diff --git a/.gitattributes b/.gitattributes
index 3560973e..b27055ec 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -1,32 +1,32 @@
-# THIS REPOSITORY'S OWN INSTALLER COMPARES ITS BYTES, so the bytes have to be
-# the same bytes on every platform.
+# THE BYTES A CLONE SEES ARE THE BYTES THIS ROOT'S CHECKS DESCRIBE.
 #
-# `openRepoTools --install` decides between `installed at`, `updated at` and
-# `already installed … (unchanged)` with `cmp -s`, and
-# `tests/test_openrepotools_command.py` compares an installed copy to this
-# checkout's file BYTE FOR BYTE. Git for Windows' installer default is
-# `core.autocrlf=true`; a checkout of THIS repository made under it turns every
-# `\n` in `openRepoTools`, `park`, `resume` and `status` into `\r\n`, and every one
-# of those comparisons is about line endings rather than about content — a
-# second `--install` reporting three files `updated at` on a machine where
-# nothing changed, and a colleague whose only sin was cloning on a stock
-# Windows laptop watching the suite fail on lines nobody touched. CI never sees
-# it: the Linux and macOS jobs check out LF by default and the Windows job pins
-# `core.autocrlf=false`.
+# `contracts/shape-pin.yaml` records a sha256 of every shape file copied here,
+# and `scripts/validate-pins.py` recomputes each one from the bytes on disk.
+# Git for Windows' installer default is `core.autocrlf=true`; a clone made under
+# it writes CRLF into the worktree, and `make validate` then goes red on every
+# pinned file for a colleague who did nothing but clone this repository
+# (openRepoShape #51, ruled by Brett Heap on 2026-09-05; the shape's own
+# statement of the rule is `shape/.gitattributes`, pinned and left in place).
 #
-# The same rule for a second reason. `tests/test_park_resume_commands.py`
-# asserts that `park`, `resume` and `status` carry the shared estate resolver
-# BYTE FOR BYTE — that is what makes the deliberate duplication safe — and a CRLF
-# checkout would either break the claim or hide a real drift behind it.
+# Before the split into three repositories this file carried the same rule for
+# a second reason: `openRepoTools --install` and its tests compare installed
+# copies with the checkout BYTE FOR BYTE. Those files are the code leg's now,
+# and a superproject's attributes never reach into a submodule's worktree, so
+# that statement moved with them, word for word, to `code/.gitattributes`; the
+# documents in `spec/` carry their own copy of the rule too.
 #
-# NO PATH IS LISTED BY NAME. Every file this repository ships is text — bash,
-# Python, YAML, Markdown, a workflow — so there is nothing for git's binary
-# heuristic to misjudge, and `text=auto` leaves that detection where it
-# belongs: with git. The pinned `upstream/openRepoShape` is a gitlink and
-# carries its own copy of this rule.
-#
-# openRepoShape #63 wrote this rule for the standard's own root, and its #51
-# (2026-09-05) wrote it for every scaffolded project; this is the same rule
-# retold for the repository that ships the two commands.
+# NO PATH IS LISTED BY NAME in the rule below: every file here is text, so
+# `text=auto` leaves binary detection with git. The block after the rule is
+# the split's (openRepoShape #471), and it stays last: the later line wins.
 
 * text=auto eol=lf
+# openRepoShape (#471): the pinned shape copies below check out with LF everywhere, as contracts/shape-pin.yaml records their bytes
+/scripts/validate-pins.py text eol=lf
+/scripts/validate-manifest.py text eol=lf
+/scripts/bootstrap.py text eol=lf
+/Makefile text eol=lf
+/.github/workflows/validate.yml text eol=lf
+/AGENTS-shape.md text eol=lf
+/scripts/repo_shape.py text eol=lf
+/scripts/validate-repository-naming.py text eol=lf
+/contracts/repository-naming.yaml text eol=lf
diff --git a/.github/release-build-requirements.txt b/.github/release-build-requirements.txt
deleted file mode 100644
index 2713ff24..00000000
--- a/.github/release-build-requirements.txt
+++ /dev/null
@@ -1,152 +0,0 @@
-# THE RELEASE BUILD'S OWN TOOLS, LOCKED BY HASH (opensoft/openRepoTools#228,
-# research R11).
-#
-# COPIED FROM openRepoShape v1.1.0: every line below this header is the lock
-# at that repository's tag v1.1.0 (`190133d`), byte for byte. Only this
-# header is rewritten, for this repository.
-#
-# `.github/workflows/release.yml`'s `build` job installs exactly the files
-# named here, with `--require-hashes --only-binary :all:`, into a virtual
-# environment of its own, and builds the wheel with
-# `python -m build --wheel --no-isolation` in it. So every program that
-# touches the wheel before it is uploaded, the `build` frontend and the
-# `hatchling` backend, is a file this list names by its digest, and so is
-# each of hatchling's own requirements: packaging, pathspec, pluggy,
-# trove-classifiers, and tomli below Python 3.11. `pyproject.toml` pins
-# hatchling alone, so a build that installs it the ordinary way, in pip's
-# isolated build environment, resolves those five on the day it runs.
-#
-# `.github/workflows/tests.yml`'s `package` job reads one entry, tomli's: it
-# copies the requirement line and every `--hash` line under it into a file
-# under `$RUNNER_TEMP`, and installs that by hash, wheels only, before
-# pytest. The job holds no digest of its own, but the pipx lock,
-# `.github/release-pipx-requirements.txt`, carries this same `tomli` entry,
-# byte for byte, and the job installs that lock after this file's `tomli`
-# (step 7 after step 4), so its tests run on the pipx lock's `tomli`. The two
-# entries must move together, re-resolved in one act.
-# The job's own two builds are `pip wheel`, in pip's isolated build
-# environment, which this lock does not reach.
-#
-# `hatchling==1.27.0` IS `pyproject.toml`'s OWN PIN, and must stay so: with
-# `--no-isolation`, `build` refuses a backend that does not satisfy
-# `[build-system] requires`, and `tests/test_release_workflow.py` holds the
-# two equal.
-#
-# UNIVERSAL: one file for every Python from 3.9, the oldest the package
-# supports, on every system. The markers choose what pip installs on each
-# Python, which is why tomli's entry serves the `package` job's 3.9.
-#
-# RESOLVED, NOT WRITTEN BY HAND, by openRepoShape with uv 0.12.18, from PyPI
-# as it stood at 2026-10-01T00:00:00Z. The command below, with that date as
-# `<date>`, gives every line under this header again (checked with uv
-# 0.12.18 on 2026-10-18). To change it, run the command with a newer date,
-# put this header back above the output, rewritten for that date, and commit
-# the diff as its own act:
-#
-#     printf 'build\nhatchling==1.27.0\n' \
-#       | uv pip compile --universal --python-version 3.9 --generate-hashes \
-#           --no-header --index-url https://pypi.org/simple --only-binary :all: \
-#           --exclude-newer <date> - -o .github/release-build-requirements.txt
-
-build==1.4.4 ; python_full_version < '3.10' \
-    --hash=sha256:8c3f48a6090b39edec1a273d2d57949aaf13723b01e02f9d518396887519f64d \
-    --hash=sha256:f832ae053061f3fb524af812dc94b8b84bac6880cd587630e3b5d91a6a9c1703
-build==1.6.1 ; python_full_version >= '3.10' \
-    --hash=sha256:51cc11666391ab6f092070437ac747002ff46f3e4113a3622177ee6b488bfc53 \
-    --hash=sha256:ecd351a4be9d35a9eaaba244a7687143c9c7d4aea6ac964e7e7ddab20cbcf4e7
-colorama==0.4.6 ; os_name == 'nt' \
-    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
-    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
-    # via build
-hatchling==1.27.0 \
-    --hash=sha256:971c296d9819abb3811112fc52c7a9751c8d381898f36533bb16f9791e941fd6 \
-    --hash=sha256:d3a2f3567c4f926ea39849cdf924c7e99e6686c9c8e288ae1037c8fa2a5d937b
-importlib-metadata==8.7.1 ; python_full_version < '3.10' \
-    --hash=sha256:49fef1ae6440c182052f407c8d34a68f72efc36db9ca90dc0113398f2fdde8bb \
-    --hash=sha256:5a1f80bf1daa489495071efbb095d75a634cf28a8bc299581244063b53176151
-    # via build
-importlib-metadata==9.0.1 ; python_full_version >= '3.10' and python_full_version < '3.10.2' \
-    --hash=sha256:ab830580bc0ef3db61ce8fae716389e5462b67e033018bab6d8f80ef17172f99 \
-    --hash=sha256:bba5600596a7e21f3eef53281cf28d6a5195634d2f2b78ff9501a3272c6eaab0
-    # via build
-packaging==26.3 \
-    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
-    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
-    # via
-    #   build
-    #   hatchling
-pathspec==1.1.1 \
-    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
-    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
-    # via hatchling
-pluggy==1.6.0 \
-    --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
-    --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
-    # via hatchling
-pyproject-hooks==1.3.3 \
-    --hash=sha256:5fc53fdac9f7bd63fbcdc868fb5f90b4784d78a53a3d3388cd738b807441a20b \
-    --hash=sha256:defda19b854fa0d3bd4f76ea4ddcba8abd7dcfcdd585a6690ade050744fc5f43
-    # via build
-tomli==2.4.1 ; python_full_version < '3.11' \
-    --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
-    --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
-    --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
-    --hash=sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d \
-    --hash=sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd \
-    --hash=sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26 \
-    --hash=sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54 \
-    --hash=sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6 \
-    --hash=sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c \
-    --hash=sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a \
-    --hash=sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd \
-    --hash=sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f \
-    --hash=sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5 \
-    --hash=sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9 \
-    --hash=sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662 \
-    --hash=sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9 \
-    --hash=sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1 \
-    --hash=sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585 \
-    --hash=sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e \
-    --hash=sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c \
-    --hash=sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41 \
-    --hash=sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f \
-    --hash=sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085 \
-    --hash=sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15 \
-    --hash=sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7 \
-    --hash=sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c \
-    --hash=sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36 \
-    --hash=sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076 \
-    --hash=sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac \
-    --hash=sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8 \
-    --hash=sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232 \
-    --hash=sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece \
-    --hash=sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a \
-    --hash=sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897 \
-    --hash=sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d \
-    --hash=sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4 \
-    --hash=sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917 \
-    --hash=sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396 \
-    --hash=sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a \
-    --hash=sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc \
-    --hash=sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba \
-    --hash=sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f \
-    --hash=sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257 \
-    --hash=sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30 \
-    --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
-    --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
-    --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
-    # via
-    #   build
-    #   hatchling
-trove-classifiers==2026.9.21.13 \
-    --hash=sha256:0a9ebc8d4e2f3e8a22848c5258033035bec17a3012ac3fea16dbaa764489eb71 \
-    --hash=sha256:8b1ff4f9c191b1040b71c37f1e445ab99732911e3cd91de52838453a854d7a17
-    # via hatchling
-zipp==3.23.1 ; python_full_version < '3.10' \
-    --hash=sha256:0b3596c50a5c700c9cb40ba8d86d9f2cc4807e9bedb06bcdf7fac85633e444dc \
-    --hash=sha256:32120e378d32cd9714ad503c1d024619063ec28aad2248dc6672ad13edfa5110
-    # via importlib-metadata
-zipp==4.1.0 ; python_full_version >= '3.10' and python_full_version < '3.10.2' \
-    --hash=sha256:25ad4e16390cd314347dd8f1de67a2ac538ae658ed4ab9db16029c07c188e97f \
-    --hash=sha256:4cb57381f544315db7688e976e922a2b18cdb513d21cc194eb42232ba2a3e602
-    # via importlib-metadata
diff --git a/.github/release-pipx-requirements.txt b/.github/release-pipx-requirements.txt
deleted file mode 100644
index 7f6c9b1d..00000000
--- a/.github/release-pipx-requirements.txt
+++ /dev/null
@@ -1,132 +0,0 @@
-# THE pipx THAT INSTALLS THE WHEEL IN CI, LOCKED BY HASH
-# (opensoft/openRepoTools#228, research R11).
-#
-# COPIED FROM openRepoShape v1.1.0: every line below this header is the lock
-# at that repository's tag v1.1.0 (`190133d`), byte for byte. Only this
-# header is rewritten, for this repository.
-#
-# Two jobs install exactly the files named here, by hash and wheels only,
-# then install the openrepotools wheel with that pipx, as a person does:
-# `.github/workflows/release.yml`'s `install` job, the install check, on each
-# of its three legs (ubuntu and macOS on Python 3.x, and ubuntu on 3.9), and
-# `.github/workflows/tests.yml`'s `package` job, on 3.9, with `PIPX_HOME`
-# and `PIPX_BIN_DIR` under `$RUNNER_TEMP`.
-#
-# UNIVERSAL, for Linux, macOS and Windows, though no job here runs on
-# Windows: pipx 1.11.1 below Python 3.10, the newest pipx that installs on
-# 3.9 (the package's oldest Python), and 1.17.8 from 3.10, the newest on
-# PyPI at the date below. `tests/test_release_workflow.py` holds those two
-# versions, and `tests/package_layout.py`'s fixtures mirror their layouts,
-# so a resolution that moves pipx must move both with it. pipx then installs
-# pip into its own shared environment, which no lock here reaches; the
-# install check's `PIP_INDEX_URL` holds every pip it runs to PyPI.
-#
-# RESOLVED, NOT WRITTEN BY HAND, by openRepoShape with uv 0.12.18, from PyPI
-# as it stood at 2026-10-01T00:00:00Z. The command below, with that date as
-# `<date>`, gives every line under this header again (checked with uv
-# 0.12.18 on 2026-10-18). To change it, run the command with a newer date,
-# put this header back above the output, rewritten for that date, and commit
-# the diff as its own act:
-#
-#     printf 'pipx\n' \
-#       | uv pip compile --universal --python-version 3.9 --generate-hashes \
-#           --no-header --index-url https://pypi.org/simple --only-binary :all: \
-#           --exclude-newer <date> - -o .github/release-pipx-requirements.txt
-
-argcomplete==3.7.0 ; python_full_version < '3.10' \
-    --hash=sha256:afde224f753f874807b1dc1414e883ab8fe0cda9c04807b6047dcb8e1ac23913 \
-    --hash=sha256:d8f0f22d2a8a7caa383be1e22b6caf1ecaf0ebd10d8f83cc125e36540c95830c
-    # via pipx
-argcomplete==3.7.2 ; python_full_version >= '3.10' \
-    --hash=sha256:6029205678bdd9c1c728a155f5f9ecf5812393f969eef58807641a2bc2aa5b19 \
-    --hash=sha256:aad8b69a0b9969edb62db0d1752354c0d50717b10e0cbb00e2a958381b9fc6b9
-    # via pipx
-click==8.1.8 ; python_full_version < '3.10' \
-    --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
-    --hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
-    # via userpath
-click==8.5.0 ; python_full_version >= '3.10' \
-    --hash=sha256:255bc9599cf7748b4b1a446ccc735421bd08a2ae529a8b88597d3de5664ee360 \
-    --hash=sha256:ba0d2089de75ea0310e2dde03160e6ca10009947fb95a182f9b54021bb272e34
-    # via userpath
-colorama==0.4.6 ; sys_platform == 'win32' \
-    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
-    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
-    # via
-    #   click
-    #   pipx
-filelock==4.0.7 ; python_full_version >= '3.10' \
-    --hash=sha256:a93c4d93269b339a6af4848342c7e940d0f9928ad95eff64764699e5f1bf8a6a \
-    --hash=sha256:da5915714a70b55d167fdc7e251ad91302b0a36816fb574dfafae8f4f2c9bb21
-    # via pipx
-packaging==26.3 \
-    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
-    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
-    # via pipx
-pipx==1.11.1 ; python_full_version < '3.10' \
-    --hash=sha256:e57354c3308b0abb75106d3b73a0d1ffa5c25f24f29e9f4a45e575776dbab85c \
-    --hash=sha256:f854fbf01c179db4331adcf6e1b95836b524100135b5d35822497a47a3857e89
-pipx==1.17.8 ; python_full_version >= '3.10' \
-    --hash=sha256:19387d1ef29f9192dfb084f22a68f5f663c2e80c6c814bef193b3203a4fc2dc3 \
-    --hash=sha256:90810ac9a12a5141364294a1abc24bcc8fab4572d18a6dae165895512e336966
-platformdirs==4.4.0 ; python_full_version < '3.10' \
-    --hash=sha256:abd01743f24e5287cd7a5db3752faf1a2d65353f38ec26d98e25a6db65958c85 \
-    --hash=sha256:ca753cf4d81dc309bc67b0ea38fd15dc97bc30ce419a7f58d13eb3bf14c4febf
-    # via pipx
-platformdirs==4.12.2 ; python_full_version >= '3.10' \
-    --hash=sha256:29dbf06d96c500bc6bdbce75fb0a14d63279c93b1842f97e72a135b33e856983 \
-    --hash=sha256:eab5f70271a490ef74618bb314fbb86e3c7e82fa3b9c922c2ea0e0a1a155d329
-    # via pipx
-tomli==2.4.1 ; python_full_version < '3.11' \
-    --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
-    --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
-    --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
-    --hash=sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d \
-    --hash=sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd \
-    --hash=sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26 \
-    --hash=sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54 \
-    --hash=sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6 \
-    --hash=sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c \
-    --hash=sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a \
-    --hash=sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd \
-    --hash=sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f \
-    --hash=sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5 \
-    --hash=sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9 \
-    --hash=sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662 \
-    --hash=sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9 \
-    --hash=sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1 \
-    --hash=sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585 \
-    --hash=sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e \
-    --hash=sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c \
-    --hash=sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41 \
-    --hash=sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f \
-    --hash=sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085 \
-    --hash=sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15 \
-    --hash=sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7 \
-    --hash=sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c \
-    --hash=sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36 \
-    --hash=sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076 \
-    --hash=sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac \
-    --hash=sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8 \
-    --hash=sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232 \
-    --hash=sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece \
-    --hash=sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a \
-    --hash=sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897 \
-    --hash=sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d \
-    --hash=sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4 \
-    --hash=sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917 \
-    --hash=sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396 \
-    --hash=sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a \
-    --hash=sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc \
-    --hash=sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba \
-    --hash=sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f \
-    --hash=sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257 \
-    --hash=sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30 \
-    --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
-    --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
-    --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
-    # via pipx
-userpath==1.9.2 \
-    --hash=sha256:2cbf01a23d655a1ff8fc166dfb78da1b641d1ceabf0fe5f970767d380b14e89d \
-    --hash=sha256:6c52288dab069257cc831846d15d48133522455d4677ee69a9781f11dbefd815
-    # via pipx
diff --git a/.github/workflows/composed.yml b/.github/workflows/composed.yml
new file mode 100644
index 00000000..35005a2f
--- /dev/null
+++ b/.github/workflows/composed.yml
@@ -0,0 +1,121 @@
+name: composed
+
+# THE EXACT-PIN INTEGRATION GATE (opensoft/openRepoTools#186, T010 of
+# `specs/004-migrate-to-triad/tasks.md`; FR-008). `validate` beside this file
+# says the three records of each leg agree — gitlink, pin, digest. This says
+# the code those records name PASSES ITS OWN SUITE, composed with the spec leg
+# and the dependency it was pinned beside: the whole arrangement at the exact
+# commits this root records, and nothing allowed to skip its way to green.
+#
+# WHY A SIBLING AND NOT A JOB IN `validate.yml`: that file is a COPY of
+# openRepoShape's, digest-pinned in `contracts/shape-pin.yaml`. An edit to it
+# is drift `scripts/validate-pins.py` and `status` both report. This file is
+# this project's own, and it references no leg by `<org>/<leg>@<sha>`, so the
+# lockstep rule has nothing in it to move.
+#
+# LINUX ONLY, on purpose. The platform matrix — macOS's bash 3.2 parse and its
+# `ready`-label suite, Windows and the no-submodule skip path — is the code
+# leg's own `tests` workflow, and it stays there. What only this root can run
+# is the COMPOSED suite: `OPENREPOTOOLS_COMPOSED=1` turns every absent root
+# into a refusal and every check that would have skipped for want of one into
+# a failure, so a green run here is a claim about all three legs at once.
+#
+# IT REFUSES ABSENT CONTEXT TWICE OVER. The step below fails on any missing
+# leg, pin or dependency file before a test runs; and the suite's own
+# `tests/conftest.py` refuses a composed session (pytest's exit 4) when the
+# assembly or spec root is absent, the dependency is not initialized, or the
+# code or spec leg is not at the commit this root records for it. A leg this
+# job cannot fetch — a private leg with no credential — fails the checkout,
+# which is the same refusal: composed acceptance with a leg missing is the one
+# thing this job must never report. The legs are fetched over https, as
+# `.gitmodules` names them; nothing here allows a `file://` transport.
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  exact-pins:
+    # THIS UBUNTU RUNNER IS ON 24.04: `ubuntu-latest` became Ubuntu 26.04 on
+    # 2026-10-21. There the `[host]` case of the TERM-ignoring kill test, which
+    # this job's suite runs, fails. Pinned until 26.04 support is decided.
+    runs-on: ubuntu-24.04
+    steps:
+      # PINNED BY COMMIT, the same two actions the code leg pins. RECURSIVE:
+      # the legs, and the dependency nested in the code leg.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
+        with:
+          submodules: recursive
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: '3.x'
+
+      - name: every context the composed run claims is here
+        run: |
+          set -euo pipefail
+          missing=0
+          for need in project.yaml contracts/code-pin.yaml contracts/spec-pin.yaml \
+                      code/openRepoTools code/tests/run.sh code/tests/conftest.py \
+                      code/contracts/openreposhape-pin.yaml \
+                      code/upstream/openRepoShape/scripts/repo_shape.py \
+                      code/upstream/openRepoShape/templates/workspace-root/README.md; do
+            if [ ! -f "$need" ]; then
+              echo "::error::the composed run needs $need, and this checkout has none"
+              missing=1
+            fi
+          done
+          if [ ! -d spec/openspec ] && [ ! -d spec/specs ] && [ ! -d spec/docs ]; then
+            echo "::error::the spec leg is not checked out at spec/"
+            missing=1
+          fi
+          git submodule status --recursive
+          exit "$missing"
+
+      # The same two the `validate` workflow runs, here as the gate's FIRST
+      # half: a suite that passes at a gitlink the pin does not name passes
+      # at the wrong commit.
+      - name: the manifest and the lockstep pins
+        run: |
+          python3 scripts/validate-manifest.py
+          python3 scripts/validate-pins.py
+
+      # ZSH, SO THE SUITE'S ZSH CASES RUN (opensoft/openRepoTools#186, T014 of
+      # `specs/004-migrate-to-triad/tasks.md`). On this runner a composed run
+      # skips 66 conditional cases: 60 that need zsh, 1 byte-count case and 5
+      # wheel cases. With zsh installed the 60 run, and the 6 skips left are the
+      # byte-count case and the five wheel cases, as in rehearsal D's composed
+      # run on a bench that has zsh; `-rs` below still lists every skip. Not
+      # pinned, as `python-version: '3.x'` above is not: the step prints the
+      # zsh it installed.
+      - name: install zsh, so the suite's zsh cases run
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends zsh
+          command -v zsh
+          zsh --version
+
+      - name: install the test runner
+        run: python3 -m pip install --disable-pip-version-check pytest==8.3.4
+
+      - name: git identity for the fixture commits (env, not global config)
+        run: |
+          {
+            echo "GIT_AUTHOR_NAME=openRepoTools CI"
+            echo "GIT_AUTHOR_EMAIL=ci@openrepotools.invalid"
+            echo "GIT_COMMITTER_NAME=openRepoTools CI"
+            echo "GIT_COMMITTER_EMAIL=ci@openrepotools.invalid"
+          } >> "$GITHUB_ENV"
+
+      # THE CODE LEG'S OWN ENTRY POINT, serialized as it is everywhere: the
+      # roots are named, not inferred, and `-rs` prints any skip that remains
+      # (a platform one; none for want of a root can reach this far).
+      - name: the code leg's suite, composed, at the exact pins
+        env:
+          OPENREPOTOOLS_COMPOSED: '1'
+          OPENREPOTOOLS_ASSEMBLY_ROOT: ${{ github.workspace }}
+          OPENREPOTOOLS_SPEC_ROOT: ${{ github.workspace }}/spec
+        run: bash code/tests/run.sh -rs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 092ddc05..00000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,1736 +0,0 @@
-name: release
-
-# ---------------------------------------------------------------------------
-# PUBLISH THE openrepotools WHEEL (#228): TestPyPI, AN INSTALL CHECK ON THREE
-# LEGS, THEN PyPI, IN ONE DISPATCHED RUN. Adapted step for step from
-# openRepoShape v1.1.0's own release.yml (`190133d`, the commit
-# `upstream/openRepoShape` is pinned at), whose checks are taken over as they
-# are (FR-028) except where design.md Decision 10 names a difference:
-#   - a pre-release `X.Y.ZrcN` is accepted, for TestPyPI alone; PyPI takes a
-#     final `X.Y.Z` and nothing else;
-#   - the repository guard (FR-048, WHERE RELEASES COME FROM below) is new
-#     here, because the model has none;
-#   - the stamp has a fifth field, REPOSITORY, the run's `$GITHUB_REPOSITORY`;
-#   - the digest's definition is held to the literal `sorted-ls-tree-r-v1`
-#     that `--version` prints and to the pin's `digest_definition`, where the
-#     model compares it with its package's own constant;
-#   - the payload's blobs and modes are checked under
-#     `openrepotools/payload/`, against the commit's own paths;
-#   - the install check runs on three legs, ubuntu and macOS on Python 3.x
-#     and ubuntu on 3.9, with no Windows leg, checking `--version` and an
-#     offline `--install` beside pipx's link, again under macOS's
-#     `/bin/bash` 3.2, and compiling the payload's two Python commands on
-#     3.9;
-#   - no step reads the release notes (WHAT THIS WORKFLOW NEVER READS).
-# It also holds more than the model where FR-029 and contracts/workflows.md
-# ask for it: the gate names `tests.yml`'s four jobs, the build checks out
-# full history with the submodule, and the ref step fetches the tag again
-# without `--depth`.
-#
-# FOUR JOBS, EACH GATED ON THE ONE BEFORE IT:
-#   build     the version and the repository guard; the tag, the branch, the
-#             clean checkout, both environments, `tests.yml`'s four jobs on
-#             this commit, and the digest; then the wheel, built twice from
-#             two `git archive` extractions of the commit, stamped, compared
-#             byte for byte, checked against the commit's own files, and its
-#             sha256 recorded.
-#   testpypi  the guard again; uploads those bytes to TestPyPI, in the
-#             `testpypi` environment, then requires TestPyPI to serve
-#             exactly that digest.
-#   install   on ubuntu, macOS and Python 3.9: pipx installs TestPyPI's
-#             file, taken by the recorded digest (on a branch, the build's
-#             own wheel), and the one command it places is run.
-#   pypi      the guard again; uploads the same bytes to PyPI, in the `pypi`
-#             environment, which waits for Brett Heap's approval after the
-#             install check, then requires PyPI to serve exactly the
-#             recorded digest.
-#
-# DISPATCH ONLY. Nothing here runs on a push, a tag or a pull request: an
-# upload is an act Brett Heap approves. The version is the tag's: `v1.1.0`
-# gives `1.1.0`, which the build writes into the stamp,
-# `openrepotools/_release.py`, with the tag, the commit, the digest and the
-# repository. A dispatch on a tag refuses unless that tag is `v<version>`,
-# annotated, and pointing at the run's own commit, and unless that commit is
-# on `main` or on the version's release branch, `release/v<major>.<minor>`.
-#
-# RE-RUN ONLY THE FAILED JOBS ("Re-run failed jobs"), never the whole run
-# and never a second dispatch of a version already uploaded. A re-run of a
-# failed job reuses the build's artifact and its recorded digest, and each
-# upload job requires the index to hold no file of the version but the
-# verified wheel at its digest (FR-031), so a re-run after an upload that
-# went through uploads nothing new. A second dispatch builds again, and its
-# wheel is the same file only while the locks, the runner's Python and the
-# commit all stay the same; the index keeps the first file under its name
-# for good, and the upload jobs refuse any other.
-#
-# NO PyPI TOKEN AND NO STORED SECRET, ANYWHERE. Both uploads use trusted
-# publishing (OIDC): `id-token: write` is granted to the two upload jobs and
-# to no other job. The one other credential is GitHub's automatic
-# GITHUB_TOKEN, read-only in every job, which `gh` uses to read this
-# repository's own API.
-#
-# EVERY ACTION IS PINNED BY COMMIT, with its release tag beside it, as
-# `tests.yml` pins them: checkout and setup-python at that file's own
-# commits, the artifact actions at the model's. One limit carried over from
-# the model, where it was accepted: pypa/gh-action-pypi-publish is a
-# container action whose image is pulled by a registry tag, so its commit
-# pins the action's files and not all the code an upload runs. The digest
-# checks before and after each upload bound what that could change.
-#
-# RELEASING: THE PROCEDURE (FR-034 to FR-040). Brett Heap decides every
-# tag, every release-branch cut and every upload, and approves each
-# deployment. The release owner, lane openRepoTools-3, carries them out on
-# his word: it tags, dispatches and creates the GitHub Release, and no other
-# lane does. For each release:
-#   1. THE COMMIT'S CI FIRST. A tag waits for its commit's `tests.yml` runs:
-#      all of them finished, and the newest green, in a push or dispatch run
-#      (the build's gate counts no `pull_request` run). On `main` the push
-#      run that landed the commit does that once it has finished green; on
-#      `release/vX.Y` the branch's own push run does, and for a commit that
-#      reached the branch by fast-forward the newer of main's run and the
-#      branch's decides (FR-039). Otherwise, BEFORE TAGGING, dispatch
-#      `tests.yml` on a branch that points at the release commit, and wait
-#      for it:
-#        git push origin <release-commit>:refs/heads/<branch>
-#        gh workflow run tests.yml --ref <branch> -R <repository>
-#   2. THE TAG, ANNOTATED, on Brett Heap's word, with the message `v1.0.0`'s
-#      has (FR-036), `<time>` the exact UTC second of his word:
-#        openRepoTools vX.Y.Z
-#
-#        <a paragraph: what the release is>
-#
-#        Tagged on Brett Heap's word (<time>, "<words>")
-#        Lane: <lane>
-#      then push it:
-#        git tag -a vX.Y.Z <release-commit> -F <message-file>
-#        git push origin refs/tags/vX.Y.Z
-#   3. DISPATCH THIS WORKFLOW ON THE TAG, with `version` set to X.Y.Z:
-#        gh workflow run release.yml --ref vX.Y.Z -f version=X.Y.Z \
-#            -R <repository>
-#   4. APPROVE `testpypi`, Brett Heap's act. The install check then runs on
-#      its three legs; approve `pypi` once it has passed.
-#   5. ONLY AFTER PyPI SERVES THE VERSION, the GitHub Release, from a
-#      checkout that has the spec leg, so the notes never name a version
-#      PyPI lacks:
-#        gh release create v<version> --repo <repository> --verify-tag \
-#            --notes-file <spec>/docs/release-notes/v<version>.md
-#   6. FOR vX.Y.0, THEN CUT `release/vX.Y` AT THE TAG, on his word:
-#        git push origin 'vX.Y.0^{commit}:refs/heads/release/vX.Y'
-#
-# THE BRANCH AND TAG POLICY, opensoft/openRepoShape#850's (Brett Heap's
-# ruling of 2026-10-17T19:52:26Z; FR-036 to FR-041):
-#   - THE TRUNK is `main`, and every PR lands on it.
-#   - A RELEASE IS AN ANNOTATED TAG `vX.Y.Z`, never a branch and never a
-#     committed version number. A tag is never moved, never deleted and
-#     never reused once it is pushed.
-#   - `release/vX.Y` IS CUT AT THE `vX.Y.0` TAG, right after the tag, and
-#     each patch `vX.Y.Z`, Z above 0, is tagged on it.
-#   - BACK-PORTS. A fix lands on `main` first, through its own review and CI.
-#     While `main` holds only that patch line's work, `release/vX.Y` takes it
-#     by a fast-forward or by a merge of `main`; otherwise by a PR to
-#     `release/vX.Y` of `git cherry-pick -x <squash commit>`.
-#   - THE LANES' SIDE: one HOLD at a time on `release/vX.Y`; the lane that
-#     landed the PR makes the back-port, unless the release owner
-#     fast-forwards; and the LANDED line names both commits, main's and the
-#     branch's.
-#   - PATCH TAGS WAIT FOR THE NEWEST RUN: a patch is tagged on
-#     `release/vX.Y` only once that commit's `tests.yml` runs have all
-#     finished and the newest is green.
-#   - ONE UPLOAD PER VERSION. An index never takes a file name twice, so a
-#     bad upload is fixed by the next patch, never by moving a tag or
-#     reusing one.
-#   - The `release/*` ruleset is Brett Heap's choice, which #850 leaves to
-#     him: no force-push and no deletion keeps fast-forward back-ports, and a
-#     rule requiring a PR makes every back-port a cherry-pick.
-#
-# TWO REHEARSALS, AND NEVER 1.1.0 (FR-033). No rehearsal uses the version
-# `1.1.0` itself: an index never takes a file name twice, and v1.1.0 is
-# built later, from another commit, in opensoft/openRepoTools-code.
-#   - THE BRANCH REHEARSAL. A dispatch on a branch builds, checks and
-#     installs, and uploads nothing: the build's checks all run (the ref step
-#     and the branch step stand down, because a branch has no tag and no
-#     release branch to be on, FR-029), the install check runs on all three
-#     legs over the build's own wheel in place of TestPyPI's, the guard
-#     records `to-testpypi` and `to-pypi` as `false` on every branch, both
-#     upload jobs run only on a `v*` tag, and both environments admit only
-#     the tags `v*`. It builds with the version of the tag it rehearses, as
-#     the model rehearsed v1.1.0 from its branch `l3-rehearsal-v1.1.0`. Before
-#     v1.1.0 that is the next pre-release, so the first branch rehearsal is
-#        gh workflow run release.yml --ref <branch> -f version=1.1.0rc1 \
-#            -R opensoft/openRepoTools
-#     A branch dispatch with `version=1.1.0` would build a 1.1.0 wheel. It
-#     would upload nothing, but this procedure forbids it.
-#   - THE CI GATE HOLDS IN A REHEARSAL TOO, and it counts only push and
-#     dispatch runs. A feature branch's commit has only `pull_request` runs,
-#     so dispatch `tests.yml` on that branch first, and wait for it to
-#     finish green:
-#        gh workflow run tests.yml --ref <branch> -R opensoft/openRepoTools
-#   - THE TestPyPI REHEARSAL. A pre-release `X.Y.ZrcN`, `1.1.0rc1` first,
-#     dispatched on its own annotated tag in opensoft/openRepoTools, on
-#     Brett Heap's word as any tag is, reaches TestPyPI and the install
-#     check, and the `pypi` job is skipped: the build records `to-pypi` as
-#     `false` for a pre-release, so it never asks for the `pypi` approval.
-#
-# WHERE RELEASES COME FROM (FR-041, FR-048).
-#   - FROM v1.1.0 ON, release tags are made in opensoft/openRepoTools-code,
-#     the triad's code leg, where the release is built. `v1.0.0` and every
-#     `rc` rehearsal tag stay in opensoft/openRepoTools, which becomes the
-#     assembly, and no tag is carried from one repository to another.
-#   - THE REPOSITORY GUARD (FR-048), the build's first step, decides from
-#     `$GITHUB_REPOSITORY`, the ref and the version, before any approval is
-#     asked. Each upload job's condition reads its record, and the job's
-#     first step checks the rule again:
-#       opensoft/openRepoTools-code  a tag     X.Y.Z     TestPyPI, then PyPI
-#       opensoft/openRepoTools-code  a tag     X.Y.ZrcN  TestPyPI alone
-#       opensoft/openRepoTools       a tag     X.Y.ZrcN  TestPyPI alone
-#       opensoft/openRepoTools       a tag     X.Y.Z     refused
-#       any other repository         a tag     any       refused
-#       any repository               a branch  any       nothing: the rehearsal
-#     So opensoft/openRepoTools sends a pre-release to TestPyPI and nothing
-#     to PyPI, and every other repository uploads nothing. The names are
-#     compared exactly, as GitHub spells them. opensoft/openRepoTools has no
-#     pypi.org publisher at all, which is the second line of defence.
-#   - opensoft/openRepoTools-code STAYS PUBLIC: the ref step fetches the tag
-#     from it with no credentials, as the model does, and the migration
-#     creates it public.
-#   - BRETT HEAP'S ACTS, NONE OF THEM A LANE'S. The build refuses every
-#     dispatch until both environments exist with their rules.
-#     - In the repository that releases, the environments `testpypi` and
-#       `pypi`, each with brettheap as the required reviewer, self-review
-#       allowed, administrators not bypassing, and a deployment limit of
-#       exactly one tag rule, `v*`.
-#     - The ruleset on the tags `v*`, "Release tags v*: only admins create,
-#       move or delete". It is not checked here (ACCEPTED LIMITS).
-#     - On test.pypi.org, the trusted publisher for opensoft/openRepoTools:
-#       project `openrepotools`, workflow `release.yml`, environment
-#       `testpypi`.
-#     - At the cutover, for opensoft/openRepoTools-code: its two
-#       environments and its tag ruleset, the test.pypi.org publisher
-#       pointed at it, and on pypi.org the project's only publisher,
-#       `release.yml` with the environment `pypi`. v1.1.0 is published only
-#       once both publishers and both environments exist.
-#     THE ENVIRONMENT IS REQUIRED in every publisher, though the form calls
-#     it optional. A publisher that names none accepts a token from ANY job
-#     of a `release.yml` in its repository, so a branch's own copy of this
-#     file could drop `environment:` from an upload job and publish with no
-#     approval and no tag limit.
-#   - ACCEPTED LIMITS, the model's, carried over where they were accepted:
-#     - A deployment limit admits a tag by its NAME. Anyone who can push a
-#       `v*` tag can dispatch on it, and the run is that tag's own copy of
-#       this file, whatever it says. The checks here bind only where the tag
-#       carries the reviewed file, which is why the tag ruleset matters.
-#     - The required reviewer's approval is therefore the last line, and lane
-#       sessions act as brettheap, the reviewer. An approval is a deliberate
-#       act of his, never a session's.
-#
-# WHAT THIS WORKFLOW NEVER READS (FR-046): the release notes, and anything
-# the code leg will not hold. After the cutover it runs in
-# opensoft/openRepoTools-code, which holds none of `docs/`, `openspec/`,
-# `specs/`, `README.md`, `AGENTS.md` and `CLAUDE.md`, so no step names one.
-# `LICENSE` is the one root file the build reads, because the code leg's
-# first commit gives it a byte-identical copy. The release notes are read
-# by the person who creates the GitHub Release (step 5), never by a step.
-# ---------------------------------------------------------------------------
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: >-
-          The version to publish, X.Y.Z, or a pre-release X.Y.ZrcN for
-          TestPyPI alone. Dispatch on the tag vX.Y.Z (or vX.Y.ZrcN) to
-          publish it; a dispatch on a branch is a rehearsal and uploads
-          nothing.
-        required: true
-        type: string
-
-# Nothing by default. Each job grants itself exactly what it uses.
-permissions: {}
-
-# One release at a time, and a running one is never cancelled halfway.
-concurrency:
-  group: release
-  cancel-in-progress: false
-
-defaults:
-  run:
-    # `bash -eo pipefail`, on every runner.
-    shell: bash
-
-env:
-  # The input reaches every script through the environment, never pasted
-  # into one by an expression, so no input can become shell or Python.
-  VERSION: ${{ inputs.version }}
-  PYTHONUTF8: '1'
-
-jobs:
-  build:
-    name: build and verify
-    # EVERY UBUNTU RUNNER IS ON 24.04: `ubuntu-latest` became Ubuntu 26.04 on
-    # 2026-10-21. There setup-python has no Python 3.9 and the `[host]` case of
-    # the TERM-ignoring kill test fails. Pinned until 26.04 support is decided.
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    permissions:
-      contents: read  # the checkout and its submodule, the tag, and the forge's compare and tree listing
-      actions: read  # the commit's tests.yml runs and their jobs, and both environments' rules
-    outputs:
-      wheel: ${{ steps.record.outputs.wheel }}
-      wheel-sha256: ${{ steps.record.outputs.wheel-sha256 }}
-      digest: ${{ steps.digest.outputs.digest }}
-      # STEP 1'S RECORD, which uploads this run may make (FR-048): each
-      # upload job's `if:` reads its own, and its first step checks again.
-      to-testpypi: ${{ steps.guard.outputs.to-testpypi }}
-      to-pypi: ${{ steps.guard.outputs.to-pypi }}
-    steps:
-      # The commit, WITH ITS SUBMODULE, because the digest code exists here
-      # only in the pinned openRepoShape (`upstream/openRepoShape`), and with
-      # full history. The token is not left in the checkout's git config,
-      # where the build backend could find it.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          submodules: true
-          fetch-depth: 0
-          persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        with:
-          python-version: '3.12'
-
-      # STEP 1, THE JOB'S FIRST SCRIPT, AFTER THE CHECKOUT AND THE PYTHON
-      # SETUP AND BEFORE ANY SCRIPT ASKS THE FORGE: THE VERSION, AND THE
-      # REPOSITORY GUARD (FR-048). The model has no guard; this one puts
-      # Brett Heap's answers on where releases come from into code.
-      #
-      # THE VERSION is a final release, X.Y.Z, or a pre-release for
-      # TestPyPI, X.Y.ZrcN, in the form its file is named by: no leading
-      # zero, nothing else after the numbers. Never 0.0.0, the committed
-      # stamp's version, which is a build from a checkout and not a release.
-      # The input is not echoed in a refusal before it is known to be plain.
-      #
-      # THE GUARD decides from `$GITHUB_REPOSITORY`, `$GITHUB_REF` and
-      # `$VERSION` alone, and records which uploads may run:
-      #   opensoft/openRepoTools-code  a tag     X.Y.Z     TestPyPI, then PyPI
-      #   opensoft/openRepoTools-code  a tag     X.Y.ZrcN  TestPyPI alone
-      #   opensoft/openRepoTools       a tag     X.Y.ZrcN  TestPyPI alone
-      #   opensoft/openRepoTools       a tag     X.Y.Z     refused
-      #   any other repository         a tag     any       refused
-      #   any repository               a branch  any       nothing: the rehearsal
-      # The two names are compared exactly, as GitHub spells them in
-      # `$GITHUB_REPOSITORY`, so any other spelling is "any other" and fails
-      # closed. A ref that is neither a tag nor a branch is refused here too,
-      # as the ref step below refuses it. A refused run records nothing, and
-      # since the build job asks for no approval, it asks for none.
-      - name: the version is X.Y.Z or X.Y.ZrcN and not the unstamped 0.0.0, and the repository guard (FR-048) says what this run may upload
-        id: guard
-        run: |
-          final='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
-          pre='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)rc(0|[1-9][0-9]*)$'
-          if [[ "$VERSION" =~ $final ]]; then
-            kind=final
-          elif [[ "$VERSION" =~ $pre ]]; then
-            kind=rc
-          else
-            echo "::error::the version input is not X.Y.Z or X.Y.ZrcN: numbers with no leading zero, and nothing else"
-            printf 'the input, quoted: %q\n' "$VERSION"
-            exit 1
-          fi
-          if [ "$VERSION" = 0.0.0 ]; then
-            echo "::error::0.0.0 is the committed stamp's version, a build from a checkout, never a release"
-            exit 1
-          fi
-          code_leg=opensoft/openRepoTools-code
-          rc_only=opensoft/openRepoTools
-          case "$GITHUB_REF" in
-            refs/heads/*)
-              to_testpypi=false
-              to_pypi=false
-              echo "a rehearsal on the branch ${GITHUB_REF#refs/heads/} of '$GITHUB_REPOSITORY': every check runs, and nothing is uploaded"
-              ;;
-            refs/tags/*)
-              if [ "$GITHUB_REPOSITORY" = "$code_leg" ]; then
-                to_testpypi=true
-                if [ "$kind" = final ]; then to_pypi=true; else to_pypi=false; fi
-              elif [ "$GITHUB_REPOSITORY" = "$rc_only" ] && [ "$kind" = rc ]; then
-                to_testpypi=true
-                to_pypi=false
-              elif [ "$GITHUB_REPOSITORY" = "$rc_only" ]; then
-                echo "::error::$rc_only releases a pre-release X.Y.ZrcN to TestPyPI and nothing else, and $VERSION is a final: a final is tagged and released in $code_leg"
-                exit 1
-              else
-                echo "::error::'$GITHUB_REPOSITORY' is neither $code_leg nor $rc_only, as GitHub spells them, so a tag dispatch here may upload nothing, and the build refuses it"
-                exit 1
-              fi
-              ;;
-            *)
-              echo "::error::a release is dispatched on a tag, or on a branch to rehearse, and this run names '$GITHUB_REF'"
-              exit 1
-              ;;
-          esac
-          {
-            echo "to-testpypi=$to_testpypi"
-            echo "to-pypi=$to_pypi"
-          } >> "$GITHUB_OUTPUT"
-          echo "version $VERSION ($kind), tag v$VERSION, in $GITHUB_REPOSITORY: to TestPyPI $to_testpypi, to PyPI $to_pypi"
-
-      # THE TAG, READ FROM THE FORGE AND FROM GIT. On a tag, the run must be
-      # dispatched on `v<version>` itself, an ANNOTATED tag (a lightweight
-      # one records no tagger and no message), whose object names this
-      # run's commit directly. On a branch the run is the rehearsal (FR-029,
-      # FR-033): this check and the next stand down, every other check below
-      # still runs, and nothing can deploy. Any other ref is refused. The
-      # checkout holds full history, so git's copy of the tag is fetched
-      # again from the forge without `--depth`, which would cut that history
-      # off at this commit.
-      - name: the dispatched ref is the annotated tag v<version> at this commit, or a branch to rehearse on
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          tag="v$VERSION"
-          case "$GITHUB_REF" in
-            "refs/tags/$tag") ;;
-            refs/heads/*)
-              echo "::notice::REHEARSAL on the branch $GITHUB_REF_NAME at $GITHUB_SHA: every check runs, the install check installs the build's own wheel, and nothing is uploaded"
-              exit 0
-              ;;
-            *)
-              echo "::error::a release is dispatched on the tag $tag, or on a branch to rehearse, and this run names $GITHUB_REF"
-              exit 1
-              ;;
-          esac
-          object="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" \
-              --jq 'select(.object.type == "tag") | .object.sha')" || object=
-          if [ -z "$object" ]; then
-            echo "::error::the forge holds no annotated tag $tag; a release tag is made with git tag -a"
-            exit 1
-          fi
-          read -r name type commit < <(gh api "repos/$GITHUB_REPOSITORY/git/tags/$object" \
-              --jq '[.tag, .object.type, .object.sha] | @tsv') || true
-          if [ "$name" != "$tag" ] || [ "$type" != commit ] || [ "$commit" != "$GITHUB_SHA" ]; then
-            echo "::error::the tag object $object is named '$name' and points at the $type $commit; a release needs $tag pointing at this run's commit $GITHUB_SHA"
-            exit 1
-          fi
-          git fetch --quiet --no-tags origin "+refs/tags/$tag:refs/tags/$tag"
-          if [ "$(git cat-file -t "refs/tags/$tag")" != tag ] \
-              || [ "$(git rev-parse "refs/tags/$tag")" != "$object" ] \
-              || [ "$(git rev-parse "refs/tags/$tag^{commit}")" != "$GITHUB_SHA" ]; then
-            echo "::error::git's $tag is not the forge's annotated tag $object at $GITHUB_SHA"
-            exit 1
-          fi
-          echo "$tag: annotated, tag object $object, at $GITHUB_SHA"
-
-      # THE COMMIT IS ON main OR ON THE VERSION'S RELEASE BRANCH. A tag can be
-      # pushed at any commit; a release is cut from one that a reviewed branch
-      # holds, as `main` itself or an ancestor of it (`identical` or `ahead`).
-      # `release/v<major>.<minor>` is where a patch on an older line is
-      # tagged (FR-037), and a pre-release's line is its own: `1.1.0rc1`
-      # belongs to `release/v1.1`. The compare names `refs/heads/<branch>`:
-      # a bare name would resolve to a tag of that name first. A rehearsal
-      # on a branch has no release branch to be on.
-      - name: the commit is on main or on the version's release branch
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          case "$GITHUB_REF" in
-            refs/heads/*)
-              echo "a rehearsal on the branch $GITHUB_REF_NAME: no release branch to be on"
-              exit 0
-              ;;
-          esac
-          found=
-          for branch in main "release/v${VERSION%.*}"; do
-            status="$(gh api "repos/$GITHUB_REPOSITORY/compare/$GITHUB_SHA...refs/heads/$branch" \
-                --jq .status 2>/dev/null)" || status=
-            case "$status" in
-              identical|ahead)
-                found="$branch"
-                echo "$GITHUB_SHA is on $branch ($status)"
-                break
-                ;;
-              *) echo "$GITHUB_SHA is not on $branch (compare: ${status:-no such branch})" ;;
-            esac
-          done
-          if [ -z "$found" ]; then
-            echo "::error::$GITHUB_SHA is on neither main nor release/v${VERSION%.*}; a release is cut from a commit one of them holds"
-            exit 1
-          fi
-
-      # THE CHECKOUT IS THIS COMMIT, AND CLEAN, before anything from it runs.
-      # The digest below is computed by the pinned submodule's own
-      # `scripts/repo_shape.py`, and a file changed or added in the work tree,
-      # or a submodule moved off its pin, would be code nobody reviewed.
-      # Ignored files count too.
-      - name: the checkout is this commit, and clean
-        run: |
-          head="$(git rev-parse HEAD)"
-          if [ "$head" != "$GITHUB_SHA" ]; then
-            echo "::error::the checkout is at $head, and this run is at $GITHUB_SHA"
-            exit 1
-          fi
-          dirty="$(git status --porcelain=v1 --untracked-files=all --ignored=matching)"
-          if [ -n "$dirty" ]; then
-            echo "::error::the checkout is not clean, so the release would not be the commit's own bytes:"
-            printf '%s\n' "$dirty"
-            exit 1
-          fi
-          echo "HEAD is $GITHUB_SHA, and the work tree holds its files and nothing else"
-
-      # BOTH ENVIRONMENTS MUST ASK A REVIEWER AND ADMIT ONLY THE TAGS v*.
-      # GitHub creates an environment a job names if it does not exist yet,
-      # with no protection rule at all, so a dispatch made before Brett Heap
-      # configured them would upload with nobody approving. And a dispatch
-      # runs the dispatched ref's own copy of this file, so an environment
-      # any ref may deploy to would publish whatever a branch carries. Each
-      # environment must name a required reviewer, and its deployment limit
-      # must be exactly one rule, the tag pattern `v*`. Either gap refuses
-      # here, before anything is built.
-      - name: both environments ask a reviewer and admit only the tags v*
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 - <<'PY'
-          import json, os, subprocess, sys
-
-          repo = os.environ["GITHUB_REPOSITORY"]
-
-
-          def api(path):
-              done = subprocess.run(["gh", "api", path], capture_output=True, text=True)
-              return json.loads(done.stdout) if done.returncode == 0 else None
-
-
-          problems = []
-          for environment in ("testpypi", "pypi"):
-              settings = api(f"repos/{repo}/environments/{environment}")
-              if settings is None:
-                  problems.append(f"the {environment} environment cannot be read: it does not "
-                                  "exist yet. Create it with a required reviewer and a "
-                                  "deployment limit to the tags v* first")
-                  continue
-              reviewers = [entry.get("reviewer", {}).get("login") or entry.get("reviewer", {}).get("slug")
-                           for rule in settings.get("protection_rules") or []
-                           if rule.get("type") == "required_reviewers"
-                           for entry in rule.get("reviewers") or []]
-              policy = settings.get("deployment_branch_policy") or {}
-              limits = api(f"repos/{repo}/environments/{environment}/deployment-branch-policies?per_page=100")
-              rules = sorted((p.get("type"), p.get("name")) for p in (limits or {}).get("branch_policies") or [])
-              if not reviewers:
-                  problems.append(f"the {environment} environment names no required reviewer, "
-                                  "so a deployment to it would not wait for an approval")
-              if policy.get("custom_branch_policies") is not True or rules != [("tag", "v*")]:
-                  problems.append(f"the {environment} environment's deployment limit is {rules} "
-                                  f"({policy!r}), not the one rule ('tag', 'v*'): a dispatch on "
-                                  "a branch runs that branch's own copy of this file")
-              else:
-                  print(f"{environment}: reviewers {reviewers}; only the tags v* can deploy")
-          for problem in problems:
-              print(f"::error::{problem}")
-          sys.exit(1 if problems else 0)
-          PY
-
-      # THE GATE THIS REPOSITORY LANDS BY, ON THIS COMMIT'S OWN TREE (FR-029,
-      # FR-046). `.github/workflows/tests.yml` runs its four jobs,
-      # `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, on
-      # every trigger, and each must have passed in a run that tested THIS
-      # commit: a `push` or `workflow_dispatch` run whose head is the
-      # commit, so the push run that landed a commit on main counts when it
-      # finished green (a run a later landing cancelled does not; each
-      # refusal names the dispatch that answers it). A `pull_request` run is
-      # not counted, because it reports the PR's head but tests a merge of
-      # it with its base, another tree. The jobs are read from each run
-      # itself (`actions/runs/<id>/jobs`), never from the commit's check
-      # runs, which anything holding an Actions token can create inside that
-      # run's check suite. The gate NAMES the four jobs it requires and never
-      # takes the set from what a run holds: a gate that adapts could not
-      # notice a job gone missing. Skipped jobs are passed over. Of the rest,
-      # none may still be running, and the newest to finish must have
-      # succeeded. The rehearsal is held to it too, so a branch's commit,
-      # which has only `pull_request` runs, needs `tests.yml` dispatched on
-      # that branch first.
-      - name: the commit carries passing guard-launch-mode, tests, tests-no-submodule and package jobs
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 - <<'PY'
-          import json, os, subprocess, sys
-
-          repo, sha = os.environ["GITHUB_REPOSITORY"], os.environ["GITHUB_SHA"]
-          gate = ("guard-launch-mode", "tests", "tests-no-submodule", "package")
-          workflow = ".github/workflows/tests.yml"
-          remedy = (f"dispatch tests.yml on a branch that points at {sha} (`gh workflow run "
-                    "tests.yml --ref <branch>`), or on the tag once it is pushed (`gh workflow "
-                    f"run tests.yml --ref v{os.environ.get('VERSION', '<version>')}`), wait for "
-                    "it, then re-run this run; `--ref main` tests main's current head, not this "
-                    "commit")
-
-
-          def rows(path, key):
-              done = subprocess.run(["gh", "api", "--paginate", path, "--jq", f".{key}[]"],
-                                    capture_output=True, text=True)
-              if done.returncode != 0:
-                  sys.exit(f"::error::`gh api {path}` failed, so the checks on {sha} are "
-                           f"unknown: {done.stderr.strip()}")
-              return [json.loads(line) for line in done.stdout.splitlines() if line.strip()]
-
-
-          runs = [run for run in rows(f"repos/{repo}/actions/runs?head_sha={sha}&per_page=100", "workflow_runs")
-                  if run.get("path") == workflow and run.get("head_sha") == sha
-                  and run.get("event") in ("push", "workflow_dispatch")]
-          checks = [job for run in runs
-                    for job in rows(f"repos/{repo}/actions/runs/{run['id']}/jobs?filter=all&per_page=100", "jobs")]
-          problems = []
-          for name in gate:
-              ran = [c for c in checks if c["name"] == name and c.get("conclusion") != "skipped"]
-              running = [c for c in ran if c["status"] != "completed"]
-              if running:
-                  problems.append(f"`{name}` is {running[0]['status']} on {sha} "
-                                  f"({running[0]['html_url']}); dispatch again once it ends")
-              elif not ran:
-                  problems.append(f"`{name}` has not run on {sha}: {remedy}")
-              else:
-                  newest = max(ran, key=lambda c: c["completed_at"])
-                  if newest["conclusion"] != "success":
-                      problems.append(f"`{name}`'s newest run on {sha} ended "
-                                      f"{newest['conclusion']} ({newest['html_url']}): {remedy}")
-                  else:
-                      print(f"{name}: success at {newest['completed_at']}, {newest['html_url']}")
-          for problem in problems:
-              print(f"::error::{problem}")
-          sys.exit(1 if problems else 0)
-          PY
-
-      # THE DIGEST THE STAMP CARRIES, computed by the PINNED submodule's own
-      # `upstream/openRepoShape/scripts/repo_shape.py` (`tree_digest`), and
-      # required to equal the same definition read from the forge's own tree
-      # listing (`tree_digest_from_gh`). No copy of that code is kept here
-      # (FR-030). Its definition is held, before anything is digested, to
-      # the literal `--version` labels every stamped digest with,
-      # `sorted-ls-tree-r-v1`, and to the definition the pin,
-      # `contracts/openreposhape-pin.yaml`, names (FR-029): a pin bumped to
-      # a standard that digests another way refuses here, rather than ship
-      # a digest under a wrong label. The model compares with its package's
-      # own constant, which this package does not have (Decision 10).
-      - name: the commit's tree digest is the forge's, by the definition the pin and --version name
-        id: digest
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          python3 -I -B - <<'PY'
-          import os, sys
-          from pathlib import Path
-
-          here = Path.cwd()
-          scripts = here / "upstream" / "openRepoShape" / "scripts"
-          pin = here / "contracts" / "openreposhape-pin.yaml"
-          literal = "sorted-ls-tree-r-v1"
-          sys.path[:0] = [str(scripts)]
-          import repo_shape
-
-          if Path(repo_shape.__file__).resolve() != (scripts / "repo_shape.py").resolve():
-              sys.exit(f"::error::repo_shape was imported from {repo_shape.__file__}, not from "
-                       f"the pinned {scripts / 'repo_shape.py'}")
-          sha, repo = os.environ["GITHUB_SHA"], os.environ["GITHUB_REPOSITORY"]
-          try:
-              manifest = repo_shape.load_yaml(pin)
-          except repo_shape.Refusal as error:
-              sys.exit(f"::error::{error}")
-          pinned = manifest.get("digest_definition") if isinstance(manifest, dict) else None
-          standard = repo_shape.TREE_DIGEST_DEFINITION
-          if standard != literal or pinned != literal:
-              sys.exit(f"::error::the pinned scripts/repo_shape.py digests by {standard!r} and "
-                       f"contracts/openreposhape-pin.yaml names {pinned!r}, and --version labels "
-                       f"every digest {literal}: all three must be {literal}")
-          try:
-              local = repo_shape.tree_digest(here, sha)
-              forge = repo_shape.tree_digest_from_gh(repo, sha)
-          except repo_shape.Refusal as error:
-              sys.exit(f"::error::{error}")
-          if local != forge:
-              sys.exit(f"::error::{sha} digests to {local} here and to {forge} from the forge's "
-                       "tree listing; the release would not be the forge's commit")
-          with open(os.environ["GITHUB_OUTPUT"], "a", encoding="utf-8") as output:
-              output.write(f"digest={local}\n")
-          print(f"{sha}: {standard} {local}, here and on the forge")
-          PY
-
-      # THE RELEASE TOOLS, FROM THEIR HASH LOCK, IN A VENV OF THEIR OWN:
-      # the `build` frontend, the `hatchling` backend at `pyproject.toml`'s
-      # own pin, and every requirement of either, each by digest, wheels
-      # only (`.github/release-build-requirements.txt` says why).
-      - name: install the release tools from their hash lock
-        run: |
-          python -m venv "$RUNNER_TEMP/tools"
-          "$RUNNER_TEMP/tools/bin/python" -m pip install --disable-pip-version-check \
-              --no-cache-dir --only-binary :all: --require-hashes \
-              -r .github/release-build-requirements.txt
-          "$RUNNER_TEMP/tools/bin/python" -m pip list --disable-pip-version-check
-          python -VV
-
-      # FROM `git archive` OF THE COMMIT, TWICE, into two directories of
-      # different names and depths. The wheel is built from the commit's
-      # own tree, never from the checkout, and two builds that share no
-      # directory are what can show the bytes depend on the commit alone.
-      - name: extract the commit twice, into two directories
-        run: |
-          tree_a="$RUNNER_TEMP/a/openRepoTools"
-          tree_b="$RUNNER_TEMP/b/elsewhere/v$VERSION-src"
-          for tree in "$tree_a" "$tree_b"; do
-            mkdir -p "$tree"
-            git archive --format=tar "$GITHUB_SHA" | tar -x -f - -C "$tree"
-          done
-          {
-            echo "TREE_A=$tree_a"
-            echo "TREE_B=$tree_b"
-          } >> "$GITHUB_ENV"
-          diff -r "$tree_a" "$tree_b"
-          echo "$GITHUB_SHA extracted into $tree_a and $tree_b"
-
-      # THE STAMP, WRITTEN THE PACKAGE'S OWN WAY (FR-009, FR-013): the
-      # committed `src/openrepotools/_release.py`, each of its five
-      # assignment lines replaced exactly once with the release's value, and
-      # every other byte, the SPDX line and the docstring among them, as it
-      # was. A count other than one refuses, so a file already stamped is
-      # refused. VERSION, TAG, COMMIT, DIGEST and REPOSITORY come from the
-      # environment, REPOSITORY from `$GITHUB_REPOSITORY` (Decision 10's
-      # fifth field), and nothing is pasted in by an expression. Each value
-      # must have the shape the command's bash reader (`stamp_read`) gives a
-      # stamped field, and both files are stamped and checked before either
-      # is written, then read again. `pyproject.toml` reads VERSION from the
-      # stamp (hatchling's version source), and `openRepoTools --version`
-      # reads all five. `tests/test_release_workflow.py` runs this very
-      # script against the committed file, and reads its output back with
-      # `--version`.
-      - name: write the stamp into both extractions
-        env:
-          DIGEST: ${{ steps.digest.outputs.digest }}
-        run: |
-          export TAG="v$VERSION" COMMIT="$GITHUB_SHA" REPOSITORY="$GITHUB_REPOSITORY"
-          python3 -I - "$TREE_A/src/openrepotools/_release.py" "$TREE_B/src/openrepotools/_release.py" <<'PY'
-          import ast, os, re, sys
-
-          names = ("VERSION", "TAG", "COMMIT", "DIGEST", "REPOSITORY")
-          number = r"(0|[1-9][0-9]*)"
-          version = rf"{number}\.{number}\.{number}(rc{number})?"
-          shapes = {"VERSION": version, "TAG": rf"v{version}", "COMMIT": r"[0-9a-f]{40}",
-                    "DIGEST": r"[0-9a-f]{64}",
-                    "REPOSITORY": r"([A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9-]*[A-Za-z0-9])"
-                                  r"/(?!\.\.?\Z)[A-Za-z0-9._-]+"}
-          unstamped = {"VERSION": "0.0.0", "TAG": "", "COMMIT": "", "DIGEST": "", "REPOSITORY": ""}
-          release = {name: os.environ.get(name, "") for name in names}
-          for name, value in release.items():
-              if not re.fullmatch(shapes[name], value) or value == unstamped[name]:
-                  sys.exit(f"::error::the stamp's {name} would be {value!r}, which is not a release's")
-          if release["TAG"] != "v" + release["VERSION"]:
-              sys.exit(f"::error::the stamp's TAG would be {release['TAG']!r}, and a release's "
-                       f"tag is v{release['VERSION']}")
-          if len(sys.argv) != 3:
-              sys.exit(f"::error::the stamp is written into the two extractions, and this run "
-                       f"names {sys.argv[1:]}")
-
-
-          def assigned(text):
-              try:
-                  body = ast.parse(text).body
-              except SyntaxError as error:
-                  return f"no assignment at all: it is not Python ({error})"
-              return {node.targets[0].id: node.value.value for node in body
-                      if isinstance(node, ast.Assign) and len(node.targets) == 1
-                      and isinstance(node.targets[0], ast.Name)
-                      and isinstance(node.value, ast.Constant)}
-
-
-          stamped = {}
-          for path in sys.argv[1:]:
-              with open(path, encoding="utf-8", newline="") as handle:
-                  text = handle.read()
-              for name, value in release.items():
-                  line = f'{name} = "{value}"'
-                  text, count = re.subn(rf'^{name} = "{re.escape(unstamped[name])}"$',
-                                        lambda _: line, text, flags=re.M)
-                  if count != 1:
-                      sys.exit(f"::error::{path} assigns {name} = \"{unstamped[name]}\" {count} "
-                               "times, not once: it is not the committed, unstamped stamp")
-              if assigned(text) != release:
-                  sys.exit(f"::error::{path} would assign {assigned(text)} after stamping, not {release}")
-              stamped[path] = text
-          for path, text in stamped.items():
-              with open(path, "w", encoding="utf-8", newline="") as handle:
-                  handle.write(text)
-              with open(path, encoding="utf-8", newline="") as handle:
-                  again = handle.read()
-              if again != text or assigned(again) != release:
-                  sys.exit(f"::error::{path} reads back as {assigned(again)}, not {release}")
-              print(f"{path}: {release}")
-          PY
-
-      # TWICE, AT THE COMMIT'S OWN TIME, AND THE TWO MUST BE ONE FILE: the
-      # bytes depend on the commit and the locked tools, not on the
-      # directory built in. A wheel only: one pure file, its times from
-      # `SOURCE_DATE_EPOCH` (an sdist can come later). `--no-isolation`, so
-      # the backend is the hash-locked one, and `build` refuses a backend
-      # that does not satisfy `[build-system] requires`.
-      - name: build the wheel from each extraction, and the two are one file
-        run: |
-          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct "$GITHUB_SHA")"
-          export SOURCE_DATE_EPOCH
-          wheel="openrepotools-$VERSION-py3-none-any.whl"
-          for side in a b; do
-            if [ "$side" = a ]; then tree="$TREE_A"; else tree="$TREE_B"; fi
-            (cd "$tree" && "$RUNNER_TEMP/tools/bin/python" -m build --wheel --no-isolation \
-                --outdir "$RUNNER_TEMP/dist-$side" .)
-            found="$(ls -A "$RUNNER_TEMP/dist-$side")"
-            if [ "$found" != "$wheel" ]; then
-              echo "::error::the build from $tree made '$found', and a release is exactly $wheel"
-              exit 1
-            fi
-          done
-          if ! cmp "$RUNNER_TEMP/dist-a/$wheel" "$RUNNER_TEMP/dist-b/$wheel"; then
-            echo "::error::two builds of $GITHUB_SHA, from two extractions in two directories, are not one file: the wheel depends on where it was built, and nothing is uploaded"
-            exit 1
-          fi
-          sha256sum "$RUNNER_TEMP/dist-a/$wheel" "$RUNNER_TEMP/dist-b/$wheel"
-          echo "SOURCE_DATE_EPOCH $SOURCE_DATE_EPOCH: two builds, one file"
-
-      # EVERY FILE IN THE WHEEL BUT THE STAMP AND THE METADATA IS THE
-      # COMMIT'S OWN, read from git (FR-006, FR-030): each module from
-      # `src/openrepotools/`, byte for byte, and each payload file, at
-      # `openrepotools/payload/<P>`, from `<P>` at the commit, byte for byte
-      # and with the commit's mode, `100755` as 0755 and `100644` as 0644,
-      # which is how hatchling 1.27.0's reproducible build writes them.
-      # Every file git tracks under `src/openrepotools/` and every path
-      # `pyproject.toml` force-includes is in it, and nothing else is. The
-      # stamp is the committed one with exactly its five values written. The
-      # metadata names this version, `pyproject.toml`'s dependencies and its
-      # one command, and carries the commit's LICENSE (FR-002: hatchling
-      # builds a wheel with no LICENSE and says nothing, so this check is
-      # what refuses one). A missing member is named, never a traceback.
-      # `tests/test_release_workflow.py` runs this very script on synthetic
-      # wheels made from the commit's blobs.
-      - name: the wheel holds the commit's own files, byte for byte and mode for mode, and the stamp
-        env:
-          DIGEST: ${{ steps.digest.outputs.digest }}
-        run: |
-          export TAG="v$VERSION" COMMIT="$GITHUB_SHA" REPOSITORY="$GITHUB_REPOSITORY"
-          python3 -I - "$RUNNER_TEMP/dist-a/openrepotools-$VERSION-py3-none-any.whl" <<'PY'
-          import ast, configparser, email.parser, os, re, stat, subprocess, sys, tomllib, zipfile
-
-          names = ("VERSION", "TAG", "COMMIT", "DIGEST", "REPOSITORY")
-          release = {name: os.environ.get(name, "") for name in names}
-          unstamped = {"VERSION": "0.0.0", "TAG": "", "COMMIT": "", "DIGEST": "", "REPOSITORY": ""}
-          version, sha = release["VERSION"], os.environ.get("GITHUB_SHA", "")
-          run = {"TAG": f"v{version}", "COMMIT": sha,
-                 "REPOSITORY": os.environ.get("GITHUB_REPOSITORY", "")}
-          if not re.fullmatch(r"[0-9a-f]{40}", sha) or any(release[k] != v for k, v in run.items()):
-              sys.exit(f"::error::the release's values {release} are not this run's {run}")
-          if len(sys.argv) != 2:
-              sys.exit(f"::error::the check reads one wheel, and this run names {sys.argv[1:]}")
-          info, stamp = f"openrepotools-{version}.dist-info/", "openrepotools/_release.py"
-          payload, package = "openrepotools/payload/", "src/openrepotools/"
-          modes = {"100755": 0o755, "100644": 0o644}
-
-          listing = subprocess.run(["git", "ls-tree", "-r", "-z", "--full-tree", sha],
-                                   capture_output=True)
-          if listing.returncode != 0:
-              sys.exit(f"::error::git cannot list {sha}: {listing.stderr.decode().strip()}")
-          tree = {}
-          for record in listing.stdout.split(b"\0"):
-              if record:
-                  meta, _, path = record.partition(b"\t")
-                  mode, kind, oid = meta.decode("ascii").split(" ")
-                  tree[path.decode("utf-8")] = (mode, kind, oid)
-
-
-          def committed(path):
-              entry = tree.get(path)
-              if entry is None or entry[1] != "blob":
-                  return None
-              done = subprocess.run(["git", "cat-file", "blob", entry[2]], capture_output=True)
-              return done.stdout if done.returncode == 0 else None
-
-
-          def assigned(text):
-              try:
-                  body = ast.parse(text).body
-              except SyntaxError:
-                  return None
-              return {n.targets[0].id: n.value.value for n in body
-                      if isinstance(n, ast.Assign) and len(n.targets) == 1
-                      and isinstance(n.targets[0], ast.Name) and isinstance(n.value, ast.Constant)}
-
-
-          problems = []
-          declared_file = committed("pyproject.toml")
-          if declared_file is None:
-              sys.exit(f"::error::{sha} has no pyproject.toml to check the wheel against")
-          try:
-              pyproject = tomllib.loads(declared_file.decode("utf-8"))
-          except (tomllib.TOMLDecodeError, UnicodeDecodeError) as error:
-              sys.exit(f"::error::{sha}'s pyproject.toml cannot be read: {error}")
-          project = pyproject.get("project", {})
-          forced = (pyproject.get("tool", {}).get("hatch", {}).get("build", {}).get("targets", {})
-                    .get("wheel", {}).get("force-include", {}))
-          sources = {}
-          for source, member in forced.items():
-              if member != payload + source:
-                  problems.append(f"pyproject.toml force-includes {source} as {member}, "
-                                  f"not as {payload}{source}")
-              sources[member] = source
-          modules = {"openrepotools/" + path[len(package):]: path for path in tree
-                     if path.startswith(package)}
-          wanted = set(modules) | set(sources)
-
-          try:
-              wheel = zipfile.ZipFile(sys.argv[1])
-          except (OSError, zipfile.BadZipFile) as error:
-              sys.exit(f"::error::{sys.argv[1]} cannot be read as a wheel: {error}")
-          with wheel:
-              entries = [e for e in wheel.infolist() if not e.filename.endswith("/")]
-              listed = [e.filename for e in entries]
-              if len(listed) != len(set(listed)):
-                  problems.append("the wheel names one file twice")
-              members = {e.filename: e for e in entries}
-
-
-              def read(name):
-                  return wheel.read(members[name]) if name in members else None
-
-
-              for name in sorted(members):
-                  if name.startswith(info) or name == stamp:
-                      continue
-                  if name in sources:
-                      source = sources[name]
-                      data, entry = committed(source), tree.get(source)
-                      want = modes.get(entry[0]) if entry else None
-                      got = stat.S_IMODE(members[name].external_attr >> 16)
-                      if data is None or want is None:
-                          problems.append(f"{name} is in the wheel, and {source} is not a regular "
-                                          f"file at {sha}")
-                          continue
-                      fine = True
-                      if read(name) != data:
-                          problems.append(f"{name} in the wheel is not {source} at {sha}, byte for byte")
-                          fine = False
-                      if got != want:
-                          problems.append(f"{name} has mode {got:04o} in the wheel, and {source} is "
-                                          f"{entry[0]} at {sha}, which is {want:04o}")
-                          fine = False
-                      if fine:
-                          print(f"{name} = {sha[:12]}:{source}, mode {got:04o}")
-                  elif name in modules:
-                      source = modules[name]
-                      if read(name) != committed(source):
-                          problems.append(f"{name} in the wheel is not {source} at {sha}")
-                      else:
-                          print(f"{name} = {sha[:12]}:{source}")
-                  else:
-                      problems.append(f"{name} is in the wheel, and neither {package} nor "
-                                      "pyproject.toml's force-include puts it there")
-              for name in sorted(wanted - set(members)):
-                  problems.append(f"{name} is tracked or force-included, and missing from the wheel")
-
-              base, shipped, before = committed(package + "_release.py"), read(stamp), len(problems)
-              if base is None or shipped is None:
-                  problems.append(f"the stamp {stamp} is missing from the wheel or from {sha}")
-              else:
-                  expected = base.decode("utf-8")
-                  for name in names:
-                      line = f'{name} = "{release[name]}"'
-                      expected, count = re.subn(rf'^{name} = "{re.escape(unstamped[name])}"$',
-                                                lambda _: line, expected, flags=re.M)
-                      if count != 1:
-                          problems.append(f"the committed stamp assigns {name} = "
-                                          f"\"{unstamped[name]}\" {count} times, not once")
-                  if shipped != expected.encode("utf-8"):
-                      old, new = expected.split("\n"), shipped.decode("utf-8", "replace").split("\n")
-                      if len(old) != len(new):
-                          problems.append(f"the stamp has {len(new)} lines, and the committed "
-                                          f"_release.py stamped has {len(old)}")
-                      for ours, theirs in zip(old, new):
-                          if ours != theirs:
-                              problems.append(f"the stamp says {theirs!r} where the release's says {ours!r}")
-                      if old == new:
-                          problems.append("the stamp is not the committed _release.py, stamped, byte for byte")
-                  values = assigned(shipped.decode("utf-8", "replace"))
-                  if values != release:
-                      problems.append(f"the stamp assigns {values}, not {release}")
-                  if len(problems) == before:
-                      print(f"{stamp}: the committed file, with {list(names)} written")
-
-              raw = read(info + "METADATA")
-              if raw is None:
-                  problems.append(f"the wheel has no {info}METADATA")
-              else:
-                  meta = email.parser.BytesParser().parsebytes(raw)
-                  shown = {"Name": meta["Name"], "Version": meta["Version"],
-                           "Requires-Python": meta["Requires-Python"],
-                           "Requires-Dist": sorted(meta.get_all("Requires-Dist") or [])}
-                  declared = {"Name": project.get("name"), "Version": version,
-                              "Requires-Python": project.get("requires-python"),
-                              "Requires-Dist": sorted(project.get("dependencies") or [])}
-                  if shown != declared:
-                      problems.append(f"the metadata says {shown}, and pyproject.toml {declared}")
-                  print(f"metadata: {shown}")
-              raw = read(info + "entry_points.txt")
-              if raw is None:
-                  problems.append(f"the wheel has no {info}entry_points.txt")
-              else:
-                  entry_points = configparser.ConfigParser(delimiters=("=",), interpolation=None)
-                  entry_points.optionxform = str
-                  try:
-                      entry_points.read_string(raw.decode("utf-8"))
-                  except (configparser.Error, UnicodeDecodeError) as error:
-                      problems.append(f"the wheel's entry_points.txt cannot be read: {error}")
-                  if entry_points.sections() != ["console_scripts"]:
-                      problems.append(f"the wheel's entry points declare {entry_points.sections()}, "
-                                      "not ['console_scripts'] alone")
-                  scripts = ({k: v.strip() for k, v in entry_points["console_scripts"].items()}
-                             if entry_points.has_section("console_scripts") else {})
-                  if scripts != project.get("scripts"):
-                      problems.append(f"the wheel's commands are {scripts}, not {project.get('scripts')}")
-                  print(f"commands: {sorted(scripts)}")
-              described = sorted(n[len(info):] for n in members if n.startswith(info))
-              if described != sorted(["METADATA", "WHEEL", "RECORD", "entry_points.txt",
-                                      "licenses/LICENSE"]):
-                  problems.append(f"the wheel's {info} holds {described}, not exactly METADATA, "
-                                  "WHEEL, RECORD, entry_points.txt and licenses/LICENSE")
-              licence, commits = read(info + "licenses/LICENSE"), committed("LICENSE")
-              if commits is None:
-                  problems.append(f"{sha} has no LICENSE, and the wheel must carry the commit's")
-              elif licence is None:
-                  problems.append(f"the wheel has no {info}licenses/LICENSE, so the commit's LICENSE "
-                                  "is not in it")
-              elif licence != commits:
-                  problems.append(f"the wheel's {info}licenses/LICENSE is not the commit's LICENSE")
-          for problem in problems:
-              print(f"::error::{problem}")
-          sys.exit(1 if problems else 0)
-          PY
-
-      # THE DIGEST IS RECORDED HERE, and every later job checks the file it
-      # holds against it: before each upload, after each upload against what
-      # the index serves, and before the install check runs anything.
-      - name: record the wheel and its sha256
-        id: record
-        run: |
-          wheel="openrepotools-$VERSION-py3-none-any.whl"
-          {
-            echo "wheel=$wheel"
-            echo "wheel-sha256=$(sha256sum "$RUNNER_TEMP/dist-a/$wheel" | cut -d' ' -f1)"
-          } | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY"
-
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-        with:
-          name: wheel
-          path: ${{ runner.temp }}/dist-a/
-          if-no-files-found: error
-
-  testpypi:
-    name: publish to TestPyPI
-    needs: build
-    # ON A v* TAG ONLY, AND ONLY WHERE THE BUILD'S GUARD SENDS THIS VERSION
-    # (FR-048): `to-testpypi` is `true` for any version on a tag in
-    # opensoft/openRepoTools-code and for a pre-release on a tag in
-    # opensoft/openRepoTools, and the build refused every other tag. A
-    # branch is the rehearsal, and both environments would refuse it anyway
-    # (their deployment limit is the tags v*). With no status function in
-    # it, `if:` also requires the build to have succeeded.
-    if: startsWith(github.ref, 'refs/tags/v') && needs.build.outputs.to-testpypi == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    environment:
-      name: testpypi
-      url: https://test.pypi.org/project/openrepotools/${{ inputs.version }}/
-    permissions:
-      id-token: write  # trusted publishing: the OIDC token TestPyPI accepts
-      actions: read  # this environment's rules and this run's approvals
-      contents: read  # the tag, read again
-    env:
-      WHEEL: ${{ needs.build.outputs.wheel }}
-      WHEEL_SHA256: ${{ needs.build.outputs.wheel-sha256 }}
-      INDEX: TestPyPI
-      JSON_BASE: https://test.pypi.org/pypi/openrepotools/
-    steps:
-      # THE REPOSITORY GUARD AGAIN, ON ITS OWN, FIRST (FR-048), in case the
-      # job's condition is ever loosened or the build's record is wrong:
-      # TestPyPI takes any release from opensoft/openRepoTools-code, a
-      # pre-release X.Y.ZrcN alone from opensoft/openRepoTools, and nothing
-      # from any other repository, each from its own tag v<version>. The
-      # names are compared exactly, as GitHub spells them.
-      - name: the repository guard (FR-048) again, before anything else, and this repository may send v<version> to TestPyPI
-        run: |
-          final='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
-          pre='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)rc(0|[1-9][0-9]*)$'
-          if [[ "$VERSION" =~ $final ]] && [ "$VERSION" != 0.0.0 ]; then
-            kind=final
-          elif [[ "$VERSION" =~ $pre ]]; then
-            kind=rc
-          else
-            echo "::error::the version input is not X.Y.Z or X.Y.ZrcN, so nothing is uploaded"
-            printf 'the input, quoted: %q\n' "$VERSION"
-            exit 1
-          fi
-          if [ "$GITHUB_REF" != "refs/tags/v$VERSION" ]; then
-            echo "::error::an upload is made from the tag v$VERSION alone, and this run names '$GITHUB_REF', so nothing is uploaded"
-            exit 1
-          fi
-          if [ "$GITHUB_REPOSITORY" = opensoft/openRepoTools-code ]; then
-            echo "opensoft/openRepoTools-code sends $VERSION ($kind) to TestPyPI"
-          elif [ "$GITHUB_REPOSITORY" = opensoft/openRepoTools ] && [ "$kind" = rc ]; then
-            echo "opensoft/openRepoTools sends the pre-release $VERSION to TestPyPI, and nothing to PyPI"
-          elif [ "$GITHUB_REPOSITORY" = opensoft/openRepoTools ]; then
-            echo "::error::opensoft/openRepoTools sends a pre-release X.Y.ZrcN to TestPyPI and nothing else, and $VERSION is a final, so nothing is uploaded"
-            exit 1
-          else
-            echo "::error::'$GITHUB_REPOSITORY' is neither opensoft/openRepoTools-code nor opensoft/openRepoTools, as GitHub spells them, so nothing is uploaded"
-            exit 1
-          fi
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: wheel
-          path: dist
-
-      - name: dist holds the wheel the build job verified, and nothing else
-        run: |
-          found="$(ls -A dist)"
-          if [ "$found" != "$WHEEL" ]; then
-            echo "::error::dist holds '$found', and the build job verified $WHEEL"
-            exit 1
-          fi
-          echo "$WHEEL_SHA256  dist/$WHEEL" | sha256sum --strict -c -
-
-      # AT USE TIME, the environment's rules again, and this run's approval.
-      # The build job's reading goes stale while the run waits: a rule
-      # removed meanwhile would let this job start with nobody approving it.
-      - name: this environment still asks a reviewer and admits only the tags v*, and this run's deployment to it was approved
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ENVIRONMENT: testpypi
-        run: |
-          python3 - <<'PY'
-          import json, os, subprocess, sys
-
-          repo, environment = os.environ["GITHUB_REPOSITORY"], os.environ["ENVIRONMENT"]
-
-
-          def api(path):
-              done = subprocess.run(["gh", "api", path], capture_output=True, text=True)
-              if done.returncode != 0:
-                  sys.exit(f"::error::`gh api {path}` failed, so nothing is uploaded: {done.stderr.strip()}")
-              return json.loads(done.stdout)
-
-
-          settings = api(f"repos/{repo}/environments/{environment}")
-          reviewers = [rule for rule in settings.get("protection_rules") or []
-                       if rule.get("type") == "required_reviewers" and rule.get("reviewers")]
-          policy = settings.get("deployment_branch_policy") or {}
-          limits = api(f"repos/{repo}/environments/{environment}/deployment-branch-policies?per_page=100")
-          rules = sorted((p.get("type"), p.get("name")) for p in limits.get("branch_policies") or [])
-          if not reviewers:
-              sys.exit(f"::error::the {environment} environment names no required reviewer now")
-          if policy.get("custom_branch_policies") is not True or rules != [("tag", "v*")]:
-              sys.exit(f"::error::the {environment} environment's deployment limit is now {rules}, "
-                       "not the one rule ('tag', 'v*'), so nothing is uploaded")
-          approved = [review["user"]["login"]
-                      for review in api(f"repos/{repo}/actions/runs/{os.environ['GITHUB_RUN_ID']}/approvals")
-                      if review.get("state") == "approved"
-                      and any(e.get("name") == environment for e in review.get("environments") or [])]
-          if not approved:
-              sys.exit(f"::error::this run holds no approval of a deployment to {environment}, "
-                       "so nothing is uploaded")
-          print(f"{environment}: a reviewer, the tags v* alone, and approved by {', '.join(approved)}")
-          PY
-
-      # THE TAG, AGAIN, RIGHT BEFORE THE UPLOAD. The run may have waited on
-      # an approval, and a tag can be moved or deleted meanwhile; an upload
-      # cannot be taken back.
-      - name: the tag v<version> still names this commit
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          object="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/v$VERSION" \
-              --jq 'select(.object.type == "tag") | .object.sha')" || object=
-          commit=
-          if [ -n "$object" ]; then
-            commit="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$object" \
-                --jq 'select(.object.type == "commit") | .object.sha')" || commit=
-          fi
-          if [ "$commit" != "$GITHUB_SHA" ]; then
-            echo "::error::the annotated tag v$VERSION no longer names $GITHUB_SHA (it names '$commit'), so nothing is uploaded"
-            exit 1
-          fi
-          echo "v$VERSION still names $GITHUB_SHA"
-
-      # BEFORE THE UPLOAD, NOTHING ELSE HELD. skip-existing skips a file
-      # name the index already holds, so the index must hold no file of
-      # this version but the verified wheel, at its verified digest: an
-      # index never replaces a file. A 404 is a version with no file yet.
-      # The verified wheel itself, already there, is a re-run of this job
-      # after its upload went through, and uploads nothing new.
-      - name: the index holds no file of this version but the verified wheel
-        run: |
-          python3 - <<'PY'
-          import json, os, sys, urllib.error, urllib.request
-
-          index, version = os.environ["INDEX"], os.environ["VERSION"]
-          url = f"{os.environ['JSON_BASE']}{version}/json"
-          wanted = {os.environ["WHEEL"]: os.environ["WHEEL_SHA256"]}
-          try:
-              with urllib.request.urlopen(url, timeout=30) as response:
-                  release = json.load(response)
-          except urllib.error.HTTPError as error:
-              if error.code != 404:
-                  raise
-              print(f"{index} holds no file of openrepotools {version} yet")
-              sys.exit(0)
-          held = {f["filename"]: f["digests"]["sha256"] for f in release["urls"]}
-          other = {name: digest for name, digest in held.items() if wanted.get(name) != digest}
-          if other:
-              sys.exit(f"::error::{index} already holds {other} for openrepotools {version}, "
-                       "which the build job did not verify, so nothing is uploaded")
-          yanked = sorted(f["filename"] for f in release["urls"] if f.get("yanked"))
-          if yanked:
-              sys.exit(f"::error::{index} holds {yanked} at the verified digest, but yanked; "
-                       "un-yank it on the index, or release a new version")
-          print(f"{index} holds {sorted(held)}, at the verified digest; skip-existing uploads nothing new")
-          PY
-
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
-        with:
-          repository-url: https://test.pypi.org/legacy/
-          skip-existing: true
-          print-hash: true
-
-      # AFTER THE UPLOAD, the index serves exactly the verified wheel, by
-      # digest, not yanked. Its JSON can lag an upload, so it is read up to
-      # 20 times, 15 seconds apart.
-      - name: the index serves exactly the verified wheel
-        run: |
-          python3 - <<'PY'
-          import json, os, sys, time, urllib.error, urllib.request
-
-          index, version = os.environ["INDEX"], os.environ["VERSION"]
-          url = f"{os.environ['JSON_BASE']}{version}/json"
-          wanted = {os.environ["WHEEL"]: os.environ["WHEEL_SHA256"]}
-          served = None
-          for attempt in range(1, 21):
-              try:
-                  with urllib.request.urlopen(url, timeout=30) as response:
-                      release = json.load(response)
-                  served = {f["filename"]: f["digests"]["sha256"] for f in release["urls"]}
-                  if served == wanted:
-                      if any(f.get("yanked") for f in release["urls"]):
-                          sys.exit(f"::error::{index} serves the verified wheel, yanked")
-                      break
-                  print(f"read {attempt}: {index} serves {served} so far")
-              except (urllib.error.URLError, TimeoutError, ConnectionError) as error:
-                  code = getattr(error, "code", None)
-                  if code is not None and code != 404 and code < 500:
-                      raise
-                  print(f"read {attempt}: {url} did not answer yet ({error})")
-              time.sleep(15)
-          else:
-              sys.exit(f"::error::after 20 reads {index} serves {served}, and the build job "
-                       f"verified {wanted}")
-          print(f"{index} serves exactly the verified wheel: {served}")
-          PY
-
-  install:
-    name: install check (${{ matrix.os }}, Python ${{ matrix.python }})
-    needs: [build, testpypi]
-    # ON A TAG, AFTER TestPyPI HOLDS THE WHEEL. On a branch, the rehearsal,
-    # where the testpypi job is skipped, after the build alone, over the
-    # build's own wheel.
-    if: >-
-      ${{ !cancelled() && needs.build.result == 'success' &&
-      (needs.testpypi.result == 'success' ||
-      (needs.testpypi.result == 'skipped' && !startsWith(github.ref, 'refs/tags/'))) }}
-    runs-on: ${{ matrix.os }}
-    timeout-minutes: 30
-    permissions:
-      contents: read  # the checkout, for the pipx lock alone
-    # THREE LEGS, AND NO WINDOWS LEG (FR-032): ubuntu and macOS on a
-    # current Python 3, and ubuntu on 3.9, the oldest Python the package
-    # supports (`requires-python`). The package is bash, and has no native
-    # Windows command.
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - os: ubuntu-24.04
-            python: '3.x'
-          - os: macos-latest
-            python: '3.x'
-          - os: ubuntu-24.04
-            python: '3.9'
-    env:
-      WHEEL: ${{ needs.build.outputs.wheel }}
-      WHEEL_SHA256: ${{ needs.build.outputs.wheel-sha256 }}
-      DIGEST: ${{ needs.build.outputs.digest }}
-      # EVERY pip THIS JOB RUNS, pipx's own included, reads PyPI and no
-      # other index. The package has no dependency, and pipx's come from
-      # its hash lock; TestPyPI, where anyone can upload, serves the one
-      # file this job fetches by its recorded digest, and nothing else.
-      PIP_INDEX_URL: https://pypi.org/simple/
-      PIP_DISABLE_PIP_VERSION_CHECK: '1'
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        id: python
-        with:
-          python-version: ${{ matrix.python }}
-
-      # FROM TestPyPI, BY THE RECORDED DIGEST: the file TestPyPI lists under
-      # the wheel's name, fetched from its file host, and kept only if its
-      # sha256 is the one the build job recorded (the step after the next).
-      - name: fetch the wheel from TestPyPI
-        if: startsWith(github.ref, 'refs/tags/')
-        run: |
-          mkdir -p "$RUNNER_TEMP/wheel"
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 10 --retry-delay 15 --retry-all-errors \
-              -o "$RUNNER_TEMP/testpypi.json" "https://test.pypi.org/pypi/openrepotools/$VERSION/json"
-          url="$(python - "$RUNNER_TEMP/testpypi.json" <<'PY'
-          import json, os, sys, urllib.parse
-          with open(sys.argv[1], encoding="utf-8") as handle:
-              files = json.load(handle)["urls"]
-          entries = [f for f in files if f["filename"] == os.environ["WHEEL"]
-                     and f["digests"]["sha256"] == os.environ["WHEEL_SHA256"]]
-          if len(entries) != 1:
-              sys.exit(f"TestPyPI lists {len(entries)} {os.environ['WHEEL']} at the recorded "
-                       f"digest, not one: {files}")
-          entry = entries[0]
-          parts = urllib.parse.urlsplit(entry["url"])
-          if parts.scheme != "https" or parts.hostname != "test-files.pythonhosted.org":
-              sys.exit(f"TestPyPI lists the wheel at {entry['url']}, not on its own file host")
-          print(entry["url"])
-          PY
-          )"
-          curl --proto '=https' --tlsv1.2 -fsSL --retry 5 --retry-all-errors \
-              -o "$RUNNER_TEMP/wheel/$WHEEL" "$url"
-          echo "fetched $url"
-
-      # THE REHEARSAL: no upload was made, so the build's own wheel.
-      - name: take the build's own wheel, on a branch (the rehearsal)
-        if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: wheel
-          path: ${{ runner.temp }}/wheel
-
-      - name: the wheel is the one the build job verified
-        run: |
-          python - <<'PY'
-          import hashlib, os, pathlib, sys
-
-          folder = pathlib.Path(os.environ["RUNNER_TEMP"]) / "wheel"
-          found, wheel = sorted(p.name for p in folder.iterdir()), os.environ["WHEEL"]
-          if found != [wheel]:
-              sys.exit(f"::error::{folder} holds {found}, and the build job verified {wheel}")
-          digest = hashlib.sha256((folder / wheel).read_bytes()).hexdigest()
-          if digest != os.environ["WHEEL_SHA256"]:
-              sys.exit(f"::error::{wheel} has sha256 {digest}, and the build job recorded "
-                       f"{os.environ['WHEEL_SHA256']}; nothing from it is run")
-          print(f"{wheel}: sha256 {digest}, the recorded digest")
-          PY
-
-      # pipx FROM ITS HASH LOCK, on this leg's Python: 1.11.1 on 3.9, the
-      # newest pipx that installs there, and 1.17.8 from 3.10
-      # (`.github/release-pipx-requirements.txt` says why). Its home and its
-      # links are directories of this job's own, under the runner's temp,
-      # as in `tests.yml`'s `package` job, and the steps below read them
-      # through `$GITHUB_ENV`.
-      - name: pipx from its hash lock, on this leg's Python
-        run: |
-          python -m pip install --only-binary :all: --require-hashes \
-              -r .github/release-pipx-requirements.txt
-          {
-            echo "PIPX_HOME=$RUNNER_TEMP/pipx/home"
-            echo "PIPX_BIN_DIR=$RUNNER_TEMP/pipx/bin"
-          } >> "$GITHUB_ENV"
-          python -m pipx --version
-
-      # THE WHEEL INTO A FRESH ENVIRONMENT OF pipx's, as a person installs
-      # it, wheels only. ONE COMMAND, SO ONE LINK: the package declares the
-      # one console script `openRepoTools`, and pipx places that link and
-      # nothing else.
-      - name: pipx installs the wheel into a fresh environment, and places the one link openRepoTools
-        env:
-          PIPX_DEFAULT_PYTHON: ${{ steps.python.outputs.python-path }}
-        run: |
-          python -m pipx install --pip-args=--only-binary=:all: "$RUNNER_TEMP/wheel/$WHEEL"
-          ls -l "$PIPX_BIN_DIR"
-          placed="$(ls -A "$PIPX_BIN_DIR")"
-          if [ "$placed" != openRepoTools ] || [ ! -L "$PIPX_BIN_DIR/openRepoTools" ]; then
-            echo "::error::pipx placed '$placed' in $PIPX_BIN_DIR, and the package's one command is the link openRepoTools"
-            exit 1
-          fi
-
-      # THE RELEASE THIS IS, LINE FOR LINE: the stamped package's five
-      # lines, naming the run's repository, the version, its tag, the commit
-      # and the digest the build recorded. On a branch these are the
-      # build's own stamp values, which are the same five.
-      - name: openRepoTools --version names this release, line for line
-        run: |
-          "$PIPX_BIN_DIR/openRepoTools" --version > "$RUNNER_TEMP/version.out" 2>&1
-          printf '%s\n' \
-              "openRepoTools $VERSION ($GITHUB_REPOSITORY @ $GITHUB_SHA)" \
-              "  version   $VERSION" \
-              "  tag       v$VERSION" \
-              "  commit    $GITHUB_SHA" \
-              "  digest    $DIGEST (sorted-ls-tree-r-v1)" > "$RUNNER_TEMP/version.want"
-          if ! diff -u "$RUNNER_TEMP/version.want" "$RUNNER_TEMP/version.out"; then
-            echo "::error::openRepoTools --version does not name $GITHUB_REPOSITORY, $VERSION, v$VERSION, $GITHUB_SHA and $DIGEST, line for line"
-            exit 1
-          fi
-          cat "$RUNNER_TEMP/version.out"
-
-      # OFFLINE, IN A HOME OF ITS OWN, BESIDE PIPX'S LINK, SET UP AS
-      # `tests.yml`'s `package` job sets up its own (FR-016, FR-032): the two
-      # scripts are one, line for line, but for the link's fingerprint, and
-      # `tests/test_release_workflow.py` holds them so. `--install`, run
-      # through the link, places the other sixteen commands, the skills and
-      # the command files, leaves the link to pipx, and says so in the two
-      # lines below, exactly. `env -i` hands it nothing of the runner's
-      # environment but what is named on its line: a fresh HOME, the bin
-      # directory pipx's link is in, a repository that cannot resolve, and a
-      # PATH whose first directory holds a `gh` and a `curl` that both fail,
-      # so anything that fetched would fail. The receipt has 28 rows, a full
-      # install's 29 less the link, and the link is as pipx left it. The
-      # link's fingerprint is taken by this leg's Python, because the macOS
-      # leg's `stat` and `sha256sum` are not GNU's.
-      - name: an offline --install beside pipx's link
-        run: |
-          set -euo pipefail
-          home="$RUNNER_TEMP/install-home"
-          offline="$RUNNER_TEMP/offline-bin"
-          mkdir "$home" "$offline"
-          for tool in gh curl; do
-            printf '#!/bin/sh\necho "%s: this run is offline" >&2\nexit 1\n' "$tool" > "$offline/$tool"
-            chmod 755 "$offline/$tool"
-          done
-          link="$PIPX_BIN_DIR/openRepoTools"
-          fingerprint='import hashlib, os, sys; p = sys.argv[1]; print(os.lstat(p).st_ino, os.readlink(p), hashlib.sha256(open(p, "rb").read()).hexdigest())'
-          before="$(python3 -I -c "$fingerprint" "$link")"
-          status=0
-          env -i HOME="$home" PATH="$offline:$PIPX_BIN_DIR:$PATH" \
-              OPENREPOTOOLS_BIN_DIR="$PIPX_BIN_DIR" OPENREPOTOOLS_REPO=offline.invalid/sentinel \
-              "$link" --install > "$RUNNER_TEMP/install.out" 2> "$RUNNER_TEMP/install.err" ||
-              status=$?
-          cat "$RUNNER_TEMP/install.out"
-          cat "$RUNNER_TEMP/install.err" >&2
-          if [ "$status" -ne 0 ]; then
-            echo "::error::the offline --install exited $status"
-            exit 1
-          fi
-          skip="openRepoTools: left to pipx at $link (a link into pipx's openrepotools environment); update it with \`pipx upgrade openrepotools\`, then run \`openRepoTools --install\` again"
-          count="openRepoTools: 16 of 17 placed in $PIPX_BIN_DIR, and 1 left to pipx"
-          for line in "$skip" "$count"; do
-            seen="$(grep -cFx -e "$line" "$RUNNER_TEMP/install.out" || true)"
-            if [ "$seen" -ne 1 ]; then
-              echo "::error::--install printed this line $seen times, not once: $line"
-              exit 1
-            fi
-          done
-          receipt="$home/.local/share/openRepoTools/installed.tsv"
-          if [ ! -f "$receipt" ]; then
-            echo "::error::--install wrote no receipt at $receipt"
-            exit 1
-          fi
-          rows="$(awk -F '\t' 'NF == 4' "$receipt" | wc -l)"
-          lines="$(wc -l < "$receipt")"
-          if [ "$rows" -ne 28 ] || [ "$lines" -ne 28 ]; then
-            echo "::error::the receipt has $lines lines and $rows rows, not 28: a full install's 29 less pipx's link"
-            exit 1
-          fi
-          if [ ! -L "$link" ] || [ "$(python3 -I -c "$fingerprint" "$link")" != "$before" ]; then
-            echo "::error::--install changed pipx's link at $link"
-            exit 1
-          fi
-
-      # ON macOS, THE SAME OFFLINE --install AGAIN UNDER APPLE'S OWN
-      # `/bin/bash` 3.2 (FR-032), in a fresh home: `/bin` first on PATH, so
-      # the bash the package's entry point finds there is `/bin/bash`. The
-      # bash first on that same PATH prints its BASH_VERSION first, and it
-      # must be 3.2. The skip line, the count line, the 28 rows and the link
-      # must be as they were under the leg's own bash.
-      - name: on macOS, the offline --install again under Apple's /bin/bash 3.2
-        if: runner.os == 'macOS'
-        run: |
-          set -euo pipefail
-          home="$RUNNER_TEMP/install-home-bin-bash"
-          offline="$RUNNER_TEMP/offline-bin-bin-bash"
-          mkdir "$home" "$offline"
-          for tool in gh curl; do
-            printf '#!/bin/sh\necho "%s: this run is offline" >&2\nexit 1\n' "$tool" > "$offline/$tool"
-            chmod 755 "$offline/$tool"
-          done
-          link="$PIPX_BIN_DIR/openRepoTools"
-          fingerprint='import hashlib, os, sys; p = sys.argv[1]; print(os.lstat(p).st_ino, os.readlink(p), hashlib.sha256(open(p, "rb").read()).hexdigest())'
-          before="$(python3 -I -c "$fingerprint" "$link")"
-          # shellcheck disable=SC2016
-          version="$(env -i PATH="/bin:$offline:$PIPX_BIN_DIR:$PATH" bash -c 'printf "%s\n" "$BASH_VERSION"')"
-          echo "BASH_VERSION $version, from the bash first on PATH=/bin:..."
-          case "$version" in
-            3.2.*) ;;
-            *)
-              echo "::error::the bash first on a PATH that begins with /bin is $version, not Apple's 3.2"
-              exit 1
-              ;;
-          esac
-          status=0
-          env -i HOME="$home" PATH="/bin:$offline:$PIPX_BIN_DIR:$PATH" \
-              OPENREPOTOOLS_BIN_DIR="$PIPX_BIN_DIR" OPENREPOTOOLS_REPO=offline.invalid/sentinel \
-              "$PIPX_BIN_DIR/openRepoTools" --install > "$RUNNER_TEMP/install-bin-bash.out" \
-              2> "$RUNNER_TEMP/install-bin-bash.err" || status=$?
-          cat "$RUNNER_TEMP/install-bin-bash.out"
-          cat "$RUNNER_TEMP/install-bin-bash.err" >&2
-          if [ "$status" -ne 0 ]; then
-            echo "::error::the offline --install under /bin/bash $version exited $status"
-            exit 1
-          fi
-          skip="openRepoTools: left to pipx at $link (a link into pipx's openrepotools environment); update it with \`pipx upgrade openrepotools\`, then run \`openRepoTools --install\` again"
-          count="openRepoTools: 16 of 17 placed in $PIPX_BIN_DIR, and 1 left to pipx"
-          for line in "$skip" "$count"; do
-            seen="$(grep -cFx -e "$line" "$RUNNER_TEMP/install-bin-bash.out" || true)"
-            if [ "$seen" -ne 1 ]; then
-              echo "::error::--install under /bin/bash $version printed this line $seen times, not once: $line"
-              exit 1
-            fi
-          done
-          receipt="$home/.local/share/openRepoTools/installed.tsv"
-          if [ ! -f "$receipt" ]; then
-            echo "::error::--install under /bin/bash $version wrote no receipt at $receipt"
-            exit 1
-          fi
-          rows="$(awk -F '\t' 'NF == 4' "$receipt" | wc -l)"
-          lines="$(wc -l < "$receipt")"
-          if [ "$rows" -ne 28 ] || [ "$lines" -ne 28 ]; then
-            echo "::error::under /bin/bash $version the receipt has $lines lines and $rows rows, not 28"
-            exit 1
-          fi
-          if [ ! -L "$link" ] || [ "$(python3 -I -c "$fingerprint" "$link")" != "$before" ]; then
-            echo "::error::--install under /bin/bash $version changed pipx's link at $link"
-            exit 1
-          fi
-
-      # ON PYTHON 3.9, THE SHIPPED BYTES COMPILE (FR-032): the two payload
-      # commands written in Python, `lanes-index` and `lane-worktrees`, as
-      # the installed package holds them under its own `payload/`, compiled
-      # by this leg's python3, the oldest the package supports. Nothing is
-      # written: `compile()` keeps no bytecode.
-      - name: on Python 3.9, the installed payload's own lanes-index and lane-worktrees compile
-        if: matrix.python == '3.9'
-        run: |
-          python3 -I - <<'PY'
-          import glob, os, sys
-
-          if sys.version_info[:2] != (3, 9):
-              sys.exit(f"::error::this leg's python3 is {sys.version.split()[0]}, not 3.9")
-          venv = os.path.join(os.environ["PIPX_HOME"], "venvs", "openrepotools")
-          found = glob.glob(os.path.join(venv, "lib", "python*", "site-packages",
-                                         "openrepotools", "payload"))
-          if len(found) != 1:
-              sys.exit(f"::error::pipx's openrepotools environment at {venv} holds {found}, "
-                       "not one payload directory")
-          problems = []
-          for name in ("lanes-index", "lane-worktrees"):
-              path = os.path.join(found[0], name)
-              try:
-                  with open(path, "rb") as handle:
-                      compile(handle.read(), path, "exec")
-              except (OSError, SyntaxError, ValueError) as error:
-                  problems.append(f"{path} does not compile on Python 3.9: {error}")
-              else:
-                  print(f"{path}: compiles on Python {sys.version.split()[0]}")
-          for problem in problems:
-              print(f"::error::{problem}")
-          sys.exit(1 if problems else 0)
-          PY
-
-  pypi:
-    name: publish to PyPI
-    needs: [build, testpypi, install]
-    # ON A v* TAG ONLY, ONLY FOR A FINAL FROM THE CODE LEG, and only after
-    # TestPyPI and every leg of the install check passed: with no status
-    # function in it, `if:` also requires every job above to have
-    # succeeded. An expression cannot test a pattern, so the build's record
-    # decides: `to-pypi` is `true` for a final X.Y.Z on a tag in
-    # opensoft/openRepoTools-code alone (FR-048), so in an rc rehearsal
-    # this job is skipped and never asks for the `pypi` approval.
-    if: startsWith(github.ref, 'refs/tags/v') && needs.build.outputs.to-pypi == 'true'
-    runs-on: ubuntu-24.04
-    timeout-minutes: 30
-    environment:
-      name: pypi
-      url: https://pypi.org/project/openrepotools/${{ inputs.version }}/
-    permissions:
-      id-token: write  # trusted publishing: the OIDC token PyPI accepts
-      actions: read  # this environment's rules and this run's approvals
-      contents: read  # the tag, read again
-    env:
-      WHEEL: ${{ needs.build.outputs.wheel }}
-      WHEEL_SHA256: ${{ needs.build.outputs.wheel-sha256 }}
-      INDEX: PyPI
-      JSON_BASE: https://pypi.org/pypi/openrepotools/
-    steps:
-      # THE REPOSITORY GUARD AGAIN, ON ITS OWN, FIRST (FR-031, FR-048): PyPI
-      # takes a final X.Y.Z from opensoft/openRepoTools-code, from its own
-      # tag v<version>, and nothing else, ever. So in opensoft/openRepoTools
-      # this step refuses outright, in case the job's condition is ever
-      # loosened; that repository's missing pypi.org publisher is the second
-      # line of defence.
-      - name: the repository guard (FR-048) again, before anything else, and v<version> is a final from opensoft/openRepoTools-code
-        run: |
-          final='^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$'
-          if ! [[ "$VERSION" =~ $final ]] || [ "$VERSION" = 0.0.0 ]; then
-            echo "::error::PyPI takes a final release X.Y.Z alone, never a pre-release, so nothing is uploaded"
-            printf 'the input, quoted: %q\n' "$VERSION"
-            exit 1
-          fi
-          if [ "$GITHUB_REF" != "refs/tags/v$VERSION" ]; then
-            echo "::error::an upload is made from the tag v$VERSION alone, and this run names '$GITHUB_REF', so nothing is uploaded"
-            exit 1
-          fi
-          if [ "$GITHUB_REPOSITORY" != opensoft/openRepoTools-code ]; then
-            echo "::error::a release reaches PyPI from opensoft/openRepoTools-code alone, as GitHub spells it, and this run is in '$GITHUB_REPOSITORY', so nothing is uploaded"
-            exit 1
-          fi
-          echo "opensoft/openRepoTools-code sends the final $VERSION to PyPI"
-
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
-        with:
-          name: wheel
-          path: dist
-
-      - name: dist holds the wheel the build job verified, and nothing else
-        run: |
-          found="$(ls -A dist)"
-          if [ "$found" != "$WHEEL" ]; then
-            echo "::error::dist holds '$found', and the build job verified $WHEEL"
-            exit 1
-          fi
-          echo "$WHEEL_SHA256  dist/$WHEEL" | sha256sum --strict -c -
-
-      - name: this environment still asks a reviewer and admits only the tags v*, and this run's deployment to it was approved
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ENVIRONMENT: pypi
-        run: |
-          python3 - <<'PY'
-          import json, os, subprocess, sys
-
-          repo, environment = os.environ["GITHUB_REPOSITORY"], os.environ["ENVIRONMENT"]
-
-
-          def api(path):
-              done = subprocess.run(["gh", "api", path], capture_output=True, text=True)
-              if done.returncode != 0:
-                  sys.exit(f"::error::`gh api {path}` failed, so nothing is uploaded: {done.stderr.strip()}")
-              return json.loads(done.stdout)
-
-
-          settings = api(f"repos/{repo}/environments/{environment}")
-          reviewers = [rule for rule in settings.get("protection_rules") or []
-                       if rule.get("type") == "required_reviewers" and rule.get("reviewers")]
-          policy = settings.get("deployment_branch_policy") or {}
-          limits = api(f"repos/{repo}/environments/{environment}/deployment-branch-policies?per_page=100")
-          rules = sorted((p.get("type"), p.get("name")) for p in limits.get("branch_policies") or [])
-          if not reviewers:
-              sys.exit(f"::error::the {environment} environment names no required reviewer now")
-          if policy.get("custom_branch_policies") is not True or rules != [("tag", "v*")]:
-              sys.exit(f"::error::the {environment} environment's deployment limit is now {rules}, "
-                       "not the one rule ('tag', 'v*'), so nothing is uploaded")
-          approved = [review["user"]["login"]
-                      for review in api(f"repos/{repo}/actions/runs/{os.environ['GITHUB_RUN_ID']}/approvals")
-                      if review.get("state") == "approved"
-                      and any(e.get("name") == environment for e in review.get("environments") or [])]
-          if not approved:
-              sys.exit(f"::error::this run holds no approval of a deployment to {environment}, "
-                       "so nothing is uploaded")
-          print(f"{environment}: a reviewer, the tags v* alone, and approved by {', '.join(approved)}")
-          PY
-
-      - name: the tag v<version> still names this commit
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          object="$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/v$VERSION" \
-              --jq 'select(.object.type == "tag") | .object.sha')" || object=
-          commit=
-          if [ -n "$object" ]; then
-            commit="$(gh api "repos/$GITHUB_REPOSITORY/git/tags/$object" \
-                --jq 'select(.object.type == "commit") | .object.sha')" || commit=
-          fi
-          if [ "$commit" != "$GITHUB_SHA" ]; then
-            echo "::error::the annotated tag v$VERSION no longer names $GITHUB_SHA (it names '$commit'), so nothing is uploaded"
-            exit 1
-          fi
-          echo "v$VERSION still names $GITHUB_SHA"
-
-      - name: the index holds no file of this version but the verified wheel
-        run: |
-          python3 - <<'PY'
-          import json, os, sys, urllib.error, urllib.request
-
-          index, version = os.environ["INDEX"], os.environ["VERSION"]
-          url = f"{os.environ['JSON_BASE']}{version}/json"
-          wanted = {os.environ["WHEEL"]: os.environ["WHEEL_SHA256"]}
-          try:
-              with urllib.request.urlopen(url, timeout=30) as response:
-                  release = json.load(response)
-          except urllib.error.HTTPError as error:
-              if error.code != 404:
-                  raise
-              print(f"{index} holds no file of openrepotools {version} yet")
-              sys.exit(0)
-          held = {f["filename"]: f["digests"]["sha256"] for f in release["urls"]}
-          other = {name: digest for name, digest in held.items() if wanted.get(name) != digest}
-          if other:
-              sys.exit(f"::error::{index} already holds {other} for openrepotools {version}, "
-                       "which the build job did not verify, so nothing is uploaded")
-          yanked = sorted(f["filename"] for f in release["urls"] if f.get("yanked"))
-          if yanked:
-              sys.exit(f"::error::{index} holds {yanked} at the verified digest, but yanked; "
-                       "un-yank it on the index, or release a new version")
-          print(f"{index} holds {sorted(held)}, at the verified digest; skip-existing uploads nothing new")
-          PY
-
-      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
-        with:
-          skip-existing: true
-          print-hash: true
-
-      # AFTER THE UPLOAD, PyPI SERVES EXACTLY THE VERIFIED DIGEST: the
-      # bytes TestPyPI served and the install check ran.
-      - name: the index serves exactly the verified wheel
-        run: |
-          python3 - <<'PY'
-          import json, os, sys, time, urllib.error, urllib.request
-
-          index, version = os.environ["INDEX"], os.environ["VERSION"]
-          url = f"{os.environ['JSON_BASE']}{version}/json"
-          wanted = {os.environ["WHEEL"]: os.environ["WHEEL_SHA256"]}
-          served = None
-          for attempt in range(1, 21):
-              try:
-                  with urllib.request.urlopen(url, timeout=30) as response:
-                      release = json.load(response)
-                  served = {f["filename"]: f["digests"]["sha256"] for f in release["urls"]}
-                  if served == wanted:
-                      if any(f.get("yanked") for f in release["urls"]):
-                          sys.exit(f"::error::{index} serves the verified wheel, yanked")
-                      break
-                  print(f"read {attempt}: {index} serves {served} so far")
-              except (urllib.error.URLError, TimeoutError, ConnectionError) as error:
-                  code = getattr(error, "code", None)
-                  if code is not None and code != 404 and code < 500:
-                      raise
-                  print(f"read {attempt}: {url} did not answer yet ({error})")
-              time.sleep(15)
-          else:
-              sys.exit(f"::error::after 20 reads {index} serves {served}, and the build job "
-                       f"verified {wanted}")
-          print(f"{index} serves exactly the verified wheel: {served}")
-          PY
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
deleted file mode 100644
index 46feb68a..00000000
--- a/.github/workflows/tests.yml
+++ /dev/null
@@ -1,535 +0,0 @@
-name: tests
-
-# The suite builds estates out of BARE REPOSITORIES IN A TEMPORARY DIRECTORY
-# and clones them over the filesystem. It never calls `gh`, never touches the
-# network, and must never create a real repository.
-#
-# THE SUITE RUNS ON LINUX ONLY. Brett Heap decided on 2026-10-15, for the
-# whole estate, to take the macOS and Windows test jobs out of CI: `tests-macos`,
-# `tests-windows` and the macOS bash-3.2 parse (`parse-macos`) are gone from this
-# file, and what they checked is not checked anywhere in it now.
-#
-# EVERY CHECKOUT THAT RUNS THE SUITE TAKES `submodules: true`, `tests-no-submodule`
-# excepted: it checks out `submodules: false` on purpose, to prove the skip path.
-# The estate tests read eight of openRepoShape's own files out of
-# `upstream/openRepoShape`, and `wip init`'s tests read the nine of
-# `templates/workspace-root/`, all pinned by `contracts/openreposhape-pin.yaml`.
-# Without them those tests SKIP rather than fail — which is what the
-# `tests-no-submodule` job below proves on purpose, and what every suite job
-# besides it must not be quietly doing.
-#
-# THE LANE HELPERS' OWN SUITE RUNS IN THESE JOBS TOO, and it runs because
-# `tests/test_lane_helpers_suite.py` calls it: this repository's CI is
-# pytest-only, so 196 KB of bash arriving at `tests/test_lane_helpers.sh` under
-# lane-collision-protocol Amendment 9's move would otherwise have run in NO
-# job. A suite nothing runs is not a suite (act 3, obligation 6). It is bash,
-# and with macOS out of CI it runs under Linux's bash 5 only: no job here parses
-# it under Apple's bash 3.2 any more.
-
-# `pull_request` names `labeled` beside GitHub's own three defaults
-# (`opened`, `synchronize`, `reopened`). It was put there so that the
-# coordinator applying `ready` to an already-open PR would reach `tests-macos`'s
-# `if:`; that job is gone, so no job here reads a label any more, and `labeled`
-# stays as it was. `on:` is shared by the whole workflow and no job has an
-# `if:`, so EVERY TRIGGER RUNS ALL FOUR JOBS, `guard-launch-mode`, `tests`,
-# `tests-no-submodule` and `package`, and so does ANY label landing on a PR.
-# `push` covers `main` and every `release/v*` branch (#228): the release
-# workflow builds only a commit whose push or dispatch run of those four is
-# green, and a patch release's commit is on its release branch, not on main.
-# The nightly `schedule` and `workflow_dispatch` run the same four. The cron
-# is UTC.
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches: [main, 'release/v*']
-  schedule:
-    - cron: '17 4 * * *'          # 04:17 UTC, nightly
-  workflow_dispatch:
-
-jobs:
-  # Keep the process launch contract independently visible while the full
-  # lane-helper suite runs. Each GitHub job has its own workstation runner;
-  # the canonical wrapper still serializes any pytest processes on that runner.
-  guard-launch-mode:
-    # EVERY UBUNTU RUNNER IS ON 24.04: `ubuntu-latest` became Ubuntu 26.04 on
-    # 2026-10-21. There setup-python has no Python 3.9 and the `[host]` case of
-    # the TERM-ignoring kill test fails. Pinned until 26.04 support is decided.
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          submodules: true
-          fetch-depth: 1
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        with:
-          python-version: '3.x'
-      - name: install the test runner
-        run: 'python3 -m pip install --disable-pip-version-check --only-binary=:all: pytest==8.3.4'
-      - name: guard launch mode and repository hygiene
-        env:
-          GIT_AUTHOR_NAME: openRepoTools CI
-          GIT_AUTHOR_EMAIL: ci@openrepotools.invalid
-          GIT_COMMITTER_NAME: openRepoTools CI
-          GIT_COMMITTER_EMAIL: ci@openrepotools.invalid
-        run: bash tests/run.sh -k 'guard_launch_mode or repo_hygiene'
-
-  tests:
-    runs-on: ubuntu-24.04
-    steps:
-      # PINNED BY COMMIT, not by tag — openRepoShape's own rule, and the same
-      # two commits every job here pins. A tag can be moved and a commit
-      # cannot, and three jobs resolving three versions of one action is
-      # exactly the drift a pin exists to prevent.
-      #
-      # `fetch-depth: 1` is enough: nothing in this repository compares a
-      # working-tree file against an older commit, which is what made
-      # openRepoShape's own jobs need full history.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          submodules: true
-          fetch-depth: 1
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        with:
-          python-version: '3.x'
-
-      # pytest is the TEST RUNNER and is the only thing installed here.
-      # Nothing this repository ships needs a Python package: its commands are
-      # bash, or `python3` (`lanes-index`, `lane-worktrees`) importing only the
-      # standard library, and the suite itself imports only the standard
-      # library.
-      # PINNED. A CI job that resolves "latest" on every run is a job whose
-      # result depends on the day it ran, which is the same objection this
-      # family makes to pinning a tag instead of a commit.
-      - name: install the test runner
-        run: python3 -m pip install --disable-pip-version-check pytest==8.3.4
-
-      # Per-invocation identity, never `git config --global`: a lane that
-      # mirrors this step on a workstation must not be able to rewrite the
-      # operator's ~/.gitconfig. The fixtures commit into throwaway
-      # repositories and honour these variables.
-      - name: git identity for the fixture commits (env, not global config)
-        run: |
-          {
-            echo "GIT_AUTHOR_NAME=openRepoTools CI"
-            echo "GIT_AUTHOR_EMAIL=ci@openrepotools.invalid"
-            echo "GIT_COMMITTER_NAME=openRepoTools CI"
-            echo "GIT_COMMITTER_EMAIL=ci@openrepotools.invalid"
-          } >> "$GITHUB_ENV"
-
-      - name: tests
-        run: python3 -m pytest tests -q
-
-  # THE SKIP PATH, PROVED. A fork's first command is `git clone` without
-  # `--recurse-submodules` and then `pytest`, and if that goes RED the fork is
-  # one nobody finishes. So one job checks out with NO submodules and asserts
-  # the suite still exits 0: the estate tests skip, naming
-  # `git submodule update --init upstream/openRepoShape`, and the hygiene and
-  # installer tests — which need nothing but this repository — still run.
-  #
-  # `pytest -q` exits 0 on skips and 1 on failures, so the job's own status IS
-  # the assertion; `-rs` prints the skip reasons, which is what a person
-  # reading this job wants to see.
-  tests-no-submodule:
-    runs-on: ubuntu-24.04
-    steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          submodules: false
-          fetch-depth: 1
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        with:
-          python-version: '3.x'
-
-      - name: install the test runner
-        run: python3 -m pip install --disable-pip-version-check pytest==8.3.4
-
-      - name: the submodule really is not materialized
-        run: |
-          set -euo pipefail
-          if [ -f upstream/openRepoShape/scripts/repo_shape.py ]; then
-            echo "the submodule IS checked out; this job proves nothing" >&2
-            exit 1
-          fi
-
-      - name: the suite skips rather than fails
-        run: python3 -m pytest tests -q -rs
-
-  # THE openrepotools PACKAGE, BUILT, CHECKED AGAINST THIS COMMIT, INSTALLED
-  # AS A PERSON INSTALLS IT AND TESTED (#228, contracts/workflows.md). The
-  # release workflow builds only a commit whose push or dispatch run of all
-  # four jobs here is green, so this job is where a commit proves it packages:
-  #
-  #   * the wheel, built twice at the commit's own time, is one file;
-  #   * every file in it is the commit's own, the payload in mode as well as
-  #     in bytes, and its `.dist-info` holds exactly five names, the commit's
-  #     LICENSE among them;
-  #   * pipx installs it, it says it is unstamped, and an offline `--install`
-  #     run through pipx's link leaves that link to pipx;
-  #   * the package's three test modules run against that wheel, and one
-  #     test skipped among them fails the job (design.md Decision 9).
-  #
-  # UBUNTU, ON THE OLDEST PYTHON THE PACKAGE SUPPORTS, 3.9, as openRepoShape
-  # v1.1.0's own `package` job, its model. tomli and pipx come by hash from
-  # the two locks under `.github/`, and pytest at the pin the jobs above
-  # install. The two builds reach PyPI for `pyproject.toml`'s pinned
-  # hatchling and pipx reaches it for its shared pip; the `--install` run
-  # reaches nothing.
-  package:
-    runs-on: ubuntu-24.04
-    steps:
-      # The same two commits the other jobs pin.
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-        with:
-          submodules: true
-          fetch-depth: 1
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-        with:
-          python-version: '3.9'
-
-      # The `tests` job's own step: per-invocation identity, never
-      # `git config --global`, for the fixture commits the package's tests
-      # make.
-      - name: git identity for the fixture commits (env, not global config)
-        run: |
-          {
-            echo "GIT_AUTHOR_NAME=openRepoTools CI"
-            echo "GIT_AUTHOR_EMAIL=ci@openrepotools.invalid"
-            echo "GIT_COMMITTER_NAME=openRepoTools CI"
-            echo "GIT_COMMITTER_EMAIL=ci@openrepotools.invalid"
-          } >> "$GITHUB_ENV"
-
-      # THE TEST TOOLS, tomli FIRST AND BY HASH (research R12). The step copies
-      # the build lock's whole tomli entry, its requirement line and every hash
-      # line under it, into a file of its own and installs that, wheels only, so
-      # this file holds no digest. The pipx lock carries the same entry, and
-      # step 7 installs it after this, so the package's tests run on that tomli,
-      # which on 3.9 reads `pyproject.toml`. Then pytest at the other jobs' pin
-      # keeps that tomli: it meets pytest's own requirement below Python 3.11.
-      - name: the test tools, tomli by hash from the build lock, then pytest
-        run: |
-          set -euo pipefail
-          lock=.github/release-build-requirements.txt
-          entry="$RUNNER_TEMP/tomli-requirements.txt"
-          awk '/^tomli==/ { found = 1 } found { print; if ($0 !~ /\\$/) exit }' \
-              "$lock" > "$entry"
-          case "$(head -n 1 "$entry")" in
-          tomli==*) ;;
-          *)
-            echo "::error::$lock has no tomli entry, and this job takes tomli from there alone"
-            exit 1
-            ;;
-          esac
-          if ! grep -q -e '--hash=' "$entry"; then
-            echo "::error::$lock's tomli entry carries no hash"
-            exit 1
-          fi
-          cat "$entry"
-          python3 -m pip install --disable-pip-version-check --require-hashes \
-              --only-binary=:all: -r "$entry"
-          python3 -m pip install --disable-pip-version-check --only-binary=:all: \
-              pytest==8.3.4
-
-      # TWICE, AT THE COMMIT'S OWN TIME, AND THE TWO MUST BE ONE FILE, as the
-      # release build requires of its own two (FR-030). `pip wheel` builds in
-      # pip's isolated build environment, with `pyproject.toml`'s pinned
-      # hatchling; `--no-deps`, because the package has no dependency to
-      # build; `--no-cache-dir`, so neither build is a copy of the other.
-      - name: build the wheel twice, and the two are one file
-        run: |
-          set -euo pipefail
-          SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"
-          export SOURCE_DATE_EPOCH
-          python3 -m pip wheel --disable-pip-version-check --no-cache-dir --no-deps \
-              -w "$RUNNER_TEMP/a" .
-          python3 -m pip wheel --disable-pip-version-check --no-cache-dir --no-deps \
-              -w "$RUNNER_TEMP/b" .
-          for out in a b; do
-            count="$(find "$RUNNER_TEMP/$out" -mindepth 1 -maxdepth 1 | wc -l)"
-            built="$(find "$RUNNER_TEMP/$out" -mindepth 1 -maxdepth 1 -printf '%f\n')"
-            if [ "$count" -ne 1 ] || [ "${built%.whl}" = "$built" ] ||
-                [ ! -f "$RUNNER_TEMP/$out/$built" ]; then
-              echo "::error::the build into $RUNNER_TEMP/$out left '$built', and a build is exactly one .whl"
-              exit 1
-            fi
-          done
-          wheel="$(find "$RUNNER_TEMP/a" -mindepth 1 -maxdepth 1 -printf '%f')"
-          if [ "$(find "$RUNNER_TEMP/b" -mindepth 1 -maxdepth 1 -printf '%f')" != "$wheel" ] ||
-              ! cmp "$RUNNER_TEMP/a/$wheel" "$RUNNER_TEMP/b/$wheel"; then
-            echo "::error::two builds of $(git rev-parse HEAD) at SOURCE_DATE_EPOCH $SOURCE_DATE_EPOCH are not one file"
-            exit 1
-          fi
-          sha256sum "$RUNNER_TEMP/a/$wheel" "$RUNNER_TEMP/b/$wheel"
-          echo "PACKAGE_WHEEL=$RUNNER_TEMP/a/$wheel" >> "$GITHUB_ENV"
-
-      # EVERY FILE IN THE WHEEL IS THE COMMIT'S OWN (contracts/wheel.md, checks
-      # 2 to 6), read from git at HEAD and never from the checkout:
-      #
-      #   * each payload file of `pyproject.toml`'s force-include table is its
-      #     blob, byte for byte, at mode 0755 where git records 100755 and 0644
-      #     where it records 100644, which is how hatchling 1.27.0 writes them;
-      #   * each module is its file under `src/openrepotools/`;
-      #   * the stamp is the committed file, unchanged: this build is unstamped;
-      #   * the `.dist-info` holds exactly its five names, LICENSE the commit's;
-      #   * and nothing else is in the wheel.
-      #
-      # It names every problem, then fails if there was one. INLINE, as the
-      # release build's own check is (research R13), and
-      # `tests/test_tests_workflow.py` runs this heredoc on four wheels it
-      # makes from HEAD's blobs: the wheel as built, and three with one thing
-      # wrong.
-      - name: the wheel holds this commit's files, byte for byte and mode for mode
-        run: |
-          set -euo pipefail
-          python3 -I - "$RUNNER_TEMP"/a/*.whl <<'PY'
-          import re
-          import subprocess
-          import sys
-          import zipfile
-
-          try:
-              import tomllib
-          except ImportError:  # 3.9 and 3.10: the tomli installed by hash above
-              import tomli as tomllib
-
-          COMMIT = "HEAD"
-          PACKAGE, PAYLOAD = "openrepotools/", "openrepotools/payload/"
-          STAMP = "src/openrepotools/_release.py"
-
-
-          def git(*args):
-              return subprocess.run(["git", *args], capture_output=True,
-                                    check=True).stdout
-
-
-          def blob(path):
-              return git("cat-file", "blob", f"{COMMIT}:{path}")
-
-
-          if len(sys.argv) != 2:
-              sys.exit("::error::the check reads the one wheel the first build left, "
-                       f"and was given {sys.argv[1:]}")
-
-          modes = {}
-          for record in git("ls-tree", "-r", "-z", "--full-tree", COMMIT).split(b"\0"):
-              if record:
-                  meta, path = record.split(b"\t", 1)
-                  mode, kind, _ = meta.decode("ascii").split(" ")
-                  if kind == "blob":
-                      modes[path.decode("utf-8")] = mode
-
-          problems = []
-          versions = re.findall(r'(?m)^VERSION = "([^"]*)"$', blob(STAMP).decode("utf-8"))
-          if len(versions) != 1:
-              sys.exit(f"::error::{STAMP} assigns VERSION {len(versions)} times at "
-                       f"{COMMIT}, not once")
-          info = f"openrepotools-{versions[0]}.dist-info/"
-
-          # Each member the wheel must hold: the file at HEAD it is, or None for
-          # one the build writes, and the mode a payload file must have.
-          wanted = {}
-          table = (tomllib.loads(blob("pyproject.toml").decode("utf-8"))
-                   ["tool"]["hatch"]["build"]["targets"]["wheel"]["force-include"])
-          for source, member in table.items():
-              if member != PAYLOAD + source:
-                  problems.append(f"pyproject.toml puts {source} at {member}, "
-                                  f"not at {PAYLOAD}{source}")
-              if modes.get(source) not in ("100755", "100644"):
-                  problems.append(f"{source} is {modes.get(source, 'no file')} at "
-                                  f"{COMMIT}, not a file the wheel can carry")
-                  continue
-              wanted[member] = (source, 0o755 if modes[source] == "100755" else 0o644)
-          for path in modes:
-              if re.fullmatch(r"src/openrepotools/[^/]+\.py", path):
-                  wanted[PACKAGE + path.rsplit("/", 1)[1]] = (path, None)
-          wanted[info + "licenses/LICENSE"] = ("LICENSE", None)
-          for name in ("METADATA", "WHEEL", "RECORD", "entry_points.txt"):
-              wanted[info + name] = (None, None)
-
-          with zipfile.ZipFile(sys.argv[1]) as wheel:
-              members = wheel.infolist()
-              names = [member.filename for member in members]
-              for name in sorted({name for name in names if names.count(name) > 1}):
-                  problems.append(f"{name} is in the wheel more than once")
-              for member in members:
-                  name = member.filename
-                  if name not in wanted:
-                      problems.append(f"{name} is in the wheel, and is no member "
-                                      "contracts/wheel.md lists")
-                      continue
-                  source, perm = wanted[name]
-                  if source is None:
-                      print(f"{name}: written by the build")
-                      continue
-                  what = "the committed stamp" if source == STAMP else source
-                  if wheel.read(name) != blob(source):
-                      problems.append(f"{name} in the wheel is not {what} at "
-                                      f"{COMMIT}, byte for byte")
-                      continue
-                  if perm is None:
-                      print(f"{name} = {COMMIT}:{source}")
-                      continue
-                  mode = member.external_attr >> 16
-                  if mode & 0o777 != perm or mode & 0o170000 not in (0, 0o100000):
-                      problems.append(f"{name} has mode {mode:o} in the wheel, and "
-                                      f"{source} is {modes[source]} at {COMMIT}, "
-                                      f"which is mode {perm:04o}")
-                      continue
-                  print(f"{name} = {COMMIT}:{source}, mode {perm:04o}")
-          for name in sorted(set(wanted) - set(names)):
-              problems.append(f"{name} is missing from the wheel")
-
-          for problem in problems:
-              print(f"::error::{problem}")
-          print(f"{len(names)} members read against {COMMIT}: "
-                f"{len(problems)} problem(s)")
-          sys.exit(1 if problems else 0)
-          PY
-
-      # pipx ON THE 3.9 ABOVE, BY HASH: the lock gives 1.11.1 there, the newest
-      # pipx that installs on 3.9 (`.github/release-pipx-requirements.txt`
-      # says why). Its home and its links are directories of this job's own,
-      # under the runner's temp, and the steps below read them through
-      # `$GITHUB_ENV`.
-      - name: pipx from its hash lock
-        run: |
-          set -euo pipefail
-          {
-            echo "PIPX_HOME=$RUNNER_TEMP/pipx/home"
-            echo "PIPX_BIN_DIR=$RUNNER_TEMP/pipx/bin"
-          } >> "$GITHUB_ENV"
-          python3 -m pip install --disable-pip-version-check --require-hashes \
-              --only-binary=:all: -r .github/release-pipx-requirements.txt
-          python3 -m pipx --version
-
-      # ONE COMMAND, SO ONE LINK: the package declares the one console script
-      # `openRepoTools`, and pipx places that link and nothing else.
-      - name: install the wheel with pipx
-        run: |
-          set -euo pipefail
-          python3 -m pipx install "$PACKAGE_WHEEL"
-          ls -l "$PIPX_BIN_DIR"
-          placed="$(ls -A "$PIPX_BIN_DIR")"
-          if [ "$placed" != openRepoTools ] || [ ! -L "$PIPX_BIN_DIR/openRepoTools" ]; then
-            echo "::error::pipx placed '$placed' in $PIPX_BIN_DIR, and the package's one command is the link openRepoTools"
-            exit 1
-          fi
-
-      # A BUILD FROM A CHECKOUT IS NOT A RELEASE, AND SAYS SO: the committed
-      # stamp is unstamped, so `--version` prints contracts/cli-output.md's
-      # five unstamped lines, and nothing else.
-      - name: the unstamped --version, line for line
-        run: |
-          set -euo pipefail
-          "$PIPX_BIN_DIR/openRepoTools" --version > "$RUNNER_TEMP/version.out" 2>&1
-          cat > "$RUNNER_TEMP/version.want" <<'EOF'
-          openRepoTools 0.0.0 (an unstamped package)
-            version   0.0.0, unstamped: a package built from a checkout, not a release
-            tag       none
-            commit    none
-            digest    none
-          EOF
-          diff -u "$RUNNER_TEMP/version.want" "$RUNNER_TEMP/version.out"
-
-      # OFFLINE, IN A HOME OF ITS OWN, BESIDE PIPX'S LINK (research R14,
-      # FR-016). `--install`, run through the link, places the other sixteen
-      # commands, the skills and the command files, leaves the link to pipx,
-      # and says so in the two lines below, exactly. `env -i` hands it nothing
-      # of the runner's environment but what is named on its line: a fresh
-      # HOME, the bin directory pipx's link is in, a repository that cannot
-      # resolve, and a PATH whose first directory holds a `gh` and a `curl`
-      # that both fail, so anything that fetched would fail. The hook pair is
-      # deferred there, as in any home without `~/projects/xFactory/lanes-edit.sh`
-      # (#237), and the run says so. The receipt has 28 rows, a full install's
-      # 29 less the link, and the link is as pipx left it.
-      - name: an offline --install beside pipx's link
-        run: |
-          set -euo pipefail
-          home="$RUNNER_TEMP/install-home"
-          offline="$RUNNER_TEMP/offline-bin"
-          mkdir "$home" "$offline"
-          for tool in gh curl; do
-            printf '#!/bin/sh\necho "%s: this run is offline" >&2\nexit 1\n' "$tool" > "$offline/$tool"
-            chmod 755 "$offline/$tool"
-          done
-          link="$PIPX_BIN_DIR/openRepoTools"
-          before="$(stat -c %i "$link") $(readlink "$link") $(sha256sum < "$link")"
-          status=0
-          env -i HOME="$home" PATH="$offline:$PIPX_BIN_DIR:$PATH" \
-              OPENREPOTOOLS_BIN_DIR="$PIPX_BIN_DIR" OPENREPOTOOLS_REPO=offline.invalid/sentinel \
-              "$link" --install > "$RUNNER_TEMP/install.out" 2> "$RUNNER_TEMP/install.err" ||
-              status=$?
-          cat "$RUNNER_TEMP/install.out"
-          cat "$RUNNER_TEMP/install.err" >&2
-          if [ "$status" -ne 0 ]; then
-            echo "::error::the offline --install exited $status"
-            exit 1
-          fi
-          skip="openRepoTools: left to pipx at $link (a link into pipx's openrepotools environment); update it with \`pipx upgrade openrepotools\`, then run \`openRepoTools --install\` again"
-          count="openRepoTools: 16 of 17 placed in $PIPX_BIN_DIR, and 1 left to pipx"
-          for line in "$skip" "$count"; do
-            seen="$(grep -cFx -e "$line" "$RUNNER_TEMP/install.out" || true)"
-            if [ "$seen" -ne 1 ]; then
-              echo "::error::--install printed this line $seen times, not once: $line"
-              exit 1
-            fi
-          done
-          receipt="$home/.local/share/openRepoTools/installed.tsv"
-          if [ ! -f "$receipt" ]; then
-            echo "::error::--install wrote no receipt at $receipt"
-            exit 1
-          fi
-          rows="$(awk -F '\t' 'NF == 4' "$receipt" | wc -l)"
-          lines="$(wc -l < "$receipt")"
-          if [ "$rows" -ne 28 ] || [ "$lines" -ne 28 ]; then
-            echo "::error::the receipt has $lines lines and $rows rows, not 28: a full install's 29 less pipx's link"
-            exit 1
-          fi
-          if [ ! -L "$link" ] ||
-              [ "$(stat -c %i "$link") $(readlink "$link") $(sha256sum < "$link")" != "$before" ]; then
-            echo "::error::--install changed pipx's link at $link"
-            exit 1
-          fi
-
-      # THE PACKAGE'S OWN TESTS, AGAINST THE WHEEL BUILT ABOVE (research R8):
-      # `OPENREPOTOOLS_TEST_WHEEL` is what the built-wheel tests read, and
-      # they skip without it, as they do in the `tests` job. The report is
-      # read in the step after.
-      - name: the package's tests, against the built wheel
-        run: |
-          set -euo pipefail
-          export OPENREPOTOOLS_TEST_WHEEL="$PACKAGE_WHEEL"
-          python3 -m pytest tests/test_package.py tests/test_package_stamp.py \
-              tests/test_install_pipx.py -q -rs --junitxml="$RUNNER_TEMP/package-tests.xml"
-
-      # A SKIP HERE IS A FAILURE (design.md Decision 9). `pytest -q` exits 0
-      # on a skip, so the JUnit report is the enforcer: at least one test, and
-      # none skipped, failed or in error.
-      - name: the package's tests all ran, and none was skipped
-        run: |
-          set -euo pipefail
-          python3 -I - "$RUNNER_TEMP/package-tests.xml" <<'PY'
-          import sys
-          import xml.etree.ElementTree as ElementTree
-
-          root = ElementTree.parse(sys.argv[1]).getroot()
-          suites = [root] if root.tag == "testsuite" else root.findall("testsuite")
-          counts = {key: sum(int(suite.get(key, "0")) for suite in suites)
-                    for key in ("tests", "skipped", "failures", "errors")}
-          cases = list(root.iter("testcase"))
-          marked = {key: sum(1 for case in cases if case.find(key) is not None)
-                    for key in ("skipped", "failure", "error")}
-          print(f"the report: {counts}; {len(cases)} test cases, of them {marked}")
-          problems = []
-          if counts["tests"] < 1 or not cases:
-              problems.append("no test ran")
-          for key in ("skipped", "failures", "errors"):
-              if counts[key]:
-                  problems.append(f"{counts[key]} {key}")
-          for key, number in marked.items():
-              if number:
-                  problems.append(f"{number} test cases marked {key}")
-          for problem in problems:
-              print(f"::error::the package's tests: {problem}")
-          sys.exit(1 if problems else 0)
-          PY
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
new file mode 100644
index 00000000..4641aa9c
--- /dev/null
+++ b/.github/workflows/validate.yml
@@ -0,0 +1,223 @@
+name: validate
+
+# The NEUTRAL gate: naming, manifest, lockstep pins. Nothing here needs a
+# review lane, a wallet register or any overlay — a project with no overlays is
+# fully conformant, and overlays attach to an existing shape rather than the
+# reverse.
+#
+# It runs on PULL REQUESTS. So does the aggregation's, which is how seven
+# consecutive pin-syncs that moved a gitlink alone went a day unnoticed:
+# `main` never reports this check, and the breakage surfaces on somebody
+# else's change. Read a green run here as "this pull request is in lockstep",
+# never as "main is".
+
+on:
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    # The `secrets` context is NOT allowed in a step-level `if:` expression —
+    # GitHub rejects the whole workflow file as unparseable the moment one
+    # appears there ("unrecognized named-value 'secrets'"), and the failure
+    # mode is not a red step but a push-event run with ZERO jobs: this was
+    # the defect on the first real projects (MedxSoft/MedxEHR #8,
+    # MedxSoft/MedxGlass #1). `secrets` IS allowed in `env:`, so the presence
+    # check is done here, once, and the guarded steps below read the
+    # resulting `env.*` booleans instead of `secrets.*` directly.
+    env:
+      SHAPE_LEGS_TOKEN_SET: ${{ secrets.SHAPE_LEGS_TOKEN != '' }}
+      SHAPE_LEGS_APP_SET: ${{ secrets.SHAPE_LEGS_APP_ID != '' && secrets.SHAPE_LEGS_APP_PRIVATE_KEY != '' }}
+    steps:
+      # The ROOT repository is always readable by the workflow's own default
+      # token, so this checkout never carries `token:` — no override, no
+      # dependency on either leg credential at all. That was the defect (first
+      # real use, MedxSoft/MedxEHR and MedxSoft/MedxGlass, runs 33821509948
+      # and 33821512605): `token: ${{ secrets.SHAPE_LEGS_TOKEN ||
+      # github.token }}` put a legs-scoped token onto the ROOT checkout, so a
+      # token correctly scoped to `contents:read` on the legs alone (or a
+      # mis-scoped/unapproved one) made `actions/checkout` itself fail with a
+      # 403 before any check ran. `persist-credentials: false` keeps that
+      # token out of the local git config entirely, so the submodule step
+      # below authenticates the legs on its own terms instead of inheriting
+      # anything from this step.
+      - uses: actions/checkout@v4
+        with:
+          submodules: false
+          persist-credentials: false
+
+      # Ruled by Brett Heap on 2026-09-04: move the legs credential to a
+      # GitHub App. An installation token is minted PER OWNER, so the legs it
+      # can name are only those this repository's own owner also owns — this
+      # step reads `.gitmodules` once, offline, and turns each leg URL (HTTPS
+      # or SSH) into an `owner/name` pair, keeping the names whose owner
+      # matches `github.repository_owner` and warning (excluding, not
+      # failing) on any that don't, since those can only ever be reached by
+      # `SHAPE_LEGS_TOKEN`. Runs only when the App secrets are present — its
+      # only consumer is the mint step below, which is guarded the same way.
+      - name: leg repository names from .gitmodules
+        id: leg-names
+        if: env.SHAPE_LEGS_APP_SET == 'true'
+        env:
+          REPO_OWNER: ${{ github.repository_owner }}
+        run: |
+          set -e
+          legs=""
+          if [ -f .gitmodules ]; then
+            while IFS= read -r url; do
+              [ -n "$url" ] || continue
+              case "$url" in
+                https://github.com/*) repo="${url#https://github.com/}" ;;
+                git@github.com:*) repo="${url#git@github.com:}" ;;
+                *) continue ;;
+              esac
+              repo="${repo%.git}"
+              owner="${repo%%/*}"
+              name="${repo#*/}"
+              if [ "$owner" = "$REPO_OWNER" ]; then
+                if [ -z "$legs" ]; then
+                  legs="$name"
+                else
+                  legs="$legs,$name"
+                fi
+              else
+                echo "::warning::leg $owner/$name is owned by a different account ($owner) than this repository ($REPO_OWNER); a GitHub App installation token is per-owner, so it is excluded from the App-minted token here and can only be reached via SHAPE_LEGS_TOKEN."
+              fi
+            done < <(git config --file .gitmodules --get-regexp '\.url$' | cut -d' ' -f2- || true)
+          fi
+          echo "legs=$legs" >> "$GITHUB_OUTPUT"
+          echo "legs for the App-minted token: $legs"
+
+      # A configured App that CANNOT mint is a misconfiguration, not a
+      # degrade: unlike a missing SHAPE_LEGS_TOKEN (handled below by letting
+      # the fetch fall back and degrade), two secrets that are present but
+      # wrong mean the App id/key don't match, or the App is not installed
+      # with `contents:read` on these legs, and a human must act on that —
+      # so `continue-on-error: false` (the default, spelled out) lets this
+      # fail the job outright, and the step below turns the action's own
+      # error into one that names the two secrets and the installation.
+      - name: mint a leg-reader token from the GitHub App
+        id: app-token
+        if: env.SHAPE_LEGS_APP_SET == 'true'
+        continue-on-error: false
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        with:
+          app-id: ${{ secrets.SHAPE_LEGS_APP_ID }}
+          private-key: ${{ secrets.SHAPE_LEGS_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: ${{ steps.leg-names.outputs.legs }}
+          permission-contents: read
+
+      - name: fail — the GitHub App could not mint an installation token
+        if: failure() && steps.app-token.outcome == 'failure'
+        run: |
+          echo "::error::Could not mint a leg-reader installation token from the GitHub App. Check that the SHAPE_LEGS_APP_ID and SHAPE_LEGS_APP_PRIVATE_KEY secrets are correct, and that the App is installed on ${{ github.repository_owner }} with Contents: read access to the leg repositories: ${{ steps.leg-names.outputs.legs }}"
+          exit 1
+
+      # Best-effort, and its failure is CAPTURED rather than let through as a
+      # step failure: a private leg with no leg credential configured is a
+      # DEGRADE (see the two guarded steps below), never a red
+      # `actions/checkout`. That was the earlier defect: `submodules: true`
+      # on checkout hard-fails the whole job the moment a leg cannot be
+      # cloned, with no route to run the checks that do not need the legs at
+      # all.
+      #
+      # Resolution order: the App-minted token (`steps.app-token.outputs.
+      # token`) first, then the `SHAPE_LEGS_TOKEN` PAT, then no credential at
+      # all — the first one present wins, and which one won is recorded as
+      # `legs_credential` for both the operator (printed below) and the fail
+      # step further down. Whichever it is, it is scoped to THIS STEP alone
+      # via `env:` — never to the job, never onto the root checkout above —
+      # and used only through a scoped `git -c url.<...>.insteadOf=<...>`
+      # rewrite, never echoed or interpolated into a URL that gets printed.
+      # Two rewrites cover both submodule URL forms an adopted repository may
+      # carry: `https://github.com/...` and SSH `git@github.com:...`. With no
+      # credential configured this falls back to a plain, unauthenticated
+      # `git submodule update --init --recursive` — the same command that
+      # already ran here, unchanged, for a project whose legs are public.
+      - name: fetch the legs (submodules)
+        id: submodules
+        env:
+          SHAPE_LEGS_APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          SHAPE_LEGS_TOKEN: ${{ secrets.SHAPE_LEGS_TOKEN }}
+        run: |
+          set +e
+          if [ -n "$SHAPE_LEGS_APP_TOKEN" ]; then
+            legs_credential=app
+            LEG_TOKEN="$SHAPE_LEGS_APP_TOKEN"
+          elif [ -n "$SHAPE_LEGS_TOKEN" ]; then
+            legs_credential=pat
+            LEG_TOKEN="$SHAPE_LEGS_TOKEN"
+          else
+            legs_credential=none
+            LEG_TOKEN=""
+          fi
+          echo "legs_credential=$legs_credential" >> "$GITHUB_OUTPUT"
+          echo "leg credential source: $legs_credential"
+          if [ -n "$LEG_TOKEN" ]; then
+            git \
+              -c "url.https://x-access-token:${LEG_TOKEN}@github.com/.insteadOf=https://github.com/" \
+              -c "url.https://x-access-token:${LEG_TOKEN}@github.com/.insteadOf=git@github.com:" \
+              submodule update --init --recursive
+          else
+            git submodule update --init --recursive
+          fi
+          status=$?
+          set -e
+          if [ "$status" -eq 0 ]; then
+            echo "legs_available=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "legs_available=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::submodule checkout failed (git exit $status) using credential source '$legs_credential'. If the legs are PRIVATE or internal sibling repositories, the default GITHUB_TOKEN cannot read them. Configure a GitHub App (SHAPE_LEGS_APP_ID + SHAPE_LEGS_APP_PRIVATE_KEY, preferred) or set SHAPE_LEGS_TOKEN — a fine-grained PAT — with contents:read on the legs, as a repository or organisation secret. Leg URLs:"
+            git config --file .gitmodules --get-regexp '\.url$' | while read -r _ url; do
+              echo "::warning::  $url"
+            done
+          fi
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.x'
+
+      # Standard library only. If this ever needs a `pip install`, the change
+      # is wrong: the shape must run in an org that cannot install anything.
+      # Neither of these two reads a leg's working tree, so both run
+      # regardless of whether the legs were fetched above.
+      - name: naming policy
+        run: python3 scripts/validate-repository-naming.py --project project.yaml
+
+      - name: project manifest
+        run: python3 scripts/validate-manifest.py
+
+      # The pin validator recomputes each leg's tree digest FROM the leg's own
+      # object store, so it needs the leg actually checked out — it REFUSES
+      # rather than passing on an uninitialized submodule, because an
+      # unreadable surface must fail rather than degrade. Running it only
+      # when the fetch above succeeded turns that refusal into a clean,
+      # explained skip instead of a job failure with no route around it.
+      - name: lockstep pins
+        if: steps.submodules.outputs.legs_available == 'true'
+        run: python3 scripts/validate-pins.py
+
+      - name: lockstep pins (skipped — legs unavailable)
+        if: steps.submodules.outputs.legs_available != 'true'
+        run: |
+          echo "::warning::lockstep pin check SKIPPED: the legs could not be checked out, so their trees are not available to recompute the digests in contracts/*-pin.yaml against. See the 'fetch the legs (submodules)' step above for why."
+
+      # Misconfiguration must not be silent. Neither leg credential being set
+      # degrading a project with private legs is expected and reported above;
+      # a credential that IS configured (App or PAT) that still could not
+      # check out the legs (wrong scope, missing contents:read grant, an
+      # incomplete App installation, a leg URL problem) is a finding a human
+      # must act on, so this fails the job — the only case that does. The
+      # root checkout above never depended on either credential, so a
+      # failure here can only mean the credential named below cannot read one
+      # of the LEG repositories.
+      - name: fail — a leg credential is configured but the legs still could not be fetched
+        if: steps.submodules.outputs.legs_available != 'true' && (env.SHAPE_LEGS_TOKEN_SET == 'true' || env.SHAPE_LEGS_APP_SET == 'true')
+        run: |
+          echo "::error::A leg credential is configured (source: ${{ steps.submodules.outputs.legs_credential }}) but 'git submodule update --init --recursive' still failed. The root checkout does not use this token — it reads with the workflow's default token — so this means the '${{ steps.submodules.outputs.legs_credential }}' credential cannot read one or more of the following LEG repositories (wrong token/App scope, a missing contents:read grant, an incomplete App installation, or a leg URL problem):"
+          git config --file .gitmodules --get-regexp '\.url$' | while read -r _ url; do
+            echo "::error::  $url"
+          done
+          exit 1
diff --git a/.gitignore b/.gitignore
index a160f494..2d04abf1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,9 @@
 __pycache__/
 *.py[cod]
 .pytest_cache/
+# Merged from the shape's copy, `shape/.gitignore` (pinned, left in place).
+.venv/
+.DS_Store
+# Paired feature worktrees, `worktrees/<NNN-feature>/{spec,code}/`: linked
+# worktrees of the two legs, machine plumbing, never committed to this root.
+/worktrees/
diff --git a/.gitmodules b/.gitmodules
index 8043147a..19bbaec8 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,6 @@
-[submodule "upstream/openRepoShape"]
-	path = upstream/openRepoShape
-	url = https://github.com/opensoft/openRepoShape.git
+[submodule "spec"]
+	path = spec
+	url = https://github.com/opensoft/openRepoTools-spec.git
+[submodule "code"]
+	path = code
+	url = https://github.com/opensoft/openRepoTools-code.git
diff --git a/AGENTS-shape.md b/AGENTS-shape.md
new file mode 100644
index 00000000..f410515d
--- /dev/null
+++ b/AGENTS-shape.md
@@ -0,0 +1,167 @@
+# AGENTS-shape.md — the rules of this repository's shape
+
+COPIED from openRepoShape and DIGEST-PINNED in `contracts/shape-pin.yaml`, so
+it says the same thing in every project carrying the shape. It describes the
+MECHANICS of this repository, not this project's work: the project's own
+instructions are in `AGENTS.md` beside it, and that file is not pinned.
+
+## What this repository is
+
+The ASSEMBLY ROOT of a project that spans three repositories. It holds no
+product code of its own. It holds `project.yaml` — the manifest, and the
+SOURCE of what this project is — the two legs as submodules at the paths
+`project.yaml` names, `spec/` and `code/` by default, the pins that say which
+commit of each leg this project currently IS, and the gate that checks them.
+
+**Work from here, not from a leg clone.** An agent standing in a leg clone can
+see neither the manifest nor the other leg, so it is reading half a project and
+cannot advance it at all. `git clone --recurse-submodules` this repository and
+run `make bootstrap`.
+
+## Advancing a leg is ONE commit here
+
+Commit in the leg, push it, then ONE commit in THIS repository moving all
+three of these together:
+
+1. the **gitlink** — the `160000` entry recorded at the leg's path,
+2. **`commit:`** in `contracts/<role>-pin.yaml`,
+3. every **`.github/workflows/*.yml` `@<sha>`** reference naming that leg.
+
+Never a bare `git submodule update` followed by a commit: that moves the
+gitlink alone. `make pins` (`scripts/validate-pins.py`, and the `validate`
+check on every pull request) refuses when the three disagree, and it is right
+to — seven consecutive pin-syncs in the xFactory aggregation moved the gitlink
+alone and left `validate` red for a day, unnoticed because the check runs on
+pull requests only.
+
+## Never edit a file that has a row in `contracts/shape-pin.yaml`
+
+Those rows are the copies of openRepoShape this project carries — the
+validators, `scripts/bootstrap.py`, the Makefile, the `validate` workflow, this
+file — and every sha256 is recomputed on every pull request. An edit in place
+is reported as DRIFT and refused.
+
+The exit is UPSTREAM: change it in `opensoft/openRepoShape`, then run that
+repository's `update-shape.py` against this project FROM a checkout of the
+standard, and land the result as a pull request. **Never update a digest in
+place.** That records this copy as the standard and makes the drift the
+validator reports today invisible tomorrow.
+
+```sh
+./update-shape.py check --root <path-to-this-project>
+# then, once the human has seen the per-file verdicts and said yes:
+./update-shape.py apply --root <path-to-this-project> --at <commit> --yes \
+    --branch shape/update-<sha> \
+    --trailer "Lane: <name>" --trailer "Co-Authored-By: <who>"
+```
+
+`apply` takes a repeatable `--trailer "<Key>: <value>"`, appended in the order
+given to the commit it writes, and only alongside `--branch` — without one
+there is no commit to put a line on, and it is refused. `apply` composes that
+message itself, so whatever lines your own conventions require on a commit —
+a `Lane:` where a lane is running, a `Co-Authored-By:` where something
+co-wrote it — reach the re-pin this way and no other, rather than by amending
+the commit afterwards. `check` writes nothing and takes none.
+
+`AGENTS.md`, `CLAUDE.md`, `README.md`, `project.yaml` and the leg pins have no
+row: they are this project's own content, and yours to edit.
+
+## What goes where
+
+| | |
+|---|---|
+| the spec leg | requirements, decisions, acceptance criteria, the contracts |
+| the code leg | the implementation and its tests |
+| this root | `project.yaml`, the pins, the gate, the assistant instructions, the front door |
+
+A contract the code READS but does not OWN lives in the SPEC leg. That was
+ruled and measured on the MedxEHR conversion: `contracts/` moved to the spec
+leg, and the code leg's tooling now takes `CONTRACTS_DIR` from the environment
+rather than each script guessing at `../`. Where this root was ADOPTED, the
+shape's Makefile exports `CONTRACTS_DIR` once, as the `contracts/` of the spec
+leg at the path `project.yaml` mounts it, and `make contracts-dir` prints it.
+Where the source kept a Makefile of its own, that block waits in
+`shape/Makefile` until the two are merged. A SCAFFOLDED root's Makefile exports
+none: its legs start from the scaffold's seed, with no `contracts/`, so
+nothing reads across them yet.
+
+## The five commands
+
+```
+make bootstrap   puts the legs on their tracking branch AT the pin, or says why
+                 not; then the validators, then the review-authority readout
+make validate    naming + manifest + lockstep pins (what CI runs)
+make pins        the lockstep pin validator alone
+make park        commit, push and RECORD every open feature, so another
+                 workstation can take the work up
+make resume      recreate the parked features here, from that record
+```
+
+`make bootstrap` places a leg on its tracking branch AT the pin only where that
+loses no commit, and otherwise leaves its checkout where it is, saying why. The
+line `authority is not wallet-carried in this org` is a report, not a fault.
+
+**`make park` BEFORE the human leaves a workstation; on the next one, clone,
+`make bootstrap`, then `make resume`** — that order, because `resume`
+recreates worktrees under a root whose legs are already at their pins. Both
+are THIN: the mechanics belong to the Speckit git extension, and when it is
+not installed the target refuses with `install it with: setup-openspeckit`
+rather than doing half of the job. `resume` REFUSES a feature whose branch
+moved since the park — it names the parked commit, the current tip and the
+commands to reconcile, and resets over nothing; that refusal is the point of
+it and not a thing to work around.
+
+**Never commit anything under `worktrees/`.** A linked worktree is machine
+plumbing — its `.git` file carries an ABSOLUTE path — so nothing there is
+committed, pushed or synced. `park` commits INSIDE the feature legs, on the
+feature branch; this root carries no feature branch and is never committed to
+by either verb.
+
+## The refusals to respect
+
+* **Never `--admin`**, and never suggest it. A ruleset that refuses a direct
+  push is doing its job.
+* **Never a direct push to the default branch.** These organisations are
+  pull-request only; every change here arrives as a pull request.
+* **Never `--allow-upstream-org`, `--yes` or `--accept-local` on your own
+  initiative.** Each stands in for a human's judgement — scaffolding into the
+  upstream's own namespace, consenting to a re-pin, keeping a local edit that
+  hides drift. Pass one only when a human has asked for it, in those words.
+
+## This layout confers NOTHING
+
+`role:` and every other manifest field confer NOTHING — no gate, no floor, no
+grant, no clearance eligibility; a consumer deriving permission from them is
+defective. A one-repository project is reviewed identically, because the
+authority travels in the grants rather than in the layout. Asked to make
+`role: spec` mean "spec authority lives here", say no: that turns a layout into
+a governance boundary, which is the one thing this standard exists to prevent.
+
+This shape is the **Triad**, and the Triad is the PREFERRED project shape
+(openxFactory `prefer-triad-project-shape`, ratified by Brett Heap on
+2026-10-06). Preferred is not required and changes none of the above: never
+tell anyone that a project kept in one repository owes anything, and never
+make the shape a review input.
+
+## Declaring descent
+
+A `<Domainx><Product>` name is a CLAIM of descent, and a claim needs a
+REFERENT: this project descends from a neutral product only if it PINS one.
+The declaration is `neutral_product_pins:` in `project.yaml` plus
+`contracts/<product>-pin.yaml` beside it, in ONE commit — the classification
+changes WITH the pin, never before it. Declare one only when the human asked
+for it: an invented pin puts a false fact about this project's ancestry in
+their tree.
+
+`shape:` records which openRepoShape this project was cut from, by commit and
+tree digest. `reference:` records the document the human's election followed —
+a claim about what that human read, and not yours to change.
+
+## In a family
+
+A FAMILY holder pins assembly roots — repositories like this one — as
+submodules under `members/<Project>`, and never legs. The member pin moves from
+the HOLDER's side: openRepoShape's `scripts/family.py bump`, one commit,
+landed as a pull request. Nothing here changes and nothing here is
+subordinate: membership is navigation, confers nothing, and this is a whole
+project whether or not any family names it.
diff --git a/AGENTS.md b/AGENTS.md
index 0b25c49d..fcbc6379 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,3 +1,27 @@
+Read AGENTS-shape.md first — the rules of this repository's shape.
+
+This is the assembly root of a three-repository project. The text after
+this list is what this repository said before the split, each path re-pointed
+at the leg that now holds it; a path beginning `spec/` or `code/` is relative
+to this root.
+
+- **`spec/`**, `opensoft/openRepoTools-spec`: `openspec/`, `specs/`, `docs/`
+  (the manuals) and `ideation/`; `openspec` runs there.
+- **`code/`**, `opensoft/openRepoTools-code`: every command
+  `openRepoTools --install` places, `repos.tsv`, `commands/`, `skills/`,
+  `tests/`, its CI, and the pinned standard at `code/upstream/openRepoShape`.
+- **This root**: the front door, `project.yaml`, the leg pins and the gate
+  (`make validate`); no product code.
+- **Tests**: `code/tests/run.sh` from here, or `tests/run.sh` inside `code/`.
+- **The lane tooling**: its code is in `code/`; its manual is
+  `spec/docs/README-lanes.md` (`docs/README-lanes.md` in the spec leg).
+- **Feature work**: paired worktrees `worktrees/<NNN-feature>/{spec,code}/`,
+  never committed here; full proposals and Speckit files in `spec`, a genuine
+  bounded amendment only in `code`'s `features/<NNN-feature>/openspec/`.
+- **A local rehearsal** whose `.gitmodules` names bare repositories on disk
+  needs `git -c protocol.file.allow=always submodule update --init
+  --recursive`; the real legs are https and need no flag.
+
 # Working in openRepoTools
 
 Three estate commands, `park`, `resume` and `status`; the lane tooling
@@ -19,7 +43,7 @@ person is driving the two INSTALLED commands.
 
 The lane tooling answers to a different document — the lane collision protocol
 at `$AGENT_PROTOCOL_ROOT/protocols/lane-collision-protocol.md` and its
-amendments — and `docs/README-lanes.md` is its manual. **The code is here; the
+amendments — and `spec/docs/README-lanes.md` is its manual. **The code is here; the
 data is not.**
 
 **A LANE HAS ONE BINDING** (Amendment 18, in force 2026-09-14): the `host`,
@@ -41,7 +65,7 @@ handoffs through `$AGENT_PROTOCOL_ROOT/workspace.yaml`'s `repository:` and
 unreadable workspace with **2**: only 2 blocks a prompt; 1 would let it through.
 Profile-only guard calls carrying exact `CLAUDE_NO_LANE=1` return 0 before input
 or identity probes, even with unreadable configuration; other values enforce.
-Brett Heap directed this exception in `openspec/changes/skip-no-lane-guard/`;
+Brett Heap directed this exception in `spec/openspec/changes/skip-no-lane-guard/`;
 Shared hooks stay installed while `~/projects/xFactory/lanes-edit.sh` answers `guard`; until then they are deferred and our guard entry taken out (#237):
 29 artifacts always, plus those two. Exit 1 means *registry not found* in lane tooling, and *findings were printed* in estate status; identify the command before interpreting it.
 
@@ -206,13 +230,13 @@ which is where `make siblings` moves a holder; `status` names both as a finding.
    reads them all WITHOUT asking, because a read — fetched or not — moves
    nothing of yours; `status --all` from anywhere says the same thing.
 
-## The pinned standard at `upstream/openRepoShape`
+## The pinned standard at `code/upstream/openRepoShape`
 
 The suite builds real estates out of eight of openRepoShape's own files, and it
-reads them out of a submodule pinned by `contracts/openreposhape-pin.yaml`.
+reads them out of a submodule pinned by `code/contracts/openreposhape-pin.yaml`.
 Three rules, and none of them is negotiable:
 
-1. **Never edit anything under `upstream/openRepoShape` in place.** It is
+1. **Never edit anything under `code/upstream/openRepoShape` in place.** It is
    somebody else's repository, checked out detached at a commit. A change the
    standard needs is a pull request THERE, then a pin bump here.
 2. **Never pin a commit that is not on that repository's `main`.**
@@ -220,17 +244,17 @@ Three rules, and none of them is negotiable:
    pull request lands and the next person's fetch of it 404s. Check with
    `gh api repos/opensoft/openRepoShape/compare/main...<sha>` — `identical` or
    `behind`.
-3. **The digest is RECOMPUTED, never adjusted.** `contracts/openreposhape-pin.yaml`
+3. **The digest is RECOMPUTED, never adjusted.** `code/contracts/openreposhape-pin.yaml`
    carries the bump command. A `tree_sha256` edited to make
-   `tests/test_upstream_pin.py` pass records this checkout as the upstream,
+   `code/tests/test_upstream_pin.py` pass records this checkout as the upstream,
    which is the one thing the row exists to prevent. The pin file and the
    gitlink move in ONE commit.
 
 ## Testing your changes to this repository
 
 ```sh
-git submodule update --init upstream/openRepoShape
-tests/run.sh                      # the suite, serialized — pass any pytest argument
+git -C code submodule update --init upstream/openRepoShape
+code/tests/run.sh                 # the suite, serialized — pass any pytest argument
 ```
 
 Brett Heap's RULING of 2026-09-16 ("do all three", on the coordinator's three
@@ -241,7 +265,7 @@ suite queuing up to 1h20 behind the workstation lock described below):
 1. **`TESTS-MACOS` LEFT THE PER-PUSH GATE, AND THEN LEFT CI.** This ruling moved
    `tests-macos` behind the `ready` label; Brett Heap's decision of 2026-10-15,
    for the whole estate, to run the suite on Linux only, removed `tests-macos`,
-   `tests-windows` and `parse-macos`. `.github/workflows/tests.yml` runs
+   `tests-windows` and `parse-macos`. `code/.github/workflows/tests.yml` runs
    `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, all on
    ubuntu — on `pull_request`, push to `main` and `release/v*`, nightly at
    04:17Z and `workflow_dispatch`. From PR 3 (#228) on, the release workflow's
@@ -251,10 +275,10 @@ suite queuing up to 1h20 behind the workstation lock described below):
    and two are taken; a finding after that is filed as an issue and the PR
    lands regardless.
 3. **CI IS THE SUITE OF RECORD.** A writer runs the shell-suite section they
-   touched locally — `bash tests/test_lane_helpers.sh` in full is fine when
-   the box is quiet — and the full local `tests/run.sh` behind the
+   touched locally — `bash code/tests/test_lane_helpers.sh` in full is fine when
+   the box is quiet — and the full local `code/tests/run.sh` behind the
    workstation lock is no longer required before a push: CI's `tests` job is
-   the footer of record. `tests/run.sh` stays exactly as it is above: how to
+   the footer of record. `code/tests/run.sh` stays exactly as it is above: how to
    run the whole suite locally, serialized, whenever a person wants that answer
    anyway, and `python3 -m pytest tests -q` by hand — unserialized against every
    other lane on the same workstation — is still the thing it exists to stop.
@@ -288,14 +312,14 @@ while [ "$(pgrep -f "$pat" | awk 'END { print NR + 0 }')" -gt 0 ]; do sleep 20;
 PYTHONPYCACHEPREFIX="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache" flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest tests -q -p no:cacheprovider
 ```
 
-`awk` AND NOT `pgrep -fc`, which is what `tests/run.sh` does and for the reason
+`awk` AND NOT `pgrep -fc`, which is what `code/tests/run.sh` does and for the reason
 it gives: `-c` is not in every `pgrep` this repository runs under, and the
 count — never `pgrep`'s exit status — is what decides. The wrapper is the
 canonical implementation of this guard; the lines above are it in one place for
 a person with no checkout in front of them.
 
-`tests/test_lane_helpers.sh` is 122 KB of bash that arrived with the move;
-`tests/test_lane_helpers_suite.py` is what makes `pytest` run it, so it is one
+`code/tests/test_lane_helpers.sh` is 122 KB of bash that arrived with the move;
+`code/tests/test_lane_helpers_suite.py` is what makes `pytest` run it, so it is one
 slow test rather than no test at all. Everything shipped here is written for
 macOS **bash 3.2**, where `${x,,}`, `mapfile`, `declare -A` and `local -n` are
 syntax errors — write `tr '[:upper:]' '[:lower:]'` and a loop. No `tests.yml`
diff --git a/CLAUDE.md b/CLAUDE.md
index 5d302681..fa3f2185 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1 +1,2 @@
+Read AGENTS-shape.md first — the rules of this repository's shape.
 Read AGENTS.md.
diff --git a/Makefile b/Makefile
new file mode 100644
index 00000000..06dd4f9c
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,73 @@
+# The five targets a scaffolded project ships. Copied verbatim from
+# openRepoShape and digest-pinned in `contracts/shape-pin.yaml`.
+#
+# `park` and `resume` are THIN, and that is the whole design (#77, RULING
+# 2026-09-09 ruling 1): the mechanics — the WIP commit, the push, `git
+# worktree add`, the `.specify/feature.json` rewrite, the soft reset — belong
+# to the SPECKIT GIT EXTENSION, and there is exactly one implementation of
+# them. This file names the two verbs, hands them `ARGS`, and REFUSES BY NAME
+# when the overlay is not installed. It reimplements none of it, and a target
+# here that started to would be a second implementation nobody tests.
+#
+# The scripts' own exit codes are 0 ok, 1 usage or environment, 2 a REFUSAL
+# before anything was done, 3 PARTIAL — at least one feature refused and the
+# rest parked. Nothing here rewrites them, but GNU make reports ANY non-zero
+# recipe status as its own exit 2 and prints `Error <code>`: when the code
+# itself matters, read it from that line or run the script directly.
+PYTHON ?= python3
+# The Speckit worktree overlay, installed by `setup-openspeckit`. A project
+# that never asked for it does not have this directory, which is why both
+# targets test for the script before running it.
+SPECKIT_GIT := .specify/extensions/git/scripts/bash
+PARK := $(SPECKIT_GIT)/park.sh
+RESUME := $(SPECKIT_GIT)/resume.sh
+# One message, two targets, so the two refusals cannot drift apart. It names
+# the installer: a refusal that says only "not installed" leaves the person
+# guessing at what to run, which is the one thing a refusal must not do.
+OVERLAY_MISSING = needs the Speckit worktree overlay; install it with: \
+                  setup-openspeckit
+.DEFAULT_GOAL := help
+
+.PHONY: help bootstrap validate pins park resume
+
+help:
+	@echo 'make bootstrap   legs onto tracking branches at their pins where that'
+	@echo '                 loses no commit, or says why not; then the validators,'
+	@echo '                 then the review-authority readout'
+	@echo 'make validate    naming + manifest + lockstep pins (what CI runs)'
+	@echo 'make pins        the lockstep pin validator alone'
+	@echo 'make park        commit, push and RECORD every open feature, so'
+	@echo '                 another workstation can take the work up'
+	@echo 'make resume      recreate the parked features here; it REFUSES a'
+	@echo '                 feature whose branch moved. ARGS=--dry-run first'
+
+bootstrap:
+	$(PYTHON) scripts/bootstrap.py
+
+validate:
+	$(PYTHON) scripts/validate-repository-naming.py --project project.yaml
+	$(PYTHON) scripts/validate-manifest.py
+	$(PYTHON) scripts/validate-pins.py
+
+pins:
+	$(PYTHON) scripts/validate-pins.py
+
+park:
+	@test -x $(PARK) || { echo 'make park $(OVERLAY_MISSING)' >&2; exit 2; }
+	@exec $(PARK) $(ARGS)
+
+resume:
+	@test -x $(RESUME) || { echo 'make resume $(OVERLAY_MISSING)' >&2; exit 2; }
+	@exec $(RESUME) $(ARGS)
+
+# --- adopted project: reading ACROSS the legs -------------------------------
+# The spec leg owns `contracts/`; the code leg holds the tooling that reads
+# them. Mounted here, `spec/contracts` is one relative path from `code/`, so
+# the root exports it once and the code leg takes it from the environment
+# rather than each script guessing at `../`.
+CONTRACTS_DIR ?= $(CURDIR)/spec/contracts
+export CONTRACTS_DIR
+
+.PHONY: contracts-dir
+contracts-dir:
+	@echo $(CONTRACTS_DIR)
diff --git a/README.md b/README.md
index ae0a60fe..6344b31a 100644
--- a/README.md
+++ b/README.md
@@ -101,6 +101,25 @@ parked. No config, or no record, is a note.
 That is all five layers: the local layer, `--fetch`, the fork, the pin and
 the record.
 
+## Three repositories
+
+This is the ASSEMBLY ROOT of a three-repository project, the shape
+[openRepoShape](https://github.com/opensoft/openRepoShape) calls the Triad: it
+holds this front door, `project.yaml`, the pins and the gate, and mounts
+`opensoft/openRepoTools-spec` at `spec/` (`openspec/`, `specs/`, the manuals in
+`docs/`, `ideation/`) and `opensoft/openRepoTools-code` at `code/` (every
+command below, `repos.tsv`, `skills/`, `commands/`, `tests/`, CI and the pinned
+standard). Clone it with `git clone --recurse-submodules` and run
+`make bootstrap`. Nothing a person types changes, and a path in this file that
+begins `spec/` or `code/` is relative to this root.
+
+### The lockstep invariant
+
+A leg's gitlink, `commit:` in `contracts/<role>-pin.yaml` and every workflow
+`@<sha>` naming that leg move in ONE commit here, after the leg's own pull
+request lands: openRepoShape's `scripts/bump-leg.py` writes it, and
+`make pins` refuses when the three disagree.
+
 ## The lane tooling
 
 `lane-start`, `lane-end`, `lanes-edit.sh` and `link-estates` are here too, with
@@ -154,7 +173,7 @@ and 5 put it and where it stays. What moved here is the CODE. A `<user>-wip` is
 a private repository whose own rules file says "No secrets and no code", nobody
 would look inside somebody else's for a command, and until this move the four
 helpers existed in exactly one place in the world: one person's private
-repository. `docs/README-lanes.md` is the manual; `docs/README-claude-current.md` is the one for the Claude Code `lane-start` launches and the RESTART NEEDED line.
+repository. `spec/docs/README-lanes.md` is the manual; `spec/docs/README-claude-current.md` is the one for the Claude Code `lane-start` launches and the RESTART NEEDED line.
 
 Every one of them finds that data through `$AGENT_PROTOCOL_ROOT/workspace.yaml`
 — `repository:` and `path:`, the same pointer file `resume` and `status`
@@ -180,7 +199,7 @@ different hat).
 
 Then it clones the repository, seeds it from openRepoShape's
 `templates/workspace-root/` at the commit pinned in
-`contracts/openreposhape-pin.yaml`, and pushes one commit to `main` — **which is
+`code/contracts/openreposhape-pin.yaml`, and pushes one commit to `main` — **which is
 also the check that matters**: a new repository is inside the organisation's
 PR-only ruleset until an administrator excludes it, and until it is, every
 register write will be refused by that gate. Better to meet it here than at
@@ -237,6 +256,10 @@ gh api repos/opensoft/openRepoTools/contents/openRepoTools \
     -H 'Accept: application/vnd.github.raw' | bash -s -- --install
 ```
 
+Both lines are unchanged by the split: the `openRepoTools` they fetch is this
+root's entry point, which hands over to the installer `code/openRepoTools` at
+the commit this root pins.
+
 A workstation uses ONE install route or the other, never both — pipx's `openrepotools`
 or workBenches' `./setup.sh` — until opensoft/workBenches#165 lets its
 `scripts/setup-estate-commands.sh` accept pipx's link (Brett Heap's decision of 2026-10-18).
@@ -266,7 +289,7 @@ its write bit. A refusal creates none of those directories either. `cp` follows
 a symlink, and an install through one leaves the command uninstalled and writes
 these bytes into whatever it points at. The ONE link it skips instead is pipx's,
 at `openRepoTools` (below). Then a `17 of 17 placed in <dir>` line,
-and the `export PATH=…` line if that directory is not on your `PATH`. Last, it names this repository's virtual environment, `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/venvs/openRepoTools/` (one per repository, outside the estate; #162), says whether it is there, and prints the two commands that make it: it never makes one, and `tests/run.sh` runs from it once it has `pytest`.
+and the `export PATH=…` line if that directory is not on your `PATH`. Last, it names this repository's virtual environment, `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/venvs/openRepoTools/` (one per repository, outside the estate; #162), says whether it is there, and prints the two commands that make it: it never makes one, and `code/tests/run.sh` runs from it once it has `pytest`.
 
 **Beside pipx's link it places SIXTEEN and leaves the seventeenth to pipx.** A
 `<dir>/openRepoTools` that is a link into pipx's `openrepotools` environment is
@@ -316,7 +339,7 @@ Twenty-nine artifacts always, plus the two hook entries once the path they call
 answers `guard` (#237), and the count is the invariant. Beside pipx's link it is
 TWENTY-EIGHT placed always, one left to pipx and 28 receipt rows, with the hook
 pair still on top once that path answers. The count was sixteen until A11
-Addendum 4 ruling 9 gave `--install` a command-file list and `commands/swap.md`
+Addendum 4 ruling 9 gave `--install` a command-file list and `code/commands/swap.md`
 in it, at the same pair of paths a skill takes — because `opensoft/workBenches#74`
 deletes the launcher's copy and `/swap` would otherwise be installed by nobody;
 eighteen until Amendment 12 adoption act 3 added the name guard's entry; and
@@ -434,19 +457,19 @@ exactly as it is for openRepoShape's `setup.sh`.
 
 **Tools depend on the shape; the shape depends on nothing.** This repository
 pins the openRepoShape commit its tests were verified against, as a submodule
-at `upstream/openRepoShape` recorded in `contracts/openreposhape-pin.yaml`.
+at `code/upstream/openRepoShape` recorded in `code/contracts/openreposhape-pin.yaml`.
 openRepoShape pins this repository NOWHERE, and knows of it only through one
 pointer line its own `--install` prints — text, not a fetch. The reverse would
 make the standard unbuildable without its tools.
 
-MOUNTED, NOT COPIED. `tests/test_park_resume_commands.py` builds real estates
+MOUNTED, NOT COPIED. `code/tests/test_park_resume_commands.py` builds real estates
 out of EIGHT of the standard's own files — the two root Makefiles, their two
 `.gitignore`s, the two `bootstrap.py`s, `siblings.py` and
 `scripts/repo_shape.py` — and a submodule hands those tests the standard's real
 bytes at the pinned commit rather than copies here that could have been edited
 into agreeing with a broken expectation.
 
-`tests/test_upstream_pin.py` is what says the pin file and the gitlink still
+`code/tests/test_upstream_pin.py` is what says the pin file and the gitlink still
 agree. Four of its checks need no submodule at all — the gitlink is read out of
 `git ls-tree HEAD` and nothing imports from the checkout — so the lockstep
 check bites in a clone that never materialized it.
@@ -454,6 +477,7 @@ check bites in a clone that never materialized it.
 ### Bumping the pin
 
 ```sh
+cd code                       # the pin and the gitlink are the code leg's
 git -C upstream/openRepoShape fetch origin
 git -C upstream/openRepoShape checkout <40 hex on openRepoShape's main>
 python3 -c "import sys; sys.path.insert(0, 'upstream/openRepoShape/scripts'); from repo_shape import tree_digest; print(tree_digest('upstream/openRepoShape', 'HEAD'))"
@@ -466,7 +490,7 @@ git commit
 **The edit comes before the `git add`, and the block is in that order for a
 reason.** Staging first and editing after stages the moved gitlink with the OLD
 pin file — and that is invisible where you are standing, because
-`tests/test_upstream_pin.py` reads the pin out of the WORKING TREE and the
+`code/tests/test_upstream_pin.py` reads the pin out of the WORKING TREE and the
 gitlink out of `git ls-tree HEAD`: green in your checkout, red in CI, which is
 the wrong way round. The pin and the gitlink are one fact in two places. The
 digest is recomputed with the PINNED CHECKOUT'S OWN `scripts/repo_shape.py`
@@ -481,10 +505,10 @@ orphaned and the next person's fetch of it 404s.
 
 ```sh
 git clone --recurse-submodules https://github.com/opensoft/openRepoTools.git
-cd openRepoTools && python3 -m pytest tests -q
+cd openRepoTools/code && python3 -m pytest tests -q
 ```
 
-From a clone that already exists, `git submodule update --init
+From a clone that already exists, `git -C code submodule update --init
 upstream/openRepoShape` first. **Without the submodule the suite SKIPS rather
 than fails**, naming that command: a fork's first `pytest` going red on a
 missing submodule is a fork nobody finishes. The estate tests need `bash`,
diff --git a/claude-current b/claude-current
deleted file mode 100755
index 5656cbf1..00000000
--- a/claude-current
+++ /dev/null
@@ -1,821 +0,0 @@
-#!/usr/bin/env bash
-# claude-current: the Claude Code executable a launch should start. That is
-# the newest version npm publishes, verified with `--version`, and it is named
-# by an ABSOLUTE PATH. `claude` is never resolved through PATH.
-#
-# Installed on PATH by `openRepoTools --install`, beside `lane-start`, which
-# calls it.
-#
-# Why it exists (opensoft/workBenches#119, Brett Heap's rulings of 2026-09-29):
-# a lane started on an old Claude Code, and nothing noticed. Two installs
-# competed on PATH, the image's copy frozen at the image build and the user's
-# own npm copy, and a session that had run 2.1.283 for twenty hours lacked a
-# model a fresh `claude` listed. The home ruling puts the resolver here,
-# installed by `openRepoTools --install`. Point 2 is verbatim "for 2, we can
-# run update on every start, this ensures we have the latest models", so every
-# launch runs this check.
-#
-# USAGE
-#   claude-current [--porcelain] [--offline]
-#   claude-current --help
-#
-# WHAT IT DOES
-#   1. Reads the published version with `npm view @anthropic-ai/claude-code
-#      version`, bounded by $CLAUDE_CURRENT_TIMEOUT seconds (default 10).
-#      --offline skips this step and step 3.
-#   2. Reads each installed candidate's `--version`, by absolute path, in this
-#      order:
-#        - the newest native version in $CLAUDE_CURRENT_NATIVE_DIR (default
-#          ~/.local/share/claude/versions), by its x.y.z name, whose
-#          `--version` answers: a newer file that does not run gives way to
-#          the next one that does, and is not read again in the same run
-#          unless an update or a wait for the lock may have changed it;
-#        - <user npm prefix>/bin/claude. The prefix is $CLAUDE_CURRENT_NPM_PREFIX,
-#          else $NPM_CONFIG_PREFIX, else $npm_config_prefix, else the
-#          `prefix=` line of ~/.npmrc, else ~/.npm-global. A relative one is
-#          taken under $HOME;
-#        - ~/.local/bin/claude;
-#        - each entry of $CLAUDE_CURRENT_SYSTEM_CANDIDATES (default
-#          /usr/local/bin/claude:/usr/bin/claude, the image's copies).
-#      A path that resolves to one already read is read once, and the first
-#      spelling, the user-writable one, is kept.
-#   3. When every candidate is behind the published version, or there is none,
-#      it updates the user-writable install under a lock and reads again. A
-#      native install gets `claude update`. When that does not reach the
-#      published version, or there is no native install, it runs
-#      `npm install -g --prefix <user prefix> @anthropic-ai/claude-code@<published>`
-#      and then the package's own install.cjs if `--version` still differs,
-#      because npm 12 skips the package's native-binary hook. A second launch
-#      waits on the lock and reads again before it updates anything itself.
-#   4. Picks the first candidate whose version EQUALS the published one
-#      (verified). Else it picks the newest candidate AHEAD of it (ahead).
-#      Else it refuses (stale), unless CLAUDE_ALLOW_STALE=1, when it picks the
-#      newest (stale). When npm could not be read, it picks the newest
-#      candidate (unverified).
-#
-# OUTPUT
-#   stdout   the absolute path, one line. With --porcelain, exactly four
-#            lines: path=<absolute path>, version=<x.y.z>,
-#            published=<x.y.z, or empty>, and
-#            status=<verified|ahead|unverified|stale>. A refusal prints nothing
-#            on stdout.
-#   stderr   one line saying what was chosen, for example
-#            "claude-current: claude 2.1.284 (verified against npm 2.1.284) at <path>".
-#            An update prints its own progress there too.
-#
-# EXIT
-#   0   resolved: verified, ahead or unverified, and stale only under
-#       CLAUDE_ALLOW_STALE=1
-#   1   no runnable Claude Code at all
-#   2   refused: every candidate is still behind npm after the update attempt
-#   64  usage: an argument it does not know, or a CLAUDE_CURRENT_* bound that
-#       is not a whole number of seconds. Kept apart from 1, which a launcher
-#       reports as "no Claude Code" (opensoft/workBenches#121)
-#
-# ENVIRONMENT
-#   CLAUDE_ALLOW_STALE=1             launch a stale candidate anyway, and say so
-#   CLAUDE_CURRENT_NPM               the npm to run (default: npm)
-#   CLAUDE_CURRENT_NODE              the node that runs install.cjs (default: node)
-#   CLAUDE_CURRENT_TIMEOUT           seconds for `npm view` (default 10)
-#   CLAUDE_CURRENT_VERSION_TIMEOUT   seconds for each `--version` (default 10)
-#   CLAUDE_CURRENT_UPDATE_TIMEOUT    seconds for each update command (default 300)
-#   CLAUDE_CURRENT_LOCK_WAIT         seconds to wait for another launch's update
-#                                    (default 330)
-#   CLAUDE_CURRENT_CACHE_DIR         where the lock lives (default
-#                                    ${XDG_CACHE_HOME:-~/.cache}/openrepotools)
-#                                    Relative paths are taken under $HOME.
-#   CLAUDE_CURRENT_NPM_PREFIX        the user npm prefix, see step 2
-#   CLAUDE_CURRENT_NATIVE_DIR        the native versions directory, see step 2
-#   CLAUDE_CURRENT_SYSTEM_CANDIDATES colon-separated image paths, see step 2.
-#                                    Set it empty for none.
-#
-# HANDING THE RESULT ON (docs/README-claude-current.md)
-#   A launcher that starts the path exports CLAUDE_BIN=<path>,
-#   CLAUDE_RESOLVED_BIN=<the same path> and CLAUDE_VERIFIED_VERSION=<version>.
-#   `lane-start` records `claude <version>` on the register's launch line and
-#   keeps CLAUDE_VERIFIED_VERSION out of the session's environment. A later
-#   launch that finds CLAUDE_BIN equal to CLAUDE_RESOLVED_BIN, with no
-#   CLAUDE_VERIFIED_VERSION, knows the value was inherited from a session and
-#   is not an operator's pin, and resolves again.
-#
-# Bash 3.2 safe (macOS): no mapfile, no associative arrays, no readlink -f,
-# no GNU-only flags; `timeout`, else `gtimeout`, else a watchdog; ONE symlink
-# lock for every launch, never `flock`, so what PATH holds cannot split it.
-
-set -euo pipefail
-
-prog="claude-current"
-PACKAGE="@anthropic-ai/claude-code"
-
-usage() {
-	cat <<'USAGE'
-claude-current [--porcelain] [--offline]
-claude-current --help
-
-Print the absolute path of the Claude Code a launch should start: the version
-npm publishes, verified with --version, updating the user-writable install
-first when every installed copy is behind. Never resolved through PATH.
-
-  --porcelain   four lines on stdout: path=, version=, published=, status=
-                (status is verified, ahead, unverified or stale)
-  --offline     no npm read and no update: the newest installed copy, unverified
-
-Exit 0 resolved, 1 nothing runnable, 2 refused as stale, 64 usage or a
-malformed CLAUDE_CURRENT_* bound.
-CLAUDE_ALLOW_STALE=1 launches a stale copy anyway. The CLAUDE_CURRENT_*
-variables and the hand-off to lane-start are in docs/README-claude-current.md.
-USAGE
-}
-
-say() { printf '%s: %s\n' "$prog" "$*" >&2; }
-die() { printf '%s: %s\n' "$prog" "$1" >&2; exit "${2:-1}"; }
-
-porcelain=0
-offline=0
-while [ $# -gt 0 ]; do
-	case "$1" in
-		--porcelain) porcelain=1 ;;
-		--offline) offline=1 ;;
-		-h | --help) usage; exit 0 ;;
-		*)
-			printf '%s: unknown argument: %s\n' "$prog" "$1" >&2
-			usage >&2
-			exit 64 ;;
-	esac
-	shift
-done
-
-# ------------------------------------------------------------------ settings
-
-posint() {
-	case "${1:-}" in
-		'' | *[!0-9]*) return 1 ;;
-	esac
-	[ "$1" -gt 0 ]
-}
-
-NPM="${CLAUDE_CURRENT_NPM:-npm}"
-NODE="${CLAUDE_CURRENT_NODE:-node}"
-TIMEOUT="${CLAUDE_CURRENT_TIMEOUT:-10}"
-VERSION_TIMEOUT="${CLAUDE_CURRENT_VERSION_TIMEOUT:-10}"
-UPDATE_TIMEOUT="${CLAUDE_CURRENT_UPDATE_TIMEOUT:-300}"
-LOCK_WAIT="${CLAUDE_CURRENT_LOCK_WAIT:-330}"
-for setting in TIMEOUT VERSION_TIMEOUT UPDATE_TIMEOUT LOCK_WAIT; do
-	eval "setting_value=\${$setting}"
-	# shellcheck disable=SC2154
-	posint "$setting_value" ||
-		die "CLAUDE_CURRENT_$setting must be a whole number of seconds above 0, and it is '$setting_value'" 64
-done
-NATIVE_DIR="${CLAUDE_CURRENT_NATIVE_DIR:-$HOME/.local/share/claude/versions}"
-CACHE_DIR="${CLAUDE_CURRENT_CACHE_DIR:-${XDG_CACHE_HOME:-$HOME/.cache}/openrepotools}"
-# Every checkout updating this user's install must take the same lock, even
-# when the override (or XDG_CACHE_HOME) is relative and their cwd differs.
-case "$CACHE_DIR" in
-	/*) : ;;
-	*) CACHE_DIR="$HOME/$CACHE_DIR" ;;
-esac
-LOCK="$CACHE_DIR/claude-current.lock.l"
-
-# A version is x.y.z, optionally with a pre-release or build tail.
-version_re='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.+-]+)?$'
-core_re='^[0-9]+\.[0-9]+\.[0-9]+$'
-is_version() { [[ "${1:-}" =~ $version_re ]]; }
-
-# ------------------------------------------------------------ small helpers
-
-# Seconds a command that ignores TERM is given before it is sent KILL, so a
-# bound is a bound whatever the command does with the first signal.
-KILL_GRACE=5
-
-# kill_tree <pid> [<signal>]: the process and every process below it, and the
-# pids it signalled, one per line on stdout. Each one is stopped before its
-# children are listed, so none of them can start another while the tree is
-# walked, then sent <signal> (default TERM) and continued so that it can act
-# on it. `pgrep -P` is on Linux and macOS alike; without it only <pid> is
-# signalled.
-kill_tree() {
-	local child sig="${2:-TERM}"
-	kill -STOP "$1" 2>/dev/null || return 0
-	printf '%s\n' "$1"
-	for child in $(pgrep -P "$1" 2>/dev/null); do
-		kill_tree "$child" "$sig"
-	done
-	kill -"$sig" "$1" 2>/dev/null || :
-	kill -CONT "$1" 2>/dev/null || :
-}
-
-# running <pid>: zombies have exited, even before their parent reaps them.
-# The installation lock uses this to distinguish a live owner from a dead one.
-running() {
-	local st
-	kill -0 "$1" 2>/dev/null || return 1
-	st="$(ps -o stat= -p "$1" 2>/dev/null)" || return 0
-	case "$st" in *Z*) return 1 ;; esac
-	return 0
-}
-
-# run_bounded <seconds> <command> [args...]: the command's own status, or 124
-# when it ran out of time. GNU `timeout`, else Homebrew's `gtimeout`, else a
-# watchdog, because a stock macOS ships neither. Every branch sends TERM at
-# the bound and KILL $KILL_GRACE seconds later to what is still running:
-# `-k` for the two commands, and for the watchdog a dedicated process group.
-# The watchdog ends the WHOLE tree, as `timeout` ends its process group: a
-# command's own children (npm's lifecycle processes, a script's `sleep`)
-# would otherwise keep the caller's command substitution open after the
-# command itself was killed. The watchdog's own output goes to /dev/null for
-# the same reason.
-run_bounded() {
-	local secs="$1" pid dog rc=0 flag monitor=0
-	shift
-	if command -v timeout >/dev/null 2>&1; then
-		timeout -k "$KILL_GRACE" "$secs" "$@" || rc=$?
-	elif command -v gtimeout >/dev/null 2>&1; then
-		gtimeout -k "$KILL_GRACE" "$secs" "$@" || rc=$?
-	else
-		# WHOEVER MAKES $flag FIRST DECIDES: the watchdog, when the time is up,
-		# or this function, when the command ended first. So this function
-		# never kills a watchdog half way through its TERM and KILL, and a
-		# watchdog that wakes after the command ended signals nothing. Where no
-		# flag can be made at all, the watchdog acts and this function stops it.
-		flag="${TMPDIR:-/tmp}/claude-current.bound.$$.$RANDOM"
-		# Bash job control assigns this asynchronous command its own process
-		# group on both Linux and stock macOS. Keep the caller's setting, and
-		# signal the group even after its leader exits: a TERM handler may
-		# create another child that still owns the output pipe.
-		case "$-" in *m*) monitor=1 ;; esac
-		set -m
-		"$@" &
-		pid=$!
-		[ "$monitor" = 1 ] || set +m
-		(
-			sleep "$secs"
-			if ! mkdir -- "$flag" 2>/dev/null && [ -d "$flag" ]; then exit 0; fi
-			kill -TERM -- "-$pid" 2>/dev/null || exit 0
-			sleep "$KILL_GRACE"
-			kill -KILL -- "-$pid" 2>/dev/null || :
-		) >/dev/null 2>&1 &
-		dog=$!
-		wait "$pid" || rc=$?
-		if mkdir -- "$flag" 2>/dev/null || [ ! -d "$flag" ]; then
-			kill_tree "$dog" >/dev/null
-		else
-			# The watchdog won even if TERM was handled as a successful exit.
-			rc=124
-		fi
-		wait "$dog" 2>/dev/null || :
-		rmdir -- "$flag" 2>/dev/null || :
-		[ "$rc" = 143 ] && rc=124
-	fi
-	[ "$rc" = 137 ] && rc=124
-	return "$rc"
-}
-
-# numcmp <a> <b>: -1, 0 or 1 for two digit strings, compared as numbers of any
-# length without integer arithmetic (the same rule as workBenches #109).
-numcmp() {
-	local x="$1" y="$2"
-	x="${x#"${x%%[!0]*}"}"
-	y="${y#"${y%%[!0]*}"}"
-	x="${x:-0}"
-	y="${y:-0}"
-	if [ "${#x}" -ne "${#y}" ]; then
-		if [ "${#x}" -gt "${#y}" ]; then echo 1; else echo -1; fi
-		return 0
-	fi
-	if [ "$x" = "$y" ]; then echo 0; return 0; fi
-	if [[ "$x" > "$y" ]]; then echo 1; else echo -1; fi
-}
-
-# precmp <a> <b>: -1, 0 or 1 for two pre-release tags, by SemVer 2.0.0 rule 11:
-# dot-separated identifiers from the left; digits-only ones compare as numbers
-# and sort before the others, which compare in byte order (LC_ALL=C); when
-# every shared identifier is equal, the tag with fewer identifiers is lower.
-# So beta.9 < beta.10, and alpha < alpha.1 < alpha.beta.
-precmp() {
-	local a="$1" b="$2" x y xn yn c
-	while [ -n "$a" ] || [ -n "$b" ]; do
-		[ -n "$a" ] || { echo -1; return 0; }
-		[ -n "$b" ] || { echo 1; return 0; }
-		x="${a%%.*}"
-		y="${b%%.*}"
-		case "$a" in *.*) a="${a#*.}" ;; *) a="" ;; esac
-		case "$b" in *.*) b="${b#*.}" ;; *) b="" ;; esac
-		xn=1
-		yn=1
-		case "$x" in '' | *[!0-9]*) xn=0 ;; esac
-		case "$y" in '' | *[!0-9]*) yn=0 ;; esac
-		if [ "$xn$yn" = 11 ]; then
-			c="$(numcmp "$x" "$y")"
-		elif [ "$xn$yn" = 10 ]; then
-			c=-1
-		elif [ "$xn$yn" = 01 ]; then
-			c=1
-		elif [ "$x" = "$y" ]; then
-			c=0
-		elif (LC_ALL=C; [[ "$x" < "$y" ]]); then
-			c=-1
-		else
-			c=1
-		fi
-		[ "$c" = 0 ] || { echo "$c"; return 0; }
-	done
-	echo 0
-}
-
-# vercmp <a> <b>: -1, 0 or 1. Numeric on the x.y.z core. Then a version with no
-# pre-release tag beats one with a tag, and two tags compare by precmp. Build
-# metadata (+...) is ignored.
-vercmp() {
-	local a="${1%%+*}" b="${2%%+*}" ac bc ap="" bp="" ar br i c
-	ac="${a%%-*}"
-	bc="${b%%-*}"
-	case "$a" in *-*) ap="${a#*-}" ;; esac
-	case "$b" in *-*) bp="${b#*-}" ;; esac
-	for i in 1 2 3; do
-		ar="${ac%%.*}"
-		br="${bc%%.*}"
-		c="$(numcmp "$ar" "$br")"
-		[ "$c" = 0 ] || { echo "$c"; return 0; }
-		ac="${ac#*.}"
-		bc="${bc#*.}"
-	done
-	if [ "$ap" = "$bp" ]; then echo 0; return 0; fi
-	if [ -z "$ap" ]; then echo 1; return 0; fi
-	if [ -z "$bp" ]; then echo -1; return 0; fi
-	precmp "$ap" "$bp"
-}
-
-# physical <path>: the path with every symlink resolved, without `readlink -f`,
-# which BSD `readlink` did not take until macOS 12.3.
-physical() {
-	local p="$1" link n=0 dir
-	while [ -L "$p" ] && [ "$n" -lt 40 ]; do
-		link="$(readlink -- "$p")" || break
-		case "$link" in
-			/*) p="$link" ;;
-			*) p="$(dirname -- "$p")/$link" ;;
-		esac
-		n=$((n + 1))
-	done
-	dir="$(cd -P -- "$(dirname -- "$p")" 2>/dev/null && pwd)" || {
-		printf '%s\n' "$p"
-		return 0
-	}
-	printf '%s/%s\n' "$dir" "$(basename -- "$p")"
-}
-
-# read_version <path>: the first version on the first line of `<path> --version`.
-read_version() {
-	local out="" v
-	out="$(run_bounded "$VERSION_TIMEOUT" "$1" --version 2>/dev/null </dev/null)" || return 1
-	v="$(printf '%s\n' "$out" | sed -n -e '1s/^[^0-9]*\([0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*[-+0-9A-Za-z.]*\).*$/\1/p')"
-	is_version "$v" || return 1
-	printf '%s\n' "$v"
-}
-
-# ----------------------------------------------------------- the candidates
-
-# The user npm prefix: the one place an update may write.
-npm_user_prefix() {
-	local p=""
-	if [ -n "${CLAUDE_CURRENT_NPM_PREFIX:-}" ]; then
-		p="$CLAUDE_CURRENT_NPM_PREFIX"
-	elif [ -n "${NPM_CONFIG_PREFIX:-}" ]; then
-		p="$NPM_CONFIG_PREFIX"
-	elif [ -n "${npm_config_prefix:-}" ]; then
-		p="$npm_config_prefix"
-	elif [ -r "$HOME/.npmrc" ]; then
-		p="$(sed -n -e 's/^[[:space:]]*prefix[[:space:]]*=[[:space:]]*//p' "$HOME/.npmrc" | tail -n 1)"
-		p="${p%"${p##*[![:space:]]}"}"
-		p="${p%\"}"
-		p="${p#\"}"
-	fi
-	case "$p" in
-		'~') p="$HOME" ;;
-		'~/'*) p="$HOME/${p#'~/'}" ;;
-		'${HOME}'*) p="$HOME${p#'${HOME}'}" ;;
-		'$HOME'*) p="$HOME${p#'$HOME'}" ;;
-	esac
-	p="${p%/}"
-	[ -n "$p" ] || p="$HOME/.npm-global"
-	# A relative prefix is anchored at $HOME, so the path npm installs into is
-	# the path read back, and the same one whichever directory asks.
-	case "$p" in
-		/*) ;;
-		*) p="$HOME/$p" ;;
-	esac
-	printf '%s\n' "$p"
-}
-USER_PREFIX="$(npm_user_prefix)"
-
-cands=""       # one "<path><TAB><version>" line per candidate, in order
-seen=$'\n'     # the physical paths already read
-native_path="" # the native candidate that runs, when there is one
-native_broken=$'\n' # the native files whose version read failed, until something may have changed them
-
-add_candidate() {
-	local p="$1" real v
-	case "$p" in /*) ;; *) return 0 ;; esac
-	[ -f "$p" ] && [ -x "$p" ] || return 0
-	real="$(physical "$p")"
-	case "$seen" in *$'\n'"$real"$'\n'*) return 0 ;; esac
-	seen="$seen$real"$'\n'
-	v="$(read_version "$p")" || return 0
-	cands="$cands$p"$'\t'"$v"$'\n'
-}
-
-# native_names: the x.y.z names of the executable regular files in the native
-# versions directory, highest first (workBenches #109's ordering), one per
-# line. One pass and one `sort`, because ordering by `vercmp` is a process for
-# every comparison.
-native_names() {
-	local f name
-	for f in "$NATIVE_DIR"/*; do
-		[ -f "$f" ] && [ -x "$f" ] && [ ! -L "$f" ] || continue
-		name="${f##*/}"
-		[[ "$name" =~ $core_re ]] || continue
-		printf '%s\n' "$name"
-	done | sort -t. -k1,1nr -k2,2nr -k3,3nr
-}
-
-# add_native: the native candidate is the newest native file whose `--version`
-# answers. A newer file that does not run (a download cut short, a binary for
-# another libc, a first start that hangs) must not hide an older one that
-# does, so each is read from the highest down and the first that answers is
-# kept. A working newest file costs one read. A file that failed is
-# remembered, because collect runs up to four times and a hung file would cost
-# its whole bound on each, and forgotten wherever something else may have
-# written it: after a wait for the lock, when another launch may have finished
-# a file this one read half written, and after `claude update`, which rewrites
-# files, the failed one among them.
-add_native() {
-	local name f before
-	native_path=""
-	[ -d "$NATIVE_DIR" ] || return 0
-	while IFS= read -r name; do
-		[ -n "$name" ] || continue
-		f="$NATIVE_DIR/$name"
-		case "$native_broken" in *$'\n'"$f"$'\n'*) continue ;; esac
-		before="$cands"
-		add_candidate "$f"
-		if [ "$cands" != "$before" ]; then
-			native_path="$f"
-			return 0
-		fi
-		native_broken="$native_broken$f"$'\n'
-	done <<EOF
-$(native_names)
-EOF
-}
-
-collect() {
-	local p old_ifs
-	cands=""
-	seen=$'\n'
-	add_native
-	add_candidate "$USER_PREFIX/bin/claude"
-	add_candidate "$HOME/.local/bin/claude"
-	old_ifs="$IFS"
-	set -f
-	IFS=:
-	for p in ${CLAUDE_CURRENT_SYSTEM_CANDIDATES-/usr/local/bin/claude:/usr/bin/claude}; do
-		IFS="$old_ifs"
-		add_candidate "$p"
-		IFS=:
-	done
-	IFS="$old_ifs"
-	set +f
-}
-
-# pick <mode> [<published>]: sets CHOSEN_PATH and CHOSEN_VERSION, or returns 1.
-#   equal    the first candidate whose version equals <published>
-#   ahead    the newest candidate newer than <published>
-#   newest   the newest candidate at all (the first of equal ones)
-pick() {
-	local mode="$1" ref="${2:-}" p v c best="" bestv=""
-	while IFS=$'\t' read -r p v; do
-		[ -n "$p" ] || continue
-		case "$mode" in
-			equal)
-				if [ "$(vercmp "$v" "$ref")" = 0 ]; then
-					CHOSEN_PATH="$p"
-					CHOSEN_VERSION="$v"
-					return 0
-				fi
-				continue ;;
-			ahead)
-				[ "$(vercmp "$v" "$ref")" = 1 ] || continue ;;
-		esac
-		if [ -z "$best" ]; then
-			best="$p"
-			bestv="$v"
-			continue
-		fi
-		c="$(vercmp "$v" "$bestv")"
-		if [ "$c" = 1 ]; then
-			best="$p"
-			bestv="$v"
-		fi
-	done <<EOF
-$cands
-EOF
-	[ -n "$best" ] || return 1
-	CHOSEN_PATH="$best"
-	CHOSEN_VERSION="$bestv"
-	return 0
-}
-
-installed_summary() {
-	local p v out=""
-	while IFS=$'\t' read -r p v; do
-		[ -n "$p" ] || continue
-		out="${out:+$out; }$v at $p"
-	done <<EOF
-$cands
-EOF
-	printf '%s' "${out:-none}"
-}
-
-# ------------------------------------------------------------ the lock
-#
-# ONE LOCK FOR EVERY LAUNCH, WHATEVER ITS PATH HOLDS (Copilot on #134). The
-# lock was `flock` where PATH had one and a symlink where it did not, so two
-# launches with different PATHs held two independent locks and both updated
-# the same install at once. Every launch now takes the one symlink at $LOCK,
-# and `flock` is never consulted.
-#
-# THE SYMLINK'S TEXT NAMES ITS OWNER, `pid=<pid>@<place>`. `ln -s` makes the
-# lock and publishes the owner in one atomic act, so a launch killed at any
-# point leaves either no lock or a lock that names it, never an ownerless one
-# every later launch would wait on. <place> is where that pid means anything:
-# the host's name and, where /proc shows one, the inode of the pid namespace.
-# Containers that share one home share this lock, and a pid read in another
-# namespace says nothing about whether its owner still runs, which `flock`
-# never needed to know. So a lock made ELSEWHERE is waited on and never taken
-# over, and the refusal names it and its place; a lock made HERE whose owner
-# is no longer running is taken over.
-#
-# ONE LAUNCH REMOVES A DEAD OWNER'S LOCK, and it holds a second directory, the
-# reaper, while it looks again. Two launches that both read the same dead pid
-# would otherwise both remove "the stale lock", and the second removal would
-# take the lock the first had just made, so both would update at once. Under
-# the reaper the lock is removed only while it still names the owner that was
-# seen dead. A reaper left by a launch killed in those few lines blocks the
-# takeover, and the refusal names it.
-
-OWNER=""
-PLACE=""
-link_lock=""
-lock_why=""
-lock_slept=0 # 1 once this launch has waited for the lock
-
-# lock_place: this launch's <place>, `<host>` or `<host>:<pid namespace inode>`.
-# No `/`, because `ln -s` onto a directory names the link it puts inside after
-# the target's last component.
-lock_place() {
-	local host ns
-	host="$(uname -n 2>/dev/null || :)"
-	ns="$(readlink "/proc/$$/ns/pid" 2>/dev/null || :)"
-	# `pid:[4026531836]` on Linux, nothing without /proc: its digits or none.
-	ns="${ns//[!0-9]/}"
-	case "$host" in '' | *[/@:]*) host=unknown ;; esac
-	printf '%s' "$host${ns:+:$ns}"
-}
-
-# take_lock: 0 with the lock held, or 1 with lock_why saying why not.
-take_lock() {
-	local waited=0 missing=0 record owner where reaped
-	if ! mkdir -p -- "$CACHE_DIR" 2>/dev/null; then
-		lock_why="the update lock's directory $CACHE_DIR could not be created"
-		return 1
-	fi
-	PLACE="$(lock_place)"
-	OWNER="pid=$$@$PLACE"
-	while :; do
-		if ln -s "$OWNER" "$LOCK" 2>/dev/null; then
-			[ "$(readlink -- "$LOCK" 2>/dev/null || :)" = "$OWNER" ] && break
-			# A directory at that path: `ln` put the link inside it.
-			rm -f -- "$LOCK/$OWNER" 2>/dev/null || :
-			lock_why="$LOCK is a directory and not this command's lock: remove it"
-			return 1
-		fi
-		if [ ! -L "$LOCK" ] && [ ! -e "$LOCK" ]; then
-			# Nothing there and still no lock: one that was released between
-			# the two acts is taken at the next try, and a directory this
-			# launch cannot write in is named now rather than waited out.
-			missing=$((missing + 1))
-			if [ "$missing" -ge 2 ]; then
-				lock_why="the update lock $LOCK could not be made in $CACHE_DIR"
-				return 1
-			fi
-			continue
-		fi
-		missing=0
-		record="$(readlink -- "$LOCK" 2>/dev/null || :)"
-		owner=""
-		where=""
-		case "$record" in
-			pid=*@*)
-				owner="${record#pid=}"
-				owner="${owner%%@*}"
-				where="${record#*@}" ;;
-		esac
-		case "$owner" in '' | *[!0-9]*) owner="" ;; esac
-		# A lock made here whose owner has gone, or that names this very pid
-		# (a dead launch's, which this one never took), is a lock nobody holds.
-		if [ -n "$owner" ] && [ "$where" = "$PLACE" ] &&
-			{ [ "$owner" = "$$" ] || ! running "$owner"; } &&
-			mkdir -- "$LOCK.reap" 2>/dev/null; then
-			reaped=0
-			if [ "$(readlink -- "$LOCK" 2>/dev/null || :)" = "$record" ] &&
-				rm -f -- "$LOCK" 2>/dev/null && [ ! -L "$LOCK" ]; then
-				reaped=1
-			fi
-			rmdir -- "$LOCK.reap" 2>/dev/null || :
-			# Taken over: try for the lock at once. Not taken over (another
-			# launch got there first, or the lock would not go): wait as usual.
-			[ "$reaped" = 1 ] && continue
-		fi
-		if [ "$waited" -ge "$LOCK_WAIT" ]; then
-			lock_why="the update lock $LOCK was not free within ${LOCK_WAIT}s"
-			if [ -n "$owner" ] && [ "$where" != "$PLACE" ]; then
-				lock_why="$lock_why. It is held by pid $owner at $where, and this launch runs at $PLACE, where that pid says nothing about whether its owner still runs: remove $LOCK if no launch is running there"
-			elif [ -z "$owner" ]; then
-				lock_why="$lock_why. It is not a lock this command makes (it reads '${record:-not a symlink}'): remove $LOCK if no launch is running"
-			fi
-			[ -d "$LOCK.reap" ] &&
-				lock_why="$lock_why, and $LOCK.reap, the directory a launch holds while it removes a dead owner's lock, is still there: remove it if no launch is running"
-			return 1
-		fi
-		sleep 1
-		waited=$((waited + 1))
-		lock_slept=1
-	done
-	link_lock="$LOCK"
-	lock_why=""
-	return 0
-}
-
-release_lock() {
-	if [ -n "$link_lock" ]; then
-		if [ "$(readlink -- "$link_lock" 2>/dev/null || :)" = "$OWNER" ]; then
-			rm -f -- "$link_lock"
-		fi
-		link_lock=""
-	fi
-}
-trap release_lock EXIT
-
-# ------------------------------------------------------------ the update
-
-update_why=""
-
-update_native() {
-	local rc=0
-	say "updating the native install toward $PUBLISHED: $native_path update"
-	run_bounded "$UPDATE_TIMEOUT" "$native_path" update </dev/null >&2 9>&- || rc=$?
-	[ "$rc" = 0 ] || update_why="\`$native_path update\` exited $rc"
-	return "$rc"
-}
-
-update_npm() {
-	local rc=0 v hook
-	if ! command -v "$NPM" >/dev/null 2>&1; then
-		update_why="there is no npm ('$NPM') to install $PACKAGE@$PUBLISHED with"
-		return 1
-	fi
-	if ! mkdir -p -- "$USER_PREFIX" 2>/dev/null; then
-		update_why="the user npm prefix $USER_PREFIX could not be created"
-		return 1
-	fi
-	say "updating $USER_PREFIX to claude $PUBLISHED: $NPM install -g --prefix $USER_PREFIX $PACKAGE@$PUBLISHED"
-	run_bounded "$UPDATE_TIMEOUT" "$NPM" install -g --prefix "$USER_PREFIX" --no-fund --no-audit \
-		"$PACKAGE@$PUBLISHED" </dev/null >&2 9>&- || rc=$?
-	if [ "$rc" != 0 ]; then
-		update_why="\`$NPM install -g --prefix $USER_PREFIX $PACKAGE@$PUBLISHED\` exited $rc"
-		return "$rc"
-	fi
-	# npm 12's install-script policy skips the package's native-binary hook, so
-	# the launcher it links can be a stub until that hook runs. The shared image
-	# runs the same hook by hand (workBenches base-image/install-ai-clis.sh).
-	v="$(read_version "$USER_PREFIX/bin/claude" || :)"
-	hook="$USER_PREFIX/lib/node_modules/$PACKAGE/install.cjs"
-	if [ "$v" != "$PUBLISHED" ] && [ -f "$hook" ]; then
-		say "running the package's own install hook, which npm skipped: $NODE $hook"
-		rc=0
-		run_bounded "$UPDATE_TIMEOUT" "$NODE" "$hook" </dev/null >&2 9>&- || rc=$?
-		[ "$rc" = 0 ] || update_why="the package's install hook ($hook) exited $rc"
-	fi
-	return 0
-}
-
-# ------------------------------------------------------------ the answer
-
-PUBLISHED=""
-CHOSEN_PATH=""
-CHOSEN_VERSION=""
-
-answer() { # <status> <stderr line>
-	say "$2"
-	if [ "$porcelain" = 1 ]; then
-		printf 'path=%s\nversion=%s\npublished=%s\nstatus=%s\n' \
-			"$CHOSEN_PATH" "$CHOSEN_VERSION" "$PUBLISHED" "$1"
-	else
-		printf '%s\n' "$CHOSEN_PATH"
-	fi
-	exit 0
-}
-
-none_installed() { # <why>
-	die "no runnable Claude Code was found by absolute path ($1). Looked in: $NATIVE_DIR, $USER_PREFIX/bin/claude, $HOME/.local/bin/claude and ${CLAUDE_CURRENT_SYSTEM_CANDIDATES-/usr/local/bin/claude:/usr/bin/claude}. Install it with: npm install -g --prefix $USER_PREFIX $PACKAGE" 1
-}
-
-collect
-
-if [ "$offline" = 1 ]; then
-	pick newest || none_installed "--offline reads no npm and installs nothing"
-	answer unverified "claude $CHOSEN_VERSION at $CHOSEN_PATH (--offline: not checked against npm)"
-fi
-
-published_why=""
-if ! command -v "$NPM" >/dev/null 2>&1; then
-	published_why="there is no npm ('$NPM') to ask"
-else
-	view_rc=0
-	view_out="$(run_bounded "$TIMEOUT" "$NPM" view "$PACKAGE" version --prefer-online 2>/dev/null </dev/null)" || view_rc=$?
-	if [ "$view_rc" = 124 ]; then
-		published_why="npm view took longer than ${TIMEOUT}s"
-	elif [ "$view_rc" != 0 ]; then
-		published_why="npm view exited $view_rc"
-	else
-		view_last="$(printf '%s\n' "$view_out" | sed -n -e '$p' | tr -d "'\"[:space:]")"
-		if is_version "$view_last"; then
-			PUBLISHED="$view_last"
-		else
-			published_why="npm view answered '$view_out'"
-		fi
-	fi
-fi
-
-if [ -z "$PUBLISHED" ]; then
-	pick newest || none_installed "and npm could not be read: $published_why"
-	answer unverified "UNVERIFIED: could not reach npm ($published_why); launching claude $CHOSEN_VERSION at $CHOSEN_PATH"
-fi
-
-if pick equal "$PUBLISHED"; then
-	answer verified "claude $CHOSEN_VERSION (verified against npm $PUBLISHED) at $CHOSEN_PATH"
-fi
-if pick ahead "$PUBLISHED"; then
-	answer ahead "claude $CHOSEN_VERSION (ahead of npm $PUBLISHED) at $CHOSEN_PATH"
-fi
-
-# Every candidate is behind, or there is none. Update under the lock, and read
-# again after taking it: another launch may have updated while this one waited.
-locked=0
-if take_lock; then
-	locked=1
-fi
-# Whoever held the lock while this launch waited may have finished or repaired
-# a native it read half written.
-[ "$lock_slept" = 0 ] || native_broken=$'\n'
-collect
-if pick equal "$PUBLISHED"; then
-	release_lock
-	answer verified "claude $CHOSEN_VERSION (verified against npm $PUBLISHED) at $CHOSEN_PATH, updated by another launch"
-fi
-# The same two answers as before the wait, in the same order: a copy newer
-# than npm that appeared while this launch waited is `ahead` here too, and not
-# a reason to update again or to refuse (Copilot on #134).
-if pick ahead "$PUBLISHED"; then
-	release_lock
-	answer ahead "claude $CHOSEN_VERSION (ahead of npm $PUBLISHED) at $CHOSEN_PATH, updated by another launch"
-fi
-if [ "$locked" = 1 ]; then
-	if [ -n "$native_path" ]; then
-		update_native || :
-		native_broken=$'\n' # the update rewrites files, the failed one among them
-		collect
-	fi
-	if ! pick equal "$PUBLISHED" && ! pick ahead "$PUBLISHED"; then
-		update_npm || :
-		collect
-	fi
-	release_lock
-	if pick equal "$PUBLISHED"; then
-		answer verified "claude $CHOSEN_VERSION (verified against npm $PUBLISHED) at $CHOSEN_PATH, updated"
-	fi
-	if pick ahead "$PUBLISHED"; then
-		answer ahead "claude $CHOSEN_VERSION (ahead of npm $PUBLISHED) at $CHOSEN_PATH, updated"
-	fi
-fi
-
-why="${lock_why:-${update_why:-the update ran and still did not produce $PUBLISHED}}"
-if ! pick newest; then
-	none_installed "and installing $PUBLISHED did not produce one: $why"
-fi
-if [ "${CLAUDE_ALLOW_STALE:-}" = 1 ]; then
-	answer stale "STALE: claude $CHOSEN_VERSION at $CHOSEN_PATH is behind npm $PUBLISHED ($why); launching it because CLAUDE_ALLOW_STALE=1"
-fi
-fix="npm install -g --prefix $USER_PREFIX $PACKAGE@$PUBLISHED"
-[ -n "$native_path" ] && fix="$native_path update, or $fix"
-die "REFUSED: npm publishes claude $PUBLISHED and the newest installed is $CHOSEN_VERSION at $CHOSEN_PATH, and the update did not produce $PUBLISHED ($why). Installed: $(installed_summary). Fix: $fix. CLAUDE_ALLOW_STALE=1 launches $CHOSEN_VERSION anyway." 2
diff --git a/claude-restart-check b/claude-restart-check
deleted file mode 100755
index eab69fbe..00000000
--- a/claude-restart-check
+++ /dev/null
@@ -1,368 +0,0 @@
-#!/usr/bin/env bash
-# claude-restart-check: one green restart line for a replaced binary, or a
-# newer-copy notice when another installed version is newer. Nothing otherwise.
-#
-# Installed on PATH by `openRepoTools --install`, for workBenches' shared
-# status line to call.
-#
-# Why it exists (opensoft/workBenches#119, Brett Heap's added scope of
-# 2026-09-29): a running session keeps the binary it loaded. When a launch's
-# update or the CLI's own auto-updater replaces that binary, every session
-# already running must say so at its prompt, the way the CLI's own update
-# notice does. The CLI's native line cannot be written from outside, so the
-# shared status line prints this command's line at the top of its panel. It
-# WARNS AND NEVER ACTS: no kill and no automatic /ctx, because a working
-# session is never interrupted (lane-collision-protocol Amendment 18).
-#
-# USAGE
-#   claude-restart-check [--running <version>] [--pid <pid>]
-#   claude-restart-check --help
-#
-#   --running <version>  the version the session reports, from the status
-#                        line's JSON `version` field
-#   --pid <pid>          where the walk to the claude process starts (default:
-#                        this command's parent). The status line passes its own
-#                        $PPID, the `/bin/sh -c` that Claude starts it under.
-#
-# HOW IT DECIDES, cheaply, because it runs at every status line render
-#   - Walks at most three processes, from --pid up through its parents, to
-#     the first one whose /proc/<pid>/exe is a Claude Code binary: a native
-#     version file (.../claude/versions/<x.y.z>, or <x.y.z> directly in the
-#     native versions directory, compared by its canonical path because the
-#     kernel reports exe with every symlink resolved) or the npm package's
-#     .../node_modules/@anthropic-ai/<dir>/bin/claude.exe.
-#   - The binary was REPLACED when that exe link ends in " (deleted)". npm
-#     renames the old package directory before it deletes it, so the exe path
-#     cannot be used to read the running version.
-#   - The INSTALLED version is read from disk, as the highest of: the running
-#     install's own (the highest x.y.z name beside a native version file, or
-#     `version` in the npm package's package.json at its canonical path), the
-#     native versions directory ($CLAUDE_CURRENT_NATIVE_DIR, default
-#     ~/.local/share/claude/versions), and the package in the user npm prefix,
-#     found the way claude-current finds it. So a session on the npm copy is
-#     told about a newer native install. The next launch checks npm and may
-#     prefer a candidate equal to npm over that newer installed copy.
-#   - It warns when the binary was replaced, or when the installed version is
-#     newer than the running one (--running, else the native file's name).
-#   It reads /proc, a directory listing and a few small files. It reaches no
-#   network and runs no binary, so the render is not slowed by a
-#   `claude --version`.
-#
-# OUTPUT
-#   Nothing, or exactly one line:
-#     RESTART NEEDED: running <old>, installed <new>; /ctx at your next breakpoint
-#   or, when only the version differs and the binary was not replaced:
-#     NEWER COPY INSTALLED: running <old>, installed <new>; /ctx checks npm before selecting a version
-#   in green, or plain when NO_COLOR is set.
-#
-# EXIT
-#   0 always, including a host with no /proc such as macOS, where it prints
-#   nothing, because a status line must never break on this. 64 only for an
-#   argument it does not know.
-#
-# ENVIRONMENT
-#   CLAUDE_RESTART_CHECK_PROC  the process table to read (default /proc), the
-#                              test seam
-#   CLAUDE_CURRENT_NATIVE_DIR, CLAUDE_CURRENT_NPM_PREFIX, NPM_CONFIG_PREFIX
-#                              where the installs are, read as claude-current
-#                              reads them
-#   NO_COLOR                   plain text, no ANSI colour
-#
-# `set -u` and NOT `set -e`, deliberately, for lane-handoff's reason one file
-# over: every read here may fail (a process gone mid-walk, a file unreadable),
-# and each failure must reach this command's own "print nothing, exit 0"
-# rather than end the status line's render with a non-zero status.
-
-set -u
-
-prog="claude-restart-check"
-
-usage() {
-	cat <<'USAGE'
-claude-restart-check [--running <version>] [--pid <pid>]
-claude-restart-check --help
-
-Print a green RESTART NEEDED line for a binary replaced on disk, or a
-NEWER COPY INSTALLED notice when only the installed version is newer. That
-notice does not promise /ctx will select the newer copy: the next launch
-checks npm first. Print nothing otherwise. Always exits 0 (64 for an unknown argument). Reads /proc
-(CLAUDE_RESTART_CHECK_PROC) and never acts on the session.
-USAGE
-}
-
-running=""
-start_pid=""
-while [ $# -gt 0 ]; do
-	case "$1" in
-		--running)
-			[ $# -ge 2 ] || { usage >&2; exit 64; }
-			running="$2"
-			shift 2 ;;
-		--running=*)
-			running="${1#--running=}"
-			shift ;;
-		--pid)
-			[ $# -ge 2 ] || { usage >&2; exit 64; }
-			start_pid="$2"
-			shift 2 ;;
-		--pid=*)
-			start_pid="${1#--pid=}"
-			shift ;;
-		-h | --help)
-			usage
-			exit 0 ;;
-		*)
-			printf '%s: unknown argument: %s\n' "$prog" "$1" >&2
-			usage >&2
-			exit 64 ;;
-	esac
-done
-
-PROC="${CLAUDE_RESTART_CHECK_PROC:-/proc}"
-[ -n "$start_pid" ] || start_pid="$PPID"
-case "$start_pid" in
-	'' | *[!0-9]*) exit 0 ;;
-esac
-[ -d "$PROC" ] || exit 0
-
-version_re='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.+-]+)?$'
-core_re='^[0-9]+\.[0-9]+\.[0-9]+$'
-is_version() { [[ "${1:-}" =~ $version_re ]]; }
-
-# numcmp, precmp and vercmp are claude-current's, byte for byte, so the two
-# commands agree on which version is newer.
-numcmp() {
-	local x="$1" y="$2"
-	x="${x#"${x%%[!0]*}"}"
-	y="${y#"${y%%[!0]*}"}"
-	x="${x:-0}"
-	y="${y:-0}"
-	if [ "${#x}" -ne "${#y}" ]; then
-		if [ "${#x}" -gt "${#y}" ]; then echo 1; else echo -1; fi
-		return 0
-	fi
-	if [ "$x" = "$y" ]; then echo 0; return 0; fi
-	if [[ "$x" > "$y" ]]; then echo 1; else echo -1; fi
-}
-
-# precmp <a> <b>: -1, 0 or 1 for two pre-release tags, by SemVer 2.0.0 rule 11:
-# dot-separated identifiers from the left; digits-only ones compare as numbers
-# and sort before the others, which compare in byte order (LC_ALL=C); when
-# every shared identifier is equal, the tag with fewer identifiers is lower.
-# So beta.9 < beta.10, and alpha < alpha.1 < alpha.beta.
-precmp() {
-	local a="$1" b="$2" x y xn yn c
-	while [ -n "$a" ] || [ -n "$b" ]; do
-		[ -n "$a" ] || { echo -1; return 0; }
-		[ -n "$b" ] || { echo 1; return 0; }
-		x="${a%%.*}"
-		y="${b%%.*}"
-		case "$a" in *.*) a="${a#*.}" ;; *) a="" ;; esac
-		case "$b" in *.*) b="${b#*.}" ;; *) b="" ;; esac
-		xn=1
-		yn=1
-		case "$x" in '' | *[!0-9]*) xn=0 ;; esac
-		case "$y" in '' | *[!0-9]*) yn=0 ;; esac
-		if [ "$xn$yn" = 11 ]; then
-			c="$(numcmp "$x" "$y")"
-		elif [ "$xn$yn" = 10 ]; then
-			c=-1
-		elif [ "$xn$yn" = 01 ]; then
-			c=1
-		elif [ "$x" = "$y" ]; then
-			c=0
-		elif (LC_ALL=C; [[ "$x" < "$y" ]]); then
-			c=-1
-		else
-			c=1
-		fi
-		[ "$c" = 0 ] || { echo "$c"; return 0; }
-	done
-	echo 0
-}
-
-vercmp() {
-	local a="${1%%+*}" b="${2%%+*}" ac bc ap="" bp="" ar br i c
-	ac="${a%%-*}"
-	bc="${b%%-*}"
-	case "$a" in *-*) ap="${a#*-}" ;; esac
-	case "$b" in *-*) bp="${b#*-}" ;; esac
-	for i in 1 2 3; do
-		ar="${ac%%.*}"
-		br="${bc%%.*}"
-		c="$(numcmp "$ar" "$br")"
-		[ "$c" = 0 ] || { echo "$c"; return 0; }
-		ac="${ac#*.}"
-		bc="${bc#*.}"
-	done
-	if [ "$ap" = "$bp" ]; then echo 0; return 0; fi
-	if [ -z "$ap" ]; then echo 1; return 0; fi
-	if [ -z "$bp" ]; then echo -1; return 0; fi
-	precmp "$ap" "$bp"
-}
-
-# The native versions directory, as claude-current reads it ($HOME unset leaves
-# only a configured one), and its canonical path when it is there:
-# /proc/<pid>/exe names a file by its real path, so a directory that is (or
-# sits below) a symlink, configured or the default, is compared by where it
-# leads. `cd -P`, `pwd -P` and no `readlink -f`, for bash 3.2 and a BSD
-# `readlink`.
-native_dir="${CLAUDE_CURRENT_NATIVE_DIR:-${HOME:+$HOME/.local/share/claude/versions}}"
-native_real=""
-if [ -n "$native_dir" ]; then
-	native_real="$(cd -P -- "$native_dir" 2>/dev/null && pwd -P)" || native_real=""
-fi
-
-# is_native_binary <exe target>: a native version file, in any directory named
-# .../claude/versions or as <x.y.z> directly in the native versions directory.
-is_native_binary() {
-	case "$1" in
-		*/claude/versions/*) return 0 ;;
-	esac
-	[ -n "$native_real" ] && [ "${1%/*}" = "${native_real%/}" ] && is_version "${1##*/}"
-}
-
-is_claude_binary() { # <exe target, " (deleted)" already removed>
-	is_native_binary "$1" && return 0
-	case "$1" in
-		*/node_modules/@anthropic-ai/*/bin/claude.exe) return 0 ;;
-		*/node_modules/@anthropic-ai/*/bin/claude) return 0 ;;
-	esac
-	return 1
-}
-
-parent_of() {
-	awk '/^PPid:/ { print $2; exit }' "$PROC/$1/status" 2>/dev/null
-}
-
-# The highest x.y.z name among the executable regular files of one directory.
-highest_in() {
-	local f name best=""
-	for f in "$1"/*; do
-		[ -f "$f" ] && [ -x "$f" ] && [ ! -L "$f" ] || continue
-		name="${f##*/}"
-		[[ "$name" =~ $core_re ]] || continue
-		if [ -z "$best" ] || [ "$(vercmp "$name" "$best")" = 1 ]; then
-			best="$name"
-		fi
-	done
-	printf '%s' "$best"
-}
-
-# package_version <package.json>: its first "version" value, however the file
-# is laid out. npm writes it one key to a line; a minified one has every key
-# on one line, so the file is cut at each brace and comma first.
-package_version() {
-	[ -r "$1" ] || return 0
-	tr '{},' '\n\n\n' 2>/dev/null <"$1" |
-		sed -n -e 's/^[[:space:]]*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*$/\1/p' | head -n 1
-}
-
-# The user npm prefix, found the way claude-current finds it (byte for byte),
-# because that is the prefix a launch updates and starts from.
-npm_user_prefix() {
-	local p=""
-	if [ -n "${CLAUDE_CURRENT_NPM_PREFIX:-}" ]; then
-		p="$CLAUDE_CURRENT_NPM_PREFIX"
-	elif [ -n "${NPM_CONFIG_PREFIX:-}" ]; then
-		p="$NPM_CONFIG_PREFIX"
-	elif [ -n "${npm_config_prefix:-}" ]; then
-		p="$npm_config_prefix"
-	elif [ -r "$HOME/.npmrc" ]; then
-		p="$(sed -n -e 's/^[[:space:]]*prefix[[:space:]]*=[[:space:]]*//p' "$HOME/.npmrc" | tail -n 1)"
-		p="${p%"${p##*[![:space:]]}"}"
-		p="${p%\"}"
-		p="${p#\"}"
-	fi
-	case "$p" in
-		'~') p="$HOME" ;;
-		'~/'*) p="$HOME/${p#'~/'}" ;;
-		'${HOME}'*) p="$HOME${p#'${HOME}'}" ;;
-		'$HOME'*) p="$HOME${p#'$HOME'}" ;;
-	esac
-	p="${p%/}"
-	[ -n "$p" ] || p="$HOME/.npm-global"
-	# A relative prefix is anchored at $HOME, so the path npm installs into is
-	# the path read back, and the same one whichever directory asks.
-	case "$p" in
-		/*) ;;
-		*) p="$HOME/$p" ;;
-	esac
-	printf '%s\n' "$p"
-}
-
-pid="$start_pid"
-exe=""
-target=""
-found=0
-steps=0
-while [ "$steps" -lt 3 ]; do
-	case "$pid" in
-		'' | 0 | *[!0-9]*) break ;;
-	esac
-	exe="$(readlink -- "$PROC/$pid/exe" 2>/dev/null)" || exe=""
-	target="${exe% (deleted)}"
-	if [ -n "$target" ] && is_claude_binary "$target"; then
-		found=1
-		break
-	fi
-	pid="$(parent_of "$pid")" || pid=""
-	steps=$((steps + 1))
-done
-[ "$found" = 1 ] || exit 0
-
-replaced=0
-[ "$exe" = "$target" ] || replaced=1
-
-# THE INSTALLED VERSION IS THE HIGHEST ONE A LAUNCH COULD START, from every
-# install claude-current reads that has its version on disk: the running
-# binary's own, the native versions directory and the user npm prefix's
-# package. A session on the npm copy is behind a newer native install, which
-# may be considered at the next launch. This read has no registry information,
-# so it cannot predict the resolver's preference for a copy equal to npm.
-installed=""
-from_path=""
-consider() { # <version>: kept when it is higher than the one in hand
-	is_version "${1:-}" || return 0
-	if [ -z "$installed" ] || [ "$(vercmp "$1" "$installed")" = 1 ]; then
-		installed="$1"
-	fi
-}
-if is_native_binary "$target"; then
-	consider "$(highest_in "${target%/*}")"
-	from_path="${target##*/}"
-else
-	case "$target" in
-		*/node_modules/@anthropic-ai/*)
-			consider "$(package_version "${target%%/node_modules/@anthropic-ai/*}/node_modules/@anthropic-ai/claude-code/package.json")"
-			if [ "$replaced" = 0 ]; then
-				from_path="$(package_version "${target%/bin/*}/package.json")"
-			fi ;;
-	esac
-fi
-if [ -n "${HOME:-}" ]; then
-	consider "$(highest_in "$native_dir")"
-	consider "$(package_version "$(npm_user_prefix)/lib/node_modules/@anthropic-ai/claude-code/package.json")"
-fi
-
-is_version "$running" || running="$from_path"
-is_version "$running" || running=""
-is_version "$installed" || installed=""
-
-newer=0
-if [ -n "$installed" ] && [ -n "$running" ] && [ "$(vercmp "$installed" "$running")" = 1 ]; then
-	newer=1
-fi
-[ "$replaced" = 1 ] || [ "$newer" = 1 ] || exit 0
-
-if [ "$replaced" = 1 ]; then
-	line="RESTART NEEDED: running ${running:-an older build}, installed ${installed:-a newer build}; /ctx at your next breakpoint"
-else
-	line="NEWER COPY INSTALLED: running $running, installed $installed; /ctx checks npm before selecting a version"
-fi
-if [ -n "${NO_COLOR:-}" ]; then
-	printf '%s\n' "$line"
-else
-	printf '\033[32m%s\033[0m\n' "$line"
-fi
-exit 0
diff --git a/code b/code
new file mode 160000
index 00000000..2a057a6d
--- /dev/null
+++ b/code
@@ -0,0 +1 @@
+Subproject commit 2a057a6d84e58c8acb4bda20d2b7b667b552c3fe
diff --git a/commands/ctx.md b/commands/ctx.md
deleted file mode 100644
index a28bccad..00000000
--- a/commands/ctx.md
+++ /dev/null
@@ -1,88 +0,0 @@
----
-name: "Ctx"
-description: "/ctx clears this lane's context in one word: the handoff is written, then this lane's own pane is respawned with a new session whose first prompt is that handoff's top block"
-category: Lane
-tags: [lane, ctx, handoff, swap, lane-collision-protocol]
----
-
-**Invoke the `handoff` skill's legacy supervised restart path with `--restart`.**
-
-Before any preservation write, resolve the lane read-only and run
-`lanes-edit.sh legacy-restart-check <lane>`. Managed ownership or an unreadable
-ownership store refuses this compatibility path. Collect writer briefs without
-changing the canonical handoff, then call `lane-handoff --restart` once with
-`--writers-file <temporary TSV>` when needed. The backend reserves `preparing`
-before changing any window, handoff, row or log. Do not execute the skill's
-ordinary steps 1–5 as a separate write sequence for `/ctx`.
-
-This intent owns only the legacy restart operation. It neither reads nor advances
-PR #97's lifecycle counters or feature 001's managed JSON ledger.
-
-`/ctx` is `/handoff --restart` and nothing else. Lane-collision-protocol **Amendment 17 clause (f)**, folded
-in on Brett Heap's word of 2026-09-14, verbatim: *"the /ctx should also run the first prompt and restart all.
-so the user only does /ctx and it is all automatic from there"* — and ratified the same day as revision 2.
-
-What that means in order, and the order is the rule:
-
-1. the backend reserves the legacy restart operation as `preparing`, then the identity triple is fixed, the handoff file is refreshed with a fresh Rule 3 top block that **lists
-   every writer this lane has running** (its worktree, its branch, its brief, what it had committed), the
-   writers are polled, and `PAUSED` is written with Amendment 11(c)'s sub-fields, Amendment 17(b)'s `agent`
-   and `transcript`, and `clear` as its why;
-2. **then** that **RESTART INTENT** becomes `pending` under the lane's own control root — the lane, a generation, an
-   operation id, the transcript being paused, the agent, the profile, the checkout, the pane, the handoff's
-   path and its **digest**, and the launch mode `fresh-from-handoff` — and read back;
-3. **then** the lane's own pane is respawned — `tmux respawn-pane -k`, so the act survives the death of the
-   session that started it — with the **pane supervisor** (`lane-handoff --supervise`, by absolute path). The
-   supervisor claims that intent, runs the launch as its **child**, and stays in the pane whatever happens;
-4. the launch is a NEW session of the same agent whose FIRST PROMPT is the top block written in step 1, run
-   without anyone typing it;
-5. that session stamps `RESUMED by …` first, as Rule 3 requires, then **COUNTS the live writers** —
-   `ListAgents`, the agent's equivalent elsewhere — because the block's `WRITERS` section is a list to COUNT
-   and not a list to relaunch (Amendment 17 Addendum 1 (i), in force 2026-09-14T20:59:31Z). A writer still
-   live OWNS its worktree and is told, not relaunched; only a writer that is NOT live is relaunched, from
-   where it stood;
-6. only when the replacement is **positively confirmed** — a live child, exactly one holder of this lane, its
-   transcript the new one and not the paused one, in the pane the intent names — is the restart marked
-   `ready`. Until then it is not.
-
-**Steps 2, 3 and 6 are new, and they are `opensoft/openRepoTools#94`.** On 2026-09-15 this command wrote its
-record, respawned the pane with `LANE_START_FRESH=1 … lane <lane>`, and what came up was
-`claude --name <lane> --resume <the uuid it had just paused>` — the same conversation, not a fresh one, with
-no supervisor to notice. The seam was an **environment variable**, and the launcher re-creates its child
-through `tmux new-session`, which hands that child the tmux **server's** environment and not the caller's.
-An environment cannot cross that boundary; a **file** can, so the intent on disk is now the authority and
-`LANE_START_FRESH` is a compatibility detail. And what tmux starts is a supervisor rather than the launch
-itself, because a launch that ends takes the pane with it — Amendment 11's own invariant is *"No path the
-launcher opened exits the pane"*, and this one did.
-
-**`/ctx` says which it did** (Addendum 1 (j)). This one respawns the pane, so the process every writer was a
-child of is gone, the record says `kind respawn`, and the count then finds none — which is what makes
-relaunching each one right. A clear that happens IN PLACE keeps that process and its writers with it: that
-one is `--in-process`, `kind in-process`, and its block says to EXPECT every writer below live. Either way
-the kind says what to expect and never what to do.
-
-**A `/ctx` whose record could not be written REFUSES before it kills anything.** A pane is never respawned
-over an unrecorded lane — and the record is now FOUR writes, not three: if the `PAUSED` line did not land, or
-the row was not flipped, or the handoff's top block (which is the new session's first prompt) could not be
-refreshed, **or the restart intent could not be written and read back**, this pane stays exactly as it is and
-the reason is printed. A pane respawned with no intent is a pane whose supervisor has nothing to launch from,
-which is the same unrecorded restart one step along.
-
-**A restart already in flight is not superseded.** A second `/ctx` on a lane whose intent is `preparing`, `pending` or
-`starting` refuses before preservation writes or the kill — and names `lane-handoff --restart-status --lane <lane>`.
-
-**When the launch fails, the pane is still yours.** The supervisor marks the intent `failed`, prints the
-stage that failed and offers one line to retry the same operation. Nothing of the lane is lost: the handoff
-it wrote is intact and its top block is still the first prompt the next session gets.
-
-No picker, no title fallback, no second command: the one word is the whole act.
-
-Every launch, retry and finalizer is fenced by operation, legacy generation and
-attempt. The first child reserves its transcript once; repeated consumers refuse.
-The Rule 3 stamp is published atomically, after recording the checksums of its
-complete prior and stamped versions. A retry accepts those exact versions only.
-
-A signal before the supervisor claim leaves the intent unchanged. A signal with
-a live or unknown child leaves `starting` and reports `INDETERMINATE`; retry stays
-blocked. Only a confirmed ended launch with no live holder becomes `failed`.
-Ordinary `lane <name>` resume cannot recover a failed supervised restart.
diff --git a/commands/handoff.md b/commands/handoff.md
deleted file mode 100644
index c579ced2..00000000
--- a/commands/handoff.md
+++ /dev/null
@@ -1,24 +0,0 @@
----
-name: "Handoff"
-description: "/handoff hands this lane off — the act /swap and /lane-swap also name, and the one /ctx runs before it restarts the pane"
-category: Lane
-tags: [lane, handoff, swap, ctx, lane-collision-protocol]
----
-
-**Invoke the `handoff` skill now and follow every step of it, in order, to the end.**
-
-That is the whole of this command, and the arguments typed after `/handoff` are its `why` and its flags:
-
-- `/handoff [why]` — the swap, the reset, the profile switch. The why is free text: `clear`, `reset`,
-  `switch`, `handoff to <who>`.
-- `/handoff --restart` — the same act with the restart attached. `/ctx` is its short name and runs the same
-  skill: the record first, then the lane's own pane respawned through the launcher with this handoff's top
-  block as the new session's first prompt (Amendment 17(f)).
-- `/handoff --exit requested by <uuid>@<host>/<container>` — the handoff another place requested: the record,
-  then `/exit` typed into this lane's own pane, because a handoff to another place is a handoff and not a
-  restart (Amendment 18(d)).
-
-Lane-collision-protocol **Amendment 17(a)**, in force 2026-09-14T09:45:33Z: one act, three names, and
-`lane-handoff` on `PATH` for the same steps from a shell. The steps are not restated here — the skill is the
-single source of the act, and two copies of one procedure that must stay byte-equal is the rejected
-alternative.
diff --git a/commands/swap.md b/commands/swap.md
deleted file mode 100644
index 16fb573a..00000000
--- a/commands/swap.md
+++ /dev/null
@@ -1,17 +0,0 @@
----
-name: "Swap"
-description: "/swap is the alias of /handoff: hand this lane off for a usage reset or profile switch"
-category: Lane
-tags: [lane, swap, handoff, ctx, lane-collision-protocol]
----
-
-**Invoke the `handoff` skill now and follow every step of it, in order, to the end.**
-
-That is the whole of this command. `/swap` is an alias (lane-collision-protocol Amendment 11 clause (g), SPEC
-§9, and Amendment 17(a), which renamed the act it points at): the canonical name is `handoff`, the skill is
-the single source of the act, and nothing here adds to, removes from, or reorders its steps. Two copies of
-one procedure that must stay byte-equal is the rejected alternative, so the steps are not restated here —
-read them there.
-
-`/handoff`, `/swap`, `/lane-swap` and the shell command `lane-handoff` are four doors to one act and write
-the same record. A context clear is that act with the restart attached: `/ctx`.
diff --git a/contracts/code-pin.yaml b/contracts/code-pin.yaml
new file mode 100644
index 00000000..f206584b
--- /dev/null
+++ b/contracts/code-pin.yaml
@@ -0,0 +1,42 @@
+schema_version: 1
+kind: pinned_contract_manifest
+
+# ===========================================================================
+# code-pin.yaml — the CODE leg, pinned by commit and digest.
+#
+# `kind: pinned_contract_manifest` is REUSED unchanged from the family's
+# ratified pin grammar; only the consumer is new. The trusted referent is
+# `commit` plus `digests.tree_sha256`. A tag MAY be recorded beside the commit
+# as a human-readable label, never as the thing being trusted, and a pin never
+# expresses a version range: the moment a pin trusts a range the fail-closed
+# property is gone.
+#
+# THIS FILE IS HALF OF ONE INVARIANT. The other halves are the GITLINK this
+# repository records at `submodule_path` and every `.github/workflows/*.yml`
+# reference of the form `<org>/<leg>/...@<sha>`. All three move in ONE commit.
+# `scripts/validate-pins.py` is the running code that says so.
+# ===========================================================================
+
+leg_role: code
+source_repository: opensoft/openRepoTools-code
+submodule_path: "code"
+
+commit: "2a057a6d84e58c8acb4bda20d2b7b667b552c3fe"
+revision_kind: commit
+
+digest_algorithm: sha256
+
+# WHAT IS DIGESTED, exactly. `sorted-ls-tree-r-v1`:
+#   records = `git ls-tree -r -z <commit>` split on NUL, empties dropped
+#   each record is `<mode> SP <type> SP <oid> TAB <path>`, path UNQUOTED
+#   sort the records bytewise ascending
+#   digest  = sha256(b"".join(record + b"\n" for record in records))
+# Mode is included, so a permission change is drift; the oid is included, so
+# any content change is drift; a nested submodule appears as `160000 commit
+# <oid>`, so a leg's own pin moving is drift too.
+digest_definition: sorted-ls-tree-r-v1
+digests:
+  tree_sha256: "31123e2d08efe36583e72956ed8b8dbbe4b968c75402b59af5b8952be83ef6d5"
+
+verify_pin: scripts/validate-pins.py
+resync_runbook: "README.md#the-lockstep-invariant"
diff --git a/contracts/openreposhape-pin.yaml b/contracts/openreposhape-pin.yaml
deleted file mode 100644
index eea57fb5..00000000
--- a/contracts/openreposhape-pin.yaml
+++ /dev/null
@@ -1,62 +0,0 @@
-schema_version: 1
-kind: pinned_contract_manifest
-
-# ===========================================================================
-# openreposhape-pin.yaml — the openRepoShape revision this repository's tests
-# were verified against, MOUNTED as a git submodule at upstream/openRepoShape.
-#
-# MOUNTED, NOT COPIED, and the difference is the whole reason there is a
-# submodule here. `tests/test_park_resume_commands.py` builds real estates out
-# of EIGHT of the standard's own files — the assembly-root and family-root
-# Makefiles, their two `.gitignore`s, the two `bootstrap.py`s, `siblings.py` and
-# `scripts/repo_shape.py` — and a submodule hands those tests THE STANDARD'S
-# REAL BYTES at the commit below, rather than copies in this tree that could
-# have been edited into agreeing with a broken expectation. `shape-pin.yaml` in
-# a scaffolded project is the other half of the same grammar, for bytes a
-# consumer HOLDS; this is the half for bytes it MOUNTS.
-#
-# THE DEPENDENCY RUNS ONE WAY. Tools depend on the shape; the shape depends on
-# nothing. openRepoShape pins this repository nowhere and knows of it only
-# through one pointer line in its own `--install`. The reverse would make the
-# standard unbuildable without its tools, which is the arrangement
-# `shape-pin.yaml`'s own header spends a paragraph refusing.
-#
-# THIS FILE AND THE GITLINK ARE ONE INVARIANT, and they move in ONE COMMIT.
-# `tests/test_upstream_pin.py` is what says they still agree: it reads the
-# gitlink out of `git ls-tree HEAD` with no import from the submodule, so it
-# bites in a clone that never materialized it, and then — only where the
-# checkout IS there — recomputes `digests.tree_sha256` with the PINNED
-# CHECKOUT'S OWN `scripts/repo_shape.py`. So this repository carries no copy of
-# the standard's code, and the number is checked against the pinned commit's
-# own definition of what the number means.
-#
-# TO BUMP THE PIN, on purpose, from this repository's root:
-#
-#   git -C upstream/openRepoShape fetch origin
-#   git -C upstream/openRepoShape checkout <40 hex on that repository's main>
-#   python3 -c "import sys; sys.path.insert(0, 'upstream/openRepoShape/scripts'); from repo_shape import tree_digest; print(tree_digest('upstream/openRepoShape', 'HEAD'))"
-#   # then write that number into `digests.tree_sha256` and the commit into
-#   # `commit:`, and stage BOTH the pin and the gitlink together:
-#   git add contracts/openreposhape-pin.yaml upstream/openRepoShape
-#
-# THE DIGEST IS RECOMPUTED, NEVER ADJUSTED. A number edited to make the test
-# pass records this checkout as the upstream, which is the one thing the row is
-# for. A commit that is not on openRepoShape's `main` is not a pin either: that
-# repository squash-merges, so a branch commit is orphaned and the next
-# person's fetch of it 404s.
-# ===========================================================================
-
-pin_role: upstream-standard
-source_repository: opensoft/openRepoShape
-submodule_path: upstream/openRepoShape
-materialization: mounted
-
-commit: "190133d5e704e380c430f87ca9c4e31746de0012"
-revision_kind: commit
-
-digest_algorithm: sha256
-digest_definition: sorted-ls-tree-r-v1
-digests:
-  tree_sha256: "7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912"
-
-verify_pin: tests/test_upstream_pin.py
diff --git a/contracts/repository-naming.yaml b/contracts/repository-naming.yaml
new file mode 100644
index 00000000..a1ec4466
--- /dev/null
+++ b/contracts/repository-naming.yaml
@@ -0,0 +1,507 @@
+schema_version: 1
+kind: repository-naming-policy
+
+# ===========================================================================
+# repository-naming.yaml — the six live naming families, as DATA.
+#
+# WHY DATA AND NOT PROSE. A convention written only in a README is checked by
+# whoever remembers it. This file is read by `scripts/validate-repository-naming.py`,
+# which the scaffold runs BEFORE it creates anything and which a scaffolded
+# project's own pull-request gate runs over its manifest, so the convention is
+# refused rather than regretted.
+#
+# THE FAMILIES CONFER NOTHING. A name is a name. Nothing in this file grants
+# review authority, clearance eligibility, gate standing or lifecycle state
+# over the repository it classifies — that is the ratified doctrine of
+# `add-wallet-carried-review-authority` ("electing the schema changes no gate,
+# no floor, no grant, and no clearance eligibility") and this file is bound by
+# it. A consumer deriving a permission from a family id is defective.
+#
+# PRECEDENCE IS SEMANTIC, NOT COSMETIC — AND TWO KINDS OF FORM LIVE HERE.
+#
+# `neutral-product`, `install` and `workspace` are UNAMBIGUOUS BY
+# CONSTRUCTION: `open` in front, `-Install` behind, `-wip` behind. Nothing
+# else spells them, so they win outright and need nothing declared. Their
+# precedence is unchanged.
+#
+# THAT STAYS TRUE OF THE CLASSIFICATION, AND A NEUTRAL PRODUCT MAY STILL ELECT
+# THE SHAPE. Ruled by Brett Heap on 2026-09-05:
+#
+#     "elect the shape for both, follow the pin chain, no family yet"
+#
+# recorded on opensoft/openxFactory#656, for `openDox` and `openXdox`. The form
+# still WINS — `openDox` classifies as `neutral-product` and no declaration
+# moves it — and it ADDITIONALLY answers the `assembly` role the project
+# declares, where the name also satisfies the `project-leg/assembly` form
+# (`admits_declared_role:` in that family below). Electing confers nothing, so
+# `openDox` mounting `openDox-spec` and `openDox-code` is a fact about LAYOUT,
+# not a claim about neutrality — exactly the reasoning that already lets a
+# DECLARED domain descendant be an assembly root, further down. `install` is
+# admitted into no role and could not be: `<X>-Install` carries a hyphen, so it
+# satisfies no leg form to begin with, and stays refused as any leg.
+#
+# `domain-descendant` is not like that. `<Domainx><Product>` is a CLAIM OF
+# DESCENT, and a claim needs a REFERENT. Ruled by Brett Heap on 2026-09-02:
+#
+#     "Descendant only if it pins open<Product>."
+#
+# A name is classified as a domain descendant ONLY when the project declares a
+# pin on the matching `open<Product>` (see `referent:` in that family below).
+# Without that pin the project's DECLARED ROLE wins: the name is a valid
+# assembly root, and the fact that it ALSO matches the descendant form is
+# RECORDED in the manifest's `naming.also_matches` rather than thrown away.
+# With no declared role at all the name is reported as `project-leg/assembly`
+# with `also_matches: [domain-descendant]`.
+#
+# WHY. Every project in a `<Domainx>` family organisation hits the overlap.
+# `MedxSoft` holds `MedxEHR`, `MedxGlass`, `MedxScribe`; on the first real
+# pilot the scaffold refused `MedxScribe` as "domain-descendant, not the
+# assembly form of a project leg" — for a name that descends from nothing,
+# because no `opensoft/openScribe` exists. Reading a claim as a fact made an
+# ordinary project unscaffoldable in the one organisation shaped to have many.
+#
+# THE CHECK STAYS OFFLINE. The referent is a PIN THE PROJECT DECLARES, which is
+# a fact in its own tree; classification never asks GitHub whether
+# `open<Product>` exists. A rule that needed the network would be unrunnable
+# in the fork-and-run case this whole standard is built for.
+#
+# THE REFERENT MAY BE REACHED THROUGH A CHAIN OF PINS. Ruled by Brett Heap on
+# 2026-09-05: "elect the shape for both, follow the pin chain, no family yet".
+# A product split into two layers is pinned by its descendants at the LAYER —
+# `codexDox` pins `openXdox`, `openXdox` pins `openDox` — so the referent is
+# reached through the chain rather than directly. The chain is RECORDED in the
+# descendant's own manifest (`naming.referent_chain:`), never inferred; a
+# DIRECT pin stays sufficient and is unchanged; and a link whose tree cannot
+# be read is reported as `declared-unverified`, never as a failure, because
+# the check stays offline. The rule is data, in `referent.chain:` below.
+#
+# `matches()` and `--explain` still report every form a name satisfies, so an
+# overlap stays visible instead of being silently resolved.
+#
+# A DESCENDANT MAY CARRY LEGS. Ruled by Brett Heap on 2026-09-02, in the same
+# breath as the referent rule: being a descendant and being a three-repository
+# project are INDEPENDENT facts. `MedxGlass` descends from `openGlass` AND is
+# the assembly root that mounts `MedxGlass-spec` and `MedxGlass-code`. The
+# descendant family therefore declares no roles of its own but ADMITS the
+# declared `assembly` role (`admits_declared_role:` below), so
+# `form: domain-descendant, role: assembly, referent_declared: true` is a
+# VALID classification for an assembly root. Reading the two rulings as
+# exclusive would have forced every declared descendant into a one-repository
+# project, which neither ruling says.
+#
+# A FIFTH FORM ARRIVED THE SAME WAY, ON 2026-09-04: `family`, a HOLDER that
+# pins other projects' assembly roots. It is spelled exactly like an assembly
+# root and is therefore DECLARED-ONLY (`declared_only: true`): the classifier
+# reports it only when the reader says which question is being asked, so
+# adding it changed no existing name's answer and no existing manifest's
+# `also_matches`. See that family's own block for the ruling.
+#
+# A SIXTH FORM ARRIVED ON 2026-09-10, AND IT IS NOT A REPOSITORY OF A PROJECT
+# AT ALL: `workspace`, `<user>-wip`, the PRIVATE repository one person owns to
+# index their own unfinished work. Ruled by Brett Heap on 2026-09-09
+# (openRepoShape#81): "if we have brett and scott as engineers, then we need
+# something like brett-wip and scott-wip right?" It is UNAMBIGUOUS BY
+# CONSTRUCTION rather than declared-only — the literal `-wip` suffix is
+# spelled by no other form here — so it needs no `--role`, and it changed no
+# existing name's answer for a different reason than `family` did: no form
+# above admits a `-wip` suffix at all, so the names it classifies are names
+# that matched NOTHING before. See that family's own block for where such a
+# repository lives, and for the fact that nothing in this standard creates
+# one.
+#
+# THE ASSEMBLY-ROOT FORM IS THE RESIDUAL CLASS, deliberately. A bare CamelCase
+# token is the widest form here and sits last on purpose: the staged fragment
+# records that two live repositories (`xFactory-Installer`, `AgentTower`) fit
+# no suffix rule at all, so this is a FORWARD rule and the residual class is
+# where an unsuffixed name lands. What it does NOT admit is a name with a
+# hyphen, an underscore, a dot or a space — those match nothing and are
+# refused, which is the check that actually earns its keep.
+# ===========================================================================
+
+families:
+  - id: neutral-product
+    precedence: 1
+    title: Neutral product
+    pattern: "^open(?:[A-Z]|x[A-Z])[A-Za-z0-9]*$"
+    description: >-
+      A domain-neutral product repository: `open` followed by the product
+      name. The character after `open` is uppercase, or the lowercase `x` of
+      an x-stem followed by an uppercase letter — which is what keeps the
+      organisation login `opensoft` from reading as a product.
+    # The roles a neutral product may ADDITIONALLY answer in. The family has
+    # no `roles:` of its own — `openDox` and `openDox-spec` are not the same
+    # form — but a neutral product that has ELECTED the three-repository shape
+    # is the repository an engineer clones, and answers as its own assembly
+    # root. Ruled by Brett Heap on 2026-09-05, "elect the shape for both,
+    # follow the pin chain, no family yet" (opensoft/openxFactory#656), for
+    # `openDox` and `openXdox`.
+    #
+    # WHY THIS TAKES NOTHING AWAY. Electing confers nothing — the doctrine's
+    # first sentence, and the first paragraph of this file — so `openDox`
+    # mounting `openDox-spec` and `openDox-code` is a fact about LAYOUT and
+    # not a claim about neutrality. The form still wins the classification:
+    # `form: neutral-product` with `also_matches: [project-leg/assembly]`, so
+    # the overlap is RECORDED rather than resolved into a leg. It is the same
+    # move `domain-descendant` already makes below, for the same reason: being
+    # a neutral product and being a three-repository project are INDEPENDENT
+    # facts, and reading them as exclusive made `openDox` unscaffoldable.
+    #
+    # `spec` and `code` are absent on purpose, exactly as they are for the
+    # descendant family: `openDox-spec` carries the lowercase suffix, matches
+    # this family's pattern not at all, and is an ordinary project leg.
+    #
+    # ELECTING ALSO MAKES THE NAME AN ID SOURCE, for the first time. The
+    # project id and topic are both derived by LOWERCASING the assembly
+    # root's name (`--id`'s default), so `openXdox` and `openxDox` — two
+    # admitted spellings — derive the SAME id `openxdox` and the same topic
+    # `xf-project-openxdox`. Before 2026-09-05 no id was ever derived from a
+    # neutral-product name at all, so this collision is newly reachable, not
+    # a pre-existing one: pass an explicit `--id` when two such products must
+    # coexist. Where the three agreeing layers of grouping (names, topics,
+    # register) disagree, the register wins and the others are reported as
+    # drift, because the register is the only one of the three that is
+    # reviewed.
+    admits_declared_role:
+      - assembly
+    examples:
+      - openxFactory
+      - openXwallet
+      - openChart
+      # Elected the shape on 2026-09-05 and are their own assembly roots. The
+      # names classify here whether or not a role is declared; what the
+      # election adds is the role, never the form.
+      - openDox
+      - openXdox
+    counter_examples:
+      - opensoft
+      - OpenChart
+
+  - id: install
+    precedence: 2
+    title: Install
+    pattern: "^[A-Za-z][A-Za-z0-9]*(?:-[A-Za-z0-9]+)*-Install$"
+    description: >-
+      A deployable install or runtime repository, ending in the CamelCase
+      suffix `-Install`. The stem may itself be hyphenated, which is how one
+      product's install is qualified by the layer that owns it.
+    # NO `admits_declared_role:`, and it is not an oversight. `<X>-Install`
+    # carries a hyphen, so it satisfies no `project-leg` form at all — there is
+    # no role for it to be admitted into, and it stays refused as an assembly,
+    # spec or code leg exactly as it was before 2026-09-05.
+    examples:
+      - xFactory-Hermes-Install
+      - Hermes-Install
+      - Keycloak-Install
+    counter_examples:
+      - hermes-install
+      - Keycloak-Installer
+
+  - id: domain-descendant
+    precedence: 3
+    title: Domain descendant
+    pattern: "^[A-Za-z][A-Za-z0-9]*x[A-Z][A-Za-z0-9]*$"
+    # THE FORM IS A CLAIM; THE PIN IS THE REFERENT. Matching the pattern is
+    # necessary and NOT sufficient: the classifier returns this family only
+    # when the project declares a pin on the neutral product below. This is
+    # the one family here whose membership is not decided by the characters
+    # alone, which is why it is the one family that carries `referent:`.
+    requires_referent: true
+    # The roles a DECLARED descendant may additionally answer in. The family
+    # has no `roles:` of its own — `MedxGlass` and `MedxGlass-spec` are not
+    # the same form — but a descendant that IS the repository an engineer
+    # clones answers as the assembly root, which is what lets a descendant
+    # carry legs. `spec` and `code` are absent on purpose: those names carry
+    # the lowercase suffix and are ordinary project legs, descendants of
+    # nothing.
+    admits_declared_role:
+      - assembly
+    referent:
+      # `MedxChart` -> product `Chart` -> `openChart`. The stem is greedy, so
+      # a name with two `x<Upper>` splits is read at the rightmost one.
+      split_pattern: "^(?P<stem>[A-Za-z][A-Za-z0-9]*)x(?P<product>[A-Z][A-Za-z0-9]*)$"
+      canonical_template: "open{product}"
+      # The neutral family admits an x-stem of its own (`openxFactory`), and
+      # `codexFactory` descends from exactly that, so the x-stem spelling of
+      # the referent counts too. Refusing it would be a spelling rule wearing
+      # the costume of a semantic one.
+      also_accepted:
+        - "openx{product}"
+      declared_by: >-
+        A pin the project declares on the neutral product — in a scaffolded
+        project, `contracts/<referent lowercased>-pin.yaml`, listed in
+        `project.yaml`'s `neutral_product_pins:`. It is a fact in the
+        project's own tree, so the check needs no network.
+      # THE REFERENT MAY BE REACHED THROUGH A CHAIN OF PINS. Ruled by Brett
+      # Heap on 2026-09-05:
+      #
+      #     "elect the shape for both, follow the pin chain, no family yet"
+      #
+      # recorded on opensoft/openxFactory#656. A neutral product split into
+      # two layers splits the referent with it: `openDox` is the core product
+      # and `openXdox` is the openxFactory-tuned layer, and the descendants
+      # pin `openXdox` ALONE — one pin chain, no direct `openDox` pin inside
+      # the family. Read as a DIRECT pin only, `codexDox`'s route to `openDox`
+      # is declared nowhere: the referent is derived from the NAME, `openXdox`
+      # is a neutral product in its own right, and `--explain codexDox` says
+      # so — *a CLAIM: needs a declared pin on openDox or openxDox*. What
+      # saves the answer today is a CASE-FOLDING COINCIDENCE and nothing else:
+      # `openXdox` casefolds onto the accepted x-stem spelling `openxDox`, so
+      # the classifier accepts a pin on the layer as if it were a pin on a
+      # product nobody has ever named. It holds for this family's spelling and
+      # for no other — a third link, or a layer named anything else, reaches
+      # nothing at all — and an accident is not a rule. `LedgerxWallet ->
+      # openXwallet -> openWallet` is the same shape, and `openWallet` has no
+      # repository at all yet.
+      #
+      # THE CHAIN IS RECORDED, NOT INFERRED. The descendant's own manifest
+      # carries the chain it relies on. Its FIRST entry is what this project
+      # actually pins and must be in its `neutral_product_pins:`; its LAST
+      # must be one of the referents above; each link beyond the first is a
+      # declaration in ANOTHER tree — `openXdox`'s own manifest declaring
+      # `neutral_product_pins: [openDox]`. Inferring the chain would mean
+      # walking repositories nobody named, which is a lookup, not a fact.
+      #
+      # A DIRECT PIN IS STILL SUFFICIENT. This is an ADDITION: `MedxChart`
+      # pinning `openChart` answers exactly as it did on 2026-09-02, and a
+      # project that records no chain is classified exactly as before.
+      #
+      # THE CHECK STAYS OFFLINE (2026-09-02, unchanged). A recorded chain is a
+      # fact in the descendant's own tree, so classification still never asks
+      # a host whether `openDox` — or `openWallet`, which need not exist at
+      # all — is there. A link whose tree IS reachable (a sibling checkout,
+      # `SHAPE_PIN_SOURCE_<PRODUCT>`, or an explicit `--link-source`) is
+      # VERIFIED against that tree's own declaration; a link whose tree is not
+      # reachable is reported as `declared-unverified` and the name STILL
+      # classifies as a descendant. Failing there would make the answer depend
+      # on which trees happen to be on the disk, which is the network
+      # dependency wearing a different coat. A link that is reachable and
+      # declares something else is BROKEN: the residual assembly-root reading
+      # wins, the overlap is recorded, and the message names the link.
+      chain:
+        # Where the chain is recorded, in the descendant's own manifest.
+        record_field: naming.referent_chain
+        # The key read in a LINK's manifest to verify that link.
+        link_declared_by: neutral_product_pins
+        # A recorded chain longer than this is refused as broken rather than
+        # walked: a chain nobody can hold in their head is not a declaration.
+        max_length: 8
+        # What a link whose tree could not be read is reported as. It is a
+        # WARNING, never a finding, and never changes the classification.
+        unverified_status: declared-unverified
+      # The worked cases, as `<descendant>: [<the pin it holds>, …, <the
+      # referent it reaches>]`. Neither row asserts that anything exists: the
+      # chain is a declaration, and `openWallet` has no repository yet.
+      example_chains:
+        codexDox: [openXdox, openDox]
+        LedgerxWallet: [openXwallet, openWallet]
+    description: >-
+      A domain's descendant of a live product: an `x`-terminated domain stem
+      immediately in front of the product name, AND a declared pin on that
+      product. The stem's own first letter may be lowercase, which
+      `codexFactory` already spends.
+    # Each example is a descendant BECAUSE of the referent beside it, not
+    # because of how it is spelled. `MedxChart` is a descendant because
+    # MedxChart pins `openChart`; strip that pin and the same name is an
+    # ordinary assembly root that also matches this form. An example with no
+    # row here has one in `example_chains:` instead — it reaches its referent
+    # through a chain rather than directly, which is the 2026-09-05 addition.
+    example_referents:
+      MedxChart: openChart
+      LedgerxWallet: openWallet
+      codexFactory: openxFactory
+      # A descendant that is ALSO an assembly root with two legs. Both facts
+      # at once is the case `admits_declared_role:` above exists for.
+      MedxGlass: openGlass
+    examples:
+      - MedxChart
+      - LedgerxWallet
+      - codexFactory
+      - MedxGlass
+      # Reached through a chain, not a direct pin: `codexDox` pins `openXdox`
+      # and `openXdox` pins `openDox` (2026-09-05).
+      - codexDox
+    # These do not even reach the referent question: they fail the pattern.
+    counter_examples:
+      - MedChart
+      - Medx
+    # And this one passes the pattern and is still NOT a descendant, because
+    # nothing named `openScribe` is pinned. It is the pilot case, kept in the
+    # data so the rule is testable from the contract rather than from memory.
+    claim_without_referent_examples:
+      - MedxScribe
+
+  - id: project-leg
+    precedence: 4
+    title: Project leg
+    pattern: "^[A-Za-z][A-Za-z0-9]*(?:-spec|-code)?$"
+    description: >-
+      One repository of a project that has elected the three-repository shape.
+      The suffixes are fixed LOWERCASE and hyphenated precisely so they sit in
+      a different visual class from every family above, all of which are
+      CamelCase words; the assembly root is bare, following the precedent the
+      aggregation root already sets — the thing you clone has no suffix.
+    roles:
+      - id: assembly
+        pattern: "^[A-Za-z][A-Za-z0-9]*$"
+        description: >-
+          The per-project ROOT repository, the one an engineer clones. It
+          carries `project.yaml`, the two legs as submodules, and the pins.
+        examples:
+          - Atlas
+          - Northwind
+      - id: spec
+        pattern: "^[A-Za-z][A-Za-z0-9]*-spec$"
+        description: The project's specification leg, mounted at `spec/`.
+        examples:
+          - Atlas-spec
+          - Northwind-spec
+      - id: code
+        pattern: "^[A-Za-z][A-Za-z0-9]*-code$"
+        description: The project's implementation leg, mounted at `code/`.
+        examples:
+          - Atlas-code
+          - Northwind-code
+    examples:
+      - Atlas
+      - Atlas-spec
+      - Atlas-code
+    counter_examples:
+      - Atlas-SPEC
+      - Atlas_spec
+      - Atlas-tests
+
+  - id: family
+    precedence: 5
+    title: Family holder
+    pattern: "^[A-Za-z][A-Za-z0-9]*$"
+    # DECLARED-ONLY, and for the same reason the descendant form is: the
+    # characters cannot tell you. `InkRouter` is spelled exactly like an
+    # assembly root, because it IS one CamelCase token — what makes it a
+    # family is `family.yaml` in its own tree, which is a fact, not a
+    # spelling. So this form is reported only when the reader DECLARES it
+    # (`--role family`, or `validate-family.py`, which reads the manifest that
+    # settles it). Left undeclared, `InkRouter` classifies as the assembly
+    # root it also looks like, and nothing about any existing project's
+    # `also_matches` changes — which is the property that let this form be
+    # added to a policy two live projects already carry a copy of.
+    declared_only: true
+    declared_by: >-
+      `family.yaml` at the root of the repository — `kind: family-manifest`,
+      naming the members it pins. A holder with no manifest is not a family.
+    description: >-
+      A HOLDER, not a project: a repository that pins other projects' assembly
+      roots as submodules under `members/` and carries the utilities to fetch
+      and bootstrap them together. Ruled by Brett Heap on 2026-09-04, for
+      InkRouter: "InkRouter is only something that can download all the others
+      easily? like a holder folder and some utilities for the family of
+      services." It has no spec or code leg of its own and confers nothing —
+      membership is navigation, exactly as the three legs are.
+    # Below the leg forms on purpose. A bare CamelCase token is an assembly
+    # root unless something says otherwise, because that is the overwhelmingly
+    # commoner case and the residual class should be the common one.
+    examples:
+      - InkRouter
+      - Northwind
+    counter_examples:
+      - InkRouter-spec
+      - ink-router
+
+  - id: workspace
+    precedence: 6
+    title: Workspace
+    pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*-wip$"
+    # UNAMBIGUOUS BY CONSTRUCTION, exactly as `<X>-Install` is, and therefore
+    # NOT declared-only. The literal lowercase suffix `-wip` is spelled by no
+    # other form in this file: the leg suffixes are `-spec` and `-code`, the
+    # install suffix is the CamelCase `-Install`, and every other family is one
+    # unhyphenated token. So this form needs NOTHING DECLARED — no `--role`,
+    # no pin, no manifest — and that is also what let it be added to a policy
+    # several live projects already carry a copy of: no name that classified
+    # before this form existed classifies differently now, and no manifest's
+    # `also_matches` widened, because no form above admits a `-wip` suffix at
+    # all. `brett-wip` matched NOTHING before; a name of that spelling is the
+    # only kind whose answer this addition changes.
+    #
+    # `<user>` IS THE GITHUB LOGIN, LOWERCASED — what `gh api user -q .login`
+    # returns and what a `Lane:` header already carries (openRepoShape#81,
+    # open decision 2, taken as its own recommendation on 2026-09-10). The
+    # pattern is lowercase-only and admits a single hyphen INSIDE the login,
+    # because a login may carry one and may not double it, begin with one or
+    # end with one; the login's length bound is GitHub's and is not restated
+    # here.
+    description: >-
+      The PRIVATE repository one person owns and only that person writes:
+      their index of unfinished work. It holds the workspace manifests
+      `speckit park` writes and `resume` reads
+      (`workspaces/<org>/<Family|Project>.yaml`) and the handoff documents a
+      LATER session picks the work up from (`handoffs/<estate>/…`), which is
+      the home the lane-collision protocol's Amendment 4 gives them. It is
+      NOT a project, not a leg and not a family: it holds no code, elects
+      nothing, is membership of nothing, and — like every other name in this
+      file — confers nothing.
+    # WHERE IT LIVES, AND WHY THERE. Ruled by Brett Heap on 2026-09-09
+    # (openRepoShape#81, rulings 1 to 3): ONE repository per person, private,
+    # org-owned rather than personal-account so the index survives
+    # offboarding and a later lane can read the handoffs — the same placement
+    # Amendment 3 already gave the lane registry. By DEFAULT it sits in that
+    # person's HOME organisation and indexes work in every organisation, a
+    # folder per org inside it; an organisation whose work must not be indexed
+    # outside it, even by name, is pointed at its own `<org>/<user>-wip` by
+    # the opt-in `orgs:` map in `~/.agents/workspace.yaml`. Which repository
+    # holds somebody's unfinished work is THEIRS to name, so the path is
+    # declared there and in no project's tree.
+    #
+    # NOTHING IN THIS STANDARD CREATES ONE (openRepoShape#81, open decision 1,
+    # taken as its own recommendation on 2026-09-10). This form is CLASSIFIED
+    # and DOCUMENTED here and scaffolded by nothing: no tool in this
+    # repository makes a `<user>-wip` repository, and the form is admitted
+    # into no role, so a `<user>-wip` name offered as an assembly root is
+    # refused exactly as it was before — with the name's own form in the
+    # refusal now, rather than "matches no family". A person creates their
+    # own, by hand, and names it once.
+    examples:
+      - brett-wip
+      - scott-wip
+      - a1-wip
+    counter_examples:
+      - Brett-wip
+      - brett-WIP
+      - brett_wip
+      - brett--wip
+      - brett-wip-2
+      - wip
+
+# The GitHub topic every repository of a project carries, so the organisation's
+# own search surfaces the group without a checkout. It is the SECOND of the
+# three agreeing layers of grouping (names, topics, register); where they
+# disagree the register wins and the others are reported as drift, because the
+# register is the only one of the three that is reviewed.
+topic:
+  template: "xf-project-{id}"
+  pattern: "^xf-project-[a-z0-9][a-z0-9-]*$"
+  id_pattern: "^[a-z0-9][a-z0-9-]*$"
+  description: >-
+    `xf-project-<id>` where `<id>` is the project's lowercase id, which is the
+    same id an aggregation's `project-register.yaml` row uses.
+  examples:
+    - xf-project-atlas
+    - xf-project-northwind
+
+# The NEGATIVE half of the policy, as data rather than as an assumption.
+# `counter_examples` above say "not THIS family" — several of them still land
+# in the residual assembly-root class, which is the honest reading. These names
+# match NO family at all and are what `validate-repository-naming.py` exits
+# non-zero on.
+unclassified_examples:
+  - Atlas_spec
+  - Atlas-tests
+  - hermes-install
+  - Keycloak-Installer
+  - xFactory-Installer
+  - 9Lives
+  - "Atlas spec"
+  # The `<user>-wip` near-misses (2026-09-10). A doubled hyphen is not a
+  # login, and `-wip` is a SUFFIX rather than an infix, so neither of these
+  # is a workspace — and neither is anything else either.
+  - brett--wip
+  - brett-wip-2
diff --git a/contracts/shape-pin.yaml b/contracts/shape-pin.yaml
new file mode 100644
index 00000000..9e86a52c
--- /dev/null
+++ b/contracts/shape-pin.yaml
@@ -0,0 +1,64 @@
+schema_version: 1
+kind: pinned_contract_manifest
+
+# ===========================================================================
+# shape-pin.yaml — the openRepoShape revision this project was cut from.
+#
+# A COPY PIN, NOT A SUBMODULE PIN, and the difference is deliberate.
+# openRepoShape is not mounted here: the scaffold COPIED a small set of files
+# out of it — the naming policy, the shared library, the three validators, the
+# bootstrap, the Makefile and the pull-request workflow — so that a project in
+# an organisation that never obtains the upstream is still self-contained and
+# still runs its own gate. There is therefore no gitlink to compare, and the
+# identity of what was copied is carried by the per-file `sha256` rows below.
+# That is exactly the half of the family's pin grammar that exists for
+# artifacts a consumer HOLDS rather than MOUNTS; `commit` and
+# `digests.tree_sha256` record the upstream revision those bytes came from, so
+# a later reader can say which openRepoShape this project is a copy of.
+#
+# EDITING A COPIED FILE IS DRIFT AND IS REPORTED AS SUCH.
+# `scripts/validate-pins.py` recomputes every `sha256` below on every pull
+# request. The exit from a drift finding is to carry the change UPSTREAM to
+# openRepoShape and re-scaffold or re-pin — not to update the digest in place,
+# which would record the fork as the standard.
+# ===========================================================================
+
+pin_role: shape
+source_repository: opensoft/openRepoShape
+materialization: copied
+
+commit: "190133d5e704e380c430f87ca9c4e31746de0012"
+revision_kind: commit
+
+digest_algorithm: sha256
+digest_definition: sorted-ls-tree-r-v1
+digests:
+  tree_sha256: "7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912"
+
+verify_pin: scripts/validate-pins.py
+
+# The copies that live in THIS repository, each with the sha256 of its bytes
+# as written by the scaffold. Written by `scaffold-project.py`; do not hand-edit.
+files:
+  - path: scripts/validate-pins.py
+    sha256: "09820c5dd29355bdbbd3c82bb6197f31e7a0a234e8beaaa5940862d09c32597f"
+  - path: scripts/validate-manifest.py
+    sha256: "7f36200f55562ab3e9588c00aaaefb0763b74f979b07d4688b70be38b1236adc"
+  - path: scripts/bootstrap.py
+    sha256: "d2bd1cfc8515088980df66c8adda3fdaea908e7e2eba6f94062c1b9e65610995"
+  - path: Makefile
+    sha256: "6d65dd06e12564a7c018a72a5a2e3c80b999d7026ce5643e77ca8dd6e9254dfa"
+  - path: shape/.gitignore
+    sha256: "00256b4fddd74373bd31f7726469936deee31f171515a2e0e1b2364a5c543223"
+  - path: shape/.gitattributes
+    sha256: "e2b88cf25928c5a58bb2acaae1779d934c262273db708d0aa6dfb01591b15baa"
+  - path: .github/workflows/validate.yml
+    sha256: "fb8c0360863ad953af7825f3be01ed27f8cf1269e5cab19dc0d6c5423161b487"
+  - path: AGENTS-shape.md
+    sha256: "84f8bf1afb83d7cd5bd556f81a3bfc01319f00ff87c33a95e98cf5d1fada5fee"
+  - path: scripts/repo_shape.py
+    sha256: "be5358aad1384f723e321bb089e1c04bfb552157f922554e9f872fae9372a904"
+  - path: scripts/validate-repository-naming.py
+    sha256: "527273cf0b8ada97166c7d60e2247c2a44e16983bf643843936ce92b19bb0f68"
+  - path: contracts/repository-naming.yaml
+    sha256: "a4eebad21541cbfe9a3e94a0ee667a2d5a7866c3567eea2a000d8339f6f096a4"
diff --git a/contracts/spec-pin.yaml b/contracts/spec-pin.yaml
new file mode 100644
index 00000000..fc595d9d
--- /dev/null
+++ b/contracts/spec-pin.yaml
@@ -0,0 +1,42 @@
+schema_version: 1
+kind: pinned_contract_manifest
+
+# ===========================================================================
+# spec-pin.yaml — the SPEC leg, pinned by commit and digest.
+#
+# `kind: pinned_contract_manifest` is REUSED unchanged from the family's
+# ratified pin grammar; only the consumer is new. The trusted referent is
+# `commit` plus `digests.tree_sha256`. A tag MAY be recorded beside the commit
+# as a human-readable label, never as the thing being trusted, and a pin never
+# expresses a version range: the moment a pin trusts a range the fail-closed
+# property is gone.
+#
+# THIS FILE IS HALF OF ONE INVARIANT. The other halves are the GITLINK this
+# repository records at `submodule_path` and every `.github/workflows/*.yml`
+# reference of the form `<org>/<leg>/...@<sha>`. All three move in ONE commit.
+# `scripts/validate-pins.py` is the running code that says so.
+# ===========================================================================
+
+leg_role: spec
+source_repository: opensoft/openRepoTools-spec
+submodule_path: "spec"
+
+commit: "64a1a989fe7b04daf3bc2a236739a01f0aa7291a"
+revision_kind: commit
+
+digest_algorithm: sha256
+
+# WHAT IS DIGESTED, exactly. `sorted-ls-tree-r-v1`:
+#   records = `git ls-tree -r -z <commit>` split on NUL, empties dropped
+#   each record is `<mode> SP <type> SP <oid> TAB <path>`, path UNQUOTED
+#   sort the records bytewise ascending
+#   digest  = sha256(b"".join(record + b"\n" for record in records))
+# Mode is included, so a permission change is drift; the oid is included, so
+# any content change is drift; a nested submodule appears as `160000 commit
+# <oid>`, so a leg's own pin moving is drift too.
+digest_definition: sorted-ls-tree-r-v1
+digests:
+  tree_sha256: "0aa2803cf44fc7494369144ff85aa93d79ac713314ea0c9fdcbfdb3ced1fb055"
+
+verify_pin: scripts/validate-pins.py
+resync_runbook: "README.md#the-lockstep-invariant"
diff --git a/docs/README-claude-current.md b/docs/README-claude-current.md
deleted file mode 100644
index 57933215..00000000
--- a/docs/README-claude-current.md
+++ /dev/null
@@ -1,285 +0,0 @@
-# `claude-current` and `claude-restart-check`
-
-Two commands `openRepoTools --install` places in `~/.local/bin` beside
-`lane-start`, since opensoft/workBenches#119:
-
-- **`claude-current`** answers which Claude Code a launch should start: the
-  version npm publishes, updated first when every installed copy is behind,
-  checked with `--version`, and named by an absolute path. `lane-start` calls
-  it, and so does workBenches' `claude-profile`.
-- **`claude-restart-check`** prints one green `RESTART NEEDED` line when a
-  running session's Claude Code has been replaced on disk. workBenches' shared
-  status line prints that line.
-
-Brett Heap ruled on #119 on 2026-09-29. The home ruling, verbatim *"this work
-is really for openRepoTools repo"*, puts both commands here. Point 2, verbatim
-*"for 2, we can run update on every start, this ensures we have the latest
-models"*, is why every launch runs the check. The workBenches side is the
-ratified OpenSpec change `launch-current-claude` (opensoft/workBenches#120).
-
-## Why
-
-A lane started on an old Claude Code, and nothing noticed. Two npm installs
-competed on `PATH`: the image's root-owned copy, frozen when the image was
-built, and the user's own `~/.npm-global` copy. Which one a lane got depended
-on the shell that launched it. A session loads the served model catalog when it
-starts, so a session that ran 2.1.283 for twenty hours did not list a model
-that a fresh `claude` on the same account listed. The same session kept running
-the binary npm had replaced under it, and nothing told it to restart.
-
-## `claude-current`
-
-```sh
-claude-current                 # the absolute path, one line on stdout
-claude-current --porcelain     # path=, version=, published=, status=
-claude-current --offline       # no npm read and no update: newest installed
-```
-
-It never resolves `claude` through `PATH`. It reads these candidates by
-absolute path, in this order, and runs each one's `--version`:
-
-1. the newest native version in `~/.local/share/claude/versions`, by its
-   x.y.z name (workBenches #109's ordering), whose `--version` answers. A
-   newer file that does not run, or does not answer within
-   `$CLAUDE_CURRENT_VERSION_TIMEOUT`, gives way to the next one that does, so
-   a broken download cannot hide a working install. A file that failed is not
-   read again in the same run, unless `claude update` has run or this launch
-   has waited for the lock, either of which may have rewritten it;
-2. `<user npm prefix>/bin/claude`. The prefix is `$CLAUDE_CURRENT_NPM_PREFIX`,
-   else `$NPM_CONFIG_PREFIX`, else `$npm_config_prefix`, else the `prefix=`
-   line of `~/.npmrc`, else `~/.npm-global`. A relative prefix is taken under
-   `$HOME`, so the path npm installs into is the path read back;
-3. `~/.local/bin/claude`;
-4. the image's copies, `/usr/local/bin/claude` and `/usr/bin/claude`
-   (`$CLAUDE_CURRENT_SYSTEM_CANDIDATES`, colon-separated; set it empty for
-   none).
-
-A path that resolves to a file already read is read once, under its first
-spelling, which is the user-writable one.
-
-It then asks npm, bounded by `$CLAUDE_CURRENT_TIMEOUT` seconds:
-`npm view @anthropic-ai/claude-code version --prefer-online`.
-
-| What it finds | What it answers | `status` |
-|---|---|---|
-| a candidate at npm's version | the first such candidate | `verified` |
-| none equal, one newer than npm | the newest newer one | `ahead` |
-| npm could not be read | the newest candidate, and says `UNVERIFIED` | `unverified` |
-| every candidate behind npm, or none installed | it updates, then reads again (below) | |
-| still behind after the update | exit 2, a refusal naming the fix | |
-| still behind, `CLAUDE_ALLOW_STALE=1` | the newest candidate, and says `STALE` | `stale` |
-
-An equal candidate beats a newer one. `ahead` is a launch, not a refusal.
-"Newer" is SemVer's order, in both commands alike: numeric on x.y.z, a
-release above its own pre-releases, and pre-release identifiers compared
-one by one, numbers as numbers (`beta.9` before `beta.10`) and words in byte
-order. Build metadata after a `+` is ignored.
-
-**The update runs under a lock** at
-`${XDG_CACHE_HOME:-~/.cache}/openrepotools/claude-current.lock.l`, the same one
-for every launch whatever its `PATH` holds (`flock` is never used, so two
-launches can never hold two different locks): a symlink whose text names its
-owner, `pid=<pid>@<place>`. One `ln -s` makes that lock and names its owner,
-so no lock is ever left without one. `<place>` is the host's name and, on
-Linux, the pid namespace's inode, because containers that share a home share
-the lock and a pid from another namespace says nothing about its owner. A lock
-made at another place is waited on and never taken over, and the refusal names
-its owner and place. A lock made here whose owner has died is taken over, by
-one launch only: the one that holds a second directory, the reaper, while it
-reads the owner again.
-After it takes the lock it reads the candidates again, because another launch
-may have updated while it waited. A lock it cannot take within
-`CLAUDE_CURRENT_LOCK_WAIT` seconds is a refusal, unless that other launch's
-update has already produced npm's version. A native install that runs gets
-`claude update`. When that does not reach npm's version, or there is no
-native install that runs, it runs
-`npm install -g --prefix <user prefix> @anthropic-ai/claude-code@<published>`.
-If `--version` still differs after that, it runs the package's own
-`install.cjs` with `node`. npm 12's install-script policy skips that hook, so
-until it runs the launcher npm links can be a stub. The shared image runs the
-same hook by hand. Everything an update prints goes to stderr.
-
-**Output.** stdout carries the path, or with `--porcelain` exactly four lines:
-
-```text
-path=<absolute path>
-version=<x.y.z>
-published=<x.y.z, or empty when npm could not be read>
-status=<verified|ahead|unverified|stale>
-```
-
-stderr carries one line saying what was chosen, for example
-`claude-current: claude 2.1.284 (verified against npm 2.1.284) at <path>`.
-A refusal prints nothing on stdout.
-
-**Exit.** 0 resolved; 1 no runnable Claude Code at all; 2 refused, because
-every candidate is still behind npm after the update; 64 usage, including a
-`CLAUDE_CURRENT_*` bound that is not a whole number of seconds. 64 is kept
-apart from 1 because a launcher reports 1 as "no Claude Code".
-
-| Variable | Default | What it is |
-|---|---|---|
-| `CLAUDE_ALLOW_STALE` | unset | `1` answers with a stale copy instead of refusing, and says `STALE` |
-| `CLAUDE_CURRENT_NPM` | `npm` | the npm to run |
-| `CLAUDE_CURRENT_NODE` | `node` | the node that runs `install.cjs` |
-| `CLAUDE_CURRENT_TIMEOUT` | `10` | seconds for `npm view` |
-| `CLAUDE_CURRENT_VERSION_TIMEOUT` | `10` | seconds for each `--version` |
-| `CLAUDE_CURRENT_UPDATE_TIMEOUT` | `300` | seconds for each update command |
-| `CLAUDE_CURRENT_LOCK_WAIT` | `330` | seconds to wait for another launch's update |
-| `CLAUDE_CURRENT_CACHE_DIR` | `${XDG_CACHE_HOME:-~/.cache}/openrepotools` | where the lock lives; relative overrides or `XDG_CACHE_HOME` paths are taken under `$HOME` |
-| `CLAUDE_CURRENT_NPM_PREFIX` | see candidate 2 | the user npm prefix, the one place an update writes |
-| `CLAUDE_CURRENT_NATIVE_DIR` | `~/.local/share/claude/versions` | the native versions directory |
-| `CLAUDE_CURRENT_SYSTEM_CANDIDATES` | `/usr/local/bin/claude:/usr/bin/claude` | the image's copies |
-
-The timeouts use `timeout`, else Homebrew's `gtimeout`, else a watchdog of its
-own, because a stock macOS ships neither. The watchdog starts the command in its
-own process group and signals that group, including children created by a TERM
-handler after the timeout, so a child npm started
-cannot hold the answer open past the bound. On every branch a command that
-ignores TERM is sent KILL five seconds later.
-
-## The hand-off
-
-A launcher that starts the path `claude-current` answered exports three
-variables to what it launches next:
-
-- `CLAUDE_BIN=<path>`
-- `CLAUDE_RESOLVED_BIN=<the same path>`
-- `CLAUDE_VERIFIED_VERSION=<version>`
-
-`CLAUDE_VERIFIED_VERSION` never reaches a running session. `lane-start` and
-`claude-profile` both remove it before they start one. `CLAUDE_BIN` and
-`CLAUDE_RESOLVED_BIN` may reach it, and that is what lets a later launch tell
-an inherited answer from an operator's pin:
-
-| The environment a launch finds | What it is | What the launch does |
-|---|---|---|
-| no `CLAUDE_BIN` | nothing chosen yet | resolves through `claude-current` |
-| `CLAUDE_BIN` = `CLAUDE_RESOLVED_BIN`, no `CLAUDE_VERIFIED_VERSION` | an earlier launch's answer, inherited from a session's environment | resolves again |
-| `CLAUDE_BIN` = `CLAUDE_RESOLVED_BIN` and `CLAUDE_VERIFIED_VERSION` | a launcher's answer, handed on | trusts it, and records the version |
-| any other `CLAUDE_BIN` | an operator's pin | launches it as it is, with no check |
-
-## `lane-start`
-
-`lane-start` applies that table after confirmation and any handoff approval.
-Resolution precedes a binding release, window rename or transcript move (and
-also runs in the bare launch described below):
-
-A binding held elsewhere must be approved for handoff before any resolver
-call. Before releasing it, an implicit-agent handoff preflights a possible
-Claude launch because the holder's new `PAUSED` record may name Claude. After
-handoff, the agent is read afresh from that record. An explicit other agent
-skips the Claude preflight. A declined handoff performs no update.
-After resolution, the binding is read again immediately before the window
-rename. A lane taken or changed during the update wait is refused; an unchanged
-existing binding can continue.
-
-- It looks for `claude-current` beside itself, then in
-  `$OPENREPOTOOLS_BIN_DIR` (default `~/.local/bin`), and never on `PATH`. A
-  sandbox that copies `lane-start` without it, as the lane suite does, launches
-  the `claude` its own `PATH` names, and no test reaches a real npm.
-- It runs `claude-current --porcelain` with stdin from `/dev/null`. The
-  resolver's stderr goes straight to the operator.
-- Exit 0: the launch command's first word becomes the absolute path.
-  `CLAUDE_BIN` and `CLAUDE_RESOLVED_BIN` are exported with that path, and one
-  line says `launching claude <version> (<status>) at <path>`.
-- Exit 2 ends `lane-start` with 2, and any other failure with 1. Either way
-  no binding handoff is requested, the window is not renamed, no transcript is
-  moved, and the row, object log and handoff's Rule 3 stamp are not written.
-- With no `claude-current` installed, one note says so, and `CLAUDE_BIN`
-  (`claude` from `PATH` when unset) is launched unchecked, as before.
-- `--dry-run` prints a `PLAN` line naming the call and runs nothing, because
-  the resolver may update. `--no-launch` resolves nothing: it is the first act
-  inside a running session and launches nothing.
-- An explicit other agent skips it. With a free binding, only the selected
-  `claude` agent asks. `--agent codex` launches `codex` as before.
-
-The lane's `STARTED` or `RESUMED` log line records the version as one more
-sub-field, `claude <version>`, when a version is in hand: read by
-`claude-current` in this run, or handed on as `CLAUDE_VERIFIED_VERSION`. For
-example:
-
-```text
-STARTED — lane repoZ-1, session <uuid>@Eagle, <UTC>, lane:repoZ-1 → home opensoft/repoZ; estate repoZ; dir <dir>; window testsess:0 @1; claude 2.1.284
-```
-
-A pinned launch records no version, and neither does a line written by the
-deferred `--no-launch` act. A value that is not x.y.z is left off with a note,
-because the log is append-only.
-
-A `--confirm` answered No launches Claude bare, without a lane and writing
-nothing, and that launch resolves the same way, refusal included. It is the
-one launch that happens before step 4.
-
-## `claude-restart-check`
-
-```sh
-claude-restart-check [--running <version>] [--pid <pid>]
-```
-
-It walks at most three processes, from `--pid` (default: its own parent) up
-through their parents, to the first one whose `/proc/<pid>/exe` is a Claude
-Code binary: a native version file (`…/claude/versions/<x.y.z>`, or `<x.y.z>`
-directly in the native versions directory, `$CLAUDE_CURRENT_NATIVE_DIR` or its
-default, compared by that directory's canonical path because the kernel
-reports `exe` with every symlink resolved),
-or the npm package's `…/node_modules/@anthropic-ai/<dir>/bin/claude.exe`. The
-status line runs its command under `/bin/sh -c`, and dash does not `exec` it,
-so claude is the status line script's grandparent. That was measured on a live
-bench on 2026-09-29.
-
-It warns when either of these holds:
-
-- **The binary was replaced**: that exe link ends in ` (deleted)`. npm renames
-  the old package directory before deleting it, so the running exe's path
-  names a directory that no longer exists, and it cannot give the running
-  version.
-- **The installed version is newer than the running one.** The installed
-  version is the highest of three, each read from disk: the running install's
-  own (the highest x.y.z name beside a native version file, or the `version`
-  in the npm package's `package.json` at its canonical path), the native
-  versions directory (`$CLAUDE_CURRENT_NATIVE_DIR`, default
-  `~/.local/share/claude/versions`), and the package in the user npm prefix,
-  found the way `claude-current` finds it. So a session on the npm copy is
-  told about a newer native install. The
-  running version is `--running` (the status line JSON's `version`), else the
-  native file's own name.
-
-The warning is exactly one line, green unless `NO_COLOR` is set. A replaced
-binary asks for a restart:
-
-```text
-RESTART NEEDED: running 2.1.283, installed 2.1.284; /ctx at your next breakpoint
-```
-
-When only another installed version is newer, the notice leaves the selection
-to the next launch's registry check:
-
-```text
-NEWER COPY INSTALLED: running 2.1.284, installed 2.1.285; /ctx checks npm before selecting a version
-```
-
-`claude-current` prefers a candidate equal to npm's published version over an
-ahead candidate. This disk-only check cannot predict that choice, so a newer
-installed copy alone is not labelled `RESTART NEEDED`.
-
-It never acts. There is no kill and no automatic `/ctx`, because a working
-session is never interrupted. It reads `/proc`, one directory listing and a
-few small files, reaches no network and runs no binary, so the render is not
-slowed by a `claude --version`. It always exits 0, on a host with no `/proc` such as macOS too,
-where it prints nothing: a status line must never break on this. 64 is kept
-for an argument it does not know. `CLAUDE_RESTART_CHECK_PROC` (default
-`/proc`) is the test seam.
-
-The status line that calls it is workBenches'
-`base-image/files/claude-statusline-command.sh`, which
-`scripts/setup-claude-profiles.sh` installs as the profiles' shared
-`statusline-command.sh`.
-
-## Portability
-
-Both commands parse and run under bash 3.2, which is what macOS ships. Neither
-uses `mapfile`, associative arrays, `readlink -f` or GNU-only flags.
-`tests/test_claude_current.py`, `tests/test_claude_restart_check.py` and
-`tests/test_lane_start_claude_current.py` are their suites, and every one of
-them runs against fakes. None reaches npm or runs a real Claude Code.
diff --git a/docs/README-lanes.md b/docs/README-lanes.md
deleted file mode 100644
index e0120758..00000000
--- a/docs/README-lanes.md
+++ /dev/null
@@ -1,4789 +0,0 @@
-# `lanes/LANES.md` — how the estate lane register is stored, and the commands that write it
-
-**THE TOOLING LIVES HERE; THE DATA LIVES IN YOUR WORKSPACE REPOSITORY.**
-Amendment 9, 2026-09-13. This manual and the commands it then described —
-`lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` — came to
-`opensoft/openRepoTools` from `opensoft/brett-wip` with their history, because
-a `<user>-wip` is a person's DATA and its own rules file says so: "No secrets
-and no code". They are INSTALLED COMMANDS now, placed by
-`openRepoTools --install`, and none of them is a file in anybody's workspace
-repository any more.
-
-**So every command below is typed by bare name**, and every one of them finds
-your register the same way: through `$AGENT_PROTOCOL_ROOT/workspace.yaml`
-(default `~/.agents/workspace.yaml`), which names your workspace repository and
-where it is checked out. `openRepoTools wip init` is the one command that
-creates that repository and writes that file. A helper that cannot find it
-refuses, exit 1, naming that command — it never guesses, and it never falls
-back to a path derived from its own location.
-
-**Moved 2026-09-10 (Amendment 5).** The register lived on the orphan `lanes`
-branch of `opensoft/xFactory` from 2026-09-09; it moved to `main` of the
-person's workspace repository — for Brett, `opensoft/brett-wip` — ratified by
-Brett Heap 2026-09-10 ("since we now have the user-wip repo this is a better place
-to store our lanes", "create opensoft/brett-wip and move it all there"),
-implemented by lane `openRepoShape-2`, session
-`8fa66b30-4cf5-4b80-b40c-ac3640cf45ab`, on workstation **Eagle**. All 1242
-register commits came across with it as a `git subtree`; the orphan branch is
-retired behind a pointer. Rules 9 and 10 are unchanged in every mechanic:
-every write is still one commit, made by `lanes-edit.sh`, and every row still
-names its workstation.
-
-Status of the original ruling: in force — ratified by Brett Heap 2026-09-09 (in-session, verbatim
-"track LANES.md in git. but we need to make sure we have a workstation
-designation too in the rows right? so that Raven/opsXfactory-2 and
-Eagle/opsXfactory-2 are not confused."). Implemented by lane
-`provenance-autonomous-merge`, session `f1356e27-665d-4119-b47e-a5e66efdce00`,
-window `codeXfactory-3`, on workstation **Eagle**.
-
-Governing protocol: `~/.agents/protocols/lane-collision-protocol.md` — Rule 9
-(register in git) and Rule 10 (workstation designation), Amendment 3,
-2026-09-09; **Amendment 5, 2026-09-10** (the register lives in the person's
-workspace repository).
-
-## Why
-
-`LANES.md` is the estate's live-lane register (protocol Rule 4). Many
-concurrent lanes on more than one workstation write to it. It used to be a
-single untracked file with no history:
-
-- **2026-09-08T23:46:33Z** — one session wrote the whole file from memory. That
-  write dropped two other lanes' rows (`browser-ui-repair`,
-  `doxbench-stewardship`) and a day of Rule 6 LANDING/LANDED lines. There was
-  **no history to recover from**; peers rebuilt rows by hand from their
-  handoffs and a 2026-09-04 `.bak`, and edits made in between are simply lost.
-
-Git makes that recovery a `git show` instead of an archaeology exercise, and
-the commit log makes every registry change attributable to a lane **and a
-workstation**.
-
-## Layout
-
-| what | where |
-|---|---|
-| repository | `<org>/<login>-wip` — the person's own workspace repository, private, org-owned (the `<user>-wip` form, `openRepoShape#81`); named by `repository:` in `~/.agents/workspace.yaml`. Brett's is `opensoft/brett-wip`; Scott's would be `opensoft/scott-wip`, and the commands below are the same commands |
-| branch | `main`. Direct commits are the norm there **by design**: the repository is excluded from the organisation's PR-only ruleset precisely so a per-edit register commit can land |
-| checkout | `~/projects/<login>-wip/`, named by `path:` in `~/.agents/workspace.yaml` and created by `openRepoTools wip init` |
-| how every command finds it | `$AGENT_PROTOCOL_ROOT/workspace.yaml` — `repository:` and `path:`, and nothing else. Never from the command's own location (Amendment 9(a)) |
-| the register | `<the checkout>/lanes/LANES.md` |
-| the path every lane already uses | `~/projects/xFactory/LANES.md` — a **symlink** to `<the checkout>/lanes/LANES.md` |
-| the writer | `lanes-edit.sh`, an installed command in `~/.local/bin` (still symlinked as `~/projects/xFactory/lanes-edit.sh`, which is what Amendment 8(e)'s `SessionStart` hook names) |
-| the two ends of a lane | `lane-start` and `lane-end`, installed commands — **regular files, not symlinks any more** |
-| their tests | `tests/test_lane_helpers.sh` in `opensoft/openRepoTools` — run it from a checkout of that repository; it touches nothing real |
-| the object logs | `<the checkout>/lanes/log/<lane>.md` — one per lane (Amendment 7) |
-| the alias table | two layers: `repos.tsv` shipped by openRepoTools and installed beside the commands, then `<the checkout>/lanes/repos.tsv` where you keep an override (Amendment 9(b)) |
-| who places the symlinks | `link-estates`, an installed command. It places the handoffs links, the register link and the `lanes-edit.sh` link — **and no longer the two `~/.local/bin` ones**, which `--install` owns |
-| who installs all of it | `openRepoTools --install` (every command and the alias table, idempotent, all-or-nothing) |
-| the lane alias table | `<the checkout>/lanes/aliases.tsv` — `<old><TAB><new><TAB><UTC>`, written by `lane-rename` and by nothing else, resolved by every reader that takes a lane name (Amendment 16(e)) |
-
-Why `main` of the workspace repository and not the aggregation's: the
-aggregation repo's `main` is PR-only (org rulesets `xFactory Tier-1 main
-protection`, `required-checks-main`, `Require Code Owner Review`, all scoped
-to `~DEFAULT_BRANCH`), so a per-edit commit cannot land there — which is why
-the register spent 2026-09-09 to 2026-09-10 on an **orphan `lanes` branch** of
-that repo instead. The workspace repository has no such gate and no product
-code at all, so the register can sit on its `main` next to the handoffs it
-cross-references. Nothing here is ever released, pinned, swept or bumped.
-
-**The register no longer owns its whole checkout.** The workspace checkout
-also holds `handoffs/` and `workspaces/`, which other lanes write. That is why
-the writer now (a) uses a pathspec on every `git add` and `git commit`, so a
-peer's half-written handoff can never ride along in a register commit, and (b)
-SKIPS `pull --rebase` when the checkout has unstaged changes to other tracked
-files — `pull --rebase` refuses outright on any unstaged tracked change — and
-pushes straight out instead, warning and naming the files. If the push is also
-rejected (the remote moved), it stops with exit 3, leaves your edit as a local
-commit, and prints the recovery: the owner of that file commits it, then you
-re-run `lanes-edit.sh commit`. If `lanes/LANES.md` is clean, that re-run makes
-no commit of its own and pushes the local commits origin does not have yet,
-through the same loop, guard and retries (#194). It reads that queue on
-`refs/heads/main`, the branch the push sends, with HEAD required to be on it,
-and pushes exactly the commit it read. It refuses with 2 and pushes nothing
-unless every queued commit is a non-merge commit whose every change is an added
-or modified regular file under `lanes/` or `handoffs/`, and never bytecode, a
-cache or an environment. That refuses a merge, a deletion (a lane rename's
-included), a type change, a symlink, a gitlink and any other path. It is a
-path filter, not an ownership check: another lane's register write passes it,
-so read `git cherry -v origin/main HEAD` before you publish a shared queue.
-Only `commit` publishes that queue: any other write with nothing to stage
-leaves it local, and with nothing ahead `commit` is the no-op it always was.
-When `pull --rebase` finds every queued commit on origin already, by content
-under other shas, it drops them all. The publish then says so and exits 0
-without a push.
-
-## THE ONE HAZARD — `sed -i` DESTROYS THE SYMLINK
-
-`~/projects/xFactory/LANES.md` is a symlink. GNU `sed -i` writes a temp file
-and **renames it over the path**, which unlinks the symlink and leaves a
-regular file. The registry then silently detaches from git: your edit is
-invisible to `git status` in `.lanes/`, and the next lane's helper run commits
-the *old* content.
-
-Verified on Eagle, 2026-09-09:
-
-```console
-$ ls -la LANES.md
-lrwxrwxrwx  LANES.md -> .lanes/LANES.md
-$ sed -i 's/x/y/' LANES.md
-$ ls -la LANES.md
--rw-r--r--  LANES.md            # <-- the symlink is GONE
-```
-
-Safe ways to write:
-
-| operation | safe? |
-|---|---|
-| `lanes-edit.sh …` | **yes — use this** |
-| `sed -i --follow-symlinks …` | yes (verified: link preserved) |
-| `cat tmp > LANES.md` (any `>` redirect) | yes |
-| `printf '…\n' >> LANES.md` (`>>` append) | yes |
-| `python3` `open(path,'a')` / `open(path,'w')` | yes |
-| **plain `sed -i`** | **NO — replaces the symlink** |
-| `mv tmp LANES.md`, `cp tmp LANES.md` (no `--no-dereference`… `cp` is fine, `mv` is not) | `mv` **NO** |
-
-If it happens: `rm LANES.md && ln -s .lanes/LANES.md LANES.md` after copying
-your content into `.lanes/LANES.md`, then commit with `lanes-edit.sh commit`.
-
-## How to write to the registry
-
-```bash
-cd ~/projects/xFactory
-
-# read (unchanged — every existing path and habit still works)
-grep -n 'my-lane' LANES.md
-./lanes-edit.sh verify-row my-lane          # first 200 / last 200 chars of the row
-
-# SET a row's state cell — the common case, and it REPLACES the cell
-# (Amendment 13(a)). The UTC is stamped by the writer.
-lanes-edit.sh set-row-state my-lane "LANDED · PR #123 merged as abc1234"
-
-# the NARRATIVE — what the lane did, found, launched, left — goes to the
-# lane's own log, never to the row (Amendment 13(b))
-LANES_LANE=my-lane lanes-edit.sh log NOTED lane:my-lane "rebased on main; the flake is the fixture's clock"
-LANES_LANE=my-lane lanes-edit.sh log RULED lane:my-lane → opensoft/openRepoTools#29 "Ratify as drafted"
-lanes-edit.sh history my-lane --since 2026-09-13T00:00Z
-
-# change one exact substring inside a row (must match exactly once).
-# The optional 4th argument becomes the commit subject — use it to record WHY.
-./lanes-edit.sh replace-in-row my-lane "ACTIVE" "PARKED" "parked pending Brett's OQ-1 ruling"
-
-# a Rule 6 LANDING / LANDED line (these are file-level lines, not rows)
-./lanes-edit.sh append-line "LANDING — lane my-lane, session <uuid>@Eagle, 2026-09-09T01:00:00Z, PR #123 into openxFactory main"
-
-# register a new lane
-./lanes-edit.sh add-row "| \`my-lane\` | \`<uuid>\` / \`session_01…\` / window \`my-lane\` | Eagle / WSL2 / brett | 2026-09-09T01:00Z | <objects> | <handoff path> | ACTIVE |"
-
-# you hand-edited .lanes/LANES.md with an allowed tool and want it committed
-LANES_LANE=my-lane ./lanes-edit.sh commit "row rewritten by hand"
-```
-
-Every mutating subcommand FIRST resolves its `<lane>` — and `LANES_LANE` — to
-the register row's own spelling, case-insensitively, before it reads or writes
-anything, so a name typed in another case edits the row that is there instead of
-creating a second one; two rows differing only by case are a refusal naming both
-(Amendment 15). Then it does the same five things:
-
-1. takes a `mkdir` lock in `.lanes/` (so two helper runs never interleave);
-2. checks whether LANES.md is already dirty before making its own edit. If it
-   is, that content is someone else's — never this invocation's — so it
-   **warns** (`git diff --stat` plus the first 200 chars of every changed
-   line, and the affected lane(s) identified by the first backtick token on
-   each changed line, or `append` for a line with no row of its own) and, by
-   **default (`--no-sweep`)**, commits that pre-existing content FIRST, as its
-   own `LANES(pre-existing@<workstation>): capture an uncommitted registry
-   edit (row <lane>)` commit, so a peer's in-flight edit is never combined
-   with yours. Pass `--sweep` to fall back to the old combined-commit
-   behaviour instead — never silently: it appends " + sweeps uncommitted
-   edit to row \<lane\>" to the commit subject it is about to create. Either
-   way the write still goes through — this never fails the call;
-3. re-reads the file, edits **exactly one line** in place, and refuses if
-   `git diff --numstat` says more than one line moved;
-4. commits as `LANES(<lane>@<workstation>): <what>` — workstation from
-   `hostname -s`;
-5. `git pull --rebase origin main` then `git push`, retrying a lost push race
-   up to six times — or, if a peer has uncommitted changes to other files in
-   this checkout, a warning naming them and a straight push (see the Layout
-   note above).
-
-**On a rebase conflict it aborts**, leaves the worktree clean and not
-mid-rebase, prints the conflicting lines and prints the recovery commands. Your
-edit survives as a local commit — but an aborted pull is not proof it never
-reached origin: this checkout is shared with every lane on the workstation, so
-the very next write out of it can pull this dangling commit onto its own and
-push both together (#32). LOOK first: `git -C <the workspace checkout> fetch
-origin main` — if THAT fails, STOP and retry it; a stale or unreachable origin
-proves nothing either way, and is not permission to reset and redo. Only once
-the fetch succeeds do you check by CONTENT whether your own commit is already
-there, never by sha: the very peer write this recovery exists for carries a
-dangling commit by rebasing it onto a newer base, which changes its hash, so
-`merge-base --is-ancestor` alone can still say "not there" once the change is
-actually published. `git -C <the workspace checkout> cherry origin/main <your
-commit> | grep -c '^+'` compares by patch instead and still finds it; 0 means
-it is already there, in which case STOP. Only once fetch succeeded AND this
-prints something other than 0 do you check that `git -C <the workspace
-checkout> rev-parse HEAD` is still the commit the recovery named; if the checkout
-has moved since the abort, STOP. Then list WHOSE the commits are, with
-`git -C <the workspace checkout> cherry -v origin/main HEAD`: one `+` line per
-local commit origin lacks, which is exactly what a reset drops, and in a shared
-checkout not every one is yours. If any `+` line is not your own write, STOP and
-take it to the lane its subject names. A `LANES(concurrent@…)` or
-`LANES(pre-existing@…)` capture names no lane, so it is not yours either. Never
-reset, stash or overwrite a peer's work: `reset --hard` drops EVERY `+` commit
-in the checkout, theirs with yours, and origin holds no copy of any of them
-(#194). Only when every `+` line is yours do you read your edit back with
-`git -C <the workspace checkout> diff origin/main..HEAD -- lanes/LANES.md`,
-then `git -C <the workspace checkout> reset --hard origin/main` and redo it on
-top of the peer's version.
-
-The script spells no path of its own: it finds the checkout root with `git
-rev-parse --show-toplevel` from its own directory and derives the pathspec
-`lanes/LANES.md` with `--show-prefix`, so the clone may live anywhere. The
-overrides `LANES_REPO`, `LANES_PATH` and `LANES_BRANCH` exist for tests.
-
-## Starting and ending a lane
-
-### One word: `lane`
-
-```console
-$ lane                          # the lanes, numbered, and ONE question: which?
-$ lane openRepoShape-2          # straight to that one, asking nothing
-$ lane openRepoShape-2 team-05e # …under another account (the late swap)
-$ lane --all                    # every repository, grouped
-```
-
-**This is the word, and it is Brett Heap's own** (lane-collision-protocol
-**Amendment 18 Addendum 1**, ratified 2026-09-14T14:05:54Z verbatim *"ratify the
-addendum"*), out of his two messages that morning, verbatim: *"i dont understand
-in another window i want to attach to that lane. what command do i use to do
-that?"* and *"this is too hard for users. we need simple way to list the lanes
-and then pick one to bind."*
-
-A bare `lane` prints clause (i)'s listing as a **numbered pick** — available
-lanes first (PARKED, or a binding this host proves dead), lanes **LIVE HERE**
-next with where each one is (`window <n> of this session`, `detached session
-<name>`), lanes **bound elsewhere** last with the workstation holding them;
-closed and dormant lanes hidden (Amendment 19) — and asks **one** question:
-`which? [1-N, f = a new lane at the next free position (<repo>-<n>), q]`. Inside
-a checkout it is that repository's lanes; outside one, or with `--all`, every
-repository, grouped.
-
-**Three branches, one per state** (clause (i-2)):
-
-| the lane is | `lane` does |
-|---|---|
-| **available** — PARKED, or a binding this host proves dead | `cd` to its **own recorded directory** and relaunch it **through the launcher** under its **own recorded profile**: `pclaude --lane <lane> <profile>`. Never a bare `lane-start` under whatever profile the shell carries, which outside a launcher session is the default config directory and therefore the wrong account. `lane <name> <profile>` names another one — the late swap |
-| **LIVE HERE** | **attaches, and never starts a second process** (clause (h)). Inside tmux: `tmux move-window -a -s <session>:<@id>` then `tmux select-window -t <session>:<@id>` — the `@id` on both, so tmux resolves the window inside the session the record named or not at all — and where the window is already in this session, only the select. With `--switch`: the same select first, and `tmux switch-client` only after it worked. Outside tmux: `tmux attach -t <session>:<@id>` — the window named in the attach itself, which tmux resolves in that session or refuses — with that window selected first |
-| **bound elsewhere** | clause (c)'s question, the **handoff request**. That request is `brettheap/new-workstation#38`'s act 4 and does not exist yet, so until it does `lane` **refuses and names where the lane is bound**. It never offers a launch: a second session on a lane another workstation holds is the collision |
-
-A row whose `STATE` is read from its own state cell — `PAUSED (row)`, because
-its log has no lane-kind line — is in **none** of the three: `lane` does not
-number it, and `lane <name>` refuses it, because there is no log to resume it
-from (`openRepoTools#89`; Amendment 19 below).
-
-**The window is matched by its id AND its session name.** tmux reissues `@` ids
-from `@0` when its server is replaced — measured here on 2026-09-13, where 0 of
-5 recorded windows resolved — so an id alone would attach to whatever pane has
-since been given it. Where the two disagree `lane` refuses and names both.
-Before attaching a LIVE lane, `lane` also checks that the window's live
-transcript is the row's latest UUID and is named for that lane. It checks all
-tmux windows for another window using the same lane name (ignoring multiple
-links to the same window ID), then renames the selected window to the lane when
-needed. A window already named for a different registered lane is not renamed.
-If the transcript or row is behind, it refuses instead of disguising
-the mismatch; run `lane-start --no-launch <lane>` in that window to record the
-new transcript. `lane-start` applies the same name-uniqueness check before a
-NEW lane's launch renames its window; an existing lane's own window in another
-container keeps its name until it hands off (Amendment 18), so it is not asked there.
-
-**With no terminal on stdin it lists, suggests and asks nothing** (clause
-(i-3)): an agent's stdin is not a terminal. **Bare `lane-start` is `lane`**
-(clause (i-4)) — one implementation, and clause (i)'s ruled behaviour stands.
-
-`lanes` is the same rows as a **read**: every column, closed lanes included, no
-question. `/restart` is the act from **inside** a running session. And `restart`
-is gone from the PATH — the section below.
-
-### `lane-start` and `lane-end`
-
-The lane rule, ruled by Brett Heap 2026-09-10: **lane = tmux window name =
-Claude session name**, in the form `<repo>-<position across, left to right>`.
-The working directory confers NO lane — two lanes may share one; a window
-still called `claude` has no lane at all; and whether a name is free is
-decided by whether the row's recorded session id is **live**, never by whether
-a row exists.
-
-**A lane name is ONE name under any case, and the register row's spelling is
-canonical** (Amendment 15, in force 2026-09-14T00:07:18Z). `lane-start
-openxfactory 2` and `lane-start openXfactory 2` are the same lane: every lookup
-of a name — the row, the object log, the tmux window, the session name,
-`LANES_LANE`, and every `<lane>` argument of the commands here — compares
-case-insensitively, and the row's own spelling is what the window is renamed to,
-what the launch is `--name`d with, what the log file is called, and what every
-line and stamp writes. A name typed in another case RESOLVES to it and is never
-written as typed. A lane with no row yet takes the checkout's REAL directory
-name for its `<repo>` half, resolved under the projects root case-insensitively;
-two directories differing only by case are a refusal naming both, because
-choosing one of them is choosing which repository the lane is in. Where the
-register already holds two rows differing only by case, **every writer refuses,
-naming both**, until they are merged by hand — 15(d): the newer row's session
-id(s) appended to the older row's session cell, in order, and the newer row
-removed in the SAME commit, whose message names both spellings. `lanes-edit.sh
-canon-lane <name>` is that resolver as a read, and the one the commands share
-rather than each keeping its own: **0** with the canonical spelling (the typed
-one where no row matches, so `add-row` can still create a lane), **2** for the
-pair, **64** usage — and that
-2 is RELAYED by `lane-start`, `lane-end` and `lane` rather than carried past,
-because the pair may be on `origin/<branch>` while this checkout still holds one
-row. `add-row` asks the published register as well as this copy of it for the
-same reason: a row a peer pushed is a refusal here, naming it and the `git pull
---rebase` that settles it, and never a second row. The LOG is held to the same
-rule — two files under `lanes/log/` whose names differ only by case are two logs
-for one lane, and every read and every write under that name refuses, naming
-both, until they are merged.
-
-Honouring that by hand is five acts at one end of a lane and one at the other,
-and this register records where they get dropped: rows added hours late (`ROW
-ADDED LATE 2026-09-09T18:05Z — the lane worked from 00:10Z without a row, a
-Rule 4 gap this row closes`), windows left named `claude`, `(2)`-suffixed
-session names minted when a rename collided with a title that was still held,
-and lanes that stopped without ever updating their row. `lane-start` and
-`lane-end` are those acts, one command at each boundary — never mid-session,
-because renaming a running window's session is exactly what mints the `(2)`.
-
-```sh
-lane-start openRepoShape 2          # in the tmux window that will carry the lane
-lane-start openRepoShape-2          # the full lane name works too
-lane-start 2                        # <repo> from the cwd's git root
-
-lane-end openRepoShape-2            # the window is closing
-lane-end openRepoShape-2 --retire   # …and the lane is not coming back
-lane-end openRepoShape-2 --inventory-only  # …past the close-out gate (#163), trees left recorded
-```
-
-Both print every step to **stderr** and refuse with a message that names the
-fix. Exit codes: **0** done, **1** environment, **2** refusal — and under
-Amendment 8 (R-A8-3) `lane-start`'s **2 is for ARGUMENT ERRORS and nothing
-else**: a name that is not a lane, a position that is not a position, a name a
-window cannot take, a lane whose register holds two rows, a lane live in
-another window. **A person's answer is never an argument error.** `--confirm`
-answered `N`, and `--confirm` with no terminal and no `--yes`, rename nothing,
-write nothing, print one notice and `exec` Claude **bare** with the
-pass-through arguments, **exit 0**; under `--no-launch` that bare command is
-printed on stdout so a launcher can exec it. `claude-profile` **`exec`s**
-`lane-start`, so this script's status *is* the launcher's, and a refusal here
-would be an exited pane with no Claude in it — the one failure the change
-exists to prevent. `--help` prints the file's own header, which is the whole
-manual.
-
-### `lane-start <repo> <n>`
-
-1. derives `LANE=<repo>-<n>` and the lane's directory — `~/projects/<repo>`,
-   or `--dir <path>`. Both halves resolve case-insensitively under Amendment
-   15: `<repo>` to the checkout's real directory name, and the lane to the
-   register row's own spelling, which then wins over everything typed;
-2. **refuses unless it is already inside tmux.** It renames the window it is
-   run in and never creates a tmux session: the window is the lane;
-3. **liveness check, before it takes the name — and it is always asked.** It
-   reads the session id(s) out of the row's *session cell* — not the whole row,
-   which quotes other lanes' ids all the time — and looks for a live record in
-   every profile's `sessions/*.json`. The row it reads is the PUBLISHED one,
-   fetched, unioned with this checkout's (see `live-holder` below), because a
-   gate that runs only when THIS checkout already names an id skips exactly when
-   the answer matters: a uuid another workstation has stamped and pushed reads
-   here as "no ids, nothing to check". `lane-start` also asks the published
-   register whether the lane already HAS a row before it adds one, and refuses
-   rather than writing a second — two rows for one lane is a register
-   `lanes-edit.sh` cannot edit at all, because `row_line` requires exactly one. A record is
-   live when its pid is alive **and** `/proc/<pid>/stat`'s start time still
-   matches what the record wrote down, so a recycled pid cannot lock a name.
-   A live holder in **another** tmux window is a refusal that names the next
-   position; a row whose recorded sessions have all ended is a lane you are
-   **resuming**, which is allowed and expected. A record whose session *name*
-   is some other lane is not a holder either: this register carries rows whose
-   session retired from the lane and was renamed, and refusing on those would
-   lock free names forever;
-3b. **the live session in THIS window** (Amendment 8), which is not step 3's
-   question. Step 3 asks whether any session the *row* names is alive; this
-   asks what is alive in this *window*, through `lanes-edit.sh window-session`.
-   The harness mints a new transcript uuid with nobody acting — a `/clear` does
-   it, and so did the 2026-09-12 usage reset that carried this lane's
-   conversation into `4a91f1dc…` while its row still ended on `09dd34d1…`. An
-   id in no row is an id `live-holder` cannot look up: it answers 8, *this lane
-   is parked*, about the conversation sitting in the very window it was asked
-   about, and `lane-start` would then resume the lane's **previous**
-   conversation and write that uuid on to an append-only line. Read off the
-   record instead, the id is appended to the session cell in step 5 — before
-   the stamp — and it is what this run resumes and stamps. There is no flag for
-   it and there could not be one: the id does not exist until the session does.
-   The act is `lane-start --no-launch <repo> <n>` run **in** that window, which
-   is what the SessionStart hook's block asks the new session to do. (The one
-   caller already *inside* that session, the name guard, names it with `--bind
-   <uuid>` — its binding mode, below — and that flag is the guard's alone);
-3c. `--confirm`, when it was passed and this window is not already named for
-   the lane: the **triple** — the window, the session live in it, the row — and
-   the question `Take lane <lane> in this window? [y/N]`. Before the rename and
-   before any write, so a No costs nothing. `--yes` answers it for a caller
-   that has already asked. **Every answer leads somewhere and no answer
-   exits.** An explicit `N` — and no terminal with no `--yes`, which is the
-   same answer with nobody there to give it — renames nothing, writes nothing,
-   prints **one** notice naming the lane it declined, and `exec`s Claude bare
-   with the pass-through arguments, **exit 0**: `N` means *not this lane*, not
-   *not at all*, and an unattended launch must still not take a lane on an
-   inference nobody confirmed. The launcher passes `--confirm` exactly when the
-   lane came from the swap *record* rather than from the window name or a flag;
-4. `tmux rename-window <LANE>` — which also turns automatic-rename **off** for
-   that window, so the name survives the next command it runs;
-5. the row, through `lanes-edit.sh`: `add-row` when there is none under ANY
-   case — it refuses one that exists under another and names it, and the
-   liveness check above reaches the RESUME branch for that row rather than this
-   one (Amendment 15(a)) — state `LIVE · <UTC> · <verb> by <uuid> (lane <lane>)
-   — lane-start on <ws>: row created`, which is Amendment 13(a)'s phrase from
-   birth (it was the bare word `STARTING` while the cell was a diary), session
-   id `pending — set by the session's first act`,
-   `<workstation> / <profile> / <user>` per Rule 10, handoff path
-   `handoffs/<estate>/session-handoff-<date>-lane-<LANE>.md` — and
-   `set-row-state` when there is one. Never a hand edit. **That state is
-   Amendment 6(c)'s stamp**, written here rather than owed to the session
-   afterwards — and since Amendment 13(a) it REPLACES the cell rather than
-   being appended to it, with the UTC stamped by the writer:
-
-   ```text
-   LIVE · <UTC> · RESUMED by <uuid> (lane <lane>) — lane-start on <ws>: window renamed, launching <the command>; dir <dir>; window <ref>
-   ```
-
-   **The launch clause comes first and clause (c)'s `dir` and `window` follow
-   it**, because the line is capped at 240 characters (Amendment 13, ratified
-   decision O1) and a line long enough to be cut must lose what a reader can
-   look up elsewhere: `dir` and `window` are sub-fields of this same act's
-   `STARTED`/`RESUMED` line in the lane's own log and columns of `lanes`, while
-   the exact command this run launched is written down nowhere else.
-
-   The **tail states what happened**, so a `--no-launch` run ends `window
-   renamed, no launch` and never claims to have launched anything.
-   `STARTED` where a new session takes the name, and the uuid is the one this
-   run actually resumes or mints, read from the **published** row. Under
-   Amendment 6(b) that stamp is load-bearing — it is what the next `lane-start`
-   resumes — so a stamp that is owed to a session which dies at a usage reset
-   before its first act is a lost lane, which is the shape this estate hits
-   daily. A brand-new row needs no stamp: it is created with that uuid already
-   in its session cell;
-6. the launch — decided *before* the row is written, because a brand-new
-   session's id is minted there and the row must record it. **Resume beats
-   new**, because a rename into a title that is still held is exactly what mints
-   `<LANE> (2)` and costs the lane its address (Amendment 2: the session name
-   *is* the messaging address). Four cases, in order: `exec claude --resume
-   <id>`, where `<id>` is the **last** uuid in the row's session cell and this
-   directory has its transcript (Amendment 6 — a lane is resumed by the id its
-   row records, never by its title); the same exact command using the same
-   agent's last `PAUSED … transcript <id>` when the row-last UUID has no
-   transcript, restoring that exact ID to the end of the session cell first;
-   `exec claude --resume <LANE>` when neither exact recorded id resolves but a
-   transcript here carries the custom title `<LANE>`, which is the fallback and
-   only filters the picker; and `exec claude --name <LANE> --session-id <fresh
-   uuid>` for a lane with no history here. A live session in the current window
-   remains authoritative over the PAUSED fallback. Anything after `--` is
-   passed through to `claude`.
-
-   **And the id it is about to resume is counted first, under two rules and not
-   one.** Amendment 18(h)'s is this tooling's: a second LIVE PROCESS on one
-   transcript is a refusal naming the pid and the retire act, and the harness
-   permits that state — measured 2026-09-15 against `claude` 2.1.270, a
-   `--resume` whose id a second *interactive* process holds starts anyway. The
-   other rule is the HARNESS'S OWN, asked here because it decides whether the
-   `exec` can happen at all: a `--resume <id>` whose id is carried by a live
-   record whose `kind` is anything but `interactive` — a `--bg` job, a
-   `bg-pty-host` child, the `bg` companion of Amendment 8 ruling (g) — prints
-   `Session <id> is running as a background session … Add --fork-session to
-   branch off a copy instead` and **exits 1 without starting**. Everything this
-   command writes — the row, the object log, the handoff stamp — is written
-   BEFORE the `exec`, so a launch the harness refuses leaves a lane recorded
-   `RESUMED` by a session that never existed, and in a window `pclaude --lane`
-   has just made, tmux prints `[exited]` over the message and closes it. So the
-   count is asked on both sides of the current-window test and the refusal names
-   where that session is (`tmux switch-client -t <window>`) and how to open it
-   (`claude agents`, `claude attach <id>`, `claude stop <id>`) beside
-   `lane-end <lane> --retire <pid>`.
-
-   **The session cell it reads is the PUBLISHED one**, fetched, through the same
-   `register-row` step 3 asks — like every other state read in this tooling. A
-   `git fetch` does not move a working tree, so a uuid a peer stamped from
-   another clone and pushed is absent from this checkout's copy of the row until
-   something pulls: read from there, a cell published as `<U1> → <U2>` still
-   ends at `<U1>`, and the lane resumes its **previous** conversation, appends a
-   status naming that id, and writes a `RESUMED` line into `lanes/log/<lane>.md`
-   carrying a session uuid that is not the lane's current one — in a file
-   nothing ever rewrites. A row this checkout has and `origin/main` has not is
-   an unpushed commit: `lane-start` says so, names the ids only this copy
-   carries, and takes a new session rather than resuming one of them.
-
-`--dry-run` prints all six and writes nothing. `--no-launch` does the first
-five and prints the `claude` command on **stdout** instead of running it —
-that is the hook a launcher uses, and it is the only thing either script ever
-writes to stdout.
-
-**`--bind <uuid>` is the name guard's binding mode, and nobody else's**
-(openRepoTools#70). The guard passes it on a person's choice `2` at its offer
-(see *The offer* below), naming the transcript of the session live in that
-window. Step 3b then takes that session even where ANOTHER row records its uuid
-— veto 1 answered by the person's `2`, which is the yes clause (h) rule 4 asks
-for — and appends it to the session cell (anchored on the published last id, or
-on `none recorded` / `pending — set by the session's first act` where the cell
-has no uuid) before the stamp. The row's stamp, the lane's `RESUMED` log line
-and the handoff's Rule 3 stamp all name **that** uuid, never the id the row
-would otherwise have resumed. It binds or it refuses, exit **2**, before
-anything is written: it is given only with `--no-launch`, never with `--fresh`
-or `--agent`, its `<uuid>` must be a transcript uuid and the session live in
-this window, and a window still named for another lane is refused — veto 2
-stands. No command printed for a person to type carries it.
-
-The env column records the Claude **profile** (`team-05b`), which is the thing
-that actually varies between lanes on one workstation; `WSL2` in the older
-rows is the same column.
-
-### `lane-end <lane>`
-
-Sets the row's state cell to `ENDED · <UTC> · lane-end on <workstation>:
-window closing; NOTHING IN FLIGHT` — `RETIRED` under `--retire`, which since
-Amendment 13(a) is the same write and not a second one — and **refuses (exit 2)
-while the row says something is still open**: if the last `LANDING` or
-`CLAIMED` in the state cell has no `LANDED`
-or `RELEASED` after it, the lane still owns something and Rule 6 is holding
-other lanes' merges. It prints the offending excerpt and the two ways out —
-post the `LANDED`/`RELEASED` first, or `--force`, which ends the lane and says
-in the register that it did.
-
-The phrases that *say* nothing is open — `NOTHING CLAIMED`, `no LANDING open`,
-`LANDING WITHDRAWN`, `UNCLAIMED` and their kin — are removed
-case-insensitively before that scan. Without that, a substring match on
-`CLAIMED` inside `NOTHING CLAIMED` would refuse on every healthy lane in the
-register.
-
-`--retire` is **the same single write**, carrying `RETIRED` instead of `ENDED`
-— since Amendment 13(a) the state cell is one phrase that `set-row-state`
-REPLACES, so there is no second act, no word to find inside the cell and no
-history in it to preserve. `--state-was "<text>"` named the exact text the old
-two-step had to replace; it is **accepted and ignored**, and a re-run that
-passes it does the same thing a re-run without it does.
-
-**It refuses (exit 2) while anything of the lane's is still on disk** — the
-close-out gate of opensoft/openRepoTools#163, asked after the in-flight guard
-and before any write, `--dry-run` included. The question is #162's sweep as a
-dry run, `lane-worktrees sweep <lane> --branches --include-scratch
---include-caches --dry-run --porcelain` ([its exit
-contract](#the-exit-contract-lane-ends-gate-163)): **3** (something to retire)
-and **2** (the sweep refused the lane, or a read failed) are a refusal that
-names every tree, branch, scratch directory and cache the table gives the lane,
-relays the sweep's own reason where it refused, and prints the table's command
-and the `--yes` that would retire them — which removes only what is on origin
-or in a bundle, never a live writer's tree. **Any other exit, or
-no `lane-worktrees` beside the command, is a gate nobody read: exit 1, never a
-pass.** Beside the table the gate makes two reads of its own. Every tree of the
-lane's is read with `git status --porcelain --ignored`, so a tree holding only
-an `.env` or a `node_modules` is named as holding them and never as clean. And
-every entry directly under the lane's own root, `.lane-worktrees/<lane>/`, that
-no tree, scratch or cache row names is **residue** — the ignored leftovers no
-row of the sweep reaches — and it refuses even where the sweep answered 0, as
-a cache row does; a root that cannot be listed is the gate unread (exit 1,
-whatever the sweep answered), never an empty one. Other lanes' trees in a shared checkout are FOREIGN, are
-counted for nobody, and never hold this lane — but a FOREIGN row names nothing
-for the residue read either, so a standalone clone directly under the lane's own
-root, which the sweep keeps FOREIGN, is residue and holds it.
-
-`--inventory-only` is **the one door past the gate**: the lane ends although the
-gate found something, refused, or could not be read, nothing on disk is touched,
-and the trees stay in the lane's #97 inventory, where the daily report lists them
-as an ended lane's. The reason it was let past is **written down**: the row's
-closing phrase gains `ENDED WITH --inventory-only: <what the gate found>; they stay
-in its #97 inventory`, and the lane's own `ENDED` (or `RETIRED`) line carries the
-same words in full. It does not pass the in-flight guard — that is `--force`'s,
-and a lane with both wants both. **`--sweep` is not built**: retiring the trees
-in the same run as the ending is not one act, so the word is refused by name
-rather than read as an unknown option; `lane-worktrees sweep <lane> --yes`
-retires them first, on its own.
-
-`lane-end --retire-dormant <repo>` is a **different act again** and ends no
-lane: it is Amendment 19(c)'s sweep of the rows that have no lane left to end.
-It is described under [A closed or dormant lane leaves the
-listing](#a-closed-or-dormant-lane-leaves-the-listing-amendment-19) below.
-
-It **never renames the window.** The name is the lane's history until the next
-`lane-start` takes that window, and a window renamed back to `claude` is a
-window nobody can attribute.
-
-One argument is taken verbatim, so a lane named before the `<repo>-<n>` rule
-(`browser-ui-repair`, `hermes-wallet-exercise`) can be ended by its own name.
-
-### The tests
-
-```sh
-# from a checkout of opensoft/openRepoTools, where the suite lives now:
-bash tests/test_lane_helpers.sh     # the shell suite alone, touches nothing real
-tests/run.sh                        # the same suite under pytest, SERIALIZED
-```
-
-`tests/run.sh` is the way to run it wherever lanes share a workstation
-(opensoft/openRepoTools#51): it waits for any live run, takes
-`${TMPDIR:-/tmp}/openrepotools-pytest.lock` — `flock` where there is one, a
-`mkdir` lock on macOS, which has none — and only then runs `python3 -m pytest
-tests -q`. Four suites ran at once on Eagle on 2026-09-14 past a guard written
-`pgrep -af '…' | grep -v pgrep >/dev/null`, which never waits: `grep` there is
-a shell function whose status is 1 when its stdout is `/dev/null`. The guard
-that does wait is anchored, split so it cannot match its own command line, and
-followed by the lock:
-
-```sh
-pat='^python3 -m pyt'"est"
-while [ "$(pgrep -f "$pat" | awk 'END { print NR + 0 }')" -gt 0 ]; do sleep 20; done
-PYTHONPYCACHEPREFIX="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache" flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest tests -q -p no:cacheprovider
-```
-
-`awk` and not `pgrep -fc`: `-c` is not in every `pgrep` this toolset runs
-under, and it is the COUNT and never `pgrep`'s exit status that decides.
-`tests/run.sh` is the canonical implementation of this guard — the lines above
-are it in one place, for a person with no checkout in front of them.
-
-The suite copies the lane commands and the shipped alias table into a sandbox
-BIN DIRECTORY, seeds a workspace repository with nothing but data in it, and
-writes that sandbox's own `workspace.yaml` to join the two — which is the
-world after Amendment 9, exactly. It unsets every `LANES_*` seam first, so
-what every case exercises is the DEFAULT resolution and not an override.
-
-A temp `HOME`, a bare repo and a clone seeded with a header and twenty-seven
-rows, a fake `tmux` that logs its renames and a fake `claude` that logs its
-argv. Amendment 7 adds a SECOND clone — the other workstation — so the race a
-claim can lose is run for real rather than described, and `project.yaml` /
-`family.yaml` fixtures for the leg detection. **No test may reach GitHub, and
-what guarantees that is `LANES_NO_GITHUB=1`**, exported over every case,
-plus `--no-github` on each: with it set, `gh_reads`, `gh_comment` and
-`gh_stale_claim_url` all return before any `gh` or `git ls-remote` call. The
-fake bin is *prepended* to `PATH`, not substituted for it, so a real `gh` on
-this workstation is still reachable and is not what stops the call. The last
-two assertions check that the real register and the real `lanes/log/` of the
-clone the suite was run from are untouched — the log check compares the
-directory listing taken before the first case with the one after the last,
-because `lanes/log/` carries real lanes' records now and *empty* was never the
-property being asserted.
-`lanes-edit.sh` runs **for real** against the sandbox register, so the commit,
-pull and push path is covered rather than stubbed, and liveness is a real
-`sleep` process and a reaped pid rather than a mocked `/proc`.
-
-## The object log (Amendment 7)
-
-**DRAFT, 2026-09-11, awaiting Brett Heap's word.** The register says where a
-lane *is*. It does not say what a lane *holds*: Rule 1 claims live in GitHub
-comments, Rule 6 landings live in `LANES.md` as free text, and "does anyone own
-this issue" has no answer short of reading 607 appended lines and 44 handoffs.
-This is the tooling half of that answer.
-
-### Layout
-
-| what | where |
-|---|---|
-| a lane's object log | `lanes/log/<lane>.md` — one file per lane, append-only. `<lane>` is the REGISTER ROW'S spelling (Amendment 15); a file left under another case is found by every reader and RENAMED to that spelling once, by the first write that touches it, inside that write's own commit — so git records the rename beside the line appended. Two plain `mv`s through a temporary name, because on a case-insensitive filesystem `mv a A` answers *identical* and renames nothing |
-| line 1 of each | `# lane <lane> — object log (lane-collision-protocol Amendment 7)` |
-| every other line | one EVENT, in the grammar below |
-| the alias table | two layers (Amendment 9(b)): the shipped `repos.tsv` installed beside the commands, then `<the checkout>/lanes/repos.tsv` where you keep an override. `alias<TAB>owner/repo`, case-insensitive. An override row replaces the shipped row for the same alias and adds rows it does not carry; an alias in neither is still a refusal saying to spell it `owner/repo` |
-| the only writer | `lanes-edit.sh` (`log`, `claim`, `release`), as for `LANES.md` |
-| the reader | `lanes-edit.sh who` |
-
-One file per lane is what makes this safe from two workstations at once: two
-lanes writing at the same moment touch two different files, so what a shared
-file would turn into a conflict is a fast-forward here. **There is no index.**
-A read fetches and greps; 45 lanes' logs together are smaller than one of the
-register's rows.
-
-**Every state read is of `origin/main`, after a `git fetch` — never of the
-working tree.** What has LANDED is what other lanes can see, and a working
-tree can be behind by a peer's whole day: `who`, `claim`'s pre-check, the
-staleness test, the superseded filter, the crossing warning, `lane-end`'s
-refusal and `lane-start`'s home lookup all read the same source, so they
-cannot disagree with each other either. `LANES_NO_FETCH=1` (and `who
---no-fetch`) skips the fetch for an offline lane and for the tests; it does
-not change what is read, only how current the ref is.
-
-`LANES.md` is unchanged. Its rows are still its rows, and its Rule 6 `LANDING`
-/ `LANDED` lines still land in it, because every lane already reads them there
-as the merge hold — which is why `who --landing` reads *those* and not the
-logs. A `LANDING` or a `LANDED` therefore writes **both files in one commit,
-with two pathspecs**: there is no moment at which only one of them has been
-written.
-
-### The grammar
-
-```text
-<VERB> — lane <lane>, session <transcript-uuid>@<workstation>, <UTC>, <object>[ → <payload> | ← <payload>][ — <free text>]
-```
-
-The verb is **one token**. The first four fields are separated by `, `. The
-**object token contains no space and no comma**, so the payload begins
-unambiguously at the first space after it; payload sub-fields are separated by
-`; ` and several refs are space-separated.
-
-| kind | verbs |
-|---|---|
-| issue | `CLAIMED`, `RELEASED`, `TAKEOVER ← <stale claim URL>`, `CLOSED → owner/repo#pr` |
-| PR | `OPENED ← owner/repo#i [owner/repo#j …]`, `LANDING`, `LANDED → <sha>`, `WITHDRAWN`, `CLOSED` |
-| issue or PR | `TAKEOVER ← lane:<dispossessed lane>` |
-| lane | `STARTED`, `PAUSED`, `RESUMED`, `ENDED`, `RETIRED` |
-| narrative | `NOTED`, `RULED [→ <object>]` (Amendment 13(b)) |
-| race | `CLAIM-LOST → lane:<other>` |
-
-There is no `MERGED`: Rule 6's `LANDED → <sha>` is already the post-merge line.
-
-**Every line has an object**, lane-kind lines included — theirs is the lane:
-
-```text
-STARTED — lane openRepoProject-1, session 09dd34d1-3afe-43a1-88fc-c33c92c08088@Eagle, 2026-09-11T19:08:12Z, lane:openRepoProject-1 → home opensoft/openRepoProject; estate openRepoProject
-```
-
-`PAUSED`, `RESUMED`, `ENDED` and `RETIRED` carry the same `lane:<name>` object
-and no payload. So do Amendment 13(b)'s `NOTED` and `RULED` — and `RULED` takes
-one optional payload, the object the ruling bears on: `RULED — lane <lane>,
-session <uuid>@<ws>, <UTC>, lane:<lane> → opensoft/openRepoTools#29 — <the
-words, verbatim>`. **Neither is a transition**, so neither ever changes a lane's
-state on any object or on itself: `who`, `lane-end`, `lanes` and `swapped` skip
-them exactly as they skip `STARTED` and `RESUMED`.
-
-**The `<lane>` field and the `lane:<name>` object are matched
-case-insensitively, and a writer writes the register row's spelling into both**
-(Amendment 15). A log is append-only and its lines carry whatever was typed on
-the day it was written: `lanes/log/openxfactory-2.md` holds `lane
-openXfactory-2` lines from 2026-09-02 beside the `lane openxfactory-2` lines of
-the 23:51Z incident, in one file, about one lane. `who --lane`, `lane-end`'s
-refusal and the `lanes` listing read both as that lane's; the old lines are
-never rewritten.
-
-**The object kinds in scope** are an issue or PR (`owner/repo#<n>`), an
-OpenSpec change directory (`owner/repo:openspec/changes/<name>`), and — for
-the lane-kind lines only — `lane:<name>`. `#<n>` is shorthand for the lane's
-**own** home repo; a foreign repo is always spelled, so that crossing is
-explicit at the moment it is typed. Human acts, realization groups, contract
-cuts, file surfaces and Amendment 1's substrates stay where they are today, on
-their governing records, and are an explicit non-goal; a later amendment may
-add keys.
-
-The alias table resolves an omitted owner and the register's legacy
-spellings — all four spellings of `codexFactory` resolve to
-`codeXfactory/codexFactory`, which is the redirect GitHub itself answers with —
-and an alias that is **not** in the table is refused, with the hint to spell
-`owner/repo`. Guessing is how a fifth spelling of one repository gets created,
-so spellings that could not be resolved (`oxF`, `xF`, `OMI`, `OWI`, and the
-bare `InkRouter` and `IRSS`, which are ambiguous between two orgs) are left out
-deliberately rather than guessed at.
-
-### State is per lane
-
-**A lane's state on an object is that lane's own LAST line naming it.** The
-lane HOLDS the object while that verb is open; the object is HELD when any lane
-holds it.
-
-- **open** — `CLAIMED`, `TAKEOVER`, `OPENED`, `LANDING`, `WITHDRAWN`. A
-  withdrawn landing leaves the PR held by the lane that withdrew it.
-- **closed** — `RELEASED`, `CLAIM-LOST`, `CLOSED`, `LANDED`. **A closing verb
-  closes only the writing lane's hold**, never another lane's.
-
-That last sentence has a consequence worth knowing before it bites: after
-another lane's `TAKEOVER`, the dispossessed lane's own last line is still its
-`CLAIMED`, so `who` marks it `superseded by TAKEOVER (lane:<X>)` rather than
-counting it as a holder, and `lane-end` — which would otherwise refuse for
-ever — names the one act that frees it:
-
-```text
-CLAIMED opensoft/repoG#8 (…) — taken over by lane:repoG-2 at 2026-09-11T20:00:51Z;
-  run: lanes-edit.sh release opensoft/repoG#8 "taken over by repoG-2"
-```
-
-**A `TAKEOVER` supersedes only while it is the taker's own last line on the
-object.** Per-lane last-line semantics apply to the taker too: once lane B
-writes `RELEASED`, `CLOSED` or `LANDED` on the object, B's `TAKEOVER` supersedes
-nothing, and a later `CLAIMED` by the lane it dispossessed holds normally. A
-`TAKEOVER` is never removed from an append-only log, so treating one as
-superseding *for ever* made a legitimate re-claim invisible: `who` called a held
-object FREE, `claim` did not refuse the next lane — the one outcome Rule 1
-exists to prevent — and `who --lane` and `lane-end` disagreed about the same
-object. No clock and no cross-file order is needed to ask this: both halves are
-"what is this lane's last line", read off two append-only files.
-
-**A chain of takeovers resolves to its last link** (opensoft/openRepoTools#74).
-The dead-lane exception below lets a `TAKEOVER` displace an earlier `TAKEOVER`
-— `A` claims; `B` takes over from `A`; `C` takes over from `B` once `B` is
-dead — and every link that displaces a `TAKEOVER` names the lane it displaced
-as `TAKEOVER ← lane:<x>` (a stale claim's comment URL is only ever the payload
-for a `CLAIMED` taken over). So a lane whose own last line is a `TAKEOVER` is
-displaced only by another lane's standing `TAKEOVER` that **names it**: `B` by
-`C`, and `C` by nothing, so `C` alone holds the object. Any other open verb is
-displaced by any standing `TAKEOVER`, as above, and the taker named is one no
-other standing `TAKEOVER` names: `A`'s line reads `superseded by TAKEOVER
-(lane:C)`. Read one hop at a time — "does some other lane's last line here
-read `TAKEOVER`" — `B`'s own stale `TAKEOVER` was proof that `C` was displaced
-too: `who` reported **zero** holders, `who --lane C` told `C` to release an
-object it held, and `claim` granted the next lane a plain `CLAIMED` over it.
-
-*Known, deliberate.* Two lanes that each end on a `TAKEOVER` of one object,
-**neither naming the other** (two takers of one stale claim), are **both**
-reported as holders; so are two whose `TAKEOVER`s name *each other*, which no
-file order can put in order. That is a visible conflict rather than a silent
-one, and it is not reachable through the helpers in the ordinary case — a live
-lane's `claim --force` takes over a stale `CLAIMED` and nothing else (or, per
-the dead-lane exception below, a **dead** lane's hold of any verb, an earlier
-`TAKEOVER` included), and refuses outright when more than one lane holds the
-object.
-
-**State is read in FILE ORDER, never by comparing timestamps.** A lane's log is
-append-only and single-writer, so its line order *is* that lane's write order,
-and "its last line naming the object" means the last such line **in the file** —
-a `LANDING` and its `LANDED` are often written in the same second, and on a
-workstation whose clock steps backwards the second of them is stamped earlier.
-The UTC stays on every line as information and is compared only where a
-**duration** is the rule — Rule 1's four hours and Rule 6's thirty minutes —
-because no two workstations share a clock (this one was observed jumping ±25s
-on 2026-09-11, and a log commit landed carrying a UTC 26s after its own
-committer date), and which lane got somewhere first is landing order on `main`
-rather than a stamp.
-
-**No line is ever dropped silently.** A line the parser cannot read is
-reported as `unreadable: lanes/log/<lane>.md:<n> (<why>)` and counted, because
-in an append-only log that nothing rewrites, a dropped line is a hold no tool
-will mention again — `who` would call the object free, and it is not. A UTC
-without seconds (`2026-09-10T20:31Z`) is read, not dropped: the register has
-been writing that form since before this helper existed.
-
-### `log` — the generic append
-
-```sh
-LANES_LANE=openRepoProject-1 lanes-edit.sh log OPENED opensoft/brett-wip#14 ← brettheap/new-workstation#11
-```
-
-Validates the verb and the object key, appends one line, and commits it as
-`LOG(<lane>@<workstation>): <VERB> <object>`. A lane verb takes a `lane:<name>`
-object and an object verb refuses one.
-
-It **refuses the four verbs that have a guarded subcommand of their own** —
-`CLAIMED` and `TAKEOVER` (use `claim`, `claim --force`), `RELEASED` (use
-`release`), and `CLAIM-LOST`, which only a lost race writes — and names the
-subcommand in the refusal. `log CLAIMED` would otherwise skip the pre-check,
-the race and the rescan while `who` reported the result identically to a real
-claim, and `log TAKEOVER` would skip the staleness test that is the only thing
-making a takeover legitimate. `OPENED`, `LANDING`, `LANDED`, `WITHDRAWN`,
-`CLOSED` and the lane verbs are exactly what `log` is for. `--text "<t>"` sets the free text when
-there is no payload to put it after. The session id is `$LANES_SESSION`, else
-the **last** transcript uuid in the lane's row — the lane's current session
-under Amendment 6(b).
-
-### `claim` — Rule 1 as one act
-
-```sh
-LANES_LANE=openRepoProject-1 lanes-edit.sh claim brettheap/new-workstation#11
-```
-
-**The race is decided by which `CLAIMED` LANDS on `main` first — never by
-comparing timestamps.** Two workstations' clocks are not a shared order; git's
-push serialization is, and the `mkdir` mutex in this helper only serializes one
-workstation. So:
-
-1. `git fetch origin`, and pre-check against **`origin/main`** — what has
-   landed is what other lanes can see, and a working tree can be anything.
-2. If another lane holds it, print `who` and **exit 2**: Rule 1 says the lane
-   stops and reports, it does not author a successor. Nothing is written.
-3. Run Rule 1's three reads and print them; warn if this is a crossing.
-4. Append the `CLAIMED` line, commit, push. Inside that push, after every
-   `pull --rebase`, rescan: if another lane's `CLAIMED` or `TAKEOVER` is
-   already on this history, **theirs landed first** — append
-   `CLAIM-LOST → lane:<winner>`, push both lines, and **exit 7**. The claim is
-   *abandoned*, not queued; Rule 7's queueing is for substrates, which this
-   amendment does not touch.
-5. Post the GitHub `CLAIMED —` comment **after** the push, citing the commit
-   that carries the line. The line is never rewritten to cite the comment.
-
-A claim needs a checkout it can rebase. Amendment 5(d) *skips* `pull --rebase`
-when a peer has left uncommitted changes to other files in this shared
-checkout — the right default for a row edit, and unacceptable for a race — so
-`claim` **refuses (exit 2) and names the files** instead of racing unprotected.
-
-The guard is computed over the **whole checkout** — every tracked file that
-differs from `HEAD`, staged or not — minus exactly the pathspecs this write
-will commit, and `log` and `release` are guarded the same way. Scoped to
-anything narrower it was a hole: measured against (the lane's log + `LANES.md`)
-while a `CLAIMED` writes the log alone, a dirty `lanes/LANES.md` — the one file
-this checkout routinely has dirty — passed the guard, took the skip-the-pull
-branch, and raced with the rescan disabled, leaving two lanes holding one
-object. The exception is plural on purpose: a `LANDING` or `LANDED` writes two
-files, so a dirty register is *its* business and is captured as its own
-attributed commit, exactly as before.
-
-`claim`, `release` and `log` first take that same pre-existing capture for the
-register — a peer's uncommitted `lanes/LANES.md` lands as its own attributed
-`LANES(pre-existing@<workstation>): …` commit, with the warning every register
-write already prints — and only then re-test the checkout, because this clone
-carries a half-written register line most of the day and refusing every claim
-on it would push lanes to stop using the tool. Any **other** modified tracked
-file outside the write's own pathspecs is still a refusal (exit 2), and it is
-taken before the lock and before the capture, so a write that refuses never
-leaves a commit of somebody else's line behind.
-
-**Reads 2 and 3 name the object, not its digits** (Amendment 8). They searched
-for the bare slug as a *substring*, and a number is a substring of almost
-everything: claiming `brettheap/new-workstation#15` printed somebody else's
-PR #10 — GitHub's own search had matched `15` in its text — and a 40-character
-commit sha out of `ls-remote`, both under the heading *existing work on this
-object*. Evidence that is not evidence is how a lane talks itself out of a claim
-it should make, or into one it should not. **Two reads, two tests**, because the two
-inputs are not the same kind of text. `gh pr list`'s rows are **prose**, so a
-reference is `#<n>` — the hash required, its left side unbounded, because the
-canonical spelling is `owner/repo#15` and the character before the `#` is a
-letter — or the row's own number column, which is the PR the object *is*.
-`ls-remote`'s refs are **names**: `issue-15-fix` carries no hash, so there the
-test is the bare number as a whole token, after the leading sha has been
-stripped, so a branch is matched by its name and never by the digits of the
-commit it points at. An OpenSpec change directory has a word for a slug and
-takes the whole-token test in both.
-
-**Read 2 filters over the body.** `gh pr list`'s columns are number, title,
-branch and state; the reference that makes a PR a sibling is almost always in
-its **body**, which is what GitHub's own search matched and what the columns do
-not carry. Filtering the columns alone dropped the real PR for this very
-issue — whose body says `brettheap/new-workstation#15` twice — while a filter
-with the hash optional kept the wrong one instead. So the body is fetched,
-flattened to one line, used for the test, and cut off again before anything is
-printed: under-reporting a sibling is the direction that lets a lane claim what
-somebody else is already working on, and it is the one direction Rule 1 cannot
-afford.
-
-The filter is the `sibling-filter <object> [--branch]` subcommand, which both
-reads pipe through and which can be held to account on its own:
-
-```console
-$ printf '10\tbump the pin to 1150\n15\tthe amendment 8 work\n' | lanes-edit.sh sibling-filter opensoft/repoE#15
-15	the amendment 8 work
-```
-
-`--no-github` skips every `gh` call, for the tests and for an offline lane. A
-line written that way is **not yet a Rule 1 claim**, because the comment a
-person outside this estate reads does not exist, so it carries the free text
-`no-github` and `who` prints it as `local only — no GitHub claim comment`.
-Otherwise **the log is authoritative for a claim made through `claim`** — a log
-line *is* a live claim for Rule 1 purposes — and the GitHub comment is the copy
-another person reads.
-
-**Stale**, made checkable from Rule 1's own words: a lane's `CLAIMED` on an
-**issue** is stale when it is older than four hours *and* that lane has written
-no later `OPENED` whose `←` payload names the issue. A PR is never stale by
-this rule — Rule 6 governs PRs, with its own thirty minutes. An object is taken
-to be a PR once some lane has written `OPENED` on it, which is the only
-offline evidence there is and exactly the evidence Rule 1 cares about.
-`--force` takes over a stale claim — or, per the dead-lane exception just
-below, a dead lane's hold of any verb — and nothing else, writing one of TWO
-payload forms for either reason (Copilot round 9, PR #61: this sentence
-named only one). `TAKEOVER ← <the stale claim's comment URL>` when the hold
-taken over was itself a `CLAIMED` posted as a GitHub comment and that
-comment can still be found; `TAKEOVER ← lane:<the dispossessed lane>`
-whenever it cannot — always true for a dead lane's own `OPENED`, `LANDING`,
-`WITHDRAWN` or earlier `TAKEOVER` (none of those was ever a `CLAIMED`
-comment to find), and also true under `--no-github` or a search that simply
-comes up empty. `TAKEOVER` is itself an open verb, so no second line is
-needed either way to say the taker holds it.
-
-**Or the holder's LANE is dead, whatever the verb** (opensoft/openRepoTools#30).
-Staleness answers Rule 1's own question about one claim; it says nothing about
-a lane that went silent and was retired, leaving an `OPENED` PR or a fresh
-`CLAIMED` issue behind that neither gate above will ever call takeable — the
-verb-check refuses the PR outright, and a `CLAIMED` lane that later `OPENED` a
-PR naming it is deliberately never stale, which is exactly backwards once the
-lane itself is gone. `--force` also takes over a hold of ANY open verb when the
-holder's own object log ends its lane-kind lines (`STARTED`/`PAUSED`/
-`RESUMED`/`ENDED`/`RETIRED`) on `ENDED` or `RETIRED` — a swap (`PAUSED`) is
-deliberately not dead — **and** no live session for it is found on this
-workstation (`live_holder`, the one liveness implementation this file has,
-never a second one): a `RETIRED` register line is not proof by itself that
-nothing is still running under that name (opensoft/openRepoTools#39), so the
-register's verdict is checked before it is trusted. **That check is made only
-from inside the lane's last binding** (Amendment 18(b)): the `host` and
-`container` of its last `STARTED`/`RESUMED` before the terminal line must be
-this place's — a line from before Amendment 18(a) is matched on its own
-workstation — or the binding's window must be gone from a tmux server this
-host shares with it. A lane last bound anywhere else is UNKNOWN, never dead,
-and `--force` refuses it, naming that binding. The session ids that check asks
-about are the row's, published and this checkout's own, so a register that
-could not be read is refused as well: it never confirms a lane dead
-(opensoft/openRepoTools#67). Before this the only path
-was a `release` of the dead lane's held objects by hand, one at a time, run
-under its own name on the taker's word.
-
-**A crossing warns; it never refuses** (Brett Heap, 2026-09-11: "yes just
-warn"). Crossing is routine — `opsXfactory-3` landed **32 distinct PRs** into
-`opensoft/Omnigent-Install`, every one of them foreign to its home, and
-`openXfactory-3` landed 23 foreign of 31 — so a refusal here would be a new
-gate nobody asked for. `claim` names every lane homed on the target repo that
-is live (or on another workstation), with its address and last transcript uuid:
-
-```text
-WARNING: CROSS-REPO — opensoft/workBenches is not lane openRepoProject-1's home (opensoft/openRepoProject).
-  LIVE lane homed on opensoft/workBenches: @workBenches-2 — last transcript uuid 4f2c8e10-...
-```
-
-Repos that are **legs of one `project.yaml`** are not a crossing: the manifest
-is looked for one and two levels under `~/projects`, and only
-`legs[].repository` is read — the manifest says of itself that it confers
-nothing, and `role:` is never consulted. A `family.yaml`'s `members:` is
-deliberately *not* read: a family is broader than a project, and two of its
-members are two projects with two lanes.
-
-### `release`
-
-```sh
-LANES_LANE=openRepoProject-1 lanes-edit.sh release brettheap/new-workstation#11 "superseded by #12"
-```
-
-A `RELEASED` line and the matching GitHub comment (`--no-github` skips it). It
-never refuses: releasing something this lane does not hold is a note, not an
-error, and it is also the act that closes a dispossessed lane's own line after
-someone else's takeover.
-
-### `who` — the read
-
-```console
-$ lanes-edit.sh who brettheap/new-workstation#11
-object   brettheap/new-workstation#11
-HOLDS    lane openRepoProject-1        CLAIMED   2026-09-11T19:08:12Z (2h 14m ago)
-state    HELD
-holder   lane openRepoProject-1 (CLAIMED, 2026-09-11T19:08:12Z)
-  stale    no — 2h 14m old, threshold 4h
-  home     opensoft/openRepoProject
-  holder   lane openRepoProject-1 — LIVE (session 09dd34d1-3afe-43a1-88fc-c33c92c08088, pid 779114, tmux claude-team-05f-20260911150206-778763:@460.%460)
-  address  @openRepoProject-1 · claude --resume 09dd34d1-3afe-43a1-88fc-c33c92c08088
-  handoff  handoffs/openRepoProject/session-handoff-2026-09-11-lane-openRepoProject-1.md
-  log      lanes/log/openRepoProject-1.md
-```
-
-```sh
-lanes-edit.sh who --lane openRepoProject-1     # what this lane holds open
-lanes-edit.sh who --landing opensoft/brett-wip # the Rule 6 merge hold on a repo
-```
-
-`who --landing` reads **LANES.md's own Rule 6 lines**, not the logs, because
-those are written for every lane, before this amendment and after it. Landings
-are counted as distinct `(lane, repository, PR)` **triples**, never as raw
-`LANDING` lines: a retry re-posts `LANDING` for the same PR, and the register
-holds 571 such lines for far fewer landings. The repository is part of the key
-because one lane landing into several repositories is this estate's norm —
-keyed on `(lane, PR)` alone, a lane's `LANDED` on one repository closed its own
-still-open `LANDING` on another whenever the two PR numbers matched, and the
-merge hold went invisible. The repository is lower-cased in the key only, so a
-`LANDED` spelled `OpsxFactory` still closes a `LANDING` spelled `opsXfactory`.
-Both sides are resolved through `repos.tsv` before they are compared, so a
-`LANDED` into `opensoft/OpsxFactory` closes a `LANDING` into `OpsxFactory` —
-one repository the register writes both ways, 70 Rule 6 lines against 23 at
-`8f9c04d` — the triple's repository is the canonical `owner/repo`, and an
-alias the table does not know keeps its own spelling.
-
-**A `LANDED` closes the `LANDING` it answers, paired by `(lane, PR)` in file
-order.** Every `LANDING` in the register carries `into <repo> main`; most
-`LANDED` lines do not — 300 of 329 on 2026-09-12 — so keying a `LANDED` on the
-repository *it* names keyed those 300 on the empty string, where they could
-never close the repository-qualified `LANDING` they belonged to. Measured over
-the real register at `ee0e07c`, that reported **232 open merge holds** where
-the genuinely open count was **one**: on cutover day `who --landing` would have
-told the first lane to ask that essentially every repository it wanted to land
-into was held. So the *pairing* is by `(lane, PR)` — a `LANDED` closes the most
-recent still-unmatched `LANDING` of that lane and PR, and the pair's repository
-is the **LANDING's** — while the *result* still keys on the triple, which is
-what keeps a `LANDED` on one repository from closing a `LANDING` on another.
-
-A `LANDED` that *does* name a repository must name that `LANDING`'s. If it does
-not, it closes nothing and is printed against the repository it names as
-
-```text
-unpaired LANDED  opensoft/repoOTHER#32  lane repoT-1, … — the open LANDING for
-  (lane repoT-1, PR #32) is on opensoft/repoT, so this closes nothing
-```
-
-rather than being dropped: an append-only register is never rewritten, so a
-line no tool mentions again is a line nobody will reconcile. One consequence is
-worth knowing: when a lane has two `LANDING`s open on one PR number in two
-repositories and lands the **earlier** one while naming its repository, the
-`LANDED` reads as unpaired and both holds stay open until the second lands.
-Two holds reported where one is real is the safe direction, and the shape is
-rare; a `LANDED` naming a repository at all is one line in eleven.
-
-A `LANDING` past **Rule 6's thirty minutes** with no `LANDED` is marked
-`STALE (Rule 6: >30 min)` and still listed — the line is reported, the reader
-is told it is past the window. After the register's holds, the lane logs are
-reported under `from lane logs (secondary):`: they are evidence beside the
-register, never instead of it.
-
-**An empty answer is an answer.** `who --lane <lane that holds nothing>` and
-`who --landing <repo with no hold>` print `none open …` and exit **0**; 8 is
-reserved for genuine absence — a lane with no log file, or an object no line
-anywhere names. A script that gates on `if who --landing <repo>` must be able
-to read the healthy case as success.
-
-`--home owner/repo` supplies the home repo for a lane whose log has no
-`STARTED` line yet, which is what `#<n>` needs to expand. It is an option of
-`claim`, `release`, `who`, `log` and `lane-end` — **five**. It is resolved through `repos.tsv` and
-then **validated** against `owner/repo`, and it is **refused (exit 2) where the
-lane's own `STARTED` line already answers the question**, so the log and the
-flag can never disagree. All five resolve it **after the fetch**, because the
-`STARTED` line that refuses it may be a peer's and live only on `origin/main`.
-Unvalidated it was a hole straight through the alias discipline: `--home 'not
-a repo'` wrote `not a repo#42` into the log — a line the log's own parser
-cannot read back, in a file nothing ever rewrites.
-`lane-start` checks its own answer the same way, so a checkout whose `origin`
-is a path or a mirror records `home unknown` rather than something every `#n`
-in that lane would then inherit.
-
-### Liveness
-
-**One implementation**, in `lanes-edit.sh`, which `lane-start` asks for through
-its internal `live-holder` subcommand. Two copies would drift, and this is the
-check that decides whether a lane name is free.
-
-Amendment 8 adds a second read over the same records, keyed on the **window**
-rather than on a lane: `window-session <tmux session>:<window id>` prints the
-live record whose own `tmux` field names that window —
-`<uuid> <tmux> <name> <pid> <profile>`, `\037`-separated, **0** with the
-record, **8** when the records were read and none is in that window, **1** when
-they could not be read at all. Where several live records name one window — a
-session that outlives the window it started in keeps the `tmux` value it was
-born with — the most recently updated one wins, so the answer does not depend on
-which the filesystem listed first. The three live tests are shared with
-`live-holder`; the two that are about a *lane* — the row's ids and the
-`nameSource` rule — are not applied, because a window holds one interactive
-session whatever it is called, and the record's name is reported rather than
-believed. The profile is read off the record's own path, never from the
-environment of whoever is asking.
-
-A lane is LIVE when a session record **on this workstation** carries one of the
-row's transcript uuids, its `status` is not one of `ended`, `exited`, `dead`,
-`stopped`, its pid is alive, and `/proc/<pid>/stat` field 22 still equals the
-`procStart` the record wrote down. Every uuid in the row's session cell is
-tried, not only the last: a lane whose earlier lineage is still running is
-still held.
-
-A record's `name` is evidence about *another* lane only when a person or a
-`--name` set it. **The rule is the SET: EXPLICIT is `{user, peer}`, and
-everything else — `derived`, `auto`, any other value, and no field at all — is
-MACHINE**; a record is skipped for a differing name only when its `nameSource`
-is EXPLICIT. The census is evidence for the set, not the rule, and it moves:
-measured across this workstation's records at 2026-09-11T21:04Z, `derived`
-273, `user` 31, `peer` 9, `auto` **0**, and 26 records carrying no
-`nameSource` at all — which is why "no field" has to be named in the rule
-rather than left to a census that happens to contain a value today.
-
-This is a fix, not a preference. On 2026-09-11 this orchestrator's own record
-read `name: openrepoproject-63, nameSource: derived` while it held lane
-`openRepoProject-1` — pid alive, `procStart` matching, status `busy` — and the
-old filter skipped it on the name alone, so `lane-start --dry-run` reported *no
-live session holds openRepoProject-1* and a second window would not have been
-refused the lane. After the operator ran `/rename openRepoProject-1` the same
-record read `openRepoProject-1` / `user`, and the check reported the holder.
-Records are enumerated with `find … -path '*/sessions/*.json'`, never a
-one-level glob: team profiles live two levels down.
-
-A holder recorded on **another workstation** reads
-`UNKNOWN (records are local to <ws>; ask @<lane> or read its handoff)`, never
-`NOT LIVE` — session records are local files, and this machine has no way to
-make that claim about another.
-
-**And so does a read this workstation could not perform.** `live-holder` has
-three answers and never two of them conflated: **0** with the holder, **8** for
-"the records were read and nothing live holds this lane", and any other non-zero
-for "I could not read them" — an unreadable tree, an unreadable record, a
-permissions or IO fault. `lane-start` renames a window on 8, so mapping a failed
-read to 8 as well is exactly how a running lane loses its address: the rename
-mints `<lane> (2)`. `who` prints that third answer as
-`UNKNOWN (this workstation's session records could not be read…)`, for the same
-reason it never says `NOT LIVE` about another machine.
-
-**Every row `who` reads comes from `origin/main`, like the logs.** The session
-cell, the handoff path and the workstation column are read with
-`git show origin/main:lanes/LANES.md` after the fetch — nothing in `who` reads
-the working tree. A row that existed only on `origin/main` used to lose the
-resume uuid and the handoff path, which are the two things `who` exists to hand
-over; and a peer's *uncommitted* edit to column 3 turned a lane on Raven into
-`NOT LIVE`, which is the confident false report that sends a reader to
-`claim --force` against a live lane.
-
-**The one read that also consults this checkout is the `live-holder`
-subcommand, and only its id SET** — the union of the published row's transcript
-uuids with this checkout's row's. A session stamps its own uuid on the row with
-`replace-in-row`, and that write is a local commit for as long as its push takes
-(and longer, whenever a peer's file is blocking the rebase): read from
-`origin/main` alone, the rename gate would not see the uuid of the session it is
-being asked to rename over, would answer 8, and `lane-start` would take the name
-— which is exactly what mints `<lane> (2)` and costs a running lane its address
-(AGENTS.md rule 7). Liveness fails closed, so an id `origin/main` has not seen
-yet is one more reason to REFUSE a rename and never a reason to allow one, and
-nothing that PRINTS uses the union: `who` reads the published row and nothing
-else.
-
-### Exit codes
-
-| code | meaning |
-|---|---|
-| 0 | done, including `commit`'s publish of a queue that `pull --rebase` emptied because origin already held every commit in it by content (#194; it says so, and sends no push) |
-| 1 | environment — no register, no writer |
-| 2 | refusal — bad arguments, the object is held, an unknown alias, a checkout that cannot be rebased, or `commit` refusing to publish local commits that are not register or handoff writes, from a checkout whose HEAD is off the branch, or that it cannot read (#194; it pushes none of them) |
-| 3 | the edit is never a permanent loss, but this attempt cannot confirm whether it also reached origin — a rebase conflict (not pushed by this attempt; a later write from this checkout may already carry it to origin, so look by content before you retry), a network timeout on a push or a pull (a hung one often already landed), or six attempts exhausted because a peer's uncommitted file blocks every rebase |
-| 4 | the mutex could not be taken within 60s |
-| 5 | an edit moved more than one line and was refused — or a register rewrite whose copy, write or result could not be proved (#120 item 1). The copy every proof is made against is compared with the register, and what lands with what was built; where a write cut the register short, its earlier bytes are put back and proved first, and the refusal says which of the two the register holds — never "unchanged" about a register the write truncated |
-| 6 | `git add` / `commit` / `push` failed |
-| 7 | another act got there first and this one wrote nothing: `claim`'s `CLAIM-LOST` (another lane's claim landed first), and `set-lane-state` / `set-lane-tree`'s lifecycle fence (openRepoTools#91, below) |
-| 9 | `CLAIM-LOST` — issue #30's own dead-lane verdict could not be reconfirmed before a `--force` takeover's push landed: the source lane resumed, a live session now backs it up, or that could not be read at all (`claim` only). Never 7 — that code is a RIVAL's claim, and this is the same lane the takeover was granted over |
-| 10 | `lane-state`: the lane's lifecycle snapshot is there and could not be read, or is of this schema and not a whole record, so nothing can be read out of it as a snapshot (openRepoTools#91 and #115, below) — never the 8 that means it has none. It was 9 until #61 spent 9 on `claim`. `lane-trees`: the lane's `trees` directory is there and could not be listed (#157 item 4e) — never the 8 that means it recorded no tree |
-| 8 | no record — and no other meaning |
-| 64 | `swapped`'s own usage error — never the dispatcher's 2 — and the lifecycle arms' own: `set-lane-tree`'s partial observation, a count that is not one, or a field that is only blanks (below) |
-
-3 to 6 are the codes this helper already used; 7 and 8 were free.
-
-**8 means "there is no such record", and nothing else.** `who <object>` exits 8
-when no line anywhere names the object; `who --lane <lane>` exits 8 when the
-lane has no log file; the internal reads `lane-start` and `lane-end` use follow
-the same rule — `lane-objects` exits 8 for a lane with no log, `live-holder`
-exits 8 when the session records were READ and no live one holds the lane
-(the ordinary answer for a parked lane) and never when it could not read them,
-`register-row` exits 8 when the PUBLISHED register has no row for the lane
-(and **2**, not 8, for a name that is not lane-shaped at all — a malformed
-argument is a refusal, never an absence), `resolve-home` exits 8 when the lane
-has no home on record and none was passed, `swapped` exits 8 when no lane is
-swapped on the workstation, `idle-holders` exits 8 when no live but idle
-session holds one of the row's earlier ids, and `window-session` exits 8 when
-no live session is in the window.
-
-**`swapped` exits 64 on a usage error of its own, never 2.** The launcher gates
-its whole Amendment 8 degrade on a `2` from `swapped` meaning one thing —
-*this `lanes-edit.sh` predates Amendment 8 and has no such subcommand*, which
-is the dispatcher's unknown-subcommand code. A caller's own bug must not be
-indistinguishable from an old helper at the one place the degrade is decided,
-so `swapped` answers `0` rows, `8` none swapped, `64` a bad call, and leaves
-`2` to mean *no such subcommand* alone. `session-start` is the one subcommand that never exits
-anything but **0**: it is a hook.
-Every other non-zero code from any of them is a FAILURE, and `lane-start`
-and `lane-end` treat only 0 and 8 as answers: anything else is a refusal
-(exit 1) that prints the helper's own stderr and renames and writes nothing.
-They used to return 1 for both, and both scripts read 1 as an answer — a
-broken helper made `lane-end` end a lane that was holding an open claim while
-telling the next session it was pre-cutover, and made `lane-start` announce
-`no live session holds <lane>` about a session that was live in another
-window.
-
-### Before the cutover
-
-A lane with **no log file** has not written a line since this amendment landed,
-and nothing pretends otherwise:
-
-- `who --lane <lane>` says `no log for <lane>; see its row's state cell` and
-  exits 8;
-- `lane-end` falls back to the old substring scan of the state cell, and says
-  that is what it is doing — over BOTH this checkout's row and the published
-  one (`register-row`), either of which showing a hold being a refusal: a fetch
-  does not move a working tree, so a peer's `LANDING` appended to the row and
-  pushed was invisible to the one path that still decides a merge hold from
-  prose;
-- `who --landing` still sees that lane, because it reads `LANES.md`;
-- existing rows keep their state cells untouched. Nothing is migrated and no
-  history is rewritten.
-
-### `lane-start` and `lane-end` under this amendment
-
-`lane-start` appends `STARTED` (or `RESUMED`, following its launch decision)
-**after** the row write, carrying `home owner/repo` taken from
-`git remote get-url origin` of the lane's own directory. `<repo>-<n>` is a
-label, not a scope; this line is the only thing that says where a lane actually
-lives. A checkout with no `origin` records `home unknown` rather than a guess,
-and says so.
-
-**The home is canonical.** That spelling is resolved through the alias table
-— both layers, the shipped `repos.tsv` and the checkout's override (Amendment
-9(b)) — *before* the line is written, and every comparison of an object's
-repository against a home resolves both sides — because a home is inherited by every `#<n>`
-that lane ever writes. A checkout whose `origin` still said
-`opensoft/codexFactory` wrote object keys that could never collide with another
-lane's `codeXfactory/codexFactory#<n>`, so two lanes held one GitHub issue under
-two keys and nothing detected it. A spelling the table has no row for is
-recorded exactly as `origin` gives it, with a note asking for a row — guessing
-is how the fifth spelling of one repository got into the register.
-
-`lane-end`'s refusal is now **exact**: every object whose last line in this
-lane's own log is open is named, with the takeover case naming its own fix, and
-the recovery it prints is in the helper's real CLI grammar — one of
-
-```sh
-LANES_LANE=<lane> lanes-edit.sh log LANDED <object> → <merge sha>    # the PR merged
-LANES_LANE=<lane> lanes-edit.sh release <object> "<why>"             # the claim is given up
-LANES_LANE=<lane> lanes-edit.sh log CLOSED <object>                  # closed without merging
-```
-
-The arrow is its **own argument**. Quoted into the free-text slot
-(`log LANDED <obj> "→ <sha>"`) the sha lands *after* the ` — `, the line stops
-matching `LANDED → <sha>`, and the register's Rule 6 line loses the merge sha
-for good in a file nothing rewrites. There is no `MERGED` verb at all, and
-`log RELEASED` is refused — `release` is the subcommand, and it posts the Rule 1
-comment too.
-
-`--force` records what it overrode, in the grammar's own shape:
-
-```text
-ENDED — lane X, session <uuid>@<ws>, <UTC>, lane:X — forced; open: opensoft/repoX#11, opensoft/repoX#12
-```
-
-` — ` occurs exactly **twice**, which is the guarantee that lets one parser read
-every line, and the free text names the objects the lane's own log showed open
-rather than blaming a state cell the script never read. **The writer enforces
-that**: it refuses any payload or free text containing ` — `, or a newline,
-before the lock and before anything is created. It
-also prints a generated handoff fragment on **stdout** — `## Done (RELEASED,
-CLAIM-LOST, CLOSED, LANDED)` and `## Open (CLAIMED, TAKEOVER, OPENED, LANDING,
-WITHDRAWN)`, from the log, each header naming the set it partitioned by — to be
-pasted into the handoff the row points at,
-because a handoff written from memory is how an object goes missing between two
-sessions of one lane. That fragment is the only thing `lane-end` writes to
-stdout.
-
-A `CLAIMED` another lane has taken over is listed under `## Open` as
-`superseded by TAKEOVER (lane:<X>) — release it`. It belongs there because it is
-still this lane's last line on the object and only this lane's `release` closes
-it; what it is not is work the next session still holds. The fragment is the one
-surface here that becomes a **durable document**, so an object `who` gives to
-another lane must not be pasted into the next handoff as simply open — the
-refusal, `who <object>` and `who --lane` all carry the takeover already.
-
-### Archivability
-
-A lane's log is archivable when the lane is `RETIRED` and every object in it is
-`CLOSED`, `LANDED`, `RELEASED` or `CLAIM-LOST`. **Nothing prunes
-automatically.** The amendment states the rule and stops there.
-
-## Swap and restart (Amendment 8)
-
-**DRAFT, 2026-09-12, awaiting Brett Heap's word** (`brettheap/new-workstation#15`).
-A **swap** is a planned stop — a usage reset, a profile switch. A **restart** is
-the launch that follows it. The lane has to survive the gap, and on
-2026-09-12 it twice did not: the restart opened a **new tmux session**, which
-loses the window name that carries the lane, and the reset minted a **new
-transcript uuid** while the row's session cell still ended on the old one.
-
-Neither half adds a file. The **record** a swap leaves is the lane's own
-`PAUSED` line in `lanes/log/<lane>.md`, payload
-`swap; window <tmux session>:<index>; workstation <ws>` — an ordinary event line
-under Amendment 7's grammar, not a new kind of thing:
-
-```text
-PAUSED — lane openRepoProject-1, session 09dd34d1-…@Eagle, 2026-09-12T16:52:39Z, lane:openRepoProject-1 → swap; window claude-team-05b-20260912102132-2699:0; workstation Eagle — on Brett Heap's word: shutdown and i will reset the usage
-```
-
-A lane is **swapped** on a workstation when that `PAUSED` is its **last
-lane-kind line** — no later `RESUMED`, `STARTED`, `ENDED` or `RETIRED`. The line
-above is real, and that lane is *not* swapped today, because a `RESUMED` follows
-it seven minutes later.
-
-Two read-only subcommands. **Neither ever writes**, and both honour
-`LANES_NO_FETCH=1` — the launcher passes it, because a record this workstation
-wrote is already in its own clone and a restart must not wait on the network.
-In that mode they still read `origin/main`, exactly as they do after a fetch;
-what is skipped is the fetch, never the ref.
-
-### `swapped [<workstation>]`
-
-The lanes a swap paused on a workstation and nothing has resumed. Default
-workstation is `hostname -s`. One row per lane, **tab-separated, lane first**:
-
-```console
-$ lanes-edit.sh swapped Eagle
-repoSW-1	2026-09-12T10:00:00Z	claude-team-05b-20260912102132-2699:0 @71	~/projects/repoSW	team-05b
-repoSW-5	2026-09-12T11:00:00Z	sess-five:5
-```
-
-**Amendment 11 gives the row a fourth field, `<dir>`, and a fifth,
-`<profile>`, and the `<window>` field a second ref, `<@id>`** — and the second
-row above is what every record written before that looks like: the fields are
-EMPTY rather than guessed (Amendment 7(i) cuts each lane over at its own next
-start, and nothing is backfilled). **The first field before the first tab is
-still the lane**, which is the contract both readers of this output take, and
-it is what makes a fourth and a fifth field safe to add at all.
-
-`<lane>`, `<UTC>`, `<window>` — the window being the `window <s>:<i>` the
-`/swap` recorded, which is where that lane was. **The lane is the register
-row's spelling** (Amendment 15), as `window-lane`'s answer is, and not the
-spelling of the lane's log file: a log written before that amendment is still
-`lanes/log/openxfactory-4.md` beside the row `openXfactory-4`, and `swapped`
-lists that lane as `openXfactory-4`, so a reader may hand the field straight to
-`tmux rename-window` or to a read of the register. **Exit 0** with
-rows, **8** with none (and the reason on stderr, so stdout is only ever rows). A
-launcher takes the first row's lane as its default and hands it to
-`lane-start --confirm`.
-
-**The rows are in LANDING ORDER — most recently landed first — and not in UTC
-order.** Amendment 7's file-order rule orders one lane's own lines and does not
-reach across two lanes' files, and two lanes' UTCs are two clocks: they may be
-two workstations' (which share no order at all) or one workstation's mid-jump —
-this one was observed stepping ±25 s in bursts, and a log commit landed whose
-content carried a UTC 26 s after its own committer date. Git's push
-serialization is the one order both lanes really share, and it is the same
-arbiter `claim` already uses to decide a race. So the key is the position of the
-commit that **added** each lane's `PAUSED` line, measured as its distance from
-the tip of `origin/main` — history, not a committer date either. The UTC stays
-in the output as **information**, and decides nothing. The example above is the
-test's own: `repoSW-5` carries the later UTC and landed first, so it is second.
-
-### `session-start`
-
-The whole output of Claude Code's **SessionStart hook**. It reads the hook's
-JSON on stdin (`session_id`, `source`, `cwd`) and the tmux window name, resolves
-the lane — **the window name first, then the session id against every row's
-session cell** — and prints ONE block. The working directory is in the payload
-and is deliberately *not* read as a lane: the working directory confers no lane
-(Amendment 6(a)), two lanes share one all day, and every nested checkout in the
-xFactory estate shares its parent's.
-
-**It never writes, it never touches the network, and it always exits 0** —
-including on garbage stdin and on no register at all, which every other
-subcommand refuses. A hook that fails is a hook that breaks the session it was
-meant to orient; a hook that fetches puts the network in front of every session
-start on the workstation, and R-A8-1 rules it out for exactly that reason.
-
-So every line of the block is **this checkout as it last stood**, and the block
-says how long ago that was — the line `ssb_tail` prints **unconditionally**, as
-the last line of every block whichever branch wrote the rest (Amendment 8(e)):
-
-```text
-as of 4m ago (no fetch)
-```
-
-The age is `.git/FETCH_HEAD`'s mtime — rewritten by every fetch and by nothing
-else — rendered `<n>s`/`<n>m`/`<n>h`/`<n>d ago`; `never` where this checkout has
-never fetched, `unknown` where it cannot be read. Neither is a failure and
-neither costs a network call. A block that says `as of 4d ago (no fetch)` is a
-block a reader knows not to trust about another workstation's lane, which is the
-whole of what makes an unfetched read honest.
-
-The lane's session is the one the row records, and the hook says so:
-
-```console
-$ lanes-edit.sh session-start   # stdin: {"session_id":"4a91f1dc-…","source":"resume","cwd":"…"}
-LANE openRepoProject-1 — handoff handoffs/openRepoProject/session-handoff-2026-09-11-lane-openRepoProject-1.md — row session 4a91f1dc-46dc-48be-a75a-1789fab038d0
-stamp the handoff RESUMED (Rule 3) and follow its top block
-open: CLAIMED brettheap/new-workstation#15; OPENED brettheap/new-workstation#16; OPENED opensoft/workBenches#63
-as of 4m ago (no fetch)
-```
-
-The first line's last field reads `row session none recorded` where the row
-carries no id this hook can read — the rows that hold only `session_…` footer
-ids, which have no transcript uuid to mismatch *against* and are therefore not
-reported as a mismatch at all.
-
-The second line is one of three, and it is **derived** rather than assumed from
-the ids agreeing: the handoff the ROW names is read and grepped for the line
-this session would owe, because a window started by a bare `claude` has no stamp
-and does still owe one. Already stamped by the launcher → `handoff already
-stamped by lane-start — follow its top block`; no handoff in the row at all →
-`the row records no handoff path — there is none to stamp or to follow`.
-
-The third line is the lane's open objects, `who --lane`'s answer on one line;
-`open: none open` when it holds nothing, and
-`open: no log for <lane> (pre-cutover lane) — see its row's state cell` when it
-has no log at all.
-
-**Two different mismatches, and the block says which.** An id the cell *carries*
-but does not end on is a superseded transcript of this lane — the 2026-09-11
-wrong-lineage resume. The conversation in this window is not the lane's, so it
-is left rather than carried on with:
-
-```text
-WARNING: this is a superseded transcript of lane repoSS-1; the live one is <U>; you resumed <V> — exit this session and run: lane-start repoSS 1
-as of 4m ago (no fetch)
-```
-
-That mismatch has one **sub-branch**: where the lane's newest row stamp says
-`unknown`, the cell's last id names a transcript this directory does not have, a
-relaunch would take the same title fallback again and record nothing either — so
-the cure there is the recording act, not a relaunch:
-
-```text
-WARNING: this is a superseded transcript of lane repoSS-1; the live one is <U>, which the row records as `unknown` — a relaunch would record nothing either, so run: lane-start --no-launch repoSS 1
-as of 4m ago (no fetch)
-```
-
-An id the cell does not carry **at all** is the harness having minted a new
-transcript with nobody acting. The lane is right and the row is simply behind,
-so the cure is the act that reads the live record in this window and appends
-that uuid to the cell:
-
-```text
-WARNING: this window is lane repoSS-1 whose current session is <U>; this session <V> is in no row — the harness minted a new transcript — run: lane-start --no-launch repoSS 1
-as of 4m ago (no fetch)
-```
-
-There is no third mismatch, and **no branch names `/resume` or the picker**:
-neither is a lane surface, and a reader sent back through the picker performs
-the very failure this block exists to catch. Every command is printed **filled
-in** — the hook holds the lane, so `<repo> <n>` reads `repoSS 1` by the time
-anyone sees it, and a lane named before the `<repo>-<n>` rule gets
-`--dir <path> browser-ui-repair` rather than the bad split `browser-ui repair`.
-
-And when neither the window nor the register answers — the one branch that keeps
-its placeholders, because no lane is known there to fill them in with, unless
-the window name itself parses as `<repo>-<n>`:
-
-```text
-no lane bound to this window — run: lane-start <repo> <n>
-as of 4m ago (no fetch)
-```
-
-`source` is one of `startup`, `resume`, `clear`, `compact`, `fork`. A
-**compact** prints **nothing**: the same conversation carries on in the same
-window under the same id, and a block there would announce a lane's identity
-into the middle of a session that already has it. Everything else gets the
-block — a **fork** included, which is a new attachment to the lane's
-conversation — and an unknown or missing `source` is treated as a `startup`
-rather than dropped.
-
-Installing it is user-local configuration, not part of this repository:
-`hooks.SessionStart` in `~/.claude/settings.json`, command
-`~/projects/xFactory/lanes-edit.sh session-start`.
-
-### What Amendment 8 does not add
-
-**No new script and no new path.** `swapped`, `session-start`,
-`window-session` and `sibling-filter` are subcommands of the writer that already
-exists, and every one of them is a **read**: AGENTS.md rule 1's list of writers
-(`set-row-state`, `replace-in-row`, `append-line`, `add-row`, `log`,
-`claim`, `release`, `commit`) and rule 8's list of tooling paths are both
-unchanged by this amendment.
-
-## Bind and list (Amendment 11, amended by Amendment 18)
-
-**DRAFT, 2026-09-13, awaiting Brett Heap's word on the amendment itself**
-(`brettheap/new-workstation#21`) — but **eight decisions inside it are
-RATIFIED**, verbatim, on 2026-09-13T18:05:29Z: *"Ratify all four"*, *"Yes, build
-`lanes` in A11"*, *"Ratify the bundle"*, *"Hotfix brett-wip now, move it with
-history"*. Everything below rests on one of those eight.
-
-Amendment 8 made a swap leave a record. Amendment 11 is what makes that record
-enough to **restart from**, and it exists because on 2026-09-13 a restart of a
-real lane printed `[exited]` and a second one came up in the wrong directory
-without the repository's `CLAUDE.md` or the lane's memory, silently.
-
-### The two words
-
-```console
-$ lane openRepoProject-1        # cd to its directory, relaunch through the launcher
-$ lane                          # the lanes of this checkout, numbered — pick one
-$ lanes                         # inside a checkout: ITS lanes, and the next free one
-$ lanes --all                   # every lane the register and the logs know
-$ lanes --fetch                 # any of them, after refreshing from origin
-```
-
-**`lane <name>` is Amendment 11's OUTSIDE half and `restart` is retired**
-(**Amendment 18 Addendum 2**, ratified 2026-09-14T16:50:32Z verbatim *"ratify"*,
-on Brett Heap's ruling *"i think we can drop restart as a cli command and keep
-it inside a claude session with /restart. if we need it for ctx, keep it for
-that, but I do not see any reason to expose this to the user. lane does all the
-things a user wants"*). `openRepoTools --install` no longer places `restart`
-**and REMOVES the copy an earlier install placed** — printing `restart: RETIRED`
-beside the file it took away — because a word that merely stops being written
-stays on the PATH of every workstation that already took it. It removes only
-what it wrote: a file of that name carrying this installer's own header goes,
-and one that does not is NAMED, left exactly as it is, and the `rm` that removes
-it printed for the person to run. Everything decision 7 ratified about that act
-is true of `lane <name>`, which does it and three things more. Everything below
-is about `lane <name>` and was written about `restart <lane>`.
-
-`lane <name>` needs **no window, no record of a window and no guess** — only
-the lane's name, its `dir` and its `profile`, both of which the record now
-carries. That is the whole point: measured on this estate after the tmux server
-was replaced, each of the two surfaces the direction names met **one prompt
-offering two choices, and the lane it offered was the wrong one**. Declining was
-the only correct answer, and declining left the operator where they started.
-
-**It never calls `claude` itself.** Every path goes through the launcher and
-therefore through `lane-start`, which renames the window, writes the row stamp,
-extends the session cell, writes the `RESUMED` object line, stamps the handoff —
-and passes `--name <lane>`, without which the harness derives a record name like
-`openrepoproject-b9` and that derived name is what the statusline and
-`ListAgents` show.
-
-**It `cd`s into the lane's directory before it launches**, and that is not a
-convenience: the harness keys a session to the directory it was started in, so a
-restart from the wrong one loads neither the repository's `CLAUDE.md` nor the
-lane's memory, while `--resume <uuid>` goes on continuing the right transcript —
-which is why the loss is silent.
-
-**`lanes` is never a picker, and `lane` asks exactly one question.** Ratified
-decision 3 refused a picker for the words Amendment 11 added, and Amendment 18
-Addendum 1 is the later word on a question that decision was not asked: a person
-who has to type a lane name has to know one. So `lanes` still asks nothing at
-all — it is a read — and `lane` prints the listing, asks `which?` **once**, acts
-on the one answer, and stops; with no terminal on stdin it asks nothing either.
-
-`/restart [<lane>]` is the same act from **inside** a running session, and it is
-a skill rather than a command because a session cannot `exec` a launcher over
-itself: it binds the window through `lane-start --no-launch`, and where this
-session is not the lane's conversation it prints exactly `claude --resume <uuid>`
-and stops. It is unchanged by Addendum 2: what left the PATH is the outside
-half, and `/restart` was always the inside one.
-
-### The bare word narrows inside a checkout
-
-**Brett Heap settled clause (j)'s default on 2026-09-13T20:38:11Z, verbatim
-*"Narrow inside a checkout (Recommended)"*, and `lane-start <repo>` with no
-position in the same breath, verbatim *"Yes, list and suggest (Recommended)"*.**
-
-A bare `lanes` INSIDE a lane checkout lists **that repository's lanes** — the
-checkout around the cwd as clause (i)'s `--dir`, and that checkout's `origin` as
-`--repo`, which are an **OR and not an AND**, because a lane's home repository
-and the checkout it sits in are not the same fact — and it ends with the **next
-free position** and the exact `lane-start <repo> <n>` that takes it, filled in.
-The position offered is the **lowest** one no lane of that repository holds,
-never the highest plus one: positions come back as lanes end, and `lane-start`
-refuses one that is taken, so this is a suggestion with a guard behind it rather
-than an assertion.
-
-**The repository is the one `origin` names, and the directory's name is only the
-fallback.** Inside a worktree, `basename $(git rev-parse --show-toplevel)` is the
-WORKTREE's name: run in a worktree of `openRepoTools` called `ort-a11` the
-listing narrowed to a repository called `ort-a11`, found none, and offered
-`lane-start ort-a11 1` — a lane whose `$PROJECTS_ROOT/<repo>` cannot exist. A
-checkout with no `origin` keeps the directory name, because there is nothing
-else to have.
-
-`lanes --all`, and a bare `lanes` outside every checkout, are clause (j)'s
-every-lane listing **unchanged**; any explicit narrowing — `--repo`, `--dir`,
-`--ws`, `--here` — is the caller saying which lanes they mean and suppresses it
-too. `--here` is the pre-Amendment-11 default, only the asking workstation's
-lanes, kept as an option: "list the lanes" on a two-workstation estate means
-both.
-
-`lane-start <repo>` with **no position** prints that same listing and that same
-next free position, and **launches nothing**. It still exits **2** — a
-repository is not a lane, and a caller that scripted `lane-start <repo>`
-expecting a session must not read 0 from a run that started none — and the
-refusal names the position it has just given the reader a listing for. It
-renders nothing of its own: it runs `lanes --prefix <repo>`, so the two surfaces
-cannot offer different positions.
-
-### What the record carries now
-
-Two payload sub-fields are added to the lane's `STARTED`, `RESUMED` and swap
-`PAUSED` lines, and the `window` sub-field gains a second ref:
-
-```text
-STARTED — lane openRepoProject-1, session a3ab3df2-…@Eagle, 2026-09-13T04:30:00Z, lane:openRepoProject-1 → home opensoft/openRepoProject; estate openRepoProject; dir ~/projects/openRepoProject; profile team-05a; window claude-team-05a-20260912213845-570498:0 @71
-PAUSED — lane openRepoProject-1, session a3ab3df2-…@Eagle, 2026-09-13T04:32:00Z, lane:openRepoProject-1 → swap; window claude-team-05a-20260912213845-570498:0 @71; dir ~/projects/openRepoProject; profile team-05a; workstation Eagle
-```
-
-- **`dir <path>`** — the lane's checkout. Two writers put it there: `lane-start`
-  from the directory it is about to `cd` into, and the swap from the live
-  session's own record. A path containing `, `, ` — ` or `"` is **refused**,
-  naming the path; a path containing a **space is written quoted**, which is
-  what makes it one ref under Amendment 7(b)'s grammar, and every reader strips
-  the quotes.
-- **`profile <name>`** — from `$CLAUDE_PROFILE_NAME`, which the launcher exports
-  into every session it starts. Without it a restart typed anywhere but in the
-  lane's surviving window cannot name the profile the launcher needs.
-- **`window <session>:<index> <@id>`** — two space-separated refs in one
-  sub-field. **The name is the key and the id is information**: a tmux server
-  restart reissues every id from `@0`, so a binding keyed on the id would lose
-  the lane where one keyed on the name does not.
-
-**A line written before this carries none of them, and a reader that finds none
-says so rather than assuming one.** Nothing is backfilled.
-
-### The lane's directory, in six rungs
-
-`--dir <path>` → the **swap record's** `dir` → the **lane's log** (`lane-dir`) →
-`$PROJECTS_ROOT/<repo>` → the estate's **`project.yaml` legs** → **a checkout
-named for the home's repository** under `$PROJECTS_ROOT`. First answer wins, and
-**the cwd's own checkout is ruled out by name**: deriving the directory from
-wherever you happen to be standing is an inference, and `lane-start` writes the
-lane's HOME from that directory's `origin`, which every `#n` the lane afterwards
-writes inherits. A recorded directory that no longer exists is a **refusal
-naming the path**, never a silent re-home.
-
-**Rungs 5 and 6 were four until Evidence 7** (`708395e`), where a lane whose
-checkout is NESTED — `~/projects/xFactory/xFactories/OpsxFactory`, not
-`$PROJECTS_ROOT/opsXfactory` — met an exit 1 behind an `exec` and a pane that
-said `[exited]`. Neither is a search for a directory that looks right:
-
-- **Rung 5 is a DECLARATION.** openRepoShape's manifest carries a top-level
-  `legs:` list of `repository:`/`path:`, and Amendment 7 decision 3 treats a leg
-  as home. Where a manifest names the lane's recorded home as a leg, that leg's
-  `path`, resolved against the manifest's own directory, IS the checkout.
-- **Rung 6 is a NAME, and the name is the repository's.** One or two levels
-  under `$PROJECTS_ROOT`, a directory named for the home's repository —
-  `resolve-repo`'s canonical spelling, because `opsXfactory` the lane label and
-  `OpsxFactory` the repository are not the same string.
-
-**Both are proved by `origin` and both are skipped entirely where the lane has
-no recorded home**, because there is then nothing to prove a candidate against
-and a match would be the guess rung 4 already refuses to make. A candidate whose
-`origin` is not the recorded home is passed over, not taken. And when all six
-answer nothing the end is still a **refusal, exit 2**, one line a person can
-type — never the exit 1 Evidence 7 met.
-
-### The new reads
-
-All read-only, all out of `origin/<branch>`, all following Amendment 7(d)'s
-fail-closed convention — **0** an answer, **8** *no answer*, **64** a usage error
-of their own — with one exception that every un-upgraded workstation is in:
-**`2` is a helper predating Amendment 11**, expected and silent, and a caller
-falls to its next rung there rather than refusing.
-
-| read | what it answers |
-|---|---|
-| `lanes-edit.sh lane-dir <lane>` | the `dir ` of the lane's **last** lane-kind line carrying one, unquoted where it was written quoted |
-| `lanes-edit.sh lane-profile <lane>` | the same read one sub-field along — the `profile ` of that last line. An addition to the amendment's own table, so that `lane <name>` can learn a profile with one `git show` instead of a listing that reads every log on the workstation |
-| `lanes-edit.sh window-lane [<ws>] <@id>\|<session>:<index>` | the lane bound to a window **of the asking workstation** — the register row whose name is the window's name, else that workstation's swap record naming that ref. Both rungs answer in the **register row's own spelling** (Amendment 15): what this prints is renamed to, `--name`d with and typed as `lane <name>` |
-| `lanes-edit.sh session-lane <uuid>` | the lane whose register row's **session cell** names that transcript uuid. Adoption act 0's; it is the read the `SessionStart` hook already made. **0** the lane · **8** no row's cell names it · **64** usage — like every other read in this table, by A11 Addendum 4 ruling 1, which corrects act 0's `2` · **2** a helper predating the read |
-| `lanes-edit.sh last-session <lane>` | the lane's resume target: the last uuid in the published cell **whatever shape it is in**, and failing that the session of its last `PAUSED`/`RESUMED`. This is what `/restart`'s step 4 reads, by A11 Addendum 4 ruling 14, rather than clause (f)'s `register-row` alone — so a lane whose row was never stamped but whose log records the session it paused in still has a resume target |
-| `lanes-edit.sh forks <lane>` | the **live forks** of the lane's transcript — never holders, and a defect to retire |
-| `lanes-edit.sh lanes [--repo\|--dir\|--prefix\|--ws\|--lane\|--here\|--all\|--closed\|--fetch]` | every lane, newest write first, tab-separated: clause (j)'s **ten columns in clause (j)'s order** — name, state, workstation, profile, window, last transcript uuid, directory, held objects, age, the line that binds it — then the read's own three, `home`, the count of live forks, and — since Amendment 18(b) — whether THIS place may pronounce on that binding (`here`, `elsewhere`, or `none` for a row with no binding line at all), which is what `lane-groups` files an `IDLE` row by — then Amendment 19's four: the row's **class** (`closed`, `dormant` or `none`), its `started` cell, its state cell's **head** and the **flag words** in that cell. The last two are carried **for a row with no object log** — 19(a)'s dormant row, whose cell is all this read has to show — and are `none` for a row that has one, which has its log instead: they are free text of up to 280 characters per row and the table the listing joins on is walked once per lane, so carrying them for every row cost the whole estate 3x (42 s against 14 on a register of 132 rows, measured). **No column is ever empty**, because three readers split the row with a tab-IFS `read`, to which an empty field between two tabs is no field at all. **CLOSED and DORMANT rows are left out unless `--closed` is passed** (19(b)); `--lane <name>` is never filtered, because its caller has named the lane. `lanes` and `lane` each render the subset their surface needs (A11 Addendum 4 ruling 7), and column 10 is the read's so the two cannot offer different commands; since Amendment 18 Addendum 2 the word it names is `lane <name>`. **The one read whose default is local**, and `--lane <lane>` answers about one without walking the estate. `--prefix <repo>` is the LABEL fallback the checkout narrowing and `lane-start <repo>` both ask for, used only where a lane has neither a home nor a `dir` |
-| `lanes-edit.sh lane-groups [<ws>]` | **the rows on STDIN**, each with the group the pick puts it in: `available` (PARKED, or a binding that workstation **and container** prove dead), `live`, `elsewhere` — an `IDLE` row whose binding is another container on this same host is **elsewhere**, because IDLE means this host saw no live record and across that seam the pid it would have read is in another namespace (Amendment 18(b)). Closed and dormant rows are DROPPED (Amendment 19). It reads nothing itself — the caller has already paid for `lanes`, and two surfaces computing one partition is how they come to disagree |
-| `lanes-edit.sh next-free <repo>` | **the rows on STDIN plus every row of this checkout's register and of `lanes/archive/LANES-retired.md`** (Amendment 19(b) and (d): the rows the listing hides and the rows `archive-rows` has moved out still hold their positions), and the LOWEST position no lane of that repository HAS EVER held — `ENDED` and `RETIRED` rows reserve theirs, because a lane's identity is its name and its object log `lanes/log/<lane>.md` is append-only, so a second lane at a retired position would write its life into the first one's file. The name before the position is compared whole, so `repo-foo-1` is no lane of `repo`. `lanes`'s footer and `lane`'s `f` answer both read it, so the two cannot offer different positions |
-| `lanes-edit.sh binding <lane>` | where the lane is bound, and whether this place may pronounce on it: `<host> <container> <window> <utc> <session> <os> <here\|elsewhere> <live\|gone\|unknown>` (Amendment 18(b)). **0** bound · **8** free · **1** the log could not be read, which is never "this lane is free" |
-| `lanes-edit.sh workstation` | `<workstation> <source> <host> <source> <os> <source> <container> <source>` — eight tab-separated fields since Amendment 18(a), the first two unchanged. A source is `seam`, `hostname`, `workstation`, `kernel`, `outside`, or, for the workstation itself, `container-unset` |
-| `lanes-edit.sh fetch-age` | how old this checkout's answer is |
-
-**`request-handoff` is the one WRITE in that family** and is not a read at all:
-`lanes-edit.sh request-handoff <lane> [--wait <s>] [--session <uuid>]` writes
-clause (c)'s `HANDOFF-REQUESTED`, pushes it, types `/handoff --exit requested by
-…` into the bound pane where that pane is on this tmux server, and waits;
-`--force "<why>"` is clause (e)'s second invocation and releases the binding on
-its holder's behalf. **0** the lane is free — bind it · **2** the wait ended
-empty, or the request was refused · **8** the lane was already free · **1** a
-read failed.
-
-**`window-lane` owns the agreement rule, and it owns it once.** Existing-now is
-not enough on its own: a record naming `claude-y:0 @97`, met from the window that
-has since taken `claude-y:0` as `@200`, passes the existing-now test on its ref
-and would bind the lane to a **stranger's pane** with no question. So a record
-that carries an `<@id>` is matched on its `<session>:<index>` **only where the
-window now holding that ref reports that same id**; a record with no id is
-matched on the ref alone. Three callers share that one implementation — the
-launcher's precedence 3, `/restart`'s step 2(c) and `/lane-swap`'s step 1 —
-because three implementations of one rule is how they would come to disagree.
-
-### Two things that are never taken
-
-**A window named for another lane never lends its session.** `lane-start`'s step
-3b learns a harness-minted uuid from the session live in the window it was typed
-in — which is how a `/clear`, a usage reset and a profile switch stay recorded.
-Its fence is **two vetoes and no permission**: the **register veto** (a uuid that
-belongs to another row is never taken, read through `session-lane` and
-fail-closed) and the **window-name veto** (a window named for another lane is
-never taken). Neither the window's name being the lane nor `live-holder`
-answering `here` is a *condition for taking* — at step 3b the window is usually
-still called `claude` and there is no holder here, which is exactly the case the
-mechanism exists for.
-
-**A fork of a lane's transcript is never a holder and never writes the
-register.** A `--fork-session` copies the parent's title and gets a **new id**,
-so lineage is never the test: the holder is the session whose id the published
-cell names. `lanes`, `/restart`, `who --lane` and the `SessionStart` hook all
-show a live fork as a **defect to retire**, and none of them kills anything.
-**Retiring it is `lane-end <lane> --retire <pid|uuid>`** — the one act, ratified
-decision 8(e) and clause (k) rule (e). It is the **DOOR** to Amendment 6(d) and
-not a record of one: it proves the pid or uuid is this lane's live fork and
-prints 6(d) filled in. **It writes nothing** — a `RETIRED` carrying a payload
-would be a seventh edit to in-force text, and Amendment 7(b) gives that verb
-none — so every read goes on naming the fork until the person takes the printed
-act. And it **kills nothing either**: stopping the process is a separate act and
-it stays the person's.
-
-**A duplicate holder of a lane's OWN transcript is a different thing, and it IS
-killed** (opensoft/openRepoTools#39, Amendment 18(h)). A cross-profile resume
-can leave a `bg-pty-host` running `claude --fork-session --resume
-<path>/<uuid>.jsonl` behind; once a later `lane-start --no-launch` binds that
-forked id as the row's own session, the id is no longer one `forks` (decision
-8(e)) will ever report — it is designed to stay silent about an id the row
-DOES record — while a second live process now holds the one transcript
-Amendment 18(h) says exactly one may. `lanes-edit.sh duplicate-holder <lane>`
-finds it in the PROCESS TABLE instead (`pgrep -f` for a live `--fork-session`,
-then `ps -o pid=,ppid=,args= -p` per candidate — portable across GNU and
-BSD/macOS), matched against every id this lane's row has ever carried by the
-`--resume` value read whole, a directory with a space in it included
-(opensoft/openRepoTools#76: `ps` joins the argv with spaces and quotes nothing,
-so the value runs to the first `.jsonl` that ends an argument, and a value with
-a space in it counts only as one absolute path, starting with `/` and holding
-no ` /`, by Brett Heap's ruling of 2026-10-18 on PR #205), and
-excludes the lane's own live holder (`live_holder`, the same implementation
-`live-holder` already calls) **and the harness's own companion of it** —
-Amendment 8 ruling (g)'s `kind: bg` record carrying the same id in the same
-profile as an interactive record of it, which is one session and not a rival
-holder, together with any wrapper whose child is that companion. A records
-tree that cannot be read for that test is a read that failed, never "no
-companion", and a register that cannot be read is never "no duplicate": the
-row's ids are the whole search, so it exits 1 and names the read
-(opensoft/openRepoTools#67). `lane-end <lane> --retire <pid>` tries `forks`
-first and this second, and on a match here it TERMs the `bg-pty-host` parent
-and EVERY child of it that resumes the same transcript, not only the first
-(opensoft/openRepoTools#86), reports each pid it signalled, and says RETIRED
-only once every one of them is gone; it refuses, naming the reason, when the
-pid given is the lane's own live session rather than the duplicate. Before this
-the retirement was a bare `kill -TERM`, outside every tool this estate has.
-
-### The workstation's name
-
-`$LANES_WORKSTATION`, exported by the workBenches launcher from the host into
-every session and container it starts. Outside a container it still defaults to
-`hostname -s`. **Inside a container with no value, every writer refuses, exit 2,
-naming the variable** — because a container's `hostname` is the container's id,
-not a workstation, a row on a workstation that does not exist is a row no reader
-can match, and the log is never rewritten. `lanes-edit.sh` already carries six
-such lines in one lane's log, and they stay where they are.
-
-## One binding per lane (Amendment 18)
-
-**A lane has ONE binding. The record says where it is — host, OS, container,
-window — and a second place ASKS the first to hand off before it binds; nothing
-is taken silently.** Ratified by Brett Heap 2026-09-14T13:15:18Z, verbatim
-*"merge 37 and 78, ratify revision 4"*, on his observation of the same day:
-
-> we are working on lanes tooling … if I run a lane, then i am on a host running
-> macOS or linux or windows … and in all 3, i might be in a container. we should
-> probably note the host name, OS type and container name if there is one. so if
-> I am on wsl and I am in cloudBench and then move to pyBench, when I try to
-> restart in pyBench, it should ask me if I want to pause the lane on cloudBench.
-> we shoudl not allow two bindings to a lane … we need to send a signal to that
-> session to shutdown. once it is shutdown, then we alow the new connection to
-> bind
-
-### Why — a pid does not cross a pid namespace
-
-A lane's liveness is read from the harness's session records and a `kill -0` of
-the recorded pid. Both are **local** facts. Across workstations the tooling
-already said so — another machine's row is UNKNOWN and `who` says to ask that
-lane. Across **containers on one machine** it did not: two bench containers on
-Eagle share the profile directory, so pyBench can read a record cloudBench
-wrote and then `kill -0` a pid **in cloudBench's namespace**, which is either
-nothing or some other process. A lane live and writing in cloudBench read NOT
-LIVE from pyBench, and `lane-start` there took the name.
-
-### The three sub-fields
-
-`STARTED`, `RESUMED` and `PAUSED` carry three more, after Amendment 11(c)'s
-`dir`/`profile`/`window` and Amendment 17(b)'s `agent`/`transcript`:
-
-```text
-STARTED — lane openRepoTools-3, session d1ac715c-…@Eagle, 2026-09-15T12:38:51Z, lane:openRepoTools-3 → home opensoft/openRepoTools; estate openRepoTools; dir ~/projects/openRepoTools; profile team-05c; window claude-team-05c-…:0 @71; host eagle; os wsl; container cloud-bench
-```
-
-- **`host <name>`** — the MACHINE's short hostname **as it reads outside any
-  container**. The launcher exports it (`LANES_HOST`); a writer outside a
-  container reads `hostname -s`; a writer **inside** one with no export writes
-  the **Rule 10 workstation name**, because in this estate a workstation is one
-  host and a container's own `hostname` is its id.
-- **`os <linux|macos|wsl|windows>`** — the HOST's operating system as the person
-  means it. The launcher exports it (`LANES_OS`); with no export the kernel is
-  probed: `Darwin` → `macos`; `Linux` whose `/proc/version` names `microsoft` →
-  `wsl`; one naming `linuxkit` → `macos` (Docker Desktop's VM); any other
-  `Linux` → `linux`. **`windows` is written only by a launcher on the Windows
-  host itself** — this toolset is bash and runs in WSL2 there, so its own probe
-  never says it.
-- **`container <name|none>`** — the bench's name as the launcher exports it
-  (`LANES_CONTAINER`: `py-bench`, `cloud-bench`, …); inside a container with no
-  export, **that container's own `hostname`**, which for Docker's default is its
-  id and is the one thing that tells two unnamed containers apart; outside every
-  container, the word `none`.
-
-They are written by **`write_event`**, the one writer every caller goes through
-— `lane-start`'s `STARTED`/`RESUMED`, the handoff's `PAUSED`, and the forced
-release below — so no boundary script carries a copy of the probe. **A value is
-read live at every write and never carried across a run**: measured
-2026-09-15T12:17Z, when a bench container on this estate was recreated with a
-new hostname and its `~/.local/bin` went with it. A container's `hostname` names
-that container for as long as it exists and names nothing afterwards.
-
-**`ENDED` and `RETIRED` carry none of them.** Amendment 11(c) keeps those two
-payload-free — edit 1 of six, `R-A11-15` — and a verb that RELEASES a binding
-has no binding to describe. (Amendment 18's Adoption list names them in passing;
-the RULE, clause (a), names `STARTED`, `RESUMED` and `PAUSED`, and the rule
-governs.)
-
-**A line written before this amendment carries none of the three and stays
-valid**: readers treat its binding as *the window on the row's workstation*,
-which is what they read before. Nothing is backfilled.
-
-**"None of the three" means all three, not `host` alone.** The writer drops an
-offending sub-field on its own and keeps the line, so a line carrying a
-`container` and an `os` and no `host` is a MODERN line that lost one field — and
-reading it as pre-amendment would ignore the container it does carry. All three
-absent is the only shape that is really from before this clause; anything less
-is matched on host **and** container like every other modern line.
-
-### What the launcher must export
-
-`opensoft/workBenches#77` — `claude-profile` and the bench shells export
-`LANES_HOST`, `LANES_OS` and `LANES_CONTAINER` into **every session and every
-container they start**, beside the `LANES_WORKSTATION` they already export. The
-per-host act is nothing more than that export; this toolset only ever READS
-them, exactly as it reads `LANES_WORKSTATION`, and its fallbacks above are what
-answer until the export arrives.
-
-### The binding, and who may pronounce it dead
-
-A lane's **binding** is the `host`, `container` and `window` of its last
-lane-kind line that is `STARTED` or `RESUMED` **with no `PAUSED`, `ENDED` or
-`RETIRED` after it**. A lane whose last lane-kind line is one of those three, or
-which has none, is **FREE**.
-
-```sh
-lanes-edit.sh binding <lane>
-# <host> <container> <window> <utc> <session> <os> <here|elsewhere> <live|gone|unknown>
-# 0 bound · 8 free · 1 the log could not be read · 64 usage
-```
-
-**Liveness is pronounced only from INSIDE the binding's own host and container**,
-where the pid namespace is the record's. From anywhere else a binding is
-**UNKNOWN, never dead**, whatever `kill -0` says — that is the seventh column.
-
-A **modern** record is matched on the machine's own hostname AND the container;
-the Rule 10 workstation name is accepted as the host only for a **pre-amendment**
-line, which has nothing else to be matched on. Clause (a)'s own fallback still
-works through that without a second rule: a writer inside a container with no
-`$LANES_HOST` writes the workstation name into `host`, and a reader in that same
-container computes the same name the same way.
-
-That column is also what the pick reads. `lane_groups` asks it **before** the
-state, so a row that reads `LIVE` because a live session record here names one
-of its ids — the records are shared between containers, and the pid that record
-names is in another namespace — is still filed **BOUND ELSEWHERE** when its
-binding is another place's. The act there is clause (c)'s request; and because
-watching a lane and taking it are two acts of which only the second is the
-collision, that branch also names the attach filled in wherever the window is
-live on this tmux server. A **parked** lane of another container is untouched by
-all of it: column 13 carries the locality of a binding that STANDS, and parking
-IS the handoff.
-
-**The one exception is the window**, and it is the eighth column. One host's
-launcher mounts ONE tmux socket into every container it starts, so where the
-asker and the binding share a tmux server and the binding's window **no longer
-exists there**, the binding is **DEAD** — the pane a session must live in is
-gone. The window is matched by Amendment 11(h)'s agreement rule, the `<@id>`
-TOGETHER with its `<session>`, because tmux reuses ids once a window is gone.
-Amendment 6(d)'s retire act and openRepoTools#30's takeover path apply to that
-case as they stand. A window on another **host** is `unknown` and never `gone`:
-an id from another machine resolving here would be a coincidence.
-
-**And so is a window this place cannot ASK about** — no tmux binary, no server
-running, a socket this user cannot read, a `$TMUX_TMPDIR` that differs. `tmux`
-answers an id that resolves nowhere and a server that is not there with the SAME
-empty line, and only one of the two is a dead pane; so the server is asked a
-question that does not mention the id, and a server that does not answer leaves
-the binding `unknown`. The alternative is a container the host's socket was
-never mounted into pronouncing every other container's lane DEAD, which is this
-clause's own collision arriving through its own exception.
-
-### The second place asks
-
-`lane-start <repo> <n>` and `lane <name>` run from a place that is not the
-binding — a different `host`, `container` or `window` — **REFUSE to bind**.
-Where stdin is a terminal they first ask, naming the binding:
-
-```text
-lane openRepoTools-3 is bound to window cloudsess:4 @62 in container cloud-bench
-on host eagle (session d1ac715c-…, last line 2026-09-15T12:39:07Z); this tmux
-server says that window is live.
-ask it to hand off, then bind here? [y/N]
-```
-
-A `y`, or the flag **`--request-handoff`** from a caller with no terminal (an
-agent's stdin is not one, and the refusal names the flag), is **the request**:
-
-```sh
-lanes-edit.sh request-handoff <lane> [--wait <s>] [--session <uuid>] [--no-wait]
-lanes-edit.sh request-handoff <lane> --force "<why>"
-# 0 the lane is free — bind it · 2 the wait ended empty, or refused
-# 8 the lane was already free · 1 a read failed · 64 usage
-```
-
-In the clause's own order, and the order is load-bearing:
-
-1. **The line is written and PUSHED first**, so the bound session can read it
-   from anywhere:
-   `HANDOFF-REQUESTED — lane <l>, session <requester uuid>@<ws>, <UTC>, lane:<l> → by host <h>; container <c>; window <w>; wait <n>s`.
-   `HANDOFF-REQUESTED` is a lane-kind verb that **changes no state**: every
-   last-line reader skips it, and `lane-last` after a request still answers
-   `STARTED`.
-2. **Then, and only where the bound pane is on THIS tmux server**, the requester
-   types `/handoff --exit requested by <uuid>@<host>/<container>` into it —
-   Amendment 12's M1, the one mechanism a running session has, and only while
-   that pane's current command is `claude`. It is an optimisation of the
-   same-host case and never the request: a session that never reads it answers
-   at its hook's next read of the pushed line.
-3. **Then it waits** — `--wait <s>`, default **300** — polling the published log
-   every fifteen seconds (`$LANES_POLL_SECONDS` is the test seam) for a
-   `PAUSED`, `ENDED` or `RETIRED` newer than the request. When one arrives the
-   lane is free and the requester binds as it would have.
-
-The **session field is the requester's own transcript uuid** and Amendment 7(b)
-admits nothing else there. Where none is knowable — a bare shell with no
-`$CLAUDE_CODE_SESSION_ID` and no live record for its window — the request is
-**refused** and names `--session <uuid>`, rather than writing the literal
-`unknown` into a log no later line can correct.
-
-### The bound session answers at its own prompt
-
-The prompt guard (Amendment 12) makes two more reads of the lane's own log:
-
-- **(d)** a `HANDOFF-REQUESTED` newer than this session's binding and not yet
-  answered → it **refuses that one prompt**, names who asked and from where, and
-  types `/handoff --exit requested by …` into its own pane. The handoff is
-  Amendment 17(a)'s, unchanged in its steps, and under `--exit` the session
-  **ENDS** — a handoff to another place is a handoff and not a restart. Nothing
-  the person typed is lost: the refused prompt is theirs to type again in the
-  new place.
-- **(e)** a `PAUSED` newer than the binding that **this session did not write**
-  → it refuses **every prompt from then on**, naming the line and who forced it,
-  until the person there hands off or ends the session.
-
-**A working session is never interrupted** (clause (f)): no `Escape`, no signal
-to the process, no `respawn-pane` from a requester. A hook fires at a prompt
-boundary; a session inside a long turn answers when that turn ends.
-
-### The wait ends with nothing — refuse, and only a word forces
-
-A wait that ends with no release is a **refusal, exit 2**, printing the facts a
-person needs: the binding (host, container, window, the line and its UTC), the
-request and its UTC, whether the pane was reachable and typed into, and the one
-word that overrides.
-
-**`--force` is a second invocation, never automatic**, and it takes a WHY. It
-writes
-
-```text
-PAUSED — lane <l>, session <requester uuid>@<ws>, <UTC>, lane:<l> → on behalf of <bound uuid>; forced by <uuid>@<host>/<container>; why <why>; host …; os …; container …
-```
-
-— the **writer's own session in the session field**, so it is not impersonation
-(the retired-lane release of 2026-09-13, openRepoTools#30, is the precedent) —
-and then binds. The why is written as a NAMED sub-field, `why <text>`, which
-clause (e) does not spell and which the log needs: every reader here matches a
-sub-field by the word it OPENS with, so a why beginning `host is unreachable`
-would be read as that line's `host`, refused by the writer's own check, and the
-person would be told about a field they did not write. The line's own three
-separators — `, `, `; `, ` — ` — are folded to a middle dot inside it rather
-than refused, because the person typed a sentence and not a grammar. The bound session, if it is alive after all, reads that line at
-its next prompt and stops, loudly. **Two places never both write a lane in
-silence.**
-
-### A live lane's one act is the attach
-
-A lane that is LIVE is never started a second time — clause (h) is one live
-process per transcript, and a `lane-start` or a `pclaude` on a running lane is
-exactly the second one. So `lanes` prints the act for it, filled in:
-
-```text
-openRepoTools-3            LIVE     Eagle      team-05c     bindsess:0 @61
-                           attach: tmux switch-client -t bindsess:@61   (it is LIVE — never a second lane-start on a running lane)
-```
-
-`tmux switch-client` inside tmux, `tmux attach` outside it. The target names the
-session **and** the window, because `attach -t <session>` alone lands on
-whatever that session has since made current — another lane. The choice between
-the two is made in the READ (`lanes_rows`, column 10), so `lanes` and `lane`
-cannot come to offer different acts for one row.
-
-### What `workstation` prints now
-
-```sh
-lanes-edit.sh workstation
-# <workstation> <source> <host> <source> <os> <source> <container> <source>
-```
-
-Eight tab-separated fields; the first two are unchanged, which is the contract
-`lanes`, `lane` and `lane-handoff` already read with `cut -f1`/`cut -f2`. Each
-source is `seam` (the launcher exported it), `hostname` (probed), `workstation`
-(a container with no export, writing the Rule 10 name for its host), `kernel`
-(the `uname` / `/proc/version` probe) or `outside` (no container) — **and, for
-the WORKSTATION field alone, `container-unset`**, which is Rule 10's own answer
-where this IS a container and nothing exported `$LANES_WORKSTATION`: the NAME
-still answers there, because a read in front of every launch may not refuse,
-while every WRITER refuses on it by name. It predates this clause and the reads
-table above has carried it all along; a reader holding this paragraph to five
-words would reject a valid eight-field line from exactly the containers this
-amendment is about.
-
-## The name guard and the lock (Amendment 12)
-
-**A lane session normally works while three names are one.** A readable,
-recoverable lane/session mismatch now pauses for an explicit choice; unreadable,
-ambiguous, duplicate, or superseded identity still refuses the prompt. Ratified
-by Brett Heap 2026-09-13T18:20:44Z — *"Ratify revision 2"*, with M1 *"Type
-/rename into the pane"*.
-
-The three:
-
-1. the tmux **WINDOW** it runs in is named for a lane;
-2. the **SESSION's own name** — the live record's `name` — is that same name;
-3. the register **ROW** keyed by that name records this session's id as the
-   **LAST** id of its session cell (Amendment 6(b)).
-
-`lanes-edit.sh guard` is the `UserPromptSubmit` hook that reads them. Where they
-agree it is **silent and exits 0**; where they do not it **exits 2**, which is
-what blocks a prompt, and prints the triple as it stands and the ONE command
-that cures it, filled in. It is the only subcommand in that file that refuses a
-person's work.
-
-```console
-$ # what the person sees on a blocked prompt
-lanes-edit: THE NAME GUARD REFUSES THIS PROMPT (lane-collision-protocol Amendment 12). The three names:
-lanes-edit:   window   eagle:@12 'claude'
-lanes-edit:   session  d1ac715c-… 'openRepoTools-3' (nameSource user) pid 1924546 profile team-05f
-lanes-edit:   row      this window names no lane, so no row is keyed by it
-lanes-edit: this window is named 'claude', which is no lane, while the SESSION is named for lane openRepoTools-3 — …
-lanes-edit: run: lane-start --no-launch openRepoTools 3
-```
-
-### The table — one row per state, one cure each
-
-Every message prints the register's own spelling of the lane (Amendment 15) and
-every command is filled in, never `<repo> <n>`.
-
-| what it finds | what it does |
-|---|---|
-| the window is not a lane, the session name parses as `<repo>-<n>` | `lane-start --no-launch <repo> <n>` — **the 2026-09-10 case**, which ran for three days unrecorded |
-| neither name is a lane | refuses and says so: WHICH lane this work is is yours to name, and a guard that guessed would bind a window to a row nobody chose |
-| the window is a lane, this uuid is the row's last id, the session name differs **only by case** | the lock renames it to the ROW's spelling — a lane name is ONE name under any case (Amendment 15), so there is nothing here for a person to decide |
-| … and the session name is a **FORMER name of this lane** | the lock renames it to the row's spelling — the alias table makes that name this lane for ever (Amendment 16(e)), so a rename run from another window is drift to finish, not a choice to put to anyone (Amendment 16(f)) |
-| … and the session name differs by more — a non-lane word, a `<lane> (N)` title, ANOTHER lane's name, no name at all | **THE THREE-CHOICE OFFER** (below), and NOTHING is typed until a person picks `3` |
-| the window is a lane, this uuid is IN the cell but not last | a SUPERSEDED transcript: exit, `lane-start <repo> <n>`, which resumes the id the row ends on |
-| the window is a lane, this uuid is in NO row | the harness minted a transcript with nobody acting: `lane-start --no-launch <repo> <n>`, the recording act, no relaunch |
-| the window's name matches TWO rows differing only by case | refuses naming both spellings and the merge, which is a person's act (Amendment 15(d)) |
-| not inside tmux at all | refuses: a lane RUNS in a tmux window named for it (Rule 4, Amendment 2) |
-
-**A lane named before Rule 4's `<repo>-<n>` form has no `<repo> <n>` to fill
-in**, and nothing in the register, the window or the session says where its
-checkout is. Rows 1, 5 and 6 then say so in the offer's own words (below) and
-print the offer's own line, `lane-start [--no-launch] --dir <that lane's
-checkout> <lane>`: the checkout is yours to supply, and a bare `--dir <path>` is
-never printed as though it were a command (openRepoTools#73).
-
-### The lock
-
-Under the projects root the session name is **not the person's to set freely; it
-is the lane's** (clause (h), Brett Heap's D5). `lane-start` sets it at every
-launch (`--name "$LANE"` on all three branches), and **the lock is what answers
-the two drifts that are not decisions**:
-
-* a name that differs from the row's only **by CASE**, which is the same lane
-  under Amendment 15; and
-* a name that is a **FORMER name of the row's own lane**, which is the same lane
-  under Amendment 16(e) — the alias table resolves it to this row for ever, so
-  a session still called `repoRen-1` on a lane the register now spells
-  `repoRen-7` is not a lane anybody is moving to. It is what a `lane-rename` run
-  from ANOTHER window leaves behind, and finishing it is clause (f)'s whole job.
-
-There the guard renames it
-for you — it types `/rename <lane>` into this session's own tmux pane, which is
-the only path a running session's name has (M1 — the docs name `--name` at
-launch, `/rename`, and `Ctrl+R` in the picker, and nothing else). That one
-prompt is refused so the rename lands first; send it again. (The WINDOW's half
-of the same drift needs nobody: a window's name is one tmux call, so the guard
-simply makes it — Amendment 16(f).)
-
-**Every wider mismatch is the offer below and nothing is typed into the pane
-until a person picks `3`.** A session called `openrepotools-b9`, a
-`<lane> (2)` title, ANOTHER lane's name, no name at all: which lane this
-conversation is is a decision, and the guard asks rather than renaming on the
-person's behalf — and two of the three answers would be wrong for a former
-name, which is why that one is the lock's and not the offer's. What follows about the PANE — which one, and whether it may be
-typed into at all — is the mechanism both the lock and choice `3` use.
-
-The pane's **current command is asked first** and nothing is typed into a pane
-running anything else — `claude` and nothing else, which is M1's own word:
-`/rename openRepoTools-3` typed at a shell is a command that does not exist,
-typed into an editor it is text nobody wrote, and typed into a Node REPL it is
-input somebody has to clear. A pane whose command cannot be read is not typed
-into either — fail closed. Every outcome but a successful typing prints the line
-for you to type yourself, which is the cure and not a failure: on Eagle today
-two panes report `bash` (a session under a launcher wrapper), and those are
-exactly the windows where you will read it.
-
-**Which pane**: the one the live record names, and where the record names none
-— the harness has been seen to write no `tmux` field for a process plainly in a
-window — the pane this hook is itself running in, `tmux display-message -p
-'#{pane_id}'`. Both hooks run inside the session's own pane, so that is the same
-pane, asked of tmux rather than guessed.
-
-A `<lane> (N)` title is a **mismatch** (ratified decision D4) and the suffix is
-evidence: it is exactly what a rename into a title something else still holds
-mints, so another holder of that name was live. That reading is printed **with
-the offer's three choices**, where this state now arrives, and it names
-`lanes-edit.sh forks <lane>` and `lane-end <lane> --retire <pid>` — never a
-`kill`, because stopping a process is the person's act and stays theirs
-(Amendment 11 clause (k) rule (e)).
-
-### The offer
-
-For a readable current lane/session mismatch, the guard now presents three
-numbered choices rather than choosing a repair automatically:
-
-1. **Allow this lane** — explicitly allow the current lane/session pair for
-   this transcript. Later prompts warn without blocking until either name
-   changes.
-2. **Adjust lane to session** — move the window and register binding to the
-   session's lane through the existing lane-start and UUID-anchor path.
-3. **Adjust session to lane** — type /rename <lane> into the verified Claude
-   pane. This choice never changes the register.
-
-The answer is the next prompt and is consumed by the guard. Invalid answers
-keep the offer pending. If the pane cannot accept choice 3, the guard prints
-the manual /rename command and keeps the offer. Choice 1 is stored per
-transcript under the session's offer directory and is invalidated when the
-lane, session name, or transcript changes.
-
-**And choice 1 is an answer to ONE row of the table above, honoured there and
-nowhere earlier.** It is read at the row it was given for — a readable lane
-whose uuid is the row's LAST id and whose session name is not the lane's — so
-an unreadable register, an ambiguous one, a duplicate live process, a
-SUPERSEDED transcript and a uuid the row does not name at all are refused
-through it, exactly as they are without it: an allowance is not a bypass. The
-three names agreeing again ends it too — that is one of them having changed —
-so the file is dropped and a later drift is a fresh question rather than a
-silent pass on an old answer.
-
-*"if the user does a rename, then we should offer to move to that lane or create
-a new lane if we do not have one as that name"* (D5, verbatim). A record whose
-`nameSource` is `user`, whose `name` is another lane's, and whose `nameSince` is
-later than this window's binding is a person saying **"this is that lane now"**
-— so the guard **asks** rather than guessing:
-
-```console
-lanes-edit: WARNING: the lane and Claude session names disagree.
-lanes-edit: 1) explicitly allow this lane for this transcript
-lanes-edit: 2) adjust the lane to session openRepoShape-2
-lanes-edit: 3) adjust the session to lane openRepoTools-3 (types `/rename openRepoTools-3`)
-lanes-edit: Reply `1`, `2` or `3`.
-```
-
-The numbered answer is the **next prompt**; it is consumed by the guard and
-never reaches the model. Anything other than `1`, `2` or `3` asks again.
-The pending offer is held per session id under
-`$CLAUDE_CONFIG_DIR/lanes/offers/<uuid>`. **An answer is a prompt**, so it
-waits behind the duplicate read below: while a second live process carries this
-transcript the answer is refused with that, and the offer is kept for the first
-prompt after the other process is retired.
-
-**A lane named before Rule 4's `<repo>-<n>` form is offered, not run.** The
-register carries 22 of them, and `lane-start` needs such a lane's DIRECTORY,
-which nothing in the register, the window or the session says. So the offer
-says what it cannot fill in and choice `2` refuses rather than running a command
-with a `<path>` placeholder in it: the move is
-`lane-start --no-launch --dir <that lane's checkout> <lane>`, yours to run with
-the path filled in, and the offer is kept. On choice `2` the **window is renamed first** and that order is
-load-bearing: `lane-start`'s step 3b veto 2 refuses to take the session live in
-a window named for another lane, which after choice `2` is exactly what this
-window is — without the rename `lane-start --bind` refuses, because its binding
-mode answers veto 1 and never veto 2.
-
-**And choice `2` runs `lane-start` in its binding mode, `--no-launch --bind
-<this uuid>`** (openRepoTools#70). Its step 3b **veto 1** never takes a uuid
-that belongs to ANOTHER row (Amendment 11 clause (d) rule 1), and after the
-rename this uuid still belongs to the lane being left. Without an answer to that
-veto `lane-start` left the person's own transcript out of the new lane's cell —
-and the next prompt then found a lane window whose row did not name this
-transcript and refused, with a cure that vetoed for the same reason and changed
-nothing. A blocking hook that refuses for ever, on a state it created by obeying
-the person, is the worst outcome this surface has. So the guard used to append
-this uuid to the cell itself after `lane-start` returned — by which time
-`lane-start` had taken the destination row's ordinary resume path and stamped
-the row, the lane's log and the handoff `RESUMED` by the id **that row already
-had**, under `--no-launch`, about a conversation nobody was in. `--bind` is the
-person's `2` handed to `lane-start`: it appends this uuid to the cell first,
-with its own anchor discipline (the PUBLISHED last id, so a stale copy of the
-row refuses rather than writing a cell that no longer matches), and every stamp
-it writes names this uuid. The guard makes no register write of its own for it
-any more: it reads the cell back and says it ends on this uuid, or prints the
-act that puts it there where `lane-start`'s append could not land — a copy of
-the row older than the published one, or a cell carrying no uuid and neither
-`none recorded` nor the `pending` line. Its old write is not kept behind that as
-a fallback, because it used the same anchor and would have refused in exactly
-the same places. That is not a hole in veto 1: the veto exists for the take
-nobody asked for, and clause (h) rule 4's limit is that the lock never moves a
-uuid between rows **without the person saying so** — here they have, in the
-answer given at this very prompt.
-
-### The duplicate read (Amendment 18(h))
-
-**A transcript is held by ONE live process.** The harness can fork one
-(`--fork-session`, minting a new id in a background pty host) or resume one
-twice, and the tooling refuses to build on either. Measured four times on
-2026-09-14, the last at 18:14Z: a `bg` record in one profile's `sessions/`
-beside the interactive record in ANOTHER's, both live, both carrying one
-`sessionId` — so the sweep is of **every** profile's directory, not the asking
-session's.
-
-The one live record this read passes over in silence is the harness's own
-**companion**: `kind: bg`, beside this window's own record, in the same
-profile's `sessions/` (Amendment 8, ruling (g) — *"records that share a
-`sessionId` are one session, not a queue of rival holders"*). The **kind** is
-what tells it from a second live process, not the profile: one profile can
-resume one transcript twice — no move, no swap, one command — and the
-interactive record that makes is 18(h)'s own case.
-
-**The companion is the harness's relation, not the asker's.** Where the asking
-window carries no record of the transcript at all — `lane-end --retire` typed
-in a bare shell or in another lane's window — it is read off the **lane's live
-window record** instead: the interactive record in a window tmux resolves and
-agrees with, and a `kind: bg` record in that record's profile is its companion
-from any window. Only one profile may answer; two live windows in two profiles
-on one transcript leave every row `unrelated`, as before (openRepoTools#73).
-
-`lanes-edit.sh transcript-holders <uuid>` is the read, and three surfaces share
-it rather than implementing the rule three times:
-
-* **the guard** refuses every prompt in a process that shares its id with
-  another live one, naming the pid, its window or `bg`, its profile, and the
-  retire act `lane-end <lane> --retire <pid>`;
-* **`lane-start`** counts the holders of the id it is about to resume or bind —
-  at the window-binding step and in the row-resume branch — and refuses rather
-  than appending such an id to the row or launching a second resume of it;
-* **`lane-end <lane> --retire <pid>`** retires a duplicate whose id **IS** the
-  row's own, which `forks` cannot see because its criterion is "an id the row
-  does NOT record". A duplicate is named by its **pid** and never by a uuid —
-  its uuid is the row's own and could not pick between the processes carrying
-  it; the uuid form is for a fork. The window's own session is refused **by
-  name**: retiring the session that IS the lane is how a lane loses the
-  conversation it is, and ending the lane is the bare `lane-end <lane>`. The
-  harness's own **companion** of that session is refused by name too: it is one
-  half of the live session, not a rival to it.
-
-A window is matched by **id AND session name** (Amendment 11(h)'s agreement
-rule) because tmux reuses window ids once a window is gone. **A silent tmux is
-not a dead window**: where that read comes back empty, a second, untargeted
-question (`tmux display-message -p '#{session_name}'`) asks whether a server
-answers here at all. Only a window a server that answers does not have is
-`(gone)`; one tmux did not answer about is `(no answer)`, and like `(not
-asked)` it **protects** the process in it, so `--retire` refuses the lane's own
-pid while tmux is down or unreachable rather than handing Amendment 6(d)'s
-retitle to the conversation that IS the lane (openRepoTools#73).
-
-### The `SessionStart` block's own line (clause (f))
-
-The `SessionStart` hook gains one line — `session name '<x>' was not the lane
-'<y>' — renamed` — and types the rename itself, so the first prompt already
-finds the three agreeing. It types over DRIFT only: a name a PERSON set to
-another lane's, newer than this window's binding, is clause (h) rule 2's
-instruction and this hook leaves it alone, says so, and lets the guard put the
-offer at the next prompt — otherwise a rename followed by a `/clear` would be
-undone before anyone was asked. It is that hook's **one act on a pane and its only act
-of any kind**: it stays read-only against the register and **always exits 0**,
-because a hook that fails is a hook that breaks the session it was meant to
-orient (R-A8-1). Where another live process carries this session id it **SAYS
-so** and names the retire act; the refusal is the guard's.
-
-### Fail closed for lane sessions, and safe-mode recovery
-
-A mismatch refuses, and so does an **indeterminate read** — session records
-unreadable, tmux not answering, the register unreadable, a payload naming no
-`cwd` — naming the read, because a triple that cannot be verified is not a
-triple that agrees (clause (d)). The row is read from `origin/<branch>` as this
-checkout last had it (R19) and **the guard never fetches**: this hook runs at
-every prompt, and putting the network there would be R-A8-1's objection several
-times over.
-
-Profile-only launches with exact `CLAUDE_NO_LANE=1` are exempt, as described
-under Scope below. For a session subject to the guard, `claude --safe-mode` runs
-with every hook disabled — deliberate, visible in the
-prompt box, and **a session started that way is not a lane session**: it may not
-write the register or claim an object. The hook's `timeout 5` is the other way
-it can fail open, and it is the amendment's own number: a hook that exceeds its
-timeout is killed, and a killed hook does not exit 2.
-
-### Scope
-
-Sessions launched with `CLAUDE_NO_LANE=1` skip the prompt guard, silently. The
-workBenches profile launcher supplies this marker for a launch without a lane
-and clears it for an explicit lane launch. Explicit `--no-lane` wins over lane
-options. Other marker values keep the normal checks. The hook stays installed
-in profile settings so a concurrent lane session using the same profile still
-receives enforcement. Existing sessions need a relaunch to change launch mode.
-
-The guard applies to every session whose `cwd` is under `$PROJECTS_ROOT`
-(default `~/projects`), which is every estate session, and is **silent
-elsewhere** (D1): a name there is a title and nothing more. A **subagent's**
-prompt — hook input carrying `agent_id` — is exempt, because subagents do not
-submit prompts and the lane that runs them has already passed.
-
-Installing it is `openRepoTools --install`'s: the entry
-`~/projects/xFactory/lanes-edit.sh guard`, timeout 5, under
-`hooks.UserPromptSubmit` in `~/.claude/settings.json`, beside the `SessionStart`
-one. It carries **no `|| true`** — on `SessionStart` that suffix is the whole
-safety property, and here it would be the opposite of the mechanism, since
-`cmd || true` exits 0 for every code the command can produce and a guard that
-refuses nothing silently is the exact state this amendment exists to end.
-
-## The row is current state; the log is history (Amendment 13)
-
-**In force — ratified by Brett Heap 2026-09-13T21:08:36Z, verbatim "Ratify as
-drafted (Recommended)".** The `state` column was defined as a cell and used as
-a diary. Measured the day the amendment was drafted: the register was
-1,141,283 bytes over 46 rows, its longest row 96,228 characters, and one lane's
-cell 7,016 characters after a single day of appending — three different things
-in one column (the lane's CURRENT state, which Rule 6 reads; a running
-narrative; and rulings quoted verbatim), appended forever with ` · `, never
-replaced, in a table nobody can read in the table.
-
-### The cell is one phrase, and every write replaces it
-
-```text
-<STATE> · <UTC> · <one line>
-```
-
-`STATE` is one of `LIVE`, `PAUSED`, `LANDING #<n>`, `LANDED`, `ENDED`,
-`RETIRED`, `HANDED OFF`. **Rule 6 is unchanged** and is now the whole of what
-the cell says at that moment. The line is at most **240 characters** (ratified
-decision O1) and carries neither a `|` (it would forge a cell boundary) nor a
-second ` · ` (it would read back as a fourth part of the phrase).
-
-```sh
-lanes-edit.sh set-row-state my-lane "LANDING #123 · CI green; waiting on review"
-```
-
-The UTC is stamped by the writer, never passed in. `append-row-status` is
-**RETIRED** and refuses, naming this and the two verbs below: the cell can
-never grow again because the act that grew it is gone, not because every caller
-remembered.
-
-**Which text is the state cell** is decided by splitting the row on ` | `, and
-a seven-column row has exactly six of those separators. A row with more has a
-` | ` inside one of its cells, and the two readings of it — count six from the
-left, take the last cell from the right — disagree about which text to
-overwrite, so **that row is refused by name** rather than written at a guess.
-Measured on the live register 2026-09-15 (52 rows): 50 split cleanly, and the
-two that do not are cured by escaping the literal pipe as `\|`, the way a
-Markdown table carries one, in a hand edit wrapped by `lanes-edit.sh commit`.
-A bare `|` that is *not* spelled ` | ` is harmless and stays inside its cell.
-
-### The narrative goes to the lane's own log
-
-Two verbs join Amendment 7's, in the same file, with the same grammar:
-
-```text
-NOTED — lane <lane>, session <uuid>@<ws>, <UTC>, lane:<lane> — <what the lane did, found, launched, left>
-RULED — lane <lane>, session <uuid>@<ws>, <UTC>, lane:<lane>[ → <object>] — <Brett Heap's words, verbatim>
-```
-
-```sh
-LANES_LANE=my-lane lanes-edit.sh log NOTED lane:my-lane "rebased on main; the flake is the fixture's clock"
-LANES_LANE=my-lane lanes-edit.sh log RULED lane:my-lane → opensoft/openRepoTools#29 "Ratify as drafted (Recommended)"
-lanes-edit.sh history my-lane [--since <UTC>]
-lanes-edit.sh history --all [--since <UTC>]          # every lane, on one timeline (Amendment 14)
-lanes-edit.sh history --repo <owner/repo>           # the lanes whose home it is
-```
-
-`NOTED` takes no payload; `RULED` takes one, the object it bears on, and that
-object is canonicalised through `repos.tsv` like every other object this
-tooling writes. **Neither is a transition of anything**, so neither ever moves
-a lane's state: `who`, `lane-end`, Amendment 11's `lanes` and `swapped` skip
-them exactly as they skip `STARTED` and `RESUMED`. `history` prints them in
-**file order**, which is the order the lane wrote them (R14), and exits 8 for a
-lane that has written none.
-
-### The migration — one act, on Brett Heap's word
-
-```sh
-lanes-edit.sh migrate-state-cells            # DRY RUN: reads everything, writes nothing
-lanes-edit.sh migrate-state-cells --yes      # the one act
-```
-
-Each row's cell is split on ` · ` into entries, oldest first. Each becomes one
-log line: `RULED` where the entry begins with `RULING`, `RULINGS` or
-`RATIFIED`, else `NOTED`; the entry's own leading timestamp becomes the line's
-UTC (a row's `started` where it carries none), the session is the **last uuid**
-of the row's session cell, and the workstation is the first `/`-separated part
-of the row's own column. The cell is then replaced by the state the **last**
-entry's leading verb names, else by `MIGRATED · <UTC> · history in
-lanes/log/<lane>.md`.
-
-**One commit** carries the archive `lanes/archive/LANES-pre-amendment-13-<UTC>.md`,
-every log it appended to, and the register — so the narrative exists three
-times over (git history, the archive, the logs), which is the posture
-Amendment 3 took after the 2026-09-08 loss. It **refuses** when no cell holds a
-` · ` entry it can migrate, so a second run is a no-op that says so.
-
-A row it cannot take is **skipped and named**, never half-written, and its cell
-keeps every character so that a re-run after the row is settled migrates
-exactly it. Five reasons: the row is ambiguous (above); its session cell holds
-no transcript uuid, so the line could only name `unknown` in the one field an
-append-only log must never carry it in; two rows differ only by case
-(Amendment 15(d)); the lane's log is two files or is published under a spelling
-this checkout does not have; or the first cell is not a lane name.
-
-## Renaming a lane (Amendment 16)
-
-**In force 2026-09-14T09:24:35Z**, ratified verbatim *"Ratify as drafted
-(Recommended)"* on Brett Heap's request of the same day, verbatim: *"we need the
-ability to rename a lane. maybe lanes --rename <current lane name> <new lane
-name>."* **A LANE IS RENAMED BY ONE WORD, IN ONE COMMIT, AND ITS OLD NAME KEEPS
-RESOLVING FOR EVER.**
-
-Why it exists: on 2026-09-14 two lanes renamed themselves **by hand**, each as
-one `RENAMED` line appended to `LANES.md`. The lines are honest and they are all
-there is — the rows still carried the old keys, the logs and the handoffs the old
-names, and a reader of either lane's history had to know the rename to follow it.
-
-```sh
-lane-rename openxfactory-4-opendox-extraction openxfactory-4 "Brett Heap's word: shorten it"
-lane-rename hermes-wallet-exercise codeXfactory-2 --no-github
-lanes --rename a b        # REFUSED, and it names `lane-rename`
-```
-
-The first two lines above are the amendment's own **adoption act**, and they
-have not been run: clause (i) says the two hand renames of 2026-09-14 are *regularised by the
-adoption act, not re-done* — their rows, logs and handoffs moved by this command
-**on Brett Heap's word**, with their existing `RENAMED` lines in `LANES.md` left
-exactly where they are.
-
-### What one command does
-
-| # | clause | the move |
-|---|---|---|
-| 1 | (b) | the register row's key cell becomes `` `<new>` ``, and the text beside it gains `` *(ex `<old>`, renamed <UTC>)* `` — the form the register already uses for a lane named later than it started. Nothing else in the row changes; **the session cell keeps its history** (Amendment 6(b)) |
-| 2 | (c) | `lanes/log/<old>.md` → `lanes/log/<new>.md`, plus one line: `RENAMED — lane <new>, session <uuid>@<ws>, <UTC>, lane:<new> ← lane:<old> — <why>` |
-| 3 | (d) | the handoff the row names → the same date with `lane-<new>`, plus a Rule 3 stamp under its header block: `RENAMED from <old> by <uuid> (lane <new>) at <UTC>`. The row's handoff column follows |
-| 4 | (e) | `lanes/aliases.tsv` gains one TAB-separated record, `<old><TAB><new><TAB><UTC>` |
-| 5 | (g) | **after** the commit lands, one GitHub comment per object the lane HOLDS, citing its sha — the same partition `who --lane` reports and `lane-end` refuses on. `--no-github` skips it |
-| 6 | (f) | the tmux window is renamed, and `/rename <new>` is typed into the lane's own pane (Amendment 12(h)'s M1 — the only path a running session's name has) |
-
-**The first four are ONE commit, refused or whole.** Any two of them apart is a
-state no reader can read: a row under `<new>` whose log is still `<old>.md` is a
-lane whose history `who --lane` cannot find, and an alias without the row it
-points at is a name that resolves to nothing.
-
-### The refusals — clause (a), before anything is written
-
-| the state | why |
-|---|---|
-| no row under `<old>` in any case, and none through an alias | a rename moves a row that exists; `lanes --all` lists the ones that do |
-| a row under `<new>` in any case | two rows for one name is what every writer here refuses (Amendment 15(a)) |
-| `<old>` and `<new>` are one name under any case | that is not a rename but a change to the row's own SPELLING, which every reader already resolves to — Amendment 15(d)'s hand act |
-| `<new>` is not `<repo>-<n>` and no `--verbatim` | Rule 4's form is what `lanes --prefix`, the next free position and `lane-start <repo> <n>` are computed from |
-| a **LIVE** session holds `<old>` in another window | its own name is locked to the lane and only it can change that (Amendment 12(h)); renaming from elsewhere would leave a running conversation named for a lane the register no longer has |
-| two rows under `<old>` differing only by case | there is no ONE row to rename (Amendment 15(d) merges them first) |
-| the alias table would gain a **cycle** | a chain that returns to its own start has no end to resolve to |
-| `<new>` is already an alias **key** | a row wins over an alias, so a row under a name some other lane was renamed away from would END that lane's old name resolving |
-| `lanes/log/<new>.md` exists in **any case**, here or on `origin` | one lane's history appended to another's is the one thing an append-only log cannot be walked back from |
-| the row's handoff is **outside the workspace repository** | a commit cannot carry a file outside its own checkout, so the rename would be three moves and a note |
-| an unreadable register, log, handoff or alias table | fail closed, naming the read — an alias table that cannot be READ is not an estate with no renames |
-
-Each of them says **"Nothing was written."** The command moves four files, and a
-half-done rename is not something a second run can finish.
-
-And a filesystem can still refuse the third of four moves. Every write between
-the first byte and the commit is made against a **snapshot** taken before it, and
-every exit path — a `die`, a signal, the shell — restores it: the log, the
-handoff and `lanes/aliases.tsv` go back to what they were and nothing is
-committed. The register is not in the snapshot and does not need to be:
-`replace_line` proves the new file before it writes a byte of `LANES.md`.
-
-### The alias table, and the one seat every reader shares
-
-`lanes/aliases.tsv` lives beside the register — `<old><TAB><new><TAB><UTC>`,
-comments on `#` lines — and `lane-rename` is its only writer. It has **one
-layer**, unlike `repos.tsv`: a repository alias is an organisation's fact and a
-lane rename is one person's register moving, so openRepoTools ships none.
-
-Clause (e) lists the readers that resolve through it — `who`, `lanes`,
-`live-holder`, `history`, Rule 6 attribution, `lane-start`'s row lookup, the
-`SessionStart` block and Amendment 12's guard — and **that list is not built as a
-list.** Amendment 15 already put `canon_lane` in front of every one of them, so
-the resolution is hooked there, once:
-
-* **a name with no row** is looked up in the table, case-insensitively, and the
-  chain (`a→b`, `b→c`) is walked to its end — stopping at **the first name along
-  it that has a row**, because **a row wins over an alias at every hop**, not only
-  at the start. That is what makes renaming a lane back to an old name readable,
-  and it is what keeps a lane legitimately minted under a freed name (`a→b` frees
-  `a`, and the next free position hands it out) as its own lane rather than a
-  second reading of `b`. The walk is bounded by the table's own size, never by a
-  fixed number of hops: a chain longer than the cap would otherwise resolve to an
-  intermediate name and clause (e)'s "for ever" would quietly end there;
-* **the lane field of every old log line** is resolved *on the way in*, in
-  `LOG_AWK`. Clause (c) is explicit that the lines above the `RENAMED` are never
-  rewritten, so a renamed lane's log holds its history under two names in one
-  file; read byte for byte, half of that lane's holds would be invisible to
-  `who --lane` and to `lane-end`'s refusal. One rule in the parse serves every
-  reader behind it;
-* **the tmux window's name.** A rename run from another window leaves that
-  window carrying the old name — and the name guard resolves it, **renames the
-  window itself** (one tmux call, unlike a session name), and types the
-  `/rename`. So a rename made from anywhere is finished by the lane at its next
-  prompt, with nobody typing anything.
-
-The old name resolves **for ever**: nothing in this toolset ever removes a row
-from that table.
-
-### `RENAMED` is a lane-kind verb that changes no state
-
-It joins Amendment 7's verb list as a lane verb — its object is `lane:<name>` —
-and it is outside the last-line rule **by construction**: every state read here
-enumerates the five verbs that do change state (`STARTED PAUSED RESUMED ENDED
-RETIRED`), so a lane's last `STARTED` or `PAUSED` is still its last one after a
-rename, which is what decides whether it is running, swapped or closed. It is not
-written by hand: `lanes-edit.sh log RENAMED …` is refused and names `lane-rename`,
-because a line on its own is exactly the 2026-09-14 hand rename this amendment
-replaces.
-
-### `lanes` stays read-only
-
-Amendment 11(j)'s *"it writes nothing"* is untouched (clause (h)). `lanes
---rename` is refused with the one word to type — the flag is answered rather than
-left unknown, because the request that produced this amendment spelled it that
-way.
-
-
-## The handoff (Amendment 17)
-
-**In force 2026-09-14T09:45:33Z** (revision 2, `/ctx` included), with Amendment
-18(d)'s `--exit` and Addendum 2's respawn line. **A HANDOFF IS THE SWAP, UNDER
-ONE NAME; A LANE RESUMES FROM ANY AGENT THAT CAN READ IT; AND `/ctx` IS THE
-WHOLE ACT IN ONE WORD.**
-
-### One act, three names
-
-| where you are | the word |
-|---|---|
-| in the lane's session | `/handoff [why]` — and `/swap` and `/lane-swap` are its aliases, kept so that nothing written about them stops working |
-| in a shell in the lane's window | `lane-handoff [why]`, placed on `PATH` by `openRepoTools --install` |
-| clearing the context | `/ctx`, which is `/handoff --restart` |
-
-The steps are Amendment 8(a)'s and Amendment 11's, unchanged: the identity
-triple fixed, the handoff file refreshed with a fresh Rule 3 top block, the
-writers polled, `PAUSED` written, the restart line printed. What differs between
-a context clear, a usage reset, a profile switch and handing the lane to someone
-else is only **why**, and the record's free text has always carried that. The
-word was wrong, not the act.
-
-The skill `skills/handoff/SKILL.md` is the single source of the act; the files at
-`skills/lane-swap/SKILL.md`, `commands/handoff.md`, `commands/ctx.md` and
-`commands/swap.md` name it and add nothing — two copies of one procedure that
-must stay byte-equal is the alternative the amendment rejects by name.
-
-### The record's two new sub-fields
-
-The `PAUSED` payload gains two beside Amendment 11(c)'s `window`, `dir` and
-`profile`:
-
-```text
-PAUSED — lane repoHF-1, session a17a0001-…@Eagle, 2026-09-14T17:05:11Z, lane:repoHF-1 → swap; window hfsess:0 @21; dir ~/projects/repoHF; profile team-05a; workstation Eagle; agent claude; transcript a17a0001-… — clear
-```
-
-- **`agent <name>`** — `claude`, `codex`, or the launcher's name for whatever
-  wrote the line. A **manifest key**: letters, digits, `.`, `_`, `-`. The
-  pattern is also how this sub-field gets the `; ` rule without a token of its
-  own, and `lane-start --agent` reads it back to choose a launcher.
-- **`transcript <id|none>`** — the agent's own resumable id where it has one.
-  `none` is an **answer**, not a gap.
-
-And the tooling writes a third beside them, `kind <in-process|respawn|unknown>`,
-because it is the one fact about the act that FOLLOWS the record and no later
-reader can infer it: **an in-process clear does not kill this lane's writers**
-(**Amendment 17 Addendum 1**, clauses (h)–(k), in force 2026-09-14T20:59:31Z).
-Measured here on 2026-09-14 — a harness `/clear` mints a new transcript id in the
-SAME process, so every subagent survives it and only its in-flight tool calls die
-(a `Bash` killed that way exits 137); the handoff written a minute earlier said
-*relaunch every writer below*, and the live count a minute later showed all five
-alive on their worktrees.
-
-| kind | what happened to the process | written by |
-|---|---|---|
-| `in-process` | it keeps running, and every writer with it | `lane-handoff --in-process` |
-| `respawn` | it is replaced or ended — the pane respawned, the session exited, a profile switch, a usage-reset relaunch | `--restart`, `--exit`, `--late` |
-| `unknown` | not this command's to know: a plain handoff may be followed by a `/clear` or by a relaunch | a plain `lane-handoff` |
-
-The same word is in the line's FREE TEXT after the why — `clear in-process`,
-`clear respawn`, `kind unknown` (clause (h)) — so the person reading the record
-reads it too. **THE KIND SAYS WHAT TO EXPECT AND NEVER WHAT TO DO** (j). What
-says what to do is clause (i), and it is the same in every kind: the `WRITERS`
-section is **a list to COUNT, not a list to relaunch** — `ListAgents` in Claude,
-the agent's equivalent elsewhere; a writer still live OWNS its worktree and is
-sent one message rather than relaunched; only a writer that is NOT live is
-relaunched, from where it stands. Where the count and the block disagree, **the
-count wins**: the block is what the paused session expected and the count is what
-is true. And one worktree is one writer's for as long as that writer is live (k).
-
-**The writer validates both** (`pause_subfields_check`, called from
-`write_event`) and refuses the line rather than writing a sub-field no reader can
-use: this log is append-only, and `lane-start` launches on what it reads back.
-
-Three reads answer for them, all read-only: `lanes-edit.sh lane-agent <lane>`,
-`lanes-edit.sh lane-transcript <lane>` and `lanes-edit.sh lane-last <lane>` (the
-lane's last lane-kind line as `<verb>	<utc>	<session>	<payload>`). `swapped`
-gains a sixth and a seventh field for the same two:
-
-```console
-$ lanes-edit.sh swapped Eagle
-repoHF-1	2026-09-14T17:05:11Z	hfsess:0 @21	~/projects/repoHF	team-05a	claude	a17a0001-…
-repoSW-1	2026-09-12T10:00:00Z	claude-team-05b-20260912102132-2699:0
-```
-
-The second row is every record written before an amendment: the fields are
-**empty rather than guessed**, and the two reads answer **8**. Nothing is
-backfilled (Amendment 7(i)); each lane cuts over at its own next handoff. **The
-first field before the first tab is still the lane**, which is the contract every
-reader of this output takes and what makes a sixth and a seventh safe to add.
-
-### The launcher table — `lane-start --agent <name>`
-
-`lane-start <repo> <n>` reads the row and the last `PAUSED`. With no `--agent`
-the default is **the agent that paused**; with no `PAUSED`, `claude`.
-
-| agent | what is launched |
-|---|---|
-| `claude`, its transcript here | `claude --name <lane> --resume <id>` — Amendment 6's case (a), unchanged |
-| `claude`, no transcript here (or `--agent claude` named, or `LANE_START_FRESH=1`) | `claude --name <lane> --session-id <fresh uuid> "<the handoff's top block>"` |
-| `codex` | `codex "<the handoff's top block>"`; its resumable id is read back where it prints one |
-| anything else | **a refusal naming the two it knows** — a lane is resumed by an agent whose launch has been taught and tested, never by a guessed argv |
-
-**The top block is the head of the handoff down to its first `---` rule** (200
-lines at the outside), and it is delivered **after** the Rule 3 stamp is written,
-so the session reads a prompt that already carries the record of its own resume.
-The stamp names the agent where the agent is not Claude — `RESUMED by codex
-<id> (lane <lane>) at <UTC>` — and the row's session cell is appended in that
-agent's own spelling, `harness <uuid>` / `Codex <id>` / `<agent> <id>`, which is
-how the register has spelled Codex sessions since 2026-09-05.
-
-### `/ctx` — one word, and everything after it is automatic
-
-`/ctx` (`/handoff --restart`) performs the handoff and then **restarts in
-place**: `tmux respawn-pane -k` on the lane's own pane, and what comes up is a
-NEW session of the same agent whose **first prompt is the handoff's top block**.
-What tmux starts is not that session but a SUPERVISOR that launches it — the two
-subsections below are why, and they are `openRepoTools#94` — so the sentence
-holds end to end and no longer holds only as far as tmux accepting a command.
-That block's
-`WRITERS` section lists every worktree the lane had running: its branch, its last
-commit, what it was holding, and the brief it was given, so the new session finds
-them rather than discovering them — and its first line is Addendum 1 (i)'s, the
-COUNT. **`/ctx` says which it did** (j): this one respawns, so the record says
-`kind respawn` and the count then finds none, which is what makes relaunching
-each one right. A `/ctx` that clears IN PLACE is the other kind and must say so
-(`--in-process`, `kind in-process`): the process survives, its writers survive
-with it, and the block says to EXPECT every writer below live.
-
-**The record comes first, always, and the record is FOUR writes** (it was three
-until `openRepoTools#94`). A `/ctx` **refuses before it kills anything** where the
-`PAUSED` line did not land, where the row was not flipped (the register would say
-RUNNING about a session that has just been replaced), where the handoff could not
-be refreshed (its top block is literally the new session's first prompt, and a
-stale one hands over the instructions of another act), **or where the restart
-intent could not be written and read back**. A pane is never respawned over an
-unrecorded lane, and a pane respawned with no intent is a pane whose supervisor
-has nothing to launch from — the same unrecorded restart one step along.
-
-#### The restart intent — what makes the new session a FRESH one
-
-`opensoft/openRepoTools#94`, measured on Eagle at 2026-09-15T20:59Z: `/ctx` wrote
-its record, respawned its own pane with `LANE_START_FRESH=1 … lane <lane>`, and
-what came up was `claude --name <lane> --resume <the uuid it had just paused>` —
-the same conversation, not a fresh one. `lane-start` was right (both of its
-`(( ! fresh ))` gates were in the installed copy), `lane` was right (its available
-branch ends in a plain `exec`), and the variable simply never arrived. The
-launcher re-creates its child through tmux, and **a command tmux starts gets the
-tmux SERVER's environment, not the caller's** — `claude-profile`'s own code says
-so, which is why it writes six values into the command string explicitly. The
-seventh was never written, so it was never there.
-
-An environment cannot cross a boundary another repository owns. **A file can.**
-Before anything is killed, `/ctx` writes a RESTART INTENT under the lane's own
-legacy control root, independently of lifecycle snapshots,
-using an explicit `$LANES_LANE_STATE_ROOT` when configured. Otherwise, an existing
-intent under the recorded checkout's parent or `$PROJECTS_ROOT/.lane-state/<lane>`
-retains its location through reservation, preservation, cleanup and later reads.
-Distinct occupied intent locations or unreadable candidate ancestry refuse.
-Aliases of the same control-root directory count once; separate leaf symlink
-or hardlink entries refuse. With no existing intent, the recorded-parent rung precedes
-the projects-root fallback, with a checkout hint only when neither answers.
-Root selection shares the writer mutex with CAS. Recording a nested checkout
-cannot move this operation; PR #97 diagnostics retain their independent root
-selection and may reside elsewhere:
-
-```
-$ lanes-edit.sh restart-intent openRepoTools-3
-state            pending
-generation       7
-operation        ctx-20260915T210412Z-41233-1187
-mode             fresh-from-handoff
-agent            claude
-profile          max-001
-dir              /…/openRepoTools
-pane             claude-…:@6.%6
-handoff          /…/handoffs/openRepoTools/…md
-digest           9f2c…
-old_transcript   4135b2c9-…
-new_transcript   none
-attempt          0
-```
-
-It carries no credential and there is no field for one. `lane-start` reads it back
-and **the intent is the authority**: with a `pending` or `starting` intent whose
-mode is `fresh-from-handoff`, the launch is a new session named for the lane and
-primed by the handoff's top block, whatever the row's last uuid or the lane's last
-`PAUSED` record name and whether or not any environment variable survived. A
-`ready` intent is history and authorises nothing, which is what makes the next
-`lane <name>` an ordinary resume. `LANE_START_FRESH=1` still works and is no longer
-the authority; `lane-start --fresh` is the same thing as an argument, for a caller
-with no launcher between it and there.
-
-Two refusals rather than substitutions: an intent naming another checkout, or an
-`--operation` that is not the lane's current one, is a refusal that renames
-nothing and starts nothing — and a handoff whose **digest** has changed since the
-intent was written blocks the launch, because that file's top block IS the first
-prompt.
-
-#### Legacy compatibility and preparation recovery
-
-Supervised manual `/ctx` is a legacy compatibility path for Claude. Readiness
-uses trusted Claude-native interactive session records for agent provenance.
-Before replacing the old pane, the backend verifies the complete pending launch,
-an existing absolute checkout and the canonical handoff checksum. Equivalent
-handoff symlink paths retain their filesystem identity. Intent records reject
-unknown keys, malformed lines and control characters in launch facts; those facts
-are never flattened into different paths. Lane rename refuses unfinished or
-failed restart ownership under the shared writer mutex. Observer cleanup uses
-private cancellation and owned-child waiting, never a saved numeric PID signal.
-
-Supervised manual `/ctx` is a legacy compatibility path. Run
-`lanes-edit.sh legacy-restart-check <lane>` before any preservation writes;
-managed lanes and unreadable managed ownership refuse. The check uses feature
-001's installed read-only `legacy-check`, or conservatively refuses any matching
-managed storage when that reader is absent. It never edits JSON ownership.
-
-The backend reserves `preparing` before changing a handoff, register, log or
-window. A normal error or catchable signal changes only that exact reservation
-to `failed`; it never respawns the old pane. If an uncatchable termination leaves
-`preparing`, first verify the original pane/session is still alive and no
-replacement was launched. Read operation, generation and attempt with
-`lanes-edit.sh restart-intent <lane>`, then reconcile that exact reservation:
-
-```sh
-lanes-edit.sh set-restart-intent <lane> failed --expect preparing \
-  --expect-operation <operation> --expect-generation <generation> \
-  --expect-attempt <attempt> --reason 'preparation abandoned; old pane confirmed alive'
-```
-
-A new `/ctx` can then refresh the preservation record. This command authorizes
-no child launch from a partially prepared record.
-
-If preparation failed before `pending`, the failed intent keeps mode
-`preservation-only`, attempt 0 and no new transcript. It is not a failed launch
-and cannot be given to `--supervise`. Once every holder is confirmed absent,
-`lane <name>` may use ordinary resume without restart operation/attempt tokens or fresh-session selectors.
-It rechecks the same failed preparation before binding changes and before
-launch, leaves the intent unchanged, and retains the normal binding safeguards.
-A live or unknown holder still refuses. Failed `fresh-from-handoff` launches
-remain restricted to their same-operation supervisor.
-
-The first launch reserves `new_transcript` only while it is `none`. Every later
-write expects its exact operation, generation, attempt and transcript. The
-verified Rule 3 stamp is persisted with both `digest` and `prepared_digest`
-before `lanes-edit.sh publish-handoff` checks the expected digest and exact
-attempt under the workspace writer mutex, then atomically replaces the resolved
-handoff target. Both backend refresh and resume stamps use this publisher; manual
-semantic edits are staged in temporary files and use the same command. Interruption leaves
-either complete version valid for retry; unrelated changed prose refuses.
-Historical `ready` intents do not control an ordinary resume.
-
-#### The supervisor — what tmux actually starts
-
-The pane is respawned with `lane-handoff --supervise --lane <lane> --operation
-<id>`, **by absolute path**, because a respawned pane's `PATH` is whatever the
-person's shell profile makes of it. It is a MODE of a command that is already
-installed and not one more word: Amendment 18 Addendum 2 (i-8) is explicit
-that *"no word is kept on `PATH` for it alone"*, which is the ground on which
-`restart` was taken off `PATH` in the first place.
-
-The legacy supervisor requires both the recorded pane and current TMUX_PANE to
-be known and agree before claiming an attempt. A respawn forwards the configured
-control/protocol roots and the launcher's LANES_HOST, LANES_OS and
-LANES_CONTAINER identity alongside LANES_WORKSTATION. An existing unusable
-control-root directory or ancestor is a read failure; only genuinely absent
-storage permits an ordinary first launch. Readiness checks the child process
-state and refuses an exited child awaiting reap.
-
-What the supervisor does, in order:
-
-1. **claims** the intent — `pending`/`failed` → `starting`, compare-and-swap on
-   the operation, legacy generation and attempt, so a stale supervisor writes nothing;
-2. refuses before launching anything on a stale operation, a `starting` or
-   `ready` one, a pane the intent does not name, a changed handoff digest, or a
-   live holder of the lane (Amendment 18(h): a second session of one lane is the
-   collision the whole protocol is about — and the act it prints is
-   `lane-end <lane> --retire <pid>`, never a kill);
-3. **runs the launch as its CHILD** — `pclaude --lane <lane> <profile>`, which is
-   (i-8)'s second door, falling to `lane-start --fresh --operation <id>` where
-   there is no launcher or the record names no profile. Never `lane <name>`: that
-   is the human dispatcher, and attaching to a live session is one of its valid
-   outcomes;
-4. **confirms readiness** from a read-only predicate — the child alive, exactly
-   one live holder of this lane, its transcript the new one and not the paused
-   one, in the pane the intent names — and only then marks the legacy intent `ready`.
-   It never uses PR #97 diagnostic lifecycle state to decide restart readiness or writes managed JSON state. Ordinary STARTED/RESUMED events may update diagnostics independently. Tmux accepting a command is **not** a started session, and nothing
-   here treats it as one;
-5. **stays in the pane**, whatever happens. Amendment 11's own invariant is *"No
-   path the launcher opened exits the pane"*, and `/ctx` was the one path that
-   did: what tmux used to start was the launch itself, so a launch that failed
-   took the pane with it.
-
-#### The retry surface
-
-A launch that never reaches readiness leaves the intent `failed` with a bounded
-reason, and the supervisor prints the stage, the fact that the handoff is intact,
-and two lines — retry and read:
-
-```
-RESTART FAILED — lane openRepoTools-3, operation ctx-20260915T210412Z-41233-1187
-  the launch ended with status 127 before readiness was confirmed
-
-  retry:   lane-handoff --supervise --lane openRepoTools-3 --operation ctx-…
-  read it: lane-handoff --restart-status --lane openRepoTools-3
-```
-
-Where there is a terminal it then asks once — `[r = retry, q = leave it]` — and a
-retry is **the same operation**: the same generation, digest, directory, profile
-and launch mode, with the attempt count incremented. Where there is no terminal
-it exits 3 — or **4**, where the launch ran past the readiness deadline still
-alive and only then ended, which the record says as well.
-
-**A signal reconciles only a successfully claimed attempt.** Before claim,
-`SIGTERM`/`SIGHUP` leaves the intent unchanged. After claim, a live or unknown
-child leaves `starting` with `INDETERMINATE` and blocks retry; a proven ended
-child may leave `failed`. Neither handler kills the child. Failure after the
-launcher exits also requires an affirmative empty all-holder read before retry
-is offered, because a descendant may still own the lane.
-
-Ctrl-C in that pane belongs to the **session**, not to the supervisor: the
-supervisor ignores `SIGINT` so that interrupting Claude cannot tear the pane down
-under it, and the launch is started with `INT` and `QUIT` put back to their
-defaults so the keystroke reaches the session itself. A deadline that expires with the child still ALIVE is a
-third answer, `INDETERMINATE`: nothing is killed (Amendment 8(f) — ending
-somebody's process is not a boundary script's act), nothing is retried, the lane
-is not marked running, and the reason goes into the record, because an interactive
-child owns the pane's screen.
-
-`lane-handoff --restart-status --lane <lane>` reads all of it from any window —
-the lane, the intent and its attempt, the operation and generation, the mode, the
-agent and profile, the checkout, the pane, the handoff and its digest, both
-transcripts, the bounded failure reason, and what act is open on it.
-
-**A second `/ctx` never supersedes a restart in flight.** With the intent
-`preparing`, `pending` or `starting`, an ordinary `/ctx` refuses before preservation writes and the kill and names
-the status command. Taking over an abandoned operation is an explicit act and not
-an automatic one.
-
-`/handoff --exit requested by <uuid>@<host>/<container>` is the other end
-(Amendment 18(d)): after the record, `/exit` is typed into this lane's own pane
-and the session **ends**, because a handoff to another place is a handoff and
-not a restart.
-
-### `--late` — the record a swap never left
-
-A session that died at a usage limit wrote no `PAUSED`, and the lane's log still
-reads as running. `lane-handoff --late --at <UTC> [why]` writes that record after
-the fact — and **it is written from a shell BEFORE the relaunch**:
-
-```sh
-lane-handoff --late --at 2026-09-14T12:02:27Z "late; usage limit hit before the swap"
-lclaude <profile>      # and only then; use pclaude --lane <lane> if lclaude is unavailable
-```
-
-**The rule, and it is the whole of why `--at` is required.** A lane's state is
-its log's last lane-kind line **in file order** (R14), and the log is
-append-only. A late `PAUSED` appended after the `RESUMED` that `lane-start`
-writes at the relaunch would make a lane that is **running** read as paused, in a
-file nothing rewrites. So a late line is **dated by its own field** — the moment
-the old session ended, which the caller names — and it is written only where the
-lane's last lane-kind line is a `STARTED` or `RESUMED` **older** than that
-instant. A last line that is already a `PAUSED`, an `ENDED`/`RETIRED`, or a
-`STARTED`/`RESUMED` at or after it is a **refusal that writes nothing** and names
-the act to take instead. Run from inside the session that has already been
-resumed, `--late` refuses: the honest record of the state that session holds is
-its own next `/handoff`.
-
-### The transcript follows the lane
-
-`lane-start`'s resume case (a) looked for `<the row's last id>.jsonl` only under
-the **current profile's** projects directory, so a lane restarted under a new
-profile after a usage limit never resumed its conversation.
-
-**Measured first, and the fact shrank the act** (2026-09-14T12:35Z): on a
-launcher-configured workstation every profile's `projects/` is ONE shared
-directory — `readlink -f ~/.claude-profiles/profiles/<org>/<team>/<any>/projects`
-→ `~/.claude-profiles/state/opensoft/projects`. So a transcript needs **no move**
-to be resumed under another profile. `lane-start` therefore **says where it found
-the transcript**, and says when that directory is shared:
-
-```text
-lane-start: transcript a17a…f3 found in this profile's projects directory
-(~/.claude/projects), which IS the directory profile(s) t3 read too (one
-shared directory: a profile switch resumes this lane by id and moves nothing)
-```
-
-Where the two profiles' `projects/` really are two directories — a workstation
-without the launcher's layout — the transcript is **moved** into this profile's
-(the `<uuid>.jsonl` and its sibling `<uuid>/` directory), a pointer
-`<uuid>.jsonl.moved-to-<profile>-<UTC>` is left where it was, and the move is
-said on one line. A **copy** would leave two live transcripts of one uuid to
-diverge, and nothing merges them.
-
-**A uuid whose holder is LIVE in the other profile is a refusal, never a move**
-(Amendment 18(h): a transcript is held by ONE live process). The refusal names
-the pid, where that process is (its window, or `bg`), the profile it is under,
-and the retire act — `lane-end <lane> --retire <pid>` — and nothing is moved and
-nothing is launched.
-
-## A closed or dormant lane leaves the listing (Amendment 19)
-
-**In force — ratified by Brett Heap 2026-09-14T13:46:16Z, verbatim *"ratify
-19"*** (`brettheap/new-workstation#36`, text `#37`). It amends what `lanes`
-lists (11(j), 18(i)), gives Amendment 6(d)'s retire act a **sweep** for rows
-that predate the object log, and uses Amendment 13's `RETIRED` as a row's
-current state.
-
-It exists because of a measurement. On 2026-09-14 `lanes` inside the
-openxFactory checkout listed **nineteen rows for five lanes**: the five live
-under `team-01b`, and **fourteen marked `NO LOG`** — lanes that ran between
-2026-08-27 and 2026-09-02, before Amendment 7 gave every lane a log, and that
-were never ended under any rule that could end them. Their rows carry their own
-last words (`ended`, `dormant`, `CLOSED 2026-09-04`, one `LIVE` that is not, and
-five saying `ENDED WITHOUT PUSHING — loss risk`, `work unpushed` or `owes …`),
-and **no writer today can close them**: `lane-end` wants a live session or a log
-to write into, and they have neither.
-
-### The two states below PARKED
-
-| state | what it is | how it is read |
-|---|---|---|
-| **CLOSED** | the lane's own log has finished | the **last lane-kind line** of `lanes/log/<lane>.md` is `ENDED` or `RETIRED` |
-| **DORMANT** | a row with **no object log** and no live session on this workstation | no lane-kind line anywhere in the logs for that name, and no live session record naming any of the row's transcript ids |
-
-Neither is **bound** (18(b)) and neither is **available to bind** (18(i)): a
-closed lane's name is finished, and a dormant row's is not known to be. Both
-already left the numbered pick; this is what takes them out of the read.
-
-**One row with no log is NOT dormant:** one whose state cell is Amendment
-13(a)'s phrase and whose state word is something other than `ENDED`, `RETIRED`
-or the migration's `MIGRATED`. The row says the lane is somewhere — `PAUSED`,
-`LANDING #<n>`, `HANDED OFF` — and hiding it would hide a lane a person can
-still pick up.
-
-**Its `STATE` is that word with `(row)` after it** — `PAUSED (row)`, `LANDING
-#12 (row)` — and not `NO LOG` (`openRepoTools#89`): the cell is the lane's
-current state, and a listing that printed `NO LOG` over it was not reading the
-one column Amendment 13 made authoritative. The mark keeps it a **read**. A row
-whose log has no lane-kind line records no directory, no profile and no
-binding, so there is nothing to resume: column 10 offers no act, `lane-groups`
-files the row `rowonly`, `lane` never numbers it and refuses it by name, and
-the lane is picked up by hand in its own checkout — `pclaude --lane <lane>
-<profile>` — where `lane-start` records its first lane-kind line. A cell saying
-**`LIVE`** stays `NO LOG`: a cell cannot prove a session is running, only a
-live record can, and the row is flagged for still saying it.
-
-### The listing
-
-```console
-$ lanes                      # CLOSED and DORMANT rows are not here
-$ lanes --closed             # …and now they are, each with a second line
-$ lanes --closed --all       # every repository's
-$ lanes --closed --here      # this workstation's
-```
-
-A CLOSED lane is shown with the closing line's **verb** (the `STATE` column) and
-its **time** (the `AGE` column). A DORMANT row is shown as `NO LOG` with its
-**start date** and its **state cell's head** — the row's own last words, which
-are the only thing it has left to say — and with **FLAGS** where that cell says
-the work was `unpushed`, `lost`, a `loss` or `owed`, or still says `LIVE`.
-
-**An empty listing is not an empty register.** A repository whose every row is
-closed or dormant lists nothing, so `lanes --prefix <repo>` says that in those
-terms — *"no lane of `<repo>` is LISTED — and that is not the same as none being
-recorded"* — points at `--closed`, and offers the position it read from the
-register and the archive rather than assuming 1. And a closed or dormant row
-never reaches the numbered pick even when it is asked for by name: `lane
-<name>`'s read is deliberately unfiltered, so `lane-groups` drops it on its
-CLASS rather than on its state word.
-
-**The next free position is computed over EVERY row** — hidden rows and the
-archive of the next section included — so a retired `<repo>-<n>` is **never
-reissued**. A lane's identity is its name, its log is `lanes/log/<lane>.md` and
-that file is append-only: a second lane at a retired position would write its
-life into the first one's file, and every read of that log would answer for two
-lanes at once. Positions are cheap; identities are not.
-
-### The sweep — one act, on a word
-
-```console
-$ lane-end --retire-dormant openxFactory                      # DRY RUN
-$ LANES_LANE=<your lane> lane-end --retire-dormant openxFactory \
-      --reason "pre-Amendment-7 rows; no log, no session" --yes
-```
-
-Without `--yes` it **writes nothing** and prints every dormant row of that
-repository with its start, its workstation and the head of its state cell,
-flagging the ones above — *so the person sees what the sweep will close before
-it closes it; an agent's stdin is not a terminal, so the word is `--yes` typed
-by a person.*
-
-With `--yes` it is **ONE commit** (`lanes-edit.sh retire-rows`, the lock held
-once). Per dormant row:
-
-* `lanes/log/<lane>.md` is created with a single line —
-  `RETIRED — lane <lane>, session <the sweeping session's uuid>@<ws>, <UTC>,
-  lane:<lane> → retired-dormant by lane <writer>; reason <why>; was: <the state
-  cell's head, verbatim, capped at 240>`. The session field is the **writer's**
-  transcript uuid (7(b)): `$LANES_SESSION`, else the last id of **this
-  checkout's** row for the writer, else the published row's, so a transcript
-  stamped here and not yet pushed is the one written. The row's own last words are carried into the log
-  so that nothing the row said is lost when the row stops saying it;
-* the row's state cell becomes `RETIRED · <UTC> · <why>; was: <head>`. Clause
-  (c) writes that cell as `RETIRED <UTC> · <why> · was: <head>`, which is four
-  parts where 13(a)'s cell has three and whose first word would be a state no
-  reader knows; the phrase above carries the same four facts under the grammar
-  every other writer obeys, and goes through the same `row_state_check` — so the
-  240-character cap, the `|` and the second ` · ` are refused here exactly as
-  they are for `set-row-state`. A `|` a legacy cell carries becomes `/` in the
-  row (it would forge a cell boundary) and stays **verbatim** in the log line,
-  which is not a table.
-
-It **refuses**: a lane a live session holds on this workstation; a row whose log
-already carries a lane-kind line other than `ENDED`/`RETIRED` (**a parked lane
-is not dormant**); and a repository with no dormant row — *nothing to do is
-said, not done* (exit **8**). Any one of them refuses the **whole run**, before
-a byte is written, because it is one commit and therefore one decision. It also
-refuses a session-record read that failed: *"a read that failed is not 'nothing
-is live'"*. So does a listing that **withheld the class** (exit **1**). The
-listing withholds it where it could not list this checkout's log directory, or
-had nowhere to keep its warnings about published logs it could not read, and it
-says so. Counting zero there would be "nothing to do" about rows nobody could
-class.
-
-A log whose **last** lane-kind line is `ENDED` or `RETIRED` is refused too,
-since a `RETIRED` after it would be one more line in an append-only log. The
-refusal says the lane is **already CLOSED** and already hidden (19(b)). For
-`RETIRED` it names `lanes-edit.sh archive-rows <repo>` as the act that takes the
-row out of the register. For `ENDED` it says nothing more is owed: the row stays
-as the record, because `archive-rows` moves only rows whose cell says `RETIRED`.
-A log whose last lane-kind line is `STARTED`, `PAUSED` or `RESUMED` is sent to
-`lane-end <lane>` instead (#120 item 3). The lane is called CLOSED only when
-origin's copy of its log ends on that line. A closing line only this checkout's
-log carries, left by an earlier act that stopped part-way or never pushed, is
-refused as exactly that.
-
-It refuses six more things for the reason every writer here refuses them — a
-half-written act is worse than no act: a checkout **behind** `origin` or dirty
-in anything but the register; a row whose ` | ` count makes **which text is the
-state cell** unknowable; a lane whose object log would need Amendment 15's
-**case-only rename**, which is a write of its own and not one this commit
-smuggles — or whose log `origin` still publishes under another case while this
-checkout already has the row's spelling, **a case-only rename whose commit
-never landed**, which the scan refuses in `ensure_log`'s own words rather than
-leaving it to `ensure_log` half-way through the write (#120 item 2); an object
-log that exists here and is **NOT TRACKED**, which is
-somebody's uncommitted work and would land inside this commit under this act's
-message; a lane **named twice**, whose log would take the same line twice in a
-file nothing can correct; and a `--reason` carrying a `|`, a second ` · ` or a
-newline, which is refused as the **argument** it is (capped at 180 characters,
-because the row's own last words go in beside it).
-
-It also refuses what a write would go **through** (exit **2**): a lane's log
-path that is a symlink, or is there and not a regular file. The append's `>>`
-would follow the link and put the RETIRED line outside the repository while the
-commit records only the link. And it refuses the reads that **failed**
-(exit **1**), because a failed read is not "it has none":
-* a published log that the tree names and git cannot read;
-* a log directory that cannot be listed;
-* a published register that cannot be read (the seam's read, before every row).
-
-It touches **no file outside the register and the logs**. A retired row records
-that a lane is finished; worktrees, branches and handoffs stay exactly where
-they are.
-
-**Nothing is half-PUBLISHED, because the commit is the only thing that
-publishes.** Every refusal above is made in the scan, before a byte is written.
-That includes the commit of a peer's uncommitted register edit, which the act
-makes as its own `LANES(pre-existing@…)` commit: it is made only after the
-scan, so a refusal leaves HEAD where it was. A failure in the writes themselves — a log whose append could not be proved, a
-row whose rewrite touched more than one line or could not be proved (the
-register is put back where the write cut it short, #120 item 1) — leaves this checkout DIRTY and
-the register unpublished: that is what `git status` then shows, `git checkout --
-lanes` undoes it whole, and the next run is REFUSED by the dirty-checkout guard
-rather than made twice. `migrate-state-cells` has the same shape for the same
-reason. Such a refusal says this act has committed nothing (a peer's edit it
-found and captured first is a commit of its own), and lists what the act had
-already written in this checkout. Where the register may be truncated, it also
-names where the exact copy of the register from before the edit is kept: in the
-checkout's own git directory, as `lanes-edit-register-before-edit.<UTC>.<pid>`
-with mode 0600, where a restart that empties the temporary directory leaves it.
-
-### The archive — a second act on a second word
-
-```console
-$ lanes-edit.sh archive-rows openxFactory                     # DRY RUN
-$ lanes-edit.sh archive-rows openxFactory --yes               # ONE commit
-```
-
-It moves every **`RETIRED`** row of that repository out of `lanes/LANES.md` and
-into **`lanes/archive/LANES-retired.md`**, in one commit whose message names
-each lane moved. The archive is written **first** and the rows removed second,
-so a refusal between the two leaves a copy in the archive and the register
-whole, never a row in neither file.
-
-Before anything is written, `--yes` refuses (exit **2**) in two cases:
-* an archive, or archive directory, that is a **symlink**, or an archive path
-  that is there and **not a regular file**. The append would follow the link,
-  and the rows would leave the repository while the commit removed them from
-  the register.
-* a **published archive this checkout does not have**, because it is outside a
-  sparse checkout or marked skip-worktree. A new archive made here would hold
-  only these rows, and its commit would drop every position the published one
-  reserves.
-
-As in the sweep, a peer's register edit is committed only after these checks.
-
-Nothing reads a row differently for having moved: the listing reads the archive
-beside the register (so `lanes --closed` still shows those rows) and so does
-every reader of the next free position — and a published archive that cannot be
-*rendered* is a REFUSAL that says so, never a fallback to this checkout's copy,
-which may lack a retired position the published one holds: read as absent, or
-from that copy, it would put a retired position back on offer. Five more reads
-fail closed rather than answer, and for the same reason. The first three refuse
-(exit **1**); the listing withholds the class for the last two:
-* a local archive path that is there and not a regular file;
-* a register path that renders empty (a zero-byte register, or a broken
-  symlink);
-* a published register whose blob git cannot read. Whether the register or a
-  log is published is the TREE's answer, never `cat-file -e`'s, which fails for
-  an unreadable blob as for an absent path.
-* a published log git cannot read: the listing names it and never classes that
-  lane DORMANT;
-* a log directory it cannot list: the listing classes no row DORMANT at all.
-
-`add-row` refuses a lane name the archive holds, so `lane-start <repo> <n>`
-cannot reissue one by hand either. It also refuses (exit **1**) where the
-published register cannot be read, rather than read that as "no such row":
-otherwise a row this checkout has not pulled would be added a second time.
-And it refuses (exit **1**) an archive that carries a `|` line it cannot take
-apart, naming each such line by its number and the copy it is in, published
-or this checkout's (#122). A line counts only if it is
-the table's header (its first cell is `lane`), its `|---|` rule, or a row whose
-first cell holds its lane in backticks; any other line may be the very lane
-being added. The header is found by that first cell, because a ` | ` count
-cannot tell it from a row (both carry six), and a hand edit can part it from its
-rule. An archive scan that **failed** is a refusal too, never "no match". So is
-an archive with CRLF line endings, or a table written without the spaces around
-its `|`: `archive-rows` writes neither, and nothing in this tool reads CRLF.
-Where add-row has already committed its row when a peer's archive arrives in its
-`pull --rebase`, any of these refusals removes the row again in a compensating
-local commit, as a peer's retirement does, so no later write publishes it. It
-removes only the copy this checkout's register adds over origin's: where a peer
-published the same row first, the rebase drops add-row's commit, and the copy
-left is the peer's, so nothing is taken back. It finds that copy's line in a
-diff it asks for with no context: `GIT_DIFF_OPTS` unset and
-`diff.interHunkContext=0`, either of which would otherwise add context to
-`-U0`. Any context that still arrives is counted where it stands. It reads
-that diff as text (`--text`), so an attribute, a NUL byte or a
-`core.bigFileThreshold` that classes the register as binary cannot hide the
-row, and its proof that one line was removed counts lines whatever
-`core.bigFileThreshold` says. Where the take-back itself cannot remove the row
-— a copy or a write cut short, or a proof that refuses — the refusal says that
-add-row has committed its row, locally and unpushed, and that it must be removed
-before any other write in that checkout publishes it. Where the row is removed
-but the removal cannot be committed, a note says whether the removal is staged,
-that add-row's commit still holds the row, and the command that commits the
-removal.
-
-**One such line refuses every lane, not only its own.** `lanes-edit.sh
-retired-identity <lane>`, the check `lane-start` makes before it launches,
-exits 1 on it as well, so every `lane-start` refuses while the line is there.
-`lane-start` hides the reason: it reads that check with its stderr discarded and
-says only that the archive could not be checked for the lane. Run
-`lanes-edit.sh retired-identity <lane>` to see the line, its number and its
-copy.
-
-**Rule 9 holds either way** — a row is
-one `git show` away — so the archive is for a register a person wants shorter,
-and never a requirement.
-
-## Crash-consistent lane recovery (openRepoTools#91)
-
-**A lane is `RUNNING`, `SWAPPING`, `SWAPPED` or `CLOSED`, and which of those it
-is WITH NO LIVE HOLDER is what says where its session stopped.** A session can
-run out of tokens before the handoff, after the handoff began and before it
-finished, or after it finished — and until this capability all three left the
-same evidence: a last lane-kind line that is a `STARTED`/`RESUMED` (which is
-also what a running lane looks like) or a `PAUSED` (which is also what a clean
-swap looks like). The two crash kinds had no word.
-
-Governed by `openspec/changes/add-crash-consistent-lane-worktree-recovery/` and
-tracked on [opensoft/openRepoTools#91](https://github.com/opensoft/openRepoTools/issues/91).
-It amends no protocol: **it adds no lane-kind verb to the append-only log**.
-Amendment 7's five state verbs, `STARTED`, `PAUSED`, `RESUMED`, `ENDED` and
-`RETIRED`, stand, and every reader of them — `swapped`, `lane-last`,
-`lane-dir`, `who`, `lane-end` — is untouched. (Amendment 18(g) has since added a
-sixth lane-kind verb, `HANDOFF-REQUESTED`, which changes no state; this change
-adds none.) What is new is a SNAPSHOT beside that history.
-
-### The four words, and the two crashes
-
-```text
-RUNNING --/handoff begins--> SWAPPING --record + row + handoff all landed--> SWAPPED
-   ^                                                                          |
-   +---------------- the act that confirms the next binding --------------—---+
-```
-
-| the snapshot says | a live holder? | what it means |
-|---|---|---|
-| `RUNNING` | yes | the lane is running — do not launch a second coordinator or a second writer |
-| `RUNNING` | **no** | **ungraceful stop**: the session died before any handoff began, so nothing was polled, refreshed or recorded |
-| `SWAPPING` | yes | a handoff is in flight — do not compete with it |
-| `SWAPPING` | **no** | **interrupted swap**: the handoff began and did not finish, so the record, the row and the handoff file may each be half done |
-| `SWAPPED` | no | the swap completed; the lane is resumable once its trees are read |
-| `SWAPPED` | yes | inconsistent — a swapped lane has no holder, and neither side is overwritten |
-| `CLOSED` | — | the lane is finished; a dirty or unpushed tree under it is a closure inconsistency and no cleanup is made |
-| any | **unreadable** | `indeterminate`. A holder that could not be established is NOT "no holder" (`R22`, Amendment 7(d)), and no crash is pronounced on a read nobody got. That includes the ids the holder is looked up by: a register row that could not be read — the published one, or this checkout's copy — is never a row naming no session (opensoft/openRepoTools#113). |
-| **unreadable** | — | `indeterminate` again, and for the same rule read one file earlier: a snapshot that IS THERE and cannot be opened is not a lane that has none. `lane-state` exits **10** for it, never the **8** that means *this lane has no snapshot, go on*. |
-| **`MALFORMED`** | — | `indeterminate`: a snapshot of this schema that is not a WHOLE record — cut short, or edited by hand (opensoft/openRepoTools#115). `lane-state` exits **10** for it too, and every writer refuses to replace it. |
-| any | — and a worktree read **failed** | `indeterminate`, whatever the snapshot and the holder say: an inventory directory, the checkout's registrations or a lane root that could not be listed hides trees the report never saw (opensoft/openRepoTools#113). |
-| any | — and the lane is **bound elsewhere** | `indeterminate`. Amendment 18(b): liveness is pronounced only from inside the binding's own host and container, and from anywhere else a binding is UNKNOWN, never dead — and this workstation's snapshot is this workstation's alone. The one exception is clause (b)'s own: a binding whose window is gone from this host's tmux is dead, and the local read decides. |
-| — | — and the lane is **managed-owned** | `managed-owned`, and nothing else is read or pronounced: see *Managed-owned lanes* below. |
-
-### The fence
-
-Every transition carries a monotonic **generation** and a unique **operation
-id**, and `set-lane-state --expect …` is the compare-and-swap:
-
-```sh
-lanes-edit.sh lane-state <lane>                     # state, generation, operation, owner, updated
-lanes-edit.sh set-lane-state <lane> SWAPPING --expect RUNNING
-lanes-edit.sh set-lane-state <lane> SWAPPED  --expect SWAPPING \
-              --expect-generation <n> --expect-operation <id>
-```
-
-A finalizer whose state, generation or operation no longer matches writes
-NOTHING and exits **7** — the number this file already spends on `claim`'s
-CLAIM-LOST, and one meaning on it: *you lost the race*. That is what stops a
-`/handoff` that stalled for an hour from marking a lane `SWAPPED` after somebody
-has recovered and resumed it. A handoff that finds the lane still `SWAPPING`
-**takes it over** with a new generation and names the operation that never
-finished; nothing of that operation is undone.
-
-`SWAPPED` keeps the generation and the operation — it is the same operation
-reaching its commit point — so for an inventory write the pair alone cannot
-tell a poll in flight from one delayed past its own finalizer. A
-`set-lane-tree … --generation/--operation` is therefore also refused with **7**
-where the lane reads `SWAPPED`: the operation it names is finished and its
-inventory is closed (opensoft/openRepoTools#114). Every other transition moves
-the generation, so this is the one state in which a matching pair names a
-finished operation. An observation filed under no transition is a
-`set-lane-tree` with neither flag.
-
-`RUNNING` is written by the act that CONFIRMS the binding and never by the
-SessionStart hook: `session-start` never writes, never touches the network and
-always exits 0 (Amendment 8, `R-A8-1`), and a hook that writes is a hook that
-can break the session it was meant to orient. So the snapshot follows the
-`STARTED`/`RESUMED` line `lane-start` writes, in `lanes-edit.sh`'s own
-`write_event`; `ENDED`/`RETIRED` become `CLOSED` there too.
-
-### Where it lives
-
-A LOCAL control root beside the lane's own checkouts — not the register (every
-write of that is a commit, a pull and a push, and a transition happens three
-times per handoff with no network), and not inside a git worktree (metadata
-there dirties a checkout and disappears with the very directory whose loss it
-explains). Three rungs, and never the caller's current directory:
-
-1. `$LANES_LANE_STATE_ROOT/<lane>` — the explicit override and the suite's seam;
-2. `<parent of the lane's recorded `dir`>/.lane-state/<lane>` — the same parent
-   the lane's own `.lane-worktrees/<lane>` root sits in, and `dir` is Amendment
-   11(c)'s recorded field rather than a guess;
-3. `$PROJECTS_ROOT/.lane-state/<lane>`.
-
-No rung answering is **8**, *this lane has no control root* — the ordinary
-answer for a lane that has not started under Amendment 11(c), and not a failure.
-Nothing is backfilled (Amendment 7(i)).
-
-Because the snapshot is filed under NOTHING — never committed, never leaving the
-machine that wrote it — `R-A11-14` does not reach it: a container with no
-`$LANES_WORKSTATION` still keeps a lifecycle it can recover itself from, while
-the register and object-log writes stop there exactly as they did.
-
-### The worktree inventory
-
-Every handoff polls the lane's writers in the two places a lane keeps them —
-`<checkout>/.claude/worktrees/<name>` and
-`<projects>/.lane-worktrees/<lane>/<name>` — and now records each one MACHINE
-READABLY beside the lane as well as in the handoff's WRITERS section:
-
-```sh
-lanes-edit.sh lane-trees <lane>
-# <id> <path> <branch> <head> <upstream> <dirty> <unpushed> <writer> <observed> <checkout> <generation> <operation> <schema>
-lanes-edit.sh lane-tree-now <worktree path>
-# <branch> <head> <upstream> <dirty> <unpushed>   — what git says about one tree NOW
-```
-
-A `trees` directory that is there and cannot be listed is `lane-trees`' exit
-**10**, never the **8** of a lane that recorded no tree (opensoft/openRepoTools#157
-item 4e). Every lane's records on this workstation, one row per tree, are `lanes
---worktrees`; the derived index keeps them as its `worktrees` table, which no
-act reads (*The derived index*, below).
-
-The full `head` and the `upstream` are why this is not the prose section one
-more time: `%h` is an abbreviation that lengthens as a repository grows, and
-`0 unpushed` cannot be told from *this branch tracks nothing at all* without the
-upstream. Every field is an OBSERVATION and none of them is truth about git.
-
-**`lane-tree-now` is the one implementation of that observation**, and the
-handoff, the sidecar and the reconciliation all go through it, so the WRITERS
-section a person reads and the record a recovery reads can never be two
-different readings. It does not convert a git read that FAILED into a
-clean-looking value: `unknown`/`none`/`0` are answers, and a read that could not
-be made exits **1** and prints nothing (`R22`, Amendment 7(d)). Two states are
-answers rather than failures and are spelled as such — a branch with no commit
-yet has `unborn` for its head, and a branch whose upstream is configured but
-whose remote-tracking ref is not in this checkout (the ordinary state after a
-merged branch is deleted) records that configured upstream with `unknown`
-unpushed, never the `0` that reads as *everything here is published*. Both
-halves of that configuration are reads with a status: a `branch.<b>.merge` or
-`branch.<b>.remote` that git could not read is a **1**, never an empty remote
-spelled as the local upstream `./<merge>` (opensoft/openRepoTools#113).
-
-**A sidecar this helper cannot read is one it will not replace.** A snapshot or
-a tree record carrying a schema this version does not write is reported as
-`UNKNOWN-SCHEMA` by every reader and REFUSED by every writer (exit 1), rather
-than overwritten by a record an older helper can understand — the one act no
-later reader can undo. And `set-lane-tree --generation/--operation` is COMPARED
-with the lane's own snapshot under the mutex before the record is filed, so a
-poll taken under an operation a recovery has since superseded — or one the
-lane has already finalized — is refused with **7** instead of being filed over
-the current inventory.
-
-**And a record of THIS schema is read only when it is whole**
-(opensoft/openRepoTools#115). The `schema:` line alone used to pass, so a file
-cut short after it was read as empty fields and replaced by every writer. Now
-every key its writer writes must be there and not empty — `lane`, `state`,
-`generation`, `operation`, `owner`, `agent`, `profile`, `workstation`, `kind`
-and `updated` for a snapshot; `lane`, `tree`, `path`, `checkout`, `branch`,
-`head`, `upstream`, `dirty`, `unpushed`, `writer`, `generation`, `operation` and
-`observed` for a tree — with a snapshot's `state` one of the four words, every
-`generation` a number, a tree's `dirty` a number and its `unpushed` a number or
-`unknown`, its `path` absolute, and its `tree` the id its file is named for.
-Both writers have written exactly these keys since #97 landed. A record that
-fails is taken the way an unknown schema is: every writer refuses it (exit
-**1**, nothing written), `lane-state` answers **10** and `lane-reconcile` reads
-the snapshot as `MALFORMED`, and `lane-trees` carries a tree record as a row of
-its own named by its file under the schema `<malformed>`, keeping the path the
-record names — so the tree is still named once, though that path is the record's
-own word and may be relative — and every other field empty.
-The writers ask the same question of their own temporary file before the
-rename, so a record cut short as it was written is removed rather than renamed
-over a whole one.
-
-**One path, one record.** A tree's record is named from its path and from
-nothing else: `c<cksum>-<folded path>`, a `cksum` of the WHOLE absolute path
-and then the path with every character outside the file-name alphabet folded to
-`-`. The fold is for a person reading the directory; the checksum is what keeps
-`…/a+b` and `…/a-b`, which fold alike, two records rather than one replacing the
-other. And `set-lane-tree` takes a caller's observation **whole** — `--branch`,
-`--head`, `--upstream`, `--dirty` and `--unpushed` together — or reads the tree
-itself; a partial one is refused with **64** and nothing is written, because the
-fields it lacks would be filed as a `dirty 0, unpushed 0` nobody observed. So is
-a `--dirty` that is not a count, an `--unpushed` that is neither a count nor
-`unknown`, or a `--branch`, `--head`, `--upstream`, `--checkout` or `--writer`
-that is only blanks (a reader trims a value, so that field would be empty): a
-record carrying one could be neither read nor replaced.
-
-### The reconciliation, which resets nothing
-
-```sh
-lanes-edit.sh lane-reconcile <lane>
-```
-
-It recomputes branch, HEAD, upstream, dirty and unpushed for every inventoried
-tree, reads `git worktree list --porcelain` in the lane's checkout and the
-directories under both lane roots, and prints one `TREE` line per tree with a
-classification: `ok`, `dirty`, `unpushed`, `unpushed-unknown`,
-`dirty+unpushed`, `dirty+unpushed-unknown`, `missing`, `possible-loss`,
-`not-a-checkout`, `unreadable`, `unreadable-sidecar`, `malformed-sidecar`,
-`unknown-schema`, `unmanaged`, `stale-registration`. Every one of those reads has
-a status, and a read that FAILED is never an empty answer (opensoft/openRepoTools
-#113): an inventory directory that cannot be listed (`lane-trees`' **10**), a
-`git worktree list --porcelain` that fails in a checkout with a `.git` of its
-own, and a lane root that cannot be listed or searched each make the verdict
-`indeterminate` and are named in it — a recorded directory that is no
-repository at all registers nothing, and that alone is an absence, as
-`lane-worktrees` reads it. A `BINDING` line says where the lane is bound — `here`,
-`free`, `gone` (bound on this host's tmux and its window is gone), `elsewhere`
-(and where), or `unknown` (its log could not be read) — and `elsewhere` or
-`unknown` turns every verdict into `indeterminate` (Amendment 18(b)). The last
-line is the `VERDICT`. `lane-start` prints the report before it writes
-anything, for any verdict that is not `running` or `closed` — and for
-`resumable` as well whenever its `TREES` line counts a tree that is dirty or
-unpushed, requires recovery, or is unmanaged or stale: `resumable` says the swap
-completed, not that every tree it left is clean, published and where it was.
-
-A **renamed** lane keeps its snapshot and inventory: `rename-lane` moves its
-control root to the new name once the rename's commit has landed, and never
-over something already there (Amendment 16). Its `.lane-worktrees/<old>` root
-holds real git worktrees and is not moved — that is a `git worktree move`, and a
-person's. A lane retired by Amendment 19's sweep is taken to `CLOSED` exactly as
-a lane that ended itself is.
-
-**It reads the published register first**, as every read in `lanes-edit.sh`
-does: the lane's name resolves through the register and Amendment 16's alias
-table, and its binding and any managed-owner marker are read from them, so a
-stale ref would pronounce from a binding that has since moved. The fetch goes
-into the register checkout and touches no lane tree; it is bounded by
-`LANES_GIT_TIMEOUT` and, when it fails, the ref is read as it stands.
-`LANES_NO_FETCH=1` skips it — which is how `lane-start` calls it, having fetched
-in its step 3 — at the cost of reading what was last fetched. Whether a recovery
-read should be local by default is opensoft/openRepoTools#157.
-
-**It reports and it resets nothing.** `park` CREATES NOTHING and `resume` RESETS
-NOTHING (`AGENTS.md` rule 1), so this read runs `git status`, `git log @{u}..`,
-`git rev-parse` and `git worktree list --porcelain` and nothing else:
-
-* a **missing** tree that was clean and published names the estate's own
-  `resume <Name>` as the only rebuild — and NAMES it rather than running it,
-  because that verb runs `make resume` across a whole estate and a report may
-  not do that as a side effect;
-* a missing tree whose last observation held dirty or unpushed work is
-  **possible-loss** and is never claimed to be reconstructable — no metadata
-  reconstructs a file's contents;
-* an **unmanaged** tree — one git registers, or one sitting under a lane root,
-  that no sidecar names — is reported and never deleted, adopted or overwritten:
-  which lane a tree belongs to is a person's to say. One tree is named ONCE
-  however many spellings of its path reach the report: a sidecar holds the path
-  its poll was given, `git worktree list --porcelain` answers with the physical
-  path, and the on-disk sweep walks the recorded `dir`, so every comparison
-  resolves both sides — without which every tree of an estate that reaches its
-  checkouts through a `projects` symlink is reported twice, the second time as a
-  tree nobody manages;
-* a **stale-registration** names the `git worktree prune` that clears it, and
-  prunes nothing itself;
-* an **unreadable** tree is one git answers in and cannot be read through —
-  nothing is assumed about it, in either direction, and the line names the
-  `git -C <path> status` a person runs;
-* an **unreadable-sidecar** is a tree record that IS there and could not be
-  read — a permission, an I/O error, a dangling link. The tree it recorded is
-  NOT known, in any field; it counts toward recovery, the line names the file a
-  person reads by hand, and it is never skipped as though the lane owned one
-  tree fewer (`lane-trees` carries it as a row of its own whose schema is
-  `<unreadable>`);
-* a **malformed-sidecar** is a tree record of this schema that is not whole —
-  cut short, a key missing or out of shape, or an id that is not its file's
-  (opensoft/openRepoTools#115). It is reported as the unreadable one is: no
-  field of it is read, it counts toward recovery, the line says what is wrong
-  with it and names the file, and no writer replaces it. Before this, a record
-  cut after its `path:` came out with an empty dirty and unpushed, and a vanished
-  tree that held work read `missing`, clean and published;
-* an **unknown-schema** tree is a sidecar written by a newer tooling: it is
-  named, and not one field of it is read, because a value taken out of a record
-  whose shape this reader is guessing at is worse than no value.
-
-### What a resumed session does with it
-
-Read the verdict first, then the trees, then `ListAgents` — the count is still
-what decides whether a writer is live (Amendment 17 Addendum 1 (i), and (k):
-one worktree, one writer). `ungraceful-stop` and `interrupted-swap` both mean
-**inspect every tree before relaunching anything**; the difference is that under
-`interrupted-swap` the record, the row and the handoff file may each be half
-written, so check all three rather than trusting the handoff's top block.
-
-## Managed-owned lanes
-
-**Brett Heap's ruling of 2026-10-04, verbatim: *"managed ledger owns enrolled lanes; #97 owns legacy — rework both"*.**
-A lane the managed ledger has enrolled carries a **managed-owner marker** in its
-register row's state cell, written by that ledger's own writer:
-
-```text
-LIVE · <UTC> · managed-owner mode=managed daemon=<id> generation=<n> bound-lane=<lane>
-MANAGED OWNER · <token>        (the historical shorthand)
-```
-
-Every lane without one is a **legacy** lane — every lane in the register today —
-and the lane tooling here answers for legacy lanes only. The marker is read by
-one reader, ported byte for byte from branch `001-separate-swap-ctx-handoff`
-(`3c26041:lanes-edit.sh:776-898`), and asked through one read:
-
-```sh
-lanes-edit.sh managed-projection <lane>
-```
-
-| exit | meaning | what every legacy act does |
-|---|---|---|
-| 0 | a valid marker; the owner is printed | **refuses with 2**, names the owner, writes nothing |
-| 8 | no marker and no managed-owner vocabulary, in the published row or this checkout's — whatever the row's shape: a row with none cannot be a marker, and a writer refuses a row it cannot split on its own (2) | runs exactly as it always has |
-| 1 | managed-owner vocabulary that does not parse (a `generation=0`, an empty daemon, a `bound-lane` that is not this lane, an empty shorthand token, a `managed:` anywhere in the row), a row carrying the vocabulary that is not seven columns, vocabulary that only this checkout's register file carries, whether it is ahead of origin (a change committed here and not pushed, or not committed) or behind it (origin dropped the vocabulary after this checkout last moved; the remedy is a fast-forward), or a register that could not be read. The refusal names the file it read, which under a runtime-clone `LANES_REPO` is workspace.yaml's tree, not the clone | **refuses with 1**: ownership is UNKNOWN, and an ownership nobody could establish is never read as legacy (Amendment 7(d)) |
-| 64 | usage | — |
-
-The acts that ask, each before its first write: `lane-start` (at the head of its
-section 3, before Amendment 18's binding gate and `--request-handoff`),
-`lane-handoff` (before the window is renamed — so `--late`, `--restart` and
-`--exit` never reach `SWAPPING` or `SWAPPED`), `lane-end` (the ending,
-`--retire` and `--retire <pid>`), the object log's `STARTED`, `RESUMED`, `ENDED`
-and `RETIRED`, a swap's `PAUSED`, `request-handoff` (its `--dry-run` too),
-`set-lane-state`, `set-lane-tree`, `retire-rows` (one managed or unknown lane
-refuses the whole sweep), `migrate-state-cells` (one managed or unknown row it
-would rewrite refuses the whole migration), `archive-rows` (one such RETIRED
-row refuses the whole move), `append-session-id`, `add-row` for a lane that
-already has a row, `set-row-state`, `replace-in-row` and `rename-lane`. Each
-reads this checkout's row as well as the published one, because this
-checkout's row is the one a legacy writer rewrites: vocabulary in one copy and
-not the other is UNKNOWN (1). `managed-projection` reads both copies the same
-way (opensoft/openRepoTools#157 item 4a), so the gates of `lane-start`,
-`lane-handoff` and `lane-end`, which ask it, refuse what the writers refuse —
-before a launch moves a transcript rather than after. A claim or a release is
-about the object, not the lane, and is not refused. `lane-reconcile` reads nothing of a managed lane and prints
-`VERDICT managed-owned` (and `indeterminate` where ownership is unknown). And no
-legacy writer — `set-row-state`, `add-row`, `replace-in-row`, `append-line`,
-`append-session-id`, `rename-lane`'s new name, the sweep — may write the
-marker's vocabulary into the register at all, so a marker is never forged.
-
-What the managed ledger itself does with an enrolled lane is not this manual's:
-branch `001-separate-swap-ctx-handoff`'s governance review is **PROPOSED — NOT
-APPROVED**, and nothing here asserts that it supersedes Amendment 17.
-
-## The derived index (Amendment 14)
-
-**In force — ratified by Brett Heap 2026-10-05, verbatim *"ratify 48"***
-(brettheap/new-workstation#48; the tooling is opensoft/openRepoTools#160).
-**The register's truth stays where it is.** `lanes/LANES.md`, `lanes/log/`,
-`lanes/aliases.tsv` and `lanes/archive/` are the record, written only by
-`lanes-edit.sh`. `lanes-index` keeps a **derived index** of them — SQLite on
-local disk, or QA Postgres where this workstation is configured for it —
-written behind the sources, read only by tooling that decides nothing, and
-never a gate. Where the index and the source disagree, the source is right and
-the index is behind.
-
-### What it is for, and what it never does
-
-It is for the questions no act asks: every repository's rows at once, every
-lane's history on one timeline, a dashboard, Eagle and Raven asking one store.
-It is **never read by an act**: no `claim`, `release`, `log` verb or LANES
-line; not the name guard or the `SessionStart` block; not `lane`, `lane-start`,
-`lane-end`, `lane-handoff`, `lane-rename`, `/restart`, `/handoff`, `/ctx`; no
-row writer, sweep, archive or migration; and none of the reads an act makes for
-itself (`who`, `binding`, `live-holder`, `next-free`, `managed-projection`,
-`lane-reconcile`). An index that is missing, stale, unreachable, wiped or wrong
-changes no exit code and no output of any of them. It never writes back:
-nothing in any source is ever written from it.
-
-### The three words, and the one step `lanes-edit.sh` gained
-
-```sh
-lanes-index sync      [--source <s>]              # write behind what LANDED
-lanes-index reconcile [--source <s>] [--dry-run]  # read the source whole; put the index right
-lanes-index status                                 # per source: store, provenance, lag, last error
-```
-
-- **`sync`** reads the register as `origin/<branch>` of the workspace checkout
-  stands — what the push left, never the working tree — and upserts every
-  record whose content differs, keyed by **(source, record id)** and versioned
-  by a **digest of its content**: an upsert bearing the stored digest changes
-  nothing, so a replay or a crash is harmless. The source's indexed commit is
-  compared and swapped **in the same transaction** as the rows it covers, and
-  a sync from a commit that does not descend from it **writes nothing** — so
-  two workstations syncing into one Postgres, even at once, cannot roll it
-  back. A record its source no longer holds leaves in the same sync. One sync
-  at a time per workstation: a second finds the lock held, leaves the holder a
-  mark to sync again, and returns at once.
-- **`reconcile`** reads the source whole, compares every stored row by what it
-  **says** (not by the digest it carries, so a row changed by hand is found),
-  upserts what differs and removes what is gone: on a wiped index, the
-  rebuild. `--dry-run` prints the counts and writes nothing.
-- **`status`** prints the store, each source's provenance against its tip, the
-  lag in commits, and this workstation's last sync and last error.
-
-**The nudge.** After every write whose push **landed**, and after its mutex is
-released, `lanes-edit.sh` starts **one detached `lanes-index sync`**: stdin
-closed, stdout and stderr on `/dev/null`, never waited, its status never read.
-It carries no data. It is skipped where `lanes-index` is not on `PATH` (one
-`command -v`, nothing printed) and wherever `LANES_INDEX=off`. A slow, failing
-or absent indexer delays and fails no commit, push or swap.
-
-### Reading it — `--index`, only when typed
-
-```sh
-lanes --index                       # any listing, out of the index
-lanes-edit.sh history <lane> --index
-lanes-edit.sh history --all  [--since <UTC>] [--index]      # every lane, one timeline
-lanes-edit.sh history --repo <owner/repo> [--index]         # the lanes whose HOME it is
-```
-
-The flag is typed per invocation — **never** taken from the environment or a
-configuration. It replaces the **published** reads (the register, the archive,
-the alias table, the logs) and nothing else, so the live session records, tmux
-and this checkout's own files are read as they are without it. Where the index
-is current the answer is **byte for byte the source read's**, on stderr as on
-stdout — the warnings for a log's unreadable lines and the count that closes
-them included (opensoft/openRepoTools#166) — the clock's columns aside (the
-listing's AGE and its "last heard from origin" age, computed the same way at
-the moment of the read). Stderr carries the flag's OWN lines besides: the
-`read:` line below, and for `history` the `LANES_NO_FETCH=1 — not fetching …`
-note, because where the index answers that arm fetches nothing in front of it.
-And it is **one commit's image**: `lanes-index export` reads the provenance and
-every table in ONE read snapshot — a SQLite read transaction, a Postgres
-`REPEATABLE READ READ ONLY` one — so a sync landing mid-read is in the answer
-whole or not at all (#166). One line on stderr says which was read:
-
-```text
-read: index (sqlite) at register@1a2b3c4d5e6f; 0 commits behind
-read: sources (index unreachable: psql: error: connection to server … failed)
-```
-
-Lag is said, never refused. Where the index cannot answer — `lanes-index` not
-installed, the store `missing`, `unreachable`, `wiped` (no provenance for this
-register), of an `unknown-schema`, a configuration it `refused`, or
-`LANES_INDEX=off` — the line says so and the **sources** answer, with the
-source read's own exit. `history --all` and `--repo` read the sources without
-the flag; `history` over two lanes used to be refused.
-
-### The store and its configuration
-
-`${XDG_CONFIG_HOME:-~/.config}/openRepoTools/lanes-index.conf`, or the file
-`$LANES_INDEX_CONFIG` names — per workstation, **never committed**, never under
-`~/.agents/` (which on a workstation built from the workspace repository *is*
-that repository):
-
-```text
-store=sqlite|postgres     default: postgres where url= is set, else sqlite
-sqlite=<path>             default ${XDG_STATE_HOME:-~/.local/state}/openRepoTools/lanes-index.sqlite
-url=<libpq URL>           the WRITER role — sync and reconcile
-passfile=<path>           the 0600 libpq password file for it
-reader_url=<libpq URL>    the SELECT-only READER role — status and the --index reads;
-                          REQUIRED beside url=, or those reads are refused
-reader_passfile=<path>    its password file, where it is not the same one
-schema=<name>             the Postgres schema (default lanes_index)
-```
-
-Refused (exit 2, nothing read or written): a configuration that is group- or
-world-readable, inside a git work tree or under `~/.agents/`; a URL that
-carries a password in any spelling; a password file that is not 0600; a SQLite
-path inside a git work tree. A Postgres configuration with no `reader_url=` is
-refused for `status` and the read flags (`read: sources (index refused …)`):
-**a read never connects with the writer's credential**, and there is no
-fallback to it. Postgres is reached through `psql` and only where
-`url=` is set — nothing imports a driver — with `PGPASSFILE` naming the
-password file and an inherited `PGPASSWORD` or `PGPASSFILE` removed; with
-no `passfile=` (a passwordless role), `PGPASSFILE` names an empty 0600 file of
-the indexer's own, so libpq never falls back to `~/.pgpass`. No configuration at all
-is SQLite at its default path, created 0600.
-
-**The two roles are Postgres's to hold** (act 3, Brett Heap's on Eagle and
-Raven — or nothing, and SQLite):
-
-```sql
-CREATE ROLE lanes_index_writer LOGIN;   -- the password lives in the 0600 passfile only
-CREATE ROLE lanes_index_reader LOGIN;
-CREATE SCHEMA lanes_index AUTHORIZATION lanes_index_writer;
-GRANT USAGE ON SCHEMA lanes_index TO lanes_index_reader;
-ALTER DEFAULT PRIVILEGES FOR ROLE lanes_index_writer IN SCHEMA lanes_index
-  GRANT SELECT ON TABLES TO lanes_index_reader;
-```
-
-The writer is confined to the index's schema and held by the indexer alone —
-by no session, supervisor, launcher or ledger authority; a leaked writer can
-damage only what a `reconcile` rebuilds. The reader may only `SELECT`.
-
-### What is indexed (schema 1)
-
-One versioned schema (`schema_version`); every row carries its `provenance`
-(the register commit it was last written at), `indexed_utc` and
-`schema_version`, and its `digest`.
-
-| table | one row per | what it holds |
-|---|---|---|
-| `lanes` | lane | canonical name, `aliases` (Amendment 16(e)), `home`, the `workstation / env / user` cell, `started_utc`, `handoff_path` (a pointer), `state_phrase`, `objects_cell`, `session_ids` in order, `last_session` (the resume target), `archived`, the row's own text — and **`owner`**: `legacy`, `managed <owner>` or `unknown`, from `lanes-edit.sh managed-projection` (0, 8, 1) and never from a parser of the indexer's, so a malformed marker is never downgraded to `legacy` |
-| `log_lines` | log line, by lane and file ordinal | verb, session, workstation, UTC as written, object, payload, its sub-fields as JSON, free text; a line the grammar cannot read is kept as `unreadable` with its file, line and reason, never dropped |
-| `register_lines` | register line, by ordinal | Rule 6's `LANDING`/`LANDED` and Amendment 10's `HOLD`/`HOLD RELEASED`: lane, repository, PR, tip, UTC, the line itself |
-| `lane_aliases` | alias-table line | `old_name`, `new_name`, UTC |
-| `transcript_pointers` | pointer | a row's session-cell ids and each `transcript` a `PAUSED` names, with its `agent` — pointers only |
-| `source_files` | file of the source | kind, blob, line counts — what the read flags need to answer as `origin` would |
-| `holds` (a VIEW) | open hold | `holders_of`'s answer, which is `who`'s: per lane (case-insensitively), its last line on each object **in file order**, never by UTC, where its verb is open — and not while another lane's own last line there is a `TAKEOVER`. **Not yet where one `TAKEOVER` displaced another**: `holders_of` displaces a `TAKEOVER` only by one that names its lane (`← lane:<x>`, opensoft/openRepoTools#74), and this view still reads any other lane's `TAKEOVER` as displacing it, so for a chain of takeovers it holds no row where `who` names the last link, and for two takers neither naming the other no row where `who` names both. The object is keyed AS WRITTEN: a line naming a repository by a spelling `lanes/repos.tsv` has since renamed (R20) is its own key here, where `who` folds its argument into the canonical one. Computed, never stored |
-| `provenance` | source | the indexed commit (or generation), UTC, schema version |
-
-**Created empty and written by nothing here**: `swap_states` and
-`job_summaries` — the managed ledger's half, `ledger:<Workstation>`, which the
-001 feature's T058 writes (act 4). `worktrees` is the inventory's, below — the
-same schema 1, whose table was created with #161's columns before a row was
-written into it. Not indexed at all: transcript and handoff bodies,
-credentials, the ledger's claims, fences, releases and exit witnesses.
-
-### The `worktrees` table — every lane's #97 inventory (opensoft/openRepoTools#161)
-
-**What it is for: the next account's first query.** A session that resumes a
-lane — or that sits down at Raven after a day on Eagle — wants every open
-worktree before it decides anything: whose it is, which branch, whether the
-lane stopped `RUNNING` or `SWAPPED`, what was dirty or unpushed, when it was
-last seen and whether a writer is still live. Each lane's handoff already
-records that beside the lane (*The worktree inventory*, above); this table is
-the same records in one place, under the source `inventory:<Workstation>` — one
-per workstation, because the sidecars live on that workstation's disk and
-nowhere else — so a store two workstations sync into answers for both.
-
-```sh
-lanes --worktrees [<lane> | --all]            # this workstation's sidecars
-lanes --index --worktrees [<lane> | --all]    # the table: every workstation it holds
-lanes-index sync      --source inventory      # what every inventory write nudges
-lanes-index reconcile --source inventory [--dry-run]
-```
-
-| column | from |
-|---|---|
-| `workstation`, `lane` | the workstation's name (`lanes-edit.sh workstation`) and the lane's canonical one |
-| `owner` | `legacy`, `managed <owner>` or `unknown` — the read `managed-projection` makes, never a parser of the indexer's |
-| `path`, `branch`, `dirty_count`, `unpushed_count`, `last_seen_utc` | the tree's sidecar: the last observation, `detached <sha>` for a detached head, an `unknown` count as NULL. A sidecar that could not be read is `unreadable sidecar`, one of another schema `unknown schema <n>`, each with the record's id where its path would be |
-| `base`, `last_commit` | two git reads of the RECORDED head, in the tree or, once it is gone, its recorded checkout: its merge-base with `origin/main` (else `main`, else `origin/HEAD`), and `<sha> <subject>` |
-| `lifecycle`, `generation`, `operation` | the lane's snapshot (`lane-state`): `RUNNING`, `SWAPPING`, `SWAPPED` or `CLOSED` for a **legacy** lane; `INDETERMINATE` for a managed or unknown one, whose lifecycle this tooling does not pronounce on, and for a snapshot that is missing, unreadable or of another schema |
-| `writer_live` | the listing's own LIVE — a session record on this workstation naming one of the row's ids — and NULL where those records could not be read or the lane is bound on another host, from where liveness is unknown and never dead (Amendment 18(b)) |
-| `pr_number`, `pr_state` | `gh` at sync, best effort, the newest pull request whose head is the branch; NULL wherever it was not asked (`LANES_NO_GITHUB=1`) or did not answer. A MERGED or CLOSED answer is not asked again while the branch and its last commit stand |
-| `provenance`, `indexed_utc` | the generation the TREE'S OWN record was filed under — behind `generation` exactly when the observation predates the lane's current transition — and the sync |
-
-**Read through the helper, never around it.** The indexer reads `lanes-edit.sh
-worktrees --all`, which lists each lane's sidecars through `lane-trees`' own
-reader, its snapshot through `lane-state`'s and its owner through
-`managed-projection`'s, and walks no directory for a tree no sidecar names —
-that is `lane-reconcile`'s act. Nothing is recomputed: `dirty` and `unpushed`
-are what the handoff saw, and `LAST SEEN` says when.
-
-**Rows follow the inventory.** Keyed by (source, `<lane>:<path>`) — a second
-tree of one lane with the same path (two with no `path:`, say) as
-`<lane>:<path><US><n>`, numbered from 2 in the read's sorted order, and a lane's
-unread marker as `<lane>:<US>unread` — and versioned by a digest of the row and
-its provenance, so a replay writes nothing (a change that reorders two trees of
-one path moves both keys, and that sync upserts both); a tree
-the inventory no longer names — removed at landing, or by a sweep's disposition
-— leaves in the same sync. The provenance moves only forward **per lane**: a
-`sync` that reads a lane's lifecycle generation below the one its rows were
-written at (a snapshot moved aside and begun again) writes nothing for that lane
-and says so, and `reconcile --source inventory` is the act that takes the lane
-as it now stands. A lane whose `trees` directory is there and cannot be listed
-keeps its rows — it is not a lane with no worktrees — and gets ONE MARKER ROW,
-keyed `<lane>:<US>unread`, with no `path` and the `branch` `unreadable inventory
-(<why>)` — the key is what makes it one, because a tree's path can be empty (a
-sidecar with no `path:`) and a hand-made sidecar's branch can read the same —
-which the `--index` read prints as the same `inventory NOT READ` line the sidecars
-give (opensoft/openRepoTools#173): a FIRST sync that cannot read a lane has no
-rows to keep and is still not an empty answer, and rows held over from an
-earlier sync are said to be, on that line. The marker leaves with the first
-sync that reads the lane, and `lanes-index status` counts it apart from the
-worktrees. The schema stays 1, so an indexer from before #173 sharing a
-Postgres store reads a marker as a tree: its `export --worktrees` prints it as
-a `TREE` line with an empty path and that branch, and its `status` counts it as
-a worktree. An older and a newer indexer syncing ONE store each converge to their
-own view of the same inventory — no duplicate rows and no growth — and they
-rewrite it on every sync only where a lane has two trees with the same path,
-which the older one keys as one; with none, an unreadable lane included, a sync
-after the first writes nothing. A store written by #219's unlanded heads
-(`f00ee58`, `ab853b1`) keeps their marker, keyed `<lane>:`, as a kept row while
-that lane stays unreadable, and it clears at the first sync that reads the lane.
-The source's own row carries a fingerprint of the
-whole table as its compare-and-swap token and a sync count that only goes up. A
-container with no `LANES_WORKSTATION` syncs nothing (exit 2): a source named for
-a container's own id is one no restart finds again.
-
-**A lane listing that is not whole writes nothing** (opensoft/openRepoTools#173
-item c1). The inventory is read through the lane listing, whose lanes are the
-names three reads give — the register's rows, the archive's and the object
-logs' — and each lane's trees are under the control root its log's `dir`
-places. Where the register, the archive, the list of the logs or any one
-published log could not be read — or whether one could not is NOT KNOWN,
-because no temporary file could keep the warnings of their read —
-`lanes-edit.sh worktrees --all` prints the rows it did reach and one line more,
-`PARTIAL <workstation> <why>`; over a listing those reads left empty it is that
-line alone, never the **8** of "none". A lane such a read could not name is not
-a lane with no worktrees, and which lanes those are is exactly what it does not
-know, so `sync` and `reconcile --source inventory` write NOTHING over it — not
-the lanes it did list either — and exit **1**, `unread: the lane listing …
-was not whole - <why> - …`, which `status` shows as the last error and the
-`--index` read beside the source's `synced <UTC>` (below). The table
-stays the last whole read, dated by its `synced <UTC>`, and the first sync over
-a whole listing writes what moved meanwhile. Holding only the lanes the read
-could not name would have needed a marker for each of them, one for the listing
-itself — a first sync has no rows to hold — and a one-lane `--index` read that
-knew of it. An indexer from before #173's item c1 refuses the line too, as one
-it does not read. A read of one NAMED lane goes by that name, which no listing
-gives, and never prints `PARTIAL`.
-
-Where those reads succeed, the listing makes each of them once, except the list
-of the logs, which it makes twice (the review of #289). The register, the
-archive and the list of the logs are asked before the listing is made, and
-where one succeeds the listing reads that very text — the register out of its
-cache, the other two pinned for that listing alone — so a read of them that
-fails after the check cannot thin a listing taken as whole; where one fails,
-the read is `PARTIAL` whatever the listing's own reads of it then give. The
-second list of the logs is the events', which read every log once per process,
-and where it could not be made the events say so: that is `PARTIAL` too,
-because every lane's `dir` comes out of their read. A lane's `dir` is not read
-again: its control root, the list of its trees and its lifecycle snapshot all
-take the listing's own. A second read of the lane's log that failed used to
-send the root to `$PROJECTS_ROOT/.lane-state`, and a lane with trees read as
-one with none (review r2 of #289). What is still read twice, besides the list
-of the logs: with no `origin` (`LANES_NO_GIT=1`, or a checkout with no
-`origin/<branch>`), the log directory is asked — there and not a directory this
-account can list and search is `PARTIAL` — and is then listed again for the
-names and again for the events, and a log file in it that will not open leaves
-no warning naming it; and the events ask for themselves whether
-`origin/<branch>` is there, so a `rev-parse` that failed in that one read alone
-reads this checkout's logs in place of origin's.
-
-**The nudge.** Every inventory write — `set-lane-state`, `set-lane-tree`, the
-lifecycle follow after a `STARTED`, `RESUMED`, `ENDED` or `RETIRED`, and a
-rename's move of the control root — starts the same detached `lanes-index sync`
-a landed push does, as `sync --source inventory`, skipped where `lanes-index` is
-not on `PATH` or `LANES_INDEX=off`. One sync at a time per workstation: a nudge
-that finds the lock held leaves a mark NAMING ITS SOURCE, and the holder syncs
-every source a mark names before it lets go.
-
-**The read.** `lanes --worktrees` reads this workstation's sidecars; with
-`--index` it reads the table — every `inventory:*` source the store holds, so
-Raven sees Eagle's leftovers — and stderr says `read: index (<store>) at
-inventory:<ws> synced <UTC>`, or `read: sources (index <why>)` and the sidecars
-answer. Where this workstation recorded an error for a source — a `sync` or a
-`reconcile` of it that refused or failed, a `--dry-run` included: a lane listing
-that was not whole, a store it could not reach — that source's `synced <UTC>` is
-followed by `(last error: <UTC> <why>)`, the last error `status` shows, until a
-`sync` or a `reconcile` that is not a dry run succeeds; another workstation's is
-in its own record, not this one's.
-Where the table is current, this workstation's rows are the same bytes
-either way — and a store only this workstation syncs into (SQLite, or a
-Postgres nobody else writes) prints exactly the source read, while a shared one
-adds the other workstations' rows among them. Every row is a last observation: the current truth of a lane is `lanes-edit.sh lane-reconcile
-<lane>`, which reads the disk — and the sidecars — of the workstation it runs
-on and of no other, so the footer says to run it ON THE WORKSTATION the lane's
-rows name (#173): Raven's listing of Eagle's rows is answered on Eagle. A
-`PARTIAL` line prints as `(every lane)` and `lane listing NOT WHOLE: <why>`,
-and the footer says that a lane missing from such a listing is NOT a lane with
-no worktrees — the listing's own form of an `UNREAD` lane's `inventory NOT
-READ` line.
-
-**What never reads it.** No act: not `lane-reconcile` — there is no
-`lane-reconcile --index`, by Amendment 14(b) — not `lane-start`, `lane-end`,
-`lane-handoff` or the worktree sweep (opensoft/openRepoTools#162). Each of them
-reads the sidecars and the disk, exactly as before this table existed; an
-inventory index that is missing, stale, unreachable, wiped or wrong changes no
-answer of theirs.
-
-### The tests' promise
-
-`tests/test_lanes_index.py`, and a section of `tests/test_lane_helpers.sh` for
-the acts only that suite drives, hold the index — the inventory's table
-included, whose writers and `lane-reconcile` are among the acts — to Amendment
-14's eight:
-**offline no-read** (every act byte-identical against an unreachable store),
-**poisoned index** (wrong rows change no act's answer), **wiped-index
-reconcile** (the rebuild equals a synced index row for row), **replay**,
-**monotonic provenance**, **a hung indexer** delaying no writer beyond the fork,
-**the managed seam** (valid, malformed and plain rows as `managed`, `unknown`,
-`legacy`, all through `managed-projection`), and **fallback** (each failure
-says `read: sources` and gives the source read's answer). The parser is held
-to `LOG_AWK`'s output line for line. No test creates a real database.
-
-## Retiring a lane's worktrees — `lane-worktrees sweep` (#162)
-
-**On Brett Heap's word of 2026-10-05 ("build 162")**, tracked on
-[opensoft/openRepoTools#162](https://github.com/opensoft/openRepoTools/issues/162).
-A swap that does not finish gracefully — a usage limit, a killed pane, a crashed
-harness — leaves its writers' trees where they stood, and the protocol's
-worktree-safety rule (a swap never commits, pushes, stashes, resets or cleans)
-is right to leave them. This is the act that retires them afterwards, in one
-place, under one rule: **nothing is deleted that is not first on origin or in a
-bundle under the sweeps directory, and a tree a live writer owns is never
-touched.**
-
-```sh
-lane-worktrees sweep <lane>                     # the DRY RUN: the table, nothing changed
-lane-worktrees sweep <lane> --yes [--live <path>|--live none]
-lane-worktrees sweep <lane> --dry-run --porcelain   # lane-end's gate (#163): 0 / 3 / 2
-lane-worktrees add <lane> <slice> [--branch <b>] [--from <ref>]   # make a tree AND record it (#163)
-lane-worktrees sweep --expire [--yes]           # archives past retention
-```
-
-**Which trees are the lane's** is #97's inventory (`lanes-edit.sh lane-trees`)
-and the disk — **never the derived index** (Amendment 14 clause (b)). The sweep
-also reads every registration of the lane's checkout and every checkout under
-its two roots (`<checkout>/.claude/worktrees/*`, `.lane-worktrees/<lane>/*`).
-A tree the inventory does not name is still **the lane's** when it stands under
-the lane's own root, `.lane-worktrees/<lane>/` (only this lane's starts make it),
-or sits in `<checkout>/.claude/worktrees` with its HEAD — a commit origin's
-default branch lacks — carrying this lane's `Lane:` trailer AS ITS OWN (a tree
-another lane stacked on this lane's commit is not this lane's, #174); its rows
-say so. A lane with no #97 snapshot at all (state `NONE`) but trees of its own is
-**refused, exit 2**: which trees are its is recorded nowhere, so #163's gate does
-not pass it. Any other tree the inventory does not name is **FOREIGN**: reported and left, unless
-`--include-foreign` and a `--word "<verbatim>"` (recorded in every register line
-it causes). A tree ANOTHER lane's inventory names is that lane's and is never
-taken from here, word or no word — and one BOTH inventories name is kept, since
-records are history and a path can be reused. Other lanes' claims are read
-wherever #97 keeps them (#170 G6): beside this lane's control root, under
-`$LANES_LANE_STATE_ROOT` and `$PROJECTS_ROOT/.lane-state`, beside every checkout
-the estate's shape walk finds, beside every lane's recorded `dir` in the
-register's lane logs that lies in this sweep's estate (#174), and - where the whole estate is walked (a clone the table
-could take, or `--include-scratch`) - in every `.lane-state` that walk finds, one
-in a plain directory inside a repository included (#174). An inventory record that cannot be
-read (no id, no path, an unknown schema; #170 G9) refuses the sweep, exit **2**: its tree's owner
-is unknown — and so does ANOTHER lane's record or inventory directory, a lane
-worktree root, a checkout's `git worktree list`, or the register's lane logs that
-cannot be read, before anything is fetched (#170 G1, G5); another lane's claim
-that cannot be read is a NOTE instead where this lane has no tree, since a claim
-could only take one from it (#174). The lane's own checkout is never a candidate. The lane name is
-resolved first (`lanes-edit.sh canon-lane`, Amendment 15), as `lane-start` and
-`lane-end` resolve it; an alias table that cannot be read refuses.
-
-**Who may act** is #97's reconciliation (`lanes-edit.sh lane-reconcile`), read
-before anything is written — the fetch included. Under `--yes` the register is
-FETCHED FIRST, by the sweep itself (`origin/<branch>` of the workspace
-repository, an explicit refspec): `lanes-edit.sh`'s own fetch answers 0 when it
-fails, and an inherited `LANES_NO_FETCH=1` skips it, so a lane rebound on another
-host after this one's last fetch would read as bound HERE (#170 A1). A register
-that cannot be fetched refuses, exit **2**, with nothing changed. The fetch of
-each repository acted in pins its refspec as `status --fetch` does
-(`+refs/heads/*:refs/remotes/origin/*`, `--refmap` the same, tag pruning off), so
-a mirror-style `remote.origin.fetch` cannot let `--prune` delete a local branch
-before it is classified (#170 item 6).
-
-| the lane | dry run | `--yes` |
-|---|---|---|
-| bound on another host or container (Amendment 18(b): UNKNOWN, never dead) | the table, exit **2** | refused, exit **2** |
-| its binding, holder or reconciliation could not be read | the table, exit **2** | refused, exit **2** |
-| held by ANOTHER live session | the table, exit **2** | refused, exit **2** |
-| managed-owned (ruling 2026-10-04) | refused, exit **2** | refused, exit **2** |
-| held by THIS session, or with a tree THIS session recorded (an inventory `writer` that is the caller, #170 B5) | the table | only with the coordinator's writer count: `--live <worktree>` per live writer (its ListAgents count, Amendment 17 Addendum 1 (i)), or `--live none`. A path that names no tree of the table, or `none` beside a path, is usage, **64** (#170 B4) |
-| `SWAPPING` in a live session | the table | refused: a handoff is in flight |
-| no live holder, bound here, free or gone | the table | performed |
-
-### The table, as implemented
-
-Each tree is classified in this order; the first row that matches decides.
-
-| tree | disposition | what `--yes` does |
-|---|---|---|
-| not in the lane's inventory | `foreign` | nothing (`--include-foreign --word …` applies the rows below) |
-| a process stands in it or holds a file open there (`/proc`, else `lsof`), a tmux pane's current path is in it, it is named by `--live`, the sweep was started inside it, or the session that recorded it is live | `live` | nothing, ever — asked again at the moment of the act |
-| liveness could not be read — the scan failed, or a process of THIS account whose `/proc` entries cannot be read (not dumpable) is placed in it by an absolute path in its command line or by its parent's working directory (#170 item 2) | `keep` | nothing |
-| its directory is gone and git still registers it | `prune` | `git worktree remove <path>` — that one registration; a repository-wide `git worktree prune` is never run (it would unregister other lanes' and FOREIGN trees too); a directory that reappeared meanwhile is left for the next sweep to classify |
-| … and its registration's git directory names a commit no branch, tag or origin holds — a detached HEAD, a reflog entry (#170 A4) | `rescue+prune` | a rescue branch pushed (where there is an origin) and a bundle, then that one registration removed |
-| … and its registration's git directory keeps a submodule repository (`modules/`) with a branch, tag, stash or reflog entry no remote of it holds, or an annotated tag object none of them holds (#174) | `keep` | nothing: the prune would take that repository (asked again just before) |
-| its directory is gone and nothing registers it | `gone` | nothing; the inventory record is history |
-| another lane's inventory names it too | `keep` | nothing: which lane owns it now is a person's to say |
-| a registration someone LOCKED; a file flagged skip-worktree or assume-unchanged that differs from the index (git status hides it, #170 A2); a submodule with uncommitted work, ignored files no commit carries (an `.env`), a branch, tag or HEAD no remote of it holds, a stash (#170 item 5), a commit only its reflog names, or a skip-worktree or assume-unchanged edit (#174) — its repository lives under the tree's git directory and goes with it; any submodule repository that git directory keeps under `modules/` with a branch, tag, HEAD, stash or reflog entry no remote of it holds, or an ANNOTATED tag whose very tag object none of them holds (asked of each remote at the act), a DEINITIALIZED submodule's included (#174); a repository nested anywhere inside it, a venv's `src/`, node_modules and a cache-named directory included (#170 A3, #174); a CLONE with a branch, a TAG (#170 item 4) or a stash origin lacks, or whose git directory linked worktrees share | `keep` | nothing, and the line says which |
-| something leans on it — another repository's `objects/info/alternates`, or a remote whose URL is its path, read from every repository the estate walk finds: every directory of the estate but caches, tool environments and `site-packages`, a plain directory inside a repository included (#170 A11) | `load-bearing` | nothing; the line names every dependent and the remedy (`git repack -a -d`, then drop the alternates or re-point the remote) |
-| a CLONE (removed by deleting its directory) when the search for what leans on it was partial: a directory of the estate could not be read, there is no estate root, or the clone lies outside it (#170 A11) | `keep` | nothing |
-| no `origin` | `keep` (`bundle+remove` with `--bundle`) | a bundle is its only rescue |
-| dirty or untracked work, where git-lfs is configured and an untracked file is `filter=lfs` content | `keep` | nothing: untracked files go to a bundle only (below), and a bundle carries an LFS pointer, never its bytes (#174); asked again at the act, before anything is pushed |
-| dirty or untracked work | `wip-rescue+remove` | the tracked changes (`git add -u` into a COPY of its index), `commit-tree` on its head, `rescue/<lane>/<slice>-<UTC>` pushed and seen on origin; UNTRACKED files in a second commit on it that goes to the bundle ONLY, never to origin — an un-ignored key file is not something anyone meant to push (#170 A9; `--push-untracked` pushes them as before). Which files are untracked is read from the two snapshots taken AT THE ACT, never from the table's status, so a file that arrived since is held back too (#174); a bundle, then removed |
-| an unborn branch, clean | `remove` | removed |
-| detached at a commit origin holds | `remove` | removed |
-| detached with commits of its own | `rescue+remove` | `rescue/<lane>/<slice>-<UTC>` pushed, a bundle, then removed |
-| MERGED — its PR LANDED in the register, or `gh` says MERGED, into the default branch, and that PR's head holds this tip | `remove+delete-branch` | removed; local branch deleted at the SHA judged merged (`update-ref -d <old>`), and the remote branch too — under a lease on the judged SHA — where its `Lane:` trailer is this lane's, it holds nothing the PR did not, and `gh` does not still answer a PR of it OPEN (a LANDED line with a wrong number never closes an open PR, #170 A8) |
-| clean, every commit on its own remote branch (an open PR is untouched) | `remove` | removed; the branch stays |
-| clean, its head on some origin branch | `remove` | removed; the branch stays |
-| unpublished commits on `main`/`master`, or on a branch origin has DIVERGED from | `rescue+remove` | the tip to `rescue/<lane>/<slice>-<UTC>`, then removed; the branch itself is never force-pushed |
-| unpublished commits on a branch an OPEN pull request names (gh's OPEN wins over a register LANDED line naming that PR, #174), whose origin tip carries ANOTHER lane's `Lane:` trailer, or where whether a PR names it could not be read (#170 A7) | `rescue+remove` | the same: the lane's unreviewed commits never go onto somebody else's branch, and origin's branch is left as it is |
-| unpublished commits otherwise | `push+remove` | pushed AS IS under its OWN name — never its upstream's, which for a branch made from `origin/main` is `main` — then removed |
-
-**"Merged" is never `git branch --merged` alone**: a squash merge leaves no
-ancestry, and a branch whose tip IS on `main` with no pull request naming it is
-listed as unmerged and its branch kept. A PR merged into another base (a release
-or feature branch) is no landing, and an OPEN PR protects its branch however an
-older PR of the same branch was merged — unless the register has LANDED that
-very PR. The branch's pull request comes from one `gh pr list --state all` per
-repository; with `LANES_NO_GITHUB=1` or no `gh` nothing is called merged. The register's `LANDED` lines are read from
-`origin/<branch>` of the workspace repository.
-
-**Liveness is asked again before the rescue and again at the moment of
-removal** — processes, open files, tmux panes and the recording session, afresh;
-a scan that cannot be made leaves the tree. **At the moment of removal** the
-head is re-read, and the tree must still be clean — or, after a WIP rescue, must still be byte for byte the tree the rescue
-commit carries. A push that origin refuses leaves the tree exactly as it was:
-the WIP commit is made BESIDE the tree, never into it, so its branch, index and
-files never move. Every push is checked on origin (`git ls-remote`) before
-anything goes, and where the repository has git-lfs configured (`filter.lfs.*`)
-it runs its hooks, so git-lfs's pre-push uploads the objects (#170 A10).
-
-**Before each removal git is asked what it would take.** A worktree's removal
-takes its own git directory — its HEAD and that HEAD's reflog (and its branch
-and the branch's reflog, where the branch is deleted after it); a pruned
-registration's the same; a CLONE takes every ref but its remote-tracking ones,
-and every reflog — a reflog directory that cannot be listed makes the answer
-unknown, and the clone stays (#174) — and an ANNOTATED TAG is its own object,
-kept where origin holds that very tag object (`ls-remote --tags`) and bundled,
-its message with it, where it does not (#174); a `--branches` delete takes the
-branch's tip and its reflog (#174). Commits there that no origin ref, surviving
-branch, tag or stash keeps — a commit only a reflog names, after an amend or a checkout away
-from it (#170 A5) — go to a bundle first, through temporary
-`refs/lane-worktrees/<slice>-<UTC>/*` refs deleted once it verifies. **The
-self-check** asks the same question once more right before the removal: a
-commit the removal would take that is neither on origin, in a ref that stays,
-in a push seen on origin this run, nor in a bundle this run verified is a
-defect in the table, and the sweep REFUSES it — exit **2**, a line in
-`DISPOSITION.md`, nothing after it acted on. A CLONE with a local git-lfs
-store (`.git/lfs/objects`) whose commits would go to a bundle only is kept
-instead: a bundle carries LFS pointers, never their bytes (#174). The first register line that
-cannot be written stops the sweep the same way (exit 1, #170 B6).
-
-**Ignored files that are not caches or build output** (an `.env`, a local
-config) are archived to `<slice>-ignored.tar.gz` before a tree goes: a commit
-cannot carry them, and the rule is that nothing goes that is not first saved.
-They are listed again at the moment of removal, and a tree whose ignored files
-changed, appeared or went since the archive was taken is left.
-Build output (`target`, `build`, `dist`, `.tox`, `.next`, `*.egg-info`, …) is
-generated and is not archived — judged by the ignored entry's OWN name, never an
-ancestor's, so `docker/build/prod.env` is archived (#170 A6) — and so are
-`docker/node_modules/prod.env` and `docker/.venv/prod.env`: the archive leaves
-caches out only BENEATH an entry it was given, and is read back for every entry
-selected, so one missing leaves the tree (#174). More than
-`ignored_archive_mb` of the rest leaves the tree in place for a person.
-
-### The other rows
-
-| flag | what | disposition |
-|---|---|---|
-| `--branches` | local branches no worktree holds, in the lane's checkout | merged by PR evidence: `delete` (`delete+remote` where the `Lane:` trailer is this lane's, origin's tip is inside the PR and gh does not answer it OPEN), each at the SHA judged and only after a fetch of that checkout that worked under `--yes`, and only after what the delete would take — its tip and every commit its reflog names — is on origin, in a ref that stays or in a bundle (a `bundle:` ledger row), asked once more right before the delete: the self-check, exit **2** on a refusal (#174); an open PR's branch: `keep` — and still COUNTED where it is the lane's and `origin/<branch>` lacks its tip (#170 G2); a branch `origin/<branch>` holds, whatever its configured upstream, is published and not listed (#170 G7); unmerged with a missing, diverged, unpushed or unreadable upstream: `list` with its tip, distance from `origin/main`, last commit date and owner — never deleted; `main`, `master` and `rescue/*`: never touched |
-| `--include-scratch` | `.lane-worktrees/<lane>/*-scratch`, `briefs/`, `bin/` that are no checkout | `archive+remove`: tar (caches left out) and sha256, then removed — only if no writer arrived and nothing outside the caches changed while the tar ran; `keep` while a tree of the table or any `.git` lies under it (#170 item 7), or the search for what leans on it was partial (#170 A11) |
-| `--include-caches` | `__pycache__`, `.pytest_cache`, `.mypy_cache`, `.ruff_cache`, `node_modules`, any directory with `pyvenv.cfg` (and `venv/`, `.venv/` with an activate script), under `.lane-worktrees/<lane>/**` and the lane's inventory trees | `remove`, without archiving — never one git tracks or whose tracking cannot be read, one that is or holds a repository or a directory that cannot be read (`keep`: a venv's `src/` clone is work, #174; asked again just before), one inside scratch being archived, or one in a FOREIGN tree, a live one, one whose liveness is unknown or one left by its own act; the owning tree's liveness is asked again just before |
-| `--include-sandboxes` | `tmp.*` and `pytest-of-$USER/pytest-*` in `/tmp` and `$TMPDIR` (or `LANE_WORKTREES_SANDBOX_ROOTS`), and `tests/run.sh`'s run roots, owned by this account | `remove` where the owning process is gone: a pytest `.lock` naming a dead pid (read again at the act), and no live process standing in it, holding it open or naming it in its environment. A `tmp.*` is NEVER removed (#170 item 1, option (b); #174): `mktemp -d` records no owner, so neither a suite's mark in it nor `aging_days` untouched proves a suite made it — one older than `sandbox_min_age_minutes` (by the newest file in it) is `list`ed and left, with its mark and any repository in it (a bare one included), since it may be a person's checkout or scratch |
-| `--links` | every symlink under the estate and every worktree `.git` gitdir pointer | `broken`, listed with target and age; nothing changes |
-| `--bundle` | every tree acted on | a `git bundle` beside the archive (always, for a rescue) |
-
-### The sweeps directory, the register line, retention
-
-`${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/sweeps/<lane>/<UTC>/`,
-mode 0700, created EXCLUSIVELY by the first act of a `--yes` (a second sweep
-started in the same second gets `<UTC>-2`) and never by a dry run:
-
-* `DISPOSITION.md` — every tree and item acted on: what it was, why, what was
-  done, where its rescue is, and the register line that records it;
-* `rescues.tsv` — `origin`, rescue branch and sha for each rescue, which
-  `--expire` reads; a bundle that is the ONLY copy of what it holds (untracked
-  files, commits only a reflog named, a tree with no origin) is a row too, with
-  origin `-` and branch `bundle:<file>` (#170 item 8);
-* the bundles, `<slice>-ignored.tar.gz` and `scratch-<name>.tar.gz`;
-* `MANIFEST.sha256` — `sha256sum` format, every file above.
-
-**One register `NOTED` line per tree acted on** (`lanes-edit.sh log NOTED
-lane:<lane>`), written after the act so it says what happened, naming the
-disposition, the rescue and the archive; one more each for scratch, branches,
-and caches with sandboxes, each written as the session that swept
-(`LANES_SESSION`, #170 E7). A line the register refuses is printed whole for a
-person to write by hand - quoted for the shell (#170 E6) and naming that same
-session (#179) - and the exit is 1. The line is the pointer that
-outlives the archive.
-
-**Retention: 90 days** (`sweep.conf`). `sweep --expire` lists archives older than
-that, and with `--yes` removes those whose every rescue branch is still on
-origin AT THE RESCUED SHA (`git ls-remote`); an archive whose rescue branch is
-gone from origin, or was remade at another commit, or that holds a `bundle:` row,
-is the only copy and is NEVER expired. Nor is an archive that is not WHOLE — no `MANIFEST.sha256`, a file it
-does not list or whose digest differs (a sweep interrupted after a bundle), or a
-`rescues.tsv` that is missing or has a row that is not origin, branch and SHA,
-or a manifest entry whose file is gone. What expired is appended to
-`sweeps/EXPIRED.log`.
-
-`${XDG_CONFIG_HOME:-$HOME/.config}/openRepoTools/sweep.conf` (or
-`$LANE_WORKTREES_CONF`), `key=value` lines:
-
-| key | default | what |
-|---|---|---|
-| `retention_days` | 90 | archive age before `--expire` may remove it |
-| `aging_days` | 14 | a rescue branch or dirty inventory tree older than this is "awaiting disposition" in the report |
-| `sandbox_min_age_minutes` | 60 | a `tmp.*` younger than this is never a killed suite's |
-| `foreign_quiet_hours` | 24 | a FOREIGN tree active within this is treated as live, even with `--include-foreign` |
-| `ignored_report_mb` | 50 | the report's threshold for an ignored directory |
-| `ignored_archive_mb` | 200 | ignored files (not caches, not build output) a tree may carry into its archive; more, and the tree is left for a person |
-
-### The exit contract (`lane-end`'s gate, #163)
-
-`lane-worktrees sweep <lane> --dry-run --porcelain` prints one tab-separated
-row per tree and item, between a `lane` row and a `summary` row:
-
-```text
-lane    <lane> <state> <holder> <holder uuid> <binding> <verdict>
-refused <why>                                   (only when refused)
-tree    <disposition> <retire|-> <path> <branch> <head> <why>
-<kind>  <disposition> <retire|-> <path> <detail> <bytes> <why>     (branch, scratch, cache, sandbox, link)
-leg     <disposition> <retire|-> <path> <branch> <head> <why>    (an assembly's checkouts only, T018)
-summary <to retire> <trees> <live> <foreign>
-```
-
-**`lane-end` reads it with `--branches --include-scratch --include-caches`** and
-refuses on 3 and on 2 — and on 0 too where a `cache` row is printed, because a
-cache under the lane's root is still the lane's to clear though never its work to
-retire, or where its own read of the lane's root finds residue no row names
-(see [`lane-end <lane>`](#lane-end-lane)). It counts the rows whose second field
-is `retire`, plus every `cache` row; a FOREIGN tree, another lane's branch and a
-`gone` record count for nothing. It passes `LANES_EDIT` through and sets
-`LANES_NO_FETCH=1`, having fetched in its own reads.
-
-Every field is escaped — a backslash is written `\\`, a TAB `\t`, a newline `\n`
-and a carriage return `\r` — so a path holding any of them is still one field
-of one row; bytes that are not UTF-8 pass through as the bytes they are. The
-command exits **0** (nothing to retire), **3** (something to retire — a tree of the
-lane's on disk, live or not, a stale registration, an unpublished or merged
-branch of the lane's, included scratch), or **2** (refused: bound elsewhere,
-held by another session, managed, a lane with trees and no #97 snapshot, a read
-failed — a lane root, a registration list, another lane's claim on a lane with
-a tree, the register's lane logs, or under `--yes` the register's fetch — or an
-error no read caught, which is never a traceback's exit 1 on a dry run). FOREIGN trees, links,
-caches and sandboxes are never the lane's to retire. `--yes` exits 0 when every
-act completed, 1 when one failed part-way (the rest go on — unless a register
-line could not be written, which stops the rest; each failure is in
-the table and in `DISPOSITION.md`, which is written even when an error no read
-caught stops the run), and **2** when the self-check refused a removal; usage
-is 64, a `--live` path that names no tree included.
-
-### A triad: its legs, their worktrees and the paired trees (T018)
-
-**Plan task T018 of the triad migration (opensoft/openRepoTools#186).** A lane's
-checkout is an **assembly** when its own `project.yaml` declares a leg other than
-itself — the standard's rule, as openRepoShape's `templates/assembly-root/project.yaml`
-writes it: a top-level `legs:` list of `- role:` / `repository:` / `path:`, the
-assembly's own leg at `path: "."`. One reader answers it for every lane tool:
-
-```sh
-lanes-edit.sh project-legs <checkout>   # <repository> TAB <path as declared> TAB <where it is checked out>
-```
-
-It is `lane-start`'s rung-5 reading of `legs:`, line for line (a test holds the two
-equal), and reads `repository:` and `path:` only — the manifest confers nothing,
-and `role:` is never read. 0 with legs; 8 with none (no `project.yaml`, or one naming
-no leg but the checkout itself); 1 where the manifest is there and cannot be read,
-which is never "no legs"; 64 usage. It touches no workspace.
-
-**Why the sweep needed it.** A leg is a submodule: its `.git` is a file,
-`git -C <assembly> worktree list` names none of its worktrees, and a feature's
-trees in the standard's three-leg layout, `<assembly>/worktrees/<feature>/{spec,code}`,
-are worktrees of the LEGS' repositories. So a code tree was invisible to the sweep,
-to `lane-end`'s gate, to the handoff's poll and to the daily report unless it had
-been recorded with the code leg as its checkout — and a lane with unpushed work in
-one passed `lane-end`.
-
-**Where the lane's checkout is an assembly**, `lane-worktrees sweep` also:
-
-* reads every leg, and every dependency nested in one (an initialized submodule of
-  the leg's own, as `code/upstream/openRepoShape` will be), as a **`leg` row** —
-  `clean`, `dirty`, `unpushed`, `dirty+unpushed`, `absent` (not checked out here,
-  or not there at all) or `unreadable` (a `.git` of its own that git cannot read,
-  or a leg directory this account cannot search, #255). A dependency nested in a
-  leg that git lists as not initialized has no row where its directory is missing,
-  or empty and searchable: it was never initialized. But git lists a dependency it
-  cannot search as not initialized too, so where its directory, or one above it,
-  cannot be searched (or it holds a `.git` that git cannot read), it is an
-  `unreadable` row, counted: a read that failed is never a clean dependency (#255).
-  One whose directory holds a checkout that git can read (a clone made by hand,
-  which git does not count as initialized) is read like an initialized one: it
-  holds the lane's work all the same.
-  A leg is the assembly's, shared by every lane the assembly homes, as the
-  assembly's own checkout is: **no `--yes` acts on a leg
-  checkout** (its branches are another matter: see `--branches` below). It is
-  COUNTED (exit 3, and `lane-end`'s gate) only where its HEAD's own `Lane:` trailer
-  is this lane's and it holds edits or commits origin lacks — the rule the sweep
-  already applies to `.claude/worktrees` — or where it could not be read; one
-  that holds another lane's work, or nobody's, is listed and counted for nobody;
-* lists the worktrees git registers in **every leg** — a FOREIGN row names the leg
-  it is registered in — so a tree recorded with the leg as its checkout is the
-  lane's as any recorded tree is;
-* takes **`<assembly>/worktrees`** as a root: a tree there that the lane's
-  inventory does not record is the lane's by its HEAD's own `Lane:` trailer and by
-  nothing else, because the paired root, like `.claude/worktrees`, is per feature
-  and not per lane — and `lane-handoff` records a tree there only on that rule, or
-  where the lane's own writers file names it (below), so the inventory does not
-  take in other lanes' trees; a standalone clone there
-  is FOREIGN; the root, a feature directory or a leg's directory under it that
-  cannot be listed or searched refuses, exit **2**;
-* with `--branches`, makes each leg's branches rows like the checkout's own, each
-  naming its leg, and **`--yes` deletes a merged lane branch there exactly as it
-  does in the checkout** — bundling first any commits only its reflog names, and
-  deleting its origin branch too where the row says `delete+remote`. No `--yes`
-  acts on a leg *checkout*. With `--fetch` (and under `--yes`), it asks each leg's
-  origin.
-
-A manifest, or a leg's own submodule list, that cannot be read refuses, exit
-**2**. **A checkout with no `project.yaml` is asked nothing** — no helper call, no
-read, no row — so a single repository's sweep, gate, handoff, report and `add` are
-byte for byte what they were; `tests/test_triad_lane_tooling.py` holds every one of
-them to the output `c45a452`'s tools printed.
-
-**`lane-end`'s gate** counts a `leg` row marked `retire` as a "leg checkout" it
-names, with the remedy a person's (commit and push from inside it; no `--yes` is
-offered when legs are all it counted), and lists a leg that holds work and is not
-this lane's below the table as NOT counted — whether the gate passes or not.
-
-**`lane-handoff` and `lane-reconcile` (T018 (b)).** Where the lane's checkout is an
-assembly, `lane-handoff` also looks in the **paired root**:
-`<assembly>/worktrees/<feature>` and `<feature>/<each declared leg's path>`, at every
-directory there with a `.git` of its own. The paired root is per feature and not per
-lane — every lane the assembly homes keeps its feature trees there — so the handoff
-takes a tree there as this lane's on the sweep's terms and on no wider ones. It
-**polls and records a paired tree only where one of three things holds**:
-
-* this lane's inventory already names it;
-* its HEAD's own last `Lane:` trailer is this lane's, on a commit origin's default
-  branch lacks — the sweep's own rule for that root;
-* the `--writers-file` names it, because a writer with nothing committed yet has no
-  trailer to be found by.
-
-Those trees are in the WRITERS block and its count. **Every other checkout there is
-another lane's, or nobody's**: one line in the top block under a heading of its own,
-outside WRITERS — `- PAIRED ROOT, not this lane's: <path> — branch …`, with its last
-commit and its HEAD's own trailer, which is what finds its lane. It is not counted, not
-recorded, and never a writer for the next session to relaunch; its own lane's handoff
-records it. So one lane's `lane-end` never refuses on another lane's paired work, and
-its `sweep --yes` never acts on it. This is option (a) of the pre-PR review's M1, as
-lane 1 ruled on 2026-10-17 (#186, comment 6240800023, item 1; the analysis's §7 item
-12): a handoff that recorded every paired tree made other
-lanes' trees the running lane's inventory, and a tree two lanes' inventories both name
-is `keep`, counted, in both sweeps.
-
-Every tree it polls is **recorded under the checkout it belongs to**. A worktree of a
-leg's repository (a paired tree, or one `lane-worktrees add --checkout
-<assembly>/code` made under the lane's root) is recorded under that leg, the path
-`project-legs` prints and `add` records. A tree the inventory already records under a
-checkout of the tree's own repository keeps it: a dependency nested in a leg
-(`--checkout <assembly>/code/upstream/<dep>`) is no declared leg. Any other tree keeps
-the lane's `dir`, as before. A leg that is not checked out here (never initialized, or
-deinitialized) names no tree. A leg with a `.git` of its own that git cannot read, or
-a leg directory this account cannot search (#255), is `unreadable`, the sweep's word:
-one `- UNREADABLE LEG: …` line in WRITERS and a note on
-stderr, and counted on stderr's `legs: N of the assembly's legs under <dir> unreadable`
-line, never in WRITERS' `(N found)`. The lane is not held `SWAPPING` for the leg
-itself. A polled tree that could then be of that leg's repository is one it cannot
-place: its common git directory lies inside the assembly or its git directory (a
-leg's `.git/modules/<leg>`) and is no readable leg's and not the assembly's own, or
-the inventory records it under the unreadable leg. Such a tree is named, marked
-`(NOT recorded)` in its WRITERS line, and not recorded, so the checkout `add` recorded
-stays, and the lane stays `SWAPPING` for that tree. The `UNREADABLE LEG` line says how
-many trees were withheld, or that none was. A tree of any other repository, such as a
-worktree of an unrelated repository in the lane's own root, is recorded under the
-lane's `dir`, as when every leg reads. A tree with a `.git` of its own that git cannot
-read at all (a damaged `.git/modules/<leg>` takes every worktree of that leg with it)
-is listed in WRITERS and counted, marked `(NOT recorded)` and `UNREADABLE`, never
-recorded, and the lane stays `SWAPPING` for it. A checkout with no `project.yaml`
-naming a leg passes over such a tree, as it always did. A worktree
-a leg registers anywhere else is not polled
-as a writer, just as the checkout's own registrations elsewhere are not;
-`lanes-edit.sh lane-reconcile` reports it. The reconciliation reads what the legs hold
-beside what the checkout holds. Every worktree git registers in a checked-out leg that
-no sidecar names is a `TREE` row: `unmanaged`, or `stale-registration` where its
-directory is gone, naming the leg. A checkout in the paired root that nothing else named
-is `unmanaged`. A leg with a `.git` of its own that git cannot read, or a leg directory
-this account cannot search, is a `TREE` row `unreadable` that requires recovery:
-the sweep's rule and word for its `leg` row, which
-it counts. The verdict is not `indeterminate` for it, so the sweep still lists and
-counts that leg. Nothing is adopted, deleted or overwritten.
-
-**A `project.yaml` that cannot be read is never "no legs".** `lane-handoff` still
-completes (`R-A11-11`), but it does not poll the paired root. It says so in the top
-block's WRITERS section (`- NOT POLLED: …`), files no sidecar for a tree it cannot
-place (a tree of the lane's own repository is still recorded), and leaves the lane
-`SWAPPING`. The reconciliation's verdict is `indeterminate`, said in the words the
-sweep refuses with ("the legs of the assembly `<dir>` could not be read"): the sweep
-reads that verdict first and refuses on it, exit **2**. The verdict is `indeterminate`
-too where a leg's registrations, the paired root or a feature directory under it
-cannot be listed, or a leg's directory under a feature cannot be searched. For the
-same directories, and where the lane's inventory cannot be read (which paired trees it
-names would then be unknown), `lane-handoff` gives the same three signs: a
-`- NOT POLLED: …` line in WRITERS, a note on stderr, and the lane left `SWAPPING`.
-So does an inventory that holds a record that is not a whole schema-1 one (#255):
-`lane-trees` gives such a record its id, its schema (`<unreadable>`, `<none>`, an
-unknown one, or #252's `<malformed>`) and any path it keeps, and the note names each
-one by those three. It is never read as a record, as the sweep never reads one, so a
-paired tree that only it names is not taken as this lane's writer, and the handoff
-files no record over it.
-**A checkout with no `project.yaml` is asked nothing**, and one whose
-`project.yaml` names no leg but itself is asked only `project-legs`, which answers 8.
-The handoff's output, top block and inventory, and the reconciliation, are byte for
-byte what they were. `tests/test_triad_lane_tooling_handoff.py` holds them to the
-output `c45a452`'s tools printed, on a repository laid out to look like a triad: a
-submodule's worktree under `worktrees/<feature>/code`, and a tree recorded with the
-submodule as its checkout.
-
-**A parked paired tree is not the lane's to the sweep — a gap lane 1 has ruled on, and
-not yet closed (docs/triad-lane-tooling-analysis.md §7, item 11).** On 2026-10-17 (#186,
-comment 6240800023, item 2) lane 1 ruled that park's WIP commit carries a `Lane: <lane>`
-trailer and that `resume` records the tree it rebuilds with `lanes-edit.sh
-set-lane-tree`. Both are workBenches changes and neither has landed, so what follows
-holds until they do. The sweep and `lane-end`'s gate
-give a tree under `<assembly>/worktrees` to a lane by its HEAD's own `Lane:` trailer
-and by nothing else, unless the lane's inventory names it. `make park` commits a dirty
-leg tree as `wip: park <UTC time> — lane <lane>`, with no trailer, and `resume`
-soft-resets those commits, leaving the work uncommitted on the commit below them. So a
-parked or resumed paired tree is a FOREIGN row of `lane-worktrees sweep <lane>
---dry-run` ("… its HEAD carries no Lane: trailer of this lane's as its own"), counted
-for nobody, and a gate that passes says nothing of it. **Before `lane-end` in an
-assembly**, run that dry run and read every FOREIGN row under `<assembly>/worktrees`:
-one whose HEAD, or whose branch's upstream, is a `wip: park … — lane <this lane>`
-commit, or that holds uncommitted edits, may be this lane's parked work. Land it or
-hand it over first, or record it with `lanes-edit.sh set-lane-tree <lane> <path>
---checkout <assembly>/<leg>` so the gate counts it. `lane-handoff` does not record it
-for you: on the sweep's terms it records a paired tree with no trailer of the lane's
-only where the inventory or the writers file already names it.
-
-### Two protocol lines this act assumes (proposed for the amendment that ratifies it)
-
-1. **A lane creates worktrees, never clones.** Every tree a lane works in is a
-   `git worktree` of the estate's checkout, recorded in its inventory (#97) —
-   which `lane-worktrees add` does in one act (below). A
-   standalone clone under a lane root is FOREIGN to every sweep, and one that is
-   a shared store or a local remote is LOAD-BEARING. A lane adds no local remote
-   and no alternates.
-2. **Scratch lives in the session scratchpad or the lane's state directory,
-   never beside repositories.** `.lane-worktrees/<lane>/*-scratch`, `briefs/`
-   and `bin/` are grandfathered into the archive-then-remove row; new scratch
-   goes to `${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/lanes/<lane>/scratch/`
-   or the harness scratchpad.
-
-### Making a lane's worktree — `lane-worktrees add` (#163)
-
-**Creation records the tree, in the same act.** Nothing in this tooling made a
-worktree before this verb — `lane-start` makes none, and every writer's tree was
-a `git worktree add` typed into a brief — so the inventory was written only at a
-handoff, and a lane that never handed off had none: lane `openRepoTools-3`'s was
-empty while nine trees under its root were its own, and the sweep could not
-judge them.
-
-```sh
-lane-worktrees add <lane> <slice> [--branch <name>] [--from <ref>] [--checkout <dir>] [--dry-run]
-```
-
-It makes `<parent of the lane's dir>/.lane-worktrees/<lane>/<slice>` as a `git
-worktree` of the lane's recorded checkout (or `--checkout <dir>`, the root of a
-checkout), on `--branch` (default: the slice) — checked out where that branch
-exists, otherwise made from `--from` (default `HEAD`) **with `--no-track`**, so
-a bare `git push` never aims a writer's commits at the branch it started from —
-and then records it with `lanes-edit.sh set-lane-tree <lane> <path> --checkout
-<dir>` (with `--writer` where the caller's session is a transcript uuid). The
-path is the one line on stdout. It refuses, exit **2** and nothing made, a
-managed lane or one whose ownership could not be read, a lane that records no
-directory, an inventory that cannot be read, a path that already exists, a
-branch name git does not take, and `--from` beside a branch that already exists.
-**A record that fails after the tree is made — or a `git worktree add` that
-fails after making it, as one does when a `post-checkout` hook fails — takes the
-fresh tree and the branch this act made back out** (`git worktree remove`,
-without `--force`, and `update-ref -d` at the commit it made) and exits 2; only
-where something is left — the undo failed, a directory git does not register,
-which is named and never deleted blind, or a new branch that has moved past the
-commit this act started it at, which is kept so that commit stays reachable — is
-the exit **1**, with the `set-lane-tree` that records it printed. Usage
-is 64, and every flag of the sweep's is usage here.
-
-A tree made any other way — a brief's own `git worktree add`, the harness's
-`isolation: worktree` — is still legal git and is FOREIGN to every sweep until
-`lanes-edit.sh set-lane-tree <lane> <path>` records it.
-
-**In a triad (T018), a tree of a leg is made from the leg** — the guidance of
-docs/triad-lane-tooling-analysis.md §4.4, proposal 1:
-
-```sh
-lane-worktrees add <lane> <slice> --checkout <assembly>/code
-```
-
-Where the lane's checkout is an assembly (its `project.yaml` declares a leg other
-than itself, read by `lanes-edit.sh project-legs`), a tree made from any checkout of
-a leg's repository — the leg itself, or a worktree of it, a paired
-`<assembly>/worktrees/<feature>/code` included — is recorded with **the leg** as its
-checkout (`<assembly>/<path>`), which every reader of the inventory enumerates; the
-note names the leg, and says so where the checkout given was a worktree of it. Made
-from the assembly itself (no `--checkout`), the tree is a worktree of the assembly,
-whose legs a worktree does not check out: `add` makes it as before and says that its
-legs are empty there, naming the `--checkout <assembly>/<leg>` that makes a leg's
-tree. A lane whose checkout has no `project.yaml` is asked nothing, and its `add` is
-what it always was. A manifest that cannot be read refuses, exit **2**, nothing made.
-
-### The estate report — `sweep --all --dry-run --report`
-
-The net under every actor that never runs `lane-end`: **creation outpacing
-closeout as a number that is read every day.** It reads every lane's #97
-inventory and snapshot in every `.lane-state` it can find (#170 G15, B8):
-`<estate>/.lane-state`; beside every checkout the estate's shape walk finds,
-so a nested checkout's lanes are read where #97 keeps them; under every
-directory a walk of the whole estate finds, caches skipped, a plain directory
-inside a repository included (`xFactory/xFactories/.lane-state`); beside every
-lane's recorded `dir` in the register; and `$LANES_LANE_STATE_ROOT`. It also
-reads the workspace repository's register on `origin/<branch>`, and the disk —
-**never the derived index** (Amendment 14 clause (b)) — and CHANGES NOTHING:
-no fetch, no index refresh (`GIT_OPTIONAL_LOCKS=0`), no expiry. A byte that is
-not UTF-8, in a path or in the workspace's `.gitignore`, is carried as itself,
-never an error (#170 G10-G12).
-
-```sh
-lane-worktrees sweep --all --dry-run --report [--estate <dir>] [--post <file> | --post <owner/repo>#<n>]
-```
-
-| section | what is listed |
-|---|---|
-| FOREIGN repositories | a CLONE inside a worktree container (`.lane-worktrees/<lane>`, `.claude/worktrees`, `worktrees`, `<x>-worktrees`), and a second clone of an origin the estate already has a checkout of: path, size, last commit, owner (the last `Lane:` trailer), and LOAD-BEARING with its dependents where something leans on it |
-| Orphaned worktrees of ENDED lanes | trees an inventory records, and directories under `.lane-worktrees/<lane>`, of a lane whose snapshot is `CLOSED` or whose log's last lane line is `ENDED` or `RETIRED` — with the sweep that retires them. Empty beside a record it could not read — a lane snapshot, an inventory, the register's lines, a directory the walk could not list — it says "none found in what could be read", never "none" (#170 B8); a failure that is no lane record (an ignored-file listing, say) is still a row of the last section but leaves "none" as it is (#179); so does Awaiting disposition |
-| Unmerged branches | local branches of every checkout — and of every leg of an assembly (T018) — with no upstream, a gone upstream, a diverged one, or unpushed commits: tip, state, age, owner, and whether a worktree holds it. Never deleted; `main`, `master` and `rescue/*` are not listed |
-| Root main divergence | a checkout whose local `main` is ahead of `origin/main`; where every changed path is under `handoffs/` or `lanes/`, the remedy is Amendment 4's — those live in the workspace repository and are pushed per write |
-| Assembly legs with uncommitted or unpublished work | **only where the estate holds an assembly with a leg checked out** (T018): every leg of a canonical checkout whose `project.yaml` declares legs, holding dirty or untracked paths or a HEAD no origin ref holds, or that could not be read — each named with its assembly. A leg is a submodule (its `.git` a file), so it was never a canonical checkout; it is now read as a checkout of its own here, and in the three branch sections, whose leg rows end with `the <path> leg of <assembly>` |
-| Awaiting disposition | a `rescue/*` branch (local or on origin) and a DIRTY inventory tree whose git directory has been still for `aging_days` (14), with owner and age |
-| Caches and sandboxes | `--include-caches`' and `--include-sandboxes`' rows across every lane, by size |
-| Ignored directories over `ignored_report_mb` | every ignored directory of every repository at or over 50 MB (`du -sk`) |
-| Evidence-shaped paths | untracked or ignored — an ignored FILE as much as an ignored directory (#170 item 9) — `junit*.xml`, `MANIFEST*`, `*-report.md`, `*REPORT*.md`, `canary-*`, `*-evidence`, `deployment-evidence` inside a repository, and a directory of reports beside the repositories — each a finding to move to the evidence root below |
-| Sweep archives past retention | `sweep --expire`'s own dry run: what WOULD expire, and what is past retention but kept because its rescue left origin. Expiring stays an act (`sweep --expire --yes`) |
-| Workspace repository hygiene | the workspace's `.gitignore` lines it lacks (with the one command that adds them, its path quoted for the shell, #170 item 10), and bytecode already in its history (for a person's word: history is rewritten only on one) |
-| Records the report could not read | a lane snapshot, inventory directory or record, or an inventory tree's `git status`, that could not be read; a directory the estate walk could not list, the estate root itself (#170 E10), the register's lane logs or its ENDED and RETIRED lines where the `git grep` failed (#170 G3), and a repository whose ignored or untracked files could not be listed (#179) — unknown is never absent, and the sections above may be missing what it holds |
-| `status --all` findings | the estate command's ahead/behind, fork, shape-pin and parked-record lines, reported as what they are and never counted as dirt (`LANE_WORKTREES_STATUS` names the command when it is not beside this one) |
-
-The summary table at its head also carries **the count of rescue branches** and
-**the sweeps directory's size**, so the cleanup's own footprint is watched.
-`--post <file>` writes the report there; `--post <owner>/<repo>#<n>` comments it
-on that issue through `gh`; with no `--post` it is printed. `--all` and
-`--report` come together, with no lane, no `--yes` and no `--expire` (usage, 64).
-
-**`lane-start` runs it once a day per workstation**, after the row is written
-and before the launch: the first start of a UTC day takes the stamp
-`${XDG_STATE_HOME:-~/.local/state}/openRepoTools/report-<YYYYMMDD>.stamp`
-(an atomic `set -C` create, so two starts at once run one report), removes
-older stamps, and starts the report DETACHED — stdin, stdout and stderr closed,
-in a subshell that exits at once, under `nohup` and, where there is a `setsid`
-(Linux), in a session of its own, so a pane killed after the stamp was taken
-does not take the report with it (#170 E8) — over the start's own
-`$PROJECTS_ROOT`, writing `…/openRepoTools/reports/<UTC>.md`. The report names
-every path, branch and lane of the estate, so it is private: the state and
-reports directories are 0700 and the report is written under `umask 077`
-(#170 item 11); where they cannot be made 0700 no report starts and no stamp
-is taken, so the next start tries again (#179). Every step either works or is skipped in
-silence: the report never delays a start and never fails one. `--dry-run`
-starts none; `LANE_WORKTREES_REPORT=off` is the switch (both suites set it).
-
-### Nothing new lands beside the code
-
-The sweep retires what is already there; these keep more from arriving.
-
-* **`tests/run.sh`** sends bytecode to
-  `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/pycache`, turns pytest's cache off,
-  and roots every temporary directory of a run under
-  `${XDG_STATE_HOME:-~/.local/state}/openRepoTools/tmp/<UTC>-<pid>/`, which its
-  EXIT trap removes however the run ends — after stopping the suite's whole
-  process group (TERM, then KILL at ten seconds, and only then the leader
-  reaped, so a suite that ignores TERM cannot hold the lock for ever: #170 item
-  3), so nothing it started outlives the run root or the lock. With
-  a terminal on stdin the suite runs in the FOREGROUND instead, so `--pdb` or a
-  `breakpoint()` can read it (a background group would be stopped by SIGTTIN,
-  and the wrapper would wait on it holding the lock); it is then in the
-  wrapper's own group, whose members are read before the suite starts, and
-  what is there afterwards that was not, and is no sibling of the wrapper, is
-  stopped the same way before the cleanup (#170 G14). `--basetemp` is the
-  wrapper's own, and a caller's is refused, 64 (#170 G8). A SIGKILL is the one end no trap sees;
-  the pid in the name is what lets `--include-sandboxes` tell its owner is gone.
-* **One virtual environment per repository, outside the estate:**
-  `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/venvs/<repo>/`. `openRepoTools
-  --install` names this repository's and says whether it is there; `tests/run.sh`
-  runs from it when it has `pytest`. A `venv/` or `.venv/` inside a worktree is
-  a legacy leftover for `--include-caches`.
-* **One evidence root per repository:**
-  `${XDG_STATE_HOME:-~/.local/state}/openRepoTools/evidence/<repo>/<UTC>-<slug>/`
-  for JUnit files, manifests, reports, canary and deployment evidence — never
-  inside a checkout and never beside the repositories. The report lists what is
-  still found inside the estate.
-* **The workspace repository never carries bytecode.** `openRepoTools wip init`
-  seeds `__pycache__/`, `*.pyc`, `*.pyo`, `.pytest_cache/`, `.mypy_cache/`,
-  `.ruff_cache/`, `node_modules/`, `.venv/`, `venv/` and `site-packages/` (a
-  virtual environment under any other name) into the new
-  workspace's `.gitignore` (a line the template already carries is not
-  repeated). Every commit `lanes-edit.sh` makes asks git what its pathspec would
-  stage (`git add --dry-run`) or holds staged already, and REFUSES, exit **2**,
-  nothing staged, when any of it is bytecode, a cache, a dependency tree or a virtual environment — and
-  offers the `.gitignore` lines a workspace without them lacks. A pathspec git
-  cannot read (a malformed magic pathspec, an unreadable index) is refused the
-  same way, never read as clean (#170 G13). Attachments are
-  committed by hand, so the same question is a subcommand:
-
-  ```sh
-  lanes-edit.sh pathspec-check handoffs/<repo>/attachments/<slug>
-  # 0 clean · 2 the offending paths on stdout, the offer on stderr, or the read failed · 64 usage
-  ```
-
-## Hand edits
-
-After **any** hand edit made with an allowed tool (python read/write, `sed -i
---follow-symlinks`, a `>>` append), run
-`LANES_LANE=<lane> ./lanes-edit.sh commit "<message>"` **immediately** — don't
-leave it sitting uncommitted while you do something else. Prefer
-`set-row-state` / `replace-in-row` / `append-line` over a hand edit in the
-first place: they commit in the same call, so there is no window where the
-edit sits uncommitted at all.
-
-An uncommitted hand edit left in the worktree is captured by the *next* lane's
-helper run, not by yours — and that capture now comes with a warning and, by
-default, a **separate** `LANES(pre-existing@<workstation>): …` commit (see
-above), rather than silently landing inside that other lane's own commit with
-no trace of whose it was (which is what happened in 0d84d34 and a1f2438:
-content intact, authorship lost). The separation only helps if you commit
-promptly — a hand edit is never truly "yours" in the history until it is
-committed under your own lane's message. `lanes-edit.sh commit` itself cannot
-split a hand edit that mixes your row with someone else's: it warns and
-annotates its subject the same way when the dirty diff it is about to wrap
-touches a row other than the one named by `$LANES_LANE`.
-
-## What is forbidden
-
-- **A whole-file write from memory.** This is the 2026-09-08 incident. If you
-  find yourself about to write out all ~110 lines, stop: the rows you did not
-  read are the rows you are about to delete.
-- **`git add -A`, a bare `git commit`, `git stash`, `force-push`** — estate
-  rules, and this checkout is shared with `handoffs/` and `workspaces/` and
-  with every other lane on this workstation.
-- **Committing `LANES.md` to a governed or product repository.** It lives on
-  `main` of the workspace repository and nowhere else — never in an
-  aggregation, a member, or any repo that is released, pinned or swept.
-  (Before Amendment 5 this line read "it stays on `lanes`"; the branch that
-  named is retired.)
-
-## Snapshots
-
-`LANES.md.snap-*` / `LANES.md.bak-*` at the aggregation root are the pre-git
-backup habit. They are no longer required — git history is the backup — and
-they are gitignored on `main`, so leaving them is harmless. The last pre-git
-snapshot is kept deliberately:
-`~/projects/xFactory/LANES.md.snap-20260909T002735Z-pre-git`.
-
-## Adopting this on another workstation (Raven)
-
-**Two commands, and the second one is the same one that creates a workspace
-repository from nothing** (Amendment 9(c)). `wip init` is idempotent, so on a
-machine whose repository already exists it clones it, adds nothing to a seeded
-repository, writes the pointer file and runs `link-estates`:
-
-```sh
-openRepoTools --install     # the commands, the three skills, the three command files and the hook entry
-openRepoTools wip init      # create or adopt the workspace, and link it
-```
-
-If the host was set up from `opensoft/workBenches`, `./setup.sh` has already
-run both and there is nothing to type at all — **and that is the whole of
-Amendment 11's decision 8(b) as `R-A11-13` corrected it: there is NO second
-installer.** `setup.sh` already runs `openRepoTools --install`, so `lane`,
-`lanes` and the `/restart` skill ride the step that is there rather than a new
-one. What Evidence 5 actually measured was narrower and is worth saying: after a
-machine rebuild the launcher was present and `lane-start` and `lane-end` were
-**not on `PATH` at all**, so the launcher's documented degradation ran a bare
-`claude --resume <uuid>` — no stamps, a derived session name, a window left
-`claude`, three stampless restarts in one day. The gap was never that nothing
-runs `--install`; it was that the installed `openRepoTools` predated the move
-and placed no lane helper.
-
-**And the launcher exports this workstation's name.** `$LANES_WORKSTATION` is
-written once per host and exported into every session and container the launcher
-starts (`R-A11-14`). Outside a container `hostname -s` still answers; **inside
-one with no value every writer here refuses**, because a container's hostname is
-the container's id and this log is never rewritten.
-
-The warning from Amendment 3's "Raven setup (operator, Brett)" block still
-stands and the linker does not do it for you: **diff Raven's local `LANES.md`
-against this one and append its missing rows with `lanes-edit.sh add-row`
-BEFORE the local file becomes the symlink.** Raven's file may hold rows this
-register has never seen. `link-estates` never deletes a real file — it moves
-one aside as `<path>.pre-link-estates-<UTC>` — so the content survives either
-way, but a row nobody re-appends is a row nobody reads.
-
-### Coming from the pre-move world
-
-A workstation that ran lanes before Amendment 9 carries
-`~/.local/bin/lane-start` and `~/.local/bin/lane-end` as **symlinks** into its
-workspace checkout, placed by the old `link-estates`. Remove them before the
-first `--install`, in this order:
-
-```sh
-rm -f ~/.local/bin/lane-start ~/.local/bin/lane-end   # while they are still symlinks
-openRepoTools --install                               # places them as regular files
-link-estates                                          # repoints ~/projects/xFactory/lanes-edit.sh
-```
-
-**You are not asked to remember it: `--install` refuses** (A9 Addendum 4,
-R-A9-12). In its planning phase, before any of its artifacts is placed, it walks
-every target in the bin directory and dies naming every one that is not a regular file,
-what it is, and the one `rm` that clears them. `cp` FOLLOWS A SYMLINK, so an
-install over these would leave the two commands UNINSTALLED — the targets stay
-links — and would write the post-move bytes into `opensoft/brett-wip`'s working
-tree, which is the repository every lane writes: `lanes-edit.sh`'s
-`refuse_dirty_checkout` then refuses `log`, `claim` and `release` on that
-workstation until somebody runs `git checkout -- lanes/`.
-
-It is not tidiness. workBenches' `setup-estate-commands.sh` refuses the WHOLE
-estate install when any target "already exists as a symlink", and `setup.sh`
-swallows that exit into one `⚠` line — so a host that skips this looks set up
-and has no estate commands on it. The installed `link-estates` reports either
-stale symlink it finds, with the command that replaces it.
-
-**The helpers no longer resolve the register from their own real path.** They
-read `~/.agents/workspace.yaml`, which is what makes an installed command in
-`~/.local/bin` able to find a register that is nowhere near it.
-
-Also drop the retired worktree if this workstation still has one:
-`git -C ~/projects/xFactory worktree remove .lanes` (Eagle did this on
-2026-09-10).
-
-## Reading the history from before either move
-
-**There have been two moves and they used different mechanisms**, so the two
-halves of the history are read differently. The REGISTER moved in 2026-09-10
-under Amendment 5, by `git subtree`, from the orphan `lanes` branch of
-`opensoft/xFactory` into the workspace repository. The CODE — these four
-commands, their suite and this manual — moved in 2026-09-13 under Amendment
-9(f)(2), by ONE `git filter-repo` run with a written path map and an
-`--allow-unrelated-histories` merge, from the workspace repository into
-`opensoft/openRepoTools`. `git subtree split` was rejected for that second
-move because it carves one prefix and renames nothing, while the move was two
-source prefixes landing on three destinations with a rename on every path.
-
-**The code half**, in a checkout of `opensoft/openRepoTools`, where
-`--follow` crosses the rename and the unrelated-histories merge:
-
-```sh
-git log --follow --oneline -- lanes-edit.sh      # reaches lanes/lanes-edit.sh
-git log --follow --oneline -- lane-start         # and so for lane-end,
-                                                 # link-estates, repos.tsv,
-                                                 # tests/test_lane_helpers.sh
-                                                 # and this file
-```
-
-The rollback for that move is the annotated tag **`pre-amendment-9-move`** on
-`opensoft/brett-wip`, placed at the commit that still carried all seven paths,
-immediately before the strip. Checking it out and running its
-`scripts/link-estates` puts a workstation back on the pre-move world with its
-data untouched, because no data moved.
-
-**The register half**, which is untouched by the 2026-09-13 move — no data
-moved. `git subtree add` imports commits unchanged, so the 1242 register
-commits made between 2026-09-09 and the Amendment 5 move carry their pre-move
-path (`LANES.md`, at the root of the orphan branch), and git's default history
-simplification stops at the subtree merge. Its own two halves are one command
-each, in the workspace checkout:
-
-```sh
-git log --oneline -- lanes/LANES.md              # since the move
-git log --oneline pre-move/lanes -- LANES.md     # the 1242 up to the import
-git log --oneline --full-history -- LANES.md     # 1256: those, plus the 12 the
-                                                 # orphan branch took while the
-                                                 # move was in flight, which came
-                                                 # in on a later sync and are not
-                                                 # under the tag
-git show <sha>:LANES.md                          # a lost row, pre-move
-git show <sha>:lanes/LANES.md                    # a lost row, since
-```
-
-`pre-move/lanes` is an annotated tag on the last commit the orphan branch ever
-took. The same shape applies to `pre-move/handoffs` and
-`pre-move/workspaces`.
-
-The legacy supervisor uses the current profile launcher's existing-TMUX path,
-which keeps the exact operation as a child and forwards its operation/attempt
-tokens. The historical #94 incident above describes the earlier launcher. A
-respawn also forwards configured `LANES_LANE_STATE_ROOT` and
-`AGENT_PROTOCOL_ROOT` with shell quoting so its durable intent remains readable.
-
-Legacy lane rename is an explicit publication exception: it already holds the
-writer mutex and now refuses unfinished/failed restart ownership before moving
-inputs. Its existing four-file transaction uses EXIT rollback, including stamp
-write failures; it is not crash atomic across those files. This change does not
-claim stronger crash durability for ordinary rename. Restart preservation and
-resume-stamp publishers use the atomic checksum-fenced publication helper.
-
-Reconciliation with PR #97 keeps completed restart history under its original
-lane name when a lane is renamed. Only the diagnostic lifecycle snapshot and
-worktree inventory move to the new control root. The new canonical lane has no
-inherited restart operation; unfinished or unreadable intents still refuse rename.
diff --git a/docs/release-notes/v1.0.0.md b/docs/release-notes/v1.0.0.md
deleted file mode 100644
index b8ca5002..00000000
--- a/docs/release-notes/v1.0.0.md
+++ /dev/null
@@ -1,15 +0,0 @@
-# openRepoTools v1.0.0
-
-This tag marks the baseline for versioned releases: openRepoTools as it stands on `main` at `aaa7bc8`, on 2026-10-17.
-
-openRepoTools holds three things:
-- **The estate commands.** `park <Name>`, `resume <Name>` and `status <Name>` work on the estates that [openRepoShape](https://github.com/opensoft/openRepoShape) scaffolds.
-- **The lane tooling.** `lanes-edit.sh`, `lane-start`, `lane-end`, `link-estates` and their helpers record the work, under the lane collision protocol. `docs/README-lanes.md` is their manual.
-- **The installer.** `openRepoTools --install` places the tools, and `openRepoTools wip init` creates the workspace they read.
-
-This release pins openRepoShape at `7f84ca4`, the commit its tests were verified against.
-
-**Not on PyPI.** The first PyPI release will be **v1.1.0**. It will be published from the code leg after the triad migration (#186), through a tag-gated release workflow with TestPyPI first, modelled on openRepoShape's. Until then, `openRepoTools --version` still prints the repository and ref it was installed from.
-
-Tagged on Brett Heap's word (2026-10-17, "Yes, on main aaa7bc8").
-
diff --git a/docs/release-notes/v1.1.0.md b/docs/release-notes/v1.1.0.md
deleted file mode 100644
index 1d41db3f..00000000
--- a/docs/release-notes/v1.1.0.md
+++ /dev/null
@@ -1,145 +0,0 @@
-# openRepoTools v1.1.0
-
-<!-- FIRST DRAFT, lane openRepoTools-3, 2026-10-18, for opensoft/openRepoTools#228 (feature 006-release-pypi, T023). Each value not yet known is a named placeholder in angle brackets, set in code font, and each is listed under "Before the tag". Every one is filled in, or its paragraph is cut, before the tag. Paragraphs are one line each, as in v1.0.0.md, because a GitHub Release keeps a single line break as a break. -->
-
-v1.1.0 puts openRepoTools on PyPI. It is openRepoTools as it stands at `<release-commit>` in `opensoft/openRepoTools-code`, tagged on `<release-date>`. `pipx install openrepotools` is a second way in, beside the one-line install and a checkout's `--install`, and `openRepoTools --version` from the package names the release it runs. `<pr-count>` pull requests landed on `main` between v1.0.0's commit, `aaa7bc8`, and this release's.
-
-v1.0.0 is not on PyPI, and 1.1.0 is the first version there. This release is published from `opensoft/openRepoTools-code`, after the triad migration (opensoft/openRepoTools#186), and its tag is made there. v1.0.0 stays in `opensoft/openRepoTools`, where it was made, and no tag is carried from one repository to the other.
-
-## What 1.1.0 adds
-
-- **openRepoTools on PyPI, as `openrepotools`** (opensoft/openRepoTools#228). `<pypi-url>` is its page. Two commands install it:
-
-  ```sh
-  pipx install openrepotools
-  openRepoTools --install
-  ```
-
-  The package places one command, `openRepoTools`. It runs the packaged `openRepoTools` with the first `bash` on your `PATH` and your arguments unchanged, and with no `bash` it refuses and names it. It needs Python 3.9 or newer and declares no Python dependencies. The toolset's own requirements are unchanged: `bash`, `git`, and `jq` for `--install`.
-
-  The wheel carries everything `--install` places, the sixteen commands and `repos.tsv`, the three skills and the three command files, and the openRepoShape pin, each byte for byte as the release commit holds it. So `openRepoTools --install` run from the package reaches no network. pipx owns `openRepoTools` in its bin directory, `~/.local/bin` by default, as a link into its own environment, and `--install` leaves that one link alone: it places the other sixteen, says `1 left to pipx`, and writes 28 receipt rows where a full install writes 29.
-
-  The version is the tag's, and no file in the repository carries a version number: the release build stamps it into the wheel.
-- **`--version` names the release** (opensoft/openRepoTools#228). From the package it prints five lines:
-
-  ```text
-  openRepoTools 1.1.0 (opensoft/openRepoTools-code @ <release-commit>)
-    version   1.1.0
-    tag       v1.1.0
-    commit    <release-commit>
-    digest    <release-digest> (sorted-ls-tree-r-v1)
-  ```
-
-  A package built outside a release prints `openRepoTools 0.0.0 (an unstamped package)` and says so. A checkout and the one-line install print what they printed in v1.0.0, a repository and ref (`main` by default) and no version number. A package whose stamp is broken refuses every invocation, `--help` included, and names the fix, `pipx reinstall openrepotools`.
-- **`--install` meets each other installer by a rule** (opensoft/openRepoTools#228):
-  - pipx's link is skipped, by whichever `--install` meets it: the package's, a checkout's or the one-line install's. A checkout's or the one-line install's count line then says where the other sixteen now come from.
-  - pip's console script at the target `openRepoTools`, which `pip install --user openrepotools` leaves, is refused in every mode before anything is placed, and the refusal names pipx as the one package route.
-  - Any other link at a target still refuses the whole install, and no refusal advises removing pipx's link.
-  - After a package-mode install, a note names the first `openRepoTools` on your `PATH` when it is not the package's, so a stale bash file ahead of pipx's link is not mistaken for the release.
-- **The hook pair waits for its target** (opensoft/openRepoTools#237, opensoft/openRepoTools#247). `openRepoTools --install` and `openRepoTools wip init` add the pair of hook entries, `SessionStart` and the name guard (`guard`), to `~/.claude/settings.json` only once `~/projects/xFactory/lanes-edit.sh` exists, is executable and answers `guard`. Until then they say why, and how to complete it, and our exact guard entry is taken back out of a file that already carries it; our `SessionStart` entry, which ends in `|| true`, and every hook of yours stay. So a workstation upgrading from v1.0.0 whose `~/projects/xFactory/lanes-edit.sh` does not answer `guard` loses that one entry on its next `--install`, until `openRepoTools wip init`, or `link-estates` and `--install` again, completes the pair. Before this, a fresh workstation got both entries before workspace initialization had provided that file, so the name guard could fail with a command-not-found error at every prompt.
-- **CI proves the package, and a release workflow publishes it** (opensoft/openRepoTools#228).
-  - `tests.yml` runs on every push to `main` and to every `release/v*` branch, as well as on pull requests, nightly and by dispatch, and every run has four jobs: `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`. The `package` job builds the wheel twice at the commit's time and requires the two to be one file, checks every packaged payload file against the commit's blob in bytes and in mode, checks the wheel's `.dist-info`, installs the wheel with pipx, runs the unstamped `--version` and an offline `--install` beside pipx's link, and runs the package's tests, failing if one is skipped.
-  - `release.yml` is run by hand, on an annotated tag, with the version. It is adapted from openRepoShape v1.1.0's. Its build refuses unless the ref is the version's annotated tag and the tag names the run's commit; that commit is on `main` or on `release/vX.Y`; the `testpypi` and `pypi` environments each name a required reviewer and limit deployments to `v*` tags; the commit's four CI jobs ran in a push or dispatch run of `tests.yml` and the newest succeeded; and the tree digest computed here equals the one computed from GitHub's tree listing. It then builds twice from `git archive`, stamps the build, and requires one file.
-  - It uploads by trusted publishing, with no token: to TestPyPI, then an install check on Ubuntu, on macOS (run again under macOS's own bash 3.2) and on Ubuntu with Python 3.9, then to PyPI. Each upload waits for Brett Heap's approval in its environment. A pre-release `X.Y.ZrcN` reaches TestPyPI only. Only `opensoft/openRepoTools-code` may publish a final version, and nothing uploads to PyPI from `opensoft/openRepoTools`.
-- **Releases are annotated tags** (opensoft/openRepoTools#228). A release is an annotated tag `vX.Y.Z` on a commit on `main` or on `release/vX.Y`, never a branch and never a version number committed to a file, and a tag is never moved or reused. `release/vX.Y` is cut at `vX.Y.0` and carries the patch tags. A fix lands on `main` first, then reaches the release branch by a fast-forward, a merge, or a pull request of `git cherry-pick -x`. A version is uploaded once, and a bad upload is fixed by the next patch.
-- **The lane tools name what they could not read in a triad's legs** (opensoft/openRepoTools#255, opensoft/openRepoTools#271). It closes two gaps in opensoft/openRepoTools#246, which taught the lane tools to look inside a triad's legs; each broke that change's rule that a read that failed is never an empty one. `lane-handoff` names every tree-inventory record that is not a whole schema-1 one in its NOT POLLED note, and the lane stays SWAPPING. A leg directory this account cannot search is unreadable and never `absent`: `lane-worktrees sweep` exits 3, `lane-end` refuses over it, `lane-reconcile` gives it an `unreadable` row, and `lane-handoff` withholds its tree. A dependency nested in a leg whose directory, or one above it, this account cannot search is unreadable to the sweep too: it exits 3, and `lane-end` refuses over it. A leg directory that is not there at all is still `absent`. One known gap remains (opensoft/openRepoTools#272): the sweep also reads a declared leg beneath a directory this account cannot search as `absent`, so `lane-end` does not hold on it. These readers run only in an assembly, a checkout whose `project.yaml` declares a leg, so a checkout with no `project.yaml` sees no change.
-- **`lane-handoff` reads the lane's lifecycle whole** (opensoft/openRepoTools#280, opensoft/openRepoTools#283). It used to pipe `lanes-edit.sh lane-state` into an `awk` that exits as soon as it has printed the one field it wants. Under `pipefail`, a `lane-state` that wrote again after that died of SIGPIPE, so now and then the read exited 141, the handoff said the lifecycle could not be read, and it recorded no RUNNING to SWAPPING to SWAPPED transition. That failed safe, but whether it happened depended on timing alone, and it could turn a pull request's `tests` job red at random. The handoff now takes `lane-state`'s whole output first and parses it afterwards, so its status is `lane-state`'s own. The read of the operation of a lane that is still SWAPPING, which only names that operation in a note, is made the same way.
-
-## What else changed since v1.0.0
-
-- **The openRepoShape pin moved.** This release pins openRepoShape at v1.1.0, `190133d` on its `main`, the commit its tests were verified against (opensoft/openRepoTools#233). v1.0.0 pinned `7f84ca4`.
-- **The estate commands** (`park`, `resume` and `status`):
-  - `resume` and `status` hold each leg to the branch bootstrap puts it on: the leg row's own `branch:`, else the root's `tracking_branch` (opensoft/openRepoTools#238).
-  - `park`, `resume` and `status` find a family folder named for its repository or for its display name, and `resume` names the holder's repository from `family.yaml` where it is on disk (opensoft/openRepoTools#240).
-  - `park`'s not-carried report counts a leg's unpushed commits on the branch its own row declares, else the root's `tracking_branch` (opensoft/openRepoTools#249).
-  - `family.yaml` values are read the way openRepoShape v1.1.0 reads them, `status` names one family laid out twice, and `resume` finds a holder by its id when its record names another folder (opensoft/openRepoTools#251).
-- **The register and `lanes-edit.sh`:**
-  - `swapped` names a lane by the register row's spelling, not the log file's (opensoft/openRepoTools#201).
-  - `superseded_by` follows a chain of TAKEOVERs to its last link, so one lane holds the object (opensoft/openRepoTools#204).
-  - The lane listing reads a row's state phrase when its log is missing, so a migrated PAUSED row stops showing NO LOG (opensoft/openRepoTools#206).
-  - `managed-projection` reads this checkout's row as the writers do, `lane-trees` tells an unlistable trees directory from no inventory, and the manual's seven-column row is qualified (opensoft/openRepoTools#213).
-  - `lanes-edit.sh commit` with nothing staged still publishes the local commits that origin lacks, when each of them only adds or changes a register or handoff file, so the recovery's re-run of `commit` pushes the edit it stranded, and the conflict recovery warns that `reset --hard` drops a peer's commits (opensoft/openRepoTools#214).
-  - A one-line record cannot take a newline: `append-line` and `lane-handoff`'s why refuse it before writing, and the deferred `lane-start` command keeps `--agent` (opensoft/openRepoTools#218).
-  - `lanes-index` follow-ups: `export` reads one snapshot, `history --index` says its closing stderr count, a foreign source is refused before the lock, a damaged table reads as unusable, an unread lane stays NOT READ in the index, and the worktrees footer names the workstation (opensoft/openRepoTools#219).
-  - A register that could not be read no longer reads as a lane with no session ids, so the dead-lane `--force` check and `duplicate-holder` fail closed (opensoft/openRepoTools#221).
-  - Register sweeps and reads refuse what they could not read: `retire-rows`, `archive-rows`, `migrate-state-cells`, the DORMANT class, `next-free` and `add-row` (opensoft/openRepoTools#230).
-  - Lifecycle reads that failed are no longer answers, `set-lane-tree`'s fence closes with its operation, and a lane sidecar is valid only when whole (opensoft/openRepoTools#252).
-  - The register's rewrites refuse a copy or write they cannot prove and put a cut-short register back, `retire-rows` refuses an unpushed log rename before it writes and calls a lane closed only from its published log, and `add-row` refuses an archive row it cannot read and takes back a row refused after its rebase (opensoft/openRepoTools#263).
-  - A lane listing that is not whole no longer removes indexed worktree rows: the inventory read says PARTIAL, `lanes --worktrees` prints it NOT WHOLE, and `lanes-index` writes nothing over it; an older helper's tree with no path stays a tree (opensoft/openRepoTools#289).
-- **`lane`, `lane-start`, `lane-end`, the name guard and their helpers:**
-  - `lane-end`'s synopsis says what a DUPLICATE retire does, a state cell that breaks the phrase's grammar is read whole instead of narrowed, and the TAKEOVER grammar table and two `tests.yml` header comments are corrected (opensoft/openRepoTools#202).
-  - `lane-start`'s transcript follow counts a holder only when `transcript-holders` verifies it, not on `kill -0` (opensoft/openRepoTools#203).
-  - `duplicate-holder` and `lane-end --retire` read a `--resume` path whole and act on every verified child, not the first (opensoft/openRepoTools#205).
-  - The name guard and the SessionStart hook name an unreadable register or binding log instead of guessing a branch (opensoft/openRepoTools#208).
-  - `lanes` filters `lanes-edit.sh`'s no-fetch notice out of its stderr with a `grep` that now takes its pattern as `-e`'s argument, so under macOS's BSD `grep` the `--` after the pattern ends the options and is no longer read as a file name, and every other line is printed as `lanes-edit.sh` wrote it, with no `grep: --: No such file or directory` error and no temporary file's name in front; the suite's `repoG#8` assertion can now fail, and it stops counting the bash files in prose (opensoft/openRepoTools#209).
-  - Three wrapper reads that failed no longer read as no answer: `lane`'s window-name check asks the unpushed local row too, `lanes`' hidden-row probe reads its whole stream, and `lane-end --retire-dormant` refuses without its stderr capture (opensoft/openRepoTools#210).
-  - `claude-current` falls back from a native Claude Code that does not run to the next one that does, and `claude-restart-check` recognises a running native in a custom `CLAUDE_CURRENT_NATIVE_DIR`, symlinked included (opensoft/openRepoTools#211).
-  - `lane-start` fails closed on three fences: a new lane's rename is read back and undone when another window took the name, a row or log that says RETIRED is not started again, and a new lane never takes a window named for another registered lane (opensoft/openRepoTools#216).
-  - `lane` and `lane-handoff` refuse empty and flag-shaped flag values, and `lane-handoff` renames the window only once the handoff can no longer be refused (opensoft/openRepoTools#220).
-  - A silent tmux is no longer read as a dead window, the companion verdict is read off the lane's live window from any window, and the guard's cure for a lane named before Rule 4 says what it cannot fill in (opensoft/openRepoTools#222).
-  - `lane-start` gains a guard-only binding mode that stamps the transcript being bound, so the offer's yes no longer records a RESUMED nobody is in (opensoft/openRepoTools#223).
-  - Under `set -e`, `lanes --worktrees`, `openRepoTools wip init` and `lane-end` no longer end on macOS's bash 3.2 where a utility run through `command` fails, and a scan of the shipped scripts keeps that shape out (opensoft/openRepoTools#294).
-- **The handoff and its skill:**
-  - The handoff skill commits the handoff in the checkout it was published in, by its own path, and refuses foreign staged entries and in-progress operations (opensoft/openRepoTools#199).
-  - Every shell block in the handoff skill parses, and the skill stops calling `/rename` the only act there is (opensoft/openRepoTools#200).
-  - The handoff skill resolves `lanes-edit.sh` on `PATH` first, its comments no longer promise write (c) without a workstation, and it refuses the object-log and register-line writes for a lane that has never had a session recorded (opensoft/openRepoTools#207).
-  - `rename-lane`'s Rule 3 handoff stamp is published through a same-directory temporary file and one atomic rename, so a writer killed mid-stamp leaves the handoff whole (opensoft/openRepoTools#212).
-  - The handoff skill's step-1 fence refuses Amendment 15(d)'s exit 2 instead of reading it as no answer, and its window ref is checked as a whole string (opensoft/openRepoTools#260).
-  - The handoff skill's two PAUSED writes carry the why it computed, sanitized as `lane-handoff` sanitizes it, and a why carrying a line break is refused before step 1 (opensoft/openRepoTools#264).
-- **The lane tools look inside a triad's legs and paired feature trees**, so the sweep, `lane-end`'s gate, `lane-handoff`, `lane-reconcile` and the daily report can see a lane's work there, and a checkout with no `project.yaml` is treated as before (opensoft/openRepoTools#246).
-- **The test suite and its checks:**
-  - Follow-ups to the test roots of opensoft/openRepoTools#190: a refused root's value is named, the pin's commit is checked, paired feature worktrees are found, redirected roots show under `-q`, the lane manual's sections run, and the installer-source test is restated (opensoft/openRepoTools#195).
-  - Clause (c)'s TAIL case is read on a checkout at a short fixed path, and `lane-start`'s row stamp is driven at three checkout lengths, so the case no longer answers by the length of the run root (opensoft/openRepoTools#215).
-  - The shell suite's wrapper stops the suite's process group on a timeout, an interrupt, TERM or hangup, the launcher precedence of `lane <name>` is pinned with launchers the suite names, and the pty driver's comment says what it counts (opensoft/openRepoTools#217).
-  - The hygiene check refuses host paths under the bench root, with an allowance for quoted `grep` patterns, and the consumer reads and the durable-intent sample no longer carry them (opensoft/openRepoTools#229).
-  - `tests/run.sh` refuses to start when it cannot record its lock's owner, and its cleanup removes only a lock that is still its own (opensoft/openRepoTools#232).
-  - The hygiene check's end-of-options rule splits a line only outside quotes, and the suite stops counting its bash files (opensoft/openRepoTools#239).
-  - The hygiene check reads every exit-3 die of `lanes-edit.sh` against its cause and both documented rows, so a die that claims nothing was pushed, or a fourth die no row documents, fails it (opensoft/openRepoTools#259).
-  - The shell suite times each of its sections and its exit-trap teardown, and prints both in its transcript and in CI's step summary (opensoft/openRepoTools#261).
-  - The shell suite's wrapper prints the suite's timing table and teardown line on a pass, where CI's log can read them (opensoft/openRepoTools#265).
-  - CI and the release workflow run on `ubuntu-24.04`, because `ubuntu-latest` is now Ubuntu 26.04, where setup-python has no Python 3.9 and the TERM-ignoring kill test fails: every Ubuntu runner in `tests.yml` and `release.yml` is pinned to it, the tests and the 006 contract lines that name the label follow, and `macos-latest` is unchanged (opensoft/openRepoTools#296).
-- **The triad migration's records:**
-  - The migration's evidence of 2026-10-08 and 2026-10-09 is recorded: test roots and CI patches, the installer entry point, restore and rollback, opensoft/openRepoTools#192's corrections, T018 and the Gate B status (opensoft/openRepoTools#196).
-  - T006's `assembly-0001` and T010's code-leg `tests.yml` patch are re-cut against the files that opensoft/openRepoTools#228's series leaves, T009's assembly-root length-caps patch is added, and lines 17 and 33 of the Gate B walk are marked PARTLY until they are reviewed, as part of opensoft/openRepoTools#186 (opensoft/openRepoTools#266).
-- **`<other-changes>`**: the changes that landed on `main` after `a42946e` and before the release commit and have no line above, by area, one line each with its pull request.
-
-## Install and upgrade
-
-- **From PyPI:** `pipx install openrepotools`, or `pipx install openrepotools==1.1.0` for this release, then `openRepoTools --install`. `pipx` itself comes from `sudo apt-get install -y pipx` on Debian and Ubuntu and `brew install pipx` on macOS; then run `pipx ensurepath` and open a new terminal. The package is tested against the layouts of pipx 1.11.1, 1.17.8 and 1.18.3. `openRepoTools --version` prints the five lines above.
-- **From the one-line install to pipx:** run
-
-  ```sh
-  pipx install --force openrepotools
-  openRepoTools --install
-  ```
-
-  `--force` is needed. The one-line install left a regular file at `~/.local/bin/openRepoTools`, and a plain `pipx install openrepotools` meets it: pipx only warns that the file exists and that it is not modifying it, places no link, and exits 0. The bash file stays at that path and keeps running, so `--version` still names a repository and ref and not a release, and its next `--install` finds no payload beside it and fetches `main`. `--force` puts pipx's link in the file's place. Then `openRepoTools --install` skips that link and replaces the other sixteen files with the package's. On a workstation with no `openRepoTools` yet, `pipx install openrepotools` is enough.
-- **Upgrade:** `pipx upgrade openrepotools`, then `openRepoTools --install` again. Until that second command, the placed files, skills, command files and hook entries stay the earlier release's, and the link is skipped again.
-- **Remove:** `pipx uninstall openrepotools` removes only the command and its environment. The placed files, the skills, the command files, the hook entries and the receipt stay, and a checkout's `--install` then places a regular `openRepoTools` at the freed path.
-- **One install route or the other, never both.** Until opensoft/workBenches#165 lets workBenches' `scripts/setup-estate-commands.sh` accept pipx's link, a workstation uses pipx's route or workBenches' `./setup.sh`. `./setup.sh` refuses a symlinked `openRepoTools` before it installs anything, and after installing it requires a regular file identical to its vendored copy, so on a workstation with pipx's link every `./setup.sh` refuses its estate step and names the link. This is Brett Heap's option (c), of 2026-10-18. State of opensoft/workBenches#165 at the tag: `<workBenches#165 state>`.
-- **The one-line install and a checkout** work as before, and their `--version` still prints a repository and ref, `main` by default, and no release.
-- **Windows** is reached through WSL2, as for every bash command here. The package has no native Windows command, and it is a wheel only, with no source distribution.
-
-Tagged on Brett Heap's word (`<tag-time>`, "`<tag-words>`").
-
-## Full list
-
-- The `v1.1.0` milestone: <https://github.com/opensoft/openRepoTools/milestone/1>
-
-## Before the tag
-
-Before the tag, fill in every placeholder below or cut its paragraph, then cut this section, the draft comment at the top and the last line of this file. The GitHub Release is created from this file only after PyPI serves 1.1.0 (FR-042), so these notes never name a version PyPI lacks. Cutting the release follows the RELEASING header of `.github/workflows/release.yml`.
-
-- [ ] **`<release-commit>`**: the 40-hex commit the tag `v1.1.0` names, in `opensoft/openRepoTools-code`, on `main` or on `release/v1.1`. It appears in the first paragraph and in the `--version` lines. The build refuses it unless its `tests.yml` runs have all finished and the newest is green.
-- [ ] **`<release-digest>`**: that commit's tree digest by `sorted-ls-tree-r-v1`, as the install check's `--version` prints it.
-- [ ] **`<release-date>`**: the UTC date of the tag.
-- [ ] **`<tag-time>` and `<tag-words>`**: the exact UTC second and Brett Heap's own words, as the tag message gives them.
-- [ ] **`<pypi-url>`**: PyPI's page for `openrepotools` 1.1.0, filled in once PyPI serves it. Neither pypi.org nor test.pypi.org held the project when this was read on 2026-10-18 (both answered 404), and the page is expected at `https://pypi.org/project/openrepotools/1.1.0/`.
-- [ ] **The hook pair, with no placeholder**: #237 landed as opensoft/openRepoTools#247 (`586dea2`, merged 2026-10-18T14:29:20Z), and #237 is in the `v1.1.0` milestone on Brett Heap's word. Re-read the hook-pair paragraph against `main` at the release commit: which entries wait, what the message says, and that our exact guard entry is taken back out of a file that carries it while the pair is deferred (at drafting, `openRepoTools:187` and `:3377-3392`; README says it too).
-- [ ] **`<pr-count>`**: the number of pull requests that landed on `main` in `opensoft/openRepoTools` between v1.0.0's commit, `aaa7bc8`, and the release commit, counted at the tag. At drafting it was 53, counted at `a42946e`: each of the 53 commits of `aaa7bc8..a42946e` is the squash of one pull request, and none is a merge.
-- [ ] **`<other-changes>`**: the closing line of the list under "What else changed since v1.0.0", for the changes that land after `a42946e`. The list above it was drafted on 2026-10-20 from the squash titles of `aaa7bc8..a42946e`, by area, one line each with its pull request. It carries 44 of the 53 pull requests in that range, the openRepoShape pin's (#233) at its head and 43 by area; the other 9 have their lines under "What 1.1.0 adds": the package series of #228 (#262, #267, #268, #269, #270 and #284), #237's hook pair (#247), #255's fix (#271) and #280's fix (#283). Lines for the changes after `a42946e` were added to it on 2026-10-21, each in its area: #263, #289, #294 and #296. They are not in those counts. At the tag, redo the list from `aaa7bc8` to the release commit, add a line for each pull request after `a42946e` that has none, check that every pull request in that range has a line in these notes, and cut this placeholder's line. The openRepoShape pin's line is already written.
-- [ ] **`<workBenches#165 state>`**: whether opensoft/workBenches#165 has landed, and whether workBenches has taken a version that accepts pipx's link. If it has, rewrite the "One install route or the other" paragraph to say so; if not, keep it as it stands.
-- [ ] **The pin, with no placeholder**: `contracts/openreposhape-pin.yaml` at the release commit still names `190133d`. If the pin moved, correct the pin line, and the commit it names must be on openRepoShape's `main`.
-- [ ] **The milestone**: re-read the `v1.1.0` milestone. It held two issues at drafting time, #228 and #237. By 2026-10-20 it held six entries: #228, still open; #237, closed by its merged pull request #247; #255, closed; and #280, closed by its merged pull request #283. Each closed entry has its line above under "What 1.1.0 adds" (#255's pull request is #271, which is not in the milestone). Each that lands before the tag gets its line above, and each that does not is moved out by Brett Heap.
-
-This draft is `opensoft/openRepoTools-spec`'s `docs/release-notes/v1.1.0.md`.
diff --git a/docs/triad-lane-tooling-analysis.md b/docs/triad-lane-tooling-analysis.md
deleted file mode 100644
index d8aa606f..00000000
--- a/docs/triad-lane-tooling-analysis.md
+++ /dev/null
@@ -1,712 +0,0 @@
-# The triad split, lane-tooling side: what moves, what breaks, what to change
-
-**Date:** 2026-10-07 (finished 2026-10-08 on base `c4864ac`) · **Lane:** openRepoTools-3 · **Branch:** `feat/triad-lane-tooling`,
-made from `origin/main` at `c4864ac` · **Slice:** (d), the lane-tooling side of the
-assembly/spec/code split of `opensoft/openRepoTools`.
-
-**Plan read:** branch `004-migrate-to-triad` at `ff6f6a7` (the head of PR #187), read with
-`git show` only: `specs/004-migrate-to-triad/{plan,tasks,spec,installer-design,research,data-model,quickstart,verification,adopter-rehearsal}.md`
-and `openspec/changes/migrate-to-triad/{adoption-plan.yaml,design.md}`. Brett Heap confirmed
-the leg names and their public visibility on 2026-10-07: `openRepoTools-spec` mounted at
-`spec/` and `openRepoTools-code` mounted at `code/`.
-
-Every `file:line` below is on main `c4864ac` unless it names another revision. Main moved
-to `837928a` while this was finished (#187 landed the plan, its `specs/004-migrate-to-triad/` and
-`openspec/changes/migrate-to-triad/` byte-identical to `ff6f6a7`; #188 the openRepoShape repin);
-that changed only `specs/`, `openspec/`, `contracts/openreposhape-pin.yaml` and the
-`upstream/openRepoShape` gitlink, so no line cited here from a tool or a test moved, and the
-branch stays on `c4864ac`. A claim
-marked **measured** was run on a throwaway fixture in this lane's scratch directory; one
-marked **derived** follows from the code or from git's documented behaviour and was not run.
-**2026-10-18:** paths on the bench where this was read are written `~/projects/…`, the
-bench's projects directory, as `tests/test_repo_hygiene.py` asks of a committed file since
-#229 item 22; the one quoted `grep` pattern in §4.15 keeps the spelling it searched for.
-This document decides nothing. Plan tasks are T006 (root collisions and leg guidance), T007
-(installer entry point), T009 (separate roots in fixtures and hygiene), T010 (CI and pin
-checks) and T018 (feature selection, park/resume and bindings).
-
----
-
-## 0. Summary
-
-1. **None of the shipped lane tools reads `docs/`, `openspec/` or `specs/` at run time.** The
-   adoption plan's cross-leg follow-ups for `lane-start`, `lanes-edit.sh`, `openRepoTools` and
-   `claude-current` (adoption-plan.yaml:325-328 and :334) are comments, usage text, a URL, or
-   the object-key grammar. Each tool finds its helpers **beside itself**: `$SCRIPT_DIR`,
-   `$selfdir` or `__file__`. All of those helpers move to `code/` together, so that lookup
-   works unchanged. The only code that really reads across legs is in the **tests**. Lane 1's
-   PR #190 (`feat/test-roots-for-the-triad` at `c139e88`) gives the suite those roots, so this
-   branch carries no test change of its own (§6). **2026-10-13:** that was true of this
-   branch's first commit only. It now carries T018's shape-gated changes to five tools,
-   with two test modules of its own (`tests/test_triad_lane_tooling.py`,
-   `tests/test_triad_lane_tooling_handoff.py`) and their two goldens; it still changes none
-   of the suite's roots. The §4.4 note of 2026-10-09 and the §6 notes say what it carries.
-2. **The installer is the most fragile surface.** The README one-liners and every
-   already-installed copy's own `openRepoTools --install` fetch files by **repository-root
-   path** from `opensoft/openRepoTools@main` (openRepoTools:70-71, :258-275, :1370-1394). Once
-   the root split lands, those paths sit under the `code` gitlink. The result: the
-   one-liners stop working, every installed copy's re-install **refuses** with nothing
-   placed, and `wip init` **silently** seeds from openRepoShape `main` instead of the pinned
-   commit (openRepoTools:2516). No patch made before cutover can avoid this without changing
-   today's behaviour. The T007 entry point has to land **in the root-split PR itself** (§4.10).
-3. **Lanes keep working only if their `dir` stays at the assembly root**, and three things
-   change around them. First, `#n` expands against the assembly. Second, an OpenSpec claim
-   keyed on `opensoft/openRepoTools` searches the wrong repository's pull requests. Third, a
-   code-leg worktree can't be seen by the lane's sweep, the `lane-end` gate or the
-   `lane-handoff` poll unless it was made with `lane-worktrees add --checkout <assembly>/code`.
-   The daily report never counts a submodule leg as a canonical checkout. And one live lane
-   outside this repository runs the **checkout copy** `~/projects/openRepoTools/lanes-edit.sh`,
-   which disappears from that path at the split (§4.4, §4.5, §4.15).
-4. **The code leg needs its own `.gitattributes` and `.gitignore`.** Git applies no
-   superproject attribute to a path inside a submodule (**measured**, §4.13). The plan puts both
-   files at the root only. Two hygiene caps are also full: `AGENTS.md` is at its cap
-   (316/316) and `README.md` is at its cap (486/486). So T006's "add the AGENTS-shape line"
-   and "merge shape/README.md" fail the hygiene suite unless those caps are raised with dated
-   entries.
-
----
-
-## 1. Scope and method
-
-**In scope:** the lane tools (`lane-start`, `lane-end`, `lane-worktrees`, `lanes-edit.sh`,
-`lanes-index`, `lane-handoff`, `lane-rename`, `lane`, `lanes`, `link-estates`, `repos.tsv`),
-`openRepoTools --install` and `wip init`, the hooks it merges, the documents that name
-checkout paths, the tests and CI that assume one root, and the register/handoff data in
-`opensoft/brett-wip` that names `~/projects/openRepoTools` (read, never written).
-
-**Out of scope:** the estate verbs `park`, `resume` and `status`. They find estates by
-`$PROJECTS_DIR` and run `make park`/`make resume`, and they already know three-leg roots
-(AGENTS.md rule 4). `claude-current` and `claude-restart-check` appear only where the
-installer places them.
-
-**How:** I read every named file (the installer and `wip init` parts of `openRepoTools`,
-`lane-start`, `link-estates`, `tests/conftest.py`, `tests/run.sh`, `.github/workflows/tests.yml`
-and AGENTS.md in full; the large tools by their path-bearing sections). I grepped every shipped
-file for self-location (`BASH_SOURCE`, `SCRIPT_DIR`, `selfdir`, `__file__`), cross-leg directory
-names, hook and settings writes, and `project.yaml` readers. I measured git's behaviour around
-submodules and worktrees on a fixture of three local bare repositories. I also read lane 1's
-Gate B receipt in `brett-wip/migration/openRepoTools/adopter-fix-20261007-iM20tv/`, whose
-standard table is 45 spec / 49 code / 6 root of 100 tracked paths at `c4864ac`. That matches
-`git ls-files | wc -l` = 100 here.
-
----
-
-## 2. What the plan documents say, checked
-
-| Claim (where) | Checked on `c4864ac` |
-| --- | --- |
-| No change to lane-start, lane-worktrees, lane-end, link-estates or repos.tsv beyond placing them in code (adoption-plan.yaml:163-230, 259-268) | True of the placement. Not enough for the bindings: see §4.4, §4.5, §4.15. `lane-worktrees` and `lanes-index` are absent from the committed plan (it predates them) and present in lane 1's regenerated rehearsal plan as code. |
-| lane-start and lanes-edit.sh name `docs/` (adoption-plan.yaml:326-327); lanes-edit.sh names `openspec/` (:334) | They are named, but never read: §3. |
-| lane-handoff names `openspec/` and the follow-ups omit it | lane-handoff:2439 is a comment citing `openspec/changes/add-supervised-context-restart/design.md`. It is not a read. |
-| lane-start reads estate `project.yaml` legs (lane-start:1271-1293); lanes-edit.sh too (lanes-edit.sh:5039-5121) | True. Both readers already handle an assembly like openRepoTools's: §4.2, §4.5. |
-| repos.tsv:52 has only `openRepoTools` | True. There are no `-spec`/`-code` rows. |
-| Paired layout `worktrees/<feature>/{spec,code}` (plan.md:207-208) has no code on main | True. No lane tool makes, polls or claims a tree there: §4.4. |
-| installer-design.md: resolve, select, delegate; one immutable code identity checked against `contracts/code-pin.yaml`; `fetch_from_repo` :258, `collect_commands` :962, `collect_skills` :1370, `wip_shape_ref` :2502, `wip_fetch_template_file` :2519; REPO/REF :70-71 | Every line number holds. `code-pin` has 0 hits in tracked files. |
-| installer-design.md:61-64 counts 15 names / 27 files / 29 artifacts | **Stale.** `INSTALLABLES` (openRepoTools:338) holds **17** names. With 3 skills and 3 command files at 2 paths each, that is **29 placed files + 2 hook entries = 31 artifacts**, which is the installer's own statement (openRepoTools:389-396). Placing by rename (#172, `3660224`) landed after the design. It changes the placement mechanics, not the sources. |
-
----
-
-## 3. The adoption plan's cross-leg follow-ups, line by line
-
-Lane 1's Gate B receipt (`logs/runB-cross-leg-grep.log`) lists file names only. Each hit
-falls into one of these kinds: **comment**, **usage** (text a command prints), **URL**,
-**key** (an object key, not a path), **fixture** (data a test builds), or **READ** (a file
-opened at run time).
-
-| Follow-up | Hit on `c4864ac` | Kind | Change needed |
-| --- | --- | --- | --- |
-| claude-current names `docs/` (:325) | claude-current:89 | comment | none |
-| | claude-current:123 | usage (`--help` prints `docs/README-claude-current.md`) | Text only: the path is repository-relative, so after the split it means `spec/docs/…` from the root or `../spec/docs/…` from `code/`. Changing it changes `--help`'s bytes, so this is a **proposal** for the T014 docs batch, not a patch. |
-| lane-start names `docs/` (:326) | lane-start:294, :617 | comment | none |
-| lanes-edit.sh names `docs/` (:327) | lanes-edit.sh:10387 | comment | none |
-| openRepoTools names `docs/` (:328) | openRepoTools:1218 (comment); :1342 (URL `code.claude.com/docs/en/hooks`) | comment, URL | none |
-| tests/run.sh names `docs/` (:329) | tests/run.sh:36 | comment | none |
-| test_install_skill_and_hook.py (:330) | :73, :1339 | URL | none |
-| test_lane_helpers.sh names `docs/` (:331) | :3738, :6228 `cat "$SRC_DIR/docs/README-lanes.md"` | **READ** | #190: `LANE_MANUAL`, skipped when the run has no spec root |
-| test_lane_start_claude_current.py (:332) | :15 | docstring | none |
-| "… and 1 more" (:333) = test_repo_hygiene.py | :1183, :1214-1217, :1233, :2390, :2624 | **READ** | #190: `doc()` → `ROOTS.path_for` |
-| lanes-edit.sh names `openspec/` (:334) | :280, :2770 (comments); :2814-2818, :2895-2897 (grammar `owner/repo:openspec/changes/<name>`); :12110 (comment) | key | No path change. The **repository half** of the key changes meaning: §4.5. |
-| test_lane_helpers.sh names `openspec/` (:335) | :1280, :2086, :3781 (object keys of a fake `opensoft/repoE`); :13343 (comment) | fixture, comment | none |
-| test_park_resume_commands.py names `specs/` (:336) | :350, a `feature_directory: worktrees/…/spec/specs/…` string in a three-leg record the test writes | fixture | none |
-| (not listed) lane-handoff names `openspec/` | lane-handoff:2439 | comment | none |
-
----
-
-## 4. Surface by surface
-
-### 4.1 How every tool finds its helpers (all tools)
-
-| Tool | Self-location (`c4864ac`) | Helpers found beside itself |
-| --- | --- | --- |
-| lane-start | :339-341 `SCRIPT_DIR` from `readlink -f` | lanes-edit.sh :600-604, claude-current :650, lanes :868, lane :917, lane-worktrees :4307 |
-| lane-end | :259-261 | lanes-edit.sh :520, lane-worktrees :532 |
-| lanes-edit.sh | :634-639 | lanes-index :2256, repos.tsv :2453, lane-start :9189 |
-| lane-handoff | :119-120 | lanes-edit.sh :399, lane-start :685 |
-| lane / lanes / lane-rename | lane:114-115 / lanes:102-103 / lane-rename:73-74 | lanes-edit.sh (lane:188, lanes:191, lane-rename:155), lane-start (lane:1166) |
-| lanes-index | :325 `dirname(realpath(__file__))` | lanes-edit.sh |
-| lane-worktrees | :441, :5278 | lanes-edit.sh, status |
-| openRepoTools | :72 `SELF`; :971, :1372, :2504, :2521 `selfdir` | the 17 installables, `skills/`, `commands/`, `contracts/openreposhape-pin.yaml`, `upstream/openRepoShape/templates/…` |
-
-**Under the triad:** every one of these helpers is code-leg content (adoption-plan.yaml:107-323),
-so `code/<tool>` finds `code/<helper>` exactly as `<tool>` finds `<helper>` today. Installed
-copies in `~/.local/bin` are unaffected. **No change; T006 confirms it.**
-
-### 4.2 `lane-start`
-
-| Line | What it does | Under the triad |
-| --- | --- | --- |
-| :608 | `PROJECTS_ROOT=${PROJECTS_ROOT:-$HOME/projects}` | unchanged |
-| :1116-1357 | The lane's directory, by six rungs: `--dir`, the swap record, the lane log's `dir`, `$PROJECTS_ROOT/<repo>`, the estate `project.yaml` legs (:1291-1318), then a checkout named for the home and proved by its origin (:1319-1328) | Lanes openRepoTools-1, -2 and -3 record `dir ~/projects/openRepoTools` (§4.15), so rungs 2 and 3 answer. If the assembly stays at that path (an in-place adoption of the live checkout), **nothing changes**. A lane homed at `opensoft/openRepoTools-code` (none exists) would be resolved by rung 5: the reader at :1301-1309 matches `repository:` against the home and resolves `path: code` against the manifest's directory. The shell suite already covers rung 5 on a declared `legs:` manifest (tests/test_lane_helpers.sh:5691-5704). IRRS, IRSS and MedxEHR carry the same block on this workstation today. |
-| :1118-1128 | "the harness keys a session to the directory it was started in" (Evidence 3) | **This is why a lane's `dir` should stay at the assembly root.** Re-homing a lane into `code/` changes the Claude project folder (`-workspace-projects-openRepoTools` → `-workspace-projects-openRepoTools-code`). That strands the lane's memory, and `--resume <uuid>` stops finding the transcript. **T018 proposal:** bindings keep `dir` = assembly root, and nothing is rebound. |
-| :1180-1199 | The home is written from the directory's `origin` | At the assembly root the origin is still `opensoft/openRepoTools`, so the home is unchanged. |
-| :4294-4340 | Starts the daily report (`lane-worktrees sweep --all --dry-run --report`) for `$PROJECTS_ROOT` | Inherits the report's blind spot: §4.4. |
-| hooks | lane-start writes **no** hook and no `settings.json` (`grep` finds only comments at :142, :1783) | none |
-
-**Patch:** none needed. **Proposal (T018):** the bindings decision above, plus a fixture test
-that runs rung 5 against an openRepoTools-shaped manifest (§7).
-
-### 4.3 `lane-end`
-
-The close-out gate (:195-211, :1908-2045) runs `lane-worktrees sweep <lane> --branches
---include-scratch --include-caches --dry-run --porcelain`. It then reads every tree with
-`git status --ignored` (:1927-1945) and every entry under `${dir%/*}/.lane-worktrees/<lane>`
-(:2024-2045). Its roots and its trees are lane-worktrees'. **Under the triad it is as blind as
-the sweep (§4.4).** A lane with unpushed work in a paired `worktrees/<feature>/code` tree, or
-in any code-leg tree it never recorded, passes the gate. **Patch:** none. **Proposal:** the
-lane-worktrees roots change in §4.4 closes this too.
-
-### 4.4 `lane-worktrees`: sweep inventory, `add`, and the daily report
-
-**Measured** on a fixture (assembly `A` with `code` and `spec` submodules, and a worktree
-of the code leg at `A/worktrees/001-x/code`):
-
-- `git -C A/code rev-parse --show-toplevel` → `A/code`, and `--show-superproject-working-tree` → `A`;
-- `A/code/.git` is a **file**, `gitdir: ../.git/modules/code`;
-- `git worktree add` inside the submodule succeeds (git 2.43);
-- `git -C A worktree list` lists **only `A`**. The code leg's tree appears only under
-  `git -C A/code worktree list`, whose main entry is spelled `A/.git/modules/code`;
-- `git -C A status` shows `?? worktrees/`. The shape's assembly `.gitignore` template
-  (`templates/assembly-root/.gitignore` at the pinned openRepoShape) does not ignore it.
-
-| Line | What it reads | Under the triad |
-| --- | --- | --- |
-| :2165-2173 `_roots` | `<dir>/.claude/worktrees` and `${dir%/*}/.lane-worktrees/<lane>` | Unchanged for `dir` = assembly. The paired `A/worktrees/<feature>/{spec,code}` is **in neither root**. |
-| :2175-2248 `_discover` | inventory sidecars + `git worktree list` of the lane's checkout and of every inventoried `checkout` | A code-leg tree is seen **only if** an inventory row names `checkout: <assembly>/code`. A tree made by `make resume`/Speckit in the paired layout is never seen. |
-| :2122-2163 `_lane_claims` | trailer claims under `.claude/worktrees` only | Paired trees are never claimed. |
-| :2709-2713, :2759-2763 | scratch and caches under `.lane-worktrees/<lane>` | unchanged |
-| :5381-5557 `add` | `git worktree add` of `--checkout` or the lane's `dir`, at `${dir%/*}/.lane-worktrees/<lane>/<slice>`, then `set-lane-tree … --checkout <checkout>` | Without `--checkout`, it makes a worktree of the **assembly**, with empty, uninitialised `code/` and `spec/` (a worktree does not initialise submodules). **With `--checkout <assembly>/code` it works today:** `:5448-5451` accepts it because `--show-toplevel` is the submodule root (measured above). |
-| :1091-1125 `estate_repos` | walks into a repository only through `worktrees`, `.worktrees`, `.claude`, or a child with `.git` | `A/worktrees/<feature>` has no `.git`, so `A/worktrees/<feature>/code` is never reached (derived). |
-| :4884-4907, :4887 `Report.build` | `clones = [r … if os.path.isdir(r/.git)]` → canonical checkouts → branches, root-main, aging | A leg's `.git` is a file, so **a submodule leg is never canonical**. The code leg's branches, which are where all lane-tooling work happens after the split, never reach the daily report. This is already true today for every leg of IRRS, IRSS, MedxEHR and openDox on this workstation. |
-| :4760-4770 `_under_container` | `worktrees`, `.worktrees`, `*-worktrees`, `.lane-worktrees/<lane>` | Recognises `A/worktrees`. Unaffected. |
-
-**Patch:** none. Every fix changes what the sweep or the report says **today** about the
-estate's existing triads, and the brief rules out behaviour changes. **Proposals (T018):**
-
-1. **Guidance, no code:** under the triad a lane makes a code tree with
-   `lane-worktrees add <lane> <slice> --checkout <assembly>/code`. That records the tree
-   with the code leg as its checkout, so every reader above sees it.
-2. `_roots` adds `<assembly>/worktrees` when `<dir>/project.yaml` names legs. Trees there are
-   claimed only by the HEAD `Lane:` trailer rule `_lane_claims` already applies to
-   `.claude/worktrees`, because that directory is per-feature, not per-lane. The same root
-   goes into `lanes-edit.sh:12699-12705` (`lane_worktree_roots`) and
-   `lane-handoff:1994-1996`, so the three readers cannot disagree.
-3. `Report.build` treats a checkout whose `.git` is a file pointing into
-   `<superproject>/.git/modules/<path>` as canonical when the superproject is canonical.
-   This changes today's report for IRRS and the other existing triads, so it needs a ruling.
-
-#### 2026-10-09: what this branch now implements of §4.4 (T018), and what moves for every shape
-
-**On the coordinator's brief for slice (d2)** (worktree visibility for triad legs,
-plan task T018), proposals 1–3 above are implemented as **shape-gated** changes,
-one commit each with its tests (`tests/test_triad_lane_tooling.py`): (a) the sweep and
-`lane-end`'s gate (proposal 2); (b) `lane-handoff`'s poll of the paired root, each
-tree recorded under its leg, and `lane-reconcile`'s leg registrations (proposal 2's
-other two readers — a second writer's, on `feat/triad-lane-tooling-handoff`, which
-this branch merges with its own tests); (c) the daily report (proposal 3); and (d)
-`lane-worktrees add` recording the leg it made a tree from, with proposal 1's
-guidance in `docs/README-lanes.md` and the usage text. The gate is
-the standard's own rule: the lane's checkout (or the checkout a tool polls) is an
-**assembly** when its own `project.yaml` declares a leg other than itself. One
-reader answers it for every tool, `lanes-edit.sh project-legs <checkout>`, whose
-seven deciding awk lines are `lane-start`'s rung-5 lines verbatim (a test holds
-them equal). A checkout with no `project.yaml` is asked nothing, so on a single
-repository every output, exit code, register line and inventory row is the one
-`c45a452`'s tools produce: the test stores that "before" as a golden file
-generated once from `c45a452`'s own tools (`tests/fixtures/t018/`), because CI
-checks out at depth 1, and compares every touched command's output on a single
-repository — one with a submodule that is no leg, and one with a `project.yaml`
-naming no leg but itself — against it.
-
-**Outputs that change regardless of shape (for lane 1's ruling).** Two kinds of
-text move on every checkout, single repository included, because they are usage
-text and not behaviour; the coordinator directed both kept and listed here:
-
-1. `lanes-edit.sh`'s refusal of an unknown subcommand (exit 2) now lists
-   `project-legs` among the subcommands it answers to, and its usage header (what
-   `lanes-edit.sh` with no argument prints) gains the `project-legs` line.
-   `tests/test_repo_hygiene.py` requires the refusal to list every arm.
-2. The `--help` text of the touched commands gains the triad guidance:
-   `lane-worktrees --help` (a "A TRIAD" paragraph), `lane-end --help` (four lines
-   in THE CLOSE-OUT GATE), and the commands later commits touch, each named in
-   that commit's message.
-
-No exit code, register line, inventory row, sweep row, gate verdict or report
-line moves for a checkout with no `project.yaml`.
-
-### 4.5 `lanes-edit.sh`
-
-| Line | What it does | Under the triad |
-| --- | --- | --- |
-| :2754-2765 `alias_lookup`; :2776-2847 `canon_object` | resolves a key's repository through repos.tsv. A spelled `owner/repo` is **always accepted** (:2834) | `opensoft/openRepoTools-code#n` works with no repos.tsv row. The bare `openRepoTools-code#n` is refused until the row exists (§4.9). |
-| :2791-2813 | `#n` expands against the lane's **home** | Home stays `opensoft/openRepoTools`, so `#n` always means the **assembly's** issue or PR. The code leg numbers its PRs from #1, so `#3` from an openRepoTools lane is the assembly's #3, never the code leg's. **T018 proposal:** code-leg and spec-leg objects are spelled in full. The lane-collision protocol text should say so. |
-| :2814-2818, :2895-2897 | `owner/repo:openspec/changes/<name>` keys | Rule 1's sibling reads run `gh pr list --repo <object_repo> --search <slug>` (:10249-10272). A change keyed on `opensoft/openRepoTools` therefore searches the **assembly's** PRs, while spec PRs land in `openRepoTools-spec`. **T018 proposal:** at cutover, each open claim on `opensoft/openRepoTools:openspec/changes/<x>` is released and re-claimed as `opensoft/openRepoTools-spec:openspec/changes/<x>`, through `lanes-edit.sh release`/`claim`. The log is append-only and is never rewritten. |
-| :5053-5105 `project_legs_file`, `same_project` | manifests at `$PROJECTS_ROOT/*/project.yaml` and `*/*/project.yaml` | `~/projects/openRepoTools/project.yaml` is depth 1, so a claim on `opensoft/openRepoTools-code#n` from a lane homed at the assembly is "legs of one project.yaml — not a crossing" (:5120-5122). This works with no change. |
-| :12555-12595 `tree_id_for`, `lane_tree_put` | sidecar per tree: absolute `path`, `checkout`, branch, head … | Formats are unchanged. Rows written before cutover stay **true**: they describe worktrees of the monorepo history, which is the assembly's own history (FR-001). |
-| :12699-12705 `lane_worktree_roots` | `<dir>/.claude/worktrees`, `${dir%/*}/.lane-worktrees/<lane>` | Same gap as §4.4, proposal 2. |
-| :16791-16829 `set-lane-tree` | takes an absolute path and an **unvalidated** `--checkout` | Records a code-leg tree today: `--checkout <assembly>/code`. |
-| :14973-15030 `session-start`, `guard` | the two hook verbs; the guard compares window, session name and register row, never the cwd | unchanged (§4.11) |
-| :594 `LANES_LANE_DIR` | leg detection from the lane's checkout | unchanged |
-
-**Patch:** none. A behaviour change in object keys or roots needs a ruling. **Proposals:** as
-in the table.
-
-### 4.6 `lanes-index`
-
-It reads the register through `lanes-edit.sh` beside itself (:325) and keeps its store and
-config under XDG (`:160-166`). It has no repository-relative path. **No change.**
-
-### 4.7 `lane-handoff`
-
-Helpers beside itself (:119-120, :399, :685). The writers poll covers
-`$dir/.claude/worktrees/*` and `$parent/.lane-worktrees/$lane/*` (:1892-1996), and has the
-same gap as §4.4. The only `openspec/` reference is a comment (:2439). **No change; one
-proposal (§4.4, item 2).**
-
-### 4.8 `lane`, `lanes`, `lane-rename`
-
-`lanes` with no arguments narrows to "the checkout around the cwd" by its
-`git rev-parse --show-toplevel` and that checkout's `origin` (lanes:394-420, lane:440-460).
-**Under the triad** a person standing in `code/` gets `--dir <assembly>/code --repo
-opensoft/openRepoTools-code --prefix openRepoTools-code`. No lane matches, and it offers
-`lane-start openRepoTools-code 1` (derived). From the assembly root it is unchanged.
-`lane-rename` has no path of its own. **Proposal (T018):** when `--show-superproject-working-tree`
-is non-empty and that superproject's `project.yaml` names the toplevel as a leg, narrow to the
-superproject's directory and origin. This changes today's output inside IRRS/IRSS legs, so it
-needs a ruling. Patch sketch:
-
-```bash
-here_root="$(git rev-parse --show-toplevel 2>/dev/null || :)"
-super="$(git rev-parse --show-superproject-working-tree 2>/dev/null || :)"
-if [ -n "$super" ] && [ -f "$super/project.yaml" ]; then here_root="$super"; fi
-```
-
-### 4.9 `link-estates` and `repos.tsv`
-
-`link-estates` finds the workspace through `workspace.yaml` and never from its own location
-(:89-295). It links `~/projects/<estate>/handoffs` → `<workspace>/handoffs/<estate>` for each
-estate directory that exists (:399-409), and `~/projects/xFactory/lanes-edit.sh` →
-`$OPENREPOTOOLS_BIN_DIR/lanes-edit.sh` (:421). **Under the triad:**
-`~/projects/openRepoTools/handoffs` is an untracked symlink in the live checkout today,
-and it stays one at the assembly root. The hook link points at the installed copy. **No
-change.**
-
-`repos.tsv`:52 maps `openRepoTools` only. Its own rule (repos.tsv:16-23) is that a row is
-added "when a new repo first appears in a LANDING line", resolved with `gh repo view`. Rows
-for repositories that do not exist yet would break that rule. **Proposal (cutover, after Gate
-C creates the legs):** two rows, `openRepoTools-code	opensoft/openRepoTools-code` and
-`openRepoTools-spec	opensoft/openRepoTools-spec`, in the code leg's `repos.tsv`.
-
-### 4.10 `openRepoTools --install`, `wip init` and the `installed.tsv` receipt
-
-**Where each artifact comes from today.** `SELF` is this file (openRepoTools:72). When it is a
-file, `selfdir` is its directory.
-
-| Artifact | Local source (when `SELF` is a file) | Remote source | Code |
-| --- | --- | --- | --- |
-| The 17 `INSTALLABLES` (openRepoTools, park, resume, status, lane, lanes, lane-handoff, lane-rename, lanes-edit.sh, lane-start, lane-end, link-estates, repos.tsv, claude-current, claude-restart-check, lanes-index, lane-worktrees) | `$selfdir/<name>` | `fetch_from_repo <name>`: `gh api repos/$REPO/contents/<name>?ref=$REF`, else `raw.githubusercontent.com/$REPO/$REF/<name>` | :338, :962-990, :258-275 |
-| 3 skills × 2 destinations | `$selfdir/skills/<n>/SKILL.md` | `fetch_from_repo skills/<n>/SKILL.md` | :1289-1290, :1370-1381 |
-| 3 command files × 2 destinations | `$selfdir/commands/<n>.md` | `fetch_from_repo commands/<n>.md` | :1302-1303, :1387-1394 |
-| `SessionStart` entry | constant `~/projects/xFactory/lanes-edit.sh session-start \|\| true` | none | :1320, :1324-1333 |
-| `UserPromptSubmit` guard | constant `~/projects/xFactory/lanes-edit.sh guard` | none | :1352, :1355-1363 |
-| `wip init` pin | `$selfdir/contracts/openreposhape-pin.yaml` | `fetch_from_repo contracts/openreposhape-pin.yaml`, **else the literal `main`** | :2502-2517 |
-| `wip init` templates | `$selfdir/upstream/openRepoShape/templates/workspace-root/…` | `gh api`/raw from `opensoft/openRepoShape` at the pin | :2519-2544 |
-
-**The receipt** (`installed.tsv`, rows written at openRepoTools:561-598) is
-`<name> <destination> <sha256> <UTC>`. It records **no source**, so a code-leg source changes
-none of its rows. Readers accept four **or more** fields (`receipt_rows_except` :641-645,
-`receipt_verdict` :808-819). A fifth column for the code identity, which T008 asks to be
-recorded ("record its actual code identity"), can be appended without breaking an older
-reader.
-
-**What happens in each context once the root split has landed** (derived; the GitHub
-behaviour for paths under a gitlink is to be measured in T008):
-
-| Context | Today | After the split, with no T007 |
-| --- | --- | --- |
-| a. `code/openRepoTools --install` in an assembly checkout | — | `selfdir` = `code/`, all 23 files local. **Works unchanged.** |
-| b. `./openRepoTools --install` at the assembly root | the monorepo file | No file of that name until T007. |
-| c. README one-liners (README.md:228, :236) | fetch root `openRepoTools`, which then fetches the rest by root path | The root path `openRepoTools` 404s until T007 exists. With a T007 entry point that only `exec`s the code installer, the code installer still fetches `park`, `skills/…` and the rest from `$REPO@$REF` = the **assembly**, where those paths are under `code` and 404. **The entry point must also hand the delegate one immutable code identity.** |
-| d. Installed copy `~/.local/bin/openRepoTools --install` | `selfdir` = `~/.local/bin`, so it copies the **17 already-installed files over themselves** (:976-980; an installed copy never updated its commands) and fetches skills and commands from `opensoft/openRepoTools@main` | `collect_skills` gets a 404 and returns 1. `install_commands` dies at :1125 with "could not fetch one of the 3 skills…", **exit 2, nothing placed**. A safe refusal, but on every workstation. |
-| e. Installed copy `openRepoTools wip init` | pin fetched from the monorepo | `contracts/openreposhape-pin.yaml` is not at the assembly root (the assembly has `contracts/{shape,spec,code}-pin.yaml`), so `wip_shape_ref` prints **`main`** (:2516). **Silent drift**: templates come from openRepoShape `main`, not from the pin. |
-| f. `--version` | `openRepoTools (opensoft/openRepoTools @ main)` | unchanged text, now naming the assembly |
-
-**Why no patch made now can save (d) and (e).** The population that would need the fix is
-every copy already installed. Those copies get new code only from an install that succeeds,
-and the only one that can succeed after cutover is (a) or the T007 one-liner. A
-pre-cutover change that probes `contracts/code-pin.yaml` first would add a network request to
-every remote install today. It would also have to tell a 404 from a transport failure
-(installer-design.md:31-33), which `fetch_from_repo` cannot do: it returns a bare status
-(:258-275). That is T007 proper.
-
-**T007 proposal, as a sketch** (bash 3.2; root file `openRepoTools`; it delegates and adds no
-install mechanics):
-
-```bash
-#!/usr/bin/env bash
-# openRepoTools (assembly root): resolve ONE code identity, then run the code leg's installer.
-set -euo pipefail
-REPO="${OPENREPOTOOLS_REPO:-opensoft/openRepoTools}"; REF="${OPENREPOTOOLS_REF:-main}"
-SELF="${BASH_SOURCE[0]:-$0}"
-die() { printf '\nREFUSED: %s\n' "$1" >&2; exit 2; }
-# 1. A local adopted checkout: the gitlink and contracts/code-pin.yaml must agree.
-if [ -f "$SELF" ]; then
-  here="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-  if [ -f "$here/project.yaml" ]; then
-    link="$(git -C "$here" ls-tree HEAD code | awk '$2 == "commit" { print $3 }')"
-    pin="$(sed -n 's/^commit:[[:space:]]*"\{0,1\}\([0-9a-f]\{40\}\)"\{0,1\}[[:space:]]*$/\1/p' "$here/contracts/code-pin.yaml")"
-    [ -n "$link" ] && [ "$link" = "$pin" ] || die "code gitlink ($link) and contracts/code-pin.yaml ($pin) disagree"
-    [ "$(git -C "$here/code" rev-parse HEAD 2>/dev/null)" = "$pin" ] || die "code/ is not checked out at the pin $pin: git submodule update --init code"
-    exec "$here/code/openRepoTools" "$@"
-  fi
-fi
-# 2. Remote: REF resolved ONCE; the pin read at that commit; the gitlink checked; the code
-#    installer run with the public variables naming the code identity, so every payload it
-#    fetches comes from that one commit (gh first, curl second, as fetch_from_repo does).
-commit="$(gh api "repos/$REPO/commits/$REF" --jq .sha)" || die "…"
-# … read contracts/code-pin.yaml at $commit (source_repository, commit), check the gitlink
-#   `gh api repos/$REPO/contents/code?ref=$commit --jq .sha` equals it, fetch
-#   openRepoTools from $code_repo at $code_commit into a temp file, then:
-OPENREPOTOOLS_REPO="$code_repo" OPENREPOTOOLS_REF="$code_commit" exec bash "$tmp" "$@"
-```
-
-The **code installer** then needs installer-design.md's code-side resolution for context (d),
-because an installed copy defaults `REPO` to the assembly again: before `collect_skills`, if
-`$REPO@$REF` carries `contracts/code-pin.yaml`, payloads come from the pinned code repository
-and commit. A pin that is present but malformed refuses. Only an authoritative 404 means a
-legacy monorepo. **Landing order:** the entry point has to be in the root-split PR's tree. If
-it lands later, the README one-liners are broken for everyone in between.
-
-### 4.11 Hooks
-
-Only `openRepoTools --install` writes hooks: two entries merged into
-`$CLAUDE_USER_DIR/settings.json` (`plan_hook_merge` :1760-1880, `place_skill_and_hook` :1976).
-Both commands name `~/projects/xFactory/lanes-edit.sh`, which `link-estates` points at the
-**installed** `lanes-edit.sh` (link-estates:421). `lane-start` and every other tool write no
-hook (grep: comments only). `lanes-edit.sh guard` (:15000-15030) compares window, session
-name and register row, never the cwd or the repository layout. **No change.**
-
-### 4.12 Documents that name checkout paths
-
-| Where | What | Under the triad | Task |
-| --- | --- | --- | --- |
-| README.md:157 | `docs/README-lanes.md`, `docs/README-claude-current.md` | From the root README these are `spec/docs/…` | T006 / T014 docs batch |
-| README.md:228, :236 | the one-liners for the root `openRepoTools` | stay byte-identical (`RAW_INSTALL_LINE`, test_repo_hygiene.py:105-107, is printed by openRepoShape's `--install`); they need T007 | T007 |
-| README.md:417-449, :467-468 | pin-bump procedure with `upstream/openRepoShape`, `contracts/openreposhape-pin.yaml` | From the root these are `code/upstream/…`, `code/contracts/…`, or the procedure moves to the code leg's guidance | T006 |
-| AGENTS.md:22, :44 | `docs/README-lanes.md`, `openspec/changes/skip-no-lane-guard/` | `spec/…` from the root | T006 |
-| AGENTS.md:200-224, :233, :247-250, :285, :291-292 | `upstream/openRepoShape`, `contracts/openreposhape-pin.yaml`, `git submodule update --init upstream/openRepoShape`, `tests/run.sh`, `.github/workflows/tests.yml`, `tests/test_lane_helpers*.{sh,py}` | All are code-leg paths: from the root, `cd code` first | T006 |
-| docs/README-lanes.md:573-594, :3979-3997 | `tests/run.sh` | code-leg path | T006 |
-| docs/README-lanes.md:1793 | example `STARTED` line, `dir ~/projects…` | an example; true as long as the assembly stays at its path | none |
-| docs/README-claude-current.md:172 | "looks for `claude-current` beside itself" | true in `code/` | none |
-| ideation/brainstorm/supervised-context-restart-durable-intent.md:31 | `directory: ~/projects/openRepoTools` (an example intent record) | spec-leg prose; stays true if the assembly keeps that path | none |
-
-**Hygiene caps that T006 will trip:** test_repo_hygiene.py:1735-1736 caps AGENTS.md at 316
-lines, and it **is** 316. test_repo_hygiene.py:2232-2233 caps README.md at 486, and it **is**
-486. The adoption follow-ups "add the line `Read AGENTS-shape.md first…` to the existing
-AGENTS.md" (adoption-plan.yaml:339) and "merge shape/README.md into README.md" (:341) each
-add lines. Each cap needs a dated entry in the same PR, following the convention the test's
-docstring keeps.
-
-### 4.13 Tests
-
-Lane 1's **PR #190** (`feat/test-roots-for-the-triad` at `c139e88`, based on `c4864ac`,
-T009/T010) is the suite's roots. It was read with `git diff c4864ac..c139e88 -- tests/` and
-was not run here. This table says, for each assumption, what #190 does about it.
-
-| Test | Assumption (`c4864ac`) | Under the triad | Change |
-| --- | --- | --- | --- |
-| tests/conftest.py:29 | `REPO = parents[1]`, one root | `REPO` is the code root, and stays so | #190: `ROOTS = resolve_roots(os.environ, SUITE_ROOT)`, `REPO = CODE_ROOT`, `ROOTS.path_for(rel)`. The roots come from `OPENREPOTOOLS_{CODE,ASSEMBLY,SPEC}_ROOT`, or are found through `discover_assembly` (`contracts/code-pin.yaml` + `project.yaml` + the gitlink). `OPENREPOTOOLS_COMPOSED=1` is the composed mode. |
-| tests/conftest.py:48-58 | `UPSTREAM = REPO/upstream/openRepoShape` | code leg, unchanged (FR-004) | #190: `UPSTREAM = DEPENDENCY_ROOT`. Standalone it skips as today; composed it fails. |
-| test_repo_hygiene.py: 23 reads of README.md, AGENTS.md, CLAUDE.md, docs/README-lanes.md (:849, :860, :887, :911, :918, :942, :954, :957, :988, :1010, :1012, :1038, :1048, :1183, :1217, :1221, :1233, :1246, :1735, :2232, :2390, :2624, :3074) | `REPO / …` | README, AGENTS and CLAUDE are assembly files; README-lanes is a spec file | #190: `doc()` and `code_first()` |
-| test_repo_hygiene.py:234, :2453, :2650, :2691 | `git ls-files` at REPO | The code leg's own index only | #190: `tracked_files()` over `ROOTS.tracked_roots()`. The composed run also scans the assembly and the spec leg. |
-| test_repo_hygiene.py:2681 | `REPO/.gitattributes` carries `* text=auto eol=lf` | **Fails in the code leg**, because the plan puts `.gitattributes` at the root only (adoption-plan.yaml:41-48). Git applies **no** superproject attribute inside a submodule: **measured**, `git -C A/code check-attr -a lane-start` prints nothing while `git -C A check-attr -a project.yaml` prints `text: auto`, `eol: lf`. The installer's `cmp -s` byte checks and test_openrepotools_command.py's byte comparisons depend on that rule. | #190 reads it from the code root **deliberately**, for the same reason. That makes the **T006** proposal mandatory: the code leg carries its own `.gitattributes` (`* text=auto eol=lf`) and `.gitignore` (`__pycache__/`, `*.py[cod]`, `.pytest_cache/`, as at the root today). Without the ignore file, a bare `python3 -m pytest` in `code/` leaves the submodule dirty in the assembly's status. |
-| test_openrepotools_command.py:1398 | README.md | assembly | #190: `ROOTS.path_for("README.md")` |
-| test_install_*.py, test_wip_init_command.py:42-43, test_upstream_pin.py:28, :102 | `openRepoTools`, `skills/`, `commands/`, `upstream/…`, `.gitmodules`, `contracts/…` at REPO | all code-leg paths | none needed; #190 also edits test_upstream_pin.py |
-| tests/test_lane_helpers.sh:50, :3738, :6228 | `SRC_DIR` = repo root; manual read from `$SRC_DIR/docs/README-lanes.md` | The read comes back **empty**. 13 `has` assertions then fail (:3739-3744, :6229-6239, :6580), and 3 `hasnt` assertions pass with nothing to check (:3745, :6241, :6579) | #190: `LANE_MANUAL="${OPENREPOTOOLS_LANE_MANUAL-$SRC_DIR/docs/README-lanes.md}"`. The two quoting blocks are skipped, by name, when it is set and empty. **Not covered:** the third read, inside the `--retire` block (:6579-6580 on `c4864ac`, :6595-6596 in #190), still reads `$ln_doc` after #190's `if`/`else`. With no spec root `ln_doc` is never assigned, and the suite runs under `set -u` (:42), so the whole shell suite **aborts** there with `ln_doc: unbound variable`. **Measured** on the same construct: `bash -c 'set -uo pipefail; has() { :; }; has d "$ln_doc" x; echo after'` prints that error, exits 127 and never reaches `after`. This happens only in a standalone code leg; today's layout is unaffected. |
-| tests/test_lane_helpers_suite.py:157-191 | runs the shell suite at REPO | needs the spec root handed to it | #190: `OPENREPOTOOLS_LANE_MANUAL` from `ROOTS.root_of("spec")` |
-| tests/run.sh:75-80, :235-236 | cds to the repo root; venv named `openRepoTools` | code root; the venv name is a constant | #190: makes relative `OPENREPOTOOLS_*_ROOT` absolute before the `cd` |
-
-**One gap in #190 that the lane tooling's layout raises** (read, not run):
-`discover_assembly` stops at the first directory above the code checkout that carries the
-assembly markers, and requires that directory to mount this checkout. A code worktree in
-plan.md's paired layout, `<assembly>/worktrees/<feature>/code`, is therefore a leg with no
-assembly. Its manual and front-door reads **skip** unless the roots are named, although the
-paired spec worktree sits beside it at `../spec`.
-
-### 4.14 CI (`.github/workflows/tests.yml`)
-
-Every job checks out **this repository at its root** (`actions/checkout`, :55, :83, :129,
-:184, :235, :291), with `submodules: true` (:57, :85, :186, :293) or `false` (:131, :237).
-In the code leg the same file runs the code leg's own tests, with the nested
-`upstream/openRepoShape` intact. With no spec or assembly context, #190's document reads
-skip in a standalone run. Composed (`OPENREPOTOOLS_COMPOSED=1`), the run is refused before its
-first test. #190 changes no workflow. The bash-3.2 list (:254-272) and `test_the_macos_job_parses_every_bash_file…`
-(test_repo_hygiene.py:166-194) are code-relative and unaffected.
-
-**T010 proposal, as a sketch:** each job that runs the full suite adds two read-only
-checkouts and names them:
-
-```yaml
-      - uses: actions/checkout@<pinned sha>
-        with: { path: code, submodules: true }
-      - uses: actions/checkout@<pinned sha>
-        with: { repository: opensoft/openRepoTools-spec, ref: <the matching spec commit>, path: spec }
-      - uses: actions/checkout@<pinned sha>
-        with: { repository: opensoft/openRepoTools, ref: main, path: assembly, submodules: false }
-      - run: bash tests/run.sh -k 'guard_launch_mode or repo_hygiene'
-        working-directory: code
-        env:
-          OPENREPOTOOLS_SPEC_ROOT: ${{ github.workspace }}/spec          # #190's names
-          OPENREPOTOOLS_ASSEMBLY_ROOT: ${{ github.workspace }}/assembly
-          OPENREPOTOOLS_COMPOSED: "1"
-```
-
-"Matching" is lane 1's decision: the spec commit the assembly's `contracts/spec-pin.yaml`
-names at assembly `main`, or the paired feature branch of the same name. `tests-no-submodule`
-(:127-149) keeps proving that a fork's first run skips rather than fails. The assembly's own
-`validate.yml` from the shape checks manifest and pins.
-
-**2026-10-09: the sketch above, as written, cannot pass #190's composed mode** (found by the
-review of #190, read here at `dbc6837`). It checks out the PR's code at `code/` and the
-assembly at its `main`, and names that assembly in `OPENREPOTOOLS_ASSEMBLY_ROOT` with
-`OPENREPOTOOLS_COMPOSED=1`. #190's composed contract refuses any code root the assembly does
-not pin: `Roots.absent()` (tests/conftest.py:283) runs `_leg_at_its_pin("code", …)` (:259),
-which compares the code root's HEAD with the gitlink the assembly records at its code mount
-and refuses a mismatch ("composed acceptance is for the pinned code leg and no other"), and
-`pytest_configure` (:404-412) raises that refusal as a `pytest.UsageError`, **exit 4**, before
-the first test. On a code PR the PR's commit is never the commit assembly `main` pins, so the
-job would exit 4 on every code PR. Without `OPENREPOTOOLS_ASSEMBLY_ROOT`, `discover_assembly`
-(tests/conftest.py:159-172) finds an assembly only above the code root that MOUNTS it at its
-gitlink, which a sibling `code/` checkout is not. A composed job therefore has to do one of
-three things:
-
-1. check out an assembly whose code gitlink already points at the PR's own commit (a paired
-   assembly branch that pins it);
-2. build a throwaway assembly for the run that pins the PR's commit (the assembly at `main`,
-   its `code` gitlink and `contracts/code-pin.yaml` moved to the PR's commit, the code leg
-   checked out as its submodule), and run composed from that; or
-3. run #190's **standalone** mode on code PRs (no `OPENREPOTOOLS_COMPOSED`), leaving composed
-   acceptance to the assembly's own pin-bump PRs.
-
-Which one is lane 1's decision under §7 item 7; the sketch above is item 2's starting point,
-not a job that can run as it stands.
-
-### 4.15 The register, logs, inventory and handoffs in `brett-wip` (read only)
-
-`grep -rcE '/workspace/projects/openRepoTools|~/projects/openRepoTools|\$HOME/projects/openRepoTools'`
-at brett-wip `c311a78`:
-
-| File | Hits | What they are | Carry-over proposal |
-| --- | ---: | --- | --- |
-| lanes/LANES.md | 0 | Rows carry home `opensoft/openRepoTools` | none: the assembly keeps the name |
-| lanes/log/openRepoTools-3.md / -1.md / -2.md | 32 / 11 / 11 | `dir ~/projects/openRepoTools` on STARTED/RESUMED/PAUSED lines (29 + 1, 11, 11 of them) | Append-only, never rewritten. They stay valid **if the assembly keeps this path**. If it moves, run one `lane-start --dir <new> openRepoTools <n>` per lane at its breakpoint; that writes the new `dir`. |
-| `~/projects/.lane-state/openRepoTools-{1,2,3}/trees/*.yaml` (beside, not in, brett-wip) | 18 / 8 / 14 sidecars | every row `checkout: ~/projects/openRepoTools`; 19 trees under `.claude/worktrees` | They stay true: they describe monorepo-history worktrees of the same repository. Translate each tree's delta through T016/T017 receipts, then retire it with `lane-worktrees sweep --yes`. The sweep's "landed" test compares against the assembly's default branch, where a monorepo branch's content never lands after the split, so expect **rescue to a bundle**, not "landed". |
-| handoffs/openRepoTools/session-handoff-2026-09-13-lane-openRepoTools-3.md, migration-handoff-2026-10-06.md, …-2026-10-02-…-2.md, …-2026-09-16-…-1.md | 56, 42, 26, 24 | historical reads and paths | none: each live lane's next Rule 3 top block restates the current paths |
-| handoffs/xFactory/session-handoff-2026-09-05-lane-opsXfactory-1.md | 11 | **"register writes via … `~/projects/openRepoTools/lanes-edit.sh`"**, the **checkout copy** | **Act before cutover:** this lane is live (PAUSED 2026-10-07T11:12:58Z, swap). That path disappears when the live checkout pulls the assembly main. Point its next handoff at the installed copy (`~/.local/bin/lanes-edit.sh` or `~/projects/xFactory/lanes-edit.sh`), and tell its owner. |
-| handoffs/xFactory/attachments/opsXfactory-1/land-444.sh | 2 | `LANES_EDIT="${LANES_EDIT:-$HOME/projects/openRepoTools/lanes-edit.sh}"` (:329) | Same. A script that defaults to the checkout copy breaks at the split. |
-| handoffs/xFactory/attachments/opsXfactory-1/briefs/DELTA-land-{444-r2,444-r4,444-r5-MERGE-WORKER,462}.md | 1 each | the same checkout-copy path in briefs | same |
-| handoffs/xFactory/session-handoff-2026-09-0{2,5}…, -09-10b…, -09-12… (5 files); lanes/log/openxfactory-1.md (4), openXfactory-5.md (1), openXfactory-3.md (1) | 1-4 | mentions of the checkout and of its `lanes-edit.sh` | historical. Check whether any live lane still runs the checkout copy. |
-| migration/openRepoTools/prep-20261007T100559Z/{worktrees.tsv, inventory-raw.json, status-openRepoTools.txt}; adopter-fix-20261007-iM20tv/{README.md, logs/lane-worktrees-add.log} | 9, 9, 1; 1, 1 | migration evidence | none: evidence of its time |
-
-Outside brett-wip, nothing calls a tool by its checkout path. `~/.claude/settings.json` and
-the shell rc files have no `projects/openRepoTools` (`grep` exited 1), and neither does
-`~/.agents`. In `workBenches` there is one hit, a fixture string at
-`devcontainer.test/test-claude-profile-lane-default.sh:282` and `:293`: text a fake prints,
-naming a cwd. That is not a tool call.
-
----
-
-## 5. What does not need to change, and why
-
-- **How the tools find their helpers** (§4.1): every helper moves to `code/` with the tool.
-- **`lane-start`'s directory rungs and `lanes-edit.sh`'s crossing test** (§4.2, §4.5): both
-  already read `legs:` the way openRepoShape writes them, and the shell suite covers both
-  (tests/test_lane_helpers.sh:1458-1469 for crossings, :5691-5704 for rung 5).
-- **The workspace resolver, the register, logs and handoffs** (`link-estates:89-295`,
-  byte-identical in four helpers): they are found through `workspace.yaml`, never from a
-  checkout path.
-- **`installed.tsv`**: it records destinations, not sources (§4.10).
-- **Both hook entries**: they name the `~/projects/xFactory/lanes-edit.sh` link to the
-  installed copy (§4.11).
-- **`lanes-index`, `lane-rename`, `link-estates`**: no repository-relative path.
-- **`set-lane-tree` and the inventory format**: absolute paths. An unvalidated `--checkout`
-  already admits a code-leg tree.
-- **`tests/run.sh`**: the lock, the run root and the venv name are not layout facts.
-- **The dependency unit**: `upstream/openRepoShape`, `.gitmodules` and
-  `contracts/openreposhape-pin.yaml` move together to code, so `test_upstream_pin.py`,
-  `NEEDS_UPSTREAM` and `wip init`'s local template path stay true there.
-
----
-
-## 6. What this branch carries
-
-**One commit: this document** (T006 / T007 / T009 / T010 / T018). No shipped command changed.
-Every behaviour change proposed in §4 changes what a command prints or does **today**, for
-this repository or for the estate's existing triads. Each is written above as a proposal with
-a sketch, for a ruling.
-
-**2026-10-11: what the branch now ships.** That paragraph described the branch's first
-commit. The branch now also carries T018's shape-gated changes (§4.4, 2026-10-09 note):
-(a) `lanes-edit.sh project-legs`, the one reader of an assembly's legs, with
-`lane-worktrees sweep` and `lane-end`'s gate enumerating the legs, the worktrees they
-register and the paired root; (b) `lane-handoff` polling the paired root and recording
-each tree under its leg, and `lane-reconcile` reading the legs' registrations and the
-paired root (merged from writer 2's `feat/triad-lane-tooling-handoff`); (c) the daily
-report counting each leg as a checkout of its own; (d) `lane-worktrees add` recording
-the leg it made a tree from. On a single repository every output is byte for byte what
-`c45a452` printed, which two stored goldens hold: `tests/fixtures/t018/` and
-`tests/fixtures/t018-handoff/`. Usage text moves for every shape (§4.4). The branch merges
-main at `f87fd5a` (#190) and changes none of #190's test-root files.
-
-**2026-10-13: the paired root in `lane-handoff`, after the pre-PR review.** (b) above is
-narrower now (the review's M1, option (a), then pending lane 1's ruling on #186; ruled
-2026-10-17, §7 item 12). The handoff polls and records a paired tree only where the
-lane's inventory names it, its HEAD's own
-`Lane:` trailer is the lane's on a commit origin's default branch lacks (the sweep's
-rule), or the writers file names it. Every other paired tree is a `PAIRED ROOT, not this
-lane's` line in the top block, outside WRITERS, not counted and not recorded. A paired
-root, feature directory or leg directory it cannot list or search, and an inventory it
-cannot read, are `NOT POLLED` and leave the lane `SWAPPING`, as `lane-reconcile` is
-`indeterminate` and the sweep refuses for the same directories. The heading below,
-"why this branch carries no test change", means no change to the suite's **roots**: the
-branch's own tests are the two modules and goldens named above.
-
-**Overlap with #190, and why this branch carries no test change.** An earlier draft of this
-branch made the suite's roots shape-aware. Lane 1's PR #190 does the same work, more
-completely, under other names. The draft was dropped before it was committed; its diff is
-kept only in this lane's scratch directory.
-
-| File | This branch's draft | #190 | Disposition |
-| --- | --- | --- | --- |
-| tests/conftest.py | `manifest_legs`, `checkout_roots`, `ASSEMBLY`, `SPEC`, `source()`; `$OPENREPOTOOLS_TEST_{ASSEMBLY,SPEC}_ROOT`; a missing root **fails** | `ROOTS`, `resolve_roots`, `ROOTS.path_for`; `$OPENREPOTOOLS_{CODE,ASSEMBLY,SPEC}_ROOT` and `_COMPOSED`; standalone **skips**, composed **refuses** | dropped; #190's definitions stand |
-| tests/test_checkout_roots.py (new) | 9 cases on throwaway layouts, the paired layout among them | tests/test_test_roots.py (new, 573 lines) | dropped; the paired layout is a gap in #190 (§4.13) |
-| tests/test_repo_hygiene.py | 23 reads through `source()` | `doc()`, `code_first()`, `tracked_files()` | dropped |
-| tests/test_openrepotools_command.py | 1 read through `source()` | `ROOTS.path_for("README.md")` | dropped |
-| tests/test_lane_helpers.sh, test_lane_helpers_suite.py | `SPEC_DIR` from `$OPENREPOTOOLS_TEST_SPEC_ROOT` (written, never committed) | `LANE_MANUAL` from `$OPENREPOTOOLS_LANE_MANUAL`, with skips | dropped; one read #190 leaves open (§4.13) |
-
----
-
-## 7. Decisions for lane 1 (the migration owner)
-
-**2026-10-17: lane 1's rulings on T018.** Lane openRepoTools-1 ruled in comment
-**6240800023** on opensoft/openRepoTools#186 ("the four T018 rulings", posted
-2026-10-17T20:48Z), answering lane 3's 6240688657, first asked in 6111266988. Each
-ruling is quoted at its item below: item 3 (what goes live), item 11 (parked paired
-trees), and item 12, added here, for the pre-PR review's M1. The same comment gives
-lane 1's word to open the T018 PR once five conditions are met, and lane 1 owns the
-landing.
-
-1. **Bindings (T018):** keep every lane's `dir` at the assembly root and its home at
-   `opensoft/openRepoTools`, and spell leg objects in full. The alternative is lanes homed on a
-   leg, which changes the Claude project folder, and with it memory and `--resume`.
-2. **Open OpenSpec claims (T018):** re-key `opensoft/openRepoTools:openspec/changes/<x>` to
-   `opensoft/openRepoTools-spec:…` at cutover, by release and claim.
-3. **Worktree visibility (T018):** adopt §4.4 proposal 1 (guidance) now. Rule on proposals 2
-   and 3, which change the sweep and the daily report for existing triads too.
-   **Ruled 2026-10-17 (6240800023, item 3).** Proposal 1, the guidance, goes live now.
-   Proposals 2 and 3 go live with the T018 PR, on one condition. They change the sweep,
-   `lane-end`'s gate, the handoff poll, `lane-reconcile`'s TREE rows and the daily report
-   for every triad on this workstation, and those triads belong to other lanes. So the PR
-   body must carry a read-only before/after measurement over each of them (IRRS, IRSS,
-   MedxEHR, MedxGlass, openDox, openXdox, openWallet and the codexFactory copies),
-   comparing main's tools with T018's. For each triad it lists the sweep rows that
-   change, every `lane-end` verdict that changes with the lane that owns it, and the
-   report lines that appear. Any verdict that flips to a refusal is told to its owning
-   lane, on #186 or in the register, before the landing.
-4. **Checkout-copy callers:** opsXfactory-1's handoff and its `land-444.sh` call
-   `~/projects/openRepoTools/lanes-edit.sh`. Re-point them before the live checkout pulls the
-   split.
-5. **T007 landing order:** the root entry point goes in the root-split PR, and the code
-   installer's pin resolution covers already-installed re-installs (context d) and
-   `wip_shape_ref`'s silent `main` (context e).
-6. **T006 contents:** the code leg's own `.gitattributes` and `.gitignore`; dated cap entries
-   for AGENTS.md (316) and README.md (486); the root guidance's `code/` prefixes (§4.12).
-7. **T010 context:** which spec and assembly commits a code CI run pairs with, and whether the
-   code leg's CI carries the two extra checkouts or the assembly's CI runs the composed suite.
-   **2026-10-09:** the §4.14 sketch exits 4 under #190's composed mode as it stands (#190 at
-   `dbc6837`: `_leg_at_its_pin`, tests/conftest.py:259, refuses a code root the assembly does
-   not pin, raised by `pytest_configure`, :404-412; `discover_assembly`, :159-172, finds only
-   an assembly that mounts the code root). The composed job must check out an assembly whose
-   code gitlink points at the PR's own commit, or a throwaway assembly built for the run that
-   pins it, or use #190's standalone mode (§4.14, 2026-10-09 note).
-8. **Measure in T008:** what `gh api …/contents/<path>` and `raw.githubusercontent.com` answer
-   for a path under a gitlink. §4.10 derives a 404 and does not claim it.
-9. **Standalone skip, or standalone fail (#190):** there are two readings of FR-008. #190
-   skips a document read in a standalone code leg and refuses only in composed mode. That
-   is sound only if the composed job is **required** on every code PR (T010); otherwise a
-   code-only CI is green with the manual never read. This branch's dropped draft failed in
-   both modes, which keeps a code-only CI red until T010 gives it context. Choose one, and
-   write it into T010.
-10. **Paired worktrees in #190:** decide whether `discover_assembly` should also accept
-    `<assembly>/worktrees/<feature>/code`, with the spec root at `../spec` (§4.13), and
-    move the third manual read (#190's test_lane_helpers.sh:6595-6596) inside its `if`, or
-    a standalone code-leg run aborts on `ln_doc: unbound variable` (§4.13, measured).
-11. **Parked paired trees (T018).** **2026-10-11**, from lane 3's review of #196's T018
-    record (review 5481327496 on #196, finding 2), **derived** from the code of this
-    branch and of workBenches `ffd5516`, not run. The sweep, and so `lane-end`'s
-    close-out gate, gives a tree under `<assembly>/worktrees` to a lane only by its
-    HEAD's own `Lane:` trailer, among the commits origin's default branch lacks:
-    `lane-worktrees` at 9991d69, :2424-2431 (the paired-root claim) and :4473-4494
-    (`own_trailers`, `head_lane_trailer`), and a leg checkout by the same rule, :2124.
-    workBenches' `park.sh`
-    (`devBenches/base-image/files/speckit-worktree/templates/specify/extensions/git/scripts/bash/park.sh`)
-    puts the lane only in the WIP commit's subject, `wip: park <UTC> — lane <lane>`
-    (:226), committed with `-m "$WIP_SUBJECT"` and no trailer (:860). `resume.sh` knows
-    those commits by that subject (:221-231) and `reset --soft HEAD~<depth>`s them
-    (:746), so HEAD is back on the commit below them and the work is uncommitted. A
-    parked or resumed paired tree is therefore FOREIGN, counted for nobody, and a gate
-    that passes prints nothing of it: `lane-end`'s pass path (:2122-2127) names only the
-    unclaimed leg checkouts. It is counted only where the lane's #97 inventory names
-    it, which happens through `lanes-edit.sh set-lane-tree`, or a `lane-handoff` that
-    ran while it stood (T018 (b)); `lane-worktrees add` makes its trees under the
-    lane's own root, never in the paired root. **2026-10-13:** since the handoff polls the
-    paired root by the sweep's rule (§6, note of that date), it records a parked or
-    resumed tree only where the inventory or the writers file already names it, so the
-    handoff no longer closes this gap by itself. Lane 3 changed no attribution code; `docs/README-lanes.md`
-    (T018 section) says what to check before `lane-end`. **Choose:** (i) the sweep also
-    reads park's WIP subject as the lane's mark, which couples `lane-worktrees` to a
-    workBenches subject format; or (ii) park's WIP commit carries a `Lane: <lane>`
-    trailer, a workBenches change that resume's subject match does not disturb. Either
-    way a RESUMED tree has no trailer of its own until its writer next commits, because
-    its HEAD is back below the WIP commits. So decide too whether `resume` records the
-    tree it rebuilds in the lane's inventory (`lanes-edit.sh set-lane-tree <lane> <path>
-    --checkout <assembly>/<leg>`), which covers both states.
-    **Ruled 2026-10-17 (6240800023, item 2): (ii), and `resume` records the tree.**
-    Park's WIP commit carries a `Lane: <lane>` trailer, so attribution stays on one
-    contract, the trailer, and `lane-worktrees` is not coupled to a workBenches subject
-    format. `resume` records the tree it rebuilds with `lanes-edit.sh set-lane-tree
-    <lane> <path> --checkout <assembly>/<leg>`, which covers both the parked and the
-    resumed state. Both are workBenches changes, to be filed as one workBenches issue
-    that cites this item and is linked from the T018 PR. **workBenches issue: opensoft/workBenches#166, filed and
-    linked.** The PR does not wait for it. Until it lands, `docs/README-lanes.md` (T018
-    section) says what to check before `lane-end`.
-12. **The paired root in `lane-handoff` (T018, the pre-PR review's M1).** **Ruled
-    2026-10-17 (6240800023, item 1): (a), as implemented in `4d4957d`, with the two-lane
-    regression test** (`test_t018_a_handoff_takes_no_other_lanes_paired_tree`). The
-    handoff polls and records a paired tree only when one of these holds: this lane's
-    inventory names it, its HEAD's last `Lane:` trailer is this lane's on a commit
-    origin's default branch lacks, or the lane's writers file names it. Every other
-    paired tree is printed as "PAIRED ROOT, not this lane's", and is not counted or
-    recorded. Lane 1's reason: recording everything is the misattribution that
-    `.claude/worktrees` already causes in this checkout's directory, where on 2026-10-11
-    six other lanes' trees went into lane 1's inventory that way. Option (b), recording
-    every paired tree as the running lane's, is not taken.
diff --git a/ideation/README.md b/ideation/README.md
deleted file mode 100644
index cb23f6d8..00000000
--- a/ideation/README.md
+++ /dev/null
@@ -1,10 +0,0 @@
-# openRepoTools Ideation
-
-This directory holds non-normative brainstorm material. Documents under
-`brainstorm/` describe possibilities for later specification and implementation;
-they do not amend the lane collision protocol or the shipped command contracts.
-
-## Brainstorm packets
-
-- [Supervised Context Restart](brainstorm/supervised-context-restart-overview.md) — a durable `/ctx` restart transaction with a surviving pane supervisor, explicit fresh-launch intent, and positive replacement readiness.
-- [Crash-Consistent Lane Worktree Recovery](brainstorm/lane-worktree-recovery-state-overview.md) — a proposed canonical lane worktree layout, two-phase swap state, and resume-time reconciliation model.
diff --git a/ideation/brainstorm/lane-worktree-recovery-state-canonical-layout.md b/ideation/brainstorm/lane-worktree-recovery-state-canonical-layout.md
deleted file mode 100644
index 1740a5e0..00000000
--- a/ideation/brainstorm/lane-worktree-recovery-state-canonical-layout.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# Canonical Lane-Owned Worktree Layout — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Give each lane a derivable worktree root beneath its home repository while keeping the coordinator in the canonical base checkout.
-Topics: lane-worktree-recovery-state, canonical-worktree-layout, lane-directory, worktree-ownership
-Repository context: openRepoTools lane orchestration, with openRepoShape and Speckit worktree-layout compatibility as a boundary
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Derivable lane root** — Resolve every lane-owned worktree without relying on a historical absolute path.
-- **Coordinator-base invariant** — Require the lane coordinator to launch from its home repository's canonical base checkout.
-
-## Focus
-
-This document isolates where a lane and its worktrees live. Today `dir` is the exact directory from which a coordinator was launched; it can be a base checkout or a feature worktree, and legacy lanes may not record it at all. That makes recovery depend on historical paths and leaves the relationship between one coordinator and several writer worktrees implicit.
-
-## Proposed model
-
-Resolve a lane's stable repository identity from `home owner/repo` and `estate`. On each workstation, resolve that identity to the canonical base checkout. The coordinator always launches there. Lane-owned writer worktrees occupy a deterministic root derived from that checkout, conceptually:
-
-```text
-<home-base-parent>/worktrees/<canonical-lane>/
-├── lane-state.yaml
-├── tree-state/
-│   └── <tree>.yaml
-└── trees/
-    └── <tree>/
-```
-
-The exact path must remain compatible with the estate's `project.yaml`, `SPECKIT_GIT_WORKTREE_ROOT`, and openRepoShape's feature-first worktree contract. A naive `..` calculation is insufficient for a three-leg estate. The invariant is derivability from repository identity and shape, not this illustrative spelling.
-
-State files live beside the Git worktrees rather than inside them. That avoids making a checkout dirty, accidentally committing orchestration metadata, and losing the only record when a worktree directory disappears.
-
-One lane may own many worktrees, but its coordinator has one launch directory. Each worktree receives a stable tree identifier and records its own repository, role, branch, HEAD, upstream, writer, and lifecycle state.
-
-## Interfaces and boundaries
-
-The layout consumes canonical lane name, `home`, `estate`, and shape configuration. It emits derivable paths and sidecar locations. It does not decide whether work is safe, whether a writer is live, or whether a missing worktree can be rebuilt.
-
-Existing governed Speckit feature paths remain authoritative. Lane ownership may need to be an index over those paths rather than a second physical layout when moving them would violate the shape contract.
-
-## Alternatives and tensions
-
-- Keeping the coordinator in whichever worktree it last used preserves current flexibility but makes the lane's identity depend on mutable feature state.
-- Putting `.lane-state` inside each worktree makes discovery local but dirties or disappears with the checkout unless special exclusion rules are reliable everywhere.
-- Recording absolute paths is easy on one workstation but is not portable between host, container, and another workstation.
-- Organizing physical worktrees by lane makes discovery simple; organizing them by feature preserves the existing Speckit contract. A sidecar lane index may reconcile both.
-
-## Open questions
-
-- Is the coordinator base the estate root, the lane's `home` repository checkout, or a declared coordination leg?
-- Should lane-owned scratch worktrees and governed Speckit feature worktrees use different physical roots?
-- What stable identifier names a writer tree when the branch is renamed?
-- Is the sidecar local-only, workspace-replicated, or split between both?
-
-## Relationships
-
-The lifecycle written beneath this layout is defined in [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md). Resume reconciles the layout against Git and processes as described in [Resume-Time Worktree Reconciliation](lane-worktree-recovery-state-resume-reconciliation.md).
diff --git a/ideation/brainstorm/lane-worktree-recovery-state-crash-consistent-lifecycle.md b/ideation/brainstorm/lane-worktree-recovery-state-crash-consistent-lifecycle.md
deleted file mode 100644
index 42edbe34..00000000
--- a/ideation/brainstorm/lane-worktree-recovery-state-crash-consistent-lifecycle.md
+++ /dev/null
@@ -1,68 +0,0 @@
-# Crash-Consistent Lane Lifecycle — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Persist RUNNING, SWAPPING, and SWAPPED as guarded transitions so token exhaustion before or during a handoff is distinguishable and recoverable.
-Topics: lane-worktree-recovery-state, crash-consistent-lifecycle, swap, session-binding
-Repository context: openRepoTools `/swap`, `lane-handoff`, `lane-start`, and SessionStart behavior
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Two-phase swap** — Mark a swap in progress before preservation work and complete it only after every required handoff write succeeds.
-- **Generation-fenced transition** — Prevent a delayed old process from overwriting the state of a newer resumed session.
-
-## Focus
-
-This document isolates lane-level lifecycle state and transition ordering. A session may exhaust tokens before `/swap`, during `/swap`, after a clean swap, or while a replacement is starting. Those cases must not collapse into one ambiguous `PAUSED` observation.
-
-## Proposed model
-
-Use an atomically replaced current-state sidecar plus the existing append-only lane event history:
-
-```text
-RUNNING --/swap begins--> SWAPPING --handoff complete--> SWAPPED
-   ^                                                     |
-   +------- confirmed replacement SessionStart ----------+
-```
-
-`/swap` first performs a compare-and-swap from `RUNNING` to `SWAPPING`. It then inventories worktrees, polls writers, records dirty and unpushed state, refreshes the handoff, and lands the protocol's pause writes. Only after every required step succeeds may it compare-and-swap the same operation from `SWAPPING` to `SWAPPED`.
-
-Each transition carries at least:
-
-```yaml
-state: swapping
-generation: 42
-operation_id: 73989e7c-0000-0000-0000-000000000000
-session_id: <transcript-uuid>
-agent: claude
-profile: team-01l
-updated_at: <UTC>
-```
-
-The finishing write must match both `generation` and `operation_id`. A stale `/swap` process therefore cannot mark a lane `SWAPPED` after another process has recovered or resumed it.
-
-The replacement must not write `RUNNING` merely because a launcher was invoked. `RUNNING` is written only after SessionStart confirms the new process, transcript, canonical lane, directory, and binding. An optional `RESUMING` state can make the launch interval explicit; without it, state remains `SWAPPED` until confirmation.
-
-## Interfaces and boundaries
-
-The lifecycle owns lane intent and transition authority. It consumes a verified session/binding identity and emits state changes. Liveness remains an observation from process/session records and must not be inferred from the state word alone.
-
-This lifecycle does not claim that work is durable. `SWAPPED` means the required swap procedure completed; durability assertions come from the worktree reconciliation checks.
-
-## Alternatives and tensions
-
-- Reusing only append-only `PAUSED` and `RESUMED` events preserves one source but makes an interrupted multi-step swap harder to distinguish without an explicit `SWAPPING` event.
-- A mutable sidecar gives a cheap current-state read but needs atomic replacement, locking, and an append-only audit event to explain every change.
-- A heartbeat can identify abandoned `RUNNING` and `SWAPPING` states sooner, but process identity and namespace boundaries remain the stronger liveness evidence.
-
-## Open questions
-
-- Is `RESUMING` worth a fourth persisted state, or should `SWAPPED` remain until SessionStart?
-- What timeout, if any, changes an indeterminate holder into a recovery candidate?
-- Which swap steps are mandatory before `SWAPPED`, and which may finish asynchronously?
-- Is recovery allowed to complete an interrupted operation ID, or must it always create a new generation?
-
-## Relationships
-
-The state refers to worktrees placed by [Canonical Lane-Owned Worktree Layout](lane-worktree-recovery-state-canonical-layout.md). Its crash outcomes are interpreted by [Resume-Time Worktree Reconciliation](lane-worktree-recovery-state-resume-reconciliation.md).
diff --git a/ideation/brainstorm/lane-worktree-recovery-state-overview.md b/ideation/brainstorm/lane-worktree-recovery-state-overview.md
deleted file mode 100644
index b7cf95d0..00000000
--- a/ideation/brainstorm/lane-worktree-recovery-state-overview.md
+++ /dev/null
@@ -1,98 +0,0 @@
-# Crash-Consistent Lane Worktree Recovery Overview — Brainstorm
-
-Status: brainstorm
-Kind: reference
-Summary: Make a multi-worktree lane resumable by deriving its worktree inventory, journaling swap transitions, and reconciling persisted intent with live Git and process evidence before relaunch.
-Topics: lane-worktree-recovery-state, lane-management, worktree-recovery, swap, resume
-Repository context: openRepoTools, with integration boundaries at the lane collision protocol, openRepoShape, Speckit, and estate park/resume
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Structured lane recovery** — Deliver canonical lane worktree roots, crash-consistent swap state, and a guarded resume report as one capability.
-
-## Motivation
-
-A lane can coordinate several worktrees containing dirty files or unpushed commits. Today the lane launch record identifies one coordinator directory, while writer worktrees live primarily in the handoff and process context. Token exhaustion can happen before `/swap` or after `/swap` begins but before it completes, leaving the next session unable to distinguish a clean handoff from an interrupted one.
-
-Legacy lanes add another ambiguity: their human-readable handoffs may name a directory while their machine-readable event history does not. Asking the operator for `--dir` recovers the coordinator but does not discover or verify every worktree the lane owned.
-
-## Goals
-
-- Derive the complete expected worktree inventory for a lane on a workstation.
-- Distinguish normal running, an in-progress swap, and a completed swap across process death.
-- Detect token exhaustion before and during `/swap` without claiming a clean handoff.
-- Prevent duplicate coordinators and writers through locked, generation-fenced transitions.
-- Find and preserve dirty or unpushed worktrees before resuming.
-- Delegate reconstructable feature worktrees to the existing estate `resume` mechanism.
-
-## Non-goals
-
-- Reconstruct missing uncommitted file contents from metadata.
-- Delete unknown worktrees or stale paths automatically.
-- Replace the estate parked record or hand-roll its Git operations.
-- Treat a profile, absolute host path, or branch name as the lane's stable identity.
-- Ratify the coordinator-base invariant merely by recording this brainstorm.
-
-## What the system delivers
-
-The coordinator starts from a canonical base checkout resolved from stable repository identity. Writer worktrees have deterministic or indexed locations and sidecar manifests. `/swap` uses a two-phase `RUNNING -> SWAPPING -> SWAPPED` transition. Resume compares those records with live session holders, Git worktree registrations, actual directories, branches, commits, dirty files, and upstream state before allowing a new SessionStart to return the lane to `RUNNING`.
-
-The result is an explainable outcome: attach to the existing owner, complete or recover an interrupted swap, resume a cleanly swapped lane, rebuild durable parked trees, or refuse with precise evidence of possible loss.
-
-## System model
-
-```text
-                         /swap
-confirmed session   ----------------> transition journal
-      |                                  RUNNING
-      |                                     |
-      v                                     v
-canonical base ----> lane tree index --> SWAPPING
-                          |                  |
-                          v                  v
-                    Git worktrees ------> SWAPPED
-                          |                  |
-                          +---- reconcile <--+
-                                   |
-                     attach / recover / refuse / resume
-                                   |
-                         confirmed SessionStart
-                                   |
-                                RUNNING
-```
-
-## Cluster map
-
-- [Resumable Lane Ownership](lane-worktree-recovery-state-synthesis-resumable-lanes.md) — joins physical discovery, transition authority, and evidence-based recovery.
-
-## How it fits
-
-The proposal extends rather than replaces existing roles. The lane event log remains the append-only audit history. The sidecar provides atomic current state and a bounded local inventory. The handoff remains the human and agent resume narrative. `git worktree list` and Git status remain filesystem truth. Estate `park`, `status`, and `resume` remain the only mechanism for durably recording and reconstructing governed feature worktrees.
-
-Implementation must account for the current openRepoShape worktree convention. If lane-first physical paths conflict with feature-first paths, the canonical lane root should index existing paths rather than move them.
-
-The governed change is [add-crash-consistent-lane-worktree-recovery](../../openspec/changes/add-crash-consistent-lane-worktree-recovery/proposal.md), tracked in [opensoft/openRepoTools#91](https://github.com/opensoft/openRepoTools/issues/91). The brainstorm remains non-normative; the OpenSpec proposal, capability specification, and design define the implementation boundary.
-
-## Key decisions and open questions
-
-- Proposed: `SWAPPING` is entered before any handoff work; `SWAPPED` is committed only after every mandatory step succeeds.
-- Proposed: `RUNNING` is written only by a confirmed SessionStart.
-- Proposed: every transition is locked and fenced by generation plus operation ID.
-- Proposed: the coordinator launches from a canonical base checkout and feature changes live in writer worktrees.
-- Open: whether `RESUMING` is a separate persisted state.
-- Open: how the lane index coexists with Speckit's feature-first worktree paths.
-- Open: which recovery discrepancies block only a writer versus the whole coordinator.
-- Open: which metadata is local and which is replicated for another workstation.
-
-## Document map
-
-### Synthesis
-
-- [Resumable Lane Ownership](lane-worktree-recovery-state-synthesis-resumable-lanes.md)
-
-### Atomic concepts
-
-- [Canonical Lane-Owned Worktree Layout](lane-worktree-recovery-state-canonical-layout.md)
-- [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md)
-- [Resume-Time Worktree Reconciliation](lane-worktree-recovery-state-resume-reconciliation.md)
diff --git a/ideation/brainstorm/lane-worktree-recovery-state-resume-reconciliation.md b/ideation/brainstorm/lane-worktree-recovery-state-resume-reconciliation.md
deleted file mode 100644
index 4d38413f..00000000
--- a/ideation/brainstorm/lane-worktree-recovery-state-resume-reconciliation.md
+++ /dev/null
@@ -1,66 +0,0 @@
-# Resume-Time Worktree Reconciliation — Brainstorm
-
-Status: brainstorm
-Kind: process
-Summary: Resume a lane only after comparing its persisted intent with live holders, Git worktree registrations, filesystem state, branches, commits, and unpublished work.
-Topics: lane-worktree-recovery-state, resume-reconciliation, git-worktree, loss-prevention
-Repository context: openRepoTools lane restart behavior and the separate estate `park`, `resume`, and `status` mechanisms
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Lane recovery report** — Classify every expected and discovered worktree before launching a replacement writer.
-- **Safe rebuild delegation** — Recreate only worktrees whose commits and branch state are durably represented by the estate parked record or origin.
-
-## Focus
-
-This document isolates what resume must prove. A sidecar state records intent, but only live-process evidence, `git worktree list --porcelain`, filesystem inspection, and Git status reveal what survived a crash.
-
-## Proposed model
-
-Resume acquires the lane lock, resolves the canonical lane root, and reconciles three inventories:
-
-1. expected trees from the lane sidecars and latest handoff;
-2. registered trees from each repository's `git worktree list --porcelain`;
-3. directories actually present beneath the canonical lane root.
-
-For every tree it recalculates repository identity, branch or detached HEAD, current commit, upstream, dirty count, untracked files, and unpushed commits. It also checks the recorded writer/session against live holders. Stored `dirty`, `unpushed`, branch, and HEAD values are comparison points, never current truth.
-
-Suggested outcomes:
-
-| Persisted state | Observed holder | Outcome |
-|---|---|---|
-| RUNNING | live and matching | Attach or refuse a duplicate launch |
-| RUNNING | absent | Ungraceful stop; preserve and inspect every tree |
-| SWAPPING | live and matching | Swap still executing; do not compete |
-| SWAPPING | absent | Interrupted swap; recovery required |
-| SWAPPED | absent | Validate trees, then permit resume |
-| SWAPPED | live | Inconsistent state; refuse until reconciled |
-| CLOSED | any dirty or unpushed tree | Closure inconsistency; refuse cleanup |
-
-A missing worktree may be rebuilt only when its branch and commit are durably available and the existing estate `resume` contract authorizes reconstruction. A path that may have held uncommitted work is reported as possible loss; metadata cannot reconstruct missing file contents.
-
-Unknown worktrees beneath the lane root are never deleted. They are reported as orphan or unmanaged candidates and require adoption or an explicit operator cleanup act.
-
-## Interfaces and boundaries
-
-This process reads lane sidecars, lane event history, handoffs, session holders, Git registrations, and filesystem state. It may delegate reconstruction to the estate's `resume` command. It does not hand-roll WIP commits, force-add worktrees, reset branches, or delete unknown directories.
-
-The lane mechanism and estate mechanism remain distinct: lane resume restores orchestration identity; estate resume reconstructs previously parked feature worktrees from durable branch and commit records.
-
-## Alternatives and tensions
-
-- Automatically rebuilding every missing path is convenient but cannot distinguish a clean removed worktree from lost uncommitted work.
-- Refusing on every discrepancy is safe but may make ordinary stale registrations expensive; classifications should include precise operator remedies.
-- A lane-first physical directory makes enumeration cheap, while an index over shape-governed feature paths avoids changing the current worktree contract.
-
-## Open questions
-
-- Which discrepancies are warnings, and which must block the coordinator launch?
-- Can the coordinator start while individual trees remain recovery-required?
-- How are cross-repository writer worktrees represented under one lane root?
-- Should a clean, pushed, unknown worktree be adoptable automatically or only on a person's word?
-
-## Relationships
-
-The expected inventory comes from [Canonical Lane-Owned Worktree Layout](lane-worktree-recovery-state-canonical-layout.md). The meaning of stale state comes from [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md).
diff --git a/ideation/brainstorm/lane-worktree-recovery-state-synthesis-resumable-lanes.md b/ideation/brainstorm/lane-worktree-recovery-state-synthesis-resumable-lanes.md
deleted file mode 100644
index edcb8057..00000000
--- a/ideation/brainstorm/lane-worktree-recovery-state-synthesis-resumable-lanes.md
+++ /dev/null
@@ -1,64 +0,0 @@
-# Synthesis: Resumable Lane Ownership — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: A canonical worktree inventory, generation-fenced swap lifecycle, and evidence-based reconciliation together make lane recovery deterministic after token exhaustion or process death.
-Topics: lane-worktree-recovery-state, resumable-lanes, worktree-ownership, crash-recovery, synthesis
-Repository context: openRepoTools lane lifecycle integrated with openRepoShape estate worktree recovery
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Crash-explainable resume** — Report exactly where a lane stopped and what survived before any replacement process writes.
-- **Recoverable multi-writer lane** — Restore the coordinator while preventing duplicate writers and preserving dirty or unpublished worktrees.
-
-## Members and their joints
-
-Atomic members: [Canonical Lane-Owned Worktree Layout](lane-worktree-recovery-state-canonical-layout.md), [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md), and [Resume-Time Worktree Reconciliation](lane-worktree-recovery-state-resume-reconciliation.md).
-
-```text
-stable home/estate
-       |
-       v
-canonical lane root -----> expected worktree inventory
-       |                              |
-       v                              v
-RUNNING -> SWAPPING -> SWAPPED -> reconcile Git + disk + holders
-                                      |
-                         resume, attach, refuse, or recover
-```
-
-### Location makes recovery enumerable
-
-The canonical layout turns an open-ended filesystem search into a bounded lane inventory. Repository identity and shape determine where to look; sidecars explain what each path was intended to be. This supplies the reconciliation process with expected inputs without making the sidecars the truth about Git.
-
-### Transition state explains why the inventory was left
-
-The same worktree state has different meanings depending on when the coordinator died. Dirty work beneath `RUNNING` with no holder means no swap began. The same work beneath abandoned `SWAPPING` means preservation began but did not complete. `SWAPPED` means the handoff procedure reached its commit point, although Git is still rechecked.
-
-### Reconciliation controls the next transition
-
-Resume does not blindly change `SWAPPED` to `RUNNING`. It first proves there is no competing holder and classifies every tree. Only a confirmed SessionStart owns the transition to `RUNNING`. Generation and operation fencing prevent either the old swap or a second resume from overwriting the new owner.
-
-## Emergent behavior
-
-Together, the three mechanisms distinguish clean pause, pre-swap crash, mid-swap crash, failed launch, stale process, lost path, and durable rebuild. None of the three can provide that result alone: layout finds things, lifecycle explains intent, and reconciliation tests reality.
-
-## Tensions to hold
-
-- Lane-first layout improves discovery but must not contradict shape-governed feature paths.
-- More persisted state improves diagnosis but creates more transition and migration obligations.
-- A coordinator-base invariant simplifies identity but changes today's permission to launch a lane directly in a feature worktree.
-- Automatic recovery should reduce routine work without masking potentially uncommitted loss.
-
-## Recombination opportunities
-
-- Add the reconciliation report to `lanes` and the SessionStart orientation block.
-- Let `/swap` use the same inventory engine as resume, with different allowed transitions.
-- Reuse estate `status` findings and `resume` reconstruction rather than duplicating Git worktree mechanics.
-
-## Open questions
-
-- Does the current openRepoShape worktree contract adopt lane ownership directly, or does openRepoTools maintain a sidecar index over it?
-- What is the minimum state that must be replicated through the workspace repository for cross-workstation recovery?
-- Which component owns garbage collection after `CLOSED`?
diff --git a/ideation/brainstorm/supervised-context-restart-durable-intent.md b/ideation/brainstorm/supervised-context-restart-durable-intent.md
deleted file mode 100644
index 60765b83..00000000
--- a/ideation/brainstorm/supervised-context-restart-durable-intent.md
+++ /dev/null
@@ -1,65 +0,0 @@
-# Durable Context-Restart Intent — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Persist the exact fresh-session launch intent before `/ctx` replaces its current process so a failed launch remains diagnosable and idempotently retryable.
-Topics: supervised-context-restart, durable-restart-intent, ctx, crash-consistent-lifecycle
-Repository context: openRepoTools lane handoff, lifecycle state, and fresh-session launch behavior
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Restart intent record** — Store the lane, directory, profile, agent, handoff, generation, operation, and fresh-session requirement as one guarded launch request.
-- **Idempotent context restart** — Retry the same unfinished launch without resuming the old transcript or minting competing operations.
-
-## Focus
-
-This document isolates the information that must survive between completing a semantic handoff and successfully starting its replacement session. Today `LANE_START_FRESH=1` exists only in the command passed to `tmux respawn-pane`; when that command exits, the durable lane records retain a pause but not the exact launch that was intended.
-
-## Proposed model
-
-After the handoff operation reaches its preservation commit point, write an atomic restart-intent sidecar under the lane's local control root:
-
-```yaml
-schema: 1
-lane: openRepoTools-3
-generation: 42
-operation_id: <uuid>
-state: pending
-agent: claude
-profile: team-01l
-directory: ~/projects/openRepoTools
-handoff: handoffs/openRepoTools/session-handoff-2026-09-15-lane-openRepoTools-3.md
-mode: fresh-from-handoff
-old_transcript: <uuid>
-requested_at: <UTC>
-```
-
-The record is written before process replacement and compare-and-swap fenced by lane generation and operation ID. Launch attempts update bounded status such as `pending`, `starting`, `ready`, or `failed`, plus diagnostic details. The intended mode is data, not a one-use environment variable.
-
-A retry consumes the same pending operation. It does not silently mint a second generation, resume the old transcript, or reinterpret a normal lane launch as a context clear.
-
-## Interfaces and boundaries
-
-The semantic handoff supplies the handoff path and old-session facts. The crash-consistent lifecycle supplies generation and operation ownership. The restart supervisor consumes the intent and records launch outcome.
-
-The intent does not prove that a replacement is running. It records what must be attempted and preserves failure evidence. Positive startup confirmation remains a separate concern.
-
-The local sidecar is sufficient for same-workstation pane replacement. Cross-workstation continuation still depends on the workspace repository and estate records; whether restart intent itself should be replicated remains open.
-
-## Alternatives and tensions
-
-- An environment variable is simple but disappears with the failed process and cannot support safe retry.
-- Encoding launch intent only in prose inside the handoff is human-readable but makes exact, fenced consumption difficult.
-- Reconstructing intent from the latest `PAUSED` event risks confusing a profile switch, ordinary handoff, and context clear.
-- Retaining failed intents improves diagnosis but requires explicit cleanup rules after success, cancellation, or lane retirement.
-
-## Open questions
-
-- Should the intent use a distinct `STARTING` lifecycle state or remain a child record beneath `SWAPPED`?
-- Which failure details are safe and useful to persist without capturing credentials or command-line secrets?
-- Can an operator cancel a pending restart while keeping the lane cleanly `SWAPPED`?
-
-## Relationships
-
-The [Pane-Resident Restart Supervisor](supervised-context-restart-pane-supervisor.md) consumes this record, and [Positive Replacement Startup Confirmation](supervised-context-restart-startup-confirmation.md) decides when it is complete. Generation ownership comes from [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md).
diff --git a/ideation/brainstorm/supervised-context-restart-overview.md b/ideation/brainstorm/supervised-context-restart-overview.md
deleted file mode 100644
index 0f35e24e..00000000
--- a/ideation/brainstorm/supervised-context-restart-overview.md
+++ /dev/null
@@ -1,94 +0,0 @@
-# Supervised Context Restart Overview — Brainstorm
-
-Status: brainstorm
-Kind: reference
-Summary: Make `/ctx` a durable, generation-fenced restart transaction whose replacement launcher survives failure and marks the lane running only after confirmation.
-Topics: supervised-context-restart, ctx, semantic-handoff, crash-consistent-lifecycle, automatic-context-rollover
-Repository context: openRepoTools with an integration boundary at the workBenches-owned pclaude launcher
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Supervised `/ctx`** — Preserve the semantic handoff, replace the old context, start a fresh session automatically, and retain a visible recovery surface on every launch failure.
-- **Safe automatic context execution** — Supply the confirmed restart primitive required by threshold-triggered rollover.
-
-## Motivation
-
-`/ctx` is intended to clear context and immediately continue from a handoff without another operator command. The current implementation successfully preserves the handoff before replacing the pane, but it passes `lane <name>` or `pclaude` directly to `tmux respawn-pane` and treats tmux's acceptance as success. The old Claude is then gone before anyone knows whether the replacement launched.
-
-One observed run wrote its handoff and `PAUSED` record, killed the old process, and left no replacement session. The design has no surviving process to report a launcher error, and its fresh-session intent exists only in the lost command environment. The human-facing `lane` dispatcher can also legally choose an attach/select path in which nothing is launched, making it unsuitable as an internal restart primitive.
-
-## Goals
-
-- Preserve the one-command `/ctx` experience when all components succeed.
-- Keep the old session alive until semantic preservation and exclusive lifecycle ownership are complete.
-- Preserve exact fresh-session launch intent across child failure.
-- Leave an observable process and safe retry path whenever replacement fails.
-- Mark the lane running only after the intended replacement is positively identified and alive.
-- Give manual and automatic context rollover one authoritative backend.
-
-## Non-goals
-
-- Replacing semantic handoff generation with a shell-only summary.
-- Making the human-facing `lane` dispatcher a narrower internal API.
-- Reconstructing work that was never written to a surviving worktree or handoff.
-- Adding a continuously polling system daemon merely to supervise context restart.
-- Changing profile rotation into lane identity.
-
-## What the system delivers
-
-The proposed system separates semantic preparation from deterministic mechanics. Claude captures reasoning and writer state, then calls one guarded backend. That backend acquires generation ownership, performs mandatory writes, and creates a durable restart intent. Tmux starts a pane-resident supervisor, which directly launches the exact fresh session as a child and remains visible on failure. A readiness check finally moves the lane to `RUNNING`.
-
-For operators, success still looks like typing `/ctx` once. Failure changes substantially: the pane remains, explains the failed stage, and offers an idempotent retry rather than silently exiting.
-
-## System model
-
-```text
-RUNNING
-  |  semantic handoff + exclusive compare-and-swap
-  v
-SWAPPING
-  |  writer inventory + handoff + protocol records
-  v
-SWAPPED + durable restart intent
-  |  tmux starts surviving supervisor
-  v
-STARTING (or fenced attempt beneath SWAPPED)
-  |  replacement identity and liveness confirmed
-  v
-RUNNING
-
-Any pre-commit failure: old session remains alive.
-Any launch failure: supervisor and restart intent remain available.
-```
-
-## Cluster map
-
-- [Synthesis: Reliable Context Rollover](supervised-context-restart-synthesis-reliable-rollover.md) — joins semantic authority, durable intent, process supervision, and readiness into one transaction.
-
-## How it fits
-
-The proposal refines the replacement edge of [Crash-Consistent Lane Worktree Recovery](lane-worktree-recovery-state-overview.md). That work owns lane generations, worktree inventory, and interrupted-swap recovery. Supervised context restart owns the narrower interval from a completed handoff to a confirmed fresh process.
-
-It also becomes a prerequisite for [Automatic Context Rollover](automatic-context-rollover-overview.md). The threshold controller may request the semantic workflow, but it should report completion only after supervised startup confirmation.
-
-The pclaude launcher remains responsible for profile/account selection. Whether the supervisor belongs in openRepoTools or workBenches is an ownership decision; either way, the internal launch surface must be narrower than the operator-facing `lane` command.
-
-## Key decisions and open questions
-
-Load-bearing proposed decisions are to fail closed when transition ownership cannot be acquired, persist fresh launch semantics as data, never call `lane` from the internal restart path, and retain a pane process through launch failure.
-
-The main unresolved decisions are whether to add a first-class `STARTING` state, where the supervisor is owned, how readiness is confirmed without violating the generic SessionStart hook contract, and whether restart-only supervision should later expand to every lane launch.
-
-## Document map
-
-### Synthesis
-
-- [Reliable Context Rollover](supervised-context-restart-synthesis-reliable-rollover.md)
-
-### Atomic documents
-
-- [Semantic and Mechanical Restart Boundary](supervised-context-restart-semantic-mechanical-boundary.md)
-- [Durable Context-Restart Intent](supervised-context-restart-durable-intent.md)
-- [Pane-Resident Restart Supervisor](supervised-context-restart-pane-supervisor.md)
-- [Positive Replacement Startup Confirmation](supervised-context-restart-startup-confirmation.md)
diff --git a/ideation/brainstorm/supervised-context-restart-pane-supervisor.md b/ideation/brainstorm/supervised-context-restart-pane-supervisor.md
deleted file mode 100644
index 5357f788..00000000
--- a/ideation/brainstorm/supervised-context-restart-pane-supervisor.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# Pane-Resident Restart Supervisor — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Respawn `/ctx` into a small supervisor that launches the replacement as a child and remains visible with recovery instructions if that child cannot start.
-Topics: supervised-context-restart, pane-supervisor, tmux, ctx
-Repository context: openRepoTools pane replacement integrated with the installed pclaude launcher
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Surviving restart controller** — Keep one process alive in the lane pane while the old Claude exits and a fresh Claude is launched.
-- **Visible launch failure** — Leave the exact launcher error and an idempotent retry command on screen instead of closing the pane.
-
-## Focus
-
-This document isolates which process owns the dangerous interval after `/ctx` kills the old Claude but before a fresh Claude is known to be running. `tmux respawn-pane` currently starts `lane <name>` or `pclaude` directly and treats tmux's acceptance as success. If the command returns or takes a no-launch route, the pane disappears with no surviving controller.
-
-## Proposed model
-
-Respawn the pane into a dedicated command such as:
-
-```text
-lane-restart-supervisor --lane <lane> --operation <operation-id>
-```
-
-The supervisor becomes the pane's root process. It reads and fences the durable restart intent, invokes a private launch primitive as a child, and waits for positive startup evidence. It never calls the human-facing `lane` dispatcher, whose job includes attach/select behavior and therefore permits successful outcomes in which nothing is launched.
-
-If preparation or launch fails, the supervisor remains in the pane and prints:
-
-- the lane, generation, and operation it attempted;
-- the exact failed stage and exit status;
-- the state and location of the handoff and restart intent;
-- a safe retry command that consumes the same operation;
-- a cancellation or inspection command where supported.
-
-On success, the interactive child owns the terminal while the supervisor remains its parent. The implementation may either keep supervising for the life of the child or exit only after a tmux-safe handoff that preserves a failure surface for future restarts.
-
-## Interfaces and boundaries
-
-The supervisor owns process lifetime, diagnostics, retry, and launch-attempt status. It does not generate semantic handoff content, choose a lane from a picker, modify worktrees, or infer identity from the pane title.
-
-The dedicated launch primitive owns exact directory/profile/agent argument construction. Existing `pclaude` may remain the account launcher, but it runs beneath the supervisor rather than replacing the only process capable of reporting failure.
-
-## Alternatives and tensions
-
-- A permanently resident supervisor around every Claude launch gives the cleanest lifecycle but changes the installed launcher architecture more broadly.
-- A restart-only supervisor is smaller and fixes `/ctx`, although ordinary lane launches retain their existing process shape.
-- A detached external daemon could supervise every lane but adds discovery, authorization, and service-lifecycle complexity that the pane itself already solves.
-- A diagnostic shell on failure is convenient but must not accidentally imply the lane is `RUNNING` or permit an unfenced second launch.
-
-## Open questions
-
-- Should the supervisor live in openRepoTools or in the workBenches project that owns `pclaude`?
-- Should the supervisor remain for the full Claude lifetime or only through confirmed startup?
-- How should terminal signals and exit status propagate between tmux, the supervisor, `pclaude`, and Claude?
-
-## Relationships
-
-The supervisor consumes [Durable Context-Restart Intent](supervised-context-restart-durable-intent.md) and waits for [Positive Replacement Startup Confirmation](supervised-context-restart-startup-confirmation.md). Its launch request is produced only after the [Semantic and Mechanical Restart Boundary](supervised-context-restart-semantic-mechanical-boundary.md) completes preservation.
diff --git a/ideation/brainstorm/supervised-context-restart-semantic-mechanical-boundary.md b/ideation/brainstorm/supervised-context-restart-semantic-mechanical-boundary.md
deleted file mode 100644
index a796df7b..00000000
--- a/ideation/brainstorm/supervised-context-restart-semantic-mechanical-boundary.md
+++ /dev/null
@@ -1,51 +0,0 @@
-# Semantic and Mechanical Restart Boundary — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Let Claude produce semantic handoff content while one deterministic backend exclusively owns lifecycle writes, process replacement, and retry behavior.
-Topics: supervised-context-restart, semantic-mechanical-boundary, semantic-handoff, ctx
-Repository context: openRepoTools `/ctx` command, handoff skill, lane-handoff backend, and lane launch commands
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Single restart transaction API** — Accept model-produced handoff material and execute every mechanical state transition through one testable backend.
-- **Thin `/ctx` command** — Reduce the model instruction to semantic capture followed by one guarded backend invocation.
-
-## Focus
-
-This document isolates the authority boundary between reasoning that requires the current model and mechanics that must behave identically every time. The current handoff skill includes extensive shell recipes, including direct `tmux respawn-pane` instructions, while `lane-handoff` contains overlapping mechanics. That duplication allows a session to reconstruct the destructive tail instead of calling one authoritative transaction.
-
-## Proposed model
-
-Split `/ctx` into two explicit phases:
-
-1. **Semantic preparation:** Claude summarizes current reasoning, discovers and polls writers, and produces a structured handoff payload plus human-readable narrative.
-2. **Mechanical commit and restart:** one backend validates identity, acquires the lane generation, snapshots trees, writes the handoff and protocol records, commits the transition, persists restart intent, and delegates replacement to the supervisor.
-
-The backend accepts an operation-scoped input rather than asking the model to reproduce shell commands. It either completes the guarded pre-kill transaction or refuses with the old session intact. Once the restart commit point is crossed, the supervisor owns all subsequent process behavior.
-
-The human-facing `lane` command remains responsible for lookup, attach, and operator-selected launch. It is not an internal primitive for a restart transaction. A private launch command has narrower semantics: launch this exact pending operation or refuse.
-
-## Interfaces and boundaries
-
-The model owns meaning, unresolved intent, and communication with live writers. It does not own compare-and-swap, tmux quoting, launcher selection, or success determination.
-
-The backend owns state and process orchestration. It must not invent semantic handoff content when the old session is still available; late recovery after a crash remains a distinct degraded path.
-
-## Alternatives and tensions
-
-- Keeping all steps in a skill maximizes model flexibility but weakens reproducibility at the most destructive boundary.
-- Making the entire handoff shell-only is deterministic but loses current reasoning and agent communication.
-- A structured intermediate payload adds schema/versioning work but makes replay, validation, and tests substantially clearer.
-- Direct in-process `/clear` could avoid process replacement if the harness offered a supported clear-and-seed operation; terminal keystroke injection is too race-prone to emulate that interface.
-
-## Open questions
-
-- What is the smallest structured payload that preserves semantic value without coupling the model to backend state schema?
-- Does the backend write the final Markdown handoff, or splice a validated model-authored section into it?
-- How should a partially prepared semantic handoff be exposed if lifecycle acquisition subsequently refuses?
-
-## Relationships
-
-This extends [Semantic Handoff Before Restart](automatic-context-rollover-semantic-handoff.md) by defining its implementation boundary. It produces [Durable Context-Restart Intent](supervised-context-restart-durable-intent.md) and hands process control to the [Pane-Resident Restart Supervisor](supervised-context-restart-pane-supervisor.md).
diff --git a/ideation/brainstorm/supervised-context-restart-startup-confirmation.md b/ideation/brainstorm/supervised-context-restart-startup-confirmation.md
deleted file mode 100644
index 11551223..00000000
--- a/ideation/brainstorm/supervised-context-restart-startup-confirmation.md
+++ /dev/null
@@ -1,56 +0,0 @@
-# Positive Replacement Startup Confirmation — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: Keep a lane non-running until evidence confirms that the intended replacement process, transcript, directory, and binding are alive.
-Topics: supervised-context-restart, startup-confirmation, session-binding, crash-consistent-lifecycle
-Repository context: openRepoTools lane-start, SessionStart reporting, and lifecycle transition behavior
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Confirmed `RUNNING` transition** — Move from a completed handoff to `RUNNING` only after the intended replacement proves its identity and liveness.
-- **Launch-time recovery classification** — Distinguish a pending restart, an active startup attempt, an immediate child failure, and a ready replacement.
-
-## Focus
-
-This document isolates what evidence is required before the lane may claim `RUNNING`. Current `lane-start` writes `LIVE` before its final `exec`, so a launcher or Claude failure can leave a positive state for a process that never existed.
-
-## Proposed model
-
-Keep the lifecycle at `SWAPPED`, or move it to a fenced `STARTING`, while the supervisor launches the child. Confirm readiness only when evidence agrees on:
-
-- canonical lane name;
-- generation and restart operation;
-- new transcript/session identifier;
-- agent and selected profile;
-- expected coordinator directory;
-- exclusive pane/session binding;
-- a live replacement process associated with that binding.
-
-The confirming mechanism must be local, bounded, and idempotent. If the generic SessionStart hook must remain read-only and always exit zero, confirmation can come from a separate launcher-owned acknowledgment or from a supervisor check combining child liveness with newly created transcript and binding evidence. It must not be inferred merely from `exec` being attempted.
-
-Only confirmation may write `RUNNING` and mark the restart intent `ready`. A timeout or child exit leaves the intent retryable and the lifecycle non-running; it does not fabricate `RESUMED` success.
-
-## Interfaces and boundaries
-
-`lane-start` may prepare and validate a launch, but pre-exec validation is not runtime readiness. The supervisor observes the child. The lane-state writer owns the fenced transition. SessionStart may report identity without becoming a blocking networked hook.
-
-This confirmation does not certify that all writers were relaunched or that the model correctly understood the handoff. Those are post-start semantic responsibilities.
-
-## Alternatives and tensions
-
-- A SessionStart write is semantically direct but conflicts with the current rule that the generic hook is read-only, network-free, and non-blocking.
-- A short process-liveness grace period is easy but can mistake a hung or misbound client for a ready session.
-- Transcript-file creation plus process liveness is stronger, but profile storage paths and timing must be handled without races.
-- Letting the new model stamp itself `RESUMED` proves semantic execution but is too late and too nondeterministic to be the only process-level readiness signal.
-
-## Open questions
-
-- What is the minimum sufficient local readiness evidence on Claude, Codex, and future agents?
-- How long may `STARTING` remain before the supervisor reports failure without killing a possibly slow but valid launch?
-- Which component writes the append-only `RESUMED` event, and how is it ordered against local `RUNNING`?
-
-## Relationships
-
-This closes the operation recorded by [Durable Context-Restart Intent](supervised-context-restart-durable-intent.md) and observed by the [Pane-Resident Restart Supervisor](supervised-context-restart-pane-supervisor.md). It refines the replacement edge in [Crash-Consistent Lane Lifecycle](lane-worktree-recovery-state-crash-consistent-lifecycle.md).
diff --git a/ideation/brainstorm/supervised-context-restart-synthesis-reliable-rollover.md b/ideation/brainstorm/supervised-context-restart-synthesis-reliable-rollover.md
deleted file mode 100644
index f7892b7f..00000000
--- a/ideation/brainstorm/supervised-context-restart-synthesis-reliable-rollover.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# Synthesis: Reliable Context Rollover — Brainstorm
-
-Status: brainstorm
-Kind: architecture
-Summary: A strict semantic boundary, durable launch intent, surviving supervisor, and positive readiness check turn `/ctx` into an observable and retryable transaction.
-Topics: supervised-context-restart, reliable-rollover, durable-restart-intent, pane-supervisor, startup-confirmation, synthesis
-Repository context: openRepoTools context clearing from handoff preparation through confirmed replacement
-Captured: 2026-09-15
-
-## Possible feats
-
-- **Failure-visible `/ctx`** — Clear context automatically while ensuring every failed replacement leaves a pane, durable intent, and safe retry path.
-- **Readiness-gated automatic rollover** — Give the 65% controller a completion condition stronger than tmux accepting a command.
-
-## Members and their joints
-
-Atomic members: [Semantic and Mechanical Restart Boundary](supervised-context-restart-semantic-mechanical-boundary.md), [Durable Context-Restart Intent](supervised-context-restart-durable-intent.md), [Pane-Resident Restart Supervisor](supervised-context-restart-pane-supervisor.md), and [Positive Replacement Startup Confirmation](supervised-context-restart-startup-confirmation.md).
-
-```text
-Claude semantic preparation
-          |
-          v
-guarded SWAPPING -- mandatory writes --> SWAPPED + restart intent
-                                              |
-                                              v
-                                    pane supervisor
-                                      |         |
-                               child ready   child fails
-                                      |         |
-                                      v         v
-                                   RUNNING   visible retry
-```
-
-### Authority and commit points
-
-The [semantic boundary](supervised-context-restart-semantic-mechanical-boundary.md) prevents model instructions from becoming an alternate mechanical implementation. The backend must own the lane generation before preservation begins. Failure to acquire ownership is a refusal, not a warning followed by process replacement.
-
-`SWAPPED` is the preservation commit point, not proof of a running replacement. The [durable intent](supervised-context-restart-durable-intent.md) records exactly what must happen next and prevents a failed one-use environment variable from erasing fresh-session semantics.
-
-### Process lifetime and feedback
-
-The [supervisor](supervised-context-restart-pane-supervisor.md) is the first process started after the old session is replaced. Because it launches the agent as a child, launcher refusal or immediate exit cannot close the only diagnostic surface.
-
-The [startup confirmation](supervised-context-restart-startup-confirmation.md) separates "tmux accepted a command" from "the intended new session owns the lane." That distinction controls when `RUNNING` and completed intent may be written.
-
-### Failure and recovery flow
-
-Failures before `SWAPPED` preserve the old session wherever it is still alive. Failures after `SWAPPED` preserve the completed handoff, restart intent, and supervisor. Retrying uses the same fenced operation unless an explicit recovery act proves it abandoned and advances the generation.
-
-## Emergent behavior
-
-Together these mechanisms make a destructive context reset recoverable at every boundary. The user can type one command in the successful case, while launch failures remain visible and machine-classifiable. Automatic rollover can wait for true completion rather than equating process replacement with success.
-
-## Tensions to hold
-
-- The SessionStart hook's read-only contract conflicts with using it as the writer of `RUNNING`; another bounded confirmation path may be required.
-- A restart-only supervisor is easier to ship, while a permanent lane supervisor offers a cleaner general process model.
-- Local restart intent enables immediate recovery but does not by itself provide cross-workstation continuation.
-- Strict fail-closed generation handling can require explicit operator recovery for stale `SWAPPING` operations.
-
-## Recombination opportunities
-
-This cluster can become the execution prerequisite for [Automatic Context Rollover](automatic-context-rollover-overview.md). Its durable operation and error states can also strengthen ordinary profile swaps without making profile part of lane identity.
-
-## Open questions
-
-- Is a distinct persisted `STARTING` state needed, or is `SWAPPED` plus attempt status sufficient?
-- Which repository owns the supervisor when `pclaude` is supplied by workBenches but lane state is supplied by openRepoTools?
-- What positive evidence is portable enough for every supported agent?
diff --git a/lane b/lane
deleted file mode 100755
index 8e289d81..00000000
--- a/lane
+++ /dev/null
@@ -1,1583 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# lane — one word: the lanes, numbered, and the one you pick is bound.
-#
-#   lane                   the lanes of the checkout you are in, NUMBERED, and
-#                          ONE question: which?
-#   lane <name>            straight to that lane's branch, asking nothing
-#   lane <name> <profile>  the same, under another account (the late swap)
-#   lane --all             every repository, grouped
-#
-# Installed on PATH by `openRepoTools --install`. lane-collision-protocol
-# AMENDMENT 18 ADDENDUM 1, RATIFIED 2026-09-14T14:05:54Z verbatim "ratify the
-# addendum", out of Brett Heap's two messages of that morning, verbatim:
-#
-#   i dont understand in another window i want to attach to that lane. what
-#   command do i use to do that?
-#
-#   this is too hard for users. we need simple way to list the lanes and then
-#   pick one to bind.
-#
-# and his answer to what the word should be, interactive multi-choice, verbatim
-# "lane (Recommended)". Clause (i) is REFINED by it and not replaced: the
-# listing is the same listing, and what is new is the NUMBER in front of each
-# row and the one question under them.
-#
-# THREE BRANCHES, ONE PER STATE, AND THE STATE IS THE READ'S (clause (i-2)):
-#
-#   * AVAILABLE — PARKED, or a binding this host proves dead. It goes THROUGH
-#     THE LAUNCHER, in the lane's own recorded directory, under the profile the
-#     lane's own record names: `cd <dir> && exec pclaude --lane <lane>
-#     <profile>`. That is Brett Heap's refinement of 2026-09-14T14:1xZ, from his
-#     question *"when do i use lane vs restart … they seem almost the same to
-#     me"* — a bare `lane-start` under whatever profile the shell happens to
-#     carry is, outside a launcher session, the DEFAULT CONFIG DIRECTORY and
-#     therefore the wrong account. `lane <name> <profile>` names another one,
-#     which is the late-swap case and is exactly what `pclaude --lane <lane>
-#     <profile>` already takes.
-#   * LIVE HERE — the ATTACH, and NEVER A SECOND PROCESS (clause (h)). Inside
-#     tmux the lane's window is moved into this session and selected; outside
-#     tmux, `tmux attach -t <its session>:<@id>` — the window named in the
-#     attach itself, so no act between the fence and the terminal can land on
-#     another lane — with that window selected first.
-#     Nothing is launched or resumed and no register/log write is made: the
-#     session is already running. If its window has a generic name, the picker
-#     verifies the live transcript against the row and repairs that tmux name
-#     before attaching. Measured 2026-09-14: the attach acts are `tmux move-window -a -s
-#     <session>:<@id>` and then `tmux select-window -t <session>:<@id>` — the
-#     `@id` on both, because an index is a name another window can be given
-#     between the read and the act — and where the window is already in this
-#     session the move is not made at all.
-#   * BOUND ELSEWHERE — clause (c)'s question, the handoff request, which
-#     `opensoft/openRepoTools#38` builds and this word now asks: *"lane <l> is
-#     bound to window <w> in <container> on <host> … ask it to hand off, then
-#     bind here? [y/N]"*. A `y` (or `--request-handoff` where there is no
-#     terminal) writes the request to the lane's log, pushes it, types
-#     `/handoff --exit requested by …` into that pane where it is on this tmux
-#     server, and WAITS; when the release lands the lane is free and this word
-#     takes the AVAILABLE branch with it. An empty wait refuses with the facts
-#     and names `--force`, which is a second invocation and never automatic. It
-#     never offers a launch on a lane still bound: that is the collision this
-#     whole protocol is about.
-#
-# CLOSED AND DORMANT LANES ARE HIDDEN (Amendment 19). A lane whose last act was
-# its last is not a lane a person picks, and a picker that offered one would be
-# offering to reopen something closed on purpose. They are still ROWS in
-# `lanes`, which is the read: this is a pick.
-#
-# AND A ROW WHOSE STATE IS ONLY ITS OWN CELL IS NOT PICKED EITHER (#89). `lanes`
-# shows it as `<WORD> (row)` — the state its Amendment 13(a) cell names, where
-# its log has no lane-kind line to give one — and this word refuses it by name:
-# with no log there is nothing to resume from. `go_rowonly` says so.
-#
-# IT IS A PICKER, AND THAT IS THE AMENDMENT AND NOT A DRIFT. Ratified decision 3
-# ruled "never a picker, never a menu" for `restart` and for `/restart`, and
-# Addendum 1 is the later word on a question that decision was not asked: a
-# person who has to type a lane name has to know one. THE COUNT IS STILL ONE
-# QUESTION — the listing, then `which?`, then the act — and with NO TERMINAL ON
-# STDIN there is no question at all: the listing prints, the acts are suggested
-# filled in, and the command exits having asked nothing (clause (i-3); an
-# agent's stdin is not a terminal, and every agent on this estate reads this
-# command's output rather than answering it).
-#
-# `restart` IS RETIRED AND THIS IS WHERE IT WENT (Amendment 18 Addendum 2,
-# ratified 2026-09-14T16:50:32Z verbatim "ratify", from Brett Heap's ruling
-# *"i think we can drop restart as a cli command and keep it inside a claude
-# session with /restart … lane does all the things a user wants"*). The
-# AVAILABLE branch below is `restart <lane>`'s whole act, moved here rather than
-# copied: the launcher path, the recorded directory, the recorded profile,
-# asking nothing. `/restart` is untouched — it is the INSIDE half, for a session
-# that started bare, and a session cannot exec a launcher over itself.
-#
-# EXIT CODES, in this family's convention (clause (f)'s, which excludes 3
-# because `lanes-edit.sh` already spends it on an unpushed commit and a code
-# that means two things is a code a caller cannot act on):
-#
-#   0  the lane was reached — this process replaced by the launcher, or the
-#      attach performed — or the listing printed, or the pick declined
-#   8  NO LANE TO PICK: nothing in scope that this word would offer
-#   2  REFUSED — no such lane, a lane bound elsewhere, no directory or profile
-#      recorded yet, no launcher on PATH, an answer that is not one of the
-#      choices, a recorded window that no longer resolves
-#   1  a read failed, which is never "there are no lanes" (Amendment 7(d))
-#   64 usage — an unknown option, or a flag with no value
-#
-#   $LANES_EDIT      the register's reader (default: lanes-edit.sh beside this)
-#   $PCLAUDE         the launcher         (default: lclaude, else pclaude, else claude-profile)
-#   $LANE_DRY_RUN=1  print the acts instead of performing them
-#
-# It writes nothing to the register and it never runs `claude` itself: every
-# launch goes through the launcher and therefore through `lane-start`, which is
-# what renames the window, stamps the row, extends the session cell, writes the
-# lane's `RESUMED` line and passes `--name <lane>` so the harness's record name
-# is the lane rather than a derived one.
-
-set -euo pipefail
-
-prog="${0##*/}"
-SELF="${BASH_SOURCE[0]:-$0}"
-selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-TAB="$(printf '\t')"
-US="$(printf '\037')"
-
-say()  { printf '%s\n' "$*"; }
-note() { printf '%s: %s\n' "$prog" "$*" >&2; }
-die()  { printf '\n%s: REFUSED: %s\n' "$prog" "$1" >&2; exit "${2:-2}"; }
-# THE ONE-LINE FUNCTION `lane-start:550` CARRIES, and for the same reason: a
-# `--dry-run` prints an act to be TYPED, and an unquoted one is not that act.
-# Clause (c) admits a directory with a space in it — it is written QUOTED and
-# read back unquoted — so `cd /p/my projects` is a line that cd's into `/p/my`.
-quoted() { printf '%q ' "$@" | sed 's/ $//'; }
-lc() { printf '%s' "${1-}" | tr 'A-Z' 'a-z'; }
-
-usage() {
-	cat <<'USAGE'
-lane [<name> [<profile>]] [--all] [--dir <path>] [--switch] [--dry-run]
-     [--request-handoff | --force <why>] [--wait <s>]
-
-  lane             the lanes of the checkout you are in, numbered, and ONE
-                   question: which? Available lanes first (parked, or a binding
-                   this host proves dead), lanes LIVE HERE next with where each
-                   is, lanes bound elsewhere last; closed and dormant hidden.
-                   Outside every checkout: every repository, grouped.
-  lane <name>      straight to that lane's branch, asking nothing: available →
-                   the launcher, in its own directory and under its own
-                   recorded profile; LIVE HERE → its window, attached, never a
-                   second process; bound elsewhere → a refusal naming where.
-  lane <name> <profile>
-                   the same, under the profile you name rather than the one the
-                   record carries — the late swap, exactly as
-                   `pclaude --lane <lane> <profile>` takes it.
-
-  --all            every repository, grouped, whatever the cwd.
-  --dir <path>     the lane's checkout, for a lane whose record has none yet.
-                   Handed straight to the launcher. Not needed on the normal
-                   path, and it must not become the way a lane is reached.
-  --switch         attach with `tmux switch-client` instead of moving the
-                   lane's window into this session.
-  --request-handoff
-                   for a lane BOUND ELSEWHERE: ask that place to hand it off
-                   and wait, without being asked first. The `y` to this word's
-                   own question, for a caller with no terminal.
-  --force <why>    take a lane bound elsewhere anyway — a SECOND invocation,
-                   never automatic. The <why> goes into the lane's append-only
-                   log and is what the bound session reads when it refuses
-                   every prompt from then on (Amendment 18(e)).
-  --wait <s>       how long to wait for the handoff (default 300).
-  --dry-run        print the acts instead of performing them.
-  -h, --help       this.
-
-With NO TERMINAL ON STDIN it lists, suggests and asks nothing — an agent's
-stdin is not a terminal. `f` at the question opens a NEW lane at the next free
-position; `q` picks none.
-
-Exit: 0 reached, listed or declined · 8 nothing to pick · 2 refused ·
-1 a read failed · 64 usage.
-
-  $LANES_EDIT   the register's reader   (default: lanes-edit.sh beside this file)
-  $PCLAUDE      the launcher            (default: lclaude, else pclaude, else claude-profile)
-
-`lanes` is the same rows as a READ — every column, closed lanes included, no
-question. `/restart` is the act from INSIDE a running session, which cannot
-exec a launcher over itself. `lane-end <lane>` closes a lane.
-USAGE
-}
-
-# The helper, found the way `lanes` and `lane-start` find it: beside this
-# command first — `--install` places both in one directory — then on PATH. One
-# resolution, so a workstation with two copies never reads one and writes the
-# other.
-LANES_EDIT="${LANES_EDIT:-}"
-if [ -z "$LANES_EDIT" ]; then
-	if [ -x "$selfdir/lanes-edit.sh" ]; then LANES_EDIT="$selfdir/lanes-edit.sh"
-	else LANES_EDIT="$(command -v lanes-edit.sh 2>/dev/null || printf '')"
-	fi
-fi
-[ -n "$LANES_EDIT" ] && [ -x "$LANES_EDIT" ] || die "no register reader at ${LANES_EDIT:-lanes-edit.sh} — it is installed beside this
-    command by \`openRepoTools --install\`. Run that, or set \$LANES_EDIT." 2
-
-# ------------------------------------------------------------------ arguments
-
-all_given=0; switch=0; dry_run="${LANE_DRY_RUN:-0}"; dir_flag=""
-name=""; profile=""; positional=0; endopts=0
-# AMENDMENT 18(c)/(e) — the two answers to the BOUND ELSEWHERE branch's one
-# question, for a caller with no terminal to be asked on, and the wait's length.
-request_flag=0; force_why=""; handoff_wait=300
-# THE TWO ARGUMENTS ARE THE LANE AND THE PROFILE, IN THAT ORDER, and they are
-# taken in ONE place so that `--` can end the options without a second copy of
-# the rule. A lane name that opens with `-` is not a lane name (the fence below
-# refuses it, and so does `lanes-edit.sh`), so before `--` a `-`-led word is an
-# OPTION and is refused as one: `lane -repoA11-1` is 64, and `lane -- -repoA11-1`
-# is the fence's own 2, which is the refusal that says what a lane name is.
-take_arg() {
-	# AN ARGUMENT THAT WAS GIVEN AND IS EMPTY IS NOT "NO ARGUMENT" (Copilot round
-	# 12 on #45, `lane:234`). `lane ""` left `$name` empty, every guard below it
-	# read that as "no lane was named", and a malformed named invocation became a
-	# different question — the listing, and on a terminal the numbered pick. The
-	# helper's own whole-string fence refuses an empty lane name; this refuses it
-	# at the door, in the same terms, because the two arguments this word takes
-	# are a lane and a profile and neither of them is the empty string.
-	[ -n "$1" ] || die "$prog was given an EMPTY argument, which is not a lane name and not a
-    profile. A lane name is the register row's own spelling; the listing is the
-    bare word with no argument at all:
-      the lanes of this checkout:  $prog
-      that lane:                   $prog <name>" 64
-	positional=$((positional + 1))
-	case "$positional" in
-	1) name="$1" ;;
-	2) profile="$1" ;;
-	*) die "$prog takes a lane and an optional profile: $prog [<name> [<profile>]]" 64 ;;
-	esac
-}
-# A FLAG WHERE A VALUE BELONGS IS REFUSED, in the spaced spelling (opensoft/
-# openRepoTools#80 item 1, Copilot's review of workBenches#91 at `lane:215`).
-# `lane --dir --all` took `--all` as the checkout: the flag a person typed was
-# swallowed as a value and never took effect, so the run asked a different
-# question from the one asked of it. `--force --dry-run` was worse, a REAL
-# takeover whose why was the word `--dry-run`, written into another place's
-# append-only log. `park`, `resume` and `status` refuse this with their shared
-# `flag_value` (92eab6c) and `lane-handoff` with its own; this is the same
-# answer for the three value-taking arms here. The `=` spelling is the way back
-# for a value that really does begin with `-` — `--dir=--odd` takes whatever
-# follows the `=` — and an empty one there is already refused at its arm.
-not_a_flag() {   # <flag> <the value the spaced spelling would take>
-	case "$2" in
-	-*) die "$1 needs a value and '$2' is a flag: nothing here swallows the next word
-    whatever it is. A value that really does begin with \`-\` is given after an
-    \`=\`:  $1=$2" 64 ;;
-	esac
-}
-while [ $# -gt 0 ]; do
-	if [ "$endopts" = 1 ]; then take_arg "$1"; shift; continue; fi
-	case "$1" in
-	-h | --help) usage; exit 0 ;;
-	--all) all_given=1; shift ;;
-	--switch) switch=1; shift ;;
-	--dry-run) dry_run=1; shift ;;
-	--request-handoff) request_flag=1; shift ;;
-	--force) force_why="${2-}"; [ -n "$force_why" ] || die "--force takes the WHY you are taking a lane another place is bound to: it is written into that lane's append-only log and it is the sentence the bound session reads when it refuses every prompt from then on (Amendment 18(e))" 64; not_a_flag --force "$force_why"; shift 2 ;;
-	--force=*) force_why="${1#--force=}"; [ -n "$force_why" ] || die "--force takes the WHY you are taking a lane another place is bound to (Amendment 18(e))" 64; shift ;;
-	--wait) handoff_wait="${2-}"; [ -n "$handoff_wait" ] || die "--wait needs a number of seconds" 64; not_a_flag --wait "$handoff_wait"; shift 2 ;;
-	--wait=*) handoff_wait="${1#--wait=}"; [ -n "$handoff_wait" ] || die "--wait needs a number of seconds" 64; shift ;;
-	--dir) dir_flag="${2-}"; [ -n "$dir_flag" ] || die "--dir needs a path" 64; not_a_flag --dir "$dir_flag"; shift 2 ;;
-	--dir=*) dir_flag="${1#--dir=}"; [ -n "$dir_flag" ] || die "--dir needs a path" 64; shift ;;
-	--) endopts=1; shift ;;
-	-*) die "unknown option '$1' — see $prog --help" 64 ;;
-	*) take_arg "$1"; shift ;;
-	esac
-done
-
-case "$handoff_wait" in '' | *[!0-9]*) die "--wait takes a whole number of seconds; '$handoff_wait' is not one" 64 ;; esac
-# TWO ANSWERS TO ONE QUESTION ARE NOT AN ANSWER. `--request-handoff` asks the
-# place that holds the lane to release it and waits; `--force` releases it on
-# that place's behalf without asking. Together they say both, and which one a
-# run took would be decided by the order of two arms rather than by the person.
-[ "$request_flag" = 1 ] && [ -n "$force_why" ] &&
-	die "--request-handoff ASKS the place that holds this lane to hand it off and waits for
-    it; --force takes it without asking and makes that place stop loudly
-    (Amendment 18(e)). They are two different acts on somebody else's session —
-    pick one." 64
-
-# `--all` IS THE LISTING'S SCOPE AND A NAME IS ONE LANE, so the two together are
-# a line that means two things — said rather than silently resolved either way,
-# which is the rule `lanes --all --prefix <repo>` took one file over.
-if [ "$all_given" = 1 ] && [ -n "$name" ]; then
-	die "--all is the LISTING's scope and \`$prog <name>\` names one lane; they are two
-    questions.
-      every repository:  $prog --all
-      that lane:         $prog $name" 64
-fi
-
-# A RELATIVE `--dir` NAMES TWO DIRECTORIES: this command `cd`s into the
-# directory and then `exec`s the launcher WITH THE SAME STRING, which
-# `lane-start` resolves a second time — from the new working directory. So it is
-# resolved ONCE, to what it meant where the operator typed it. A path that does
-# not exist is left exactly as typed, so the refusal that names it is unchanged.
-if [ -n "$dir_flag" ]; then
-	dir_abs="$(cd -- "$dir_flag" 2>/dev/null && pwd -P || printf '')"
-	[ -n "$dir_abs" ] && dir_flag="$dir_abs"
-fi
-
-# THE WHOLE STRING, AND IT IS `lanes-edit.sh`'s OWN RULE (`check_lane_name`).
-# `[A-Za-z0-9]*)` pins the FIRST CHARACTER and nothing else, so `repoA11-1 x`
-# and `repoA11-1/extra` reach the reads and come back as "no such lane" about a
-# string that is not a lane name at all.
-if [ -n "$name" ]; then
-	case "$name" in
-	"" | *[!A-Za-z0-9._-]* | .* | -*)
-		die "'$name' is not a lane name (letters, digits, . _ -, not opening with . or -)" 2 ;;
-	esac
-fi
-
-# ------------------------------------------------------------ the workstation
-#
-# FROM CONFIGURATION, NEVER FROM `hostname` (ratified decision 8(d)): read
-# through the helper, which is the one implementation the register's own writer
-# uses. A command that ran `hostname` here would name a workstation the register
-# has never heard of the moment it ran in a container.
-ws_pair="$("$LANES_EDIT" workstation 2>/dev/null || :)"
-ws="$(printf '%s' "$ws_pair" | cut -f1)"
-ws_src="$(printf '%s' "$ws_pair" | cut -f2)"
-
-# THE CONTAINER NOTICE, AND THIS IS THE SURFACE THAT NEEDS IT MOST. With no
-# `$LANES_WORKSTATION` inside a container the workstation is the CONTAINER'S id,
-# so no row is this workstation's — and the partition then puts EVERY lane under
-# BOUND ELSEWHERE, which is a listing that tells a person their own lanes are
-# somebody else's. Measured in this very repository on 2026-09-14, in a
-# container with the seam unset: one lane, filed elsewhere, with nothing on
-# screen to say why.
-#
-# THE SENTENCE IS ASKED FOR RATHER THAN RESTATED — `lanes` takes it the same way
-# and for the same reason (`lanes:253`): `lanes_workstation_why` is the one
-# wording the writers share, and a copy here would be the drift
-# `test_repo_hygiene.py` holds the four against. The helper prints it on stderr
-# and still answers on stdout, because a read in front of a launch may not
-# refuse; the read above discarded that stderr, so this asks for it again.
-#
-# SAID ONCE PER RUN, because BOTH surfaces that need it can be reached in ONE
-# run: the listing prints it under the rows, and the branch a mis-filed lane
-# takes prints it above its own refusal. A person who picked a number out of a
-# listing that had already explained itself does not need the paragraph twice.
-ws_notice_said=0
-ws_notice() {
-	[ "$ws_notice_said" = 0 ] || return 0
-	case "$ws_src" in
-	container-unset)
-		ws_notice_said=1
-		say ""
-		"$LANES_EDIT" workstation 2>&1 >/dev/null || : ;;
-	esac
-}
-
-# ------------------------------------------------------------------- the read
-#
-# THE SAME ROWS `lanes` RENDERS, THROUGH THE SAME READ. `lanes_rows` is the one
-# implementation of what a lane's row is (clause (h)'s rule, and A11 Addendum 4
-# ruling 7's for column 10); this word renders a SUBSET of them with a number in
-# front. A second read here would be a second thing to drift.
-#
-# LOCAL, LIKE EVERY READ IN THIS FAMILY: it sits in front of a launch and a
-# person typing one word wants an answer now. `lanes --fetch` is the refresh,
-# and it is one word away.
-#
-# AND THE CODE DECIDES, NOT THE EMPTINESS OF THE OUTPUT (Amendment 7(d), the
-# fail-closed family): `0` rows · `8` none · `2` A HELPER PREDATING THE READ ·
-# `64` a usage error of the read's own · anything else A READ THAT FAILED, which
-# is never "there are no lanes" and never a pick this word prints empty.
-ROWS_OUT=""
-# AND WHETHER THE PROOF WAS MADE AT ALL. `lanes_rows` says on STDERR — and goes
-# on answering — that this workstation's session records could not be read, in
-# which case its STATE column is the LOG'S VERB ALONE: *"a lane that is live may
-# show as IDLE or PAUSED here"* (`lanes-edit.sh:4628`). An `IDLE` row is
-# AVAILABLE only because this host PROVED the binding dead, and that is the
-# proof that did not happen — so launching one would start a second process on a
-# lane that may still be running, which is the collision clause (h) exists for
-# (Copilot round 1 on #45, `lane:777`). The sentence is caught here, where the
-# stderr is already being read, and `go_available` refuses on it.
-#
-# THREE STATES AND NOT TWO (Copilot round 3 on #45, `lane:322`): `0` the proof
-# was made · `1` the helper SAID it could not make it · `2` this command could
-# not read whether it did, because no temporary file could be made to capture
-# the helper's notes. `2` is not `0`: the fall-through Amendment 7(d) forbids is
-# exactly "I did not get the answer, so I will treat it as the good one".
-LIVENESS_UNREAD=0
-read_rows() {   # <args for `lanes-edit.sh lanes`>
-	local rr_rc=0 rr_err_file
-	rr_err_file="$(mktemp "${TMPDIR:-/tmp}/lane-read.XXXXXX" 2>/dev/null || printf '')"
-	if [ -n "$rr_err_file" ]; then
-		ROWS_OUT="$(LANES_NO_FETCH=1 "$LANES_EDIT" lanes "$@" 2>"$rr_err_file")" || rr_rc=$?
-		# The one expected sentence is dropped out of the stream rather than the
-		# stream being dropped for its sake: the helper also says HERE that this
-		# workstation's session records could not be read, which is the line
-		# telling a person that a lane showing IDLE may be live.
-		grep -v -e 'not fetching; reading origin/' -- "$rr_err_file" >&2 || :
-		# `-e`, LIKE THE LINE ABOVE IT: a pattern given as an OPERAND puts the
-		# `--` after one, and BSD's `getopt` reads that as a filename.
-		if grep -q -e "session records could not be read" -- "$rr_err_file"; then LIVENESS_UNREAD=1; fi
-		rm -f -- "$rr_err_file"
-	else
-		# NO TEMPORARY FILE, SO THE HELPER'S NOTES WENT STRAIGHT TO THE TERMINAL
-		# and this command cannot read them back — the same degradation `lanes`
-		# already names for its fetch line. What it must NOT do is read its own
-		# blindness as an answer: whether the liveness proof was made is UNKNOWN
-		# from here, and `go_available` treats unknown as unproved.
-		LIVENESS_UNREAD=2
-		ROWS_OUT="$(LANES_NO_FETCH=1 "$LANES_EDIT" lanes "$@")" || rr_rc=$?
-	fi
-	case "$rr_rc" in
-	0) return 0 ;;
-	8) ROWS_OUT=""; return 8 ;;
-	64) die "bad arguments for the lane read — see $prog --help" 64 ;;
-	2) die "the \`lanes-edit.sh\` on this workstation has no \`lanes\` subcommand, so it
-    predates lane-collision-protocol Amendment 11. That is not a failure and
-    nothing is wrong with the register — this workstation has not taken the
-    install yet. Take it:  openRepoTools --install" 2 ;;
-	*) die "$LANES_EDIT lanes failed (exit $rr_rc). That is NOT 'there are no lanes', and
-    this command will not offer a pick — or a lane — on an answer it did not get
-    (Amendment 7(d)). Run it by hand to see what it says, then re-run." 1 ;;
-	esac
-}
-
-# THE GROUPING IS THE HELPER'S AND NOT THIS RENDERER'S, for the reason column 10
-# is (A11 Addendum 4 ruling 7): two surfaces computing one partition is how they
-# come to disagree about which lanes are free. `lane-groups` reads the rows this
-# command has already paid for, on stdin, and answers `<group><TAB><row>`.
-# CALLED THROUGH `$( )`, SO ITS STATUS IS READ BY EVERY CALLER. A `die` inside a
-# command substitution exits the SUBSHELL and leaves this process carrying on
-# with an empty answer — the trap `lanes-edit.sh` states for `row_line` and
-# `canon_lane` — so every caller spells it `x="$(group_rows)" || exit $?`. The
-# refusal has already gone to stderr from inside the subshell; what the status
-# carries is that there WAS one.
-group_rows() {   # rows in $ROWS_OUT → `<group><TAB><row>`
-	local gr_rc=0 gr_out
-	gr_out="$(printf '%s\n' "$ROWS_OUT" | "$LANES_EDIT" lane-groups "$ws" 2>/dev/null)" || gr_rc=$?
-	# (`$gr_rc` is the helper's own, because `set -o pipefail` is on and the
-	# `printf` cannot fail.)
-	case "$gr_rc" in
-	0) printf '%s' "$gr_out" ;;
-	2) die "the \`lanes-edit.sh\` on this workstation has no \`lane-groups\` subcommand, so
-    it predates lane-collision-protocol Amendment 18 Addendum 1 and the pick
-    cannot be grouped here. That is not a failure and nothing is wrong with the
-    register. Take the install:  openRepoTools --install
-    Until then the same rows are a read:  lanes" 2 ;;
-	*) die "$LANES_EDIT lane-groups failed (exit $gr_rc). That is NOT 'no lane is
-    available' (Amendment 7(d)), and this command will not print a pick with a
-    group missing from it. Run it by hand to see what it says, then re-run." 1 ;;
-	esac
-}
-
-# ------------------------------------------------------------------ the scope
-#
-# THE BARE WORD INSIDE A LANE CHECKOUT NARROWS TO THAT REPOSITORY, exactly as
-# `lanes` does and for the settlement's own reason (2026-09-13T20:38:11Z,
-# verbatim "Narrow inside a checkout (Recommended)"). The narrowing is the
-# read's own: `--dir` is the checkout around the cwd, `--repo` is that
-# checkout's `origin`, and the two are an OR — a lane's home repository and the
-# checkout it sits in are not the same fact. `--prefix` is the third term and
-# the label fallback.
-#
-# THE REPOSITORY IS THE ONE `origin` NAMES and the directory's name is the
-# fallback: inside a worktree `basename $(git rev-parse --show-toplevel)` is the
-# WORKTREE's name, which narrows to a repository no lane can be named for.
-origin_nwo() {
-	local url nwo
-	url="$(git -C "${1:-.}" remote get-url origin 2>/dev/null || :)"
-	[ -n "$url" ] || return 1
-	nwo="$(printf '%s\n' "$url" | sed -E 's#\.git$##; s#^git@[^:]+:##; s#^ssh://[^/]+/##; s#^https?://[^/]+/##')"
-	printf '%s\n' "$nwo" | grep -qE '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$' || return 1
-	printf '%s\n' "$nwo"
-}
-
-here_repo=""; here_root=""; here_nwo=""
-scope_args=()
-if [ "$all_given" = 1 ]; then
-	scope_args=(--all)
-elif [ -z "$name" ]; then
-	here_root="$(git rev-parse --show-toplevel 2>/dev/null || :)"
-	if [ -n "$here_root" ]; then
-		here_nwo="$(origin_nwo "$here_root" 2>/dev/null || :)"
-		if [ -n "$here_nwo" ]; then here_repo="${here_nwo#*/}"; else here_repo="$(basename -- "$here_root")"; fi
-		scope_args=(--dir "$here_root" --prefix "$here_repo")
-		if [ -n "$here_nwo" ]; then scope_args+=(--repo "$here_nwo"); fi
-	fi
-fi
-
-# ------------------------------------------------------------ the row's parts
-#
-# Clause (j)'s ten columns and the read's two additions, in the read's order:
-#   1 lane · 2 state · 3 workstation · 4 profile · 5 window · 6 last uuid ·
-#   7 directory · 8 objects · 9 age · 10 the one act for it · 11 home ·
-#   12 live forks of its transcript · 13 whether this place may pronounce on
-#   that binding (Amendment 18(b): `here`, `elsewhere`, or `none` for a row
-#   with no binding line at all)
-# AND AMENDMENT 19's FOUR: 14 the row's class (`closed`, `dormant` or `none`) ·
-# 15 its `started` cell · 16 its state cell's head · 17 the flag words in that
-# cell. A closed or dormant row never reaches this word — `lanes_rows` leaves
-# them out of the listing and `lane_groups` drops them by class as well — but
-# the four fields are READ here all the same, for the rule below.
-#
-# THE LAST NAME MUST BE THE LAST COLUMN, and that is not a style point: `read`
-# puts every remaining field into its final variable, so a column added to the
-# read and not to this list arrives glued to the one before it. Column 12 is a
-# COUNT and column 13 a word, and `0<TAB>here` is neither. AND NO COLUMN MAY
-# BE EMPTY: a tab is IFS whitespace, so an empty one is no field at all and
-# every name after it takes its neighbour's value — which is why the read
-# prints `none` in 13 rather than leaving it empty.
-R_LANE=""; R_STATE=""; R_WS=""; R_PF=""; R_WIN=""; R_SID=""; R_DIR=""
-R_OBJ=""; R_AGE=""; R_CMD=""; R_HOME=""; R_FK=""; R_LOC=""
-R_CLASS=""; R_START=""; R_WAS=""; R_FLAGS=""
-split_row() {   # <row>
-	IFS="$TAB" read -r R_LANE R_STATE R_WS R_PF R_WIN R_SID R_DIR R_OBJ R_AGE R_CMD R_HOME R_FK R_LOC R_CLASS R_START R_WAS R_FLAGS <<EOF
-${1-}
-EOF
-	case "${R_DIR:-none}" in none) R_DIR="" ;; esac
-	case "${R_PF:-none}" in none) R_PF="" ;; esac
-	case "${R_WIN:-none}" in none) R_WIN="" ;; esac
-	case "${R_HOME:-none}" in none) R_HOME="" ;; esac
-	case "${R_WS:-unknown}" in unknown) R_WS="" ;; esac
-	case "${R_FK:-}" in '' | *[!0-9]*) R_FK=0 ;; esac
-	case "${R_LOC:-none}" in none) R_LOC="" ;; esac
-}
-
-# The repository a row is filed under, for the grouping: the home the log
-# records, and the lane name's `<repo>-` label where it records none. Amendment
-# 7 calls that prefix a label rather than a fact, which is why it is the
-# fallback here and never the override.
-row_repo() {   # <lane> <home>
-	if [ -n "${2-}" ]; then printf '%s' "${2#*/}"; return 0; fi
-	case "${1-}" in
-	*-*) printf '%s' "${1%-*}" ;;
-	*) printf '%s' "${1-}" ;;
-	esac
-}
-
-# ----------------------------------------------------------------- the window
-#
-# THE RECORD'S `tmux` FIELD IS `<session>:<@window>.<%pane>` and the two halves
-# this command needs are the SESSION NAME and the WINDOW ID. The id is what is
-# selected and moved; the session name is what the id is CHECKED AGAINST,
-# because tmux reissues `@` ids from `@0` when its server is replaced — measured
-# on this estate on 2026-09-13, where every one of five recorded windows was
-# `(gone)` and `@71` had since been handed to somebody else. Matching a dead ref
-# is how a lane binds to a stranger's pane, which is the fence clause (b)
-# already states for `window-lane`; this is that fence on the attach.
-W_SESS=""; W_ID=""
-split_window() {   # <window field>
-	W_SESS=""; W_ID=""
-	case "${1-}" in
-	*:*) : ;;
-	*) return 1 ;;
-	esac
-	W_SESS="${1%%:*}"
-	W_ID="${1#*:}"
-	W_ID="${W_ID%%.*}"
-	W_ID="${W_ID%% *}"
-	[ -n "$W_SESS" ] && [ -n "$W_ID" ] || return 1
-	return 0
-}
-
-tmux_here() { [ -n "${TMUX:-}" ] && command -v tmux >/dev/null 2>&1; }
-
-# THE SELECT IS PART OF THE FENCE AND NOT A COURTESY (Copilot round 1 on #45,
-# `lane:610`, critical). Every one of the four attach paths puts the terminal on
-# the lane's OWN window, and three of them do something after it — an `attach`,
-# a `switch-client`, a `move-window`. A select that FAILED and was swallowed
-# leaves the person on whatever window that session left current, which is
-# another lane: the id resolved a moment ago, at the fence above, and does not
-# now. So the failure is a refusal here, in one function, rather than four
-# `|| :`s and one guess.
-# THE TARGET IS SESSION-QUALIFIED, which is the same fence this command applies
-# everywhere else: an `@id` alone leaves tmux to pick the "best" session holding
-# that window, and picking is what the id-AND-session rule exists to stop
-# (Copilot round 2 on #45, `lane:666`). `<session>:<@id>` names both halves, so
-# the act is the one the record described or it is nothing.
-#
-# AND THE SESSION IS THE ONE THE WINDOW IS IN *NOW*. After a `move-window` the
-# window belongs to THIS session and the source may have closed itself behind
-# it, so a refusal naming `$W_SESS` would send a person to a session that is
-# gone (Copilot round 2, `lane:706`). Every caller passes the session it means.
-#
-# AND THE LINE IT OFFERS FIRST KEEPS THE WINDOW IT CHECKED (Copilot round 11 on
-# #45, `lane:499` and `lane:804`). `tmux attach -t <session>` alone lands on
-# whatever that session has since made current — which is the outcome this whole
-# fence exists to stop, offered in the refusal that exists to stop it. The
-# qualified form attaches AND selects in one act (measured, tmux 3.4: `attach -t
-# dst:@2` made `@2` current; `attach -t dst:@3` for a window of another session
-# refused with `can't find window: @3`), so it is either the lane or a refusal,
-# never another lane. The bare session stays UNDER it, said as what it is —
-# whatever that session now holds — because a person who wants it anyway is
-# entitled to type it knowing that.
-select_window_or_refuse() {   # <session> <@id> <what was already done, or "">
-	tmux select-window -t "$1:$2" 2>/dev/null && return 0
-	die "lane $R_LANE's window $2 could not be selected in session $1${3:+ ($3)}. It
-    resolved a moment ago, at the check above, and does not now — so going on
-    would put this terminal on whatever window that session left current, which
-    is another lane, and that is the one thing the id-AND-session fence exists
-    to stop.
-      what the register says now:            lanes --all
-      that window, if it is back:            tmux attach -t $1:$2
-      that session, whatever it now holds:   tmux attach -t $1" 2
-}
-tmux_field() {   # <target> <format>
-	command -v tmux >/dev/null 2>&1 || return 1
-	tmux display-message -p -t "$1" "$2" 2>/dev/null | head -n1
-}
-this_session() {
-	tmux_here || return 0
-	tmux display-message -p '#S' 2>/dev/null || :
-}
-
-# WHERE A LIVE LANE IS, in the words clause (i-1) uses: `window <n> of this
-# session`, or the session it is in, or `detached session <name>`. Read from
-# tmux and never from the record, because the record says where the window WAS.
-where_live() {   # <window field>
-	local wl_now wl_idx wl_att wl_this
-	split_window "${1-}" || { printf 'window %s (not a session:window this word can read)' "${1:-none}"; return 0; }
-	wl_now="$(tmux_field "$W_ID" '#{session_name}' 2>/dev/null || :)"
-	if [ -z "$wl_now" ] || [ "$wl_now" != "$W_SESS" ]; then
-		printf 'its recorded window %s does NOT resolve here now' "$1"
-		return 0
-	fi
-	wl_idx="$(tmux_field "$W_ID" '#{window_index}' 2>/dev/null || :)"
-	wl_this="$(this_session)"
-	if [ -n "$wl_this" ] && [ "$wl_this" = "$W_SESS" ]; then
-		printf 'window %s of this session' "${wl_idx:-?}"
-		return 0
-	fi
-	wl_att="$(tmux_field "$W_SESS" '#{session_attached}' 2>/dev/null || :)"
-	case "${wl_att:-0}" in
-	0 | '') printf 'detached session %s, window %s' "$W_SESS" "${wl_idx:-?}" ;;
-	*) printf 'session %s, window %s' "$W_SESS" "${wl_idx:-?}" ;;
-	esac
-}
-
-# ---------------------------------------------------------------- the branches
-
-# THE SAME RULE AS `group_rows`: read through `$( )`, so the caller takes the
-# status and exits on it rather than `exec`ing an empty string.
-launcher() {
-	local lp="${PCLAUDE:-}"
-	if [ -z "$lp" ]; then
-		lp="$(command -v lclaude 2>/dev/null || command -v pclaude 2>/dev/null || command -v claude-profile 2>/dev/null || printf '')"
-	fi
-	[ -n "$lp" ] || die "there is no launcher on PATH (neither \`lclaude\`, \`pclaude\`, nor \`claude-profile\`), and this
-    command will not run \`claude\` itself: every launch goes through the
-    launcher and therefore through \`lane-start\`, which is what renames the
-    window, stamps the row, extends the session cell and passes \`--name\` so
-    the harness's record name is the lane rather than a derived one. Install the
-    toolset and the launcher, then re-run." 2
-	printf '%s' "$lp"
-}
-
-# AVAILABLE — `restart <lane>`'s whole act, which is where that word went
-# (Amendment 18 Addendum 2). The directory and the profile are the LANE'S OWN
-# RECORD's, out of the row this command has already read: a launch typed
-# anywhere but in the lane's surviving window can learn neither from tmux,
-# because a window reuse or a rename destroys the `claude-<profile>-<ts>-<pid>`
-# session name that was the only place the profile ever appeared.
-go_available() {
-	local ga_dir="$R_DIR" ga_pf="$profile" ga_from="" ga_pclaude dir_for_hint pos lrepo ga_start
-	local ga_cmd ga_why
-	# A LANE IS AVAILABLE BECAUSE THIS HOST PROVED NOTHING IS RUNNING ON IT, and
-	# where the session records could not be read that proof was never made — IN
-	# EVERY STATE, `PAUSED` INCLUDED (Copilot round 4 on #45, `lane:560`).
-	#
-	# THE EXCEPTION ROUND 1 CARVED OUT WAS THE ROW MOST LIKELY TO COLLIDE, and
-	# the evidence is the sentence this file already quotes forty lines above:
-	# *"a lane that is live may show as IDLE OR PAUSED here"* (`lanes-edit.sh:4628`,
-	# the helper's own words). A live record BEATS the log's last verb — *"a lane
-	# whose session is running is LIVE whatever its last written line says;
-	# otherwise the verb answers"* (`lanes-edit.sh:4700`) — so when the live read
-	# fails the verb is ALL that is left, and `/lane-swap` writes the `PAUSED`
-	# line while its session is still on screen. "Parked by its own last line" was
-	# read as a proof; it is a line, and the proof is the read that did not
-	# happen. Every state refuses (clause (h), Amendment 7(d)).
-	if [ "$LIVENESS_UNREAD" != 0 ]; then
-		ga_why="this workstation's session records could NOT be read (the line above)"
-		case "$LIVENESS_UNREAD" in
-		2) ga_why="no temporary file could be made to read the helper's own notes back, so
-    whether those records answered is UNKNOWN from here" ;;
-		esac
-		die "lane $R_LANE reads ${R_STATE:-UNKNOWN}, and $ga_why — so nothing here has
-    PROVED that lane dead, and a lane that is LIVE shows as IDLE or PAUSED when
-    that proof is missing — the helper's own words (\`lanes-edit.sh:4628\`),
-    because a live record beats the log's last verb and the verb is all that is
-    left. This command will not start a second session on a lane that may
-    already be running (clause (h)); that is the collision the whole protocol is
-    about, and a record this command did not read is not an answer (Amendment
-    7(d)).
-      what is actually running:  lanes-edit.sh live-holder $R_LANE
-      fix the read and re-run:   lanes --all
-    A PAUSED row is no exception here: \`/lane-swap\` writes that line while its
-    session is still on screen, so it is the row most likely to be running." 2
-	fi
-	if [ -n "$dir_flag" ]; then ga_dir="$dir_flag"; fi
-	if [ -z "$ga_pf" ]; then ga_pf="$R_PF"; fi
-	# A PROFILE IS NEVER GUESSED. Until a lane has been started once under
-	# Amendment 11 its record carries none, and there is nothing here to derive
-	# one from that would not be a guess: the tmux session name is gone and the
-	# row does not carry it. Launching the WRONG profile is a launch into
-	# another account, so this refuses and names the two lines that work.
-	if [ -z "$ga_pf" ]; then
-		# QUOTED WHERE IT IS A PATH, LEGIBLE WHERE IT IS A PLACEHOLDER (Copilot
-		# round 8 on #45, `lane:612`). A recorded directory with a space in it —
-		# `/work/my lane` — printed bare makes `cd /work/my lane` two arguments, so
-		# the one line this refusal exists to hand over is a line that cannot be
-		# pasted. `%q` through `quoted`, the same helper the dry-run uses; the
-		# placeholder is left as words, because `\<the\ lane\'s\ checkout\>` is
-		# not a thing to type either.
-		dir_for_hint="<the lane's checkout>"
-		[ -z "$ga_dir" ] || dir_for_hint="$(quoted "$ga_dir")"
-		die "lane $R_LANE's record does not name a profile yet, and this command will not guess one:
-    a wrong profile is a launch into another account. It is recorded
-    by \`lane-start\` at the lane's next start and by \`/lane-swap\` at its next
-    swap (Amendment 11 clause (c); nothing is backfilled, Amendment 7(i)).
-
-    Name it yourself, which is the late-swap form this word already takes:
-      $prog $R_LANE <profile>
-    or, one line in the lane's own directory:
-      cd $dir_for_hint && pclaude --lane $R_LANE <profile>" 2
-	fi
-	if [ -z "$ga_dir" ]; then
-		# THE ACT PRINTED IS THE ONE `lane-start` TAKES FOR *THIS* LANE'S NAME
-		# (Copilot round 4 on #45, `lane:595`). A lane whose name is not
-		# `<repo>-<n>` — `browser-ui-repair`, a `--verbatim` row like any other — is
-		# started by the ONE-ARGUMENT form beside a `--dir` (`lane-start:601`), and
-		# appending a position to it names A DIFFERENT LANE: `lane-start
-		# browser-ui-repair 3` is `browser-ui-repair-3`. A refusal whose remedy
-		# records the directory of another lane is worse than no remedy at all.
-		pos="${R_LANE##*-}"; lrepo="${R_LANE%-*}"
-		ga_start="$lrepo $pos"
-		case "${pos%[A-Za-z]}" in '' | *[!0-9]*) ga_start="$R_LANE" ;; esac
-		die "lane $R_LANE's record does not name a directory yet, so this command does not
-    know where to \`cd\` — and a launch that lands in the right transcript and
-    the wrong directory loses the repository's CLAUDE.md and the lane's memory,
-    silently (Evidence 3). Name it once:
-      lane-start --dir <the lane's checkout> $ga_start
-    which RECORDS it in the lane's own log, so every later \`$prog $R_LANE\`
-    reads it back and no one has to be told again (Amendment 11 clause (c);
-    Evidence 7). For this run alone:
-      $prog --dir <the lane's checkout> $R_LANE${profile:+ $profile}" 2
-	fi
-	[ -d "$ga_dir" ] || die "lane $R_LANE's recorded directory does not exist here: $ga_dir
-    That is a refusal naming the path and NEVER a silent re-home: this command
-    will not fall back to a directory that merely has the right name, because
-    \`lane-start\` writes the lane's HOME from that directory's origin and every
-    later line inherits it. A lane parked on ANOTHER WORKSTATION records that
-    machine's path, and what brings the work here is that estate's own
-    \`resume <Name>\`. Then, or for a checkout you already have:
-      $prog --dir <path> $R_LANE" 2
-	ga_pclaude="$(launcher)" || exit $?
-	command -v lane-start >/dev/null 2>&1 || note "\`lane-start\` is not on PATH. The launcher will say what it does about that
-    on its first line; this command does not second-guess it, but a launch
-    without it writes no stamp and leaves the window as it is."
-	ga_cmd=("$ga_pclaude" --lane "$R_LANE")
-	if [ -n "$dir_flag" ]; then ga_cmd=("$ga_pclaude" --lane "$R_LANE" --dir "$dir_flag"); fi
-	ga_cmd+=("$ga_pf")
-	if [ -n "$profile" ]; then ga_from=" · profile named on the command line"
-	else ga_from=" · from the lane record"
-	fi
-	say "lane $R_LANE · dir $ga_dir · profile $ga_pf$ga_from"
-	if [ "$dry_run" = 1 ]; then
-		say "cd $(quoted "$ga_dir")"
-		say "exec $(quoted "${ga_cmd[@]}")"
-		say "--dry-run: nothing was launched"
-		exit 0
-	fi
-	cd -- "$ga_dir"
-	exec "${ga_cmd[@]}"
-}
-
-# LIVE HERE — THE ATTACH, AND NEVER A SECOND PROCESS (clause (h), clause (i-2)).
-# No register or log is written. A verified generic tmux window name may be
-# repaired; the session is already running and the attach starts nothing.
-go_live() {
-	local gl_this gl_now gl_says gl_row gl_cell gl_last gl_record gl_rc
-	local gl_local_row gl_local_cell gl_local_last gl_pub_ids gl_local_ids gl_row_ok gl_local_rc
-	local gl_sid gl_target gl_name gl_pid gl_profile gl_windows gl_id gl_other_name
-	if [ -n "$profile" ]; then
-		die "lane $R_LANE is LIVE HERE under profile ${R_PF:-<none recorded>}, and \`$prog <name>
-    <profile>\` names the profile to LAUNCH under — an attach starts nothing, so
-    there is no account for that argument to change. Changing a live lane's
-    account is a SWAP: \`/lane-swap\` in that session, then
-    \`$prog $R_LANE $profile\` once it is parked. Attach as it is:
-      $prog $R_LANE" 2
-	fi
-	command -v tmux >/dev/null 2>&1 || die "lane $R_LANE is live in ${R_WIN:-a window its record does not name} and there is no
-    \`tmux\` on PATH here, so this command cannot attach to it — and it will not
-    start a second session on a live lane instead (clause (h))." 2
-	split_window "$R_WIN" || die "lane $R_LANE is live, and its record's window field is '${R_WIN:-none}', which is not
-    a \`<session>:<@window>\` this command can attach to. Read the lane:  lanes --all" 2
-	# THE FENCE, AND IT IS THE ONE `window_lane` ALREADY STATES: an `@id` is
-	# matched only where the window now holding it reports the SAME SESSION the
-	# record named. tmux reissues ids from `@0` when its server is replaced, so
-	# attaching on the id alone binds this word to whatever pane has since been
-	# given it.
-	gl_now="$(tmux_field "$W_ID" '#{session_name}' 2>/dev/null || :)"
-	if [ -z "$gl_now" ] || [ "$gl_now" != "$W_SESS" ]; then
-		gl_says="the id $W_ID names no window on this tmux server at all"
-		if [ -n "$gl_now" ]; then gl_says="the id $W_ID is in session $gl_now and the record says $W_SESS"; fi
-		die "lane $R_LANE's recorded window $R_WIN does not resolve here now: $gl_says.
-    tmux reissues \`@\` ids from \`@0\` when its server is replaced, so attaching
-    on the id alone would put you in whatever pane has since been given it —
-    this command will not guess which window is the lane's.
-      its session, if it is still there:  tmux attach -t $W_SESS
-      what the register says now:         lanes --all" 2
-	fi
-	# A window ID is not enough to make this the lane. A /clear or profile
-	# switch can leave a live transcript newer than the row, and a renamed
-	# session can belong to another lane. The prompt guard would refuse both;
-	# do not conceal either mismatch by renaming the window on the way in.
-	gl_row="$(LANES_NO_FETCH=1 "$LANES_EDIT" register-row "$R_LANE" 2>/dev/null)" ||
-		die "lane $R_LANE has no readable register row, so its live window cannot be bound safely. Read it with: lanes --all" 2
-	gl_cell="$(printf '%s\n' "$gl_row" | awk -F'|' 'NR == 1 { print $3 }')"
-	gl_last="$(printf '%s\n' "$gl_cell" | grep -Eoi '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tail -n1 || :)"
-	gl_pub_ids="$(printf '%s\n' "$gl_cell" | grep -Eoi '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tr 'A-F' 'a-f' | tr '\n' ' ' || :)"
-	gl_local_rc=0
-	gl_local_row="$("$LANES_EDIT" register-row-local "$R_LANE" 2>/dev/null)" || gl_local_rc=$?
-	case "$gl_local_rc" in
-	0)
-		gl_local_cell="$(printf '%s\n' "$gl_local_row" | awk -F'|' 'NR == 1 { print $3 }')"
-		gl_local_last="$(printf '%s\n' "$gl_local_cell" | grep -Eoi '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tail -n1 || :)"
-		gl_local_ids="$(printf '%s\n' "$gl_local_cell" | grep -Eoi '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tr 'A-F' 'a-f' | tr '\n' ' ' || :)" ;;
-	8) gl_local_last=""; gl_local_ids="" ;;
-	*) die "lane $R_LANE's local register row could not be read (exit $gl_local_rc). Nothing was renamed or attached." 2 ;;
-	esac
-	gl_rc=0
-	gl_record="$("$LANES_EDIT" window-session "$W_SESS:$W_ID" 2>/dev/null)" || gl_rc=$?
-	[ "$gl_rc" = 0 ] && [ -n "$gl_record" ] ||
-		die "lane $R_LANE's window $W_SESS:$W_ID has no provable live session (record read exit $gl_rc). Nothing was renamed or attached. In that window, repair the binding with: lane-start --no-launch $R_LANE" 2
-	IFS="$US" read -r gl_sid gl_target gl_name gl_pid gl_profile <<EOF
-$gl_record
-EOF
-	# A local stamp can be newer than the published row. Accept only a copy
-	# whose UUID history extends the other; divergent histories are not proof.
-	gl_row_ok=0
-	if [ "$(lc "$gl_sid")" = "$(lc "$gl_last")" ]; then
-		if [ "$gl_local_rc" = 8 ]; then
-			gl_row_ok=1
-		else
-			case " $gl_pub_ids" in " $gl_local_ids"*) gl_row_ok=1 ;; esac
-		fi
-	fi
-	if [ "$(lc "$gl_sid")" = "$(lc "$gl_local_last")" ]; then
-		case " $gl_local_ids" in " $gl_pub_ids"*) gl_row_ok=1 ;; esac
-	fi
-	if [ "$gl_row_ok" != 1 ] || [ "$(lc "$gl_name")" != "$(lc "$R_LANE")" ]; then
-		die "lane $R_LANE's window $W_SESS:$W_ID holds transcript ${gl_sid:-unknown} named '${gl_name:-none}', but the published/local row ends in ${gl_last:-none}/${gl_local_last:-none}, or their UUID histories diverge. Nothing was renamed or attached. In that window, record the live transcript with: lane-start --no-launch $R_LANE" 2
-	fi
-	# tmux permits duplicate names. Distinct @window IDs are the units here:
-	# one linked window may be visible in more than one session.
-	gl_windows="$(tmux list-windows -a -F "#{window_id}${TAB}#{window_name}" 2>/dev/null)" ||
-		die "tmux could not list window names, so uniqueness of $R_LANE is unknown. Nothing was renamed or attached." 2
-	while IFS="$TAB" read -r gl_id gl_other_name; do
-		[ -n "$gl_id" ] || continue
-		if [ "$gl_id" != "$W_ID" ] && [ "$(lc "$gl_other_name")" = "$(lc "$R_LANE")" ]; then
-			die "another tmux window ($gl_id) is already named $gl_other_name. Lane window names must be unique in this tmux server; nothing was renamed or attached." 2
-		fi
-	done <<EOF
-$gl_windows
-EOF
-	gl_name="$(tmux_field "$W_SESS:$W_ID" '#{window_name}' 2>/dev/null || :)"
-	[ -n "$gl_name" ] || die "tmux could not read the name of $W_SESS:$W_ID; nothing was renamed or attached." 2
-	if [ "$gl_name" != "$R_LANE" ]; then
-		if [ "$(lc "$gl_name")" != "$(lc "$R_LANE")" ]; then
-			# A tmux name may contain spaces or punctuation that a lane name
-			# cannot. Such a name cannot have a register row; only ask the
-			# register when the name is lane-shaped.
-			case "$gl_name" in
-			"" | *[!A-Za-z0-9._-]* | .* | -*) : ;;
-			*)
-				gl_rc=0
-				LANES_NO_FETCH=1 "$LANES_EDIT" register-row "$gl_name" >/dev/null 2>&1 || gl_rc=$?
-				# THE PUBLISHED ROW IS ONLY ONE OF TWO (#138 item 13, Copilot round 19
-				# on #93): a lane whose `add-row` or session stamp is committed here
-				# and not yet pushed already owns its window name, and `register-row`
-				# answers 8 for it. The target-row validation above asks both copies;
-				# so does this, and a local read that failed is not "no row".
-				if [ "$gl_rc" = 8 ]; then
-					gl_rc=0
-					"$LANES_EDIT" register-row-local "$gl_name" >/dev/null 2>&1 || gl_rc=$?
-				fi
-				case "$gl_rc" in
-				0) die "window $W_SESS:$W_ID is named $gl_name, which has its own lane row. Renaming it to $R_LANE would take another lane's tmux address; nothing was renamed or attached." 2 ;;
-				8) : ;;
-				*) die "whether window name $gl_name belongs to another lane could not be read from the published or the local register (exit $gl_rc). Nothing was renamed or attached." 2 ;;
-				esac ;;
-			esac
-		fi
-		if [ "$dry_run" = 1 ]; then
-			say "tmux rename-window -t $W_SESS:$W_ID $R_LANE (currently '$gl_name')"
-		else
-			tmux rename-window -t "$W_SESS:$W_ID" "$R_LANE" ||
-				die "tmux could not rename $W_SESS:$W_ID to $R_LANE; nothing was attached." 2
-			[ "$(tmux_field "$W_SESS:$W_ID" '#{window_name}' 2>/dev/null || :)" = "$R_LANE" ] ||
-				die "the rename of $W_SESS:$W_ID did not read back as $R_LANE; nothing was attached." 2
-		fi
-	fi
-	gl_this="$(this_session)"
-	if [ -z "$gl_this" ]; then
-		# OUTSIDE TMUX: the window is selected first, so the attach lands ON the
-		# lane rather than on whichever window that session left current.
-		say "lane $R_LANE is live in session $W_SESS — attaching (nothing is launched)"
-		if [ "$dry_run" = 1 ]; then
-			say "tmux select-window -t $W_SESS:$W_ID"
-			say "exec tmux attach -t $W_SESS:$W_ID"
-			say "--dry-run: nothing was attached"
-			exit 0
-		fi
-		# THE ATTACH NAMES THE WINDOW AND NOT ONLY THE SESSION (Copilot round 6 on
-		# #45, `lane:708`). A select and then an attach are TWO acts, and a window
-		# that closes between them leaves `attach -t <session>` on whatever that
-		# session has since made current — another lane, which is the one thing the
-		# id-AND-session fence exists to stop. MEASURED, tmux 3.4 on a private
-		# socket, 2026-09-14: with `dst` current on `@0`, `attach -t dst:@2`
-		# attached AND made `@2` current in ONE act, and `attach -t dst:@3` naming a
-		# window of ANOTHER session refused with `can't find window: @3`. The select
-		# above stays: it is this command's own refusal, in this command's words,
-		# while there is still a terminal to print it on — and the attach then
-		# resolves the same `<session>:<@id>` at the moment it acts.
-		select_window_or_refuse "$W_SESS" "$W_ID" ""
-		exec tmux attach -t "$W_SESS:$W_ID"
-	fi
-	if [ "$gl_this" = "$W_SESS" ]; then
-		say "lane $R_LANE is a window of this session — selecting it (nothing is launched)"
-		if [ "$dry_run" = 1 ]; then
-			say "tmux select-window -t $W_SESS:$W_ID"
-			say "--dry-run: nothing was selected"
-			exit 0
-		fi
-		select_window_or_refuse "$W_SESS" "$W_ID" ""
-		exit 0
-	fi
-	if [ "$switch" = 1 ]; then
-		# THE SELECT COMES FIRST AND THE SWITCH ONLY FOLLOWS ONE THAT WORKED
-		# (Copilot round 3 on #45, `lane:687`). `select-window` names the session it
-		# acts on and needs no client there, so the lane's own window is made that
-		# session's current window BEFORE this client is moved into it. Switching
-		# first and selecting after leaves a client that LOST THE RACE sitting on
-		# whatever window that session left current — another lane, and this
-		# terminal already in it — which is the one thing the id-AND-session fence
-		# exists to stop. Ordered this way a select that fails costs nothing: the
-		# client has not moved.
-		say "lane $R_LANE is in session $W_SESS — switching this client to it (nothing is launched)"
-		if [ "$dry_run" = 1 ]; then
-			say "tmux select-window -t $W_SESS:$W_ID"
-			say "tmux switch-client -t $W_SESS:$W_ID"
-			say "--dry-run: nothing was switched"
-			exit 0
-		fi
-		# AND THE SWITCH NAMES THE WINDOW, for the reason the attach does (Copilot
-		# round 7 on #45, `lane:738`): another client can make that session's
-		# current window something else between the select and the switch, and a
-		# `switch-client -t <session>` would then land this client on it. MEASURED,
-		# tmux 3.4 on a private socket, 2026-09-14: a client on `home`, `dst`
-		# current on `@1`, and `switch-client -t dst:@3` moved the client to `dst`
-		# AND made `@3` current in ONE act, while `switch-client -t dst:@999`
-		# refused with `can't find window: @999` and exit 1.
-		select_window_or_refuse "$W_SESS" "$W_ID" ""
-		tmux switch-client -t "$W_SESS:$W_ID" || die "lane $R_LANE's window $W_ID was selected in session $W_SESS, and \`tmux
-    switch-client -t $W_SESS:$W_ID\` then failed — so this client is still where
-    it was and nothing else was done. That session's current window IS the lane
-    now, which is the half that worked:
-      go there by hand:            tmux switch-client -t $W_SESS:$W_ID
-      or bring the window here:    $prog $R_LANE" 2
-		exit 0
-	fi
-	# THE MOVE, PROVED BY HAND ON 2026-09-14: `move-window -a -s <session>:<@id>`
-	# brings the window into THIS session after the current one, and
-	# `select-window -t <session>:<@id>` puts the terminal on it. A detached
-	# session whose only window moves closes itself, which is the tidy end of a
-	# lane that was left in one.
-	#
-	# THE SOURCE IS THE `@id` AND NEVER THE INDEX (Copilot round 4 on #45,
-	# `lane:715`). An index read one command before it is used is a name another
-	# window can be given in between, and the fence above proved the `@id` — not
-	# a number. MEASURED, tmux 3.4 on a private socket, 2026-09-14: with `w3` at
-	# `src:2`, killing it and opening another window at that index and then
-	# `move-window -a -s src:2` MOVED THE INTRUDER into the destination and
-	# exited 0 — the wrong window, here, silently — while `move-window -a -s
-	# src:@2` on that same estate refused with `can't find window: @2` and exit 1.
-	# tmux resolves a `<session>:<@id>` inside the session named or not at all,
-	# which is the whole of the fence, and a move that fails is a refusal: the
-	# select below runs only on one that worked.
-	say "lane $R_LANE is in session $W_SESS — moving its window here and selecting it (nothing is launched)"
-	if [ "$dry_run" = 1 ]; then
-		say "tmux move-window -a -s $W_SESS:$W_ID"
-		say "tmux select-window -t $gl_this:$W_ID"
-		say "--dry-run: nothing was moved"
-		exit 0
-	fi
-	tmux move-window -a -s "$W_SESS:$W_ID" || die "lane $R_LANE's window $W_ID could not be moved out of session $W_SESS into this one,
-    so NOTHING was moved and this terminal is where it was. It resolved a moment
-    ago, at the check above, and tmux refuses a \`<session>:<@id>\` whose window
-    is no longer in that session — which is the fence doing its work rather than
-    a fault.
-      what the register says now:            lanes --all
-      that window, if it is back:            tmux attach -t $W_SESS:$W_ID
-      that session, whatever it now holds:   tmux attach -t $W_SESS" 2
-	select_window_or_refuse "$gl_this" "$W_ID" "its window was moved here out of $W_SESS, which may have closed behind it"
-	exit 0
-}
-
-# BOUND ELSEWHERE — CLAUSE (c)'s QUESTION, WHICH EXISTS NOW. This word never
-# offers a launch here: a second session on a lane another place holds is the
-# collision the whole protocol is about. What it offers is the REQUEST — *"the
-# second place asks"* — and the request is `lanes-edit.sh request-handoff`,
-# which writes the line, pushes it, types `/handoff --exit requested by …` into
-# the bound pane where that pane is on this tmux server, and waits. The
-# mechanism is there and the QUESTION is here, in this word's own terms, because
-# `lane-start` asks it in its own and one mechanism with two doors is the rule
-# clause (h) gives every read in this family.
-#
-# THE GROUPING PUT THIS LANE HERE BY THE REGISTER'S WORKSTATION COLUMN; THE
-# BINDING READ IS WHAT THE QUESTION IS ASKED ABOUT. The two can disagree — a row
-# filed on another workstation whose log's last lane-kind line released the
-# binding is FREE, and asking a place that is not holding it for a handoff it
-# cannot give is a question nobody can answer. So the read decides, and an
-# already-free lane goes to the available branch it belonged in.
-go_elsewhere() {
-	local ge_out="" ge_rc=0 ge_ask="" ge_answer="" ge_facts=""
-	local ge_host ge_cont ge_win ge_utc ge_sess ge_os ge_where ge_wstate
-	local ge_wsess="" ge_wid=""
-	local ge_rh ge_rh_rc
-	# AND THE CONTAINER NOTICE BELONGS HERE MOST OF ALL, not only under the
-	# listing. With no `$LANES_WORKSTATION` inside a container the workstation is
-	# the CONTAINER'S id, so NO row is this workstation's — and the partition then
-	# files a person's OWN lane under this heading, which makes the sentence below
-	# name a machine they are sitting at. `lane <name>` reaches this refusal
-	# WITHOUT passing through the listing, so a notice printed only beneath the
-	# rows never reaches the person who typed the name; and the pick reaches both,
-	# which is what `ws_notice`'s once-per-run guard is for. On stderr, because
-	# the refusal under it is.
-	ws_notice >&2
-	# LOCAL, LIKE EVERY READ IN THIS WORD, and the fetch that matters is one
-	# layer down rather than missing: this read decides WHAT to ask and which
-	# facts to print, and `request-handoff` — the act it leads to — fetches for
-	# itself before it writes a line, so a binding this checkout has not pulled
-	# the release of answers 8 there and this branch takes the available one.
-	# The other direction is `lane-start`'s: it reads the binding after a fetch
-	# before it binds anything, so nothing is taken on a stale answer either.
-	ge_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" binding "$R_LANE" 2>/dev/null)" || ge_rc=$?
-	case "$ge_rc" in
-	0) : ;;
-	8)
-		note "lane $R_LANE's row is filed on ${R_WS:-another workstation}, and its own log says the binding has been RELEASED — so there is nothing there to ask for and this is an available lane after all (Amendment 18(b))."
-		go_available
-		return 0 ;;
-	2)
-		die "lane $R_LANE is bound on ${R_WS:-a workstation this row does not name}${R_WIN:+, window $R_WIN}, and
-    this workstation's \`lanes-edit.sh\` has no \`binding\` read, so it predates
-    lane-collision-protocol Amendment 18 and cannot ask that place for the
-    handoff. That is not a failure and nothing is wrong with the register —
-    this workstation has not taken the install yet. Take it:
-      openRepoTools --install
-    Until then the exit is a person on ${R_WS:-that workstation} parking it:
-    \`/handoff\` in that session, after which \`$prog $R_LANE\` takes it here." 2 ;;
-	*)
-		die "where lane $R_LANE is bound could not be read: \`lanes-edit.sh binding\` exited
-    $ge_rc. That is NOT 'it is bound nowhere' (Amendment 7(d)), and this command
-    will not ask a place it cannot name for a handoff — nor bind a lane on an
-    answer it did not get. Run it by hand to see what it says:
-      $LANES_EDIT binding $R_LANE" 1 ;;
-	esac
-	IFS="$TAB" read -r ge_host ge_cont ge_win ge_utc ge_sess ge_os ge_where ge_wstate <<EOF
-$ge_out
-EOF
-	ge_facts="lane $R_LANE is bound to window ${ge_win:-none} in container ${ge_cont:-none} on host ${ge_host:-unknown} (session ${ge_sess:-unknown}, last line ${ge_utc:-unknown}); this tmux server says that window is ${ge_wstate:-unknown}"
-	# AND WHERE THAT WINDOW IS LIVE ON THIS TMUX SERVER, THE ATTACH IS STILL
-	# OFFERED (Copilot round 2 on openRepoTools#83). A binding in another
-	# container of this host is not this place's to pronounce on — that is why
-	# the row is here rather than under LIVE HERE — but one host's launcher
-	# mounts ONE socket into every container it starts, so the pane exists and
-	# putting a terminal in front of it STARTS NOTHING. Watching a lane and
-	# taking it are two different acts, and only the second is the collision.
-	#
-	# AND THE TARGET IS `<session>:<@id>`, READ FROM THE LOG'S OWN SHAPE (Copilot
-	# round 11 on openRepoTools#83, `lane:952`). `binding` prints the log's
-	# `window` sub-field, Amendment 11(c)'s `<session>:<index> <@id>`, and NOT the
-	# live record's `<session>:<@id>.<%pane>` that `split_window` reads — through
-	# it, `cloudsess:4 @62` became `cloudsess:4`, the INDEX, which tmux can give
-	# another window between this read and the act. The id is what
-	# `binding_window_state` matched to say `live` — it answers `unknown` for a
-	# field with no `@id` — so it is the id that is offered, split the way
-	# `lanes-edit.sh lanes` column 10 splits the same field.
-	ge_watch=""
-	case "$ge_win" in *:*' @'[0-9]*) ge_wsess="${ge_win%%:*}"; ge_wid="${ge_win##* }" ;; esac
-	if [ "$ge_wstate" = live ] && [ -n "$ge_wsess" ] && [ -n "$ge_wid" ]; then
-		if [ -n "$(this_session)" ]; then ge_watch="tmux switch-client -t $ge_wsess:$ge_wid"
-		else ge_watch="tmux attach -t $ge_wsess:$ge_wid"
-		fi
-	fi
-	# A BINDING THIS HOST PROVES DEAD IS NOT A BINDING TO ASK ABOUT. One host's
-	# launcher mounts ONE tmux socket into every container it starts, so a
-	# window that is gone from this server is a pane no session can be in —
-	# clause (b)'s one exception, and the takeover path this word already has.
-	if [ "$ge_wstate" = gone ]; then
-		note "$ge_facts — and a window that is gone from this tmux server is clause (b)'s one DEAD binding, because one host's launcher mounts one socket into every container it starts. Taking it here."
-		go_available
-		return 0
-	fi
-	if [ -n "$force_why" ]; then
-		ge_ask=force
-	elif [ "$request_flag" = 1 ]; then
-		ge_ask=yes
-	elif [ -t 0 ]; then
-		say ""
-		say "$ge_facts."
-		[ -z "$ge_watch" ] || say "to WATCH it where it is, which starts nothing:  $ge_watch"
-		printf 'ask it to hand off, then bind here? [y/N] '
-		IFS= read -r ge_answer || ge_answer=""
-		case "$(lc "$ge_answer")" in y | yes) ge_ask=yes ;; *) ge_ask=no ;; esac
-	else
-		ge_ask=no-terminal
-	fi
-	if [ "$ge_ask" = no ] || [ "$ge_ask" = no-terminal ]; then
-		die "$ge_facts.
-    A lane has ONE binding and this is not it (Amendment 18(b)), so nothing here
-    was launched, attached or written. Liveness is pronounced only from inside
-    that binding's own host and container — from here it is UNKNOWN and never
-    dead, whatever a \`kill -0\` of a pid in another namespace would say.
-      ask that place for the handoff, and wait for it:
-        $prog --request-handoff $R_LANE
-      or take it anyway, which is a SECOND invocation and never automatic, and
-      which makes that place STOP loudly rather than silently:
-        $prog --force \"<why you are taking it>\" $R_LANE${ge_watch:+
-      or WATCH it where it is, which starts nothing and takes nothing:
-        $ge_watch}
-      what the register says:  lanes --all
-      who holds it:            lanes-edit.sh who --lane $R_LANE" 2
-	fi
-	ge_rh=("$LANES_EDIT" request-handoff "$R_LANE")
-	if [ "$ge_ask" = force ]; then ge_rh+=(--force "$force_why")
-	else ge_rh+=(--wait "$handoff_wait")
-	fi
-	[ "$dry_run" = 0 ] || ge_rh+=(--dry-run)
-	say "$(quoted "${ge_rh[@]}")"
-	ge_rh_rc=0
-	"${ge_rh[@]}" || ge_rh_rc=$?
-	case "$ge_rh_rc" in
-	0 | 8) say "lane $R_LANE is free — taking it here." ;;
-	2) die "the handoff was not obtained (the facts and the \`--force\` line are above), so lane
-    $R_LANE is still bound elsewhere and nothing here was launched or attached." 2 ;;
-	*) die "\`$LANES_EDIT request-handoff $R_LANE\` exited $ge_rh_rc, which is neither 'the lane is
-    free' nor the refusal that says it is not. Nothing was launched or attached." 1 ;;
-	esac
-	if [ "$dry_run" = 1 ]; then
-		say "--dry-run: nothing was requested, launched or attached"
-		exit 0
-	fi
-	go_available
-	return 0
-}
-
-# A NEW LANE AT THE NEXT FREE POSITION — the `f` answer. The position comes from
-# the helper, over the rows this command has already read, so the number this
-# word offers and the one `lanes` prints cannot differ.
-go_new() {   # <repo>
-	local gn_repo="${1-}" gn_next gn_start gn_rc
-	local gn_cmd
-	[ -n "$gn_repo" ] || die "there is no repository in scope, so there is no position for \`f\` to take.
-    Stand in the lane's checkout, or name it:  lane-start <repo> <n>" 2
-	# THE STATUS IS READ, NOT DISCARDED (Copilot round 3 on #45, `lane:751`): a
-	# read that FAILED can still have printed digits before it did, and `|| :`
-	# handed them to the validation below as if they were an answer — a position
-	# this estate may well have taken, opened as a new lane.
-	gn_rc=0
-	gn_next="$(printf '%s\n' "$ROWS_OUT" | "$LANES_EDIT" next-free "$gn_repo" 2>/dev/null)" || gn_rc=$?
-	# AND `2` IS THE CONTRACT'S OWN CODE HERE TOO (Copilot round 12 on #45,
-	# `lane:873`). The LISTING has told the two apart since round 3 — an
-	# un-upgraded workstation is named as one and sent to the install, a read that
-	# FAILED is named by its code — and this path, which is the same read one
-	# answer later, collapsed both into "run it by hand". The person who typed `f`
-	# on a workstation that has not taken the install would have been told to read
-	# something that does not exist there.
-	if [ "$gn_rc" = 2 ]; then
-		die "\`f\` cannot open a lane here: this workstation's \`lanes-edit.sh\` has no
-    \`next-free\`, so it predates lane-collision-protocol Amendment 18 Addendum 1
-    and there is no position for it to take. That is not a failure and nothing is
-    wrong with the register — this workstation has not taken the install yet.
-    Take it:  openRepoTools --install" 2
-	fi
-	if [ "$gn_rc" != 0 ]; then
-		die "the next free position of $gn_repo could not be read: \`lanes-edit.sh next-free\`
-    exited $gn_rc. This command will not open a lane at a position it did not
-    get (Amendment 7(d)) — a number printed by a read that then failed is not an
-    answer. Read it:  lanes --prefix $gn_repo" 1
-	fi
-	case "${gn_next:-}" in
-	'' | *[!0-9]*) die "the next free position of $gn_repo could not be read, and this command will not
-    offer a position it did not get (Amendment 7(d)). Read it:  lanes --prefix $gn_repo" 1 ;;
-	esac
-	# BESIDE THIS COMMAND FIRST, THEN PATH — the rule this file already states
-	# for `$LANES_EDIT` fifty lines above, and for the same reason: `--install`
-	# places the two in ONE directory, and a workstation carrying two copies
-	# must not read its rows from one and open its lane with the other (Copilot
-	# round 1 on #45, `lane:701`).
-	if [ -x "$selfdir/lane-start" ]; then gn_start="$selfdir/lane-start"
-	else gn_start="$(command -v lane-start 2>/dev/null || printf '')"
-	fi
-	[ -n "$gn_start" ] || die "no \`lane-start\` on PATH, and it is what opens a lane — it is installed beside
-    this command by \`openRepoTools --install\`. Run that, then re-run." 2
-	# AND `--dir` GOES WITH IT. The flag is in this command's own parser and
-	# `lane-start` takes the same one, so dropping it here would open the new
-	# lane in a checkout the person did not name — silently, which is Evidence
-	# 3's loss (Copilot round 1 on #45, `lane:710`).
-	gn_cmd=("$gn_start")
-	if [ -n "$dir_flag" ]; then gn_cmd+=(--dir "$dir_flag"); fi
-	gn_cmd+=("$gn_repo" "$gn_next")
-	say "a new lane at $gn_repo-$gn_next${dir_flag:+ · dir $dir_flag}"
-	if [ "$dry_run" = 1 ]; then
-		say "exec $(quoted "${gn_cmd[@]}")"
-		say "--dry-run: nothing was started"
-		exit 0
-	fi
-	exec "${gn_cmd[@]}"
-}
-
-# A ROW WHOSE STATE IS ITS OWN CELL IS SHOWN AND NEVER BOUND (#89). Where a
-# lane's log has no lane-kind line, `lanes_rows` reads the STATE out of the
-# row's Amendment 13(a) cell and prints it as `<WORD> (row)` — `PAUSED (row)`
-# for a row `migrate-state-cells` left parked — and `lane-groups` files it
-# `rowonly`. The pick never numbers that group, and a lane NAMED here arrives in
-# it and is refused: a log with no lane-kind line records no directory, no
-# profile and no binding, so there is nothing to resume, and a launch on a
-# word no log wrote is a resume of nothing. The refusal names the read, and the
-# act by hand that gives the lane its first lane-kind line.
-go_rowonly() {
-	die "lane $R_LANE reads ${R_STATE:-a state from its row}: that is its register row's own
-    state cell (Amendment 13(a)), shown because its log has no lane-kind line —
-    no STARTED, PAUSED or RESUMED — to give a state of its own. So there is
-    nothing here to resume: no recorded directory, profile or binding, and this
-    command will not launch a lane on a word no log wrote. Nothing was launched.
-      what the row says:   lanes-edit.sh register-row $R_LANE
-      start it by hand, in its own checkout, and \`lane-start\` records its
-      first lane-kind line:
-        cd <the lane's checkout> && pclaude --lane $R_LANE <profile>" 2
-}
-
-# THE ONE DISPATCH, so the three branches are chosen in ONE place whether the
-# lane was picked by number or named on the command line — and the one group
-# that is not a branch is refused here too, for the same reason.
-go_row() {   # <group> <row>
-	split_row "$2"
-	case "$1" in
-	available) go_available ;;
-	live) go_live ;;
-	elsewhere) go_elsewhere ;;
-	rowonly) go_rowonly ;;
-	*) die "lane $R_LANE is in state '${R_STATE:-unknown}', which this command has no branch
-    for. Read it:  lanes --all" 1 ;;
-	esac
-}
-
-# --------------------------------------------------------------- `lane <name>`
-#
-# A LANE NAME IS ONE NAME UNDER ANY CASE (Amendment 15), and the spelling the
-# REGISTER ROW carries is the canonical one. `canon-lane` answers that — one
-# resolver, shared — and every line below this one then speaks of the lane by
-# the row's own spelling: what is `cd`'d for, what is handed to the launcher as
-# `--lane`, what is attached to and what every refusal names.
-#
-# THE ONE-LANE READ FOLLOWS IT, on the canonical name: it reads ONE log rather
-# than the estate's, which is the whole reason that selector exists. THE
-# ESTATE-WIDE READ UNDER IT IS THE FALLBACK AND NOT THE RESOLVER — it fires only
-# where the one-lane read came back knowing NOTHING of the lane, which after
-# `canon-lane` means a workstation whose `lanes-edit.sh` predates Amendment 15
-# and answered 2 as an unknown subcommand. So the ordinary path pays for one
-# read, an un-upgraded one pays for two, and neither can give a different answer
-# from the other about which lane was meant.
-if [ -n "$name" ]; then
-	# AMENDMENT 15 FIRST, BECAUSE THE ROW'S SPELLING IS THE LANE'S NAME. *"A lane
-	# name is one name under any case"* (ratified 2026-09-14T00:07:18Z verbatim
-	# "Ratify as drafted"), and `lanes-edit.sh canon-lane` is the ONE resolver
-	# every command that takes a `<lane>` shares — for the reason clause (h) gives
-	# every other read here: an implementation of *which row is this name's* in
-	# each command is how they come to disagree about it. This is `restart`'s own
-	# call, moved here with the act under Amendment 18 Addendum 2.
-	#
-	# `2` IS TWO ANSWERS AND ONE OF THEM IS A REFUSAL. It is what a helper
-	# predating Amendment 15 spends on an unknown subcommand — silent, expected,
-	# and a fall-through — and it is also `canon-lane`'s OWN refusal for a
-	# register that spells one lane two ways, which no read below can resolve and
-	# which only a person's 15(d) merge settles. The two are told apart by the
-	# refusal's own words, which no un-upgraded helper emits, and the pair is
-	# RELAYED rather than reported as a read that failed.
-	cl_out=""; cl_rc=0
-	cl_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" canon-lane "$name" 2>/dev/null)" || cl_rc=$?
-	cl_why=""; cl_pair=0
-	if [ "$cl_rc" = 2 ]; then
-		cl_why="$(LANES_NO_FETCH=1 "$LANES_EDIT" canon-lane "$name" 2>&1 >/dev/null || :)"
-		case "$cl_why" in *"Amendment 15(d)"*) cl_pair=1 ;; esac
-	fi
-	if [ "$cl_pair" = 1 ]; then
-		printf '%s\n' "$cl_why" >&2
-		die "the PUBLISHED register spells lane $name two ways (above), so no read under that
-    name is unambiguous and this command will not bind a lane it cannot name —
-    Amendment 15(d): merge the newer row's session id(s) into the older row's
-    session cell, in order, remove the newer row in the SAME commit naming both
-    spellings, and re-run. Nothing was launched and nothing was attached." 2
-	fi
-	# AND A RESOLVER THAT *FAILED* IS NOT "THE TYPED SPELLING WILL DO" (Copilot
-	# round 11 on #45, `lane:956`). Only two statuses are answers here: `0`, the
-	# row's own spelling, and the unknown-subcommand `2` of a helper predating
-	# Amendment 15, which is the documented fall-through to the estate-wide read
-	# below — told apart from `canon-lane`'s OWN 2 by the 15(d) words, one branch
-	# up. Anything else is a read that did not answer, and this command binds no
-	# lane under a name nothing established (Amendment 7(d), the same rule the row
-	# read, the grouping read and the position read each take in this file).
-	# AND 66 IS THE ONE THAT HAS A NAME (Amendment 16(e), Copilot round 4 on
-	# openRepoTools#81): the lane ALIAS table could not be read, so a former name
-	# resolves to nothing and this command would bind a lane under a spelling
-	# that may belong to a row under another one. It falls into the refusal below
-	# with every other unanswered read, which is where it belongs.
-	if [ "$cl_rc" != 0 ] && [ "$cl_rc" != 2 ]; then
-		die "the register's spelling of lane $name could not be read: \`lanes-edit.sh canon-lane\`
-    exited $cl_rc. A lane name is ONE name under any case (Amendment 15) and the
-    row's own spelling is the one every read and every write goes under — so
-    this command will not bind a lane under a spelling nothing has established
-    (Amendment 7(d)). Nothing was launched and nothing was attached.
-      run it by hand to see what it says:  $LANES_EDIT canon-lane $name
-      what the register says now:          lanes --all" 1
-	fi
-	if [ "$cl_rc" = 0 ] && [ -n "$cl_out" ] && [ "$cl_out" != "$name" ]; then
-		note "lane $name → $cl_out (Amendment 15: the register row's spelling is canonical)"
-		name="$cl_out"
-	fi
-	read_rows --lane "$name" || :
-	row="$(printf '%s\n' "$ROWS_OUT" | awk -F"$TAB" 'NF >= 2 { print; exit }')"
-	split_row "${row:-}"
-	state_now="$R_STATE"
-	case "${state_now:-}" in
-	'' | UNKNOWN | 'NO LOG')
-		# Nothing of this lane's own was found under the name the resolver
-		# returned — which on an upgraded workstation is the row's own spelling
-		# and on an older one is still the spelling that was typed. Ask the
-		# estate, where every spelling the register and the logs carry is a row.
-		all_rc=0
-		read_rows --all || all_rc=$?
-		match=""
-		if [ "$all_rc" = 0 ]; then
-			match="$(printf '%s\n' "$ROWS_OUT" | awk -F"$TAB" -v w="$(lc "$name")" 'NF >= 2 && tolower($1) == w { print; exit }')"
-		fi
-		if [ -n "$match" ]; then
-			row="$match"
-			split_row "$row"
-		elif [ -z "$state_now" ] || [ "$state_now" = UNKNOWN ]; then
-			die "no lane called '$name' is in the register or the logs.
-    The lanes of this checkout:  $prog
-    Every lane:                  $prog --all
-    Open a new one:              lane-start <repo> <n>" 2
-		fi ;;
-	esac
-	# The group is the helper's, over this one row, so a named lane and a picked
-	# one cannot take different branches — and a CLOSED lane has no group at all,
-	# which is the answer rather than a branch.
-	ROWS_OUT="$row"
-	grouped="$(group_rows | awk -F"$TAB" 'NF >= 2 { print; exit }')" || exit $?
-	[ -n "$grouped" ] || die "lane $R_LANE's last act was its last — the read calls it ${R_STATE:-closed} — so there
-    is nothing to bind. A closed lane is not reopened by picking it:
-      lane-start <repo> <n>
-    What it did:  lanes-edit.sh who --lane $R_LANE" 8
-	go_row "${grouped%%$TAB*}" "${grouped#*$TAB}"
-	exit 0
-fi
-
-# -------------------------------------------------------------------- the pick
-
-rows_rc=0
-read_rows ${scope_args[@]+"${scope_args[@]}"} || rows_rc=$?
-grouped_all=""
-if [ "$rows_rc" = 0 ]; then grouped_all="$(group_rows)" || exit $?; fi
-
-PICK_GROUP=(); PICK_ROW=()
-n=0
-# ONE HEADING PER STATE, IN CLAUSE (i-1)'s ORDER — available, live here, bound
-# elsewhere — and WITHIN a heading, grouped by repository wherever the listing
-# is not already one repository's. That is the `--all` half of (i-1): "every
-# repository, grouped". The read's own order is newest activity first and it is
-# kept inside each repository, which is why the sort carries the read's sequence
-# as its second key rather than re-ordering by name.
-render_group() {   # <group> <heading>
-	local rg_line rg_row rg_seq=0 rg_repo rg_last="" rg_list=""
-	while IFS= read -r rg_line; do
-		[ -n "$rg_line" ] || continue
-		case "$rg_line" in "$1$TAB"*) : ;; *) continue ;; esac
-		rg_row="${rg_line#*$TAB}"
-		split_row "$rg_row"
-		rg_seq=$((rg_seq + 1))
-		rg_list="${rg_list}$(row_repo "$R_LANE" "$R_HOME")$TAB$rg_seq$TAB$rg_row
-"
-	done <<EOF
-$grouped_all
-EOF
-	[ -n "$rg_list" ] || return 0
-	if [ -z "$here_repo" ]; then
-		rg_list="$(printf '%s' "$rg_list" | LC_ALL=C sort -t"$TAB" -k1,1 -k2,2n)"
-	fi
-	say ""
-	say "$2"
-	while IFS= read -r rg_line; do
-		[ -n "$rg_line" ] || continue
-		rg_repo="${rg_line%%$TAB*}"
-		rg_row="${rg_line#*$TAB}"; rg_row="${rg_row#*$TAB}"
-		split_row "$rg_row"
-		if [ -z "$here_repo" ] && [ "$rg_repo" != "$rg_last" ]; then
-			say "  $rg_repo"
-			rg_last="$rg_repo"
-		fi
-		n=$((n + 1))
-		PICK_GROUP+=("$1")
-		PICK_ROW+=("$rg_row")
-		case "$1" in
-		available) printf '  %2s  %-24s %-8s %-12s %s\n' "$n" "$R_LANE" "$R_STATE" "${R_PF:-no profile}" "${R_DIR:-no directory recorded}" ;;
-		live) printf '  %2s  %-24s %s\n' "$n" "$R_LANE" "$(where_live "$R_WIN")" ;;
-		*) printf '  %2s  %-24s %-8s %s\n' "$n" "$R_LANE" "${R_WS:-unknown}" "${R_WIN:+window $R_WIN}" ;;
-		esac
-		# A LIVE FORK OF A LANE'S TRANSCRIPT IS A DEFECT TO RETIRE AND NEVER A
-		# HOLDER (ratified decision 8(e)), and it is shown where a person is
-		# choosing what to bind. The one act is clause (k) rule (e)'s, and it is
-		# `lane-end`'s door rather than a read that names them.
-		case "$R_FK" in
-		0) : ;;
-		*) printf '      DEFECT: %s live fork(s) of this lane transcript — never a holder; retire each: lane-end %s --retire <pid|uuid>\n' "$R_FK" "$R_LANE" ;;
-		esac
-	done <<EOF
-$rg_list
-EOF
-}
-
-label=""
-if [ -n "$here_repo" ]; then label=" of $here_repo"; fi
-say "lanes$label, read locally — \`lanes --fetch\` refreshes first"
-render_group available "AVAILABLE — parked, or a binding this host proves dead"
-# AND WHERE THE PROOF WAS NOT READ, THIS HEADING SAYS WHAT IT COSTS (Copilot
-# round 5 on #45, `lanes-edit.sh:4829`). The partition itself is right and is
-# ONE read: `lane-groups` groups by the STATE column, and when the session
-# records could not be read that column is the LOG'S VERB ALONE — so every row
-# under this heading is unproven and `go_available` refuses each of them, in
-# every state (clause (h)). A listing that numbered them without a word would be
-# asking a person to pick an answer this command has already decided to refuse.
-avail_n="$n"
-if [ "$LIVENESS_UNREAD" != 0 ] && [ "$avail_n" != 0 ]; then
-	say ""
-	say "  NOTHING above can be launched from here until that read is fixed: the STATE"
-	say "  column is the log's own last verb, so a lane that is LIVE shows as IDLE or"
-	say "  PAUSED, and picking one of these is REFUSED rather than launched (clause (h),"
-	say "  Amendment 7(d)). A LIVE HERE lane below is unaffected — an attach starts"
-	say "  nothing."
-	say "    what is actually running:  lanes-edit.sh live-holder <lane>"
-	say "    fix the read and re-run:   lanes --all"
-fi
-render_group live "LIVE HERE — attach, never a second process"
-render_group elsewhere "BOUND ELSEWHERE — ask that workstation for the handoff"
-
-# AND WHEN IT CANNOT BE READ THE PICK SAYS SO (Copilot round 3 on #45,
-# `lane:960`). `|| :` collapsed every status of this read into an empty string
-# and the `f` answer then vanished from the question with nothing on screen to
-# say why — the same defect `lanes`'s footer had one file over, and the same
-# answer: `2` is an un-upgraded workstation and says so, anything else names the
-# code it got, and neither is a position of 1.
-next_free=""; next_free_rc=0
-if [ -n "$here_repo" ]; then
-	next_free="$(printf '%s\n' "$ROWS_OUT" | "$LANES_EDIT" next-free "$here_repo" 2>/dev/null)" || next_free_rc=$?
-	# THE STATUS DECIDES BEFORE THE TEXT DOES (Copilot round 5 on #45,
-	# `lane:1000`). A read that printed digits AND THEN FAILED passes the shape
-	# test below on its own output, so the fail-closed arm under it was skipped
-	# and `f` was offered at a position nothing answered for — which is the very
-	# thing `go_new` stopped doing one round earlier (round 3, `lane:751`). The
-	# offer and the answer read the same status now.
-	[ "$next_free_rc" = 0 ] || next_free=""
-	case "${next_free:-}" in '' | *[!0-9]*) next_free="" ;; esac
-fi
-
-if [ "$n" = 0 ]; then
-	say ""
-	say "no lane$label is available, live here or bound elsewhere."
-	say "  every lane, closed and dormant ones included:  lanes --all"
-fi
-if [ -n "$here_repo" ] && [ -z "$next_free" ]; then
-	say ""
-	case "$next_free_rc" in
-	2)
-		say "  \`f\` is not offered: this workstation's \`lanes-edit.sh\` has no \`next-free\`, so"
-		say "  it predates lane-collision-protocol Amendment 18 Addendum 1. Take the"
-		say "  install and the answer comes back:  openRepoTools --install" ;;
-	*)
-		say "  \`f\` is not offered: \`lanes-edit.sh next-free\` exited $next_free_rc and gave no"
-		say "  position, and this command will not offer one it did not get (Amendment"
-		say "  7(d)). Read it by hand:  lanes --prefix $here_repo" ;;
-	esac
-fi
-ws_notice
-
-# ONE QUESTION, AND ONLY WHERE THERE IS A TERMINAL TO ASK IT ON (clause (i-3)).
-# `[ -t 0 ]` is the whole test: an agent's stdin is not a terminal, and an agent
-# reading this output is owed the ACTS filled in rather than a prompt nothing
-# will answer.
-if [ ! -t 0 ]; then
-	say ""
-	say "nothing was asked: stdin is not a terminal. The acts, filled in:"
-	# AND THE ACTS CARRY THE `--dir` THIS RUN WAS GIVEN (Copilot round 5 on #45,
-	# `lane:1030`). The `f` answer has taken it since round 1 (`lane:710`), and an
-	# act PRINTED for a person to type that drops it opens the new lane in
-	# whatever checkout they happen to be standing in — Evidence 3's silent loss,
-	# at the one moment a lane is created. One surface performed the act and the
-	# other printed it; they spell it the same way now.
-	nt_dir=""; nt_sw=""
-	if [ -n "$dir_flag" ]; then nt_dir=" --dir $(quoted "$dir_flag")"; fi
-	# …AND `--switch`, WHICH IS A DIFFERENT ATTACH AND NOT A PREFERENCE (Copilot
-	# round 8 on #45, `lane:1123`). Typing back a `lane <name>` that lost it MOVES
-	# a live lane's window into this session instead of switching the client to
-	# it — a different act on somebody's terminal. It goes on the `lane` line
-	# alone: `lane-start` has no such flag.
-	if [ "$switch" = 1 ]; then nt_sw=" --switch"; fi
-	# …AND AMENDMENT 18(c)/(e)'s THREE, on the same rule. A suggested line that
-	# lost `--request-handoff` asks a person to type a command that refuses; one
-	# that lost `--force` asks them to type a command that does not take the
-	# lane. Both are acts on somebody else's session, so neither is a preference
-	# to be dropped.
-	if [ "$request_flag" = 1 ]; then nt_sw="$nt_sw --request-handoff"; fi
-	if [ -n "$force_why" ]; then nt_sw="$nt_sw --force $(quoted "$force_why")"; fi
-	if [ "$handoff_wait" != 300 ]; then nt_sw="$nt_sw --wait $handoff_wait"; fi
-	if [ "$n" != 0 ]; then printf '    %-34s %s\n' "$prog$nt_dir$nt_sw <name>" "the lane you want, from the list above"; fi
-	if [ -n "$next_free" ]; then printf '    %-34s %s\n' "lane-start$nt_dir $here_repo $next_free" "a new lane at the next free position"; fi
-	printf '    %-34s %s\n' "lanes --all" "every lane the register and the logs know"
-	if [ "$n" = 0 ]; then exit 8; fi
-	exit 0
-fi
-
-say ""
-if [ -n "$next_free" ]; then
-	if [ "$n" = 0 ]; then
-		printf 'which? [f = a new lane at the next free position (%s-%s), q] ' "$here_repo" "$next_free"
-	else
-		printf 'which? [1-%s, f = a new lane at the next free position (%s-%s), q] ' "$n" "$here_repo" "$next_free"
-	fi
-else
-	if [ "$n" = 0 ]; then exit 8; fi
-	printf 'which? [1-%s, q] ' "$n"
-fi
-# ONE ANSWER, READ ONCE (clause (i-1): "asks ONE question"). A picker that
-# re-asks is a process holding the terminal, which is the thing ratified
-# decision 3 refused: this reads one line, acts on it, and where it is not one
-# of the choices it says so and stops — the next act is a command the person
-# types.
-answer=""
-IFS= read -r answer || answer=q
-answer="${answer#"${answer%%[![:space:]]*}"}"
-answer="${answer%"${answer##*[![:space:]]}"}"
-
-case "$(lc "$answer")" in
-q | '')
-	say "nothing picked."
-	if [ "$n" = 0 ]; then exit 8; fi
-	exit 0 ;;
-f)
-	go_new "$here_repo" ;;
-esac
-case "$answer" in
-'' | *[!0-9]*)
-	die "'$answer' is not one of the choices. One answer is read and nothing is waiting
-    now: run \`$prog\` again, or name the lane — \`$prog <name>\`." 2 ;;
-esac
-# A DIGIT STRING TOO LONG TO BE A POSITION IS NOT A POSITION (Copilot round 12
-# on #45, `lane:1215`). `$(( 10#… ))` WRAPS at the shell's integer width —
-# `18446744073709551617` comes back as `1` — so an answer far outside `1-N`
-# could arrive at the range check as a number that IS in it and bind a lane
-# nobody picked, which is the wrong-lane outcome every fence in this file exists
-# to stop. The length is compared BEFORE the conversion, against the digits of
-# `$n` itself, because that is the widest answer the question offered.
-if [ "${#answer}" -gt "${#n}" ]; then
-	die "'$answer' is not in 1-$n. One answer is read and nothing is waiting now: run
-    \`$prog\` again, or name the lane — \`$prog <name>\`." 2
-fi
-pick=$((10#$answer))
-if [ "$pick" -lt 1 ] || [ "$pick" -gt "$n" ]; then
-	die "$pick is not in 1-$n. One answer is read and nothing is waiting now: run
-    \`$prog\` again, or name the lane — \`$prog <name>\`." 2
-fi
-i=$((pick - 1))
-go_row "${PICK_GROUP[$i]}" "${PICK_ROW[$i]}"
-exit 0
diff --git a/lane-end b/lane-end
deleted file mode 100755
index 08fec0c0..00000000
--- a/lane-end
+++ /dev/null
@@ -1,2546 +0,0 @@
-#!/usr/bin/env bash
-#
-# lane-end — the LAST act of a lane: say in the register that the window is
-# closing and that nothing is in flight, and refuse to say it while something
-# still is.
-#
-# It NEVER renames the tmux window. The name is the lane's history until the
-# next `lane-start` takes that window, and a window renamed back to `claude`
-# is a window nobody can attribute.
-#
-# PROTOCOL  ~/.agents/protocols/lane-collision-protocol.md
-#   Rule 4 — a lane appends its row when it starts and UPDATES THAT ROW WHEN
-#     IT STOPS; the register is the last file a lane writes.
-#   Rule 6 — a row reads LANDING from the moment the lane posts LANDING on a
-#     PR until it posts LANDED. Other lanes hold their merges while it does,
-#     so a lane that ends without closing its landing window stalls the
-#     estate. That is what this script's refusal is for.
-#   Rule 9 + Amendment 5 — the write is one commit, made by lanes-edit.sh.
-#   Amendment 7 (DRAFT 2026-09-11) — the refusal is now EXACT, read from the
-#     lane's own object log rather than guessed at by substring; the lane's
-#     last act is an `ENDED` (or `RETIRED`) line in that log; and the handoff
-#     fragment the next session needs is GENERATED from it, on stdout.
-#
-# USAGE
-#   lane-end [options] <lane>            # lane-end openRepoShape-2
-#   lane-end <lane> --inventory-only     # end it past the CLOSE-OUT GATE: its
-#                                        # trees, branches, scratch and caches
-#                                        # stay where they are, and the row and
-#                                        # the ENDED line say so (#163)
-#   lane-end <lane> --retire <pid|uuid>  # retire a live FORK: writes nothing and
-#                                        # kills nothing
-#   lane-end <lane> --retire <pid>       # a DUPLICATE of the lane's id: TERMs a
-#                                        # background holder's pair, only reports
-#                                        # any other; the row is not written
-#   lane-end --retire-dormant <repo> [--reason "<why>"] [--yes]
-#                                        # the DORMANT rows of one repository,
-#                                        # dry run by default; --yes is ONE
-#                                        # commit (Amendment 19(c))
-#   lane-end [options] <repo> <n>        # the split form works too
-#   lane-end [options] <n>               # <repo> = basename of the cwd's git root
-#
-# One argument is taken VERBATIM as the lane name, so the rows named before
-# the `<repo>-<n>` rule (`browser-ui-repair`, `hermes-wallet-exercise`) can be
-# ended too — their last act is exactly what this is for.
-#
-# OPTIONS
-#   --retire            write the state cell as RETIRED rather than ENDED — the
-#                       lane is not coming back, as opposed to a window that is
-#                       only closing for the night. Since Amendment 13(a) that
-#                       is the SAME write as the closing one (the cell is one
-#                       phrase that set-row-state replaces), not a second act
-#   --retire <pid|uuid> A DIFFERENT ACT for one of THREE kinds of target, and
-#                       it ends nothing in the LANE'S ROW on any of them: for a
-#                       live FORK of this lane's transcript it is the DOOR to
-#                       Amendment 6(d)'s retire act (Amendment 11 clause
-#                       (k) rule (e) — "both print the one act: retire it,
-#                       under Amendment 6(d) … Neither kills a process … and
-#                       lane-end's --retire is the door"). For a FORK — a live
-#                       session under an id the row does NOT record, wearing
-#                       this lane's title (decision 8(e)) — it PROVES the pid
-#                       or uuid is one and prints 6(d) for it filled in, the
-#                       /rename for a session with a prompt or 6(d)'s "ended"
-#                       for a kind: bg holder that has none; it writes NOTHING
-#                       (a RETIRED carrying a payload would be a seventh edit
-#                       to in-force text: Amendment 7(b) gives RETIRED no
-#                       payload and A11 clause (c) keeps it that way) and it
-#                       KILLS NOTHING there. The other two kinds both answer
-#                       Amendment 18(h) — exactly one live process may hold one
-#                       transcript — from two different kinds of evidence, and
-#                       this door runs both because neither can see what the
-#                       other does:
-#                         * a DUPLICATE HOLDER — a live `--fork-session`
-#                           process under an id the row DOES record, found in
-#                           the PROCESS TABLE (opensoft/openRepoTools#39) — is
-#                           a background wrapper nobody is answering a prompt
-#                           in, so this act TERMs the bg-pty-host parent and
-#                           EVERY child of it that resumes this transcript
-#                           (opensoft/openRepoTools#86; never the lane's own
-#                           live session, which it refuses to touch), reports
-#                           each pid it signalled, and says RETIRED only once
-#                           every one is gone. Named by the PARENT or any
-#                           CHILD PID and never by the transcript uuid
-#                           (Copilot round 9, PR #61) — the same reason a
-#                           DUPLICATE below never is: the uuid IS the row's
-#                           own and cannot distinguish two process-table
-#                           holders (or a duplicate beside a not-yet-bound
-#                           fork) that carry the identical id;
-#                         * a DUPLICATE — any other live process carrying the
-#                           row's own id, found by SESSION RECORD
-#                           (opensoft/openRepoTools#39, Amendment 12/#52),
-#                           which also catches an ordinary INTERACTIVE second
-#                           resume the process-table match was never built to
-#                           see — is reported and never killed, exactly like a
-#                           FORK, because it may have a prompt open; the
-#                           lane's OWN session, in its own window, is refused
-#                           by name (retiring the session that IS the lane is
-#                           how a lane loses the conversation it is — end the
-#                           lane instead, the bare form above), and the
-#                           harness's OWN COMPANION of that session — the
-#                           `kind: bg` record beside it in the same profile,
-#                           Amendment 8 ruling (g) — is refused by name too:
-#                           it is one half of the live session and not a
-#                           rival to it. A DUPLICATE is named by its PID and
-#                           never by a uuid, because its uuid IS the row's
-#                           own and could not pick between the processes
-#                           carrying it; the uuid form above is for a FORK,
-#                           whose id is one the row does not record.
-#                       Refuses on anything that is none of the three, and on
-#                       any of the reads failing — a read that failed is not
-#                       "it is not one". `lanes-edit.sh forks <lane>`,
-#                       `lanes-edit.sh duplicate-holder <lane>` and
-#                       `lanes-edit.sh transcript-holders <uuid>` (the last
-#                       against the row's own id, via `last-session <lane>`)
-#                       are the reads that name them.
-#   --state-was <text>  ACCEPTED AND IGNORED since Amendment 13(a). It named the
-#                       exact text `--retire` had to replace, back when the cell
-#                       was the row's history and retiring meant flipping the
-#                       one word it opened with. The cell is now one phrase and
-#                       the closing write carries RETIRED itself
-#   --force             end the lane even though its object log still shows
-#                       something open, and say so in the lines written. It
-#                       does not pass the close-out gate: that is the next word
-#   --inventory-only    THE DOOR PAST THE CLOSE-OUT GATE (below): end the lane
-#                       although the sweep still finds trees, branches, scratch
-#                       or caches of it on disk, refused the lane, or could not
-#                       be read. Nothing on disk is touched and the trees stay
-#                       in the lane's #97 inventory, where the daily report
-#                       lists them as an ended lane's; the row's closing phrase
-#                       and the lane's ENDED (or RETIRED) line say that this
-#                       door was taken and what the gate found. Where the gate
-#                       passes it changes nothing
-#   --sweep             NOT BUILT, and refused with that said. Retiring the
-#                       trees in the same run as the ending is not one act:
-#                       `lane-worktrees sweep <lane> --yes` retires them first,
-#                       on its own; the word is held here so that nothing else
-#                       takes it meanwhile
-#   --home owner/repo   the lane's home repo, for a PRE-CUTOVER lane whose log
-#                       has no STARTED line. Accepted for parity with `claim`
-#                       and `who` and passed through to the helper; lane-end's
-#                       own reads are of canonical object keys, so it changes
-#                       nothing they do. It is CHECKED FIRST, through the
-#                       writer's own `resolve-home`, because the only line it
-#                       reaches is written after the row is already closed
-#   --retire-dormant <repo>
-#                       A THIRD ACT, and it ends no lane either: the SWEEP of
-#                       lane-collision-protocol Amendment 19(c). A DORMANT row
-#                       is one with NO object log and no live session here — a
-#                       lane from before Amendment 7 gave every lane a log, or
-#                       one whose log was never created. No `lane-end <lane>`
-#                       can close those: this command wants a live session or a
-#                       log to write into, and they have neither, so they sit at
-#                       the top of every `lanes` and the next free position is
-#                       read past them. Without `--yes` this is a DRY RUN that
-#                       names every dormant row of `<repo>` with its start, its
-#                       workstation and the head of its state cell, and FLAGS
-#                       each row whose cell says the work was unpushed, lost, a
-#                       loss or owed, or still says LIVE — so a person sees what
-#                       the sweep will close before it closes it. With `--yes`
-#                       it is ONE commit (`lanes-edit.sh retire-rows`): each
-#                       lane's log is created with a single `RETIRED` line
-#                       carrying the reason and the row's own last words, and
-#                       the row's state becomes `RETIRED · <UTC> · <why>;
-#                       was: <head>`. It REFUSES a lane a live session holds
-#                       here and a row whose log says the lane is parked, and it
-#                       touches NO file outside the register and the logs —
-#                       worktrees, branches and handoffs stay exactly where they
-#                       are. An agent's stdin is not a terminal, so `--yes` is a
-#                       word a PERSON types.
-#   --reason "<why>"    the words the sweep writes into each RETIRED line and
-#                       into each row's state cell. `--retire-dormant` only
-#   --yes               make the sweep the one act. `--retire-dormant` only
-#   --dry-run           print what would be written; write nothing
-#   -h, --help
-#
-# THE REFUSAL
-#   EXACT, from `lanes/log/<lane>.md` (Amendment 7): every object whose LAST
-#   event in this lane's own log is OPEN — `CLAIMED`, `TAKEOVER`, `OPENED`,
-#   `LANDING` or `WITHDRAWN` — is still this lane's, and each one is named. No
-#   substring, no guessing, and no false refusal on a row that merely says the
-#   words. The rows are read from `origin/main` through `lanes-edit.sh
-#   lane-objects`, which answers 8 when the lane has no log at all and 0 with
-#   the rows otherwise; ANY other exit is the helper failing, and this script
-#   refuses rather than treating a failure as an absence.
-#
-#   THE FALLBACK, and only for a lane with NO log file — one that has not
-#   written a line since the cutover: the old scan of the state cell for the
-#   protocol's own words, in which the LAST LANDING or CLAIMED not followed by
-#   a LANDED or RELEASED is something in flight. Phrases that SAY there is
-#   nothing open — `NOTHING CLAIMED`, `NO LANDING OPEN`, `LANDING WITHDRAWN`,
-#   `UNCLAIMED` and their kin — are removed before that scan, because rows are
-#   full of them and a substring match on CLAIMED inside NOTHING CLAIMED would
-#   refuse on every healthy lane. That scan reads TWO cells — this checkout's
-#   row and the PUBLISHED one (`lanes-edit.sh register-row`, which fetches and
-#   reads `origin/main`, like every other state read) — and either of them
-#   showing a hold is a refusal. A fetch does not move the working tree, so a
-#   peer's LANDING pushed on to this row was invisible to the one path that
-#   still decides a merge hold from prose.
-#
-# THE CLOSE-OUT GATE (opensoft/openRepoTools#163)
-#   After the in-flight guard and before any write, the lane's own leftovers
-#   are asked about: `lane-worktrees sweep <lane> --branches --include-scratch
-#   --include-caches --dry-run --porcelain`, which exits 0 (nothing of the
-#   lane's to retire), 3 (something to retire) or 2 (refused, or a read
-#   failed). 3 and 2 are a REFUSAL, exit 2, naming every tree, branch, scratch
-#   directory and cache the table gives the lane, the sweep's own reason where
-#   it refused, and the exact sweep command; any other exit, or no
-#   `lane-worktrees` at all, is a gate nobody read (exit 1), never a pass.
-#   Beside the sweep's table, this command makes two reads of its own:
-#     * every tree of the lane's is read with `git status --porcelain
-#       --ignored`, so a tree holding nothing but ignored files (an `.env`, a
-#       `node_modules`) is named as holding them, never as clean;
-#     * every entry directly under the lane's own root, `.lane-worktrees/
-#       <lane>/`, that the table does not name as a tree, scratch or a cache is
-#       RESIDUE - ignored leftovers the sweep's rows never reach - and refuses
-#       even where the sweep answered 0, as a cache row does.
-#   Where the lane's checkout is an ASSEMBLY (T018, opensoft/openRepoTools#186)
-#   the sweep also prints a `leg` row per leg checkout: one it counts is named
-#   as a leg checkout whose remedy is a person's — no sweep acts on a leg — and
-#   one that holds work and is not this lane's is listed and NOT counted.
-#   `--inventory-only` is the one way past it, and `--sweep` is not built.
-#
-# THE HANDOFF FRAGMENT
-#   On STDOUT, generated from the lane's log, and partitioned by the same two
-#   sets the refusal uses, so no object can fall out of both:
-#     `## Done` — RELEASED, CLAIM-LOST, CLOSED, LANDED
-#     `## Open` — CLAIMED, TAKEOVER, OPENED, LANDING, WITHDRAWN
-#   A `CLAIMED` another lane has since taken over is listed under `## Open` as
-#   `superseded by TAKEOVER (lane:X) — release it`, because it is this lane's
-#   last line on the object and only this lane's `release` closes it — but it is
-#   not work the next session still holds, and a handoff that said it was would
-#   send that session at an object `who` gives to somebody else.
-#   (There is no `MERGED`: Rule 6's `LANDED → <sha>` is the post-merge line.
-#   `WITHDRAWN` is OPEN — a withdrawn landing leaves the PR held by the lane
-#   that withdrew it.) Paste it into the handoff the row points at. It is the
-#   ONLY thing this script writes to stdout; every step and every refusal
-#   still goes to stderr.
-#
-# EXIT
-#   0  done
-#   1  environment — no register, no writer, `lanes-edit.sh lane-objects`
-#      failed (which is NOT the same as the lane having no object log), or the
-#      close-out gate could not be read (no `lane-worktrees`, or an exit that
-#      is none of its three)
-#   2  refusal — bad arguments, no row (or two), something still in flight, or
-#      the close-out gate: the lane's trees, branches, scratch, caches or
-#      residue still on disk, or the sweep refusing the lane
-#   8  nothing there. `--retire-dormant`: no lane of that repository is
-#      recorded, or none of its rows is DORMANT. `--retire <pid|uuid>`: nothing
-#      of any kind is live for the lane
-#   130, 143  stopped by INT or TERM (128 plus the signal): the run ends where
-#      the signal found it and removes its temporary file, never resumes
-#
-# ENVIRONMENT
-#   LANES_FILE  default <the workspace repository>/lanes/LANES.md
-#   LANES_EDIT  default lanes-edit.sh beside this command
-#   LANE_WORKTREES  default lane-worktrees beside this command: the close-out
-#               gate's sweep
-#   LANES_WORKSPACE_ROOT  the workspace repository, overriding workspace.yaml's
-#               `path:` — the test seam
-#   AGENT_PROTOCOL_ROOT   dir holding workspace.yaml (default ~/.agents)
-#   OPENREPOTOOLS_BIN_DIR where `--install` put the commands (default
-#               ~/.local/bin) — searched for lanes-edit.sh
-#
-# It spells no absolute path of its own. Since Amendment 9(a) the register is
-# found through `$AGENT_PROTOCOL_ROOT/workspace.yaml` rather than beside this
-# file — this is an installed command now — and its WRITER is found beside it,
-# because `--install` places the two together.
-
-set -euo pipefail
-
-prog=lane-end
-
-SELF="${BASH_SOURCE[0]}"
-RESOLVED="$(readlink -f -- "$SELF" 2>/dev/null || printf '%s' "$SELF")"
-SCRIPT_DIR="$(cd -- "$(dirname -- "$RESOLVED")" && pwd)"
-
-# --- THE WORKSPACE REPOSITORY (lane-collision-protocol Amendment 9(a)) -------
-#
-# The person's data — the register `lanes/LANES.md`, the object logs
-# `lanes/log/`, the handoffs, the manifests `park` writes, and a
-# `lanes/repos.tsv` override — is found through
-# `$AGENT_PROTOCOL_ROOT/workspace.yaml`, and NEVER from this file's own
-# location. `resume:466` and `status:1673` already read that same file under
-# that same name, and Amendment 9(a) mints no second one: a second way to find
-# it is a second answer.
-#
-# Deriving it from here stopped being POSSIBLE the moment this became an
-# installed regular file in `~/.local/bin` with no register anywhere near it,
-# and it stopped being WANTED for a subtler reason: a file's location on disk
-# is evidence about the file, not about a person's data.
-#
-# THESE FOUR FUNCTIONS ARE A DELIBERATE COPY, byte for byte, across
-# `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` — the same trade
-# openRepoTools already makes for its own fetch shim (`openRepoTools:93-100`).
-# A shared `lanes-common.sh` would be a TENTH file for `--install` to place and
-# a broken helper the first time somebody copied only some of them. Each of
-# these is one file a person has on PATH.
-#
-# FAILING TO FIND IT IS A REFUSAL, NEVER A GUESS. No file, no `path:`, no
-# `repository:`, or a `path:` that is not the root of a checkout of the
-# `repository:` named beside it → the caller refuses, exit 1 — the code
-# `lanes-edit.sh` has always used for *registry not found* — with the fix
-# named: `openRepoTools wip init`. Nothing here ever creates that file, writes
-# a register, or falls back to a path derived from its own location. THE
-# CHECKOUT TEST IS NEW: nothing validated it before this, so a `path:` pointing
-# at some other repository used to be accepted and now is not.
-#
-# `LANES_WORKSPACE_ROOT` is the test seam and the only override — the seam
-# `lane-start` already spelled for handoff resolution, widened to the whole
-# question so `test_lane_helpers.sh` can point every helper at one sandbox.
-# --- BEGIN shared workspace resolver (Amendment 9(a)) ----------------------
-# BYTE-IDENTICAL IN ALL FOUR LANE HELPERS, and held there by
-# `tests/test_repo_hygiene.py`. The estate commands carry the same discipline
-# for their own estate resolver and for the same reason its guard gives: a
-# drifted copy is TWO ANSWERS to one question, and "where is this person's
-# workspace" is exactly the question Amendment 9(a) exists to give one answer
-# to. Edit it in one file and the test names the other three.
-LANES_WS_WHY=""
-
-lanes_ws_yaml() { printf '%s\n' "${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"; }
-
-# `key: value` at the TOP LEVEL only, first occurrence, with an inline `#`
-# comment and surrounding quotes stripped and a leading `~` expanded against
-# $HOME (nothing expands a bare `~` inside a file). The anchored `^key:` never
-# reaches into the INDENTED `orgs:` map, which Amendment 9(a) puts out of
-# scope: these helpers read `repository:` and `path:` and nothing else, because
-# one register in the first workspace repository is the whole rule — the
-# register never follows that map. Two lines of sed, because a YAML parser is
-# not a dependency any of these files will take for one scalar.
-lanes_ws_field() {
-  local v
-  v="$(sed -n -e "s/^$1:[[:space:]]*//p" "$2" 2>/dev/null | head -n 1 |
-    sed -e 's/[[:space:]]*#.*$//' -e 's/[[:space:]]*$//')"
-  v="${v%\"}"; v="${v#\"}"
-  v="${v%\'}"; v="${v#\'}"
-  case "$v" in
-  '~') v="$HOME" ;;
-  '~/'*) v="$HOME/${v#'~/'}" ;;
-  esac
-  printf '%s\n' "$v"
-}
-
-# THE WORKSTATION'S NAME IS READ, NEVER INVENTED — AND NEVER `hostname` INSIDE A
-# CONTAINER (lane-collision-protocol Amendment 11, ratified decision 8(d), as
-# corrected by A11 Addendum 3's `R-A11-14`).
-#
-# WHAT WENT WRONG. `opensoft/brett-wip` `origin/main` carries SIX lines in
-# `lanes/log/openRepoProject-1.md` whose workstation is a container id — five
-# `@0e7d1a79a07e`, one `@55cceb3e5bc9` — in an append-only file, written by every
-# writer inside that container and not only by Evidence 6's fork. A row on a
-# workstation that does not exist is a row no reader can match, no crossing can
-# detect and no `swapped <ws>` can answer for; and the log is never rewritten, so
-# each one is wrong for ever.
-#
-# WHO OWNS THE VALUE. `R-A11-14`: the **workBenches launcher**, which runs on the
-# host and exports `LANES_WORKSTATION=<the host's own hostname -s>` into every
-# session AND every container it starts, beside the `CLAUDE_PROFILE_NAME` it
-# already exports. These helpers READ it. They do not write it, they do not
-# derive it from a second file, and THEY NEVER SUBSTITUTE A PLACEHOLDER: an
-# `@unknown-workstation` is the same defect one field along from the `unknown`
-# clause (e) refuses in the session field, and the rejected alternative — a
-# `workstation:` key in `workspace.yaml` — is a SECOND PLACE FOR THE TRUTH TO BE
-# WRONG beside the variable the launcher already sets.
-#
-# THE THREE ANSWERS, as `<name><TAB><source>`:
-#
-#   seam              `$LANES_WORKSTATION` is set. This is the ordinary case
-#                     wherever the launcher started the session.
-#   hostname          no seam, and this is NOT a container: `hostname -s`, which
-#                     is what the seam has defaulted to since Amendment 6 and
-#                     what every row written before this rung was written by.
-#   container-unset   no seam, and this IS a container. The NAME still answers,
-#                     because a read in front of every launch may not refuse —
-#                     it will simply match nothing, which is the honest answer —
-#                     but every WRITER refuses, exit 2, naming the variable and
-#                     the launcher that sets it.
-#
-# IT ANSWERS AS A PAIR, AND THAT IS NOT A STYLE CHOICE. A caller reads the name
-# with `$(lanes_workstation)`, which is a COMMAND SUBSTITUTION and therefore a
-# subshell: a global the function set there dies with it. The source is on the
-# same line as the name, which is the only way out of a subshell there is.
-#
-#   $LANES_IN_CONTAINER   1 or 0, forcing the probe. THE TEST SEAM, and nothing
-#                         else sets it: the suite must be able to exercise both
-#                         halves of this rule on one host, and the host it runs
-#                         on is a container exactly when it is.
-lanes_in_container() {
-  case "${LANES_IN_CONTAINER:-}" in
-  1) return 0 ;;
-  0) return 1 ;;
-  esac
-  [ -e /.dockerenv ] || [ -e /run/.containerenv ]
-}
-
-lanes_workstation_pair() {
-  local v
-  if [ -n "${LANES_WORKSTATION:-}" ]; then
-    printf '%s\t%s\n' "$LANES_WORKSTATION" seam
-    return 0
-  fi
-  v="$(hostname -s 2>/dev/null || hostname 2>/dev/null || printf 'unknown')"
-  if lanes_in_container; then
-    printf '%s\t%s\n' "$v" container-unset
-  else
-    printf '%s\t%s\n' "$v" hostname
-  fi
-}
-
-# THE NAME ALONE, which is what every writer of the workstation column wants.
-lanes_workstation() { lanes_workstation_pair | cut -f1; }
-
-# The ONE SENTENCE a writer refuses with, in one place, so the three writers
-# cannot word it three ways. Empty on every other source, so
-# `[ -n "$(lanes_workstation_why "$src")" ]` is the whole of the test.
-lanes_workstation_why() {   # <source>
-  [ "${1:-}" = container-unset ] || return 0
-  printf '%s\n' "this is a container and \$LANES_WORKSTATION is not set, so there is no workstation name to write. This host's own \`hostname\` is the CONTAINER'S id, not a workstation, and a row on a workstation that does not exist is a row no reader can match — in a log nothing ever rewrites (Amendment 11, decision 8(d); R-A11-14). The value is the workBenches launcher's to export into every session and container it starts. Set it for this one and re-run: export LANES_WORKSTATION=<this host's name>"
-}
-
-# One of the spellings `git remote get-url origin` prints for one GitHub
-# repository, reduced to a bare lowercased `<owner>/<name>` so it can be
-# compared against workspace.yaml's own `<owner>/<name>`. A URL that is not
-# GitHub's is compared as it stands, lowercased — which is what lets a sandbox
-# name a bare local origin and still be checked.
-lanes_ws_norm() {
-  local u="${1%.git}"
-  case "$u" in
-  https://github.com/*) u="${u#https://github.com/}" ;;
-  ssh://git@github.com/*) u="${u#ssh://git@github.com/}" ;;
-  git@github.com:*) u="${u#git@github.com:}" ;;
-  esac
-  printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
-}
-
-# Do these two name one repository? Equal after normalisation, OR the origin's
-# path ENDS in the `<owner>/<name>` the pointer file spells — which is how a
-# GitHub Enterprise host, an ssh alias and a local bare mirror laid out by
-# owner and name all say the same thing as `https://github.com/<owner>/<name>`.
-# The pointer file spells `<owner>/<name>` because that is what a person types;
-# `git remote get-url` spells a URL because that is what git stores.
-lanes_ws_same_repo() {
-  local a b
-  a="$(lanes_ws_norm "$1")"
-  b="$(lanes_ws_norm "$2")"
-  [ -n "$a" ] && [ -n "$b" ] || return 1
-  [ "$a" = "$b" ] && return 0
-  case "$a" in */"$b") return 0 ;; esac
-  return 1
-}
-
-# Prints the workspace checkout's real root, or returns 1 having set
-# $LANES_WS_WHY to the one sentence that says which of the five ways it failed.
-# ROOT-NESS IS ITS OWN CHECK: `rev-parse --is-inside-work-tree` and
-# `remote get-url origin` both succeed from any SUBDIRECTORY of a work tree, so
-# a `path:` naming a subdirectory would otherwise be accepted and resolve
-# `<path>/lanes/LANES.md` inside the wrong directory.
-lanes_workspace_root() {
-  local yaml repo path origin toplevel real
-  LANES_WS_WHY=""
-  if [ -n "${LANES_WORKSPACE_ROOT:-}" ]; then
-    printf '%s\n' "$LANES_WORKSPACE_ROOT"
-    return 0
-  fi
-  yaml="$(lanes_ws_yaml)"
-  if [ ! -r "$yaml" ]; then
-    LANES_WS_WHY="there is no $yaml"
-    return 1
-  fi
-  repo="$(lanes_ws_field repository "$yaml")"
-  path="$(lanes_ws_field path "$yaml")"
-  if [ -z "$repo" ]; then
-    LANES_WS_WHY="$yaml names no \`repository:\`"
-    return 1
-  fi
-  if [ -z "$path" ]; then
-    LANES_WS_WHY="$yaml names no \`path:\`"
-    return 1
-  fi
-  if ! git -C "$path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    LANES_WS_WHY="$yaml names path: $path, which is not a git checkout"
-    return 1
-  fi
-  origin="$(git -C "$path" remote get-url origin 2>/dev/null || :)"
-  if ! lanes_ws_same_repo "$origin" "$repo"; then
-    LANES_WS_WHY="$yaml names repository: $repo, but $path is a checkout of ${origin:-no origin at all}"
-    return 1
-  fi
-  toplevel="$(git -C "$path" rev-parse --show-toplevel 2>/dev/null || :)"
-  real="$(cd -- "$path" 2>/dev/null && pwd -P)" || real=""
-  if [ -z "$real" ] || [ "$toplevel" != "$real" ]; then
-    LANES_WS_WHY="$yaml names path: $path, which is not the ROOT of that checkout (${toplevel:-unknown} is)"
-    return 1
-  fi
-  printf '%s\n' "$real"
-}
-
-# The refusal's body, so all four helpers say the same thing in the same words.
-#
-# THE REASON IS RE-DERIVED HERE, IN THE PARENT SHELL, and that is the whole
-# point of this line. Every caller reaches the resolver through a command
-# substitution — `LANES_WS_ROOT="$(lanes_workspace_root || :)"` — which runs it
-# in a SUBSHELL, so the $LANES_WS_WHY it set died with that subshell and the
-# parent still holds the empty string it started with. Six distinct diagnoses
-# were being computed and all six were being thrown away; every one of the
-# refusals Amendment 9(a) enumerates printed the same "no reason recorded".
-# The resolver is read-only and cheap — two `sed`s and three `git` reads — and
-# it is reached on the refusal path only, so running it again HERE is the one
-# place its answer survives to be printed.
-lanes_workspace_why() {
-  [ -n "$LANES_WS_WHY" ] || lanes_workspace_root >/dev/null 2>&1 || :
-  printf '%s' "the workspace repository could not be found — ${LANES_WS_WHY:-no reason recorded}.
-    Amendment 9(a): every lane helper reads \`repository:\` and \`path:\` from
-    $(lanes_ws_yaml), never from its own location. One command writes that
-    file, creates or clones the repository and places the symlinks:
-        openRepoTools wip init"
-}
-# --- END shared workspace resolver ------------------------------------------
-
-# THE REGISTER AND ITS WRITER, after the move (Amendment 9(b)). The register is
-# the workspace repository's `lanes/LANES.md`, found through the pointer file
-# above. The writer is `lanes-edit.sh`, which `--install` places BESIDE this
-# command — in `~/.local/bin` when installed, in the checkout when run from one
-# — so `$SCRIPT_DIR` answers both without a second rule. `$OPENREPOTOOLS_BIN_DIR`
-# and `$PATH` are the fallbacks for a command copied somewhere on its own.
-LANES_WS_ROOT=""
-if [ -z "${LANES_FILE:-}" ] || [ -z "${LANES_REPO:-}" ]; then
-  LANES_WS_ROOT="$(lanes_workspace_root || :)"
-fi
-: "${LANES_REPO:=$LANES_WS_ROOT}"
-LANES_FILE="${LANES_FILE:-${LANES_WS_ROOT:+$LANES_WS_ROOT/lanes/LANES.md}}"
-
-lanes_edit_default() {
-  local d
-  [ -x "$SCRIPT_DIR/lanes-edit.sh" ] && { printf '%s\n' "$SCRIPT_DIR/lanes-edit.sh"; return 0; }
-  d="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-  [ -x "$d/lanes-edit.sh" ] && { printf '%s\n' "$d/lanes-edit.sh"; return 0; }
-  command -v lanes-edit.sh 2>/dev/null && return 0
-  printf '%s\n' "$SCRIPT_DIR/lanes-edit.sh"
-}
-LANES_EDIT="${LANES_EDIT:-$(lanes_edit_default)}"
-
-# THE CLOSE-OUT GATE'S SWEEP (opensoft/openRepoTools#163), found the way the
-# writer is: `--install` places `lane-worktrees` beside this command too.
-lane_worktrees_default() {
-  local d
-  [ -x "$SCRIPT_DIR/lane-worktrees" ] && { printf '%s\n' "$SCRIPT_DIR/lane-worktrees"; return 0; }
-  d="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-  [ -x "$d/lane-worktrees" ] && { printf '%s\n' "$d/lane-worktrees"; return 0; }
-  command -v lane-worktrees 2>/dev/null && return 0
-  printf '%s\n' "$SCRIPT_DIR/lane-worktrees"
-}
-LANE_WORKTREES="${LANE_WORKTREES:-$(lane_worktrees_default)}"
-
-
-LE_TMP=""
-cleanup() { [ -n "${LE_TMP:-}" ] && rm -f -- "$LE_TMP"; return 0; }
-# A SIGNAL ENDS THE RUN, AND `cleanup` RUNS ON THE WAY OUT. `cleanup` returns
-# rather than exits, so the one trap `cleanup EXIT INT TERM` ran it and then
-# RESUMED the script at the next command — harmless while nothing was left to
-# delete, and a fail-open once the sweep's capture file is `LE_TMP`: the
-# resumed script read the deleted file as an empty note and went on to write
-# (#138 item 6, the delta review of fe6e38a). The codes are the shell's own,
-# 128 plus the signal, and the EXIT trap does the removing once.
-trap cleanup EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-note() { printf '%s: %s\n' "$prog" "$*" >&2; }
-step() { printf '%s: %s\n' "$prog" "$*" >&2; }
-plan() { printf '%s: PLAN %s\n' "$prog" "$*" >&2; }
-die()  { printf '%s: %s\n' "$prog" "$1" >&2; exit "${2:-1}"; }
-usage() { sed -n -e '1,2d' -e '/^#/!q' -e 's/^# \{0,1\}//' -e p "$RESOLVED"; }
-
-# ------------------------------------------------------------------ arguments
-
-retire=0; force=0; dry_run=0; state_was=""; home_override=""; retire_target=""
-retire_dormant=""; sweep_reason=""; sweep_yes=0; inventory_only=0
-positional=()
-
-# A TRANSCRIPT UUID AND A PID, TOLD APART FROM A LANE ARGUMENT BY SHAPE.
-# `--retire` is two acts now (A11 Addendum 4 ruling 8) and the value is what
-# tells them apart, so the shapes a value may have are written here once.
-is_fork_uuid() { [[ "${1-}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]]; }
-is_fork_pid()  { case "${1-}" in '' | *[!0-9]*) return 1 ;; esac; return 0; }
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    # `--retire` IS TWO ACTS, AND THE VALUE TELLS THEM APART (A11 Addendum 4
-    # ruling 8, ratified "a11 addendum 4 yes"). Bare, it is what it has always
-    # been: mark THIS LANE's state cell RETIRED as part of ending it. With a
-    # `<pid|uuid>` it is the one act clause (k) rule (e) gives for a live FORK
-    # of the lane's transcript — *"both print the one act: retire it … and
-    # `lane-end`'s `--retire` is the door"* — and it ends nothing.
-    #
-    # THE ONE AMBIGUOUS SPELLING IS REFUSED RATHER THAN GUESSED AT. A bare
-    # number is a legal lane argument (`lane-end 3` ends `<cwd repo>-3`), so
-    # `lane-end --retire 3` could be either act. Where no lane has been named
-    # yet, that spelling refuses and prints both — the alternative is choosing
-    # between two different acts on a coin toss. A uuid is never ambiguous,
-    # and `--retire=<value>` is always the fork form.
-    --retire=*)
-      retire=1; retire_target="${1#--retire=}"
-      [ -n "$retire_target" ] || die "--retire= needs a pid or a transcript uuid" 2
-      shift ;;
-    --retire)
-      retire=1
-      if is_fork_uuid "${2-}"; then
-        retire_target="$2"; shift 2
-      elif is_fork_pid "${2-}"; then
-        [ "${#positional[@]}" -gt 0 ] || die "'--retire $2' is ambiguous: '$2' is both a lane POSITION — \`$prog $2\` ends lane <repo>-$2 and marks it RETIRED — and a pid, which retires a live FORK of a lane and ends nothing. Name the lane first: $prog <lane> --retire $2   (or spell the fork form $prog <lane> --retire=$2)" 2
-        retire_target="$2"; shift 2
-      else
-        shift
-      fi ;;
-    # AMENDMENT 19(c) — THE SWEEP. It takes the REPOSITORY as its own value, so
-    # that nothing about it is ambiguous with the lane argument this command
-    # otherwise takes: `lane-end --retire-dormant openxFactory` names a
-    # repository and never a lane, and the bare form with the repository as a
-    # positional is accepted for the reader who typed it that way.
-    --retire-dormant)
-      case "${2-}" in
-        '' | -*) retire_dormant="-" ;;
-        *) retire_dormant="$2"; shift ;;
-      esac
-      shift ;;
-    --retire-dormant=*)
-      retire_dormant="${1#--retire-dormant=}"
-      [ -n "$retire_dormant" ] || die "--retire-dormant= needs the repository whose dormant rows are to be swept" 2
-      shift ;;
-    # A FLAG IS NOT A VALUE (Copilot round 1 on #93): `--reason --yes` took
-    # `--yes` as the reason, fell back to the dry run and exited 0 — a malformed
-    # line that ran and did not do what it said. A value beginning with `-` is
-    # refused, and the `=` spelling is named for a reason that really begins
-    # with one.
-    --reason)      case "${2-}" in '' | -*) die "--reason needs the words that say why, and '${2-}' is a flag — so the reason was left out and the act it belongs to may have been too. Spell a reason that really begins with a dash as --reason=<why>." 2 ;; esac
-                   sweep_reason="$2"; shift 2 ;;
-    --reason=*)    sweep_reason="${1#--reason=}"; [ -n "$sweep_reason" ] || die "--reason needs the words that say why" 2; shift ;;
-    --yes)         sweep_yes=1; shift ;;
-    --home)        home_override="${2-}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift 2 ;;
-    --home=*)      home_override="${1#--home=}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift ;;
-    --force)       force=1; shift ;;
-    # THE CLOSE-OUT GATE'S ONE DOOR, AND THE WORD HELD FOR ITS SECOND (#163).
-    # `--sweep` would retire the lane's trees in the same run as its ending,
-    # which is not built — `lane-worktrees sweep --yes` is that act, on its own
-    # — so the word is refused by name rather than read as an unknown option.
-    --inventory-only) inventory_only=1; shift ;;
-    --sweep | --sweep=*)
-                   die "--sweep is not built: retiring a lane's trees in the same run as its ending is not one act. \`lane-worktrees sweep <lane> --yes\` retires them first, on its own (it removes only what is on origin or in a bundle, never a live writer's tree), and then $prog <lane> ends the lane; or $prog <lane> --inventory-only ends the lane with its trees left where they are, in its inventory. Nothing was written." 2 ;;
-    --dry-run)     dry_run=1; shift ;;
-    --state-was)   state_was="${2-}"; [ -n "$state_was" ] || die "--state-was needs the exact text to replace" 2; shift 2 ;;
-    --state-was=*) state_was="${1#--state-was=}"; [ -n "$state_was" ] || die "--state-was needs the exact text to replace" 2; shift ;;
-    -h|--help)     usage; exit 0 ;;
-    --)            shift ;;
-    -*)            die "unknown option '$1' — see $prog --help" 2 ;;
-    *)             positional+=("$1"); shift ;;
-  esac
-done
-
-# ------------------- AMENDMENT 19(c): `--retire-dormant <repo>`, THE SWEEP ---
-#
-# IT IS NOT A LANE ARGUMENT AND IT NEVER ENDS A LANE, so it is answered here —
-# before the `<lane>` derivation below, which would otherwise refuse this line
-# for naming no lane at all.
-#
-# THE DRY RUN IS THE DEFAULT AND THE AMENDMENT SAYS WHY: *"so the person sees
-# what the sweep will close before it closes it; an agent's stdin is not a
-# terminal, so the word is `--yes` typed by a person"*. This half makes no
-# decision of its own about what is dormant: it asks the READ — `lanes --closed
-# --prefix <repo>`, whose fourteenth column is the row's class — so the listing
-# and the sweep can never disagree about which rows they are talking about, and
-# `lanes-edit.sh retire-rows` re-proves every one of clause (c)'s refusals for
-# itself before it writes a byte.
-if [ -n "$retire_dormant" ]; then
-  [ "$retire" = 0 ] || die "--retire and --retire-dormant are two different acts: --retire is a lane's own ending (or a live fork's), and --retire-dormant sweeps a repository's rows that have no lane left to end. Run one of them." 2
-  [ "$force" = 0 ] || die "--force ends a lane that still holds something; it has no meaning for a sweep of rows whose lanes ended before Amendment 7. Nothing was written." 2
-  [ "$inventory_only" = 0 ] || die "--inventory-only is the door past ONE lane's close-out gate; the sweep of dormant rows ends no lane and asks no gate. Nothing was written." 2
-  [ -z "$state_was" ] || die "--state-was is for the state cell of a lane being ended; the sweep writes each row's cell itself, from the reason and the row's own last words. Nothing was written." 2
-  [ -z "$home_override" ] || die "--home is for a pre-cutover lane's own log line; the sweep writes no home into anything. Nothing was written." 2
-  [ "$dry_run" = 0 ] || sweep_yes=0
-  # THE REPOSITORY, WHICHEVER WAY IT WAS TYPED — as the flag's value, or as the
-  # one positional after a bare flag. Two of them is a refusal rather than a
-  # choice between them.
-  if [ "$retire_dormant" = "-" ]; then
-    case "${#positional[@]}" in
-      1) retire_dormant="${positional[0]}" ;;
-      0) die "which repository? $prog --retire-dormant <repo> [--reason \"<why>\"] [--yes]" 2 ;;
-      *) die "--retire-dormant takes ONE repository: $prog --retire-dormant <repo>" 2 ;;
-    esac
-  elif [ "${#positional[@]}" -gt 0 ]; then
-    die "--retire-dormant already names the repository ($retire_dormant), so '${positional[0]}' is one argument too many. It sweeps a repository's dormant ROWS and takes no lane: $prog --retire-dormant $retire_dormant [--reason \"<why>\"] [--yes]" 2
-  fi
-  case "$retire_dormant" in
-    *[!A-Za-z0-9._-]* | '') die "'$retire_dormant' is not a repository name (letters, digits, . _ -)" 2 ;;
-  esac
-  if [ -z "${LANES_FILE:-}" ]; then die "$(lanes_workspace_why)" 1; fi
-  [ -f "$LANES_FILE" ] || die "no register at $LANES_FILE — the workspace repository $(lanes_ws_yaml) names carries no lanes/LANES.md. \`openRepoTools wip init\` seeds one (it is idempotent); or set LANES_FILE" 1
-  [ -x "$LANES_EDIT" ] || die "no register writer at $LANES_EDIT — \`lanes-edit.sh\` is installed beside this command by \`openRepoTools --install\`. Run that, or set LANES_EDIT" 1
-
-  # THE REASON IS CHECKED BEFORE THE DRY RUN IS PRINTED (Copilot round 2 on
-  # #93). `retire_rows` refuses a reason that would forge a cell, and it is
-  # reached only under `--yes` — so a dry run over a bad reason printed a clean
-  # preview of an act that could not run, which is the one thing a preview may
-  # not do. The rules are the writer's own (Amendment 13(a) and ratified
-  # decision O1) and the refusal names the argument.
-  if [ -n "$sweep_reason" ]; then
-    case "$sweep_reason" in
-      *'|'*)   die "--reason may not contain '|': it would forge a cell boundary in every row this sweep rewrites. Got: '$sweep_reason'" 2 ;;
-      *' · '*) die "--reason may not contain ' · ': that separator is what divides the state cell's three parts (Amendment 13(a)), and a second one reads back as a fourth part. Use a semicolon. Got: '$sweep_reason'" 2 ;;
-    esac
-    if [ "${sweep_reason//[$'\n\r']/}" != "$sweep_reason" ]; then
-      die "--reason is ONE line: a newline in it would split a row in two and every row after it would be read as a lane" 2
-    fi
-    sweep_us="$(printf '\037')"
-    if [ "${sweep_reason//$sweep_us/}" != "$sweep_reason" ]; then
-      die "--reason may not contain the internal field separator: it would corrupt the sweep plan before any row is written" 2
-    fi
-    [ "${#sweep_reason}" -le 180 ] ||
-      die "--reason is ${#sweep_reason} characters. The cell's whole line is capped at 240 (Amendment 13, ratified decision O1) and the row's OWN last words go in beside it, so a reason longer than 180 leaves nothing of them. Shorten it — the long version belongs in the lane's log." 2
-  fi
-
-  # THE READ IS FETCHED. Every other listing in this family is local by design —
-  # it sits in front of a person who is waiting — but this one sits in front of
-  # a WRITE, and a dormant row is a row about which this checkout's copy may be
-  # a week old.
-  # THE READ'S STDERR IS KEPT (Copilot round 4 on #93). `lanes_rows` leaves the
-  # class unset where this workstation's session records could not be read —
-  # DORMANT is "no log AND no live session here", and the second half was never
-  # established — and it SAYS so on stderr. Without that sentence this command
-  # would count zero dormant rows and exit 8 announcing that none are dormant,
-  # which is a reason it has not got. The stream is passed through either way:
-  # it is the person's.
-  # AND THE CAPTURE IS NOT OPTIONAL (#138 item 6, the review of `dbbb117`).
-  # Where `mktemp` cannot make the file, the read ran with its stderr
-  # uncaptured and `rd_err` stayed empty, so the sentence above never reached
-  # the check below that refuses on it and the sweep went on over a fact that
-  # was not read. Not being able to read the read's notes is not their absence.
-  rd_rc=0
-  rd_err=""
-  # `LE_TMP` IS WHAT `cleanup` REMOVES ON EVERY EXIT, and it is assigned from
-  # the `mktemp` itself so that no signal can land between the file existing
-  # and `cleanup` knowing its name. The note is relayed on stderr, and where
-  # that write fails — a closed or full stderr — `set -e` leaves before a plain
-  # `rm` below is reached and the capture file stayed in `$TMPDIR`.
-  LE_TMP="$(mktemp "${TMPDIR:-/tmp}/lane-end-sweep.XXXXXX" 2>/dev/null || printf '')"
-  rd_errf="$LE_TMP"
-  [ -n "$rd_errf" ] ||
-    die "no temporary file could be made to capture the read's own notes, so whether this workstation's session records could be read was never established — and DORMANT is 'no object log AND no live session here'. The rows are not counted over a fact that was not read (Amendment 7(d)). Fix \$TMPDIR (full, gone or not writable) and re-run. Nothing was written." 1
-  rd_rows="$("$LANES_EDIT" lanes --fetch --closed --prefix "$retire_dormant" 2>"$rd_errf")" || rd_rc=$?
-  # AND A CAPTURE THAT CANNOT BE READ BACK IS NOT AN EMPTY ONE: the empty note
-  # is the one that never refuses.
-  rd_err="$(cat -- "$rd_errf")" ||
-    die "the capture of the read's own notes could not be read back, so whether this workstation's session records could be read was never established — and DORMANT is 'no object log AND no live session here'. The rows are not counted over a fact that was not read (Amendment 7(d)). Nothing was written." 1
-  printf '%s' "$rd_err" >&2
-  rm -f -- "$rd_errf"
-  case "$rd_err" in
-    *"session records could not be read"*)
-      die "this workstation's session records could not be read (the read says so above), so whether any of $retire_dormant's rows has a LIVE session here was never established — and DORMANT is 'no object log AND no live session here'. The rows are not counted over a fact that was not read (Amendment 7(d)). Fix the read and re-run; nothing was written." 1 ;;
-    # AND WHERE THE READ CLASSED NO ROW AT ALL BECAUSE A READ FAILED — the log
-    # directory, the published logs' warnings, or the register itself (#138
-    # items 4 and 11, the reviews of #230): counting zero here was this
-    # command's "there is nothing to do", exit 8, about rows nobody could class.
-    *"no row is classed DORMANT here"*)
-      die "the read could not establish which of $retire_dormant's rows are dormant (it says why above), so it classed none of them DORMANT — and that is NOT 'none of them are' (Amendment 7(d)). Fix the read and re-run; nothing was written." 1 ;;
-  esac
-  case "$rd_rc" in
-    0) : ;;
-    8) die "no lane of $retire_dormant is recorded at all, so there is no dormant row to retire. Nothing was written." 8 ;;
-    2) die "the \`lanes-edit.sh\` on this workstation has no \`lanes\` subcommand, so it predates lane-collision-protocol Amendment 11 and cannot say which rows are dormant. This workstation has not taken the install yet:  openRepoTools --install" 2 ;;
-    *) die "$LANES_EDIT lanes --closed --prefix $retire_dormant exited $rd_rc, so which rows are dormant was never established — and that is NOT 'none of them are' (Amendment 7(d)). Run it by hand to see what it says. Nothing was written." 1 ;;
-  esac
-
-  rd_lanes=(); rd_n=0; rd_flagged=0
-  rd_report=""
-  TAB="$(printf '\t')"
-  # THE READ'S SEVENTEEN COLUMNS BY NAME: 13 is Amendment 18(b)'s locality and
-  # 14 to 17 are Amendment 19's class, start, head and flags — so the class this
-  # sweep selects on is the fourteenth, never the thirteenth.
-  while IFS="$TAB" read -r d_lane d_state d_ws d_pf d_win d_sid d_dir d_obj d_age d_cmd d_home d_fk d_loc d_class d_start d_was d_flags; do
-    [ -n "${d_lane:-}" ] || continue
-    [ "${d_class:-none}" = dormant ] || continue
-    rd_lanes+=("$d_lane")
-    rd_n=$((rd_n + 1))
-    d_mark="    "
-    case "${d_flags:-none}" in
-      none | '') d_flags="" ;;
-      *) d_mark="FLAG"; rd_flagged=$((rd_flagged + 1)) ;;
-    esac
-    # THE TWO FREE-TEXT COLUMNS ARE CUT TO THEIR WIDTH AND THE NAME IS NOT.
-    # Measured on the live register: `started` holds `2026-09-02 ~22:30Z;
-    # RESUMED 09-03 12:55Z and 19:27Z` and the workstation cell `<workstation? —
-    # owner fills>`, either of which pushes every column after it out of line in
-    # a report a person reads to decide. The LANE is never cut — it is the name
-    # they act on — and the cut is a bash expansion rather than printf's `%.Ns`,
-    # which counts BYTES and would tear the `≤` and `—` these cells carry.
-    d_start_s="${d_start:-unknown}"
-    if [ "${#d_start_s}" -gt 20 ]; then d_start_s="${d_start_s:0:19}…"; fi
-    d_ws_s="${d_ws:-unknown}"
-    if [ "${#d_ws_s}" -gt 10 ]; then d_ws_s="${d_ws_s:0:9}…"; fi
-    rd_report="$rd_report$(printf '  %s %-28s %-20s %-10s %s' "$d_mark" "$d_lane" "$d_start_s" "$d_ws_s" "$d_flags")
-$(printf '       was: %s' "${d_was:-none}")
-"
-  done <<EOF
-$rd_rows
-EOF
-
-  printf '%s --retire-dormant %s — %s (lane-collision-protocol Amendment 19(c))\n' \
-    "$prog" "$retire_dormant" "$( [ "$sweep_yes" = 1 ] && printf 'THE ACT' || printf 'DRY RUN, nothing is written' )"
-  printf '  register : %s\n' "$LANES_FILE"
-  printf '  dormant  : %s row(s), %s of them FLAGGED\n' "$rd_n" "$rd_flagged"
-  if [ "$rd_n" = 0 ]; then
-    die "no row of $retire_dormant is DORMANT — a dormant row is one with no object log and no live session here (Amendment 19(a)), and every row of that repository has one or the other. There is nothing to do, and nothing was done. \`lanes --closed --prefix $retire_dormant\` shows what its rows say." 8
-  fi
-  printf '\n       lane                         started              where      flags\n'
-  printf '%s' "$rd_report"
-  printf '\n  A FLAG is this row saying the work was unpushed, lost, a loss or owed, or\n'
-  printf '  still saying LIVE. Retiring the row does not lose that text: it is carried\n'
-  printf '  into the RETIRED line of the log this sweep creates, and into the cell.\n'
-  printf '  Nothing outside the register and the logs is touched — worktrees, branches\n'
-  printf '  and handoffs stay exactly where they are (Amendment 19(c)).\n'
-  if [ -n "$sweep_reason" ]; then
-    printf '  reason   : %s\n' "$sweep_reason"
-  else
-    printf '  reason   : none given — the writer names the amendment (--reason "<why>" says it better)\n'
-  fi
-
-  # THE OFFERED LINE CARRIES THE REASON AS ONE SHELL-QUOTED `--reason=` WORD
-  # (#93, the review of `44b77c3`). Printed as `--reason "<why>"`, an accepted
-  # `--reason=--why` came back as a dash-led value the parser refuses, and a
-  # reason holding `"` or `$(` came back as shell syntax the person would run.
-  if [ "$sweep_yes" != 1 ]; then
-    printf '\n  DRY RUN — nothing was written. Make it the one act with:\n'
-    printf '    LANES_LANE=<your lane> %s --retire-dormant %s%s --yes\n' \
-      "$prog" "$retire_dormant" "$( [ -n "$sweep_reason" ] && printf ' --reason=%q' "$sweep_reason" || printf ' --reason "<why>"' )"
-    exit 0
-  fi
-
-  # THE WRITER IS A LANE, AND IT IS NOT GUESSED. Every line this sweep appends
-  # carries the sweeping lane's own transcript uuid in its session field
-  # (Amendment 7(b)), and a session field that is anything else is wrong for
-  # ever in an append-only log — so the lane is named by the person running it
-  # or the act does not happen.
-  [ -n "${LANES_LANE:-}" ] ||
-    die "the sweep writes a RETIRED line into each lane's log, and the session field of every one of them is the SWEEPING lane's transcript uuid (Amendment 7(b)) — so this act needs to know which lane is doing it. Re-run it from your lane: LANES_LANE=<your lane> $prog --retire-dormant $retire_dormant --yes. Nothing was written." 2
-  rd_argv=(retire-rows)
-  for rd_l in ${rd_lanes[@]+"${rd_lanes[@]}"}; do rd_argv+=("$rd_l"); done
-  # AN `&&` LIST WHOSE TEST FAILS IS A FAILING COMMAND, and this script runs
-  # under `set -e`: written as `[ -n "$x" ] && rd_argv+=(…)` a run with no
-  # `--reason` would exit here, silently, having printed the whole dry run.
-  #
-  # AND IT IS FORWARDED AS ONE ARGUMENT (Copilot round 2 on #93). Split as
-  # `--reason <why>`, the documented spelling for a reason that BEGINS with a
-  # dash — `--reason=--why`, which this parser accepts — arrived at the writer
-  # as two words, and the writer refuses a dash-led value there by design. So
-  # the confirmed act refused what the dry run had just accepted.
-  if [ -n "$sweep_reason" ]; then rd_argv+=("--reason=$sweep_reason"); fi
-  rd_argv+=(--writer "$LANES_LANE")
-  step "the one commit: $LANES_EDIT ${rd_argv[*]}"
-  "$LANES_EDIT" "${rd_argv[@]}"
-  exit $?
-fi
-
-# THE SWEEP'S OWN FLAGS BELONG TO THE SWEEP (Copilot round 3 on #93). They are
-# parsed above for every invocation, and without this `lane-end <lane> --yes`
-# ran the ORDINARY ending — a line that reads like a confirmed sweep doing
-# something else entirely — while `lane-end <lane> --reason "<why>"` dropped the
-# reason on the floor. Neither is a typo this command may interpret.
-if [ -z "$retire_dormant" ]; then
-  [ "$sweep_yes" = 0 ] ||
-    die "--yes is the word that makes the SWEEP the act (Amendment 19(c)) and it belongs to --retire-dormant. Ending one lane needs no confirmation and takes none: $prog <lane>. Nothing was written." 2
-  [ -z "$sweep_reason" ] ||
-    die "--reason says why a repository's DORMANT ROWS are being retired (Amendment 19(c)) and it belongs to --retire-dormant; ending one lane writes its own closing line and would drop these words. Nothing was written: $prog <lane>, or $prog --retire-dormant <repo> --reason \"$sweep_reason\"." 2
-fi
-
-# A lane name is taken VERBATIM when one argument is given: the register
-# still carries lanes named before the `<repo>-<n>` rule (browser-ui-repair,
-# hermes-wallet-exercise), and their last act is exactly what this is for.
-LANE=""
-case "${#positional[@]}" in
-  2) LANE="${positional[0]}-${positional[1]}" ;;
-  1)
-    arg="${positional[0]}"
-    if [[ "$arg" =~ ^[0-9]+[A-Za-z]?$ ]]; then
-      top="$(git rev-parse --show-toplevel 2>/dev/null || :)"
-      [ -n "$top" ] || die "no <repo> given and this directory is not a git checkout — run: $prog <repo> $arg" 1
-      LANE="$(basename -- "$top")-$arg"
-    else
-      LANE="$arg"
-    fi
-    ;;
-  0) usage >&2; die "which lane? $prog <lane>" 2 ;;
-  *) die "too many arguments: $prog <lane>" 2 ;;
-esac
-[[ "$LANE" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || die "'$LANE' is not a lane name (allowed: letters, digits, . _ -)" 2
-
-if [ -z "${LANES_FILE:-}" ]; then die "$(lanes_workspace_why)" 1; fi
-[ -f "$LANES_FILE" ] || die "no register at $LANES_FILE — the workspace repository $(lanes_ws_yaml) names carries no lanes/LANES.md. \`openRepoTools wip init\` seeds one (it is idempotent); or set LANES_FILE" 1
-[ -x "$LANES_EDIT" ] || die "no register writer at $LANES_EDIT — \`lanes-edit.sh\` is installed beside this command by \`openRepoTools --install\`. Run that, or set LANES_EDIT" 1
-
-# ------------------------- AMENDMENT 15: THE ROW'S SPELLING IS THE LANE'S NAME
-#
-# **A lane name is one name under any case** (ratified 2026-09-14T00:07:18Z),
-# and `lanes-edit.sh canon-lane` is the ONE resolver the commands share rather
-# than each keeping its own — for the reason Amendment 11 clause (h) gives every
-# other read here: an implementation of "which row is this name's" in each
-# command is how they would come to disagree about it.
-#
-# `2` IS TWO ANSWERS AND ONE OF THEM IS A REFUSAL (Copilot round 4 on
-# openRepoTools#41). It is what a helper predating this amendment spends on an
-# unknown subcommand, and it is also `canon-lane`'s own two-rows refusal. Both
-# used to carry on with the name as typed, on the reading that this command's own
-# row scan sees the pair anyway — and it does, in `$LANES_FILE`, THE WORKING
-# TREE. The register the refusal is about is `origin/<branch>`: on a checkout
-# that is behind, the pair is published, the local scan finds exactly one row and
-# passes, and the only other place the refusal could still surface is the
-# `register-row` read below, whose stderr is suppressed and whose 2 becomes a
-# generic exit 1 naming neither spelling. So the refusal is identified by its own
-# words — no helper predating the amendment emits them from an unknown
-# subcommand — and relayed, with the old-helper fallback left as it was.
-
-cl_out=""; cl_rc=0
-cl_out="$("$LANES_EDIT" canon-lane "$LANE" 2>/dev/null)" || cl_rc=$?
-cl_why=""; cl_pair=0
-case "$cl_rc" in 2 | 66) cl_why="$(LANES_NO_FETCH=1 "$LANES_EDIT" canon-lane "$LANE" 2>&1 >/dev/null || :)" ;; esac
-case "$cl_why" in *"Amendment 15(d)"*) cl_pair=1 ;; esac
-# AMENDMENT 16(e) — AND 66 IS THE ALIAS TABLE THAT COULD NOT BE READ (Copilot
-# round 4 on openRepoTools#81). It is its own number because 2 already carries
-# two meanings here, and this command must not END a lane it cannot name: a
-# former name that resolves to nothing reads as a lane with no row, and the
-# ENDED line would be written under a name no reader resolves.
-if [ "$cl_rc" = 66 ]; then
-  printf '%s\n' "$cl_why" >&2
-  die "lane $LANE's name could not be resolved: the lane alias table could not be read (above, exit 66). Amendment 16(e) makes a renamed lane's old name resolve through that file for ever, so a name it cannot answer for may be a lane whose row is under another name — and this command will not end a lane it cannot name. The row is untouched and nothing was written." 2
-fi
-if [ "$cl_pair" = 1 ]; then
-  printf '%s\n' "$cl_why" >&2
-  die "the PUBLISHED register spells lane $LANE two ways (above), so no read and no write under that name is unambiguous and this command will not end a lane it cannot name — Amendment 15(d): merge the newer row's session id(s) into the older row's session cell, in order, remove the newer row in the SAME commit naming both spellings, push, and re-run. The row is untouched and nothing was written." 2
-fi
-if [ "$cl_rc" = 0 ] && [ -n "$cl_out" ] && [ "$cl_out" != "$LANE" ]; then
-  note "lane $LANE → $cl_out (Amendment 15: the register row's spelling is canonical)"
-  LANE="$cl_out"
-fi
-
-# THE SEAM (ruling 2026-10-04): A MANAGED-OWNED LANE IS NOT THIS COMMAND'S.
-# `lanes-edit.sh managed-projection` answers 0 with the owner where the lane's
-# register row carries the managed ledger's marker, 8 for a legacy lane, and 1
-# where ownership could not be established. ANY other status — a helper that
-# predates the verb included — is UNKNOWN as well, and refused the same way:
-# a fence that opens because its read failed is no fence (Amendment 7(d)).
-seam_refuse() {   # <lane> <the act>
-  sr_out=""; sr_rc=0
-  sr_out="$("$LANES_EDIT" managed-projection "$1" 2>/dev/null)" || sr_rc=$?
-  case "$sr_rc" in
-  0) die "lane $1 is owned by the managed ledger (owner ${sr_out:-unnamed}), and $2 is a legacy lane act, refused here, once the lane is named and before a byte is written: no state cell, no ENDED or RETIRED line, no handoff fragment, and no process signalled. Brett Heap's ruling of 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\". Act on this lane through the managed ledger." 2 ;;
-  8) : ;;
-  *) die "whether the managed ledger owns lane $1 is UNKNOWN (\`$LANES_EDIT managed-projection $1\` exited $sr_rc): its register row carries managed-owner vocabulary that does not parse, or the read failed. An ownership nobody could establish is never read as legacy (Amendment 7(d)), so $2 is refused here, once the lane is named and before a byte is written: no state cell, no ENDED or RETIRED line, no handoff fragment, and no process signalled. Read it: $LANES_EDIT managed-projection $1" 1 ;;
-  esac
-}
-# CALLED TWICE BELOW, each time before the first thing its path does: at the
-# head of the `--retire <pid>` door, which signals processes, and right after
-# "the row"'s own refusals on the ending path (the ending and `--retire`),
-# before the state cell and the ENDED/RETIRED line. NOT HERE, ONCE: "the row"
-# refuses a register that spells this lane two ways (Amendment 15(d)) out of its
-# OWN read, so that the words a person needs arrive even through a helper that
-# predates `canon-lane` — and such a helper predates `managed-projection` too,
-# which this function rightly calls UNKNOWN. Both are refusals that write
-# nothing; the pair's comes first so that it is still the one said.
-# (`--retire-dormant` is above and is refused by `retire-rows` itself.)
-
-# `--home` IS VALIDATED BEFORE ANYTHING IS WRITTEN. It is for a PRE-CUTOVER
-# lane, and `lanes-edit.sh` refuses it once the lane's own log records a home —
-# but the only place this script passes it is its LAST act, the ENDED/RETIRED
-# line, which is written AFTER the row has been closed and whose failure is
-# deliberately never fatal. So a bad option that could have been rejected in a
-# second instead closed the row, lost the lane its ENDED line, and exited 0. The
-# check is the writer's own `resolve_home`, asked for through `resolve-home`, so
-# the preflight and the write cannot disagree: 0 or 8 is an answer, 2 is the
-# refusal, and anything else is the helper failing.
-if [ -n "$home_override" ]; then
-  home_rc=0
-  home_err="$("$LANES_EDIT" resolve-home "$LANE" "$home_override" 2>&1 >/dev/null)" || home_rc=$?
-  [ -n "$home_err" ] && printf '%s\n' "$home_err" >&2
-  case "$home_rc" in
-    0|8) : ;;
-    2) die "--home $home_override is refused for lane $LANE (the writer's reason is above). Nothing has been written and the row is untouched." 2 ;;
-    *) die "$LANES_EDIT resolve-home $LANE $home_override failed (exit $home_rc). That is not a verdict on the option, and this script will not close a row on an argument it could not check. Fix the helper, then re-run." 1 ;;
-  esac
-fi
-
-# ------------------------------------------- --retire <pid|uuid>: A LIVE FORK
-#
-# THE ONE ACT EVERY SURFACE PRINTS FOR A FORK (A11 clause (k) rule (e), A11
-# Addendum 4 ruling 8, `R-A11-24`): *"both print the one act: **retire it**,
-# under Amendment 6(d), which is the operator's act and stays the operator's.
-# **Neither kills a process** … and `lane-end`'s `--retire` is the door."*
-# Before this round the door did not exist: `restart` printed a READ
-# (`lanes-edit.sh forks <lane>`), `lanes` printed *"Name them"*, and two places
-# said *"retiring one is `kill <pid>`"* — three spellings of one ratified act,
-# none of them it.
-#
-# IT IS A DOOR AND NOT A RECORD, AND THAT IS THIS ROUND CORRECTING ITSELF. The
-# first build of this act wrote `RETIRED — lane <lane>, … , lane:<lane> → fork
-# <sid>; pid <n>; kind <k>` into the lane's own log and filtered `forks` on it.
-# It cannot: **Amendment 7(b) gives `RETIRED` NO PAYLOAD** — *"`PAUSED`,
-# `RESUMED`, `ENDED` and `RETIRED` take no payload"* — and Amendment 11 clause
-# (c), which narrows that sentence for `RESUMED` and counts the narrowing as
-# **edit 1 of six**, says in the same breath that *"`ENDED` and `RETIRED` stay
-# payload-free"*. The other spelling is no better: 7(b)'s *"Every lane-kind line
-# takes the object `lane:<name>`"* is enforced by this estate's own writer
-# (`lanes-edit.sh`'s `log` arm: *"'$verb' is a lane verb: its object is
-# lane:<name>"*), so an object of `fork:<uuid>` narrows that half instead. Either
-# way it is a **SEVENTH edit to in-force text** where the count is six and the
-# six are ratified (`R-A11-15`) — and the first one also needed the state reader
-# to learn a second rule about which of a lane's lines are the lane's, in an
-# append-only file. Writing that silently is the exact defect this estate blocks
-# on, so the record is dropped rather than smuggled.
-#
-# WHAT THE RULE ACTUALLY ASKS FOR IS REPORTING, and it says so in its own words:
-# *"This is Amendment 8(f)'s own posture — 'reports what 6(d) is owed and
-# performs none of it' — extended to the case that produced it, and the
-# reporting is what closed Evidence 6 on the day."* So this act **proves** the
-# target is THIS lane's live fork, and **prints Amendment 6(d)'s retire act for
-# it, filled in**. It writes nothing and it kills nothing.
-#
-# AND IT IS NOT `forks` WITH EXTRA STEPS. `forks` NAMES every fork; this takes
-# ONE, refuses anything that is not one of them (a stranger's pid, a uuid of
-# another lane), refuses a `forks` read that FAILED rather than reading it as
-# *"it is not a fork"*, and spells 6(d) for the kind of session it actually is.
-# One act, one name, on every surface — which is the whole of `R-A11-24`.
-#
-# `kill <pid>` IS PRINTED BY NOTHING (`R-A11-24` in terms). The pid and the cwd
-# are printed as FACTS — `who` and the hook have always printed them — so a
-# person can find the process; what is never printed is a command that ends it.
-#
-# ALL OF THE ABOVE IS ABOUT A FORK, AND ONLY A FORK (opensoft/openRepoTools#39,
-# Amendment 18(h)). A DUPLICATE HOLDER is a different thing wearing a similar
-# shape, and this door tells them apart before it decides what to do: a fork
-# (decision 8(e)) is a live session under an id the row does NOT record,
-# wearing this lane's title — it might be somebody's long-running job with a
-# prompt still open, so Amendment 8(f) reserves ending it for a person. A
-# duplicate holder is a live `--fork-session` process found in the PROCESS
-# TABLE under an id the row DOES record — the very thing Amendment 18(h) says
-# may never coexist with the lane's own live session ("the tooling refuses to
-# build on either… it never appends such an id to the row and never launches a
-# second resume of it"). Nobody is answering a prompt in a background
-# `bg-pty-host` fork of a transcript this lane's own row already claims for
-# itself, so this door TERMS that pair on sight rather than only naming it —
-# the retirement Evidence of 2026-09-14 had to do by hand, outside every tool
-# this estate has (`kill -TERM`, on Brett Heap's word). It never touches a
-# process on another transcript, and it refuses the lane's own live session
-# exactly as the fork case refuses to end a lane's row.
-if [ -n "$retire_target" ]; then
-  [ "$force" = 0 ] || die "--force is for ending a lane that still holds something; it has no meaning for retiring a fork. Run: $prog $LANE --retire $retire_target" 2
-  [ "$inventory_only" = 0 ] || die "--inventory-only is the door past a lane's close-out gate; retiring a fork ends no lane and asks no gate. Run: $prog $LANE --retire $retire_target" 2
-  [ -z "$state_was" ] || die "--state-was is for the state cell of a lane being ended; retiring a fork touches no cell. Run: $prog $LANE --retire $retire_target" 2
-  # THE SEAM, before any process is looked for or signalled (ruling 2026-10-04).
-  seam_refuse "$LANE" "retiring a fork or a duplicate holder"
-
-  # THE FORK IS PROVED BEFORE ANYTHING IS PRINTED, and a read that FAILED is
-  # never "it is not a fork": `forks` answers 0 with rows, 8 with none and 1
-  # where this workstation's session records could not be read (Amendment 7(d)).
-  # Only the first can find one. 8 is DEFERRED rather than an immediate die
-  # (issue #30/#39): a lane with no live FORK may still have a live duplicate
-  # of one of the two other kinds below, and dying here before either gets a
-  # turn would make that read unreachable for exactly the lanes it exists for
-  # — one with no fork at all.
-  fk_rc=0
-  fk_rows="$("$LANES_EDIT" forks "$LANE" 2>/dev/null)" || fk_rc=$?
-  case "$fk_rc" in
-    0 | 8) : ;;
-    *) die "$LANES_EDIT forks $LANE failed (exit $fk_rc). That is NOT 'no fork of it is live', and this script will not name an act for a fork it could not prove is one. Run it by hand to see what it says, then re-run." 1 ;;
-  esac
-
-  fk_sid=""; fk_pid=""; fk_kind=""; fk_cwd=""
-  if [ "$fk_rc" = 0 ]; then
-    while IFS="$(printf '\t')" read -r fr_sid fr_pid fr_kind fr_cwd; do
-      [ -n "${fr_sid:-}" ] || continue
-      if [ "$(printf '%s' "$fr_sid" | tr 'A-F' 'a-f')" = "$(printf '%s' "$retire_target" | tr 'A-F' 'a-f')" ] \
-         || { [ -n "$fr_pid" ] && [ "$fr_pid" = "$retire_target" ]; }; then
-        fk_sid="$fr_sid"; fk_pid="$fr_pid"; fk_kind="${fr_kind:-interactive}"; fk_cwd="$fr_cwd"
-        break
-      fi
-    done <<FORKS
-$fk_rows
-FORKS
-  fi
-
-  # ISSUE #39 — NOT A TITLE-BASED FORK; TRY A DUPLICATE HOLDER OF THIS LANE'S
-  # OWN TRANSCRIPT INSTEAD (Amendment 18(h)). A cross-profile resume leaves a
-  # `bg-pty-host` running `claude --fork-session --resume <path>/<uuid>.jsonl`
-  # behind, and once a `lane-start --no-launch` binds that forked id as the
-  # row's own session, `forks` (decision 8(e), keyed on "an id the row does
-  # NOT record") is designed to stay silent about it — which is the gap: two
-  # live processes now hold the one transcript Amendment 18(h) says exactly
-  # one may. `duplicate-holder` reads the PROCESS TABLE for exactly that
-  # shape and already excludes the lane's own live holder from its rows.
-  #
-  # ONLY WHEN `fk_sid` IS STILL EMPTY (Copilot round 3, PR #61): a proved
-  # fork already answers the whole act below, and this second, unrelated read
-  # — a separate `lanes-edit.sh` process, its own `git fetch` — must not turn
-  # a WORKING fork retirement into a hard failure because `pgrep` happens to
-  # be missing or the process table happens to be unreadable at this exact
-  # moment. `LANES_NO_FETCH=1` skips the fetch `forks` just made for the same
-  # checkout, so this reads the ref that call already brought current rather
-  # than paying for it, and possibly disagreeing with it, twice.
-  dh_rc=8; dh_rows=""
-  if [ -z "$fk_sid" ]; then
-    dh_rc=0
-    dh_rows="$(LANES_NO_FETCH=1 "$LANES_EDIT" duplicate-holder "$LANE" 2>/dev/null)" || dh_rc=$?
-    case "$dh_rc" in
-      0 | 8) : ;;
-      *) die "$LANES_EDIT duplicate-holder $LANE failed (exit $dh_rc). That is NOT 'no duplicate holder is live', and this script will not name an act against a process it could not prove is one. Run it by hand to see what it says, then re-run." 1 ;;
-    esac
-  fi
-
-  # AMENDMENT 18(h) — THE LANE'S OWN LIVE SESSION HAS ITS OWN REFUSAL EVEN
-  # WHEN NOTHING ELSE IS HOLDING THIS TRANSCRIPT (Copilot round 2, PR #61):
-  # with no fork and no OTHER process on this id, `duplicate-holder` rightly
-  # excludes the lane's own pid and answers 8, same as "nothing at all" — but
-  # "nothing else holds it" and "the pid you named IS the one thing holding
-  # it" are different facts, and only the second earns this specific refusal
-  # rather than the generic 8 below. Skipped entirely once a fork has already
-  # matched, for the same reason the duplicate-holder read above is: a proved
-  # fork answers the act, and this is a THIRD process and fetch this checkout
-  # does not need to make to use its own answer. A read that FAILS is not
-  # "it is not the lane's own session": only rc 8 clears the general checks
-  # that follow; rc 0 either dies here or clears them; anything else dies.
-  lh_rc=8; lh_pid=""; lh_sid=""; lh_verdict=""
-  if [ -z "$fk_sid" ]; then
-    lh_rc=0
-    lh_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" live-holder "$LANE" 2>/dev/null)" || lh_rc=$?
-    lh_sid=""; lh_tgt=""; lh_name=""; lh_pid=""; lh_verdict=""
-    case "$lh_rc" in
-      0)
-        IFS=$'\037' read -r lh_sid lh_tgt lh_name lh_pid lh_verdict <<LIVE || :
-$lh_out
-LIVE
-        if [ -n "$lh_pid" ] && [ "$lh_pid" = "$retire_target" ]; then
-          die "pid $lh_pid is lane $LANE's own live session (session $lh_sid, ${lh_verdict:-here}) — Amendment 18(h) refuses to retire the one process a lane's binding actually is: it is not a fork and not a duplicate holder, it is the lane. End the lane instead, or name the OTHER pid of a genuine duplicate pair." 2
-        fi
-        ;;
-      8) : ;;
-      *) die "$LANES_EDIT live-holder $LANE failed (exit $lh_rc) while checking whether $retire_target is lane $LANE's own live session. That is NOT 'it is not' — fix the helper or the records, then re-run." 1 ;;
-    esac
-  fi
-
-  dh_parent=""; dh_children=""; dh_uuid=""
-  if [ -z "$fk_sid" ] && [ "$dh_rc" = 0 ]; then
-    # `IFS=$'\037'`, NEVER A TAB: `duplicate-holder`'s child field is
-    # DOCUMENTED empty for a parent with no confirmable fork-session child
-    # (lanes-edit.sh's own `duplicate_holder_pids`, "the child slot stays
-    # empty"), and a bare tab is IFS-whitespace to `read` — two adjacent tabs
-    # either side of that empty field collapse into one delimiter exactly as
-    # repeated spaces do, shifting the uuid into the child field and leaving
-    # `dr_uuid` empty. Measured on e4f9054's CI (`tests-no-submodule`): a
-    # partly-retired duplicate's still-alive child was reported as
-    # `pid <uuid> (child): gone` and its genuinely-killed parent as
-    # `STILL ALIVE, TERM withheld` (its own argv check comparing against an
-    # emptied `$dh_uuid`). The unit separator is not IFS whitespace, so it
-    # never collapses — the same reason `live-holder`'s own line below already
-    # reads with it.
-    # PID ONLY, NEVER THE TRANSCRIPT UUID (Copilot round 9, PR #61): a
-    # duplicate holder is documented as PID-addressed, and matching `dr_uuid`
-    # too made the row's own transcript id a valid target — which cannot
-    # DISTINGUISH between multiple process-table holders of one transcript
-    # (two separate stray `bg-pty-host` duplicates, or a duplicate beside a
-    # not-yet-bound fork under the same id, all carry the identical uuid),
-    # so a uuid match silently picked whichever row this loop reached first.
-    # The uuid form stays reserved for a title-based FORK above, whose id is
-    # one the row does NOT record and so cannot repeat across rows the way a
-    # duplicate holder's row-recorded id can.
-    #
-    # THE CHILD FIELD IS A LIST (opensoft/openRepoTools#86): every child
-    # `duplicate_holder_pids` verified, space-separated, where it used to name
-    # only the first. The target is compared with EACH pid in it, by equality,
-    # never by a substring of the list, so `--retire=<two pids>` names none.
-    while IFS=$'\037' read -r dr_parent dr_children dr_uuid; do
-      [ -n "${dr_parent:-}" ] || continue
-      dr_hit=0
-      if [ "$dr_parent" = "$retire_target" ]; then dr_hit=1; fi
-      for dr_c in $dr_children; do
-        if [ "$dr_c" = "$retire_target" ]; then dr_hit=1; fi
-      done
-      if [ "$dr_hit" = 1 ]; then
-        dh_parent="$dr_parent"; dh_children="$dr_children"; dh_uuid="$dr_uuid"
-        break
-      fi
-    done <<DUPES
-$dh_rows
-DUPES
-  fi
-
-  if [ -n "$dh_parent" ]; then
-    # THE WINDOW'S OWN LIVE SESSION IS NEVER RETIRED THIS WAY (Amendment
-    # 18(h): "the window's own session is the one it refuses to retire") —
-    # reusing the SAME `live-holder` read already taken once above, never a
-    # second shell-out and never a second liveness primitive for one
-    # invocation. Its own case above already dies on anything but 0 or 8, so
-    # by the time control reaches here `lh_rc` can only be one of those two:
-    # `duplicate-holder`'s own exclusion already keeps a live `dh_parent` from
-    # ever equalling `lh_pid`, so this is the residual, cheap check for the
-    # child slot alone (a `pgrep -P` result coinciding with the lane's own
-    # pid would be bizarre, but the fence costs nothing to keep). Every child
-    # in the slot is asked, not only the first (opensoft/openRepoTools#86).
-    if [ -n "$lh_pid" ]; then
-      for dh_c in $dh_parent $dh_children; do
-        if [ "$lh_pid" = "$dh_c" ]; then
-          die "pid $lh_pid is lane $LANE's own live session (session $lh_sid, ${lh_verdict:-here}) — Amendment 18(h) refuses to retire the one process a lane's binding actually is. Retire the OTHER pid of the pair ($prog $LANE --retire <pid>), or end the lane itself." 2
-        fi
-      done
-    fi
-
-    # AMENDMENT 18(h) — A DUPLICATE HOLDER IS TERMED, NOT ONLY NAMED. Unlike
-    # decision 8(e)'s title-based fork above (never killed: Amendment 8(f), A11
-    # clause (k) rule (e) — a fork MIGHT be somebody's long-running job with a
-    # prompt to answer), a live process sharing THIS LANE'S OWN transcript id
-    # is exactly what Amendment 18(h) says may never coexist with the lane's
-    # own session: "the tooling refuses to build on either... it never
-    # appends such an id to the row and never launches a second resume of
-    # it." Retiring the register's own binding does not end a duplicate that
-    # is still holding the transcript file open, so THIS act ends the
-    # duplicate itself — never a process on another transcript (the read is
-    # scoped to this lane's own ids), and never the pid just proved above to
-    # be the lane's own.
-    if (( dry_run )); then
-      dh_c_said=""
-      for dh_c in $dh_children; do dh_c_said="$dh_c_said and pid $dh_c (child)"; done
-      note "--dry-run: would send TERM to pid $dh_parent (bg-pty-host)$dh_c_said — lane $LANE's duplicate holder of transcript $dh_uuid. Nothing sent."
-      exit 0
-    fi
-    # RE-VALIDATED IMMEDIATELY BEFORE EACH SIGNAL, not trusted from the read
-    # a few lines above (Copilot round 3, PR #61): that read and this signal
-    # are two different moments, and a pid can be reaped and reused by an
-    # unrelated process in the gap between them. A pid whose CURRENT argv no
-    # longer shows `--fork-session --resume …<this transcript>.jsonl` is not
-    # signalled — it is treated exactly as "already gone", which is the
-    # honest fact whether it truly exited or the number now belongs to
-    # something else this act must never touch.
-    #
-    # AN EXACT PATH COMPONENT, NOT AN ARBITRARY SUBSTRING (Copilot round 4, PR
-    # #61, the same fix as `duplicate_holder_pids`'s own discovery match):
-    # `*"$uuid.jsonl"*` also matches `other-<uuid>.jsonl` and
-    # `<uuid>.jsonl.bak`, neither of which is THIS transcript's basename.
-    # `/<uuid>.jsonl` must be preceded by a path separator and followed by
-    # the end of the argument or a space.
-    # THE ACTUAL `--resume` VALUE, NOT A GLOB THAT CAN SPAN OTHER ARGUMENTS
-    # (Copilot round 5, PR #61): `*"--resume"*"/$uuid.jsonl"*` matches
-    # `--resume /other.jsonl --label /<uuid>.jsonl` too, since `*` between
-    # them freely crosses argument boundaries. The value right after
-    # `--resume ` is what the harness actually resumed, and that is the only
-    # thing compared.
-    #
-    # READ WHOLE, SPACES AND ALL (opensoft/openRepoTools#76). `ps -o args=`
-    # joins the argv with spaces and quotes nothing, so the cut this used to
-    # make at the first space (`${v%% *}`) turned `--resume /home/Jane
-    # Doe/…/<uuid>.jsonl` into `/home/jane`, read a still-matching duplicate
-    # as "argv no longer matched", and withheld its TERM. The value now ends
-    # at the first `.jsonl` that ends an argument (followed by a space or by
-    # the end of the line), which keeps round 5's case above reading
-    # `/other.jsonl`, and a value with a word opening `--` inside it is
-    # refused as a later option rather than a directory. A value with a
-    # space in it must be one absolute path, starting with `/` and holding no
-    # ` /`, or it is refused too (Brett Heap's ruling of 2026-10-18 on PR
-    # #205): a bare session id followed by a prompt naming this transcript, or
-    # a `<uuid>.jsonl.bak` followed by a word that reaches it through ` /`,
-    # would otherwise be read as one value ending in `/<uuid>.jsonl` and TERMed
-    # here. Not every `<uuid>.jsonl.bak` form is refused: one followed by a
-    # later word that does not begin with `/` still reads as that value. This
-    # is `lanes-edit.sh`'s `dhp_resume_value`, the rule discovery already
-    # applied to this pid, word for word, and its comment there gives that
-    # limit and the others of reading a flattened argv at all; the two must
-    # stay the same rule. It sets `dh_rv` in this shell rather than printing
-    # it.
-    dh_resume_value() {   # <flattened argv, lowercased> — sets dh_rv
-      dh_rv=""
-      case "${1-}" in *"--resume "*) : ;; *) return 0 ;; esac
-      dh_rv_rest="${1#*--resume }"
-      while :; do
-        case "$dh_rv_rest" in *.jsonl*) : ;; *) dh_rv=""; return 0 ;; esac
-        dh_rv="${dh_rv}${dh_rv_rest%%.jsonl*}.jsonl"
-        dh_rv_rest="${dh_rv_rest#*.jsonl}"
-        case "$dh_rv_rest" in "" | " "*) break ;; esac
-      done
-      case "$dh_rv" in *" --"*) dh_rv="" ;; esac
-      case "$dh_rv" in *" "*)
-        case "$dh_rv" in /*) : ;; *) dh_rv="" ;; esac
-        case "$dh_rv" in *" /"*) dh_rv="" ;; esac
-      esac
-      return 0
-    }
-    dh_uuid_lc="$(printf '%s' "$dh_uuid" | tr 'A-F' 'a-f')"
-    dh_p_match=0
-    dh_p_args="$(ps -o args= -p "$dh_parent" 2>/dev/null | tr 'A-F' 'a-f')" || dh_p_args=""
-    # `--fork-session ` WITH ITS OWN TRAILING SPACE (Copilot round 11, PR
-    # #61): a bare substring also matches `--fork-session-helper` or any
-    # other flag that merely STARTS WITH this text — never the process this
-    # recheck means. The real invocation always has a boundary (a space,
-    # then `--resume`) right after this flag, so requiring it here rules the
-    # false one out the same way `--resume ` already rules out
-    # `--resume-file` beside it.
-    case "$dh_p_args" in *"--fork-session "*"--resume "*)
-      dh_resume_value "$dh_p_args"
-      case "$dh_rv" in */"$dh_uuid_lc.jsonl") dh_p_match=1 ;; esac
-    esac
-    # THE SIGNAL'S OWN EXIT STATUS, KEPT APART FROM "DID ARGV MATCH" (Copilot
-    # round 11, PR #61): folding both into one `dh_p_sent` flag and
-    # swallowing `kill`'s status (`|| :`) made a `kill -TERM` that failed
-    # outright — wrong owner, or the pid reaped in the gap since the recheck
-    # above — indistinguishable from one truly delivered. The message below
-    # must be able to say "nothing was sent" (retrying TERM cannot help;
-    # look at who owns the pid) apart from "TERM was sent and ignored" (a
-    # KILL, or more time, is the next step) — that needs both bits kept.
-    dh_p_killed=0
-    if [ "$dh_p_match" = 1 ]; then
-      kill -TERM "$dh_parent" 2>/dev/null && dh_p_killed=1
-    fi
-    # EVERY CHILD IN THE SLOT, NOT ONLY THE FIRST (opensoft/openRepoTools#86):
-    # each is rechecked and signalled on its own, and its two bits are kept
-    # beside its pid as `<pid>:<match><killed>` for the report below, so one
-    # child's verdict is never read as another's.
-    dh_c_state=""
-    for dh_c in $dh_children; do
-      dh_c_match=0
-      dh_c_killed=0
-      dh_c_args="$(ps -o args= -p "$dh_c" 2>/dev/null | tr 'A-F' 'a-f')" || dh_c_args=""
-      case "$dh_c_args" in *"--fork-session "*"--resume "*)
-        dh_resume_value "$dh_c_args"
-        case "$dh_rv" in */"$dh_uuid_lc.jsonl") dh_c_match=1 ;; esac
-      esac
-      if [ "$dh_c_match" = 1 ]; then
-        kill -TERM "$dh_c" 2>/dev/null && dh_c_killed=1
-      fi
-      dh_c_state="$dh_c_state $dh_c:$dh_c_match$dh_c_killed"
-    done
-    # VERIFIED GONE, NOT ASSUMED FROM `kill`'S OWN STATUS (Copilot round 4, PR
-    # #61): that status conflates "already gone" (fine — the goal was never
-    # the signal, it was the duplicate not existing) with "no permission"
-    # (a real failure), and a caller that always reads exit 0 here cannot
-    # tell a genuine retirement from a duplicate still running.
-    #
-    # `kill -0`'S OWN FAILURE HAS THE SAME TWO ANSWERS CONFLATED, ONE LEVEL
-    # DOWN (Copilot round 13, PR #61): ESRCH (truly gone) and EPERM (still
-    # there, just not ours to signal) both read as "gone" here, so a TERM
-    # this process had no permission to deliver in the first place could be
-    # reported RETIRED over a duplicate still running. `kill -0` STAYS the
-    # primary check — it is a raw syscall and answers instantly — and `ps -p`
-    # is asked only where `kill -0` already says gone, to catch the one case
-    # that disagrees: a pid EPERM hid from the syscall but a process listing
-    # can still see.
-    #
-    # `command -p`, NOT A BARE `ps` (measured, not merely reasoned to): this
-    # suite fakes `ps` and `pgrep` for its WHOLE run (`$SANDBOX/fakebin`,
-    # prepended to PATH) so `duplicate_holder_pids`' DISCOVERY never touches
-    # the real process table — but that fake is a STATIC table, built once
-    # from `$FAKE_PS_RECORDS` at fixture setup and never told about a `kill`
-    # this act sends minutes later, so a bare `ps -p` here would ask the very
-    # same fake DISCOVERY consulted and get the pre-kill answer back forever,
-    # no matter how long this retries. Measured directly: this fallback,
-    # written as a bare `ps -p`, reported the DUP/RACE fixtures "STILL ALIVE"
-    # after a genuine, verified `kill -TERM`, on a clean CI runner with no
-    # other process anywhere near that pid — the fake, not scheduling, not
-    # load. `command -p ps` is POSIX's own way to ask for the REAL utility on
-    # a default PATH regardless of what the caller's own PATH resolves to,
-    # exactly the bypass this verification (of a REAL fixture process this
-    # suite itself spawned) needs; `kill -0` needs no such bypass because
-    # nothing here fakes `kill`.
-    #
-    # A BOUNDED RETRY, NOT ONE FIXED PAUSE: a single 0.1s settle is long
-    # enough for every genuinely-gone case under ordinary load, but SIGTERM
-    # delivery and reaping both wait on the scheduler under real contention
-    # from a sibling lane's own concurrent run on a shared workstation.
-    # `dh_settle_gone` polls up to two seconds (twenty tries, 0.1s apart) and
-    # returns the instant both checks agree the pid is gone, so the common,
-    # unloaded case still resolves in one pass.
-    #
-    # `ps` IN A SUBSHELL OF ITS OWN (opensoft/openRepoTools#292): macOS's bash
-    # 3.2 ends a `set -e` script where a utility run through `command` fails,
-    # even after `!` in an `if`, and `ps -p` fails exactly when the pid is
-    # gone, so this act ended at the moment it had its answer. The subshell's
-    # status is ps's either way, and `command -p` keeps its bypass.
-    dh_settle_gone() {   # <pid> — 0 once confirmed gone, 1 if still found
-      dsg_tries=0
-      while [ "$dsg_tries" -lt 20 ]; do
-        if ! kill -0 "$1" 2>/dev/null && ! (command -p ps -p "$1" >/dev/null 2>&1); then
-          return 0
-        fi
-        dsg_tries=$((dsg_tries + 1))
-        sleep 0.1
-      done
-      return 1
-    }
-    dh_p_gone=1; dh_settle_gone "$dh_parent" || dh_p_gone=0
-    dh_p_msg="gone"
-    [ "$dh_p_gone" = 1 ] || dh_p_msg="STILL ALIVE, TERM withheld: argv no longer matched"
-    [ "$dh_p_gone" = 1 ] || [ "$dh_p_match" = 0 ] || [ "$dh_p_killed" = 1 ] || dh_p_msg="STILL ALIVE, TERM NOT SENT: the signal itself failed (check ownership/permissions) — this is not the process ignoring TERM, it never received one"
-    [ "$dh_p_gone" = 1 ] || [ "$dh_p_match" = 0 ] || [ "$dh_p_killed" = 0 ] || dh_p_msg="STILL ALIVE despite TERM delivered"
-    note "pid $dh_parent (bg-pty-host): $dh_p_msg"
-    # EVERY CHILD MUST BE GONE FOR THIS TO SAY RETIRED (opensoft/openRepoTools#86):
-    # one child still alive, whichever it is, makes this a partial retirement
-    # and the refusal below, never a RETIRED over a process still holding the
-    # transcript.
-    dh_c_all_gone=1
-    for dh_c_tok in $dh_c_state; do
-      dh_c="${dh_c_tok%%:*}"; dh_c_bits="${dh_c_tok#*:}"
-      dh_c_match="${dh_c_bits%?}"; dh_c_killed="${dh_c_bits#?}"
-      dh_c_gone=1; dh_settle_gone "$dh_c" || dh_c_gone=0
-      [ "$dh_c_gone" = 1 ] || dh_c_all_gone=0
-      dh_c_msg="gone"
-      [ "$dh_c_gone" = 1 ] || dh_c_msg="STILL ALIVE, TERM withheld: argv no longer matched"
-      [ "$dh_c_gone" = 1 ] || [ "$dh_c_match" = 0 ] || [ "$dh_c_killed" = 1 ] || dh_c_msg="STILL ALIVE, TERM NOT SENT: the signal itself failed (check ownership/permissions) — this is not the process ignoring TERM, it never received one"
-      [ "$dh_c_gone" = 1 ] || [ "$dh_c_match" = 0 ] || [ "$dh_c_killed" = 0 ] || dh_c_msg="STILL ALIVE despite TERM delivered"
-      note "pid $dh_c (child): $dh_c_msg"
-    done
-    if [ "$dh_p_gone" = 1 ] && [ "$dh_c_all_gone" = 1 ]; then
-      step "RETIRED lane $LANE's duplicate holder of transcript $dh_uuid (Amendment 18(h))"
-      note "The lane itself is untouched: its row, and its own live session if it has one, are unaffected."
-      exit 0
-    fi
-    note "The lane itself is untouched: its row, and its own live session if it has one, are unaffected."
-    die "lane $LANE's duplicate holder of transcript $dh_uuid was only partly retired — see the pid lines above. Whatever is still alive did not accept TERM (permission, a handler that ignores it, or argv changed before this act reached it); re-run $prog $LANE --retire <pid> once you have looked, or end it by hand." 1
-  fi
-
-  # ---------------- A DUPLICATE OF THE ROW'S OWN ID, BY SESSION RECORD
-  # (opensoft/openRepoTools#39, Amendment 12/#52) — A DIFFERENT READING OF THE
-  # SAME RULE, FROM A DIFFERENT SURFACE, NOT A REPLACEMENT FOR THE ONE ABOVE.
-  # `duplicate-holder` above finds a `bg-pty-host` wrapper in the PROCESS
-  # TABLE by its `--fork-session --resume <uuid>.jsonl` argv and TERMs it on
-  # sight, because nothing is answering a prompt in it. `transcript-holders`
-  # instead finds every LIVE SESSION RECORD carrying the row's own id,
-  # wherever the harness keeps one — which also catches an ordinary
-  # INTERACTIVE second resume the process-table match was never built to see
-  # — and only REPORTS it, the same way a title-based fork is only reported,
-  # because a second interactive resume may have a prompt open. Both reads
-  # run (each on its own evidence, neither replacing the other); whichever
-  # finds `$retire_target` first answers, and this one is reached only when
-  # the process-table read above did not already match it (`dh_parent` empty).
-  #
-  # THE SECOND POPULATION, AND THE ONE THE FIRST BUILD OF THIS ACT COULD NOT
-  # SEE. Amendment 6(d) allows exactly one live conversation per lane and
-  # Amendment 18(h) sharpens it to one live PROCESS per transcript; `forks`
-  # answers about ids the row does NOT record, and this answers about the id it
-  # DOES. Measured 2026-09-14T12:05–12:30Z on lane openRepoTools-3: a harness
-  # `--fork-session` in a background pty host, whose record sat in ANOTHER
-  # profile's `sessions/` directory, beside the interactive resume of the same
-  # transcript in a tmux window — three live processes on one file at the peak.
-  #
-  # THE WINDOW'S OWN SESSION IS THE ONE IT REFUSES TO RETIRE, and it is read out
-  # of the same rows rather than out of a second helper and a second fetch: the
-  # record that is an interactive session in a window tmux still resolves — by
-  # `<@id>` AND session name, Amendment 11(h)'s agreement rule, which
-  # `transcript-holders` owns — is the lane's session. Every OTHER live process
-  # carrying that id is the duplicate.
-  dup_pid=""; dup_kind=""; dup_where=""; dup_prof=""
-  dup_own=""; dup_rows=""; dup_id=""
-  dup_comp=""; dup_comp_kind=""; dup_comp_prof=""
-  # `dup_other` IS NOT `dup_rows`'S OWN EMPTINESS (Copilot round 8, PR #61
-  # follow-up, caught by this suite rather than by review): `lane-end` is a
-  # plain script, never itself a bound claude session, so `transcript_holders`
-  # never sees a "here" record and every row it returns — INCLUDING the
-  # lane's own perfectly ordinary live session — verdicts `unrelated` rather
-  # than `companion` or `duplicate`. Reading raw `dup_rows` as "something is
-  # live here" made an entirely healthy lane (one live session, nothing else)
-  # answer the SAME as a lane with a genuine second process: `--retire` on a
-  # pid that is neither refused with 8 ("nothing of any kind is live") but
-  # with 2 ("neither ... nor a live duplicate"), naming a "duplicate" that was
-  # only ever the lane's own session all along. `$lh_pid` — proved a few lines
-  # above by `live-holder`, the one liveness implementation this file has, and
-  # already known before this read ever runs — is the fence: a row that IS it
-  # is accounted for and not "other"; a row that is not it genuinely is.
-  dup_other=""
-  if [ -z "$fk_sid" ] && [ -z "$dh_parent" ]; then
-    du_rc=0
-    dup_id="$(LANES_NO_FETCH=1 "$LANES_EDIT" last-session "$LANE" 2>/dev/null)" || du_rc=$?
-    case "$du_rc" in
-      0 | 8) : ;;
-      *) die "$LANES_EDIT last-session $LANE exited $du_rc, so the id the row records could not be read and whether '$retire_target' is a DUPLICATE of it is not known. That is not 'it is not one', and this script will not name an act against a process it could not prove is one." 1 ;;
-    esac
-    if [ "$du_rc" = 0 ] && [ -n "$dup_id" ]; then
-      # `thh_rc` AND NOT `dh_rc`: this is `transcript-holders`' OWN exit
-      # status, a different read from `duplicate-holder`'s above, and reusing
-      # that name here would step on a value `dh_rc` no longer needs by this
-      # point but a later reader of this block could mistake for it.
-      thh_rc=0
-      dup_rows="$("$LANES_EDIT" transcript-holders "$dup_id" 2>/dev/null)" || thh_rc=$?
-      case "$thh_rc" in
-        0 | 8) : ;;
-        2) note "this \`lanes-edit.sh\` has no \`transcript-holders\` (exit 2), so a duplicate of lane $LANE's own transcript cannot be looked for here. Install the one beside this script (\`openRepoTools --install\`)." ;;
-        *) die "$LANES_EDIT transcript-holders $dup_id exited $thh_rc, so whether '$retire_target' is a live duplicate of lane $LANE's own transcript could NOT be read — which is not 'it is not one'." 1 ;;
-      esac
-      if [ "$thh_rc" = 0 ]; then
-        # WHICH PROFILES HAVE AN INTERACTIVE HOLDER, FIRST (Copilot round 10,
-        # PR #61) — a `kind: bg` row is Amendment 8 ruling (g)'s companion
-        # ONLY beside an interactive record IN THE SAME PROFILE; a `kind: bg`
-        # row in a profile with no interactive row of its own is not anyone's
-        # proven companion and stays a candidate "other" (round 9's own fix
-        # read EVERY `kind: bg` row as a companion, which also excluded a
-        # genuine duplicate in a DIFFERENT profile — exactly `transcript_
-        # holders`' own `duplicate` case, "any record at all in ANOTHER
-        # profile's sessions/", which this PR's own repoGD fixture already
-        # exercises). Built in its own pass because a row's verdict alone
-        # cannot answer this from OUTSIDE any bound window wherever no ONE
-        # live window answers for the transcript. `transcript_holders` now
-        # reads the companion off the LANE's live window record from any
-        # window (openRepoTools#73, item 2) — but where tmux is silent, the
-        # session is in no window, or two live windows in two profiles carry
-        # it, every row still reads `unrelated`, `companion` included, and
-        # `duplicate_holder_pids` applies this very rule, so it stays.
-        dup_int_profs=""
-        while IFS=$'\037' read -r ip_pid ip_kind ip_tgt ip_prof ip_where ip_verdict ip_file; do
-          [ -n "${ip_pid:-}" ] || continue
-          [ "$ip_kind" = bg ] && continue
-          case "$dup_int_profs" in *" $ip_prof "*) : ;; *) dup_int_profs="${dup_int_profs} $ip_prof " ;; esac
-        done <<<"$dup_rows"
-        while IFS=$'\037' read -r dr_pid dr_kind dr_tgt dr_prof dr_where dr_verdict dr_file; do
-          [ -n "${dr_pid:-}" ] || continue
-          # A WINDOW THAT COULD NOT BE ASKED ABOUT IS UNKNOWN AND NOT DEAD
-          # (Amendment 18(b)): `(not asked)` — no tmux here, or a record with
-          # no `<@id>` in it — PROTECTS the process, and so does `(no
-          # answer)` — tmux installed and its server silent, which used to
-          # come back `(gone)` and let `--retire <the lane's own pid>` print
-          # 6(d)'s retitle for the conversation that IS the lane
-          # (openRepoTools#73, item 1). Only a `(gone)` this server actually
-          # refuted makes it retirable.
-          case "$dr_where" in
-            "window "*"(gone)") dr_own=0 ;;
-            "window "*) dr_own=1 ;;
-            *) dr_own=0 ;;
-          esac
-          if [ "$dr_own" = 1 ] && [ "$dr_kind" != bg ]; then
-            dup_own="${dup_own:+$dup_own }$dr_pid"
-          fi
-          dr_is_comp=0
-          if [ "$dr_verdict" = companion ]; then
-            dr_is_comp=1
-          elif [ "$dr_kind" = bg ]; then
-            case "$dup_int_profs" in *" $dr_prof "*) dr_is_comp=1 ;; esac
-          fi
-          # NEITHER lane $LANE's OWN KNOWN LIVE PID (proved above by
-          # `live-holder`, Copilot round 8 follow-up: that pid is accounted
-          # for whatever `transcript_holders` verdicts it here, `unrelated`
-          # included) NOR ITS HARNESS COMPANION (Copilot round 9, refined
-          # round 10: the companion test above, not `dr_kind = bg` alone —
-          # so a stranger pid against a lane with nothing wrong keeps
-          # answering 8, never a false "a duplicate exists" 2, while a
-          # `kind: bg` row in a DIFFERENT profile with no interactive row
-          # of its own still counts as one).
-          if { [ -z "$lh_pid" ] || [ "$dr_pid" != "$lh_pid" ]; } && [ "$dr_is_comp" = 0 ]; then
-            dup_other=1
-          fi
-          if [ "$dr_pid" = "$retire_target" ]; then
-            # THE HARNESS'S OWN COMPANION IS NOT A DUPLICATE AND MAY NOT BE
-            # NAMED AS ONE. `transcript_holders` marks it `companion` — the
-            # `kind: bg` record beside THIS window's own record of this id,
-            # Amendment 8 ruling (g)'s *"records that share a `sessionId` are
-            # one session, not a queue of rival holders"* — and the guard and
-            # `lane-start` both pass it over in silence. Selecting it here would
-            # have this act print Amendment 6(d)'s ending for one half of a live
-            # session that IS the lane (Copilot round 2 on this PR). It is held
-            # separately so the refusal below can say WHICH thing the pid is,
-            # rather than falling through to "neither" and naming nothing.
-            #
-            # `$dr_is_comp` (Copilot rounds 9 AND 10, PR #61), NOT `dr_verdict`
-            # ALONE: the verdict is `companion` when `lane-end` runs from
-            # WITHIN the lane's own bound window, or — since openRepoTools#73 —
-            # from anywhere ONE live window answers for the transcript; where
-            # none does (tmux silent, no window, two live windows in two
-            # profiles) every row here verdicts `unrelated` instead, `companion`
-            # included, and round 9's first fix read `dr_kind = bg` alone as
-            # the fallback signal — which ALSO excluded a genuine `kind: bg`
-            # duplicate in a DIFFERENT profile (`transcript_holders`' own
-            # `duplicate` case), since a companion is proven only BESIDE an
-            # interactive holder of this id IN THE SAME PROFILE, never by
-            # kind alone. `$dr_is_comp`, computed above against every
-            # interactive row's own profile, is the one test both routings
-            # (this one and `dup_other`'s) now share.
-            if [ "$dr_is_comp" = 1 ]; then
-              dup_comp="$dr_pid"; dup_comp_kind="${dr_kind:-interactive}"
-              dup_comp_prof="$dr_prof"
-            else
-              dup_pid="$dr_pid"; dup_kind="${dr_kind:-interactive}"
-              dup_where="$dr_where"; dup_prof="$dr_prof"
-            fi
-          fi
-        done <<<"$dup_rows"
-      fi
-    fi
-  fi
-
-  # THE COMPANION IS REFUSED BY NAME TOO, and before the rest, because it is
-  # the one pid a person can reach for here that is neither a duplicate nor the
-  # lane's own session: it is the OTHER HALF of the session that is. Ending it
-  # is not Amendment 6(d)'s act on anything — 6(d) ends an idle background
-  # session still holding a lane NAME, and this one holds the live session's own
-  # id, which ruling (g) reads as one session and not as a rival.
-  if [ -z "$fk_sid" ] && [ -z "$dh_parent" ] && [ -z "$dup_pid" ] && [ -n "$dup_comp" ]; then
-    die "pid $dup_comp is the HARNESS'S OWN COMPANION of lane $LANE's live session (kind ${dup_comp_kind:-bg}; profile ${dup_comp_prof:-unknown}; the same transcript ${dup_id:-unknown} and the same profile as this window's own record of it). Amendment 8 ruling (g): \"records that share a \`sessionId\` are one session, not a queue of rival holders, and there is no contest between them to win\" — so it is not a duplicate of anything, and ending it would end one half of the session that IS this lane. Nothing is named. To retire a real duplicate pass ITS pid (\`$LANES_EDIT transcript-holders $dup_id\` lists every live process carrying this transcript and says which is which); to end the lane, run: $prog $LANE" 2
-  fi
-
-  # THE WINDOW'S OWN SESSION IS REFUSED BY NAME, and the refusal names the act
-  # that DOES end a lane, because an operator who typed this meant one of the
-  # two and there is no third thing to mean.
-  # AND WHERE TMUX DID NOT ANSWER, IT SAYS THAT INSTEAD (openRepoTools#73,
-  # item 1): `(no answer)` protects the process because its window could not be
-  # read at all, which is not the same as having read it and found the lane, so
-  # the refusal names the silence rather than claiming what it could not see.
-  if [ -z "$fk_sid" ] && [ -z "$dh_parent" ] && [ -n "$dup_pid" ]; then
-    case " $dup_own " in
-      *" $dup_pid "*)
-        case "$dup_where" in
-          *"(no answer)")
-            die "pid $dup_pid carries lane $LANE's own transcript in $dup_where, and tmux did not answer at all — its server is down, or unreachable from here — so whether that window is still there could not be read. A window nobody could ask about is NOT a dead one (Amendment 18(b)), and the process in it may be the session that IS the lane, so nothing is named. Re-run this where tmux answers; to end the lane, run: $prog $LANE" 2 ;;
-        esac
-        die "pid $dup_pid IS lane $LANE's own live session, in its own window ($dup_where) — not a duplicate of it. Retiring the session that IS the lane is how a lane loses the conversation it is, so nothing is named. To end the lane, run: $prog $LANE   ·   to retire a duplicate, pass ITS pid (\`$LANES_EDIT transcript-holders $dup_id\` lists every live process carrying this transcript)." 2 ;;
-    esac
-  fi
-
-  if [ -z "$fk_sid" ] && [ -z "$dh_parent" ] && [ -n "$dup_pid" ]; then
-    fk_today="$(date -u +%Y-%m-%d)"
-    step "pid $dup_pid IS a live DUPLICATE of lane $LANE's own transcript $dup_id — proved, and NOTHING has been written or stopped"
-    note "  $dup_where  kind $dup_kind  profile $dup_prof"
-    note "A transcript is held by ONE live process (Amendment 18(h), ratified 2026-09-14): two of them append to one file, each overwriting what the other wrote. The lane's own session is${dup_own:+ pid $dup_own} in its window."
-    case "$dup_kind" in
-      bg)
-        note "Amendment 6(d)'s retire act for a BACKGROUND holder: \"an idle background session still holding a lane name is ended\". It has no prompt to type into, so the retitle below is not available to it."
-        note "Ending it is YOUR act and no tool's (Amendment 8(f) refuses it by name, and A11 clause (k) rule (e) repeats the refusal for this surface): the pid above is the process." ;;
-      *)
-        note "Amendment 6(d)'s retire act, typed IN THAT SESSION — there is no API to rename one from outside it:"
-        note "    /rename $LANE · retired $fk_today" ;;
-    esac
-    note "Until it is retired, every surface goes on naming it — which is true, because it is still a second live writer of this lane's transcript until one of the two acts above is taken."
-    note "The lane itself is untouched: this ended nothing, wrote nothing and killed nothing."
-    if (( dry_run )); then
-      note "--dry-run changes nothing here: this act writes nothing on any path, so the run above IS the whole of it."
-    fi
-    exit 0
-  fi
-
-  if [ -z "$fk_sid" ] && [ -z "$dh_parent" ]; then
-    if [ -n "$fk_rows" ]; then
-      note "the live forks of lane $LANE's transcript are:"
-      printf '%s\n' "$fk_rows" | while IFS="$(printf '\t')" read -r fr_sid fr_pid fr_kind fr_cwd; do
-        [ -n "${fr_sid:-}" ] || continue
-        note "  $fr_sid  pid $fr_pid  ${fr_kind:-interactive}  $fr_cwd"
-      done
-    else
-      note "no fork of lane $LANE's transcript is live on this workstation. A fork is found by its transcript's TITLE under an id the row does not record (ratified decision 8(e)); \`$LANES_EDIT forks $LANE\` is the read that names them."
-    fi
-    if [ -n "${dh_rows:-}" ]; then
-      note "the live duplicate holders of lane $LANE's transcript, by PROCESS TABLE, are:"
-      printf '%s\n' "$dh_rows" | while IFS=$'\037' read -r dr_parent dr_children dr_uuid; do
-        [ -n "${dr_parent:-}" ] || continue
-        # Every child in the slot, each named on its own (#86).
-        dr_c_said=""
-        for dr_c in $dr_children; do dr_c_said="$dr_c_said, pid $dr_c (child)"; done
-        note "  pid $dr_parent (bg-pty-host)$dr_c_said  transcript $dr_uuid"
-      done
-    else
-      note "no live duplicate holder of lane $LANE's transcript is in the process table either (Amendment 18(h), opensoft/openRepoTools#39); \`$LANES_EDIT duplicate-holder $LANE\` is the read that names them."
-    fi
-    if [ -n "$dup_rows" ]; then
-      note "and the live processes carrying lane $LANE's OWN transcript ${dup_id:-(none recorded)}, by SESSION RECORD, are:"
-      printf '%s\n' "$dup_rows" | while IFS=$'\037' read -r dr_pid dr_kind dr_tgt dr_prof dr_where dr_verdict dr_file; do
-        [ -n "${dr_pid:-}" ] || continue
-        note "  pid $dr_pid  ${dr_kind:-interactive}  $dr_where  profile $dr_prof"
-      done
-    else
-      note "and no second live session record carries lane $LANE's own transcript ${dup_id:-(none recorded)} either (Amendment 18(h))."
-    fi
-    # 8 IS KEPT FOR "THERE IS NOTHING OF ANY KIND", which is the code this act
-    # has answered since it was written and the one a caller reads as "no
-    # fork is live". The 2 is for a target that is not one of the things that
-    # ARE there — a stranger's pid, another lane's uuid — and the two stayed
-    # one code until issue #39 gave the act a second population, now a third,
-    # to look in: `forks` (title, never killed), `duplicate-holder` (process
-    # table, TERMed), `transcript-holders` (session record, never killed) —
-    # three reads answering one rule (Amendment 18(h): one live process per
-    # transcript), kept as three because each is built on a different kind of
-    # evidence and this workstation is not the only place any one of them can
-    # fail to see what another does.
-    if [ -z "$fk_rows" ] && [ -z "${dh_rows:-}" ] && [ -z "$dup_other" ]; then
-      die "nothing of any kind is live for lane $LANE on this workstation, so there is nothing to retire: no FORK of its transcript (an id the row does not record, ratified decision 8(e)), no live DUPLICATE HOLDER of the id it does in the process table (Amendment 18(h), opensoft/openRepoTools#39), and no live DUPLICATE of it by session record either (Amendment 18(h))." 8
-    fi
-    die "'$retire_target' is neither the session id nor the pid of a live fork of lane $LANE, nor the pid (parent or child) of a live duplicate holder of its own transcript in the process table, nor the pid of a live duplicate of it by session record. Naming an act against something that is none of this lane's is how the wrong conversation gets retitled and the wrong process gets stopped, so nothing is named. Pick one of the ids or pids above." 2
-  fi
-
-  # AMENDMENT 6(d), FILLED IN — and it is TWO acts because 6(d) is two, one per
-  # kind of session: *"When a lineage is superseded, handed off or dead, it is
-  # retitled `<lane> · retired <YYYY-MM-DD>`, and an idle background session
-  # still holding a lane name is ENDED."* A fork with a prompt can be retitled
-  # from inside it and there is no API to do it from out here (clause (f) step
-  # 7's own reason); a `kind: bg` fork has no prompt at all, which is exactly
-  # what Evidence 6's `--fork-session` daemon was, so the retitle is not
-  # available there and 6(d)'s second half is the one that applies.
-  fk_today="$(date -u +%Y-%m-%d)"
-  step "$fk_sid IS a live fork of lane $LANE's transcript — proved, and NOTHING has been written or stopped"
-  note "  pid ${fk_pid:-unknown}  ${fk_kind}${fk_cwd:+  cwd $fk_cwd}"
-  case "$fk_kind" in
-    bg)
-      note "Amendment 6(d)'s retire act for a BACKGROUND holder: \"an idle background session still holding a lane name is ended\". It has no prompt to type into, so the retitle below is not available to it."
-      note "Ending it is YOUR act and no tool's (Amendment 8(f) refuses it by name, and clause (k) rule (e) repeats the refusal for this surface): the pid above is the process." ;;
-    *)
-      note "Amendment 6(d)'s retire act, typed IN THAT SESSION — there is no API to rename one from outside it:"
-      note "    /rename $LANE · retired $fk_today" ;;
-  esac
-  note "Until it is retired, \`$LANES_EDIT forks $LANE\` goes on naming it and every surface goes on marking the lane — which is true, because it is still a fork of this lane until one of the two acts above is taken."
-  note "The lane itself is untouched: this ended nothing, wrote nothing and killed nothing."
-  if (( dry_run )); then
-    note "--dry-run changes nothing here: this act writes nothing on any path, so the run above IS the whole of it."
-  fi
-  exit 0
-fi
-
-# ---------------------------------------------------------------- the row
-
-# AMENDMENT 15 — `tolower` ON BOTH SIDES, exactly as `lane-start`'s function of
-# this name now compares and as `row_line` compares one file over. The resolver
-# above has usually already made `$LANE` the row's own spelling, and this is
-# what happens when it could NOT: a helper predating `canon-lane` spends 2 on
-# the unknown subcommand, and a register holding 15(d)'s pair spends 2 as well.
-# Byte for byte, `lane-end openxfactory-2` on the lane `openXfactory-2` then
-# reads as NO ROW — and the refusal's own remedy is `add-row`, which is the
-# 23:51:56Z incident performed by the other end of the lane. (`add-row` refuses
-# it, so the register is safe either way; the message was the defect.)
-rows_for_lane() {
-  awk -v lane="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      if (tolower(substr(rest, 1, p2 - 1)) == tolower(lane)) print
-    }' "$LANES_FILE"
-}
-# The SPELLINGS those rows carry, for a refusal that can name them — two rows
-# for one lane may now be two spellings of one name, and a person sent looking
-# for a duplicate that is not there to find loses the time twice.
-row_names_for_lane() {
-  awk -v lane="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      t = substr(rest, 1, p2 - 1)
-      if (tolower(t) == tolower(lane)) print t
-    }' "$LANES_FILE"
-}
-
-row="$(rows_for_lane "$LANE" || :)"
-row_count=0
-[ -n "$row" ] && row_count="$(printf '%s\n' "$row" | grep -c . || :)"
-
-case "$row_count" in
-  0) die "the register has no row for lane $LANE — nothing to end. If the lane predates the helpers, add its row first: lanes-edit.sh add-row \"| \`$LANE\` | … |\"" 2 ;;
-  1) : ;;
-  *) rfl_names="$(row_names_for_lane "$LANE" | tr '\n' ' ')"
-     rfl_distinct="$(row_names_for_lane "$LANE" | LC_ALL=C sort -u | grep -c . || :)"
-     rfl_why="and lanes-edit.sh can edit neither. Merge them into one row by hand in $LANES_FILE, then re-run"
-     if [ "$rfl_distinct" -gt 1 ]; then
-       # BRACED: bash decides where a NAME ends with a locale-dependent
-       # `isalnum()`, and bash 3.2 on Darwin reads the em dash's three bytes as
-       # part of it (A9 Addendum 4, R-A9-11).
-       rfl_why="spelled ${rfl_names}— a lane name is ONE name under any case (Amendment 15), so those are two rows for ONE lane, and lanes-edit.sh can edit neither. Merge them into one row by hand in $LANES_FILE — Amendment 15(d): append the newer row's session id(s) to the older row's session cell, in order, and remove the newer row in the SAME commit, whose message names both spellings — then re-run"
-     fi
-     die "the register has $row_count rows for lane $LANE, $rfl_why" 2 ;;
-esac
-
-# THE SEAM, after the row's own refusals and before the state cell, the in-flight
-# guard and every write (ruling 2026-10-04; see `seam_refuse` above).
-seam_refuse "$LANE" "a lane end"
-
-# The state cell is the row's SEVENTH column — awk field 8, because $1 is the
-# empty string before the leading pipe — and it runs to the trailing pipe, so a
-# cell that contains a literal `|` is rejoined rather than truncated. Counting
-# back from NF returned the last FRAGMENT of such a cell, and the live register
-# has two rows with stray pipes in them: for one, NF-1 is ` re-cut `. A
-# fragment that happens not to carry the word LANDING is a fail-open.
-state_cell_of() {
-  local s
-  s="$(printf '%s\n' "$1" | awk -F'|' '{
-    if (NF >= 9) { c = $8; for (i = 9; i < NF; i++) c = c "|" $i; print c }
-    else { print $(NF-1) }
-  }')"
-  s="${s#"${s%%[![:space:]]*}"}"   # ltrim
-  s="${s%"${s##*[![:space:]]}"}"   # rtrim
-  printf '%s' "$s"
-}
-state_cell="$(state_cell_of "$row")"
-
-# ------------------------------------------------------- the in-flight guard
-
-# FIRST, exactly, from the lane's own object log (Amendment 7). `lane-objects`
-# prints this lane's LAST event per object — an object another lane has since
-# taken over is no longer this lane's business and is not listed.
-# ONLY 0 AND 8 ARE ANSWERS. `lane-objects` exits 8 for "this lane has no log
-# file" — the pre-cutover case — and 0 with the rows otherwise. Every other
-# exit is the helper FAILING, and the difference is the difference between "the
-# lane holds nothing" and "nobody asked". With `2>/dev/null` and a single
-# failure code, a broken helper made this script print `no object log for
-# <lane> (pre-cutover lane)` about a lane that was holding an open claim, and
-# end it. Rule 6's merge hold and Rule 1's claim both stopped being enforced,
-# silently, and the fragment the next session reads said there was nothing.
-log_rows=""; have_log=0; open_list=""; open_objs=""
-LE_TMP="$(mktemp)"
-lo_rc=0
-log_rows="$("$LANES_EDIT" lane-objects "$LANE" 2>"$LE_TMP")" || lo_rc=$?
-[ -s "$LE_TMP" ] && cat -- "$LE_TMP" >&2
-case "$lo_rc" in
-  0) have_log=1 ;;
-  8) have_log=0 ;;
-  *) note "the helper's own output is above."
-     die "$LANES_EDIT lane-objects $LANE failed (exit $lo_rc). That is NOT 'this lane has no object log', and this script will not guess which it is while the lane may still hold something. Fix the helper (or run it by hand: $LANES_EDIT lane-objects $LANE), then re-run." 1 ;;
-esac
-
-if [ "$have_log" = 1 ]; then
-  while IFS=$'\037' read -r o_utc o_verb o_obj o_ref o_sup; do
-    [ -n "${o_verb:-}" ] || continue
-    case "$o_verb" in
-      CLAIMED|TAKEOVER|OPENED|LANDING|WITHDRAWN)
-        if [ -n "${o_sup:-}" ]; then
-          # Another lane took this object over. A lane closes only its OWN
-          # hold, so this lane's CLAIMED is still its last line and would
-          # refuse for ever. The way out is its own RELEASED line.
-          open_list="${open_list}${open_list:+$'\n'}  $o_verb $o_obj ($o_utc) — taken over by lane:${o_sup%@*} at ${o_sup#*@}; run: lanes-edit.sh release $o_obj \"taken over by ${o_sup%@*}\""
-        else
-          open_list="${open_list}${open_list:+$'\n'}  $o_verb $o_obj${o_ref:+ $o_ref} ($o_utc)"
-        fi
-        open_objs="${open_objs}${open_objs:+, }$o_obj" ;;
-    esac
-  done <<<"$log_rows"
-fi
-
-# Everything below is CASE-SENSITIVE on purpose: the protocol's words are
-# LANDING, CLAIMED, LANDED, RELEASED in capitals, and a row's ordinary prose
-# ("nothing claimed tonight") is not a claim.
-scrub_cell() {
-  printf '%s' "$1" | sed -E 's/(NOTHING IS CLAIMED|NOTHING CLAIMED|NONE CLAIMED|NOT CLAIMED|UNCLAIMED|NO CLAIM|NO LANDING OPEN|NO LANDING|LANDING WITHDRAWN|LANDING CLOSED|NOT LANDING|LANDING WINDOW|NOTHING IN FLIGHT)//Ig'
-}
-# AMENDMENT 13(a) — WHERE THE CELL IS THE PHRASE, ONLY THE STATE PART IS READ.
-# `<STATE> · <UTC> · <one line>`: the STATE is where the lane is and the line is
-# PROSE about its last act, which may legitimately say "waiting for LANDING #7"
-# or "released the claim". Scanned whole, that prose is a merge hold this
-# command then refuses to close the lane over — a false hold in the one path
-# that still decides a hold from words rather than from the log (Copilot round 1
-# on openRepoTools#82). A LEGACY DIARY CELL IS UNCHANGED and is still scanned
-# whole; the two are told apart the way the migration tells them apart, by
-# asking whether the cell's SECOND ` · ` field is exactly an instant — a diary's
-# second entry begins with one and is never only one.
-# BOTH FIELDS ARE CHECKED, NOT ONE (Copilot round 4 on openRepoTools#82). A
-# second field that is an instant is not enough: a LEGACY DIARY whose second
-# entry is nothing but a timestamp — `ACTIVE · 2026-09-12T10:00:00Z · LANDING
-# #7` — would pass that test, the scan would be narrowed to `ACTIVE`, and a
-# pre-cutover lane holding an open landing would be CLOSED instead of refused.
-# Narrowing is the fail-OPEN direction, so it is taken only where the cell is
-# certainly the phrase: the first field one of Amendment 13(a)'s seven states
-# (or `MIGRATED`, which `migrate-state-cells` writes and which holds nothing),
-# the second exactly an instant, and a third part after it. That is
-# `mig_cell_is_phrase`'s rule in `lanes-edit.sh`; the states are the
-# amendment's own list, and this is the second place that list is written.
-# THE LINE KEEPS DECISION O1's GRAMMAR TOO (opensoft/openRepoTools#90, part
-# (a); Copilot's last review of #82). `set-row-state` refuses a line of more
-# than 240 characters or one carrying `|` or CR/LF, so a cell with any of them
-# was not written by it, and narrowing there dropped its prose from the scan
-# all the same: an open LANDING in that prose closed the lane. That cell is
-# scanned whole, like a diary. The cap is in CHARACTERS and `${#x}` is BYTES in
-# a C locale, where a line of `—` and `→` inside it would read as past it and
-# a lane merely waiting for a LANDING would be held by it: past 240, a line
-# that is valid UTF-8 is recounted with its continuation bytes taken out, the
-# same number in every locale. Text that is not valid UTF-8 has continuation
-# bytes that follow nothing and are no characters, so it keeps the first count,
-# which can only over-count, and an over-count reads more of the cell.
-cell_for_scan() {   # <state cell> — the part of it that says where the lane is
-  cfs="$1"
-  case "$cfs" in
-    *' · '*)
-      cfs_one="${cfs%% · *}"
-      cfs_rest="${cfs#* · }"
-      case "$cfs_rest" in *' · '*) : ;; *) printf '%s' "$cfs"; return 0 ;; esac
-      cfs_two="${cfs_rest%% · *}"
-      cfs_three="${cfs_rest#* · }"
-      # EXACTLY THREE PARTS, AND THE THIRD NOT EMPTY — `mig_cell_is_phrase`'s
-      # rule to the letter (Copilot round 5 on openRepoTools#82). A FOURTH ` · `
-      # means a diary: `LIVE · <UTC> · a note · <UTC> LANDING #7` has the
-      # phrase's first two fields and a history after them, and narrowing to
-      # `LIVE` there would close a lane over an open landing.
-      case "$cfs_three" in
-        '' | *' · '*) printf '%s' "$cfs"; return 0 ;;
-      esac
-      # O1's OWN RULES FOR THE LINE, which `mig_cell_is_phrase` does not test
-      # and `set-row-state` does (#90): no `|`, no CR/LF, at most 240 characters.
-      case "$cfs_three" in
-        *'|'* | *$'\n'* | *$'\r'*) printf '%s' "$cfs"; return 0 ;;
-      esac
-      # `iconv -c` drops what is not UTF-8, and its exit status is not to be
-      # trusted (musl's is 0 either way), so the text is UTF-8 when it comes
-      # back unchanged; with no `iconv` it never does. A count that cannot be
-      # made is a long line, and BSD `wc` pads, hence the `tr`.
-      cfs_len="${#cfs_three}"
-      if [ "$cfs_len" -gt 240 ]; then
-        cfs_utf8="$(printf '%s' "$cfs_three" | iconv -c -f UTF-8 -t UTF-8 2>/dev/null)" || :
-        if [ "$cfs_utf8" = "$cfs_three" ]; then
-          cfs_len="$(printf '%s' "$cfs_three" | LC_ALL=C tr -d '\200-\277' | wc -c | tr -d ' ')" ||
-            cfs_len=241
-        fi
-      fi
-      [ "$cfs_len" -le 240 ] || { printf '%s' "$cfs"; return 0; }
-      cfs_ok=0
-      case "$cfs_one" in
-        LIVE|PAUSED|LANDED|ENDED|RETIRED|'HANDED OFF'|MIGRATED) cfs_ok=1 ;;
-        'LANDING #'*)
-          case "${cfs_one#LANDING #}" in
-            '' | *[!0-9]*) : ;;
-            *) cfs_ok=1 ;;
-          esac ;;
-      esac
-      case "$cfs_two" in
-        [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]Z | [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) : ;;
-        *) cfs_ok=0 ;;
-      esac
-      [ "$cfs_ok" = 1 ] && cfs="$cfs_one" ;;
-  esac
-  printf '%s' "$cfs"
-}
-haystack="$(scrub_cell "$(cell_for_scan "$state_cell")")"
-
-# Start index of the LAST occurrence of $2 in $1, or -1.
-last_index() {
-  local h="$1" needle="$2" rest="${1##*"$2"}"
-  [ "$rest" = "$h" ] && { printf -- '-1'; return 0; }
-  printf '%s' "$(( ${#h} - ${#rest} - ${#needle} ))"
-}
-
-# The STATE-CELL scan keeps its own word. It used to reset the one the log loop
-# had just set, so a lane whose hold came from its log and whose state cell said
-# neither LANDING nor CLAIMED ended with an EMPTY verb written into the register
-# and into the append-only log — `while  was still open` — and the register line
-# blamed the state cell for a hold the script had just announced it read from
-# `lanes/log/<lane>.md`.
-# It is a FUNCTION because it now runs over two cells, not one — see below. It
-# sets cell_at, cell_word and close_at, and RETURNS 0 when that cell is in
-# flight: the last LANDING or CLAIMED in it has no LANDED or RELEASED after it.
-cell_at=-1; cell_word=""; close_at=-1
-scan_cell() {
-  local h="$1" w i
-  cell_at=-1; cell_word=""
-  for w in LANDING CLAIMED; do
-    i="$(last_index "$h" "$w")"
-    if [ "$i" -gt "$cell_at" ]; then cell_at="$i"; cell_word="$w"; fi
-  done
-  close_at=-1
-  for w in LANDED RELEASED; do
-    i="$(last_index "$h" "$w")"
-    if [ "$i" -gt "$close_at" ]; then close_at="$i"; fi
-  done
-  [ "$cell_at" -ge 0 ] && [ "$close_at" -lt "$cell_at" ]
-}
-
-cell_source="this checkout's row"
-in_flight=0
-if [ "$have_log" = 1 ]; then
-  # The log is authoritative for a lane that has one. The state cell is the
-  # row's prose history and no longer decides anything here.
-  [ -n "$open_list" ] && in_flight=1
-  step "in-flight read from lanes/log/$LANE.md (exact), not from the state cell"
-  scan_cell "$haystack" || :
-else
-  # PRE-CUTOVER, AND THE ROW IS READ FROM `origin/main` TOO. `lane-objects`
-  # reads what has LANDED (Amendment 7, R19) and this fallback read the WORKING
-  # TREE — which a fetch does not move. A peer's `LANDING` appended to this
-  # row's state cell and pushed is therefore invisible here until something
-  # pulls, so the one path that still decides a merge hold from prose could
-  # write `NOTHING IN FLIGHT` over a hold that is current, and Rule 6 stops
-  # being enforced for exactly the lanes that have nothing else enforcing it.
-  # BOTH cells are scanned and EITHER is a refusal: this checkout's row may
-  # carry a hold that has not been pushed yet, and the published row a hold
-  # that has not been pulled. A hold seen anywhere is a hold.
-  scan_cell "$haystack" && in_flight=1
-  if [ "$in_flight" = 0 ]; then
-    pub_rc=0
-    pub_row="$("$LANES_EDIT" register-row "$LANE" 2>/dev/null)" || pub_rc=$?
-    case "$pub_rc" in
-      0)
-        pub_hay="$(scrub_cell "$(cell_for_scan "$(state_cell_of "$pub_row")")")"
-        if [ "$pub_hay" != "$haystack" ] && scan_cell "$pub_hay"; then
-          in_flight=1; haystack="$pub_hay"; cell_source="the published row on origin/main"
-          step "the published row carries an open $cell_word that this checkout has not pulled"
-        fi ;;
-      8) : ;;                     # the published register has no row for it yet
-      *) note "the helper's own output is above."
-         die "$LANES_EDIT register-row $LANE failed (exit $pub_rc). This lane has no object log, so its row's state cell is the ONLY thing that can say whether a merge hold is open, and this script will not end a lane on a read it did not get. Fix the helper (or run it by hand: $LANES_EDIT register-row $LANE), then re-run." 1 ;;
-    esac
-  fi
-fi
-
-rflag=""; (( retire )) && rflag=" --retire"
-
-if [ "$in_flight" = 1 ] && [ "$have_log" = 1 ]; then
-  if [ "$force" = 0 ]; then
-    note "lane $LANE still holds $(printf '%s\n' "$open_list" | grep -c .) object(s) — its own log's last event on each is still open:"
-    printf '%s\n' "$open_list" >&2
-    # THE REAL CLI GRAMMAR OF THE HELPER, and only verbs it accepts. The arrow is
-    # its OWN argument: quoted into the free-text slot, `log LANDED <obj>
-    # "→ <sha>"` writes the sha AFTER the ` — `, the line stops matching
-    # `LANDED → <sha>`, and the Rule 6 line in the register loses the merge sha for
-    # good in a file nothing rewrites. There is no `MERGED` verb at all — the
-    # post-merge line IS `LANDED → <sha>` — and `log RELEASED` is refused, since
-    # `release` is the subcommand and it posts the Rule 1 comment as well.
-    note "the fix, in the order the protocol wants it — one of these per object:"
-    note "  LANES_LANE=$LANE lanes-edit.sh log LANDED <object> → <merge sha>    # the PR merged"
-    note "  LANES_LANE=$LANE lanes-edit.sh release <object> \"<why>\"             # the claim is given up"
-    note "  LANES_LANE=$LANE lanes-edit.sh log CLOSED <object>                  # closed without merging"
-    note "  $prog $LANE$rflag"
-    note "or end it anyway and record that you did: $prog $LANE --force$rflag"
-    exit 2
-  fi
-  step "--force: ending with $(printf '%s\n' "$open_list" | grep -c .) object(s) still open in the lane's log; the line written says so"
-elif [ "$in_flight" = 1 ]; then
-  # Bash substring, not `cut -c`: ${#s} counts characters and GNU cut counts
-  # bytes, and these cells are full of · — → , so the two disagree.
-  from=$(( cell_at > 40 ? cell_at - 40 : 0 ))
-  excerpt="${haystack:from:160}"
-  # BRACED, AND THE BRACES ARE LOAD-BEARING (A9 Addendum 4, R-A9-11). The line
-  # below writes `\u2026$excerpt\u2026`, and bash decides where a variable NAME ends
-  # with `isalnum()`, which is LOCALE-DEPENDENT: bash 3.2 on Darwin, under the
-  # `en_US.UTF-8` the runner sets, reads the three bytes of `\u2026` as name
-  # characters and looks up `excerpt\u2026` instead. Unset, `set -u`, and
-  # `lane-end` died where it was about to print the refusal \u2014 the macOS job read
-  # `lane-end: line 573: excerpt\u2026: unbound variable`, exit 0 instead of the
-  # exit 2 that whole branch exists for. `${excerpt}` says where the name ends.
-  if [ "$force" = 0 ]; then
-    note "lane $LANE has no object log yet (pre-cutover), so this is the state cell's substring scan, over $cell_source:"
-    note "lane $LANE still has something in flight — the last $cell_word in its state cell has no LANDED or RELEASED after it:"
-    note "  …${excerpt}…"
-    note "the fix, in the order the protocol wants it:"
-    note "  lanes-edit.sh set-row-state $LANE \"LANDED · PR #<n> merged as <merge sha>\"      # or ENDED · …"
-    note "  $prog $LANE$rflag"
-    note "or end it anyway and record that you did: $prog $LANE --force$rflag"
-    exit 2
-  fi
-  step "--force: ending with an open $cell_word in the state cell; the line written says so"
-fi
-
-# ---------------------------------------- the close-out gate (#163)
-#
-# WORKSPACE CREATION OUTPACES WORKSPACE CLOSEOUT, and this is where the second
-# catches up with the first (opensoft/openRepoTools#163, on Brett Heap's word
-# of 2026-10-05). A lane ended while its writers' trees, their branches, its
-# scratch and its caches are still on disk leaves them to nobody: the cleanup
-# records show landing and retirement as separate acts for months, and the
-# separate act not happening. So the end of a lane asks, exactly as it already
-# asks about open objects, and refuses while the answer is not "nothing".
-#
-# THE QUESTION IS THE SWEEP'S DRY RUN, never a second implementation of it:
-# `lane-worktrees sweep <lane> --dry-run --porcelain` is #162's exit contract
-# for this gate — 0 nothing of the lane's to retire, 3 something to retire, 2
-# refused or a read failed — and its rows are what the refusal names. Any other
-# exit, a missing command included, is a gate nobody read, and a read that
-# failed is never an answer (Amendment 7(d)): exit 1, and nothing is written.
-# `LANES_NO_FETCH=1` because this command has just fetched, in its own reads.
-#
-# TWO READS OF THIS COMMAND'S OWN SIT BESIDE IT, and both are about what the
-# sweep's rows do not say. `git status --porcelain --ignored` in every tree of
-# the lane's, because the sweep's own status read leaves ignored files out and
-# a tree holding an `.env` or a `node_modules` is not a clean tree to name. And
-# every entry directly under the lane's own root, `.lane-worktrees/<lane>/`,
-# that no tree, scratch or cache row names — a directory a removed tree left its
-# ignored files in, a brief, a log — which the sweep never lists and which is
-# still the lane's: RESIDUE, and it refuses even where the sweep answered 0.
-#
-# `--inventory-only` IS THE ONE DOOR, and it takes the lane past every answer
-# but leaves every tree where it is and in the lane's #97 inventory; the reason
-# it was let past is written into the row's closing phrase and the ENDED line.
-# `--sweep`, which would retire them in the same run, is not built: the act
-# that retires them is `lane-worktrees sweep --yes`, on its own.
-TAB="$(printf '\t')"
-gate_argv=(sweep "$LANE" --branches --include-scratch --include-caches)
-gate_shown="lane-worktrees ${gate_argv[*]}"
-
-# A PATH'S PHYSICAL SPELLING, the way the sweep compares paths (`realpath`):
-# a symlink under the lane's root is an entry of its own and is not followed.
-gate_real() {   # <path>
-  gr_p="${1-}"; gr_r=""
-  if [ -d "$gr_p" ] && [ ! -L "$gr_p" ]; then
-    gr_r="$(CDPATH='' cd -P -- "$gr_p" 2>/dev/null && pwd -P)" || gr_r=""
-  else
-    gr_r="$(CDPATH='' cd -P -- "$(dirname -- "$gr_p")" 2>/dev/null && pwd -P)" || gr_r=""
-    if [ -n "$gr_r" ]; then gr_r="${gr_r%/}/$(basename -- "$gr_p")"; fi
-  fi
-  printf '%s\n' "${gr_r:-$gr_p}"
-}
-
-# WHAT IS IN ONE TREE, IGNORED FILES INCLUDED. `GIT_OPTIONAL_LOCKS=0`: a read
-# that refreshed the index would be a write, and this gate writes nothing.
-gate_tree_state() {   # <path>
-  gts_p="${1-}"
-  if [ ! -d "$gts_p" ]; then printf 'its directory is gone'; return 0; fi
-  gts_top="$(git -C "$gts_p" rev-parse --show-toplevel 2>/dev/null)" || gts_top=""
-  if [ -z "$gts_top" ] || [ "$(gate_real "$gts_top")" != "$(gate_real "$gts_p")" ]; then
-    if ! ls -A -- "$gts_p" >/dev/null 2>&1; then
-      printf 'no checkout of its own, and what is in it could not be listed'
-      return 0
-    fi
-    gts_n=0
-    for gts_e in "$gts_p"/* "$gts_p"/.[!.]* "$gts_p"/..?*; do
-      if [ -e "$gts_e" ] || [ -L "$gts_e" ]; then gts_n=$((gts_n + 1)); fi
-    done
-    printf 'no checkout of its own; %s entr(ies) in it' "$gts_n"
-    return 0
-  fi
-  gts_st="$(GIT_OPTIONAL_LOCKS=0 git -C "$gts_p" status --porcelain=v1 --ignored --untracked-files=normal 2>/dev/null)" || {
-    printf 'git status --ignored could not be read in it'
-    return 0
-  }
-  gts_m=0; gts_u=0; gts_i=0
-  gts_c="$(printf '%s\n' "$gts_st" | awk 'NF { k = substr($0, 1, 2); if (k == "!!") i++; else if (k == "??") u++; else m++ } END { printf "%d %d %d\n", m + 0, u + 0, i + 0 }')"
-  read -r gts_m gts_u gts_i <<GTS || :
-$gts_c
-GTS
-  if [ "$gts_m" = 0 ] && [ "$gts_u" = 0 ] && [ "$gts_i" = 0 ]; then
-    printf 'git status --ignored: clean, nothing ignored in it either'
-    return 0
-  fi
-  gts_ign="$(printf '%s\n' "$gts_st" | awk 'substr($0, 1, 3) == "!! " { print substr($0, 4) }' | head -n 3 | tr '\n' ' ')"
-  printf 'git status --ignored: %s changed; %s untracked; %s ignored' "$gts_m" "$gts_u" "$gts_i"
-  if [ -n "$gts_ign" ]; then printf ' (%s)' "${gts_ign% }"; fi
-  return 0
-}
-
-gate_rc=0; gate_out=""; gate_err=""
-if [ -x "$LANE_WORKTREES" ]; then
-  : > "$LE_TMP"
-  gate_out="$(LANES_EDIT="$LANES_EDIT" LANES_NO_FETCH=1 "$LANE_WORKTREES" "${gate_argv[@]}" --dry-run --porcelain 2>"$LE_TMP")" || gate_rc=$?
-  gate_err="$(cat -- "$LE_TMP" 2>/dev/null || :)"
-else
-  gate_rc=127
-  gate_err="there is no executable lane-worktrees at $LANE_WORKTREES; \`openRepoTools --install\` places it beside this command (or set LANE_WORKTREES)"
-fi
-
-gate_holder=""; gate_refused=""; gate_lines=""; gate_named=""
-gate_trees=0; gate_branches=0; gate_scratch=0; gate_caches=0; gate_residue=0; gate_foreign=0
-gate_legs=0; gate_leg_lines=""   # T018: an assembly's leg checkouts, counted and listed
-gate_person=0     # counted rows `--yes` leaves too: a person's to settle
-gate_lf='
-'
-while IFS="$TAB" read -r g_kind g_a g_b g_c g_d g_e g_f; do
-  [ -n "${g_kind:-}" ] || continue
-  # THE FIELDS ARE ESCAPED (`\\`, `\t`, `\n`, `\r`) so a path is one field
-  # whatever it holds, and `%b` is exactly the inverse: every backslash of the
-  # original arrives doubled, so no other escape can appear.
-  case "$g_kind" in
-    lane)    gate_holder="${g_c:-}" ;;
-    refused) gate_refused="${g_a:-}" ;;
-    tree)
-      g_path="$(printf '%b' "${g_c:-}")"
-      # A FOREIGN ROW NAMES NOTHING FOR THE RESIDUE READ (S1 of the review of
-      # #175): it is counted for nobody, so a standalone clone under the lane's
-      # own root, which the sweep keeps FOREIGN, must still hold the gate.
-      case "${g_a:-}" in
-        foreign) gate_foreign=$((gate_foreign + 1)); continue ;;
-      esac
-      gate_named="${gate_named}$(gate_real "$g_path")${gate_lf}"
-      [ "${g_b:-}" = retire ] || continue
-      gate_trees=$((gate_trees + 1))
-      case "${g_a:-}" in keep | live | load-bearing) gate_person=$((gate_person + 1)) ;; esac
-      g_head="${g_e:-?}"
-      gate_lines="${gate_lines}  tree     ${g_a}  ${g_path}  [${g_d:-?} ${g_head:0:12}]${gate_lf}             $(gate_tree_state "$g_path")${gate_lf}             ${g_f:-}${gate_lf}" ;;
-    branch)
-      [ "${g_b:-}" = retire ] || continue
-      gate_branches=$((gate_branches + 1))
-      case "${g_a:-}" in keep | list) gate_person=$((gate_person + 1)) ;; esac
-      gate_lines="${gate_lines}  branch   ${g_a}  $(printf '%b' "${g_c:-}")  ${g_d:-}${gate_lf}             ${g_f:-}${gate_lf}" ;;
-    scratch)
-      g_path="$(printf '%b' "${g_c:-}")"
-      gate_named="${gate_named}$(gate_real "$g_path")${gate_lf}"
-      gate_scratch=$((gate_scratch + 1))
-      case "${g_a:-}" in keep | live | load-bearing) gate_person=$((gate_person + 1)) ;; esac
-      gate_lines="${gate_lines}  scratch  ${g_a}  ${g_path}  (${g_e:-0} bytes)${gate_lf}             ${g_f:-}${gate_lf}" ;;
-    cache)
-      g_path="$(printf '%b' "${g_c:-}")"
-      gate_named="${gate_named}$(gate_real "$g_path")${gate_lf}"
-      gate_caches=$((gate_caches + 1))
-      gate_lines="${gate_lines}  cache    ${g_a}  ${g_path}  (${g_e:-0} bytes)${gate_lf}" ;;
-    # T018 (opensoft/openRepoTools#186): A LEG CHECKOUT OF AN ASSEMBLY — only
-    # where the lane's checkout is one; a single repository prints no such row.
-    # The sweep counts it (`retire`) where its HEAD's own Lane: trailer is this
-    # lane's and it holds work origin lacks or edits no commit carries, or
-    # where it could not be read; one that holds work and is not this lane's
-    # is listed below the table and counted for nobody, as the assembly's own
-    # checkout is. No sweep acts on one, so its remedy is a person's.
-    leg)
-      g_path="$(printf '%b' "${g_c:-}")"
-      g_head="${g_e:-?}"
-      if [ "${g_b:-}" = retire ]; then
-        gate_legs=$((gate_legs + 1))
-        gate_lines="${gate_lines}  leg      ${g_a}  ${g_path}  [${g_d:-?} ${g_head:0:12}]${gate_lf}             ${g_f:-}${gate_lf}"
-      else
-        case "${g_a:-}" in
-          clean | absent) : ;;
-          *) gate_leg_lines="${gate_leg_lines}  leg      ${g_a}  ${g_path}  [${g_d:-?} ${g_head:0:12}]${gate_lf}             ${g_f:-}${gate_lf}" ;;
-        esac
-      fi ;;
-  esac
-done <<GATE
-$gate_out
-GATE
-
-# RESIDUE: what is directly under the lane's own root and is named by no row.
-# The root is beside the lane's recorded directory, as the sweep derives it; a
-# lane that records none has none. A read of that directory that FAILED is the
-# gate unread, never an empty root.
-gate_unread=""
-gd_rc=0; gd_dir=""
-gd_dir="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-dir "$LANE" 2>/dev/null)" || gd_rc=$?
-gate_root=""
-case "$gd_rc" in
-  0) gd_dir="${gd_dir%/}"
-     if [ -n "$gd_dir" ]; then gate_root="${gd_dir%/*}/.lane-worktrees/$LANE"; fi ;;
-  8) : ;;
-  *) gate_unread="\`$LANES_EDIT lane-dir $LANE\` exited $gd_rc, so the lane's own root could not be read for residue" ;;
-esac
-gate_is_named() {   # <physical path>
-  gin_p="${1-}"
-  while IFS= read -r gin_l; do
-    if [ -n "$gin_l" ] && [ "$gin_l" = "$gin_p" ]; then return 0; fi
-  done <<GIN
-$gate_named
-GIN
-  return 1
-}
-# A ROOT THAT CANNOT BE LISTED IS NOT AN EMPTY ONE (Copilot round 1 on #175):
-# a glob over a directory nobody may read matches nothing, and every entry of
-# it would pass unseen. `ls -A`'s status is the probe, and it is asked first.
-if [ -n "$gate_root" ] && [ -d "$gate_root" ] && ! ls -A -- "$gate_root" >/dev/null 2>&1; then
-  gate_unread="${gate_unread:+$gate_unread; }the lane's own root $gate_root could not be listed, so what is in it is unknown"
-elif [ -n "$gate_root" ] && [ -d "$gate_root" ]; then
-  for g_ent in "$gate_root"/* "$gate_root"/.[!.]* "$gate_root"/..?*; do
-    if [ ! -e "$g_ent" ] && [ ! -L "$g_ent" ]; then continue; fi
-    if gate_is_named "$(gate_real "$g_ent")"; then continue; fi
-    gate_residue=$((gate_residue + 1))
-    if [ -L "$g_ent" ]; then
-      g_what="a symlink"
-    elif [ -d "$g_ent" ]; then
-      g_what="$(gate_tree_state "$g_ent")"
-    else
-      g_what="a file"
-    fi
-    gate_lines="${gate_lines}  residue  ${g_ent}${gate_lf}             ${g_what}; under the lane's own root and neither a tree nor scratch the sweep knows${gate_lf}"
-  done
-elif [ -n "$gate_root" ] && [ -e "$gate_root" ]; then
-  gate_unread="${gate_unread:+$gate_unread; }the lane's own root $gate_root is there and is no directory"
-fi
-
-gate_left=""
-gate_part() {   # <count> <noun>
-  if [ "${1:-0}" -gt 0 ]; then gate_left="${gate_left:+$gate_left and }$1 $2"; fi
-  return 0
-}
-gate_part "$gate_trees" "tree(s)"
-gate_part "$gate_branches" "branch(es)"
-gate_part "$gate_scratch" "scratch dir(s)"
-gate_part "$gate_caches" "cache(s)"
-gate_part "$gate_residue" "residue path(s)"
-gate_part "$gate_legs" "leg checkout(s)"
-
-# THE VERDICT. 0 passes only with nothing named and nothing unread beside it;
-# 3 and 2 never pass; anything else is the gate nobody read.
-gate_pass=0; gate_exit=2; gate_log=""
-case "$gate_rc" in
-  0) if [ -z "$gate_left" ] && [ -z "$gate_unread" ]; then gate_pass=1; fi
-     gate_log="the close-out gate (sweep exit 0) found ${gate_left:-nothing} left${gate_unread:+ and could not read its own root for residue}" ;;
-  3) gate_log="the close-out gate (sweep exit 3) found ${gate_left:-something} left" ;;
-  2) gate_log="the close-out gate's sweep refused this lane (exit 2)${gate_left:+ with $gate_left left}" ;;
-  *) gate_exit=1
-     gate_log="the close-out gate could not be read (lane-worktrees exit $gate_rc)" ;;
-esac
-# A ROOT THAT COULD NOT BE READ IS THE GATE UNREAD WHATEVER THE SWEEP ANSWERED
-# (Copilot round 2 on #175): exit 1, the environment, on 3 and 2 as on 0.
-if [ -n "$gate_unread" ]; then
-  gate_exit=1
-  case "$gate_rc" in
-    2 | 3) gate_log="$gate_log; and its own root could not be read for residue" ;;
-  esac
-fi
-
-if [ "$gate_pass" = 1 ]; then
-  step "close-out gate: nothing of lane $LANE's is left on disk ($gate_shown --dry-run answered 0)"
-  if [ -n "$gate_leg_lines" ]; then
-    note "the assembly's leg checkout(s) below hold work that is not this lane's by its HEAD's own Lane: trailer; they are listed and NOT counted, as the assembly's own checkout is not:"
-    printf '%s' "$gate_leg_lines" >&2
-  fi
-  if [ "$inventory_only" = 1 ]; then
-    note "--inventory-only changed nothing: the close-out gate passed, so the lane ends as any other does"
-  fi
-  inventory_only=0
-else
-  fflag=""; (( force )) && fflag=" --force"
-  if [ "$inventory_only" = 0 ]; then
-    case "$gate_rc" in
-      0 | 3)
-        if [ -z "$gate_left" ] && [ -n "$gate_unread" ]; then
-          note "lane $LANE is NOT ended: the close-out gate (opensoft/openRepoTools#163) could not read all it asks about, and a read that failed is never an answer (Amendment 7(d))."
-        else
-          note "lane $LANE is NOT ended: the close-out gate (opensoft/openRepoTools#163) found what is still the lane's: ${gate_left:-the rows below}"
-        fi ;;
-      2)     note "lane $LANE is NOT ended: the close-out gate's sweep refused it (exit 2): ${gate_refused:-it printed no reason; run the table below}" ;;
-      *)     note "lane $LANE is NOT ended: the close-out gate could not be read — \`$gate_shown --dry-run --porcelain\` exited $gate_rc, and a read that failed is never an answer (Amendment 7(d))." ;;
-    esac
-    if [ -n "$gate_lines" ]; then printf '%s' "$gate_lines" >&2; fi
-    if [ -n "$gate_leg_lines" ]; then
-      note "and the assembly's leg checkout(s) below hold work that is not this lane's by its HEAD's own Lane: trailer; they are listed and NOT counted:"
-      printf '%s' "$gate_leg_lines" >&2
-    fi
-    if [ "$gate_foreign" -gt 0 ]; then
-      note "($gate_foreign FOREIGN tree(s) beside these are not this lane's, and were not counted.)"
-    fi
-    if [ -n "$gate_unread" ]; then note "and: $gate_unread"; fi
-    if [ "$gate_exit" = 1 ] && [ -n "$gate_err" ]; then
-      note "what the gate said on stderr:"
-      printf '%s\n' "$gate_err" | sed -e 's/^/    /' >&2
-    fi
-    note "the table, which changes nothing:"
-    note "  $gate_shown"
-    # THE ACT IS OFFERED ONLY WHERE THE SWEEP WOULD TAKE IT: on 2 its `--yes`
-    # refuses for the same reason its dry run did.
-    gate_act=0
-    if [ "$gate_rc" = 3 ]; then gate_act=1; fi
-    if [ "$gate_rc" = 0 ] && [ "$gate_caches" -gt 0 ]; then gate_act=1; fi
-    # T018: A LEG IS NO SWEEP'S TO RETIRE, so where legs are all that is
-    # counted the act offered is the person's, not `--yes`.
-    if [ "$gate_legs" -gt 0 ] && [ $((gate_trees + gate_branches + gate_scratch + gate_caches)) = 0 ]; then gate_act=0; fi
-    if [ "$gate_act" = 1 ]; then
-      note "the one act that retires them (--yes removes only what is on origin or in a bundle, never a live writer's tree):"
-      if [ "$gate_holder" = live ]; then
-        note "  $gate_shown --yes --live <each live writer's worktree> | --live none"
-      else
-        note "  $gate_shown --yes"
-      fi
-      if [ "$gate_person" -gt 0 ]; then
-        note "  ($gate_person row(s) above marked keep, live, load-bearing or list are left by --yes as well: each says why, and settling it is a person's)"
-      fi
-    fi
-    if [ "$gate_residue" -gt 0 ]; then
-      note "residue is no sweep's to retire: move it to \${XDG_STATE_HOME:-~/.local/state}/openRepoTools/lanes/$LANE/scratch/ or remove it by hand"
-    fi
-    if [ "$gate_legs" -gt 0 ]; then
-      note "a leg checkout is the assembly's and no sweep acts on one: commit and push its work from inside it (git -C <leg> status, git -C <leg> push), then end the lane again"
-    fi
-    note "or end the lane and leave them where they are, in its inventory, with the reason written down:"
-    note "  $prog $LANE$rflag$fflag --inventory-only"
-    exit "$gate_exit"
-  fi
-  step "--inventory-only: ending lane $LANE past the close-out gate; $gate_log. Nothing on disk is touched, and the lines written say so"
-fi
-
-# --- BEGIN shared one-line cut (lane-collision-protocol Amendment 13(a)) ---
-# BYTE-IDENTICAL IN `lane-start`, `lane-end` AND `lane-handoff`, the three
-# commands that write a row's state cell — the same trade the four lane helpers
-# already make for their workspace resolver, and for the same reason: a drifted
-# copy is TWO ANSWERS to one question, and "what may this line contain, and
-# where may it be cut" is one question.
-#
-# FOUR THINGS THE CELL'S LINE MAY NOT CARRY, and `set-row-state` REFUSES all
-# four — which would cost the row its stamp or its closing write, so they are
-# fixed here rather than met there:
-#
-#   ` · `  the phrase's own separator. A second one reads back as a fourth part
-#          of `<STATE> · <UTC> · <one line>`; it is spelled `; `.
-#   `|`    a cell boundary in a Markdown table row. A launch command or a
-#          directory may legitimately hold one — `claude --flag 'a|b'`, a path
-#          with a pipe in it — and the row is where it would forge a column
-#          (Copilot round 1 on openRepoTools#82). It is spelled `¦`, the broken
-#          bar, which is not a separator anywhere here; the object log's own
-#          line keeps the character itself.
-#   CR/LF  a row is ONE LINE of a table, so a newline in this text would split
-#          it in two and every row after it would be read as a lane. Spelled
-#          `; ` for the same reason the separator is (Copilot round 2).
-#   >240   ratified decision O1's cap. Cut at 230 with the last partial WORD
-#          dropped, which is what makes the cut safe: `${s:0:n}` counts BYTES
-#          wherever the locale is not a UTF-8 one, and a byte offset can land
-#          inside the very characters above. 230 and not 240, so the ` ...`
-#          marker fits inside the cap however the two count.
-cut_to_line() {   # <line> — the row's one line, safe to hand to set-row-state
-  ctl="${1//$'\r'/ }"
-  ctl="${ctl//$'\n'/; }"
-  ctl="${ctl// · /; }"
-  ctl="${ctl//|/¦}"
-  [ "${#ctl}" -gt 230 ] || { printf '%s' "$ctl"; return 0; }
-  ctl="${ctl:0:230}"
-  case "$ctl" in *' '*) ctl="${ctl% *}" ;; esac
-  printf '%s ...' "$ctl"
-}
-# --- END shared one-line cut ---
-
-# --------------------------------------------------------------- the write
-
-utc="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-# ONE SPELLING OF THE WORKSTATION, the one `lanes-edit.sh:438` uses and
-# `lane-start` now uses — `${LANES_WORKSTATION:-$(hostname -s)}` (A9 Addendum
-# 4, R-A9-13). This line is the `lane-end on <ws>` free text of the row's
-# status, which a reader compares with the workstation column beside it.
-ws_pair="$(lanes_workstation_pair)"
-ws="${ws_pair%%	*}"
-# A CONTAINER WITH NO CONFIGURED WORKSTATION WRITES NOTHING (Amendment 11,
-# decision 8(d), `R-A11-14`): this value is the `lane-end on <ws>` free text of
-# the row's status, which a reader compares with the workstation column beside
-# it, and a container id there is a comparison that can never match.
-ws_why="$(lanes_workstation_why "${ws_pair##*	}")"
-[ -z "$ws_why" ] || die "$ws_why" 2
-# The register line names the source it actually read (the log for a lane that
-# has one, the state cell for a pre-cutover lane) and the objects it read there.
-# AMENDMENT 13(a) — THE CLOSING WRITE IS THE WHOLE CELL, AND IT CARRIES THE
-# STATE WORD. The `state` column holds ONE PHRASE, `<STATE> · <UTC> · <one
-# line>`, and `set-row-state` stamps the UTC itself, so this builds the line
-# alone. `RETIRED` and `ENDED` are both clause (a) states, which is why
-# `--retire` no longer needs a second write of its own — see below.
-state_word=ENDED; (( retire )) && state_word=RETIRED
-state_line="lane-end on $ws: window closing; NOTHING IN FLIGHT"
-if [ "$in_flight" = 1 ] && [ "$have_log" = 1 ]; then
-  # THE COUNT AND NOT THE LIST. Amendment 13(a)'s line is ONE line about the
-  # lane's state, and a lane forced closed over eleven open objects names them
-  # in 300 characters — measured in the suite's own `repoE-1`, which is exactly
-  # the row this write then could not make. The objects are in the ENDED line of
-  # the lane's own log, one section below, and in the refusal this `--force`
-  # overrode; the row says how many there were and where they are.
-  state_line="lane-end on $ws: window closing; ENDED WITH --force while this lane's own object log still showed $(printf '%s\n' "$open_list" | grep -c .) object(s) open; they are in lanes/log/$LANE.md"
-elif [ "$in_flight" = 1 ]; then
-  state_line="lane-end on $ws: window closing; ENDED WITH --force while the state cell of $cell_source still showed an open $cell_word; read the archived cell before trusting it"
-fi
-# THE DOOR PAST THE CLOSE-OUT GATE IS WRITTEN DOWN (#163): the row says it was
-# taken and what the gate found, so an ended lane whose trees are still on disk
-# is never read as one that closed out clean. It goes AFTER whatever the line
-# already says, so a forced end keeps its own words first.
-if [ "$inventory_only" = 1 ]; then
-  state_line="$state_line; ENDED WITH --inventory-only: $gate_log; they stay in its #97 inventory"
-fi
-# The cell's own separator never appears INSIDE the line, and a line over
-# Amendment 13's cap is cut here rather than costing the row its whole closing
-# write — the object log one section along carries the full text either way.
-state_line="$(cut_to_line "$state_line")"
-
-if (( dry_run )); then
-  plan "lanes-edit.sh set-row-state $LANE \"$state_word · $state_line\""
-else
-  LANES_LANE="$LANE" "$LANES_EDIT" set-row-state "$LANE" "$state_word · $state_line"
-  step "row closed: $state_word"
-fi
-
-# ------------------------------------------------------------------ --retire
-
-# `--retire` USED TO BE A SECOND WRITE, and Amendment 13(a) is what removed it.
-# The cell was the row's history, so retiring a lane meant REPLACING THE STATE
-# WORD it opened with and leaving everything after that word alone —
-# `replace-in-row` with an anchor that had to occur exactly once in the row,
-# which is what `--state-was` existed to supply when the derived word did not.
-# The cell is now ONE PHRASE that every write replaces, so the closing write
-# above already carries `RETIRED` as its state and there is nothing left for a
-# second act to flip. `--state-was` is accepted and ignored, because a person
-# with the old habit must not be refused mid-teardown.
-if (( retire )); then
-  [ -z "$state_was" ] ||
-    note "--state-was is no longer needed: Amendment 13(a) made the state cell one phrase that set-row-state REPLACES, so the closing write above already carries RETIRED. It was ignored."
-  (( dry_run )) || step "state cell reads RETIRED"
-fi
-
-# ------------------------------------------- the lane's own object log line
-
-# Amendment 7. Written after the row, and it never fails the end of a lane:
-# a lane that cannot write its log has still ended, and says that it could not.
-# THE EVENT LINE FOLLOWS THE GRAMMAR, AND ITS FREE TEXT CARRIES NO ` — ` (R21).
-# The line reads
-#   ENDED — lane X, session u@W, T, lane:X — forced; open: <object list>
-# so ` — ` occurs exactly twice, which is the guarantee that makes one parser
-# read every line. The old text spent a third one on prose and named an EMPTY
-# verb; the writer now refuses any free text carrying that separator, so this is
-# enforced rather than hoped for.
-lane_verb=ENDED; (( retire )) && lane_verb=RETIRED
-lane_text="window closing; NOTHING IN FLIGHT"
-if [ "$in_flight" = 1 ] && [ "$have_log" = 1 ]; then
-  lane_text="forced; open: $open_objs"
-elif [ "$in_flight" = 1 ]; then
-  lane_text="forced; open: $cell_word in the state cell (pre-cutover lane, no object log)"
-fi
-# AND THE LANE'S OWN LOG CARRIES THE REASON IN FULL, which the row's 240
-# characters may have cut (#163). No ` — ` and no `, ` in it: the line's own
-# separators.
-if [ "$inventory_only" = 1 ]; then
-  lane_text="$lane_text; inventory-only: $gate_log; $gate_shown names them"
-fi
-
-if (( dry_run )); then
-  plan "lanes-edit.sh log $lane_verb lane:$LANE --text \"$lane_text\""
-elif LANES_LANE="$LANE" "$LANES_EDIT" log "$lane_verb" "lane:$LANE" ${home_override:+--home "$home_override"} --text "$lane_text" >/dev/null; then
-  step "object log: $lane_verb"
-else
-  note "the lane's object log was NOT written ($lane_verb). Write it by hand:"
-  note "  LANES_LANE=$LANE $LANES_EDIT log $lane_verb lane:$LANE --text \"$lane_text\""
-fi
-
-# ------------------------------------------------------- the handoff fragment
-#
-# On STDOUT, so it can be piped straight into the handoff the row points at.
-# Generated from the log, because a handoff written from memory is how an
-# object goes missing between two sessions of one lane.
-
-# The headers NAME the two sets in the printed fragment, so a reader can check
-# the partition against the amendment without reading the code that produced
-# it — and so that nobody reads `## Done` as "merged" or `## Open` as "unclaimed".
-printf '## Done (RELEASED, CLAIM-LOST, CLOSED, LANDED)\n\n'
-done_n=0
-if [ "$have_log" = 1 ]; then
-  while IFS=$'\037' read -r o_utc o_verb o_obj o_ref o_sup; do
-    [ -n "${o_verb:-}" ] || continue
-    case "$o_verb" in
-      CLOSED|LANDED|RELEASED|CLAIM-LOST)
-        printf -- '- %s — %s%s (%s)\n' "$o_verb" "$o_obj" "${o_ref:+ $o_ref}" "$o_utc"
-        done_n=$((done_n + 1)) ;;
-    esac
-  done <<<"$log_rows"
-fi
-[ "$done_n" = 0 ] && printf -- '- nothing recorded as done in this lane'"'"'s log\n'
-
-# AND IT READS `lane_objects`' FIFTH FIELD, like the refusal above. An object
-# another lane has taken over is still this lane's LAST LINE — a lane closes
-# only its own hold — so it belongs under `## Open`; what it is not is OPEN. Left
-# unqualified it is pasted into the next session's handoff as work that lane
-# still has, about an object `who` says another lane holds: this fragment is the
-# one surface that becomes a durable document, and the refusal, `who <object>`
-# and `who --lane` all carry the takeover already.
-printf '\n## Open (CLAIMED, TAKEOVER, OPENED, LANDING, WITHDRAWN)\n\n'
-open_n=0
-if [ "$have_log" = 1 ]; then
-  while IFS=$'\037' read -r o_utc o_verb o_obj o_ref o_sup; do
-    [ -n "${o_verb:-}" ] || continue
-    case "$o_verb" in
-      CLAIMED|TAKEOVER|OPENED|LANDING|WITHDRAWN)
-        if [ -n "${o_sup:-}" ]; then
-          printf -- '- %s — %s%s (%s) — superseded by TAKEOVER (lane:%s) — release it\n' \
-            "$o_verb" "$o_obj" "${o_ref:+ $o_ref}" "$o_utc" "${o_sup%@*}"
-        else
-          printf -- '- %s — %s%s (%s)\n' "$o_verb" "$o_obj" "${o_ref:+ $o_ref}" "$o_utc"
-        fi
-        open_n=$((open_n + 1)) ;;
-    esac
-  done <<<"$log_rows"
-else
-  printf -- '- no object log for %s (pre-cutover lane) — see its row'"'"'s state cell in LANES.md\n' "$LANE"
-fi
-[ "$have_log" = 1 ] && [ "$open_n" = 0 ] && printf -- '- nothing open\n'
-
-(( dry_run )) && step "--dry-run: nothing was written"
-exit 0
diff --git a/lane-handoff b/lane-handoff
deleted file mode 100755
index e1a43cee..00000000
--- a/lane-handoff
+++ /dev/null
@@ -1,3139 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# lane-handoff — the swap, the context clear and the handoff, under one name.
-#
-#   lane-handoff [why]             hand this lane off: fix the identity triple,
-#                                  refresh the handoff, poll the writers, write
-#                                  the PAUSED record, print the restart line
-#   lane-handoff --restart [why]   the same, and then RESPAWN this lane's own
-#                                  pane through the launcher with the handoff's
-#                                  top block as the new session's first prompt
-#                                  (`/ctx`, Amendment 17(f))
-#   lane-handoff --exit [why]      the same, and then type `/exit` into this
-#                                  lane's own pane (Amendment 18(d), for a
-#                                  handoff another place REQUESTED)
-#   lane-handoff --in-process [why]
-#                                  the same, for a clear that keeps THIS PROCESS
-#                                  running: the record says `kind in-process`
-#                                  and the top block tells the next session that
-#                                  every writer SURVIVED and to relaunch none
-#   lane-handoff --late --at <UTC> [why]
-#                                  the record written AFTER THE FACT for a swap
-#                                  that never ran, BEFORE the relaunch
-#
-# lane-collision-protocol **Amendment 17**, ratified 2026-09-14T09:45:33Z,
-# clause (a): *"the act Amendment 8(a) calls the swap is the HANDOFF:
-# `lane-handoff` on `PATH` (placed by `openRepoTools --install`) from a shell,
-# `/handoff` from inside a session; `/lane-swap` and `/swap` remain as aliases"*.
-# The steps are the `handoff` skill's, which are Amendment 8(a)'s and Amendment
-# 11's as they stand — THIS FILE AND THAT SKILL ARE ONE ACT IN TWO SURFACES, and
-# the skill is the one a session runs, because a session can send a subagent a
-# message and a shell cannot.
-#
-# WHAT IS NEW HERE, AND WHAT IS NOT. Nothing about the record changes but two
-# sub-fields: clause (b) gives the `PAUSED` payload `agent <name>` and
-# `transcript <id|none>` beside Amendment 11(c)'s `window`, `dir` and `profile`,
-# so that the next session can be started by whatever agent can read the lane
-# (`lane-start --agent`, clause (c)). The free text still says WHY — `clear`,
-# `reset`, `switch`, `handoff to <who>`, `requested by <uuid>@<host>/<container>`
-# — and nothing else changes with the why. That is the whole of clause (a):
-# *"The word has been wrong, not the act."*
-#
-# THE FLAGS, and each is one act after the record rather than a second kind of
-# record — except `--in-process`, which is the one fact about the act that
-# FOLLOWS the record and which the record therefore carries:
-#
-#   --restart  Amendment 17(f), `/ctx`: *"a `/ctx` whose record could not be
-#              written REFUSES before it kills anything (a pane is never
-#              respawned over an unrecorded lane)"*. So the pane is respawned
-#              ONLY after the PAUSED line is written, and a refused write is a
-#              refusal of the whole act with the pane untouched.
-#   --exit     Amendment 18(d): a handoff to ANOTHER PLACE ends the session,
-#              because 17(f)'s respawn is for the lane that stays where it is.
-#              The `why` a requester gives is `requested by <uuid>@<host>/<c>`.
-#   --late     Amendment 17 adoption act 7: the swap that never ran, recorded
-#              after the fact. It is written BEFORE the relaunch — see THE LATE
-#              RULE below, which is the whole of why it takes `--at`.
-#   --in-process
-#              THE WRITERS SURVIVE THIS ONE. Measured in this lane on
-#              2026-09-14: a harness `/clear` mints a new transcript id IN THE
-#              SAME PROCESS, so every subagent the lane has running lives
-#              through it and only its in-flight tool calls die. The record then
-#              says `kind in-process` and the top block tells the next session
-#              to EXPECT EVERY WRITER BELOW LIVE — an expectation and never an
-#              instruction, which is Addendum 1 (j): what to DO is clause (i)'s
-#              count, the same in every kind. Relaunching a writer that is still
-#              live puts two of them on one worktree (k). `--restart`, `--exit`
-#              and `--late` are `kind respawn`: a new process, and its writers
-#              are gone. A PLAIN handoff is `kind unknown`, because the act that
-#              follows it is not this command's to know.
-#
-# THE LATE RULE, stated here because it is the one rule of this command a
-# reader cannot derive from the amendment. A lane's state is its log's LAST
-# lane-kind line IN FILE ORDER (Amendment 7's rule, R14, and every reader in
-# `lanes-edit.sh` implements it that way — `swapped_candidates`, `lane_row_facts`,
-# `lane_payload_field`). The log is APPEND-ONLY. So a late `PAUSED` appended
-# after the `RESUMED` that `lane-start` wrote at the relaunch would make a lane
-# that is running read as paused, in a file nothing rewrites — the one thing the
-# record must never say. Two ways out were available: teach every reader to skip
-# a `PAUSED` whose `late` sub-field predates a later `RESUMED`, or refuse to
-# write the line where it can no longer be the last one. This command takes the
-# second, because it is the only one that keeps `binding` and every state read
-# correct WITHOUT editing readers this amendment does not touch:
-#
-#   * `--late` REQUIRES `--at <UTC>` — the moment the old session ended. A late
-#     line is dated by its own field, not by the clock of the shell writing it.
-#   * it is written only where the lane's last lane-kind line is a `STARTED` or
-#     `RESUMED` OLDER than that instant — the dead session's own start. That is
-#     the state of a lane whose swap never ran, and it is the state that exists
-#     only BEFORE the relaunch.
-#   * a last line that is already a `PAUSED` (the record exists), an `ENDED` or
-#     `RETIRED` (the lane is closed), or a `STARTED`/`RESUMED` at or after that
-#     instant (the relaunch is already recorded) is a REFUSAL that writes
-#     nothing and names the act to take instead.
-#
-# So the documented act is: run `lane-handoff --late --at <UTC>` FROM THE SHELL,
-# then `pclaude <profile>`. Run from inside the session that has already been
-# resumed, it refuses — and the honest record of the state that session now
-# holds is its own next handoff.
-#
-# EXIT CODES, this toolset's and the family's:
-#
-#   0  the handoff was written (and the pane respawned or exited, where asked)
-#   2  REFUSED — nothing was written, or the record was written and the act
-#      that follows it was refused before touching the pane, or tmux would not
-#      rename the window and the record was NOT written (the refusal names
-#      what had landed before it: the handoff's top block, SWAPPING)
-#   1  a read failed, which is never "nothing to report" (Amendment 7(d))
-#
-#   $LANES_EDIT       the register's reader/writer (default: beside this file)
-#   $LANES_AGENT      this agent's name for the record (default: claude)
-#   $PCLAUDE          the launcher                 (default: lclaude, else pclaude, else claude-profile)
-#   $LANE_HANDOFF_NO_TMUX=1   never touch tmux (the identity fix, --exit, --restart)
-#                             — and with `$TMUX` unset, this is not inside tmux,
-#                             so tmux is not touched either
-#
-# lane-collision-protocol Amendment 17 (in force 2026-09-14T09:45:33Z),
-# Amendment 18(d) and Addendum 2 (in force 2026-09-14T16:50:32Z).
-
-set -uo pipefail
-
-prog="${0##*/}"
-SELF="${BASH_SOURCE[0]:-$0}"
-selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-
-say()  { printf '%s\n' "$*"; }
-note() { printf '%s: %s\n' "$prog" "$*" >&2; }
-step() { printf '%s: %s\n' "$prog" "$*" >&2; }
-die()  { printf '\n%s: REFUSED: %s\n' "$prog" "$1" >&2; exit "${2:-2}"; }
-# Exact launch facts must not carry record delimiters, on Bash 3.2 too.
-restart_fact_ok() {
-  local LC_ALL=C
-  case "${1-}" in *[[:cntrl:]]*) return 1 ;; esac
-  return 0
-}
-# EVERY ARGUMENT AS ONE SHELL WORD, WITHOUT `printf %q` AND WITHOUT A PIPE —
-# measured on the macOS job at `db206db` and `ac0c697`, where three cases of
-# this branch's own went red and no other platform could see it. One line, two
-# defects:
-#
-#   * `printf '%q '` RENDERS DIFFERENTLY UNDER BASH 3.2, which is what Apple
-#     ships and what that job runs (`/bin/bash` 3.2.57). Bash 4.4 and later
-#     give a multi-line argument back as `$'…\n…'` — one readable, runnable
-#     word; 3.2 has no such form and escapes every space and every byte of
-#     every multi-byte character with a backslash of its own. The one caller
-#     that passes a multi-line argument is the `--no-launch` print of a launch
-#     carrying the handoff's top block as its first prompt (Amendment 17(c)),
-#     and it got back neither a readable line nor a runnable one.
-#   * AND THE PIPE THROUGH `sed` MADE THAT FATAL RATHER THAN UGLY. Under
-#     `set -o pipefail` this function's status IS the pipeline's, and BSD `sed`
-#     in a UTF-8 locale (`LC_ALL=en_US.UTF-8` on that runner) refuses bytes
-#     that are not a valid sequence — `RE error: illegal byte sequence` — which
-#     is what 3.2's `%q` makes of the em dash every one of these documents is
-#     written with. `quoted` is a BARE command in the `--no-launch` branch, so
-#     `set -e` ended the command there: exit 1, and an empty stdout.
-#
-# So the quoting is this file's own, and it is the POSIX one every shell reads
-# the same way: a word of safe characters bare, anything else in single quotes
-# with its own single quotes spelled `'\''`. A newline inside single quotes IS
-# a newline, so the line stays readable as well as runnable, on either bash.
-quoted() {
-	q_sep=""
-	for q_a in "$@"; do
-		case "$q_a" in
-		'' | *[!A-Za-z0-9._/:=@%+,-]*)
-			printf "%s'%s'" "$q_sep" "${q_a//\'/\'\\\'\'}" ;;
-		*) printf '%s%s' "$q_sep" "$q_a" ;;
-		esac
-		q_sep=' '
-	done
-	return 0
-}
-
-usage() {
-	cat <<'USAGE'
-lane-handoff [--restart | --exit | --in-process] [--late --at <UTC>]
-             [--lane <lane>] [--agent <name>] [--transcript <id|none>]
-             [--writers-file <path>] [--dir <path>] [why …]
-
-  lane-handoff [why]      hand this lane off — the act /handoff, /swap and
-                          /lane-swap all name. The identity triple is fixed,
-                          the handoff file gains a fresh Rule 3 top block with
-                          a WRITERS section, every running writer is polled,
-                          the lane's PAUSED record is written with Amendment
-                          11(c)'s sub-fields plus `agent` and `transcript`,
-                          and the one restart command is printed.
-  --restart               /ctx: after the record, respawn THIS lane's own pane
-                          through the launcher, the new session's first prompt
-                          being the handoff's top block. A record that cannot
-                          be written refuses before anything is killed.
-  --exit                  after the record, type /exit into this lane's own
-                          pane (Amendment 18(d): a handoff to another place).
-  --in-process            the clear that follows keeps THIS PROCESS running (a
-                          harness /clear), so every writer this lane has running
-                          survives it: the record says `kind in-process` and the
-                          top block tells the next session to EXPECT every
-                          writer below live — an expectation, never an
-                          instruction (Addendum 1 (j)). Refused with --restart,
-                          --exit and --late, which each mean the process ended.
-                          With none of the four the kind is `unknown`.
-  --supervise             THE PANE SUPERVISOR, started by --restart's respawn
-                          and not typed by a person: it claims the lane's
-                          restart intent, launches the replacement as its own
-                          CHILD, confirms readiness before anything is called
-                          running, and STAYS IN THE PANE with the diagnostic and
-                          a retry when the launch fails. Needs --lane and
-                          --operation.
-  --restart-status        read the lane's restart intent — its operation,
-                          generation, attempt, state, handoff, digest,
-                          transcripts and bounded failure reason — and print the
-                          act that is open on it. Reads only. Needs --lane.
-  --operation <id>        the restart operation --supervise was started for. An
-                          id that is not the lane's current one is a refusal.
-  --late --at <UTC>       write the record a swap never left, dated by the
-                          moment the old session ended. Run it from a shell
-                          BEFORE the relaunch; see --help's LATE RULE.
-  --lane <lane>           the lane, where this window does not name it.
-  --agent <name>          the agent for the record (default: $LANES_AGENT, else
-                          claude). Letters, digits, `.`, `_`, `-`.
-  --transcript <id|none>  its resumable id (default: this session's, else none)
-  --writers-file <path>   lines of `<worktree><TAB><brief>` — the brief each
-                          writer was given, for the WRITERS section.
-  --dir <path>            the lane's checkout, where its record names none.
-  why …                   the free text: clear, reset, switch, handoff to <who>,
-                          requested by <uuid>@<host>/<container>.
-
-Exit: 0 written · 2 refused · 1 a read failed.
-      --supervise adds: 3 the launch failed before readiness and there was no
-      terminal here to offer the retry on · 4 the same, for a launch that ran
-      PAST the readiness deadline still alive and only then ended (the record
-      carries INDETERMINATE and the intent is retryable either way) · 143 and
-      129, a supervisor sent SIGTERM or SIGHUP, which marks the intent failed,
-      kills nothing, and says whether the child was still running.
-USAGE
-}
-
-# ------------------------------------------------------------------ arguments
-
-do_restart=0; do_exit=0; do_late=0; do_in_process=0; do_supervise=0; do_status=0
-late_at=""; lane=""; agent=""; transcript=""; writers_file=""; dir_flag=""
-operation=""
-why=""
-
-# A FLAG WHERE A VALUE BELONGS IS REFUSED, in this command as in `park`,
-# `resume` and `status` (`92eab6c`): `--lane --restart` must not hand off a lane
-# called `--restart`, and `--flag=value` is the spelling that gives a `-`-led
-# value back. One reader, byte-identical to theirs.
-# AND ITS REFUSAL ENDS THIS COMMAND, NOT ONLY ITS OWN SUBSHELL (opensoft/
-# openRepoTools#80). Every arm reads it as `x="$(flag_value …)"`, and a `die`
-# inside `$( )` exits the subshell it runs in: the REFUSED line was printed and
-# the run then went on with the value empty — `--lane --restart` handed off
-# whatever lane the window resolved to, and `--writers-file ""` wrote a handoff
-# with no briefs. So every arm ends `|| exit`, which carries the refusal's own
-# status out, and this file sets no `-e` that would have done it silently.
-flag_value() {   # <flag> <the next argument, if any>
-	case "${2-}" in
-	'') die "$1 needs a value" 2 ;;
-	-*) die "$1 needs a value and '$2' is a flag. Use $1=$2 where that really is the value." 2 ;;
-	esac
-	printf '%s' "$2"
-}
-
-while [ $# -gt 0 ]; do
-	case "$1" in
-	-h | --help) usage; exit 0 ;;
-	--restart) do_restart=1; shift ;;
-	--exit) do_exit=1; shift ;;
-	--late) do_late=1; shift ;;
-	# THE PROCESS SURVIVES THIS ONE, AND THAT CHANGES WHAT THE NEXT SESSION IS
-	# TOLD (measured in this lane on 2026-09-14): a harness `/clear` mints a new
-	# transcript id IN THE SAME PROCESS, so every subagent this lane has running
-	# lives through it and only its in-flight tool calls die. A block that then
-	# says *relaunch every writer* puts a second writer on a worktree the first
-	# one still holds.
-	--in-process) do_in_process=1; shift ;;
-	# THE OTHER HALF OF `--restart`, AND THE SAME COMMAND ON PURPOSE
-	# (openRepoTools#94). `--supervise` is what tmux starts in the respawned
-	# pane: it claims the restart intent `--restart` wrote, launches the
-	# replacement as a CHILD, confirms readiness and stays in the pane when
-	# anything goes wrong. It is a MODE and not a thirteenth installed word,
-	# because Amendment 18 Addendum 2 (i-8) is explicit that *"no word is kept
-	# on `PATH` for it alone"* — which is the ground on which `restart` was
-	# taken off it. `--restart-status` is the read-only surface over the same
-	# record.
-	--supervise) do_supervise=1; shift ;;
-	--restart-status) do_status=1; shift ;;
-	# AN `=` WITH NOTHING AFTER IT IS A VALUE THAT WAS TYPED AND LOST, never one
-	# that was not typed (opensoft/openRepoTools#80, Copilot's review of
-	# workBenches#91 at `lane-handoff:242` and `:248`). Each `--flag=*` arm below
-	# takes whatever follows the `=`, and every one of these values is read
-	# further down as "was this given at all?": `--lane=` fell through to the
-	# window's own lane and handed THAT one off, `--writers-file=` wrote the
-	# WRITERS section with no brief for a writer the caller had briefed, and
-	# `--dir=` took the record's directory in place of the one being named. The
-	# spaced spelling has always refused an empty value through `flag_value`;
-	# this is the same refusal for the other spelling, in ONE arm ahead of the
-	# seven, because `case` takes the first pattern that matches. The arms below
-	# keep taking a value that begins with `-`, which is what `=` is for.
-	--operation= | --at= | --lane= | --agent= | --transcript= | --writers-file= | --dir=)
-		die "${1%=} needs a value, and '$1' gives it an empty one. Give it one after the '=', or leave the flag out." 2 ;;
-	--operation) operation="$(flag_value --operation "${2-}")" || exit; shift 2 ;;
-	--operation=*) operation="${1#--operation=}"; shift ;;
-	--at) late_at="$(flag_value --at "${2-}")" || exit; shift 2 ;;
-	--at=*) late_at="${1#--at=}"; shift ;;
-	--lane) lane="$(flag_value --lane "${2-}")" || exit; shift 2 ;;
-	--lane=*) lane="${1#--lane=}"; shift ;;
-	--agent) agent="$(flag_value --agent "${2-}")" || exit; shift 2 ;;
-	--agent=*) agent="${1#--agent=}"; shift ;;
-	--transcript) transcript="$(flag_value --transcript "${2-}")" || exit; shift 2 ;;
-	--transcript=*) transcript="${1#--transcript=}"; shift ;;
-	--writers-file) writers_file="$(flag_value --writers-file "${2-}")" || exit; shift 2 ;;
-	--writers-file=*) writers_file="${1#--writers-file=}"; shift ;;
-	--dir) dir_flag="$(flag_value --dir "${2-}")" || exit; shift 2 ;;
-	--dir=*) dir_flag="${1#--dir=}"; shift ;;
-	--) shift; while [ $# -gt 0 ]; do why="${why:+$why }$1"; shift; done ;;
-	-*) die "unknown option '$1' — see $prog --help" 2 ;;
-	*) why="${why:+$why }$1"; shift ;;
-	esac
-done
-
-# THE WHY IS ONE LINE, AND IT IS REFUSED AT THE DOOR (opensoft/openRepoTools#72
-# item 6, #85). It reaches FOUR places, and only the last two pass through
-# `sanitize`: the handoff's top block, where a newline writes a malformed prompt
-# (a `---` line among them, which is where `lane-start`'s `handoff_top_block`
-# ends the first prompt it hands the next session); the handoff commit's
-# subject; the object log's PAUSED line, where `write_event` refuses it, but
-# only AFTER section 2 has refreshed and committed the handoff, so the act ends
-# with a top block and no record behind it; and the register's file-level
-# line, where `append-line` used to write it first and refuse it after. One
-# test here covers all four, and it comes before the identity triple, the
-# refresh and every write, so the refusal leaves nothing to undo. It is the
-# rule `lane-end --reason` and `rename-lane`'s reason already keep for a free
-# text that becomes one line. `sanitize` flattens a newline as well, but that
-# is the second line of defence and not this one.
-if [ "${why//[$'\n\r']/}" != "$why" ]; then
-	die "the why is ONE line: it is written into the handoff's top block, its commit message, the object log's PAUSED line and the register's file-level line, and a newline or carriage return in it would split each of them — the last two in files nothing rewrites. Nothing was written. Put it on one line, with '; ' where the break was, and re-run." 2
-fi
-
-# ONE ACT AT A TIME AFTER THE RECORD. `--restart` respawns the pane for a lane
-# that STAYS HERE and `--exit` ends the session for a lane going somewhere else
-# (Amendment 18(d)); asking for both is asking the same pane to do two opposite
-# things, and whichever ran second would run against a pane the first had
-# already replaced.
-# AND THE TWO MODES THAT ARE NOT HANDOFFS AT ALL ARE ASKED FOR ALONE
-# (openRepoTools#94). `--supervise` is the pane's own root process after a
-# `/ctx` and `--restart-status` is a read; neither writes a PAUSED record, and a
-# caller that asked for one of them beside `--restart` is asking this command to
-# hand off a lane and to be the thing that catches the handoff, in one process.
-for lh_mode_a in supervise:$do_supervise status:$do_status; do
-	[ "${lh_mode_a#*:}" = 1 ] || continue
-	for lh_mode_b in restart:$do_restart exit:$do_exit late:$do_late in-process:$do_in_process; do
-		[ "${lh_mode_b#*:}" = 1 ] || continue
-		die "--${lh_mode_a%%:*} is not a handoff and --${lh_mode_b%%:*} is: the first is the pane's own process after a /ctx (or a read of what that /ctx left), and the second writes the record. Ask for one." 2
-	done
-done
-[ "$do_supervise" = 1 ] && [ "$do_status" = 1 ] &&
-	die "--supervise launches and --restart-status reads; ask for one." 2
-# AND `--operation` NAMES THE ACT `--supervise` WAS STARTED FOR, so it is
-# meaningless anywhere else — and worse than meaningless on `--restart`, whose
-# own tail MINTS an operation: a value given there would be silently discarded,
-# which is the shape of thing a person only finds out about from a record that
-# does not say what they typed.
-[ -n "$operation" ] && [ "$do_supervise" != 1 ] &&
-	die "--operation names the restart operation a supervisor was started for, and only --supervise reads it. --restart MINTS its own operation and would discard this one silently; every other mode has none. Drop it, or run:  $prog --supervise --lane <lane> --operation $operation" 2
-
-[ "$do_restart" = 1 ] && [ "$do_exit" = 1 ] &&
-	die "--restart and --exit are two different ends for one act: --restart respawns this lane's own pane (Amendment 17(f), the lane stays here) and --exit ends the session (Amendment 18(d), the lane goes elsewhere). Pick one." 2
-# AND `--late` IS NEITHER OF THEM. It is written BEFORE the relaunch by a shell
-# that is not in the lane's session at all — there is no pane of this lane's to
-# respawn or to type into, and the relaunch it precedes is the operator's own
-# `pclaude`.
-[ "$do_late" = 1 ] && { [ "$do_restart" = 1 ] || [ "$do_exit" = 1 ]; } &&
-	die "--late is the record a swap never left, written from a shell BEFORE the relaunch: there is no session of this lane's to restart or exit. Write the late record first, then start the lane." 2
-# AND `--late --in-process` IS A CONTRADICTION IN ITS OWN TERMS (Copilot round 4
-# on openRepoTools#47). A late record is written for a session that has ALREADY
-# ENDED — that is what makes it late — and `--in-process` says THIS PROCESS KEPT
-# RUNNING. Taken together the kind block below would take the `in-process` arm
-# first and write a record telling the next session to expect writers live that
-# died with the process the record is about.
-[ "$do_late" = 1 ] && [ "$do_in_process" = 1 ] &&
-	die "--late and --in-process cannot both be true: a late record is written for a session that has ALREADY ENDED (that is what makes it late, and its writers went with it), while --in-process says THIS PROCESS KEPT RUNNING. A late record is \`kind respawn\`. Drop --in-process." 2
-
-# ------------------------------------------- THE KIND OF CLEAR THIS RECORDS
-#
-# MEASURED IN THIS LANE ON 2026-09-14, and it is the difference between a
-# handoff a session can act on and one that costs it a worktree:
-#
-#   in-process  a harness `/clear` — and any `/ctx` that clears IN PLACE rather
-#               than respawning the pane — mints a NEW TRANSCRIPT ID IN THE SAME
-#               PROCESS. Every subagent this lane has running SURVIVES it; only
-#               the tool calls they had in flight die (a `Bash` killed at the
-#               clear exits 137). A top block that then says *relaunch every
-#               writer below* puts a SECOND writer on a worktree the first one
-#               still holds, and the two of them lose each other's work.
-#   respawn     the pane is respawned (`--restart`) or the session is ended
-#               (`--exit`) — a NEW PROCESS either way, and every writer of the
-#               old one is gone with it. A profile switch and a usage-reset
-#               relaunch are the same kind by the same argument (Addendum 1
-#               (h)), and each is this command with one of those two flags.
-#
-#   unknown     a PLAIN handoff — `/handoff` with none of the three flags —
-#               after which the person may type `/clear` or may relaunch. The
-#               act that follows is not this command's to know, and Addendum 1
-#               (h) is explicit that such a record writes `kind unknown` rather
-#               than guessing: the top block then treats it as (i) treats every
-#               kind, which is to COUNT the live writers first.
-#
-# THE KIND SAYS WHAT TO EXPECT AND NEVER WHAT TO DO (Amendment 17 Addendum 1,
-# ratified 2026-09-14T20:59:31Z, clause (j)). Clause (i) is what says what to
-# do, it is the same in all three cases, and it is the WRITERS section's first
-# line below.
-[ "$do_in_process" = 1 ] && { [ "$do_restart" = 1 ] || [ "$do_exit" = 1 ]; } &&
-	die "--in-process says THIS PROCESS KEEPS RUNNING, and --restart respawns this lane's pane while --exit ends the session: each of those replaces the process every writer of this lane is a child of. Pick one — the flag is for a clear that happens inside the session that is running." 2
-if [ "$do_in_process" = 1 ]; then
-	handoff_kind=in-process
-	kind_headline='expect every writer below live — count them before you touch any of them'
-	kind_act='THIS HANDOFF WAS WRITTEN FOR AN IN-PROCESS CLEAR: the process was not replaced, so expect every writer below live and the count to name them all.'
-	kind_state='the process was not replaced, so every writer above kept running through the clear and only its in-flight tool calls died'
-elif [ "$do_restart" = 1 ] || [ "$do_exit" = 1 ] || [ "$do_late" = 1 ]; then
-	# `--late` IS A RESPAWN AND NEVER AN UNKNOWN: the record a swap never left
-	# is written for a session that has ALREADY ended — that is why it is late —
-	# so the process is gone and every writer with it, which is what the word
-	# names (Addendum 1 (h): "a usage-reset relaunch").
-	handoff_kind=respawn
-	kind_headline='expect none of the writers below live — count them, then relaunch from where each stands'
-	kind_act='THIS HANDOFF WAS WRITTEN FOR A RESPAWN: the process that ran the writers is gone, so expect the count to name none of them.'
-	kind_state='a NEW PROCESS takes this lane on — the pane respawned or the session ended — so every writer of the old one is gone with it'
-else
-	handoff_kind=unknown
-	kind_headline='the count decides: this handoff cannot know whether the process survived'
-	kind_act='THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT: a plain handoff may be followed by a `/clear` in this process or by a relaunch, so nothing below assumes either — the count is the answer.'
-	kind_state='the act that follows this record was not this command'"'"'s to know (`kind unknown`, Addendum 1 (h)) — the restart line below is one of the two, and a `/clear` typed here is the other'
-fi
-
-# ---------------------------------------------------------------- the helper
-#
-# Beside this command first — `--install` places both in one directory — then on
-# PATH. One resolution, so a workstation with two copies never reads one and
-# writes the other.
-LANES_EDIT="${LANES_EDIT:-}"
-if [ -z "$LANES_EDIT" ]; then
-	if [ -x "$selfdir/lanes-edit.sh" ]; then LANES_EDIT="$selfdir/lanes-edit.sh"
-	else LANES_EDIT="$(command -v lanes-edit.sh 2>/dev/null || printf '')"
-	fi
-fi
-[ -n "$LANES_EDIT" ] && [ -x "$LANES_EDIT" ] || die "no register reader at ${LANES_EDIT:-lanes-edit.sh} — it is installed beside this
-    command by \`openRepoTools --install\`. Run that, or set \$LANES_EDIT." 2
-
-utc_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
-UTC="$(utc_now)"
-
-# TMUX IS THIS LANE'S ONLY FROM INSIDE IT (opensoft/openRepoTools#80 item 10,
-# Copilot's review of workBenches#91 at `lane-handoff:351`). A `tmux` binary on
-# PATH is not a tmux client: from an ordinary shell on a host where any tmux
-# server runs — another person's, a leftover one — every `display-message`
-# below answers about that server's most recent client, and the rename, the
-# record's `window` and `--restart`/`--exit` would then read or act on a window
-# that is not this lane's. `$TMUX` is set only inside a real client, which is
-# the test `lane`'s `tmux_here` makes and the one made here.
-have_tmux() {
-	[ "${LANE_HANDOFF_NO_TMUX:-0}" = 1 ] && return 1
-	[ -n "${TMUX:-}" ] && command -v tmux >/dev/null 2>&1
-}
-
-# THIS COMMAND'S OWN ABSOLUTE PATH, because tmux starts the supervisor and a
-# respawned pane's `PATH` is whatever the person's shell profile makes of it —
-# which is one of the ways a respawn comes up with a word that is not this
-# estate's.
-SELF_ABS="$selfdir/${SELF##*/}"
-
-# THE HANDOFF'S DIGEST, spelled as `lanes-edit.sh` and `lane-start` spell it:
-# all three compare the same number, so there is ONE implementation of it and
-# not three. `none` is an ANSWER — this workstation has neither tool — and it
-# means *not checked here*, never *unchanged*.
-handoff_digest() {   # <file>
-	[ -r "${1-}" ] || { printf 'none\n'; return 0; }
-	if command -v sha256sum >/dev/null 2>&1; then
-		sha256sum -- "$1" 2>/dev/null | awk '{print $1; exit}'
-	elif command -v shasum >/dev/null 2>&1; then
-		shasum -a 256 -- "$1" 2>/dev/null | awk '{print $1; exit}'
-	else
-		printf 'none\n'
-	fi
-}
-
-# A PANE REF IS COMPARED COMPONENT-WISE, NEVER AS A SUFFIX OR A PREFIX. The
-# three spellings are `<session>:<@id>`, `<session>:<@id>.%<pane>` and, in
-# `$TMUX_PANE`, the bare `%<pane>` — and a `case` on `*"$x"` accepts `%16` for
-# `%6` and a `case` on `"$x"*` accepts `@331` for `@33`. Both are the wrong
-# window, and this comparison decides whether a second session of a lane gets
-# started in one. Empty on either side is NOT a disagreement: a comparison that
-# cannot be made is said rather than failed shut, which is what the callers do
-# with it.
-pane_agrees() {   # <a> <b>
-	pa_a="${1-}"; pa_b="${2-}"
-	[ -n "$pa_a" ] && [ -n "$pa_b" ] || return 0
-	[ "$pa_a" != none ] && [ "$pa_b" != none ] || return 0
-	[ "$pa_a" = "$pa_b" ] && return 0
-	# A BARE `%<pane>` on either side is compared against the other's pane
-	# component and against nothing else.
-	case "$pa_a" in
-	%*) case "$pa_b" in *.%*) [ "$pa_a" = "${pa_b##*.}" ] && return 0 ;; esac; return 1 ;;
-	esac
-	case "$pa_b" in
-	%*) case "$pa_a" in *.%*) [ "$pa_b" = "${pa_a##*.}" ] && return 0 ;; esac; return 1 ;;
-	esac
-	# Otherwise both name a window; one may also name a pane, and a record that
-	# names only the window agrees with an intent that names the pane inside it.
-	case "$pa_a" in *.%*) pa_aw="${pa_a%.*}" ;; *) pa_aw="$pa_a" ;; esac
-	case "$pa_b" in *.%*) pa_bw="${pa_b%.*}" ;; *) pa_bw="$pa_b" ;; esac
-	[ "$pa_aw" = "$pa_bw" ]
-}
-
-# ---------------------------------------------------- the readiness predicate
-#
-# READ-ONLY, AND POSITIVE. It asks five things and every one of them must
-# answer, because the failure this exists to stop is a launch that was ACCEPTED
-# and never happened:
-#
-#   1. the child this supervisor started is still alive;
-#   2. this workstation's session records name a LIVE HOLDER of the lane;
-#   3. exactly ONE of them — a second is Amendment 18(h)'s collision, and a
-#      restart that confirmed itself while two processes answered for one lane
-#      would be the tooling making the very thing the protocol refuses;
-#   4. that holder's transcript is the one `lane-start` said it was about to
-#      make — and, where it said nothing, at least one that is NOT the
-#      transcript the `/ctx` paused, which is the spec's *a transcript distinct
-#      from the old transcript*;
-#   5. it is in the pane the intent was written for, where both are knowable.
-#
-# IT WRITES NOTHING, AND IT NEEDS NOTHING FROM THE `SessionStart` HOOK, whose
-# read-only, network-free, always-zero contract is load-bearing (`R-A8-1`,
-# ratified) and is untouched by any of this.
-#
-# THE CHILD'S PID COMES OUT OF A FILE and not out of a variable, because the
-# child is started in the FOREGROUND (below) and this predicate runs in a
-# background observer that has no way to be told it otherwise. An empty file is
-# *the child has not got as far as recording itself*, which is not the same as
-# *the child is gone*.
-#
-# 0 ready · 1 not yet (the reason is on `READY_WHY`) · 2 the child is gone.
-ready_check() {   # <lane> <pid file> <expected new transcript|""> <old transcript|""> <pane|"">
-	rc_lane="$1"; rc_pidf="$2"; rc_new="$3"; rc_old="$4"; rc_pane="$5"
-	READY_WHY=""; READY_SID=""
-	rc_pid=""
-	[ -r "$rc_pidf" ] && rc_pid="$(head -n 1 -- "$rc_pidf" 2>/dev/null | tr -dc '0-9')"
-	if [ -z "$rc_pid" ]; then
-		READY_WHY="the child has not recorded its pid yet"
-		return 1
-	fi
-	kill -0 "$rc_pid" 2>/dev/null || { READY_WHY="the child (pid $rc_pid) is gone"; return 2; }
-	rc_ps="$(ps -p "$rc_pid" -o stat= 2>/dev/null)"; rc_ps="$(printf '%s' "$rc_ps" | tr -d '[:space:]')"
-	case "$rc_ps" in
-	  Z*) READY_WHY="the child (pid $rc_pid) exited and is awaiting reap"; return 2 ;;
-	  '') READY_WHY="the child process state could not be established"; return 1 ;;
-	esac
-	rc_out=""; rc_rc=0
-	rc_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$rc_lane" 2>/dev/null)" || rc_rc=$?
-	case "$rc_rc" in
-	0) : ;;
-	8) READY_WHY="no live session record names lane $rc_lane yet"; return 1 ;;
-	*) READY_WHY="this workstation's session records could not be read (live-holder exited $rc_rc), which is NOT 'nothing is live'"; return 1 ;;
-	esac
-	rc_n="$(printf '%s\n' "$rc_out" | awk -F'\037' '!seen[$4]++ {n++} END {print n+0}')"
-	if [ "${rc_n:-0}" != 1 ]; then
-		READY_WHY="$rc_n live holders answer for lane $rc_lane and readiness needs exactly one (Amendment 18(h))"
-		return 1
-	fi
-	# Historical records for one live PID are one process. Prefer the
-	# current attempt's exact fresh UUID; another PID still blocks above.
-	if [ -n "$rc_new" ] && [ "$rc_new" != none ]; then
-		rc_expected="$(printf '%s\n' "$rc_out" | awk -F'\037' -v sid="$rc_new" '$1==sid {print; exit}')"
-		[ -z "$rc_expected" ] || rc_out="$rc_expected"
-	fi
-	# lane-holders reads only trusted Claude-native interactive session records;
-	# that provenance plus the Claude-only launch gate supplies agent evidence.
-	rc_sid="$(printf '%s\n' "$rc_out" | awk -F'\037' '{print $1; exit}')"
-	rc_tgt="$(printf '%s\n' "$rc_out" | awk -F'\037' '{print $2; exit}')"
-	rc_nm="$(printf '%s\n' "$rc_out" | awk -F'\037' '{print $3; exit}')"
-	READY_SID="$rc_sid"
-	# THE HOLDER'S NAME IS THE LANE'S ADDRESS, and it is evidence this predicate
-	# already had in its hand and did not read (Copilot round 2 on
-	# openRepoTools#121). Amendment 2 makes the session NAME the lane's messaging
-	# address — `ListAgents`, `SendMessage`, `@<lane>` and the statusline all read
-	# it — so a replacement answering for this lane under some other name is not
-	# the replacement this restart was for, whatever its transcript says.
-	# Compared case-insensitively, because Amendment 15 makes one lane's two
-	# spellings one lane; `none` on either side is a comparison that cannot be
-	# made and is said rather than failed shut, as `pane_agrees` does.
-	if [ -n "$rc_nm" ] && [ "$rc_nm" != none ]; then
-		if [ "$(printf '%s' "$rc_nm" | tr '[:upper:]' '[:lower:]')" != "$(printf '%s' "$rc_lane" | tr '[:upper:]' '[:lower:]')" ]; then
-			READY_WHY="the live holder is named '$rc_nm' and this lane is $rc_lane — a session answering for the lane under another name is not this restart's replacement (Amendment 2)"
-			return 1
-		fi
-	fi
-	if [ -n "$rc_new" ] && [ "$rc_new" != none ]; then
-		if [ "$rc_sid" != "$rc_new" ]; then
-			READY_WHY="the live holder's transcript is $rc_sid and this launch was preparing $rc_new"
-			return 1
-		fi
-	elif [ -n "$rc_old" ] && [ "$rc_old" != none ] && [ "$rc_sid" = "$rc_old" ]; then
-		READY_WHY="the live holder's transcript is $rc_sid, which is the one this /ctx paused — that is a resume and not a fresh session"
-		return 1
-	fi
-	if ! pane_agrees "$rc_pane" "$rc_tgt"; then
-		READY_WHY="the live holder is in $rc_tgt and the intent names pane $rc_pane"
-		return 1
-	fi
-	return 0
-}
-
-# ------------------------------------------------- the observer, and the wait
-#
-# THE CHILD RUNS IN THE FOREGROUND AND THIS PROCESS WAITS ON IT. That order is
-# not a preference: the child is an interactive terminal program, and a
-# background child in a shell with no job control cannot read the terminal at
-# all. So the OBSERVATION goes into the background instead — one subshell that
-# polls the read-only predicate above and, the moment it answers, makes the one
-# fenced write that turns this restart into a confirmed one. That is the
-# design's *separate observation path*, and it is why nothing is printed over a
-# running Claude's screen: the observer WRITES its verdict, and
-# `--restart-status` from any other window is where it is read.
-#
-# EVERY TWO SECONDS AND NOT EVERY ONE: the predicate's middle question goes
-# through `lanes-edit.sh live-holder`, which reads the register, and sixty of
-# those in a minute is sixty git processes behind a session that is trying to
-# start.
-supervise_watch() {   # <lane> <operation> <generation> <pid file> <new> <old> <pane>
-	sw_lane="$1"; sw_op="$2"; sw_gen="$3"; sw_pidf="$4"; sw_new="$5"; sw_old="$6"; sw_pane="$7"; sw_attempt="$8"; sw_stop="$9"
-	# THE DEADLINE IS WALL CLOCK, NOT A COUNT OF SLEEPS. This loop used to add
-	# 2 per turn and call that the elapsed time, which counts only the `sleep`
-	# and never the work between two of them — and the work is a `live-holder`
-	# read that resolves the lane, reads the published row and scans every
-	# session record this workstation has. On a loaded machine that is seconds,
-	# so a "60-second" deadline was sixty seconds PLUS thirty register reads,
-	# and the INDETERMINATE line then reported a number that had never elapsed.
-	# The design's promise is *"waits up to 60 seconds"* and a person waiting on
-	# a pane is owed the number they were told.
-	#
-	# THE COUNTED SLEEPS ARE KEPT AS THE FLOOR, so this loop terminates on a
-	# workstation whose `date` cannot answer or whose clock steps backwards:
-	# the wait is the GREATER of what was slept and what the clock says, and a
-	# clock that goes backwards simply leaves the counted sleeps deciding.
-	sw_t0="$(date +%s 2>/dev/null | tr -dc '0-9')"
-	sw_slept=0
-	sw_waited=0
-	while [ "$sw_waited" -lt "$SUPERVISE_READY_SECONDS" ]; do
-		[ ! -e "$sw_stop" ] || return 0
-		sleep 2
-		[ ! -e "$sw_stop" ] || return 0
-		sw_slept=$((sw_slept + 2))
-		sw_waited="$sw_slept"
-		sw_now="$(date +%s 2>/dev/null | tr -dc '0-9')"
-		if [ -n "$sw_t0" ] && [ -n "$sw_now" ] && [ "$sw_now" -gt "$sw_t0" ]; then
-			sw_el=$((sw_now - sw_t0))
-			[ "$sw_el" -gt "$sw_waited" ] && sw_waited="$sw_el"
-		fi
-		# lane-start writes the prepared UUID after the observer has started.
-		# Read the current attempt, never the preceding attempt's UUID.
-		if ! ri_load "$sw_lane"; then return 5; fi
-		[ "$RI_OP" = "$sw_op" ] && [ "$RI_GEN" = "$sw_gen" ] &&
-		  [ "$RI_ATTEMPT" = "$sw_attempt" ] && [ "$RI_STATE" = starting ] || return 5
-		sw_new="$RI_NEW"
-		case "$sw_new" in ''|none) continue ;; esac
-		sw_rc=0
-		ready_check "$sw_lane" "$sw_pidf" "$sw_new" "$sw_old" "$sw_pane" || sw_rc=$?
-		case "$sw_rc" in
-		2) return 3 ;;          # the child is gone; the supervisor has its status
-		0)
-			# THE FINALIZER, FENCED ON THIS OPERATION AND THIS GENERATION. A
-			# stale observer of a superseded operation writes nothing: exit 7
-			# is the intent refusing it, and that refusal is the whole point of
-			# the fence.
-			[ ! -e "$sw_stop" ] || return 0
-			sw_frc=0
-			LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sw_lane" ready \
-				--expect starting --expect-operation "$sw_op" --expect-generation "$sw_gen" --expect-attempt "$sw_attempt" \
-				--new-transcript "${READY_SID:-$sw_new}" \
-				--reason "readiness confirmed after ${sw_waited}s" >/dev/null 2>&1 || sw_frc=$?
-			if [ "$sw_frc" != 0 ]; then
-				note "lane $sw_lane came up and the restart intent could NOT be marked ready (exit $sw_frc): the session is running and the record does not say so. Read it:  $prog --restart-status --lane $sw_lane"
-				return 5
-			fi
-			# Legacy readiness belongs only to this intent. Never advance #97's
-			# diagnostic snapshot or a managed JSON generation/operation here.
-			return 0 ;;
-		esac
-	done
-	# THE DEADLINE, WITH THE CHILD STILL ALIVE — INDETERMINATE, which is a THIRD
-	# answer and not a failure. Nothing is killed (Amendment 8(f): ending
-	# somebody's process is not a boundary script's act), nothing is retried,
-	# and the lane is NOT marked running.
-	# FENCED ON THE GENERATION LIKE EVERY OTHER WRITE THIS OBSERVER MAKES. It is
-	# the same argument Copilot's round 1 makes about the failure write: an
-	# observer whose lane has moved on must not publish its verdict over a newer
-	# generation's record, and `$sw_gen` is the generation the supervisor
-	# CLAIMED rather than whatever is on disk by now.
-	[ ! -e "$sw_stop" ] || return 0
-	LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sw_lane" starting \
-		--expect starting --expect-operation "$sw_op" --expect-generation "$sw_gen" --expect-attempt "$sw_attempt" \
-		--reason "INDETERMINATE: ${sw_waited}s elapsed (deadline ${SUPERVISE_READY_SECONDS}s) with the child alive and readiness unconfirmed; ${READY_WHY:-no evidence}" >/dev/null 2>&1 || :
-	return 4
-}
-
-# THE CHILD'S ARGV, out of the intent and out of nothing else — the spec's *no
-# picker, attach, select, current-directory, title, or default-profile
-# resolution*, and never the human-facing `lane` dispatcher, whose valid
-# outcomes include attaching to something instead of launching.
-#
-# THE LAUNCHER FIRST, because it is what configures the ACCOUNT: `pclaude
-# --lane <lane> <profile>` is the same act `lane`'s available branch makes, one
-# door along, and `lane-start` is what it runs. Where this workstation has no
-# launcher, or the intent records no profile to hand one, the supervisor runs
-# `lane-start` itself with the fresh mode as an ARGUMENT — the narrow operation
-# launch, and the only path on which `--operation` can be passed at all, since
-# the launcher forwards no argument of its own.
-#
-# EITHER WAY THE FRESH SESSION IS THE INTENT'S TO DECIDE AND NOT THIS ARGV'S:
-# `lane-start` reads the same file and goes fresh with no flag and no variable
-# set. The flag and the variable are set here anyway, because a launch that
-# says what it is in three places is a launch whose defect capture can be read
-# — and because on the launcher path they are the only two that even reach it.
-supervise_argv() {   # <lane> <operation>
-	sa_lane="$1"; sa_op="$2"
-	SUPERVISE_CMD=(); SUPERVISE_VIA=""
-	sa_launcher="${PCLAUDE:-}"
-	if [ -z "$sa_launcher" ]; then
-		sa_launcher="$(command -v lclaude 2>/dev/null || command -v pclaude 2>/dev/null || command -v claude-profile 2>/dev/null || printf '')"
-	fi
-	if [ -n "$sa_launcher" ] && [ -n "$RI_PROFILE" ] && [ "$RI_PROFILE" != none ]; then
-		SUPERVISE_CMD=("$sa_launcher" --lane "$sa_lane" "$RI_PROFILE")
-		SUPERVISE_VIA="the launcher ($sa_launcher), which configures the account and runs lane-start"
-		return 0
-	fi
-	sa_start=""
-	if [ -x "$selfdir/lane-start" ]; then sa_start="$selfdir/lane-start"
-	else sa_start="$(command -v lane-start 2>/dev/null || printf '')"
-	fi
-	[ -n "$sa_start" ] || return 1
-	SUPERVISE_CMD=("$sa_start" --fresh --operation "$sa_op")
-	[ -n "$RI_DIR" ] && [ "$RI_DIR" != none ] && SUPERVISE_CMD+=(--dir "$RI_DIR")
-	SUPERVISE_CMD+=("$sa_lane")
-	if [ -n "$sa_launcher" ]; then
-		SUPERVISE_VIA="lane-start directly ($sa_start) — this lane's record names no profile, so there is nothing to tell the launcher which account to come up in"
-	else
-		SUPERVISE_VIA="lane-start directly ($sa_start) — there is no launcher on PATH here"
-	fi
-	return 0
-}
-
-# THE FAILURE SURFACE. The supervisor is STILL IN THE PANE, which is the whole
-# of what this change is for, and what it offers is one line to retry and one
-# to walk away with. A pane with no terminal — the suite, a `--supervise` run
-# from a script — is told the same thing and gets exit 3 rather than a read
-# nobody will answer.
-#
-# 3 = reported, no terminal · 10 = reported, ask the person.
-# THE FAILURE IS FENCED ON THE GENERATION TOO, AND ON THE ONE THIS SUPERVISOR
-# CLAIMED (Copilot round 1 on openRepoTools#121). The readiness finalizer has
-# always carried `--expect-generation`; this write did not, so a supervisor
-# whose lane had moved on could publish its old failure over a newer
-# generation's record. The number has to be the one captured AT THE CLAIM and
-# not the one on disk now — re-reading it would read the newer generation and
-# match it, which is the stale write the fence exists to refuse.
-supervise_failed() {   # <lane> <operation> <reason>
-	sf_lane="$1"; sf_op="$2"; sf_why="$3"
-	# A dead launcher can leave a descendant holding the lane. Only an
-	# affirmative empty holder read allows a retryable failure.
-	sf_hrc=0
-	LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$sf_lane" >/dev/null 2>&1 || sf_hrc=$?
-	if [ "$sf_hrc" != 8 ]; then
-		LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sf_lane" starting \
-			--expect starting --expect-operation "$sf_op" \
-			--expect-generation "$SV_CLAIMED_GEN" --expect-attempt "$SV_CLAIMED_ATTEMPT" \
-			--reason "INDETERMINATE: launch ended but holder absence is unproven (read $sf_hrc); $sf_why" >/dev/null 2>&1 || :
-		say "INDETERMINATE — holder absence is unproven; retry is blocked."
-		say "  read it: $prog --restart-status --lane $sf_lane"
-		return 4
-	fi
-	sf_fence=()
-	[ -n "$SV_CLAIMED_GEN" ] && sf_fence=(--expect-generation "$SV_CLAIMED_GEN" --expect-attempt "$SV_CLAIMED_ATTEMPT")
-	sf_wrc=0
-	LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sf_lane" failed \
-		--expect 'starting|pending' --expect-operation "$sf_op" \
-		${sf_fence[@]+"${sf_fence[@]}"} \
-		--reason "$sf_why" >/dev/null 2>&1 || sf_wrc=$?
-	case "$sf_wrc" in
-	  0) : ;;
-	  7)
-		say "SUPERSEDED — this supervisor no longer owns operation $sf_op; no retry is authorized here."
-		say "  read it: $prog --restart-status --lane $sf_lane"
-		return 2 ;;
-	  *)
-		note "the restart failure could not be recorded (exit $sf_wrc); retry remains blocked. Read it: $prog --restart-status --lane $sf_lane"
-		return 1 ;;
-	esac
-	say ""
-	say "RESTART FAILED — lane $sf_lane, operation $sf_op"
-	say "  $sf_why"
-	say ""
-	say "  The old session is gone (this pane was respawned for the restart) and the"
-	say "  handoff it wrote is intact: its top block is still the first prompt the next"
-	say "  session gets, and nothing of the lane has been lost."
-	say ""
-	say "  retry:   $(quoted "$SELF_ABS") --supervise --lane $sf_lane --operation $sf_op"
-	say "  read it: $(quoted "$SELF_ABS") --restart-status --lane $sf_lane"
-	say "  retry uses this same supervised operation; ordinary lane resume is not recovery."
-	say ""
-	if [ "${LANE_SUPERVISOR_NO_PROMPT:-0}" = 1 ] || [ ! -t 0 ]; then
-		note "there is no terminal here to offer the retry on, so this supervisor exits 3 rather than blocking on a read nobody will answer. The intent is \`failed\` and carries the reason; the three lines above are the whole of what to do next."
-		return 3
-	fi
-	return 10
-}
-
-# THE ONE QUESTION THIS COMMAND EVER ASKS, and it asks it only where a person is
-# looking at the pane. `r` retries the SAME operation; anything else leaves the
-# pane to the person, with the intent `failed` and every line above still on
-# screen.
-supervise_prompt() {   # <lane> <operation>
-	printf '%s: retry this restart? [r = retry, q = leave it] ' "$prog" >&2
-	sp_ans=""
-	IFS= read -r sp_ans || { printf '\n' >&2; return 3; }
-	case "$sp_ans" in
-	r | R | retry) return 0 ;;
-	*)
-		say ""
-		say "left as it is. The intent stays \`failed\` and this pane is yours:"
-		say "  retry:   $(quoted "$SELF_ABS") --supervise --lane $1 --operation $2"
-		return 3 ;;
-	esac
-}
-
-# THE SUPERVISOR PROPER. It loops only because a RETRY is the same launch made
-# again under the same operation, generation, digest, directory and mode — the
-# spec's idempotent retry — and never because a child that ended is relaunched
-# on its own.
-# THE CHILD, AS ONE WORD, so the two spellings of its launch differ only in the
-# redirection that hands it this pane's stdin. It reads `sr_dir`, `sr_op`,
-# `sr_pidf` and `SUPERVISE_CMD` from the run it is called inside.
-supervise_child() {
-	( trap - INT QUIT
-	  if [ -n "$sr_dir" ] && [ "$sr_dir" != none ]; then
-		cd -- "$sr_dir" || exit 127
-	  fi
-	  LANE_START_FRESH=1 LANE_RESTART_OPERATION="$sr_op" LANE_RESTART_ATTEMPT="$SV_CLAIMED_ATTEMPT" \
-		exec sh -c 'printf "%s\n" "$$" > "$1"; shift; exec "$@"' _ "$sr_pidf" "${SUPERVISE_CMD[@]}" )
-}
-
-supervise_run() {   # <lane> <operation>
-	sr_lane="$1"; sr_op="$2"
-	# THIS PANE'S OWN STDIN, SAVED, so the background child below can be given
-	# it back. Where fd 0 cannot be duplicated the child is started without it,
-	# which is what a foreground child would have had anyway on such a shell.
-	SV_STDIN_SAVED=0
-	# Scope stderr suppression to the descriptor save. A bare exec also
-	# redirects this shell's stderr permanently, hiding the retry prompt.
-	if { exec 9<&0; } 2>/dev/null; then SV_STDIN_SAVED=1; fi
-	sr_pidf="$(mktemp "${TMPDIR:-/tmp}/lane-supervisor.XXXXXX" 2>/dev/null || printf '')"
-	[ -n "$sr_pidf" ] || die "no temporary file could be made to record the launch's pid, and without it this supervisor cannot tell a child that died from one that is starting. Nothing was started." 2
-	SV_PIDFILE="$sr_pidf"
-	while : ; do
-		# ---- the claim: `pending`/`failed` -> `starting`, fenced on the
-		# operation AND the generation. It is INSIDE the loop because a retry
-		# is a second claim of the same operation and must take the fence
-		# again: between the failure and the `r` a person may have started the
-		# lane by hand, and the retry must lose that race rather than win it.
-		ri_load "$sr_lane" || die "the restart intent could not be read. Nothing was started." 2
-		case "$RI_STATE" in
-		pending) sr_att=(--attempt=1); sr_claim_attempt=1 ;;
-		failed)  sr_att=(--bump-attempt); sr_claim_attempt=$((RI_ATTEMPT + 1)) ;;
-		*) die "lane $sr_lane's restart intent is '${RI_STATE:-none}' and this supervisor can only launch from \`pending\` or \`failed\`. Nothing was started. Read it:  $prog --restart-status --lane $sr_lane" 2 ;;
-		esac
-		LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$sr_lane" ||
-			die "managed ownership blocks this legacy retry. Nothing was started." 2
-		sr_claim_gen="$RI_GEN"
-		SV_CLAIMED_GEN=""; SV_CLAIMED_ATTEMPT=""; SV_CHILD_LAUNCH_STARTED=0
-		SV_DEFERRED_SIGNAL=""; SV_DEFERRED_STATUS=""
-		SV_CLAIMING=1
-		sr_crc=0
-		LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sr_lane" starting \
-			--expect "$RI_STATE" --expect-operation "$sr_op" --expect-generation "${RI_GEN:-0}" --expect-attempt "$RI_ATTEMPT" \
-			"${sr_att[@]}" --new-transcript none --reason "supervisor claimed the operation" >/dev/null 2>&1 || sr_crc=$?
-		# The writer is the authority for a successful CAS; publish its exact
-		# requested identity before replaying a signal deferred during the claim.
-		if [ "$sr_crc" = 0 ]; then
-			SV_CLAIMED_GEN="$sr_claim_gen"; SV_CLAIMED_ATTEMPT="$sr_claim_attempt"
-		fi
-		SV_CLAIMING=0
-		[ -z "$SV_DEFERRED_SIGNAL" ] || sv_signal "$SV_DEFERRED_SIGNAL" "$SV_DEFERRED_STATUS"
-		case "$sr_crc" in
-		0) : ;;
-		7) die "lane $sr_lane's restart intent moved between reading it and claiming it: another act owns operation $sr_op now. Nothing was started. Read it:  $prog --restart-status --lane $sr_lane" 2 ;;
-		*) die "lane $sr_lane's restart intent could not be claimed (\`set-restart-intent\` exited $sr_crc), and this supervisor will not launch without a fenced hold on operation $sr_op. Nothing was started." 2 ;;
-		esac
-		ri_load "$sr_lane" || die "the claimed intent could not be read back. Nothing was started." 2
-		[ "$RI_OP" = "$sr_op" ] && [ "$RI_GEN" = "$sr_claim_gen" ] && [ "$RI_ATTEMPT" = "$sr_claim_attempt" ] && [ "$RI_STATE" = starting ] ||
-			die "another operation replaced the supervisor claim. Nothing was started." 2
-		# THE GENERATION THIS SUPERVISOR HOLDS, taken once, here, where the claim
-		# has just succeeded and the record is this act's. Every later write of
-		# this operation is fenced on THIS number rather than on whatever the file
-		# says at the time, which is what makes a superseded supervisor's write
-		# refuse instead of landing.
-		SV_CLAIMED_GEN="${RI_GEN:-0}"
-		SV_CLAIMED_ATTEMPT="$RI_ATTEMPT"
-		case "$SV_CLAIMED_GEN" in '' | *[!0-9]*) SV_CLAIMED_GEN=0 ;; esac
-
-		# Repeat this check for every claimed attempt, including an interactive
-		# retry: a holder may have appeared while the previous failure waited.
-		sr_hrc=0
-		LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$sr_lane" >/dev/null 2>&1 || sr_hrc=$?
-		if [ "$sr_hrc" != 8 ]; then
-			LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$sr_lane" starting \
-				--expect starting --expect-operation "$sr_op" --expect-generation "$SV_CLAIMED_GEN" --expect-attempt "$SV_CLAIMED_ATTEMPT" \
-				--reason "INDETERMINATE: holder absence is unproven before attempt launch (read $sr_hrc)" >/dev/null 2>&1 || :
-			say "INDETERMINATE — holder absence is unproven; no child was launched and retry is blocked."
-			return 4
-		fi
-
-		if ! supervise_argv "$sr_lane" "$sr_op"; then
-			supervise_failed "$sr_lane" "$sr_op" "there is no launcher and no lane-start on PATH here, so nothing could be started"
-			sr_fs=$?
-			[ "$sr_fs" = 10 ] || return "$sr_fs"
-			supervise_prompt "$sr_lane" "$sr_op" || return $?
-			continue
-		fi
-		sr_dir="$RI_DIR"
-		if [ ! -d "$sr_dir" ] || [ ! -r "$sr_dir" ] || [ ! -x "$sr_dir" ]; then
-			supervise_failed "$sr_lane" "$sr_op" "the intent's checkout $sr_dir does not exist here, so the launch was not made"
-			sr_fs=$?
-			[ "$sr_fs" = 10 ] || return "$sr_fs"
-			supervise_prompt "$sr_lane" "$sr_op" || return $?
-			continue
-		fi
-		say "lane $sr_lane — restarting (operation $sr_op, attempt ${RI_ATTEMPT:-1})"
-		say "  through $SUPERVISE_VIA"
-		say "  first prompt: the top block of ${RI_HANDOFF:-the handoff this lane names}"
-		say "  this supervisor stays in the pane: whatever the launch does, it will say so here."
-		say ""
-		: > "$sr_pidf"
-		SV_WATCH_DIR="$(mktemp -d "${TMPDIR:-/tmp}/lane-observer.XXXXXX" 2>/dev/null)" ||
-			die "no private observer directory could be created. Nothing was started." 2
-		supervise_watch "$sr_lane" "$sr_op" "$SV_CLAIMED_GEN" "$sr_pidf" "$RI_NEW" "$RI_OLD" "$RI_PANE" "$RI_ATTEMPT" "$SV_WATCH_DIR/stop" &
-		sr_watch=$!
-		# PUBLISHED, so the signal handler can stop it: it is a background job of
-		# this shell and a signal to this shell is not a signal to it.
-		SV_WATCH_PID="$sr_watch"
-		sr_status=0
-		# THE CHILD RUNS IN THE BACKGROUND AND THIS PROCESS `wait`s ON IT, and
-		# that is not a preference either: **bash defers a trap until the
-		# foreground command it is running returns**. Measured — a `TERM` sent
-		# to a shell running `sleep 20` in the foreground does not reach its
-		# `TERM` trap for the whole twenty seconds, and the same shell with the
-		# sleep backgrounded and `wait`ed runs the trap in the same second. A
-		# supervisor whose child is an interactive Claude runs for hours, so a
-		# foreground child means the signal handling above would never fire when
-		# it is needed, which is the whole of Copilot round 1's finding.
-		#
-		# TWO THINGS A BACKGROUND JOB LOSES, AND BOTH ARE PUT BACK, because the
-		# child here is an interactive terminal program and neither loss is
-		# survivable for one:
-		#
-		#   * ITS STDIN. With job control off — which is every non-interactive
-		#     bash — an asynchronous command's stdin is redirected from
-		#     `/dev/null`. Measured. So fd 9 holds this pane's own stdin, saved
-		#     before the loop, and the child is started with `<&9`.
-		#   * ITS `INT` AND `QUIT`. Bash sets both to SIG_IGN for an
-		#     asynchronous command, and SIG_IGN SURVIVES `exec` — so Claude
-		#     would come up with Ctrl-C dead, in the pane a person just cleared
-		#     the context of. Measured: `SigIgn 0000000000000006` on the child
-		#     without the reset, `0000000000000000` with it. `trap - INT QUIT`
-		#     in the subshell restores the disposition this shell was entered
-		#     with, which is the default, and it does so even though this shell
-		#     has since set `trap '' INT` for itself.
-		#
-		# THE PID IS WRITTEN BY THE PROCESS THAT BECOMES THE CHILD, and `sh -c`
-		# is how, on bash 3.2 as well as on a modern one: `$$` inside it is
-		# that shell's pid, and the `exec` on the next word makes that pid the
-		# launch's own. `$BASHPID` would be the one-liner and macOS ships bash
-		# 3.2, which does not have it.
-		# `9<&-` CLOSES THE SAVED COPY IN THE CHILD once it has become its
-		# stdin: the pane's descriptor is this process's bookkeeping and is no
-		# part of the environment an interactive Claude should be handed.
-		SV_CHILD_LAUNCH_STARTED=1  # conservative before the fork/pid-file boundary
-		if [ "$SV_STDIN_SAVED" = 1 ]; then
-			supervise_child <&9 9<&- &
-		else
-			supervise_child &
-		fi
-		sr_child=$!
-		wait "$sr_child" || sr_status=$?
-		sv_stop_watch
-		# WHAT THE RECORD SAYS NOW IS WHAT DECIDES, and never this process's
-		# memory of what it started: the observer is the only thing that ever
-		# had positive evidence, and it wrote that evidence down.
-		ri_load "$sr_lane" >/dev/null 2>&1 || :
-		if [ "$RI_STATE" = ready ] && [ "$RI_OP" = "$sr_op" ] && [ "$RI_GEN" = "$SV_CLAIMED_GEN" ] && [ "$RI_ATTEMPT" = "$SV_CLAIMED_ATTEMPT" ]; then
-			say ""
-			say "lane $sr_lane: the replacement session was CONFIRMED (operation $sr_op, transcript ${RI_NEW:-unrecorded}) and has now exited."
-			say "  A session that exited on purpose is not relaunched here — that is \`lane $sr_lane\`."
-			return 0
-		fi
-		# AND WHETHER IT WENT THROUGH `INDETERMINATE` IS PART OF THE ANSWER
-		# (Copilot round 1 on openRepoTools#121). The usage block promises
-		# `4 indeterminate`, and no path returned it: the observer's `return 4`
-		# is read by nothing, because the observer runs in the background and
-		# this process decides from the RECORD. So the record decides that too.
-		#
-		# THE `failed` TRANSITION STAYS, and it is the half Copilot asked to
-		# remove. `INDETERMINATE` is the answer for a child that is ALIVE at the
-		# deadline — the supervisor keeps waiting, kills nothing and marks
-		# nothing — and this branch is reached only once that child has EXITED.
-		# A launch that ended having never been confirmed is a failed launch by
-		# every reading, and it is retryable; leaving the intent `starting`
-		# there would wedge the lane in the one state neither a retry nor the
-		# next `/ctx` can move, which is the defect the signal handling above
-		# exists to close. What was owed was the DISTINCTION, and it is the
-		# exit status and the reason, not a different transition.
-		sr_why="the launch ended with status $sr_status before readiness was confirmed"
-		sr_end=3
-		case "$RI_REASON" in
-		INDETERMINATE:*)
-			sr_why="the launch was INDETERMINATE — it ran past the readiness deadline still alive, then ended with status $sr_status; $RI_REASON"
-			sr_end=4 ;;
-		esac
-		supervise_failed "$sr_lane" "$sr_op" "$sr_why"
-		sr_fs=$?
-		# `10` IS "ASK THE PERSON" AND EVERY OTHER VALUE IS THE STATUS TO LEAVE
-		# WITH — except that an indeterminate end reports 4 rather than the 3
-		# `supervise_failed` returns for "reported, no terminal here".
-		if [ "$sr_fs" != 10 ]; then
-			[ "$sr_fs" = 3 ] && return "$sr_end"
-			return "$sr_fs"
-		fi
-		supervise_prompt "$sr_lane" "$sr_op" || return $?
-	done
-}
-
-# ============ THE PANE SUPERVISOR AND THE RESTART STATUS (openRepoTools#94)
-#
-# WHY A PROCESS STAYS IN THE PANE. `/ctx` respawned its own pane and treated
-# tmux ACCEPTING the command as proof a session had started. Tmux accepting a
-# command says nothing about whether the child resolved a profile, executed
-# Claude, stayed alive, or consumed the handoff it was supposed to. On
-# 2026-09-15 the preservation side completed, the old process was killed, and
-# what came back was not the act the record says — with nothing in the pane to
-# notice, because the thing tmux started was the launch itself and a launch
-# that ends takes the pane with it.
-#
-# THE PROTOCOL ALREADY ASKS FOR THIS IN SO MANY WORDS. Amendment 11's own
-# invariant is **"No path the launcher opened exits the pane"** (clause (b),
-# with its width, closed under `R-A11-16`); `/ctx` opened a path that did. The
-# supervisor is that invariant kept for the one act that had no one keeping it:
-# it is the pane's root process, it launches the real thing as a CHILD, and
-# whatever the child does the pane still has a process in it that can say what
-# happened and offer the retry.
-#
-# AND IT IS NOT A NEW WORD ON `PATH` (Amendment 18 Addendum 2 (i-8): *"no word
-# is kept on `PATH` for it alone"*, which is the ground on which `restart` was
-# removed from the installed set). It is a MODE of the command that already
-# owns the `/ctx` transaction, invoked by absolute path — tmux must not depend
-# on the respawned pane's `PATH` — and a person still has exactly one word,
-# `lane`.
-#
-# WHAT IT NEVER DOES: it never kills the child (Amendment 8(f): ending
-# somebody's process is not a boundary script's act), it never relaunches a
-# child that exited AFTER readiness, it never runs a picker, it never
-# rediscovers a launch choice from the current directory, the window title or a
-# rotating default, and it never marks a lane running on anything but positive
-# evidence.
-#
-# SUPERVISOR EXIT CODES, and they are contract:
-#   0  the child became ready and has since exited normally, or the operator
-#      ended the supervisor after a reported outcome
-#   2  REFUSED before launching anything — a stale operation, a mismatched
-#      pane, an intent that is not this lane's, an ambiguous live holder
-#   3  the launch FAILED before readiness and there was no terminal here to
-#      offer the retry on (the intent is `failed` and carries the reason)
-#   4  the launch was INDETERMINATE: the child is alive and readiness could not
-#      be confirmed inside the deadline. Nothing was killed and nothing was
-#      marked running
-
-# HOW LONG READINESS IS WAITED FOR. Sixty seconds is the design's number and a
-# slow workstation's transcript can take a few of them; the seam is for the
-# suite, which must not spend a minute proving a timeout.
-SUPERVISE_READY_SECONDS="${LANE_SUPERVISOR_READY_SECONDS:-60}"
-case "$SUPERVISE_READY_SECONDS" in '' | *[!0-9]*) SUPERVISE_READY_SECONDS=60 ;; esac
-
-# ONE FIELD OF THE LANE'S RESTART INTENT. Empty where there is none, which
-# every caller below tests for rather than guessing at.
-ri_field() {   # <lane> <key>
-	LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$1" 2>/dev/null \
-		| awk -F'\t' -v k="$2" '$1 == k { print $2; exit }'
-}
-
-# THE WHOLE INTENT ONCE, into `RI_*`. 0 where there is one, 8 where there is
-# not, 1 where the read FAILED — which is never the same as "there is none"
-# (Amendment 7(d)).
-ri_load() {   # <lane>
-	RI_STATE=""; RI_OP=""; RI_GEN=""; RI_MODE=""; RI_AGENT=""; RI_PROFILE=""
-	RI_DIR=""; RI_PANE=""; RI_WINDOW=""; RI_HANDOFF=""; RI_DIGEST=""; RI_PREPARED_DIGEST=""
-	RI_OLD=""; RI_NEW=""; RI_ATTEMPT=""; RI_REASON=""; RI_FILE=""
-	ril_out=""; ril_rc=0
-	ril_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$1" 2>/dev/null)" || ril_rc=$?
-	case "$ril_rc" in
-	0) : ;;
-	8) return 8 ;;
-	*) return 1 ;;
-	esac
-	RI_STATE="$(printf '%s\n' "$ril_out"   | awk -F'\t' '$1 == "state" { print $2; exit }')"
-	RI_OP="$(printf '%s\n' "$ril_out"      | awk -F'\t' '$1 == "operation" { print $2; exit }')"
-	RI_GEN="$(printf '%s\n' "$ril_out"     | awk -F'\t' '$1 == "generation" { print $2; exit }')"
-	RI_MODE="$(printf '%s\n' "$ril_out"    | awk -F'\t' '$1 == "mode" { print $2; exit }')"
-	RI_AGENT="$(printf '%s\n' "$ril_out"   | awk -F'\t' '$1 == "agent" { print $2; exit }')"
-	RI_PROFILE="$(printf '%s\n' "$ril_out" | awk -F'\t' '$1 == "profile" { print $2; exit }')"
-	RI_DIR="$(printf '%s\n' "$ril_out"     | awk -F'\t' '$1 == "dir" { print $2; exit }')"
-	RI_PANE="$(printf '%s\n' "$ril_out"    | awk -F'\t' '$1 == "pane" { print $2; exit }')"
-	RI_WINDOW="$(printf '%s\n' "$ril_out"  | awk -F'\t' '$1 == "window" { print $2; exit }')"
-	RI_HANDOFF="$(printf '%s\n' "$ril_out" | awk -F'\t' '$1 == "handoff" { print $2; exit }')"
-	RI_DIGEST="$(printf '%s\n' "$ril_out"  | awk -F'\t' '$1 == "digest" { print $2; exit }')"
-	RI_PREPARED_DIGEST="$(printf '%s\n' "$ril_out" | awk -F'\t' '$1 == "prepared_digest" {print $2; exit}')"
-	RI_OLD="$(printf '%s\n' "$ril_out"     | awk -F'\t' '$1 == "old_transcript" { print $2; exit }')"
-	RI_NEW="$(printf '%s\n' "$ril_out"     | awk -F'\t' '$1 == "new_transcript" { print $2; exit }')"
-	RI_ATTEMPT="$(printf '%s\n' "$ril_out" | awk -F'\t' '$1 == "attempt" { print $2; exit }')"
-	RI_REASON="$(printf '%s\n' "$ril_out"  | awk -F'\t' '$1 == "reason" { print $2; exit }')"
-	RI_FILE="$(printf '%s\n' "$ril_out"    | awk -F'\t' '$1 == "file" { print $2; exit }')"
-	return 0
-}
-
-# THE STATUS SURFACE — read-only, and the whole of what an operator needs to
-# tell a preservation failure, a tmux refusal, a launcher failure, an immediate
-# child exit, an indeterminate readiness and a confirmed run apart.
-if [ "$do_status" = 1 ]; then
-	[ -n "$lane" ] || die "--restart-status needs the lane: $prog --restart-status --lane <lane>" 2
-	rst_rc=0
-	ri_load "$lane" || rst_rc=$?
-	case "$rst_rc" in
-	8) say "lane $lane has no restart intent: no /ctx is in flight for it."; exit 0 ;;
-	1) die "lane $lane's restart intent could not be read (\`$LANES_EDIT restart-intent $lane\` failed). That is NOT 'there is none' — a read that failed is never an answer (Amendment 7(d))." 1 ;;
-	esac
-	say "lane        $lane"
-	say "intent      $RI_STATE (attempt ${RI_ATTEMPT:-0})"
-	say "operation   ${RI_OP:-none}   generation ${RI_GEN:-0}"
-	say "mode        ${RI_MODE:-none}"
-	say "agent       ${RI_AGENT:-none}   profile ${RI_PROFILE:-none}"
-	say "dir         ${RI_DIR:-none}"
-	say "pane        ${RI_PANE:-none}   window ${RI_WINDOW:-none}"
-	say "handoff     ${RI_HANDOFF:-none}"
-	say "digest      ${RI_DIGEST:-none}   prepared ${RI_PREPARED_DIGEST:-none}"
-	say "transcript  old ${RI_OLD:-none} → new ${RI_NEW:-none}"
-	say "reason      ${RI_REASON:-none}"
-	say "file        ${RI_FILE:-none}"
-	say "authority   legacy restart intent only"
-	say "lifecycle   separate diagnostics; never used to decide restart readiness"
-	case "$RI_STATE" in
-	preparing) say "PREPARING: old pane was not respawned; inspect preservation and reconcile this exact reservation before a new /ctx." ;;
-	failed)
-          say ""
-          if [ "$RI_MODE" = preservation-only ] && [ "$RI_ATTEMPT" = 0 ] && [ "$RI_NEW" = none ]; then
-            say "PREPARATION FAILED: the old pane was not respawned; no supervised launch was attempted."
-            say "When every holder is confirmed absent, ordinary resume is available: lane $lane"
-            say "From the original live session, a new /ctx may retry preservation."
-          else
-            say "RETRY:   $(quoted "$SELF_ABS") --supervise --lane $lane --operation ${RI_OP:-<id>}"
-          fi ;;
-
-	pending)  say ""; say "NOT YET CLAIMED: no supervisor has taken this operation. The pane it was written for may never have been respawned." ;;
-	starting) say ""; say "IN FLIGHT: this attempt is reserved; a child may still be alive. Do not start a second one — read the pane it is in (${RI_PANE:-pane not recorded})." ;;
-	ready)    say ""; say "DONE: this restart was confirmed. It authorises no further launch; an ordinary \`lane $lane\` resumes the lane." ;;
-	esac
-	exit 0
-fi
-
-# THE PANE IS HELD OPEN ON EVERY NON-ZERO EXIT OF THIS MODE, refusals
-# included. Amendment 11's invariant is *"No path the launcher opened exits the
-# pane"*, and a supervisor that refused before launching and then returned would
-# leave tmux printing `[exited]` over the one message that says why — which is
-# the shape of the defect this whole mode exists to close, reached through its
-# own front door. Where there is no terminal there is nobody to hold it for, and
-# the status is simply returned.
-SV_PIDFILE=""
-SV_SIGNALLED=0
-SV_WATCH_PID=""
-SV_WATCH_DIR=""
-SV_CLAIMING=0
-SV_DEFERRED_SIGNAL=""; SV_DEFERRED_STATUS=""
-SV_CHILD_LAUNCH_STARTED=0
-# Never signal a saved PID: an observer can finish hours before its child.
-# Cancellation uses a private marker; wait addresses our owned shell job.
-sv_stop_watch() {
-	if [ -n "$SV_WATCH_DIR" ]; then
-		: > "$SV_WATCH_DIR/stop"
-		# A signal can arrive after the fork but before PID publication. $!
-		# identifies that owned shell job; before the fork it is absent or a
-		# previously waited owned job. Waiting never signals a recycled PID.
-		sv_wait_pid="${SV_WATCH_PID:-${!:-}}"
-		[ -z "$sv_wait_pid" ] || wait "$sv_wait_pid" 2>/dev/null || :
-		SV_WATCH_PID=""
-		rm -f -- "$SV_WATCH_DIR/stop" 2>/dev/null
-		rmdir -- "$SV_WATCH_DIR" 2>/dev/null || :
-		SV_WATCH_DIR=""
-	fi
-}
-
-# Empty until this supervisor has successfully claimed a specific attempt.
-SV_CLAIMED_GEN=""
-SV_CLAIMED_ATTEMPT=""
-sv_on_exit() {
-	sv_hs=$?
-	sv_stop_watch
-	[ -z "$SV_PIDFILE" ] || rm -f -- "$SV_PIDFILE" 2>/dev/null
-	[ "$sv_hs" = 0 ] && return 0
-	# A SUPERVISOR SOMEBODY SIGNALLED AWAY IS NOT ONE ANYBODY IS WAITING TO
-	# READ. Holding the pane open for an Enter after a `tmux kill-pane` is a
-	# pane that will not close.
-	[ "$SV_SIGNALLED" = 1 ] && return 0
-	[ "${LANE_SUPERVISOR_NO_PROMPT:-0}" = 1 ] && return 0
-	[ -t 0 ] || return 0
-	printf '\n%s: this pane is held open so the lines above can be read (exit %s). Press Enter to close it. ' "$prog" "$sv_hs" >&2
-	IFS= read -r sv_ignored || :
-	return 0
-}
-
-# Cancellation writes only an owned attempt. A live or unknown child keeps
-# starting and blocks retry; an unclaimed pending intent remains unchanged.
-sv_signal() {   # <signal name> <exit status>
-	# Bash may deliver a deferred signal as the CAS returns, before the caller
-	# records its successful claim. Finish publication before reconciliation.
-	if [ "$SV_CLAIMING" = 1 ]; then
-		SV_DEFERRED_SIGNAL="$1"; SV_DEFERRED_STATUS="$2"
-		return 0
-	fi
-	SV_SIGNALLED=1
-	# THE OBSERVER GOES FIRST, AND IS REAPED (Copilot round 2 on
-	# openRepoTools#121). It is a background job of this shell and a signal to
-	# this process is not a signal to it: left running it keeps polling after its
-	# supervisor is gone, and the two verdicts then race. Neither can overwrite
-	# the other — both writes are fenced and the loser is refused — but the
-	# LOSER STILL SPEAKS, and a supervisor printing *the restart intent is
-	# `failed`* about an operation the observer had just confirmed `ready` is a
-	# line nobody can act on. So it is stopped, reaped, and the record is read
-	# back AFTER the write below rather than assumed.
-	# A SIGNAL BEFORE THIS PROCESS KNOWS WHICH OPERATION IT IS SUPERVISING has no
-	# record to write and says so: the traps are installed at the top of the mode,
-	# ahead of the arguments being checked, because a supervisor that could be
-	# signalled between those two lines and leave nothing behind is the same gap
-	# one instruction wide.
-	sv_stop_watch
-	if [ -z "$lane" ] || [ -z "$operation" ]; then
-		say ""
-		say "$prog: SIG$1 before this supervisor had a lane and an operation to supervise — nothing was claimed, nothing was started and nothing is left behind."
-		exit "$2"
-	fi
-	# A preflight signal has no claimed generation/attempt to reconcile.
-	if [ -z "$SV_CLAIMED_GEN" ]; then
-		say "$prog: SIG$1 before the restart claim; the intent was left unchanged."
-		exit "$2"
-	fi
-	sv_sg_child=""; sv_sg_alive="child termination could not be established"; sv_sg_state=starting
-	if [ -n "$SV_PIDFILE" ] && [ -r "$SV_PIDFILE" ]; then
-		sv_sg_child="$(head -n 1 -- "$SV_PIDFILE" 2>/dev/null | tr -dc '0-9')"
-	fi
-	if [ -n "$sv_sg_child" ]; then
-		if kill -0 "$sv_sg_child" 2>/dev/null; then
-			sv_sg_alive="the launch (pid $sv_sg_child) was STILL RUNNING and was not killed"
-		else
-			sv_sg_alive="the launch (pid $sv_sg_child) had already ended"
-			sv_sg_hrc=0
-			LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$lane" >/dev/null 2>&1 || sv_sg_hrc=$?
-			[ "$sv_sg_hrc" != 8 ] || sv_sg_state=failed
-		fi
-	fi
-	if [ "$SV_CHILD_LAUNCH_STARTED" = 0 ]; then
-		sv_sg_alive="no child was launched"
-		sv_sg_hrc=0
-		LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$lane" >/dev/null 2>&1 || sv_sg_hrc=$?
-		[ "$sv_sg_hrc" != 8 ] || sv_sg_state=failed
-	fi
-	sv_sg_fence=()
-	[ -n "$SV_CLAIMED_GEN" ] && sv_sg_fence=(--expect-generation "$SV_CLAIMED_GEN" --expect-attempt "$SV_CLAIMED_ATTEMPT")
-	sv_sg_reason="supervisor received SIG$1 before readiness; $sv_sg_alive"
-	[ "$sv_sg_state" != starting ] || sv_sg_reason="INDETERMINATE: $sv_sg_reason"
-	LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$lane" "$sv_sg_state" \
-		--expect 'pending|starting' --expect-operation "$operation" \
-		${sv_sg_fence[@]+"${sv_sg_fence[@]}"} \
-		--reason "$sv_sg_reason" \
-		>/dev/null 2>&1 || :
-	ri_load "$lane" >/dev/null 2>&1 || :
-	say ""
-	say "$prog: SIG$1 — this supervisor is leaving operation $operation on lane $lane."
-	say "  $sv_sg_alive."
-	if [ "${RI_STATE:-}" = ready ]; then
-		# THE OBSERVER GOT THERE FIRST, and its evidence is better than this
-		# handler's: the replacement was confirmed before the signal arrived, and
-		# the `failed` write above was refused by the fence for exactly that
-		# reason. Saying `failed` here would be this process reporting its own
-		# intention over the record's fact.
-		say "  The replacement was CONFIRMED before this signal arrived (transcript ${RI_NEW:-unrecorded}), so the intent is \`ready\` and this restart is DONE."
-		say "    read it: $(quoted "$SELF_ABS") --restart-status --lane $lane"
-	else
-		say "  The restart intent is \`${RI_STATE:-starting}\`; no child was killed."
-		say "    read it: $(quoted "$SELF_ABS") --restart-status --lane $lane"
-		if [ "${RI_STATE:-}" = failed ]; then
-			say "    retry:   $(quoted "$SELF_ABS") --supervise --lane $lane --operation $operation"
-		else
-			say "  Retry remains blocked until the child is confirmed gone and the attempt is reconciled."
-		fi
-	fi
-	exit "$2"
-}
-
-if [ "$do_supervise" = 1 ]; then
-	trap sv_on_exit EXIT
-	# `INT` IS THE CHILD'S AND NOT THIS PROCESS'S. Ctrl-C reaches the whole
-	# foreground process group, and a supervisor that exited on it would tear
-	# the pane down under a Claude that was merely interrupted — so this process
-	# ignores it and the child's own subshell puts it back to default before the
-	# exec, which is the one thing that keeps Ctrl-C working in that pane.
-	trap '' INT
-	trap 'sv_signal TERM 143' TERM
-	trap 'sv_signal HUP 129' HUP
-	[ -n "$lane" ] || die "--supervise needs the lane: $prog --supervise --lane <lane> --operation <id>" 2
-	[ -n "$operation" ] || die "--supervise needs the operation it was started for: $prog --supervise --lane $lane --operation <id>. A supervisor that took whatever intent it found would be a supervisor that launches a lane for an act somebody else is in the middle of." 2
-
-	LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$lane" ||
-		die "legacy supervisor refuses managed or unknown ownership. Nothing was started." 2
-
-	# ---- the operation this supervisor was started for, and no other
-	sv_rc=0
-	ri_load "$lane" || sv_rc=$?
-	case "$sv_rc" in
-	8) die "lane $lane has no restart intent, so there is nothing for operation $operation to launch. Nothing was started. A /ctx whose intent could not be written should have refused before it killed anything — read the lane:  $prog --restart-status --lane $lane" 2 ;;
-	1) die "lane $lane's restart intent could not be read (\`$LANES_EDIT restart-intent $lane\` failed). That is NOT 'there is none', and this supervisor will not launch a session for an operation it could not verify (Amendment 7(d)). Nothing was started." 1 ;;
-	esac
-	[ "$RI_OP" = "$operation" ] ||
-		die "operation $operation is not lane $lane's current restart operation, which is ${RI_OP:-none} (intent ${RI_STATE:-none}, generation ${RI_GEN:-0}). A stale supervisor never launches against a newer operation: nothing was started. Read it:  $prog --restart-status --lane $lane" 2
-	case "$RI_STATE" in
-	pending | failed) : ;;
-	starting) die "lane $lane's restart operation $operation is already \`starting\` — a supervisor holds it, in ${RI_PANE:-a pane this record does not name}. A second one would launch a second session of one lane, which is the collision this whole protocol is about (Amendment 18(h)). Nothing was started." 2 ;;
-	ready)    die "lane $lane's restart operation $operation is already \`ready\`: that restart was confirmed and this record authorises no further launch. Nothing was started. To open the lane:  lane $lane" 2 ;;
-	*)        die "lane $lane's restart intent is in state '${RI_STATE:-none}', which this supervisor does not know how to launch from. Nothing was started." 2 ;;
-	esac
-	[ "$RI_MODE" = fresh-from-handoff ] ||
-		die "lane $lane's restart intent names launch mode '${RI_MODE:-none}' and this supervisor makes only 'fresh-from-handoff' launches. Nothing was started." 2
-
-	# ---- the pane: this supervisor is IN the pane the intent was written for
-	#
-	# A SUPERVISOR IN THE WRONG PANE WOULD PUT A SECOND SESSION OF THIS LANE
-	# SOMEWHERE THE LANE IS NOT. The intent records the pane `/ctx` respawned;
-	# `$TMUX_PANE` is where this process actually is. They are compared where
-	# both are knowable, and a comparison that CANNOT be made is said rather than
-	# assumed — this runs under a fake tmux in the suite and under none at all
-	# where a person invoked it by hand.
-	sv_pane_here="${TMUX_PANE:-}"
-    [ -n "$RI_PANE" ] && [ "$RI_PANE" != none ] && [ -n "$sv_pane_here" ] ||
-      die "the restart pane binding cannot be verified: recorded ${RI_PANE:-none}, current ${sv_pane_here:-none}. Nothing was started." 2
-	pane_agrees "$RI_PANE" "$sv_pane_here" ||
-		die "lane $lane's restart intent was written for pane $RI_PANE and this supervisor is in $sv_pane_here. Nothing was started: a launch here would put this lane's session in a pane the lane's own record does not name, and that record is what every other reader goes by." 2
-
-	# ---- the agent: the intent's, and the lane's own record, must still agree
-	#
-	# DESIGN DECISION 15 SAYS AGENT, PROFILE AND DIRECTORY ARE FENCED *EARLIER* —
-	# *"where a conflict refuses the launch before it is made, rather than
-	# re-checked after"* — and for the agent that was not true of any line
-	# (Copilot round 2 on openRepoTools#121). The intent records it and nothing
-	# read it back. So it is read back here, which is the place the decision
-	# names: before anything is claimed or started.
-	#
-	# IT IS THE CANONICAL AGENT AND NOT THE CHILD'S. What a live process IS
-	# cannot be read from this estate's records — `live-holder` answers a
-	# transcript, a pane, a name, a pid and a verdict, and no agent word — so
-	# what is compared is the lane's own recorded agent against the one this
-	# restart was written for. A lane whose agent changed under a restart is a
-	# restart whose contract changed under it, and launching the intent's agent
-	# into it would make the record and the process disagree.
-	sv_ag=""; sv_agrc=0
-	sv_ag="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-agent "$lane" 2>/dev/null)" || sv_agrc=$?
-	case "$sv_agrc" in
-	0)
-		if [ -n "$RI_AGENT" ] && [ "$RI_AGENT" != none ] && [ -n "$sv_ag" ] && [ "$sv_ag" != "$RI_AGENT" ]; then
-			die "lane $lane's restart intent was written for agent '$RI_AGENT' and the lane's own record now names '$sv_ag'. Nothing was started: the agent decides which launcher this lane is resumed by and what its first prompt even means, so a restart made for one agent into a lane recorded as another is a session neither record describes. Read it:  $prog --restart-status --lane $lane" 2
-		fi ;;
-	# 8 IS A LANE WHOSE RECORD NAMES NO AGENT and 2 A HELPER WITH NO WORD FOR
-	# ONE; both are answers, and a comparison that cannot be made is not a
-	# disagreement.
-	8 | 2) : ;;
-	*) die "lane $lane's recorded agent could not be read (lane-agent exited $sv_agrc). Nothing was started: unknown agent identity cannot authorize a restart." 1 ;;
-	esac
-
-	[ "$RI_AGENT" = claude ] || die "this legacy supervisor supports only the recorded Claude agent. Nothing was started." 2
-	case "$RI_DIR" in /*) : ;; *) die "the supervised restart needs an absolute checkout. Nothing was started." 2 ;; esac
-	[ -d "$RI_DIR" ] && [ -r "$RI_DIR" ] && [ -x "$RI_DIR" ] ||
-		die "the supervised restart checkout is missing or unusable. Nothing was started." 2
-	[ -n "$RI_HANDOFF" ] && [ "$RI_HANDOFF" != none ] && [ -s "$RI_HANDOFF" ] &&
-	  [ -n "$RI_DIGEST" ] && [ "$RI_DIGEST" != none ] ||
-	  die "the supervised restart has no complete handoff checksum. Nothing was started." 2
-	# ---- the handoff's digest: the first prompt is that file, and only that file
-	if [ -n "$RI_HANDOFF" ] && [ "$RI_HANDOFF" != none ] && [ -n "$RI_DIGEST" ] && [ "$RI_DIGEST" != none ]; then
-		sv_now="$(handoff_digest "$RI_HANDOFF")"
-		[ "$sv_now" = "$RI_DIGEST" ] || [ "$sv_now" = "${RI_PREPARED_DIGEST:-none}" ] ||
-			die "lane $lane's handoff has changed since operation $operation was written: the intent records $RI_DIGEST for $RI_HANDOFF and it now digests $sv_now. The top block of that file is the new session's FIRST PROMPT, so launching now would deliver a block this /ctx did not write. Nothing was started. Take the handoff again:  $prog --restart" 2
-	fi
-
-	# ---- a live holder makes this ambiguous, and ambiguity refuses
-	#
-	# `live-holder` answers who is running this lane NOW. A supervisor that
-	# launched behind one would be Amendment 18(h)'s second binding, made by the
-	# tooling itself. A read that FAILED is not "nobody is": it refuses too,
-	# because this is the one moment a second process gets created.
-	sv_hold=""; sv_hrc=0
-	sv_hold="$(LANES_NO_FETCH=1 "$LANES_EDIT" live-holder "$lane" 2>/dev/null)" || sv_hrc=$?
-	case "$sv_hrc" in
-	0) [ -z "$sv_hold" ] ||
-		die "lane $lane already has a live holder, so this supervisor will not start a second session of it (Amendment 18(h)):
-$sv_hold
-Nothing was started. If that process is a leftover of an earlier attempt, retire it first — \`lane-end $lane --retire <pid>\` — then retry:  $prog --supervise --lane $lane --operation $operation" 2 ;;
-	8 | 2) : ;;
-	*) die "lane $lane's live holders could not be read (\`$LANES_EDIT live-holder $lane\` exited $sv_hrc), so whether this lane is already running is UNKNOWN from here — and a read that failed is never an answer (Amendment 7(d)). This supervisor will not create a second process on a lane that may be live. Nothing was started." 1 ;;
-	esac
-
-	supervise_run "$lane" "$operation"
-	exit $?
-fi
-
-
-# EVERY READ OF THE REGISTER GOES THROUGH ONE FENCE, and Amendment 7(d) is the
-# whole of it: `0` an answer, `8` NO ANSWER and `2` a helper predating the read
-# — both of those fall to the next rung — and ANYTHING ELSE is a read that
-# FAILED, which is neither. A register that could not be read is not "this
-# window is not a lane", and the steps below would then write a PAUSED record,
-# a stamp and a restart command for a lane this window is not.
-#
-# IT SETS A VARIABLE RATHER THAN PRINTING ITS ANSWER, and that is load-bearing:
-# a refusal inside `$( )` kills only the substitution's subshell, and this
-# command would carry on with an empty answer.
-#
-# AND `2` IS TWO ANSWERS (Amendment 15; Copilot round 2 on openRepoTools#47).
-# It is what a helper predating a subcommand spends on an unknown one — the
-# rung this fence falls through for, and every workstation until adoption
-# reaches it — and it is ALSO `canon_lane`'s refusal of a register holding two
-# rows that differ only by case, which every read through `check_lane_name` now
-# carries. Falling through THAT is binding this window to whichever lane the
-# next rung happens to answer with, and then renaming the window, writing a
-# PAUSED record and respawning a pane for it. So the refusal is asked for BY
-# ITS OWN WORDS — no old helper emits them from an unknown subcommand, which is
-# how `lane-start:755-767`, `lane-end` and `restart` tell the two apart — and
-# relayed, with the fall-through for a genuinely old helper left as it was.
-sread() {   # sread <var> "<what the failure is NOT>" <verb> [args…]
-	sr_var="$1"; sr_not="$2"; shift 2
-	sr_out=""; sr_rc=0
-	sr_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" "$@" 2>/dev/null)" || sr_rc=$?
-	case "$sr_rc" in
-	0) : ;;
-	2)
-		sr_why="$(LANES_NO_FETCH=1 "$LANES_EDIT" "$@" 2>&1 >/dev/null || :)"
-		case "$sr_why" in
-		*"Amendment 15(d)"*)
-			die "the register holds two rows for this lane that differ only by case, so no read of it is unambiguous and this command will not pick one (Amendment 15(d)). Nothing was written and nothing was renamed. The helper's own words:
-$sr_why" 2 ;;
-		esac
-		sr_out="" ;;
-	8) sr_out="" ;;
-	*) die "\`$LANES_EDIT $1\` failed (exit $sr_rc). That is NOT $sr_not — a read that failed is never an answer (Amendment 7(d)), and this command will not bind a lane, write a PAUSED record or print a restart command on one. Run it by hand to see what it says." 1 ;;
-	esac
-	eval "$sr_var=\$sr_out"
-}
-
-# ---------------- the crash-consistent lifecycle (opensoft/openRepoTools#91)
-#
-# A LANE IS `RUNNING`, `SWAPPING`, `SWAPPED` OR `CLOSED`, and this command owns
-# the two-phase transition in the middle of that: `SWAPPING` BEFORE any
-# preservation work begins, `SWAPPED` only after every mandatory write has
-# landed. What that buys is the one thing the `PAUSED` record alone could never
-# say — WHERE a session that ran out of tokens stopped. `RUNNING` with no live
-# holder is an ungraceful stop: nothing was polled, nothing was refreshed,
-# nothing was recorded. `SWAPPING` with no live holder is an INTERRUPTED SWAP:
-# some of those writes may have landed and some may not, and every worktree
-# below is preserved until a person has read them.
-#
-# THE LIFECYCLE NEVER REFUSES THE SWAP. `R-A11-11` is that a swap is never left
-# unwritten, and it binds this command: a control root that cannot be derived,
-# a fence another act moved, a snapshot that cannot be written — each of them
-# costs the LIFECYCLE and never the record. The handoff carries on and says
-# what it could not keep, exactly as it does for a dropped sub-field.
-lc_on=""; lc_gen=""; lc_op=""; lc_state=""; lc_inventory_missed=""
-
-lifecycle_begin() {
-	lc_on=""; lc_gen=""; lc_op=""; lc_state=""
-	lcb_now=""; lcb_raw=""; lcb_rc=0
-	# READ WHOLE, THEN PARSE (opensoft/openRepoTools#280). This read was
-	# `lane-state | awk '… { print $2; exit }'` under `pipefail`, and that `awk`
-	# exits at the line it wants: a `lane-state` that wrote once more after it
-	# — its builtin `printf` hands a multi-line snapshot to the pipe in pieces —
-	# died of SIGPIPE, the substitution's status was 141, and the `case` below
-	# took that for a read that FAILED: "could not be read", no fence, no
-	# inventory and no RUNNING -> SWAPPING -> SWAPPED, on timing alone (CI run
-	# 39322387035). The reader had stopped listening; the read had not failed.
-	# So the status below is `lane-state`'s own, from a command nothing can end
-	# early, and the state is parsed out of what it printed afterwards.
-	lcb_raw="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-state "$lane" 2>/dev/null)" || lcb_rc=$?
-	case "$lcb_rc" in
-	0 | 8) : ;;
-	*)
-		note "the lane lifecycle could not be read (\`$LANES_EDIT lane-state $lane\` exited $lcb_rc), so this handoff records no RUNNING -> SWAPPING -> SWAPPED transition. The swap itself goes on (\`R-A11-11\`) and the PAUSED record below is unaffected."
-		return 0 ;;
-	esac
-	lcb_now="$(printf '%s\n' "$lcb_raw" | awk -F"\t" '$1 == "state" { print $2; exit }')"
-	[ -n "$lcb_now" ] || lcb_now=none
-	# AN INTERRUPTED SWAP IS TAKEN OVER, NOT COMPETED WITH. A lane still
-	# reading `SWAPPING` when a new handoff starts is one whose previous
-	# operation never finished; this one supersedes it with a NEW generation,
-	# which is precisely what refuses the old finalizer if it ever wakes up.
-	# The old operation id is named rather than lost.
-	if [ "$lcb_now" = SWAPPING ]; then
-		# Read whole, then parsed, for the reason given above (#280); its status
-		# was never read, and the operation is only named in the note below.
-		lcb_old_raw="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-state "$lane" 2>/dev/null)"
-		lcb_old="$(printf '%s\n' "$lcb_old_raw" | awk -F"\t" '$1 == "operation" { print $2; exit }')"
-		note "lane $lane is still recorded SWAPPING from operation ${lcb_old:-unknown}, which never finished: this handoff SUPERSEDES it with a new generation, and that is what refuses the old finalizer if it ever returns. Nothing of that operation is undone here."
-	fi
-	lcb_out=""; lcb_src=0
-	lcb_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" set-lane-state "$lane" SWAPPING \
-		--expect "$lcb_now" --owner "${uuid:-none}" --agent "$agent" \
-		--profile "${profile_name:-none}" --kind "$handoff_kind" 2>/dev/null)" || lcb_src=$?
-	case "$lcb_src" in
-	0)
-		lc_gen="$(printf '%s\n' "$lcb_out" | awk -F"\t" '$1 == "generation" { print $2; exit }')"
-		lc_op="$(printf '%s\n' "$lcb_out" | awk -F"\t" '$1 == "operation" { print $2; exit }')"
-		# THE FENCE THIS RUN WILL FINISH WITH, READ BACK BEFORE IT IS TRUSTED.
-		# Every later call carries both — the finalizer as `--expect-generation`
-		# and `--expect-operation`, each tree sidecar as the operation that
-		# recorded it — and an empty one there is a flag with no value, which
-		# the writer refuses. Better to record no transition at all than to
-		# record trees against an operation nobody can match.
-		if [ -z "$lc_gen" ] || [ -z "$lc_op" ]; then
-			note "the lane was taken to SWAPPING and the helper named no generation or no operation back, so this handoff records no fence and takes no inventory. Read the state by hand: $LANES_EDIT lane-state $lane"
-		else
-			lc_on=1
-			lc_state=SWAPPING
-			step "lifecycle: $lcb_now -> SWAPPING (generation $lc_gen, operation $lc_op)"
-		fi ;;
-	7)
-		note "the lane lifecycle moved between reading it and taking it (it was $lcb_now and is not now), so this handoff records no transition and its worktree inventory carries no operation. Another process is acting on lane $lane: read it with \`$LANES_EDIT lane-reconcile $lane\` before relaunching anything. The swap itself goes on (\`R-A11-11\`)." ;;
-	1)
-		note "lane $lane has no lifecycle control root (its record names no directory, and \$PROJECTS_ROOT is not a directory here), so this handoff records no RUNNING -> SWAPPING -> SWAPPED transition and crash recovery for it stays incomplete. The swap itself goes on." ;;
-	*)
-		note "the lane lifecycle could not be taken to SWAPPING (\`set-lane-state\` exited $lcb_src). The swap goes on and records no transition." ;;
-	esac
-	return 0
-}
-
-# `SWAPPED` IS THE COMMIT POINT AND IT IS FENCED ON THIS OPERATION. A handoff
-# whose record, row and handoff file did not all land leaves the lane
-# `SWAPPING` and SAYS WHICH STEP IS UNFINISHED — because those three are
-# exactly what a resumed session needs to have found, and a lane called
-# `SWAPPED` on two of them is a lane whose recovery would skip the third.
-lifecycle_finish() {   # <what is unfinished, empty when nothing is>
-	[ -n "$lc_on" ] || return 0
-	if [ -n "${1-}" ]; then
-		lc_state=SWAPPING
-		note "the lane stays SWAPPING (generation $lc_gen, operation $lc_op): $1. A later session reads that as an INTERRUPTED SWAP and preserves every worktree, which is the honest record of what this act left."
-		return 0
-	fi
-	lcf_rc=0
-	LANES_NO_FETCH=1 "$LANES_EDIT" set-lane-state "$lane" SWAPPED \
-		--expect SWAPPING --expect-generation "$lc_gen" --expect-operation "$lc_op" \
-		--owner "${uuid:-none}" --agent "$agent" --profile "${profile_name:-none}" \
-		--kind "$handoff_kind" >/dev/null 2>&1 || lcf_rc=$?
-	case "$lcf_rc" in
-	0) lc_state=SWAPPED; step "lifecycle: SWAPPING -> SWAPPED (generation $lc_gen, operation $lc_op)" ;;
-	7)
-		lc_state=superseded
-		note "this handoff is NOT the act that finishes lane $lane: the lifecycle fence moved under it (another handoff, or a resume that took the lane) and a stale finalizer must never overwrite a newer owner. The PAUSED record, the row and the handoff file are all written; only the SWAPPED transition was refused." ;;
-	*)
-		lc_state=SWAPPING
-		note "the lane could not be recorded SWAPPED (\`set-lane-state\` exited $lcf_rc), so it stays SWAPPING and a later session reads it as an interrupted swap." ;;
-	esac
-	return 0
-}
-
-# ------------------------------------------------- 1. the identity triple
-#
-# THE WORKSTATION COMES FROM CONFIGURATION, NEVER FROM `hostname` (Amendment 11,
-# ratified decision 8(d)): the helper's own `workstation` read is the one
-# implementation, and its second tab-separated field says which rung answered.
-ws_pair=""; ws_rc=0
-ws_pair="$("$LANES_EDIT" workstation 2>/dev/null)" || ws_rc=$?
-ws="${ws_pair%%	*}"
-ws_src="${ws_pair##*	}"
-# AND IT NEVER WRITES A PLACEHOLDER (`R-A11-14`). Inside a container with no
-# `LANES_WORKSTATION` the register and object-log writes STOP — they are filed
-# under the workstation, and a record filed under a container id is a record no
-# restart of any workstation will ever find — while the SWAP ITSELF GOES ON
-# (A11 Addendum 4 ruling 11, `R-A11-11`: *a swap is never left unwritten*). The
-# handoff file is refreshed, it NAMES the gap, and the restart line is printed
-# with `--lane`, because the row is not flipped either.
-ws_missing=""
-if [ "$ws_rc" != 0 ] && [ "$ws_rc" != 8 ] && [ -z "$ws" ]; then
-	ws_missing=1
-	note "NO WORKSTATION READ: \`$LANES_EDIT workstation\` exited $ws_rc and named none. Exit 2 is a lanes-edit.sh predating Amendment 11 (\`R-A11-8\`); anything else is a read that failed. Either way no record is filed under no workstation (\`R-A11-14\`): the register and object-log writes below are NOT made. The handoff is still refreshed and NAMES this gap, and the restart line is still printed, with --lane."
-elif [ "$ws_src" = container-unset ] || [ -z "$ws" ]; then
-	ws_missing=1
-	note "NO WORKSTATION: this is a container and \$LANES_WORKSTATION is not set. The register and object-log writes below are NOT made — both logs are append-only and a record filed under a container id is unfindable (\`R-A11-14\`). The handoff is refreshed and NAMES the gap, and the restart line is printed with --lane. The launcher exports the value into every session and container it starts; to close it now: export LANES_WORKSTATION=<this host name> and re-run."
-fi
-
-# THE WINDOW, its `<@id>`, and the lane — the launcher's own order, with
-# Amendment 11 clause (b)'s zero-question step in the middle, so this command
-# and the launcher never disagree about which lane this window is.
-# THREE TMUX SPELLINGS OF ONE WINDOW, AND NEITHER IS DERIVED FROM ANOTHER
-# (Amendment 11 clause (c), as `lane-start:975-984` states it): the record's
-# `window` sub-field is `<session>:<index> <@id>`, two space-separated refs, and
-# the HARNESS's own `tmux` field — which `window-session` matches a session
-# record on, and which is where the PANE comes from — is `<session>:<@id>`.
-# Reading one for the other is how a record names a window nothing can resolve.
-# AND EACH IS CHECKED AS A WHOLE STRING (opensoft/openRepoTools#80 item 3,
-# Copilot's review of workBenches#91 at `lane-handoff:434`). `*:[0-9]*` and
-# `@[0-9]*` were prefix globs, so `session:1junk` and `@123junk` passed —
-# from tmux and from the launcher's environment alike — and went into the
-# append-only `window` sub-field, where `window-lane` can never resolve them.
-# The launcher and `lane-start` hold the same two values to `^.+:[0-9]+$` and
-# `^@[0-9]+$`; these are those two rules, spelled in `case` as `lane-start`
-# spells its own id check. The ref: a session part that is not empty, then
-# digits and nothing else after the LAST `:`.
-window_ref_ok() {   # <session>:<index>
-	case "${1##*:}" in '' | *[!0-9]*) return 1 ;; esac
-	case "$1" in ?*:*) return 0 ;; esac
-	return 1
-}
-window_id_ok() {   # @<id>
-	case "$1" in @ | @*[!0-9]*) return 1 ;; @*) return 0 ;; esac
-	return 1
-}
-win=""; wid=""; window_name=""; win_harness=""
-if have_tmux; then
-	win="$(tmux display-message -p '#S:#I' 2>/dev/null || :)"
-	window_ref_ok "$win" || win=""
-	wid="$(tmux display-message -p '#{window_id}' 2>/dev/null || :)"
-	window_id_ok "$wid" || wid=""
-	window_name="$(tmux display-message -p '#W' 2>/dev/null || :)"
-	win_harness="$(tmux display-message -p '#{session_name}:#{window_id}' 2>/dev/null || :)"
-fi
-[ -n "$win" ] || win="${WORKBENCHES_CLAUDE_WINDOW_REF:-}"
-window_ref_ok "$win" || win=""
-[ -n "$wid" ] || wid="${WORKBENCHES_CLAUDE_WINDOW_ID:-}"
-window_id_ok "$wid" || wid=""
-window_ref="${win}${wid:+ $wid}"
-
-if [ -z "$lane" ] && [ -n "$window_name" ]; then
-	sread row_probe "'this window is not a lane'" register-row "$window_name"
-	[ -n "$row_probe" ] && lane="$window_name"
-fi
-if [ -z "$lane" ]; then
-	wl_ref="${wid:-$win}"
-	if [ -n "$wl_ref" ] && [ -n "$ws" ]; then
-		sread candidate "'no lane is bound to this window'" window-lane "$ws" "$wl_ref"
-		case "$candidate" in
-		[A-Za-z0-9_]*) lane="$candidate" ;;
-		esac
-	fi
-fi
-if [ -z "$lane" ] && [ -n "$ws" ]; then
-	# The swap record, read exactly as the launcher reads it: the tab is the
-	# contract. A row that printed before a failed read, or one with no tab, is
-	# not a record row — `cut -f 1` would hand back the whole line, lane-shaped
-	# and wrong.
-	sread rows "'this workstation has no swap record'" swapped "$ws"
-	first="$(printf '%s\n' "$rows" | head -n 1)"
-	case "$first" in
-	*"	"*)
-		candidate="${first%%	*}"
-		case "$candidate" in
-		[A-Za-z0-9_]*) lane="$candidate" ;;
-		esac ;;
-	esac
-fi
-if [ -z "$lane" ]; then
-	case "$window_name" in
-	*-[0-9]*) die "nothing binds this window: it is named '$window_name', the register has no row for that name, no record of this workstation names this window, and this workstation has no swap record to fall back to. Bind it first, then hand off:
-    lane-start --no-launch ${window_name%-*} ${window_name##*-}" 2 ;;
-	*) die "nothing binds this window${window_name:+ (it is named '$window_name', which is not a lane name)}, so there is no lane to hand off. Bind it first — the repository and the position are the operator's to name:
-    lane-start --no-launch <repo> <n>
-    or name the lane here: $prog --lane <lane>" 2 ;;
-	esac
-fi
-# ONE NAME UNDER ANY CASE, AND BEFORE ANYTHING IS RENAMED OR WRITTEN
-# (Amendment 15; Copilot round 2 on openRepoTools#47). Every rung above answers
-# with a spelling of its own — the tmux window's name, a record's lane field,
-# the swap row's first cell — and `--lane` answers with whatever was typed,
-# validated by nothing until the record write far below. The REGISTER ROW's
-# spelling is the canonical one, and it is what the window rename, the top
-# block, the payload, the object log's lane field and the restart line must all
-# carry; so it is taken ONCE, here, through the resolver `lane-start`,
-# `lane-end`, `lanes` and `restart` share. It is also where an AMBIGUOUS
-# register is refused (15(d), through the fence above) and where a `--lane`
-# that is not a lane NAME at all is refused — both before the rename, so that a
-# refusal leaves the window exactly as it found it.
-#
-# WHAT IT IS NOT IS A CHECK THAT THE LANE HAS A ROW (Copilot round 4 on
-# openRepoTools#47). `canon_lane` answers with the TYPED spelling where no row
-# matches, deliberately — `lane-start` uses the same resolver for a lane it is
-# about to create — so a well-formed `--lane` this register has never carried
-# reaches the writes below and is named there, by the row read that cannot find
-# a handoff and by the row flip that finds no state cell to replace.
-sread lane_canon "'this lane has no row'" canon-lane "$lane"
-if [ -n "$lane_canon" ] && [ "$lane_canon" != "$lane" ]; then
-	step "lane $lane → $lane_canon (Amendment 15: the register row's spelling is canonical)"
-	lane="$lane_canon"
-fi
-case "$lane" in
-*[!A-Za-z0-9._-]* | .* | -* | '')
-	die "'$lane' is not a lane name (letters, digits, . _ -, not opening with . or -). Nothing was renamed and nothing was written: a name the register cannot hold is one every write below would refuse anyway, and the window would already have been renamed to it." 2 ;;
-esac
-step "lane=$lane${window_ref:+ window=$window_ref} workstation=${ws:-<none>}"
-
-# THE SEAM (ruling 2026-10-04): A MANAGED-OWNED LANE IS NOT THIS COMMAND'S.
-# `lanes-edit.sh managed-projection` answers 0 with the owner where the lane's
-# register row carries the managed ledger's marker, 8 for a legacy lane, and 1
-# where ownership could not be established. ANY other status — a helper that
-# predates the verb included — is UNKNOWN as well, and refused the same way:
-# a fence that opens because its read failed is no fence (Amendment 7(d)).
-seam_refuse() {   # <lane> <the act>
-	sr_out=""; sr_rc=0
-	sr_out="$("$LANES_EDIT" managed-projection "$1" 2>/dev/null)" || sr_rc=$?
-	case "$sr_rc" in
-	0) die "lane $1 is owned by the managed ledger (owner ${sr_out:-unnamed}), and $2 is a legacy lane act, refused here, before the window is renamed and before a byte is written: no PAUSED, no row, no handoff file, no lifecycle transition, no inventory, and no restart. Brett Heap's ruling of 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\". Act on this lane through the managed ledger." 2 ;;
-	8) : ;;
-	*) die "whether the managed ledger owns lane $1 is UNKNOWN (\`$LANES_EDIT managed-projection $1\` exited $sr_rc): its register row carries managed-owner vocabulary that does not parse, or the read failed. An ownership nobody could establish is never read as legacy (Amendment 7(d)), so $2 is refused here, before the window is renamed and before a byte is written: no PAUSED, no row, no handoff file, no lifecycle transition, no inventory, and no restart. Read it: $LANES_EDIT managed-projection $1" 1 ;;
-	esac
-}
-# Here, once the lane's canonical name is known and before ANYTHING is done
-# with it: every mode of this command — the handoff, `--late`, `--restart`,
-# `--exit` — is behind this line, so `SWAPPING` and `SWAPPED` never run for a
-# managed lane.
-seam_refuse "$lane" "a handoff"
-
-# A plain preservation writer cannot modify an in-flight restart's input.
-# This read precedes window, row and log writes; publication checks it again
-# under the helper mutex, together with the prior handoff checksum.
-if [ "$do_restart" != 1 ]; then
-  lh_irrc=0
-  lh_intent="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$lane")" || lh_irrc=$?
-  case "$lh_irrc" in
-    0)
-      lh_istate="$(printf '%s\n' "$lh_intent" | awk -F'\t' '$1=="state" {print $2; exit}')"
-      case "$lh_istate" in
-        ready|failed) : ;;
-        *) die "a restart owns this lane, or its intent is malformed; preservation refused before window, handoff, row or log writes. Read it: $prog --restart-status --lane $lane" 2 ;;
-      esac ;;
-    8) : ;;
-    *) die "the legacy restart intent cannot be read; preservation refused before any writes." 2 ;;
-  esac
-fi
-if [ "$do_restart" = 1 ]; then
-  LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$lane" ||
-    die "legacy /ctx restart refused at the managed-lane boundary. Nothing was written or respawned." 2
-fi
-if [ "$do_restart" = 1 ]; then
-  ri_gen=0; ri_prc=0
-  ri_prior="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$lane")" || ri_prc=$?
-  case "$ri_prc" in
-    0) ri_gen="$(printf '%s\n' "$ri_prior" | awk -F'\t' '$1 == "generation" {print $2; exit}')" ;;
-    8) : ;;
-    *) die "the prior legacy intent cannot be read. Nothing was written or respawned." 2 ;;
-  esac
-  case "$ri_gen" in ''|*[!0-9]*) die "the legacy generation is malformed. Nothing was written." 2 ;; esac
-  ri_prev_gen="$ri_gen"; ri_gen=$((ri_gen + 1))
-  operation="ctx-$(date -u +%Y%m%dT%H%M%SZ)-$$-${RANDOM:-0}"
-  restart_prepare_cleanup() {
-    LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$lane" failed \
-      --expect preparing --expect-operation "$operation" --expect-generation "$ri_gen" \
-      --expect-attempt 0 --reason 'preservation stopped before pending; old pane was not respawned' >/dev/null 2>&1 || :
-  }
-  LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$lane" preparing \
-    --expect 'none|ready|failed' --expect-generation "$ri_prev_gen" \
-    --operation "$operation" --generation "$ri_gen" --mode preservation-only \
-    --reason 'reserved before preservation writes' >/dev/null ||
-      die "another restart owns this lane, or its reservation could not be written; an ordinary context clear never supersedes an operation in flight. No handoff, row, log or window was changed. Read it: $prog --restart-status --lane $lane" 2
-  trap restart_prepare_cleanup EXIT
-  trap 'exit 130' INT
-  trap 'exit 143' TERM
-fi
-step "lane=$lane${window_ref:+ window=$window_ref} workstation=${ws:-<none>}"
-
-# THE LIVE RECORD OF THIS WINDOW — the session's uuid, the PANE `--exit` and
-# `--restart` type into, and the name `/rename` may be owed. `window-session`
-# is the one implementation of this read (Amendment 11 clause (h)).
-sess_uuid=""; pane=""; sess_name=""; sess_profile=""
-if [ -n "$win_harness" ]; then
-	ws_ref="$win_harness"
-	if [ -n "$ws_ref" ]; then
-		sread wsess "'no live session is in this window'" window-session "$ws_ref"
-		if [ -n "$wsess" ]; then
-			# `<sid><US><tmux><US><name><US><pid><US><profile>`, the record's own fields.
-			sess_uuid="$(printf '%s' "$wsess" | awk -F'\037' '{print $1}')"
-			pane="$(printf '%s' "$wsess" | awk -F'\037' '{print $2}')"
-			sess_name="$(printf '%s' "$wsess" | awk -F'\037' '{print $3}')"
-			sess_profile="$(printf '%s' "$wsess" | awk -F'\037' '{print $5}')"
-		fi
-	fi
-fi
-# THE SHELL'S OWN SESSION BEATS THE RECORD. The harness exports
-# `CLAUDE_CODE_SESSION_ID` into every shell a session runs, and a session naming
-# itself is the one fact no record can be more current than.
-[ -n "${CLAUDE_CODE_SESSION_ID:-}" ] && sess_uuid="$CLAUDE_CODE_SESSION_ID"
-if [ -n "$sess_name" ] && [ "$sess_name" != "$lane" ] && [ "$sess_name" != none ]; then
-	note "the session in this window is named '$sess_name', not '$lane' — the session name is the lane's messaging address (Amendment 2) and no API renames a running one from outside it. In the session, type:  /rename $lane"
-fi
-
-# The uuid the record's `session` field carries. `write_event` refuses anything
-# that is not a transcript uuid — including the literal `unknown` — so the id is
-# taken from the shell, then from the row, and a lane with neither is named
-# rather than written wrong (Amendment 11 clause (e)).
-uuid="$sess_uuid"
-if [ -z "$uuid" ]; then
-	sread row_uuid "'this lane has no recorded session'" last-session "$lane"
-	uuid="$row_uuid"
-fi
-
-# ---------------------------------------------- Amendment 17(b): the agent
-#
-# A MANIFEST KEY — letters, digits, `.`, `_`, `-` — and the shape check is also
-# how this sub-field gets SPEC rev 6 §5's `; ` rule without a token of its own:
-# the pattern admits neither a `;` nor a space. The writer refuses a bad one
-# too (`lanes-edit.sh`'s `pause_subfields_check`); this is the caller-side half,
-# so the refusal names the flag rather than the grammar.
-[ -n "$agent" ] || agent="${LANES_AGENT:-claude}"
-case "$agent" in
-*[!A-Za-z0-9._-]* | '') die "--agent takes a manifest key — letters, digits, '.', '_', '-' — and '$agent' is not one. The record's \`agent\` sub-field is what \`lane-start --agent\` reads back to know which launcher to use (Amendment 17(b))." 2 ;;
-esac
-# `transcript <id|none>`: the agent's own resumable id where it has one. For
-# `claude` that is this lane's transcript uuid; an agent with none writes
-# `none`, which is an answer and not a gap.
-#
-# IT IS THE RESOLVED `$uuid` AND NOT `$sess_uuid` (Copilot round 1 on
-# openRepoTools#47). Run from a shell with no `CLAUDE_CODE_SESSION_ID` and no
-# live record for this window — `lane-handoff --lane <lane>` from a bare
-# terminal, which is the `--late` case and every scripted one — `$sess_uuid` is
-# empty while `$uuid` has already fallen back to the ROW's recorded session,
-# which is the id `lane-start` resumes this lane by. Writing `transcript none`
-# there records *this agent has no resumable id* about a conversation whose id
-# the same line carries in its `session` field.
-if [ -z "$transcript" ]; then
-	if [ "$agent" = claude ] && [ -n "$uuid" ]; then transcript="$uuid"
-	else transcript=none
-	fi
-fi
-case "$transcript" in
-*[!A-Za-z0-9._-]* | '') die "--transcript takes the agent's own resumable id, or the word 'none' — '$transcript' is neither (Amendment 17(b))." 2 ;;
-esac
-
-# --------------------------------------------- the lane's checkout and profile
-#
-# `dir` IS THE LANE'S CHECKOUT AND NEVER A WORKTREE (`R-A11-11`, Evidence 3):
-# restarting into a worktree loses the repository's CLAUDE.md and the lane's
-# memory. Three sources, every one of them a RECORD rather than a derivation —
-# and a read that FAILED takes no substitute, because a swap typed in one
-# checkout for a lane that lives in another would otherwise record this
-# session's directory as that lane's, in a log nothing rewrites.
-dir="$dir_flag"; dir_read_failed=""
-if [ -z "$dir" ]; then
-	dir_rc=0
-	dir="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-dir "$lane" 2>/dev/null)" || dir_rc=$?
-	case "$dir_rc" in
-	0) : ;;
-	8 | 2) dir="" ;;
-	*) dir=""; dir_read_failed="\`$LANES_EDIT lane-dir $lane\` failed (exit $dir_rc)" ;;
-	esac
-	if [ -z "$dir" ] && [ -z "$dir_read_failed" ]; then
-		dir="${WORKBENCHES_CLAUDE_LANE_DIR:-}"
-		if [ -z "$dir" ] && [ -n "${CLAUDE_CODE_SESSION_ID:-}" ] && [ -n "${CLAUDE_CONFIG_DIR:-}" ] && command -v jq >/dev/null 2>&1; then
-			dir="$(jq -r --arg id "$CLAUDE_CODE_SESSION_ID" \
-				'select((.sessionId // "") == $id) | .cwd // empty' \
-				"$CLAUDE_CONFIG_DIR"/sessions/*.json 2>/dev/null | head -n 1)"
-		fi
-	fi
-fi
-# AN ABSOLUTE PATH OR NOTHING AT ALL: a relative one has no meaning without the
-# writer's cwd, which no reader of this log has.
-case "$dir" in /*) : ;; *) dir="" ;; esac
-[ -n "$dir" ] || note "NO dir sub-field: ${dir_read_failed:-neither the lane log, the launcher nor this session record names the lane checkout}, so the record is written without one (Amendment 11 clause (c))."
-
-profile_name="${CLAUDE_PROFILE_NAME:-$sess_profile}"
-case "$profile_name" in
-*[!A-Za-z0-9._-]* | '') profile_name="" ;;
-esac
-
-# A restart must have a supported, exact checkout before preservation or kill.
-# Ordinary handoffs may still record a missing directory as diagnostics.
-if [ "$do_restart" = 1 ]; then
-  [ "$agent" = claude ] || die "this legacy restart supports only Claude. Nothing was respawned." 2
-  [ -n "$dir" ] && [ -d "$dir" ] && [ -r "$dir" ] && [ -x "$dir" ] ||
-    die "a supervised restart requires an existing absolute checkout directory. Nothing was respawned." 2
-  for restart_fact in "$dir" "${pane:-${TMUX_PANE:-}}" "$window_ref"; do
-    restart_fact_ok "$restart_fact" || die "restart launch facts cannot contain control characters. Nothing was respawned." 2
-  done
-fi
-
-# THE WINDOW IS NOT RENAMED HERE ANY MORE: the refusals between here and the
-# record must leave it as they found it, two of them say so in as many words,
-# and now they do. The rename is section 3a below, after the last of them
-# (opensoft/openRepoTools#80).
-
-# ---------------------------- the LATE record's preconditions, read FIRST
-#
-# BEFORE THE POLL AND BEFORE THE REFRESH, because a refusal must leave the lane
-# exactly as it found it — the handoff file included. Everything this block
-# needs is the lane's own published log, and the rule it enforces is THE LATE
-# RULE at the head of this file: a late `PAUSED` is written only where it can
-# still be the lane's LAST lane-kind line in file order.
-if [ "$do_late" = 1 ]; then
-	[ -n "$late_at" ] || die "--late needs --at <UTC>: a late record is dated by the moment the OLD SESSION ENDED and not by the clock of the shell writing it, and that instant is also what decides whether the line can still be the lane's last one. Pass --at 2026-09-14T12:02:27Z (the time of the last thing that session did)." 2
-	case "$late_at" in
-	[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) : ;;
-	*) die "--at takes a UTC instant spelled as the log spells it, YYYY-MM-DDTHH:MM:SSZ — '$late_at' is not one." 2 ;;
-	esac
-	if [ -n "$ws_missing" ]; then
-		die "the late record cannot be filed under a workstation this command could not read (\`R-A11-14\`), and a late PAUSED is the one line that has no second chance: nothing was written. Export LANES_WORKSTATION and re-run." 2
-	fi
-	# THE LANE'S LAST LANE-KIND LINE, read from the published log exactly as
-	# every state reader reads it: FILE ORDER decides which is last.
-	last_line=""; ll_rc=0
-	last_line="$("$LANES_EDIT" lane-last "$lane" 2>/dev/null)" || ll_rc=$?
-	case "$ll_rc" in
-	0) : ;;
-	8) last_line="" ;;
-	*) die "\`$LANES_EDIT lane-last $lane\` failed (exit $ll_rc). That is NOT 'this lane has no lane-kind line', and a late PAUSED written on an answer nobody got could pause a lane that is running (Amendment 7(d))." 1 ;;
-	esac
-	last_verb="$(printf '%s' "$last_line" | awk -F'\t' '{print $1}')"
-	last_utc="$(printf '%s' "$last_line" | awk -F'\t' '{print $2}')"
-	case "$last_verb" in
-	'')
-		die "lane $lane has no STARTED or RESUMED in its object log, so there is no binding for a late PAUSED to close. A lane that never started is not a lane that failed to swap." 2 ;;
-	PAUSED)
-		die "lane $lane's last lane-kind line is already a PAUSED (at $last_utc): the record this act writes is already there, and a second one records nothing. If that PAUSED is wrong, the log is append-only and no later line corrects it — say so in the handoff instead." 2 ;;
-	ENDED | RETIRED)
-		die "lane $lane's last lane-kind line is $last_verb (at $last_utc): the lane is closed, and a PAUSED after it would reopen a lane nobody is in." 2 ;;
-	esac
-	if ! [ "$last_utc" '<' "$late_at" ]; then
-		die "lane $lane's last lane-kind line is $last_verb at $last_utc, which is AT OR AFTER the $late_at this late record claims: the relaunch is already recorded, and this log is APPEND-ONLY, so a PAUSED appended now would be the lane's last line and would make a lane that is RUNNING read as paused. Nothing was written.
-    The act, in order: run \`$prog --late --at <when the old session ended>\` from a SHELL, and only then start the lane (\`pclaude <profile>\`).
-    Where the relaunch has already happened — which is this case — the honest record of the state that session now holds is its own next \`$prog\`." 2
-	fi
-fi
-
-# ----------------- 2a. RUNNING -> SWAPPING, before any preservation work
-#
-# FIRST OF THE ACTS THAT CHANGE ANYTHING, and deliberately ahead of the poll,
-# the refresh and the record: a session that dies from here on leaves the lane
-# reading `SWAPPING`, which is the word for *the handoff began and did not
-# finish*. Taken any later, the window in which token exhaustion is
-# indistinguishable from an ungraceful stop is exactly the window in which the
-# writers are being polled — the longest part of the act.
-#
-# IT IS BELOW THE `--late` PRECONDITIONS ON PURPOSE. Those refuse and write
-# nothing at all, and a refusal must leave the lane exactly as it found it.
-lifecycle_begin
-
-# ------------------------------------------------ 3. poll the running writers
-#
-# Amendment 17(f): the top block *"LISTS EVERY WRITER THE LANE HAS RUNNING (its
-# worktree, its branch, its brief, what it had committed)"*, and the next
-# session *"RELAUNCHES EVERY WRITER IT LISTS from where each stood"*. A shell
-# cannot message a subagent — that is the skill's step 3, and the one question
-# this act ever asks belongs there — so what a shell CAN do is read every
-# worktree the lane has and report it exactly: `git status --short` and
-# `git log @{u}..`, per worktree, printed here and summarised into the section.
-#
-# TWO PLACES, because the estate uses both: `<checkout>/.claude/worktrees/<name>`
-# for a writer working inside the lane's own repository, and
-# `<projects>/.lane-worktrees/<lane>/<name>` for the ones a lane keeps beside it.
-# AND A THIRD WHERE THE CHECKOUT IS AN ASSEMBLY (T018, below): the paired
-# feature trees `<assembly>/worktrees/<feature>/{spec,code}`.
-#
-# THE SNAPSHOT FILE IS A PRECONDITION, NOT A CONVENIENCE (Copilot round 1 on
-# openRepoTools#47). With no temporary file the count below still rises and
-# every line written to it goes nowhere: the block would then say *WRITERS: 3
-# found* and list none, and a `/ctx` on that block relaunches nothing while
-# telling the next session there were three. A section that cannot be filled is
-# refused here, before the handoff is touched and before the record is written,
-# which is the one point at which nothing has happened yet.
-writers_tmp="$(mktemp "${TMPDIR:-/tmp}/lane-handoff-writers.XXXXXX" 2>/dev/null || printf '')"
-[ -n "$writers_tmp" ] ||
-	die "could not create a temporary file under ${TMPDIR:-/tmp} to snapshot this lane's writers into, and the WRITERS section is what the next session counts against \`ListAgents\` (Amendment 17 Addendum 1 (i)). Nothing was written, nothing was renamed and no pane was touched. Free some space, or set TMPDIR to somewhere writable, and re-run." 2
-cleanup() { [ -n "${writers_tmp:-}" ] && rm -f -- "$writers_tmp"; return 0; }
-trap 'cleanup; if [ "$do_restart" = 1 ]; then restart_prepare_cleanup; fi' EXIT
-trap 'exit 130' INT
-trap 'exit 143' TERM
-
-brief_for() {   # <worktree path>
-	[ -n "$writers_file" ] && [ -r "$writers_file" ] || return 1
-	awk -F'\t' -v p="$1" '$1 == p { sub(/^[^\t]*\t/, ""); print; exit }' "$writers_file"
-}
-
-writer_count=0
-pw_withheld_count=0
-# A TREE WITH A `.git` OF ITS OWN THAT GIT CANNOT READ, IN AN ASSEMBLY (T018,
-# S2 of the review of bf2a220), is NAMED, never passed over. A leg whose
-# module directory (`<assembly>/.git/modules/<leg>`) is damaged takes every
-# worktree of its repository with it: the trees `lane-worktrees add --checkout
-# <assembly>/<leg>` made, and the paired trees this lane's inventory names.
-# Passed over, they vanished from the WRITERS section and from its count while
-# the lane went SWAPPED, as if the poll had looked everywhere it looks. So such
-# a tree is listed and counted as a writer whose state nobody could read, it is
-# NOT recorded (a guessed reading would replace the one its record names), and
-# the lane stays SWAPPING for it. Only `poll_writer` calls this, and only where
-# the checkout is an assembly: a checkout with no `project.yaml` naming a leg
-# passes over such a tree as it always did, which its golden holds.
-unreadable_writer() {   # <tree>
-	uw_d="$1"
-	uw_err="$(git -C "$uw_d" rev-parse --git-dir 2>&1 >/dev/null </dev/null \
-		| awk 'NF { sub(/^[ \t]+/, ""); sub(/[ \t]+$/, ""); print; exit }')"
-	uw_err="${uw_err:-no answer}"
-	uw_brief="$(brief_for "$uw_d" || printf '')"
-	writer_count=$((writer_count + 1))
-	pw_withheld_count=$((pw_withheld_count + 1))
-	say ""
-	say "WRITER $uw_d — UNREADABLE: it has a .git of its own and git could not read it: $uw_err"
-	say "  nothing is assumed about its branch, its commits or its edits, and it is NOT recorded"
-	printf -- '- `%s` (NOT recorded) — UNREADABLE: it has a .git of its own and git could not read it (%s), so nothing is assumed about its branch, its commits or its edits. A read that failed is never a clean tree (Amendment 7(d)) — read it by hand (`git -C %s status`) before relaunching a writer onto it; brief: %s\n' \
-		"$uw_d" "$uw_err" "$uw_d" "${uw_brief:-(fill in: the brief this writer was given)}" >> "$writers_tmp"
-	if [ -n "$lc_on" ]; then
-		lc_inventory_missed="${lc_inventory_missed:+$lc_inventory_missed }$uw_d"
-		note "the worktree inventory entry for $uw_d was NOT written: it has a .git of its own and git could not read it ($uw_err), so neither what it holds nor which checkout it is recorded under is known, and a guessed reading would replace the one its record names now. This handoff's WRITERS section names it, the lane stays SWAPPING for it, and \`$LANES_EDIT lane-reconcile $lane\` says what the inventory holds."
-	else
-		note "the tree $uw_d has a .git of its own and git could not read it ($uw_err), so nothing is assumed about it, and this handoff's WRITERS section names it. Read it by hand (git -C $uw_d status) before relaunching a writer onto it."
-	fi
-	return 0
-}
-poll_writer() {   # <path>
-	pw_d="$1"
-	[ -d "$pw_d" ] || return 0
-	if ! git -C "$pw_d" rev-parse --git-dir >/dev/null 2>&1; then
-		[ -n "$legs_state" ] || return 0
-		{ [ -e "$pw_d/.git" ] || [ -L "$pw_d/.git" ]; } || return 0
-		unreadable_writer "$pw_d"
-		return 0
-	fi
-	# THE OBSERVATION IS THE HELPER'S, AND THIS COMMAND MAKES NONE OF ITS OWN
-	# (Copilot round 5 on openRepoTools#97). `lanes-edit.sh lane-tree-now` is the
-	# one implementation of *what git says about this tree right now* — the same
-	# function `lane-reconcile` recomputes with — so the WRITERS section a person
-	# reads and the sidecar a recovery reads are ONE reading, with one error
-	# handling behind them. The five fields it answers with are the five the
-	# record carries: branch, full head, upstream, dirty and unpushed.
-	#
-	# `%h` IS NOT AMONG THEM, and that is the point of the full head: an
-	# abbreviation lengthens as a repository grows and is ambiguous across
-	# repositories, while the upstream is what tells `0 unpushed` from *this
-	# branch tracks nothing at all*.
-	#
-	# AND A READING NOBODY COULD MAKE IS SAID, NOT INVENTED. Where the helper
-	# refuses — git failing inside a checkout, or a lanes-edit.sh predating this
-	# read, which answers 2 for a subcommand it has never heard of — every field
-	# is `?`, no sidecar is filed, and the section says so. A `none` here and a
-	# `0` there is exactly the clean-looking record this round removed.
-	pw_obs=""; pw_orc=0
-	pw_obs="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-tree-now "$pw_d" 2>/dev/null)" || pw_orc=$?
-	pw_branch='?'; pw_head=unknown; pw_up='?'; pw_dirty='?'; pw_ahead='?'
-	if [ "$pw_orc" = 0 ]; then
-		pw_branch="$(printf '%s' "$pw_obs" | awk -F'\037' '{print $1}')"
-		pw_head="$(printf '%s' "$pw_obs" | awk -F'\037' '{print $2}')"
-		pw_up="$(printf '%s' "$pw_obs" | awk -F'\037' '{print $3}')"
-		pw_dirty="$(printf '%s' "$pw_obs" | awk -F'\037' '{print $4}')"
-		pw_ahead="$(printf '%s' "$pw_obs" | awk -F'\037' '{print $5}')"
-	else
-		note "the observation of $pw_d could not be made (\`$LANES_EDIT lane-tree-now\` exited $pw_orc), so this writer is listed with what could not be read rather than with a clean-looking reading of it, and no inventory entry is filed for it. The lines below are still printed from this checkout, and the swap goes on (\`R-A11-11\`)."
-	fi
-	# The LISTING, which is prose and not the record: the actual lines a person
-	# reads under the counts above. `|| :` and not a failure, for the reason the
-	# note above gives — this is what is left to show when the reading refused.
-	pw_last="$(git -C "$pw_d" log -1 --format='%h %s' 2>/dev/null || :)"
-	pw_status="$(git -C "$pw_d" status --short 2>/dev/null || :)"
-	pw_unpushed="$(git -C "$pw_d" log '@{u}..' --oneline 2>/dev/null || :)"
-	pw_brief="$(brief_for "$pw_d" || printf '')"
-	writer_count=$((writer_count + 1))
-	say ""
-	say "WRITER $pw_d — branch $pw_branch, last commit ${pw_last:-<none>}"
-	say "  git status --short: ${pw_dirty} dirty"
-	[ -n "$pw_status" ] && printf '%s\n' "$pw_status" | sed 's/^/    /'
-	say "  git log @{u}..: ${pw_ahead} unpushed"
-	[ -n "$pw_unpushed" ] && printf '%s\n' "$pw_unpushed" | sed 's/^/    /'
-	# WHERE IT IS RECORDED, decided before its line is written (below), so that a
-	# tree this handoff withholds says so in its own line — `(NOT recorded)` —
-	# rather than reading exactly as a recorded one (N1 of the review of
-	# bf2a220). A checkout with no `project.yaml` naming a leg withholds nothing,
-	# and its line is the one it always was.
-	pw_co=""; pw_withheld=""
-	if [ -n "$lc_on" ] && [ "$pw_orc" = 0 ]; then
-		pw_co="${dir:-unknown}"
-		[ -z "$legs_state" ] || pw_co="$(writer_checkout "$pw_d")"
-		[ -n "$pw_co" ] || pw_withheld=" (NOT recorded)"
-	fi
-	printf -- '- `%s`%s — branch `%s`, last commit `%s`, %s dirty, %s unpushed; brief: %s\n' \
-		"$pw_d" "$pw_withheld" "$pw_branch" "${pw_last:-<none>}" "$pw_dirty" "$pw_ahead" \
-		"${pw_brief:-(fill in: the brief this writer was given)}" >> "$writers_tmp"
-	# AND THE SAME OBSERVATION, MACHINE-READABLE, BESIDE THE LANE AND NOT INSIDE
-	# IT (openRepoTools#91). The WRITERS section above is what a person and the
-	# next session read; this is what `lane-reconcile` recomputes against after
-	# a crash, when there may be no session to read anything. It carries THIS
-	# handoff's generation and operation, so a tree recorded by a superseded
-	# operation is visible as one. It never fails the poll and never fails the
-	# swap: a lane with no control root simply keeps no inventory yet.
-	#
-	# THE CHECKOUT IT IS RECORDED UNDER IS THE LANE'S `dir`, EXCEPT IN AN
-	# ASSEMBLY (T018): there a tree of a leg's repository is recorded under its
-	# LEG, the checkout `lane-worktrees add --checkout <assembly>/code` recorded
-	# and every reader of the inventory enumerates (`writer_checkout`, below).
-	# Where no checkout can be vouched for — the assembly's legs could not be
-	# read, or one of them is unreadable, and the tree is not of the lane's own
-	# repository nor of a leg git could read — NOTHING is filed: a guessed
-	# checkout would replace the one `add` recorded, so the tree is named and
-	# the lane stays SWAPPING for it, as for a refused write.
-	if [ -n "$lc_on" ] && [ "$pw_orc" = 0 ]; then
-		if [ -n "$pw_withheld" ]; then
-			pw_withheld_count=$((pw_withheld_count + 1))
-			lc_inventory_missed="${lc_inventory_missed:+$lc_inventory_missed }$pw_d"
-			if [ "$legs_state" = known ]; then
-				pw_cant="the assembly has $legs_unreadable_count unreadable leg(s), each named by an UNREADABLE LEG line in the top block, so whether this tree is of such a leg's repository"
-			else
-				pw_cant="$dir/project.yaml could not be read, so whether this tree is of one of the assembly's legs"
-			fi
-			note "the worktree inventory entry for $pw_d was NOT written: $pw_cant — and so which checkout it is recorded under — is not known, and a guessed one would replace the checkout its record names now. This handoff's WRITERS section still names the tree, the lane stays SWAPPING for it, and \`$LANES_EDIT lane-reconcile $lane\` says what the inventory holds."
-			return 0
-		fi
-		LANES_NO_FETCH=1 "$LANES_EDIT" set-lane-tree "$lane" "$pw_d" \
-			--checkout "$pw_co" --branch "$pw_branch" --head "$pw_head" \
-			--upstream "$pw_up" --dirty "$pw_dirty" --unpushed "$pw_ahead" \
-			--writer "${uuid:-none}" --generation "$lc_gen" --operation "$lc_op" \
-			>/dev/null 2>&1 || {
-			# AND THE SWAP IS NOT COMPLETE WITHOUT IT (Copilot on 64dfd97, PR
-			# #97): an inventory missing a polled writer is not the record a
-			# recovery reads as a finished swap, so the tree is named here and
-			# `lifecycle_finish` leaves the lane SWAPPING for it.
-			lc_inventory_missed="${lc_inventory_missed:+$lc_inventory_missed }$pw_d"
-			note "the worktree inventory entry for $pw_d could not be written — the helper refused it, and a refusal of 7 there is this handoff's own fence: the lane's generation or operation moved while this poll was being taken, so a superseded reading was not filed over the current one. This handoff's WRITERS section still names the tree, the lane stays SWAPPING for it, and \`$LANES_EDIT lane-reconcile $lane\` says what the inventory holds."
-		}
-	fi
-	return 0
-}
-
-# ------------------------------------------------ 3b. A TRIAD'S LEGS (T018)
-#
-# opensoft/openRepoTools#186, plan task T018. THE LANE'S CHECKOUT IS AN
-# ASSEMBLY when its own `project.yaml` declares a leg other than itself — the
-# standard's rule, read by `lanes-edit.sh project-legs`, the one reader every
-# lane tool asks, never a second grammar here. Its legs (`spec/`, `code/`) are
-# submodules, and a feature's trees are worktrees of the LEGS' repositories, so
-# two things follow, and neither touches a checkout with no `project.yaml`,
-# which is asked nothing and polled and recorded exactly as before:
-#
-#   * THE PAIRED ROOT IS POLLED BY THE SWEEP'S RULE — `<assembly>/worktrees/
-#     <feature>` and `<feature>/<each declared leg's path>`, the standard's
-#     three-leg feature trees. The paired root is per feature and NOT per
-#     lane: every lane the assembly homes keeps its feature trees there. So a
-#     tree there is polled and recorded as THIS lane's writer only where one
-#     of three things holds: this lane's inventory already names it; its
-#     HEAD's own last `Lane:` trailer is this lane's on a commit origin's
-#     default branch lacks (`lane-worktrees`' `own_trailers` and
-#     `head_lane_trailer`, the rule its sweep claims the same root by); or
-#     the writers file names it, because a writer with nothing committed yet
-#     has no trailer to be found by. Every other checkout there is ANOTHER
-#     LANE'S OR NOBODY'S: one informational line in the top block, outside
-#     WRITERS, never counted and never recorded. A handoff that recorded them
-#     all made other lanes' feature trees this lane's inventory, so its
-#     `lane-end` refused on their work, its `sweep --yes` could act on it, and
-#     the next session was told to relaunch writers into them (the pre-PR
-#     review of T018, M1, option (a)). Only a directory with a `.git` of its
-#     own is a checkout there: anything else under it is the assembly's own
-#     working tree, where git answers too.
-#   * A TREE IS RECORDED UNDER THE CHECKOUT IT BELONGS TO. A tree of a leg's
-#     repository — `lane-worktrees add --checkout <assembly>/code` makes one
-#     under the lane's own root, and every paired tree is one — was re-recorded
-#     here with the ASSEMBLY as its checkout, and the leg `add` had recorded
-#     was lost at the first handoff. Its repository's common git directory,
-#     which a leg shares with every worktree of it, names its leg now.
-#
-# A MANIFEST THAT COULD NOT BE READ IS SAID, AND THE SWAP GOES ON
-# (`R-A11-11`): the paired root is then NOT polled, the top block's WRITERS
-# section says so, no tree is recorded under a checkout nobody could establish,
-# and the lane stays SWAPPING — a poll that could not look everywhere is not
-# the record a recovery reads as a finished swap. SO IS A PAIRED ROOT, A
-# FEATURE DIRECTORY OR A LEG'S DIRECTORY UNDER IT THAT COULD NOT BE LISTED, and
-# an inventory that could not be read (`paired_unread`): each is a place a
-# tree of this lane's may stand unseen, exactly as `lane-reconcile` says
-# `indeterminate` and the sweep refuses for the same directories.
-legs_state=""; legs_unread=""; leg_rows=""; leg_commons=""; dir_common=""; dir_phys=""
-paired_unread=""; paired_others=""; paired_other_count=0; paired_inv=""
-tab="$(printf '\t')"
-# THE PHYSICAL PATH OF A CHECKOUT'S COMMON GIT DIRECTORY, or nothing: a leg
-# and every worktree of its repository share one (`<assembly>/.git/modules/
-# <leg>`), and git spells it relative where it is the checkout's own `.git`.
-common_dir_of() {   # <path>
-	cdo_c="$(git -C "$1" rev-parse --git-common-dir 2>/dev/null)" || return 0
-	[ -n "$cdo_c" ] || return 0
-	case "$cdo_c" in /*) : ;; *) cdo_c="$1/$cdo_c" ;; esac
-	( CDPATH=''; cd -P -- "$cdo_c" 2>/dev/null && pwd -P ) || :
-	return 0
-}
-physical_of() {   # <path>
-	( CDPATH=''; cd -P -- "$1" 2>/dev/null && pwd -P ) || :
-	return 0
-}
-if [ -n "$dir" ] && { [ -e "$dir/project.yaml" ] || [ -L "$dir/project.yaml" ]; }; then
-	legs_rc=0
-	leg_rows="$(LANES_NO_FETCH=1 "$LANES_EDIT" project-legs "$dir" 2>/dev/null)" || legs_rc=$?
-	case "$legs_rc" in
-	0) [ -z "$leg_rows" ] || legs_state=known ;;
-	8) leg_rows="" ;;
-	*)
-		leg_rows=""; legs_state=unread
-		legs_unread="the legs of the assembly $dir could not be read (its project.yaml is there, and \`$LANES_EDIT project-legs $dir\` exited $legs_rc)"
-		dir_common="$(common_dir_of "$dir")"
-		note "$legs_unread — which is never 'no legs' (Amendment 7(d)). So the assembly's paired feature trees under $dir/worktrees were NOT polled, and a tree that is not of $dir's own repository is NOT recorded: read them by hand before a writer is relaunched there. The handoff goes on (\`R-A11-11\`), and where it records a lifecycle the lane stays SWAPPING for it." ;;
-	esac
-fi
-# EACH LEG THAT IS CHECKED OUT HERE, BY ITS COMMON GIT DIRECTORY. A leg that is
-# NOT — a submodule never initialized, or deinitialized — is an empty
-# directory of the assembly's, where git answers the ASSEMBLY: its common
-# directory would then be the assembly's own, and every tree of the assembly
-# would be recorded under that leg. So a leg counts only where git's own
-# toplevel there is the leg itself.
-#
-# A LEG WITH A `.git` OF ITS OWN THAT GIT CANNOT READ is no absent leg: it is a
-# read that failed, never an absent or a clean one (Amendment 7(d)). Passed
-# over, it was a leg this handoff said nothing of while the sweep counted it,
-# and every tree of its repository was re-recorded under the assembly, over
-# the leg `add` had recorded. So it is the sweep's rule (`probe_leg`: git's
-# toplevel there is not the leg, and a `.git` stands in it), the sweep's word
-# and `lane-reconcile`'s: `unreadable`, one `- UNREADABLE LEG` line a leg in the
-# top block's WRITERS section and a note on stderr, and COUNTED
-# (`legs_unreadable_count`). The lifecycle is NOT left SWAPPING for the leg
-# itself, as the reconciliation's verdict is not `indeterminate` for it: the
-# poll looked everywhere it looks. A tree this handoff then cannot place is
-# another matter (`writer_checkout`): it is named, not recorded, and the lane
-# stays SWAPPING for it, as for any tree no checkout can be vouched for.
-#
-# SO IS A LEG DIRECTORY THIS ACCOUNT CANNOT SEARCH (#255, openRepoShape-2's
-# SHOULD on #246): whether a `.git` stands in it cannot be tested, and the
-# `.git` test fails there exactly as for a leg that is not checked out, so
-# the leg was passed over IN SILENCE while an unpushed commit of this lane's
-# could be in it. It takes the same path, in the same words as the sweep's
-# `probe_leg` and `lane-reconcile`. A leg directory that is not there at all
-# is still passed over (`-d`), as a leg that is not checked out.
-legs_unreadable=""; legs_unreadable_count=0
-if [ "$legs_state" = known ]; then
-	while IFS="$tab" read -r lg_repo lg_decl lg_abs; do
-		[ -n "$lg_abs" ] && [ -d "$lg_abs" ] || continue
-		lg_top="$(git -C "$lg_abs" rev-parse --show-toplevel 2>/dev/null </dev/null || :)"
-		if [ -z "$lg_top" ] || [ "$(physical_of "$lg_top")" != "$(physical_of "$lg_abs")" ]; then
-			if [ -e "$lg_abs/.git" ] || [ -L "$lg_abs/.git" ]; then
-				lg_what="it has a .git of its own and git could not read it"
-			elif [ ! -x "$lg_abs" ]; then
-				lg_what="its directory cannot be searched, so whether it has a .git of its own could not be tested, and git could not read it"
-			else
-				continue
-			fi
-			if [ -n "$lg_top" ]; then
-				lg_err="git answers $lg_top there"
-			else
-				lg_err="$(git -C "$lg_abs" rev-parse --show-toplevel 2>&1 >/dev/null </dev/null \
-					| awk 'NF { sub(/^[ \t]+/, ""); sub(/[ \t]+$/, ""); print; exit }')"
-				lg_err="${lg_err:-no answer}"
-			fi
-			lg_why="the $lg_decl leg of $dir/project.yaml${lg_repo:+ ($lg_repo)}: git could not be read through it ($lg_what: $lg_err)"
-			legs_unreadable_count=$((legs_unreadable_count + 1))
-			# `<leg> TAB <why>`, one a line: the top block writes each leg's line
-			# once the poll has said whether any tree was withheld (N1), and
-			# `writer_checkout` asks whether a record names one of these legs.
-			legs_unreadable="$legs_unreadable$lg_abs$tab$lg_why
-"
-			# WHAT IS STILL VOUCHED FOR, AND WHAT COULD BE A LEG'S (`writer_checkout`).
-			[ -n "$dir_common" ] || dir_common="$(common_dir_of "$dir" </dev/null)"
-			[ -n "$dir_phys" ] || dir_phys="$(physical_of "$dir" </dev/null)"
-			note "the leg $lg_abs is unreadable: $lg_why — a read that failed is never a clean leg (Amendment 7(d)), so nothing is assumed about it or about which tree is of its repository, and the top block's WRITERS section names it. Read it by hand (git -C $lg_abs status) before relaunching a writer onto a tree of its repository."
-			continue
-		fi
-		lg_c="$(common_dir_of "$lg_abs" </dev/null)"
-		[ -n "$lg_c" ] || continue
-		leg_commons="$leg_commons$lg_c$tab$lg_abs
-"
-	done <<LEG_ROWS
-$leg_rows
-LEG_ROWS
-fi
-# A PLACE THE POLL COULD NOT LOOK, said where it is found and kept for the top
-# block's `- NOT POLLED` line and the lifecycle.
-paired_note_unread() {   # <why>
-	paired_unread="${paired_unread:+$paired_unread; }$1"
-	note "$1 — a read that failed is never an empty one (Amendment 7(d)). So a tree of this lane's there may be missing from the WRITERS section: read it by hand before a writer is relaunched there. The handoff goes on (\`R-A11-11\`), and where it records a lifecycle the lane stays SWAPPING for it."
-}
-# THIS LANE'S INVENTORY, READ ONCE, where the checkout is an assembly whose legs
-# were read: which paired trees are already this lane's, and the checkout each
-# recorded tree was filed under (`writer_checkout`). `<path> TAB <checkout>`, one
-# a line. A checkout with no `project.yaml` never asks it.
-#
-# A ROW IS A RECORD ONLY WHERE IT IS A WHOLE SCHEMA-1 ONE (#255): its schema,
-# `lane-trees`' thirteenth field, is `1` - the schema `lane-worktrees` reads too
-# (`_discover`). Every other row keeps no field but its id, its path where the
-# file named one, and its schema (`<none>`, an unknown one, `<unreadable>`, and
-# #252's `<malformed>`), so it is no record of whose a tree is: read as one, it
-# made the paired tree it names this lane's writer on the strength of a record
-# nobody could read, and the poll then tried to file a record of its own for
-# that tree - over a malformed one, which went SWAPPED in silence, or against
-# one of another schema, which `set-lane-tree` refuses and this handoff then
-# reported as a refused write. So such a row is NAMED, by its id, its schema and
-# any path it keeps, and the lane stays SWAPPING for it, exactly as for an
-# inventory that could not be read at all; it never reaches `paired_inv`.
-if [ "$legs_state" = known ]; then
-	pi_out=""; pi_rc=0
-	pi_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-trees "$lane" 2>/dev/null </dev/null)" || pi_rc=$?
-	case "$pi_rc" in
-	0)
-		paired_inv="$(printf '%s\n' "$pi_out" | awk -F'\037' 'NF >= 2 && $2 != "" && $13 == "1" { print $2 "\t" $10 }')"
-		pi_bad="$(printf '%s\n' "$pi_out" | awk -F'\037' 'NF >= 2 && ($2 == "" || $13 != "1") {
-			printf "%s%s (schema %s%s)", (n++ ? ", " : ""), $1, ($13 == "" ? "<none>" : $13), ($2 == "" ? "" : ", path " $2) }')"
-		[ -z "$pi_bad" ] ||
-			paired_note_unread "this lane's worktree inventory holds record(s) that could not be read ($pi_bad), so a paired tree only they name could not be told from another lane's" ;;
-	8) : ;;
-	*) paired_note_unread "this lane's worktree inventory could not be read (\`$LANES_EDIT lane-trees $lane\` exited $pi_rc), so a paired tree only it names could not be told from another lane's" ;;
-	esac
-fi
-# THE CHECKOUT THIS LANE'S INVENTORY RECORDS FOR A TREE, under either spelling
-# of the tree's path, or nothing.
-inventory_checkout() {   # <tree>
-	[ -n "$paired_inv" ] || return 1
-	ic_r="$(physical_of "$1")"
-	IC_P="$1" IC_R="$ic_r" awk -F'\t' '
-		$1 == ENVIRON["IC_P"] || (ENVIRON["IC_R"] != "" && $1 == ENVIRON["IC_R"]) { print $2; f = 1; exit }
-		END { exit f ? 0 : 1 }' <<IC_ROWS
-$paired_inv
-IC_ROWS
-}
-# THE CHECKOUT A POLLED TREE IS RECORDED UNDER, in an assembly: the leg whose
-# repository it is a worktree of; else the checkout this lane's inventory
-# already records for it, where that is a checkout of the tree's own
-# repository — a dependency nested in a leg (`add --checkout
-# <assembly>/code/upstream/<dep>`) is no declared leg, and re-recording its
-# tree under the assembly would lose the checkout `add` recorded; else the
-# lane's own `dir`, as always. Where the legs could not be read, only a tree
-# of `dir`'s own repository can be vouched for, and anything else answers
-# NOTHING (the caller files nothing).
-#
-# AND WHERE A LEG IS UNREADABLE (`legs_unreadable_count`), NOTHING IS ANSWERED
-# FOR A TREE THAT COULD BE OF THAT LEG'S REPOSITORY, whose common directory
-# nobody could read: the lane's `dir` would then replace the leg `add`
-# recorded. Such a tree is one whose common git directory nobody could read;
-# or one whose common git directory lies physically inside the assembly, or
-# inside the assembly's own git directory, without being the assembly's own
-# (`<assembly>/.git/modules/<leg>`, a leg's own `.git`, or a linked worktree's
-# `modules/` under the common directory); or one this lane's inventory records
-# under an unreadable leg, or under a checkout inside one. A tree of ANY OTHER
-# repository (a worktree of an unrelated repository in the lane's own root)
-# is of no leg, so it keeps the lane's `dir`, exactly as where every leg reads
-# (S1 of the review of bf2a220): withheld, it left the lane SWAPPING on every
-# handoff and its record going stale for as long as the leg stayed broken.
-recorded_under_unreadable_leg() {   # <checkout a record names>
-	ru_p="$(physical_of "$1")"
-	while IFS="$tab" read -r ru_abs ru_why; do
-		[ -n "$ru_abs" ] || continue
-		case "$1/" in "$ru_abs"/*) return 0 ;; esac
-		ru_lp="$(physical_of "$ru_abs" </dev/null)"
-		if [ -n "$ru_p" ] && [ -n "$ru_lp" ]; then
-			case "$ru_p/" in "$ru_lp"/*) return 0 ;; esac
-		fi
-	done <<RU_ROWS
-$legs_unreadable
-RU_ROWS
-	return 1
-}
-writer_checkout() {   # <tree>
-	wc_c="$(common_dir_of "$1")"
-	if [ -n "$wc_c" ] && [ -n "$leg_commons" ]; then
-		while IFS="$tab" read -r wc_l wc_p; do
-			if [ -n "$wc_l" ] && [ "$wc_l" = "$wc_c" ]; then printf '%s' "$wc_p"; return 0; fi
-		done <<WC_ROWS
-$leg_commons
-WC_ROWS
-	fi
-	if [ "$legs_state" = known ]; then
-		wc_rec="$(inventory_checkout "$1" </dev/null || :)"
-		if [ -n "$wc_c" ] && [ -n "$wc_rec" ] && [ -d "$wc_rec" ] &&
-		   [ "$(common_dir_of "$wc_rec" </dev/null)" = "$wc_c" ]; then
-			printf '%s' "$wc_rec"; return 0
-		fi
-		if [ "$legs_unreadable_count" -gt 0 ]; then
-			if [ -n "$wc_c" ] && [ -n "$dir_common" ] && [ "$wc_c" = "$dir_common" ]; then
-				printf '%s' "$dir"; return 0
-			fi
-			[ -n "$wc_c" ] && [ -n "$dir_phys" ] || return 0
-			case "$wc_c/" in "$dir_phys"/*) return 0 ;; esac
-			if [ -n "$dir_common" ]; then
-				case "$wc_c/" in "$dir_common"/*) return 0 ;; esac
-			fi
-			if [ -n "$wc_rec" ] && recorded_under_unreadable_leg "$wc_rec" </dev/null; then return 0; fi
-		fi
-		printf '%s' "${dir:-unknown}"; return 0
-	fi
-	if [ -n "$wc_c" ] && [ -n "$dir_common" ] && [ "$wc_c" = "$dir_common" ]; then printf '%s' "$dir"; fi
-	return 0
-}
-
-# WHOSE A PAIRED TREE IS (M1 (a) of the T018 pre-PR review). Three answers make
-# it this lane's, cheapest first; anything else is another lane's or nobody's.
-#
-# THE WRITERS FILE, read exactly as `brief_for` reads it: a line whose first
-# field is the tree.
-writers_name() {   # <tree>
-	[ -n "$writers_file" ] && [ -r "$writers_file" ] || return 1
-	awk -F'\t' -v p="$1" '$1 == p { f = 1; exit } END { exit f ? 0 : 1 }' "$writers_file"
-}
-# EVERY `Lane:` TRAILER of the messages on stdin, one a line, as
-# `lane-worktrees` reads them (`^Lane:\s*(\S+)\s*$`, multi-line).
-lane_trailers() {
-	awk '/^Lane:[[:space:]]*[^[:space:]]+[[:space:]]*$/ {
-		v = $0; sub(/^Lane:[[:space:]]*/, "", v); sub(/[[:space:]]+$/, "", v); print v }'
-}
-# THE SWEEP'S OWN CLAIM ON THE PAIRED ROOT (`lane-worktrees`' `_lane_claims`,
-# with `own_trailers` and `head_lane_trailer`): HEAD's own last `Lane:`
-# trailer is this lane's, and this lane's trailer is among the commits HEAD has
-# that origin's default branch lacks — `origin/HEAD`, else `origin/main`; with
-# neither there is no base to tell them by, and no claim. Compared without
-# case, as the sweep compares. A standalone CLONE is never claimed by its
-# trailer, as the sweep never adopts one.
-head_trailer_is_lane() {   # <tree>
-	[ -d "$1/.git" ] && return 1
-	ht_base="$(git -C "$1" symbolic-ref -q refs/remotes/origin/HEAD 2>/dev/null || :)"
-	if [ -z "$ht_base" ] && git -C "$1" rev-parse -q --verify refs/remotes/origin/main >/dev/null 2>&1; then
-		ht_base=refs/remotes/origin/main
-	fi
-	[ -n "$ht_base" ] || return 1
-	ht_want="$(printf '%s' "$lane" | tr '[:upper:]' '[:lower:]')"
-	ht_head="$(git -C "$1" log -1 --format=%B HEAD 2>/dev/null | lane_trailers | tail -n 1 | tr '[:upper:]' '[:lower:]')"
-	[ -n "$ht_head" ] && [ "$ht_head" = "$ht_want" ] || return 1
-	git -C "$1" log --format=%B "$ht_base..HEAD" 2>/dev/null | lane_trailers | tr '[:upper:]' '[:lower:]' |
-		HT_W="$ht_want" awk '$0 == ENVIRON["HT_W"] { f = 1 } END { exit f ? 0 : 1 }'
-}
-# ONE CHECKOUT OF THE PAIRED ROOT: polled and recorded as this lane's writer,
-# or named once as not this lane's — its branch, its last commit and its HEAD's
-# own trailer, which is what a person needs to find its lane — and never
-# counted, recorded or offered for a relaunch.
-paired_tree() {   # <tree>
-	if inventory_checkout "$1" >/dev/null || writers_name "$1" || head_trailer_is_lane "$1"; then
-		poll_writer "$1"
-		return 0
-	fi
-	pt_branch="$(git -C "$1" symbolic-ref -q --short HEAD 2>/dev/null)"; pt_brc=$?
-	case "$pt_brc" in 0) : ;; 1) pt_branch='(detached)' ;; *) pt_branch='?' ;; esac
-	pt_last="$(git -C "$1" log -1 --format='%h %s' 2>/dev/null || :)"
-	pt_trailer="$(git -C "$1" log -1 --format=%B HEAD 2>/dev/null | lane_trailers | tail -n 1)"
-	pt_shown=none
-	[ -z "$pt_trailer" ] || pt_shown="\`$pt_trailer\`"
-	paired_other_count=$((paired_other_count + 1))
-	say ""
-	say "PAIRED ROOT, not this lane's: $1 — branch $pt_branch, last commit ${pt_last:-<none>}"
-	say "  HEAD's own Lane: trailer ${pt_trailer:-none}; neither lane $lane's inventory nor its writers file names it, so it is not polled, counted or recorded for $lane"
-	paired_others="$paired_others$(printf -- '- PAIRED ROOT, not this lane'"'"'s: `%s` — branch `%s`, last commit `%s`, HEAD'"'"'s own `Lane:` trailer %s' \
-		"$1" "$pt_branch" "${pt_last:-<none>}" "$pt_shown")
-"
-	return 0
-}
-
-: > "$writers_tmp"
-if [ -n "$dir" ]; then
-	for w in "$dir"/.claude/worktrees/*; do poll_writer "$w"; done
-	parent="${dir%/*}"
-	for w in "$parent"/.lane-worktrees/"$lane"/*; do poll_writer "$w"; done
-	# THE PAIRED ROOT, where the checkout is an assembly whose legs were read.
-	# `</dev/null` on every poll inside the loop: its rows are the loop's
-	# stdin, and nothing the poll runs may take them. A directory there that
-	# cannot be listed is said, as `lane-reconcile` says it (`indeterminate`)
-	# and the sweep refuses on it — never passed over as an empty one.
-	if [ "$legs_state" = known ]; then
-		pr_root="$dir/worktrees"
-		if [ -d "$pr_root" ] && { [ ! -r "$pr_root" ] || [ ! -x "$pr_root" ]; }; then
-			paired_note_unread "the assembly's paired root $pr_root could not be listed"
-		else
-			for wf in "$pr_root"/*; do
-				[ -d "$wf" ] && [ ! -L "$wf" ] || continue
-				if [ ! -r "$wf" ] || [ ! -x "$wf" ]; then
-					paired_note_unread "the assembly's feature directory $wf could not be listed"
-					continue
-				fi
-				if [ -e "$wf/.git" ] || [ -L "$wf/.git" ]; then paired_tree "$wf" </dev/null; fi
-				while IFS="$tab" read -r lg_repo lg_decl lg_abs; do
-					case "$lg_decl" in ''|/*) continue ;; esac
-					wl="$wf/${lg_decl#./}"
-					[ -d "$wl" ] && [ ! -L "$wl" ] || continue
-					if [ ! -x "$wl" ]; then
-						paired_note_unread "the assembly's paired tree directory $wl could not be searched" </dev/null
-						continue
-					fi
-					if [ -e "$wl/.git" ] || [ -L "$wl/.git" ]; then paired_tree "$wl" </dev/null; fi
-				done <<LEG_ROWS
-$leg_rows
-LEG_ROWS
-			done
-		fi
-	fi
-fi
-step "writers polled: $writer_count under ${dir:-<no recorded checkout>}"
-[ "$legs_unreadable_count" = 0 ] ||
-	step "legs: $legs_unreadable_count of the assembly's legs under $dir unreadable — named in the top block's WRITERS section, never a clean leg"
-[ "$paired_other_count" = 0 ] ||
-	step "paired root: $paired_other_count tree(s) under $dir/worktrees are not lane $lane's — listed in the top block, never counted or recorded"
-
-# ------------------------------------------------------ 2. refresh the handoff
-#
-# The handoff path is the row's SIXTH column: awk field 7, because `$1` is the
-# empty string before the leading pipe — `lanes-edit.sh`'s own `row_cell` /
-# `handoff_of_lane` convention. NEVER count back from `NF`: a lane's row carries
-# every state line to the RIGHT of the handoff column, so `$(NF-2)` lands on the
-# empty string and the commit below would `git add ""` — silently, in the one
-# step Amendment 6(e) exists for.
-sread row "'this lane has no row'" register-row "$lane"
-row_line="$(printf '%s\n' "$row" | grep '^|' | tail -n 1)"
-handoff_cell="$(printf '%s' "$row_line" | awk -F'|' '{print $7}' | awk '{$1=$1};1')"
-
-handoff_file=""
-if [ -n "$handoff_cell" ]; then
-	case "$handoff_cell" in
-	'~/'*) [ -f "$HOME/${handoff_cell#'~/'}" ] && handoff_file="$HOME/${handoff_cell#'~/'}" ;;
-	/*) [ -f "$handoff_cell" ] && handoff_file="$handoff_cell" ;;
-	*)
-		# THE WORKSPACE REPOSITORY, THROUGH THE HELPER'S OWN RESOLVER and never
-		# through a second reading of `workspace.yaml` — Amendment 9(a) is
-		# explicit that a second way to find one thing is a second answer.
-		hs_root="$("$LANES_EDIT" workspace-root 2>/dev/null || :)"
-		for hs_base in "${LANES_REPO:-}" "$hs_root"; do
-			[ -n "$hs_base" ] || continue
-			if [ -f "$hs_base/$handoff_cell" ]; then handoff_file="$hs_base/$handoff_cell"; break; fi
-		done ;;
-	esac
-fi
-
-# THE FRESH RULE 3 TOP BLOCK. It is PREPENDED and the file is never rewritten:
-# a handoff is the one document in this protocol whose whole purpose is to be
-# read by a later session, and the act that deleted two lanes' rows on
-# 2026-09-08 was a file written whole out of what somebody remembered of it.
-# Everything that was in the file stays below the marker, as history.
-#
-# LINE 1 AND THE BLANK AFTER IT ARE STRUCTURAL: `lane-start` splices its Rule 3
-# stamp at *"the line immediately after the first blank line that follows line
-# 1"*, so a top block that does not open that way is a block the RESUMED stamps
-# land in the middle of.
-top_block() {
-	printf 'Lane: %s (%s, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' \
-		"$lane" "${profile_name:-profile unknown}" "${uuid:-unknown}"
-	printf '\n'
-	printf '## RESUME PROMPT — PAUSED %s (%s), agent %s, transcript %s, kind %s — %s\n\n' \
-		"$UTC" "${why:-handoff}" "$agent" "$transcript" "$handoff_kind" "$kind_headline"
-	printf '**FIRST ACTS, in order.** (1) You are lane `%s`%s%s. Stamp this block RESUMED before anything else (Rule 3, single use) — `lane-start --no-launch <repo> <n>` in this window writes it. (2) Read AGENTS.md, then this block. (3) COUNT THE LIVE WRITERS before relaunching anything — the WRITERS section below is a list to COUNT, not a list to relaunch (Amendment 17 Addendum 1 (i)). ONE WORKTREE, ONE WRITER (k): a worktree is one writer'"'"'s for as long as that writer is live, a relaunch onto a live writer'"'"'s worktree is the writers'"'"' form of Amendment 18(h)'"'"'s second binding, and where you find one made you retire the newer before either commits. %s Older sections below are history.\n\n' \
-		"$lane" "${window_ref:+ in tmux window \`$window_ref\`}" "${dir:+, checkout \`$dir\`}" "$kind_act"
-	printf '**STATE at %s.** Handed off by `%s` on %s: %s. Agent `%s`, transcript `%s`. Kind `%s`: %s.%s\n\n' \
-		"$UTC" "$prog" "${ws:-<no workstation>}" "${why:-no why given}" "$agent" "$transcript" \
-		"$handoff_kind" "$kind_state" \
-		"${ws_missing:+ THE REGISTER AND OBJECT-LOG WRITES WERE NOT MADE: this session ran with no configured workstation, so the row still reads as it did and the register is BEHIND this file (\`R-A11-14\`). The next session binds with \`lane-start --no-launch\`.}"
-	printf '**WRITERS at %s** (%s found under `%s`) — FIRST count the live writers: `ListAgents` in Claude, the agent'"'"'s equivalent elsewhere. A writer still live OWNS its worktree: do not relaunch it; one message telling it that its in-flight call died and who the coordinator now is, is enough. Relaunch only a writer that is NOT live, from where it stands — `git status` and `git log @{u}..` in its worktree, then its brief. WHERE THE COUNT AND THIS LIST DISAGREE, THE COUNT WINS: this list is what the paused session expected, the count is what is true.\n\n' \
-		"$UTC" "$writer_count" "${dir:-<no recorded checkout>}"
-	if [ "$writer_count" = 0 ]; then
-		printf -- '- none running at the handoff. A writer this lane starts later is listed by the next refresh.\n'
-	else
-		cat -- "$writers_tmp"
-	fi
-	# T018: A POLL THAT COULD NOT LOOK EVERYWHERE SAYS SO HERE, where the next
-	# session reads it — never only on a stderr nobody kept.
-	if [ -n "$legs_unread" ]; then
-		printf -- '- NOT POLLED: %s, so the assembly'"'"'s paired feature trees under `%s/worktrees` are not in this list. Read them by hand before relaunching a writer there.\n' \
-			"$legs_unread" "$dir"
-	fi
-	if [ -n "$paired_unread" ]; then
-		printf -- '- NOT POLLED: %s, so a tree of this lane'"'"'s under `%s/worktrees` may be missing from this list. Read it by hand before relaunching a writer there.\n' \
-			"$paired_unread" "$dir"
-	fi
-	# AND A LEG GIT COULD NOT READ, one line a leg, in the sweep's words. Its
-	# last clause says what the poll then withheld, and only that (N1 of the
-	# review of bf2a220): the trees it could not place are each marked
-	# `(NOT recorded)` above, and where there are none the line says so.
-	if [ -n "$legs_unreadable" ]; then
-		if [ "$pw_withheld_count" -gt 0 ]; then
-			tb_placed="the $pw_withheld_count tree(s) this handoff could not place are named above, each marked (NOT recorded)"
-		else
-			tb_placed="every tree this handoff polled could still be placed, so none is withheld for it"
-		fi
-		while IFS="$tab" read -r tb_abs tb_why; do
-			[ -n "$tb_abs" ] || continue
-			printf -- '- UNREADABLE LEG: `%s` is unreadable, %s. So NOTHING is assumed about it — not its own state, nor which tree is of its repository: %s. A read that failed is never a clean leg (Amendment 7(d)) — read it by hand (`git -C %s status`) before relaunching a writer onto a tree of its repository.\n' \
-				"$tb_abs" "$tb_why" "$tb_placed" "$tb_abs"
-		done <<TB_ROWS
-$legs_unreadable
-TB_ROWS
-	fi
-	printf '\n'
-	# T018, M1 (a): THE PAIRED ROOT'S OTHER TREES, OUTSIDE WRITERS. They are
-	# other lanes' feature trees, or nobody's: named so the next session knows
-	# they are there and whose to ask, never counted above, never recorded, and
-	# never a writer to relaunch. Nothing is printed where there are none, so
-	# a checkout with no `project.yaml` gets the block it always got.
-	if [ -n "$paired_others" ]; then
-		printf '**PAIRED ROOT at %s: %s tree(s) under `%s/worktrees` that are NOT this lane'"'"'s.** None is in this lane'"'"'s inventory, carries its `Lane:` trailer on a commit origin'"'"'s default branch lacks, or is named by its writers file, so none is counted above or recorded. Each is another lane'"'"'s feature tree, or nobody'"'"'s: NEVER relaunch a writer into one of them.\n\n' \
-			"$UTC" "$paired_other_count" "$dir"
-		printf '%s\n' "$paired_others"
-	fi
-}
-
-handoff_written=0
-if [ -z "$handoff_file" ]; then
-	note "the row names no handoff this command could find${handoff_cell:+ ('$handoff_cell')}, so the top block was NOT written. The record below is still written; put this block at the head of the lane's handoff by hand:"
-	top_block >&2
-else
-	hs_tmpd="$(mktemp -d 2>/dev/null || printf '')"
-	if [ -z "$hs_tmpd" ]; then
-		note "could not create a temporary directory, so the handoff was not refreshed: $handoff_file"
-	else
-		hs_prior_digest="$(handoff_digest "$handoff_file")"
-		{ top_block
-		  printf -- '---\n\n'
-		  cat -- "$handoff_file"
-		} > "$hs_tmpd/out"
-		# PROVED BEFORE IT LANDS: taking the new block back out again must give
-		# the original file byte for byte. That is also what catches a file whose
-		# last line has no newline.
-		hs_added="$(( $(grep -c '' "$hs_tmpd/out") - $(grep -c '' "$handoff_file") ))"
-		if tail -n +$((hs_added + 1)) -- "$hs_tmpd/out" | cmp -s - "$handoff_file"; then
-			# THE FLAG FOLLOWS THE WRITE AND NEVER THE INTENTION (Copilot round 1 on
-			# openRepoTools#47). A handoff file that is read-only, or on a filesystem
-			# that is full, fails HERE — and `handoff_written=1` set regardless is
-			# what lets `--restart` pass its gate and respawn the pane over a STALE
-			# top block, which is the one document the new session is started with.
-			hs_publish_args=(publish-handoff "$lane" "$handoff_file" "$hs_tmpd/out" --expect-digest "$hs_prior_digest")
-			if [ "$do_restart" = 1 ]; then
-				# Bind preservation publication to this operation before replacing
-				# any canonical bytes; the helper verifies file identity under lock.
-				LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$lane" preparing \
-				  --expect preparing --expect-operation "$operation" --expect-generation "$ri_gen" --expect-attempt 0 \
-				  --handoff "$handoff_file" --digest "$hs_prior_digest" >/dev/null ||
-				  { rm -rf -- "$hs_tmpd"; die "the preservation handoff could not be bound to this restart. Nothing was published or respawned." 2; }
-				hs_publish_args+=(--operation "$operation" --generation "$ri_gen" --attempt 0 --state preparing --transcript none)
-			fi
-			if hs_published="$(LANES_NO_FETCH=1 "$LANES_EDIT" "${hs_publish_args[@]}")"; then
-				handoff_file="$hs_published"
-				handoff_written=1
-				step "handoff refreshed: $handoff_file (+$hs_added lines at the head)"
-			else
-				note "the refreshed top block could NOT be written to $handoff_file (the error above is the shell's own), so that file still carries the block it had. It is printed below; put it at the head of that file by hand:"
-				top_block >&2
-			fi
-		else
-			note "the splice of the new top block into $handoff_file did not prove out (the old file must survive it byte for byte), so NOTHING was written to it."
-			top_block >&2
-		fi
-		rm -rf -- "$hs_tmpd"
-	fi
-fi
-
-# The commit is in the LANE'S OWN workspace repository and is not one of the
-# writes a missing workstation stops (A11 Addendum 4 ruling 11): it is where the
-# gap is NAMED. One commit, an explicit pathspec and the Rule 5 trailer.
-if [ "$handoff_written" = 1 ] && [ "${LANES_NO_GIT:-0}" != 1 ]; then
-	# THE PARENT IS RESOLVED WITH `cd -P`, NOT `readlink -f` (Copilot round 3 on
-	# openRepoTools#47, the same rule as `lane-start`'s `real_of`). Where
-	# `readlink -f` is not in the userland the fallback hands the path back
-	# UNRESOLVED, so `hs_repo` — which git answers with a PHYSICAL path — and
-	# `hs_rel`, derived from the symlinked spelling, disagree: `git add` then
-	# refuses a pathspec that "leaves the repository", and the handoff this act
-	# has just written is left uncommitted. A handoff is reached through the
-	# estate's `handoffs` symlink on every workstation that has one.
-	hs_dirreal="$( CDPATH=''; cd -P -- "$(dirname -- "$handoff_file")" 2>/dev/null && pwd -P )" ||
-		hs_dirreal="$(dirname -- "$handoff_file")"
-	hs_real="$hs_dirreal/$(basename -- "$handoff_file")"
-	hs_repo="$(git -C "$(dirname -- "$hs_real")" rev-parse --show-toplevel 2>/dev/null || :)"
-	if [ -n "$hs_repo" ]; then
-		hs_rel="${hs_real#"$hs_repo"/}"
-		if git -C "$hs_repo" add -- "$hs_rel" >/dev/null 2>&1 &&
-		   git -C "$hs_repo" commit -q -m "handoff($lane@${ws:-unknown}): PAUSED, ${why:-handoff}" -m "Lane: $lane" -- "$hs_rel" >/dev/null 2>&1; then
-			step "handoff commit: handoff($lane@${ws:-unknown}): PAUSED"
-			if git -C "$hs_repo" pull --rebase -q origin "${LANES_BRANCH:-main}" >/dev/null 2>&1 &&
-			   git -C "$hs_repo" push -q origin "${LANES_BRANCH:-main}" >/dev/null 2>&1; then
-				step "handoff pushed to origin/${LANES_BRANCH:-main}"
-			else
-				git -C "$hs_repo" rebase --abort >/dev/null 2>&1 || :
-				note "the handoff is committed here and was NOT pushed (a conflict, or no reachable origin). Never force; look first, then push:
-    git -C $hs_repo fetch origin ${LANES_BRANCH:-main} && git -C $hs_repo log --oneline origin/${LANES_BRANCH:-main} -3
-    git -C $hs_repo pull --rebase origin ${LANES_BRANCH:-main} && git -C $hs_repo push origin ${LANES_BRANCH:-main}"
-			fi
-		else
-			note "the handoff is written and NOT committed — an uncommitted write is captured by the next lane's commit and its attribution is lost (Amendment 4(d)). Commit it yourself:
-    git -C $hs_repo commit -m \"handoff($lane@${ws:-unknown}): PAUSED\" -m \"Lane: $lane\" -- $hs_rel"
-		fi
-	fi
-fi
-
-# ------------------------- 3a. the window takes the lane's name, and only now
-#
-# THE OTHER TWO NAMES MADE TO MATCH IT, mechanically. The window is renamed
-# here; the SESSION's name is the lane's messaging address (Amendment 2) and
-# there is no API to rename a running session from outside it, so where the
-# live record's name is not the lane the act is PRINTED, beside the read of
-# that record above — it is the operator's `/rename`, and it is not a question.
-#
-# AFTER THE LAST REFUSAL AND BEFORE THE FIRST RECORD (opensoft/openRepoTools#80
-# items 2 and 11, Copilot's review of workBenches#91 at `lane-handoff:519`). The
-# rename used to run before the `--late` preconditions, the writers' snapshot
-# file, the row read and the `--restart` binding — every one of them a refusal,
-# two of them saying that nothing was renamed — so a refused handoff left the
-# window carrying the name of a lane it had not handed off. And its failure was
-# swallowed: the `&&` gated only the message, and the PAUSED record, the row and
-# the restart line went on as if the window were the lane's, which is how the
-# next handoff from that window binds the wrong lane. `lane-start` holds this
-# same rename fatal, and so does this command now: a rename tmux refuses is a
-# refusal, made before the PAUSED record, the LANES.md line and the row, and
-# before any pane is touched. What HAS landed by then is said, because the act
-# that follows is a re-run and a person deciding on one needs to know.
-if have_tmux && [ -n "$window_name" ] && [ "$window_name" != "$lane" ]; then
-	rn_err=""
-	if ! rn_err="$(tmux rename-window "$lane" 2>&1 >/dev/null)"; then
-		rn_landed=""
-		[ "$handoff_written" = 1 ] &&
-			rn_landed=" The handoff's new top block IS written, and a re-run puts a newer one above it."
-		[ -n "$lc_on" ] &&
-			rn_landed="$rn_landed The lane reads SWAPPING until a handoff finishes, and the next one supersedes this one."
-		die "tmux would not rename this window '$window_name' → '$lane'${rn_err:+ (tmux: $rn_err)}, and the window IS the lane (Amendment 8(b)): a record written beside a window that still carries another name is how the next handoff from it binds the wrong lane. So the PAUSED record, the LANES.md line and the row were NOT written, and no pane was touched.$rn_landed Rename the window, then run the same command again:
-    tmux rename-window $lane" 2
-	fi
-	step "window renamed '$window_name' → '$lane' (Amendment 8(b): the window IS the lane)"
-fi
-
-# ------------------------------------------------------- 4. the swap record
-#
-# THE FREE TEXT IS SANITIZED ONCE: Amendment 7(b)/R26 refuses any payload or
-# free text containing ` — ` (exit 2), because that separator is what divides a
-# line's fields from its free text.
-#
-# AND A LINE BREAK IS SPELLED `; ` TOO (opensoft/openRepoTools#85), whatever
-# its spelling — CRLF, a lone CR, a lone LF — so that one break is one `; `.
-# Both writers this text reaches refuse a newline before they write
-# (`write_event` for the log, `append-line` for the register), and a why that
-# carries one is refused at the door, right after the arguments are read, so
-# nothing that reaches here today carries one. This is the second line of
-# defence, in the shape #85 asks of the caller: where a break does arrive, the
-# act still happens, on one line. `sed` cannot do it, because `sed` reads a
-# line at a time and hands the break back.
-sanitize() {
-	sz="${1//$'\r\n'/; }"
-	sz="${sz//$'\r'/; }"
-	sz="${sz//$'\n'/; }"
-	printf '%s' "$sz" | sed 's/ — /; /g'
-}
-# THE FREE TEXT NAMES THE KIND AFTER ITS WHY (Amendment 17 Addendum 1 (h), in
-# force 2026-09-14T20:59:31Z): `clear in-process`, `clear respawn`, `switch
-# respawn`, `reset respawn` — the why the caller gave, then the word for what
-# happened to the PROCESS. A handoff that cannot know which will follow writes
-# `kind unknown`, which is the addendum's own spelling of it. The payload
-# carries the same fact as a sub-field (`; kind <k>`) for the readers that
-# parse the line; this is for the person who reads it.
-kind_word="$handoff_kind"
-[ "$handoff_kind" = unknown ] && kind_word="kind unknown"
-why_text="$(sanitize "${why:-handoff}") $kind_word"
-
-# THE PAYLOAD. It opens `swap; ` because that is what `swapped` matches on — the
-# record the launcher restarts from — and the sub-fields after it are Amendment
-# 11(c)'s three plus Amendment 17(b)'s two. A value carrying `, `, ` — `, `; ` or
-# `"` is DROPPED (the sub-field, not the line) and what was dropped is PRINTED:
-# `R-A11-11` binds this writer — *a swap is never left unwritten* — so an
-# offending sub-field costs its own information and never the record.
-payload="swap"
-refused=""
-# THE SAME FENCE FOR ALL FOUR SEPARATORS (Copilot round 3 on openRepoTools#47).
-# `window` is two space-separated refs in ONE sub-field, so a `; ` inside it
-# would be read back as the END of the sub-field and the rest as another one:
-# every reader of this line would then recover a window ref that is not the
-# lane's. The comment above already said both were dropped; now they are.
-case "$window_ref" in *', '* | *' — '* | *'; '* | *'"'*) refused="$refused window=$window_ref"; window_ref="" ;; esac
-case "$dir" in *', '* | *' — '* | *'; '* | *'"'*) refused="$refused dir=$dir"; dir="" ;; esac
-dir_field="$dir"
-case "$dir_field" in *' '*) dir_field="\"$dir_field\"" ;; esac
-[ -z "$window_ref" ] || payload="$payload; window $window_ref"
-[ -z "$dir_field" ] || payload="$payload; dir $dir_field"
-[ -z "$profile_name" ] || payload="$payload; profile $profile_name"
-[ -z "$ws" ] || payload="$payload; workstation $ws"
-# AMENDMENT 17(b) — THE TWO SUB-FIELDS THAT MAKE THE LANE RESUMABLE BY ANY
-# AGENT. They go LAST, after Amendment 11(c)'s, because every reader written
-# before this amendment stops at the sub-field it knows and a reader that finds
-# none says so (Amendment 7(i)'s cutover rule).
-payload="$payload; agent $agent; transcript $transcript"
-# AND THE KIND OF CLEAR, AFTER THEM, ON THE SAME ARGUMENT: a reader written
-# before this field stops at the sub-field it knows. It is in the record and not
-# only in the handoff because the record is what a launcher and a later reader
-# have — `in-process` says the writers of that session were still running when
-# the line was written, which is the one fact that decides whether relaunching
-# them is right.
-payload="$payload; kind $handoff_kind"
-[ -z "$refused" ] || note "DROPPED sub-field (not appended, and the line is still written):$refused"
-
-# A lane-aware launcher is required for restarts. An explicit lane keeps the
-# pclaude fallback safe across both old and new launcher installations.
-lane_profile_word="pclaude --lane $lane"
-command -v lclaude >/dev/null 2>&1 && lane_profile_word=lclaude
-
-# ------------------------------------------------------------ the LATE branch
-if [ "$do_late" = 1 ]; then
-	late_payload="$payload; late $late_at"
-	late_why="$(sanitize "${why:-late; usage limit hit before the swap at $late_at}") $kind_word"
-	if LANES_LANE="$lane" LANES_SESSION="$uuid" "$LANES_EDIT" log PAUSED "lane:$lane" \
-		'→' "$late_payload" "$late_why" --utc "$late_at"; then
-		step "late PAUSED written, dated $late_at (before the relaunch, which is the only place it can go)"
-		# THE LATE RECORD'S MANDATORY SET IS TWO AND NOT THREE: the row is not
-		# flipped by this branch at all (it exits below), so requiring it would
-		# leave every late record reading as an interrupted swap for ever.
-		lc_unfinished=""
-		[ "$handoff_written" = 1 ] || lc_unfinished="the handoff file was not refreshed"
-		[ -z "$lc_inventory_missed" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the worktree inventory was not recorded for $lc_inventory_missed"
-		[ -z "$legs_unread" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the assembly's legs could not be read, so its paired feature trees were not polled"
-		[ -z "$paired_unread" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }a directory of the assembly's paired root, or this lane's inventory, could not be read, so a paired tree of this lane's may not have been polled"
-		lifecycle_finish "$lc_unfinished"
-	else
-		lifecycle_finish "the late PAUSED record was refused by the helper"
-		die "the late PAUSED was NOT written (the helper refused it — its own message is above). Nothing else was done." 2
-	fi
-	say ""
-	say "LATE RECORD WRITTEN for lane $lane, dated $late_at. Now start the lane:"
-	say "  $lane_profile_word ${profile_name:-<profile>}"
-	if [ -n "$lc_on" ]; then
-		say "  lifecycle: $lc_state (generation $lc_gen, operation $lc_op) — lanes-edit.sh lane-reconcile $lane"
-	fi
-	exit 0
-fi
-
-# --- BEGIN shared one-line cut (lane-collision-protocol Amendment 13(a)) ---
-# BYTE-IDENTICAL IN `lane-start`, `lane-end` AND `lane-handoff`, the three
-# commands that write a row's state cell — the same trade the four lane helpers
-# already make for their workspace resolver, and for the same reason: a drifted
-# copy is TWO ANSWERS to one question, and "what may this line contain, and
-# where may it be cut" is one question.
-#
-# FOUR THINGS THE CELL'S LINE MAY NOT CARRY, and `set-row-state` REFUSES all
-# four — which would cost the row its stamp or its closing write, so they are
-# fixed here rather than met there:
-#
-#   ` · `  the phrase's own separator. A second one reads back as a fourth part
-#          of `<STATE> · <UTC> · <one line>`; it is spelled `; `.
-#   `|`    a cell boundary in a Markdown table row. A launch command or a
-#          directory may legitimately hold one — `claude --flag 'a|b'`, a path
-#          with a pipe in it — and the row is where it would forge a column
-#          (Copilot round 1 on openRepoTools#82). It is spelled `¦`, the broken
-#          bar, which is not a separator anywhere here; the object log's own
-#          line keeps the character itself.
-#   CR/LF  a row is ONE LINE of a table, so a newline in this text would split
-#          it in two and every row after it would be read as a lane. Spelled
-#          `; ` for the same reason the separator is (Copilot round 2).
-#   >240   ratified decision O1's cap. Cut at 230 with the last partial WORD
-#          dropped, which is what makes the cut safe: `${s:0:n}` counts BYTES
-#          wherever the locale is not a UTF-8 one, and a byte offset can land
-#          inside the very characters above. 230 and not 240, so the ` ...`
-#          marker fits inside the cap however the two count.
-cut_to_line() {   # <line> — the row's one line, safe to hand to set-row-state
-  ctl="${1//$'\r'/ }"
-  ctl="${ctl//$'\n'/; }"
-  ctl="${ctl// · /; }"
-  ctl="${ctl//|/¦}"
-  [ "${#ctl}" -gt 230 ] || { printf '%s' "$ctl"; return 0; }
-  ctl="${ctl:0:230}"
-  case "$ctl" in *' '*) ctl="${ctl% *}" ;; esac
-  printf '%s ...' "$ctl"
-}
-# --- END shared one-line cut ---
-
-# ------------------------------------------------- (a) the object-log PAUSED
-record_written=0
-row_write_refused=""
-if [ -n "$ws_missing" ]; then
-	note "NOT WRITTEN: the PAUSED line, the LANES.md line and the row's state cell all stop where there is no configured workstation (clause (k) rule (d), \`R-A11-14\`). The handoff refreshed above names the gap, and the restart line below carries --lane, because a restart cannot resolve this lane from a row that was never set."
-	row_write_refused=1
-else
-	if LANES_LANE="$lane" LANES_SESSION="$uuid" "$LANES_EDIT" log PAUSED "lane:$lane" \
-		'→' "$payload" "$why_text"; then
-		record_written=1
-		step "object log: PAUSED lane:$lane → $payload"
-	else
-		note "the PAUSED line was NOT written — the helper's own refusal is above. Write it before anything else:"
-		note "  LANES_LANE=$lane LANES_SESSION=$uuid $LANES_EDIT log PAUSED lane:$lane '→' \"$payload\" \"$why_text\""
-	fi
-	# (b) the LANES.md file-level line, the shape every prior PAUSED/RESUMED
-	# used. It is written whether or not (a) could be (`R-A11-11`: a swap is
-	# never left unwritten) — EXCEPT where there is no transcript uuid to name,
-	# which is the one thing that must never be written into either file. The
-	# literal `unknown` is in this estate's append-only log four times already
-	# and no later line corrects any of them (Amendment 11 clause (e)); a
-	# register line naming it would be the fifth, one file along.
-	if [ -n "$uuid" ]; then
-		"$LANES_EDIT" append-line "PAUSED — lane $lane, session $uuid@$ws, $UTC, $why_text; handoff refreshed" >/dev/null 2>&1 ||
-			note "the LANES.md file-level PAUSED line was not appended (the register may be busy or behind); the object-log line above is the record readers take."
-	else
-		note "no transcript uuid is knowable for this lane, so neither the object log's PAUSED nor the register's file-level line was written — a record naming 'unknown' in that field is a record no restart can read (Amendment 11 clause (e)). The handoff file above is refreshed and is the whole of what this act left behind. Bind the session first:  lane-start --no-launch <repo> <n>"
-	fi
-	# (c) the row: ONE WRITE, which sets the whole cell (Amendment 13(a)).
-	#
-	# It used to be TWO, and both of them were guesses at a cell that was a
-	# history: `replace-in-row` flipping the leading state word — derived by
-	# grepping the row for `| WORD ·` or `| WORD |`, since the anchor had to
-	# occur exactly once or the write was refused — and then an
-	# `append-row-status` putting `PAUSED — <payload>` at the END of the same
-	# cell, so the row said PAUSED twice, in two places, with a day of narrative
-	# between them. The cell is now one phrase that `set-row-state` REPLACES, so
-	# a swap writes it once and there is no anchor to guess at: a row whose cell
-	# opens with anything at all, or with nothing, takes the same write.
-	#
-	# The payload carries the record's sub-fields (`swap; window …; dir …;
-	# profile …; agent …; transcript …`), which is exactly the line a person
-	# reading the row wants; a ` · ` inside it would read back as a fourth part
-	# of the phrase, and 240 characters is the cap (ratified decision O1) — the
-	# object-log line written above carries the full payload either way.
-	hs_line="$(cut_to_line "$payload")"
-	LANES_LANE="$lane" "$LANES_EDIT" set-row-state "$lane" "PAUSED · $hs_line" >/dev/null 2>&1 || row_write_refused=1
-	[ -z "$row_write_refused" ] || note "the row's state cell was NOT set to PAUSED (the write was refused — run it by hand to see what it says: lanes-edit.sh set-row-state $lane \"PAUSED · $hs_line\"). The restart line below carries --lane for that reason."
-fi
-
-# ------------------------- 4a. SWAPPING -> SWAPPED, the operation's commit point
-#
-# THE THREE WRITES THAT MUST HAVE LANDED, and they are the same three
-# `--restart` and `--exit` already gate on: the lane's `PAUSED` record (what
-# every launcher and every later reader takes its state from), the row (what
-# every OTHER lane reads) and the handoff file (whose top block is literally
-# the next session's first prompt). A lane called `SWAPPED` on two of those is
-# a lane whose recovery would skip the third, so the transition is made only on
-# all three and the state otherwise STAYS `SWAPPING` — which a later session
-# reads as an interrupted swap and answers by preserving every worktree.
-#
-# THE SWAP IS STILL REPORTED AND STILL RESTARTABLE (`R-A11-11`, *a swap is
-# never left unwritten*): this changes what the lane's lifecycle SAYS, never
-# whether the act completes.
-lc_unfinished=""
-[ "$record_written" = 1 ] || lc_unfinished="the lane's PAUSED record did not land"
-[ -z "$row_write_refused" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the row's state cell was not flipped"
-[ "$handoff_written" = 1 ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the handoff file was not refreshed"
-[ -z "$lc_inventory_missed" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the worktree inventory was not recorded for $lc_inventory_missed"
-[ -z "$legs_unread" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }the assembly's legs could not be read, so its paired feature trees were not polled"
-[ -z "$paired_unread" ] || lc_unfinished="${lc_unfinished:+$lc_unfinished; }a directory of the assembly's paired root, or this lane's inventory, could not be read, so a paired tree of this lane's may not have been polled"
-lifecycle_finish "$lc_unfinished"
-
-# ------------------------------------------- 5. the restart line — one command
-if [ -n "$row_write_refused" ]; then
-	if [ "$lane_profile_word" = lclaude ]; then
-		restart_cmd="lclaude --lane $lane ${profile_name:-<profile>}"
-	else
-		restart_cmd="$lane_profile_word ${profile_name:-<profile>}"
-	fi
-	restart_note=" (the row was not flipped, so the lane must be named explicitly)"
-else
-	restart_cmd="$lane_profile_word ${profile_name:-<profile>}"
-	restart_note=""
-fi
-say ""
-say "READY — restart with: $restart_cmd$restart_note"
-say "  record: PAUSED lane:$lane → $payload"
-say "  agent $agent, transcript $transcript (lane-start --agent $agent resumes it)"
-if [ -n "$lc_on" ]; then
-	say "  lifecycle: $lc_state (generation $lc_gen, operation $lc_op) — lanes-edit.sh lane-reconcile $lane"
-	say "  inventory: $writer_count worktree(s) recorded — lanes-edit.sh lane-trees $lane"
-fi
-
-# -------------------------------------------- Amendment 17(f) / 18(d): the end
-#
-# THE RECORD COMES FIRST, ALWAYS. *"a `/ctx` whose record could not be written
-# REFUSES before it kills anything (a pane is never respawned over an unrecorded
-# lane)"* — so both branches below test `record_written` before they touch tmux,
-# and a lane whose PAUSED line did not land keeps its pane and its session.
-if [ "$do_restart" = 1 ] || [ "$do_exit" = 1 ]; then
-	[ "$record_written" = 1 ] ||
-		die "the lane's PAUSED record was NOT written, so this pane is left exactly as it is: a pane is never respawned over an unrecorded lane, and a session is never ended without one (Amendment 17(f)). Fix the write above and re-run." 2
-	# AND THE RECORD IS THREE WRITES, NOT ONE (Copilot rounds 1 and 2 on
-	# openRepoTools#47). The object-log line above is the first of them; the
-	# ROW is what every other lane and every launcher reads this lane's state
-	# from, and the HANDOFF is the document the new session is started with —
-	# its top block is literally the respawn's first prompt (`lane-start`'s
-	# 5a). A pane respawned over an unflipped row leaves the register saying
-	# RUNNING about a session that no longer exists, and a pane respawned over
-	# a STALE top block hands the new session the last handoff's instructions:
-	# the writers of another act, the why of another act. Neither is a state
-	# this command may create and then kill the only process that could fix it,
-	# so both are gates, and each names the act that clears it.
-	[ -z "$row_write_refused" ] ||
-		die "the lane's PAUSED line is written and the ROW WAS NOT FLIPPED (the note above says why), so this pane is left exactly as it is: respawning it would leave the register reading RUNNING for a session that has just been replaced, and every other lane reads the row. Flip it and re-run, or restart by hand:  $restart_cmd" 2
-	[ "$handoff_written" = 1 ] ||
-		die "the lane's PAUSED line is written and the HANDOFF WAS NOT REFRESHED (the note above says why), so this pane is left exactly as it is: the top block of that file is what the new session is started with, and respawning now would hand it the block of a handoff this act has replaced. Put the block printed above at the head of the handoff, then re-run — or restart by hand once you have:  $restart_cmd" 2
-	have_tmux ||
-		die "the record is written, and there is no tmux here to ${do_restart:+respawn}${do_exit:+end} this pane with. Do it by hand — the record is the part that mattered." 2
-	# THE PANE, from the LIVE RECORD's own `tmux` field — `<session>:<@id>.%<pane>`
-	# — because that is the pane the session is really in; the window ref is the
-	# fallback for a record that carries none, and tmux resolves it to that
-	# window's active pane.
-	target="${pane:-${TMUX_PANE:-}}"
-	[ -n "$target" ] || target="${wid:-$win}"
-	[ -n "$target" ] ||
-		die "the record is written, and no pane of this lane's could be resolved (no live record names one, \$TMUX_PANE is unset and this window has no ref). Nothing was killed." 2
-fi
-
-if [ "$do_exit" = 1 ]; then
-	# AMENDMENT 18(d): the session ENDS, because a handoff to another place is a
-	# handoff and not a restart. `/exit` is typed into the lane's own pane —
-	# Amendment 12's M1, the one mechanism there is — so the session ends at its
-	# next prompt with nothing of the person's lost.
-	if tmux send-keys -t "$target" '/exit' Enter 2>/dev/null; then
-		say "  /exit typed into $target (Amendment 18(d): the session ends where the handoff was requested from elsewhere)"
-	else
-		die "the record is written and `/exit` could NOT be typed into $target. Type it in the lane's own pane yourself." 2
-	fi
-	exit 0
-fi
-
-if [ "$do_restart" = 1 ]; then
-	# AMENDMENT 17(f) — THE RESPAWN, THROUGH THE LAUNCHER, WITH THE TOP BLOCK AS
-	# THE NEW SESSION'S FIRST PROMPT. `respawn-pane -k` replaces the pane's
-	# process, so the act survives the death of the session that started it: the
-	# session running this command is killed BY the command it just wrote the
-	# record for.
-	#
-	# WHAT THE RESPAWN LINE USED TO BE, AND WHY IT IS NOT THAT ANY MORE.
-	# Amendment 18 Addendum 2 (i-8) names two doors for this act: *"relaunches
-	# the lane's own pane with `lane <name>` (its parked branch is exactly
-	# Amendment 11(i)'s act), or through the launcher directly"*. This command
-	# respawned with the first of them, and openRepoTools#94 is what that cost:
-	# `lane` is a HUMAN DISPATCHER whose valid outcomes include attaching to an
-	# existing session without launching anything, and the fresh-session
-	# requirement it was asked to carry was an environment variable that the
-	# launcher's own `tmux new-session` dropped on the way through.
-	#
-	# BOTH DOORS ARE KEPT, ONE LEVEL DOWN. What tmux starts now is this
-	# command's `--supervise` mode, and what the SUPERVISOR starts is (i-8)'s
-	# second door — `pclaude --lane <lane> <profile>`, the launcher directly —
-	# falling to `lane-start` itself where this workstation has no launcher or
-	# the lane's record names no profile. The ground of (i-8) is honoured
-	# exactly: *"no word is kept on `PATH` for it alone"*, and none is — the
-	# supervisor is a mode of a command that is already installed, and a person
-	# still has one word, `lane`.
-	#
-	# THE DEVIATION IS WRITTEN DOWN rather than taken quietly: it is decisions
-	# 10 and 11 of `openspec/changes/add-supervised-context-restart/design.md`
-	# — 10 for the supervisor being a MODE of this command rather than the new
-	# installed word decision 5 proposed, 11 for neither of (i-8)'s two doors
-	# being taken at THIS level — and the protocol text that would ratify it is
-	# task 7.4's, unwritten as this lands.
-
-	# ---- THE PRE-KILL COMMIT POINT: THE RESTART INTENT (openRepoTools#94)
-	#
-	# THE FRESH SESSION IS WRITTEN DOWN BEFORE ANYTHING IS KILLED, and that is
-	# the whole of this change. `LANE_START_FRESH=1` in the respawn's command
-	# string was the seam and it was measured NOT ARRIVING: `claude-profile`
-	# re-created the child through `tmux new-session` in that incident. The current
-	# launcher keeps an existing TMUX pane; an out-of-pane tmux launch hands a command
-	# the SERVER's environment and not the client's — the launcher's own code
-	# says so, which is why it threads six values into the command string
-	# explicitly and why a seventh nobody thought to thread simply vanished.
-	# The pane came back resuming the transcript this act had just paused.
-	#
-	# SO THE REQUIREMENT BECOMES A FILE. The intent is written under the lane's
-	# own control root, carries the lane, generation, operation, old
-	# transcript, agent, profile, checkout, pane, handoff path and DIGEST and
-	# the launch mode, and `lane-start` reads it back whatever the environment
-	# did. It is the one channel that crosses a boundary another repository
-	# owns.
-	#
-	# AND IT IS A GATE, LIKE THE THREE ABOVE IT. Amendment 17(f) is an order —
-	# *a `/ctx` whose record could not be written REFUSES before it kills
-	# anything* — and after this change the intent IS part of that record: a
-	# pane respawned with no intent is a pane whose supervisor has nothing to
-	# launch from, which is the same unrecorded restart one step along. It
-	# therefore refuses here, with the old process still alive, rather than
-	# after it is dead.
-	#
-	# Complete the reservation made before preservation writes.
-	ri_args=(set-restart-intent "$lane" pending
-		--expect preparing --expect-operation "$operation" --expect-generation "$ri_gen" --expect-attempt 0
-		--operation "$operation" --generation "$ri_gen"
-		--mode fresh-from-handoff
-		--agent "$agent" --pane "$target"
-		--old-transcript "${transcript:-none}"
-		--profile "${profile_name:-none}" --window "${window_ref:-none}"
-		--dir "$dir" --handoff "$handoff_file")
-	ri_wrc=0
-	LANES_NO_FETCH=1 "$LANES_EDIT" "${ri_args[@]}" >/dev/null 2>&1 || ri_wrc=$?
-	case "$ri_wrc" in
-	0) : ;;
-	7) die "lane $lane already has a restart in flight (its intent is \`pending\` or \`starting\`), so this /ctx did NOT replace the pane: an ordinary context clear never supersedes an operation somebody else is in the middle of. The record above IS written. Read what is open:  $prog --restart-status --lane $lane" 2 ;;
-	*) die "the lane's PAUSED record, row and handoff are all written and the RESTART INTENT could not be (\`set-restart-intent\` exited $ri_wrc), so this pane is left exactly as it is. The intent is what tells the new session it is a FRESH one primed by the handoff's top block, and a pane respawned without it comes up resuming the transcript this act just paused — which is openRepoTools#94, measured. Restart by hand once it can be written:  $restart_cmd" 2 ;;
-	esac
-	# READ BACK BEFORE THE KILL, because a write that reported success and a
-	# record a second process can read are not the same fact, and the process
-	# that could fix the difference is the one about to die.
-	ri_load "$lane" || die "the pending restart intent could not be read back. Nothing was respawned." 2
-	[ "$RI_STATE" = pending ] && [ "$RI_OP" = "$operation" ] && [ "$RI_GEN" = "$ri_gen" ] &&
-	  [ "$RI_ATTEMPT" = 0 ] && [ "$RI_MODE" = fresh-from-handoff ] && [ "$RI_AGENT" = claude ] &&
-	  [ "$RI_PROFILE" = "${profile_name:-none}" ] && [ "$RI_DIR" = "$dir" ] && [ -d "$RI_DIR" ] &&
-	  [ "$RI_PANE" = "$target" ] && [ "$RI_WINDOW" = "${window_ref:-none}" ] &&
-	  [ "$RI_OLD" = "${transcript:-none}" ] && [ "$RI_NEW" = none ] &&
-	  [ "$RI_HANDOFF" = "$handoff_file" ] && [ -s "$RI_HANDOFF" ] &&
-	  [ "$RI_DIGEST" != none ] && [ -n "$RI_DIGEST" ] && [ "$(handoff_digest "$RI_HANDOFF")" = "$RI_DIGEST" ] ||
-		die "the pending restart launch facts could not be verified before replacing the pane. Nothing was respawned; read the intent: $prog --restart-status --lane $lane" 2
-	say "  restart intent $operation written (generation $ri_gen, mode fresh-from-handoff)"
-
-	# ---- THE RESPAWN, INTO A SUPERVISOR AND NOT INTO THE LAUNCH ITSELF
-	#
-	# WHAT TMUX STARTS IS A PROCESS THAT STAYS. The old line respawned the pane
-	# with the launch, so a launch that failed took the pane with it and left
-	# an empty dead window where a person's lane had been — against Amendment
-	# 11's own invariant, *"No path the launcher opened exits the pane"*. The
-	# supervisor is that invariant kept for the one act that had nobody
-	# keeping it: it claims the intent, runs the launch as its CHILD, confirms
-	# readiness, and on any failure stays in the pane with the diagnostic and
-	# the retry.
-	#
-	# BY ABSOLUTE PATH, because a respawned pane's `PATH` is whatever the
-	# person's shell profile makes of it, and a respawn is the one act no later
-	# refusal can undo. It is checked for existence HERE, while this process is
-	# still alive to say so.
-	[ -x "$SELF_ABS" ] ||
-		die "the record and the restart intent are written and this command cannot find itself at $SELF_ABS to hand the pane to, so nothing was respawned: tmux starts the supervisor by absolute path because a respawned pane's PATH is not this one's. Restart by hand:  $restart_cmd" 2
-	# AND THE ENVIRONMENT THE SUPERVISOR NEEDS IS WRITTEN INTO THE COMMAND
-	# STRING, for exactly the reason #94 exists: the workstation name is what
-	# every register write from the new session is filed under (`R-A11-14`),
-	# and tmux would otherwise hand the pane whatever the SERVER has.
-	launch_line="$(quoted "$SELF_ABS" --supervise --lane "$lane" --operation "$operation")"
-	[ -n "$ws" ] && launch_line="LANES_WORKSTATION=$(quoted "$ws") $launch_line"
-	[ -z "${LANES_LANE_STATE_ROOT:-}" ] || launch_line="LANES_LANE_STATE_ROOT=$(quoted "$LANES_LANE_STATE_ROOT") $launch_line"
-	[ -z "${AGENT_PROTOCOL_ROOT:-}" ] || launch_line="AGENT_PROTOCOL_ROOT=$(quoted "$AGENT_PROTOCOL_ROOT") $launch_line"
-	[ -z "${LANES_HOST:-}" ] || launch_line="LANES_HOST=$(quoted "$LANES_HOST") $launch_line"
-	[ -z "${LANES_OS:-}" ] || launch_line="LANES_OS=$(quoted "$LANES_OS") $launch_line"
-	[ -z "${LANES_CONTAINER:-}" ] || launch_line="LANES_CONTAINER=$(quoted "$LANES_CONTAINER") $launch_line"
-	say "  respawning $target: $launch_line"
-	if tmux respawn-pane -k -t "$target" "$launch_line" 2>/dev/null; then
-		say "  respawned into the supervisor — it launches the fresh session, confirms it came up, and stays in this pane if it did not"
-	else
-		die "the record and the restart intent are written and \`tmux respawn-pane -k -t $target\` was refused, so this pane is exactly as it was and the lane's restart intent is \`pending\` for operation $operation. Nothing was killed. Start it yourself:  $restart_cmd
-    or hand this pane to the supervisor once tmux will take it:
-      $launch_line" 2
-	fi
-	exit 0
-fi
-
-exit 0
diff --git a/lane-rename b/lane-rename
deleted file mode 100755
index 1638e2ec..00000000
--- a/lane-rename
+++ /dev/null
@@ -1,337 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# lane-rename — a lane is renamed by ONE WORD, in ONE COMMIT, and its old name
-# keeps resolving for ever.
-#
-#   lane-rename <old> <new> ["<why>"]   rename the lane: the row, its object
-#                                       log, its handoff and lanes/aliases.tsv
-#                                       in one commit; then this window's name
-#                                       and this session's name
-#   lane-rename <old> <new> --verbatim  <new> need not be `<repo>-<n>`
-#   lane-rename <old> <new> --no-github skip the per-object comments
-#   lane-rename <old> <new> --no-tmux   write only; touch no window and no pane
-#
-# lane-collision-protocol **Amendment 16**, ratified 2026-09-14T09:24:35Z
-# verbatim *"Ratify as drafted (Recommended)"*, on Brett Heap's request of the
-# same day, verbatim: *"we need the ability to rename a lane. maybe lanes
-# --rename <current lane name> <new lane name>."* The spelling he chose is this
-# one — *"lane-rename <old> <new> (Recommended)"* — and `lanes` stays read-only
-# (clause (h), and Amendment 11(j) before it).
-#
-# WHY IT EXISTS: TWO RENAMES BY HAND IN ONE NIGHT. The register's rows are keyed
-# by lane name; so are `lanes/log/<lane>.md`, the handoff
-# `session-handoff-<date>-lane-<name>.md`, the tmux window, the session name
-# (Amendment 12's lock), every Rule 6 line's attribution, every other lane's log
-# line that names it, and the wire form `Lane: <lower> (<Canonical>)` on every
-# PR, issue and comment the lane ever wrote. Nothing renamed any of it. On
-# 2026-09-14 two lanes renamed themselves anyway, each as one `RENAMED` line
-# appended to `LANES.md` — *"the lines are honest and they are all there is"*.
-#
-# WHAT THIS COMMAND IS, AND WHAT IT IS NOT. The WRITE is
-# `lanes-edit.sh rename-lane`, which is where every refusal and all four moves
-# live: this file adds nothing to the register and nothing to any log. What it
-# adds is the two names a register writer may not touch (clause (f)):
-#
-#   * THE WINDOW, renamed with `tmux rename-window` when this window carries the
-#     old name — one tmux call any client may make, which is why `lane-start`
-#     makes exactly this one at every launch;
-#   * THE SESSION, whose name is LOCKED to the lane by Amendment 12(h) and which
-#     no API renames from outside it. The one path is `/rename <new>` typed into
-#     the lane's own pane (M1), and the conditions on typing at all are M1's: a
-#     pane whose current command is `claude`, and nothing else. Where they do not
-#     hold, the line is PRINTED — a lock that silently did nothing is a lock
-#     nobody knows is broken.
-#
-# RUN FROM ELSEWHERE IT STILL RENAMES THE LANE, and says what is left: clause
-# (f) is explicit that *"the window and session are the lane's to fix at its
-# next prompt, and the guard says so"*. Amendment 12's name guard does exactly
-# that, out of the same alias table: at the lane's next prompt it resolves the
-# window's former name to the lane's row, renames the window itself, and types
-# the `/rename`. So a rename made from another window is finished by the lane
-# without anybody typing anything.
-#
-# AND IT CANNOT BE RUN OVER A RUNNING LANE FROM OUTSIDE IT. Clause (a) refuses a
-# rename while a LIVE session holds `<old>` in another window, and that refusal
-# is the helper's, before anything is written — because the running session's
-# own name would then be a lane the register no longer carries, and that is the
-# state the name guard refuses every prompt over.
-#
-# EXIT CODES ARE THE HELPER'S, passed straight through: `0` done · `1` no
-# register, or a read that failed · `2` a refusal (clause (a), bad arguments, or
-# a `lanes-edit.sh` predating this amendment) · `3` the commit is local and this
-# attempt cannot confirm it reached origin · `4` the mutex · `5` a move refused
-# · `6` git. Never this file's own numbers: every one of them is decided in the
-# writer, and two tables of codes for one act is how they come to disagree.
-#
-#   $LANES_EDIT          the writer (default: lanes-edit.sh beside this file)
-#   $LANE_RENAME_NO_TMUX 1: the same as --no-tmux (the test seam)
-
-set -uo pipefail
-
-prog="${0##*/}"
-SELF="${BASH_SOURCE[0]:-$0}"
-selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-
-say()  { printf '%s\n' "$*"; }
-step() { printf '%s: %s\n' "$prog" "$*" >&2; }
-note() { printf '%s: %s\n' "$prog" "$*" >&2; }
-die()  { printf '\n%s: REFUSED: %s\n' "$prog" "$1" >&2; exit "${2:-2}"; }
-# `tr`, not `${x,,}`: every file this repository ships is parsed under macOS
-# bash 3.2 in CI, where `${x,,}` is a syntax error.
-lc()   { printf '%s' "${1-}" | tr '[:upper:]' '[:lower:]'; }
-
-usage() {
-	cat <<'USAGE'
-lane-rename <old> <new> ["<why>"] [--verbatim] [--no-github] [--no-tmux]
-
-Rename a lane. ONE COMMIT, refused or whole (lane-collision-protocol Amendment
-16): the register row's key cell, `lanes/log/<old>.md` → `lanes/log/<new>.md`
-with a RENAMED line, the handoff the row names → the same date with
-`lane-<new>` plus a Rule 3 stamp, and `lanes/aliases.tsv` gains one TAB-separated
-record, `<old>	<new>	<UTC of the rename>`. Then one GitHub comment on every
-object the lane holds.
-
-THE OLD NAME KEEPS RESOLVING, for ever and in every reader: `who`, `lanes`,
-`live-holder`, `lane-start`, Rule 6 attribution, the SessionStart block and the
-name guard all resolve a lane name through `lanes/aliases.tsv` before they read.
-
-  --verbatim   accept a <new> that is not of the form <repo>-<n>. Rule 4's form
-               is what `lanes --prefix`, the next free position and
-               `lane-start <repo> <n>` are computed from, so a lane renamed out
-               of it loses all three; Amendment 11's `--dir` lanes are the
-               deliberate exception this flag exists for.
-  --no-github  make the commit and post no comment on any object the lane holds.
-  --no-tmux    write only: rename no window and type into no pane.
-  -h, --help   this.
-
-Run it IN THE LANE'S OWN WINDOW and the whole act is one command: the window is
-renamed and `/rename <new>` is typed into the pane. Run from anywhere else it
-renames the lane and says what is left — and the name guard finishes the window
-and the session at that lane's next prompt.
-
-A rename is REFUSED, before anything is written, where: there is no row under
-<old> in any case; a row exists under <new> in any case; <new> is not <repo>-<n>
-and --verbatim was not given; a LIVE session holds <old> in another window; two
-rows for <old> differ only by case; the alias table would gain a cycle; or a
-read could not be made.
-
-Exit: the writer's own codes — 0 done · 1 environment · 2 refused · 3 committed,
-not confirmed pushed · 4 mutex · 5 a move refused · 6 git.
-USAGE
-}
-
-# ------------------------------------------------------------- the arguments
-old=""; new=""; why=""; no_tmux="${LANE_RENAME_NO_TMUX:-0}"
-pass=()
-while [ $# -gt 0 ]; do
-	case "$1" in
-	-h | --help)  usage; exit 0 ;;
-	--verbatim)   pass+=(--verbatim); shift ;;
-	--no-github)  pass+=(--no-github); shift ;;
-	--no-tmux)    no_tmux=1; shift ;;
-	--why)        why="${2-}"; [ -n "$why" ] || die "--why needs a reason" 2; shift 2 ;;
-	--why=*)      why="${1#--why=}"; [ -n "$why" ] || die "--why needs a reason" 2; shift ;;
-	--)           shift ;;
-	-*)           die "unknown option '$1' — see $prog --help" 2 ;;
-	*)
-		if   [ -z "$old" ]; then old="$1"
-		elif [ -z "$new" ]; then new="$1"
-		elif [ -z "$why" ]; then why="$1"
-		else die "$prog takes <old> <new> [\"<why>\"] — '$1' is one argument too many. See $prog --help" 2
-		fi
-		shift ;;
-	esac
-done
-[ -n "$old" ] && [ -n "$new" ] || { usage >&2; die "usage: $prog <old> <new> [\"<why>\"]" 2; }
-
-# ---------------------------------------------------------------- the writer
-#
-# Beside this command first — `--install` places both in one directory — then on
-# PATH. One resolution, so a workstation with two copies never reads one and
-# writes with the other.
-LANES_EDIT="${LANES_EDIT:-}"
-if [ -z "$LANES_EDIT" ]; then
-	if [ -x "$selfdir/lanes-edit.sh" ]; then LANES_EDIT="$selfdir/lanes-edit.sh"
-	else LANES_EDIT="$(command -v lanes-edit.sh 2>/dev/null || printf '')"
-	fi
-fi
-[ -n "$LANES_EDIT" ] && [ -x "$LANES_EDIT" ] || die "no register writer at ${LANES_EDIT:-lanes-edit.sh} — it is installed beside this
-    command by \`openRepoTools --install\`. Run that, or set \$LANES_EDIT." 1
-
-have_tmux() {
-	[ "$no_tmux" = 1 ] && return 1
-	[ -n "${TMUX:-}" ] || return 1
-	command -v tmux >/dev/null 2>&1
-}
-
-# ---------------------------------------------------------------- this window
-#
-# READ BEFORE THE WRITE, and only read. Amendment 16(f) turns on ONE question —
-# is this the lane's own window — and the two facts it is answered from are read
-# here, before the write, because a write that refuses must leave this window
-# exactly as it found it.
-#
-# TWO SPELLINGS, AND NEITHER IS DERIVED FROM THE OTHER (Amendment 11(c), as
-# `lane-start` states it): `#W` is the NAME, and `<session>:<@id>` is the ref
-# the harness's own session records are matched on, which is the one
-# `window-session` takes. `<session>:<index>` is a third spelling this command
-# has no question for, so it is not read.
-win_name=""; win_harness=""
-if have_tmux; then
-	win_name="$(tmux display-message -p '#W' 2>/dev/null || :)"
-	win_harness="$(tmux display-message -p '#{session_name}:#{window_id}' 2>/dev/null || :)"
-fi
-# THIS WINDOW IS THE LANE'S WHEN ITS NAME RESOLVES TO THE LANE, and that is a
-# question for the RESOLVER and not for a string compare (Copilot round 1 on
-# openRepoTools#81). Compared against the typed `<old>` alone, a lane currently
-# called `B` renamed through an OLDER name `A` left `here` at 0 — the window is
-# named `B` — so the command skipped both the window rename and the `/rename` in
-# the lane's own window, which is the one place clause (f) says they happen.
-#
-# `canon-lane` answers it for every spelling at once: `<old>`, `<new>`, any
-# older alias, and any case of them (Amendment 15). It is asked AFTER the write,
-# because the write is what puts `<old> → <new>` in the table — before it, a
-# window named `<old>` resolves to `<old>`, which is exactly as true and answers
-# a different question.
-here=0
-window_is_lane() {   # <the lane the window must be>
-	wil_want="$1"
-	[ -n "$win_name" ] || return 1
-	[ "$(lc "$win_name")" = "$(lc "$wil_want")" ] && return 0
-	wil_canon="$("$LANES_EDIT" canon-lane "$win_name" 2>/dev/null)" || return 1
-	[ -n "$wil_canon" ] && [ "$(lc "$wil_canon")" = "$(lc "$wil_want")" ]
-}
-
-# ------------------------------------------------------------------ the write
-#
-# EVERY REFUSAL IS THE WRITER'S, INCLUDING THE ONE ABOUT THIS WINDOW. Clause (a)
-# refuses a rename while a live session holds `<old>` elsewhere, and that read
-# is `live-holder`'s, which knows whether a record is `here` — so this file does
-# not ask the question twice and cannot answer it differently.
-step "renaming lane $old → $new (lane-collision-protocol Amendment 16)"
-rc=0
-"$LANES_EDIT" rename-lane "$old" "$new" ${why:+"$why"} ${pass[@]+"${pass[@]}"} || rc=$?
-if [ "$rc" != 0 ]; then
-	# THE RENAME MAY ALREADY HAVE LANDED, AND THEN THIS IS THE REPAIR RUN
-	# (Copilot round 1 on openRepoTools#81). The two acts below are the two a
-	# register writer may not make, and either of them can fail on its own —
-	# tmux refusing the rename, a pane not running `claude` — with the commit
-	# already on `origin`. Re-running the same command was the documented cure
-	# and it could not work: the writer resolves `<old>` through the alias it
-	# just wrote, finds `<new>`'s row, and refuses. So the refusal is ASKED
-	# WHICH ONE IT IS: where `<old>` already resolves to `<new>`, the write is
-	# done and what is left is this file's half, which then runs. Anything else
-	# is a real refusal and is passed through untouched.
-	if [ "$rc" = 2 ]; then
-		landed="$("$LANES_EDIT" canon-lane "$old" 2>/dev/null)" || landed=""
-		if [ -n "$landed" ] && [ "$(lc "$landed")" = "$(lc "$new")" ]; then
-			step "the rename itself has already landed — '$old' resolves to $new — so this run is the window and the session only (Amendment 16(f))"
-			rc=0
-		fi
-	fi
-fi
-if [ "$rc" != 0 ]; then
-	# THE WRITER HAS ALREADY SAID WHY, in its own words and with the act to
-	# take. Saying it again in different words is how two surfaces come to
-	# disagree about one refusal; the only thing added here is that NOTHING of
-	# this window's was touched, which is this file's own fact.
-	case "$rc" in
-	2) note "nothing was renamed here either: the window still carries '${win_name:-none}' and no pane was typed into." ;;
-	*) note "the write exited $rc (the writer's own code, above). This window was NOT touched — read what it said before re-running: a 3 means the commit is local and may already be on origin." ;;
-	esac
-	exit "$rc"
-fi
-
-window_is_lane "$new" && here=1
-
-# --------------------------------------------------- clause (f): the two names
-#
-# THE WINDOW FIRST, because it is the half that needs nobody. `rename-window`
-# also turns tmux's automatic-rename OFF for this window, which is what keeps
-# the name through the next command that runs in it — `lane-start` takes the
-# same call for the same reason.
-if [ "$here" = 1 ] && have_tmux && [ "$win_name" != "$new" ]; then
-	if tmux rename-window "$new" 2>/dev/null; then
-		say "  window renamed '$win_name' → '$new'"
-	else
-		note "tmux would not rename this window, so it still carries '$win_name'. Rename it yourself: tmux rename-window $new"
-	fi
-fi
-
-if [ "$here" != 1 ]; then
-	# FROM ELSEWHERE, THE LANE'S OWN NEXT PROMPT FINISHES IT (clause (f)). This
-	# is not a gap: the guard resolves the window's former name through the very
-	# alias table this rename just wrote, renames the window itself and types the
-	# `/rename`. What is printed is what a person would type if they got there
-	# first.
-	say ""
-	say "  This is not lane $new's own window${win_name:+ (it is named '$win_name')}, so its window and its session are"
-	say "  the lane's to fix — which the name guard does at its next prompt (Amendment 16(f)):"
-	say "      tmux rename-window $new        # in the lane's own window"
-	say "      /rename $new                   # typed in the lane's own session"
-	exit 0
-fi
-
-# --------------------------------------------- the session name (Amendment 12(h))
-#
-# M1's CONDITIONS ARE THE ONES `guard_type` MAKES, and they are not a taste: a
-# `/rename` typed at a shell is a command that does not exist, and typed into an
-# editor it is text nobody wrote. So the pane comes from the LANE's own live
-# record, and it is typed into only where that pane's current command is
-# `claude`.
-#
-# THE PANE IS NOT `$TMUX_PANE`. This command usually runs from a shell, and that
-# shell's pane is running the shell: a person who typed `lane-rename` at a
-# prompt is not typing into their own session, and the record is what says where
-# the session actually is.
-# THE PANE IS THE LANE'S OWN SESSION'S, NOT "WHATEVER IS LIVE IN THIS WINDOW"
-# (Copilot round 3 on openRepoTools#81). `window-session` answers about the
-# WINDOW: a second Claude session in another pane of it is a live interactive
-# record with the same target, and `/rename <new>` typed there renames somebody
-# else's conversation. `live-holder <lane>` answers about the LANE — it reads
-# only ids the lane's own ROW carries (Amendment 6(b)'s session cell), which is
-# the fact that makes the session this lane's — so that is the read, and the
-# window agreement test stays on top of it for the reason `guard_run` gives:
-# tmux REUSES window ids, so a record placed here by its pid can carry a target
-# another window now answers to.
-pane=""; sess_name=""
-if have_tmux && [ -n "$win_harness" ]; then
-	lh_out=""
-	lh_out="$("$LANES_EDIT" live-holder "$new" 2>/dev/null)" || lh_out=""
-	if [ -n "$lh_out" ]; then
-		# `<sid><US><target><US><name><US><pid><US><verdict>`, `live_holder`'s
-		# own fields; the target is `<session>:<@id>.<%pane>`.
-		rec_tgt="$(printf '%s' "$lh_out" | awk -F'\037' '{print $2}')"
-		sess_name="$(printf '%s' "$lh_out" | awk -F'\037' '{print $3}')"
-		case "$rec_tgt" in none) rec_tgt="" ;; esac
-		if [ -n "$rec_tgt" ] && [ "${rec_tgt%.*}" = "$win_harness" ]; then
-			case "$rec_tgt" in *.%*) pane="${rec_tgt##*.}" ;; esac
-		fi
-	fi
-fi
-
-if [ -n "$sess_name" ] && [ "$(lc "$sess_name")" = "$(lc "$new")" ]; then
-	say "  the session in this window is already named '$sess_name'"
-	exit 0
-fi
-
-typed=0
-if [ -n "$pane" ] && have_tmux; then
-	cur="$(tmux display-message -p -t "$pane" '#{pane_current_command}' 2>/dev/null || :)"
-	case "$cur" in
-	claude)
-		if tmux send-keys -t "$pane" "/rename $new" Enter 2>/dev/null; then
-			typed=1
-			say "  /rename $new typed into $pane (Amendment 12(h) M1: the only path a running session's name has)"
-		fi ;;
-	esac
-fi
-if [ "$typed" = 0 ]; then
-	say ""
-	say "  The session's own name is LOCKED to the lane (Amendment 12(h)) and no API renames a"
-	say "  running one from outside it. Type this in lane $new's own session — or say nothing and"
-	say "  let the name guard type it at that lane's next prompt:"
-	say "      /rename $new"
-fi
-exit 0
diff --git a/lane-start b/lane-start
deleted file mode 100755
index b83c07cd..00000000
--- a/lane-start
+++ /dev/null
@@ -1,4651 +0,0 @@
-#!/usr/bin/env bash
-#
-# lane-start — the FIRST act of a lane: name the tmux window after the lane,
-# put the lane's row in the register, and launch the session under the same
-# name. One command at the boundary, so the three things that must agree are
-# set in one act and cannot drift apart.
-#
-# THE LANE RULE (Brett Heap, 2026-09-10)
-#   lane = tmux window name = Claude session name, in the form
-#   `<repo>-<position across, left to right>`. The working directory confers
-#   NO lane — two lanes may share one; a window still called `claude` has no
-#   lane at all; and whether a name is free is decided by whether the
-#   register row's recorded session id is LIVE, never by whether a row exists.
-#
-# PROTOCOL  ~/.agents/protocols/lane-collision-protocol.md
-#   Rule 4 + Amendment 2 — the window is NAMED for the lane BEFORE the row is
-#     appended, and peers are addressed by that name.
-#   Rule 9 + Amendment 5 — every register write is one commit, made by
-#     lanes-edit.sh, in the person's workspace repository.
-#   Rule 10 — every row names its workstation.
-#   Amendment 7 (DRAFT 2026-09-11) — after the row is written, the lane's own
-#     object log records that the lane is here. Every line has an object, and
-#     a lane-kind line's object is the lane itself:
-#       STARTED — lane X, session <uuid>@<ws>, <UTC>, lane:X → home owner/repo; estate <estate>
-#     `RESUMED` for a session that is being resumed rather than started. The
-#     home repo comes from `git remote get-url origin` of the lane's OWN
-#     directory: `<repo>-<n>` is a label, not a scope, and this line is the
-#     only thing that says where a lane actually lives. It is resolved through
-#     `lanes/repos.tsv` before it is written (R20), because a home is inherited
-#     by every `#n` that lane writes and a legacy org spelling would key those
-#     against a repository nothing else can reconcile them with.
-#   Amendment 6 (DRAFT 2026-09-11, awaiting Brett Heap's word) — A LANE IS
-#     RESUMED BY THE SESSION ID ITS ROW RECORDS, NEVER BY ITS TITLE. Titles are
-#     not unique: `claude --help` says `-r, --resume [value]` is "Resume a
-#     conversation by session ID, or open interactive picker with optional
-#     search term", so only a session id is an exact resume — a title merely
-#     filters the picker. On 2026-09-11 four transcripts in one working
-#     directory carried the title `codeXfactory-1` and eight more carried
-#     `codeXfactory-1 (2)` / `(4)`, while the session Brett was actually
-#     driving carried no title at all.
-#   Rule 3 + Amendment 8 (DRAFT 2026-09-12) — THE HANDOFF IS STAMPED HERE TOO.
-#     On a resume, the handoff the row points at gets Rule 3's line, in place,
-#     as the line after its header block:
-#       RESUMED by <uuid> (lane <name>) at <UTC> — lane-start on <ws>
-#     committed on its own as `handoff(<lane>@<ws>): RESUMED by <uuid>`, with
-#     an explicit pathspec and a `Lane:` trailer (Amendment 4(d)), then pulled
-#     and pushed. It NEVER refuses the launch: a stamp that cannot be written
-#     prints the command that writes it. Seven resumes of one lane needed that
-#     line written by hand, and while it was owed the counts drifted 6/4/5
-#     across the row, the object log and the handoff itself.
-#
-# USAGE
-#   lane-start [options] <repo> <n>      # lane-start openRepoShape 2
-#   lane-start [options] <repo>-<n>      # the full lane name works too
-#   lane-start [options] <n>             # <repo> = basename of the cwd's git root
-#   lane-start --dir <path> <lane>       # any lane name, when --dir says where
-#   lane-start                           # no <repo> and no <n>: this is `lane`
-#
-# BARE, THIS IS `lane` (Amendment 18 Addendum 1 clause (i-4)): the lanes,
-# numbered, and the one you pick is bound. It renders nothing of its own — it
-# `exec`s that word, carrying `--dry-run` and `--dir`, which mean the same thing
-# there, and REFUSING by name the options `lane` has nothing to apply them to
-# rather than dropping them. On a workstation with no `lane` the old refusal is
-# still the whole answer.
-#
-# <repo> is parsed out of the lane name only because it is what locates the
-# lane's directory. With `--dir` there is nothing left to parse, so the name is
-# taken VERBATIM — which is how a lane named before the `<repo>-<n>` rule
-# (`browser-ui-repair`) is started.
-#
-# OPTIONS
-#   --dir <path>     the lane's checkout            (default $PROJECTS_ROOT/<repo>)
-#   --estate <name>  the handoff estate folder      (default <repo>)
-#   --dry-run        print every step; rename nothing, write nothing, launch
-#                    nothing
-#   --no-launch      do everything except the launch, and print the claude
-#                    command on stdout — for the launcher integration and the
-#                    tests
-#   --confirm        when this window's name is not the lane, print the three
-#                    facts that disagree — the WINDOW, the SESSION live in it,
-#                    the ROW — and ask before taking it. The launcher passes it
-#                    when the lane came from the swap RECORD rather than from
-#                    the window name or a flag (Amendment 8)
-#   --yes            answer that question yes without asking, for a caller that
-#                    has already asked
-#   --request-handoff  a lane bound in ANOTHER place is never taken (Amendment
-#                    18(b)). This is the `y` to the question this command asks
-#                    on a terminal, for a caller that has none: the request is
-#                    written to the lane's log and pushed, typed into the bound
-#                    pane where it is on this tmux server, and waited on
-#   --force <why>    clause (e)'s override: release that binding ON ITS BEHALF
-#                    and bind here. A SECOND invocation, never automatic, and
-#                    the <why> is written into an append-only log and is what
-#                    the bound session reads when it refuses every prompt from
-#                    then on
-#   --wait <s>       how long to wait for the handoff (default 300, clause (c))
-#   --agent <name>   WHICH AGENT resumes this lane (Amendment 17(c)). Default:
-#                    the agent of the lane's last `PAUSED` record, else
-#                    `claude`. `claude` with its transcript here resumes it by
-#                    id exactly as Amendment 6 has always done; every other
-#                    case launches the named agent with the handoff's TOP BLOCK
-#                    as its first prompt. The table is `claude` and `codex`; a
-#                    name it does not carry is a refusal naming the two, never a
-#                    guessed argv
-#   --fresh          A NEW SESSION of this lane's agent, primed by the handoff's
-#                    top block, whatever transcript the row names — the
-#                    fresh-session mode as an ARGUMENT rather than as an
-#                    environment variable (openRepoTools#94). The lane's own
-#                    pending restart intent outranks it; a conflicting one is a
-#                    refusal and never a substitution
-#   --operation <id> the restart operation this launch belongs to, passed by the
-#                    pane supervisor. The intent named by it is the one this run
-#                    reads; an id that is not the lane's current operation is a
-#                    refusal
-#   --bind <uuid>    THE NAME GUARD'S BINDING MODE, and nobody else's: the
-#                    guard passes it on a person's choice `2` at its offer
-#                    (Amendment 12(h) rule 2, openRepoTools#70). <uuid> is the
-#                    transcript of the session live in THIS window. It is
-#                    appended to the lane's session cell even where another row
-#                    records it — that `2` is the person's yes (clause (h) rule
-#                    4) — and the row's stamp, the lane's log line and the
-#                    handoff's Rule 3 stamp all name it, never the id this run
-#                    would otherwise have resumed. It binds or it refuses: only
-#                    with --no-launch, never with --fresh or --agent, and a
-#                    <uuid> that is not this window's live session, or a window
-#                    named for another lane, is a refusal before anything is
-#                    written
-#   -h, --help
-#   --               everything after it is passed through to claude
-#
-# WHAT IT DOES, in order
-#   1. derives LANE=<repo>-<n> and the lane's directory (which must exist);
-#   2. refuses unless it is already inside tmux: it renames the window it is
-#      run in and never creates a session;
-#   3. LIVENESS CHECK, before it takes the name. If the register already has a
-#      row for LANE it reads the session id(s) out of THE PUBLISHED row's
-#      session cell — `lanes-edit.sh register-row`, which fetches and reads
-#      `origin/<branch>` — and looks for a LIVE record (pid alive, start time
-#      still matching, a status that is not `ended`) in every profile's
-#      `sessions/*.json`. A live holder in ANOTHER tmux window is a refusal. A
-#      row whose recorded sessions are all dead is a lane you are RESUMING, and
-#      that is allowed;
-#   3b. the LIVE SESSION IN THIS WINDOW (Amendment 8), which is not the same
-#      question as step 3's. The harness mints a new transcript uuid with
-#      nobody acting — a `/clear` does it, and so did the 2026-09-12 usage
-#      reset that carried this lane's conversation into `4a91f1dc…` while its
-#      row still ended on `09dd34d1…`. That id is in NO row, so step 3 cannot
-#      see it and answers "this lane is parked" about the conversation sitting
-#      in the very window it was asked about. Keyed on the WINDOW instead
-#      (`lanes-edit.sh window-session`), the record is found: its uuid is
-#      appended to the session cell in step 5, BEFORE the stamp, and it is what
-#      this run resumes and stamps. There is no flag for it and there could not
-#      be one — the id does not exist until the session does, so the act is
-#      `lane-start --no-launch <repo> <n>` run IN that window, which is what the
-#      SessionStart hook's block tells the new session to do. (`--bind <uuid>`
-#      is the one caller already INSIDE that session — the name guard — naming
-#      it, and it is the guard's alone: see OPTIONS);
-#   3c. `--confirm`, if it was passed and this window is not already named for
-#      the lane: the triple in front of a person, and a question. Before the
-#      rename and before any write, so a No costs nothing;
-#   4. `tmux rename-window <LANE>` — which also turns automatic-rename OFF for
-#      that window (tmux(1) rename-window), so the name survives the next
-#      command the window runs. A NEW lane's name is read back, and where
-#      another window carries it too the rename is undone and the run refuses;
-#   5. the row: `lanes-edit.sh add-row` when there is none, otherwise
-#      `set-row-state`. Never a hand edit and never a whole-file write.
-#      THE STATE IS AMENDMENT 6(c)'s STAMP, written here rather than owed to
-#      the session afterwards, and since Amendment 13(a) it is the WHOLE cell
-#      (`<STATE> · <UTC> · <one line>`, the UTC stamped by the writer):
-#        LIVE · <UTC> · RESUMED by <uuid> (lane <lane>) — lane-start on <ws>:
-#        window renamed, launching <the command>; dir <dir>; window <ref>
-#      The TAIL states what happened, so a `--no-launch` run ends `window
-#      renamed, no launch` and never claims to have launched anything.
-#      `STARTED` where a new session takes the name, and the uuid is the one
-#      this run actually resumes or mints, read from the PUBLISHED row. A stamp
-#      that is owed is a stamp that is missed, and under Amendment 6(b) a missed
-#      stamp is not bookkeeping debt — it is a lost lane. A brand-new row needs
-#      no stamp: it is created with that uuid already in its session cell;
-#   6. the launch. It is DECIDED in step 5a, before the row is written, because
-#      a brand-new session's id is minted there and step 5 must record it.
-#      RESUME BEATS NEW throughout — a rename into a title that is still held
-#      mints `<LANE> (2)` and the lane loses its address. Three cases, in order:
-#        a. `exec claude --resume <id>`, where <id> is THE LAST session id in
-#           the PUBLISHED row's session cell and
-#           `<projects state>/<cwd key>/<id>.jsonl` exists. Exact: that
-#           conversation and no other.
-#        b. `exec claude --resume <LANE>` when no recorded id resolves but a
-#           transcript here carries the custom title <LANE> — or `<LANE> (N)`,
-#           which is the same lane: that suffix is what a rename into a title
-#           something else still holds mints, and the liveness check has always
-#           read it that way. THE FALLBACK, not the rule — it opens the picker
-#           filtered by the title, and several transcripts can share one title.
-#           A suffix found here is reported: it means a stale holder was live,
-#           and the cure is to retire the holders, not to live with `(4)`.
-#        c. `exec claude --name <LANE> --session-id <fresh uuid>` for a lane
-#           with no history here. The uuid is minted so the row can carry it,
-#           which is what makes (a) work on the next start.
-#
-# THE RESUME TARGET — WHY THE LAST ID, AND WHY THE PUBLISHED CELL
-#   The session cell is a HISTORY, written left to right: a lane's row reads
-#   `<first> → <after the first /clear> → <after the profile switch>`, oldest
-#   first, because each succeeding session appends itself. So the LAST session
-#   id in the cell is the lane's current one, and that is the only id this
-#   script will resume. Earlier ids are the lane's past and are never resumed
-#   (a stale lineage is precisely what went wrong on 2026-09-11).
-#
-#   AND THE CELL IS THE PUBLISHED ONE. `$LANES_FILE` is this checkout's working
-#   tree, and a `git fetch` does not move a working tree: a uuid a peer stamped
-#   from another clone and pushed is simply absent here until something pulls.
-#   Read from there, a row published as `<U1> → <U2>` still reads `<U1>` — so
-#   the operator lands in the lane's PREVIOUS conversation, the status appended
-#   to the row names the wrong id, and the RESUMED line goes into
-#   `lanes/log/<lane>.md` carrying a session uuid that is not the lane's
-#   current one, in a file nothing ever rewrites. Every other state read in
-#   this tooling goes through `origin/<branch>` after a fetch; this one does
-#   too, through the same `register-row` this script already asks before it
-#   adds a row. `live-holder`'s id set stays a UNION of both (R25) and is the
-#   one exception, for the opposite reason: liveness fails CLOSED, so an id
-#   only this checkout knows is one more reason to refuse a rename.
-#
-# KEEPING THE ROW CURRENT
-#   Resuming by a recorded id only works if the row is current, so this script
-#   makes it current where it can:
-#     * case (c), NEW ROW — the row is created with the minted id already in
-#       its session cell, instead of `pending — set by the session's first act`;
-#     * case (c), EXISTING ROW — `lanes-edit.sh append-session-id` appends
-#       `→ harness <minted id>` after the cell's last id, matching that id
-#       INSIDE THE SESSION CELL: the 6(c) stamp writes the same uuid twice more
-#       into the state cell, so a whole-row anchor (`replace-in-row`) refuses on
-#       every row this tool has already stamped — three occurrences in this
-#       estate's own `openRepoProject-1` row. When the cell has no
-#       id to append to (some rows record only `session_…` footer ids, which
-#       are not transcript ids), it prints the command and leaves the act to
-#       the session — it never guesses at the cell's text;
-#     * case (a) — nothing to do: the row already names the session being
-#       resumed;
-#     * case (b) — the id cannot be known before the picker runs, so the
-#       session stamps its own row as its first act (Amendment 6(c)).
-#   `--session-id` is set to LANE_START_SESSION_ID=0 to turn the minting off;
-#   the row then reads `pending — set by the session's first act` as before.
-#
-# WHAT COUNTS AS A SESSION ID IN THE CELL
-#   The TRANSCRIPT uuid — the name of the session's `<uuid>.jsonl` — and only
-#   that, because it is the only id `--resume` takes and the only one the
-#   liveness records key on. Some rows record a PR-FOOTER id (`session_01…`)
-#   instead; those cannot be resumed or checked, so the script names them and
-#   says the row needs the transcript uuid rather than treating the cell as
-#   empty. Every RESUMED / handoff / takeover stamp writes the transcript uuid.
-#
-# OUTPUT  every step and every refusal goes to stderr; the ONLY thing written
-#   to stdout is `--no-launch`'s command line, so `--no-launch` composes.
-#
-# EXIT
-#   0  done
-#   1  environment — not inside tmux, no tmux, a RECORDED directory that is
-#      gone, no register, or `lanes-edit.sh live-holder` failed (which is NOT
-#      the same as its answering 8, "no live session holds this lane")
-#   2  refusal — an ARGUMENT ERROR, and one further case this amendment adds: a
-#      name that is not a lane, a position that is not a position, a name a
-#      window cannot take, a lane whose register holds two rows and so resolves
-#      to none, a lane that is live in another window — and A LANE WHOSE
-#      CHECKOUT IS NOT RECORDED AND CANNOT BE PROVED (Evidence 7).
-#
-#      THAT LAST ONE MOVED FROM 1 TO 2 AND THE MOVE IS THE POINT. Evidence 7:
-#      a lane whose record predates clause (c) carries no `dir`, the default
-#      `$PROJECTS_ROOT/<repo>` did not exist, and this script exited **1**
-#      behind the launcher's `exec` — a pane that said `[exited]` with the
-#      message scrolled past it. It is a REFUSAL a person fixes with one flag,
-#      not an environment that failed, and `restart` already spends 2 on the
-#      same fact (clause (i), `R-A11-20`: *"no such lane, no recorded
-#      directory, no profile recorded yet"*). A directory the lane itself
-#      RECORDED and which is now gone keeps 1: that is a path that was right
-#      and moved, and nothing is searched for in its place.
-#
-#      A PERSON'S ANSWER IS NOT AN ARGUMENT ERROR. `--confirm` answered `N`, and
-#      `--confirm` with no tty and no `--yes` — the same answer with nobody
-#      there to give it — rename nothing, write nothing, print one notice and
-#      `exec` Claude BARE with the pass-through arguments, exit 0. A launcher
-#      that `exec`s this script would otherwise leave the operator in an exited
-#      pane with no Claude in it. Under `--no-launch` the bare command is
-#      printed on stdout, so a launcher can exec it itself.
-#
-# ENVIRONMENT
-#   PROJECTS_ROOT        default ~/projects
-#   LANES_FILE           default <the workspace repository>/lanes/LANES.md
-#   LANES_EDIT           default lanes-edit.sh beside this command
-#   AGENT_PROTOCOL_ROOT  dir holding workspace.yaml (default ~/.agents)
-#   OPENREPOTOOLS_BIN_DIR  where `--install` put the commands (default
-#                        ~/.local/bin) — searched for lanes-edit.sh
-#   CLAUDE_CONFIG_DIR    the profile whose sessions/ and projects/ are read
-#   CLAUDE_PROJECTS_DIR  default $CLAUDE_CONFIG_DIR/projects, else ~/.claude/projects
-#   CLAUDE_BIN           the Claude Code to launch. Unset, it is the absolute
-#                        path `claude-current --porcelain` answers, the one
-#                        beside this command or in $OPENREPOTOOLS_BIN_DIR and
-#                        never one on PATH: npm's published version, updated
-#                        first when every copy is behind, and a stale one
-#                        REFUSED with exit 2 before anything is written
-#                        (opensoft/workBenches#119). `claude` from PATH only
-#                        where no claude-current is installed. Set, it is a pin
-#                        and launched as it is, unless it equals
-#                        CLAUDE_RESOLVED_BIN with no CLAUDE_VERIFIED_VERSION:
-#                        that is an earlier launch's answer inherited through a
-#                        session's environment, and it is resolved again
-#   CLAUDE_RESOLVED_BIN  the path a resolution chose, exported beside CLAUDE_BIN
-#   CLAUDE_VERIFIED_VERSION  the version a launcher's own claude-current read
-#                        for CLAUDE_BIN (equal to CLAUDE_RESOLVED_BIN): recorded
-#                        as `claude <version>` on the log line, and removed
-#                        before the launch so no session inherits it
-#   CLAUDE_ALLOW_STALE=1 claude-current answers with a stale copy instead of
-#                        refusing it; docs/README-claude-current.md has the rest
-#   LANE_START_SESSION_ID  0 turns off minting a uuid for a new session (and
-#                        therefore turns off writing it into the row)
-#   LANE_START_HANDOFF_ANSWER  answers Amendment 18(c)'s question — *"ask it to
-#                        hand off, then bind here?"* — without a terminal. The
-#                        seam the tests drive it through, and its own variable
-#                        rather than `LANE_START_ANSWER`'s because one run can
-#                        ask both questions and a single seam would answer the
-#                        wrong one. Set at all, it is the answer; anything but
-#                        y/yes is No
-#   LANE_START_ANSWER    answers `--confirm`'s question without a terminal —
-#                        the seam the tests drive it through. Set at all, it is
-#                        the answer; anything but y/yes is No
-#   LANES_REPO           the checkout the register and the handoffs share
-#                        (default: the workspace repository)
-#   LANES_WORKSPACE_ROOT the workspace repository, overriding the `path:` in
-#                        ${AGENT_PROTOCOL_ROOT:-~/.agents}/workspace.yaml — the
-#                        test seam, and the only override there is
-#   LANES_BRANCH         default main — the branch the handoff stamp is pushed on
-#   LANES_GIT_TIMEOUT    seconds bounding each git call that touches the NETWORK
-#                        (default 60; 0 or a non-number turns the bound off)
-#   LANES_GIT            the git binary THOSE calls use, so a test can hand them
-#                        a git that hangs without shadowing git for the script
-#   LANES_NO_GIT=1       write the handoff's stamp but commit nothing
-#   LANE_START_FRESH=1   a NEW session of this lane's agent, started with the
-#                        top block of the handoff the row names as its first
-#                        prompt — which is what a context clear IS. It was
-#                        `/ctx`'s one seam under Amendment 17(f) and it still
-#                        works; it is NO LONGER THE AUTHORITY (openRepoTools#94):
-#                        the lane's own restart intent outranks it and `--fresh`
-#                        stands beside it, because an environment variable does
-#                        not survive the launcher's `tmux new-session` and this
-#                        command was measured being reached without it
-#
-# It spells no absolute path of its own. Since Amendment 9(a) the register is
-# found through `$AGENT_PROTOCOL_ROOT/workspace.yaml` rather than beside this
-# file — this is an installed command now, and a command's own directory is
-# evidence about the command, not about a person's data. Its WRITER is found
-# beside it, because `--install` places the two together. Everything else hangs
-# off $HOME.
-
-set -euo pipefail
-
-prog=lane-start
-
-SELF="${BASH_SOURCE[0]}"
-RESOLVED="$(readlink -f -- "$SELF" 2>/dev/null || printf '%s' "$SELF")"
-SCRIPT_DIR="$(cd -- "$(dirname -- "$RESOLVED")" && pwd)"
-
-# --- THE WORKSPACE REPOSITORY (lane-collision-protocol Amendment 9(a)) -------
-#
-# The person's data — the register `lanes/LANES.md`, the object logs
-# `lanes/log/`, the handoffs, the manifests `park` writes, and a
-# `lanes/repos.tsv` override — is found through
-# `$AGENT_PROTOCOL_ROOT/workspace.yaml`, and NEVER from this file's own
-# location. `resume:466` and `status:1673` already read that same file under
-# that same name, and Amendment 9(a) mints no second one: a second way to find
-# it is a second answer.
-#
-# Deriving it from here stopped being POSSIBLE the moment this became an
-# installed regular file in `~/.local/bin` with no register anywhere near it,
-# and it stopped being WANTED for a subtler reason: a file's location on disk
-# is evidence about the file, not about a person's data.
-#
-# THESE FOUR FUNCTIONS ARE A DELIBERATE COPY, byte for byte, across
-# `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` — the same trade
-# openRepoTools already makes for its own fetch shim (`openRepoTools:93-100`).
-# A shared `lanes-common.sh` would be a TENTH file for `--install` to place and
-# a broken helper the first time somebody copied only some of them. Each of
-# these is one file a person has on PATH.
-#
-# FAILING TO FIND IT IS A REFUSAL, NEVER A GUESS. No file, no `path:`, no
-# `repository:`, or a `path:` that is not the root of a checkout of the
-# `repository:` named beside it → the caller refuses, exit 1 — the code
-# `lanes-edit.sh` has always used for *registry not found* — with the fix
-# named: `openRepoTools wip init`. Nothing here ever creates that file, writes
-# a register, or falls back to a path derived from its own location. THE
-# CHECKOUT TEST IS NEW: nothing validated it before this, so a `path:` pointing
-# at some other repository used to be accepted and now is not.
-#
-# `LANES_WORKSPACE_ROOT` is the test seam and the only override — the seam
-# `lane-start` already spelled for handoff resolution, widened to the whole
-# question so `test_lane_helpers.sh` can point every helper at one sandbox.
-# --- BEGIN shared workspace resolver (Amendment 9(a)) ----------------------
-# BYTE-IDENTICAL IN ALL FOUR LANE HELPERS, and held there by
-# `tests/test_repo_hygiene.py`. The estate commands carry the same discipline
-# for their own estate resolver and for the same reason its guard gives: a
-# drifted copy is TWO ANSWERS to one question, and "where is this person's
-# workspace" is exactly the question Amendment 9(a) exists to give one answer
-# to. Edit it in one file and the test names the other three.
-LANES_WS_WHY=""
-
-lanes_ws_yaml() { printf '%s\n' "${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"; }
-
-# `key: value` at the TOP LEVEL only, first occurrence, with an inline `#`
-# comment and surrounding quotes stripped and a leading `~` expanded against
-# $HOME (nothing expands a bare `~` inside a file). The anchored `^key:` never
-# reaches into the INDENTED `orgs:` map, which Amendment 9(a) puts out of
-# scope: these helpers read `repository:` and `path:` and nothing else, because
-# one register in the first workspace repository is the whole rule — the
-# register never follows that map. Two lines of sed, because a YAML parser is
-# not a dependency any of these files will take for one scalar.
-lanes_ws_field() {
-  local v
-  v="$(sed -n -e "s/^$1:[[:space:]]*//p" "$2" 2>/dev/null | head -n 1 |
-    sed -e 's/[[:space:]]*#.*$//' -e 's/[[:space:]]*$//')"
-  v="${v%\"}"; v="${v#\"}"
-  v="${v%\'}"; v="${v#\'}"
-  case "$v" in
-  '~') v="$HOME" ;;
-  '~/'*) v="$HOME/${v#'~/'}" ;;
-  esac
-  printf '%s\n' "$v"
-}
-
-# THE WORKSTATION'S NAME IS READ, NEVER INVENTED — AND NEVER `hostname` INSIDE A
-# CONTAINER (lane-collision-protocol Amendment 11, ratified decision 8(d), as
-# corrected by A11 Addendum 3's `R-A11-14`).
-#
-# WHAT WENT WRONG. `opensoft/brett-wip` `origin/main` carries SIX lines in
-# `lanes/log/openRepoProject-1.md` whose workstation is a container id — five
-# `@0e7d1a79a07e`, one `@55cceb3e5bc9` — in an append-only file, written by every
-# writer inside that container and not only by Evidence 6's fork. A row on a
-# workstation that does not exist is a row no reader can match, no crossing can
-# detect and no `swapped <ws>` can answer for; and the log is never rewritten, so
-# each one is wrong for ever.
-#
-# WHO OWNS THE VALUE. `R-A11-14`: the **workBenches launcher**, which runs on the
-# host and exports `LANES_WORKSTATION=<the host's own hostname -s>` into every
-# session AND every container it starts, beside the `CLAUDE_PROFILE_NAME` it
-# already exports. These helpers READ it. They do not write it, they do not
-# derive it from a second file, and THEY NEVER SUBSTITUTE A PLACEHOLDER: an
-# `@unknown-workstation` is the same defect one field along from the `unknown`
-# clause (e) refuses in the session field, and the rejected alternative — a
-# `workstation:` key in `workspace.yaml` — is a SECOND PLACE FOR THE TRUTH TO BE
-# WRONG beside the variable the launcher already sets.
-#
-# THE THREE ANSWERS, as `<name><TAB><source>`:
-#
-#   seam              `$LANES_WORKSTATION` is set. This is the ordinary case
-#                     wherever the launcher started the session.
-#   hostname          no seam, and this is NOT a container: `hostname -s`, which
-#                     is what the seam has defaulted to since Amendment 6 and
-#                     what every row written before this rung was written by.
-#   container-unset   no seam, and this IS a container. The NAME still answers,
-#                     because a read in front of every launch may not refuse —
-#                     it will simply match nothing, which is the honest answer —
-#                     but every WRITER refuses, exit 2, naming the variable and
-#                     the launcher that sets it.
-#
-# IT ANSWERS AS A PAIR, AND THAT IS NOT A STYLE CHOICE. A caller reads the name
-# with `$(lanes_workstation)`, which is a COMMAND SUBSTITUTION and therefore a
-# subshell: a global the function set there dies with it. The source is on the
-# same line as the name, which is the only way out of a subshell there is.
-#
-#   $LANES_IN_CONTAINER   1 or 0, forcing the probe. THE TEST SEAM, and nothing
-#                         else sets it: the suite must be able to exercise both
-#                         halves of this rule on one host, and the host it runs
-#                         on is a container exactly when it is.
-lanes_in_container() {
-  case "${LANES_IN_CONTAINER:-}" in
-  1) return 0 ;;
-  0) return 1 ;;
-  esac
-  [ -e /.dockerenv ] || [ -e /run/.containerenv ]
-}
-
-lanes_workstation_pair() {
-  local v
-  if [ -n "${LANES_WORKSTATION:-}" ]; then
-    printf '%s\t%s\n' "$LANES_WORKSTATION" seam
-    return 0
-  fi
-  v="$(hostname -s 2>/dev/null || hostname 2>/dev/null || printf 'unknown')"
-  if lanes_in_container; then
-    printf '%s\t%s\n' "$v" container-unset
-  else
-    printf '%s\t%s\n' "$v" hostname
-  fi
-}
-
-# THE NAME ALONE, which is what every writer of the workstation column wants.
-lanes_workstation() { lanes_workstation_pair | cut -f1; }
-
-# The ONE SENTENCE a writer refuses with, in one place, so the three writers
-# cannot word it three ways. Empty on every other source, so
-# `[ -n "$(lanes_workstation_why "$src")" ]` is the whole of the test.
-lanes_workstation_why() {   # <source>
-  [ "${1:-}" = container-unset ] || return 0
-  printf '%s\n' "this is a container and \$LANES_WORKSTATION is not set, so there is no workstation name to write. This host's own \`hostname\` is the CONTAINER'S id, not a workstation, and a row on a workstation that does not exist is a row no reader can match — in a log nothing ever rewrites (Amendment 11, decision 8(d); R-A11-14). The value is the workBenches launcher's to export into every session and container it starts. Set it for this one and re-run: export LANES_WORKSTATION=<this host's name>"
-}
-
-# One of the spellings `git remote get-url origin` prints for one GitHub
-# repository, reduced to a bare lowercased `<owner>/<name>` so it can be
-# compared against workspace.yaml's own `<owner>/<name>`. A URL that is not
-# GitHub's is compared as it stands, lowercased — which is what lets a sandbox
-# name a bare local origin and still be checked.
-lanes_ws_norm() {
-  local u="${1%.git}"
-  case "$u" in
-  https://github.com/*) u="${u#https://github.com/}" ;;
-  ssh://git@github.com/*) u="${u#ssh://git@github.com/}" ;;
-  git@github.com:*) u="${u#git@github.com:}" ;;
-  esac
-  printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
-}
-
-# Do these two name one repository? Equal after normalisation, OR the origin's
-# path ENDS in the `<owner>/<name>` the pointer file spells — which is how a
-# GitHub Enterprise host, an ssh alias and a local bare mirror laid out by
-# owner and name all say the same thing as `https://github.com/<owner>/<name>`.
-# The pointer file spells `<owner>/<name>` because that is what a person types;
-# `git remote get-url` spells a URL because that is what git stores.
-lanes_ws_same_repo() {
-  local a b
-  a="$(lanes_ws_norm "$1")"
-  b="$(lanes_ws_norm "$2")"
-  [ -n "$a" ] && [ -n "$b" ] || return 1
-  [ "$a" = "$b" ] && return 0
-  case "$a" in */"$b") return 0 ;; esac
-  return 1
-}
-
-# Prints the workspace checkout's real root, or returns 1 having set
-# $LANES_WS_WHY to the one sentence that says which of the five ways it failed.
-# ROOT-NESS IS ITS OWN CHECK: `rev-parse --is-inside-work-tree` and
-# `remote get-url origin` both succeed from any SUBDIRECTORY of a work tree, so
-# a `path:` naming a subdirectory would otherwise be accepted and resolve
-# `<path>/lanes/LANES.md` inside the wrong directory.
-lanes_workspace_root() {
-  local yaml repo path origin toplevel real
-  LANES_WS_WHY=""
-  if [ -n "${LANES_WORKSPACE_ROOT:-}" ]; then
-    printf '%s\n' "$LANES_WORKSPACE_ROOT"
-    return 0
-  fi
-  yaml="$(lanes_ws_yaml)"
-  if [ ! -r "$yaml" ]; then
-    LANES_WS_WHY="there is no $yaml"
-    return 1
-  fi
-  repo="$(lanes_ws_field repository "$yaml")"
-  path="$(lanes_ws_field path "$yaml")"
-  if [ -z "$repo" ]; then
-    LANES_WS_WHY="$yaml names no \`repository:\`"
-    return 1
-  fi
-  if [ -z "$path" ]; then
-    LANES_WS_WHY="$yaml names no \`path:\`"
-    return 1
-  fi
-  if ! git -C "$path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    LANES_WS_WHY="$yaml names path: $path, which is not a git checkout"
-    return 1
-  fi
-  origin="$(git -C "$path" remote get-url origin 2>/dev/null || :)"
-  if ! lanes_ws_same_repo "$origin" "$repo"; then
-    LANES_WS_WHY="$yaml names repository: $repo, but $path is a checkout of ${origin:-no origin at all}"
-    return 1
-  fi
-  toplevel="$(git -C "$path" rev-parse --show-toplevel 2>/dev/null || :)"
-  real="$(cd -- "$path" 2>/dev/null && pwd -P)" || real=""
-  if [ -z "$real" ] || [ "$toplevel" != "$real" ]; then
-    LANES_WS_WHY="$yaml names path: $path, which is not the ROOT of that checkout (${toplevel:-unknown} is)"
-    return 1
-  fi
-  printf '%s\n' "$real"
-}
-
-# The refusal's body, so all four helpers say the same thing in the same words.
-#
-# THE REASON IS RE-DERIVED HERE, IN THE PARENT SHELL, and that is the whole
-# point of this line. Every caller reaches the resolver through a command
-# substitution — `LANES_WS_ROOT="$(lanes_workspace_root || :)"` — which runs it
-# in a SUBSHELL, so the $LANES_WS_WHY it set died with that subshell and the
-# parent still holds the empty string it started with. Six distinct diagnoses
-# were being computed and all six were being thrown away; every one of the
-# refusals Amendment 9(a) enumerates printed the same "no reason recorded".
-# The resolver is read-only and cheap — two `sed`s and three `git` reads — and
-# it is reached on the refusal path only, so running it again HERE is the one
-# place its answer survives to be printed.
-lanes_workspace_why() {
-  [ -n "$LANES_WS_WHY" ] || lanes_workspace_root >/dev/null 2>&1 || :
-  printf '%s' "the workspace repository could not be found — ${LANES_WS_WHY:-no reason recorded}.
-    Amendment 9(a): every lane helper reads \`repository:\` and \`path:\` from
-    $(lanes_ws_yaml), never from its own location. One command writes that
-    file, creates or clones the repository and places the symlinks:
-        openRepoTools wip init"
-}
-# --- END shared workspace resolver ------------------------------------------
-
-# THE REGISTER AND ITS WRITER, after the move (Amendment 9(b)). The register is
-# the workspace repository's `lanes/LANES.md`, found through the pointer file
-# above. The writer is `lanes-edit.sh`, which `--install` places BESIDE this
-# command — in `~/.local/bin` when installed, in the checkout when run from one
-# — so `$SCRIPT_DIR` answers both without a second rule. `$OPENREPOTOOLS_BIN_DIR`
-# and `$PATH` are the fallbacks for a command copied somewhere on its own.
-LANES_WS_ROOT=""
-if [ -z "${LANES_FILE:-}" ] || [ -z "${LANES_REPO:-}" ]; then
-  LANES_WS_ROOT="$(lanes_workspace_root || :)"
-fi
-: "${LANES_REPO:=$LANES_WS_ROOT}"
-LANES_FILE="${LANES_FILE:-${LANES_WS_ROOT:+$LANES_WS_ROOT/lanes/LANES.md}}"
-
-lanes_edit_default() {
-  local d
-  [ -x "$SCRIPT_DIR/lanes-edit.sh" ] && { printf '%s\n' "$SCRIPT_DIR/lanes-edit.sh"; return 0; }
-  d="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-  [ -x "$d/lanes-edit.sh" ] && { printf '%s\n' "$d/lanes-edit.sh"; return 0; }
-  command -v lanes-edit.sh 2>/dev/null && return 0
-  printf '%s\n' "$SCRIPT_DIR/lanes-edit.sh"
-}
-LANES_EDIT="${LANES_EDIT:-$(lanes_edit_default)}"
-
-PROJECTS_ROOT="${PROJECTS_ROOT:-$HOME/projects}"
-CLAUDE_HOME="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
-PROJECTS_STATE="${CLAUDE_PROJECTS_DIR:-$CLAUDE_HOME/projects}"
-
-# WHICH CLAUDE CODE A LAUNCH STARTS (opensoft/workBenches#119, Brett Heap
-# 2026-09-29, verbatim "for 2, we can run update on every start, this ensures
-# we have the latest models"). Decided here, from the environment as it
-# arrived, and acted on by `lane_claude_resolve_launch` below, once a launch
-# is certain: before the binding handoff, and in the bare launch a `--confirm`
-# answered No takes. Three shapes, and docs/README-claude-current.md has the
-# contract:
-#   * CLAUDE_BIN unset: resolve through `claude-current`, the one `--install`
-#     places beside this command;
-#   * CLAUDE_BIN equal to CLAUDE_RESOLVED_BIN with no CLAUDE_VERIFIED_VERSION:
-#     an earlier launch's answer, inherited through a session's environment.
-#     It is not an operator's pin, so it is resolved again;
-#   * anything else is a pin and is launched as it is. A pin that a launcher's
-#     own `claude-current` produced carries CLAUDE_VERIFIED_VERSION, which is
-#     recorded on the log line as `claude <version>`.
-# CLAUDE_VERIFIED_VERSION is read once and removed, so it never reaches the
-# session: a launch from inside that session must resolve again.
-lane_claude_version=""
-lane_claude_resolve=0
-lane_claude_checked=0
-if [ -z "${CLAUDE_BIN:-}" ]; then
-  lane_claude_resolve=1
-elif [ "$CLAUDE_BIN" = "${CLAUDE_RESOLVED_BIN:-}" ]; then
-  if [ -n "${CLAUDE_VERIFIED_VERSION:-}" ]; then
-    lane_claude_version="$CLAUDE_VERIFIED_VERSION"
-  else
-    lane_claude_resolve=1
-  fi
-fi
-unset CLAUDE_VERIFIED_VERSION
-CLAUDE_BIN="${CLAUDE_BIN:-claude}"
-
-# `claude-current` is looked for where `--install` puts it and NEVER on PATH:
-# beside this command, else in $OPENREPOTOOLS_BIN_DIR. A sandbox that copies
-# this command somewhere without it, as the lane suite does, then launches the
-# `claude` its own PATH names, and no test reaches a real npm.
-lane_claude_current() {
-  local d
-  [ -x "$SCRIPT_DIR/claude-current" ] && { printf '%s\n' "$SCRIPT_DIR/claude-current"; return 0; }
-  d="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-  [ -x "$d/claude-current" ] && { printf '%s\n' "$d/claude-current"; return 0; }
-  return 1
-}
-
-# lane_claude_resolve_launch: for a run that is to resolve (above) and is about
-# to launch, `claude-current --porcelain` names the Claude Code to start. It
-# reads npm's published version, updates the user-writable install first when
-# every copy is behind, and answers with an absolute path it has run
-# `--version` on; CLAUDE_BIN becomes that path, exported with
-# CLAUDE_RESOLVED_BIN. Its exit 2 is a refusal (every copy still behind npm)
-# and ends this run with 2; any other failure (1, nothing runnable; 64, a
-# malformed setting) ends it with 1, the environment status. Both callers come
-# before a binding handoff, window rename or transcript move, and the bare
-# launch a `--confirm` answered No
-# takes. Its stderr is the operator's and goes straight through. Never under
-# `--no-launch`, which launches nothing and is the first act INSIDE a running
-# session, and never under `--dry-run`, which must not update anything. It
-# resolves once: a second call does nothing.
-lane_claude_resolve_launch() {
-  local lcc_cmd lcc_out lcc_rc=0 lcc_line lcc_path="" lcc_version="" lcc_status=""
-  (( lane_claude_resolve )) || return 0
-  (( ! no_launch )) || return 0
-  lane_claude_resolve=0
-  if ! lcc_cmd="$(lane_claude_current)"; then
-    note "no claude-current beside this command or in ${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}, so $CLAUDE_BIN is launched as it is (through PATH, where it is a bare name), unchecked against npm; openRepoTools --install places claude-current"
-    return 0
-  fi
-  if (( dry_run )); then
-    plan "$lcc_cmd --porcelain   (chooses the Claude Code to launch; not run under --dry-run, because it may update one)"
-    return 0
-  fi
-  lcc_out="$("$lcc_cmd" --porcelain </dev/null)" || lcc_rc=$?
-  case "$lcc_rc" in
-    0) : ;;
-    2) die "claude-current refused the launch (exit 2, its reason above): the newest Claude Code installed is behind the one npm publishes. Nothing was written. CLAUDE_ALLOW_STALE=1 $prog … launches it anyway, or CLAUDE_BIN=<path> pins one." 2 ;;
-    *) die "claude-current named no Claude Code to launch (exit $lcc_rc, its reason above). Nothing was written." 1 ;;
-  esac
-  while IFS= read -r lcc_line; do
-    case "$lcc_line" in
-      path=*)    [ -n "$lcc_path" ]    || lcc_path="${lcc_line#path=}" ;;
-      version=*) [ -n "$lcc_version" ] || lcc_version="${lcc_line#version=}" ;;
-      status=*)  [ -n "$lcc_status" ]  || lcc_status="${lcc_line#status=}" ;;
-    esac
-  done <<LCC
-$lcc_out
-LCC
-  case "$lcc_path" in
-    /*) [ -f "$lcc_path" ] && [ -x "$lcc_path" ] ||
-          die "claude-current answered '$lcc_path', which is not an executable file. Nothing was written." 1 ;;
-    *) die "claude-current exited 0 without an absolute path= line (it printed '$lcc_out'). Nothing was written." 1 ;;
-  esac
-  CLAUDE_BIN="$lcc_path"
-  CLAUDE_RESOLVED_BIN="$lcc_path"
-  export CLAUDE_BIN CLAUDE_RESOLVED_BIN
-  lane_claude_version="$lcc_version"
-  lane_claude_checked=1
-  step "launching claude ${lcc_version:-of an unknown version} (${lcc_status:-no status}) at $lcc_path, as claude-current chose"
-}
-
-LS_TMP=""
-cleanup() { [ -n "${LS_TMP:-}" ] && rm -f -- "$LS_TMP"; return 0; }
-trap cleanup EXIT INT TERM
-
-note() { printf '%s: %s\n' "$prog" "$*" >&2; }
-step() { printf '%s: %s\n' "$prog" "$*" >&2; }
-plan() { printf '%s: PLAN %s\n' "$prog" "$*" >&2; }
-die()  { printf '%s: %s\n' "$prog" "$1" >&2; exit "${2:-1}"; }
-usage() { sed -n -e '1,2d' -e '/^#/!q' -e 's/^# \{0,1\}//' -e p "$RESOLVED"; }
-# EVERY ARGUMENT AS ONE SHELL WORD, WITHOUT `printf %q` AND WITHOUT A PIPE —
-# measured on the macOS job at `db206db` and `ac0c697`, where three cases of
-# this branch's own went red and no other platform could see it. One line, two
-# defects:
-#
-#   * `printf '%q '` RENDERS DIFFERENTLY UNDER BASH 3.2, which is what Apple
-#     ships and what that job runs (`/bin/bash` 3.2.57). Bash 4.4 and later
-#     give a multi-line argument back as `$'…\n…'` — one readable, runnable
-#     word; 3.2 has no such form and escapes every space and every byte of
-#     every multi-byte character with a backslash of its own. The one caller
-#     that passes a multi-line argument is the `--no-launch` print of a launch
-#     carrying the handoff's top block as its first prompt (Amendment 17(c)),
-#     and it got back neither a readable line nor a runnable one.
-#   * AND THE PIPE THROUGH `sed` MADE THAT FATAL RATHER THAN UGLY. Under
-#     `set -o pipefail` this function's status IS the pipeline's, and BSD `sed`
-#     in a UTF-8 locale (`LC_ALL=en_US.UTF-8` on that runner) refuses bytes
-#     that are not a valid sequence — `RE error: illegal byte sequence` — which
-#     is what 3.2's `%q` makes of the em dash every one of these documents is
-#     written with. `quoted` is a BARE command in the `--no-launch` branch, so
-#     `set -e` ended the command there: exit 1, and an empty stdout.
-#
-# So the quoting is this file's own, and it is the POSIX one every shell reads
-# the same way: a word of safe characters bare, anything else in single quotes
-# with its own single quotes spelled `'\''`. A newline inside single quotes IS
-# a newline, so the line stays readable as well as runnable, on either bash.
-quoted() {
-  q_sep=""
-  for q_a in "$@"; do
-    case "$q_a" in
-      '' | *[!A-Za-z0-9._/:=@%+,-]*)
-        printf "%s'%s'" "$q_sep" "${q_a//\'/\'\\\'\'}" ;;
-      *) printf '%s%s' "$q_sep" "$q_a" ;;
-    esac
-    q_sep=' '
-  done
-  return 0
-}
-
-# ------------------------------------------------------------------ arguments
-
-dry_run=0; no_launch=0; estate=""; dir_override=""; confirm=0; take_yes=0
-agent_flag=""; fresh_flag=0; op_flag=""
-# THE NAME GUARD'S BINDING MODE (openRepoTools#70) — the transcript being bound.
-bind_sid=""
-# AMENDMENT 18(c)/(e) — the three words a second place has for a bound lane.
-request_handoff=0; force_why=""; handoff_wait=300
-positional=(); pass=()
-
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --dry-run)   dry_run=1; shift ;;
-    --no-launch) no_launch=1; shift ;;
-    --confirm)   confirm=1; shift ;;
-    --yes)       take_yes=1; shift ;;
-    # AMENDMENT 17(c) — RESUME THIS LANE FROM ANY AGENT THAT CAN READ IT. A
-    # lane's state is model-neutral: the register row, the object log, the
-    # handoff with its Rule 3 resume prompt, the worktrees and branches. The
-    # transcript is ONE agent's convenience, and until this flag the only door
-    # into a lane launched `claude` and nothing else. Both spellings refuse an
-    # empty value, for the reason `--dir` states above.
-    --agent)     agent_flag="${2-}"; [ -n "$agent_flag" ] || die "--agent needs a name" 2; shift 2 ;;
-    --agent=*)   agent_flag="${1#--agent=}"; [ -n "$agent_flag" ] || die "--agent needs a name" 2; shift ;;
-    # `--fresh` — THE FRESH-SESSION MODE AS AN ARGUMENT, and it exists because
-    # the environment seam it stands beside cannot be relied on to arrive
-    # (openRepoTools#94, measured on Eagle 2026-09-15T20:59Z). `/ctx` set
-    # `LANE_START_FRESH=1` in the command it respawned the pane with, the
-    # launcher re-created the child through `tmux new-session`, and tmux hands
-    # a command the SERVER's environment and not the client's — so this
-    # command was reached with the variable gone and resumed the very
-    # transcript the context clear had just paused. An ARGUMENT survives an
-    # `exec`; it does not survive a re-creation either, which is why the
-    # DURABLE RESTART INTENT below outranks both. This flag is for the caller
-    # that reaches this command directly.
-    --fresh)     fresh_flag=1; shift ;;
-    # THE OPERATION THIS LAUNCH BELONGS TO (openRepoTools#94). The supervisor
-    # passes it so that this run reads the intent it was started for and no
-    # other, and so that a launch arriving with a STALE operation refuses
-    # rather than consuming a newer lane's intent.
-    --operation)   op_flag="${2-}"; [ -n "$op_flag" ] || die "--operation needs an operation id" 2; shift 2 ;;
-    --operation=*) op_flag="${1#--operation=}"; [ -n "$op_flag" ] || die "--operation needs an operation id" 2; shift ;;
-    # THE NAME GUARD'S BINDING MODE (openRepoTools#70). The guard's choice `2`
-    # passes the transcript it is running in, and this run stamps THAT id rather
-    # than the one the row would have resumed. What it may be combined with is
-    # decided below the loop, where every flag has been read.
-    --bind)      bind_sid="${2-}"; [ -n "$bind_sid" ] || die "--bind needs the transcript uuid of the session being bound" 2; shift 2 ;;
-    --bind=*)    bind_sid="${1#--bind=}"; [ -n "$bind_sid" ] || die "--bind needs the transcript uuid of the session being bound" 2; shift ;;
-    # AMENDMENT 18(c) AND (e) — THE SECOND PLACE'S THREE WORDS, and each of
-    # them is an ANSWER to a question this command would otherwise ask. A
-    # caller with no terminal on stdin cannot be asked (an agent's is not one),
-    # so `--request-handoff` is that `y` written down; `--force` is clause
-    # (e)'s override, which is a SECOND invocation and never automatic and
-    # which takes the WHY it writes into an append-only log; `--wait` is the
-    # clause's own default of 300 seconds, named.
-    --request-handoff) request_handoff=1; shift ;;
-    --force)     force_why="${2-}"; [ -n "$force_why" ] || die "--force takes the WHY you are taking a lane another place is bound to: it is written into that lane's append-only log and it is the sentence the bound session reads when it refuses every prompt from then on (Amendment 18(e))" 2; shift 2 ;;
-    --force=*)   force_why="${1#--force=}"; [ -n "$force_why" ] || die "--force takes the WHY you are taking a lane another place is bound to (Amendment 18(e))" 2; shift ;;
-    --wait)      handoff_wait="${2-}"; [ -n "$handoff_wait" ] || die "--wait needs a number of seconds" 2; shift 2 ;;
-    --wait=*)    handoff_wait="${1#--wait=}"; [ -n "$handoff_wait" ] || die "--wait needs a number of seconds" 2; shift ;;
-    # THE TWO SPELLINGS OF ONE FLAG GIVE ONE ANSWER, and these two did not
-    # (#26, the review of `c3ebcfe`, `lane-start:707`). `--dir ""` refuses;
-    # `--dir=` set the variable to nothing and fell through as if the operator
-    # had not named a directory at all — so the rungs below it ran, and one of
-    # them is `$PROJECTS_ROOT/<repo>`: `lane-start --dir= <repo> <n>` started in
-    # a checkout the operator had not asked for instead of refusing a path they
-    # had not given. `restart:151` — the same flag, on the sibling command —
-    # has carried the guard on both spellings all along, which is what makes
-    # this a divergence rather than a decision. Held for every flag in this
-    # estate by `test_the_two_spellings_of_a_flag_refuse_the_same_empty_value`,
-    # derived from the arms themselves rather than from a list.
-    --dir)       dir_override="${2-}"; [ -n "$dir_override" ] || die "--dir needs a path" 2; shift 2 ;;
-    --dir=*)     dir_override="${1#--dir=}"; [ -n "$dir_override" ] || die "--dir needs a path" 2; shift ;;
-    --estate)    estate="${2-}"; [ -n "$estate" ] || die "--estate needs a name" 2; shift 2 ;;
-    --estate=*)  estate="${1#--estate=}"; [ -n "$estate" ] || die "--estate needs a name" 2; shift ;;
-    -h|--help)   usage; exit 0 ;;
-    --)          shift; pass=("$@"); break ;;
-    -*)          die "unknown option '$1' — see $prog --help" 2 ;;
-    *)           positional+=("$1"); shift ;;
-  esac
-done
-
-repo=""; n=""; verbatim=""
-case "$handoff_wait" in ''|*[!0-9]*) die "--wait takes a whole number of seconds; '$handoff_wait' is not one" 2 ;; esac
-# TWO ANSWERS TO ONE QUESTION ARE NOT AN ANSWER. `--request-handoff` asks the
-# bound place to release the lane and waits for it; `--force` releases it on
-# that place's behalf without asking. Passing both says both, and which one a
-# run took would be decided by the order of two arms rather than by the person.
-[ "$request_handoff" = 1 ] && [ -n "$force_why" ] &&
-  die "--request-handoff ASKS the place that holds this lane to hand it off and waits for it; --force takes it without asking and makes that place stop loudly (Amendment 18(e)). They are two different acts on somebody else's session — pick one." 2
-# THE BINDING MODE BINDS A SESSION THAT IS ALREADY RUNNING, AND NOTHING ELSE
-# (openRepoTools#70). Its whole reason to exist is that the guard's `yes` ran
-# `--no-launch` and the row's resume path stamped `RESUMED by <the id the row
-# already had>` — a conversation nobody was in. So every combination that could
-# put a different id on that stamp is refused here, before anything is read or
-# written: a launch (the session is running; there is nothing to start), a fresh
-# session (a second answer to which session this lane is), and another agent
-# (the session being bound is the Claude one the guard is running in). These are
-# refusals, never quiet corrections: a caller that passes them has misread what
-# the mode is for.
-if [ -n "$bind_sid" ]; then
-  [[ "$bind_sid" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]] ||
-    die "--bind takes the transcript uuid of the session live in this window (the name of its <uuid>.jsonl), and '$bind_sid' is not one" 2
-  [ "$no_launch" = 1 ] ||
-    die "--bind is the name guard's binding mode: it binds the session ALREADY running in this window and launches nothing, so it is given only with --no-launch (Amendment 12(h) rule 2, openRepoTools#70)" 2
-  [ "$fresh_flag" = 0 ] ||
-    die "--bind binds the session live in this window and --fresh starts a new one: two answers to which session this lane is. Pick one." 2
-  [ -z "$agent_flag" ] ||
-    die "--bind binds the Claude session live in this window, and --agent names an agent to launch; a run that launches nothing has no agent to name" 2
-fi
-case "${#positional[@]}" in
-  2) repo="${positional[0]}"; n="${positional[1]}" ;;
-  1)
-    arg="${positional[0]}"
-    if [[ "$arg" =~ ^[0-9]+[A-Za-z]?$ ]]; then
-      n="$arg"
-    elif [[ "$arg" == *-* ]] && [[ "${arg##*-}" =~ ^[0-9]+[A-Za-z]?$ ]]; then
-      repo="${arg%-*}"; n="${arg##*-}"
-    elif [ -n "$dir_override" ]; then
-      verbatim="$arg"
-    else
-      # `lane-start <repo>` WITH NO POSITION LISTS AND SUGGESTS (Brett Heap,
-      # 2026-09-13, interactive multi-choice, verbatim "Yes, list and suggest
-      # (Recommended)"; A11 Addendum 4 ruling 6's third delta, tracked as
-      # `opensoft/openRepoTools#28`). It used to refuse with a placeholder `<n>`
-      # for the operator to translate, at the one moment they are trying to
-      # start work and do not know which positions are taken.
-      #
-      # IT RENDERS NOTHING OF ITS OWN. `lanes --prefix <repo>` is that listing
-      # and its next-free-position footer, installed beside this command by
-      # `openRepoTools --install`; a second rendering here is a second thing to
-      # drift. Where it is absent — an older workstation — the refusal below is
-      # still the whole answer, so this is an improvement and never a dependency.
-      # BESIDE THIS COMMAND FIRST, THEN PATH (Copilot round 1 on #45): the two
-      # are placed in ONE directory by `openRepoTools --install`, and a
-      # workstation carrying two copies must not render this listing out of a
-      # different version from the one it is standing in. Same rule as the bare
-      # form's `lane` below and as `lane`'s own `$LANES_EDIT`.
-      if [ -x "$SCRIPT_DIR/lanes" ]; then ls_cmd="$SCRIPT_DIR/lanes"
-      else ls_cmd="$(command -v lanes 2>/dev/null || :)"
-      fi
-      # AND THE REFUSAL PROMISES A LISTING ONLY WHERE ONE WAS MADE (#26, the
-      # review of `c3ebcfe`, `lane-start:602`). `|| :` made every code of that
-      # read the same code, and the sentence below then sent a person to "the
-      # listing above" when what was above it was `lanes`'s own refusal. `0` and
-      # `8` both PRINT one — 8 is the empty repository, whose listing is the
-      # next free position and the line that takes it — `2` is a `lanes`
-      # predating the read, which says so in its own words, and anything else is
-      # a read that FAILED. Nothing of the listing is re-rendered here on any of
-      # them: this command renders none of it (the paragraph above), the read's
-      # own output and stderr have already gone to the terminal, and what
-      # changes is only whether this refusal claims a listing it did not get.
-      ls_listed=0
-      if [ -n "$ls_cmd" ]; then
-        note "'$arg' is a repository and not a lane. Its lanes, and the position that is free:"
-        ls_rc=0
-        LANES_NO_FETCH=1 "$ls_cmd" --prefix "$arg" >&2 || ls_rc=$?
-        case "$ls_rc" in
-          0 | 8) ls_listed=1 ;;
-          2) : ;;
-          *) note "that listing FAILED (exit $ls_rc) — which is not 'this repository has no lanes', so no position is offered from it" ;;
-        esac
-      fi
-      # STILL EXIT 2, AND NOTHING IS LAUNCHED. A listing is what a person asked
-      # for; a caller that scripted `lane-start <repo>` expecting a session must
-      # not read 0 from a run that started none.
-      from_listing=" with a position from the listing above"
-      [ "$ls_listed" = 1 ] || from_listing=""
-      die "'$arg' is not a lane: a lane is <repo>-<position>, e.g. $arg-1. Run: $prog $arg <n>$from_listing, or name the checkout yourself with --dir <path> to use '$arg' as the lane name" 2
-    fi
-    ;;
-  0)
-    # BARE `lane-start` IS `lane` (Amendment 18 Addendum 1 clause (i-4),
-    # ratified 2026-09-14T14:05:54Z verbatim "ratify the addendum"): *"Bare
-    # `lane-start` — no repository, no position — is an alias of `lane`, so
-    # clause (i) as ruled still holds and there is one implementation."*
-    #
-    # IT RENDERS NOTHING OF ITS OWN, exactly as the `<repo>`-with-no-position
-    # rung above renders nothing of its own: `lane` is the listing, the numbered
-    # pick and the three branches, installed beside this command by
-    # `openRepoTools --install`. Where it is ABSENT — an older workstation — the
-    # refusal below is still the whole answer, so this is an improvement and
-    # never a dependency.
-    #
-    # `exec`, NOT A CALL: this command is itself `exec`ed by the launcher, so a
-    # pick that ends in a launch must replace this process rather than leave it
-    # waiting on a child that has replaced itself.
-    if [ -x "$SCRIPT_DIR/lane" ]; then lane_word="$SCRIPT_DIR/lane"
-    else lane_word="$(command -v lane 2>/dev/null || :)"
-    fi
-    if [ -n "$lane_word" ]; then
-      # THE OPTIONS ARE NOT DROPPED ON THE FLOOR (Copilot round 1 on #45,
-      # `lane-start:661`). This command's parser has already taken them, and an
-      # `exec` with none of them turns `--no-launch` — a flag whose whole
-      # promise is that nothing starts — into an interactive pick that launches.
-      # `--dry-run` and `--dir` mean the same thing in `lane` and go with it;
-      # every other flag here is this command's own, has no meaning for a
-      # listing that has not been answered yet, and is REFUSED BY NAME rather
-      # than ignored.
-      lane_argv=("$lane_word")
-      [ "$dry_run" = 0 ] || lane_argv+=(--dry-run)
-      [ -z "$dir_override" ] || lane_argv+=(--dir "$dir_override")
-      # AMENDMENT 18(c)/(e)'s THREE GO WITH IT, for the reason `--dry-run` and
-      # `--dir` do: they mean the same thing in `lane`, whose BOUND ELSEWHERE
-      # branch is the other door to the same request, and a flag silently
-      # dropped is a promise that was not kept.
-      [ "$request_handoff" = 0 ] || lane_argv+=(--request-handoff)
-      [ -z "$force_why" ] || lane_argv+=(--force "$force_why")
-      [ "$handoff_wait" = 300 ] || lane_argv+=(--wait "$handoff_wait")
-      ls_drop=""
-      [ "$no_launch" = 0 ] || ls_drop="$ls_drop --no-launch"
-      [ "$confirm" = 0 ]   || ls_drop="$ls_drop --confirm"
-      [ "$take_yes" = 0 ]  || ls_drop="$ls_drop --yes"
-      # AND THE VALUE GOES WITH THE FLAG THAT TOOK ONE (Copilot round 4 on #45,
-      # `lane-start:690`). `--estate` and `--` are parsed WITH their operands,
-      # and a suggested command carrying the flag and not the value is one
-      # nobody can run: `lane-start --estate x --yes` printed `lane-start <repo>
-      # <n> --estate --yes`, whose `--estate` swallows the `--yes` and names an
-      # estate `--yes`. A line printed for a person to type is a line this
-      # command has to be willing to have typed back at it.
-      # AND EACH VALUE IS QUOTED THE WAY THE SHELL WILL READ IT BACK (Copilot
-      # round 7 on #45, `lane-start:698`): `--estate 'team blue'` printed bare
-      # is two words when it is typed again, which is a suggested command that
-      # does something else. `quoted` is the same helper every other printed
-      # command in this file goes through.
-      [ -z "$estate" ]     || ls_drop="$ls_drop --estate $(quoted "$estate")"
-      [ "${#pass[@]}" = 0 ] || ls_drop="$ls_drop -- $(quoted "${pass[@]}")"
-      # AND THE LINE CARRIES THE OPTIONS THAT WERE *KEPT* TOO (Copilot round 8
-      # on #45, `lane-start:706`). The remedy was built out of the refused flags
-      # alone, so `lane-start --dir /work/repo --estate x` printed `lane-start
-      # <repo> <n> --estate x` and the checkout the person had named was gone
-      # from the line they were told to type. What is suggested is the WHOLE
-      # command they meant, not the half this rung could not take.
-      ls_keep=""
-      [ "$dry_run" = 0 ]     || ls_keep="$ls_keep --dry-run"
-      [ -z "$dir_override" ] || ls_keep="$ls_keep --dir $(quoted "$dir_override")"
-      [ "$request_handoff" = 0 ] || ls_keep="$ls_keep --request-handoff"
-      [ -z "$force_why" ]    || ls_keep="$ls_keep --force $(quoted "$force_why")"
-      [ "$handoff_wait" = 300 ] || ls_keep="$ls_keep --wait $handoff_wait"
-      if [ -n "$ls_drop" ]; then
-        die "bare \`$prog\` is \`lane\` (Amendment 18 Addendum 1 clause (i-4)), which lists the
-    lanes and binds the one you pick — and$ls_drop belongs to a lane that has
-    already been named, so there is nothing here for it to apply to. It is
-    refused rather than ignored: a flag that is silently dropped is a promise
-    that was not kept.
-      pick a lane:                    $prog
-      that lane, with those options:  $prog <repo> <n>$ls_keep$ls_drop" 2
-      fi
-      note "no <repo> and no position: this is \`lane\`, which lists the lanes and binds the one you pick (Amendment 18 Addendum 1 clause (i-4))"
-      exec "${lane_argv[@]}"
-    fi
-    usage >&2; die "a lane needs a position: $prog <repo> <n>" 2 ;;
-  *) die "too many arguments: $prog <repo> <n>" 2 ;;
-esac
-
-[ -n "$verbatim" ] || [[ "$n" =~ ^[0-9]+[A-Za-z]?$ ]] || die "'$n' is not a position — the lane form is <repo>-<position across, left to right>, e.g. 2" 2
-
-# No <repo> anywhere: the cwd's git root names it, and only its basename.
-if [ -z "$repo" ] && [ -z "$verbatim" ]; then
-  top="$(git rev-parse --show-toplevel 2>/dev/null || :)"
-  [ -n "$top" ] || die "no <repo> given and this directory is not a git checkout — run it inside the lane's checkout, or: $prog <repo> $n" 1
-  repo="$(basename -- "$top")"
-fi
-
-# ------------------------------------ AMENDMENT 15(a): `<repo>` IS A DIRECTORY
-#
-# **A lane name is one name under any case, and the register row's spelling is
-# the one it carries** (ratified 2026-09-14T00:07:18Z). The `<repo>` half of a
-# NEW lane's name has no row to take a spelling from, so it takes the CHECKOUT'S
-# REAL DIRECTORY NAME — which is the only spelling on this workstation that is a
-# fact rather than a habit, and the one every later reader of the lane's `dir`
-# and `$PROJECTS_ROOT/<repo>` rung will meet.
-#
-# TWO DIRECTORIES DIFFERING ONLY BY CASE ARE A REFUSAL NAMING BOTH. On a
-# case-insensitive filesystem — macOS — they cannot both exist and this never
-# fires; on Linux they can, and choosing one of them is choosing which
-# repository the lane is in.
-#
-# `ls` and ONE awk rather than a `tr` per entry: this sits in front of a launch,
-# `$PROJECTS_ROOT` holds a few dozen directories, and the `[ -d ]` below runs
-# only for the names that already matched. The `--` stays for the reason
-# `lanes-edit.sh`'s twin scan carries in full (`log_files_named_ci`; Copilot
-# round 3 on openRepoTools#41, declined with a measurement): BSD `ls` ends its
-# options at `--` like every other POSIX utility, and the step line this
-# function produces — `repo repocase → repoCase` — is asserted on the macOS job,
-# where an `ls` that refused `--` would leave it silent.
-projects_dir_matches() {   # <typed repo>
-  ls -- "$PROJECTS_ROOT" 2>/dev/null |
-    awk -v want="$1" 'BEGIN { w = tolower(want) } tolower($0) == w { print }' |
-    while IFS= read -r pdm_m; do
-      [ -d "$PROJECTS_ROOT/$pdm_m" ] && printf '%s\n' "$pdm_m"
-    done
-}
-if [ -n "$repo" ] && [ -d "$PROJECTS_ROOT" ]; then
-  repo_hits="$(projects_dir_matches "$repo" || :)"
-  repo_hit_n=0
-  if [ -n "$repo_hits" ]; then repo_hit_n="$(printf '%s\n' "$repo_hits" | grep -c . || :)"; fi
-  # THE REFUSAL IS FOR A RUN THAT HAS NO OTHER ANSWER, AND `--dir` IS THE OTHER
-  # ANSWER. Its own remedy names `--dir <path>`, so refusing a run that already
-  # passed one is refusing the fix it printed: `lane-start --dir /chosen repotwin
-  # 1` was rejected before the rung that honours the flag (Copilot round 1 on
-  # openRepoTools#41). With the checkout named, the ambiguity that is left is
-  # only about the lane-s NAME, which keeps the spelling that was typed and is
-  # then overruled by the register row-s a few lines below — so this SAYS what
-  # it did not resolve and carries on.
-  if [ "$repo_hit_n" -gt 1 ] && [ -z "$dir_override" ]; then
-    die "$PROJECTS_ROOT holds $repo_hit_n directories whose names differ only by case for '$repo': $(printf '%s\n' "$repo_hits" | tr '\n' ' ')— a lane name is ONE name under any case (Amendment 15(a)), so there is no spelling of '$repo' this can take without choosing which repository the lane is in. Name the checkout yourself with --dir <path>, or rename one of those directories." 2
-  fi
-  if [ "$repo_hit_n" -gt 1 ]; then
-    note "$PROJECTS_ROOT holds $repo_hit_n directories whose names differ only by case for '$repo': $(printf '%s\n' "$repo_hits" | tr '\n' ' ')— --dir has named the checkout, so this run is not ambiguous about WHERE the lane is. Its NAME keeps the '$repo' you typed, and the register row's own spelling wins over that below (Amendment 15(a))."
-  fi
-  if [ "$repo_hit_n" = 1 ] && [ "$repo_hits" != "$repo" ]; then
-    step "repo $repo → $repo_hits (Amendment 15(a): the checkout's real directory name under $PROJECTS_ROOT)"
-    repo="$repo_hits"
-  fi
-fi
-
-LANE="${verbatim:-$repo-$n}"
-[[ "$LANE" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] || die "'$LANE' is not usable as a window and session name (allowed: letters, digits, . _ -)" 2
-
-# The position after this one, for the refusal to name. `10#` because a lane
-# may be `-08` and 08 is not a number in base 8.
-if [[ "$n" =~ ^[0-9]+$ ]]; then next_n="$((10#$n + 1))"; else next_n="<the next free position>"; fi
-
-if [ -z "${LANES_FILE:-}" ]; then die "$(lanes_workspace_why)" 1; fi
-[ -f "$LANES_FILE" ] || die "no register at $LANES_FILE — the workspace repository $(lanes_ws_yaml) names carries no lanes/LANES.md. \`openRepoTools wip init\` seeds one (it is idempotent); or set LANES_FILE" 1
-[ -x "$LANES_EDIT" ] || die "no register writer at $LANES_EDIT — \`lanes-edit.sh\` is installed beside this command by \`openRepoTools --install\`. Run that, or set LANES_EDIT" 1
-
-# ------------------------- AMENDMENT 15: THE ROW'S SPELLING IS THE LANE'S NAME
-#
-# The row wins over the directory, and over what was typed: it is what the
-# window is renamed to (step 4), what `--name`s every launch branch (step 5a),
-# what the row stamp and the object log carry, and what the log file is called.
-# `--verbatim` lanes come through here too — `browser-ui-repair` is a row like
-# any other and a `lane-start Browser-UI-Repair` is that lane.
-#
-# ONE RESOLVER, SHARED. `lanes-edit.sh canon-lane` is the same read `lane-end`,
-# `lanes` and `restart` make, for the reason clause (h) gives every other read
-# in this toolset: an implementation of "which row is this name's" in each
-# command is how they would come to disagree about it.
-#
-# 2 IS TWO ANSWERS AND THE REFUSAL IS THE ONE THAT MATTERS (Copilot round 4 on
-# openRepoTools#41). It is the code a helper predating this amendment spends on
-# an unknown subcommand — every workstation until adoption reaches it — and it is
-# ALSO `canon-lane`'s own two-rows refusal. Carrying on from both was written
-# here on the reading that the refusal is one this script makes again forty lines
-# below out of its own read of the register; that read is `$LANES_FILE`, THE
-# WORKING TREE, and the register this refusal is about is `origin/<branch>`. On a
-# checkout that is behind, the pair is published and this file holds one row: the
-# local scan passes, and what the operator gets is the stderr-suppressed
-# `register-row` read below turning the SAME refusal into a generic exit 1 that
-# names neither spelling. So the refusal is asked for by its own words — no old
-# helper emits them from an unknown subcommand — and relayed, with the fallback
-# for a genuinely old helper left exactly as it was.
-cl_out=""; cl_rc=0
-cl_out="$("$LANES_EDIT" canon-lane "$LANE" 2>/dev/null)" || cl_rc=$?
-cl_why=""; cl_pair=0
-case "$cl_rc" in 2 | 66) cl_why="$(LANES_NO_FETCH=1 "$LANES_EDIT" canon-lane "$LANE" 2>&1 >/dev/null || :)" ;; esac
-case "$cl_why" in *"Amendment 15(d)"*) cl_pair=1 ;; esac
-case "$cl_rc" in
-  0)
-    if [ -n "$cl_out" ] && [ "$cl_out" != "$LANE" ]; then
-      step "lane $LANE → $cl_out (Amendment 15: the register row's spelling is canonical)"
-      LANE="$cl_out"
-    fi ;;
-  2)
-    if [ "$cl_pair" = 1 ]; then
-      printf '%s\n' "$cl_why" >&2
-      die "the PUBLISHED register spells lane $LANE two ways (above), so no read and no write under that name is unambiguous and nothing here picks one — Amendment 15(d): merge the newer row's session id(s) into the older row's session cell, in order, remove the newer row in the SAME commit naming both spellings, push, and re-run. Nothing was launched, renamed or written." 2
-    fi ;;
-  66)
-    # AMENDMENT 16(e) — THE ALIAS TABLE COULD NOT BE READ, AND THAT IS NOT A
-    # SPELLING QUESTION (Copilot round 4 on openRepoTools#81). `lanes/aliases.tsv`
-    # is what makes a lane's OLD name resolve to its row, so a table nobody can
-    # read makes a RENAMED lane look like a lane nobody has — and the next line
-    # of this command is the one that decides whether to add a row. Carrying on
-    # with the typed name there is a SECOND row for a lane that has been running
-    # all day, which is the duplicate Amendment 15(a) exists to refuse.
-    printf '%s\n' "$cl_why" >&2
-    die "lane $LANE's name could not be resolved: ${LANES_EDIT##*/} could not read the lane alias table (above, exit 66). Amendment 16(e) makes a renamed lane's old name resolve through that file for ever, so a name it cannot answer for may be a lane that is already running under another one — and this command would add a second row for it. Fix the read and re-run. Nothing was launched, renamed or written." 2 ;;
-  *) note "$LANES_EDIT canon-lane $LANE failed (exit $cl_rc) — carrying on with the name as typed, which the register may spell differently" ;;
-esac
-
-repo="${repo:-$LANE}"          # the verbatim form has no <repo> of its own
-estate="${estate:-$repo}"
-
-# ----------------------------------------- 1b. THE LANE'S DIRECTORY
-#
-# AMENDMENT 11 CLAUSE (c). A lane's checkout is known to every process that is
-# IN it and to nothing that is about to start one, and Evidence 2 turned that
-# into a restart that printed `[exited]`: `openXfactory-5`'s checkout is
-# `~/projects/xFactory/openxFactory`, this script derived `$PROJECTS_ROOT/<repo>`
-# and died here, and the launcher had no `--dir` to pass. Evidence 3 made it
-# worse and quieter — a restart started from `/workspace` came up WITHOUT the
-# repository's `CLAUDE.md` and without the lane's memory, because the harness
-# keys a session to the directory it was started in, while `--resume <uuid>`
-# went on continuing the transcript under the repository's own project folder.
-# So the directory is READ FROM THE LANE'S OWN RECORD, and this script `cd`s
-# into it before it launches (step 6).
-#
-# SIX RUNGS, FIRST ANSWER WINS, and clause (c) states them here rather than
-# leaving them to an implementation because the launcher draft that read the
-# first text of that clause invented one of its own:
-#
-#   1. `--dir <path>` — the operator's word. NOT tested for existence at this
-#      rung: the refusal below names the path and the flag that fixes it, and a
-#      script that silently dropped what it was told would hide that.
-#   2. the SWAP RECORD's `dir` for this lane — `swapped`'s fourth tab-separated
-#      field (clause (h)).
-#   3. the LANE'S LOG — `lanes-edit.sh lane-dir <lane>`, the `dir ` sub-field of
-#      its last lane-kind line carrying one.
-#   4. `$PROJECTS_ROOT/<repo>` — the default, and ONLY the default for a lane
-#      that has never been started under this amendment.
-#   5. THE ESTATE'S `project.yaml` LEGS, and
-#   6. A CHECKOUT NAMED FOR THE HOME'S REPOSITORY one or two levels under
-#      `$PROJECTS_ROOT` — both added for Evidence 7, both PROVED by the
-#      candidate's own `origin` against the lane's recorded home, and both
-#      STATED IN FULL beside the code that implements them a hundred lines
-#      below rather than a second time here.
-#
-# THEY WERE FOUR UNTIL EVIDENCE 7 AND THIS BLOCK WENT ON SAYING SO (#26, the
-# review of `c3ebcfe`, `lane-start:780`). `708395e` added rungs 5 and 6 to this
-# file; `2f44da0` corrected the MANUAL's count to six. The contract THE CODE
-# CARRIES still said "FOUR RUNGS" and "THERE IS NO FIFTH RUNG" a hundred lines
-# above the two rungs it had grown — which makes the code below look
-# unreachable to its next reader, and the one act that reading invites is
-# deleting it.
-#
-# WHAT THAT SENTENCE RULED OUT IS UNCHANGED, AND IT WAS NEVER A COUNT: THE
-# CWD'S OWN CHECKOUT IS RULED OUT BY NAME. Deriving the directory from the
-# directory the operator happens to be standing in is an inference, and this
-# script writes the lane's HOME into its Amendment 7 `STARTED` line from that
-# directory's `origin`, which every `#n` the lane afterwards writes inherits. An
-# inference that can silently re-home a lane is not worth the refusal it saves;
-# the refusal names `--dir`, and `--dir` is one word. Rungs 5 and 6 are not that
-# inference and cannot decay into it: every candidate is PROVED by its own
-# `origin` against the recorded home, one that fails the proof is passed over,
-# and both are skipped entirely for a lane with no recorded home to prove it
-# against.
-#
-# EVERY READ FAILS TO THE NEXT RUNG AND NEVER TO A REFUSAL. Amendment 7(d)'s
-# fail-closed rule says a read that could not run must never be taken for
-# "nothing to report"; it does not say the rungs below it stop answering. 8 is
-# no answer, 2 is a helper predating Amendment 11 — expected and silent, told
-# from a caller's bug by the helper's own words rather than by its status —
-# and anything else is named once and then carried past.
-# `owner/repo` out of a checkout's `origin`. DEFINED HERE rather than beside
-# its first old caller, because Evidence 7's two rungs are the FIRST callers
-# and they run four hundred lines earlier; a function defined after its call
-# site is a function that is not there yet.
-origin_nwo() {
-  local url nwo
-  url="$(git -C "$1" remote get-url origin 2>/dev/null || :)"
-  [ -n "$url" ] || return 1
-  nwo="$(printf '%s\n' "$url" | sed -E 's#\.git$##; s#^git@[^:]+:##; s#^ssh://[^/]+/##; s#^https?://[^/]+/##')"
-  [[ "$nwo" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || return 1
-  printf '%s\n' "$nwo"
-}
-
-# A CANDIDATE IS PROVED BY ITS OWN `origin`, NEVER BY ITS NAME. Both of the two
-# rungs Evidence 7 adds hand every candidate through here, and a candidate whose
-# origin is not the lane's recorded home is not taken — which is what keeps them
-# rungs rather than the inference clause (c) rules out by name.
-lane_dir_is_home() {   # <candidate dir> <owner/repo the record names>
-  ldh_o="$(origin_nwo "$1" 2>/dev/null || :)"
-  [ -n "$ldh_o" ] || return 1
-  ldh_c="$("$LANES_EDIT" resolve-repo "$ldh_o" 2>/dev/null || :)"
-  [ -n "$ldh_c" ] && ldh_o="$ldh_c"
-  [ "$(printf '%s' "$ldh_o" | tr 'A-Z' 'a-z')" = "$(printf '%s' "$2" | tr 'A-Z' 'a-z')" ]
-}
-
-DIR=""; DIR_SOURCE=""; DIR_DEFAULT_TRIED=""
-if [ -n "$dir_override" ]; then
-  DIR="$dir_override"; DIR_SOURCE="--dir"
-fi
-if [ -z "$DIR" ]; then
-  ld_out=""; ld_rc=0
-  ld_out="$("$LANES_EDIT" swapped 2>/dev/null)" || ld_rc=$?
-  case "$ld_rc" in
-    0)
-      ld_row="$(printf '%s\n' "$ld_out" | awk -F'\t' -v l="$LANE" 'tolower($1) == tolower(l) { print; exit }')"
-      if [ -n "$ld_row" ]; then
-        ld_cand="$(printf '%s' "$ld_row" | cut -f4)"
-        case "$ld_cand" in
-          /*) DIR="$ld_cand"; DIR_SOURCE="the swap record" ;;
-        esac
-      fi ;;
-    8|2) : ;;
-    *) note "$LANES_EDIT swapped failed (exit $ld_rc) — carrying on to the lane's log for its directory" ;;
-  esac
-fi
-if [ -z "$DIR" ]; then
-  ld_out=""; ld_rc=0
-  ld_out="$("$LANES_EDIT" lane-dir "$LANE" 2>/dev/null)" || ld_rc=$?
-  case "$ld_rc" in
-    0) case "$ld_out" in /*) DIR="$ld_out"; DIR_SOURCE="the lane's log" ;; esac ;;
-    8|2) : ;;
-    *) note "$LANES_EDIT lane-dir $LANE failed (exit $ld_rc) — carrying on to the default for its directory" ;;
-  esac
-fi
-# A DIRECTORY THAT WAS RECORDED AND IS GONE IS ITS OWN FAILURE, and it keeps
-# its own code. Rungs 1 to 3 are the operator's word and the lane's own record:
-# where one of them answered and the path is not there, the path is NAMED and
-# `--dir` is named beside it, and nothing below this line runs — searching for a
-# substitute for a directory the lane itself recorded is the silent re-home
-# clause (c) rules out. Evidence 7's case is the OTHER one: no rung answered at
-# all, `$DIR` is still empty here, and rungs 5 and 6 are what that case reaches.
-if [ -n "$DIR" ] && [ ! -d "$DIR" ]; then
-  die "no such directory: $DIR (from $DIR_SOURCE) — pass --dir <path> if this lane's checkout is somewhere else" 1
-fi
-if [ -z "$DIR" ]; then
-  if [ -d "$PROJECTS_ROOT/$repo" ]; then
-    DIR="$PROJECTS_ROOT/$repo"; DIR_SOURCE="the default \$PROJECTS_ROOT/<repo>"
-  else
-    DIR_DEFAULT_TRIED="$PROJECTS_ROOT/$repo"
-  fi
-fi
-
-# ------------------------------------- EVIDENCE 7: THE LANE WHOSE CHECKOUT IS
-#                                       NESTED, AND WHOSE RECORD PREDATES `dir`
-#
-# Measured 2026-09-13T23:01Z and reported by Brett Heap
-# (`brettheap/new-workstation#20`, comment 5656793094). `pclaude team03m`
-# auto-selected the saved lane `opsXfactory-5` from its swap record, the
-# launcher handed a bare lane name to this script, rung 4 derived
-# `~/projects/opsXfactory` — which does not exist — and this script **exited 1
-# before Claude started**, leaving a pane that said `[exited]`. The lane's real
-# checkout is `~/projects/xFactory/xFactories/OpsxFactory`. Its own record could
-# not help: its `STARTED`/`RESUMED` lines carry `home opensoft/OpsxFactory;
-# estate xFactory` and its `PAUSED` swap line carries `window …; workstation
-# docker-desktop`, and **no `dir`** — the field this amendment adds, which
-# nothing backfills (Amendment 7(i)).
-#
-# TWO RUNGS BEFORE THE REFUSAL, AND NEITHER IS AN INFERENCE. Rungs 5 and 6 are
-# both proved by the candidate's own `origin` against the lane's RECORDED HOME,
-# so what they find is the checkout of the lane's own repository and not "a
-# directory that merely has the right name". That distinction is the whole of
-# why clause (c) rules the cwd's checkout out by name: this script writes the
-# lane's home from the directory's `origin`, and a wrong directory silently
-# re-homes the lane. A directory whose origin IS the recorded home cannot.
-#
-#   5. THE ESTATE'S `project.yaml` LEGS. openRepoShape's manifest is a top-level
-#      `legs:` list of `repository:` / `path:`, and Amendment 7 decision 3
-#      treats legs as home. Where a manifest names the lane's home as a leg, the
-#      leg's `path` resolved against that manifest's directory IS the checkout,
-#      declared rather than searched for.
-#   6. A CHECKOUT NAMED FOR THE HOME'S REPOSITORY, one or two levels under
-#      `$PROJECTS_ROOT` — the two depths the estate actually uses and the same
-#      two `same_project` globs for manifests. `opsXfactory` the lane label and
-#      `OpsxFactory` the repository are not the same string, which is why the
-#      NAME comes from the alias table's own canonical spelling
-#      (`resolve-repo`) rather than from the lane's label.
-#
-# BOTH ARE SKIPPED ENTIRELY WHERE THE LANE HAS NO RECORDED HOME, because there
-# is then nothing to prove a candidate against and a match would be a guess.
-if [ -z "$DIR" ]; then
-  ls_home=""; ls_rc=0
-  ls_home="$("$LANES_EDIT" resolve-home "$LANE" 2>/dev/null)" || ls_rc=$?
-  [ "$ls_rc" = 0 ] || ls_home=""
-  case "$ls_home" in */*) : ;; *) ls_home="" ;; esac
-fi
-# Rung 5 — the legs.
-if [ -z "$DIR" ] && [ -n "$ls_home" ]; then
-  for ls_m in "$PROJECTS_ROOT"/*/project.yaml "$PROJECTS_ROOT"/*/*/project.yaml; do
-    [ -f "$ls_m" ] || continue
-    # ONLY `repository:` AND `path:`, and only as navigation: the manifest says
-    # of itself that it CONFERS NOTHING, and `role:` is never read here. This is
-    # the SECOND reader of `legs[]` in this toolset — `lanes-edit.sh`'s
-    # `project_legs_file` is the first — and it exists because that one answers
-    # with repositories alone and no read in clause (h)'s table carries a leg's
-    # PATH. Naming the duplication is the honest half of it.
-    ls_cand="$(awk -v want="$ls_home" '
-      /^[A-Za-z_][A-Za-z0-9_]*:/ { inlegs = ($0 ~ /^legs:/); repo = ""; path = ""; next }
-      !inlegs { next }
-      /^[ \t]*-[ \t]/ { repo = ""; path = "" }
-      /^[ \t]+repository:[ \t]*/ { v = $0; sub(/^[ \t]+repository:[ \t]*/, "", v)
-        sub(/[ \t]+$/, "", v); gsub(/^"|"$/, "", v); gsub(/^'"'"'|'"'"'$/, "", v); repo = v }
-      /^[ \t]+path:[ \t]*/ { v = $0; sub(/^[ \t]+path:[ \t]*/, "", v)
-        sub(/[ \t]+$/, "", v); gsub(/^"|"$/, "", v); gsub(/^'"'"'|'"'"'$/, "", v); path = v }
-      repo != "" && path != "" && tolower(repo) == tolower(want) { print path; exit }' "$ls_m" 2>/dev/null || :)"
-    [ -n "$ls_cand" ] || continue
-    ls_dir="$(dirname -- "$ls_m")"
-    case "$ls_cand" in .) ls_try="$ls_dir" ;; /*) ls_try="$ls_cand" ;; *) ls_try="$ls_dir/$ls_cand" ;; esac
-    [ -d "$ls_try" ] || continue
-    lane_dir_is_home "$ls_try" "$ls_home" || continue
-    DIR="$ls_try"; DIR_SOURCE="the legs of ${ls_m#$PROJECTS_ROOT/} (Evidence 7)"
-    break
-  done
-fi
-# Rung 6 — a checkout named for the repository, proved by its origin.
-if [ -z "$DIR" ] && [ -n "$ls_home" ]; then
-  ls_name="${ls_home#*/}"
-  for ls_try in "$PROJECTS_ROOT/$ls_name" "$PROJECTS_ROOT"/*/"$ls_name" "$PROJECTS_ROOT"/*/*/"$ls_name"; do
-    [ -d "$ls_try" ] || continue
-    lane_dir_is_home "$ls_try" "$ls_home" || continue
-    DIR="$ls_try"; DIR_SOURCE="the checkout of $ls_home under \$PROJECTS_ROOT (Evidence 7)"
-    break
-  done
-fi
-
-# THE REFUSAL IS A REFUSAL (exit 2) AND NOT AN ENVIRONMENT FAILURE (exit 1), and
-# it is ONE LINE a person can type. Evidence 7's whole cost was that this was a
-# `1` behind an `exec`: a pane that said `[exited]` and a message nobody read.
-# `restart` already spends 2 on exactly this case — *"no such lane, no recorded
-# directory, no profile recorded yet"* (clause (i), `R-A11-20`) — so after this
-# the two commands answer the same way about the same fact.
-if [ -z "$DIR" ]; then
-  # EVERY PIECE OF THIS MESSAGE IS BUILT OUT HERE, and that is this file's own
-  # rule rather than a style: an apostrophe inside a `${var:-…}` expansion is
-  # parsed by bash as a QUOTE and not as prose, and the whole script then fails
-  # to parse. `restart` carries the same warning over the same kind of hint.
-  ls_where="$PROJECTS_ROOT/$repo"
-  [ -z "$DIR_DEFAULT_TRIED" ] || ls_where="$DIR_DEFAULT_TRIED"
-  ls_pos="${LANE##*-}"
-  if [ -n "$ls_home" ]; then
-    ls_tried="the default $ls_where, the project.yaml legs of $ls_home, and a checkout of $ls_home one or two levels under $PROJECTS_ROOT"
-  else
-    ls_tried="the default $ls_where. This lane has no home on record either, so there was nothing to prove a candidate against"
-  fi
-  die "lane $LANE has no recorded checkout and none could be PROVED, so nothing was started.
-    Tried: $ls_tried.
-    Name it once, and every later start reads it back out of the lane's own log:
-      lane-start --dir <path> $repo $ls_pos
-    Nothing here guesses. This script writes the lane HOME from the directory's
-    origin, and a directory that merely has the right name would re-home the lane
-    for every \`#n\` it writes afterwards (Amendment 11 clause (c); Evidence 7,
-    brettheap/new-workstation#20 comment 5656793094)." 2
-fi
-DIR="$(cd -- "$DIR" && pwd)"
-DIR_REAL="$(cd -- "$DIR" && pwd -P)"
-[ "$DIR_SOURCE" = "--dir" ] || step "dir $DIR, from $DIR_SOURCE (Amendment 11 clause (c))"
-
-# THE DIRECTORY THIS SCRIPT IS ABOUT TO RECORD MUST BE READABLE BACK OUT OF THE
-# LINE THAT RECORDS IT (clause (c), and Amendment 8(b)'s same refusal for
-# `window`). `, ` and ` — ` are what divide an event line into its fields and
-# its free text, `; ` is what divides the payload's SUB-FIELDS from each other,
-# and a `"` is what clause (c) uses to make a path with a space ONE ref under
-# Amendment 7(b)'s grammar — so a path carrying any of the four is REFUSED,
-# naming the path, rather than truncated, escaped or appended. A log whose own
-# parser cannot read a line is a log that has lost the fact.
-#
-# `; ` WAS THE ONE THIS FENCE DID NOT HAVE, and clause (c) names it in the same
-# breath as the other two: *"A value containing `, `, ` — ` or `; ` is refused,
-# exit 2, naming it — not truncated, not escaped, and not appended."* The
-# `/lane-swap` skill, the other writer the clause names, has refused all three
-# since `68614bf`; this one refused two of them and the quoting does NOT cover
-# the gap. `payload_subfield` splits on `; ` BEFORE it honours a quote
-# (`lanes-edit.sh:payload_subfield`), so `dir "/p/a; b"` — quoted, because it
-# carries a space — splits into `dir "/p/a` and `b"`, and `lane-dir` answers
-# `"/p/a`: a path that is wrong, carries a quote mark, and was never written by
-# anyone. That is Evidence 3's failure exactly, in a file nothing rewrites.
-case "$DIR" in
-  *', '*|*' — '*|*'; '*|*'"'*)
-    die "this lane's directory is $DIR, and a \`dir\` sub-field may not contain ', ', ' — ', '; ' or '\"': those are what divide an event line into its fields, its sub-fields and its free text, and the log is append-only, so a line written wrong there is wrong for ever. Move the checkout, or start the lane with --dir <a path without them>" 2 ;;
-esac
-
-# THIS LANE'S OWN ARGUMENTS, so no hint this script prints ever hands a reader a
-# `<repo> <n>` to translate while the script holds both (F-B6's rule, on this
-# side of the seam). A lane named before the `<repo>-<position>` rule has no
-# position to print and is started through `--dir`, exactly as it was here.
-if [ -n "$n" ]; then self_args="$repo $n"; else self_args="--dir $DIR $LANE"; fi
-
-step "lane $LANE · dir $DIR · estate $estate"
-
-# ----------------------------------------------------------------- 2. in tmux
-
-[ -n "${TMUX:-}" ] || die "run this inside the tmux window that will carry the lane — it renames that window and never creates a tmux session" 1
-command -v tmux >/dev/null 2>&1 || die "tmux is not on PATH, but \$TMUX is set — this environment is inconsistent" 1
-this_window="$(tmux display-message -p '#{session_name}:#{window_id}' 2>/dev/null || :)"
-[ -n "$this_window" ] || die "tmux did not answer display-message — cannot tell which window this is" 1
-this_window_name="$(tmux display-message -p '#W' 2>/dev/null || :)"
-# AMENDMENT 11 CLAUSE (c) — THE WINDOW SUB-FIELD IS `<tmux session>:<window
-# index> <@window id>`, TWO SPACE-SEPARATED REFS IN ONE SUB-FIELD, and neither
-# of them is the `<session>:<@id>` above. That one is the harness's own `tmux`
-# spelling and is what `window-session` matches a session record on; the
-# record's refs are a person's `<session>:<index>` and tmux's own `<@id>`,
-# which is what clause (b)'s precedence 3 and clause (h)'s `window-lane` match.
-# Reading one for the other is how a record would name a window nothing can
-# resolve, so both are captured here, from tmux, and neither is derived from
-# the other.
-this_window_ref="$(tmux display-message -p '#{session_name}:#{window_index}' 2>/dev/null || :)"
-this_window_id="$(tmux display-message -p '#{window_id}' 2>/dev/null || :)"
-record_window="$this_window_ref"
-# THE ID IS WRITTEN WHERE ONE IS KNOWABLE AND THE SUB-FIELD IS THE REF ALONE
-# WHERE IT IS NOT: a record with no id is COMPLETE, because the NAME is the key
-# (clause (b)) and the id is information (ratified decision 5). A tmux server
-# restart, a workstation reboot or a swap taken from a terminal that is then
-# closed all leave a recorded id naming nothing, and a binding keyed on the id
-# would lose the lane where one keyed on the name does not.
-# AND AN ID IS `@<digits>` AND NOTHING ELSE (F-X13(a)). `@*` accepted anything
-# that merely STARTED with an at-sign, and two things that are not ids do: a
-# tmux too old to know `#{window_id}` PRINTS THE FORMAT BACK, and a shim on
-# PATH may print anything at all. Either one recorded here is a lie in an
-# append-only log — and worse than an absence, because the sub-field would then
-# name a window `window-lane` can never resolve while looking complete.
-# `claude-profile` makes exactly this check on exactly this value
-# (`workBenches#71`'s `lane-swap` skill, `:239-240`: `[[ "$win_id" =~
-# ^@[0-9]+$ ]]`), and two writers of one field with two standards is the drift
-# this branch removes everywhere else.
-#
-# Written as a `case` rather than `[[ =~ ]]` to match this file's own style for
-# this test: `@` alone is not an id, and `@` followed by any non-digit is not
-# one either.
-case "$this_window_id" in
-  @) : ;;
-  @*[!0-9]*) : ;;
-  @*) record_window="$this_window_ref $this_window_id" ;;
-esac
-case "$record_window" in
-  *', '*|*' — '*|*'"'*)
-    die "this window's tmux refs are '$record_window', and a \`window\` sub-field may not contain ', ', ' — ' or '\"' (Amendment 8(b), extended by Amendment 11 clause (c) to \`dir\`): those are what divide an event line into its fields and its free text, and the log is append-only. Rename the tmux session" 2 ;;
-esac
-step "this window is $this_window, named '${this_window_name:-?}'"
-step "  its record refs are $record_window"
-
-# Active restarts refuse unowned callers before any binding repair or rename.
-# Detailed prompt and launch-fact validation follows before transcript writes.
-preparation_failure_identity=""
-preparation_failure_snapshot() {   # validated restart-intent output
-  printf '%s\n' "$1" | awk -F'\t' '
-    {v[$1]=$2} END {printf "%s|%s|%s|%s|%s|%s", v["state"],v["mode"],v["attempt"],v["new_transcript"],v["operation"],v["generation"]}'
-}
-preparation_failure_resume_check() {   # validated restart-intent output
-  pfr_identity="$(preparation_failure_snapshot "$1")"
-  case "$pfr_identity" in failed\|preservation-only\|0\|none\|*) : ;;
-    *) die "a failed supervised launch requires its same-operation supervisor; ordinary resume refuses. Nothing was launched." 2 ;;
-  esac
-  [ -z "$preparation_failure_identity" ] || [ "$pfr_identity" = "$preparation_failure_identity" ] ||
-    die "the failed preparation changed during ordinary recovery. Nothing was launched." 2
-  [ -z "${op_flag:-}${LANE_RESTART_OPERATION:-}${LANE_RESTART_ATTEMPT:-}" ] ||
-    die "failed preparation permits only ordinary resume without restart operation or attempt tokens. Nothing was launched." 2
-  [ "${fresh_flag:-0}" != 1 ] && [ "${LANE_START_FRESH:-0}" != 1 ] ||
-    die "failed preparation permits only ordinary resume, not a fresh session. Nothing was launched." 2
-  LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$LANE" ||
-    die "managed or unknown ownership blocks failed-preparation recovery. Nothing was launched." 2
-  pfr_holder_rc=0
-  LANES_NO_FETCH=1 "$LANES_EDIT" lane-holders "$LANE" >/dev/null || pfr_holder_rc=$?
-  [ "$pfr_holder_rc" = 8 ] ||
-    die "ordinary recovery from failed preparation requires confirmed absence of every holder (lane-holders exited $pfr_holder_rc). Nothing was launched." 2
-  preparation_failure_identity="$pfr_identity"
-}
-eri_rc=0
-eri_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$LANE" --dir "$DIR" 2>/dev/null)" || eri_rc=$?
-case "$eri_rc" in
-  0)
-    eri_state="$(printf '%s\n' "$eri_out" | awk -F'\t' '$1=="state" {print $2; exit}')"
-    eri_op="$(printf '%s\n' "$eri_out" | awk -F'\t' '$1=="operation" {print $2; exit}')"
-    case "$eri_state" in
-      preparing) die "this restart is still preparing its preservation records. Nothing was changed." 2 ;;
-      failed) preparation_failure_resume_check "$eri_out" ;;
-      pending|starting)
-        eri_token="${op_flag:-${LANE_RESTART_OPERATION:-}}"
-        [ -n "$eri_token" ] || die "an active restart requires its supervisor operation token. Nothing was changed." 2
-        [ "$eri_token" = "$eri_op" ] || die "operation $eri_token is not lane $LANE's current restart operation $eri_op. Nothing was changed." 2
-        LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$LANE" || die "managed ownership blocks this legacy restart. Nothing was changed." 2
-        # --no-launch is a read-only command preview for an active restart.
-        (( ! no_launch )) || dry_run=1 ;;
-      ready) : ;;
-      INCOMPLETE) die "the restart intent is INCOMPLETE: its fenced fields cannot compare. Nothing was changed. Read it: lanes-edit.sh restart-intent $LANE" 2 ;;
-      UNKNOWN-SCHEMA) die "the restart schema is unreadable (Amendment 7(d)). Resuming could open the transcript that /ctx PAUSED. Update this workstation's openRepoTools or reconcile the intent once no restart is active. Nothing was changed." 2 ;;
-      *) die "the restart intent is malformed ($eri_state). Nothing was changed." 2 ;;
-    esac ;;
-  8|2) : ;;
-  1) die "the restart intent could not be read. That is NOT 'no restart is in flight': ordinary resume could open the transcript that /ctx PAUSED. Set LANES_LANE_STATE_ROOT to a readable control root. Nothing was changed." 2 ;;
-  *) die "the restart intent could not be read. Nothing was changed." 2 ;;
-esac
-
-# -------------------------------------------------------- 3. liveness check
-
-# THE SEAM (ruling 2026-10-04): A MANAGED-OWNED LANE IS NOT THIS COMMAND'S.
-# `lanes-edit.sh managed-projection` answers 0 with the owner where the lane's
-# register row carries the managed ledger's marker, 8 for a legacy lane, and 1
-# where ownership could not be established. ANY other status — a helper that
-# predates the verb included — is UNKNOWN as well, and refused the same way:
-# a fence that opens because its read failed is no fence (Amendment 7(d)).
-seam_refuse() {   # <lane> <the act>
-  sr_out=""; sr_rc=0
-  sr_out="$("$LANES_EDIT" managed-projection "$1" 2>/dev/null)" || sr_rc=$?
-  case "$sr_rc" in
-  0) die "lane $1 is owned by the managed ledger (owner ${sr_out:-unnamed}), and $2 is a legacy lane act, refused here, before the binding is read, before a handoff is requested of anybody and before a byte is written: no row, no log line, no stamp, no window name, no launch. Brett Heap's ruling of 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\". Act on this lane through the managed ledger." 2 ;;
-  8) : ;;
-  *) die "whether the managed ledger owns lane $1 is UNKNOWN (\`$LANES_EDIT managed-projection $1\` exited $sr_rc): its register row carries managed-owner vocabulary that does not parse, or the read failed. An ownership nobody could establish is never read as legacy (Amendment 7(d)), so $2 is refused here, before the binding is read, before a handoff is requested of anybody and before a byte is written: no row, no log line, no stamp, no window name, no launch. Read it: $LANES_EDIT managed-projection $1" 1 ;;
-  esac
-}
-# AT THE TOP OF SECTION 3, and so BEFORE Amendment 18's binding gate and its
-# `request-handoff`: asking a managed lane's place to hand off is itself a
-# legacy act on that lane.
-seam_refuse "$LANE" "a lane start"
-
-# The row, READ (never written) with the same rule lanes-edit.sh uses to find
-# one: the row's FIRST backticked token is the lane name.
-# AMENDMENT 15 — `tolower` ON BOTH SIDES, exactly as `row_line` now compares.
-# This read is what decides "is this lane new", and it was the byte-for-byte
-# comparison that let `lane-start openxfactory 2` add a SECOND row for
-# `openXfactory-2` at 2026-09-13T23:51:56Z. Case-insensitive, the lane is found,
-# the branch below is the RESUME branch, and `add-row` is never reached.
-rows_for_lane() {
-  awk -v lane="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      if (tolower(substr(rest, 1, p2 - 1)) == tolower(lane)) print
-    }' "$LANES_FILE"
-}
-# The names those rows carry — which under Amendment 15 may be two spellings of
-# ONE name, and a refusal that could not say so would send a person looking for
-# a duplicate that is not there to find.
-row_names_for_lane() {
-  awk -v lane="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      t = substr(rest, 1, p2 - 1)
-      if (tolower(t) == tolower(lane)) print t
-    }' "$LANES_FILE"
-}
-
-row="$(rows_for_lane "$LANE" || :)"
-row_count=0
-[ -n "$row" ] && row_count="$(printf '%s\n' "$row" | grep -c . || :)"
-
-if [ "$row_count" -gt 1 ]; then
-  rfl_names="$(row_names_for_lane "$LANE" | tr '\n' ' ')"
-  rfl_distinct="$(row_names_for_lane "$LANE" | LC_ALL=C sort -u | grep -c . || :)"
-  rfl_why="and lanes-edit.sh can edit neither"
-  if [ "$rfl_distinct" -gt 1 ]; then
-    # BRACED, AND THE BRACES ARE LOAD-BEARING (A9 Addendum 4, R-A9-11): bash
-    # decides where a variable NAME ends with `isalnum()`, which is LOCALE-
-    # DEPENDENT, and bash 3.2 on Darwin under the runner's `en_US.UTF-8` reads
-    # the three bytes of `—` as name characters — so this looks up
-    # `rfl_names—`, which `set -u` then kills the script over. Caught by
-    # `test_no_shipped_bash_leaves_a_variable_name_to_bash_3_2s_locale`, which
-    # is the rule this repository already learned once.
-    rfl_why="spelled ${rfl_names}— a lane name is ONE name under any case (Amendment 15), so those are two rows for ONE lane, and lanes-edit.sh can edit neither"
-  fi
-  die "the register has $row_count rows for lane $LANE, $rfl_why. Merge them into one row by hand in $LANES_FILE (one line each) — Amendment 15(d): append the newer row's session id(s) to the older row's session cell, in order, and remove the newer row in the SAME commit, whose message names both spellings — then commit with 'LANES_LANE=$LANE lanes-edit.sh commit \"merged duplicate rows\"' and re-run" 2
-fi
-
-# AND EVERYTHING THIS SCRIPT DECIDES FROM THE ROW IS DECIDED AGAINST WHAT HAS
-# LANDED, not against this checkout. `$LANES_FILE` is the working tree, and a
-# `git fetch` does not move it: a row another workstation added and pushed, or a
-# uuid it stamped on an existing row, is simply absent here until something
-# pulls. Two decisions turn on that row and BOTH used to read the working tree.
-#   "IS THIS LANE NEW" — reaching `add-row` on that reading appends a SECOND row
-#     (`add-row` checks the working tree too, and `commit_push`'s rebase then
-#     brings the peer's row in underneath it), and two rows for one lane is a
-#     register no helper can edit at all, because `row_line` requires exactly one.
-#   "WHICH SESSION IS THIS LANE'S" — the resume target, the id in the status
-#     appended to the row, and the uuid stamped on the RESUMED / STARTED line
-#     (see THE RESUME TARGET above).
-# So: ask for the PUBLISHED row ONCE, here, for both. 0 and 8 are the answers;
-# anything else is the helper failing, and this script decides nothing about a
-# row on an answer it did not get. LANES_NO_FETCH=1 is honoured inside the
-# helper, for an offline start.
-pub_rc=0
-pub_row="$("$LANES_EDIT" register-row "$LANE" 2>/dev/null)" || pub_rc=$?
-if [ "$row_count" = 0 ]; then
-  case "$pub_rc" in
-    8) : ;;                        # no published row either: the lane really is new
-    0)
-      note "the register on origin/main ALREADY has a row for $LANE, and this checkout does not:"
-      pub_row_first="${pub_row%%$'\n'*}"
-      printf '  %s\n' "${pub_row_first:0:200}" >&2
-      note "adding a row here would make two, and two rows for one lane is a register lanes-edit.sh cannot edit."
-      note "RECOVERY — bring this checkout up to date, then re-run this command:"
-      note "  git -C \"$(cd -- "$(dirname -- "$LANES_FILE")/.." && pwd)\" pull --rebase origin main"
-      die "refusing to add a second row for $LANE" 2 ;;
-    *)
-      note "the helper's own output is above."
-      die "$LANES_EDIT register-row $LANE failed (exit $pub_rc). That is NOT 'the register has no row for $LANE', and this script will not add a row on an answer it did not get — a duplicate row is a register no helper can edit. Fix the helper (or run it by hand: $LANES_EDIT register-row $LANE), then re-run." 1 ;;
-  esac
-else
-  case "$pub_rc" in
-    0) : ;;
-    8)
-      # A row HERE and none on `origin/main`: it is in a commit this checkout
-      # has not pushed, or on another branch. There is then no published cell,
-      # so there is no recorded session to resume — and this script does not
-      # fall back to the working tree, because falling back is the fault. The
-      # ids below are named as DIAGNOSTICS, never as a target: nothing outside
-      # this checkout can see them. `lane-end`'s refusal reads `origin/<branch>`
-      # for the same reason and cannot see an unpushed line either — what has
-      # landed is what other lanes can see.
-      note "this checkout has a row for $LANE and the register on origin/main has none — so there is no PUBLISHED session cell, and no recorded session to resume."
-      unpub_ids="$(printf '%s\n' "$row" | awk -F'|' '{print $3}' | grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tr 'A-F' 'a-f' | tr '\n' ' ' || :)"
-      [ -n "$unpub_ids" ] && note "  the id(s) only this checkout's copy carries, which nothing else can see: ${unpub_ids% }"
-      note "  RECOVERY — push the register from here, then re-run: git -C \"$(cd -- "$(dirname -- "$LANES_FILE")/.." && pwd)\" push origin main" ;;
-    *)
-      note "the helper's own output is above."
-      die "$LANES_EDIT register-row $LANE failed (exit $pub_rc). That is NOT 'the register has no row for $LANE', and this script will not pick a resume target on an answer it did not get: resuming the working tree's id lands the operator in the lane's previous conversation and stamps that uuid on an append-only line. Fix the helper (or run it by hand: $LANES_EDIT register-row $LANE), then re-run." 1 ;;
-  esac
-fi
-
-# Every field of a `| … |` row by position: 1 is empty (before the leading
-# pipe), 2 the lane cell, 3 the session-id cell, NF-1 the state cell.
-# OF THE PUBLISHED ROW. `$row` above is this checkout's, and it is read for
-# exactly one thing: whether adding a row would make two. Every id this script
-# acts on comes from `$pub_row`, which is empty when the published register has
-# no row for the lane — the case the `8` branch above has already reported.
-cell() { printf '%s\n' "$pub_row" | awk -F'|' -v i="$1" '{print $i}'; }
-
-# Only the SESSION-ID CELL is read for ids. State cells quote other lanes'
-# session ids all the time ("RESUMED by <id>", "handed off to <id>"), and a
-# live one of those is not this lane's holder.
-# Two readings of the same cell. The liveness check below wants the SET, so it
-# sorts; the resume target wants the ORDER, because the cell is a history and
-# its LAST id is the lane's current session (see THE RESUME TARGET above).
-session_ids=""
-session_ids_ordered=""
-if [ "$row_count" = 1 ]; then
-  session_ids_ordered="$(cell 3 | grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tr 'A-F' 'a-f' || :)"
-  [ -n "$session_ids_ordered" ] && session_ids="$(printf '%s\n' "$session_ids_ordered" | sort -u)"
-  id_count=0; [ -n "$session_ids" ] && id_count="$(printf '%s\n' "$session_ids" | grep -c . || :)"
-  step "the register already has a row for $LANE; its session cell on origin/main names $id_count session id(s)"
-  # A row may record only `session_01…` FOOTER ids. Those are not transcript
-  # ids: a transcript is `<uuid>.jsonl`, so a footer id can neither be checked
-  # for liveness nor resumed. Name the gap rather than behave as if the cell
-  # were empty — that silence is what made 2026-09-11 hard to diagnose.
-  if [ "$id_count" = 0 ]; then
-    footer_ids="$(cell 3 | grep -oE 'session_[A-Za-z0-9]{10,}' | sort -u || :)"
-    if [ -n "$footer_ids" ]; then
-      note "the cell records only PR-footer ids ($(printf '%s' "$footer_ids" | tr '\n' ' ')), which are not transcript ids — so this lane has no liveness check and no resume target. Its session must stamp its TRANSCRIPT uuid (the name of its <uuid>.jsonl) on the row."
-    fi
-  fi
-else
-  step "the register has no row for $LANE yet"
-fi
-
-# LIVENESS IS ONE IMPLEMENTATION, and it lives in `lanes-edit.sh`, because
-# `who` asks exactly this question about exactly these rows and two copies
-# would drift. It reads the row's session cell itself and tries EVERY
-# transcript uuid recorded there, not merely the last one — a lane whose
-# earlier lineage is still running is still held.
-#
-# It also carries the `nameSource` fix: a session record's `name` is evidence
-# about some OTHER lane only when a person or a peer set it. `nameSource:
-# derived` is the harness naming a window after its working directory, and
-# treating that as a denial reported "no live session holds <lane>" for
-# sessions that plainly did (2026-09-11, the orchestrator's own window).
-# ONLY 0 AND 8 ARE ANSWERS: 0 is "this record holds the lane", 8 is "no live
-# record does". Any other exit is the helper FAILING, and this script must not
-# read a failure as "the name is free" — renaming a running session into a
-# title something else still holds is exactly what mints `<lane> (2)` and costs
-# the lane its address (AGENTS.md rule 7). The first version swallowed the
-# helper's stderr and treated every non-zero exit as "no holder", so a helper
-# that could not run at all produced a confident "no live session holds <lane>"
-# about a session that was live in another window.
-live_holder() { "$LANES_EDIT" live-holder "$LANE"; }
-
-# AND IT IS ASKED UNCONDITIONALLY. This used to run only when the row THIS
-# CHECKOUT has already named a session id, which is the wrong gate twice over:
-# the ids came from the working tree, which no fetch moves, so a row (or a newly
-# stamped uuid) that another workstation had already published was read as "no
-# ids, nothing to check"; and a lane with no row here at all skipped the check
-# entirely. Both skip exactly when the answer matters — the helper owns the row
-# lookup, fetches first, and unions the published ids with this checkout's (R25),
-# so asking it costs one fetch and can only ever ADD a reason to refuse.
-holder_here=0
-LS_TMP="$(mktemp)"
-holder=""; lh_rc=0
-holder="$(live_holder 2>"$LS_TMP")" || lh_rc=$?
-[ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-case "$lh_rc" in
-  0)
-    # WHOSE SESSION IT IS COMES FROM THE HELPER (Amendment 8, ruling (g)), not
-    # from a string compare on the `tmux` column here. The first version made
-    # that compare, and on 2026-09-12 it refused this lane the window it was
-    # running in: the record it was handed was the harness's `kind: bg`
-    # COMPANION, which carries the interactive session's own `sessionId` and no
-    # `tmux` at all, so `"none" != "$this_window"` and the refusal read
-    # "lane openRepoProject-1 is live in session c5701b54… (tmux none)" about
-    # the session typing the command. A record with no target is not a record in
-    # no window — the helper now answers with `here`, `elsewhere` or `orphan`,
-    # having tested `$CLAUDE_CODE_SESSION_ID`, the window, and this pane's
-    # process tree in that order.
-    #
-    # AN EMPTY FIFTH FIELD IS A REFUSAL, not a pass: an older `lanes-edit.sh`
-    # that does not send one must not be read as saying "here".
-    IFS=$'\037' read -r h_id h_target h_name h_pid h_where <<<"$holder"
-    case "$h_where" in
-      here)
-        holder_here=1
-        step "this window's own session $h_id (pid $h_pid, name '${h_name:-none}') already holds $LANE — carrying on" ;;
-      orphan)
-        # AMENDMENT 6(d), and not a refusal. A live record that names no window
-        # and is in no pane's process tree is an idle background session still
-        # holding the name — the thing 6(d) says to retire. It is not in this
-        # window, so it is not this window's session; it is in no window, so it
-        # is nobody's rival either. Say so, name the act, and carry on.
-        note "lane $LANE is named by a live record that is in NO window and not in this pane's process tree: session $h_id, pid $h_pid, name '${h_name:-none}'. That is an orphaned holder, not a rival (Amendment 6(d)) — retire it: kill $h_pid. Carrying on."
-        ;;
-      *)
-        note "lane $LANE is live in session $h_id (tmux ${h_target:-unknown}); take $repo-$next_n or resume that window"
-        note "  $prog $repo $next_n"
-        note "  tmux switch-client -t ${h_target%.*}     # or go to the window that holds it"
-        exit 2 ;;
-    esac ;;
-  8)
-    if [ "$row_count" = 1 ]; then
-      step "no live session holds $LANE — this is a resume of a lane whose sessions have all ended"
-    else
-      step "no live session holds $LANE — the register records no session for it at all, here or on origin/main"
-    fi ;;
-  *)
-    note "the helper's own output is above."
-    die "$LANES_EDIT live-holder $LANE failed (exit $lh_rc). That is NOT 'no live session holds $LANE', and this script will not rename the window on an answer it did not get: a rename into a name something still holds is what mints '$LANE (2)'. Fix the helper (or run it by hand: $LANES_EDIT live-holder $LANE), then re-run." 1 ;;
-esac
-
-# ------------------------------ 3a. the orphaned holders (Amendment 8(f))
-#
-# R-A8-6. Step 3 asked whether the lane's CURRENT id is held. This asks who is
-# still holding its EARLIER ones — Amendment 6(d)'s orphans, the live-but-idle
-# sessions that are the whole reason the `/resume` picker offered this lane two
-# transcripts of which neither was the lane.
-#
-# IT NAMES THEM AND IT NEVER KILLS. The retire act is `kill <pid>`, printed
-# here with the session id and the profile beside it so a person can check
-# before running it, and run by that person. Clause (f) rules it the operator's
-# act — an idle background session is exactly the shape of thing that turns out
-# to be somebody's long-running job — and it never blocks or delays the launch:
-# a helper too old to know the read simply says nothing.
-ih_out=""; ih_rc=0
-ih_out="$("$LANES_EDIT" idle-holders "$LANE" 2>/dev/null)" || ih_rc=$?
-if [ "$ih_rc" = 0 ] && [ -n "$ih_out" ]; then
-  note "lane $LANE: this row's EARLIER session ids are still held by live but idle sessions (Amendment 6(d) orphans). They are history, not alternatives — retire them, and $prog never does it for you:"
-  while IFS=$'\t' read -r o_sid o_pid o_kind o_prof; do
-    [ -n "$o_sid" ] || continue
-    note "  session $o_sid (kind ${o_kind:-none}, profile ${o_prof:-unknown}) — retire it: kill $o_pid"
-  done <<<"$ih_out"
-fi
-
-# THE RESUME TARGET, from the PUBLISHED cell (R33): the LAST id in it. Read
-# here rather than in 5a because step 3b may replace it with an id the cell does
-# not carry yet, and 5a's launch decision has to see that.
-row_sid=""
-[ -n "$session_ids_ordered" ] && row_sid="$(printf '%s\n' "$session_ids_ordered" | tail -n1)"
-
-# ------------------------------------- 3b. the live session in THIS window
-#
-# A DIFFERENT QUESTION FROM STEP 3's, and Amendment 8 exists for the gap between
-# them. Step 3 asks "is any session the ROW names alive"; this asks "what is
-# live in THIS WINDOW". The harness mints a new transcript uuid with nobody
-# acting — a `/clear` does it (Amendment 6, fact 4), and so did the 2026-09-12
-# usage reset that carried this lane's conversation into `4a91f1dc…` while its
-# row still ended on `09dd34d1…`. An id in no row is an id `live-holder` cannot
-# look up: it answers 8, "this lane is parked", about the conversation sitting
-# in the window it was asked about, and this script would then resume the lane's
-# PREVIOUS conversation and stamp that uuid on an append-only line.
-#
-# So the id is taken from the record itself, and step 5 appends it to the
-# session cell BEFORE it stamps — which is what makes liveness and the next
-# resume follow it. There is no flag for this and there could not be one: the id
-# does not exist until the session does. The act is `lane-start --no-launch` run
-# IN the window, which is what the SessionStart hook's block asks the new
-# session to do, and what this lane did by hand at 2026-09-12T16:59Z.
-#
-# A FAILED READ IS A WARNING HERE, NOT A REFUSAL, and that is not R22 being
-# waived. R22 is for a read whose empty answer PERMITS something: `live-holder`
-# fails closed because a rename over a live name costs a lane its address. This
-# read only ever ADDS an id to a cell, and it runs after `live-holder` has
-# already read the same records and refused if it could not — so a failure here
-# means the records went unreadable between two calls a second apart, and the
-# honest response is to say so and carry on rather than to refuse a lane its
-# start.
-# ------------------- AMENDMENT 18(h): ONE LIVE PROCESS PER TRANSCRIPT
-#
-# *"`lane-start` — every launch branch and `--no-launch`'s window-binding step —
-# counts the live records carrying the id it is about to resume or bind, across
-# every profile's `sessions/`, and REFUSES when a process other than this
-# window's holds it, naming the pid(s), their windows or `bg`, and the retire
-# act; it never appends such an id to the row and never launches a second resume
-# of it."* Ratified 2026-09-14T13:15:18Z as revision 4 of Amendment 18;
-# opensoft/openRepoTools#39.
-#
-# MEASURED, AND THAT IS WHY IT IS A REFUSAL AND NOT A NOTE. On 2026-09-14 at
-# 12:05Z the harness spawned `claude --session-id d1ac715c… --fork-session` under
-# a `bg-pty-host`; at 12:07Z the launcher NAMED it as a defect; at 12:10Z a
-# `lane-start --no-launch openRepoTools 3` in a new window bound THAT SAME
-# transcript as the row's session, seeing nothing; at 12:25Z a second `pclaude`
-# resumed it interactively. Three live processes, one transcript file, and the
-# retire act could not see any of them BECAUSE the row now recorded the id.
-# The count below is the read that was missing, and it is asked of the id this
-# run is about to write down or resume — never of the lane.
-#
-# IT FAILS CLOSED, AND THE THREE CODES ARE THE CONTRACT: 0 with rows, 8 with
-# none, 64 a usage error, anything else a read that did not happen. A 2 is a
-# `lanes-edit.sh` that predates this read — the un-upgraded workstation — and
-# THAT one falls through with a note, exactly as clause (h)'s other reads do,
-# because refusing every lane start on every workstation that has not installed
-# this yet is not a safety property.
-#
-# AND THE HARNESS HAS A FENCE OF ITS OWN ON THE SAME FILE, WHICH THIS RUN MUST
-# ASK BEFORE IT EXECS RATHER THAN AFTER (measured on Eagle 2026-09-15 against
-# `claude` 2.1.270, and reproduced live in a scratch config directory): a
-# `claude --resume <id>` whose id is carried by a live session record whose
-# `kind` is anything but `interactive` REFUSES AND EXITS 1 before it starts,
-# with
-#
-#   Error: Session <id> is running as a background session. Run `claude agents`
-#   to find its id, then `claude attach <id>` to open it, or `claude stop <id>`
-#   first to resume it here. Add --fork-session to branch off a copy instead.
-#
-# — the harness's own `H5`/`zpe` pair, which takes the FIRST live record for the
-# id whose `kind !== "interactive"` (a `--bg` job, a `bg-pty-host` child, the
-# `bg` COMPANION of Amendment 8 ruling (g)) and stops there. A second live
-# INTERACTIVE record does NOT stop it — the same measurement got past that check
-# and failed later, on authentication — which is exactly why 18(h) is this
-# tooling's to enforce and not the harness's.
-#
-# THE COST OF ASKING IT LATE IS A FALSE `RESUMED`. The row, the object log and
-# the handoff stamp are all written BEFORE the `exec` at the foot of this
-# command, so a launch the harness refuses leaves a lane recorded as RESUMED by
-# a session that never started, and in a launcher-created window — `pclaude
-# --lane <lane> <profile>`, whose pane's only command this is — tmux prints
-# `[exited]` over the message and closes it (opensoft/workBenches#77's shape,
-# one door along). So the `resume` rule below asks the harness's question in
-# front of the launch and prints the harness's own remedy beside this estate's.
-dup_check() {   # <session uuid> <what this run was about to do with it> [<rules>]
-  # THE RULES, AND THE THIRD ARGUMENT IS WHICH OF THEM APPLY:
-  #   bind         (the default) 18(h)'s duplicate count alone — the
-  #                window-binding call, which opens no transcript;
-  #   resume       both rules — the branch that is about to `--resume` this id
-  #                with no record of it in this window;
-  #   resume-here  the harness's fence alone — the same branch where the id IS
-  #                this window's own live session, whose duplicate count the
-  #                window-binding call above has already made.
-  local dc_id="${1-}" dc_why="${2-}" dc_rules="${3-bind}" dc_rows="" dc_rc=0 dc_other="" dc_bg="" dc_att=""
-  local dc_pid dc_kind dc_tgt dc_prof dc_where dc_verdict dc_file
-  [ -n "$dc_id" ] || return 0
-  : > "$LS_TMP"
-  dc_rows="$("$LANES_EDIT" transcript-holders "$dc_id" 2>"$LS_TMP")" || dc_rc=$?
-  case "$dc_rc" in
-    0 | 8) : ;;
-    2) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-       note "this \`lanes-edit.sh\` has no \`transcript-holders\` (exit 2), so whether another live process already carries $dc_id is NOT known here. Install the one beside this script (\`openRepoTools --install\`); carrying on."
-       return 0 ;;
-    *) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-       die "$LANES_EDIT transcript-holders $dc_id exited $dc_rc, so whether another live process already carries that transcript could NOT be read — and that is not 'no other process does'. A transcript is held by ONE live process (Amendment 18(h)); nothing has been renamed, written or launched." 1 ;;
-  esac
-  [ "$dc_rc" = 0 ] || return 0
-  while IFS=$'\037' read -r dc_pid dc_kind dc_tgt dc_prof dc_where dc_verdict dc_file; do
-    [ -n "${dc_pid:-}" ] || continue
-    # `unrelated` BLOCKS HERE AND NOWHERE ELSE, and the difference is the
-    # question being asked. `transcript_holders` answers "who holds this
-    # transcript, and what is this window's relation to them", and its
-    # `unrelated` means THIS WINDOW CARRIES NO RECORD OF IT AT ALL — kept
-    # silent there so that a rule about a TRANSCRIPT cannot overturn
-    # `live_holder`'s verdicts about a LANE, or `forks`, from a read that was
-    # asked about neither. THE QUESTION HERE IS 18(h)'s OWN and is narrower:
-    # *"the id it is about to resume or bind"*. The ROW-RESUME branch reaches
-    # this call only when `row_sid != win_sid`, so this window has no record of
-    # that id and EVERY live holder of it comes back `unrelated` — counting
-    # only `duplicate` made that branch's check one that could never fire
-    # (Copilot round 1 on opensoft/openRepoTools#52). At the window-binding call
-    # the id IS this window's own session, so a `here` record exists and nothing
-    # is `unrelated`; one rule, two call sites, no second definition of a
-    # duplicate.
-    #
-    # AND IT DOES NOT DECIDE WHETHER THE LANE IS TAKEN. An ORPHAN — a live but
-    # idle holder of the row's id — is still reported and never refused as a
-    # rival (Amendment 8(f), through `live_holder`'s own verdict, printed above
-    # this with 6(d)'s act), and a `bg` companion still holds no lane. What
-    # 18(h) adds is about the FILE: this branch's next act is `claude --resume
-    # <that id>`, and the clause says *"it never appends such an id to the row
-    # and never launches a second resume of it"*. 8(f)'s own sentence does not
-    # reach that state either — it rules on *"a row's EARLIER session ids …
-    # still held by live but idle sessions"*, and this is the id the row ENDS
-    # on, which is the one a resume opens.
-    #
-    # THE HARNESS'S OWN FENCE FIRST, because it decides whether the `exec` this
-    # branch is about to make can start at all, and it reads the record's KIND
-    # and not this read's verdict: the `bg` COMPANION of the session live in
-    # THIS window is `companion` here — benign, one session seen twice — and it
-    # is still a record whose kind is not `interactive`, so `claude --resume`
-    # stops on it. A record with no `kind` at all is written down as
-    # `interactive` by `transcript_holders` (an older harness wrote nothing
-    # else), which is the same reading the harness makes.
-    if [ "$dc_rules" != bind ] && [ -n "${dc_kind:-}" ] && [ "$dc_kind" != interactive ]; then
-      dc_bg="${dc_bg:+$dc_bg, }pid $dc_pid ($dc_where, kind $dc_kind, profile $dc_prof)"
-      if [ -z "$dc_att" ] && [ -n "${dc_tgt:-}" ] && [ "$dc_tgt" != none ]; then
-        dc_att="${dc_tgt%.*}"
-      fi
-    fi
-    # AND IT IS NOT A SECOND VERDICT, SO IT DOES NOT `continue` PAST 18(h)'s
-    # COUNT: one record can be both — a `bg` duplicate in another profile is a
-    # second process on the file AND the thing the harness will stop on — and a
-    # refusal that named only the newer of the two reasons would drop the one
-    # this suite has asserted since #52. `resume-here` is the exception and
-    # states why: the id is this window's own session, whose duplicate count the
-    # window-binding call above has already made.
-    [ "$dc_rules" = resume-here ] && continue
-    case "$dc_verdict" in
-      duplicate | unrelated) : ;;
-      *) continue ;;
-    esac
-    dc_other="${dc_other:+$dc_other, }pid $dc_pid ($dc_where, kind $dc_kind, profile $dc_prof)"
-    if [ -z "$dc_att" ] && [ -n "${dc_tgt:-}" ] && [ "$dc_tgt" != none ]; then
-      dc_att="${dc_tgt%.*}"
-    fi
-  done <<<"$dc_rows"
-  [ -n "$dc_bg" ] || [ -n "$dc_other" ] || return 0
-  if [ -n "$dc_other" ]; then
-    note "another live process already carries transcript $dc_id: $dc_other"
-    note "A transcript is held by ONE live process (Amendment 18(h)): two of them append to one file, each overwriting what the other wrote, and a row that records it has two processes answering for one lane. This run was about to $dc_why, and it has done NOTHING — no window renamed, no id appended, no session launched."
-  fi
-  if [ -n "$dc_bg" ]; then
-    note "a live BACKGROUND session already carries transcript $dc_id: $dc_bg"
-    note "\`$CLAUDE_BIN --resume $dc_id\` would REFUSE to start against it — \"Session $dc_id is running as a background session … Add --fork-session to branch off a copy instead\" — and exit 1 before anything ran (measured against claude 2.1.270, and reproduced in a scratch configuration directory). This run was about to $dc_why, and it has done NOTHING: no window renamed, no id appended, no session launched. A lane recorded RESUMED by a launch the harness refuses is a false transition in two append-only files, and in a window a launcher has just made — \`pclaude --lane <lane> <profile>\`, whose pane's only command this is — tmux prints \`[exited]\` over the message and closes it."
-    note "open the one that is running rather than a second copy of it: \`claude agents\` names its id, \`claude attach <id>\` opens it, \`claude stop <id>\` ends it."
-  fi
-  # WHERE THAT PROCESS IS, WHEN ITS RECORD SAYS SO (Amendment 18 Addendum 1's
-  # posture: the conversation that is already live is ATTACHED, never started a
-  # second time). The line is printed beside the retire act and not instead of
-  # it: which of the two this is — the lane running in another window, or a
-  # duplicate to retire — is the person's to read, and only one of them is a
-  # window to go to.
-  [ -n "$dc_att" ] && note "that process is in ${dc_att}: tmux switch-client -t $dc_att   (from outside tmux: tmux attach -t ${dc_att%%:*})"
-  die "retire the other one first — \`lane-end\` proves it is this lane's duplicate and prints Amendment 6(d)'s act for it, and it ends, writes and kills nothing:
-    lane-end $LANE --retire <pid>" 1
-}
-
-win_sid=""; win_target=""; win_name=""; win_pid=""; win_profile=""
-: > "$LS_TMP"
-win_rec=""; ws_rc=0
-win_rec="$("$LANES_EDIT" window-session "$this_window" 2>"$LS_TMP")" || ws_rc=$?
-[ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-case "$ws_rc" in
-  0)
-    IFS=$'\037' read -r win_sid win_target win_name win_pid win_profile <<<"$win_rec"
-    step "this window's live session is $win_sid (name '${win_name:-none}', pid $win_pid, profile ${win_profile:-unknown})" ;;
-  8) step "no live session record names this window ($this_window)" ;;
-  *)
-    note "$LANES_EDIT window-session $this_window failed (exit $ws_rc) — carrying on without it. This read only ever ADDS the harness's new transcript uuid to the cell, and live-holder has already read the same records; if the cell is behind, stamp it yourself." ;;
-esac
-
-# AMENDMENT 18(h), THE WINDOW-BINDING STEP. Asked BEFORE the vetoes and before
-# anything is taken: an id a second live process already carries is one this run
-# must neither append to a cell nor resume, whatever the vetoes below decide
-# about whose it is.
-[ -n "$win_sid" ] && dup_check "$win_sid" "bind $win_sid as lane $LANE's session"
-
-# The id the cell does not carry. `$session_ids` is the PUBLISHED set (step 3),
-# so an id only this checkout knows is not treated as recorded either.
-#
-# NOT WHEN STEP 3 ALREADY FOUND ITS HOLDER HERE: a row whose OWN id is live in
-# this window is a cell that is current by definition, and there is nothing to
-# append. And only a TRANSCRIPT UUID is ever appended — a cell records those and
-# only those (Amendment 6(b)), and a record carrying anything else in its
-# `sessionId` is not something `--resume` could take.
-# ------------------ 3b(i). THE WINDOW-NAME VETO (Amendment 11, `R-A11-12`)
-#
-# STEP 3b'S FENCE IS TWO VETOES AND NO PERMISSION, and this is the second of
-# them. `R-A11-1` was corrected twice before it reached this shape and both
-# corrections are worth the reader's time, because each one broke the mechanism
-# in the opposite direction:
-#
-#   * the FIRST fence added "and the row carries no transcript yet", which made
-#     step 3b's cell-stamping DEAD in every case it exists for — the `/clear`,
-#     the usage reset, the profile switch — and was withdrawn (RV-T1);
-#   * the SECOND made the window's own NAME a CONDITION FOR TAKING, and that
-#     fails for every session that came up bare in a window still called
-#     `claude`, which was 8 of this workstation's 16 windows and this lane three
-#     times in one day (CF-T10). Its second disjunct, `live-holder` answering
-#     `here`, is unreachable at the site it governs: the branch below requires
-#     `holder_here = 0`.
-#
-# So neither is a permission. The rule is: the live session is taken UNLESS one
-# of two vetoes fires.
-#
-#   VETO 1 — THE REGISTER. A uuid that belongs to ANOTHER ROW is never taken,
-#     read through `lanes-edit.sh session-lane <uuid>` and fail-closed: only 0
-#     and 8 are answers. That veto is ADOPTION ACT 0'S (`opensoft/brett-wip#5`
-#     @`3719d97`), ported into this copy by `openRepoTools#24` (Amendment 9's
-#     adoption act 3, MERGED as `d4b5710`), and this branch
-#     does not re-implement it. THE SHA IS THE MERGE COMMIT AND NOT THE DRAFT
-#     HEAD: act 0 merged 2026-09-13T19:14:37Z, squashed, so `#5`'s pre-merge
-#     head `95e7a4c` is NOT an ancestor of `origin/main` and citing it names
-#     something that never landed (F-X18).
-#
-#   VETO 2 — THE WINDOW'S NAME, and it is this PR's second layer. A window NAMED
-#     FOR ANOTHER LANE is never taken. It catches what the register veto cannot:
-#     a session whose uuid is in NO row at all — the harness mints one on every
-#     `/clear` — running in a window that plainly belongs to somebody else. That
-#     is Evidence 2(b) exactly: `lane-start openXfactory-5` typed from a window
-#     named `openRepoProject-1` took this lane's live uuid as that lane's resume
-#     target and planned to stamp it on that lane's row.
-#
-# A NAME IS A VETO AND NEVER A PERMISSION, which is the whole of `R-A11-12`: a
-# window called `claude` vetoes nothing and the taking goes ahead, which is
-# exactly the case the first correction was made to preserve.
-# AND IT FAILS CLOSED, EXACTLY AS THE REGISTER VETO BESIDE IT DOES (`R-A11-12`;
-# clause (d) rule 1, ratified verbatim): *"Both reads fail closed: any answer but
-# 0 naming another lane or 8 leaves the cell and the resume target alone, because
-# here an empty answer is what PERMITS the take."* Only **8** — no row knows this
-# window's name — is permission. Every other code is a read that did not answer
-# the question, and this is the one place where not answering it would be read as
-# "the session is free": the cost of vetoing is one printed act, and the cost of
-# permitting is another lane's uuid on an append-only line.
-#
-# THE `2` IS NAMED RATHER THAN LEFT TO BE FOUND. `register-row` exits 2 where
-# `check_lane_name` refuses the string — a window name carrying a space, a slash
-# or a leading `-`, which no lane name may carry (`lanes-edit.sh:1210-1215`). Such
-# a window is not provably ANOTHER lane's, but it is not provably free either, and
-# the ruling's words admit no third answer: it vetoes, and the note says which
-# code came back so the operator can rename the window or pass --dir. A window
-# named `claude`, `zsh` or anything else lane-SHAPED that no row knows exits 8 and
-# still permits the take, which is what keeps the /clear, the usage reset and the
-# profile switch working in the windows this estate actually has.
-win_veto=""; win_veto_why=""
-if [ -n "$win_sid" ] && [ -n "$this_window_name" ] && [ "$this_window_name" != "$LANE" ]; then
-  if [ "$(printf '%s' "$this_window_name" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')" ]; then
-    wnv_rc=0
-    "$LANES_EDIT" register-row "$this_window_name" >/dev/null 2>&1 || wnv_rc=$?
-    case "$wnv_rc" in
-      0) win_veto="$this_window_name"
-         win_veto_why="which is another lane the register has a row for" ;;
-      8) : ;;
-      *) win_veto="$this_window_name"
-         win_veto_why="and whether that is another lane is NOT KNOWN — \`$LANES_EDIT register-row $this_window_name\` exited $wnv_rc, which is neither 0 (a row) nor 8 (no row), so this read fails closed (R-A11-12)" ;;
-    esac
-  fi
-fi
-
-harness_sid=""; cell_anchor=""
-# ------------------- 3b(ii). THE BINDING MODE (`--bind`, openRepoTools#70)
-#
-# THE GUARD'S CHOICE `2` IS A PERSON SAYING "THIS SESSION IS THAT LANE NOW", and
-# clause (h) rule 2 names the act it asks for: *"the row created or this uuid
-# appended to its cell"*. Without this mode the take below refused that uuid —
-# veto 1, because the row being LEFT still records it — so the row's ordinary
-# resume path ran instead and stamped the row, the lane's log and the handoff
-# with `RESUMED by <the id the row already had>`, under `--no-launch`, about a
-# conversation nobody was in; and the guard then appended the uuid to the cell
-# itself. The cell ended right and the append-only log said something else.
-#
-# SO THE MODE IS STEP 3b's OWN TAKE, WITH VETO 1 ANSWERED BY THE PERSON. Clause
-# (h) rule 4's limit is that a uuid never moves between rows WITHOUT the
-# person's yes, and `--bind` is that yes, carried by the one caller that asked
-# for it. Everything else about the take is unchanged: the cell is extended
-# first and the stamp second (Amendment 8), with the PUBLISHED last id as the
-# anchor. One rule is added, and it is the guard's own former anchor rule moved
-# here: a cell recording no uuid is anchored on either of the two texts such a
-# cell carries instead.
-#
-# AND IT BINDS OR IT REFUSES. Every case where the take cannot happen — no live
-# session in this window, a different one from the uuid named, a window named
-# for ANOTHER lane (veto 2, which this mode does NOT lift) — is a refusal here,
-# before the rename and before any write. Carrying on would reach the resume
-# path, and that path stamping an id nobody is in is the defect this mode exists
-# to end.
-if [ -n "$bind_sid" ]; then
-  bind_lc="$(printf '%s' "$bind_sid" | tr 'A-F' 'a-f')"
-  [ -n "$win_sid" ] ||
-    die "--bind $bind_sid: no live session record names this window ($this_window), so there is no session here to bind. Nothing has been renamed, written or launched." 2
-  [ "$(printf '%s' "$win_sid" | tr 'A-F' 'a-f')" = "$bind_lc" ] ||
-    die "--bind names $bind_sid, and the session live in this window is $win_sid. The binding mode binds THIS window's session and no other one, so nothing has been renamed, written or launched." 2
-  [ -z "$win_veto" ] ||
-    die "this window is named '$win_veto', $win_veto_why — so the session live in it ($win_sid) is NOT bound as $LANE's (Amendment 11 clause (d) rule 1, veto 2, which --bind does not lift). Rename the window to $LANE first. Nothing has been renamed, written or launched." 2
-  if [ "$bind_lc" = "$row_sid" ]; then
-    step "--bind: $win_sid is already the last id in $LANE's session cell — nothing to append"
-  else
-    harness_sid="$win_sid"
-    cell_anchor="$row_sid"
-    if [ -z "$cell_anchor" ]; then
-      # THE TWO TEXTS A CELL CARRIES INSTEAD OF A UUID: `none recorded`, which a
-      # person writes into a row by hand, and the `pending` line this file writes
-      # into a row it creates with no uuid to put there (step 5, below). Both are
-      # whole-cell texts, so they anchor exactly as an id does, and a cell
-      # carrying anything else prints the act and is never guessed at.
-      bind_cell="$(cell 3 | sed -e 's/^ *//' -e 's/ *$//')"
-      case "$bind_cell" in
-        "none recorded" | "pending — set by the session's first act") cell_anchor="$bind_cell" ;;
-      esac
-    fi
-    row_sid="$harness_sid"
-    note "--bind: the session live in THIS window is $harness_sid, and it is bound as $LANE's on the person's choice 2 at the name guard (Amendment 12(h) rule 2). Its uuid goes into the session cell before the row's status — even where another row records it, because that choice is the person's yes (clause (h) rule 4) — and every stamp this run writes names it."
-  fi
-elif [ -n "$win_veto" ]; then
-  note "this window is named '$win_veto', $win_veto_why — so the session live in it ($win_sid) is NOT taken as $LANE's, and $LANE's row is not stamped with it (Amendment 11 clause (d) rule 1, veto 2; Evidence 2(b)). Run this from $LANE's own window, or pass --dir and let it start its own session."
-elif [ -n "$win_sid" ] && [ "$holder_here" = 0 ]; then
-  if ! [[ "$win_sid" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]]; then
-    note "the session live in this window has id '$win_sid', which is not a transcript uuid — leaving the cell alone"
-  elif printf '%s\n' "$session_ids" | grep -qx -F -- "$win_sid"; then
-    step "  its uuid is already in the row's session cell — nothing to append"
-  else
-    # R-A11-1 (corrected; A11 Addendum 2, ratified 2026-09-13T18:05:29Z "Ratify
-    # all four") — OWNERSHIP DECIDES, AND A LIVE SESSION THAT BELONGS TO ANOTHER
-    # ROW IS NEVER TAKEN. Until this test, the branch above fired on ANY live
-    # session in the typing window, so `lane-start X` typed from lane Y's window
-    # resumed Y's transcript and appended Y's uuid to X's row — cross-lane
-    # contamination, reproduced as Evidence 2(b) on `brettheap/new-workstation#20`
-    # (the same run planned to write this lane's uuid into `openXfactory-5`'s row).
-    #
-    # THE TEST IS THE REGISTER, NOT THE WINDOW'S NAME. The two legitimate cases
-    # this step exists for — a `/clear`, a usage reset, a profile switch — all
-    # happen in a window the launcher has just made and named `claude`, BEFORE
-    # step 4 renames it, and their uuid is one the harness has just minted, so it
-    # is in NO row at all. Fencing on the window's name instead would refuse
-    # exactly those three and leave step 3b dead, which is the failure `RV-T1`
-    # raised against the withdrawn "and the row carries no transcript yet"
-    # conjunct. An id that some OTHER lane's row already names is the one thing
-    # that is provably not this lane's, and that is the fence.
-    #
-    # IT FAILS CLOSED (R22). Only 0 (a lane) and 8 (no row names it) are answers;
-    # any other code is a read that did not happen — an older `lanes-edit.sh` with
-    # no `session-lane` exits 2 — and a read that could not be made must never be
-    # read as "the session is free", because an empty answer is what PERMITS the
-    # take here. The cost of refusing is one printed act; the cost of permitting
-    # is another lane's uuid on an append-only line.
-    win_owner=""; wo_rc=0
-    win_owner="$("$LANES_EDIT" session-lane "$win_sid" 2>/dev/null)" || wo_rc=$?
-    if [ "$wo_rc" != 0 ] && [ "$wo_rc" != 8 ]; then
-      note "$LANES_EDIT session-lane $win_sid failed (exit $wo_rc), so whose session is live in this window is NOT known — leaving $LANE's session cell and resume target alone. A helper with no 'session-lane' exits 2; install the one beside this script."
-    elif [ "$wo_rc" = 0 ] && [ -n "$win_owner" ] && [ "$win_owner" != "$LANE" ]; then
-      note "the session live in THIS window is $win_sid, and the register says it is lane $win_owner's, not $LANE's. A live session that belongs to another row is NEVER taken (R-A11-1): $LANE's session cell and resume target are left exactly as they are. Start $LANE in its own window, or take $win_owner here."
-    else
-      harness_sid="$win_sid"
-      cell_anchor="$row_sid"
-      row_sid="$harness_sid"
-      note "the session live in THIS window is $harness_sid and the PUBLISHED session cell does not name it: the harness minted a new transcript (a /clear, a usage reset, a profile switch). No other row names it either, so it is this lane's current session, and the cell is stamped with it before the row's status."
-    fi
-  fi
-elif [ -n "$win_sid" ]; then
-  step "  it is the session step 3 already found holding $LANE in this window — the cell is current"
-fi
-
-# ------------------------------------------------------------- 3c. --confirm
-#
-# A window whose name is not the lane is a window whose lane came from somewhere
-# else — the swap RECORD, or a flag — and taking it renames the window and
-# writes the register. `--confirm` puts the three facts that disagree in front
-# of a person first: the WINDOW, the SESSION live in it, and the ROW.
-#
-# NO TERMINAL AND NO `--yes` IS A REFUSAL, exit 2, before the rename and before
-# any write. A question nobody can answer is not a Yes, and a launcher that read
-# it as one would rename a window somebody else's lane is working in.
-if (( confirm )); then
-  if [ "$this_window_name" = "$LANE" ]; then
-    step "--confirm: this window is already named $LANE — nothing to confirm"
-  else
-    # AMENDMENT 15 — A WINDOW NAMED FOR THIS LANE IN ANOTHER CASE IS NOT "not
-    # the lane". The rename still happens below, because the row's spelling is
-    # what the window is named; what changes is the sentence the operator is
-    # asked to answer. Told their own lane's window is not the lane, the
-    # reasonable answer is N — and N abandons a resume that was legitimate.
-    if [ "$(printf '%s' "$this_window_name" | tr 'A-Z' 'a-z')" = "$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')" ]; then
-      why="named '$this_window_name', which is THIS LANE under another case — a lane name is ONE name under any case (Amendment 15), and the rename below is to the register row's own spelling, $LANE"
-    else
-      case "$this_window_name" in
-        ""|claude|bash|zsh|sh|node) why="auto-named '${this_window_name:-none}'" ;;
-        *)                          why="named '$this_window_name', which is not the lane" ;;
-      esac
-    fi
-    note "--confirm: this window is $why. The three facts, before anything is renamed or written:"
-    note "  window   $this_window '${this_window_name:-none}'"
-    if [ -n "$win_sid" ]; then
-      note "  session  $win_sid '${win_name:-none}' (pid $win_pid, profile ${win_profile:-unknown})"
-    else
-      note "  session  none — no live session record names this window"
-    fi
-    if [ "$row_count" = 1 ]; then
-      note "  row      ${row:0:200}"
-    elif [ -n "$pub_row" ]; then
-      pub_row_first="${pub_row%%$'\n'*}"
-      note "  row      ${pub_row_first:0:200}"
-    else
-      note "  row      none — the register has no row for $LANE"
-    fi
-    answer=""; no_tty=0
-    if (( take_yes )); then
-      step "Take lane $LANE in this window? [y/N] y   (--yes)"
-      answer=y
-    elif [ -n "${LANE_START_ANSWER+set}" ]; then
-      step "Take lane $LANE in this window? [y/N] ${LANE_START_ANSWER:-<empty>}   (LANE_START_ANSWER)"
-      answer="$LANE_START_ANSWER"
-    elif [ -t 0 ]; then
-      printf '%s: Take lane %s in this window? [y/N] ' "$prog" "$LANE" >&2
-      IFS= read -r answer || answer=""
-    else
-      answer=""
-      no_tty=1
-    fi
-    case "$answer" in
-      y|Y|yes|YES|Yes) step "taking lane $LANE in this window" ;;
-      *)
-        # AMENDMENT 8(c)/(d), R-A8-3 — EVERY ANSWER LEADS SOMEWHERE AND NO
-        # ANSWER EXITS. `claude-profile` EXECS this script, so this script's
-        # exit status IS the launcher's: a refusal here is an exited pane with
-        # no Claude in it, which is the one failure the whole change exists to
-        # prevent. `N` means NOT THIS LANE, not NOT AT ALL — and no tty with no
-        # `--yes` is the same answer with nobody there to give it, which must
-        # still not take a lane on an inference nobody confirmed. Both fall
-        # through to Claude, bare: nothing renamed, nothing written, no lane,
-        # ONE notice, exit 0. Exit 2 is left to argument errors alone.
-        if (( no_tty )); then
-          bare_why="--confirm was passed, there is no terminal to ask on, and --yes was not, so lane $LANE is NOT taken in a window $why"
-        else
-          bare_why="lane $LANE is NOT taken: the answer was '${answer:-<empty, which is N>}'"
-        fi
-        note "$bare_why. Nothing has been renamed and nothing has been written. Starting Claude with no lane — to take it later, run: $prog $self_args"
-        lane_claude_resolve_launch
-        bare=("$CLAUDE_BIN" ${pass[@]+"${pass[@]}"})
-        if (( no_launch )); then
-          # The launcher asked for a command to exec; it gets the bare one, on
-          # stdout, exactly as it would have got the lane's.
-          quoted "${bare[@]}"; printf '\n'
-          step "--no-launch: the command above was printed, not run"
-          exit 0
-        fi
-        if (( dry_run )); then
-          plan "exec $(quoted "${bare[@]}")"
-          step "--dry-run: nothing was renamed, written or launched"
-          exit 0
-        fi
-        step "exec: $(quoted "${bare[@]}")"
-        exec "${bare[@]}"
-        ;;
-    esac
-  fi
-fi
-
-# Refuse known local conflicts before resolving or updating Claude, and
-# before asking a holder to release its binding.
-lane_check_local_fences() {
-# Step 3 fetched the published register. Before changing a tmux name, prove
-# this identity was not retired (including an unpushed local archive row).
-retired_rc=0
-retired_hits="$(LANES_NO_FETCH=1 "$LANES_EDIT" retired-identity "$LANE" 2>/dev/null)" || retired_rc=$?
-case "$retired_rc" in
-  8) : ;;
-  0) die "lane $LANE is RETIRED (archive: $retired_hits). Nothing was renamed or written; choose a free position." 2 ;;
-  *) die "the lane archive could not be checked for $LANE (exit $retired_rc). Nothing was renamed or written." 1 ;;
-esac
-
-# AND A RETIRED ROW THAT IS STILL IN THE REGISTER (opensoft/openRepoTools#138
-# item 14). The archive holds a retired row only once `archive-rows` has moved
-# it there; until then the row says so itself, and `retired-identity` answers 8
-# about it. So the row is asked too — this checkout's copy and the published
-# one, either of which may be ahead — and so is the lane's own log: a state
-# word of RETIRED, or a last lane-kind line that is RETIRED, is a lane that is
-# not coming back, and resuming it would append a STARTED or RESUMED after its
-# retirement in a log nothing ever rewrites.
-#
-# RETIRED ONLY, AND NOT ENDED. `lane-end` is "the window is closing" and
-# `--retire` is "the lane is not coming back" (docs/README-lanes.md); a binding
-# is released by a PAUSED or an ENDED alike (Amendment 18(b)), `lane` sends a
-# closed lane back here to be reopened, and an ENDED lane resumed by this
-# command is in the real register. Making ENDED terminal is a ruling's to make.
-for retired_row in "$row" "$pub_row"; do
-  retired_word="$(printf '%s\n' "$retired_row" | awk -F'|' 'NF > 2 {
-    split($(NF - 1), w, " "); if (w[1] == "RETIRED") { print w[1]; exit } }')"
-  [ -z "$retired_word" ] ||
-    die "lane $LANE's register row says RETIRED, though the archive does not hold it yet: a retired lane is not coming back (opensoft/openRepoTools#138 item 14). Nothing was renamed or written; choose a free position." 2
-done
-retired_last_rc=0
-retired_last="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-last "$LANE" 2>/dev/null)" || retired_last_rc=$?
-retired_verb="$(printf '%s\n' "$retired_last" | cut -f1)"
-case "$retired_last_rc:$retired_verb" in
-  0:RETIRED)
-    die "lane $LANE's object log ends on its RETIRED line, though the archive does not hold it yet: a retired lane is not coming back (opensoft/openRepoTools#138 item 14). Nothing was renamed or written; choose a free position." 2 ;;
-  0:* | 8:*) : ;;
-  *) die "\`$LANES_EDIT lane-last $LANE\` exited $retired_last_rc, so whether lane $LANE's log ends on RETIRED could NOT be read — and that is not 'it does not' (Amendment 7(d)). Nothing was renamed or written." 1 ;;
-esac
-
-# A lane name is a tmux-window address. tmux itself allows two distinct
-# windows to carry one name, so check the whole server before taking it. A
-# linked window may appear in several sessions with the same @id; that is one
-# window, not a collision.
-#
-# ASKED OF A NEW LANE ONLY — one with no row — because only there is every
-# other window carrying the name certainly FOREIGN: nothing has bound that lane
-# yet. An EXISTING lane's own binding is different since Amendment 18 (#83):
-# a bench in another container shares this tmux server, its window keeps the
-# lane's name until that session hands off, and a second place binding the
-# lane after a release, or through `--request-handoff`, is the ratified flow.
-# Asked of every lane, this fence refused exactly that takeover.
-if [ "$row_count" = 0 ]; then
-  window_named_lane ||
-    die "tmux could not list window names, so whether $LANE is already in use is unknown. Nothing was renamed or written." 2
-  [ -z "$WNL_ID" ] ||
-    die "another tmux window ($WNL_ID) is already named $WNL_NAME, and $LANE is a NEW lane, so that window is not its own. Lane window names must be unique in this tmux server; nothing was renamed or written." 2
-
-  # AND THIS WINDOW'S OWN NAME (opensoft/openRepoTools#138 item 16). The scan
-  # above skips this window, so a NEW lane started from a stale or reused
-  # window still named for ANOTHER registered lane would rename it and take
-  # that lane's tmux address. Only a name no row carries is reusable: `claude`,
-  # a shell, or a string `check_lane_name` refuses, which no row can carry.
-  # Both copies of the register are asked, because a row this checkout has not
-  # pushed already owns its window, and a read that fails refuses.
-  case "$this_window_name" in
-    "" | *[!A-Za-z0-9._-]* | .* | -*) : ;;
-    *)
-      if [ "$(printf '%s' "$this_window_name" | tr 'A-Z' 'a-z')" != "$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')" ]; then
-        for own_read in register-row register-row-local; do
-          own_rc=0
-          LANES_NO_FETCH=1 "$LANES_EDIT" "$own_read" "$this_window_name" >/dev/null 2>&1 || own_rc=$?
-          case "$own_rc" in
-            8) : ;;
-            0) die "this window is named $this_window_name, which is another lane the register has a row for (\`$own_read\`), and $LANE is a NEW lane: renaming the window would take that lane's tmux address (opensoft/openRepoTools#138 item 16). Start $LANE in a window of its own. Nothing was renamed or written." 2 ;;
-            *) die "\`$LANES_EDIT $own_read $this_window_name\` exited $own_rc, so whether this window is another lane's could NOT be read — and that is not 'it is not' (Amendment 7(d)). Nothing was renamed or written." 1 ;;
-          esac
-        done
-      fi ;;
-  esac
-fi
-}
-# The first window OTHER than this one that this tmux server names $LANE, in
-# any case, into WNL_ID and WNL_NAME (both empty where there is none); 1 where
-# tmux could not list the windows. The fence above asks it before the rename,
-# and step 4 asks it again after.
-window_named_lane() {
-  WNL_ID=""; WNL_NAME=""
-  wnl_tab="$(printf '\t')"
-  wnl_rows="$(tmux list-windows -a -F "#{window_id}${wnl_tab}#{window_name}" 2>/dev/null)" || return 1
-  while IFS="$wnl_tab" read -r wnl_id wnl_name; do
-    [ -n "$wnl_id" ] || continue
-    if [ "$wnl_id" != "$this_window_id" ] &&
-       [ "$(printf '%s' "$wnl_name" | tr 'A-Z' 'a-z')" = "$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')" ]; then
-      WNL_ID="$wnl_id"; WNL_NAME="$wnl_name"
-      return 0
-    fi
-  done <<EOF
-$wnl_rows
-EOF
-  return 0
-}
-lane_check_local_fences
-
-# ------------- 3b(ii). AMENDMENT 18(b): ONE BINDING PER LANE, AND THIS PLACE
-#
-# *"A bound lane is started nowhere else — not a second window on the same host,
-# not another container, not another host — until its binding is released by a
-# `PAUSED` (its own, or one written under (e)) or ended. Liveness is pronounced
-# only from INSIDE the binding's own `host` and `container`, where the pid
-# namespace is the record's: from anywhere else a binding is UNKNOWN, never
-# dead, whatever `kill -0` says."* Ratified 2026-09-14T13:15:18Z as revision 4;
-# opensoft/openRepoTools#38.
-#
-# THIS IS A SECOND FENCE AND NOT A REPLACEMENT FOR STEP 3. Step 3 asks whether a
-# session the ROW names is alive and answers out of THIS workstation's session
-# records — which is exactly the read that cannot cross a container seam, and
-# exactly why it said NOT LIVE about a lane cloudBench was writing. So where the
-# binding IS this host's and this container's, step 3 has already pronounced and
-# nothing changes; where it is NOT, this fence refuses whatever `kill -0` said,
-# because the record it read is from another pid namespace.
-#
-# THE ONE EXCEPTION IS THE WINDOW, and the helper has already applied it: on one
-# host the launcher mounts ONE tmux socket into every container it starts, so a
-# binding whose `@id` no longer resolves there — matched by Amendment 11(h)'s
-# agreement rule, the id TOGETHER with its session — is DEAD, and Amendment
-# 6(d)'s retire act and opensoft/openRepoTools#30's takeover path apply as they
-# stand. That is the `gone` the read answers with, and it is answered only where
-# the HOST matches, because a window id from another machine resolving here
-# would be a coincidence.
-#
-# A HELPER PREDATING THIS READ FALLS THROUGH WITH A NOTE, exactly as clause
-# (h)'s other reads do: refusing every lane start on every workstation that has
-# not taken the install yet is not a safety property. Every OTHER code is a read
-# that did not happen, and this one fails CLOSED — a binding that could not be
-# read is not a lane that is free, and the cost of guessing here is two sessions
-# writing one append-only log.
-bind_out=""; bind_rc=0; bind_recheck=0
-: > "$LS_TMP"
-bind_out="$("$LANES_EDIT" binding "$LANE" 2>"$LS_TMP")" || bind_rc=$?
-case "$bind_rc" in
-  0) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2 ;;
-  8) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-     step "no binding: lane $LANE's last lane-kind line released it, or it has none (Amendment 18(b)) — nothing to ask" ;;
-  2) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-     note "this \`lanes-edit.sh\` has no \`binding\` (exit 2), so whether lane $LANE is bound somewhere else is NOT known here. Install the one beside this script (\`openRepoTools --install\`); carrying on with step 3's liveness read alone, which cannot see another container." ;;
-  *) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-     die "$LANES_EDIT binding $LANE exited $bind_rc, so where this lane is bound could NOT be read — and that is not 'it is bound nowhere'. A lane has ONE binding (Amendment 18(b)); nothing has been renamed, written or launched." 1 ;;
-esac
-if [ "$bind_rc" = 0 ]; then
-  IFS=$'\t' read -r b_host b_cont b_win b_utc b_sess b_os b_where b_wstate <<<"$bind_out"
-  if [ "$b_where" = here ]; then
-    step "binding: this host ($b_host) and container ($b_cont), window $b_win since $b_utc — liveness here is this place's to pronounce, and step 3 has (Amendment 18(b))"
-  elif [ "$b_wstate" = gone ]; then
-    note "lane $LANE's binding is window $b_win in container $b_cont on host $b_host (since $b_utc), and that window is GONE from this tmux server — the pane a session must live in does not exist. That is the ONE case in which a binding elsewhere reads DEAD (Amendment 18(b)), because one host's launcher mounts one tmux socket into every container it starts. Carrying on: this is Amendment 6(d)'s retire act and openRepoTools#30's takeover path, unchanged."
-  else
-    # ---- CLAUSE (c): THE SECOND PLACE ASKS, AND NEVER TAKES.
-    ls_bind_facts="lane $LANE is bound to window ${b_win:-none} in container ${b_cont:-none} on host ${b_host:-unknown} (session ${b_sess:-unknown}, last line ${b_utc:-unknown}); this tmux server says that window is ${b_wstate:-unknown}"
-    ls_ask=0
-    if [ -n "$force_why" ]; then
-      ls_ask=force
-    elif (( request_handoff )); then
-      ls_ask=yes
-    elif [ -n "${LANE_START_HANDOFF_ANSWER+set}" ]; then
-      step "$ls_bind_facts"
-      step "ask it to hand off, then bind here? [y/N] ${LANE_START_HANDOFF_ANSWER:-<empty>}   (LANE_START_HANDOFF_ANSWER)"
-      case "$LANE_START_HANDOFF_ANSWER" in y|Y|yes|YES|Yes) ls_ask=yes ;; *) ls_ask=no ;; esac
-    elif [ -t 0 ]; then
-      note "$ls_bind_facts"
-      printf '%s: ask it to hand off, then bind here? [y/N] ' "$prog" >&2
-      IFS= read -r ls_answer || ls_answer=""
-      case "$ls_answer" in y|Y|yes|YES|Yes) ls_ask=yes ;; *) ls_ask=no ;; esac
-    else
-      ls_ask=no-terminal
-    fi
-    if [ "$ls_ask" = no ] || [ "$ls_ask" = no-terminal ]; then
-      ls_flag="Ask it to hand off — the request is written to the lane's log, pushed, and typed into that pane where it is on this tmux server:
-      $prog --request-handoff $self_args"
-      [ "$ls_ask" = no-terminal ] || ls_flag="Ask it to hand off:
-      $prog --request-handoff $self_args"
-      ls_why="a lane has ONE binding, and this is not it (Amendment 18(b))"
-      [ "$ls_ask" = no-terminal ] && ls_why="$ls_why. There is no terminal on stdin to ask on — an agent's stdin is not one — so the flag is the answer"
-      die "$ls_bind_facts.
-    $ls_why. Nothing has been renamed, written or launched. Liveness is
-    pronounced only from inside that binding's own host and container, so from
-    here it is UNKNOWN and never dead, whatever a \`kill -0\` of a pid in
-    another namespace would say.
-      $ls_flag
-      or take it anyway, which is a SECOND invocation and never automatic, and
-      which makes that place STOP loudly rather than silently:
-      $prog --force \"<why you are taking it>\" $self_args" 2
-    fi
-    # Approval precedes any possible update; resolution precedes release.
-    # With no explicit agent the holder's new PAUSED may name Claude, so
-    # preflight that possible launch before asking it to give up the binding.
-    # An explicit other agent never needs a Claude preflight.
-    if [ -z "$agent_flag" ] || [ "$agent_flag" = claude ]; then
-      lane_claude_resolve_launch
-    fi
-    ls_rh=("$LANES_EDIT" request-handoff "$LANE")
-    [ -z "$win_sid" ] || ls_rh+=(--session "$win_sid")
-    if [ "$ls_ask" = force ]; then
-      ls_rh+=(--force "$force_why")
-    else
-      ls_rh+=(--wait "$handoff_wait")
-    fi
-    (( dry_run )) && ls_rh+=(--dry-run)
-    step "$(quoted "${ls_rh[@]}")"
-    ls_rh_rc=0
-    "${ls_rh[@]}" || ls_rh_rc=$?
-    case "$ls_rh_rc" in
-      0) bind_recheck=1; step "lane $LANE is free — binding it here (Amendment 18(c))" ;;
-      8) bind_recheck=1; step "lane $LANE was already free by the time the request was made — binding it here" ;;
-      2) die "the handoff was not obtained (the helper's own facts and its \`--force\` line are above), so lane $LANE is still bound elsewhere and NOTHING here has been renamed, written or launched." 2 ;;
-      *) die "$LANES_EDIT request-handoff $LANE exited $ls_rh_rc, which is neither 'the lane is free' nor the refusal that says it is not — nothing here has been renamed, written or launched." 1 ;;
-    esac
-  fi
-fi
-
-# The successful handoff may have published a different agent in its PAUSED
-# record. Read that authoritative answer now, before rename or transcript movement.
-AGENT=""; AGENT_EXPLICIT=0; AGENT_ID=""; RECORDED_AGENT=""; RECORDED_AGENT_READ=0
-read_recorded_agent() {
-  rra_out=""; rra_rc=0
-  rra_out="$("$LANES_EDIT" lane-agent "$LANE" 2>/dev/null)" || rra_rc=$?
-  RECORDED_AGENT_READ=1
-  case "$rra_rc" in
-    0) RECORDED_AGENT="$rra_out" ;;
-    8|2) RECORDED_AGENT="" ;;
-    # A READ THAT FAILED IS NOT "THIS LANE'S RECORD NAMES NO AGENT", and the
-    # helper says so in its own refusal: *"a caller that read it that way would
-    # launch the default agent over a lane another one paused"* (Amendment
-    # 7(d), `lanes-edit.sh`'s `lane-agent` arm). This used to `note` and launch
-    # `claude` anyway — the one act in this whole command that no later refusal
-    # can undo — so it refuses, and names the flag that goes past it, which is
-    # a person naming the agent rather than this command guessing at one.
-    *) die "\`$LANES_EDIT lane-agent $LANE\` failed (exit $rra_rc), so which agent paused this lane is UNKNOWN — and launching the default over a lane another agent paused is what Amendment 7(d) has this read refuse rather than answer. Run it by hand to see what it says, or name the agent: $prog --agent <name> …" 2 ;;
-  esac
-  return 0
-}
-if [ -n "$bind_sid" ]; then
-  # THE BINDING MODE BINDS THE CLAUDE SESSION THE GUARD IS RUNNING IN
-  # (openRepoTools#70), whichever agent last paused this lane: the launcher
-  # table below would otherwise stamp `<agent> pending` for a session that is
-  # plainly here and plainly Claude.
-  AGENT=claude
-elif [ -n "$agent_flag" ]; then
-  AGENT="$agent_flag"; AGENT_EXPLICIT=1
-else
-  read_recorded_agent
-  if [ -n "$RECORDED_AGENT" ]; then AGENT="$RECORDED_AGENT"; fi
-  [ -n "$AGENT" ] || AGENT=claude
-  [ "$AGENT" = claude ] || AGENT_EXPLICIT=1
-fi
-case "$AGENT" in
-  *[!A-Za-z0-9._-]*|'') die "--agent takes a manifest key — letters, digits, '.', '_', '-' — and '$AGENT' is not one (Amendment 17(b))" 2 ;;
-esac
-# THE AGENT THIS LANE IS RUNNING, IN THE ENVIRONMENT OF THE SESSION IT STARTS
-# (Copilot round 2 on openRepoTools#47). `lane-handoff` derives the record's
-# `agent` sub-field from `$LANES_AGENT`, else `claude` — so a `codex` session
-# launched here would write `agent claude` at its own handoff and the next
-# `lane-start` would resume it with the wrong launcher, one record along. The
-# launch decides which agent this is; the launch is therefore what says so.
-export LANES_AGENT="$AGENT"
-if [ "$AGENT" = claude ]; then
-  lane_claude_resolve_launch
-fi
-
-# ------------------------------------------------------- 4. name the window
-
-# Resolver work can take time. Preserve the final read too, so a retirement
-# or new window collision during that wait still refuses before rename.
-lane_check_local_fences
-
-# ---------------- 3d. AND THE BINDING IS READ AGAIN BEFORE THE FIRST ACT
-#
-# A HANDOFF THAT LANDED IS AN OBSERVATION AND NOT A RESERVATION (Copilot round 1
-# on opensoft/openRepoTools#83). `request-handoff` returns 0 when it SEES the
-# release; between that and the rename, the row status, the log line and the
-# launch, another place waiting on the same release can bind the lane — and
-# `commit_push` rebases both append-only writes rather than refusing the second,
-# so the log would carry two bindings and no reader could say which is the
-# lane's.
-#
-# NOTHING IN THE RATIFIED TEXT GIVES A LANE A RESERVATION, and inventing one
-# here would be an unratified act on an in-force protocol — it is filed rather
-# than smuggled in (opensoft/openRepoTools#84). What IS available is to make the
-# read the LAST thing before the first act instead of the first thing in the
-# run: the window between them is then one read wide rather than a question, a
-# rename, two register writes and a launch wide, and a lane that moved in it is
-# a refusal naming where it went rather than a second binding written over it.
-#
-# A RESOLVER MAY WAIT TOO: another start can bind while this one waits for
-# the update lock or npm. Recheck after resolution, immediately before rename,
-# including an initially free binding. An unchanged existing binding remains
-# valid; an observed release or replacement is not this invocation's binding.
-# AND A DRY RUN HAS NOTHING TO RE-READ, BECAUSE IT DID NOTHING (Copilot round 3
-# on opensoft/openRepoTools#83). `request-handoff --dry-run` prints its plan and
-# answers 0 WITHOUT releasing anything, so an unconditional re-read here sees the
-# binding still standing and refuses — and `lane-start --dry-run
-# --request-handoff`, whose whole job is to print the plan, could never print
-# one. A plan is a statement about what WOULD happen; the fence that protects
-# the first act belongs to the run that takes it.
-bind_waited="$bind_recheck"
-bind_expected_rc="$bind_rc"; bind_expected_out="$bind_out"
-if [ "$bind_recheck" = 1 ]; then
-  bind_expected_rc=8; bind_expected_out=""
-fi
-[ "$lane_claude_checked" = 0 ] || bind_recheck=1
-if [ "$bind_recheck" = 1 ] && (( dry_run )); then
-  plan "read the binding again before the rename, and refuse if the lane moved while this run was taking it"
-  bind_recheck=0
-fi
-if [ "$bind_recheck" = 1 ]; then
-  : > "$LS_TMP"
-  bind_again=""; bind_again_rc=0
-  bind_again="$("$LANES_EDIT" binding "$LANE" 2>"$LS_TMP")" || bind_again_rc=$?
-  [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-  case "$bind_again_rc" in
-    8) [ "$bind_expected_rc" = 8 ] ||
-         die "lane $LANE's binding changed while Claude was resolved: it is now released. Nothing here was renamed or bound; retry against the current record." 2
-       if [ "$bind_waited" = 1 ]; then
-         step "binding: still free after the handoff — taking it"
-       else
-         step "binding: still free after Claude resolution — taking it"
-       fi ;;
-    0)
-      if [ "$bind_expected_rc" = 0 ] && [ "$bind_again" = "$bind_expected_out" ]; then
-        step "binding: unchanged after Claude resolution"
-      else
-        IFS=$'\t' read -r ba_host ba_cont ba_win ba_utc ba_sess ba_os ba_where ba_wstate <<<"$bind_again"
-        # A NEW OR CHANGED BINDING IS THE RACE, INCLUDING ONE IN THIS WINDOW.
-        # This invocation wrote no STARTED/RESUMED yet. An unchanged prior
-        # binding was accepted above; this one appeared during the wait.
-        die "lane $LANE was BOUND AGAIN or changed while this run was taking it: it is now window ${ba_win:-none} in container ${ba_cont:-none} on host ${ba_host:-unknown} (session ${ba_sess:-unknown}, ${ba_utc:-unknown}). This run observed a free or earlier binding before its wait, and another binding now stands before its first act. This run has written no binding of its own yet, so that one is not this invocation's: a binding at THIS window is a second invocation IN it, which is the same race one pane closer. Nothing has been renamed, written or launched. Ask again, or take it up with that place:
-      $prog --request-handoff $self_args" 2
-      fi ;;
-    2) [ "$bind_expected_rc" = 2 ] ||
-         die "the binding could not be rechecked after Claude resolution (exit 2). Nothing here was renamed or bound." 1
-       note "this \`lanes-edit.sh\` has no \`binding\`, so whether the lane moved again while this run waited is not known here; carrying on." ;;
-    *) die "$LANES_EDIT binding $LANE exited $bind_again_rc on the re-read before the rename, so whether this lane is still free could NOT be established — and that is not 'it is'. Nothing has been renamed, written or launched." 1 ;;
-  esac
-fi
-
-if (( dry_run )); then
-  plan "tmux rename-window $LANE   (also turns automatic-rename off for this window)"
-else
-  win_auto_was=""
-  [ "$row_count" != 0 ] || win_auto_was="$(tmux show-options -w -v automatic-rename 2>/dev/null || :)"
-  tmux rename-window "$LANE"
-  step "window renamed to $LANE (automatic-rename is now off for it)"
-fi
-
-# AND A NEW LANE'S NAME IS READ BACK (opensoft/openRepoTools#138 item 3). The
-# fence's scan and the rename above are two tmux commands with nothing reserving
-# the name between them, so two NEW-lane starts in two windows could both find
-# it free and both take it — and the register's lock, which comes after, cannot
-# undo a rename. Nothing here invents a reservation (#84: that is a ruling's to
-# make); the rename is checked instead. tmux runs one command at a time, so of
-# two starts that each rename and then list, the later list always sees the
-# earlier rename: at most one keeps the name, and both refusing is the
-# fail-closed answer. A list that fails is not a name that is free. A refusal
-# gives THIS window back its name and its automatic-rename, so nothing of this
-# run is left behind it.
-if (( ! dry_run )) && [ "$row_count" = 0 ]; then
-  rb_why=""
-  if ! window_named_lane; then
-    rb_why="tmux could not list the windows after the rename, so whether another window took $LANE as well is unknown"
-  elif [ -n "$WNL_ID" ]; then
-    rb_why="after the rename another tmux window ($WNL_ID) is named $WNL_NAME too: a second start took this NEW lane's name between this run's check and its rename"
-  fi
-  if [ -n "$rb_why" ]; then
-    # NO NAME TO GO BACK TO IS NO UNDO: where tmux answered `#W` with nothing,
-    # nothing here can name this window back, and the refusal says so rather
-    # than claiming an undo it did not make.
-    rb_undo="This window's rename could NOT be undone, because its earlier name is not known — rename it yourself: tmux rename-window <its name>"
-    if [ -n "$this_window_name" ]; then
-      if tmux rename-window "$this_window_name" 2>/dev/null; then
-        rb_undo="This window's rename is undone"
-      else
-        rb_undo="This window's rename could NOT be undone — rename it back yourself: tmux rename-window $this_window_name"
-      fi
-    fi
-    case "$win_auto_was" in
-      "") tmux set-option -w -u automatic-rename 2>/dev/null || : ;;
-      on) tmux set-option -w automatic-rename on 2>/dev/null || : ;;
-    esac
-    die "$rb_why (opensoft/openRepoTools#138 item 3). $rb_undo, and nothing has been written or launched. Lane window names are unique in a tmux server; settle which window is $LANE and re-run there." 2
-  fi
-fi
-
-# ------------------------------------------------- 5a. what will be launched
-#
-# Decided BEFORE the row is written: a brand-new session's id is minted here
-# and step 5 has to record it.
-
-# Claude keeps one transcript directory per working directory, named by that
-# path with every non-alphanumeric character turned into '-'. A lane reached
-# through a symlink has two spellings, so both are searched.
-sanitize() { printf '%s' "$1" | tr -c 'A-Za-z0-9' '-'; }
-
-transcript_dirs() {
-  printf '%s\n' "$PROJECTS_STATE/$(sanitize "$DIR")"
-  [ "$DIR_REAL" = "$DIR" ] || printf '%s\n' "$PROJECTS_STATE/$(sanitize "$DIR_REAL")"
-}
-
-# ===================== AMENDMENT 17, adoption act 6: THE TRANSCRIPT FOLLOWS
-# ===================== THE LANE
-#
-# `transcript_dirs` above looks under THIS PROFILE's projects directory and
-# nowhere else, so a lane restarted under a NEW PROFILE after a usage limit
-# never resumed its conversation: it fell to the title fallback or to a new
-# session primed by a handoff the stuck session never refreshed.
-#
-# MEASURED FIRST, AND THE FACT SHRANK THE ACT (opensoft/openRepoTools#36, the
-# correction of 2026-09-14T12:35Z): on a launcher-configured workstation EVERY
-# profile's `projects/` is ONE shared directory —
-# `readlink -f ~/.claude-profiles/profiles/<org>/<team>/<any>/projects` →
-# `~/.claude-profiles/state/opensoft/projects` — so a transcript needs NO MOVE
-# to be resumed under another profile, and the whole act there is to SAY SO.
-# The move is for the workstation without that layout, where the two
-# directories are really two.
-#
-# WHY A MOVE AND NEVER A COPY: two live transcripts of one uuid diverge, and
-# nothing merges them. The pointer left behind says where it went.
-# THE PROFILE STORE'S ROOT IS THE DOCUMENTED ONE, NEVER `~/.claude-profiles`
-# SPELLED AGAIN (Copilot round 1 on openRepoTools#47). `$CLAUDE_PROFILES_HOME`
-# is in this repository's README table and is what `lanes-edit.sh`'s own profile
-# walk reads (`lanes-edit.sh:4381`); a second spelling here is a second answer
-# to "where are this person's profiles", and on a workstation that moved the
-# store it is the WRONG one — every scan below would find nothing, and a lane
-# resumed under another profile would start a new conversation beside a
-# transcript that was there all along.
-PROFILES_HOME="${CLAUDE_PROFILES_HOME:-$HOME/.claude-profiles}"
-
-profile_projects_dirs() {
-  # This profile's own first, then every other profile's. Team profiles sit two
-  # levels down, which is the same shape `lanes-edit.sh`'s `session_files` walks
-  # for the sessions beside them.
-  printf '%s\n' "$PROJECTS_STATE"
-  for ppd_d in "$PROFILES_HOME"/profiles/*/*/*/projects \
-               "$PROFILES_HOME"/profiles/*/*/projects \
-               "$PROFILES_HOME"/profiles/*/projects \
-               "$CLAUDE_HOME"/projects; do
-    [ -d "$ppd_d" ] && printf '%s\n' "$ppd_d"
-  done
-}
-
-# THE PHYSICAL PATH, WITHOUT `readlink -f` — which is not in the stock macOS
-# userland (Copilot round 1 on openRepoTools#47), where it exits 1 and a
-# fallback hands the path back UNRESOLVED. Two spellings of ONE directory then
-# compare as two directories, and the shared-`projects/` case below — which on
-# a launcher-configured workstation is EVERY case — would move a transcript
-# that never needed moving, on the platform this suite's own macOS job runs.
-# `cd -P` + `pwd -P` is the shell's own answer and is in every shell that
-# parses this file. A path that is not a directory comes back as it was given,
-# which is what the `readlink -f` fallback did.
-real_of() { ( CDPATH=''; cd -P -- "$1" 2>/dev/null && pwd -P ) || printf '%s\n' "$1"; }
-# THE HANDOFF'S DIGEST, spelled exactly as `lanes-edit.sh` spells it, because
-# the two are compared: this file is what the intent recorded and what a launch
-# verifies, and two implementations of one digest is one implementation too
-# many. `none` where the workstation has neither tool — an ANSWER, meaning *not
-# checked here*, never *unchanged*.
-handoff_digest_of() {   # <file>
-  [ -r "${1-}" ] || { printf 'none\n'; return 0; }
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum -- "$1" 2>/dev/null | awk '{print $1; exit}'
-  elif command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 -- "$1" 2>/dev/null | awk '{print $1; exit}'
-  else
-    printf 'none\n'
-  fi
-}
-
-profile_of_projects_dir() {   # <…/<profile>/projects> -> the profile's name
-  popd_d="${1%/projects}"; popd_n="${popd_d##*/}"
-  case "$popd_n" in .claude|claude|"") printf 'default\n' ;; *) printf '%s\n' "$popd_n" ;; esac
-}
-
-# The transcript of one id under ONE projects directory, in either spelling of
-# the lane's path (a lane reached through a symlink has two).
-transcript_under() {   # <projects dir> <id>
-  tu_d="$1"; tu_id="$2"
-  for tu_s in "$(sanitize "$DIR")" "$(sanitize "$DIR_REAL")"; do
-    [ -f "$tu_d/$tu_s/$tu_id.jsonl" ] && { printf '%s\n' "$tu_d/$tu_s/$tu_id.jsonl"; return 0; }
-  done
-  return 1
-}
-
-# EVERY LIVE HOLDER OF AN ID, ACROSS EVERY PROFILE'S `sessions/` (Amendment
-# 18(h), in force 2026-09-14T13:15:18Z: *"A transcript (one session id) is held
-# by ONE live process"*). WHO IS LIVE IS `lanes-edit.sh`'s ONE ANSWER AND NOT A
-# SECOND ONE HERE (opensoft/openRepoTools#56). This function used to read the
-# records itself and test the pid with `kill -0` ALONE — one of the three tests
-# `record_is_live` makes, not three — so a record that had ENDED, or whose pid
-# had been RECYCLED onto some other process, read as a live holder and refused a
-# transcript's follow with *"a LIVE process there holds it"* and the retire act,
-# about a process that is not that session. `lanes-edit.sh transcript-holders`
-# (opensoft/openRepoTools#52) is that read, on `record_is_live` — status not
-# ended, the pid answers, and `procStart` is still the one the record wrote down
-# — across every profile through `session_files`, and `dup_check` above already
-# asks it; this asks it the same way and reads its exits the same way.
-#
-# EVERY ROW IT PRINTS IS A HOLDER HERE, WHATEVER ITS VERDICT. The verdict says
-# what THIS WINDOW's relation to the holder is, which is `dup_check`'s question;
-# the question at this call is narrower and older — *is any live process holding
-# the id this run is about to move out of another profile* — and the move is
-# wrong for a `companion` or a `here` record just as it is for a `duplicate`.
-# The row's format is the contract this reads (`pid US kind US tgt US profile US
-# where US verdict US file`), and the verdict stays the helper's to change.
-#
-# IT SETS `LIVE_HOLDERS` — `<pid><TAB><tmux target, or bg><TAB><profile>` per
-# holder, one to a line — AND PRINTS NOTHING, and it is never called inside
-# `$( )`: a refusal is `FOLLOW_WHY`, and a subshell would keep it to itself (the
-# reason `follow_transcript` states beside its own variables). Returns 0 with
-# the holders read (none is an answer), 2 where they could not be.
-LIVE_HOLDERS=""
-live_holders_of_id() {   # <id>
-  lho_id="$1"; LIVE_HOLDERS=""; lho_rc=0; lho_rows=""
-  lho_tab=$'\t'; lho_nl='
-'
-  : > "$LS_TMP"
-  lho_rows="$("$LANES_EDIT" transcript-holders "$lho_id" 2>"$LS_TMP")" || lho_rc=$?
-  case "$lho_rc" in
-    0) : ;;
-    8) return 0 ;;
-    2) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-       note "this \`lanes-edit.sh\` has no \`transcript-holders\` (exit 2), so whether a live process already holds transcript $lho_id is NOT known here. Install the one beside this script (\`openRepoTools --install\`); carrying on."
-       return 0 ;;
-    *) [ -s "$LS_TMP" ] && cat -- "$LS_TMP" >&2
-       FOLLOW_WHY="$LANES_EDIT transcript-holders $lho_id exited $lho_rc, so whether a live process holds that transcript could NOT be read — and that is not 'none does'. A transcript is held by ONE live process (Amendment 18(h)): nothing was moved and nothing was launched."
-       return 2 ;;
-  esac
-  while IFS=$'\037' read -r lho_pid lho_kind lho_tgt lho_prof lho_where lho_verdict lho_file; do
-    [ -n "${lho_pid:-}" ] || continue
-    # The raw tmux target, and `bg` where the record names none (`transcript-holders`
-    # writes `none`) — what this said before it asked the helper.
-    case "${lho_tgt:-none}" in none) lho_tgt=bg ;; esac
-    LIVE_HOLDERS="${LIVE_HOLDERS:+$LIVE_HOLDERS$lho_nl}$lho_pid$lho_tab$lho_tgt$lho_tab${lho_prof:-}"
-  done <<<"$lho_rows"
-  return 0
-}
-
-# PUTTING THE MOVE BACK. The transaction below is three writes, and the two
-# after the first each undo what came before them rather than leave a
-# transcript split across two profiles. It reads `follow_transcript`'s own
-# `ft_*` variables — one act, one set of names — and PRINTS what it could not
-# undo rather than returning a code, because a rollback that itself failed is
-# the one state nobody can infer from the outside and the refusal has to say it.
-ft_rollback() {
-  ftr_out=""
-  if [ "${ft_moved_sib:-0}" = 1 ]; then
-    mv -- "$ft_dest_dir/$ft_id" "$ft_sib" 2>/dev/null ||
-      ftr_out="the sibling directory is at $ft_dest_dir/$ft_id and could not be put back to $ft_sib"
-  fi
-  mv -- "$ft_dest_dir/$ft_id.jsonl" "$ft_f" 2>/dev/null ||
-    ftr_out="${ftr_out:+$ftr_out; }the transcript is at $ft_dest_dir/$ft_id.jsonl and could not be put back to $ft_f"
-  printf '%s' "$ftr_out"
-  return 0
-}
-
-# THE SEARCH, THE SAY AND THE MOVE. Sets `FOLLOW_FILE` (the transcript's path
-# HERE, after any move) and `FOLLOW_WHY` (a refusal), and returns 0 found, 8
-# nowhere, 2 refused. IT NEVER `die`s: a refusal inside `$( )` kills only the
-# substitution's subshell, and the caller would carry on with an empty answer —
-# which here would mean starting a second process on a transcript another live
-# one holds.
-FOLLOW_FILE=""; FOLLOW_WHY=""
-follow_transcript() {   # <id>
-  ft_id="$1"; FOLLOW_FILE=""; FOLLOW_WHY=""
-  ft_here_real="$(real_of "$PROJECTS_STATE")"
-  ft_shared=""
-  while IFS= read -r ft_d; do
-    [ -n "$ft_d" ] || continue
-    [ "$ft_d" = "$PROJECTS_STATE" ] && continue
-    ft_real="$(real_of "$ft_d")"
-    if [ "$ft_real" = "$ft_here_real" ]; then
-      # THE SHARED-DIRECTORY CASE, which on a launcher-configured workstation is
-      # every case: the other profile's `projects/` IS this one, so the
-      # transcript is already here and nothing is moved.
-      ft_shared="${ft_shared:+$ft_shared }$(profile_of_projects_dir "$ft_d")"
-      continue
-    fi
-    ft_f="$(transcript_under "$ft_d" "$ft_id" 2>/dev/null || :)"
-    [ -n "$ft_f" ] || continue
-    ft_prof="$(profile_of_projects_dir "$ft_d")"
-    # A UUID WHOSE HOLDER IS LIVE THERE IS A REFUSAL, NEVER A MOVE (Amendment
-    # 18(h)): moving the file out from under a running process, and then
-    # resuming the same id here, is two live processes on one transcript — the
-    # state measured on this lane on 2026-09-14 and the reason that clause
-    # exists.
-    # NOT `$( )`: `live_holders_of_id` sets `FOLLOW_WHY` when the holders cannot
-    # be read, and a subshell would keep the refusal to itself.
-    ft_hrc=0
-    live_holders_of_id "$ft_id" || ft_hrc=$?
-    [ "$ft_hrc" = 0 ] || return "$ft_hrc"
-    ft_holders="$LIVE_HOLDERS"
-    if [ -n "$ft_holders" ]; then
-      FOLLOW_WHY="transcript $ft_id is in profile $ft_prof's projects directory ($ft_d) and a LIVE process there holds it:
-$(printf '%s\n' "$ft_holders" | sed 's/^/      pid /; s/\t/ in /; s/\t/ under profile /')
-    A transcript is held by ONE live process (Amendment 18(h)): moving it here and resuming the id would make a second. Nothing was moved and nothing was launched.
-    End that process, or retire it: lane-end $LANE --retire <pid>"
-      return 2
-    fi
-    # THE MOVE: the `<uuid>.jsonl` and its sibling `<uuid>/` directory, into the
-    # SAME slug under this profile, with a pointer left where it was.
-    ft_dest_dir="$PROJECTS_STATE/$(basename -- "$(dirname -- "$ft_f")")"
-    ft_sib="${ft_f%.jsonl}"
-    # `--dry-run` MOVES NOTHING (Copilot round 1 on openRepoTools#47). This
-    # function runs long before the dry-run exit at the foot of the script, and
-    # a command whose last line is *nothing was renamed, written or launched*
-    # must not have moved a person's transcript out of another profile to get
-    # there. The plan is printed with both paths instead, and the caller says
-    # what it would have followed.
-    if (( dry_run )); then
-      plan "mv $ft_f $ft_dest_dir/$ft_id.jsonl (with its sibling $ft_id/, and a pointer left where it was)"
-      FOLLOW_WHY="dry-run:transcript $ft_id is in profile $ft_prof's projects directory ($ft_d) and WOULD be moved into $ft_dest_dir"
-      return 8
-    fi
-    mkdir -p -- "$ft_dest_dir" 2>/dev/null || {
-      FOLLOW_WHY="could not create $ft_dest_dir to move transcript $ft_id into"; return 2; }
-    # AN OCCUPIED DESTINATION IS REFUSED BEFORE ANYTHING MOVES (Copilot round 3
-    # on openRepoTools#47). `mv <dir> <existing dir>` does not fail — it moves
-    # the source INSIDE it — so a `<uuid>/` already sitting here would take the
-    # other profile's sidecar as `<uuid>/<uuid>/`, mark the sibling moved, and
-    # resume with the transcript's state split from the transcript. Nothing this
-    # command writes is worth guessing which of two `<uuid>` directories is the
-    # lane's, so it names what is there and stops. A name that is NOT a
-    # directory is left to the transaction below, where `mv` really does fail
-    # and the rollback puts the transcript back.
-    if [ -d "$ft_dest_dir/$ft_id" ] || [ -e "$ft_dest_dir/$ft_id.jsonl" ]; then
-      FOLLOW_WHY="transcript $ft_id is in profile $ft_prof's projects directory ($ft_d), and something ALREADY SITS where it would go: $ft_dest_dir/$ft_id$( [ -e "$ft_dest_dir/$ft_id.jsonl" ] && printf '.jsonl' ). Nothing was moved — a move onto an occupied name puts one transcript inside another, and which of the two is this lane's is not this command's to guess. Move that aside, or end the lane that owns it."
-      return 2
-    fi
-    if ! mv -- "$ft_f" "$ft_dest_dir/$ft_id.jsonl" 2>/dev/null; then
-      FOLLOW_WHY="could not move $ft_f into $ft_dest_dir (the transcript stays where it is, and this lane will not resume an id it cannot read)"
-      return 2
-    fi
-    # THE THREE WRITES ARE ONE TRANSACTION (Copilot round 1 on
-    # openRepoTools#47). The `.jsonl`, its sibling `<uuid>/` state directory and
-    # the pointer left behind are one act, and a HALF-DONE one is worse than
-    # none: a sibling orphaned in the other profile is state the resumed session
-    # silently loses, and a transcript gone from where a person will look for it
-    # with no pointer has had its only recovery trail deleted. So each of the
-    # two below is CHECKED, and a step that cannot complete puts back what the
-    # steps before it moved and refuses — naming the parts it could not put
-    # back, because a rollback that itself failed is the one state nobody can
-    # infer from the outside.
-    ft_moved_sib=0
-    if [ -d "$ft_sib" ]; then
-      if mv -- "$ft_sib" "$ft_dest_dir/$ft_id" 2>/dev/null; then
-        ft_moved_sib=1
-      else
-        ft_undone="$(ft_rollback)"
-        FOLLOW_WHY="transcript $ft_id moved into $ft_dest_dir, but its sibling state directory $ft_sib could NOT follow it — half a transcript is not one, so the move was put back. Nothing was launched.${ft_undone:+
-    WHAT COULD NOT BE PUT BACK: $ft_undone}"
-        return 2
-      fi
-    fi
-    # THE POINTER, WHERE THE FILE WAS: `<uuid>.jsonl.moved-to-<profile>-<UTC>`.
-    # A person looking for a transcript that is not where they left it is owed
-    # the sentence, in the directory they are standing in — so a pointer that
-    # cannot be written (a source directory that is read-only, say) undoes the
-    # move rather than completing it untraceably.
-    ft_to="${CLAUDE_PROFILE_NAME:-}"
-    [ -n "$ft_to" ] || ft_to="$(profile_of_projects_dir "$PROJECTS_STATE")"
-    ft_ptr="$ft_f.moved-to-$ft_to-$(date -u +%Y-%m-%dT%H%M%SZ)"
-    if ! printf 'moved to %s by %s at %s\n' "$ft_dest_dir" "$prog" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
-         > "$ft_ptr" 2>/dev/null; then
-      rm -f -- "$ft_ptr" 2>/dev/null || :
-      ft_undone="$(ft_rollback)"
-      FOLLOW_WHY="transcript $ft_id could not be given its pointer at $ft_ptr, which is the only trail back to where it was — so the move was put back rather than left untraceable. Nothing was launched.${ft_undone:+
-    WHAT COULD NOT BE PUT BACK: $ft_undone}"
-      return 2
-    fi
-    step "transcript $ft_id was in profile $ft_prof's projects directory ($ft_d), which is NOT this profile's — moved into $ft_dest_dir, with a pointer left where it was (a copy would leave two live transcripts of one uuid diverge)"
-    FOLLOW_FILE="$ft_dest_dir/$ft_id.jsonl"
-    return 0
-  done <<EOF
-$(profile_projects_dirs)
-EOF
-  [ -z "$ft_shared" ] || FOLLOW_WHY="shared:$ft_shared"
-  return 8
-}
-
-# The transcript of ONE recorded session id, in this directory.
-recorded_transcript() {
-  local id="$1" d
-  [ -n "$id" ] || return 1
-  while IFS= read -r d; do
-    if [ -f "$d/$id.jsonl" ]; then printf '%s\n' "$d/$id.jsonl"; return 0; fi
-  done < <(transcript_dirs)
-  return 1
-}
-
-# A `/rename` is a `{"type":"custom-title",…}` record inside the transcript,
-# and the LAST one wins — a session renamed away from this lane must not be
-# resumed by it. Several transcripts can still carry one title; that is why
-# this is only the fallback.
-# `<LANE> (2)` is the SAME lane: that suffix is exactly what a rename into a
-# title something else still holds mints, and live_holder() already reads it
-# that way. A matcher that insisted on the bare string would hide a lane from
-# itself — this orchestrator's own title on 2026-09-11 was `codeXfactory-1 (4)`.
-# AMENDMENT 15 — THE TITLE IS MATCHED CASE-INSENSITIVELY, because the SESSION
-# NAME is one of the lookups the rule names and because this is the branch that
-# decides RESUME versus MINT A NEW ONE. `openXfactory-2`'s own transcript is
-# titled `openxfactory-2` — the launcher named it that on 2026-09-13, and the
-# row says `openXfactory-2` since the 15(d) merge — so a byte-for-byte matcher
-# would find NO transcript for that lane and start a second conversation on it,
-# which is the incident this amendment exists to stop, one branch along.
-# `live_holder` and `fork_map` have matched titles case-insensitively all along;
-# this was the one that did not.
-#
-# THE LANE IS LOWER-CASED ONCE, outside the loop, and only the candidate's own
-# `base` per file — which is two processes this loop already spends on `grep`
-# and `sed` for every file it looks at.
-titled_transcript() {
-  local d f last title base tt_lane_lc
-  tt_lane_lc="$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')"
-  while IFS= read -r d; do
-    [ -d "$d" ] || continue
-    for f in "$d"/*.jsonl; do
-      [ -e "$f" ] || continue
-      last="$(grep -e '^{"type":"custom-title"' "$f" 2>/dev/null | tail -n1 || :)"
-      [ -n "$last" ] || continue
-      title="$(printf '%s' "$last" | sed 's/.*"customTitle":"//; s/".*//')"
-      base="${title% (*)}"
-      if [ "$(printf '%s' "$base" | tr 'A-Z' 'a-z')" = "$tt_lane_lc" ]; then printf '%s\t%s\n' "$f" "$title"; return 0; fi
-    done
-  done < <(transcript_dirs)
-  return 1
-}
-
-new_uuid() {
-  if [ -r /proc/sys/kernel/random/uuid ]; then cat /proc/sys/kernel/random/uuid
-  elif command -v uuidgen >/dev/null 2>&1; then uuidgen | tr 'A-F' 'a-f'
-  else return 1
-  fi
-}
-
-# Amendment 7's lane verb follows the LAUNCH decision, which is the honest
-# reading of it: a resume is a RESUMED and a new session is a STARTED.
-lane_verb=STARTED
-lane_sid=""
-
-# ================= AMENDMENT 17(c): WHICH AGENT, AND WHAT IT IS LAUNCHED WITH
-#
-# *"`lane-start <repo> <n>` reads the row and the last `PAUSED`. Where the agent
-# asked for is the one that paused, and its transcript is here, it resumes
-# exactly as today (Amendment 6's case (a)). Otherwise — a different agent, or
-# no transcript here — it launches the named agent with THE HANDOFF'S TOP BLOCK
-# AS ITS FIRST PROMPT … With no `--agent` the default is the agent that paused;
-# with no `PAUSED` the default is `claude`."*
-#
-# THE DEFAULT COMES FROM THE RECORD, THROUGH THE ONE READ THAT ANSWERS FOR IT
-# (`lane-agent`, this amendment's sibling of `lane-dir`). 8 is "no record of
-# this amendment yet" — every lane until its own next handoff — and it is not a
-# failure: `claude` is what this command has always launched.
-# THE AGENT'S OWN RESUMABLE ID, where the record carries one. For `claude` that
-# is the transcript uuid the session cell already records and this script
-# already resumes; for another agent it is the one id a launch has in hand, and
-# it is what the row's session cell is appended with in that agent's spelling
-# (`Codex <id>`). `none` is an ANSWER — the agent has no resumable id — and is
-# not carried into the cell as if it were one.
-#
-# AND ONLY WHERE THE RECORD IS THAT AGENT'S (Copilot round 2 on
-# openRepoTools#47). `lane-transcript` answers for the LANE — its last `PAUSED`,
-# whichever agent wrote it — so a lane paused by `claude` and resumed with
-# `--agent codex` would take the CLAUDE uuid and append it to the row's session
-# cell spelled `Codex <uuid>`: an id no `codex` can resume, attributing this
-# lane's history to a conversation that is not it, in a cell nothing rewrites.
-if [ "$AGENT" != claude ]; then
-  [ "$RECORDED_AGENT_READ" = 1 ] || read_recorded_agent
-  if [ -n "$RECORDED_AGENT" ] && [ "$RECORDED_AGENT" != "$AGENT" ]; then
-    note "the lane's last handoff names agent $RECORDED_AGENT and this launch is $AGENT, so the recorded transcript is NOT carried into the row's session cell — that id is $RECORDED_AGENT's and $AGENT cannot resume it. This launch is recorded without an id of its own; the session's first act stamps the row with the one it gets."
-  else
-    at_out=""; at_rc=0
-    at_out="$("$LANES_EDIT" lane-transcript "$LANE" 2>/dev/null)" || at_rc=$?
-    case "$at_rc" in
-      0) [ "$at_out" = none ] || AGENT_ID="$at_out" ;;
-      8|2) : ;;
-      *) note "$LANES_EDIT lane-transcript $LANE failed (exit $at_rc) — the row's session cell will record this launch without the agent's own id" ;;
-    esac
-  fi
-fi
-# ------------- THE FRESH SESSION, AND WHICH OF ITS THREE SOURCES IS AUTHORITY
-#
-# A CONTEXT CLEAR IS ONE SENTENCE — *a NEW session of this lane's agent,
-# started with the top block of the handoff the row names as its first prompt* —
-# and it is why `/ctx` does not simply resume the transcript it has just paused.
-# What changed on 2026-09-15 is not the sentence but WHO SAYS IT.
-#
-# `LANE_START_FRESH=1` WAS THE SEAM AND IS NO LONGER THE AUTHORITY
-# (openRepoTools#94, measured on Eagle 2026-09-15T20:59Z). `/ctx` respawned the
-# lane's own pane with the variable set, and this command was reached WITHOUT
-# it: `claude-profile` re-creates the child through tmux, and its own code says
-# the rule — *"`tmux new-session` hands the command the SERVER's environment,
-# not this client's, so a variable the operator exported in their own shell
-# reaches the child only if it is written into the command string"*. It threads
-# six values explicitly and this was never one of them. The gates below were
-# correct and were simply never reached with `fresh` set; the lane resumed the
-# uuid it had just paused, and the record said an act had happened that had not.
-#
-# SO THE AUTHORITY IS A FILE, and the three sources are read in this order:
-#
-#   1. THE LANE'S OWN RESTART INTENT — `lanes-edit.sh restart-intent <lane>`,
-#      written under the lane's control root BEFORE the old process was killed
-#      and read back here whatever the environment did. It is the only channel
-#      that crosses a boundary another repository owns, because it is on disk
-#      rather than in an environment. Only `pending` and `starting` authorise a
-#      launch: a `ready` intent is HISTORY (which is what makes an ordinary
-#      `lane <name>` after a successful `/ctx` an ordinary resume), and a
-#      failed launch is the supervisor's to retry, moving it back to `starting`.
-#      Failed preparation authorizes only guarded ordinary resume with unchanged
-#      intent history; it has no supervised launch authority.
-#   2. `--fresh`, for the caller that reaches this command directly and has no
-#      launcher between it and here.
-#   3. `LANE_START_FRESH=1`, kept exactly as it was so that nothing written
-#      about it stops working, and no longer trusted to arrive.
-#
-# AND AN INTENT THAT DISAGREES WITH THIS RUN IS A REFUSAL, NEVER A SUBSTITUTION
-# (spec: *the operation launch refuses without substituting the conflicting
-# value*). An intent naming another directory is an intent for a lane in
-# another checkout, and launching this one in it is Evidence 3's silent loss of
-# the repository's CLAUDE.md and the lane's memory; an `--operation` that is not
-# the lane's current one is a supervisor acting for an operation that has been
-# superseded.
-fresh=0
-fresh_why=""
-hs_workspace_root() { lanes_workspace_root; }
-
-# The file the row's handoff cell names. Three spellings, first hit wins, and
-# every one of them is a READ:
-#   (a) a path the cell already spells — absolute, or `~`-rooted, which is
-#       Amendment 4(e)'s estate spelling reaching the same file through the
-#       `~/projects/<estate>/handoffs` symlink;
-#   (b) `<the register's own checkout>/<cell>` — the repository-relative
-#       spelling every row this script writes carries, and the one the register
-#       and the handoffs share;
-#   (c) `<the workspace repository>/<cell>`, for a register reached from
-#       somewhere else.
-# A cell that spells a path of its own is answered by (a) alone: joining an
-# absolute path on to a root gives a path nothing has.
-hs_resolve() {
-  local cell="$1" cand root
-  [ -n "$cell" ] || return 1
-  case "$cell" in
-    '~/'*) cand="$HOME/${cell#'~/'}" ;;
-    /*)    cand="$cell" ;;
-    *)     cand="" ;;
-  esac
-  if [ -n "$cand" ]; then
-    [ -f "$cand" ] || return 1
-    printf '%s\n' "$cand"; return 0
-  fi
-  if [ -n "${LANES_REPO:-}" ] && [ -f "$LANES_REPO/$cell" ]; then
-    printf '%s\n' "$LANES_REPO/$cell"; return 0
-  fi
-  root="$(hs_workspace_root 2>/dev/null || :)"
-  if [ -n "$root" ] && [ -f "$root/$cell" ]; then
-    printf '%s\n' "$root/$cell"; return 0
-  fi
-  return 1
-}
-
-first_prompt=0
-ri_state=""; ri_op=""; ri_gen=""; ri_mode=""; ri_dir=""; ri_hf=""; ri_dig=""; ri_rc=0; ri_expected_digest=""; ri_prompt=""; ri_active=0; ri_attempt=""; ri_prepared=""; ri_agent=""; ri_profile=""
-ri_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$LANE" --dir "$DIR" 2>/dev/null)" || ri_rc=$?
-case "$ri_rc" in
-  0)
-    ri_state="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "state" { print $2; exit }')"
-    ri_op="$(printf '%s\n'    "$ri_out" | awk -F'\t' '$1 == "operation" { print $2; exit }')"
-    ri_gen="$(printf '%s\n'   "$ri_out" | awk -F'\t' '$1 == "generation" { print $2; exit }')"
-    ri_mode="$(printf '%s\n'  "$ri_out" | awk -F'\t' '$1 == "mode" { print $2; exit }')"
-    ri_dir="$(printf '%s\n'   "$ri_out" | awk -F'\t' '$1 == "dir" { print $2; exit }')"
-    ri_hf="$(printf '%s\n'    "$ri_out" | awk -F'\t' '$1 == "handoff" { print $2; exit }')"
-    ri_dig="$(printf '%s\n'   "$ri_out" | awk -F'\t' '$1 == "digest" { print $2; exit }')"
-    ri_pane="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "pane" {print $2; exit}')"
-    ri_attempt="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "attempt" {print $2; exit}')"
-    ri_prepared="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "prepared_digest" {print $2; exit}')"
-    ri_agent="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "agent" {print $2; exit}')"
-    ri_profile="$(printf '%s\n' "$ri_out" | awk -F'\t' '$1 == "profile" {print $2; exit}')" ;;
-  # 8 IS AN ANSWER — this lane has no restart in flight, which is every
-  # ordinary launch — and 2 IS A HELPER THAT PREDATES THIS READ: an installed
-  # `lanes-edit.sh` from before openRepoTools#94 answers 2 from its
-  # unknown-subcommand arm, and on that workstation no `/ctx` could have
-  # written an intent at all. The estate's fence is one sentence and
-  # `lane-handoff` spells it out at its own register reads — *"`0` an answer,
-  # `8` NO ANSWER and `2` a helper predating the read — both of those fall to
-  # the next rung"*. Both fall to the next rung here too, and neither is worth
-  # a note printed on every launch of every lane.
-  8|2) : ;;
-  # AND 1 IS NOT ONE OF THEM (Copilot round 2 on openRepoTools#121). `1` is
-  # *the control root could not be derived*, which is a READ THAT COULD NOT BE
-  # MADE and never *there is no restart in flight* — and the two are opposite
-  # facts at this one gate. The sidecar `/ctx` wrote sits under a root resolved
-  # from the lane's recorded directory or `$PROJECTS_ROOT`, and the pane this
-  # launch runs in is a NEW one whose environment is not the one that wrote it;
-  # a root that resolved then and does not now leaves this command reading
-  # nothing and calling it nothing-in-flight. What it would then do is resolve
-  # an ordinary resume source — and for a lane whose `/ctx` has just killed its
-  # pane, that is the transcript the `/ctx` PAUSED. That is openRepoTools#94,
-  # recreated by the very command written to prevent it.
-  #
-  # SO IT REFUSES, and so does any code this fence does not classify. The old
-  # line said *refusing every launch on a helper that could not answer is not a
-  # safety property* — which is true of a lane with no restart in flight and
-  # false of the one gate whose wrong answer resumes a paused transcript. The
-  # refusal names what to run to see the failure and both ways out of it,
-  # because a refusal a person cannot act on is not better than the defect.
-  1)
-    die "lane $LANE's restart intent could not be read: it has no lifecycle control root here (\`$LANES_EDIT restart-intent $LANE\` exits 1 — its record names no directory and \$PROJECTS_ROOT is not a directory in this environment). That is NOT 'no restart is in flight': the sidecar a /ctx writes lives under that root, and launching without reading it would resolve an ordinary resume source — which for a lane whose pane a /ctx has just replaced is the transcript that /ctx PAUSED (openRepoTools#94). Nothing was renamed, written or started. Give this run a root it can resolve: set \$LANES_LANE_STATE_ROOT, or make \$PROJECTS_ROOT (default \$HOME/projects) a directory — the lane's own record names its checkout once it has been started with one, and resolves on that." 2 ;;
-  *)
-    die "lane $LANE's restart intent read FAILED (\`$LANES_EDIT restart-intent $LANE\` exited $ri_rc), and a read that failed is never an answer (Amendment 7(d)). Nothing was renamed, written or started: this is the one launch gate whose wrong answer resumes the transcript a /ctx just paused (openRepoTools#94), so it refuses rather than falling through to an ordinary resume source. Run that command yourself to see what it says, then launch again." 1 ;;
-esac
-if [ -n "$preparation_failure_identity" ]; then
-  pfr_current="$(preparation_failure_snapshot "$ri_out")"
-  [ "$pfr_current" = "$preparation_failure_identity" ] ||
-    die "the failed preparation changed during ordinary recovery. Nothing was launched." 2
-fi
-if [ -n "${LANE_RESTART_OPERATION:-}" ]; then
-  [ -z "$op_flag" ] || [ "$op_flag" = "$LANE_RESTART_OPERATION" ] ||
-    die "the explicit restart operation disagrees with the supervisor token. Nothing was started." 2
-  op_flag="${op_flag:-$LANE_RESTART_OPERATION}"
-fi
-# AN `--operation` NAMES THE INTENT IT BELONGS TO, AND ONLY THAT ONE.
-if [ -n "$op_flag" ]; then
-  [ -n "$ri_state" ] ||
-    die "--operation $op_flag was given and lane $LANE has no restart intent to match it against (the read above says what answered). A supervised launch is made for ONE operation and this one cannot be found: nothing was renamed, nothing was written and no session was started. Read it with:  lanes-edit.sh restart-intent $LANE" 2
-  [ "$op_flag" = "$ri_op" ] ||
-    die "--operation $op_flag is not lane $LANE's current restart operation, which is ${ri_op:-none} (state ${ri_state:-none}, generation ${ri_gen:-0}). A stale supervisor must never launch against a newer operation — nothing was renamed, written or started. Read it with:  lanes-edit.sh restart-intent $LANE" 2
-fi
-case "$ri_state" in
-  # AN INTENT THIS READER CANNOT UNDERSTAND REFUSES THE LAUNCH, AND DOES NOT
-  # QUIETLY RESUME (Copilot round 1 on openRepoTools#121). `lanes-edit.sh`
-  # answers `UNKNOWN-SCHEMA` where a newer tooling wrote the record, and that
-  # answer used to fall through this `case` to the ordinary resume-source
-  # resolution below — which is the SAFE half of the decision (it authorises no
-  # fresh session) sitting on top of the UNSAFE one: the lane whose intent that
-  # is has just had its pane killed by a `/ctx`, and the resume source waiting
-  # there is the transcript that `/ctx` PAUSED. Falling through would resume it.
-  # That is openRepoTools#94 exactly, reached down a second road.
-  #
-  # So it is a refusal, in the one shape Amendment 7(d) gives: a read that could
-  # not be made is never an answer. It costs a person the lane until the
-  # workstation's `lanes-edit.sh` is new enough to read the file — and the
-  # message says both ways out, which is what makes that recoverable rather than
-  # a wall.
-  INCOMPLETE)
-    die "lane $LANE has a restart intent that is missing facts a launch is fenced on (\`lanes-edit.sh restart-intent $LANE\` answers INCOMPLETE and names them). Its writer records every field on every transition, so a record missing one was not written by this tooling — and launching from it would skip the very checks those fields exist for: the pane comparison and the handoff digest both treat an absent value as *cannot compare*. Nothing was renamed, written or started. Read it, and remove it once you know no restart is in flight:  lanes-edit.sh restart-intent $LANE" 2 ;;
-  UNKNOWN-STATE)
-    die "lane $LANE has a malformed restart state. Nothing was started. Read it: lanes-edit.sh restart-intent $LANE" 2 ;;
-  UNKNOWN-SCHEMA)
-    die "lane $LANE has a restart intent this \`lanes-edit.sh\` cannot read: its schema is one this version does not know (\`lanes-edit.sh restart-intent $LANE\` answers UNKNOWN-SCHEMA). That is NOT 'no restart is in flight' — a read that could not be made is never an answer (Amendment 7(d)) — and starting anyway would resolve an ordinary resume source, which for a lane whose /ctx just killed its pane is the transcript that /ctx PAUSED. Nothing was renamed, written or started. Update this workstation's openRepoTools so it can read that record, or remove the intent once you know no restart is in flight:  lanes-edit.sh restart-intent $LANE" 2 ;;
-  failed)
-    [ -n "$preparation_failure_identity" ] ||
-      die "a failed restart appeared during ordinary launch. Recheck it before recovery. Nothing was launched." 2
-    preparation_failure_resume_check "$ri_out" ;;
-
-  preparing)
-    die "this restart is still preparing its preservation records. No launch is authorized. Read it: lanes-edit.sh restart-intent $LANE" 2 ;;
-  pending|starting)
-    ri_active=1
-    [ "$AGENT" = claude ] && [ "$ri_agent" = claude ] || die "legacy supervised restart requires the recorded Claude agent. Nothing was started." 2
-    if [ -n "${CLAUDE_PROFILE_NAME:-}" ] && [ "$ri_profile" != none ]; then
-      [ "$CLAUDE_PROFILE_NAME" = "$ri_profile" ] || die "the launcher profile disagrees with the restart intent. Nothing was started." 2
-    fi
-    if [ -n "${LANE_RESTART_ATTEMPT:-}" ]; then
-      [ "$LANE_RESTART_ATTEMPT" = "$ri_attempt" ] || die "this child belongs to a superseded restart attempt. Nothing was started." 2
-    fi
-    [ -n "$op_flag" ] || die "an active restart requires its supervisor operation token. Ordinary lane launch cannot consume it. Retry with lane-handoff --supervise --lane $LANE --operation $ri_op." 2
-    LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$LANE" ||
-      die "managed or unknown ownership blocks this legacy restart. Nothing was started." 2
-    if [ -n "$ri_pane" ] && [ "$ri_pane" != none ] && [ -n "${TMUX_PANE:-}" ]; then
-      case "$ri_pane" in *.%*) ri_pane_id="${ri_pane##*.}" ;; %*) ri_pane_id="$ri_pane" ;; *) ri_pane_id="" ;; esac
-      [ -z "$ri_pane_id" ] || [ "$ri_pane_id" = "$TMUX_PANE" ] || die "the restart intent names another pane. Nothing was started." 2
-    fi
-    [ "$ri_mode" = fresh-from-handoff ] || die "this restart has not completed preservation; its mode is $ri_mode. Nothing was started." 2
-    [ -n "$ri_dig" ] && [ "$ri_dig" != none ] || die "the supervised restart has no complete handoff checksum. Nothing was started." 2
-    if [ "$ri_mode" = fresh-from-handoff ]; then
-      # THE DIRECTORY IS COMPARED BEFORE ANYTHING IS TAKEN. `real_of` is this
-      # file's own resolver, so a symlinked projects root does not read as a
-      # disagreement it is not.
-      if [ -n "$ri_dir" ] && [ "$ri_dir" != none ] && [ "$(real_of "$ri_dir")" != "$(real_of "$DIR")" ]; then
-        die "lane $LANE's restart intent (operation ${ri_op:-none}, state $ri_state) names checkout $ri_dir and this launch stands in $DIR. That is a conflict and not a preference: a launch that lands in the right transcript and the wrong directory loses the repository's CLAUDE.md and the lane's memory, silently (Evidence 3). Nothing was renamed, written or started. Launch it where the intent says, or read the intent:  lanes-edit.sh restart-intent $LANE" 2
-      fi
-      # THE HANDOFF'S DIGEST IS VERIFIED ON EVERY LAUNCH (spec: *a changed or
-      # missing handoff blocks launch and retry*), because the top block of
-      # that file is literally this launch's first prompt and a file that has
-      # moved under the intent is a different instruction. A `none` digest is
-      # *not checked here* — a workstation with neither `sha256sum` nor
-      # `shasum` — and says so rather than passing silently.
-      if [ -n "$ri_hf" ] && [ "$ri_hf" != none ] && [ -n "$ri_dig" ] && [ "$ri_dig" != none ]; then
-        ri_now="$(handoff_digest_of "$ri_hf")"
-        if [ "$ri_now" != "$ri_dig" ] && [ "$ri_now" != "${ri_prepared:-none}" ]; then
-          die "lane $LANE's handoff has changed since its restart intent was written: the intent records digest $ri_dig for $ri_hf and that file now digests $ri_now. The top block of that file is this launch's FIRST PROMPT, so launching now would hand the new session the block of a handoff the /ctx did not write. Nothing was renamed, written or started (operation ${ri_op:-none}). Take the handoff again:  lane-handoff --restart" 2
-        fi
-      fi
-      # The digest and the actual prompt must refer to the same row-bound file.
-      ri_cell="$(cell 7 | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
-      ri_row_hf="$(hs_resolve "$ri_cell")" || die "the restart handoff the row names is missing. Nothing was started." 2
-      [ -n "$ri_hf" ] && [ "$ri_hf" != none ] && [ -s "$ri_hf" ] &&
-        [ "$ri_hf" -ef "$ri_row_hf" ] ||
-        die "the restart intent and register name different handoffs. Nothing was started." 2
-      ri_expected_digest="$(handoff_digest_of "$ri_hf")"
-      fresh=1
-      fresh_why=" (restart intent ${ri_op:-none}, state $ri_state: the /ctx respawn)"
-    else
-      note "lane $LANE has a restart intent in state $ri_state whose mode is '${ri_mode:-none}' and not 'fresh-from-handoff', so it authorises no fresh session here; this launch resolves its own resume source."
-    fi ;;
-esac
-if (( ! fresh )) && [ "$fresh_flag" = 1 ]; then
-  fresh=1
-  fresh_why=" (--fresh)"
-fi
-if (( ! fresh )) && [ "${LANE_START_FRESH:-0}" = 1 ]; then
-  fresh=1
-  fresh_why=" (LANE_START_FRESH=1: the /ctx respawn)"
-fi
-
-# AMENDMENT 11, EVIDENCE 4 — `--name "$LANE"` IS ON EVERY LAUNCH BRANCH, NOT
-# ONLY THE NEW-SESSION ONE. The session NAME is the lane's messaging address
-# (Amendment 2): `ListAgents`, `SendMessage`, `@<lane>` and the statusline all
-# read the harness record's name, and a resume that passes no `--name` gets a
-# DERIVED one. Measured on this lane 2026-09-13: the transcript carried
-# `customTitle: openRepoProject-1`, set once by `/rename`, while every process
-# that resumed it that day carried `openrepoproject-b9`, `-1e`, `-27`, `-45` —
-# four derived names for one lane, because only the new-session branch below
-# passed the flag. A resume is a launch; a launch names its window's session
-# after the lane, or the lane loses its address for the life of that session,
-# and there is no API to rename a running one from inside.
-new_sid=""
-# ACT 6 — WHERE THE TRANSCRIPT IS, SAID RATHER THAN ASSUMED, and followed where
-# it is in another profile's directory. This runs BEFORE the branch below, so
-# `recorded_transcript` answers for a transcript this run has just moved here.
-rec_file=""
-resume_sid="$row_sid"
-restored_sid=""
-# NOT IN THE BINDING MODE (openRepoTools#70): the id there is a session that is
-# RUNNING in this window, its launch decision does not read where its transcript
-# is, and a transcript a live process holds is one this act refuses to move.
-if [ -n "$row_sid" ] && [ "$AGENT" = claude ] && (( ! fresh )) && [ -z "$bind_sid" ]; then
-  rec_file="$(recorded_transcript "$row_sid" 2>/dev/null || :)"
-  if [ -n "$rec_file" ]; then
-    # WHICH DIRECTORY IT WAS FOUND IN, and whether that directory is SHARED —
-    # `readlink -f` equal across profiles is what makes a profile switch need no
-    # move at all, and a person swapping accounts is owed that sentence rather
-    # than a silent success they cannot reason about.
-    shared_with=""
-    here_real="$(real_of "$PROJECTS_STATE")"
-    while IFS= read -r ppd; do
-      [ -n "$ppd" ] && [ "$ppd" != "$PROJECTS_STATE" ] || continue
-      [ "$(real_of "$ppd")" = "$here_real" ] || continue
-      shared_with="${shared_with:+$shared_with }$(profile_of_projects_dir "$ppd")"
-    done <<EOF
-$(profile_projects_dirs)
-EOF
-    step "transcript $row_sid found in this profile's projects directory ($PROJECTS_STATE)${shared_with:+, which IS the directory profile(s) $shared_with read too (one shared directory: a profile switch resumes this lane by id and moves nothing)}"
-  else
-    # `|| ft_rc=$?` AND NOT `; ft_rc=$?`: this script runs under `set -e`, so a
-    # function returning 8 as a bare command ENDS IT — with 8, which is this
-    # estate's code for "no record" and which a caller would read as a lane-start
-    # that found nothing rather than one that was never asked.
-    ft_rc=0
-    follow_transcript "$row_sid" || ft_rc=$?
-    case "$ft_rc" in
-      0) rec_file="$FOLLOW_FILE" ;;
-      2) die "$FOLLOW_WHY" 2 ;;
-      *) case "$FOLLOW_WHY" in
-           shared:*) note "no transcript for $row_sid under this directory in any profile's projects directory (profiles ${FOLLOW_WHY#shared:} share this one)" ;;
-           # `--dry-run` FOUND IT AND MOVED NOTHING. The run carries on as a
-           # lane whose transcript is not here — which is what it would be
-           # WITHOUT the move — because a dry run must not report a launch that
-           # depends on a write it did not make.
-           dry-run:*) note "--dry-run: ${FOLLOW_WHY#dry-run:}. Nothing was moved; the branch below is the one a lane with no transcript here takes" ;;
-         esac ;;
-    esac
-  fi
-fi
-
-# AMENDMENT 17(c) MAKES THE PAUSED RECORD A RESUME SOURCE, NOT MERELY A LABEL.
-# The row normally wins because its last transcript is the current one. A
-# harness restart can, however, append the process/session id it minted while
-# continuing an older Claude transcript. That id is then a perfectly readable
-# row entry but has no `<id>.jsonl`; falling through to `--resume <LANE>` opens
-# Claude's title picker and can immediately exit a launcher-created pane. The
-# last PAUSED record already carries the exact agent transcript for this case.
-# Where it names this same agent and that transcript exists, resume the exact id
-# and put it back at the end of the cell below. A live session being bound in
-# this window still wins: step 3b has first-hand evidence and must never be
-# replaced by an older handoff.
-#
-# AND "BEING BOUND" IS TWO VARIABLES, NOT ONE (Copilot round 2 on
-# openRepoTools#87). `$harness_sid` is set only where step 3b TAKES a session
-# the row does not name; where the window's live session IS the row's, step 3
-# has already said so with `holder_here` and `$harness_sid` stays empty — so
-# that test alone let this fallback fire on the one state it was written to
-# stand off: the lane live in THIS window, its transcript not under this
-# directory (the harness has been seen to keep one under another `cwd` key),
-# and an older PAUSED record beside it. It would have `--resume`d the older
-# conversation over the person's own, in the window they are sitting in. Both
-# halves of the evidence are asked for now — and `--bind` is that evidence
-# named outright (openRepoTools#70).
-if [ -z "$rec_file" ] && [ -z "$harness_sid" ] && [ -z "$bind_sid" ] && (( ! holder_here )) \
-   && [ "$AGENT" = claude ] \
-   && [ "$RECORDED_AGENT" = claude ] && (( ! fresh )); then
-  paused_sid=""; paused_rc=0
-  paused_sid="$("$LANES_EDIT" lane-transcript "$LANE" 2>/dev/null)" || paused_rc=$?
-  case "$paused_rc" in
-    0)
-      if [[ "$paused_sid" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]] \
-         && [ "$paused_sid" != "$row_sid" ]; then
-        paused_file="$(recorded_transcript "$paused_sid" 2>/dev/null || :)"
-        if [ -z "$paused_file" ]; then
-          paused_follow_rc=0
-          follow_transcript "$paused_sid" || paused_follow_rc=$?
-          case "$paused_follow_rc" in
-            0) paused_file="$FOLLOW_FILE" ;;
-            2) die "$FOLLOW_WHY" 2 ;;
-            *) case "$FOLLOW_WHY" in
-                 dry-run:*) note "--dry-run: ${FOLLOW_WHY#dry-run:}. Nothing was moved; the title/new-session branch below remains the dry-run result" ;;
-               esac ;;
-          esac
-        fi
-        if [ -n "$paused_file" ]; then
-          resume_sid="$paused_sid"
-          rec_file="$paused_file"
-          restored_sid="$paused_sid"
-          step "the row's last session id $row_sid has no transcript here, but this same agent's last PAUSED record names transcript $paused_sid and it is here ($(basename -- "$rec_file")) — resuming that exact id"
-        fi
-      fi ;;
-    8|2) : ;;
-    *) note "$LANES_EDIT lane-transcript $LANE failed (exit $paused_rc) — carrying on without the last PAUSED record's exact resume id" ;;
-  esac
-fi
-
-# ---- THE LAUNCHER TABLE (Amendment 17(c)) -------------------------------
-#
-# ONE BRANCH PER AGENT, and a name this table does not carry is a REFUSAL that
-# names the ones it does — never a guess at an argv nobody has tested. The
-# table is deliberately short: `claude`, whose three cases are Amendment 6's
-# and are unchanged below, and `codex`, which takes its first prompt
-# positionally as `claude` does. A third agent is a row here and a test beside
-# it, and nothing else.
-if [ "$AGENT" != claude ]; then
-  case "$AGENT" in
-    codex)
-      # THE LAUNCHER IS ON PATH, OR NOTHING IS WRITTEN (Copilot round 3 on
-      # openRepoTools#47). The row, the object log and the Rule 3 stamp are all
-      # written BEFORE the `exec` at the foot of this command, so a `codex` this
-      # workstation does not have records the lane as RESUMED and then exits
-      # 127 — a false transition in two append-only files that a person has to
-      # repair by hand. The check is here, in 5a, which is before every write.
-      command -v "$AGENT" >/dev/null 2>&1 ||
-        die "this command's launcher table knows '$AGENT', and this workstation has no '$AGENT' on PATH. Nothing was written: the row, the object log and the handoff's Rule 3 stamp are all written before the launch, and a lane recorded as RESUMED by a launch that exits 127 is a false transition in two append-only files. Install it, or name an agent this workstation has: $prog --agent <name> …" 2
-      # `codex` KEEPS NO ID THIS COMMAND CAN PASS: it prints its own resumable
-      # id where it has one, so the lane's record carries whatever the last
-      # handoff wrote (`transcript <id>`) and the session's own first act
-      # corrects it. The top block is delivered positionally, which is the one
-      # thing both agents in this table have in common.
-      step "agent $AGENT — launching it with this lane's handoff top block as its first prompt (Amendment 17(c))"
-      cmd=("$AGENT")
-      lane_verb=RESUMED; lane_sid=unknown; first_prompt=1 ;;
-    *)
-      die "this command has no launcher for the agent '$AGENT'. It knows: claude (resume by id where its transcript is here, else a named new session with the handoff's top block as its first prompt) and codex (the top block as its first prompt). A lane is resumed by an agent whose launch this command has been taught and tested — never by a guessed argv (Amendment 17(c))." 2 ;;
-  esac
-elif [ -n "$bind_sid" ]; then
-  # THE BINDING MODE STAMPS THE ID BEING BOUND (openRepoTools#70), and it is
-  # decided FIRST, ahead of every branch that reads where a transcript is: the
-  # session is running in this window, so which directory holds its file is not
-  # a question this run has to answer, and the title and new-session branches
-  # would stamp `unknown` or a minted id for a conversation that is plainly
-  # here. Step 3b has already put this uuid at the end of the cell (or found it
-  # there), and the 18(h) count for it was made at the window-binding call. The
-  # command is the exact resume of that id — printed, never run, since --bind
-  # comes only with --no-launch — which is what the next `lane-start` resumes.
-  step "--bind: lane $LANE is bound to $win_sid, the session live in this window — the row's stamp, the lane's log line and the handoff's Rule 3 stamp name it"
-  cmd=("$CLAUDE_BIN" --name "$LANE" --resume "$win_sid")
-  lane_verb=RESUMED; lane_sid="$win_sid"
-elif [ -n "$resume_sid" ] && [ -n "$rec_file" ]; then
-  # AMENDMENT 18(h), AND THIS IS THE ONLY LAUNCH BRANCH WITH AN ID TO COUNT
-  # (`main`, #52). The clause is *"the id it is about to resume or bind"*: this
-  # branch is the one that resumes an id, and the count is asked INSIDE it
-  # rather than above, because above it the row's id is merely a candidate —
-  # act 6's search on the lines above is what decides whether anything resumes
-  # it at all, and counting the holders of a transcript nobody is about to open
-  # would refuse a lane for a fact about a conversation it is not going to
-  # touch. The title-fallback branch resumes through the PICKER, whose
-  # transcript is not knowable here, and the new-session branch MINTS a fresh
-  # uuid; neither has an id, which is stated rather than left to be noticed.
-  # AND THE HARNESS'S OWN FENCE IS ASKED ON BOTH SIDES OF THAT TEST, because it
-  # is the one rule that still bites when the id IS this window's session: the
-  # `bg` companion of a live session carries its id, and `claude --resume` stops
-  # on a companion. `resume-here` asks that and nothing else — the duplicate
-  # count for this id was already made at the window-binding call above.
-  #
-  # ONLY WHERE AN `exec` IS ABOUT TO HAPPEN. `--no-launch` and `--dry-run` open
-  # no transcript and hand the harness nothing, so the harness's refusal is not
-  # theirs to inherit — and AMENDMENT 8 RULING (g) IS EXPLICIT about the shape
-  # that would otherwise break: a `bg` companion is one session seen twice and
-  # NEVER refuses the lane to the window its own session is running in, which is
-  # exactly what a `--no-launch` binding act in that window is. 18(h)'s count is
-  # asked in both, unchanged, because an id a second process holds is one this
-  # run must not WRITE DOWN either.
-  ls_rules=bind
-  if (( ! no_launch )) && (( ! dry_run )); then ls_rules=resume; fi
-  if [ "$resume_sid" != "$win_sid" ]; then
-    dup_check "$resume_sid" "resume transcript $resume_sid as lane $LANE" "$ls_rules"
-  elif [ "$ls_rules" = resume ]; then
-    dup_check "$resume_sid" "resume transcript $resume_sid as lane $LANE" resume-here
-  fi
-  if [ -n "$restored_sid" ]; then
-    step "the recovered resume session is $resume_sid and its transcript is here ($(basename -- "$rec_file")) — resuming it by id"
-  else
-    step "the row's current session is $resume_sid and its transcript is here ($(basename -- "$rec_file")) — resuming it by id"
-  fi
-  (( holder_here )) && step "  (it is the session live in this window; --resume attaches to the same conversation)"
-  cmd=("$CLAUDE_BIN" --name "$LANE" --resume "$resume_sid")
-  lane_verb=RESUMED; lane_sid="$resume_sid"
-elif (( fresh )) || (( AGENT_EXPLICIT )); then
-  # `--agent claude` WITH NO TRANSCRIPT HERE, and the `/ctx` respawn: a NAMED
-  # NEW SESSION, with the handoff's top block as its first prompt. It skips the
-  # title fallback deliberately — a caller that named an agent, or a context
-  # clear that has just written a fresh top block, is asking for a new session
-  # of this lane and not for a picker filtered by a title.
-  step "agent claude — a new session named for the lane, with this lane's handoff top block as its first prompt$fresh_why"
-  cmd=("$CLAUDE_BIN" --name "$LANE")
-  lane_verb=RESUMED; lane_sid=unknown; first_prompt=1
-  if [ -n "$harness_sid" ]; then
-    note "the live session in this window ($harness_sid) is not resumed by this launch: a first prompt is delivered to a session that has none. The cell still records the session that is in the window."
-  elif [ "${LANE_START_SESSION_ID:-1}" != 0 ]; then
-    if new_sid="$(new_uuid)"; then
-      while recorded_transcript "$new_sid" >/dev/null 2>&1; do new_sid="$(new_uuid)"; done
-      cmd+=(--session-id "$new_sid")
-      lane_sid="$new_sid"
-      step "minted session id $new_sid — the row will carry it, so the next $prog resumes it by id"
-    else
-      new_sid=""
-      note "no uuid source (/proc/sys/kernel/random/uuid, uuidgen): the new session's own first act must stamp its id on the row"
-    fi
-  fi
-elif titled="$(titled_transcript)"; then
-  transcript="${titled%%$'\t'*}"; found_title="${titled#*$'\t'}"
-  [ -n "$row_sid" ] && note "the row's last session id $row_sid has no transcript for this directory — falling back to the title"
-  step "a transcript here carries the title '$found_title' ($(basename -- "$transcript")) — resume beats new"
-  # THREE ANSWERS, NOT TWO (Amendment 15). A title that is not the lane's own
-  # spelling is now one of two different facts, and they have different cures: a
-  # dedupe suffix means ANOTHER holder was live when this one was renamed, and a
-  # title differing only by CASE means this is the lane's own transcript under
-  # the spelling it was launched with before the row's became canonical. Telling
-  # a person to retire stale holders for the second would send them hunting a
-  # collision that never happened.
-  if [ "$found_title" != "$LANE" ]; then
-    if [ "$(printf '%s' "$found_title" | tr 'A-Z' 'a-z')" = "$(printf '%s' "$LANE" | tr 'A-Z' 'a-z')" ]; then
-      note "  that title spells this lane in another case, which is the SAME lane (Amendment 15): the window and the launch take the register row's spelling, $LANE"
-    else
-      note "  that title carries a dedupe suffix, so another holder of '$LANE' was live when it was renamed: retire the stale holders (lane-end --retire, or retitle them '<lane> · retired <date>') and end idle background sessions still holding the name"
-    fi
-  fi
-  note "  '--resume $LANE' FILTERS THE PICKER, it does not resume exactly: pick the lane's own session, then put its id in the row's session cell"
-  (( holder_here )) && step "  (that session is the one live in this window; --resume attaches to the same conversation)"
-  cmd=("$CLAUDE_BIN" --name "$LANE" --resume "$LANE")
-  # The picker decides which transcript this is, so the id is NOT KNOWABLE
-  # here — and the line says so rather than naming the row's last id, which is
-  # an id whose transcript this directory does not even have (that is why this
-  # branch was reached). Writing it would put a session uuid on a RESUMED that
-  # belongs to a different conversation, in a file nothing rewrites. `unknown`
-  # is the grammar's own word for an id nobody has; the session stamps the row
-  # with its real one as its first act (Amendment 6(c)).
-  lane_verb=RESUMED; lane_sid=unknown
-else
-  step "nothing here to resume for $LANE — a new session takes the name"
-  cmd=("$CLAUDE_BIN" --name "$LANE")
-  # A NEW SESSION IS NEVER ATTRIBUTED TO THE OLD ONE. With minting turned off
-  # (LANE_START_SESSION_ID=0), or with no uuid source at all, there is no id to
-  # write — and an empty LANES_SESSION makes the helper fall back to the LAST id
-  # in the row's cell, which is the session that has ENDED. The row itself is
-  # left reading `pending — set by the session's first act` in that case, so the
-  # log said one thing and the row another about the same act.
-  lane_sid=unknown
-  if [ -n "$harness_sid" ]; then
-    # Nothing is minted: the row is about to name the session that is really in
-    # this window, and minting a second id beside it would give the lane two
-    # answers to "which session is this". The launch still takes a new session —
-    # this branch was reached because the live one has no transcript in this
-    # directory and cannot be resumed by id — and it is not attributed to the
-    # other one, which is what `unknown` says.
-    note "the live session in this window ($harness_sid) has no transcript in this directory, so it cannot be resumed by id. A new session takes the name and nothing is minted; the cell still records the session that is in the window."
-  elif [ "${LANE_START_SESSION_ID:-1}" != 0 ]; then
-    if new_sid="$(new_uuid)"; then
-      while recorded_transcript "$new_sid" >/dev/null 2>&1; do new_sid="$(new_uuid)"; done
-      cmd+=(--session-id "$new_sid")
-      lane_sid="$new_sid"
-      step "minted session id $new_sid — the row will carry it, so the next $prog resumes it by id"
-    else
-      new_sid=""
-      note "no uuid source (/proc/sys/kernel/random/uuid, uuidgen): the new session's own first act must stamp its id on the row"
-    fi
-  fi
-fi
-cmd+=(${pass[@]+"${pass[@]}"})
-
-# THE CLAUDE CODE TO START (opensoft/workBenches#119), once the agent and the
-# launch are known. Resolution already ran before the binding handoff and
-# first stateful act; use that selected path when building the final command.
-if [ "$AGENT" = claude ]; then
-  cmd[0]="$CLAUDE_BIN"
-fi
-
-# A LANE WITH NO ROW IS A `STARTED`, WHATEVER BRANCH LAUNCHED IT (Copilot round
-# 1 on openRepoTools#47). Two branches above set the verb to RESUMED because
-# they are resuming a lane that PAUSED — `--agent <name>` and the `/ctx` seam —
-# and both are reachable for a lane the register has never carried, where
-# `add-row` is about to write the first row and the object log has no line at
-# all. A `RESUMED` opening that log is a line no reader can pair with a start,
-# in a file nothing rewrites.
-if [ "$row_count" = 0 ] && [ "$lane_verb" = RESUMED ]; then
-  lane_verb=STARTED
-  step "this lane has no row yet, so the record of this launch is a STARTED (there is nothing to have resumed)"
-fi
-
-# IS THERE A TRANSCRIPT UUID TO NAME AT ALL? (Amendment 8(d), R-A8-2.) Computed
-# HERE, with the launch decision that produced `lane_sid`, because three later
-# sections read it: the row's stamp (5), the object-log line (5b) and the
-# handoff's Rule 3 stamp (5c). It used to be computed between the first two,
-# which left the first reading a variable the last two shared.
-# Reserve this attempt's transcript before row, log or handoff mutation.
-if [ "$ri_active" = 1 ] && (( ! no_launch )) && (( ! dry_run )); then
-  [ -n "$lane_sid" ] && [ "$lane_sid" != unknown ] || die "the restart has no prepared transcript. Nothing was written." 2
-  LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$LANE" starting \
-    --expect 'pending|starting' --expect-operation "$ri_op" \
-    --expect-generation "$ri_gen" --expect-attempt "$ri_attempt" \
-    --expect-new-transcript none --new-transcript "$lane_sid" --reason 'transcript reserved before preservation writes' >/dev/null ||
-      die "this restart attempt lost ownership before preservation writes. Nothing was launched." 2
-fi
-
-lane_sid_known=0
-[[ "$lane_sid" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]] && lane_sid_known=1
-
-# WHO THE TWO STAMPS NAME (Amendment 17(c)). For `claude` it is the uuid and
-# nothing else — `RESUMED by <uuid>`, the line Amendment 6(c), Amendment 8(d),
-# this file's own header and the manual all quote. For another agent it is
-# `<agent> <id>`, and `pending` where that agent's id is not knowable until it
-# prints one: the STATE cell and the handoff are histories of acts, and an act
-# that happened with an id nobody has yet is still an act that happened.
-stamp_who="${lane_sid:-unknown}"
-stamp_ok="$lane_sid_known"
-if [ "$AGENT" != claude ]; then
-  stamp_who="$AGENT ${AGENT_ID:-pending}"
-  stamp_ok=1
-fi
-
-# ------------- 4a. what the last session left (opensoft/openRepoTools#91)
-#
-# THE RECONCILIATION IS PRINTED BEFORE ANYTHING IS WRITTEN, and it REFUSES
-# NOTHING. A lane recorded `RUNNING` with no live holder stopped ungracefully —
-# nothing was polled, refreshed or recorded — and one recorded `SWAPPING` with
-# no live holder was interrupted MID-HANDOFF, where some of the three writes
-# may have landed and some may not. Either way there may be worktrees carrying
-# dirty or unpushed work, and the one thing this command must not do is start a
-# session that writes over them in ignorance.
-#
-# IT IS HERE, ABOVE SECTION 5, because the `STARTED`/`RESUMED` line this run is
-# about to write takes the lane to `RUNNING` — so a report printed after it
-# would describe this launch rather than the crash it is recovering from.
-#
-# IT IS A REPORT AND NOT A GATE. `resume` RESETS NOTHING and `park` CREATES
-# NOTHING (AGENTS.md rule 1); this prints what differs and names the act, and
-# every refusal this command makes is the one it already made. A helper that
-# predates the read (exit 2) and a lane with no snapshot (exit 8) are both
-# silent — Amendment 7(i)'s cutover rule: nothing is backfilled.
-if (( ! dry_run )); then
-  lrec_out=""; lrec_rc=0
-  lrec_out="$(LANES_NO_FETCH=1 "$LANES_EDIT" lane-reconcile "$LANE" 2>/dev/null)" || lrec_rc=$?
-  case "$lrec_rc" in
-    0)
-      lrec_verdict="$(printf '%s\n' "$lrec_out" | awk -F'\037' '$1 == "VERDICT" { print $2 " — " $3; exit }')" || lrec_verdict=""
-      # A RESUMABLE LANE IS QUIET ONLY WHEN ITS TREES ARE (Codex on ec9847e,
-      # PR #97): `resumable` says the swap completed, not that every tree it
-      # left is clean, published and where it was. So a resumable lane whose
-      # TREES line counts anything dirty or unpushed, needing recovery, or
-      # unmanaged or stale is reported like any other verdict.
-      lrec_attn="$(printf '%s\n' "$lrec_out" | awk -F'\037' '$1 == "TREES" { split($3, a, " "); split($4, b, " "); split($5, c, " "); print a[1] + b[1] + c[1]; exit }')" || lrec_attn=""
-      lrec_quiet=0
-      case "$lrec_verdict" in
-        running*|closed*|'') lrec_quiet=1 ;;
-        resumable*)
-          if [ "${lrec_attn:-0}" = 0 ]; then lrec_quiet=1
-          else lrec_verdict="$lrec_verdict — and its trees below need reading before a writer is relaunched"
-          fi ;;
-      esac
-      if [ "$lrec_quiet" = 0 ]; then
-          note "LANE RECOVERY: $lrec_verdict"
-          printf '%s\n' "$lrec_out" | awk -F'\037' '
-            $1 == "STATE" { printf "  state    %s (%s, %s)\n", $2, $3, $4 }
-            $1 == "HOLDER" { printf "  holder   %s %s\n", $2, $3 }
-            $1 == "BINDING" && $2 != "here" && $2 != "free" { printf "  binding  %s %s\n", $2, $3 }
-            $1 == "TREE" && $3 != "ok" { printf "  tree     %-18s %s\n", $3, $5 }
-            $1 == "TREES" { printf "  trees    %s, %s, %s, %s\n", $2, $3, $4, $5 }' >&2 || :
-          note "Nothing here was reset, recreated or deleted. Read it in full with: $LANES_EDIT lane-reconcile $LANE"
-      fi ;;
-    2 | 8) : ;;
-    *) note "the lane recovery read failed (\`$LANES_EDIT lane-reconcile $LANE\` exited $lrec_rc). That is NOT 'this lane stopped cleanly' — a read that failed is never an answer (Amendment 7(d)). This launch goes on; run it by hand to see what it says." ;;
-  esac
-fi
-
-# ------------------------------------------------------------- 5. the row
-
-utc="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-started="$(date -u +%Y-%m-%dT%H:%MZ)"
-today="$(date -u +%Y-%m-%d)"
-# THE WORKSTATION COLUMN HAS ONE READER, AND NOW ONE SPELLING (A9 Addendum 4,
-# R-A9-13). `lanes-edit.sh:438` computes this very cell as
-# `${LANES_WORKSTATION:-$(hostname -s)}` and has since Amendment 6; this file
-# computed it as a bare `hostname`, which honours no seam and, on any host
-# whose `hostname` is a FQDN, writes `eagle.local` into a column every reader
-# compares against `eagle`. Two spellings of one column are two answers. The
-# seam is also what makes the moved suite runnable anywhere: its 55 seed rows
-# spell the column `Eagle`, so before this it was green on a workstation
-# literally named Eagle and on no other machine, GitHub's runners included.
-ws_pair="$(lanes_workstation_pair)"
-ws="${ws_pair%%	*}"
-ws_why="$(lanes_workstation_why "${ws_pair##*	}")"
-# A CONTAINER WITH NO CONFIGURED WORKSTATION WRITES NOTHING (Amendment 11,
-# decision 8(d), `R-A11-14`). `$ws` goes into the row's workstation column, into
-# the row's stamp and into the `session <uuid>@<ws>` of every event line this
-# run writes — and `opensoft/brett-wip` `origin/main` already carries six log
-# lines naming a container id, in a file nothing rewrites. The refusal is here,
-# BEFORE the row and before the log, rather than at each of the three writes.
-[ -z "$ws_why" ] || die "$ws_why" 2
-env_name="$(basename -- "$CLAUDE_HOME")"
-case "$env_name" in .claude|claude) env_name=default ;; esac
-# THE AGENT'S OWN SPELLING IN THE ROW'S SESSION CELL (Amendment 17(c)): *"the
-# row's session cell keeps its history as Amendment 6 has it; its entries
-# already carry the agent's kind (`harness <uuid>`, `Codex <id>`)"*. The
-# register has spelled Codex sessions that way since 2026-09-05, so the table
-# is the register's own and not a new convention.
-# --- BEGIN shared one-line cut (lane-collision-protocol Amendment 13(a)) ---
-# BYTE-IDENTICAL IN `lane-start`, `lane-end` AND `lane-handoff`, the three
-# commands that write a row's state cell — the same trade the four lane helpers
-# already make for their workspace resolver, and for the same reason: a drifted
-# copy is TWO ANSWERS to one question, and "what may this line contain, and
-# where may it be cut" is one question.
-#
-# FOUR THINGS THE CELL'S LINE MAY NOT CARRY, and `set-row-state` REFUSES all
-# four — which would cost the row its stamp or its closing write, so they are
-# fixed here rather than met there:
-#
-#   ` · `  the phrase's own separator. A second one reads back as a fourth part
-#          of `<STATE> · <UTC> · <one line>`; it is spelled `; `.
-#   `|`    a cell boundary in a Markdown table row. A launch command or a
-#          directory may legitimately hold one — `claude --flag 'a|b'`, a path
-#          with a pipe in it — and the row is where it would forge a column
-#          (Copilot round 1 on openRepoTools#82). It is spelled `¦`, the broken
-#          bar, which is not a separator anywhere here; the object log's own
-#          line keeps the character itself.
-#   CR/LF  a row is ONE LINE of a table, so a newline in this text would split
-#          it in two and every row after it would be read as a lane. Spelled
-#          `; ` for the same reason the separator is (Copilot round 2).
-#   >240   ratified decision O1's cap. Cut at 230 with the last partial WORD
-#          dropped, which is what makes the cut safe: `${s:0:n}` counts BYTES
-#          wherever the locale is not a UTF-8 one, and a byte offset can land
-#          inside the very characters above. 230 and not 240, so the ` ...`
-#          marker fits inside the cap however the two count.
-cut_to_line() {   # <line> — the row's one line, safe to hand to set-row-state
-  ctl="${1//$'\r'/ }"
-  ctl="${ctl//$'\n'/; }"
-  ctl="${ctl// · /; }"
-  ctl="${ctl//|/¦}"
-  [ "${#ctl}" -gt 230 ] || { printf '%s' "$ctl"; return 0; }
-  ctl="${ctl:0:230}"
-  case "$ctl" in *' '*) ctl="${ctl% *}" ;; esac
-  printf '%s ...' "$ctl"
-}
-# --- END shared one-line cut ---
-
-AGENT_WORD="$AGENT"
-case "$AGENT" in
-  claude) AGENT_WORD=harness ;;
-  codex)  AGENT_WORD=Codex ;;
-esac
-user="$(id -un)"
-handoff="handoffs/$estate/session-handoff-$today-lane-$LANE.md"
-
-# The session cell of a NEW row names the session that is about to run,
-# whenever one was minted — that is the whole point of minting it. And where a
-# session is ALREADY live in this window (step 3b) the cell names THAT one: a
-# lane bound to a running window mid-session is the ordinary shape of
-# `--no-launch`, and a row minting a fresh uuid beside a conversation that is
-# already there would name a session nobody will ever be in.
-harness_cell="harness $harness_sid (transcript uuid; profile ${win_profile:-unknown})"
-if [ -n "$harness_sid" ]; then
-  session_cell="$harness_cell — live in this window, recorded by $prog $utc"
-elif [ -n "$new_sid" ]; then
-  session_cell="harness \`$new_sid\` (minted by $prog, $utc)"
-else
-  session_cell="pending — set by the session's first act"
-fi
-
-if [ "$row_count" = 0 ]; then
-  # AMENDMENT 13(a) — A NEW ROW IS BORN IN THE PHRASE. The state cell opened
-  # with the bare word `STARTING` for as long as the cell was a diary; it is one
-  # phrase now — `<STATE> · <UTC> · <one line>` — and a row created outside that
-  # shape is a row the first `set-row-state` would be the only thing to fix.
-  # `LIVE` is the state, because this row is written by the act that takes the
-  # lane live in this window, and the line says which act and on which
-  # workstation.
-  new_line="$lane_verb by $stamp_who (lane $LANE) — lane-start on $ws: row created"
-  new_state="LIVE · $utc · $(cut_to_line "$new_line")"
-  new_row="| \`$LANE\` | $session_cell | $ws / $env_name / $user | $started | none | $handoff | $new_state |"
-  if (( dry_run )); then
-    plan "lanes-edit.sh add-row"
-    plan "  $new_row"
-  else
-    # THE SAME RULE AS THE STAMP ONE SCREEN DOWN, and the opposite ANSWER. A
-    # bare command under `set -e` dies with the helper's own code and no
-    # sentence of its own; this one is read. But a lane with no ROW is not a
-    # lane with an unwritten stamp — every other lane's liveness read, every
-    # crossing check and the next `lane-start` all key on that row — so this is
-    # a refusal that says so, before the window is anything but renamed.
-    ar_rc=0
-    LANES_LANE="$LANE" "$LANES_EDIT" add-row "$new_row" || ar_rc=$?
-    if [ "$ar_rc" = 0 ]; then
-      step "row added"
-    else
-      die "the register row for $LANE was NOT added ($LANES_EDIT add-row exited $ar_rc; its own words are above). This window has been renamed and NOTHING else has been written — no session cell, no object log, no launch: a lane with no row is a lane no other lane's liveness read, crossing check or \`lane-start\` can see. Settle that refusal and re-run, or add it by hand:
-    LANES_LANE=$LANE $LANES_EDIT add-row '$new_row'" "$ar_rc"
-    fi
-  fi
-else
-  # AMENDMENT 8 — THE CELL FIRST, THEN THE STAMP. The harness minted a
-  # transcript uuid the published cell does not carry (step 3b), and the stamp
-  # below is about to name that uuid: writing the stamp first would leave, for
-  # as long as the two commits are apart, a row whose status names a session its
-  # own session cell does not — and if the append then refused, for ever. So the
-  # cell is extended first, with the same `replace-in-row` and the same anchor
-  # discipline the minted case uses below: the anchor is the PUBLISHED last id,
-  # which refuses exactly when this checkout's copy of the row is older than the
-  # one that landed, and a refusal prints the act rather than corrupting a cell.
-  if [ -n "$harness_sid" ]; then
-    harness_hint="LANES_LANE=$LANE $LANES_EDIT append-session-id $LANE \"<the session cell's last id>\" \"→ $harness_cell\""
-    # THE COMMIT SAYS WHICH ACT THIS WAS: under `--bind` nothing was minted, a
-    # person moved a running session here (openRepoTools#70).
-    harness_why="session cell: the harness minted $harness_sid for this window"
-    [ -z "$bind_sid" ] || harness_why="session cell: bound $harness_sid on the person's choice 2 at the name guard (Amendment 12(h) rule 2)"
-    if [ -z "$cell_anchor" ]; then
-      note "the row's session cell records no transcript uuid to append to (some rows carry only \`session_…\` footer ids, which are not transcript ids). STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $harness_hint"
-    elif (( dry_run )); then
-      plan "lanes-edit.sh append-session-id $LANE '$cell_anchor' '→ $harness_cell'"
-    elif LANES_LANE="$LANE" "$LANES_EDIT" append-session-id "$LANE" "$cell_anchor" "→ $harness_cell" "$harness_why"; then
-      step "session cell updated: $cell_anchor → $harness_sid (the transcript live in this window)"
-    else
-      note "the session cell was NOT extended with $harness_sid (this checkout's copy of the row does not carry $cell_anchor exactly once IN ITS SESSION CELL — it may be older than the published one). STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $harness_hint"
-    fi
-  fi
-
-  # The row is the next launch's first source, so make the exact transcript
-  # recovered from the lane's PAUSED record its final entry again. Without
-  # this, every subsequent launch would rediscover the same dead row id and
-  # need the fallback. This is written before the RESUMED status for the same
-  # ordering guarantee as the harness-minted append immediately above.
-  if [ -n "$restored_sid" ]; then
-    restored_cell="harness \`$restored_sid\` (transcript uuid; restored from the lane's last PAUSED record)"
-    restored_hint="LANES_LANE=$LANE $LANES_EDIT append-session-id $LANE \"<the session cell's last id>\" \"→ $restored_cell\""
-    if [ -z "$row_sid" ]; then
-      note "the row's session cell records no transcript uuid to append the recovered id to. STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $restored_hint"
-    elif (( dry_run )); then
-      plan "lanes-edit.sh append-session-id $LANE '$row_sid' '→ $restored_cell'"
-    elif LANES_LANE="$LANE" "$LANES_EDIT" append-session-id "$LANE" "$row_sid" "→ $restored_cell" "session cell: restored $restored_sid from the lane's last PAUSED record"; then
-      step "session cell updated: $row_sid → $restored_sid (the exact transcript from the lane's last PAUSED record)"
-    else
-      note "the session cell was NOT extended with recovered transcript $restored_sid (this checkout's copy of the row may be older than the published one). The launch is unaffected and so is the NEXT one: this recovery reads the lane's last PAUSED record and not the cell, so it finds the same transcript again and prints this same act — the row keeps naming an id no transcript answers to until somebody runs it. STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $restored_hint"
-    fi
-  fi
-
-  # AMENDMENT 8's RULE, FOLLOWED HERE TOO: THE CELL FIRST, THEN THE STAMP
-  # (Copilot round 5 on openRepoTools#82). The harness path above says it in
-  # those words — the stamp names a uuid, so the cell that carries the uuid is
-  # written first — and this path did the opposite: it stamped the minted id and
-  # THEN tried to append it, so a refused append left the row's state naming a
-  # session its own session cell does not carry. The resume target is the
-  # SESSION CELL and nothing else (Amendment 6(b)), so that never resumed the
-  # wrong conversation — it resumed the id the register knew — but the row said
-  # two things a reader has to reconcile. Written in this order the common path
-  # says one thing, and a refused append still prints the act that cures it.
-  # An EXISTING row that is about to run a NEW session: append the minted id
-  # after the cell's last id, so the next start resumes by id instead of by
-  # title. The append is `replace-in-row`, which refuses unless its anchor
-  # occurs exactly once in the row — so a failure here is a refusal, never a
-  # corruption, and it never fails the launch.
-  #
-  # THE ANCHOR IS THE PUBLISHED ID AND THE FILE IS THIS CHECKOUT'S, which is a
-  # refusal exactly when the two disagree — a stale copy of the row, the case
-  # the read above exists for. That is the right way round: appending after the
-  # id THIS copy ends on would write a cell that no longer matches the one that
-  # landed, and `commit_push`'s rebase would then conflict on the same line. The
-  # refusal prints the act instead, and the launch is unaffected.
-  if [ -n "$new_sid" ]; then
-    stamp_hint="LANES_LANE=$LANE $LANES_EDIT append-session-id $LANE \"<the session cell's last id>\" \"→ harness \\\`$new_sid\\\`\""
-    if [ -z "$row_sid" ]; then
-      note "the row's session cell records no session id this script can read (some rows carry only \`session_…\` footer ids). STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $stamp_hint"
-    elif (( dry_run )); then
-      plan "lanes-edit.sh append-session-id $LANE '$row_sid' '→ harness \`$new_sid\`'"
-    elif LANES_LANE="$LANE" "$LANES_EDIT" append-session-id "$LANE" "$row_sid" "→ harness \`$new_sid\`" "session cell: $prog minted $new_sid for this window"; then
-      step "session cell updated: $row_sid → $new_sid"
-    else
-      note "the session cell was NOT stamped (this checkout's copy of the row does not carry $row_sid exactly once IN ITS SESSION CELL — it may be older than the published one). STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  $stamp_hint"
-    fi
-  fi
-
-  # AMENDMENT 6(c)'s STAMP, WRITTEN HERE. The row's first act after a resume is
-  # `RESUMED by <transcript uuid>`, and under Amendment 6(b) that stamp is
-  # load-bearing: it is what the NEXT lane-start resumes, so a missed one is not
-  # bookkeeping debt, it is a lost lane. It used to be owed to the session that
-  # lane-start had just exec'd — which is a stamp nobody writes when the session
-  # dies at a usage reset before its first act, the shape this estate hits daily.
-  # The verb follows the launch decision, exactly as the object-log line does: a
-  # resume is RESUMED and a new session is STARTED, and the uuid is the one this
-  # run actually resumes or mints, read from the PUBLISHED row (R33) or from the
-  # record live in this window (step 3b).
-  # THE TAIL STATES WHAT HAPPENED (Amendment 8(d), F-B5). The old line said
-  # `launching <cmd>` unconditionally, so a `--no-launch` run stamped the row
-  # with a launch that by definition did not happen — and `--no-launch` is now
-  # the PRESCRIBED act twice over in clause (d) (the harness-mint append, and
-  # the deferred writes of the title-fallback path), so the defect would have
-  # become the common case rather than an edge. The head of the stamp — the
-  # part Amendment 6(b) and clause (d) quote, up to and including `lane-start on
-  # <ws>:` — is unchanged.
-  # AMENDMENT 13(a) — WHAT HAPPENED FIRST, AND THE PLACE IT HAPPENED AFTER IT.
-  # The tail used to read `window renamed, dir <dir>, window <ref>, launching
-  # <cmd>`, and under a 240-character cap (ratified decision O1) that order puts
-  # the ONE FACT THAT IS NOWHERE ELSE — the exact command this run launched —
-  # behind two that are recorded twice over: clause (c) writes `dir` and
-  # `window` into the lane's own log as sub-fields of this very act's
-  # `STARTED`/`RESUMED` line, and Amendment 11's listing prints both as columns.
-  # So the launch clause comes first and the two sub-fields follow it, and a
-  # line long enough to be cut loses what a reader can look up rather than what
-  # they cannot.
-  if (( no_launch )); then
-    did="window renamed, no launch"
-  else
-    did="window renamed, launching $(quoted "${cmd[@]}")"
-  fi
-  did="$did; dir $DIR${record_window:+; window $record_window}"
-  # `$stamp_who` is computed with the launch decision above: the uuid for
-  # Claude, `<agent> <id>` for any other agent (Amendment 17(c)).
-  # AMENDMENT 13(a) — THE STAMP IS THE CELL NOW, not another entry appended to
-  # it. The `state` column holds ONE PHRASE, `<STATE> · <UTC> · <one line>`, and
-  # `set-row-state` stamps the UTC itself — so this builds the line alone, and
-  # the `$utc` this run computed stays where it is still needed (the handoff's
-  # Rule 3 stamp and the log line).
-  #
-  # THE STATE IS `LIVE` EITHER WAY. A launch takes the lane live in this window;
-  # `--no-launch` is the recording act of a session that is already in it
-  # (Amendment 6(c)), so the lane is live in both branches and the tail says
-  # which one happened.
-  #
-  # AND THE LINE KEEPS `<verb> by <uuid>` WORD FOR WORD, because
-  # `row_stamp_is_unknown` reads exactly that pair out of this cell — Amendment
-  # 8(e)'s "first cure carries one condition", which tells a wrong lineage from
-  # the title fallback. A ` · ` inside the line would read back as a fourth part
-  # of the phrase, so it is spelled `; ` here rather than refused at the writer,
-  # and a line over the cap is cut rather than costing the row its whole stamp:
-  # what will not fit is in the object log, one line along.
-  state_line="$lane_verb by $stamp_who (lane $LANE) — lane-start on $ws: $did"
-  state_line="$(cut_to_line "$state_line")"
-  # AND ITS STATUS IS READ, BECAUSE THIS FILE RUNS UNDER `set -e`. A bare
-  # command here is a launch that DIES on the helper's refusal — exit 5, "an
-  # edit moved more than one line", straight out of the shell with no sentence
-  # of its own and the pane gone before anybody can read the helper's. Measured
-  # in this suite: `without --confirm nothing is asked` came back 5, from a row
-  # write nobody had asked to be fatal.
-  #
-  # AND IT IS A NOTE, NEVER A REFUSAL. The row's stamp is the RECORD of a resume
-  # and not its licence — the same rule Amendment 6(c) and the handoff's Rule 3
-  # stamp already take here — so a stamp that could not be written prints the
-  # act that writes it and the lane still starts.
-  if (( dry_run )); then
-    plan "lanes-edit.sh set-row-state $LANE \"LIVE · $state_line\""
-  else
-    srs_rc=0
-    LANES_LANE="$LANE" "$LANES_EDIT" set-row-state "$LANE" "LIVE · $state_line" || srs_rc=$?
-    if [ "$srs_rc" = 0 ]; then
-      step "row state set: LIVE · $lane_verb by ${lane_sid:-unknown}"
-    else
-      note "the row's state cell was NOT set (exit $srs_rc — the helper's own words are above), and the launch is not refused for it: the stamp is the record of this act, not its licence. Set it by hand:"
-      note "  LANES_LANE=$LANE $LANES_EDIT set-row-state $LANE \"LIVE · $state_line\""
-    fi
-  fi
-
-  # AMENDMENT 17(c) — THE CELL, IN THE AGENT'S OWN SPELLING. A launch of an
-  # agent that is not Claude mints no transcript uuid and resumes none: the one
-  # id it has in hand is the `transcript <id>` the lane's own last handoff
-  # recorded (Amendment 17(b)), and the cell is appended with it as the register
-  # has spelled such entries since 2026-09-05 — `Codex <id>`.
-  #
-  # AND NOTHING IS APPENDED WHERE THERE IS NO ID. `pending` in the session cell
-  # would be the same defect clause (e) refuses in the session field of a log
-  # line: the cell is what Amendment 6(b) resumes from, and a placeholder there
-  # is a resume target nobody has. The row's STATE cell still records the act
-  # (`RESUMED by codex pending`), because that cell is a history of acts.
-  if [ "$AGENT" != claude ] && [ -n "$AGENT_ID" ]; then
-    agent_cell="$AGENT_WORD \`$AGENT_ID\`"
-    # THE ANCHOR IS THE PUBLISHED ROW'S LAST ID, which is the same anchor the
-    # minted-uuid append below uses and for the same reason: `append-session-id`
-    # refuses unless it occurs exactly once IN THE SESSION CELL, so a stale copy
-    # of the row is a refusal that prints the act rather than a corruption.
-    # `$cell_anchor` is NOT it — that variable is set only where a session is
-    # live in this window whose uuid the cell lacks (step 3b), which is never
-    # the case for a launch of an agent that is not Claude.
-    if [ -z "$row_sid" ]; then
-      note "the row's session cell records no id to append to, so this launch's $AGENT_WORD id is not in it. STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  LANES_LANE=$LANE $LANES_EDIT append-session-id $LANE \"<the session cell's last id>\" \"→ $agent_cell\""
-    elif (( dry_run )); then
-      plan "lanes-edit.sh append-session-id $LANE '$row_sid' '→ $agent_cell'"
-    elif LANES_LANE="$LANE" "$LANES_EDIT" append-session-id "$LANE" "$row_sid" "→ $agent_cell" "session cell: $prog launched $AGENT for this lane"; then
-      step "session cell updated: $row_sid → $agent_cell"
-    else
-      note "the session cell was NOT extended with $agent_cell (this checkout's copy of the row may be older than the published one). STAMP IT AS THIS SESSION'S FIRST ACT:"
-      note "  LANES_LANE=$LANE $LANES_EDIT append-session-id $LANE \"<the session cell's last id>\" \"→ $agent_cell\""
-    fi
-  fi
-fi
-
-# ------------------------------------------- 5b. the lane's own object log
-#
-# Amendment 7. AFTER the row, because the row is what `who` reads the lane's
-# liveness and handoff path out of, and a log line that named a lane with no
-# row would point at nothing. It never fails the launch: a lane that cannot
-# write its log still starts, and says that it could not.
-
-# `owner/repo` out of the lane's own origin. Every URL form the estate uses:
-# `git@github.com:owner/repo.git`, `https://github.com/owner/repo`, `ssh://…`.
-# It CHECKS its own answer. A remote that is a local path, a mirror or any
-# non-GitHub URL does not reduce to `owner/repo`, and recording one as the
-# lane's home would be inherited by every `#n` that lane ever writes — and a
-# home containing a space writes an event line the log's own parser cannot
-# read back. `unknown` is the honest answer and the helper already refuses to
-# expand `#n` against it.
-
-origin_url="$(git -C "$DIR" remote get-url origin 2>/dev/null || :)"
-home_nwo="$(origin_nwo "$DIR" || :)"
-if [ -z "$home_nwo" ]; then
-  home_nwo=unknown
-  if [ -z "$origin_url" ]; then
-    note "$DIR has no 'origin' remote, so the lane's home repo is recorded as 'unknown' — its cross-repo checks will not run until it is known"
-  else
-    note "$DIR's origin ('$origin_url') does not resolve to a GitHub owner/repo, so the lane's home repo is recorded as 'unknown' rather than as something every '#n' in this lane would inherit"
-  fi
-else
-  # THE HOME IS CANONICAL (Amendment 7, R20). A checkout keeps whatever spelling
-  # its `origin` had on the day it was cloned, and this estate has moved a
-  # repository between orgs while the register was live: a lane homed on
-  # `opensoft/codexFactory` wrote `#5` as an object key that could never collide
-  # with another lane's `codeXfactory/codexFactory#5`, so two lanes held one
-  # GitHub issue and nothing detected it. `lanes/repos.tsv` is what says the two
-  # spellings are one repository, and every OTHER spelling in the tooling goes
-  # through it — so this one does too, BEFORE the STARTED line is written, since
-  # a home is inherited by every `#n` that lane ever writes.
-  home_canon=""; hr_rc=0
-  home_canon="$("$LANES_EDIT" resolve-repo "$home_nwo" 2>/dev/null)" || hr_rc=$?
-  case "$hr_rc" in
-    0)
-      if [ -n "$home_canon" ] && [ "$home_canon" != "$home_nwo" ]; then
-        step "home $home_nwo resolves through lanes/repos.tsv to $home_canon — recording the canonical spelling"
-        home_nwo="$home_canon"
-      fi ;;
-    8)
-      note "lanes/repos.tsv has no row for '$home_nwo', so the lane's home is recorded exactly as its origin spells it. If this repository has ever moved org or is spelled more than one way in the register, add a row to lanes/repos.tsv so every lane keys the same object the same way." ;;
-    *)
-      note "$LANES_EDIT resolve-repo '$home_nwo' failed (exit $hr_rc) — recording the spelling derived from origin" ;;
-  esac
-fi
-# AMENDMENT 11 CLAUSE (c) — THE LANE'S DIRECTORY, PROFILE AND WINDOW, WRITTEN
-# HERE BECAUSE THIS IS THE MOMENT THEY ARE ALL CERTAINLY KNOWN.
-#
-# `dir` closes Amendment 6's oldest open item by the record rather than by a
-# symlink, an environment variable or a manifest: a lane's checkout is known to
-# every process that is IN it and to nothing about to start one, so the one
-# process that is certainly in it writes it down. `profile` is the second, and
-# it is taken from `$CLAUDE_PROFILE_NAME`, which the launcher exports into
-# every session it starts (`claude-profile:658`) — today a lane's profile is
-# recoverable only from the tmux session name `claude-<profile>-<ts>-<pid>`,
-# which act 1's window reuse and any rename destroy and which no record
-# carries, so a restart typed anywhere but in the lane's surviving window
-# cannot name the profile the launcher needs. `window` is Amendment 8(b)'s,
-# gaining its `<@id>` ref.
-#
-# A LINE WRITTEN BEFORE THIS CLAUSE CARRIES NONE OF THEM, AND A READER THAT
-# FINDS NONE SAYS SO RATHER THAN ASSUMING ONE — Amendment 7(i)'s cutover rule.
-# So each sub-field is appended only where its value is actually in hand: no
-# `$CLAUDE_PROFILE_NAME` is a lane started outside the launcher, and inventing
-# `unknown` for it would be the same defect clause (e) refuses in the session
-# field.
-#
-# A SPACE IS THE ONE CHARACTER THAT NEEDS A RULE RATHER THAN A REFUSAL, AND THE
-# RULE IS QUOTING. Amendment 7(b) makes the space the separator between several
-# refs inside one sub-field — which is exactly what `window`'s two refs rely on
-# — so an unquoted `dir $HOME/my projects/x` (unquoted) parses as TWO refs and `lane-dir`
-# hands back a truncated path that this script then refuses as "no such
-# directory". The writer quotes it; `lane-dir` and every other reader take a
-# value opening with `"` as running to its closing `"`, and strip both.
-quote_subfield() {
-  case "$1" in
-    *' '*) printf '"%s"' "$1" ;;
-    *)     printf '%s' "$1" ;;
-  esac
-}
-lane_profile="${CLAUDE_PROFILE_NAME:-}"
-case "$lane_profile" in
-  *', '*|*' — '*|*'; '*|*'"'*)
-    note "\$CLAUDE_PROFILE_NAME is '$lane_profile', which contains ', ', ' — ', '; ' or '\"' — the lane's \`profile\` sub-field is left out rather than written unreadable"
-    lane_profile="" ;;
-esac
-lane_payload="home $home_nwo; estate $estate; dir $(quote_subfield "$DIR")"
-[ -n "$lane_profile" ] && lane_payload="$lane_payload; profile $(quote_subfield "$lane_profile")"
-[ -n "$record_window" ] && lane_payload="$lane_payload; window $record_window"
-# `claude <version>`: the Claude Code this launch starts, as claude-current read
-# it here or as a launcher's own claude-current handed it on
-# (opensoft/workBenches#119). In hand only then, so appended only then, for
-# the reason given above; and a version is digits, dots and a tag, so a value
-# that is not one is left out rather than written into a line nothing rewrites.
-lane_claude_version_re='^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.+-]+)?$'
-if [ "$AGENT" = claude ] && [ -n "$lane_claude_version" ]; then
-  if [[ "$lane_claude_version" =~ $lane_claude_version_re ]]; then
-    lane_payload="$lane_payload; claude $lane_claude_version"
-  else
-    note "the Claude Code version '$lane_claude_version' is not x.y.z, so the lane's log line carries no \`claude\` sub-field"
-  fi
-fi
-
-# AMENDMENT 8(d), R-A8-2 — `unknown` NEVER REACHES THE OBJECT LOG, AND THE RULE
-# IS THE CONDITION RATHER THAN THE PATH. Amendment 7(b): the `session` field is
-# the transcript uuid and only that. `lane_sid` is the literal `unknown`
-# wherever this run has no uuid to name — the title fallback, where the picker
-# has not run when the stamps would be written; a session already live in this
-# window whose transcript is not in this directory; a run with no uuid source at
-# all; `LANE_START_SESSION_ID=0`. The log is APPEND-ONLY, so a line written
-# wrong there is wrong for ever, and the grammar's own writer does not write a
-# line it cannot fill in. It is not a narrowing of Amendment 7 either: A8
-# narrows A7 in exactly one place, clause (b)'s `PAUSED` payload, and not here.
-#
-# THE ROW'S STAMP STILL CARRIES `unknown`, and that is deliberate: the state
-# cell is a history of ACTS, the act happened, and a placeholder there is a
-# thing a reader can see. `unknown` never enters the SESSION cell, which is what
-# Amendment 6(b) resumes from, and so is never replaced in it.
-#
-# BOTH DEFERRED RECORDS ARE WRITTEN BY THE FIRST ACT THAT KNOWS THE UUID — the
-# session's own `lane-start --no-launch`, which clause (e)'s hook prompts by
-# name. That run reads the live record whose tmux target is this window, APPENDS
-# that uuid to the session cell through the cell-scoped edit, and only then
-# writes this line and the handoff's stamp, both carrying the real uuid.
-# (`lane_sid_known` is computed with the launch decision above, which is where
-# `lane_sid` is decided and where the row's own stamp first reads it.)
-#
-# AND THE COMMAND IT PRINTS CARRIES THE AGENT THIS RUN WAS GIVEN
-# (opensoft/openRepoTools#72 item 5). `$self_args` is the lane and nothing
-# else, so a lane started `--agent codex` — which never has a uuid here, so it
-# ALWAYS reaches this line — was handed a first act that dropped the flag, and
-# the person who ran it had `lane-agent` choose instead: the agent of the lane's
-# last PAUSED, which is whichever agent paused it and not the one now running
-# it. `AGENT_EXPLICIT` is 1 for an agent named on the command line and for one
-# the record named that is not the default; either way the run that settles
-# this one is the same agent's, so it is written down, quoted like every other
-# command this file prints. It goes AFTER the lane's own arguments, so the
-# `--no-launch <repo> <n>` a reader looks for is still one run of words.
-ls_defer_agent=""
-if (( AGENT_EXPLICIT )); then ls_defer_agent=" $(quoted --agent "$AGENT")"; fi
-if (( ! lane_sid_known )); then
-  note "no transcript uuid is knowable at this instant (the row's stamp says '${lane_sid:-unknown}'), so the lane's $lane_verb log line is NOT written: Amendment 7(b) makes that field a transcript uuid and only that, and the log is append-only. Nor is the handoff's Rule 3 stamp. BOTH are written by the first act that knows the uuid, which is this session's own:"
-  note "  $prog --no-launch $self_args$ls_defer_agent"
-elif (( dry_run )); then
-  plan "lanes-edit.sh log $lane_verb lane:$LANE → \"$lane_payload\""
-else
-  if LANES_LANE="$LANE" LANES_SESSION="$lane_sid" "$LANES_EDIT" log "$lane_verb" "lane:$LANE" '→' "$lane_payload"; then
-    step "object log: $lane_verb lane:$LANE, home $home_nwo"
-  else
-    note "the lane's object log was NOT written ($lane_verb, home $home_nwo). Write it as this session's first act:"
-    note "  LANES_LANE=$LANE $LANES_EDIT log $lane_verb lane:$LANE '→' \"$lane_payload\""
-  fi
-fi
-
-# ------------------------------------------- 5c. the handoff's Rule 3 stamp
-#
-# AMENDMENT 8 — LANE-START WRITES THE RULE 3 STAMP. Rule 3 makes the FIRST act
-# of a lane resuming from a handoff a stamp on that handoff, in place, before
-# it reads any further and before any other act. It was the SESSION's to write,
-# and it was missed every time: seven resumes of this lane needed it written by
-# hand afterwards, and while it was owed the three records of the same day
-# disagreed about how many resumes there had been — the row said six, the
-# object log four, the handoff five, about ONE lane on ONE day. Amendment 6(c)
-# found exactly this about the row's own stamp and cured it the same way: the
-# boundary act that KNOWS the resume writes the record of it, because a stamp
-# that is owed is a stamp that is missed.
-#
-# ON A RESUME OF AN EXISTING ROW, AND NOTHING ELSE. The verb is `$lane_verb` —
-# the very one 5a decided for the row's status and 5b's object line — so the
-# three can never disagree about whether this was a resume. A brand-new row is
-# not a resume of anything: the file its handoff cell names does not exist yet,
-# and the session that will write it has not run.
-#
-# THE INSERT POINT IS RULED: the line immediately after the first blank line
-# that follows line 1 — line 1 being the lane header (Rule 4) and the blank the
-# end of the header block. That puts THIS resume at the top of the block of
-# stamps, above the ones before it.
-#
-# AFTER 5b, so that every `lanes-edit.sh` write this run makes is already
-# committed before this one touches the checkout at all. The register and the
-# handoffs share one checkout, and the helper REFUSES a checkout carrying an
-# uncommitted change to a tracked file it is not itself writing (Amendment 5,
-# `dirty_elsewhere`). Stamp the handoff first and let its commit fail, and the
-# edit made for the row is the reason the row cannot be written.
-#
-# AND IT IS NEVER A REASON TO REFUSE THE LAUNCH. A handoff that has moved, a
-# checkout with no git, a rebase conflict, a push that hangs — each one prints
-# the command that finishes the act, and the lane still starts. Rule 3's stamp
-# is the RECORD of a resume, not the licence for one, and refusing the session
-# would lose the conversation the stamp is about. (Rule 3 also says a lane that
-# finds an existing stamp stops and reports. That is addressed to the session
-# reading the resume prompt, not to the act that records the resume: the file
-# already carries one line per resume and gains one more.)
-
-# Ruling (h)'s bound, in this script's own few lines rather than reached for in
-# the helper's: every git call that touches the NETWORK runs under
-# `LANES_GIT_TIMEOUT` seconds (default 60; `0` or a non-number turns the bound
-# off), so a hung remote costs the launch a minute and never the session. No
-# `timeout` on PATH is not a reason to skip the call — it is a reason to make
-# it unbounded, which is what this did before the bound existed.
-HS_TIMED_OUT=0
-hs_git_net() {
-  local rc=0 budget="${LANES_GIT_TIMEOUT:-60}"
-  HS_TIMED_OUT=0
-  case "$budget" in
-    ''|0|*[!0-9]*) "${LANES_GIT:-git}" "$@" || rc=$? ;;
-    *)
-      if command -v timeout >/dev/null 2>&1; then
-        timeout -k 5 "$budget" "${LANES_GIT:-git}" "$@" || rc=$?
-        case "$rc" in 124|137) HS_TIMED_OUT=1 ;; esac
-      else
-        "${LANES_GIT:-git}" "$@" || rc=$?
-      fi ;;
-  esac
-  return "$rc"
-}
-
-# F-B7 — WHICH CASE THE READER IS IN, said rather than assumed. A stamp that is
-# committed here and not pushed is carried out by the next `lanes-edit.sh` write
-# ONLY where the handoff lives in the register's own checkout: that write pushes
-# the BRANCH, so it takes the orphaned commit with it. `hs_resolve` also accepts
-# an absolute path and a workspace root, either of which can land outside
-# `$LANES_REPO` — and nothing ever pushes a commit made there, because no
-# `lanes-edit.sh` write goes out of it. Promising a carry that will not happen
-# is worse than printing the command, so the note says which it is.
-hs_carry_note() {
-  if [ -n "${LANES_REPO:-}" ] && [ "$hs_repo" = "$LANES_REPO" ]; then
-    note "  (this handoff is in the register's own checkout, so the next lanes-edit.sh write out of it pushes the branch and carries this commit with it.)"
-  else
-    note "  (this handoff is NOT in the register's checkout ($hs_repo), so no lanes-edit.sh write will ever push it: the command above is the whole of the recovery.)"
-  fi
-  return 0
-}
-
-# The workspace repository, which is where handoffs live (Amendment 4(a)) and,
-# since Amendment 9(a), where the register lives too. THIS USED TO BE A SECOND
-# READER of the same file with a looser rule — it took any `path:` at any
-# indentation and checked nothing — and Amendment 9(a) is explicit that a
-# second way to find one thing is a second answer. It now defers to the one
-# resolver above, which is the same in all four helpers.
-
-# The handoff path is field 7 of the PUBLISHED row: the register's header is
-# `| lane | session id | workstation / env / user | started (UTC) | objects
-# owned | handoff path | state |`, and awk's field 1 is the empty string before
-# the leading pipe. A row carrying an EXTRA cell after its state — there are
-# such rows — does not move field 7; counting back from NF would.
-# AND IT STAMPS ONLY WITH A REAL UUID (R-A8-2). A stamp naming `unknown` is a
-# Rule 3 record that answers nothing about who resumed, in the one document this
-# protocol cannot afford to rewrite; the note above names the act that writes it
-# together with the deferred log line, at the first instant either can be right.
-# AND THE STAMP NAMES THE AGENT WHERE ONE WAS NAMED (Amendment 17(c)): *"the
-# Rule 3 resume prompt … single-use, and stamped `RESUMED by …` before anything
-# else, as Rule 3 requires"*. `$stamp_ok` is `$lane_sid_known` for Claude — the
-# rule R-A8-2 gives — and 1 for an agent whose id is its own kind of id, because
-# refusing that stamp would leave Rule 3 unstamped for every launch this
-# amendment exists to make.
-if [ "$lane_verb" = RESUMED ] && [ "$row_count" = 1 ] && (( stamp_ok )); then
-  hs_cell="$(cell 7 | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' || :)"
-  hs_stamp="RESUMED by $stamp_who (lane $LANE) at $utc — lane-start on $ws"
-  hs_subject="handoff($LANE@$ws): RESUMED by $stamp_who"
-  hs_trailer="Lane: $LANE ($ws)"
-  hs_file=""
-  if [ -z "$hs_cell" ]; then
-    step "the row names no handoff path, so there is no Rule 3 stamp to write"
-  elif ! hs_file="$(hs_resolve "$hs_cell")"; then
-    hs_ws_root="$(hs_workspace_root 2>/dev/null || :)"
-    note "the handoff the row points at was NOT found, so Rule 3's stamp is not written: '$hs_cell'"
-    note "  looked under ${LANES_REPO:-<this checkout has no git root>} and ${hs_ws_root:-<no readable path: in ${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml>}"
-    note "  STAMP IT AS THIS SESSION'S FIRST ACT — this line under the handoff's header block:"
-    note "    $hs_stamp"
-    note "  then: git -C <the workspace repo> commit -m \"$hs_subject\" -m \"$hs_trailer\" -- <the file>"
-  else
-    # A handoff may be reached through the estate's `handoffs` symlink, so the
-    # path git is given is the REAL one: a pathspec that leaves the repository
-    # lexically is a pathspec git refuses, however plainly it is inside it.
-    # `cd -P` AND NOT `readlink -f`, for the reason `real_of` gives above and
-    # `lane-handoff` gives one file over (Copilot round 3 on openRepoTools#47):
-    # an unresolved path here is a `hs_rel` git refuses as a pathspec, and the
-    # stamp is then written and never committed.
-    hs_dirreal="$( CDPATH=''; cd -P -- "$(dirname -- "$hs_file")" 2>/dev/null && pwd -P )" ||
-      hs_dirreal="$(dirname -- "$hs_file")"
-    hs_real="$hs_dirreal/$(basename -- "$hs_file")"
-    # Resolve a final-component symlink too; atomic publication replaces its
-    # real target and leaves the estate link intact.
-    hs_links=0
-    while [ -L "$hs_real" ]; do
-      hs_links=$((hs_links + 1))
-      [ "$hs_links" -lt 40 ] || die "the handoff symlink chain cannot be resolved. Nothing was launched." 2
-      hs_link="$(readlink "$hs_real")" || die "the handoff symlink could not be read." 2
-      case "$hs_link" in /*) hs_real="$hs_link" ;; *) hs_real="$(dirname -- "$hs_real")/$hs_link" ;; esac
-      hs_dirreal="$( CDPATH=''; cd -P -- "$(dirname -- "$hs_real")" && pwd -P )" || die "the handoff target directory is missing." 2
-      hs_real="$hs_dirreal/$(basename -- "$hs_real")"
-    done
-    hs_repo="$(git -C "$(dirname -- "$hs_real")" rev-parse --show-toplevel 2>/dev/null || :)"
-    hs_rel="$hs_real"
-    [ -n "$hs_repo" ] && hs_rel="${hs_real#"$hs_repo"/}"
-    hs_fix="git -C ${hs_repo:-<the workspace repo>} commit -m \"$hs_subject\" -m \"$hs_trailer\" -- $hs_rel"
-    hs_at=""
-    if [ -r "$hs_real" ] && [ -s "$hs_real" ]; then
-      hs_at="$(awk 'NR > 1 && /^[[:space:]]*$/ { print NR; exit }' "$hs_real" || :)"
-      if [ -z "$hs_at" ]; then
-        hs_at=1
-        note "$hs_rel has no blank line after line 1, so it has no header block to stamp under — the stamp goes directly under line 1"
-      fi
-    fi
-    if [ -z "$hs_at" ]; then
-      note "the handoff the row points at is empty or unreadable, so Rule 3's stamp is not written: $hs_file"
-      note "  STAMP IT AS THIS SESSION'S FIRST ACT — this line under the handoff's header block:"
-      note "    $hs_stamp"
-      note "  then: $hs_fix"
-    elif (( dry_run )); then
-      plan "stamp $hs_rel at line $((hs_at + 1)): $hs_stamp"
-      plan "$hs_fix"
-      plan "  then git -C ${hs_repo:-<the workspace repo>} pull --rebase origin ${LANES_BRANCH:-main} && … push origin ${LANES_BRANCH:-main}"
-    else
-      # THE FILE IS SPLICED, NEVER REWRITTEN. A handoff is the one document in
-      # this protocol whose whole purpose is to be read by a later session, and
-      # the act that deleted two lanes' rows on 2026-09-08 was a file written
-      # whole from what somebody remembered of it. So: read it, put ONE line
-      # in, write the rest back unchanged — and prove it before it lands. The
-      # added line must be exactly the stamp, at exactly the ruled position,
-      # and taking that line back out again must give the original file byte
-      # for byte. If it does not, nothing is written at all: that is also what
-      # catches a file whose last line has no newline, where `head` would glue
-      # the stamp on to the end of it.
-      hs_tmpd="$(mktemp -d)"
-      hs_pre="$hs_tmpd/pre"; hs_out="$hs_tmpd/out"
-      if ! cat -- "$hs_real" > "$hs_pre" 2>/dev/null; then
-        note "the handoff the row points at could not be read, so Rule 3's stamp is not written: $hs_file"
-        note "  STAMP IT AS THIS SESSION'S FIRST ACT — this line under the handoff's header block:"
-        note "    $hs_stamp"
-        note "  then: $hs_fix"
-      else
-        if [ "$ri_active" = 1 ] && [ "$ri_expected_digest" != none ] &&
-           [ "$(handoff_digest_of "$hs_pre")" != "$ri_expected_digest" ]; then
-          rm -rf -- "$hs_tmpd"
-          die "the restart handoff changed before its owned resume stamp. Nothing was launched." 2
-        fi
-        { head -n "$hs_at" -- "$hs_pre"
-          printf '%s\n' "$hs_stamp"
-          tail -n "+$((hs_at + 1))" -- "$hs_pre"
-        } > "$hs_out"
-        if [ "$(sed -n -e "$((hs_at + 1))p" "$hs_out")" = "$hs_stamp" ] &&
-           { head -n "$hs_at" -- "$hs_out"; tail -n "+$((hs_at + 2))" -- "$hs_out"; } | cmp -s - "$hs_pre"
-        then
-          if [ "$ri_active" = 1 ]; then
-            ri_post_digest="$(handoff_digest_of "$hs_out")"
-            # Persist both sides of this exact, verified stamp splice before
-            # publishing bytes. Interruption on either side remains retryable.
-            if ! LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$LANE" starting \
-              --expect starting --expect-operation "$ri_op" \
-              --expect-generation "$ri_gen" --expect-attempt "$ri_attempt" \
-              --expect-new-transcript "$lane_sid" --digest "$ri_expected_digest" --prepared-digest "$ri_post_digest" \
-              --reason 'owned handoff stamp prepared' >/dev/null; then
-              rm -rf -- "$hs_tmpd"
-              die "this attempt could not reserve its handoff stamp. Nothing was launched." 2
-            fi
-            ri_expected_digest="$ri_post_digest"
-          fi
-          hs_publish_args=(publish-handoff "$LANE" "$hs_real" "$hs_out" --expect-digest "$(handoff_digest_of "$hs_pre")")
-          if [ "$ri_active" = 1 ]; then
-            hs_publish_args+=(--operation "$ri_op" --generation "$ri_gen" --attempt "$ri_attempt" --state starting --transcript "$lane_sid")
-          fi
-          if ! LANES_NO_FETCH=1 "$LANES_EDIT" "${hs_publish_args[@]}" >/dev/null; then
-            rm -rf -- "$hs_tmpd"
-            die "the handoff stamp could not be published atomically under its writer lock. Nothing was launched." 2
-          fi
-          step "handoff stamped at line $((hs_at + 1)) of $hs_rel: $hs_stamp"
-          if [ "${LANES_NO_GIT:-0}" = 1 ]; then
-            note "LANES_NO_GIT=1 — the stamp is written and NOT committed:"
-            note "  $hs_fix"
-          elif [ -z "$hs_repo" ]; then
-            note "$hs_real is not inside a git checkout, so the stamp cannot be committed from here — it is written, and nothing outside this machine knows it."
-          else
-            # AMENDMENT 4(d) — one commit per write, an EXPLICIT pathspec, and
-            # the `Lane:` trailer. Never `git add -A` and never a bare `git
-            # commit`: this checkout is shared with every other lane on this
-            # workstation, and a write left uncommitted is captured by the next
-            # lane's commit with its attribution lost.
-            hs_rc=0
-            "${LANES_GIT:-git}" -C "$hs_repo" add -- "$hs_rel" 1>&2 || hs_rc=$?
-            if [ "$hs_rc" = 0 ]; then
-              "${LANES_GIT:-git}" -C "$hs_repo" commit -q -m "$hs_subject" -m "$hs_trailer" -- "$hs_rel" 1>&2 || hs_rc=$?
-            fi
-            if [ "$hs_rc" != 0 ]; then
-              note "the stamp is written but NOT committed (git exit $hs_rc) — an uncommitted write is captured by the next lane's commit and its attribution is lost (Amendment 4(d)). Commit it yourself:"
-              note "  $hs_fix"
-            else
-              step "handoff stamp committed: $hs_subject"
-              hs_branch="${LANES_BRANCH:-main}"
-              if ! hs_git_net -C "$hs_repo" pull --rebase -q origin "$hs_branch" 1>&2; then
-                "${LANES_GIT:-git}" -C "$hs_repo" rebase --abort >/dev/null 2>&1 || :
-                if [ "$HS_TIMED_OUT" = 1 ]; then
-                  note "the pull before the push TIMED OUT after ${LANES_GIT_TIMEOUT:-60}s (ruling (h): the launch does not wait on a hung remote) — the stamp is a local commit here and was not pushed."
-                else
-                  note "the pull before the push did not apply (a conflict, or no reachable origin) — the rebase is aborted, the checkout is clean, and the stamp is a local commit here that was not pushed."
-                fi
-                # RV-B3 — LOOK FIRST, because an aborted pull does NOT mean the
-                # commit stayed here. Observed live 2026-09-12T23:04Z: this
-                # lane's handoff commit hit an abort on a peer lane's untracked
-                # log file, and the peer's own helper then rebased and pushed —
-                # carrying this lane's local commit `59a2576` out to origin
-                # underneath its own `f053245`. A reader who ran the re-push
-                # blind at that point lands the same stamp twice, in the one
-                # document this protocol cannot afford to rewrite. The
-                # push-rejected branch below has always said to look; this one
-                # promised a recovery that is sometimes already done.
-                note "  git -C $hs_repo fetch origin $hs_branch && git -C $hs_repo log --oneline origin/$hs_branch -3   # a peer's push may already carry it"
-                note "  git -C $hs_repo pull --rebase origin $hs_branch && git -C $hs_repo push origin $hs_branch      # only if it is not there"
-                hs_carry_note
-              elif ! hs_git_net -C "$hs_repo" push -q origin "$hs_branch" 1>&2; then
-                if [ "$HS_TIMED_OUT" = 1 ]; then
-                  note "the push TIMED OUT after ${LANES_GIT_TIMEOUT:-60}s (ruling (h)) — a hung push often LANDED and the connection did not close, so look before pushing again."
-                else
-                  note "the push was rejected — the stamp is a local commit here and other workstations cannot see it yet."
-                fi
-                note "  git -C $hs_repo fetch origin $hs_branch && git -C $hs_repo log --oneline origin/$hs_branch -3"
-                note "  git -C $hs_repo push origin $hs_branch      # only if it is not there"
-                hs_carry_note
-              else
-                step "handoff stamp pushed to origin/$hs_branch"
-              fi
-            fi
-          fi
-        else
-          note "the splice of Rule 3's stamp into $hs_rel did not prove out (one line added, none changed), so NOTHING was written to it. Add this line under its header block yourself:"
-          note "    $hs_stamp"
-          note "  then: $hs_fix"
-        fi
-      fi
-      rm -rf -- "$hs_tmpd"
-    fi
-  fi
-fi
-
-# ------------------------- 5d. the first prompt (Amendment 17(c) and (f))
-#
-# *"it launches the named agent with THE HANDOFF'S TOP BLOCK AS ITS FIRST
-# PROMPT (the Rule 3 resume prompt, read from the file the row names)"*.
-#
-# AFTER 5c, AND THAT ORDER IS THE WHOLE OF RULE 3. The block handed to the new
-# session is read AFTER this run has stamped `RESUMED by …` into the file, so
-# the session reads a prompt that already carries the record of its own resume —
-# and a `/ctx` respawn hands over the block `lane-handoff` wrote one step
-# earlier, which is the same bytes from the same file rather than a second copy
-# of them.
-#
-# THE TOP BLOCK IS THE HEAD OF THE FILE DOWN TO THE FIRST `---` RULE, which is
-# the marker every refresh writes between the fresh block and the history below
-# it, and 200 lines at the outside for a handoff that has none. A first prompt
-# is a prompt, not a document: the session reads the rest of the file itself,
-# and that is what "older sections below are history" means.
-handoff_top_block() {   # <file>
-  awk 'NR > 1 && $0 ~ /^---[ \t]*$/ { exit } { print } NR >= 200 { exit }' "$1"
-}
-
-if (( first_prompt )); then
-  fp_cell=""
-  if [ "$row_count" = 1 ]; then
-    fp_cell="$(cell 7 | sed 's/^[[:space:]]*//; s/[[:space:]]*$//' || :)"
-  else
-    fp_cell="$handoff"
-  fi
-  fp_file=""
-  [ -n "$fp_cell" ] && fp_file="$(hs_resolve "$fp_cell" 2>/dev/null || :)"
-  if [ "$ri_active" = 1 ] && (( fresh )); then
-    [ -n "$fp_file" ] && [ "$fp_file" -ef "$ri_hf" ] ||
-      die "the delivered restart prompt is not the intent-bound handoff. Nothing was launched." 2
-    [ "$ri_expected_digest" = none ] || [ "$(handoff_digest_of "$fp_file")" = "$ri_expected_digest" ] ||
-      die "the restart handoff changed after preparation. Nothing was launched." 2
-  fi
-  if [ -n "$fp_file" ] && [ -s "$fp_file" ]; then
-    fp_text="$(handoff_top_block "$fp_file")"
-    if [ "$ri_active" = 1 ] && (( fresh )); then
-      [ -n "$fp_text" ] || die "the supervised handoff has no first prompt. Nothing was launched." 2
-      [ "$ri_expected_digest" = none ] || [ "$(handoff_digest_of "$fp_file")" = "$ri_expected_digest" ] ||
-        die "the restart handoff changed while reading its prompt. Nothing was launched." 2
-    fi
-    if [ -n "$fp_text" ]; then
-      cmd+=("$fp_text")
-      step "first prompt: the top block of $fp_cell ($(printf '%s\n' "$fp_text" | grep -c .) lines), delivered to $AGENT as its opening prompt"
-    else
-      note "the handoff the row names is empty at its head, so $AGENT is launched with no first prompt: $fp_file"
-    fi
-  else
-    # NEVER A REASON TO REFUSE THE LAUNCH, for the same reason a handoff that
-    # cannot be stamped is not: Rule 3's block is the RECORD a session resumes
-    # from, and a session with no prompt can still read the file itself.
-    note "the handoff the row names was not found${fp_cell:+ ('$fp_cell')}, so $AGENT is launched with no first prompt. Its first act is to read that file and stamp it (Rule 3)."
-  fi
-fi
-
-# --------- 5c. the transcript this launch is about to make, INTO THE INTENT
-#
-# THE SUPERVISOR CANNOT CONFIRM WHAT IT WAS NEVER TOLD (openRepoTools#94). Its
-# readiness predicate asks whether the EXPECTED new transcript exists and is
-# bound to this lane; the only process that knows which uuid that is, is this
-# one, and only after 5a minted it. So it is written back into the intent
-# before the `exec` — the last act this command takes that the supervisor can
-# read — and the state goes with it: `starting` is *a launch was prepared for
-# this operation*, and the legacy intent stays starting
-# until readiness is CONFIRMED.
-#
-# THE WRITE IS FENCED ON THE OPERATION AND ON NOTHING ELSE. A launch that has
-# been superseded between 5a and here writes nothing, and says so: the exit 7
-# is the intent telling this run that a newer operation owns the lane.
-#
-# A FAILED FENCE OR WRITE REFUSES THE LAUNCH. An observer declining to mark
-# readiness cannot undo the effects of a stale process that was already execed.
-if (( fresh )) && [ "$ri_active" = 1 ] && (( ! no_launch )) && (( ! dry_run )); then
-  ri_new="$lane_sid"
-  [ -n "$ri_new" ] && [ "$ri_new" != unknown ] || ri_new="${new_sid:-}"
-  ri_wrc=0
-  # FENCED ON THE GENERATION AS WELL AS THE OPERATION (Copilot round 2 on
-  # openRepoTools#121), which is what every write the supervisor makes of this
-  # same intent carries. `$ri_gen` is the generation this run READ at the top,
-  # before anything was renamed or written, and the supervisor's claim keeps it
-  # — so a legacy operation advanced between the two has a launch here that
-  # writes nothing and says so, rather than stamping its expected transcript
-  # onto a newer generation's record.
-  ri_fence=()
-  case "${ri_gen:-}" in '' | *[!0-9]*) : ;; *) ri_fence=(--expect-generation "$ri_gen" --expect-attempt "$ri_attempt") ;; esac
-  LANES_NO_FETCH=1 "$LANES_EDIT" legacy-restart-check "$LANE" ||
-    die "managed ownership blocks the prepared legacy launch. Nothing was launched." 2
-  LANES_NO_FETCH=1 "$LANES_EDIT" set-restart-intent "$LANE" starting \
-    --expect 'pending|starting' --expect-operation "$ri_op" \
-    ${ri_fence[@]+"${ri_fence[@]}"} \
-    ${ri_new:+--new-transcript "$ri_new"} \
-    --expect-new-transcript "$ri_new" --digest "$ri_expected_digest" --prepared-digest none \
-    --reason "lane-start prepared the launch" >/dev/null 2>&1 || ri_wrc=$?
-  case "$ri_wrc" in
-    0) step "restart intent $ri_op: starting${ri_new:+, expected transcript $ri_new}" ;;
-    7) die "the restart intent moved under this launch: another operation owns lane $LANE now. This stale launch was refused before exec. Re-read it: lanes-edit.sh restart-intent $LANE" 2 ;;
-    *) die "the prepared transcript could not be recorded (set-restart-intent exited $ri_wrc). This supervised launch was refused before exec because readiness cannot verify its identity." 1 ;;
-  esac
-fi
-
-# ------------- 5e. the estate's daily report (opensoft/openRepoTools#162)
-#
-# ONCE A DAY PER WORKSTATION, DETACHED, AND NEVER A REASON A START WAITS OR
-# FAILS. `lane-worktrees sweep --all --dry-run --report` is the net under every
-# actor that never runs `lane-end`: what is FOREIGN, orphaned, unpublished,
-# aging or past retention across the estate, as one table, written to the state
-# directory. It changes nothing. The first start of the day takes the stamp -
-# `set -C` makes taking it one atomic create, so two starts at once run one
-# report - and starts it with stdin, stdout and stderr closed, in a subshell
-# that exits at once, so the report is no child of the session this command is
-# about to exec. Every step of this either works or is skipped in silence:
-# a report that could not start is tomorrow's start's to run.
-# `LANE_WORKTREES_REPORT=off` is the switch, and both suites set it.
-lane_daily_report() {
-  [ "${LANE_WORKTREES_REPORT:-on}" = off ] && return 0
-  ldr_bin=""
-  if [ -x "$SCRIPT_DIR/lane-worktrees" ]; then
-    ldr_bin="$SCRIPT_DIR/lane-worktrees"
-  else
-    ldr_bin="$(command -v lane-worktrees 2>/dev/null || :)"
-  fi
-  [ -n "$ldr_bin" ] || return 0
-  ldr_state="${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools"
-  ldr_day="$(date -u +%Y%m%d 2>/dev/null || :)"
-  [ -n "$ldr_day" ] || return 0
-  # THE REPORT IS PRIVATE (#170 item 11): it names every path, branch and lane
-  # of the estate. Its directories are 0700, and it is written under umask 077.
-  # A directory that could not be made 0700 - one that already existed wider,
-  # on a file system or under an owner that refuses the chmod - runs NO report
-  # (#179, Copilot round 1): the stamp is not taken, so tomorrow's start tries
-  # again, and a report never lands where every local account could read it.
-  ( umask 077; mkdir -p -- "$ldr_state/reports" ) 2>/dev/null || return 0
-  chmod 700 "$ldr_state" "$ldr_state/reports" 2>/dev/null || return 0
-  ( set -C; : > "$ldr_state/report-$ldr_day.stamp" ) 2>/dev/null || return 0
-  for ldr_old in "$ldr_state"/report-*.stamp; do
-    [ "$ldr_old" = "$ldr_state/report-$ldr_day.stamp" ] || rm -f -- "$ldr_old" 2>/dev/null || :
-  done
-  ldr_out="$ldr_state/reports/$(date -u +%Y%m%dT%H%M%SZ).md"
-  # THE ESTATE THIS START READS: `$PROJECTS_ROOT` as resolved above, named to
-  # the report rather than left for it to find again.
-  ldr_estate=""
-  [ -d "$PROJECTS_ROOT" ] && ldr_estate="$PROJECTS_ROOT"
-  # A PANE KILLED AFTER THE STAMP WAS TAKEN DOES NOT TAKE THE REPORT WITH IT
-  # (#170 E8): the report ignores the hangup (`nohup`, everywhere), and where
-  # there is a `setsid` (Linux; macOS has none) it is in a session of its own,
-  # which no terminal's hangup reaches at all. Otherwise today's stamp would
-  # name a report that never finished, and none would run until tomorrow.
-  ldr_detach=""
-  command -v setsid >/dev/null 2>&1 && ldr_detach="setsid"
-  ( umask 077
-    $ldr_detach nohup "$ldr_bin" sweep --all --dry-run --report --post "$ldr_out" \
-      ${ldr_estate:+--estate "$ldr_estate"} </dev/null >/dev/null 2>&1 & ) 2>/dev/null || :
-  step "the estate's daily report is running, detached: $ldr_out"
-  return 0
-}
-(( dry_run )) || lane_daily_report || :
-
-# ---------------------------------------------------------------- 6. launch
-#
-# `cmd` was decided in 5a, before the row was written.
-
-if (( no_launch )); then
-  quoted "${cmd[@]}"; printf '\n'
-  step "--no-launch: the command above was printed, not run (its cwd would be $DIR)"
-  exit 0
-fi
-
-if (( dry_run )); then
-  plan "cd $DIR"
-  plan "exec $(quoted "${cmd[@]}")"
-  step "--dry-run: nothing was renamed, written or launched"
-  exit 0
-fi
-
-if [ -n "$preparation_failure_identity" ]; then
-  pfr_final="$(LANES_NO_FETCH=1 "$LANES_EDIT" restart-intent "$LANE" --dir "$DIR")" ||
-    die "the failed preparation could not be rechecked before ordinary launch. Nothing was launched." 2
-  preparation_failure_resume_check "$pfr_final"
-fi
-
-cd -- "$DIR"
-step "exec: $(quoted "${cmd[@]}")"
-exec "${cmd[@]}"
diff --git a/lane-worktrees b/lane-worktrees
deleted file mode 100755
index 35e2d0ea..00000000
--- a/lane-worktrees
+++ /dev/null
@@ -1,6318 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""lane-worktrees - one act that archives, rescues and removes a lane's
-abandoned worktrees, branches, scratch and killed-suite sandboxes
-(opensoft/openRepoTools#162).
-
-    lane-worktrees sweep <lane> [--dry-run | --yes] [--porcelain]
-                   [--bundle] [--branches] [--links] [--push-untracked]
-                   [--include-scratch] [--include-caches] [--include-sandboxes]
-                   [--include-foreign --word "<verbatim>"]
-                   [--live <path> ... | --live none] [--fetch] [--estate <dir>]
-    lane-worktrees sweep --expire [--dry-run | --yes] [--porcelain]
-    lane-worktrees sweep --all --dry-run --report [--post <path|owner/repo#n>]
-                   [--estate <dir>]
-    lane-worktrees add <lane> <slice> [--branch <name>] [--from <ref>]
-                   [--checkout <dir>] [--dry-run]
-    lane-worktrees --help | --version
-
-A SWAP THAT DOES NOT FINISH GRACEFULLY LEAVES ITS WRITERS' TREES WHERE THEY
-STOOD, and the protocol's worktree-safety rule (a swap never commits, pushes,
-stashes, resets or cleans) is right to leave them. This is the act that
-retires them afterwards, in one place, with one rule: NOTHING IS DELETED THAT
-IS NOT FIRST ON ORIGIN OR IN A BUNDLE under the sweeps directory, and a tree a
-live writer owns is never touched.
-
-THE DRY RUN IS THE DEFAULT and changes nothing - no fetch, no ref, no file,
-no register line (`--fetch` asks origin first; `lanes-edit.sh`'s own reads
-fetch the register as they always do). `--yes` performs the table: it fetches
-the register itself first and refuses if that fails (an inherited
-LANES_NO_FETCH does not skip it), then fetches origin in every repository it
-acts in, with a pinned refspec that never prunes a local branch or tag.
-
-BEFORE EACH REMOVAL git is asked which commits it would take - a worktree's
-HEAD and reflog, a clone's every ref (an annotated tag's object included)
-and reflog, a pruned registration's, a `--branches` delete's tip and reflog -
-and any that no origin ref, surviving branch, tag or stash keeps go to a
-bundle first (ONLY-COPY bundles are rows of rescues.tsv, and `--expire`
-never removes their archive). The same question is the SELF-CHECK right
-before the removal: anything neither on origin nor in a verified bundle is
-refused, exit 2, and nothing after it is acted on; so is everything after a
-register line that could not be written. Untracked files are never pushed
-(the bundle only) unless `--push-untracked`, and untracked git-lfs content,
-which a bundle would carry as a pointer only, keeps its tree; a branch an open
-pull request or another lane owns is never pushed onto (a rescue branch
-instead, and gh's OPEN wins over a LANDED line); where git-lfs is configured
-the push runs its hooks, and a clone whose local git-lfs store a bundle alone
-would have to stand for is kept. A cache that holds a repository (a bare one
-included) is never removed, nor is any `tmp.*` sandbox (it is listed: nothing
-proves a suite made it), nor a tree or registration whose git directory keeps
-a submodule repository (a deinitialized one's included) with work no remote
-of it holds.
-
-WHICH TREES ARE THE LANE'S is #97's inventory (`lanes-edit.sh lane-trees`)
-and the disk - never the derived index (Amendment 14 clause (b)). A tree the
-inventory does not name is FOREIGN: reported, and left, unless
-`--include-foreign` and a `--word`. A tree another lane's inventory names is
-that lane's and is never acted on from here.
-
-WHO MAY ACT is #97's reconciliation (`lanes-edit.sh lane-reconcile`): a lane
-bound on another host or container is UNKNOWN, never dead (Amendment 18(b)),
-so every act is refused for it; a lane held by another live session is
-refused; a lane whose holder is THIS session, or one with a tree THIS session
-recorded, acts only on the writer count the coordinator states with `--live`
-(Amendment 17 Addendum 1 (i)) - each path naming a tree of the table, or
-`--live none` alone (anything else is usage, 64).
-
-"MERGED" is the register's LANDED line for the branch's pull request, or
-`gh`'s MERGED state for it - never `git branch --merged` alone, because a
-squash merge leaves no ancestry.
-
-The sweeps directory: ${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/
-sweeps/<lane>/<UTC>/ with MANIFEST.sha256, DISPOSITION.md and rescues.tsv.
-`sweep --expire` lists (and with `--yes` removes) archives older than the
-retention (90 days; `sweep.conf`) whose every rescue branch is still on
-origin at the rescued SHA; an archive whose rescue branch is gone or moved,
-that holds an only-copy bundle (a `bundle:` row), or that is not whole (its
-MANIFEST.sha256 missing or not matching, its rescues.tsv unreadable), is
-never expired.
-
-THE ESTATE REPORT (`--all --dry-run --report`) is the net under every actor
-that never runs `lane-end`: FOREIGN clones, trees of ENDED lanes, unmerged
-branches, root-`main` divergence, rescue branches and dirty trees awaiting
-disposition, caches and sandboxes, large ignored directories, evidence-shaped
-paths, archives past retention, the workspace's bytecode hygiene and
-`status --all`'s findings - one markdown document, printed or `--post`ed to a
-file or an issue. It changes nothing. `lane-start` runs it once a day per
-workstation, detached (`LANE_WORKTREES_REPORT=off` is the switch). It exits 0,
-or 1 when `--post` could not deliver it (the report is then printed).
-
-PORCELAIN: one row per line, fields separated by one TAB. In every field a
-backslash is written `\\`, a TAB `\t`, a newline `\n` and a carriage
-return `\r`, so a path holding any of them is still one field of one row.
-Undecodable bytes in a path pass through as the bytes they are.
-
-ADD (`add <lane> <slice>`, #163) IS HOW A LANE MAKES A WORKTREE, AND IT
-RECORDS THE TREE IN THE LANE'S #97 INVENTORY IN THE SAME ACT: a `git worktree
-add` of the lane's checkout (or `--checkout <dir>`) at `<parent of the lane's
-dir>/.lane-worktrees/<lane>/<slice>`, on branch `--branch` (default: the
-slice) - checked out where it exists, else made from `--from` (default HEAD)
-with `--no-track`, so a bare `git push` never aims a writer's commits at the
-branch it started from - then `lanes-edit.sh set-lane-tree`. A record that
-fails, or a `git worktree add` that fails after making the tree (a failing
-post-checkout hook), takes the fresh tree and its new branch back out. The
-path is printed on
-stdout; `--dry-run` makes nothing. A tree made any other way is FOREIGN until
-`lanes-edit.sh set-lane-tree <lane> <path>` records it. Exit 0 made and
-recorded, 2 refused (nothing made), 1 made and neither recorded nor taken back
-out (the commands are printed), 64 usage.
-
-A TRIAD (opensoft/openRepoTools#186, T018). Where the lane's checkout is an
-ASSEMBLY - its `project.yaml` declares a leg other than itself, read by
-`lanes-edit.sh project-legs` - the sweep also reads each leg and each
-dependency nested in one as a `leg` row (never acted on; counted only where
-its HEAD's own `Lane:` trailer is this lane's and it holds work, or where it
-could not be read), lists the worktrees git registers in every leg, and takes
-`<assembly>/worktrees` - the paired `worktrees/<feature>/{spec,code}` - as a
-root whose trees are the lane's by that same trailer rule. The estate report
-counts each leg of every canonical assembly as a checkout of its own - its
-branches, root `main` and rescue branches, each row naming its assembly - and
-adds a section of the legs holding uncommitted or unpublished work, only where
-an assembly's leg is checked out. `add` records a tree made from any checkout
-of a leg's repository - the leg itself or a worktree of it - with the LEG as
-its checkout, and says, of a tree made from the assembly itself, that its legs
-are empty there. A checkout with no `project.yaml` is asked nothing, and its
-table, its report and its `add` are what they always were.
-
-Exit codes:
-  0  dry run: nothing to retire  ·  --yes: every act completed
-  3  dry run: something to retire (the `lane-end` gate's answer, #163)
-  2  refused: the lane is bound elsewhere, held by another live session,
-     managed-owned, has trees but no #97 snapshot, or a read failed (a lane
-     root, a registration list, another lane's claim on a lane with a tree,
-     the register's fetch under --yes) - or an error no read caught -
-     nothing was changed; or, under --yes, the self-check refused a removal
-     (what was done before it is recorded, nothing after it was acted on)
-  1  --yes: an act failed part-way; what was done is recorded and the
-     rest is left exactly as it was
- 64  usage
-"""
-
-from __future__ import annotations
-
-import argparse
-import datetime as _dt
-import getpass
-import hashlib
-import json
-import os
-import re
-import shlex
-import shutil
-import socket
-import stat
-import subprocess
-import sys
-import tarfile
-import tempfile
-import time
-
-PROG = "lane-worktrees"
-VERSION = "1"
-US = "\x1f"
-
-#: Dependency caches and bytecode: they hold no work and are rebuilt, so they
-#: are removed WITHOUT archiving (`--include-caches`) and never counted as a
-#: tree's ignored work.
-CACHE_NAMES = ("__pycache__", ".pytest_cache", ".mypy_cache", ".ruff_cache",
-               "node_modules")
-VENV_NAMES = ("venv", ".venv")
-
-#: Ignored BUILD OUTPUT: generated, rebuilt, and often gigabytes. A tree's
-#: ignored files are archived before it goes - except caches and these.
-BUILD_NAMES = ("target", "build", "dist", ".tox", ".nox", ".gradle", ".next",
-               ".turbo", ".cache", "coverage", "htmlcov", ".eggs")
-
-#: A branch with one of these names is never pushed "as is" by a sweep: its
-#: unpublished commits go to a rescue branch instead. Pushing a lane's stray
-#: commits onto a default branch is not a rescue.
-PROTECTED_BRANCHES = ("main", "master")
-
-#: The register words a legacy writer may never write (ruling 2026-10-04).
-RESERVED = ("managed owner", "managed binding", "mode=managed", "managed:")
-
-GIT_NET_TIMEOUT = 180
-GIT_TIMEOUT = 120
-
-DEFAULT_CONF = {
-    "retention_days": 90,
-    "aging_days": 14,
-    "sandbox_min_age_minutes": 60,
-    "foreign_quiet_hours": 24,
-    "ignored_report_mb": 50,
-    "ignored_archive_mb": 200,
-}
-
-UUID_RE = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-"
-                     r"[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
-STAMP_RE = re.compile(r"^(\d{8}T\d{6}Z)")
-SLUG_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
-LANDED_OBJ_RE = re.compile(
-    r"^LANDED — lane [^,]+, session [^,]+, [^,]+, "
-    r"([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)#(\d+)\b")
-LANDED_ROW_RE = re.compile(r"^LANDED — .*PR #(\d+) into "
-                           r"([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+) main")
-
-
-class Usage(Exception):
-    """A usage error: exit 64."""
-
-
-class Refusal(Exception):
-    """A refusal before anything was changed: exit 2."""
-
-
-# ================================================================ utilities
-
-def utc_now() -> str:
-    return _dt.datetime.now(_dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def utc_stamp() -> str:
-    return _dt.datetime.now(_dt.timezone.utc).strftime("%Y%m%dT%H%M%SZ")
-
-
-def say(text: str = "") -> None:
-    sys.stdout.write(text + "\n")
-
-
-def pesc(value) -> str:
-    """One porcelain field: a backslash, TAB, newline or carriage return in
-    it is written `\\`, `\\t`, `\\n`, `\\r`, so a row is always one line of
-    exactly its columns - a path with a TAB in it is still one field (B3)."""
-    return (str(value).replace("\\", "\\\\").replace("\t", "\\t")
-            .replace("\n", "\\n").replace("\r", "\\r"))
-
-
-def prow(*fields) -> None:
-    say("\t".join(pesc(f) for f in fields))
-
-
-def note(text: str) -> None:
-    sys.stderr.write(f"{PROG}: {text}\n")
-
-
-def run(argv, cwd=None, env=None, timeout=GIT_TIMEOUT, input_text=None):
-    """Run `argv`; NEVER raises for a non-zero exit or a missing program.
-
-    A program that could not be started is exit 127 with the reason on
-    stderr, and a timeout is 124 - the two shapes every caller here already
-    reads as "the read failed", which is never an answer (Amendment 7(d))."""
-    try:
-        # SURROGATEESCAPE, NOT STRICT UTF-8: a path is bytes, and a worktree
-        # named in Latin-1 is a tree to report, never a traceback (B2).
-        return subprocess.run(
-            [str(a) for a in argv], cwd=cwd, env=env, capture_output=True,
-            encoding="utf-8", errors="surrogateescape", timeout=timeout, input=input_text,
-            stdin=None if input_text is not None else subprocess.DEVNULL)
-    except subprocess.TimeoutExpired:
-        return subprocess.CompletedProcess(argv, 124, "", f"timed out after {timeout}s")
-    except OSError as exc:
-        return subprocess.CompletedProcess(argv, 127, "", str(exc))
-
-
-#: Repositories read as a git directory ALONE (#174, Copilot round 2): a
-#: submodule repository under `<gitdir>/modules/` names its working tree in
-#: `core.worktree`, and where that directory is gone - a gone worktree's
-#: registration, a submodule removed after its deinit - every git command
-#: run in it dies on "cannot chdir". Only reads that need no working tree are
-#: run there (refs, reflogs, rev-list, ls-remote), so each is handed the
-#: repository's own `objects/` as one. See `module_reads`.
-_GITDIR_READS: set = set()
-
-
-def git_env(path: str = "") -> dict:
-    env = dict(os.environ)
-    if path and path in _GITDIR_READS:
-        env["GIT_WORK_TREE"] = os.path.join(path, "objects")
-    env["GIT_TERMINAL_PROMPT"] = "0"
-    env.setdefault("GIT_SSH_COMMAND", "ssh -o BatchMode=yes")
-    env["LC_ALL"] = "C"
-    # A READ TAKES NO OPTIONAL LOCK: `git status` otherwise refreshes the
-    # index's stat cache and writes it back, and a dry run writes nothing.
-    env["GIT_OPTIONAL_LOCKS"] = "0"
-    return env
-
-
-def git(path: str, *args: str, timeout: int = GIT_TIMEOUT):
-    return run(["git", "-C", path, *args], env=git_env(path), timeout=timeout)
-
-
-def git_out(path: str, *args: str):
-    """stdout stripped, or None where git failed."""
-    proc = git(path, *args)
-    if proc.returncode != 0:
-        return None
-    return proc.stdout.strip()
-
-
-def real(path: str) -> str:
-    try:
-        return os.path.realpath(path)
-    except OSError:
-        return path
-
-
-def under(path: str, root: str) -> bool:
-    """`path` IS `root` or sits beneath it - compared physically."""
-    p, r = real(path), real(root)
-    return p == r or p.startswith(r.rstrip(os.sep) + os.sep)
-
-
-def tilde(path: str) -> str:
-    home = os.environ.get("HOME", "")
-    if home and (path == home or path.startswith(home.rstrip("/") + "/")):
-        return "~" + path[len(home.rstrip("/")):]
-    return path
-
-
-def short(sha: str) -> str:
-    return sha[:12] if sha and re.match(r"^[0-9a-f]{12,}$", sha) else (sha or "-")
-
-
-def dir_size(path: str) -> int:
-    total = 0
-    for base, dirs, files in os.walk(path, followlinks=False):
-        for name in files + dirs:
-            try:
-                total += os.lstat(os.path.join(base, name)).st_size
-            except OSError:
-                pass
-    return total
-
-
-def human_size(n: int) -> str:
-    size = float(n)
-    for unit in ("B", "KB", "MB", "GB"):
-        if size < 1024 or unit == "GB":
-            return f"{size:.0f} {unit}" if unit == "B" else f"{size:.1f} {unit}"
-        size /= 1024
-    return f"{n} B"
-
-
-def rmtree(path: str) -> None:
-    """`shutil.rmtree` that also clears git's read-only object files. A path
-    that is already gone is already removed.
-
-    A SYMLINK IS NEVER CHMOD-ED OR REMOVED THROUGH (#170 E4): `os.chmod`
-    follows a link, so the retry for an entry that would not go changed the
-    mode of whatever the link pointed at - a clone elsewhere - and a path that
-    IS a link was "removed" by an rmtree that refused it in silence. A link
-    at the top is refused; one inside is retried without a chmod."""
-    if not os.path.lexists(path):
-        return
-    if os.path.islink(path):
-        raise OSError(f"{path} is a symbolic link; nothing is removed through one")
-
-    def clear(func, target, _exc):
-        if not os.path.islink(target):
-            try:
-                os.chmod(target, stat.S_IWRITE | stat.S_IREAD | stat.S_IEXEC)
-            except OSError:
-                pass
-        func(target)
-    shutil.rmtree(path, onerror=clear)
-
-
-def sha256_of(path: str) -> str:
-    digest = hashlib.sha256()
-    with open(path, "rb") as fh:
-        for block in iter(lambda: fh.read(1 << 20), b""):
-            digest.update(block)
-    return digest.hexdigest()
-
-
-def safe_ref_part(text: str) -> str:
-    """A path component folded into what a ref name takes."""
-    folded = re.sub(r"[^A-Za-z0-9._-]+", "-", text).strip(".-") or "tree"
-    folded = re.sub(r"\.\.+", ".", folded)
-    if folded.endswith(".lock"):
-        folded = folded[:-5] + "-lock"
-    return folded[:80]
-
-
-def register_text(text: str) -> str:
-    """A register line's free text, fenced the way `lanes-edit.sh`'s writer
-    fences a payload: no ` — ` (the line's own separator), no `, `, no
-    newline, and none of the managed-owner vocabulary a legacy writer may
-    never write (ruling 2026-10-04)."""
-    out = text.replace("\r", " ").replace("\n", " ")
-    out = out.replace(" — ", " - ").replace(", ", "; ")
-    low = out.lower()
-    for word in RESERVED:
-        if word in low:
-            out = re.sub("managed", "manag.ed", out, flags=re.IGNORECASE)
-            break
-    while out.startswith(("→", "←")):
-        out = out[1:].lstrip()
-    return out
-
-
-# ============================================================ configuration
-
-def _home() -> str:
-    return os.environ.get("HOME") or os.path.expanduser("~")
-
-
-def state_dir() -> str:
-    base = os.environ.get("XDG_STATE_HOME") or os.path.join(_home(), ".local", "state")
-    return os.path.join(base, "openRepoTools")
-
-
-def sweeps_dir() -> str:
-    return os.path.join(state_dir(), "sweeps")
-
-
-def conf_path() -> str:
-    named = os.environ.get("LANE_WORKTREES_CONF", "")
-    if named:
-        return named
-    base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(_home(), ".config")
-    return os.path.join(base, "openRepoTools", "sweep.conf")
-
-
-def load_conf() -> dict:
-    """`sweep.conf`: `key=value` lines, `#` comments. An unknown key or a
-    value that is not a whole number is a note and the default stands."""
-    conf = dict(DEFAULT_CONF)
-    path = conf_path()
-    try:
-        with open(path, encoding="utf-8", errors="surrogateescape") as fh:
-            lines = fh.read().splitlines()
-    except OSError:
-        return conf
-    for raw in lines:
-        line = raw.split("#", 1)[0].strip()
-        if not line or "=" not in line:
-            continue
-        key, value = (part.strip() for part in line.split("=", 1))
-        if key not in DEFAULT_CONF:
-            note(f"{path}: '{key}' is not a sweep.conf key; ignored")
-            continue
-        if not value.isdigit():
-            note(f"{path}: {key}={value} is not a whole number; the default "
-                 f"{DEFAULT_CONF[key]} stands")
-            continue
-        conf[key] = int(value)
-    return conf
-
-
-# =================================================== the helper (lanes-edit)
-
-def lanes_edit_path() -> str:
-    """`$LANES_EDIT`, else the `lanes-edit.sh` beside this file, else PATH -
-    the order `lanes` and `lanes-index` already find it in."""
-    named = os.environ.get("LANES_EDIT", "")
-    if named:
-        return named
-    here = os.path.join(os.path.dirname(os.path.realpath(__file__)), "lanes-edit.sh")
-    if os.access(here, os.X_OK):
-        return here
-    return shutil.which("lanes-edit.sh") or ""
-
-
-class LaneFacts:
-    """What #97's reconciliation says about one lane, read once."""
-
-    def __init__(self, lane: str):
-        self.lane = lane
-        self.rc = 0
-        self.root = ""
-        self.state = "NONE"
-        self.holder = "unknown"         # live | none | unknown
-        self.holder_uuid = ""
-        self.holder_detail = ""
-        self.binding = "unknown"        # here | free | gone | elsewhere | unknown
-        self.binding_at = ""
-        self.managed = ""               # "" | owned | unknown
-        self.managed_owner = ""
-        self.verdict = ""
-        self.verdict_why = ""
-        self.dir = ""
-        self.inventory: list = []
-        self.inventory_rc = 0
-        self.why = ""
-
-
-class Helper:
-    def __init__(self):
-        self.path = lanes_edit_path()
-        self._fetched = False
-
-    def call(self, *args: str, env_extra: dict | None = None, fetch: bool = False,
-             timeout: int = 300):
-        if not self.path:
-            return subprocess.CompletedProcess(args, 127, "", "no lanes-edit.sh beside this "
-                                               "command or on PATH")
-        env = dict(os.environ)
-        env["LANES_INDEX"] = "off"
-        if not fetch or self._fetched:
-            env["LANES_NO_FETCH"] = "1"
-        if env_extra:
-            env.update(env_extra)
-        proc = run([self.path, *args], env=env, timeout=timeout)
-        if fetch:
-            self._fetched = True
-        return proc
-
-    def canon_lane(self, lane: str):
-        """(canonical spelling, refusal) - Amendment 15's resolver, as
-        `lane-end` reads it: 0 with the row's spelling; 66 the alias table
-        unreadable and 2 with 15(d)'s words a published case pair, both
-        refusals; any other answer (a helper predating the subcommand) keeps
-        the typed spelling."""
-        proc = self.call("canon-lane", lane, fetch=True)
-        out = proc.stdout.strip()
-        if proc.returncode == 0 and out:
-            return out, ""
-        if proc.returncode == 66:
-            return lane, ("the lane alias table could not be read (exit 66), so a renamed "
-                          f"lane's old name cannot be resolved: {_first_line(proc.stderr)}")
-        if proc.returncode == 2 and "Amendment 15(d)" in (proc.stderr or ""):
-            return lane, ("the published register spells this lane two ways (Amendment "
-                          f"15(d)): {_first_line(proc.stderr)}")
-        return lane, ""
-
-    def lane_facts(self, lane: str) -> LaneFacts:
-        facts = LaneFacts(lane)
-        proc = self.call("lane-reconcile", lane, fetch=True)
-        facts.rc = proc.returncode
-        if proc.returncode == 0:
-            self._parse_reconcile(facts, proc.stdout)
-        elif proc.returncode == 8:
-            # NO CONTROL ROOT: no inventory exists, and the holder and the
-            # binding are asked for on their own.
-            facts.state = "NONE"
-            self._holder_binding(facts)
-        else:
-            facts.why = (f"`lanes-edit.sh lane-reconcile {lane}` exited {proc.returncode}: "
-                         + _first_line(proc.stderr))
-            return facts
-        dproc = self.call("lane-dir", lane)
-        if dproc.returncode == 0:
-            facts.dir = dproc.stdout.strip()
-        elif dproc.returncode != 8:
-            facts.why = (f"`lanes-edit.sh lane-dir {lane}` exited {dproc.returncode}: "
-                         + _first_line(dproc.stderr))
-            return facts
-        tproc = self.call("lane-trees", lane)
-        facts.inventory_rc = tproc.returncode
-        if tproc.returncode == 0:
-            for line in tproc.stdout.splitlines():
-                if not line.strip():
-                    continue
-                fields = line.split(US)
-                if len(fields) < 2 or not fields[0]:
-                    # A ROW WITH NO ID IS AN UNREADABLE RECORD, never no record
-                    # (#170 G9): skipped, a tree it names outside the scanned
-                    # roots went unseen and the dry run could exit 0.
-                    facts.inventory.append({"id": "", "path": "", "schema": "",
-                                            "raw": line})
-                    continue
-                keys = ("id", "path", "branch", "head", "upstream", "dirty", "unpushed",
-                        "writer", "observed", "checkout", "generation", "operation",
-                        "schema")
-                rec = dict(zip(keys, fields + [""] * (len(keys) - len(fields))))
-                facts.inventory.append(rec)
-        elif tproc.returncode not in (8, 1) or (tproc.returncode == 1 and facts.root):
-            facts.why = (f"`lanes-edit.sh lane-trees {lane}` exited {tproc.returncode}: "
-                         + _first_line(tproc.stderr))
-        return facts
-
-    def _parse_reconcile(self, facts: LaneFacts, text: str) -> None:
-        for line in text.splitlines():
-            parts = line.split(US)
-            tag = parts[0]
-            if tag == "MANAGED":
-                facts.managed = "unknown" if parts[1:2] == ["unknown"] else "owned"
-                facts.managed_owner = parts[1] if len(parts) > 1 else ""
-            elif tag == "ROOT" and len(parts) > 1:
-                facts.root = parts[1]
-            elif tag == "STATE" and len(parts) > 1:
-                facts.state = parts[1]
-            elif tag == "HOLDER" and len(parts) > 1:
-                facts.holder = parts[1]
-                facts.holder_detail = parts[2] if len(parts) > 2 else ""
-                if facts.holder == "live":
-                    facts.holder_uuid = facts.holder_detail.split(" ")[0]
-            elif tag == "BINDING" and len(parts) > 1:
-                facts.binding = parts[1]
-                facts.binding_at = parts[2] if len(parts) > 2 else ""
-            elif tag == "VERDICT" and len(parts) > 1:
-                facts.verdict = parts[1]
-                facts.verdict_why = parts[2] if len(parts) > 2 else ""
-
-    def _holder_binding(self, facts: LaneFacts) -> None:
-        bproc = self.call("binding", facts.lane)
-        if bproc.returncode == 0:
-            cols = bproc.stdout.rstrip("\n").split("\t")
-            where = cols[6] if len(cols) > 6 else "elsewhere"
-            wstate = cols[7] if len(cols) > 7 else "unknown"
-            facts.binding_at = f"{cols[0]}/{cols[1]}" if len(cols) > 1 else ""
-            if where == "here":
-                facts.binding = "here"
-            elif wstate == "gone":
-                facts.binding = "gone"
-            else:
-                facts.binding = "elsewhere"
-        elif bproc.returncode == 8:
-            facts.binding = "free"
-        else:
-            facts.binding = "unknown"
-        hproc = self.call("live-holder", facts.lane)
-        if hproc.returncode == 0:
-            facts.holder = "live"
-            facts.holder_detail = hproc.stdout.strip().replace(US, " ")
-            facts.holder_uuid = facts.holder_detail.split(" ")[0]
-        elif hproc.returncode == 8:
-            facts.holder = "none"
-        else:
-            facts.holder = "unknown"
-            facts.holder_detail = _first_line(hproc.stderr)
-        mproc = self.call("managed-projection", facts.lane)
-        if mproc.returncode == 0:
-            facts.managed, facts.managed_owner = "owned", mproc.stdout.strip()
-        elif mproc.returncode not in (8, 2):
-            facts.managed = "unknown"
-
-    def workspace_root(self) -> str:
-        proc = self.call("workspace-root")
-        return proc.stdout.strip() if proc.returncode == 0 else ""
-
-    def fetch_register(self) -> str:
-        """`--yes` ACTS ON A REGISTER READ NOW, or not at all (#170 A1): '' once
-        the workspace repository's `origin/<branch>` is fetched, else why not.
-
-        `lanes-edit.sh`'s own `log_sync` answers 0 on every way it can fail to
-        fetch, and an inherited `LANES_NO_FETCH=1` skips the fetch outright, so a
-        lane rebound on another host after this one's last fetch read as bound
-        HERE and its trees were removed (Amendment 18(b)). The fetch is made
-        directly, with an explicit refspec, and every later helper call reads
-        the ref it left (`LANES_NO_FETCH=1`, set by `call` once `_fetched`)."""
-        root = self.workspace_root()
-        if not root:
-            return ("the workspace repository could not be found (`lanes-edit.sh "
-                    "workspace-root` answered nothing)")
-        branch = os.environ.get("LANES_BRANCH", "") or "main"
-        proc = git(root, "fetch", "--quiet", "--no-tags", "origin",
-                   f"+refs/heads/{branch}:refs/remotes/origin/{branch}", timeout=GIT_NET_TIMEOUT)
-        if proc.returncode != 0:
-            return (f"`git -C {root} fetch origin {branch}` failed: " + _first_line(proc.stderr))
-        self._fetched = True
-        return ""
-
-    def transcript_live(self, uuid: str, fresh: bool = False) -> str:
-        """live | none | unknown - one live process carrying that transcript,
-        asked once per session however many trees it recorded (`fresh` asks
-        again: at the moment of an act the cached answer is minutes old)."""
-        cache = self.__dict__.setdefault("_live", {})
-        if fresh or uuid not in cache:
-            proc = self.call("transcript-holders", uuid)
-            cache[uuid] = {0: "live", 8: "none"}.get(proc.returncode, "unknown")
-        return cache[uuid]
-
-    def note_line(self, lane: str, text: str, session: str = ""):
-        """The NOTED line, written AS THIS SESSION (#170 E7): `LANES_SESSION`
-        is passed, so the line names the session that swept and not
-        whatever the helper would find on its own."""
-        extra = {"LANES_LANE": lane}
-        if session:
-            extra["LANES_SESSION"] = session
-        return self.call("log", "NOTED", f"lane:{lane}", register_text(text),
-                         env_extra=extra, fetch=False)
-
-
-LANE_LINE_RE = re.compile(r"^(?:STARTED|PAUSED|RESUMED|ENDED|RETIRED) — lane [^,]+, "
-                          r"session [^,]+, [^,]+, (.*)$")
-
-
-def payload_field(payload: str, name: str) -> str:
-    """One `<name> <value>` sub-field of a register payload, as
-    `lanes-edit.sh`'s `payload_subfield` reads it: the `; `-separated part
-    that starts with the name, its value up to the first space - or, quoted,
-    up to the closing quote."""
-    want = name + " "
-    for part in payload.split("; "):
-        if not part.startswith(want):
-            continue
-        value = part[len(want):].strip()
-        if value.startswith('"'):
-            end = value.find('"', 1)
-            if end > 0:
-                return value[1:end]
-        return value.split(" ", 1)[0]
-    return ""
-
-
-def register_lane_dirs(helper) -> tuple:
-    """({lane: its recorded dir}, why-not) - every lane log's last lane-kind
-    line that carries a `dir`, read from the workspace repository's
-    `origin/<branch>` in one `git grep`. Where #97 keeps that lane's control
-    root (`<parent of dir>/.lane-state/<lane>`) follows from it."""
-    root = helper.workspace_root() if helper.path else ""
-    if not root:
-        return {}, "the workspace repository could not be found"
-    branch = os.environ.get("LANES_BRANCH", "") or "main"
-    proc = git(root, "grep", "-E", "-e", r"^(STARTED|PAUSED|RESUMED|ENDED|RETIRED) — lane ",
-               f"origin/{branch}", "--", "lanes/log")
-    if proc.returncode not in (0, 1):
-        return {}, (f"the register's lane logs on origin/{branch} could not be read: "
-                    + _first_line(proc.stderr))
-    out: dict = {}
-    for line in proc.stdout.splitlines():
-        _ref, _, rest = line.partition(":")
-        fname, _, text = rest.partition(":")
-        if not fname.endswith(".md"):
-            continue
-        m = LANE_LINE_RE.match(text)
-        found = payload_field(m.group(1), "dir") if m else ""
-        if found.startswith("/"):
-            out[os.path.basename(fname)[:-3]] = found
-    return out, ""
-
-
-def _first_line(text: str) -> str:
-    for line in (text or "").splitlines():
-        if line.strip():
-            return line.strip()
-    return "no answer"
-
-
-# ============================================================ liveness: who
-
-class ProcScan:
-    """Every process this account can see, and the paths it stands in or
-    holds open: `/proc` where there is one, `lsof` where there is not
-    (macOS), and every tmux pane's current path beside either.
-
-    A scan that could not be made is `available = False`, and a tree whose
-    liveness rests on it is never acted on - not "nobody is there".
-
-    A PROCESS OF THIS ACCOUNT WHOSE `/proc` ENTRIES CANNOT BE READ (#170 item
-    2) - not dumpable, as `ssh-agent` makes itself - is in `unknown`, never
-    read as absent. Which tree it stands in cannot be read either, so it is
-    placed by what can be: an absolute path in its command line, and its
-    parent's working directory (a process starts where its parent stands).
-    A tree either places it in is of unknown liveness and is never acted
-    on. One that places it nowhere (an `ssh-agent` daemon, re-parented to
-    init) holds no tree; one whose status cannot be read at all could be in
-    any. A process of ANOTHER account is never a writer here and is passed
-    over."""
-
-    def __init__(self):
-        self.entries: list = []      # (pid, comm, kind, path)
-        self.unknown: list = []      # (pid, comm, [paths it is placed by], anywhere)
-        self.available = False
-        self.why = ""
-        self._env_loaded = False
-        self._scan()
-
-    def _scan(self) -> None:
-        me = os.getpid()
-        uid = os.getuid()
-        if os.environ.get(SEAM_NO_PROCSCAN, "") == "1":
-            # THE SUITE'S SEAM (#170 C5): a host with no `/proc` and no `lsof`,
-            # on a host that has both.
-            self.why = "this host has no /proc and no lsof (the suite's seam)"
-            return
-        if os.path.isdir("/proc/self/fd"):
-            self.available = True
-            pending = []             # (pid, comm, ppid, hints, anywhere)
-            for name in os.listdir("/proc"):
-                if not name.isdigit() or int(name) == me:
-                    continue
-                base = "/proc/" + name
-                status = _proc_status(base)
-                if status == {}:
-                    continue          # it exited
-                if status is None:
-                    # NOT EVEN ITS STATUS: whose it is comes from the entry's own
-                    # owner, and where it stands cannot be placed at all.
-                    try:
-                        if os.stat(base).st_uid == uid:
-                            pending.append((int(name), "?", 0, [], True))
-                    except OSError:
-                        pass
-                    continue
-                if status.get("State", "").startswith("Z"):
-                    continue          # a zombie stands nowhere
-                ids = (status.get("Uid", "").split() + ["-1", "-1"])[:2]
-                ours = str(uid) in ids
-                comm = status.get("Name", "?")
-                hidden = False
-                try:
-                    self.entries.append((int(name), comm, "cwd", _proc_path(os.readlink(base + "/cwd"))))
-                except (FileNotFoundError, ProcessLookupError):
-                    continue
-                except PermissionError:
-                    hidden = True
-                except OSError:
-                    pass
-                try:
-                    fds = os.listdir(base + "/fd")
-                except PermissionError:
-                    hidden, fds = True, []
-                except OSError:
-                    fds = []
-                for fd in fds:
-                    try:
-                        target = os.readlink(base + "/fd/" + fd)
-                    except OSError:
-                        continue
-                    if target.startswith("/"):
-                        self.entries.append((int(name), comm, "fd", _proc_path(target)))
-                if hidden and ours:
-                    ppid = int(status.get("PPid", "0") or 0) if status.get("PPid", "").isdigit() else 0
-                    pending.append((int(name), comm, ppid, _cmdline_paths(base), False))
-            cwd_of = {pid: where for pid, _c, kind, where in self.entries if kind == "cwd"}
-            for pid, comm, ppid, hints, anywhere in pending:
-                if ppid in cwd_of:
-                    hints = hints + [cwd_of[ppid]]
-                self.unknown.append((pid, comm, hints, anywhere))
-        elif shutil.which("lsof"):
-            proc = run(["lsof", "-nP", "-w", "-F", "pcfn", "-u", str(os.getuid())], timeout=120)
-            if proc.stdout:
-                self.available = True
-                pid, comm, fd = 0, "", ""
-                for line in proc.stdout.splitlines():
-                    if not line:
-                        continue
-                    tag, value = line[0], line[1:]
-                    if tag == "p":
-                        pid, comm, fd = int(value or 0), "", ""
-                    elif tag == "c":
-                        comm = value
-                    elif tag == "f":
-                        fd = value
-                    elif tag == "n" and pid and pid != me and value.startswith("/"):
-                        self.entries.append((pid, comm, "cwd" if fd == "cwd" else "fd", value))
-            else:
-                self.why = "lsof answered nothing: " + _first_line(proc.stderr)
-        else:
-            self.why = "this host has no /proc and no lsof, so which process stands in a tree cannot be read"
-        if shutil.which("tmux"):
-            proc = run(["tmux", "list-panes", "-a", "-F",
-                        "#{pane_pid}\t#{session_name}:#{window_index}.#{pane_index}\t#{pane_current_path}"],
-                       timeout=30)
-            if proc.returncode == 0:
-                for line in proc.stdout.splitlines():
-                    cols = line.split("\t")
-                    if len(cols) == 3 and cols[2].startswith("/"):
-                        pid = int(cols[0]) if cols[0].isdigit() else 0
-                        # PHYSICAL, like every other path here: `/proc` and `lsof`
-                        # answer resolved paths, and a pane keeps the spelling
-                        # the shell was given (macOS's `/var` is `/private/var`).
-                        self.entries.append((pid, "tmux pane " + cols[1], "pane", real(cols[2])))
-
-    def load_environ(self) -> None:
-        """The path-shaped values of every readable process's environment
-        (HOME, TMPDIR, a suite's sandbox): Linux only, and only for the
-        sandbox sweep, which is where a process's ROOT may be nowhere else."""
-        if self._env_loaded:
-            return
-        self._env_loaded = True
-        if not os.path.isdir("/proc/self"):
-            return
-        me = os.getpid()
-        for name in os.listdir("/proc"):
-            if not name.isdigit() or int(name) == me:
-                continue
-            try:
-                with open(f"/proc/{name}/environ", "rb") as fh:
-                    raw = fh.read()
-            except OSError:
-                continue
-            for item in raw.split(b"\0"):
-                if b"=/" not in item:
-                    continue
-                value = item.split(b"=", 1)[1].decode("utf-8", "replace")
-                for piece in value.split(":"):
-                    if piece.startswith("/"):
-                        self.entries.append((int(name), "", "env", piece))
-
-    def holders(self, path: str) -> list:
-        root = real(path)
-        out = []
-        for pid, comm, kind, where in self.entries:
-            if where == root or where.startswith(root.rstrip("/") + "/"):
-                out.append((pid, comm, kind, where))
-        return out
-
-    def unknown_for(self, path: str) -> str:
-        """Why a process of this account that `/proc` would not show could be
-        in `path`, or '' (see the class: item 2)."""
-        root = real(path)
-        for pid, comm, hints, anywhere in self.unknown:
-            if anywhere:
-                return (f"process {pid} of this account could not be read at all (not even its "
-                        "status), so it could be in any tree")
-            for h in hints:
-                if h == root or h.startswith(root.rstrip("/") + "/"):
-                    return (f"process {pid} ({comm}) of this account could not be read (it is "
-                            f"not dumpable), and {h} - its command line or its parent's "
-                            "directory - places it here")
-        return ""
-
-
-def _proc_path(target: str) -> str:
-    return target[:-10] if target.endswith(" (deleted)") else target
-
-
-def _proc_status(base: str):
-    """`/proc/<pid>/status` as {field: value}; {} where the process is gone,
-    None where it is there and cannot be read."""
-    try:
-        with open(base + "/status", encoding="utf-8", errors="replace") as fh:
-            text = fh.read()
-    except (FileNotFoundError, ProcessLookupError):
-        return {}
-    except OSError:
-        return None
-    out = {}
-    for line in text.splitlines():
-        key, sep, value = line.partition(":")
-        if sep:
-            out[key.strip()] = value.strip()
-    return out
-
-
-def _cmdline_paths(base: str) -> list:
-    """The absolute paths in a process's command line (`--x=/p` included)."""
-    try:
-        with open(base + "/cmdline", "rb") as fh:
-            raw = fh.read()
-    except OSError:
-        return []
-    out = []
-    for arg in raw.split(b"\0"):
-        text = arg.decode("utf-8", "surrogateescape")
-        for piece in [text] + text.split("=", 1)[1:]:
-            if piece.startswith("/"):
-                out.append(real(piece))
-    return out
-
-
-def pid_alive(pid: int) -> bool:
-    if pid <= 0:
-        return False
-    try:
-        os.kill(pid, 0)
-    except ProcessLookupError:
-        return False
-    except PermissionError:
-        return True
-    except OSError:
-        return False
-    return True
-
-
-# ========================================================== merge evidence
-
-def slug_of(url: str) -> str:
-    u = (url or "").strip()
-    if u.endswith(".git"):
-        u = u[:-4]
-    for prefix in ("https://github.com/", "http://github.com/", "ssh://git@github.com/",
-                   "git@github.com:", "git://github.com/"):
-        if u.startswith(prefix):
-            rest = u[len(prefix):].strip("/")
-            return rest if SLUG_RE.match(rest) else ""
-    return ""
-
-
-class MergeEvidence:
-    """Whether a branch's work is MERGED, decided by the register's LANDED
-    line for its pull request or by `gh`'s state for it - and never by
-    `git branch --merged` alone, which a squash merge defeats."""
-
-    def __init__(self, helper: Helper):
-        self.helper = helper
-        self.gh_ok = (os.environ.get("LANES_NO_GITHUB", "") != "1"
-                      and bool(shutil.which("gh")))
-        self.gh_why = "" if self.gh_ok else ("LANES_NO_GITHUB=1" if os.environ.get(
-            "LANES_NO_GITHUB", "") == "1" else "no gh on PATH")
-        self._prs: dict = {}
-        self._landed = None
-        self.register_why = ""
-
-    def landed(self) -> set:
-        if self._landed is not None:
-            return self._landed
-        self._landed = set()
-        root = self.helper.workspace_root()
-        if not root:
-            self.register_why = "the workspace repository could not be found"
-            return self._landed
-        branch = os.environ.get("LANES_BRANCH", "main")
-        proc = git(root, "grep", "-h", "-E", "-e", "^LANDED", f"origin/{branch}", "--",
-                   "lanes/LANES.md", "lanes/log")
-        if proc.returncode not in (0, 1):
-            self.register_why = "the register could not be read: " + _first_line(proc.stderr)
-            return self._landed
-        for line in proc.stdout.splitlines():
-            m = LANDED_OBJ_RE.match(line)
-            if m:
-                self._landed.add((m.group(1).lower(), int(m.group(2))))
-                continue
-            m = LANDED_ROW_RE.match(line)
-            if m:
-                self._landed.add((m.group(2).lower(), int(m.group(1))))
-        return self._landed
-
-    def prs(self, slug: str, branch: str):
-        """Every pull request whose head is `branch`, ASKED BY THAT BRANCH
-        (#170 E5): one `--limit 1000` list of the whole repository missed the
-        PR of a branch older than its thousandth, which then read as none."""
-        if not slug or not self.gh_ok:
-            return None
-        if (slug, branch) in self._prs:
-            return self._prs[(slug, branch)]
-        env = dict(os.environ, GH_PROMPT_DISABLED="1", GH_NO_UPDATE_NOTIFIER="1")
-        proc = run(["gh", "pr", "list", "--repo", slug, "--state", "all", "--head", branch,
-                    "--limit", "200", "--json", "number,state,mergedAt,headRefName,headRefOid,"
-                    "baseRefName,isCrossRepository"],
-                   env=env, timeout=120)
-        rows = None
-        if proc.returncode == 0:
-            try:
-                rows = json.loads(proc.stdout or "[]")
-            except ValueError:
-                rows = None
-        if rows is None:
-            self.gh_why = f"gh pr list --repo {slug} --head {branch} failed: " + _first_line(proc.stderr)
-        self._prs[(slug, branch)] = rows
-        return rows
-
-    @staticmethod
-    def default_branches(repo: str) -> set:
-        """The branch a landing goes into: origin's HEAD where this clone
-        knows it, else `main` or `master`."""
-        head = git_out(repo, "symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD") or ""
-        if head.startswith("origin/") and len(head) > len("origin/"):
-            return {head[len("origin/"):]}
-        return set(PROTECTED_BRANCHES)
-
-    def judge(self, repo: str, slug: str, branch: str, tip: str) -> dict:
-        """{'state': merged|moved|elsewhere|open|closed|none|unknown, 'pr': n,
-        'source': ..., 'why': ...} for `branch` at `tip`."""
-        rows = self.prs(slug, branch)
-        if rows is None:
-            return {"state": "unknown", "pr": 0, "source": "",
-                    "why": "no pull request could be read for it (" + (self.gh_why or
-                                                                       "not a GitHub origin") + ")"}
-        mine = [r for r in rows if r.get("headRefName") == branch
-                and not r.get("isCrossRepository")]
-        if not mine:
-            return {"state": "none", "pr": 0, "source": "gh", "why": "no pull request names it"}
-        landed = self.landed()
-        # AN OPEN PULL REQUEST PROTECTS ITS BRANCH BEFORE ANYTHING ELSE: an
-        # older merged PR on the same branch says nothing about the work the
-        # open one still carries - unless the register has LANDED that very PR.
-        for row in sorted(mine, key=lambda r: -int(r.get("number", 0))):
-            if row.get("state") == "OPEN" and (slug.lower(), int(row.get("number", 0))) not in landed:
-                return {"state": "open", "pr": int(row["number"]), "source": "gh",
-                        "why": f"PR #{row['number']} is open"}
-        # ... AND WHILE GH STILL ANSWERS OPEN, THE REMOTE BRANCH STAYS (#170 A8):
-        # a LANDED line that names the wrong number (#21 for #20) must not
-        # delete the branch of a PR that is still open, which would close it.
-        gh_open = [int(r.get("number", 0)) for r in mine if r.get("state") == "OPEN"]
-        defaults = self.default_branches(repo)
-        elsewhere = None
-        for row in sorted(mine, key=lambda r: -int(r.get("number", 0))):
-            number = int(row.get("number", 0))
-            by_register = (slug.lower(), number) in landed
-            by_gh = row.get("state") == "MERGED"
-            if by_register or by_gh:
-                # A MERGE INTO A RELEASE OR FEATURE BRANCH IS NOT A LANDING: only
-                # a PR whose base is the default branch makes its branch merged.
-                base = row.get("baseRefName") or ""
-                if base not in defaults:
-                    elsewhere = elsewhere or {
-                        "state": "elsewhere", "pr": number, "source": "gh", "gh_open": gh_open,
-                        "why": f"PR #{number} was merged into {base or 'a base gh did not name'}, "
-                               f"not {'/'.join(sorted(defaults))}: not a landing"}
-                    continue
-                head = row.get("headRefOid") or ""
-                contained = bool(tip) and (tip == head or (bool(head) and git(
-                    repo, "merge-base", "--is-ancestor", tip, head).returncode == 0))
-                source = "register LANDED" if by_register else "gh MERGED"
-                if contained:
-                    return {"state": "merged", "pr": number, "source": source, "head": head,
-                            "gh_open": gh_open,
-                            "why": f"PR #{number} is merged ({source}) and holds this tip"
-                                   + (f"; gh still answers PR #{gh_open[0]} OPEN, so its remote "
-                                      "branch is kept" if gh_open else "")}
-                return {"state": "moved", "pr": number, "source": source, "head": head,
-                        "gh_open": gh_open,
-                        "why": f"PR #{number} is merged ({source}) but this branch has moved "
-                               f"past its head {short(head)}"
-                               + (f"; gh still answers PR #{gh_open[0]} OPEN" if gh_open else "")}
-        if elsewhere:
-            return elsewhere
-        return {"state": "closed", "pr": int(mine[0].get("number", 0)), "source": "gh",
-                "why": f"PR #{mine[0].get('number')} was closed unmerged"}
-
-
-# ============================================================== the estate
-
-def estate_repos(root: str, max_depth: int = 7) -> list:
-    """Every repository under `root`: a walk that descends into a repository
-    ONLY through nested checkouts and worktree containers, so the walk is the
-    estate's shape and not every source directory in it."""
-    found = []
-    prune = set(CACHE_NAMES) | set(VENV_NAMES) | {".git", ".lane-state", ".tox"}
-
-    def walk(d: str, depth: int, in_repo: bool) -> None:
-        try:
-            entries = list(os.scandir(d))
-        except OSError:
-            return
-        is_repo = any(e.name == ".git" for e in entries)
-        if is_repo:
-            found.append(d)
-        if depth >= max_depth:
-            return
-        for e in entries:
-            if e.name in prune:
-                continue
-            try:
-                if e.is_symlink() or not e.is_dir(follow_symlinks=False):
-                    continue
-            except OSError:
-                continue
-            if is_repo or in_repo:
-                if (e.name in ("worktrees", ".worktrees", ".claude")
-                        or os.path.lexists(os.path.join(e.path, ".git"))):
-                    walk(e.path, depth + 1, True)
-            else:
-                walk(e.path, depth + 1, False)
-
-    if root and os.path.isdir(root):
-        walk(root, 0, False)
-    return found
-
-
-#: What the estate walk never enters: caches, tool environments and installed
-#: packages. None of them holds a clone anything leans on, and node_modules
-#: alone is most of an estate's directories.
-WALK_SKIP = frozenset(CACHE_NAMES) | {".tox", ".nox", "site-packages"}
-
-
-class EstateWalk:
-    """Every repository and every `.lane-state` directory under one root,
-    and every directory the walk could not read."""
-
-    def __init__(self, root: str):
-        self.root = root
-        self.repos: list = []
-        self.lane_states: list = []
-        self.unread: list = []
-
-
-def walk_estate(root: str) -> EstateWalk:
-    """A walk of EVERY directory under `root` but the caches (#170 A11):
-    `estate_repos` descends into a repository only through worktree
-    containers, so a clone in a plain directory inside a repository (all of
-    `xFactory/xFactories/*` on Eagle) was never seen, and nor was anything
-    that leaned on a lane's clone from there. A directory that cannot be read
-    is named in `unread`, so a caller can tell a complete answer from a
-    partial one. Symlinks are never followed; a `.git` is never entered."""
-    walk = EstateWalk(root)
-    if not root or not os.path.isdir(root):
-        walk.unread.append(f"the estate root {root or '(none)'} is not a directory")
-        return walk
-    stack = [root]
-    while stack:
-        d = stack.pop()
-        try:
-            with os.scandir(d) as it:
-                entries = list(it)
-        except FileNotFoundError:
-            continue
-        except OSError as exc:
-            walk.unread.append(f"{d} ({exc.strerror or exc})")
-            continue
-        for e in entries:
-            if e.name == ".git":
-                walk.repos.append(d)
-                continue
-            try:
-                if e.is_symlink() or not e.is_dir(follow_symlinks=False):
-                    continue
-            except OSError:
-                continue
-            if e.name == ".lane-state":
-                walk.lane_states.append(e.path)
-            elif e.name not in WALK_SKIP:
-                stack.append(e.path)
-    walk.repos.sort()
-    walk.lane_states.sort()
-    return walk
-
-
-def git_common_dir(repo: str) -> str:
-    dotgit = os.path.join(repo, ".git")
-    if os.path.isdir(dotgit):
-        return dotgit
-    try:
-        with open(dotgit, encoding="utf-8", errors="surrogateescape") as fh:
-            first = fh.readline().strip()
-    except OSError:
-        return ""
-    if not first.startswith("gitdir:"):
-        return ""
-    gitdir = first[len("gitdir:"):].strip()
-    if not os.path.isabs(gitdir):
-        gitdir = os.path.normpath(os.path.join(repo, gitdir))
-    try:
-        with open(os.path.join(gitdir, "commondir"), encoding="utf-8", errors="surrogateescape") as fh:
-            common = fh.readline().strip()
-        if not os.path.isabs(common):
-            common = os.path.normpath(os.path.join(gitdir, common))
-        return common
-    except OSError:
-        return gitdir
-
-
-def local_remote_urls(common: str, unread: list | None = None) -> list:
-    """(name, url) for every remote in that config whose URL is a local path.
-    A config that exists and cannot be read is named in `unread`."""
-    out = []
-    try:
-        with open(os.path.join(common, "config"), encoding="utf-8", errors="replace") as fh:
-            text = fh.read()
-    except FileNotFoundError:
-        return out
-    except OSError as exc:
-        if unread is not None:
-            unread.append(f"{os.path.join(common, 'config')} ({exc.strerror or exc})")
-        return out
-    section = ""
-    for raw in text.splitlines():
-        line = raw.strip()
-        m = re.match(r'^\[remote\s+"([^"]+)"\]$', line)
-        if m:
-            section = m.group(1)
-            continue
-        if line.startswith("["):
-            section = ""
-            continue
-        if section and re.match(r"^url\s*=", line):
-            url = line.split("=", 1)[1].strip()
-            if url.startswith(("/", "./", "../", "~", "file://")):
-                out.append((section, url))
-    return out
-
-
-def dependents_map(repos: list, unread: list | None = None) -> dict:
-    """{physical path a repository LEANS ON: [(dependent, how)]} - read from
-    `objects/info/alternates` and from remotes whose URL is a local path. A
-    clone something leans on is LOAD-BEARING and is never removed by a sweep.
-    A repository whose git directory, alternates or config exists and cannot
-    be read is named in `unread`: its leaning is unknown, never none."""
-    deps: dict = {}
-    for repo in repos:
-        common = git_common_dir(repo)
-        if not common:
-            # A `.git` FILE THAT IS NO POINTER IS NO REPOSITORY: uv keeps an empty
-            # one in its cache to stop git looking upward. Only one that cannot
-            # be read leaves the leaning unknown.
-            try:
-                with open(os.path.join(repo, ".git"), "rb") as fh:
-                    fh.read(1)
-            except OSError as exc:
-                if unread is not None:
-                    unread.append(f"{repo}/.git ({exc.strerror or exc})")
-            continue
-        try:
-            with open(os.path.join(common, "objects", "info", "alternates"),
-                      encoding="utf-8", errors="surrogateescape") as fh:
-                for raw in fh.read().splitlines():
-                    alt = raw.strip()
-                    if not alt or alt.startswith("#"):
-                        continue
-                    if not os.path.isabs(alt):
-                        alt = os.path.normpath(os.path.join(common, "objects", alt))
-                    target = real(alt)
-                    deps.setdefault(target, []).append((repo, "alternates " + alt))
-        except FileNotFoundError:
-            pass
-        except OSError as exc:
-            if unread is not None:
-                unread.append(f"{common}/objects/info/alternates ({exc.strerror or exc})")
-        for name, url in local_remote_urls(common, unread):
-            path = url[len("file://"):] if url.startswith("file://") else url
-            path = os.path.expanduser(path)
-            if not os.path.isabs(path):
-                path = os.path.normpath(os.path.join(repo, path))
-            deps.setdefault(real(path), []).append((repo, f"remote {name} -> {url}"))
-    return deps
-
-
-def leaned_on(path: str, common: str, deps: dict) -> list:
-    """Who leans on the tree at `path` (and on its object store, for a clone)."""
-    out = []
-    targets = [real(path)]
-    if common and not under(common, path):
-        pass
-    elif common:
-        targets.append(real(common))
-    for target, who in deps.items():
-        for t in targets:
-            if target == t or target.startswith(t.rstrip("/") + "/"):
-                for dependent, how in who:
-                    if not under(dependent, path):
-                        out.append((dependent, how))
-    seen, uniq = set(), []
-    for item in out:
-        if item not in seen:
-            seen.add(item)
-            uniq.append(item)
-    return uniq
-
-
-# ================================================================ the trees
-
-class Tree:
-    def __init__(self, path: str, owner: str, foreign_kind: str = ""):
-        self.path = path
-        self.real = real(path)
-        self.owner = owner                 # inventory | foreign
-        self.foreign_kind = foreign_kind   # registered | lane-root | clone | other-lane
-        self.other_lane = ""
-        self.sidecar: dict = {}
-        self.checkout = ""                 # the repository's main worktree
-        self.registered = False
-        self.locked = False
-        self.exists = os.path.isdir(path)
-        self.is_git = False
-        self.kind = ""                     # worktree | clone | main
-        self.common = ""
-        self.branch = ""
-        self.detached = False
-        self.unborn = False
-        self.head = ""
-        self.status_lines: list = []
-        self.upstream = ""
-        self.origin_url = ""
-        self.remote_branch = ""            # the name it is (or would be) pushed as
-        self.remote_tip = ""
-        self.on_origin = None              # bool | None (unknown)
-        self.ahead = 0
-        self.behind = 0
-        self.lane_trailer = ""
-        self.remote_trailer = ""           # the Lane: trailer of origin/<branch>'s tip
-        self.merge: dict = {}
-        self.live = None                   # (True|None, why) | None = not live
-        self.lean: list = []
-        self.guard = ""
-        self.read_error = ""
-        self.disposition = ""
-        self.reason = ""
-        self.retire = False
-        self.result = ""
-        self.rescue = ""                   # origin ref a rescue went to
-        self.bundle = ""
-        self.ignored_archive = ""
-        self.register = ""
-        self.contested = False             # another lane's inventory names it too
-        self.reg: dict = {}                # its registration, where git has one
-        self.held_back = ""                # the bundle-only commit of its untracked files
-        self.lost_bundle = ""              # the bundle of commits only its reflog named
-        self.leg = None                    # T018: the assembly's leg that registers it
-
-    @property
-    def slice(self) -> str:
-        return safe_ref_part(os.path.basename(self.path.rstrip("/")))
-
-    @property
-    def gitpath(self) -> str:
-        """Where git is asked about it: the tree, or - its directory gone -
-        the checkout that registers it."""
-        return self.path if self.exists else (self.checkout or self.path)
-
-    def label(self) -> str:
-        if not self.exists:
-            return "(gone)"
-        if not self.is_git:
-            return "(not a checkout)"
-        if self.detached:
-            return f"(detached) {short(self.head)}"
-        if self.unborn:
-            return f"{self.branch} (unborn)"
-        return f"{self.branch} {short(self.head)}"
-
-
-def worktree_registrations(checkout: str):
-    """Every registration of `checkout`'s repository, its main worktree first
-    - or None where git could not list them, which is never "none" (#170 G5):
-    an empty answer let discovery report nothing to retire and exit 0."""
-    # `-z` WHERE GIT HAS IT (2.36+): a path with a newline in it is one field,
-    # not a registration of half its name and a line of noise (B3).
-    proc = git(checkout, "worktree", "list", "--porcelain", "-z")
-    if proc.returncode == 0:
-        fields = proc.stdout.split("\0")
-    else:
-        proc = git(checkout, "worktree", "list", "--porcelain")
-        if proc.returncode != 0:
-            return None
-        fields = proc.stdout.splitlines()
-    out, cur = [], {}
-    for line in fields + [""]:
-        if not line:
-            if cur:
-                out.append(cur)
-            cur = {}
-            continue
-        key, _, value = line.partition(" ")
-        if key == "worktree":
-            cur = {"path": value}
-        elif key in ("HEAD", "branch"):
-            cur[key.lower()] = value
-        elif key in ("detached", "bare", "locked", "prunable"):
-            cur[key] = value or True
-    return out
-
-
-def read_tree(tree: Tree) -> None:
-    """Everything git says about one tree, NOW. A read that failed is said,
-    never converted into a clean-looking value (R22, Amendment 7(d))."""
-    if not tree.exists:
-        return
-    proc = git(tree.path, "rev-parse", "--show-toplevel", "--git-common-dir")
-    if proc.returncode != 0:
-        return
-    lines = proc.stdout.strip().splitlines()
-    if not lines or real(lines[0]) != tree.real:
-        return            # a plain directory inside some other checkout
-    tree.is_git = True
-    common = lines[1] if len(lines) > 1 else ""
-    if common and not os.path.isabs(common):
-        common = os.path.normpath(os.path.join(tree.path, common))
-    tree.common = common
-    dotgit = os.path.join(tree.path, ".git")
-    tree.kind = "worktree" if os.path.isfile(dotgit) else "clone"
-    if tree.common:
-        main = os.path.dirname(tree.common.rstrip("/")) if os.path.basename(
-            tree.common.rstrip("/")) == ".git" else ""
-        tree.checkout = main or tree.checkout
-        if tree.kind == "clone" and main and real(main) == tree.real:
-            tree.kind = "clone"
-    branch = git(tree.path, "symbolic-ref", "-q", "--short", "HEAD")
-    if branch.returncode == 0:
-        tree.branch = branch.stdout.strip()
-    elif branch.returncode == 1:
-        tree.detached = True
-    else:
-        tree.read_error = "HEAD could not be read: " + _first_line(branch.stderr)
-        return
-    head = git(tree.path, "rev-parse", "--verify", "-q", "HEAD")
-    if head.returncode == 0:
-        tree.head = head.stdout.strip()
-    elif tree.branch:
-        tree.unborn = True
-    else:
-        tree.read_error = "HEAD names no commit"
-        return
-    status = git(tree.path, "status", "--porcelain=v1", "--ignore-submodules=none",
-                 "--untracked-files=normal")
-    if status.returncode != 0:
-        tree.read_error = "git status failed: " + _first_line(status.stderr)
-        return
-    tree.status_lines = [ln for ln in status.stdout.splitlines() if ln.strip()]
-    tree.origin_url = git_out(tree.path, "config", "--get", "remote.origin.url") or ""
-    if tree.branch:
-        up = git(tree.path, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}")
-        tree.upstream = up.stdout.strip() if up.returncode == 0 else ""
-        # THE BRANCH IS PUSHED UNDER ITS OWN NAME, NEVER ITS UPSTREAM'S. A branch
-        # made with `worktree add -b <b> origin/main` TRACKS origin/main, and a
-        # push "to its upstream" would put a lane's stray commits on main.
-        target = tree.branch
-        tree.remote_branch = target
-        tip = git_out(tree.path, "rev-parse", "-q", "--verify", f"refs/remotes/origin/{target}")
-        tree.remote_tip = tip or ""
-        if tree.remote_tip:
-            rmsg = git_out(tree.path, "log", "-1", "--format=%B", tree.remote_tip) or ""
-            rtrailers = re.findall(r"^Lane:\s*(\S+)\s*$", rmsg, re.MULTILINE)
-            tree.remote_trailer = rtrailers[-1] if rtrailers else ""
-    if tree.head:
-        if tree.remote_tip:
-            counts = git_out(tree.path, "rev-list", "--left-right", "--count",
-                             f"{tree.remote_tip}...{tree.head}")
-            parts = (counts or "").split()
-            if len(parts) != 2 or not all(x.isdigit() for x in parts):
-                # NEVER ZERO FOR UNKNOWN: "0 ahead" is what lets a tree go
-                # without a rescue.
-                tree.read_error = (f"its distance from origin/{tree.remote_branch} could not "
-                                   "be read (git rev-list failed)")
-                return
-            tree.behind, tree.ahead = int(parts[0]), int(parts[1])
-        contains = git(tree.path, "for-each-ref", "--count=1", "--contains", tree.head,
-                       "--format=%(refname)", "refs/remotes/origin/")
-        if contains.returncode == 0:
-            tree.on_origin = bool(contains.stdout.strip())
-        msg = git_out(tree.path, "log", "-1", "--format=%B", "HEAD") or ""
-        trailers = re.findall(r"^Lane:\s*(\S+)\s*$", msg, re.MULTILINE)
-        tree.lane_trailer = trailers[-1] if trailers else ""
-
-
-def snapshot_tree(path: str, tracked_only: bool = False) -> str:
-    """The tree object `git add -A` would commit in `path` NOW (`git add -u`
-    with `tracked_only`: no untracked file), written through a COPY of its
-    index so the tree's own index is never touched. Empty where it could
-    not be made."""
-    index = git_out(path, "rev-parse", "--git-path", "index")
-    if index is None:
-        return ""
-    if not os.path.isabs(index):
-        index = os.path.join(path, index)
-    fd, tmp = tempfile.mkstemp(prefix="lane-worktrees-index.")
-    os.close(fd)
-    try:
-        if os.path.exists(index):
-            shutil.copyfile(index, tmp)
-        else:
-            os.unlink(tmp)
-        env = git_env()
-        env["GIT_INDEX_FILE"] = tmp
-        if run(["git", "-C", path, "add", "-u" if tracked_only else "-A"],
-               env=env).returncode != 0:
-            return ""
-        proc = run(["git", "-C", path, "write-tree"], env=env)
-        return proc.stdout.strip() if proc.returncode == 0 else ""
-    finally:
-        try:
-            os.unlink(tmp)
-        except OSError:
-            pass
-
-
-def tree_guards(tree: Tree) -> str:
-    """What makes a tree unsafe to remove whatever its git state says: work a
-    commit in it cannot carry (a submodule's own dirt, commits, branches, tags
-    or stash; a clone nested inside it; an edit git status hides) and a
-    registration someone locked."""
-    if tree.locked:
-        return ("its worktree registration is LOCKED - someone pinned it on purpose; "
-                f"`git -C {tree.checkout or tree.path} worktree unlock {tree.path}` is theirs to run")
-    if tree.kind == "clone":
-        # A CLONE TAKES ITS LINKED WORKTREES' REPOSITORY WITH IT: a worktree
-        # elsewhere - perhaps a live writer's - keeps its files and loses its
-        # git directory.
-        wl = git(tree.path, "worktree", "list", "--porcelain")
-        if wl.returncode != 0:
-            return "its worktree registrations could not be read"
-        linked = [line[len("worktree "):] for line in wl.stdout.splitlines()
-                  if line.startswith("worktree ")][1:]
-        if linked:
-            return (f"it is a CLONE whose git directory {len(linked)} linked worktree(s) share "
-                    f"(e.g. {linked[0]}); its removal would take their repository with it - "
-                    "remove or move them first")
-        # A CLONE TAKES EVERY BRANCH, TAG AND STASH WITH IT, which a worktree
-        # never does: each one must be on origin first - a TAG included
-        # (#170 item 4), and a ref that cannot be checked keeps it.
-        why = unpublished_ref(tree.path, "--remotes=origin", "origin")
-        if why:
-            return (f"it is a CLONE and {why}; a clone's removal takes every branch and tag "
-                    "with it")
-        stash = git(tree.path, "stash", "list")
-        if stash.returncode != 0 or stash.stdout.strip():
-            return "it is a CLONE with a stash, which its removal would take with it"
-    # AN EDIT GIT STATUS DOES NOT SHOW (#170 A2): a file flagged
-    # skip-worktree or assume-unchanged that differs from the index reads as
-    # clean, and `git add -A` skips it, so no rescue would carry it.
-    hidden = hidden_edits(tree.path)
-    if hidden is None:
-        return ("its skip-worktree and assume-unchanged flags could not be read, so whether it "
-                "holds an edit git status hides is unknown")
-    if hidden:
-        return (f"{len(hidden)} file(s) flagged skip-worktree or assume-unchanged differ from "
-                f"the index (e.g. {hidden[0]}): git status hides them and no rescue would carry "
-                "them - `git update-index --no-skip-worktree --no-assume-unchanged <path>`, "
-                "then sweep again")
-    sub = git(tree.path, "submodule", "status", "--recursive")
-    if sub.returncode != 0:
-        return ("its submodules could not be listed (git submodule status failed), so whether "
-                "they hold work its removal would take is unknown")
-    subs = set()
-    for line in sub.stdout.splitlines():
-        parts = line[1:].split()
-        if len(parts) >= 2:
-            subs.add(os.path.normpath(os.path.join(tree.path, parts[1])))
-    for line in sub.stdout.splitlines():
-        if not line.strip() or line.startswith("-"):
-            continue
-        parts = line[1:].split()
-        if len(parts) < 2:
-            continue
-        spath = os.path.join(tree.path, parts[1])
-        dirt = git_out(spath, "status", "--porcelain")
-        if dirt is None or dirt:
-            return (f"submodule {parts[1]} holds uncommitted work (a commit in the tree "
-                    "cannot carry it) - commit it there first")
-        # ITS IGNORED WORK TOO: an `.env` in a submodule is archived by
-        # nobody - the tree's own archive lists the superproject's only.
-        extra = ignored_paths(spath)
-        if extra is None or extra:
-            return (f"submodule {parts[1]} holds ignored files no commit carries "
-                    + (f"({extra[0]}{' and more' if len(extra) > 1 else ''})" if extra
-                       else "(they could not be listed)")
-                    + " - move them out first")
-        # ITS BRANCHES, TAGS AND STASH, NOT ONLY ITS HEAD (#170 item 5): a
-        # worktree's submodules keep their repositories under its own git
-        # directory (`.git/worktrees/<id>/modules/`), and a clone's under
-        # `.git/modules/` - either way the removal takes them.
-        why = unpublished_ref(spath, "--remotes", "every remote of it")
-        if why:
-            return (f"submodule {parts[1]}: {why} - push it there first; the tree's removal "
-                    "takes the submodule's repository with it")
-        sstash = git(spath, "stash", "list")
-        if sstash.returncode != 0 or sstash.stdout.strip():
-            return (f"submodule {parts[1]} has a stash (or its stash could not be read), which "
-                    "the tree's removal would take with it")
-        # ITS HIDDEN EDITS TOO (#174, Copilot round 2): a file flagged
-        # skip-worktree or assume-unchanged in the submodule reads as clean
-        # there exactly as in the superproject (#170 A2).
-        shidden = hidden_edits(spath)
-        if shidden is None or shidden:
-            return (f"submodule {parts[1]}: " + (
-                "its skip-worktree and assume-unchanged flags could not be read" if shidden is None
-                else f"{len(shidden)} file(s) flagged skip-worktree or assume-unchanged differ from "
-                     f"its index (e.g. {shidden[0]})")
-                + " - git status hides them and no rescue would carry them")
-        # ITS REFLOGS TOO (#174, Copilot round 1): a commit made in the
-        # submodule and checked out away from is in no branch, tag or stash -
-        # only a reflog under its git directory names it - and the tree's
-        # removal takes that directory, which no loss plan of the tree reads.
-        why = unpublished_reflog(spath, "--remotes", "every remote of it")
-        if why:
-            return (f"submodule {parts[1]}: {why} - push it there first; the tree's removal "
-                    "takes the submodule's repository with it")
-    # EVERY SUBMODULE REPOSITORY ITS GIT DIRECTORY KEEPS (#174, Copilot round
-    # 2), a DEINITIALIZED one's included: `git submodule status` shows it `-`,
-    # its working tree is gone, and its repository - branches, stash, reflog -
-    # stays under `<gitdir>/modules/<name>`, which the removal takes.
-    gitdir = git_out(tree.path, "rev-parse", "--absolute-git-dir")
-    if not gitdir:
-        return "its git directory could not be read, so the submodule repositories it keeps are unknown"
-    why = module_repos_why(gitdir)
-    if why:
-        return why + "; the tree's removal takes that repository with it"
-    # A REPOSITORY NESTED ANYWHERE IN IT - a venv's `src/` (`pip install -e
-    # git+...`), node_modules and a cache directory included (#170 A3; #174,
-    # Copilot round 2) - and a directory that cannot be read keeps the tree.
-    nested, unread = nested_repos(tree.path, subs)
-    if nested:
-        return (f"a repository is nested inside it at {nested[0]} - its work is "
-                "no commit of this tree's; move it out first (a lane creates "
-                "worktrees, never clones)")
-    if unread:
-        return (f"{unread[0]} inside it could not be read, so whether a repository is nested "
-                "there is unknown")
-    return ""
-
-
-def nested_repos(top: str, exclude: set = frozenset(), bare: bool = False) -> tuple:
-    """([every directory under `top` that holds a `.git`], [what could not
-    be read]) - `top` itself, `exclude`d paths (a tree's submodules) and
-    anything inside a nested repository are not entered. NOTHING ELSE IS
-    PASSED OVER (#174, Copilot round 2): this walk is the proof that a removal
-    takes no repository, and a checkout under a directory named
-    `__pycache__` or `.pytest_cache` is still a checkout. With `bare`, a
-    BARE repository (`is_bare_repository`) is found as one too."""
-    found, unread = [], []
-    stack = [top]
-    while stack:
-        d = stack.pop()
-        try:
-            with os.scandir(d) as it:
-                entries = list(it)
-        except FileNotFoundError:
-            continue
-        except OSError as exc:
-            unread.append(f"{d} ({exc.strerror or exc})")
-            continue
-        if d != top and (any(e.name == ".git" for e in entries)
-                         or (bare and _bare_shaped(entries))):
-            found.append(d)
-            continue
-        for e in entries:
-            if e.name == ".git":
-                continue
-            try:
-                if e.is_symlink() or not e.is_dir(follow_symlinks=False):
-                    continue
-            except OSError:
-                continue
-            if os.path.normpath(e.path) not in exclude:
-                stack.append(e.path)
-    return sorted(found), unread
-
-
-def _bare_shaped(entries: list) -> bool:
-    """A directory listing that is a git directory's own: a `HEAD` beside an
-    `objects/` - as `module_repos` reads one."""
-    names = {e.name for e in entries}
-    return "HEAD" in names and "objects" in names
-
-
-def is_bare_repository(path: str) -> bool:
-    """`path` is a git directory with no working tree of its own - a BARE
-    repository (`git init --bare`, a mirror, `<x>.git`) - by its shape."""
-    try:
-        with os.scandir(path) as it:
-            return _bare_shaped(list(it))
-    except OSError:
-        return False
-
-
-def repository_within(path: str) -> str:
-    """Why `path` holds a repository - it is one, or one lies anywhere inside
-    it - or that what is inside could not be read; else ''. What a directory
-    removal without a commit-level check (a cache, a sandbox) must never
-    take. A BARE repository is one (#174 review R2): it has no `.git`, and a
-    sandbox holding the only copy of a commit in one was removed as empty."""
-    if os.path.lexists(os.path.join(path, ".git")) or is_bare_repository(path):
-        return f"it is a repository ({path})"
-    nested, unread = nested_repos(path, bare=True)
-    if nested:
-        return f"a repository lies inside it ({nested[0]})"
-    if unread:
-        return f"{unread[0]} inside it could not be read, so whether a repository lies there is unknown"
-    return ""
-
-
-def lost_tips(path: str, cands: list, keep: list):
-    """The candidate objects at least one commit of whose history no ref or
-    object in `keep` (rev-list arguments: `--remotes=origin`, `--branches`, a
-    SHA) reaches - what a removal would take that is in no such place. A
-    candidate object that is gone (a reflog entry gc took) is already lost
-    and is not reported; one that is no commit cannot be proved kept and is.
-
-    AN ANNOTATED TAG IS ITS OWN OBJECT (#174, Copilot round 1): a clone's tag
-    reached here as the tag object, was reported lost however it was kept,
-    and the self-check refused - and halted the sweep on - every clone with
-    one. A tag object is kept where `keep` names it by SHA (a verified
-    bundle's head, origin's own tag); its history is its peeled commit's,
-    asked like any other. None where git could not answer."""
-    want = []
-    for c in cands:
-        if c and c not in want and not re.match(r"^0+$", c):
-            want.append(c)
-    if not want:
-        return []
-    kept_objects = [k for k in keep if SHA_RE.match(k)]
-    keep_refs = [k for k in keep if not SHA_RE.match(k)]
-    query = want + [f"{k}^{{commit}}" for k in kept_objects]
-    check = run(["git", "-C", path, "cat-file", "--batch-check=%(objectname) %(objecttype)"],
-                env=git_env(path), input_text="\n".join(query) + "\n")
-    lines = check.stdout.splitlines()
-    if check.returncode != 0 or len(lines) != len(query):
-        return None
-    commits, odd, tags = [], [], []
-    for sha, line in zip(want, lines[:len(want)]):
-        parts = line.split()
-        otype = parts[-1] if parts else ""
-        if otype == "commit":
-            commits.append(sha)
-        elif otype == "tag":
-            tags.append(sha)
-        elif otype != "missing":
-            odd.append(sha)
-    # A SHA in `keep` counts through the commit it peels to: a tag object a
-    # bundle carries keeps that commit's history too.
-    keep_commits = [line.split()[0] for line in lines[len(want):]
-                    if len(line.split()) == 2 and line.split()[1] == "commit"]
-    if tags:
-        peel = run(["git", "-C", path, "cat-file", "--batch-check=%(objectname) %(objecttype)"],
-                   env=git_env(path), input_text="".join(f"{t}^{{commit}}\n" for t in tags))
-        peeled = peel.stdout.splitlines()
-        if peel.returncode != 0 or len(peeled) != len(tags):
-            return None
-        for tag, line in zip(tags, peeled):
-            parts = line.split()
-            if tag not in kept_objects:
-                odd.append(tag)
-            if len(parts) == 2 and parts[1] == "commit" and parts[0] not in commits:
-                commits.append(parts[0])
-    if not commits:
-        return odd
-    proc = run(["git", "-C", path, "rev-list", *commits, "--not", *keep_refs, *keep_commits],
-               env=git_env(path), timeout=GIT_TIMEOUT)
-    if proc.returncode != 0:
-        return None
-    out = set(proc.stdout.split())
-    return [c for c in commits if c in out] + odd
-
-
-def origin_tag_objects(path: str, tags: list) -> list:
-    """The annotated tag objects among `tags` origin holds AS THEY ARE (its
-    `ls-remote --tags` names that very object) - kept by origin, so not the
-    only copy. Where origin cannot be asked, none: such a tag is bundled."""
-    if not tags:
-        return []
-    proc = git(path, "ls-remote", "--tags", "origin", timeout=GIT_NET_TIMEOUT)
-    if proc.returncode != 0:
-        return []
-    have = {line.split("\t", 1)[0] for line in proc.stdout.splitlines() if "\t" in line}
-    return [t for t in tags if t in have]
-
-
-def unpublished_ref(path: str, remotes: str, where: str) -> str:
-    """'' when every branch, tag and HEAD of the repository at `path` is in a
-    remote-tracking ref `remotes` names (`--remotes=origin`, `--remotes`);
-    else which one is not, or that it could not be checked - both keep."""
-    proc = git(path, "for-each-ref", "--format=%(refname)%09%(objecttype)%09%(objectname)"
-               "%09%(*objecttype)%09%(*objectname)", "refs/heads/", "refs/tags/")
-    if proc.returncode != 0:
-        return "its branches and tags could not be read"
-    tips: dict = {}
-    for line in proc.stdout.splitlines():
-        cols = line.split("\t")
-        if len(cols) < 5:
-            continue
-        ref, otype, sha, ptype, psha = cols[:5]
-        commit = sha if otype == "commit" else (psha if ptype == "commit" else "")
-        if not commit:
-            return (f"its tag {ref[len('refs/tags/'):]} names no commit, so whether {where} "
-                    "holds it cannot be checked")
-        tips.setdefault(commit, ref)
-    head = git_out(path, "rev-parse", "-q", "--verify", "HEAD^{commit}")
-    if head:
-        tips.setdefault(head, "HEAD")
-    lost = lost_tips(path, list(tips), [remotes])
-    if lost is None:
-        return f"whether {where} holds its branches and tags could not be read"
-    if not lost:
-        return ""
-    ref = tips.get(lost[0], lost[0])
-    for prefix, kind in (("refs/heads/", "branch "), ("refs/tags/", "tag ")):
-        if ref.startswith(prefix):
-            return f"its {kind}{ref[len(prefix):]} holds commits {where} lacks"
-    return f"its {ref} holds commits {where} lacks"
-
-
-def unpublished_reflog(path: str, remotes: str, where: str) -> str:
-    """'' when every commit a reflog of the repository at `path` names is in
-    a remote-tracking ref `remotes` names; else how many are not, or that
-    the reflogs could not be read - both keep."""
-    gitdir = git_out(path, "rev-parse", "--absolute-git-dir")
-    if not gitdir:
-        return f"its git directory could not be read, so whether {where} holds what its reflogs name is unknown"
-    files, why = reflog_files(gitdir)
-    if files is None:
-        return why
-    shas, why = reflog_shas(files)
-    if shas is None:
-        return why
-    lost = lost_tips(path, shas, [remotes])
-    if lost is None:
-        return f"whether {where} holds the commits its reflogs name could not be read"
-    if lost:
-        return (f"its reflog names {len(lost)} commit(s) {where} lacks (e.g. {short(lost[0])}), "
-                "in no branch, tag or stash")
-    return ""
-
-
-def hidden_edits(path: str):
-    """Files flagged skip-worktree or assume-unchanged whose content in the
-    tree differs from the index - edits `git status` does not show and `git
-    add -A` does not take (#170 A2). A flagged file that is not there (a
-    sparse checkout's) is no edit. None where git could not answer."""
-    proc = git(path, "ls-files", "-v", "-s", "-z")
-    if proc.returncode != 0:
-        return None
-    files, out = [], []
-    for rec in proc.stdout.split("\0"):
-        meta, sep, rel = rec.partition("\t")
-        cols = meta.split()
-        if not sep or len(cols) < 4:
-            continue
-        tag, mode, sha = cols[0], cols[1], cols[2]
-        if not (tag == "S" or tag.islower()):
-            continue
-        full = os.path.join(path, rel)
-        if not os.path.lexists(full) or mode == "160000":
-            continue
-        if mode == "120000":
-            blob = git(path, "cat-file", "blob", sha)
-            try:
-                same = blob.returncode == 0 and os.readlink(full) == blob.stdout
-            except OSError:
-                same = False
-            if not same:
-                out.append(rel)
-            continue
-        files.append((rel, sha))
-    if files:
-        proc = run(["git", "-C", path, "hash-object", "--stdin-paths"], env=git_env(),
-                   input_text="".join(rel + "\n" for rel, _ in files))
-        got = proc.stdout.split()
-        if proc.returncode != 0 or len(got) != len(files):
-            return None
-        out += [rel for (rel, sha), now in zip(files, got) if now != sha]
-    return sorted(out)
-
-
-def ignored_work(tree: Tree):
-    """Ignored paths that are NOT caches: a commit cannot carry them, so they
-    are archived beside the bundle before the tree goes. None where git could
-    not list them - which is never read as "there are none"."""
-    return ignored_paths(tree.path)
-
-
-def ignored_paths(path: str):
-    """`ignored_work` for any checkout path - a submodule's included."""
-    proc = git(path, "ls-files", "--others", "--ignored", "--exclude-standard",
-               "--directory", "-z")
-    if proc.returncode != 0:
-        return None
-    out = []
-    for rel in proc.stdout.split("\0"):
-        rel = rel.rstrip("/")
-        if not rel:
-            continue
-        # THE ENTRY'S OWN NAME DECIDES, never an ancestor's (#170 A6): with
-        # `--directory` an ignored cache or build directory is listed as
-        # itself, so a path BENEATH a directory named `build` is an ignored
-        # file in a tracked directory - `docker/build/prod.env` - and was
-        # dropped unarchived while `top.env` beside it was archived.
-        name = os.path.basename(rel)
-        if name in CACHE_NAMES:
-            continue
-        full = os.path.join(path, rel)
-        if os.path.isdir(full) and (name in VENV_NAMES
-                                    or os.path.exists(os.path.join(full, "pyvenv.cfg"))):
-            continue
-        if name in BUILD_NAMES or name.endswith(".egg-info"):
-            continue
-        if rel.endswith((".pyc", ".pyo")):
-            continue
-        out.append(rel)
-    return out
-
-
-# ================================================== an assembly's legs (T018)
-#
-# opensoft/openRepoTools#186, plan task T018 - A TRIAD'S CHECKOUTS. A checkout
-# is an ASSEMBLY when its own `project.yaml` declares a leg other than itself:
-# the standard's own rule, read by `lanes-edit.sh project-legs` - the one
-# reader every lane tool asks, whose grammar is `lane-start`'s rung 5 line for
-# line - and never here a second time. Its legs (`spec/`, `code/`) are
-# submodules: their `.git` is a FILE, `git -C <assembly> worktree list` names
-# none of their worktrees, and a feature's paired trees under
-# `<assembly>/worktrees/<feature>/{spec,code}` are worktrees of the LEGS'
-# repositories, so before this every reader below was blind to them.
-#
-# A CHECKOUT WITH NO `project.yaml` IS ASKED NOTHING: no helper call, no read,
-# no row - which is every single-repository checkout, whose sweep, report and
-# `add` are therefore byte for byte what they were.
-
-
-class Leg:
-    """One checkout an assembly mounts: a leg its `project.yaml` declares, or
-    a dependency NESTED in one - an initialized submodule of the leg's own
-    (`code/upstream/openRepoShape`). It is the ASSEMBLY'S, shared by every
-    lane the assembly homes, as the assembly's own checkout is, so a sweep
-    NEVER acts on the CHECKOUT: it is read - for the worktrees git registers
-    in it and for its own dirty and unpushed state - and counted for this lane
-    only where its HEAD's own `Lane:` trailer is this lane's. Its BRANCHES are
-    another matter: under `--branches` they are rows like the checkout's own
-    (`_branch_checkouts`), and `--yes` deletes a merged lane branch there
-    exactly as it does in the checkout, bundling first."""
-
-    def __init__(self, path: str, decl: str, repository: str, assembly: str,
-                 nested_in: str = ""):
-        self.path = path
-        self.real = real(path)
-        self.decl = decl                   # its path as declared, under the assembly
-        self.repository = repository       # as the manifest names it ('' when nested)
-        self.assembly = assembly
-        self.nested_in = nested_in         # the leg it is a dependency of
-        self.exists = os.path.isdir(path)
-        self.checkout = False              # a checkout of its own is there
-        self.read_error = ""
-        self.branch = ""
-        self.detached = False
-        self.head = ""
-        self.dirty = 0
-        self.upstream = ""
-        self.ahead = None
-        self.on_origin = None
-        self.origin_url = ""
-        self.claimed = False               # its HEAD's own Lane: trailer is this lane's
-        self.disposition = ""
-        self.reason = ""
-        self.retire = False
-
-    def what(self) -> str:
-        if self.nested_in:
-            return f"a dependency nested in the {self.nested_in} leg ({self.decl})"
-        return (f"the {self.decl} leg of {os.path.join(self.assembly, 'project.yaml')}"
-                + (f" ({self.repository})" if self.repository else ""))
-
-    def label(self) -> str:
-        if not self.exists or not self.checkout:
-            return "(not checked out)" if not self.read_error else "(unreadable)"
-        if self.detached:
-            return f"(detached) {short(self.head)}"
-        if not self.head:
-            return f"{self.branch} (unborn)"
-        return f"{self.branch} {short(self.head)}"
-
-
-def project_legs(helper, checkout: str) -> tuple:
-    """([(repository, path as declared, where it is checked out)], why-not):
-    the legs `<checkout>/project.yaml` declares, through `lanes-edit.sh
-    project-legs`. A checkout with no `project.yaml` is asked nothing; a
-    manifest that could not be read is never "no legs" (Amendment 7(d))."""
-    if not checkout or not os.path.lexists(os.path.join(checkout, "project.yaml")):
-        return [], ""
-    proc = helper.call("project-legs", checkout)
-    if proc.returncode == 8:
-        return [], ""
-    if proc.returncode != 0:
-        return [], (f"`lanes-edit.sh project-legs {checkout}` exited {proc.returncode}: "
-                    + _first_line(proc.stderr))
-    rows = []
-    for line in proc.stdout.splitlines():
-        cols = line.split("\t")
-        if len(cols) >= 3 and cols[1] and cols[2]:
-            rows.append((cols[0], cols[1], cols[2]))
-    return rows, ""
-
-
-def probe_leg(leg: Leg) -> None:
-    """Is a checkout of its own there? An uninitialized leg is an empty
-    directory of the assembly's, and git answers the ASSEMBLY there - which is
-    no checkout of the leg's. A `.git` of its own that git cannot read is a
-    read that failed, never an absent leg.
-
-    SO IS A LEG DIRECTORY THIS ACCOUNT CANNOT SEARCH (#255, openRepoShape-2's
-    SHOULD on #246): whether a `.git` stands in it cannot be tested, and
-    `os.path.lexists` answers False for a path it cannot reach exactly as for
-    one that is not there - so the leg read `absent`, counted for nobody, and
-    `lane-end` could end a lane over an unpushed commit in it. The `.git` is
-    asked of `lstat` itself: only "no such file" (or "not a directory") is a
-    leg with no `.git`; any other failure is a read that failed, the same
-    `read_error` - `unreadable`, counted - in the words `lane-handoff` and
-    `lane-reconcile` use for it. A leg directory that is not there at all is
-    still `absent` (`leg.exists`)."""
-    if not leg.exists:
-        return
-    proc = git(leg.path, "rev-parse", "--show-toplevel")
-    if proc.returncode == 0 and real(proc.stdout.strip()) == leg.real:
-        leg.checkout = True
-        return
-    said = (_first_line(proc.stderr) if proc.returncode != 0 else
-            f"git answers {proc.stdout.strip()} there")
-    try:
-        os.lstat(os.path.join(leg.path, ".git"))
-    except (FileNotFoundError, NotADirectoryError):
-        return
-    except OSError:
-        leg.read_error = ("its directory cannot be searched, so whether it has a .git of its "
-                          "own could not be tested, and git could not read it: " + said)
-        return
-    leg.read_error = "it has a .git of its own and git could not read it: " + said
-
-
-def probe_uninitialized(leg: Leg) -> None:
-    """A dependency `git submodule status` lists as `-`: `read_error` is set
-    where its directory, or one above it, cannot be searched, and `checkout`
-    where it holds a checkout of its own that git can read (#255).
-    `probe_leg` alone cannot see a dependency beneath a directory this
-    account cannot search: `Leg.exists` is `os.path.isdir`, which answers
-    False for a path it cannot reach exactly as for one that is not there, so
-    it would read `absent`. The path is asked of `stat` itself: only "no such
-    file" (or "not a directory") is a dependency that is not there, which sets
-    nothing; any other failure is a read that failed. A directory that is
-    there is `probe_leg`'s: with no search it is unreadable through its
-    `lstat` of the `.git`; holding a checkout git can read - a clone made by
-    hand, which git does not count as initialized - it is a checkout; empty
-    and searchable, it is a dependency never initialized and sets nothing."""
-    try:
-        os.stat(leg.path)
-    except (FileNotFoundError, NotADirectoryError):
-        return
-    except OSError as err:
-        leg.read_error = ("a directory above it cannot be searched, so whether it is there "
-                          f"could not be tested: {err.strerror or err}")
-        return
-    probe_leg(leg)
-
-
-def assembly_checkouts(helper, assembly: str) -> tuple:
-    """([Leg], declared, why-not) - every leg `<assembly>/project.yaml`
-    declares, and every dependency nested in one (the submodules
-    `git submodule status --recursive` names in each leg: the initialized
-    ones, and a `-` line only as below), in that order; `declared` is whether
-    the manifest declares any leg at all, which is what makes
-    `<assembly>/worktrees` the paired root.
-
-    A DEPENDENCY GIT LISTS AS NOT INITIALIZED (A `-` LINE) IS NOT ALWAYS
-    NOTHING TO READ (#255, lane 3's review). Git lists a dependency whose
-    directory it cannot search - mode 000, or read and no search, or one
-    beneath a directory it cannot search - as `-` too, and exits 0, exactly as
-    for one never initialized. Skipped unread, it got no row, the sweep
-    exited 0, and `lane-end` ended the lane over that dependency's unpushed
-    commit. So a `-` line is probed (`probe_uninitialized`) and gets a row
-    where the probe is a read that failed, or where its directory holds a
-    checkout git can read - a clone made by hand, which git does not count as
-    initialized, and which holds the lane's work all the same: it is read like
-    an initialized one. A directory that is not there, or an empty one that
-    can be searched, is a dependency never initialized and still adds none.
-    The path on a `-` line is the whole of the rest of the line: git prints a
-    describe suffix only on a ` ` or `+` line (`print_status` in
-    builtin/submodule--helper.c), so none is trimmed from it."""
-    rows, why = project_legs(helper, assembly)
-    if why:
-        return [], False, why
-    out = []
-    for repository, decl, path in rows:
-        leg = Leg(path, decl, repository, assembly)
-        probe_leg(leg)
-        out.append(leg)
-        if not leg.checkout:
-            continue
-        sub = git(path, "submodule", "status", "--recursive")
-        if sub.returncode != 0:
-            return out, True, (f"the dependencies nested in the {decl} leg ({path}) could not be "
-                               "listed (git submodule status failed): " + _first_line(sub.stderr))
-        for line in sub.stdout.splitlines():
-            if not line.strip():
-                continue
-            parts = line[1:].split(" ", 1)
-            if len(parts) < 2:
-                continue
-            rel = parts[1]
-            if not line.startswith("-") and rel.endswith(")") and " (" in rel:
-                rel = rel[:rel.rindex(" (")]
-            nested = Leg(os.path.normpath(os.path.join(path, rel)), f"{decl}/{rel}", "",
-                         assembly, nested_in=decl)
-            if line.startswith("-"):
-                # Declared and not initialized: nothing to read - unless git
-                # could not search its directory, which it lists the same way,
-                # or a checkout of its own stands there (a hand clone).
-                probe_uninitialized(nested)
-                if not (nested.read_error or nested.checkout):
-                    continue
-            else:
-                probe_leg(nested)
-            out.append(nested)
-    return out, bool(rows), ""
-
-
-def read_leg(leg: Leg, lane: str) -> None:
-    """What git says about one leg checkout NOW. A read that failed is said,
-    never converted into a clean-looking value (R22, Amendment 7(d))."""
-    if not leg.checkout or leg.read_error:
-        return
-    branch = git(leg.path, "symbolic-ref", "-q", "--short", "HEAD")
-    if branch.returncode == 0:
-        leg.branch = branch.stdout.strip()
-    elif branch.returncode == 1:
-        leg.detached = True
-    else:
-        leg.read_error = "HEAD could not be read: " + _first_line(branch.stderr)
-        return
-    head = git(leg.path, "rev-parse", "--verify", "-q", "HEAD")
-    if head.returncode == 0:
-        leg.head = head.stdout.strip()
-    elif not leg.branch:
-        leg.read_error = "HEAD names no commit"
-        return
-    status = git(leg.path, "status", "--porcelain=v1", "--ignore-submodules=none",
-                 "--untracked-files=normal")
-    if status.returncode != 0:
-        leg.read_error = "git status failed: " + _first_line(status.stderr)
-        return
-    leg.dirty = sum(1 for ln in status.stdout.splitlines() if ln.strip())
-    leg.origin_url = git_out(leg.path, "config", "--get", "remote.origin.url") or ""
-    if leg.head:
-        contains = git(leg.path, "for-each-ref", "--count=1", "--contains", leg.head,
-                       "--format=%(refname)", "refs/remotes/origin/")
-        if contains.returncode != 0:
-            leg.read_error = ("whether origin holds its HEAD could not be read: "
-                              + _first_line(contains.stderr))
-            return
-        leg.on_origin = bool(contains.stdout.strip())
-    if leg.branch:
-        up = git(leg.path, "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}")
-        leg.upstream = up.stdout.strip() if up.returncode == 0 else ""
-        if leg.upstream and leg.head:
-            n = git_out(leg.path, "rev-list", "--count", "@{u}..HEAD")
-            leg.ahead = int(n) if n and n.isdigit() else None
-    leg.claimed = bool(lane) and bool(leg.head) and lane.lower() in own_trailers(leg.path) \
-        and head_lane_trailer(leg.path).lower() == lane.lower()
-
-
-def decide_leg(leg: Leg) -> None:
-    """A leg's row. It is COUNTED - the sweep's exit 3, `lane-end`'s gate -
-    where its HEAD's own `Lane:` trailer is this lane's and it holds work
-    origin lacks or edits no commit carries, or where it could not be read;
-    otherwise it is listed and counted for nobody, as the assembly's own
-    checkout is. No `--yes` acts on one."""
-    what = leg.what()
-    if leg.read_error:
-        leg.disposition, leg.retire = "unreadable", True
-        leg.reason = (f"{what}: git could not be read through it ({leg.read_error}); a read that "
-                      "failed is never a clean leg (Amendment 7(d)) - read it by hand: "
-                      f"git -C {leg.path} status")
-        return
-    if not leg.exists or not leg.checkout:
-        leg.disposition, leg.retire = "absent", False
-        leg.reason = f"{what}: not checked out here, so it holds nothing to read"
-        return
-    parts = []
-    if leg.dirty:
-        parts.append(f"{leg.dirty} dirty or untracked path(s)")
-    if leg.head and leg.on_origin is False:
-        parts.append("its HEAD carries commit(s) no origin ref holds"
-                     + (f" ({leg.ahead} ahead of {leg.upstream})" if leg.upstream and leg.ahead
-                        else "")
-                     + ("" if leg.origin_url else "; it has no origin remote"))
-    if not parts:
-        leg.disposition, leg.retire = "clean", False
-        leg.reason = (f"{what}: clean, and its HEAD is on origin" if leg.head else
-                      f"{what}: clean, on an unborn branch with nothing committed")
-        return
-    leg.disposition = ("dirty+unpushed" if len(parts) == 2 else
-                       "dirty" if leg.dirty else "unpushed")
-    leg.retire = leg.claimed
-    leg.reason = what + ": " + "; ".join(parts) + (
-        "; its HEAD's own Lane: trailer is this lane's, so it is COUNTED - commit and push from "
-        "inside it: a sweep never acts on a leg checkout, which is the assembly's"
-        if leg.claimed else
-        "; listed and NOT counted - a leg checkout is the assembly's, shared by every lane it "
-        "homes, and its HEAD's own Lane: trailer is not this lane's")
-
-
-# ============================================================ the sweep
-
-class Options:
-    def __init__(self, ns):
-        self.yes = bool(ns.yes)
-        self.porcelain = bool(ns.porcelain)
-        self.bundle = bool(ns.bundle)
-        self.branches = bool(ns.branches)
-        self.links = bool(ns.links)
-        self.scratch = bool(ns.include_scratch)
-        self.caches = bool(ns.include_caches)
-        self.sandboxes = bool(ns.include_sandboxes)
-        self.foreign = bool(ns.include_foreign)
-        self.word = ns.word or ""
-        self.live = list(ns.live or [])
-        self.fetch = bool(ns.fetch) or self.yes
-        self.estate = ns.estate or ""
-        self.push_untracked = bool(ns.push_untracked)
-
-
-class Item:
-    """One row of the table that is not a tree: a branch, a scratch
-    directory, a cache, a sandbox, a broken link."""
-
-    def __init__(self, kind: str, path: str, disposition: str, reason: str,
-                 retire: bool = False, detail: str = ""):
-        self.kind = kind
-        self.path = path
-        self.disposition = disposition
-        self.reason = reason
-        self.retire = retire
-        self.detail = detail
-        self.size = 0
-        self.result = ""
-        self.extra: dict = {}
-
-
-class Sweep:
-    def __init__(self, lane: str, opts: Options):
-        self.lane = lane
-        self.opts = opts
-        self.conf = load_conf()
-        self.helper = Helper()
-        self.facts = LaneFacts(lane)
-        self.trees: list = []
-        self.items: list = []
-        self.refusal = ""
-        self.notes: list = []
-        self.caller = (os.environ.get("LANES_SESSION") or
-                       os.environ.get("CLAUDE_CODE_SESSION_ID") or "")
-        self.procs = None
-        self.evidence = MergeEvidence(self.helper)
-        self.stamp = utc_stamp()
-        self.archive = ""
-        self.failed = 0
-        self.deps: dict = {}
-        self.deps_partial: list = []
-        self.walk_lane_states: list = []
-        self.shape_repos: list = []
-        self.estate_root = ""
-        self.fetched: dict = {}
-        self.rescues: list = []
-        self.dispositions: list = []
-        self.acting = False
-        self.verified: dict = {}           # common dir -> SHAs a push of this run put on origin
-        self.bundled: dict = {}            # common dir -> heads of this run's verified bundles
-        self.halt = ""                     # why no further act is taken
-        self.refused_check = ""            # the self-check's refusal: exit 2
-        self.usage = ""                    # a usage error found once the trees are known: 64
-        self.legs: list = []               # T018: the assembly's leg checkouts, where it is one
-        self.paired_root = ""              # T018: <assembly>/worktrees, where it is one
-
-    # ------------------------------------------------------------- reading
-    def gather(self) -> None:
-        if not self.helper.path:
-            self.refusal = ("no lanes-edit.sh beside this command or on PATH: which trees "
-                            "are this lane's is #97's inventory, and nothing else answers it")
-            return
-        # UNDER --yes THE REGISTER IS FETCHED FIRST, AND A FETCH THAT FAILED IS A
-        # REFUSAL (#170 A1): a binding read from a ref as it stood here is not
-        # where the lane is bound now, and from outside its binding a lane is
-        # UNKNOWN, never dead (Amendment 18(b)). An inherited LANES_NO_FETCH=1
-        # does not skip it.
-        if self.opts.yes:
-            why = self.helper.fetch_register()
-            if why:
-                self.refusal = ("--yes acts only on the register as origin holds it NOW, and it "
-                                f"could not be fetched: {why}. Where the lane is bound is then "
-                                "unknown, never 'here' (Amendment 18(b)); nothing was changed")
-                return
-        # THE CANONICAL SPELLING BEFORE ANY PATH IS DERIVED FROM IT: scratch,
-        # caches, rescue names and the Lane: trailer comparison all use it.
-        canon, why = self.helper.canon_lane(self.lane)
-        if why:
-            self.refusal = f"lane {self.lane}'s name could not be resolved: {why}"
-            return
-        if canon != self.lane:
-            self.notes.append(f"lane {self.lane} -> {canon} (Amendment 15: the register row's "
-                              "spelling is canonical)")
-            self.lane = canon
-            self.facts = LaneFacts(canon)
-        self.facts = self.helper.lane_facts(self.lane)
-        f = self.facts
-        if f.why:
-            self.refusal = f"a read failed, which is never an answer (Amendment 7(d)): {f.why}"
-            return
-        if f.managed == "owned":
-            self.refusal = (f"lane {self.lane} is owned by the managed ledger (owner "
-                            f"{f.managed_owner or 'unnamed'}): its worktrees are that ledger's "
-                            "(ruling 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\")")
-            return
-        if f.managed == "unknown":
-            self.refusal = (f"whether the managed ledger owns lane {self.lane} is UNKNOWN; "
-                            f"read it: lanes-edit.sh managed-projection {self.lane}")
-            return
-        self.estate_root = (self.opts.estate or os.environ.get("PROJECTS_ROOT", "")
-                            or (os.path.dirname(f.dir.rstrip("/")) if f.dir else ""))
-        # THE GATE DECIDES BEFORE ANYTHING IS WRITTEN - the fetch included. A
-        # refused lane is still READ, so the table says what a sweep from the
-        # right place would do; it is never fetched or touched from here.
-        self._lane_gate()
-        self.procs = ProcScan()
-        if self.procs.unknown:
-            self.notes.append(
-                f"{len(self.procs.unknown)} process(es) of this account could not be read in "
-                "/proc (" + ", ".join(f"{pid} {comm}" for pid, comm, _h, _a in
-                                      self.procs.unknown[:6])
-                + (" ..." if len(self.procs.unknown) > 6 else "") + "): a tree their command "
-                "line or parent's directory places them in is of unknown liveness and kept")
-        self._assembly()
-        self._discover()
-        self.usage = self._live_usage()
-        if self.usage:
-            return
-        # THE ESTATE'S CHECKOUTS BY ITS SHAPE (a quick walk): beside each one
-        # another lane's control root may sit.
-        self.shape_repos = estate_repos(self.estate_root) if self.estate_root else []
-        # WHO ELSE CLAIMS THESE TREES is read before anything is written: a
-        # claim that cannot be read refuses, and a refusal never fetches.
-        self._other_lanes()
-        self._lane_claims()
-        if self.opts.fetch and not self.refusal:
-            self._fetch_all()
-        for tree in self.trees:
-            read_tree(tree)
-        for leg in self.legs:
-            read_leg(leg, self.lane)
-        self._dependents()
-        # EVERY CONTROL ROOT THE WHOLE-ESTATE WALK FOUND IS A PLACE ANOTHER LANE'S
-        # CLAIM MAY BE (#174, Copilot round 2): `host/vendor/.lane-state`, with
-        # `host` a repository and no log naming it, was found by that walk and
-        # thrown away - and a clone another lane claims from there was removed.
-        if self.walk_lane_states:
-            self._other_lanes(self.walk_lane_states)
-        for tree in self.trees:
-            self._liveness(tree)
-            if tree.is_git and tree.exists:
-                tree.lean = leaned_on(tree.path, tree.common if tree.kind == "clone" else "",
-                                      self.deps)
-                if tree.branch and not tree.unborn and tree.branch not in PROTECTED_BRANCHES:
-                    tree.merge = self.evidence.judge(tree.path, slug_of(tree.origin_url),
-                                                     tree.branch, tree.head)
-
-    def _assembly(self) -> None:
-        """T018: WHERE THE LANE'S CHECKOUT IS AN ASSEMBLY, its legs and the
-        dependencies nested in them are read, and `<assembly>/worktrees` - the
-        paired `worktrees/<feature>/{spec,code}` the standard's three-leg root
-        keeps its feature trees in - is a root of the table. A checkout with no
-        `project.yaml` is asked nothing. A manifest, or a leg's own submodule
-        list, that could not be read refuses: which checkouts the assembly
-        holds would be unknown, never none (Amendment 7(d))."""
-        d = self.facts.dir
-        if not d or not os.path.isdir(d):
-            return
-        legs, declared, why = assembly_checkouts(self.helper, d)
-        self.legs = legs
-        if declared:
-            self.paired_root = os.path.join(d, "worktrees")
-        if why:
-            self.refusal = self.refusal or (
-                f"the legs of the assembly {d} could not be read, so which checkouts and "
-                f"worktrees it holds is unknown (Amendment 7(d)): {why}")
-
-    def _dependents(self) -> None:
-        """What leans on the trees. WHERE A REMOVAL WOULD DELETE A DIRECTORY -
-        a clone the table could take, or `--include-scratch` - the whole
-        estate is walked (#170 A11): every directory but caches, so a clone
-        in a plain directory inside a repository is seen, and what the walk
-        could not read makes the scan PARTIAL, which removes no such
-        directory. A worktree's removal deletes no objects (they are its
-        checkout's), so where only worktrees are candidates the estate's
-        shape is enough: on Eagle the whole walk is 683,000 directories."""
-        whole = self.opts.scratch or any(
-            t.exists and t.kind == "clone"
-            and (t.owner != "foreign" or (self.opts.foreign and t.foreign_kind != "other-lane"))
-            for t in self.trees)
-        unread: list = []
-        if whole:
-            walk = walk_estate(self.estate_root)
-            unread += walk.unread
-            self.walk_lane_states = walk.lane_states
-            self.deps = dependents_map(walk.repos, unread)
-            self.deps_partial = unread
-        else:
-            self.deps = dependents_map(self.shape_repos, unread)
-            self.deps_partial = []
-
-    def _live_usage(self) -> str:
-        """`--live` names writers' trees, so each path must name one of the
-        table's (#170 B4): a misspelt path was accepted in silence, and the
-        writer it meant to protect was not protected. `none` stands alone."""
-        named = [n for n in self.opts.live if n != "none"]
-        if named and len(named) != len(self.opts.live):
-            return "--live none says no writer is live; it takes no path beside it"
-        for n in named:
-            if not any(under(t.path, n) or under(n, t.path) for t in self.trees):
-                return (f"--live {n} names no tree of this sweep (misspelt?); the trees are "
-                        "the lane's inventory, its roots and its checkout's registrations")
-        return ""
-
-    def _lane_claims(self) -> None:
-        """A tree #97's inventory does not name is still THIS LANE'S when it
-        stands under the lane's own worktree root (`.lane-worktrees/<lane>/`,
-        which only this lane's starts make), or sits in the checkout's
-        `.claude/worktrees` with its HEAD - a commit its origin's default
-        branch lacks - carrying this lane's `Lane:` trailer as its own.
-        Another lane's claim still wins. Without this a lane whose trees were
-        never recorded read as "nothing to retire", and #163's gate passed it
-        (B1).
-
-        AND A LANE WITH NO SNAPSHOT AT ALL (#97's state NONE) BUT TREES OF ITS
-        OWN IS REFUSED: which of them are its is recorded nowhere, so the gate
-        does not pass it until a handoff records them or a person retires
-        them.
-
-        HEAD'S OWN TRAILER, NOT ANY OF THE BRANCH'S (#174 review R1): a tree
-        another lane STACKED on this lane's commit carries this lane's trailer
-        below its tip, and adopting it on that removed the other lane's tree
-        and pushed its in-progress edit to `rescue/<this lane>/...` - and two
-        lanes sharing one checkout both adopted it."""
-        roots = self._roots()
-        lane_root = roots[-1] if roots else ""
-        claude_root = roots[0] if self.facts.dir and roots else ""
-        for t in self.trees:
-            # A CLONE IS NEVER ADOPTED: a lane creates worktrees, never clones,
-            # so a standalone clone under its root stays FOREIGN - a finding for
-            # a person's word, as #162's first protocol line has it.
-            if t.owner != "foreign" or t.foreign_kind in ("other-lane", "clone", "paired-clone"):
-                continue
-            if lane_root and under(t.path, lane_root) and t.real != real(lane_root):
-                t.owner = "lane-root"
-            elif claude_root and t.exists and under(t.path, claude_root) \
-                    and self.lane.lower() in own_trailers(t.path) \
-                    and head_lane_trailer(t.path).lower() == self.lane.lower():
-                t.owner = "trailer"
-            # T018: THE PAIRED ROOT IS PER FEATURE, NOT PER LANE, exactly as
-            # `.claude/worktrees` is per checkout - so a tree there is this
-            # lane's by its HEAD's own trailer, the same rule, and by nothing else.
-            elif self.paired_root and t.exists and under(t.path, self.paired_root) \
-                    and t.real != real(self.paired_root) \
-                    and self.lane.lower() in own_trailers(t.path) \
-                    and head_lane_trailer(t.path).lower() == self.lane.lower():
-                t.owner = "trailer"
-        claimed = [t for t in self.trees if t.owner in ("lane-root", "trailer")]
-        if self.facts.state == "NONE" and claimed:
-            self.refusal = self.refusal or (
-                f"lane {self.lane} has no #97 snapshot (state NONE), yet {len(claimed)} tree(s) "
-                f"are its by where they stand or what they carry (e.g. {claimed[0].path}); which "
-                "are its is recorded nowhere, so the gate does not pass - record them with a "
-                "handoff (lane-handoff takes the inventory), or retire them by hand")
-
-    def _roots(self) -> list:
-        roots = []
-        if self.facts.dir:
-            roots.append(os.path.join(self.facts.dir, ".claude", "worktrees"))
-            roots.append(os.path.join(os.path.dirname(self.facts.dir.rstrip("/")),
-                                      ".lane-worktrees", self.lane))
-        elif os.environ.get("PROJECTS_ROOT"):
-            roots.append(os.path.join(os.environ["PROJECTS_ROOT"], ".lane-worktrees", self.lane))
-        return roots
-
-    def _discover(self) -> None:
-        seen: dict = {}
-        lane_dir = real(self.facts.dir) if self.facts.dir else ""
-        # T018: A LEG CHECKOUT IS NO TREE OF THE TABLE, as the lane's own
-        # checkout is none: it is the assembly's, and its own row says what it
-        # holds. A record naming one is that row's, never a tree to remove.
-        leg_by_real = {g.real: g for g in self.legs if g.checkout}
-        for rec in self.facts.inventory:
-            path = rec.get("path") or ""
-            if not path or rec.get("schema") not in ("1",):
-                # A RECORD THAT CANNOT BE READ IS A TREE WHOSE OWNER IS UNKNOWN:
-                # skipping it would let the table say "nothing to retire", and
-                # --include-foreign find the same path as nobody's.
-                self.refusal = self.refusal or (
-                    f"inventory record {rec.get('id') or '?'} is unreadable or of schema "
-                    f"{rec.get('schema') or '?'}, so which trees are this lane's is not known "
-                    "(Amendment 7(d)); read it: lanes-edit.sh lane-trees " + self.lane)
-                continue
-            if lane_dir and real(path) == lane_dir:
-                continue
-            if leg_by_real and real(path) in leg_by_real:
-                continue
-            t = Tree(path, "inventory")
-            t.sidecar = rec
-            t.checkout = rec.get("checkout") if rec.get("checkout") not in ("", "unknown") else ""
-            seen[t.real] = t
-        checkouts = []
-        # A RECORDED DIRECTORY THAT IS NO REPOSITORY HAS NO REGISTRATIONS, as it
-        # has no branches (#163, `_branch_checkouts`): an absence, never the
-        # failed `git worktree list` that #170 G5 refuses.
-        if self.facts.dir and os.path.isdir(self.facts.dir) and not no_repository(self.facts.dir):
-            checkouts.append(self.facts.dir)
-        for t in list(seen.values()):
-            if t.checkout and os.path.isdir(t.checkout) and t.checkout not in checkouts:
-                checkouts.append(t.checkout)
-        # T018: EVERY LEG'S REGISTRATIONS TOO, LAST, so a tree registered in a
-        # leg's repository is the leg's: `git -C <assembly> worktree list`
-        # names none of them, and a code tree recorded under any other checkout
-        # was the only one a sweep ever saw.
-        for g in self.legs:
-            if g.checkout and g.real not in [real(c) for c in checkouts]:
-                checkouts.append(g.path)
-        regs_by_real: dict = {}
-        for co in checkouts:
-            regs = worktree_registrations(co)
-            if regs is None:
-                self.refusal = self.refusal or (
-                    f"the worktree registrations of {co} could not be read (git worktree list "
-                    "failed), so which trees it holds is unknown (#170 G5, Amendment 7(d))")
-                continue
-            for i, reg in enumerate(regs):
-                if i == 0 or reg.get("bare"):
-                    continue          # the main worktree is the checkout itself
-                regs_by_real[real(reg["path"])] = (co, reg)
-        for rp, (co, reg) in regs_by_real.items():
-            t = seen.get(rp)
-            if t is None:
-                t = Tree(reg["path"], "foreign",
-                         "leg" if real(co) in leg_by_real else "registered")
-                seen[t.real] = t
-            t.leg = leg_by_real.get(real(co))
-            t.registered = True
-            t.checkout = t.checkout or co
-            t.locked = bool(reg.get("locked"))
-            t.reg = reg
-        for root in self._roots():
-            try:
-                names = sorted(os.listdir(root))
-            except (FileNotFoundError, NotADirectoryError):
-                continue
-            except OSError as exc:
-                # A ROOT THAT CANNOT BE LISTED IS NOT AN ABSENT ROOT (#170 G1): read
-                # as one, an empty inventory let the dry run exit 0 and clear #163's
-                # gate over trees nobody could see.
-                self.refusal = self.refusal or (
-                    f"the lane's worktree root {root} could not be listed "
-                    f"({exc.strerror or exc}), so which trees stand in it is unknown")
-                continue
-            for name in names:
-                full = os.path.join(root, name)
-                if not os.path.isdir(full) or os.path.islink(full):
-                    continue
-                if real(full) in seen:
-                    continue
-                if not os.path.lexists(os.path.join(full, ".git")):
-                    continue
-                kind = "clone" if os.path.isdir(os.path.join(full, ".git")) else "lane-root"
-                seen[real(full)] = Tree(full, "foreign", kind)
-        if self.paired_root:
-            self._paired(seen)
-        self.trees = sorted(seen.values(), key=lambda t: (t.owner != "inventory", t.path))
-
-    def _paired(self, seen: dict) -> None:
-        """T018: THE ASSEMBLY'S PAIRED FEATURE TREES, `<assembly>/worktrees/
-        <feature>/<each declared leg path>` (and `<feature>` itself), that no
-        registration above named - a registration lost, or a clone where a
-        worktree belongs. A directory that cannot be listed refuses, as a lane
-        root does (#170 G1): an unread root is never an empty one. One that can
-        be listed and not SEARCHED is unread too - what stands in it cannot be
-        told - and so is a leg's directory under a feature that cannot be
-        searched: `lane-reconcile` and `lane-handoff` say the same of each."""
-        root = self.paired_root
-        try:
-            names = sorted(os.listdir(root))
-            unsearchable = not os.access(root, os.X_OK)
-        except (FileNotFoundError, NotADirectoryError):
-            return
-        except OSError as exc:
-            self.refusal = self.refusal or (
-                f"the assembly's worktree root {root} could not be listed "
-                f"({exc.strerror or exc}), so which feature trees stand in it is unknown")
-            return
-        if unsearchable:
-            self.refusal = self.refusal or (
-                f"the assembly's worktree root {root} could not be listed (it cannot be "
-                "searched), so which feature trees stand in it is unknown")
-            return
-        decls = [g.decl for g in self.legs if not g.nested_in]
-        for name in names:
-            fdir = os.path.join(root, name)
-            if not os.path.isdir(fdir) or os.path.islink(fdir):
-                continue
-            try:
-                os.listdir(fdir)
-                why = "" if os.access(fdir, os.X_OK) else "it cannot be searched"
-            except OSError as exc:
-                why = exc.strerror or str(exc)
-            if why:
-                self.refusal = self.refusal or (
-                    f"the assembly's feature directory {fdir} could not be listed "
-                    f"({why}), so which trees stand in it is unknown")
-                continue
-            for full in [fdir] + [os.path.join(fdir, d) for d in decls]:
-                if not os.path.isdir(full) or os.path.islink(full) or real(full) in seen:
-                    continue
-                if not os.access(full, os.X_OK):
-                    self.refusal = self.refusal or (
-                        f"the assembly's paired tree directory {full} could not be searched, "
-                        "so whether a tree stands in it is unknown")
-                    continue
-                if not os.path.lexists(os.path.join(full, ".git")):
-                    continue
-                kind = ("paired-clone" if os.path.isdir(os.path.join(full, ".git"))
-                        else "paired")
-                seen[real(full)] = Tree(full, "foreign", kind)
-
-    def _other_lanes(self, extra: list = ()) -> None:
-        """A FOREIGN tree another lane's inventory names is THAT lane's.
-
-        EVERY LANE'S CONTROL ROOT IS READ, wherever #97 keeps it (#170 G6): a
-        lane whose checkout is nested (`<estate>/group/repo`) keeps its
-        `.lane-state` beside that checkout, not beside this lane's, so the
-        parents read are #97's own rungs for every lane - the override, the
-        parent of every lane's recorded `dir` in the register, `$PROJECTS_ROOT`
-        - beside this lane's own and beside every checkout of the estate. A
-        register that cannot be read refuses: whose claims were missed would
-        be unknown.
-
-        ONLY THIS SWEEP'S ESTATE, AND NEVER A REFUSAL WITH NO TREE (#174 review
-        R3): the register names every lane on the workstation, so one pathless
-        or unreadable sidecar in ANY estate made the sweep exit 2 for a lane
-        with nothing on disk - every lane-end blocked. A recorded `dir` outside
-        the estate root is not read, and with no tree a claim can take away
-        nothing, so one that cannot be read is a note."""
-        parents = set()
-        if self.facts.root:
-            parents.add(os.path.dirname(self.facts.root.rstrip("/")))
-        if self.facts.dir:
-            parents.add(os.path.join(os.path.dirname(self.facts.dir.rstrip("/")), ".lane-state"))
-        if os.environ.get("LANES_LANE_STATE_ROOT"):
-            parents.add(os.environ["LANES_LANE_STATE_ROOT"])
-        if os.environ.get("PROJECTS_ROOT"):
-            parents.add(os.path.join(os.environ["PROJECTS_ROOT"], ".lane-state"))
-        parents.update(os.path.join(os.path.dirname(r.rstrip("/")), ".lane-state")
-                       for r in self.shape_repos)
-        parents.update(extra)
-        claimed: dict = {}
-
-        def unreadable(what: str) -> None:
-            # A CLAIM THAT CANNOT BE READ IS NOT "NO CLAIM" (Amendment 7(d)) -
-            # but a claim only takes a tree from this lane, so with no tree it
-            # can lower nothing: a note then, never a refusal (#174 review R3).
-            if not self.trees:
-                text = (f"{what} could not be read; this lane has no tree for another lane's "
-                        "claim to take, so the sweep goes on - read it, or move it aside if it "
-                        "is debris")
-                if text not in self.notes:
-                    self.notes.append(text)
-                return
-            self.refusal = self.refusal or (
-                f"{what} could not be read, so whether another lane claims these trees is "
-                "unknown; read it, or move it aside if it is debris")
-
-        dirs, why = register_lane_dirs(self.helper)
-        if why:
-            unreadable(f"every lane's recorded directory ({why})")
-        for other, odir in dirs.items():
-            if other.lower() == self.lane.lower():
-                continue
-            parent = os.path.join(os.path.dirname(odir.rstrip("/")), ".lane-state")
-            # THIS SWEEP'S ESTATE ONLY (#174 review R3): a lane recorded in
-            # another estate keeps its claims there.
-            if self.estate_root and not under(parent, self.estate_root):
-                continue
-            parents.add(parent)
-        for parent in sorted(parents):
-            try:
-                lanes = os.listdir(parent)
-            except FileNotFoundError:
-                continue
-            except OSError:
-                unreadable(f"the lane-state directory {parent}")
-                continue
-            for other in lanes:
-                if other.lower() == self.lane.lower():
-                    continue
-                tdir = os.path.join(parent, other, "trees")
-                try:
-                    files = os.listdir(tdir)
-                except (FileNotFoundError, NotADirectoryError):
-                    continue          # that lane has no inventory: no claim
-                except OSError:
-                    unreadable(f"lane {other}'s inventory {tdir}")
-                    continue
-                for fname in files:
-                    if fname.startswith(".") or not fname.endswith(".yaml"):
-                        continue
-                    path = ""
-                    try:
-                        with open(os.path.join(tdir, fname), encoding="utf-8", errors="surrogateescape") as fh:
-                            for line in fh:
-                                if line.startswith("path: "):
-                                    path = line[6:].strip()
-                                    break
-                    except (OSError, UnicodeDecodeError):
-                        unreadable(f"lane {other}'s inventory record {fname}")
-                        continue
-                    if not path:
-                        unreadable(f"lane {other}'s inventory record {fname} (it names no path)")
-                        continue
-                    claimed[real(path)] = other
-        for tree in self.trees:
-            if tree.real not in claimed:
-                continue
-            tree.other_lane = claimed[tree.real]
-            if tree.owner == "foreign":
-                tree.foreign_kind = "other-lane"
-            else:
-                # BOTH INVENTORIES NAME IT: records are history and a path can
-                # be reused, so which lane owns it now is not this sweep's to
-                # decide.
-                tree.contested = True
-
-    def _branch_checkouts(self) -> list:
-        checkouts = []
-        # A RECORDED DIRECTORY THAT IS NO REPOSITORY HAS NO BRANCHES (#163): it
-        # is an absence, not a read that failed - and as a `keep` row it held
-        # `lane-end`'s gate shut for every lane started outside a checkout.
-        if self.facts.dir and os.path.isdir(self.facts.dir) and not no_repository(self.facts.dir):
-            checkouts.append(self.facts.dir)
-        for t in self.trees:
-            if t.owner == "inventory" and t.checkout and os.path.isdir(t.checkout) \
-                    and real(t.checkout) not in [real(c) for c in checkouts]:
-                checkouts.append(t.checkout)
-        # T018: AND EVERY LEG'S, where the lane's checkout is an assembly: after
-        # the split a lane's branches are made in its code leg, not in the root.
-        for g in self.legs:
-            if g.checkout and g.real not in [real(c) for c in checkouts]:
-                checkouts.append(g.path)
-        return checkouts
-
-    def _fetch_all(self) -> None:
-        commons: dict = {}
-        probes = [t.path if t.exists else t.checkout for t in self.trees]
-        if self.opts.branches:
-            probes += self._branch_checkouts()
-        probes += [g.path for g in self.legs if g.checkout]      # T018
-        for probe in probes:
-            if not probe or not os.path.isdir(probe):
-                continue
-            common = git_out(probe, "rev-parse", "--git-common-dir")
-            if common is None:
-                continue
-            if not os.path.isabs(common):
-                common = os.path.normpath(os.path.join(probe, common))
-            commons.setdefault(real(common), probe)
-        for common, probe in commons.items():
-            if not git_out(probe, "config", "--get", "remote.origin.url"):
-                self.fetched[common] = "no origin remote"
-                continue
-            # THE REFSPEC IS PINNED, as `status --fetch` pins it (#170 item 6):
-            # a mirror-style `remote.origin.fetch` (`+refs/heads/*:refs/heads/*`)
-            # would let `--prune` delete local-only branches before they were
-            # classified or rescued. `--refmap` keeps the configured refspec from
-            # mapping anything, and neither `fetch.pruneTags` nor the remote's
-            # `pruneTags` may take a local tag with it.
-            proc = git(probe, "-c", "fetch.pruneTags=false", "-c", "remote.origin.pruneTags=false",
-                       "fetch", "--prune", "--quiet", "--recurse-submodules=no",
-                       "--refmap=+refs/heads/*:refs/remotes/origin/*", "origin",
-                       "+refs/heads/*:refs/remotes/origin/*", timeout=GIT_NET_TIMEOUT)
-            self.fetched[common] = "ok" if proc.returncode == 0 else (
-                "fetch failed: " + _first_line(proc.stderr))
-
-    def _liveness(self, tree: Tree) -> None:
-        if not tree.exists:
-            return
-        for named in self.opts.live:
-            if named != "none" and (under(tree.path, named) or under(named, tree.path)):
-                tree.live = (True, "the coordinator's writer count names it (--live)")
-                return
-        try:
-            here = os.getcwd()
-        except OSError:
-            here = ""
-        if here and under(here, tree.path):
-            tree.live = (True, "this sweep was started from inside it")
-            return
-        if self.procs is not None and self.procs.available:
-            holders = self.procs.holders(tree.path)
-            if holders:
-                pid, comm, kind, where = holders[0]
-                tree.live = (True, f"process {pid} ({comm or '?'}) has its {kind} there")
-                return
-            hidden = self.procs.unknown_for(tree.path)
-            if hidden:
-                tree.live = (None, "liveness could not be read: " + hidden)
-                return
-        elif self.procs is not None:
-            tree.live = (None, "liveness could not be read: " + self.procs.why)
-            return
-        writer = (tree.sidecar or {}).get("writer", "")
-        if writer and UUID_RE.match(writer) and writer != self.caller:
-            answer = self.helper.transcript_live(writer)
-            if answer == "live":
-                tree.live = (True, f"the session that recorded it ({writer[:8]}) is live")
-                return
-            if answer == "unknown":
-                tree.live = (None, f"whether session {writer[:8]} is live could not be read")
-                return
-        if tree.owner != "inventory" and tree.is_git:
-            quiet = self.conf["foreign_quiet_hours"] * 3600
-            newest = _gitdir_activity(tree.path)
-            if newest and time.time() - newest < quiet:
-                tree.live = (True, ("FOREIGN" if tree.owner == "foreign" else
-                                    "not in the inventory")
-                             + f" and active {int((time.time() - newest) // 60)} min ago "
-                                   f"(foreign trees quiet for {self.conf['foreign_quiet_hours']} h only)")
-
-    def _lane_gate(self) -> None:
-        f = self.facts
-        if f.binding == "elsewhere":
-            self.refusal = (f"lane {self.lane} is bound on {f.binding_at or 'another place'}, and "
-                            "liveness is pronounced only from inside that binding (Amendment "
-                            "18(b)): from here it is UNKNOWN, never dead. Sweep it from there, or "
-                            "ask it to hand off: lane-start --request-handoff")
-            return
-        if f.binding == "unknown":
-            self.refusal = (f"where lane {self.lane} is bound could not be read, and a read that "
-                            "failed is never an answer (Amendment 7(d))")
-            return
-        if f.holder == "unknown":
-            self.refusal = (f"whether a live session holds lane {self.lane} could not be read "
-                            f"({f.holder_detail or 'the session records'}); that is not 'none'")
-            return
-        if f.holder == "live" and f.holder_uuid != self.caller:
-            self.refusal = (f"lane {self.lane} is held by live session {f.holder_uuid or '?'} "
-                            f"({f.holder_detail}); sweep it from inside that session, or after "
-                            "it hands off")
-            return
-        if self.opts.yes and f.holder == "live" and f.state == "SWAPPING":
-            self.refusal = (f"lane {self.lane} is SWAPPING in a live session: a handoff is in "
-                            "flight and a sweep does not compete with it")
-            return
-        if self.opts.yes and f.holder == "live" and not self.opts.live:
-            self.refusal = (f"lane {self.lane} is held by THIS session, and only its coordinator "
-                            "knows which writers are live (ListAgents; Amendment 17 Addendum 1 "
-                            "(i)). State the count: --live <worktree> for each live writer, or "
-                            "--live none")
-            return
-        # A TREE THIS SESSION RECORDED IS ONE ITS OWN WRITERS MAY STAND IN (#170
-        # B5): their liveness is never asked of the transcript - it is this
-        # one - so the coordinator's count is wanted whatever the holder reads.
-        mine = [r for r in f.inventory if self.caller and r.get("writer") == self.caller]
-        if self.opts.yes and mine and not self.opts.live:
-            self.refusal = (f"this session recorded {len(mine)} of lane {self.lane}'s trees (e.g. "
-                            f"{mine[0].get('path') or '?'}), so its own writers may be in them, "
-                            "and only its coordinator knows which are live (ListAgents; "
-                            "Amendment 17 Addendum 1 (i)). State the count: --live <worktree> "
-                            "for each live writer, or --live none")
-            return
-        if f.verdict == "indeterminate":
-            self.refusal = (f"#97's reconciliation of lane {self.lane} is INDETERMINATE: "
-                            + (f.verdict_why or "a read it rests on failed"))
-            return
-        if self.opts.yes and self.opts.foreign and not self.opts.word:
-            self.refusal = ("--include-foreign acts on trees #97's inventory does not give to "
-                            "this lane, and that takes a word: --word \"<the words, verbatim>\"")
-            return
-
-    # ---------------------------------------------------------- deciding
-    def decide(self) -> None:
-        for leg in self.legs:
-            decide_leg(leg)
-        for tree in self.trees:
-            self._decide(tree)
-            if tree.owner in ("lane-root", "trailer") and tree.disposition != "foreign":
-                tree.reason += ("; not in #97's inventory - the lane's by "
-                                + ("its root" if tree.owner == "lane-root" else
-                                   "its branch's Lane: trailer"))
-        if self.opts.branches:
-            self._branches()
-        if self.opts.scratch:
-            self._scratch()
-        if self.opts.caches:
-            self._caches()
-        if self.opts.sandboxes:
-            self.items.extend(sandbox_items(self.procs or ProcScan(), self.conf))
-        if self.opts.links and self.estate_root:
-            self.items.extend(link_items(self.estate_root))
-
-    def _decide(self, t: Tree) -> None:
-        mine = t.owner != "foreign" or (self.opts.foreign and t.foreign_kind != "other-lane")
-
-        def put(disp: str, why: str, retire: bool = True) -> None:
-            t.disposition, t.reason, t.retire = disp, why, retire
-
-        if t.owner == "foreign" and not mine:
-            where = {"registered": "registered in the lane's checkout",
-                     "lane-root": "under this lane's worktree root",
-                     "clone": "a standalone CLONE under this lane's root (a lane creates "
-                              "worktrees, never clones)",
-                     "other-lane": f"lane {t.other_lane}'s inventory names it"}.get(t.foreign_kind, "")
-            if t.foreign_kind in ("leg", "paired", "paired-clone"):
-                where = self._leg_where(t)
-            put("foreign", f"not in lane {self.lane}'s inventory (#97); {where}", False)
-            if t.lean:
-                t.reason += "; LOAD-BEARING: " + _lean_text(t.lean)
-            return
-        if t.contested:
-            put("keep", f"lane {t.other_lane}'s inventory names it too; which lane owns it "
-                        "now is a person's to say")
-            return
-        if not t.exists:
-            if t.registered:
-                if t.locked:
-                    put("keep", "its directory is gone and the registration is LOCKED; "
-                                f"git -C {t.checkout} worktree unlock {t.path} first")
-                    return
-                # ITS GIT DIRECTORY MAY KEEP SUBMODULE REPOSITORIES (#174, Copilot
-                # round 2): `<admin>/modules/<name>`, with branches, a stash or a
-                # reflog no remote holds, goes with the registration.
-                admin = worktree_admin(t.checkout, t.path) if t.checkout else ""
-                mod_why = module_repos_why(admin) if admin else ""
-                if mod_why:
-                    put("keep", "its directory is gone, and " + mod_why + "; pruning the "
-                                "registration would take that repository with it")
-                    return
-                # THE REGISTRATION MAY BE THE ONLY POINTER TO ITS COMMITS (#170
-                # A4): a detached HEAD, or a reflog entry, that no branch, tag or
-                # origin holds is lost with the registration's git directory.
-                try:
-                    lost = self._lost(t)
-                except _ActFailed as exc:
-                    put("keep", "its directory is gone, and " + str(exc).replace(
-                        "; left in place", ""))
-                    return
-                if lost:
-                    put("rescue+prune", f"the directory is gone and git still registers it; its "
-                                        f"registration names {len(lost)} commit(s) no branch, tag "
-                                        "or origin holds (its HEAD or reflog): rescued - a rescue "
-                                        "branch pushed where there is an origin, and a bundle - "
-                                        "then that one registration pruned")
-                else:
-                    put("prune", "the directory is gone and git still registers it")
-            else:
-                put("gone", "the directory is gone and nothing registers it; the inventory "
-                            "record is history", False)
-            return
-        if t.live is not None:
-            if t.live[0]:
-                put("live", "a live writer owns it: " + t.live[1])
-            else:
-                put("keep", t.live[1])
-            return
-        if not t.is_git:
-            put("keep", "the path exists and is no checkout; it is left exactly as it is")
-            return
-        if t.read_error:
-            put("keep", "git could not be read through it: " + t.read_error)
-            return
-        t.guard = tree_guards(t)
-        if t.guard:
-            put("keep", t.guard)
-            return
-        if t.lean:
-            put("load-bearing", "LOAD-BEARING: " + _lean_text(t.lean)
-                + "; remedy: in each dependent `git repack -a -d` then drop its "
-                  "objects/info/alternates, or re-point the local remote - then sweep again")
-            return
-        if t.kind == "clone":
-            partial = self._deps_partial(t.path)
-            if partial:
-                put("keep", "it is a CLONE, removed by deleting its directory, and the search for "
-                            "repositories that lean on it (alternates, a local remote) was "
-                            "partial: " + _first_few(partial)
-                            + " - a dependent nobody saw would lose its objects")
-                return
-        if self.opts.fetch:
-            state = self.fetched.get(real(t.common), "")
-            if state and state not in ("ok", "no origin remote"):
-                put("keep", f"origin could not be read ({state}), so what is published is unknown")
-                return
-        if not t.origin_url:
-            if self.opts.bundle:
-                put("bundle+remove", "no origin remote: a bundle is its only rescue")
-            else:
-                put("keep", "no origin remote, so nothing in it can be published; --bundle "
-                            "archives it instead")
-            return
-        dirty = len(t.status_lines)
-        if dirty:
-            untracked = sum(1 for ln in t.status_lines if ln.startswith("?? "))
-            if untracked and not self.opts.push_untracked:
-                files = untracked_files(t.path)
-                why = (lfs_untracked_why(t.path, files) if files is not None else
-                       "its untracked files could not be listed, so whether git-lfs content "
-                       "is among them is unknown" if lfs_configured(t.path) else "")
-                if why:
-                    put("keep", why)
-                    return
-            put("wip-rescue+remove", f"{dirty} dirty or untracked path(s): a WIP commit on "
-                                     "a rescue branch, pushed, then removed"
-                + (f"; its {untracked} untracked path(s) go to the bundle only, never pushed "
-                   "(--push-untracked pushes them)" if untracked and not self.opts.push_untracked
-                   else ""))
-            return
-        if t.unborn:
-            put("remove", "an unborn branch with nothing in it")
-            return
-        if t.detached:
-            if t.on_origin:
-                put("remove", "detached at a commit origin holds")
-            elif t.on_origin is None:
-                put("keep", "detached, and whether origin holds the commit could not be read")
-            else:
-                put("rescue+remove", "detached with commits of its own: a rescue branch, pushed, "
-                                     "then removed")
-            return
-        m = t.merge or {}
-        if m.get("state") == "merged":
-            put("remove+delete-branch", m["why"] + "; the local branch is deleted, and the "
-                "remote one where it is this lane's and holds nothing the PR did not")
-            return
-        if t.remote_tip and t.ahead == 0:
-            put("remove", "clean, and every commit is on origin/" + t.remote_branch
-                + (f" ({m.get('why')})" if m.get("state") in ("open", "closed", "moved",
-                                                                "elsewhere") else ""))
-            return
-        if not t.remote_tip and t.on_origin:
-            put("remove", "clean, and its head is on origin")
-            return
-        if t.branch in PROTECTED_BRANCHES or (t.remote_tip and t.behind > 0):
-            why = ("a default branch is never pushed by a sweep" if t.branch in PROTECTED_BRANCHES
-                   else f"origin/{t.remote_branch} has {t.behind} commit(s) it lacks (diverged)")
-            put("rescue+remove", f"{t.ahead or 'unpublished'} commit(s) not on origin and {why}: "
-                                 "a rescue branch, pushed, then removed")
-            return
-        # A LANE'S UNREVIEWED COMMITS NEVER GO ONTO SOMEBODY'S BRANCH AS IS
-        # (#170 A7): not onto one an open pull request names (a teammate's
-        # under review), not onto one whose tip carries another lane's
-        # `Lane:` trailer, and not where whether a PR names it could not be
-        # read. They go to a rescue branch of this lane's instead.
-        if t.remote_tip:
-            other = t.remote_trailer if (t.remote_trailer and
-                                         t.remote_trailer.lower() != self.lane.lower()) else ""
-            # GH'S OPEN WINS HERE WHATEVER THE REGISTER SAYS (#174, Copilot round
-            # 2): a LANDED line naming a PR gh still answers OPEN made the verdict
-            # "moved", and the lane's commits were pushed onto that open branch.
-            gh_open = m.get("gh_open") or []
-            why = (m["why"] + ", and a lane's unreviewed commits never go onto an open pull "
-                   "request's branch" if m.get("state") == "open" else
-                   f"gh still answers PR #{gh_open[0]} OPEN for it, whatever the register's "
-                   "LANDED line says, and a lane's unreviewed commits never go onto an open pull "
-                   "request's branch" if gh_open else
-                   f"origin/{t.remote_branch} carries lane {other}'s work (its tip's Lane: "
-                   "trailer)" if other else
-                   f"whether an open pull request names origin/{t.remote_branch} is unknown "
-                   f"({m.get('why', 'not read')})" if m.get("state") == "unknown" else "")
-            if why:
-                put("rescue+remove", f"{t.ahead} commit(s) not on origin/{t.remote_branch}, and "
-                                     f"{why}: a rescue branch, pushed, then removed - "
-                                     f"origin/{t.remote_branch} is left as it is")
-                return
-        put("push+remove", (f"{t.ahead} commit(s) not on origin/{t.remote_branch}"
-                            if t.remote_tip else f"origin has no {t.remote_branch}")
-            + ": pushed as is, then removed")
-
-    def _leg_where(self, t: Tree) -> str:
-        """T018: where a tree of an assembly's legs stands, for its FOREIGN row."""
-        paired = bool(self.paired_root) and under(t.path, self.paired_root)
-        if t.foreign_kind == "paired-clone":
-            return ("a standalone CLONE in the assembly's paired feature worktrees "
-                    f"({self.paired_root}); a feature's trees are worktrees of its legs")
-        if paired:
-            return (f"in the assembly's paired feature worktrees ({self.paired_root})"
-                    + (f", registered in {t.leg.what()}" if t.leg else "")
-                    + "; its HEAD carries no Lane: trailer of this lane's as its own")
-        return (f"registered in {t.leg.what() if t.leg else 'a leg of the assembly'}, outside "
-                "every root a lane's trees are claimed in")
-
-    def _branches(self) -> None:
-        leg_by_real = {g.real: g for g in self.legs if g.checkout}
-        for co in self._branch_checkouts():
-            items = branch_items(co, self.lane, self.evidence)
-            leg = leg_by_real.get(real(co))
-            if leg is not None:
-                # T018: WHICH CHECKOUT, since a branch name says nothing of it.
-                for it in items:
-                    it.detail = f"in {leg.what()}" + (f" · {it.detail}" if it.detail else "")
-            if self.opts.fetch:
-                common = git_out(co, "rev-parse", "--git-common-dir") or ""
-                if common and not os.path.isabs(common):
-                    common = os.path.normpath(os.path.join(co, common))
-                state = self.fetched.get(real(common), "") if common else ""
-                if state != "ok":
-                    # A DELETE DECIDED ON STALE REFS IS NO DELETE: what origin
-                    # holds now was not read.
-                    for it in items:
-                        if it.disposition in ("delete", "delete+remote"):
-                            it.disposition = "keep"
-                            it.reason = (f"origin could not be fetched in {co} "
-                                         f"({state or 'not fetched'}); " + it.reason)
-            self.items.extend(items)
-
-    def _scratch(self) -> None:
-        if not self.facts.dir:
-            return
-        root = os.path.join(os.path.dirname(self.facts.dir.rstrip("/")), ".lane-worktrees",
-                            self.lane)
-        try:
-            names = sorted(os.listdir(root))
-        except OSError:
-            return
-        for name in names:
-            full = os.path.join(root, name)
-            if not (name.endswith("-scratch") or name in ("briefs", "bin")):
-                continue
-            if os.path.islink(full) or not os.path.isdir(full):
-                continue
-            if os.path.lexists(os.path.join(full, ".git")):
-                continue          # a checkout is a tree, and the table above has it
-            holders = self.procs.holders(full) if self.procs and self.procs.available else []
-            lean = leaned_on(full, "", self.deps)
-            inner = self._trees_inside(full)
-            if inner:
-                # TREES UNDER IT ARE THE TABLE'S FIRST (#170 item 7): an archive
-                # and an rmtree of the scratch would take a worktree nested in it
-                # - FOREIGN, live or the lane's own - with its git directory.
-                it = Item("scratch", full, "keep", f"{inner}: the tree table retires what is "
-                          "under it first, and the scratch goes on a later sweep", True)
-            elif lean:
-                it = Item("scratch", full, "load-bearing", "LOAD-BEARING: " + _lean_text(lean)
-                          + "; it is never removed until they are re-pointed", True)
-            elif holders:
-                pid, comm, kind, _w = holders[0]
-                it = Item("scratch", full, "live", f"process {pid} ({comm}) has its {kind} there",
-                          True)
-            elif self.procs is not None and not self.procs.available:
-                it = Item("scratch", full, "keep", "liveness could not be read: " + self.procs.why,
-                          True)
-            elif self.procs is not None and self.procs.unknown_for(full):
-                it = Item("scratch", full, "keep", "liveness could not be read: "
-                          + self.procs.unknown_for(full), True)
-            elif self._deps_partial(full):
-                it = Item("scratch", full, "keep", "it is removed by deleting its directory, and "
-                          "the search for repositories that lean on it was partial: "
-                          + _first_few(self._deps_partial(full)), True)
-            else:
-                it = Item("scratch", full, "archive+remove",
-                          "lane scratch: tar and sha256 under the sweeps directory, then removed",
-                          True)
-            it.size = dir_size(full)
-            self.items.append(it)
-
-    def _caches(self) -> None:
-        roots = []
-        if self.facts.dir:
-            roots.append(os.path.join(os.path.dirname(self.facts.dir.rstrip("/")),
-                                      ".lane-worktrees", self.lane))
-        for t in self.trees:
-            if t.owner == "inventory" and t.exists and t.is_git \
-                    and not any(under(t.path, r) for r in roots):
-                roots.append(t.path)
-        # NEVER FROM A TREE THAT IS NOT THIS LANE'S OR NOT PROVABLY FREE: a
-        # FOREIGN tree (whoever's it is, live or not), a live one, one whose
-        # liveness could not be read, one another lane also claims, one
-        # something leans on. A tree kept for its git state (a locked
-        # registration, a submodule's work) still gives up its caches: they
-        # hold no work, and its liveness is asked below.
-        protected = [t.path for t in self.trees if self._cache_protected(t)]
-        # A CACHE INSIDE SCRATCH THAT IS BEING ARCHIVED GOES WITH THE SCRATCH
-        # (and the archive leaves caches out): two acts on one path is one too many.
-        archived = [i.path for i in self.items if i.kind == "scratch"
-                    and i.disposition == "archive+remove"]
-        trees = sorted((t.path for t in self.trees if t.exists), key=len, reverse=True)
-        for root in roots:
-            for path, size in find_caches(root):
-                if any(under(path, lp) for lp in protected + archived):
-                    continue
-                owner = self._cache_owner(path, roots, trees)
-                # LIVENESS IS THE OWNER'S, not the cache's: a writer stands in
-                # the tree, not in its __pycache__.
-                if self.procs is None or not self.procs.available or self.procs.holders(owner) \
-                        or self.procs.unknown_for(owner):
-                    continue
-                if tracked(path) is not False:
-                    continue          # tracked, or its tracking is unknown
-                # A CACHE THAT HOLDS A REPOSITORY HOLDS WORK (#174, Copilot round
-                # 1): `pip install -e git+...` clones into `<venv>/src/<pkg>`, and
-                # the tree kept for that clone (#170 A3) still gave up its venv -
-                # the clone and its unpushed fix with it.
-                inner = repository_within(path)
-                if inner:
-                    it = Item("cache", path, "keep", f"{inner}: its work is no cache's, and the "
-                              "directory is never removed while it is there", False)
-                    it.size = size
-                    it.extra["owner"] = owner
-                    self.items.append(it)
-                    continue
-                it = Item("cache", path, "remove", "a dependency cache or bytecode: it holds no "
-                          "work and is rebuilt", False)
-                it.size = size
-                it.extra["owner"] = owner
-                self.items.append(it)
-
-    @staticmethod
-    def _cache_protected(t: Tree) -> bool:
-        return (t.disposition in ("foreign", "live", "load-bearing") or t.live is not None
-                or t.contested or t.result.startswith(("FAILED", "left")))
-
-    def _trees_inside(self, path: str) -> str:
-        """Why `path` holds trees, or '': a tree of the table under it, or
-        any `.git` beneath it (or a directory there that cannot be read)."""
-        for t in self.trees:
-            if t.real != real(path) and under(t.path, path):
-                return f"a tree of this table lies under it ({t.path})"
-        nested, unread = nested_repos(path)
-        if nested:
-            return f"a repository lies under it ({nested[0]})"
-        if unread:
-            return f"{unread[0]} under it could not be read, so whether a tree lies there is unknown"
-        return ""
-
-    def _deps_partial(self, path: str) -> list:
-        """Why the search for what leans on `path` is not complete: what the
-        estate walk could not read, and `path` lying outside the estate root
-        it searched."""
-        out = list(self.deps_partial)
-        if self.estate_root and not under(path, self.estate_root):
-            out.append(f"{path} lies outside the estate root {self.estate_root}, the only place "
-                       "dependents were looked for")
-        return out
-
-    @staticmethod
-    def _cache_owner(path: str, roots: list, trees: list) -> str:
-        """The tree a cache is in, else the top directory under the lane's
-        root it is in, else the root."""
-        for t in trees:
-            if under(path, t):
-                return t
-        for r in roots:
-            if under(path, r):
-                rel = os.path.relpath(path, r).split(os.sep)
-                return os.path.join(r, rel[0]) if rel and rel[0] not in ("", ".") else r
-        return path
-
-    # ------------------------------------------------------------ output
-    def retire_count(self) -> int:
-        return (sum(1 for t in self.trees if t.retire)
-                + sum(1 for i in self.items if i.retire)
-                + sum(1 for g in self.legs if g.retire))
-
-    def render(self) -> None:
-        f = self.facts
-        mode = "YES - performing the table" if self.opts.yes else \
-            "DRY RUN - nothing is changed; --yes performs it"
-        say(f"{PROG} sweep {self.lane} - {mode}")
-        holder = f.holder
-        if f.holder == "live":
-            holder = f"live {f.holder_uuid[:8]}" + (" (this session)" if f.holder_uuid == self.caller else "")
-        say(f"  lane: state {f.state} · holder {holder} · binding {f.binding}"
-            + (f" ({f.binding_at})" if f.binding_at else "") + (f" · verdict {f.verdict}" if f.verdict else ""))
-        say(f"  checkout: {f.dir or '(no recorded directory)'} · inventory "
-            f"{len(f.inventory)} tree(s) · origin "
-            + ("fetched now" if self.opts.fetch else "as of the last fetch"))
-        ev = self.evidence
-        say("  merged means: the register's LANDED line for the branch's PR, or gh's MERGED"
-            + (f" (gh: {ev.gh_why})" if ev.gh_why else "")
-            + (f" (register: {ev.register_why})" if ev.register_why else ""))
-        if self.refusal:
-            say("")
-            say(f"REFUSED: {self.refusal}")
-        for line in self.notes:
-            say(f"  note: {line}")
-        say("")
-        say("TREES")
-        if not self.trees:
-            say("  (none: no inventory tree, no registration, nothing under the lane's roots)")
-        for t in self.trees:
-            res = f" -> {t.result}" if t.result else ""
-            say(f"  {t.disposition:<22} {t.path}")
-            say(f"  {'':<22}   {t.label()} · {t.reason}{res}")
-        if self.legs:
-            # T018: THE ASSEMBLY'S OWN CHECKOUTS, read and never acted on.
-            say("")
-            say(f"LEGS (the assembly's own checkouts, from {os.path.join(f.dir, 'project.yaml')}; "
-                "read, and never acted on)")
-            for g in self.legs:
-                say(f"  {g.disposition:<22} {g.path}")
-                say(f"  {'':<22}   {g.label()} · {g.reason}")
-        kinds = (("branch", "BRANCHES (--branches)"), ("scratch", "SCRATCH (--include-scratch)"),
-                 ("cache", "CACHES (--include-caches)"), ("sandbox", "SANDBOXES (--include-sandboxes)"),
-                 ("link", "BROKEN LINKS (--links)"))
-        for kind, title in kinds:
-            rows = [i for i in self.items if i.kind == kind]
-            if not rows:
-                continue
-            say("")
-            say(title)
-            for i in rows:
-                size = f" · {human_size(i.size)}" if i.size else ""
-                res = f" -> {i.result}" if i.result else ""
-                say(f"  {i.disposition:<22} {i.path}{size}")
-                say(f"  {'':<22}   {i.detail + ' · ' if i.detail else ''}{i.reason}{res}")
-        say("")
-        foreign = sum(1 for t in self.trees if t.disposition == "foreign")
-        live = sum(1 for t in self.trees if t.disposition == "live")
-        say(f"SUMMARY: {len(self.trees)} tree(s): {self.retire_count()} to retire · "
-            f"{live} live · {foreign} foreign"
-            + (f" · {len(self.legs)} leg checkout(s), "
-               f"{sum(1 for g in self.legs if g.retire)} counted" if self.legs else "")
-            + (f" · archive {tilde(self.archive)}" if self.archive else ""))
-
-    def porcelain(self) -> None:
-        f = self.facts
-        prow("lane", self.lane, f.state or "-", f.holder or "-",
-             f.holder_uuid or "-", f.binding or "-", f.verdict or "-")
-        if self.refusal:
-            prow("refused", self.refusal)
-        for t in self.trees:
-            prow("tree", t.disposition, "retire" if t.retire else "-", t.path,
-                 t.branch or ("(detached)" if t.detached else "-"), t.head or "-",
-                 t.reason + (f" -> {t.result}" if t.result else ""))
-        for g in self.legs:      # T018
-            prow("leg", g.disposition, "retire" if g.retire else "-", g.path,
-                 g.branch or ("(detached)" if g.detached else "-"), g.head or "-", g.reason)
-        for i in self.items:
-            prow(i.kind, i.disposition, "retire" if i.retire else "-", i.path,
-                 i.detail or "-", str(i.size), i.reason + (f" -> {i.result}" if i.result else ""))
-        prow("summary", self.retire_count(), len(self.trees),
-             sum(1 for t in self.trees if t.disposition == "live"),
-             sum(1 for t in self.trees if t.disposition == "foreign"))
-
-    # -------------------------------------------------------------- acting
-    def act(self) -> None:
-        self.acting = True
-        os.umask(0o077)
-        for t in self.trees:
-            if t.disposition in ("live", "foreign", "keep", "gone", "load-bearing", ""):
-                continue
-            if self.halt:
-                # NOTHING MORE IS ACTED ON once a self-check refused or the
-                # register refused a line (#170 B6): what is left is exactly
-                # as the table found it.
-                t.result = "left: " + self.halt
-                continue
-            try:
-                self._act_tree(t)
-            except _Keep as exc:
-                t.disposition = "keep"
-                t.result = "left: " + str(exc)
-            except _SelfCheck as exc:
-                t.result = "REFUSED by the self-check: " + str(exc)
-                self.refused_check = f"{t.path}: {exc}"
-                self.halt = (f"the self-check refused {t.path} ({exc}); no further act is taken "
-                             "until that is understood")
-                note(f"REFUSED by the self-check before removing {t.path}: {exc}")
-            except _ActFailed as exc:
-                t.result = "FAILED: " + str(exc)
-                self.failed += 1
-            except OSError as exc:
-                t.result = f"FAILED: {exc}"
-                self.failed += 1
-            self._record(t)
-        for i in self.items:
-            if self.halt:
-                if i.retire or i.disposition in ("remove", "archive+remove", "delete",
-                                                 "delete+remote"):
-                    i.result = "left: " + self.halt
-                continue
-            try:
-                self._act_item(i)
-            except _SelfCheck as exc:
-                i.result = "REFUSED by the self-check: " + str(exc)
-                self.refused_check = f"{i.path}: {exc}"
-                self.halt = (f"the self-check refused {i.kind} {i.path} ({exc}); no further act "
-                             "is taken until that is understood")
-                note(f"REFUSED by the self-check before deleting {i.kind} {i.path}: {exc}")
-                self._archive_dir()
-            except (_ActFailed, OSError) as exc:
-                i.result = "FAILED: " + str(exc)
-                self.failed += 1
-        self._register_items()
-        if self.archive:
-            self._write_disposition()
-
-    def _archive_dir(self) -> str:
-        """This invocation's archive, created EXCLUSIVELY: two sweeps started
-        in one second never share - and overwrite - one ledger."""
-        if not self.archive:
-            parent = os.path.join(sweeps_dir(), safe_ref_part(self.lane))
-            os.makedirs(parent, mode=0o700, exist_ok=True)
-            path, n = os.path.join(parent, self.stamp), 1
-            while True:
-                try:
-                    os.mkdir(path, 0o700)
-                    break
-                except FileExistsError:
-                    n += 1
-                    path = os.path.join(parent, f"{self.stamp}-{n}")
-            self.archive = path
-        return self.archive
-
-    def _rescue_name(self, t: Tree, suffix: str = "") -> str:
-        base = f"rescue/{safe_ref_part(self.lane)}/{t.slice}-{self.stamp}{suffix}"
-        name, n = base, 1
-        while git(t.gitpath, "rev-parse", "-q", "--verify", f"refs/heads/{name}").returncode == 0:
-            n += 1
-            name = f"{base}-{n}"
-        return name
-
-    def _occupied(self, path: str, writer: str = "") -> str:
-        """Why `path` may NOT be touched now, or '' - asked afresh: processes,
-        open files and tmux panes, and the session that recorded it. A scan
-        that could not be made is a reason, never a pass."""
-        fresh = ProcScan()
-        if not fresh.available:
-            return "liveness could not be read: " + (fresh.why or "no process scan")
-        held = fresh.holders(path)
-        if held:
-            pid, comm, kind, _w = held[0]
-            return f"process {pid} ({comm or '?'}) has its {kind} there"
-        hidden = fresh.unknown_for(path)
-        if hidden:
-            return "liveness could not be read: " + hidden
-        if writer and UUID_RE.match(writer) and writer != self.caller:
-            answer = self.helper.transcript_live(writer, fresh=True)
-            if answer != "none":
-                return (f"the session that recorded it ({writer[:8]}) is "
-                        + ("live" if answer == "live" else "of unknown liveness"))
-        return ""
-
-    # ---------------------------------------------- what a removal would take
-    def _common(self, path: str) -> str:
-        common = git_out(path, "rev-parse", "--git-common-dir") or ""
-        if common and not os.path.isabs(common):
-            common = os.path.normpath(os.path.join(path, common))
-        return real(common) if common else ""
-
-    def _loss_plan(self, t: Tree):
-        """(where git is asked, candidate commits, what keeps them) for the
-        removal `t`'s disposition makes - or why it could not be read.
-
-        A WORKTREE'S removal takes its own git directory: its HEAD and that
-        HEAD's reflog (and, where its branch is deleted after it, the branch
-        and the branch's reflog). Every branch, tag and stash of the
-        repository stays. A PRUNED registration takes the same, read from its
-        git directory, the working tree being gone already. A CLONE's removal
-        takes everything in it: every ref but its remote-tracking ones, and
-        every reflog."""
-        if not t.exists:
-            co = t.checkout
-            admin = worktree_admin(co, t.path) if co else ""
-            if not admin:
-                return None, f"the git directory of its registration in {co or '?'} was not found"
-            logs, why = reflog_shas([os.path.join(admin, "logs", "HEAD")])
-            if logs is None:
-                return None, why
-            return (co, [(t.reg or {}).get("head", "")] + logs,
-                    ["--remotes=origin", "--branches", "--tags", "--glob=refs/stash"]), ""
-        gitdir = git_out(t.path, "rev-parse", "--absolute-git-dir")
-        if not gitdir:
-            return None, "its git directory could not be read"
-        if t.kind == "clone":
-            refs = git(t.path, "for-each-ref", "--format=%(refname) %(objectname) %(objecttype)",
-                       "refs/")
-            if refs.returncode != 0:
-                return None, "its refs could not be read"
-            rows = [line.split(" ") for line in refs.stdout.splitlines()
-                    if len(line.split(" ")) == 3 and not line.startswith("refs/remotes/")]
-            tips = [sha for _ref, sha, _otype in rows]
-            tags = [sha for ref, sha, otype in rows if ref.startswith("refs/tags/") and otype == "tag"]
-            files, why = reflog_files(gitdir)
-            if files is None:
-                return None, why
-            logs, why = reflog_shas(files)
-            if logs is None:
-                return None, why
-            return (t.path, tips + [t.head] + logs,
-                    ["--remotes=origin"] + origin_tag_objects(t.path, tags)), ""
-        logs_files = [os.path.join(gitdir, "logs", "HEAD")]
-        keep = ["--remotes=origin"]
-        if t.disposition == "remove+delete-branch" and t.branch:
-            logs_files.append(os.path.join(t.common, "logs", "refs", "heads", *t.branch.split("/")))
-            keep.append(f"--exclude={t.branch}")
-        keep += ["--branches", "--tags", "--glob=refs/stash"]
-        logs, why = reflog_shas(logs_files)
-        if logs is None:
-            return None, why
-        return (t.path, [t.head] + logs, keep), ""
-
-    def _lost(self, t: Tree) -> list:
-        """The commits the removal would take that are on origin, in a
-        surviving ref, pushed and seen this run, or in a bundle of this run -
-        none of them. Raises when that cannot be read: unknown is never
-        'nothing'."""
-        plan, why = self._loss_plan(t)
-        if plan is None:
-            raise _ActFailed("which commits its removal would take could not be read (" + why
-                             + "); left in place" + (f"; its rescue is at {t.rescue}"
-                                                     if t.rescue else ""))
-        where, cands, keep = plan
-        common = self._common(where)
-        kept = sorted(self.verified.get(common, set()) | self.bundled.get(common, set()))
-        lost = lost_tips(where, cands, keep + kept)
-        if lost is None:
-            raise _ActFailed("whether its commits are kept elsewhere could not be read (git "
-                             "rev-list failed); left in place")
-        return lost
-
-    def _branch_lost(self, co: str, branch: str, tip: str) -> list:
-        """What deleting `refs/heads/<branch>` (at `tip`) in `co` would take
-        that no origin ref, other branch, tag, stash, push or bundle of this
-        run keeps: its tip and every commit its reflog names. Raises when
-        that cannot be read - unknown is never 'nothing'."""
-        common = self._common(co)
-        if not common:
-            raise _ActFailed("the repository's git directory could not be read; the branch is left")
-        logs, why = reflog_shas([os.path.join(common, "logs", "refs", "heads", *branch.split("/"))])
-        if logs is None:
-            raise _ActFailed(why + "; the branch is left")
-        keep = ["--remotes=origin", f"--exclude={branch}", "--branches", "--tags",
-                "--glob=refs/stash"]
-        kept = sorted(self.verified.get(common, set()) | self.bundled.get(common, set()))
-        lost = lost_tips(co, [tip] + logs, keep + kept)
-        if lost is None:
-            raise _ActFailed("whether its commits are kept elsewhere could not be read (git "
-                             "rev-list failed); the branch is left")
-        return lost
-
-    def _self_check(self, t: Tree) -> None:
-        """NOTHING IS DELETED THAT IS NOT FIRST ON ORIGIN OR IN A BUNDLE, asked
-        one last time of git itself, right before the removal: every commit
-        the removal would take must be reachable from origin, from a ref that
-        stays, from a push seen on origin this run, or from the heads of a
-        bundle this run wrote and verified. Anything else is a defect in the
-        table above, and the sweep stops (exit 2) rather than act on it."""
-        try:
-            lost = self._lost(t)
-        except _ActFailed as exc:
-            raise _SelfCheck(str(exc))
-        if lost:
-            raise _SelfCheck(f"{len(lost)} commit(s) it would take are neither on origin nor in a "
-                             f"bundle (e.g. {short(lost[0])})")
-
-    def _bundle_lost(self, t: Tree, lost: list, label: str) -> str:
-        """A bundle of commits no ref names: each is given a temporary ref
-        (`refs/lane-worktrees/<slice>-<UTC>/<label>-<n>`, the name it carries
-        in the bundle), the bundle is made and verified, and the refs are
-        deleted. The ledger records it as the only copy."""
-        return self._bundle_lost_at(t.gitpath, t.slice, lost, label, t.checkout or "", t.path)
-
-    def _bundle_lost_at(self, where: str, slice_: str, lost: list, label: str,
-                        checkout: str, what: str) -> str:
-        prefix = f"refs/lane-worktrees/{slice_}-{self.stamp}"
-        made = []
-        try:
-            for n, sha in enumerate(lost, 1):
-                ref = f"{prefix}/{label}-{n}"
-                self._git_or_fail(where, "update-ref", ref, sha, "")
-                made.append(ref)
-            out = self._bundle_at(where, slice_, made)
-        finally:
-            for ref in made:
-                git(where, "update-ref", "-d", ref)
-        self._ledger_row(out, lost[0], checkout, what)
-        return out
-
-    def _ledger_bundle(self, t: Tree, bundle: str, sha: str) -> None:
-        self._ledger_row(bundle, sha, t.checkout or "", t.path)
-
-    def _ledger_row(self, bundle: str, sha: str, checkout: str, what: str) -> None:
-        """`rescues.tsv`'s row for a bundle that is the ONLY copy of what it
-        holds (#170 item 8): origin `-`, branch `bundle:<file>`. `--expire`
-        reads such a row as "no other copy" and never expires the archive."""
-        if sha:
-            self.rescues.append(("-", f"bundle:{os.path.basename(bundle)}", sha, checkout, what))
-
-    def _act_tree(self, t: Tree) -> None:
-        # LIVENESS IS ASKED AGAIN AT THE MOMENT OF THE ACT, not trusted from the
-        # read: a writer may have started in the tree since the table was made.
-        writer = (t.sidecar or {}).get("writer", "")
-        if t.exists:
-            why = self._occupied(t.path, writer)
-            if why:
-                t.disposition = "live" if not why.startswith("liveness") else "keep"
-                t.result = f"left: {why}"
-                return
-        if t.disposition in ("prune", "rescue+prune"):
-            self._act_prune(t)
-            return
-        guard = tree_guards(t) if t.exists else ""
-        if guard:
-            t.disposition = "keep"
-            t.result = "left: " + guard
-            return
-        # A SUBMODULE'S ANNOTATED TAG IS AN OBJECT OF ITS OWN (#174, Copilot
-        # round 2) - asked here, at the act, because it asks each remote.
-        why = module_tags_why(git_out(t.path, "rev-parse", "--absolute-git-dir") or "")
-        if why:
-            raise _Keep(why + "; the tree's removal takes that repository with it")
-        # 1. RESCUE OR PUBLISH FIRST - nothing below removes what is not on
-        # origin or in a bundle.
-        disp = t.disposition
-        refs_to_bundle: list = []
-        drop_after_bundle: list = []
-        only_copy = ""
-        wip_tree = ""
-        if disp == "wip-rescue+remove":
-            wip_tree, refs_to_bundle, drop_after_bundle, only_copy = self._wip_rescue(t)
-        elif disp == "rescue+remove":
-            name = self._rescue_name(t)
-            self._git_or_fail(t.path, "update-ref", f"refs/heads/{name}", t.head, "")
-            self._push(t, name, name)
-            refs_to_bundle = [name]
-            t.rescue = f"origin/{name}"
-        elif disp == "push+remove":
-            self._push(t, t.branch, t.remote_branch or t.branch)
-            refs_to_bundle = [t.branch] if self.opts.bundle else []
-            t.rescue = f"origin/{t.remote_branch or t.branch}"
-        elif disp in ("remove", "remove+delete-branch"):
-            refs_to_bundle = [t.branch or "HEAD"] if self.opts.bundle and t.head else []
-        elif disp == "bundle+remove":
-            if t.kind == "clone" and lfs_store_holds(t.common):
-                raise _Keep(LFS_STORE_WHY)
-            refs_to_bundle = [t.branch or "HEAD"]
-            only_copy = t.head
-        # 2. THE BUNDLE - always for a rescue, and for everything under --bundle.
-        if refs_to_bundle:
-            try:
-                t.bundle = self._bundle(t, refs_to_bundle)
-            finally:
-                for ref in drop_after_bundle:
-                    git(t.path, "update-ref", "-d", ref)
-            if only_copy:
-                self._ledger_bundle(t, t.bundle, only_copy)
-        # 2b. WHAT THE REMOVAL WOULD STILL TAKE (#170 A5): a commit only the
-        # tree's reflog names (an amend, a reset, a checkout away from a
-        # detached commit) is in no ref, so no push and no ref bundle above
-        # carried it. It goes to a bundle of its own.
-        lost = self._lost(t)
-        # A CLONE'S LOCAL GIT-LFS STORE GOES WITH IT (#174, Copilot round 2): a
-        # bundle carries the pointers of commits only it holds, never the bytes
-        # under `.git/lfs/objects`, and no push uploaded them.
-        if lost and t.kind == "clone" and lfs_store_holds(t.common):
-            raise _Keep(LFS_STORE_WHY)
-        if lost and os.environ.get(SEAM_NO_LOSS_BUNDLE, "") != "1":
-            t.lost_bundle = self._bundle_lost(t, lost, "unreachable")
-        # 3. IGNORED WORK no commit could carry.
-        extra = ignored_work(t)
-        if extra is None:
-            raise _ActFailed("its ignored files could not be listed, so whether it holds an "
-                             ".env or local configuration no commit carries is unknown; left "
-                             "in place" + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-        # TAKEN BEFORE THE ARCHIVE and compared at removal, so a change made
-        # while the tar ran leaves the tree too.
-        ignored_before = ignored_print(t.path, extra)
-        if extra:
-            size = sum(dir_size(os.path.join(t.path, r)) if os.path.isdir(os.path.join(t.path, r))
-                       else os.lstat(os.path.join(t.path, r)).st_size for r in extra
-                       if os.path.lexists(os.path.join(t.path, r)))
-            cap = self.conf["ignored_archive_mb"] * 1024 * 1024
-            if size > cap:
-                raise _ActFailed(f"{human_size(size)} of ignored files no commit can carry "
-                                 f"(over ignored_archive_mb={self.conf['ignored_archive_mb']}): "
-                                 "move or delete them by hand, or raise the cap; left in place"
-                                 + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-            t.ignored_archive = self._tar(t.path, extra,
-                                          f"{t.slice}-ignored.tar.gz")
-        # 4. NOTHING MOVED, PROVED AGAIN AT THE MOMENT OF REMOVAL: no writer
-        # arrived while the pushes, bundles and archives ran; the head is the
-        # one classified; and the content is clean - or, for a WIP rescue, is
-        # byte for byte the tree the rescue commit carries.
-        why = self._occupied(t.path, writer)
-        if why:
-            raise _ActFailed(f"{why} - it arrived while the rescue was made; left in place"
-                             + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-        # THE IGNORED FILES ARE THE ONES ARCHIVED: none changed, appeared or
-        # went since the list was taken - neither `git status` nor the WIP
-        # snapshot sees an `.env`.
-        again_ignored = ignored_work(t)
-        if again_ignored is None or ignored_print(t.path, again_ignored) != ignored_before:
-            raise _ActFailed("its ignored files changed after they were archived (or could not "
-                             "be listed again); left in place"
-                             + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-        head_now = git_out(t.path, "rev-parse", "-q", "--verify", "HEAD") or ""
-        if head_now != t.head:
-            raise _ActFailed(f"HEAD moved from {short(t.head) or 'none'} to "
-                             f"{short(head_now) or 'none'} under the sweep; left in place"
-                             + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-        if wip_tree:
-            if snapshot_tree(t.path) != wip_tree:
-                raise _ActFailed("the tree changed after its rescue was taken; left in place; "
-                                 f"the rescue is at {t.rescue or tilde(t.bundle)}")
-        else:
-            again = git(t.path, "status", "--porcelain=v1", "--ignore-submodules=none",
-                        "--untracked-files=normal")
-            if again.returncode != 0 or again.stdout.strip():
-                raise _ActFailed("the tree changed under the sweep (git status is not clean); "
-                                 "left in place"
-                                 + (f"; its rescue is at {t.rescue}" if t.rescue else ""))
-        # 5. THE INVARIANT, ASKED OF GIT ONE LAST TIME (see `_self_check`).
-        self._self_check(t)
-        checkout = t.checkout or os.path.dirname(t.common.rstrip("/"))
-        if t.kind == "worktree":
-            co = t.checkout if t.checkout and os.path.isdir(t.checkout) else t.path
-            proc = git(co, "worktree", "remove", "--force", t.path)
-            if proc.returncode != 0:
-                raise _ActFailed("git worktree remove: " + _first_line(proc.stderr))
-        else:
-            rmtree(t.path)
-        if os.path.exists(t.path):
-            raise _ActFailed("the directory is still there after the removal")
-        t.result = "removed" + ((f"; pushed to {t.rescue}" if disp == "push+remove" else
-                                 f"; rescue {t.rescue}") if t.rescue else "")
-        if t.held_back:
-            t.result += "; untracked files in the bundle only"
-        if t.lost_bundle:
-            t.result += f"; commits no other ref keeps {tilde(t.lost_bundle)}"
-        # 6. THE BRANCHES OF A MERGED TREE - each deleted only AT THE SHA THAT
-        # WAS JUDGED merged, so a branch that moved under the sweep is kept.
-        if disp == "remove+delete-branch" and t.branch:
-            co = t.checkout if t.checkout and os.path.isdir(t.checkout) else checkout
-            done, why = delete_local_branch(co, t.branch, t.head)
-            t.result += "; local branch deleted" if done else "; local branch NOT deleted: " + why
-            if not done:
-                self.failed += 1
-            head = (t.merge or {}).get("head", "")
-            ours = t.lane_trailer.lower() == self.lane.lower()
-            gh_open = (t.merge or {}).get("gh_open") or []
-            if t.remote_tip and gh_open:
-                t.result += f"; remote branch kept (gh still answers PR #{gh_open[0]} OPEN)"
-            elif t.remote_tip and ours and head and (t.remote_tip == head or git(
-                    co, "merge-base", "--is-ancestor", t.remote_tip, head).returncode == 0):
-                done, why = delete_remote_branch(co, t.remote_branch, t.remote_tip)
-                t.result += "; remote branch deleted" if done else "; remote branch NOT deleted: " + why
-                if not done:
-                    self.failed += 1
-            elif t.remote_tip:
-                t.result += ("; remote branch kept (" + ("its Lane: trailer is "
-                             + (t.lane_trailer or "absent") if not ours else
-                             "it holds commits the PR head does not") + ")")
-        self._note(t, f"swept {t.path}: {disp} (was {t.label()})"
-                   + ((f"; pushed to {t.rescue}" if disp == "push+remove" else
-                       f"; rescue {t.rescue}") if t.rescue else "")
-                   + (f"; bundle {tilde(t.bundle)}" if t.bundle else "")
-                   + ("; untracked files in the bundle only" if t.held_back else "")
-                   + (f"; commits no other ref keeps {tilde(t.lost_bundle)}" if t.lost_bundle
-                      else "")
-                   + (f"; ignored files {tilde(t.ignored_archive)}" if t.ignored_archive else "")
-                   + f"; archive {tilde(self._archive_dir())}")
-
-    def _act_prune(self, t: Tree) -> None:
-        """A registration whose directory is gone: that one registration is
-        removed - after the commits only its git directory names (its HEAD,
-        detached, and that HEAD's reflog) are rescued (#170 A4)."""
-        if os.path.lexists(t.path):
-            # IT CAME BACK while the sweep ran (a remount, a restore): it is a
-            # tree again, and it is classified afresh by the next sweep, never
-            # removed on a reading taken while it was gone.
-            t.disposition = "keep"
-            t.result = "left: the directory reappeared after it was read as gone; sweep again"
-            return
-        co = t.checkout
-        admin = worktree_admin(co, t.path) if co else ""
-        mod_why = (module_repos_why(admin) or module_tags_why(admin)) if admin else ""
-        if mod_why:
-            raise _Keep("its git directory keeps a submodule repository that would be lost: "
-                        + mod_why)
-        lost = self._lost(t)
-        head = (t.reg or {}).get("head", "")
-        if lost and head in lost and git_out(co, "config", "--get", "remote.origin.url"):
-            name = self._rescue_name(t)
-            self._git_or_fail(co, "update-ref", f"refs/heads/{name}", head, "")
-            self._push(t, name, name)
-            t.rescue = f"origin/{name}"
-            t.bundle = self._bundle(t, [name])
-            lost = self._lost(t)
-        if lost:
-            t.lost_bundle = self._bundle_lost(t, lost, "pruned")
-        self._self_check(t)
-        # THAT ONE REGISTRATION: `git worktree prune` would unregister every
-        # missing tree of the repository - another lane's, a FOREIGN one,
-        # one on a disk that is not mounted - and say nothing of it.
-        proc = git(co, "worktree", "remove", t.path)
-        if proc.returncode != 0:
-            raise _ActFailed("git worktree remove " + t.path + ": " + _first_line(proc.stderr)
-                             + " - a repository-wide prune is never run in its place")
-        regs = worktree_registrations(co)
-        if regs is None:
-            raise _ActFailed("the registrations could not be read again after the prune")
-        if t.path in [r["path"] for r in regs]:
-            raise _ActFailed("the registration is still there after the prune")
-        t.result = "pruned" + (f"; rescue {t.rescue}" if t.rescue else "") + (
-            f"; bundle {tilde(t.bundle)}" if t.bundle else "") + (
-            f"; commits no other ref keeps {tilde(t.lost_bundle)}" if t.lost_bundle else "")
-        self._note(t, f"swept {t.path}: stale registration pruned in {co}"
-                   + (f"; rescue {t.rescue}" if t.rescue else "")
-                   + (f"; bundle {tilde(t.bundle)}" if t.bundle else "")
-                   + (f"; commits no other ref keeps {tilde(t.lost_bundle)}" if t.lost_bundle
-                      else ""))
-
-    def _wip_rescue(self, t: Tree) -> tuple:
-        """The WIP rescue: (the tree `git add -A` makes, refs to bundle, refs
-        to delete once bundled, the commit only the bundle holds).
-
-        THE WORK IS COMMITTED BESIDE THE TREE, NOT INTO IT: a temporary index
-        takes the add, and `commit-tree` + `update-ref` make the rescue
-        branch. The tree's own branch, index and files are never moved, so a
-        push that fails leaves it exactly as it was.
-
-        UNTRACKED FILES ARE NEVER PUSHED unless `--push-untracked` (#170 A9):
-        an un-ignored `gcp-service-account.json` is a file nobody meant to
-        commit. The pushed WIP commit carries the tracked changes only, and a
-        second commit on it with every untracked file goes to the bundle
-        alone - through a temporary ref, so it is in no branch."""
-        full = snapshot_tree(t.path)
-        if not full:
-            raise _ActFailed("the tree's content could not be snapshotted (git add -A into "
-                             "a temporary index failed); left in place")
-        # WHAT IS UNTRACKED IS READ FROM THE SNAPSHOTS, NOW - never from the
-        # table's status (#174, Copilot round 1): a tree with only tracked
-        # changes when it was read, and an untracked key file by the time of
-        # the rescue, pushed the key with the full snapshot. The pushed one is
-        # tracked-only unless `--push-untracked`, and whatever the full one
-        # holds beyond it goes to the bundle alone.
-        pushed = full if self.opts.push_untracked else snapshot_tree(t.path, tracked_only=True)
-        if not pushed:
-            raise _ActFailed("the tree's tracked changes could not be snapshotted; left in place")
-        untracked: list = []
-        if pushed != full:
-            untracked = tree_paths_between(t.path, pushed, full)
-            if untracked is None:
-                raise _ActFailed("which files would go to the bundle only could not be read (git "
-                                 "diff-tree failed); left in place")
-        hold = pushed != full
-        if hold:
-            # A BUNDLE CARRIES A GIT-LFS POINTER, NEVER ITS BYTES (#174, Copilot
-            # round 1): checked BEFORE anything is pushed.
-            why = lfs_untracked_why(t.path, untracked)
-            if why:
-                raise _Keep(why)
-        head_tree = (git_out(t.path, "rev-parse", "HEAD^{tree}") if t.head else EMPTY_TREE) or ""
-        subject = f"WIP({self.lane}): {t.slice} swept {self.stamp}; swept, not reviewed"
-        body = (f"Rescued by {PROG} sweep from {t.path} (branch "
-                f"{t.branch or 'detached'} at {short(t.head) if t.head else 'no commit'}). "
-                "The tree held uncommitted or untracked work when its lane was swept; "
-                "this commit is that work as it stood, unreviewed.")
-        tip = t.head
-        if pushed != head_tree:
-            tip = self._commit_tree(t.path, pushed, t.head, subject, body)
-        refs, drop = [], []
-        if tip and (tip != t.head or t.on_origin is not True):
-            name = self._rescue_name(t)
-            self._git_or_fail(t.path, "update-ref", f"refs/heads/{name}", tip, "")
-            self._push(t, name, name)
-            refs.append(name)
-            t.rescue = f"origin/{name}"
-        only = ""
-        if hold:
-            held = self._commit_tree(
-                t.path, full, tip,
-                f"WIP({self.lane}): {t.slice} untracked files {self.stamp}; bundle only, never "
-                "pushed",
-                f"The {len(untracked)} untracked path(s) of {t.path} when its lane was swept "
-                f"(e.g. {untracked[0] if untracked else '?'}). They were never pushed: an "
-                "untracked file may be a "
-                "credential nobody meant to commit. This commit is in this bundle only.")
-            tmp = f"refs/lane-worktrees/{t.slice}-{self.stamp}/untracked"
-            self._git_or_fail(t.path, "update-ref", tmp, held, "")
-            refs.append(tmp)
-            drop.append(tmp)
-            t.held_back = held
-            only = held
-        return full, refs, drop, only
-
-    def _git_or_fail(self, path: str, *args: str) -> str:
-        proc = git(path, *args)
-        if proc.returncode != 0:
-            raise _ActFailed(f"git {' '.join(args)}: " + _first_line(proc.stderr))
-        return proc.stdout
-
-    def _commit_tree(self, path: str, tree: str, parent: str, subject: str, body: str) -> str:
-        """A commit of `tree` on `parent`, made without touching any branch,
-        index or file - unsigned, because a rescue must not wait on a key."""
-        args = []
-        if not git_out(path, "config", "--get", "user.email"):
-            args += ["-c", "user.email=lane-worktrees@localhost", "-c", "user.name=lane-worktrees"]
-        msg = f"{subject}\n\n{body}\n\nLane: {self.lane}\n"
-        argv = ["git", "-C", path, *args, "commit-tree", "--no-gpg-sign", tree]
-        if parent:
-            argv += ["-p", parent]
-        proc = run(argv + ["-F", "-"], env=git_env(), input_text=msg)
-        if proc.returncode != 0 or not proc.stdout.strip():
-            raise _ActFailed("git commit-tree: " + _first_line(proc.stderr + proc.stdout))
-        return proc.stdout.strip()
-
-    def _push(self, t: Tree, local: str, remote: str) -> None:
-        where = t.gitpath
-        # GIT-LFS UPLOADS ITS OBJECTS FROM ITS PRE-PUSH HOOK (#170 A10): with
-        # `--no-verify` a rescued branch reached origin as pointers only, and
-        # the tree - the one copy of the objects - was then removed. Where the
-        # repository has git-lfs configured the hooks run; a hook that
-        # refuses leaves the tree.
-        verify = [] if lfs_configured(where) else ["--no-verify"]
-        proc = git(where, "push", *verify, "--quiet", "origin",
-                   f"refs/heads/{local}:refs/heads/{remote}", timeout=GIT_NET_TIMEOUT)
-        if proc.returncode != 0:
-            raise _ActFailed(f"git push origin {local}:{remote}: " + _first_line(proc.stderr))
-        local_sha = git_out(where, "rev-parse", f"refs/heads/{local}") or ""
-        seen = git(where, "ls-remote", "origin", f"refs/heads/{remote}", timeout=GIT_NET_TIMEOUT)
-        got = seen.stdout.split()[0] if seen.returncode == 0 and seen.stdout.split() else ""
-        if not local_sha or got != local_sha:
-            raise _ActFailed(f"origin does not show refs/heads/{remote} at {short(local_sha)} "
-                             f"after the push (it shows {short(got) or 'nothing'}); the tree is left")
-        self.verified.setdefault(self._common(where), set()).add(local_sha)
-        # ONLY A RESCUE BRANCH PINS ITS ARCHIVE (`--expire`): a branch pushed as
-        # is is the lane's own, and its later merge and deletion is no loss.
-        if remote.startswith("rescue/"):
-            origin = t.origin_url or git_out(where, "config", "--get", "remote.origin.url") or ""
-            self.rescues.append((origin, remote, local_sha, t.checkout or "", t.path))
-
-    def _bundle(self, t: Tree, refs: list) -> str:
-        """A bundle of `refs` holding what origin's default branch lacks (its
-        prerequisites are on origin), or the whole history where that would be
-        empty or origin has no default branch here. Its heads are recorded:
-        they are what the self-check counts as bundled."""
-        return self._bundle_at(t.gitpath, t.slice, refs)
-
-    def _bundle_at(self, where: str, slice_: str, refs: list) -> str:
-        out = os.path.join(self._archive_dir(), f"{slice_}.bundle")
-        n = 1
-        while os.path.exists(out):
-            n += 1
-            out = os.path.join(self._archive_dir(), f"{slice_}-{n}.bundle")
-        base = git_out(where, "symbolic-ref", "-q", "refs/remotes/origin/HEAD") or ""
-        if not base and git(where, "rev-parse", "-q", "--verify",
-                            "refs/remotes/origin/main").returncode == 0:
-            base = "refs/remotes/origin/main"
-        proc = git(where, "bundle", "create", out, *refs, "--not", base) if base else None
-        if proc is None or proc.returncode != 0:
-            if os.path.exists(out):
-                os.unlink(out)
-            proc = git(where, "bundle", "create", out, *refs)
-        if proc.returncode != 0:
-            raise _ActFailed("git bundle create: " + _first_line(proc.stderr))
-        check = git(where, "bundle", "verify", out)
-        if check.returncode != 0:
-            raise _ActFailed("git bundle verify: " + _first_line(check.stderr))
-        heads = git(where, "bundle", "list-heads", out)
-        if heads.returncode != 0:
-            raise _ActFailed("git bundle list-heads: " + _first_line(heads.stderr))
-        self.bundled.setdefault(self._common(where), set()).update(
-            line.split()[0] for line in heads.stdout.splitlines() if line.split())
-        return out
-
-    def _tar(self, base: str, rels: list, name: str) -> str:
-        """`rels` under `base`, archived and read back: EVERY ENTRY SELECTED IS
-        IN IT. Caches and bytecode are left out only BENEATH a selected entry,
-        never because of the entry's own ancestors (#174, Copilot round 1):
-        `docker/node_modules/prod.env` is an ignored file in a tracked
-        directory, selected on its own name, and a filter that read every
-        part of the member's path dropped it - while `top.env` beside it kept
-        the archive non-empty, so it verified and the tree went."""
-        out = os.path.join(self._archive_dir(), name)
-        n = 1
-        while os.path.exists(out):
-            n += 1
-            out = os.path.join(self._archive_dir(), name.replace(".tar.gz", f"-{n}.tar.gz"))
-        wanted = [rel.rstrip("/") for rel in rels]
-        try:
-            with tarfile.open(out, "w:gz") as tf:
-                for rel in wanted:
-                    tf.add(os.path.join(base, rel), arcname=rel, recursive=True,
-                           filter=_no_caches_beneath(rel))
-            with tarfile.open(out, "r:gz") as tf:
-                names = set(tf.getnames())
-        except (OSError, tarfile.TarError) as exc:
-            raise _ActFailed(f"the archive {out} could not be written: {exc}")
-        missing = [rel for rel in wanted if rel not in names]
-        if not names or missing:
-            raise _ActFailed(f"the archive {out} came back without "
-                             + (f"{missing[0]}{' and more' if len(missing) > 1 else ''}"
-                                if missing else "anything") + "; left in place")
-        return out
-
-    def _act_item(self, i: Item) -> None:
-        if i.kind == "scratch" and i.disposition == "archive+remove":
-            why = self._occupied(i.path)
-            if why:
-                i.disposition = "live" if not why.startswith("liveness") else "keep"
-                i.result = "left: " + why
-                return
-            inner = self._trees_inside(i.path)
-            if inner:
-                i.disposition, i.result = "keep", "left: " + inner
-                return
-            before = content_print(i.path)
-            parent, name = os.path.dirname(i.path), os.path.basename(i.path)
-            i.extra["archive"] = self._tar(parent, [name], f"scratch-{safe_ref_part(name)}.tar.gz")
-            # WHAT IS REMOVED IS WHAT WAS ARCHIVED: no writer arrived while the
-            # tar ran, and nothing outside the caches changed.
-            why = self._occupied(i.path)
-            if why:
-                raise _ActFailed(f"{why} - it arrived while the archive was made; left in place; "
-                                 f"the archive is {tilde(i.extra['archive'])}")
-            if content_print(i.path) != before or self._trees_inside(i.path):
-                raise _ActFailed("it changed while it was archived; left in place; the archive "
-                                 f"{tilde(i.extra['archive'])} is of what it was")
-            rmtree(i.path)
-            i.result = "archived and removed"
-        elif i.kind == "cache" and i.disposition == "remove":
-            # (14) THE OWNING TREE IS ASKED AGAIN: a writer may have started
-            # there while the rescues ran, or the tree's own act left it live.
-            owner = i.extra.get("owner") or i.path
-            left = [t for t in self.trees if under(i.path, t.path) and self._cache_protected(t)]
-            why = ("its tree was left: " + (left[0].result or left[0].reason)) if left \
-                else self._occupied(owner) or repository_within(i.path)
-            if why:
-                i.disposition = "keep"
-                i.result = "left: " + why
-                return
-            rmtree(i.path)
-            i.result = "removed"
-        elif i.kind == "sandbox" and i.disposition == "remove":
-            # ITS OWNER IS ASKED AGAIN: a pytest `.lock` may name a live pid
-            # now - a run that works outside the directory holds nothing in it.
-            if i.extra.get("kind") == "pytest":
-                owner = _lock_pid(os.path.join(i.path, ".lock"))
-                if owner and pid_alive(owner):
-                    i.disposition, i.result = "live", f"left: its .lock names live pid {owner}"
-                    return
-            if i.extra.get("kind") == "mktemp":
-                # NEVER A `tmp.*` (#170 item 1, option (b)): the table lists one
-                # and never asks this, so reaching here is a defect - it is left.
-                i.disposition, i.result = "list", "left: a tmp.* is listed, never removed"
-                return
-            fresh = ProcScan()
-            fresh.load_environ()
-            if not fresh.available or fresh.holders(i.path) or fresh.unknown_for(i.path):
-                i.disposition, i.result = "live", "left: a process arrived in it, or one of " \
-                                                  "this account that cannot be read is placed there"
-                return
-            rmtree(i.path)
-            i.result = "removed"
-        elif i.kind == "branch" and i.disposition in ("delete", "delete+remote"):
-            # THE BRANCH'S REFLOG GOES WITH THE REF (#174, Copilot round 1): an
-            # experiment committed on it and reset away from is reachable from
-            # that reflog alone, and `update-ref -d` deleted its last pointer
-            # with no loss plan, no bundle and no self-check. The same three a
-            # tree's branch delete has are asked here.
-            co, branch, tip = i.extra["checkout"], i.extra["branch"], i.extra.get("tip", "")
-            slice_ = "branch-" + safe_ref_part(branch)
-            lost = self._branch_lost(co, branch, tip)
-            if lost and os.environ.get(SEAM_NO_LOSS_BUNDLE, "") != "1":
-                i.extra["bundle"] = self._bundle_lost_at(co, slice_, lost, "reflog", co,
-                                                         f"{co} branch {branch}")
-            try:
-                still = self._branch_lost(co, branch, tip)
-            except _ActFailed as exc:
-                raise _SelfCheck(str(exc))
-            if still:
-                raise _SelfCheck(f"{len(still)} commit(s) its delete would take are neither on "
-                                 f"origin nor in a bundle (e.g. {short(still[0])})")
-            done, why = delete_local_branch(co, branch, tip)
-            if not done:
-                raise _ActFailed("the local branch was not deleted: " + why)
-            i.result = "local branch deleted"
-            if i.extra.get("bundle"):
-                i.result += f"; commits only its reflog named {tilde(i.extra['bundle'])}"
-            if i.disposition == "delete+remote":
-                done, why = delete_remote_branch(i.extra["checkout"], i.extra["branch"],
-                                                 i.extra.get("remote_tip", ""))
-                i.extra["remote_deleted"] = done
-                if done:
-                    i.result += "; remote branch deleted"
-                else:
-                    i.result += "; remote branch NOT deleted: " + why
-                    self.failed += 1
-
-    def _register_items(self) -> None:
-        done = [i for i in self.items if i.result
-                and not i.result.startswith(("FAILED", "left", "REFUSED"))]
-        scratch = [i for i in done if i.kind == "scratch"]
-        branches = [i for i in done if i.kind == "branch"]
-        cleaned = [i for i in done if i.kind in ("cache", "sandbox")]
-        if scratch:
-            self._note(None, "swept scratch: " + "; ".join(
-                f"{os.path.basename(i.path)} archived to {tilde(i.extra.get('archive', ''))}"
-                for i in scratch))
-        if branches:
-            self._note(None, "swept branches merged by PR: " + "; ".join(
-                f"{i.extra['branch']} (PR #{i.extra.get('pr')}"
-                f"{' + remote' if i.extra.get('remote_deleted') else ''})"
-                for i in branches))
-        if cleaned:
-            total = sum(i.size for i in cleaned)
-            self._note(None, f"swept {len(cleaned)} cache or sandbox director(ies) "
-                             f"({human_size(total)}): they hold no work and are rebuilt")
-
-    def _note(self, t, text: str) -> None:
-        if self.opts.foreign and self.opts.word and t is not None and t.owner == "foreign":
-            text += f"; foreign on the word '{self.opts.word}'"
-        proc = self.helper.note_line(self.lane, text, self.caller)
-        line = "NOTED " + utc_now() if proc.returncode == 0 else \
-            f"NOT WRITTEN (lanes-edit.sh log exited {proc.returncode}: {_first_line(proc.stderr)})"
-        if t is not None:
-            t.register = line
-        if proc.returncode != 0:
-            self.failed += 1
-            # THE FIRST LINE THE REGISTER REFUSES STOPS THE SWEEP (#170 B6): an
-            # act the register does not record is one nobody can find, and a
-            # register that refused one line will refuse the next.
-            self.halt = self.halt or ("the register refused a line (NOT WRITTEN); nothing more "
-                                      "is acted on until it is written by hand")
-            # THE COMMAND IS QUOTED FOR THE SHELL (#170 E6): it is printed to be
-            # pasted, and a path with a quote or a `$` in it broke it. It names
-            # the session that swept, as the line it stands for does (#170 E7;
-            # #179, Copilot round 1) - each value quoted, never the assignment.
-            assign = [f"LANES_LANE={shlex.quote(self.lane)}"]
-            if self.caller:
-                assign.append(f"LANES_SESSION={shlex.quote(self.caller)}")
-            note(f"the register line for {t.path if t else 'this sweep'} was NOT written "
-                 f"(exit {proc.returncode}); write it by hand: "
-                 + " ".join(assign + [shlex.quote(a) for a in (
-                     "lanes-edit.sh", "log", "NOTED", f"lane:{self.lane}",
-                     register_text(text))]))
-        self.dispositions.append((t.path if t else "-", text, line))
-
-    def _record(self, t: Tree) -> None:
-        if not self.archive and (t.rescue or t.bundle or t.result):
-            self._archive_dir()
-        if self.archive:
-            self._write_disposition()
-
-    def _write_disposition(self) -> None:
-        d = self._archive_dir()
-        lines = [f"# Sweep of lane {self.lane} - {self.stamp}", "",
-                 f"Run by `{PROG} sweep {self.lane} --yes` on "
-                 f"{os.environ.get('LANES_WORKSTATION') or socket.gethostname()} as "
-                 f"{getpass.getuser()}. Nothing here was deleted that was not first on origin "
-                 "or in this directory.", ""]
-        if self.refused_check:
-            lines += [f"**REFUSED by the self-check** (exit 2): {self.refused_check}. Nothing "
-                      "after it was acted on.", ""]
-        elif self.halt:
-            lines += [f"**Stopped:** {self.halt}.", ""]
-        if any(r[0] == "-" for r in self.rescues):
-            lines += ["A `bundle:` row in `rescues.tsv` is a bundle that is the ONLY copy of what "
-                      "it holds (untracked files, commits only a reflog named, a tree with no "
-                      "origin); `sweep --expire` never removes this archive. Its commits are "
-                      "under `refs/lane-worktrees/*` or `refs/heads/*` in the bundle: "
-                      "`git fetch <bundle> 'refs/*:refs/restored/*'`.", ""]
-        if self.opts.word:
-            lines += [f"Foreign trees were included on the word: \"{self.opts.word}\"", ""]
-        lines += ["| tree | was | disposition | why | result | rescue | bundle | register |",
-                  "|---|---|---|---|---|---|---|---|"]
-
-        def cell(text: str) -> str:
-            return (text or "-").replace("|", "\\|")
-
-        for t in self.trees:
-            if not t.result:
-                continue
-            bundles = ", ".join(os.path.basename(b) for b in (t.bundle, t.lost_bundle) if b)
-            lines.append("| " + " | ".join(cell(x) for x in (
-                t.path, t.label(), t.disposition, t.reason, t.result, t.rescue,
-                bundles, t.register)) + " |")
-        rows = [i for i in self.items if i.result]
-        if rows:
-            lines += ["", "| item | kind | disposition | result | size |", "|---|---|---|---|---|"]
-            for i in rows:
-                lines.append("| " + " | ".join(cell(x) for x in (
-                    i.path, i.kind, i.disposition, i.result, human_size(i.size))) + " |")
-        lines += ["", "## Register lines", ""]
-        for path, text, line in self.dispositions:
-            lines.append(f"- `{path}`: {line} - {text}")
-        lines.append("")
-        with open(os.path.join(d, "DISPOSITION.md"), "w", encoding="utf-8", errors="surrogateescape") as fh:
-            fh.write("\n".join(lines))
-        with open(os.path.join(d, "rescues.tsv"), "w", encoding="utf-8", errors="surrogateescape") as fh:
-            fh.write("# origin\tbranch\tsha\tcheckout\ttree\n")
-            for row in self.rescues:
-                fh.write("\t".join(row) + "\n")
-        write_manifest(d)
-
-
-class _ActFailed(Exception):
-    pass
-
-
-class _Keep(Exception):
-    """Found at the moment of the act, before anything was changed: the tree
-    is kept, as the table would have kept it had it been there to see."""
-
-
-class _SelfCheck(Exception):
-    """The invariant's last check refused a removal: exit 2, and no further act."""
-
-
-#: The suite's seam: skips the reflog bundle (#170 A5) so the self-check is
-#: what stands between the removal and a commit only a reflog names.
-SEAM_NO_LOSS_BUNDLE = "LANE_WORKTREES_SEAM_NO_LOSS_BUNDLE"
-
-#: The suite's seam: a process scan that cannot be made (#170 C5).
-SEAM_NO_PROCSCAN = "LANE_WORKTREES_SEAM_NO_PROCSCAN"
-
-EMPTY_TREE = "4b825dc642cb6eb9a060e54bf8d69288fbee4904"
-
-
-def worktree_admin(checkout: str, path: str) -> str:
-    """The git directory (`<common>/worktrees/<id>`) of `checkout`'s
-    registration of `path` - found by the `gitdir` file that points at
-    `<path>/.git` - or ''."""
-    common = git_out(checkout, "rev-parse", "--git-common-dir") or ""
-    if not common:
-        return ""
-    if not os.path.isabs(common):
-        common = os.path.normpath(os.path.join(checkout, common))
-    want = {os.path.normpath(os.path.join(path, ".git")), real(os.path.join(path, ".git"))}
-    base = os.path.join(common, "worktrees")
-    try:
-        ids = sorted(os.listdir(base))
-    except OSError:
-        return ""
-    for wid in ids:
-        try:
-            with open(os.path.join(base, wid, "gitdir"), encoding="utf-8",
-                      errors="surrogateescape") as fh:
-                target = fh.readline().strip()
-        except OSError:
-            continue
-        if target and (os.path.normpath(target) in want or real(target) in want):
-            return os.path.join(base, wid)
-    return ""
-
-
-def reflog_files(gitdir: str) -> tuple:
-    """([every reflog file under `<gitdir>/logs`], why-not). `os.walk` passes
-    over a directory it cannot list IN SILENCE, and a reflog never read names
-    no commit - so a clone whose `logs/refs/heads` was unreadable had its
-    reflog-only commits left out of the loss plan, and the rescue and the
-    self-check both approved its deletion (#174, Copilot round 1). A `logs`
-    directory that is not there is an empty answer; anything else that
-    could not be listed is unknown, never empty."""
-    top = os.path.join(gitdir, "logs")
-    errors: list = []
-
-    def failed(exc: OSError) -> None:
-        if isinstance(exc, FileNotFoundError) and \
-                os.path.normpath(str(exc.filename or "")) == os.path.normpath(top):
-            return
-        errors.append(exc)
-
-    files: list = []
-    for base, _dirs, names in os.walk(top, onerror=failed):
-        files += [os.path.join(base, n) for n in names]
-    if errors:
-        exc = errors[0]
-        return None, (f"{exc.filename or top} could not be listed "
-                      f"({exc.strerror or exc}), so the commits its reflogs name are unknown")
-    return files, ""
-
-
-def reflog_shas(files: list) -> tuple:
-    """([every commit the reflog files name, old and new], why-not): a
-    missing file is an empty reflog; one that cannot be read is unknown."""
-    out: list = []
-    for path in files:
-        try:
-            with open(path, encoding="utf-8", errors="surrogateescape") as fh:
-                for line in fh:
-                    for sha in line.split(" ", 2)[:2]:
-                        if re.match(r"^[0-9a-f]{40}([0-9a-f]{24})?$", sha) and \
-                                not re.match(r"^0+$", sha) and sha not in out:
-                            out.append(sha)
-        except FileNotFoundError:
-            continue
-        except OSError as exc:
-            return None, f"the reflog {path} could not be read ({exc.strerror or exc})"
-    return out, ""
-
-
-def untracked_files(path: str):
-    """Every untracked, un-ignored file in the checkout at `path`, one by
-    one (never a directory), or None where git could not list them."""
-    proc = git(path, "ls-files", "--others", "--exclude-standard", "-z")
-    if proc.returncode != 0:
-        return None
-    return [rel for rel in proc.stdout.split("\0") if rel]
-
-
-def tree_paths_between(path: str, a: str, b: str):
-    """The paths whose entries differ between trees `a` and `b`, or None."""
-    proc = git(path, "diff-tree", "-r", "-z", "--no-renames", "--name-only", a, b)
-    if proc.returncode != 0:
-        return None
-    return [rel for rel in proc.stdout.split("\0") if rel]
-
-
-def lfs_untracked_why(path: str, rels: list) -> str:
-    """Why untracked files `rels` cannot go to a bundle that is their only
-    copy, or '': where git-lfs is configured, one its attributes give
-    `filter=lfs` is snapshotted as a POINTER - its bytes go to the local
-    LFS store, which no bundle carries and the tree's (or the clone's)
-    removal may take, and it is never pushed (#170 A9). A person moves it
-    out, or commits and pushes it."""
-    if not rels or not lfs_configured(path):
-        return ""
-    proc = run(["git", "-C", path, "check-attr", "-z", "--stdin", "filter"], env=git_env(),
-               input_text="".join(rel + "\0" for rel in rels))
-    if proc.returncode != 0:
-        return ("whether its untracked files are git-lfs content could not be read (git "
-                "check-attr failed), and a bundle would carry a pointer, never the bytes")
-    fields = proc.stdout.split("\0")
-    hits = [fields[i] for i in range(0, len(fields) - 2, 3) if fields[i + 2] == "lfs"]
-    if not hits:
-        return ""
-    return (f"{len(hits)} untracked file(s) are git-lfs content (e.g. {hits[0]}): untracked files "
-            "go to a bundle only, a bundle carries an LFS pointer and never its bytes, and they "
-            "are never pushed - move them out, or commit and push them, then sweep again")
-
-
-LFS_STORE_WHY = ("it is a CLONE with a local git-lfs store (.git/lfs/objects), and commits only a "
-                 "bundle would keep may point into it - a bundle carries LFS pointers, never their "
-                 "bytes, and the clone's removal takes the store; push them with git-lfs, or move "
-                 "the store's objects out, then sweep again")
-
-
-def lfs_store_holds(common: str) -> bool:
-    """`<common>/lfs/objects` holds at least one file - a local git-lfs store
-    whose bytes a clone's removal would take. One that cannot be read is
-    read as holding some."""
-    top = os.path.join(common or "", "lfs", "objects")
-    if not common or not os.path.lexists(top):
-        return False
-    errors: list = []
-    for _base, _dirs, files in os.walk(top, onerror=errors.append):
-        if files:
-            return True
-    return bool(errors)
-
-
-def module_repos(gitdir: str) -> tuple:
-    """([every submodule repository kept under `<gitdir>/modules`, nested
-    ones included], [what could not be read])."""
-    top = os.path.join(gitdir, "modules")
-    found, unread = [], []
-    stack = [top]
-    while stack:
-        d = stack.pop()
-        try:
-            with os.scandir(d) as it:
-                entries = list(it)
-        except FileNotFoundError:
-            continue
-        except OSError as exc:
-            unread.append(f"{d} ({exc.strerror or exc})")
-            continue
-        names = {e.name for e in entries}
-        if d != top and "HEAD" in names and "objects" in names:
-            found.append(d)
-            if "modules" in names:
-                stack.append(os.path.join(d, "modules"))
-            continue
-        for e in entries:
-            try:
-                if e.is_dir(follow_symlinks=False):
-                    stack.append(e.path)
-            except OSError:
-                unread.append(e.path)
-    return sorted(found), unread
-
-
-def module_repos_why(gitdir: str) -> str:
-    """Why a submodule repository `gitdir` keeps would lose work with it, or
-    '' (#174, Copilot round 2): any branch, tag or HEAD, stash or reflog entry
-    that no remote of that repository holds. A DEINITIALIZED submodule keeps
-    its repository there with no working tree, so no other guard reads it;
-    `git stash list` wants a working tree, so the stash is read as its ref."""
-    mods, unread = module_repos(gitdir)
-    if unread:
-        return (f"{unread[0]} could not be read, so whether a submodule repository kept there "
-                "holds work is unknown")
-    for m in mods:
-        why = module_reads(m, _module_repo_why, m, os.path.relpath(m, gitdir))
-        if why:
-            return why
-    return ""
-
-
-def module_reads(m: str, fn, *args):
-    """`fn(*args)` with every git command in the submodule repository `m`
-    run as a git directory alone (`_GITDIR_READS`)."""
-    _GITDIR_READS.add(m)
-    try:
-        return fn(*args)
-    finally:
-        _GITDIR_READS.discard(m)
-
-
-def _module_repo_why(m: str, rel: str) -> str:
-    why = unpublished_ref(m, "--remotes", "every remote of it")
-    if why:
-        return f"the submodule repository {rel}: {why}"
-    stash = git(m, "for-each-ref", "--count=1", "--format=%(refname)", "refs/stash")
-    if stash.returncode != 0 or stash.stdout.strip():
-        return f"the submodule repository {rel} has a stash (or it could not be read)"
-    why = unpublished_reflog(m, "--remotes", "every remote of it")
-    if why:
-        return f"the submodule repository {rel}: {why}"
-    return ""
-
-
-def module_tags_why(gitdir: str) -> str:
-    """Why an ANNOTATED tag of a submodule repository kept under
-    `<gitdir>/modules` would be lost with it, or '' (#174, Copilot round 2).
-    A tag object - its message, its signature - is its own object, and
-    `module_repos_why` asks only whether the commit it names is published, so
-    a local tag on a published commit passed. A tag object no remote of that
-    repository answers to `ls-remote --tags` AS THAT VERY OBJECT keeps it, and
-    so does a remote that cannot be asked. It asks each remote, so it runs at
-    the act only (the dry run asks no remote)."""
-    if not gitdir:
-        return "its git directory could not be read, so the submodule repositories it keeps are unknown"
-    mods, unread = module_repos(gitdir)
-    if unread:
-        return (f"{unread[0]} could not be read, so whether a submodule repository kept there "
-                "holds work is unknown")
-    for m in mods:
-        why = module_reads(m, _module_tags_why, m, os.path.relpath(m, gitdir))
-        if why:
-            return why
-    return ""
-
-
-def _module_tags_why(m: str, rel: str) -> str:
-    proc = git(m, "for-each-ref", "--format=%(objecttype) %(objectname) %(refname)",
-               "refs/tags/")
-    if proc.returncode != 0:
-        return f"the tags of the submodule repository {rel} could not be read"
-    tags: dict = {}
-    for line in proc.stdout.splitlines():
-        cols = line.split(" ", 2)
-        if len(cols) == 3 and cols[0] == "tag":
-            tags.setdefault(cols[1], cols[2][len("refs/tags/"):])
-    if not tags:
-        return ""
-    remotes = git(m, "remote")
-    have: set = set()
-    for remote in (remotes.stdout.split() if remotes.returncode == 0 else []):
-        ls = git(m, "ls-remote", "--tags", remote, timeout=GIT_NET_TIMEOUT)
-        if ls.returncode == 0:
-            have.update(line.split("\t", 1)[0] for line in ls.stdout.splitlines()
-                        if "\t" in line)
-    missing = sorted(name for sha, name in tags.items() if sha not in have)
-    if missing:
-        return (f"the submodule repository {rel}: its annotated tag {missing[0]} is a tag "
-                "object no remote of it holds, or that none could be asked about - its "
-                f"message would be lost; push it (git push <remote> tag {missing[0]}) first")
-    return ""
-
-
-def lfs_configured(path: str) -> bool:
-    """git-lfs is set up for the repository at `path` (any `filter.lfs.*`
-    in its configuration, the global one included)."""
-    proc = git(path, "config", "--get-regexp", r"^filter\.lfs\.")
-    return proc.returncode == 0 and bool(proc.stdout.strip())
-
-
-def delete_local_branch(checkout: str, branch: str, expect: str):
-    """(done, why): `refs/heads/<branch>` deleted only while it is still at
-    `expect` and no worktree has it checked out - `update-ref -d` with the
-    old value, so a branch that moved under the sweep is never lost."""
-    if not expect:
-        return False, "the SHA it was judged at is not known"
-    regs = worktree_registrations(checkout)
-    if regs is None:
-        return False, "the worktree registrations could not be read, so whether one holds it is unknown"
-    for reg in regs:
-        if reg.get("branch") == f"refs/heads/{branch}":
-            return False, f"it is checked out in {reg.get('path')} now"
-    proc = git(checkout, "update-ref", "-d", f"refs/heads/{branch}", expect)
-    if proc.returncode != 0:
-        return False, (f"it is no longer at {short(expect)} (" + _first_line(proc.stderr) + ")")
-    return True, ""
-
-
-def delete_remote_branch(checkout: str, branch: str, expect: str):
-    """(done, why): origin's branch deleted only while origin still has it at
-    `expect` - a lease, so commits pushed there since are never discarded."""
-    if not expect:
-        return False, "the SHA it was judged at is not known"
-    proc = git(checkout, "push", "--no-verify", "--porcelain",
-               f"--force-with-lease=refs/heads/{branch}:{expect}", "origin",
-               f":refs/heads/{branch}", timeout=GIT_NET_TIMEOUT)
-    if proc.returncode != 0:
-        return False, _first_line(proc.stderr or proc.stdout)
-    return True, ""
-
-
-def _first_few(reasons: list) -> str:
-    return "; ".join(reasons[:3]) + (f"; and {len(reasons) - 3} more" if len(reasons) > 3 else "")
-
-
-def _lean_text(lean: list) -> str:
-    return "; ".join(f"{dep} leans on it ({how})" for dep, how in lean[:5]) + (
-        f"; and {len(lean) - 5} more" if len(lean) > 5 else "")
-
-
-def own_trailers(path: str) -> set:
-    """The `Lane:` trailers of the commits HEAD has that origin's default
-    branch lacks, lower-cased - empty where there is no such base to tell the
-    branch's own commits by."""
-    base = git_out(path, "symbolic-ref", "-q", "refs/remotes/origin/HEAD") or ""
-    if not base and git(path, "rev-parse", "-q", "--verify",
-                        "refs/remotes/origin/main").returncode == 0:
-        base = "refs/remotes/origin/main"
-    if not base:
-        return set()
-    text = git_out(path, "log", "--format=%B", f"{base}..HEAD") or ""
-    return {v.lower() for v in re.findall(r"^Lane:\s*(\S+)\s*$", text, re.MULTILINE)}
-
-
-def head_lane_trailer(path: str) -> str:
-    """HEAD's own `Lane:` trailer (its last one), read as `read_tree` reads
-    `lane_trailer` - '' where it has none or HEAD could not be read. Trailer
-    adoption is decided before `read_tree` runs, so it asks here (#174
-    review R1)."""
-    msg = git_out(path, "log", "-1", "--format=%B", "HEAD") or ""
-    trailers = re.findall(r"^Lane:\s*(\S+)\s*$", msg, re.MULTILINE)
-    return trailers[-1] if trailers else ""
-
-
-def _gitdir_activity(path: str) -> float:
-    gitdir = git_out(path, "rev-parse", "--absolute-git-dir")
-    newest = 0.0
-    if not gitdir:
-        return newest
-    for name in ("index", "HEAD", os.path.join("logs", "HEAD")):
-        try:
-            newest = max(newest, os.stat(os.path.join(gitdir, name)).st_mtime)
-        except OSError:
-            pass
-    return newest
-
-
-def ignored_print(base: str, rels: list) -> list:
-    """The ignored paths `rels` under `base`, every file in them with its size
-    and mtime: what the ignored archive carries, compared again at removal."""
-    out = []
-    for rel in sorted(rels):
-        full = os.path.join(base, rel)
-        if os.path.isdir(full) and not os.path.islink(full):
-            out += [(rel, *row) for row in content_print(full)]
-        else:
-            try:
-                st = os.lstat(full)
-                out.append((rel, "", st.st_size, st.st_mtime_ns))
-            except OSError:
-                out.append((rel, "", -1, -1))
-    return out
-
-
-def content_print(root: str) -> list:
-    """Every non-cache file under `root` with its size and mtime - what an
-    archive of it carries, so a change made while it was archived shows."""
-    out = []
-    for base, dirs, files in os.walk(root):
-        dirs[:] = sorted(d for d in dirs if d not in CACHE_NAMES and d not in VENV_NAMES)
-        for name in sorted(files):
-            if name.endswith((".pyc", ".pyo")):
-                continue
-            full = os.path.join(base, name)
-            try:
-                st = os.lstat(full)
-            except OSError:
-                out.append((os.path.relpath(full, root), -1, -1))
-                continue
-            out.append((os.path.relpath(full, root), st.st_size, st.st_mtime_ns))
-    return out
-
-
-def _no_caches_beneath(rel: str):
-    """A tar member filter for the entry `rel`: caches and bytecode hold no
-    work, so an archive never carries one BENEATH it - judged by the parts
-    of the member's path below `rel`, never by `rel`'s own ancestors. The
-    entry itself is always carried: it was selected by its own name."""
-    prefix = rel + "/"
-
-    def keep(info):
-        if info.name == rel:
-            return info
-        tail = info.name[len(prefix):] if info.name.startswith(prefix) else info.name
-        if any(p in CACHE_NAMES or p in VENV_NAMES for p in tail.split("/")):
-            return None
-        if tail.endswith((".pyc", ".pyo")):
-            return None
-        return info
-    return keep
-
-
-def write_manifest(d: str) -> None:
-    rows = []
-    for base, _dirs, files in os.walk(d):
-        for name in files:
-            full = os.path.join(base, name)
-            rel = os.path.relpath(full, d)
-            if rel == "MANIFEST.sha256":
-                continue
-            rows.append(f"{sha256_of(full)}  {rel}")
-    with open(os.path.join(d, "MANIFEST.sha256"), "w", encoding="utf-8", errors="surrogateescape") as fh:
-        fh.write("\n".join(sorted(rows, key=lambda r: r.split("  ", 1)[1])) + "\n")
-
-
-def tracked(path: str):
-    """True when git tracks something under `path`, False when it tracks
-    nothing there or `path` is in no repository, None when a repository's
-    index could not be read - which is never "untracked"."""
-    parent = os.path.dirname(path.rstrip("/"))
-    inside = git(parent, "rev-parse", "--is-inside-work-tree")
-    if inside.returncode != 0 or inside.stdout.strip() != "true":
-        return False
-    proc = git(parent, "ls-files", "-z", "--", os.path.basename(path.rstrip("/")))
-    if proc.returncode != 0:
-        return None
-    return bool(proc.stdout.strip("\0"))
-
-
-def find_caches(root: str) -> list:
-    out = []
-    for base, dirs, _files in os.walk(root, followlinks=False):
-        keep = []
-        for d in dirs:
-            full = os.path.join(base, d)
-            if d == ".git" or os.path.islink(full):
-                continue
-            is_venv = os.path.isfile(os.path.join(full, "pyvenv.cfg")) or (
-                d in VENV_NAMES and (os.path.exists(os.path.join(full, "bin", "activate"))
-                                     or os.path.exists(os.path.join(full, "Scripts", "activate"))))
-            if d in CACHE_NAMES or is_venv:
-                out.append((full, dir_size(full)))
-            else:
-                keep.append(d)
-        dirs[:] = keep
-    return out
-
-
-def no_repository(path: str) -> bool:
-    """True only where git answers that there is NO repository at `path` -
-    which has no branches - and never where one could not be read. A `.git`
-    entry of its own IS a repository, however broken: git answers "not a git
-    repository" for a gitdir it cannot read too (#170 G5)."""
-    if os.path.lexists(os.path.join(path, ".git")):
-        return False
-    proc = git(path, "rev-parse", "--git-dir")
-    return proc.returncode != 0 and "not a git repository" in (proc.stderr or "").lower()
-
-
-def branch_items(checkout: str, lane: str, evidence: MergeEvidence) -> list:
-    """`--branches`: local branches NO worktree has checked out. Merged by
-    PR evidence: deleted (and the remote where it is this lane's and holds
-    nothing the PR did not). Unmerged with a missing, diverged or behind
-    upstream: LISTED with tip, distance and age, never deleted. A branch an
-    open PR names is never touched; rescue branches are never touched."""
-    out = []
-    regs = worktree_registrations(checkout)
-    if regs is None:
-        return [Item("branch", checkout, "keep", "the worktree registrations could not be read, "
-                     "so which branches a worktree holds is unknown", True)]
-    held = {r.get("branch", "")[len("refs/heads/"):] for r in regs if r.get("branch")}
-    fmt = "%(refname:short)\t%(objectname)\t%(upstream:short)\t%(committerdate:iso-strict)"
-    proc = git(checkout, "for-each-ref", f"--format={fmt}", "refs/heads/")
-    if proc.returncode != 0:
-        return [Item("branch", checkout, "keep", "the branches could not be read: "
-                     + _first_line(proc.stderr), True)]
-    origin = git_out(checkout, "config", "--get", "remote.origin.url") or ""
-    slug = slug_of(origin)
-    default = (git_out(checkout, "symbolic-ref", "-q", "--short", "refs/remotes/origin/HEAD")
-               or "origin/main")
-    for line in proc.stdout.splitlines():
-        cols = line.split("\t")
-        if len(cols) < 4:
-            continue
-        name, tip, upstream, date = cols
-        if name in held or name in PROTECTED_BRANCHES or name.startswith("rescue/"):
-            continue
-        msg = git_out(checkout, "log", "-1", "--format=%B", tip) or ""
-        trailers = re.findall(r"^Lane:\s*(\S+)\s*$", msg, re.MULTILINE)
-        owner = trailers[-1] if trailers else ""
-        ours = owner.lower() == lane.lower()
-        counts = git_out(checkout, "rev-list", "--left-right", "--count", f"{default}...{tip}") or ""
-        behind_main, ahead_main = (counts.split() + ["?", "?"])[:2]
-        age = _age_days(date)
-        detail = (f"{short(tip)} · {ahead_main} ahead/{behind_main} behind {default} · last "
-                  f"commit {date[:10]} ({age} d) · owner {owner or 'unknown'}")
-        judged = evidence.judge(checkout, slug, name, tip) if slug else {
-            "state": "unknown", "why": "not a GitHub origin"}
-        # PUBLISHED MEANS ORIGIN'S OWN REF FOR IT HOLDS THE TIP (#170 G7): a
-        # branch made from origin/main TRACKS main, so its configured upstream
-        # says "ahead" even once it is pushed under its own name.
-        published = _on_origin_as(checkout, name, tip)
-        it = None
-        if judged["state"] == "open":
-            # THE DELETE PROTECTION STAYS; THE COUNT DOES NOT HIDE IT (#170 G2):
-            # a lane-owned branch an open PR names, holding commits origin's
-            # ref for it lacks, is unfinished work, and a read that failed is
-            # never "finished".
-            it = Item("branch", name, "keep", judged["why"] + ": an open PR's branch is never touched"
-                      + ("" if published is True else
-                         "; origin's ref for it lacks its tip" if published is False else
-                         "; whether origin holds its tip could not be read"),
-                      ours and published is not True, detail)
-        elif judged["state"] == "merged":
-            remote_tip = git_out(checkout, "rev-parse", "-q", "--verify",
-                                 f"refs/remotes/origin/{name}") or ""
-            head = judged.get("head", "")
-            remote_ok = bool(remote_tip) and ours and not judged.get("gh_open") and (
-                remote_tip == head or git(checkout, "merge-base", "--is-ancestor", remote_tip,
-                                          head).returncode == 0)
-            it = Item("branch", name, "delete+remote" if remote_ok else "delete",
-                      judged["why"] + ("; the remote branch too (this lane's, nothing beyond the PR)"
-                                       if remote_ok else ""), ours, detail)
-            it.extra.update(pr=judged.get("pr"), tip=tip, remote_tip=remote_tip if remote_ok else "")
-        elif published is True:
-            continue
-        else:
-            up_state = "missing"
-            if upstream:
-                up_tip = git_out(checkout, "rev-parse", "-q", "--verify", f"refs/remotes/{upstream}") \
-                    if not upstream.startswith("refs/") else None
-                if up_tip:
-                    c = (git_out(checkout, "rev-list", "--left-right", "--count",
-                                 f"{up_tip}...{tip}") or "").split()
-                    if len(c) == 2 and all(x.isdigit() for x in c):
-                        b, a = int(c[0]), int(c[1])
-                        up_state = ("diverged" if a and b else "ahead" if a else
-                                    "behind" if b else "published")
-                    else:
-                        # NEVER "0 0" FOR UNKNOWN: that would read as published
-                        # and drop the branch from the list.
-                        up_state = "unreadable (git rev-list failed)"
-                else:
-                    up_state = "missing"
-            if up_state in ("published", "behind"):
-                continue
-            it = Item("branch", name, "list", f"unmerged ({judged.get('why', '')}); upstream "
-                      f"{upstream or 'none'} is {up_state}: a person disposes of it (push it to "
-                      f"rescue/{safe_ref_part(lane)}/..., or a word) - never deleted", ours, detail)
-        it.extra.update(checkout=checkout, branch=name)
-        out.append(it)
-    return out
-
-
-def _on_origin_as(checkout: str, name: str, tip: str):
-    """True when `refs/remotes/origin/<name>` holds `tip`, False when it is
-    absent or does not, None when that could not be read."""
-    ref = git(checkout, "rev-parse", "-q", "--verify", f"refs/remotes/origin/{name}")
-    if ref.returncode == 1 and not ref.stdout.strip():
-        return False
-    if ref.returncode != 0:
-        return None
-    remote = ref.stdout.strip()
-    if remote == tip:
-        return True
-    anc = git(checkout, "merge-base", "--is-ancestor", tip, remote)
-    return {0: True, 1: False}.get(anc.returncode)
-
-
-def _age_days(iso: str) -> int:
-    try:
-        when = _dt.datetime.fromisoformat(iso.replace("Z", "+00:00"))
-        return max(0, (_dt.datetime.now(_dt.timezone.utc) - when).days)
-    except ValueError:
-        return 0
-
-
-def sandbox_roots() -> list:
-    named = os.environ.get("LANE_WORKTREES_SANDBOX_ROOTS", "")
-    if named:
-        return [p for p in named.split(os.pathsep) if p]
-    roots = []
-    for cand in ("/tmp", os.environ.get("TMPDIR", ""), tempfile.gettempdir()):
-        if cand and os.path.isdir(cand) and real(cand) not in [real(r) for r in roots]:
-            roots.append(cand)
-    return roots
-
-
-#: `tests/run.sh` writes its pid here in every run root it makes.
-RUN_MARKER = ".openrepotools-run"
-
-
-def sandbox_provenance(path: str) -> tuple:
-    """(which suite marked `path`, the pid the mark names) - pytest's `.lock`
-    in a numbered directory, `tests/run.sh`'s marker, or run.sh's run-root
-    layout (`basetemp/` beside `tmp/`) - or ('', 0): no proof a suite made
-    it."""
-    for name, what in ((".lock", "a pytest .lock"), (RUN_MARKER, "tests/run.sh's marker")):
-        # A MARK THAT NAMES NO PID PROVES NOTHING (#174, Copilot round 2): an
-        # empty or malformed `.lock` made a person's `tmp.*` a suite's, past
-        # the 14-day rule and the repository guard.
-        pid = _lock_pid(os.path.join(path, name))
-        if pid > 0:
-            return what, pid
-    if os.path.isdir(os.path.join(path, "basetemp")) and os.path.isdir(os.path.join(path, "tmp")):
-        return "tests/run.sh's run-root layout", 0
-    return "", 0
-
-
-def _size_and_newest(path: str) -> tuple:
-    """(bytes, newest mtime) of everything under `path`, itself included: a
-    sandbox written to last week in a subdirectory is not a month old."""
-    total, newest = 0, 0.0
-    try:
-        newest = os.lstat(path).st_mtime
-    except OSError:
-        pass
-    for base, dirs, files in os.walk(path, followlinks=False):
-        for name in files + dirs:
-            try:
-                st = os.lstat(os.path.join(base, name))
-            except OSError:
-                continue
-            total += st.st_size
-            newest = max(newest, st.st_mtime)
-    return total, newest
-
-
-def sandbox_items(procs: ProcScan, conf: dict) -> list:
-    """Killed-suite sandboxes: `tmp.*` and `pytest-of-$USER/pytest-*` whose
-    owning process is gone, and `tests/run.sh`'s own run roots. They hold no
-    work; one a live process stands in, holds open or names in its
-    environment is never touched, and neither is one younger than the
-    minimum age (`sandbox_min_age_minutes`).
-
-    A `tmp.*` IS LISTED AND NEVER REMOVED (#170 item 1, option (b); #174
-    review R2): `mktemp -d` records no owner, so nothing proves a suite made
-    one - any `tmp.*` may be a person's checkout or saved scratch. Only
-    `pytest-of-$USER/pytest-*` and run.sh's `<UTC>-<pid>` run roots are
-    removed."""
-    out = []
-    unreadable: list = []
-    uid = os.getuid()
-    procs.load_environ()
-    min_age = conf["sandbox_min_age_minutes"] * 60
-    user = getpass.getuser()
-    candidates = []
-    for root in sandbox_roots():
-        try:
-            names = os.listdir(root)
-        except OSError:
-            continue
-        for name in names:
-            full = os.path.join(root, name)
-            if name.startswith("tmp.") and os.path.isdir(full) and not os.path.islink(full):
-                candidates.append((full, "mktemp", 0))
-            if name == f"pytest-of-{user}" and os.path.isdir(full):
-                try:
-                    subs = os.listdir(full)
-                except OSError as exc:
-                    # UNREADABLE IS A ROW, never a traceback and never "empty".
-                    it = Item("sandbox", full, "keep", "its pytest sandboxes could not be listed ("
-                              + (exc.strerror or str(exc)) + "), so none of them is touched",
-                              False)
-                    unreadable.append(it)
-                    continue
-                for sub in subs:
-                    sp = os.path.join(full, sub)
-                    if sub.startswith("pytest-") and os.path.isdir(sp) and not os.path.islink(sp):
-                        candidates.append((sp, "pytest", _lock_pid(os.path.join(sp, ".lock"))))
-    runs = os.path.join(state_dir(), "tmp")
-    try:
-        for name in os.listdir(runs):
-            full = os.path.join(runs, name)
-            if os.path.isdir(full) and not os.path.islink(full):
-                m = re.search(r"-(\d+)$", name)
-                candidates.append((full, "run.sh", int(m.group(1)) if m else 0))
-    except OSError:
-        pass
-    now = time.time()
-    for path, kind, pid in candidates:
-        try:
-            st = os.lstat(path)
-        except OSError:
-            continue
-        if st.st_uid != uid:
-            continue
-        prov = ""
-        if kind == "mktemp":
-            prov, pid = sandbox_provenance(path)
-        if pid and pid_alive(pid):
-            continue
-        if not procs.available or procs.holders(path) or procs.unknown_for(path):
-            continue
-        if kind == "mktemp":
-            size, newest = _size_and_newest(path)
-            age = now - newest
-            if age < min_age:
-                continue
-            # EVERY `tmp.*` IS LISTED, NEVER REMOVED (#170 item 1, option (b);
-            # #174 review R2). Untouched for aging_days was the one rule that
-            # removed a real one, and it removed a person's tmp.* holding notes
-            # and one holding a BARE repository with the only copy of a commit,
-            # with no archive; a mark is a file anybody may have left, and
-            # run.sh writes its own in its run roots, never in a tmp.*.
-            inner = repository_within(path)
-            mark = (f"{prov}" + (f" (pid {pid}, gone)" if pid else "")) if prov else (
-                "no mark of a test suite (no pytest .lock, no tests/run.sh marker or run-root "
-                "layout)")
-            it = Item("sandbox", path, "list", f"a tmp.* directory with {mark}, last written "
-                      f"{int(age // 86400)} d ago" + (f", and {inner}" if inner else "")
-                      + ": `mktemp -d` records no owner, so it may be a person's checkout or "
-                      "scratch - listed, never removed (#170 item 1)", False)
-            it.size = size
-        else:
-            it = Item("sandbox", path, "remove", f"a {kind} sandbox whose owning process is gone"
-                      + (f" (pid {pid})" if pid else ""), False)
-            it.size = dir_size(path)
-        it.extra["kind"] = kind
-        out.append(it)
-    return out + unreadable
-
-
-def _lock_pid(path: str) -> int:
-    try:
-        with open(path, encoding="utf-8", errors="surrogateescape") as fh:
-            text = fh.read().strip()
-        return int(text) if text.isdigit() else 0
-    except (OSError, ValueError):
-        return 0
-
-
-def link_items(root: str) -> list:
-    """`--links`: every symlink under the estate and every worktree `.git`
-    gitdir pointer, checked to resolve; the broken ones, with target and age.
-
-    A `scandir` walk: an entry's kind comes from the directory read itself, so
-    only a symlink or a `.git` FILE costs a call of its own - the estate is tens
-    of thousands of directories, and `os.walk`'s `lstat` of each was minutes."""
-    out = []
-    prune = set(CACHE_NAMES) | set(VENV_NAMES) | {".git", ".tox", ".nox"}
-    now = time.time()
-    stack = [root]
-    while stack:
-        d = stack.pop()
-        try:
-            entries = list(os.scandir(d))
-        except OSError:
-            continue
-        for e in entries:
-            try:
-                if e.is_symlink():
-                    if not os.path.exists(e.path):
-                        try:
-                            target = os.readlink(e.path)
-                            age = int((now - os.lstat(e.path).st_mtime) // 86400)
-                        except OSError:
-                            target, age = "?", 0
-                        out.append(Item("link", e.path, "broken", f"symlink to {target} that "
-                                        f"does not resolve ({age} d old)", False))
-                    continue
-                if e.name == ".git":
-                    if e.is_file(follow_symlinks=False):
-                        _gitdir_pointer(e.path, d, now, out)
-                    continue
-                if e.name in prune:
-                    continue
-                if e.is_dir(follow_symlinks=False):
-                    stack.append(e.path)
-            except OSError:
-                continue
-    return sorted(out, key=lambda i: i.path)
-
-
-def _gitdir_pointer(path: str, base: str, now: float, out: list) -> None:
-    try:
-        with open(path, encoding="utf-8", errors="surrogateescape") as fh:
-            first = fh.readline().strip()
-    except OSError:
-        return
-    if not first.startswith("gitdir:"):
-        return
-    target = first[7:].strip()
-    resolved = target if os.path.isabs(target) else os.path.join(base, target)
-    if not os.path.isdir(resolved):
-        try:
-            age = int((now - os.lstat(path).st_mtime) // 86400)
-        except OSError:
-            age = 0
-        out.append(Item("link", path, "broken", f"gitdir pointer to {target} that does "
-                        f"not resolve ({age} d old)", False))
-
-
-# ================================================================== expire
-
-def expiry_rows(conf: dict) -> list:
-    """(archive, age in days, keep|expire, why) for every archive under the
-    sweeps directory - `sweep --expire`'s table, and the report's. An archive
-    past retention is `expire` only while it is whole (`archive_ledger`) and
-    every rescue branch it records is on origin at the rescued SHA; one whose
-    rescue left or moved is the only copy and is kept."""
-    root = sweeps_dir()
-    keep_days = conf["retention_days"]
-    now = _dt.datetime.now(_dt.timezone.utc)
-    rows = []
-    try:
-        lanes = sorted(os.listdir(root))
-    except OSError:
-        lanes = []
-    for lane in lanes:
-        ldir = os.path.join(root, lane)
-        if not os.path.isdir(ldir):
-            continue
-        for stamp in sorted(os.listdir(ldir)):
-            adir = os.path.join(ldir, stamp)
-            if not os.path.isdir(adir):
-                continue
-            m = STAMP_RE.match(stamp)
-            if m:
-                when = _dt.datetime.strptime(m.group(1), "%Y%m%dT%H%M%SZ").replace(
-                    tzinfo=_dt.timezone.utc)
-            else:
-                when = _dt.datetime.fromtimestamp(os.stat(adir).st_mtime, _dt.timezone.utc)
-            age = (now - when).days
-            if age < keep_days:
-                rows.append((adir, age, "keep", f"{age} d old; retention {keep_days} d"))
-                continue
-            ledger, why = archive_ledger(adir)
-            if ledger is None:
-                rows.append((adir, age, "keep", why + " - its rescues cannot be checked, so it "
-                             "is kept"))
-                continue
-            missing = []
-            for origin, branch, sha in ledger:
-                if origin == "-" or branch.startswith("bundle:"):
-                    # A BUNDLE THAT IS THE ONLY COPY (#170 item 8): nothing on
-                    # any origin holds what it holds.
-                    missing.append(f"{branch} (that bundle is the only copy of {short(sha)})")
-                    continue
-                proc = run(["git", "ls-remote", origin, f"refs/heads/{branch}"], env=git_env(),
-                           timeout=GIT_NET_TIMEOUT)
-                got = proc.stdout.split()[0] if proc.returncode == 0 and proc.stdout.split() else ""
-                if proc.returncode != 0:
-                    missing.append(f"{branch} (origin could not be read)")
-                elif not got:
-                    missing.append(f"{branch} (gone from origin)")
-                elif got != sha:
-                    # THE RESCUED COMMIT, NOT THE NAME: a branch reset or remade
-                    # at another commit no longer holds the work.
-                    missing.append(f"{branch} (on origin at {short(got)}, not the rescued "
-                                   f"{short(sha)})")
-            if missing:
-                rows.append((adir, age, "keep", "not every rescue is on origin: "
-                             + "; ".join(missing) + " - this archive is the only copy"))
-            else:
-                rows.append((adir, age, "expire", f"{age} d old and every rescue branch is on origin"))
-    return rows
-
-
-def expire(opts) -> int:
-    conf = load_conf()
-    root = sweeps_dir()
-    keep_days = conf["retention_days"]
-    rows = expiry_rows(conf)
-    failed = 0
-    for i, (adir, age, disp, why) in enumerate(rows):
-        if disp == "expire" and opts.yes:
-            try:
-                rmtree(adir)
-                rows[i] = (adir, age, "expired", why)
-                os.makedirs(root, exist_ok=True)
-                with open(os.path.join(root, "EXPIRED.log"), "a", encoding="utf-8", errors="surrogateescape") as fh:
-                    fh.write(f"{utc_now()}\t{adir}\t{why}\n")
-            except OSError as exc:
-                rows[i] = (adir, age, "FAILED", str(exc))
-                failed += 1
-    if opts.porcelain:
-        for adir, age, disp, why in rows:
-            prow("archive", disp, adir, age, why)
-    else:
-        say(f"{PROG} sweep --expire - " + ("YES" if opts.yes else "DRY RUN") +
-            f" - retention {keep_days} d ({conf_path()})")
-        if not rows:
-            say("  (no archives under " + tilde(root) + ")")
-        for adir, age, disp, why in rows:
-            say(f"  {disp:<8} {tilde(adir)} · {why}")
-    if failed:
-        return 1
-    if not opts.yes and any(r[2] == "expire" for r in rows):
-        return 3
-    return 0
-
-
-SHA_RE = re.compile(r"^[0-9a-f]{40}([0-9a-f]{24})?$")
-
-
-def archive_ledger(adir: str):
-    """(rescues, why): the archive's rescue ledger, or None with why it cannot
-    be trusted. An archive is trusted only when it is WHOLE: `MANIFEST.sha256`
-    is there and every file in the archive is in it at its digest (an
-    interrupted sweep leaves a bundle the ledger never recorded), and
-    `rescues.tsv` is there and every row of it is origin, branch and a full
-    SHA. A header-only ledger in a whole archive is a verified "no rescues"."""
-    manifest = os.path.join(adir, "MANIFEST.sha256")
-    listed: dict = {}
-    try:
-        with open(manifest, encoding="utf-8", errors="surrogateescape") as fh:
-            for line in fh:
-                if not line.strip():
-                    continue
-                digest, sep, rel = line.rstrip("\n").partition("  ")
-                if not sep or not re.match(r"^[0-9a-f]{64}$", digest):
-                    return None, "its MANIFEST.sha256 is malformed"
-                listed[rel] = digest
-    except OSError:
-        return None, "it has no readable MANIFEST.sha256 (the sweep that made it did not finish)"
-    for rel in listed:
-        if not os.path.isfile(os.path.join(adir, rel)):
-            return None, f"{rel} is in its MANIFEST.sha256 and no longer in it"
-    for base, _dirs, files in os.walk(adir):
-        for name in files:
-            full = os.path.join(base, name)
-            rel = os.path.relpath(full, adir)
-            if rel == "MANIFEST.sha256":
-                continue
-            if rel not in listed:
-                return None, f"{rel} is in it and not in its MANIFEST.sha256"
-            try:
-                with open(full, "rb") as fh:
-                    if hashlib.sha256(fh.read()).hexdigest() != listed[rel]:
-                        return None, f"{rel} does not match its MANIFEST.sha256"
-            except OSError:
-                return None, f"{rel} could not be read"
-    if "rescues.tsv" not in listed:
-        return None, "it has no rescues.tsv"
-    out = []
-    try:
-        with open(os.path.join(adir, "rescues.tsv"), encoding="utf-8", errors="surrogateescape") as fh:
-            for line in fh:
-                if line.startswith("#") or not line.strip():
-                    continue
-                cols = line.rstrip("\n").split("\t")
-                if len(cols) < 3 or not cols[0] or not cols[1] or not SHA_RE.match(cols[2]):
-                    return None, "its rescues.tsv has a row that is not origin, branch, sha"
-                out.append((cols[0], cols[1], cols[2]))
-    except OSError:
-        return None, "its rescues.tsv could not be read"
-    return out, ""
-
-
-# ================================================================== report
-
-EVIDENCE_NAME_RE = re.compile(
-    r"(^canary-|^deployment-evidence$|-evidence$|^evidence$|-report\.md$|REPORT[^/]*\.md$|"
-    r"^junit[^/]*\.xml$|^MANIFEST)", re.IGNORECASE)
-HANDOFF_PATHS = ("handoffs/", "lanes/")
-#: `rescue/<lane>/<slice>-<UTC>` names its lane; a rescue branch of another
-#: convention (`rescue/<slug>`) names none.
-LANE_SHAPED_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*-[0-9]+$")
-
-
-def estate_root_default() -> str:
-    for cand in (os.environ.get("PROJECTS_ROOT", ""), os.path.join(_home(), "projects"),
-                 os.path.join(_home(), "Projects")):
-        if cand and os.path.isdir(cand):
-            return cand
-    return ""
-
-
-def _under_container(path: str, root: str) -> str:
-    """The worktree container a path sits in - `.lane-worktrees/<lane>`,
-    `.claude/worktrees`, `worktrees`, `<x>-worktrees` - or ''."""
-    rel = os.path.relpath(path, root)
-    parts = rel.split(os.sep)
-    for i, p in enumerate(parts[:-1]):
-        if p == ".lane-worktrees" and i + 1 < len(parts) - 1:
-            return os.sep.join(parts[:i + 2])
-        if p in ("worktrees", ".worktrees") or p.endswith("-worktrees"):
-            return os.sep.join(parts[:i + 1])
-    return ""
-
-
-def _du(paths: list) -> dict:
-    """{path: bytes} through `du -sk`, which walks in C: an estate's ignored
-    trees are millions of files, and a Python walk of them is minutes."""
-    out: dict = {}
-    for i in range(0, len(paths), 64):
-        chunk = paths[i:i + 64]
-        proc = run(["du", "-sk", "--", *chunk], timeout=600)
-        for line in proc.stdout.splitlines():
-            size, _, path = line.partition("\t")
-            if size.isdigit():
-                out[path] = int(size) * 1024
-    return out
-
-
-def _lane_parents(root: str, repos: list) -> list:
-    """Every directory a lane's control root and worktree root can sit in.
-    #97 puts `.lane-state/<lane>` - and lane-start `.lane-worktrees/<lane>` -
-    beside the lane's recorded `dir`, so a lane whose checkout is nested
-    (`<estate>/InkRouter/IRRS`) keeps them in `<estate>/InkRouter`, not at
-    the estate's top."""
-    out = [root] if root else []
-    for r in repos:
-        parent = os.path.dirname(r.rstrip(os.sep))
-        if parent and parent not in out:
-            out.append(parent)
-    return out
-
-
-def _lane_state_dirs(parents: list) -> list:
-    dirs = []
-    cands = [os.environ.get("LANES_LANE_STATE_ROOT", "")]
-    cands += [os.path.join(p, ".lane-state") for p in parents]
-    for cand in cands:
-        if cand and os.path.isdir(cand) and cand not in dirs:
-            dirs.append(cand)
-    return dirs
-
-
-def _lane_tree_roots(parents: list) -> list:
-    """`<parent>/.lane-worktrees`, each that exists."""
-    out = []
-    for p in parents:
-        cand = os.path.join(p, ".lane-worktrees")
-        if os.path.isdir(cand) and cand not in out:
-            out.append(cand)
-    return out
-
-
-class Report:
-    """`sweep --all --dry-run --report`: the estate's leftovers as one
-    document. It reads every lane's #97 inventory, the workspace register and
-    the disk; it changes nothing."""
-
-    def __init__(self, opts):
-        self.opts = opts
-        self.conf = load_conf()
-        self.root = opts.estate or estate_root_default()
-        self.helper = Helper()
-        self.sections: list = []
-        self.counts: dict = {}
-        self.now = time.time()
-        self.unreadable: dict = {}
-        # WHAT BEARS ON THE LANES' RECORDS, apart (#179, Copilot round 1): an
-        # orphan or aging section empty beside an unread snapshot, inventory,
-        # register line or inventory tree may be missing rows; an ignored-file
-        # listing or a canonical checkout's registrations that failed say
-        # nothing of either, and must not turn their "none" into "unknown".
-        self.records_unread: dict = {}
-
-    def _unread(self, key: str, why: str, record: bool = True) -> None:
-        """A read that failed: a row of "Records the report could not read",
-        and - where it is one of the lanes' records - one an empty orphan or
-        aging section names."""
-        self.unreadable.setdefault(key, why)
-        if record:
-            self.records_unread.setdefault(key, why)
-
-    def add(self, title: str, rows: list, empty: str, note_text: str = "",
-            partial: bool = False) -> None:
-        """`partial`: the section is read from the lanes' records, so an
-        empty one says "none found" only beside what could not be read."""
-        self.sections.append((title, rows, empty, note_text, partial))
-        self.counts[title] = len(rows)
-
-    def _recorded_parents(self) -> list:
-        """Every directory a `.lane-state` stands in beyond the checkouts'
-        parents (#170 B8). Two sources, and what neither could read is a
-        finding:
-
-          * a WALK of the estate, every directory but the caches: a lane whose
-            checkout sits in a plain directory inside a repository
-            (`xFactory/xFactories/<x>` on Eagle) keeps `.lane-state` there,
-            and `estate_repos` never enters such a directory;
-          * the register: each lane's recorded `dir`, whose parent #97 puts
-            the lane's control root in, wherever it is."""
-        out: list = []
-        if self.root:
-            walk = walk_estate(self.root)
-            for d in walk.lane_states:
-                out.append(os.path.dirname(d))
-            for what in walk.unread:
-                self._unread(what, "could not be listed: a lane's records under it are not read")
-        if self.helper.path:
-            dirs, why = register_lane_dirs(self.helper)
-            if why:
-                self._unread("the register's lane logs", why)
-            for d in dirs.values():
-                out.append(os.path.dirname(d.rstrip(os.sep)))
-        return [p for i, p in enumerate(out) if p and p not in out[:i]]
-
-    # ------------------------------------------------------------- reading
-    def build(self) -> None:
-        repos = estate_repos(self.root) if self.root else []
-        self.deps = dependents_map(repos)
-        clones = [r for r in repos if os.path.isdir(os.path.join(r, ".git"))]
-        canonical = self._canonical(clones)
-        self.canonical = canonical
-        # T018: EVERY CANONICAL ASSEMBLY'S LEGS, each a checkout of its own.
-        self.legs = self._assembly_legs(canonical)
-        parents = _lane_parents(self.root, canonical) + self._recorded_parents()
-        self.state_dirs = _lane_state_dirs(parents)
-        self.tree_roots = _lane_tree_roots(parents)
-        self._foreign(clones, canonical)
-        closed = self._closed_lanes()
-        self._orphans(closed)
-        self._branches(canonical)
-        self._root_main(canonical)
-        if self.legs:
-            self._legs_section()
-        self._aging(canonical)
-        self._caches_and_sandboxes()
-        self._ignored_and_evidence(repos, canonical)
-        self._archives()
-        self._workspace_hygiene()
-        self._status_all()
-        self.add("Records the report could not read", [[p, w] for p, w in
-                                                      sorted(self.unreadable.items())], "none",
-                 "UNKNOWN IS NEVER ABSENT: a lane snapshot, inventory or tree the report "
-                 "could not read is one whose findings above may be missing.")
-
-    # A READ THAT FAILED IS A FINDING, never an empty answer (Amendment 7(d)):
-    # an inventory the report could not read would otherwise make it clean.
-    def _ls(self, d: str, record: bool = True) -> list:
-        try:
-            return sorted(os.listdir(d))
-        except (FileNotFoundError, NotADirectoryError):
-            return []
-        except OSError as exc:
-            self._unread(d, f"could not be listed ({exc.strerror or exc})", record)
-            return []
-
-    def _record(self, path: str, need_path: bool = False) -> dict:
-        try:
-            with open(path, encoding="utf-8") as fh:
-                text = fh.read()
-        except FileNotFoundError:
-            return {}
-        except (OSError, UnicodeDecodeError) as exc:
-            self._unread(path, "could not be read ("
-                         + (getattr(exc, "strerror", "") or str(exc)) + ")")
-            return {}
-        out = {}
-        for line in text.splitlines():
-            key, sep, value = line.partition(": ")
-            if sep:
-                out[key.strip()] = value.strip()
-        if need_path and not out.get("path"):
-            self._unread(path, "an inventory record that names no path")
-        return out
-
-    def _tree_records(self, tdir: str) -> list:
-        return [self._record(os.path.join(tdir, f), need_path=True) for f in self._ls(tdir)
-                if f.endswith(".yaml") and not f.startswith(".")]
-
-    def _canonical(self, clones: list) -> list:
-        """The estate's own checkouts: a clone outside every worktree
-        container. Of several clones of one origin, the one whose folder is
-        named for the repository is the checkout and the rest are duplicates."""
-        by_origin: dict = {}
-        for c in clones:
-            if _under_container(c, self.root):
-                continue
-            url = git_out(c, "config", "--get", "remote.origin.url") or ""
-            key = (slug_of(url) or url).lower().rstrip("/")
-            by_origin.setdefault(key, []).append(c)
-        self.duplicates: dict = {}
-        out = []
-        for key, group in by_origin.items():
-            if not key or len(group) == 1:
-                out.extend(group)
-                continue
-            name = key.rsplit("/", 1)[-1].replace(".git", "")
-            named = [g for g in group if os.path.basename(g).lower() == name]
-            # ONE CHECKOUT PER ORIGIN, CHOSEN DETERMINISTICALLY: the one named
-            # for the repository, the shallowest of several so named, and the
-            # shallowest of all where none is. The rest are duplicates - never
-            # all of them canonical, which would hide the finding.
-            pool = named or group
-            keep = sorted(pool, key=lambda g: (g.count(os.sep), g))[0]
-            out.append(keep)
-            for g in group:
-                if g != keep:
-                    self.duplicates[g] = (keep, len(named) != 1)
-        return sorted(out)
-
-    def _assembly_legs(self, canonical: list) -> list:
-        """T018 (opensoft/openRepoTools#186): THE LEGS OF EVERY CANONICAL
-        ASSEMBLY - a checkout whose own `project.yaml` declares a leg other than
-        itself, read by `lanes-edit.sh project-legs`. A leg is a submodule, its
-        `.git` a FILE, so no leg was ever canonical and the branches all lane
-        work makes after a split never reached this report. Each is read as a
-        checkout of its own, its rows naming its assembly. A checkout with no
-        `project.yaml` is asked nothing, so a report of single repositories is
-        what it always was; a manifest that could not be read is a row of the
-        last section."""
-        legs = []
-        for c in canonical:
-            rows, why = project_legs(self.helper, c)
-            if why:
-                self._unread(c, f"its legs could not be read: {why}", record=False)
-                continue
-            for repository, decl, path in rows:
-                leg = Leg(path, decl, repository, c)
-                probe_leg(leg)
-                if leg.checkout or leg.read_error:
-                    legs.append(leg)
-        return legs
-
-    def _leg_cell(self, path: str) -> str:
-        """'' for a canonical checkout; for a leg, which assembly it is under -
-        by its real path too, because `_checkouts` keeps the FIRST spelling of
-        a checkout that is both, and that is the canonical one."""
-        legs = getattr(self, "legs", [])
-        if not legs:
-            return ""
-        for g in legs:
-            if g.path == path:
-                return f"the {g.decl} leg of {g.assembly}"
-        rp = real(path)
-        for g in legs:
-            if g.real == rp:
-                return f"the {g.decl} leg of {g.assembly}"
-        return ""
-
-    def _checkouts(self, canonical: list) -> list:
-        """The checkouts the branch, `main` and rescue sections read: every
-        canonical checkout, then every leg checked out here (T018), EACH ONCE
-        BY ITS REAL PATH, in that order. A leg whose `.git` is a directory - a
-        clone, not a submodule's gitfile - is also one of the estate's
-        canonical checkouts, and read once as each it printed every branch row
-        and its `main` row twice (the read-only triad measurement of
-        2026-10-17, finding 1). With no leg checked out it is `canonical`
-        itself, untouched, so a report of single repositories cannot move."""
-        legs = [g.path for g in getattr(self, "legs", []) if g.checkout]
-        if not legs:
-            return list(canonical)
-        out, seen = [], set()
-        for c in canonical + legs:
-            r = real(c)
-            if r in seen:
-                continue
-            seen.add(r)
-            out.append(c)
-        return out
-
-    def _legs_section(self) -> None:
-        """T018: every leg checkout holding edits no commit carries or commits
-        no origin ref holds - or that could not be read - under its assembly."""
-        rows = []
-        for g in self.legs:
-            read_leg(g, "")
-            decide_leg(g)
-            if g.disposition in ("clean", "absent"):
-                continue
-            state = (g.read_error if g.disposition == "unreadable" else
-                     "; ".join(p for p in (
-                         f"{g.dirty} dirty or untracked path(s)" if g.dirty else "",
-                         ("HEAD carries commit(s) no origin ref holds"
-                          + (f" ({g.ahead} ahead of {g.upstream})" if g.upstream and g.ahead
-                             else "")) if g.head and g.on_origin is False else "") if p))
-            rows.append([g.path, f"the {g.decl} leg of {g.assembly}", g.label(), state])
-        self.add("Assembly legs with uncommitted or unpublished work", rows,
-                 "none: every leg checkout is clean and its HEAD is on origin",
-                 "A leg is a checkout of its own under its assembly (T018): it is the "
-                 "assembly's, shared by every lane it homes, and a person's to commit and push.")
-
-    def _foreign(self, clones: list, canonical: list) -> None:
-        rows = []
-        for c in clones:
-            container = _under_container(c, self.root)
-            why = ""
-            if container:
-                why = f"a CLONE inside {container}, where a lane makes worktrees"
-            elif c in self.duplicates:
-                first, ambiguous = self.duplicates[c]
-                why = f"a second clone of {first}'s origin" + (
-                    " (no single clone is named for the repository; the shallowest is "
-                    "taken as its checkout)" if ambiguous else "")
-            if not why:
-                continue
-            # `%cd --date=short`, never `%cs`: `%cs` is git 2.21's, and an older git
-            # prints the placeholder itself where the date belongs (#170 (d)).
-            last = git_out(c, "log", "-1", "--date=short", "--format=%cd") or "?"
-            msg = git_out(c, "log", "-1", "--format=%B") or ""
-            owner = (re.findall(r"^Lane:\s*(\S+)", msg, re.MULTILINE) or ["-"])[-1]
-            lean = leaned_on(c, git_common_dir(c), self.deps)
-            rows.append([c, why, human_size(dir_size(c)), last, owner,
-                         ("LOAD-BEARING: " + _lean_text(lean)) if lean else ""])
-        self.add("FOREIGN repositories", rows, "none: every clone is the estate's own checkout",
-                 "A lane creates worktrees, never clones. Each is a person's to dispose of.")
-
-    def _closed_lanes(self) -> dict:
-        """{lane: why} for every lane whose snapshot is CLOSED or whose log's
-        last lane-kind line is ENDED or RETIRED."""
-        closed: dict = {}
-        for d in self.state_dirs:
-            for lane in self._ls(d):
-                if self._record(os.path.join(d, lane, "lane-state.yaml")).get("state") == "CLOSED":
-                    closed[lane] = "its snapshot is CLOSED"
-        wroot = self.helper.workspace_root() if self.helper.path else ""
-        if wroot:
-            branch = os.environ.get("LANES_BRANCH", "main")
-            proc = git(wroot, "grep", "-E", "-e",
-                       "^(STARTED|RESUMED|PAUSED|ENDED|RETIRED) — lane ",
-                       f"origin/{branch}", "--", "lanes/log")
-            if proc.returncode not in (0, 1):
-                # A GREP THAT FAILED IS NO "NO EVENTS" (#170 G3): exit 1 is no
-                # match; anything else - a ref that is not there, a repository
-                # git cannot read - leaves every log-only ENDED lane unknown.
-                self._unread(f"the register's ENDED and RETIRED lines (origin/{branch})",
-                             f"git grep exited {proc.returncode}: " + _first_line(proc.stderr))
-            last: dict = {}
-            for line in proc.stdout.splitlines():
-                _ref, _, rest = line.partition(":")
-                fname, _, text = rest.partition(":")
-                last[os.path.basename(fname)[:-3]] = text.split(" ", 1)[0]
-            for lane, verb in last.items():
-                if verb in ("ENDED", "RETIRED"):
-                    closed.setdefault(lane, f"its log ends {verb}")
-        return closed
-
-    def _orphans(self, closed: dict) -> None:
-        rows = []
-        seen = set()
-        for d in self.state_dirs:
-            for lane in sorted(closed):
-                for rec in self._tree_records(os.path.join(d, lane, "trees")):
-                    path = rec.get("path", "")
-                    if path and os.path.isdir(path) and real(path) not in seen:
-                        seen.add(real(path))
-                        rows.append([path, lane, closed[lane], "lane-worktrees sweep " + lane])
-        for lane, lroot in [(ln, r) for ln in sorted(closed) for r in self.tree_roots]:
-            ldir = os.path.join(lroot, lane)
-            for n in self._ls(ldir):
-                full = os.path.join(ldir, n)
-                if os.path.isdir(full) and real(full) not in seen:
-                    seen.add(real(full))
-                    rows.append([full, lane, closed[lane], f"lane-worktrees sweep {lane} "
-                                 "--include-scratch --include-foreign --word \"<yours>\""])
-        self.add("Orphaned worktrees of ENDED lanes", rows, "none", partial=True)
-
-    def _branches(self, canonical: list) -> None:
-        rows = []
-        fmt = ("%(refname:short)%1f%(objectname:short=12)%1f%(upstream:short)%1f"
-               "%(upstream:track)%1f%(committerdate:iso-strict)%1f%(contents:trailers)%00")
-        for c in self._checkouts(canonical):
-            proc = git(c, "for-each-ref", f"--format={fmt}", "refs/heads/")
-            if proc.returncode != 0:
-                continue
-            regs = worktree_registrations(c)
-            if regs is None:
-                self._unread(c, "its worktree registrations could not be listed", record=False)
-                regs = []
-            held = {r.get("branch", "")[len("refs/heads/"):] for r in regs if r.get("branch")}
-            for rec in proc.stdout.split("\0"):
-                cols = rec.strip("\n").split("\x1f")
-                if len(cols) < 6:
-                    continue
-                name, tip, up, track, date, trailers = cols[:6]
-                if name in PROTECTED_BRANCHES or name.startswith("rescue/"):
-                    continue
-                if not up:
-                    state = "no upstream"
-                elif "gone" in track:
-                    state = f"upstream {up} gone"
-                elif "ahead" in track and "behind" in track:
-                    state = f"diverged from {up} {track}"
-                elif "ahead" in track:
-                    state = f"unpushed {track}"
-                else:
-                    continue
-                owner = (re.findall(r"^Lane:\s*(\S+)", trailers, re.MULTILINE) or ["-"])[-1]
-                rows.append([f"{c} {name}", tip, state, f"{_age_days(date)} d",
-                             owner, "held by a worktree" if name in held else ""]
-                            + ([self._leg_cell(c)] if self._leg_cell(c) else []))
-        rows.sort(key=lambda r: -int(r[3].split()[0]))
-        self.add("Unmerged branches with a missing, diverged or unpushed upstream", rows,
-                 "none", "Listed, never deleted: a person pushes each to rescue/<lane>/... "
-                 "or gives a word.")
-
-    def _root_main(self, canonical: list) -> None:
-        rows = []
-        for c in self._checkouts(canonical):
-            if git(c, "rev-parse", "-q", "--verify", "refs/heads/main").returncode != 0 or \
-                    git(c, "rev-parse", "-q", "--verify", "refs/remotes/origin/main").returncode != 0:
-                continue
-            n = git_out(c, "rev-list", "--count", "refs/remotes/origin/main..refs/heads/main") or "0"
-            if not n.isdigit() or int(n) == 0:
-                continue
-            paths = (git_out(c, "diff", "--name-only", "refs/remotes/origin/main...refs/heads/main")
-                     or "").splitlines()
-            only = bool(paths) and all(p.startswith(HANDOFF_PATHS) for p in paths)
-            rows.append([c, f"local main ahead of origin by {n}",
-                         "only handoff/register paths" if only else f"{len(paths)} path(s)",
-                         "Amendment 4: handoffs and the register live in the workspace "
-                         "repository and are pushed per write" if only else
-                         "push it through a pull request, or a person's word"]
-                        + ([self._leg_cell(c)] if self._leg_cell(c) else []))
-        self.add("Root main divergence", rows, "none")
-
-    def _aging(self, canonical: list) -> None:
-        aging = self.conf["aging_days"]
-        rows = []
-        rescue_count = 0
-        seen = set()
-        for c in self._checkouts(canonical):
-            proc = git(c, "for-each-ref", "--format=%(refname)\t%(committerdate:iso-strict)",
-                       "refs/heads/rescue/", "refs/remotes/origin/rescue/")
-            for line in proc.stdout.splitlines():
-                ref, _, date = line.partition("\t")
-                name = ref.split("/rescue/", 1)[1]
-                if (c, name) in seen:
-                    continue
-                seen.add((c, name))
-                rescue_count += 1
-                age = _age_days(date)
-                if age >= aging:
-                    first = name.split("/", 1)[0] if "/" in name else ""
-                    owner = first if LANE_SHAPED_RE.match(first) else "-"
-                    rows.append([f"{c} rescue/{name}", f"rescue branch, {age} d",
-                                 owner, "awaiting disposition"]
-                                + ([self._leg_cell(c)] if self._leg_cell(c) else []))
-        for d in self.state_dirs:
-            for lane in self._ls(d):
-                for rec in self._tree_records(os.path.join(d, lane, "trees")):
-                    path = rec.get("path", "")
-                    if not path or not os.path.isdir(path):
-                        continue
-                    dirt = git_out(path, "status", "--porcelain")
-                    if dirt is None:
-                        self._unread(path, f"lane {lane}'s inventory tree; git status could "
-                                           "not be read in it")
-                        continue
-                    if not dirt:
-                        continue
-                    newest = _gitdir_activity(path)
-                    age = int((self.now - newest) // 86400) if newest else 0
-                    if age >= aging:
-                        rows.append([path, f"dirty inventory tree, {age} d", lane,
-                                     "awaiting disposition"])
-        self.rescue_count = rescue_count
-        self.add(f"Awaiting disposition (older than {aging} days)", rows, "none", partial=True)
-
-    def _caches_and_sandboxes(self) -> None:
-        rows = []
-        roots = []
-        for lroot in getattr(self, "tree_roots", []):
-            try:
-                roots += [os.path.join(lroot, n) for n in sorted(os.listdir(lroot))]
-            except OSError:
-                pass
-        for c in getattr(self, "canonical", []):
-            wt = os.path.join(c, ".claude", "worktrees")
-            if os.path.isdir(wt):
-                roots.append(wt)
-        for root in roots:
-            for path, size in find_caches(root):
-                rows.append([path, "cache", size])
-        for it in sandbox_items(ProcScan(), self.conf):
-            rows.append([it.path, "sandbox", it.size])
-        rows.sort(key=lambda r: -r[2])
-        total = sum(r[2] for r in rows)
-        self.add(f"Caches and sandboxes ({human_size(total)} in all)",
-                 [[p, k, human_size(s)] for p, k, s in rows], "none",
-                 "Removed without archiving by `--include-caches` / `--include-sandboxes`.")
-
-    def _ignored_and_evidence(self, repos: list, canonical: list) -> None:
-        threshold = self.conf["ignored_report_mb"] * 1024 * 1024
-        big, evidence = [], []
-        for r in repos:
-            proc = git(r, "ls-files", "--others", "--ignored", "--exclude-standard",
-                       "--directory", "-z")
-            if proc.returncode != 0:
-                self._unread(r, "its ignored files could not be listed", record=False)
-            # EVERY IGNORED ENTRY IS EVIDENCE-SHAPED OR NOT BY ITS NAME (#170 item
-            # 9): an ignored `junit-results.xml` is a FILE, and keeping only the
-            # directories (which `du` sizes) dropped it from the evidence match.
-            entries = [p for p in proc.stdout.split("\0") if p] if proc.returncode == 0 else []
-            ignored = [p.rstrip("/") for p in entries if p.endswith("/")]
-            sizes = _du([os.path.join(r, p) for p in ignored]) if ignored else {}
-            for path, size in sizes.items():
-                if size >= threshold:
-                    big.append([path, human_size(size)])
-            # THE UNTRACKED LISTING IS READ LIKE THE IGNORED ONE (#179, Copilot
-            # round 2): one that failed is a finding, and its stdout is never
-            # taken for the repository's untracked files.
-            unt = git(r, "ls-files", "--others", "--exclude-standard", "--directory", "-z")
-            if unt.returncode != 0:
-                self._unread(r, "its untracked files could not be listed", record=False)
-            untracked = unt.stdout.split("\0") if unt.returncode == 0 else []
-            for p in (untracked + entries):
-                name = p.rstrip("/").rsplit("/", 1)[-1]
-                if p and EVIDENCE_NAME_RE.search(name):
-                    evidence.append([os.path.join(r, p.rstrip("/")), "untracked or ignored in "
-                                     + os.path.basename(r)])
-        if self.root:
-            repo_set = set(repos)
-            for n in self._ls(self.root, record=False):
-                full = os.path.join(self.root, n)
-                if full in repo_set or not os.path.isdir(full) or n.startswith(".lane-") \
-                        or n.endswith("-worktrees"):
-                    continue
-                if EVIDENCE_NAME_RE.search(n) or self._holds_reports(full):
-                    evidence.append([full, "a directory of reports beside the repositories"])
-        big.sort(key=lambda r: r[0])
-        self.add(f"Ignored directories over {self.conf['ignored_report_mb']} MB", big, "none")
-        self.add("Evidence-shaped paths inside the estate", evidence, "none",
-                 "One evidence root per repository: ${XDG_STATE_HOME:-$HOME/.local/state}/"
-                 "openRepoTools/evidence/<repo>/<UTC>-<slug>/. Each is a finding to move.")
-
-    @staticmethod
-    def _holds_reports(d: str) -> bool:
-        try:
-            for e in os.scandir(d):
-                if e.is_file() and EVIDENCE_NAME_RE.search(e.name):
-                    return True
-                if e.is_dir(follow_symlinks=False) and not e.name.startswith("."):
-                    for f in os.scandir(e.path):
-                        if f.is_file() and EVIDENCE_NAME_RE.search(f.name):
-                            return True
-        except OSError:
-            return False
-        return False
-
-    def _archives(self) -> None:
-        """`sweep --expire`'s dry run, folded in: what WOULD expire, and what
-        is past retention but kept because its rescue left origin. Expiring
-        stays an act (`sweep --expire --yes`); the report changes nothing."""
-        root = sweeps_dir()
-        keep = self.conf["retention_days"]
-        rows = []
-        for adir, age, disp, why in expiry_rows(self.conf):
-            if disp == "expire":
-                rows.append([adir, f"{age} d", "would expire: lane-worktrees sweep --expire --yes"])
-            elif age >= keep:
-                rows.append([adir, f"{age} d", "kept past retention: " + why])
-        self.sweeps_size = dir_size(root) if os.path.isdir(root) else 0
-        self.add(f"Sweep archives past retention ({keep} days)", rows, "none")
-
-    def _workspace_hygiene(self) -> None:
-        rows = []
-        wroot = self.helper.workspace_root() if self.helper.path else ""
-        if wroot:
-            # SURROGATEESCAPE, as every other reader here (#170 G10): one byte that
-            # is not UTF-8 in the workspace's `.gitignore` aborted the report.
-            try:
-                with open(os.path.join(wroot, ".gitignore"), encoding="utf-8",
-                          errors="surrogateescape") as fh:
-                    have = set(fh.read().splitlines())
-            except OSError:
-                have = set()
-            want = ["__pycache__/", "*.pyc", "*.pyo", ".pytest_cache/", ".mypy_cache/",
-                    ".ruff_cache/", "node_modules/", ".venv/", "venv/", "site-packages/"]
-            missing = [w for w in want if w not in have]
-            if missing:
-                # THE PATH IS QUOTED (#170 item 10): the command is offered to be
-                # pasted, and a workspace path with a space in it split the redirect.
-                rows.append([os.path.join(wroot, ".gitignore"), "lacks " + " ".join(missing),
-                             "printf '%s\\n' " + " ".join(f"'{m}'" for m in missing)
-                             + " >> " + shlex.quote(os.path.join(wroot, ".gitignore"))])
-            hist = git(wroot, "log", "--all", "--format=", "--name-only", "--",
-                       "*.pyc", "*__pycache__*")
-            paths = sorted({p for p in hist.stdout.splitlines() if p})
-            if paths:
-                rows.append([wroot, f"{len(paths)} bytecode path(s) in history, e.g. {paths[0]}",
-                             "a person's word: history is rewritten only on one"])
-        self.add("Workspace repository hygiene", rows, "none")
-
-    def _status_all(self) -> None:
-        # `LANE_WORKTREES_STATUS` names the estate command when it is not
-        # beside this one (a test names a fake; a person, their own build).
-        exe = os.environ.get("LANE_WORKTREES_STATUS", "")
-        if not exe:
-            exe = os.path.join(os.path.dirname(os.path.realpath(__file__)), "status")
-            if not os.access(exe, os.X_OK):
-                exe = shutil.which("status") or ""
-        rows = []
-        why = ""
-        if not exe:
-            why = "no `status` beside this command or on PATH"
-        else:
-            env = dict(os.environ)
-            if self.root:
-                # THE ESTATE THIS REPORT READ, however it was resolved: from
-                # `--estate`, `$PROJECTS_ROOT` or the home default.
-                env["PROJECTS_DIR"] = self.root
-            proc = run([exe, "--all"], env=env, timeout=600)
-            if proc.returncode not in (0, 1):
-                why = f"`status --all` exited {proc.returncode}: " + _first_line(proc.stderr)
-            context = ""
-            for line in proc.stdout.splitlines():
-                s = line.strip()
-                if line.startswith("=== "):
-                    context = s.strip("= ").replace("status ", "")
-                elif s.startswith("- "):
-                    rows.append([context, s[2:]])
-        self.add("`status --all` findings (pin drift and tracking are reported as what they "
-                 "are, never counted as dirt)", rows, "none", why)
-
-    # ------------------------------------------------------------ writing
-    def markdown(self) -> str:
-        host = os.environ.get("LANES_WORKSTATION") or socket.gethostname()
-        out = [f"# Estate report - {host} - {utc_now()}", "",
-               f"`{PROG} sweep --all --dry-run --report` over `{self.root or '(no estate)'}`. "
-               "It changed nothing.", "",
-               "| finding | count |", "|---|---|"]
-        for title, rows, _e, _n, _p in self.sections:
-            out.append(f"| {title} | {len(rows)} |")
-        out.append(f"| rescue branches (all ages) | {getattr(self, 'rescue_count', 0)} |")
-        out.append(f"| the sweeps directory | {human_size(getattr(self, 'sweeps_size', 0))} |")
-        for title, rows, empty, note_text, partial in self.sections:
-            out += ["", f"## {title}", ""]
-            if note_text:
-                out += [note_text, ""]
-            if not rows and partial and self.records_unread:
-                # UNKNOWN IS NEVER "NONE" (#170 B8): a lane whose records could
-                # not be read may hold exactly what this section looks for.
-                out.append(f"_none found in what could be read; {len(self.records_unread)} "
-                           "record(s) could not be read (see \"Records the report could not "
-                           "read\")_")
-                continue
-            if not rows:
-                out.append(f"_{empty}_")
-                continue
-            for r in rows[:500]:
-                out.append("- " + " · ".join(str(c).replace("\n", " ") for c in r if c != ""))
-            if len(rows) > 500:
-                out.append(f"- ... and {len(rows) - 500} more")
-        return "\n".join(out) + "\n"
-
-
-def report_all(opts) -> int:
-    rep = Report(opts)
-    rep.build()
-    text = rep.markdown()
-    post = opts.post or ""
-    if not post:
-        sys.stdout.write(text)
-        return 0
-    m = re.match(r"^([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)#(\d+)$", post)
-    if m:
-        fd, tmp = tempfile.mkstemp(prefix="lane-worktrees-report.", suffix=".md")
-        # SURROGATEESCAPE (#170 G11, G12): a row holding a path that is not
-        # UTF-8 is that path's bytes, never an internal error before `gh` runs.
-        with os.fdopen(fd, "w", encoding="utf-8", errors="surrogateescape") as fh:
-            fh.write(text)
-        try:
-            proc = run(["gh", "issue", "comment", m.group(2), "--repo", m.group(1),
-                        "--body-file", tmp], timeout=120)
-        finally:
-            os.unlink(tmp)
-        if proc.returncode != 0:
-            note(f"the report could not be posted to {post}: " + _first_line(proc.stderr))
-            sys.stdout.write(text)
-            return 1
-        say(f"{PROG}: the report was posted to {post}: {proc.stdout.strip()}")
-        return 0
-    try:
-        os.makedirs(os.path.dirname(os.path.abspath(post)), exist_ok=True)
-        with open(post, "w", encoding="utf-8", errors="surrogateescape") as fh:
-            fh.write(text)
-    except OSError as exc:
-        note(f"the report could not be written to {post}: {exc}")
-        sys.stdout.write(text)
-        return 1
-    say(f"{PROG}: the report is at {post}")
-    return 0
-
-
-# ======================================================= add: the creation
-
-#: A slice is one path component under the lane's own root, and the default
-#: branch name: what a ref and a directory both take.
-SLICE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]*$")
-
-
-def git_common_dir_of(path: str) -> str:
-    """The physical path of `path`'s repository's common git directory, or ''.
-    A leg and every worktree of its repository share one, under the
-    assembly's `.git/modules/`."""
-    common = git_out(path, "rev-parse", "--git-common-dir")
-    if not common:
-        return ""
-    if not os.path.isabs(common):
-        common = os.path.join(path, common)
-    return real(common)
-
-
-def add_tree(ns) -> int:
-    """`add <lane> <slice>` - the one act that MAKES a lane's worktree, and it
-    records the tree in the lane's #97 inventory in the same act
-    (opensoft/openRepoTools#163). A tree made by hand is legal git and FOREIGN
-    to every sweep until something records it; lane openRepoTools-3's own
-    inventory was empty while it had nine trees, so the gate could not tell
-    which were its. Nothing in this tooling made a worktree before this verb,
-    so this is where creation and the record become one act.
-
-    The tree goes under the lane's own root, `<parent of its dir>/
-    .lane-worktrees/<lane>/<slice>`, which only this lane's acts make, as a
-    `git worktree` of the lane's checkout (or `--checkout <dir>`). A new
-    branch is made with `--no-track`: a branch made from `origin/main` that
-    tracked it would push a writer's commits at main on a bare `git push`.
-
-    Exit 0: made and recorded, the path on stdout. 2: refused, and nothing
-    was made - including a record that failed after the tree was made, or a
-    `git worktree add` that failed after making it (a failing `post-checkout`
-    hook), when the fresh tree and the branch this act made are taken back
-    out. 1: something it made is left and not recorded; the commands are
-    printed. 64: usage."""
-    lane, slice_name = ns.lane or "", ns.slice or ""
-    usage = ("lane-worktrees add <lane> <slice> [--branch <name>] [--from <ref>] "
-             "[--checkout <dir>] [--dry-run]")
-    if not lane or not slice_name:
-        note(f"usage: {usage}")
-        return 64
-    if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._-]*$", lane):
-        note(f"usage: '{lane}' is not a lane name")
-        return 64
-    if not SLICE_RE.match(slice_name) or ".." in slice_name or slice_name.endswith(".lock"):
-        note(f"usage: '{slice_name}' is not a slice name (letters, digits, . _ -; one path "
-             "component, which is also the default branch name)")
-        return 64
-    if ns.checkout is not None and not os.path.isabs(ns.checkout):
-        note("usage: --checkout takes an absolute path")
-        return 64
-
-    def refuse(why: str) -> int:
-        note(f"REFUSED, nothing was made: {why}")
-        return 2
-
-    helper = Helper()
-    if not helper.path:
-        return refuse("no lanes-edit.sh beside this command or on PATH, and the record is its")
-    canon, why = helper.canon_lane(lane)
-    if why:
-        return refuse(f"lane {lane}'s name could not be resolved: {why}")
-    lane = canon
-    mproc = helper.call("managed-projection", lane)
-    if mproc.returncode == 0:
-        return refuse(f"lane {lane} is owned by the managed ledger (owner "
-                      f"{mproc.stdout.strip() or 'unnamed'}), and its worktrees are that "
-                      "ledger's (ruling 2026-10-04)")
-    if mproc.returncode != 8:
-        return refuse(f"whether the managed ledger owns lane {lane} is UNKNOWN (`lanes-edit.sh "
-                      f"managed-projection {lane}` exited {mproc.returncode}); an ownership "
-                      "nobody could read is never read as legacy (Amendment 7(d))")
-    dproc = helper.call("lane-dir", lane)
-    if dproc.returncode == 8:
-        return refuse(f"lane {lane} records no directory (Amendment 11(c)), so it has no "
-                      "root to make a tree under; start it with lane-start first")
-    if dproc.returncode != 0 or not dproc.stdout.strip():
-        return refuse(f"`lanes-edit.sh lane-dir {lane}` exited {dproc.returncode}: "
-                      + _first_line(dproc.stderr))
-    lane_dir = dproc.stdout.strip().rstrip("/") or "/"
-    checkout = (ns.checkout or lane_dir).rstrip("/") or "/"
-    top = git_out(checkout, "rev-parse", "--show-toplevel")
-    if top is None or real(top) != real(checkout):
-        return refuse(f"{checkout} is not the root of a git checkout"
-                      + (f" ({top} is)" if top else ""))
-    # T018 (opensoft/openRepoTools#186): THE LEG A TREE IS MADE FROM IS WHAT IS
-    # RECORDED. Where the lane's checkout is an ASSEMBLY, a tree made from one
-    # of its legs - the leg itself, or any worktree of that leg's repository -
-    # is recorded with the LEG as its checkout, which every reader of the
-    # inventory enumerates. A checkout with no `project.yaml` is asked nothing,
-    # and the record is the checkout given, as always.
-    record_co, leg_line, assembly_hint = checkout, "", ""
-    legs, why = project_legs(helper, lane_dir)
-    if why:
-        return refuse(f"the legs of the assembly {lane_dir} could not be read, so which "
-                      f"checkout a tree of it belongs to is unknown (Amendment 7(d)): {why}")
-    if legs:
-        made_from = git_common_dir_of(checkout)
-        for repository, decl, lpath in legs:
-            if made_from and os.path.isdir(lpath) and git_common_dir_of(lpath) == made_from \
-                    and real(git_out(lpath, "rev-parse", "--show-toplevel") or "") == real(lpath):
-                record_co = lpath
-                leg_line = (f" - the {decl} leg of {os.path.join(lane_dir, 'project.yaml')}"
-                            + (f" ({repository})" if repository else ""))
-                break
-        if not leg_line and real(checkout) == real(lane_dir):
-            assembly_hint = (f"lane {lane}'s checkout {lane_dir} is an ASSEMBLY, and this tree is "
-                             "of the assembly itself: a worktree does not check its legs out ("
-                             + ", ".join(f"{d}/" for _r, d, _p in legs) + " are empty in it). A "
-                             "tree of a leg is made from that leg: "
-                             + " or ".join(f"--checkout {os.path.join(lane_dir, d)}"
-                                           for _r, d, _p in legs))
-    # THE RECORD MUST HAVE SOMEWHERE TO GO BEFORE THE TREE IS MADE: a tree
-    # this act could not record is the very thing it exists to stop.
-    tproc = helper.call("lane-trees", lane)
-    if tproc.returncode not in (0, 8):
-        return refuse(f"lane {lane}'s inventory cannot be read or written (`lanes-edit.sh "
-                      f"lane-trees {lane}` exited {tproc.returncode}: "
-                      + _first_line(tproc.stderr) + ")")
-    root = os.path.join(os.path.dirname(lane_dir), ".lane-worktrees", lane)
-    path = os.path.join(root, slice_name)
-    if os.path.lexists(path):
-        return refuse(f"{path} already exists; a tree is made where nothing is, and one "
-                      f"already there is recorded with: lanes-edit.sh set-lane-tree {lane} {path}")
-    branch = ns.branch or slice_name
-    if git(checkout, "check-ref-format", "--branch", branch).returncode != 0:
-        return refuse(f"'{branch}' is not a branch name git takes")
-    exists = git(checkout, "rev-parse", "-q", "--verify", f"refs/heads/{branch}").returncode == 0
-    if exists and ns.from_ref:
-        return refuse(f"branch {branch} already exists, so --from {ns.from_ref} would be "
-                      "ignored; name a new branch, or drop --from to check this one out")
-    start = ns.from_ref or "HEAD"
-    # THE COMMIT A NEW BRANCH STARTS AT, resolved ONCE and handed to git as an
-    # id: the take-back below deletes the branch only while it still points
-    # here, so a commit made on it meanwhile (a `post-checkout` hook can make
-    # one) is never made unreachable.
-    start_oid = ""
-    if not exists:
-        start_oid = git_out(checkout, "rev-parse", "-q", "--verify", f"{start}^{{commit}}") or ""
-        if not start_oid:
-            return refuse(f"'{start}' names no commit in {checkout}")
-    argv = (["worktree", "add", path, branch] if exists else
-            ["worktree", "add", "--no-track", "-b", branch, path, start_oid])
-    if ns.dry_run:
-        note(f"DRY RUN, nothing was made: git -C {checkout} {' '.join(argv)}; then "
-             f"lanes-edit.sh set-lane-tree {lane} {path} --checkout {record_co}{leg_line}")
-        if assembly_hint:
-            note(assembly_hint)
-        say(path)
-        return 0
-    try:
-        os.makedirs(root, exist_ok=True)
-    except OSError as exc:
-        return refuse(f"the lane's root {root} could not be made: {exc}")
-    _ACTIVE["add"] = (lane, path)
-
-    def take_back(what: str) -> int:
-        """Undo what this act made - the tree's registration and directory, and
-        the branch where this act made it - after `what` went wrong. 2 where
-        nothing is left, 1 where something is, with the commands printed."""
-        left = []
-        regs = git(checkout, "worktree", "list", "--porcelain")
-        registered = None
-        if regs.returncode == 0:
-            registered = any(real(line[len("worktree "):]) == real(path)
-                             for line in regs.stdout.splitlines() if line.startswith("worktree "))
-        if registered:
-            if git(checkout, "worktree", "remove", path).returncode != 0:
-                left.append(f"the tree {path} (git -C {checkout} worktree remove {path})")
-        elif registered is None:
-            left.append(f"whatever git registered at {path} (its registrations could not be read)")
-        elif os.path.lexists(path):
-            # MADE AND NOT REGISTERED: nothing here proves it is git's alone,
-            # so it is named and never deleted blind.
-            left.append(f"the directory {path}, which git does not register")
-        if not exists:
-            tip = git_out(checkout, "rev-parse", "-q", "--verify", f"refs/heads/{branch}")
-            if tip and tip != start_oid:
-                # IT MOVED PAST WHERE THIS ACT STARTED IT: the commits on it are
-                # somebody's, and a branch is their only name.
-                left.append(f"branch {branch}, which this act made at {short(start_oid)} and "
-                            f"which now holds {short(tip)}: kept, so that commit stays reachable")
-            elif tip and (left or git(checkout, "update-ref", "-d", f"refs/heads/{branch}",
-                                      start_oid).returncode != 0):
-                left.append(f"branch {branch} at {short(tip)}, which this act made")
-        _ACTIVE.pop("add", None)
-        if not left:
-            note(f"REFUSED, nothing was made: {what}; the fresh tree {path} was removed "
-                 "again" + ("" if exists else f" and branch {branch} with it"))
-            return 2
-        note(f"{what}, and this is left of what this act made: {'; '.join(left)}. Record a "
-             f"tree that is wanted with: lanes-edit.sh set-lane-tree {lane} {path} "
-             f"--checkout {record_co}")
-        return 1
-
-    made = git(checkout, *argv)
-    if made.returncode != 0:
-        # A FAILED `worktree add` MAY HAVE MADE THE TREE ALREADY: a
-        # `post-checkout` hook runs after the checkout, and git returns its
-        # status. Whatever it left is taken back like a record that failed.
-        return take_back(f"git worktree add failed: {_first_line(made.stderr)}")
-    head = git_out(path, "rev-parse", "HEAD") or ""
-    caller = os.environ.get("LANES_SESSION") or os.environ.get("CLAUDE_CODE_SESSION_ID") or ""
-    record = ["set-lane-tree", lane, path, "--checkout", record_co]
-    if UUID_RE.match(caller):
-        record += ["--writer", caller]
-    rproc = helper.call(*record)
-    if rproc.returncode == 0:
-        note(f"made {path} on branch {branch} at {short(head)} in {checkout}{leg_line}; recorded "
-             f"in lane {lane}'s inventory as {rproc.stdout.strip() or '?'}"
-             + (f" with {record_co} as its checkout" if record_co != checkout else ""))
-        if assembly_hint:
-            note(assembly_hint)
-        _ACTIVE.pop("add", None)
-        say(path)
-        return 0
-    # THE RECORD FAILED: the fresh tree and the branch this act made are taken
-    # back out, so a tree nothing records is not left behind by the act whose
-    # whole point is that there are none. `worktree remove` without --force:
-    # nothing has been written in it yet, and git still refuses if it was.
-    return take_back(f"the tree was made and could NOT be recorded (`lanes-edit.sh "
-                     f"{' '.join(record)}` exited {rproc.returncode}: "
-                     f"{_first_line(rproc.stderr)})")
-
-
-# ==================================================================== main
-
-class _Parser(argparse.ArgumentParser):
-    def error(self, message):
-        raise Usage(message)
-
-
-def parse(argv: list):
-    parser = _Parser(prog=PROG, add_help=False)
-    parser.add_argument("verb", nargs="?")
-    parser.add_argument("lane", nargs="?")
-    parser.add_argument("slice", nargs="?")          # add's
-    parser.add_argument("--branch")                  # add's
-    parser.add_argument("--from", dest="from_ref")   # add's
-    parser.add_argument("--checkout")                # add's
-    mode = parser.add_mutually_exclusive_group()
-    mode.add_argument("--dry-run", action="store_true")
-    mode.add_argument("--yes", action="store_true")
-    parser.add_argument("--porcelain", action="store_true")
-    parser.add_argument("--bundle", action="store_true")
-    parser.add_argument("--branches", action="store_true")
-    parser.add_argument("--links", action="store_true")
-    parser.add_argument("--include-scratch", action="store_true")
-    parser.add_argument("--include-caches", action="store_true")
-    parser.add_argument("--include-sandboxes", action="store_true")
-    parser.add_argument("--include-foreign", action="store_true")
-    parser.add_argument("--word")
-    parser.add_argument("--live", action="append")
-    parser.add_argument("--fetch", action="store_true")
-    parser.add_argument("--push-untracked", action="store_true")
-    parser.add_argument("--estate")
-    parser.add_argument("--expire", action="store_true")
-    parser.add_argument("--all", action="store_true")
-    parser.add_argument("--report", action="store_true")
-    parser.add_argument("--post")
-    parser.add_argument("-h", "--help", action="store_true")
-    parser.add_argument("--version", action="store_true")
-    return parser.parse_args(argv)
-
-
-_ACTIVE: dict = {}
-
-
-def main(argv: list) -> int:
-    """The exit contract, whatever happens inside: an error no read caught is
-    exit 2 on a dry run (nothing was changed), and under `--yes` the archive's
-    DISPOSITION.md is written first and the exit is 1 (B2)."""
-    for stream in (sys.stdout, sys.stderr):
-        if hasattr(stream, "reconfigure"):
-            stream.reconfigure(errors="surrogateescape")
-    try:
-        return _main(argv)
-    except Exception as exc:  # pylint: disable=broad-except
-        import traceback
-        frames = [f for f in traceback.extract_tb(exc.__traceback__)
-                  if os.path.basename(f.filename) == os.path.basename(__file__)]
-        where = f" at {PROG} line {frames[-1].lineno}" if frames else ""
-        detail = f"{type(exc).__name__}: {exc}{where}"
-        added = _ACTIVE.get("add")
-        if added:
-            # `add` MADE A TREE BEFORE THE ERROR: "nothing was changed" would
-            # be false, and the tree may be one nothing records.
-            note(f"INTERNAL ERROR after the tree {added[1]} was made: {detail}; whether it is "
-                 f"recorded is in: lanes-edit.sh lane-trees {added[0]}")
-            return 1
-        sweep = _ACTIVE.get("sweep")
-        acted = bool(sweep is not None and sweep.acting)
-        if sweep is not None and sweep.opts.porcelain:
-            prow("refused", "internal error, outside the table: " + detail)
-        if acted:
-            try:
-                if sweep.archive:
-                    sweep._write_disposition()
-            except Exception:  # pylint: disable=broad-except
-                pass
-            note(f"INTERNAL ERROR part-way through --yes: {detail}; what was done is in "
-                 f"{tilde(sweep.archive) if sweep.archive else 'the table above'}")
-            return 1
-        note(f"INTERNAL ERROR, nothing was changed: {detail}")
-        return 2
-
-
-def _main(argv: list) -> int:
-    try:
-        ns = parse(argv)
-    except Usage as exc:
-        note(f"usage: {exc} (see {PROG} --help)")
-        return 64
-    if ns.help:
-        sys.stdout.write(__doc__)
-        return 0
-    if ns.version:
-        say(f"{PROG} {VERSION}")
-        return 0
-    if ns.verb == "add":
-        # THE SWEEP'S WORDS ARE NOT ADD'S: a flag a verb does not read is a
-        # line that does not do what it says.
-        theirs = [flag for flag, given in (
-            ("--yes", ns.yes), ("--porcelain", ns.porcelain), ("--bundle", ns.bundle),
-            ("--branches", ns.branches), ("--links", ns.links),
-            ("--push-untracked", ns.push_untracked),
-            ("--include-scratch", ns.include_scratch), ("--include-caches", ns.include_caches),
-            ("--include-sandboxes", ns.include_sandboxes),
-            ("--include-foreign", ns.include_foreign), ("--word", ns.word is not None),
-            ("--live", bool(ns.live)), ("--fetch", ns.fetch), ("--estate", ns.estate is not None),
-            ("--expire", ns.expire), ("--all", ns.all), ("--report", ns.report),
-            ("--post", ns.post is not None)) if given]
-        if theirs:
-            note(f"usage: {', '.join(theirs)} belong to sweep, not to add")
-            return 64
-        return add_tree(ns)
-    if ns.verb != "sweep":
-        note("usage: lane-worktrees sweep <lane> [--dry-run | --yes] ... | lane-worktrees "
-             "add <lane> <slice> ... (see --help)")
-        return 64
-    if ns.slice is not None or ns.branch is not None or ns.from_ref is not None \
-            or ns.checkout is not None:
-        note("usage: a slice, --branch, --from and --checkout are add's, and sweep takes "
-             "none of them")
-        return 64
-    if ns.all or ns.report or ns.post is not None:
-        if not (ns.all and ns.report) or ns.lane or ns.yes or ns.expire:
-            note("usage: the estate-wide sweep only reports: lane-worktrees sweep --all "
-                 "--dry-run --report [--post <path|owner/repo#n>]")
-            return 64
-        return report_all(ns)
-    if ns.expire:
-        if ns.lane:
-            note("usage: sweep --expire takes no lane: it reads every lane's archives")
-            return 64
-        return expire(ns)
-    if not ns.lane:
-        note("usage: lane-worktrees sweep <lane> [--dry-run | --yes] ... (see --help)")
-        return 64
-    if not re.match(r"^[A-Za-z0-9][A-Za-z0-9._-]*$", ns.lane):
-        note(f"usage: '{ns.lane}' is not a lane name")
-        return 64
-    if ns.word is not None and not ns.include_foreign:
-        note("usage: --word is the word --include-foreign acts on, and nothing else takes it")
-        return 64
-    opts = Options(ns)
-    sweep = Sweep(ns.lane, opts)
-    _ACTIVE["sweep"] = sweep
-    sweep.gather()
-    if sweep.usage:
-        note(f"usage: {sweep.usage}")
-        return 64
-    if sweep.refusal and not sweep.trees:
-        sweep.decide()
-        (sweep.porcelain if opts.porcelain else sweep.render)()
-        if not opts.porcelain:
-            note("REFUSED: " + sweep.refusal)
-        return 2
-    sweep.decide()
-    if opts.yes and not sweep.refusal:
-        sweep.act()
-    (sweep.porcelain if opts.porcelain else sweep.render)()
-    if sweep.refusal or sweep.refused_check:
-        return 2
-    if opts.yes:
-        return 1 if sweep.failed else 0
-    return 3 if sweep.retire_count() else 0
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv[1:]))
diff --git a/lanes b/lanes
deleted file mode 100755
index d58aa6ed..00000000
--- a/lanes
+++ /dev/null
@@ -1,833 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# lanes — the lanes of the checkout you are in, or every lane, newest first.
-#
-#   lanes            INSIDE a lane checkout: that repository's lanes, and the
-#                    next free position with the exact line that takes it.
-#                    Outside one: every lane the register and the logs know.
-#   lanes --all      every lane, whatever the cwd — it clears the narrowing
-#   lanes --here     only this workstation's lanes
-#   lanes --fetch    any of the above, after refreshing from origin
-#   lanes --index    any of the above, out of the DERIVED INDEX (Amendment 14)
-#   lanes --worktrees [<lane>|--all]
-#                    every open worktree the #97 inventory records - owner,
-#                    branch, lifecycle, dirty/unpushed, last seen, writer
-#                    (opensoft/openRepoTools#161); with --index, out of the
-#                    index's `worktrees` table, every workstation it holds
-#
-# THE DEFAULT IS EVERY LANE, AND THE NARROWING IS BY CHECKOUT (A11 Addendum 4
-# ruling 6, ratified "a11 addendum 4 yes" with ruling 6 answered NO, over the
-# settlement Brett Heap gave at 2026-09-13T20:38:11Z, verbatim "Narrow inside a
-# checkout (Recommended)"). It used to be scoped to the ASKING WORKSTATION,
-# which is in no clause: `window-lane` is scoped and the contract says so at
-# length, and this read is not. "List the lanes" on a two-workstation estate
-# means both. `--here` is the old default, kept as an option.
-#
-# Installed on PATH by `openRepoTools --install`. Brett Heap's direction of
-# 2026-09-13T15:34:30Z, verbatim — "we need a good simple way to restart and
-# list the lanes" — and RATIFIED as lane-collision-protocol Amendment 11
-# decision 6 on 2026-09-13T18:05:29Z, verbatim "Yes, build `lanes` in A11".
-#
-# IT IS ITS OWN WORD, AND `pclaude` WITH NO ARGUMENTS IS UNTOUCHED. The other
-# half of the same proposal had a bare `pclaude` print this listing, and that
-# REPEALS A RATIFIED DECISION: `pclaude` with no arguments prints the PROFILE
-# list today (`claude-profile:632`, `action="${1:-list}"`) and Amendment 11's
-# ratified decision 1 keeps `list`, `login`, `status` and `run` meaning what
-# they mean. `R-A11-9` took the other way out — one new word on PATH, nothing
-# repealed, and a listing readable from a bare shell that has never heard of a
-# profile.
-#
-# IT CHANGES NOTHING. Every read is Amendment 7's: out of `origin/<branch>`,
-# never the working tree, and it writes nothing, commits nothing and launches
-# nothing. It asks nothing either — a listing is output, not a picker
-# (ratified decision 3; decision 7 point 5 says why the two are different).
-#
-# `--index` READS THE DERIVED INDEX, AND ONLY WHEN TYPED (lane-collision-protocol
-# Amendment 14(b), ratified "ratify 48"). It is passed to the helper, whose
-# published reads of the register and the logs then answer out of
-# `lanes-index`'s copy; the rows, the footer and the exit are the source
-# read's, and stderr says which was read — `read: index (<store>) at
-# register@<sha12>; <k> commits behind`, or `read: sources (index <why>)` where
-# the index could not answer and the sources did. Never from the environment
-# or a configuration: a listing a person did not ask to read from a copy is
-# read from the record.
-#
-# LOCAL BY DEFAULT, `--fetch` TO REFRESH. Every read in this family sits in
-# front of a launch and a person typing one word wants an answer now, so the
-# default passes `LANES_NO_FETCH=1` and the listing says how old the checkout's
-# answer is. A stale answer a reader can see is worth more than a fresh one
-# they waited on.
-#
-# A LIVE FORK IS SHOWN AS A DEFECT TO RETIRE (ratified decision 8(e), from
-# Evidence 6). On 2026-09-13 an abandoned launch of a lane left behind a
-# `--fork-session` daemon of its transcript — a new session id, `kind: bg`, no
-# tmux, cwd `/workspace` — that went on orchestrating the same plan, relaunched
-# writers on the same three branches, wrote `RESUMED` and `PAUSED` lines into
-# the lane's log and messaged the interactive session claiming to be the holder
-# while citing a dead pid. It is never a holder and it must never write the
-# register; this listing names it, and the ONE act it prints is clause (k) rule
-# (e)'s — `lane-end <lane> --retire <pid|uuid>`, which PROVES the pid or uuid is
-# this lane's live fork and prints Amendment 6(d) filled in for it. IT WRITES
-# NOTHING (#26, the review of `29d3417`): a `RETIRED` carrying a payload would
-# be a seventh edit to in-force text and Amendment 7(b) gives that verb none, so
-# the read goes on naming the fork until the person takes 6(d) — which is what
-# the footer this command prints has said all along, and what this comment did
-# not. It kills nothing either; ending somebody's process is not a tool's act
-# (Amendment 8(f)).
-#
-# EXIT CODES, AND THEY ARE THE CONTRACT'S RATHER THAN THIS COMMAND'S (SPEC §15,
-# and clause (h)'s row for the read behind it): `0` rows · `8` none · `64` usage
-# · `2` A HELPER PREDATING AMENDMENT 11 · `1` a read failed.
-#
-# `64` AND `2` WERE THE WRONG WAY ROUND until this round (F-X4). A typo exited 2
-# where the contract gives 64, and a workstation whose `lanes-edit.sh` predates
-# this amendment — which is EVERY workstation until adoption act 3's install
-# reaches it — exited 1, the code reserved for a read that broke, where the
-# contract gives 2. The helper's own `lanes)` arm had them right all along; only
-# the command in front of it did not. `1` is this command's own and is not in the
-# contract's four: it is the residue, a read that answered nothing recognisable.
-#
-#   $LANES_EDIT   the register's reader (default: lanes-edit.sh beside this file)
-#
-# `lane <name>` BINDS one of these — the launcher for a parked one, the attach
-# for one live here — and a bare `lane` is that listing as a NUMBERED PICK with
-# one question under it (Amendment 18 Addendum 1). This command asks nothing and
-# binds nothing: it is the read, and it shows the rows a pick hides — the closed
-# lanes, the dormant ones, and every column.
-
-set -euo pipefail
-
-prog="${0##*/}"
-SELF="${BASH_SOURCE[0]:-$0}"
-selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-
-say() { printf '%s\n' "$*"; }
-die() { printf '\n%s: REFUSED: %s\n' "$prog" "$1" >&2; exit "${2:-64}"; }
-
-usage() {
-	cat <<'USAGE'
-lanes [--fetch] [--index] [--all] [--here] [--closed] [--repo <owner/repo>]
-      [--dir <path>] [--prefix <repo>] [--ws <workstation>]
-      [--rename <old> <new>]
-lanes --worktrees [<lane> | --all] [--index] [--fetch]
-
-Inside a lane checkout: THAT REPOSITORY's lanes, ending with the next free
-position and the exact `lane-start <repo> <n>` that takes it. Outside one: every
-lane the register and the lane logs know. Newest activity first: name, state,
-workstation, profile, tmux window, last transcript uuid, directory, held objects
-and age — and the ONE act for it: for a PAUSED lane the exact command that binds
-it, and for a LIVE one the exact `tmux` that attaches to it, because a lane that
-is running is never started a second time.
-
-  --fetch          refresh from origin first. Without it the read is LOCAL and
-                   the foot of the listing says how old this checkout's answer
-                   is: a person typing one word wants an answer now.
-  --index          read the DERIVED INDEX instead of the published register
-                   and logs (Amendment 14): the same rows, the same exit, and
-                   one line on stderr saying which was read — `read: index
-                   (<store>) at register@<sha12>; <k> commits behind`, or
-                   `read: sources (index <why>)` where the index cannot
-                   answer and the sources do. Only when typed: never from the
-                   environment or a configuration.
-  --all            every lane, whatever the cwd: it clears the checkout
-                   narrowing as well as any --repo/--dir/--ws given with it.
-  --prefix <repo>  the lanes NAMED for that repository, and the next free
-                   position for it. `lane-start <repo>` with no position asks
-                   for exactly this rather than rendering a listing of its own.
-  --here           only this workstation's lanes. This was the default before
-                   Amendment 11 Addendum 4 ruling 6 and is an option now.
-  --closed         add the CLOSED and the DORMANT lanes, which this listing
-                   leaves out by default (Amendment 19(b)). CLOSED is a lane
-                   whose object log's last lane-kind line is ENDED or RETIRED;
-                   DORMANT is a row with NO object log and no live session here
-                   — a lane from before Amendment 7, or one whose log was never
-                   created. Each gets a second line saying which it is, when it
-                   started, what its state cell still says, and whether that
-                   cell says the work was unpushed, lost or owed. It combines
-                   with --all, --here and the narrowing flags; the NEXT FREE
-                   POSITION below always counts them, listed or not.
-  --repo <o/r>     only lanes whose register home is that repository.
-  --dir <path>     only lanes whose recorded directory is that path.
-                   --repo and --dir together are an OR, not an AND: a lane's
-                   home repository and the checkout it sits in are not the same
-                   fact.
-  --ws <name>      another workstation's lanes.
-  --worktrees [<lane> | --all]
-                   every open worktree of one lane, or of every lane: the #97
-                   inventory each lane's handoff recorded beside it — owner,
-                   branch, lifecycle, dirty and unpushed counts, when it was
-                   last seen and whether the lane's writer is live
-                   (opensoft/openRepoTools#161). Every field is that LAST
-                   OBSERVATION and nothing is recomputed: the current truth of a
-                   lane is `lanes-edit.sh lane-reconcile <lane>`, which reads the
-                   disk. Without --index it reads this workstation's sidecars;
-                   WITH it, the derived index's `worktrees` table — every
-                   workstation syncing into that store, so Raven sees Eagle's
-                   leftovers — and stderr says which, as for the listing. It
-                   takes none of the listing's narrowing flags. A lane whose
-                   inventory could not be read is a NOT READ line, and a lane
-                   listing that could not be read whole a NOT WHOLE line
-                   (opensoft/openRepoTools#173): neither is a lane with no
-                   worktrees.
-  --rename <old> <new>
-                   REFUSED, and it names the word that does it:
-                   `lane-rename <old> <new>`. This command writes nothing
-                   (Amendment 11(j)) and a rename is four files in one commit,
-                   so the act is a word of its own (Amendment 16(h)) — the
-                   option is here because that is the spelling a person reaches
-                   for, and an option that is silently unknown answers them
-                   with a usage line instead of the act.
-  -h, --help       this.
-
-Exit: 0 rows · 8 none · 64 usage · 2 a helper predating Amendment 11 · 1 a read failed.
-
-It writes nothing, launches nothing and asks nothing. `lane <name>` is what
-BINDS one — the launcher for a parked lane, the attach for one live here — and a
-bare `lane` is this listing as a numbered pick with one question under it.
-RENAMING one is `lane-rename <old> <new>`, a word of its own for the same reason
-(Amendment 16(h)); `lanes --rename` is refused and names it.
-USAGE
-}
-
-LANES_EDIT="${LANES_EDIT:-}"
-if [ -z "$LANES_EDIT" ]; then
-	if [ -x "$selfdir/lanes-edit.sh" ]; then LANES_EDIT="$selfdir/lanes-edit.sh"
-	else LANES_EDIT="$(command -v lanes-edit.sh 2>/dev/null || printf '')"
-	fi
-fi
-[ -n "$LANES_EDIT" ] && [ -x "$LANES_EDIT" ] || die "no register reader at ${LANES_EDIT:-lanes-edit.sh} — it is installed beside this
-    command by \`openRepoTools --install\`. Run that, or set \$LANES_EDIT." 1
-
-do_fetch=0
-# `--index` IS PASSED THROUGH AND NEVER MIMICKED HERE: the helper owns the
-# store and the fallback, exactly as it owns the network for `--fetch`.
-idx_args=()
-closed=0            # 1 once `--closed` has been seen
-narrowed=0          # 1 once anything has narrowed the listing
-all_given=0         # 1 once `--all` has been seen, wherever in the line it was
-# THE REPOSITORY THIS LISTING IS ABOUT, where it is about one. Set from the
-# checkout around the cwd, or named by `--prefix <repo>` — which is how
-# `lane-start <repo>` with no position asks for this listing rather than
-# rendering a second one of its own (A11 Addendum 4 ruling 6's third delta,
-# tracked as `opensoft/openRepoTools#28`). Its presence is what turns on the
-# NEXT FREE POSITION footer.
-here_repo=""
-args=()
-# `--worktrees` (opensoft/openRepoTools#161) TAKES ONE POSITIONAL, THE LANE, and
-# the listing takes none — so whether this line asks for worktrees is known
-# before the loop below meets a positional, wherever the flag stands in it.
-wt_mode=0
-wt_lane=""
-# `${1+"$@"}` AND NOT A BARE `"$@"`: bash 3.2 under `set -u` calls the empty
-# `"$@"` of a bare `lanes` an unbound variable and exits (tests/run.sh says why).
-for wt_a in ${1+"$@"}; do
-	case "$wt_a" in --worktrees) wt_mode=1 ;; esac
-done
-while [ $# -gt 0 ]; do
-	case "$1" in
-	-h | --help) usage; exit 0 ;;
-	--fetch) do_fetch=1; shift ;;
-	--index) idx_args=(--index); shift ;;
-	--worktrees) shift ;;
-	# `--all` CLEARS THE LABEL AS WELL AS THE FILTERS. The helper's `--all` drops
-	# `--repo`, `--dir` and `--prefix`, so the ROWS were right — but `here_repo`
-	# is this wrapper's own, and `lanes --all --prefix repoA11` (either order)
-	# listed every lane in the estate under a footer that said "of repoA11" and
-	# offered a next free position computed from one repository's rows. A count
-	# that names a repository it did not narrow to is worse than no count.
-	--all) args+=(--all); narrowed=0; here_repo=""; all_given=1; shift ;;
-	--here) args+=(--here); narrowed=1; shift ;;
-	# `--closed` IS NOT A NARROWING AND MUST NOT LOOK LIKE ONE. It widens the
-	# listing, so it neither sets `narrowed` nor joins `args` here: the array
-	# being empty is what the checkout narrowing below is gated on, and a flag
-	# sitting in it would stop `lanes --closed` inside a checkout meaning "this
-	# repository's lanes, the closed ones included". It is appended after that
-	# block instead.
-	--closed) closed=1; shift ;;
-	--repo | --dir | --ws | --prefix)
-		[ -n "${2-}" ] || die "$1 needs a value — see $prog --help" 64
-		[ "$1" = --prefix ] && here_repo="$2"
-		args+=("$1" "$2"); narrowed=1; shift 2 ;;
-	--repo=* | --dir=* | --ws=* | --prefix=*)
-		flag="${1%%=*}"; val="${1#*=}"
-		[ -n "$val" ] || die "$flag needs a value — see $prog --help" 64
-		[ "$flag" = --prefix ] && here_repo="$val"
-		args+=("$flag" "$val"); narrowed=1; shift ;;
-	# AMENDMENT 16(h) — `lanes` STAYS READ-ONLY, AND THE REFUSAL NAMES THE WORD.
-	# Brett Heap's request of 2026-09-14 spelled the act on this command —
-	# verbatim *"maybe lanes --rename <current lane name> <new lane name>"* —
-	# and the ratified spelling is a word of its own, because Amendment 11(j)'s
-	# *"it writes nothing"* is what makes this listing safe to run in front of
-	# every launch, and one writing option would make that sentence untrue of
-	# the command rather than of the option. So the flag is answered rather
-	# than silently unknown: a person who reaches for it gets the act, not a
-	# usage line.
-	--rename | --rename=*)
-		rn_a="${2-}"; rn_b="${3-}"
-		[ "${1%%=*}" = "$1" ] || { rn_a="${1#--rename=}"; rn_b="${2-}"; }
-		die "\`lanes\` writes nothing, launches nothing and asks nothing (Amendment 11(j)), and a
-    rename is four files in one commit. The word is its own:
-
-        lane-rename ${rn_a:-<old>} ${rn_b:-<new>}
-
-    It moves the row, the object log, the handoff and lanes/aliases.tsv in ONE
-    commit, comments on every object the lane holds, renames the window and types
-    the \`/rename\` — and the old name resolves for ever afterwards, here included
-    (lane-collision-protocol Amendment 16)." 64 ;;
-	--) shift ;;
-	-*) die "unknown option '$1' — see $prog --help" 64 ;;
-	*)
-		if [ "$wt_mode" = 1 ] && [ -z "$wt_lane" ]; then
-			wt_lane="$1"; shift
-		elif [ "$wt_mode" = 1 ]; then
-			die "--worktrees takes ONE lane, or --all — see $prog --help" 64
-		else
-			die "lanes takes no positional arguments; did you mean \`lane $1\`? — see $prog --help" 64
-		fi ;;
-	esac
-done
-
-# ------------------------------------------------ `--worktrees` (#161)
-#
-# EVERY OPEN WORKTREE, rendered from `lanes-edit.sh worktrees`' rows — the #97
-# inventory as each lane's handoff last recorded it, read from this
-# workstation's sidecars, or with `--index` from the derived index's
-# `worktrees` table, which holds every workstation that syncs into it. Where
-# the index is current, this workstation's rows are the same bytes either way,
-# and a store no other workstation syncs into prints exactly the source read;
-# stderr says which was read. It recomputes nothing and it decides nothing: the act
-# that reads the disk is `lanes-edit.sh lane-reconcile <lane>`, and the footer
-# says so.
-US="$(printf '\037')"
-if [ "$wt_mode" = 1 ]; then
-	for wt_a in ${args[@]+"${args[@]}"}; do
-		[ "$wt_a" = --all ] && continue
-		die "--worktrees takes ONE lane or --all, and none of the listing's narrowing flags ('$wt_a' was given) — see $prog --help" 64
-	done
-	[ "$closed" = 0 ] || die "--worktrees takes ONE lane or --all, not --closed: a closed lane's worktrees are listed with every other's — see $prog --help" 64
-	[ "$all_given" = 0 ] || [ -z "$wt_lane" ] || die "--worktrees takes ONE lane OR --all, not both — see $prog --help" 64
-	wt_args=()
-	if [ -n "$wt_lane" ]; then wt_args+=("$wt_lane"); else wt_args+=(--all); fi
-	[ "$do_fetch" = 1 ] && wt_args+=(--fetch)
-	rc=0
-	wt_err=""
-	wt_err_file="$(mktemp "${TMPDIR:-/tmp}/lanes-worktrees.XXXXXX" 2>/dev/null || printf '')"
-	if [ -n "$wt_err_file" ]; then
-		out="$("$LANES_EDIT" worktrees ${idx_args[@]+"${idx_args[@]}"} "${wt_args[@]}" 2>"$wt_err_file")" || rc=$?
-		wt_err="$(cat -- "$wt_err_file" 2>/dev/null || printf '')"
-		# `-e` AND NO `--` AFTER THE PATTERN: BSD's `grep` stops at its first
-		# operand, so a `--` there is a FILE it cannot open on macOS. A BARE
-		# `grep`, NOT `command grep` (opensoft/openRepoTools#292): this one exits
-		# 1 whenever the helper said nothing else, and macOS's bash 3.2 ends a
-		# `set -e` script where a utility run through `command` fails, `|| :`
-		# or not, which left `lanes --worktrees` at exit 1 with no output.
-		grep -v -e 'not fetching; reading origin/' "$wt_err_file" >&2 || :
-		rm -f -- "$wt_err_file"
-	else
-		out="$("$LANES_EDIT" worktrees ${idx_args[@]+"${idx_args[@]}"} "${wt_args[@]}")" || rc=$?
-	fi
-	case "$rc" in
-	0) : ;;
-	8)
-		say "no worktree is inventoried${wt_lane:+ for lane $wt_lane}."
-		say "  each handoff records its lane's trees (lanes-edit.sh set-lane-tree); the disk itself is read by"
-		say "  lanes-edit.sh lane-reconcile <lane>"
-		exit 8 ;;
-	64) die "bad arguments for the worktrees read — see $prog --help" 64 ;;
-	2)
-		case "$wt_err" in
-		*"unknown subcommand 'worktrees'"*)
-			die "the \`lanes-edit.sh\` on this workstation has no \`worktrees\` read, so it
-    predates opensoft/openRepoTools#161. Nothing is wrong with the inventory —
-    take the install:  openRepoTools --install" 2 ;;
-		esac
-		exit 2 ;;
-	*) die "$LANES_EDIT worktrees failed (exit $rc). That is NOT 'no worktree is inventoried', and
-    this command will not print an empty listing on an answer it did not get
-    (Amendment 7(d)). Run it by hand to see what it says." 1 ;;
-	esac
-	printf '%-11s %-26s %-16s %-13s %-7s %-34s %5s %8s  %-20s  %s\n' \
-		WORKSTATION LANE OWNER LIFECYCLE WRITER BRANCH DIRTY UNPUSHED "LAST SEEN" PATH
-	n=0; nl=0; nw=0; wt_unread=0; wt_partial=0; wt_lanes=" "; wt_wss=" "
-	while IFS="$US" read -r w_kind w_ws w_lane w_owner w_path w_branch w_base w_life w_gen w_op w_live w_seen w_last w_dirty w_unp w_prov; do
-		case "${w_kind:-}" in
-		PARTIAL)
-			# `PARTIAL <ws> <why>` (#173 item c1): the LANE LISTING these rows
-			# were read through was not whole, and the second field — read
-			# into `w_lane` — says which read failed.
-			printf '%-11s %-26s lane listing NOT WHOLE: %s\n' "$w_ws" "(every lane)" "$w_lane"
-			wt_partial=$((wt_partial + 1)) ;;
-		TREE)
-			case "${w_live:-}" in 1) w_wr=live ;; 0) w_wr=none ;; *) w_wr=unknown ;; esac
-			printf '%-11s %-26s %-16s %-13s %-7s %-34s %5s %8s  %-20s  %s\n' \
-				"$w_ws" "$w_lane" "${w_owner:-unknown}" "${w_life:-INDETERMINATE}" "$w_wr" \
-				"${w_branch:-unknown}" "${w_dirty:-?}" "${w_unp:-?}" "${w_seen:-never}" "$w_path"
-			n=$((n + 1))
-			case "$wt_lanes" in *" $w_ws/$w_lane "*) : ;; *) wt_lanes="$wt_lanes$w_ws/$w_lane "; nl=$((nl + 1)) ;; esac
-			case "$wt_wss" in *" $w_ws "*) : ;; *) wt_wss="$wt_wss$w_ws "; nw=$((nw + 1)) ;; esac ;;
-		UNREAD)
-			# `UNREAD <ws> <lane> <why>`: the third field is the reason.
-			printf '%-11s %-26s inventory NOT READ: %s\n' "$w_ws" "$w_lane" "$w_owner"
-			wt_unread=$((wt_unread + 1)) ;;
-		esac
-	done <<EOF
-$out
-EOF
-	say ""
-	say "$n worktree(s) in $nl lane(s) on $nw workstation(s), each as its lane's inventory last recorded it (LAST SEEN); nothing here is recomputed."
-	if [ "$wt_unread" != 0 ]; then
-		say "$wt_unread lane(s) above have an inventory that is there and could not be read: that is NOT a lane with no worktrees."
-	fi
-	if [ "$wt_partial" != 0 ]; then
-		say "the lane listing above is NOT WHOLE: a lane it could not name is missing from it, and that is NOT a lane with no worktrees."
-	fi
-	# THE ACT IS NAMED WITH WHERE IT RUNS (opensoft/openRepoTools#173, Copilot's
-	# fourth review of #171). An `--index` listing holds every workstation that
-	# syncs into the store, so Raven lists Eagle's rows, and `lane-reconcile`
-	# reads only the sidecars and the disk of the workstation it is run on. The
-	# line is the same on both reads, so the two stay the same bytes.
-	say "  the current truth of one lane:  lanes-edit.sh lane-reconcile <lane>, run ON THE WORKSTATION its rows name   (it reads that workstation's own sidecars and disk; this listing decides nothing)"
-	exit 0
-fi
-
-# `--all` WINS WHEREVER IT APPEARS IN THE LINE, so the label is cleared after the
-# loop and not inside the arm: `lanes --all --prefix repoA11` and
-# `lanes --prefix repoA11 --all` are the same command and must print the same
-# footer. The helper drops the FILTERS on `--all`; `here_repo` is this wrapper's
-# own and is what the footer, the count and the next-free-position are computed
-# from.
-if [ "$all_given" = 1 ]; then here_repo=""; fi
-
-# THE BARE WORD INSIDE A LANE CHECKOUT NARROWS TO THAT REPOSITORY (Brett Heap's
-# settlement of 2026-09-13T20:38:11Z, verbatim "Narrow inside a checkout
-# (Recommended)"; A11 Addendum 4 ruling 6; SPEC rev 6 §15).
-#
-# THE NARROWING IS THE READ'S OWN, not a second filter: `--dir` is clause (i)'s
-# and defaults here to the checkout around the cwd, `--repo` is that checkout's
-# `origin`, and the two are an OR — a lane's home repository and the checkout it
-# sits in are not the same fact. `--prefix` is the third term and is the LABEL
-# fallback, used by the read only where a lane has neither a home nor a `dir`:
-# a row with no log at all cannot be filed by either, and its name is the only
-# thing left. A lane whose home DISAGREES with its prefix is filed by its home.
-#
-# ANY EXPLICIT NARROWING SUPPRESSES THIS. `--repo`, `--dir`, `--ws` and `--here`
-# are the caller saying which lanes they mean, and `--all` says every one.
-origin_nwo() {
-	url="$(git -C "${1:-.}" remote get-url origin 2>/dev/null || :)"
-	[ -n "$url" ] || return 1
-	nwo="$(printf '%s\n' "$url" | sed -E 's#\.git$##; s#^git@[^:]+:##; s#^ssh://[^/]+/##; s#^https?://[^/]+/##')"
-	printf '%s\n' "$nwo" | grep -qE '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$' || return 1
-	printf '%s\n' "$nwo"
-}
-# THE REPOSITORY IS THE ONE `origin` NAMES, AND THE DIRECTORY'S NAME IS THE
-# FALLBACK — not the other way round. `basename $(git rev-parse --show-toplevel)`
-# is the name of the DIRECTORY this shell is standing in, and inside a WORKTREE
-# that is the worktree's own name: run in a worktree of `openRepoTools` called
-# `ort-a11` it narrowed to a repository called `ort-a11`, found none, and offered
-# `lane-start ort-a11 1` — a lane whose `$PROJECTS_ROOT/<repo>` cannot exist.
-# Every lane on this estate is named for the repository, which is what `origin`
-# says and what `repos.tsv` aliases, so the origin's own repository name is the
-# prefix wherever there is an origin. A checkout with no origin keeps the
-# directory name, because there is nothing else to have.
-here_root=""; here_nwo=""
-if [ "$narrowed" = 0 ] && [ ${#args[@]} -eq 0 ]; then
-	here_root="$(git rev-parse --show-toplevel 2>/dev/null || :)"
-	if [ -n "$here_root" ]; then
-		here_nwo="$(origin_nwo "$here_root" 2>/dev/null || :)"
-		if [ -n "$here_nwo" ]; then here_repo="${here_nwo#*/}"; else here_repo="$(basename -- "$here_root")"; fi
-		args+=(--dir "$here_root" --prefix "$here_repo")
-		[ -n "$here_nwo" ] && args+=(--repo "$here_nwo")
-	fi
-fi
-
-if [ "$closed" = 1 ]; then args+=(--closed); fi
-
-ws_pair="$("$LANES_EDIT" workstation 2>/dev/null || :)"
-ws_name="$(printf '%s' "$ws_pair" | cut -f1)"
-ws_src="$(printf '%s' "$ws_pair" | cut -f2)"
-
-# THE CONTAINER NOTICE, ON THE TOKEN THE HELPER ACTUALLY EMITS AND IN THE
-# HELPER'S OWN WORDS (`R-A11-14`, ratified verbatim "a11 addendum 3 yes").
-#
-# Two defects were in the three lines this replaces. The branch was
-# `hostname-in-container`, which `lanes_workstation_pair` has never emitted —
-# its three sources are `seam`, `hostname` and `container-unset`
-# (`lanes-edit.sh:371-383`) — so the notice could not print at all. And what it
-# printed was the act this toolset REJECTS BY NAME: `lanes-edit.sh:337-339`,
-# *"the rejected alternative — a `workstation:` key in `workspace.yaml` — is a
-# SECOND PLACE FOR THE TRUTH TO BE WRONG beside the variable the launcher
-# already sets."*
-#
-# THE SENTENCE IS ASKED FOR RATHER THAN RESTATED. `lanes_workstation_why` is the
-# one wording three writers already share, and this command carries no copy of
-# the workstation seam — the four that exist are byte-identical and held together
-# by `test_repo_hygiene.py`, and a fifth here would be the drift that test exists
-# to catch. `lanes-edit.sh workstation` prints that sentence on stderr and still
-# answers on stdout, because a read in front of a launch may not refuse; the read
-# above discarded that stderr, so this asks for it again. One extra 0.04 s fork,
-# and only on the path that is already printing a paragraph.
-#
-# IT IS A FUNCTION BECAUSE THE EMPTY LISTING NEEDS IT MOST. In a container with
-# no `LANES_WORKSTATION` the workstation column is the CONTAINER'S id, so no row
-# matches and the read exits 8 — and that is exactly the reader who has to be
-# told why their lanes vanished. Printed at the foot on the rows path and inside
-# the 8 arm on the other, from one definition.
-ws_notice() {
-	case "$ws_src" in
-	container-unset)
-		say ""
-		"$LANES_EDIT" workstation 2>&1 >/dev/null || : ;;
-	esac
-}
-
-# LOCAL IS THE HELPER'S OWN DEFAULT for this one read (SPEC rev 4 §15), so
-# `--fetch` is passed through rather than simulated here: one implementation of
-# "does this read touch the network", in the file that owns the network.
-#
-# AND A FETCH THAT DID NOT HAPPEN IS NOT A FETCH (#26, the fail-closed family,
-# `lanes:236`, taken on Brett Heap's word "Take it first, then land"). A read
-# that fetches MAY NOT REFUSE — it sits in front of a launch — so `log_sync`
-# falls back to the local refs and says so on stderr, *"fetch failed — reading
-# the logs as they stand locally"*, and answers 0. This command threw that
-# sentence away with `2>/dev/null` and then printed *"as of a fetch just now"*
-# over the top of it: the one line in the output a person reads to decide
-# whether the answer is CURRENT, asserting something the run had already been
-# told was false. The stderr of the fetch path is kept and rendered; the stderr
-# of the local path still is not, because there the notice is `LANES_NO_FETCH=1`
-# saying what the caller asked for.
-#
-# AND THE FALLBACK THAT MADE NO CAPTURE FILE THREW THEM AWAY AGAIN (#26, the
-# review of `c3ebcfe`, `lanes:280`). Where `mktemp` cannot make a file — a
-# `$TMPDIR` that is gone, full or not writable — this read ran with
-# `2>/dev/null`, so the helper's fallback sentence went to the same place it
-# went before this was fixed at all and the footer printed "as of a fetch just
-# now" over it. The temporary file is a CONVENIENCE for reading the notice back;
-# without one the notice still belongs to the person, so it is PASSED THROUGH to
-# the terminal and the footer stops asserting a freshness this run cannot check.
-rc=0
-fetch_err=""
-fetch_unchecked=0
-if [ "$do_fetch" = 1 ]; then
-	fetch_err_file="$(mktemp "${TMPDIR:-/tmp}/lanes-fetch.XXXXXX" 2>/dev/null || printf '')"
-	if [ -n "$fetch_err_file" ]; then
-		out="$("$LANES_EDIT" lanes --fetch ${idx_args[@]+"${idx_args[@]}"} ${args[@]+"${args[@]}"} 2>"$fetch_err_file")" || rc=$?
-		fetch_err="$(cat "$fetch_err_file" 2>/dev/null || printf '')"
-		rm -f -- "$fetch_err_file"
-		# THE ONE LINE THAT SAYS WHICH WAS READ reaches the person on this path
-		# too: the rest of this stream is rendered below only where the fetch
-		# fell back, and `read: …` is not about the fetch.
-		printf '%s\n' "$fetch_err" | command grep '^read: ' >&2 || :
-		# …AND ONLY THERE (Copilot round 3 on #164): the notes are rendered
-		# again, on STDOUT, under a fetch that fell back, where a `read:` line
-		# would be said twice and would make `--index` change the listing.
-		fetch_err="$(printf '%s\n' "$fetch_err" | command grep -v '^read: ' || :)"
-	else
-		out="$("$LANES_EDIT" lanes --fetch ${idx_args[@]+"${idx_args[@]}"} ${args[@]+"${args[@]}"})" || rc=$?
-		fetch_unchecked=1
-	fi
-else
-	# AND THE LOCAL PATH'S STDERR IS NOT ONE KNOWN SENTENCE ANY MORE (#26, the
-	# review of `37632b1`, `lanes:293`). `2>/dev/null` was written when the only
-	# thing on that stream was the helper saying `LANES_NO_FETCH=1` — the notice
-	# this command asks for, on every local read, which is why it was silenced.
-	# The helper now also says there that this workstation's SESSION RECORDS could
-	# not be read, which is the line telling a person that the STATE column is the
-	# log's verb alone and that a lane showing IDLE may be live. So the stream is
-	# KEPT and the one expected sentence is dropped out of it, rather than the
-	# stream being dropped for the sake of that sentence.
-	local_err_file="$(mktemp "${TMPDIR:-/tmp}/lanes-local.XXXXXX" 2>/dev/null || printf '')"
-	if [ -n "$local_err_file" ]; then
-		out="$("$LANES_EDIT" lanes ${idx_args[@]+"${idx_args[@]}"} ${args[@]+"${args[@]}"} 2>"$local_err_file")" || rc=$?
-		# `-e` BEFORE THE `--` (#54, the shape #53 fixed at `skills/restart/SKILL.md`):
-		# with the pattern as a bare operand a getopt that does not permute —
-		# BSD's, so every macOS shell, and GNU's under `POSIXLY_CORRECT` — takes
-		# the pattern for the first operand and reads `--` as a second, a FILE it
-		# cannot open. `-e` makes the pattern an option's argument, so `--` ends
-		# the options where it says it does.
-		grep -v -e 'not fetching; reading origin/' -- "$local_err_file" >&2 || :
-		rm -f -- "$local_err_file"
-	else
-		# No capture file, so nothing is filtered and everything reaches the
-		# person — the same answer the fetch path gives one branch up.
-		out="$("$LANES_EDIT" lanes ${idx_args[@]+"${idx_args[@]}"} ${args[@]+"${args[@]}"})" || rc=$?
-	fi
-fi
-
-# THE ONE PHRASE, AND IT IS THE HELPER'S OWN (`lanes-edit.sh:2902`): both the
-# failure and the timeout end *"reading the logs as they stand locally"*, so one
-# test covers both and neither is restated here.
-fetch_fell_back=0
-case "$fetch_err" in
-*"reading the logs as they stand locally"*) fetch_fell_back=1 ;;
-esac
-case "$rc" in
-0) : ;;
-8)
-	if [ -n "$here_repo" ]; then
-		# AN EMPTY REPOSITORY STILL GETS THE ANSWER A PERSON CAME FOR: the next
-		# free position, and the line that takes it, printed filled in.
-		#
-		# AND AN EMPTY LISTING IS NO LONGER AN EMPTY REGISTER (Copilot round 2 on
-		# #93). Since Amendment 19(b) a repository whose every row is CLOSED or
-		# DORMANT lists NOTHING — and its positions are all taken. Printing
-		# "next free position: 1" there would hand out a number a retired lane
-		# holds, which is the one thing 19(b) exists to prevent. So the position
-		# is ASKED FOR rather than assumed: `next-free` reads the register and
-		# the archive itself, so it answers over an empty listing.
-		e_next=""; e_rc=0
-		e_next="$(printf '' | "$LANES_EDIT" next-free "$here_repo" 2>/dev/null)" || e_rc=$?
-		if [ "$e_rc" != 0 ]; then e_next=""; fi
-		case "${e_next:-}" in '' | *[!0-9]*) e_next="" ;; esac
-		# WHETHER THERE ARE HIDDEN ROWS IS ASKED, NOT INFERRED FROM THE NUMBER
-		# (Copilot round 3 on #93). `next-free != 1` was a proxy, and it is wrong
-		# for the register that holds ONE hidden row at position 2 or later:
-		# there the lowest free position really is 1, and the listing would have
-		# said "no lane is recorded" about a repository that has one. The
-		# `--closed` read answers it directly, and it is made HERE — on the path
-		# that has already found nothing to show — and nowhere else.
-		e_hidden=0
-		e_hrc=0
-		# THE WHOLE STREAM IS READ, AND THE STATUS DECIDES BEFORE THE TEXT DOES
-		# (#138 item 15, Copilot round 20 on #93, and the gap beside it). `grep
-		# -q .` exits on the first line, and past a pipe buffer's worth of rows
-		# the producer then takes SIGPIPE: under `pipefail` the pipeline answered
-		# 141, `e_hidden` stayed 0, and the listing said none was recorded about
-		# a repository with hidden rows. Reading the output into a variable
-		# closes nothing on the producer. And a read that FAILED, with rows or
-		# without, answered the same "none is recorded": the status is kept. `0`
-		# and `8` are answers, and rows it printed are rows (an `8` that printed
-		# some is a contradiction and fails towards showing them); anything
-		# else is a read that did not answer (Amendment 7(d)).
-		e_rows="$("$LANES_EDIT" lanes --closed ${idx_args[@]+"${idx_args[@]}"} ${args[@]+"${args[@]}"} 2>/dev/null)" || e_hrc=$?
-		case "$e_hrc" in
-		0 | 8) case "$e_rows" in *[![:space:]]*) e_hidden=1 ;; esac ;;
-		*) e_hidden=unread ;;
-		esac
-		if [ "$e_hidden" = 1 ]; then
-			say "no lane of $here_repo is LISTED — and that is not the same as none being recorded: closed and dormant lanes are left out (Amendment 19(b))."
-			say ""
-			say "  see them:            $prog --closed --prefix $here_repo"
-		elif [ "$e_hidden" = unread ]; then
-			say "no lane of $here_repo is LISTED — and whether closed or dormant lanes are recorded could not be read (\`lanes-edit.sh lanes --closed\` exited $e_hrc), so this listing does not say that none is (Amendment 7(d))."
-			say ""
-			say "  try it by hand:      $prog --closed --prefix $here_repo"
-		else
-			say "no lane of $here_repo is recorded."
-			say ""
-		fi
-		# A helper without `next-free` (exit 2) cannot know whether a hidden or
-		# archived row owns position 1. Every failed or malformed answer refuses
-		# to offer a number, including this mixed-version workstation.
-		if [ "$e_rc" = 0 ] && [ -n "$e_next" ]; then
-			say "  next free position:  $e_next"
-			say "  take it:             lane-start $here_repo $e_next"
-		else
-			say "  the next free position could not be read as a valid number"
-			say "  (\`lanes-edit.sh next-free\` exited $e_rc). This listing will not offer a position"
-			say "  over a read that did not"
-			say "  answer (Amendment 7(d)) — a row it missed is a position it would hand out"
-			say "  twice. Run it by hand to see what it says:"
-			say "    printf '' | $LANES_EDIT next-free $here_repo"
-		fi
-		say "  every lane:          $prog --all"
-	else
-		say "no lane is recorded${ws_name:+ that $ws_name can see}."
-		say "  open one:            lane-start <repo> <n>"
-		say "  this workstation:    $prog --here"
-	fi
-	# AN EMPTY LISTING AFTER A FETCH THAT FELL BACK IS THE CASE THAT MATTERS
-	# MOST: "no lane is recorded" read off a stale checkout is the answer a
-	# person is likeliest to act on, and the likeliest to be wrong.
-	if [ "$fetch_fell_back" = 1 ]; then
-		say ""
-		say "  and the fetch did not answer, so that is this checkout's own copy:"
-		printf '%s\n' "$fetch_err" | sed -n 's/^/  /p'
-	elif [ "$fetch_unchecked" = 1 ]; then
-		say ""
-		say "  and whether the fetch answered is UNKNOWN — no temporary file could be made"
-		say "  to read the helper's own notes back, so they went to the terminal above"
-		say "  rather than into this line. That may be this checkout's own copy."
-	fi
-	ws_notice
-	exit 8 ;;
-64) die "bad arguments for the listing read — see $prog --help" 64 ;;
-# A HELPER PREDATING AMENDMENT 11, AND IT IS EXPECTED RATHER THAN BROKEN. `2` is
-# what a `lanes-edit.sh` with no `lanes` subcommand exits, exactly as a
-# pre-Amendment-8 one did for `swapped` (`lanes-edit.sh:4818-4826`), and until
-# act 3's install reaches a workstation that is what every one of them answers.
-# The contract gives it its own code so a caller can tell it from a read that
-# broke, and the message names the act rather than the rule.
-2) die "the \`lanes-edit.sh\` on this workstation has no \`lanes\` subcommand, so it
-    predates lane-collision-protocol Amendment 11. That is not a failure and
-    nothing is wrong with the register — this workstation has not taken adoption
-    act 3's install yet. Take it:  openRepoTools --install" 2 ;;
-*) die "$LANES_EDIT lanes failed (exit $rc). That is NOT 'there are no lanes', and this
-    command will not print an empty listing on an answer it did not get
-    (Amendment 7(d)). Run it by hand to see what it says." 1 ;;
-esac
-
-printf '%-26s %-8s %-10s %-12s %-22s %-38s %-9s %s\n' \
-	LANE STATE WHERE PROFILE WINDOW "LAST TRANSCRIPT" AGE DIRECTORY
-n=0
-defects=0
-# THE LAST NAME TAKES EVERY REMAINING FIELD, so `r_loc` — Amendment 18(b)'s
-# column 13 — is named here even though this listing does not render it: without
-# it column 13 arrives glued to the fork COUNT, and `0<TAB>here` is not a count.
-# COLUMNS 14 TO 17 ARE AMENDMENT 19'S — the row's CLASS (`closed`, `dormant`
-# or `none`), its `started` cell, its state cell's head and the flag words in
-# that cell — and they are named for the same reason: every field of this row
-# is read by its own index, and the read prints no column empty, because an
-# empty one between two tabs is no field at all to this `read`.
-while IFS="$(printf '\t')" read -r r_lane r_state r_ws r_pf r_win r_sid r_dir r_obj r_age r_restart r_home r_fk r_loc r_class r_start r_was r_flags; do
-	[ -n "${r_lane:-}" ] || continue
-	printf '%-26s %-8s %-10s %-12s %-22s %-38s %-9s %s\n' \
-		"$r_lane" "$r_state" "$r_ws" "$r_pf" "$r_win" "$r_sid" "$r_age" "$r_dir"
-	case "$r_obj" in
-	none | 'none open' | '') : ;;
-	*) printf '%-26s holds: %s\n' "" "$r_obj" ;;
-	esac
-	# THE EXACT COMMAND THAT BINDS IT, FILLED IN, FOR A **PAUSED** LANE — clause
-	# (j) column 10, AND IT COMES OUT OF THE READ (A11 Addendum 4 ruling 7). This
-	# command used to compute it and `restart` computed a different one: two
-	# implementations of one column, which is how two surfaces come to disagree
-	# about which lane may be restarted. The rule — a PAUSED lane only, and the
-	# `pclaude --lane <lane> <profile>` form where the record carries no profile
-	# yet — is stated once, in `lanes_rows`, and rendered here. The word it
-	# prints is `lane <name>` since Amendment 18 Addendum 2 retired `restart`.
-	case "${r_restart:-none}" in
-	none | '') : ;;
-	lane\ *) printf '%-26s bind it: %s\n' "" "$r_restart" ;;
-	# A LIVE LANE'S ONE ACT IS THE ATTACH AND NEVER A SECOND PROCESS (Amendment
-	# 18 clause (i), on the question of 2026-09-14T13:47Z). The read chose
-	# between `switch-client` and `attach` — it knows whether this process is
-	# inside tmux — and filled the target in; this renderer says which kind of
-	# act it is, because "bind it" over a `tmux attach` would describe a binding
-	# that is not being made: the session is already running and this only puts
-	# a terminal in front of it.
-	tmux\ *) printf '%-26s attach: %s   (it is LIVE — never a second lane-start on a running lane)\n' "" "$r_restart" ;;
-	*) printf '%-26s bind it: %s   (no profile recorded yet; it is written at this lane next start or swap)\n' "" "$r_restart" ;;
-	esac
-	# THE SECOND LINE A CLOSED OR DORMANT ROW GETS (Amendment 19(b)), and one
-	# is here only under `--closed`. A CLOSED lane is shown with the closing
-	# line's verb (the STATE column) and its time (the AGE column); a DORMANT
-	# row as `NO LOG` with its START DATE and its STATE CELL'S HEAD — the row's
-	# own last words, which are the only thing it has left to say for itself and
-	# exactly what the sweep carries into the log it creates for it. The FLAGS
-	# are that sweep's: a cell saying the work was unpushed, lost, a loss or
-	# owed, or still saying LIVE.
-	case "${r_class:-none}" in
-	closed)
-		printf '%-26s closed: its object log ends with %s; started %s\n' \
-			"" "$r_state" "${r_start:-unknown}" ;;
-	dormant)
-		r_tail="${r_was:-none}"
-		if [ "${#r_tail}" -gt 140 ]; then r_tail="${r_tail:0:140} …"; fi
-		r_fl=""
-		case "${r_flags:-none}" in
-		none | '') : ;;
-		*) r_fl="; FLAGS $r_flags" ;;
-		esac
-		printf '%-26s DORMANT: no object log and no live session here; started %s%s\n' \
-			"" "${r_start:-unknown}" "$r_fl"
-		printf '%-26s was: %s\n' "" "$r_tail" ;;
-	esac
-	case "${r_fk:-0}" in
-	0 | '') : ;;
-	*) printf '%-26s DEFECT: %s live fork(s) of this lane transcript — never a holder, and they must not write the register. Name them: %s forks %s; retire each: lane-end %s --retire <pid>\n' \
-		"" "$r_fk" "$LANES_EDIT" "$r_lane" "$r_lane"
-		defects=$((defects + 1)) ;;
-	esac
-	n=$((n + 1))
-done <<EOF
-$out
-EOF
-
-# THE NEXT FREE POSITION AND THE EXACT LINE THAT TAKES IT — the half of the
-# settlement that is not a filter. A listing tells a person what is there; this
-# tells them what to type next, filled in, so nobody has to translate a
-# placeholder at the one moment they are trying to start work.
-#
-# IT IS THE HELPER'S ANSWER AND NO LONGER THIS COMMAND'S (Amendment 18 Addendum
-# 1). `lane`'s `f` answer opens a lane at the same position, and two surfaces
-# computing one number is how they come to offer two — the defect A11 Addendum 4
-# ruling 7 removed from column 10. `next-free` takes THESE ROWS on stdin, so it
-# costs one process and not a second read, and the rule it states — the LOWEST
-# free position, digits with an optional trailing letter, `5a` and `5` one
-# position taken twice — is stated there once.
-#
-# AND A HELPER THAT CANNOT ANSWER IT IS NOT A POSITION OF 1 (Amendment 7(d)): a
-# `lanes-edit.sh` predating the read exits 2 and prints nothing, and a listing
-# that then offered `lane-start <repo> 1` would be offering a position this
-# estate may well have taken. The footer says so instead.
-# AND THE CODE SAYS WHICH IT WAS. `|| :` made every status of that read the same
-# status, and the footer below then told a person to take the install for a read
-# that had FAILED — the fail-closed family's own defect, one rung down (Copilot
-# round 1 on #45, `lanes:432`). `2` is the un-upgraded workstation and says so;
-# anything else is a read that did not answer and is named as one. A `0` that
-# comes back with nothing a position could be made of is in that second class:
-# the read answered, and what it answered is not a number.
-next=""; next_rc=0
-if [ -n "$here_repo" ]; then
-	next="$(printf '%s\n' "$out" | "$LANES_EDIT" next-free "$here_repo" 2>/dev/null)" || next_rc=$?
-	# THE STATUS DECIDES BEFORE THE TEXT DOES (Copilot round 5 on #45,
-	# `lanes:441`). Digits printed by a read that THEN FAILED pass the shape test
-	# below on their own output, and this footer would hand out a position out of
-	# a read that did not answer — the same hole `lane` had one file over, and the
-	# same rule closes it.
-	[ "$next_rc" = 0 ] || next=""
-	case "${next:-}" in '' | *[!0-9]*) next="" ;; esac
-fi
-
-say ""
-if [ "$do_fetch" = 1 ] && [ "$fetch_fell_back" = 1 ]; then
-	# THE PHRASE THE FOOTER MUST NOT CARRY IS NOT QUOTED HERE EITHER: the suite
-	# asserts that a fallen-back fetch never prints the fresh-fetch sentence, and
-	# a message that QUOTED it to disown it failed that assertion on its own
-	# words. What the helper said is printed under this line instead.
-	say "$n lane(s)${here_repo:+ of $here_repo}, read LOCALLY: the fetch did not answer, so this is the checkout's own copy as of $("$LANES_EDIT" fetch-age 2>/dev/null || printf 'unknown'). What the helper said:"
-	printf '%s\n' "$fetch_err" | sed -n 's/^/  /p'
-elif [ "$do_fetch" = 1 ] && [ "$fetch_unchecked" = 1 ]; then
-	# NO CAPTURE FILE, SO NO CLAIM. The helper's notes went straight to the
-	# terminal above and this line does not know whether one of them was the
-	# fallback sentence — which is exactly why it does not say "just now".
-	say "$n lane(s)${here_repo:+ of $here_repo}, and whether the fetch answered is UNKNOWN: no temporary file could be made to read the helper's own notes back, so they are above rather than in this line. This checkout last heard from origin $("$LANES_EDIT" fetch-age 2>/dev/null || printf 'unknown')."
-elif [ "$do_fetch" = 1 ]; then
-	say "$n lane(s)${here_repo:+ of $here_repo}, as of a fetch just now."
-else
-	say "$n lane(s)${here_repo:+ of $here_repo}, read locally — no fetch; this checkout last heard from origin $("$LANES_EDIT" fetch-age 2>/dev/null || printf 'unknown'). \`$prog --fetch\` refreshes first."
-fi
-# CLOSED AND DORMANT LANES ARE NOT IN THE COUNT ABOVE, and a listing that did
-# not say so would read as a register with nothing finished in it. The hint is
-# printed whenever they were left out, which is every run without `--closed`.
-if [ "$closed" = 0 ]; then
-	say "  closed and dormant lanes are not listed (Amendment 19(b)):  $prog --closed"
-fi
-if [ -n "$here_repo" ] && [ -n "$next" ]; then
-	say ""
-	say "  next free position:  $next"
-	say "  take it:             lane-start $here_repo $next"
-	say "  pick one:            lane"
-	say "  every lane:          $prog --all"
-elif [ -n "$here_repo" ] && [ "$next_rc" = 2 ]; then
-	say ""
-	say "  the next free position could not be read: this workstation's \`lanes-edit.sh\`"
-	say "  has no \`next-free\`, so it predates lane-collision-protocol Amendment 18"
-	say "  Addendum 1. Take the install and it comes back:  openRepoTools --install"
-	say "  every lane:          $prog --all"
-elif [ -n "$here_repo" ]; then
-	say ""
-	# THE CODE STAYS ON THE WORD IT BELONGS TO. A line break between `exited` and
-	# the number is a refusal that no longer says which code it got to anything
-	# reading a line at a time — and the reflow that split `PROVED that binding
-	# dead` across two lines was CI's one red case on `9581ac9`.
-	say "  the next free position could not be read: \`lanes-edit.sh next-free\`"
-	say "  exited $next_rc and gave no position. That is NOT a position of 1 and this"
-	say "  listing will not offer one it did not get (Amendment 7(d)) — a 0 with"
-	say "  nothing a position can be made of is in that class too. Run it by hand:"
-	say "    $LANES_EDIT lanes --prefix $here_repo | $LANES_EDIT next-free $here_repo"
-	say "  every lane:          $prog --all"
-fi
-[ "$defects" = 0 ] || say "$defects lane(s) have a live fork of their transcript running. A fork is never the holder (ratified decision 8(c)); the one act is \`lane-end <lane> --retire <pid|uuid>\`, which proves the fork and prints Amendment 6(d) for it filled in — it writes nothing and it never kills the process, and taking it stays yours (clause (k) rule (e))."
-ws_notice
-exit 0
diff --git a/lanes-edit.sh b/lanes-edit.sh
deleted file mode 100755
index d28ed8f2..00000000
--- a/lanes-edit.sh
+++ /dev/null
@@ -1,18977 +0,0 @@
-#!/usr/bin/env bash
-#
-# lanes-edit.sh — the sanctioned writer for the estate lane registry (LANES.md).
-#
-# Protocol: ~/.agents/protocols/lane-collision-protocol.md, Rule 9 (registry in
-# git) and Rule 10 (workstation designation), Amendment 3, 2026-09-09 — moved
-# to the person's workspace repository by Amendment 5, 2026-09-10.
-#
-# WHERE THE REGISTER LIVES (Amendment 5, 2026-09-10; Amendment 9(a), 2026-09-13)
-#   `lanes/LANES.md` on `main` of THE PERSON'S OWN workspace repository — the
-#   `<org>/<login>-wip` that `$AGENT_PROTOCOL_ROOT/workspace.yaml` names, which
-#   is `opensoft/brett-wip` for the person this file was written for and
-#   `opensoft/scott-wip` for the next one. This file names no repository of its
-#   own: Amendment 5's second-person clause put a second person's register in a
-#   second repository, and Amendment 9 is what made that reachable. Direct commits to
-#   `main` are the norm THERE by design: the repository is excluded from the
-#   organisation's PR-only ruleset precisely so that a per-edit registry
-#   commit can land, which is what Rule 9 requires and what the orphan
-#   `lanes` branch of `opensoft/xFactory` used to be for. That branch is
-#   RETIRED, and its history came across whole with this file.
-#
-#   Every path a lane already uses keeps resolving:
-#   `~/projects/xFactory/LANES.md` and `~/projects/xFactory/lanes-edit.sh`
-#   are symlinks into the checkout, placed by `link-estates`.
-#   This script never spells the checkout's own path, and since Amendment 9(a)
-#   it no longer derives it from its own location either: it reads
-#   `repository:` and `path:` from `$AGENT_PROTOCOL_ROOT/workspace.yaml`, the
-#   same pointer file `resume` and `status` already read. This file is an
-#   installed command in `~/.local/bin` with no register anywhere near it, so
-#   its own directory is evidence about the command and not about a person's
-#   data. Failing to find the workspace is a refusal naming
-#   `openRepoTools wip init`, never a guess.
-#
-# WHY THIS EXISTS
-#   LANES.md is edited by many concurrent lanes on more than one workstation.
-#   On 2026-09-08T23:46Z a whole-file write from one session dropped two other
-#   lanes' rows and a day of Rule 6 LANDED lines, and there was no history to
-#   recover from. Every write now goes through this script (or an equivalent
-#   single-line in-place edit followed by commit + pull --rebase + push), so the
-#   registry has a history and a lost row is one `git show` away.
-#
-# HAZARD — `sed -i` REPLACES A SYMLINK WITH A REGULAR FILE.
-#   ~/projects/xFactory/LANES.md is a SYMLINK into this worktree. Plain
-#   `sed -i` unlinks it and writes a new regular file, silently detaching the
-#   registry from git. Use this helper, or `sed -i --follow-symlinks`, or
-#   `cat tmp > LANES.md` (a redirect follows the symlink). `>>` appends,
-#   `cat`, `cut`, `head`, `tail`, `grep`, `python open(...,'a')` are all safe.
-#
-# USAGE
-#   lanes-edit.sh [--no-sweep|--sweep] verify-row         <lane>
-#   lanes-edit.sh [--no-sweep|--sweep] set-row-state      <lane> "<STATE> · <one line>"
-#   lanes-edit.sh [--no-sweep|--sweep] replace-in-row     <lane> "<old>" "<new>" ["<why>"]
-#   lanes-edit.sh [--no-sweep|--sweep] append-session-id  <lane> "<anchor>" "<text to append>" ["<why>"]
-#                                        (the anchor is matched INSIDE THE
-#                                         SESSION CELL and nowhere else, and the
-#                                         text is appended at the END of it)
-#   lanes-edit.sh [--no-sweep|--sweep] append-line        "<text>"            # LANDING/LANDED lines
-#                                        (attribution: $LANES_LANE, else the
-#                                         "lane <name>" the text itself names)
-#   lanes-edit.sh [--no-sweep|--sweep] add-row            "<full | row |>"
-#   lanes-edit.sh                      commit             "<message>"         # commit a hand edit; with
-#                                         nothing staged, publish the stranded
-#                                         register and handoff commits (#194)
-#   lanes-edit.sh                      migrate-state-cells [--yes]            # Amendment 13(e), once
-#   lanes-edit.sh                      retire-rows        <lane>… [--reason "<why>"] [--writer <lane>]
-#   lanes-edit.sh                      archive-rows       <repo> [--yes]      # Amendment 19(d)
-#
-# AMENDMENT 19 — A CLOSED OR DORMANT LANE LEAVES THE LISTING
-#   lanes-edit.sh lanes [--closed]                 # CLOSED and DORMANT rows too
-#   lane-end --retire-dormant <repo> [--reason "<why>"] [--yes]
-#   lanes-edit.sh archive-rows <repo> [--yes]
-#
-#   CLOSED is a lane whose object log's last lane-kind line is `ENDED` or
-#   `RETIRED`; DORMANT is a ROW WITH NO OBJECT LOG and no live session here —
-#   the rows that predate Amendment 7 and that no `lane-end` can close, because
-#   it wants a live session or a log to write into. `lanes` lists neither by
-#   default; `--closed` adds them, and the NEXT FREE POSITION is computed over
-#   every row of the repository — the hidden ones and the archive included — so
-#   a retired `<repo>-<n>` is never reissued.
-#
-#   `lane-end --retire-dormant <repo>` is a DRY RUN that names every dormant row
-#   of that repository with its start, its workstation and its state cell's
-#   head, and FLAGS the cells that say the work was unpushed, lost, a loss or
-#   owed, or that still say LIVE. With `--yes` it is ONE commit — `retire-rows`
-#   below it — creating each lane's log with a single `RETIRED` line that
-#   carries the row's own last words, and setting the row's state to
-#   `RETIRED · <UTC> · <why>; was: <head>`.
-#
-# AMENDMENT 13 — THE ROW IS CURRENT STATE; THE LOG IS HISTORY
-#   lanes-edit.sh set-row-state <lane> "<STATE> · <one line>"
-#   lanes-edit.sh log NOTED lane:<lane> "<what the lane did, found, launched, left>"
-#   lanes-edit.sh log RULED lane:<lane> [→ <object>] "<Brett Heap's words, verbatim>"
-#   lanes-edit.sh history <lane> [--since <UTC>] [--index]
-#   lanes-edit.sh history --all | --repo <owner/repo> [--since <UTC>] [--index]
-#   lanes-edit.sh migrate-state-cells [--yes]
-#
-#   The `state` column holds ONE PHRASE — `<STATE> · <UTC> · <one line>` — and
-#   every write REPLACES it. `set-row-state` stamps the UTC itself; the STATE is
-#   one of LIVE, PAUSED, LANDING #<n>, LANDED, ENDED, RETIRED, HANDED OFF (Rule
-#   6's reading of the cell is unchanged and is now the whole of what the cell
-#   says at that moment), and the line is at most 240 characters (ratified
-#   decision O1) carrying neither a `|` nor a second ` · `.
-#
-#   `append-row-status` is RETIRED and refuses, naming these. It appended and
-#   never replaced, which is how the column that says where a lane IS came to
-#   hold 96,228 characters in one row and 7,016 in another after ONE day — a
-#   diary in a table nobody can read in the table.
-#
-#   THE NARRATIVE GOES TO THE LANE'S OWN LOG, under two Amendment 7 verbs that
-#   are lane-kind lines and NOT transitions: `NOTED` is a status note and
-#   `RULED` a ruling recorded verbatim, with the object it bears on as its
-#   payload where there is one. Neither ever changes a lane's state on any
-#   object or on itself — `who`, `lane-end`, `lanes` and `swapped` skip them
-#   exactly as they skip `STARTED` and `RESUMED` — and `history` prints them in
-#   file order, which is the diary the cell used to be.
-#
-#   `migrate-state-cells` is clause (e)'s ONE act, on Brett Heap's word: a DRY
-#   RUN by default, and with `--yes` one commit carrying the archive
-#   `lanes/archive/LANES-pre-amendment-13-<UTC>.md`, every lane's log and the
-#   register. It REFUSES when no cell holds a ` · ` entry, so a second run is a
-#   no-op that says so.
-#
-# AMENDMENT 14 — THE DERIVED INDEX (`lanes-index`), WHICH NOTHING HERE ACTS ON
-#   lanes-edit.sh lanes     … --index        # the listing, out of the index
-#   lanes-edit.sh history   … --index        # the diary, out of the index
-#   lanes-edit.sh worktrees … --index        # the inventory, out of its table (#161)
-#
-#   The register's truth stays where it is. `lanes-index` (placed by
-#   `openRepoTools --install`) keeps a DERIVED copy — SQLite, or QA Postgres
-#   where this workstation is configured for it — written BEHIND the sources:
-#   after every write whose push LANDED, and after the mutex is released, this
-#   file starts one DETACHED `lanes-index sync` (stdin closed, never waited,
-#   its status never read; skipped where `lanes-index` is not on PATH or
-#   `LANES_INDEX=off`). No act reads the index or waits on it. `--index` is the
-#   only way a read consults it, typed per invocation, and it says on stderr
-#   which it read: `read: index (<store>) at register@<sha12>; <k> commits
-#   behind`, or `read: sources (index <why>)` and the sources answer.
-#
-#   THE INVENTORY HAS A TABLE TOO (opensoft/openRepoTools#161): `worktrees`,
-#   under the source `inventory:<Workstation>`, copied from `worktrees --all`
-#   by `lanes-index sync --source inventory` — which every inventory write
-#   (`set-lane-state`, `set-lane-tree`, the lifecycle follow, a rename's move
-#   of the control root) nudges exactly as a landed push nudges the register's.
-#   No act reads it: `lane-reconcile`, `lane-start` and `lane-end` read the
-#   sidecars and the disk. With `--index` the stderr line is `read: index
-#   (<store>) at inventory:<ws> synced <UTC>`, followed by `(last error: <UTC>
-#   <why>)`, the last error `status` shows for that source: one a sync or a
-#   reconcile on this workstation refused or failed with, a `--dry-run`
-#   included, until a sync or a reconcile that is not a dry run succeeds.
-#
-# AMENDMENT 7 — the per-lane object log (`lanes/log/<lane>.md`)
-#   lanes-edit.sh log     <VERB> <object> [→|← <payload>] ["<text>"] [--text "<t>"]
-#   lanes-edit.sh claim   <object> [--force] [--no-github] [--home owner/repo]
-#   lanes-edit.sh release <object> ["<why>"] [--no-github] [--home owner/repo]
-#   lanes-edit.sh who     <object> | --lane <lane> | --landing owner/repo
-#
-# AMENDMENT 8 — swap and restart, the READ side (both read-only, never write)
-#   lanes-edit.sh swapped       [<workstation>]
-#   lanes-edit.sh session-start                  # the SessionStart hook; JSON on stdin
-#
-# AMENDMENT 12 — the name guard and the lock (the blocking hook)
-#   lanes-edit.sh guard                          # the UserPromptSubmit hook; JSON on stdin
-#
-#   `guard` is the ONLY verb here that refuses a person's work. It reads the
-#   hook's JSON, takes the WINDOW from tmux, the SESSION's own name from the
-#   live record and the ROW from `origin/<branch>`, and where the three are not
-#   one name it REFUSES THE PROMPT (exit 2) with the triple and the one command
-#   that cures it. THE LOCK types `/rename <lane>` into this pane for the TWO
-#   drifts that are not decisions — a name differing from the row's only by
-#   CASE, which is the same lane under Amendment 15, and a name that is a
-#   FORMER name of the row's lane, which is the same lane under Amendment
-#   16(e) and is what a rename run from another window leaves behind. EVERY
-#   OTHER READABLE MISMATCH IS AN OFFER OF THREE CHOICES, answered `1` (allow
-#   this lane for this transcript), `2` (adjust the lane to the session) or `3`
-#   (adjust the session to the lane, which types the `/rename`) at the next
-#   prompt; an answer to a question the state has moved past is dropped rather
-#   than acted on, and the unreadable, ambiguous, duplicate and superseded still
-#   refuse outright. It is silent and cheap where the three agree, silent
-#   outside `$PROJECTS_ROOT` and silent for a subagent's prompt.
-#
-# AMENDMENT 16 — a lane is renamed by ONE WORD, in ONE COMMIT, and its old name
-# resolves for ever
-#   lanes-edit.sh rename-lane <old> <new> ["<why>"] [--verbatim] [--no-github]
-#
-#   `lane-rename <old> <new>` on PATH is the word; this is its write. ONE
-#   commit, refused or whole, and its four moves are the amendment's clauses
-#   (b)–(e): the row's key cell becomes `` `<new>` `` with `*(ex `<old>`,
-#   renamed <UTC>)*` beside it; `lanes/log/<old>.md` is renamed to
-#   `lanes/log/<new>.md` and gains a `RENAMED` line; the handoff the row names
-#   is renamed to the same date with `lane-<new>` and gains a Rule 3 stamp,
-#   with the row's handoff column following; and `lanes/aliases.tsv` gains
-#   `<old>	<new>	<UTC>`.
-#
-#   THE ALIAS TABLE IS WHAT MAKES THE OLD NAME KEEP WORKING (clause (e)).
-#   `canon_lane` — Amendment 15's resolver, which every `<lane>` argument and
-#   every `$LANES_LANE` already passes through — resolves a name with NO ROW
-#   through that table, case-insensitively, chains to their end, before it
-#   answers. So an old name in a line, a window, a session record or a person's
-#   typing lands on the current row, in every reader at once, rather than in a
-#   list of readers somebody has to keep complete. A ROW WINS OVER AN ALIAS:
-#   a name that is a lane today IS that lane, which is also what makes a rename
-#   back again readable.
-#
-#   `RENAMED` is a LANE-KIND verb that changes no object's state. Every
-#   last-line state reader here enumerates the five verbs that DO
-#   (`STARTED PAUSED RESUMED ENDED RETIRED`), so the new verb is outside that
-#   rule by construction and no reader had to be taught to skip it.
-#
-# AMENDMENT 18 — ONE BINDING PER LANE
-#   lanes-edit.sh binding <lane>                 # where this lane is bound
-#   lanes-edit.sh request-handoff <lane> [--wait <s>] [--session <uuid>]
-#   lanes-edit.sh request-handoff <lane> --force "<why>"
-#
-#   A lane's BINDING is the `host`, `container` and `window` of its last
-#   `STARTED`/`RESUMED` with no `PAUSED`/`ENDED`/`RETIRED` after it, and those
-#   three sub-fields are written by `write_event` beside Amendment 11(c)'s
-#   `dir`/`profile`/`window` — read from `LANES_HOST`/`LANES_OS`/
-#   `LANES_CONTAINER`, which the launcher exports, with clause (a)'s fallbacks.
-#   **Liveness is pronounced only from inside the binding's own host and
-#   container**: from anywhere else it is UNKNOWN and never dead, whatever
-#   `kill -0` of a pid in another namespace would say. The ONE exception is a
-#   window that is gone from a tmux server the two share, which is dead and is
-#   today's takeover path. A second place ASKS — `request-handoff` writes the
-#   line and pushes it, types `/handoff --exit requested by …` into the bound
-#   pane where that pane is here, and waits; an empty wait refuses with the
-#   facts and names `--force`, which is a second invocation that releases the
-#   binding on the bound session's behalf in the requester's own session field.
-#   The prompt guard answers both from the bound side (clauses (d) and (e)).
-#
-# AMENDMENT 18(h) — one live process per transcript
-#   lanes-edit.sh transcript-holders <uuid>      # every live process carrying it
-#
-#   A transcript is held by ONE live process; the harness can fork one or resume
-#   one twice. This read is what `lane-start` asks before it binds or resumes an
-#   id, what `lane-end <lane> --retire <pid>` proves a duplicate with, and what
-#   `guard` refuses a prompt on. It sweeps EVERY profile's `sessions/`, because a
-#   duplicate's record sits in another profile's — measured four times on
-#   2026-09-14.
-#
-#   A SWAP is a planned stop — a usage reset, a profile switch — and a RESTART
-#   is the launch that follows it. The RECORD a swap leaves is not a new file:
-#   it is the lane's own `PAUSED` line, payload
-#   `swap; window <tmux session>:<index>; workstation <ws>`. A lane is SWAPPED
-#   on a workstation when that PAUSED is its LAST lane-kind line — no later
-#   RESUMED, STARTED, ENDED or RETIRED — and `swapped` lists those lanes, which
-#   is how a restart finds its lane once the new tmux session has lost the
-#   window name. `session-start` is the whole output of the SessionStart hook:
-#   it resolves the lane from the tmux window name, else from the session id in
-#   the hook's JSON, prints ONE block, and ALWAYS exits 0 — a hook that fails
-#   is a hook that breaks the session it was meant to orient.
-#
-# AMENDMENT 17 — the handoff is the swap, and the record names the agent
-#   lanes-edit.sh lane-agent      <lane>    # the last record's `agent <name>`
-#   lanes-edit.sh lane-transcript <lane>    # its `transcript <id|none>`
-#   lanes-edit.sh lane-last       <lane>    # its LAST lane-kind line, as
-#                                           # <verb><TAB><utc><TAB><session><TAB><payload>
-#   lanes-edit.sh workspace-root            # the workspace repository's path
-#   lanes-edit.sh log PAUSED … --utc <UTC>  # date a LATE record by its own field
-#
-#   Clause (b) gives the `PAUSED` payload two sub-fields beside Amendment
-#   11(c)'s `window`, `dir` and `profile`: `agent <name>` — `claude`, `codex`,
-#   or the launcher's name for whatever wrote the line, a manifest key (letters,
-#   digits, `.`, `_`, `-`) — and `transcript <id|none>`, the agent's own
-#   resumable id where it has one. THE WRITER VALIDATES BOTH (`pause_subfields_check`,
-#   called from `write_event`) because the log is append-only: a malformed
-#   sub-field there is malformed for ever, and `lane-start --agent` launches on
-#   what it reads. `swapped` prints them as its sixth and seventh fields, after
-#   the five it already had, and a record written before this amendment carries
-#   neither — which is EMPTY in that output and 8 from the two reads, never a
-#   guess (Amendment 7(i)'s cutover rule).
-#
-#   `--utc <UTC>` IS FOR THE LATE RECORD AND NOTHING ELSE (adoption act 7): the
-#   `PAUSED` a swap never left, written after the fact and dated by the moment
-#   the old session ENDED rather than by the clock of the shell writing it. It
-#   changes which instant the line NAMES and never where the line goes: the log
-#   is append-only and FILE ORDER is what every state read means by "last", so
-#   `lane-handoff --late` refuses to write one that would land after the
-#   relaunch's `RESUMED` — a lane that is running must never read as paused.
-#
-#   `--home owner/repo` is an option of all FIVE of `claim`, `release`, `who`,
-#   `log` and `lane-end`, for a lane whose log has no STARTED line. All five
-#   resolve it AFTER the fetch (R30), because the STARTED line that refuses it
-#   may be a peer's and live only on `origin/<branch>`.
-#
-#   An object is `owner/repo#<n>`, `owner/repo:openspec/changes/<name>`, `#<n>`
-#   for the lane's OWN home repo, or `lane:<name>` for the lane-kind lines.
-#   `lanes/repos.tsv` (`alias<TAB>owner/repo`) resolves an omitted owner and
-#   the register's legacy spellings; an unknown alias is refused, never guessed.
-#   A LANE'S HOME GOES THROUGH THE SAME TABLE (R20, Addendum 5) — `lane-start`
-#   resolves it before writing STARTED, and every comparison of an object's
-#   repository against a home resolves BOTH sides. A home is inherited by every
-#   `#<n>` that lane writes, so a legacy org spelling there gave one GitHub
-#   issue two object keys and two lanes held it with no collision detected.
-#
-#   STATE IS PER LANE: a lane's state on an object is its own LAST line naming
-#   it, and it HOLDS the object while that verb is open. Open is
-#   {CLAIMED, TAKEOVER, OPENED, LANDING, WITHDRAWN}; closed — and it closes
-#   only the writing lane's hold — is {RELEASED, CLAIM-LOST, CLOSED, LANDED}.
-#
-#   THAT APPLIES TO A TAKEOVER TOO (R18, Addendum 5): lane B's TAKEOVER on an
-#   object supersedes lane A's CLAIMED only while the TAKEOVER is B's OWN LAST
-#   LINE on it. Once B writes RELEASED, CLOSED or LANDED there, A's later
-#   CLAIMED holds normally. A TAKEOVER is never removed from an append-only
-#   log, so treating one as superseding for ever made a legitimate re-claim
-#   invisible: `who` called a held object FREE and `claim` did not refuse the
-#   next lane. Known and deliberate: two lanes each ending on a TAKEOVER of one
-#   object are BOTH reported as holders — a visible conflict, and not reachable
-#   through the helpers, since `claim --force` takes over a stale CLAIMED only.
-#
-#   AND "LAST" IS THE LAST LINE IN THE FILE (R14, Addendum 4). A lane's log is
-#   append-only and single-writer, so the ORDER OF ITS LINES is the order of
-#   that lane's writes. No state read here — `lane_objects`, `superseded_by`,
-#   PER_LANE_AWK, `who` in any mode, `lane-end`'s refusal, `claim`'s pre-check
-#   and its rescan — selects or orders lines by their UTC field. The UTC stays
-#   on every line as INFORMATION, and is compared only where a DURATION is the
-#   rule: Rule 1's four-hour staleness and Rule 6's thirty minutes, where a few
-#   seconds are immaterial. On 2026-09-11 this workstation's realtime clock was
-#   observed jumping ±25s in bursts and a log commit landed whose content
-#   carried a UTC 26s after its own committer date; a max-UTC read made that
-#   lane's newest line invisible. Two workstations never share a clock either.
-#
-#   `claim` is Rule 1 as one act, and THE RACE IS DECIDED BY WHICH CLAIMED
-#   LANDS ON `main` FIRST, never by comparing timestamps: fetch, pre-check
-#   against `origin/main`, append, commit, push; on a rebase, rescan, and if
-#   another lane's claim is already there, write `CLAIM-LOST` and stop. Git's
-#   push serialization is the arbiter between workstations; the `mkdir` mutex
-#   below only serializes this one.
-#
-#   EVERY STATE READ IS OF `origin/<branch>`, AFTER A FETCH — never of the
-#   working tree. What has LANDED is what other lanes can see; a working tree
-#   can be behind by a peer's whole day. `who`, the pre-check, staleness, the
-#   superseded filter, the crossing warning, `lane-end`'s refusal and
-#   `lane-start`'s home lookup all read the same source, so they cannot
-#   disagree with each other either.
-#
-#   THE REGISTER'S ROWS ARE READ THE SAME WAY (R19, Addendum 5). The session
-#   cell, the handoff path and the workstation column come from
-#   `git show origin/<branch>:lanes/LANES.md`; nothing in `who` reads the
-#   working tree. THE ONE EXCEPTION IS THE `live-holder` SUBCOMMAND, and only
-#   its id SET (R25, Addendum 6): it is the published row's union this
-#   checkout's, because a session stamps its uuid on the row with
-#   `replace-in-row` and that write is a LOCAL COMMIT until its push lands —
-#   read from `origin` alone the rename gate would not see the uuid of the very
-#   session it is being asked to rename over, would answer 8, and `lane-start`
-#   would take the name. That is what mints `<lane> (2)` (AGENTS.md rule 7).
-#   Liveness fails closed, so an id `origin` has not seen is a reason to refuse
-#   a rename, never to allow one, and nothing that PRINTS uses the union.
-#
-#   A LANDED CLOSES THE LANDING IT ANSWERS (R17, Addendum 5): `who --landing`
-#   pairs them by (lane, PR) in FILE ORDER and keys the result on
-#   (lane, repository, PR). Most of the register's LANDED lines carry no
-#   `into <repo> main` clause, and keying those on the repository they name
-#   reported 232 phantom merge holds where one was real.
-#
-# openRepoTools#91 — THE CRASH-CONSISTENT LANE LIFECYCLE AND THE INVENTORY
-#   lanes-edit.sh lane-state      <lane>
-#   lanes-edit.sh set-lane-state  <lane> <RUNNING|SWAPPING|SWAPPED|CLOSED> \
-#                                 [--expect <STATE|none>] [--expect-generation <n>] \
-#                                 [--expect-operation <id>] [--operation <id>] \
-#                                 [--owner <uuid>] [--agent <name>] [--profile <name>] \
-#                                 [--kind <word>]
-#   lanes-edit.sh lane-trees      <lane>
-#   lanes-edit.sh set-lane-tree   <lane> <worktree path> [--checkout <dir>] \
-#                                 [--branch <b>] [--head <sha>] [--upstream <ref>] \
-#                                 [--dirty <n>] [--unpushed <n>] [--writer <uuid>] \
-#                                 [--generation <n>] [--operation <id>]
-#   lanes-edit.sh lane-tree-now   <worktree path>
-#   lanes-edit.sh project-legs    <checkout>     # an assembly's legs, by path (T018)
-#   lanes-edit.sh lane-reconcile  <lane>
-#   lanes-edit.sh worktrees       [<lane> | --all] [--index] [--fetch]
-#   lanes-edit.sh pathspec-check  <path>...          # opensoft/openRepoTools#162
-#
-#   A lane is RUNNING, SWAPPING, SWAPPED or CLOSED, and WHICH OF THOSE IT IS
-#   WITH NO LIVE HOLDER is what says where its session stopped: `RUNNING` with
-#   no holder is an UNGRACEFUL STOP (nothing was handed off) and `SWAPPING`
-#   with no holder is an INTERRUPTED SWAP (the handoff began and did not
-#   finish). Every transition carries a monotonic `generation` and a unique
-#   `operation`, and `--expect*` is the compare-and-swap that refuses a stale
-#   finalizer with exit 7 rather than letting it overwrite a newer owner.
-#
-#   NO LANE-KIND VERB IS ADDED TO THE APPEND-ONLY LOG BY THIS CHANGE. Amendment
-#   7's five state verbs stand and every reader of them is untouched (Amendment
-#   18(g) has since added a sixth lane-kind verb, `HANDOFF-REQUESTED`, which
-#   changes no state; this adds none). This is a SNAPSHOT beside that
-#   history, local to the workstation, replaced atomically, and never committed
-#   — see the section above the dispatcher for where it lives and why it is
-#   neither in the register nor inside a git worktree.
-#
-#   `set-lane-tree` records ONE worktree of the lane — its path, checkout,
-#   branch, head, upstream, dirty and unpushed counts and writer — as an
-#   OBSERVATION; `lane-reconcile` recomputes every one of them and REPORTS the
-#   difference. It resets nothing, deletes nothing and creates nothing: a
-#   missing tree's only rebuild is the estate's own `resume <Name>`, and a
-#   missing tree that last held uncommitted work is reported as possible loss,
-#   because no metadata reconstructs a file's contents.
-#
-#   `lane-tree-now` IS THAT OBSERVATION ON ITS OWN, and it is here so that the
-#   handoff's WRITERS section, the sidecar it files and the reconciliation that
-#   recomputes against it are one implementation with one error handling. A git
-#   read that FAILED is never converted into a clean-looking value by any of the
-#   three: `unknown`, `none` and `0` are answers, and the reads that could not
-#   be made are said instead (R22, Amendment 7(d)).
-#
-#   THE TWO WRITERS REFUSE A SIDECAR THEY CANNOT READ. A snapshot or a tree
-#   record carrying a schema this helper does not write is never replaced — a
-#   reader that fails closed and a writer that walks past it protect nothing —
-#   and neither is one of THIS schema that is not a whole record: a key its
-#   writer writes missing or out of shape, or an id that is not its file's
-#   (#115). `set-lane-tree`'s `--generation`/`--operation` are COMPARED with
-#   the lane's own snapshot under the mutex before the record is filed, so a
-#   poll from an operation a recovery has superseded, or from one already
-#   finalized (`SWAPPED`, #114), cannot be filed over the current one.
-#
-# THE SEAM — A MANAGED-OWNED LANE IS NOT THIS TOOLING'S (Brett Heap's ruling of
-# 2026-10-04, verbatim: "managed ledger owns enrolled lanes; #97 owns legacy —
-# rework both")
-#   lanes-edit.sh managed-projection <lane>
-#
-#   0 with the owner on stdout where the lane's register row carries a valid
-#   managed-owner marker, 8 where it carries none (a LEGACY lane, which is
-#   every lane today), 1 where it carries managed-owner vocabulary that does
-#   not parse as a marker, where only THIS checkout's row carries the
-#   vocabulary (#157 item 4a), or the register could not be read (ownership
-#   UNKNOWN), 64 usage. Every legacy act that would write for a lane asks this
-#   first and refuses a managed lane with 2 and an unknown one with 1, before
-#   a byte is written: the lane-kind lines `log` writes (STARTED, RESUMED,
-#   ENDED, RETIRED), `set-lane-state`, `set-lane-tree`, `retire-rows`,
-#   `set-row-state`, `replace-in-row` and `rename-lane`, the entry of
-#   `lane-start` and `lane-handoff`, and `lane-end` before its first act on
-#   each of its paths. `lane-reconcile` pronounces
-#   nothing on a managed lane (`VERDICT managed-owned`), and no legacy writer
-#   may write the marker's vocabulary into a row at all.
-#
-# EXIT CODES — every subcommand, one table, no two meanings on one number
-#   0  done (and #194's publish whose queue `pull --rebase` emptied)
-#   1  environment (no register, no writer)
-#   2  refusal: bad arguments, the object is held, an unknown alias, a
-#      checkout that cannot be rebased, — Amendment 15 — a register holding
-#      two rows whose lane names differ only by case, which every writer and
-#      `canon-lane` refuse until 15(d)'s merge, or AMENDMENT 12's BLOCKED
-#      PROMPT, or — opensoft/openRepoTools#162 — a commit whose pathspec
-#      would stage bytecode, a cache or a virtual environment
-#      (`commit_push`, `pathspec-check`), or — #194 — `commit` refusing to
-#      publish local commits that are not register or handoff writes, from a
-#      checkout whose HEAD is off the branch, or that it cannot read
-#      (`cp_publish_fence`), and pushes none of them. EIGHT MEANINGS ON ONE NUMBER, and they
-#      stay readable only because of where each can occur: bad arguments to a
-#      subcommand that predates Amendment 11; `register-row`'s "not lane-shaped";
-#      AN UNKNOWN SUBCOMMAND (the `*)` arm below), which is how a caller detects
-#      a helper predating the amendment that added the read it asked for; and
-#      Amendment 11's container refusal. The last is on WRITERS ONLY (the
-#      dispatcher guard), so no READ can return it and clause (h)'s
-#      fall-to-the-next-rung rule is unaffected by it.
-#      THE SIXTH IS NOT THIS FILE'S NUMBER AT ALL: 2 is what a `UserPromptSubmit`
-#      hook must exit to BLOCK a prompt (code.claude.com/docs/en/hooks), so
-#      `guard` spends the one number the harness reads, and every refusal it
-#      makes — a mismatch, an unreadable read, a pending offer's question and
-#      its answer — is that 2. `guard` never exits anything else but 0.
-#  64  usage — a caller's bad arguments to one of the reads Amendment 11 added
-#      (`window-lane`, `lane-dir`, `lane-profile`, `last-session`, `forks`,
-#      `duplicate-holder` (issue #39), `workstation`, `fetch-age`, `lanes`,
-#      `session-lane`, and `swapped`, which
-#      took it first), to Amendment 13's `history`, and to Amendment 15's
-#      `canon-lane`, which takes the same
-#      contract because its four callers sit in front of a launch as those do. IT WAS IN NO TABLE AT ALL until this round (F-X16), while
-#      being the code the contract gives every one of those reads.
-#
-#  66  EX_NOINPUT — AMENDMENT 16(e)'s ALIAS TABLE COULD NOT BE READ, and
-#      `canon-lane` is the one verb that spends it. `lanes/aliases.tsv` is what
-#      makes a renamed lane's OLD name resolve, so a table nobody can read is
-#      not an estate with no renames: a former name would read as a lane nobody
-#      has, and `lane-start` would append a SECOND row for one that has been
-#      running all day. It is a number of its own because 2 already carries two
-#      meanings to `lane-start`, `lane-end`, `lane` and `lane-handoff` — 15(d)'s
-#      two-rows refusal, told by its words, and the unknown-subcommand 2 of an
-#      older helper, which they carry on past — and a third meaning there is the
-#      fail-open this refusal exists to close.
-#
-#      WHY A SECOND USAGE CODE RATHER THAN 2. A read in front of a launch has to
-#      tell "you called me wrong" from "this helper has never heard of you" —
-#      and the second of those IS a 2, emitted by the `*)` arm, on every
-#      workstation until adoption act 3's install reaches it. One number cannot
-#      carry both without the caller guessing, so the newer reads spend a number
-#      of their own and the older half of this file keeps 2 where it always was.
-#      Clause (h)'s table is the contract for which read uses which.
-#   3  the edit is never a permanent loss, but this attempt cannot confirm
-#      whether it also reached origin. THREE CAUSES (Copilot round 3 on #50,
-#      5203261904, naming the other two this row used to leave out): a
-#      rebase conflict this attempt could not resolve — not pushed BY THIS
-#      ATTEMPT; a later write from this checkout may already carry it to
-#      origin, so LOOK by CONTENT before you retry (round 4, 5203455553:
-#      SHA ancestry alone misses a peer's rebase of it, which changes the
-#      hash but not the patch); `git_timeout_die`'s network timeout on a
-#      push OR a pull, where a hung one often already landed; or six
-#      attempts exhausted because a peer's own uncommitted file blocks
-#      every rebase.
-#   4  the mutex could not be taken within 60s
-#   5  an edit moved more than one line and was refused — or, Amendment 15, a
-#      lane's object log could not be renamed to the row's own spelling — or,
-#      #120 item 1, a register rewrite (`replace_line`, `delete_lines`) whose
-#      copy, write or result could not be proved; where the write had cut the
-#      register short its earlier bytes are put back first, and the refusal
-#      says which of the two the register holds
-#   6  git add / commit / push failed
-#   7  ANOTHER ACT GOT THERE FIRST, and this one wrote nothing. `claim`:
-#      CLAIM-LOST, another lane's claim landed on main first.
-#      `set-lane-state`: the lifecycle fence did not match — the state, the
-#      generation or the operation id moved under this process — so a stale
-#      finalizer cannot overwrite a newer owner (openRepoTools#91).
-#      `set-lane-tree`: the `--generation`/`--operation` this observation was
-#      taken under is no longer the lane's — or the lane is `SWAPPED` and the
-#      operation it names is finished (#114) — so a superseded poll cannot be
-#      filed over the current inventory. ONE MEANING ON THE NUMBER, in three
-#      places: you lost the race.
-#   8  no record — `who` found nothing; `lane-objects` has no log file for the
-#      lane; `live-holder` READ this workstation's session records and none of
-#      them holds it; `swapped` found no lane swapped on the workstation;
-#      `history` READ the lane's log and it carries no `NOTED` or `RULED` line;
-#      `window-session` found no live session in the window. A read that could
-#      not be performed is never 8 (R22). `session-start` never exits 8, or
-#      anything but 0: it is a hook. `guard` never exits 8 either — it is a hook
-#      too, and a BLOCKING one, so its two codes are 0 and 2 (see 2 above).
-#   9  CLAIM-LOST — issue #30's own dead-lane verdict could not be
-#      reconfirmed before this takeover's push landed: the source lane's own
-#      log moved past its terminal line, a live session on this workstation
-#      now backs it up, or that could not be read at all (`claim` only,
-#      `--force` over a dead lane's hold). NEVER coerced to 7: that code
-#      means a RIVAL's claim landed first, and this is the same lane the
-#      takeover was granted over, alive again rather than beaten to main.
-#  10  THE RECORD IS THERE AND COULD NOT BE READ, which is the other half of 8
-#      and never 8 itself (Copilot round 6 on openRepoTools#97). `lane-state`
-#      spends it for a lifecycle snapshot that EXISTS at the control root and
-#      cannot be opened — a permission, an I/O error, a name whose bytes are
-#      gone. 8 says *this lane has no snapshot*, which a launcher answers by
-#      going on; 10 says *this lane may be mid-crash and nobody could look*,
-#      which it answers by reading the lane by hand. One number could not carry
-#      both, and the one that was carrying both was 8 (R22, Amendment 7(d)).
-#      IT WAS 9 until main's #61 landed with 9 as `claim --force`'s abandoned
-#      takeover; each PR had taken 9 as unused, and the later one moved.
-#      `lane-trees` spends it for an inventory directory that EXISTS and
-#      cannot be listed, which is never "this lane recorded no tree" (#157
-#      item 4e). And `lane-state` spends it for a snapshot of this schema that
-#      opens and is not a WHOLE record — cut short, or a key missing or out of
-#      shape (#115): nothing can be read out of it as a snapshot, so it is
-#      the same answer, and the message says which of the two it is.
-#
-# --no-sweep (DEFAULT, added 2026-09-09 after 0d84d34/a1f2438 swept another
-#   lane's uncommitted hand edit into an unrelated commit): every mutating
-#   subcommand checks, before making its own edit, whether LANES.md is
-#   already dirty. If it is, that content is someone else's — never this
-#   invocation's — so it is committed FIRST, on its own, as
-#   `LANES(pre-existing@<workstation>): capture an uncommitted registry edit
-#   (row <lane>)`, before this invocation's own edit is made and committed.
-#   A WARNING (with `git diff --stat` and the first 200 chars of every
-#   changed line) always prints first. This never fails the call — the
-#   write still goes through. Amendment 7's `log`, `claim` and `release` take
-#   the same capture for the REGISTER between the two halves of their
-#   dirty-checkout guard, which is why a peer's half-written `lanes/LANES.md`
-#   does not refuse them (Addendum 3, R11); any OTHER modified tracked file
-#   still does, and is refused before the capture rather than after it.
-# --sweep — the old behaviour: leave the pre-existing content staged so it
-#   lands inside this invocation's own commit. Still warns exactly as above,
-#   and appends " + sweeps uncommitted edit to row <lane>" to the commit
-#   subject, so the sweep is never silent.
-# `commit` has no edit of its own to separate from a pre-existing one — its
-#   job IS to wrap whatever is already dirty. It instead warns and appends
-#   the same " + sweeps uncommitted edit to row <lane>" note when the dirty
-#   content touches a row other than the caller's own $LANES_LANE.
-#
-# ENVIRONMENT
-#   LANES_FILE         registry path        (default: <LANES_DIR>/LANES.md)
-#   LANES_DIR          dir holding it       (default: <LANES_REPO>/lanes)
-#   LANES_REPO         checkout root        (default: the `path:` in
-#                                            $AGENT_PROTOCOL_ROOT/workspace.yaml,
-#                                            checked to be a checkout of the
-#                                            `repository:` beside it — Amendment
-#                                            9(a); never a literal path)
-#   LANES_WORKSPACE_ROOT  that `path:`, overridden  (the test seam; nothing else
-#                                            sets it)
-#   AGENT_PROTOCOL_ROOT  dir holding workspace.yaml  (default: ~/.agents)
-#   LANES_PATH         pathspec of the register RELATIVE to LANES_REPO
-#                                           (default: `lanes/LANES.md`, derived
-#                                            with `git rev-parse --show-prefix`)
-#   LANES_BRANCH       branch to commit on  (default: main)
-#   LANES_LANE         lane name for the commit subject when no lane argument
-#   LANES_WORKSTATION  workstation name     (the launcher exports it; else
-#                                            `hostname -s` outside a container,
-#                                            and inside one WITH NO VALUE every
-#                                            WRITER refuses — Amendment 11,
-#                                            decision 8(d), R-A11-14)
-#   LANES_HOST         the MACHINE's short hostname as it reads OUTSIDE any
-#                      container (Amendment 18(a); the launcher exports it).
-#                      Fallback: `hostname -s` outside a container, and inside
-#                      one the Rule 10 workstation name
-#   LANES_OS           linux | macos | wsl | windows — the HOST's, as the person
-#                      means it. Fallback: the kernel probe (Darwin -> macos,
-#                      /proc/version naming microsoft -> wsl, linuxkit -> macos,
-#                      any other Linux -> linux). `windows` is a launcher's word
-#                      only: this file is bash and runs in WSL2 there
-#   LANES_CONTAINER    the bench's name (`py-bench`, …). Fallback: inside a
-#                      container, that container's own `hostname` — read LIVE at
-#                      every write, never cached; outside one, `none`
-#   LANES_POLL_SECONDS the interval `request-handoff`'s wait polls the published
-#                      log at (default 15). The test seam, and only that
-#   LANES_IN_CONTAINER 1|0                  force the container probe (test seam)
-#   LANES_NO_GIT=1     edit only, no commit/push (used by the test harness)
-#   LANES_LOG_DIR      the object logs     (default: <LANES_DIR>/log)
-#   LANES_REPOS_TSV    the per-wip alias OVERRIDE (default: <LANES_DIR>/repos.tsv)
-#   LANES_REPOS_TSV_SHIPPED  the organisation's alias table shipped by
-#                      openRepoTools (default: beside this command)
-#   LANES_ALIASES_TSV  Amendment 16(e)'s LANE alias table, `<old><TAB><new>
-#                      <TAB><UTC>` (default: <LANES_DIR>/aliases.tsv)
-#   LANES_ALIASES_PATH its pathspec relative to LANES_REPO
-#                      (default: `lanes/aliases.tsv`)
-#   LANES_SESSION      this session's TRANSCRIPT uuid, for the event lines
-#                      (default: the last uuid in the lane's row — Amendment 6(b))
-#   LANES_LANE_DIR     the lane's checkout, for project.yaml leg detection
-#                      (default: $PROJECTS_ROOT/<repo part of the home repo>)
-#   LANES_NO_GITHUB=1  skip every `gh` call (tests, offline); same as --no-github
-#   LANES_NO_FETCH=1   skip the `git fetch` a read does first (offline; tests).
-#                      It does NOT change WHAT is read: every state read is of
-#                      `origin/<branch>`, which without the fetch is simply the
-#                      ref as it already stands here.
-#   LANES_STALE_HOURS  Rule 1's stale threshold, reused (default: 4)
-#   LANES_DEBUG        non-empty: a refusal also prints its exit code
-#   LANES_INDEX=off    no `lanes-index sync` after a write, and `--index` reads
-#                      the sources (Amendment 14). It never turns a read ON:
-#                      only a typed `--index` does
-#
-# Dependencies: bash, git, coreutils. No sed/awk substitution on the payload —
-# every edit is computed with bash string operations, so `/`, `&`, `\` and `|`
-# in the text are literal.
-
-set -u
-
-# Parse the global flags before probing paths, git or workstation identity.
-# A profile-only prompt must not depend on any of that lane infrastructure.
-SWEEP_MODE="no-sweep"
-while [ $# -gt 0 ]; do
-  case "${1-}" in
-    --no-sweep)  SWEEP_MODE="no-sweep"; shift ;;
-    --sweep)     SWEEP_MODE="sweep"; shift ;;
-    --no-github) LANES_NO_GITHUB=1; shift ;;
-    *) break ;;
-  esac
-done
-
-if [ "${1-}" = guard ] && [ "${CLAUDE_NO_LANE:-}" = 1 ]; then
-  if [ "$#" -ne 1 ]; then
-    printf '%s\n' "lanes-edit: usage: guard   (the UserPromptSubmit hook; the hook's JSON on stdin)" >&2
-    exit 2
-  fi
-  exit 0
-fi
-
-SELF="$0"
-if command -v readlink >/dev/null 2>&1; then
-  RESOLVED="$(readlink -f "$SELF" 2>/dev/null || printf '%s' "$SELF")"
-else
-  RESOLVED="$SELF"
-fi
-SCRIPT_DIR="$(cd -- "$(dirname -- "$RESOLVED")" && pwd)"
-
-# --- THE WORKSPACE REPOSITORY (lane-collision-protocol Amendment 9(a)) -------
-#
-# The person's data — the register `lanes/LANES.md`, the object logs
-# `lanes/log/`, the handoffs, the manifests `park` writes, and a
-# `lanes/repos.tsv` override — is found through
-# `$AGENT_PROTOCOL_ROOT/workspace.yaml`, and NEVER from this file's own
-# location. `resume:466` and `status:1673` already read that same file under
-# that same name, and Amendment 9(a) mints no second one: a second way to find
-# it is a second answer.
-#
-# Deriving it from here stopped being POSSIBLE the moment this became an
-# installed regular file in `~/.local/bin` with no register anywhere near it,
-# and it stopped being WANTED for a subtler reason: a file's location on disk
-# is evidence about the file, not about a person's data.
-#
-# THESE FOUR FUNCTIONS ARE A DELIBERATE COPY, byte for byte, across
-# `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` — the same trade
-# openRepoTools already makes for its own fetch shim (`openRepoTools:93-100`).
-# A shared `lanes-common.sh` would be a TENTH file for `--install` to place and
-# a broken helper the first time somebody copied only some of them. Each of
-# these is one file a person has on PATH.
-#
-# FAILING TO FIND IT IS A REFUSAL, NEVER A GUESS. No file, no `path:`, no
-# `repository:`, or a `path:` that is not the root of a checkout of the
-# `repository:` named beside it → the caller refuses, exit 1 — the code
-# `lanes-edit.sh` has always used for *registry not found* — with the fix
-# named: `openRepoTools wip init`. Nothing here ever creates that file, writes
-# a register, or falls back to a path derived from its own location. THE
-# CHECKOUT TEST IS NEW: nothing validated it before this, so a `path:` pointing
-# at some other repository used to be accepted and now is not.
-#
-# `LANES_WORKSPACE_ROOT` is the test seam and the only override — the seam
-# `lane-start` already spelled for handoff resolution, widened to the whole
-# question so `test_lane_helpers.sh` can point every helper at one sandbox.
-# --- BEGIN shared workspace resolver (Amendment 9(a)) ----------------------
-# BYTE-IDENTICAL IN ALL FOUR LANE HELPERS, and held there by
-# `tests/test_repo_hygiene.py`. The estate commands carry the same discipline
-# for their own estate resolver and for the same reason its guard gives: a
-# drifted copy is TWO ANSWERS to one question, and "where is this person's
-# workspace" is exactly the question Amendment 9(a) exists to give one answer
-# to. Edit it in one file and the test names the other three.
-LANES_WS_WHY=""
-
-lanes_ws_yaml() { printf '%s\n' "${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"; }
-
-# `key: value` at the TOP LEVEL only, first occurrence, with an inline `#`
-# comment and surrounding quotes stripped and a leading `~` expanded against
-# $HOME (nothing expands a bare `~` inside a file). The anchored `^key:` never
-# reaches into the INDENTED `orgs:` map, which Amendment 9(a) puts out of
-# scope: these helpers read `repository:` and `path:` and nothing else, because
-# one register in the first workspace repository is the whole rule — the
-# register never follows that map. Two lines of sed, because a YAML parser is
-# not a dependency any of these files will take for one scalar.
-lanes_ws_field() {
-  local v
-  v="$(sed -n -e "s/^$1:[[:space:]]*//p" "$2" 2>/dev/null | head -n 1 |
-    sed -e 's/[[:space:]]*#.*$//' -e 's/[[:space:]]*$//')"
-  v="${v%\"}"; v="${v#\"}"
-  v="${v%\'}"; v="${v#\'}"
-  case "$v" in
-  '~') v="$HOME" ;;
-  '~/'*) v="$HOME/${v#'~/'}" ;;
-  esac
-  printf '%s\n' "$v"
-}
-
-# THE WORKSTATION'S NAME IS READ, NEVER INVENTED — AND NEVER `hostname` INSIDE A
-# CONTAINER (lane-collision-protocol Amendment 11, ratified decision 8(d), as
-# corrected by A11 Addendum 3's `R-A11-14`).
-#
-# WHAT WENT WRONG. `opensoft/brett-wip` `origin/main` carries SIX lines in
-# `lanes/log/openRepoProject-1.md` whose workstation is a container id — five
-# `@0e7d1a79a07e`, one `@55cceb3e5bc9` — in an append-only file, written by every
-# writer inside that container and not only by Evidence 6's fork. A row on a
-# workstation that does not exist is a row no reader can match, no crossing can
-# detect and no `swapped <ws>` can answer for; and the log is never rewritten, so
-# each one is wrong for ever.
-#
-# WHO OWNS THE VALUE. `R-A11-14`: the **workBenches launcher**, which runs on the
-# host and exports `LANES_WORKSTATION=<the host's own hostname -s>` into every
-# session AND every container it starts, beside the `CLAUDE_PROFILE_NAME` it
-# already exports. These helpers READ it. They do not write it, they do not
-# derive it from a second file, and THEY NEVER SUBSTITUTE A PLACEHOLDER: an
-# `@unknown-workstation` is the same defect one field along from the `unknown`
-# clause (e) refuses in the session field, and the rejected alternative — a
-# `workstation:` key in `workspace.yaml` — is a SECOND PLACE FOR THE TRUTH TO BE
-# WRONG beside the variable the launcher already sets.
-#
-# THE THREE ANSWERS, as `<name><TAB><source>`:
-#
-#   seam              `$LANES_WORKSTATION` is set. This is the ordinary case
-#                     wherever the launcher started the session.
-#   hostname          no seam, and this is NOT a container: `hostname -s`, which
-#                     is what the seam has defaulted to since Amendment 6 and
-#                     what every row written before this rung was written by.
-#   container-unset   no seam, and this IS a container. The NAME still answers,
-#                     because a read in front of every launch may not refuse —
-#                     it will simply match nothing, which is the honest answer —
-#                     but every WRITER refuses, exit 2, naming the variable and
-#                     the launcher that sets it.
-#
-# IT ANSWERS AS A PAIR, AND THAT IS NOT A STYLE CHOICE. A caller reads the name
-# with `$(lanes_workstation)`, which is a COMMAND SUBSTITUTION and therefore a
-# subshell: a global the function set there dies with it. The source is on the
-# same line as the name, which is the only way out of a subshell there is.
-#
-#   $LANES_IN_CONTAINER   1 or 0, forcing the probe. THE TEST SEAM, and nothing
-#                         else sets it: the suite must be able to exercise both
-#                         halves of this rule on one host, and the host it runs
-#                         on is a container exactly when it is.
-lanes_in_container() {
-  case "${LANES_IN_CONTAINER:-}" in
-  1) return 0 ;;
-  0) return 1 ;;
-  esac
-  [ -e /.dockerenv ] || [ -e /run/.containerenv ]
-}
-
-lanes_workstation_pair() {
-  local v
-  if [ -n "${LANES_WORKSTATION:-}" ]; then
-    printf '%s\t%s\n' "$LANES_WORKSTATION" seam
-    return 0
-  fi
-  v="$(hostname -s 2>/dev/null || hostname 2>/dev/null || printf 'unknown')"
-  if lanes_in_container; then
-    printf '%s\t%s\n' "$v" container-unset
-  else
-    printf '%s\t%s\n' "$v" hostname
-  fi
-}
-
-# THE NAME ALONE, which is what every writer of the workstation column wants.
-lanes_workstation() { lanes_workstation_pair | cut -f1; }
-
-# The ONE SENTENCE a writer refuses with, in one place, so the three writers
-# cannot word it three ways. Empty on every other source, so
-# `[ -n "$(lanes_workstation_why "$src")" ]` is the whole of the test.
-lanes_workstation_why() {   # <source>
-  [ "${1:-}" = container-unset ] || return 0
-  printf '%s\n' "this is a container and \$LANES_WORKSTATION is not set, so there is no workstation name to write. This host's own \`hostname\` is the CONTAINER'S id, not a workstation, and a row on a workstation that does not exist is a row no reader can match — in a log nothing ever rewrites (Amendment 11, decision 8(d); R-A11-14). The value is the workBenches launcher's to export into every session and container it starts. Set it for this one and re-run: export LANES_WORKSTATION=<this host's name>"
-}
-
-# One of the spellings `git remote get-url origin` prints for one GitHub
-# repository, reduced to a bare lowercased `<owner>/<name>` so it can be
-# compared against workspace.yaml's own `<owner>/<name>`. A URL that is not
-# GitHub's is compared as it stands, lowercased — which is what lets a sandbox
-# name a bare local origin and still be checked.
-lanes_ws_norm() {
-  local u="${1%.git}"
-  case "$u" in
-  https://github.com/*) u="${u#https://github.com/}" ;;
-  ssh://git@github.com/*) u="${u#ssh://git@github.com/}" ;;
-  git@github.com:*) u="${u#git@github.com:}" ;;
-  esac
-  printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
-}
-
-# Do these two name one repository? Equal after normalisation, OR the origin's
-# path ENDS in the `<owner>/<name>` the pointer file spells — which is how a
-# GitHub Enterprise host, an ssh alias and a local bare mirror laid out by
-# owner and name all say the same thing as `https://github.com/<owner>/<name>`.
-# The pointer file spells `<owner>/<name>` because that is what a person types;
-# `git remote get-url` spells a URL because that is what git stores.
-lanes_ws_same_repo() {
-  local a b
-  a="$(lanes_ws_norm "$1")"
-  b="$(lanes_ws_norm "$2")"
-  [ -n "$a" ] && [ -n "$b" ] || return 1
-  [ "$a" = "$b" ] && return 0
-  case "$a" in */"$b") return 0 ;; esac
-  return 1
-}
-
-# Prints the workspace checkout's real root, or returns 1 having set
-# $LANES_WS_WHY to the one sentence that says which of the five ways it failed.
-# ROOT-NESS IS ITS OWN CHECK: `rev-parse --is-inside-work-tree` and
-# `remote get-url origin` both succeed from any SUBDIRECTORY of a work tree, so
-# a `path:` naming a subdirectory would otherwise be accepted and resolve
-# `<path>/lanes/LANES.md` inside the wrong directory.
-lanes_workspace_root() {
-  local yaml repo path origin toplevel real
-  LANES_WS_WHY=""
-  if [ -n "${LANES_WORKSPACE_ROOT:-}" ]; then
-    printf '%s\n' "$LANES_WORKSPACE_ROOT"
-    return 0
-  fi
-  yaml="$(lanes_ws_yaml)"
-  if [ ! -r "$yaml" ]; then
-    LANES_WS_WHY="there is no $yaml"
-    return 1
-  fi
-  repo="$(lanes_ws_field repository "$yaml")"
-  path="$(lanes_ws_field path "$yaml")"
-  if [ -z "$repo" ]; then
-    LANES_WS_WHY="$yaml names no \`repository:\`"
-    return 1
-  fi
-  if [ -z "$path" ]; then
-    LANES_WS_WHY="$yaml names no \`path:\`"
-    return 1
-  fi
-  if ! git -C "$path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    LANES_WS_WHY="$yaml names path: $path, which is not a git checkout"
-    return 1
-  fi
-  origin="$(git -C "$path" remote get-url origin 2>/dev/null || :)"
-  if ! lanes_ws_same_repo "$origin" "$repo"; then
-    LANES_WS_WHY="$yaml names repository: $repo, but $path is a checkout of ${origin:-no origin at all}"
-    return 1
-  fi
-  toplevel="$(git -C "$path" rev-parse --show-toplevel 2>/dev/null || :)"
-  real="$(cd -- "$path" 2>/dev/null && pwd -P)" || real=""
-  if [ -z "$real" ] || [ "$toplevel" != "$real" ]; then
-    LANES_WS_WHY="$yaml names path: $path, which is not the ROOT of that checkout (${toplevel:-unknown} is)"
-    return 1
-  fi
-  printf '%s\n' "$real"
-}
-
-# The refusal's body, so all four helpers say the same thing in the same words.
-#
-# THE REASON IS RE-DERIVED HERE, IN THE PARENT SHELL, and that is the whole
-# point of this line. Every caller reaches the resolver through a command
-# substitution — `LANES_WS_ROOT="$(lanes_workspace_root || :)"` — which runs it
-# in a SUBSHELL, so the $LANES_WS_WHY it set died with that subshell and the
-# parent still holds the empty string it started with. Six distinct diagnoses
-# were being computed and all six were being thrown away; every one of the
-# refusals Amendment 9(a) enumerates printed the same "no reason recorded".
-# The resolver is read-only and cheap — two `sed`s and three `git` reads — and
-# it is reached on the refusal path only, so running it again HERE is the one
-# place its answer survives to be printed.
-lanes_workspace_why() {
-  [ -n "$LANES_WS_WHY" ] || lanes_workspace_root >/dev/null 2>&1 || :
-  printf '%s' "the workspace repository could not be found — ${LANES_WS_WHY:-no reason recorded}.
-    Amendment 9(a): every lane helper reads \`repository:\` and \`path:\` from
-    $(lanes_ws_yaml), never from its own location. One command writes that
-    file, creates or clones the repository and places the symlinks:
-        openRepoTools wip init"
-}
-# --- END shared workspace resolver ------------------------------------------
-
-# ======================= AMENDMENT 18(a) — WHERE THE LANE IS ================
-#
-# **A LANE HAS ONE BINDING, AND THE RECORD SAYS WHERE IT IS.** Ratified
-# 2026-09-14T13:15:18Z as revision 4; `brettheap/new-workstation#34`/#35,
-# opensoft/openRepoTools#38. Clause (a) gives the lane-kind payload three
-# sub-fields beside Amendment 11(c)'s `window`, `dir` and `profile`:
-#
-#   host <name>       the MACHINE's short hostname as it reads OUTSIDE any
-#                     container. The launcher exports it (`LANES_HOST`); a
-#                     writer outside a container reads `hostname -s`; a writer
-#                     INSIDE one with no export writes the Rule 10 workstation
-#                     name, because in this estate a workstation is one host and
-#                     a container's own `hostname` is its id.
-#   os <linux|macos|wsl|windows>
-#                     the HOST's operating system as the person means it. The
-#                     launcher exports it (`LANES_OS`); with no export the
-#                     kernel is probed: `Darwin` -> macos; `Linux` whose
-#                     `/proc/version` names `microsoft` -> wsl; one naming
-#                     `linuxkit` -> macos (Docker Desktop's VM); any other
-#                     `Linux` -> linux. `windows` is written ONLY by a launcher
-#                     on the Windows host itself — this toolset is bash and runs
-#                     in WSL2 there, so its own probe never says it.
-#   container <name|none>
-#                     the bench's name as the launcher exports it
-#                     (`LANES_CONTAINER`: `py-bench`, `cloud-bench`, …); inside
-#                     a container with no export, THAT CONTAINER'S OWN
-#                     `hostname`, which for Docker's default is its id — a true
-#                     name of that container and the one thing that tells two
-#                     unnamed containers apart; outside every container, `none`.
-#
-# WHY THE RULE EXISTS AT ALL, in the amendment's own words: *"a pid does not
-# cross a pid namespace, and the tooling pretends it does."* Two bench
-# containers on one host share the profile directory, so pyBench can read a
-# session record cloudBench wrote and then `kill -0` a pid in cloudBench's
-# namespace — which is either nothing or some other process. A lane live and
-# writing in cloudBench reads NOT LIVE from pyBench, and `lane-start` there took
-# the name. The three facts are what let a reader say UNKNOWN instead.
-#
-# READ LIVE, EVERY TIME, AND NEVER CACHED — MEASURED 2026-09-15T12:17Z. This
-# bench container was recreated with a new hostname (`cb999b9fd177`) and its
-# `~/.local/bin` was wiped with it. A container's `hostname` names THIS
-# container for as long as it exists and names nothing afterwards, so it is
-# asked at the moment a line is written and is never carried in a variable
-# across a run, let alone read back out of a record as though it were the
-# workstation's name. A binding written by a container that has since been
-# recreated therefore does NOT match this one — which is correct, because its
-# pid namespace went with it — and the window-gone exception in clause (b) is
-# what makes such a binding readable as dead rather than stranding the lane.
-#
-# EACH ANSWERS AS A PAIR, `<value><TAB><source>`, for the reason
-# `lanes_workstation_pair` states: a caller reads the value with `$( … )`, which
-# is a subshell, so a global the function set there dies with it. The source is
-# what `workstation` prints in its two new columns.
-#
-# NOT IN THE SHARED RESOLVER BLOCK ABOVE, deliberately. That block is
-# byte-identical in four files and `tests/test_repo_hygiene.py` holds it there;
-# these three are read by the WRITER and by the reads built on it, all of which
-# are in this file, so a fourth copy would be three more places for one answer
-# to be given differently.
-
-# `hostname -s` where there is one, else `hostname`, else empty. BSD and GNU
-# both take `-s`; a busybox one may not, and an empty answer is honest.
-lanes_host_probe() {
-  hostname -s 2>/dev/null || hostname 2>/dev/null || printf ''
-}
-
-lanes_host_pair() {
-  if [ -n "${LANES_HOST:-}" ]; then
-    printf '%s\t%s\n' "$LANES_HOST" seam
-    return 0
-  fi
-  if lanes_in_container; then
-    # INSIDE A CONTAINER `hostname` IS THE CONTAINER'S ID AND NOT THE HOST'S
-    # (Amendment 11 decision 8(d), R-A11-14, one field along): the Rule 10
-    # workstation name is the host in this estate, so it is what is written.
-    printf '%s\t%s\n' "$WS" workstation
-    return 0
-  fi
-  printf '%s\t%s\n' "$(lanes_host_probe)" hostname
-}
-
-# THE KERNEL, PROBED — and `windows` is not one of its answers, which is the
-# clause's own sentence and not an omission.
-lanes_os_pair() {
-  if [ -n "${LANES_OS:-}" ]; then
-    printf '%s\t%s\n' "$LANES_OS" seam
-    return 0
-  fi
-  lop_u="$(uname -s 2>/dev/null || printf '')"
-  case "$lop_u" in
-    Darwin) printf '%s\t%s\n' macos kernel; return 0 ;;
-    Linux) : ;;
-    *) printf '%s\t%s\n' linux kernel; return 0 ;;
-  esac
-  # `/proc/version` IS ABSENT ON A BSD USERLAND AND THAT IS NOT AN ERROR (#52's
-  # fixture lesson): the read is guarded, and a Linux kernel naming neither
-  # string is plain `linux`.
-  lop_v=""
-  [ -r /proc/version ] && lop_v="$(cat /proc/version 2>/dev/null || printf '')"
-  case "$lop_v" in
-    *microsoft*|*Microsoft*|*WSL*) printf '%s\t%s\n' wsl kernel ;;
-    *linuxkit*|*Linuxkit*) printf '%s\t%s\n' macos kernel ;;
-    *) printf '%s\t%s\n' linux kernel ;;
-  esac
-}
-
-lanes_container_pair() {
-  if [ -n "${LANES_CONTAINER:-}" ]; then
-    printf '%s\t%s\n' "$LANES_CONTAINER" seam
-    return 0
-  fi
-  if lanes_in_container; then
-    printf '%s\t%s\n' "$(lanes_host_probe)" hostname
-    return 0
-  fi
-  printf '%s\t%s\n' none outside
-}
-
-# THE ONE FENCE ALL THREE VALUES PASS, and it is Amendment 7(b)'s grammar
-# rather than a taste: a sub-field's refs are separated by SPACES and its
-# siblings by `; `, the line's fields by `, ` and its free text by ` — `, and
-# the log is APPEND-ONLY. A hostname carrying any of those is a line no parser
-# can read, for ever. A value that fails is DROPPED with a note (the sub-field,
-# never the line — `R-A11-11`'s posture for the swap record, one field along):
-# a binding that loses its `container` still says which host it is on, while a
-# lane-kind line that was never written loses the lane.
-lanes_binding_value_ok() {   # <value>
-  case "${1-}" in
-    '') return 1 ;;
-    *[!A-Za-z0-9._:-]*) return 1 ;;
-  esac
-  return 0
-}
-
-# The register is no longer the whole of its own worktree: since Amendment 5
-# it is one file, `lanes/LANES.md`, inside the workspace repository. So every
-# git call needs the checkout ROOT and a pathspec RELATIVE to it. Amendment
-# 9(a) says where the root comes from; `--show-prefix` still derives the
-# pathspec, because `LANES_DIR` may be pointed anywhere by a caller and the
-# pathspec must follow it.
-#
-# RESOLVED HERE, REFUSED LATER. An empty answer is carried rather than fatal,
-# so `--help`, the usage and `session-start` — a hook that must exit 0 on a
-# machine with no register at all — still run. The refusal is the
-# `registry not found` guard below, which is exit 1: the code this script has
-# always used for it and the code Amendment 9(a) quotes.
-LANES_WS_ROOT=""
-if [ -z "${LANES_REPO:-}" ] || { [ -z "${LANES_DIR:-}" ] && [ -z "${LANES_FILE:-}" ]; }; then
-  LANES_WS_ROOT="$(lanes_workspace_root || :)"
-fi
-: "${LANES_REPO:=$LANES_WS_ROOT}"
-if [ -z "${LANES_DIR:-}" ]; then
-  if [ -n "${LANES_FILE:-}" ]; then
-    LANES_DIR="$(dirname -- "$LANES_FILE")"
-  else
-    LANES_DIR="${LANES_WS_ROOT:+$LANES_WS_ROOT/lanes}"
-  fi
-fi
-LANES_FILE="${LANES_FILE:-$LANES_DIR/LANES.md}"
-WS_PAIR="$(lanes_workstation_pair)"
-WS="${WS_PAIR%%	*}"
-WS_SOURCE="${WS_PAIR##*	}"
-# AMENDMENT 18(a) — THE THREE FACTS BENEATH THE WORKSTATION'S NAME, probed here
-# for the READS and probed AGAIN by the writer for every line it appends, and
-# always AFTER `WS`, because the `host` fallback inside a container IS the
-# workstation's name. Every one of them is a live read of this process's own
-# environment and kernel: nothing here is ever taken from a record.
-LANES_HOST_NAME=""; LANES_HOST_SOURCE=""
-LANES_OS_NAME=""; LANES_OS_SOURCE=""
-LANES_CONTAINER_NAME=""; LANES_CONTAINER_SOURCE=""
-# ONE FUNCTION PROBES ALL THREE, AND THE WRITER CALLS IT AGAIN AT THE WRITE
-# (Copilot round 3 on opensoft/openRepoTools#83). A process-start snapshot is
-# what every reader wants — the values cannot change under a short read — but
-# the sentence this file makes about them is *"read live at every write and
-# never cached"*, and a `request-handoff` can sit in a five-minute wait between
-# its start and a later act. The probe is two forks; making the words true costs
-# nothing and leaves nothing for a reader to have to reason about.
-lanes_binding_probe() {
-  HOST_PAIR="$(lanes_host_pair)"
-  LANES_HOST_NAME="${HOST_PAIR%%	*}"
-  LANES_HOST_SOURCE="${HOST_PAIR##*	}"
-  OS_PAIR="$(lanes_os_pair)"
-  LANES_OS_NAME="${OS_PAIR%%	*}"
-  LANES_OS_SOURCE="${OS_PAIR##*	}"
-  CONTAINER_PAIR="$(lanes_container_pair)"
-  LANES_CONTAINER_NAME="${CONTAINER_PAIR%%	*}"
-  LANES_CONTAINER_SOURCE="${CONTAINER_PAIR##*	}"
-  # The lower-cased cache the locality rule reads is derived from them, so it
-  # is dropped here rather than left saying what the probe used to say.
-  LANES_HOST_LC=""; LANES_WS_LC=""; LANES_CONTAINER_LC=""
-  return 0
-}
-lanes_binding_probe
-NO_GIT="${LANES_NO_GIT:-0}"
-LOCK="$LANES_DIR/.lanes-edit.lock"
-# AMENDMENT 14 — TWO VALUES ONLY THIS PROCESS SETS, AND NEVER THE ENVIRONMENT.
-# The index is consulted behind a flag typed for the invocation, "never by
-# default, environment or configuration" (clause (b)), and the nudge follows a
-# push THIS process made (clause (d)). Both are assigned here unconditionally,
-# so an exported variable of either name changes nothing.
-LANES_IDX_DIR=""
-LANES_INDEX_NUDGE=0
-# AND THE INVENTORY'S OWN TWO (opensoft/openRepoTools#161), for the same reason:
-# the `worktrees` table's export directory, set only by `index_open worktrees`,
-# and the nudge an inventory write leaves for `cleanup` - set only by a write
-# of a lifecycle snapshot or a tree record that this process made.
-LANES_WT_IDX_DIR=""
-LANES_INDEX_NUDGE_INV=0
-LOCK_HELD=0
-LANES_PATH="${LANES_PATH:-$(git -C "${LANES_DIR:-.}" rev-parse --show-prefix 2>/dev/null || :)${LANES_FILE##*/}}"
-
-# The pathspecs the current invocation is writing. Every subcommand that
-# predates Amendment 7 writes exactly one, the register; a LANDING or LANDED
-# writes two. CP_AFTER_REBASE is a function commit_push calls after each
-# `pull --rebase`, before it pushes — `claim` uses it to notice that another
-# lane's claim landed first.
-CP_PATHS=("$LANES_PATH")
-CP_AFTER_REBASE=""
-# Set by `commit` alone, and never taken from the environment: with nothing
-# staged, commit_push publishes the local commits ahead of origin for that one
-# write and for no other (#194).
-CP_PUBLISH_AHEAD=0
-# A publish's push sends the commit its fence read, `<sha>:refs/heads/<branch>`;
-# empty, every push sends the branch as it stands, as it always has (#194).
-CP_PUSH_SPEC=""
-CP_FENCE_TIP=""
-CP_FENCE_AHEAD=0
-
-# die "<message>" [<exit code>] — the MESSAGE is $1 alone. It used to be "$*",
-# which joined the exit code on to the end of every refusal that passed one:
-# `… is not a stale claim. 2`. The code is the caller's business and the
-# process's, not the reader's; LANES_DEBUG=1 prints it for whoever is debugging
-# the codes themselves.
-die() {
-  printf 'lanes-edit: %s\n' "${1-}" >&2
-  [ -n "${LANES_DEBUG:-}" ] && printf 'lanes-edit: (exit %s)\n' "${2:-1}" >&2
-  exit "${2:-1}"
-}
-note() { printf 'lanes-edit: %s\n' "$*" >&2; }
-
-# AMENDMENT 8, ruling (h): THE LOCK NAMES ITS HOLDER, so a lock nobody holds can
-# be told from a lock somebody does. The directory alone could only be aged out,
-# and ten minutes of every lane on the workstation blocked is not a recovery.
-release_lock() {
-  rm -f -- "$LOCK/pid" 2>/dev/null || :
-  rmdir -- "$LOCK" 2>/dev/null || :
-  LOCK_HELD=0
-  return 0
-}
-
-# ====================================================== AMENDMENT 16 =======
-#
-# THE RENAME'S UNDO, AND WHY IT IS A TRAP AND NOT A LINE BEFORE EACH `die`.
-#
-# `rename-lane` is ONE COMMIT, REFUSED OR WHOLE, and its refusals all happen
-# before the first byte — but the four MOVES themselves can still fail on a
-# filesystem: a `mv` across a mount, a handoff this user may not write, a disk
-# that fills between the log and the alias table. Copilot round 1 on
-# openRepoTools#81 named the state that left: *"the log has already been moved
-# and its `RENAMED` line appended, and this `die` exits without rolling either
-# change back"* — a half-renamed checkout, which is exactly what the contract
-# says cannot happen and what no re-run can finish.
-#
-# So the writes are made against a SNAPSHOT taken before the first of them, and
-# every exit path between the first write and the commit restores it. It hangs
-# off `cleanup`, not off each `die`, for the reason `replace_line` makes
-# unavoidable: that function dies inside itself when its own proof fails, and a
-# caller cannot put a line after it. `cleanup` runs on EXIT and on the two
-# signals, so one hook covers every way out, the shell's included.
-#
-# THE REGISTER IS NOT IN IT. `replace_line` builds the new file in a temporary
-# directory and proves it — one line added, one removed, the same line count —
-# BEFORE it writes a byte of `LANES.md`, so the register is never half-written
-# and there is nothing there to restore.
-RL_ACTIVE=0; RL_SNAP=""; RL_HEAD_BEFORE=""
-RL_LOG_OLD=""; RL_LOG_NEW=""; RL_H_OLD=""; RL_H_NEW=""
-RL_ALIAS=""; RL_ALIAS_EXISTED=0; RL_REG=""
-RL_PATHS_FOR_UNDO=()
-rename_undo() {
-  [ "$RL_ACTIVE" = 1 ] || return 0
-  RL_ACTIVE=0
-  # A COMMIT THAT EXISTS IS NOT UNDONE. The undo is armed through `commit_push`
-  # because that function can die before it commits anything; once it HAS
-  # committed, the four moves are in that commit and restoring the working tree
-  # would be an inverse change nobody asked for, on top of a commit whose own
-  # recovery `commit_push` prints. HEAD is the whole test.
-  if [ -n "$RL_HEAD_BEFORE" ]; then
-    ru_head="$(git -C "$LANES_REPO" rev-parse HEAD 2>/dev/null || printf '')"
-    if [ -n "$ru_head" ] && [ "$ru_head" != "$RL_HEAD_BEFORE" ]; then
-      note "the rename is COMMITTED as $ru_head and is not rolled back; what follows is about getting that commit to origin, and the four files are whole."
-      return 0
-    fi
-  fi
-  [ -n "$RL_LOG_NEW" ] && [ -f "$RL_LOG_NEW" ] && rm -f -- "$RL_LOG_NEW"
-  [ -n "$RL_LOG_OLD" ] && [ -n "$RL_SNAP" ] && [ -f "$RL_SNAP/log" ] && cat -- "$RL_SNAP/log" > "$RL_LOG_OLD"
-  if [ -n "$RL_H_NEW" ] && [ "$RL_H_NEW" != "$RL_H_OLD" ] && [ -f "$RL_H_NEW" ]; then rm -f -- "$RL_H_NEW"; fi
-  [ -n "$RL_H_OLD" ] && [ -n "$RL_SNAP" ] && [ -f "$RL_SNAP/handoff" ] && cat -- "$RL_SNAP/handoff" > "$RL_H_OLD"
-  if [ -n "$RL_ALIAS" ]; then
-    if [ "$RL_ALIAS_EXISTED" = 1 ]; then
-      [ -n "$RL_SNAP" ] && [ -f "$RL_SNAP/aliases" ] && cat -- "$RL_SNAP/aliases" > "$RL_ALIAS"
-    else
-      rm -f -- "$RL_ALIAS"
-    fi
-  fi
-  # THE REGISTER LAST, and with the `cat >` every writer here uses for it: the
-  # register reached through `~/projects/<estate>/LANES.md` is a SYMLINK, and a
-  # redirect follows it where `mv` or `cp` would replace it with a regular file
-  # and detach the register from git — the hazard this file's own header opens
-  # with.
-  [ -n "$RL_REG" ] && [ -n "$RL_SNAP" ] && [ -f "$RL_SNAP/register" ] && cat -- "$RL_SNAP/register" > "$RL_REG"
-  # AND THE INDEX WITH IT, because `commit_push` STAGES before it commits: a
-  # `git add` that succeeded and a `git commit` that did not leaves the four
-  # paths staged, so restoring only the working tree would leave the rename in
-  # the index for the next writer to commit by accident.
-  # THE PATHSPECS STAY AN ARRAY (Copilot round 8 on openRepoTools#81). Flattened
-  # into one string and expanded unquoted, a handoff under `handoffs/team
-  # notes/…` — a path this estate supports, and the one every other line here
-  # quotes — became `handoffs/team` and `notes/…`, two pathspecs that match
-  # nothing. AND `git reset` SAYS NOTHING ABOUT ONE IT CANNOT MATCH: measured,
-  # it resets the paths it does match, leaves that file staged and exits 0, so
-  # the `|| :` above was never reached and no line of output said so. The
-  # rename then stayed in the index for the next writer to commit by accident,
-  # which is the half-transaction this whole snapshot exists to prevent.
-  if [ -n "$RL_REG" ] && [ "$NO_GIT" != 1 ] && [ "${#RL_PATHS_FOR_UNDO[@]}" -gt 0 ]; then
-    git -C "$LANES_REPO" reset -q HEAD -- "${RL_PATHS_FOR_UNDO[@]}" 2>/dev/null || :
-  fi
-  note "the rename was rolled back: the object log, the handoff and ${LANES_ALIASES_PATH:-lanes/aliases.tsv} are as they were, and nothing was committed. A rename is ONE commit, refused or whole (Amendment 16)."
-  return 0
-}
-
-# `cleanup`'S TEMPORARIES START EMPTY, so none of them is a path the CALLER
-# chose. It runs on every exit and removes each one by name, and a variable
-# exported into the environment used to arrive here already set: `rl_htmp`
-# made a read-only `canon-lane` delete the file it named, and `TMPD` made it
-# `rm -rf` the directory (the reviews of #212 and #213; `pbh_tmp` and `TMPD`
-# had the hole before `rl_htmp` joined them). `SE_CACHE_FILE` is assigned only
-# at the state-event cache below, so a signal before that line removed what it
-# inherited. Every other path `cleanup`, `rename_undo` and `release_lock`
-# remove is set above, before the trap: `RL_*`, `LANES_IDX_DIR`,
-# `LANES_WT_IDX_DIR`, `LOCK` and `LOCK_HELD`.
-TMPD=""; pbh_tmp=""; rl_htmp=""; SE_CACHE_FILE=""
-cleanup() {
-  [ -z "${pbh_tmp:-}" ] || rm -f -- "$pbh_tmp"
-  [ -z "${rl_htmp:-}" ] || rm -f -- "$rl_htmp"   # rename-lane's stamp before its replace (#158)
-  rename_undo
-  if [ "$LOCK_HELD" = 1 ]; then release_lock; fi
-  [ -n "${RL_SNAP:-}" ] && [ -d "${RL_SNAP:-}" ] && rm -rf -- "$RL_SNAP"
-  [ -n "${TMPD:-}" ] && [ -d "${TMPD:-}" ] && rm -rf -- "$TMPD"
-  [ -n "${SE_CACHE_FILE:-}" ] && rm -f -- "$SE_CACHE_FILE" "$SE_CACHE_FILE".* 2>/dev/null
-  [ -n "${LANES_IDX_DIR:-}" ] && [ -d "${LANES_IDX_DIR:-}" ] && rm -rf -- "$LANES_IDX_DIR"
-  [ -n "${LANES_WT_IDX_DIR:-}" ] && [ -d "${LANES_WT_IDX_DIR:-}" ] && rm -rf -- "$LANES_WT_IDX_DIR"
-  # AMENDMENT 14(d) — THE NUDGE IS THE LAST THING THIS PROCESS DOES: after the
-  # lock is released at the top of this function, and only where `commit_push` recorded a push
-  # that landed - or, opensoft/openRepoTools#161, where an inventory writer
-  # recorded a snapshot or a tree record it had just replaced. Tested here rather
-  # than inside the function, because `cleanup` also runs for a process that died
-  # before `index_nudge` was ever defined.
-  if [ "${LANES_INDEX_NUDGE:-0}" = 1 ] || [ "${LANES_INDEX_NUDGE_INV:-0}" = 1 ]; then index_nudge; fi
-  return 0
-}
-# AND A SIGNAL ACTUALLY STOPS IT (Amendment 8, ruling (h)). `trap cleanup EXIT
-# INT TERM` ran the handler and then CARRIED ON, because a trap that returns
-# resumes the command after the one that was interrupted — so a `kill` of a
-# writer stuck in `acquire_lock`'s 60-second wait released the lock and then
-# went on waiting for it, and a `kill` of one mid-write released the lock while
-# it still had the register open. Measured: SIGTERM at 8s, the process still
-# running at 56s. The handler now re-raises with the default disposition, which
-# is the only way a shell reports "killed by that signal" and the only way the
-# process actually stops.
-trap cleanup EXIT
-trap 'cleanup; trap - INT;  kill -INT  $$' INT
-trap 'cleanup; trap - TERM; kill -TERM $$' TERM
-
-# A LOCK WHOSE HOLDER IS DEAD IS STALE THE INSTANT ITS PID IS GONE — not ten
-# minutes later. A helper killed at a usage reset, or an ssh that took the
-# process down with it, leaves a directory no living process will ever remove,
-# and until Amendment 8(h) every writer on the workstation waited out the full
-# age-out behind it. A lock with NO pid file is from an older version of this
-# script and keeps the age test, which is the only thing that could be said
-# about it.
-lock_steal_if_dead() {
-  [ -d "$LOCK" ] || return 0
-  lsd_pid="$(cat -- "$LOCK/pid" 2>/dev/null || :)"
-  case "$lsd_pid" in ''|*[!0-9]*) return 0 ;; esac
-  [ "$lsd_pid" = "$$" ] && return 0
-  kill -0 "$lsd_pid" 2>/dev/null && return 0
-  note "taking over $LOCK: its holder (pid $lsd_pid) is gone"
-  rm -f -- "$LOCK/pid" 2>/dev/null || :
-  rmdir -- "$LOCK" 2>/dev/null || :
-  return 0
-}
-
-# THE MUTEX, TAKEN WITHOUT DYING FOR IT — 0 taken, 1 not taken, and no exit
-# either way. `acquire_lock` below is this with the refusal on the end, so the
-# `mkdir` mutex, the pid test and the age-out are written ONCE and every taker
-# of the lock obeys the same three.
-#
-# THE NON-FATAL FORM IS WHAT THE LIFECYCLE FOLLOW-UP TAKES (openRepoTools#91).
-# It runs at the foot of `write_event`, AFTER the event line has landed and been
-# committed, and a `die` there would abort a caller whose write is already on
-# disk — so the snapshot that could not be taken under the mutex is left alone
-# and SAID, exactly as a snapshot that could not be written is.
-lock_try() {   # [<seconds to wait, default 60>]
-  lt_max="${1:-60}"
-  lock_steal_if_dead
-  # Stale lock (>10 min) is removed: a helper run never takes that long. The
-  # age test is now the FALLBACK — the pid test above is the real one.
-  if [ -d "$LOCK" ]; then
-    if [ -z "$(find "$LOCK" -maxdepth 0 -mmin -10 2>/dev/null)" ]; then
-      note "removing stale lock $LOCK"
-      rm -f -- "$LOCK/pid" 2>/dev/null || :
-      rmdir -- "$LOCK" 2>/dev/null || :
-    fi
-  fi
-  lt_i=0
-  while [ "$lt_i" -lt "$lt_max" ]; do
-    if mkdir -- "$LOCK" 2>/dev/null; then
-      LOCK_HELD=1
-      printf '%s\n' "$$" > "$LOCK/pid" 2>/dev/null || :
-      return 0
-    fi
-    lock_steal_if_dead          # it may have died while we were waiting
-    lt_i=$((lt_i + 1))
-    sleep 1
-  done
-  return 1
-}
-
-acquire_lock() {
-  lock_try 60 && return 0
-  die "could not acquire $LOCK after 60s — another lanes-edit run is active (holder pid $(cat -- "$LOCK/pid" 2>/dev/null || printf 'unrecorded'))" 4
-}
-
-# ---------------------------------------------------------------- row lookup
-
-# AMENDMENT 15 — A LANE NAME IS ONE NAME UNDER ANY CASE, AND THE ROW'S SPELLING
-# IS THE ONE IT CARRIES (ratified 2026-09-14T00:07:18Z).
-#
-# Every spelling the WORKING TREE's register carries for a name, compared
-# case-insensitively, one per line. This is the set `row_line` counts and the
-# set every refusal below NAMES: at 2026-09-13T23:51:56Z a `lane-start
-# openxfactory 2` typed in lowercase for the lane `openXfactory-2` found NO row
-# here — the row key was the one exact comparison left in this file — and
-# appended a SECOND row for a lane that had run since 2026-09-02, while its
-# object log went on into the one file both spellings had always shared.
-rows_named_ci_local() {   # <typed name>
-  awk -v want="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      t = substr(rest, 1, p2 - 1)
-      if (tolower(t) == tolower(want)) print t
-    }' "$LANES_FILE"
-}
-
-# Prints the 1-based line number of the row whose FIRST backticked token is the
-# lane name, COMPARED CASE-INSENSITIVELY (Amendment 15). Exactly one match is
-# required — and where there are two, that is the amendment's own refusal and
-# not a puzzle about which row to edit: 15(d) says the two are merged into one,
-# by hand, in a commit that names both spellings.
-#
-# THE LINE IT RETURNS IS STILL THE EXACT LINE. What changed is how the line is
-# FOUND; every editor above still rewrites that one line byte for byte, so a row
-# spelled `openXfactory-2` keeps its spelling when a caller typed the lowercase
-# form. Which spelling gets WRITTEN into new text is `canon_lane`'s answer, one
-# function along.
-row_line() {
-  lane="$1"
-  hits="$(
-    awk -v lane="$lane" '
-      substr($0,1,1) == "|" {
-        p1 = index($0, "`")
-        if (p1 == 0) next
-        rest = substr($0, p1 + 1)
-        p2 = index(rest, "`")
-        if (p2 == 0) next
-        if (tolower(substr(rest, 1, p2 - 1)) == tolower(lane)) print NR
-      }' "$LANES_FILE"
-  )"
-  n="$(printf '%s' "$hits" | grep -c . || :)"
-  if [ "$n" != 1 ]; then
-    # NOTE: row_line runs inside $( ), so it must RETURN, not exit — an `exit`
-    # here would only leave the command substitution's subshell and the caller
-    # would carry on with an empty line number.
-    note "expected exactly 1 row for lane '$lane', found $n${hits:+ (lines: $(printf '%s' "$hits" | tr '\n' ' '))}"
-    if [ "$n" -gt 1 ]; then
-      note "those rows are spelled $(rows_named_ci_local "$lane" | tr '\n' ' ')— a lane name is ONE name under any case (Amendment 15), so merge them into one row (Amendment 15(d)): append the newer row's session id(s) to the older row's session cell, in order, and remove the newer row in the SAME commit"
-    fi
-    return 2
-  fi
-  printf '%s' "$hits"
-}
-
-count_occurrences() { # $1=haystack $2=needle
-  hay="$1"; needle="$2"; c=0
-  if [ -z "$needle" ]; then note "empty search string"; return 2; fi
-  while :; do
-    case "$hay" in
-      *"$needle"*) c=$((c + 1)); hay="${hay#*"$needle"}" ;;
-      *) break ;;
-    esac
-  done
-  printf '%s' "$c"
-}
-
-# A row split into HEAD (everything up to and including the SECOND `|`), the
-# SESSION CELL, and TAIL (from the THIRD `|` on) — the three pieces
-# `append-session-id` needs, and the only safe way to reach cell 3 of a row
-# whose LATER cells may contain a literal `|` (the live register has two such
-# rows). It splits from the LEFT for that reason, never from NF. The three
-# pieces are asserted to reassemble into the row before anything is written.
-RSC_HEAD=""; RSC_CELL=""; RSC_TAIL=""
-row_split_session_cell() {   # <row>
-  rsc_row="$1"; RSC_HEAD=""; RSC_CELL=""; RSC_TAIL=""
-  case "$rsc_row" in *"|"*) : ;; *) return 1 ;; esac
-  rsc_rest="${rsc_row#*|}"                 # after the 1st |
-  case "$rsc_rest" in *"|"*) : ;; *) return 1 ;; esac
-  rsc_rest2="${rsc_rest#*|}"               # after the 2nd |
-  case "$rsc_rest2" in *"|"*) : ;; *) return 1 ;; esac
-  RSC_CELL="${rsc_rest2%%|*}"
-  RSC_TAIL="|${rsc_rest2#*|}"
-  RSC_HEAD="${rsc_row%%|*}|${rsc_rest%%|*}|"
-  [ "$RSC_HEAD$RSC_CELL$RSC_TAIL" = "$rsc_row" ] || return 1
-  return 0
-}
-rstrip_spaces() { s="$1"; while [ "${s% }" != "$s" ]; do s="${s% }"; done; printf '%s' "$s"; }
-
-# --------------------------------------------- AMENDMENT 13: THE ROW IS STATE
-#
-# **THE ROW IS THE LANE'S CURRENT STATE, ONE LINE A PERSON CAN READ; ITS HISTORY
-# IS THE LANE'S OWN LOG** — lane-collision-protocol Amendment 13, in force
-# 2026-09-13T21:08:36Z. Clause (a): the `state` column holds ONE PHRASE,
-# `<STATE> · <UTC> · <one line>`, and every write REPLACES it. `set-row-state`
-# is the writer; `append-row-status` is RETIRED, so the cell can never grow into
-# a diary again. Measured on the day the amendment was drafted: the register was
-# 1,141,283 bytes over 46 rows, its longest row 96,228 characters, and this
-# lane's own cell 7,016 characters after ONE day of appending.
-#
-# WHERE THE CELL IS: SPLIT THE ROW ON ` | `, AND SIX SEPARATORS ARE THE PROOF.
-# A seven-column row has exactly six of them, and then the two readings of the
-# row — count six from the left, take the last cell from the right — are the
-# same text. A row with MORE has a ` | ` inside one of its cells, and nothing
-# here can tell WHICH cell it is in: the two readings disagree, and one of them
-# writes the new state over the row's handoff path. So more than six is a
-# REFUSAL naming the row, never a choice between them.
-#
-# MEASURED ON THE LIVE REGISTER, 2026-09-15 (1,335,595 bytes, 52 rows): 50 of
-# them carry exactly six separators and split cleanly. `openXfactory-2` carries
-# seven — one of them is inside its `objects owned` cell, so the two readings
-# disagree about the HANDOFF PATH — and `openxfactory-4` eight, both inside its
-# state cell. Those two are refused by name, and the fix is a person's: escape
-# the pipe as `\|`, which is how a Markdown table carries a literal one, in a
-# hand edit wrapped by `lanes-edit.sh commit`. A BARE `|` THAT IS NOT SPELLED
-# ` | ` IS HARMLESS and stays inside whichever cell holds it: the state cells of
-# `openRepoProject-1` and `openRepoTools-3` carry nineteen and four of them
-# (`'| true'`, a quoted shell fragment), and both of those rows split exactly.
-#
-# It splits from the LEFT for the reason `row_split_session_cell` does — the
-# cells that may carry a stray separator are the free-text ones at the end — and
-# the three pieces are asserted to reassemble into the row before anything is
-# written.
-RSS_HEAD=""; RSS_CELL=""; RSS_TAIL=""
-row_split_state_cell() {   # <row> — 0 with the pieces · 1 not a row · 2 ambiguous
-  rss_row="$1"; RSS_HEAD=""; RSS_CELL=""; RSS_TAIL=""
-  case "$rss_row" in "|"*) : ;; *) return 1 ;; esac
-  rss_body="$(rstrip_spaces "$rss_row")"
-  case "$rss_body" in *"|") : ;; *) return 1 ;; esac
-  # `${row:N}` AND NEVER `${row#"$body"}`. Removing a literal prefix walks every
-  # prefix length in turn, so a 90,751-character row cost ELEVEN SECONDS in that
-  # one expansion — measured 2026-09-15 against the live register's longest row,
-  # and it is the whole of what made a dry run of the migration take a minute
-  # and a half. A substring by offset is linear, and both `${#s}` and `${s:n}`
-  # count CHARACTERS, so the two agree on a row full of `·`, `—` and `→`.
-  rss_pad="${rss_row:${#rss_body}}"         # the row's own trailing spaces, kept
-  rss_inner="${rss_body%|}"                 # everything before the closing pipe
-  rss_n="$(count_occurrences "$rss_inner" " | ")" || return 1
-  [ "$rss_n" = 6 ] || return 2
-  rss_rest="$rss_inner"; rss_head=""; rss_i=0
-  while [ "$rss_i" -lt 6 ]; do
-    rss_one="${rss_rest%% | *}"
-    rss_head="$rss_head$rss_one | "
-    rss_rest="${rss_rest:$(( ${#rss_one} + 3 ))}"     # 3 = the separator
-    rss_i=$((rss_i + 1))
-  done
-  RSS_HEAD="$rss_head"; RSS_CELL="$rss_rest"; RSS_TAIL="|$rss_pad"
-  [ "$RSS_HEAD$RSS_CELL$RSS_TAIL" = "$rss_row" ] || { RSS_HEAD=""; RSS_CELL=""; RSS_TAIL=""; return 1; }
-  return 0
-}
-
-# How many ` | ` a row carries, for the refusal above to be able to say so.
-row_sep_count() {   # <row>
-  count_occurrences "$(rstrip_spaces "$1")" " | " 2>/dev/null || printf '?'
-}
-
-# Clause (a)'s seven states, and O1's cap on the one line beside them.
-ROW_STATES='LIVE, PAUSED, LANDING #<n>, LANDED, ENDED, RETIRED, HANDED OFF'
-ROW_STATE_CAP=240
-ROW_STATE=""; ROW_STATE_LINE=""
-state_word_is_valid() {   # <STATE>
-  case "${1-}" in
-    LIVE|PAUSED|LANDED|ENDED|RETIRED|'HANDED OFF') return 0 ;;
-    'LANDING #'*)
-      # Rule 6's reading of the cell is unchanged by Amendment 13 and is now the
-      # whole of what the cell says at that moment, so the number is checked:
-      # `LANDING #` with nothing after it is a merge hold no lane can pair with
-      # a PR.
-      case "${1#LANDING #}" in
-        '' | *[!0-9]*) return 1 ;;
-        *) return 0 ;;
-      esac ;;
-  esac
-  return 1
-}
-
-# `<STATE> · <one line>` → ROW_STATE and ROW_STATE_LINE, or a refusal. Every
-# test is made BEFORE the lock and before the row is touched, so a refusal
-# leaves the register exactly as it found it.
-row_state_check() {   # "<STATE> · <one line>"
-  rst_in="${1-}"; ROW_STATE=""; ROW_STATE_LINE=""
-  case "$rst_in" in
-    *' · '*) : ;;
-    *) die "the phrase is '<STATE> · <one line>' and this carries no ' · ' separator: '$rst_in'. The STATE is one of $ROW_STATES; the line says what the last act was, in at most $ROW_STATE_CAP characters. The narrative goes to the lane's own log — \`log NOTED\` / \`log RULED\` (Amendment 13(b))." 2 ;;
-  esac
-  ROW_STATE="${rst_in%% · *}"
-  ROW_STATE_LINE="${rst_in#* · }"
-  state_word_is_valid "$ROW_STATE" ||
-    die "'$ROW_STATE' is not one of Amendment 13(a)'s states ($ROW_STATES). The cell is the lane's CURRENT STATE and nothing else, so an eighth word is a state no reader of Rule 6 or of the listing knows." 2
-  [ -n "$ROW_STATE_LINE" ] ||
-    die "the phrase is '<STATE> · <one line>' and the line is empty: say what the last act was. A state with no line is a cell a person cannot read anything out of." 2
-  case "$ROW_STATE_LINE" in
-    *' · '*) die "the line may not contain ' · ': that separator is what divides the cell's three parts — '<STATE> · <UTC> · <one line>' — and a second one inside the line reads back as a fourth part. Use a semicolon: '$ROW_STATE_LINE'" 2 ;;
-    *'|'*)   die "the line may not contain '|': it would forge a cell boundary in the row, which is the one edit no reader of the register could recover from. Got: '$ROW_STATE_LINE'" 2 ;;
-  esac
-  if [ "${ROW_STATE_LINE//[$'\n\r']/}" != "$ROW_STATE_LINE" ]; then
-    die "the line is ONE line: a newline in it would split the row in two and every row after it would be read as a lane" 2
-  fi
-  # THE MARKER'S VOCABULARY IS NOT A LEGACY WRITER'S TO WRITE (ruling
-  # 2026-10-04). The projection reader matches it anywhere in a row, so a
-  # phrase carrying it would make this lane read as managed, or as UNKNOWN.
-  if managed_projection_hint "$rst_in"; then
-    die "the phrase carries managed-owner vocabulary ('managed owner', 'managed binding', 'mode=managed' or 'managed:'), and only the managed ledger's own writer writes a managed-owner marker, and a legacy writer that wrote its vocabulary into a row would forge that lane's ownership (ruling 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\"). Reword it: '$rst_in'" 2
-  fi
-  # ${#s} COUNTS CHARACTERS and the cap is O1's 240 of them — these lines are
-  # full of `·`, `—` and `→`, so a byte count would refuse a line that is inside
-  # the cap and accept one that is not.
-  [ "${#ROW_STATE_LINE}" -le "$ROW_STATE_CAP" ] ||
-    die "the line is ${#ROW_STATE_LINE} characters and the cap is $ROW_STATE_CAP (Amendment 13, ratified decision O1). Shorten it, and put what will not fit in the lane's own log, which is where the history lives: LANES_LANE=<lane> lanes-edit.sh log NOTED lane:<lane> \"<what happened>\"" 2
-  return 0
-}
-
-# Prints the row's OWN spelling of a lane name that matches $1 ignoring case,
-# when exactly one row does. Attribution only — never used to pick the line an
-# edit rewrites, which stays exact-match. Rule 10's wire form is lowercase
-# (`Lane: openxfactory-2`) while the row's token may be camel (`openXfactory-2`),
-# so an exact lookup alone loses the author of a Rule 6 line.
-row_lane_ci() {
-  awk -v want="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      t = substr(rest, 1, p2 - 1)
-      if (tolower(t) == tolower(want)) { n++; hit = t }
-    }
-    END { if (n == 1) print hit }' "$LANES_FILE"
-}
-
-# A Rule 6 line names its own lane in its text — "LANDING — lane <name>, …",
-# "LANDED — lane <name> (<Window>), …". `append-line` takes no lane argument,
-# so with LANES_LANE unset it used to commit as LANES(unknown@<ws>) and the
-# line's author was lost from the log (this predates Amendment 5: the same
-# `${LANES_LANE:-unknown}` is in the pre-move script). Read the name out of
-# the text instead, and fall back to unknown only when there is nothing to
-# read. Anything outside [A-Za-z0-9._-] is rejected rather than sanitised,
-# and the caller checks the candidate against the register's own rows before
-# trusting it — "…names no lane at all" must not be attributed to a lane
-# called "at".
-lane_from_text() {
-  t="$1"; l=""
-  case "$t" in
-    *"lane "*)
-      l="${t#*lane }"
-      l="${l%%[ ,;:)]*}"
-      l="${l//\`/}"
-      ;;
-  esac
-  case "$l" in
-    "" | *[!A-Za-z0-9._-]*) printf '' ;;
-    *) printf '%s' "$l" ;;
-  esac
-}
-
-# --------------------------------------------------------------- file writes
-
-# THE REGISTER IS REWRITTEN IN TWO PLACES, `replace_line` AND `delete_lines`,
-# AND BOTH PROVE WHAT THEY COPIED AND WHAT LANDED (opensoft/openRepoTools#120
-# item 1, Copilot round 5 on #93). The appends below them prove their result
-# with `cmp`; the rewrites proved only the file they built, and two steps of
-# theirs were never checked at all:
-#
-#   * THE COPY. Every proof of a rewrite (the line count, `numstat`, the no-op)
-#     is made against `$pre`, a `cat` of the register into a temporary file, and
-#     that `cat` had no status. A copy that came out short (a full temporary
-#     filesystem, a read that failed part-way) made a SHORT register look like a
-#     one-line edit of itself: every proof passed and the short copy was written
-#     back as the register and committed. Measured at 5e88a2c with the copy cut
-#     at half its lines: a 156,611-byte register rewritten as 78,306, exit 0.
-#   * THE WRITE. `cat -- <out> > LANES.md` had its status read and not its
-#     result, and `>` TRUNCATES before `cat` writes a byte. A write that failed
-#     part-way left a half register behind a refusal that called it UNCHANGED,
-#     and one that came out short and said nothing was a half register
-#     committed. Even an uncommitted half register is one write from being
-#     published: the next writer in this checkout commits a dirty register as a
-#     peer's pre-existing edit (`handle_preexisting`).
-#
-# So the copy is compared with the register and the result with what was built.
-# Where the result is not what was built, the copy's bytes are put back and
-# proved before the refusal (5) says which of the two the register now holds.
-# Both still write through `cat` and a redirection, which FOLLOW a symlinked
-# register; a rename beside it would replace the link with a file.
-#
-# A REFUSAL SAYS WHAT IS ALREADY ON DISK (the review of #263, S2). The sweeps
-# write their logs, their archive and their earlier rows before a row's
-# rewrite, so a refusal that said "Nothing was written" was false there: `git
-# status` showed those files, and a re-run read them back. What holds is that
-# THIS ACT has committed nothing — not "nothing has been committed": a peer's
-# uncommitted register edit found first is captured as a commit of its own
-# (`handle_preexisting`) before the act's edit, and the one caller that HAS
-# committed when it rewrites (add-row's after-rebase take-back) says so through
-# `REG_COMMITTED_HERE` (the delta review of #263). Each sweep names its local
-# writes with `reg_wrote`, which the refusals list. AND WHERE THE REGISTER MAY
-# BE TRUNCATED the copy is KEPT (S2's NIT 6): it is the only exact copy of the
-# register as it was, uncommitted edits included, and the exit trap removes
-# `$TMPD`. So it is copied into the checkout's own git directory — mode 0600,
-# under a name nothing else holds, proved byte for byte — where a restart that
-# empties the temporary directory leaves it; only where that cannot be done is
-# it renamed beside `$TMPD` instead (a rename needs no free space).
-REG_WRITTEN_HERE=""
-REG_COMMITTED_HERE=""
-DL_SAYS_UNCHANGED=""
-DL_SAYS_AFTER_WRITE=""
-reg_wrote() {   # <what this act has written in this checkout, not committed>
-  REG_WRITTEN_HERE="$REG_WRITTEN_HERE, $1"
-}
-reg_committed() {   # — what this act has committed, as a refusal says it
-  printf '%s' "${REG_COMMITTED_HERE:-this act has committed nothing}"
-}
-reg_written_here() {   # — the sentence a refusal ends with, or nothing
-  [ -n "$REG_WRITTEN_HERE" ] || return 0
-  printf ' This act has already written, in this checkout and NOT committed: %s. `git -C %s status` shows them; commit or undo them before re-running.' \
-    "${REG_WRITTEN_HERE#, }" "$LANES_REPO"
-}
-register_copy() {   # <copy> <what the refusal leaves as it was>
-  cat -- "$LANES_FILE" > "$1" && cmp -s -- "$LANES_FILE" "$1" ||
-    die "the register at $LANES_FILE could not be copied whole to $1, and every proof of this edit is made against that copy: a short one would make a short register look like a one-line edit of itself. The register is as it was and $(reg_committed): $2.$(reg_written_here)" 5
-}
-register_rewrite() {   # <the copy> <what the register becomes> <what else the refusal says>
-  cat -- "$2" > "$LANES_FILE" && cmp -s -- "$LANES_FILE" "$2" && return 0
-  if cmp -s -- "$LANES_FILE" "$1"; then
-    die "could not write the rewritten register $LANES_FILE: the write did not reach it, and it is byte for byte as it was before this edit. $3$(reg_written_here)" 5
-  fi
-  if cat -- "$1" > "$LANES_FILE" && cmp -s -- "$LANES_FILE" "$1"; then
-    die "the rewritten register $LANES_FILE did not land as it was written: the write cut it short, and its earlier bytes have been put back and proved. $3$(reg_written_here)" 5
-  fi
-  rgw_keep=""; rgw_where=""
-  rgw_git="$(git -C "$LANES_REPO" rev-parse --absolute-git-dir 2>/dev/null)" || rgw_git=""
-  if [ -n "$rgw_git" ] && [ -d "$rgw_git" ]; then
-    rgw_to="$rgw_git/lanes-edit-register-before-edit.$(date -u +%Y%m%dT%H%M%SZ).$$"
-    if [ ! -e "$rgw_to" ] && [ ! -L "$rgw_to" ]; then
-      if ( umask 077 && set -C && cat -- "$1" > "$rgw_to" ) 2>/dev/null && cmp -s -- "$1" "$rgw_to"; then
-        rgw_keep="$rgw_to"
-      else
-        rm -f -- "$rgw_to" 2>/dev/null || :
-      fi
-    fi
-  fi
-  if [ -z "$rgw_keep" ]; then
-    rgw_to="${1%/*}.register-before-edit"
-    if [ ! -e "$rgw_to" ] && [ ! -L "$rgw_to" ] && chmod 600 -- "$1" 2>/dev/null && mv -- "$1" "$rgw_to" 2>/dev/null; then
-      rgw_keep="$rgw_to"
-      rgw_where=" That is the temporary directory, because the checkout's git directory could not take the copy: a restart that empties it loses them, so restore them first."
-    fi
-  fi
-  if [ -n "$rgw_keep" ]; then
-    rgw_copy="Its exact bytes from before this edit, with any uncommitted edit they held, are kept in $rgw_keep (mode 0600; \`cat -- $rgw_keep > $LANES_FILE\` puts them back, and \`git -C $LANES_REPO diff -- $LANES_PATH\` shows what it lost meanwhile); \`git checkout\` would bring back only its last commit and drop any uncommitted edit.$rgw_where"
-  else
-    rgw_copy="Its bytes from before this edit could not be kept either: \`git -C $LANES_REPO diff -- $LANES_PATH\` shows what it lost, and \`git -C $LANES_REPO checkout -- $LANES_PATH\` brings back its last commit, dropping any uncommitted edit it held."
-  fi
-  die "could not write the rewritten register $LANES_FILE, and the bytes it had before this edit could not be put back either: IT MAY NOW BE TRUNCATED. Restore it before any other write in $LANES_REPO, because the next one would commit it as a pre-existing edit. $rgw_copy $3$(reg_written_here)" 5
-}
-
-# Replace line N with $2, leaving every other byte untouched. Verified with
-# `git diff --no-index --numstat` (must be exactly 1 added / 1 deleted).
-replace_line() {
-  n="$1"; newline="$2"
-  # 1 where the line was already exactly what was asked for and nothing was
-  # written. A caller that prints what it did reads this rather than announcing
-  # a replacement that did not happen.
-  REPLACE_LINE_NOOP=0
-  TMPD="$(mktemp -d)"
-  pre="$TMPD/pre"; out="$TMPD/out"
-  register_copy "$pre" "its line $n is as it was and this edit is not made"
-  before="$(wc -l < "$pre" | tr -d ' ')"
-  {
-    [ "$n" -gt 1 ] && head -n "$((n - 1))" -- "$pre"
-    printf '%s\n' "$newline"
-    tail -n "+$((n + 1))" -- "$pre"
-  } > "$out"
-  after="$(wc -l < "$out" | tr -d ' ')"
-  [ "$before" = "$after" ] || die "line count changed ($before -> $after); refusing" 5
-  # A LINE THAT IS ALREADY EXACTLY WHAT WAS ASKED FOR IS A WRITE THAT IS DONE,
-  # AND NOT A PROOF THAT FAILED (measured 2026-09-16, `lanes-edit.sh`). The
-  # `numstat` below proves this edit touched ONE line by demanding `1 1` from
-  # `git diff --no-index` — and an edit that changes nothing produces NO OUTPUT
-  # AT ALL, so `$stat` came back empty, the equality was false, and the act
-  # died 5 with `numstat: none`. The guard read "nothing changed" as "more than
-  # one line changed", which are opposite facts.
-  #
-  # IT IS REACHED BY ORDINARY USE AND NOT BY A CONTRIVANCE. `set-row-state`
-  # writes `<STATE> · $(utc_now) · <line>` and `utc_now` is seconds, so two
-  # stamps of the SAME state phrase inside one second are byte-identical — two
-  # `lane-start --no-launch` runs of one lane in one window, which is exactly
-  # what `tests/test_lane_helpers.sh`'s Amendment 15 `--confirm` case does, and
-  # what made it fail about one run in two with `expected [0], got [5]`. On a
-  # workstation it is a lane stamped twice in a second being told its write was
-  # refused, when the register already says precisely what the caller asked for.
-  #
-  # THE CALLERS ARE SAFE WITH IT: nothing is written, so `commit_push` finds
-  # nothing staged and says so on its own line, and every one of the four
-  # callers (`set-row-state`, `append-session-id`, `replace-in-row` and
-  # `migrate-state-cells`) wanted the file to SAY something rather than to
-  # differ from what it said. Nor does it push: a write with nothing staged
-  # publishes nothing, whatever this shared checkout has queued ahead of
-  # origin; only `commit` does that, and only what its path filter passes (#194).
-  if cmp -s -- "$pre" "$out"; then
-    REPLACE_LINE_NOOP=1
-    note "line $n of $LANES_FILE is already exactly what this write asked for — nothing rewritten, and nothing to commit"
-    return 0
-  fi
-  stat="$(git --no-pager diff --no-index --numstat -- "$pre" "$out" 2>/dev/null | head -n1 | cut -f1,2)"
-  [ "$stat" = "$(printf '1\t1')" ] || die "edit touched more than one line (numstat: ${stat:-none}); refusing" 5
-  # THE WRITE IS CHECKED (Copilot round 3 on openRepoTools#81). `cat > file`
-  # here is the last act of every row edit in this file — `append-row-status`,
-  # `replace-in-row`, `append-session-id` and Amendment 16's `rename-lane` —
-  # and unchecked it returns 0 having written NOTHING when `LANES.md` is not
-  # writable: the two proofs above pass (they are made against a temporary
-  # file), the note says the line was rewritten, and the caller commits whatever
-  # else it changed. For a rename that is the alias landing while the row it
-  # points at never moves. AND ITS RESULT IS PROVED, not only its status, with
-  # the register put back where the write cut it short (#120 item 1, above).
-  register_rewrite "$pre" "$out" "Its line $n is not rewritten, and $(reg_committed)."
-  note "line $n rewritten in $LANES_FILE"
-}
-
-# LINES REMOVED AND NOTHING ELSE TOUCHED — `replace_line`'s proof, for the one
-# act that takes rows OUT of the register (Amendment 19(d): `archive-rows`
-# MOVES a repository's RETIRED rows to `lanes/archive/LANES-retired.md`). The
-# rows are appended to the archive FIRST and removed here second, so a refusal
-# between the two leaves the register whole and the archive holding a copy —
-# never the other way round, which would be the one order that loses a row.
-#
-# THE NUMBERS ARE THE PROOF: exactly N fewer lines, and `git diff --numstat`
-# showing N deleted and ZERO added. A deletion that also rewrote a line would
-# pass a line count and fail this.
-delete_lines() {   # <line numbers, one per line, any order>
-  dl_list="$1"
-  dl_n="$(printf '%s\n' "$dl_list" | grep -c . || :)"
-  [ "$dl_n" -gt 0 ] || return 0
-  TMPD="$(mktemp -d)"
-  dl_pre="$TMPD/pre"; dl_out="$TMPD/out"
-  # WHAT A REFUSAL HERE SAYS ABOUT THE ROWS IS THE CALLER'S (the delta review of
-  # #263, NIT). archive-rows' sentences are the default: its rows are already in
-  # the archive. add-row's take-back passes its own, because there the row is
-  # add-row's committed one and no archive is involved.
-  dl_unchanged="${DL_SAYS_UNCHANGED:-no row was removed, the rows are in $LANES_ARCH_PATH, and the register is whole}"
-  dl_after_write="${DL_SAYS_AFTER_WRITE:-The archive may have been appended locally, but $(reg_committed); resolve that partial move before retrying.}"
-  register_copy "$dl_pre" "$dl_unchanged"
-  # AND EVERY LATER REFUSAL HERE SAYS IT AS WELL (delta review 4 of #263, N1
-  # and S4's N2). The pass, the line count and `numstat` below refused with no
-  # word of what the act had committed: add-row's take-back, which HAS committed
-  # its row, died saying only "the removal added or rewrote lines" or "that row
-  # is still in it and in that commit", with no row and no commit named, and the
-  # next write published the row. Each now ends as `register_copy`'s refusal
-  # does: the register as it was, what this act has committed, the caller's
-  # sentence, and what the act has already written in this checkout.
-  dl_as_was="The register is as it was and $(reg_committed): $dl_unchanged.$(reg_written_here)"
-  dl_before="$(wc -l < "$dl_pre" | tr -d ' ')"
-  # `awk -v` CARRIES ONE LINE, AND THIS LIST IS MANY — the finding `who_landing`
-  # took in round 5 of A9 Addendum 4 (R-A9-11), re-made here and answered by
-  # `tests-macos` at `758a536` with six red lines and nothing saying why. A
-  # `-v name=value` is processed as if it were a STRING LITERAL, and a string
-  # literal cannot span lines: macOS's awk (one-true-awk) refuses it outright —
-  # `awk: newline in string … at source line 1`, exit 2, NO OUTPUT AT ALL —
-  # while gawk and mawk accept it silently, so no Linux job and no workstation
-  # here can see it. What it cost is exactly what it cost there: an empty
-  # `$dl_out`, a line count that fails its own proof, and `archive-rows --yes`
-  # dying 5 with the rows already in the archive and the register untouched.
-  # `ENVIRON` has no such restriction and is POSIX awk, so the list goes through
-  # the environment of this one command, which is the spelling `who_landing`
-  # settled on. Asserted on every platform by a shim that IS the one-true-awk
-  # rule (`tests/test_lane_helpers.sh`, the `repo19d` case).
-  #
-  # AND THE PASS IS READ WITH ITS OWN STATUS. An awk that failed writes an empty
-  # file, and an empty file is not "no rows matched" (Amendment 7(d)) — it is a
-  # read that failed, and it must say so rather than arrive at the line-count
-  # proof as a wrong number, which is the shape the macOS job had to be
-  # reverse-engineered from.
-  if ! LANES_DROP_LINES="$dl_list" awk '
-    BEGIN { k = split(ENVIRON["LANES_DROP_LINES"], a, "\n")
-            for (i = 1; i <= k; i++) if (a[i] != "") drop[a[i] + 0] = 1 }
-    !(NR in drop)' "$dl_pre" > "$dl_out"; then
-    die "the pass that removes $dl_n row(s) from $LANES_FILE failed, so what the register would become is not known — and that is not an empty register (Amendment 7(d)). $dl_as_was" 5
-  fi
-  dl_after="$(wc -l < "$dl_out" | tr -d ' ')"
-  [ "$dl_after" -eq "$((dl_before - dl_n))" ] ||
-    die "removing $dl_n row(s) changed the line count by $((dl_before - dl_after)); refusing. $dl_as_was" 5
-  # AND IT COUNTS LINES WHATEVER THE REGISTER'S SIZE (delta review 4 of #263,
-  # S4). Under a `core.bigFileThreshold` below the register's size git classes
-  # both copies as binary, and `numstat` prints a `-` for each count, which
-  # `--text` does not change: add-row's take-back refused there, and its row
-  # stayed committed for the next write to publish. A `-c` on the command line
-  # outranks every config file and `GIT_CONFIG_*` in the environment (measured
-  # on git 2.43). An attribute or a NUL byte that classes the copies as binary
-  # still makes this proof refuse, in the words above.
-  dl_stat="$(git --no-pager -c core.bigFileThreshold=2g diff --no-index --numstat -- "$dl_pre" "$dl_out" 2>/dev/null | head -n1 | cut -f1,2)"
-  [ "$dl_stat" = "$(printf '0\t%s' "$dl_n")" ] ||
-    die "the removal added or rewrote lines (numstat: ${dl_stat:-none}); refusing. $dl_as_was" 5
-  # The redirection follows the register symlink, but its status is still a
-  # write fence. An unwritable target must not let archive-rows commit the
-  # appended archive while the source rows remain in the register. And its
-  # RESULT is the fence as well, with the register put back where the write cut
-  # it short (#120 item 1, above `replace_line`).
-  register_rewrite "$dl_pre" "$dl_out" "$dl_after_write"
-  note "$dl_n row(s) removed from $LANES_FILE"
-}
-
-# $2 is the file to append to, defaulting to the register. Amendment 7's
-# per-lane object logs are appended with exactly the same proof — one line
-# more, not one existing byte different.
-append_text_line() {
-  newline="$1"; target="${2:-$LANES_FILE}"
-  # ONE LINE IS REFUSED A NEWLINE BEFORE IT IS WRITTEN, NOT PROVED ONE AFTER
-  # (opensoft/openRepoTools#85). The proofs below are made AFTER the `>>`, so a
-  # text carrying a newline was appended whole — two physical lines where one
-  # was meant — and only then refused: `append changed line count by 2`, exit
-  # 5, the file left modified and uncommitted. What came next was worse than
-  # the refusal. A dirty object log is refused by every later writer in that
-  # checkout; a dirty REGISTER is committed by the next one, as a peer's
-  # `pre-existing` edit (`handle_preexisting`) — measured in `lane-handoff`'s own
-  # flow, where the row flip right after the refused PAUSED line committed the
-  # two lines. A carriage return is refused with it: `wc -l` does not count one, so it
-  # passed the proof and put a line no reader splits the same way into a file
-  # nothing rewrites. `write_event` has refused both since R21; this is the
-  # same gate in the one function every append goes through, which is the
-  # reason this file gives for putting the container guard at the dispatcher:
-  # *"nine copies of one rule is how eight of them would come to disagree"*.
-  # FIRST, before the `mktemp` and the copy, so a refusal touches nothing.
-  if [ "${newline//[$'\n\r']/}" != "$newline" ]; then
-    die "an appended line is ONE line, and this text carries a newline or a carriage return: appended, it would put several lines into $target where one was meant, and the proof that only one was added fails after the write, not before it. Nothing was written. Spell the break '; ' and re-run." 2
-  fi
-  TMPD="$(mktemp -d)"
-  pre="$TMPD/pre"
-  cat -- "$target" > "$pre"
-  # `| tr -d ' '`, THE SPELLING `park:564` AND `status:746` ALREADY USE — and
-  # the one function that did not use it was the macOS job's LARGEST SINGLE
-  # CAUSE (A9 Addendum 4, R-A9-11). BSD `wc` right-aligns every count in a
-  # fixed-width field, so `wc -l < f` answers `"       5"` on macOS where GNU
-  # answers `"5"`, while `$((before_lines + 1))` is arithmetic and is never
-  # padded. `[ "       5" = "5" ]` is FALSE — so on BSD this refused EVERY
-  # append it was ever asked to make, and refused it HAVING ALREADY APPENDED:
-  # the `>>` on the line between them had run, so the `die` left the file
-  # modified and uncommitted, and then every later `lanes-edit.sh` in that
-  # checkout refused as well (`unstaged tracked change — so the race cannot be
-  # run safely here`, 48 times in the macOS transcript at `9000e86`). The
-  # message it died with read `append changed line count by 1`: the very
-  # equality the test above it had just denied, which is what a comparison of
-  # a padded string against an unpadded one looks like from the outside.
-  # Measured: transcript line 454 of the macOS job at `9000e86`. And
-  # reproduced on Linux under NOTHING BUT a `wc` that pads — the rest of the
-  # tree exactly as `d3d59b5` shipped it — for **575 passed, 423 failed**
-  # against that runner's own 560 / 438. Fifteen assertions apart, which is
-  # about what the second defect (a liveness `sleep` too short for a 900 s
-  # run, `tests/test_lane_helpers.sh:446`) has left to contribute once this
-  # one has already taken the checkout down with it.
-  before_lines="$(wc -l < "$pre" | tr -d ' ')"
-  printf '%s\n' "$newline" >> "$target"   # >> FOLLOWS the symlink
-  after_lines="$(wc -l < "$target" | tr -d ' ')"
-  # `-eq`, not `=`: these are NUMBERS, and saying so is what makes a second
-  # padded spelling arriving from anywhere unable to resurrect the defect.
-  [ "$after_lines" -eq "$((before_lines + 1))" ] || die "append changed line count by $((after_lines - before_lines)); inspect $target" 5
-  # THE WHOLE FILE REBUILT, and no `cmp -n`: the `-n <limit>` that reads
-  # "compare at most this many bytes" is GNU's, and BSD `cmp`'s trailing
-  # numbers are SKIPS, not a limit — so where GNU compared a prefix, BSD
-  # answers `illegal option -- n`, exits 2, and this proof becomes a REFUSAL
-  # of a write that was perfectly correct, dying 5 with the log line already
-  # on disk and uncommitted. What the file must now be is exactly its old
-  # bytes followed by the one new line, so that is what is built and compared:
-  # `cat`, `printf` and cmp's `-` operand are POSIX, no byte count is needed
-  # (`head -c 0` is an ERROR on BSD, which is what the first append to an
-  # empty log would have hit), and the claim is STRONGER than the old one —
-  # not merely that no existing byte moved, but that the line appended is the
-  # line that was asked for.
-  { cat -- "$pre"; printf '%s\n' "$newline"; } | cmp -s -- "$target" - ||
-    die "append rewrote existing bytes; inspect $target" 5
-  note "1 line appended to $target"
-}
-
-# ------------------------------------------------------------------ git side
-
-LANES_BRANCH="${LANES_BRANCH:-main}"
-
-# Bounded like every other network call (Amendment 8(h)). A timeout here is not
-# fatal: the callers already degrade to "no remote branch", which costs a fetch
-# that would have hung anyway.
-remote_has_branch() {
-  git_net -C "$LANES_REPO" ls-remote --exit-code --heads origin "$LANES_BRANCH" >/dev/null 2>&1 || {
-    [ "$GIT_TIMED_OUT" = 1 ] && note "ls-remote timed out after ${GIT_TIMEOUT}s — treating origin/$LANES_BRANCH as unreachable"
-    return 1
-  }
-  return 0
-}
-
-# Unstaged changes to TRACKED files OTHER than the register. New in Amendment
-# 5 and unavoidable: the register shares its checkout with handoffs/ and
-# workspaces/, which other lanes write. `git pull --rebase` refuses outright
-# on ANY unstaged tracked change, so without this the refusal would surface as
-# a bogus "REBASE CONFLICT" and the writer would be sent to a recovery that
-# does not apply. Prints the offending paths, one per line.
-dirty_elsewhere() {
-  git -C "$LANES_REPO" --no-pager diff --name-only 2>/dev/null \
-    | grep -v -x -F -- "$(printf '%s\n' "${CP_PATHS[@]}")" || :
-}
-
-# Every TRACKED file in this checkout that differs from HEAD — staged or not,
-# and whatever pathspec the caller happens to be writing. That is exactly the
-# set `git pull --rebase` refuses on. `git status --porcelain` reports the same
-# thing, with rename records and path quoting to parse first; these two
-# plumbing reads answer the same question unambiguously, and neither reports an
-# untracked file, which does not block a rebase.
-tracked_dirty() {
-  { git -C "$LANES_REPO" --no-pager diff --name-only 2>/dev/null
-    git -C "$LANES_REPO" --no-pager diff --name-only --cached 2>/dev/null
-  } | LC_ALL=C sort -u
-}
-
-# AMENDMENT 7 — `log`, `claim` and `release` REFUSE a checkout that cannot be
-# rebased. $1 names the act; every remaining argument is a pathspec THIS write
-# is about to append to and is therefore exempt.
-#
-# `lanes/LANES.md` is the one exemption that is not a pathspec of the write:
-# it is CAPTURED rather than refused, by capture_register_edit below, and the
-# guard is then re-run against the checkout that capture left behind. See
-# there for why (Addendum 3, R11).
-#
-# The guard is computed over the WHOLE checkout, and from the same set the
-# write will use, because the first version of it was not: `claim` measured
-# "dirty elsewhere" against (log + LANES.md) while a CLAIMED writes the log
-# alone, so a dirty `lanes/LANES.md` — the one dirty file this repository
-# actually has, at ~500 register commits a day — passed the guard and then took
-# commit_push's Amendment 5(d) branch, which skips `pull --rebase` and with it
-# the rescan that decides the race. Two lanes ended up holding one object with
-# no CLAIM-LOST. The guard and the write must never disagree about what this
-# invocation is writing.
-refuse_dirty_checkout() {
-  rd_what="$1"; shift
-  [ "$NO_GIT" = 1 ] && return 0
-  git -C "$LANES_REPO" rev-parse --git-dir >/dev/null 2>&1 || return 0
-  if [ "$#" -gt 0 ]; then
-    rd_others="$(tracked_dirty | grep -v -x -F -- "$(printf '%s\n' "$@")" || :)"
-  else
-    rd_others="$(tracked_dirty)"
-  fi
-  [ -n "$rd_others" ] || return 0
-  note "this checkout has uncommitted changes to tracked files that are not this $rd_what's:"
-  printf '  %s\n' $rd_others >&2
-  case "$rd_what" in
-    claim) note "a claim is decided by which CLAIMED lands on main first, and 'pull --rebase' refuses on any"
-           note "unstaged tracked change — so the race cannot be run safely here." ;;
-    *)     note "an object-log write is ordered against other lanes by landing on main, and 'pull --rebase'"
-           note "refuses on any unstaged tracked change — so this write cannot be ordered safely here." ;;
-  esac
-  note "RECOVERY — whoever wrote those files commits them:"
-  note "  lanes/LANES.md   LANES_LANE=<lane> lanes-edit.sh commit \"<what you wrote>\""
-  note "  anything else    git -C $LANES_REPO commit -m \"handoff(<lane>@<workstation>): <what>\" -- <path>"
-  note "then re-run the refused $rd_what: its own push publishes their commits with it (#194)."
-  die "refusing to $rd_what on a checkout that cannot be rebased" 2
-}
-
-# ------------------------------------------- AMENDMENT 8, ruling (h): THE
-# WRITER NEVER BLOCKS THE ESTATE.
-#
-# On 2026-09-12 at about 01:44Z an ssh `git-receive-pack` hung for five minutes
-# AFTER its push had already landed, and `lanes-edit.sh append-row-status` sat
-# inside it holding the mutex for the whole five minutes. Every lane on Eagle
-# that wanted to write a row waited behind a lock whose holder was blocked on a
-# socket, and the estate only moved again when the ssh was killed by hand.
-#
-# So every git call that touches the NETWORK — push, pull, fetch, ls-remote —
-# runs under a timeout, and a timeout is not a failure to retry: it is a
-# refusal to hold the mutex any longer. The helper aborts any rebase it started,
-# releases the lock, prints how to find out whether the push landed anyway, and
-# exits 3 with the edit safe in a local commit.
-#
-# `LANES_GIT_TIMEOUT` is the budget in seconds (default 60; 0 disables the
-# bound). `LANES_GIT` is the binary, so a test can hand these calls — and ONLY
-# these calls — a git that hangs, without shadowing git for the rest of the
-# script.
-GIT_TIMEOUT="${LANES_GIT_TIMEOUT:-60}"
-GIT_BIN="${LANES_GIT:-git}"
-GIT_TIMED_OUT=0
-git_net() {
-  GIT_TIMED_OUT=0
-  gn_rc=0
-  case "$GIT_TIMEOUT" in
-    ''|0|*[!0-9]*) "$GIT_BIN" "$@" || gn_rc=$? ;;
-    *)
-      if command -v timeout >/dev/null 2>&1; then
-        timeout -k 5 "$GIT_TIMEOUT" "$GIT_BIN" "$@" || gn_rc=$?
-        case "$gn_rc" in 124|137) GIT_TIMED_OUT=1 ;; esac
-      else
-        "$GIT_BIN" "$@" || gn_rc=$?
-      fi ;;
-  esac
-  return "$gn_rc"
-}
-
-# What a timed-out network call does. NEVER a retry: the point is to stop
-# holding the lock, and a second call to the same hung endpoint holds it twice
-# as long.
-git_timeout_die() {   # <the command, for the reader>
-  note "TIMED OUT after ${GIT_TIMEOUT}s: $1"
-  note "  Amendment 8(h): the writer does not hold the estate's mutex on a hung"
-  note "  network call. The lock is being released now, before this exits."
-  "$GIT_BIN" -C "$LANES_REPO" rebase --abort 2>/dev/null || :
-  note "  YOUR EDIT IS SAFE — it is already a local commit:"
-  "$GIT_BIN" -C "$LANES_REPO" --no-pager log --oneline "origin/$LANES_BRANCH..HEAD" 2>/dev/null | head -n 5 >&2 || :
-  note "  RECOVERY — a hung push often means it LANDED and the connection did not close,"
-  note "  so look before you push again:"
-  note "    git -C $LANES_REPO fetch origin $LANES_BRANCH && git -C $LANES_REPO log --oneline origin/$LANES_BRANCH -3"
-  note "    git -C $LANES_REPO push origin $LANES_BRANCH      # only if it is not there"
-  release_lock
-  die "timed out after ${GIT_TIMEOUT}s on '$1' — the mutex is released and your commit is local; nothing was lost." 3
-}
-
-# BYTECODE NEVER RIDES A WORKSPACE COMMIT (opensoft/openRepoTools#162, cause
-# 19: a handoff's attachments were committed with a whole virtualenv's
-# `__pycache__` inside them, and the workspace repository carries them for
-# ever). What `git add` WOULD stage for a pathspec is asked of git itself
-# (`add --dry-run`, which honours `.gitignore` exactly as the real add does),
-# and every path in that answer with a cache, bytecode or environment
-# component is printed. Empty means the pathspec is clean.
-# ONE PER LINE AND READ WITH `read`, never word-split: `*.pyc` unquoted is a
-# glob, and the shell would expand it against whatever directory this runs in.
-BYTECODE_IGNORES='__pycache__/
-*.pyc
-*.pyo
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-node_modules/
-.venv/
-venv/
-site-packages/'
-bytecode_in_pathspec() {   # <repo> <pathspec>...   0 read (the paths printed) · 3 a read FAILED
-  bip_repo="${1-}"; shift || :
-  [ "$#" -gt 0 ] || return 0
-  # WHAT THE ADD WOULD STAGE, AND WHAT IS STAGED ALREADY: `add --dry-run` says
-  # nothing of a path the index already holds at these bytes, and the commit
-  # takes it all the same. A staged DELETION of bytecode is a cleanup and is
-  # let through (`--diff-filter=d`).
-  #
-  # A READ THAT FAILED IS NO "CLEAN" (#170 G13): a malformed magic pathspec, or
-  # an index git cannot read, made both reads exit 128 with their stderr thrown
-  # away and printed nothing, and the check passed. Each status is kept now.
-  # `add --dry-run`'s 1 is the one answer that is not a failure: it means some
-  # NAMED path is ignored, which the add would not stage.
-  #
-  # BOTH READS IN THE C LOCALE AND UNQUOTED (#170 E1, E2): the `add '<path>'`
-  # lines are parsed, and a translated git words them otherwise; and `diff
-  # --name-only` C-quotes a path that is not ASCII (`"caf\303\251.pyc"`), whose
-  # closing quote hid the `.pyc` - so a staged non-ASCII bytecode file passed.
-  # `core.quotePath=false` leaves such a path as its bytes; one git still
-  # quotes (a control character, a `"` or a `\`) has its quotes taken off
-  # before it is judged.
-  bip_add=""; bip_rc=0
-  bip_add="$(LC_ALL=C git -C "$bip_repo" -c core.quotePath=false add --dry-run --ignore-missing -- "$@" 2>/dev/null)" || bip_rc=$?
-  [ "$bip_rc" -le 1 ] || return 3
-  bip_staged=""
-  bip_staged="$(LC_ALL=C git -C "$bip_repo" -c core.quotePath=false diff --cached --name-only --diff-filter=d -- "$@" 2>/dev/null)" || return 3
-  {
-    printf '%s\n' "$bip_add" | LC_ALL=C sed -n "s/^add '\(.*\)'\$/\1/p"
-    printf '%s\n' "$bip_staged"
-  } |
-    LC_ALL=C awk '{ if ($0 ~ /^".*"$/) $0 = substr($0, 2, length($0) - 2) }
-      !seen[$0]++ {
-      n = split($0, part, "/"); hit = 0
-      for (i = 1; i <= n; i++)
-        if (part[i] == "__pycache__" || part[i] == ".pytest_cache" ||
-            part[i] == ".mypy_cache" || part[i] == ".ruff_cache" ||
-            part[i] == "node_modules" || part[i] == ".venv" ||
-            part[i] == "venv" || part[i] == "site-packages") hit = 1
-      if ($0 ~ /\.py[co]$/) hit = 1
-      if (hit) print }'
-}
-
-# The refusal's words, and the OFFER beside them: the ignore lines the
-# workspace's own `.gitignore` lacks, with the one command that adds them.
-# `openRepoTools wip init` seeds them into a new workspace; an older one is
-# offered them here, where they are missing.
-bytecode_refusal_text() {   # <the offending paths, one per line>
-  brt_n="$(printf '%s\n' "${1-}" | awk 'NF { n++ } END { print n + 0 }')"
-  brt_missing=""
-  while IFS= read -r brt_l; do
-    [ -n "$brt_l" ] || continue
-    command grep -Fqx -- "$brt_l" "$LANES_REPO/.gitignore" 2>/dev/null ||
-      brt_missing="$brt_missing '$brt_l'"
-  done <<BRT_EOF
-$BYTECODE_IGNORES
-BRT_EOF
-  printf '%s path(s) of this commit are bytecode, a cache, a dependency tree or a virtual environment, and none of them is ever a workspace repository'"'"'s (opensoft/openRepoTools#162):\n%s\n' \
-    "$brt_n" "$(printf '%s\n' "${1-}" | head -n 10 | sed 's/^/    /')"
-  if [ -n "$brt_missing" ]; then
-    # THE PATH IS QUOTED FOR THE SHELL (#170 G4): the command is offered to be
-    # pasted, and a workspace path with a space in it split the redirect.
-    brt_target="$(printf '%q' "$LANES_REPO/.gitignore")"
-    printf 'This workspace'"'"'s .gitignore lacks%s; add them and they are never staged again:\n    printf '"'"'%%s\\n'"'"'%s >> %s\n' \
-      "$brt_missing" "$brt_missing" "$brt_target"
-  fi
-  printf 'Nothing was staged or committed. Unstage or delete those paths, then re-run.'
-}
-
-# #194, AS #214's ADVERSARIAL CHECK HARDENED IT — WHAT `commit` MAY PUBLISH
-# WITH NOTHING STAGED, read from the objects the push will send and nothing
-# else. Three ordinary checkout states got a deletion past the first fence,
-# which read `git log --name-status origin/<b>..HEAD`:
-#
-#   * A MERGE's own changes: `log` prints no diff for a merge, so a deletion
-#     made while resolving one passed unread. A merge or root commit refuses.
-#   * HEAD ON ANOTHER BRANCH: the fence read HEAD and the push sent
-#     `refs/heads/<b>`. The range is the branch, and HEAD must be it, because
-#     `pull --rebase` moves HEAD and the push moves the branch.
-#   * A LOCAL BRANCH NAMED `origin/<b>`, which shadows the tracking ref. Both
-#     ends of the range are spelled in full.
-#
-# The reads are plumbing (`rev-list`, `diff-tree --raw`), which no `color.*` or
-# `diff.ignoreSubmodules` reshapes, under `--no-replace-objects`, so a replace
-# ref cannot show the fence one commit while the push sends another. A change
-# passes only as an ADDED or MODIFIED REGULAR FILE under the register's own
-# directory (`$LANES_PREFIX`, derived, as every path of the register's is) or
-# `handoffs/`, and never as bytecode, a cache or an environment (#162's list).
-# A deletion, a type change, a symlink or a gitlink refuses, and so does a path
-# anywhere else. IT IS A PATH AND KIND FILTER: it vouches for where a change
-# lands and what it is, never for whose it is (it reads no subject, author or
-# trailer), so another lane's register write passes it. That includes lane
-# tooling's own lane rename,
-# which deletes a log to re-add it: a deletion is the one change origin cannot
-# get back, and the fence keeps one rule for it. A read or a classification
-# that fails refuses too (2), because it proves nothing.
-#
-# Two guards have a test each (lane openRepoShape-2's SHOULD 4). `--no-renames`
-# reads a rename as the deletion it is: read as an `R` line, the refusal would
-# name a rename and not the path origin loses. And the register's directories
-# are matched with their trailing `/`, so `lanes-archive/` beside `lanes/` is
-# not inside it.
-#
-# It leaves CP_FENCE_TIP at the commit it read and CP_FENCE_AHEAD at how many
-# it read, and the publish pushes exactly that commit (`<sha>:refs/heads/<b>`).
-# A commit another lane makes in this shared checkout between the read and the
-# push stays local.
-cp_publish_fence() {
-  cpf_ref="refs/heads/$LANES_BRANCH"
-  cpf_head="$(git -C "$LANES_REPO" symbolic-ref -q HEAD 2>/dev/null || :)"
-  [ "$cpf_head" = "$cpf_ref" ] || die "refusing to publish: HEAD is ${cpf_head:-detached}, not $cpf_ref, and the push sends $cpf_ref while \`pull --rebase\` moves HEAD, so what would be published is not what HEAD shows, and nothing was pushed (#194). Whoever moved this shared checkout off $LANES_BRANCH puts it back; never reset or check out over their work." 2
-  cpf_rc=0
-  cpf_base="$(git --no-replace-objects -C "$LANES_REPO" rev-parse -q --verify "refs/remotes/origin/$LANES_BRANCH^{commit}")" || cpf_rc=$?
-  cpf_tip="$(git --no-replace-objects -C "$LANES_REPO" rev-parse -q --verify "$cpf_ref^{commit}")" || cpf_rc=$?
-  cpf_revs="$(git --no-replace-objects -C "$LANES_REPO" rev-list --parents "$cpf_base..$cpf_tip")" || cpf_rc=$?
-  cpf_odd="$(printf '%s\n' "$cpf_revs" | awk 'NF > 0 && NF != 2 { printf "  %s %s\n", substr($1, 1, 12), (NF > 2 ? "is a merge commit" : "is a root commit") }')" || cpf_rc=$?
-  cpf_pairs="$(printf '%s\n' "$cpf_revs" | awk 'NF == 2')" || cpf_rc=$?
-  # `diff-tree --stdin` SKIPS A COMMIT IT CANNOT READ and still exits 0, and
-  # prints no header for an empty diff unless told `--always`: so every commit
-  # handed to it must come back as a header, or the read refuses.
-  cpf_raw=""; cpf_n=0
-  if [ -n "$cpf_pairs" ]; then
-    cpf_n="$(printf '%s\n' "$cpf_pairs" | awk 'END { print NR }')" || cpf_rc=$?
-    cpf_raw="$(printf '%s\n' "$cpf_pairs" | git --no-replace-objects -C "$LANES_REPO" -c core.quotePath=false diff-tree --stdin --always -r --no-renames --raw --ignore-submodules=none)" || cpf_rc=$?
-  fi
-  cpf_reg="${LANES_PREFIX:+${LANES_PREFIX%/}/}"; cpf_logp="${LANES_LOG_PREFIX:+${LANES_LOG_PREFIX%/}/}"
-  cpf_bad="$(printf '%s\n' "$cpf_raw" | awk -F '\t' -v want="$cpf_n" -v reg="$cpf_reg" -v logp="$cpf_logp" \
-      -v reg_path="$LANES_PATH" -v alias_path="$LANES_ALIASES_PATH" '
-    function inside(p) {
-      return (reg != "" && index(p, reg) == 1) || (logp != "" && index(p, logp) == 1) ||
-             index(p, "handoffs/") == 1 || p == reg_path || p == alias_path
-    }
-    function bytecode(p,   n, part, i) {
-      if (p ~ /\.py[co]$/) return 1
-      n = split(p, part, "/")
-      for (i = 1; i <= n; i++)
-        if (part[i] == "__pycache__" || part[i] == ".pytest_cache" || part[i] == ".mypy_cache" ||
-            part[i] == ".ruff_cache" || part[i] == "node_modules" || part[i] == ".venv" ||
-            part[i] == "venv" || part[i] == "site-packages") return 1
-      return 0
-    }
-    NF == 0 { next }
-    NF == 1 && $1 ~ /^[0-9a-f]+$/ { c = substr($1, 1, 12); seen++; next }
-    { split($1, f, " "); st = f[5]; mode = f[2]
-      if (!(NF == 2 && (st == "A" || st == "M") && (mode == "100644" || mode == "100755") && inside($2) && !bytecode($2)))
-        printf "  %s %s %s %s\n", c, st, mode, $2 }
-    END { if (seen != want) exit 3 }')" || cpf_rc=$?
-  [ "$cpf_rc" = 0 ] || die "git could not read, or this helper could not classify, the local commits on $cpf_ref ahead of refs/remotes/origin/$LANES_BRANCH, so whether they are \`commit\`'s to publish is unknown; nothing was pushed (#194)" 2
-  if [ -n "$cpf_odd$cpf_bad" ]; then
-    note "of the local commits on $cpf_ref ahead of origin/$LANES_BRANCH, these are not register or handoff writes (a merge or root commit, or a change that is not an added or modified regular file under ${LANES_PREFIX:-the register directory} or handoffs/):"
-    [ -z "$cpf_odd" ] || printf '%s\n' "$cpf_odd" >&2
-    [ -z "$cpf_bad" ] || printf '%s\n' "$cpf_bad" >&2
-    die "refusing to publish: \`commit\` pushes only register and handoff writes (#194), so nothing was pushed. A lane rename (Amendment 16) deletes and re-adds its log and is refused here too; the next register write from this checkout carries it. Anything else, whoever queued it publishes it; never reset it away. Read them: git -C $LANES_REPO log --stat refs/remotes/origin/$LANES_BRANCH..$cpf_ref" 2
-  fi
-  CP_FENCE_TIP="$cpf_tip"
-  CP_FENCE_AHEAD="$cpf_n"
-}
-
-# The publish's CP_AFTER_REBASE: `pull --rebase` has rewritten the queue onto
-# what origin holds now, and may have taken in a commit made since the first
-# read, so the fence reads it again and the push is pinned to what it read.
-# THE PULL CAN EMPTY THE QUEUE (lane openRepoShape-2, #214 6243280936): origin
-# may hold every queued commit already, by content under other shas, because
-# another workstation made the same edit or a peer's write carried it. The
-# rebase drops each one, and a push would send origin its own tip and print
-# "pushed". So the publish ends here, exit 0, as the no-op it now is, and it
-# says so. Only `commit` installs this hook, and this commit_push is its last
-# act, so the exit is that return.
-cp_publish_refence() {
-  cp_publish_fence
-  if [ "$CP_FENCE_AHEAD" = 0 ]; then
-    note "origin/${LANES_BRANCH} already holds every commit this publish listed: \`pull --rebase\` found each one there by content and dropped it, so none is left to push and no push was sent (#194)"
-    exit 0
-  fi
-  CP_PUSH_SPEC="$CP_FENCE_TIP:refs/heads/$LANES_BRANCH"
-}
-
-# commit_push "<subject>" [<pathspec>...] — the pathspecs default to the
-# register alone, which is every caller that predates Amendment 7. A LANDING
-# or LANDED writes TWO (the register and the lane's log) so that both halves
-# of one act land in one commit and no reader ever sees half of it.
-# AMENDMENT 15 — A CASE-ONLY RENAME IS STAGED IN THE INDEX AND COMMITTED FROM
-# IT, because a PATH-LIMITED commit cannot record one at all on a
-# case-INSENSITIVE filesystem — which is what this repository's macOS job runs
-# on. `ensure_log` renames a lane's log to the register row's spelling and
-# hands the OLD path in beside the new one. Three things are true there, and
-# together they leave exactly one way through:
-#
-#   * `git add -- <old> <new>` under git's own `core.ignorecase=true` matches
-#     both pathspecs to the ONE index entry and stages a MODIFICATION under the
-#     old name, so the rename never reaches the commit. Measured on the macOS
-#     job of openRepoTools#41 at `48f2111`: fifteen red assertions, the first
-#     of them *"the rename landed in the WRITE's own commit"*, whose
-#     `git log -- <the canonical path>` came back EMPTY.
-#   * The same `add` under `core.ignorecase=false` is no better, and is worse:
-#     the OPERATING SYSTEM still resolves `lanes/log/repocase-1.md` to the file
-#     now named `repoCase-1.md`, so git stages the old entry as MODIFIED and
-#     the new path as a SECOND entry. One file on disk, two paths in the tree —
-#     and every checkout after it reports the one it cannot materialise as
-#     deleted, so the writes behind it are refused (2) for a dirty checkout
-#     they did not make. Measured at `e35f2a8` and `928908a`: eleven red
-#     assertions, all of them behind `lanes/log/repocase-1.md` reported dirty.
-#   * `git commit -- <paths>` is `--only`: it builds the tree from HEAD and the
-#     WORKING TREE of those paths, disregarding what is staged. So an index
-#     that holds the rename exactly is thrown away by the commit anyway, and
-#     the old path — which the OS still resolves — comes back in the tree.
-#
-# So the old entry is dropped from the INDEX by its exact path, where no
-# filesystem is consulted at all; the NEW path alone is added; and the commit
-# is made from the index rather than from a pathspec.
-# `update-index --force-remove` is the one git verb that removes an entry
-# without asking the filesystem whether the file is still there, and it is a
-# no-op on a path the index does not hold — so a log that was never committed
-# renames just as quietly. The index commit is FAIL-CLOSED: anything staged
-# that is not one of this write's own pathspecs refuses (6) instead of riding
-# along, which is the guarantee the `--only` pathspec was there to give.
-#
-# `-c core.ignorecase=false` stays on every call that takes `CP_PATHS`, because
-# a pathspec that means one thing to `add` and another to `diff` is the same
-# defect one line along: with the old entry already gone it is what makes `add`
-# record the new path in the spelling the code computed rather than the one the
-# index used to hold. It narrows nothing else — these paths are this file's own,
-# `lanes/LANES.md` and `lanes/log/<lane>.md`, spelled by the code that computes
-# them.
-CP_EXACT="core.ignorecase=false"
-commit_push() {
-  msg="$1"; shift || :
-  if [ "$#" -gt 0 ]; then CP_PATHS=("$@"); else CP_PATHS=("$LANES_PATH"); fi
-  [ "$NO_GIT" = 1 ] && { note "LANES_NO_GIT=1 — not committing"; return 0; }
-  # THE OLD PATH IS A PATHSPEC FOR THE DIFFS AND NEVER FOR THE `add`: after the
-  # index entry is force-removed it matches neither the index nor a directory
-  # read that compares exactly, and `git add` FAILS on a pathspec that matches
-  # nothing at all.
-  cp_ren="${LOG_RENAMED_FROM:-}"
-  cp_add=(); cp_add_n=0
-  for cp_p in ${CP_PATHS[@]+"${CP_PATHS[@]}"}; do
-    if [ -n "$cp_ren" ] && [ "$cp_p" = "$cp_ren" ]; then continue; fi
-    cp_add+=("$cp_p"); cp_add_n=$((cp_add_n + 1))
-  done
-  if [ -n "$cp_ren" ]; then
-    git -C "$LANES_REPO" -c "$CP_EXACT" update-index --force-remove -- "$cp_ren" \
-      || die "git update-index --force-remove $cp_ren failed — the log is already renamed on disk and git still holds the old path, so nothing was committed. Re-run; if it refuses again, \`git -C $LANES_REPO rm --cached -- $cp_ren\` is the same act by hand." 6
-  fi
-  if [ "$cp_add_n" -gt 0 ]; then
-    cp_brc=0
-    cp_byte="$(bytecode_in_pathspec "$LANES_REPO" ${cp_add[@]+"${cp_add[@]}"})" || cp_brc=$?
-    [ "$cp_brc" = 0 ] || die "git could not read what this commit would stage (a pathspec it cannot parse, or an index it cannot read), so whether it carries bytecode is unknown; nothing was staged or committed (opensoft/openRepoTools#170 G13)" 2
-    [ -z "$cp_byte" ] || die "$(bytecode_refusal_text "$cp_byte")" 2
-    git -C "$LANES_REPO" -c "$CP_EXACT" add -- ${cp_add[@]+"${cp_add[@]}"} || die "git add failed" 6
-  fi
-  # #194 — NOTHING STAGED IS NOT NOTHING TO PUBLISH, FOR `commit` ALONE. A
-  # write the push loop below could not get out (a peer's uncommitted file
-  # blocking the rebase, six rejected pushes) leaves its edit as a LOCAL commit,
-  # and the RECOVERY printed for it is to re-run `commit` once the way is clear.
-  # Returning here sent that re-run home with exit 0 and the commit still local.
-  # So `commit`, the one caller that sets CP_PUBLISH_AHEAD, still takes the push
-  # loop (its lock, the dirty-elsewhere guard, the retries) whenever the branch
-  # holds commits `origin/$LANES_BRANCH` does not, as of the last fetch; no such
-  # ref reads as none. Every other write with nothing to stage stays the no-op it
-  # always was and reaches no network: a repeated `set-row-state` must not turn
-  # into a push of whatever this SHARED checkout has queued (the #214 review
-  # measured exactly that deleting `scripts/link-estates` on origin).
-  #
-  # AND `commit` PUBLISHES ONLY REGISTER AND HANDOFF WRITES, and only what it read:
-  # `cp_publish_fence` (above) reads the queue on the branch the push sends and
-  # refuses the whole publish (2) for anything that is not a register or
-  # handoff write. The push is pinned to the commit the fence read, and every
-  # `pull --rebase` reads it again (CP_AFTER_REBASE) and re-pins it.
-  cp_publish=0
-  if git -C "$LANES_REPO" -c "$CP_EXACT" diff --cached --quiet -- "${CP_PATHS[@]}"; then
-    cp_ahead="$(git --no-replace-objects -C "$LANES_REPO" --no-pager log --oneline "refs/remotes/origin/$LANES_BRANCH..refs/heads/$LANES_BRANCH" 2>/dev/null || :)"
-    if [ -z "$cp_ahead" ]; then
-      note "nothing staged for ${CP_PATHS[*]} — no commit made"
-      return 0
-    fi
-    cp_n="$(printf '%s\n' "$cp_ahead" | awk 'END { print NR }')"
-    if [ "$CP_PUBLISH_AHEAD" != 1 ]; then
-      note "nothing staged for ${CP_PATHS[*]} — no commit made; the $cp_n local commit(s) ahead of origin/$LANES_BRANCH stay local. \`lanes-edit.sh commit\` would publish all of them, so read \`git -C $LANES_REPO cherry -v origin/$LANES_BRANCH HEAD\` first: another lane's commits are its own to publish"
-      return 0
-    fi
-    cp_publish_fence
-    note "nothing staged for ${CP_PATHS[*]} — no commit made; pushing the $cp_n local commit(s) origin/$LANES_BRANCH does not have, up to ${CP_FENCE_TIP:0:12}:"
-    printf '%s\n' "$cp_ahead" | head -n 10 >&2 || :
-    [ "$cp_n" -le 10 ] || note "  … and $((cp_n - 10)) more"
-    CP_PUSH_SPEC="$CP_FENCE_TIP:refs/heads/$LANES_BRANCH"
-    CP_AFTER_REBASE=cp_publish_refence
-    cp_publish=1
-  fi
-  if [ "$cp_publish" = 1 ]; then
-    :   # nothing of this write's own to commit: straight on to the push
-  elif [ -n "$cp_ren" ]; then
-    cp_staged="$(git -C "$LANES_REPO" -c "$CP_EXACT" diff --cached --name-only)"
-    cp_extra=""
-    while IFS= read -r cp_s; do
-      [ -n "$cp_s" ] || continue
-      cp_known=0
-      for cp_p in ${CP_PATHS[@]+"${CP_PATHS[@]}"}; do
-        if [ "$cp_s" = "$cp_p" ]; then cp_known=1; fi
-      done
-      if [ "$cp_known" = 0 ]; then cp_extra="$cp_extra $cp_s"; fi
-    done <<EOF
-$cp_staged
-EOF
-    if [ -n "$cp_extra" ]; then
-      die "this commit carries a case-only rename of the lane's log, so it is made from the INDEX rather than from its pathspecs — and the index also holds$cp_extra, which is not this write's to commit. Stage-reset it — \`git -C $LANES_REPO restore --staged --\`$cp_extra — and re-run. Nothing was committed and the log is already renamed on disk." 6
-    fi
-    git -C "$LANES_REPO" -c "$CP_EXACT" commit -q -m "$msg" || die "git commit failed" 6
-    # THE RENAME IS DONE AND IN HEAD: the old path is no longer a pathspec of
-    # anything below, and the next `commit_push` of this run is not a rename.
-    CP_PATHS=(${cp_add[@]+"${cp_add[@]}"})
-    LOG_RENAMED_FROM=""
-  else
-    git -C "$LANES_REPO" -c "$CP_EXACT" commit -q -m "$msg" -- "${CP_PATHS[@]}" || die "git commit failed" 6
-  fi
-  [ "$cp_publish" = 1 ] || note "committed: $msg"
-  if ! remote_has_branch; then
-    if ! git_net -C "$LANES_REPO" push -q -u origin "$LANES_BRANCH"; then
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push -u origin $LANES_BRANCH"
-      die "initial push of '$LANES_BRANCH' failed" 6
-    fi
-    LANES_INDEX_NUDGE=1
-    note "pushed (created origin/$LANES_BRANCH)"
-    return 0
-  fi
-  attempt=1
-  while [ "$attempt" -le 6 ]; do
-    # A peer may have written LANES.md between our commit and this pull.
-    if ! git -C "$LANES_REPO" -c "$CP_EXACT" diff --quiet -- "${CP_PATHS[@]}"; then
-      cap="$(git -C "$LANES_REPO" -c "$CP_EXACT" --no-pager diff --numstat -- "${CP_PATHS[@]}" | cut -f1,2 | tr '\t' '/')"
-      git -C "$LANES_REPO" -c "$CP_EXACT" commit -q -m "LANES(concurrent@$WS): capture an uncommitted registry edit ($cap lines +/-) made by whoever else is writing right now — its author should follow up with a commit that says what it was" -- "${CP_PATHS[@]}" || :
-      note "captured a concurrent uncommitted edit ($cap lines +/-) as its own commit"
-    fi
-    others="$(dirty_elsewhere)"
-    if [ -n "$others" ]; then
-      # Someone else's uncommitted file in this shared checkout. Pulling is
-      # impossible until they commit it, and it is NOT ours to commit — a
-      # handoff mid-write is exactly the content Amendment 4(d) says its own
-      # author commits. So skip the pull and try the push: it succeeds unless
-      # the remote moved, and the register edit is already a local commit
-      # either way.
-      note "WARNING: this checkout has uncommitted changes to files OTHER than the register — not this invocation's:"
-      printf '  %s\n' $others >&2
-      note "skipping 'pull --rebase' (it refuses on any unstaged tracked change) and pushing straight out"
-      if git_net -C "$LANES_REPO" push -q origin "${CP_PUSH_SPEC:-$LANES_BRANCH}"; then
-        LANES_INDEX_NUDGE=1
-        note "pushed origin/$LANES_BRANCH (attempt $attempt, no pull — see the warning above)"
-        return 0
-      fi
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $LANES_BRANCH"
-      note "push rejected and the pull is blocked by the files above (attempt $attempt)"
-      if [ "$attempt" -ge 6 ]; then
-        note "RECOVERY: their author commits those files (a handoff: handoff(<lane>@<workstation>): <what>),"
-        note "  then re-run: LANES_LANE=<lane> lanes-edit.sh commit \"<what you wrote>\"  — your edit is already"
-        note "  a local commit here. If $LANES_PATH is clean, that re-run makes no commit of its own and"
-        note "  pushes the local commits this lists (#194), refusing (2) and pushing nothing unless every one"
-        note "  is a register or handoff write: git -C $LANES_REPO log --oneline origin/$LANES_BRANCH..HEAD"
-        die "could not push origin/$LANES_BRANCH: behind the remote, and a peer's uncommitted file blocks the rebase. Nothing was lost — your commit is local." 3
-      fi
-    elif git_net -C "$LANES_REPO" pull --rebase -q origin "$LANES_BRANCH"; then
-      # The rebase has just put this invocation's commit on top of whatever
-      # landed first. `claim` hooks in HERE, because that is the moment the
-      # race is decided: if a peer's claim is on this history, theirs landed.
-      if [ -n "${CP_AFTER_REBASE:-}" ]; then
-        "$CP_AFTER_REBASE" || return $?
-      fi
-      if git_net -C "$LANES_REPO" push -q origin "${CP_PUSH_SPEC:-$LANES_BRANCH}"; then
-        LANES_INDEX_NUDGE=1
-        note "pushed origin/$LANES_BRANCH (attempt $attempt)"
-        return 0
-      fi
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $LANES_BRANCH"
-      note "push raced (attempt $attempt) — retrying"
-    else
-      # A TIMED-OUT PULL IS NOT A CONFLICT. Read as one it would send the writer
-      # to a recovery that does not apply, and `rebase --abort` would be the
-      # only true line in it.
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git pull --rebase origin $LANES_BRANCH"
-      note "REBASE CONFLICT on origin/$LANES_BRANCH — conflicting lines follow:"
-      for cp in "${CP_PATHS[@]}"; do
-        grep -n -e '^<<<<<<<' -e '^=======' -e '^>>>>>>>' -- "$LANES_REPO/$cp" 2>/dev/null | head -n 40 >&2 || :
-        grep -n -A2 -e '^<<<<<<<' -- "$LANES_REPO/$cp" 2>/dev/null | head -n 40 >&2 || :
-      done
-      git -C "$LANES_REPO" rebase --abort 2>/dev/null || :
-      cp_sha="$(git -C "$LANES_REPO" rev-parse HEAD 2>/dev/null)"
-      note "rebase ABORTED — the worktree is clean and NOT mid-rebase. Your edit is safe in these local commits:"
-      git -C "$LANES_REPO" --no-pager log --oneline "origin/$LANES_BRANCH..HEAD" 2>/dev/null | head -n 10 >&2 || :
-      # #32 — AN ABORTED PULL IS NOT PROOF THIS COMMIT NEVER REACHED ORIGIN
-      # (the same rule RV-B3 took for the handoff stamp's own push, in
-      # lane-start). This checkout is shared with every lane on the
-      # workstation, so the very next write out of it pulls this dangling
-      # commit onto its own and pushes both together — three of the four
-      # "rebase conflict … nothing was pushed" lines seen on Eagle in one
-      # hour named a commit that was ALREADY on origin by the time anyone
-      # read them. LOOK before you reset or redo anything — by ANCESTRY
-      # (Copilot round 2 on #50, 5203033893): a log capped at a few entries
-      # can bury this commit below the window while it stays an ancestor, the
-      # moment four or more later writes land ahead of it.
-      # ROUND 3 (Copilot 5203261904): `fetch && merge-base ... && echo A ||
-      # echo B` is left-associative — a FAILED fetch also falls to the `||`
-      # and prints the SAME "not-there" a genuine non-ancestor does, so a
-      # stale or unreachable origin would silently wave the reset/redo path
-      # through. Fetch is now its own line, checked before anything else.
-      # ROUND 4 (Copilot 5203455553): SHA ancestry is the wrong test — the
-      # very write this whole recovery exists to catch (a peer's own
-      # `commit_push` pulling THIS dangling commit and rebasing it onto a
-      # newer base, per the very next branch above) gives it a NEW sha, so
-      # `merge-base --is-ancestor $cp_sha …` answers "not-there" even once
-      # the CONTENT is published. `git cherry` compares by PATCH, not by
-      # sha, so a rebase that only replays the same change (no real
-      # conflict) is still found. Measured against a real bare repo: a
-      # commit rebased by a peer this way answers `not-there` under
-      # `merge-base --is-ancestor` and `-` (found, equivalent) under
-      # `git cherry` — verified for the genuinely-absent case too (`+`) and
-      # the plain same-sha case (no output at all, which the `-c '^+'`
-      # count below also reads as zero, i.e. already there).
-      note "RECOVERY (in that order):"
-      note "  git -C $LANES_REPO fetch origin $LANES_BRANCH || echo FETCH-FAILED   # if that printed FETCH-FAILED, STOP and retry — a stale or unreachable origin proves nothing either way"
-      note "  git -C $LANES_REPO cherry origin/$LANES_BRANCH $cp_sha | grep -c '^+'   # BY CONTENT, not by sha: a peer's rebase changes the hash but git cherry still finds the same patch"
-      note "  if that printed 0, STOP — reset or redo now would write it a second time."
-      note "  git -C $LANES_REPO rev-parse HEAD   # if this is not $cp_sha, STOP: the checkout moved after this abort, and the lines below no longer describe it"
-      note "  git -C $LANES_REPO cherry -v origin/$LANES_BRANCH HEAD   # WHOSE: one '+' line per local commit origin lacks, which is what the reset below drops"
-      note "  if any '+' line is not your own write, STOP and take it to the lane its subject names; a LANES(concurrent@…) or"
-      note "  LANES(pre-existing@…) capture names no lane, so it is NOT yours. Never reset, stash or overwrite a peer's work:"
-      note "  the reset below drops EVERY '+' commit in this checkout, theirs with yours, and origin holds no copy of any of them (#194)."
-      note "  git -C $LANES_REPO diff origin/$LANES_BRANCH..HEAD -- ${CP_PATHS[*]}   # only if it is not there: read back exactly what you wrote"
-      note "  git -C $LANES_REPO reset --hard origin/$LANES_BRANCH                # only if every '+' line is yours: drop the local commits (NOTE: also drops any"
-      note "                                                          # uncommitted peer edit in this checkout)"
-      note "  then re-read LANES.md and redo the edit with lanes-edit.sh, on top of the peer's version."
-      die "rebase conflict on origin/$LANES_BRANCH — not pushed by this attempt; a later write from this checkout may already carry it, so look before you retry." 3
-    fi
-    attempt=$((attempt + 1))
-    sleep 3
-  done
-  die "could not push origin/$LANES_BRANCH after 6 attempts; your commit is local — retry later" 6
-}
-
-# ====================================================== AMENDMENT 14 =======
-#
-# THE DERIVED INDEX (lane-collision-protocol Amendment 14, ratified by Brett
-# Heap 2026-10-05, verbatim "ratify 48"). The register's truth stays where it
-# is; `lanes-index` keeps a DERIVED copy of it — SQLite on local disk, or QA
-# Postgres where a workstation is configured for it — written behind the
-# sources, read only by tooling that decides nothing, and never a gate.
-#
-# THIS FILE TOUCHES IT IN EXACTLY TWO PLACES, AND NEITHER IS ON AN ACT'S PATH.
-#
-#   THE NUDGE (clause (d)). After a push has LANDED and the mutex is released —
-#   `cleanup`, on the way out, once `commit_push` has recorded a push that went
-#   through — ONE DETACHED `lanes-index sync`: stdin closed, stdout and stderr
-#   on /dev/null, descriptors 3 to 9 closed, started from a subshell that
-#   exits at once so this process never has a child to wait for, and its
-#   status never read. It carries no data: the indexer reads `origin/<branch>`
-#   as the push left it, never takes this file's mutex, and a slow, failing or
-#   absent indexer delays and fails nothing here. `LANES_INDEX=off` skips it,
-#   and so does a workstation with no `lanes-index` ON PATH — PATH alone, not
-#   the file beside this one, because a sibling in a clone is not an
-#   installation and the suite runs this file thousands of times from one: the
-#   absent case is one `command -v` and prints nothing.
-#
-#   THE READ FLAG (clause (b)). `lanes ... --index` and `history ... --index`,
-#   and only when TYPED: `index_open` asks `lanes-index export` for the index's
-#   image of the register, and the eight PUBLISHED-READ primitives — the
-#   register, the archive, the alias table, the log list, a log's events, the
-#   events of them all — answer out of that image instead of `origin/<branch>`.
-#   Everything else the read does is unchanged, the LOCAL reads included (this
-#   checkout's own register and log files, this workstation's session records,
-#   tmux), which is what makes its answer byte-identical to the source read's
-#   where the index is current. Anything else — the indexer absent, the store
-#   missing, unreachable, wiped or of another schema, a configuration it
-#   refuses — is said in ONE line and the source read runs as it always did.
-#
-# NOTHING ELSE READS IT. No act, no hook, no guard, no writer and none of the
-# reads an act makes for itself (`who`, `binding`, `live-holder`, `next-free`,
-# `managed-projection`, `lane-reconcile`) has a path to `LANES_IDX_DIR`: it is
-# assigned empty at start-up whatever the environment says, and set only by
-# `index_open`, which only the two read arms call.
-#
-# THE INVENTORY'S NUDGE IS THE SAME ONE (opensoft/openRepoTools#161). The #97
-# inventory writers — `set-lane-state`, `set-lane-tree`, the lifecycle follow
-# `write_event` makes after a `STARTED`/`RESUMED`/`ENDED`/`RETIRED`, and the
-# rename that moves a lane's control root — write no commit and push nothing,
-# so they leave `LANES_INDEX_NUDGE_INV` instead, and the same detached fork is
-# made with `--source inventory`: the indexer reads this workstation's
-# sidecars as they now stand, through this file's own `worktrees` read. A write
-# that did both (a `STARTED` that landed and moved the snapshot) makes both
-# forks; `lanes-index` runs one sync at a time per workstation, and a second
-# that finds the lock held leaves the holder a mark naming its source.
-index_nudge() {
-  in_reg="${LANES_INDEX_NUDGE:-0}"; in_inv="${LANES_INDEX_NUDGE_INV:-0}"
-  LANES_INDEX_NUDGE=0; LANES_INDEX_NUDGE_INV=0
-  [ "${LANES_INDEX:-}" = off ] && return 0
-  in_bin="$(command -v lanes-index 2>/dev/null || :)"
-  [ -n "$in_bin" ] || return 0
-  if [ "$in_reg" = 1 ]; then
-    ( "$in_bin" sync </dev/null >/dev/null 2>&1 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- & ) >/dev/null 2>&1
-  fi
-  if [ "$in_inv" = 1 ]; then
-    ( "$in_bin" sync --source inventory </dev/null >/dev/null 2>&1 3>&- 4>&- 5>&- 6>&- 7>&- 8>&- 9>&- & ) >/dev/null 2>&1
-  fi
-  return 0
-}
-
-# THE READ FLAG'S ONE DOOR. 0 with `LANES_IDX_DIR` set and `read: index (...)`
-# said; 1 with `read: sources (index <why>)` said and NOTHING set, so the caller
-# runs the source read exactly as it would have without the flag — and exits as
-# that read would. Both lines go to stderr: stdout is the read's own, and a
-# person diffing the two answers diffs the answer.
-#
-# THE LAG IS SAID, NEVER REFUSED (clause (b)): `<k>` is how many commits this
-# checkout's `origin/<branch>` carries past the indexed one, and `unknown` where
-# that commit is not here to count from.
-#
-# `index_open worktrees` IS THE SAME DOOR FOR THE `worktrees` TABLE
-# (opensoft/openRepoTools#161): `export --worktrees` writes every
-# `inventory:<Workstation>` source the store holds, `LANES_WT_IDX_DIR` is set
-# and `LANES_IDX_DIR` is NOT — so not one published read of the register is
-# answered out of the index by it — and the line names each source with the
-# time it was synced, because an inventory has no commit to count a lag in.
-index_open() {   # [worktrees]
-  io_kind="${1-register}"
-  LANES_IDX_DIR=""
-  LANES_WT_IDX_DIR=""
-  if [ "${LANES_INDEX:-}" = off ]; then
-    printf 'read: sources (index off: LANES_INDEX=off)\n' >&2
-    return 1
-  fi
-  io_bin=""
-  if [ -x "$SCRIPT_DIR/lanes-index" ]; then io_bin="$SCRIPT_DIR/lanes-index"
-  else io_bin="$(command -v lanes-index 2>/dev/null || :)"
-  fi
-  if [ -z "$io_bin" ]; then
-    printf 'read: sources (index missing: no lanes-index beside %s or on PATH)\n' "$SCRIPT_DIR/lanes-edit.sh" >&2
-    return 1
-  fi
-  io_dir="$(mktemp -d "${TMPDIR:-/tmp}/lanes-index-read.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$io_dir" ]; then
-    printf 'read: sources (index unread: no temporary directory could be made)\n' >&2
-    return 1
-  fi
-  io_rc=0
-  io_xa=""
-  [ "$io_kind" = worktrees ] && io_xa=--worktrees
-  if command -v timeout >/dev/null 2>&1; then
-    timeout -k 2 30 "$io_bin" export --out "$io_dir" ${io_xa:+"$io_xa"} </dev/null >/dev/null 2>"$io_dir/.stderr" || io_rc=$?
-  else
-    "$io_bin" export --out "$io_dir" ${io_xa:+"$io_xa"} </dev/null >/dev/null 2>"$io_dir/.stderr" || io_rc=$?
-  fi
-  if [ "$io_rc" != 0 ] || [ ! -f "$io_dir/meta" ]; then
-    io_why=""
-    [ -f "$io_dir/why" ] && io_why="$(head -n 1 -- "$io_dir/why" 2>/dev/null || :)"
-    case "$io_rc" in 124|137) io_why="unreachable: lanes-index export did not answer within 30 s" ;; esac
-    if [ -z "$io_why" ]; then
-      io_why="unread: lanes-index export exited $io_rc"
-      io_err="$(head -n 1 -- "$io_dir/.stderr" 2>/dev/null || :)"
-      [ -z "$io_err" ] || io_why="$io_why: $io_err"
-    fi
-    rm -rf -- "$io_dir"
-    printf 'read: sources (index %s)\n' "$io_why" >&2
-    return 1
-  fi
-  io_store="$(sed -n -e 's/^store=//p' "$io_dir/meta" | head -n 1)"
-  if [ "$io_kind" = worktrees ]; then
-    # A FIFTH FIELD IS THE LAST ERROR this workstation's own record of the
-    # source carries (N2 of the review of #289): a sync that refused a listing
-    # that was not whole left the table as it was, and `synced` alone did not
-    # say that a later sync had failed, or why. It is named as `status` names
-    # it, because a refused `reconcile`, a `--dry-run` included, records one
-    # too (review r2 of #289, NIT-1).
-    io_at="$(awk -F'\t' '$1 == "inventory" { printf "%s%s synced %s%s", (n++ ? "; " : ""), $2, $3, ($5 != "" ? " (last error: " $5 ")" : "") }' "$io_dir/meta")"
-    LANES_WT_IDX_DIR="$io_dir"
-    printf 'read: index (%s) at %s\n' "${io_store:-unknown}" "${io_at:-no inventory source}" >&2
-    return 0
-  fi
-  io_sha="$(sed -n -e 's/^sha=//p' "$io_dir/meta" | head -n 1)"
-  io_behind=unknown
-  if [ -n "$io_sha" ] && have_remote_ref; then
-    io_n="$(git -C "$LANES_REPO" rev-list --count "$io_sha..origin/$LANES_BRANCH" 2>/dev/null || :)"
-    case "$io_n" in ''|*[!0-9]*) : ;; *) io_behind="$io_n" ;; esac
-  fi
-  LANES_IDX_DIR="$io_dir"
-  # WHAT WAS READ BEFORE THE FLAG WAS HONOURED IS NOT WHAT IS READ AFTER IT:
-  # every published-read cache this process may already hold is dropped.
-  LANES_REGISTER_CACHE=""
-  [ -n "${SE_CACHE_FILE:-}" ] && rm -f -- "$SE_CACHE_FILE.register"
-  lane_alias_flush
-  state_events_flush
-  printf 'read: index (%s) at register@%s; %s commits behind\n' "${io_store:-unknown}" "${io_sha:0:12}" "$io_behind" >&2
-  return 0
-}
-
-# Prints, to stdout, a comma-joined, de-duplicated list of the lane(s) whose
-# row changed in the CURRENT unstaged diff of LANES.md — identified by the
-# first backtick token on each changed (+/-) line — or "append" for a
-# changed line that is not a `| ... |` row (e.g. a Rule 6 LANDING/LANDED
-# line, which names no row of its own).
-identify_changed_lanes() {
-  git -C "$LANES_REPO" --no-pager diff -- "${CP_PATHS[@]}" 2>/dev/null | awk '
-    /^[+-][^+-]/ {
-      line = substr($0, 2)
-      lane = "append"
-      if (substr(line, 1, 1) == "|") {
-        p1 = index(line, "`")
-        if (p1 > 0) {
-          rest = substr(line, p1 + 1)
-          p2 = index(rest, "`")
-          if (p2 > 0) lane = substr(rest, 1, p2 - 1)
-        }
-      }
-      if (!(lane in seen)) { seen[lane] = 1; order[++n] = lane }
-    }
-    END { for (i = 1; i <= n; i++) printf "%s%s", (i > 1 ? "," : ""), order[i] }
-  '
-}
-
-# Prints the standard WARNING block (diff --stat + first 200 chars of every
-# changed line) to stderr. Takes no action beyond warning.
-warn_dirty() {
-  git -C "$LANES_REPO" --no-pager diff --stat -- "${CP_PATHS[@]}" >&2
-  git -C "$LANES_REPO" --no-pager diff -- "${CP_PATHS[@]}" 2>/dev/null | awk '/^[+-][^+-]/ {print substr($0,1,200)}' >&2
-}
-
-# Called by every mutating subcommand BEFORE it makes its own edit. If
-# LANES.md is already dirty at that point, that content is someone else's —
-# a peer's hand edit, or a helper run interrupted before it could push —
-# never this invocation's. Always warns. In the default --no-sweep mode it
-# commits that content now, as its own attributed commit, so it can never
-# land combined with this invocation's edit (the 0d84d34 / a1f2438
-# incidents: another lane's row edit landed inside an unrelated commit with
-# no trace of whose it was). In --sweep mode it leaves the content staged
-# for this invocation's own commit and sets PRE_DIRTY_LANES so the caller
-# can annotate its commit subject.
-#
-# Sets PRE_DIRTY_LANES to the affected lane list in --sweep mode; empty
-# otherwise (nothing left to annotate — it was already committed separately).
-handle_preexisting() {
-  PRE_DIRTY_LANES=""
-  if [ "$#" -gt 0 ]; then CP_PATHS=("$@"); else CP_PATHS=("$LANES_PATH"); fi
-  [ "$NO_GIT" = 1 ] && return 0
-  git -C "$LANES_REPO" diff --quiet -- "${CP_PATHS[@]}" 2>/dev/null && return 0
-  lanes="$(identify_changed_lanes)"; lanes="${lanes:-unknown}"
-  note "WARNING: LANES.md already has uncommitted changes before this edit (row: $lanes) — not this invocation's"
-  warn_dirty
-  if [ "$SWEEP_MODE" = "sweep" ]; then
-    PRE_DIRTY_LANES="$lanes"
-    note "SWEEP_MODE=sweep — leaving it staged; it will land inside this invocation's own commit, annotated"
-  else
-    git -C "$LANES_REPO" add -- "${CP_PATHS[@]}"
-    git -C "$LANES_REPO" commit -q -m "LANES(pre-existing@$WS): capture an uncommitted registry edit (row $lanes)" -- "${CP_PATHS[@]}" || :
-    note "captured pre-existing edit (row $lanes) as its own commit"
-  fi
-  return 0
-}
-
-# R11 (Addendum 3, 2026-09-11) — a peer's uncommitted REGISTER edit is
-# CAPTURED, not refused. `lanes/LANES.md` is dirty in this shared checkout for
-# much of the day — the register takes ~500 commits a day and a half-written
-# row is what one of them looks like a second before it lands — so refusing
-# every `claim`, `log` and `release` on it would push lanes to stop using the
-# tool, and the pre-existing capture already exists precisely to make that
-# state safe to rebase over. So: capture FIRST, exactly as every register
-# write has done since --no-sweep (the warning included), and let the guard
-# re-test the checkout afterwards.
-#
-# Only when the register is NOT one of this write's own pathspecs: a LANDING
-# or a LANDED commits it itself, and the ordinary handle_preexisting call
-# covers it there, --sweep included. There is nothing to sweep a register edit
-# INTO when this commit does not touch the register, so this capture is always
-# its own commit whatever --sweep says.
-#
-# It is reached only AFTER write_event's first guard, so it never commits on
-# behalf of a write that is about to refuse: a checkout dirty in anything ELSE
-# is refused before the lock and before this runs, and a refusal that had
-# already committed a peer's register edit would be a refusal that wrote.
-capture_register_edit() {
-  case " $* " in *" $LANES_PATH "*) return 0 ;; esac
-  cre_mode="$SWEEP_MODE"
-  SWEEP_MODE="no-sweep"
-  handle_preexisting "$LANES_PATH"
-  SWEEP_MODE="$cre_mode"
-  return 0
-}
-
-# ======================================================== Amendment 7 ======
-#
-# THE PER-LANE OBJECT LOG.
-#
-#   lanes/log/<lane>.md — one file per lane, append-only, line 1 a header,
-#   every other line an EVENT. This helper is the only writer, for the same
-#   reason it is the register's only writer. One file per lane is also what
-#   makes two workstations safe: two lanes writing at once touch two files.
-#
-#   <VERB> — lane <lane>, session <uuid>@<ws>, <UTC>, <object>[ → <payload>][ — <free text>]
-#
-#   The verb is ONE token. The first four fields are separated by `, `. The
-#   OBJECT token contains no space and no comma; everything after it up to
-#   ` — ` is payload, whose sub-fields are separated by `; ` and whose refs
-#   are space-separated.
-#
-#   STATE IS PER LANE. A lane's state on an object is that lane's LAST line
-#   naming it — the last such line IN THE FILE, never the largest UTC (R14);
-#   the lane HOLDS the object when that verb is in the OPEN set; the object is
-#   HELD when any lane holds it. There is no index file: a read fetches and
-#   greps, because 45 lanes' logs together are smaller than one of the
-#   register's rows.
-#
-#   LANES.md is unchanged. Its rows stay its rows and its Rule 6 LANDING /
-#   LANDED lines stay where every lane already reads them as the merge hold —
-#   which is why `who --landing` reads THOSE and not the logs. A LANDING or
-#   LANDED writes both files in one commit, with two pathspecs.
-
-LANES_PREFIX="${LANES_PREFIX:-$(git -C "${LANES_DIR:-.}" rev-parse --show-prefix 2>/dev/null || :)}"
-LANES_LOG_DIR="${LANES_LOG_DIR:-$LANES_DIR/log}"
-LANES_LOG_PREFIX="${LANES_LOG_PREFIX:-${LANES_PREFIX}log/}"
-
-# THE ALIAS TABLE IS TWO LAYERS, in this order (Amendment 9(b), ruling 3): the
-# per-wip OVERRIDE in the person's own workspace repository, then the
-# organisation's table shipped by openRepoTools and installed beside this
-# command. An override row replaces the shipped row for the same alias and adds
-# rows the shipped table does not carry; an alias in NEITHER layer is still a
-# refusal naming the fix, spell it `owner/repo` (Amendment 7(a), unchanged).
-#
-# The shipped copy sits BESIDE this file because `--install` places from one
-# list into one directory at one mode — the alternative was a second
-# destination and a second mode in two repositories, which is why the table
-# carries an executable bit it has no use for.
-LANES_REPOS_TSV="${LANES_REPOS_TSV:-${LANES_DIR:+$LANES_DIR/repos.tsv}}"
-if [ -z "${LANES_REPOS_TSV_SHIPPED:-}" ]; then
-  if [ -n "${OPENREPOTOOLS_BIN_DIR:-}" ] && [ -f "$OPENREPOTOOLS_BIN_DIR/repos.tsv" ]; then
-    LANES_REPOS_TSV_SHIPPED="$OPENREPOTOOLS_BIN_DIR/repos.tsv"
-  else
-    LANES_REPOS_TSV_SHIPPED="$SCRIPT_DIR/repos.tsv"
-  fi
-fi
-
-# AMENDMENT 16(e) — THE LANE ALIAS TABLE, `lanes/aliases.tsv`, one layer and
-# not two. `repos.tsv` above has a shipped layer because a repository alias is
-# an ORGANISATION's fact; a lane rename is one person's register moving, so the
-# table lives beside the register it describes and openRepoTools ships none.
-# `<old>	<new>	<UTC>`, one line per rename, appended by `rename-lane` and by
-# nothing else — and read case-insensitively by `canon_lane`, which is the one
-# seat every `<lane>` argument in this file already passes through.
-LANES_ALIASES_TSV="${LANES_ALIASES_TSV:-${LANES_DIR:+$LANES_DIR/aliases.tsv}}"
-LANES_ALIASES_PATH="${LANES_ALIASES_PATH:-${LANES_PREFIX}aliases.tsv}"
-PROJECTS_ROOT="${PROJECTS_ROOT:-$HOME/projects}"
-NO_GITHUB="${LANES_NO_GITHUB:-0}"
-STALE_HOURS="${LANES_STALE_HOURS:-4}"     # Rule 1's threshold, reused
-
-# The field separator for every machine-read line below. NOT a tab: a tab is
-# IFS WHITESPACE, so bash's `read` collapses runs of them and one empty field
-# (an event with no payload) shifts every field after it one to the left.
-# \037 — US, "unit separator" — is not whitespace, so empty fields survive it.
-US="$(printf '\037')"
-# THE ROW SEPARATOR FOR THE IN-SHELL LOOKUP TABLES (A11 Addendum 4 ruling 12).
-# GS, one below US, and for the same reason US was chosen over a tab: it is not
-# IFS whitespace, so an empty field does not shift every field after it.
-GS="$(printf '\036')"
-
-# ONE LINE OUT OF A TABLE THIS SHELL IS ALREADY HOLDING, WITHOUT A PROCESS.
-# The listing's three tables — the published register's index, this checkout's,
-# and one line of facts per lane — are a few dozen lines each and were read with
-# `printf | awk` PER LANE, which is six processes a lane to look up strings that
-# are already in memory. Fenced with `$GS` and keyed on the lane name
-# lower-cased, the whole lookup is one parameter expansion.
-#
-# IT ASSIGNS A GLOBAL AND RETURNS, rather than printing: a function whose answer
-# is taken with `$( … )` forks, which is the cost this exists to avoid.
-#
-# AND THE EXPANSION IS `%%key*`, NEVER `#*key` — THE SAME FIRST MATCH, IN
-# LINEAR TIME (opensoft/openRepoTools#107). Bash removes a shortest prefix by
-# trying the whole pattern against EVERY prefix of the string in turn, and a
-# pattern that opens with `*` costs a scan of that prefix each time: `#*key` is
-# QUADRATIC in the table. A longest suffix is found by trying the pattern only
-# where its FIRST character matches, and here that is `$GS`, which occurs once
-# per line — so `%%key*` touches each byte about once. Both name the FIRST
-# occurrence of `$GS<lane>$US`: `#*key` is everything up to and including it,
-# `%%key*` everything before it. Measured on the suite's own fixture register
-# (194 rows, 162 object logs): the per-lane loop of one `lanes --prefix` read
-# was 56.6 s of its 58.1 s, about 75 ms per lookup, three or more lookups per
-# lane — which is what put `lane`'s pick past the pty driver's 60-second bound.
-# The offset is in CHARACTERS on both sides of the `+` (`${#…}` and `${1:…}`
-# count the same way in any one locale), so a multibyte table cuts where the
-# old expansion cut.
-LOOKUP_OUT=""
-table_lookup() {   # <fenced table> <lower-cased lane>
-  local tl_key tl_head tl_rest
-  LOOKUP_OUT=""
-  tl_key="$GS$2$US"
-  tl_head="${1%%"$tl_key"*}"
-  [ "$tl_head" = "$1" ] && return 1
-  tl_rest="${1:$(( ${#tl_head} + ${#tl_key} ))}"
-  LOOKUP_OUT="${tl_rest%%"$GS"*}"
-  return 0
-}
-
-utc_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
-
-# ---------------------------------------------------------------- the verbs
-#
-# A lane HOLDS an object while its own last line on it is OPEN. WITHDRAWN is
-# open on purpose: withdrawing a landing leaves the PR held by the lane that
-# withdrew it. The CLOSED set closes only the WRITING lane's hold — another
-# lane's claim on the same object is untouched by it.
-is_open_verb()   { case "$1" in CLAIMED|TAKEOVER|OPENED|LANDING|WITHDRAWN) return 0 ;; esac; return 1; }
-is_closed_verb() { case "$1" in RELEASED|CLAIM-LOST|CLOSED|LANDED) return 0 ;; esac; return 1; }
-# AND `HANDOFF-REQUESTED` IS A LANE-KIND VERB THAT CHANGES NO STATE (Amendment
-# 18(g)): *"this adds one lane-kind verb, `HANDOFF-REQUESTED`, which changes no
-# object's state and which every last-line reader skips."* It is lane-kind
-# because its object is `lane:<name>` — which is what `is_lane_verb` is asked
-# here, and the only thing it is asked (its one caller is the `log` arm's
-# object check) — and it is in NEITHER state set, so it opens nothing and closes
-# nothing. Every reader that decides a lane's STATE enumerates the five state
-# verbs by name (`lane_row_facts`, `lane_payload_field`, `lane_binding_utc`,
-# `lane-last`, `swapped_candidates`), so none of them sees it, and
-# `lane_binding_scan` is the one read that does: to it a request is a fact ABOUT
-# a binding and never a release of one.
-is_lane_verb()   { case "$1" in STARTED|PAUSED|RESUMED|ENDED|RETIRED|HANDOFF-REQUESTED) return 0 ;; esac; return 1; }
-# AMENDMENT 13(b) — THE TWO NARRATIVE VERBS, AND THEY ARE OUTSIDE EVERY STATE
-# THERE IS. `NOTED` is a status note and `RULED` a ruling recorded verbatim;
-# both are lane-kind lines whose object is the lane itself, and NEITHER IS A
-# TRANSITION OF ANYTHING. So they are their own set rather than members of
-# `is_lane_verb`: every reader that computes a lane's state by the per-lane
-# last-line rule takes the five lane verbs by name, and a sixth and seventh
-# inside that predicate would have made the narrative move the lane — a `NOTED`
-# after a swap's `PAUSED` would have made a paused lane read as neither paused
-# nor running, which is the one thing `swapped` and `restart` are built on.
-# The one reader that took the LAST lane-kind line whatever it was is
-# `swapped_candidates`, and it skips these by name for exactly that reason.
-#
-# AMENDMENT 16 PUTS `RENAMED` HERE, AND THE SET IS WHAT IT WAS RATHER THAN WHAT
-# IT IS CALLED: a LANE-KIND LINE THAT IS NOT A TRANSITION. Clause (c) says the
-# rename's line "changes no object's state, every last-line reader skips it",
-# which is Amendment 13(b)'s sentence about its own two in different words — and
-# `swapped_candidates` is the proof that `is_lane_verb` is the wrong home: it
-# takes a lane's last lane-kind line WHATEVER its verb is, so a `RENAMED` there
-# would make a swapped lane read as neither paused nor running and `restart`
-# would not find it. One predicate, three verbs, one property.
-#
-# `HANDOFF-REQUESTED` IS INSIDE `is_lane_verb` AND THESE THREE ARE NOT, and the
-# difference is the object rather than the state: that predicate's ONE caller is
-# the `log` arm's check that a lane verb's object is `lane:<name>`, which the
-# request needs and which Amendment 13 gives its two by their own arm, as
-# Amendment 16 gives `RENAMED` by its. None of the four moves a lane, and none
-# of the four is seen by a state reader.
-is_note_verb()   { case "$1" in NOTED|RULED|RENAMED) return 0 ;; esac; return 1; }
-valid_verb() {
-  is_open_verb "$1" || is_closed_verb "$1" || is_lane_verb "$1" || is_note_verb "$1"
-}
-VERB_LIST="CLAIMED RELEASED TAKEOVER CLOSED | OPENED LANDING LANDED WITHDRAWN | STARTED PAUSED RESUMED ENDED RETIRED HANDOFF-REQUESTED | CLAIM-LOST | NOTED RULED RENAMED"
-
-check_lane_name() {
-  case "${1-}" in
-    "" | *[!A-Za-z0-9._-]* | .* | -*)
-      die "'${1-}' is not a lane name (letters, digits, . _ -, not opening with . or -)" 2 ;;
-  esac
-}
-
-log_file_for() { printf '%s/%s.md\n' "$LANES_LOG_DIR" "$1"; }
-log_path_for() { printf '%s%s.md\n' "$LANES_LOG_PREFIX" "$1"; }
-
-# AMENDMENT 15 — THE LOG FILE IS `lanes/log/<canonical>.md`, AND A FILE OF
-# ANOTHER CASE IS STILL THIS LANE'S LOG.
-#
-# The log's file name was lowercased from the start, which is exactly why the
-# 2026-09-13 incident produced TWO ROWS AND ONE LOG: `openXfactory-2` and
-# `openxfactory-2` had always shared `lanes/log/openxfactory-2.md`. The real
-# register still carries `lanes/log/openxfactory-4.md` beside the row
-# `openxfactory-4` — the same spelling, nothing to do — and the historical
-# mismatch is the shape these two functions exist for. READERS find the file
-# whatever its case; the first WRITE renames it to the canonical spelling, once,
-# inside its own commit (`ensure_log` below).
-#
-# `ls` and one `awk`, not a `$(lc …)` per file: `lanes/log/` carries a file per
-# lane of the estate and this is asked on the path a person is waiting on.
-#
-# AND THE `--` STAYS (Copilot round 3 on openRepoTools#41, DECLINED with a
-# measurement). It was read as a macOS defect — *"BSD `ls` rejects `--`, and the
-# suppressed error makes every case-insensitive log scan empty"* — which would
-# mean no first write ever renames anything on the one platform this amendment's
-# rename exists for. BSD `ls` ends its options at `--` through `getopt(3)`, as
-# every POSIX utility does, and `tests-macos` has been GREEN on the two
-# assertions that can only pass if this scan finds a file of another case there:
-# the rename recorded inside the write's own commit, and `lane-start`'s own
-# `repo repocase → repoCase` out of the twin scan at `lane-start:677`. The suite
-# asserts the parse itself as well, on every platform. Dropping `--` would hand
-# a directory whose name begins with `-` back to `ls` as flags and change
-# nothing else.
-#
-# AND IT RETURNS 1 WHERE THE DIRECTORY IS THERE AND COULD NOT BE LISTED (#138
-# item 9). It was `ls … 2>/dev/null | awk`, whose status is the awk's, so an
-# unreadable directory answered "no log of any case" — which `retire_rows`' scan
-# took as a lane with no log, and its write loop then failed on that directory
-# after the scan had passed. A missing directory is still no log, and 0.
-log_files_named_ci() {   # <lane> — every existing log file for it, whatever its case
-  lfn_ls=""
-  if [ -e "$LANES_LOG_DIR" ]; then
-    lfn_ls="$(ls -- "$LANES_LOG_DIR" 2>/dev/null)" || return 1
-  fi
-  printf '%s\n' "$lfn_ls" | awk -v want="$1" -v d="$LANES_LOG_DIR" '
-    BEGIN { w = tolower(want) ".md" }
-    tolower($0) == w { print d "/" $0 }'
-}
-
-# The PUBLISHED path of a lane's log, found the same way — the canonical path
-# where `origin/<branch>` has no file of another case, so a lane with no log at
-# all still reads as the pre-cutover 8 rather than as a failure.
-#
-# TWO PATHS DIFFERING ONLY BY CASE ARE A REFUSAL AND NOT A CHOICE (Copilot round
-# 4 on openRepoTools#41). The `exit` after the first match read a tree holding
-# BOTH `lanes/log/repocase-1.md` and `lanes/log/repoCase-1.md` as though it held
-# one, and every reader behind it — `lane_log_events`, `lane_log_exists`,
-# `last-session`, the listing's per-lane facts — then consumed whichever `ls-tree`
-# happened to name first and DROPPED the other file's lines without saying so.
-# That is two logs for one lane, the state 15(d)'s hand merge exists for, and an
-# append-only history half of which is invisible is worse than a refusal. Counted
-# and REFUSED (2) naming both, in `canon_lane`'s own shape — it RETURNS rather
-# than exits, because every caller takes it with `$( )`.
-#
-# AND THE WORKING TREE ANSWERS WHERE `origin` HAS NOTHING. The fallback was the
-# canonical path outright, which is a path that need not exist: a lane whose log
-# is still spelled the old way and has never been pushed has ONE file on disk and
-# this named another. `claim`'s dirty-checkout exemption is computed from it, so
-# the lane's own uncommitted log read as an unrelated dirty file and the claim was
-# refused for it. The same case-insensitive scan every other reader uses answers
-# that half (Copilot round 4).
-log_path_ci() {   # <lane> — 0 with the ONE path, 2 where two differ only by case
-  lpc_exact="$(log_path_for "$1")"
-  # AMENDMENT 14 — UNDER `--index` THE INDEX'S LOG LIST STANDS IN FOR
-  # `origin`'s tree, and nothing else in this function changes.
-  if [ -n "$LANES_IDX_DIR" ] || have_remote_ref; then
-    if [ -n "$LANES_IDX_DIR" ]; then
-      lpc_hits="$(awk -v want="$lpc_exact" 'BEGIN { w = tolower(want) } tolower($0) == w' "$LANES_IDX_DIR/logs" 2>/dev/null)"
-    else
-    lpc_hits="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null \
-      | awk -v want="$lpc_exact" 'BEGIN { w = tolower(want) } tolower($0) == w')"
-    fi
-    lpc_n="$(printf '%s' "$lpc_hits" | grep -c . || :)"
-    if [ "$lpc_n" -gt 1 ]; then
-      note "lane $1 has $lpc_n object logs on origin/$LANES_BRANCH whose names differ only by case: $(printf '%s\n' "$lpc_hits" | tr '\n' ' ')"
-      note "one lane is ONE lane under any case and its log is ONE file (Amendment 15), so no read of it is unambiguous and nothing here picks one of them. Merge them by hand into $lpc_exact, oldest lines first, remove the others in the same commit (Amendment 15(d)), and re-run."
-      return 2
-    fi
-    [ "$lpc_n" = 1 ] && { printf '%s\n' "$lpc_hits"; return 0; }
-  fi
-  lpc_loc="$(log_files_named_ci "$1")"
-  lpc_ln="$(printf '%s' "$lpc_loc" | grep -c . || :)"
-  if [ "$lpc_ln" -gt 1 ]; then
-    note "lane $1 has $lpc_ln object logs in this checkout whose names differ only by case: $(printf '%s\n' "$lpc_loc" | tr '\n' ' ')"
-    note "one lane is ONE lane under any case and its log is ONE file (Amendment 15), so no read of it is unambiguous and nothing here picks one of them. Merge them by hand into $(log_file_for "$1"), oldest lines first, remove the others in the same commit (Amendment 15(d)), and re-run."
-    return 2
-  fi
-  [ "$lpc_ln" = 1 ] && { printf '%s\n' "${LANES_LOG_PREFIX}${lpc_loc##*/}"; return 0; }
-  printf '%s\n' "$lpc_exact"
-}
-
-# The repo-relative path `ensure_log` renamed a log AWAY from, for the ONE
-# caller that has to put it in the same commit as the write. Empty on every
-# other run, and reset by every `ensure_log`, so "renamed" is never sticky.
-LOG_RENAMED_FROM=""
-
-ensure_log() {
-  lane="$1"; lf="$(log_file_for "$lane")"
-  LOG_RENAMED_FROM=""
-  [ -d "$LANES_LOG_DIR" ] || mkdir -p -- "$LANES_LOG_DIR"
-  el_hits="$(log_files_named_ci "$lane")"
-  el_n="$(printf '%s' "$el_hits" | grep -c . || :)"
-  if [ "$el_n" -gt 1 ]; then
-    die "lane $lane has $el_n object logs whose names differ only by case: $(printf '%s\n' "$el_hits" | tr '\n' ' ')— one lane is ONE lane under any case and its log is ONE file (Amendment 15). Merge them by hand into $lf, oldest lines first, remove the others in the same commit, and re-run. Nothing was written." 2
-  fi
-  # A LOG THIS CHECKOUT HAS NOT PULLED IS STILL THIS LANE-S LOG, AND CREATING
-  # THE CANONICAL FILE BESIDE IT IS THE SPLIT THIS FUNCTION EXISTS TO PREVENT.
-  # `log_files_named_ci` reads the WORKING TREE, while every state reader here
-  # deliberately answers out of `origin/<branch>` (R19): on a checkout that is
-  # behind, a published `lanes/log/repocase-1.md` is invisible to the scan
-  # above, this write would create `repoCase-1.md`, and `commit_push`-s own
-  # rebase would then land BOTH. The refusal below is fail-closed and its cure
-  # is one command, where the cure for two published files is 15(d)-s hand
-  # merge (Copilot round 1 on openRepoTools#41).
-  #
-  # AND THE GUARD IS NOT ONLY FOR A CHECKOUT WITH NO FILE AT ALL (Copilot round 4
-  # on openRepoTools#41). It ran under `el_n = 0`, so the state a rename leaves
-  # when its COMMIT does not land — the canonical file here, the old-cased path
-  # still in the remote tree — walked straight past it, and the next write staged
-  # the canonical path alone and left the published one where it was: two files
-  # for one lane again, by the path this function exists to close. The test is
-  # therefore on the PATHS and not on the count: a published path that is neither
-  # the canonical one NOR the one this checkout is about to rename FROM is a
-  # refusal, which leaves the ordinary rename (local and published agree on the
-  # old spelling) exactly as it was.
-  el_from=""
-  [ "$el_n" = 1 ] && el_from="$el_hits"
-  if have_remote_ref; then
-    el_pub="$(log_path_ci "$lane")" || die "lane $lane's object log is published twice (above) and nothing is written under a name that means two files. Merge them by hand (Amendment 15(d)) and re-run. Nothing was written." 2
-    if [ "$el_pub" != "$(log_path_for "$lane")" ] && [ "${el_from##*/}" != "${el_pub##*/}" ]; then
-      el_here="and this checkout does not have it"
-      [ -n "$el_from" ] && el_here="while this checkout has ${LANES_LOG_PREFIX}${el_from##*/} instead — a case-only rename whose commit never landed"
-      die "lane ${lane}'s object log is published as $el_pub $el_here: the row spells the lane $lane, so the log is $(log_path_for "$lane") (Amendment 15), and writing one here now would leave TWO files for one lane. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run; the rename then happens once, inside this write's own commit. Nothing was written." 2
-    fi
-  fi
-  if [ -n "$el_from" ] && [ "$el_from" != "$lf" ]; then
-    # THE RENAME IS ONE ACT AND IT HAPPENS ONCE: after it the canonical name is
-    # the only one `log_files_named_ci` can find, so the next write takes the
-    # branch above and does nothing. THROUGH A TEMPORARY NAME, because on a
-    # case-INSENSITIVE filesystem — macOS, which this repository's CI runs — the
-    # two names are one file and `mv a A` answers "identical" rather than
-    # renaming; two `mv`s do the same job on both kinds of filesystem, and
-    # neither is `git mv`, whose own case-only rename is the thing that differs
-    # between platforms. The caller puts the old path in this write's pathspecs
-    # and `commit_push` drops its INDEX entry by that exact path before staging
-    # the new one, then commits the index rather than the pathspecs — the one
-    # sequence that records the rename on a case-insensitive filesystem as well
-    # as on this one, argued in full above `CP_EXACT`.
-    el_tmp="$lf.amendment15.$$"
-    # THE REFUSAL SAYS WHERE THE FILE IS, and the two halves fail differently:
-    # the first `mv` failing leaves the log exactly where it was, while the
-    # SECOND failing leaves it at `$el_tmp` — a name no reader of this
-    # directory looks for. A refusal that told a person to "move it by hand"
-    # without saying which path to move is a refusal they cannot act on, and
-    # this one costs a lane its whole history if it is acted on wrongly.
-    if ! mv -- "$el_from" "$el_tmp" 2>/dev/null; then
-      die "could not rename $el_from to $lf (Amendment 15: the register row's spelling names the lane's log). Nothing was written and the log is untouched at $el_from; rename it by hand and re-run." 5
-    fi
-    if ! mv -- "$el_tmp" "$lf" 2>/dev/null; then
-      die "could not rename $el_tmp to $lf (Amendment 15: the register row's spelling names the lane's log). Nothing was written, and THIS LANE'S LOG IS NOW AT $el_tmp — rename it to $lf by hand, or back to $el_from, and re-run. It is not lost and no reader looks for it under that name." 5
-    fi
-    LOG_RENAMED_FROM="${LANES_LOG_PREFIX}${el_from##*/}"
-    note "$el_from → $lf: the register row spells this lane $lane, and the row's spelling names its log (Amendment 15)"
-  fi
-  if [ ! -f "$lf" ]; then
-    printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$lane" > "$lf"
-    note "created $lf"
-  fi
-}
-
-# ------------------------------------------------------- the alias table
-#
-# `lanes/repos.tsv`, `alias<TAB>owner/repo`. Consulted when the owner is
-# omitted, and when a spelling the register really uses is not the canonical
-# nameWithOwner (all four spellings of codexFactory resolve to
-# `codeXfactory/codexFactory`, which is the redirect GitHub answers with).
-# Matching is case-insensitive: the register spells one repo `OpsxFactory`,
-# `opsXfactory` and `opsxfactory` in the same week.
-alias_lookup() {
-  al_k="$1"
-  for al_tsv in "${LANES_REPOS_TSV:-}" "${LANES_REPOS_TSV_SHIPPED:-}"; do
-    [ -n "$al_tsv" ] && [ -f "$al_tsv" ] || continue
-    awk -F'\t' -v k="$al_k" '
-      BEGIN { kl = tolower(k) }
-      /^[ \t]*#/ { next }
-      NF >= 2 { if (tolower($1) == kl) { print $2; found = 1; exit } }
-      END { exit(found ? 0 : 1) }' "$al_tsv" && return 0
-  done
-  return 1
-}
-
-# canon_object <raw> [<home owner/repo>] — prints the canonical object key.
-# THE KINDS IN SCOPE, and no others (a later amendment may add keys):
-#   owner/repo#n                        an issue or a PR
-#   owner/repo:openspec/changes/<name>  an OpenSpec change directory
-#   #n                                  the lane's OWN home repo
-#   lane:<name>                         a lane, for the lane-kind lines only
-# Human acts, realization groups, contract cuts, file surfaces and Amendment
-# 1's substrates stay where they are today — comments on their governing
-# records — and are an explicit non-goal here.
-canon_object() {
-  co_raw="$1"; co_home="${2-}"; co_repo=""; co_rest=""; co_owner=""; co_hc=""
-  case "$co_raw" in
-    lane:*)
-      case "${co_raw#lane:}" in
-        "" | *[!A-Za-z0-9._-]*) note "'$co_raw' is not a lane object: lane:<name>"; return 2 ;;
-      esac
-      # AMENDMENT 15 — A LANE OBJECT CARRIES THE ROW'S SPELLING TOO. `lane:<name>`
-      # is the object of every lane-kind line (7(b)), so a `log PAUSED
-      # lane:openxfactory-2` on the lane `openXfactory-2` would write a key that
-      # does not match the lane's own earlier lines — in a file nothing rewrites,
-      # and against which `who lane:<name>` is then asked. Canonicalised here, so
-      # the writers and the reader ask the same question of it.
-      co_cl="$(canon_lane "${co_raw#lane:}")" || return 2
-      printf 'lane:%s\n' "$co_cl"; return 0 ;;
-    '#'*)
-      case "${co_raw#\#}" in
-        "" | *[!0-9]*) note "'$co_raw' is not an object key: after '#' comes the issue or PR number"; return 2 ;;
-      esac
-      if [ -z "$co_home" ]; then
-        note "'$co_raw' is shorthand for this lane's home repo, and no home is on record for it."
-        note "  Spell it owner/repo$co_raw, or pass --home owner/repo (a pre-cutover lane has no STARTED line)."
-        return 2
-      fi
-      if ! valid_nwo "$co_home"; then
-        note "'$co_home' is not a repository, so '$co_raw' cannot be expanded against it."
-        note "  A home is owner/repo. This one came from the lane's STARTED line or from --home."
-        return 2
-      fi
-      # R20 — THE HOME GOES THROUGH THE ALIAS TABLE TOO, on the way into a key.
-      # `home_of_lane` and `resolve_home` both resolve already; this is the last
-      # gate, so no caller can reach a key by a path that skipped it. A checkout
-      # whose origin still spells `opensoft/codexFactory` wrote `#5` as a key
-      # nothing could reconcile with `codeXfactory/codexFactory#5`, and two lanes
-      # held one issue with no collision detected.
-      co_hc="$(alias_lookup "$co_home" 2>/dev/null || :)"
-      [ -n "$co_hc" ] && co_home="$co_hc"
-      printf '%s%s\n' "$co_home" "$co_raw"; return 0 ;;
-    *:openspec/changes/*)
-      co_repo="${co_raw%%:openspec/changes/*}"
-      co_rest=":openspec/changes/${co_raw#*:openspec/changes/}"
-      case "${co_rest#:openspec/changes/}" in
-        "" | *[!A-Za-z0-9._-]*) note "'$co_raw' is not an object key: an OpenSpec change is owner/repo:openspec/changes/<name>"; return 2 ;;
-      esac ;;
-    *'#'*)
-      co_repo="${co_raw%%#*}"
-      co_rest="#${co_raw#*#}"
-      case "${co_rest#\#}" in
-        "" | *[!0-9]*) note "'$co_raw' is not an object key: after '#' comes the issue or PR number"; return 2 ;;
-      esac ;;
-    *)
-      note "'$co_raw' is not an object key. In scope: owner/repo#<n>, owner/repo:openspec/changes/<name>, #<n> for this lane's home repo, lane:<name>."
-      return 2 ;;
-  esac
-  [ -n "$co_repo" ] || { note "'$co_raw' names no repository"; return 2; }
-  co_owner="$(alias_lookup "$co_repo" 2>/dev/null || :)"
-  if [ -z "$co_owner" ]; then
-    case "$co_repo" in
-      */*) co_owner="$co_repo" ;;     # a spelled owner/repo is always accepted
-      *)
-        note "unknown repo alias '$co_repo' — spell it owner/repo (the canonical GitHub nameWithOwner), or add it to ${LANES_LOG_PREFIX%log/}repos.tsv"
-        return 2 ;;
-    esac
-  fi
-  case "$co_owner" in
-    */*/*|*/) note "the alias table maps '$co_repo' to '$co_owner', which is not owner/repo"; return 2 ;;
-    */*) : ;;
-    *) note "the alias table maps '$co_repo' to '$co_owner', which is not owner/repo"; return 2 ;;
-  esac
-  case "$co_owner" in *[!A-Za-z0-9./_-]*) note "'$co_owner' is not a usable owner/repo"; return 2 ;; esac
-  printf '%s%s\n' "$co_owner" "$co_rest"
-}
-
-# owner/repo, and nothing else: exactly one slash, and only the characters
-# GitHub allows in either half. `--home 'not a repo'` used to go straight into
-# an object key, and the helper wrote `not a repo#42` — a line its OWN parser
-# cannot read back, in a log nothing ever rewrites.
-valid_nwo() { [[ "${1-}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
-
-# A TRANSCRIPT UUID, and nothing else — the shape `claude --resume` takes
-# exactly and the one every event line's `session` field carries (Amendment
-# 7(b), Definitions sense 1). Not a PR-footer `session_01…`, not a session
-# NAME, and not the literal `unknown`: `write_event` refuses all three.
-valid_uuid() { [[ "${1-}" =~ ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ ]]; }
-
-# The home repo for this invocation. `--home` is for a PRE-CUTOVER lane — one
-# whose log has no STARTED line — and is REFUSED where the log already answers
-# the question, so the flag and the log can never disagree. It is resolved
-# through the alias table and then validated, like any other spelling.
-#
-# R30 (Addendum 7) — AND EVERY CALLER ASKS AFTER THE FETCH. The STARTED line it
-# reads is `origin/<branch>`'s, like every other state read, so a home a peer
-# recorded is invisible here until `log_sync` has run: asked before it, `--home`
-# was ACCEPTED on a lane whose own log already answers the question — the one
-# refusal this flag has — and the object key it then built was the second
-# spelling of an issue another lane was already holding. `who` and `lane-end`'s
-# `resolve-home` preflight fetched first already; `log`, `claim` and `release`
-# now do too, so the preflight and the write can still never disagree.
-#
-# Called as `home="$(resolve_home "$lane" "$override")" || exit $?` — a `die`
-# in here runs inside the command substitution, so the caller must pass the
-# code on rather than carry on with an empty home.
-resolve_home() {
-  rh_lane="${1-}"; rh_over="${2-}"; rh_log=""
-  [ -n "$rh_lane" ] && rh_log="$(home_of_lane "$rh_lane" 2>/dev/null || :)"
-  if [ -n "$rh_over" ]; then
-    if [ -n "$rh_log" ]; then
-      note "lane $rh_lane's own log already records its home: $rh_log (from its STARTED line)."
-      die "--home is for a pre-cutover lane, one whose log has no STARTED line. Drop it, or correct the lane's home by appending a new STARTED line through lane-start." 2
-    fi
-    rh_res="$(alias_lookup "$rh_over" 2>/dev/null || :)"; rh_over="${rh_res:-$rh_over}"
-    valid_nwo "$rh_over" || die "--home takes owner/repo (the canonical GitHub nameWithOwner), or an alias in ${LANES_LOG_PREFIX%log/}repos.tsv: '${2-}' is neither" 2
-    printf '%s\n' "$rh_over"
-    return 0
-  fi
-  printf '%s\n' "$rh_log"
-}
-
-is_lane_object() { case "$1" in lane:*) return 0 ;; esac; return 1; }
-object_repo()    { case "$1" in lane:*) printf '\n' ;; *:openspec/changes/*) printf '%s\n' "${1%%:openspec/changes/*}" ;; *) printf '%s\n' "${1%%#*}" ;; esac; }
-object_number()  { case "$1" in lane:*|*:openspec/changes/*) printf '\n' ;; *'#'*) printf '%s\n' "${1##*#}" ;; *) printf '\n' ;; esac; }
-object_slug()    { case "$1" in *:openspec/changes/*) printf '%s\n' "${1##*/}" ;; *'#'*) printf '%s\n' "${1##*#}" ;; *) printf '%s\n' "$1" ;; esac; }
-
-# ------------------------------------------------------- reading the logs
-#
-# One parser, used by everything. It prints US-separated fields, UTC first:
-#   utc  lane  verb  uuid  ws  object  ref  payload  text  file  line
-#
-# The last two are the line's ADDRESS — the file it was read from and its
-# number IN THAT FILE (FNR, so it is the number the reader sees in the log and
-# the number an `unreadable:` report names). That address is what every state
-# read orders by (R14): the log is append-only, so a line further down the file
-# is a line written later, whatever the two lines' UTC fields say.
-# `match()` is used for every multi-byte separator: RSTART and RLENGTH are in
-# the same units as each other whatever the locale, and a hard-coded byte
-# offset for " — " is not.
-# AMENDMENT 16(e) — A LINE'S LANE IS THE LANE OF THE FILE IT IS IN, and that is
-# the whole of the rule.
-#
-# Clause (c) is explicit that a rename rewrites none of the lines above it:
-# *"the lines above it — which still say `lane <old>` — are never rewritten"*.
-# So after a rename a lane's log holds its whole history under two names, in one
-# file, about one lane — the exact shape Amendment 15 met when one lane's log
-# spelled it two ways, and the exact failure: `lane_objects`, `superseded_by`,
-# `holders_of`, `lane_row_facts` and `first_landed_of` all key on this field, so
-# read byte for byte HALF A RENAMED LANE'S HOLDS BECOME INVISIBLE — `who --lane`
-# calls a held object free and `lane-end` ends a lane that holds one.
-#
-# THE FIRST ANSWER WAS AN ALIAS LOOKUP IN THIS PARSE, AND IT WAS THE WRONG ONE
-# (Copilot round 1 on openRepoTools#81). A rename FREES the old name — no row
-# carries it, so `lane_next_free` hands the position out and a NEW lane can be
-# called it — and from that moment the field `lane <old>` is ambiguous: it is
-# the renamed lane's history in one file and the new lane's present in another.
-# No amount of resolving a NAME tells those apart, because the name is the same.
-#
-# THE FILE DOES. Amendment 7's first sentence is one file per lane, single
-# writer, and Amendment 15 makes its name the row's own spelling — so
-# `lanes/log/<lane>.md` IS the statement of which lane every line in it belongs
-# to, it MOVES with the rename (clause (c)), and it needs no table to read. The
-# field stays on the line as the spelling somebody typed; the FILE is what the
-# readers are keyed on. That also settles, with nothing added, the two spellings
-# of one lane Amendment 15 had to reason about line by line.
-LOG_AWK='
-function trim(s) { sub(/^[ \t]+/, "", s); sub(/[ \t]+$/, "", s); return s }
-# The lane a FILE belongs to: its base name without `.md`. `FN` is the
-# repo-relative path `remote_log_events` hands in; `FILENAME` is awk-s own for a
-# file read from disk. Computed once per file rather than per line.
-function filelane(   f, n, parts) {
-  f = (FN != "" ? FN : FILENAME)
-  if (f == "") return ""
-  n = split(f, parts, "/")
-  f = parts[n]
-  sub(/\.[Mm][Dd]$/, "", f)
-  return f
-}
-# A LINE IS NEVER DROPPED SILENTLY. This log is append-only and nothing in it
-# is ever rewritten, so a line no parser can read is a hold no tool will
-# mention again — `who` would call the object free, and it is not.
-function bad(why,   f) {
-  f = (FN != "" ? FN : FILENAME)
-  printf "unreadable: %s:%d (%s)\n", f, FNR, why > "/dev/stderr"
-  nbad++
-}
-FNR == 1 { FL = "" }
-{
-  line = $0
-  if (line ~ /^[ \t]*#/ || line ~ /^[ \t]*$/) next
-  if (match(line, / — /) == 0) { bad("no \" — \" after the verb"); next }
-  verb = trim(substr(line, 1, RSTART - 1))
-  rest = substr(line, RSTART + RLENGTH)
-  if (index(verb, " ") > 0) { bad("the verb is one token: \"" verb "\""); next }
-  if (substr(rest, 1, 5) != "lane ") { bad("no \"lane <name>\" field"); next }
-  rest = substr(rest, 6)
-  q = index(rest, ","); if (q == 0) { bad("no \",\" after the lane"); next }
-  lane = trim(substr(rest, 1, q - 1)); rest = trim(substr(rest, q + 1))
-  if (substr(rest, 1, 8) != "session ") { bad("no \"session <uuid>@<ws>\" field"); next }
-  rest = substr(rest, 9)
-  q = index(rest, ","); if (q == 0) { bad("no \",\" after the session"); next }
-  sess = trim(substr(rest, 1, q - 1)); rest = trim(substr(rest, q + 1))
-  a = index(sess, "@")
-  uuid = (a ? substr(sess, 1, a - 1) : sess)
-  ws   = (a ? substr(sess, a + 1) : "")
-  # The UTC is matched by SHAPE. Taking it up to the next comma would be
-  # wrong for any line whose object is followed by nothing at all. The
-  # seconds are optional: the register carries `…T20:31Z` lines from before
-  # this helper existed, and refusing to read one loses a hold.
-  if (match(rest, /^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9](:[0-9][0-9])?Z/) == 0) { bad("no YYYY-MM-DDTHH:MM[:SS]Z"); next }
-  utc = substr(rest, RSTART, RLENGTH)
-  rest = substr(rest, RSTART + RLENGTH)
-  if (substr(rest, 1, 1) != ",") { bad("no \",\" and object after the UTC"); next }
-  rest = trim(substr(rest, 2))
-  # The object token contains no space and no comma, so it ends at the first
-  # space — which is what makes the payload unambiguous however it is spelled.
-  sp = index(rest, " ")
-  if (sp == 0) { obj = rest; rest = "" }
-  else         { obj = substr(rest, 1, sp - 1); rest = substr(rest, sp + 1) }
-  ref = ""; payload = ""; txt = ""
-  # Every test below is a REGEX, never a substr() width: RSTART and RLENGTH
-  # are in whatever unit the locale counts in, and they agree with each other.
-  # A hard-coded 4 for "— " does not, and gawk counts characters.
-  if (rest != "") {
-    if (match(rest, /^— /)) { txt = trim(substr(rest, RSTART + RLENGTH)) }
-    else {
-      if (match(rest, / — /)) { txt = trim(substr(rest, RSTART + RLENGTH)); rest = trim(substr(rest, 1, RSTART - 1)) }
-      if (match(rest, /^→ /))      { ref = "→"; payload = trim(substr(rest, RSTART + RLENGTH)) }
-      else if (match(rest, /^← /)) { ref = "←"; payload = trim(substr(rest, RSTART + RLENGTH)) }
-      else { payload = trim(rest) }
-    }
-  }
-  if (FL == "") FL = filelane()
-  if (FL != "") {
-    # THE LANE-KIND OBJECT IS THE WRITING LANE AND NOTHING ELSE (Amendment
-    # 7(b)), so it follows the same rule: `lane:<old>` in a renamed lane-s own
-    # log is that lane under the name it had, and `who lane:<name>` asks
-    # `canon_object` -> `canon_lane` of the name it was given, which lands on
-    # the same answer from the other side.
-    lane = FL
-    if (substr(obj, 1, 5) == "lane:") obj = "lane:" FL
-  }
-  printf "%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%d\n", utc, 31, lane, 31, verb, 31, uuid, 31, ws, 31, obj, 31, ref, 31, payload, 31, txt, 31, (FN != "" ? FN : FILENAME), 31, FNR
-}
-END { if (nbad > 0) printf "%d unreadable line(s) above — an append-only log is never rewritten, so a line no parser reads is a hold no tool will mention again\n", nbad > "/dev/stderr" }'
-
-parse_log_stream() { awk -v FN="${1:-}" "$LOG_AWK"; }
-
-log_files() {
-  for le_f in "$LANES_LOG_DIR"/*.md; do
-    [ -e "$le_f" ] || continue
-    case "${le_f##*/}" in README.md) continue ;; esac
-    printf '%s\n' "$le_f"
-  done
-}
-
-log_events() {
-  le_files=()
-  if [ "$#" -gt 0 ]; then
-    le_files=("$@")
-  else
-    while IFS= read -r le_f; do [ -n "$le_f" ] && le_files+=("$le_f"); done <<EOF
-$(log_files)
-EOF
-  fi
-  [ "${#le_files[@]}" -gt 0 ] || return 0
-  awk -v FN="" "$LOG_AWK" "${le_files[@]}"
-}
-
-# Is there an `origin/<branch>` to read from at all? Outside a repository, and
-# under the LANES_NO_GIT=1 harness, there is not, and the working tree is all
-# there is.
-have_remote_ref() {
-  [ "$NO_GIT" = 1 ] && return 1
-  git -C "$LANES_REPO" rev-parse --verify -q "origin/$LANES_BRANCH" >/dev/null 2>&1
-}
-
-# The same events, read from `origin/<branch>` instead of the working tree.
-# EVERY state read goes through state_events() below, which reads THIS: what
-# has LANDED is what other lanes can see, and a working tree can be anything —
-# behind by a peer's whole day, or carrying a line that never lands.
-remote_log_events() {
-  # AMENDMENT 14 — under `--index`, the index's events of every log, in the
-  # order and the grammar this function prints them in, and the warnings
-  # `LOG_AWK` would have printed for the lines it could not read.
-  if [ -n "$LANES_IDX_DIR" ]; then
-    cat -- "$LANES_IDX_DIR/warn" >&2 2>/dev/null || :
-    cat -- "$LANES_IDX_DIR/events"
-    return 0
-  fi
-  [ "$NO_GIT" = 1 ] && { log_events; return 0; }
-  git -C "$LANES_REPO" rev-parse --verify -q "origin/$LANES_BRANCH" >/dev/null 2>&1 || { log_events; return 0; }
-  # A LOG THE TREE NAMES AND `show` CANNOT READ IS SAID, by path (#138 item
-  # 11). The parser's status is the pipeline's, so the failure left no trace:
-  # the lane simply had no lines, which the listing reads as DORMANT. The line
-  # reaches the person through `state_events`' warnings, and `lanes_rows` reads
-  # it back out of that file by its fixed prefix.
-  # AND A LIST OF THE LOGS THAT COULD NOT BE MADE IS SAID THE SAME WAY (the
-  # review of #289, SHOULD-1(a)). Piped straight into the loop, a failed
-  # `ls-tree` was no logs at all: every lane lost its events - its `dir` among
-  # them - in silence. `worktree_rows` reads this line back out of the same
-  # warnings, and because the events are built once per process, it speaks for
-  # the very read every lane's `dir` came from.
-  rl_list=""
-  if ! rl_list="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null)"; then
-    note "unlisted logs: $LANES_LOG_PREFIX on origin/$LANES_BRANCH — git could not list them, so no log's lines are in this read"
-    return 0
-  fi
-  printf '%s\n' "$rl_list" \
-  | while IFS= read -r rf; do
-      [ -n "$rf" ] || continue
-      case "${rf##*/}" in README.md) continue ;; esac
-      git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$rf" 2>/dev/null | parse_log_stream "$rf"
-      [ "${PIPESTATUS[0]}" = 0 ] || note "unreadable log: $rf — git could not read it, so none of its lines are in this read"
-    done
-}
-
-# THE SOURCE OF EVERY STATE READ. Cached for the life of one invocation,
-# because `who` on a held object asks for it eight or nine times (the state
-# scan, the superseded filter once per holder, staleness twice, the crossing
-# check) and reading it is 45 `git show`s. Any write flushes it: `claim`
-# rescans after its rebase, and the ref has moved by then.
-SE_CACHE_FILE="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-events.XXXXXX" 2>/dev/null || printf '')"
-# THE BUILD'S WARNINGS OUTLIVE THE BUILD, AND THAT IS NOT A CONVENIENCE.
-# `LOG_AWK` writes `unreadable: <file>:<line>` and its count to stderr WHILE the
-# stream is parsed — so they were emitted by whichever caller happened to build
-# the cache first, and lost entirely when that caller was a command substitution
-# with `2>/dev/null`. That was always true and never mattered, because the
-# first builder in `who` was a call whose stderr reached the person. Ruling 12's
-# one-pass listing moved the first build into exactly such a substitution — the
-# `lr_facts` render — and the whole warning vanished from `who --lane`, caught
-# by the two assertions that exist for it.
-#
-# So the build's stderr is CAPTURED beside the cache and replayed once per
-# shell. `SE_WARNED` is deliberately a plain variable: a subshell that replays
-# into `/dev/null` sets it only in ITSELF, so the parent still warns at its own
-# first call — which is the call whose stderr a person is reading. An
-# append-only log is never rewritten, so a line no parser reads is a hold no
-# tool will mention again: this warning is the only notice there is.
-SE_WARN_FILE="${SE_CACHE_FILE:+$SE_CACHE_FILE.warn}"
-SE_WARNED=0
-state_events_warn() {
-  [ "$SE_WARNED" = 1 ] && return 0
-  [ -n "$SE_WARN_FILE" ] && [ -s "$SE_WARN_FILE" ] || return 0
-  SE_WARNED=1
-  cat -- "$SE_WARN_FILE" >&2
-  return 0
-}
-state_events() {
-  if [ -z "$SE_CACHE_FILE" ]; then remote_log_events; return 0; fi
-  if [ ! -s "$SE_CACHE_FILE" ]; then
-    # BUILT ATOMICALLY, because `claim` asks for this from both ends of one
-    # pipeline: `state_events | lane_states_on | holders_of`, and holders_of
-    # calls superseded_by, which asks again while the first read is still
-    # writing. A half-written cache read as a whole one loses lines, and a
-    # lost line is a hold that has vanished. Write to a per-subshell name and
-    # rename: a reader then sees either the empty file (and builds its own) or
-    # the finished one, never half of it.
-    se_t="$SE_CACHE_FILE.${BASHPID:-$$}"
-    remote_log_events > "$se_t" 2> "$se_t.warn"
-    mv -f -- "$se_t.warn" "$SE_WARN_FILE" 2>/dev/null || rm -f -- "$se_t.warn"
-    mv -f -- "$se_t" "$SE_CACHE_FILE" 2>/dev/null || { state_events_warn; cat -- "$se_t"; rm -f -- "$se_t"; return 0; }
-  fi
-  state_events_warn
-  cat -- "$SE_CACHE_FILE"
-}
-state_events_flush() {
-  [ -n "$SE_CACHE_FILE" ] && : > "$SE_CACHE_FILE"
-  # The warnings belong to the stream that was parsed; a flush means it is
-  # parsed again, so they are said again.
-  [ -n "$SE_WARN_FILE" ] && : > "$SE_WARN_FILE"
-  SE_WARNED=0
-  return 0
-}
-
-# One lane's own events, and whether that lane has a log at all — from
-# `origin/<branch>` for the same reason. A lane whose log exists only in this
-# working tree has not published anything, and a lane whose log exists only on
-# `origin` is a lane this checkout has not pulled: the second is the case that
-# matters and the one that used to read as "pre-cutover".
-#
-# AMENDMENT 15 — AND THE FILE IS FOUND WHATEVER ITS CASE. A lane whose log was
-# written under another spelling has not lost its history the moment its row's
-# spelling becomes canonical; the first write renames the file, and until then
-# every reader finds it.
-#
-# BOTH HALVES ASK `log_path_ci`, AND A `head -n1` IS NOT AN ANSWER (Copilot round
-# 4 on openRepoTools#41). The working-tree branch took the first of the
-# case-insensitive matches exactly as the published lookup did, so two local
-# files made a read-only caller decide a lane's resume, its profile and its state
-# out of half its history — silently, while the WRITER treats that same state as
-# ambiguous and refuses. One resolver now answers both, and its 2 is carried:
-# `lane_log_exists` spends it rather than 1, so "there are two logs" is never
-# read as "there is no log".
-lane_log_events() {
-  ll_rel="$(log_path_ci "$1")" || return 2
-  if [ -n "$LANES_IDX_DIR" ]; then
-    # A LOG THE INDEX DOES NOT HOLD IS A LOG `origin` DID NOT HOLD at the
-    # indexed commit: no lines, exactly as a `git show` of a missing path.
-    command grep -Fqx -- "$ll_rel" "$LANES_IDX_DIR/logs" 2>/dev/null || return 0
-    awk -F"$US" -v p="$ll_rel" '$10 == p' "$LANES_IDX_DIR/events"
-    # THAT LOG'S WARNINGS AND THE COUNT THAT CLOSES THEM (opensoft/openRepoTools#166
-    # item 3): the source read runs LOG_AWK over this one file, whose END says
-    # how many lines it could not read. The export writes that line after each
-    # log's own warnings, so it is the line straight after this log's last one.
-    awk -v p="unreadable: $ll_rel:" '
-      index($0, p) == 1 { print; mine = 1; next }
-      mine && /^[0-9]+ unreadable line[(]s[)] above/ { print }
-      { mine = 0 }' "$LANES_IDX_DIR/warn" >&2 2>/dev/null || :
-    return 0
-  elif have_remote_ref; then
-    git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$ll_rel" 2>/dev/null | parse_log_stream "$ll_rel"
-  else
-    ll_f="$LANES_LOG_DIR/${ll_rel##*/}"
-    [ -f "$ll_f" ] || return 0
-    log_events "$ll_f"
-  fi
-}
-lane_log_exists() {
-  lle_rel="$(log_path_ci "$1")" || return 2
-  if [ -n "$LANES_IDX_DIR" ]; then
-    command grep -Fqx -- "$lle_rel" "$LANES_IDX_DIR/logs" 2>/dev/null
-  elif have_remote_ref; then
-    git -C "$LANES_REPO" cat-file -e "origin/$LANES_BRANCH:$lle_rel" 2>/dev/null
-  else
-    [ -f "$LANES_LOG_DIR/${lle_rel##*/}" ]
-  fi
-}
-
-# The register, read the same way — `who --landing` is a state read about a
-# merge hold other lanes are holding their merges for, so it must see what
-# landed rather than what this checkout happens to have pulled.
-# CACHED FOR THE LIFE OF ONE PROCESS, and Amendment 11's listing is the reason.
-# The published register is a 1 MB file and this is a `git show` of it; every
-# `row_of_lane`, `lane_named_ci`, `lane_of_session` and `lane_workstation` call
-# makes one. A single lane's act makes a handful and nobody noticed — but
-# `lanes` asks about EVERY lane in the register, so the same megabyte was being
-# re-rendered dozens of times for one listing a person is waiting on.
-#
-# IT IS SAFE BECAUSE NOTHING INSIDE ONE INVOCATION MOVES IT. `origin/<branch>`
-# is advanced by `log_sync`, which every subcommand runs BEFORE it reads, and by
-# `commit_push`, which runs AFTER the last read of a write path — so the ref a
-# process reads is fixed for as long as that process reads it. The one act that
-# would break that assumption is a second `log_sync` mid-read, and there is
-# none; `log_sync` clears this cache anyway, so a caller that adds one gets the
-# fresh answer rather than a stale one.
-# AND IN A FILE AS WELL AS A VARIABLE (A11 Addendum 4 ruling 12). The variable
-# serves one shell; every caller of `row_of_lane`, `lane_workstation` and
-# `session_ids_of_lane` reaches it through `$( … )`, which is a SUBSHELL, so the
-# variable cache was rebuilt — a `git show` of 1.1 MB — by all four of the
-# per-lane reads the listing makes, for every lane. The file survives the
-# subshell that wrote it, so the megabyte is rendered once per process.
-#
-# AND THE READ SAYS WHETHER IT HAPPENED (opensoft/openRepoTools#67).
-# `register_text_checked` is the read itself: 0 with the register on stdout, and
-# 1 where the published `git show` or the working tree's `cat` FAILED — what it
-# prints then is whatever that read printed, so `register_text` renders a failed
-# read exactly as it always did, and it is not an answer. `register_text` is the
-# same read with the status thrown away, as it always was, because its callers
-# are pipelines whose `awk` answers for them and rewriting all of them is not
-# this change. The three callers for which an empty register is a VERDICT ask
-# the checked read through `session_ids_checked` below.
-#
-# A FAILED READ IS NEVER CACHED, in the variable or in the file. It used to be:
-# the empty render went into both, so the first caller to meet a failed read —
-# `canon_lane`, which `claim` and `duplicate-holder` both run first — left every
-# later read in the process an empty register with no failure left to report,
-# and a checked read behind it would have been reading that cache instead of the
-# register. The next read asks again, and gets the same failure or the register.
-LANES_REGISTER_CACHE=""
-register_text_checked() {
-  # AMENDMENT 14 — under `--index`, the register's rows and its Rule 6 and
-  # Amendment 10 lines as the index holds them, in register order. Not cached:
-  # it is one local file, and the cache below belongs to the published read.
-  if [ -n "$LANES_IDX_DIR" ]; then cat -- "$LANES_IDX_DIR/register"; return; fi
-  if [ -n "$LANES_REGISTER_CACHE" ]; then printf '%s\n' "$LANES_REGISTER_CACHE"; return 0; fi
-  rt_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.register}"
-  if [ -n "$rt_c" ] && [ -s "$rt_c" ]; then cat -- "$rt_c"; return; fi
-  rt_txt=""; rt_rc=0
-  # WHETHER THE REGISTER IS PUBLISHED IS `register_published`'s answer, the
-  # tree's (#138 item 18, the review of #230): asked with `cat-file -e`, a
-  # missing or corrupt blob was "not published" and this checkout's copy was
-  # read in its place — an answer, where #67's rule above makes it a 1.
-  rt_prc=0; register_published || rt_prc=$?
-  case "$rt_prc" in
-    0) rt_txt="$(git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$LANES_PATH" 2>/dev/null)" || rt_rc=$? ;;
-    8) rt_txt="$(cat -- "$LANES_FILE")" || rt_rc=$? ;;
-    *) rt_rc=1 ;;
-  esac
-  if [ "$rt_rc" != 0 ]; then
-    printf '%s\n' "$rt_txt"
-    return 1
-  fi
-  LANES_REGISTER_CACHE="$rt_txt"
-  if [ -n "$rt_c" ]; then
-    printf '%s\n' "$LANES_REGISTER_CACHE" > "$rt_c.${BASHPID:-$$}" 2>/dev/null &&
-      mv -f -- "$rt_c.${BASHPID:-$$}" "$rt_c" 2>/dev/null ||
-      rm -f -- "$rt_c.${BASHPID:-$$}"
-  fi
-  printf '%s\n' "$LANES_REGISTER_CACHE"
-}
-register_text() { register_text_checked || :; }
-
-# IS THE REGISTER PUBLISHED? 0 yes, 8 no (or there is no `origin/<branch>`), 1
-# the tree could not be listed. THE TREE ANSWERS AND NEVER THE BLOB (#138 item
-# 18, the review of #230): `cat-file -e` fails for a blob that is missing or
-# corrupt exactly as for a path origin does not have, so a register origin has
-# and git could not read was "not published", and `register_text` answered with
-# this checkout's copy — the seam, `next-free` and `add-row` all read that as
-# the published register. `retire_rows` asks a lane's log the same way (item 17).
-# THE PATH IS AN ARGUMENT, the register's by default: `archive_text` asks it of
-# the archive, which had the same `cat-file -e` and the same fallback.
-register_published() {   # [<path relative to LANES_REPO>]
-  have_remote_ref || return 8
-  rp_tree=""
-  rp_tree="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "${1:-$LANES_PATH}" 2>/dev/null)" || return 1
-  [ -n "$rp_tree" ] || return 8
-  return 0
-}
-
-# ------------------------- AMENDMENT 19(d): THE ARCHIVE IS PART OF THE READ
-#
-# `archive-rows <repo>` moves a repository's RETIRED rows out of the register
-# and into `lanes/archive/LANES-retired.md`, and the amendment is explicit about
-# who follows them: *"every reader of the next free position and `lanes
-# --closed` read the archive too"*. So the archive is read exactly as the
-# register is — `origin/<branch>` first (R19), this checkout second — and its
-# ABSENCE IS SILENCE: a register nobody has archived from has no such file, and
-# that is the ordinary case rather than an error.
-#
-# It is NOT cached the way `register_text` is: this file is the small one (the
-# rows nobody reads day to day), and a write that rescans it after its rebase
-# (`add-row`'s `retired_identity_hits`) must read it as it now stands, which a
-# cache kept for the process would not. ONE LISTING PINS IT, and only for its
-# own reads: `worktree_rows` reads the archive once, and where that read
-# succeeded, `PIN_ARCHIVE` hands its text to every read of the listing it then
-# makes - so the archive the listing names lanes from IS the one it checked (the
-# review of opensoft/openRepoTools#289, SHOULD-1(b): a read that failed only
-# after the check left the archive's lanes out of a listing taken as whole).
-LANES_ARCH_NAME="LANES-retired.md"
-LANES_ARCH_PATH="${LANES_ARCH_PATH:-${LANES_PREFIX}archive/$LANES_ARCH_NAME}"
-LANES_ARCH_FILE="${LANES_ARCH_FILE:-$LANES_DIR/archive/$LANES_ARCH_NAME}"
-PIN_ARCHIVE=0
-PIN_ARCHIVE_TEXT=""
-archive_text() {
-  if [ "$PIN_ARCHIVE" = 1 ]; then printf '%s' "$PIN_ARCHIVE_TEXT"; return 0; fi
-  # AMENDMENT 14 — under `--index`, the archive's rows where the indexed commit
-  # carried an archive; where it carried none, the same local fallback below.
-  if [ -n "$LANES_IDX_DIR" ] && [ -f "$LANES_IDX_DIR/archive" ]; then cat -- "$LANES_IDX_DIR/archive"; return 0; fi
-  # A published archive that cannot be rendered cannot be replaced with a
-  # possibly stale local copy: that copy may omit a retired position. WHETHER
-  # IT IS PUBLISHED IS THE TREE'S ANSWER (the re-review of #230): asked with
-  # `cat-file -e`, an archive blob git could not read was "not published", the
-  # local copy answered, and a retired position was offered and reissued.
-  if [ -z "$LANES_IDX_DIR" ]; then
-    at_prc=0; register_published "$LANES_ARCH_PATH" || at_prc=$?
-    case "$at_prc" in
-      0) if git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$LANES_ARCH_PATH" 2>/dev/null; then return 0; fi
-         note "the published $LANES_ARCH_PATH exists but could not be read — a local copy cannot prove it contains every published retired position"
-         return 1 ;;
-      8) : ;;
-      *) note "the tree of origin/$LANES_BRANCH could not be listed, so whether $LANES_ARCH_PATH is published is not known — and a local copy cannot stand in for it"
-         return 1 ;;
-    esac
-  fi
-  # AND THE LOCAL COPY IS THE SAME RULE ONE RUNG DOWN: a file that is THERE and
-  # will not open is a read that FAILED, and its rows hold positions. Saying
-  # nothing here would put a retired `<repo>-<n>` back on offer.
-  archive_local_text
-}
-
-# THIS CHECKOUT'S ARCHIVE: its text, nothing where there is none, and 1 where
-# the path is THERE AND IS NOT A REGULAR FILE (#138 item 7) as well as where it
-# will not open. Asked with `-f` alone, a directory, a FIFO or a broken symlink
-# read as no archive and its retired positions came back on offer; `cat` on the
-# FIFO would have blocked besides. `archive_text`'s last rung and
-# `retired_identity_hits`' second read are both this.
-archive_local_text() {
-  if [ -f "$LANES_ARCH_FILE" ]; then
-    cat -- "$LANES_ARCH_FILE" 2>/dev/null || return 1
-  elif [ -e "$LANES_ARCH_FILE" ] || [ -L "$LANES_ARCH_FILE" ]; then
-    note "$LANES_ARCH_PATH is there and is not a regular file, so the retired positions it should hold cannot be read"
-    return 1
-  fi
-  return 0
-}
-
-# A retired name OR its numeric position is unavailable, even when a recut
-# suffix changes the spelling. Inspect both published and unpushed archives.
-#
-# A LINE THE SCAN CANNOT TAKE APART IS A REFUSAL, NOT A NON-ROW (#122, Copilot
-# round 6 on #93). The scan skipped every `|` line with no backticked token, and
-# took the first backtick ANYWHERE in a line as its lane, so a retired row whose
-# lane cell a hand edit or a bad merge had mangled — `| repoX-4 | harness `<id>`
-# | …` — dropped out of the answer and add-row reissued its position: 19(b)'s
-# guarantee failing open. Every `|` line of the archive is now one of three:
-#
-#   * THE RULE: `|`, `-`, `:` and blanks only, with at least one dash;
-#   * THE HEADER: its first cell is the word `lane`, as in the header
-#     `archive_rows` writes. It is NOT found as "the line above the rule": the
-#     live register carried two rows between its header and its rule on
-#     2026-10-19, so a hand edit can part the two, and refusing a header for it
-#     would make add-row refuse on the path that creates every lane. Nor is it
-#     found by counting ` | `: the header carries six, exactly as a row does;
-#   * A ROW: its first backticked token lies wholly inside its FIRST cell. That
-#     is the token every reader here takes as the lane, `*(unnamed)* `<lane>``
-#     included (three live rows are spelled that way).
-#
-# Any other `|` line is printed with its line number, and this returns 3: a row
-# nobody can read may be the very lane being added. AND THE SCAN'S OWN STATUS
-# IS READ. The scan's status used to be that of the `sort -u` behind it, so an
-# awk that FAILED read as "no archived row matched".
-#
-# EACH LINE NUMBER NAMES ITS COPY (the review of #263, NIT 4). Both copies are
-# scanned, and where the published archive and this checkout's differ, one bad
-# line had two numbers and no word on which file either was in.
-RETIRED_ROWS_AWK='
-  function key(n,   h, p) {
-    p = n; sub(/^.*-/, "", p); sub(/[A-Za-z]$/, "", p)
-    h = n; sub(/-[^-]*$/, "", h)
-    if (h == n || p !~ /^[0-9]+$/) return ""
-    return tolower(h) "-" (p + 0)
-  }
-  BEGIN { wk = key(want) }
-  substr($0, 1, 1) == "|" {
-    if ($0 ~ /^[|][-:| \t]*$/ && index($0, "-")) next
-    c = substr($0, 2); s = index(c, " | "); if (s) c = substr(c, 1, s - 1)
-    h = c; sub(/^[ \t]+/, "", h); sub(/[ \t|]+$/, "", h)
-    if (tolower(h) == "lane") next
-    p1 = index(c, "`"); p2 = p1 ? index(substr(c, p1 + 1), "`") : 0
-    if (!p1 || p2 < 2) { printf "M%s%d%s%s\n", sep, NR, sep, $0; next }
-    t = substr(c, p1 + 1, p2 - 1)
-    if (tolower(t) == tolower(want) || (wk != "" && key(t) == wk)) printf "H%s%s\n", sep, t
-  }'
-retired_identity_hits() { # <lane>; stdout: matching retired spellings · 1 not read · 3 a line not a row
-  ri_lane="$1"
-  ri_pub="$(archive_text 2>/dev/null)" || return 1
-  ri_local=""
-  ri_local="$(archive_local_text 2>/dev/null)" || return 1
-  ri_scan=""
-  ri_scan="$(printf '%s\n' "$ri_pub" | awk -v want="$ri_lane" -v sep="$US" "$RETIRED_ROWS_AWK")" || return 1
-  ri_scan2=""
-  ri_scan2="$(printf '%s\n' "$ri_local" | awk -v want="$ri_lane" -v sep="$US" "$RETIRED_ROWS_AWK")" || return 1
-  # WHICH COPY `archive_text` ANSWERED WITH: the index's under `--index`, else
-  # origin's where the tree publishes one, else this checkout's (its own rungs,
-  # read the same way; a read that failed has already returned 1 above).
-  ri_from="this checkout"
-  if [ -n "$LANES_IDX_DIR" ]; then
-    [ -f "$LANES_IDX_DIR/archive" ] && ri_from="the index"
-  elif register_published "$LANES_ARCH_PATH" >/dev/null 2>&1; then
-    ri_from="origin/$LANES_BRANCH"
-  fi
-  ri_bad=""
-  ri_bad="$( { printf '%s\n' "$ri_scan" | awk -v sep="$US" -v w="$ri_from" 'substr($0, 1, 2) == "M" sep { print w sep substr($0, 3) }'
-               printf '%s\n' "$ri_scan2" | awk -v sep="$US" -v w="this checkout" 'substr($0, 1, 2) == "M" sep { print w sep substr($0, 3) }'; } |
-    awk -F"$US" '{ k = $2 FS $3
-                   if (!(k in w)) { o[++n] = k; w[k] = $1 } else if (w[k] != $1) w[k] = w[k] " and " $1 }
-                 END { for (i = 1; i <= n; i++) { split(o[i], p, FS); print "line " p[1] " (" w[o[i]] "): " p[2] } }')" || return 1
-  if [ -n "$ri_bad" ]; then
-    note "$LANES_ARCH_PATH carries a table line that is neither its header, its rule, nor a row whose first cell holds its lane in backticks (each named with the copy it is in):"
-    printf '%s\n' "$ri_bad" | sed -e 's/^/lanes-edit:   /' >&2
-    return 3
-  fi
-  ri_hits=""
-  ri_hits="$(printf '%s\n%s\n' "$ri_scan" "$ri_scan2" |
-    awk -v sep="$US" 'substr($0, 1, 2) == "H" sep { print substr($0, 3) }')" || return 1
-  [ -z "$ri_hits" ] || printf '%s\n' "$ri_hits" | LC_ALL=C sort -u
-}
-
-# EVERY REFUSAL HERE TAKES ITS ROW BACK, not only the retired match (the review
-# of #263, M1). This runs after `pull --rebase`, so the add-row is already a
-# local commit on top of the peer's archive. A refusal that only returned left
-# that commit at HEAD, and the next unrelated write from this checkout pushed
-# it: measured, a peer's archive line this scan could not take apart during
-# add-row's pull gave exit 1, then `set-row-state` published the row it had
-# refused. A read that failed and a line that is not a row are refusals of the
-# same row as a retired match is, so all three run the same compensation.
-add_row_retirement_rescan() {
-  ar_rebased_rc=0
-  ar_rebased_hits="$(retired_identity_hits "$ADD_ROW_LANE")" || ar_rebased_rc=$?
-  if [ "$ar_rebased_rc" != 0 ]; then
-    ar_why="the archive could not be read after rebase, or it carries a line that is not a row (above), so whether lane $ADD_ROW_LANE was retired meanwhile is not known"
-    ar_subject="cancel add-row whose retirement could not be checked after rebase"
-    ar_back=1
-  elif [ -n "$ar_rebased_hits" ]; then
-    ar_why="lane $ADD_ROW_LANE was retired by a peer before this add-row could push (archive: $(printf '%s' "$ar_rebased_hits" | tr '\n' ' '))"
-    ar_subject="cancel add-row rejected by peer retirement"
-    ar_back=2
-  else
-    return 0
-  fi
-  # Leaving the rejected add-row at HEAD would let the next unrelated registry
-  # write push it. Remove ONLY this invocation's exact appended line and commit
-  # that compensation locally; any swept pre-existing edit stays intact.
-  #
-  # AND ONLY A ROW THIS CHECKOUT STILL ADDS IS ITS OWN TO TAKE BACK (the delta
-  # review of #263, D1). A peer that published the byte-identical row first
-  # makes `pull --rebase` DROP this add-row's commit as already upstream, and
-  # the one copy left in the register is then the peer's: the exact-line grep
-  # found it and deleted it, and the next write published that deletion
-  # (measured: the peer's row gone from origin). So the copy taken back is the
-  # one this checkout's register adds over origin/$LANES_BRANCH's, read from
-  # their diff by content — which is what a surviving add-row commit is, under
-  # whatever sha the rebase gave it, and whatever local commits sit beside it.
-  # None added: nothing of this add-row's is left, and nothing is taken back.
-  # One: that line, wherever an identical peer copy sits. More than one, or a
-  # diff that cannot be read: not this act's to guess, and said so.
-  # "origin already has the row" would be wrong the other way: an add-row
-  # commit that SURVIVED beside a peer's identical row at another place would
-  # be kept, and published by the next write as a second copy.
-  #
-  # AND THE LINE IS COUNTED WHATEVER CONTEXT THE DIFF CARRIES (the delta review
-  # of #263, S3). `-U0` does not hold on its own: a `GIT_DIFF_OPTS=-u3` in the
-  # environment overrides it outright, and a user's `diff.interHunkContext`
-  # fuses two nearby changes into one hunk with the lines between them as
-  # context. The parse counted only `+` lines, so a hunk carrying context put
-  # the row at the wrong line, the line check refused, nothing was taken back,
-  # and the next ordinary write published the row add-row had refused (M1
-  # again; measured with each of the two). So both: this one diff runs with
-  # `GIT_DIFF_OPTS` unset and `diff.interHunkContext=0` (a `-c` on the command
-  # line outranks every config file and `GIT_CONFIG_*` in the environment), and
-  # the parse advances its new-file line on every line of a hunk but a removed
-  # one (`-`) or git's "\ No newline" note, so whatever context still arrives
-  # is counted where it stands. The `unset` is inside the command
-  # substitution's own subshell, and so touches nothing after it.
-  #
-  # AND IT IS READ AS TEXT (delta review 4 of #263, S4). Where git classes the
-  # register as binary, the diff is one line, "Binary files … differ", with no
-  # hunk to read: a `binary` or `-diff` attribute, published or local, a diff
-  # driver with `binary=true`, `core.attributesFile`, `GIT_ATTR_SOURCE`,
-  # `attr.tree`, a NUL byte in its first 8000 bytes, or a `core.bigFileThreshold`
-  # below its size (the live register is over 2 MB). add-row then said this
-  # checkout added no copy of the row, kept its commit, and the next write
-  # published the row (measured with each). `--text` gives the hunks whatever
-  # classes the register.
-  ar_diff="$(unset GIT_DIFF_OPTS; git --no-replace-objects --no-pager -C "$LANES_REPO" -c "$CP_EXACT" -c diff.interHunkContext=0 diff --no-color --no-ext-diff --no-textconv --text -U0 "refs/remotes/origin/$LANES_BRANCH" -- "$LANES_PATH" 2>/dev/null)" || {
-    note "$ar_why; and this checkout's register could not be compared with origin/$LANES_BRANCH's, so whether a copy of the rejected row here is this add-row's or a peer's is not known. Nothing was taken back: read \`git -C $LANES_REPO log -p origin/$LANES_BRANCH..HEAD -- $LANES_PATH\` and remove this add-row's row before any later push"
-    return 1
-  }
-  ar_lines="$(printf '%s\n' "$ar_diff" | AR_ROW="$ADD_ROW_TEXT" LC_ALL=C awk '
-    /^@@ / { h = $0; sub(/^@@ -[0-9,]+ [+]/, "", h); sub(/[ ,].*$/, "", h); n = h + 0; inh = 1; next }
-    !inh { next }
-    { c = substr($0, 1, 1) }
-    c == "-" || c == "\\" { next }
-    c == "+" && substr($0, 2) == ENVIRON["AR_ROW"] { print n }
-    { n++ }
-  ')" || {
-    note "$ar_why; and the diff of this checkout's register against origin/$LANES_BRANCH's could not be read, so nothing was taken back: remove this add-row's row before any later push"
-    return 1
-  }
-  case "$ar_lines" in
-    '')
-      if git --no-replace-objects --no-pager -C "$LANES_REPO" show "refs/remotes/origin/$LANES_BRANCH:$LANES_PATH" 2>/dev/null | command grep -qFx -- "$ADD_ROW_TEXT"; then
-        note "$ar_why. origin/$LANES_BRANCH already carries this exact row, published by a peer, and the rebase dropped this add-row's commit as already upstream: this checkout adds no copy of it, so there is nothing of this add-row's to take back and the peer's row is left as it is."
-      else
-        note "$ar_why. This checkout's register carries no copy of the row that origin/$LANES_BRANCH's does not, so there is nothing of this add-row's to take back."
-      fi
-      return "$ar_back" ;;
-    *$'\n'*)
-      note "$ar_why; and this checkout's register adds more than one exact copy of the rejected row over origin/$LANES_BRANCH's, so which is this add-row's is not known and none was taken back: the local add-row commit must be repaired before any later push"
-      return 1 ;;
-  esac
-  ar_line="$ar_lines"
-  [ "$(sed -n "${ar_line}p" "$LANES_FILE" 2>/dev/null)" = "$ADD_ROW_TEXT" ] || {
-    note "$ar_why; and line $ar_line of $LANES_FILE, where the diff puts the rejected row, does not hold it exactly, so nothing was taken back: the local add-row commit must be repaired before any later push"
-    return 1
-  }
-  # A REFUSAL OF THE TAKE-BACK ITSELF SAYS ADD-ROW'S TRUTH (the delta review of
-  # #263, NIT): `delete_lines`' own sentences are archive-rows' — "the rows are
-  # in the archive", "the archive may have been appended" — and false here.
-  REG_COMMITTED_HERE="this act HAS committed its row for lane $ADD_ROW_LANE, locally and unpushed"
-  DL_SAYS_UNCHANGED="no row was removed, so that row is still in it and in that commit. Remove it from $LANES_PATH and commit that before any other write in $LANES_REPO, because the next one would publish it"
-  DL_SAYS_AFTER_WRITE="Its row for lane $ADD_ROW_LANE was not taken back, and this act HAS committed it, locally and unpushed: with the register whole, remove that row from $LANES_PATH and commit that before any other write in $LANES_REPO, because the next one would publish it."
-  delete_lines "$ar_line"
-  REG_COMMITTED_HERE=""; DL_SAYS_UNCHANGED=""; DL_SAYS_AFTER_WRITE=""
-  # A REMOVAL THAT CANNOT BE COMMITTED SAYS SO (delta review 4 of #263, N3).
-  # These returned in silence: the removal was left written or staged under
-  # add-row's commit, and the next write's own commit carried it, under its
-  # own caption, with no one told.
-  ar_msg="LANES($ADD_ROW_LANE@$WS): $ar_subject"
-  ar_fix="add-row's commit still holds the row. Commit the removal before any other write in $LANES_REPO, so that write does not carry it under its own caption: \`git -C $LANES_REPO commit -m '$ar_msg' -- $LANES_PATH\`"
-  git -C "$LANES_REPO" -c "$CP_EXACT" add -- "$LANES_PATH" || {
-    note "$ar_why; the rejected row was removed from $LANES_FILE, but staging that removal failed, so it is only in the working tree, and $ar_fix"
-    return 1
-  }
-  git -C "$LANES_REPO" -c "$CP_EXACT" commit -q -m "$ar_msg" -- "$LANES_PATH" || {
-    note "$ar_why; the rejected row was removed from $LANES_FILE and that removal is staged, but its compensating commit failed, so $ar_fix"
-    return 1
-  }
-  note "$ar_why; the rejected row was removed in a compensating LOCAL commit, so no later write publishes it. Neither commit was pushed."
-  return "$ar_back"
-}
-
-# Each lane's LAST line on <object>, as
-#   utc  lane  verb  uuid  ws  object  ref  payload  text  file  line
-#
-# R14 — "LAST" IS THE LAST LINE IN THE FILE, and never the largest UTC. One
-# lane's log is append-only and single-writer, so its line order IS that lane's
-# write order; a clock is not. It was a max-UTC read here that made a LANDED
-# invisible behind the LANDING it closed, on the day this workstation's clock
-# was jumping ±25s. `pos()` is the line's address — its file and its line
-# number, zero-padded so that one string comparison orders both.
-# AMENDMENT 15 — KEYED ON THE LANE LOWER-CASED. The key decides how many rows
-# come out of here, and the ROW is the whole line, so the spelling a reader sees
-# is still the one the winning line carried. Keyed on the raw `$2`, a lane whose
-# log spells it two ways emitted TWO rows for ONE lane — and `claim`-s rival
-# test, which excludes its OWN row from this set, then met its own earlier
-# CLAIMED as a stranger and refused the lane its own object (Copilot round 1 on
-# openRepoTools#41).
-PER_LANE_AWK='
-function pos(pf, pn) { return pf "\034" sprintf("%09d", pn) }
-BEGIN { FS = sep }
-$6 == o { k = tolower($2); p = pos($10, $11); if (!(k in u) || p >= u[k]) { u[k] = p; L[k] = $0 } }
-END { for (l in u) print L[l] }'
-
-# Ordered by LANE NAME, deliberately. These rows are one line per lane, so
-# nothing about their order is a fact about the object: which lane got there
-# first is LANDING ORDER ON `main` (F13), which `first_landed_of` reads out of
-# git history. This sort used to be on the UTC field, and sorting a set of
-# lanes by their clocks is exactly the comparison R14 removes.
-lane_states_on() {   # <object> [events-producer-output on stdin]
-  awk -v sep="$US" -v o="$1" "$PER_LANE_AWK" | LC_ALL=C sort -t"$US" -k2,2
-}
-
-# The lanes that HOLD <object> — those whose own last line on it is open.
-# Prints  lane  verb  utc  file  line: the last two are the ADDRESS of that
-# lane's own last line, which is what a staleness test needs in order to ask
-# "has this lane written anything BELOW it in its own log" without a clock.
-holders_of() {
-  hf_obj="$1"
-  while IFS="$US" read -r h_utc h_lane h_verb h_uuid h_ws h_o h_ref h_pay h_txt h_file h_line; do
-    [ -n "${h_verb:-}" ] || continue
-    is_open_verb "$h_verb" || continue
-    # A CLAIMED that another lane has since taken over is not a hold.
-    [ -z "$(superseded_by "$hf_obj" "$h_lane" "$h_verb")" ] || continue
-    printf '%s%s%s%s%s%s%s%s%s\n' "$h_lane" "$US" "$h_verb" "$US" "$h_utc" "$US" "$h_file" "$US" "$h_line"
-  done
-}
-
-# A LANE NAME IS NOT A REGULAR EXPRESSION (Copilot round 4 on openRepoTools#41).
-# Every filter of these US-delimited holder rows was `grep "^$lane$US"`, which
-# hands a name straight to a matcher: `check_lane_name` admits `.`, so excluding
-# `repo.a-1` also excludes the REAL rival `repoXa-1`, and `first_landed_of`'s
-# `grep -q` could match a lane that is not in the set at all. A claim decided by
-# that filter is a claim whose winner is whichever name happened to be a pattern
-# — in a race whose whole point is that the arbiter is exact.
-#
-# So the comparison is `awk` on FIELD ONE, `tolower` on both sides, with no
-# pattern anywhere: literal, case-insensitive (Amendment 15) and blind to `.`,
-# `*`, `[` and `^`. `-v` carries one line, which a lane name is.
-rows_not_named() {   # <lane> — every row whose first field is NOT it
-  awk -v sep="$US" -v want="$1" 'BEGIN { FS = sep; w = tolower(want) } tolower($1) != w'
-}
-rows_named() {       # <lane> — every row whose first field IS it
-  awk -v sep="$US" -v want="$1" 'BEGIN { FS = sep; w = tolower(want) } tolower($1) == w'
-}
-
-# Every object this lane's OWN log mentions, with the lane's last verb on it.
-# `lane-end`'s refusal and `who --lane` both read exactly this.
-# Every object this lane's OWN log mentions, with the lane's last verb on it,
-# plus — read from EVERY lane's log — whether another lane has since taken the
-# object over. A lane closes only its own hold, so after someone else's
-# TAKEOVER this lane's last line is still its CLAIMED; without the fifth field
-# `lane-end` would refuse for ever and never say why.
-#   utc  verb  object  ref+payload  superseded-by(lane@utc, or empty)
-lane_objects() {
-  # 8, not 1: "no log file" is an ANSWER. TWO LOGS IS NOT THAT ANSWER, and 2 is
-  # carried through rather than flattened into it (Copilot round 4): `who --lane`
-  # and `lane-end`'s refusal would otherwise report a lane whose history is split
-  # across two files as a pre-cutover lane with no log at all.
-  lo_ex=0
-  lane_log_exists "$1" || lo_ex=$?
-  case "$lo_ex" in
-    0) : ;;
-    2) return 2 ;;
-    *) return 8 ;;
-  esac
-  # AMENDMENT 15 — THE LANE FIELD OF A LOG LINE IS MATCHED CASE-INSENSITIVELY,
-  # and the caller has already resolved `$1` to the row's spelling. The line's
-  # own spelling is whatever was TYPED on the day it was appended, and an
-  # append-only log is never rewritten: `lanes/log/openxfactory-2.md` carries
-  # `lane openXfactory-2` lines from 2026-09-02 and `lane openxfactory-2` lines
-  # from the 23:51:56Z incident, in one file, about one lane. Read byte for
-  # byte, half of that lane's claims are invisible to `who --lane` and to
-  # `lane-end`'s refusal — which is the amendment's own sentence, that a lane
-  # name is compared case-insensitively wherever a name is looked up, and the
-  # OBJECT LOG is one of the places it lists.
-  #
-  # `mel` IS COMPUTED ONCE IN `BEGIN`, not per line: this stream is every line
-  # of every lane's log on the estate.
-  state_events | awk -v sep="$US" -v me="$1" '
-    function pos(pf, pn) { return pf "\034" sprintf("%09d", pn) }
-    BEGIN { FS = sep; mel = tolower(me) }
-    $6 ~ /^lane:/ { next }
-    tolower($2) == mel {
-      if (!($6 in ord)) { ord[$6] = ++n; byn[n] = $6 }
-      p = pos($10, $11)
-      if (!($6 in mp) || p >= mp[$6]) { mp[$6] = p; utc[$6] = $1; verb[$6] = $3; ref[$6] = $7; pay[$6] = $8 }
-    }
-    # EVERY OTHER LANE, ITS OWN LAST LINE on each object, by the same file-order
-    # rule this lane is read by (R14). The verb is kept, not only the TAKEOVERs,
-    # because what decides supersession is whether a TAKEOVER is still the last
-    # word of the lane that wrote it — see the END block.
-    # KEYED ON THE OTHER LANE LOWER-CASED TOO, and its SPELLING carried beside
-    # the key (Amendment 15): two spellings of one taker would otherwise be two
-    # takers, and the one whose last line is a stale CLAIMED could hide the
-    # other-s TAKEOVER. `on[]` keeps the spelling of the line that won the
-    # position test, so what is PRINTED is still a name somebody wrote.
-    # `ot[]` is the lane a TAKEOVER names as `← lane:<x>`, lower-cased, and
-    # empty for any other line: the link a chain is followed by (#74, below).
-    tolower($2) != mel {
-      q = pos($10, $11); okey = $6 SUBSEP tolower($2)
-      if (!(okey in op) || q >= op[okey]) { op[okey] = q; ov[okey] = $3; ou[okey] = $1; on[okey] = $2
-        ot[okey] = ($3 == "TAKEOVER" && $7 == "←" && substr($8, 1, 5) == "lane:") ? tolower(substr($8, 6)) : "" }
-    }
-    # SUPERSEDED, WITHOUT ORDERING TWO FILES AGAINST EACH OTHER (R14), AND ONLY
-    # WHILE THE TAKEOVER STILL STANDS (R18): another lane has a TAKEOVER on the
-    # object AS ITS OWN LAST LINE, and this lane has written nothing on it since
-    # — the last line here is still the open verb that TAKEOVER took. A
-    # TAKEOVER is never removed from an append-only log, so testing for one
-    # ANYWHERE in the file of the taker kept superseding these claims for ever:
-    # after that lane released the object and this one legitimately re-claimed
-    # it, `who` called the object FREE and a third lane was not refused.
-    # STALE UNTIL PR #61 (Copilot round 11): this paragraph itself said "a
-    # TAKEOVER displaces a CLAIMED and nothing else", singular, after the
-    # dead-lane exception of issue #30 had already widened what the awk
-    # fragment above tests. A TAKEOVER displaces CLAIMED (the ordinary
-    # stale-claim shape of decision 8(e)) or, per that dead-lane exception, a
-    # TAKEOVER, OPENED, LANDING or WITHDRAWN left by another lane (`claim
-    # --force` refuses every other verb) — that full set is the whole of the
-    # test; any later line of this lane is it speaking after the fact and is
-    # reported as it stands. The two lines sit in two different lanes, whose
-    # files share no clock, and this asks for none.
-    # A CHAIN IS FOLLOWED TO ITS LAST LINK (opensoft/openRepoTools#74), by the
-    # rule `superseded_by` below argues: when this lane-s own last line is a
-    # TAKEOVER, only another lane-s standing TAKEOVER that NAMES this lane
-    # (`← lane:<this lane>`) displaces it, and not one this lane-s own
-    # TAKEOVER names back; any other open verb is displaced by any standing
-    # TAKEOVER, and the taker NAMED is one no other standing TAKEOVER names
-    # wherever there is one. Without it the true holder at the end of a chain
-    # was told here that it had been "taken over" by the lane it took the
-    # object from, and `lane-end` handed it the release that frees the object.
-    END { for (kk in ov) if (ov[kk] == "TAKEOVER" && ot[kk] != "") {
-            split(kk, aa, SUBSEP); if (ot[kk] != aa[2]) nmd[aa[1], ot[kk]] = 1 }
-          for (kk in ov) if (ov[kk] == "TAKEOVER") {
-            split(kk, aa, SUBSEP); oo = aa[1]; ll = aa[2]
-            if (!(oo in verb)) continue
-            if (verb[oo] == "TAKEOVER") {
-              mt = (ref[oo] == "←" && substr(pay[oo], 1, 5) == "lane:") ? tolower(substr(pay[oo], 6)) : ""
-              if (ot[kk] != mel || mt == ll) continue
-              r = 1
-            } else r = (((oo, ll) in nmd) ? 0 : 1)
-            if (!(oo in tp) || r > tr[oo] || (r == tr[oo] && op[kk] >= tp[oo])) { tp[oo] = op[kk]; tr[oo] = r; tlane[oo] = on[kk]; tutc[oo] = ou[kk] } }
-          for (i = 1; i <= n; i++) { o = byn[i]
-            supv = ((o in tlane) && (verb[o] == "CLAIMED" || verb[o] == "TAKEOVER" || verb[o] == "OPENED" || verb[o] == "LANDING" || verb[o] == "WITHDRAWN"))
-            sup = supv ? tlane[o] "@" tutc[o] : ""
-            printf "%s%c%s%c%s%c%s%c%s\n", utc[o], 31, verb[o], 31, o, 31, (ref[o] ? ref[o] " " pay[o] : ""), 31, sup } }'
-}
-
-# The lane and UTC of a TAKEOVER on <object> that is STILL THAT LANE'S OWN LAST
-# LINE on it — printed only when $3, our own last verb on the object, is one of
-# the OPEN VERBS a takeover can displace: CLAIMED (decision 8(e)'s ordinary
-# stale-claim shape), or TAKEOVER, OPENED, LANDING or WITHDRAWN (issue #30's
-# dead-lane exception, `superseded_by`'s own case below). Empty when there is
-# none. STALE UNTIL PR #61 (Copilot round 8): this line said "the CLAIMED a
-# takeover displaces", singular, after the awk fragment just above it had
-# already grown the full set — the code was never wrong, only this prose.
-#
-# R18 — "ITS OWN LAST LINE" IS THE WHOLE OF THE BOUND. Per-lane last-line
-# semantics apply to the taker too: once the taker writes RELEASED, CLOSED or
-# LANDED on the object, its TAKEOVER supersedes nothing and a later CLAIMED by
-# the dispossessed lane holds. Matching any TAKEOVER anywhere in the taker's
-# append-only file made a legitimate re-claim invisible for ever: `who` called
-# a held object FREE, `claim` did not refuse the next lane — the single outcome
-# Rule 1 exists to prevent — and `who --lane` and `lane-end` disagreed about the
-# same object.
-#
-# NO TIMESTAMP IS COMPARED (R14): the two lines are in two lanes' files and
-# there is no shared clock to order them by, so the question asked is the one
-# file order can answer — is our own last line still the claim, and is a
-# TAKEOVER still theirs. The UTC printed beside the lane is information for the
-# reader, never a key.
-#
-# A CHAIN OF TAKEOVERS RESOLVES TO ITS LAST LINK (opensoft/openRepoTools#74).
-# Issue #30's dead-lane exception lets a TAKEOVER displace an earlier TAKEOVER
-# — A claims, B takes over from A, C takes over from B once B is dead — and
-# every link that displaces a TAKEOVER names the lane it displaced as
-# `← lane:<x>`: `claim --force` writes that payload for every hold that is not
-# a CLAIMED, and only a CLAIMED is ever taken with a comment URL instead. The
-# test used to be "does SOME other lane's last line here read TAKEOVER", and it
-# read B's TAKEOVER — itself displaced by C — as proof that C was displaced
-# too: `who` reported ZERO holders of an object C held. So the question is now
-# asked by what our own last line is:
-#   * a TAKEOVER is displaced ONLY by another lane's standing TAKEOVER that
-#     NAMES our lane. B is displaced by C, which names it; C by nothing, since
-#     no standing TAKEOVER names C. One lane holds the object: the last link.
-#   * any other open verb is displaced by any standing TAKEOVER, as it always
-#     was, and the taker NAMED is one that no other standing TAKEOVER names —
-#     the lane that holds the object now — wherever there is one. A's line
-#     says C, not B. Where every taker is named, the file-ordered position
-#     picks which one is named; A is displaced either way.
-# Two lanes that each end on a TAKEOVER and do not name each other — two takers
-# of one stale claim — are therefore BOTH holders, the visible conflict the
-# README's "Known, deliberate" paragraph has always described; since PR #61
-# (issue #30) widened the gate, the old test had them displace each other and
-# `who` called the object FREE. Two TAKEOVERs that name EACH OTHER (a lane revived and took back
-# what had been taken from it) are both holders too: no file order says which
-# was written last, and a conflict `who` shows is one a person can resolve.
-superseded_by() {   # <object> <lane> <that lane's own last verb on it>
-  # ANY OPEN VERB, NOT ONLY CLAIMED (Copilot round 7, PR #61, issue #30): a
-  # dead lane's TAKEOVER — decision 8(e)'s stale-CLAIMED case is still the
-  # common one, but opensoft/openRepoTools#30 added a dead-lane TAKEOVER that
-  # displaces an OPENED, LANDING, WITHDRAWN or an earlier TAKEOVER too, exactly
-  # the verbs `is_open_verb` already lists. Gating this early return on
-  # `= CLAIMED` alone left every one of those un-superseded: `holders_of`
-  # counted the dead lane's own OPENED as a live hold beside the taker's
-  # TAKEOVER, and `who` reported two holders of one object — the very
-  # collision #30 exists to end.
-  case "${3-}" in
-    CLAIMED|TAKEOVER|OPENED|LANDING|WITHDRAWN) : ;;
-    *) return 0 ;;
-  esac
-  # AMENDMENT 15 — `tolower` ON BOTH SIDES, exactly as `lane_objects` above
-  # reads the same stream: the lane field of a log line carries the spelling
-  # that was typed on the day, and one lane's two spellings are one lane. The
-  # NAME is still the one the winning line carried, because this is printed.
-  # OUR OWN LAST LINE IS READ HERE TOO, not only the other lanes': the TAKEOVER
-  # it may be is what names the lane a chain was taken from (#74, above). `t[]`
-  # is the lane each last line names as `← lane:<x>`, lower-cased, or empty;
-  # a TAKEOVER naming its own lane names nobody.
-  state_events | awk -v sep="$US" -v o="$1" -v me="$2" -v mv="$3" '
-    function pos(pf, pn) { return pf "\034" sprintf("%09d", pn) }
-    BEGIN { FS = sep; mel = tolower(me) }
-    $6 == o { p = pos($10, $11); ll = tolower($2)
-      if (!(ll in q) || p >= q[ll]) { q[ll] = p; v[ll] = $3; u[ll] = $1; nm[ll] = $2
-        t[ll] = ($3 == "TAKEOVER" && $7 == "←" && substr($8, 1, 5) == "lane:") ? tolower(substr($8, 6)) : "" } }
-    END { for (l in q) if (v[l] == "TAKEOVER" && t[l] != "" && t[l] != l) named[t[l]] = 1
-          for (l in q) {
-            if (l == mel || v[l] != "TAKEOVER") continue
-            if (mv == "TAKEOVER") {
-              if (t[l] != mel || t[mel] == l) continue
-              r = 1
-            } else r = ((l in named) ? 0 : 1)
-            if (!seen || r > br || (r == br && q[l] >= b)) { seen = 1; br = r; b = q[l]; bl = nm[l]; bu = u[l] } }
-          if (seen) print bl "@" bu }'
-}
-
-# A lane's HOME repo, from the payload of its own STARTED (or RESUMED) line.
-# `<repo>-<n>` is a label, not a scope: this is the only thing that says where
-# a lane actually lives.
-# R20 — and the answer is CANONICAL. A STARTED line records whatever spelling
-# that checkout's `origin` had on the day, and the register's own history proves
-# those drift (`opensoft/codexFactory` is today `codeXfactory/codexFactory`).
-# Every comparison of an object's repository against a home — canon_object's
-# `#n`, cross_repo_warn, same_project, who's CROSS-REPO note — resolves BOTH
-# sides, and resolving here is what makes that true of all of them at once.
-home_of_lane() {
-  lane_log_exists "$1" || return 1
-  hol_h="$(lane_log_events "$1" | awk -v sep="$US" '
-    BEGIN { FS = sep }
-    $3 == "STARTED" || $3 == "RESUMED" {
-      if (match($8, /home [^ ;]+/)) h = substr($8, RSTART + 5, RLENGTH - 5)
-    }
-    END { if (h != "" && h != "unknown") print h; else exit 1 }')" || return 1
-  [ -n "$hol_h" ] || return 1
-  hol_c="$(alias_lookup "$hol_h" 2>/dev/null || :)"
-  printf '%s\n' "${hol_c:-$hol_h}"
-}
-
-# `PIN_LOGS` IS THE ONE LISTING'S OWN LIST OF THE PUBLISHED LOGS, exactly as
-# `PIN_ARCHIVE` is its archive: `worktree_rows` lists them once, and where that
-# succeeded the listing names its lanes from that list and not from a second
-# `ls-tree` that could fail after it (the review of #289, SHOULD-1(b)).
-PIN_LOGS=0
-PIN_LOGS_TEXT=""
-known_lanes() {
-  if [ -n "$LANES_IDX_DIR" ]; then
-    while IFS= read -r kl_f; do
-      [ -n "$kl_f" ] || continue
-      kl_n="${kl_f##*/}"
-      case "$kl_n" in README.md) continue ;; esac
-      printf '%s\n' "${kl_n%.md}"
-    done < "$LANES_IDX_DIR/logs"
-    return 0
-  fi
-  if [ "$PIN_LOGS" = 1 ] || have_remote_ref; then
-    { if [ "$PIN_LOGS" = 1 ]; then printf '%s' "$PIN_LOGS_TEXT"
-      else git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null
-      fi; } \
-    | while IFS= read -r kl_f; do
-        [ -n "$kl_f" ] || continue
-        kl_n="${kl_f##*/}"
-        case "$kl_n" in README.md) continue ;; esac
-        printf '%s\n' "${kl_n%.md}"
-      done
-    return 0
-  fi
-  while IFS= read -r kl_f; do
-    [ -n "$kl_f" ] || continue
-    kl_n="${kl_f##*/}"; printf '%s\n' "${kl_n%.md}"
-  done <<EOF
-$(log_files)
-EOF
-}
-
-# ---------------------------------------------------------- age and staleness
-
-# `date -u -d <stamp>` IS GNU-ONLY, AND THIS FUNCTION IS WHAT STALENESS IS MADE
-# OF (A9 Addendum 4, R-A9-11). BSD `date` — macOS's — answers `illegal option
-# -- d`, and `2>/dev/null || printf ''` turned that refusal into an EMPTY
-# ANSWER rather than an error: `age_of` printed `age unknown` beside every row,
-# `older_than_minutes` and `older_than_threshold` returned false for every
-# stamp, and the whole of `who`'s idle and stale reporting was silently off on
-# a platform this repository's own CI runs. BSD spells the same question
-# `-j -f <format> <stamp>`, so both are asked, GNU first because it is what
-# every lane workstation runs. TWO FORMATS, because this estate writes two:
-# `utc_now`, `lane-end`'s RELEASED and every log line carry SECONDS, and a
-# row's `Started` cell carries MINUTES. GNU reads either from one call; BSD
-# must be told which, so it is asked twice. A stamp none of the three can read
-# is still the empty string every caller here already tests for.
-epoch_of() {
-  date -u -d "$1" +%s 2>/dev/null ||
-    date -u -j -f '%Y-%m-%dT%H:%M:%SZ' "$1" +%s 2>/dev/null ||
-    date -u -j -f '%Y-%m-%dT%H:%MZ' "$1" +%s 2>/dev/null ||
-    printf ''
-}
-
-# `age_of <utc> [<now, epoch seconds>]`. A CALLER WITH MANY STAMPS PASSES `now`
-# ONCE (A11 Addendum 4 ruling 12): `date -u +%s` is a process, and asking the
-# clock again for every row of a listing both costs one and lets the rows
-# disagree about when "now" was.
-age_of() {
-  ao_t="$(epoch_of "$1")"
-  if [ -z "$ao_t" ]; then printf 'age unknown'; return 0; fi
-  ao_now="${2-}"; [ -n "$ao_now" ] || ao_now="$(date -u +%s)"
-  ao_d=$(( ao_now - ao_t )); [ "$ao_d" -lt 0 ] && ao_d=0
-  printf '%dh %02dm' "$((ao_d / 3600))" "$(((ao_d % 3600) / 60))"
-}
-
-lc() { printf '%s' "${1-}" | tr 'A-Z' 'a-z'; }
-
-# `lc`'s ANSWER WITHOUT A PROCESS, for a loop that asks it of EVERY lane in the
-# estate (opensoft/openRepoTools#107). `$(lc …)` is a subshell and a `tr`, and
-# the listing's `--prefix` and `--repo` filters made two of them per lane per
-# filter: measured on the suite's fixture register (194 rows, 162 logs), 3.2 s
-# of one `lanes --prefix` read, for lanes it then filtered out. The mapping is
-# `tr 'A-Z' 'a-z'`'s — the twenty-six ASCII capitals and nothing else — spelled
-# as twenty-six literal substitutions, so no locale's idea of a range or of a
-# case can widen it. It ASSIGNS `LOWER_OUT` and returns, for `table_lookup`'s
-# reason: a function read through `$( … )` is the fork this exists to remove.
-LOWER_OUT=""
-lower_into() {   # <string>
-  LOWER_OUT="${1-}"
-  case "$LOWER_OUT" in *[ABCDEFGHIJKLMNOPQRSTUVWXYZ]*) : ;; *) return 0 ;; esac
-  LOWER_OUT="${LOWER_OUT//A/a}"; LOWER_OUT="${LOWER_OUT//B/b}"; LOWER_OUT="${LOWER_OUT//C/c}"
-  LOWER_OUT="${LOWER_OUT//D/d}"; LOWER_OUT="${LOWER_OUT//E/e}"; LOWER_OUT="${LOWER_OUT//F/f}"
-  LOWER_OUT="${LOWER_OUT//G/g}"; LOWER_OUT="${LOWER_OUT//H/h}"; LOWER_OUT="${LOWER_OUT//I/i}"
-  LOWER_OUT="${LOWER_OUT//J/j}"; LOWER_OUT="${LOWER_OUT//K/k}"; LOWER_OUT="${LOWER_OUT//L/l}"
-  LOWER_OUT="${LOWER_OUT//M/m}"; LOWER_OUT="${LOWER_OUT//N/n}"; LOWER_OUT="${LOWER_OUT//O/o}"
-  LOWER_OUT="${LOWER_OUT//P/p}"; LOWER_OUT="${LOWER_OUT//Q/q}"; LOWER_OUT="${LOWER_OUT//R/r}"
-  LOWER_OUT="${LOWER_OUT//S/s}"; LOWER_OUT="${LOWER_OUT//T/t}"; LOWER_OUT="${LOWER_OUT//U/u}"
-  LOWER_OUT="${LOWER_OUT//V/v}"; LOWER_OUT="${LOWER_OUT//W/w}"; LOWER_OUT="${LOWER_OUT//X/x}"
-  LOWER_OUT="${LOWER_OUT//Y/y}"; LOWER_OUT="${LOWER_OUT//Z/z}"
-  return 0
-}
-
-older_than_minutes() {   # <utc> <minutes>
-  om_t="$(epoch_of "$1")"; [ -n "$om_t" ] || return 1
-  [ "$(( $(date -u +%s) - om_t ))" -gt "$(( $2 * 60 ))" ]
-}
-
-older_than_threshold() {
-  st_t="$(epoch_of "$1")"; [ -n "$st_t" ] || return 1
-  [ "$(( $(date -u +%s) - st_t ))" -gt "$((STALE_HOURS * 3600))" ]
-}
-
-# An object is treated as a PR once some lane has written OPENED on it. That
-# is the only offline evidence there is, and it is exactly the evidence Rule 1
-# cares about: a claim followed by a PR is not abandoned.
-object_is_pr() {
-  op_o="$1"
-  state_events | awk -v sep="$US" -v o="$op_o" 'BEGIN{FS=sep} $6 == o && $3 == "OPENED" { f = 1 } END { exit(f ? 0 : 1) }'
-}
-
-# Rule 1's staleness, made checkable. A lane's CLAIMED on an ISSUE is stale
-# when it is older than four hours AND that lane has written no later OPENED
-# whose `←` payload names the issue. A PR is never stale by this rule — Rule 6
-# governs PRs, with its own thirty minutes.
-# "LATER" IS FURTHER DOWN THE SAME FILE (R14). The four hours above is a
-# DURATION and stays on the clock, where ±25s is immaterial; this is an ORDER
-# between two lines of one append-only log, and it is read off the log.
-claim_is_stale() {   # <lane> <object> <utc-of-the-claim> <its file> <its line>
-  cs_lane="$1"; cs_obj="$2"; cs_utc="$3"; cs_file="${4-}"; cs_line="${5-0}"
-  older_than_threshold "$cs_utc" || return 1
-  object_is_pr "$cs_obj" && return 1
-  state_events | awk -v sep="$US" -v l="$cs_lane" -v o="$cs_obj" -v f="$cs_file" -v ln="$cs_line" '
-    BEGIN { FS = sep }
-    tolower($2) == tolower(l) && $3 == "OPENED" && $10 == f && ($11 + 0) > (ln + 0) {
-      # the `←` payload is space-separated issue keys
-      n = split($8, a, " ")
-      for (i = 1; i <= n; i++) if (a[i] == o) { found = 1 }
-    }
-    END { exit(found ? 1 : 0) }'
-}
-
-# ------------------------------------------- issue #30: A DEAD LANE'S HOLD
-#
-# `claim_is_stale` answers Rule 1's own question — is THIS CLAIM old — and on
-# purpose it refuses for anything that is not a CLAIMED issue: Rule 6 governs a
-# PR's own thirty minutes, and an OPENED, LANDING or WITHDRAWN was never a
-# claim to begin with. Neither test answers a DIFFERENT question Rule 1 never
-# had a word for: the LANE holding the object is not coming back at all,
-# whatever verb its last line on the object used. Measured 2026-09-13
-# (opensoft/openRepoTools#30): lane openRepoProject-1 went silent and was
-# retired (`lane-end --retire`, Amendment 6(d)), leaving an OPENED PR and two
-# CLAIMED issues behind — `claim --force` refused all three, the verb-check
-# refusing the PR and the four-hour clock refusing the issues (a CLAIMED lane
-# that later OPENED a PR naming it is deliberately never stale by Rule 1's own
-# test, which is exactly backwards for a lane that is dead). The workaround
-# was a `release` on the dead lane's behalf, by hand, object by object.
-#
-# DEAD, HERE, MEANS THE REGISTER SAYS SO, FIRST: the holder's own object log's
-# last LANE-KIND line (Amendment 7(b)'s STARTED/PAUSED/RESUMED/ENDED/RETIRED —
-# `lane_row_facts`' own "last lane-kind line wins in file order" rule, R14,
-# read for one lane rather than for a whole listing) is ENDED or RETIRED.
-# PAUSED IS DELIBERATELY NOT DEAD — a swap is a planned, expected stop
-# (Amendment 8) and stealing a swapped lane's claims would be exactly the
-# collision this protocol exists to prevent — and neither is a log with no
-# lane-kind line yet, which cannot hold an object through this path at all
-# (`state_events` reads nothing for it either).
-#
-# AND CONFIRMED, NEVER ASSUMED, SECOND: a register that says RETIRED is not
-# proof by itself that nothing is still running under that name — Amendment
-# 6(d)'s retire act writes no signal and kills no process, and
-# opensoft/openRepoTools#39 is exactly a register saying one thing while a
-# duplicate process says another. So the verdict is checked against
-# `live_holder` — the ONE liveness implementation this file has, over the same
-# published-union-local id set `lanes-edit.sh live-holder` already builds, and
-# never a new one — and a lane a live record on THIS workstation still holds is
-# refused exactly as an untaken CLAIMED is: "refuse where the holder is live"
-# is not a special case here, it is this same rule. A `live_holder` read that
-# FAILS is not "confirmed live" (fail closed for the log half, as every other
-# reader of this stream does) — but nor is it "confirmed dead": a RETIRED
-# verdict this workstation simply cannot check against any records at all is
-# HELD BACK exactly as a live one is, because issue #30's fix must never be
-# LESS safe than the check it sits beside. STALE UNTIL PR #61 (Copilot round
-# 11): this paragraph used to say such a read "is not held back either",
-# which described the opposite of the fail-closed rule the code below it
-# already enforced — only an ACTUAL, CONFIRMED-EMPTY read (`live_holder` exit
-# 8, never a bare rc 0 check) allows the takeover that every other outcome,
-# read failures included, withholds.
-#
-# 0 dead-and-confirmed (`HOLDER_DEAD_VERB` names the verdict), 1 not — refuse
-# as before. (This is `holder_is_dead`'s OWN return code, a different space
-# from the three `live_holder` answers just above it.)
-#
-# A LINE WHOSE PAYLOAD OPENS `fork ` IS NEVER THE LANE'S OWN VERB (Copilot
-# round 8, PR #61) — the same exclusion `lane_row_facts` already makes (above,
-# "A FORK-S RETIRED IS NOT THE LANE-S OWN LAST VERB") and for the identical
-# reason: the first build of ruling 8's retire act appended `RETIRED … lane:
-# <lane> -> fork <sid>; pid <n>; kind <k>` to the LANE's own log for a FORK it
-# retired, and nothing writes one any more but these logs are append-only, so
-# one written under that build is still there. Read as this lane's own last
-# line, it says the LANE was retired — backwards for a lane that may be alive
-# beside the fork it disowned, and exactly the state a PAUSED (swapped) lane
-# would be in if a stray line like this landed after its own last STARTED or
-# RESUMED: `claim --force` would read it as ENDED and take over holds a
-# planned, expected stop was never meant to surrender — the very collision
-# Amendment 8 exists to prevent.
-#
-# A LOG THAT YIELDED NO LANE-KIND VERDICT AT ALL IS ITS OWN ANSWER TOO
-# (Copilot on 05d7889, PR #61). The read used to be one pipeline whose status
-# was `awk`'s, so a log `lane_log_events` could not read — two files differing
-# only by case on origin, a `git show` that failed, a log no longer there —
-# came back as an EMPTY verdict with status 0 and set neither marker below:
-# `claim_rescan_hook` then told the operator the log had "moved past the
-# terminal line", which nobody had read. `HOLDER_NO_VERDICT` is that case,
-# named: the read failed, or it produced no STARTED/PAUSED/RESUMED/ENDED/
-# RETIRED line to judge. It is still `return 1` — fail closed — and only the
-# words a caller prints change.
-#
-# AND THE CONFIRMATION IS PRONOUNCED ONLY FROM INSIDE THE LANE'S LAST BINDING
-# (Copilot on 8ce6c9d, PR #61, against Amendment 18(b) as #83 landed it):
-# *"Liveness is pronounced only from INSIDE the binding's own `host` and
-# `container`, where the pid namespace is the record's: from anywhere else a
-# binding is UNKNOWN, never dead."* `live_holder` answering 8 says no session
-# record on THIS workstation holds the lane — which proves nothing about a lane
-# whose last `STARTED`/`RESUMED` was written on another host or in another
-# container, so a terminal log there plus an empty read here would have handed
-# its open holds to `--force` on a fact nobody could establish. The binding is
-# read off the last such line before the terminal one, with clause (a)'s
-# cutover rule (no `host`/`container`/`os` at all is a line from before it,
-# matched on the line's own workstation), and judged by `binding_is_here` —
-# the one locality rule this file has. Not here, the one exception clause (b)
-# carves out still applies: a shared tmux server on which the binding's window
-# is GONE is a dead binding (`binding_window_state`) — and then the local
-# `live_holder` read below still has to come back empty, because a dead pane
-# is not proof that nothing on this workstation still carries the lane
-# (Copilot on a52abc6). Anything else is
-# `HOLDER_BOUND_ELSEWHERE` (the binding's `host/container`), and refused like
-# every other verdict this workstation could not establish. A log with no
-# binding line at all keeps the local read, which is all there is to ask.
-#
-# AND THE IDS THE LOCAL READ IS ASKED ABOUT MUST HAVE BEEN READ
-# (opensoft/openRepoTools#67). They are the row's, published-union-local, and
-# an unreadable register used to yield the same EMPTY set as a lane with no
-# row — which `live_holder` answers 8, so a terminal log on a register nobody
-# could read was "confirmed dead" and its holds went to `--force`, even with a
-# live session on this workstation still carrying the lane's id. That is
-# `HOLDER_REGISTER_UNREADABLE` now, with `HOLDER_TERMINAL_UNKNOWN` beside it so
-# every reader that already refuses a liveness read that failed refuses this one
-# too; `claim` names it in its own words.
-HOLDER_DEAD_VERB=""
-HOLDER_LIVE_TERMINAL=""
-HOLDER_TERMINAL_UNKNOWN=""
-HOLDER_NO_VERDICT=""
-HOLDER_BOUND_ELSEWHERE=""
-HOLDER_REGISTER_UNREADABLE=""
-HOLDER_DEAD_WHY=""
-HOLDER_TERMINAL_SEEN=""
-holder_is_dead() {   # <lane>
-  hid_l="${1-}"; [ -n "$hid_l" ] || return 1
-  HOLDER_DEAD_VERB=""
-  HOLDER_LIVE_TERMINAL=""
-  HOLDER_TERMINAL_UNKNOWN=""
-  HOLDER_NO_VERDICT=""
-  HOLDER_BOUND_ELSEWHERE=""
-  HOLDER_REGISTER_UNREADABLE=""
-  HOLDER_DEAD_WHY="no live session on this workstation"
-  HOLDER_TERMINAL_SEEN=""
-  hid_rc=0
-  hid_ev="$(lane_log_events "$hid_l" 2>/dev/null)" || hid_rc=$?
-  if [ "$hid_rc" != 0 ]; then
-    HOLDER_NO_VERDICT=1
-    return 1
-  fi
-  hid_verb="$(printf '%s\n' "$hid_ev" | awk -F"$US" '
-    ($3=="STARTED"||$3=="PAUSED"||$3=="RESUMED"||$3=="ENDED"||$3=="RETIRED") && substr($8,1,5)!="fork " { v=$3 }
-    END { print v }')"
-  case "$hid_verb" in
-    ENDED|RETIRED) : ;;
-    "") HOLDER_NO_VERDICT=1; return 1 ;;
-    *) return 1 ;;
-  esac
-  HOLDER_TERMINAL_SEEN="$hid_verb"
-  # AMENDMENT 18(b) — the last binding, and whether this place may pronounce
-  # on it (the paragraph above `HOLDER_DEAD_VERB`).
-  hid_bind="$(printf '%s\n' "$hid_ev" | awk -F"$US" '
-    ($3=="STARTED"||$3=="RESUMED") && substr($8,1,5)!="fork " { ws=$5; pay=$8; seen=1 }
-    END { if (seen) printf "%s%c%s\n", ws, 31, pay }')"
-  if [ -n "$hid_bind" ]; then
-    hid_bws="${hid_bind%%"$US"*}"; hid_bpay="${hid_bind#*"$US"}"
-    hid_bhost="$(payload_subfield "$hid_bpay" host)"
-    hid_bcont="$(payload_subfield "$hid_bpay" container)"
-    hid_bos="$(payload_subfield "$hid_bpay" os)"
-    hid_bwin="$(payload_subfield "$hid_bpay" window all)"
-    hid_blegacy=""
-    [ -n "$hid_bhost$hid_bcont$hid_bos" ] || hid_blegacy=legacy
-    [ -n "$hid_bhost" ] || hid_bhost="$hid_bws"
-    [ -n "$hid_bcont" ] || hid_bcont=none
-    if ! binding_is_here "$hid_bhost" "$hid_bcont" "$hid_blegacy"; then
-      # THE WINDOW-GONE EXCEPTION ADMITS THE BINDING TO THE LOCAL READ BELOW,
-      # IT DOES NOT REPLACE IT (Copilot on a52abc6, PR #61): a pane gone from
-      # the shared tmux server says the BINDING is dead, not that nothing on
-      # this workstation still carries the lane — an orphaned background
-      # duplicate outlives its pane. So `live_holder` is still asked, and only
-      # its confirmed-empty 8 lets this answer dead; live or unreadable stays
-      # a refusal exactly as it is for a binding that is here.
-      if [ "$(binding_window_state "$hid_bhost" "$hid_bwin" "$hid_blegacy")" != gone ]; then
-        HOLDER_BOUND_ELSEWHERE="${hid_bhost:-unknown}/${hid_bcont}"
-        return 1
-      fi
-      HOLDER_DEAD_WHY="its binding's window is gone from this host's tmux, Amendment 18(b), and no live session on this workstation"
-    fi
-  fi
-  # 8 IS AN ANSWER AND 1 IS NOT (#67, the paragraph above `HOLDER_DEAD_VERB`):
-  # a lane the register gives no transcript uuid goes on to `live_holder` with
-  # an empty set exactly as before; a register that could not be read stops here.
-  hid_ids=""; hid_irc=0
-  hid_ids="$(session_ids_checked "$hid_l")" || hid_irc=$?
-  case "$hid_irc" in
-    0|8) : ;;
-    *) HOLDER_REGISTER_UNREADABLE=1; HOLDER_TERMINAL_UNKNOWN="$hid_verb"; return 1 ;;
-  esac
-  # THREE ANSWERS, NEVER TWO CONFLATED (Copilot round 1, opensoft/openRepoTools#61):
-  # `live_holder` is 0 live, 8 read-and-confirmed-nothing, or any other code a
-  # records tree this workstation could not read at all — and THAT is not
-  # "confirmed dead" either, it is "not established", exactly as every other
-  # caller of this one liveness implementation already treats it. Only 8 may
-  # pass; 0 and every failure both refuse.
-  live_holder "$hid_l" "$hid_ids" >/dev/null 2>&1; hid_lrc=$?
-  [ "$hid_lrc" = 8 ] || {
-    # A CONFIRMED-LIVE TERMINAL LOG IS ITS OWN VERDICT, NOT "NOT ESTABLISHED"
-    # (Copilot round 13, PR #61): this function's OWN return value stays
-    # fail-closed exactly as above — only 8 ever lets it answer dead — but a
-    # caller that reads false here and falls back to Rule 1's ORDINARY
-    # stale-claim test has no way to tell "this log never terminated" apart
-    # from "this log terminated and a real session still answers for it",
-    # and the second is refused on liveness alone wherever else this file
-    # meets it (`repoK-3`'s own case, `lane-start`'s own refusal). Recorded
-    # here, for `hid_lrc = 0` (genuinely confirmed live).
-    #
-    # AND AN UNREADABLE RECORDS TREE IS NEITHER (Copilot's own "closer look"
-    # on c82577e, PR #61): `hid_lrc` outside {0, 8} means this workstation
-    # could not read whether a live session backs the lane up at all — the
-    # exact reading every OTHER caller of `live_holder` already refuses on
-    # (the comment three lines up), and silently letting `claim_is_stale`
-    # answer instead would treat "I could not check" as "checked and clear"
-    # for the one shape (a terminal log) this file already distrusts enough
-    # to check in the first place. Recorded so the caller can refuse in
-    # these words rather than in the confirmed-live ones, which would
-    # misstate why.
-    if [ "$hid_lrc" = 0 ]; then
-      HOLDER_LIVE_TERMINAL="$hid_verb"
-    else
-      HOLDER_TERMINAL_UNKNOWN="$hid_verb"
-    fi
-    return 1
-  }
-  HOLDER_DEAD_VERB="$hid_verb"
-  return 0
-}
-
-# ------------------------------------------------------------- liveness
-#
-# ONE implementation, here, because `lane-start` and `who` must agree about
-# what "live" means — `lane-start` asks for it with the `live-holder`
-# subcommand rather than keeping a second copy that can drift.
-#
-# LIVE iff a session record ON THIS WORKSTATION carries one of the row's
-# transcript uuids, its `status` is not one of {ended, exited, dead, stopped},
-# its pid is alive, and `/proc/<pid>/stat` field 22 still equals the
-# `procStart` the record wrote down.
-
-# Every session record on this workstation, one path per line.
-#
-# R22 — AND IT SAYS WHETHER IT COULD READ THEM. Returns 0 when every records
-# tree that EXISTS was listed without error, and 1 when one existed and could
-# not be — a permissions or IO fault, which is not the same answer as "no record
-# holds this lane" and must never be reported as one. A tree that is simply
-# absent is not a failure: a workstation may have only one of the two.
-SESSION_FILES_ERR=""
-session_files() {
-  sf_rc=0; sf_d=""; sf_err=""
-  SESSION_FILES_ERR=""
-  sf_err="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-sf.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$sf_err" ]; then
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  # Team profiles sit two levels down (profiles/<org>/<team>/<profile>/sessions/),
-  # so that one is a -path find and not a one-level glob.
-  for sf_d in "$HOME/.claude-profiles/profiles" "$HOME/.claude/sessions"; do
-    [ -e "$sf_d" ] || continue
-    case "$sf_d" in
-      */sessions) find "$sf_d" -maxdepth 1 -name '*.json' -type f 2>>"$sf_err" || sf_rc=1 ;;
-      *)          find "$sf_d" -path '*/sessions/*.json' -type f 2>>"$sf_err" || sf_rc=1 ;;
-    esac
-  done
-  if [ -s "$sf_err" ]; then
-    SESSION_FILES_ERR="$(LC_ALL=C tr '\n' ';' < "$sf_err" | LC_ALL=C cut -c1-300)"
-    sf_rc=1
-  fi
-  rm -f -- "$sf_err"
-  return "$sf_rc"
-}
-
-jstr() { printf '%s' "$1" | grep -o "\"$2\":\"[^\"]*\"" | head -n1 | sed 's/^.*":"//; s/"$//'; }
-jnum() { printf '%s' "$1" | grep -o "\"$2\":[0-9][0-9]*" | head -n1 | sed 's/^.*://'; }
-
-# ------------------------------------------------- A11 Addendum 4 ruling 12:
-# ONE PASS OVER THE SESSION RECORDS, FOR THE WHOLE PROCESS
-#
-# *"Decision 6's `lanes` gets a stated bar — it answers in about a second on
-# this estate — and the per-lane fan-out is what changes to meet it."*
-#
-# WHERE THE TIME WENT, measured on a copy of the live register (46 rows, 15
-# logs) before any of this was written: `lanes` took 14 m 30 s wall and ~23
-# CPU-minutes. Not the register, and not the logs — a `git show` of the 1.1 MB
-# register is 11 ms and the fifteen logs are one cached pass. It was THIS: 564
-# session records on this workstation, each read with `cat` and then four or
-# five `jstr`/`jnum` calls that are FOUR PROCESSES EACH (`printf | grep | head |
-# sed`) — about twenty processes per record, eleven thousand per scan — and both
-# scans were rebuilt FOR EVERY LANE, because `live_session_ids` and `fork_map`
-# cached into a VARIABLE and every caller invoked them inside `$( … )`, which is
-# a subshell whose variables die with it.
-#
-# So: the parse becomes ONE awk over every record file, and the caches become
-# FILES, which a subshell's build leaves behind for its parent.
-#
-# `jstr` and `jnum` ARE REPRODUCED HERE RATHER THAN CALLED, and the reproduction
-# is exact: `jstr` is the first `"key":"…"` whose value holds no `"`, `jnum` the
-# first `"key":` followed immediately by a digit. Both are `grep -o … | head -n1`
-# on the whole blob, so both take the FIRST occurrence and neither is anchored.
-# A record is read the same way by either path, and `record_is_live` still makes
-# the liveness decision in shell, on the fields this hands it.
-SESSION_RECORD_AWK='
-function jstr(s, k,   r, i, v) {
-  r = "\"" k "\":\""
-  i = index(s, r); if (i == 0) return ""
-  v = substr(s, i + length(r))
-  i = index(v, "\""); if (i == 0) return ""
-  return substr(v, 1, i - 1)
-}
-function jnum(s, k,   r, i, v, rest) {
-  r = "\"" k "\":"
-  rest = s
-  while ((i = index(rest, r)) > 0) {
-    v = substr(rest, i + length(r))
-    if (v ~ /^[0-9]/) { match(v, /^[0-9]+/); return substr(v, 1, RLENGTH) }
-    rest = substr(rest, i + length(r))
-  }
-  return ""
-}
-function emit(   ) {
-  if (f == "") return
-  printf "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n", f, sep,
-    jstr(blob, "sessionId"), sep, jstr(blob, "tmux"), sep, jstr(blob, "name"), sep,
-    jnum(blob, "pid"), sep, jstr(blob, "kind"), sep, jstr(blob, "cwd"), sep,
-    jstr(blob, "status"), sep, jstr(blob, "procStart")
-}
-FNR == 1 { emit(); f = FILENAME; blob = "" }
-{ blob = blob $0 }
-END { emit() }'
-
-# A PER-PROCESS FILE CACHE. `$( … )` is a subshell, so a variable set by a
-# builder called inside one is gone the moment it answers; a file is not.
-# Named beside the events cache so `cleanup`'s `rm -f -- "$SE_CACHE_FILE".*`
-# already takes them, and cleared by `log_sync` with everything else it moves.
-#
-# SPELLED AS A PARAMETER EXPANSION AND NOT A FUNCTION, because a function called
-# as `$(cache_path register)` is a FORK — and this is reached on the per-lane
-# path the ruling exists to take the forks out of. `${SE_CACHE_FILE:+…}` is the
-# shell's own, costs nothing, and yields the empty string where there is no
-# cache file at all, which is the one case every caller already tests for.
-
-# Every session record on this workstation, parsed once:
-#   <file><US><sessionId><US><tmux><US><name><US><pid><US><kind><US><cwd><US><status><US><procStart>
-session_records() {
-  sr_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.records}"
-  if [ -n "$sr_c" ] && [ -f "$sr_c" ]; then cat -- "$sr_c"; return 0; fi
-  # AND A TREE THAT COULD NOT BE READ IS NOT A WORKSTATION WITH NO SESSIONS
-  # (#26, the review of `37632b1`, `lanes-edit.sh:2008`). `session_files` sets
-  # `SESSION_FILES_ERR` and returns 1 for exactly that case — the three callers
-  # that read it DIRECTLY refuse on it, and say so where they do — and this one
-  # read it through `|| :` inside a `$( )`, which discards the status and the
-  # message with the subshell. The empty answer was then CACHED for the life of
-  # the process, so every consumer after it was told the same untrue thing. The
-  # status decides here and NOTHING IS WRITTEN to the cache on it: a cache of a
-  # failure is a failure nobody can see.
-  sr_files=""; sr_frc=0
-  sr_files="$(session_files 2>/dev/null)" || sr_frc=$?
-  [ "$sr_frc" = 0 ] || return 1
-  sr_t=""
-  [ -n "$sr_c" ] && sr_t="$sr_c.${BASHPID:-$$}"
-  if [ -z "$sr_files" ]; then
-    [ -n "$sr_t" ] && { : > "$sr_t"; mv -f -- "$sr_t" "$sr_c" 2>/dev/null || rm -f -- "$sr_t"; }
-    return 0
-  fi
-  # One awk, however many files — `awk` takes them all on its command line and
-  # `FILENAME` keeps each record attributable. The same shape `log_events` uses
-  # for the lane logs, for the same reason.
-  sr_arr=()
-  while IFS= read -r sr_f; do [ -n "$sr_f" ] && sr_arr+=("$sr_f"); done <<EOF
-$sr_files
-EOF
-  if [ "${#sr_arr[@]}" -eq 0 ]; then
-    [ -n "$sr_t" ] && { : > "$sr_t"; mv -f -- "$sr_t" "$sr_c" 2>/dev/null || rm -f -- "$sr_t"; }
-    return 0
-  fi
-  if [ -n "$sr_t" ]; then
-    awk -v sep="$US" "$SESSION_RECORD_AWK" "${sr_arr[@]}" > "$sr_t" 2>/dev/null
-    mv -f -- "$sr_t" "$sr_c" 2>/dev/null || { cat -- "$sr_t"; rm -f -- "$sr_t"; return 0; }
-    cat -- "$sr_c"
-  else
-    awk -v sep="$US" "$SESSION_RECORD_AWK" "${sr_arr[@]}" 2>/dev/null
-  fi
-  return 0
-}
-
-pid_alive() {
-  local pid="$1" want="$2" statline rest
-  [ -n "$pid" ] || return 1
-  kill -0 "$pid" 2>/dev/null || return 1
-  [ -n "$want" ] || return 0
-  [ -r "/proc/$pid/stat" ] || return 0
-  # `read` AND NOT `$(cat …)`, WHICH IS A FORK PER RECORD (A11 Addendum 4
-  # ruling 12). This runs once for every session record on the workstation —
-  # 564 of them here — and `lanes` asked about every record for every lane, so
-  # this one substitution was ~26,000 processes for one listing. A builtin read
-  # of a one-line file is the same answer.
-  statline=""
-  read -r statline < "/proc/$pid/stat" 2>/dev/null || statline=""
-  rest="${statline##*) }"
-  # shellcheck disable=SC2086
-  set -- $rest
-  [ "$#" -ge 20 ] || return 0
-  [ "${20}" = "$want" ]
-}
-
-# A session record's `name` is EVIDENCE ABOUT ANOTHER LANE only when a person
-# or a `--name` set it. The values real records carry on this estate are:
-#
-#   derived   the harness named the window after its working directory
-#   auto      the harness named it without being told to
-#   user      a person typed `/rename`, or `--name` was passed
-#   peer      another session in the mesh set it
-#
-# EXPLICIT is {user, peer} — the two a person or `--name` produces. A record
-# with any other value, or with none at all, says nothing either way about
-# which lane it is, and is therefore NOT read as a denial.
-#
-# This is a fix, not a preference. On 2026-09-11 the orchestrator's own record
-# read `name: openrepoproject-63, nameSource: derived` while it held lane
-# openRepoProject-1 — pid alive, procStart matching, status busy — and the old
-# filter skipped it on the name alone, so a dry run reported "no live session
-# holds openRepoProject-1" and a second window would not have been refused.
-# 274 of this estate's 341 records carry `derived`.
-EXPLICIT_NAME_SOURCES="user peer"
-name_is_explicit() {
-  case " $EXPLICIT_NAME_SOURCES " in *" ${1:-} "*) return 0 ;; esac
-  return 1
-}
-
-# The three tests every record answers, wherever it was found: a status that is
-# not one of {ended, exited, dead, stopped}, a pid that is alive, and a
-# `/proc/<pid>/stat` field 22 still equal to the `procStart` the record wrote
-# down — so a recycled pid cannot hold a name. `live_holder` adds the two that
-# are about a LANE (the row's ids, and the nameSource rule); `window_session`
-# adds the one that is about a WINDOW. One copy of the three, because two would
-# drift and this is the check that decides whether a name may be taken.
-record_is_live() {   # <the record's JSON blob>
-  record_fields_are_live "$(jstr "$1" status)" "$(jnum "$1" pid)" "$(jstr "$1" procStart)"
-}
-# THE SAME THREE TESTS, ON FIELDS ALREADY IN HAND (ruling 12). `session_records`
-# parses every record once; re-serialising its fields back into a blob so this
-# could re-parse them would be the fork storm the one pass exists to remove.
-# ONE copy of the three tests, because two would drift and this is the check
-# that decides whether a name may be taken.
-record_fields_are_live() {   # <status> <pid> <procStart>
-  case "${1-}" in ended|exited|dead|stopped) return 1 ;; esac
-  pid_alive "${2-}" "${3-}"
-}
-
-# ------------------------------------- AMENDMENT 8, ruling (g): WHOSE session
-#
-# Three facts about this estate's records, every one of them observed on
-# 2026-09-12 while `lane-start` was refusing the very window that held the lane:
-#
-#   1. THE HARNESS EXPORTS `CLAUDE_CODE_SESSION_ID` into every shell a session
-#      runs — so a `lane-start` that a session runs already knows its own
-#      transcript id without asking the filesystem anything. That is the
-#      cheapest and the most certain test there is, and it comes first.
-#   2. ONE SESSION WRITES MORE THAN ONE RECORD. Beside the interactive process
-#      in the pane the harness runs a companion: `kind: bg`, no `tmux`, no
-#      `nameSource`, its own pid, and THE SAME `sessionId`. Records that share a
-#      `sessionId` are one session, not a queue of rival holders, and there is
-#      no contest between them to win.
-#   3. A RECORD MAY CARRY NO `tmux` AT ALL. The pane's interactive record
-#      usually has one, the companion never does, and the harness has been seen
-#      to write none for a process plainly in a window. "No target" is not "no
-#      window": it is a missing observation, and the process tree holds the
-#      answer the record failed to write down.
-#
-# What those three produced: `live_holder` returned the COMPANION — its
-# `sessionId` matched the row, its pid was alive, and carrying no `nameSource`
-# it survived the name test — reported its target as `none`, and `lane-start`
-# read "not this window" and refused the session that was running the command:
-#
-#   lane openRepoProject-1 is live in session c5701b54… (tmux none);
-#   take openRepoProject-2 or resume that window
-#
-# The orphaned idle holder from the PREVIOUS profile was a real find and was
-# correctly retired under Amendment 6(d); this one was the same shape read
-# wrongly. The difference between them is not recency and never was — it is
-# whether the process is in THIS pane's tree.
-
-# A `kind: bg` record is a COMPANION: never a holder, never a rival, skipped by
-# every read that asks who holds a lane or what is in a window. Only
-# `interactive` records hold a lane; a record from a harness too old to say
-# carries no `kind` at all and is read as interactive, because that is the only
-# thing those harnesses ever wrote.
-record_is_session() {   # <the record's JSON blob>
-  record_fields_are_session "$(jstr "$1" kind)"
-}
-record_fields_are_session() {   # <kind>
-  case "${1-}" in
-    ''|interactive) return 0 ;;
-    *) return 1 ;;
-  esac
-}
-
-# THIS shell's own window and pane, asked of tmux and never guessed. Both are
-# empty outside tmux, and an empty answer makes every test below fail SHUT — so
-# a caller with no tmux behaves exactly as it did before Amendment 8. Cached
-# because `who` asks about every lane in the register and this is two forks.
-LANES_HERE_CTX=0
-LANES_THIS_WINDOW=""
-LANES_PANE_PID=""
-here_context() {
-  [ "$LANES_HERE_CTX" = 1 ] && return 0
-  LANES_HERE_CTX=1
-  [ -n "${TMUX:-}" ] || return 0
-  command -v tmux >/dev/null 2>&1 || return 0
-  LANES_THIS_WINDOW="$(tmux display-message -p '#{session_name}:#{window_id}' 2>/dev/null || :)"
-  LANES_PANE_PID="$(tmux display-message -p '#{pane_pid}' 2>/dev/null || :)"
-  case "$LANES_PANE_PID" in *[!0-9]*) LANES_PANE_PID="" ;; esac
-  return 0
-}
-
-# pid_under <pid> <ancestor> — is <pid> the ancestor itself, or below it?
-#
-# `/proc/<pid>/stat` is `<pid> (<comm>) <state> <ppid> …`, and a comm may hold
-# spaces and brackets, so the parse starts after the LAST `) ` — the same cut
-# `pid_alive` makes for field 22. The walk stops at pid 1, at an entry it cannot
-# read (a process it cannot see is not in this pane), and at 64 steps, so a
-# /proc that lies about parentage cannot spin it.
-pid_under() {   # <pid> <ancestor>
-  pu_p="${1-}"; pu_anc="${2-}"; pu_i=0
-  [ -n "$pu_p" ] && [ -n "$pu_anc" ] || return 1
-  case "$pu_anc" in *[!0-9]*) return 1 ;; esac
-  while [ "$pu_i" -lt 64 ]; do
-    case "$pu_p" in ''|*[!0-9]*) return 1 ;; esac
-    [ "$pu_p" = "$pu_anc" ] && return 0
-    [ "$pu_p" -gt 1 ] 2>/dev/null || return 1
-    [ -r "/proc/$pu_p/stat" ] || return 1
-    pu_rest="$(cat "/proc/$pu_p/stat" 2>/dev/null || :)"
-    [ -n "$pu_rest" ] || return 1
-    pu_rest="${pu_rest##*) }"
-    pu_p="$(printf '%s' "$pu_rest" | cut -d' ' -f2)"
-    pu_i=$((pu_i + 1))
-  done
-  return 1
-}
-
-# record_is_here <blob> — is this record THIS window's own session? The ruling's
-# order, cheapest and most certain first:
-#   1. its `sessionId` is the one the harness exported into this very shell;
-#   2. its `tmux` target names this window — the FAST PATH, and only a fast
-#      path: a record without one is not thereby somewhere else;
-#   3. its pid is this pane's process, or below it.
-record_is_here() {   # <the record's JSON blob>
-  here_context
-  rih_sid="$(jstr "$1" sessionId)"
-  if [ -n "${CLAUDE_CODE_SESSION_ID:-}" ] && [ -n "$rih_sid" ] \
-     && [ "$rih_sid" = "$CLAUDE_CODE_SESSION_ID" ]; then return 0; fi
-  rih_t="$(jstr "$1" tmux)"
-  if [ -n "$rih_t" ] && [ -n "$LANES_THIS_WINDOW" ] \
-     && [ "${rih_t%.*}" = "$LANES_THIS_WINDOW" ]; then return 0; fi
-  pid_under "$(jnum "$1" pid)" "$LANES_PANE_PID"
-}
-
-# live_holder <lane> [<newline-separated session ids>]
-#
-# R22 — IT FAILS CLOSED AT THE SOURCE. Three answers, and they are distinct:
-#   0  a live record holds the lane (the row is printed)
-#   8  the records were READ, and none of them does
-#   1  the records could not be read — a permissions or IO fault
-#
-# AND ON 0 IT SAYS WHOSE (Amendment 8, ruling (g)). The fifth field is the
-# verdict — `here`, `elsewhere` or `orphan` — because the caller that has to act
-# on it cannot work it out from the `tmux` column: a record with no target is
-# not a record in no window, and `lane-start` refusing on that string is what
-# refused this lane its own window. `here` beats `elsewhere` beats `orphan`, and
-# a record with no target whose SESSION also wrote a windowed record is that
-# same session seen twice, not a second holder — it is dropped, never ranked.
-# `lane-start` renames a window on 8 and REFUSES on anything else, so collapsing
-# a failed read into 8 is exactly how a running lane loses its address: the
-# rename mints `<lane> (2)` (AGENTS.md rule 7). The first version returned 1 for
-# both, which is the same fault one layer up; hardening the CALLER left this
-# source with no way to say "I could not read".
-live_holder() {
-  local lane="$1" ids="${2-}" all="${3-}" pats=() f blob pid name status target sid base src
-  local lh_files lh_match lh_err kindv verdict c c_sid c_tgt c_name c_pid c_v
-  local lh_bg="" lh_windowed="" lh_here="" lh_here_tgt="" lh_else="" lh_orph="" lh_bres=""
-  local cands=()
-  SESSION_FILES_ERR=""
-  [ -n "$ids" ] || ids="$(session_ids_of_lane "$lane" 2>/dev/null || :)"
-  # A row with no transcript uuid in it is an ANSWER: nothing recorded can be
-  # live. It is not a failed read.
-  [ -n "$ids" ] || return 8
-  for sid in $ids; do pats+=(-e "\"sessionId\":\"$sid\""); done
-  [ "${#pats[@]}" -gt 0 ] || return 8
-  lh_files="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-lf.XXXXXX" 2>/dev/null || printf '')"
-  lh_match="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-lm.XXXXXX" 2>/dev/null || printf '')"
-  lh_err="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-le.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$lh_files" ] || [ -z "$lh_match" ] || [ -z "$lh_err" ]; then
-    rm -f -- "$lh_files" "$lh_match" "$lh_err" 2>/dev/null || :
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  # NOT `$( )`: session_files sets SESSION_FILES_ERR, and a subshell would keep
-  # the reason for the failure to itself.
-  if ! session_files > "$lh_files"; then
-    rm -f -- "$lh_files" "$lh_match" "$lh_err"
-    return 1
-  fi
-  if [ ! -s "$lh_files" ]; then
-    rm -f -- "$lh_files" "$lh_match" "$lh_err"
-    return 8                       # this workstation keeps no records at all
-  fi
-  # `xargs -r` IS GNU-ONLY and was dead weight: the `[ ! -s ]` guard above
-  # returns before this line when there is no record to search at all, which
-  # is the only thing `-r` would have caught (A9 Addendum 4, R-A9-11). The
-  # `tr`s read arbitrary bytes — a path, and grep's own words about it — so
-  # they read them as bytes: BSD `tr` answers `Illegal byte sequence` for a
-  # multibyte character in a UTF-8 locale and prints NOTHING, which would turn
-  # a record that cannot be read into a reason nobody can read either.
-  LC_ALL=C tr '\n' '\0' < "$lh_files" | xargs -0 grep -l -F "${pats[@]}" > "$lh_match" 2>"$lh_err" || :
-  if [ -s "$lh_err" ]; then        # a record that exists and cannot be read
-    SESSION_FILES_ERR="$(LC_ALL=C tr '\n' ';' < "$lh_err" | LC_ALL=C cut -c1-300)"
-    rm -f -- "$lh_files" "$lh_match" "$lh_err"
-    return 1
-  fi
-  rm -f -- "$lh_files" "$lh_err"
-  # PASS 1 — every live record the row's ids match, classified. Not the first
-  # one found: the first one found is a directory order, and on 2026-09-12 the
-  # directory order put the companion in front of the session at the keyboard.
-  while IFS= read -r f; do
-    [ -n "$f" ] || continue
-    blob="$(cat -- "$f" 2>/dev/null || :)"
-    [ -n "$blob" ] || continue
-    record_is_live "$blob" || continue
-    sid="$(jstr "$blob" sessionId)"
-    pid="$(jnum "$blob" pid)"
-    name="$(jstr "$blob" name)"
-    src="$(jstr "$blob" nameSource)"
-    target="$(jstr "$blob" tmux)"
-    # A COMPANION IS NOT A HOLDER. It is reported, on stderr, so that a person
-    # who is looking at a `(tmux none)` record can see why it was not obeyed.
-    if ! record_is_session "$blob"; then
-      kindv="$(jstr "$blob" kind)"
-      lh_bg="${lh_bg}${lh_bg:+, }pid ${pid:-unknown} (kind ${kindv:-none}, session ${sid:-unknown})"
-      continue
-    fi
-    base="${name% (*)}"
-    # `tr`, not `${x,,}`: openRepoTools' CI parses every shipped bash file with
-    # macOS' /bin/bash 3.2, where `${x,,}` is a SYNTAX error and not a portable
-    # lowercase (.github/workflows/tests.yml — that job names this very
-    # construction as its example). Amendment 9's adoption act 3, obligation 4.
-    base_lc="$(printf '%s' "$base" | tr '[:upper:]' '[:lower:]')"
-    lane_lc="$(printf '%s' "$lane" | tr '[:upper:]' '[:lower:]')"
-    if [ -n "$base" ] && [ "$base_lc" != "$lane_lc" ] && name_is_explicit "$src"; then
-      # AMENDMENT 16(e) — A NAME THIS LANE USED TO HAVE IS THIS LANE. The skip
-      # above is Amendment 8's: a session a PERSON named for ANOTHER lane is not
-      # this one's holder. After a rename the lane's own session still carries
-      # its FORMER name — the `/rename` is what clause (f) is for and it lands at
-      # the lane's next prompt, not before — and read byte for byte that record
-      # is "another lane's", so the lane's own live session stopped being its
-      # holder the instant the row moved. That would refuse the rename's own
-      # window its `/rename`, and tell `who` the lane is NOT LIVE while it is.
-      # Resolved through the same seat every other name goes through; anything
-      # that resolves elsewhere is still skipped, which is Amendment 8's rule
-      # unchanged.
-      # AND THE RESOLVER'S OWN STATUS IS KEPT (Copilot round 4). Piped into
-      # `grep | head || :` it was thrown away, so an unreadable alias table
-      # answered EMPTY here, the record was skipped, and `live_holder` returned
-      # 8 — "no live session holds it" — about a lane that is running. That is
-      # the read `lane-start` renames a window over.
-      lh_brc=0
-      lh_bres="$(rows_named_ci_alias "$base" 2>/dev/null)" || lh_brc=$?
-      if [ "$lh_brc" != 0 ]; then
-        SESSION_FILES_ERR="${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), so whether the session named '$base' carries a FORMER name of lane $lane could not be established (Amendment 16(e))"
-        rm -f -- "$lh_match"
-        return 1
-      fi
-      lh_bres="$(printf '%s\n' "$lh_bres" | grep . | head -n1 || :)"
-      if [ -z "$lh_bres" ] || [ "$(lc "$lh_bres")" != "$lane_lc" ]; then continue; fi
-    fi
-    if record_is_here "$blob"; then verdict=here
-    elif [ -n "$target" ];     then verdict=elsewhere
-    else                            verdict=orphan
-    fi
-    [ -n "$target" ] && lh_windowed="${lh_windowed}${sid}
-"
-    cands+=("$(printf '%s%s%s%s%s%s%s%s%s' "$sid" "$US" "${target:-none}" "$US" "${name:-none}" "$US" "${pid:-unknown}" "$US" "$verdict")")
-  done < "$lh_match"
-  rm -f -- "$lh_match"
-  [ -n "$lh_bg" ] && note "lane $lane: companion records, which are never holders: $lh_bg"
-
-  # The restart observer needs every process, while live-holder keeps its
-  # existing preferred-record contract. Multiple witnesses of one PID are
-  # one holder; two PIDs sharing a transcript are still two holders.
-  if [ "$all" = all ]; then
-    [ "${#cands[@]}" -gt 0 ] || return 8
-    printf '%s\n' "${cands[@]}" | awk -F'\037' '!seen[$1 FS $4]++'
-    return 0
-  fi
-
-  # PASS 2 — the pick. `here` first, and among two records of one session the
-  # WINDOWED one is the better witness of it; then a genuine rival in another
-  # window; then an orphan, and only one whose session wrote no windowed record
-  # at all, because the other kind is this same session seen twice.
-  for c in ${cands[@]+"${cands[@]}"}; do
-    IFS="$US" read -r c_sid c_tgt c_name c_pid c_v <<<"$c"
-    case "$c_v" in
-      here)
-        if [ -z "$lh_here" ] || { [ "$lh_here_tgt" = none ] && [ "$c_tgt" != none ]; }; then
-          lh_here="$c"; lh_here_tgt="$c_tgt"
-        fi ;;
-      elsewhere) [ -n "$lh_else" ] || lh_else="$c" ;;
-      orphan)
-        printf '%s' "$lh_windowed" | grep -qx -F -- "$c_sid" && continue
-        [ -n "$lh_orph" ] || lh_orph="$c" ;;
-    esac
-  done
-  if   [ -n "$lh_here" ]; then printf '%s\n' "$lh_here"; return 0
-  elif [ -n "$lh_else" ]; then printf '%s\n' "$lh_else"; return 0
-  elif [ -n "$lh_orph" ]; then printf '%s\n' "$lh_orph"; return 0
-  fi
-  return 8
-}
-
-# -------------------------------- AMENDMENT 8(f), R-A8-6: the ORPHANED HOLDERS
-#
-# A row's session cell is a HISTORY, and its EARLIER ids are history rather than
-# alternatives — but a live process can still be holding one, which is Amendment
-# 6(d)'s orphan and, on this lane, the reason the `/resume` picker offered two
-# transcripts of which neither was the lane. `live_holder` answers about the
-# lane's holder, one record, picked; this answers about ALL the earlier ids, and
-# it answers to be READ.
-#
-# IT NAMES THEM AND DOES NOTHING ELSE. Retiring is `kill <pid>`, printed by the
-# caller and run by a person: ending somebody's process is not a boundary
-# script's act — an idle background session is exactly the shape of thing that
-# turns out to be somebody's long-running job — and clause (f) rules it the
-# operator's, for the same reason clause (a)'s step 3 pushes nobody's work for
-# them.
-#
-# IDLE means a LIVE record (Amendment 6's three tests: a status that is not
-# ended, a pid that is alive, a `procStart` that still matches) which is NOT a
-# session in a window: a `kind: bg` companion, or a record carrying no `tmux`
-# target at all. A live INTERACTIVE record with a window is not an orphan, it is
-# a rival, and `live_holder` is the read that answers about those.
-#
-# One line per record, `<session id><TAB><pid><TAB><kind><TAB><profile>`.
-# Exit 0 with rows, 8 with none, 1 where the records could not be read.
-idle_holders() {   # <lane>
-  ih_lane="${1-}"; ih_ids=""; ih_last=""; ih_earlier=""; ih_out=""
-  ih_files=""; ih_match=""; ih_err=""; ih_f=""; ih_blob=""
-  ih_sid=""; ih_pid=""; ih_kind=""; ih_tgt=""
-  SESSION_FILES_ERR=""
-  [ -n "$ih_lane" ] || return 8
-  ih_ids="$(session_ids_of_lane "$ih_lane" 2>/dev/null || :)"
-  [ -n "$ih_ids" ] || return 8
-  ih_last="$(printf '%s\n' "$ih_ids" | tail -n1)"
-  ih_earlier="$(printf '%s\n' "$ih_ids" | grep -vx -F -- "$ih_last" || :)"
-  [ -n "$ih_earlier" ] || return 8
-  ih_files="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-if.XXXXXX" 2>/dev/null || printf '')"
-  ih_match="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-im.XXXXXX" 2>/dev/null || printf '')"
-  ih_err="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-ie.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$ih_files" ] || [ -z "$ih_match" ] || [ -z "$ih_err" ]; then
-    rm -f -- "$ih_files" "$ih_match" "$ih_err" 2>/dev/null || :
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  if ! session_files > "$ih_files"; then
-    rm -f -- "$ih_files" "$ih_match" "$ih_err"
-    return 1
-  fi
-  if [ ! -s "$ih_files" ]; then
-    rm -f -- "$ih_files" "$ih_match" "$ih_err"
-    return 8
-  fi
-  ih_pats=()
-  for ih_sid in $ih_earlier; do ih_pats+=(-e "\"sessionId\":\"$ih_sid\""); done
-  # `xargs -r` and the locale, for the reason `live_holder` gives above.
-  LC_ALL=C tr '\n' '\0' < "$ih_files" | xargs -0 grep -l -F "${ih_pats[@]}" > "$ih_match" 2>"$ih_err" || :
-  if [ -s "$ih_err" ]; then
-    SESSION_FILES_ERR="$(LC_ALL=C tr '\n' ';' < "$ih_err" | LC_ALL=C cut -c1-300)"
-    rm -f -- "$ih_files" "$ih_match" "$ih_err"
-    return 1
-  fi
-  rm -f -- "$ih_files" "$ih_err"
-  while IFS= read -r ih_f; do
-    [ -n "$ih_f" ] || continue
-    ih_blob="$(cat -- "$ih_f" 2>/dev/null || :)"
-    [ -n "$ih_blob" ] || continue
-    record_is_live "$ih_blob" || continue
-    ih_sid="$(jstr "$ih_blob" sessionId)"
-    ih_tgt="$(jstr "$ih_blob" tmux)"
-    ih_kind="$(jstr "$ih_blob" kind)"
-    # a session IN a window is not an orphan — it is a rival, and live_holder's
-    # question, not this one's.
-    if record_is_session "$ih_blob" && [ -n "$ih_tgt" ]; then continue; fi
-    ih_pid="$(jnum "$ih_blob" pid)"
-    ih_out="${ih_out}${ih_sid}\t${ih_pid:-unknown}\t${ih_kind:-none}\t$(record_profile "$ih_f")
-"
-  done < "$ih_match"
-  rm -f -- "$ih_match"
-  [ -n "$ih_out" ] || return 8
-  printf '%b' "$ih_out"
-  return 0
-}
-
-# ---------------------------------------------- the session in a tmux WINDOW
-#
-# AMENDMENT 8. `live_holder` asks "is any session this ROW names alive"; this
-# asks "which live session is in THIS WINDOW", and the two answers differ in
-# exactly the case Amendment 8 exists for. The harness mints a new transcript
-# uuid without anybody acting — a `/clear` does it (Amendment 6, fact 4), and so
-# did the 2026-09-12 usage reset that carried this lane's conversation into
-# `4a91f1dc…` while its row still ended on `09dd34d1…`. That id is in no row, so
-# `live_holder` cannot see it and answers 8, "this lane is parked", about the
-# conversation sitting in the window it was asked about. Keyed on the WINDOW
-# instead, the record is found, and `lane-start` appends its uuid to the cell
-# before it stamps — which is what makes the next resume land in the right
-# conversation.
-
-# The profile a record belongs to, read off its own path — never guessed from
-# the environment, because the process asking may be in another profile:
-#   ~/.claude-profiles/profiles/<org>/<team>/<profile>/sessions/<pid>.json
-#   ~/.claude/sessions/<pid>.json                                 -> default
-record_profile() {
-  rpf_d="${1%/*}"; rpf_d="${rpf_d%/sessions}"; rpf_n="${rpf_d##*/}"
-  case "$rpf_n" in .claude|claude|"") printf 'default\n' ;; *) printf '%s\n' "$rpf_n" ;; esac
-}
-
-# window_session <tmux target> — the LIVE record whose own `tmux` field names
-# that window. The target is `<tmux session>:<window id>`, which is what
-# `tmux display-message -p '#{session_name}:#{window_id}'` prints and what the
-# record's `tmux` field carries before its `.%<pane>` suffix.
-#
-# NO NAME TEST. `live_holder`'s fifth test skips a record explicitly named for
-# another lane, because there the question is "does this record hold that lane".
-# Here the question is "what is running in this window", and a window holds one
-# interactive session whatever it is called: the record's name is REPORTED, so
-# the caller can put it in front of a person, and decides nothing.
-#
-# R22 — three answers, never two of them conflated: 0 with the record, 8 when
-# the records were READ and none is in that window, 1 when they could not be
-# read at all.
-# WHERE SEVERAL LIVE RECORDS NAME ONE WINDOW, IDENTITY DECIDES — NOT RECENCY
-# (Amendment 8, ruling (g); this replaces the first version's "the most recently
-# updated one wins", which was wrong in the case it was written for).
-#
-#   tier 3  its `sessionId` is `$CLAUDE_CODE_SESSION_ID`, which the harness
-#           exported into this very shell — when the window asked about is this
-#           one. Nothing beats a session naming itself.
-#   tier 2  its pid is this pane's process or below it — again only for this
-#           window. This is what lets a record with NO `tmux` be found: the
-#           harness does not always write the target down, and a record without
-#           one is not thereby in no window.
-#   tier 1  its `tmux` field names the window. The fast path, and the only test
-#           available for a window that is not this one.
-#
-# `updatedAt` breaks a tie WITHIN a tier and nowhere else, so the answer never
-# depends on directory order. It cannot be the rule itself: it is a LIVENESS
-# HEARTBEAT, and the idle companion beside a working session heartbeats later
-# than the session does — in the 2026-09-12 records the companion's `updatedAt`
-# was 1789235975177 against the interactive record's 1789235958137, so "the
-# newest wins" picks precisely the record that is not in the window. Two records
-# of ONE session are not a contest to win at all: the windowed one represents
-# the session, and `record_is_session` has already dropped the companion.
-window_session() {
-  local target="$1" f blob sid tmuxv name pid upd best_upd best_out wsn_files
-  local tier best_tier ws_is_self ws_pane
-  SESSION_FILES_ERR=""
-  [ -n "$target" ] || return 8
-  # Tiers 2 and 3 are about THIS pane, so they apply only when the window asked
-  # about is the one this process is in. Asked about somebody else's window,
-  # this read is exactly the `tmux`-field match it always was.
-  here_context
-  ws_is_self=0; ws_pane=""
-  if [ -n "$LANES_THIS_WINDOW" ] && [ "$LANES_THIS_WINDOW" = "$target" ]; then
-    ws_is_self=1; ws_pane="$LANES_PANE_PID"
-  fi
-  wsn_files="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-ws.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$wsn_files" ]; then
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  # NOT `$( )`: session_files sets SESSION_FILES_ERR, and a subshell would keep
-  # the reason for the failure to itself.
-  if ! session_files > "$wsn_files"; then rm -f -- "$wsn_files"; return 1; fi
-  best_upd=-1; best_tier=0; best_out=""
-  while IFS= read -r f; do
-    [ -n "$f" ] || continue
-    blob="$(cat -- "$f" 2>/dev/null || :)"
-    [ -n "$blob" ] || continue
-    record_is_live "$blob" || continue
-    # A COMPANION IS NOT WHAT IS IN A WINDOW. `kind: bg` carries the interactive
-    # record's own `sessionId`, so admitting it here would let the SAME uuid be
-    # found by the wrong process — and would re-open the bug the moment a
-    # harness starts writing a target on to companions.
-    record_is_session "$blob" || continue
-    sid="$(jstr "$blob" sessionId)"
-    tmuxv="$(jstr "$blob" tmux)"
-    tier=0
-    if [ "$ws_is_self" = 1 ] && [ -n "${CLAUDE_CODE_SESSION_ID:-}" ] \
-       && [ -n "$sid" ] && [ "$sid" = "$CLAUDE_CODE_SESSION_ID" ]; then
-      tier=3
-    elif [ -n "$ws_pane" ] && pid_under "$(jnum "$blob" pid)" "$ws_pane"; then
-      tier=2
-    elif [ -n "$tmuxv" ] && [ "${tmuxv%.*}" = "$target" ]; then
-      tier=1
-    else
-      continue
-    fi
-    upd="$(jnum "$blob" updatedAt)"
-    case "$upd" in ''|*[!0-9]*) upd=0 ;; esac
-    if [ "$tier" -lt "$best_tier" ]; then continue; fi
-    if [ "$tier" = "$best_tier" ] && [ "$upd" -le "$best_upd" ]; then continue; fi
-    best_tier="$tier"; best_upd="$upd"
-    name="$(jstr "$blob" name)"
-    pid="$(jnum "$blob" pid)"
-    best_out="$(printf '%s%s%s%s%s%s%s%s%s' "$sid" "$US" "${tmuxv:-$target}" "$US" "${name:-none}" "$US" "${pid:-unknown}" "$US" "$(record_profile "$f")")"
-  done < "$wsn_files"
-  rm -f -- "$wsn_files"
-  [ -n "$best_out" ] || return 8
-  printf '%s\n' "$best_out"
-  return 0
-}
-
-# ------------------------------------------------------------ the row, read
-#
-# R19 — FROM `origin/<branch>`, LIKE EVERY OTHER STATE READ. These four reads
-# (the row itself, its session cell, its handoff path and its workstation
-# column) were the last ones taking the WORKING TREE, and `print_holder_detail`
-# is built entirely out of them — so `who` routinely answered with a current log
-# and a stale row: a holder recorded on the other workstation read `NOT LIVE`
-# because a peer's UNCOMMITTED edit to column 3 said `Eagle`, and a row that
-# exists only on `origin/main` was not seen at all, losing the resume uuid and
-# the handoff path, which are the two things `who` exists to hand over. Nothing
-# in `who` reads the working tree now.
-
-# AMENDMENT 15 — `tolower` ON BOTH SIDES, like every other lookup of a lane
-# name in this file. A caller reaches these two through `canon_lane`, so the
-# name arriving here is already the ROW's own spelling; the comparison is
-# case-insensitive anyway, because a caller that did not canonicalise must not
-# silently read "this lane has no row" about a lane that has one.
-ROW_AWK='
-  substr($0,1,1) == "|" {
-    p1 = index($0, "`"); if (p1 == 0) next
-    rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-    if (tolower(substr(rest, 1, p2 - 1)) == tolower(lane)) print
-  }'
-row_of_lane()       { register_text | awk -v lane="$1" "$ROW_AWK"; }
-# The same row as THIS CHECKOUT has it. One caller: the `live-holder`
-# subcommand, which unions these ids with the published ones because liveness
-# fails CLOSED — an id this checkout knows and `origin/main` does not yet is one
-# more reason to refuse a rename, never a reason to allow one (AGENTS.md rule 7).
-row_of_lane_local() { awk -v lane="$1" "$ROW_AWK" "$LANES_FILE"; }
-row_cell() { printf '%s\n' "$1" | awk -F'|' -v i="$2" '{print $i}'; }
-
-# ====================================================== AMENDMENT 15 =======
-#
-# THE RESOLVER. **A lane name is compared CASE-INSENSITIVELY wherever a name is
-# looked up, and the spelling the register row carries is canonical** — it is
-# what the window is named, what the session is named, what the log file is
-# called, and what every line and stamp writes. A name typed in another case
-# RESOLVES to it and is never written as typed.
-#
-# Every spelling the PUBLISHED register carries for a name, from
-# `origin/<branch>` like every other state read (R19). `lane_named_ci` below is
-# the same question asked for one answer and no refusal — it is the hook's read
-# and the hook never refuses — so the two are one parse in two shapes rather
-# than two rules.
-#
-# AND A THIRD SHAPE SINCE AMENDMENT 12: the prompt guard asks this one because
-# it COUNTS. `canon_lane` below answers a caller that wants a name back and
-# refuses two with `note` + 2 in this file's own voice; the guard has to print
-# its triple FIRST and then say what is wrong, in its own shape, so it takes the
-# spellings from here and makes the refusal itself. One parse, three readings,
-# and no second rule about what a lane name is.
-#
-# AND IT RETURNS 1 WHERE THE PUBLISHED REGISTER COULD NOT BE READ (#138 item
-# 18): the pipeline's status is the awk's, so a failed read was "no such row".
-# It reads `register_text_checked` (#67), whose status `register_text` drops,
-# and keeps both statuses; every caller that does not check them is unchanged.
-rows_named_ci() {   # <typed name>
-  register_text_checked | awk -v want="$1" '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      t = substr(rest, 1, p2 - 1)
-      if (tolower(t) == tolower(want)) print t
-    }'
-  [ "${PIPESTATUS[0]}${PIPESTATUS[1]}" = 00 ]
-}
-
-# ====================================================== AMENDMENT 16 =======
-#
-# THE LANE ALIAS TABLE — `lanes/aliases.tsv`, `<old>	<new>	<UTC>` — AND THE
-# ONE SEAT EVERY READER SHARES.
-#
-# Clause (e): *"Every reader that takes a lane name — `who`, `lanes`,
-# `live-holder`, `history`, Rule 6 attribution, `lane-start`'s row lookup, the
-# `SessionStart` block and Amendment 12's guard — resolves through it,
-# case-insensitively (Amendment 15), before it reads."* THAT LIST IS NOT BUILT
-# AS A LIST. Amendment 15 already put `canon_lane` in front of every one of
-# those reads — each subcommand arm below spells
-# `lane="$(canon_lane "$lane")" || exit 2`, and `lane-start`, `lane-end`, `lane`
-# and `lane-handoff` each call the `canon-lane` subcommand — so the resolution
-# is hooked THERE, once, and the guard's own two lookups take the same function
-# one layer down. A list of readers is a list somebody has to keep complete.
-#
-# READ FROM `origin/<branch>` LIKE THE REGISTER (R19), falling back to this
-# checkout's own file — `register_text`'s exact shape, for its exact reason:
-# `rename-lane` lands the row and this table in ONE commit, so a reader taking
-# one from the working tree and the other from `origin` could see an alias whose
-# row has not arrived here, or a row whose alias has not.
-LANES_ALIAS_CACHE=""
-LANES_ALIAS_ERR=""
-# THE REASON IS WRITTEN WHERE THE PARENT CAN READ IT, and that is not a
-# nicety: every caller of `lane_alias_text` reaches it through a COMMAND
-# SUBSTITUTION — `lane_alias_hop`, `lane_alias_target` and `lane_alias_keys`
-# are all taken with `$( )`, and `rows_named_ci_alias` is taken with one by
-# `canon_lane` — so a variable set here dies with the subshell, and every
-# refusal below printed `(unknown error)`: fail-closed, and silent about what
-# to fix. It goes in a file beside the events cache, which `cleanup` already
-# sweeps (`rm -f -- "$SE_CACHE_FILE".*`), exactly as `SE_WARN_FILE` carries a
-# warning raised inside the same kind of substitution. The variable is kept as
-# the answer for a process that has no temporary file at all — `mktemp` can
-# fail, and `SE_CACHE_FILE` is empty when it does.
-lane_alias_fail() {   # <reason>
-  LANES_ALIAS_ERR="${1-}"
-  laf_f="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliaserr}"
-  [ -n "$laf_f" ] && printf '%s' "${1-}" > "$laf_f" 2>/dev/null
-  return 0
-}
-# AND IT IS NOT ITS OWN FALLBACK. The file is the reason THIS process last
-# failed with; the variable is the reason THIS SHELL last failed with; and
-# where there is neither, the sentence still has to read as English, so the
-# words are spelled out here rather than left to a caller's `${x:-…}`.
-lane_alias_err() {
-  lae_f="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliaserr}"
-  if [ -n "$lae_f" ] && [ -s "$lae_f" ]; then cat -- "$lae_f"; return 0; fi
-  printf '%s' "${LANES_ALIAS_ERR:-unknown error}"
-  return 0
-}
-# A READ THAT FAILED IS NOT AN EMPTY TABLE (Copilot round 1 on openRepoTools#81).
-# `cat … 2>/dev/null || :` made a permission or IO fault on `lanes/aliases.tsv`
-# indistinguishable from an estate that has never renamed a lane — and the two
-# have opposite consequences: the second means a name resolves to itself, while
-# the first means a name whose row moved resolves to NOTHING, so a reader misses
-# that lane's whole history and `rename-lane` validates its cycle test against a
-# table it could not read. Clause (e) promises the old name resolves FOR EVER, so
-# this fails CLOSED: 5, with the reason in `LANES_ALIAS_ERR`, which the writer
-# turns into a refusal and every reader says out loud.
-lane_alias_text() {
-  if [ -n "$LANES_ALIAS_CACHE" ]; then printf '%s\n' "$LANES_ALIAS_CACHE"; return 0; fi
-  lat_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliases}"
-  # THE CACHE'S OWN READ IS CHECKED (Copilot round 5 on openRepoTools#81). The
-  # `return 0` under an unchecked `cat` was the fail-closed rule with a hole in
-  # it: a cache this process wrote and cannot now read would answer EMPTY with
-  # status 0, and a former lane name would resolve as new — which is the one
-  # outcome every other branch of this function exists to refuse.
-  if [ -n "$lat_c" ] && [ -s "$lat_c" ]; then
-    cat -- "$lat_c" || {
-      lane_alias_fail "the cached copy at $lat_c could not be read"
-      return 5
-    }
-    return 0
-  fi
-  # A FRESH READ BEGINS HERE, so the reason the LAST one failed with goes: the
-  # file outlives the subshell that wrote it on purpose, and an answer kept
-  # past the read it belongs to is the stale kind of honesty.
-  lat_t=""; LANES_ALIAS_ERR=""
-  lat_e="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliaserr}"
-  [ -n "$lat_e" ] && rm -f -- "$lat_e"
-  # AMENDMENT 14 — under `--index`, the table as the indexed commit carried it;
-  # where it carried none, the same local fallbacks below.
-  if [ -n "$LANES_IDX_DIR" ] && [ -f "$LANES_IDX_DIR/aliases" ]; then
-    lat_t="$(cat -- "$LANES_IDX_DIR/aliases" 2>/dev/null)" || {
-      lane_alias_fail "the index's copy at $LANES_IDX_DIR/aliases could not be read"
-      return 5
-    }
-  elif [ -z "$LANES_IDX_DIR" ] && have_remote_ref && git -C "$LANES_REPO" cat-file -e "origin/$LANES_BRANCH:$LANES_ALIASES_PATH" 2>/dev/null; then
-    lat_t="$(git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$LANES_ALIASES_PATH" 2>/dev/null)" || {
-      lane_alias_fail "git show origin/$LANES_BRANCH:$LANES_ALIASES_PATH failed, and the object is there"
-      return 5
-    }
-  elif [ -n "${LANES_ALIASES_TSV:-}" ] && [ -f "$LANES_ALIASES_TSV" ]; then
-    lat_t="$(cat -- "$LANES_ALIASES_TSV" 2>/dev/null)" || {
-      lane_alias_fail "$LANES_ALIASES_TSV is there and could not be read"
-      return 5
-    }
-  elif [ -n "${LANES_ALIASES_TSV:-}" ] \
-       && { [ -e "$LANES_ALIASES_TSV" ] || [ -L "$LANES_ALIASES_TSV" ]; }; then
-    # SOMETHING IS THERE AND IT IS NOT A TABLE (Copilot round 8 on
-    # openRepoTools#81). A directory, a FIFO, a socket or a DANGLING symlink at
-    # this path makes `-f` false, and the branch was simply skipped: the empty
-    # answer below was cached and handed back with status 0, so a former lane
-    # name read as NEW — and `lane-start` then appends a SECOND row for a lane
-    # that has been running all day, which is Amendment 15(a)'s duplicate
-    # arrived at through a READ. `-L` is asked beside `-e` because `-e` is FALSE
-    # on a dangling link, the same pair the handoff's destination test uses.
-    #
-    # AND THE READER'S RULE IS NARROWER THAN THE WRITER'S, deliberately. The
-    # writer refuses a LIVE symlink to a regular file as well, because it
-    # appends in place and a redirect follows one into whatever is at the far
-    # end; a reader that follows the same link gets the table's own bytes and is
-    # right to, so `-f` above answers it and says nothing. What is refused here
-    # is only what cannot be READ — which is why the two say different words.
-    if [ -L "$LANES_ALIASES_TSV" ]; then
-      lane_alias_fail "$LANES_ALIASES_TSV is a symlink whose target is not a regular file"
-    else
-      lane_alias_fail "$LANES_ALIASES_TSV exists and is not a regular file"
-    fi
-    return 5
-  fi
-  # AND THE EMPTY ANSWER IS CACHED TOO, as one comment line in the table's own
-  # grammar. An estate that has never renamed a lane is the ordinary case, and
-  # without this the `cat-file -e` above would run again for every `canon_lane`
-  # of every command — which is the cost `table_lookup` one screen up exists to
-  # avoid, made per process instead of per lane.
-  LANES_ALIAS_CACHE="${lat_t:-# no lane aliases}"
-  if [ -n "$lat_c" ]; then
-    printf '%s\n' "$LANES_ALIAS_CACHE" > "$lat_c.${BASHPID:-$$}" 2>/dev/null &&
-      mv -f -- "$lat_c.${BASHPID:-$$}" "$lat_c" 2>/dev/null ||
-      rm -f -- "$lat_c.${BASHPID:-$$}"
-  fi
-  printf '%s\n' "$LANES_ALIAS_CACHE"
-}
-
-# BOTH COPIES OF IT, and the flag that says the awk file has been asked for:
-# the variable this shell holds, the file every subshell reads, and the path
-# `LOG_AWK` was handed (ruling 12's rule for the register cache, which this one
-# is a twin of). Called by `log_sync`, because a fetch moves the ref this is
-# read from, and by `rename-lane` after its own commit, because the alias it
-# just wrote is the one the comments below it are computed with.
-lane_alias_flush() {
-  LANES_ALIAS_CACHE=""
-  LANES_ALIAS_ERR=""
-  laf_e="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliaserr}"
-  [ -n "$laf_e" ] && rm -f -- "$laf_e"
-  laf_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.aliases}"
-  [ -n "$laf_c" ] && rm -f -- "$laf_c"
-  return 0
-}
-
-# lane_alias_target <typed> [<forbidden>] — the END of that name's alias chain.
-#   0 + the name   the table names it (a chain `a→b`, `b→c` answers `c`)
-#   1 + nothing    the table does not name it
-#   3 + nothing    the table holds a CYCLE through it
-#   4 + nothing    the chain VISITS <forbidden> — `rename-lane`'s cycle test,
-#                  which asks of the table as it WILL be: adding `<old> →
-#                  <new>` closes a cycle exactly when the chain from `<new>`
-#                  reaches `<old>`, and reaching it ANYWHERE counts, not only
-#                  at the end (a chain `new → old → x` ends at `x` and still
-#                  closes, because the new row is appended last and wins the
-#                  key `old`).
-#   5 + nothing    the table could not be READ (fail closed; `LANES_ALIAS_ERR`)
-#
-# Case-insensitive on both sides (Amendment 15). THE LAST ROW FOR A KEY WINS:
-# the file is append-ordered, and a name renamed away, minted again and renamed
-# again has two rows of which the later is the answer a reader today needs.
-#
-# THE WALK IS BOUNDED BY THE TABLE AND NOT BY A NUMBER (Copilot round 1 on
-# openRepoTools#81). It was `for (i = 0; i < 32; i++)`, which is a CAP on a
-# valid chain as well as on a cycle: an estate that renamed one lane thirty-three
-# times would have its earliest names resolve to an INTERMEDIATE one, which has
-# no row, so `canon_lane` would answer a name nothing carries and clause (e)'s
-# "for ever" would quietly end at hop 32. The `seen` set is what guarantees
-# termination — every hop consumes one key of a finite map — so the bound is the
-# number of keys plus one, which no honest chain can exceed and no cycle can
-# reach without closing first.
-lane_alias_target() {   # <typed name> [<forbidden name>]
-  lat_out="$(lane_alias_text)" || return 5
-  printf '%s\n' "$lat_out" | awk -F'\t' -v want="$1" -v stop="${2-}" '
-    /^[ \t]*#/ { next }
-    NF >= 2 {
-      k = $1; v = $2
-      gsub(/^[ \t]+|[ \t]+$/, "", k); gsub(/^[ \t]+|[ \t]+$/, "", v)
-      if (k == "" || v == "") next
-      if (!(tolower(k) in map)) nmap++
-      map[tolower(k)] = v
-    }
-    END {
-      cur = want; ls = tolower(stop)
-      for (i = 0; i <= nmap; i++) {
-        lk = tolower(cur)
-        if (stop != "" && lk == ls) { hit = 1; break }
-        if (lk in seen) { cyc = 1; break }
-        if (!(lk in map)) break
-        seen[lk] = 1; cur = map[lk]; hops++
-      }
-      if (hit) exit 4
-      if (cyc) exit 3
-      if (hops > 0) { print cur; exit 0 }
-      exit 1
-    }'
-}
-
-# ONE HOP, and the reason it exists apart from the walk above: "a ROW WINS OVER
-# AN ALIAS" has to be asked at EVERY hop and not only at the start (Copilot round
-# 1). After `A → B`, a lane legitimately minted under the name `A` again — the
-# position `A` freed is one `lane_next_free` will hand out — makes `A` both a row
-# and an alias key, and a chain `C → A` must then stop AT `A`, which is a lane,
-# rather than carry on to `B`, which is a different one. Walking hop by hop in
-# the shell is what lets the row test sit between the hops; the chains this
-# estate writes are one or two long, and `register_text` is cached, so the cost
-# is an awk per hop over a table of a few lines.
-#   0 + the next name · 1 + nothing · 5 the table could not be read
-lane_alias_hop() {   # <name>
-  lah_out="$(lane_alias_text)" || return 5
-  printf '%s\n' "$lah_out" | awk -F'\t' -v want="$1" '
-    /^[ \t]*#/ { next }
-    NF >= 2 {
-      k = $1; v = $2
-      gsub(/^[ \t]+|[ \t]+$/, "", k); gsub(/^[ \t]+|[ \t]+$/, "", v)
-      if (k == "" || v == "") next
-      map[tolower(k)] = v
-    }
-    END { if (tolower(want) in map) { print map[tolower(want)]; exit 0 } exit 1 }'
-}
-
-# lane_alias_keys — every key of the table, one per line, as written. The one
-# caller is `rename-lane`, which refuses a `<new>` that is already a key
-# (Copilot round 1): a row under a former name TAKES PRECEDENCE over the alias,
-# so minting one deliberately would end that former name's resolution — the one
-# thing clause (e) promises never happens.
-lane_alias_keys() {
-  lak_out="$(lane_alias_text)" || return 5
-  printf '%s\n' "$lak_out" | awk -F'\t' '
-    /^[ \t]*#/ { next }
-    NF >= 2 { k = $1; gsub(/^[ \t]+|[ \t]+$/, "", k); if (k != "") print k }'
-}
-
-# Every ROW SPELLING that answers for <typed>: its own rows, and where it has
-# none, the rows of the first name along its alias chain that HAS one. Used by
-# `canon_lane` below and by the guard's window and session lookups, which are
-# the two seats that read a row from a name without going through `canon_lane`.
-#
-# A ROW WINS OVER AN ALIAS, AT EVERY HOP AND NOT ONLY AT THE START (Copilot
-# round 1 on openRepoTools#81). A name that is a lane today IS that lane — which
-# is what makes renaming a lane BACK to a name readable — and the chain has to
-# be walked with that test BETWEEN the hops, because an alias key can become a
-# row again: `A → B` frees the name `A`, `lane_next_free` hands that position
-# out, and a later `C → A` must then answer `A`, the lane, rather than running
-# on to `B`, which is a different one. Taking only the END of the chain answered
-# `B` and lost `C`'s own lane.
-#
-# The loop is bounded by a `seen` list rather than by a number, for
-# `lane_alias_target`'s reason: every hop consumes one key of a finite table.
-#   0 + the row spellings (possibly none) · 5 the alias table could not be READ
-#
-# AND THE 5 IS CARRIED, NOT SWALLOWED (Copilot round 3 on openRepoTools#81). It
-# was `|| return 0`, which hands a caller an EMPTY answer — "no row under this
-# name" — for a table nobody could read. Every caller then falls to its own
-# not-a-lane branch: `canon_lane` answers the typed spelling, so `lane-start`
-# reads a renamed lane as new and appends a SECOND row; the guard falls to
-# `lane_shaped` and sends a running session to bind a row it already has. That
-# is the fail-OPEN direction on the one promise clause (e) makes, so the status
-# is propagated and each caller decides what to do with it.
-rows_named_ci_alias() {   # <typed name>
-  rna_hits="$(rows_named_ci "$1" 2>/dev/null || :)"
-  if [ -n "$rna_hits" ]; then printf '%s\n' "$rna_hits"; return 0; fi
-  rna_cur="$1"; rna_seen="$US$(lc "$1")$US"
-  while :; do
-    rna_rc=0
-    rna_next="$(lane_alias_hop "$rna_cur" 2>/dev/null)" || rna_rc=$?
-    [ "$rna_rc" = 5 ] && return 5
-    [ "$rna_rc" = 0 ] && [ -n "$rna_next" ] || return 0
-    case "$rna_seen" in *"$US$(lc "$rna_next")$US"*) return 0 ;; esac
-    rna_seen="$rna_seen$(lc "$rna_next")$US"
-    rna_hits="$(rows_named_ci "$rna_next" 2>/dev/null || :)"
-    if [ -n "$rna_hits" ]; then printf '%s\n' "$rna_hits"; return 0; fi
-    rna_cur="$rna_next"
-  done
-}
-
-# canon_lane <typed> — the name every `<lane>` argument and `$LANES_LANE` is
-# read through BEFORE anything is read or written under it.
-#
-#   exactly one row matches, ignoring case   its OWN spelling
-#   no row matches                           the typed spelling, unchanged —
-#                                            which is what `add-row` needs, and
-#                                            what makes a brand-new lane's
-#                                            first act possible at all
-#   two or more                              REFUSE (2), naming them all
-#
-# IT RETURNS AND NEVER EXITS, for `row_line`'s reason: every caller takes it
-# with `$( )`, and an `exit` there would leave only the substitution's subshell
-# while the caller carried on with an empty lane name. The callers spell it
-# `lane="$(canon_lane "$lane")" || exit 2`.
-#
-# THE REFUSAL IS THE AMENDMENT'S OWN AND IT BELONGS TO EVERY WRITER, not only
-# to `lane-start`, which has refused two rows for one name since Amendment 5:
-# clause (b) says *"where the register already holds two rows that differ only
-# by case, every writer REFUSES, naming both, until they are merged"*. Merging
-# them is 15(d)'s act and a person's — the newer row's session id(s) appended to
-# the older row's cell, in order, and the newer row removed in the same commit —
-# because a tool that merged two rows of history on its own would be choosing
-# which lane's record survives.
-#
-# AMENDMENT 16(e) — AND A NAME WITH NO ROW IS ASKED OF THE ALIAS TABLE BEFORE
-# the typed spelling is handed back. This is clause (e)'s whole implementation
-# and it is one function deep: a renamed lane's OLD name, from a line, a window,
-# a session record or a person's typing, lands on the row it is now. The order
-# is row first and alias second — a name that is a lane today is that lane — and
-# the resolution SAYS SO on stderr, because every act under an old name is an
-# act on a lane the caller did not name.
-canon_lane() {   # <typed name>
-  cl_want="${1-}"
-  [ -n "$cl_want" ] || return 0
-  cl_rc=0
-  cl_hits="$(rows_named_ci_alias "$cl_want" 2>/dev/null)" || cl_rc=$?
-  # AN ALIAS TABLE THAT CANNOT BE READ IS A REFUSAL HERE TOO (Copilot round 3
-  # on openRepoTools#81). This function's answer is what `lane-start` decides
-  # "is this lane new" by and what `register-row` reports, so carrying on with
-  # the typed spelling is not a read-only shrug: with a row under `<new>` and an
-  # unreadable table, `lane-start <repo> <n>` reads the former name as absent
-  # and appends a SECOND row — the duplicate Amendment 15(a) exists to refuse.
-  # R22's rule governs: a read that could not be performed is never an answer.
-  if [ "$cl_rc" = 5 ]; then
-    note "${LANES_ALIASES_PATH:-lanes/aliases.tsv} COULD NOT BE READ ($(lane_alias_err)), so whether '$cl_want' is a FORMER name of some lane is NOT established — which is not the same as it not being one (Amendment 16(e))."
-    note "Nothing is read or written under a name this register cannot resolve: a rename's alias would be invisible, and a lane that has one would read as new. Fix the read — the table is ${LANES_ALIASES_TSV:-<no path>} here and ${LANES_ALIASES_PATH:-lanes/aliases.tsv} on origin/$LANES_BRANCH — and re-run."
-    # 66 AND NOT 2, BECAUSE 2 ALREADY MEANS SOMETHING TO FOUR CALLERS (Copilot
-    # round 4). `lane-start`, `lane-end`, `lane` and `lane-handoff` each read
-    # `canon-lane`'s 2 as EITHER Amendment 15(d)'s two-rows refusal — told by
-    # the words in its message — or the unknown-subcommand 2 of a helper that
-    # predates Amendment 15, which they carry on past with the name as typed.
-    # A third meaning on that number lands in the second branch, which is the
-    # fail-OPEN this refusal exists to close. 66 is EX_NOINPUT: an input file
-    # that did not exist or could not be read, which is exactly what happened,
-    # and a code none of the four recognises makes `lane` and `lane-handoff`
-    # refuse where they stand — the other two are taught it in this same commit.
-    return 66
-  fi
-  cl_n="$(printf '%s' "$cl_hits" | grep -c . || :)"
-  if [ "$cl_n" -gt 1 ]; then
-    note "the register has $cl_n rows whose lane names differ only by case for '$cl_want': $(printf '%s' "$cl_hits" | tr '\n' ' ')"
-    note "a lane name is ONE name under any case (Amendment 15), so no read and no write under it is unambiguous. Merge them into one row (Amendment 15(d)): append the newer row's session id(s) to the older row's session cell, in order, remove the newer row in the SAME commit, and name both spellings in the commit message."
-    return 2
-  fi
-  cl_out="$cl_want"
-  if [ "$cl_n" = 1 ]; then
-    cl_out="$cl_hits"
-  else
-    # NO ROW UNDER EITHER NAME. The alias still answers where the table names
-    # it — a lane whose row has since been archived keeps its log, and reading
-    # that log under the old name is the whole point of the table.
-    cl_al=""; cl_arc=0
-    cl_al="$(lane_alias_target "$cl_want" 2>/dev/null)" || cl_arc=$?
-    if [ "$cl_arc" = 3 ]; then
-      note "${LANES_ALIASES_PATH:-lanes/aliases.tsv} resolves '$cl_want' in a CYCLE, so it names no lane at all: a rename chain that returns to its own start has no end to resolve to. \`rename-lane\` refuses to write one, so this table was edited by hand — take the offending row out of it. Carrying on with '$cl_want' exactly as typed."
-    elif [ "$cl_arc" = 5 ]; then
-      # UNREACHABLE BY THE PATH ABOVE, which already refused a 5 — kept because
-      # this arm is the second reader of the same table and a silent
-      # disagreement between two readers of one file is worth a line of code.
-      note "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err))."
-      return 66
-    elif [ -n "$cl_al" ]; then
-      cl_out="$cl_al"
-    fi
-  fi
-  if [ "$(lc "$cl_out")" != "$(lc "$cl_want")" ]; then
-    note "'$cl_want' is a FORMER name of lane $cl_out (${LANES_ALIASES_PATH:-lanes/aliases.tsv}, Amendment 16(e)) — reading and writing $cl_out."
-  fi
-  printf '%s' "$cl_out"
-  return 0
-}
-
-uuids_in_cell() { grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tr 'A-F' 'a-f' || :; }
-
-session_ids_of_lane() {
-  si_row="$(row_of_lane "$1")"
-  [ -n "$si_row" ] || return 1
-  row_cell "$si_row" 3 | uuids_in_cell
-}
-session_ids_local_of_lane() {
-  sl_row="$(row_of_lane_local "$1")"
-  [ -n "$sl_row" ] || return 1
-  row_cell "$sl_row" 3 | uuids_in_cell
-}
-# THE SAME UNION, AND IT SAYS WHETHER IT COULD READ IT (opensoft/openRepoTools#67).
-# The pair above answer 1 for "this lane has no row" AND for "the register could
-# not be read" — `row_of_lane` is `register_text | awk`, and `awk` answers 0
-# over an empty render — so a caller that unions them with `|| :` holds an
-# EMPTY id set either way. For most of them that is harmless. For the three
-# that take an empty set as a VERDICT it is fail-open: `holder_is_dead` hands it
-# to `live_holder`, whose 8 then calls a lane dead that nobody could check,
-# `duplicate_holder_pids` answers "no duplicate" without looking, and
-# `lane_reconcile` pronounces a crash on that same 8 (#113 item 1). Those three
-# ask this read instead, and the pair keep their contract for everyone else.
-#
-#   0  the published-union-local ids, one per line, published first, deduped
-#   8  BOTH copies were read and neither gives this lane a transcript uuid: no
-#      row, or a row whose session cell holds none — an answer either way, the
-#      same one `live_holder` already gives an empty cell
-#   1  the published register (or, with none published, the working tree's) or
-#      the working tree's own copy could not be read: NOT an empty set
-session_ids_checked() {   # <lane>
-  sc_pub=""; sc_loc=""
-  sc_pub="$(register_text_checked 2>/dev/null)" || return 1
-  sc_loc="$(row_of_lane_local "$1" 2>/dev/null)" || return 1
-  sc_ids="$(row_cell "$(printf '%s\n' "$sc_pub" | awk -v lane="$1" "$ROW_AWK")
-$sc_loc" 3 | uuids_in_cell | awk 'NF && !seen[$0]++')"
-  [ -n "$sc_ids" ] || return 8
-  printf '%s\n' "$sc_ids"
-}
-last_session_id_of_lane() { session_ids_of_lane "$1" 2>/dev/null | tail -n1; }
-# The handoff path is the row's SIXTH column — awk field 7, because $1 is the
-# empty string before the leading pipe. Counting back from NF was wrong for any
-# row with a literal `|` inside a cell, and the live register has two: of 45
-# rows, 43 split into 9 fields, one into 10 and one into 11, and for the last
-# of those NF-2 is the tail of the state cell (` re-cut `) rather than the
-# handoff. `lane_workstation` below counts from the left for the same reason.
-handoff_of_lane() {
-  hl_row="$(row_of_lane "$1")"
-  [ -n "$hl_row" ] || return 1
-  row_cell "$hl_row" 7 | sed 's/^ *//; s/ *$//'
-}
-
-short_ws() { printf '%s' "${1%%.*}" | tr 'A-Z' 'a-z'; }
-
-# Column 3 of the row is `<workstation> / <env> / <user>`. A lane recorded on
-# ANOTHER workstation cannot be liveness-checked from here at all: the session
-# records are local files. Saying NOT LIVE about it would be a claim this
-# machine has no way to make.
-lane_workstation() {
-  lw_row="$(row_of_lane "$1")"
-  [ -n "$lw_row" ] || return 1
-  row_cell "$lw_row" 4 | sed 's/^ *//; s/ *$//; s| */.*||' | awk '{print $1}'
-}
-lane_is_elsewhere() {
-  lw="$(lane_workstation "$1" 2>/dev/null || :)"
-  [ -n "$lw" ] || return 1
-  [ "$(short_ws "$lw")" != "$(short_ws "$WS")" ]
-}
-
-# The session id an event line carries: what the caller says it is, else the
-# lane's current one (Amendment 6(b): the LAST id in the cell), else NOTHING.
-#
-# R-A11 (e) — IT NO LONGER SUBSTITUTES THE LITERAL `unknown`. It did, and that
-# literal is in the append-only log four times already, in two lanes
-# (`lanes/log/codeXfactory-1.md` ×3, `lanes/log/openxfactory-4-opendox-extraction.md`
-# ×1 on `origin/main`) — written by `log PAUSED` from a swap skill that had the
-# uuid in hand and did not pass it, and by `release`. Amendment 7(b) makes that
-# field a transcript uuid and ONLY that. Returning empty hands the decision to
-# `write_event`, which refuses the write and names the act that supplies the
-# uuid; the four lines already written stay exactly where they are (Amendment
-# 7(b) forbids editing them, 7(i)'s cutover rule governs).
-session_for() {
-  if [ -n "${LANES_SESSION:-}" ]; then printf '%s\n' "$LANES_SESSION"; return 0; fi
-  last_session_id_of_lane "$1" 2>/dev/null || :
-}
-
-# ----------------------------------------------------- project.yaml legs
-#
-# openRepoShape's assembly-root manifest: a top-level `legs:` list of
-# `- role: assembly|spec|code` / `repository: owner/repo` / `path:`. Two
-# repositories are legs of ONE project when one manifest names them both.
-#
-# ONLY `legs[].repository` is read, and only as navigation. The manifest says
-# of itself that it CONFERS NOTHING — `role:` in particular grants nothing and
-# is never read here.
-#
-# `family.yaml`'s `members:` is deliberately NOT read, though its entries carry
-# a `repository:` too. A family is broader than a project — `InkRouter` holds
-# `IRRS` and `IRSS`, separate projects with separate lanes — and the ruling
-# said legs. Two repos in one family ARE a crossing.
-project_legs_file() {
-  [ -f "$1" ] || return 1
-  awk '
-    /^[A-Za-z_][A-Za-z0-9_]*:/ { inlegs = ($0 ~ /^legs:/); next }
-    !inlegs { next }
-    /^[ \t]*#/ { next }
-    /^[ \t]+repository:[ \t]*/ {
-      v = $0
-      sub(/^[ \t]+repository:[ \t]*/, "", v)
-      sub(/[ \t]+$/, "", v)
-      gsub(/^"|"$/, "", v)
-      gsub(/^'"'"'|'"'"'$/, "", v)
-      if (v != "") print v
-    }' "$1"
-}
-
-# ------------------------------------------- an assembly's legs, by path
-#
-# opensoft/openRepoTools#186, plan task T018 — WHERE A TRIAD'S LEGS ARE CHECKED
-# OUT, for the lane tooling that has to look inside one: `lane-worktrees`' sweep,
-# its daily report and its `add`, `lane-handoff`'s writer poll, and
-# `lane-reconcile` below. A checkout IS AN ASSEMBLY when its own `project.yaml`
-# declares a leg other than itself — the standard's own rule (openRepoShape's
-# `templates/assembly-root/project.yaml`: a top-level `legs:` list of `- role:` /
-# `repository:` / `path:`, the assembly's own leg at `path: "."`). A checkout
-# with no such file, or one naming no leg but itself, is every single
-# repository, and every reader asks it nothing more than it did before.
-#
-# THE READING IS `lane-start`'s RUNG 5, LINE FOR LINE, and never a second
-# grammar: rung 5 resolves ONE leg's path for the home it is given, and this
-# prints every leg the block declares, as `<repository><TAB><path>`. The seven
-# lines that decide what a leg is are byte-identical to that reader's, and
-# `tests/test_triad_lane_tooling.py` holds them so. As there, ONLY `repository:`
-# and `path:` are read, and only as navigation: the manifest CONFERS NOTHING,
-# and `role:` is never read.
-project_leg_paths_file() {   # <manifest>
-  [ -f "$1" ] || return 1
-  awk '
-      /^[A-Za-z_][A-Za-z0-9_]*:/ { inlegs = ($0 ~ /^legs:/); repo = ""; path = ""; next }
-      !inlegs { next }
-      /^[ \t]*-[ \t]/ { repo = ""; path = "" }
-      /^[ \t]+repository:[ \t]*/ { v = $0; sub(/^[ \t]+repository:[ \t]*/, "", v)
-        sub(/[ \t]+$/, "", v); gsub(/^"|"$/, "", v); gsub(/^'"'"'|'"'"'$/, "", v); repo = v }
-      /^[ \t]+path:[ \t]*/ { v = $0; sub(/^[ \t]+path:[ \t]*/, "", v)
-        sub(/[ \t]+$/, "", v); gsub(/^"|"$/, "", v); gsub(/^'"'"'|'"'"'$/, "", v); path = v }
-      repo != "" && path != "" { print repo "\t" path; repo = ""; path = "" }' "$1"
-}
-
-# THE LEGS OF ONE CHECKOUT, one a line: `<repository><TAB><path as
-# declared><TAB><where it is checked out>`, the last being the declared path
-# resolved against the checkout as rung 5 resolves it. The assembly's own `.`
-# is left out: it IS the checkout. 0 with legs; 8 with none — no
-# `project.yaml`, or one naming no leg but the checkout itself; 1 where the
-# manifest is there and could not be read, which is never "no legs" (R22,
-# Amendment 7(d)).
-assembly_legs() {   # <checkout>
-  al_dir="${1-}"; al_dir="${al_dir%/}"; al_rows=""; al_out=""; al_tab="$(printf '\t')"
-  [ -n "$al_dir" ] || return 8
-  al_m="$al_dir/project.yaml"
-  [ -e "$al_m" ] || [ -L "$al_m" ] || return 8
-  { [ -f "$al_m" ] && [ -r "$al_m" ]; } || return 1
-  al_rows="$(project_leg_paths_file "$al_m")" || return 1
-  while IFS="$al_tab" read -r al_repo al_path; do
-    al_path="${al_path%/}"
-    case "$al_path" in
-      ''|.|./.) continue ;;
-      /*) al_abs="$al_path" ;;
-      ./*) al_abs="$al_dir/${al_path#./}" ;;
-      *) al_abs="$al_dir/$al_path" ;;
-    esac
-    al_out="$al_out$al_repo$al_tab$al_path$al_tab$al_abs
-"
-  done <<AL_ROWS
-$al_rows
-AL_ROWS
-  [ -n "$al_out" ] || return 8
-  printf '%s' "$al_out"
-  return 0
-}
-
-# Manifests are looked for where the estate keeps them: one level under
-# $PROJECTS_ROOT (`~/projects/MedxEHR/project.yaml`) and two
-# (`~/projects/InkRouter/IRRS/project.yaml`, the shape real register traffic
-# uses today), plus the lane's own checkout when it names one.
-# Every repository spelling, on both sides of the comparison, through the same
-# alias table the object keys go through — a manifest that still spells a
-# pre-move org (`opensoft/codexFactory` where the key canonicalises to
-# `codeXfactory/codexFactory`) is one repository, and comparing the two
-# literally reports a crossing that is not one.
-canon_repo_list() {
-  while IFS= read -r cr_v; do
-    [ -n "$cr_v" ] || continue
-    cr_c="$(alias_lookup "$cr_v" 2>/dev/null || :)"
-    printf '%s\n' "${cr_c:-$cr_v}"
-  done
-}
-
-same_project() {
-  sp_home="$1"; sp_obj="$2"; sp_f=""; sp_legs=""
-  SAME_PROJECT_FILE=""
-  [ -n "$sp_home" ] && [ -n "$sp_obj" ] || return 1
-  sp_c="$(alias_lookup "$sp_home" 2>/dev/null || :)"; sp_home="${sp_c:-$sp_home}"
-  sp_c="$(alias_lookup "$sp_obj"  2>/dev/null || :)"; sp_obj="${sp_c:-$sp_obj}"
-  [ "$sp_home" = "$sp_obj" ] && return 0
-  for sp_f in ${LANES_LANE_DIR:+"$LANES_LANE_DIR/project.yaml"} \
-              "$PROJECTS_ROOT"/*/project.yaml \
-              "$PROJECTS_ROOT"/*/*/project.yaml; do
-    [ -f "$sp_f" ] || continue
-    sp_legs="$(project_legs_file "$sp_f" 2>/dev/null | canon_repo_list || :)"
-    [ -n "$sp_legs" ] || continue
-    printf '%s\n' "$sp_legs" | grep -qx -F -- "$sp_home" || continue
-    printf '%s\n' "$sp_legs" | grep -qx -F -- "$sp_obj"  || continue
-    SAME_PROJECT_FILE="$sp_f"
-    return 0
-  done
-  return 1
-}
-
-# Decision 2, ratified by Brett Heap 2026-09-11 ("yes just warn"): a crossing
-# WARNS and proceeds. It never refuses — the estate crosses routinely
-# (opsXfactory-3 landed 32 distinct PRs into opensoft/Omnigent-Install, every
-# one of them foreign to its home), and a refusal here would be a new gate
-# nobody asked for.
-cross_repo_warn() {
-  cw_obj_repo="$1"; cw_home="$2"; cw_me="$3"; cw_found=0; cw_lane=""; cw_h=""; cw_id=""
-  [ -n "$cw_obj_repo" ] || return 0
-  if [ -z "$cw_home" ]; then
-    note "NOTE: lane $cw_me has no home repo on record, so the cross-repo check did not run (pre-cutover lane: pass --home owner/repo)"
-    return 0
-  fi
-  [ "$cw_obj_repo" = "$cw_home" ] && return 0
-  if same_project "$cw_home" "$cw_obj_repo"; then
-    note "$cw_obj_repo and $cw_home are legs of one project.yaml — not a crossing (${SAME_PROJECT_FILE:-?})"
-    return 0
-  fi
-  note "WARNING: CROSS-REPO — $cw_obj_repo is not lane $cw_me's home ($cw_home). Proceeding: Amendment 7 warns here, it never refuses."
-  while IFS= read -r cw_lane; do
-    [ -n "$cw_lane" ] || continue
-    [ "$cw_lane" = "$cw_me" ] && continue
-    # Both sides through the alias table (R20): home_of_lane resolves its
-    # answer, and the object's repository arrived canonical from canon_object,
-    # so this comparison is between two canonical spellings. It is still made
-    # case-insensitively, because the register spells one repository three ways
-    # in a week and only the TABLE's lookup is case-blind, not its output.
-    cw_h="$(home_of_lane "$cw_lane" 2>/dev/null || :)"
-    [ "$(lc "$cw_h")" = "$(lc "$cw_obj_repo")" ] || continue
-    cw_id="$(last_session_id_of_lane "$cw_lane" 2>/dev/null || :)"
-    if lane_is_elsewhere "$cw_lane"; then
-      note "  lane homed on $cw_obj_repo, on another workstation ($(lane_workstation "$cw_lane")): @$cw_lane — last transcript uuid ${cw_id:-unknown}"
-      cw_found=1
-    elif live_holder "$cw_lane" >/dev/null 2>&1; then
-      note "  LIVE lane homed on $cw_obj_repo: @$cw_lane — last transcript uuid ${cw_id:-unknown} — claude --resume ${cw_id:-<uuid>}"
-      cw_found=1
-    fi
-  done <<EOF
-$(known_lanes)
-EOF
-  [ "$cw_found" = 1 ] || note "  no live lane is homed on $cw_obj_repo"
-  return 0
-}
-
-# ---------------------------------------------------------------- writing
-
-event_line() {
-  el_verb="$1"; el_lane="$2"; el_uuid="$3"; el_utc="$4"; el_obj="$5"; el_ref="${6-}"; el_pay="${7-}"; el_txt="${8-}"
-  el_line="$el_verb — lane $el_lane, session $el_uuid@$WS, $el_utc, $el_obj"
-  [ -n "$el_ref" ] && [ -n "$el_pay" ] && el_line="$el_line $el_ref $el_pay"
-  [ -z "$el_ref" ] && [ -n "$el_pay" ] && el_line="$el_line $el_pay"
-  [ -n "$el_txt" ] && el_line="$el_line — $el_txt"
-  printf '%s\n' "$el_line"
-}
-
-# Rule 6's own rendering of a LANDING / LANDED, for LANES.md — the phrasing
-# every other lane already greps for as the merge hold.
-rule6_line() {
-  r6_verb="$1"; r6_lane="$2"; r6_uuid="$3"; r6_utc="$4"; r6_obj="$5"; r6_pay="${6-}"; r6_n=""
-  r6_n="$(object_number "$r6_obj")"
-  [ -n "$r6_n" ] || return 1
-  r6_line="$r6_verb — lane $r6_lane, session $r6_uuid@$WS, $r6_utc, PR #$r6_n into $(object_repo "$r6_obj") main"
-  [ -n "$r6_pay" ] && r6_line="$r6_line → $r6_pay"
-  printf '%s\n' "$r6_line"
-}
-
-# write_event <lane> <verb> <object> <ref> <payload> <text> <utc> <uuid>
-# Appends to the lane's log and commits — and for a LANDING or a LANDED
-# appends Rule 6's line to LANES.md in the SAME commit, two pathspecs, so the
-# register and the log can never disagree about a merge hold.
-write_event() {
-  we_lane="$1"; we_verb="$2"; we_obj="$3"; we_ref="$4"; we_pay="$5"; we_txt="$6"; we_utc="$7"; we_uuid="$8"
-  # R-A11 (e) — THE `session` FIELD IS A TRANSCRIPT UUID AND ONLY THAT, AND THE
-  # WRITER ITSELF IS WHERE THAT IS ENFORCED. Amendment 7(b) says so of the
-  # grammar; nothing checked it, and the literal `unknown` is in the append-only
-  # log four times already, in two lanes — three from `log PAUSED` (a swap skill
-  # holding the uuid and not passing it) and one from `release`. The log is
-  # append-only, so a line written wrong there is wrong for ever and no later
-  # line can correct it. Refused HERE rather than in the `log` arm because the
-  # same field is written by `claim` and `release` too, and one of the four came
-  # from `release`: this is the writer, so this is the gate.
-  #
-  # It is the FIRST test in the function, before the lock, before the capture
-  # and before the log file is created, so a refusal leaves the checkout exactly
-  # as it found it — and it names the act that supplies the uuid rather than the
-  # rule it broke, because the caller's next move is that act.
-  #
-  # This composes with `R-A8-2` rather than repeating it: `R-A8-2` stopped
-  # `lane-start` WRITING `unknown` (its title-fallback path defers the line
-  # instead); this stops the writer ACCEPTING it, from any caller.
-  if ! valid_uuid "$we_uuid"; then
-    we_bad="${we_uuid:-<empty>}"
-    case "$we_uuid" in
-      unknown) we_why="'unknown' is the one value this field must never carry: it is in this append-only log four times already, and no later line can correct any of them" ;;
-      session_*) we_why="'$we_bad' is a PR-footer id, which is neither resumable nor liveness-checkable (Amendment 6(b))" ;;
-      *) we_why="'$we_bad' is not a transcript uuid" ;;
-    esac
-    die "an event's session field is the TRANSCRIPT UUID and only that (Amendment 7(b)): $we_why. Nothing was written — not the $we_verb line, not the log file, not a commit. Name the session taking the act: LANES_SESSION=\"\$CLAUDE_CODE_SESSION_ID\" LANES_LANE=$we_lane lanes-edit.sh <subcommand> …   If lane $we_lane has no transcript uuid recorded at all, the act that gives it one is Amendment 6(c)'s session-cell append: run 'lane-start --no-launch <repo> <n>' in the lane's own window first" 2
-  fi
-  # THE WRITER REFUSES A FIELD THAT WOULD MAKE THE LINE UNREADABLE (R21).
-  # ` — ` divides a line into its three parts, and the grammar guarantees it
-  # occurs AT MOST TWICE — once after the verb, once before the free text — so
-  # that one parser reads every line. A payload or a free text carrying a third
-  # one breaks that guarantee in a file nothing ever rewrites; so does a
-  # newline, which `append_text_line` would notice only AFTER writing it. Both
-  # are refused here, before the lock and before anything is created, rather
-  # than hoped against.
-  case "$we_pay$we_txt" in
-    *" — "*) die "an event's payload and free text may not contain ' — ': that separator is what divides a line's verb from its fields and its fields from its free text, and a third one leaves the line ambiguous to its own parser. Use a semicolon or a colon instead: '$we_pay$we_txt'" 2 ;;
-  esac
-  if [ "${we_pay//[$'\n\r']/}" != "$we_pay" ] || [ "${we_txt//[$'\n\r']/}" != "$we_txt" ]; then
-    die "an event's payload and free text are ONE line: a newline in either would append several lines to an append-only log, and the proof that only one was added would fail after the write, not before it" 2
-  fi
-  # AND A `, ` IN THE PAYLOAD, WHICH IS CLAUSE (c)'S OTHER SEPARATOR AND WAS IN
-  # NO WRITER AT ALL. ` — ` divides the verb from the fields and the fields from
-  # the free text; `, ` divides THE FIELDS FROM EACH OTHER — `lane <l>, session
-  # <u>@<ws>, <utc>, <object>` — and the payload is the tail of that fourth
-  # field, so a `, ` inside it reads back as a fifth field and a sixth that no
-  # reader knows. `lane-start` fences its `dir`, `window` and `profile` values
-  # one at a time (`:689-692`, `:728-731`, `:1574-1578`) and the `/lane-swap`
-  # skill now fences the same two; this is the backstop under all of them, in the
-  # writer, for the reason this file gives for putting the container guard at the
-  # dispatcher: *"nine copies of one rule is how eight of them would come to
-  # disagree"*.
-  #
-  # THE PAYLOAD AND NOT THE FREE TEXT. The free text is everything after the
-  # SECOND ` — `, where a parser has already finished splitting fields, so a
-  # comma there is ordinary prose and the estate's log is full of it. Refusing it
-  # would refuse lines this estate legitimately writes.
-  #
-  # AND NOT THE `"` EITHER, WHICH IS WHY THIS GUARD IS NARROWER THAN THE ONES
-  # ABOVE IT. Clause (c)'s own rule for a path containing a space is to WRITE IT
-  # QUOTED — `dir "/checkouts/b/my projects/x"`, which is what makes it one ref
-  # under 7(b)'s own grammar. (The amendment spells that example under a home
-  # directory; it is spelled with a neutral root here because
-  # `test_no_committed_file_names_a_host_absolute_path` refuses a `/home/<name>/`
-  # path in any tracked file, and a rule that holds for a real path holds for an
-  # example of one.) One ref under
-  # 7(b) — so `quote_subfield` puts a `"` into the payload deliberately and a `"`
-  # refusal here would refuse the very shape the clause mandates. The `"` belongs
-  # in the per-VALUE fences, where it is, and not in the whole-payload one.
-  #
-  # MEASURED BEFORE IT WAS WRITTEN, against every line this estate has: 111
-  # payloads in `opensoft/brett-wip`'s 15 lane logs carry `, ` 0 times and `"` 0
-  # times, while 76 carry `; ` — the sub-field separator, which this guard must
-  # therefore never touch.
-  case "$we_pay" in
-    *", "*) die "an event's payload may not contain ', ': that separator is what divides an event line's four fields from each other — 'lane <lane>, session <uuid>@<ws>, <utc>, <object>' — and the payload is the tail of the fourth, so a ', ' inside it reads back as fields the log's own parser cannot account for. The log is append-only and no later line can correct it. Use a semicolon, which is the sub-field separator: '$we_pay'" 2 ;;
-  esac
-  # AND IT REFUSES A FREE TEXT THAT BEGINS WITH AN ARROW (R26, Addendum 6).
-  # `→` and `←` introduce the PAYLOAD, and the payload is its own argument.
-  # Quoted into the free-text slot — `log LANDED <obj> "→ <sha>"`, the shape a
-  # reader reaches for because that is how the finished line looks — it is
-  # written AFTER the ` — `, where the parser reads it as prose: the event
-  # carries no payload, `rule6_line` renders the register's Rule 6 line without
-  # `→ <sha>`, and the merge sha is lost in two files that are never rewritten.
-  # Nothing legitimate starts a sentence with an arrow, so the trap is closed
-  # here rather than left to be noticed afterwards.
-  case "$we_txt" in
-    '→'*|'←'*)
-      we_hint="LANES_LANE=$we_lane lanes-edit.sh log $we_verb $we_obj → <payload>"
-      case "$we_verb" in
-        RELEASED)                    we_hint="LANES_LANE=$we_lane lanes-edit.sh release $we_obj \"<why>\"  — a release takes a reason, not a payload" ;;
-        CLAIMED|TAKEOVER|CLAIM-LOST) we_hint="LANES_LANE=$we_lane lanes-edit.sh claim $we_obj" ;;
-      esac
-      die "an event's free text may not begin with '→' or '←': those arrows introduce the PAYLOAD, which is its own argument and comes BEFORE the free text. Quoted into the text slot it is written after the ' — ', where no reader and no parser looks for it — a LANDED that way loses its merge sha from both the log and the register's Rule 6 line, in two files nothing rewrites. Write it positionally, e.g. 'lanes-edit.sh log LANDED <object> → <sha>'; for this call: $we_hint" 2 ;;
-  esac
-  # AMENDMENT 17(b) — the two sub-fields, checked in the writer for the same
-  # reason the session field is: from any caller, before the lock, before the
-  # log file is created, and on a log no later line can correct.
-  pause_subfields_check "$we_pay"
-  # AMENDMENT 18(a) — the binding's three sub-fields, checked where a caller
-  # wrote them and APPENDED where it did not, for the three verbs clause (a)
-  # names. The append is the LAST thing done to the payload, after every
-  # separator guard above has passed on what the caller gave: the writer's own
-  # values are fenced by `lanes_binding_value_ok` before they go in, so the
-  # guards cannot be re-run on them and do not need to be.
-  binding_subfields_check "$we_pay"
-  case "$we_verb" in
-    STARTED|RESUMED|PAUSED)
-      we_pay="$(binding_subfields_add "$we_pay")"
-      # A PAYLOAD THIS APPEND CREATED GETS THE ARROW THAT INTRODUCES ONE. A
-      # lane-kind line written with no payload at all — `log STARTED lane:X`,
-      # which this estate's older lines and several of its callers spell — now
-      # has one, and Amendment 7(b) introduces a payload with `→`. Without it
-      # the line would carry its sub-fields bare after the object: readable by
-      # `LOG_AWK`, which takes an unarrowed tail as the payload, and unlike
-      # every other lane-kind line in the estate.
-      [ -n "$we_ref" ] || [ -z "$we_pay" ] || we_ref='→' ;;
-  esac
-  we_line="$(event_line "$we_verb" "$we_lane" "$we_uuid" "$we_utc" "$we_obj" "$we_ref" "$we_pay" "$we_txt")"
-  we_paths=("$(log_path_for "$we_lane")")
-  we_r6=""
-  case "$we_verb" in
-    LANDING|LANDED) we_r6="$(rule6_line "$we_verb" "$we_lane" "$we_uuid" "$we_utc" "$we_obj" "$we_pay" 2>/dev/null || :)" ;;
-  esac
-  [ -n "$we_r6" ] && we_paths+=("$LANES_PATH")
-  # THE EXEMPTION IS THE PATH THE LOG IS ACTUALLY AT, WHICH NEED NOT BE THE
-  # CANONICAL ONE YET (Amendment 15; Copilot round 4 on openRepoTools#41).
-  # `$we_lane` is the ROW's spelling by the time it reaches here, while the file
-  # may still carry the spelling it was written under until THIS write renames
-  # it — so a lane with uncommitted lines in its own old-cased log met the test
-  # that exists to refuse somebody ELSE's uncommitted work, and could not write
-  # at all. Only the two exemptions take it: `we_paths` is what the capture and
-  # the commit are given and stays exactly what it was, with the old path joining
-  # it below as `LOG_RENAMED_FROM` once the rename has actually happened.
-  we_lp="$(log_path_ci "$we_lane")" || die "lane $we_lane's object log is published twice (above), and one lane is ONE lane under any case: its log is ONE file (Amendment 15). Merge them by hand (Amendment 15(d)) and re-run. Nothing was written." 2
-  # R11 — the register is EXEMPT from this first test, because it is captured
-  # below rather than refused. Everything ELSE this checkout has dirty is
-  # refused HERE: before the lock, before the capture and before anything is
-  # created, so that a refusal leaves the checkout exactly as it found it.
-  refuse_dirty_checkout "write $we_verb" "${we_paths[@]}" "$we_lp" "$LANES_PATH"
-  # THE LIFECYCLE SNAPSHOT AS IT STANDS BEFORE THIS LINE EXISTS (openRepoTools#91,
-  # Copilot round 5 on #97). It is read HERE — before the lock, before the append
-  # and before the commit — because it is the pre-image the follow-up at the foot
-  # of this function compares against: a `RUNNING` written out of an event that
-  # landed an hour ago must not overwrite a `SWAPPING` that began since, and the
-  # only evidence of which came first is what the snapshot said when this write
-  # started. Only the four verbs that move the lifecycle pay for the read.
-  we_pre=""; we_seam=""
-  # THE SEAM, BEFORE THE LOCK AND BEFORE A BYTE (ruling 2026-10-04): EVERY
-  # lane-kind line — the four that move a lifecycle, a swap's `PAUSED`, and
-  # Amendment 18(g)'s `HANDOFF-REQUESTED` (Copilot round 3 on #97) — is a legacy
-  # act on the lane itself, and a managed-owned lane, or one whose ownership
-  # could not be read, refuses it here. Object-kind lines (a claim, a release)
-  # are about the object a lane holds and are not the lane's ownership.
-  is_lane_verb "$we_verb" && managed_seam_refuse "$we_lane" "a $we_verb line in its object log"
-  case "$we_verb" in
-    STARTED|RESUMED|ENDED|RETIRED)
-      # Past the seam the lane is legacy, and that verdict is what the lifecycle
-      # follow-up at this function's foot is handed. `PAUSED` and
-      # `HANDOFF-REQUESTED` move no lifecycle and are handed nothing.
-      we_seam=8
-      we_pre="$(lane_state_preimage "$we_lane" "$we_pay")" ;;
-  esac
-  acquire_lock
-  capture_register_edit "${we_paths[@]}"
-  handle_preexisting "${we_paths[@]}"
-  # AMENDMENT 15 — `ensure_log` IS BELOW THE CAPTURE AND NOT ABOVE IT, and the
-  # order is load-bearing rather than tidy. It may now RENAME the lane's log to
-  # the row's own spelling, and the amendment says that rename lands "in that
-  # same commit" as the write — while `handle_preexisting` exists to commit
-  # whatever it finds dirty in this write's pathspecs FIRST, as somebody else's
-  # content. Run above it, the rename was exactly what that capture would
-  # commit: the one act of this write, taken out of it and attributed to a peer.
-  # Below it, the checkout is clean when the rename happens and the rename is
-  # this write's own. The old path joins the pathspecs so the deletion is
-  # committed beside the append.
-  ensure_log "$we_lane"
-  [ -n "$LOG_RENAMED_FROM" ] && we_paths+=("$LOG_RENAMED_FROM")
-  # THEN re-test, against the checkout the capture left behind. The capture is
-  # not assumed to have worked — handle_preexisting swallows a failed commit by
-  # design, it never fails the call — and a register still dirty at this point
-  # would send commit_push down Amendment 5(d)'s skip-the-pull branch, which is
-  # the branch that disables the rescan deciding a race.
-  refuse_dirty_checkout "write $we_verb" "${we_paths[@]}" "$we_lp"
-  append_text_line "$we_line" "$(log_file_for "$we_lane")"
-  if [ -n "$we_r6" ]; then
-    append_text_line "$we_r6" "$LANES_FILE"
-    note "Rule 6 line also appended to $LANES_FILE (one commit, ${#we_paths[@]} pathspecs)"
-  fi
-  we_msg="LOG($we_lane@$WS): $we_verb $we_obj"
-  [ -n "$PRE_DIRTY_LANES" ] && we_msg="$we_msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-  commit_push "$we_msg" "${we_paths[@]}"
-  we_rc=$?
-  state_events_flush
-  release_lock
-  # THE LIFECYCLE SNAPSHOT FOLLOWS THE LINE THAT WAS WRITTEN (openRepoTools#91),
-  # and it is here — in the writer, after the lock — for the reason
-  # `pause_subfields_check` is here: from ANY caller, over one implementation,
-  # rather than in each of the commands that write a lane-kind line. A
-  # `STARTED` or a `RESUMED` is the confirming act of a new owner and takes the
-  # lane to `RUNNING`; an `ENDED` or a `RETIRED` takes it to `CLOSED`; a
-  # `PAUSED` moves nothing, because the two-phase transition around it is
-  # `lane-handoff`'s and lands `SWAPPED` only once every mandatory write has.
-  # AFTER `release_lock`, because `acquire_lock` is a `mkdir` mutex and not a
-  # reentrant one — and the follow-up takes that same mutex for itself, around
-  # the read of the pre-image and the replacement of the snapshot together. It
-  # never fails the event and it is silent for a lane with no control root, which
-  # is every lane that has not started under Amendment 11(c) — the cutover rule
-  # of Amendment 7(i), not a failure.
-  lane_state_follow "$we_lane" "$we_verb" "$we_pay" "$we_uuid" "$we_pre" "$we_seam"
-  return "$we_rc"
-}
-
-# A read fetches first — there is no index, so "current" means "after a fetch".
-#
-# AND WHERE IT DID NOT FETCH IT RECORDS WHY, so the one caller with a freshness
-# line can correct it (#26, the fail-closed family one layer out, `lanes:411`).
-# FOUR of the five ways out of here never reach the fetch at all —
-# `LANES_NO_GIT=1`, `LANES_NO_FETCH=1`, a `$LANES_REPO` that is not a checkout,
-# and an `origin/$LANES_BRANCH` `ls-remote` could not confirm, THE TIMEOUT AMONG
-# THEM — and every one of them answered 0 in silence. `lanes --fetch` reads this
-# file's stderr for one phrase and prints *"as of a fetch just now"* when it does
-# not find it, so all four printed that sentence over a fetch that never ran.
-# `43b6320` closed the LOUD path, where the fetch was attempted and failed; this
-# is the quiet one.
-#
-# IT IS RECORDED HERE AND SAID IN THE `lanes` ARM, not printed here, because
-# EVERY subcommand in this file runs this function and only the one with a
-# `--fetch` flag has a freshness line to be wrong. A note on every path would put
-# a paragraph in front of every launch on the workstation to fix a sentence that
-# is printed in one place.
-LOG_SYNC_FETCH=""      # yes · fell-back · else WHY this run did not fetch
-log_sync() {
-  # THE CACHE ABOVE IS THE REF AS IT STOOD; a fetch moves the ref, so it is
-  # dropped here rather than read past. Both copies of it: the variable this
-  # shell holds and the file every subshell reads (ruling 12).
-  LANES_REGISTER_CACHE=""
-  ls_rc="${SE_CACHE_FILE:+$SE_CACHE_FILE.register}"; [ -n "$ls_rc" ] && rm -f -- "$ls_rc"
-  # AND AMENDMENT 16's ALIAS TABLE, for the same reason and in the same breath:
-  # it is read from `origin/<branch>` beside the register and a fetch moves that
-  # ref. A rename lands both files in ONE commit, so a cache that kept one and
-  # dropped the other is exactly the disagreement the single commit prevents.
-  lane_alias_flush
-  LOG_SYNC_FETCH=""
-  [ "$NO_GIT" = 1 ] && { LOG_SYNC_FETCH="LANES_NO_GIT=1 is set, so nothing in this run touches git"; return 0; }
-  [ "${LANES_NO_FETCH:-0}" = 1 ] && { LOG_SYNC_FETCH="LANES_NO_FETCH=1 is set in this environment"; note "LANES_NO_FETCH=1 — not fetching; reading origin/$LANES_BRANCH as the ref already stands here"; return 0; }
-  git -C "$LANES_REPO" rev-parse --git-dir >/dev/null 2>&1 || { LOG_SYNC_FETCH="$LANES_REPO is not a git checkout"; return 0; }
-  if ! remote_has_branch; then
-    LOG_SYNC_FETCH="origin/$LANES_BRANCH could not be reached"
-    [ "$GIT_TIMED_OUT" = 1 ] && LOG_SYNC_FETCH="$LOG_SYNC_FETCH — ls-remote timed out after ${GIT_TIMEOUT}s"
-    return 0
-  fi
-  if git_net -C "$LANES_REPO" fetch -q origin "$LANES_BRANCH" 2>/dev/null; then
-    LOG_SYNC_FETCH=yes
-  else
-    LOG_SYNC_FETCH=fell-back
-    note "fetch $([ "$GIT_TIMED_OUT" = 1 ] && printf 'timed out after %ss' "$GIT_TIMEOUT" || printf 'failed') — reading the logs as they stand locally"
-  fi
-  return 0
-}
-
-# ------------------------------------------------------------------- who
-#
-# Exit 0 found, 8 no record.
-
-print_holder_detail() {
-  ph_lane="$1"; ph_obj="$2"; ph_rc=0
-  ph_home="$(home_of_lane "$ph_lane" 2>/dev/null || :)"
-  printf '  home     %s\n' "${ph_home:-unknown (pre-cutover lane: no STARTED line)}"
-  ph_rowid="$(last_session_id_of_lane "$ph_lane" 2>/dev/null || :)"
-  if lane_is_elsewhere "$ph_lane"; then
-    # Session records are local files. This machine cannot see another
-    # workstation's, so it must not say NOT LIVE about one.
-    printf '  holder   lane %s — UNKNOWN (records are local to %s; ask @%s or read its handoff)\n' \
-      "$ph_lane" "$(lane_workstation "$ph_lane")" "$ph_lane"
-  else
-    # 0 / 8 / anything else, and never two of them conflated (R22): a read this
-    # workstation could not perform is UNKNOWN, exactly as another workstation's
-    # records are. NOT LIVE is a claim, and it is the claim that sends a reader
-    # to `claim --force` against a lane that is running.
-    ph_h="$(live_holder "$ph_lane" 2>/dev/null)"; ph_rc=$?
-    case "$ph_rc" in
-      0)
-        IFS="$US" read -r ph_hid ph_target ph_hname ph_hpid ph_where <<EOF
-$ph_h
-EOF
-        case "$ph_where" in
-          orphan) printf '  holder   lane %s — LIVE but in NO window (session %s, pid %s): an orphaned holder, Amendment 6(d) — retire it: kill %s\n' \
-                    "$ph_lane" "$ph_hid" "$ph_hpid" "$ph_hpid" ;;
-          here)   printf '  holder   lane %s — LIVE (session %s, pid %s, tmux %s) — this window\n' "$ph_lane" "$ph_hid" "$ph_hpid" "$ph_target" ;;
-          *)      printf '  holder   lane %s — LIVE (session %s, pid %s, tmux %s)\n' "$ph_lane" "$ph_hid" "$ph_hpid" "$ph_target" ;;
-        esac ;;
-      8)
-        printf '  holder   lane %s — NOT LIVE (parked: every session its row records has ended)\n' "$ph_lane" ;;
-      *)
-        printf '  holder   lane %s — UNKNOWN (this workstation'"'"'s session records could not be read; ask @%s or read its handoff)\n' "$ph_lane" "$ph_lane" ;;
-    esac
-  fi
-  # R-A8-6, THE SECOND READER. `lane-start` names the row's orphaned holders to
-  # the operator who is about to take the lane; `who` names them to everyone
-  # else, because "who holds this" is exactly the question a person asks when a
-  # picker has just offered them two transcripts of one lane. The `holder` line
-  # above answers about the lane's CURRENT id; this answers about its EARLIER
-  # ones, which are history rather than alternatives. It NEVER kills: the act is
-  # `kill <pid>`, printed with the session and profile beside it so a person can
-  # check first, and run by that person (clause (f)).
-  #
-  # Silent where there are none, where the lane is on another workstation (its
-  # records are not local and this machine must not claim about them), and where
-  # the read itself failed — an unreadable record is not an assertion that a
-  # holder is absent, and `who`'s own `UNKNOWN` line has already said so.
-  if ! lane_is_elsewhere "$ph_lane"; then
-    ph_idle="$(idle_holders "$ph_lane" 2>/dev/null)"
-    # NOT a pipe: `printf ... | while read; do …; done` runs the loop on the
-    # STRIPPED command substitution with no trailing newline, so `read` hits
-    # EOF on the (only) line before it ever completes one, returns failure,
-    # and the loop body never runs at all — the one-holder case is exactly
-    # the common case, and a pipe here would print nothing, ever. A here-string
-    # always terminates the last line, which is why `lane-start`'s own reader
-    # of this same helper (above) uses one instead of a pipe.
-    if [ -n "$ph_idle" ]; then
-      while IFS="$(printf '\t')" read -r ph_isid ph_ipid ph_ikind ph_iprof; do
-        [ -n "$ph_isid" ] || continue
-        printf '  idle     lane %s — an EARLIER session id of this row is still held: session %s, pid %s (kind %s, profile %s). History, not an alternative — retire it: kill %s\n' \
-          "$ph_lane" "$ph_isid" "$ph_ipid" "${ph_ikind:-none}" "${ph_iprof:-unknown}" "$ph_ipid"
-      done <<<"$ph_idle"
-    fi
-  fi
-  printf '  address  @%s · claude --resume %s\n' "$ph_lane" "${ph_rowid:-<no transcript uuid in the row>}"
-  ph_ho="$(handoff_of_lane "$ph_lane" 2>/dev/null || :)"
-  [ -n "$ph_ho" ] && printf '  handoff  %s\n' "$ph_ho"
-  printf '  log      %s\n' "$(log_path_for "$ph_lane")"
-  ph_objrepo="$(object_repo "$ph_obj")"
-  if [ -n "$ph_home" ] && [ -n "$ph_objrepo" ] && [ "$ph_objrepo" != "$ph_home" ] && ! same_project "$ph_home" "$ph_objrepo"; then
-    printf '  CROSS-REPO  %s is not lane %s'"'"'s home (%s)\n' "$ph_objrepo" "$ph_lane" "$ph_home"
-  fi
-}
-
-who_object() {
-  wo_obj="$1"
-  wo_states="$(state_events | lane_states_on "$wo_obj")"
-  if [ -z "$wo_states" ]; then
-    printf 'no record of %s in any lane log\n' "$wo_obj"
-    printf '  (a lane with no log file is pre-cutover: see its row'"'"'s state cell in LANES.md)\n'
-    return 8
-  fi
-  printf 'object   %s\n' "$wo_obj"
-  wo_held=0
-  while IFS="$US" read -r s_utc s_lane s_verb s_uuid s_ws s_o s_ref s_pay s_txt s_file s_line; do
-    [ -n "${s_verb:-}" ] || continue
-    wo_sup="$(superseded_by "$wo_obj" "$s_lane" "$s_verb")"
-    if [ -n "$wo_sup" ]; then
-      printf 'super.   lane %-22s %-9s %s (%s ago) — superseded by TAKEOVER (lane:%s) at %s\n' \
-        "$s_lane" "$s_verb" "$s_utc" "$(age_of "$s_utc")" "${wo_sup%@*}" "${wo_sup#*@}"
-      printf '         this lane no longer holds it; it closes its own line with: lanes-edit.sh release %s "taken over by %s"\n' "$wo_obj" "${wo_sup%@*}"
-    elif is_open_verb "$s_verb"; then
-      printf 'HOLDS    lane %-22s %-9s %s (%s ago)%s\n' "$s_lane" "$s_verb" "$s_utc" "$(age_of "$s_utc")" "${s_pay:+ ${s_ref:-} $s_pay}"
-      wo_held=1
-    else
-      printf 'closed   lane %-22s %-9s %s (%s ago)%s\n' "$s_lane" "$s_verb" "$s_utc" "$(age_of "$s_utc")" "${s_pay:+ ${s_ref:-} $s_pay}"
-    fi
-    # A line written with --no-github is not yet a Rule 1 claim: the comment a
-    # person outside this estate reads does not exist.
-    case "${s_txt:-}" in
-      no-github|'no-github;'*) printf '         local only — no GitHub claim comment\n' ;;
-      "") : ;;
-      *) printf '         %s\n' "$s_txt" ;;
-    esac
-  done <<EOF
-$wo_states
-EOF
-  if [ "$wo_held" = 0 ]; then
-    printf 'state    FREE — no lane'"'"'s last line on it is open\n'
-    return 0
-  fi
-  printf 'state    HELD\n'
-  while IFS="$US" read -r s_utc s_lane s_verb s_uuid s_ws s_o s_ref s_pay s_txt s_file s_line; do
-    [ -n "${s_verb:-}" ] || continue
-    is_open_verb "$s_verb" || continue
-    [ -z "$(superseded_by "$wo_obj" "$s_lane" "$s_verb")" ] || continue
-    printf 'holder   lane %s (%s, %s)\n' "$s_lane" "$s_verb" "$s_utc"
-    # NOT STALE, AND IT SAYS WHICH OF THE THREE REASONS. `stale no — 5h 00m
-    # old, threshold 4h` is two true halves that read as a contradiction: both
-    # of the other discharges (Rule 1's "a claim followed by a PR is not
-    # abandoned", and Rule 6 governing a PR) leave a claim past the threshold
-    # and NOT stale, and neither was named.
-    if [ "$s_verb" = CLAIMED ] && claim_is_stale "$s_lane" "$wo_obj" "$s_utc" "$s_file" "$s_line"; then
-      printf '  stale    YES — claimed %s ago with no OPENED naming it, past the %sh threshold; a takeover is allowed (claim --force)\n' "$(age_of "$s_utc")" "$STALE_HOURS"
-    elif [ "$s_verb" = CLAIMED ]; then
-      if ! older_than_threshold "$s_utc"; then
-        printf '  stale    no — %s old, threshold %sh\n' "$(age_of "$s_utc")" "$STALE_HOURS"
-      elif object_is_pr "$wo_obj"; then
-        printf '  stale    no — %s old, past the %sh threshold, but this object is a PR: Rule 6'"'"'s thirty minutes govern it, not Rule 1'"'"'s hours\n' "$(age_of "$s_utc")" "$STALE_HOURS"
-      else
-        printf '  stale    no — %s old, past the %sh threshold, but lane %s has since written an OPENED naming it (Rule 1: a claim followed by a PR is not abandoned)\n' "$(age_of "$s_utc")" "$STALE_HOURS" "$s_lane"
-      fi
-    fi
-    print_holder_detail "$s_lane" "$wo_obj"
-  done <<EOF
-$wo_states
-EOF
-  return 0
-}
-
-who_lane() {
-  wl_lane="$1"
-  # DECISION 8(e) — A LIVE FORK IS A DEFECT AND IS NAMED FIRST. It is printed
-  # BEFORE the lane's objects and before the pre-cutover return, because a fork
-  # is a fact about a lane whether or not that lane has an object log: Evidence
-  # 6's fork wrote `RESUMED` and `PAUSED` lines into one that did. `who` names
-  # it and does nothing; ending somebody's process is a person's act (Amendment
-  # 8(f)).
-  # A SURFACE THAT MAY NOT REFUSE SAYS IT COULD NOT LOOK (#26, the review of
-  # `37632b1`). `|| :` printed the same nothing for "no fork is live" and for "I
-  # could not read this workstation's session records", and those are the two
-  # answers ratified decision 8(e) most needs kept apart.
-  wl_fk=""; wl_fkrc=0
-  wl_fk="$(lane_forks "$wl_lane" 2>/dev/null)" || wl_fkrc=$?
-  case "$wl_fkrc" in
-    0 | 8) : ;;
-    *) printf 'UNKNOWN  this workstation'"'"'s session records could not be read, so whether a live FORK of lane %s'"'"'s transcript is running is NOT established — which is not the same as none. See: lanes-edit.sh forks %s\n' "$wl_lane" "$wl_lane" ;;
-  esac
-  if [ -n "$wl_fk" ]; then
-    while IFS="$(printf '\t')" read -r wl_fid wl_fpid wl_fkind wl_fcwd; do
-      [ -n "${wl_fid:-}" ] || continue
-      printf 'DEFECT   %s is a live FORK of this lane'"'"'s transcript (pid %s, %s, cwd %s) — never a holder, and it must not write the register. Retire it: lane-end %s --retire %s\n' \
-        "$wl_fid" "$wl_fpid" "${wl_fkind:-interactive}" "${wl_fcwd:-unknown}" "$wl_lane" "$wl_fpid"
-    done <<EOF
-$wl_fk
-EOF
-  fi
-  if ! lane_log_exists "$wl_lane"; then
-    printf 'no log for %s; see its row'"'"'s state cell\n' "$wl_lane"
-    return 8
-  fi
-  wl_n=0
-  # FIVE fields, because `lane_objects` prints five. Read into four, the fifth —
-  # the superseded-by cell — arrived glued to the payload and printed where a
-  # payload goes: `CLAIMED opensoft/repoX#40 2026-… bbb-1@2026-…`.
-  while IFS="$US" read -r wl_utc wl_verb wl_obj wl_ref wl_sup; do
-    [ -n "${wl_verb:-}" ] || continue
-    is_open_verb "$wl_verb" || continue
-    printf '%-9s %s  %s (%s ago)%s%s\n' "$wl_verb" "$wl_obj" "$wl_utc" "$(age_of "$wl_utc")" \
-      "${wl_ref:+ $wl_ref}" "${wl_sup:+  (taken over by lane:${wl_sup%@*} at ${wl_sup#*@} — release it to close this line)}"
-    wl_n=$((wl_n + 1))
-  done <<EOF
-$(lane_objects "$wl_lane")
-EOF
-  # An empty answer is an answer: 8 stays reserved for "there is no log".
-  if [ "$wl_n" = 0 ]; then printf 'none open — lane %s holds nothing open\n' "$wl_lane"; return 0; fi
-  return 0
-}
-
-# THE MERGE HOLD IS DECIDED FROM LANES.md, not from the logs. Rule 6's
-# LANDING / LANDED lines are written for every lane, before this amendment and
-# after it, and every lane already reads them there. The logs are secondary.
-#
-# Landings are counted as distinct (lane, repository, PR) TRIPLES, never as raw
-# LANDING lines: a retry re-posts LANDING for the same PR, and the register has
-# 571 such lines for far fewer landings.
-#
-# A LANDED CLOSES THE LANDING IT ANSWERS, PAIRED BY (lane, PR) IN FILE ORDER
-# (R17). Most of the register’s LANDED lines carry no `into <repo> main` clause
-# at all — 284 of 308 on the day this was measured — so keying a LANDED on the
-# repository it names keyed 284 of them on the empty string, where they could
-# never close the repository-qualified LANDING they belonged to: `who --landing`
-# reported 201 phantom merge holds across five repositories, every one of them
-# landed long ago, on a register whose genuinely open count was one. So the
-# PAIRING is by (lane, PR) — the LANDED closes the most recent LANDING of that
-# lane and PR that is still unmatched, and the pair’s repository is the
-# LANDING’s — while the RESULT still keys on (lane, repository, PR), which is
-# what keeps a LANDED on one repository from closing a LANDING on another.
-# AND A LANDED THAT NAMES A REPOSITORY PREFERS A LANDING ON THAT REPOSITORY
-# (R24, Addendum 6). Only a LANDED with NO `into <repo> main` clause takes the
-# most recent unmatched LANDING regardless — it has said nothing about where it
-# landed, so the LANDING is the only thing that can say. One that DOES name a
-# repository takes the most recent unmatched LANDING naming the same one, and
-# is reported as an `unpaired LANDED` — closing nothing — only when there is no
-# such LANDING at all. Without the preference, a lane with two LANDINGs open on
-# ONE PR number in two repositories that lands the EARLIER one, naming its
-# repository, was unpaired and both holds stayed open until the second landed.
-# The answer is identical everywhere else, including the (lane, repository, PR)
-# result key: a LANDED on one repository still closes no LANDING on another.
-#
-# The repository is lower-cased IN THE KEY ONLY: the register spells one
-# repository four ways in a week, and a LANDED spelled `OpsxFactory` must still
-# close a LANDING spelled `opsXfactory`.
-#
-# AND BOTH SIDES GO THROUGH `lanes/repos.tsv` FIRST (R29, Addendum 7). Case is
-# only half of it: the register writes `OpsxFactory` and `opensoft/OpsxFactory`
-# for ONE repository — 23 Rule 6 lines against 70 at `8f9c04d` — and
-# `codexFactory`, `codeXfactory/codexFactory` and `opensoft/codexFactory` for
-# another. Compared literally, a LANDED spelled one way does not close the
-# LANDING spelled the other: it reads as an `unpaired LANDED`, the hold stays
-# open, and over-reporting a merge hold is the direction that stalls other
-# lanes' merges. So every `into <repo> main` is resolved AS IT IS PARSED, which
-# makes the pairing, R24's preference and the (lane, repository, PR) result key
-# agree by construction — the key's repository is the canonical spelling, and
-# an alias the table does not know keeps its own, case-blind like every other.
-#
-# WHAT THAT IS WORTH TODAY, measured read-only over `origin/main` at `6fa966b`:
-# the VERDICT does not move — 1 open LANDING (lane browser-ui-repair's PR #401,
-# genuinely in flight) and 0 unpaired LANDED, before this change and after it.
-# No (lane, PR) pair in the register mixes its spellings YET, so this is a
-# guard and not a repair, and it is worth saying so rather than claiming a hold
-# it did not clear. What it does move there is the KEY: 17 result-key spellings
-# collapse to the 11 repositories they name, and two LANDINGs a retry spelled
-# two ways are one hold instead of two.
-#
-# The table is handed in through the ENVIRONMENT, as `LANES_RULE6_ALIASES`,
-# one `<lowercased alias>\037<owner/repo>` per line — because awk cannot read
-# `repos.tsv` for itself here (this program's stdin is the register) and
-# because `awk -v`, which is where it used to go, carries ONE LINE: see
-# `who_landing` for what a many-line `-v` does on macOS's awk.
-#
-# BOTH LAYERS, SHIPPED FIRST (Amendment 9(b)). This is the second reader of the
-# table — `alias_lookup` is the other — and it layers them the same way by
-# reading the shipped file before the override, so the LAST assignment to an
-# alias wins and an override row REPLACES the shipped row for that alias while
-# adding rows the shipped table does not carry. One map, emitted in the order
-# the aliases were first seen, so the output is stable.
-rule6_aliases() {
-  r6_files=()
-  for r6_tsv in "${LANES_REPOS_TSV_SHIPPED:-}" "${LANES_REPOS_TSV:-}"; do
-    [ -n "$r6_tsv" ] && [ -f "$r6_tsv" ] || continue
-    r6_files+=("$r6_tsv")
-  done
-  [ "${#r6_files[@]}" -gt 0 ] || return 0
-  awk -F'\t' '
-    /^[ \t]*#/ { next }
-    NF >= 2 {
-      a = $1; b = $2
-      gsub(/^[ \t]+|[ \t]+$/, "", a); gsub(/^[ \t]+|[ \t]+$/, "", b)
-      if (a != "" && b != "") {
-        k = tolower(a)
-        if (!(k in seen)) { seen[k] = 1; ord[++n] = k }
-        m[k] = b
-      }
-    }
-    END { for (i = 1; i <= n; i++) printf "%s\037%s\n", ord[i], m[ord[i]] }' "${r6_files[@]}"
-}
-
-RULE6_AWK='
-function trim(s) { sub(/^[ \t]+/, "", s); sub(/[ \t]+$/, "", s); return s }
-function canon(r,   l) { l = tolower(r); return (l in A) ? A[l] : r }
-BEGIN {
-  na = split(ENVIRON["LANES_RULE6_ALIASES"], ar, "\n")
-  for (ai = 1; ai <= na; ai++) { ap = index(ar[ai], "\037")
-    if (ap > 1) A[substr(ar[ai], 1, ap - 1)] = substr(ar[ai], ap + 1) }
-}
-/^(LANDING|LANDED) — / {
-  line = $0
-  verb = substr(line, 1, index(line, " ") - 1)
-  lane = ""; pr = ""; repo = ""; utc = ""
-  if (match(line, /lane [A-Za-z0-9._-]+/))            lane = substr(line, RSTART + 5, RLENGTH - 5)
-  if (match(line, /PR #[0-9]+/))                      pr   = substr(line, RSTART + 4, RLENGTH - 4)
-  if (match(line, /into [A-Za-z0-9\/._-]+ main/))     repo = canon(substr(line, RSTART + 5, RLENGTH - 10))
-  if (match(line, /[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9](:[0-9][0-9])?Z/)) utc = substr(line, RSTART, RLENGTH)
-  if (lane == "" || pr == "") next
-  g = lane "\037" pr
-  if (verb == "LANDING") {
-    k = g "\037" tolower(repo)
-    if (!(k in ST)) { gk[g, ++gn[g]] = k }
-    ST[k] = "LANDING"; U[k] = utc; L[k] = lane; P[k] = pr; R[k] = repo; O[k] = NR
-    next
-  }
-  best = ""; bord = -1; bestr = ""; bordr = -1
-  for (i = 1; i <= gn[g]; i++) { kk = gk[g, i]
-    if (ST[kk] != "LANDING") continue
-    if (O[kk] > bord) { bord = O[kk]; best = kk }
-    if (repo != "" && tolower(repo) == tolower(R[kk]) && O[kk] > bordr) { bordr = O[kk]; bestr = kk } }
-  if (bestr != "") best = bestr        # R24: a LANDED that NAMES a repository
-  if (best == "") next
-  if (repo != "" && tolower(repo) != tolower(R[best])) {
-    printf "UNPAIRED%c%s%c%s%c%s%c%s%c%s\n", 31, lane, 31, pr, 31, utc, 31, repo, 31, R[best]
-    next
-  }
-  ST[best] = "LANDED"; U[best] = utc; O[best] = NR
-}
-END { for (k in ST) printf "%s%c%s%c%s%c%s%c%s%c\n", ST[k], 31, L[k], 31, P[k], 31, U[k], 31, R[k], 31 }'
-
-# Rule 6's window, in minutes. A LANDING past it with no LANDED is still a
-# line somebody wrote and is still listed — but it is marked, because reporting
-# a 253-day-old LANDING as a live merge hold with nothing to say it is not one
-# is how the estate ends up holding its merges for a lane that stopped.
-LANDING_MINUTES="${LANES_LANDING_MINUTES:-30}"
-
-# The lane logs are SECONDARY here and are reported after the register: every
-# lane writes its Rule 6 line into LANES.md, pre- and post-cutover alike, and
-# that is what decides the hold. A lane's own LANDING/LANDED is evidence
-# beside it, never instead of it.
-who_landing_logs() {
-  wll_repo="$1"; wll_rows=""
-  wll_rows="$(state_events | awk -v sep="$US" -v repo="$wll_repo" '
-    function pos(pf, pn) { return pf "\034" sprintf("%09d", pn) }
-    BEGIN { FS = sep }
-    $6 ~ /^lane:/ { next }
-    {
-      o = $6; r = o; sub(/#.*$/, "", r); sub(/:openspec\/changes\/.*$/, "", r)
-      if (tolower(r) != tolower(repo)) next
-      # The LAST line this lane wrote on the object, in FILE ORDER (R14).
-      # A LANDED is often written in the same second as the LANDING it closes,
-      # and on a workstation whose clock steps back it is stamped before it.
-      k = $2 sep o
-      p = pos($10, $11)
-      if (!(k in P) || p >= P[k]) { P[k] = p; u[k] = $1; V[k] = $3; L[k] = $2; O[k] = o }
-    }
-    END { for (k in P) if (V[k] == "LANDING" || V[k] == "LANDED")
-            printf "%s%c%s%c%s%c%s\n", V[k], 31, L[k], 31, O[k], 31, u[k] }' \
-    | LC_ALL=C sort -t"$US" -k3,3 -k2,2)"
-  [ -n "$wll_rows" ] || return 0
-  printf 'from lane logs (secondary):\n'
-  while IFS="$US" read -r wl_verb wl_lane wl_obj wl_utc; do
-    [ -n "${wl_verb:-}" ] || continue
-    printf '  %-8s %s  lane %s, %s (%s ago)\n' "$wl_verb" "$wl_obj" "$wl_lane" "$wl_utc" "$(age_of "$wl_utc")"
-  done <<EOF
-$wll_rows
-EOF
-}
-
-who_landing() {
-  wd_repo="$1"; wd_n=0; wd_rows=""
-  # `awk -v` CARRIES ONE LINE, AND THIS TABLE IS MANY (A9 Addendum 4, R-A9-11,
-  # round 5; the `probe` step of run 34782845181 answered it on the runner).
-  # A `-v name=value` is processed as if it were a STRING LITERAL, and a string
-  # literal cannot span lines: macOS's awk (one-true-awk 20200816) refuses it
-  # outright — `awk: newline in string … at source line 1`, exit 2, no output at
-  # all — while gawk and mawk accept it silently. So this read, and only this
-  # read, answered `none open` for every LANDING in the register on that
-  # platform: fourteen of the job's twenty-six remaining failures, and the
-  # estate's merge holds invisible on a workstation that runs macOS.
-  #
-  # `ENVIRON` has no such restriction and is POSIX awk, so the table goes
-  # through the environment of this one command. The program is otherwise
-  # untouched: the probe ran `RULE6_AWK` itself on that awk with an empty table
-  # and it emitted both rows byte-for-byte, and `length`, `match`, `RSTART`,
-  # `RLENGTH` and `substr` there all agree with each other on a line carrying
-  # an em dash. There was nothing wrong with the parser or with the arithmetic;
-  # the table could not get in.
-  wd_aliases="$(rule6_aliases)"
-  wd_rows="$(register_text | LANES_RULE6_ALIASES="$wd_aliases" awk "$RULE6_AWK")"
-  while IFS="$US" read -r wd_verb wd_lane wd_pr wd_utc wd_r wd_other; do
-    [ "${wd_verb:-}" = LANDING ] || continue
-    wd_c="$(alias_lookup "${wd_r:-}" 2>/dev/null || :)"; wd_c="${wd_c:-$wd_r}"
-    [ "$(lc "$wd_c")" = "$(lc "$wd_repo")" ] || continue
-    wd_stale=""
-    older_than_minutes "$wd_utc" "$LANDING_MINUTES" && wd_stale="  STALE (Rule 6: >${LANDING_MINUTES} min)"
-    printf 'LANDING  %s#%s  lane %s, %s (%s ago)%s\n' "$wd_repo" "$wd_pr" "$wd_lane" "$wd_utc" "$(age_of "$wd_utc")" "$wd_stale"
-    wd_n=$((wd_n + 1))
-  done <<EOF
-$wd_rows
-EOF
-  # "No hold on this repository" is an ANSWER, and a script that gates on
-  # `if who --landing <repo>` must read it as one. 8 is reserved for absence.
-  [ "$wd_n" = 0 ] && printf 'none open — no LANDING on %s is still open (read from LANES.md'"'"'s Rule 6 lines)\n' "$wd_repo"
-  # A LANDED that names THIS repository while the LANDING it would close is on
-  # another closes nothing (R17), and is said so rather than dropped: an
-  # append-only register is never rewritten, so a line no tool mentions again is
-  # a line nobody will ever reconcile.
-  while IFS="$US" read -r wd_verb wd_lane wd_pr wd_utc wd_r wd_other; do
-    [ "${wd_verb:-}" = UNPAIRED ] || continue
-    wd_c="$(alias_lookup "${wd_r:-}" 2>/dev/null || :)"; wd_c="${wd_c:-$wd_r}"
-    [ "$(lc "$wd_c")" = "$(lc "$wd_repo")" ] || continue
-    printf 'unpaired LANDED  %s#%s  lane %s, %s — the open LANDING for (lane %s, PR #%s) is on %s, so this closes nothing\n' \
-      "$wd_repo" "$wd_pr" "$wd_lane" "$wd_utc" "$wd_lane" "$wd_pr" "${wd_other:-an unnamed repository}"
-  done <<EOF
-$wd_rows
-EOF
-  who_landing_logs "$wd_repo"
-  return 0
-}
-
-# ======================================================== Amendment 8 ======
-#
-# SWAP AND RESTART, THE READ SIDE.
-#
-#   A SWAP is a planned stop — a usage reset, a profile switch — and a RESTART
-#   is the launch that follows it. Neither adds a file. The RECORD a swap
-#   leaves is the lane's own PAUSED line, payload
-#   `swap; window <tmux session>:<index>; workstation <ws>`, and a lane is
-#   SWAPPED on a workstation when that PAUSED is its LAST lane-kind line.
-#
-#   Both reads here are READ-ONLY and neither ever writes. `swapped` is what a
-#   launcher asks when the tmux window name is gone — a restart opens a NEW
-#   tmux session, which is precisely why the window name cannot carry the lane
-#   across one. `session-start` is the SessionStart hook's whole output.
-
-# The register's own spelling of a lane whose name matches $1 ignoring case,
-# read from `origin/<branch>` like every other state read (R19). Rule 10's wire
-# form is lowercase and a tmux window may carry either, while the row's token is
-# camel (`openRepoProject-1`): an exact lookup alone loses the lane.
-#
-# AMENDMENT 16(e) — AND IT RESOLVES A FORMER NAME, through the same seat every
-# other reader takes. Clause (e) names the `SessionStart` block among the
-# readers that resolve, and this is the read behind it: a window still carrying
-# the name a lane had before its rename would otherwise orient the new session
-# to "no lane bound to this window" — which is the one thing that block exists
-# not to say — while the lane's row, log and handoff are all a `lane-rename`
-# away under another name.
-#
-# `rows_named_ci_alias` IS THAT SEAT AND THIS IS `head -n1` OF IT, which is
-# exactly what the `exit` in the awk above was: one answer and no refusal. The
-# hook never refuses, so where two rows differ only by case this still answers
-# with the first of them and `canon_lane` — the read every WRITER goes through
-# — is where that pair is refused.
-#   0 + one spelling (or nothing) · 5 the alias table could not be READ
-# The 5 is carried for `rows_named_ci_alias`-s reason: `session_start_block` is
-# a hook and may not refuse, but it must not print "no lane bound to this
-# window" about a window whose name it could not resolve.
-lane_named_ci() {
-  lnc_rc=0
-  lnc_out="$(rows_named_ci_alias "$1" 2>/dev/null)" || lnc_rc=$?
-  [ "$lnc_rc" = 5 ] && return 5
-  printf '%s\n' "$lnc_out" | grep . | head -n1
-  return 0
-}
-
-# The lane whose row's SESSION CELL names <uuid> — the second resolution the
-# hook has, for a window that carries no lane name. ONLY the session cell is
-# read: state cells quote other lanes' ids all the time ("RESUMED by <id>",
-# "handed off to <id>"), and one of those is not this session's lane.
-lane_of_session() {
-  los_id="$(lc "${1-}")"
-  [ -n "$los_id" ] || return 1
-  register_text | awk -F'|' -v id="$los_id" '
-    substr($0,1,1) != "|" { next }
-    {
-      if (index(tolower($3), id) == 0) next
-      p1 = index($2, "`"); if (p1 == 0) next
-      rest = substr($2, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      print substr(rest, 1, p2 - 1); exit
-    }'
-}
-
-# ============================================================================
-# AMENDMENT 11 — THE RECORD'S SUB-FIELDS, AND THE READS BUILT ON THEM
-# ============================================================================
-#
-# Amendment 11 clause (c) gives the lane's `STARTED`/`RESUMED` lines and the
-# swap record two new payload sub-fields, `dir <path>` and `profile <name>`,
-# beside Amendment 8(b)'s `window`, which gains a second ref. Clause (h) turns
-# the reads of them into subcommands, for the reason Amendment 7(d) already
-# gives `live-holder` and `lane-objects`: EACH READ EXISTS SO THAT SEVERAL
-# CALLERS SHARE ONE IMPLEMENTATION. `window-lane` has three (the launcher's
-# precedence 3, `/restart`'s step 2(c), the `/lane-swap` skill's step 1);
-# `session-lane` has two (`/restart`'s step 2(b) and the SessionStart hook);
-# `lane-dir` has four. A rule implemented once cannot be implemented three
-# ways, which is exactly how the launcher, the skill and `/restart` would come
-# to disagree about which lane a window is.
-
-# ONE PARSER OF A PAYLOAD'S SUB-FIELDS, AND ONE UNQUOTER.
-#
-# Amendment 7(b)'s grammar: sub-fields are separated by `; `, and SEVERAL REFS
-# INSIDE ONE SUB-FIELD ARE SEPARATED BY SPACES — which is what the `window`
-# sub-field's `<session>:<index> <@id>` relies on. So an unquoted
-# `dir $HOME/my projects/x` (unquoted) parses as two refs and hands back a truncated
-# path, and clause (c)'s rule is that the WRITER QUOTES a value containing a
-# space and EVERY READER takes a value opening with `"` as running to its
-# closing `"`, stripping both.
-#
-# Two modes, because the grammar has two kinds of value:
-#   (default)  ONE REF — the value up to its first space, or the whole of a
-#              quoted value. `dir` and `profile` are read this way.
-#   all        EVERY REF — the whole sub-field, which is what `window` is:
-#              two refs that a caller splits itself.
-payload_subfield() {   # <payload> <name> [all]
-  awk -v pay="$1" -v want="$2" -v mode="${3-}" '
-    BEGIN {
-      want = want " "
-      n = split(pay, sf, "; ")
-      for (i = 1; i <= n; i++) {
-        if (substr(sf[i], 1, length(want)) != want) continue
-        v = substr(sf[i], length(want) + 1)
-        sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-        if (substr(v, 1, 1) == "\"") {
-          q = index(substr(v, 2), "\"")
-          if (q > 0) { print substr(v, 2, q - 1); exit }
-        }
-        if (mode != "all") { sub(/ .*$/, "", v) }
-        print v; exit
-      }
-    }'
-}
-
-# ---------------------------------------- AMENDMENT 17(b): THE TWO SUB-FIELDS
-#
-# `agent <name>` and `transcript <id|none>`, VALIDATED BY THE WRITER. Amendment
-# 17(b) gives the `PAUSED` payload both; nothing else in this file could check
-# them, because a payload is free text to `write_event` — and this log is
-# APPEND-ONLY, so a sub-field written wrong is wrong for ever and no later line
-# corrects it. The check is the same shape `valid_uuid` gives the session field
-# under clause (e): the WRITER is the gate, from any caller.
-#
-# WHAT EACH ADMITS, and why the pattern is the rule rather than a list:
-#   agent       A MANIFEST KEY — letters, digits, `.`, `_`, `-`. It is what
-#               `lane-start --agent <name>` reads back to choose a launcher, so
-#               a value carrying a space or a `;` is a value that would come
-#               back as two sub-fields or as an argument nobody meant. The
-#               pattern is also how this sub-field gets SPEC rev 6 §5's `; `
-#               rule without a token of its own — the same argument clause (c)'s
-#               `profile` takes.
-#   transcript  THE AGENT'S OWN RESUMABLE ID, or the literal `none` — which is
-#               an ANSWER ("this agent has no resumable id") and not a gap.
-#               Claude's is a uuid; another agent's is whatever that agent
-#               prints, so the shape is the same manifest key rather than
-#               `valid_uuid`, which would refuse every agent but one.
-#
-# A PAYLOAD CARRYING NEITHER IS VALID AND STAYS VALID. Every record written
-# before this amendment carries neither, and Amendment 7(i)'s cutover rule is
-# that a reader finding none says so rather than assuming one. The check fires
-# only on a sub-field that is THERE.
-# THE TWO ARE WRITTEN TOGETHER OR NOT AT ALL, AND AN EMPTY ONE IS NOT AN
-# ABSENT ONE (Copilot rounds 1 and 2 on openRepoTools#47). The first shape of
-# this gate entered on either sub-field and then accepted each empty result
-# independently, which let a HALF record through: `agent codex` with no
-# transcript, or `transcript <id>` with no agent, both of which `lane-start`
-# reads one field of and defaults the other — launching Claude on a codex id,
-# or codex on none. And a sub-field written EMPTY (`; agent ; …`) parsed
-# identically to one that was never there, so a malformed line was indexed as a
-# pre-amendment one for ever, in a log nothing rewrites.
-#
-# PRESENCE IS READ OFF THE SUB-FIELDS, never off the whole line: `dir
-# /srv/agent-work` carries the letters and is not the field.
-pause_subfields_check() {   # <payload>
-  psc_pay="${1-}"
-  case "$psc_pay" in *agent*|*transcript*) : ;; *) return 0 ;; esac
-  psc_has_a=0; psc_has_t=0
-  psc_rest="$psc_pay"
-  while : ; do
-    psc_one="${psc_rest%%; *}"
-    case "$psc_one" in
-      agent | 'agent '*)           psc_has_a=1 ;;
-      transcript | 'transcript '*) psc_has_t=1 ;;
-    esac
-    case "$psc_rest" in
-      *'; '*) psc_rest="${psc_rest#*; }" ;;
-      *) break ;;
-    esac
-  done
-  # A PAYLOAD CARRYING NEITHER IS VALID AND STAYS VALID: every record written
-  # before this amendment carries neither, and Amendment 7(i)'s cutover rule is
-  # that a reader finding none says so rather than assuming one.
-  if [ "$psc_has_a" = 0 ] && [ "$psc_has_t" = 0 ]; then return 0; fi
-  # EACH FIELD THAT IS THERE IS READ WITH `all`, WHICH IS THE WHOLE SUB-FIELD
-  # AND NOT ITS FIRST REF. The default mode ends a value at its first space —
-  # the rule `dir` and `profile` are read by — so `agent not a key` would come
-  # back as `not`, a perfectly good manifest key, and the check would pass the
-  # very value it exists to refuse. A gate reads what was written, never what a
-  # reader would make of it. THE VALUE IS JUDGED BEFORE THE PAIR, so a payload
-  # that is both malformed and half-written is refused for the malformation,
-  # which is the thing the writer of it can see in what they typed.
-  if [ "$psc_has_a" = 1 ]; then
-    psc_a="$(payload_subfield "$psc_pay" agent all)"
-    case "$psc_a" in
-      '')
-        die "the record's \`agent\` sub-field is THERE and EMPTY, which is not the same as absent: no reader can tell it from a pre-amendment record, so every one of them would default to \`claude\` for ever (Amendment 7(i)'s cutover rule is about a field that was never written, not one written blank). Write the agent, or write neither sub-field. Nothing was written" 2 ;;
-      *[!A-Za-z0-9._-]*)
-        die "the record's \`agent\` sub-field is a manifest key — letters, digits, '.', '_', '-' — and '$psc_a' is not one (Amendment 17(b)). Nothing was written: this log is append-only, and \`lane-start --agent\` launches on what it reads back from this field" 2 ;;
-    esac
-  fi
-  if [ "$psc_has_t" = 1 ]; then
-    psc_t="$(payload_subfield "$psc_pay" transcript all)"
-    case "$psc_t" in
-      '')
-        die "the record's \`transcript\` sub-field is THERE and EMPTY. The word for an agent with no resumable id is \`none\`, which is an ANSWER; blank is a gap no reader can tell from a pre-amendment record. Nothing was written" 2 ;;
-      *[!A-Za-z0-9._-]*)
-        die "the record's \`transcript\` sub-field is the agent's own resumable id, or the word 'none' — '$psc_t' is neither (Amendment 17(b)). Nothing was written" 2 ;;
-    esac
-  fi
-  # AND THE PAIR. `lane-start` reads ONE of these fields to choose a launcher
-  # and the OTHER to choose what it hands that launcher, so a record carrying
-  # one of them makes it default the other: Claude launched on a codex id, or
-  # codex launched on none, out of a line nothing rewrites.
-  if [ "$psc_has_a" != "$psc_has_t" ]; then
-    psc_only=transcript
-    [ "$psc_has_a" = 1 ] && psc_only=agent
-    die "Amendment 17(b)'s two sub-fields are written TOGETHER or not at all, and this payload carries only \`$psc_only\`. A half record is worse than none: \`lane-start\` reads the field that is there and DEFAULTS the one that is not, so it would launch the wrong agent, or the right one on an id that is not its. Write both (\`agent <name>; transcript <id|none>\`), or neither. Nothing was written — this log is append-only" 2
-  fi
-  return 0
-}
-
-# ------------------------- AMENDMENT 18(a): THE BINDING'S THREE SUB-FIELDS
-#
-# WRITTEN BY THE WRITER, ONCE, FOR EVERY CALLER — the argument this file already
-# makes for putting the container refusal at the dispatcher: *"nine copies of one
-# rule is how eight of them would come to disagree."* `lane-start` writes
-# `STARTED`/`RESUMED`, `lane-handoff` writes `PAUSED`, and clause (e)'s forced
-# `PAUSED` is written here; all three go through `write_event`, so the three
-# facts are appended HERE and no boundary script carries a copy of the probe.
-#
-# THE THREE VERBS ARE CLAUSE (a)'s THREE, AND `ENDED`/`RETIRED` ARE NOT AMONG
-# THEM. Clause (a) is the RULE and it names `STARTED`, `RESUMED` and `PAUSED`;
-# clause (b) reads the binding out of `STARTED`/`RESUMED` alone and a `PAUSED`
-# releases it. Amendment 18's Adoption list adds `lane-end`'s two "for the
-# record", and they are left out deliberately: Amendment 7(b) says *"`PAUSED`,
-# `RESUMED`, `ENDED` and `RETIRED` take no payload"*, Amendment 11 clause (c)
-# narrows that for `RESUMED` as **edit 1 of six** and says in the same breath
-# that *"`ENDED` and `RETIRED` stay payload-free"*, and `lane-end` already
-# refuses to write one for exactly that reason (its own block argues it at
-# length: a payload there is a SEVENTH edit to in-force text where the count is
-# six and the six are ratified, `R-A11-15`). A verb that RELEASES a binding has
-# no binding to describe, so nothing is lost by the omission and a ratified
-# count is not quietly broken by it.
-#
-# APPENDED AND NEVER SUBSTITUTED: a payload that already carries one of the
-# three is the caller's own and is left exactly as it is, so a test seam, a
-# replay and a future writer that fills them in itself all keep their value.
-# They go LAST, after Amendment 11(c)'s and Amendment 17(b)'s, on the same
-# cutover argument those took: a reader written before this clause stops at the
-# sub-field it knows, and one that finds none says so (Amendment 7(i)).
-#
-# A VALUE THAT WOULD MAKE THE LINE UNREADABLE COSTS ITS OWN SUB-FIELD AND NEVER
-# THE LINE (`R-A11-11`'s posture): the drop is printed, and the binding still
-# names whichever of the three it could write.
-binding_subfields_add() {   # <payload> ; prints the payload with the three appended
-  bsa_pay="${1-}"
-  bsa_drop=""
-  # READ LIVE AT THE WRITE, which is what this clause says and what the
-  # 2026-09-15T12:17Z measurement means: a container's `hostname` names THAT
-  # container for as long as it exists and names nothing afterwards. The globals
-  # are a process-start convenience for the reads; the line about to be appended
-  # to an append-only log takes the probe again.
-  lanes_binding_probe
-  for bsa_f in host os container; do
-    case "$bsa_f" in
-      host)      bsa_v="$LANES_HOST_NAME" ;;
-      os)        bsa_v="$LANES_OS_NAME" ;;
-      container) bsa_v="$LANES_CONTAINER_NAME" ;;
-    esac
-    # Already there: the caller's, untouched.
-    [ -n "$(payload_subfield "$bsa_pay" "$bsa_f" all)" ] && continue
-    case "$bsa_pay" in "$bsa_f "*) continue ;; esac
-    if ! lanes_binding_value_ok "$bsa_v"; then
-      bsa_drop="$bsa_drop $bsa_f=${bsa_v:-<empty>}"
-      continue
-    fi
-    # AND `os` IS ONE OF FOUR WORDS WHEREVER IT COMES FROM (Copilot round 5 on
-    # openRepoTools#83). `binding_subfields_check` refuses a caller-written `os`
-    # that is none of them; this path takes the LAUNCHER'S export, which is
-    # nobody's to validate but this writer's — `LANES_OS=plan9` would otherwise
-    # be persisted on every binding line as a value the same file refuses when a
-    # caller supplies it, in a log nothing rewrites. Dropped rather than
-    # refused, like every other value here: `host` and `container` are what
-    # clause (b) reads, and a lane-kind line is never lost over a field no
-    # reader decides anything by.
-    if [ "$bsa_f" = os ]; then
-      case "$bsa_v" in
-        linux|macos|wsl|windows) : ;;
-        *) bsa_drop="$bsa_drop os=$bsa_v"; continue ;;
-      esac
-    fi
-    bsa_pay="${bsa_pay:+$bsa_pay; }$bsa_f $bsa_v"
-  done
-  [ -z "$bsa_drop" ] || note "DROPPED binding sub-field (the line is still written, Amendment 18(a)):$bsa_drop — a value carrying a space, ',', ';', '\"' or ' — ' is a line this log's own parser could never read again, and an \`os\` that is none of linux, macos, wsl, windows is a value this file's own writer refuses when a caller supplies it"
-  printf '%s' "$bsa_pay"
-}
-
-# AND THE VALUES A CALLER WRITES ITSELF ARE CHECKED, for the reason
-# `pause_subfields_check` gives for Amendment 17(b)'s two: a payload is free
-# text to `write_event`, this log is append-only, and `binding` launches — and
-# refuses — on what it reads back. The check fires only on a sub-field that is
-# THERE, so every line written before this clause stays valid (Amendment 7(i)).
-binding_subfields_check() {   # <payload>
-  bsc_pay="${1-}"
-  case "$bsc_pay" in *host*|*os*|*container*) : ;; *) return 0 ;; esac
-  for bsc_f in host os container; do
-    bsc_has=0
-    bsc_rest="$bsc_pay"
-    while : ; do
-      bsc_one="${bsc_rest%%; *}"
-      case "$bsc_one" in "$bsc_f" | "$bsc_f "*) bsc_has=1 ;; esac
-      case "$bsc_rest" in
-        *'; '*) bsc_rest="${bsc_rest#*; }" ;;
-        *) break ;;
-      esac
-    done
-    [ "$bsc_has" = 1 ] || continue
-    bsc_v="$(payload_subfield "$bsc_pay" "$bsc_f" all)"
-    case "$bsc_v" in
-      '')
-        die "the record's \`$bsc_f\` sub-field is THERE and EMPTY, which is not the same as absent: no reader can tell it from a line written before Amendment 18(a), so every one of them would read this lane's binding as the window on the row's workstation for ever. Write the value, or leave the sub-field out and the writer fills it in. Nothing was written" 2 ;;
-      *[!A-Za-z0-9._:-]*)
-        die "the record's \`$bsc_f\` sub-field is one ref of Amendment 7(b)'s grammar — letters, digits, '.', '_', '-', ':' — and '$bsc_v' is not one (Amendment 18(a)). A space there is a SECOND ref and a ';' is a second sub-field, in a log nothing rewrites. Nothing was written" 2 ;;
-    esac
-    if [ "$bsc_f" = os ]; then
-      case "$bsc_v" in
-        linux|macos|wsl|windows) : ;;
-        *) die "the record's \`os\` sub-field is one of linux, macos, wsl, windows (Amendment 18(a)) — '$bsc_v' is none of them. The probe writes the first three and only a launcher on the Windows host itself writes the fourth. Nothing was written" 2 ;;
-      esac
-    fi
-  done
-  return 0
-}
-
-# The <name> sub-field of the lane's LAST lane-kind line that carries one, IN
-# FILE ORDER — which is the order every other state read in this file uses, and
-# for the reason `swapped_lanes` states below: a lane's log is append-only and
-# single-writer, so a line further down the file is a line written later
-# whatever the two UTC fields say.
-#
-# THE LAST LINE CARRYING ONE, NOT THE LAST LINE. A lane started under Amendment
-# 11 and then PAUSED for a reason that is not a swap has a last line with no
-# payload at all, and its directory has not stopped being true. Amendment 7(i)'s
-# cutover rule is the same shape: a line written before this clause carries
-# none, and a reader that finds none SAYS SO rather than assuming one.
-# THE SIX FACTS A LISTING ROW NEEDS, FROM ONE PASS OVER ONE LANE'S EVENTS.
-# `<verb><US><utc><US><dir><US><profile><US><window><US><home>` on one line.
-# It is `payload_subfield`'s two rules and `home_of_lane`'s one, written once in
-# awk instead of a dozen forks per lane — and the rules are restated here rather
-# than referred to because a reader comparing the two must be able to see both:
-#   * the LAST lane-kind line that carries a sub-field wins, in FILE ORDER;
-#   * a value opening with `"` runs to its closing `"`, quotes stripped, and any
-#     other value ends at its first space — except `window`, which is two
-#     space-separated refs in ONE sub-field and is taken whole.
-lane_row_facts() {   # events on stdin, ONE LINE PER LANE
-  awk -v sep="$US" '
-    function field(pay, want, whole,   n, i, sf, v, q) {
-      want = want " "
-      n = split(pay, sf, "; ")
-      for (i = 1; i <= n; i++) {
-        if (substr(sf[i], 1, length(want)) != want) continue
-        v = substr(sf[i], length(want) + 1)
-        sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-        if (substr(v, 1, 1) == "\"") {
-          q = index(substr(v, 2), "\"")
-          if (q > 0) return substr(v, 2, q - 1)
-        }
-        if (!whole) sub(/ .*$/, "", v)
-        return v
-      }
-      return ""
-    }
-    function pos(pf2, pn) { return pf2 "\034" sprintf("%09d", pn) }
-    BEGIN { FS = sep }
-    $3 == "STARTED" || $3 == "PAUSED" || $3 == "RESUMED" || $3 == "ENDED" || $3 == "RETIRED" {
-      # AMENDMENT 15 — KEYED ON THE LANE LOWER-CASED, WITH ITS SPELLING BESIDE
-      # IT. Every consumer of this table already looks a lane up by its
-      # lower-cased name (`lanes_rows`-s `table_lookup`, which reads the FIRST
-      # line with that key), and the key used to be the spelling the LINE
-      # carried: a log holding both spellings of one lane — which is what
-      # `lanes/log/openxfactory-2.md` holds — emitted TWO lines under one key,
-      # and the listing took the first and lost the other-s state, dir,
-      # profile, window, home and session. `disp` is the first spelling seen,
-      # for the second column; `lanes_rows` prints the register-s spelling over
-      # it anyway, and this is what a lane with a log and no row shows as.
-      l = tolower($2)
-      if (!(l in seen)) { seen[l] = ++n; byn[n] = l }
-      if (!(l in disp)) disp[l] = $2
-      # A FORK-S RETIRED IS NOT THE LANE-S OWN LAST VERB (decision 8(c): a fork
-      # is never the lane; A11 Addendum 4 ruling 8). Read as the lane-s own line
-      # it would say the LANE was retired — the opposite of what happened, since
-      # the lane may well be live beside the fork it disowned. So a line whose
-      # payload opens `fork ` is skipped HERE, for the state fields only.
-      # NOTHING WRITES ONE ANY MORE, and this comment said otherwise (#26, the
-      # review of `29d3417`). The first build of ruling 8-s act appended
-      # `RETIRED … lane:<lane> -> fork <sid>; pid <n>; kind <k>`; that line is a
-      # seventh edit to in-force text and Amendment 7(b) gives `RETIRED` no
-      # payload, so `lane-end --retire` PROVES the fork and prints 6(d) and
-      # writes nothing at all (`lane_forks`-s own block argues it in full). The
-      # skip stays because these logs are APPEND-ONLY and never rewritten: a log
-      # that took one of those lines while that build was live still carries it.
-      #
-      # R14 IS NOT WEAKENED BY THIS. R14 decides WHICH of a lane-s own lines is
-      # last; this decides which lines are the lane-s own. A line about
-      # something that is never the lane was never in that set.
-      if (substr($8, 1, 5) == "fork ") next
-      # FILE ORDER decides which line is a lane-s LAST (R14), exactly as
-      # `swapped_candidates` decides it: a lane-s log is append-only and
-      # single-writer, so a line further down the file is a line written later
-      # whatever the two UTC fields say.
-      p = pos($10, $11)
-      if (!(l in mp) || p >= mp[l]) { mp[l] = p; verb[l] = $3; utc[l] = $1; ws[l] = $5 }
-      v = field($8, "dir", 0);     if (v != "") d[l] = v
-      v = field($8, "profile", 0); if (v != "") pf[l] = v
-      v = field($8, "window", 1);  if (v != "") w[l] = v
-      if ($3 == "STARTED" || $3 == "RESUMED") {
-        v = field($8, "home", 0); if (v != "" && v != "unknown") h[l] = v
-        # AMENDMENT 18(b) — WHERE THIS BINDING IS, out of the same pass, and
-        # taken from the BINDING LINE rather than from the last line carrying a
-        # sub-field: a `PAUSED` releases a binding and its own host is where the
-        # release was written, not where the lane was. Lower-cased here so the
-        # comparison one layer up costs no process (`lc` is a printf and a tr,
-        # and this listing asks it of every lane).
-        bh[l] = tolower(field($8, "host", 0)); if (bh[l] == "") bh[l] = tolower($5)
-        bc[l] = tolower(field($8, "container", 0)); if (bc[l] == "") bc[l] = "none"
-        # A line written before clause (a) carries NONE OF THE THREE, and its
-        # binding is *"the window on the row-s workstation"* — which has no
-        # container in it. All three, and not the host alone: this writer drops
-        # an offending sub-field on its own and keeps the line, so a modern line
-        # missing only its host is modern and is matched on the container it
-        # does carry (Copilot round 2). Said here so the reader one layer up
-        # matches it exactly as `binding` does.
-        bl[l] = (field($8, "host", 0) == "" && field($8, "container", 0) == "" && \
-                 field($8, "os", 0) == "" ? "legacy" : "")
-      }
-      # Clause (d) rule 3-s second source, out of the same pass: the session
-      # field of the lane-s last PAUSED or RESUMED, which is the resume target
-      # where the published cell names none.
-      if (($3 == "PAUSED" || $3 == "RESUMED") && $4 ~ /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/) sid[l] = tolower($4)
-      next
-    }
-    # THE OBJECTS EACH LANE HOLDS, from the same pass. A lane HOLDS an object
-    # when its own LAST line on that object carries an OPEN verb — Amendment
-    # 7(b)-s partition, and the one `lane-end` refuses on.
-    #
-    # IT CARRIES NO TAKEN-OVER ANNOTATION, AND THAT IS A DELIBERATE NARROWING.
-    # `lane_objects` adds one by asking `superseded_by` per object, which is a
-    # full pass over this stream per object per lane: on the suite-s own
-    # register that turned a listing into eighteen minutes and counting. A
-    # listing says WHAT A LANE HOLDS; `who --lane <lane>` is the authority that
-    # says whether somebody has taken it over, and the listing points at it.
-    $6 !~ /^lane:/ {
-      l = tolower($2); k = l "\034" $6          # Amendment 15, as above
-      p = pos($10, $11)
-      if (!(k in omp) || p >= omp[k]) { omp[k] = p; overb[k] = $3; oobj[k] = $6; olane[k] = l
-        if (!(k in okseen)) { okseen[k] = ++okn; okbyn[okn] = k } }
-      if (!(l in seen)) { seen[l] = ++n; byn[n] = l }
-      if (!(l in disp)) disp[l] = $2
-    }
-    END {
-      for (i = 1; i <= okn; i++) {
-        k = okbyn[i]
-        if (overb[k] != "CLAIMED" && overb[k] != "TAKEOVER" && overb[k] != "OPENED" && overb[k] != "LANDING" && overb[k] != "WITHDRAWN") continue
-        l = olane[k]
-        if (l in have) obj[l] = obj[l] "; " overb[k] " " oobj[k]
-        else { obj[l] = overb[k] " " oobj[k]; have[l] = 1 }
-      }
-      for (i = 1; i <= n; i++) {
-        l = byn[i]
-        # KEYED ON THE LANE LOWER-CASED, like the register index beside it and
-        # for the same reason: the listing joins these two tables on the lane
-        # name, and this file matches a lane name case-insensitively everywhere
-        # else (`lane_named_ci`).
-        printf "%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s\n", l, 31, disp[l], 31, verb[l], 31, utc[l], 31, ws[l], 31, d[l], 31, pf[l], 31, w[l], 31, h[l], 31, sid[l], 31, obj[l], 31, bh[l], 31, bc[l], 31, bl[l]
-      }
-    }'
-}
-
-# 0 with the sub-field · 8 the log was read and carries none · 1 THE LOG COULD
-# NOT BE READ, which is not the same fact and never was (#26, the fail-closed
-# family one layer out, `lanes-edit.sh:3525`).
-#
-# THE READ WAS INSIDE THE HERE-DOCUMENT THAT FEEDS THE LOOP, and a command
-# substitution's status THERE is not carried anywhere — not, as the review had
-# it, carried as `awk`'s; it is discarded outright, because a here-document body
-# is text and nothing tests it. So a `lane_log_events` that failed arrived as no
-# lines at all and left through the `return 8` below, and 8 is the one code every
-# caller of this function is entitled to read as *"this lane has not started
-# under Amendment 11 yet"* — the pre-cutover answer that sends `restart`,
-# `lane-start` and both skills to the rungs beneath a record they never
-# established was readable. The read is its own step now and its status decides.
-lane_payload_field() {   # <lane> <name> [all]
-  lpf_lines=""; lpf_rc=0
-  lpf_lines="$(lane_log_events "$1")" || lpf_rc=$?
-  [ "$lpf_rc" = 0 ] || return 1
-  # The scan is over EVERY lane-kind payload, newest last, and the answer is
-  # the last one that actually carries the sub-field.
-  lpf_v=""
-  while IFS= read -r lpf_p; do
-    [ -n "$lpf_p" ] || continue
-    lpf_this="$(payload_subfield "$lpf_p" "$2" "${3-}")"
-    [ -n "$lpf_this" ] && lpf_v="$lpf_this"
-  done <<EOF
-$(printf '%s\n' "$lpf_lines" | awk -F"$US" '
-    $3 == "STARTED" || $3 == "PAUSED" || $3 == "RESUMED" || $3 == "ENDED" || $3 == "RETIRED" { print $8 }')
-EOF
-  [ -n "$lpf_v" ] || return 8
-  printf '%s\n' "$lpf_v"
-}
-
-# --------------------------------------------- clause (h): `window-lane`
-#
-# WHAT TMUX SAYS ABOUT A REF, NOW. Empty where there is no tmux, no server, or
-# no such window — and an empty answer is what makes every match below fail
-# SHUT, which is clause (b)'s liveness fence: a record whose window is gone
-# names a window somebody else's `:0` may since have been given, and matching a
-# dead ref is how a lane binds to a stranger's pane.
-tmux_window_field() {   # <ref> <format>
-  [ -n "${1-}" ] || return 1
-  command -v tmux >/dev/null 2>&1 || return 1
-  tmux display-message -p -t "$1" "$2" 2>/dev/null | head -n1
-}
-
-# THE LANE BOUND TO A WINDOW OF THE ASKING WORKSTATION (Amendment 11 clause
-# (h), `R-A11-8`/RV-T7 for the scoping and `R-A11-8`/RV-T6 for the agreement
-# rule). Three callers, ONE implementation:
-#
-#   * the launcher's precedence 3 (clause (b) row 3),
-#   * `/restart`'s step 2(c) (clause (f)),
-#   * the `/lane-swap` skill's step 1 (Amendment 8(a) step 1, extended).
-#
-# TWO RUNGS, first answer wins:
-#   1. the window's own NAME, where the register has a row for it. That is
-#      clause (b)'s precedence 2 read through the same door, so a caller that
-#      asks this read a ref gets the same answer the launcher would.
-#   2. this workstation's swap records, matched on the ref.
-#
-# SCOPED TO THE ASKING WORKSTATION, IN THE CONTRACT AND NOT ONLY IN `Open`. A
-# `<session>:<index>` is a local fact about one machine, and `claude-x:0`
-# written on Raven collides with `claude-y:0` on Eagle far more easily than an
-# `<@id>` will. `swapped` takes `[<ws>]` for exactly that reason and this read
-# takes it for the same one: records written by another workstation are NOT
-# CONSIDERED.
-#
-# THE AGREEMENT RULE, AND THIS READ OWNS IT. Existing-now is not enough on its
-# own: a record naming `claude-y:0 @97`, met from the window that has since
-# taken `claude-y:0` as `@200`, passes the existing-now test on its ref and
-# would bind the lane to a stranger's pane with no question — which is the
-# failure the liveness fence exists to stop, arriving through the LIVE ref
-# instead of the dead one. So:
-#
-#   a record that carries an `<@id>` is matched on its `<session>:<index>` ONLY
-#   WHERE THE WINDOW NOW HOLDING THAT REF REPORTS THAT SAME ID; a record with
-#   no id is matched on the ref alone.
-#
-# It is stated once, here, and not restated in each of the read's three
-# callers: three implementations of one rule is how they would come to
-# disagree. The launcher PR withdrew its own copy of this clause on the same
-# ground.
-#
-# 0 with the lane, 8 with none, 64 a usage error of its own.
-window_lane() {   # <workstation> <ref>
-  wl_ws="$(short_ws "${1:-$WS}")"; wl_ref="${2-}"
-  [ -n "$wl_ref" ] || return 64
-  # A WORKSTATION THAT IS NOT THIS ONE HAS NO WINDOW THIS PROCESS CAN SEE, and
-  # the read says so rather than pretending. The window's NAME and the liveness
-  # fence are both facts about the tmux server running HERE: asked about Raven,
-  # a local `display-message` would answer about an Eagle window that happens to
-  # share the ref — which is the collision the scoping exists to stop, made by
-  # the fence itself. So a foreign workstation is answered from its RECORDS
-  # alone, unfenced, and that is the cross-machine answer Amendment 7's open
-  # item is about: this process cannot tell whether Raven's window still exists.
-  wl_local=1
-  [ "$wl_ws" = "$(short_ws "$WS")" ] || wl_local=0
-  if [ "$wl_local" = 1 ]; then
-    # RUNG 1 — the window's own name. Read from tmux, so a ref that names no
-    # window answers nothing here either.
-    wl_name="$(tmux_window_field "$wl_ref" '#{window_name}' 2>/dev/null || :)"
-    if [ -n "$wl_name" ]; then
-      wl_row="$(lane_named_ci "$wl_name" 2>/dev/null || :)"
-      if [ -n "$wl_row" ]; then printf '%s\n' "$wl_row"; return 0; fi
-    fi
-  fi
-  # RUNG 2 — that workstation's swap records. `swapped_candidates` is the one
-  # reader of a `PAUSED … swap;` line in this file, so the record's shape is
-  # parsed once however many reads are built on it.
-  wl_now_id=""
-  if [ "$wl_local" = 1 ]; then
-    wl_now_id="$(tmux_window_field "$wl_ref" '#{window_id}' 2>/dev/null || :)"
-    [ -n "$wl_now_id" ] || return 8        # the ref names no window HERE, now
-  fi
-  # THE FIELD LIST IS `swapped_candidates`' OWN, IN FULL, and it gains Amendment
-  # 17(b)'s two: `read` puts every field it has no variable for into the LAST
-  # one, so a short list would have quietly moved the pickaxe key — which is not
-  # read here — into `wl_p` and the agent into it too. Named in full, the reader
-  # and the writer of this row cannot drift apart.
-  while IFS="$US" read -r wl_l wl_u wl_w wl_d wl_p wl_a wl_t wl_key; do
-    [ -n "${wl_l:-}" ] || continue
-    [ -n "${wl_w:-}" ] && [ "$wl_w" != unknown ] || continue
-    # The sub-field's refs: `<session>:<index>` first, `<@id>` second.
-    wl_rec_ref="${wl_w%% *}"
-    wl_rec_id=""
-    case "$wl_w" in *' '@*) wl_rec_id="${wl_w##* }" ;; esac
-    case "$wl_ref" in
-    @*)
-      # Asked by id. The record must carry that id, and the id must resolve —
-      # which `wl_now_id` has already proved, since tmux answered for it.
-      [ -n "$wl_rec_id" ] && [ "$wl_rec_id" = "$wl_ref" ] || continue
-      ;;
-    *)
-      # Asked by `<session>:<index>`. The record must name that ref, AND —
-      # where the record carries an id and this workstation can see the window
-      # — the window now holding the ref must report that same id.
-      [ "$wl_rec_ref" = "$wl_ref" ] || continue
-      if [ "$wl_local" = 1 ] && [ -n "$wl_rec_id" ] && [ "$wl_rec_id" != "$wl_now_id" ]; then continue; fi
-      ;;
-    esac
-    # AMENDMENT 15 — AND THE ANSWER IS THE ROW'S SPELLING, as rung 1's already
-    # is. `$wl_l` is the lane as its own `PAUSED … swap;` line spells it, which
-    # is whatever the lane was PAUSED under; this read's three callers hand what
-    # it prints to `tmux rename-window`, to `--name` and to `lane <name>`, so
-    # a record written before the row's spelling settled would rename a window
-    # to the wrong one. A register holding the 15(d) pair keeps the record's own
-    # spelling rather than refusing: this read is a rung in front of a launch and
-    # its contract is 0, 8 or 64 — the refusal belongs to the writer it leads to.
-    wl_can="$(canon_lane "$wl_l" 2>/dev/null || :)"
-    printf '%s\n' "${wl_can:-$wl_l}"
-    return 0
-  done <<EOF
-$(swapped_candidates "$wl_ws")
-EOF
-  return 8
-}
-
-# ------------------------------- clause (d) rules 3 and 4: the LAST UUID
-#
-# THE RESUME TARGET, READ ROBUSTLY AND NEVER FALLING TO A TITLE WHILE A UUID
-# EXISTS (Amendment 11 clause (d), Evidence 2(b)). Two sources, in order, and
-# the second is consulted ONLY where the first has no answer at all — Amendment
-# 6(b) keeps the published cell as the resume target and this adds no second
-# one:
-#
-#   1. THE PUBLISHED ROW'S SESSION CELL, OF ANY SHAPE. `uuids_in_cell` matches
-#      the uuid by its shape rather than by the cell's punctuation, so
-#      `harness \`x\` → after /clear \`y\``, a bare id, a `(profile team-02c)`
-#      annotation and a cell carrying `session_01…` footer ids beside a uuid
-#      all answer the same: the LAST uuid in it.
-#   2. THE LANE'S OWN LOG — the session field of its last `PAUSED` or `RESUMED`
-#      line, in file order, out of `origin/<branch>` exactly as every other
-#      state read is. Clause (e) is what makes this source trustworthy, by
-#      refusing `unknown` in that field: a log that may carry the literal there
-#      is a log that cannot be read this way, and the two clauses are one act.
-#
-# A uuid whose transcript is not in the lane's directory IS STILL A UUID, and
-# the caller says so rather than resuming a title into a picker.
-#
-# 0 with the uuid, 8 where neither source names one.
-last_session_of() {   # <lane>
-  lso_l="${1-}"; [ -n "$lso_l" ] || return 64
-  lso_id="$(session_ids_of_lane "$lso_l" 2>/dev/null | tail -n1 || :)"
-  if [ -n "$lso_id" ]; then printf '%s\n' "$lso_id"; return 0; fi
-  lso_id="$(lane_log_events "$lso_l" 2>/dev/null | awk -F"$US" '
-    ($3 == "PAUSED" || $3 == "RESUMED") && $4 ~ /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/ { id = $4 }
-    END { if (id != "") print tolower(id) }')"
-  [ -n "$lso_id" ] || return 8
-  printf '%s\n' "$lso_id"
-}
-
-# ------------------------- decision 8(c) and 8(e): A FORK IS NEVER A HOLDER
-#
-# Evidence 6, 2026-09-13: an abandoned launch of a lane left behind a DAEMON
-# FORK of its transcript — `--fork-session`, a NEW session id, `kind: bg`, no
-# tmux, a cwd of `/workspace` — which went on orchestrating the same plan,
-# relaunched writers on the same three branches, wrote `RESUMED` and `PAUSED`
-# lines into the lane's log, and messaged the interactive session claiming to
-# be the holder while citing a dead pid.
-#
-# Amendment 8 ruling (g) already skips a `kind: bg` companion, and that is not
-# enough: a fork is a SESSION OF ITS OWN with an id no row carries, so the
-# thing that makes it recognisable is neither its kind nor its id but ITS
-# TRANSCRIPT'S TITLE. A `--fork-session` copies the parent's `custom-title`
-# record, so the fork's transcript says `openRepoProject-1` while its id says
-# something the lane's row has never heard of. That pair — THE LANE'S TITLE
-# UNDER AN ID THE LANE DOES NOT RECORD — is the defect, and it is what this
-# read finds.
-#
-# IT NAMES THEM AND DOES NOTHING ELSE, exactly as `idle_holders` does and for
-# the same reason clause (f) of Amendment 8 gives. THE ACT IT NAMES IS
-# `lane-end <lane> --retire <pid|uuid>` (clause (k) rule (e), A11 Addendum 4
-# ruling 8) and never `kill <pid>`: that act is the DOOR to Amendment 6(d), it
-# writes nothing and *"neither kills a process"*. So this read goes on naming a
-# fork until 6(d) is actually taken on it — the retitle, or the process gone —
-# which is what is TRUE; and stopping the process stays a person's act that no
-# surface here prints as the one.
-#
-# One line per fork, `<session id><TAB><pid><TAB><kind><TAB><cwd>`.
-# 0 with rows, 8 with none, 1 where the records could not be read.
-# Every LIVE record on this workstation whose transcript carries a custom
-# title, as
-# `<lc title><US><title><US><sessionId><US><lc sessionId><US><pid><US><kind><US><cwd>`.
-# Built ONCE per process: `who` asks about every lane in the register, and one
-# find per record per lane would be a read nobody would run.
-#
-# CACHED IN A FILE for the reason `live_session_ids` gives, and this one was the
-# more expensive of the two: `transcript_title` falls back to a `find` over the
-# whole profiles tree, so a rebuild per lane was a filesystem walk per lane.
-#
-# THE LOWER-CASED TITLE AND ID ARE CARRIED rather than computed by the reader:
-# `lc` is `printf | tr`, TWO PROCESSES, and `lane_forks` ran it on every entry of
-# this map for every lane it was asked about — fifty lanes times however many
-# live records, for two comparisons a `case` can make.
-fork_map() {
-  fm_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.forks}"
-  if [ -n "$fm_c" ] && [ -f "$fm_c" ]; then cat -- "$fm_c"; return 0; fi
-  # THE READ IS ITS OWN STEP AND ITS STATUS DECIDES, because the loop below is
-  # fed by a HERE-DOCUMENT and a here-document body is TEXT: the status of a
-  # command substitution inside it is discarded outright (#26, the review of
-  # `37632b1`; the same shape `f368a75` took out of `lane_payload_field`).
-  fm_recs=""; fm_rc=0
-  fm_recs="$(session_records)" || fm_rc=$?
-  [ "$fm_rc" = 0 ] || return 1
-  fm_out=""
-  while IFS="$US" read -r fm_f fm_sid fm_tmux fm_name fm_pid fm_kind fm_cwd fm_status fm_start; do
-    [ -n "${fm_sid:-}" ] || continue
-    record_fields_are_live "$fm_status" "$fm_pid" "$fm_start" || continue
-    fm_t="$(transcript_title "$fm_sid" "$fm_f" "$fm_cwd")"
-    [ -n "$fm_t" ] || continue
-    fm_out="${fm_out}$(lc "$fm_t")${US}${fm_t}${US}${fm_sid}${US}$(lc "$fm_sid")${US}${fm_pid}${US}${fm_kind}${US}${fm_cwd}
-"
-  done <<EOF
-$fm_recs
-EOF
-  if [ -n "$fm_c" ]; then
-    printf '%s' "$fm_out" > "$fm_c.${BASHPID:-$$}" 2>/dev/null &&
-      mv -f -- "$fm_c.${BASHPID:-$$}" "$fm_c" 2>/dev/null ||
-      rm -f -- "$fm_c.${BASHPID:-$$}"
-  fi
-  printf '%s' "$fm_out"
-}
-
-# The `customTitle` of a transcript, by its uuid. A `/rename` writes a
-# `{"type":"custom-title",…}` record INTO the transcript and the LAST one wins,
-# which is the same reading `lane-start`'s own `titled_transcript` makes.
-# `<lane> (2)` is the same lane: that suffix is what a rename into a title
-# something else still holds mints.
-transcript_title() {   # <uuid> [<the record's file>] [<the record's cwd>]
-  tt_id="${1-}"; [ -n "$tt_id" ] || return 1
-  tt_f=""
-  # THE CHEAP CANDIDATES FIRST, AND THE WALK ONLY WHERE THEY MISS. The harness
-  # keeps one transcript directory per working directory, named by that
-  # directory with every character that is not a letter or a digit replaced by
-  # `-`; the record itself carries both the profile directory it was written in
-  # (`<profile>/sessions/<pid>.json`) and the `cwd`. Two `[ -f ]` tests answer
-  # for every ordinary session, and the `find` is what catches a transcript the
-  # harness moved — which is the case Evidence 6's fork was in, its transcript
-  # under `state/` rather than under the profile.
-  if [ -n "${3-}" ]; then
-    tt_slug="$(printf '%s' "$3" | sed 's/[^A-Za-z0-9]/-/g')"
-    for tt_c in \
-      "$(dirname -- "$(dirname -- "${2:-/nonexistent/x}")")/projects/$tt_slug/$tt_id.jsonl" \
-      "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/projects/$tt_slug/$tt_id.jsonl"; do
-      [ -f "$tt_c" ] && { tt_f="$tt_c"; break; }
-    done
-  fi
-  if [ -z "$tt_f" ]; then
-    for tt_root in "${CLAUDE_PROFILES_HOME:-$HOME/.claude-profiles}" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}"; do
-      [ -d "$tt_root" ] || continue
-      tt_f="$(find "$tt_root" -maxdepth 8 -path '*/projects/*' -name "$tt_id.jsonl" -type f 2>/dev/null | head -n1)"
-      [ -n "$tt_f" ] && break
-    done
-  fi
-  [ -n "$tt_f" ] || return 1
-  tt_last="$(grep -e '^{"type":"custom-title"' -- "$tt_f" 2>/dev/null | tail -n1 || :)"
-  [ -n "$tt_last" ] || return 1
-  tt_v="$(printf '%s' "$tt_last" | sed 's/.*"customTitle":"//; s/".*//')"
-  [ -n "$tt_v" ] || return 1
-  printf '%s\n' "${tt_v% (*)}"
-}
-
-# `lane_forks <lane> [<ids fence>]`
-#
-# THE TWO SETS AS ONE SPACE-FENCED STRING EACH, tested with `case` (A11
-# Addendum 4 ruling 12). The `grep -qx` this replaces was a process per map
-# entry per lane, and `lc` on the entry's title was two more; a `case` is the
-# shell's own.
-#
-# AND A CALLER THAT ALREADY HAS THEM PASSES THEM. `lanes` asks this about every
-# lane, and computing the row's ids here meant TWO renders of the published
-# register plus one of the working tree's, per lane — the very reads the listing
-# has already made in one pass. A caller with one lane in hand (`forks`, `who`)
-# passes nothing and this computes them, so the read is unchanged for everybody
-# else. The fences are `" a b c "`, lower-cased, spaces at both ends.
-lane_forks() {   # <lane> [<ids fence>]
-  lf_l="${1-}"; [ -n "$lf_l" ] || return 64
-  lf_ll="$(lc "$lf_l")"
-  if [ "$#" -ge 2 ]; then
-    lf_ids="$2"
-  else
-    lf_ids=" $( { session_ids_of_lane "$lf_l" 2>/dev/null || :
-                  session_ids_local_of_lane "$lf_l" 2>/dev/null || :; } | awk 'NF && !seen[$0]++' | tr '\n' ' ')"
-  fi
-  # AND THE MAP IS READ BEFORE THE LOOP, so that a session tree which could not
-  # be read leaves here as **1** and not as the **8** that means "no fork of it
-  # is live" (#26, the review of `37632b1`). The `forks` arm has carried the
-  # refusal for that 1 since it was written — *"That is NOT 'no fork of it is
-  # live'"* — and it was UNREACHABLE, because the status died in the
-  # here-document below. A fork is a DEFECT under ratified decision 8(e); the
-  # one thing worse than reporting one is reporting none without looking.
-  lf_map=""; lf_mrc=0
-  lf_map="$(fork_map)" || lf_mrc=$?
-  [ "$lf_mrc" = 0 ] || return 1
-  lf_out=""
-  while IFS="$US" read -r lf_tl lf_t lf_sid lf_sidl lf_pid lf_kind lf_cwd; do
-    [ -n "${lf_tl:-}" ] || continue
-    [ "$lf_tl" = "$lf_ll" ] || continue
-    # AN ID THE ROW RECORDS IS THE LANE ITSELF, never a fork of it.
-    case "$lf_ids" in *" $lf_sid "*) continue ;; esac
-    # AND THERE IS NO THIRD TEST, BECAUSE RETIRING WRITES NOTHING. The first
-    # build of ruling 8's act appended `RETIRED … -> fork <sid>` to the lane's
-    # log and this read filtered on it; that line is a SEVENTH edit to in-force
-    # text — Amendment 7(b) gives `RETIRED` no payload and A11 clause (c) keeps
-    # it that way — so it is gone (`lane-end`'s own block argues it in full).
-    # `lane-end --retire <pid|uuid>` is the DOOR to Amendment 6(d) and performs
-    # none of it, which is clause (k) rule (e)'s own posture, so a fork stays a
-    # fork here until the operator's retitle or its process is gone. This read
-    # keeps saying what is TRUE rather than what has been acknowledged.
-    lf_out="${lf_out}${lf_sid}	${lf_pid}	${lf_kind:-interactive}	${lf_cwd}
-"
-  done <<EOF
-$lf_map
-EOF
-  [ -n "$lf_out" ] || return 8
-  printf '%s' "$lf_out"
-}
-
-# ------------------------------------------- issue #39: DUPLICATE HOLDERS
-#
-# `lane_forks` answers one question — a LIVE session recorded under an id the
-# row does NOT carry, wearing the lane's own transcript title — and it answers
-# it well: Evidence 6's `--fork-session` daemon had a fresh id nothing had
-# heard of. Measured 2026-09-14 (opensoft/openRepoTools#39): a cross-profile
-# resume leaves a SECOND kind of stray behind that `lane_forks` cannot see at
-# all — a `bg-pty-host` running `claude --session-id <X> --fork-session
-# --resume <parent>.jsonl` under a background pty host, where a LATER
-# `lane-start --no-launch` went on to bind `<X>` itself as the row's own
-# session. Once that happens the fork's id IS an id the row carries,
-# `lane_forks`' own exclusion (`case "$lf_ids" in *" $lf_sid "*) continue`)
-# fires exactly as designed, and the daemon goes invisible to it — while a
-# second live process now holds the one transcript Amendment 18(h) says
-# exactly one process may hold. `lane-end --retire <pid>` refused it outright,
-# and the retirement was a bare `kill -TERM`, outside every tool this estate
-# has.
-#
-# THE PROCESS TABLE, NOT A SESSION RECORD'S `sessionId` FIELD, because this
-# question is not about what a record CLAIMS its id is — the fork's own record
-# may say `<X>`, which is exactly the id the row now also carries and exactly
-# why `lane_forks` cannot use it — it is about the ARGV a live process was
-# actually started with: a `--fork-session` invocation whose `--resume` path
-# ends in one of THIS LANE's own transcript ids. Every id the row has ever
-# carried is checked, not only the last (Amendment 6(b): a chained cell's
-# earlier link is still this lane's transcript).
-#
-# `pgrep -f` FIRST, THEN `ps -o pid=,ppid=,args= -p` PER CANDIDATE, both forms
-# already used elsewhere in this tree for the same reason: GNU and BSD/macOS
-# agree on `-f` (match the full argument list) and on `-o field=` (each `=`
-# suppresses that field's own header, so the frame needs no trimming) where
-# they do not agree on a fixed-column `ps aux`. Scoping the `ps` call to one
-# candidate pid at a time, rather than walking the whole table once, is what
-# lets the exact form stay `-p <pid>` instead of a table-wide parse this file
-# would then own two implementations of.
-#
-# THE ROW'S OWN LIVE HOLDER IS EXCLUDED, never reported and never touched,
-# over the SAME implementation `live-holder` already calls (`live_holder`,
-# over the published-union-local id set) — never a new liveness primitive. In
-# the ordinary case this exclusion never fires: a lane's real interactive
-# session is never started WITH `--fork-session` in its own argv, so nothing
-# this read finds can coincide with it. It stays in because a fence that is
-# usually a no-op is exactly what a fence should be, and `lane-end` asks the
-# same question again, in words, before it sends a single signal.
-#
-# One line per surviving match: `<parent pid><US><child pids, or empty><US>
-# <the matched uuid>` — `$US`, never a TAB. A CONFIRMED CHILD OF THE CI RUN ON
-# PR #61: with a real, honest, DOCUMENTED-empty child slot (the line just
-# above — "the child slot stays empty" is not a race-only rarity, it is this
-# read's ordinary answer for a parent with no confirmable fork-session child),
-# a bare TAB is one of bash `read`'s own IFS-WHITESPACE characters, so
-# `IFS=$'\t' read -r a b c` on `"<parent>\t\t<uuid>"` — TWO adjacent tabs
-# either side of the empty middle field — COLLAPSES them into ONE delimiter
-# exactly as it collapses repeated spaces, silently shifting the uuid into
-# `b` and leaving `c` empty. Measured: `tests-no-submodule` on e4f9054,
-# `test_the_lane_helper_suite_passes` read the empty child as a parent still
-# "STILL ALIVE" (its own argv check comparing against `$dh_uuid_lc=""` could
-# match nothing) and the uuid as a pid — `pid <uuid> (child): gone`. `$US` is
-# not IFS whitespace, so `read` never merges it with itself; both consumers in
-# `lane-end` read this format with `IFS=$'\037'` for the same reason
-# `live-holder`'s own multi-field line already does.
-# 0 with rows, 8 with none, 1 where `pgrep` is missing, the register or
-# this workstation's session records could not be read — a read that failed is
-# never "nothing is a duplicate".
-duplicate_holder_pids() {   # <lane>
-  dhp_l="${1-}"; [ -n "$dhp_l" ] || return 64
-  command -v pgrep >/dev/null 2>&1 || return 1
-  command -v ps    >/dev/null 2>&1 || return 1
-  # THE IDS ARE THE WHOLE SEARCH, SO A REGISTER THAT COULD NOT BE READ IS 1
-  # (opensoft/openRepoTools#67). Its empty render used to be the same empty set
-  # as a lane with no row, and this returned 8 — "no duplicate holder is live" —
-  # without asking the process table anything at all.
-  dhp_ids=""; dhp_irc=0
-  dhp_ids="$(session_ids_checked "$dhp_l")" || dhp_irc=$?
-  case "$dhp_irc" in
-    0) : ;;
-    8) return 8 ;;
-    *) SESSION_FILES_ERR="the register (origin/$LANES_BRANCH:$LANES_PATH, or $LANES_FILE) could not be read, so lane $dhp_l's session ids are not known and no process could be matched against them"
-       return 1 ;;
-  esac
-  dhp_legit=""
-  # NOT `$( … )` (Copilot round 2, PR #61): `live_holder` communicates a read
-  # failure by setting `SESSION_FILES_ERR` in ITS CALLER's shell, exactly as
-  # `session_files` documents and `window_session` already relies on — a
-  # command substitution runs in a SUBSHELL, so that assignment would die with
-  # it and the dispatcher's `${SESSION_FILES_ERR:-unknown error}` would print
-  # "unknown error" always. The tmp file is what lets this call stay direct
-  # and still hand the printed record back to the code after it.
-  dhp_lh_f="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-dhp.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$dhp_lh_f" ]; then
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  live_holder "$dhp_l" "$dhp_ids" > "$dhp_lh_f" 2>/dev/null; dhp_lrc=$?
-  case "$dhp_lrc" in
-    0) dhp_legit="$(awk -F"$US" '{print $4}' "$dhp_lh_f")" ;;
-    8) : ;;
-    *) rm -f -- "$dhp_lh_f"; return 1 ;;
-  esac
-  rm -f -- "$dhp_lh_f"
-  # `pgrep -f` ITSELF, THREE-WAY (Copilot round 2): 1 is its OWN "no process
-  # matched" — the ordinary, honest 8 — and anything else (2 usage, 3 a fatal
-  # error reading the process table) is a READ THAT FAILED, never "none is a
-  # duplicate".
-  dhp_cand=""; dhp_pgrc=0
-  dhp_cand="$(pgrep -f 'fork-session' 2>/dev/null)" || dhp_pgrc=$?
-  case "$dhp_pgrc" in
-    0) : ;;
-    1) return 8 ;;
-    *) return 1 ;;
-  esac
-  [ -n "$dhp_cand" ] || return 8
-  # AMENDMENT 8 RULING (g)'s COMPANION IS NEVER A DUPLICATE, FROM THIS SURFACE
-  # EITHER (Copilot on 05d7889, PR #61). `live_holder` above answers the
-  # INTERACTIVE holder only — it passes over a `kind: bg` record by design —
-  # so `dhp_legit` fenced the session at the keyboard but not the harness's
-  # own companion beside it: a `kind: bg` record carrying the SAME id in the
-  # SAME profile as an interactive record of it, "one session, not a queue of
-  # rival holders". `lane-end`'s session-record path already refuses that pid
-  # by name; this process-table path runs FIRST, so a companion whose argv
-  # carried `--fork-session --resume <this lane's id>.jsonl` would have been
-  # handed to it as a duplicate and TERMed — one half of the live session that
-  # IS the lane. The companion set is built here with the very rule
-  # `lane-end` applies (`transcript_holders`' own `companion` verdict, or a
-  # `bg` row in a profile that also holds a non-`bg` row of the same id, which
-  # is how that verdict reads from outside the lane's own window), and a
-  # candidate that is one — or a wrapper whose child is one — is never a row.
-  # A records tree `transcript_holders` could not read is a read that FAILED,
-  # exactly as `live_holder`'s is above: 1, never "no companion".
-  dhp_comp=" "
-  dhp_th_f="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-dht.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$dhp_th_f" ]; then
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  for dhp_tid in $dhp_ids; do
-    transcript_holders "$dhp_tid" > "$dhp_th_f" 2>/dev/null; dhp_thrc=$?
-    case "$dhp_thrc" in
-      0) : ;;
-      8) continue ;;
-      *) rm -f -- "$dhp_th_f"; return 1 ;;
-    esac
-    dhp_int_profs=" "
-    while IFS="$US" read -r dt_pid dt_kind dt_tgt dt_prof dt_where dt_v dt_file; do
-      [ -n "${dt_pid:-}" ] || continue
-      [ "$dt_kind" = bg ] && continue
-      case "$dhp_int_profs" in *" $dt_prof "*) : ;; *) dhp_int_profs="${dhp_int_profs}${dt_prof} " ;; esac
-    done < "$dhp_th_f"
-    while IFS="$US" read -r dt_pid dt_kind dt_tgt dt_prof dt_where dt_v dt_file; do
-      [ -n "${dt_pid:-}" ] || continue
-      [ "$dt_kind" = bg ] || continue
-      dt_is_comp=0
-      if [ "$dt_v" = companion ]; then
-        dt_is_comp=1
-      else
-        case "$dhp_int_profs" in *" $dt_prof "*) dt_is_comp=1 ;; esac
-      fi
-      [ "$dt_is_comp" = 1 ] && dhp_comp="${dhp_comp}${dt_pid} "
-    done < "$dhp_th_f"
-  done
-  rm -f -- "$dhp_th_f"
-  # A CANDIDATE'S OWN PARENT, WHEN IT IS ALSO A CANDIDATE, IS NEVER TREATED AS
-  # A SECOND PARENT (Copilot round 2): `--fork-session`'s argv is inherited by
-  # the child `claude` process as often as the bg-pty-host wrapper that
-  # started it, so `pgrep -f` routinely returns BOTH — and reading the child
-  # on its own turn, with no ppid fence, reported it as a headless parent of
-  # its own (no child of ITS OWN to find), doubling one duplicate into two
-  # rows and leaving `--retire <the real parent's pid>` unreachable if the
-  # child's spurious row was taken instead.
-  dhp_cand_fence=" $(printf '%s' "$dhp_cand" | tr '\n' ' ') "
-  dhp_out=""
-  while IFS= read -r dhp_pid; do
-    [ -n "$dhp_pid" ] || continue
-    [ -n "$dhp_legit" ] && [ "$dhp_pid" = "$dhp_legit" ] && continue
-    case "$dhp_comp" in *" $dhp_pid "*) continue ;; esac
-    dhp_psrc=0
-    dhp_line="$(ps -o pid=,ppid=,args= -p "$dhp_pid" 2>/dev/null)" || dhp_psrc=$?
-    # A `ps -p` MISS IS NOT A READ FAILURE, but a nonzero status alongside
-    # OUTPUT would be (Copilot round 5/6, PR #61: "a failed ps lookup is read
-    # as no candidate") — `ps -p <gone pid>` fails with EMPTY output, which is
-    # the ordinary, honest "it already exited" race this whole scan expects;
-    # a command that failed and still printed something is the one case
-    # this file's fail-closed rule everywhere else applies to.
-    if [ -z "$dhp_line" ]; then continue; fi
-    [ "$dhp_psrc" = 0 ] || return 1
-    read -r dhp_pid_chk dhp_ppid dhp_args <<DHPLINE
-$dhp_line
-DHPLINE
-    # `--fork-session ` WITH ITS OWN TRAILING SPACE (Copilot round 11, PR
-    # #61): a bare substring also matches `--fork-session-helper` or any
-    # other flag that merely STARTS WITH this text, which is never the
-    # process this scan means — the real invocation always has a boundary
-    # (a space, then `--resume`) right after this flag, so requiring it
-    # rules the false one out the same way the `--resume ` half already
-    # rules out `--resume-file` beside it.
-    case "$dhp_args" in *"--fork-session "*"--resume "*) : ;; *) continue ;; esac
-    case "$dhp_cand_fence" in *" $dhp_ppid "*) continue ;; esac
-    dhp_args_lc="$(printf '%s' "$dhp_args" | tr 'A-F' 'a-f')"
-    # THE ACTUAL `--resume` VALUE, NOT A GLOB THAT CAN SPAN OTHER ARGUMENTS
-    # (Copilot round 5, PR #61): `*"--resume"*"/$id.jsonl"*` also matches
-    # `--resume /other.jsonl --label /<id>.jsonl`, since `*` between them
-    # freely crosses argument boundaries. What was actually resumed is the
-    # value right after `--resume `, and that is the only thing compared —
-    # read WHOLE, spaces and all, by `dhp_resume_value` below this function
-    # (opensoft/openRepoTools#76: cutting it at the first space never matched
-    # a directory that has one).
-    dhp_resume_value "$dhp_args_lc"; dhp_resume="$dhp_rv"
-    for dhp_id in $dhp_ids; do
-      dhp_id_lc="$(printf '%s' "$dhp_id" | tr 'A-F' 'a-f')"
-      # AN EXACT PATH COMPONENT, NOT AN ARBITRARY SUBSTRING (Copilot round 4,
-      # PR #61): a bare substring also matches `other-<id>.jsonl` (no leading
-      # `/`, so it is not THIS transcript's basename) and `<id>.jsonl.bak` —
-      # `/<id>.jsonl` must be the resume token's own trailing path component.
-      dhp_matched=0
-      case "$dhp_resume" in */"$dhp_id_lc.jsonl") dhp_matched=1 ;; esac
-      if [ "$dhp_matched" = 1 ]; then
-          # THE CHILD, PREFERRING ONE THAT IS ITSELF A `--fork-session` MATCH
-          # (the real `claude` leaf) over whichever child the process table
-          # happens to list first. `pgrep -P`'s OWN status, three-way, same as
-          # the top-level `pgrep -f` above (Copilot round 4): 1 is its own
-          # "no children", honestly empty; anything else is a read that
-          # FAILED, and this candidate is skipped rather than reported with a
-          # child slot that only LOOKS empty on purpose.
-          dhp_child=""; dhp_kids=""; dhp_kidrc=0
-          dhp_kids="$(pgrep -P "$dhp_pid" 2>/dev/null)" || dhp_kidrc=$?
-          case "$dhp_kidrc" in
-            0 | 1) : ;;
-            *) return 1 ;;
-          esac
-          # AN ARBITRARY CHILD IS NEVER GUESSED (Copilot round 6, PR #61): a
-          # bg-pty-host can have children that are not the `claude` process it
-          # wraps at all — a shell, a pty helper — and reporting the FIRST one
-          # `pgrep -P` happens to list, when none of them is itself a
-          # `--fork-session` candidate, could hand an unrelated process to
-          # `lane-end --retire`'s TERM. Only a child THIS SAME SCAN also
-          # confirmed as a fork-session candidate is ever named; otherwise the
-          # child slot stays empty; the parent is still reported and retirable
-          # on its own.
-          #
-          # EVERY FENCED CANDIDATE MUST PROVE IT RESUMES THIS SAME TRANSCRIPT
-          # BEFORE IT IS NAMED, and a `ps -p` MISS IS NOT THE SAME VERDICT AS A
-          # CONFIRMED MISMATCH (Copilot round 8 AND round 9, PR #61: the first
-          # pass here trusted a SOLE fenced candidate on the fence alone,
-          # which round 9 found true a wrapper with exactly one child for a
-          # DIFFERENT transcript could exploit). Both facts are proven in one
-          # pass, never two:
-          #   * a candidate whose `ps -p` reads and whose `--resume` value
-          #     matches `$dhp_id_lc` exactly is VERIFIED — named, however many
-          #     other candidates there are, and so is EVERY other child that
-          #     verifies (opensoft/openRepoTools#86, below);
-          #   * a candidate whose `ps -p` reads but whose `--resume` does NOT
-          #     match is a CONFIRMED MISMATCH — a different transcript's fork,
-          #     and it is never named, however few other candidates there are;
-          #   * a candidate whose `ps -p` MISSES (empty output — the ordinary
-          #     "already gone by the time this scan asks" race, not a
-          #     confirmed anything) is neither: it is held as a FALLBACK, and
-          #     named only if it is the SOLE fallback with no verified
-          #     candidate elsewhere. This is what keeps `lane-end`'s own race
-          #     case working — a child already unreadable by the time
-          #     discovery runs is still named here, for the pre-kill recheck
-          #     a step later to catch honestly — while a wrapper's one child
-          #     for another transcript, which DOES read, is never mistaken
-          #     for it.
-          # Two or more unresolved fallbacks are left unnamed rather than
-          # guessed between; the parent is still reported and retirable on
-          # its own in every one of these shapes.
-          #
-          # EVERY VERIFIED CHILD, NOT THE FIRST (opensoft/openRepoTools#86,
-          # Copilot on 11bf0f0, PR #61): this loop used to `break` on the first
-          # child that verified, and the record had one child slot, so a
-          # wrapper with two children both resuming this transcript had the
-          # second left out of the report `lane-end --retire` acts on — which
-          # then TERMed the parent and the one child it was told about,
-          # reported RETIRED, and left the other still holding the transcript.
-          # The loop now runs to the end, and the slot carries every verified
-          # child, space-separated, in the order `pgrep -P` listed them. A
-          # pid never contains a space and `$US` is the record's only field
-          # separator, so `lane-end`'s `IFS=$'\037' read` still takes the
-          # whole list as one field.
-          dhp_verified=""; dhp_fallback=""; dhp_fallback_n=0
-          for dhp_c in $dhp_kids; do
-            case "$dhp_cand_fence" in *" $dhp_c "*) : ;; *) continue ;; esac
-            dhp_c_line=""; dhp_c_psrc=0
-            dhp_c_line="$(ps -o args= -p "$dhp_c" 2>/dev/null)" || dhp_c_psrc=$?
-            if [ -z "$dhp_c_line" ]; then
-              dhp_fallback_n=$((dhp_fallback_n + 1))
-              [ -n "$dhp_fallback" ] || dhp_fallback="$dhp_c"
-              continue
-            fi
-            [ "$dhp_c_psrc" = 0 ] || return 1
-            dhp_c_args_lc="$(printf '%s' "$dhp_c_line" | tr 'A-F' 'a-f')"
-            # `--fork-session ` WITH ITS OWN TRAILING SPACE (Copilot round 11,
-            # PR #61) — same fix, same reason as the parent's own check above.
-            case "$dhp_c_args_lc" in *"--fork-session "*"--resume "*) : ;; *) continue ;; esac
-            dhp_resume_value "$dhp_c_args_lc"; dhp_c_resume="$dhp_rv"
-            case "$dhp_c_resume" in
-              */"$dhp_id_lc.jsonl") dhp_verified="${dhp_verified}${dhp_verified:+ }${dhp_c}" ;;
-            esac
-          done
-          if [ -n "$dhp_verified" ]; then
-            dhp_child="$dhp_verified"
-          elif [ "$dhp_fallback_n" = 1 ]; then
-            dhp_child="$dhp_fallback"
-          fi
-          # A WRAPPER WHOSE CHILD IS THE COMPANION IS THE COMPANION'S OWN HOST
-          # (Copilot on 05d7889, PR #61, with the companion set above): the
-          # harness's record may carry the `claude` leaf's pid rather than the
-          # `bg-pty-host` wrapper's, so EVERY child `pgrep -P` listed is asked
-          # — named or not — and a match drops the whole pair. Terming the
-          # wrapper ends the companion with it.
-          dhp_is_comp_host=0
-          for dhp_c in $dhp_kids; do
-            case "$dhp_comp" in *" $dhp_c "*) dhp_is_comp_host=1; break ;; esac
-          done
-          if [ "$dhp_is_comp_host" = 0 ]; then
-            dhp_out="${dhp_out}${dhp_pid}${US}${dhp_child}${US}${dhp_id}
-"
-          fi
-          break
-      fi
-    done
-  done <<EOF
-$dhp_cand
-EOF
-  [ -n "$dhp_out" ] || return 8
-  printf '%s' "$dhp_out"
-}
-
-# THE `--resume` VALUE, READ WHOLE (opensoft/openRepoTools#76), for both of
-# `duplicate_holder_pids`' matches above. It sets `dhp_rv` in the caller's own
-# shell, never through `$( … )`, which would fork once per candidate, to the
-# value after the FIRST `--resume ` in a flattened, already-lowercased argv,
-# or to empty where there is no value it can name.
-#
-# `ps -o args=` JOINS THE ARGV WITH SPACES AND QUOTES NOTHING, so where one
-# argument ends is gone from the line this reads. Measured with procps on
-# Linux: `--resume "/home/Jane Doe/.claude/projects/p/<id>.jsonl"
-# --output-format stream-json` reads back as `--resume /home/Jane
-# Doe/.claude/projects/p/<id>.jsonl --output-format stream-json`. The cut this
-# replaced, `${v%% *}`, took `/home/jane` from that and matched nothing, so a
-# duplicate resumed from a home, profile or project directory with a space in
-# it was never found, and `lane-end`'s pre-kill recheck, which made the same
-# cut, would have withheld the TERM it is there to send.
-#
-# THE VALUE ENDS AT THE FIRST `.jsonl` THAT ENDS AN ARGUMENT, one followed by
-# a space or by the end of the line, because the transcript path a harness
-# resumes ends exactly there. That keeps both of PR #61's earlier guarantees:
-# Copilot round 5's `--resume /other.jsonl --label /<id>.jsonl` still reads
-# `/other.jsonl` and never this transcript, and round 4's `<id>.jsonl.bak`
-# is still not `<id>.jsonl`, because its `.jsonl` ends no argument.
-#
-# A WORD OPENING WITH `--` INSIDE IT IS A LATER OPTION, NOT A DIRECTORY, and a
-# value that holds one is EMPTY. `--resume <a bare session id> --x
-# /<id>.jsonl` has no `.jsonl` of its own to stop at, so the first one that
-# ends an argument is the later option's, and naming the process from it
-# would hand `lane-end --retire` a TERM for something that resumed another
-# session.
-#
-# A VALUE WITH A SPACE IN IT MUST BE ONE ABSOLUTE PATH, starting with `/` and
-# holding no ` /`, or it is EMPTY (Brett Heap's ruling of 2026-10-18 on PR
-# #205, "Add the condition first (Recommended)"). A value that does not itself
-# end in `.jsonl` runs on to the next `.jsonl` that ends an argument, so a
-# later plain word ending in `/<id>.jsonl` was read as its tail, where the cut
-# at the first space never read it at all. Five shapes did that: a bare
-# session id followed by a prompt that names the transcript (`--resume <id>
-# read /p/<id>.jsonl and summarise`, and `claude -p … --resume <id> summarise
-# /p/<id>.jsonl`), an empty argument before the path (`--resume ''
-# /p/<id>.jsonl`, which `ps` prints with two spaces), a `<id>.jsonl.bak`
-# followed by a word that names the transcript (`--resume /p/<id>.jsonl.bak
-# note /q/<id>.jsonl`), and a shell whose `-c` string resumes `$ID` and then
-# tails the transcript. Each of them starts with something other than `/`, or
-# reaches the later path through a space and a `/`, and a transcript path does
-# neither, whatever spaces its home, profile or project directory holds, save
-# a directory whose name ENDS in a space before its `/`, which puts a ` /`
-# inside the path, so it is refused (see the known limits below). A value with
-# no space in it is untouched by this, and reads as the cut read it.
-#
-# KNOWN LIMITS, and they are the flattening's rather than this read's. A
-# directory whose own name holds `.jsonl ` or ` --`, or ends in a space before
-# its `/`, is cut short or refused, which only ever misses. The one shape this
-# read can still mistake is narrower now: a value that starts with `/` but
-# does not itself end in `.jsonl`, followed by a later word that names
-# `<id>.jsonl` and does not begin with `/` (`--resume /p/<id>.jsonl.bak note
-# q/<id>.jsonl`, and likewise a word opening `~/`, `$HOME/`, `file:///`,
-# `path=/` or `(/`), which reaches it through no ` /`. Linux's
-# `/proc/<pid>/cmdline` keeps the argument boundaries and BSD/macOS has
-# nothing like it, so one portable reading of `ps`, the same on every
-# platform and under the suite's own fake `ps`, is kept over two that could
-# disagree. `lane-end` carries the same rule for its pre-kill recheck
-# (`dh_resume_value`), and the two must stay the same rule.
-dhp_resume_value() {   # <flattened argv, lowercased> — sets dhp_rv
-  dhp_rv=""
-  case "${1-}" in *"--resume "*) : ;; *) return 0 ;; esac
-  dhp_rv_rest="${1#*--resume }"
-  while :; do
-    case "$dhp_rv_rest" in *.jsonl*) : ;; *) dhp_rv=""; return 0 ;; esac
-    dhp_rv="${dhp_rv}${dhp_rv_rest%%.jsonl*}.jsonl"
-    dhp_rv_rest="${dhp_rv_rest#*.jsonl}"
-    case "$dhp_rv_rest" in "" | " "*) break ;; esac
-  done
-  case "$dhp_rv" in *" --"*) dhp_rv="" ;; esac
-  case "$dhp_rv" in *" "*)
-    case "$dhp_rv" in /*) : ;; *) dhp_rv="" ;; esac
-    case "$dhp_rv" in *" /"*) dhp_rv="" ;; esac
-  esac
-  return 0
-}
-
-# ------------------------------- decisions 6 and 7: THE LANE LISTING READ
-#
-# ONE READ, TWO LISTINGS. Decision 6 ratified the estate-wide `lanes`; decision
-# 7 ratified `restart`'s per-repo listing and `/restart`'s. All three are the
-# same rows with a different filter, so the filter is an argument here rather
-# than three implementations in three commands — the rule clause (h) already
-# gives `window-lane` and `session-lane`.
-#
-# READ-ONLY, out of `origin/<branch>` like every Amendment 7 read, and
-# `LANES_NO_FETCH=1` is honoured by the one `log_sync` its caller makes. It
-# never writes and never launches anything.
-#
-#   lanes_rows [--repo <owner/repo>] [--dir <path>] [--ws <ws>] [--all]
-#
-# `--repo` and `--dir` are decision 7's per-repo scope and they are an OR, not
-# an AND: "rows whose register `home` is this checkout's `origin`, OR whose
-# recorded `dir` is this checkout". That second half is a second use for clause
-# (c)'s `dir` and an argument for recording it, because a lane's home
-# repository and the checkout it sits in are not the same fact.
-#
-# Tab-separated, one line per lane, and the COLUMNS ARE THE DATA rather than a
-# rendering: `restart` and `lanes` lay them out, and a third caller that wants
-# a different shape does not need a fourth read.
-#
-#   <lane> <state> <workstation> <profile> <window> <last uuid> <dir>
-#   <objects> <age> <restart line> <home> <forks>
-#
-# THE FIRST TEN ARE CLAUSE (j)'s TEN, IN CLAUSE (j)'s ORDER (A11 Addendum 4
-# ruling 7): *"`lanes` and `restart` each render the subset of clause (j)'s ten
-# columns their surface needs while the read carries all ten."* Column 10 — the
-# restart line — used to be computed by each renderer, which is two
-# implementations of one column; it is the read's now, so the two surfaces
-# cannot disagree about which lane may be restarted or about what to type.
-#
-# `<home>` and `<forks>` are the read's own additions after the ten.
-# `<forks>` is decision 8(e): the count of LIVE forks of this lane's transcript
-# — a defect to retire, shown by both listings and never counted as a holder.
-#
-# Newest activity first, by the UTC of the lane's last lane-kind line. That is
-# a clock and it decides nothing but the ORDER OF A LISTING, which is the one
-# place a clock is allowed to: `swapped` ranks by landing order because a
-# launcher BINDS from its first row, and nothing binds from this one.
-# Every LIVE session id on this workstation with the window it is in, as
-# `<sessionId><US><tmux target><US><name><US><pid>`. ONE pass over the records
-# for the whole listing: `live_holder` answers about one lane and re-reads
-# every record to do it, which for a 48-row register is 48 scans of the same
-# directory.
-#
-# CACHED IN A FILE AND NOT IN A VARIABLE (A11 Addendum 4 ruling 12). Every
-# caller invokes this inside `$( … )`, which is a SUBSHELL — so the variable the
-# build set died with the build and the next lane rebuilt it, 564 records at a
-# time, 46 times for one listing. A file survives the subshell that wrote it.
-live_session_ids() {
-  lsi_c="${SE_CACHE_FILE:+$SE_CACHE_FILE.live}"
-  if [ -n "$lsi_c" ] && [ -f "$lsi_c" ]; then cat -- "$lsi_c"; return 0; fi
-  # ITS OWN STEP, FOR THE HERE-DOCUMENT'S SAKE, exactly as in `fork_map`: a
-  # session tree that could not be read is not a workstation with nothing live
-  # on it, and this answer decides the STATE column of every row a listing
-  # prints (#26, the review of `37632b1`).
-  lsi_recs=""; lsi_rc=0
-  lsi_recs="$(session_records)" || lsi_rc=$?
-  [ "$lsi_rc" = 0 ] || return 1
-  lsi_out=""
-  while IFS="$US" read -r lsi_f lsi_sid lsi_tmux lsi_name lsi_pid lsi_kind lsi_cwd lsi_status lsi_start; do
-    [ -n "${lsi_sid:-}" ] || continue
-    record_fields_are_session "$lsi_kind" || continue
-    record_fields_are_live "$lsi_status" "$lsi_pid" "$lsi_start" || continue
-    lsi_out="${lsi_out}${lsi_sid}${US}${lsi_tmux}${US}${lsi_name}${US}${lsi_pid}
-"
-  done <<EOF
-$lsi_recs
-EOF
-  if [ -n "$lsi_c" ]; then
-    printf '%s' "$lsi_out" > "$lsi_c.${BASHPID:-$$}" 2>/dev/null &&
-      mv -f -- "$lsi_c.${BASHPID:-$$}" "$lsi_c" 2>/dev/null ||
-      rm -f -- "$lsi_c.${BASHPID:-$$}"
-  fi
-  printf '%s' "$lsi_out"
-}
-
-# Every lane the register has a row for — the union with `known_lanes` is what
-# a listing shows, because a lane may have a row and no log (pre-cutover) or a
-# log and a row that has been closed.
-register_lanes() {
-  { register_text; archive_text; } | awk '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      print substr(rest, 1, p2 - 1)
-    }'
-}
-
-# ONE PASS OVER THE REGISTER FOR THE WHOLE LISTING (A11 Addendum 4 ruling 12).
-#   `<lane><US><workstation><US><session ids, lower-cased, space separated>`
-#
-# The four facts the listing wants from a row — is there a row, whose
-# workstation, which ids, which is last — were four separate reads per lane,
-# each of them `register_text | awk` and each therefore a render of the
-# published 1.1 MB register. This is the same three answers from one pass, and
-# the parsing is the SAME parsing: `ROW_AWK`'s first-backticked-token rule for
-# the name, `row_cell`'s "field k+1 because $1 is the empty string before the
-# leading pipe" for the cells, `lane_workstation`'s strip-at-the-first-slash for
-# the workstation, and `uuids_in_cell`'s shape match — restated here in awk
-# because a reader comparing the two must be able to see both.
-LANES_REGISTER_INDEX_AWK='
-    # THE STATE CELL IS THE SEVENTH, AND SIX ` | ` SEPARATORS ARE THE PROOF —
-    # `row_split_state_cell` in awk, for the same reason the three reads above
-    # are restated here: this pass already holds the row, and a second read of
-    # the same megabyte to ask what the cell says would cost the listing what
-    # ruling 12 spent this function to save. The rule is that files: split from
-    # the left, six separators or it is not knowable WHICH text is the state
-    # cell, and then the last piece is it. More than six returns EMPTY rather
-    # than a guess — the writer refuses that row outright, and a reader that
-    # picked one of the two readings would be filing a lane by the wrong text.
-    function cell_state(row,   body, rest, i, cnt) {
-      sub(/[ \t]+$/, "", row)
-      if (substr(row, 1, 1) != "|") return ""
-      if (substr(row, length(row), 1) != "|") return ""
-      body = substr(row, 1, length(row) - 1)
-      rest = body; cnt = 0
-      while (cnt < 6) {
-        i = index(rest, " | ")
-        if (i == 0) return ""
-        rest = substr(rest, i + 3)
-        cnt++
-      }
-      if (index(rest, " | ") > 0) return ""
-      return rest
-    }
-    function trim(t) { sub(/^[ \t]+/, "", t); sub(/[ \t]+$/, "", t); return t }
-    substr($0, 1, 1) != "|" { next }
-    {
-      p1 = index($0, "`"); if (p1 == 0) next
-      rest = substr($0, p1 + 1); p2 = index(rest, "`"); if (p2 == 0) next
-      lane = substr(rest, 1, p2 - 1)
-      n = split($0, c, "|")
-      ses = (n >= 3 ? c[3] : "")
-      ws  = (n >= 4 ? c[4] : "")
-      # COLUMN 4, `started (UTC)`, AS THE ROW SPELLS IT. The live register
-      # writes that column three ways — `2026-09-02`, `2026-09-04 ~15:30Z` and
-      # `2026-09-13T17:41Z` — and this carries the text, not an instant: the
-      # sweep prints it for a person to read, and `mig_started_utc` is the one
-      # place that turns it into a UTC.
-      started = (n >= 5 ? trim(c[5]) : "")
-      gsub(/\t/, " ", started)
-      sub(/^[ \t]+/, "", ws); sub(/[ \t]+$/, "", ws)
-      sub(/ *\/.*$/, "", ws)
-      sub(/[ \t].*$/, "", ws)
-      # `short_ws` IS `printf | tr`, TWO PROCESSES, and the listing ran it per
-      # lane to decide the workstation filter. It is one `sub` and a `tolower`
-      # here, in the pass that already has the value.
-      wss = tolower(ws); sub(/\..*$/, "", wss)
-      ids = ""; s2 = tolower(ses)
-      while (match(s2, /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/)) {
-        ids = ids substr(s2, RSTART, RLENGTH) " "
-        s2 = substr(s2, RSTART + RLENGTH)
-      }
-      sub(/ $/, "", ids)
-      # THE STATE CELL: ITS HEAD, AND THE WORDS A SWEEP MUST NOT PASS OVER
-      # SILENTLY (Amendment 19(b) and (c)). The head is what `lanes --closed`
-      # shows for a dormant row and what its `RETIRED` line carries as
-      # `was:`, so the row-s own last words survive the sweep that closes it;
-      # the flags are read from the WHOLE cell and not from the head, because
-      # the five words that matter — the work was unpushed, lost, a loss, owed,
-      # or the cell still says LIVE — sit at the end of cells thousands of
-      # characters long on the register this was written for.
-      # CUT BACK TO A SPACE: `substr` counts bytes in some awks and characters
-      # in others, and a cut mid-character would put half a `—` into a log line
-      # that is append-only. Dropping the last (possibly torn) word costs a word
-      # and can never do that.
-      #
-      # AND THESE TWO ARE A TABLE OF THEIR OWN (`--cells`), NEVER THE ONE THE
-      # LISTING SCANS PER LANE — ruling 12 again, measured. `table_lookup` walks
-      # the whole table for every lane, so a free-text field of up to 280
-      # characters per row is paid for N times: on a register of 132 rows one
-      # `lanes --prefix <repo>` went from 14 s to 42 s with `head` and `flags`
-      # in this table, which is what put the pick past the 60-second terminal
-      # case in CI. The four short facts every row needs stay here; the two long
-      # ones are asked for BELOW THE NARROWING FILTER and only for a row with no
-      # object log, which is the only row that has anything to say with them
-      # (Amendment 19(a)).
-      if (!cells) {
-        print tolower(lane) sep lane sep ws sep wss sep ids sep started
-        next
-      }
-      cell = cell_state($0)
-      # An invalid column boundary is NOT an empty state cell. Leave this row
-      # out of the cells index so the caller keeps it unclassified and visible.
-      if (cell == "") next
-      gsub(/\t/, " ", cell)
-      cell = trim(cell)
-      head = cell
-      if (length(head) > 280) {
-        head = substr(head, 1, 280)
-        sub(/[^ ]*$/, "", head)
-        head = trim(head)
-        if (head == "") head = substr(cell, 1, 200)
-        head = head " ..."
-      }
-      lcell = tolower(cell)
-      flags = ""
-      if (lcell ~ /(^|[^a-z])unpushed([^a-z]|$)/) flags = flags "unpushed,"
-      if (lcell ~ /(^|[^a-z])lost([^a-z]|$)/)     flags = flags "lost,"
-      if (lcell ~ /(^|[^a-z])loss([^a-z]|$)/)     flags = flags "loss,"
-      if (lcell ~ /(^|[^a-z])owe[sd]([^a-z]|$)/)  flags = flags "owes,"
-      if (lcell ~ /(^|[^a-z])live([^a-z]|$)/)     flags = flags "LIVE,"
-      sub(/,$/, "", flags)
-      # KEYED ON THE LANE NAME LOWER-CASED, because `lane_named_ci` is the rule
-      # everywhere else in this file: the register spells one lane three ways in
-      # a week, and the names this listing joins on come from the LOG files.
-      # (No apostrophe in this comment: the whole program is a single-quoted
-      # shell string, and one would end it.)
-      print tolower(lane) sep head sep flags
-    }'
-# `--local` READS THIS CHECKOUT'S REGISTER instead of the published one, which
-# is `session_ids_local_of_lane`'s source and is unioned with the published ids
-# for the same fail-closed reason that read gives: an id this checkout knows and
-# `origin/main` does not yet is one more reason to refuse, never to allow.
-# `--cells` IS THE OTHER HALF OF THE SAME PASS: `<lane>` and the state cell-s
-# head and flag words, and nothing else. It is a separate call because it is a
-# separate COST — see the awk above — and the listing asks for it only where a
-# row has no object log to speak for it.
-lanes_register_index() {   # [--local] [--cells]
-  lri_local=0; lri_cells=0
-  while [ $# -gt 0 ]; do
-    case "$1" in
-      --local) lri_local=1; shift ;;
-      --cells) lri_cells=1; shift ;;
-      *) break ;;
-    esac
-  done
-  if [ "$lri_local" = 1 ]; then
-    { cat -- "$LANES_FILE" 2>/dev/null || :
-      [ -f "$LANES_ARCH_FILE" ] && { cat -- "$LANES_ARCH_FILE" 2>/dev/null || :; }
-    } | awk -v sep="$US" -v cells="$lri_cells" "$LANES_REGISTER_INDEX_AWK" 2>/dev/null
-  else
-    { register_text; archive_text; } | awk -v sep="$US" -v cells="$lri_cells" "$LANES_REGISTER_INDEX_AWK"
-  fi
-}
-
-# SCOPE, AFTER A11 Addendum 4 RULING 6 (ratified "a11 addendum 4 yes", ruling 6
-# = NO to the workstation-scoped default):
-#
-#   default   EVERY lane the register and the logs know — clause (j) as
-#             written. It used to be this workstation's, and that was never in
-#             the contract: `window-lane` is scoped and the contract says so at
-#             length (`R-A11-8`/RV-T7); this read is not. "List the lanes" on a
-#             two-workstation estate means both.
-#   --here    this workstation only. The old default, kept as an OPTION.
-#   --ws <n>  a named workstation only, which implies the same narrowing.
-#   --all     no narrowing of any kind: it CLEARS `--repo`, `--dir`, `--prefix`
-#             and `--here`, so a caller that has narrowed can undo it in one
-#             word. That is what the settlement means by "`--all` forces the
-#             every-lane listing".
-#
-# `--prefix <repo>` is the LABEL fallback and nothing more: a lane whose log
-# records NEITHER a home NOR a directory cannot be filed by either, and its
-# name's `<repo>-` prefix is the only thing left. Amendment 7 calls that prefix
-# a label rather than a fact, so it is used ONLY where the two facts are absent
-# — never to override a home that disagrees with it, which is the case
-# `openRepoTools#28` says must be SAID rather than filed twice.
-lanes_rows() {
-  lr_repo=""; lr_dir=""; lr_ws="$WS"; lr_here=0; lr_all=0; lr_one=""; lr_prefix=""
-  lr_closed=0
-  while [ $# -gt 0 ]; do
-    case "$1" in
-      --repo)   lr_repo="${2-}";   shift 2 || return 64 ;;
-      --dir)    lr_dir="${2-}";    shift 2 || return 64 ;;
-      --prefix) lr_prefix="${2-}"; shift 2 || return 64 ;;
-      --ws)     lr_ws="${2-}"; lr_here=1; shift 2 || return 64 ;;
-      --lane)   lr_one="${2-}";    shift 2 || return 64 ;;
-      --here)   lr_here=1; shift ;;
-      --all)    lr_all=1; shift ;;
-      # AMENDMENT 19(b) — `--closed` ADDS the CLOSED and the DORMANT rows, and
-      # it COMBINES with everything rather than replacing it: with `--all` it is
-      # every repository-s closed lanes, with `--here` this workstation-s. So it
-      # is deliberately NOT cleared by the `--all` reset below, which exists to
-      # undo a NARROWING; this flag widens.
-      --closed) lr_closed=1; shift ;;
-      *) return 64 ;;
-    esac
-  done
-  # `--all` LAST AND ABSOLUTE, whatever order the flags arrived in — AND THAT
-  # INCLUDES `--lane`, which this reset used to leave standing (#26, the review
-  # of `c3ebcfe`). `--lane <name>` is the narrowest selector there is: the block
-  # below it sets `lr_names` to that one name and clears the other four filters
-  # for itself, so `lanes --all --lane X` answered about ONE lane under the flag
-  # that means every lane. The sentence above it has said "absolute" since it was
-  # written; this is the code catching up with it, and it is the same defect the
-  # wrapper's own `here_repo` had one file up (`lanes:143`, taken at `2f44da0`).
-  if [ "$lr_all" = 1 ]; then lr_repo=""; lr_dir=""; lr_prefix=""; lr_here=0; lr_one=""; fi
-  [ -n "$lr_dir" ] && lr_dir="$(cd -- "$lr_dir" 2>/dev/null && pwd -P || printf '%s' "$lr_dir")"
-  # ONE LANE, WITHOUT SCANNING THE ESTATE. `lane <name>` needs one row's
-  # `profile` and nothing else, and building the whole listing for it would walk
-  # every log, every row and every live session record on the workstation to
-  # answer a question about one lane. Same rows, same columns, same code.
-  # EACH NAME CARRIES ITS OWN LOWER-CASED KEY, emitted by the pass that already
-  # computes it for the de-duplication: the three lookups below join on that key
-  # and `lc` is two processes (ruling 12).
-  if [ -n "$lr_one" ]; then
-    lr_names="$(printf '%s\n' "$lr_one" | awk -v sep="$US" 'NF { print tolower($0) sep $0 }')"
-    lr_here=0; lr_repo=""; lr_dir=""; lr_prefix=""
-  else
-    # THE REGISTER FIRST, AND THAT IS AMENDMENT 15 (it was the logs first).
-    # The de-duplication has always been on the name LOWER-CASED, so for a lane
-    # both sources know it is the FIRST source that decides which spelling the
-    # listing prints — and the amendment says the register row's spelling is the
-    # canonical one. Read the other way round, a lane whose log file predates
-    # its row's spelling was listed under the file name, and column 10's
-    # line that binds the lane offered that spelling back to the reader.
-    lr_names="$( { register_lanes 2>/dev/null || :; known_lanes 2>/dev/null || :; } | awk -v sep="$US" 'NF && !seen[tolower($0)]++ { print tolower($0) sep $0 }')"
-  fi
-  [ -n "$lr_names" ] || return 8
-  # ONE PASS OVER EVERY LANE'S EVENTS, NOT ONE READ PER LANE PER FIELD.
-  # `lanes` asks about every lane the register and the logs know, and this loop
-  # used to make a `git show` of each lane's log — and then a fork per sub-field
-  # on top. Measured on the live register: 24 s for a listing that shows ONE
-  # row, because the cost was the 74 lanes it filtered OUT. `state_events` is
-  # the stream every other state read in this file is built on, it is already
-  # cached for the life of the process, and `lane_row_facts` turns it into one
-  # line per lane carrying the six facts a row needs — `payload_subfield`'s two
-  # rules and `home_of_lane`'s one, applied in the same awk that parses.
-  # `--lane` READS ONE LOG, NOT THE ESTATE'S. `lane <name>` asks for one
-  # lane's profile and nothing else, and `state_events` is a `git show` per log
-  # file — nine seconds on the live register. The same parser over the same
-  # grammar either way, so the two answers cannot differ.
-  if [ -n "$lr_one" ]; then
-    lr_facts="$(lane_log_events "$lr_one" 2>/dev/null | lane_row_facts)"
-  else
-    lr_facts="$(state_events 2>/dev/null | lane_row_facts)"
-  fi
-  # AND A PUBLISHED LOG THAT COULD NOT BE READ IS NOT A LANE WITH NO LOG (#138
-  # item 11). A lane absent from the facts is DORMANT below, and a log whose
-  # `git show` failed gave no lines; `remote_log_events` names each such log,
-  # and those lanes are fenced out of the class here. Without the warnings file
-  # (no temporary file could be made) no read can be told from a failed one, so
-  # no row is classed dormant at all.
-  lr_unread=" "; lr_unread_ok=1; lr_unread_paths=""
-  if [ -z "$lr_one" ] && [ -z "$LANES_IDX_DIR" ]; then
-    if [ -n "$SE_WARN_FILE" ]; then
-      lr_unread_paths="$(sed -n -e 's/^lanes-edit: unreadable log: \(.*\) — git could not read it.*$/\1/p' "$SE_WARN_FILE" 2>/dev/null)"
-      lr_unread=" $(printf '%s\n' "$lr_unread_paths" | awk 'NF { n = $0; sub(/^.*\//, "", n); sub(/\.md$/, "", n); print tolower(n) }' | tr '\n' ' ')"
-    else
-      lr_unread_ok=0
-    fi
-  fi
-  [ -z "$lr_unread_paths" ] ||
-    note "these published logs could not be read, so no lane of theirs is classed DORMANT: $(printf '%s\n' "$lr_unread_paths" | tr '\n' ' ')"
-  [ "$lr_unread_ok" = 1 ] ||
-    note "no temporary file could be made for the read's warnings, so whether any published log failed to read is not known, and no row is classed DORMANT here."
-  # AND A REGISTER THAT COULD NOT BE READ IS SAID, ONCE (the re-review of #230).
-  # Every row above came out of `register_text`, which drops the status
-  # `register_text_checked` keeps (#67), and a published register git cannot
-  # read renders as no text, so those rows simply vanished — and the sweep
-  # counted none of them. The class is withheld, which `lane-end` refuses on. A
-  # read that succeeds fills the cache every later read here takes, so the
-  # check costs one render.
-  lr_reg_ok=1
-  register_text_checked >/dev/null 2>&1 || lr_reg_ok=0
-  [ "$lr_reg_ok" = 1 ] ||
-    note "the register ($LANES_PATH, published or this checkout's) could not be read, so its rows are not in this listing, and no row is classed DORMANT here."
-  # THE REGISTER AND THE LIVE RECORDS, EACH READ ONCE FOR THE WHOLE LISTING
-  # (ruling 12). Both were per-lane before, and `live_session_ids` was rebuilt
-  # from 564 session records for every one of them.
-  # THE THREE TABLES, FENCED FOR AN IN-SHELL LOOKUP (ruling 12). `tr` turns each
-  # newline into `$GS` once, and `table_lookup` then finds any lane's line with
-  # one parameter expansion — instead of `printf | awk` per lane per table,
-  # which for fifty lanes was a hundred and fifty processes spent reading
-  # strings this shell was already holding.
-  # AN ARCHIVE THAT CANNOT BE READ IS SAID, NOT SWALLOWED (Copilot round 2 on
-  # #93). The two pipelines below end in `awk`, whose status is its own, so a
-  # failed `archive_text` inside them is invisible — and what goes missing is
-  # the CLOSED rows the archive holds. A listing may not refuse (it sits in
-  # front of a launch), so it says it, exactly as it says a session-record read
-  # that failed; the POSITION is the half that must not guess, and
-  # `lane_next_free` refuses there rather than offering one over a partial read.
-  if ! archive_text >/dev/null 2>&1; then
-    note "$LANES_ARCH_PATH exists and could not be read, so the RETIRED rows it holds are not in this listing — and \`next-free\` will refuse a position rather than offer one over a partial read."
-  fi
-  lr_index="$GS$(lanes_register_index 2>/dev/null | tr '\n' "$GS" || :)"
-  # THE CELLS ARE BUILT ON FIRST USE AND NOT BEFORE (see `lanes_register_index
-  # --cells`): a listing whose every row has an object log never asks for them,
-  # and the two passes that build them are two `awk`s over a register this
-  # function has already rendered once.
-  lr_cells=""; lr_lcells=""; lr_cells_built=0
-  lr_local_index="$GS$(lanes_register_index --local 2>/dev/null | tr '\n' "$GS" || :)"
-  lr_facts_t="$GS$(printf '%s\n' "$lr_facts" | tr '\n' "$GS")"
-  # THE LIVE SCAN, AND WHAT A LISTING DOES WHEN IT FAILS (#26, the review of
-  # `37632b1`). NOT a refusal: this listing is the read a person makes IN FRONT
-  # OF A LAUNCH, and `43b6320`'s rule for the fetch is the rule here — it
-  # answers, and says what it could not establish. What it must never do is
-  # print a lane's log verb as its STATE in silence, because a lane that is
-  # LIVE then shows as IDLE or PAUSED and the row offers the `restart` line that
-  # would start a second session on it. The collision itself is still refused
-  # one surface along: `lane-start`'s own `live_holder` reads these same records
-  # DIRECTLY and exits 1 where they cannot be read.
-  lr_live_rows=""; lr_live_rc=0
-  lr_live_rows="$(live_session_ids 2>/dev/null)" || lr_live_rc=$?
-  lr_fork_rc=0
-  lr_live_fence=" $(printf '%s\n' "$lr_live_rows" | awk -F"$US" 'NF { print tolower($1) }' | tr '\n' ' ')"
-  lr_ws_short="$(short_ws "$lr_ws")"
-  lr_now="$(date -u +%s)"
-  # AMENDMENT 18(b), FOR THE PARTITION — computed ONCE for the whole listing,
-  # because `lc` is two processes and this is asked of every lane. The row
-  # carries the BINDING-s host and container (lower-cased by the awk above) and
-  # this is what they are compared against.
-  LANES_HOST_LC="$(lc "$LANES_HOST_NAME")"
-  LANES_WS_LC="$(lc "$WS")"
-  LANES_CONTAINER_LC="$(lc "$LANES_CONTAINER_NAME")"
-  # AND THE TWO NARROWING FILTERS' OWN SIDES, for the same reason: `--repo` and
-  # `--prefix` do not change from one lane to the next, and the loop below asked
-  # `lc` for both of them again for every lane in the estate (#107). The lane's
-  # side is per lane and goes through `lower_into`, which is `lc` without a fork.
-  lr_repo_lc=""; [ -z "$lr_repo" ] || lr_repo_lc="$(lc "$lr_repo")"
-  lr_prefix_lc=""; [ -z "$lr_prefix" ] || lr_prefix_lc="$(lc "$lr_prefix")"
-  # ONLY A LANE THE FORK MAP NAMES CAN HAVE A FORK (ruling 12). `lane_forks`
-  # stays the ONE implementation of what a fork is and what disqualifies one;
-  # this simply declines to ask it about the forty-five lanes of this estate
-  # that no live transcript is titled for, each of which cost a subshell, a
-  # `cat` of the map and a `grep` to be told nothing.
-  lr_fork_map=""
-  lr_fork_map="$(fork_map 2>/dev/null)" || lr_fork_rc=$?
-  lr_fork_titles=" $(printf '%s\n' "$lr_fork_map" | awk -F"$US" 'NF { print $1 }' | tr '\n' ' ')"
-  # THE LOG FILES THIS CHECKOUT HAS, LOWER-CASED, AS ONE FENCE (Copilot round 4
-  # on #93). `state_events` reads the PUBLISHED logs (R19), so a log committed
-  # here and not yet pushed is not in the facts pass at all — and DORMANT is
-  # "no object log", which that lane has. The sweep reads the local log for
-  # exactly this reason since round 3, and the read and the writer may not
-  # disagree about the amendment's own condition. One `ls` for the whole
-  # listing, matched with a `case` per lane, and lower-cased because a lane name
-  # is ONE name under any case (Amendment 15).
-  # AND A DIRECTORY THAT IS THERE AND CANNOT BE LISTED IS NOT ONE WITH NO LOG IN
-  # IT (#138 item 4): the fence would be empty and a lane whose only log is here
-  # classed DORMANT. It is said, and no row is classed dormant over it below.
-  lr_logfiles=""; lr_logs_rc=0
-  if [ -e "$LANES_LOG_DIR" ]; then
-    lr_logfiles="$(ls -- "$LANES_LOG_DIR" 2>/dev/null)" || lr_logs_rc=1
-  fi
-  lr_logfiles=" $(printf '%s\n' "$lr_logfiles" | awk '{ print tolower($0) }' | tr '\n' ' ')"
-  [ "$lr_logs_rc" = 0 ] ||
-    note "$LANES_LOG_DIR exists and could not be listed, so whether a row has a log this checkout has and origin has not is not known, and no row is classed DORMANT here. Fix the read and re-run before sweeping."
-  if [ "$lr_live_rc" != 0 ] || [ "$lr_fork_rc" != 0 ]; then
-    note "this workstation's session records could not be read, so the STATE column below is the LOG's verb alone: a lane that is live may show as IDLE or PAUSED here, and no fork of any lane is established either way. Fix the read and re-run before acting on a restart line."
-  fi
-  lr_out=""
-  while IFS="$US" read -r lr_ll lr_l; do
-    [ -n "$lr_l" ] || continue
-    lr_verb=""; lr_utc=""; lr_w=""; lr_d=""; lr_pf=""; lr_win=""; lr_home=""; lr_logsid=""; lr_obj=""
-    # DOES THIS LANE HAVE AN OBJECT LOG AT ALL? `lane_row_facts` emits a line
-    # for every lane whose log carries one of Amendment 7-s five lane verbs, so
-    # this lookup — which the listing makes anyway — is the answer, and
-    # Amendment 19(a)-s DORMANT is built on it below.
-    lr_lanekind=0
-    lr_bhost=""; lr_bcont=""; lr_blegacy=""
-    if table_lookup "$lr_facts_t" "$lr_ll"; then
-      lr_lanekind=1
-      IFS="$US" read -r lr_fl lr_verb lr_utc lr_w lr_d lr_pf lr_win lr_home lr_logsid lr_obj \
-        lr_bhost lr_bcont lr_blegacy <<EOF2
-$LOOKUP_OUT
-EOF2
-    fi
-    # THE ROW'S THREE FACTS, OUT OF THE ONE PASS: is there a row at all, whose
-    # workstation it names, and which transcript uuids its session cell carries.
-    # AND ITS `started` CELL (Amendment 19(b)), which `--closed` prints for a
-    # CLOSED row as well as a dormant one and which is a date rather than free
-    # text. Its state cell's HEAD and FLAGS are NOT here — they are the one
-    # table this loop does not walk per lane, and they are fetched below the
-    # narrowing filter for the rows that have no log to speak for them.
-    lr_ixl=""; lr_rw=""; lr_rws=""; lr_ids_sp=""; lr_start=""; lr_was=""; lr_flags=""
-    if table_lookup "$lr_index" "$lr_ll"; then
-      IFS="$US" read -r lr_ixl lr_rw lr_rws lr_ids_sp lr_start <<EOF2
-$LOOKUP_OUT
-EOF2
-    fi
-    lr_lixl=""; lr_lrw=""; lr_lrws=""; lr_lids_sp=""; lr_lstart=""; lr_lwas=""; lr_lflags=""
-    if table_lookup "$lr_local_index" "$lr_ll"; then
-      IFS="$US" read -r lr_lixl lr_lrw lr_lrws lr_lids_sp lr_lstart <<EOF2
-$LOOKUP_OUT
-EOF2
-    fi
-    # THE PUBLISHED ROW-S WORDS WIN AND THIS CHECKOUT-S ANSWER ONLY FILLS IN
-    # (R19): a row this checkout has added and not yet pushed has no published
-    # text at all, and showing nothing about it would hide the newest row on the
-    # workstation that made it.
-    [ -n "$lr_start" ] || lr_start="$lr_lstart"
-    # THE REGISTER'S OWN WORKSTATION COLUMN WINS where the row has one: it is
-    # what every other read in this file compares, and a lane may have a row
-    # here and its last log line from another machine.
-    [ -n "$lr_rw" ] && lr_w="$lr_rw"
-    if [ "$lr_here" = 1 ] && [ -n "$lr_w" ]; then
-      lr_wcmp="$lr_rws"; [ -n "$lr_wcmp" ] || lr_wcmp="$(short_ws "$lr_w")"
-      [ "$lr_wcmp" = "$lr_ws_short" ] || continue
-    fi
-    lr_row="$lr_ixl"
-    if [ -n "$lr_home" ]; then
-      lr_hc="$(alias_lookup "$lr_home" 2>/dev/null || :)"
-      [ -n "$lr_hc" ] && lr_home="$lr_hc"
-    fi
-    if [ -n "$lr_repo" ] || [ -n "$lr_dir" ] || [ -n "$lr_prefix" ]; then
-      lr_keep=0
-      if [ -n "$lr_repo" ] && [ -n "$lr_home" ]; then
-        lower_into "$lr_home"
-        [ "$LOWER_OUT" = "$lr_repo_lc" ] && lr_keep=1
-      fi
-      [ -n "$lr_dir" ]  && [ -n "$lr_d" ]    && [ "$lr_d" = "$lr_dir" ] && lr_keep=1
-      # THE LABEL, AS A THIRD OR-TERM. Amendment 7 calls a lane name's
-      # `<repo>-` prefix a LABEL rather than a fact, and the home is what FILES
-      # a lane — but a listing is asked "which lanes are this repository's", and
-      # two populations answer that and are missed by home and `dir` alike:
-      #   * a lane with a ROW AND NO LOG, which this estate has, whose home and
-      #     directory are simply not recorded anywhere yet;
-      #   * a lane a person NAMED for this repository whose log records a
-      #     different home — the disagreement `openRepoTools#28` says to SAY
-      #     rather than resolve, and still a position `lane-start <repo> <n>`
-      #     cannot hand out twice.
-      # It never overrides a home: a lane matched only by its label is LISTED,
-      # not re-homed.
-      if [ "$lr_keep" = 0 ] && [ -n "$lr_prefix" ]; then
-        lower_into "$lr_l"
-        case "$LOWER_OUT" in "$lr_prefix_lc"-*) lr_keep=1 ;; esac
-      fi
-      [ "$lr_keep" = 1 ] || continue
-    fi
-    # FAILING THE CELL, THE LANE'S OWN LOG — clause (d) rule 3, out of the same
-    # one pass rather than a second read of the same stream.
-    lr_sid="${lr_ids_sp##* }"
-    [ -n "$lr_sid" ] || lr_sid="$lr_logsid"
-    # THE STATE. A live record naming one of the lane-s ids beats the log-s
-    # own last verb, because a lane whose session is running is LIVE whatever
-    # its last written line says; otherwise the verb answers.
-    #
-    # A `case` OVER A SPACE-FENCED STRING, AND NOT A `grep` PER RECORD (ruling
-    # 12): this ran `printf | grep -qx` once for every live record for every
-    # lane. The fence is built once above; the lookup of the WINDOW is an awk,
-    # and it only happens for a lane that is actually live.
-    # THE IDS OF BOTH ROWS, AND THAT IS FAIL-CLOSED (Copilot round 1 on #93).
-    # The published cell is R19's source for everything else here, but a lane
-    # whose `append-session-id` has landed in THIS checkout and not yet been
-    # pushed has its current transcript in the local row alone — and
-    # `live_session_ids` can see that very session running. Read from the
-    # published cell only, such a lane is not LIVE, which under Amendment 19(a)
-    # makes it DORMANT: hidden from the listing and offered to the sweep while
-    # somebody is working in it. Both sets are asked, and either one naming a
-    # live record is LIVE.
-    lr_state=""
-    lr_live_win=""
-    for lr_one_id in $lr_ids_sp $lr_lids_sp; do
-      case "$lr_live_fence" in
-        *" $lr_one_id "*)
-          lr_state=LIVE
-          lr_live_win="$(printf '%s\n' "$lr_live_rows" | awk -F"$US" -v i="$lr_one_id" 'tolower($1) == i { print $2; exit }')"
-          break ;;
-      esac
-    done
-    if [ -n "$lr_live_win" ]; then
-      lr_win="$lr_live_win"
-    elif [ -n "$lr_win" ]; then
-      # SPEC rev 4 §15 column 5: the window is marked `gone` where the ref no
-      # longer resolves. After a tmux server restart that is EVERY recorded
-      # window on the workstation — measured on Eagle at 15:5xZ on 2026-09-13,
-      # 0 of 5 — and a column that showed a dead ref as though it were live is
-      # the column a person would try to attach to.
-      lr_wref="${lr_win%% *}"
-      [ -n "$(tmux_window_field "$lr_wref" '#{window_id}' 2>/dev/null || :)" ] || lr_win="$lr_win (gone)"
-    fi
-    if [ -z "$lr_state" ]; then
-      case "$lr_verb" in
-        PAUSED)  lr_state=PAUSED ;;
-        ENDED)   lr_state=ENDED ;;
-        RETIRED) lr_state=RETIRED ;;
-        STARTED|RESUMED) lr_state=IDLE ;;
-        *)       lr_state="$([ -n "$lr_row" ] && printf 'NO LOG' || printf 'UNKNOWN')" ;;
-      esac
-    fi
-    # THE STATE CELL-S HEAD AND FLAGS, FOR THE ROWS THEY ARE ABOUT — a row with
-    # NO OBJECT LOG (Amendment 19(a)). It is the only row whose cell is all the
-    # listing has: one with a log has the log, and `lanes` prints neither field
-    # for it. The lookup is HERE, below the narrowing filter, because a row this
-    # listing is not showing is a row it may not pay for — and it walks a table
-    # of its own rather than the one above, which every lane in the estate walks
-    # once (ruling 12: the measurement is in `LANES_REGISTER_INDEX_AWK`).
-    #
-    # AND A ROW THE CELLS PASS DID NOT SEE IS NOT A ROW WITH NO CELL. The two
-    # passes read ONE register text, so every row in the table above is in this
-    # one; a row in the first and not the second is a read that answered
-    # differently the second time, and an EMPTY cell read as an answer would
-    # make `mig_cell_is_phrase` false and class the row DORMANT — hiding a row
-    # whose cell may say PAUSED and offering it to the sweep, which is the one
-    # thing 13(a) is in this rule for. `lr_cellrow` carries whether the pass saw
-    # it, and the class below is not decided without it (Amendment 7(d), the
-    # same posture round 3 gave the liveness read). It is the PUBLISHED pass
-    # that carries it, because the published row is the only one the class is
-    # ever decided on — `lr_row` is `lr_ixl` and a row this checkout alone has
-    # is in no class either way.
-    lr_cellrow=0
-    if [ "$lr_lanekind" = 0 ] && [ -n "$lr_ixl$lr_lixl" ]; then
-      if [ "$lr_cells_built" = 0 ]; then
-        lr_cells="$GS$(lanes_register_index --cells 2>/dev/null | tr '\n' "$GS" || :)"
-        lr_lcells="$GS$(lanes_register_index --local --cells 2>/dev/null | tr '\n' "$GS" || :)"
-        lr_cells_built=1
-      fi
-      if table_lookup "$lr_cells" "$lr_ll"; then
-        lr_cellrow=1
-        IFS="$US" read -r lr_was lr_flags <<EOF2
-$LOOKUP_OUT
-EOF2
-      fi
-      if table_lookup "$lr_lcells" "$lr_ll"; then
-        IFS="$US" read -r lr_lwas lr_lflags <<EOF2
-$LOOKUP_OUT
-EOF2
-      fi
-      [ -n "$lr_was" ]   || lr_was="$lr_lwas"
-      [ -n "$lr_flags" ] || lr_flags="$lr_lflags"
-    fi
-    # ------- AMENDMENT 19(a): THE TWO STATES BELOW PARKED, AND WHO IS IN THEM
-    #
-    # CLOSED is a lane whose own log has FINISHED — its last lane-kind line is
-    # `ENDED` or `RETIRED`, which is exactly what the block above has just put
-    # in `lr_state`. DORMANT is a row with NO OBJECT LOG and no live session
-    # here: the fourteen rows of openxFactory that ran before Amendment 7 gave
-    # every lane a log, that no `lane-end` can close because it wants a live
-    # session or a log to write into, and that sat at the top of every `lanes`
-    # while the next free position was read past them.
-    #
-    # "NO OBJECT LOG" IS ASKED OF THE FACTS TABLE AND NOT OF THE FILESYSTEM:
-    # `lr_lanekind` is that lookup, made once at the top of this loop, where a
-    # `git cat-file` per lane would have the listing pay for the whole estate to
-    # answer about the rows it is going to hide.
-    #
-    # AND THE REGISTER-S OWN CLAIM IS HONOURED (Amendment 13(a): the row says
-    # where a lane IS, in one line). A cell that is the phrase and whose state
-    # word is neither `ENDED`, `RETIRED` nor the migration-s `MIGRATED` says the
-    # lane is somewhere — PAUSED, LANDING, HANDED OFF — and hiding that row
-    # would hide a lane a person can still pick up, which is the opposite of
-    # what this amendment is for. It is the one way a row with no log is NOT
-    # dormant, and `mig_cell_is_phrase` is the same test the migration makes of
-    # the same cell rather than a second reading of it.
-    lr_class=""
-    case "$lr_state" in
-      ENDED|RETIRED) lr_class=closed ;;
-      LIVE) : ;;
-      *)
-        # AND NEVER OVER A LIVENESS READ THAT FAILED (Copilot round 3 on #93).
-        # DORMANT is "no object log AND no live session on this workstation";
-        # where the session records could not be read, the second half was never
-        # established, and hiding the row on it would hide a lane somebody may
-        # be working in. The listing already SAYS the read failed (one screen
-        # up); this is what it does about it — leaves the class unset, so the
-        # row stays listed and the sweep is never offered it.
-        if [ -n "$lr_row" ] && [ "$lr_lanekind" = 0 ] && [ "$lr_live_rc" = 0 ] &&
-           [ "$lr_cellrow" = 1 ] && [ "$lr_logs_rc" = 0 ] && [ "$lr_unread_ok" = 1 ] &&
-           [ "$lr_reg_ok" = 1 ]; then
-          lr_class=dormant
-          # A LOG THIS CHECKOUT HAS AND `origin` HAS NOT IS STILL AN OBJECT LOG,
-          # AND SO IS ONE `origin` HAS AND GIT COULD NOT READ (item 11).
-          case "$lr_logfiles" in
-            *" $lr_ll.md "*) lr_class="" ;;
-          esac
-          case "$lr_unread" in
-            *" $lr_ll "*) lr_class="" ;;
-          esac
-          if mig_cell_is_phrase "$lr_was"; then
-            case "${lr_was%% · *}" in
-              ENDED|RETIRED|MIGRATED) : ;;
-              *) lr_class="" ;;
-            esac
-          fi
-        fi ;;
-    esac
-    # NEITHER IS LISTED BY DEFAULT (clause (b)) and `--closed` adds them back.
-    # `--lane <name>` IS NEVER FILTERED: it is the narrowest selector there is
-    # and its caller has NAMED the lane, so a closed lane asked about by name
-    # answers about itself instead of reading as a lane that does not exist —
-    # which is what `lane <name>`, `lane-start` and the handoff would all have
-    # been told by an empty answer.
-    if [ -n "$lr_class" ] && [ "$lr_closed" = 0 ] && [ -z "$lr_one" ]; then continue; fi
-    # THE ROW'S OWN STATE, WHERE THE LOG HAS NONE TO GIVE (#89, out of the
-    # suppressed comments of Copilot's review of #82). Amendment 13(a) makes the
-    # state cell the lane's CURRENT STATE, and `migrate-state-cells` leaves
-    # exactly that behind: the phrase in the cell and, in the log, NOTED lines
-    # and no lane-kind line at all. So the STATE above said `NO LOG` over a cell
-    # saying `PAUSED`, and the one column the amendment exists to make
-    # authoritative was the one column this listing did not consult. Where the
-    # log gave no answer and `mig_cell_is_phrase` proves the cell is the phrase
-    # — the same test the migration and the class above make of the same cell —
-    # the STATE is the cell's word with ` (row)` after it.
-    #
-    # ` (row)` IS PART OF THE WORD, AND THAT IS THE POINT: the word is SHOWN and
-    # never bound. A row with no lane-kind line records no directory, no profile
-    # and no binding, so there is nothing for `lane` to resume — and every
-    # reader that keys on the log's own `PAUSED` (column 10 below, `lane_groups`,
-    # the `bind it:` line of `lanes`) passes this word by without a change of
-    # its own. `lane_groups` files it `rowonly`, and `lane` refuses that group by
-    # name rather than launching on a word no log wrote.
-    #
-    # FOUR WORDS STAY `NO LOG`. `ENDED`, `RETIRED` and the migration's
-    # `MIGRATED` are the cells of Amendment 19(a)'s DORMANT rows, which 19(b)
-    # shows as `NO LOG` with that cell's head on a line of its own. And `LIVE` is
-    # the one case that is NOT symmetric: a cell cannot prove a session is
-    # running, only a live record can, and the read above has already been
-    # asked — a row it did not find live whose cell still says `LIVE` is the row
-    # column 17 flags, and a STATE column saying so would tell a person a lane
-    # is running that nothing has proved is.
-    #
-    # BELOW THE CLASS, ON PURPOSE: the cell is read only for a row with no object
-    # log and only below the narrowing filter (ruling 12), and the class is the
-    # LOG's question, decided on the log's answer before this changes the word.
-    if [ "$lr_state" = 'NO LOG' ] && mig_cell_is_phrase "$lr_was"; then
-      case "${lr_was%% · *}" in
-        LIVE | ENDED | RETIRED | MIGRATED) : ;;
-        *) lr_state="${lr_was%% · *} (row)" ;;
-      esac
-    fi
-    [ -n "$lr_obj" ] || lr_obj="none open"
-    lr_age="$([ -n "$lr_utc" ] && age_of "$lr_utc" "$lr_now" || printf 'age unknown')"
-    # THE TWO SETS `lane_forks` WOULD OTHERWISE RE-READ THE REGISTER FOR, handed
-    # to it out of the one pass this loop already made (ruling 12) — and asked
-    # at all only where a live transcript carries this lane's title.
-    lr_fk=0
-    case "$lr_fork_titles" in
-      *" $lr_ll "*)
-        lr_fk="$(lane_forks "$lr_l" " $lr_ids_sp $lr_lids_sp " 2>/dev/null | grep -c . || :)"
-        case "$lr_fk" in ''|*[!0-9]*) lr_fk=0 ;; esac ;;
-    esac
-    # `none` AND NEVER A DASH, because three of these columns are `none` on
-    # this estate until adoption act 7 cuts each lane over — `profile`,
-    # `directory` and the `<@id>` half of `window` all come from records written
-    # under clause (c), and 0 of the 5 swap records on Eagle carry any of them.
-    # A word a reader can act on beats a glyph they have to interpret.
-    # COLUMN 10 — THE LINE THAT BINDS THE LANE — IS THE READ'S AND NOT A
-    # RENDERER'S (A11 Addendum 4 ruling 7). Clause (j) gives TEN columns in
-    # order and this carried nine; `lanes` computed the tenth and `restart`
-    # computed a different tenth, which is two implementations of one column and
-    # is how they would come to disagree about which lane may be restarted.
-    #
-    # THE WORD IS `lane <name>` (Amendment 18 Addendum 2, ratified
-    # 2026-09-14T16:50:32Z verbatim "ratify"): `restart` is no longer a command
-    # a person is given, and `lane <name>` is the same act — the launcher's
-    # path, the lane's own recorded directory and profile, asking nothing —
-    # plus the pick, the attach and the elsewhere branch. A column naming a word
-    # that is not on the person's PATH is a column they cannot type.
-    #
-    # A PAUSED LANE ONLY (clause (j) column 10, F-X20), and a PAUSED lane whose
-    # record carries NO `profile` gets the form that works today with the
-    # profile named as the one token the operator must supply — because a wrong
-    # profile is a launch into another account and nothing here may guess one,
-    # while a line that cannot be typed is worse than a column that says
-    # `none`. Every other state gets `none`: a lane whose last act was its last
-    # is not a lane a person restarts.
-    #
-    # AND A **LIVE** LANE'S ONE ACT IS THE ATTACH, FILLED IN (Amendment 18
-    # clause (i), refined on the question Brett Heap asked 2026-09-14T13:47Z —
-    # verbatim *"how do i start claude with that profile and that lane? do i use
-    # lane command?"*, about a lane live in a DETACHED tmux session, where the
-    # listing named the session and no act). A live lane is never started a
-    # second time: clause (h) is one live process per transcript, and a
-    # `lane-start` or a `pclaude` on a running lane is exactly the second one.
-    # So the column carries `tmux switch-client` inside tmux and `tmux attach`
-    # outside it — the same two acts `lane`'s LIVE HERE branch performs, which
-    # is why the CHOICE between them is made here, in the read both surfaces
-    # share, and not in a renderer.
-    #
-    # THE TARGET IS `<session>:<@id>` WHERE THE RECORD KNOWS AN ID, and the
-    # session alone where it does not. Measured on this estate 2026-09-14 (tmux
-    # 3.4, private socket): `attach -t dst:@2` attached AND made `@2` current in
-    # ONE act, while `attach -t <session>` lands on whatever that session has
-    # since made current — another lane, which is the one thing the
-    # id-AND-session fence exists to stop. A bare session is still what a record
-    # with no `@id` can offer, and it is offered as that.
-    lr_restart=none
-    if [ "$lr_state" = PAUSED ]; then
-      if [ -z "$lr_pf" ] || [ "$lr_pf" = none ]; then
-        lr_restart="pclaude --lane $lr_l <profile>"
-      else
-        lr_restart="lane $lr_l"
-      fi
-    elif [ "$lr_state" = LIVE ]; then
-      # THE WINDOW COLUMN HAS TWO SHAPES AND BOTH REACH HERE. A LIVE row takes
-      # it from the live session record, whose `tmux` field is
-      # `<session>:<@id>.<%pane>`; every other row takes it from the log, whose
-      # `window` sub-field is Amendment 11(c)'s TWO space-separated refs,
-      # `<session>:<index> <@id>`. Reading one for the other is how this column
-      # would offer `tmux attach -t <session>:<index>` — an index another window
-      # can be given between the read and the act, which is exactly what the
-      # id-AND-session rule exists to stop.
-      lr_wref="${lr_win%% *}"
-      lr_attid=""
-      case "$lr_win" in *' @'*) lr_attid="${lr_win##* }" ;; esac
-      if [ -z "$lr_attid" ]; then
-        lr_wtmp="${lr_wref%%.*}"
-        case "${lr_wtmp#*:}" in @[0-9]*) lr_attid="${lr_wtmp#*:}" ;; esac
-      fi
-      lr_att="${lr_wref%%:*}"
-      [ -z "$lr_attid" ] || lr_att="$lr_att:$lr_attid"
-      case "${lr_win:-none}" in
-        none | *'(gone)'*) : ;;
-        *)
-          if [ -n "${TMUX:-}" ]; then lr_restart="tmux switch-client -t $lr_att"
-          else lr_restart="tmux attach -t $lr_att"
-          fi ;;
-      esac
-    fi
-    # COLUMN 13 — WHETHER THIS PLACE MAY PRONOUNCE ON THAT BINDING, and it is
-    # the READ-s answer and not a renderer-s (Copilot round 1 on this PR; the
-    # rule A11 Addendum 4 ruling 7 gave column 10). `lane-groups` filed an
-    # `IDLE` row as AVAILABLE on the workstation column alone — and an IDLE row
-    # is a binding THIS host could not see a live record for, which across a
-    # container seam is exactly the lane that IS running: two benches on one
-    # host share the profile directory, so the pick offered another container-s
-    # live lane and the launch made a second process on it. `here` is Amendment
-    # 18(b)-s only place liveness may be pronounced from; a pre-clause line is
-    # matched on the host alone, which is clause (a)-s cutover sentence; and
-    # `none` is a lane with no binding line at all, which changes nothing about
-    # how it was filed before this column existed (it was EMPTY until Amendment
-    # 19-s four columns came after it — see below for why it cannot be now).
-    # AND ONLY WHERE THERE IS A BINDING TO BE LOCAL TO. The binding fields come
-    # from the last `STARTED`/`RESUMED` whatever released it since, so a PARKED
-    # lane still carries the host and container of the place that last ran it —
-    # and a lane parked in another container is AVAILABLE here, because parking
-    # IS the handoff (asserted since Amendment 18 Addendum 1). Column 13 means
-    # *the locality of a binding that stands*, and is `none` where none does.
-    lr_local=""
-    case "$lr_verb" in STARTED|RESUMED) : ;; *) lr_bhost="" ;; esac
-    if [ -n "$lr_bhost" ]; then
-      lr_local=elsewhere
-      # THE RULE IS `binding_is_here`-s AND NOT A SECOND COPY OF IT (Copilot
-      # round 2 on openRepoTools#83 read the two and found them already
-      # diverging). The `_lc` form is the same function with the two `lc` forks
-      # taken off the front, because the awk above has lower-cased these values
-      # already and this is asked of every lane in the listing.
-      binding_is_here_lc "$lr_bhost" "$lr_bcont" "$lr_blegacy" && lr_local=here
-    fi
-    # COLUMNS 14 TO 17 ARE AMENDMENT 19-S, AND THEY GO AFTER AMENDMENT 18(b)-S
-    # 13 for the reason `swapped_lanes` gives its sixth and seventh: the first
-    # field before the first tab is the contract every reader of this output
-    # takes, and each of the others is read by its own index. 14 is the CLASS —
-    # `closed`, `dormant` or `none` — so that the sweep and the listing
-    # partition the rows ONE way; 15 the row-s `started` cell, 16 its state
-    # cell-s head and 17 the flag words found in the whole of that cell.
-    #
-    # AND NO COLUMN IS EMPTY, 13 INCLUDED, because three readers take this row
-    # with `IFS=<tab> read`, and a tab is IFS WHITESPACE: two in a row are ONE
-    # separator, so an empty 13 would hand 14 to the variable named for 13 and
-    # every field after it to the one before. A row with no standing binding
-    # says `none` there, which `lane_groups` files exactly as it filed empty —
-    # only `elsewhere` changes the group.
-    lr_out="${lr_out}${lr_utc:-0000}${US}${lr_l}	${lr_state}	${lr_w:-unknown}	${lr_pf:-none}	${lr_win:-none}	${lr_sid:-none}	${lr_d:-none}	${lr_obj:-none}	${lr_age}	${lr_restart}	${lr_home:-none}	${lr_fk}	${lr_local:-none}	${lr_class:-none}	${lr_start:-unknown}	${lr_was:-none}	${lr_flags:-none}
-"
-  done <<EOF
-$lr_names
-EOF
-  [ -n "$lr_out" ] || return 8
-  printf '%s' "$lr_out" | LC_ALL=C sort -t"$US" -k1,1r | awk -F"$US" 'NF >= 2 { print $2 }'
-}
-
-# --------------------- AMENDMENT 18 ADDENDUM 1: THE PICK'S TWO READS ---------
-#
-# `lane` (Addendum 1 (i-1), ratified 2026-09-14T14:05:54Z verbatim "ratify the
-# addendum") renders THE SAME ROWS `lanes` renders — in three groups, with a
-# number in front of each. Neither the grouping nor the next free position is
-# that word's own: both are computed HERE, over the rows `lanes_rows` printed,
-# because two surfaces computing one answer is how they come to disagree. That
-# is the rule clause (h) already gives `window-lane` and `session-lane`, and the
-# one A11 Addendum 4 ruling 7 gave column 10 after `lanes` and `restart` had
-# each computed a restart line of its own.
-#
-# ROWS ON STDIN, like `sibling-filter` one screen down: the caller has already
-# made the read and paid for it, and a subcommand that read the register a
-# second time would double the cost of every pick to answer a question about
-# the rows already in its hand. Neither of these two reads the register, the
-# logs, the session records or the network at all.
-
-# THE PARTITION, AND IT IS THE STATE COLUMN'S (clause (i-2)):
-#
-#   available   PARKED — a lane nobody holds — or A BINDING THIS HOST PROVES
-#               DEAD: a lane whose last verb was STARTED or RESUMED, on this
-#               workstation, with no live session record naming any of its ids.
-#               `lanes_rows` has already made that proof, and it is the whole
-#               difference between its `LIVE` and its `IDLE`.
-#   live        LIVE: a live session record on this workstation names one of the
-#               row's ids. The act is the ATTACH and never a second process.
-#   elsewhere   a binding this host CANNOT prove dead, because the row is
-#               another workstation's: the session records are local files, so
-#               saying NOT LIVE about Raven from Eagle would be a claim this
-#               machine has no way to make. Clause (c)'s handoff question.
-#   rowonly     NOT A PICK: a STATE `lanes_rows` read out of the row's own
-#               13(a) cell, `<WORD> (row)`, because the log has no lane-kind
-#               line to give one (#89). Shown by `lanes`, never numbered by
-#               `lane`, and refused by name — there is no log to resume from.
-#
-# CLOSED AND DORMANT LANES LEAVE THE PICK (Amendment 19). A lane whose last act
-# was its last is not a lane a person picks, and a pick that offered one would
-# be offering to reopen something closed on purpose. `ENDED` and `RETIRED` are
-# that set in today's vocabulary and `CLOSED`/`DORMANT` are the words the rows
-# take under #42; both are named here, so the pick is right under either and
-# the word does not have to move when the read does. They are still ROWS in
-# `lanes`, which is the READ — this is a pick.
-lane_groups() {   # <workstation> ; rows on stdin
-  awk -F'\t' -v me="$(short_ws "${1:-$WS}")" '
-    NF >= 3 {
-      st = $2
-      # THE CLASS FIRST, AND THAT IS AMENDMENT 19 ARRIVING IN COLUMN 14 — 13 is
-      # Amendment 18(b)-s, which landed first (Copilot round 2 on #93). A DORMANT row-s STATE is `NO LOG`, which is in no list
-      # below, so the state test alone let one through wherever the rows come
-      # from a read that does not hide them — `lanes --closed`, and `lane
-      # <name>`-s own `--lane` read, which is never filtered because its caller
-      # named the lane. The class is the read-s answer to exactly this question.
-      cls = (NF >= 14 ? $14 : "")
-      if (cls == "closed" || cls == "dormant") next
-      if (st == "ENDED" || st == "RETIRED" || st == "CLOSED" || st == "DORMANT") next
-      # A STATE READ OUT OF THE ROW-S OWN CELL IS SHOWN AND NEVER PICKED (#89).
-      # `lanes_rows` prints `<WORD> (row)` for a row whose log has no lane-kind
-      # line and whose cell is Amendment 13(a)-s phrase, and such a row records
-      # no directory, no profile and no binding: there is no log to resume it
-      # from. It is in none of the three groups, so the pick never numbers it,
-      # and `rowonly` is the group `lane <name>` refuses by name. Asked BEFORE
-      # the workstation, because a row with no log on this workstation was
-      # filed AVAILABLE on that column alone.
-      if (st ~ / \(row\)$/) { print "rowonly" "\t" $0; next }
-      w = tolower($3); sub(/\..*$/, "", w)
-      # COLUMN 13 IS THE READ-S OWN ANSWER to *"may this place pronounce on that
-      # binding"* (Amendment 18(b)), and an `IDLE` row is exactly the row that
-      # needs it: IDLE means THIS host saw no live record for the lane-s ids,
-      # and across a container seam that is the lane that IS running — two
-      # benches on one host share the profile directory, so the pid the record
-      # names is in the other one-s namespace. Filed on the workstation column
-      # alone, such a row was offered as AVAILABLE and the launch made a second
-      # process on a live lane (Copilot round 1 on openRepoTools#83).
-      #
-      # AN EMPTY OR `none` COLUMN 13 IS A ROW WITH NO BINDING LINE AT ALL — a lane
-      # with a row and no log, or a `lanes-edit.sh` predating this column (the
-      # read says `none` since Amendment 19 put columns after it) — and it is
-      # filed exactly as it was before the column existed, which is Amendment
-      # 7(i)-s cutover rule for a field a reader may simply not have.
-      loc = (NF >= 13 ? $13 : "")
-      # AND IT IS ASKED BEFORE THE STATE, INCLUDING OF A `LIVE` ROW (Copilot
-      # round 2 on openRepoTools#83). `LIVE` is a live session record HERE
-      # naming one of the row-s ids — and a record written in another container
-      # is readable here while the pid it names is in another namespace, so a
-      # `kill -0` that answers is answering about some other process. Clause (b)
-      # gives that binding to the place it is in: from here it is UNKNOWN, the
-      # act is clause (c)-s request, and the attach stays available to a person
-      # because `lane`-s elsewhere branch names it wherever that window is live
-      # on this tmux server. Column 13 is `none` where no binding stands, so a
-      # PARKED lane of another container is untouched by this and is AVAILABLE,
-      # because parking IS the handoff.
-      if (loc == "elsewhere") g = "elsewhere"
-      else if (st == "LIVE") g = "live"
-      else if (st == "PAUSED") g = "available"
-      else if (w == me) g = "available"
-      else g = "elsewhere"
-      print g "\t" $0
-    }'
-}
-
-# THE NEXT FREE POSITION, over those same rows: clause (i-1)'s `f` answer, and
-# the footer `lanes` has printed since Brett Heap's settlement of
-# 2026-09-13T20:38:11Z. It is the LOWEST one NO ROW HOLDS and never the highest
-# plus one, because handing out 12 while 3 has never been used grows a column
-# nobody reads — and `lane-start` refuses a position that is taken, so this is a
-# suggestion with a guard behind it and never an assertion.
-#
-# A POSITION A LANE HAS HELD IS RESERVED, ENDED AND RETIRED ROWS INCLUDED
-# (Copilot round 7 on #45, `lanes-edit.sh:4839`, where this paragraph said
-# positions "come back as lanes end" and the code has never done that). EVERY
-# row on stdin is taken, whatever its state, and that is deliberate: a lane's
-# identity is its name, its object log is `lanes/log/<lane>.md` and it is
-# APPEND-ONLY, so a second lane at a retired position would write its life into
-# the first one's file and every read of that log — who holds what, when it was
-# claimed, which session paused it — would answer for two lanes at once. The
-# register's row is the same story in one line. Positions are cheap; identities
-# are not.
-#
-# A POSITION IS DIGITS WITH AN OPTIONAL TRAILING LETTER, which is
-# `lane-start`'s own rule: `5a` and `5` are one position taken twice, because a
-# lane may be re-cut and a re-cut position is not free, and it is the only
-# reading under which `openxfactory-4-opendox-extraction` has no position at
-# all. The comparison is case-insensitive on both sides, like every other lookup
-# of a lane name in this file (Amendment 15).
-# EVERY ROW OF THE REGISTER AND OF THE ARCHIVE, AS BARE NAMES — the rows the
-# listing HIDES since Amendment 19(b), and the rows `archive-rows` has moved out
-# of the register altogether under 19(d). Both are read out of THIS CHECKOUT-s
-# files and neither is fetched: the rows on stdin already carry the published
-# register (the caller has just rendered it), and this union can only move the
-# position UP, which is the direction a position may safely move. `next-free`
-# is exempt from the workspace guard, so no workspace at all is silence here.
-# THE PUBLISHED ONES, WITH THIS CHECKOUT'S AS THE FALLBACK (Copilot round 1 on
-# #93). Reading only the local files missed a row that is on `origin/<branch>`
-# and not yet pulled here: hidden from the stdin rows by clause (b) and absent
-# from this union, its position came back on offer — which is the one thing
-# 19(b) exists to prevent. `register_text` and `archive_text` are the same two
-# reads the listing makes, in R19's order.
-#
-# AND A SOURCE THAT EXISTS AND CANNOT BE READ IS A REFUSAL, not an empty set: a
-# position is handed out ONCE, and a read that failed is never an answer
-# (Amendment 7(d)).
-lane_position_rows() {   # 0 with the names · 1 where a source exists and could not be read
-  [ -n "${LANES_FILE:-}" ] || return 0
-  # THE PUBLISHED REGISTER FIRST AND THE WORKING TREE SECOND — `register_text`'s
-  # own rule, asked for rather than restated (Copilot round 3 on #93). Gated on
-  # the working-tree FILE existing, this read skipped the published register
-  # entirely on a checkout that has none, and `next-free` then counted only the
-  # stdin rows and the archive.
-  #
-  # AND AN EMPTY ANSWER WHERE A SOURCE EXISTS IS A READ THAT FAILED (round 2):
-  # `register_text` ends in a `printf` and answers 0 whatever its `git show` or
-  # its `cat` did, so the status says nothing; what cannot happen is a source
-  # with bytes in it rendering as nothing.
-  # AND ANY PATH THERE IS A SOURCE (#138 item 5). Under `[ -s ]` a zero-byte
-  # register — what a rewrite that failed leaves — and a broken symlink were
-  # skipped where origin has no register, and `next-free` counted the stdin
-  # rows and the archive alone. Counted as a source, either renders empty, and
-  # the check below refuses it.
-  if [ -f "$LANES_FILE" ] && [ ! -r "$LANES_FILE" ]; then return 1; fi
-  lpr_have=0
-  if [ -e "$LANES_FILE" ] || [ -L "$LANES_FILE" ]; then lpr_have=1; fi
-  # AND THE PUBLISHED ONE IS THE TREE'S ANSWER, with `register_text`'s 1 kept
-  # (#138 item 18, the review of #230): a published register whose blob git
-  # cannot read is a source that failed, not one that is absent.
-  lpr_prc=0; register_published || lpr_prc=$?
-  case "$lpr_prc" in
-    0) lpr_have=1 ;;
-    8) : ;;
-    *) return 1 ;;
-  esac
-  lpr_reg=""
-  if [ "$lpr_have" = 1 ]; then
-    lpr_reg="$(register_text_checked 2>/dev/null)" || return 1
-    [ -n "$lpr_reg" ] || return 1
-  fi
-  lpr_arc=""
-  lpr_arc="$(archive_text 2>/dev/null)" || return 1
-  printf '%s\n%s\n' "$lpr_reg" "$lpr_arc" | awk '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      r = substr($0, p1 + 1); p2 = index(r, "`"); if (p2 == 0) next
-      print substr(r, 1, p2 - 1)
-    }' 2>/dev/null || return 1
-  return 0
-}
-
-lane_next_free() {   # <repo> ; rows on stdin
-  [ -n "${1-}" ] || return 64
-  lnf_more=""
-  if ! lnf_more="$(lane_position_rows)"; then
-    note "the register or the archive of retired rows exists and could not be read, so the rows this position must avoid are not all known. A position is handed out ONCE and a read that failed is not an answer (Amendment 7(d)), so none is offered."
-    return 1
-  fi
-  { cat; printf '%s\n' "$lnf_more"; } | awk -F'\t' -v r="$1" '
-    BEGIN { rl = tolower(r) }
-    $1 != "" {
-      # THE WHOLE NAME BEFORE THE POSITION IS COMPARED, NOT A PREFIX (Copilot
-      # round 7 on #45, `lanes-edit.sh:4853`). `substr(l, 1, length(rl))` reads
-      # `repo-foo-1` as a lane of `repo`, so a repository whose name is another
-      # name plus a hyphen took positions out of its neighbour: `next-free repo`
-      # would skip 1 because `repo-foo-1` exists, and hand out a number for a
-      # reason nobody could see in the listing. `head` is everything before the
-      # LAST hyphen and has to equal the repository exactly.
-      p = $1; sub(/^.*-/, "", p)
-      head = $1; sub(/-[^-]*$/, "", head)
-      if (head == $1) next
-      if (tolower(head) != rl) next
-      sub(/[A-Za-z]$/, "", p)
-      if (p !~ /^[0-9]+$/) next
-      taken[p + 0] = 1
-    }
-    END { i = 1; while (i in taken) i++; print i }'
-}
-
-# swapped_lanes [<workstation>] — one row per swapped lane, tab-separated:
-#   <lane>	<UTC>	<window>	<dir>	<profile>	<agent>	<transcript>
-#
-# THE FIRST FIELD IS THE REGISTER ROW'S SPELLING OF THE LANE (Amendment 15), the
-# way `window-lane`'s answer is. The record is read under the lane's LOG FILE
-# name, and a log written before Amendment 15 is still `lanes/log/<lower>.md`
-# beside a row that spells the lane in mixed case (`lanes/log/openxfactory-4.md`
-# and `openXfactory-4`), so the raw name is the wrong one to print. A caller of
-# this output hands that field to `tmux rename-window`, to `--name`, to
-# `lane <name>` and to a read of the register, and each of them wants the row's
-# spelling. The log's own spelling is kept for the two things that read the LOG
-# — its path and the pickaxe key — and is never printed.
-#
-# THE LAST TWO ARE AMENDMENT 17(b)'s, and they are added at the END for the
-# reason the fourth and fifth were: the FIRST FIELD BEFORE THE FIRST TAB is the
-# contract every reader of this output takes (the launcher, the `handoff`
-# skill's step 1, `lane-start`'s directory rung 2 and `restart`'s, each with the
-# same comment saying so), and each of the others is read by its own index. A
-# record written before an amendment carries its fields EMPTY rather than
-# guessed — Amendment 7(i)'s cutover rule, which is what makes a sixth and a
-# seventh safe to add at all.
-#
-# WHICH LINE IS A LANE'S "LAST" IS FILE ORDER (R14), like every other state read
-# here: a lane's log is append-only and single-writer, so a line further down
-# the file is a line written later whatever the two UTC fields say — and this is
-# the read a restart resolves its lane from, so letting a clock decide it would
-# be the same fault Amendment 7 removed everywhere else.
-#
-# THE ROWS ARE ORDERED BY LANDING ORDER ON `origin/<branch>`, MOST RECENTLY
-# LANDED FIRST — the position of the commit that ADDED each lane's PAUSED line,
-# and never the UTC in it. File order does not reach across two lanes' files,
-# and two lanes' UTCs are two clocks: they may be two workstations' (Amendment 7
-# gives them no shared order at all) or one workstation's mid-jump — this one
-# was observed stepping ±25 s in bursts, and a log commit landed whose content
-# carried a UTC 26 s after its own committer date. Git's push serialization is
-# the one order both lanes really share, and it is the same arbiter clause (f)
-# already uses to decide a race. The UTC stays in the output as INFORMATION, and
-# decides nothing.
-#
-# The rank is the DAG distance from the tip (`rev-list --count <sha>..origin`),
-# not a committer date, so it is history order and not a clock either. Swapped
-# lanes are few — one per window a swap paused — so one pickaxe per candidate is
-# the cheap read. A candidate whose adding commit cannot be found (no remote ref
-# here, or the harness's LANES_NO_GIT=1) ranks last, and those fall back to UTC
-# order among themselves: an order that is merely unhelpful, never wrong.
-swapped_candidates() {
-  sw_want="$(short_ws "${1:-$WS}")"
-  state_events | awk -v sep="$US" -v want="$sw_want" '
-    function pos(pf, pn) { return pf "\034" sprintf("%09d", pn) }
-    BEGIN { FS = sep }
-    $6 !~ /^lane:/ { next }
-    # AMENDMENT 13(b) — AND THE TWO NARRATIVE VERBS ARE NOT LANE-KIND STATE.
-    # AMENDMENT 16 ADDS THE THIRD, and it is the one reader that has to be told
-    # (Copilot round 6 on openRepoTools#81). `RENAMED` joined `is_note_verb` —
-    # lane-kind, and not a transition — but this awk names the verbs it skips
-    # rather than asking the predicate, so a lane whose LAST line was its rename
-    # stopped reading as PAUSED: `swapped` would not list it and `restart` would
-    # not find the lane it is meant to bring back.
-    # This read takes a lane-s LAST lane-kind line whatever its verb is and then
-    # asks whether it is a `PAUSED` carrying a swap payload; it is the ONE state
-    # reader in this file that does not name the five verbs it wants. `NOTED`
-    # and `RULED` are written into exactly the same lines and change nothing
-    # about where a lane is, so a lane that noted anything after its swap would
-    # have vanished from `swapped` — and `restart` reads `swapped` to find the
-    # lane whose window name a new tmux session has lost. Skipped by name, here
-    # and nowhere else, because every other reader already takes a whitelist.
-    $3 == "NOTED" || $3 == "RULED" || $3 == "RENAMED" { next }
-    # AMENDMENT 15 — LOWER-CASED KEY, ORIGINAL SPELLING BESIDE IT. Which line is
-    # a lane-s LAST is what decides whether that lane is SWAPPED at all, and
-    # keyed on the raw `$2` a `PAUSED … swap;` under one spelling followed by a
-    # `RESUMED` under the other left the PAUSED alive as a candidate: `restart`
-    # would relaunch a lane that is not paused, and `window-lane` would bind a
-    # window ref the lane has since left (Copilot round 1 on openRepoTools#41).
-    { k = tolower($2); p = pos($10, $11)
-      if (!(k in mp) || p >= mp[k]) {
-        mp[k] = p; verb[k] = $3; utc[k] = $1; pay[k] = $8; uuid[k] = $4; ws[k] = $5; obj[k] = $6; nm[k] = $2 } }
-    END {
-      for (l in mp) {
-        if (verb[l] != "PAUSED") continue
-        if (substr(pay[l], 1, 5) != "swap;") continue
-        w = ""; wst = ""; d = ""; pf = ""; ag = ""; tr = ""
-        n = split(pay[l], sf, "; ")
-        for (i = 1; i <= n; i++) {
-          if (substr(sf[i], 1,  7) == "window ")      w   = substr(sf[i], 8)
-          if (substr(sf[i], 1, 12) == "workstation ") wst = substr(sf[i], 13)
-          # AMENDMENT 11 clause (c): two sub-fields added to the three
-          # A8(b):202 gives this line.
-          # A `dir` whose path carries a space is written QUOTED, so the quotes
-          # are stripped here — one unquoter, in the one parser of this line.
-          if (substr(sf[i], 1,  4) == "dir ")         d   = substr(sf[i], 5)
-          if (substr(sf[i], 1,  8) == "profile ")     pf  = substr(sf[i], 9)
-          # AMENDMENT 17(b): two more, and a record written before that
-          # amendment carries neither — which is EMPTY here, never a guess
-          # (the cutover rule of Amendment 7(i); no apostrophe in this comment,
-          # because this awk program is single-quoted in the shell).
-          if (substr(sf[i], 1,  6) == "agent ")       ag  = substr(sf[i], 7)
-          if (substr(sf[i], 1, 11) == "transcript ")  tr  = substr(sf[i], 12)
-        }
-        sub(/[ \t]+$/, "", w); sub(/[ \t]+$/, "", wst); sub(/\..*$/, "", wst)
-        sub(/^[ \t]+/, "", d);  sub(/[ \t]+$/, "", d)
-        sub(/^[ \t]+/, "", pf); sub(/[ \t]+$/, "", pf)
-        sub(/^[ \t]+/, "", ag); sub(/[ \t]+$/, "", ag)
-        sub(/^[ \t]+/, "", tr); sub(/[ \t]+$/, "", tr)
-        if (substr(d, 1, 1) == "\"") { q = index(substr(d, 2), "\""); if (q > 0) d = substr(d, 2, q - 1) }
-        else                          { sub(/ .*$/, "", d) }
-        sub(/ .*$/, "", pf)
-        sub(/ .*$/, "", ag)
-        sub(/ .*$/, "", tr)
-        if (tolower(wst) != want) continue
-        # The LAST field is the PICKAXE KEY: the head of the line as it was
-        # written, up to and including its object, which is unique to it and
-        # which `git log -S` can find without a regex.
-        # `nm[l]` AND NEVER `l` (Amendment 15, `8345d2f`): the key is the lane
-        # folded to one case and `nm` is the lane as the event stream spells
-        # it, which is the base name of the lane LOG FILE (Amendment 16(c) keys
-        # every line to its file). That is NOT the register row spelling
-        # wherever the file does not carry it: a log written before Amendment 15
-        # is still `lanes/log/openxfactory-4.md` beside the row `openXfactory-4`.
-        # It stays the spelling of the log itself, for the pickaxe key below and for
-        # `log_path_for`; the row spelling is for `swapped_lanes` to print as
-        # the first field, and `window-lane` canonicalises its answer the same
-        # way. (No apostrophe in this comment: this awk program is single-quoted.)
-        printf "%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s — lane %s, session %s@%s, %s, %s\n",
-          nm[l], 31, utc[l], 31, (w == "" ? "unknown" : w), 31,
-          (d == "" ? "" : d), 31, (pf == "" ? "" : pf), 31,
-          (ag == "" ? "" : ag), 31, (tr == "" ? "" : tr), 31,
-          verb[l], nm[l], uuid[l], ws[l], utc[l], obj[l]
-      }
-    }'
-}
-
-swapped_lanes() {
-  sw_rows="$(swapped_candidates "${1:-$WS}")"
-  [ -n "$sw_rows" ] || return 0
-  while IFS="$US" read -r sw_l sw_u sw_w sw_d sw_p sw_a sw_t sw_key; do
-    [ -n "${sw_l:-}" ] || continue
-    # THE ROW'S SPELLING FOR THE FIRST FIELD, THE LOG'S FOR THE LOG (see above).
-    # `canon_lane` refuses a register holding the 15(d) pair and a table of
-    # former names it cannot read; this read keeps the log's own spelling then,
-    # for `window-lane`'s reason: it is informational and its contract is rows
-    # or 8, and the refusal belongs to the writer the lane leads to.
-    sw_can="$(canon_lane "$sw_l" 2>/dev/null || :)"
-    sw_rank=999999999
-    if have_remote_ref; then
-      sw_sha="$(git -C "$LANES_REPO" log -1 --format=%H -S"$sw_key" "origin/$LANES_BRANCH" -- "$(log_path_for "$sw_l")" 2>/dev/null || :)"
-      if [ -n "$sw_sha" ]; then
-        sw_c="$(git -C "$LANES_REPO" rev-list --count "$sw_sha..origin/$LANES_BRANCH" 2>/dev/null || :)"
-        case "$sw_c" in ''|*[!0-9]*) : ;; *) sw_rank="$sw_c" ;; esac
-      fi
-    fi
-    printf '%09d%s%s%s%s%s%s%s%s%s%s%s%s%s%s\n' "$sw_rank" "$US" "${sw_can:-$sw_l}" "$US" "$sw_u" "$US" "$sw_w" \
-      "$US" "${sw_d:-}" "$US" "${sw_p:-}" "$US" "${sw_a:-}" "$US" "${sw_t:-}"
-  done <<EOF
-$sw_rows
-EOF
-}
-
-# The lane's open objects on ONE line, for the hook's block. `who --lane` prints
-# a line per object and a heading; a hook has one line's worth of a reader's
-# attention, and the objects are what the next act needs to know.
-lane_open_summary() {
-  los_l="$1"; los_out=""
-  if ! lane_log_exists "$los_l"; then
-    printf 'no log for %s (pre-cutover lane) — see its row'"'"'s state cell\n' "$los_l"
-    return 0
-  fi
-  while IFS="$US" read -r lo_utc lo_verb lo_obj lo_ref lo_sup; do
-    [ -n "${lo_verb:-}" ] || continue
-    is_open_verb "$lo_verb" || continue
-    los_out="${los_out}${los_out:+; }$lo_verb $lo_obj${lo_sup:+ (taken over by lane:${lo_sup%@*})}"
-  done <<EOF
-$(lane_objects "$los_l" 2>/dev/null || :)
-EOF
-  printf '%s\n' "${los_out:-none open}"
-}
-
-# HOW OLD THE ANSWER IS (Amendment 8, R-A8-1). The hook never fetches, so every
-# line of its block is the checkout as it last stood. `.git/FETCH_HEAD` is
-# rewritten by every fetch and by nothing else, so its mtime is when this
-# checkout last heard from `origin` — and a block that says "4d ago" is a block
-# a reader knows not to trust about another workstation's lane. Never a network
-# call and never a failure: an unreadable one answers `unknown`.
-fetch_age() {
-  fa_dir="$(git -C "$LANES_REPO" rev-parse --git-dir 2>/dev/null || :)"
-  [ -n "$fa_dir" ] || { printf 'unknown\n'; return 0; }
-  case "$fa_dir" in /*) : ;; *) fa_dir="$LANES_REPO/$fa_dir" ;; esac
-  [ -f "$fa_dir/FETCH_HEAD" ] || { printf 'never\n'; return 0; }
-  fa_t="$(stat -c %Y -- "$fa_dir/FETCH_HEAD" 2>/dev/null || stat -f %m -- "$fa_dir/FETCH_HEAD" 2>/dev/null || :)"
-  case "$fa_t" in ''|*[!0-9]*) printf 'unknown\n'; return 0 ;; esac
-  fa_s=$(( $(date -u +%s) - fa_t ))
-  [ "$fa_s" -lt 0 ] && fa_s=0
-  if   [ "$fa_s" -lt 90 ];     then printf '%ss ago\n' "$fa_s"
-  elif [ "$fa_s" -lt 5400 ];   then printf '%sm ago\n' "$((fa_s / 60))"
-  elif [ "$fa_s" -lt 172800 ]; then printf '%sh ago\n' "$((fa_s / 3600))"
-  else                              printf '%sd ago\n' "$((fa_s / 86400))"
-  fi
-}
-
-# The last line of every block the hook prints, whichever branch wrote the rest,
-# in the words clause (e) gives it: "every block ends with the line
-# `as of <n>m ago (no fetch)`". It is the whole of what makes an unfetched read
-# honest — a reader sees how stale the answer is instead of trusting a freshness
-# nobody verified.
-ssb_tail() {
-  printf 'as of %s (no fetch)\n' "$(fetch_age)"
-  return 0
-}
-
-# `lane-start`'s arguments FOR THIS LANE, filled in (Amendment 8, R-A8-7). The
-# block used to print the literal `<repo> <n>` with the lane in hand, so every
-# reader translated `openRepoProject-1` into `openRepoProject 1` by hand, on
-# every mismatch, for ever. A lane is `<repo>-<position across>` (THE LANE
-# RULE), so the split is on the LAST `-` — and ONLY when what follows it is a
-# number: a lane named before that rule (`browser-ui-repair`) is started through
-# `--dir`, and splitting it would print `browser-ui repair`, which is a command
-# that does the wrong thing rather than one that does nothing.
-lane_start_args() {
-  lsa_l="${1-}"; lsa_n="${lsa_l##*-}"
-  case "$lsa_l" in *-*) : ;; *) printf -- '--dir <path> %s\n' "$lsa_l"; return 0 ;; esac
-  case "$lsa_n" in ''|*[!0-9]*) printf -- '--dir <path> %s\n' "$lsa_l"; return 0 ;; esac
-  printf '%s %s\n' "${lsa_l%-*}" "$lsa_n"
-}
-
-# Has Rule 3's stamp for THIS session already been written? (Amendment 8,
-# R-A8-7: the block told every resume to "stamp the handoff RESUMED" when
-# `lane-start` had just written it — one manufactured decision per resume.) A
-# local file read and nothing else: the row's handoff cell, resolved the way the
-# row spells it, grepped for this session's own line. It is ASKED rather than
-# assumed from the ids matching, because a window started by a bare `claude`
-# rather than by `lane-start` has no stamp and does still owe one.
-handoff_stamped_by() {   # <handoff cell> <session id>
-  hsb_cell="${1-}"; hsb_id="${2-}"; hsb_f=""
-  [ -n "$hsb_cell" ] && [ -n "$hsb_id" ] || return 1
-  case "$hsb_cell" in
-    '~/'*) hsb_f="$HOME/${hsb_cell#'~/'}" ;;
-    /*)    hsb_f="$hsb_cell" ;;
-    *)     [ -n "${LANES_REPO:-}" ] && hsb_f="$LANES_REPO/$hsb_cell" ;;
-  esac
-  [ -n "$hsb_f" ] && [ -r "$hsb_f" ] || return 1
-  grep -qF -e "RESUMED by $hsb_id" -- "$hsb_f" 2>/dev/null
-}
-
-# DOES THE ROW'S NEWEST STAMP NAME A UUID, OR `unknown`? (Amendment 8(e), "the
-# first cure carries one condition".) A real `lane-start` is the wrong-lineage
-# remedy BECAUSE the cell's last id names a transcript the lane's directory has.
-# Where the last launch took clause (d)'s title fallback, that id names a
-# transcript this directory does not have — which is why the fallback was
-# reached — and the row says so in its own words: the stamp that run wrote
-# carries the literal `unknown`. A relaunch would take the same fallback again,
-# so the cure there is the recording act instead.
-#
-# The row is read, never the directory: the hook is handed no lane checkout and
-# the working directory confers no lane. `0` when the newest stamp says
-# `unknown`, `1` otherwise — including a row with no stamp at all, where a
-# relaunch is the ordinary remedy.
-row_stamp_is_unknown() {   # <lane>
-  rsu_lane="${1-}"; rsu_n=""; rsu_row=""; rsu_last=""
-  [ -n "$rsu_lane" ] || return 1
-  rsu_n="$(row_line "$rsu_lane" 2>/dev/null)" || return 1
-  case "$rsu_n" in ''|*[!0-9]*) return 1 ;; esac
-  rsu_row="$(sed -n -e "${rsu_n}p" "$LANES_FILE" 2>/dev/null || :)"
-  [ -n "$rsu_row" ] || return 1
-  rsu_last="$(printf '%s' "$rsu_row" | grep -o '[A-Z][A-Z]* by [^ |]*' | tail -n1 || :)"
-  case "$rsu_last" in *" by unknown") return 0 ;; esac
-  return 1
-}
-
-# session_start_block <hook json> <tmux window name> — the whole of what the
-# SessionStart hook prints. It NEVER writes and its caller ALWAYS exits 0.
-#
-# `source` is one of startup, resume, clear, compact, fork. A COMPACT prints
-# NOTHING: the same conversation carries on in the same window under the same
-# id, and a block there would announce a lane's identity into the middle of a
-# session that already has it. Everything else — a fork included, which is a new
-# attachment to the lane's conversation — gets the block, and an unknown or
-# missing source is treated as a startup rather than dropped.
-#
-# `cwd` is in the payload and is deliberately NOT read as a lane: THE WORKING
-# DIRECTORY CONFERS NO LANE (Amendment 6(a)) — two lanes share one all day, and
-# every nested checkout in the xFactory estate shares its parent's. The WINDOW
-# and the REGISTER decide, in that order.
-session_start_block() {
-  ssb_json="${1-}"; ssb_win="${2-}"
-  ssb_id="$(lc "$(jstr "$ssb_json" session_id)")"
-  ssb_src="$(jstr "$ssb_json" source)"
-  case "$ssb_src" in compact) return 0 ;; esac
-
-  # AMENDMENT 15 — THE WINDOW NAME, THE SESSION NAME AND THE ROW KEY ARE
-  # COMPARED CASE-INSENSITIVELY, AND EVERY LINE BELOW PRINTS THE ROW'S OWN
-  # SPELLING. Both reads already answer with the register's spelling —
-  # `lane_named_ci` lowercases both sides by name, and `lane_of_session` prints
-  # the row's token — so `$ssb_lane` is canonical from here down, which is what
-  # makes `lane_start_args` below hand a reader the commands filled in with the
-  # spelling their window and their session are about to be named.
-  # AMENDMENT 12'S GUARD AND LOCK PLUG IN HERE, and since #25 they ARE built —
-  # `ssb_name_line` immediately below is clause (f), and the lock it types is
-  # the same `guard_type` the `UserPromptSubmit` guard uses. A session whose
-  # name differs from `$ssb_lane` only by case is renamed to the ROW's spelling
-  # like any other drift, which is what makes this line and Amendment 15 one
-  # rule rather than two.
-  ssb_lane=""; ssb_alias_unread=""
-  if [ -n "$ssb_win" ]; then
-    # AMENDMENT 16(e) — AND A TABLE THIS READ COULD NOT OPEN IS SAID, NOT
-    # SWALLOWED (Copilot round 3 on openRepoTools#81). This hook never refuses,
-    # so an unreadable `lanes/aliases.tsv` cannot stop the block — but printing
-    # "no lane bound to this window" about a window whose name might be a
-    # FORMER one is the block orienting a session wrongly, which is the one
-    # thing it exists not to do. It says so instead, and the line below it is
-    # then read as what it is.
-    ssb_rc=0
-    ssb_lane="$(lane_named_ci "$ssb_win" 2>/dev/null)" || ssb_rc=$?
-    [ "$ssb_rc" = 5 ] && { ssb_lane=""; ssb_alias_unread=1; }
-  fi
-  [ -n "$ssb_lane" ] || [ -z "$ssb_id" ] || ssb_lane="$(lane_of_session "$ssb_id" 2>/dev/null || :)"
-  [ -n "$ssb_alias_unread" ] && [ -z "$ssb_lane" ] && \
-    printf 'WARNING: %s could not be read, so a window named for a lane RENAMED since could not be resolved to it (Amendment 16(e)) — this block may be about to say no lane binds a window that one does\n' "${LANES_ALIASES_PATH:-lanes/aliases.tsv}"
-  # AMENDMENT 12 CLAUSE (f) AND AMENDMENT 18(h)'s READ — the name line and the
-  # duplicate line, printed HERE rather than inside each of the three branches
-  # below, because both are facts about this session and not about which of them
-  # applies. `|| :` for the reason the whole block has one: this hook never
-  # fails and always exits 0 (R-A8-1).
-  # THE SUBSHELL IS THE `|| :` MADE TRUE OF MORE THAN A RETURN — see
-  # `ssb_name_line`'s own header. It is the one line of this block that reads
-  # every profile's session records, so it is the one most able to meet
-  # something this hook may not die on.
-  ( ssb_name_line "$ssb_id" "$ssb_lane" ) || :
-  if [ -z "$ssb_lane" ]; then
-    # THE ONE PLACE THE PLACEHOLDER IS RIGHT: no lane is known here, so there is
-    # nothing to fill in. It is also the estate's ONE no-lane notice — the
-    # launcher prints its own on stderr before the launch, and Amendment 8's
-    # resume-choice table says one of the two goes; this is the one the session
-    # itself can read.
-    # THE ONE BRANCH THAT KEEPS ITS PLACEHOLDERS — no lane is known here, so
-    # there is nothing to fill in. Except where the WINDOW NAME itself parses as
-    # `<repo>-<n>`: the register has no such row, but the operator's own two
-    # arguments are right there in the name, and printing them beats printing a
-    # blank for them to fill. It is also the estate's ONE no-lane notice —
-    # clause (c) step 4 stands down wherever this hook can speak.
-    if [ -n "$ssb_win" ] && [ "$(lane_start_args "$ssb_win")" != "--dir <path> $ssb_win" ]; then
-      printf 'no lane bound to this window — run: lane-start %s\n' "$(lane_start_args "$ssb_win")"
-    else
-      printf 'no lane bound to this window — run: lane-start <repo> <n>\n'
-    fi
-    ssb_tail
-    return 0
-  fi
-
-  ssb_args="$(lane_start_args "$ssb_lane")"
-  ssb_cur="$(last_session_id_of_lane "$ssb_lane" 2>/dev/null || :)"
-  if [ -n "$ssb_id" ] && [ -n "$ssb_cur" ] && [ "$ssb_id" != "$ssb_cur" ]; then
-    # THE BRANCH IS THE ID'S POSITION IN THE SESSION CELL, NOT ITS PRESENCE.
-    # The cell is a history written oldest first and the LAST id is the lane
-    # (Amendment 6(b)), so there are exactly three places an id can be, and
-    # each is cured by a different act:
-    #
-    #   * the cell's LAST id — this session IS the lane. Handled below.
-    #   * IN the cell but not last — a SUPERSEDED transcript of this lane. That
-    #     is the 2026-09-11 wrong-lineage resume, caught at the first instant it
-    #     can be caught, and the cure is a real `lane-start`, which resumes the
-    #     id the row ends on. The conversation in this window is not the lane's,
-    #     so the session is exited rather than carried on with.
-    #   * in NO cell — the harness minted a new transcript with nobody acting (a
-    #     /clear, a usage reset, a profile switch), or an operator's title-
-    #     fallback pick landed on a transcript no row carries. The lane is right
-    #     and the row is simply behind, so the cure is the recording act and no
-    #     relaunch: `lane-start --no-launch`, which reads the live record in
-    #     this window and appends that uuid to the cell.
-    #
-    # THE TWO CURES ARE NOT INTERCHANGEABLE. A reader who runs `--no-launch` on
-    # a superseded transcript records the WRONG conversation as the lane's, in
-    # the cell the next restart resumes from — the failure this block exists to
-    # catch, performed by its own remedy.
-    #
-    # AND NO CURE SENDS A READER BACK THROUGH THE PICKER (clause (f)): where the
-    # row's newest stamp says `unknown`, the cell's last id names a transcript
-    # the lane's directory does not have, a relaunch would take the same title
-    # fallback again, and the recording act is the cure there too. No branch
-    # names `/resume` or the picker, because neither is a lane surface.
-    #
-    # EVERY COMMAND IS PRINTED FILLED IN (F-B6): the hook holds the lane, and a
-    # reader trying to get back to work should not have to translate
-    # `openRepoProject-1` into `openRepoProject 1` by hand at that moment.
-    if printf '%s\n' "$(session_ids_of_lane "$ssb_lane" 2>/dev/null || :)" | grep -qx -F -- "$ssb_id"; then
-      if row_stamp_is_unknown "$ssb_lane"; then
-        printf 'WARNING: this is a superseded transcript of lane %s; the live one is %s, which the row records as `unknown` — a relaunch would record nothing either, so run: lane-start --no-launch %s\n' \
-          "$ssb_lane" "$ssb_cur" "$ssb_args"
-      else
-        printf 'WARNING: this is a superseded transcript of lane %s; the live one is %s; you resumed %s — exit this session and run: lane-start %s\n' \
-          "$ssb_lane" "$ssb_cur" "$ssb_id" "$ssb_args"
-      fi
-    else
-      printf 'WARNING: this window is lane %s whose current session is %s; this session %s is in no row — the harness minted a new transcript — run: lane-start --no-launch %s\n' \
-        "$ssb_lane" "$ssb_cur" "$ssb_id" "$ssb_args"
-    fi
-    ssb_tail
-    return 0
-  fi
-
-  ssb_ho="$(handoff_of_lane "$ssb_lane" 2>/dev/null || :)"
-  # AMENDMENT 11 CLAUSE (h) — THE BOUND LINE GAINS THE WINDOW, and gains
-  # nothing else: `session-start` keeps all three of its safety properties, it
-  # never writes, it never touches the network and it always exits 0 (R-A8-1),
-  # and this is a field the block has already read out of the lane's own log.
-  # It is here because the window is what clause (b)'s precedence 3 and clause
-  # (f)'s step 2(c) bind from, and a reader who cannot see what the record says
-  # the window is cannot tell a lane that will bind with no question from one
-  # that will not.
-  ssb_win="$(lane_payload_field "$ssb_lane" window all 2>/dev/null || :)"
-  printf 'LANE %s — handoff %s — row session %s%s\n' \
-    "$ssb_lane" "${ssb_ho:-none recorded}" "${ssb_cur:-none recorded}" \
-    "${ssb_win:+ — window $ssb_win}"
-  # DECISION 8(e) — A LIVE FORK OF THIS LANE'S TRANSCRIPT IS SHOWN AS A DEFECT
-  # TO RETIRE. Evidence 6: an abandoned launch left a `--fork-session` daemon
-  # orchestrating the same plan, relaunching writers on the same branches and
-  # writing this lane's log under an id no row carries, while telling the
-  # interactive session it was the holder. A session that starts into a lane
-  # somebody else's fork is still running needs to know before it acts, and the
-  # retirement is a person's act (Amendment 8(f)), so the line NAMES and does
-  # nothing.
-  ssb_fk=""; ssb_fkrc=0
-  ssb_fk="$(lane_forks "$ssb_lane" 2>/dev/null)" || ssb_fkrc=$?
-  # AND THE SAME HERE, for the same reason: this block is the first thing a
-  # session that starts into a lane reads, and "no fork" is a fact it acts on.
-  case "$ssb_fkrc" in
-    0 | 8) : ;;
-    *) printf 'UNKNOWN: this workstation'"'"'s session records could not be read, so whether a live FORK of this lane'"'"'s transcript is running is NOT established — which is not the same as none. See: lanes-edit.sh forks %s\n' "$ssb_lane" ;;
-  esac
-  if [ -n "$ssb_fk" ]; then
-    while IFS='\t' read -r ssb_fid ssb_fpid ssb_fkind ssb_fcwd; do
-      [ -n "${ssb_fid:-}" ] || continue
-      printf 'DEFECT: %s is a live FORK of this lane'"'"'s transcript (pid %s, %s, cwd %s) — it is not the holder and must not write the register. Retire it: lane-end %s --retire %s\n' \
-        "$ssb_fid" "$ssb_fpid" "${ssb_fkind:-interactive}" "${ssb_fcwd:-unknown}" "$ssb_lane" "$ssb_fpid"
-    done <<EOF
-$ssb_fk
-EOF
-  fi
-  # THE BLOCK STOPS ASKING FOR A STAMP `lane-start` HAS ALREADY WRITTEN (R-A8-7,
-  # resume-choice row 9: one manufactured decision per resume). It is DERIVED,
-  # not assumed from the ids matching — a window started by a bare `claude`
-  # rather than through the launcher has no stamp and does still owe one — so
-  # the handoff the ROW names is read and grepped for THIS session's own line.
-  # Where the row names no handoff at all the line says that instead.
-  if [ -z "$ssb_ho" ]; then
-    printf 'the row records no handoff path — there is none to stamp or to follow\n'
-  elif handoff_stamped_by "$ssb_ho" "$ssb_id"; then
-    printf 'handoff already stamped by lane-start — follow its top block\n'
-  else
-    printf 'stamp the handoff RESUMED (Rule 3) and follow its top block\n'
-  fi
-  printf 'open: %s\n' "$(lane_open_summary "$ssb_lane")"
-  ssb_tail
-  return 0
-}
-
-# ============================================================================
-# AMENDMENT 12 — THE NAME GUARD AND THE LOCK, WITH AMENDMENT 18(h)'S ONE READ
-# ============================================================================
-#
-# **A LANE SESSION WORKS ONLY WHILE THREE NAMES ARE ONE** — the tmux WINDOW it
-# runs in, the SESSION's own name, and the register ROW whose session cell ends
-# on this transcript — **and otherwise the prompt is REFUSED** (exit 2), with
-# the triple as it stands and the ONE command that cures it, filled in. Ratified
-# 2026-09-13T18:20:44Z, "Ratify revision 2", with M1 "Type /rename into the
-# pane"; `brettheap/new-workstation#22`/#23, opensoft/openRepoTools#25.
-#
-# WHY THE RULE NEEDED AN ENFORCEMENT. Amendment 2 has said since 2026-09-05 that
-# a lane is its window's name and its session's name; nothing refused anything
-# for eight days, and between 2026-09-10 and 2026-09-12 this very lane ran as
-# `openRepoTools-3`, `-4`, … `-14` — a fresh title per `/resume`, in a window
-# still named `claude`, in profiles that changed at every usage reset — and no
-# row was ever written. `session_start_block` above says which lane a window is
-# and "ALWAYS exits 0"; `window_session` "decides nothing". This is the surface
-# that decides.
-#
-# THE LOCK (clause (h), Brett Heap's D5). Under the projects root the session
-# name is not the person's to set freely; it is the lane's. The tooling sets it
-# at every launch (`lane-start --name "$LANE"`, clause (c)) and again whenever it
-# drifts — by TYPING `/rename <lane>` into the session's own tmux pane, which is
-# the only mechanism a running session has (M1, "Type /rename into the pane"):
-# the docs name `--name` at launch, `/rename`, and `Ctrl+R` in the picker, and
-# nothing else — no hook output field, no environment variable, no settings key.
-# A PERSON'S rename to another lane's name is not drift but an INSTRUCTION, and
-# it is OFFERED back before it is obeyed: yes moves this window to that lane, no
-# renames the session back.
-#
-# FAIL CLOSED (clause (d)). A mismatch refuses; so does an INDETERMINATE read —
-# session records unreadable, tmux not answering, the register unreadable —
-# naming the read, because a triple that cannot be verified is not a triple that
-# agrees. Profile-only launches carrying exactly `CLAUDE_NO_LANE=1` are exempt
-# from this guard. `claude --safe-mode` disables every hook, deliberate and
-# visible in the prompt box; a session started that way is not a lane session
-# and may not write the register or claim an object.
-#
-# WHAT IT COSTS, AND THE ONE WAY IT FAILS OPEN. Measured on Eagle 2026-09-14
-# against 329 session records and a 1.3 MB register: the register read is ~2 s
-# wall and the `grep -l` over every profile's records ~0.4 s, so a refusal lands
-# inside the ratified `timeout 5`. A hook that EXCEEDS its timeout is killed, and
-# a killed hook does not exit 2 — so the timeout is the one path on which this
-# guard fails open. It is the amendment's own number and is left at it; the
-# cheap tests are made first so that the two reads happen only where they decide
-# something.
-#
-# IT NEVER FETCHES. `session-start`'s R-A8-1 argument applies here several times
-# over — that hook runs once per session and this one runs at EVERY PROMPT — so
-# the row is read from `origin/<branch>` AS THIS CHECKOUT LAST HAD IT (R19, the
-# same `register_text` every other state read takes) and the network is never
-# opened. "The register not fetchable" (clause (d)) is therefore the READ
-# failing, and that refuses.
-
-# A LANE NAME IS `<repo>-<position>` (THE LANE RULE), and this is the predicate
-# for it: `check_lane_name`'s character fence, plus a LAST `-` followed by
-# digits. It agrees with `lane_start_args` by construction — that function
-# prints `--dir <path> <lane>` for exactly the names this refuses — and the two
-# exist separately because one answers a question and the other builds a command
-# line. A name the register has a row for is a lane whatever its shape
-# (`browser-ui-repair` is one); this asks only whether the two arguments of
-# `lane-start` can be read OUT of a name nobody has a row for yet, which is what
-# rows 1 and 6 of the table below need.
-lane_shaped() {   # <name>
-  lsh_n="${1-}"
-  case "$lsh_n" in ''|*[!A-Za-z0-9._-]*|.*|-*) return 1 ;; esac
-  case "$lsh_n" in *-*) : ;; *) return 1 ;; esac
-  lsh_pos="${lsh_n##*-}"
-  case "$lsh_pos" in ''|*[!0-9]*) return 1 ;; esac
-  return 0
-}
-
-# CLAUSE (e)'s SCOPE, AND IT IS ASKED OF BOTH SPELLINGS OF A PATH. The guard
-# applies to every session whose `cwd` is under the projects root and is silent
-# elsewhere (D1, "Projects root only"). On a launcher-configured workstation
-# `~/projects` is a SYMLINK — every profile's is one link to
-# `~/.claude-profiles/state/opensoft/projects` — and the harness reports a `cwd`
-# that has already been resolved through it, so a literal prefix test answers
-# "outside the projects root" about every estate session there is. Both the
-# typed path and its `pwd -P` are compared, and a match on either is inside:
-# the direction that errs toward the guard APPLYING is the safe one, because
-# the other direction is the guard never firing at all.
-under_projects_root() {   # <cwd> <projects root>
-  upr_c="${1-}"; upr_r="${2-}"
-  [ -n "$upr_c" ] && [ -n "$upr_r" ] || return 1
-  case "$upr_c/" in "$upr_r"/*) return 0 ;; esac
-  upr_cr="$(cd -- "$upr_c" 2>/dev/null && pwd -P)" || upr_cr=""
-  upr_rr="$(cd -- "$upr_r" 2>/dev/null && pwd -P)" || upr_rr=""
-  [ -n "$upr_cr" ] && [ -n "$upr_rr" ] || return 1
-  case "$upr_cr/" in "$upr_rr"/*) return 0 ;; esac
-  return 1
-}
-
-# THE WINDOW A RECORD NAMES, UNDER AMENDMENT 11(h)'s AGREEMENT RULE. A record's
-# `tmux` is `<session>:<@id>.<%pane>`, and tmux REUSES window ids once a window
-# is gone — measured 2026-09-14, when a stale record's `@1` resolved to a window
-# of another session. So the id alone is not the window: the id must resolve
-# HERE and the session it resolves in must be the one the record wrote down.
-#   0  the window exists and agrees
-#   1  the id resolves nowhere here, or resolves in another tmux session — and
-#      the SERVER answered, so this is a refutation and not a silence
-#   2  tmux did not answer at all: its server is down or unreachable from here,
-#      so the window is UNKNOWN, not gone (openRepoTools#73, item 1)
-#   8  there is nothing to test — no target on the record, no `@id` in it, or no
-#      tmux to ask (a record with no window is not thereby a record nowhere)
-#
-# THE 2 NEEDS A SECOND QUESTION, AND IT IS ASKED ONLY WHERE THE FIRST CAME BACK
-# EMPTY. `tmux_window_field` answers empty for a window this server refuted and
-# for a server that never answered, and this function used to call both 1 —
-# which `transcript_holders` writes as `(gone)`, and which `lane-end --retire`
-# reads as "not the lane's own session". So with tmux installed and its server
-# silent, `--retire <the lane's own pid>` was accepted and printed Amendment
-# 6(d)'s retitle for the conversation that IS the lane (measured on f87fd5a:
-# `/rename repoGD-1 · retired …`, exit 0). `tmux_server_answers` tells the two
-# apart, and a window nobody could ask about keeps `(not asked)`'s posture: it
-# protects the process in it.
-record_window_state() {   # <the record's tmux field>
-  rws_t="${1-}"
-  [ -n "$rws_t" ] && [ "$rws_t" != none ] || return 8
-  rws_ref="${rws_t%.*}"
-  rws_id="${rws_ref##*:}"
-  rws_sess="${rws_ref%:*}"
-  case "$rws_id" in @*) : ;; *) return 8 ;; esac
-  command -v tmux >/dev/null 2>&1 || return 8
-  rws_now="$(tmux_window_field "$rws_id" '#{session_name}' 2>/dev/null || :)"
-  if [ -z "$rws_now" ]; then
-    tmux_server_answers || return 2
-    return 1
-  fi
-  [ "$rws_now" = "$rws_sess" ] || return 1
-  return 0
-}
-
-# DOES A TMUX SERVER ANSWER HERE AT ALL? Asked UNTARGETED, so it names no window
-# and no window's absence can refute it: with no `-t`, tmux answers for the
-# client this shell is in, or outside tmux for a session of its own choosing,
-# and with no server it prints nothing and exits 1 (`no server running on …`).
-# Measured on this estate 2026-10-13 against tmux 3.4 on a private socket: no
-# server → empty, exit 1; a server up, asked from outside it → the session's
-# name, exit 0; and a TARGETED read of an `@id` that server does not have →
-# empty, exit 0 — the very answer a silent server also gives, which is why this
-# is a separate question and not a status code read off the first one.
-tmux_server_answers() {
-  command -v tmux >/dev/null 2>&1 || return 1
-  [ -n "$(tmux display-message -p '#{session_name}' 2>/dev/null | head -n1)" ]
-}
-
-# ------------------------------------- AMENDMENT 18(h): ONE LIVE PROCESS
-#
-# *"A transcript (one session id) is held by ONE live process. The harness can
-# fork one (`--fork-session`, minting a new id in a background pty host) or
-# resume one twice, and the tooling refuses to build on either."* Ratified
-# 2026-09-14T13:15:18Z as revision 4 of Amendment 18;
-# `brettheap/new-workstation#34`, opensoft/openRepoTools#39.
-#
-# MEASURED FOUR TIMES ON 2026-09-14, the fourth at 18:14Z: a `bg` record in ONE
-# profile's `sessions/` and an interactive record in ANOTHER's, both live, both
-# carrying one `sessionId` — which is why this sweeps EVERY profile's directory
-# and not the asking session's. On a launcher-configured workstation every
-# profile's `projects/` is one shared directory, so a transcript needs no move
-# to be resumed under another profile and a duplicate is one `--resume` away.
-#
-# THREE CALLERS, ONE IMPLEMENTATION, for the reason clause (h) already gives
-# `window-lane`: `lane-start` refuses to bind or resume an id another process
-# holds, `lane-end --retire <pid>` retires that process, and the prompt guard
-# refuses every prompt inside it. A rule implemented three times is a rule three
-# surfaces come to disagree about.
-#
-# IT IS BUILT ON A `grep -l`, NOT ON `session_records`. This runs at every prompt
-# under a five-second timeout, and the one-pass parse is a per-process CACHE that
-# the first caller pays for in full — 329 records here. The question asked is
-# about ONE id the harness has already handed the hook, so the cheap shape is the
-# one `live_holder` uses: one grep for the id, then a parse of the one or two
-# files that match. Measured at ~0.4 s against those 329.
-#
-#   <pid><US><kind><US><tmux|none><US><profile><US><where><US><verdict><US><file>
-#
-# `where` is for a person to read — `window <session>:<@id>`, the same with
-# ` (gone)` where the agreement rule above refuses it, ` (no answer)` where tmux
-# did not answer at all and ` (not asked)` where there was nothing to ask — or
-# `bg`. Only `(gone)` is a window this server REFUTED (openRepoTools#73).
-#
-# THE VERDICT IS THE WHOLE OF THE JUDGEMENT, and it has four values because
-# THREE IN-FORCE RULES MEET HERE AND NONE OF THEM MAY BE OVERTURNED BY THIS ONE:
-#
-#   here        the record is THIS window's own process — its `tmux` names this
-#               window, or its pid is this pane's or below it: `record_is_here`'s
-#               TIERS 2 AND 3, and its tier 1 is left out because it cannot
-#               discriminate here. That tier asks whether the record's
-#               `sessionId` is `$CLAUDE_CODE_SESSION_ID`, and every candidate in
-#               this set carries the very id being tested — so on the asking
-#               session's own transcript it would answer `here` for the
-#               duplicate too, which is the one reading this function exists to
-#               prevent.
-#   companion   not this window's, in the SAME profile's `sessions/` as this
-#               window's own record of this id, AND NOT A SESSION RECORD.
-#               AMENDMENT 8, RULING (g) names exactly one such thing: *"Beside
-#               the interactive process in the pane the harness runs a companion:
-#               `kind: bg`, no `tmux`, no `nameSource`, its own pid, and THE SAME
-#               `sessionId` … Records that share a `sessionId` are one session,
-#               not a queue of rival holders, and there is no contest between
-#               them to win."* The harness writes a session's own records under
-#               that session's own `$CLAUDE_CONFIG_DIR`, so same-profile is what
-#               "the harness's own second record of one session" looks like —
-#               and the `kind` is what tells that record apart from a SECOND
-#               INTERACTIVE PROCESS in the same directory, which is one
-#               transcript resumed twice and is 18(h)'s own case rather than the
-#               harness's companion. The profile alone read a second `--resume`
-#               UNDER ONE PROFILE as benign (Copilot round 1 on this PR), and
-#               that is the cheapest way there is to make two live processes on
-#               one transcript: no move, no swap, one command.
-#               THE KIND IS `bg` AND NOTHING ELSE IS READ AS ONE. `not a session
-#               record` was the first spelling of this test and it was too wide
-#               by exactly the kinds nobody has ruled on: this suite's own
-#               interactive fork carries `kind: user`
-#               (`tests/test_lane_helpers.sh`, Amendment 11 clause (k)), and any
-#               kind a later harness invents would have arrived here as the
-#               harness's benign companion (Copilot round 2 on this PR). Ruling
-#               (g) names ONE shape to pass over, so that shape is what this
-#               matches; every other live record on this id — known kind or not,
-#               and a record too old to carry a `kind` at all, which pass 1
-#               writes down as `interactive` — is a duplicate, which is the
-#               closed direction.
-#               AND WHERE THIS WINDOW CARRIES NO RECORD OF THE TRANSCRIPT, THE
-#               LANE'S LIVE WINDOW STANDS IN FOR IT (openRepoTools#73, item 2).
-#               The relation is the HARNESS's, between two records of one
-#               session, and nothing about it depends on who asks — but it was
-#               read relative to the ASKING process, so `lane-end --retire` typed
-#               in a bare shell or in another lane's window found nothing
-#               `here`, every holder came back `unrelated`, and the companion
-#               was never called one. The record a session's companion sits
-#               beside is the interactive record in a window this server
-#               RESOLVES AND AGREES WITH (rc 0 above) — the record `lane-end`
-#               already calls "the lane's session" — so a `kind: bg` record in
-#               that record's profile is `companion` from any window. ONLY ONE
-#               PROFILE MAY ANSWER: two live windows in two profiles on one
-#               transcript is 18(h)'s own case with no way to tell which is the
-#               lane's, and there every row stays `unrelated`, as before. The
-#               anchor row itself is not this window's and stays `unrelated`.
-#   duplicate   EVERY OTHER live record carrying this id: a session record in
-#               another window of this same profile, or any record at all in
-#               ANOTHER profile's `sessions/` beside this window's own. That is
-#               AMENDMENT 18(h)'s second live process. The MEASURED shape was the
-#               second one — four times on 2026-09-14, the last at 18:14Z, the
-#               second record sat in another profile's directory, and 18(h) says
-#               why, *"on a launcher-configured workstation every profile's
-#               `projects/` is one shared directory … which is also why a
-#               duplicate is one `--resume` away"* — but the rule it states is
-#               one live PROCESS per transcript, not one per profile.
-#   unrelated   THIS WINDOW CARRIES NO RECORD OF THIS TRANSCRIPT AT ALL, so this
-#               read says nothing about the processes that do — beyond the one
-#               relation that is not this window's to have, the companion above
-#               (#73). That is not timidity: `live_holder` answers "is any
-#               session this row names alive" and Amendment 8(f) rules an
-#               ORPHAN reported and never refused, while `lane_forks` answers
-#               about a fork. A rule that counted every live record here would
-#               overturn both from a read that was not asked about either. ONE
-#               CALLER TAKES IT AS A BLOCKER ANYWAY AND SAYS SO WHERE IT DOES:
-#               `lane-start`'s `dup_check`, asked about the ONE id a run is
-#               about to resume, where an `unrelated` holder is a second live
-#               process on the very file that run is about to open (Amendment
-#               18(h), *"never launches a second resume of it"*). That is a
-#               narrower question than this verdict answers, so the narrowing
-#               lives at that call site and not in this table.
-#
-# 0 with rows, 8 with none, 1 where the records could not be read, 64 no uuid.
-transcript_holders() {   # <session uuid>
-  th_id="${1-}"; [ -n "$th_id" ] || return 64
-  th_files=""; th_match=""; th_err=""; th_f=""; th_blob=""
-  th_pid=""; th_kind=""; th_tgt=""; th_where=""; th_verdict=""; th_out=""
-  # `th_here_prof` AND `th_here` AMONG THEM, and the omission was not cosmetic:
-  # this file runs under `set -u` (line 292), pass 2's `[ -z "$th_here_prof" ]`
-  # is reached for the FIRST record that is not this window's, and an unset
-  # variable there exits the shell with `unbound variable` — a 1 every caller
-  # reads as "the records could not be read" and refuses on. It cost the suite's
-  # `the same lane live in THIS window is not a collision`, which asks
-  # `lane-start` for an exit 0 and got `dup_check`'s fail-closed 1.
-  th_here=""; th_here_prof=""; th_prof=""; th_wrc=0; th_final=""
-  # THE LANE'S LIVE WINDOW, for the companion verdict where this window has no
-  # record of the transcript (#73): the profile of the session record whose
-  # window this server resolves and agrees with, and whether a SECOND profile
-  # answered too, which leaves no single one to read it from.
-  th_live_win=no; th_win_prof=""; th_win_two=no
-  SESSION_FILES_ERR=""
-  here_context
-  th_files="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-tf.XXXXXX" 2>/dev/null || printf '')"
-  th_match="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-tm.XXXXXX" 2>/dev/null || printf '')"
-  th_err="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-te.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$th_files" ] || [ -z "$th_match" ] || [ -z "$th_err" ]; then
-    rm -f -- "$th_files" "$th_match" "$th_err" 2>/dev/null || :
-    SESSION_FILES_ERR="could not create a temporary file under ${TMPDIR:-/tmp}"
-    return 1
-  fi
-  # NOT `$( )`: session_files sets SESSION_FILES_ERR, and a subshell would keep
-  # the reason for the failure to itself.
-  if ! session_files > "$th_files"; then
-    rm -f -- "$th_files" "$th_match" "$th_err"
-    return 1
-  fi
-  if [ ! -s "$th_files" ]; then
-    rm -f -- "$th_files" "$th_match" "$th_err"
-    return 8
-  fi
-  # The locale and the NUL separator for the reason `live_holder` states above:
-  # these are arbitrary bytes and BSD `tr` prints nothing at all for a multibyte
-  # character in a UTF-8 locale.
-  LC_ALL=C tr '\n' '\0' < "$th_files" | xargs -0 grep -l -F -e "\"sessionId\":\"$th_id\"" > "$th_match" 2>"$th_err" || :
-  if [ -s "$th_err" ]; then
-    SESSION_FILES_ERR="$(LC_ALL=C tr '\n' ';' < "$th_err" | LC_ALL=C cut -c1-300)"
-    rm -f -- "$th_files" "$th_match" "$th_err"
-    return 1
-  fi
-  rm -f -- "$th_files" "$th_err"
-  while IFS= read -r th_f; do
-    [ -n "$th_f" ] || continue
-    th_blob="$(cat -- "$th_f" 2>/dev/null || :)"
-    [ -n "$th_blob" ] || continue
-    # The id is matched EXACTLY and not by the grep alone: a record naming this
-    # uuid inside some other field would otherwise be counted as a holder.
-    [ "$(lc "$(jstr "$th_blob" sessionId)")" = "$(lc "$th_id")" ] || continue
-    record_is_live "$th_blob" || continue
-    th_pid="$(jnum "$th_blob" pid)"
-    th_kind="$(jstr "$th_blob" kind)"
-    th_tgt="$(jstr "$th_blob" tmux)"
-    th_where=bg; th_live_win=no
-    if record_fields_are_session "$th_kind" && [ -n "$th_tgt" ]; then
-      th_wrc=0
-      record_window_state "$th_tgt" || th_wrc=$?
-      case "$th_wrc" in
-        0) th_where="window ${th_tgt%.*}"; th_live_win=yes ;;
-        1) th_where="window ${th_tgt%.*} (gone)" ;;
-        2) th_where="window ${th_tgt%.*} (no answer)" ;;
-        *) th_where="window ${th_tgt%.*} (not asked)" ;;
-      esac
-    elif record_fields_are_session "$th_kind"; then
-      th_where="no window"
-    fi
-    th_here=no
-    if [ -n "$th_tgt" ] && [ -n "$LANES_THIS_WINDOW" ] && [ "${th_tgt%.*}" = "$LANES_THIS_WINDOW" ]; then
-      th_here=yes
-    elif pid_under "$th_pid" "$LANES_PANE_PID"; then
-      th_here=yes
-    fi
-    th_prof="$(record_profile "$th_f")"
-    [ "$th_here" = yes ] && [ -z "$th_here_prof" ] && th_here_prof="$th_prof"
-    if [ "$th_live_win" = yes ]; then
-      if [ -z "$th_win_prof" ]; then th_win_prof="$th_prof"
-      elif [ "$th_win_prof" != "$th_prof" ]; then th_win_two=yes
-      fi
-    fi
-    th_out="${th_out}${th_pid:-unknown}${US}${th_kind:-interactive}${US}${th_tgt:-none}${US}${th_prof}${US}${th_where}${US}${th_here}${US}${th_f}
-"
-  done < "$th_match"
-  rm -f -- "$th_match"
-  [ -n "$th_out" ] || return 8
-  [ "$th_win_two" = yes ] && th_win_prof=""
-  # PASS 2 — THE VERDICT, WHICH NEEDS THE WHOLE SET AND SO CANNOT BE MADE ABOVE.
-  th_final=""
-  while IFS="$US" read -r tv_pid tv_kind tv_tgt tv_prof tv_where tv_here tv_file; do
-    [ -n "${tv_pid:-}" ] || continue
-    if [ "$tv_here" = yes ]; then
-      tv_v=here
-    elif [ -z "$th_here_prof" ]; then
-      # NOTHING HERE, SO THE LANE'S LIVE WINDOW ANSWERS FOR THE ONE RELATION
-      # THAT IS NOT THE ASKER'S (#73): the harness's `bg` companion beside it.
-      # Everything else stays `unrelated`, which is what every caller already
-      # reads this state as.
-      if [ -n "$th_win_prof" ] && [ "$tv_prof" = "$th_win_prof" ] && [ "$tv_kind" = bg ]; then
-        tv_v=companion
-      else
-        tv_v=unrelated
-      fi
-    elif [ "$tv_prof" = "$th_here_prof" ] && [ "$tv_kind" = bg ]; then
-      tv_v=companion
-    else
-      tv_v=duplicate
-    fi
-    th_final="${th_final}${tv_pid}${US}${tv_kind}${US}${tv_tgt}${US}${tv_prof}${US}${tv_where}${US}${tv_v}${US}${tv_file}
-"
-  done <<EOF
-$th_out
-EOF
-  printf '%s' "$th_final"
-  return 0
-}
-
-# ===================== AMENDMENT 18(b) — THE BINDING, READ ==================
-#
-# **A LANE HAS ONE BINDING**: the `host`, `container` and `window` of its last
-# lane-kind line that is `STARTED` or `RESUMED` with no `PAUSED`, `ENDED` or
-# `RETIRED` after it. A lane whose last lane-kind line is one of those three, or
-# that has none, is FREE. Ratified 2026-09-14T13:15:18Z as revision 4.
-#
-# ONE SCAN ANSWERS FOUR QUESTIONS, because three surfaces ask them of the same
-# stream and a second pass is a second answer: the `binding` read (clause (c)'s
-# refusal), the prompt guard's clause (d) — *"a `HANDOFF-REQUESTED` newer than
-# its own binding and not yet answered"* — its clause (e) — *"a `PAUSED` newer
-# than the binding that this session did not write"* — and `request-handoff`'s
-# wait, which ends when the release arrives.
-#
-# IT IS FILE ORDER AND NEVER A CLOCK (R14). A lane's log is append-only and
-# single-writer, so a line further down the file is a line written later
-# whatever the two UTC fields say — and "newer than the binding" here means
-# BELOW it in the file, which is the only order two lines of one lane really
-# share. The UTC is carried out as information, for the sentence a person reads.
-#
-# A FORK'S LINE IS NOT THE LANE'S (decision 8(c), A11 Addendum 4 ruling 8), so a
-# payload opening `fork ` is skipped exactly as `lane_row_facts` skips it: a
-# `RETIRED` about a fork would read as the LANE being retired, which is the
-# opposite of what happened.
-#
-# A LINE WRITTEN BEFORE AMENDMENT 18(a) CARRIES NONE OF THE THREE SUB-FIELDS AND
-# STAYS VALID: its binding is *"the window on the row's workstation, which is
-# what they read today"*. So `host` falls back to the line's own `@<ws>` — which
-# is the Rule 10 workstation, and is also what a container with no export writes
-# into `host` deliberately — and `container` falls back to `none`. Amendment
-# 7(i)'s cutover rule, with the fallback the clause itself names.
-#
-#   1 state       bound · requested · released · free
-#   2 host        3 container   4 window    5 utc   6 session   7 os
-#   8 request utc      9 request session    10 request payload
-#   11 release verb    12 release utc       13 release session  14 release payload
-#   15 legacy      `legacy` where the binding line predates clause (a)
-#   16 foreign release verb  17 utc  18 session  19 payload — the release
-#              ANOTHER session wrote after the session named in argument 2 wrote
-#              its own last lane-kind line, which is clause (e)-s test and which
-#              survives a later binding by a third place
-#
-# 0 with the line, 1 where the LOG COULD NOT BE READ — which is not the same
-# fact as "this lane has no binding" and never was (#26, the fail-closed family).
-lane_binding_scan() {   # <lane> [<this session uuid>]
-  lbs_lines=""; lbs_rc=0
-  lbs_lines="$(lane_log_events "$1")" || lbs_rc=$?
-  [ "$lbs_rc" = 0 ] || return 1
-  printf '%s\n' "$lbs_lines" | awk -v sep="$US" -v me="$(lc "${2-}")" '
-    function field(pay, want, whole,   n, i, sf, v, q) {
-      want = want " "
-      n = split(pay, sf, "; ")
-      for (i = 1; i <= n; i++) {
-        if (substr(sf[i], 1, length(want)) != want) continue
-        v = substr(sf[i], length(want) + 1)
-        sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-        if (substr(v, 1, 1) == "\"") {
-          q = index(substr(v, 2), "\"")
-          if (q > 0) return substr(v, 2, q - 1)
-        }
-        if (!whole) sub(/ .*$/, "", v)
-        return v
-      }
-      return ""
-    }
-    BEGIN { FS = sep; state = "free" }
-    # THIS SESSION-S OWN LAST LANE-KIND LINE, wherever it is, and the release
-    # another session wrote AFTER it — clause (e), which says EVERY prompt from
-    # then on and not merely the prompt before the next binding (Copilot round 1
-    # on this PR). Tracked beside the binding and never out of it: when a third
-    # place binds the lane after a forced release, the binding fields below move
-    # on to that new line while this pair stays exactly where it was, which is
-    # what makes the refusal persist as the clause says it must.
-    me != "" && tolower($4) == me && \
-      ($3 == "STARTED" || $3 == "RESUMED" || $3 == "PAUSED" || $3 == "ENDED" || $3 == "RETIRED") { me_pos = NR; me_verb = $3 }
-    me != "" && tolower($4) != me && ($3 == "PAUSED" || $3 == "ENDED" || $3 == "RETIRED") {
-      if (substr($8, 1, 5) != "fork ") {
-        f_pos = NR; f_verb = $3; f_utc = $1; f_sess = $4; f_pay = $8
-        # A release that NAMES this session is evidence on its own, whether or
-        # not this session ever wrote a line of its own: clause (e)-s `on behalf
-        # of <bound uuid>` is written by a place that read the binding, and the
-        # session it names may have been bound by a `lane-start` whose own
-        # STARTED was deferred for want of a uuid (Amendment 8(d), R-A8-2).
-        if (index(tolower($8), "on behalf of " me) > 0) {
-          ob_pos = NR; ob_verb = $3; ob_utc = $1; ob_sess = $4; ob_pay = $8
-        }
-      }
-    }
-    $3 == "STARTED" || $3 == "RESUMED" {
-      if (substr($8, 1, 5) == "fork ") next
-      state = "bound"; seen = 1
-      b_utc = $1; b_sess = $4; b_ws = $5; b_pay = $8
-      r_utc = ""; r_sess = ""; r_pay = ""
-      x_verb = ""; x_utc = ""; x_sess = ""; x_pay = ""
-      next
-    }
-    $3 == "HANDOFF-REQUESTED" {
-      if (state != "bound" && state != "requested") next
-      state = "requested"
-      r_utc = $1; r_sess = $4; r_pay = $8
-      next
-    }
-    $3 == "PAUSED" || $3 == "ENDED" || $3 == "RETIRED" {
-      if (substr($8, 1, 5) == "fork ") next
-      if (!seen) { state = "free"; next }
-      state = "released"
-      x_verb = $3; x_utc = $1; x_sess = $4; x_pay = $8
-      r_utc = ""; r_sess = ""; r_pay = ""
-      next
-    }
-    END {
-      host = field(b_pay, "host", 0);      if (host == "") host = b_ws
-      cont = field(b_pay, "container", 0); if (cont == "") cont = "none"
-      win  = field(b_pay, "window", 1)
-      os   = field(b_pay, "os", 0)
-      # CLAUSE (a) CUTOVER RULE, CARRIED AS A FIELD OF ITS OWN: *"A line
-      # written before this amendment carries none of the three and stays
-      # valid; readers treat its binding as THE WINDOW ON THE ROW-S
-      # WORKSTATION, which is what they read today."* What they read today has
-      # no container in it — so a pre-amendment binding must not be filed under
-      # ANOTHER container merely because the asker is in one, which on an estate
-      # whose every line predates this clause would refuse every lane start
-      # inside every bench. The fallback values above are still what the read
-      # PRINTS (`none` is the answer a reader acts on); this field says which of
-      # them were read and which were supplied.
-      # (No apostrophe anywhere in this comment: the whole program is a
-      # single-quoted shell string, and one would end it — the same rule
-      # `LANES_REGISTER_INDEX_AWK` states for its own.)
-      # LEGACY IS ALL THREE ABSENT, NOT `host` ALONE (Copilot round 2 on
-      # openRepoTools#83). The writer drops an offending sub-field on its own
-      # and keeps the line — `R-A11-11`-s posture — so a MODERN line can carry a
-      # container and an os and no host, and calling that one pre-amendment
-      # would ignore the container it does carry and let another container past
-      # the fence. All three absent is the only shape that is really a line from
-      # before this clause; anything less fails CLOSED, matched on host AND
-      # container like every other modern line.
-      legacy = (field(b_pay, "host", 0) == "" && field(b_pay, "container", 0) == "" && \
-                field(b_pay, "os", 0) == "" ? "legacy" : "")
-      if (state == "free" || state == "released") { host = ""; cont = ""; win = ""; os = ""; legacy = "" }
-      # A release by another session counts only where it came AFTER this
-      # session-s own last line. One that came before it is a lane this session
-      # has bound or handed off since, and the clause is about being released
-      # from UNDER a session, not about anything that ever happened to the lane.
-      # A release by another session counts only where it came AFTER this
-      # session-s own last line, and only where this session HAS one: a uuid
-      # that appears nowhere in this log has been released from nothing, and
-      # every fresh transcript in a lane-s window would otherwise be refused for
-      # ever by the PAUSED its predecessor wrote. The exception is a release
-      # that names this session outright, which is evidence with no line of its
-      # own needed.
-      if (ob_pos > me_pos) {
-        f_verb = ob_verb; f_utc = ob_utc; f_sess = ob_sess; f_pay = ob_pay
-      } else if (me_pos == 0 || f_pos <= me_pos) {
-        f_verb = ""; f_utc = ""; f_sess = ""; f_pay = ""
-      }
-      # AND A SESSION THAT RELEASED THE LANE ITSELF WAS TAKEN FROM NOTHING.
-      # Clause (e) is about a binding released from UNDER a session that still
-      # holds it; where this session-s own last lane-kind line is a PAUSED, an
-      # ENDED or a RETIRED, it gave the lane up, and the next place-s release of
-      # it is ordinary history. A session in that state that is somehow still
-      # running is the (b) table-s superseded-transcript row, which says the
-      # right thing about it and names the right cure.
-      if (me_verb == "PAUSED" || me_verb == "ENDED" || me_verb == "RETIRED") {
-        f_verb = ""; f_utc = ""; f_sess = ""; f_pay = ""
-      }
-      printf "%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s%c%s\n", \
-        state, 31, host, 31, cont, 31, win, 31, b_utc, 31, b_sess, 31, os, 31, \
-        r_utc, 31, r_sess, 31, r_pay, 31, x_verb, 31, x_utc, 31, x_sess, 31, x_pay, 31, legacy, 31, \
-        f_verb, 31, f_utc, 31, f_sess, 31, f_pay
-    }'
-  return 0
-}
-
-# IS THAT BINDING THIS PLACE'S? Clause (b): *"Liveness is pronounced only from
-# INSIDE the binding's own `host` and `container`, where the pid namespace is
-# the record's: from anywhere else a binding is UNKNOWN, never dead, whatever
-# `kill -0` says."* So the comparison is made ONCE, here, and every surface that
-# refuses on it reads the same answer.
-#
-# A MODERN RECORD MATCHES ON BOTH, AND ON THE HOST'S OWN NAME (Copilot round 2
-# on openRepoTools#83). The `$WS` fallback below is clause (a)'s CUTOVER
-# affordance and nothing else: a line written before this amendment carries no
-# `host`, and its binding is *"the window on the row's workstation"* — so the
-# workstation's name is all such a line has to be matched on, and the container
-# it never carried is not asked for. A line that DOES carry the three is matched
-# on what it says: the machine's own hostname AND the container. Allowing `$WS`
-# there let a record whose `host` is another machine read as `here` wherever the
-# two names happened to coincide — and `lane-start` then skips the fence, which
-# is the one refusal this clause exists to make.
-#
-# CLAUSE (a)'s OWN FALLBACK STILL WORKS THROUGH IT: a writer inside a container
-# with no `$LANES_HOST` writes the Rule 10 workstation name into `host`, and a
-# reader in that same container computes the same name the same way, so the two
-# agree without this function having to guess which of the two names it is
-# looking at.
-#
-# TWO FORMS, ONE RULE. `binding_is_here` takes the record's values as they were
-# written; `binding_is_here_lc` takes them already lower-cased, for the listing,
-# which asks this of every lane and may not spend two processes a lane on `lc`.
-# The rule is in the second and the first is two `lc`s in front of it.
-LANES_HOST_LC=""; LANES_WS_LC=""; LANES_CONTAINER_LC=""
-# THE HOST HALF ON ITS OWN, because clause (b)'s two rules need different
-# halves of it: the pid namespace is the host AND the container, while the tmux
-# server one host's launcher mounts into every container it starts is THE HOST.
-# Both take the same legacy affordance, and taking it in one place is what stops
-# them drifting — which is exactly what the review found when only one of them
-# had it (Copilot round 4 on openRepoTools#83).
-binding_host_is_here_lc() {   # <host, lower-cased> [legacy]
-  [ -n "$LANES_HOST_LC" ] || LANES_HOST_LC="$(lc "$LANES_HOST_NAME")"
-  [ -n "$LANES_WS_LC" ] || LANES_WS_LC="$(lc "$WS")"
-  [ "${1-}" = "$LANES_HOST_LC" ] && return 0
-  # THE WORKSTATION NAME IS A PRE-AMENDMENT LINE'S ONLY HANDLE, and nothing
-  # else's: a line that carries the three says which machine it is on, and
-  # accepting a second name for this one lets another machine's binding read as
-  # local wherever the two strings coincide.
-  [ "${2-}" = legacy ] && [ "${1-}" = "$LANES_WS_LC" ] && return 0
-  return 1
-}
-binding_is_here_lc() {   # <host, lower-cased> <container, lower-cased> [legacy]
-  binding_host_is_here_lc "${1-}" "${3-}" || return 1
-  [ "${3-}" = legacy ] && return 0
-  [ -n "$LANES_CONTAINER_LC" ] || LANES_CONTAINER_LC="$(lc "$LANES_CONTAINER_NAME")"
-  [ "${2-}" = "$LANES_CONTAINER_LC" ] || return 1
-  return 0
-}
-binding_is_here() {   # <host> <container> [legacy]
-  binding_is_here_lc "$(lc "${1-}")" "$(lc "${2-}")" "${3-}"
-}
-
-# IS THIS THE SAME BINDING AS THE ONE THAT WAS READ? Five fields and not two
-# (Copilot round 7 on openRepoTools#83). A binding is `host`, `container` and
-# `window` — that is clause (b)'s own definition — and the UTC and session are
-# what tell one of them from the next at the same place. Compared on the UTC and
-# the session alone, a lane released and REBOUND within the same second by a
-# process carrying the same transcript id reads as unchanged, and the act that
-# follows the comparison (a forced `PAUSED`, or carrying on into a bind) lands
-# on a holder that arrived after the read. The log has a one-second UTC and this
-# estate resumes one transcript from several places, so neither field is
-# distinguishing on its own.
-#
-# TEN ARGUMENTS IN TWO GROUPS OF FIVE, in the order `binding` prints them.
-binding_identity_same() {   # <h1> <c1> <w1> <u1> <s1>  <h2> <c2> <w2> <u2> <s2>
-  [ "${1-}" = "${6-}" ] || return 1
-  [ "${2-}" = "${7-}" ] || return 1
-  [ "${3-}" = "${8-}" ] || return 1
-  [ "${4-}" = "${9-}" ] || return 1
-  [ "${5-}" = "${10-}" ] || return 1
-  return 0
-}
-
-# THE ONE EXCEPTION CLAUSE (b) CARVES OUT, AND ITS FENCE. *"Where the asker and
-# the binding share a tmux server (the launcher mounts one socket into every
-# container it starts on a host) and the binding's window no longer exists
-# there, the binding is DEAD — the pane a session must live in is gone."*
-#
-# THE SHARED SERVER IS THE **HOST**, NOT THE CONTAINER: that is the whole point
-# of the exception, because two benches on one machine see one tmux and neither
-# can see the other's pids. So the window is asked about wherever the `host`
-# matches, container or no container, and never where it does not — a window id
-# from another MACHINE resolving here would be a coincidence, and matching it is
-# how a lane binds to a stranger's pane.
-#
-# THE ID *AND* THE SESSION, which is Amendment 11(h)'s agreement rule and the
-# 2026-09-14 measurement behind it: tmux reuses window ids once a window is
-# gone, and a stale record's `@1` resolved to a window of another session.
-#
-#   live     the window is there and its session agrees
-#   gone     the id resolves nowhere here, or resolves in another session
-#   unknown  not this host, no `@id` in the record, or no tmux to ask — and
-#            UNKNOWN IS NEVER DEAD, which is the clause's own word
-binding_window_state() {   # <host> <window sub-field> [legacy]
-  bws_host="${1-}"; bws_win="${2-}"
-  # THE SHARED SERVER IS THE HOST, AND THE HOST IS MATCHED BY THE ONE RULE
-  # `binding_is_here` USES (Copilot round 4 on openRepoTools#83). This test
-  # accepted the Rule 10 workstation name for EVERY record, so a MODERN line
-  # naming another machine could be judged `gone` here — and `gone` is the one
-  # answer that makes a binding elsewhere read DEAD and hands `lane-start` and
-  # `lane` the takeover path. A takeover of another machine's lane, out of a
-  # name that happened to coincide, is the collision this clause exists to stop,
-  # reached through its own exception.
-  binding_host_is_here_lc "$(lc "$bws_host")" "${3-}" || { printf 'unknown\n'; return 0; }
-  [ -n "$bws_win" ] || { printf 'unknown\n'; return 0; }
-  # `<session>:<index> <@id>` — two space-separated refs in ONE sub-field
-  # (Amendment 11(c)). The id is the second; a record that carries only the ref
-  # cannot be tested by the agreement rule at all.
-  bws_ref="${bws_win%% *}"
-  bws_id="${bws_win##* }"
-  case "$bws_id" in @[0-9]*) : ;; *) printf 'unknown\n'; return 0 ;; esac
-  command -v tmux >/dev/null 2>&1 || { printf 'unknown\n'; return 0; }
-  bws_now="$(tmux_window_field "$bws_id" '#{session_name}' 2>/dev/null || :)"
-  # `gone` IS THE ID RESOLVING NOWHERE, AND NOTHING ELSE (Copilot round 6 on
-  # openRepoTools#83). An id that resolves in ANOTHER session is two different
-  # facts wearing one answer: tmux reuses ids, so it may be a stranger's
-  # window — and `lane <name>` MOVES a live lane's window into the asking
-  # session (Addendum 1 (i-2)), which leaves the record naming the session it
-  # came from while the very same window, with the very same id, is alive one
-  # session along. Answered `gone`, that move would make a RUNNING lane read as
-  # a dead binding, and `gone` is the one answer that hands `lane-start` and
-  # `lane` the takeover path: a second process on a lane whose window a person
-  # had just pulled in front of themselves.
-  #
-  # So the two are separated and only the first is DEAD. The second is
-  # `unknown` — not this place's to pronounce, which is clause (b)'s own posture
-  # everywhere else — and it costs the takeover path exactly the case where an
-  # id has been reused, which was never a proof of death either. The RECORD
-  # going stale under a move is a real gap and it is filed, not papered over
-  # here: `lane` writes nothing to the register by design (Addendum 1), so
-  # keeping that field current is an act somebody has to rule on
-  # (opensoft/openRepoTools#95).
-  #
-  # AND AN EMPTY ANSWER IS TWO FACTS, OF WHICH ONLY ONE IS DEAD (Copilot round 9
-  # on openRepoTools#83). `bws_now` comes back EMPTY both where the id resolves
-  # nowhere and where there is NO SERVER TO ASK AT ALL — a container the host's
-  # socket was never mounted into, a server not started yet, a `$TMUX_TMPDIR`
-  # that differs, a socket this user cannot read. AND THE STATUS IS NOT THE
-  # DISCRIMINATOR: measured on tmux 3.4, an id that resolves nowhere on a server
-  # that IS there answers `0` with an empty stdout, while no server at all
-  # answers 1 with an empty stdout and `error connecting to … (No such file or
-  # directory)` on stderr — which `tmux_window_field` sends to `/dev/null` and
-  # this read discards with `|| :`. `command -v tmux` catches only the
-  # workstation that has no tmux BINARY, and the two are not the same
-  # workstation. Read as `gone`, the second one makes
-  # EVERY binding of every other container on this host read DEAD — the one
-  # answer that hands `lane-start` and `lane` the takeover path — which is this
-  # clause's own collision reached through its own exception, on the very estate
-  # the exception was written for. The contract three lines above already says
-  # *"no tmux to ask"* is `unknown`; this is the code saying it too.
-  #
-  # SO THE SERVER IS ASKED A QUESTION THAT DOES NOT MENTION THE ID, and only a
-  # server that ANSWERS may pronounce. One extra fork, and only on the read that
-  # was about to say DEAD.
-  if [ -z "$bws_now" ]; then
-    tmux list-windows -a -F '#{window_id}' >/dev/null 2>&1 || { printf 'unknown\n'; return 0; }
-    printf 'gone\n'; return 0
-  fi
-  [ "$bws_now" = "${bws_ref%%:*}" ] || { printf 'unknown\n'; return 0; }
-  printf 'live\n'
-  return 0
-}
-
-# ============ AMENDMENT 18(c)/(d)/(e) — THE SECOND PLACE ASKS ===============
-#
-# *"`lane-start <repo> <n>` and `restart <lane>` run from a place that is not the
-# binding — a different `host`, `container` or `window` — REFUSE to bind. … A
-# `y`, or the flag `--request-handoff` from a caller with no terminal, is THE
-# REQUEST, and it is written before anything else is tried … Then, WHERE THE
-# BOUND PANE IS ON THIS TMUX SERVER, the requester also types `/handoff --exit
-# requested by <uuid>@<host>/<container>` into that pane … The requester then
-# WAITS … When one arrives the lane is free and the requester binds as it would
-# have."*
-#
-# THE MECHANISM IS HERE AND THE QUESTION IS AT THE DOOR. `lane-start` and `lane`
-# each ASK in their own words — one is a launch that has already been typed, the
-# other a pick out of a listing — and both then call THIS, so the line that is
-# written, the pane that is typed into, the interval that is polled and the
-# refusal that ends an empty wait are one implementation. That is the rule
-# clause (h) gives `window-lane` and the one A11 Addendum 4 ruling 7 gave column
-# 10 after two surfaces had each computed a restart line of their own.
-#
-# THE ORDER IS THE CLAUSE'S AND IT IS LOAD-BEARING: the line is written and
-# PUSHED FIRST, so that a bound session anywhere can read it from `origin`, and
-# only then is the pane typed into — which is an optimisation for the same-host
-# case and never the request itself. A request that could not be written is not
-# a request, and nothing is typed on the strength of one.
-#
-#   $LANES_POLL_SECONDS   the poll interval (default 15) — the one seam, and it
-#                         is the suite's: a case that must watch a wait end
-#                         cannot spend fifteen seconds per poll doing it.
-
-# THE REQUESTER'S OWN TRANSCRIPT UUID, which the line's `session` field is and
-# which Amendment 7(b) admits nothing else into (clause (e), enforced in
-# `write_event`). Four sources, first answer wins: the flag, `$LANES_SESSION`,
-# the harness's own `$CLAUDE_CODE_SESSION_ID`, and the live record of THIS
-# window. A caller with none of them is REFUSED rather than given a placeholder:
-# the literal `unknown` is in this estate's append-only log four times already
-# and no later line corrects any of them.
-requester_uuid() {   # [<--session value>]
-  ru_v="${1-}"
-  [ -n "$ru_v" ] || ru_v="${LANES_SESSION:-}"
-  [ -n "$ru_v" ] || ru_v="${CLAUDE_CODE_SESSION_ID:-}"
-  if [ -z "$ru_v" ]; then
-    here_context
-    if [ -n "$LANES_THIS_WINDOW" ]; then
-      ru_rec="$(window_session "$LANES_THIS_WINDOW" 2>/dev/null || :)"
-      [ -n "$ru_rec" ] && ru_v="${ru_rec%%"$US"*}"
-    fi
-  fi
-  valid_uuid "$ru_v" || return 8
-  printf '%s\n' "$(lc "$ru_v")"
-}
-
-# THIS WINDOW'S OWN `@id`, for the one comparison clause (c) needs before it
-# writes anything: a request to hand off the window you are standing in is not a
-# request, it is a loop. `here_context` gives `<session>:<@id>`; a record's
-# `window` sub-field is `<session>:<index> <@id>`, so the ids are what compare.
-binding_is_this_window() {   # <window sub-field>
-  bitw_id="${1##* }"
-  case "$bitw_id" in @[0-9]*) : ;; *) return 1 ;; esac
-  here_context
-  [ -n "$LANES_THIS_WINDOW" ] || return 1
-  [ "${LANES_THIS_WINDOW##*:}" = "$bitw_id" ] || return 1
-  return 0
-}
-
-# THE FACTS A PERSON NEEDS TO DECIDE, in one place, so the question `lane-start`
-# asks, the question `lane` asks and the refusal that ends an empty wait all
-# name the same things (clause (e): *"the binding (`host`, `container`,
-# `window`, the line and its `UTC`), the request and its `UTC`, whether the pane
-# was reachable and typed into, and the one word that overrides"*).
-binding_facts() {   # <lane> <host> <container> <window> <utc> <session> <window state>
-  printf 'lane %s is bound to window %s in container %s on host %s (session %s, last line %s); this tmux server says that window is %s\n' \
-    "$1" "${4:-none}" "${3:-none}" "${2:-unknown}" "${6:-unknown}" "${5:-unknown}" "${7:-unknown}"
-}
-
-# The UTC of the lane's last `STARTED` or `RESUMED` — Amendment 18(b)'s BINDING,
-# read from the lane's own log out of `origin/<branch>` like every other state
-# read. Clause (h) rule 2 compares a record's `nameSince` against it: a rename
-# OLDER than the binding is a title this window inherited, not an instruction
-# somebody has just given. 0 with the stamp, 8 where the log names none, 1 where
-# it could not be read.
-lane_binding_utc() {   # <lane>
-  lbu_lines=""; lbu_rc=0
-  lbu_lines="$(lane_log_events "$1")" || lbu_rc=$?
-  [ "$lbu_rc" = 0 ] || return 1
-  lbu_v="$(printf '%s\n' "$lbu_lines" | awk -F"$US" '$3 == "STARTED" || $3 == "RESUMED" { v = $1 } END { if (v != "") print v }')"
-  [ -n "$lbu_v" ] || return 8
-  printf '%s\n' "$lbu_v"
-}
-
-# ------------------------------------------------- (h)'s ONE ACT ON A PANE
-#
-# M1, ratified: *"the guard and the `SessionStart` hook rename by TYPING
-# `/rename <lane>` into the session's own tmux pane with `tmux send-keys`: the
-# only path that exists, run from inside the pane, only after the prompt has
-# been refused and only while the pane's current command is `claude`."*
-#
-# THE PANE'S CURRENT COMMAND IS ASKED FIRST, and a pane that is running anything
-# else is NOT typed into: `/rename openRepoTools-3` typed at a shell is a command
-# that does not exist, and typed into an editor it is text somebody did not
-# write.
-#
-# `claude` AND NOTHING ELSE, which is M1's own word — *"only while the pane's
-# current command is `claude`"*. This test read `claude|node` for one round, on
-# the reasoning that the harness is a node program and this format reports the
-# process rather than the wrapper; MEASURED on Eagle 2026-09-14T23:4xZ, across
-# the twelve panes tmux had, it is not: eleven lane panes report `claude`, two
-# report `bash` (a pane whose session is under a launcher wrapper) and one
-# `zsh`, and no pane reports `node` at all. So `node` bought nothing here and
-# would have let a stray Node REPL in a pane take `/rename <lane>` as input
-# (Copilot round 4 on this PR). A pane this refuses is not a lock that failed:
-# the caller prints the line for the person to type, which is the cure — and on
-# this estate today the `bash` panes are exactly where they will read it.
-#
-#   0  typed
-#   1  no tmux, or `send-keys` itself refused
-#   8  the pane's current command could not be read — fail closed, type nothing
-#   9  the pane is running something else
-guard_type() {   # <pane target> <the line to type>
-  gt_pane="${1-}"; gt_text="${2-}"
-  [ -n "$gt_text" ] || return 1
-  command -v tmux >/dev/null 2>&1 || return 1
-  # THE RECORD'S PANE, ELSE THIS ONE — AND THIS ONE IS THE RIGHT FALLBACK
-  # BECAUSE OF WHERE THIS CODE RUNS. The pane comes from the live record's
-  # `tmux` field, and the harness has been seen to write NO `tmux` at all for a
-  # process plainly in a window (Amendment 8, ruling (g)'s third fact) — a
-  # record `transcript_holders` and `record_is_here` still place HERE, by the
-  # pane's own process tree. With an empty target the lock used to print "tmux
-  # would not take the keys" and type nothing, for a session whose name it could
-  # have fixed (Copilot round 2 on this PR). Both callers of this function run
-  # INSIDE the session's own pane — a `UserPromptSubmit` hook and a
-  # `SessionStart` hook do — so `#{pane_id}` with no `-t` is that session's
-  # pane, asked of tmux rather than guessed, and M1's condition below is still
-  # asked of whatever pane this resolves to.
-  [ -n "$gt_pane" ] || gt_pane="$(tmux display-message -p '#{pane_id}' 2>/dev/null || :)"
-  [ -n "$gt_pane" ] || return 1
-  gt_cmd="$(tmux_window_field "$gt_pane" '#{pane_current_command}' 2>/dev/null || :)"
-  [ -n "$gt_cmd" ] || return 8
-  case "$gt_cmd" in claude) : ;; *) return 9 ;; esac
-  tmux send-keys -t "$gt_pane" "$gt_text" Enter 2>/dev/null || return 1
-  return 0
-}
-
-# THE PENDING OFFER, held per session id and expiring with the session (clause
-# (h) rule 2). It is a file and not a variable because the next prompt is a
-# different process: `$CLAUDE_CONFIG_DIR/lanes/offers/<uuid>`, the harness's own
-# per-profile configuration directory, which is where a fact about one session
-# belongs and is not the register.
-guard_offer_file() {   # <session uuid>
-  printf '%s/lanes/offers/%s\n' "${CLAUDE_CONFIG_DIR:-$HOME/.claude}" "${1-}"
-}
-
-# `lane-start`, found the way every word in this toolset finds its siblings:
-# beside this file first — `--install` places them in one directory — then on
-# PATH. One resolution, so a workstation with two copies never reads one and
-# runs the other. `$LANES_LANE_START` is the seam the suite sets.
-#
-# NAMED AS A SIBLING OF THIS FILE AND NOT OF ANY PARTICULAR WORD, because
-# Amendment 18 Addendum 2 (in force 2026-09-14T16:50:32Z) takes `restart` off a
-# person's PATH altogether — "i think we can drop restart as a cli command and
-# keep it inside a claude session with /restart … lane does all the things a
-# user wants" — and opensoft/openRepoTools#43 removes the file. A comment that
-# pointed at it for its resolution order would name a file that is going.
-guard_lane_start() {
-  if [ -n "${LANES_LANE_START:-}" ]; then printf '%s\n' "$LANES_LANE_START"; return 0; fi
-  if [ -x "$SCRIPT_DIR/lane-start" ]; then printf '%s\n' "$SCRIPT_DIR/lane-start"; return 0; fi
-  command -v lane-start 2>/dev/null || printf ''
-}
-
-# ------------------------------------------------------- the triple, printed
-#
-# EVERY REFUSAL PRINTS THE THREE NAMES AS THEY STAND, and prints them ONCE
-# however many things are wrong. What a person sees is the state and then the
-# one command, which is F-B6's rule — filled in, never `<repo> <n>`.
-G_WINREF=""; G_WINNAME=""; G_ID=""; G_NAME=""; G_SRC=""; G_PID=""; G_PROF=""
-G_ROW=""; G_LANE=""; G_SES_LANE=""
-# AMENDMENT 16(f) — the former name this window still carried, and whether the
-# guard managed to rename the window to the lane's current one.
-G_WIN_WAS=""; G_WIN_FIXED=0
-GUARD_TRIPLE_DONE=0
-GUARD_RENAME_SAID=0
-# SAID ONCE, WHEREVER THE RUN ENDS. The guard's own rename of a window is the
-# one act it takes that is not a refusal, so it is announced on the agreeing
-# path too — a lock that silently did something is a lock nobody knows about,
-# which is the rule `guard_lock_rename` already states for the typing.
-guard_window_renamed_note() {
-  [ -n "$G_WIN_WAS" ] || return 0
-  [ "$GUARD_RENAME_SAID" = 0 ] || return 0
-  GUARD_RENAME_SAID=1
-  if [ "$G_WIN_FIXED" = 1 ]; then
-    note "THIS WINDOW WAS NAMED '$G_WIN_WAS', WHICH IS A FORMER NAME OF LANE $G_LANE (${LANES_ALIASES_PATH:-lanes/aliases.tsv}, Amendment 16(e)) — so it has been renamed to $G_LANE for you (Amendment 16(f): a rename run from another window leaves this one to fix at its next prompt, and a window's name is one tmux call, not a typed one)."
-  else
-    note "THIS WINDOW IS NAMED '$G_WIN_WAS', WHICH IS A FORMER NAME OF LANE $G_LANE (${LANES_ALIASES_PATH:-lanes/aliases.tsv}, Amendment 16(e)), and tmux would not rename it. Rename it yourself: tmux rename-window -t ${G_WINREF:-<this window>} $G_LANE"
-  fi
-  return 0
-}
-#
-# THE HEADING IS AN ARGUMENT BECAUSE ONE CALLER DOES NOT REFUSE. An explicitly
-# allowed mismatch (choice 1 below) prints the same three names and then lets
-# the prompt through, and a line reading "THE NAME GUARD REFUSES THIS PROMPT"
-# over a prompt it has just allowed is the guard lying about its own act. Every
-# other caller passes nothing and gets the refusal heading unchanged.
-guard_triple() {   # [<heading>]
-  [ "$GUARD_TRIPLE_DONE" = 0 ] || return 0
-  GUARD_TRIPLE_DONE=1
-  gt_s="${G_ID:-unknown} '${G_NAME:-none}'"
-  [ -n "$G_SRC" ] && gt_s="$gt_s (nameSource $G_SRC)"
-  [ -n "$G_PID" ] && gt_s="$gt_s pid $G_PID"
-  [ -n "$G_PROF" ] && gt_s="$gt_s profile $G_PROF"
-  gt_w="${G_WINREF:-not in tmux} '${G_WINNAME:-none}'"
-  [ -n "$G_WIN_WAS" ] && gt_w="$gt_w — a former name of $G_LANE (Amendment 16(e))"
-  note "${1:-THE NAME GUARD REFUSES THIS PROMPT (lane-collision-protocol Amendment 12). The three names:}"
-  note "  window   $gt_w"
-  note "  session  $gt_s"
-  note "  row      ${G_ROW:-not read}"
-  guard_window_renamed_note
-  return 0
-}
-
-# SAFE-MODE RECOVERY, NAMED WHERE A PERSON COULD BE STUCK (clause (d)).
-# Profile-only launches are exempt through `CLAUDE_NO_LANE=1` at dispatch.
-# Claude's `--safe-mode` disables every hook and is visible in the prompt box; a
-# session started that way is not a lane session and may not write the register
-# or claim an object. It is printed by the INDETERMINATE refusals — the reads
-# that could not be made — and not by the mismatches, which have a cure of their
-# own one line above.
-guard_bypass() {
-  printf '%s' "If this workstation cannot answer at all, \`claude --safe-mode\` runs with every hook off — and a session started that way is NOT a lane session: it may not write the register or claim an object."
-}
-
-# <why> [<the one command, filled in>] — the shape of every row of the (b)
-# table: the triple, one sentence saying what is wrong, and one line to type.
-guard_refuse() {
-  guard_triple
-  note "$1"
-  [ -n "${2-}" ] && note "run: $2"
-  return 2
-}
-
-# ============================== `guard` ==============================
-#
-# THE (b) TABLE, ONE ROW PER STATE AND ONE CURE EACH, in the amendment's own
-# order. Every message prints the register's own spelling of the lane
-# (Amendment 15) and every command is filled in — or, for a lane named before
-# Rule 4, which leaves its checkout unknown, SAYS it cannot be
-# (`guard_refuse_start`, openRepoTools#73).
-#
-#   the window is not a lane, the session name parses as `<repo>-<n>`
-#       -> `lane-start --no-launch <repo> <n>`               THE 2026-09-10 CASE
-#   the window is not a lane, and neither is the session name
-#       -> `lane-start <repo> <n>` for the lane this work is — the guard cannot
-#          name it
-#   the window is a lane, this uuid is the row's LAST id, the session name is
-#   not a lane name (untitled, a fallback, `<lane> (N)`, any word that does not
-#   parse)                       -> THE LOCK RENAMES IT, and says so
-#   … the session name is ANOTHER lane's and a PERSON set it after the binding
-#                                -> THE OFFER (D5)
-#   the window is a lane, this uuid is IN the cell but not last
-#       -> Amendment 8's cure: exit, `lane-start <repo> <n>`
-#   the window is a lane, this uuid is in NO row
-#       -> Amendment 8's cure: `lane-start --no-launch <repo> <n>`
-#   the window is a lane whose name matches TWO rows, or the register cannot be
-#   read                         -> refuse naming the read
-#   not inside tmux at all       -> refuse (D2): a lane runs in a tmux window
-#                                   named for it
-#
-# AND THE AGREEING CASE IS SILENT AND COSTS NOTHING, which is the property that
-# makes a hook at every prompt bearable at all.
-guard_run() {   # <the hook's JSON, on stdin already read>
-  gr_json="${1-}"
-
-  # ---- (e) SCOPE, and the two exemptions are the cheapest tests there are.
-  #
-  # A SUBAGENT IS EXEMPT: subagents do not submit prompts, and the lane that
-  # runs them has already passed this guard. The hook input carries `agent_id`
-  # for one and nothing else does.
-  [ -z "$(jstr "$gr_json" agent_id)" ] || return 0
-  # OUTSIDE THE PROJECTS ROOT THE GUARD IS SILENT (D1). A name there is a title
-  # and nothing more. INPUT THAT NAMES NO `cwd` AT ALL is not "outside": it is a
-  # read that did not happen, and clause (d) refuses those.
-  gr_cwd="$(jstr "$gr_json" cwd)"
-  if [ -z "$gr_cwd" ]; then
-    guard_refuse "the hook input carried no \`cwd\`, so whether this session is under the projects root — the whole of clause (e)'s scope — could not be read, and an indeterminate read refuses (Amendment 12(d)). $(guard_bypass)"
-    return 2
-  fi
-  under_projects_root "$gr_cwd" "${PROJECTS_ROOT:-$HOME/projects}" || return 0
-
-  G_ID="$(lc "$(jstr "$gr_json" session_id)")"
-  gr_prompt="$(jstr "$gr_json" prompt)"
-
-  # ---- THE WORKSPACE. Every other subcommand dies 1 here (the dispatcher's
-  # own guard, which this verb is exempt from); this one refuses with 2,
-  # because 1 does not block a prompt and clause (d) is fail CLOSED: a register
-  # that cannot be located is not a register that agrees.
-  if [ -z "$LANES_REPO" ] || [ -z "$LANES_DIR" ] || [ ! -f "$LANES_FILE" ]; then
-    guard_refuse "the ROW cannot be read, so the triple cannot be verified — and a triple that cannot be verified is not a triple that agrees (Amendment 12(d)). $(lanes_workspace_why) $(guard_bypass)"
-    return 2
-  fi
-
-  # ---- (b)'s LAST ROW: NOT INSIDE TMUX AT ALL (D2, "Refuse").
-  here_context
-  if [ -z "$LANES_THIS_WINDOW" ]; then
-    if [ -z "${TMUX:-}" ]; then
-      guard_refuse "this session is not in a tmux window at all, and a lane RUNS in a tmux window named for it (Rule 4, Amendment 2). Open one and start the lane there." "lane-start <repo> <n>   (in a tmux window)"
-    else
-      guard_refuse "tmux did not answer \`display-message -p '#{session_name}:#{window_id}'\`, so the WINDOW half of the triple could not be read — and an indeterminate read refuses (Amendment 12(d)). $(guard_bypass)"
-    fi
-    return 2
-  fi
-  G_WINREF="$LANES_THIS_WINDOW"
-  G_WINNAME="$(tmux display-message -p '#W' 2>/dev/null || :)"
-  if [ -z "$G_WINNAME" ]; then
-    guard_refuse "tmux did not answer \`display-message -p '#W'\` for $G_WINREF, so the WINDOW's name could not be read — and an indeterminate read refuses (Amendment 12(d)). $(guard_bypass)"
-    return 2
-  fi
-
-  # ---- THE LIVE RECORD FOR THIS SESSION, AND AMENDMENT 18(h)'s COUNT, IN ONE
-  # READ. The hook is handed its own `session_id` by the harness, so the
-  # question asked is "which live processes carry THIS transcript", which is
-  # both halves at once and is the cheap shape (`transcript_holders` states the
-  # measurement). `window_session` asks the other question — "what is live in
-  # this window" — by parsing every record on the workstation, and at 11.8 s
-  # against 329 of them on 2026-09-14 it cannot run inside a five-second hook.
-  #
-  # NOT `$( )`: `transcript_holders` sets `SESSION_FILES_ERR`, and a subshell
-  # would keep the reason for the failure to itself.
-  gr_tmp="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-gd.XXXXXX" 2>/dev/null || printf '')"
-  if [ -z "$gr_tmp" ]; then
-    guard_refuse "no temporary file could be made under ${TMPDIR:-/tmp}, so this workstation's session records could not be read (Amendment 12(d)). $(guard_bypass)"
-    return 2
-  fi
-  gr_rc=0
-  transcript_holders "$G_ID" > "$gr_tmp" || gr_rc=$?
-  if [ "$gr_rc" != 0 ] && [ "$gr_rc" != 8 ]; then
-    rm -f -- "$gr_tmp"
-    guard_refuse "this workstation's session records could not be read (${SESSION_FILES_ERR:-unknown error}), so the SESSION's own name could not be read — and an indeterminate read refuses (Amendment 12(d)). $(guard_bypass)"
-    return 2
-  fi
-  gr_here=""; gr_here_tgt=""; gr_others=""
-  while IFS="$US" read -r gh_pid gh_kind gh_tgt gh_prof gh_where gh_verdict gh_file; do
-    [ -n "${gh_pid:-}" ] || continue
-    # A COMPANION IS NEITHER — not this window's record and not a second
-    # process — so it is passed over in silence, which is Amendment 8 ruling
-    # (g)'s own posture. Two records of ONE session in ONE pane are that
-    # session seen twice, and the WINDOWED one is the better witness of it.
-    case "$gh_verdict" in
-      here)
-        if [ -z "$gr_here" ] || { [ "$gr_here_tgt" = none ] && [ "$gh_tgt" != none ]; }; then
-          gr_here="$gh_pid$US$gh_kind$US$gh_tgt$US$gh_prof$US$gh_file"; gr_here_tgt="$gh_tgt"
-        fi ;;
-      duplicate)
-        gr_others="${gr_others}${gr_others:+, }pid $gh_pid ($gh_where, kind $gh_kind, profile $gh_prof)" ;;
-    esac
-  done < "$gr_tmp"
-  rm -f -- "$gr_tmp"
-  if [ -z "$gr_here" ]; then
-    guard_refuse "no live session record in THIS window ($G_WINREF) carries this session id, so the SESSION's own name could not be read — and an indeterminate read refuses (Amendment 12(d)). The records were read; none of them is this window's. $(guard_bypass)"
-    return 2
-  fi
-  IFS="$US" read -r G_PID gr_kind gr_tgt G_PROF gr_file <<<"$gr_here"
-  gr_blob="$(cat -- "$gr_file" 2>/dev/null || :)"
-  G_NAME="$(jstr "$gr_blob" name)"
-  G_SRC="$(jstr "$gr_blob" nameSource)"
-  # THE PANE ONLY FROM A TARGET THAT NAMES THIS WINDOW. `here` is true by the
-  # record's target OR by the pane's own process tree, and tmux REUSES window
-  # ids — so a record that is here BY ANCESTRY can carry a target another
-  # window now answers to, and `/rename` typed into it would land in somebody
-  # else's pane. M1's gate cannot catch that one: the other pane is running
-  # `claude` too (Copilot round 3 on this PR). Where the record's target does
-  # not name this window the pane is left EMPTY, and `guard_type` asks tmux for
-  # the pane this hook is running in, which is the session's own.
-  gr_pane=""
-  if [ -n "$gr_tgt" ] && [ -n "$LANES_THIS_WINDOW" ] && [ "${gr_tgt%.*}" = "$LANES_THIS_WINDOW" ]; then
-    case "$gr_tgt" in *.%*) gr_pane="${gr_tgt##*.}" ;; esac
-  fi
-
-  # ---- THE REGISTER'S TEXT, TESTED POSITIVELY, ONCE, BEFORE THE ROW IS READ
-  # (openRepoTools#60). `register_text` prefers `origin/<branch>` and falls back
-  # to this checkout's file, and where both come back empty — a file this
-  # checkout cannot open, with no published copy — it answers EMPTY TEXT AND 0,
-  # because it ends in a `printf`. Every read below then finds no rows, and the
-  # table refused by its LAST arm, "whose row does not name this uuid at all",
-  # with a cure that cannot mend a read that did not happen. A status on
-  # `rows_named_ci` is not the place: its status is its awk's, which says nothing
-  # about the text, and it is shared with `canon_lane` and Amendment 15's
-  # callers. The awk below has one job, and its status IS the answer.
-  # HERE, AND NOT BESIDE THE WORKSPACE TEST WHERE #60 PROPOSED IT: there neither
-  # the window nor the session has been read yet, so the triple this refusal
-  # prints said `not in tmux` about a session that is. Here it names both, and
-  # `row not read`, which is the one thing that is not known.
-  # IT COSTS ONE `cat` AND ONE `awk`, ~6 ms on a 1.3 MB register: the text is
-  # cached beside `$SE_CACHE_FILE` for the life of this process, so this is the
-  # render the first read below would have made, moved here — `GIT_TRACE` counts
-  # one `git show` of the register per prompt with this test and without it. It
-  # is streamed and not captured: `$( )` of the same megabyte measured ~30 ms.
-  if ! register_text 2>/dev/null | awk 'NF { t = 1 } END { exit !t }'; then
-    guard_refuse "the register's TEXT could not be read — neither \`origin/$LANES_BRANCH:$LANES_PATH\` nor $LANES_FILE rendered a line — so the ROW cannot be read and the triple cannot be verified. A register that could not be read is not a register with no row for this lane, and an indeterminate read refuses (Amendment 12(d)). $(guard_bypass)"
-    return 2
-  fi
-
-  # ---- THE ROW, from `origin/<branch>` as this checkout last had it (R19), and
-  # every comparison case-insensitive with the register's spelling printed
-  # (Amendment 15).
-  # AMENDMENT 16(e) — BOTH LOOKUPS RESOLVE AN ALIAS. A rename run from another
-  # window leaves this one named for the lane as it was (clause (f) says so in
-  # as many words), and read byte for byte that window names no row at all: the
-  # guard would send a running lane to `lane-start --no-launch` for a row it
-  # already has, under a name the register no longer carries. `rows_named_ci_alias`
-  # is `rows_named_ci` with the table behind it, so the row this window's name
-  # answers for is the row the lane is in today.
-  # AND A TABLE THIS READ COULD NOT OPEN REFUSES THE PROMPT (Copilot round 3 on
-  # openRepoTools#81). `|| :` made an unreadable `lanes/aliases.tsv` look like
-  # "this name is no lane", and the `lane_shaped` fallback below then bound the
-  # window's own former spelling — sending a running lane to `lane-start
-  # --no-launch` for a row it already has. Clause (d) is fail CLOSED and this is
-  # exactly its shape: a triple that cannot be verified is not a triple that
-  # agrees.
-  # `gr_warc` AND NOT `gr_arc`, WHICH THIS FUNCTION NOW USES FOR THE ANSWER'S
-  # STATUS (#87). Both are set before every read of them, so nothing leaked;
-  # one name for two questions in one function is the kind of thing that only
-  # stays harmless until somebody moves a block. It pairs with `gr_sarc`, the
-  # session-name read below.
-  gr_warc=0
-  gr_hits="$(rows_named_ci_alias "$G_WINNAME" 2>/dev/null)" || gr_warc=$?
-  if [ "$gr_warc" = 5 ]; then
-    guard_refuse "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), so whether this window's name '$G_WINNAME' is a FORMER name of a lane could not be established — and an indeterminate read refuses (Amendment 12(d), Amendment 16(e)). $(guard_bypass)"
-    return 2
-  fi
-  gr_n="$(printf '%s' "$gr_hits" | grep -c . || :)"
-  if [ "$gr_n" -gt 1 ]; then
-    guard_refuse "the register holds $gr_n rows whose lane names differ only by case for this window's name '$G_WINNAME': $(printf '%s' "$gr_hits" | tr '\n' ' '). A lane name is ONE name under any case (Amendment 15), so no read under it is unambiguous and a register that cannot be read is not a register that agrees (Amendment 12(b))." "merge them into one row (Amendment 15(d)) — append the newer row's session id(s) to the older row's session cell, in order, and remove the newer row in the SAME commit"
-    return 2
-  fi
-  if [ "$gr_n" = 1 ]; then G_LANE="$gr_hits"
-  elif lane_shaped "$G_WINNAME"; then G_LANE="$G_WINNAME"
-  fi
-
-  # ---- AMENDMENT 16(f) — AND THE WINDOW IS RENAMED HERE, not merely reported.
-  # The two halves of the triple are fixed by different acts for a reason: a
-  # running session's NAME can only be changed from inside it, which is why
-  # (h)1's lock TYPES `/rename`, while a WINDOW's name is one tmux call any
-  # client can make — `lane-start:1849` makes exactly this one. So where this
-  # window still carries a former name of its lane, the guard renames it and
-  # says so, rather than refusing a prompt over a difference it can close
-  # itself. It costs nothing where no lane was ever renamed: `G_WIN_WAS` is set
-  # only when the alias table answered above.
-  #
-  # UNTARGETED, LIKE `lane-start:1849` AND `lane-handoff:517`. This hook runs
-  # INSIDE the session's own pane, so tmux's current window IS the one being
-  # named, and a `-t` here would be a second spelling of a window this file
-  # already has three of (Amendment 11(c)) — one more place for two of them to
-  # disagree. `rename-window` also turns automatic-rename OFF for the window,
-  # which is what makes the new name survive the next command that runs in it.
-  gr_wl="$(lc "$G_WINNAME")"
-  if [ -n "$G_LANE" ] && [ "$gr_wl" != "$(lc "$G_LANE")" ]; then
-    G_WIN_WAS="$G_WINNAME"
-    if tmux rename-window "$G_LANE" 2>/dev/null; then
-      G_WIN_FIXED=1
-    fi
-  fi
-
-  gr_sarc=0
-  gr_snhits="$(rows_named_ci_alias "$G_NAME" 2>/dev/null)" || gr_sarc=$?
-  if [ "$gr_sarc" = 5 ]; then
-    guard_refuse "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), so whether this session's name '${G_NAME:-none}' is a FORMER name of a lane could not be established — and an indeterminate read refuses (Amendment 12(d), Amendment 16(e)). $(guard_bypass)"
-    return 2
-  fi
-  gr_snn="$(printf '%s' "$gr_snhits" | grep -c . || :)"
-  if [ "$gr_snn" -gt 1 ]; then
-    guard_refuse "the register holds $gr_snn rows whose lane names differ only by case for this session's name '$G_NAME': $(printf '%s' "$gr_snhits" | tr '\n' ' '). A lane name is ONE name under any case (Amendment 15)." "merge them into one row (Amendment 15(d))"
-    return 2
-  fi
-  if [ "$gr_snn" = 1 ]; then G_SES_LANE="$gr_snhits"
-  elif lane_shaped "$G_NAME"; then G_SES_LANE="$G_NAME"
-  fi
-
-  gr_ids=""; gr_last=""
-  if [ -n "$G_LANE" ]; then
-    gr_ids="$(session_ids_of_lane "$G_LANE" 2>/dev/null || :)"
-    gr_last="$(printf '%s\n' "$gr_ids" | grep . | tail -n1 || :)"
-    if [ -n "$(row_of_lane "$G_LANE" 2>/dev/null || :)" ]; then
-      G_ROW="\`$G_LANE\` — last session ${gr_last:-none recorded}"
-    else
-      G_ROW="the register has no row for \`$G_LANE\`"
-    fi
-  else
-    G_ROW="this window names no lane, so no row is keyed by it"
-  fi
-
-  # ---- AMENDMENT 18(h) — ONE LIVE PROCESS PER TRANSCRIPT, ASKED BEFORE THE
-  # PENDING OFFER IS ANSWERED. Clause (h) refuses *"every prompt in a process
-  # that shares its session id with another live one"*, and THE ANSWER TO THIS
-  # GUARD'S OWN QUESTION IS A PROMPT: a `2` consumed here runs `lane-start`,
-  # writes a register row and appends a uuid to a cell, out of a process that
-  # may not be writing anything at all — and the offer is held per SESSION ID,
-  # so the second process answers the first one's question. The offer is KEPT
-  # while the duplicate stands and is answered at the first prompt after the
-  # other process is retired (Copilot round 1 on this PR).
-  if [ -n "$gr_others" ]; then
-    guard_triple
-    note "ANOTHER LIVE PROCESS CARRIES THIS SESSION ID ($G_ID): $gr_others."
-    note "A transcript is held by ONE live process (Amendment 18(h), ratified 2026-09-14): two of them append to one file, each overwriting what the other wrote, and the row records an id that two processes answer for. Measured four times on 2026-09-14, the last at 18:14Z — a harness \`--fork-session\` in a background pty host beside the interactive resume, its record in ANOTHER profile's sessions/ directory."
-    if [ -n "$G_LANE" ]; then
-      note "retire the other one — it proves the process is this lane's duplicate and prints Amendment 6(d)'s act for it, and it ends, writes and kills nothing:"
-      note "run: lane-end $G_LANE --retire <pid>"
-    else
-      note "retire the other one: lane-end <lane> --retire <pid>. This window names no lane, so which lane it is is yours to name."
-    fi
-    return 2
-  fi
-
-  # ---- THE PENDING OFFER, ANSWERED BEFORE THE TABLE BELOW IS CONSULTED
-  # (clause (h) rule 2). The answer prompt is the person's reply to a question
-  # this guard asked, it is consumed here and never reaches the model, and the
-  # triple still disagrees BECAUSE of the rename being answered — so this
-  # cannot wait behind the table below. It DOES wait behind 18(h)'s count
-  # above, for the reason stated there.
-  #
-  # AND AN `allow` FILE IS NOT A PENDING QUESTION, so it is not answered here:
-  # it is a STANDING ANSWER to one the person has already settled, and it is
-  # honoured at the row of the table that states the mismatch it allows — never
-  # in front of the table, where it would also silence the SUPERSEDED and the
-  # not-in-any-row refusals, which are states nobody allowed and which the
-  # amendment keeps closed (the requirement's own words: unreadable, ambiguous,
-  # duplicate or superseded identity still refuses).
-  gr_off="$(guard_offer_file "$G_ID")"
-  gr_mode=""
-  [ -f "$gr_off" ] && gr_mode="$(sed -n -e 's/^mode=//p' "$gr_off" 2>/dev/null | head -n1)"
-  if [ -f "$gr_off" ] && [ "$gr_mode" != allow ]; then
-    # 3 IS "THE OFFER WAS STALE AND HAS BEEN DROPPED", and it is the one answer
-    # that does not consume the prompt: the table below judges it, which asks
-    # the question again where the mismatch still stands and refuses where the
-    # state has become one the amendment keeps closed.
-    gr_arc=0
-    guard_answer "$gr_off" "$gr_prompt" "$gr_pane" || gr_arc=$?
-    [ "$gr_arc" = 3 ] || return 2
-    gr_mode=""
-  fi
-
-  # ---- AMENDMENT 18 CLAUSES (d) AND (e), THE BOUND SESSION'S TWO ANSWERS.
-  # Both are reads of THIS lane's own object log, made at this point for the
-  # reason (h)'s count above is made here: the lane is known, nothing has been
-  # judged yet, and a refusal here costs the prompt and nothing else.
-  #
-  #   (d) a `HANDOFF-REQUESTED` newer than this session's binding and not yet
-  #       answered by a `PAUSED` of its own -> refuse this ONE prompt, name who
-  #       asked and from where, and type `/handoff --exit requested by …` into
-  #       this pane ((h)1's mechanism, which `guard_type` already is). *"The
-  #       person at the bound pane sees the refusal and the handoff run; nothing
-  #       they typed is lost, because the refused prompt is theirs to type again
-  #       in the new place."*
-  #   (e) a `PAUSED` newer than the binding that THIS session did not write ->
-  #       refuse EVERY prompt from then on, naming the line and who forced it,
-  #       until the person here hands off or ends the session. *"Two places
-  #       never both write a lane in silence; the worst a `--force` can do is
-  #       make the old place stop, loudly."*
-  #
-  # BOTH ARE GATED ON THE BINDING BEING THIS SESSION'S, and the gate has two
-  # disjuncts because a lane's transcript changes under it: the binding's
-  # `session` field is this uuid, OR the binding's WINDOW is this window — which
-  # is the `/clear`, the usage reset and the profile switch, where the harness
-  # minted a new id and the row has not caught up. Without the second, a request
-  # aimed at a lane that had been cleared would be answered by nobody; without
-  # the first, a session in a window that merely carries the name would answer
-  # for somebody else's binding.
-  #
-  # WHAT IT COSTS, MEASURED: `lanes-edit.sh binding openRepoTools-3` against this
-# estate's live register is **0.17 s** wall (2026-09-15), because it is one
-# `git show` of ONE lane's log and one awk — not the register read the triple
-# above already paid for. The guard's own budget is the amendment's `timeout 5`,
-# and the two reads it makes before this one measured ~2 s and ~0.4 s.
-#
-# A READ THAT FAILED IS NOT A LANE WITH NOTHING PENDING — but it is not a
-  # refusal either, and that is a narrowing this guard makes deliberately.
-  # Clause (d) is fail-closed about the READS THAT BUILD THE TRIPLE; these two
-  # decide whether ANOTHER PLACE has asked for the lane, and a log that cannot
-  # be read there costs at worst a request answered one prompt later, while
-  # refusing on it would block every prompt of every lane on a workstation whose
-  # `origin` is briefly unreadable. It is said rather than swallowed.
-  #
-  # AND ONLY WHERE THIS WINDOW NAMES A LANE. With no lane there is no log to
-  # read and no binding to be asked for; the row below this block is the one
-  # that refuses a window naming none, and it says the right thing about it.
-  gr_bind=""; gr_bind_rc=0
-  [ -n "$G_LANE" ] && { gr_bind="$(lane_binding_scan "$G_LANE" "$G_ID")" || gr_bind_rc=$?; }
-  if [ -z "$G_LANE" ]; then :
-  elif [ "$gr_bind_rc" != 0 ]; then
-    note "lane $G_LANE's object log could not be read, so whether another place has asked for this lane (Amendment 18(d)) or forced it away (18(e)) is NOT known this prompt. The prompt is not refused for it — the three names above agree — but a request would be answered one prompt late."
-  else
-    IFS="$US" read -r gb_state gb_host gb_cont gb_win gb_utc gb_sess gb_os gb_rutc gb_rsess gb_rpay \
-      gb_xverb gb_xutc gb_xsess gb_xpay gb_legacy gb_fverb gb_futc gb_fsess gb_fpay <<EOF
-$gr_bind
-EOF
-    gb_mine=0
-    [ -n "$gb_sess" ] && [ "$(lc "$gb_sess")" = "$G_ID" ] && gb_mine=1
-    # THE WINDOW DISJUNCT IS A LOCAL TEST AND IS GATED LIKE ONE (Copilot round 4
-    # on openRepoTools#83). It exists for the `/clear`, the usage reset and the
-    # profile switch, where the harness minted a new id and the binding's window
-    # is still this one — but a tmux `@id` names a window on ONE server and tmux
-    # reissues them from `@0`, so compared alone it could make THIS session the
-    # answerer for a binding on another host, or for a stale one whose id has
-    # since been given to somebody else: the guard would then type `/handoff
-    # --exit` into this pane and refuse this prompt for a request nobody made of
-    # it. Three tests, not one: the binding is in this host and container, its
-    # window RESOLVES here with its own session (Amendment 11(h)'s agreement
-    # rule, which is what `live` means), and only then is the id compared.
-    if [ "$gb_mine" = 0 ] && [ -n "$gb_win" ] \
-       && binding_is_here "$gb_host" "$gb_cont" "$gb_legacy" \
-       && [ "$(binding_window_state "$gb_host" "$gb_win" "$gb_legacy")" = live ] \
-       && binding_is_this_window "$gb_win"; then
-      gb_mine=1
-    fi
-    if [ "$gb_mine" = 1 ] && [ "$gb_state" = requested ]; then
-      # `by host <h>` IS ONE SUB-FIELD WHOSE NAME IS `by host`, which is how
-      # clause (c) spells the request's payload — `→ by host <h>; container
-      # <c>; window <w>; wait <n>s`. Read as `host` it matches nothing, because
-      # `payload_subfield` anchors on the START of a sub-field and this one
-      # opens `by `. The clause's spelling is the grammar here, not a typo in
-      # it, and the reader is what bends.
-      gb_by="$(payload_subfield "$gb_rpay" "by host")"
-      gb_bc="$(payload_subfield "$gb_rpay" container)"
-      gb_bw="$(payload_subfield "$gb_rpay" window all)"
-      gb_line="/handoff --exit requested by ${gb_rsess:-a session this line does not name}@${gb_by:-unknown}/${gb_bc:-none}"
-      gb_trc=0
-      guard_type "$gr_pane" "$gb_line" || gb_trc=$?
-      guard_triple
-      note "A HANDOFF WAS REQUESTED for lane $G_LANE at ${gb_rutc:-an instant this line does not name} by ${gb_rsess:-a session this line does not name} from container ${gb_bc:-none} on host ${gb_by:-unknown}${gb_bw:+, window $gb_bw} — handing off (Amendment 18(d))."
-      gb_wait="$(payload_subfield "$gb_rpay" wait)"
-      note "A lane has ONE binding: that place cannot bind this lane until this one releases it, and it is WAITING on this session${gb_wait:+, for $gb_wait}. The handoff writes the PAUSED record, refreshes the handoff file with a fresh Rule 3 top block, and then ENDS this session, because a handoff to another place is a handoff and not a restart (Amendment 17(a) under \`--exit\`)."
-      case "$gb_trc" in
-        0) note "  \`$gb_line\` has been typed into this pane — it runs at this prompt's place, and THIS prompt is refused so the handoff goes first. Nothing you typed is lost: type it again in the new place." ;;
-        9) note "  this pane is running something other than \`claude\`, so nothing was typed into it (Amendment 12's M1 types only into a pane running claude). Run it yourself: $gb_line" ;;
-        8) note "  this pane's current command could not be read, so nothing was typed into it — fail closed. Run it yourself: $gb_line" ;;
-        *) note "  tmux would not take the keys, so nothing was typed. Run it yourself: $gb_line" ;;
-      esac
-      note "If this lane is NOT going anywhere, the answer is still an act and not a silence: tell that place, and they can stop waiting."
-      return 2
-    fi
-    # CLAUSE (e) IS ASKED OF THIS SESSION-S OWN TRACK, not of the latest
-    # binding (Copilot round 1 on this PR). Read off the binding, the refusal
-    # stopped the moment a THIRD place bound the lane — the scan-s `x_*` fields
-    # move on to the new line — and the clause says the refusal is EVERY prompt
-    # from then on, until the person here hands off or ends the session. Fields
-    # 16-19 are that track: the release another session wrote after this one-s
-    # own last lane-kind line, wherever the lane has been since.
-    if [ -n "$gb_fverb" ] && [ -n "$gb_fsess" ]; then
-      guard_triple
-      note "THIS LANE'S BINDING WAS RELEASED BY SOMEBODY ELSE (Amendment 18(e)). Lane $G_LANE's log carries a \`$gb_fverb\` at ${gb_futc:-an instant this line does not name}, written by session $gb_fsess — not by this one — after this session's own last line:"
-      note "    ${gb_fpay:-(no payload)}"
-      note "Another place forced the lane away and has bound it, or is binding it now. TWO PLACES NEVER BOTH WRITE A LANE: every prompt in this session is refused from here on, and this is not a state a rename or a relaunch clears."
-      note "The exits, and both are yours: hand this session off properly, which records what it holds and ends it —"
-      note "    lane-handoff --exit \"released from under me by $gb_fsess\""
-      note "— or end the session. To take the lane BACK, do it from a place that can bind it, after this one has stopped."
-      return 2
-    fi
-  fi
-
-  # ---- (b) ROWS 1 AND 2: THE WINDOW IS NOT A LANE.
-  if [ -z "$G_LANE" ]; then
-    if [ -n "$G_SES_LANE" ]; then
-      guard_refuse_start "this window is named '$G_WINNAME', which is no lane, while the SESSION is named for lane $G_SES_LANE — so nothing binds this conversation to a row, no surface would refuse a second window taking the same lane, and the handoff this session writes is one only this profile can find. THAT IS THE 2026-09-10 CASE, which ran for three days." "$G_SES_LANE" --no-launch
-    else
-      guard_refuse "neither this window ('$G_WINNAME') nor this session ('${G_NAME:-none}') names a lane, so the guard cannot name one either: WHICH lane this work is is yours to say, and a guard that guessed would bind a window to a row nobody chose." "lane-start <repo> <n>   (for the lane this work is)"
-    fi
-    return 2
-  fi
-
-  # ---- THE WINDOW IS A LANE. Where the uuid sits in the row's cell decides
-  # which of the next four rows applies, and the cell is a HISTORY written
-  # oldest first whose LAST id is the lane (Amendment 6(b)).
-  if [ -n "$gr_last" ] && [ "$G_ID" = "$gr_last" ]; then
-    # ---- THE DRIFTS THAT ARE NOT DECISIONS, AND AMENDMENT 16 ADDS THE SECOND.
-    # openRepoTools#87 left the LOCK exactly one case — a session name differing
-    # from the row's only by CASE, which is the same lane under Amendment 15 —
-    # and made every other readable mismatch a three-choice OFFER, because a
-    # person who renames a session to ANOTHER lane's name is choosing something
-    # and a guard may not choose for them. A FORMER NAME OF THIS VERY LANE IS
-    # NOT SUCH A CHOICE: clause (e) makes it resolve to this row for ever, so a
-    # session still named `repoRen-1` on a lane the register now spells
-    # `repoRen-7` is this lane under the name it was renamed away from — drift
-    # left behind by a rename run in ANOTHER window, which is precisely the
-    # state clause (f) exists to finish. Offering three ways to repair it would
-    # ask a person to decide what the rename already decided, and two of the
-    # three answers would be wrong: `1` would make the old name permanent and
-    # `2` would move the lane BACK to the name it was renamed away from.
-    #
-    # `$G_SES_LANE` IS THE TEST BECAUSE IT IS ALREADY THE RESOLVED ANSWER: it is
-    # `rows_named_ci_alias "$G_NAME"` above, so it is this lane exactly when the
-    # session's name is this lane's under any case or any former spelling.
-    if [ "$(lc "$G_NAME")" = "$(lc "$G_LANE")" ] \
-       || { [ -n "$G_SES_LANE" ] && [ "$(lc "$G_SES_LANE")" = "$(lc "$G_LANE")" ]; }; then
-      # THE THREE AGREE. Under Amendment 15 they agree under any case — and the
-      # ROW's spelling is the one the session carries, so a name that differs
-      # only by case is renamed to it rather than refused for ever.
-      # AND AN ALLOWANCE DIES WITH THE MISMATCH IT ALLOWED: the names agreeing
-      # again is one of the two names having CHANGED, which is the requirement's
-      # own condition for it no longer applying. Leaving the file would let a
-      # rename back to the allowed spelling pass silently on a decision the
-      # person made about a state they have since left.
-      [ -f "$gr_off" ] && [ "$gr_mode" = allow ] && rm -f -- "$gr_off"
-      # AMENDMENT 16(f): the window may still have carried a former name a
-      # moment ago, in which case it has just been renamed and that is said
-      # here — the one thing this guard does that is not a refusal.
-      [ "$G_NAME" = "$G_LANE" ] && { guard_window_renamed_note; return 0; }
-      if [ "$(lc "$G_NAME")" = "$(lc "$G_LANE")" ]; then
-        guard_lock_rename "$gr_pane" "spells the lane '$G_NAME' where the register's row spells it '$G_LANE', and a lane name is ONE name under any case whose canonical spelling is the row's (Amendment 15)"
-      else
-        guard_lock_rename "$gr_pane" "is '$G_NAME', which is a FORMER name of lane $G_LANE (${LANES_ALIASES_PATH:-lanes/aliases.tsv}, Amendment 16(e)) — the same lane under the name it was renamed away from, and not a lane anybody is moving to"
-      fi
-      return 2
-    fi
-    # ---- THE MISMATCH, AND THE ONE STATE THAT PASSES THROUGH IT. The
-    # allowance is honoured HERE and nowhere earlier: this is the row of the
-    # table it was given for — a readable current lane whose uuid is the row's
-    # LAST id and whose session name is not the lane's — so a superseded
-    # transcript, a uuid in no row, an ambiguous register and an unreadable
-    # read have all been refused above it, allowance or no allowance.
-    if [ "$gr_mode" = allow ] && guard_allow_active "$gr_off"; then
-      guard_triple "THE NAME GUARD ALLOWS THIS PROMPT ON AN EXPLICIT CHOICE (lane-collision-protocol Amendment 12). The three names:"
-      note "WARNING: this lane/session name mismatch was explicitly allowed for this transcript. It will remain allowed only while the lane and session names stay unchanged."
-      return 0
-    fi
-    # AN ALLOWANCE THAT NO LONGER FITS IS DROPPED RATHER THAN CARRIED: either
-    # name having changed is exactly what invalidates it, and the person is
-    # asked again below.
-    [ "$gr_mode" = allow ] && rm -f -- "$gr_off"
-    guard_offer "$gr_off" "$gr_pane"
-    return 2
-  fi
-
-  if [ -n "$gr_ids" ] && printf '%s\n' "$gr_ids" | grep -qx -F -- "$G_ID"; then
-    guard_refuse_start "this is a SUPERSEDED transcript of lane $G_LANE: the row's session cell carries $G_ID but ENDS on $gr_last, so the conversation in this window is not the lane's and renaming it would not make it one. Exit this session and start the lane, which resumes the id the row ends on." "$G_LANE"
-    return 2
-  fi
-
-  guard_refuse_start "this window is lane $G_LANE, whose row ${gr_last:+ends on $gr_last and }does not name $G_ID at all — the harness minted a new transcript with nobody acting (a /clear, a usage reset, a profile switch). The lane is right and the ROW is behind, so the cure is the recording act and no relaunch: it reads the live record in this window and appends that uuid to the cell." "$G_LANE" --no-launch
-  return 2
-}
-
-# (h) rule 2's third test: is the rename NEWER than this window's binding?
-# Amendment 18(b) makes the binding the lane's last `STARTED`/`RESUMED`, and
-# `nameSince` is an epoch in MILLISECONDS (measured on this estate's records,
-# 2026-09-14). A rename OLDER than the binding is a title this window inherited
-# and not an instruction somebody has just given, so it is drift and the lock
-# renames it back. A record with NO `nameSince` — an older harness — cannot be
-# told apart either way and is drift too, which is (h)1's default and the
-# closed direction. A lane whose log records no binding at all cannot make a
-# rename older than one, so there the rename is the instruction.
-# AND A LOG THAT COULD NOT BE READ IS A THIRD ANSWER, NOT EITHER OF THE TWO
-# (openRepoTools#60). `lane_binding_utc` answers 1 for it — `log_path_ci`
-# refuses two logs differing only by case (Amendment 15) — and this test folded
-# that 1 into the 8, so the `SessionStart` hook, its one caller since #87 made
-# the guard's answer the offer, told a person their rename was newer than a
-# binding nobody read. Read as "not newer" it would type over a person's own
-# `/rename`, which (h) rule 4 forbids, so the caller is told and names the read.
-#   0 newer · 1 not newer, or no `nameSince` · 5 the lane's log could not be read
-guard_rename_is_newer() {   # <lane> <nameSince, epoch ms>
-  grn_lane="${1-}"; grn_since="${2-}"
-  case "$grn_since" in ''|*[!0-9]*) return 1 ;; esac
-  grn_rc=0
-  grn_utc="$(lane_binding_utc "$grn_lane" 2>/dev/null)" || grn_rc=$?
-  [ "$grn_rc" = 0 ] || [ "$grn_rc" = 8 ] || return 5
-  [ -n "$grn_utc" ] || return 0
-  grn_e="$(epoch_of "$grn_utc")"
-  [ -n "$grn_e" ] || return 0
-  [ "$grn_since" -gt "$((grn_e * 1000))" ]
-}
-
-# ------------------------------------------------------ (h)1: THE LOCK RENAMES
-#
-# The guard refuses THIS ONE PROMPT so the rename lands first, types
-# `/rename <lane>` into this pane, and says so. M1's conditions are
-# `guard_type`'s; every outcome but a successful typing prints the line for the
-# person to type themselves, because a lock that silently did nothing is a lock
-# nobody knows is broken.
-guard_lock_rename() {   # <pane> <what is wrong with the name, as a clause>
-  glr_pane="${1-}"; glr_why="${2-}"
-  glr_rc=0
-  guard_type "$glr_pane" "/rename $G_LANE" || glr_rc=$?
-  guard_triple
-  note "the session name $glr_why, and under the projects root the session name is not the person's to set freely — it is the LANE's (Amendment 12(h), THE LOCK)."
-  case "$glr_rc" in
-    0) note "SO IT HAS BEEN RENAMED FOR YOU: \`/rename $G_LANE\` was typed into this pane ($glr_pane), which is the only path a running session's name has (M1). This one prompt is refused so the rename lands first — send it again." ;;
-    8) note "the pane's current command could not be read, so NOTHING was typed: a \`/rename\` typed at a shell is a command that does not exist and typed into an editor is text nobody wrote. Type it yourself: /rename $G_LANE" ;;
-    9) note "this pane is not running claude, so NOTHING was typed, for the reason above. Type it in the lane's own pane: /rename $G_LANE" ;;
-    *) note "tmux would not take the keys, so NOTHING was typed. Type it yourself: /rename $G_LANE" ;;
-  esac
-  # THE ' (N)' SUFFIX IS NOT READ HERE ANY MORE, and it is not lost. Two names
-  # reach this lock and NEITHER CAN CARRY ONE: a name differing from the lane's
-  # only by CASE, which has no room for a suffix, and a FORMER name of this lane
-  # (Amendment 16(e)), which is a KEY of the alias table — and `repoRen-1 (2)`
-  # is not that key, so a suffixed former name resolves to nothing and goes to
-  # the offer with every other wider mismatch. `guard_offer` prints ratified
-  # decision D4's reading of the suffix, where the state that has one arrives.
-  return 2
-}
-
-# F-B6 PRINTS EVERY COMMAND FILLED IN, AND THERE IS ONE LANE NAME THAT CANNOT
-# BE. `lane_start_args` answers `<repo> <n>` for a lane named under Rule 4's
-# `<repo>-<n>` form and `--dir <path> <lane>` for one named before it — and that
-# `<path>` is a PLACEHOLDER, because nothing in the register, the window or this
-# session says where such a lane's checkout is. Printing it in a diagnostic is
-# honest; RUNNING it is not. `lane-start --no-launch --dir '<path>' legacy-ui`
-# refuses on a directory that does not exist, and the offer that ran it would
-# ask the same question at every prompt afterwards (Copilot round 1 on this PR).
-# So the offer SAYS what it cannot fill in and choice `2` refuses instead of
-# running it, with the offer kept so that `1` and `3` still answer it.
-guard_args_filled() {   # <lane>
-  gaf_a="$(lane_start_args "$1")"
-  case "$gaf_a" in *'<path>'*) return 1 ;; esac
-  return 0
-}
-
-# AND THE TABLE'S OWN CURES SAY IT TOO (openRepoTools#73, item 3). The offer was
-# fixed and the diagnostic beside it was not: rows 1, 5 and 6 of the (b) table
-# printed `$(lane_start_args …)` straight, so a lane named before Rule 4 got
-# `run: lane-start --no-launch --dir <path> legacy-ui` — a `<path>` placeholder
-# in the one line a person is told to type, which F-B6 says is printed filled
-# in. Filled in where it can be; where it cannot, the reason is the OFFER's
-# sentence, the act is the offer's own line, and the checkout is the person's to
-# supply, because nothing this guard can read says which one it is.
-guard_refuse_start() {   # <why> <lane> [--no-launch]
-  grs_why="${1-}"; grs_lane="${2-}"; grs_flag="${3-}"
-  if guard_args_filled "$grs_lane"; then
-    guard_refuse "$grs_why" "lane-start ${grs_flag:+$grs_flag }$(lane_start_args "$grs_lane")"
-    return 2
-  fi
-  guard_refuse "$grs_why Lane $grs_lane is named before Rule 4's \`<repo>-<n>\` form, so the command below cannot be filled in here: \`lane-start\` needs that lane's DIRECTORY and nothing in the register, the window or this session says which one it is — the checkout is yours to supply." "lane-start ${grs_flag:+$grs_flag }--dir <that lane's checkout> $grs_lane"
-  return 2
-}
-
-# ------------------------------------------------------------ (h)2: THE OFFER
-#
-# *"if the user does a rename, then we should offer to move to that lane or
-# create a new lane if we do not have one as that name"* (D5, verbatim). The
-# one thing the guard never does silently is decide, with nobody acting, which
-# of two disagreeing LANES a window belongs to.
-guard_offer() {   # <offer file> <pane>
-  go_f="${1-}"; go_pane="${2-}"
-  mkdir -p -- "${go_f%/*}" 2>/dev/null || :
-  { printf 'mode=name-drift\n'
-    printf 'from=%s\n' "$G_LANE"
-    printf 'to=%s\n'   "$G_SES_LANE"
-    printf 'session=%s\n' "$G_NAME"
-    printf 'uuid=%s\n' "$G_ID"
-    printf 'utc=%s\n'  "$(utc_now)"
-    printf 'window=%s\n' "$G_WINREF"
-    printf 'pane=%s\n'   "$go_pane"
-  } > "$go_f" 2>/dev/null || :
-  guard_triple
-  note "WARNING: the lane and Claude session names disagree. This prompt is paused until you choose how to repair or explicitly allow this lane."
-  note "1) explicitly allow this lane for this transcript (future prompts warn but do not block while both names stay unchanged)"
-  if [ -n "$G_SES_LANE" ]; then
-    go_row="$(row_of_lane "$G_SES_LANE" 2>/dev/null || :)"
-    if [ -n "$go_row" ]; then
-      go_last="$(last_session_id_of_lane "$G_SES_LANE" 2>/dev/null || :)"
-      note "2) adjust the lane to session $G_SES_LANE (existing lane; last session ${go_last:-none recorded})"
-    else
-      note "2) adjust the lane to session $G_SES_LANE (create or move to this lane)"
-    fi
-    note "3) adjust the session to lane $G_LANE (types \`/rename $G_LANE\` into this pane)"
-  else
-    note "2) adjust the lane to session — unavailable because '${G_NAME:-none}' is not a lane name the tooling can safely derive"
-    note "3) adjust the session to lane $G_LANE (types \`/rename $G_LANE\` into this pane)"
-  fi
-  # RATIFIED DECISION D4, WHERE THE STATE IT READS NOW ARRIVES. A `<lane> (N)`
-  # title is a mismatch and the SUFFIX IS EVIDENCE about another process, so it
-  # is said beside the choices rather than left for the person to notice.
-  go_base="${G_NAME% (*)}"
-  if [ -n "$go_base" ] && [ "$(lc "$go_base")" = "$(lc "$G_LANE")" ] && [ "$go_base" != "$G_NAME" ]; then
-    note "AND THE ' (N)' SUFFIX IS EVIDENCE: it is exactly what a rename into a title something else still holds mints, so another holder of '$G_LANE' was live when this session was named (Amendment 6(d), ratified decision D4). Naming them is a read of its own, kept off this hook's path because it costs about three seconds: \`lanes-edit.sh forks $G_LANE\`. Retiring one is \`lane-end $G_LANE --retire <pid>\`, which proves it is a fork, prints Amendment 6(d)'s act filled in, and ends, writes and kills nothing."
-  fi
-  note "Reply \`1\`, \`2\` or \`3\`. The answer is the NEXT prompt, it is consumed here and never reaches the model; anything else asks again."
-  [ -f "$go_f" ] || note "(the offer could not be written to $go_f, so the answer will be read as a fresh prompt and this question asked again — which is the safe direction)"
-  return 2
-}
-
-# A choice of 1 is deliberately sticky only for the exact readable identity it
-# allowed. A renamed session, a different lane binding, or a new transcript
-# must come back through the numbered offer.
-guard_allow_active() {   # <offer file>
-  gaa_f="${1-}"
-  [ "$(sed -n -e 's/^mode=//p' "$gaa_f" 2>/dev/null | head -n1)" = allow ] || return 1
-  [ "$(sed -n -e 's/^from=//p' "$gaa_f" 2>/dev/null | head -n1)" = "$G_LANE" ] || return 1
-  [ "$(sed -n -e 's/^session=//p' "$gaa_f" 2>/dev/null | head -n1)" = "$G_NAME" ] || return 1
-  [ "$(sed -n -e 's/^uuid=//p' "$gaa_f" 2>/dev/null | head -n1)" = "$G_ID" ] || return 1
-  return 0
-}
-
-# ------------ THE UUID IN THE NEW LANE'S CELL, WHICH `lane-start --bind` WRITES
-#
-# CLAUSE (h) RULE 2 NAMES THE END STATE AND RULE 3 REPEATS IT: after choice 2,
-# *"window X, session X, ROW X STAMPED WITH THIS UUID"*. `lane-start --no-launch`
-# used to perform every other part of that and NOT this one, by a fence that is
-# right and stays: its step 3b VETO 1 — Amendment 11 clause (d) rule 1 — never
-# takes a uuid that belongs to ANOTHER ROW, and after a rename this uuid belongs
-# to `$ga_from`'s.
-#
-# MEASURED, AND IT WAS A LOOP AND NOT A BLEMISH. In the suite: choice `2` moved
-# the window to `repoGD-2`, whose row then read `STARTED by 7a01ae69…` while this
-# session was `aaaa0012-1111…`. The NEXT prompt therefore found a lane window
-# whose row did not name this transcript — the last row of the (b) table — and
-# refused with `lane-start --no-launch repoGD 2`, which vetoed for the same
-# reason and changed nothing. So the guard made that last write itself, after
-# `lane-start` returned — by which time `lane-start` had taken the destination
-# row's ordinary RESUME path and stamped the row, the lane's log and the handoff
-# with the id THE ROW ALREADY HAD, under `--no-launch`, about a conversation
-# nobody was in (openRepoTools#70).
-#
-# THE WRITE IS `lane-start`'s NOW, IN ITS BINDING MODE. `--bind <this uuid>` is
-# veto 1 answered by the person's `2` — clause (h) rule 4's limit is that the
-# lock never moves a uuid between rows WITHOUT the person's yes, and this is the
-# yes — so the cell is extended first and every stamp names THIS uuid, in one
-# act, anchored on the PUBLISHED last id as `lane-start` always anchors, and
-# where a cell records no uuid on the `none recorded` or `pending — set by the
-# session's first act` text such a cell carries instead, which is this guard's
-# former anchor rule moved there.
-#
-# SO THIS IS A READ, AND IT WRITES NOTHING. It says the end state rule 3 names
-# is there, or prints the act that puts it there where `lane-start` could not:
-# a checkout whose copy of the row is older than the published one, or a cell
-# carrying no uuid and neither text. THE OLD WRITE IS NOT KEPT BEHIND IT AS A
-# FALLBACK, because it would rescue neither: its anchor is `lane-start`'s, so a
-# stale copy of the row refuses it exactly as it refused `lane-start` (whose own
-# next write to that same row line has by then met the same difference as a
-# rebase conflict), and a cell with neither text has nothing to anchor on. What
-# it would add is a second append after a write whose push timed out, read
-# against a published ref that never moved — the uuid in the cell twice.
-#
-#   0  the cell ends on this uuid
-#   1  it does not, and the act that fixes it has been printed
-guard_bound_check() {   # <the lane moved to>
-  gbc_to="${1-}"
-  # THE CACHED REGISTER IS THE ONE FROM BEFORE `lane-start` RAN, and this is the
-  # one place in the file that reads it AFTER a writer has moved it: a row
-  # `lane-start` has just CREATED is not in it at all, and the answer would then
-  # be "no uuid" on the one path that most needs the true one. Both copies are
-  # dropped — the variable this shell holds and the file every subshell reads
-  # (A11 Addendum 4 ruling 12) — exactly as `log_sync` drops them after a fetch,
-  # and for the same reason: the ref has moved under them.
-  LANES_REGISTER_CACHE=""
-  gbc_rc="${SE_CACHE_FILE:+$SE_CACHE_FILE.register}"; [ -n "$gbc_rc" ] && rm -f -- "$gbc_rc"
-  gbc_last="$(last_session_id_of_lane "$gbc_to" 2>/dev/null || :)"
-  if [ "$(lc "$gbc_last")" = "$(lc "$G_ID")" ]; then
-    note "…and $gbc_to's session cell now ends on $G_ID, written by lane-start's binding mode — which is what the next \`lane-start $gbc_to\` resumes."
-    return 0
-  fi
-  note "…but $gbc_to's session cell does NOT end on $G_ID (it ends on ${gbc_last:-no transcript uuid at all}; lane-start's own words are above). Stamp it as this session's first act, which is Amendment 6(c)'s own remedy:"
-  note "   LANES_LANE=$gbc_to lanes-edit.sh append-session-id $gbc_to \"<the session cell's last id>\" \"→ harness $G_ID (transcript uuid; profile ${G_PROF:-unknown})\""
-  return 1
-}
-
-# The answer, and it is the whole of clause (h) rule 2's second half.
-guard_answer() {   # <offer file> <the prompt> <pane>
-  ga_f="${1-}"; ga_p="${2-}"; ga_pane="${3-}"
-  ga_mode="$(sed -n -e 's/^mode=//p' "$ga_f" 2>/dev/null | head -n1)"
-  ga_from="$(sed -n -e 's/^from=//p' "$ga_f" 2>/dev/null | head -n1)"
-  ga_to="$(sed -n -e 's/^to=//p' "$ga_f" 2>/dev/null | head -n1)"
-  ga_session="$(sed -n -e 's/^session=//p' "$ga_f" 2>/dev/null | head -n1)"
-  ga_ans="$(printf '%s' "$ga_p" | tr 'A-Z' 'a-z' | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
-  # THE OFFER IS READABLE WHEN IT NAMES ITS MODE AND THE LANE IT WAS MADE FOR,
-  # AND `session=` IS NOT PART OF THAT TEST. A session record carrying NO `name`
-  # at all is the (b) table's own untitled row and it reaches this offer with an
-  # empty name, so requiring one here made that state's offer UNANSWERABLE: the
-  # question was asked, the answer was dropped as unreadable, the next prompt
-  # asked it again, and choice 3 — the one that would have fixed it — could
-  # never be reached. An empty session name is a FACT about the session, and it
-  # is printed as `none` wherever this speaks.
-  if [ "$ga_mode" != name-drift ] || [ -z "$ga_from" ]; then
-    rm -f -- "$ga_f"
-    guard_refuse "the pending offer at $ga_f could not be read, so it has been dropped rather than answered on a guess. Send your prompt again and the question will be asked afresh."
-    return 2
-  fi
-  # AND THE QUESTION BEING ANSWERED MUST STILL BE THE QUESTION THAT WAS ASKED
-  # (Copilot round 1 on openRepoTools#87). The file is keyed by TRANSCRIPT, and
-  # a prompt is a later moment: between the offer and its answer the window can
-  # be renamed to another lane and the session renamed by hand, and every one of
-  # the three choices then acts on a state nobody was shown — `2` moves to a
-  # destination derived from a session name that has gone, `3` types `/rename`
-  # for a lane this window no longer is, and `1` records an allowance for a pair
-  # that does not exist. So the stored identity is compared with the live one,
-  # and a stale offer is DROPPED rather than answered: this prompt is not
-  # consumed, it is judged by the table below, which asks again where the
-  # mismatch still stands and refuses where the state has become one of the
-  # unsafe ones. 3 is that status, and `guard_run` is its only caller.
-  if [ "$ga_from" != "$G_LANE" ] || [ "$ga_session" != "$G_NAME" ]; then
-    rm -f -- "$ga_f"
-    note "the pending question was about lane $ga_from and session '${ga_session:-none}', and this window is now lane ${G_LANE:-none} with session '${G_NAME:-none}' — so the offer has been DROPPED rather than answered on a state you were never shown. Nothing was renamed or written. This prompt is judged afresh below."
-    return 3
-  fi
-  case "$ga_ans" in
-  1)
-    if ! { printf 'mode=allow\n'
-      printf 'from=%s\n' "$ga_from"
-      printf 'to=%s\n' "$ga_to"
-      printf 'session=%s\n' "$ga_session"
-      printf 'uuid=%s\n' "$G_ID"
-      printf 'utc=%s\n' "$(utc_now)"
-    } > "$ga_f" 2>/dev/null; then
-      guard_refuse "the explicit allow could not be recorded at $ga_f, so the mismatch remains unapproved. Nothing was renamed or written; answer 1 again after the session state is writable."
-      return 2
-    fi
-    guard_triple
-    note "ALLOWED: this lane/session name mismatch is explicitly allowed for this transcript. This answer is consumed; send your work again. Future prompts will warn without blocking while the lane remains $ga_from and the session remains '${ga_session:-none}'."
-    return 2 ;;
-  2)
-    if [ -z "$ga_to" ]; then
-      guard_refuse "choice 2 is unavailable because the session name '${ga_session:-none}' is not a lane name the tooling can safely derive. Nothing was renamed or written; the offer is kept. Choose 1 or 3."
-      return 2
-    fi
-    if ! guard_args_filled "$ga_to"; then
-      guard_refuse "lane $ga_to is named before Rule 4's \`<repo>-<n>\` form, so choice 2 cannot be filled in here: \`lane-start\` needs that lane's DIRECTORY and nothing in the register, the window or this session says which one it is. NOTHING has been renamed, moved or written, and the offer is KEPT." "lane-start --no-launch --dir <that lane's checkout> $ga_to"
-      return 2
-    fi
-    ga_start="$(guard_lane_start)"
-    if [ -z "$ga_start" ] || [ ! -x "$ga_start" ]; then
-      guard_refuse "there is no \`lane-start\` beside this file or on PATH, so this window has NOT moved to $ga_to and NOTHING has been written. The offer is kept: answer \`2\` again once it is installed (\`openRepoTools --install\`)."
-      return 2
-    fi
-    # THE WINDOW IS RENAMED FIRST, AND THAT ORDER IS LOAD-BEARING. Clause (h)
-    # rule 2 lists the acts in it — *"window renamed, row created or this uuid
-    # appended to its cell"* — and `lane-start` will not do the second while the
-    # first is undone: its step 3b VETO 2 refuses to take the session live in a
-    # window NAMED FOR ANOTHER LANE (Amendment 11 clause (d) rule 1, veto 2,
-    # `R-A11-12`), which after choice 2 is exactly what this window is. Without
-    # the rename the binding mode below REFUSES, because `--bind` answers veto 1
-    # and never veto 2 (openRepoTools#70) — and before it existed the lane was
-    # started and stamped with the person's transcript left OUT of its session
-    # cell, the one thing the next resume follows. The veto is right and stays:
-    # what changes is that the person has just said this window is the other
-    # lane.
-    if command -v tmux >/dev/null 2>&1; then
-      tmux rename-window "$ga_to" 2>/dev/null ||
-        note "the window could not be renamed to $ga_to, so lane-start may refuse to take this session as that lane's (its step 3b veto 2)."
-    fi
-    ga_rc=0
-    # ITS STDOUT IS THE COMMAND IT WOULD HAVE LAUNCHED, and a hook's stdout is
-    # not what a person reads: everything this act says goes to stderr, where
-    # the blocking reason is shown.
-    # UNQUOTED ON PURPOSE: `lane_start_args` prints TWO words, `<repo> <n>` —
-    # or `--dir <path> <lane>` for a lane named before the `<repo>-<n>` rule.
-    # AND IN ITS BINDING MODE (openRepoTools#70): `--bind` names THIS
-    # transcript, so the destination's cell is appended with it and the row's
-    # stamp, its log line and its handoff's Rule 3 stamp all name it — never
-    # the id that row would otherwise have resumed, which nobody is in. The
-    # flag is the guard's alone, so it is in this call and in no command this
-    # file prints for a person to type.
-    # shellcheck disable=SC2046
-    "$ga_start" --no-launch --bind "$G_ID" $(lane_start_args "$ga_to") >&2 || ga_rc=$?
-    if [ "$ga_rc" != 0 ]; then
-      guard_refuse "\`lane-start --no-launch $(lane_start_args "$ga_to")\`, run in its binding mode for this transcript, exited $ga_rc (its own words are above), so this window has NOT moved and $ga_from has NOT been marked MOVED. The offer is KEPT, so answer \`2\` again once that refusal is settled, or choose \`3\` to rename the session back to $ga_from."
-      return 2
-    fi
-    rm -f -- "$ga_f"
-    guard_triple
-    note "MOVED: this window is now lane $ga_to — renamed, and stamped. The prompt that answered the question is consumed; send your work again."
-    guard_bound_check "$ga_to" || :
-    if [ -n "$(row_of_lane "$ga_from" 2>/dev/null || :)" ]; then
-      # AMENDMENT 13(a) — THE STATE IS SET, NOT APPENDED. This window has just
-      # moved to another lane, so the lane it LEFT is not running in it any
-      # more: `PAUSED` is where that lane now is, and the line says where it
-      # went. It used to be an `append-row-status` of `MOVED → <lane>`, which
-      # left the cell saying two things at once — whatever state it opened with,
-      # and this.
-      # THE LINE IS BOUNDED (Copilot round 5 on openRepoTools#82). A lane name is
-      # bounded in its CHARACTERS by `check_lane_name` and not in its length, and
-      # this line carried it twice: a long enough name makes `set-row-state`
-      # refuse the very write that records where the work went — after the window
-      # has already been renamed and moved. The name is said ONCE, and cut where
-      # even once does not fit, so the act always records something true.
-      ga_line="this window moved to lane $ga_to on the person's choice 2 at the guard"
-      if [ "${#ga_line}" -gt 230 ]; then
-        ga_line="${ga_line:0:230}"
-        case "$ga_line" in *' '*) ga_line="${ga_line% *}" ;; esac
-        ga_line="$ga_line ..."
-      fi
-      if "$RESOLVED" set-row-state "$ga_from" "PAUSED · $ga_line" >&2; then
-        note "…and $ga_from's row now reads PAUSED, naming the move to $ga_to."
-      else
-        note "…but $ga_from's row could NOT be marked (its writer's words are above). Run: lanes-edit.sh set-row-state $ga_from \"PAUSED · $ga_line\""
-      fi
-    else
-      note "…and the register has no row for $ga_from, so there is nothing to mark MOVED there."
-    fi
-    return 2 ;;
-  3)
-    ga_trc=0
-    guard_type "$ga_pane" "/rename $ga_from" || ga_trc=$?
-    guard_triple
-    case "$ga_trc" in
-      0) rm -f -- "$ga_f"; note "ADJUSTED SESSION TO LANE $ga_from: \`/rename $ga_from\` was typed into this pane ($ga_pane). The prompt that answered the question is consumed; send your work again." ;;
-      *) note "the rename could NOT be typed into this pane, so the session is still named '${ga_session:-none}'. NOTHING was written; the offer is kept. Type it yourself: /rename $ga_from" ;;
-    esac
-    return 2 ;;
-  *)
-    guard_triple
-    note "that is not an answer to the pending question, so it has been refused rather than acted on: this window is lane $ga_from and this session is named '${ga_session:-none}'."
-    note "1) allow this lane for this transcript   2) adjust the lane to session ${ga_to:-${ga_session:-none}}   3) adjust the session to lane $ga_from (types \`/rename $ga_from\`)"
-    # THE SAME SENTENCE THE OFFER ENDS ON, because a question asked again is
-    # asked in the words it was asked in: a person who is being re-asked has
-    # just typed something else, and two spellings of one question is how they
-    # come to believe the second one takes different answers.
-    note "Reply \`1\`, \`2\` or \`3\`. The answer is the NEXT prompt, it is consumed here and never reaches the model; anything else asks again."
-    return 2 ;;
-  esac
-}
-
-
-# ------------------------------- CLAUSE (f): THE `SessionStart` BLOCK'S LINE
-#
-# *"Where the record's name differs from the window's lane it prints
-# `session name '<x>' was not the lane '<y>' — renamed` and types the rename
-# ((h)1), so the first prompt already finds the three agreeing. It stays
-# read-only against the register and non-blocking, as Amendment 8 made it; the
-# refusal is the `UserPromptSubmit` hook's."*
-#
-# AND AMENDMENT 18(h)'s READ BESIDE IT, SAID AND NOT ACTED ON: where another
-# live process carries this session id, the block NAMES it and the retire act.
-# The guard refuses on that; this hook refuses nothing and never will — a hook
-# that fails is a hook that breaks the session it was meant to orient (R-A8-1),
-# and typing into its own pane writes nothing anywhere, which is why (h)1 gives
-# it that one act and no other.
-#
-# EVERY PATH RETURNS 0. A read that failed prints nothing rather than guessing:
-# the guard is the surface that refuses on an indeterminate read, and doing it
-# twice, in the hook that may not, would be the same failure one layer up.
-ssb_name_line() {   # <session uuid> <lane, or empty>
-  snl_id="${1-}"; snl_lane="${2-}"
-  [ -n "$snl_id" ] || return 0
-  snl_tmp="$(mktemp "${TMPDIR:-/tmp}/lanes-edit-sn.XXXXXX" 2>/dev/null || printf '')"
-  [ -n "$snl_tmp" ] || return 0
-  snl_rc=0
-  # IN A SUBSHELL, AND THAT IS R-A8-1 AND NOT TIDINESS. *"This hook never fails
-  # and always exits 0"*; `|| snl_rc=$?` catches a RETURN and catches nothing
-  # else, because a fatal inside a function called in this shell — an unbound
-  # variable under `set -u`, a `die` on a path nobody expected to reach one —
-  # exits the shell itself, `|| :` at the call site and all. Measured: with
-  # `th_here_prof` unset, `lanes-edit.sh session-start` exited 1 and printed no
-  # block at all, which is precisely the hook breaking the session it was
-  # written to orient. Nothing here needs state from the call — the rows come
-  # back through a file — so the subshell costs nothing and bounds it.
-  ( transcript_holders "$snl_id" ) > "$snl_tmp" 2>/dev/null || snl_rc=$?
-  if [ "$snl_rc" != 0 ]; then rm -f -- "$snl_tmp"; return 0; fi
-  snl_file=""; snl_tgt=none; snl_others=""
-  while IFS="$US" read -r sn_pid sn_kind sn_tgt sn_prof sn_where sn_verdict sn_file; do
-    [ -n "${sn_pid:-}" ] || continue
-    # The same three-way reading the guard makes, and for the same reasons.
-    case "$sn_verdict" in
-      here)
-        if [ -z "$snl_file" ] || { [ "$snl_tgt" = none ] && [ "$sn_tgt" != none ]; }; then
-          snl_file="$sn_file"; snl_tgt="$sn_tgt"
-        fi ;;
-      duplicate)
-        snl_others="${snl_others}${snl_others:+, }pid $sn_pid ($sn_where, kind $sn_kind, profile $sn_prof)" ;;
-    esac
-  done < "$snl_tmp"
-  rm -f -- "$snl_tmp"
-  if [ -n "$snl_others" ]; then
-    printf 'DEFECT: another live process carries this session id (%s): %s — a transcript is held by ONE live process (Amendment 18(h)), and two of them append to one file. Retire it: lane-end %s --retire <pid>\n' \
-      "$snl_id" "$snl_others" "${snl_lane:-<lane>}"
-  fi
-  [ -n "$snl_lane" ] && [ -n "$snl_file" ] || return 0
-  snl_blob="$(cat -- "$snl_file" 2>/dev/null || :)"
-  snl_name="$(jstr "$snl_blob" name)"
-  [ -n "$snl_name" ] || snl_name=none
-  [ "$snl_name" = "$snl_lane" ] && return 0
-  # THE SAME FENCE AS THE GUARD'S, for the same reason and in the same words:
-  # a record that is here by ancestry can carry another window's target, and
-  # this hook types into a pane. `here_context` is asked HERE because the read
-  # above it runs in a subshell, which is where its answer would otherwise have
-  # stayed.
-  # A PERSON'S RENAME TO ANOTHER LANE IS THE GUARD'S TO OFFER, NOT THIS HOOK'S
-  # TO UNDO. Clause (f) types the rename for (h)1's case — DRIFT, a name that is
-  # no lane's — while (h) rule 2 makes a record whose `nameSource` is `user`,
-  # whose name is another lane's, and whose `nameSince` is later than this
-  # window's binding an INSTRUCTION, answered `1`, `2` or `3` at the next prompt.
-  # This hook runs on every startup, resume, clear and fork, so typing over such
-  # a name would erase the person's choice before the guard could put the
-  # question (Copilot round 4 on this PR): a rename, then a `/clear`, and the
-  # offer never happens. It is SAID here and left to the prompt that follows.
-  snl_src="$(jstr "$snl_blob" nameSource)"
-  snl_since="$(jnum "$snl_blob" nameSince)"
-  snl_nrc=1
-  if [ "${snl_src:-}" = user ] && [ "$(lc "$snl_name")" != "$(lc "$snl_lane")" ] \
-     && { [ -n "$(rows_named_ci "$snl_name" 2>/dev/null || :)" ] || lane_shaped "$snl_name"; }; then
-    snl_nrc=0
-    guard_rename_is_newer "$snl_lane" "$snl_since" || snl_nrc=$?
-  fi
-  case "$snl_nrc" in
-    0)
-      printf "session name '%s' is a lane name YOU set, newer than this window's binding to '%s' — the name guard offers the move at your next prompt (Amendment 12(h) rule 2); nothing was renamed here\n" \
-        "$snl_name" "$snl_lane"
-      return 0 ;;
-    # A BINDING NOBODY COULD READ IS NEITHER ANSWER (openRepoTools#60): not
-    # "newer", which is a claim about a log this hook did not read, and not
-    # drift, which would type over the person's own rename. The read is named
-    # and the name left alone; this hook refuses nothing, so that is all it does.
-    5)
-      printf "session name '%s' is a lane name YOU set, and lane %s's object log could not be read, so whether you set it after this window's binding is NOT known — nothing was renamed here, and the name guard puts it to you at your next prompt (Amendment 12(h) rule 4)\n" \
-        "$snl_name" "$snl_lane"
-      return 0 ;;
-  esac
-  here_context
-  snl_pane=""
-  if [ -n "$snl_tgt" ] && [ "$snl_tgt" != none ] && [ -n "$LANES_THIS_WINDOW" ] \
-     && [ "${snl_tgt%.*}" = "$LANES_THIS_WINDOW" ]; then
-    case "$snl_tgt" in *.%*) snl_pane="${snl_tgt##*.}" ;; esac
-  fi
-  snl_trc=0
-  guard_type "$snl_pane" "/rename $snl_lane" || snl_trc=$?
-  if [ "$snl_trc" = 0 ]; then
-    printf "session name '%s' was not the lane '%s' — renamed\n" "$snl_name" "$snl_lane"
-  else
-    printf "session name '%s' is not the lane '%s' — run: /rename %s\n" "$snl_name" "$snl_lane" "$snl_lane"
-  fi
-  return 0
-}
-
-# ----------------------------------------------------------------- GitHub
-#
-# Rule 1 is one act: the three reads, the local line, and the comment that
-# another person reads. The LOG is authoritative for a claim made through
-# `claim` — a log line IS a live claim for Rule 1 purposes — and the GitHub
-# comment is the copy that a person outside this estate can see.
-# --no-github skips every call here, which is what the tests and an offline
-# lane run with.
-
-# THE SIBLING READS NAME THE OBJECT, NOT ITS DIGITS (Amendment 8). Rule 1's
-# reads 2 and 3 searched for the bare slug as a SUBSTRING, and a number is a
-# substring of almost everything. Measured live on 2026-09-12 against the
-# governing repository, `gh pr list --search 15` answered with PR #16 and PR
-# #10 — GitHub had matched the digits inside "**15 of the register's 41 rows**"
-# — and `ls-remote | grep 15` answered with a branch whose 40-character sha
-# merely contains them, all under the heading "existing work on this object".
-# A sibling that does not NAME the object is not evidence about it, and evidence
-# that is not evidence is how a lane talks itself out of a claim it should make.
-#
-# TWO READS, TWO TESTS, because the two inputs are not the same kind of text.
-#   pr      `gh pr list`'s rows, which are prose. A number in prose is a
-#           number; a REFERENCE is `#<n>`, so the hash is required — and its
-#           LEFT side is not bounded, because the canonical spelling of the
-#           thing being looked for is `owner/repo#15` and the character before
-#           the `#` is a letter. A row whose FIRST field is the number itself
-#           is kept too: that is the PR the object IS.
-#   branch  `ls-remote`'s refs, which are names. `issue-15-fix` names the
-#           object and carries no hash, so the bare number as a whole token is
-#           the test — after the leading sha is stripped, so a branch is matched
-#           by its name and never by the digits of the commit it points at.
-# An OpenSpec change directory has a word for a slug and takes the whole-token
-# test in both modes.
-#
-# AND READ 2 FILTERS OVER THE BODY. `gh pr list`'s columns are number, title,
-# branch and state; the reference that makes a PR a sibling is almost always in
-# its BODY, which is what GitHub's own search matched and what the columns do
-# not carry. Filtering the columns alone dropped PR #16 — the PR for this very
-# issue, whose body says `brettheap/new-workstation#15` twice — while a filter
-# with the hash optional kept #10 instead. So the body is fetched, flattened to
-# one line, used for the test, and cut off again before anything is printed:
-# under-reporting a sibling is the direction that lets a lane claim what
-# somebody is already working on, and it is the one direction Rule 1 cannot
-# afford.
-ere_quote() { printf '%s' "${1-}" | sed -E 's/[][(){}.^$*+?|\\/]/\\&/g'; }
-sibling_filter() {   # <object> [pr|branch]; candidate lines on stdin
-  sfl_slug="$(object_slug "$1")"
-  sfl_num="$(object_number "$1")"
-  sfl_mode="${2:-pr}"
-  if [ -z "$sfl_slug" ]; then cat; return 0; fi
-  sfl_q="$(ere_quote "$sfl_slug")"
-  if [ -n "$sfl_num" ] && [ "$sfl_mode" = pr ]; then
-    # `#<n>` anywhere, or the row's own number column.
-    awk -v sep="$(printf '\t')" -v n="$sfl_slug" -v re="#$sfl_q([^0-9A-Za-z]|$)" '
-      { if ($0 ~ re) { print; next }
-        split($0, f, sep); if (f[1] == n) print }'
-    return 0
-  fi
-  sed -E 's/^[0-9a-fA-F]{40}[[:space:]]+//' \
-    | grep -E -- "(^|[^0-9A-Za-z])$sfl_q([^0-9A-Za-z]|\$)" || :
-}
-
-gh_reads() {
-  gr_obj="$1"; gr_repo="$(object_repo "$gr_obj")"; gr_n="$(object_number "$gr_obj")"; gr_slug="$(object_slug "$gr_obj")"
-  gr_term="${gr_n:+#$gr_n}"; gr_term="${gr_term:-$gr_slug}"
-  if [ "$NO_GITHUB" = 1 ]; then
-    printf '1. existing claims on the object: not read (--no-github)\n'
-    printf '2. gh pr list --state all --search: not read (--no-github)\n'
-    printf '3. git ls-remote --heads: not read (--no-github)\n'
-    return 0
-  fi
-  command -v gh >/dev/null 2>&1 || { note "gh is not on PATH — rerun with --no-github, or install it"; return 1; }
-  printf '1. existing `CLAIMED —` comments on %s:\n' "$gr_obj"
-  if [ -n "$gr_n" ]; then
-    gr_c="$( { gh issue view "$gr_n" --repo "$gr_repo" --comments 2>/dev/null || gh pr view "$gr_n" --repo "$gr_repo" --comments 2>/dev/null; } | grep -n -e 'CLAIMED —' -e 'TAKEOVER —' -e 'RELEASED —' || : )"
-  else
-    gr_c=""
-  fi
-  printf '%s\n' "${gr_c:-   none}"
-  printf '2. `gh pr list --repo %s --state all --search "%s"`, kept where the row or its body names `%s`:\n' "$gr_repo" "$gr_term" "${gr_n:+#}$gr_slug"
-  # The body is fetched for the TEST and cut off before the print. `--json`
-  # needs a gh that has it; where it does not, the four columns are filtered on
-  # their own, which is strictly less recall and never a wrong answer.
-  gr_raw="$(gh pr list --repo "$gr_repo" --state all --search "$gr_term" --limit 20 \
-              --json number,title,headRefName,state,body \
-              -q '.[] | [.number, .title, .headRefName, .state, (.body // "" | gsub("[\r\n]+"; " "))] | @tsv' 2>/dev/null || :)"
-  [ -n "$gr_raw" ] || gr_raw="$(gh pr list --repo "$gr_repo" --state all --search "$gr_term" --limit 20 2>/dev/null || :)"
-  gr_p="$(printf '%s\n' "$gr_raw" | sibling_filter "$gr_obj" pr | cut -f1-4 || :)"
-  printf '%s\n' "${gr_p:-   none}"
-  printf '3. `git ls-remote --heads git@github.com:%s` branches naming `%s` as a whole token:\n' "$gr_repo" "$gr_slug"
-  gr_b="$(git ls-remote --heads "git@github.com:$gr_repo.git" 2>/dev/null | sibling_filter "$gr_obj" branch || :)"
-  printf '%s\n' "${gr_b:-   none}"
-  return 0
-}
-
-gh_comment() {
-  gc_obj="$1"; gc_body="$2"; gc_repo="$(object_repo "$gc_obj")"; gc_n="$(object_number "$gc_obj")"
-  [ "$NO_GITHUB" = 1 ] && return 1
-  [ -n "$gc_n" ] || { note "$gc_obj is a change directory, not an issue or a PR — no GitHub comment to post"; return 1; }
-  command -v gh >/dev/null 2>&1 || return 1
-  gc_url="$(printf '%s' "$gc_body" | gh issue comment "$gc_n" --repo "$gc_repo" --body-file - 2>/dev/null \
-         || printf '%s' "$gc_body" | gh pr comment "$gc_n" --repo "$gc_repo" --body-file - 2>/dev/null || :)"
-  gc_url="$(printf '%s\n' "$gc_url" | grep -o 'https://[^ ]*' | tail -n1 || :)"
-  [ -n "$gc_url" ] || return 1
-  printf '%s\n' "$gc_url"
-}
-
-# The hook `commit_push` calls after every `pull --rebase`, before it pushes.
-# If another lane's CLAIMED or TAKEOVER on this object is on the rebased
-# history, THEIRS LANDED FIRST and this claim has lost. Git's push
-# serialization is the arbiter across workstations; the local `mkdir` mutex
-# only serializes one workstation, and never decides a race.
-# Of the rival lanes in <holders>, the one whose line on <object> LANDED
-# first. Landing order is the arbiter and a timestamp is not: two
-# workstations' clocks are not a shared order, which is the whole reason this
-# amendment decides the race by which CLAIMED reaches `main` first. The
-# pickaxe lists the commits that added a line naming the object, oldest first;
-# the first of them that touched a rival's log names the winner.
-first_landed_of() {   # <object> <holder rows>
-  fl_obj="$1"; fl_holders="$2"
-  fl_first="$(printf '%s\n' "$fl_holders" | head -n1 | cut -d"$US" -f1)"
-  [ "$(printf '%s\n' "$fl_holders" | grep -c .)" -gt 1 ] || { printf '%s\n' "$fl_first"; return 0; }
-  have_remote_ref || { printf '%s\n' "$fl_first"; return 0; }
-  while IFS= read -r fl_sha; do
-    [ -n "$fl_sha" ] || continue
-    while IFS= read -r fl_f; do
-      [ -n "$fl_f" ] || continue
-      fl_lane="${fl_f##*/}"; fl_lane="${fl_lane%.md}"
-      # THE JOIN IS FILE NAME → HOLDER ROW, AND THE TWO NEED NOT SPELL THE LANE
-      # ALIKE (Copilot round 4). The file carries the row's canonical spelling
-      # from the moment the first write renames it (Amendment 15); the holder row
-      # carries whatever the winning LINE was typed with, which an append-only
-      # log never rewrites. Byte for byte this join missed the winner and the
-      # rescan fell back to the sorted-first holder — a CLAIM-LOST naming the
-      # wrong lane. Literal and case-insensitive, both defects at once.
-      if [ -n "$(printf '%s\n' "$fl_holders" | rows_named "$fl_lane")" ]; then printf '%s\n' "$fl_lane"; return 0; fi
-    done <<EOF
-$(git -C "$LANES_REPO" show --name-only --format= "$fl_sha" -- "$LANES_LOG_PREFIX" 2>/dev/null)
-EOF
-  done <<EOF
-$(git -C "$LANES_REPO" log --reverse --format=%H -S"$fl_obj" "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null)
-EOF
-  printf '%s\n' "$fl_first"
-}
-
-claim_rescan_hook() {
-  CLAIM_WINNER=""
-  # The pull has just moved `origin/<branch>`, and OUR commit is not on it —
-  # so everything this read can see landed before ours, which is the whole
-  # test. Flush the cache first: the ref moved a moment ago.
-  state_events_flush
-  # ISSUE #30's OWN RACE (Copilot round 12, PR #61): the dead-lane verdict was
-  # read ONCE, before this claim's first pull, and nothing about $CLAIM_OBJ has
-  # to change for that verdict to go stale — a RESUMED line is the LANE's own
-  # log, never an event on the object the scan below reads, so that scan alone
-  # can never catch a source lane waking back up. Re-run the SAME check the
-  # takeover was granted on, on every rebase this loop makes, and abandon
-  # exactly as a landed rival does the moment it no longer answers dead. A
-  # stale-claim takeover carries no such verdict to revalidate — `claim_is_stale`'s
-  # age does not run backwards — so this runs only where `CLAIM_SKIP_DEAD` says
-  # the skip was issue #30's.
-  if [ -n "$CLAIM_SKIP_DEAD" ] && [ -n "$CLAIM_SKIP" ] && ! holder_is_dead "$CLAIM_SKIP"; then
-    # THREE DIFFERENT ANSWERS, NEVER ONE SENTENCE (Copilot's own "closer
-    # look" on 21b8e82, PR #61): `holder_is_dead` returning false a SECOND
-    # time is not one fact. `HOLDER_LIVE_TERMINAL` set is a CONFIRMED
-    # revival; `HOLDER_TERMINAL_UNKNOWN` set is a read that failed — fail-
-    # closed for ownership, same as the grant itself demanded, but "I could
-    # not check" is not "it came back", and saying so would misreport a read
-    # failure as a fact this file never established; NEITHER set means the
-    # log's own last lane-kind line has moved past ENDED/RETIRED entirely —
-    # a resume in every sense but the word. Distinguished so the note says
-    # which actually happened here.
-    #
-    # AND A FOURTH, `HOLDER_NO_VERDICT` (Copilot on 05d7889, PR #61): the
-    # log itself could not be read, or yielded no lane-kind line at all. That
-    # is not "moved past the terminal line" — nothing was read to move — so
-    # it takes the could-not-reconfirm words, and `CLAIM_ABANDON_REVIVED`
-    # carries which kind of abort this was to the note and the CLAIM-LOST
-    # line `claim` writes after this hook returns, so neither says "alive
-    # again" about a lane nobody saw come back.
-    CLAIM_ABANDON_REVIVED=1
-    if [ -n "$HOLDER_LIVE_TERMINAL" ]; then
-      note "lane $CLAIM_SKIP is no longer confirmed dead — its own log ends $HOLDER_LIVE_TERMINAL, but a live session on this workstation now backs it up"
-    elif [ -n "$HOLDER_TERMINAL_UNKNOWN" ]; then
-      CLAIM_ABANDON_REVIVED=""
-      note "lane $CLAIM_SKIP's dead-lane verdict could not be reconfirmed — this workstation could not read whether a live session backs it up before this takeover's push landed. That is NOT 'still dead', so the takeover is abandoned rather than assumed safe"
-    elif [ -n "$HOLDER_BOUND_ELSEWHERE" ]; then
-      # AMENDMENT 18(b) (Copilot on 8ce6c9d, PR #61): the log the takeover
-      # was granted on now names a last binding on another host or container,
-      # whose liveness this place cannot pronounce — not a revival seen.
-      CLAIM_ABANDON_REVIVED=""
-      note "lane $CLAIM_SKIP's dead-lane verdict could not be reconfirmed — its last binding is now on $HOLDER_BOUND_ELSEWHERE (host/container), and from here that binding is UNKNOWN, never dead (Amendment 18(b)). The takeover is abandoned rather than assumed safe"
-    elif [ -n "$HOLDER_NO_VERDICT" ]; then
-      CLAIM_ABANDON_REVIVED=""
-      note "lane $CLAIM_SKIP's dead-lane verdict could not be reconfirmed — its own object log could not be read, or yielded no lane-kind line at all, before this takeover's push landed. That is NOT 'still dead' and NOT 'it resumed' either: nothing was read. The takeover is abandoned rather than assumed safe"
-    else
-      note "lane $CLAIM_SKIP is no longer confirmed dead — its own log has moved past the terminal line this takeover was granted on, a resume in every sense but the word"
-    fi
-    CLAIM_WINNER="$CLAIM_SKIP"
-    # A DISTINCT EXIT CODE, NOT A REUSE OF 7 (Copilot's own "closer look" on
-    # 21b8e82, PR #61): 7 is documented, elsewhere and before this PR
-    # (`lanes-edit.sh`'s own exit-code table, `docs/README-lanes.md`), as
-    # CLAIM-LOST — another lane's claim landing on main first — and
-    # automation reading that code for THIS abort would chase a remote race
-    # that never happened. 9 is this file's own public code, unused before
-    # now; the event this writes is still CLAIM-LOST (this attempt did not
-    # succeed, which is what that verb has always meant), but the PROCESS
-    # exit is not the SAME claim as a landed rival's.
-    return 9
-  fi
-  # CASE-INSENSITIVE ON BOTH EXCLUSIONS (Amendment 15), for the reason `claim`-s
-  # own pre-check carries it: these two remove THIS lane and the lane it is
-  # taking over from the set of rivals, and the row each removes carries whatever
-  # spelling the winning line used. Byte for byte, a lane whose earlier CLAIMED
-  # says `repohold-1` under the row `repoHold-1` loses the race to ITSELF and
-  # writes a CLAIM-LOST naming itself as the winner — measured, exit 7.
-  # AND LITERAL, not `grep -iv` (Copilot round 4): a name is not a pattern, and a
-  # rival removed because a `.` in THIS lane's name matched its spelling is a
-  # race this read reports as won when it was lost.
-  crh="$(state_events | lane_states_on "$CLAIM_OBJ" | holders_of "$CLAIM_OBJ" \
-         | rows_not_named "$CLAIM_LANE" | { [ -n "$CLAIM_SKIP" ] && rows_not_named "$CLAIM_SKIP" || cat; } || :)"
-  [ -n "$crh" ] || return 0
-  CLAIM_WINNER="$(first_landed_of "$CLAIM_OBJ" "$crh")"
-  IFS="$US" read -r crh_lane crh_verb crh_utc crh_rest <<EOF
-$(printf '%s\n' "$crh" | rows_named "$CLAIM_WINNER" | head -n1)
-EOF
-  note "another lane's claim landed on main before this one: @$CLAIM_WINNER ($crh_verb, $crh_utc)"
-  return 7
-}
-
-# The URL of the stale claim a TAKEOVER supersedes — Rule 1's takeover comment
-# must name it. Read from GitHub, because that is where the comment is.
-gh_stale_claim_url() {
-  gs_obj="$1"; gs_lane="$2"; gs_repo="$(object_repo "$gs_obj")"; gs_n="$(object_number "$gs_obj")"
-  [ "$NO_GITHUB" = 1 ] && return 1
-  [ -n "$gs_n" ] || return 1
-  command -v gh >/dev/null 2>&1 || return 1
-  gh issue view "$gs_n" --repo "$gs_repo" --json comments \
-     -q '.comments[] | select(.body | test("CLAIMED — lane '"$gs_lane"'")) | .url' 2>/dev/null | tail -n1
-}
-
-# ------------------------------- AMENDMENT 13(e): THE MIGRATION, ONE ACT -----
-#
-# `migrate-state-cells` empties every `state` cell of its diary INTO the lane's
-# own log, once, on Brett Heap's word (ratified decision O3: after the writer
-# changes are installed on both workstations — a cell must stop growing before
-# it is emptied). It is a DRY RUN unless `--yes` is passed, and it REFUSES to
-# run at all when no cell holds a ` · ` entry, so a second run is a no-op that
-# says so.
-#
-# NOTHING IS DELETED. The appended narrative exists in git history AND in
-# `lanes/archive/LANES-pre-amendment-13-<UTC>.md`, written in this same commit,
-# AND in the logs — three times over, which is the posture Amendment 3 took
-# after the 2026-09-08 loss.
-#
-# WHAT A ROW BECOMES. Its cell is split on ` · ` into entries, in cell order
-# (the cell grew by appending, so that is oldest first). Each entry becomes one
-# line in `lanes/log/<lane>.md`: `RULED` where the entry begins with RULING,
-# RULINGS or RATIFIED, else `NOTED`; the entry's own leading timestamp becomes
-# the line's UTC field rather than being repeated inside its text, and every
-# other character of the entry is carried verbatim — including the ` — ` these
-# entries are full of, which the log's parser reads as prose because a
-# lane-kind line's free text is introduced by the ` — ` right after its object.
-# The cell is then REPLACED by the state derived from the LAST entry's leading
-# verb where that verb is one of clause (a)'s, else by `MIGRATED`.
-#
-# THE FOUR FIELDS THAT ARE NOT IN THE ENTRY come from the row: the UTC of an
-# entry that carries none is the row's `started` (a date-only `started` is read
-# as midnight UTC that day, and the register's older minute-precision form is
-# accepted as Amendment 7(b) already accepts it); the session is the LAST uuid
-# of the row's session cell; the workstation is the first `/`-separated part of
-# the row's own column.
-#
-# AND A ROW THAT CANNOT BE MIGRATED IS SKIPPED AND NAMED, never guessed at and
-# never half-written. Its cell keeps its history, so a re-run after the row is
-# fixed by hand migrates exactly that row. Five reasons, all of them visible in
-# the dry run: an ambiguous row (more than six ` | ` separators — see
-# `row_split_state_cell`); a row whose session cell holds NO transcript uuid, so
-# the line could only name `unknown` in the one field this log must never carry
-# it in; two rows whose lane names differ only by case (Amendment 15(d)'s hand
-# merge); a lane whose object log is two files, or is published under a
-# spelling this checkout does not have; and a name that is not a lane name.
-# Measured against the live register on 2026-09-15 (52 rows): 20 rows migrate,
-# 1 has no uuid, 2 are ambiguous, and 29 hold no ` · ` entry at all and are
-# already one phrase.
-#
-# THE WORKSTATION IS A TOKEN OR IT IS `unknown`. Twelve of the live register's
-# rows carry `<workstation? — owner fills>` in that column, and that placeholder
-# holds a ` — `: written into the `session <uuid>@<ws>` field it would put a
-# THIRD ` — ` in the line, ahead of the object, and the log's own parser would
-# read the verb and the fields out of the wrong halves for ever. So the column
-# is read up to its first ` / `, and anything that is not one plain token
-# (letters, digits, `.`, `_`, `-`) is recorded as `unknown` — which is inert
-# here: no reader computes a lane's state, its window or its workstation from a
-# narrative line (Amendment 13(b)).
-
-# THESE FOUR ASSIGN A GLOBAL AND RETURN, rather than printing — the idiom
-# `table_lookup` states one screen up, for the same reason: *"a function whose
-# answer is taken with `$( … )` forks, which is the cost this exists to avoid"*.
-# They are asked once PER ENTRY, and the live register holds 2,206 entries
-# across its twenty diary cells. Measured on a copy of it, 2026-09-15: the
-# printing form took 94 seconds of a dry run, five forks an entry; this one
-# takes eleven.
-MIG_LEAD_UTC=""
-MIG_LEAD=""
-MIG_TRIM=""
-
-# Spaces off BOTH ends, forking nothing — `rstrip_spaces` and its mirror in one
-# place, for the one caller that runs them thousands of times in a row.
-mig_trim() {   # <text> — sets MIG_TRIM
-  MIG_TRIM="${1-}"
-  while [ "${MIG_TRIM# }" != "$MIG_TRIM" ]; do MIG_TRIM="${MIG_TRIM# }"; done
-  while [ "${MIG_TRIM% }" != "$MIG_TRIM" ]; do MIG_TRIM="${MIG_TRIM% }"; done
-}
-
-# The entry's own leading timestamp, or empty. Matched at the very start of the
-# entry and nowhere else: a UTC in the middle of a sentence is prose.
-mig_lead_utc() {   # <entry> — sets MIG_LEAD_UTC
-  MIG_LEAD_UTC=""
-  case "${1-}" in
-    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z*) MIG_LEAD_UTC="${1:0:20}" ;;
-    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]Z*)             MIG_LEAD_UTC="${1:0:17}" ;;
-  esac
-}
-
-# The row's `started` cell as an instant the log's grammar can read: the UTC it
-# already is, else midnight on the date it opens with, else empty — the live
-# register spells that column `2026-09-02`, `2026-09-04 ~15:30Z` and
-# `2026-09-13T17:41Z` in different rows.
-mig_started_utc() {   # <the started cell>
-  mig_trim "${1-}"
-  mig_lead_utc "$MIG_TRIM"
-  [ -n "$MIG_LEAD_UTC" ] && { printf '%s' "$MIG_LEAD_UTC"; return 0; }
-  case "$MIG_TRIM" in
-    [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*) printf '%sT00:00Z' "${MIG_TRIM:0:10}" ;;
-  esac
-}
-
-# Everything a leading state word or timestamp can hide behind, stripped: the
-# register writes `**LIVE**`, `> RULING …` and `` `PAUSED` `` in the same column.
-mig_strip_lead() {   # <text> — sets MIG_LEAD
-  MIG_LEAD="${1-}"
-  while :; do
-    case "$MIG_LEAD" in
-      ' '*|'*'*|'_'*|'`'*|'>'*|'#'*) MIG_LEAD="${MIG_LEAD#?}" ;;
-      *) break ;;
-    esac
-  done
-  mig_lead_utc "$MIG_LEAD"
-  [ -n "$MIG_LEAD_UTC" ] && { MIG_LEAD="${MIG_LEAD#"$MIG_LEAD_UTC"}"; MIG_LEAD="${MIG_LEAD# }"; }
-  return 0
-}
-
-# Clause (e)'s test: does this entry RECORD A RULING? Case-folded, because the
-# register spells it `RULING`, `Ruling` and `RULINGS` in the same week.
-# A CHARACTER CLASS PER LETTER, which is how a `case` matches without regard to
-# case in POSIX shell — and it forks nothing, where the `tr` it replaces forked
-# once per entry. `RULINGS` is `RULING*` already.
-mig_is_ruling() {   # <entry>
-  mig_strip_lead "${1:0:64}"
-  case "$MIG_LEAD" in
-    [Rr][Uu][Ll][Ii][Nn][Gg]* | [Rr][Aa][Tt][Ii][Ff][Ii][Ee][Dd]*) return 0 ;;
-  esac
-  return 1
-}
-
-# The current state the last entry names, or empty. The word must END where the
-# state word ends — `LIVELY` is not `LIVE` — and `LANDING #<n>` keeps its number,
-# because Rule 6's reading of this cell is unchanged by Amendment 13 and is now
-# the whole of what the cell says at that moment.
-mig_lead_state() {   # <entry>
-  mig_strip_lead "${1:0:64}"
-  mls="$MIG_LEAD"
-  case "$mls" in
-    'LANDING #'*)
-      mls_n="${mls#LANDING #}"
-      mls_d=""
-      while :; do
-        case "$mls_n" in
-          [0-9]*) mls_d="$mls_d${mls_n:0:1}"; mls_n="${mls_n:1}" ;;
-          *) break ;;
-        esac
-      done
-      # THE NUMBER ENDS WHERE THE WORD ENDS, exactly as `state_word_is_valid`
-      # and the five states below bound theirs. Without the test `LANDING #123abc`
-      # derived the state `LANDING #123` — a merge hold Rule 6 would read, out of
-      # an entry that names no PR at all (Copilot round 1 on openRepoTools#82).
-      case "$mls_n" in
-        '' | [!A-Za-z0-9]*) [ -n "$mls_d" ] && printf 'LANDING #%s' "$mls_d" ;;
-      esac
-      return 0 ;;
-    'HANDED OFF' | 'HANDED OFF'[!A-Za-z0-9]*) printf 'HANDED OFF'; return 0 ;;
-    LIVE    | LIVE[!A-Za-z0-9]*)    printf 'LIVE';    return 0 ;;
-    PAUSED  | PAUSED[!A-Za-z0-9]*)  printf 'PAUSED';  return 0 ;;
-    LANDED  | LANDED[!A-Za-z0-9]*)  printf 'LANDED';  return 0 ;;
-    ENDED   | ENDED[!A-Za-z0-9]*)   printf 'ENDED';   return 0 ;;
-    RETIRED | RETIRED[!A-Za-z0-9]*) printf 'RETIRED'; return 0 ;;
-  esac
-  return 0
-}
-
-# IS THIS CELL ALREADY CLAUSE (a)'s PHRASE? `<STATE> · <UTC> · <one line>` —
-# exactly three parts, the first one of the seven states (or the migration's own
-# `MIGRATED`) and the second an instant.
-#
-# WITHOUT THIS THE MIGRATION READS ITS OWN OUTPUT AS A DIARY. The phrase it
-# writes carries two ` · ` of its own, so "the cell holds a ` · ` entry" is true
-# of every row the moment it has been migrated, and clause (e)'s refusal —
-# *"it REFUSES to run when no cell holds a ` · ` entry, so a second run is a
-# no-op that says so"* — could never fire on a register that had just been
-# migrated. Measured: the second run re-split every migrated cell into three
-# entries and would have appended them to the logs again.
-mig_cell_is_phrase() {   # <cell>
-  mcp="${1-}"
-  case "$mcp" in *' · '*) : ;; *) return 1 ;; esac
-  mcp_a="${mcp%% · *}"; mcp_r="${mcp#* · }"
-  case "$mcp_r" in *' · '*) : ;; *) return 1 ;; esac
-  mcp_b="${mcp_r%% · *}"; mcp_c="${mcp_r#* · }"
-  case "$mcp_c" in *' · '*) return 1 ;; esac       # a fourth part is not the phrase
-  [ -n "$mcp_c" ] || return 1
-  case "$mcp_a" in
-    MIGRATED) : ;;
-    *) state_word_is_valid "$mcp_a" || return 1 ;;
-  esac
-  mig_lead_utc "$mcp_b"
-  [ -n "$mcp_b" ] && [ "$MIG_LEAD_UTC" = "$mcp_b" ] || return 1
-  return 0
-}
-
-# The workstation field of a migrated line — see the paragraph above.
-mig_row_ws() {   # <the workstation column>
-  mrw="${1%% / *}"
-  mrw="$(rstrip_spaces "$mrw")"
-  case "$mrw" in
-    '' | *[!A-Za-z0-9._-]*) printf 'unknown' ;;
-    *) printf '%s' "$mrw" ;;
-  esac
-}
-
-# A BLOCK OF LINES APPENDED WITH THE SAME PROOF `append_text_line` MAKES FOR
-# ONE. A lane's whole migrated history is appended in a single act — the alt is
-# one call per entry, and on the live register that is hundreds of full copies
-# of a log and hundreds of `1 line appended to …` notes for what is one write.
-# The proof is the stronger of the two `append_text_line` states: the file
-# afterwards must be exactly its old bytes followed by exactly this block.
-append_text_block() {   # <target> <block, lines separated by newlines>
-  atb_t="$1"; atb_b="$2"
-  [ -n "$atb_b" ] || return 0
-  ATB_TMPD="$(mktemp -d)"
-  atb_pre="$ATB_TMPD/pre"
-  cat -- "$atb_t" > "$atb_pre"
-  atb_before="$(wc -l < "$atb_pre" | tr -d ' ')"
-  atb_n="$(printf '%s\n' "$atb_b" | wc -l | tr -d ' ')"
-  printf '%s\n' "$atb_b" >> "$atb_t"        # >> FOLLOWS the symlink
-  atb_after="$(wc -l < "$atb_t" | tr -d ' ')"
-  [ "$atb_after" -eq "$((atb_before + atb_n))" ] ||
-    die "append changed line count by $((atb_after - atb_before)) where $atb_n lines were appended; inspect $atb_t" 5
-  { cat -- "$atb_pre"; printf '%s\n' "$atb_b"; } | cmp -s -- "$atb_t" - ||
-    die "append rewrote existing bytes; inspect $atb_t" 5
-  # AND THE COPY GOES, because it is a whole log and there is one per lane: the
-  # live register's migration makes twenty of them in a run, and a dry run makes
-  # them while reporting that nothing was written (Copilot round 1 on
-  # openRepoTools#82). It is removed HERE, where the proof has just passed, and
-  # a `die` above leaves it for the same reason every other `mktemp -d` in this
-  # file leaves one: a refused write is evidence.
-  rm -rf -- "$ATB_TMPD"
-  note "$atb_n lines appended to $atb_t"
-}
-
-# The act itself. `<1>` writes; `<0>` is the dry run, which reads exactly the
-# same things, reports exactly the same rows, and touches nothing.
-migrate_state_cells() {   # <1 = the act, 0 = the dry run>
-  msc_do="${1:-0}"
-  msc_utc="$(utc_now)"
-  msc_tmp="$(mktemp -d)"
-  mkdir -p "$msc_tmp/block"
-  : > "$msc_tmp/report"; : > "$msc_tmp/skips"; : > "$msc_tmp/cells"; : > "$msc_tmp/targets"
-  msc_arch_rel="${LANES_PREFIX}archive/LANES-pre-amendment-13-$msc_utc.md"
-  msc_arch="$LANES_DIR/archive/LANES-pre-amendment-13-$msc_utc.md"
-
-  # THE FETCH FIRST (R30), AND A CHECKOUT THAT IS BEHIND IS REFUSED. This one
-  # act rewrites every row of the register and appends to every lane's log in a
-  # single commit; made against a register that is not the published one, each
-  # of those rewrites is a conflict for `commit_push`'s rebase to resolve, and
-  # the one it cannot resolve costs the whole migration its atomicity.
-  log_sync
-  if [ "$NO_GIT" != 1 ] && have_remote_ref; then
-    msc_behind="$(git -C "$LANES_REPO" rev-list --count "HEAD..origin/$LANES_BRANCH" 2>/dev/null || printf '')"
-    case "$msc_behind" in
-      '' | 0) : ;;
-      *) die "this checkout is $msc_behind commit(s) behind origin/$LANES_BRANCH. The migration rewrites EVERY row and every lane's log in ONE commit, so it is made against the published register or not at all. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2 ;;
-    esac
-  fi
-  refuse_dirty_checkout "migrate-state-cells" "$LANES_PATH"
-
-  # THE MUTEX COMES BEFORE THE SCAN, NOT BETWEEN THE SCAN AND THE WRITE (Copilot
-  # round 2 on openRepoTools#82). This act reads every row's LINE NUMBER and its
-  # cell, and then rewrites those lines BY NUMBER: a peer's `add-row` or
-  # `replace-in-row` landing in this checkout between the two moves the lines
-  # under it, and `replace_line` then rewrites the wrong row — its one-line proof
-  # holds for the line it was given, not for the row a person meant. So the scan
-  # and the write happen inside ONE hold of the lock.
-  #
-  # THE DRY RUN TAKES NO LOCK AT ALL. It writes nothing, so a row that moves
-  # under it costs a report one line of accuracy and nothing else — and a read
-  # that holds the estate's one register mutex for the seconds this scan takes
-  # is a read that blocks every lane's write to say what it would have done.
-  [ "$msc_do" = 1 ] && acquire_lock
-
-  # TWO ROWS FOR ONE LANE UNDER TWO CASES ARE 15(d)'s HAND MERGE, and both of
-  # them are skipped rather than migrated into one log under a name that means
-  # two rows.
-  msc_dups="$(awk '
-    substr($0,1,1) == "|" {
-      p1 = index($0, "`"); if (p1 == 0) next
-      r = substr($0, p1 + 1); p2 = index(r, "`"); if (p2 == 0) next
-      print tolower(substr(r, 1, p2 - 1))
-    }' "$LANES_FILE" | LC_ALL=C sort | LC_ALL=C uniq -d)"
-
-  msc_rows=0; msc_ok=0; msc_lines=0; msc_noted=0; msc_ruled=0; msc_skipped=0
-  msc_phrase=0; msc_plain=0; msc_before=0; msc_after=0
-
-  while IFS="$(printf '\t')" read -r msc_n msc_lane; do
-    [ -n "${msc_n:-}" ] || continue
-    msc_rows=$((msc_rows + 1))
-    msc_why=""
-    case "$msc_lane" in
-      '' | *[!A-Za-z0-9._-]* | .* | -*) msc_why="'$msc_lane' is not a lane name (letters, digits, . _ -), so it names no log this writer would create" ;;
-    esac
-    if [ -z "$msc_why" ] && [ -n "$msc_dups" ]; then
-      msc_low="$(lc "$msc_lane")"
-      while IFS= read -r msc_d; do
-        [ -n "$msc_d" ] || continue
-        [ "$msc_d" = "$msc_low" ] && msc_why="the register holds more than one row whose lane name is $msc_lane under some case — one lane is ONE lane (Amendment 15), and the two are merged by hand into one row (15(d)) before either is migrated"
-      done <<EOF
-$msc_dups
-EOF
-    fi
-    msc_row="$(sed -n -e "${msc_n}p" "$LANES_FILE")"
-    if [ -z "$msc_why" ]; then
-      msc_rc=0; row_split_state_cell "$msc_row" || msc_rc=$?
-      case "$msc_rc" in
-        0) : ;;
-        2) msc_why="its row carries $(row_sep_count "$msc_row") ' | ' separators where a seven-column row carries 6, so which text is the state cell is not knowable from the row (escape the literal pipe inside a cell as \\| by hand, commit it, and re-run)" ;;
-        *) msc_why="its row does not open with '|' and end with '|'" ;;
-      esac
-    fi
-    if [ -z "$msc_why" ]; then
-      mig_trim "$RSS_CELL"; msc_cell="$MIG_TRIM"
-      msc_head="$RSS_HEAD"; msc_tail="$RSS_TAIL"
-      # TWO WAYS A CELL HOLDS NO HISTORY, AND THEY ARE NOT THE SAME FACT
-      # (Copilot round 1 on openRepoTools#82). A cell that is already
-      # `<STATE> · <UTC> · <one line>` is in clause (a)'s shape and there is
-      # nothing to do. A cell holding ONE WORD — `ACTIVE`, `LIVE`, the bare
-      # states this register is full of — has no diary to move either, so this
-      # act leaves it alone, but it is NOT in the shape: the next
-      # `set-row-state` on that lane puts it there, and reporting the two as one
-      # number would say the register was compliant when a third of it is not.
-      case "$msc_cell" in
-        *' · '*) : ;;
-        *) msc_plain=$((msc_plain + 1)); continue ;;
-      esac
-      if mig_cell_is_phrase "$msc_cell"; then msc_phrase=$((msc_phrase + 1)); continue; fi
-      # THE SEAM (Brett Heap's ruling of 2026-10-04; Copilot round 2 on
-      # openRepoTools#97). This act rewrites a row's state cell and appends to
-      # its lane's log, so a lane the managed ledger has enrolled is not a row it
-      # may take — and the historical shorthand `MANAGED OWNER · <token>` holds
-      # ONE ` · `, so `mig_cell_is_phrase` does not recognise it and, unasked,
-      # the row was planned as a diary and rewritten to `MIGRATED · …`.
-      # ONE SUCH ROW REFUSES THE WHOLE MIGRATION, exactly as one refuses the
-      # whole of Amendment 19's sweep: clause (e) makes this act ONE commit, and
-      # a register migrated but for its managed rows is not that commit. Asked
-      # HERE and not at the top of the loop: a row skipped above (15(d)'s
-      # duplicate pair, a row that is not seven columns, one word, the phrase) is
-      # never rewritten and has nothing to refuse, and asking first would turn
-      # today's skips into refusals. Both modes ask, because the dry run reports
-      # exactly what the act would do. `die` releases the lock the act holds.
-      # The seam reads this checkout's row as well as the published one, and
-      # this checkout's row is the one the migration rewrites.
-      managed_seam_refuse "$msc_lane" "migrate-state-cells (the WHOLE migration, which Amendment 13(e) makes one commit)"
-    fi
-    if [ -z "$msc_why" ]; then
-      # The row's own columns, walked from the LEFT out of the head this split
-      # already proved reassembles: 3 is `<workstation> / <env> / <user>` and 4
-      # is `started (UTC)`.
-      msc_h="${msc_head#| }"
-      msc_h="${msc_h#* | }"                    # past the lane cell
-      msc_h="${msc_h#* | }"                    # past the session cell
-      msc_c3="${msc_h%% | *}"                  # workstation / env / user
-      msc_c4="${msc_h#* | }"; msc_c4="${msc_c4%% | *}"   # started (UTC)
-      msc_ws="$(mig_row_ws "$msc_c3")"
-      msc_started="$(mig_started_utc "$msc_c4")"
-      [ -n "$msc_started" ] || msc_started="$msc_utc"
-      msc_uuid=""
-      if row_split_session_cell "$msc_row"; then
-        msc_uuid="$(printf '%s\n' "$RSC_CELL" | uuids_in_cell | tail -n1)"
-      fi
-      [ -n "$msc_uuid" ] ||
-        msc_why="its session cell holds no transcript uuid, and the session field of an event line is a transcript uuid and only that (Amendment 7(b)) — a migrated line naming 'unknown' there is wrong for ever in an append-only file. Read the cell and set the row by hand instead: lanes-edit.sh set-row-state $msc_lane \"<STATE> · <one line>\""
-    fi
-    if [ -z "$msc_why" ]; then
-      # The lane's log, found whatever its case, and never created beside one
-      # this checkout has not pulled (Amendment 15, `ensure_log`'s own guard).
-      msc_pub=""; msc_prc=0
-      msc_pub="$(log_path_ci "$msc_lane")" || msc_prc=$?
-      if [ "$msc_prc" != 0 ]; then
-        msc_why="its object log is published twice under names that differ only by case (above) — 15(d)'s hand merge"
-      else
-        msc_loc="$(log_files_named_ci "$msc_lane")"
-        msc_ln="$(printf '%s' "$msc_loc" | grep -c . || :)"
-        if [ "$msc_ln" -gt 1 ]; then
-          msc_why="this checkout holds $msc_ln object logs for it whose names differ only by case — 15(d)'s hand merge"
-        elif [ "$msc_ln" = 1 ]; then
-          msc_lf="$msc_loc"; msc_rel="${LANES_LOG_PREFIX}${msc_loc##*/}"
-          if [ "${msc_rel##*/}" != "${msc_pub##*/}" ]; then
-            msc_why="its object log is published as $msc_pub while this checkout has ${msc_rel##*/} — a case-only rename whose commit never landed. Pull first, or merge them (15(d))"
-          elif [ "$NO_GIT" != 1 ] && ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$msc_rel" >/dev/null 2>&1; then
-            # AN UNTRACKED LOG IS SOMEBODY'S UNCOMMITTED WORK, AND THIS ACT WOULD
-            # COMMIT IT (Copilot round 2 on openRepoTools#82). A log that is
-            # TRACKED and dirty is already refused for the whole run by
-            # `refuse_dirty_checkout` above, which exempts the register alone and
-            # reads staged and unstaged alike; an untracked file is in neither of
-            # those lists, so appending to it here would put a peer's first lines
-            # into this migration's one commit under this migration's message.
-            # The row is skipped and the file named, exactly as the other five
-            # reasons are, and its cell keeps every character.
-            msc_why="its object log ${msc_rel} exists here but is NOT TRACKED — somebody's uncommitted work, which this act would commit inside the migration's own commit. Commit it first (\`git -C $LANES_REPO commit -m \"<what it is>\" -- $msc_rel\`) and re-run"
-          fi
-        else
-          msc_rel="$msc_pub"; msc_lf="$LANES_LOG_DIR/${msc_pub##*/}"
-        fi
-      fi
-    fi
-    if [ -n "$msc_why" ]; then
-      msc_skipped=$((msc_skipped + 1))
-      printf '  %-26s %s\n' "$msc_lane" "$msc_why" >> "$msc_tmp/skips"
-      continue
-    fi
-
-    # THE ENTRIES, IN CELL ORDER — which is oldest first, because the cell grew
-    # by appending.
-    #
-    # SPLIT BY `awk`, IN ONE PASS, and not by `${cell#* · }` in a loop. That
-    # expansion is the shortest-prefix form: bash walks every prefix length in
-    # turn, so its cost is quadratic in the DISTANCE TO THE MATCH — cheap while
-    # the entries are short and ruinous for one long entry near the end of a
-    # 94,341-character cell. Measured on this bash, 2026-09-15: six of those
-    # expansions over a 95,000-character string with no match at all take 16
-    # seconds. One pass of `awk` is linear in the cell whatever the entries look
-    # like. A register row is ONE LINE, so an entry can hold no newline and a
-    # line of this stream is exactly an entry.
-    : > "$msc_tmp/block/$msc_n"
-    msc_en=0; msc_last=""
-    while IFS= read -r msc_e; do
-      mig_trim "$msc_e"; msc_e="$MIG_TRIM"
-      if [ -n "$msc_e" ]; then
-        msc_last="$msc_e"
-        mig_lead_utc "$msc_e"; msc_eutc="$MIG_LEAD_UTC"
-        msc_text="$msc_e"
-        if [ -n "$msc_eutc" ]; then
-          msc_t2="${msc_e#"$msc_eutc"}"; mig_trim "$msc_t2"; msc_t2="$MIG_TRIM"
-          # AN ENTRY THAT IS NOTHING BUT A TIMESTAMP KEEPS IT AS ITS TEXT: a
-          # line whose free text is empty is a line with a dangling ` — `, and
-          # this log is never rewritten.
-          [ -n "$msc_t2" ] && msc_text="$msc_t2"
-        else
-          msc_eutc="$msc_started"
-        fi
-        if mig_is_ruling "$msc_e"; then msc_verb=RULED; msc_ruled=$((msc_ruled + 1))
-        else                            msc_verb=NOTED; msc_noted=$((msc_noted + 1)); fi
-        printf '%s — lane %s, session %s@%s, %s, lane:%s — %s\n' \
-          "$msc_verb" "$msc_lane" "$msc_uuid" "$msc_ws" "$msc_eutc" "$msc_lane" "$msc_text" >> "$msc_tmp/block/$msc_n"
-        msc_en=$((msc_en + 1)); msc_lines=$((msc_lines + 1))
-      fi
-    done <<EOF
-$(printf '%s\n' "$msc_cell" | awk '{ gsub(/ · /, "\n"); print }')
-EOF
-    if [ "$msc_en" = 0 ]; then
-      msc_plain=$((msc_plain + 1)); rm -f -- "$msc_tmp/block/$msc_n"; continue
-    fi
-
-    # THE CELL IT BECOMES — clause (e): the state the LAST entry's leading verb
-    # names, where that verb is one of clause (a)'s, else `MIGRATED`.
-    msc_state="$(mig_lead_state "$msc_last")"
-    [ -n "$msc_state" ] || msc_state=MIGRATED
-    # THE CAP IS THE CAP HERE TOO (Copilot round 5 on openRepoTools#82). This
-    # builds the cell directly rather than through `set-row-state`, so nothing
-    # else enforces ratified decision O1's 240 characters on the line — and the
-    # line carries a PATH whose length is the lane's name: `check_lane_name`
-    # bounds a name's characters and not its length, so a lane named with 216 of
-    # them would be migrated to a cell the writer itself would refuse. Cut back
-    # to the last space, for the reason the three commands' `cut_to_line` gives:
-    # `${s:0:n}` counts bytes wherever the locale is not a UTF-8 one.
-    msc_line="history in $msc_rel"
-    if [ "${#msc_line}" -gt 230 ]; then
-      msc_line="${msc_line:0:230}"
-      case "$msc_line" in *' '*) msc_line="${msc_line% *}" ;; esac
-      msc_line="$msc_line ..."
-    fi
-    msc_new="$msc_state · $msc_utc · $msc_line"
-    printf '%s%s%s%s%s%s%s\n' "$msc_n" "$US" "$msc_new" "$US" "$msc_head" "$US" "$msc_tail" >> "$msc_tmp/cells"
-    printf '%s%s%s%s%s\n' "$msc_n" "$US" "$msc_lf" "$US" "$msc_rel" >> "$msc_tmp/targets"
-    printf '  %-26s %4s entries  %7s chars → %s\n' \
-      "$msc_lane" "$msc_en" "${#msc_cell}" "$msc_new" >> "$msc_tmp/report"
-    msc_ok=$((msc_ok + 1))
-    msc_before=$((msc_before + ${#msc_cell})); msc_after=$((msc_after + ${#msc_new}))
-  done <<EOF
-$(awk 'substr($0,1,1) == "|" {
-         p1 = index($0, "`"); if (p1 == 0) next
-         r = substr($0, p1 + 1); p2 = index(r, "`"); if (p2 == 0) next
-         printf "%d\t%s\n", NR, substr(r, 1, p2 - 1)
-       }' "$LANES_FILE")
-EOF
-
-  # ------------------------------------------------------------- the report
-  printf 'migrate-state-cells — %s (lane-collision-protocol Amendment 13(e))\n' \
-    "$( [ "$msc_do" = 1 ] && printf 'THE ACT' || printf 'DRY RUN, nothing is written' )"
-  printf '  register : %s\n' "$LANES_FILE"
-  printf '  archive  : %s\n' "$msc_arch_rel"
-  printf '  rows     : %s read · %s to migrate · %s already the phrase · %s one word, no history · %s skipped\n' \
-    "$msc_rows" "$msc_ok" "$msc_phrase" "$msc_plain" "$msc_skipped"
-  if [ "$msc_ok" -gt 0 ]; then
-    printf '\n  lane                      entries    cell now → the phrase it becomes\n'
-    cat -- "$msc_tmp/report"
-  fi
-  if [ "$msc_skipped" -gt 0 ]; then
-    printf '\n  SKIPPED — nothing is written for these rows and their cells keep every\n'
-    printf '  character, so a re-run after each is settled migrates exactly it:\n'
-    cat -- "$msc_tmp/skips"
-  fi
-  if [ "$msc_plain" -gt 0 ]; then
-    printf '\n  %s row(s) hold ONE WORD and no history (`ACTIVE`, `LIVE`, …). This act leaves\n' "$msc_plain"
-    printf '  them exactly as they are — there is no diary in them to move — and they are NOT\n'
-    printf '  yet `<STATE> · <UTC> · <one line>`: the next set-row-state on each writes it.\n'
-  fi
-  printf '\n  log lines: %s (%s NOTED, %s RULED) into %s log(s)\n' "$msc_lines" "$msc_noted" "$msc_ruled" "$msc_ok"
-  printf '  state cells: %s characters → %s\n' "$msc_before" "$msc_after"
-
-  # THE REFUSAL CLAUSE (e) ASKS FOR, and it is the same answer in both modes:
-  # a register whose cells hold no ` · ` entry has already been migrated (or
-  # never needed it), and a second run is a no-op that says so.
-  if [ "$msc_ok" = 0 ]; then
-    msc_left=""
-    [ "$msc_skipped" -gt 0 ] && msc_left=" The $msc_skipped row(s) listed above still hold theirs and are the ones this act cannot take; each is settled by the line beside it, and a re-run then migrates exactly those."
-    rm -rf -- "$msc_tmp"
-    die "no cell holds a ' · ' entry this act can migrate: $msc_phrase row(s) are already in Amendment 13(a)'s shape and $msc_plain hold ONE WORD and no history, which this act leaves alone — the next \`set-row-state\` on each of those lanes writes it as the phrase.$msc_left The migration is ONE act and this was not it — nothing was written." 2
-  fi
-  if [ "$msc_do" != 1 ]; then
-    printf '\n  DRY RUN — nothing was written. Make it the one act with:  lanes-edit.sh migrate-state-cells --yes\n'
-    printf '  (Amendment 13(e): one commit carrying the archive, the logs and the register.)\n'
-    rm -rf -- "$msc_tmp"
-    return 0
-  fi
-
-  # --------------------------------------------------------------- the write
-  #
-  # THE LOCK IS ALREADY HELD — it was taken BEFORE the scan, so the line numbers
-  # rewritten below are the ones this invocation read (Copilot round 2 on
-  # openRepoTools#82).
-  #
-  # AND A PEER'S REGISTER EDIT IS CAPTURED HERE, AFTER EVERY REFUSAL AND SKIP OF
-  # THE SCAN AND BEFORE THE FIRST BYTE IS WRITTEN (openRepoTools#157 item 4b).
-  # Captured before the scan, a refusal in it — the seam's, or the "nothing to
-  # migrate" one — left a `LANES(pre-existing@…)` commit behind: a refusal that
-  # wrote, which `capture_register_edit` names as the one thing it must never
-  # be. The capture commits the file's bytes and changes none of them, so what
-  # the scan read is what is committed, as it was. `retire_rows` and
-  # `archive_rows` capture at their writes for the same reason.
-  handle_preexisting "$LANES_PATH"
-  #
-  # EVERYTHING BELOW IS ONE COMMIT OR NONE. The archive, the appended logs and
-  # the rewritten rows are made on disk first and published by the single
-  # `commit_push` at the end, so a refusal in the middle of them — a log whose
-  # append could not be proved, a row whose rewrite moved more than one line —
-  # leaves this checkout DIRTY and the register unpublished, which is what
-  # `git status` then shows and `git checkout -- lanes` undoes whole. Nothing is
-  # half-published, because the commit is the only thing that publishes; and a
-  # re-run on a checkout still holding that half is REFUSED by
-  # `refuse_dirty_checkout` above rather than made twice.
-  mkdir -p -- "$LANES_DIR/archive" || die "could not create $LANES_DIR/archive — the archive is written BEFORE anything else changes, so nothing has been" 6
-  # A `>` REDIRECT, WHICH FOLLOWS A SYMLINK, and the source read whole first:
-  # this copy is the file's state before this act and it is one of the three
-  # places clause (e) keeps it.
-  cat -- "$LANES_FILE" > "$msc_arch" || die "could not write the archive $msc_arch — nothing else has been touched" 6
-  cmp -s -- "$LANES_FILE" "$msc_arch" || die "the archive $msc_arch is not byte for byte the register it was copied from; nothing else has been touched" 5
-  note "archive written: $msc_arch_rel"
-  reg_wrote "$msc_arch_rel (the register as it was)"
-
-  msc_paths=("$LANES_PATH" "$msc_arch_rel")
-  while IFS="$US" read -r msc_n msc_lf msc_rel; do
-    [ -n "${msc_n:-}" ] || continue
-    if [ ! -f "$msc_lf" ]; then
-      mkdir -p -- "$LANES_LOG_DIR"
-      msc_base="${msc_lf##*/}"
-      printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "${msc_base%.md}" > "$msc_lf"
-      note "created $msc_lf"
-    fi
-    append_text_block "$msc_lf" "$(cat -- "$msc_tmp/block/$msc_n")"
-    msc_paths+=("$msc_rel")
-  done <<EOF
-$(cat -- "$msc_tmp/targets")
-EOF
-  [ "${#msc_paths[@]}" -le 2 ] || reg_wrote "$(( ${#msc_paths[@]} - 2 )) lanes' logs under $LANES_LOG_PREFIX (their migrated lines)"
-
-  msc_rows=0
-  while IFS="$US" read -r msc_n msc_new msc_head msc_tail; do
-    [ -n "${msc_n:-}" ] || continue
-    replace_line "$msc_n" "$msc_head$msc_new $msc_tail"
-    msc_rows=$((msc_rows + 1))
-    [ "$msc_rows" != 1 ] || reg_wrote "$LANES_PATH (the state cells rewritten before this one)"
-  done <<EOF
-$(cat -- "$msc_tmp/cells")
-EOF
-
-  msc_msg="LANES(migrate@$WS): Amendment 13(e) — $msc_ok state cells become one phrase; $msc_lines lines ($msc_noted NOTED, $msc_ruled RULED) into the lanes' own logs; pre-migration register archived"
-  commit_push "$msc_msg" "${msc_paths[@]}"
-  msc_rc=$?
-  release_lock
-  # THE STAGING GOES ON THE WAY OUT, on both paths: this directory holds a block
-  # of log lines per migrated lane, and on the live register that is 2,206 lines
-  # (Copilot round 1 on openRepoTools#82). A `die` on the way here keeps it, like
-  # every other refused write in this file.
-  rm -rf -- "$msc_tmp"
-  return "$msc_rc"
-}
-
-# ------------------------------------- the restart intent (openRepoTools#94)
-#
-# WHY THIS IS A FILE AND NOT AN ENVIRONMENT VARIABLE, measured on Eagle
-# 2026-09-15T20:59Z and filed as `opensoft/openRepoTools#94`. `/ctx` respawned
-# its own pane with `LANE_START_FRESH=1 … lane openRepoTools-3` and what came
-# up was `claude --name openRepoTools-3 --resume <the uuid it had just paused>`.
-# `lane-start` was not at fault — its `(( ! fresh ))` gates were in the
-# installed copy and are in this tree — and neither was `lane`, which `exec`s.
-# The launcher is: `claude-profile` re-creates the child through tmux, and its
-# own comment states the rule this estate now has to build around —
-#
-#   "`tmux new-session` hands the command the SERVER's environment, not this
-#    client's, so a variable the operator exported in their own shell reaches
-#    the child only if it is written into the command string"
-#
-# — which is why it threads six values explicitly and why a seventh nobody
-# thought to thread is simply GONE. The defect capture's session name,
-# `claude-max-001-20260915205926-456327`, is that launcher's own
-# `claude-<profile>-<timestamp>-<pid>` pattern, so this is what happened and not
-# what might have. An ENVIRONMENT seam cannot cross a boundary another
-# repository owns. A FILE can: the intent is written under the lane's own
-# control root before the old process is killed, and every launch after it
-# reads the same bytes whatever the environment did.
-#
-# THE CONTROL ROOT follows the same layout as the diagnostic lifecycle from
-# openRepoTools#97. The restart helpers have their own namespace: their strict
-# validation and private atomic writer must not be replaced by the diagnostic
-# helpers. The intent sits beside lane-state.yaml without sharing its authority.
-
-LANE_RESTART_SCHEMA=1
-
-# THE CONTROL ROOT — explicit override, retained intent, then creation rungs.
-# 0 with a path, 8 with no rung, 1 for unknown or competing locations.
-lane_restart_control_root() {   # <lane> [<payload>] [<checkout hint>]
-  lcr_lane="${1-}"; lcr_pay="${2-}"; lcr_dir=""; lcr_par=""
-  lcr_record_root=""; lcr_projects_root=""; lcr_existing=""
-  [ -n "$lcr_lane" ] || return 8
-  if [ -n "${LANES_LANE_STATE_ROOT:-}" ]; then
-    printf '%s/%s\n' "${LANES_LANE_STATE_ROOT%/}" "$lcr_lane"
-    return 0
-  fi
-  [ -n "$lcr_pay" ] && lcr_dir="$(payload_subfield "$lcr_pay" dir)"
-  if [ -z "$lcr_dir" ]; then
-    lcr_dir="$(lane_payload_field "$lcr_lane" dir 2>/dev/null || :)"
-  fi
-  case "$lcr_dir" in
-    /*) lcr_par="${lcr_dir%/*}" ;;
-    *)  lcr_par="" ;;
-  esac
-  if [ -n "$lcr_par" ]; then
-    lcr_record_root="$lcr_par/.lane-state/$lcr_lane"
-    lane_restart_root_ok "$lcr_record_root" || return 1
-    [ -d "$lcr_par" ] || lcr_record_root=""
-  fi
-  if [ -n "${PROJECTS_ROOT:-}" ]; then
-    lcr_projects_root="${PROJECTS_ROOT%/}/.lane-state/$lcr_lane"
-    lane_restart_root_ok "$lcr_projects_root" || return 1
-    [ -d "$PROJECTS_ROOT" ] || lcr_projects_root=""
-  fi
-  # PAUSED may first record a nested checkout after reservation. Existing
-  # intent authority stays at its physical location; validity is the reader's
-  # gate, never a reason to bypass an occupied path. Unknown ancestry refuses.
-  # Only directory aliases share an atomic replacement entry; separate leaf
-  # symlinks/hardlinks would split into two records on the next replacement.
-  for lcr_candidate in "$lcr_record_root" "$lcr_projects_root"; do
-    [ -n "$lcr_candidate" ] || continue
-    lcr_file="$lcr_candidate/restart-intent.yaml"
-    if [ -e "$lcr_file" ] || [ -L "$lcr_file" ]; then
-      if [ -n "$lcr_existing" ] && [ "$lcr_candidate" != "$lcr_existing" ] &&
-         [ ! "$lcr_candidate" -ef "$lcr_existing" ]; then
-        note "lane $lcr_lane has distinct restart-intent locations in $lcr_existing and $lcr_candidate; reconcile these records before continuing. Nothing was written."
-        return 1
-      fi
-      [ -n "$lcr_existing" ] || lcr_existing="$lcr_candidate"
-    fi
-  done
-  if [ -n "$lcr_existing" ]; then
-    printf '%s\n' "$lcr_existing"
-    return 0
-  fi
-  if [ -n "$lcr_record_root" ]; then
-    printf '%s\n' "$lcr_record_root"
-    return 0
-  fi
-  if [ -n "$lcr_projects_root" ]; then
-    printf '%s\n' "$lcr_projects_root"
-    return 0
-  fi
-  # A checkout hint is a last resort, so reads cannot hide an intent that
-  # writers/status already placed under the established root rungs.
-  case "${3-}" in
-    /*) lcr_par="${3%/*}"
-        if [ -n "$lcr_par" ] && [ -d "$lcr_par" ]; then
-          printf '%s/.lane-state/%s\n' "$lcr_par" "$lcr_lane"
-          return 0
-        fi ;;
-  esac
-  return 8
-}
-
-# ONE FIELD OUT OF ONE OF THESE FILES. They are flat `key: value` lines and
-# nothing else — no nesting, no lists — so one `awk` reads every one of them
-# and a malformed file answers empty rather than half a value.
-lane_restart_sidecar_field() {   # <file> <key>
-  [ -r "${1-}" ] || return 1
-  awk -v k="${2-}" '
-    BEGIN { k = k ": " }
-    substr($0, 1, length(k)) == k {
-      v = substr($0, length(k) + 1)
-      print v; exit }' "$1"
-}
-
-# Diagnostic prose is bounded and flattened; launch identity is never normalized.
-lane_restart_sidecar_value() {   # <diagnostic value>
-  printf '%s' "${1-}" | LC_ALL=C tr '[:cntrl:]' ' '
-}
-
-lane_restart_value_ok() {   # exact values must survive flat and tabular readers
-  # POSIX class matching also works in Bash 3.2; its ANSI-C range did not.
-  local LC_ALL=C
-  case "${1-}" in *[[:cntrl:]]*) return 1 ;; esac
-  return 0
-}
-
-# THE ATOMIC REPLACE. Written beside the target and renamed over it, so a
-# reader never sees half a snapshot and a full disk leaves the old one intact.
-lane_restart_sidecar_put() {   # <file> ; the whole body on stdin
-  lsp_f="${1-}"; lsp_d="${lsp_f%/*}"
-  [ -n "$lsp_f" ] || return 1
-  mkdir -p -- "$lsp_d" 2>/dev/null || return 1
-  [ ! -d "$lsp_f" ] || return 1
-  lsp_t="$(umask 077; mktemp "$lsp_d/.restart-intent.XXXXXX" 2>/dev/null)" || return 1
-  [ -n "$lsp_t" ] || return 1
-  cat > "$lsp_t" 2>/dev/null || { rm -f -- "$lsp_t" 2>/dev/null; return 1; }
-  lsp_bad="$(lane_restart_missing "$lsp_t" "$2")" || { rm -f -- "$lsp_t"; return 1; }
-  [ -z "$lsp_bad" ] || { rm -f -- "$lsp_t"; return 1; }
-  mv -- "$lsp_t" "$lsp_f" 2>/dev/null || { rm -f -- "$lsp_t" 2>/dev/null; return 1; }
-  return 0
-}
-
-# AN OPERATION ID: unique to one transition, and shaped like the manifest key
-# every other sub-field of this estate is — letters, digits, `.`, `_`, `-` — so
-# that it can be carried in a payload, a filename and a commit subject without
-# a quoting rule of its own. There is no `uuidgen` on every workstation this
-# runs on, and a timestamp with the pid and two `$RANDOM`s behind it is unique
-# among the handfuls of transitions one lane takes in a day.
-lane_restart_op_id() {
-  printf 'op-%s-%s-%s%s\n' "$(date -u +%Y%m%dT%H%M%SZ)" "$$" "$RANDOM" "$RANDOM"
-}
-
-# THE FOUR STATES OF A RESTART, AND NOTHING ELSE IS ONE.
-#   pending   the intent is written and the old process may still be alive; the
-#             pane has not been replaced, or has been and the supervisor has
-#             not claimed it yet.
-#   starting  a supervisor has claimed this exact operation and launched.
-#   failed    the launch did not reach readiness; the supervisor is still in
-#             the pane with the diagnostic and the retry.
-#   ready     readiness was positively confirmed. A `ready` intent is HISTORY
-#             and authorises no launch, which is what makes an ordinary
-#             `lane <name>` after a successful `/ctx` an ordinary resume.
-lane_restart_word_ok() {   # <word>
-  case "${1-}" in preparing|pending|starting|failed|ready) return 0 ;; esac
-  return 1
-}
-
-# THE HANDOFF'S DIGEST. `shasum -a 256` is on macOS, `sha256sum` on Linux, and
-# a workstation with neither answers `none` — which is an ANSWER and not a gap:
-# the digest then cannot be COMPARED, and every reader below treats a `none`
-# digest as *not checked here* rather than as *unchanged*. Never `cksum`: a
-# 32-bit checksum is not a change detector for a file a person edits.
-lane_handoff_digest() {   # <file>
-  [ -r "${1-}" ] || { printf 'none\n'; return 0; }
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum -- "$1" 2>/dev/null | awk '{print $1; exit}'
-  elif command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 -- "$1" 2>/dev/null | awk '{print $1; exit}'
-  else
-    printf 'none\n'
-  fi
-}
-
-# THE INTENT, READ. `<key><TAB><value>` lines, which is what every caller here
-# parses with one `awk`. 0 with the fields, 8 where the lane has no intent at
-# all (the ordinary lane, and not a failure), 1 where the control root could
-# not be derived.
-# All schema-1 keys are mandatory; prepared_digest is an optional extension.
-# One read validates presence and duplicate keys without per-field subprocesses.
-lane_restart_missing() {   # <file> <canonical lane>
-  awk -v lane="$2" '
-    BEGIN {
-      n=split("schema lane state generation operation mode agent profile dir pane window handoff digest old_transcript new_transcript attempt workstation created updated reason", keys, " ")
-      for (i=1;i<=n;i++) allowed[keys[i]]=1
-      allowed["prepared_digest"]=1
-    }
-    {
-      if ($0 ~ /[[:cntrl:]]/ || $0 !~ /^[A-Za-z_]+: /) {bad["record"]=1; next}
-      k=$0; sub(/:.*/, "", k)
-      if (!(k in allowed)) {bad["unknown-key"]=1; next}
-      v=substr($0,length(k)+3)
-      seen[k]++; values[k]=v; if (v!="") good[k]=1
-    }
-    END {
-      for (i=1;i<=n;i++) if (seen[keys[i]]!=1 || !good[keys[i]]) bad[keys[i]]=1
-      if (values["lane"]!=lane) bad["lane"]=1
-      if (values["generation"] !~ /^[0-9]+$/) bad["generation"]=1
-      if (values["attempt"] !~ /^[0-9]+$/) bad["attempt"]=1
-      n=split("operation mode agent profile old_transcript new_transcript", keys, " ")
-      for (i=1;i<=n;i++) if (values[keys[i]] !~ /^[A-Za-z0-9._-]+$/) bad[keys[i]]=1
-      n=split("dir handoff", keys, " ")
-      for (i=1;i<=n;i++) if (values[keys[i]]!="none" && values[keys[i]] !~ /^\//) bad[keys[i]]=1
-      n=split("digest prepared_digest", keys, " ")
-      for (i=1;i<=n;i++) if ((seen[keys[i]] && seen[keys[i]]!=1) ||
-          (seen[keys[i]] && values[keys[i]]!="none" && (length(values[keys[i]])!=64 || values[keys[i]] !~ /^[0-9a-fA-F]+$/))) bad[keys[i]]=1
-      for (k in bad) {printf "%s%s", sep, k; sep=" "}
-    }
-  ' "$1"
-}
-
-lane_restart_root_ok() {   # missing directories are allowed; unusable existing ancestors are not
-  lrro_path="$1"
-  while [ -n "$lrro_path" ]; do
-    if [ -e "$lrro_path" ] || [ -L "$lrro_path" ]; then
-      [ -d "$lrro_path" ] && [ -r "$lrro_path" ] && [ -x "$lrro_path" ] || return 1
-    fi
-    lrro_parent="$(dirname -- "$lrro_path")" || return 1
-    [ "$lrro_parent" != "$lrro_path" ] || break
-    lrro_path="$lrro_parent"
-  done
-  return 0
-}
-
-lane_restart_read() {   # <lane> [<resolved checkout hint>]
-  lrr_lane="${1-}"; lrr_root=""; lrr_rc=0
-  lrr_root="$(lane_restart_control_root "$lrr_lane" "" "${2-}")" || lrr_rc=$?
-  [ "$lrr_rc" = 0 ] || return 1
-  lane_restart_root_ok "$lrr_root" || return 1
-  lrr_f="$lrr_root/restart-intent.yaml"
-  [ -e "$lrr_f" ] || [ -L "$lrr_f" ] || return 8
-  [ -f "$lrr_f" ] && [ -r "$lrr_f" ] || return 1
-  lrr_schema="$(lane_restart_sidecar_field "$lrr_f" schema)" || return 1
-  # AN UNKNOWN SCHEMA FAILS CLOSED, exactly as `lane-state` does for the same
-  # reason: a newer tooling's intent read by an older reader must not be
-  # reported as a launch this reader knows how to make.
-  case "$lrr_schema" in
-    "$LANE_RESTART_SCHEMA") : ;;
-    *) printf 'state\tUNKNOWN-SCHEMA\n'; printf 'schema\t%s\n' "${lrr_schema:-<none>}"
-       printf 'file\t%s\n' "$lrr_f"; return 0 ;;
-  esac
-  # AN ACTIVE INTENT MISSING A FACT A LAUNCH IS FENCED ON IS NOT A READABLE ONE
-  # (Copilot round 2 on openRepoTools#121). The schema check above is the whole
-  # of what this read used to verify, so a `pending` record carrying an
-  # operation and a mode and nothing else came back with empty values — and
-  # empty is exactly what every comparison downstream treats as *cannot
-  # compare*: `pane_agrees` returns agreement on an empty side, the digest check
-  # skips, and the launch goes ahead with none of the three checks those fields
-  # exist for. That is a silent launch from a record nobody wrote.
-  #
-  # PRESENT AND NOT EMPTY, WHICH IS NOT THE SAME AS *NOT `none`*. `none` IS an
-  # answer here — a workstation with neither `sha256sum` nor `shasum` records
-  # `digest: none`, and the writer writes `none` for every empty field on every
-  # transition — so what is checked is that the KEY IS THERE AT ALL, which is
-  # true of everything this tooling has ever written and false of a record that
-  # was truncated or edited by hand.
-  #
-  # `failed` ALSO NEEDS THE LAUNCH FACTS: it authorizes a supervised retry.
-  # Incomplete records remain readable diagnostics, never launch authority.
-  lrr_state="$(lane_restart_sidecar_field "$lrr_f" state)" || return 1
-  if ! lane_restart_word_ok "$lrr_state"; then
-    printf 'state\tUNKNOWN-STATE\nfile\t%s\n' "$lrr_f"
-    return 0
-  fi
-  lrr_missing="$(lane_restart_missing "$lrr_f" "$lrr_lane")" || return 1
-  if [ -n "$lrr_missing" ]; then
-    printf 'state\tINCOMPLETE\nintended_state\t%s\nmissing\t%s\nfile\t%s\n' "$lrr_state" "$lrr_missing" "$lrr_f"
-    return 0
-  fi
-  for lrr_num in generation attempt; do
-    lrr_value="$(lane_restart_sidecar_field "$lrr_f" "$lrr_num")" || return 1
-    case "$lrr_value" in ''|*[!0-9]*)
-      printf 'state\tINCOMPLETE\nmissing\t%s\nfile\t%s\n' "$lrr_num" "$lrr_f"
-      return 0 ;;
-    esac
-  done
-  for lrr_k in state generation operation mode lane agent profile dir pane window \
-               handoff digest prepared_digest old_transcript new_transcript attempt workstation \
-               created updated reason; do
-    printf '%s\t%s\n' "$lrr_k" "$(lane_restart_sidecar_field "$lrr_f" "$lrr_k")"
-  done
-  printf 'file\t%s\n' "$lrr_f"
-  return 0
-}
-
-# One field of it, for the callers that want exactly one.
-lane_restart_of() {   # <lane> <key>
-  lro_out=""; lro_rc=0
-  lro_out="$(lane_restart_read "${1-}")" || lro_rc=$?
-  [ "$lro_rc" = 0 ] || return "$lro_rc"
-  printf '%s\n' "$lro_out" | awk -F'\t' -v k="${2-}" '$1 == k { print $2; exit }'
-}
-
-# THE INTENT, WRITTEN — the ONE writer, and every caller reaches it through
-# `set-restart-intent`. An empty field is written as `none`, which is an ANSWER
-# and not a gap, on the same argument Amendment 17(b) gives its `transcript`
-# sub-field.
-#
-# THERE IS NO CREDENTIAL FIELD AND THERE IS NO PLACE FOR ONE. The fields are a
-# lane, a generation, an operation, two transcript ids, an agent, a PROFILE
-# NAME (a manifest key, never a token), a directory, a pane, a handoff path,
-# its digest, an attempt count and a bounded reason. A caller that had a secret
-# in hand would have nowhere here to put it.
-lane_restart_put() {   # <root> <lane> <state> <gen> <op> <mode> <agent> <profile> <dir> <pane> <window> <handoff> <digest> <old> <new> <attempt> <reason> <created>
-  lrw_root="$1"; lrw_lane="$2"; lrw_state="$3"; lrw_gen="$4"; lrw_op="$5"
-  lrw_mode="$6"; lrw_agent="$7"; lrw_prof="$8"; lrw_dir="$9"; shift 9
-  lrw_pane="$1"; lrw_win="$2"; lrw_hf="$3"; lrw_dig="$4"; lrw_old="$5"
-  lrw_new="$6"; lrw_att="$7"; lrw_reason="$8"; lrw_created="$9"; lrw_prepared="${10-}"
-  for lrw_value in "$lrw_lane" "$lrw_state" "$lrw_gen" "$lrw_op" "$lrw_mode" \
-      "$lrw_agent" "$lrw_prof" "$lrw_dir" "$lrw_pane" "$lrw_win" "$lrw_hf" \
-      "$lrw_dig" "$lrw_old" "$lrw_new" "$lrw_att" "$lrw_created" "$lrw_prepared" "${WS:-none}"; do
-    lane_restart_value_ok "$lrw_value" || return 1
-  done
-  # BOUNDED DIAGNOSTICS (design decision 3). A launcher that died printing a
-  # megabyte of stderr must not turn the lane's own control file into that
-  # megabyte, and the field is one LINE by construction.
-  lrw_reason="$(lane_restart_sidecar_value "$lrw_reason")"
-  if [ "${#lrw_reason}" -gt 400 ]; then
-    lrw_reason="$(printf '%s' "$lrw_reason" | cut -c1-400)… (truncated)"
-  fi
-  { printf 'schema: %s\n'         "$LANE_RESTART_SCHEMA"
-    printf 'lane: %s\n'           "$lrw_lane"
-    printf 'state: %s\n'          "$lrw_state"
-    printf 'generation: %s\n'     "${lrw_gen:-0}"
-    printf 'operation: %s\n'      "${lrw_op:-none}"
-    printf 'mode: %s\n'           "${lrw_mode:-fresh-from-handoff}"
-    printf 'agent: %s\n'          "${lrw_agent:-none}"
-    printf 'profile: %s\n'        "${lrw_prof:-none}"
-    printf 'dir: %s\n'            "${lrw_dir:-none}"
-    printf 'pane: %s\n'           "${lrw_pane:-none}"
-    printf 'window: %s\n'         "${lrw_win:-none}"
-    printf 'handoff: %s\n'        "${lrw_hf:-none}"
-    printf 'digest: %s\n'         "${lrw_dig:-none}"
-    printf 'prepared_digest: %s\n' "${lrw_prepared:-none}"
-    printf 'old_transcript: %s\n' "${lrw_old:-none}"
-    printf 'new_transcript: %s\n' "${lrw_new:-none}"
-    printf 'attempt: %s\n'        "${lrw_att:-0}"
-    printf 'workstation: %s\n'    "${WS:-none}"
-    printf 'created: %s\n'        "${lrw_created:-$(utc_now)}"
-    printf 'updated: %s\n'        "$(utc_now)"
-    printf 'reason: %s\n'         "${lrw_reason:-none}"
-  } | lane_restart_sidecar_put "$lrw_root/restart-intent.yaml" "$lrw_lane"
-}
-
-# ------------------- AMENDMENT 19(c): THE SWEEP, ONE COMMIT OR NONE ---------
-#
-# `lane-end --retire-dormant <repo>` is the word a person types, the dry run
-# they read and the `--yes` they answer with; THIS is the write underneath it.
-# It is a verb of its own because the sweep touches many rows and many logs and
-# is ONE commit — the shape `migrate-state-cells` has one screen up, for the
-# same reason: a half-published sweep is a register whose rows and whose logs
-# disagree about which lanes are finished.
-#
-# WHAT IT WRITES PER LANE, and clause (c) spells it out character by character:
-#   `lanes/log/<lane>.md` gains ONE line —
-#     RETIRED — lane <lane>, session <uuid>@<ws>, <UTC>, lane:<lane>
-#       → retired-dormant by lane <writer>; reason <why>; was: <the cell's head>
-#   and the row's state cell becomes  `RETIRED · <UTC> · <why>; was: <head>`.
-#
-# THE PAYLOAD ON A `RETIRED` IS THIS AMENDMENT'S OWN. Amendment 7(b) gives
-# `RETIRED` no payload and Amendment 11 clause (c) keeps it that way — which is
-# why `lane-end`'s fork retire is a DOOR that writes nothing at all. Amendment
-# 19 is later, ratified as drafted, and spells this line out in full: the row's
-# own last words are carried into the log so that nothing the row said is lost
-# when the row stops saying it. That is the whole of the exception, and it is
-# this line and no other.
-#
-# THE CELL IS AMENDMENT 13(a)'s PHRASE, NOT CLAUSE (c)'s LITERAL TEXT. Clause
-# (c) writes the cell as `RETIRED <UTC> · <why> · was: <head>` — four parts
-# where 13(a)'s cell has three, and a first word of `RETIRED <UTC>`, which is a
-# state no reader of Rule 6 or of the listing knows. The phrase that carries the
-# same four facts under the grammar every other writer obeys is
-# `RETIRED · <UTC> · <why>; was: <head>`, and it goes through `row_state_check`
-# — the gate `set-row-state` uses — so the 240-character cap, the `|` and the
-# second ` · ` are refused here exactly as they are there. The `|` a legacy cell
-# may carry is replaced by `/` in the ROW (it would forge a cell boundary) and
-# kept VERBATIM in the log line, which is not a table.
-#
-# THE THREE REFUSALS ARE CLAUSE (c)'s: a lane a live session holds on this
-# workstation, a row whose log already carries a lane-kind line other than
-# `ENDED`/`RETIRED` (a parked lane is not dormant), and — in `lane-end`, which
-# is the word that finds them — a repository with no dormant row at all.
-# ANY ONE OF THEM REFUSES THE WHOLE RUN, before a byte is written: this is one
-# commit, so it is one decision.
-retire_rows() {   # <lane>… [--reason "<why>"] [--writer <lane>]
-  rr_reason=""; rr_writer="${LANES_LANE:-}"; rr_lanes=""
-  while [ $# -gt 0 ]; do
-    case "$1" in
-      # A FLAG IS NOT A VALUE (Copilot round 1 on #93). `--reason --writer x`
-      # took `--writer` as the reason and swept with it, and the writer the
-      # caller named was never read — a malformed line that RAN. A value
-      # beginning with `-` is refused and the `=` spelling named for the reason
-      # that legitimately starts with one.
-      --reason)   case "${2-}" in '' | -*) die "--reason needs the words that say why, and '${2-}' is a flag — so the reason was left out. Spell a reason that really begins with a dash as --reason=<why>." 2 ;; esac
-                  rr_reason="$2"; shift 2 ;;
-      --reason=*) rr_reason="${1#--reason=}"; [ -n "$rr_reason" ] || die "--reason needs the words that say why" 2; shift ;;
-      --writer)   case "${2-}" in '' | -*) die "--writer needs the lane doing the sweeping, and '${2-}' is a flag — so the lane was left out." 2 ;; esac
-                  rr_writer="$2"; shift 2 ;;
-      --writer=*) rr_writer="${1#--writer=}"; [ -n "$rr_writer" ] || die "--writer needs the lane doing the sweeping" 2; shift ;;
-      --)         shift ;;
-      -*)         die "unknown option '$1' for retire-rows (usage: retire-rows <lane>… [--reason \"<why>\"] [--writer <lane>])" 2 ;;
-      *)          check_lane_name "$1"; rr_lanes="$rr_lanes $1"; shift ;;
-    esac
-  done
-  [ -n "$rr_lanes" ] ||
-    die "usage: retire-rows <lane>… [--reason \"<why>\"] [--writer <lane>]
-  The lanes are DORMANT rows — a row with no object log and no live session
-  (Amendment 19(a)). The word that FINDS them, shows the dry run and asks for
-  the person's --yes is:  lane-end --retire-dormant <repo>" 2
-  [ -n "$rr_reason" ] || rr_reason="dormant row swept under Amendment 19(c)"
-  [ -n "$rr_writer" ] ||
-    die "retire-rows needs the lane doing the sweeping: LANES_LANE=<lane> lanes-edit.sh retire-rows … (or --writer <lane>). Every line it writes carries that lane's own transcript uuid in its session field, and a session field that is anything else is wrong for ever in an append-only log (Amendment 7(b))." 2
-  check_lane_name "$rr_writer"
-  # THE REASON IS CHECKED ONCE, HERE, AND NEVER PER ROW. It goes into every cell
-  # this sweep rewrites, so a `|` or a second ` · ` in it is a refusal of the
-  # ARGUMENT, named as one — rather than `row_state_check` dying half-way down
-  # the scan with a message about a cell the caller never wrote. The cap is
-  # lower than the cell's own, because the row's last words go in beside it.
-  case "$rr_reason" in
-    *'|'*)   die "--reason may not contain '|': it would forge a cell boundary in every row this sweep rewrites. Got: '$rr_reason'" 2 ;;
-    *' · '*) die "--reason may not contain ' · ': that separator is what divides the state cell's three parts (Amendment 13(a)), and a second one reads back as a fourth part. Use a semicolon. Got: '$rr_reason'" 2 ;;
-  esac
-  if [ "${rr_reason//[$'\n\r']/}" != "$rr_reason" ]; then
-    die "--reason is ONE line: a newline in it would split a row in two and every row after it would be read as a lane" 2
-  fi
-  if [ "${rr_reason//$US/}" != "$rr_reason" ]; then
-    die "--reason may not contain the internal field separator: it would corrupt the sweep plan before any row is written" 2
-  fi
-  [ "${#rr_reason}" -le 180 ] ||
-    die "--reason is ${#rr_reason} characters. The cell's whole line is capped at $ROW_STATE_CAP (Amendment 13, ratified decision O1) and the row's OWN last words go in beside it, so a reason longer than 180 leaves nothing of them. Shorten it — the long version belongs in the lane's log." 2
-
-  # R30 — THE FETCH FIRST, AND A CHECKOUT THAT IS BEHIND IS REFUSED, for the
-  # reason the migration gives: this act rewrites several rows and appends to
-  # several logs in ONE commit, and made against a register that is not the
-  # published one each of those is a conflict for `commit_push`'s rebase.
-  log_sync
-  if [ "$NO_GIT" != 1 ] && [ "$LOG_SYNC_FETCH" != yes ]; then
-    die "retire-rows requires a successful fresh fetch before rewriting several rows; $LOG_SYNC_FETCH. The local origin/$LANES_BRANCH ref may be stale. Nothing was written." 1
-  fi
-  rr_writer="$(canon_lane "$rr_writer")" || exit 2
-  # THE WRITER'S TRANSCRIPT IS THIS CHECKOUT'S ROW'S LAST ID, and the published
-  # row's only where this checkout has none (Copilot round 18 on #93, #138 item
-  # 8). `session_for` reads `$LANES_SESSION` or the PUBLISHED row, and the
-  # documented call sets only `LANES_LANE`: a writer whose newest transcript is
-  # stamped here and not yet pushed signed every append-only RETIRED line with an
-  # older id. A checkout behind origin is refused below, so this row is never
-  # the older of the two — the same reason refusal 1 reads both rows' ids.
-  rr_uuid="${LANES_SESSION:-}"
-  [ -n "$rr_uuid" ] || rr_uuid="$(session_ids_local_of_lane "$rr_writer" 2>/dev/null | tail -n1)"
-  [ -n "$rr_uuid" ] || rr_uuid="$(session_for "$rr_writer" 2>/dev/null || :)"
-  valid_uuid "$rr_uuid" ||
-    die "the sweeping lane $rr_writer has no transcript uuid to write: \$LANES_SESSION is unset and its row's session cell holds none. Amendment 7(b) gives the session field a transcript uuid and ONLY that, and this log is append-only, so nothing is written. Run it from the lane's own session, or pass the id: LANES_SESSION=<uuid> LANES_LANE=$rr_writer lanes-edit.sh retire-rows …" 2
-  # All path cleanliness and ref fences run under the same writer lock as the
-  # scan. A peer can otherwise alter a target log while this act waits.
-  acquire_lock
-  if [ "$NO_GIT" != 1 ] && have_remote_ref; then
-    rr_behind="$(git -C "$LANES_REPO" rev-list --count "HEAD..origin/$LANES_BRANCH" 2>/dev/null || printf '')"
-    case "$rr_behind" in
-      '' | 0) : ;;
-      *) die "this checkout is $rr_behind commit(s) behind origin/$LANES_BRANCH. The sweep is ONE commit over several rows and several logs, so it is made against the published register or not at all. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2 ;;
-    esac
-  fi
-  refuse_dirty_checkout "retire-rows" "$LANES_PATH"
-
-  # THE MUTEX COMES BEFORE THE SCAN, not between the scan and the write: this
-  # act reads every row's LINE NUMBER and rewrites those lines by number, and a
-  # peer's `add-row` landing in between moves them under it (the finding
-  # `migrate-state-cells` took in round 2 of openRepoTools#82). It is held from
-  # `acquire_lock` above; a peer's register edit is captured at the write, after
-  # every refusal of the scan (#157 item 4b, `migrate_state_cells`' reason).
-
-  # THE LIVE READ IS FAIL-CLOSED, AND IT IS TAKEN INSIDE THE LOCK (Copilot round
-  # 2 on #93). `lanes_rows` degrades to the log's verb when this workstation's
-  # session records cannot be read, because a LISTING may not refuse; a WRITE
-  # that retired a row out from under the session still writing it is the other
-  # kind of mistake entirely — and a snapshot taken BEFORE the mutex is a
-  # snapshot a lane can go live behind: `lane-start` appends its id to the row
-  # under this same lock, so the scan would read that new id and compare it with
-  # a fence that predates it.
-  rr_live=""; rr_live_rc=0
-  rr_live="$(live_session_ids 2>/dev/null)" || rr_live_rc=$?
-  [ "$rr_live_rc" = 0 ] ||
-    die "this workstation's session records could not be read, so whether any of these lanes is LIVE HERE is not known — and clause (c) refuses a lane a live session holds. A read that failed is not 'nothing is live' (Amendment 7(d)). Nothing was written." 1
-  rr_fence=" $(printf '%s\n' "$rr_live" | awk -F"$US" 'NF { print tolower($1) }' | tr '\n' ' ')"
-
-  rr_utc="$(utc_now)"
-  rr_tmp="$(mktemp -d)"
-  : > "$rr_tmp/plan"; : > "$rr_tmp/report"
-  rr_n=0; rr_names=""
-  rr_follow=""
-  rr_seen=""
-  for rr_lane in $rr_lanes; do
-    rr_l="$(canon_lane "$rr_lane")" || exit 2          # Amendment 15
-    # THE SEAM (ruling 2026-10-04). The sweep is ONE commit, so one managed or
-    # unknown lane in it refuses all of it, here in the scan, before any line or
-    # cell is written; `die` releases the lock this sweep holds.
-    managed_seam_refuse "$rr_l" "retire-rows (Amendment 19's sweep)"
-    # A LANE NAMED TWICE IS A REFUSAL AND NOT A SECOND LINE. The log is
-    # append-only: a duplicate in the argument list would put the same `RETIRED`
-    # line into it twice, in one commit, and no later line could take it back.
-    # Compared on the RESOLVED name, so the two spellings of one lane are one
-    # lane here as they are everywhere else (Amendment 15).
-    case " $rr_seen " in
-      *" $rr_l "*) die "lane $rr_l is named twice in this sweep. Its log is append-only, so a second pass over it would write the same RETIRED line again and nothing could take it back. Name each lane once. Nothing was written." 2 ;;
-    esac
-    rr_seen="$rr_seen $rr_l"
-    rr_ln="$(row_line "$rr_l")" || exit 2              # one row, exactly
-    rr_row="$(sed -n -e "${rr_ln}p" "$LANES_FILE")"
-    if [ "${rr_row//$US/}" != "$rr_row" ]; then
-      die "lane $rr_l's row contains the internal sweep-plan field separator, so it cannot be serialized safely. Nothing was written." 2
-    fi
-    rr_rc=0; row_split_state_cell "$rr_row" || rr_rc=$?
-    case "$rr_rc" in
-      0) : ;;
-      2) die "lane $rr_l's row (line $rr_ln) carries $(row_sep_count "$rr_row") ' | ' separators where a seven-column row carries 6, so WHICH TEXT IS THE STATE CELL is not knowable from the row — and this act both READS that cell (the words it carries into the log) and REWRITES it. Escape the literal pipe inside that cell as \| by hand, commit it, and re-run. Nothing was written." 2 ;;
-      *) die "lane $rr_l's row (line $rr_ln) does not open with '|' and end with '|', so it is not a row this writer can take apart. Nothing was written." 2 ;;
-    esac
-    mig_trim "$RSS_CELL"; rr_cell="$MIG_TRIM"
-    rr_head="$rr_cell"
-    if [ "${#rr_head}" -gt 240 ]; then
-      # THE CAP IS CLAUSE (c)'s 240, CUT BACK TO A SPACE — `cut_to_line`'s rule
-      # and the migration's: `${s:0:n}` counts bytes wherever the locale is not
-      # a UTF-8 one, and these cells are full of `·`, `—` and `→`.
-      rr_head="${rr_head:0:236}"   # 236 + " ..." is the 240 clause (c) gives
-      case "$rr_head" in *' '*) rr_head="${rr_head% *}" ;; esac
-      rr_head="$rr_head ..."
-    fi
-
-    # (c) REFUSAL 1 — a live session here.
-    # BOTH ROWS' IDS, for the reason `lanes_rows` gives one screen up: an id
-    # this checkout has committed and not yet pushed is on no published cell,
-    # and this is the FAIL-CLOSED half of the same question (Copilot round 1 on
-    # #93).
-    rr_ids="$(session_ids_of_lane "$rr_l" 2>/dev/null || :)
-$(session_ids_local_of_lane "$rr_l" 2>/dev/null || :)"
-    for rr_id in $rr_ids; do
-      case "$rr_fence" in
-        *" $rr_id "*) die "lane $rr_l has a LIVE session on this workstation (transcript $rr_id), so it is not a dormant row: clause (c) refuses a lane a live session holds, and retiring it would take the row out from under the conversation that IS the lane. End it the ordinary way when it is done — lane-end $rr_l. Nothing was written." 2 ;;
-      esac
-    done
-
-    # (c) REFUSAL 2 — a log that says the lane is somewhere.
-    #
-    # THE PUBLISHED LOG IS PROVED READABLE FIRST (Copilot round 3 on #93).
-    # `lane_log_events` ends in `git show … | parse_log_stream` and this file
-    # sets no `pipefail`, so a `git show` that FAILED is masked by the parser
-    # exiting 0 over empty input — and the lane then reads as having no
-    # lane-kind line at all, which is the one answer that lets the sweep
-    # through. The object is asked for by name instead, and then `show` with its
-    # own status.
-    # WHETHER THE PATH IS PUBLISHED IS THE TREE'S ANSWER, NOT THE BLOB'S
-    # (Copilot round 21 on #93, #138 item 17). It was `cat-file -e`, which
-    # fails for a blob that is missing or corrupt exactly as for a path that is
-    # not there, so a log the tree names and git cannot read was "no published
-    # log" and the sweep went on. `ls-tree` reads the tree alone.
-    rr_pubp=""
-    rr_pubp="$(log_path_ci "$rr_l")" ||
-      die "lane $rr_l's object log is published twice under names that differ only by case (above) — 15(d)'s hand merge. Nothing was written." 2
-    if [ "$NO_GIT" != 1 ] && have_remote_ref; then
-      rr_intree=""
-      rr_intree="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$rr_pubp" 2>/dev/null)" ||
-        die "the tree of origin/$LANES_BRANCH could not be listed, so whether lane $rr_l has a published object log is not known — and that is NOT 'it has none' (Amendment 7(d)). Nothing was written." 1
-      if [ -n "$rr_intree" ]; then
-        git -C "$LANES_REPO" show "origin/$LANES_BRANCH:$rr_pubp" >/dev/null 2>&1 ||
-          die "lane $rr_l's published object log ($rr_pubp) exists on origin/$LANES_BRANCH and could not be read, so whether it carries a lane-kind line is not known — and that is NOT 'it has none' (Amendment 7(d)). Nothing was written." 1
-      fi
-    fi
-    rr_ev=""; rr_erc=0
-    rr_ev="$(lane_log_events "$rr_l" 2>/dev/null)" || rr_erc=$?
-    [ "$rr_erc" = 0 ] ||
-      die "lane $rr_l's object log could not be read (exit $rr_erc), so whether it carries a lane-kind line is not known — and that is NOT 'this lane has no log' (Amendment 7(d)). Nothing was written." 1
-    # AND THIS CHECKOUT'S OWN COPY OF THAT LOG (Copilot round 2 on #93), for the
-    # reason the session ids are read from both rows: `lane_log_events` answers
-    # out of `origin/<branch>` (R19), and a log line committed here and not yet
-    # pushed is on no origin at all. The `behind` guard above refuses a checkout
-    # that is behind; one that is AHEAD is legitimate, and there a `STARTED`
-    # that exists only here would be invisible — the lane reading as dormant
-    # while its own log says it is running.
-    # AND THE LOCAL ONE IS READ WITH THE SAME POSTURE (round 3): converted to an
-    # empty stream with `|| :`, a TRACKED log that exists here and will not open
-    # read as a lane with no lane-kind line — and the untracked-file guard below
-    # does not catch a tracked one.
-    rr_lev=""
-    rr_lf="$(log_file_for "$rr_l")"
-    # A LOG PATH THAT IS A SYMLINK, OR THERE AND NOT A REGULAR FILE, IS REFUSED
-    # BEFORE IT IS READ (Copilot round 18 on #93, #138 item 12). The write
-    # appends with `>>`, which follows a link: a tracked link here put the
-    # RETIRED line in whatever file it named, outside the repository, while the
-    # commit recorded only the link.
-    if [ -L "$rr_lf" ] || { [ -e "$rr_lf" ] && [ ! -f "$rr_lf" ]; }; then
-      die "lane $rr_l's object log $(log_path_for "$rr_l") is a symlink, or is there and not a regular file, in this checkout. This sweep appends to it with '>>', which writes through a link to whatever file it names while the commit records only the link. Put the log itself there as a regular file, commit that, and re-run. Nothing was written." 2
-    fi
-    if [ -f "$rr_lf" ]; then
-      [ -r "$rr_lf" ] ||
-        die "lane $rr_l's object log $rr_lf exists in this checkout and could not be read, so whether it carries a lane-kind line is not known — and that is NOT 'it has none' (Amendment 7(d)). Nothing was written." 1
-      rr_lev="$(log_events "$rr_lf" 2>/dev/null)" ||
-        die "lane $rr_l's object log $rr_lf could not be parsed, so whether it carries a lane-kind line is not known (Amendment 7(d)). Nothing was written." 1
-    fi
-    rr_open="$(printf '%s\n%s\n' "$rr_ev" "$rr_lev" | awk -F"$US" '$3 == "STARTED" || $3 == "PAUSED" || $3 == "RESUMED" || $3 == "ENDED" || $3 == "RETIRED" { v = $3 } END { if (v != "") print v }')"
-    rr_pub_open="$(printf '%s\n' "$rr_ev" | awk -F"$US" '$3 == "STARTED" || $3 == "PAUSED" || $3 == "RESUMED" || $3 == "ENDED" || $3 == "RETIRED" { v = $3 } END { if (v != "") print v }')"
-    # THE RULE IS CLAUSE (c)'s AND STAYS: a log that CARRIES a lane-kind line is
-    # refused. THE SENTENCE FOLLOWS THE LAST ONE (#120 item 3, Copilot round 5 on
-    # #93). A log whose last lane-kind line is ENDED or RETIRED is a lane already
-    # CLOSED (19(a)), and `lane-end` is not its exit: it is told it is closed,
-    # already hidden, and — for RETIRED alone, the only cell `archive-rows`
-    # moves — which act takes the row out of the register.
-    #
-    # AND "CLOSED" IS SAID ONLY OF A CLOSING LINE ORIGIN CARRIES (the review of
-    # #263, S2). An earlier sweep that stopped part-way leaves its RETIRED line
-    # in this checkout's log and nowhere else; a re-run told the lane it was
-    # CLOSED, "nothing more is owed", about a row never retired and a line never
-    # published. That line is still refused, and is named as this checkout's.
-    case "$rr_open" in
-      '') : ;;
-      ENDED | RETIRED)
-        rr_art=a; [ "$rr_open" != ENDED ] || rr_art=an
-        [ "$rr_pub_open" = "$rr_open" ] ||
-          die "lane $rr_l's object log in THIS CHECKOUT ends on $rr_art $rr_open line, and origin/$LANES_BRANCH's copy does not: it is a write made here and never published, by an earlier act that stopped part-way or a commit whose push has not landed (\`git -C $LANES_REPO status\` and \`git -C $LANES_REPO log origin/$LANES_BRANCH..HEAD -- $(log_path_for "$rr_l")\` say which). It is refused either way, since a second closing line would be one more line in an append-only log, and the lane is not called CLOSED, since nothing published says so. Publish that line or undo it, then re-run. Nothing was written." 2
-        case "$rr_open" in
-          RETIRED)
-            die "lane $rr_l's object log ends on a RETIRED line, so the lane is already CLOSED and RETIRED (Amendment 19(a)), not a dormant row: \`lanes\` already hides it (19(b)), and its log is append-only, so it is not retired a second time. Its row leaves the register by \`lanes-edit.sh archive-rows ${rr_l%-*}\` (19(d)), which moves that repository's rows whose state cell says RETIRED. Nothing was written." 2 ;;
-          *)
-            die "lane $rr_l's object log ends on an ENDED line, so the lane is already CLOSED (Amendment 19(a)): it was ended, and a closed lane is not a dormant row. \`lanes\` already hides it (19(b)), and its log is append-only, so a RETIRED line after its ENDED would be one more line for a lane that is already finished. Nothing more is owed: its row stays in the register as the record (Rule 9), and \`archive-rows\` is not its exit, since it moves only rows whose state cell says RETIRED. Nothing was written." 2 ;;
-        esac ;;
-      *)
-        die "lane $rr_l's object log carries a $rr_open line as its last lane-kind line, so it is not a dormant row: a running or parked lane is a lane a person can still pick up. End it as itself when its work is done: lane-end $rr_l. Nothing was written." 2 ;;
-    esac
-
-    # (c) REFUSAL 3 — THE ROW ITSELF SAYING THE LANE IS SOMEWHERE, which is the
-    # same test the listing makes and is re-proved here rather than trusted
-    # (Copilot round 1 on #93). Amendment 13(a) makes the state cell the lane's
-    # CURRENT STATE: a cell that is the phrase and names anything but `ENDED`,
-    # `RETIRED` or the migration's `MIGRATED` is a row `lanes` does not hide
-    # either, and the writer and the read must not disagree about which rows are
-    # dormant — that is the defect clause (h) and A11 Addendum 4 ruling 7 both
-    # exist to prevent.
-    #
-    # A CELL THAT ALREADY SAYS `RETIRED` IS NOT A SECOND RETIREMENT (Copilot
-    # round 20 on #93). Refused here, it was a row the listing classes DORMANT
-    # and the preview names — and one refusal stops the whole sweep. The row a
-    # migration leaves is exactly that: the phrase in the cell, NOTED lines in
-    # the log. A second retirement is a second RETIRED LINE in an append-only
-    # log, and refusal 2 just above refuses that, from the log.
-    if mig_cell_is_phrase "$rr_cell"; then
-      case "${rr_cell%% · *}" in
-        ENDED | RETIRED | MIGRATED) : ;;
-        *) die "lane $rr_l's row says ${rr_cell%% · *}: its state cell is Amendment 13(a)'s phrase — '$rr_cell' — and that cell is the lane's CURRENT STATE, so this is not a dormant row and \`lanes\` does not hide it either. A lane the register says is somewhere is ended as itself (lane-end $rr_l) or its cell is corrected first (set-row-state). Nothing was written." 2 ;;
-      esac
-    fi
-
-    # AMENDMENT 15 — the log this write appends to is the row's own spelling,
-    # and a case-only rename is a write of its own rather than one this sweep
-    # smuggles into a commit that names something else. Both halves of
-    # `ensure_log`'s question are asked HERE, in the scan, so the refusal comes
-    # before any byte is written rather than half-way through the run.
-    # AND A LOG DIRECTORY THAT CANNOT BE LISTED IS A REFUSAL HERE (#138 item 9),
-    # not a lane with no log that `ensure_log` then fails on inside the loop.
-    rr_loc="$(log_files_named_ci "$rr_l")" ||
-      die "the log directory $LANES_LOG_DIR exists and could not be listed, so whether lane $rr_l has a log of any case in this checkout is not known — and that is NOT 'it has none' (Amendment 7(d)). Nothing was written." 1
-    rr_ln2="$(printf '%s' "$rr_loc" | grep -c . || :)"
-    [ "$rr_ln2" -le 1 ] ||
-      die "lane $rr_l has $rr_ln2 object logs in this checkout whose names differ only by case: $(printf '%s\n' "$rr_loc" | tr '\n' ' ')— one lane is ONE lane under any case (Amendment 15) and no read of it is unambiguous. Merge them by hand into $(log_file_for "$rr_l") (15(d)) and re-run. Nothing was written." 2
-    if [ "$rr_ln2" = 1 ] && [ "$rr_loc" != "$(log_file_for "$rr_l")" ]; then
-      die "lane $rr_l's object log is here as ${rr_loc##*/} while the row spells the lane $rr_l, so the first write to it RENAMES the file (Amendment 15) — and this sweep is one commit over several lanes, which is not the commit that rename belongs in. Take it first with a write of that lane's own (\`LANES_LANE=$rr_l lanes-edit.sh log NOTED lane:$rr_l \"<what it was>\"\`), then re-run. Nothing was written." 2
-    fi
-    # AN UNTRACKED LOG IS SOMEBODY'S UNCOMMITTED WORK, AND THIS ACT WOULD
-    # COMMIT IT — the finding `migrate-state-cells` took in round 2 of
-    # openRepoTools#82, and this sweep has the same shape. A TRACKED log that is
-    # dirty is already refused for the whole run by `refuse_dirty_checkout`
-    # above, which exempts the register alone; an untracked file is in neither
-    # of its lists, so appending here would put a peer's first lines into this
-    # sweep's one commit under this sweep's message. (A dormant row usually has
-    # no log at all — but a migrated one has a log of NOTED lines, and that is
-    # the file this meets.)
-    if [ "$rr_ln2" = 1 ] && [ "$NO_GIT" != 1 ] &&
-       ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$(log_path_for "$rr_l")" >/dev/null 2>&1; then
-      die "lane $rr_l's object log $(log_path_for "$rr_l") exists in this checkout but is NOT TRACKED — somebody's uncommitted work, which this sweep would commit inside its own commit and under its own message. Commit it first (\`git -C $LANES_REPO commit -m \"<what it is>\" -- $(log_path_for "$rr_l")\`) and re-run. Nothing was written." 2
-    fi
-    # THE PUBLISHED PATH IS THE ONE THE READABILITY PROBE ALREADY RESOLVED —
-    # `log_path_ci` is a `ls-tree` of the whole log directory and this loop runs
-    # per lane, so asking it twice for one lane is a second read of the same
-    # tree for the same answer.
-    #
-    # AND THE QUESTION IS `ensure_log`'S OWN, NOT A PARAPHRASE OF IT (#120 item
-    # 2, Copilot round 5 on #93). The scan asked it only where this checkout had
-    # NO log, and beside that compared a BASENAME with a repo-relative PATH, a
-    # clause that could never be equal. So the state a case-only rename leaves
-    # when its commit has not been pushed — the row's spelling here, committed;
-    # the old spelling still in origin's tree; a checkout merely AHEAD, which the
-    # `behind` guard rightly lets through — passed the scan, and `ensure_log`
-    # refused it INSIDE THE WRITE LOOP, after the lanes before it in this one
-    # commit had had their logs created and appended. It is asked here as
-    # `ensure_log` asks it, in its words, because it is the same refusal; the
-    # refusal of a local file of another case above means `rr_from`, where
-    # there is one, is the row's own spelling.
-    rr_pub="$rr_pubp"
-    rr_from=""
-    [ "$rr_ln2" = 1 ] && rr_from="$rr_loc"
-    if [ "$rr_pub" != "$(log_path_for "$rr_l")" ] && [ "${rr_from##*/}" != "${rr_pub##*/}" ]; then
-      rr_here="and this checkout does not have it"
-      [ -n "$rr_from" ] && rr_here="while this checkout has ${LANES_LOG_PREFIX}${rr_from##*/} instead — a case-only rename whose commit never landed"
-      die "lane ${rr_l}'s object log is published as $rr_pub $rr_here: the row spells the lane $rr_l, so the log is $(log_path_for "$rr_l") (Amendment 15), and writing one here now would leave TWO files for one lane. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2
-    fi
-
-    # THE LINE AND THE CELL, BOTH BUILT AND BOTH CHECKED BEFORE ANYTHING IS
-    # WRITTEN. `row_state_check` dies on a cap, a `|` or a second ` · `, so it
-    # is asked HERE — in the scan — and never with the register half-rewritten.
-    rr_pay="retired-dormant by lane $rr_writer; reason $rr_reason; was: $rr_head"
-    event_line RETIRED "$rr_l" "$rr_uuid" "$rr_utc" "lane:$rr_l" '→' "$rr_pay" > "$rr_tmp/line.$rr_ln"
-    rr_wasrow="$(printf '%s' "$rr_head" | tr '|' '/')"
-    rr_wasrow="${rr_wasrow// · /; }"
-    rr_line="$rr_reason; was: $rr_wasrow"
-    if [ "${#rr_line}" -gt "$ROW_STATE_CAP" ]; then
-      rr_line="${rr_line:0:$((ROW_STATE_CAP - 4))}"
-      case "$rr_line" in *' '*) rr_line="${rr_line% *}" ;; esac
-      rr_line="$rr_line ..."
-    fi
-    row_state_check "RETIRED · $rr_line"
-    rr_new="RETIRED · $rr_utc · $ROW_STATE_LINE"
-    printf '%s%s%s%s%s%s%s%s%s\n' "$rr_ln" "$US" "$rr_l" "$US" "$rr_new" "$US" "$RSS_HEAD" "$US" "$RSS_TAIL" >> "$rr_tmp/plan"
-    printf '  %-26s %s\n' "$rr_l" "$rr_new" >> "$rr_tmp/report"
-    rr_names="$rr_names $rr_l"
-    # THE LIFECYCLE PRE-IMAGE, TAKEN UNDER THE LOCK THIS SWEEP ALREADY HOLDS
-    # (openRepoTools#91). These `RETIRED` lines are appended by this function
-    # and never by `write_event`, so the follow-up that moves a lane's snapshot
-    # to `CLOSED` for every other `RETIRED` would never run for them, and a
-    # swept lane would keep whatever its snapshot last said. The pre-image is
-    # what the follow-up compares against, exactly as `write_event` takes it.
-    rr_follow="$rr_follow$rr_l$US$(lane_state_preimage "$rr_l" "")${US}8
-"
-    rr_n=$((rr_n + 1))
-  done
-
-  # --------------------------------------------------------------- the write
-  #
-  # THE LOGS FIRST AND THE ROWS SECOND, and all of it published by the single
-  # `commit_push` at the end: a refusal in the middle leaves this checkout dirty
-  # and the register unpublished, which `git status` shows and
-  # `git checkout -- lanes` undoes whole. Nothing is half-published, because the
-  # commit is the only thing that publishes. A peer's register edit is
-  # committed as its own first, as `migrate_state_cells` says at its write.
-  handle_preexisting "$LANES_PATH"
-  rr_paths=("$LANES_PATH")
-  while IFS="$US" read -r rr_ln rr_l rr_new rr_head2 rr_tail; do
-    [ -n "${rr_ln:-}" ] || continue
-    ensure_log "$rr_l"
-    append_text_block "$(log_file_for "$rr_l")" "$(cat -- "$rr_tmp/line.$rr_ln")"
-    rr_paths+=("$(log_path_for "$rr_l")")
-    reg_wrote "$(log_path_for "$rr_l") (its RETIRED line)"
-  done <<EOF
-$(cat -- "$rr_tmp/plan")
-EOF
-  while IFS="$US" read -r rr_ln rr_l rr_new rr_head2 rr_tail; do
-    [ -n "${rr_ln:-}" ] || continue
-    replace_line "$rr_ln" "$rr_head2$rr_new $rr_tail"
-    reg_wrote "$LANES_PATH (the row of $rr_l)"
-  done <<EOF
-$(cat -- "$rr_tmp/plan")
-EOF
-
-  printf 'retire-rows — %s lane(s) RETIRED (lane-collision-protocol Amendment 19(c))\n' "$rr_n"
-  printf '  writer   : lane %s, session %s@%s\n' "$rr_writer" "$rr_uuid" "$WS"
-  printf '  reason   : %s\n' "$rr_reason"
-  printf '\n  lane                       the cell it becomes\n'
-  cat -- "$rr_tmp/report"
-  rm -rf -- "$rr_tmp"
-
-  rr_msg="LANES(retire-dormant@$WS): Amendment 19(c) — $rr_n dormant row(s) RETIRED by lane $rr_writer;$rr_names; reason $rr_reason"
-  commit_push "$rr_msg" "${rr_paths[@]}"
-  rr_crc=$?
-  release_lock
-  # AND EACH SWEPT LANE'S SNAPSHOT FOLLOWS ITS LINE, after the lock, for the
-  # reason `write_event` gives at its own foot: the follow-up takes the mutex
-  # for itself and never fails the act whose lines have already landed.
-  while IFS="$US" read -r rr_fl rr_fpre rr_fseam; do
-    [ -n "${rr_fl:-}" ] || continue
-    lane_state_follow "$rr_fl" RETIRED "" "$rr_uuid" "$rr_fpre" "$rr_fseam"
-  done <<RR_FOLLOW
-$rr_follow
-RR_FOLLOW
-  return "$rr_crc"
-}
-
-# ------------------- AMENDMENT 19(d): THE ARCHIVE, A SECOND ACT ON A SECOND
-#                     WORD
-#
-# `archive-rows <repo>` MOVES every `RETIRED` row of `<repo>` out of
-# `lanes/LANES.md` and into `lanes/archive/LANES-retired.md`, in ONE commit
-# whose message names each lane moved. Rule 9 holds either way — a row is one
-# `git show` away — so this is for a register a person wants SHORTER and is
-# never a requirement, and nothing reads a row differently for having moved:
-# `register_lanes`, `lanes_register_index` and `lane_position_rows` all read
-# the archive beside the register, which is the amendment's own sentence
-# (*"every reader of the next free position and `lanes --closed` read the
-# archive too"*). A retired `<repo>-<n>` is never reissued.
-#
-# WHICH ROWS: the lane name's head — everything before its LAST hyphen — is the
-# repository, compared without regard to case, which is `lane_next_free`'s rule
-# for the same question and not a second one; and the state cell names `RETIRED`
-# by `mig_lead_state`, the one reader of a cell's leading state word, so a
-# legacy cell and Amendment 13's phrase are read by the same code.
-archive_rows() {   # <repo> <1 = the act, 0 = the dry run>
-  ar_repo="$1"; ar_do="${2:-0}"
-  ar_rl="$(lc "$ar_repo")"
-  log_sync
-  if [ "$ar_do" = 1 ]; then
-    if [ "$NO_GIT" != 1 ] && [ "$LOG_SYNC_FETCH" != yes ]; then
-      die "archive-rows requires a successful fresh fetch before moving rows; $LOG_SYNC_FETCH. The local origin/$LANES_BRANCH ref may be stale. Nothing was written." 1
-    fi
-    if [ "$NO_GIT" != 1 ] && have_remote_ref; then
-      ar_behind="$(git -C "$LANES_REPO" rev-list --count "HEAD..origin/$LANES_BRANCH" 2>/dev/null || printf '')"
-      case "$ar_behind" in
-        '' | 0) : ;;
-        *) die "this checkout is $ar_behind commit(s) behind origin/$LANES_BRANCH. The move is ONE commit carrying the register and the archive, so it is made against the published register or not at all. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2 ;;
-      esac
-    fi
-    acquire_lock
-    # The cleanliness fence belongs INSIDE the writer lock. Another writer
-    # could otherwise create or edit the archive while this act waits for it.
-    # THE ARCHIVE IS NOT EXEMPT (Copilot round 4 on #93). It was, because this
-    # act writes it — but `handle_preexisting` captures the REGISTER alone, so a
-    # tracked edit somebody else left in the archive rode into this commit under
-    # this act's message. And it is what makes a half-done move safe: if the
-    # append lands and `delete_lines` or the commit does not, the archive is
-    # dirty and the next run REFUSES by name instead of appending the same rows
-    # a second time.
-    refuse_dirty_checkout "archive-rows" "$LANES_PATH"
-    # THE SAME RULE FOR THE ARCHIVE ITSELF: an untracked one is a file this act
-    # did not create, and appending to it would commit somebody else's lines
-    # inside this move (openRepoTools#82, round 2). An archive this act creates
-    # is untracked for the seconds between the write and the commit, which is
-    # why the test is made HERE — before anything is written.
-    if [ -f "$LANES_ARCH_FILE" ] && [ "$NO_GIT" != 1 ] &&
-       ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$LANES_ARCH_PATH" >/dev/null 2>&1; then
-      die "$LANES_ARCH_PATH exists in this checkout but is NOT TRACKED — somebody's uncommitted work, which this move would commit inside its own commit. Commit it first (\`git -C $LANES_REPO commit -m \"<what it is>\" -- $LANES_ARCH_PATH\`) and re-run. Nothing was written." 2
-    fi
-    # AN ARCHIVE THAT IS A SYMLINK, OR THERE AND NOT A REGULAR FILE, IS REFUSED
-    # (Copilot on #93's `afd5481`, #138 item 10). The rows are appended with
-    # `>>`, which follows a link: a tracked link here put them in whatever file
-    # it named, outside the repository, while the commit published the link and
-    # their removal from the register — the rows left the repository entirely.
-    if [ -L "$LANES_DIR/archive" ] || [ -L "$LANES_ARCH_FILE" ] ||
-       { [ -e "$LANES_ARCH_FILE" ] && [ ! -f "$LANES_ARCH_FILE" ]; }; then
-      die "$LANES_ARCH_PATH, or its directory, is a symlink — or the archive is there and not a regular file. This move appends the rows with '>>', which writes through a link to whatever file it names while the commit records the link and removes the rows from the register. Put the archive itself there as a regular file, commit it, and re-run. Nothing was written." 2
-    fi
-    # A PUBLISHED ARCHIVE THIS CHECKOUT DOES NOT HAVE IS REFUSED (Copilot on #93's
-    # `d0310f6`, #138 item 2). Out of a sparse checkout, or marked skip-worktree,
-    # the file is absent here and in nobody's dirty list, so the move created a
-    # NEW archive of only its own rows, whose commit would drop every position the
-    # published one reserves (Amendment 19(b)). Refused rather than seeded from
-    # origin: git (2.43, measured) will not stage a skip-worktree path, so a seeded
-    # archive fails at the commit after the rows have left the register here.
-    if [ "$NO_GIT" != 1 ] && have_remote_ref && [ ! -e "$LANES_ARCH_FILE" ] && [ ! -L "$LANES_ARCH_FILE" ]; then
-      ar_pubarch=""
-      ar_pubarch="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_ARCH_PATH" 2>/dev/null)" ||
-        die "the tree of origin/$LANES_BRANCH could not be listed, so whether $LANES_ARCH_PATH is published is not known — and a move that creates one beside a published one drops every position it reserves (Amendment 7(d)). Nothing was written." 1
-      [ -z "$ar_pubarch" ] ||
-        die "$LANES_ARCH_PATH is published on origin/$LANES_BRANCH and this checkout does not have it (it is outside a sparse checkout, or marked skip-worktree). A move made here would create a new archive holding only these rows, and its commit would drop every retired position the published one reserves (Amendment 19(b)). Bring it into this checkout — \`git -C $LANES_REPO sparse-checkout add ${LANES_ARCH_PATH%/*}\`, or for a skip-worktree path \`git -C $LANES_REPO update-index --no-skip-worktree $LANES_ARCH_PATH\` and \`git -C $LANES_REPO checkout -- $LANES_ARCH_PATH\` — and re-run. Nothing was written." 2
-    fi
-  fi
-
-  # THE REGISTER IS READ WITH ITS OWN STATUS (Copilot round 4 on #93). Inside
-  # the here-document below, a failed `awk` — an unreadable register — is
-  # discarded, the loop gets no rows, and the act reports "no row of <repo> has
-  # the state RETIRED" about a file it never read. An unreadable source is never
-  # an empty set (Amendment 7(d)).
-  ar_scan=""
-  ar_scan="$(awk 'substr($0,1,1) == "|" {
-         p1 = index($0, "`"); if (p1 == 0) next
-         r = substr($0, p1 + 1); p2 = index(r, "`"); if (p2 == 0) next
-         printf "%d\t%s\n", NR, substr(r, 1, p2 - 1)
-       }' "$LANES_FILE")" ||
-    die "the register $LANES_FILE could not be read, so which of $ar_repo's rows are RETIRED is not known — and that is not 'none of them are' (Amendment 7(d)). Nothing was written." 1
-
-  ar_tmp="$(mktemp -d)"
-  : > "$ar_tmp/rows"; : > "$ar_tmp/nums"; : > "$ar_tmp/names"
-  ar_n=0
-  while IFS="$(printf '\t')" read -r ar_num ar_lane; do
-    [ -n "${ar_num:-}" ] || continue
-    case "$(lc "$ar_lane")" in
-      "$ar_rl"-*) : ;;
-      *) continue ;;
-    esac
-    ar_head="$ar_lane"; ar_head="${ar_head%-*}"
-    [ "$(lc "$ar_head")" = "$ar_rl" ] || continue
-    ar_row="$(sed -n -e "${ar_num}p" "$LANES_FILE")"
-    # A ROW OF THIS REPOSITORY THAT CANNOT BE TAKEN APART IS A REFUSAL, NOT A
-    # SKIP (Copilot round 1 on #93). This act says it moves EVERY `RETIRED` row
-    # of `<repo>`; a row whose ` | ` count hides which text is the state cell
-    # may BE one, and moving the others while saying nothing about it is a
-    # partial act reported as a whole one.
-    ar_src=0; row_split_state_cell "$ar_row" || ar_src=$?
-    if [ "$ar_src" != 0 ]; then
-      rm -rf -- "$ar_tmp"
-      die "lane $ar_lane is $ar_repo's and its row (line $ar_num) carries $(row_sep_count "$ar_row") ' | ' separators where a seven-column row carries 6, so whether its state is RETIRED is not knowable from the row — and this act moves EVERY retired row of a repository or none of them. Escape the literal pipe inside that cell as \| by hand, commit it (\`LANES_LANE=$ar_lane lanes-edit.sh commit \"escape a literal pipe in row $ar_lane\"\`), and re-run. Nothing was written." 2
-    fi
-    mig_trim "$RSS_CELL"
-    [ "$(mig_lead_state "$MIG_TRIM")" = RETIRED ] || continue
-    # THE SEAM (Copilot round 3 on #97). This act takes a row out of the
-    # register, and a RETIRED row may carry the managed ledger's marker. One
-    # managed or unknown row refuses the WHOLE move, as one refuses the whole
-    # of the sweep, because the move is one commit. Asked in a subshell so this
-    # function removes its own staging directory before it exits, as each
-    # refusal above does; `die` there has already said why.
-    ar_mrc=0
-    ( managed_seam_refuse "$ar_lane" "archive-rows $ar_repo (the WHOLE move, which Amendment 19(d) makes one commit)" ) || ar_mrc=$?
-    if [ "$ar_mrc" != 0 ]; then
-      rm -rf -- "$ar_tmp"
-      exit "$ar_mrc"
-    fi
-    printf '%s\n' "$ar_row" >> "$ar_tmp/rows"
-    printf '%s\n' "$ar_num" >> "$ar_tmp/nums"
-    printf '%s\n' "$ar_lane" >> "$ar_tmp/names"
-    ar_n=$((ar_n + 1))
-  done <<EOF
-$ar_scan
-EOF
-
-  printf 'archive-rows %s — %s (lane-collision-protocol Amendment 19(d))\n' \
-    "$ar_repo" "$( [ "$ar_do" = 1 ] && printf 'THE ACT' || printf 'DRY RUN, nothing is written' )"
-  printf '  register : %s\n' "$LANES_FILE"
-  printf '  archive  : %s\n' "$LANES_ARCH_PATH"
-  printf '  rows     : %s RETIRED row(s) of %s\n' "$ar_n" "$ar_repo"
-  if [ "$ar_n" -gt 0 ]; then
-    printf '\n'
-    awk '{ print "  " $0 }' "$ar_tmp/names"
-  fi
-  if [ "$ar_n" = 0 ]; then
-    rm -rf -- "$ar_tmp"
-    die "no row of $ar_repo has the state RETIRED, so there is nothing to archive — this act moves finished rows and never anything else. \`lanes --closed --prefix $ar_repo\` shows what that repository's rows say; \`lane-end --retire-dormant $ar_repo\` is what RETIRES its dormant ones. Nothing was written." 2
-  fi
-  if [ "$ar_do" != 1 ]; then
-    printf '\n  DRY RUN — nothing was written. Make it the one act with:  lanes-edit.sh archive-rows %s --yes\n' "$ar_repo"
-    rm -rf -- "$ar_tmp"
-    return 0
-  fi
-  # A stopped earlier run may have appended to the archive before it removed
-  # the register rows. Never append those identities a second time, even if
-  # that partial archive was subsequently committed during recovery.
-  ar_existing=""
-  if [ -f "$LANES_ARCH_FILE" ]; then
-    ar_existing="$(awk -F'`' '/^\|/ && NF >= 3 { print $2 }' "$LANES_ARCH_FILE")" ||
-      die "could not read $LANES_ARCH_FILE to check for already archived lanes. Nothing was written." 1
-  fi
-  while IFS= read -r ar_lane; do
-    [ -n "$ar_lane" ] || continue
-    if printf '%s\n' "$ar_existing" | command grep -qixF -- "$ar_lane"; then
-      die "lane $ar_lane is already in $LANES_ARCH_PATH while still present in the register. Resolve that partial archive move before retrying; nothing was written." 2
-    fi
-  done < "$ar_tmp/names"
-
-  # THE ARCHIVE IS WRITTEN FIRST AND THE ROWS REMOVED SECOND, for the reason
-  # `delete_lines` gives: a refusal between the two leaves a copy in the archive
-  # and the register whole, and never a row in neither file. A peer's register
-  # edit is committed as its own first, after every refusal above (#157 item
-  # 4b, `migrate_state_cells`' reason).
-  handle_preexisting "$LANES_PATH"
-  mkdir -p -- "$LANES_DIR/archive" ||
-    die "could not create $LANES_DIR/archive — the archive is written before anything is removed, so nothing has been" 6
-  if [ ! -f "$LANES_ARCH_FILE" ]; then
-    {
-      printf '# LANES-retired.md — rows RETIRED out of `lanes/LANES.md`\n\n'
-      printf 'lane-collision-protocol Amendment 19(d). These lanes are finished. Their\n'
-      printf 'positions are NEVER REISSUED: every reader of the next free position and\n'
-      printf '`lanes --closed` read this file beside the register.\n\n'
-      printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-      printf '|---|---|---|---|---|---|---|\n'
-    } > "$LANES_ARCH_FILE" ||
-      die "could not write $LANES_ARCH_FILE — nothing has been removed from the register" 6
-    note "created $LANES_ARCH_FILE"
-    reg_wrote "$LANES_ARCH_PATH (created)"
-  fi
-  append_text_block "$LANES_ARCH_FILE" "$(cat -- "$ar_tmp/rows")"
-  reg_wrote "$LANES_ARCH_PATH ($ar_n row(s) appended)"
-  delete_lines "$(cat -- "$ar_tmp/nums")"
-
-  ar_msg="LANES(archive@$WS): Amendment 19(d) — $ar_n RETIRED row(s) of $ar_repo moved to $LANES_ARCH_PATH: $(tr '\n' ' ' < "$ar_tmp/names")"
-  rm -rf -- "$ar_tmp"
-  commit_push "$ar_msg" "$LANES_PATH" "$LANES_ARCH_PATH"
-  ar_crc=$?
-  release_lock
-  return "$ar_crc"
-}
-
-# ============================================================================
-# THE SEAM: A MANAGED-OWNED LANE IS NOT THIS TOOLING'S
-# ============================================================================
-#
-# Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled
-# lanes; #97 owns legacy — rework both". A lane the managed ledger has enrolled
-# carries a MANAGED-OWNER MARKER in its register row's state cell, written by
-# that ledger's own writer; every lane without one is a LEGACY lane, and the
-# legacy lane tooling in this file — the lifecycle below, the object log's
-# lane-kind lines, the sweep, the row writers — answers for legacy lanes only.
-#
-# THE RULE, which is the ported reader's own ("no malformed marker may be
-# downgraded to absence"):
-#   * a VALID marker is a managed lane: every legacy write refuses it with 2,
-#     names the owner, and writes nothing;
-#   * managed-owner vocabulary that does NOT parse — a malformed marker, a row
-#     that is not seven columns, an empty owner — or a register that could not
-#     be read is UNKNOWN: refused with 1, and nothing is written;
-#   * no vocabulary at all is a legacy lane, and everything here runs exactly
-#     as it did.
-#
-# PROVENANCE. The block between the two markers below is
-# `3c26041:lanes-edit.sh:776-898` — the projection reader of branch
-# `001-separate-swap-ctx-handoff` (its T019) — ported VERBATIM: not one byte of
-# it differs, so that when that branch's T024 lands, the merge of the two is
-# "keep either", and this file's `lane_is_managed_owned` becomes that branch's
-# `managed_legacy_check`. The proof is an empty diff:
-#   diff <(git show 3c26041:lanes-edit.sh | sed -n 776,898p) \
-#        <(sed -n '/^# --- BEGIN ported from 3c26041/,/^# --- END ported from 3c26041/p' lanes-edit.sh | sed '1d;$d')
-# Its four dependencies — `row_split_state_cell`, `rstrip_spaces`, `lc` and
-# `row_of_lane` — are byte-identical in this file and in that one.
-# --- BEGIN ported from 3c26041:lanes-edit.sh:776-898 ---
-MANAGED_PROJECTION_MODE=""
-MANAGED_PROJECTION_DAEMON=""
-MANAGED_PROJECTION_GENERATION=""
-MANAGED_PROJECTION_LANE=""
-
-managed_projection_component_valid() {   # <path-safe component>
-  local mpc_value="${1-}"
-  case "$mpc_value" in
-    '' | .* | -* | *[!A-Za-z0-9._-]*) return 1 ;;
-  esac
-  [ "${#mpc_value}" -le 128 ] || return 1
-  return 0
-}
-
-managed_projection_generation_valid() {   # <positive decimal integer>
-  local mpg_value="${1-}"
-  case "$mpg_value" in
-    '' | *[!0-9]* | 0) return 1 ;;
-  esac
-  while [ "${mpg_value#0}" != "$mpg_value" ]; do
-    mpg_value="${mpg_value#0}"
-  done
-  [ -n "$mpg_value" ] || return 1
-  MANAGED_PROJECTION_GENERATION="$mpg_value"
-  return 0
-}
-
-managed_projection_hint() {   # <row>; 0 means a managed marker is visible
-  printf '%s\n' "${1-}" | awk '
-    { s = tolower($0)
-      if (s ~ /managed[ _-](owner|binding)/ ||
-          s ~ /mode[ _-]*=[ _-]*managed/ ||
-          s ~ /managed[ _-]*:/) found = 1
-    }
-    END { exit(found ? 0 : 8) }'
-}
-
-managed_projection_parse_row() {   # <row>; 0 valid marker, 8 absent, other unknown
-  local mppr_row="${1-}" mppr_split mppr_cell mppr_text mppr_line mppr_fields mppr_hint mppr_row_lane
-  MANAGED_PROJECTION_MODE=""
-  MANAGED_PROJECTION_DAEMON=""
-  MANAGED_PROJECTION_GENERATION=""
-  MANAGED_PROJECTION_LANE=""
-  mppr_hint=8
-  if managed_projection_hint "$mppr_row"; then
-    mppr_hint=0
-  else
-    mppr_hint=$?
-  fi
-  mppr_split=0
-  row_split_state_cell "$mppr_row" || mppr_split=$?
-  case "$mppr_split" in
-    0) : ;;
-    2) [ "$mppr_hint" = 0 ] && return 1; return 8 ;;
-    *) [ "$mppr_hint" = 0 ] && return 1; return 8 ;;
-  esac
-  # A row without any managed-owner vocabulary is an ordinary legacy row and
-  # is the confirmed-absent projection result.  Once that vocabulary appears,
-  # however, every table/state delimiter and every owner field is evidence that
-  # must parse; no malformed marker may be downgraded to absence.  The split
-  # above intentionally runs first so projection writers retain RSS_HEAD and
-  # RSS_TAIL when replacing an ordinary row.
-  [ "$mppr_hint" = 0 ] || { [ "$mppr_hint" = 8 ] && return 8; return 1; }
-  mppr_cell="$(rstrip_spaces "$RSS_CELL")"
-  case "$mppr_cell" in
-    'MANAGED OWNER · '* | 'managed owner · '*)
-      # Keep the historical shorthand, but never treat an empty owner token
-      # as a valid durable binding.
-      mppr_text="${mppr_cell#* · }"
-      case "$mppr_text" in
-        '' | *[!A-Za-z0-9._-]*) return 1 ;;
-      esac
-      return 0
-      ;;
-    *' · '*) mppr_text="${mppr_cell#* · }" ;;
-    *) return 1 ;;
-  esac
-  case "$mppr_text" in
-    *' · '*) mppr_line="${mppr_text#* · }" ;;
-    *)
-      return 1 ;;
-  esac
-  case "$mppr_line" in
-    managed-owner\ *) : ;;
-    *) return 1 ;;
-  esac
-  mppr_fields="$(printf '%s\n' "$mppr_line" | sed -n \
-    's/^managed-owner mode=\([^[:space:]]*\) daemon=\([^[:space:]]*\) generation=\([^[:space:]]*\) bound-lane=\([^[:space:]]*\)$/\1|\2|\3|\4/p')"
-  [ -n "$mppr_fields" ] || return 1
-  IFS='|' read -r MANAGED_PROJECTION_MODE \
-    MANAGED_PROJECTION_DAEMON MANAGED_PROJECTION_GENERATION \
-    MANAGED_PROJECTION_LANE <<EOF
-$mppr_fields
-EOF
-  [ "$MANAGED_PROJECTION_MODE" = managed ] || return 1
-  managed_projection_component_valid "$MANAGED_PROJECTION_DAEMON" || return 1
-  managed_projection_generation_valid "$MANAGED_PROJECTION_GENERATION" || return 1
-  managed_projection_component_valid "$MANAGED_PROJECTION_LANE" || return 1
-  mppr_row_lane="$(printf '%s\n' "$RSS_HEAD" | awk -F'|' '{ cell=$2; sub(/^[[:space:]]+/, "", cell); sub(/[[:space:]]+$/, "", cell); sub(/^`/, "", cell); sub(/`$/, "", cell); print cell }')"
-  managed_projection_component_valid "$mppr_row_lane" || return 1
-  [ "$(lc "$mppr_row_lane")" = "$(lc "$MANAGED_PROJECTION_LANE")" ] || return 1
-  return 0
-}
-
-managed_projection_read() {   # <canonical lane>; 0 marker, 8 absent, other unknown
-  local mpr_lane="${1-}" mpr_row mpr_rc
-  if mpr_row="$(row_of_lane "$mpr_lane" 2>/dev/null)"; then
-    :
-  else
-    mpr_rc=$?
-    return "${mpr_rc:-1}"
-  fi
-  # `row_of_lane` is an awk pipeline and therefore exits 0 even when it
-  # printed no row.  An empty result is the published register's confirmed
-  # absence (8), not an unreadable projection; callers need this distinction
-  # so a new legacy lane remains compatible when the optional helper is absent.
-  [ -n "$mpr_row" ] || return 8
-  managed_projection_parse_row "$mpr_row"
-}
-
-managed_projection_check() {   # <canonical lane>; 0 conflict, 8 absent, other unknown
-  managed_projection_read "${1-}"
-}
-# --- END ported from 3c26041:lanes-edit.sh:776-898 ---
-
-# THE ONE READ EVERY CALLER ASKS: 0 with the owner on stdout, 8 a legacy lane,
-# 1 UNKNOWN. It wraps `managed_projection_read` and maps every other status of
-# it to 1, and it closes the one gap the ported reader leaves open on purpose:
-# `row_of_lane` is an awk pipeline over `register_text`, which answers an EMPTY
-# register — not a failure — where the published one could not be rendered, so
-# the reader would call every lane legacy. An empty register is not a register
-# with no managed lane in it, and it is 1 here (Amendment 7(d)).
-# THE OWNER is the marker's `daemon=` for the full form and its token for the
-# historical `MANAGED OWNER · <token>` shorthand, read from the same state cell
-# the reader has just validated.
-lane_is_managed_owned() {   # <canonical lane>
-  limo_lane="${1-}"; limo_rc=0
-  [ -n "$limo_lane" ] || return 1
-  limo_reg="$(register_text)"
-  [ -n "$limo_reg" ] || return 1
-  managed_projection_read "$limo_lane" || limo_rc=$?
-  case "$limo_rc" in
-    0)
-      if [ -n "$MANAGED_PROJECTION_DAEMON" ]; then
-        printf '%s\n' "$MANAGED_PROJECTION_DAEMON"
-      else
-        limo_cell="$(rstrip_spaces "$RSS_CELL")"
-        printf '%s\n' "${limo_cell#* · }"
-      fi
-      return 0 ;;
-    8) return 8 ;;
-    *) return 1 ;;
-  esac
-}
-
-# THE REFUSAL, in one place, so every legacy act says the same two sentences.
-# Returns 0 for a legacy lane; never returns otherwise. Called BEFORE the act
-# writes anything — before its lock where it takes one, and where the lock is
-# already held (the sweeps), before its first write — so a refusal changes
-# nothing; `die` releases a held lock on the way out.
-#
-# AND THIS CHECKOUT'S ROW, NOT ONLY THE PUBLISHED ONE (Copilot round 2 and 3 on
-# openRepoTools#97). The read above is the published register's (R19), and every
-# legacy row writer rewrites the row in THIS checkout: one ahead of origin, or
-# holding an edit `handle_preexisting` is about to capture, can carry managed-owner
-# vocabulary the published row does not. Two copies that disagree on ownership
-# are UNKNOWN, never legacy (Amendment 7(d)). A checkout with no register file
-# has no row here to rewrite, and the published read has already answered.
-managed_seam_refuse() {   # <canonical lane> <the act>
-  msr_lane="${1-}"; msr_act="${2-this act}"; msr_rc=0; msr_owner=""
-  msr_owner="$(lane_is_managed_owned "$msr_lane")" || msr_rc=$?
-  case "$msr_rc" in
-    0) die "lane $msr_lane is owned by the managed ledger (owner ${msr_owner:-unnamed}, from the managed-owner marker in its register row), and $msr_act is a legacy lane act: Brett Heap's ruling of 2026-10-04 — \"managed ledger owns enrolled lanes; #97 owns legacy\". Nothing was written. Act on this lane through the managed ledger." 2 ;;
-    8) : ;;
-    *) die "whether the managed ledger owns lane $msr_lane is UNKNOWN: its register row carries managed-owner vocabulary that does not parse as a marker, or the register could not be read — and an ownership nobody could establish is never read as 'legacy' (Amendment 7(d)). $msr_act was refused and nothing was written. Read it: lanes-edit.sh managed-projection $msr_lane" 1 ;;
-  esac
-  managed_local_hint "$msr_lane" ||
-    die "whether the managed ledger owns lane $msr_lane is UNKNOWN: its row in this checkout's register file, $LANES_FILE, carries managed-owner vocabulary (or could not be read) where the published register's, origin/$LANES_BRANCH, does not, and a legacy act rewrites THAT file's row — an ownership the two copies disagree on is never read as 'legacy' (Amendment 7(d)). $msr_act was refused and nothing was written. $(managed_local_remedy)" 1
-  return 0
-}
-
-# THIS CHECKOUT'S HALF OF THAT READ, which `managed-projection` asks too
-# (opensoft/openRepoTools#157 item 4a): the gates of `lane-start`, `lane-handoff`
-# and `lane-end` ask that read, and a gate that passed a marker only this copy
-# carries let a launch go on until a later writer refused. 0 where this
-# checkout's row carries no managed-owner vocabulary, or there is no register
-# file here; 1 where it carries some or could not be read. VOCABULARY ONLY, and
-# not the row's shape (item 4d): a row with none cannot be a marker, so it is
-# legacy in either copy, and the writer that rewrites it refuses a shape it
-# cannot split on its own.
-managed_local_hint() {   # <canonical lane>
-  mlh_hint=8; mlh_loc=""
-  [ -f "$LANES_FILE" ] || return 0
-  mlh_loc="$(row_of_lane_local "${1-}" 2>/dev/null)" || mlh_hint=1
-  if [ "$mlh_hint" = 8 ] && [ -n "$mlh_loc" ]; then
-    mlh_hint=0; managed_projection_hint "$mlh_loc" || mlh_hint=$?
-  fi
-  [ "$mlh_hint" = 8 ]
-}
-
-# WHAT A PERSON DOES ABOUT IT, in the words both refusals above print. The file
-# named is the one `managed_local_hint` READ, which is not always in
-# `$LANES_REPO`: a caller that points `LANES_REPO` at a runtime clone and sets
-# no `LANES_WORKSPACE_ROOT` reads the published register in that clone and this
-# file in workspace.yaml's tree. And the two copies can disagree in either
-# direction: a change here that origin has not got, or a change on origin
-# (the ledger removing its marker) that this checkout has not pulled.
-managed_local_remedy() {
-  printf 'That file is AHEAD of origin — the row changed there and not pushed, or not committed at all: publish that change or undo it — or BEHIND it — origin has dropped the vocabulary since that checkout last moved: fast-forward it. Which one: git -C %s fetch && git -C %s status --short --branch -- %s' \
-    "${LANES_FILE%/*}" "${LANES_FILE%/*}" "${LANES_FILE##*/}"
-}
-
-# ============================================================================
-# THE CRASH-CONSISTENT LANE LIFECYCLE AND THE WORKTREE INVENTORY
-# (openspec/changes/add-crash-consistent-lane-worktree-recovery,
-#  opensoft/openRepoTools#91)
-# ============================================================================
-#
-# **A LANE IS `RUNNING`, `SWAPPING`, `SWAPPED` OR `CLOSED`, and which of those
-# it is, with no live holder, is what says where it stopped.** A session can
-# run out of tokens BEFORE the handoff, AFTER it began and before it finished,
-# or after it finished — and until this section those three left the same
-# evidence: a lane whose last lane-kind line was a `STARTED`/`RESUMED` (which
-# is also what a lane that is running looks like) or a `PAUSED` (which is also
-# what a clean swap looks like). The two crash kinds had no word.
-#
-# WHAT IS NEW AND WHAT IS NOT. Nothing about the append-only log changes: its
-# five STATE verbs are Amendment 7's and this section adds no lane-kind verb at
-# all (Amendment 18(g)'s `HANDOFF-REQUESTED` is the sixth lane-kind verb, and it
-# changes no state), so `swapped_candidates`, `lane_row_facts`,
-# `lane_payload_field`, `lane-last`, `who` and `lane-end` read exactly what they
-# read before. What is added is a
-# SNAPSHOT beside that history — one small file per lane, replaced atomically
-# under this file's own mutex — carrying the state word, a monotonic
-# GENERATION, the OPERATION ID of the transition in flight, and the owner. The
-# log stays the provenance; the snapshot is the cheap current-state read that
-# an append-only file cannot give a compare-and-swap.
-#
-# WHERE IT LIVES, AND WHY IT IS NOT IN THE REGISTER AND NOT IN A WORKTREE.
-#   * NOT IN THE REGISTER. `lanes/LANES.md` is one file shared by every lane on
-#     every workstation and every write of it is a commit, a pull --rebase and
-#     a push (Amendment 5). A transition is taken three times per handoff and
-#     must be able to happen with no network at all.
-#   * NOT INSIDE A GIT WORKTREE. Orchestration metadata written into a checkout
-#     dirties it, is committed by accident, and disappears with the very
-#     directory whose loss it is meant to explain.
-#   * SO: a LOCAL control root beside the lane's own checkouts, derived in this
-#     order and never from the caller's current directory —
-#       1. `$LANES_LANE_STATE_ROOT/<lane>`, the explicit override and the
-#          suite's seam;
-#       2. `<parent of the lane's recorded `dir`>/.lane-state/<lane>` — the
-#          same parent the lane's own `.lane-worktrees/<lane>` root sits in,
-#          and `dir` is Amendment 11(c)'s recorded field, not a guess;
-#       3. `$PROJECTS_ROOT/.lane-state/<lane>`, for a lane whose record names
-#          no directory yet.
-#     No answer is 8, "this lane has no control root", exactly as `lane-dir`
-#     answers 8 for a lane that has not started under Amendment 11 — and the
-#     pre-cutover lane is the ordinary case, not a failure (Amendment 7(i)).
-#
-# IT IS WRITTEN WHERE `R-A11-14` STOPS THE REGISTER AND THE OBJECT LOG. That
-# rule refuses a record FILED UNDER A WORKSTATION where no workstation is
-# configured, because such a record is unfindable by every restart of every
-# workstation. The snapshot is filed under nothing: it is local to the machine
-# that wrote it, it is never committed and it never leaves. So a container with
-# no `$LANES_WORKSTATION` still keeps a lifecycle it can recover itself from,
-# and these two writers are deliberately NOT in the dispatcher's workstation
-# guard above.
-#
-# THE FENCE. Every transition carries `generation` (monotonic) and
-# `operation` (unique to one handoff). `set-lane-state --expect` names the
-# state, and optionally the generation and the operation, the caller believes
-# it is moving from; the write happens only where all three still match, and
-# otherwise NOTHING is written and the exit is 7 — the estate's "another act
-# got there first", which is what `claim` already spends it on. That is the
-# whole of what stops a `/handoff` that stalled for an hour from marking a lane
-# `SWAPPED` after somebody has recovered and resumed it.
-#
-# WHO WRITES `RUNNING`. The confirming act, and never the SessionStart hook:
-# `session-start` NEVER WRITES, never touches the network and ALWAYS EXITS 0
-# (Amendment 8, R-A8-1), which is what makes it safe in front of every session
-# on the workstation. The act that actually proves lane, transcript, agent,
-# directory and binding is `lane-start` (with or without `--no-launch`), and
-# the proof it leaves is its `STARTED`/`RESUMED` line — so the snapshot follows
-# THAT line, in `write_event`, from any caller. `ENDED`/`RETIRED` become
-# `CLOSED` by the same rule. A `PAUSED` moves nothing: the two-phase transition
-# around it belongs to `lane-handoff`, which takes `SWAPPING` before it polls
-# anything and `SWAPPED` only after every mandatory write has landed.
-
-LANE_STATE_SCHEMA=1
-
-# The four words, and nothing else is one.
-lane_state_word_ok() {   # <word>
-  case "${1-}" in RUNNING|SWAPPING|SWAPPED|CLOSED) return 0 ;; esac
-  return 1
-}
-
-# THE CONTROL ROOT — the three rungs above, in order. 0 with the path (which
-# need not exist yet), 8 where no rung answers.
-lane_control_root() {   # <lane> [<a payload that may carry `dir`>]
-  lcr_lane="${1-}"; lcr_pay="${2-}"; lcr_dir=""; lcr_par=""
-  [ -n "$lcr_lane" ] || return 8
-  if [ -n "${LANES_LANE_STATE_ROOT:-}" ]; then
-    printf '%s/%s\n' "${LANES_LANE_STATE_ROOT%/}" "$lcr_lane"
-    return 0
-  fi
-  [ -n "$lcr_pay" ] && lcr_dir="$(payload_subfield "$lcr_pay" dir)"
-  if [ -z "$lcr_dir" ]; then
-    lcr_dir="$(lane_payload_field "$lcr_lane" dir 2>/dev/null || :)"
-  fi
-  case "$lcr_dir" in
-    /*) lcr_par="${lcr_dir%/*}" ;;
-    *)  lcr_par="" ;;
-  esac
-  if [ -n "$lcr_par" ] && [ -d "$lcr_par" ]; then
-    printf '%s/.lane-state/%s\n' "$lcr_par" "$lcr_lane"
-    return 0
-  fi
-  if [ -n "${PROJECTS_ROOT:-}" ] && [ -d "$PROJECTS_ROOT" ]; then
-    printf '%s/.lane-state/%s\n' "${PROJECTS_ROOT%/}" "$lcr_lane"
-    return 0
-  fi
-  return 8
-}
-
-# ONE FIELD OUT OF ONE OF THESE FILES. They are flat `key: value` lines and
-# nothing else — no nesting, no lists — so one `awk` reads every one of them
-# and a malformed file answers empty rather than half a value.
-lane_sidecar_field() {   # <file> <key>
-  [ -r "${1-}" ] || return 1
-  awk -v k="${2-}" '
-    BEGIN { k = k ": " }
-    substr($0, 1, length(k)) == k {
-      v = substr($0, length(k) + 1)
-      sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-      print v; exit }' "$1"
-}
-
-# THE SCHEMA EVERY WRITER ASKS ABOUT BEFORE IT REPLACES ANYTHING (Copilot round
-# 5 on openRepoTools#97). `lane_state_read` fails closed for a snapshot version
-# it does not know — but a READER failing closed protects nobody if the WRITER
-# beside it reads the raw fields and renames a file of its own over the top: an
-# older helper meeting a `schema: 999` snapshot would then destroy a record it
-# could not even read, and no later reader can undo that. So every writer of a
-# sidecar in this section asks this first.
-#
-# ABSENT IS FINE — the first snapshot of a lane destroys nothing — and the
-# CURRENT version is fine. Everything else, INCLUDING A FILE THAT EXISTS AND
-# CANNOT BE READ, is refused: a schema nobody could read is not a schema this
-# helper knows (R22, Amendment 7(d)).
-# AND A DANGLING SYMLINK IS NOT ABSENT (Copilot on 64dfd97, PR #97): `-e` is
-# false for one, so this guard used to wave every writer through to rename its
-# own file over a record `lane_state_read` itself calls present-and-unreadable.
-# `[ -L ]` beside `[ -e ]`, exactly as the reader asks it.
-#
-# AND THE RECORD, NOT ONLY ITS VERSION LINE (opensoft/openRepoTools#115). This
-# asked one question, so a file whose first line is `schema: 1` and which holds
-# nothing else passed it — a record of the current version that is not valid at
-# that version — and both sides took it for one: the readers emitted empty
-# fields for it and the writers renamed their own file over it, the act this
-# guard exists to refuse. A file cut short is not exotic: `lane_sidecar_put`'s
-# `cat` can be, and the rename makes a COMPLETE file atomic, not an incomplete
-# one impossible. So a record of the current schema passes only when it is
-# WHOLE: every key its writer writes is there and is not empty, the keys a
-# reader decides with have their shapes, and a tree record claims the id its
-# file name gives it. Both writers have written exactly these keys since #97
-# landed (`lane_state_put`, `lane_tree_put`), so no record a released helper
-# wrote fails it. A malformed record of the KNOWN schema takes the refusal an
-# unknown schema takes: every writer refuses it (1), the snapshot's reader
-# answers 10, and the inventory's names it `<malformed>`.
-#
-# WHICH KIND OF RECORD IT IS COMES FROM WHERE IT IS FILED — `<root>/lane-state.yaml`
-# for the snapshot, `<root>/trees/<id>.yaml` for a tree — and the second argument
-# names that place for a file that is not there yet (`lane_sidecar_put`'s
-# temporary file). THE SNAPSHOT'S ARM COMES FIRST (review r1 of #252): a `case`
-# pattern's `*` matches `/`, so `*/trees/*.yaml` also matches
-# `/x/trees/state/<lane>/lane-state.yaml`, and under a control root with any
-# directory named `trees` above it every snapshot was asked a tree's keys,
-# refused, and never written. A tree's file is never named `lane-state.yaml`:
-# its id is `c<cksum>-…` (`tree_id_for`). `LSS_WHY` says why a record failed, in words a caller puts
-# in its own message; it is set in the caller's shell, so call this directly
-# and never inside `$( )`. The awk reads the id through the ENVIRONMENT, because
-# `awk -v` processes escapes in a value.
-lane_sidecar_schema_ok() {   # <file> [<the path it is filed as>]
-  LSS_WHY=""
-  [ -e "${1-}" ] || [ -L "${1-}" ] || return 0
-  if [ ! -r "$1" ]; then
-    LSS_WHY="it is there and could not be read"
-    return 1
-  fi
-  lss_v="$(lane_sidecar_field "$1" schema 2>/dev/null || :)"
-  if [ "$lss_v" != "$LANE_STATE_SCHEMA" ]; then
-    LSS_WHY="it is of a schema this helper does not write (it writes schema $LANE_STATE_SCHEMA)"
-    return 1
-  fi
-  lss_as="${2:-$1}"; lss_kind=""; lss_id=""
-  case "$lss_as" in
-    */lane-state.yaml) lss_kind=snapshot ;;
-    */trees/*.yaml)    lss_kind=tree; lss_id="${lss_as##*/}"; lss_id="${lss_id%.yaml}" ;;
-  esac
-  [ -n "$lss_kind" ] || return 0
-  lss_rc=0
-  LSS_WHY="$(LSS_KIND="$lss_kind" LSS_ID="$lss_id" awk '
-    { i = index($0, ": ")
-      if (i > 1) { k = substr($0, 1, i - 1); v = substr($0, i + 2)
-        sub(/^[ \t]+/, "", v); sub(/[ \t]+$/, "", v)
-        if (!(k in val)) val[k] = v } }
-    END {
-      kind = ENVIRON["LSS_KIND"]
-      if (kind == "snapshot")
-        n = split("lane state generation operation owner agent profile workstation kind updated", req, " ")
-      else
-        n = split("lane tree path checkout branch head upstream dirty unpushed writer generation operation observed", req, " ")
-      miss = ""
-      for (j = 1; j <= n; j++)
-        if (!(req[j] in val) || val[req[j]] == "") miss = miss (miss == "" ? "" : ", ") req[j]
-      if (miss != "") { print "it is not a whole record: it carries no " miss; exit }
-      if (val["generation"] !~ /^[0-9]+$/) { print "its generation \"" val["generation"] "\" is not a number"; exit }
-      if (kind == "snapshot") {
-        if (val["state"] !~ /^(RUNNING|SWAPPING|SWAPPED|CLOSED)$/) {
-          print "its state \"" val["state"] "\" is none of RUNNING, SWAPPING, SWAPPED and CLOSED"; exit }
-      } else {
-        if (val["tree"] != ENVIRON["LSS_ID"]) {
-          print "it claims to be tree " val["tree"] " and is filed as " ENVIRON["LSS_ID"]; exit }
-        if (substr(val["path"], 1, 1) != "/") { print "its path \"" val["path"] "\" is not absolute"; exit }
-        if (val["dirty"] !~ /^[0-9]+$/) { print "its dirty count \"" val["dirty"] "\" is not a number"; exit }
-        if (val["unpushed"] !~ /^([0-9]+|unknown)$/) {
-          print "its unpushed count \"" val["unpushed"] "\" is neither a number nor unknown"; exit }
-      }
-    }' "$1" 2>/dev/null)" || lss_rc=$?
-  if [ "$lss_rc" != 0 ]; then
-    LSS_WHY="it could not be read through (awk exited $lss_rc)"
-    return 1
-  fi
-  [ -z "$LSS_WHY" ]
-}
-
-# THE SNAPSHOT AS IT STOOD, IN ONE STRING — the pre-image a fenced write
-# compares against. `<state>/<generation>/<operation>`, and `none/0/none` for a
-# lane that has no snapshot at all, so that "there was nothing here" and "there
-# was something here" are two different answers rather than one empty string.
-lane_state_fingerprint() {   # <file>
-  [ -e "${1-}" ] || { printf 'none/0/none\n'; return 0; }
-  printf '%s/%s/%s\n' \
-    "$(lane_sidecar_field "$1" state 2>/dev/null || :)" \
-    "$(lane_sidecar_field "$1" generation 2>/dev/null || :)" \
-    "$(lane_sidecar_field "$1" operation 2>/dev/null || :)"
-}
-
-# A VALUE IS ONE LINE OF `key: value`, so a newline or a leading space in one
-# would make the file unreadable by the reader above. Both are flattened here
-# rather than refused, because a value this can spoil is a branch name or a
-# path and losing the WHOLE record over one is the worse trade.
-lane_sidecar_value() {   # <value>
-  lsv="${1-}"
-  lsv="${lsv//$'\r'/ }"
-  lsv="${lsv//$'\n'/ }"
-  printf '%s' "$lsv"
-}
-
-# THE ATOMIC REPLACE. Written beside the target and renamed over it, so a
-# reader never sees half a snapshot and a full disk leaves the old one intact.
-#
-# AND ONLY A WHOLE RECORD IS RENAMED INTO PLACE (opensoft/openRepoTools#115).
-# The rename makes a complete file atomic and nothing more: a `cat` whose input
-# was cut short — the writer killed between two of its lines — still exits 0,
-# and the half record it wrote was renamed over the whole one. The temporary
-# file is asked the question every reader and writer of the record asks, under
-# the name it is about to take, and a record that fails it is removed instead.
-lane_sidecar_put() {   # <file> ; the whole body on stdin
-  lsp_f="${1-}"; lsp_d="${lsp_f%/*}"
-  [ -n "$lsp_f" ] || return 1
-  mkdir -p -- "$lsp_d" 2>/dev/null || return 1
-  lsp_t="$lsp_f.tmp.$$"
-  cat > "$lsp_t" 2>/dev/null || { rm -f -- "$lsp_t" 2>/dev/null; return 1; }
-  if ! lane_sidecar_schema_ok "$lsp_t" "$lsp_f"; then
-    rm -f -- "$lsp_t" 2>/dev/null
-    note "the record for $lsp_f was NOT written: what was about to replace it is not a whole record ($LSS_WHY), and a half record is never renamed over a whole one."
-    return 1
-  fi
-  mv -- "$lsp_t" "$lsp_f" 2>/dev/null || { rm -f -- "$lsp_t" 2>/dev/null; return 1; }
-  return 0
-}
-
-# AN OPERATION ID: unique to one transition, and shaped like the manifest key
-# every other sub-field of this estate is — letters, digits, `.`, `_`, `-` — so
-# that it can be carried in a payload, a filename and a commit subject without
-# a quoting rule of its own. There is no `uuidgen` on every workstation this
-# runs on, and a timestamp with the pid and two `$RANDOM`s behind it is unique
-# among the handfuls of transitions one lane takes in a day.
-lane_op_id() {
-  printf 'op-%s-%s-%s%s\n' "$(date -u +%Y%m%dT%H%M%SZ)" "$$" "$RANDOM" "$RANDOM"
-}
-
-# THE SNAPSHOT, READ. `<key><TAB><value>` lines, which is what every caller
-# here parses with one `awk`. 0 with the fields, 8 where the lane has no
-# snapshot at all (the pre-cutover lane, and not a failure), 10 where a snapshot
-# IS there and could not be read — or is of this schema and not a whole record
-# (#115) — 1 where the control root could not be derived.
-#
-# THE 10 IS THE POINT OF THIS ROUND (Copilot round 6 on openRepoTools#97, where
-# it was 9 — main's #61 has since spent 9 on `claim`, so this one moved). A bare
-# `[ -r ] || return 8` answered *this lane has no snapshot* for a file that
-# exists and cannot be opened, and `lane_reconcile` maps every non-zero read to
-# `NONE` — so a permission or an I/O error came out of the report as `no-state`,
-# the verdict that tells a launcher this lane was never migrated and there is
-# nothing to recover. That is fail-OPEN on a crash pronouncement, which is the
-# whole class this capability exists to close: a read that failed is never an
-# answer (R22, Amendment 7(d)), and the two cases are told apart here so that
-# every caller above can tell them apart too.
-#
-# `[ -L ]` BESIDE `[ -e ]`, because a DANGLING SYMLINK is `-e` false: the name
-# is there and the bytes are not, which is exactly *present and unreadable* and
-# would otherwise fall through to the 8.
-#
-# THE PAYLOAD IS `lane_control_root`'s, AND OPTIONAL: a caller that already
-# holds the lane's `dir` hands it here, and the lane's log is not read again
-# to find it (review r2 of #289, SHOULD-A). A caller that names the lane
-# alone finds the root exactly as before.
-lane_state_read() {   # <lane> [<a payload that may carry `dir`>]
-  lsr_lane="${1-}"; lsr_root=""; lsr_rc=0
-  lsr_root="$(lane_control_root "$lsr_lane" "${2-}")" || lsr_rc=$?
-  [ "$lsr_rc" = 0 ] || return 1
-  lsr_f="$lsr_root/lane-state.yaml"
-  if [ ! -r "$lsr_f" ]; then
-    if [ -e "$lsr_f" ] || [ -L "$lsr_f" ]; then return 10; fi
-    return 8
-  fi
-  # AN UNKNOWN SCHEMA FAILS CLOSED (design decision: "conservative fail-closed
-  # behaviour for unknown versions"), through the ONE test every writer of these
-  # files takes too. A newer tooling's snapshot read by an older reader must not
-  # be reported as a lane in a state this reader knows — and must not be
-  # replaced by one either, which is what `lane_sidecar_schema_ok` is for.
-  # A RECORD OF THIS SCHEMA THAT IS NOT A WHOLE ONE is 10 (#115): it is there
-  # and nothing can be read out of it as a snapshot, which is what 10 says. Its
-  # fields used to come out EMPTY, and an empty state reached the verdict table
-  # as a word nobody wrote.
-  if ! lane_sidecar_schema_ok "$lsr_f"; then
-    lsr_schema="$(lane_sidecar_field "$lsr_f" schema 2>/dev/null || :)"
-    [ "$lsr_schema" != "$LANE_STATE_SCHEMA" ] || return 10
-    printf 'state\tUNKNOWN-SCHEMA\n'; printf 'schema\t%s\n' "${lsr_schema:-<none>}"
-    printf 'file\t%s\n' "$lsr_f"; return 0
-  fi
-  for lsr_k in state generation operation owner agent profile workstation kind updated lane; do
-    printf '%s\t%s\n' "$lsr_k" "$(lane_sidecar_field "$lsr_f" "$lsr_k")"
-  done
-  printf 'file\t%s\n' "$lsr_f"
-  return 0
-}
-
-# One field of it, for the callers that want exactly one.
-lane_state_of() {   # <lane> <key>
-  lso_out=""; lso_rc=0
-  lso_out="$(lane_state_read "${1-}")" || lso_rc=$?
-  [ "$lso_rc" = 0 ] || return "$lso_rc"
-  printf '%s\n' "$lso_out" | awk -F'\t' -v k="${2-}" '$1 == k { print $2; exit }'
-}
-
-# THE SNAPSHOT, WRITTEN — the ONE writer, and every caller reaches it through
-# `set-lane-state`. `lsw_*` are its fields; an empty one is written as `none`,
-# which is an ANSWER and not a gap, on the same argument Amendment 17(b) gives
-# its `transcript` sub-field.
-lane_state_put() {   # <root> <lane> <state> <gen> <op> <owner> <agent> <profile> <ws> <kind>
-  lsw_root="$1"; lsw_lane="$2"; lsw_state="$3"; lsw_gen="$4"; lsw_op="$5"
-  lsw_owner="$6"; lsw_agent="$7"; lsw_prof="$8"; lsw_ws="$9"; shift 9; lsw_kind="${1-}"
-  { printf 'schema: %s\n'      "$LANE_STATE_SCHEMA"
-    printf 'lane: %s\n'        "$(lane_sidecar_value "$lsw_lane")"
-    printf 'state: %s\n'       "$lsw_state"
-    printf 'generation: %s\n'  "$lsw_gen"
-    printf 'operation: %s\n'   "${lsw_op:-none}"
-    printf 'owner: %s\n'       "${lsw_owner:-none}"
-    printf 'agent: %s\n'       "${lsw_agent:-none}"
-    printf 'profile: %s\n'     "${lsw_prof:-none}"
-    printf 'workstation: %s\n' "${lsw_ws:-none}"
-    printf 'kind: %s\n'        "${lsw_kind:-none}"
-    printf 'updated: %s\n'     "$(utc_now)"
-  } | lane_sidecar_put "$lsw_root/lane-state.yaml"
-}
-
-# THE SNAPSHOT AS IT STOOD BEFORE THE LINE WAS WRITTEN. `write_event` takes this
-# BEFORE it appends anything and hands it to the follow-up below, which is the
-# only way that follow-up can tell *I am the newest act on this lane* from *I am
-# a delayed act whose lane has moved on since*. A lane with no control root
-# answers the same `none/0/none` a lane with no snapshot does: nothing to
-# compare, and nothing to overwrite either.
-lane_state_preimage() {   # <lane> <payload>
-  lsp_root=""; lsp_prc=0
-  lsp_root="$(lane_control_root "${1-}" "${2-}")" || lsp_prc=$?
-  [ "$lsp_prc" = 0 ] || { printf 'none/0/none\n'; return 0; }
-  lane_state_fingerprint "$lsp_root/lane-state.yaml"
-}
-
-# THE LINE THAT WAS WRITTEN IS WHAT MOVES THE SNAPSHOT, and this is where the
-# two are kept from disagreeing: it is called by `write_event`, from any
-# caller, after the log line has landed. It NEVER fails the event: a lane with
-# no control root is silent, because a lane that has not started under Amendment
-# 11 has no directory to derive one from and that is the ordinary pre-cutover
-# case.
-#
-# IT IS SERIALIZED AND IT IS FENCED (Copilot round 5 on openRepoTools#97). What
-# a confirmed `STARTED`/`RESUMED` is entitled to overwrite is the state THIS
-# WRITE SAW — advancing the generation over a `SWAPPING` it superseded is the
-# whole point of writing it — and what it is never entitled to overwrite is a
-# state that arrived AFTER it. The two are the same act read at different
-# moments, so they are told apart the only way they can be: the snapshot is read
-# under the same mutex `set-lane-state` takes, and compared with the pre-image
-# `write_event` took before this event's own line landed. Unequal means another
-# act moved the lane while this one was being written — a recovery, a handoff,
-# an `ENDED` from elsewhere — and a delayed `RUNNING` or `CLOSED` written over
-# it would be exactly the overwrite the generation exists to refuse. Nothing is
-# written then, and the lane is NAMED so a person can read it.
-#
-# THE MUTEX IS TAKEN WITHOUT DYING FOR IT. `write_event` has already released it
-# and its line is already committed: a `die` here would abort a caller whose
-# work is on disk, so a mutex nobody could take within 20s costs the snapshot
-# and says so, never the event.
-#
-# AND IT WRITES ONLY FOR A LEGACY LANE, ON EVIDENCE IT WAS HANDED (ruling
-# 2026-10-04, design decision 21). Three things must all hold before the
-# snapshot moves — `RUNNING` for a `STARTED`/`RESUMED`, `CLOSED` for an
-# `ENDED`/`RETIRED`:
-#   * the verb is one of those four;
-#   * the caller's seam read said 8 — this lane carries no managed-owner
-#     marker and no vocabulary of one — because a managed lane's lifecycle is
-#     the managed ledger's and an unknown one is nobody's to write;
-#   * a pre-image was taken before the line was written and the snapshot still
-#     matches it under the mutex.
-# A missing verdict or a missing pre-image is NOT a pass: it writes nothing,
-# because a caller that did not ask is not a caller that was told "legacy".
-lane_state_follow() {   # <lane> <verb> <payload> <uuid> <pre-image> <seam verdict>
-  lsf_lane="${1-}"; lsf_verb="${2-}"; lsf_pay="${3-}"; lsf_uuid="${4-}"; lsf_pre="${5-}"
-  lsf_seam="${6-}"
-  lsf_new=""
-  case "$lsf_verb" in
-    STARTED|RESUMED) lsf_new=RUNNING ;;
-    ENDED|RETIRED)   lsf_new=CLOSED ;;
-    *) return 0 ;;
-  esac
-  [ "$lsf_seam" = 8 ] || return 0
-  [ -n "$lsf_pre" ] || return 0
-  lsf_root=""; lsf_rc=0
-  lsf_root="$(lane_control_root "$lsf_lane" "$lsf_pay")" || lsf_rc=$?
-  [ "$lsf_rc" = 0 ] || return 0
-  lsf_f="$lsf_root/lane-state.yaml"
-  lsf_own=0
-  if [ "$LOCK_HELD" != 1 ]; then
-    if lock_try 20; then
-      lsf_own=1
-    else
-      note "the lane lifecycle snapshot for $lsf_lane was NOT moved to $lsf_new: $LOCK is held by another lanes-edit run and this follow-up will not wait behind an event that has already landed. The $lsf_verb line itself is written; the snapshot is one act behind until the next transition, and \`lanes-edit.sh lane-reconcile $lsf_lane\` says what it holds."
-      return 0
-    fi
-  fi
-  # A SNAPSHOT THIS HELPER CANNOT READ IS ONE IT MUST NOT REPLACE.
-  if ! lane_sidecar_schema_ok "$lsf_f"; then
-    if [ "$lsf_own" = 1 ]; then release_lock; fi
-    note "the lane lifecycle snapshot at $lsf_f is not a record this helper can read ($LSS_WHY), so the $lsf_verb line landed and NOTHING was written over that file: a record this helper cannot read is one it cannot safely replace. Upgrade this workstation's lanes-edit.sh if a newer tooling wrote it, or read the file by hand."
-    return 0
-  fi
-  lsf_seen="$(lane_state_fingerprint "$lsf_f")"
-  if [ "$lsf_seen" != "$lsf_pre" ]; then
-    if [ "$lsf_own" = 1 ]; then release_lock; fi
-    note "the lane lifecycle moved under this $lsf_verb: lane $lsf_lane read '$lsf_pre' (state/generation/operation) when this write began and reads '$lsf_seen' now, so the snapshot is LEFT AS IT IS and no $lsf_new was written over it. Another act got there first — a recovery, or a second handoff — and a delayed write is precisely what the generation exists to refuse. The $lsf_verb line itself landed: read the lane with \`lanes-edit.sh lane-reconcile $lsf_lane\` before relaunching anything."
-    return 0
-  fi
-  lsf_gen="$(lane_sidecar_field "$lsf_f" generation 2>/dev/null || :)"
-  case "$lsf_gen" in ''|*[!0-9]*) lsf_gen=0 ;; esac
-  lsf_gen=$((lsf_gen + 1))
-  lsf_agent="$(payload_subfield "$lsf_pay" agent)"
-  lsf_prof="$(payload_subfield "$lsf_pay" profile)"
-  if lane_state_put "$lsf_root" "$lsf_lane" "$lsf_new" "$lsf_gen" "$(lane_op_id)" \
-       "$lsf_uuid" "${lsf_agent:-}" "${lsf_prof:-}" "$WS" ""; then
-    if [ "$lsf_own" = 1 ]; then release_lock; fi
-    LANES_INDEX_NUDGE_INV=1     # opensoft/openRepoTools#161: the table follows it
-    return 0
-  fi
-  if [ "$lsf_own" = 1 ]; then release_lock; fi
-  note "the lane lifecycle snapshot at $lsf_f could NOT be written (the $lsf_verb line itself landed). Crash recovery for lane $lsf_lane is incomplete until it can be: see \`lanes-edit.sh lane-reconcile $lsf_lane\`"
-  return 0
-}
-
-# A RENAMED LANE KEEPS ITS LIFECYCLE (Amendment 16, openRepoTools#91). The
-# control root is keyed by the lane's NAME — `<parent>/.lane-state/<lane>` on
-# every rung — and `rename-lane` moves the row, the log, the handoff and the
-# alias table but knew nothing of this directory, so a renamed lane's snapshot
-# and inventory were left under a name every reader now resolves away from, and
-# its next reconciliation read `no-state`: the one answer a launcher goes past.
-# The directory is MOVED, never copied (two snapshots of one lane would be two
-# answers), only after the rename's commit returned 0, and never over anything
-# already at the new name, which is reported for a person rather than merged.
-# The diagnostic files' `lane:` line keeps the old name until the next write;
-# their readers do not key on it. Completed restart history is different: its
-# strict reader keys on the lane and its launch facts describe the old name.
-# Keep that history at the old root and move only the diagnostic files beside
-# it. The new canonical lane has no inherited restart operation.
-lane_state_rename() {   # <the old name's control root> <new lane>
-  lsn_old="${1-}"; lsn_new="${2-}"
-  [ -n "$lsn_old" ] && [ -n "$lsn_new" ] || return 0
-  [ -e "$lsn_old" ] || [ -L "$lsn_old" ] || return 0
-  lsn_to="${lsn_old%/*}/$lsn_new"
-  [ "$lsn_to" != "$lsn_old" ] || return 0
-  # A RENAME BY CASE ALONE is the same directory on a case-insensitive file
-  # system (macOS's default), where the target "exists" because it is the
-  # source; it goes through a temporary name so it lands on every file system.
-  if [ "$(lc "${lsn_old##*/}")" = "$(lc "$lsn_new")" ]; then
-    lsn_tmp="$lsn_old.rename.$$"
-    if mv -- "$lsn_old" "$lsn_tmp" 2>/dev/null && mv -- "$lsn_tmp" "$lsn_to" 2>/dev/null; then
-      LANES_INDEX_NUDGE_INV=1
-      note "the lane lifecycle snapshot and inventory moved with the rename: $lsn_old → $lsn_to"
-    else
-      note "the lane lifecycle snapshot and inventory could NOT be moved from $lsn_old to $lsn_to (the rename itself has landed). Move it by hand; until then \`lanes-edit.sh lane-reconcile $lsn_new\` reads no snapshot for this lane."
-    fi
-    return 0
-  fi
-  if [ -e "$lsn_to" ] || [ -L "$lsn_to" ]; then
-    note "the lane lifecycle snapshot and inventory were NOT moved: $lsn_old is the old name's and $lsn_to already exists for the new one, and two records of one lane are not merged here. Read both and keep one by hand; the rename itself has landed."
-    return 0
-  fi
-  if [ -e "$lsn_old/restart-intent.yaml" ] || [ -L "$lsn_old/restart-intent.yaml" ]; then
-    # rename-lane has already refused unfinished or unreadable restart records
-    # under the mutex. Preserve the completed record byte for byte, as before
-    # the diagnostic lifecycle was added; do not reinterpret it as a new lane.
-    if ! (umask 077; mkdir -- "$lsn_to") 2>/dev/null; then
-      note "the diagnostic control root could NOT be made at $lsn_to (the rename itself has landed). Completed restart history remains at $lsn_old."
-      return 0
-    fi
-    # The inventory moves here as well, even when only part of it does, so the
-    # worktrees table follows it (opensoft/openRepoTools#161). A sync with
-    # nothing changed writes nothing.
-    LANES_INDEX_NUDGE_INV=1
-    for lsn_part in lane-state.yaml trees; do
-      if [ -e "$lsn_old/$lsn_part" ] || [ -L "$lsn_old/$lsn_part" ]; then
-        if ! mv -- "$lsn_old/$lsn_part" "$lsn_to/$lsn_part" 2>/dev/null; then
-          note "the diagnostic $lsn_part could NOT be moved to $lsn_to (the rename itself has landed). Read both roots before reconciliation. Completed restart history remains at $lsn_old."
-          return 0
-        fi
-      fi
-    done
-    note "the lane lifecycle snapshot and inventory moved to $lsn_to; completed restart history remains at $lsn_old"
-    return 0
-  fi
-  if mv -- "$lsn_old" "$lsn_to" 2>/dev/null; then
-    LANES_INDEX_NUDGE_INV=1
-    note "the lane lifecycle snapshot and inventory moved with the rename: $lsn_old → $lsn_to"
-  else
-    note "the lane lifecycle snapshot and inventory could NOT be moved from $lsn_old to $lsn_to (the rename itself has landed). Move it by hand; until then \`lanes-edit.sh lane-reconcile $lsn_new\` reads no snapshot for this lane."
-  fi
-  return 0
-}
-
-# ------------------------------------------------- the worktree inventory
-#
-# A TREE ID IS DERIVED FROM ITS PATH AND FROM NOTHING ELSE, so that a branch
-# renamed under a writer does not rename the record of the tree it is on: a
-# `cksum` of the WHOLE absolute path, then the path with every character outside
-# the manifest-key set folded to `-`, which a reader recognises. The fold alone
-# is NOT one name per path (Codex on ec9847e, PR #97): `…/a+b` and `…/a-b` fold
-# to the same name, and recording the second would replace the first tree's
-# sidecar and lose its last observation without a word. The checksum in front
-# of EVERY id is what keeps two paths two records; the fold is for a person.
-tree_id_for() {   # <absolute worktree path>
-  tif_p="$(printf '%s' "${1-}" | tr -c 'A-Za-z0-9._-' '-' | tr -s '-')"
-  while [ "${tif_p#-}" != "$tif_p" ]; do tif_p="${tif_p#-}"; done
-  while [ "${tif_p%-}" != "$tif_p" ]; do tif_p="${tif_p%-}"; done
-  tif_c="$(printf '%s' "${1-}" | cksum | awk '{print $1}')"
-  # AND IT CAN NEVER OUTGROW A FILE NAME. A path deep enough to make this
-  # longer than the 255 bytes most filesystems take is a tree whose sidecar
-  # could not be created at all — silently, since the failure would be the
-  # shell's `>` and not this function's. The tail is what a reader recognises,
-  # so the head is what is dropped.
-  if [ "${#tif_p}" -gt 180 ]; then
-    tif_p="$(printf '%s' "$tif_p" | tail -c 180)"
-  fi
-  printf 'c%s-%s\n' "$tif_c" "$tif_p"
-}
-
-# ONE TREE'S SIDECAR. Every field is an OBSERVATION and none of them is truth
-# about git: `lane-reconcile` recomputes all of them and reports the
-# difference, which is the whole of design decision 6.
-lane_tree_put() {   # <root> <lane> <path> <checkout> <branch> <head> <upstream> <dirty> <unpushed> <writer> <gen> <op>
-  ltp_root="$1"; ltp_lane="$2"; ltp_path="$3"; ltp_co="$4"; ltp_branch="$5"
-  ltp_head="$6"; ltp_up="$7"; ltp_dirty="$8"; ltp_unp="$9"; shift 9
-  ltp_writer="${1-}"; ltp_gen="${2-}"; ltp_op="${3-}"
-  ltp_id="$(tree_id_for "$ltp_path")"
-  [ -n "$ltp_id" ] || return 1
-  { printf 'schema: %s\n'    "$LANE_STATE_SCHEMA"
-    printf 'lane: %s\n'      "$(lane_sidecar_value "$ltp_lane")"
-    printf 'tree: %s\n'      "$ltp_id"
-    printf 'path: %s\n'      "$(lane_sidecar_value "$ltp_path")"
-    printf 'checkout: %s\n'  "$(lane_sidecar_value "${ltp_co:-unknown}")"
-    printf 'branch: %s\n'    "$(lane_sidecar_value "${ltp_branch:-unknown}")"
-    printf 'head: %s\n'      "$(lane_sidecar_value "${ltp_head:-unknown}")"
-    printf 'upstream: %s\n'  "$(lane_sidecar_value "${ltp_up:-none}")"
-    printf 'dirty: %s\n'     "${ltp_dirty:-0}"
-    printf 'unpushed: %s\n'  "${ltp_unp:-0}"
-    printf 'writer: %s\n'    "${ltp_writer:-none}"
-    printf 'generation: %s\n' "${ltp_gen:-0}"
-    printf 'operation: %s\n' "${ltp_op:-none}"
-    printf 'observed: %s\n'  "$(utc_now)"
-  } | lane_sidecar_put "$ltp_root/trees/$ltp_id.yaml"
-}
-
-# EVERY RECORDED TREE, ONE PER LINE, US-separated:
-#   <id><US><path><US><branch><US><head><US><upstream><US><dirty><US><unpushed><US><writer><US><observed><US><checkout><US><generation><US><operation><US><schema>
-# 0 with rows, 8 with none, 1 where no control root could be derived, 10 where
-# the `trees` directory is there and cannot be listed.
-#
-# THAT 10 IS NOT AN 8 (#157 item 4e). A directory this process may not read or
-# search yields an empty glob, which read as a lane that recorded no tree — the
-# unreadable sidecar's rule above, one level up. `worktree_rows` already tells
-# the two apart before it asks; `lane-trees` and its callers now can too.
-#
-# THE LAST THREE ARE NEW AND THEY ARE AT THE END (Copilot round 5 on
-# openRepoTools#97): the fence the observation was RECORDED UNDER, and the
-# schema the sidecar itself carries. A reader written against the ten fields
-# that were here first still reads those ten. The fence is here because it was
-# written into the file and read by nothing — so a poll filed by an operation a
-# recovery has since superseded looked exactly like the current one.
-#
-# AND A SIDECAR THIS READER DOES NOT KNOW IS SAID, NEVER PARSED. Until this
-# round every `*.yaml` under `trees/` was read field by field whatever it
-# claimed to be, which is the fail-closed contract `lane_state_read` keeps for
-# the snapshot broken for the inventory beside it: a record written by a newer
-# tooling would have been reported as an ordinary observation of a tree, in
-# fields this reader was guessing at. Its id, its path and its schema are
-# printed — the three a person needs to find it — and every other field is
-# EMPTY, which `lane_reconcile` reports as `unknown-schema` rather than
-# recomputing against. A record of THIS schema that is not a whole one is the
-# same row with the schema `<malformed>` (#115), and `lane_reconcile` reports
-# it as `malformed-sidecar`.
-#
-# An optional payload carrying the lane's `dir` is `lane_control_root`'s, as
-# `lane_state_read` takes it (review r2 of #289, SHOULD-A).
-lane_trees_list() {   # <lane> [<a payload that may carry `dir`>]
-  ltl_root=""; ltl_rc=0; ltl_n=0
-  ltl_root="$(lane_control_root "${1-}" "${2-}")" || ltl_rc=$?
-  [ "$ltl_rc" = 0 ] || return 1
-  [ -d "$ltl_root/trees" ] || return 8
-  [ -r "$ltl_root/trees" ] && [ -x "$ltl_root/trees" ] || return 10
-  for ltl_f in "$ltl_root"/trees/*.yaml; do
-    [ -e "$ltl_f" ] || [ -L "$ltl_f" ] || continue
-    ltl_n=$((ltl_n + 1))
-    # A SIDECAR THAT IS THERE AND CANNOT BE READ IS NOT AN ABSENT ONE (Codex on
-    # ec9847e, PR #97). It was skipped, so a permission or an I/O error — or a
-    # dangling link — made the only record of a tree's location and its dirty
-    # state vanish, and a lane whose one sidecar it was read as having no
-    # inventory at all. It is a row of its own, named by its file and carrying
-    # no field, which `lane_reconcile` reports as `unreadable-sidecar`.
-    if [ ! -r "$ltl_f" ]; then
-      ltl_id="${ltl_f##*/}"; ltl_id="${ltl_id%.yaml}"
-      printf '%s\n' "$ltl_id$US$US$US$US$US$US$US$US$US$US$US$US<unreadable>"
-      continue
-    fi
-    ltl_s="$(lane_sidecar_field "$ltl_f" schema 2>/dev/null || :)"
-    ltl_id="$(lane_sidecar_field "$ltl_f" tree 2>/dev/null || :)"
-    ltl_p="$(lane_sidecar_field "$ltl_f" path 2>/dev/null || :)"
-    if [ "$ltl_s" != "$LANE_STATE_SCHEMA" ]; then
-      # The file name is the id where the record cannot be trusted to name it:
-      # a row with no id at all is one `lane_reconcile` skips, and a sidecar
-      # nobody can account for is the opposite of what this round is about.
-      [ -n "$ltl_id" ] || { ltl_id="${ltl_f##*/}"; ltl_id="${ltl_id%.yaml}"; }
-      printf '%s\n' "$ltl_id$US$ltl_p$US$US$US$US$US$US$US$US$US$US$US${ltl_s:-<none>}"
-      continue
-    fi
-    # AND A RECORD OF THIS SCHEMA THAT IS NOT A WHOLE ONE IS SAID, NEVER READ
-    # (#115). A truncated `schema: 1` file came out as a row of empty fields —
-    # an EMPTY ID, which `lane_reconcile` skipped outright, and an empty dirty
-    # and unpushed, which it read as 0 and 0: a vanished tree that held work
-    # reported `missing`, clean and published. Its id is its FILE NAME, because
-    # the one it claims is not to be trusted, the path it records is kept so
-    # the tree is still named once, and every other field is empty under the
-    # schema `<malformed>`.
-    if ! lane_sidecar_schema_ok "$ltl_f"; then
-      ltl_id="${ltl_f##*/}"; ltl_id="${ltl_id%.yaml}"
-      printf '%s\n' "$ltl_id$US$ltl_p$US$US$US$US$US$US$US$US$US$US$US<malformed>"
-      continue
-    fi
-    printf '%s\n' "$ltl_id$US$ltl_p\
-$US$(lane_sidecar_field "$ltl_f" branch)\
-$US$(lane_sidecar_field "$ltl_f" head)\
-$US$(lane_sidecar_field "$ltl_f" upstream)\
-$US$(lane_sidecar_field "$ltl_f" dirty)\
-$US$(lane_sidecar_field "$ltl_f" unpushed)\
-$US$(lane_sidecar_field "$ltl_f" writer)\
-$US$(lane_sidecar_field "$ltl_f" observed)\
-$US$(lane_sidecar_field "$ltl_f" checkout)\
-$US$(lane_sidecar_field "$ltl_f" generation)\
-$US$(lane_sidecar_field "$ltl_f" operation)\
-$US$ltl_s"
-  done
-  [ "$ltl_n" -gt 0 ] || return 8
-  return 0
-}
-
-# ------------------------------------------------ resume-time reconciliation
-#
-# IT REPORTS AND IT RESETS NOTHING. AGENTS.md rule 1 is the estate's: *"`park`
-# CREATES NOTHING and `resume` RESETS NOTHING"*, and never a `git reset`, a
-# `git stash`, a `git checkout -f` or a `worktree add --force` to make the next
-# run succeed. So this read runs `git status`, `git log @{u}..`, `git rev-parse`
-# and `git worktree list --porcelain` and NOTHING ELSE, names the act a person
-# takes, and leaves every tree exactly as it found it — a missing tree included,
-# whose rebuild is the estate's own `resume <Name>` and is a person's to run.
-
-# ONE PATH, ONE SPELLING — the physical one, or the path itself where it cannot
-# be resolved (a path that is gone still has to be comparable).
-#
-# THE REPORT READS THREE SOURCES AND THEY DO NOT AGREE ABOUT SPELLING. A sidecar
-# holds the path the poll was given, `git worktree list --porcelain` answers with
-# the PHYSICAL path, and the on-disk sweep walks the recorded `dir`. Every estate
-# with a `projects` symlink reaches its checkouts through it — and on macOS
-# `$TMPDIR` and `$HOME` are under `/var`, which IS a symlink to `/private/var`,
-# which is how four cases of this section went red on that runner alone at
-# `612ba5c` (`expected [dirty], got [dirty unmanaged]`): every tree was reported
-# TWICE, once as the tree it is and once as a tree nobody manages. `612ba5c`
-# resolved the lane's OWN checkout for exactly this reason and left the trees
-# under it unresolved. `cd -P` is the portable resolver, for the reason
-# `lane-start`'s `real_of` gives: `readlink -f` is not in the stock macOS
-# userland.
-lane_real_path() {   # <path>
-  lrp_p="${1-}"
-  [ -n "$lrp_p" ] || return 0
-  lrp_r="$( CDPATH=''; cd -P -- "$lrp_p" 2>/dev/null && pwd -P )" || lrp_r=""
-  printf '%s\n' "${lrp_r:-$lrp_p}"
-}
-
-# THE LANE'S TWO WORKTREE ROOTS — the same two `lane-handoff` polls, and they
-# are here rather than there so the poll and the reconciliation cannot come to
-# disagree about where a lane keeps its writers. Where the lane's checkout is an
-# ASSEMBLY (T018) both also read its paired root, `<assembly>/worktrees/
-# <feature>/<each leg's path>`, which is two levels deep and per feature, so it
-# is read beside these two (`lane_reconcile`, step 4) rather than as a third.
-lane_worktree_roots() {   # <lane> <the lane's checkout>
-  lwr_lane="${1-}"; lwr_dir="${2-}"
-  [ -n "$lwr_dir" ] || return 0
-  printf '%s/.claude/worktrees\n' "$lwr_dir"
-  printf '%s/.lane-worktrees/%s\n' "${lwr_dir%/*}" "$lwr_lane"
-  return 0
-}
-
-# What git says about one tree, NOW —
-# `<branch><US><head><US><upstream><US><dirty><US><unpushed>` — and it is the ONE
-# implementation of that sentence: `lane-reconcile` recomputes with it,
-# `set-lane-tree` records through it and `lane-handoff` polls its writers with
-# it, over the `lane-tree-now` arm below, so the WRITERS section a person reads
-# and the sidecar a recovery reads can never be two different readings.
-#
-#   0  the five fields
-#   1  there is no directory at that path
-#   2  the path is there and git does not answer in it at all
-#   3  GIT ANSWERED AND ONE OF THE READS FAILED, and NOTHING is printed
-#
-# THE 3 IS THE WHOLE POINT OF THIS ROUND (Copilot round 5 on openRepoTools#97).
-# Every read below used to end in `|| printf 'unknown'`, `|| printf 'none'` or
-# an empty count that became `0` — so a repository whose object store is
-# unreadable, whose index is locked or whose HEAD is corrupt produced a RECORD
-# THAT LOOKED CLEAN AND PUBLISHED, and a later reconciliation comparing against
-# it would call a tree holding work `missing` rather than `possible-loss`. A
-# read that failed is never an answer (R22, Amendment 7(d)), so it is no longer
-# converted into one: the caller is told the observation could not be made.
-#
-# TWO THINGS ARE ANSWERS AND NOT FAILURES, and they are named rather than
-# guessed. A branch with NO COMMIT YET has `unborn` for a head — HEAD is a
-# symbolic ref to a branch that does not exist, which is an ordinary state and
-# not a broken repository. And a branch with NO UPSTREAM CONFIGURED has `none`,
-# which is exactly the distinction the inventory records an upstream for. A
-# branch whose upstream IS configured and whose remote-tracking ref is not here
-# — the ordinary state of a branch whose remote was deleted after its merge — is
-# the third: the configured spelling is recorded, and the count against a ref
-# this checkout does not have is `unknown` rather than the `0` that reads as
-# *everything is published*.
-lane_tree_now() {   # <path>
-  ltn_p="${1-}"
-  [ -d "$ltn_p" ] || return 1
-  git -C "$ltn_p" rev-parse --git-dir >/dev/null 2>&1 || return 2
-  ltn_raw=""; ltn_b=""; ltn_h=""; ltn_u=none; ltn_d=""; ltn_n=0
-  ltn_s=""; ltn_up=""; ltn_cfg=""; ltn_rem=""; ltn_crc=0
-  # THE BRANCH, AND THE UNBORN ONE `rev-parse` CANNOT ANSWER FOR. A branch with
-  # no commit yet is HEAD as a symbolic ref to a ref that does not exist, which
-  # `rev-parse --abbrev-ref` refuses exactly as it refuses a corrupt HEAD —
-  # `symbolic-ref` is what tells the two apart, and it is asked only where the
-  # first read failed, so an ordinary tree costs one git process as before.
-  if ltn_raw="$(git -C "$ltn_p" rev-parse --abbrev-ref HEAD 2>/dev/null)" && [ -n "$ltn_raw" ]; then
-    :
-  elif ltn_raw="$(git -C "$ltn_p" symbolic-ref --short -q HEAD 2>/dev/null)" && [ -n "$ltn_raw" ]; then
-    :
-  else
-    return 3
-  fi
-  ltn_b="$ltn_raw"; [ "$ltn_b" = HEAD ] && ltn_b=detached
-  if ltn_h="$(git -C "$ltn_p" rev-parse --verify --quiet HEAD 2>/dev/null)"; then
-    [ -n "$ltn_h" ] || return 3
-  elif git -C "$ltn_p" symbolic-ref -q HEAD >/dev/null 2>&1; then
-    ltn_h=unborn
-  else
-    return 3
-  fi
-  ltn_s="$(git -C "$ltn_p" status --short 2>/dev/null)" || return 3
-  ltn_d="$(printf '%s\n' "$ltn_s" | awk 'NF { n = n + 1 } END { print n + 0 }')"
-  if ltn_up="$(git -C "$ltn_p" rev-parse --abbrev-ref '@{u}' 2>/dev/null)" && [ -n "$ltn_up" ]; then
-    ltn_u="$ltn_up"
-    ltn_n="$(git -C "$ltn_p" rev-list --count '@{u}..HEAD' 2>/dev/null)" || return 3
-    case "$ltn_n" in ''|*[!0-9]*) return 3 ;; esac
-  elif [ "$ltn_b" != detached ]; then
-    # `git config --get` is 0 for found and 1 for NOT FOUND; anything else is
-    # the read itself failing, and that is a 3 like any other.
-    ltn_cfg="$(git -C "$ltn_p" config --get "branch.$ltn_raw.merge" 2>/dev/null)" || ltn_crc=$?
-    case "$ltn_crc" in 0|1) : ;; *) return 3 ;; esac
-    if [ -n "$ltn_cfg" ]; then
-      # AND THE REMOTE BESIDE IT IS ASKED THE SAME WAY (opensoft/openRepoTools
-      # #113 item 3). It ended in `|| :`, so a read that FAILED became an empty
-      # remote and `${ltn_rem:-.}` then FABRICATED the local upstream
-      # `./<merge>`, which was filed as an observation. Only a remote that is
-      # NOT CONFIGURED (1) keeps the `.` this read has always written for it.
-      ltn_rrc=0
-      ltn_rem="$(git -C "$ltn_p" config --get "branch.$ltn_raw.remote" 2>/dev/null)" || ltn_rrc=$?
-      case "$ltn_rrc" in 0|1) : ;; *) return 3 ;; esac
-      ltn_u="${ltn_rem:-.}/${ltn_cfg#refs/heads/}"
-      ltn_n=unknown
-    fi
-  fi
-  printf '%s%s%s%s%s%s%s%s%s\n' "$ltn_b" "$US" "$ltn_h" "$US" "${ltn_u:-none}" "$US" \
-    "${ltn_d:-0}" "$US" "$ltn_n"
-  return 0
-}
-
-# NO REPOSITORY AT ALL IS AN ABSENCE, and nothing else is: `lane-worktrees`'
-# `no_repository`, the rule #170 G5 settled, so the two readers of one lane's
-# checkout cannot disagree about it. A directory with a `.git` of its own IS a
-# repository however broken — git answers "not a git repository" for a gitdir
-# it cannot read too — and only git's own "not a git repository" for a
-# directory with none is the answer "there is nothing registered here". That
-# message is read in the C locale, as `lane-worktrees`' `git_env` reads it: a
-# translated git would otherwise say it in words this match never finds, and the
-# two readers would disagree (review r1 of #252).
-lane_no_repository() {   # <dir>
-  lnr_d="${1-}"; lnr_err=""
-  if [ -e "$lnr_d/.git" ] || [ -L "$lnr_d/.git" ]; then return 1; fi
-  if lnr_err="$(LC_ALL=C git -C "$lnr_d" rev-parse --git-dir 2>&1 >/dev/null </dev/null)"; then return 1; fi
-  case "$(printf '%s' "$lnr_err" | tr '[:upper:]' '[:lower:]')" in
-    *"not a git repository"*) return 0 ;;
-  esac
-  return 1
-}
-
-lane_reconcile() {   # <lane>
-  lrc_lane="${1-}"
-  # 0. THE SEAM (ruling 2026-10-04): a managed-owned lane's lifecycle is the
-  # managed ledger's, so this legacy reconciliation reads nothing of it and
-  # pronounces nothing on it — no crash, no clearance, no closure. A lane whose
-  # ownership could not be read gets the same silence, as `indeterminate`.
-  lrc_mrc=0; lrc_mown=""
-  lrc_mown="$(lane_is_managed_owned "$lrc_lane")" || lrc_mrc=$?
-  case "$lrc_mrc" in
-    0)
-      printf 'MANAGED%s%s\n' "$US" "${lrc_mown:-unnamed}"
-      printf 'VERDICT%smanaged-owned%slane %s is owned by the managed ledger (owner %s): its lifecycle and its worktrees are that ledger'"'"'s, and this legacy reconciliation pronounces nothing on them (ruling 2026-10-04: "managed ledger owns enrolled lanes; #97 owns legacy")\n' \
-        "$US" "$US" "$lrc_lane" "${lrc_mown:-unnamed}"
-      return 0 ;;
-    8) : ;;
-    *)
-      printf 'MANAGED%sunknown\n' "$US"
-      printf 'VERDICT%sindeterminate%swhether the managed ledger owns lane %s is UNKNOWN — its register row carries managed-owner vocabulary that does not parse, or the register could not be read — so nothing is pronounced on it (Amendment 7(d)). Read it: lanes-edit.sh managed-projection %s\n' \
-        "$US" "$US" "$lrc_lane" "$lrc_lane"
-      return 0 ;;
-  esac
-  lrc_root=""; lrc_rc=0
-  lrc_root="$(lane_control_root "$lrc_lane")" || lrc_rc=$?
-  if [ "$lrc_rc" != 0 ]; then
-    note "lane $lrc_lane has no control root: its record names no directory (Amendment 11(c)) and \$PROJECTS_ROOT is not a directory here, so there is nothing to reconcile against. This is the pre-cutover answer, not a failure — the lane's next start or handoff creates one."
-    return 8
-  fi
-
-  # 1. THE SNAPSHOT.
-  lrc_state=""; lrc_gen=""; lrc_op=""; lrc_owner=""; lrc_upd=""
-  lrc_snap=""; lrc_srrc=0
-  lrc_snap="$(lane_state_read "$lrc_lane")" || lrc_srrc=$?
-  if [ "$lrc_srrc" = 0 ]; then
-    lrc_state="$(printf '%s\n' "$lrc_snap" | awk -F'\t' '$1 == "state" { print $2; exit }')"
-    lrc_gen="$(printf '%s\n' "$lrc_snap"   | awk -F'\t' '$1 == "generation" { print $2; exit }')"
-    lrc_op="$(printf '%s\n' "$lrc_snap"    | awk -F'\t' '$1 == "operation" { print $2; exit }')"
-    lrc_owner="$(printf '%s\n' "$lrc_snap" | awk -F'\t' '$1 == "owner" { print $2; exit }')"
-    lrc_upd="$(printf '%s\n' "$lrc_snap"   | awk -F'\t' '$1 == "updated" { print $2; exit }')"
-  elif [ "$lrc_srrc" = 8 ]; then
-    lrc_state=NONE
-  else
-    # A SNAPSHOT THAT IS THERE AND COULD NOT BE READ IS NOT A LANE THAT HAS
-    # NONE (Copilot round 6 on openRepoTools#97). Every non-zero read used to
-    # land on `NONE` here, and `NONE` is the verdict `no-state` — *this lane
-    # never started under this capability, there is nothing to recover* — which
-    # a launcher answers by going straight on. That is fail-OPEN on a crash
-    # pronouncement, the one class this capability exists to close. A read
-    # nobody got is `indeterminate` below, exactly as an unreadable HOLDER is.
-    lrc_state=UNREADABLE
-    # AND ONE THAT OPENS AND IS NOT A WHOLE RECORD IS SAID AS SUCH (#115). It
-    # used to come out as fields that were EMPTY, and its empty state word was
-    # `unknown-state` by the `*)` arm below — failing safe by accident rather
-    # than by a check. The 10 is the same; the word says which of the two.
-    lrc_swhy=""
-    if [ "$lrc_srrc" = 10 ] && [ -r "$lrc_root/lane-state.yaml" ] \
-       && ! lane_sidecar_schema_ok "$lrc_root/lane-state.yaml"; then
-      lrc_state=MALFORMED; lrc_swhy="$LSS_WHY"
-    fi
-  fi
-  printf 'ROOT%s%s\n' "$US" "$lrc_root"
-  printf 'STATE%s%s%sgeneration %s%soperation %s%sowner %s%supdated %s\n' \
-    "$US" "$lrc_state" "$US" "${lrc_gen:-0}" "$US" "${lrc_op:-none}" "$US" \
-    "${lrc_owner:-none}" "$US" "${lrc_upd:-never}"
-
-  # 2. THE HOLDER. `live_holder`'s three answers are the contract every other
-  # caller here reads: 0 a holder, 8 none, anything else THE RECORDS COULD NOT
-  # BE READ — which is never "no holder" (R22, Amendment 7(d)). A holder that
-  # could not be established fails CLOSED: the verdict is `indeterminate` and
-  # no crash is pronounced on a read nobody got.
-  # AND THE SAME DISTINCTION ONE READ EARLIER (#113 item 1): the ids the row
-  # records. Both reads ended in `|| :`, so a register nobody could read came
-  # out as an EMPTY id set, `live_holder` answered 8 for it — this lane records
-  # no session, nothing can be live — and a crash was pronounced on a liveness
-  # question nobody answered. `session_ids_checked` is #67's read of the same
-  # published-union-local ids, and it tells the two apart: 8, no row or a row
-  # naming no session, goes on to `live_holder` exactly as before; 1, either
-  # copy of the register unread, never reaches it.
-  lrc_ids=""; lrc_irc=0; lrc_hwhy=""
-  lrc_ids="$(session_ids_checked "$lrc_lane")" || lrc_irc=$?
-  lrc_hold=""; lrc_hrc=0
-  if [ "$lrc_irc" != 0 ] && [ "$lrc_irc" != 8 ]; then
-    lrc_hrc=1
-    lrc_hwhy="lane $lrc_lane's register row could not be read — the published register, or this checkout's copy of it at $LANES_FILE — so which sessions it records is NOT established, and an id set nobody read is never an empty one"
-  else
-    lrc_hold="$(live_holder "$lrc_lane" "$lrc_ids" 2>/dev/null)" || lrc_hrc=$?
-  fi
-  case "$lrc_hrc" in
-    0) printf 'HOLDER%slive%s%s\n' "$US" "$US" "$(printf '%s' "$lrc_hold" | tr "$US" ' ')" ;;
-    8) printf 'HOLDER%snone\n' "$US" ;;
-    *) printf 'HOLDER%sunknown%s%s\n' "$US" "$US" "${lrc_hwhy:-${SESSION_FILES_ERR:-the session records of this workstation could not be read}}" ;;
-  esac
-
-  # 2b. THE BINDING (Amendment 18(b)): *"Liveness is pronounced only from
-  # INSIDE the binding's own `host` and `container`, where the pid namespace is
-  # the record's: from anywhere else a binding is UNKNOWN, never dead."* The
-  # holder read above is THIS workstation's session records, so it says nothing
-  # about a lane whose last STARTED/RESUMED was written on another host or in
-  # another container — and this workstation's snapshot is this workstation's
-  # alone (design decision 10). Read through the same scan and the same
-  # locality rule `binding` and `holder_is_dead` use, with clause (b)'s one
-  # exception: a binding whose window is GONE from a shared tmux server is a
-  # dead binding, and then the local read above decides, as it does there.
-  #   here       the binding is this place's, or the lane's lines predate it
-  #   free       no binding is open (released, or never started)
-  #   gone       bound elsewhere on this host's tmux, and its window is gone
-  #   elsewhere  bound in a place this one cannot pronounce on
-  #   unknown    the object log could not be read for it (Amendment 7(d))
-  lrc_bwhere=free; lrc_bat=""
-  lrc_bout=""; lrc_brc=0
-  lrc_bout="$(lane_binding_scan "$lrc_lane")" || lrc_brc=$?
-  if [ "$lrc_brc" != 0 ]; then
-    lrc_bwhere=unknown
-  else
-    IFS="$US" read -r lrc_bst lrc_bhost lrc_bcont lrc_bwin lrc_butc lrc_bsess lrc_bos \
-      lrc_brutc lrc_brsess lrc_brpay lrc_bxverb lrc_bxutc lrc_bxsess lrc_bxpay lrc_blegacy \
-      lrc_bfverb lrc_bfutc lrc_bfsess lrc_bfpay <<LRC_BIND
-$lrc_bout
-LRC_BIND
-    case "$lrc_bst" in
-      bound|requested)
-        lrc_bat="${lrc_bhost:-unknown}/${lrc_bcont:-none}"
-        if binding_is_here "$lrc_bhost" "$lrc_bcont" "$lrc_blegacy"; then
-          lrc_bwhere=here
-        elif [ "$(binding_window_state "$lrc_bhost" "$lrc_bwin" "$lrc_blegacy")" = gone ]; then
-          lrc_bwhere=gone
-        else
-          lrc_bwhere=elsewhere
-        fi ;;
-    esac
-  fi
-  printf 'BINDING%s%s%s%s\n' "$US" "$lrc_bwhere" "$US" "${lrc_bat:-none}"
-
-  # 3. THE TREES — the inventory, recomputed. A stored value is a COMPARISON
-  # POINT and never current truth.
-  # THE COORDINATOR DIRECTORY, AND A LOG NOBODY COULD READ IS NOT A LANE WITH
-  # NONE (Copilot on 64dfd97, PR #97). `lane_payload_field` answers 8 for a log
-  # that carries no `dir` and 1 for a log that could not be read; collapsed into
-  # one empty string, the second skipped both sweeps below — the registrations
-  # `git worktree list` holds and the trees on disk — and a SWAPPED lane with no
-  # holder then read as resumable over paths nobody inspected. The 1 is kept,
-  # and the verdict below is `indeterminate` for it.
-  lrc_dir=""; lrc_drc=0
-  lrc_dir="$(lane_payload_field "$lrc_lane" dir 2>/dev/null)" || lrc_drc=$?
-  [ "$lrc_drc" = 0 ] || lrc_dir=""
-  lrc_seen=""; lrc_n=0; lrc_recover=0; lrc_dirty=0
-  # AN INVENTORY NOBODY COULD LIST IS NOT AN EMPTY ONE (#113, the unreadable
-  # sidecar's rule one level up). `lane_trees_list` answers 10 for a `trees`
-  # directory that is there and cannot be listed (#157 item 4e), and this read
-  # ended in `|| :`, so every tree the lane recorded vanished from the report and
-  # its verdict could still be `resumable`. `lrc_unread` gathers what the
-  # inventory and the sweeps below could not read, and the verdict says so.
-  lrc_unread=""; lrc_tl=""; lrc_tlrc=0
-  lrc_tl="$(lane_trees_list "$lrc_lane" 2>/dev/null)" || lrc_tlrc=$?
-  case "$lrc_tlrc" in
-    0|8) : ;;
-    10) lrc_unread="its worktree inventory directory $lrc_root/trees is there and could not be listed" ;;
-    *)  lrc_unread="its worktree inventory could not be read (exit $lrc_tlrc)" ;;
-  esac
-  while IFS="$US" read -r lrc_id lrc_p lrc_b lrc_h lrc_u lrc_d lrc_np lrc_w lrc_ob lrc_co lrc_tg lrc_to lrc_sch; do
-    [ -n "${lrc_id:-}" ] || continue
-    lrc_n=$((lrc_n + 1))
-    # BOTH SPELLINGS JOIN THE SEEN SET, because the two sweeps below compare
-    # against it with git's physical answer and with the recorded `dir`'s own,
-    # and a tree named under one spelling and skipped under neither is a tree
-    # reported twice.
-    [ -n "${lrc_p:-}" ] && lrc_seen="$lrc_seen $lrc_p $(lane_real_path "$lrc_p") "
-    # A SIDECAR THIS READER DOES NOT KNOW IS REPORTED AND NEVER RECOMPUTED
-    # AGAINST. `lane_trees_list` empties every field of one, because a value
-    # read out of a record whose shape this reader is guessing at is worse than
-    # no value: comparing git's answer to it would print a difference that means
-    # nothing. It counts as wanting recovery, because a person has to say what
-    # wrote it.
-    if [ "${lrc_sch:-}" = "<unreadable>" ]; then
-      printf 'TREE%s%s%sunreadable-sidecar%s%s%sits sidecar is there and could not be read, so the tree it records — where it is, and whether it held uncommitted or unpublished work — is NOT known, and nothing is assumed about it; read %s/trees/%s.yaml by hand before relaunching a writer\n' \
-        "$US" "$lrc_id" "$US" "$US" "<no path read>" "$US" "$lrc_root" "$lrc_id"
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    # A RECORD OF THIS SCHEMA THAT IS NOT A WHOLE ONE (#115) is reported as the
-    # unreadable one is: nothing is read out of it, it counts toward recovery,
-    # and the line says what is missing from it and names the file.
-    if [ "${lrc_sch:-}" = "<malformed>" ]; then
-      lrc_mwhy="the record could not be read again to say why"
-      if lane_sidecar_schema_ok "$lrc_root/trees/$lrc_id.yaml"; then :; else lrc_mwhy="$LSS_WHY"; fi
-      printf 'TREE%s%s%smalformed-sidecar%s%s%sits sidecar is of this schema and %s, so the tree it records — where it is, and whether it held uncommitted or unpublished work — is NOT known, nothing is assumed about it, and no writer replaces it; read %s/trees/%s.yaml by hand before relaunching a writer\n' \
-        "$US" "$lrc_id" "$US" "$US" "${lrc_p:-<no path read>}" "$US" "$lrc_mwhy" "$lrc_root" "$lrc_id"
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    if [ "${lrc_sch:-}" != "$LANE_STATE_SCHEMA" ]; then
-      printf 'TREE%s%s%sunknown-schema%s%s%sits sidecar records schema %s and this reader writes %s, so none of its fields is read and nothing is compared against them; the tree itself is untouched\n' \
-        "$US" "$lrc_id" "$US" "$US" "${lrc_p:-<no path recorded>}" "$US" "${lrc_sch:-<none>}" "$LANE_STATE_SCHEMA"
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    lrc_now=""; lrc_nrc=0
-    lrc_now="$(lane_tree_now "$lrc_p")" || lrc_nrc=$?
-    if [ "$lrc_nrc" = 3 ]; then
-      # GIT ANSWERS THERE AND ONE OF ITS READS FAILED. Nothing is assumed: not
-      # clean, not dirty, not published. The tree is left exactly as it is and
-      # the person is sent to it.
-      printf 'TREE%s%s%sunreadable%s%s%sgit answers in this path and one of the reads an observation is made of failed, so NOTHING is assumed about it — it was branch %s head %s with %s dirty and %s unpushed at %s; read it by hand (git -C %s status) before relaunching a writer onto it\n' \
-        "$US" "$lrc_id" "$US" "$US" "$lrc_p" "$US" "$lrc_b" "$lrc_h" "${lrc_d:-0}" "${lrc_np:-0}" "$lrc_ob" "$lrc_p"
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    if [ "$lrc_nrc" = 1 ]; then
-      # THE PATH IS GONE. Whether that is a tidy removal or a loss is decided
-      # by what the sidecar last SAW there, and metadata can reconstruct no
-      # file's contents: a tree that held uncommitted or unpublished work is
-      # POSSIBLE LOSS and is never claimed to be rebuildable.
-      case "${lrc_d:-0}${lrc_np:-0}" in
-        00) printf 'TREE%s%s%smissing%s%s%swas branch %s head %s; clean and published at %s; the estate parked record and `resume <Name>` are the only rebuild\n' \
-              "$US" "$lrc_id" "$US" "$US" "$lrc_p" "$US" "$lrc_b" "$lrc_h" "$lrc_ob" ;;
-        *)  printf 'TREE%s%s%spossible-loss%s%s%swas branch %s head %s with %s dirty and %s unpushed at %s; NOTHING here can reconstruct uncommitted files — do not recreate this path\n' \
-              "$US" "$lrc_id" "$US" "$US" "$lrc_p" "$US" "$lrc_b" "$lrc_h" "$lrc_d" "$lrc_np" "$lrc_ob" ;;
-      esac
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    if [ "$lrc_nrc" = 2 ]; then
-      printf 'TREE%s%s%snot-a-checkout%s%s%sthe path exists and git does not answer in it; it is left exactly as it is\n' \
-        "$US" "$lrc_id" "$US" "$US" "$lrc_p" "$US"
-      lrc_recover=$((lrc_recover + 1))
-      continue
-    fi
-    lrc_nb="$(printf '%s' "$lrc_now" | awk -F"$US" '{print $1}')"
-    lrc_nh="$(printf '%s' "$lrc_now" | awk -F"$US" '{print $2}')"
-    lrc_nu="$(printf '%s' "$lrc_now" | awk -F"$US" '{print $3}')"
-    lrc_nd="$(printf '%s' "$lrc_now" | awk -F"$US" '{print $4}')"
-    lrc_nn="$(printf '%s' "$lrc_now" | awk -F"$US" '{print $5}')"
-    lrc_class=ok
-    [ "${lrc_nd:-0}" -gt 0 ] && lrc_class=dirty
-    # `unpushed` IS A COUNT OR IT IS THE WORD `unknown`, and the word is what a
-    # branch whose configured upstream is not in this checkout answers. It is
-    # never compared as a number, and it counts as work that may not be
-    # published rather than as nothing to publish.
-    case "${lrc_nn:-0}" in
-      ''|0) : ;;
-      *[!0-9]*)
-        if [ "$lrc_class" = dirty ]; then lrc_class=dirty+unpushed-unknown; else lrc_class=unpushed-unknown; fi ;;
-      *)
-        if [ "$lrc_class" = dirty ]; then lrc_class=dirty+unpushed; else lrc_class=unpushed; fi ;;
-    esac
-    [ "$lrc_class" = ok ] || lrc_dirty=$((lrc_dirty + 1))
-    lrc_moved=""
-    [ "$lrc_nb" = "$lrc_b" ] || lrc_moved="$lrc_moved; branch was $lrc_b and is $lrc_nb"
-    [ "$lrc_nh" = "$lrc_h" ] || lrc_moved="$lrc_moved; head was $lrc_h and is $lrc_nh"
-    [ "${lrc_nu:-none}" = "${lrc_u:-none}" ] || lrc_moved="$lrc_moved; upstream was ${lrc_u:-none} and is ${lrc_nu:-none}"
-    # AND WHICH TRANSITION TOOK THE OBSERVATION, where it is not this lane's
-    # current one. The pair was written into every sidecar and read by nothing
-    # until this round, so a poll filed by an operation a recovery has since
-    # superseded read exactly like the current one.
-    if [ -n "${lrc_tg:-}" ] && [ "$lrc_tg" != 0 ] && [ "$lrc_tg" != "${lrc_gen:-0}" ]; then
-      lrc_moved="$lrc_moved; observed under generation $lrc_tg (operation ${lrc_to:-none}) and this lane is at generation ${lrc_gen:-0}"
-    fi
-    printf 'TREE%s%s%s%s%s%s%sbranch %s head %s upstream %s %s dirty %s unpushed; observed %s at %s%s\n' \
-      "$US" "$lrc_id" "$US" "$lrc_class" "$US" "$lrc_p" "$US" \
-      "$lrc_nb" "$lrc_nh" "${lrc_nu:-none}" "${lrc_nd:-0}" "${lrc_nn:-0}" \
-      "${lrc_d:-0}/${lrc_np:-0}" "$lrc_ob" "$lrc_moved"
-  done <<EOF
-$lrc_tl
-EOF
-
-  # 4. WHAT IS THERE AND IS IN NO SIDECAR — from git's own registrations and
-  # from the two lane roots on disk. It is REPORTED and never adopted, deleted
-  # or overwritten: which lane a tree belongs to is a person's to say.
-  lrc_unmanaged=0
-  # A TRIAD (opensoft/openRepoTools#186, plan task T018). WHERE THE LANE'S
-  # CHECKOUT IS AN ASSEMBLY — its own `project.yaml` declares a leg other than
-  # itself, read by `assembly_legs`, the one reader every lane tool asks — what
-  # its LEGS hold is read too: the worktrees git registers in each leg's
-  # repository, which `git worktree list` in the assembly never names, and the
-  # paired feature trees `<assembly>/worktrees/<feature>/<each leg's path>`.
-  # Both are reported exactly as the checkout's own registrations and the lane
-  # roots are, and adopted, deleted or overwritten no more. A checkout with no
-  # `project.yaml` is asked nothing, so its report is what it always was; a
-  # manifest, a leg's registrations or the paired root that could not be read
-  # leaves paths nobody read, and the verdict below says so.
-  lrc_legs=""; lrc_lgrc=8; lrc_legwhy=""; lrc_tab="$(printf '\t')"
-  if [ -n "$lrc_dir" ] && [ -d "$lrc_dir" ] && { [ -e "$lrc_dir/project.yaml" ] || [ -L "$lrc_dir/project.yaml" ]; }; then
-    lrc_lgrc=0
-    lrc_legs="$(assembly_legs "$lrc_dir")" || lrc_lgrc=$?
-  fi
-  if [ -n "$lrc_dir" ] && [ -d "$lrc_dir" ]; then
-    # THE CHECKOUT'S OWN ROW IS NOT AN UNMANAGED TREE, AND git ANSWERS WITH THE
-    # PHYSICAL PATH. A recorded `dir` reached through a symlink — which is how
-    # every estate with a `projects` link spells it — would otherwise not match
-    # the first row of `worktree list` and the lane's own checkout would be
-    # reported as a tree nobody manages. `cd -P` is the portable resolver here
-    # for the reason `lane-start`'s `real_of` gives: `readlink -f` is not in the
-    # stock macOS userland.
-    lrc_dirp="$(lane_real_path "$lrc_dir")"
-    # THE REGISTRATIONS ARE A READ, AND ITS STATUS IS KEPT (#113 item 4). It
-    # ended in `|| :`, so a checkout whose registrations could not be read was
-    # one with none: every stale registration and every unmanaged tree in it
-    # was omitted, the verdict could still read `resumable`, and the estate's
-    # own `resume` then failed on the registration the report never named. A
-    # directory that is NO repository at all registers nothing, and that alone
-    # is an absence (`lane_no_repository`, `lane-worktrees`' rule).
-    lrc_wlo=""; lrc_wlrc=0
-    lrc_wlo="$(git -C "$lrc_dir" worktree list --porcelain 2>/dev/null </dev/null)" || lrc_wlrc=$?
-    if [ "$lrc_wlrc" != 0 ] && lane_no_repository "$lrc_dir"; then lrc_wlrc=0; lrc_wlo=""; fi
-    if [ "$lrc_wlrc" != 0 ]; then
-      lrc_unread="${lrc_unread:+$lrc_unread; }the worktree registrations of $lrc_dir could not be read (git worktree list exited $lrc_wlrc)"
-    fi
-    while IFS= read -r lrc_wl; do
-      case "$lrc_wl" in worktree\ *) : ;; *) continue ;; esac
-      lrc_wp="${lrc_wl#worktree }"
-      [ "$lrc_wp" = "$lrc_dir" ] && continue
-      [ -n "$lrc_dirp" ] && [ "$lrc_wp" = "$lrc_dirp" ] && continue
-      # AND THE SIDECARS ARE ASKED UNDER BOTH SPELLINGS, for the same reason.
-      lrc_wpr="$(lane_real_path "$lrc_wp")"
-      case "$lrc_seen" in *" $lrc_wp "*|*" $lrc_wpr "*) continue ;; esac
-      if [ -d "$lrc_wp" ]; then
-        printf 'TREE%s%s%sunmanaged%s%s%sgit registers it in %s and no sidecar of this lane names it; it is left exactly as it is\n' \
-          "$US" "$(tree_id_for "$lrc_wp")" "$US" "$US" "$lrc_wp" "$US" "$lrc_dir"
-      else
-        printf 'TREE%s%s%sstale-registration%s%s%sgit registers it in %s and the directory is gone; `git -C %s worktree prune` is a person'\''s act\n' \
-          "$US" "$(tree_id_for "$lrc_wp")" "$US" "$US" "$lrc_wp" "$US" "$lrc_dir" "$lrc_dir"
-      fi
-      # NAMED ONCE. The on-disk sweep below walks the same two roots git
-      # registers these in, so a path reported here joins the seen set — under
-      # both spellings, because that sweep walks the recorded `dir` and this one
-      # answered with the physical path — or a reader is told about one tree
-      # twice under two different reasons.
-      lrc_seen="$lrc_seen $lrc_wp $lrc_wpr "
-      lrc_unmanaged=$((lrc_unmanaged + 1))
-    done <<EOF
-$lrc_wlo
-EOF
-  fi
-  # T018: EVERY LEG'S REGISTRATIONS, beside the checkout's own. A leg that is
-  # not checked out here is an empty directory of the assembly's, where git
-  # answers the ASSEMBLY — it registers nothing of its own, so it is passed
-  # over. A leg's main worktree is listed FIRST and spelled as its git
-  # directory under the assembly's `.git/modules/`, so it is skipped by place,
-  # not by name.
-  # A LEG WITH A `.git` OF ITS OWN THAT GIT CANNOT READ is no absent leg: it is
-  # a read that failed, never an absent or a clean one (Amendment 7(d)), and
-  # passed over it was a leg this reconciliation said nothing of while the
-  # sweep counted it. So it is the sweep's rule (`probe_leg`: git's toplevel
-  # there is not the leg, and a `.git` stands in it) and the sweep's word: a
-  # TREE row `unreadable`, which requires recovery, as the sweep's `leg` row is
-  # `unreadable` and counted. It is NO `indeterminate`: the sweep counts that
-  # leg and goes on (exit 3), and a verdict it refuses on would hide the count.
-  # SO IS A LEG DIRECTORY THIS ACCOUNT CANNOT SEARCH (#255, openRepoShape-2's
-  # SHOULD on #246): whether a `.git` stands in it cannot be tested, and the
-  # `.git` test fails there exactly as for a leg that is not checked out, so it
-  # was passed over in silence. It is the same `unreadable` row, in the words
-  # of the sweep's `probe_leg` and `lane-handoff`; a leg directory that is not
-  # there at all is still passed over (`-d`).
-  if [ "$lrc_lgrc" = 0 ]; then
-    while IFS="$lrc_tab" read -r lrc_lrepo lrc_ldecl lrc_labs; do
-      [ -n "$lrc_labs" ] && [ -d "$lrc_labs" ] || continue
-      lrc_ltop="$(git -C "$lrc_labs" rev-parse --show-toplevel 2>/dev/null </dev/null || :)"
-      if [ -z "$lrc_ltop" ] || [ "$(lane_real_path "$lrc_ltop")" != "$(lane_real_path "$lrc_labs")" ]; then
-        if [ -e "$lrc_labs/.git" ] || [ -L "$lrc_labs/.git" ]; then
-          lrc_lwhat="it has a .git of its own and git could not read it"
-        elif [ ! -x "$lrc_labs" ]; then
-          lrc_lwhat="its directory cannot be searched, so whether it has a .git of its own could not be tested, and git could not read it"
-        else
-          continue
-        fi
-        lrc_lr="$(lane_real_path "$lrc_labs")"
-        case "$lrc_seen" in *" $lrc_labs "*|*" $lrc_lr "*) continue ;; esac
-        if [ -n "$lrc_ltop" ]; then
-          lrc_lerr="git answers $lrc_ltop there"
-        else
-          lrc_lerr="$(git -C "$lrc_labs" rev-parse --show-toplevel 2>&1 >/dev/null </dev/null \
-            | awk 'NF { sub(/^[ \t]+/, ""); sub(/[ \t]+$/, ""); print; exit }' | tr -d '\037')"
-          lrc_lerr="${lrc_lerr:-no answer}"
-        fi
-        printf 'TREE%s%s%sunreadable%s%s%sthe %s leg of %s/project.yaml%s: git could not be read through it (%s: %s), so NOTHING is assumed about it — not its own state, nor the worktrees it registers, which were not listed; a read that failed is never a clean leg (Amendment 7(d)) — read it by hand (git -C %s status) before relaunching a writer onto a tree of its repository\n' \
-          "$US" "$(tree_id_for "$lrc_labs")" "$US" "$US" "$lrc_labs" "$US" "$lrc_ldecl" "$lrc_dir" \
-          "${lrc_lrepo:+ ($lrc_lrepo)}" "$lrc_lwhat" "$lrc_lerr" "$lrc_labs"
-        lrc_seen="$lrc_seen $lrc_labs $lrc_lr "
-        lrc_recover=$((lrc_recover + 1))
-        continue
-      fi
-      lrc_lwl=""; lrc_lwrc=0
-      lrc_lwl="$(git -C "$lrc_labs" worktree list --porcelain 2>/dev/null </dev/null)" || lrc_lwrc=$?
-      if [ "$lrc_lwrc" != 0 ]; then
-        lrc_legwhy="${lrc_legwhy:+$lrc_legwhy; }the worktrees git registers in $lrc_labs, the $lrc_ldecl leg, could not be listed (git worktree list exited $lrc_lwrc)"
-        continue
-      fi
-      lrc_first=1
-      while IFS= read -r lrc_wl; do
-        case "$lrc_wl" in worktree\ *) : ;; *) continue ;; esac
-        if [ "$lrc_first" = 1 ]; then lrc_first=0; continue; fi
-        lrc_wp="${lrc_wl#worktree }"
-        lrc_wpr="$(lane_real_path "$lrc_wp")"
-        case "$lrc_seen" in *" $lrc_wp "*|*" $lrc_wpr "*) continue ;; esac
-        if [ -d "$lrc_wp" ]; then
-          printf 'TREE%s%s%sunmanaged%s%s%sgit registers it in %s, the %s leg of %s/project.yaml (%s), and no sidecar of this lane names it; it is left exactly as it is\n' \
-            "$US" "$(tree_id_for "$lrc_wp")" "$US" "$US" "$lrc_wp" "$US" "$lrc_labs" "$lrc_ldecl" "$lrc_dir" "$lrc_lrepo"
-        else
-          printf 'TREE%s%s%sstale-registration%s%s%sgit registers it in %s, the %s leg of %s/project.yaml (%s), and the directory is gone; `git -C %s worktree prune` is a person'\''s act\n' \
-            "$US" "$(tree_id_for "$lrc_wp")" "$US" "$US" "$lrc_wp" "$US" "$lrc_labs" "$lrc_ldecl" "$lrc_dir" "$lrc_lrepo" "$lrc_labs"
-        fi
-        lrc_seen="$lrc_seen $lrc_wp $lrc_wpr "
-        lrc_unmanaged=$((lrc_unmanaged + 1))
-      done <<LRC_LEG_TREES
-$lrc_lwl
-LRC_LEG_TREES
-    done <<LRC_LEGS
-$lrc_legs
-LRC_LEGS
-  fi
-  while IFS= read -r lrc_wr; do
-    [ -n "$lrc_wr" ] || continue
-    [ -d "$lrc_wr" ] || continue
-    # A ROOT THAT CANNOT BE LISTED hides every tree in it — the glob comes back
-    # as itself and reads as an empty root — so it is a read nobody made (#113
-    # item 4, the on-disk half of the same sweep).
-    if [ ! -r "$lrc_wr" ] || [ ! -x "$lrc_wr" ]; then
-      lrc_unread="${lrc_unread:+$lrc_unread; }the lane's worktree root $lrc_wr could not be listed"
-      continue
-    fi
-    for lrc_c in "$lrc_wr"/*; do
-      [ -d "$lrc_c" ] || continue
-      lrc_cr="$(lane_real_path "$lrc_c")"
-      case "$lrc_seen" in *" $lrc_c "*|*" $lrc_cr "*) continue ;; esac
-      git -C "$lrc_c" rev-parse --git-dir >/dev/null 2>&1 || continue
-      printf 'TREE%s%s%sunmanaged%s%s%sit sits under this lane'\''s worktree root and no sidecar names it; it is left exactly as it is\n' \
-        "$US" "$(tree_id_for "$lrc_c")" "$US" "$US" "$lrc_c" "$US"
-      lrc_seen="$lrc_seen $lrc_c $lrc_cr "
-      lrc_unmanaged=$((lrc_unmanaged + 1))
-    done
-  done <<EOF
-$(lane_worktree_roots "$lrc_lane" "$lrc_dir")
-EOF
-  # T018: THE PAIRED ROOT. A feature directory, and each declared leg's path
-  # under it, that holds a `.git` of its own and that nothing above named — a
-  # registration lost, or a clone where a worktree belongs. Anything else under
-  # it is the assembly's own working tree, where git answers too, so a `.git`
-  # is what makes a checkout here. A directory that cannot be listed is a read
-  # nobody made, never an empty one.
-  if [ "$lrc_lgrc" = 0 ] && [ -d "$lrc_dir/worktrees" ]; then
-    if [ ! -r "$lrc_dir/worktrees" ] || [ ! -x "$lrc_dir/worktrees" ]; then
-      lrc_legwhy="${lrc_legwhy:+$lrc_legwhy; }the assembly's paired root $lrc_dir/worktrees could not be listed"
-    else
-      for lrc_f in "$lrc_dir"/worktrees/*; do
-        [ -d "$lrc_f" ] && [ ! -L "$lrc_f" ] || continue
-        if [ ! -r "$lrc_f" ] || [ ! -x "$lrc_f" ]; then
-          lrc_legwhy="${lrc_legwhy:+$lrc_legwhy; }the assembly's feature directory $lrc_f could not be listed"
-          continue
-        fi
-        # THE FEATURE DIRECTORY ITSELF, then each declared leg's path under
-        # it — a relative one, as the standard writes them. The directory is
-        # passed through the ENVIRONMENT: `awk -v` reads escapes in a value,
-        # so a name holding `\` would come out as another path.
-        lrc_cands="$lrc_f
-$(printf '%s\n' "$lrc_legs" | LRC_F="$lrc_f" awk -F'\t' '$2 != "" && $2 !~ /^\// { p = $2; sub(/^\.\//, "", p); print ENVIRON["LRC_F"] "/" p }')"
-        while IFS= read -r lrc_c; do
-          [ -n "$lrc_c" ] && [ -d "$lrc_c" ] && [ ! -L "$lrc_c" ] || continue
-          lrc_cr="$(lane_real_path "$lrc_c")"
-          case "$lrc_seen" in *" $lrc_c "*|*" $lrc_cr "*) continue ;; esac
-          # A LEG'S DIRECTORY THAT CANNOT BE SEARCHED hides whether a `.git`
-          # stands in it: a read nobody made, never an empty directory.
-          if [ ! -x "$lrc_c" ]; then
-            lrc_legwhy="${lrc_legwhy:+$lrc_legwhy; }the assembly's paired tree directory $lrc_c could not be searched"
-            continue
-          fi
-          { [ -e "$lrc_c/.git" ] || [ -L "$lrc_c/.git" ]; } || continue
-          printf 'TREE%s%s%sunmanaged%s%s%sit sits in the assembly'\''s paired feature trees (%s/worktrees) and no sidecar of this lane names it; it is left exactly as it is\n' \
-            "$US" "$(tree_id_for "$lrc_c")" "$US" "$US" "$lrc_c" "$US" "$lrc_dir"
-          lrc_seen="$lrc_seen $lrc_c $lrc_cr "
-          lrc_unmanaged=$((lrc_unmanaged + 1))
-        done <<LRC_PAIRED
-$lrc_cands
-LRC_PAIRED
-      done
-    fi
-  fi
-
-  # 5. THE VERDICT — the lifecycle word crossed with the holder, which is the
-  # whole of what tells the two crash kinds apart.
-  lrc_v=""; lrc_why=""
-  if [ "$lrc_hrc" != 0 ] && [ "$lrc_hrc" != 8 ]; then
-    lrc_v=indeterminate
-    [ -n "$lrc_hwhy" ] || lrc_hwhy="this workstation's session records could not be read"
-    lrc_why="$lrc_hwhy, so whether a holder is live is NOT established — which is not the same as none"
-  else
-    case "$lrc_state$lrc_hrc" in
-      RUNNING8)   lrc_v=ungraceful-stop; lrc_why="the lane is recorded RUNNING and no verified holder is live: the session stopped before any handoff began, so nothing was polled, refreshed or recorded — inspect every tree below before relaunching a writer" ;;
-      RUNNING0)   lrc_v=running;         lrc_why="a verified holder is live and the lane is RUNNING: do not launch a second coordinator or a second writer onto any tree below" ;;
-      SWAPPING8)  lrc_v=interrupted-swap; lrc_why="the lane is recorded SWAPPING and no verified holder is live: operation ${lrc_op:-none} began and did not finish, so the handoff, the row and the record may each be half done — every tree below is preserved for recovery" ;;
-      SWAPPING0)  lrc_v=swap-in-progress; lrc_why="operation ${lrc_op:-none} is running in a live holder: do not compete with it" ;;
-      SWAPPED8)   lrc_v=resumable;       lrc_why="the swap completed and no holder is live: the lane may be resumed once the trees below are read" ;;
-      SWAPPED0)   lrc_v=inconsistent;    lrc_why="the lane is recorded SWAPPED and a holder is LIVE: a swapped lane has no holder, so one of the two is wrong and neither is overwritten here" ;;
-      CLOSED8)    lrc_v=closed;          lrc_why="the lane is closed" ;;
-      CLOSED0)    lrc_v=inconsistent;    lrc_why="the lane is recorded CLOSED and a holder is LIVE" ;;
-      UNREADABLE*) lrc_v=indeterminate;  lrc_why="this lane's lifecycle snapshot at $lrc_root/lane-state.yaml IS THERE and could not be read, so where its session stopped is NOT established — which is not the same as a lane that has none, and is no clearance to relaunch anything (R22, Amendment 7(d): a read that failed is never an answer). Read that file by hand; if you know what wrote it, move it aside and this lane's next transition writes a fresh one" ;;
-      MALFORMED*) lrc_v=indeterminate;   lrc_why="this lane's lifecycle snapshot at $lrc_root/lane-state.yaml is of this schema and ${lrc_swhy:-is not a whole record} — truncated, or edited by hand — so where its session stopped is NOT established, and no writer replaces it, exactly as none replaces a schema it does not write (#115). Read that file by hand; if you know what wrote it, move it aside and this lane's next transition writes a fresh one" ;;
-      NONE*)      lrc_v=no-state;        lrc_why="this lane has no lifecycle snapshot: it has not started or handed off under this capability, so its crash kind cannot be told from its record (Amendment 7(i)'s cutover rule — nothing is backfilled)" ;;
-      *)          lrc_v=unknown-state;   lrc_why="the snapshot holds the state word '$lrc_state', which this reader does not know; nothing is assumed about it" ;;
-    esac
-    if [ "$lrc_v" = closed ] && [ "$lrc_dirty" -gt 0 ]; then
-      lrc_v=closure-inconsistent
-      lrc_why="the lane is recorded CLOSED and $lrc_dirty tree(s) below are dirty or unpushed: no cleanup is made here"
-    fi
-  fi
-  # AND A LANE BOUND ELSEWHERE IS NEVER PRONOUNCED ON FROM HERE (Amendment
-  # 18(b), step 2b above). Every verdict this function can reach out of a local
-  # snapshot and a local holder read — a crash, a clearance, a closure, or
-  # "nothing to recover" — is a pronouncement on liveness, and from outside the
-  # binding that is UNKNOWN, never dead. So all of them become `indeterminate`.
-  case "$lrc_bwhere" in
-    elsewhere)
-      lrc_v=indeterminate
-      lrc_why="lane $lrc_lane is bound on $lrc_bat, and liveness is pronounced only from inside that binding (Amendment 18(b)): from here it is UNKNOWN, never dead, so no crash, no clearance and no closure is pronounced — and this workstation's snapshot is this workstation's alone (design decision 10). Read the lane from that place, or ask it to hand off: lane-start --request-handoff" ;;
-    unknown)
-      lrc_v=indeterminate
-      lrc_why="lane $lrc_lane's object log could not be read, so where it is bound is NOT established — and liveness may be pronounced only from inside the binding (Amendment 18(b)). A read that failed is never an answer (Amendment 7(d))" ;;
-  esac
-  # AND NO CLEARANCE OVER PATHS NOBODY READ (#113). The inventory, the
-  # registrations or a lane root that could not be read leaves trees this
-  # report never saw — so whatever the snapshot and the holder say, the verdict
-  # is not one a launcher may go past.
-  if [ -n "$lrc_unread" ] && [ "$lrc_v" != indeterminate ]; then
-    lrc_v=indeterminate
-    lrc_why="not all of lane $lrc_lane's worktrees could be read ($lrc_unread), so trees this report never saw may hold work, and no clearance is pronounced over paths nobody read (R22, Amendment 7(d))"
-  fi
-  if [ "$lrc_drc" != 0 ] && [ "$lrc_drc" != 8 ] && [ "$lrc_v" != indeterminate ]; then
-    lrc_v=indeterminate
-    lrc_why="lane $lrc_lane's object log could not be read, so its coordinator directory is NOT established and neither the worktrees git registers there nor the trees on disk under its roots were inspected — no clearance is pronounced over paths nobody read (Amendment 7(d))"
-  fi
-  # T018: AN ASSEMBLY WHOSE LEGS COULD NOT BE READ is one whose leg
-  # registrations and paired trees nobody inspected — the same paths-nobody-read
-  # as an unreadable object log, and the same answer. It is said in the words
-  # `lane-worktrees`' sweep refuses with (`the legs of the assembly <dir> could
-  # not be read`), because the sweep reads this verdict FIRST and refuses on
-  # it: one fact, one spelling, whichever reader a person meets.
-  if [ "$lrc_lgrc" != 0 ] && [ "$lrc_lgrc" != 8 ] && [ "$lrc_v" != indeterminate ]; then
-    lrc_v=indeterminate
-    lrc_why="the legs of the assembly $lrc_dir could not be read (its project.yaml is there and unreadable), so which legs it declares — and the worktrees they register and the paired feature trees under $lrc_dir/worktrees — is NOT established, and no clearance is pronounced over paths nobody read (T018, Amendment 7(d))"
-  fi
-  if [ -n "$lrc_legwhy" ] && [ "$lrc_v" != indeterminate ]; then
-    lrc_v=indeterminate
-    lrc_why="lane $lrc_lane's checkout $lrc_dir is an assembly and not all of what its legs hold could be read ($lrc_legwhy), so no clearance is pronounced over paths nobody read (T018, Amendment 7(d))"
-  fi
-  printf 'TREES%s%s inventoried%s%s dirty or unpushed%s%s require recovery%s%s unmanaged or stale\n' \
-    "$US" "$lrc_n" "$US" "$lrc_dirty" "$US" "$lrc_recover" "$US" "$lrc_unmanaged"
-  printf 'VERDICT%s%s%s%s\n' "$US" "$lrc_v" "$US" "$lrc_why"
-  return 0
-}
-
-# ------------------------------------- every inventoried worktree, as rows
-#
-# opensoft/openRepoTools#161 — THE INVENTORY OF EVERY LANE ON THIS WORKSTATION,
-# ONE ROW PER TREE, and the one implementation of that sentence: `lanes
-# --worktrees` renders what this prints and `lanes-index sync --source
-# inventory` copies it into the derived index's `worktrees` table, so the
-# listing a person reads and the table another workstation queries cannot come
-# to disagree about what a lane left. US-separated, sixteen fields:
-#
-#   TREE <workstation> <lane> <owner> <path> <branch> <base> <lifecycle>
-#        <generation> <operation> <writer_live> <last_seen_utc> <last_commit>
-#        <dirty> <unpushed> <provenance>
-#   UNREAD <workstation> <lane> <why>
-#   PARTIAL <workstation> <why>
-#
-# IT READS WHAT #97 WROTE AND NOTHING THAT IT DID NOT. The lanes are the
-# listing's own (`lanes_rows --all --closed`, so a closed or dormant lane's
-# leftovers are not hidden), and so is `writer_live` — the listing's LIVE, out
-# of this workstation's session records, and EMPTY where those could not be
-# read or the lane is bound elsewhere (Amendment 7(d) and 18(b): never "no" on a
-# read nobody could make). The trees are `lane_trees_list`'s sidecars and
-# NO DIRECTORY IS WALKED for a tree no sidecar names: that is
-# `lane-reconcile`'s act, and it is an act. `owner` is `lane_is_managed_owned`'s
-# answer — the read `managed-projection` makes — as `legacy`, `managed <owner>`
-# or `unknown`, and `lifecycle` is the snapshot's own word for a LEGACY lane
-# only: a managed or unknown lane's lifecycle is not this tooling's to
-# pronounce on (ruling 2026-10-04), and neither is one whose snapshot is
-# missing, unreadable or of another schema, so those are `INDETERMINATE`.
-# `generation` and `operation` are the snapshot's; `provenance` is the
-# generation the TREE'S OWN record was filed under, which is behind
-# `generation` exactly when the observation predates the lane's current
-# transition.
-#
-# EVERY FIELD IS THE LAST OBSERVATION, NEVER RECOMPUTED: `branch`, `dirty`,
-# `unpushed` and `last_seen_utc` are what the sidecar says the handoff saw.
-# Two git reads are made per tree the inventory names, both of the RECORDED
-# head and neither of the working tree: `last_commit` (`<sha> <subject>`) and
-# `base`, its merge-base with `origin/main`, else `main`, else `origin/HEAD`
-# — in the tree, or in its recorded checkout once the tree is gone. A detached
-# head is `detached <sha>`; a record that could not be read is `unreadable
-# sidecar`, one of another schema `unknown schema <n>`, and one of this schema
-# that is not whole `malformed sidecar` (#115). Each keeps the path the record
-# names where it names one, else the record's id (its file name) stands
-# there. A kept path is the record's own word, so it may be relative or
-# not a tree at all; only a whole record's path is known absolute. A count that is
-# `unknown` is empty — an INTEGER column has no word for it.
-#
-# AND THE LISTING ITSELF IS SAID TO BE WHOLE OR NOT (opensoft/openRepoTools#173
-# item c1, Copilot's fourth review of #171). Its lanes are the names three
-# reads give — the register's rows, the archive's rows and the object logs'
-# file names — and each lane's trees are found under the control root its
-# log's `dir` places. `lanes_rows` is a listing a person reads in front of a
-# launch, so it may not refuse: where one of those reads fails it SAYS so on
-# stderr (the log listing not even that) and lists what the others gave. Taken
-# as whole, that made a lane whose only row is in an archive that could not be
-# read a lane with no trees — and `lanes-index sync` removed its rows; with all
-# three unread the listing was EMPTY and this said 8, "none", and the sync
-# removed every row. So for the whole listing — a named lane is read by its
-# name, which no listing gives — each of those reads is asked here too, and a
-# failed one is ONE `PARTIAL` line: the rows beside it are every tree this read
-# reached, a lane it could not name is NOT a lane with no worktrees (R22,
-# Amendment 7(d)), and the indexer writes nothing over it. The register, the
-# archive and the list of the logs are asked BEFORE the listing, and a read
-# that succeeds is the very text the listing then reads - the register's out of
-# its cache, the other two pinned for the listing alone (`PIN_ARCHIVE`,
-# `PIN_LOGS`), so no read that fails after the check can thin a listing taken
-# as whole (the review of #289, SHOULD-1). The logs themselves are asked AFTER
-# it, out of the warnings the events' own read of them left (`state_events`,
-# built once per process): a log it could not read, and a list of the logs it
-# could not make, which is the read every lane's `dir` comes from - and the
-# lane's root, its trees and its snapshot are all found under that one `dir`,
-# not under a second read of its log (review r2 of #289, SHOULD-A); where
-# those warnings could not be kept, whether a log failed is not known, which
-# is said the same way. With no `origin`, the log directory is asked as the
-# trees' is below, and its files are still read twice: docs/README-lanes.md
-# says what that leaves. An empty listing over a failed read is that line
-# alone, and never 8.
-#
-# The rows are sorted bytewise, which is the order the index's copy is written
-# in too: the two reads of one inventory are the same bytes.
-#   0 rows, with a PARTIAL line where the listing was not whole · 8 none ·
-#   1 the lane listing could not be read
-worktree_rows() {   # [<canonical lane>]
-  wr_one="${1-}"; wr_out=""
-  wr_live_ok=1
-  live_session_ids >/dev/null 2>&1 || wr_live_ok=0
-  wr_partial=""
-  wr_unlisted="the object logs under origin/$LANES_BRANCH:$LANES_LOG_PREFIX could not be listed"
-  if [ -z "$wr_one" ]; then
-    register_text_checked >/dev/null 2>&1 ||
-      wr_partial="the register $LANES_PATH could not be read"
-    # THE ARCHIVE AND THE LOG LIST ARE PINNED, NOT ONLY ASKED (SHOULD-1(b)):
-    # each read that succeeds here is the text every read of the listing below
-    # is handed, as the register's is its cache. `x` keeps the text's last
-    # newline through the substitution.
-    wr_pin=""
-    if wr_pin="$(archive_text 2>/dev/null && printf x)"; then
-      PIN_ARCHIVE_TEXT="${wr_pin%x}"; PIN_ARCHIVE=1
-    else
-      wr_partial="${wr_partial:+$wr_partial; }the archive $LANES_ARCH_PATH could not be read"
-    fi
-    # `known_lanes`' OWN TWO READS, which print what they could and answer 0
-    # either way, because the listing unions them with the register. WITH NO
-    # `origin`, A DIRECTORY THAT IS THERE IS ASKED AS THE TREES' IS BELOW: `ls`
-    # lists an `r--` one, whose files no glob can then open (N1 of the review).
-    if have_remote_ref; then
-      wr_pin=""
-      if wr_pin="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null && printf x)"; then
-        PIN_LOGS_TEXT="${wr_pin%x}"; PIN_LOGS=1
-      else
-        wr_partial="${wr_partial:+$wr_partial; }$wr_unlisted"
-      fi
-    elif [ -e "$LANES_LOG_DIR" ] || [ -L "$LANES_LOG_DIR" ]; then
-      if [ ! -d "$LANES_LOG_DIR" ] || [ ! -r "$LANES_LOG_DIR" ] || [ ! -x "$LANES_LOG_DIR" ]; then
-        wr_partial="${wr_partial:+$wr_partial; }the log directory $LANES_LOG_DIR is there and could not be listed"
-      fi
-    fi
-  fi
-  wr_lanes=""; wr_lrc=0
-  if [ -n "$wr_one" ]; then
-    wr_lanes="$(lanes_rows --lane "$wr_one" --closed)" || wr_lrc=$?
-  else
-    wr_lanes="$(lanes_rows --all --closed)" || wr_lrc=$?
-  fi
-  PIN_ARCHIVE=0; PIN_ARCHIVE_TEXT=""; PIN_LOGS=0; PIN_LOGS_TEXT=""
-  case "$wr_lrc" in
-    0) : ;;
-    8) [ -n "$wr_partial" ] || return 8 ;;
-    *) return 1 ;;
-  esac
-  if [ -z "$wr_one" ] && [ "$wr_lrc" = 0 ]; then
-    wr_ulogs=""; wr_urc=0; wr_ulist=""
-    if [ -n "$SE_WARN_FILE" ] && [ -f "$SE_WARN_FILE" ]; then
-      wr_ulogs="$(sed -n -e 's/^lanes-edit: unreadable log: \(.*\) — git could not read it.*$/\1/p' "$SE_WARN_FILE" 2>/dev/null)" || wr_urc=1
-      # THE EVENTS' OWN LIST OF THE LOGS (SHOULD-1(a)): where it failed, no
-      # lane has the `dir` its trees are found under.
-      wr_ulist="$(sed -n -e '/^lanes-edit: unlisted logs: /p' "$SE_WARN_FILE" 2>/dev/null)" || wr_urc=1
-    else
-      wr_urc=1
-    fi
-    if [ "$wr_urc" != 0 ]; then
-      wr_partial="${wr_partial:+$wr_partial; }whether every object log could be read is not known, because the warnings of their read could not be kept"
-    else
-      if [ -n "$wr_ulist" ]; then
-        case "; $wr_partial; " in
-          *"; $wr_unlisted; "*) : ;;
-          *) wr_partial="${wr_partial:+$wr_partial; }$wr_unlisted" ;;
-        esac
-      fi
-      if [ -n "$wr_ulogs" ]; then
-        wr_partial="${wr_partial:+$wr_partial; }these object logs could not be read: $(printf '%s\n' "$wr_ulogs" | tr '\n' ' ' | sed -e 's/ $//')"
-      fi
-    fi
-  fi
-  wr_tab="$(printf '\t')"
-  while IFS="$wr_tab" read -r wr_l wr_st wr_w wr_pf wr_win wr_sid wr_dir wr_obj wr_age wr_restart wr_home wr_fk wr_loc wr_rest; do
-    [ -n "${wr_l:-}" ] || continue
-    # ONE CONTROL-ROOT READ FOR A LANE WITH NO TREES, which is nearly every lane
-    # in the estate: the sidecars are listed only where a `trees` directory is.
-    # The listing's column 7 IS `lane_payload_field <lane> dir` — the same last
-    # lane-kind payload carrying `dir`, out of the same published logs, `none`
-    # where there is none — so it is handed to `lane_control_root` as the
-    # payload it takes, rather than having each of sixty lanes' logs read a
-    # second time to find what the listing has just said (measured on Eagle's
-    # 61 lanes: 7.9 s for the whole read with the second reading, 2.7 s
-    # without it). `none` is not absolute, so it falls to the same third rung
-    # an absent `dir` does.
-    # AND THE SAME PAYLOAD TO THE TWO READS BELOW (review r2 of #289,
-    # SHOULD-A). `lane_trees_list` and `lane_state_read` worked the root out
-    # again with no `dir`, reading the lane's log a second and a third time,
-    # and a `git show` that failed there was thrown away: the root fell to the
-    # third rung, where no `trees` is, and a lane whose trees this loop had
-    # just found read as a lane with none. The listing's `dir` is now the root
-    # of all three, so the read that could fail is not made.
-    wr_pay="dir ${wr_dir:-none}"
-    wr_root=""; wr_rrc=0
-    wr_root="$(lane_control_root "$wr_l" "$wr_pay" 2>/dev/null)" || wr_rrc=$?
-    [ "$wr_rrc" = 0 ] || continue
-    [ -d "$wr_root/trees" ] || continue
-    # A DIRECTORY THAT IS THERE AND CANNOT BE LISTED IS NOT AN EMPTY ONE, and
-    # the trees it holds are not trees this lane no longer has (R22).
-    if [ ! -r "$wr_root/trees" ] || [ ! -x "$wr_root/trees" ]; then
-      wr_out="${wr_out}UNREAD$US$WS$US$wr_l${US}its trees directory $wr_root/trees is there and could not be listed
-"
-      continue
-    fi
-    wr_trees=""; wr_trc=0
-    wr_trees="$(lane_trees_list "$wr_l" "$wr_pay" 2>/dev/null)" || wr_trc=$?
-    # 8 IS A `trees` DIRECTORY WITH NO RECORD IN IT; ANYTHING ELSE, with the
-    # directory already found above, is a read that did not happen - and its
-    # rows are not rows this lane no longer has (Copilot round 2 on #171).
-    case "$wr_trc" in
-      0) : ;;
-      8) continue ;;
-      *)
-        wr_out="${wr_out}UNREAD$US$WS$US$wr_l${US}its trees directory $wr_root/trees is there and lane-trees could not read it (exit $wr_trc)
-"
-        continue ;;
-    esac
-    # LIVENESS IS PRONOUNCED ONLY FROM INSIDE THE BINDING (Amendment 18(b)). A
-    # live record here naming one of the lane's ids is `1` and no such record is
-    # `0` - but only where this workstation could read its records AND the
-    # lane's latest binding is not on another host (the listing's column 13).
-    # Either of those says UNKNOWN, the empty field, and it wins over the
-    # listing's LIVE too (Copilot round 1 on #171): a still-running local
-    # session of an older binding says nothing about the writer the lane's
-    # binding elsewhere has now.
-    wr_live=0
-    [ "$wr_st" = LIVE ] && wr_live=1
-    [ "${wr_loc:-none}" = elsewhere ] && wr_live=""
-    [ "$wr_live_ok" = 1 ] || wr_live=""
-    wr_own=""; wr_orc=0
-    wr_own="$(lane_is_managed_owned "$wr_l" 2>/dev/null)" || wr_orc=$?
-    wr_own="$(printf '%s\n' "$wr_own" | head -n 1)"
-    case "$wr_orc" in
-      0) if [ -n "$wr_own" ]; then wr_owner="managed $wr_own"; else wr_owner=unknown; fi ;;
-      8) wr_owner=legacy ;;
-      *) wr_owner=unknown ;;
-    esac
-    wr_life=INDETERMINATE; wr_gen=""; wr_op=""
-    wr_snap=""; wr_src=0
-    wr_snap="$(lane_state_read "$wr_l" "$wr_pay" 2>/dev/null)" || wr_src=$?
-    if [ "$wr_src" = 0 ]; then
-      wr_s="$(printf '%s\n' "$wr_snap" | awk -F'\t' '$1 == "state" { print $2; exit }')"
-      if [ "$wr_s" != UNKNOWN-SCHEMA ]; then
-        wr_gen="$(printf '%s\n' "$wr_snap" | awk -F'\t' '$1 == "generation" { print $2; exit }')"
-        wr_op="$(printf '%s\n' "$wr_snap" | awk -F'\t' '$1 == "operation" { print $2; exit }')"
-        case "$wr_gen" in ''|*[!0-9]*) wr_gen="" ;; esac
-        case "$wr_s" in RUNNING|SWAPPING|SWAPPED|CLOSED) wr_life="$wr_s" ;; esac
-      fi
-    fi
-    [ "$wr_owner" = legacy ] || wr_life=INDETERMINATE
-    while IFS="$US" read -r t_id t_p t_b t_h t_u t_d t_n t_w t_ob t_co t_g t_o t_s; do
-      [ -n "${t_id:-}" ] || continue
-      t_base=""; t_last=""
-      if [ "${t_s:-}" = "<unreadable>" ]; then
-        t_branch="unreadable sidecar"; [ -n "${t_p:-}" ] || t_p="$t_id"
-        t_d=""; t_n=""; t_g=""; t_ob=""
-      elif [ "${t_s:-}" = "<malformed>" ]; then
-        t_branch="malformed sidecar"; [ -n "${t_p:-}" ] || t_p="$t_id"
-        t_d=""; t_n=""; t_g=""; t_ob=""
-      elif [ "${t_s:-}" != "$LANE_STATE_SCHEMA" ]; then
-        t_branch="unknown schema ${t_s:-<none>}"; [ -n "${t_p:-}" ] || t_p="$t_id"
-        t_d=""; t_n=""; t_g=""; t_ob=""
-      else
-        if [ "$t_b" = detached ]; then t_branch="detached $t_h"; else t_branch="$t_b"; fi
-        case "$t_h" in
-          ''|*[!0-9a-f]*) : ;;
-          *)
-            if [ "${#t_h}" -eq 40 ]; then
-              t_gd=""
-              if [ -d "$t_p" ]; then t_gd="$t_p"; elif [ -d "${t_co:-}" ]; then t_gd="$t_co"; fi
-              if [ -n "$t_gd" ]; then
-                t_last="$(git -C "$t_gd" show -s --format='%H %s' "$t_h^{commit}" 2>/dev/null | head -n 1 | tr -d '\037')"
-                [ -n "$t_last" ] || t_last="$t_h"
-                for t_ref in refs/remotes/origin/main refs/heads/main refs/remotes/origin/HEAD; do
-                  if git -C "$t_gd" rev-parse --verify -q "$t_ref^{commit}" >/dev/null 2>&1; then
-                    t_base="$(git -C "$t_gd" merge-base "$t_h" "$t_ref" 2>/dev/null || :)"
-                    break
-                  fi
-                done
-              else
-                t_last="$t_h"
-              fi
-            fi ;;
-        esac
-        case "$t_d" in ''|*[!0-9]*) t_d="" ;; esac
-        case "$t_n" in ''|*[!0-9]*) t_n="" ;; esac
-        case "$t_g" in ''|*[!0-9]*) t_g="" ;; esac
-      fi
-      wr_out="${wr_out}TREE$US$WS$US$wr_l$US$wr_owner$US$t_p$US$t_branch$US$t_base$US$wr_life$US$wr_gen$US$wr_op$US$wr_live$US$t_ob$US$t_last$US$t_d$US$t_n$US$t_g
-"
-    done <<WR_TREES
-$wr_trees
-WR_TREES
-  done <<WR_LANES
-$wr_lanes
-WR_LANES
-  [ -z "$wr_partial" ] || wr_out="${wr_out}PARTIAL$US$WS$US$wr_partial
-"
-  [ -n "$wr_out" ] || return 8
-  printf '%s' "$wr_out" | LC_ALL=C sort
-  return 0
-}
-
-# ---------------------------------------------------------------- subcommands
-
-cmd="${1-}"
-# The usage block is this file's own header: print from line 3 until the first
-# line that is not a comment. (It used to be a hard-coded `3,59p`, which went
-# stale the moment the header grew — as it did under Amendment 5.)
-[ -n "$cmd" ] || { sed -n -e '1,2d' -e '/^#/!q' -e 's/^# \{0,1\}//' -e p "$RESOLVED"; exit 2; }
-shift || :
-# `session-start` is EXEMPT. It is a hook: it never writes, and it must exit 0
-# even where there is no register to read at all — a hook that dies is a hook
-# that breaks the session it was meant to orient.
-# EVERY WRITER REFUSES WHERE THIS CONTAINER HAS NO CONFIGURED WORKSTATION
-# (Amendment 11, decision 8(d), `R-A11-14`). ONE GUARD AT THE DISPATCHER rather
-# than one per writer: `WS` is built into every event line's `session <uuid>@<ws>`
-# and into every commit subject this file writes, so a container id reaches the
-# append-only log through any of the TEN subcommands listed below (nine until
-# Amendment 18 added `request-handoff`), and ten copies of one rule is how nine
-# of them would come to disagree. The READS are untouched — a read in
-# front of every launch may not refuse, and one that answers nothing for a
-# workstation nobody configured is telling the truth.
-case "$cmd" in
-  # `request-handoff` JOINS THE LIST BECAUSE IT WRITES (Amendment 18(c)/(e)). It
-  # reaches `write_event` directly rather than through `log`, so the dispatcher
-  # guard is the only place that stops it filing a `HANDOFF-REQUESTED` or a
-  # forced `PAUSED` under a container id — and one field further along than the
-  # `session <uuid>@<ws>` this guard has always protected, clause (a)'s own
-  # `host` falls back to THE RULE 10 WORKSTATION NAME, which in this state is
-  # that same container id. One guard, every writer, exactly as the paragraph
-  # below says — and Amendment 13's `set-row-state` and `migrate-state-cells`
-  # are in it for the same reason.
-  # AND `rename-lane` JOINS IT FOR THE SAME REASON (Amendment 16). Its four
-  # moves are one commit and one of them is a `RENAMED` line carrying
-  # `session <uuid>@<ws>`, so an unconfigured container would put its own id
-  # into the register, the log AND `lanes/aliases.tsv` in a single write.
-  # AND AMENDMENT 19-S TWO WRITES, `retire-rows` and `archive-rows`, for the
-  # same reason: each is ONE commit over several rows and logs, and every
-  # `RETIRED` line it appends carries `session <uuid>@<ws>`.
-  replace-in-row|append-session-id|append-line|add-row|set-row-state|migrate-state-cells|retire-rows|archive-rows|commit|log|claim|release|request-handoff|rename-lane)
-    ws_why="$(lanes_workstation_why "$WS_SOURCE")"
-    [ -z "$ws_why" ] || die "$ws_why" 2 ;;
-esac
-
-# `guard` JOINS THAT EXEMPTION AND REFUSES FOR ITSELF (Amendment 12(d)). It is
-# a hook too, and a blocking one: `die … 1` here would print the workspace
-# refusal and let the prompt THROUGH, because only exit 2 blocks a
-# `UserPromptSubmit`. So the verb takes the same reads itself and answers them
-# with a 2 — fail CLOSED, which is the clause.
-case "$cmd" in
-  # THE TWO FILTERS OF AMENDMENT 18 ADDENDUM 1 READ THEIR ROWS FROM STDIN and
-  # touch no workspace at all, so a workspace this workstation has not pointed
-  # at yet is not a reason to refuse them — the same exemption `session-start`
-  # has had since it was written, and the same one `guard` joined under
-  # Amendment 12(d), each for its own reason.
-  # AND THE RETIRED VERB IS EXEMPT TOO (Copilot round 4 on openRepoTools#82,
-  # suppressed comment `lanes-edit.sh:7525`). `append-row-status` is out of the
-  # WRITER list above and says so of itself — *"it refuses before the
-  # workstation guard and before the register is even looked for"* — but this
-  # second guard caught it all the same: on a machine with no configured
-  # workspace the caller got the workspace refusal (exit 1) instead of the
-  # RETIREMENT refusal (exit 2) naming the two acts that replace it. A
-  # compatibility refusal that only fires where the register is already
-  # reachable is not one.
-  # AND `project-legs` (T018) READS ONE `project.yaml` and nothing of the
-  # workspace, so `lane-worktrees`' daily report can ask it on a
-  # workstation where no register is configured.
-  session-start|guard|lane-groups|next-free|append-row-status|project-legs) : ;;
-  *)
-    if [ -z "$LANES_REPO" ] || [ -z "$LANES_DIR" ]; then
-      die "$(lanes_workspace_why)" 1
-    fi
-    [ -f "$LANES_FILE" ] || die "registry not found: $LANES_FILE
-    $LANES_REPO is the workspace repository $(lanes_ws_yaml) names, and it
-    carries no lanes/LANES.md. A repository seeded by \`openRepoTools wip init\`
-    has one; re-run it (it is idempotent) or pull that checkout." 1
-    ;;
-esac
-
-case "$cmd" in
-  verify-row)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: verify-row <lane>" 2
-    lane="$(canon_lane "$lane")" || exit 2
-    n="$(row_line "$lane")" || exit 2
-    row="$(sed -n -e "${n}p" "$LANES_FILE")"
-    # Bash substrings, not `cut -c` and `rev`: `${#row}` counts CHARACTERS,
-    # and a register row is full of `·` `—` `→`, so a byte-counting `cut`
-    # disagrees with the length printed one field earlier — and BSD `rev` and
-    # `cut` answer `Illegal byte sequence` on the same row rather than
-    # disagreeing. The same rule `lane-end:566` states (R-A9-11).
-    # `${row: -200}` on a row SHORTER than 200 answers the empty string, where
-    # `rev | cut | rev` answered the whole row — so the short case is asked
-    # for explicitly rather than left to the expansion.
-    row_tail="$row"; [ "${#row}" -gt 200 ] && row_tail="${row: -200}"
-    printf 'lane   : %s\nline   : %s\nlength : %s chars\nfirst200: %s\nlast200 : %s\n' \
-      "$lane" "$n" "${#row}" "${row:0:200}" "$row_tail"
-    ;;
-
-  # AMENDMENT 13(a) — RETIRED, AND THE REFUSAL IS THE WHOLE OF IT.
-  #
-  # This verb appended to the `state` cell and never replaced it, which is how a
-  # column defined as the lane's CURRENT STATE came to hold a diary: 96,228
-  # characters in one row, 7,016 in this lane's own after a single day, in a
-  # table nobody can read in the table. The cell can never grow again because
-  # the act that grew it is gone — not because every caller remembered.
-  #
-  # IT REFUSES BEFORE THE WORKSTATION GUARD AND BEFORE THE REGISTER IS EVEN
-  # LOOKED FOR (it is out of the dispatcher's writer list above), so a caller on
-  # a machine that has neither still learns what to run instead. Two acts
-  # replace it, and they are two because the cell held two things: the STATE,
-  # which is one phrase a person reads, and the NARRATIVE, which is history and
-  # belongs in the lane's own append-only log.
-  append-row-status)
-    die "append-row-status is RETIRED (lane-collision-protocol Amendment 13(a), in force 2026-09-13T21:08:36Z). The state cell is ONE PHRASE — '<STATE> · <UTC> · <one line>' — and every write REPLACES it, so that the column that says where a lane IS can never grow into a diary again.
-  the STATE:      LANES_LANE=${1:-<lane>} lanes-edit.sh set-row-state ${1:-<lane>} \"<STATE> · <one line>\"
-                  ($ROW_STATES; the line at most $ROW_STATE_CAP characters)
-  the NARRATIVE:  LANES_LANE=${1:-<lane>} lanes-edit.sh log NOTED lane:${1:-<lane>} \"<what the lane did, found, launched, left>\"
-  a RULING:       LANES_LANE=${1:-<lane>} lanes-edit.sh log RULED lane:${1:-<lane>} [→ <object>] \"<Brett Heap's words, verbatim>\"
-  read it back:   lanes-edit.sh history ${1:-<lane>} [--since <UTC>]
-Nothing was written." 2
-    ;;
-
-  # AMENDMENT 13(a) — THE ONE WRITER OF THE STATE CELL. It stamps the UTC itself
-  # and REPLACES the cell, so what the column holds after this call is exactly
-  # `<STATE> · <UTC> · <one line>` and nothing of what it held before. The
-  # history is not lost by that: it is in git, and — after `migrate-state-cells`
-  # — in the lane's own log, which is the file built to hold it.
-  set-row-state)
-    lane="${1-}"; phrase="${2-}"
-    [ -n "$lane" ] && [ -n "$phrase" ] || die "usage: set-row-state <lane> \"<STATE> · <one line>\"   (STATE: $ROW_STATES)" 2
-    [ "$#" -le 2 ] || die "set-row-state takes TWO arguments: the lane, and the phrase as ONE quoted string — set-row-state <lane> \"<STATE> · <one line>\". Got $# ; the shell has split the phrase, so quote it." 2
-    # EVERY TEST OF THE PHRASE IS MADE FIRST — before the resolver, before the
-    # lock and before the row is read — so a refusal leaves this checkout, the
-    # mutex and the register exactly as it found them.
-    row_state_check "$phrase"
-    # AMENDMENT 15 — the row's own spelling, which is what the commit subject
-    # and every message below then carry.
-    lane="$(canon_lane "$lane")" || exit 2
-    # THE CELL THIS REPLACES MAY BE THE MANAGED LEDGER'S MARKER (ruling
-    # 2026-10-04), and replacing it would take the lane out of the ledger's
-    # hands without the ledger: refused before the lock, nothing written.
-    managed_seam_refuse "$lane" "set-row-state"
-    acquire_lock; handle_preexisting
-    n="$(row_line "$lane")" || exit 2
-    row="$(sed -n -e "${n}p" "$LANES_FILE")"
-    srs_rc=0; row_split_state_cell "$row" || srs_rc=$?
-    case "$srs_rc" in
-      0) : ;;
-      2) die "lane $lane's row (line $n) carries $(row_sep_count "$row") ' | ' separators where a seven-column row carries 6, so WHICH TEXT IS THE STATE CELL is not knowable from the row: read from the left this write lands on one cell, read from the right on another, and one of those readings overwrites the row's handoff path. Nothing was written. A Markdown table carries a literal pipe ESCAPED — \`\\|\` — so find the unescaped ' | ' inside a cell of that row, escape it by hand with an allowed tool, commit it (\`LANES_LANE=$lane lanes-edit.sh commit \"escape a literal pipe in row $lane\"\`), and re-run." 2 ;;
-      *) die "lane $lane's row (line $n) does not open with '|' and end with '|', so it is not a row this writer can take apart. Nothing was written." 2 ;;
-    esac
-    srs_new="$ROW_STATE · $(utc_now) · $ROW_STATE_LINE"
-    srs_was="$(rstrip_spaces "$RSS_CELL")"
-    replace_line "$n" "$RSS_HEAD$srs_new $RSS_TAIL"
-    # WHAT IT SAYS IS WHAT HAPPENED, and the two are not the same act. A state
-    # phrase stamped twice inside one second is byte-identical — `utc_now` is
-    # seconds — so the row already reads exactly this, nothing is written, and
-    # "REPLACED" beside `replace_line`'s own "nothing rewritten" would be two
-    # lines of one output contradicting each other.
-    if [ "${REPLACE_LINE_NOOP:-0}" = 1 ]; then
-      note "state cell UNCHANGED: it already reads exactly this ${#srs_new} chars, to the second"
-    else
-      note "state cell REPLACED: ${#srs_was} chars → ${#srs_new} chars"
-    fi
-    # THE WHOLE LINE IN THE SUBJECT, as `append-row-status` put its whole text
-    # there: the line is capped at 240 characters by the act above, and a
-    # subject cut at 72 loses exactly the tail that says what happened.
-    msg="LANES($lane@$WS): state · $ROW_STATE · $ROW_STATE_LINE"
-    [ -n "$PRE_DIRTY_LANES" ] && msg="$msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    commit_push "$msg"
-    ;;
-
-  replace-in-row)
-    lane="${1-}"; old="${2-}"; new="${3-}"; why="${4-}"
-    [ -n "$lane" ] && [ -n "$old" ] || die "usage: replace-in-row <lane> \"<old>\" \"<new>\" [\"<why>\"]" 2
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    # THE SEAM (ruling 2026-10-04): a managed lane's row is the ledger's, and
-    # no legacy edit may write the marker's vocabulary into any row.
-    managed_seam_refuse "$lane" "replace-in-row"
-    if managed_projection_hint "$new"; then
-      die "the replacement text carries managed-owner vocabulary ('managed owner', 'managed binding', 'mode=managed' or 'managed:'), and only the managed ledger's own writer writes a managed-owner marker, and a legacy writer that wrote its vocabulary into a row would forge that lane's ownership (ruling 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\"). Nothing was written." 2
-    fi
-    acquire_lock; handle_preexisting
-    n="$(row_line "$lane")" || exit 2
-    row="$(sed -n -e "${n}p" "$LANES_FILE")"
-    c="$(count_occurrences "$row" "$old")" || exit 2
-    [ "$c" = 1 ] || die "'$old' occurs $c times in lane $lane's row (line $n); exactly 1 required" 2
-    # NOT `${row/"$old"/"$new"}` (A9 Addendum 4, R-A9-11). Bash 4.3 and later
-    # read the quotes there as "this half is a literal, not a pattern"; BASH
-    # 3.2 KEEPS THE ONES AROUND THE REPLACEMENT AS CHARACTERS, so on macOS
-    # every `replace-in-row` wrote its new text WRAPPED IN DOUBLE QUOTES. The
-    # macOS job read `| "RETIRED 2026-09-13T20:39:04Z" · …` where the register
-    # wanted `| RETIRED 2026-…`, and nothing else noticed: the write succeeded,
-    # the commit landed, and the row was quietly wrong. (The pattern half is
-    # unaffected — 3.2 does remove those quotes, which is how the replacement
-    # got made at all.) Prefix and suffix instead, so `$new` never enters the
-    # pattern machinery: `%%` leaves the shortest prefix and `#` the text after
-    # the first match, and `count_occurrences` above has already proved there
-    # is exactly one.
-    ri_pre="${row%%"$old"*}"; ri_post="${row#*"$old"}"
-    replace_line "$n" "$ri_pre$new$ri_post"
-    msg="LANES($lane@$WS): ${why:-replace-in-row}"
-    [ -n "$PRE_DIRTY_LANES" ] && msg="$msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    commit_push "$msg"
-    ;;
-
-  # AMENDMENT 8, R-A8-4 — THE UUID APPEND IS CELL-SCOPED.
-  #
-  # `replace-in-row` refuses unless its anchor occurs exactly once in the WHOLE
-  # ROW, and the anchor for a session-cell append is a transcript uuid — which
-  # the 6(c) stamp writes into the STATE cell again on every launch (`RESUMED by
-  # <uuid> … launching claude --resume <uuid>` — twice more per launched start).
-  # Measured against `origin/main` on 2026-09-12, `openRepoProject-1`'s own row
-  # carries its current uuid THREE times and its previous one three times, so
-  # the single most load-bearing new act in Amendment 8(d) — recording the
-  # transcript the harness minted — could not run on the lane the amendment was
-  # written for.
-  #
-  # So the anchor is matched INSIDE THE SESSION CELL and nowhere else, and must
-  # occur exactly once THERE. `replace-in-row`'s whole-row rule is unchanged and
-  # is still right for what it is for: a state cell says the same thing in two
-  # places all the time, and a blind replace there would rewrite the wrong one.
-  #
-  # AND THE TEXT IS APPENDED AT THE END OF THE CELL, NOT AT THE ANCHOR. This is
-  # the second half of the same finding and it is not cosmetic: the cell spells
-  # its ids `harness `<uuid>`` — inside backticks — so a replace AT a bare-uuid
-  # anchor writes `harness `<uuid> → harness <new>`` and puts the new id inside
-  # the old one's code span. The anchor's job is to prove that the cell this
-  # checkout holds is the published one the caller read (Amendment 6(b): the
-  # cell is a HISTORY, oldest first, and the last id is the lane's current
-  # session); the APPEND's job is to add a lineage after all of them. Those are
-  # two different positions, and conflating them corrupted the cell.
-  #
-  # Anything that is not an append — a cell that must really be rewritten — is
-  # `replace-in-row`'s business, in front of a person.
-  append-session-id)
-    lane="${1-}"; old="${2-}"; add="${3-}"; why="${4-}"
-    [ -n "$lane" ] && [ -n "$old" ] && [ -n "$add" ] \
-      || die "usage: append-session-id <lane> \"<anchor in the session cell>\" \"<text to append to the cell>\" [\"<why>\"]" 2
-    case "$add" in
-      *"|"*) die "append-session-id's appended text may not contain '|': it would forge a cell boundary in the row. Got '$add'." 2 ;;
-    esac
-    if managed_projection_hint "$add"; then
-      die "append-session-id's appended text carries managed-owner vocabulary ('managed owner', 'managed binding', 'mode=managed' or 'managed:'), and only the managed ledger's own writer writes it into a row. Nothing was written." 2
-    fi
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    managed_seam_refuse "$lane" "append-session-id"   # Copilot round 3 on #97
-    acquire_lock; handle_preexisting
-    n="$(row_line "$lane")" || exit 2
-    row="$(sed -n -e "${n}p" "$LANES_FILE")"
-    row_split_session_cell "$row" || die "lane $lane's row (line $n) does not have three '|' before its session cell ends; refusing to touch it" 2
-    c="$(count_occurrences "$RSC_CELL" "$old")" || exit 2
-    if [ "$c" != 1 ]; then
-      whole="$(count_occurrences "$row" "$old" || printf '?')"
-      die "'$old' occurs $c time(s) in lane $lane's SESSION CELL (line $n); exactly 1 required there. The row as a whole carries it $whole time(s) — that difference is exactly why this act is cell-scoped and not replace-in-row." 2
-    fi
-    replace_line "$n" "$RSC_HEAD$(rstrip_spaces "$RSC_CELL") $add $RSC_TAIL"
-    msg="LANES($lane@$WS): ${why:-append-session-id}"
-    [ -n "$PRE_DIRTY_LANES" ] && msg="$msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    commit_push "$msg"
-    ;;
-
-  append-line)
-    text="${1-}"; [ -n "$text" ] || die "usage: append-line \"<text>\"" 2
-    # ONE LINE, REFUSED A NEWLINE BEFORE THE LOCK (opensoft/openRepoTools#85).
-    # `append_text_line` refuses it too, and before it writes — but that is
-    # after `acquire_lock` and `handle_preexisting`, which can COMMIT a peer's
-    # uncommitted register edit before this act's own write. A refusal that has
-    # already committed something is a refusal that wrote, so the verb asks
-    # first, exactly where `write_event` asks for `log`: the checkout is left
-    # as this command found it. `lane-handoff`'s file-level PAUSED line is the
-    # caller that met it, with a `why` carrying a newline.
-    if [ "${text//[$'\n\r']/}" != "$text" ]; then
-      die "append-line appends ONE line to the register, and this text carries a newline or a carriage return: it would append several, and the proof that only one was added would fail after the write, leaving the register modified and uncommitted. Nothing was written, and the lock was not taken. Spell the break '; ' and re-run." 2
-    fi
-    # NO MARKER BY THE BACK DOOR (Copilot round 3 on #97): `add-row` refuses a
-    # row in the marker's vocabulary, and this appends any line at all to the
-    # register — a row-shaped one included.
-    if managed_projection_hint "$text"; then
-      die "the line carries managed-owner vocabulary ('managed owner', 'managed binding', 'mode=managed' or 'managed:'), and only the managed ledger's own writer writes it into the register. Nothing was written." 2
-    fi
-    lane_tag="${LANES_LANE:-}"
-    [ -z "$lane_tag" ] || lane_tag="$(canon_lane "$lane_tag")" || exit 2
-    if [ -z "$lane_tag" ]; then
-      cand="$(lane_from_text "$text")"
-      # AMENDMENT 15 — `row_lane_ci` ALONE, and the exact branch that used to
-      # sit above it is the same question asked twice now that `row_line`
-      # compares case-insensitively too. It answers with the ROW's spelling
-      # rather than the LINE's, which is what Rule 10's wire form needs: the
-      # line says `Lane: openxfactory-2` in lowercase and the row's token is
-      # `openXfactory-2`. It is still the register that decides — a candidate no
-      # row matches prints nothing, so "…names no lane at all" is never
-      # attributed to a lane called "at".
-      #
-      # AND THE 15(d) PAIR IS A REFUSAL HERE TOO, not an absence. `row_lane_ci`
-      # answers EMPTY for two rows exactly as it does for none, and an empty
-      # `lane_tag` is a commit attributed to nobody — a writer carrying on over
-      # the one register state the amendment says every writer refuses (Copilot
-      # round 1 on openRepoTools#41). `canon_lane` is asked for its STATUS only;
-      # which of "no row" and "one row" it is stays `row_lane_ci`-s answer.
-      #
-      # AMENDMENT 16(e) — AND THE NAME THE LINE CARRIES MAY BE A FORMER ONE.
-      # Rule 6 attribution is named in clause (e)'s own list of readers, and a
-      # line that says `lane <old>` is one lane's line whatever the register
-      # calls that lane today: `canon_lane` resolves it, and `row_lane_ci` still
-      # has the last word about whether any row answers at all, which is what
-      # keeps "…names no lane at all" from being attributed to a lane called
-      # "at".
-      if [ -n "$cand" ]; then
-        cand_c="$(canon_lane "$cand")" || exit 2
-        lane_tag="$(row_lane_ci "${cand_c:-$cand}")"
-      fi
-    fi
-    acquire_lock; handle_preexisting
-    append_text_line "$text"
-    msg="LANES(${lane_tag:-unknown}@$WS): append line — ${text:0:72}"
-    [ -n "$PRE_DIRTY_LANES" ] && msg="$msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    commit_push "$msg"
-    ;;
-
-  add-row)
-    row="${1-}"; [ -n "$row" ] || die "usage: add-row \"<full | row |>\"" 2
-    case "$row" in
-      "| "*) : ;;
-      *) die "a row must start with '| '" 2 ;;
-    esac
-    case "$(rstrip_spaces "$row")" in
-      *"|") : ;;
-      *) die "a row must end with '|'" 2 ;;
-    esac
-    pipes="$(count_occurrences "$row" "|")" || exit 2
-    [ "$pipes" -ge 8 ] || die "a 7-column row needs at least 8 '|' characters, found $pipes" 2
-    if managed_projection_hint "$row"; then
-      die "the new row carries managed-owner vocabulary ('managed owner', 'managed binding', 'mode=managed' or 'managed:'), and only the managed ledger's own writer writes a managed-owner marker, and a legacy writer that wrote its vocabulary into a row would forge that lane's ownership (ruling 2026-10-04: \"managed ledger owns enrolled lanes; #97 owns legacy\"). Nothing was written." 2
-    fi
-    lane_new="$(printf '%s' "$row" | cut -d'`' -f2)"
-    # AMENDMENT 15(a) — A ROW UNDER ANY CASE IS A ROW, AND THE REFUSAL NAMES IT.
-    # This is the act the 2026-09-13 incident got past: `lane-start openxfactory
-    # 2` found no row for `openXfactory-2` and appended a second one for a lane
-    # that already had one. `row_line`'s exactly-one test cannot be the whole
-    # gate here, because two rows differing only by case make it fail for the
-    # OTHER reason and a failed `row_line` used to read as "no row, go ahead".
-    #
-    # AND THE PUBLISHED ROWS ARE ASKED TOO — R19, AND R30's FETCH IN FRONT OF IT
-    # (Copilot round 4 on openRepoTools#41). The scan was of `$LANES_FILE` alone,
-    # which a fetch does not move: on a checkout that is behind, a row `origin`
-    # already carries as `repoCase-1` is invisible here, this appends
-    # `repocase-1`, and `commit_push`'s own rebase then publishes the pair — the
-    # exact duplicate 15(a) makes this command refuse, arrived at through the one
-    # file the check never read. BOTH sets are asked and either is the refusal:
-    # the local scan stays because a row added here and not yet pushed is on no
-    # `origin` at all, and the published scan is the one the incident needed.
-    if [ -n "$lane_new" ]; then
-      log_sync
-      # AND THE ARCHIVE IS ASKED AS WELL (Amendment 19(b) and (d)). A row
-      # `archive-rows` has moved into `lanes/archive/LANES-retired.md` is still
-      # that lane's row: its object log is `lanes/log/<lane>.md` and that file is
-      # APPEND-ONLY, so a second lane under the same name would write its life
-      # into the first one's file and every read of that log — who held what,
-      # when it was claimed, which session paused it — would answer for two
-      # lanes at once. `next-free` never OFFERS such a position, because it
-      # counts the archive too; this is what refuses one that is typed by hand,
-      # which is the whole of "a retired `<repo>-<n>` is never reissued".
-      # BOTH COPIES OF THE ARCHIVE (Copilot round 1 on #93): `archive_text`
-      # answers with the PUBLISHED file wherever there is one, so a move
-      # committed here and not yet pushed was invisible to this check and its
-      # name came back on offer. The local file is read beside it, exactly as
-      # the row scan below reads `rows_named_ci_local` beside `rows_named_ci`.
-      #
-      # AND A READ THAT FAILED IS A REFUSAL, not an empty archive (round 2): the
-      # whole point of this check is that a retired identity is never reissued,
-      # and "I could not read the file that says which ones are retired" is not
-      # "none of them are" (Amendment 7(d)). NOR IS A LINE IT COULD NOT TAKE
-      # APART (#122): that row may be this lane's own, so it is the same refusal
-      # and the same 1, naming the line.
-      ar_arch_rc=0
-      ar_arch="$(retired_identity_hits "$lane_new")" || ar_arch_rc=$?
-      case "$ar_arch_rc" in
-        0) : ;;
-        3) die "$LANES_ARCH_PATH carries a line this scan cannot take apart (above), so whether '$lane_new' is a name this estate has RETIRED is not known: a row this scan cannot take apart may be that lane's own, and a retired position is never reissued (Amendment 19(b)). A row that could not be read is not a row that is not there (Amendment 7(d)). Put the lane back in backticks in that row's first cell, or remove the line if it is no row; commit the archive (\`git -C $LANES_REPO commit -m \"<what it was>\" -- $LANES_ARCH_PATH\`), publish it where the line is on origin (\`LANES_LANE=<lane> lanes-edit.sh commit \"<what it was>\"\`), and re-run. Nothing was written." 1 ;;
-        *) die "$LANES_ARCH_PATH exists and could not be read or scanned, so whether '$lane_new' is a name this estate has RETIRED is not known — and a retired position is never reissued (Amendment 19(b)). A read that failed is not 'it is not retired' (Amendment 7(d)). Fix the read and re-run; nothing was written." 1 ;;
-      esac
-      if [ -n "$ar_arch" ]; then
-        die "lane '$lane_new' is RETIRED: its row is in $LANES_ARCH_PATH, spelled $(printf '%s\n' "$ar_arch" | tr '\n' ' ')— and a retired position is NEVER REISSUED (Amendment 19(b)). That lane's object log is $(log_path_for "$lane_new") and it is append-only, so a second lane under this name would write its life into the first one's file and every read of that log would answer for two lanes at once. Take a free position instead — \`lanes --prefix <repo>\` prints the next one and the line that takes it. Nothing was written." 2
-      fi
-      ar_hits="$(rows_named_ci_local "$lane_new")"
-      # THE PUBLISHED ROWS ARE READ WITH THEIR STATUS (Copilot round 21 on #93,
-      # #138 item 18). Through `|| :` a register origin has and git could not
-      # read was "no row there", and a row this checkout had not pulled was
-      # appended a second time — and landed, wherever the rebase did not clash.
-      ar_pub=""
-      ar_pub="$(rows_named_ci "$lane_new" 2>/dev/null)" ||
-        die "the published register on origin/$LANES_BRANCH could not be read, so whether '$lane_new' already has a row there is not known — and that is NOT 'it has none' (Amendment 7(d)): a row this checkout has not pulled would be added a second time. Fix the read and re-run; nothing was written." 1
-      ar_all="$(printf '%s\n%s\n' "$ar_hits" "$ar_pub" | grep -v '^$' | LC_ALL=C sort -u || :)"
-      ar_n="$(printf '%s' "$ar_all" | grep -c . || :)"
-      ar_ln="$(printf '%s' "$ar_hits" | grep -c . || :)"
-      if [ "$ar_n" -gt 0 ]; then
-        # A LANE THE MANAGED LEDGER OWNS IS SAID TO BE ONE (Copilot round 3 on
-        # #97) before the duplicate refusal below, which would refuse it anyway
-        # without naming the owner. A new lane has no row and is never asked.
-        managed_seam_refuse "$lane_new" "add-row"
-        ar_more=""
-        [ "$ar_n" -gt 1 ] && ar_more=" Those $ar_n rows differ only by case and are themselves the refusal: merge them into one row first (Amendment 15(d))."
-        ar_where="Use set-row-state / replace-in-row on the row that is there."
-        [ "$ar_ln" = 0 ] && ar_where="That row is on origin/$LANES_BRANCH and this checkout has not pulled it, so adding one here would make two the moment this push rebases. Pull first — \`git -C $LANES_REPO pull --rebase\` — then use set-row-state / replace-in-row on the row that is there."
-        die "lane '$lane_new' already has a row, spelled $(printf '%s\n' "$ar_all" | tr '\n' ' ')— a lane name is ONE name under any case (Amendment 15(a)), so a row under another case IS that lane's row and this would be a second one. $ar_where$ar_more" 2
-      fi
-    fi
-    acquire_lock; handle_preexisting
-    append_text_line "$row"
-    msg="LANES(${lane_new:-${LANES_LANE:-unknown}}@$WS): add row"
-    [ -n "$PRE_DIRTY_LANES" ] && msg="$msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    ADD_ROW_LANE="$lane_new"
-    ADD_ROW_TEXT="$row"
-    CP_AFTER_REBASE=add_row_retirement_rescan
-    commit_push "$msg"
-    ar_push_rc=$?
-    CP_AFTER_REBASE=""
-    exit "$ar_push_rc"
-    ;;
-
-  commit)
-    msg="${1-}"; [ -n "$msg" ] || die "usage: commit \"<message>\"" 2
-    # AMENDMENT 15 — `$LANES_LANE` passes through the resolver like every
-    # `<lane>` argument does: it is the attribution in this commit's subject and
-    # the name the "touches other rows" test compares against.
-    [ -z "${LANES_LANE:-}" ] || LANES_LANE="$(canon_lane "$LANES_LANE")" || exit 2
-    acquire_lock
-    # `commit` has no edit of its own to separate from a pre-existing one —
-    # its whole job is to wrap whatever is already dirty (a hand edit made
-    # with an allowed tool). The best it can do is warn when that dirty
-    # content ALSO touches a ROW other than the caller's own $LANES_LANE,
-    # and say so in the commit subject (0d84d34: a hermes-wallet-exercise
-    # `commit` call silently absorbed an unrelated openXfactory-2 row edit).
-    # "append" (a plain line with no row of its own, e.g. this call's own
-    # Rule 6 LANDING/LANDED line) is excluded from "other" — it is the
-    # normal, expected shape of exactly what `commit` is for, and flagging
-    # it would warn on every ordinary use.
-    if [ "$NO_GIT" != 1 ] && ! git -C "$LANES_REPO" diff --quiet -- "${CP_PATHS[@]}" 2>/dev/null; then
-      touched="$(identify_changed_lanes)"
-      other="$(printf '%s\n' "$touched" | tr ',' '\n' | grep -v -x -e "${LANES_LANE:-}" -e '' -e 'append' | paste -sd, - 2>/dev/null || :)"
-      if [ -n "$other" ]; then
-        note "WARNING: uncommitted LANES.md changes touch row(s) other than this lane (${LANES_LANE:-unknown}): $other"
-        warn_dirty
-        msg="$msg + sweeps uncommitted edit to row $other"
-      fi
-    fi
-    # #194 — the one write that, with nothing to stage, publishes the local
-    # commits ahead of origin: it is the RECOVERY's re-run. See commit_push.
-    CP_PUBLISH_AHEAD=1
-    commit_push "LANES(${LANES_LANE:-unknown}@$WS): $msg"
-    ;;
-
-  # AMENDMENT 19(c) — THE SWEEP'S WRITE. `lane-end --retire-dormant <repo>` is
-  # the word that finds the dormant rows, shows the dry run and takes the
-  # person's `--yes`; this is the one commit under it, and it re-proves every
-  # refusal for itself rather than trusting the caller's list.
-  retire-rows)
-    retire_rows ${1+"$@"}
-    ;;
-
-  # AMENDMENT 19(d) — THE ARCHIVE. A DRY RUN unless `--yes` is passed, like the
-  # migration beside it, and one commit naming each lane moved when it is.
-  archive-rows)
-    ar_repo=""; ar_yes=0
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --yes)     ar_yes=1; shift ;;
-        --dry-run) ar_yes=0; shift ;;
-        --)        shift ;;
-        -*)        die "unknown option '$1' for archive-rows (usage: archive-rows <repo> [--yes])" 2 ;;
-        *)         [ -z "$ar_repo" ] || die "archive-rows takes ONE repository: archive-rows <repo> [--yes]" 2
-                   ar_repo="$1"; shift ;;
-      esac
-    done
-    [ -n "$ar_repo" ] || die "usage: archive-rows <repo> [--yes]   —  without --yes it is a DRY RUN that writes nothing" 2
-    archive_rows "$ar_repo" "$ar_yes"
-    ;;
-
-  # ====================================================== AMENDMENT 16 =======
-  #
-  # `rename-lane <old> <new> ["<why>"] [--verbatim] [--no-github]` — A LANE IS
-  # RENAMED IN ONE COMMIT, REFUSED OR WHOLE, AND ITS OLD NAME RESOLVES FOR EVER.
-  #
-  # Ratified 2026-09-14T09:24:35Z, verbatim *"Ratify as drafted (Recommended)"*,
-  # on Brett Heap's request of the same day, verbatim *"we need the ability to
-  # rename a lane"*. `lane-rename <old> <new>` on PATH is the word a person
-  # types; THIS is its write. The two are one act only because the word also
-  # renames the tmux window and types `/rename <new>` into the pane — neither of
-  # which a register writer may do for a session it is not (Amendment 16(f), and
-  # Amendment 12(h)'s M1 for why the typing is the only path a running session's
-  # name has).
-  #
-  # FOUR MOVES, ONE COMMIT (clauses (b)–(e)): the row's key cell, the object
-  # log, the handoff, and `lanes/aliases.tsv`. They are one commit because ANY
-  # TWO OF THEM APART IS A STATE NO READER CAN READ — a row under `<new>` whose
-  # log is still `<old>.md` is a lane whose history `who --lane` cannot find, and
-  # an alias without the row it points at is a name that resolves to nothing. So
-  # every refusal in clause (a) is made BEFORE THE FIRST BYTE IS WRITTEN, and
-  # each one of them says "Nothing was written": this command moves four files
-  # and a half-done rename is not something a second run can finish.
-  #
-  # AND THE `git mv` OF CLAUSES (c) AND (d) IS A PLAIN `mv` PLUS A PATHSPEC.
-  # `git mv` is one command and it also STAGES, which is the one thing this file
-  # never does: `commit_push` commits from its PATHSPECS precisely so that a
-  # peer's uncommitted work in this shared checkout can never be swept into a
-  # lane's commit (Amendment 5(d), and the sweep that made `--no-sweep` the
-  # default). Both paths go in as pathspecs of the one commit and git records
-  # the rename from the content, as it always does. `ensure_log`'s two-step
-  # `mv` is not needed either: a case-ONLY rename is refused below, so the two
-  # names are two files on every filesystem this ships to.
-  rename-lane)
-    rl_old=""; rl_new=""; rl_why=""; rl_verbatim=0
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --verbatim)  rl_verbatim=1; shift ;;
-        --no-github) NO_GITHUB=1; shift ;;
-        --why)       rl_why="${2-}"; [ -n "$rl_why" ] || die "--why needs a reason" 2; shift 2 ;;
-        --why=*)     rl_why="${1#--why=}"; [ -n "$rl_why" ] || die "--why needs a reason" 2; shift ;;
-        --)          shift ;;
-        -*)          die "unknown option '$1' for rename-lane" 2 ;;
-        *)
-          if   [ -z "$rl_old" ]; then rl_old="$1"
-          elif [ -z "$rl_new" ]; then rl_new="$1"
-          elif [ -z "$rl_why" ]; then rl_why="$1"
-          else die "rename-lane takes <old> <new> [\"<why>\"] — '$1' is one argument too many" 2
-          fi
-          shift ;;
-      esac
-    done
-    [ -n "$rl_old" ] && [ -n "$rl_new" ] \
-      || die "usage: rename-lane <old> <new> [\"<why>\"] [--verbatim] [--no-github]" 2
-    check_lane_name "$rl_old"
-    check_lane_name "$rl_new"
-    if managed_projection_hint "$rl_new"; then
-      die "the new name '$rl_new' carries managed-owner vocabulary ('managed-owner' or 'managed-binding'), so the row it is written into would read as a malformed managed-owner marker — ownership UNKNOWN for every act. Choose another name. Nothing was written." 2
-    fi
-    # THE REASON IS FREE TEXT ON AN APPEND-ONLY LINE, so it takes the writer's
-    # own two rules before anything else is read (`write_event` states both): a
-    # third ` — ` leaves the line ambiguous to its own parser, and a newline
-    # appends lines to a file whose proof counts exactly one.
-    case "$rl_why" in
-      *" — "*) die "the reason may not contain ' — ': that separator divides an event line's verb from its fields and its fields from its free text, and a third one leaves the line ambiguous to its own parser, in a file nothing ever rewrites. Use a semicolon or a colon: '$rl_why'" 2 ;;
-    esac
-    if [ "${rl_why//[$'\n\r']/}" != "$rl_why" ]; then
-      die "the reason is ONE line: a newline in it would append several lines to an append-only log, and the proof that only one was added would fail after the write rather than before it" 2
-    fi
-    rl_utc="$(utc_now)"
-    [ -n "$rl_why" ] || rl_why="renamed with lane-rename (lane-collision-protocol Amendment 16)"
-
-    # ---- (a) THE REFUSALS. The fetch first, because every read below is of
-    # `origin/<branch>` (R19, R30) — a rename computed from a checkout that is
-    # behind is a rename whose push rebases into two rows.
-    log_sync
-    # AND THE OLD NAME GOES THROUGH THE RESOLVER LIKE ANY OTHER, WHICH MAKES
-    # RENAMING UNDER AN ANCIENT NAME WORK: `canon_lane` answers with the row's
-    # own spelling, and with clause (e) behind it a name this lane was called
-    # two renames ago renames the lane it is now.
-    rl_crc=0
-    rl_old="$(canon_lane "$rl_old")" || rl_crc=$?
-    # ONE CONDITION, ONE CODE (Copilot round 6 on openRepoTools#81). `canon_lane`
-    # answers 66 for an alias table it could not read so that `canon-lane`'s four
-    # callers can tell it from a refusal — but a flat `|| exit 2` here made THIS
-    # writer answer 2 or 1 for the same fault depending on whether the typed name
-    # happened to have a row of its own, because a name with one never reaches
-    # the table at all. Translated to this command's own 1, which is what its
-    # other two alias-read refusals already spend and what the amendment's
-    # fail-closed rule is about.
-    case "$rl_crc" in
-      0) : ;;
-      66) die "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), and a rename whose alias table cannot be read is a rename whose old name may stop resolving — which is the one thing clause (e) promises for ever, so this fails closed. Nothing was written." 1 ;;
-      *) exit 2 ;;
-    esac
-    # THE OLD NAME'S LIFECYCLE CONTROL ROOT, read while the old name still has
-    # its log (openRepoTools#91; `lane_state_rename` moves it after the commit).
-    rl_lsr_old="$(lane_control_root "$rl_old" 2>/dev/null)" || rl_lsr_old=""
-    # THE SEAM (ruling 2026-10-04). A managed lane's marker names its lane as
-    # `bound-lane=`, so renaming the row under it would turn a valid marker into
-    # an unparseable one; the rename is the ledger's, and refused before the lock.
-    managed_seam_refuse "$rl_old" "rename-lane"
-
-    # ---- THE MUTEX IS TAKEN BEFORE THE CHECKS, NOT BETWEEN THEM AND THE WRITE
-    # (Copilot round 6 on openRepoTools#81). Every refusal below reads a row, a
-    # log path, the alias table and a handoff, and every one of them is a
-    # question about what is NOT there — so two renames on one workstation could
-    # both answer "the target is free", and the second would move its log over
-    # the first's and rewrite a row it read before the first commit. The lock is
-    # this workstation's serialiser and it costs nothing to take it early: it is
-    # not a write, every refusal below still writes nothing, and `cleanup`
-    # releases it on every path out, the two signals included.
-    #
-    # ACROSS WORKSTATIONS the arbiter is the same one Rule 1's claim has:
-    # whichever commit lands on `main` first. `commit_push`'s rebase brings the
-    # other's row and log in, and the loser's next attempt meets its own
-    # refusals — a row under `<new>`, a published log — with nothing written.
-    acquire_lock
-
-    # Refuse a spelling-only rename before probing both roots: on a
-    # case-insensitive filesystem they are the same intent, whose stored lane
-    # carries the canonical spelling rather than the requested new spelling.
-    if [ "$(lc "$rl_old")" = "$(lc "$rl_new")" ]; then
-      die "'$rl_old' and '$rl_new' are ONE name under any case (Amendment 15), so this is not a rename at all: it is a change to the row's own SPELLING, which every reader already resolves to and which Amendment 15(d) makes a hand act — the newer row's session id(s) appended to the older row's cell, in one commit. Nothing was written." 2
-    fi
-
-    # Rename and restart publication share this mutex. An unfinished operation
-    # owns its name and canonical inputs, including recovery from failed.
-    for rl_check in "$rl_old" "$rl_new"; do
-      rl_root_rc=0
-      lane_restart_control_root "$rl_check" >/dev/null || rl_root_rc=$?
-      [ "$rl_root_rc" != 8 ] || continue  # no root any writer could have used
-      [ "$rl_root_rc" = 0 ] || die "restart control root could not be read. Nothing was written." 1
-      rl_restart=""; rl_restart_rc=0
-      rl_restart="$(lane_restart_read "$rl_check")" || rl_restart_rc=$?
-      case "$rl_restart_rc" in
-        8) continue ;;
-        0) rl_restart_state="$(printf '%s\n' "$rl_restart" | awk -F'\t' '$1=="state" {print $2; exit}')"
-           [ "$rl_restart_state" = ready ] || die "lane $rl_check has restart intent $rl_restart_state; finish its supervised recovery before renaming. Nothing was written." 2 ;;
-        *) die "lane $rl_check restart intent could not be read. Nothing was written." 1 ;;
-      esac
-    done
-
-    rl_oh="$(rows_named_ci "$rl_old" 2>/dev/null || :)"
-    rl_on="$(printf '%s' "$rl_oh" | grep -c . || :)"
-    rl_lh="$(rows_named_ci_local "$rl_old" 2>/dev/null || :)"
-    rl_ln="$(printf '%s' "$rl_lh" | grep -c . || :)"
-    if [ "$rl_on" -gt 1 ] || [ "$rl_ln" -gt 1 ]; then
-      die "the register holds rows whose lane names differ only by case for '$rl_old': $(printf '%s\n%s\n' "$rl_oh" "$rl_lh" | grep -v '^$' | LC_ALL=C sort -u | tr '\n' ' ')— a lane name is ONE name under any case (Amendment 15), so there is no ONE row to rename. Merge them first (Amendment 15(d)): append the newer row's session id(s) to the older row's session cell, in order, and remove the newer row in the SAME commit. Nothing was written." 2
-    fi
-    if [ "$rl_ln" = 0 ]; then
-      if [ "$rl_on" = 1 ]; then
-        die "lane $rl_old's row is on origin/$LANES_BRANCH and this checkout has not pulled it, so the row this rename must rewrite is not here — and a rename that appended a second row would be the very duplicate Amendment 15(a) refuses. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2
-      fi
-      die "the register has no row for lane '$rl_old', in any case (Amendment 15(a)) and through no alias (Amendment 16(e)). A rename moves a row that exists; \`lanes --all\` lists the ones that do. Nothing was written." 2
-    fi
-
-    # A ROW UNDER `<new>` IN ANY CASE, asked of BOTH the published register and
-    # this copy of it — `add-row`'s own pair of scans, for its own reason: a row
-    # `origin` already carries is invisible to a local scan, and this push would
-    # rebase the two together.
-    rl_nh="$(printf '%s\n%s\n' "$(rows_named_ci "$rl_new" 2>/dev/null || :)" "$(rows_named_ci_local "$rl_new" 2>/dev/null || :)" | grep -v '^$' | LC_ALL=C sort -u || :)"
-    if [ -n "$rl_nh" ]; then
-      die "lane '$rl_new' already has a row, spelled $(printf '%s\n' "$rl_nh" | tr '\n' ' ')— a lane name is ONE name under any case (Amendment 15(a)), so renaming into it would make TWO rows for one name, which is the state every writer in this file refuses until 15(d)'s merge. Nothing was written." 2
-    fi
-
-    # `<new>` IS `<repo>-<n>` UNLESS `--verbatim` NAMES IT. Rule 4's form is
-    # what `lanes --prefix`, the next free position and `lane-start <repo> <n>`
-    # are all computed from, so a lane renamed out of it loses every one of
-    # them; Amendment 11's `--dir` lanes are the deliberate exception the flag
-    # exists for.
-    if [ "$rl_verbatim" = 0 ] && ! lane_shaped "$rl_new"; then
-      die "'$rl_new' is not of the form <repo>-<n> (Rule 4), and a lane renamed out of that form loses the next free position, the \`lane-start <repo> <n>\` that takes it and the whole of \`lanes --prefix\`. A lane deliberately named otherwise — Amendment 11's \`--dir\` lanes are the ones there are — is renamed with --verbatim. Nothing was written." 2
-    fi
-
-    # A `<new>` THAT IS ALREADY AN ALIAS KEY IS REFUSED (Copilot round 1 on
-    # openRepoTools#81). A row wins over an alias at every hop — that is what
-    # makes a name that is a lane today BE that lane — so minting a row under a
-    # name some other lane was renamed AWAY from would end that lane's old name
-    # resolving, which is the one thing clause (e) promises never happens. The
-    # refusal is here, at the one writer that can do it deliberately; a row
-    # minted under a freed name by `lane-start` is a different act and the
-    # readers handle it by the row-wins rule itself.
-    rl_krc=0
-    rl_keys="$(lane_alias_keys 2>/dev/null)" || rl_krc=$?
-    if [ "$rl_krc" = 5 ]; then
-      die "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), and a rename whose alias table cannot be read is a rename whose old name may stop resolving — which is the one thing clause (e) promises for ever, so this fails closed. Nothing was written." 1
-    fi
-    rl_kmatch="$(printf '%s\n' "$rl_keys" | awk -v w="$rl_new" 'BEGIN { lw = tolower(w) } NF && tolower($0) == lw { print; exit }')"
-    if [ -n "$rl_kmatch" ]; then
-      die "'$rl_new' is already a FORMER name in ${LANES_ALIASES_PATH:-lanes/aliases.tsv} (spelled '$rl_kmatch'), and a row under it would take precedence over that alias — which would end a lane's old name resolving, the one thing Amendment 16(e) promises for ever. Pick a name no lane has ever been called. Nothing was written." 2
-    fi
-
-    # A CYCLE, ASKED OF THE TABLE AS IT WILL BE (clause (e)). Adding `<old> →
-    # <new>` closes one exactly when the chain from `<new>` reaches `<old>`,
-    # anywhere along it — the new row is appended last and wins the key.
-    rl_arc=0
-    lane_alias_target "$rl_new" "$rl_old" >/dev/null 2>&1 || rl_arc=$?
-    case "$rl_arc" in
-      0 | 1) : ;;
-      3) die "${LANES_ALIASES_PATH:-lanes/aliases.tsv} already resolves '$rl_new' in a CYCLE, so nothing can be added through it until that row is taken out by hand. \`rename-lane\` writes no cycle, so this table was hand-edited. Nothing was written." 2 ;;
-      4) die "renaming $rl_old to $rl_new would close a CYCLE in ${LANES_ALIASES_PATH:-lanes/aliases.tsv}: '$rl_new' already resolves back through '$rl_old', and a chain that returns to its own start has no end for a reader to resolve to (Amendment 16(e)). Nothing was written." 2 ;;
-      *) die "${LANES_ALIASES_PATH:-lanes/aliases.tsv} could not be read ($(lane_alias_err)), and a rename whose alias table cannot be read is a rename whose old name may stop resolving — which is the one thing clause (e) promises for ever, so this fails closed. Nothing was written." 1 ;;
-    esac
-
-    # THE SESSION FIELD OF THE `RENAMED` LINE IS A TRANSCRIPT UUID AND ONLY
-    # THAT (Amendment 7(b), R-A11 (e)) — asked HERE, with the other refusals,
-    # rather than by `write_event`, because this write does not go through
-    # `write_event`: its line lands in the same commit as three file moves.
-    rl_uuid="$(session_for "$rl_old")"
-    if ! valid_uuid "$rl_uuid"; then
-      die "an event's session field is the TRANSCRIPT UUID and only that (Amendment 7(b)), and this rename's RENAMED line has none: '${rl_uuid:-<empty>}'. Name the session taking the act: LANES_SESSION=\"\$CLAUDE_CODE_SESSION_ID\" lanes-edit.sh rename-lane $rl_old $rl_new. Nothing was written." 2
-    fi
-
-    # A LIVE SESSION HOLDING `<old>` IN ANOTHER WINDOW.
-    #
-    # THE WINDOW THIS COMMAND RUNS IN IS EXEMPT, AND IT IS THE ORDINARY CASE: a
-    # lane renames ITSELF, from its own pane, which is the whole of clause (f).
-    # `live_holder`'s fifth field is the verdict that tells the two apart —
-    # `here`, `elsewhere`, `orphan` — and it is the same read `lane-start`
-    # refuses a name over. The id SET is the published row's union this
-    # checkout's (R25), for that rule's reason: liveness fails CLOSED here, so
-    # an id `origin` has not seen yet is one more reason to refuse.
-    rl_ids="$( { session_ids_of_lane "$rl_old" 2>/dev/null || :
-                 session_ids_local_of_lane "$rl_old" 2>/dev/null || :; } | awk 'NF && !seen[$0]++')"
-    rl_lhv=""; rl_lhrc=0
-    rl_lhv="$(live_holder "$rl_old" "$rl_ids" 2>/dev/null)" || rl_lhrc=$?
-    case "$rl_lhrc" in
-      8) : ;;
-      0)
-        IFS="$US" read -r rl_hsid rl_htgt rl_hname rl_hpid rl_hverdict <<EOF
-$rl_lhv
-EOF
-        if [ "${rl_hverdict:-}" != here ]; then
-          die "a LIVE session holds lane $rl_old and it is not this window's: session $rl_hsid, pid $rl_hpid, named '${rl_hname:-none}', window ${rl_htgt:-none} (${rl_hverdict:-unknown}). Clause (a) refuses that, and clause (f) is why: the session's own NAME is locked to the lane (Amendment 12(h)) and only the session itself can change it, so a rename made from anywhere else leaves a running conversation named for a lane the register no longer has. Run \`lane-rename $rl_old $rl_new\` in THAT window, or hand the lane off first (\`lane-handoff\`) and rename it once it is paused. Nothing was written." 2
-        fi ;;
-      *) die "could not read this workstation's session records for lane $rl_old: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no live session holds it' — clause (a) refuses on a LIVE holder, so a read that could not be made fails closed (R22). Fix the records or the permissions and re-run. Nothing was written." 1 ;;
-    esac
-
-    # ---- THE FOUR PATHS, ALL COMPUTED BEFORE ANYTHING MOVES.
-    rl_log_new_rel="$(log_path_for "$rl_new")"
-    rl_log_new="$(log_file_for "$rl_new")"
-    # THE TARGET LOG IS LOOKED FOR UNDER ANY CASE, here and on `origin`
-    # (Copilot round 1 on openRepoTools#81). The exact-path test missed an
-    # orphan `lanes/log/<NEW>.md` of another spelling on a case-SENSITIVE
-    # filesystem — Linux and WSL2, where this estate runs — and a rename into it
-    # would leave two case-variant histories for one lane, which is the state
-    # Amendment 15(d) makes a hand merge. `log_files_named_ci` and the published
-    # `ls-tree` scan are the same two reads every other case question here uses.
-    rl_nlocal="$(log_files_named_ci "$rl_new")"
-    if [ -n "$rl_nlocal" ]; then
-      die "lane '$rl_new' has no row and this checkout already carries $(printf '%s\n' "$rl_nlocal" | tr '\n' ' ')— an object log under that name, in some case. That file is not this rename's to write into, and appending one lane's history to another's is the one thing an append-only log cannot be walked back from. Nothing was written." 2
-    fi
-    if have_remote_ref; then
-      rl_npub="$(git -C "$LANES_REPO" ls-tree --name-only "origin/$LANES_BRANCH" -- "$LANES_LOG_PREFIX" 2>/dev/null \
-        | awk -v want="$rl_log_new_rel" 'BEGIN { w = tolower(want) } tolower($0) == w')"
-      if [ -n "$rl_npub" ]; then
-        die "$(printf '%s\n' "$rl_npub" | tr '\n' ' ')is published on origin/$LANES_BRANCH while lane '$rl_new' has no row — renaming into it would merge two lanes' histories into one append-only file. Nothing was written." 2
-      fi
-    fi
-    rl_lfhits="$(log_files_named_ci "$rl_old")"
-    rl_lfn="$(printf '%s' "$rl_lfhits" | grep -c . || :)"
-    if [ "$rl_lfn" -gt 1 ]; then
-      die "lane $rl_old has $rl_lfn object logs whose names differ only by case: $(printf '%s\n' "$rl_lfhits" | tr '\n' ' ')— one lane is ONE lane under any case and its log is ONE file (Amendment 15). Merge them by hand into $(log_file_for "$rl_old"), oldest lines first, remove the others in the same commit (15(d)), and re-run. Nothing was written." 2
-    fi
-    rl_log_old=""; rl_log_old_rel=""
-    if [ "$rl_lfn" = 1 ]; then
-      rl_log_old="$rl_lfhits"; rl_log_old_rel="${LANES_LOG_PREFIX}${rl_log_old##*/}"
-      # A SYMLINK IS NOT THIS LANE'S LOG (Copilot round 4 on openRepoTools#81).
-      # `ls` lists one like any other file, `mv` moves the LINK, and
-      # `append_text_line`'s `>>` then writes the RENAMED line THROUGH it — into
-      # whatever is at the far end, which may be outside this repository
-      # altogether, while the commit records only the link. The same rule
-      # `openRepoTools --install` states for every target it places: `cp`
-      # follows a symlink, so a symlink is a refusal and not a file.
-      if [ -L "$rl_log_old" ]; then
-        die "lane $rl_old's object log at $rl_log_old is a SYMLINK. An append-only log is written in place — the RENAMED line would go through the link into whatever is at the far end, and the commit would record the link — so this rename is not made over one. Replace it with the file itself and re-run. Nothing was written." 2
-      fi
-      # AND A REGULAR FILE, NOT MERELY NOT-A-SYMLINK (Copilot round 5). `ls`
-      # lists a FIFO like any other name, and the snapshot's `cat` of one BLOCKS
-      # — for ever, holding this lane's mutex — where a refusal costs a second.
-      if [ ! -f "$rl_log_old" ]; then
-        die "lane $rl_old's object log at $rl_log_old is not a regular file. An append-only log is read whole for the rollback copy and appended to in place, and neither can be done to that — a FIFO there would block this write, and its lock, indefinitely. Nothing was written." 2
-      fi
-      # AND GIT MUST ALREADY KNOW IT (Copilot round 6 on openRepoTools#81).
-      # `refuse_dirty_checkout` reads `tracked_dirty`, which reports no untracked
-      # file, so a peer's uncommitted `lanes/log/<old>.md` walked past it — and
-      # this rename would MOVE that file to a path it always stages, committing
-      # somebody else's lines under its own message. Round 3 kept the old path
-      # out of the pathspecs when it was untracked, which stopped `git add`
-      # failing and did nothing about the content.
-      if [ "$NO_GIT" != 1 ] \
-         && ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$rl_log_old_rel" >/dev/null 2>&1; then
-        die "lane $rl_old's object log at $rl_log_old_rel exists here and git does not track it, so its lines have never been committed by anyone — and this rename would move them to $rl_log_new_rel and commit them under its own message. Whoever wrote them commits them first: \`git -C $LANES_REPO add -- $rl_log_old_rel && git -C $LANES_REPO commit -m \"handoff(<lane>@<workstation>): <what>\"\`. Nothing was written." 2
-      fi
-    fi
-    if have_remote_ref; then
-      rl_pub="$(log_path_ci "$rl_old")" || die "lane $rl_old's object log is published twice (above), and one lane is ONE lane under any case: its log is ONE file (Amendment 15). Merge them by hand (15(d)) and re-run. Nothing was written." 2
-      if [ "$rl_pub" != "$rl_log_old_rel" ] && git -C "$LANES_REPO" cat-file -e "origin/$LANES_BRANCH:$rl_pub" 2>/dev/null; then
-        die "lane $rl_old's object log is published as $rl_pub while this checkout has ${rl_log_old_rel:-no log for it at all}: a rename made from here would move one file and leave the other, which is two logs for one lane by the path \`ensure_log\` exists to close. Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2
-      fi
-    fi
-
-    # AND THE ALIAS TABLE `origin` CARRIES AND THIS CHECKOUT DOES NOT (Copilot
-    # round 3 on openRepoTools#81). The READ prefers `origin/<branch>`, while
-    # the APPEND is to the file on disk — so on a checkout that is behind, this
-    # would create a fresh table holding ONE mapping, and the commit would
-    # either drop every alias already published or meet an add/add conflict in
-    # its own rebase. Every name renamed before today would stop resolving,
-    # which is the one thing clause (e) promises never happens. The cure is the
-    # one the row and the log guards above already name.
-    # AND THE ALIAS TABLE IS A FILE, NOT A LINK (Copilot round 4). The append is
-    # a `>>`, which follows one: a live link would put this estate's permanent
-    # alias into an arbitrary target and a dangling one would create it, while
-    # git staged only the link path.
-    if [ -L "$LANES_ALIASES_TSV" ]; then
-      die "$LANES_ALIASES_PATH is a SYMLINK at $LANES_ALIASES_TSV. The alias row is appended in place and a redirect follows a link, so it would be written at the far end while this commit recorded the link — and the alias is the one thing that makes a renamed lane's old name resolve for ever (Amendment 16(e)). Replace it with the file itself and re-run. Nothing was written." 2
-    fi
-    if [ -e "$LANES_ALIASES_TSV" ] && [ ! -f "$LANES_ALIASES_TSV" ]; then
-      die "$LANES_ALIASES_PATH at $LANES_ALIASES_TSV is not a regular file. The alias row is appended in place and the table is read whole for the rollback copy — a FIFO there would block this write, and its lock, indefinitely. Nothing was written." 2
-    fi
-    # AN EXISTING UNTRACKED TABLE IS SOMEBODY'S HAND EDIT (Copilot round 5 on
-    # openRepoTools#81). `refuse_dirty_checkout` reads `tracked_dirty`, which
-    # deliberately omits untracked files — so before this estate's FIRST rename
-    # an untracked `lanes/aliases.tsv` walked past the guard and its contents
-    # were appended to and committed inside this lane's rename. The only writer
-    # of that file is this command, and this command commits what it writes, so
-    # an untracked one was written by hand or left by a run that died.
-    if [ "$NO_GIT" != 1 ] && [ -f "$LANES_ALIASES_TSV" ] \
-       && ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$LANES_ALIASES_PATH" >/dev/null 2>&1; then
-      die "$LANES_ALIASES_PATH exists here and git does not track it, so it was written by hand or left behind by a run that died — and appending this rename's alias to it would commit somebody else's lines inside this lane's commit. \`rename-lane\` is the only writer of that file and it commits what it writes. Commit it or remove it, and re-run. Nothing was written." 2
-    fi
-    # AND A TABLE WHOSE LAST BYTE IS NOT A NEWLINE IS REFUSED (Copilot round 5).
-    # `append_text_line`'s `>>` would put this rename's record on the END of the
-    # previous line — and its own proof passes, because the bytes it builds to
-    # compare are concatenated the same way. The TSV parser then never sees the
-    # new alias at all: the rename would commit and the old name would not
-    # resolve, which is the one thing clause (e) promises. Refused rather than
-    # repaired, because appending a newline to a file this command did not write
-    # is an edit to somebody else's lines.
-    if [ -f "$LANES_ALIASES_TSV" ] && [ -s "$LANES_ALIASES_TSV" ] \
-       && [ "$(tail -c 1 -- "$LANES_ALIASES_TSV" | od -An -c | tr -d ' ')" != '\n' ]; then
-      die "$LANES_ALIASES_PATH does not end with a newline, so appending this rename's record would join it to the last line and the table's own parser would never see the new alias — the rename would land and '$rl_old' would stop resolving (Amendment 16(e)). Put a newline at its end and re-run. Nothing was written." 2
-    fi
-    if have_remote_ref && [ ! -f "$LANES_ALIASES_TSV" ] \
-       && git -C "$LANES_REPO" cat-file -e "origin/$LANES_BRANCH:$LANES_ALIASES_PATH" 2>/dev/null; then
-      die "$LANES_ALIASES_PATH is published on origin/$LANES_BRANCH and this checkout does not have it, so appending here would write a table holding only this one rename and drop every alias already published — every name renamed before today would stop resolving (Amendment 16(e)). Pull first — \`git -C $LANES_REPO pull --rebase\` — and re-run. Nothing was written." 2
-    fi
-
-    # THE ROW, AND ITS TWO CELLS. Read before the lock because nothing between
-    # here and the write changes a byte of it — `capture_register_edit` and
-    # `handle_preexisting` commit what is already there, they do not edit it.
-    rl_n="$(row_line "$rl_old")" || exit 2
-    rl_row="$(sed -n -e "${rl_n}p" "$LANES_FILE")"
-    case "$rl_row" in *"|"*) : ;; *) die "lane $rl_old's row (line $rl_n) has no '|' at all; refusing to touch it. Nothing was written." 2 ;; esac
-    rl_rest="${rl_row#*|}"
-    case "$rl_rest" in *"|"*) : ;; *) die "lane $rl_old's row (line $rl_n) has one cell and no second '|'; refusing to touch it. Nothing was written." 2 ;; esac
-    rl_head="${rl_row%%|*}|"
-    rl_cell="${rl_rest%%|*}"
-    rl_tail="|${rl_rest#*|}"
-    [ "$rl_head$rl_cell$rl_tail" = "$rl_row" ] || die "lane $rl_old's row (line $rl_n) does not reassemble from its first cell; refusing to touch it. Nothing was written." 2
-    rl_tok="\`$rl_old\`"
-    case "$rl_cell" in
-      *"$rl_tok"*) : ;;
-      *) die "lane $rl_old's row (line $rl_n) does not spell its lane \`$rl_old\` in its first cell, so there is no key cell to rewrite. Nothing was written." 2 ;;
-    esac
-    # (b) THE KEY CELL. Prefix and suffix, never `${cell/"$old"/"$new"}`: BASH
-    # 3.2 keeps the quotes around the REPLACEMENT half as characters, which is
-    # what once wrote a whole register cell wrapped in double quotes on the
-    # macOS job (`replace-in-row` states the measurement).
-    rl_cpre="${rl_cell%%"$rl_tok"*}"
-    rl_cpost="${rl_cell#*"$rl_tok"}"
-    rl_newcell="$(rstrip_spaces "$rl_cpre\`$rl_new\`$rl_cpost") *(ex \`$rl_old\`, renamed $rl_utc)* "
-    rl_newrow="$rl_head$rl_newcell$rl_tail"
-
-    # (d) THE HANDOFF CELL IS COUNTED FROM THE LEFT — awk field 7, the SIXTH
-    # cell — and never back from NF: the live register carries rows with a
-    # literal `|` inside a later cell, and counting back from the end puts the
-    # handoff two cells out on exactly those rows (`handoff_of_lane` says so at
-    # length). Six pipes consumed, then the cell, then the rest.
-    rl_pre=""; rl_rem="$rl_newrow"; rl_i=0
-    while [ "$rl_i" -lt 6 ]; do
-      case "$rl_rem" in *"|"*) : ;; *) break ;; esac
-      rl_pre="$rl_pre${rl_rem%%|*}|"; rl_rem="${rl_rem#*|}"; rl_i=$((rl_i + 1))
-    done
-    rl_hc=""; rl_hpost=""; rl_hsplit=0
-    if [ "$rl_i" = 6 ]; then
-      case "$rl_rem" in
-        *"|"*) rl_hc="${rl_rem%%|*}"; rl_hpost="|${rl_rem#*|}"; rl_hsplit=1 ;;
-      esac
-    fi
-    [ "$rl_hsplit" = 1 ] && [ "$rl_pre$rl_hc$rl_hpost" = "$rl_newrow" ] || {
-      rl_hsplit=0
-      note "lane $rl_old's row has fewer than seven '|' before its handoff column, so that column is left exactly as it is (Amendment 16(d) moves the file the row NAMES; this row names none in the place the header puts it)"
-    }
-    rl_hcell=""
-    [ "$rl_hsplit" = 1 ] && rl_hcell="$(printf '%s' "$rl_hc" | sed 's/^ *//; s/ *$//')"
-    rl_hpath_new="$rl_hcell"; rl_hmove=0
-    if [ -n "$rl_hcell" ]; then
-      rl_hbase="${rl_hcell##*/}"
-      rl_hdir="${rl_hcell%"$rl_hbase"}"
-      # `session-handoff-<date>-lane-<old>.md` → the same date with
-      # `lane-<new>` (clause (d)). ANY OTHER SHAPE IS LEFT WHERE IT IS: a
-      # handoff not named for its lane has no `lane-<name>` in it to rename,
-      # and inventing one would move a file the row points at to a path the
-      # row's own history never named. Matched case-insensitively and cut by
-      # LENGTH, because `${x%$suffix}` cannot match a suffix of another case.
-      rl_hsuf="-lane-$rl_old.md"
-      # BOTH SIDES LOWER-CASED INTO VARIABLES FIRST, and the `case` reads them:
-      # a command substitution inside a case PATTERN is the shape bash 3.2 —
-      # the bash the macOS job parses every shipped file with — mis-parses at
-      # the first `)`, which is the rule `tests/test_repo_hygiene.py` holds for
-      # every file here.
-      rl_hb_lc="$(lc "$rl_hbase")"
-      rl_hs_lc="$(lc "$rl_hsuf")"
-      case "$rl_hb_lc" in
-        *"$rl_hs_lc")
-          rl_hkeep=$(( ${#rl_hbase} - ${#rl_hsuf} ))
-          if [ "$rl_hkeep" -gt 0 ]; then
-            rl_hpath_new="$rl_hdir${rl_hbase:0:$rl_hkeep}-lane-$rl_new.md"
-            rl_hmove=1
-          fi ;;
-      esac
-    fi
-    rl_hfile=""; rl_hfile_new=""; rl_h_rel=""; rl_h_rel_new=""
-    if [ -n "$rl_hcell" ]; then
-      case "$rl_hcell" in
-        '~/'*) rl_hfile="$HOME/${rl_hcell#'~/'}"; rl_hfile_new="$HOME/${rl_hpath_new#'~/'}" ;;
-        /*)    rl_hfile="$rl_hcell"; rl_hfile_new="$rl_hpath_new" ;;
-        *)     rl_hfile="${LANES_REPO:+$LANES_REPO/}$rl_hcell"; rl_hfile_new="${LANES_REPO:+$LANES_REPO/}$rl_hpath_new" ;;
-      esac
-      # THE CONTAINMENT TEST IS PHYSICAL (Copilot round 5 on openRepoTools#81).
-      # A string prefix accepts `handoffs/../../outside/x.md` and accepts a path
-      # whose PARENT is a symlink out of the checkout — both of which resolve
-      # outside it, so the file would be moved and stamped before git refused
-      # the pathspec. The directory's own `cd -P` is the resolution
-      # `lane-start:2941` already makes for this very path, and for the same
-      # reason it gives: `readlink -f` is not in the stock macOS userland.
-      #
-      # THE QUESTION IS PUT TO THE NEAREST ANCESTOR THAT EXISTS, which is the
-      # rule `openRepoTools --install` already states for its own targets. A row
-      # names a handoff before anything writes one — `lane-start` puts the path
-      # in the row at the lane's first launch and `lane-handoff` creates the file
-      # (and its estate directory) at the first swap — so `cd -P` of the leaf
-      # directory fails for every lane that has not swapped yet, and taking that
-      # failure as "outside the workspace" refused the ordinary case.
-      if [ -n "${LANES_REPO:-}" ]; then
-        rl_repo_real="$( CDPATH=''; cd -P -- "$LANES_REPO" 2>/dev/null && pwd -P )" || rl_repo_real="$LANES_REPO"
-        rl_anc="$(dirname -- "$rl_hfile")"; rl_suffix=""; rl_hdir_real=""; rl_walk=0
-        while [ "$rl_walk" -lt 64 ]; do
-          if [ -d "$rl_anc" ]; then
-            rl_hdir_real="$( CDPATH=''; cd -P -- "$rl_anc" 2>/dev/null && pwd -P )" || rl_hdir_real=""
-            break
-          fi
-          case "$rl_anc" in */*) : ;; *) break ;; esac
-          rl_suffix="${rl_anc##*/}${rl_suffix:+/$rl_suffix}"
-          rl_anc="${rl_anc%/*}"
-          [ -n "$rl_anc" ] || rl_anc=/
-          rl_walk=$((rl_walk + 1))
-        done
-        # A `..` AMONG THE COMPONENTS THAT DO NOT EXIST RESOLVES TO NOTHING, so
-        # it is refused rather than guessed at: the physical answer is only the
-        # ancestor's, and the suffix is taken literally.
-        case "/$rl_suffix/" in *"/../"*) rl_hdir_real="" ;; esac
-        if [ -n "$rl_hdir_real" ]; then
-          [ -n "$rl_suffix" ] && rl_hdir_real="$rl_hdir_real/$rl_suffix"
-          case "$rl_hdir_real/" in
-            "$rl_repo_real"/*)
-              rl_hreal="$rl_hdir_real/$(basename -- "$rl_hfile")"
-              rl_h_rel="${rl_hreal#"$rl_repo_real"/}"
-              rl_h_rel_new="${rl_h_rel%/*}/$(basename -- "$rl_hpath_new")"
-              case "$rl_h_rel" in */*) : ;; *) rl_h_rel_new="$(basename -- "$rl_hpath_new")" ;; esac ;;
-          esac
-        fi
-      fi
-      # A HANDOFF OUTSIDE THE WORKSPACE REPOSITORY IS A REFUSAL, NOT A NOTE
-      # (Copilot round 1 on openRepoTools#81). It used to be moved and stamped
-      # and then left OUT of the commit, because a git commit cannot carry a
-      # file outside its own checkout — so "four moves, one commit" was not true
-      # of that row, and a failure afterwards had nothing to roll the outside
-      # file back from. The register's handoff column is repo-relative
-      # everywhere this estate writes it (`handoffs/<estate>/…`, the path
-      # `lane-start` computes), so a row naming one elsewhere is a hand edit,
-      # and the exit is to put the file where the row's own convention puts it.
-      if [ -z "$rl_h_rel" ]; then
-        die "lane $rl_old's row names the handoff '$rl_hcell', which resolves to $rl_hfile — outside the workspace repository ${LANES_REPO:-<unknown>}. A rename is FOUR MOVES IN ONE COMMIT (Amendment 16), and a commit cannot carry a file outside its own checkout, so this one would be three moves and a note. Move that handoff under $LANES_REPO — \`handoffs/<estate>/session-handoff-<date>-lane-$rl_old.md\` is the path \`lane-start\` computes — point the row's handoff column at it, and re-run. Nothing was written." 2
-      fi
-      # `-L` BESIDE `-e`, because `-e` IS FALSE ON A DANGLING LINK (Copilot
-      # round 5) — and `mv` would then replace that link, destroying a path this
-      # rename does not own, exactly as the source-side tests already say.
-      [ "$rl_hmove" = 1 ] && { [ -e "$rl_hfile_new" ] || [ -L "$rl_hfile_new" ]; } && \
-        die "the handoff would move to $rl_hfile_new and something is already there. That path belongs to lane $rl_new's own handoff and is not this rename's to overwrite. Move it aside and re-run. Nothing was written." 2
-    fi
-    # THE HANDOFF IS A PATHSPEC OF THIS COMMIT ONLY WHERE THERE IS A FILE TO
-    # COMMIT. `git add` FAILS on a pathspec matching nothing at all, and a row
-    # that names a handoff nobody ever wrote is ordinary — every lane has one
-    # until its first swap. A row that names one which cannot be READ is a
-    # different thing and is refused below, with the log already snapshotted.
-    # AND A PATH THAT EXISTS AND IS NOT A REGULAR FILE IS A REFUSAL, not a
-    # missing handoff (Copilot round 3 on openRepoTools#81). `-f` alone read a
-    # directory, a FIFO and a DANGLING SYMLINK as "the row names a handoff
-    # nobody wrote", so the rename committed the other three and left that path
-    # where it was. `-e` is false on a dangling link, which is why `-L` is asked
-    # beside it — the same pair `unplaceable_kind` in `openRepoTools` asks, for
-    # the same reason: `cat` through a dangling link CREATES the far end.
-    # A SYMLINK IS TESTED BEFORE `-f`, because `-f` is TRUE through one to a
-    # regular file (Copilot round 4 on openRepoTools#81) — and Rule 3's stamp is
-    # written with a redirect, which FOLLOWS it: the stamp would land in the
-    # link's target, possibly outside this repository, while the commit recorded
-    # the link and the rollback restored the wrong bytes.
-    if [ -n "$rl_hcell" ] && [ -L "$rl_hfile" ]; then
-      die "lane $rl_old's row names the handoff '$rl_hcell' and $rl_hfile is a SYMLINK. Rule 3's stamp is written in place and a redirect follows a link, so the stamp would land at the far end while this commit recorded the link (Amendment 16(d)). Point the row's column at the file itself and re-run. Nothing was written." 2
-    fi
-    if [ -n "$rl_hcell" ] && [ ! -f "$rl_hfile" ] && [ -e "$rl_hfile" ]; then
-      die "lane $rl_old's row names the handoff '$rl_hcell' and $rl_hfile is not a regular file. A rename moves and STAMPS the handoff the row names (Amendment 16(d)), and neither can be done to that; nor is it the absent handoff an un-swapped lane has, which is passed over. Put a handoff there, or point the row's column at one, and re-run. Nothing was written." 2
-    fi
-    rl_h_touch=0
-    [ -n "$rl_h_rel" ] && [ -f "$rl_hfile" ] && rl_h_touch=1
-    # AND AN UNTRACKED HANDOFF IS SOMEBODY'S UNCOMMITTED WORK (Copilot round 6).
-    # It is a pathspec of this commit the moment it exists, and `tracked_dirty`
-    # never reports it, so another lane's half-written handoff would be stamped
-    # and committed under this rename's message — which is the one thing
-    # `--no-sweep` was made the default for.
-    if [ "$rl_h_touch" = 1 ] && [ "$NO_GIT" != 1 ] \
-       && ! git -C "$LANES_REPO" ls-files --error-unmatch -- "$rl_h_rel" >/dev/null 2>&1; then
-      die "the handoff at $rl_h_rel exists here and git does not track it, so its lines have never been committed by anyone — and this rename would stamp it, move it and commit it under its own message. Whoever wrote it commits it first: \`git -C $LANES_REPO add -- $rl_h_rel && git -C $LANES_REPO commit -m \"handoff(<lane>@<workstation>): <what>\"\`. Nothing was written." 2
-    fi
-
-    # ---- NOTHING ABOVE HAS WRITTEN A BYTE. The four moves follow, in one
-    # commit, in the order the amendment lists them.
-    rl_paths=("$LANES_PATH" "$rl_log_new_rel" "$LANES_ALIASES_PATH")
-    # THE OLD LOG IS A PATHSPEC ONLY WHERE GIT KNOWS IT (Copilot round 3 on
-    # openRepoTools#81). A TRACKED path that has been moved away still matches
-    # in the index and `git add` stages its deletion; an UNTRACKED one — the log
-    # an earlier write created and never committed — matches nothing once it is
-    # gone, and `git add` FAILS on a pathspec that matches nothing at all,
-    # which would end this write inside `commit_push` with all four moves on
-    # disk. Nothing in the index refers to it, so there is nothing to stage.
-    if [ -n "$rl_log_old_rel" ] && [ "$rl_log_old_rel" != "$rl_log_new_rel" ] \
-       && { [ "$NO_GIT" = 1 ] || git -C "$LANES_REPO" ls-files --error-unmatch -- "$rl_log_old_rel" >/dev/null 2>&1; }; then
-      rl_paths+=("$rl_log_old_rel")
-    fi
-    if [ "$rl_h_touch" = 1 ]; then
-      rl_paths+=("$rl_h_rel_new")
-      [ "$rl_hmove" = 1 ] && rl_paths+=("$rl_h_rel")
-    fi
-    # THE ALIAS TABLE IS NOT EXEMPT FROM THE DIRTY-CHECKOUT REFUSAL (Copilot
-    # round 4 on openRepoTools#81). Every pathspec handed here is exempted, and
-    # `lanes/aliases.tsv` has ONE writer — this command — so a dirty one is not
-    # the ordinary mid-write state `lanes/LANES.md` is in half the day and there
-    # is no capture for it: exempted and uncaptured, a peer's half-finished
-    # rename would be appended to and swept into this lane's commit. So it is
-    # left OUT of the exemption list and the generic refusal names it.
-    rl_exempt=()
-    for rl_p in ${rl_paths[@]+"${rl_paths[@]}"}; do
-      [ "$rl_p" = "$LANES_ALIASES_PATH" ] && continue
-      rl_exempt+=("$rl_p")
-    done
-    refuse_dirty_checkout "rename lane $rl_old" ${rl_exempt[@]+"${rl_exempt[@]}"} "$LANES_PATH"
-    # THE CAPTURE IS GIVEN THE REGISTER AND NOTHING ELSE (Copilot round 3 on
-    # openRepoTools#81). `handle_preexisting` runs `git add -- <paths>` on the
-    # branch that captures a peer's uncommitted edit, and most of this write's
-    # pathspecs DO NOT EXIST YET — the new log, the alias table, the handoff's
-    # new name — so that `git add` would fail, the capture would not happen, and
-    # a peer's half-written row would be swept into this rename's commit. The
-    # register is the only file that can be dirty here at all: every OTHER
-    # tracked change was refused one line up, which is the same reasoning
-    # `capture_register_edit` states for its own single pathspec.
-    handle_preexisting "$LANES_PATH"
-
-    # ---- THE SNAPSHOT, BEFORE THE FIRST BYTE. Every exit path from here to the
-    # commit restores it (`rename_undo`, hooked into `cleanup`), because the
-    # four moves are one act and a filesystem can refuse the third of them.
-    RL_SNAP="$(mktemp -d)" || die "no temporary directory could be made under ${TMPDIR:-/tmp}, and this write is not made without somewhere to put the copy that undoes it. Nothing was written." 1
-    [ -n "$rl_log_old" ] && { cat -- "$rl_log_old" > "$RL_SNAP/log" || die "lane $rl_old's object log at $rl_log_old could not be read, so there is no copy to roll back to and this rename is not started. Nothing was written." 5; }
-    [ "$rl_h_touch" = 1 ] && { cat -- "$rl_hfile" > "$RL_SNAP/handoff" || die "the handoff at $rl_hfile is named by the row and could not be READ, so it can be neither stamped nor rolled back — and a rename that moved it unstamped is three moves and a half (Amendment 16(d)). Fix the permission, or point the row's column at a handoff that is there, and re-run. Nothing was written." 5; }
-    RL_ALIAS="$LANES_ALIASES_TSV"; RL_ALIAS_EXISTED=0
-    if [ -f "$LANES_ALIASES_TSV" ]; then
-      RL_ALIAS_EXISTED=1
-      cat -- "$LANES_ALIASES_TSV" > "$RL_SNAP/aliases" || die "$LANES_ALIASES_PATH is there and could not be read, so there is no copy to roll back to. Nothing was written." 5
-    fi
-    # AND THE REGISTER IS IN THE SNAPSHOT TOO (Copilot round 4 on
-    # openRepoTools#81). `replace_line` cannot half-write it — it proves the new
-    # file before it writes a byte — but the row IS written before
-    # `commit_push`, and `commit_push` can die before it commits anything. The
-    # undo then put the other three back and left the row renamed: a split
-    # rename, which is the state this whole mechanism exists to prevent.
-    RL_REG="$LANES_FILE"
-    cat -- "$LANES_FILE" > "$RL_SNAP/register" || die "the register at $LANES_FILE could not be read, so there is no copy to roll back to. Nothing was written." 5
-    RL_LOG_OLD="$rl_log_old"; RL_LOG_NEW="$rl_log_new"
-    RL_H_OLD=""; RL_H_NEW=""
-    RL_PATHS_FOR_UNDO=("${rl_paths[@]}")
-    RL_ACTIVE=1
-
-    # (c) THE LOG — moved, then appended to. The lines above the new one still
-    # say `lane <old>` and are NEVER rewritten (clause (c)): this file is
-    # append-only and those lines are what happened. `LOG_AWK` resolves the
-    # field on the way in, so every reader sees one lane.
-    if [ -n "$rl_log_old" ]; then
-      mv -- "$rl_log_old" "$rl_log_new" || die "could not rename $rl_log_old to $rl_log_new." 5
-      note "$rl_log_old_rel → $rl_log_new_rel"
-    else
-      [ -d "$LANES_LOG_DIR" ] || mkdir -p -- "$LANES_LOG_DIR"
-      printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$rl_new" > "$rl_log_new"
-      note "created $rl_log_new_rel — lane $rl_old has no object log (a pre-cutover lane, Amendment 7(i)), so this RENAMED is its first line"
-    fi
-    rl_line="$(event_line RENAMED "$rl_new" "$rl_uuid" "$rl_utc" "lane:$rl_new" "←" "lane:$rl_old" "$rl_why")"
-    append_text_line "$rl_line" "$rl_log_new"
-
-    # (d) THE HANDOFF — moved to the same date with `lane-<new>`, and stamped
-    # under its header block (Rule 3). THE FILE IS SPLICED AND NEVER REWRITTEN
-    # WHOLE, with the proof `lane-start` makes for its own `RESUMED by` stamp:
-    # one line in at the ruled position, and taking that line back out again
-    # gives the file back byte for byte. A handoff is the one document this
-    # protocol cannot afford to lose, and the act that dropped two lanes' rows
-    # on 2026-09-08 was a file written whole from what somebody remembered.
-    rl_hstamp="RENAMED from $rl_old by $rl_uuid (lane $rl_new) at $rl_utc"
-    rl_hdone=0
-    if [ -z "$rl_hcell" ]; then
-      note "the row names no handoff, so there is none to move or stamp (Amendment 16(d))"
-    elif [ ! -f "$rl_hfile" ]; then
-      note "the handoff the row names is not at $rl_hfile, so nothing was moved or stamped and the row's handoff column is left exactly as it is. If it turns up, rename it — $rl_hcell → $rl_hpath_new — and stamp it: $rl_hstamp"
-    else
-      if [ "$rl_hmove" = 1 ]; then
-        RL_H_OLD="$rl_hfile"; RL_H_NEW="$rl_hfile_new"
-        mv -- "$rl_hfile" "$rl_hfile_new" || die "could not rename $rl_hfile to $rl_hfile_new." 5
-        note "$rl_hcell → $rl_hpath_new"
-        rl_hdone=1
-      else
-        rl_hfile_new="$rl_hfile"
-        RL_H_OLD="$rl_hfile"; RL_H_NEW="$rl_hfile"
-        note "the handoff $rl_hcell is not named \`…-lane-$rl_old.md\`, so it has no lane in its name to rename; it is stamped where it is (Amendment 16(d))"
-      fi
-      # A STAMP THAT CANNOT BE WRITTEN IS A REFUSAL (Copilot round 1 on
-      # openRepoTools#81). It used to be a `note`, and the rename went on to
-      # commit — leaving a handoff MOVED and UNSTAMPED, which is clause (d) done
-      # by half, in the one document Rule 3 says the next session reads first.
-      # The redirect is checked for the same reason: this file runs `set -u` and
-      # not `set -e`, so an unwritable handoff would otherwise reach the
-      # "stamped" note having written nothing.
-      rl_hat="$(awk 'NR > 1 && /^[[:space:]]*$/ { print NR; exit }' "$rl_hfile_new" 2>/dev/null || :)"
-      [ -n "$rl_hat" ] || rl_hat=1
-      rl_htmpd="$(mktemp -d)" || die "no temporary directory could be made under ${TMPDIR:-/tmp} for the handoff's Rule 3 stamp." 1
-      cat -- "$rl_hfile_new" > "$rl_htmpd/pre" 2>/dev/null || { rm -rf -- "$rl_htmpd"; die "the handoff at $rl_hfile_new could not be read, so Rule 3's stamp cannot be written and this rename is not made without it." 5; }
-      { head -n "$rl_hat" -- "$rl_htmpd/pre"
-        printf '%s\n' "$rl_hstamp"
-        tail -n "+$((rl_hat + 1))" -- "$rl_htmpd/pre"
-      } > "$rl_htmpd/out"
-      if [ "$(sed -n -e "$((rl_hat + 1))p" "$rl_htmpd/out")" != "$rl_hstamp" ] ||
-         ! { head -n "$rl_hat" -- "$rl_htmpd/out"; tail -n "+$((rl_hat + 2))" -- "$rl_htmpd/out"; } | cmp -s - "$rl_htmpd/pre"
-      then
-        rm -rf -- "$rl_htmpd"
-        die "the handoff at $rl_hfile_new cannot take Rule 3's stamp without rewriting a byte of it, and a handoff written whole from anything but its own bytes is the act that lost two lanes' rows on 2026-09-08. The line it wants under its header block is: $rl_hstamp" 5
-      fi
-      # AND THE STAMPED COPY REPLACES THE HANDOFF BY RENAME, NEVER THROUGH A
-      # REDIRECT INTO IT (opensoft/openRepoTools#158). `>` truncated the handoff
-      # before the first stamped byte was written, so a writer killed inside
-      # that `cat` — or a machine that lost power there — left a handoff cut
-      # short, and no undo reached it: `rename_undo` is a trap and SIGKILL runs
-      # none, so every later read took the short file for the handoff. The
-      # bytes now go to an exclusive temporary file BESIDE the handoff, in the
-      # physical directory it resolves to, with its mode (`cp -p` first), and
-      # `mv -f` replaces it in one rename: a reader sees the handoff whole
-      # before the stamp or whole after it. These are `publish-handoff`'s
-      # mechanics, inlined because that verb takes the lock this write already
-      # holds. The leaf is never a link — refused above, before the first byte
-      # — so replacing it rather than writing through it is the same file.
-      # `cleanup` removes the temporary on every handled exit; one a crash
-      # leaves is `<handoff>.rename.XXXXXX`, which no reader of `*.md` takes
-      # for a handoff. THIS MAKES THE STAMP ATOMIC, NOT THE RENAME: a crash
-      # between two of the four moves still leaves them apart.
-      rl_hpub="$( CDPATH=''; cd -P -- "$(dirname -- "$rl_hfile_new")" && pwd -P )" || { rm -rf -- "$rl_htmpd"; die "the directory of the handoff at $rl_hfile_new could not be resolved, so Rule 3's stamp cannot be published beside it and this rename is not made without it." 5; }
-      rl_hpub="$rl_hpub/$(basename -- "$rl_hfile_new")"
-      rl_htmp="$(mktemp "$rl_hpub.rename.XXXXXX")" || { rl_htmp=""; rm -rf -- "$rl_htmpd"; die "no temporary file could be made beside the handoff at $rl_hfile_new, and Rule 3's stamp is not written into a handoff in place. This rename is not made without it." 5; }
-      if ! cp -p -- "$rl_hpub" "$rl_htmp" || ! cat -- "$rl_htmpd/out" > "$rl_htmp" || ! mv -f -- "$rl_htmp" "$rl_hpub"; then
-        rm -f -- "$rl_htmp"; rl_htmp=""; rm -rf -- "$rl_htmpd"
-        die "the handoff at $rl_hfile_new could not be written, so Rule 3's stamp is not there and this rename is not made without it." 5
-      fi
-      rl_htmp=""
-      rm -rf -- "$rl_htmpd"
-      note "handoff stamped at line $((rl_hat + 1)) of $rl_hpath_new: $rl_hstamp"
-    fi
-    # The row's handoff column follows the file, and only where the file
-    # actually moved: a column pointed at a path nothing moved to is a column
-    # that names a file that is not there.
-    if [ "$rl_hdone" = 1 ] && [ "$rl_hsplit" = 1 ]; then
-      rl_hc_pre="${rl_hc%%"$rl_hcell"*}"; rl_hc_post="${rl_hc#*"$rl_hcell"}"
-      rl_newrow="$rl_pre$rl_hc_pre$rl_hpath_new$rl_hc_post$rl_hpost"
-    fi
-
-    # (e) THE ALIAS TABLE — the one write that makes the old name keep working,
-    # for ever and in every reader (clause (e)).
-    if [ ! -f "$LANES_ALIASES_TSV" ]; then
-      { printf '# lanes/aliases.tsv — lane-collision-protocol Amendment 16(e)\n'
-        printf '# <old lane>\t<new lane>\t<UTC of the rename>\n'
-        printf '# Appended by `lanes-edit.sh rename-lane` and by nothing else. Every reader of a\n'
-        printf '# lane name resolves through it, case-insensitively; a chain resolves to its end,\n'
-        printf '# stopping at any name that is a ROW again; a cycle is refused at write time; the\n'
-        printf '# LAST row for a key wins.\n'
-      } > "$LANES_ALIASES_TSV" || die "$LANES_ALIASES_PATH could not be created, and a rename without its alias row is a lane whose old name stops resolving (Amendment 16(e))." 5
-      note "created $LANES_ALIASES_PATH"
-    fi
-    append_text_line "$(printf '%s\t%s\t%s' "$rl_old" "$rl_new" "$rl_utc")" "$LANES_ALIASES_TSV"
-
-    # (b) THE ROW, LAST — so that a refusal anywhere above leaves the register
-    # itself untouched and `row_line` still finds the lane under its old name.
-    replace_line "$rl_n" "$rl_newrow"
-
-    # EVERY ONE OF THE FOUR IS ON DISK — AND THE UNDO STAYS ARMED THROUGH THE
-    # COMMIT (Copilot round 3 on openRepoTools#81). It was cleared here, and
-    # `commit_push` can die on `update-index`, `git add` or `git commit` BEFORE
-    # any commit exists: the four files would then be left moved and modified
-    # with nothing to show for them, which is the half-renamed state this whole
-    # mechanism exists to prevent.
-    #
-    # WHAT DECIDES IS WHETHER A COMMIT WAS MADE, not where the failure happened.
-    # `rename_undo` compares HEAD against the sha taken here: unchanged means no
-    # commit carries this work and the four are restored; moved means the commit
-    # exists, the work is IN it, and `commit_push` owns the recovery from there
-    # — its exit 3 says so in its own words, and undoing a committed rename
-    # behind its back would be a second, inverse change nobody asked for.
-    RL_HEAD_BEFORE="$(git -C "$LANES_REPO" rev-parse HEAD 2>/dev/null || printf '')"
-    rl_msg="LANES($rl_new@$WS): RENAMED lane $rl_old → $rl_new (Amendment 16) — the row, $rl_log_new_rel, the handoff and $LANES_ALIASES_PATH in one commit"
-    [ -n "$PRE_DIRTY_LANES" ] && rl_msg="$rl_msg + sweeps uncommitted edit to row $PRE_DIRTY_LANES"
-    commit_push "$rl_msg" "${rl_paths[@]}"
-    rl_rc=$?
-    # `commit_push` RETURNED, so either it committed or it had nothing staged;
-    # every other outcome exits from inside it and is the trap's business.
-    RL_ACTIVE=0
-    state_events_flush
-    lane_alias_flush
-    [ "$rl_rc" != 0 ] || lane_state_rename "$rl_lsr_old" "$rl_new"
-    release_lock
-    [ "$rl_rc" = 0 ] || exit "$rl_rc"
-
-    rl_sha="$(git -C "$LANES_REPO" rev-parse HEAD 2>/dev/null || printf '')"
-    note "lane $rl_old is lane $rl_new (${rl_sha:-no sha}); '$rl_old' resolves to it for ever through $LANES_ALIASES_PATH"
-
-    # (g) ONE COMMENT PER OBJECT THE LANE HOLDS — Amendment 7(b)'s partition,
-    # the same set `lane-end` refuses on and `who --lane` reports. Posted only
-    # AFTER the commit has landed and citing its sha, exactly as `claim`'s
-    # comment is, and skipped entirely by `--no-github`.
-    if [ "$NO_GITHUB" != 1 ]; then
-      rl_body="$(printf 'Lane %s renamed %s at %s (lane-collision-protocol Amendment 16). Lane: %s (%s)\n\nRecorded in `%s` at `%s`. `%s` resolves `%s` to `%s` for every reader of a lane name, so every earlier comment, line and branch naming the old lane still finds it.\n' \
-                 "$rl_old" "$rl_new" "$rl_utc" "$(lc "$rl_new")" "$rl_new" \
-                 "$rl_log_new_rel" "${rl_sha:-unknown}" "${LANES_ALIASES_PATH:-lanes/aliases.tsv}" "$rl_old" "$rl_new")"
-      rl_posted=0; rl_missed=""
-      while IFS="$US" read -r rl_outc rl_overb rl_oobj rl_oref rl_osup; do
-        [ -n "${rl_overb:-}" ] || continue
-        is_open_verb "$rl_overb" || continue
-        rl_url="$(gh_comment "$rl_oobj" "$rl_body" 2>/dev/null || :)"
-        if [ -n "$rl_url" ]; then
-          note "comment posted on $rl_oobj: $rl_url"; rl_posted=$((rl_posted + 1))
-        else
-          rl_missed="$rl_missed $rl_oobj"
-        fi
-      done <<EOF
-$(lane_objects "$rl_new" 2>/dev/null || :)
-EOF
-      [ "$rl_posted" = 0 ] && [ -z "$rl_missed" ] && note "lane $rl_new holds nothing open, so there is no object to comment on (Amendment 16(g))"
-      [ -n "$rl_missed" ] && note "WARNING: the rename comment could not be posted on:$rl_missed. The commit IS the rename and it has landed; post them by hand so that a reader outside this estate can see it."
-    fi
-    note "THE WINDOW AND THE SESSION ARE NOT THIS WRITE'S (Amendment 16(f)): in the lane's own window, \`tmux rename-window $rl_new\` and \`/rename $rl_new\` typed into its pane. \`lane-rename\` does both when it is run there; from anywhere else the name guard renames the window at this lane's next prompt and types the \`/rename\` itself."
-    ;;
-
-  # AMENDMENT 13(e) — THE MIGRATION. A DRY RUN unless `--yes` is passed, and one
-  # act on Brett Heap's word when it is (ratified decision O3). Everything it
-  # does is argued above `migrate_state_cells`.
-  migrate-state-cells)
-    msc_yes=0
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --yes) msc_yes=1; shift ;;
-        --)    shift ;;
-        *)     die "usage: migrate-state-cells [--yes]   —  without --yes it is a DRY RUN that writes nothing; '$1' is neither" 2 ;;
-      esac
-    done
-    migrate_state_cells "$msc_yes"
-    ;;
-
-  log)
-    lane="${LANES_LANE:-}"
-    [ -n "$lane" ] || die "log needs the lane: LANES_LANE=<lane> lanes-edit.sh log <VERB> <object> …" 2
-    check_lane_name "$lane"
-    verb=""; obj_raw=""; ref=""; payload=""; text=""; home_override=""; utc_override=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --no-github) NO_GITHUB=1; shift ;;
-        # AMENDMENT 17, adoption act 7 — THE LATE RECORD'S OWN DATE, AND
-        # NOTHING ELSE USES IT. A `PAUSED` written after the fact for a swap
-        # that never ran names the moment the OLD SESSION ENDED, not the moment
-        # the shell writing it ran: `lane-handoff --late --at <UTC>` is the one
-        # caller, and its own rule is that the line may only be written where it
-        # is still the lane's last one (this log is append-only and FILE ORDER
-        # is what every state read means by "last"). The shape is checked here
-        # because a UTC field this parser cannot read is a line no reader can
-        # date — and the log is never rewritten.
-        --utc)       utc_override="${2-}"; [ -n "$utc_override" ] || die "--utc needs a UTC instant" 2; shift 2 ;;
-        --utc=*)     utc_override="${1#--utc=}"; [ -n "$utc_override" ] || die "--utc needs a UTC instant" 2; shift ;;
-        --home)      home_override="${2-}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift 2 ;;
-        --home=*)    home_override="${1#--home=}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift ;;
-        --text)      text="${2-}"; shift 2 ;;
-        --text=*)    text="${1#--text=}"; shift ;;
-        --)          shift ;;
-        '→'|'->')    ref="→"; payload="${2-}"; [ -n "$payload" ] || die "'$1' needs a payload after it" 2; shift 2 ;;
-        '←'|'<-')    ref="←"; payload="${2-}"; [ -n "$payload" ] || die "'$1' needs a payload after it" 2; shift 2 ;;
-        -*)          die "unknown option '$1' for log" 2 ;;
-        *)
-          if   [ -z "$verb" ];    then verb="$1"
-          elif [ -z "$obj_raw" ]; then obj_raw="$1"
-          elif [ -z "$text" ];    then text="$1"
-          else die "log takes <VERB> <object> [→|← <payload>] [\"<free text>\"] — '$1' is one argument too many" 2
-          fi
-          shift ;;
-      esac
-    done
-    [ -n "$verb" ] && [ -n "$obj_raw" ] || die "usage: log <VERB> <object> [→|← <payload>] [\"<free text>\"]   ($VERB_LIST)" 2
-    valid_verb "$verb" || die "'$verb' is not one of the Amendment 7 verbs ($VERB_LIST)" 2
-    # The four verbs that have a subcommand of their own are NOT written by
-    # hand. `log CLAIMED` skipped the pre-check, the race and the rescan and
-    # `who` reported the result identically to a real claim; `log TAKEOVER`
-    # skipped the staleness test that is the only thing making a takeover
-    # legitimate. Refusing them here costs nothing that is actually needed.
-    case "$verb" in
-      CLAIMED)
-        die "a CLAIMED is not written by hand: it is Rule 1's act, and 'log' skips the pre-check, the race and the rescan. Use: LANES_LANE=$lane lanes-edit.sh claim $obj_raw" 2 ;;
-      TAKEOVER)
-        die "a TAKEOVER is not written by hand: it is only legitimate against a claim that is STALE, and that is the test 'log' does not make. Use: LANES_LANE=$lane lanes-edit.sh claim $obj_raw --force" 2 ;;
-      RELEASED)
-        die "a RELEASED is not written by hand: 'release' also posts the Rule 1 comment. Use: LANES_LANE=$lane lanes-edit.sh release $obj_raw \"<why>\"" 2 ;;
-      CLAIM-LOST)
-        die "a CLAIM-LOST is written by 'claim' when it loses the race for an object, and by nothing else — there is no hand-written form of losing a race" 2 ;;
-      HANDOFF-REQUESTED)
-        die "a HANDOFF-REQUESTED is not written by hand: it is clause (c)'s act, and 'log' skips the binding read that says there is anything to request, the pane it types into and the wait that follows. Use: $SELF request-handoff $lane" 2 ;;
-      # AMENDMENT 16 — AND A `RENAMED` IS NOT WRITTEN BY HAND EITHER, for the
-      # reason the amendment itself was drafted for: two lanes renamed
-      # themselves on 2026-09-14 by appending exactly this line and nothing
-      # else, and *"the lines are honest and they are all there is: the rows
-      # still carry the old keys, the logs and handoffs the old names"*. The
-      # line is one of four moves that are one commit, and `log` makes the
-      # other three of them not at all.
-      RENAMED)
-        die "a RENAMED is not written by hand: it is one of the FOUR moves of a rename — the row's key, this log's own name, the handoff and lanes/aliases.tsv — which land in ONE commit, refused or whole (Amendment 16). A line on its own is the 2026-09-14 hand rename this amendment exists to replace: honest, and all there is. Use: lane-rename ${obj_raw#lane:} <new name>" 2 ;;
-    esac
-    # R30 — THE FETCH COMES FIRST. `log` had no `log_sync` of its own at all:
-    # it read the STARTED line that REFUSES `--home` out of an `origin/<branch>`
-    # nothing here had moved, and the pull inside `commit_push` comes far too
-    # late to be that read.
-    log_sync
-    # AMENDMENT 15 — AFTER THE FETCH AND BEFORE EVERY READ AND WRITE BELOW IT.
-    # The resolver reads the PUBLISHED register (R19), so it is asked once
-    # `log_sync` has moved the ref — and what it answers is the lane this line
-    # is WRITTEN with, the file it is written to, and the commit subject.
-    lane="$(canon_lane "$lane")" || exit 2
-    home="$(resolve_home "$lane" "$home_override")" || exit $?
-    obj="$(canon_object "$obj_raw" "$home")" || exit 2
-    # AMENDMENT 13(b) — THE TWO NARRATIVE VERBS, AND WHAT EACH OF THEM TAKES.
-    # `NOTED` is a status note about the lane; `RULED` is a ruling recorded
-    # VERBATIM, with the object it bears on as its payload where there is one.
-    # Both are lane-kind lines in Amendment 7's own `STARTED`/`RESUMED` form —
-    # object `lane:<lane>`, one token — and neither is a transition, so no
-    # reader's state moves because one was written. They are the cell's old
-    # diary, in the file built to hold it.
-    if is_note_verb "$verb"; then
-      is_lane_object "$obj" ||
-        die "'$verb' is a lane-kind line (Amendment 13(b)): its object is the LANE itself, lane:$lane, and not $obj. The object a ruling BEARS ON is its payload: LANES_LANE=$lane lanes-edit.sh log RULED lane:$lane → $obj \"<the words, verbatim>\"" 2
-      # AND IT IS THIS LANE, NOT ANOTHER (Copilot round 5 on openRepoTools#82).
-      # `is_lane_object` reads the `lane:` prefix and nothing more, so
-      # `LANES_LANE=repoA … log NOTED lane:repoB` wrote a line into repoA's log
-      # whose object named repoB — a note about a lane in a file that is not its
-      # log, and `history repoB` would never show it. Clause (b) is explicit
-      # that these are "lane-kind lines whose object is the lane itself".
-      # COMPARED CASE-INSENSITIVELY, because `$lane` is already the row's own
-      # spelling and a caller may have typed another (Amendment 15).
-      [ "$(lc "${obj#lane:}")" = "$(lc "$lane")" ] ||
-        die "'$verb' is a line about THIS lane, and its object is this lane: lane:$lane, not $obj (Amendment 13(b)). A note is written into the log of the lane it names, so an object naming another lane is a note nobody reading that lane's history would ever see. To say something about another lane, write it in the text; to record a ruling about an OBJECT, that object is the payload: LANES_LANE=$lane lanes-edit.sh log RULED lane:$lane → <object> \"<the words>\"" 2
-      if [ -z "$text" ]; then
-        case "$verb" in
-          RULED) die "a RULED with no words is not a ruling. The text is the ruling, VERBATIM — it is what Amendment 13(b) put this verb in the log for: LANES_LANE=$lane lanes-edit.sh log RULED lane:$lane${payload:+ → $payload} \"<Brett Heap's words, verbatim>\"" 2 ;;
-          *)     die "a NOTED with no text is a note with nothing in it. The text is what the line is FOR — it is the narrative the state cell used to carry (Amendment 13(a)): LANES_LANE=$lane lanes-edit.sh log NOTED lane:$lane \"<what the lane did, found, launched, left>\"" 2 ;;
-        esac
-      fi
-      case "$verb" in
-        NOTED)
-          [ -z "$payload" ] ||
-            die "NOTED takes no payload: it is a note about the lane, and Amendment 13(b) gives it the object and the free text alone. Put it in the text — or, if it is a ruling about an object, write it as one: LANES_LANE=$lane lanes-edit.sh log RULED lane:$lane → $payload \"<the words>\"" 2 ;;
-        RULED)
-          if [ -n "$payload" ]; then
-            # `→` AND NOT `←`, because clause (b) spells the form `lane:<lane>[ →
-            # <object>]` and the arrow is the only thing that says which way the
-            # ruling points. AND THE OBJECT IS CANONICALISED like every other
-            # object this file writes (R20): a ruling recorded against `#29` in a
-            # lane whose home is `opensoft/openRepoTools` is a ruling about
-            # `opensoft/openRepoTools#29`, and one recorded against a legacy org
-            # spelling is a second key for one issue — which is the defect
-            # Amendment 7(a)'s alias table exists for.
-            [ "$ref" = '→' ] ||
-              die "RULED's payload is the object the ruling bears on and it is introduced by → (Amendment 13(b)): 'log RULED lane:$lane → <object> \"<the words>\"'. '←' points the other way and means nothing here." 2
-            payload="$(canon_object "$payload" "$home")" || exit 2
-          fi ;;
-      esac
-    elif is_lane_verb "$verb"; then
-      is_lane_object "$obj" || die "'$verb' is a lane verb: its object is lane:<name>, not $obj" 2
-    else
-      ! is_lane_object "$obj" || die "'$verb' is an object verb: lane:<name> is not one of its objects" 2
-    fi
-    log_utc="$(utc_now)"
-    if [ -n "$utc_override" ]; then
-      # `--utc` IS THE LATE `PAUSED`'s SEAM AND HAS NO OTHER CALLER (Amendment
-      # 17, adoption act 7; Copilot round 2 on openRepoTools#47). The parser
-      # above takes the option for every verb and only its SHAPE was checked
-      # here, so a `STARTED` or a `RESUMED` could be dated by hand — and this
-      # log is append-only with FILE ORDER deciding which line is a lane's
-      # last, so a hand-dated line changes what every state read reports about
-      # a lane that is running. The one line that legitimately carries its own
-      # date is the record a swap never left, and `lane-handoff --late` has its
-      # own rule for when even that may be written.
-      [ "$verb" = PAUSED ] || die "--utc dates the LATE PAUSED that a swap never left (Amendment 17, adoption act 7) and nothing else — '$verb' is not one. Every other line is dated by the clock of the act that wrote it, because this log is append-only and a line dated by hand is a line whose order no reader can trust. Write it without --utc." 2
-      case "$utc_override" in
-        [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) log_utc="$utc_override" ;;
-        *) die "--utc takes a UTC instant spelled as this log spells it, YYYY-MM-DDTHH:MM:SSZ — '$utc_override' is not one, and a line nothing can date is a line no reader can order" 2 ;;
-      esac
-    fi
-    write_event "$lane" "$verb" "$obj" "$ref" "$payload" "$text" "$log_utc" "$(session_for "$lane")"
-    ;;
-
-  claim)
-    lane="${LANES_LANE:-}"
-    [ -n "$lane" ] || die "claim needs the lane: LANES_LANE=<lane> lanes-edit.sh claim <object>" 2
-    check_lane_name "$lane"
-    obj_raw=""; force=0; home_override=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --force)     force=1; shift ;;
-        --no-github) NO_GITHUB=1; shift ;;
-        --home)      home_override="${2-}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift 2 ;;
-        --home=*)    home_override="${1#--home=}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift ;;
-        --)          shift ;;
-        -*)          die "unknown option '$1' for claim" 2 ;;
-        *)           [ -z "$obj_raw" ] || die "claim takes exactly one object" 2; obj_raw="$1"; shift ;;
-      esac
-    done
-    [ -n "$obj_raw" ] || die "usage: claim <object> [--force] [--no-github] [--home owner/repo]" 2
-
-    # THE RACE IS DECIDED BY WHICH CLAIM LANDS ON main FIRST, and a rebase is
-    # what makes that decidable. Amendment 5(d) SKIPS the rebase when a peer
-    # has left uncommitted changes to other files in this shared checkout — a
-    # sensible default for a row edit, and unacceptable for a claim, which
-    # would then race unprotected. Refuse, and name the files — BEFORE the
-    # reads and before anything is written, and against exactly the pathspec
-    # this claim will write (the lane's log; a CLAIMED is not a LANDING).
-    # The register is exempt HERE and only here: write_event captures a peer's
-    # uncommitted `lanes/LANES.md` as its own commit and re-tests the checkout
-    # afterwards (R11), so a claim is not refused for the one file this
-    # checkout is dirty in most of the day.
-    # AND THE EXEMPTION IS A PATH, SO ITS AMBIGUITY IS THIS CLAIM'S (Copilot
-    # round 4): two logs differing only by case are a refusal, not a pathspec.
-    claim_log="$(log_path_ci "$lane")" || exit 2
-    refuse_dirty_checkout claim "$claim_log" "$LANES_PATH"
-
-    # 1. FETCH FIRST OF ALL — then resolve `--home` against the lane's STARTED
-    #    line (R30), canonicalise the object, and pre-check against what has
-    #    actually LANDED on main. Never against a working tree, which can be
-    #    anything, and never against a log this checkout has not pulled: a home
-    #    a peer recorded is on `origin/<branch>` and nowhere else here.
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    home="$(resolve_home "$lane" "$home_override")" || exit $?
-    obj="$(canon_object "$obj_raw" "$home")" || exit 2
-    ! is_lane_object "$obj" || die "a lane is not a claimable object" 2
-    takeover_payload=""; takeover_note=""; takeover_from=""; takeover_reason_phrase=""; takeover_dead=""
-    # CASE-INSENSITIVE, FOR THE SAME REASON THE KEY ABOVE IS LOWER-CASED
-    # (Amendment 15). This is the lane REMOVING ITSELF from the holders of the
-    # object it is about to claim, and the row it removes carries whatever
-    # spelling the winning line used. Byte for byte, a lane whose own earlier
-    # CLAIMED says `repohold-1` under the row `repoHold-1` is refused its own
-    # object. AND LITERAL rather than `grep -iv` (Copilot round 4): `repo.-1`
-    # excluding the rival `repoX-1` is a claim taken over a hold that is open.
-    held="$(state_events | lane_states_on "$obj" | holders_of "$obj" | rows_not_named "$lane" || :)"
-    if [ -n "$held" ]; then
-      who_object "$obj" || :
-      IFS="$US" read -r h_lane h_verb h_utc h_file h_line <<EOF
-$(printf '%s\n' "$held" | head -n1)
-EOF
-      if [ "$force" = 0 ]; then
-        die "lane $h_lane holds $obj ($h_verb, $h_utc). Rule 1: the lane stops and reports; it does not author a successor. If that claim is stale (CLAIMED on an issue, older than ${STALE_HOURS}h with no OPENED naming it), take it over with --force." 2
-      fi
-      if [ "$(printf '%s\n' "$held" | grep -c .)" != 1 ]; then
-        die "--force takes over ONE stale claim, and $obj is held by $(printf '%s\n' "$held" | grep -c .) lanes" 2
-      fi
-      # ISSUE #30 — a holder whose LANE is dead is takeable WHATEVER ITS VERB,
-      # bypassing both gates below: neither one was ever about the lane being
-      # gone, and a dead lane's OPENED PR has no CLAIMED to be stale in the
-      # first place. `holder_is_dead` is checked first and, alone, decides
-      # this branch; it is refused (as today) below wherever it says no.
-      if holder_is_dead "$h_lane"; then
-        takeover_from="$h_lane"
-        takeover_dead=1
-        takeover_note="lane $h_lane is dead (log ends $HOLDER_DEAD_VERB, $HOLDER_DEAD_WHY, issue #30)"
-        # A DIFFERENT PHRASE FOR THE PUBLIC COMMENT (Copilot round 3, PR #61):
-        # the formatter below used to say every takeover was "of the stale
-        # claim" unconditionally, which is simply false for this branch — the
-        # object may be an OPENED PR that was never a CLAIMED issue to begin
-        # with, and even a CLAIMED one is takeable here whatever its age. The
-        # audit comment a person outside this estate reads must not misstate
-        # why.
-        takeover_reason_phrase=" (takeover of a dead lane's hold: $takeover_note)"
-      else
-        # AMENDMENT 18(b) — A TERMINAL LOG WHOSE LAST BINDING IS ANOTHER PLACE'S
-        # IS UNKNOWN, NEVER DEAD (Copilot on 8ce6c9d, PR #61), and it is
-        # refused here, ahead of the verb test and of Rule 1's age-only test,
-        # for the reason `HOLDER_TERMINAL_UNKNOWN` is below: this workstation
-        # could not establish that nothing still runs under that name, and the
-        # log is exactly the shape issue #30 distrusts enough to check.
-        if [ -n "$HOLDER_BOUND_ELSEWHERE" ]; then
-          die "--force refused: lane $h_lane's own log ends $HOLDER_TERMINAL_SEEN, but its last binding is on $HOLDER_BOUND_ELSEWHERE (host/container), and liveness is pronounced only from inside a binding's own host and container — from here it is UNKNOWN, never dead (Amendment 18(b)). Run this takeover from that host and container, or have the lane's holds released there. Rule 1: the lane stops and reports; it does not author a successor." 2
-        fi
-        # OPENSOFT/OPENREPOTOOLS#67 — AND A REGISTER THAT COULD NOT BE READ IS
-        # REFUSED HERE TOO, ahead of the verb test, in its own words: the verb
-        # refusal below would blame a live session nobody looked for, and the
-        # `HOLDER_TERMINAL_UNKNOWN` one would put the failure on this
-        # workstation's session records, when what could not be read was the
-        # register — the row naming the ids to look for.
-        if [ -n "$HOLDER_REGISTER_UNREADABLE" ]; then
-          die "--force refused: lane $h_lane's own log ends $HOLDER_TERMINAL_SEEN, but the register (origin/$LANES_BRANCH:$LANES_PATH, or $LANES_FILE) could not be read, so the session ids lane $h_lane holds are not known and whether a live session on this workstation still backs it up was never checked. That is NOT 'it has no session ids' — an unreadable register never confirms a lane dead (issue #67). Fix the read and re-run. Rule 1: the lane stops and reports; it does not author a successor." 2
-        fi
-        if [ "$h_verb" != CLAIMED ]; then
-          # NAMES ITS OWN VERB, NOT ONLY THE THREE THAT USED TO BE POSSIBLE
-          # HERE (Copilot round 8, PR #61): before issue #30, `$h_verb` could
-          # only be OPENED, LANDING or WITHDRAWN by the time this branch is
-          # reached (a live lane's own TAKEOVER on an object it still holds
-          # falls through the `!= CLAIMED` test the same way) — but a dead
-          # lane's own un-superseded TAKEOVER (an earlier stale-claim takeover
-          # this lane never followed with a CLOSED/RELEASED/LANDED) reaches
-          # here too when THIS lane is confirmed alive, and the enumeration
-          # left it unnamed.
-          die "--force takes over a stale CLAIMED and nothing else: $obj is $h_verb by lane $h_lane. An open TAKEOVER, OPENED, LANDING or WITHDRAWN is not a stale claim, and lane $h_lane's own log does not end on ENDED or RETIRED either (or a live session on this workstation still holds it)." 2
-        fi
-        # A LIVE TERMINAL HOLDER IS REFUSED HERE, NOT ASKED WHETHER ITS CLAIM
-        # IS OLD (Copilot round 13, PR #61): `claim_is_stale` answers a claim's
-        # own AGE and has never known anything about the lane behind it — so a
-        # CLAIMED left by a lane whose own log says ENDED/RETIRED while a real
-        # session on this workstation still backs it up would read as an
-        # ORDINARY stale claim once old enough, and be taken over, which is
-        # exactly the collision issue #30 exists to stop (repoK-3's own shape,
-        # reached here only because ITS object happened to be OPENED rather
-        # than CLAIMED). `HOLDER_LIVE_TERMINAL` is the immediately-preceding
-        # `holder_is_dead` call's own tri-state answer for this lane; refused
-        # in these words rather than folded into the stale-claim message
-        # below, which is not why this one is refused.
-        if [ -n "$HOLDER_LIVE_TERMINAL" ]; then
-          die "--force refused: lane $h_lane's own log ends $HOLDER_LIVE_TERMINAL, but a live session on this workstation still backs it up — refused exactly as any other live holder's claim on $obj is. Rule 1: the lane stops and reports; it does not author a successor." 2
-        fi
-        # AND AN UNREADABLE RECORDS TREE IS REFUSED THE SAME WAY, NEVER ASKED
-        # claim_is_stale's QUESTION INSTEAD (Copilot's own "closer look" on
-        # c82577e, PR #61): "I could not check whether a live session backs
-        # this terminal log up" is not "checked and clear" — every OTHER
-        # caller of `live_holder` already refuses on a read this workstation
-        # could not make, and a terminal log is exactly the shape this branch
-        # exists to distrust; falling through to an age-only test here would
-        # let a workstation with no session records at all force a takeover
-        # `holder_is_dead` itself never established was safe.
-        if [ -n "$HOLDER_TERMINAL_UNKNOWN" ]; then
-          die "--force refused: lane $h_lane's own log ends $HOLDER_TERMINAL_UNKNOWN, and this workstation could not read whether a live session still backs it up. That is NOT 'no live session holds it' — refused for the same reason an unreadable read refuses the dead-lane path (issue #30), never assumed safe. Rule 1: the lane stops and reports; it does not author a successor." 2
-        fi
-        if ! claim_is_stale "$h_lane" "$obj" "$h_utc" "$h_file" "$h_line"; then
-          die "--force refused: lane $h_lane's claim on $obj is $(age_of "$h_utc") old (threshold ${STALE_HOURS}h), or it is a PR, or that lane has since OPENED a PR naming it. Rule 1 makes a claim takeable only when it is stale, and lane $h_lane's own log does not end on ENDED or RETIRED either (or a live session on this workstation still holds it)." 2
-        fi
-        takeover_from="$h_lane"
-        takeover_note="stale claim by lane $h_lane, posted $h_utc, no PR after ${STALE_HOURS}h"
-        takeover_reason_phrase=" (takeover of the stale claim held by lane $takeover_from)"
-      fi
-      # THE LOOKUP NAMES A "CLAIMED —" COMMENT, SO IT ONLY ANSWERS FOR ONE
-      # (Copilot round 12, PR #61): a dead lane's OPENED/LANDING/WITHDRAWN/
-      # TAKEOVER hold can carry an EARLIER claimed comment of its own, from
-      # before that lane progressed past it, and `gh_stale_claim_url` would
-      # happily hand back that superseded comment's URL — citing a claim that
-      # is not the hold this TAKEOVER displaces. Only a currently-CLAIMED hold
-      # is that comment's own hold; every other dead-lane verb takes the lane
-      # fallback, exactly as `--no-github` already does.
-      if [ "$NO_GITHUB" = 1 ] || [ "$h_verb" != CLAIMED ]; then
-        takeover_payload="lane:$h_lane"
-      else
-        takeover_payload="$(gh_stale_claim_url "$obj" "$h_lane")"
-        [ -n "$takeover_payload" ] || takeover_payload="lane:$h_lane"
-      fi
-    fi
-
-    # 2. Rule 1's three reads, printed.
-    reads="$(gh_reads "$obj")" || exit 1
-    printf '%s\n' "$reads"
-
-    # 3. decision 2 — a crossing warns and proceeds.
-    cross_repo_warn "$(object_repo "$obj")" "$home" "$lane"
-
-    # 4. append, commit, push. CP_AFTER_REBASE runs on every rebase inside the
-    #    push loop: if another lane's claim is on the rebased history, theirs
-    #    landed first and this one has lost.
-    uuid="$(session_for "$lane")"
-    utc="$(utc_now)"
-    CLAIM_OBJ="$obj"; CLAIM_LANE="$lane"; CLAIM_SKIP="$takeover_from"; CLAIM_SKIP_DEAD="$takeover_dead"
-    CLAIM_ABANDON_REVIVED=""
-    CP_AFTER_REBASE=claim_rescan_hook
-    # A line written with --no-github is NOT a Rule 1 claim until its GitHub
-    # comment exists, and it says so on its face rather than in a habit.
-    ng=""; [ "$NO_GITHUB" = 1 ] && ng="no-github"
-    if [ -n "$takeover_from" ]; then
-      write_event "$lane" TAKEOVER "$obj" "←" "$takeover_payload" "${ng:+$ng; }$takeover_note" "$utc" "$uuid"
-    else
-      write_event "$lane" CLAIMED "$obj" "" "" "$ng" "$utc" "$uuid"
-    fi
-    wrc=$?
-    CP_AFTER_REBASE=""
-    CLAIM_SKIP_DEAD=""
-
-    # 5. lost: Rule 1 says the lane STOPS AND REPORTS. The claim is abandoned,
-    #    never queued — Rule 7's queueing is for substrates, which this
-    #    amendment does not touch. TWO CAUSES, TWO EXIT CODES (Copilot's own
-    #    "closer look" on 21b8e82, PR #61): 7 is the documented, pre-existing
-    #    CLAIM-LOST — a rival's claim landed on main first; 9 is issue #30's
-    #    own dead-lane verdict failing to reconfirm before this takeover's
-    #    push landed. Both write the same CLAIM-LOST event (this attempt did
-    #    not succeed, in either cause), but automation reading the PROCESS
-    #    exit must be able to tell them apart, so the exit is never coerced
-    #    to 7 for the second.
-    if [ "$wrc" = 7 ] || [ "$wrc" = 9 ]; then
-      # "ALIVE AGAIN" ONLY WHERE IT WAS SEEN (Copilot on 05d7889, PR #61):
-      # `claim_rescan_hook` sets `CLAIM_ABANDON_REVIVED` for a confirmed
-      # revival — a live session now backs the lane, or its log moved past
-      # the terminal line — and leaves it empty where the verdict simply
-      # could not be reconfirmed (an unreadable log, or an unreadable
-      # records tree). The exit is 9 either way; only the words differ.
-      if [ "$wrc" = 9 ] && [ -n "$CLAIM_ABANDON_REVIVED" ]; then
-        note "TAKEOVER ABANDONED — lane $CLAIM_WINNER is alive again. Rule 1: stop and report; do not author a successor."
-        write_event "$lane" CLAIM-LOST "$obj" "→" "lane:$CLAIM_WINNER" "abandoned: $CLAIM_WINNER is no longer dead, takeover withdrawn before landing" "$(utc_now)" "$uuid"
-      elif [ "$wrc" = 9 ]; then
-        note "TAKEOVER ABANDONED — lane $CLAIM_WINNER's dead-lane verdict could not be reconfirmed before this push landed (above). Rule 1: stop and report; do not author a successor."
-        write_event "$lane" CLAIM-LOST "$obj" "→" "lane:$CLAIM_WINNER" "abandoned: the dead verdict on $CLAIM_WINNER could not be reconfirmed; takeover withdrawn before landing" "$(utc_now)" "$uuid"
-      else
-        note "CLAIM LOST — lane $CLAIM_WINNER's claim on $obj landed on main first. Rule 1: stop and report; do not author a successor."
-        write_event "$lane" CLAIM-LOST "$obj" "→" "lane:$CLAIM_WINNER" "abandoned: $CLAIM_WINNER landed its claim first" "$(utc_now)" "$uuid"
-      fi
-      who_object "$obj" || :
-      exit "$wrc"
-    fi
-    [ "$wrc" = 0 ] || exit "$wrc"
-
-    # 6. the comment, AFTER the push, citing the commit that carries the line.
-    sha="$(git -C "$LANES_REPO" rev-parse HEAD 2>/dev/null || printf '')"
-    if [ "$NO_GITHUB" != 1 ]; then
-      body="$(printf '%s — lane %s, session %s@%s, %s, for %s\n\nLogged in `%s` at `%s`%s.\n\nThe three reads (lane-collision-protocol Rule 1):\n\n```text\n%s\n```\n' \
-               "${takeover_from:+TAKEOVER}${takeover_from:-CLAIMED}" "$lane" "$uuid" "$WS" "$utc" "$obj" \
-               "$(log_path_for "$lane")" "${sha:-unknown}" "$takeover_reason_phrase" "$reads")"
-      url="$(gh_comment "$obj" "$body" 2>/dev/null || :)"
-      if [ -n "$url" ]; then
-        note "comment posted: $url"
-      else
-        note "WARNING: the GitHub comment could not be posted. The log line IS the claim and it has landed; post the comment by hand so that a reader outside this estate can see it."
-      fi
-    fi
-    note "lane $lane now holds $obj (${sha:-no sha})"
-    ;;
-
-  release)
-    lane="${LANES_LANE:-}"
-    [ -n "$lane" ] || die "release needs the lane: LANES_LANE=<lane> lanes-edit.sh release <object>" 2
-    check_lane_name "$lane"
-    obj_raw=""; why=""; home_override=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --no-github) NO_GITHUB=1; shift ;;
-        --home)      home_override="${2-}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift 2 ;;
-        --home=*)    home_override="${1#--home=}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift ;;
-        --)          shift ;;
-        -*)          die "unknown option '$1' for release" 2 ;;
-        *)
-          if   [ -z "$obj_raw" ]; then obj_raw="$1"
-          elif [ -z "$why" ];     then why="$1"
-          else die "release takes <object> [\"<why>\"]" 2
-          fi
-          shift ;;
-      esac
-    done
-    [ -n "$obj_raw" ] || die "usage: release <object> [\"<why>\"] [--no-github] [--home owner/repo]" 2
-    log_sync                      # R30 — the fetch, then --home and the STARTED line
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    home="$(resolve_home "$lane" "$home_override")" || exit $?
-    obj="$(canon_object "$obj_raw" "$home")" || exit 2
-    ! is_lane_object "$obj" || die "a lane is not a releasable object" 2
-    mine="$(state_events | lane_states_on "$obj" | awk -v sep="$US" -v lane="$lane" 'BEGIN{FS=sep} tolower($2) == tolower(lane)' || :)"
-    if [ -z "$mine" ]; then
-      note "NOTE: this lane has no line on $obj — releasing anyway, and the log will show that it did."
-    else
-      IFS="$US" read -r m_utc m_lane m_verb m_rest <<EOF
-$mine
-EOF
-      is_open_verb "$m_verb" || note "NOTE: this lane's last line on $obj is $m_verb, which is not an open state — releasing anyway."
-    fi
-    uuid="$(session_for "$lane")"
-    utc="$(utc_now)"
-    write_event "$lane" RELEASED "$obj" "" "" "$why" "$utc" "$uuid" || exit $?
-    if [ "$NO_GITHUB" != 1 ]; then
-      url="$(gh_comment "$obj" "$(printf 'RELEASED — lane %s, session %s@%s, %s, for %s%s\n' \
-               "$lane" "$uuid" "$WS" "$utc" "$obj" "${why:+ — $why}")" 2>/dev/null || :)"
-      [ -n "$url" ] && note "release comment posted: $url"
-    fi
-    note "lane $lane released $obj"
-    ;;
-
-  who)
-    mode="object"; arg=""; home_override=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --lane)      mode="lane";    arg="${2-}"; [ -n "$arg" ] || die "--lane needs a lane name" 2; shift 2 ;;
-        --lane=*)    mode="lane";    arg="${1#--lane=}"; [ -n "$arg" ] || die "--lane needs a lane name" 2; shift ;;
-        --landing)   mode="landing"; arg="${2-}"; [ -n "$arg" ] || die "--landing needs owner/repo" 2; shift 2 ;;
-        --landing=*) mode="landing"; arg="${1#--landing=}"; [ -n "$arg" ] || die "--landing needs owner/repo" 2; shift ;;
-        --home)      home_override="${2-}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift 2 ;;
-        --home=*)    home_override="${1#--home=}"; [ -n "$home_override" ] || die "--home needs owner/repo" 2; shift ;;
-        --no-fetch)  LANES_NO_FETCH=1; shift ;;
-        --)          shift ;;
-        -*)          die "unknown option '$1' for who" 2 ;;
-        *)           [ -z "$arg" ] || die "who takes one argument" 2; arg="$1"; shift ;;
-      esac
-    done
-    [ -n "$arg" ] || die "usage: who <object> | who --lane <lane> | who --landing owner/repo" 2
-    log_sync
-    case "$mode" in
-      lane)    arg="$(canon_lane "$arg")" || exit 2          # Amendment 15
-               who_lane "$arg" || exit $? ;;
-      landing)
-        wl_repo="$(alias_lookup "$arg" 2>/dev/null || :)"; wl_repo="${wl_repo:-$arg}"
-        case "$wl_repo" in */*) : ;; *) die "--landing needs owner/repo (or an alias in ${LANES_LOG_PREFIX%log/}repos.tsv); '$arg' is neither" 2 ;; esac
-        who_landing "$wl_repo" || exit $? ;;
-      *)
-        home="$(resolve_home "${LANES_LANE:-}" "$home_override")" || exit $?
-        obj="$(canon_object "$arg" "$home")" || exit 2
-        who_object "$obj" || exit $? ;;
-    esac
-    ;;
-
-  # ------------------------------------------- Amendment 8: swap and restart
-
-  # Read-only. Exit 0 with rows, 8 with none — 8 is "no record" here exactly as
-  # it is everywhere else, so a launcher may gate on it.
-  # `swapped` EXITS 64 ON A USAGE ERROR OF ITS OWN, never the dispatcher's 2
-  # (clause (c); F-B8, F-W4). The launcher gates its whole Amendment 8 degrade
-  # on this subcommand's 2 meaning ONE thing — "this `lanes-edit.sh` predates
-  # Amendment 8 and has no `swapped`" — and the dispatcher's unknown-subcommand
-  # 2 is exactly that. A caller's own bug must not be indistinguishable from an
-  # old helper at the one place the degrade is decided, so it gets a code of its
-  # own: 0 rows, 8 none swapped, 64 a bad call, 2 no such subcommand.
-  swapped)
-    sw_arg=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --) shift ;;
-        -*) die "unknown option '$1' for swapped (usage: swapped [<workstation>])" 64 ;;
-        *)  [ -z "$sw_arg" ] || die "swapped takes at most one workstation: swapped [<workstation>]" 64
-            sw_arg="$1"; shift ;;
-      esac
-    done
-    log_sync
-    # SEVEN FIELDS SINCE AMENDMENT 17(b), and the `NF >= 4` gate is unchanged:
-    # it is the shape test for a row that got as far as carrying a window, not a
-    # count of the fields a row has. `$7` and `$8` are the agent and its
-    # transcript, EMPTY for every record written before that amendment.
-    sw_out="$(swapped_lanes "${sw_arg:-$WS}" \
-              | LC_ALL=C sort -t"$US" -k1,1 -k3,3r -k2,2 \
-              | awk -v sep="$US" 'BEGIN { FS = sep; OFS = "\t" } NF >= 4 { print $2, $3, $4, $5, $6, $7, $8 }')"
-    if [ -z "$sw_out" ]; then
-      note "no lane on ${sw_arg:-$WS} is swapped — no lane's LAST lane-kind line is a PAUSED whose payload begins 'swap;' and names that workstation"
-      exit 8
-    fi
-    printf '%s\n' "$sw_out"
-    ;;
-
-  # The SessionStart hook. IT NEVER WRITES, IT NEVER TOUCHES THE NETWORK, AND
-  # IT ALWAYS EXITS 0 — the three properties that make it safe to put in front
-  # of every session on this workstation. Its stdin is the hook's JSON; with a
-  # terminal on stdin nobody piped one, and it is read as empty rather than
-  # waited for, because a hook that blocks is worse than a hook that says
-  # nothing.
-  #
-  # AMENDMENT 8, R-A8-1 — THERE IS NO `log_sync` HERE, AND THERE MUST NOT BE.
-  # This branch used to fetch: `log_sync` runs `remote_has_branch` (an
-  # `ls-remote`) and then a `fetch`, two network round-trips bounded at 60 s
-  # EACH, in front of every session start on the workstation — writing
-  # `.git/FETCH_HEAD`, objects and `refs/remotes/origin/main`, and advancing
-  # `origin/main` under any `lane-start` running at the same time. Amendment 7's
-  # "a read fetches first" governs STATE decisions (a claim, a refusal, who
-  # holds what); this is an informational block printed at every session start,
-  # and it must be fast and offline-safe instead. It reads the checkout AS LAST
-  # FETCHED and says how old that is, so a reader can tell a current answer from
-  # a stale one. `git_net` is the only door to the network in this file, and
-  # nothing on this path opens it.
-  session-start)
-    if [ -t 0 ]; then ss_json=""; else ss_json="$(cat 2>/dev/null || :)"; fi
-    ss_win=""
-    command -v tmux >/dev/null 2>&1 && ss_win="$(tmux display-message -p '#W' 2>/dev/null || :)"
-    session_start_block "$ss_json" "$ss_win" || :
-    exit 0
-    ;;
-
-  # AMENDMENT 12 — THE `UserPromptSubmit` HOOK. The ONE surface in this file
-  # that refuses a person's work, and the only one whose exit code is read by
-  # the harness rather than by a script: 2 BLOCKS the prompt and its stderr is
-  # what the person sees (code.claude.com/docs/en/hooks). Every other code lets
-  # the prompt through, which is why every refusal below is a 2 and why this
-  # verb is exempt from the dispatcher's `die … 1` above.
-  #
-  # AN ARGUMENT IS A USAGE REFUSAL AND NOT A SHRUG: a hook configured with a
-  # stray word is a hook nobody has checked, and passing the prompt through on
-  # one is exactly the silence Amendment 12 exists to end.
-  guard)
-    [ "$#" -eq 0 ] || die "usage: guard   (the UserPromptSubmit hook; the hook's JSON on stdin)" 2
-    if [ -t 0 ]; then g_json=""; else g_json="$(cat 2>/dev/null || :)"; fi
-    # IN A SUBSHELL, AND EVERY CODE BUT 0 IS A 2. This is clause (d) — *"fail
-    # CLOSED"* — made true of the guard's OWN failures and not only of the
-    # reads it makes, and it is here because the alternative was measured:
-    # `transcript_holders` left `th_here_prof` unset, `set -u` (line 292) took
-    # the whole shell down at the first record that was not this window's, and
-    # `lanes-edit.sh guard` exited 1. A 1 does not block a `UserPromptSubmit`
-    # — only 2 does — so the one defect this guard cannot have, a guard that
-    # lets a prompt through in silence, is exactly what a fatal inside it
-    # produced. The subshell contains it: `guard_run`'s effects are on the
-    # filesystem (the offer file, `lane-start`, the register) and on stderr,
-    # all of which cross it, and the only thing lost is shell state nothing
-    # reads afterwards.
-    #
-    # A `die` reached from one of the reads it makes is caught the same way,
-    # which is why the arm maps EVERY unexpected code rather than listing the
-    # ones known today.
-    g_rc=0
-    ( guard_run "$g_json" ) || g_rc=$?
-    case "$g_rc" in
-      0 | 2) exit "$g_rc" ;;
-      *) note "THE NAME GUARD ITSELF FAILED (exit $g_rc), so the three names were not verified — and a triple that cannot be verified is not a triple that agrees (Amendment 12(d)). This prompt is refused rather than let through, because only a 2 blocks one and a guard that fails open is the silence this amendment exists to end. $(guard_bypass)"
-         exit 2 ;;
-    esac
-    ;;
-
-  # --- internal reads, for lane-start and lane-end -------------------------
-  # Not part of the protocol's surface: they exist so that the two boundary
-  # scripts share ONE implementation of liveness and ONE parser of the log,
-  # instead of carrying copies that drift apart.
-  # Both answer with 8 for "there is no such record", the same 8 `who` uses,
-  # and with anything else ONLY when they failed. `lane-start` and `lane-end`
-  # treat 0 and 8 as answers and every other code as a refusal, because the
-  # first version of this returned 1 for both and both scripts read 1 as "no
-  # holder" / "pre-cutover lane" — a broken helper turned a refusal into a
-  # silent pass, which is the one thing a boundary act must never do.
-  # 0 prints `<uuid> <tmux> <name> <pid> <here|elsewhere|orphan>`, US-separated.
-  # The fifth field is Amendment 8 ruling (g)'s: the caller must not have to
-  # infer whose session it is from the `tmux` column, because a record with no
-  # target is not a record in no window, and reading it as one is what refused
-  # this lane the window it was running in.
-  # AMENDMENT 8(f), R-A8-6 — the row's EARLIER ids, and who is still holding
-  # them. Read-only, no fetch of its own (the caller has just made one), and it
-  # runs nothing: `lane-end <lane> --retire <pid|uuid>` is printed by the caller
-  # and typed by a person (clause (k) rule (e)).
-  # 0 with rows, 8 with none, 1 where the records could not be read — the same
-  # three answers `live-holder` gives, so a caller reads them the same way.
-  idle-holders)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: idle-holders <lane>" 2
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    idle_holders "$lane"; ih_rc=$?
-    case "$ih_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "could not read this workstation's session records for lane $lane: ${SESSION_FILES_ERR:-unknown error}." 1 ;;
-    esac
-    ;;
-
-  live-holder|lane-holders)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: live-holder <lane>" 2
-    # A READ FETCHES FIRST, like every other read here. This one did not, and
-    # "the published row" then meant whatever `origin/<branch>` happened to say
-    # when this checkout last pulled: a session started from another clone on
-    # this workstation stamps its uuid on the row, and until something unrelated
-    # fetched, the rename gate could not see it and answered 8 — a rename into a
-    # name that is held, which is what mints `<lane> (2)`. The fetch can only
-    # ADD ids, and an id is only ever a reason to refuse.
-    log_sync
-    # The id SET is the published row's union the working tree's (R25): this is
-    # the boundary read that decides whether a window may take a name, and an id
-    # only ever adds a reason to refuse.
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lh_ids="$( { session_ids_of_lane "$lane" 2>/dev/null || :
-                 session_ids_local_of_lane "$lane" 2>/dev/null || :; } | awk 'NF && !seen[$0]++')"
-    # DECISION 8(e) — A `--fork-session` OF THIS LANE'S TRANSCRIPT IS NEVER A
-    # HOLDER, AND SAYING SO IS PART OF THE ANSWER. `live_holder` already
-    # answers only about ids the ROW carries, so a fork — which has a new id
-    # and the lane's title — cannot be returned by it and could pass unseen.
-    # Amendment 8 ruling (g) skipped a `kind: bg` companion; Evidence 6's fork
-    # was one AND was orchestrating, so the rule is extended to forks BY ID.
-    # The note is on stderr, so the 0/8 contract this read's two callers gate
-    # on is untouched.
-    lh_fk=""; lh_fkrc=0
-    lh_fk="$(lane_forks "$lane" 2>/dev/null)" || lh_fkrc=$?
-    # ON STDERR, like the DEFECT line below it, so the 0/8 contract this read's
-    # two callers gate on is untouched — and said at all, because a fork check
-    # that could not be made is not a lane with no fork (#26, `37632b1`).
-    case "$lh_fkrc" in
-      0 | 8) : ;;
-      *) note "this workstation's session records could not be read, so whether a live FORK of lane $lane's transcript is running is NOT established — which is not the same as none. See: lanes-edit.sh forks $lane" ;;
-    esac
-    if [ -n "$lh_fk" ]; then
-      while IFS="$(printf '\t')" read -r lh_fid lh_fpid lh_fkind lh_fcwd; do
-        [ -n "${lh_fid:-}" ] || continue
-        note "DEFECT: $lh_fid is a live FORK of lane $lane's transcript (pid $lh_fpid, ${lh_fkind:-interactive}, cwd ${lh_fcwd:-unknown}) — it is NOT a holder of this lane and must not write the register. Retire it: lane-end $lane --retire $lh_fpid"
-      done <<EOF
-$lh_fk
-EOF
-    fi
-    lh_all=""; [ "$cmd" != lane-holders ] || lh_all=all
-    live_holder "$lane" "$lh_ids" "$lh_all"; lh_rc=$?
-    case "$lh_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "could not read this workstation's session records for lane $lane: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no live session holds it' — fix the records or the permissions and re-run." 1 ;;
-    esac
-    ;;
-
-  # AMENDMENT 8 — which LIVE session is in a tmux WINDOW, keyed on the window
-  # and not on a lane's recorded ids. `lane-start` asks it about the window it
-  # is run in, because the harness mints a new transcript uuid with nobody
-  # acting and that id is in no row for `live-holder` to find. 0 with
-  # `<uuid> <tmux> <name> <pid> <profile>` (US-separated), 8 when the records
-  # were read and no live one is in that window, 1 when they could not be read.
-  window-session)
-    wsub="${1-}"; [ -n "$wsub" ] || die "usage: window-session <tmux session>:<window id>" 2
-    window_session "$wsub"; wsub_rc=$?
-    case "$wsub_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "could not read this workstation's session records for window $wsub: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no live session is in that window'." 1 ;;
-    esac
-    ;;
-
-  # ------------------------- AMENDMENT 18(h): ONE LIVE PROCESS PER TRANSCRIPT
-  #
-  # THREE CALLERS AND ONE IMPLEMENTATION — `lane-start` before it binds or
-  # resumes an id, `lane-end --retire <pid>` when the duplicate's id is the
-  # ROW'S OWN (opensoft/openRepoTools#39), and the prompt `guard`. It answers
-  # about ONE transcript and says, per live process, where it is and whether it
-  # is THIS window's:
-  #
-  #   <pid><TAB-as-US><kind><US><tmux|none><US><profile><US><where><US><here|other><US><record file>
-  #
-  # 0 with rows, 8 with none, 1 where the records could not be read, 64 usage.
-  # The 1 is the fail-closed one: a caller that read it as 8 would bind a
-  # transcript two processes hold, which is the whole defect.
-  transcript-holders)
-    thub="${1-}"; [ -n "$thub" ] || die "usage: transcript-holders <session uuid>" 64
-    transcript_holders "$thub"; thub_rc=$?
-    case "$thub_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      64) die "usage: transcript-holders <session uuid>" 64 ;;
-      *) die "could not read this workstation's session records for session $thub: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no other live process carries it', and a caller that read it as one would bind a transcript two processes hold." 1 ;;
-    esac
-    ;;
-
-  # ---------------------- AMENDMENT 18(b): THE BINDING, AS A READ
-  #
-  # `binding <lane>` — WHERE THIS LANE IS, and whether this place may pronounce
-  # on it. Eight tab-separated fields; the FIRST FOUR are the contract
-  # opensoft/openRepoTools#38 act 2 states and the rest are grown at the end,
-  # this file's rule for a read that gains a field (`swapped_lanes`'s sixth and
-  # seventh say why):
-  #
-  #   <host> <container> <window> <utc> <session> <os> <here|elsewhere> <window state>
-  #
-  #   here / elsewhere   whether THIS process is inside the binding's own host
-  #                      and container — the only place liveness may be
-  #                      pronounced from (clause (b)). From `elsewhere` a
-  #                      binding is UNKNOWN and never dead, whatever `kill -0`
-  #                      says, because a pid does not cross a pid namespace.
-  #   window state       `live`, `gone` or `unknown`. `gone` is clause (b)'s one
-  #                      exception and is answered only where the HOST matches,
-  #                      because that is what makes the tmux server shared; it
-  #                      is the takeover path (opensoft/openRepoTools#30) and
-  #                      the one way a binding reads dead from another container.
-  #
-  # 0 BOUND · 8 FREE (the last lane-kind line released it, or there is none) ·
-  # 1 the log could not be read, which is never "this lane is free" (Amendment
-  # 7(d)) · 64 a usage error of its own.
-  binding)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: binding <lane>" 64
-    [ "$#" -le 1 ] || die "binding takes one lane: binding <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    bd_out=""; bd_rc=0
-    bd_out="$(lane_binding_scan "$lane")" || bd_rc=$?
-    [ "$bd_rc" = 0 ] || die "binding could not read lane $lane's object log (exit $bd_rc). That is NOT 'this lane is free' — a read that failed is never an answer (Amendment 7(d)), and a caller that took it as one would start a second session on a lane another place is holding." 1
-    # EVERY FIELD IS NAMED, and the last name is the last field: `read` puts
-    # what is left into its final variable, so a name short of the emit is a
-    # variable carrying four more fields glued on by `$US` — and `bd_legacy`
-    # then reads `legacy` plus four separators, which is not `legacy`, and the
-    # cutover rule below silently stops firing. Measured by the suite, on
-    # `lane-start --dry-run repoA11 7`: a pre-amendment binding on this very
-    # workstation read as another container's.
-    IFS="$US" read -r bd_state bd_host bd_cont bd_win bd_utc bd_sess bd_os \
-      bd_rutc bd_rsess bd_rpay bd_xverb bd_xutc bd_xsess bd_xpay bd_legacy \
-      bd_fverb bd_futc bd_fsess bd_fpay <<EOF
-$bd_out
-EOF
-    case "$bd_state" in
-      bound|requested) : ;;
-      *) exit 8 ;;
-    esac
-    bd_where=elsewhere
-    binding_is_here "$bd_host" "$bd_cont" "$bd_legacy" && bd_where=here
-    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
-      "${bd_host:-unknown}" "${bd_cont:-none}" "${bd_win:-none}" "${bd_utc:-unknown}" \
-      "${bd_sess:-unknown}" "${bd_os:-unknown}" "$bd_where" "$(binding_window_state "$bd_host" "$bd_win" "$bd_legacy")"
-    ;;
-
-  # ------------- AMENDMENT 18(c)/(e): ASK THE BINDING TO HAND OFF, THEN WAIT
-  #
-  #   request-handoff <lane> [--wait <s>] [--session <uuid>] [--no-wait]
-  #                          [--force "<why>"] [--dry-run]
-  #
-  # THE WHOLE OF CLAUSE (c)'s MECHANISM, in the order the clause states it: the
-  # line is written and PUSHED first, so a bound session anywhere reads it from
-  # `origin`; then — and only where the bound pane is on THIS tmux server —
-  # `/handoff --exit requested by <uuid>@<host>/<container>` is typed into it
-  # (Amendment 12's M1, the one mechanism a running session has); then the
-  # requester WAITS for a `PAUSED`, `ENDED` or `RETIRED` newer than its request.
-  #
-  # `--force` IS CLAUSE (e) AND IS A SECOND INVOCATION, NEVER AUTOMATIC: it
-  # writes the release ON THE BOUND SESSION'S BEHALF, in the REQUESTER'S OWN
-  # session field — *"so it is not impersonation (the retired-lane release of
-  # 2026-09-13, opensoft/openRepoTools#30, is the precedent)"* — and asks for
-  # nothing. It takes a WHY, because the bound session, if it is alive after all,
-  # is going to read that sentence at its next prompt and refuse every prompt
-  # from then on.
-  #
-  # EXIT CODES, this file's family: 0 THE LANE IS FREE — bind it · 2 the wait
-  # ended with nothing, or the request was refused · 8 the lane was already free
-  # · 1 a read failed, which is never "the lane is free" · 64 usage.
-  request-handoff)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: request-handoff <lane> [--wait <s>] [--session <uuid>] [--force \"<why>\"] [--dry-run]" 64
-    shift
-    rh_wait=300; rh_sess=""; rh_force=0; rh_dry=0; rh_why=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --wait)      rh_wait="${2-}"; [ -n "$rh_wait" ] || die "--wait needs a number of seconds" 64; shift 2 ;;
-        --wait=*)    rh_wait="${1#--wait=}"; [ -n "$rh_wait" ] || die "--wait needs a number of seconds" 64; shift ;;
-        --no-wait)   rh_wait=0; shift ;;
-        --session)   rh_sess="${2-}"; [ -n "$rh_sess" ] || die "--session needs a transcript uuid" 64; shift 2 ;;
-        --session=*) rh_sess="${1#--session=}"; [ -n "$rh_sess" ] || die "--session needs a transcript uuid" 64; shift ;;
-        --force)     rh_force=1; shift ;;
-        --dry-run)   rh_dry=1; shift ;;
-        --)          shift; while [ $# -gt 0 ]; do rh_why="${rh_why:+$rh_why }$1"; shift; done ;;
-        -*)          die "unknown option '$1' for request-handoff" 64 ;;
-        *)           rh_why="${rh_why:+$rh_why }$1"; shift ;;
-      esac
-    done
-    case "$rh_wait" in ''|*[!0-9]*) die "--wait takes a whole number of seconds; '$rh_wait' is not one" 64 ;; esac
-    # A WHY BELONGS TO `--force` AND TO NOTHING ELSE, so one given without it is
-    # REFUSED rather than ignored: a request carries the asker's host, container
-    # and window and no sentence, and words silently dropped are words a person
-    # believes they wrote into an append-only log.
-    if [ -n "$rh_why" ] && [ "$rh_force" = 0 ]; then
-      die "request-handoff takes no free text: clause (c)'s request line says WHO is asking and from WHERE — \`by host <h>; container <c>; window <w>; wait <n>s\` — and carries no sentence. A why is what \`--force\` writes, because that one is read by the session it takes the lane from:
-    $SELF request-handoff $lane --force \"$rh_why\"" 64
-    fi
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    # THE SEAM (Copilot round 3 on #97): asking a lane's session to hand off is
-    # a handoff act on that lane, refused for a managed one before the binding
-    # is read — so `--dry-run` refuses too, rather than planning an act that
-    # could not be taken.
-    managed_seam_refuse "$lane" "request-handoff (Amendment 18(c))"
-    rh_out=""; rh_rc=0
-    rh_out="$(lane_binding_scan "$lane")" || rh_rc=$?
-    [ "$rh_rc" = 0 ] || die "request-handoff could not read lane $lane's object log (exit $rh_rc). That is NOT 'this lane is free' (Amendment 7(d)), and nothing was written." 1
-    IFS="$US" read -r rh_state rh_host rh_cont rh_win rh_utc rh_bsess rh_os \
-      rh_rutc rh_rsess rh_rpay rh_xverb rh_xutc rh_xsess rh_xpay rh_legacy \
-      rh_fverb rh_futc rh_fsess rh_fpay <<EOF
-$rh_out
-EOF
-    case "$rh_state" in
-      bound|requested) : ;;
-      *) note "lane $lane is FREE — its last lane-kind line is ${rh_xverb:-none at all}${rh_xutc:+ at $rh_xutc}, so there is no binding to ask and nothing was written. Bind it."; exit 8 ;;
-    esac
-    rh_wstate="$(binding_window_state "$rh_host" "$rh_win" "$rh_legacy")"
-    # WHERE the binding is decides what a reader is TOLD, not whether the
-    # request is allowed. Clause (c) makes a different `host`, `container` OR
-    # WINDOW a refusal to bind, so a binding in this very host and container —
-    # a second window of it — is asked for exactly as another machine's is, and
-    # the one place a request has nothing to ask is the window it is made from.
-    rh_here=elsewhere
-    binding_is_here "$rh_host" "$rh_cont" "$rh_legacy" && rh_here=here
-    # AND THAT ONE PLACE IS TESTED ONLY WHERE THE BINDING IS LOCAL (Copilot
-    # round 1 on this PR). A tmux `@id` names a window ON ONE TMUX SERVER and
-    # tmux reissues them from `@0` when a server is replaced, so `@3` here and
-    # `@3` on another machine are not one window — and comparing the ids alone
-    # would refuse a request from a second HOST whose current window happened to
-    # carry the bound window's number, which is the one refusal that leaves a
-    # lane unaskable. The identity test is made after locality is proved, never
-    # instead of it.
-    if [ "$rh_here" = here ] && binding_is_this_window "$rh_win"; then
-      die "lane $lane's binding IS this window ($rh_win) on this host and in this container: a handoff request is what a SECOND place makes of the first, and there is nothing here to ask. Nothing was written." 2
-    fi
-
-    # ---- CLAUSE (e): `--force`, THE SECOND INVOCATION.
-    if [ "$rh_force" = 1 ]; then
-      [ -n "$rh_why" ] || die "--force takes a WHY, and it is not decoration: it is written into the lane's append-only log and it is the sentence the bound session reads at its next prompt, when it refuses every prompt from then on and names who forced it (Amendment 18(e)). Say what happened:
-    $SELF request-handoff $lane --force \"<why>\"" 2
-      rh_uuid="$(requester_uuid "$rh_sess")" || rh_uuid=""
-      [ -n "$rh_uuid" ] || die "--force writes a \`PAUSED\` in THE REQUESTER'S OWN session field — that is what makes it a release on behalf of the bound session rather than an impersonation of it (Amendment 18(e); the 2026-09-13 retired-lane release, opensoft/openRepoTools#30, is the precedent) — and no transcript uuid is knowable here. Name it: --session <uuid>, or run this from inside the session that wants the lane. Nothing was written." 2
-      # THE PERSON TYPED A SENTENCE, NOT A GRAMMAR — so the three separators
-      # this line is built out of are folded rather than refused: `, ` divides
-      # an event line's four FIELDS, ` — ` divides the verb from the fields and
-      # the fields from the free text, and `; ` divides one SUB-FIELD from the
-      # next. A middle dot is none of them, and it is the separator this
-      # estate's own register rows already use.
-      #
-      # AND THE WHY IS WRITTEN AS A NAMED SUB-FIELD, `why <text>`, which clause
-      # (e) does not spell and which the log needs. The clause's `; <why the
-      # person gave>` is a sub-field with no name, and every reader here matches
-      # a sub-field by the word it OPENS with: a why beginning `host is
-      # unreachable` would be read as this line's `host`, refused by the
-      # writer's own check, and the person would be told about a field they did
-      # not write. Named, it can collide with nothing, the words are still
-      # exactly the ones they typed, and `why` is a name no reader in this file
-      # parses.
-      rh_why_clean="$(printf '%s' "$rh_why" | sed 's/ — / · /g; s/, / · /g; s/; / · /g')"
-      # THE BINDING IS READ AGAIN IMMEDIATELY BEFORE THE APPEND (Copilot round 1
-      # on this PR). This release names the session it acts for — `on behalf of
-      # <bound uuid>` — out of a scan made before the uuid was resolved and the
-      # why was checked. If the original holder released in between and a third
-      # place bound the lane, an unconditional append would release THE NEW
-      # HOLDER while naming the old one: the one act this clause exists to make
-      # loud, made silently against somebody who never had a chance to answer.
-      # The window is not closed by this — an append is not a lock, and nothing
-      # in the ratified text gives a lane one — but the scan is now the last
-      # thing before the write rather than the first thing in the run, and a
-      # binding that moved is a refusal naming what it moved to.
-      rh_re=""; rh_re_rc=0
-      rh_re="$(lane_binding_scan "$lane")" || rh_re_rc=$?
-      [ "$rh_re_rc" = 0 ] || die "lane $lane's object log could not be re-read immediately before the forced release (exit $rh_re_rc), and a \`PAUSED\` written on an answer nobody got could release a binding that is not the one this run read. Nothing was written." 1
-      IFS="$US" read -r rh2_state rh2_host rh2_cont rh2_win rh2_utc rh2_sess rh2_rest <<EOF
-$rh_re
-EOF
-      if ! binding_identity_same "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" \
-                                 "$rh2_host" "$rh2_cont" "$rh2_win" "$rh2_utc" "$rh2_sess"; then
-        die "lane $lane's binding CHANGED while this run was preparing to force it. It was window $rh_win in container $rh_cont on host $rh_host (session ${rh_bsess:-unknown}, $rh_utc); it is now ${rh2_state:-free}${rh2_win:+, window $rh2_win in container ${rh2_cont:-none} on host ${rh2_host:-unknown} (session ${rh2_sess:-unknown}, $rh2_utc)}. Nothing was written: a forced release names the session it acts for, and this one would have named a session that no longer holds the lane while releasing one that does. Read it and decide again:
-    $SELF binding $lane" 2
-      fi
-      rh_fpay="on behalf of ${rh_bsess:-unknown}; forced by $rh_uuid@$LANES_HOST_NAME/$LANES_CONTAINER_NAME; why $rh_why_clean"
-      if [ "$rh_dry" = 1 ]; then
-        note "PLAN: $SELF log PAUSED lane:$lane → \"$rh_fpay\"   (as session $rh_uuid)"
-        note "PLAN: then bind — the lane reads free from that line on"
-        exit 0
-      fi
-      write_event "$lane" PAUSED "lane:$lane" '→' "$rh_fpay" "forced release" "$(utc_now)" "$rh_uuid" || exit $?
-      note "FORCED: lane $lane's binding is released on behalf of ${rh_bsess:-the bound session}. $(binding_facts "$lane" "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" "$rh_wstate")"
-      note "If that session is alive after all it will read this line at its next prompt and refuse EVERY prompt from then on, naming it and naming you, until the person there hands off or ends it (Amendment 18(e)). Two places never both write a lane in silence."
-      exit 0
-    fi
-
-    # ---- CLAUSE (c): THE REQUEST, WRITTEN BEFORE ANYTHING ELSE IS TRIED.
-    rh_uuid="$(requester_uuid "$rh_sess")" || rh_uuid=""
-    [ -n "$rh_uuid" ] || die "clause (c)'s request line carries the REQUESTER'S transcript uuid in its session field, and Amendment 7(b) admits nothing else there — not a placeholder, and never the literal 'unknown', which is in this estate's append-only log four times already with no later line able to correct any of them. No uuid is knowable here: this shell has no \$CLAUDE_CODE_SESSION_ID and no live session record names this window. Ask from inside the session that wants the lane, or name it:
-    $SELF request-handoff $lane --session <uuid>
-    Nothing was written." 2
-    rh_mywin="$(tmux display-message -p '#{session_name}:#{window_index}' 2>/dev/null || :)"
-    rh_myid="$(tmux display-message -p '#{window_id}' 2>/dev/null || :)"
-    case "$rh_myid" in @[0-9]*) rh_mywin="$rh_mywin $rh_myid" ;; esac
-    [ -n "$rh_mywin" ] || rh_mywin=none
-    rh_pay="by host $LANES_HOST_NAME; container $LANES_CONTAINER_NAME; window $rh_mywin; wait ${rh_wait}s"
-    rh_type="/handoff --exit requested by $rh_uuid@$LANES_HOST_NAME/$LANES_CONTAINER_NAME"
-    if [ "$rh_dry" = 1 ]; then
-      note "PLAN: $(binding_facts "$lane" "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" "$rh_wstate") ($rh_here)"
-      note "PLAN: $SELF log HANDOFF-REQUESTED lane:$lane → \"$rh_pay\"   (as session $rh_uuid), committed and pushed FIRST"
-      if [ "$rh_wstate" = live ]; then
-        note "PLAN: tmux send-keys into ${rh_win##* } — $rh_type"
-      else
-        note "PLAN: nothing is typed into a pane — this tmux server says the bound window is $rh_wstate, and the request travels through the pushed log alone"
-      fi
-      note "PLAN: then poll the published log every ${LANES_POLL_SECONDS:-15}s for ${rh_wait}s for a PAUSED, ENDED or RETIRED newer than the request; an empty wait REFUSES and names --force"
-      exit 0
-    fi
-    rh_wrote="$(utc_now)"
-    write_event "$lane" HANDOFF-REQUESTED "lane:$lane" '→' "$rh_pay" "" "$rh_wrote" "$rh_uuid" || exit $?
-    note "REQUESTED: $(binding_facts "$lane" "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" "$rh_wstate")"
-
-    # ---- AND ONLY NOW THE PANE, WHERE IT IS ON THIS TMUX SERVER (Amendment
-    # 12's M1). It is an OPTIMISATION of the same-host case and never the
-    # request: a session that never reads it answers at its hook's next read of
-    # the pushed line instead.
-    rh_typed=no
-    if [ "$rh_wstate" = live ]; then
-      rh_trc=0
-      guard_type "${rh_win##* }" "$rh_type" || rh_trc=$?
-      case "$rh_trc" in
-        0) rh_typed=yes; note "typed into ${rh_win##* }: $rh_type" ;;
-        9) note "the bound pane is running something other than \`claude\`, so nothing was typed into it (M1's own condition): the request is in the pushed log and is read at that session's next prompt." ;;
-        8) note "the bound pane's current command could not be read, so nothing was typed into it — fail closed (M1). The request is in the pushed log." ;;
-        *) note "tmux would not take the keys for ${rh_win##* }, so nothing was typed. The request is in the pushed log and is read at that session's next prompt." ;;
-      esac
-    else
-      note "the bound window is $rh_wstate from here, so no pane was typed into: the request travels through the pushed log, which is why it is written first."
-    fi
-
-    # ---- THE WAIT (clause (c)), AND ITS EMPTY END (clause (e)).
-    rh_poll="${LANES_POLL_SECONDS:-15}"
-    case "$rh_poll" in ''|*[!0-9]*|0) rh_poll=15 ;; esac
-    rh_deadline=$(( $(date -u +%s) + rh_wait ))
-    [ "$rh_wait" = 0 ] || note "waiting up to ${rh_wait}s for lane $lane to be released (polling the published log every ${rh_poll}s) …"
-    while : ; do
-      rh_left=$(( rh_deadline - $(date -u +%s) ))
-      if [ "$rh_left" -le 0 ]; then break; fi
-      # THE SLEEP IS BOUNDED BY WHAT IS LEFT OF THE WAIT (Copilot round 1 on
-      # this PR). `--wait <s>` is an UPPER BOUND a person named, and a fixed
-      # fifteen-second poll overruns it whenever the two disagree: `--wait 1`
-      # slept fifteen and then answered. What the poll interval decides is how
-      # OFTEN the log is asked, never how long the caller is held.
-      rh_nap="$rh_poll"
-      [ "$rh_nap" -gt "$rh_left" ] && rh_nap="$rh_left"
-      sleep "$rh_nap"
-      log_sync
-      rh_out=""; rh_rc=0
-      rh_out="$(lane_binding_scan "$lane")" || rh_rc=$?
-      [ "$rh_rc" = 0 ] || { note "the lane's log could not be read on this poll — waiting on"; continue; }
-      IFS="$US" read -r rh_state2 rh_host2 rh_cont2 rh_win2 rh_utc2 rh_bsess2 rh_os2 rh_rest2 <<EOF
-$rh_out
-EOF
-      case "$rh_state2" in
-        released|free)
-          note "lane $lane is FREE — the binding was released while this request waited. Bind it."
-          exit 0 ;;
-        bound|requested)
-          if ! binding_identity_same "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" \
-                                     "$rh_host2" "$rh_cont2" "$rh_win2" "$rh_utc2" "$rh_bsess2"; then
-            die "lane $lane was released and BOUND AGAIN while this request waited — its binding is now window ${rh_win2:-none} in container ${rh_cont2:-none} on host ${rh_host2:-unknown} (session ${rh_bsess2:-unknown}, $rh_utc2). The request this run wrote is answered and the lane is somebody else's: ask again, or take it up with that place." 2
-          fi ;;
-      esac
-    done
-    note "THE WAIT ENDED WITH NOTHING. $(binding_facts "$lane" "$rh_host" "$rh_cont" "$rh_win" "$rh_utc" "$rh_bsess" "$rh_wstate")"
-    note "  the request: $rh_wrote → $rh_pay, as session $rh_uuid"
-    note "  the pane:    ${rh_typed} (this tmux server says that window is $rh_wstate)"
-    die "no PAUSED, ENDED or RETIRED newer than that request arrived in ${rh_wait}s, so lane $lane is still bound and NOTHING here has bound it (Amendment 18(e)). A working session is never interrupted — a hook fires at a prompt boundary, and a session inside a long turn answers when that turn ends. Wait longer, or override, which is a SECOND invocation and never automatic:
-    $SELF request-handoff $lane --wait 900
-    $SELF request-handoff $lane --force \"<why you are taking it>\"" 2
-    ;;
-
-  # ------------------------------ AMENDMENT 11, clause (h): the new reads
-  #
-  # ALL READ-ONLY; all answer out of `origin/<branch>` as every Amendment 7
-  # read does; all honour `LANES_NO_FETCH=1`, because each one sits in front of
-  # a launch and a launcher must not sit on the network to open a terminal; and
-  # all follow Amendment 7(d)'s fail-closed convention — 0 an answer, 8 NO
-  # ANSWER, 64 a usage error of their own, and anything else a failed read that
-  # a caller must not read as "nothing to report".
-  #
-  # WITH ONE EXCEPTION, AND IT IS THE ONE EVERY UN-UPGRADED WORKSTATION IS IN:
-  # a `lanes-edit.sh` that has never heard of one of these exits **2** for an
-  # unknown subcommand, exactly as a pre-Amendment-8 one did for `swapped`.
-  # That is A HELPER PREDATING THE AMENDMENT THAT ADDED THE READ — expected and
-  # silent — and a caller falls to its next rung there rather than refusing.
-  # The two kinds of 2 are told apart by the helper's own WORDS and not by its
-  # status: the `*)` arm below says "unknown subcommand" and no other refusal
-  # here does.
-
-  # ADOPTION ACT 0 SHIPS `session-lane`, AND IT IS BELOW RATHER THAN HERE.
-  # `opensoft/brett-wip#5` @`3719d97` added it and `openRepoTools#24` — MERGED as
-# `d4b5710` on this repository's `main`, which is the sha act 3 is cited by from
-# here on rather than a branch name — ported that
-  # commit into this copy, so this branch carries NO second implementation of it
-  # (A11 Addendum 3, CF-T11: act 0 ships FOUR items, and that is the fourth).
-  # `3719d97` IS THE MERGE COMMIT. Act 0 merged 2026-09-13T19:14:37Z, squashed,
-  # so the draft head `95e7a4c` this comment used to cite is not an ancestor of
-  # `origin/main` at all (F-X18, A11 Addendum 4 ruling 13).
-  # `/restart`'s step 2(b) and `lane-start`'s step 3b both call the ported arm.
-
-  # The lane bound to a window OF THE ASKING WORKSTATION. Three callers share
-  # this one implementation — the launcher's precedence 3, `/restart`'s step
-  # 2(c), and the `/lane-swap` skill's step 1 — and it owns the `<@id>`-versus-
-  # ref agreement rule for all three (A11 Addendum 2, `R-A11-8`).
-  #
-  # The optional workstation comes FIRST, exactly as `swapped [<ws>]` takes it,
-  # and is told from the ref by shape: a ref is an `@id` or carries a `:`, and
-  # a workstation name is neither.
-  window-lane)
-    wl_a=""; wl_b=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --) shift ;;
-        -*) die "unknown option '$1' for window-lane (usage: window-lane [<workstation>] <@id>|<session>:<index>)" 64 ;;
-        *)  if   [ -z "$wl_a" ]; then wl_a="$1"
-            elif [ -z "$wl_b" ]; then wl_b="$1"
-            else die "window-lane takes at most a workstation and one window ref" 64
-            fi
-            shift ;;
-      esac
-    done
-    if [ -n "$wl_b" ]; then wl_in_ws="$wl_a"; wl_in_ref="$wl_b"
-    else                    wl_in_ws="$WS";   wl_in_ref="$wl_a"
-    fi
-    [ -n "$wl_in_ref" ] || die "usage: window-lane [<workstation>] <@id>|<session>:<index>" 64
-    case "$wl_in_ref" in
-      @*|*:*) : ;;
-      *) die "'$wl_in_ref' is neither an <@id> nor a <session>:<index>. A workstation is given FIRST: window-lane [<workstation>] <ref>" 64 ;;
-    esac
-    log_sync
-    window_lane "$wl_in_ws" "$wl_in_ref"; wl_rc=$?
-    case "$wl_rc" in
-      0)  : ;;
-      8)  exit 8 ;;
-      64) die "usage: window-lane [<workstation>] <@id>|<session>:<index>" 64 ;;
-      *)  die "window-lane could not read this workstation's records for $wl_in_ref (exit $wl_rc). That is NOT 'no lane is bound to that window'." 1 ;;
-    esac
-    ;;
-
-  # The lane's RECORDED DIRECTORY: the `dir ` sub-field of its log's LAST
-  # lane-kind line carrying one, in file order, unquoted where it was written
-  # quoted (Amendment 11 clause (c)). Four callers: `lane-start`'s directory
-  # precedence rung 3, the launcher's `--dir` default, `/restart`'s step 3 and
-  # `restart`'s own.
-  #
-  # 8 IS THE ANSWER FOR EVERY LANE THAT HAS NOT STARTED UNDER THIS AMENDMENT,
-  # and it is not a failure: adoption act 7 cuts each lane over at its own next
-  # start, nothing is backfilled (Amendment 7(i)), and the default
-  # `$PROJECTS_ROOT/<repo>` carries it until then, which is what it has always
-  # done.
-  lane-dir)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-dir <lane>" 64
-    [ "$#" -le 1 ] || die "lane-dir takes one lane: lane-dir <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    # THE READER'S STATUS DECIDES, AS IT DOES IN EVERY OTHER ARM OF THIS CLAUSE
-    # (#26, the fail-closed family one layer out). `window-session`, `last-session`,
-    # `forks` and `window-lane` all carry this `case`; these two carried
-    # `|| :` and then read the EMPTINESS of the output, so a log that could not
-    # be read left here as **8** — the pre-cutover answer, which is the one
-    # answer every caller of this read treats as *"fall to the next rung"*.
-    ld_out="$(lane_payload_field "$lane" dir)"; ld_rc=$?
-    case "$ld_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane-dir could not read lane $lane's log (exit $ld_rc). That is NOT 'this lane has no recorded directory', and a caller that read it that way would resolve the directory from the rungs beneath a record it never read (Amendment 7(d))." 1 ;;
-    esac
-    [ -n "$ld_out" ] || exit 8
-    printf '%s\n' "$ld_out"
-    ;;
-
-  # THE LANE'S RECORDED PROFILE — `lane-dir`'s sibling, and the same read one
-  # sub-field along: the `profile ` of its log's LAST lane-kind line carrying
-  # one, unquoted where it was written quoted.
-  #
-  # IT IS AN ADDITION TO SPEC §11's TABLE AND IS NAMED AS ONE. `lane <name>`
-  # needs exactly two facts about a lane it is not standing in — its directory
-  # and its profile — and the directory already had a read of its own. Without
-  # this the profile came out of the `lanes` listing, which must consult
-  # `state_events` for the held-objects column and so reads EVERY log on the
-  # workstation: measured at seventeen seconds on the live register, to answer
-  # one question about one lane, on the path a person types to get back to work.
-  # One `git show` instead, through the same `lane_payload_field` `lane-dir`
-  # uses, so the two cannot disagree about which line is a lane's last.
-  #
-  # 8 IS THE ANSWER FOR EVERY LANE THAT HAS NOT STARTED UNDER THIS AMENDMENT,
-  # and `restart` refuses on it rather than guessing: a wrong profile is a
-  # launch into another account.
-  lane-profile)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-profile <lane>" 64
-    [ "$#" -le 1 ] || die "lane-profile takes one lane: lane-profile <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lp_out="$(lane_payload_field "$lane" profile)"; lp_rc=$?
-    case "$lp_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane-profile could not read lane $lane's log (exit $lp_rc). That is NOT 'this lane's record names no profile', and a wrong profile is a launch into another account (Amendment 7(d))." 1 ;;
-    esac
-    [ -n "$lp_out" ] || exit 8
-    printf '%s\n' "$lp_out"
-    ;;
-
-  # ------------------------------------------- AMENDMENT 17(b): the two reads
-  #
-  # `lane-agent` and `lane-transcript` are `lane-dir`'s siblings, one sub-field
-  # along and through the same `lane_payload_field`, so the four cannot disagree
-  # about which line is a lane's last. ONE CALLER EACH TODAY and that is the
-  # point of the read existing rather than being inlined: `lane-start` reads the
-  # agent to know WHICH LAUNCHER to use with no `--agent`, and reads the
-  # transcript to know the id to append to the row's session cell in that
-  # agent's own spelling (`Codex <id>`), which is the one id a launch of a
-  # non-Claude agent has in hand.
-  #
-  # 8 IS THE ANSWER FOR EVERY RECORD WRITTEN BEFORE THIS AMENDMENT, and it is
-  # not a failure: Amendment 7(i) cuts each lane over at its own next handoff,
-  # nothing is backfilled, and `lane-start`'s default of `claude` carries it
-  # until then — which is what it has always done.
-  lane-agent)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-agent <lane>" 64
-    [ "$#" -le 1 ] || die "lane-agent takes one lane: lane-agent <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15: one name under any case
-    la_out="$(lane_payload_field "$lane" agent)"; la_rc=$?
-    case "$la_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane-agent could not read lane $lane's log (exit $la_rc). That is NOT 'this lane's record names no agent', and a caller that read it that way would launch the default agent over a lane another one paused (Amendment 7(d))." 1 ;;
-    esac
-    [ -n "$la_out" ] || exit 8
-    printf '%s\n' "$la_out"
-    ;;
-
-  lane-transcript)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-transcript <lane>" 64
-    [ "$#" -le 1 ] || die "lane-transcript takes one lane: lane-transcript <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15: one name under any case
-    lt_out="$(lane_payload_field "$lane" transcript)"; lt_rc=$?
-    case "$lt_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane-transcript could not read lane $lane's log (exit $lt_rc). That is NOT 'this lane's record names no transcript' (Amendment 7(d))." 1 ;;
-    esac
-    [ -n "$lt_out" ] || exit 8
-    printf '%s\n' "$lt_out"
-    ;;
-
-  # AMENDMENT 13(b) — THE DIARY THE CELL USED TO BE, IN THE FILE BUILT TO HOLD
-  # IT. A lane's `NOTED` and `RULED` lines in order — FILE order, which is the
-  # order that lane wrote them (R14), and never a sort on the UTC field: two
-  # workstations share no clock and this one has been measured jumping ±25s.
-  # `--since` is the one filter, and it compares the two instants after padding
-  # the register's older minute-precision form to seconds, so a line stamped
-  # `…T20:31Z` is on the right side of a `--since …T20:30:00Z`.
-  #
-  # 8 IS "THIS LANE HAS WRITTEN NO NARRATIVE", which a lane that has never taken
-  # a note and a lane with no log at all both are; a read that could not be made
-  # is never 8 (R22) and leaves through the die above it.
-  # AMENDMENT 13's DIARY, and since AMENDMENT 14 ACROSS LANES TOO.
-  #
-  #   history <lane>                one lane's `NOTED` and `RULED` lines, in
-  #                                 FILE ORDER — the diary the state cell used
-  #                                 to be. Unchanged.
-  #   history --all                 every lane's, as ONE timeline: by UTC, and
-  #                                 by file and line where two share a minute.
-  #   history --repo <owner/repo>   the lanes whose HOME is that repository —
-  #                                 the `home` of their last `STARTED`/`RESUMED`,
-  #                                 through the alias table, exactly as `lanes
-  #                                 --repo` files them — on one timeline.
-  #   --since <UTC>                 with any of the three.
-  #   --index                       read the DERIVED INDEX instead of the
-  #                                 published logs (Amendment 14(b)), only when
-  #                                 typed: stderr says `read: index (<store>) at
-  #                                 register@<sha12>; <k> commits behind`, or
-  #                                 `read: sources (index <why>)` and the
-  #                                 sources answer. Where the index answers it
-  #                                 does not fetch: it reads no network at all,
-  #                                 and the lag is said against this checkout.
-  #
-  # `history` over two lanes was refused, exit 64, on 2026-10-05 (Amendment 14,
-  # "Why" 3); `--all` and `--repo` are that question, and they read the
-  # SOURCES — the same one pass over every published log `who` makes — with or
-  # without the flag.
-  history)
-    lane=""; hi_since=""; hi_all=0; hi_repo=""; hi_index=0
-    hi_usage="history <lane> | --all | --repo <owner/repo>  [--since <UTC>] [--index]"
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --since)   hi_since="${2-}"; [ -n "$hi_since" ] || die "--since needs a UTC instant" 64; shift 2 ;;
-        --since=*) hi_since="${1#--since=}"; [ -n "$hi_since" ] || die "--since needs a UTC instant" 64; shift ;;
-        --all)     hi_all=1; shift ;;
-        --repo)    hi_repo="${2-}"; [ -n "$hi_repo" ] || die "--repo needs a repository ($hi_usage)" 64; shift 2 ;;
-        --repo=*)  hi_repo="${1#--repo=}"; [ -n "$hi_repo" ] || die "--repo needs a repository ($hi_usage)" 64; shift ;;
-        --index)   hi_index=1; shift ;;
-        --)        shift ;;
-        -*)        die "unknown option '$1' for history ($hi_usage)" 64 ;;
-        *)         [ -z "$lane" ] || die "history takes ONE lane, or --all, or --repo <owner/repo>: $hi_usage" 64; lane="$1"; shift ;;
-      esac
-    done
-    hi_sel=0
-    [ -n "$lane" ] && hi_sel=$((hi_sel + 1))
-    [ "$hi_all" = 1 ] && hi_sel=$((hi_sel + 1))
-    [ -n "$hi_repo" ] && hi_sel=$((hi_sel + 1))
-    [ "$hi_sel" = 1 ] || die "usage: $hi_usage — ONE of a lane, --all or --repo" 64
-    [ -z "$lane" ] || check_lane_name "$lane"
-    case "$hi_since" in
-      '') : ;;
-      [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]Z | [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]T[0-9][0-9]:[0-9][0-9]:[0-9][0-9]Z) : ;;
-      *) die "--since takes a UTC instant spelled as this log spells it, YYYY-MM-DDTHH:MM[:SS]Z — '$hi_since' is not one" 64 ;;
-    esac
-    # THE INDEX FIRST, and where it answers there is no fetch: the read is the
-    # index's, and a network round trip in front of it is the cost the flag is
-    # for avoiding. Where it does not answer, the source read below is exactly
-    # the one this arm always made, the fetch included.
-    if [ "$hi_index" = 1 ] && index_open; then LANES_NO_FETCH=1; fi
-    log_sync
-    if [ -n "$lane" ]; then
-      lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-      hi_lines=""; hi_rc=0
-      hi_lines="$(lane_log_events "$lane")" || hi_rc=$?
-      case "$hi_rc" in
-        0) : ;;
-        2) exit 2 ;;
-        *) die "history could not read lane $lane's log (exit $hi_rc). That is NOT 'this lane has written no narrative' — a read that failed is never an answer (Amendment 7(d))." 1 ;;
-      esac
-      hi_out="$(printf '%s\n' "$hi_lines" | awk -F"$US" -v since="$hi_since" '
-        function pad(u) { return (length(u) == 17) ? substr(u, 1, 16) ":00Z" : u }
-        $3 == "NOTED" || $3 == "RULED" {
-          if (since != "" && pad($1) < pad(since)) next
-          printf "%-20s  %-5s  %s%s\n", $1, $3, ($8 != "" ? $8 " — " : ""), $9
-        }')"
-      [ -n "$hi_out" ] || exit 8
-      printf '%s\n' "$hi_out"
-    else
-      hi_ev="$(state_events)"
-      # `--repo`: THE LANES WHOSE HOME IS IT, keyed as every other table in
-      # this file is — the log's own lane, lower-cased — and a home compared
-      # through the alias table on BOTH sides, so `openRepoTools` and
-      # `opensoft/openRepoTools` are one repository here as they are to
-      # `lanes --repo`. A lane with no recorded home is in no repository's.
-      hi_filter=0; hi_keep=""
-      if [ -n "$hi_repo" ]; then
-        hi_filter=1
-        hi_want="$(alias_lookup "$hi_repo" 2>/dev/null || :)"; [ -n "$hi_want" ] || hi_want="$hi_repo"
-        lower_into "$hi_want"; hi_want_lc="$LOWER_OUT"
-        while IFS="$US" read -r hi_l _hi_disp _hi_v _hi_u _hi_w _hi_d _hi_p _hi_win hi_h _hi_rest; do
-          [ -n "${hi_l:-}" ] && [ -n "${hi_h:-}" ] || continue
-          hi_hc="$(alias_lookup "$hi_h" 2>/dev/null || :)"; [ -n "$hi_hc" ] || hi_hc="$hi_h"
-          lower_into "$hi_hc"
-          [ "$LOWER_OUT" = "$hi_want_lc" ] && hi_keep="$hi_keep $hi_l"
-        done <<EOF
-$(printf '%s\n' "$hi_ev" | lane_row_facts)
-EOF
-      fi
-      # ONE TIMELINE: the UTC padded as the single-lane read pads it, then the
-      # file and the line — the log's own order where two lines share a stamp.
-      # The key is cut away after the sort; the lane is the LOG's (Amendment
-      # 16(e): a line's lane is the lane of the file it is in).
-      hi_out="$(printf '%s\n' "$hi_ev" | awk -F"$US" -v since="$hi_since" -v filter="$hi_filter" -v keep="$hi_keep" '
-        function pad(u) { return (length(u) == 17) ? substr(u, 1, 16) ":00Z" : u }
-        BEGIN { n = split(keep, kk, " "); for (i = 1; i <= n; i++) K[kk[i]] = 1 }
-        $3 == "NOTED" || $3 == "RULED" {
-          if (since != "" && pad($1) < pad(since)) next
-          if (filter == 1 && !(tolower($2) in K)) next
-          printf "%s\034%s\034%09d\037%-20s  %-26s  %-5s  %s%s\n", pad($1), $10, $11, $1, $2, $3, ($8 != "" ? $8 " — " : ""), $9
-        }' | LC_ALL=C sort | awk -v s="$US" '{ i = index($0, s); print substr($0, i + 1) }')"
-      [ -n "$hi_out" ] || exit 8
-      printf '%s\n' "$hi_out"
-    fi
-    ;;
-
-  # THE LANE'S LAST LANE-KIND LINE, in FILE ORDER — `<verb><TAB><utc><TAB><session><TAB><payload>`.
-  # One caller: `lane-handoff --late`, which may only write the record a swap
-  # never left where that line is still a `STARTED` or a `RESUMED` older than
-  # the instant the late line claims. This log is APPEND-ONLY and file order is
-  # what every state read means by "last", so a `PAUSED` appended after the
-  # relaunch's `RESUMED` would make a lane that is RUNNING read as paused — and
-  # this read is how that is refused instead of written.
-  #
-  # IT IS THE LANE'S OWN LINES AND NOT A FORK'S, which is `lane_row_facts`' rule
-  # one function along (decision 8(c): a fork is never the lane).
-  lane-last)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-last <lane>" 64
-    [ "$#" -le 1 ] || die "lane-last takes one lane: lane-last <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15: one name under any case
-    ll_lines=""; ll_rc=0
-    ll_lines="$(lane_log_events "$lane")" || ll_rc=$?
-    [ "$ll_rc" = 0 ] || die "lane-last could not read lane $lane's log (exit $ll_rc). That is NOT 'this lane has no lane-kind line' (Amendment 7(d))." 1
-    ll_out="$(printf '%s\n' "$ll_lines" | awk -F"$US" -v OFS='	' '
-      $3 == "STARTED" || $3 == "PAUSED" || $3 == "RESUMED" || $3 == "ENDED" || $3 == "RETIRED" {
-        if (substr($8, 1, 5) == "fork ") next
-        v = $3; u = $1; s = $4; p = $8
-      }
-      END { if (v != "") print v, u, s, p }')"
-    [ -n "$ll_out" ] || exit 8
-    printf '%s\n' "$ll_out"
-    ;;
-
-  # THE WORKSPACE REPOSITORY'S PATH — the one resolver, printed. Amendment 9(a)
-  # is explicit that a second way to find one thing is a second answer, and
-  # `lane-handoff` needs this path to resolve the handoff cell of a row whose
-  # spelling is repository-relative. Every other reader of it is in this file.
-  workspace-root)
-    [ "$#" = 0 ] || die "workspace-root takes no arguments" 64
-    wr_out="$(lanes_workspace_root 2>/dev/null || :)"
-    [ -n "$wr_out" ] || die "$(lanes_workspace_why)" 1
-    printf '%s\n' "$wr_out"
-    ;;
-
-  # The lane's RESUME TARGET, read robustly (Amendment 11 clause (d) rules 3
-  # and 4): the last uuid in the published row's session cell WHATEVER SHAPE
-  # THAT CELL IS IN, and failing that the session field of the lane's last
-  # `PAUSED` or `RESUMED` line. Never a title, and never an exit — a caller
-  # that gets 8 has learnt that no uuid is knowable from either source, which
-  # is the ONLY state in which Amendment 8(d)'s title fallback is reachable.
-  last-session)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: last-session <lane>" 64
-    [ "$#" -le 1 ] || die "last-session takes one lane: last-session <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    last_session_of "$lane"; ls_rc=$?
-    case "$ls_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "last-session could not read the register or the log for $lane (exit $ls_rc)" 1 ;;
-    esac
-    ;;
-
-  # DECISION 8(c) AND 8(e) — the live FORKS of this lane's transcript, which
-  # are a defect to retire and never a holder. Evidence 6: an abandoned launch
-  # left a `--fork-session` daemon orchestrating the same plan and writing this
-  # lane's log under an id no row carries. It NAMES them and does nothing else:
-  # the act is `lane-end <lane> --retire <pid|uuid>` (clause (k) rule (e)),
-  # printed by the caller and typed by a person, for the reason Amendment 8(f)
-  # gives — and it writes a record rather than killing anything.
-  # 0 with rows, 8 with none, 1 where the records could not be read.
-  forks)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: forks <lane>" 64
-    [ "$#" -le 1 ] || die "forks takes one lane: forks <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lane_forks "$lane"; fk_rc=$?
-    case "$fk_rc" in
-      0)  : ;;
-      8)  exit 8 ;;
-      64) die "usage: forks <lane>" 64 ;;
-      *)  die "could not read this workstation's session records for lane $lane: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no fork of it is live'." 1 ;;
-    esac
-    ;;
-
-  # ISSUE #39 — a live `--fork-session` DUPLICATE of this lane's OWN
-  # transcript, found in the process table rather than in a session record's
-  # `sessionId` field (which is exactly why `forks` cannot see it once the id
-  # is bound to the row: `lane-end <lane> --retire <pid>` is the caller, for a
-  # duplicate `lane_forks` was designed to stay silent about).
-  # 0 with rows, 8 with none, 1 where `pgrep` is missing, or the register or
-  # the records could not be read.
-  duplicate-holder)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: duplicate-holder <lane>" 64
-    [ "$#" -le 1 ] || die "duplicate-holder takes one lane: duplicate-holder <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    duplicate_holder_pids "$lane"; dh_rc=$?
-    case "$dh_rc" in
-      0)  : ;;
-      8)  exit 8 ;;
-      64) die "usage: duplicate-holder <lane>" 64 ;;
-      *)  die "could not read the register, this workstation's process table or its session records for lane $lane: ${SESSION_FILES_ERR:-unknown error}. That is NOT 'no duplicate holder is live'." 1 ;;
-    esac
-    ;;
-
-  # DECISION 8(d) — THE WORKSTATION'S NAME, AND WHERE IT CAME FROM. One
-  # implementation, so `restart`, `lanes` and every other caller name the
-  # workstation the same way the register's own writer does rather than each
-  # running `hostname` and disagreeing with it. Prints `<name><TAB><source>`,
-  # where the source is one of the THREE `lanes_workstation_pair` emits —
-  # `seam`, `hostname` or `container-unset` (`:371-383`) — and on that last one
-  # the sentence that says what to export goes to stderr, because a read must
-  # still answer.
-  #
-  # THE TWO NAMES THAT WERE HERE DO NOT EXIST. `config` and
-  # `hostname-in-container` are the vocabulary of the rung `R-A11-14` REMOVED:
-  # a `workstation:` key in `workspace.yaml`, refused as a second place for the
-  # truth to be wrong beside the variable the launcher already sets (`:337-339`).
-  # `lanes:190` matched the second of them and could therefore never print, which
-  # is how a dead branch went unnoticed (F-X1). SPEC rev 6's §11 row still lists
-  # all four; that is the text's to correct, and the code's own emitters are the
-  # authority for this comment.
-  # Always 0: a workstation name that could refuse would be a refusal in front
-  # of every launch on this machine.
-  # THE WORKSTATION'S NAME AND ITS SOURCE — and, since Amendment 18(a), the
-  # THREE FACTS BENEATH IT and theirs. Eight tab-separated fields:
-  #
-  #   <workstation> <source> <host> <source> <os> <source> <container> <source>
-  #
-  # GROWN AT THE END, which is this file's rule for every read that gains a
-  # field (`swapped_lanes`'s sixth and seventh say why): the FIRST TWO are the
-  # contract `lanes`, `lane` and `lane-handoff` already take with `cut -f1` and
-  # `cut -f2`, and a reader that has never heard of the rest is unaffected by
-  # them. Each source is one of `seam` (the launcher exported it), `hostname`
-  # (probed), `workstation` (a container with no export, writing the Rule 10
-  # name for its host), `kernel` (the `uname`/`/proc/version` probe) or
-  # `outside` (no container). The workstation's own refusal sentence is printed
-  # on stderr exactly as before, and this read still ANSWERS: a read in front of
-  # every launch may not refuse.
-  workstation)
-    [ "$#" -eq 0 ] || die "workstation takes no arguments" 64
-    ws_why="$(lanes_workstation_why "$WS_SOURCE")"
-    [ -n "$ws_why" ] && note "$ws_why"
-    printf '%s\t%s\t%s\t%s\t%s\t%s\t%s\t%s\n' \
-      "$WS" "$WS_SOURCE" \
-      "$LANES_HOST_NAME" "$LANES_HOST_SOURCE" \
-      "$LANES_OS_NAME" "$LANES_OS_SOURCE" \
-      "$LANES_CONTAINER_NAME" "$LANES_CONTAINER_SOURCE"
-    ;;
-
-  # HOW OLD THE CHECKOUT'S ANSWER IS (`R-A8-1`'s rule, given its own read).
-  # `.git/FETCH_HEAD` is rewritten by every fetch and by nothing else, so its
-  # mtime is when this checkout last heard from `origin` — and a listing that
-  # says "4d ago" is a listing a reader knows not to trust about another
-  # workstation's lane. Never a network call and never a failure: an unreadable
-  # one answers `unknown`. Always 0.
-  fetch-age)
-    [ "$#" -eq 0 ] || die "fetch-age takes no arguments" 64
-    fetch_age
-    ;;
-
-  # DECISIONS 6 AND 7 — THE LANE LISTING, as data. `lanes` renders the
-  # estate-wide one and `restart` the per-repo one from these same rows, which
-  # is why the filter is an argument rather than three implementations.
-  # 0 with rows, 8 with none, 64 a usage error of its own.
-  lanes)
-    lns_args=(); lns_fetch=0; lns_index=0
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --repo|--dir|--ws|--lane|--prefix) [ -n "${2-}" ] || die "$1 needs a value (usage: lanes [--repo <owner/repo>] [--dir <path>] [--prefix <repo>] [--ws <workstation>] [--lane <lane>] [--here] [--all] [--closed] [--fetch] [--index])" 64
-                           lns_args+=("$1" "$2"); shift 2 ;;
-        --all|--here|--closed) lns_args+=("$1"); shift ;;
-        --fetch)           lns_fetch=1; shift ;;
-        # AMENDMENT 14(b) — THE DERIVED INDEX, ONLY WHEN TYPED. It replaces the
-        # PUBLISHED reads of the register and the logs and nothing else; the
-        # live session records, tmux and this checkout's own files are read
-        # exactly as they are without it, so the rows are the same rows.
-        --index)           lns_index=1; shift ;;
-        --)                shift ;;
-        *)                 die "unknown argument '$1' for lanes (usage: lanes [--repo <owner/repo>] [--dir <path>] [--prefix <repo>] [--ws <workstation>] [--here] [--all] [--closed] [--fetch] [--index])" 64 ;;
-      esac
-    done
-    # THE ONE READ IN THIS FILE WHOSE DEFAULT IS LOCAL (SPEC rev 4 §15). Every
-    # other read here sits in front of a LAUNCH, where a stale answer binds the
-    # wrong lane; this one sits in front of a PERSON, who is waiting on it. So
-    # `LANES_NO_FETCH=1` is its default rather than an override — still honoured
-    # where it is already set — and `--fetch` is how a caller asks for the
-    # network. `fetch-age` is the read beside it, so a listing can say how old
-    # its answer is, exactly as Amendment 8(e)'s hook does under `R-A8-1`.
-    [ "$lns_fetch" = 1 ] || LANES_NO_FETCH=1
-    log_sync
-    # A FETCH THAT DID NOT HAPPEN IS NOT A FETCH, AND IT IS SAID IN THE ONE
-    # PHRASE THE CALLER ALREADY READS (#26, `lanes:411`). `log_sync` leaves four
-    # ways out of itself that never reach the fetch and were silent on all four;
-    # `lanes --fetch` matches its stderr for *"reading the logs as they stand
-    # locally"* and prints *"as of a fetch just now"* where it does not find it.
-    # So the phrase is the helper's, once, and the reason is named beside it.
-    #
-    # ONLY UNDER `--fetch`. Without it this read's default is LOCAL by design
-    # (SPEC rev 4 §15) and the notice would be a line saying it did what it was
-    # asked — which is why the wrapper renders the fetch path's stderr and not
-    # the local path's.
-    if [ "$lns_fetch" = 1 ] && [ "$LOG_SYNC_FETCH" != yes ] && [ "$LOG_SYNC_FETCH" != fell-back ]; then
-      note "--fetch was asked for and NO FETCH WAS MADE: $LOG_SYNC_FETCH — reading the logs as they stand locally"
-    fi
-    # AFTER the fetch, so `<k> commits behind` is counted against the
-    # `origin/<branch>` this run has just brought up to date where it asked to.
-    if [ "$lns_index" = 1 ]; then index_open || :; fi
-    # AMENDMENT 15 — `--lane <name>` IS A `<lane>` ARGUMENT AND GOES THROUGH THE
-    # RESOLVER. The filter inside `lanes_rows` has always joined on the name
-    # lower-cased, so the ROWS came back either way; what a typed spelling used
-    # to do was put itself in column 1 and in column 10's `lane <name>` line.
-    # `${lns_args[@]+"${lns_args[@]}"}` AND NOT `${#lns_args[@]}` OR AN INDEX:
-    # this file is parsed under macOS bash 3.2 in CI, where an EMPTY array under
-    # `set -u` is the expansion this idiom exists for — it is the same one the
-    # `lanes_rows` call below already uses, and a bare `lanes` with no flags is
-    # exactly the empty case. The rebuild also stops assuming the value sits at
-    # `i + 1`; it takes the word AFTER `--lane`, which is what the parser above
-    # guarantees there is one of.
-    # `--all` IS ABSOLUTE AND IT CLEARS `--lane` (the reset inside `lanes_rows`
-    # says so in terms), so a `--lane` it is about to throw away must not be
-    # resolved — and must not REFUSE. `lanes --all --lane <the 15(d) pair>` is
-    # the every-lane listing, in either flag order, and exiting 2 on a selector
-    # this run ignores would hide every lane for a name nothing was asked about
-    # (Copilot round 1 on openRepoTools#41).
-    lns_all=0
-    for lns_a in ${lns_args[@]+"${lns_args[@]}"}; do
-      case "$lns_a" in --all) lns_all=1 ;; esac
-    done
-    lns_new=(); lns_take=0
-    for lns_a in ${lns_args[@]+"${lns_args[@]}"}; do
-      if [ "$lns_take" = 1 ]; then
-        lns_take=0
-        if [ "$lns_all" = 0 ]; then
-          lns_one="$(canon_lane "$lns_a")" || exit 2
-        else
-          lns_one="$lns_a"
-        fi
-        lns_new+=("$lns_one")
-        continue
-      fi
-      case "$lns_a" in --lane) lns_take=1 ;; esac
-      lns_new+=("$lns_a")
-    done
-    lns_args=(${lns_new[@]+"${lns_new[@]}"})
-    lns_out="$(lanes_rows ${lns_args[@]+"${lns_args[@]}"})"; lns_rc=$?
-    case "$lns_rc" in
-      0)  : ;;
-      8)  exit 8 ;;
-      64) die "usage: lanes [--repo <owner/repo>] [--dir <path>] [--prefix <repo>] [--ws <workstation>] [--here] [--all] [--closed] [--fetch] [--index]" 64 ;;
-      *)  die "the lane listing could not be read (exit $lns_rc)" 1 ;;
-    esac
-    [ -n "$lns_out" ] || exit 8
-    printf '%s\n' "$lns_out"
-    ;;
-
-  # AMENDMENT 18 ADDENDUM 1 — THE PICK'S TWO READS, over the rows the `lanes`
-  # arm above has just printed. Both take those rows on STDIN and neither reads
-  # the register: the caller has paid for that read and a second one would
-  # double the cost of every pick. `lane` is the only caller of the first and
-  # `lane` and `lanes` are both callers of the second, which is the point — two
-  # surfaces computing one partition, or one next free position, is how they
-  # come to disagree.
-  # 0 with the answer · 64 a usage error of its own.
-  lane-groups)
-    [ "$#" -le 1 ] || die "lane-groups takes one optional workstation: lane-groups [<workstation>]   (the rows on stdin)" 64
-    lane_groups "${1-}"
-    ;;
-
-  next-free)
-    [ -n "${1-}" ] || die "usage: next-free <repo>   (the rows on stdin)" 64
-    [ "$#" -le 1 ] || die "next-free takes one repository: next-free <repo>   (the rows on stdin)" 64
-    lane_next_free "$1"
-    ;;
-
-  # AMENDMENT 8 — Rule 1's sibling reads, filtered to lines that NAME the
-  # object. `gh_reads` pipes both of its searches through this; it is a
-  # subcommand so that the filter can be held to account directly, and so a
-  # person can run a search of their own through the same test.
-  sibling-filter)
-    sfsub=""; sfsub_mode=pr
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --branch) sfsub_mode=branch; shift ;;
-        --pr)     sfsub_mode=pr; shift ;;
-        --)       shift ;;
-        -*)       die "unknown option '$1' for sibling-filter" 2 ;;
-        *)        [ -z "$sfsub" ] || die "sibling-filter takes one object" 2; sfsub="$1"; shift ;;
-      esac
-    done
-    [ -n "$sfsub" ] || die "usage: sibling-filter <object> [--branch]   (candidate lines on stdin)" 2
-    sfsub_home="$(resolve_home "${LANES_LANE:-}" "" 2>/dev/null || :)"
-    sfsub_obj="$(canon_object "$sfsub" "$sfsub_home")" || exit 2
-    sibling_filter "$sfsub_obj" "$sfsub_mode"
-    ;;
-
-  # R20 — a lane's HOME goes through `repos.tsv` like every other spelling, and
-  # `lane-start` has no alias table of its own. 0 with the canonical
-  # nameWithOwner, 8 when the table has no row for it (the caller records the
-  # spelling it derived, and warns), 2 when the table maps it to something that
-  # is not owner/repo.
-  resolve-repo)
-    rr="${1-}"; [ -n "$rr" ] || die "usage: resolve-repo <owner/repo|alias>" 2
-    rr_c="$(alias_lookup "$rr" 2>/dev/null || :)"
-    [ -n "$rr_c" ] || { printf '%s\n' "$rr"; exit 8; }
-    valid_nwo "$rr_c" || die "the alias table maps '$rr' to '$rr_c', which is not owner/repo" 2
-    printf '%s\n' "$rr_c"
-    ;;
-
-  lane-objects)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-objects <lane>" 2
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lane_objects "$lane" || exit $?
-    ;;
-
-  # The lane's ROW as it has LANDED — fetched, and read from
-  # `origin/<branch>:lanes/LANES.md` like every other state read (R19). 0 with
-  # the row, 8 when the published register has none. `lane-end`'s pre-cutover
-  # fallback and `lane-start`'s "is this lane new" test both used to read the
-  # working tree, which a fetch does not move: a peer's LANDING appended to the
-  # state cell, or a peer's whole row, was invisible to both, so `lane-end`
-  # wrote NOTHING IN FLIGHT over a live merge hold and `lane-start` added a
-  # SECOND row for a lane that already had one — and two rows is a register no
-  # helper can edit (`row_line` requires exactly one).
-  register-row)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: register-row <lane>" 2
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    rr_row="$(row_of_lane "$lane")"
-    [ -n "$rr_row" ] || exit 8
-    printf '%s\n' "$rr_row"
-    ;;
-
-  # This checkout's row can be ahead of origin after a local transcript stamp.
-  # The live attach checks both copies; an unreadable local row is not absence.
-  register-row-local)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: register-row-local <lane>" 2
-    check_lane_name "$lane"
-    rr_row="$(row_of_lane_local "$lane")" || die "could not read local register row for $lane" 1
-    [ -n "$rr_row" ] || exit 8
-    case "$rr_row" in *$'\n'*) die "more than one local row names $lane" 2 ;; esac
-    printf '%s\n' "$rr_row"
-    ;;
-
-  # 0 with archived spellings, 8 absent, 1 when either archive cannot be read
-  # or carries a line that is not a row (#122, named above the refusal).
-  retired-identity)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: retired-identity <lane>" 2
-    check_lane_name "$lane"
-    log_sync
-    rr_hits="$(retired_identity_hits "$lane")" || die "could not read the lane archive, or it carries a line that is not a row (above)" 1
-    [ -n "$rr_hits" ] || exit 8
-    printf '%s\n' "$rr_hits"
-    ;;
-
-  # R-A11-7 — THE HOOK'S OWN uuid → lane READ, EXPOSED. `lane_of_session` has
-  # answered "which lane's row's SESSION CELL names this uuid" since Amendment
-  # 8(e), for a window that carries no lane name; nothing else could reach it.
-  # `lane-start` step 3b needs the same answer to keep R-A11-1's fence — a live
-  # session that belongs to ANOTHER row is never taken — so it is one read with
-  # two callers rather than a second implementation of the same question.
-  #
-  # ONLY the session cell is read, exactly as the hook reads it: state cells
-  # quote other lanes' ids all the time (`RESUMED by <id>`, `handed off to
-  # <id>`), and one of those is not that session's lane.
-  #
-  # Read-only. 0 with the lane, 8 when no row's session cell names it —
-  # Amendment 7(d)'s fail-closed convention, so a caller can tell *none* from
-  # *could not read* — and 64 on a usage error of its own.
-  #
-  # 64 AND NOT 2 (A11 Addendum 4 ruling 1, ratified "a11 addendum 4 yes").
-  # Adoption act 0 wrote this read with a usage `2` (`3719d97:lanes/lanes-edit.sh`)
-  # and SPEC rev 6 §11 recorded the landed code; clause (h)'s own table said
-  # `64 usage` for every read in it, and the contract contradicted itself. The
-  # ruling settles it the other way: *"`session-lane`'s usage code is 64 like
-  # every other read in clause (h); adoption act 0 item (4), which says 2, is
-  # the line corrected."*
-  #
-  # IT MATTERS BECAUSE `2` HERE ALREADY MEANS SOMETHING ELSE. A helper that has
-  # never heard of `session-lane` exits 2 from the `*)` arm, and that is what
-  # every workstation answers until act 3's install reaches it. A caller that
-  # cannot tell that 2 from a usage 2 cannot tell *"install the helper"* from
-  # *"fix your call"* — and both of `session-lane`'s callers fail CLOSED on
-  # anything but 0 or 8, so the distinction is the whole of what they can report.
-  session-lane)
-    sl_id="${1-}"; [ -n "$sl_id" ] || die "usage: session-lane <transcript-uuid>" 64
-    [ "$#" -le 1 ] || die "session-lane takes one transcript uuid: session-lane <transcript-uuid>" 64
-    log_sync
-    sl_lane="$(lane_of_session "$sl_id")"
-    [ -n "$sl_lane" ] || exit 8
-    printf '%s\n' "$sl_lane"
-    ;;
-
-  # AMENDMENT 15 — THE RESOLVER, EXPOSED, because `lane-start`, `lane-end`,
-  # `lanes` and `restart` all take a `<lane>` argument and the amendment gives
-  # them all the SAME resolver. An implementation of "which row is this name's"
-  # in each command is how they would come to disagree about it — which is the
-  # whole reason clause (h) turned `window-lane` and `session-lane` into
-  # subcommands.
-  #
-  # Read-only, out of `origin/<branch>` like every other state read (R19).
-  #   0   the canonical spelling — the row's own where a row matches ignoring
-  #       case, and the TYPED spelling where none does, because a lane with no
-  #       row is a lane `add-row` is about to create and the typed name is all
-  #       there is.
-  #   2   the refusal: two or more rows differ only by case (15(d)). It is 2 and
-  #       not 8 because it is a REFUSAL and not an absence — and `lane-start`
-  #       already spends 2 on exactly this fact for two rows of one spelling.
-  #   64  a usage error of its own, as every read in clause (h)'s table does.
-  # A caller that meets 2 from a helper predating this amendment is meeting the
-  # `*)` arm's unknown-subcommand 2, told apart by the helper's own WORDS as
-  # every other read here is; the four callers fall through to the typed
-  # spelling there, and each has its own refusal for a register that really does
-  # hold two such rows.
-  canon-lane)
-    cl_in="${1-}"; [ -n "$cl_in" ] || die "usage: canon-lane <lane>" 64
-    [ "$#" -le 1 ] || die "canon-lane takes one lane: canon-lane <lane>" 64
-    check_lane_name "$cl_in"
-    log_sync
-    # THE CODE IS CARRIED, not flattened to 2: 66 is the alias table that could
-    # not be read and its four callers tell it from 2 by that number alone.
-    cl_res="$(canon_lane "$cl_in")" || exit $?
-    printf '%s\n' "$cl_res"
-    ;;
-
-  # `--home`'s validation, WITHOUT a write — the same `resolve_home` the writers
-  # call, so a preflight and the write can never disagree. 0 with the canonical
-  # home, 8 when the lane has none and none was given, 2 when the option is
-  # refused (the lane's log already records its home) or is not owner/repo.
-  # `lane-end` forwards `--home` to its own ENDED line, which is written AFTER
-  # the row has been closed: without this the refusal arrived too late to
-  # refuse anything, and left a closed row with no ENDED line behind it.
-  resolve-home)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: resolve-home <lane> [<owner/repo|alias>]" 2
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    rh_out="$(resolve_home "$lane" "${2-}")" || exit $?
-    [ -n "$rh_out" ] || exit 8
-    printf '%s\n' "$rh_out"
-    ;;
-
-  # ---------- openRepoTools#94: the restart intent the supervisor launches from
-  #
-  # BOTH ANSWER OUT OF THE LOCAL CONTROL ROOT. The writer reads the register's
-  # managed-ownership projection before mutation; neither writes the register,
-  # the object log or reaches the network. The WRITER is deliberately absent from the
-  # dispatcher's workstation guard above — `R-A11-14` is about a record FILED
-  # UNDER A WORKSTATION, and this one is filed under nothing and never leaves
-  # the machine that wrote it — and it takes the same 64-for-usage contract
-  # every read Amendment 11 added takes, because it sits in front of a launch
-  # exactly as those do.
-  #
-  #   0   done
-  #   1   no control root could be derived, or it could not be written
-  #   2   a refusal of the arguments
-  #   7   THE FENCE DID NOT MATCH — another act got there first, which is what
-  #       this file already spends 7 on (`claim`'s CLAIM-LOST, `set-lane-state`).
-  #       Nothing was written and the current intent is printed.
-  #   8   there is no intent for this lane
-  #  64   a usage error of this subcommand's own
-
-  restart-intent)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: restart-intent <lane> [--dir <absolute checkout>]" 64
-    shift; lri_dir=""
-    if [ "$#" -gt 0 ]; then
-      [ "$#" = 2 ] && [ "$1" = --dir ] || die "usage: restart-intent <lane> [--dir <absolute checkout>]" 64
-      case "$2" in /*) lri_dir="$2" ;; *) die "--dir takes an absolute checkout" 64 ;; esac
-    fi
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lri_out=""; lri_rc=0
-    lri_out="$(lane_restart_read "$lane" "$lri_dir")" || lri_rc=$?
-    case "$lri_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane $lane has no lifecycle control root, so it can carry no restart intent: its record names no directory (Amendment 11(c)) and \$PROJECTS_ROOT is not a directory here. That is NOT 'this lane has no restart in flight' — a read that could not be made is never an answer (Amendment 7(d))." 1 ;;
-    esac
-    printf '%s\n' "$lri_out"
-    ;;
-
-  publish-handoff)
-    lane="${1-}"; pbh_target="${2-}"; pbh_source="${3-}"
-    [ "$#" -ge 3 ] || die "usage: publish-handoff <lane> <target> <prepared-file> --expect-digest <sha> [--operation <id> --generation <n> --attempt <n> --state <state> --transcript <id>]" 64
-    shift 3; check_lane_name "$lane"; lane="$(canon_lane "$lane")" || exit 2
-    pbh_digest=""; pbh_op=""; pbh_gen=""; pbh_attempt=""; pbh_state=""; pbh_sid=""
-    while [ "$#" -gt 0 ]; do
-      [ "$#" -ge 2 ] && [ -n "${2-}" ] || die "$1 needs a value" 64
-      case "$1" in
-        --expect-digest) pbh_digest="$2" ;;
-        --operation) pbh_op="$2" ;;
-        --generation) pbh_gen="$2" ;;
-        --attempt) pbh_attempt="$2" ;;
-        --state) pbh_state="$2" ;;
-        --transcript) pbh_sid="$2" ;;
-        *) die "unknown publish-handoff flag $1" 64 ;;
-      esac
-      shift 2
-    done
-    [ "${#pbh_digest}" = 64 ] || die "publication requires the complete prior SHA-256" 64
-    case "$pbh_digest" in *[!0-9a-fA-F]*) die "publication requires SHA-256" 64 ;; esac
-    [ -f "$pbh_source" ] && [ -r "$pbh_source" ] && [ -s "$pbh_source" ] || die "the prepared handoff is unreadable or empty" 1
-    acquire_lock
-    managed_seam_refuse "$lane" "publish-handoff"
-    pbh_links=0
-    while [ -L "$pbh_target" ]; do
-      pbh_links=$((pbh_links+1)); [ "$pbh_links" -lt 40 ] || die "the handoff link chain cannot be resolved" 2
-      pbh_link="$(readlink "$pbh_target")" || die "the handoff link could not be read" 1
-      case "$pbh_link" in /*) pbh_target="$pbh_link" ;; *) pbh_target="$(dirname -- "$pbh_target")/$pbh_link" ;; esac
-    done
-    pbh_parent="$( CDPATH=''; cd -P -- "$(dirname -- "$pbh_target")" && pwd -P )" || die "the handoff parent is missing" 1
-    pbh_target="$pbh_parent/$(basename -- "$pbh_target")"
-    [ -f "$pbh_target" ] && [ -r "$pbh_target" ] || die "the handoff target is unreadable" 1
-    pbh_irc=0; pbh_intent="$(lane_restart_read "$lane")" || pbh_irc=$?
-    case "$pbh_irc" in 0|8) : ;; *) release_lock; die "restart ownership could not be read; no handoff was published" 1 ;; esac
-    pbh_current="$(printf '%s\n' "$pbh_intent" | awk -F'\t' '$1=="state" {print $2; exit}')"
-    case "$pbh_current" in UNKNOWN-*|INCOMPLETE) release_lock; die "restart ownership is malformed; no handoff was published" 2 ;; esac
-    if [ -n "$pbh_op" ]; then
-      [ -n "$pbh_gen" ] && [ -n "$pbh_attempt" ] && [ -n "$pbh_state" ] && [ -n "$pbh_sid" ] || { release_lock; die "operation publication needs generation, attempt, state and transcript fences" 64; }
-      pbh_actual="$(printf '%s\n' "$pbh_intent" | awk -F'\t' '
-        $1=="operation" {o=$2} $1=="generation" {g=$2} $1=="attempt" {a=$2} $1=="state" {s=$2} $1=="new_transcript" {t=$2}
-        END {printf "%s|%s|%s|%s|%s",o,g,a,s,t}')"
-      [ "$pbh_actual" = "$pbh_op|$pbh_gen|$pbh_attempt|$pbh_state|$pbh_sid" ] || { release_lock; die "this handoff publisher lost restart ownership; nothing was published" 7; }
-      pbh_bound="$(printf '%s\n' "$pbh_intent" | awk -F'\t' '$1=="handoff" {print $2; exit}')"
-      [ -n "$pbh_bound" ] && [ "$pbh_bound" != none ] && [ "$pbh_bound" -ef "$pbh_target" ] ||
-        { release_lock; die "the publication target is not the operation-bound handoff; nothing was published" 2; }
-    else
-      case "$pbh_current" in preparing|pending|starting) release_lock; die "an active restart owns this handoff; nothing was published" 7 ;; esac
-    fi
-    [ "$(lane_handoff_digest "$pbh_target")" = "$pbh_digest" ] || { release_lock; die "the handoff changed before publication; nothing was published" 7; }
-    pbh_tmp="$(mktemp "$pbh_target.resume.XXXXXX")" || { release_lock; die "the publication temporary file could not be made" 1; }
-    if ! cp -p -- "$pbh_target" "$pbh_tmp" || ! cat -- "$pbh_source" > "$pbh_tmp" || ! mv -f -- "$pbh_tmp" "$pbh_target"; then
-      rm -f -- "$pbh_tmp"; release_lock; die "the handoff could not be published atomically" 1
-    fi
-    release_lock
-    printf '%s\n' "$pbh_target"
-    ;;
-
-  legacy-restart-check)
-    lane="${1-}"; check_lane_name "$lane"
-    lane="$(canon_lane "$lane")" || exit 2
-    managed_seam_refuse "$lane" "legacy-restart-check"
-    # Use the managed service's affirmative read when that installation exists.
-    # Exit 8 means confirmed absence; every unknown/error answer refuses.
-    lrc_managed="${SELF%/*}/lane-managed"
-    if [ -e "$lrc_managed" ] || [ -L "$lrc_managed" ]; then
-      [ -f "$lrc_managed" ] && [ -r "$lrc_managed" ] && [ -x "$lrc_managed" ] ||
-        die "the installed managed ownership reader is unusable. Legacy restart refuses without writing or launching." 1
-      lrc_rc=0
-      LANES_NO_FETCH=1 "$lrc_managed" legacy-check --lane "$lane" >/dev/null || lrc_rc=$?
-      case "$lrc_rc" in
-        8) exit 0 ;;
-        0) die "lane $lane is managed. Legacy /ctx restart refuses; use the managed service. Its JSON ledger is the sole authority." 2 ;;
-        *) die "managed ownership for lane $lane could not be confirmed. Legacy restart refuses without writing or launching." 1 ;;
-      esac
-    fi
-    # A missing executable cannot mean missing enrollment. Probe only the
-    # private workspace's Git common directory, never this code checkout.
-    lrc_common="$(git -C "$LANES_REPO" rev-parse --git-common-dir)" ||
-      die "the workspace Git common directory could not be read. Legacy restart refuses." 1
-    case "$lrc_common" in /*) : ;; *) lrc_common="$LANES_REPO/$lrc_common" ;; esac
-    lrc_root="$lrc_common/openrepotools-managed"
-    if [ -e "$lrc_root" ] || [ -L "$lrc_root" ]; then
-      [ -d "$lrc_root" ] && [ -r "$lrc_root" ] && [ -x "$lrc_root" ] && [ ! -L "$lrc_root" ] ||
-        die "managed ownership storage is unreadable or unsafe. Legacy restart refuses." 1
-      lrc_key="$(lc "$lane")"
-      for lrc_host in "$lrc_root"/*; do
-        [ -e "$lrc_host" ] || [ -L "$lrc_host" ] || continue
-        [ -d "$lrc_host" ] && [ -r "$lrc_host" ] && [ -x "$lrc_host" ] && [ ! -L "$lrc_host" ] ||
-          die "managed host ownership storage is unreadable or unsafe. Legacy restart refuses." 1
-        if [ -e "$lrc_host/$lrc_key" ] || [ -L "$lrc_host/$lrc_key" ]; then
-          die "lane $lane has managed ownership storage. Legacy /ctx restart refuses; install/use its managed service to read the JSON authority." 2
-        fi
-      done
-    fi
-    ;;
-
-  set-restart-intent)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: set-restart-intent <lane> <preparing|pending|starting|failed|ready> [--expect <STATE[|STATE…]|none>] [--expect-generation <n>] [--expect-operation <id>] [--operation <id>] [--generation <n>] [--mode <word>] [--agent <name>] [--profile <name>] [--dir <path>] [--pane <ref>] [--window <ref>] [--handoff <path>] [--digest <sha|none>] [--old-transcript <id>] [--new-transcript <id>] [--attempt <n>] [--bump-attempt] [--reason <text>]" 64
-    shift
-    sri_state="${1-}"; [ -n "$sri_state" ] || die "set-restart-intent needs the state to move to: preparing, pending, starting, failed or ready" 64
-    shift
-    sri_exp=""; sri_expg=""; sri_expo=""; sri_expa=""; sri_expn=""; sri_op=""; sri_gen=""; sri_mode=""
-    sri_agent=""; sri_prof=""; sri_dir=""; sri_pane=""; sri_win=""; sri_hf=""
-    sri_dig=""; sri_prepared=""; sri_old=""; sri_new=""; sri_att=""; sri_bump=0; sri_reason=""
-    # THE TWO SPELLINGS OF ONE FLAG GIVE ONE ANSWER (#26, the review of
-    # `c3ebcfe`, and `lane-start` carries the same paragraph at its own
-    # arguments). `--flag ""` refused an empty value here and `--flag=` took
-    # one, so the `=` spelling of an empty operation, generation, attempt or
-    # expectation read as ABSENT — and every rung below the flag then ran on a
-    # value the operator DID give: an `--expect=` would have fenced on nothing,
-    # an `--expect-operation=` would have claimed an operation it was not
-    # entitled to. The six that refuse an empty value refuse it in both
-    # spellings; the ones below that take `[ "$#" -ge 2 ]` deliberately ACCEPT
-    # an empty value in both, because `none` is an answer for those fields.
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --expect)              sri_exp="${2-}";  [ -n "$sri_exp" ]  || die "--expect needs a state word, 'none', or a '|'-separated set of them" 64; shift 2 ;;
-        --expect=*)            sri_exp="${1#--expect=}"; [ -n "$sri_exp" ] || die "--expect needs a state word, 'none', or a '|'-separated set of them" 64; shift ;;
-        --expect-generation)   sri_expg="${2-}"; [ -n "$sri_expg" ] || die "--expect-generation needs a number" 64; shift 2 ;;
-        --expect-generation=*) sri_expg="${1#--expect-generation=}"; [ -n "$sri_expg" ] || die "--expect-generation needs a number" 64; shift ;;
-        --expect-attempt)     sri_expa="${2-}"; [ -n "$sri_expa" ] || die "--expect-attempt needs a number" 64; shift 2 ;;
-        --expect-attempt=*)    sri_expa="${1#--expect-attempt=}"; [ -n "$sri_expa" ] || die "--expect-attempt needs a number" 64; shift ;;
-        --prepared-digest)    sri_prepared="${2-}"; [ -n "$sri_prepared" ] || die "--prepared-digest needs a checksum" 64; shift 2 ;;
-        --prepared-digest=*)  sri_prepared="${1#--prepared-digest=}"; [ -n "$sri_prepared" ] || die "--prepared-digest needs a checksum" 64; shift ;;
-        --expect-new-transcript) sri_expn="${2-}"; [ -n "$sri_expn" ] || die "--expect-new-transcript needs an id or none" 64; shift 2 ;;
-        --expect-new-transcript=*) sri_expn="${1#--expect-new-transcript=}"; [ -n "$sri_expn" ] || die "--expect-new-transcript needs an id or none" 64; shift ;;
-        --expect-operation)    sri_expo="${2-}"; [ -n "$sri_expo" ] || die "--expect-operation needs an operation id" 64; shift 2 ;;
-        --expect-operation=*)  sri_expo="${1#--expect-operation=}"; [ -n "$sri_expo" ] || die "--expect-operation needs an operation id" 64; shift ;;
-        --operation)           sri_op="${2-}";   [ -n "$sri_op" ]   || die "--operation needs an operation id" 64; shift 2 ;;
-        --operation=*)         sri_op="${1#--operation=}"; [ -n "$sri_op" ] || die "--operation needs an operation id" 64; shift ;;
-        --generation)          sri_gen="${2-}";  [ -n "$sri_gen" ]  || die "--generation needs a number" 64; shift 2 ;;
-        --generation=*)        sri_gen="${1#--generation=}"; [ -n "$sri_gen" ] || die "--generation needs a number" 64; shift ;;
-        --mode)                sri_mode="${2-}"; [ "$#" -ge 2 ] || die "--mode needs a value" 64; shift 2 ;;
-        --mode=*)              sri_mode="${1#--mode=}"; shift ;;
-        --agent)               sri_agent="${2-}"; [ "$#" -ge 2 ] || die "--agent needs a value" 64; shift 2 ;;
-        --agent=*)             sri_agent="${1#--agent=}"; shift ;;
-        --profile)             sri_prof="${2-}"; [ "$#" -ge 2 ] || die "--profile needs a value" 64; shift 2 ;;
-        --profile=*)           sri_prof="${1#--profile=}"; shift ;;
-        --dir)                 sri_dir="${2-}"; [ "$#" -ge 2 ] || die "--dir needs a value" 64; shift 2 ;;
-        --dir=*)               sri_dir="${1#--dir=}"; shift ;;
-        --pane)                sri_pane="${2-}"; [ "$#" -ge 2 ] || die "--pane needs a value" 64; shift 2 ;;
-        --pane=*)              sri_pane="${1#--pane=}"; shift ;;
-        --window)              sri_win="${2-}"; [ "$#" -ge 2 ] || die "--window needs a value" 64; shift 2 ;;
-        --window=*)            sri_win="${1#--window=}"; shift ;;
-        --handoff)             sri_hf="${2-}"; [ "$#" -ge 2 ] || die "--handoff needs a value" 64; shift 2 ;;
-        --handoff=*)           sri_hf="${1#--handoff=}"; shift ;;
-        --digest)              sri_dig="${2-}"; [ "$#" -ge 2 ] || die "--digest needs a value" 64; shift 2 ;;
-        --digest=*)            sri_dig="${1#--digest=}"; shift ;;
-        --old-transcript)      sri_old="${2-}"; [ "$#" -ge 2 ] || die "--old-transcript needs a value" 64; shift 2 ;;
-        --old-transcript=*)    sri_old="${1#--old-transcript=}"; shift ;;
-        --new-transcript)      sri_new="${2-}"; [ "$#" -ge 2 ] || die "--new-transcript needs a value" 64; shift 2 ;;
-        --new-transcript=*)    sri_new="${1#--new-transcript=}"; shift ;;
-        --attempt)             sri_att="${2-}"; [ -n "$sri_att" ] || die "--attempt needs a number" 64; shift 2 ;;
-        --attempt=*)           sri_att="${1#--attempt=}"; [ -n "$sri_att" ] || die "--attempt needs a number" 64; shift ;;
-        --bump-attempt)        sri_bump=1; shift ;;
-        --reason)              sri_reason="${2-}"; [ "$#" -ge 2 ] || die "--reason needs a value" 64; shift 2 ;;
-        --reason=*)            sri_reason="${1#--reason=}"; shift ;;
-        --)                    shift ;;
-        *)                     die "unknown option '$1' for set-restart-intent" 64 ;;
-      esac
-    done
-    lane_restart_word_ok "$sri_state" ||
-      die "'$sri_state' is not a restart-intent state: preparing, pending, starting, failed and ready are the supported states" 64
-    # THE FOUR VALUES THAT ARE KEYS AND NOT PROSE. An operation id, a launch
-    # mode, an agent and a profile are MANIFEST KEYS everywhere else in this
-    # estate — letters, digits, `.`, `_`, `-` — and each of them is compared
-    # for equality by a later reader (`--expect-operation`, the supervisor's
-    # own fence, `lane-start --agent`). A value carrying a space, a `;` or a
-    # newline is a value no such comparison can be trusted with, and this file
-    # is written one `key: value` line at a time.
-    for sri_k in "operation=$sri_op" "mode=$sri_mode" "agent=$sri_agent" "profile=$sri_prof" \
-                 "expect-operation=$sri_expo"; do
-      sri_kv="${sri_k#*=}"
-      [ -n "$sri_kv" ] || continue
-      case "$sri_kv" in
-        *[!A-Za-z0-9._-]*) die "--${sri_k%%=*} takes a manifest key — letters, digits, '.', '_' and '-' — because a later reader compares it for equality and this record is one line per field. Got '$sri_kv'." 64 ;;
-      esac
-    done
-    case "$sri_gen$sri_att$sri_expa" in *[!0-9]*) die "--generation and --attempt take numbers" 64 ;; esac
-    case "$sri_expg" in
-      '') : ;;
-      *[!0-9]*) die "--expect-generation takes a number; '$sri_expg' is not one" 64 ;;
-    esac
-    # A DIRECTORY IN THIS RECORD IS ABSOLUTE OR IT IS NOTHING, and the same for
-    # the handoff: the reader of this file is a DIFFERENT PROCESS IN A
-    # DIFFERENT DIRECTORY — the supervisor in a respawned pane — and a relative
-    # path resolved against its cwd is a path to somewhere else. `~` is the
-    # writing shell's and is never expanded here.
-    case "$sri_dir" in ''|/*) : ;; *) die "--dir takes an ABSOLUTE path: this record is read by the supervisor in a pane whose working directory is not this one, and a relative path there names a different place. Got '$sri_dir'." 64 ;; esac
-    case "$sri_hf" in ''|/*) : ;; *) die "--handoff takes an ABSOLUTE path, for the same reason --dir does: the launch that reads it back stands somewhere else. Got '$sri_hf'." 64 ;; esac
-    for sri_exact in "$sri_dir" "$sri_pane" "$sri_win" "$sri_hf" "$sri_old" "$sri_new" "$sri_dig" "$sri_prepared"; do
-      lane_restart_value_ok "$sri_exact" || die "restart launch facts cannot contain control characters. Nothing was written." 64
-    done
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    # Select the physical intent under the CAS mutex: a waiting writer must
-    # see a reservation another writer established before releasing the lock.
-    acquire_lock
-    managed_seam_refuse "$lane" "set-restart-intent"
-    sri_root=""; sri_rrc=0
-    sri_root="$(lane_restart_control_root "$lane")" || sri_rrc=$?
-    [ "$sri_rrc" = 0 ] || {
-      release_lock
-      die "lane $lane's restart control root is unavailable, unreadable or ambiguous. Nothing was written. Inspect its recorded directory and projects-root intents, or configure LANES_LANE_STATE_ROOT explicitly." 1
-    }
-    sri_f="$sri_root/restart-intent.yaml"
-    # A SCHEMA THIS WRITER DOES NOT KNOW IS NOT ITS RECORD TO REPLACE (Copilot
-    # round 1 on openRepoTools#121). The READ side already fails closed on one —
-    # it answers `UNKNOWN-SCHEMA` rather than reporting a launch it cannot
-    # understand — and the WRITE side walked straight past it: the fields it
-    # knows were copied forward, the ones it does not were dropped, and the file
-    # came out stamped `schema: 1`. A newer tooling's intent would have been
-    # silently rewritten as an older one's, which is the read-side protection
-    # undone by the other half of the same command. This is checked INSIDE the
-    # lock, with the fence, because the file may be replaced between a read and
-    # a write, and it refuses with 2 — not 7 — because 7 is *another act got
-    # there first, re-read and decide* and this is *this copy of the tooling
-    # must not touch this file at all*.
-    if [ -e "$sri_f" ] || [ -L "$sri_f" ]; then
-      if [ ! -f "$sri_f" ] || [ ! -r "$sri_f" ]; then
-        release_lock
-        die "lane $lane has an existing unreadable restart intent. Nothing was written: a failed read is not an absent operation." 1
-      fi
-      sri_missing="$(lane_restart_missing "$sri_f" "$lane")" || { release_lock; die "the restart record could not be read. Nothing was written." 1; }
-      [ -z "$sri_missing" ] || { release_lock; die "the existing restart record is malformed (missing, duplicate or invalid fields: $sri_missing). Nothing was written." 2; }
-      sri_nows="$(lane_restart_sidecar_field "$sri_f" schema)" || { release_lock; die "the restart schema could not be read. Nothing was written." 1; }
-      if [ "$sri_nows" != "$LANE_RESTART_SCHEMA" ]; then
-        release_lock
-        die "lane $lane's restart intent is schema '$sri_nows' and this \`lanes-edit.sh\` writes schema $LANE_RESTART_SCHEMA. Nothing was written: taking a transition over it would copy forward the fields this version knows, drop the ones it does not, and stamp the file as an older schema — which is a newer tooling's record quietly replaced by an older one. Read it with a helper that knows that schema, or remove $sri_f once you know no restart is in flight." 2
-      fi
-    fi
-    sri_now=""; sri_nowg=""; sri_nowo=""; sri_nowa=""; sri_nown=""
-    if [ -r "$sri_f" ]; then
-      sri_now="$(lane_restart_sidecar_field "$sri_f" state)"
-      sri_nowg="$(lane_restart_sidecar_field "$sri_f" generation)"
-      sri_nowo="$(lane_restart_sidecar_field "$sri_f" operation)"
-      sri_nowa="$(lane_restart_sidecar_field "$sri_f" attempt)"
-      sri_nown="$(lane_restart_sidecar_field "$sri_f" new_transcript)"
-    fi
-    if [ -r "$sri_f" ]; then
-      lane_restart_word_ok "$sri_now" || { release_lock; die "the existing restart state is malformed. Nothing was written." 2; }
-      case "$sri_nowg:$sri_nowa" in *[!0-9:]*|:*|*:) release_lock; die "the existing restart generation or attempt is malformed. Nothing was written." 2 ;; esac
-    fi
-    sri_fence=""
-    # `--expect` TAKES A SET, because the states a caller is entitled to write
-    # over are usually more than one and asking for them in two calls is a
-    # second read-then-write with a window between. `pending` is created over
-    # `none|ready|failed` and never over `pending|starting`, which is the
-    # spec's *an ordinary `/ctx` does not supersede an operation in flight*
-    # expressed as one argument.
-    if [ -n "$sri_exp" ]; then
-      sri_match=0
-      sri_rest="$sri_exp"
-      while [ -n "$sri_rest" ]; do
-        case "$sri_rest" in
-          *'|'*) sri_one="${sri_rest%%|*}"; sri_rest="${sri_rest#*|}" ;;
-          *)     sri_one="$sri_rest"; sri_rest="" ;;
-        esac
-        [ "$sri_one" = none ] || lane_restart_word_ok "$sri_one" ||
-          { release_lock; die "--expect takes restart-intent states or 'none'; '$sri_one' is neither" 64; }
-        [ "$sri_one" = "${sri_now:-none}" ] && sri_match=1
-      done
-      [ "$sri_match" = 1 ] || sri_fence="the intent is ${sri_now:-none} and --expect named $sri_exp"
-    fi
-    [ -z "$sri_expg" ] || [ "$sri_expg" = "${sri_nowg:-0}" ]    || sri_fence="${sri_fence:+$sri_fence; }generation is ${sri_nowg:-0} and --expect-generation named $sri_expg"
-    [ -z "$sri_expo" ] || [ "$sri_expo" = "${sri_nowo:-none}" ] || sri_fence="${sri_fence:+$sri_fence; }operation is ${sri_nowo:-none} and --expect-operation named $sri_expo"
-    [ -z "$sri_expa" ] || [ "$sri_expa" = "${sri_nowa:-0}" ] || sri_fence="${sri_fence:+$sri_fence; }attempt is ${sri_nowa:-0} and --expect-attempt named $sri_expa"
-    [ -z "$sri_expn" ] || [ "$sri_expn" = "${sri_nown:-none}" ] || sri_fence="${sri_fence:+$sri_fence; }prepared transcript is ${sri_nown:-none} and --expect-new-transcript named $sri_expn"
-    if [ -n "$sri_fence" ]; then
-      release_lock
-      printf 'state\t%s\ngeneration\t%s\noperation\t%s\nattempt\t%s\n' \
-        "${sri_now:-none}" "${sri_nowg:-0}" "${sri_nowo:-none}" "${sri_nowa:-0}"
-      die "lane $lane's restart intent did not move to $sri_state: $sri_fence. Another act got there first — a second /ctx, a supervisor that claimed this operation, or a resume that finished it — and nothing was written. Re-read it (lanes-edit.sh restart-intent $lane) before deciding what this process should do; a stale supervisor must never overwrite a newer operation." 7
-    fi
-    case "$sri_nowg" in ''|*[!0-9]*) sri_nowg=0 ;; esac
-    case "$sri_nowa" in ''|*[!0-9]*) sri_nowa=0 ;; esac
-    # A TRANSITION THAT DOES NOT NAME A FIELD KEEPS IT, and does not blank it —
-    # the same rule `set-lane-state` takes, and for the same reason: a
-    # `starting` written by the supervisor is about the STATE, and blanking the
-    # handoff digest out of that call would lose the one fact every later
-    # launch and retry is fenced on.
-    sri_keep() {   # <key> <value the caller gave>
-      [ -n "${2-}" ] && { printf '%s' "$2"; return 0; }
-      lane_restart_sidecar_field "$sri_f" "$1" 2>/dev/null || :
-    }
-    sri_gen="$(sri_keep generation "$sri_gen")"; [ -n "$sri_gen" ] || sri_gen="$sri_nowg"
-    sri_op="$(sri_keep operation "$sri_op")";    [ -n "$sri_op" ]  || sri_op="$(lane_restart_op_id)"
-    sri_prepared="$(sri_keep prepared_digest "$sri_prepared")"
-    sri_mode="$(sri_keep mode "$sri_mode")"
-    sri_agent="$(sri_keep agent "$sri_agent")"
-    sri_prof="$(sri_keep profile "$sri_prof")"
-    sri_dir="$(sri_keep dir "$sri_dir")"
-    sri_pane="$(sri_keep pane "$sri_pane")"
-    sri_win="$(sri_keep window "$sri_win")"
-    sri_hf="$(sri_keep handoff "$sri_hf")"
-    # …EXCEPT WHERE THE OPERATION ITSELF HAS CHANGED, and then five of these
-    # fields are not this act's facts at all. `old_transcript`,
-    # `new_transcript`, `attempt`, `reason` and `created` are scoped to ONE
-    # operation: the transcript that restart paused, the transcript its launch
-    # was preparing, how many times THAT launch was tried, why THAT one failed,
-    # and when THAT intent was made. Carrying them into the next operation is
-    # how a brand-new `/ctx` comes out reading `attempt 3` and `reason "the
-    # launcher exited 127"` from a restart that is over — and two of them are
-    # worse than cosmetic, because the supervisor's readiness predicate is
-    # built on exactly this pair:
-    #
-    #   * an inherited `new_transcript` is a uuid THIS launch will never mint,
-    #     so readiness can only run to its deadline and report indeterminate;
-    #   * an inherited `old_transcript` is the wrong uuid to be distinct FROM,
-    #     and that check is the one that catches openRepoTools#94 itself — a
-    #     replacement that came up resuming the transcript this `/ctx` paused.
-    #     Comparing it against some earlier restart's transcript would let the
-    #     measured defect through the very predicate written to catch it.
-    #
-    # A caller that names one of the five still wins; this only decides what an
-    # UNNAMED field falls back to, and `none` is an answer where another
-    # operation's value is a lie.
-    sri_newop=0
-    [ "$sri_op" = "${sri_nowo:-none}" ] || sri_newop=1
-    if [ "$sri_newop" = 1 ]; then sri_prepared=none; fi
-    if [ "$sri_newop" != 1 ]; then
-      sri_old="$(sri_keep old_transcript "$sri_old")"
-      sri_new="$(sri_keep new_transcript "$sri_new")"
-      sri_reason="$(sri_keep reason "$sri_reason")"
-    fi
-    # THE DIGEST IS COMPUTED HERE WHERE THE CALLER NAMED A HANDOFF AND NO
-    # DIGEST, so that there is ONE implementation of *what this handoff was
-    # when the intent was made* and a caller cannot accidentally record a
-    # digest of something else.
-    if [ -z "$sri_dig" ]; then
-      case "$sri_hf" in
-        /*) if [ "$sri_state" = pending ] && [ -r "$sri_hf" ]; then
-              sri_dig="$(lane_handoff_digest "$sri_hf")"
-            else
-              sri_dig="$(lane_restart_sidecar_field "$sri_f" digest 2>/dev/null || :)"
-            fi ;;
-        *)  sri_dig="$(lane_restart_sidecar_field "$sri_f" digest 2>/dev/null || :)" ;;
-      esac
-    fi
-    # THE ATTEMPT COUNT. `--bump-attempt` is the retry's own act and is the one
-    # thing that may not be inferred: a supervisor claiming a NEW operation
-    # starts at 1, and a retry of the SAME one increments.
-    if [ -n "$sri_att" ]; then
-      :
-    elif [ "$sri_bump" = 1 ]; then
-      sri_att=$((sri_nowa + 1))
-    elif [ "$sri_newop" = 1 ]; then
-      sri_att=0
-    else
-      sri_att="$sri_nowa"
-    fi
-    # AND `created` IS THIS OPERATION'S OWN, for the same reason: it is read as
-    # *when this restart was taken*, and a new operation inheriting the last
-    # one's timestamp says a `/ctx` happened at a moment it did not.
-    if [ "$sri_newop" = 1 ]; then
-      sri_created=""
-    else
-      sri_created="$(lane_restart_sidecar_field "$sri_f" created 2>/dev/null || :)"
-    fi
-    if lane_restart_put "$sri_root" "$lane" "$sri_state" "$sri_gen" "$sri_op" \
-         "$sri_mode" "$sri_agent" "$sri_prof" "$sri_dir" "$sri_pane" "$sri_win" \
-         "$sri_hf" "$sri_dig" "$sri_old" "$sri_new" "$sri_att" "$sri_reason" \
-         "$sri_created" "$sri_prepared"; then
-      release_lock
-      printf 'state\t%s\ngeneration\t%s\noperation\t%s\nattempt\t%s\ndigest\t%s\nfile\t%s\n' \
-        "$sri_state" "$sri_gen" "$sri_op" "$sri_att" "${sri_dig:-none}" "$sri_f"
-    else
-      release_lock
-      die "lane $lane's restart intent could not be written under $sri_root (the shell's own error is above). Nothing was changed: the intent is replaced atomically, so the one that was there is the one that is there." 1
-    fi
-    ;;
-
-  # ---------- THE SEAM: is this lane the managed ledger's? (ruling 2026-10-04)
-  #
-  #   0  a valid managed-owner marker: the owner is printed
-  #   8  no marker and no managed-owner vocabulary, in the published row or
-  #      this checkout's: a legacy lane
-  #   1  vocabulary that does not parse, vocabulary only this checkout's row
-  #      carries (#157 item 4a, as `managed_seam_refuse` reads it), or a
-  #      register that could not be read: ownership UNKNOWN, which a caller
-  #      refuses on exactly as it refuses 0
-  #  64  usage
-  managed-projection)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: managed-projection <lane>" 64
-    [ "$#" -le 1 ] || die "managed-projection takes one lane: managed-projection <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    mpj_out=""; mpj_rc=0
-    mpj_out="$(lane_is_managed_owned "$lane")" || mpj_rc=$?
-    case "$mpj_rc" in
-      0) printf '%s\n' "$mpj_out" ;;
-      8)
-        managed_local_hint "$lane" ||
-          die "lane $lane's row in this checkout's register file, $LANES_FILE, carries managed-owner vocabulary (or could not be read) where the published register's, origin/$LANES_BRANCH, does not: the two copies disagree on whether the managed ledger owns it, so that is UNKNOWN, and it is never read as 'legacy' (Amendment 7(d)) — every legacy writer refuses it for the same reason. $(managed_local_remedy)" 1
-        exit 8 ;;
-      *) die "lane $lane's register row carries managed-owner vocabulary that does not parse as a marker, or the register could not be read: whether the managed ledger owns it is UNKNOWN, and that is never read as 'legacy' (Amendment 7(d))." 1 ;;
-    esac
-    ;;
-
-  # ---------- openRepoTools#91: the lifecycle, the inventory, the reconcile
-  #
-  # ALL FIVE ANSWER OUT OF THE LOCAL CONTROL ROOT and none of them touches the
-  # register, the object log or the network. The two WRITERS are deliberately
-  # absent from the dispatcher's workstation guard above (`R-A11-14` is about a
-  # record FILED UNDER A WORKSTATION; this one is filed under nothing and never
-  # leaves the machine that wrote it), and they take the same 64-for-usage
-  # contract every read Amendment 11 added takes, because they sit in front of
-  # a launch exactly as those do.
-  #
-  #   0   done
-  #   1   no control root could be derived, or it could not be written; or a
-  #       WRITER met a record there it cannot read — of a schema it does not
-  #       write, or of its own and not a whole record (#115) — and replaced
-  #       nothing; or `lane-tree-now` met a git read that failed
-  #   2   a refusal of the arguments
-  #   7   THE FENCE DID NOT MATCH — another act got there first, which is what
-  #       this file already spends 7 on (`claim`'s CLAIM-LOST). Nothing was
-  #       written and the current state is printed. `set-lane-tree` spends it
-  #       too where the lane is `SWAPPED`: the operation its fence names is
-  #       finished (#114).
-  #   8   there is no such record (no snapshot, no tree)
-  #  10   THE RECORD IS THERE AND COULD NOT BE READ, which is never 8 (Copilot
-  #       round 6 on #97). 8 tells a launcher *this lane was never migrated, go
-  #       on*; 10 tells it *this lane may be mid-crash and nobody could look*.
-  #       (It was 9 until main's #61 spent 9 on `claim`'s abandoned takeover.)
-  #       A snapshot of this schema that is not a whole record is 10 as well
-  #       (#115): nothing can be read out of it as a snapshot.
-  #  64   a usage error of this subcommand's own — for `set-lane-tree`, a
-  #       partial observation, a `--dirty`/`--unpushed` that is not a count
-  #       (`unknown` is one for `--unpushed`), or a field that is only blanks
-
-  lane-state)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-state <lane>" 64
-    [ "$#" -le 1 ] || die "lane-state takes one lane: lane-state <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lst_out=""; lst_rc=0
-    lst_out="$(lane_state_read "$lane")" || lst_rc=$?
-    case "$lst_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      10)
-        # WHICH OF THE TWO 10s (#115): a record that opens and is not a whole
-        # one of this schema is said as that, for the person who reads it.
-        lst_f="$(lane_control_root "$lane" 2>/dev/null || printf '<no control root>')/lane-state.yaml"
-        lst_what="it could not be read"
-        if [ -r "$lst_f" ] && ! lane_sidecar_schema_ok "$lst_f"; then lst_what="it is of this schema and $LSS_WHY, so nothing can be read out of it as a snapshot"; fi
-        die "lane $lane HAS a lifecycle snapshot at its control root and $lst_what. That is NOT 'this lane has no snapshot' — 8 says that, and a launcher answers an 8 by going on, which over an unreadable record would be a launch made in ignorance of a crash nobody could look at (R22, Amendment 7(d)). Read it by hand: $lst_f" 10 ;;
-      *) die "lane $lane has no lifecycle control root: its record names no directory (Amendment 11(c)) and \$PROJECTS_ROOT is not a directory here. That is NOT 'this lane is in no state' — a read that could not be made is never an answer (Amendment 7(d))." 1 ;;
-    esac
-    printf '%s\n' "$lst_out"
-    ;;
-
-  set-lane-state)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: set-lane-state <lane> <RUNNING|SWAPPING|SWAPPED|CLOSED> [--expect <STATE|none>] [--expect-generation <n>] [--expect-operation <id>] [--operation <id>] [--owner <uuid>] [--agent <name>] [--profile <name>] [--kind <word>]" 64
-    shift
-    sls_state="${1-}"; [ -n "$sls_state" ] || die "set-lane-state needs the state to move to: RUNNING, SWAPPING, SWAPPED or CLOSED" 64
-    shift
-    sls_exp=""; sls_expg=""; sls_expo=""; sls_op=""; sls_owner=""; sls_agent=""; sls_prof=""; sls_kind=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --expect)             sls_exp="${2-}";  [ -n "$sls_exp" ]  || die "--expect needs a state word, or 'none'" 64; shift 2 ;;
-        --expect=*)           sls_exp="${1#--expect=}"; [ -n "$sls_exp" ] || die "--expect needs a value" 64; shift ;;
-        --expect-generation)  sls_expg="${2-}"; [ -n "$sls_expg" ] || die "--expect-generation needs a number" 64; shift 2 ;;
-        --expect-generation=*) sls_expg="${1#--expect-generation=}"; [ -n "$sls_expg" ] || die "--expect-generation needs a value" 64; shift ;;
-        --expect-operation)   sls_expo="${2-}"; [ -n "$sls_expo" ] || die "--expect-operation needs an operation id" 64; shift 2 ;;
-        --expect-operation=*) sls_expo="${1#--expect-operation=}"; [ -n "$sls_expo" ] || die "--expect-operation needs a value" 64; shift ;;
-        --operation)          sls_op="${2-}";   [ -n "$sls_op" ]   || die "--operation needs an operation id" 64; shift 2 ;;
-        --operation=*)        sls_op="${1#--operation=}"; [ -n "$sls_op" ] || die "--operation needs a value" 64; shift ;;
-        --owner)              sls_owner="${2-}"; [ "$#" -ge 2 ] && [ -n "$sls_owner" ] || die "--owner needs a value" 64; shift 2 ;;
-        --owner=*)            sls_owner="${1#--owner=}"; [ -n "$sls_owner" ] || die "--owner needs a value" 64; shift ;;
-        --agent)              sls_agent="${2-}"; [ "$#" -ge 2 ] && [ -n "$sls_agent" ] || die "--agent needs a value" 64; shift 2 ;;
-        --agent=*)            sls_agent="${1#--agent=}"; [ -n "$sls_agent" ] || die "--agent needs a value" 64; shift ;;
-        --profile)            sls_prof="${2-}"; [ "$#" -ge 2 ] && [ -n "$sls_prof" ] || die "--profile needs a value" 64; shift 2 ;;
-        --profile=*)          sls_prof="${1#--profile=}"; [ -n "$sls_prof" ] || die "--profile needs a value" 64; shift ;;
-        --kind)               sls_kind="${2-}"; [ "$#" -ge 2 ] && [ -n "$sls_kind" ] || die "--kind needs a value" 64; shift 2 ;;
-        --kind=*)             sls_kind="${1#--kind=}"; [ -n "$sls_kind" ] || die "--kind needs a value" 64; shift ;;
-        --)                   shift ;;
-        *)                    die "unknown option '$1' for set-lane-state" 64 ;;
-      esac
-    done
-    lane_state_word_ok "$sls_state" || die "'$sls_state' is not a lane lifecycle state: RUNNING, SWAPPING, SWAPPED and CLOSED are the four, and a fifth word in this file would be a state no reader of it knows" 64
-    [ -z "$sls_exp" ] || [ "$sls_exp" = none ] || lane_state_word_ok "$sls_exp" ||
-      die "--expect takes one of the four states, or 'none' for a lane that has no snapshot yet; '$sls_exp' is neither" 64
-    case "$sls_expg" in
-      '') : ;;
-      *[!0-9]*) die "--expect-generation takes a number; '$sls_expg' is not one" 64 ;;
-    esac
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    managed_seam_refuse "$lane" "set-lane-state"    # ruling 2026-10-04
-    sls_root=""; sls_rrc=0
-    sls_root="$(lane_control_root "$lane")" || sls_rrc=$?
-    [ "$sls_rrc" = 0 ] ||
-      die "lane $lane has no lifecycle control root, so there is nowhere to record that it is $sls_state: its record names no directory (Amendment 11(c)) and \$PROJECTS_ROOT is not a directory here. Set \$LANES_LANE_STATE_ROOT, or start the lane through lane-start so that its record carries a dir." 1
-    # THE FENCE, read under the same mutex the write takes, so that two
-    # transitions cannot both read the state before either writes it.
-    acquire_lock
-    # AND THE SCHEMA IS ASKED ABOUT BEFORE ANY TRANSITION FIELD IS READ OR
-    # WRITTEN (Copilot round 5 on #97). `lane_state_read` fails closed for a
-    # version it does not know; this writer used to walk past that check into
-    # the raw fields and rename its own file over the top, so an older helper
-    # meeting a newer tooling's snapshot destroyed a record it could not read —
-    # the one act no later reader can undo. It is a 1 and not a 7: 7 says a race
-    # was lost and invites the caller to re-read and try again, and no re-read
-    # makes this file readable by this helper.
-    if ! lane_sidecar_schema_ok "$sls_root/lane-state.yaml"; then
-      sls_sch="$(lane_sidecar_field "$sls_root/lane-state.yaml" schema 2>/dev/null || :)"
-      release_lock
-      die "lane $lane's lifecycle snapshot at $sls_root/lane-state.yaml records schema ${sls_sch:-<none>} and is not a record this helper can read: $LSS_WHY. NOTHING was read out of it and nothing was written over it: a record this helper cannot read is one it cannot safely replace, whether its schema is one this helper does not write or its own and the record is not whole (#115). Upgrade this workstation's lanes-edit.sh if a newer tooling wrote it; if you know what wrote that file, move it aside by hand and re-run." 1
-    fi
-    sls_now=""; sls_nowg=""; sls_nowo=""
-    if [ -r "$sls_root/lane-state.yaml" ]; then
-      sls_now="$(lane_sidecar_field "$sls_root/lane-state.yaml" state)"
-      sls_nowg="$(lane_sidecar_field "$sls_root/lane-state.yaml" generation)"
-      sls_nowo="$(lane_sidecar_field "$sls_root/lane-state.yaml" operation)"
-    fi
-    sls_fence=""
-    [ -z "$sls_exp" ]  || [ "$sls_exp"  = "${sls_now:-none}" ] || sls_fence="state is ${sls_now:-none} and --expect named $sls_exp"
-    [ -z "$sls_expg" ] || [ "$sls_expg" = "${sls_nowg:-0}" ]   || sls_fence="${sls_fence:+$sls_fence; }generation is ${sls_nowg:-0} and --expect-generation named $sls_expg"
-    [ -z "$sls_expo" ] || [ "$sls_expo" = "${sls_nowo:-none}" ] || sls_fence="${sls_fence:+$sls_fence; }operation is ${sls_nowo:-none} and --expect-operation named $sls_expo"
-    if [ -n "$sls_fence" ]; then
-      release_lock
-      printf 'state\t%s\ngeneration\t%s\noperation\t%s\n' "${sls_now:-none}" "${sls_nowg:-0}" "${sls_nowo:-none}"
-      die "lane $lane did not move to $sls_state: $sls_fence. Another act got there first — a resume that advanced the generation, or a second handoff — and nothing was written. Re-read the state (lanes-edit.sh lane-state $lane) before deciding what this process should do; a stale finalizer must never overwrite a newer owner." 7
-    fi
-    case "$sls_nowg" in ''|*[!0-9]*) sls_nowg=0 ;; esac
-    # A TRANSITION THAT DOES NOT NAME A FIELD KEEPS IT, and does not blank it.
-    # `SWAPPED` is the same operation's commit point and `CLOSED` the end of a
-    # lane that was owned by somebody: writing `owner none` there would lose
-    # the one fact a later reconciliation compares a live holder against, out of
-    # a call that was only ever about the state word.
-    [ -n "$sls_owner" ] || sls_owner="$(lane_sidecar_field "$sls_root/lane-state.yaml" owner 2>/dev/null || :)"
-    [ -n "$sls_agent" ] || sls_agent="$(lane_sidecar_field "$sls_root/lane-state.yaml" agent 2>/dev/null || :)"
-    [ -n "$sls_prof" ]  || sls_prof="$(lane_sidecar_field "$sls_root/lane-state.yaml" profile 2>/dev/null || :)"
-    [ -n "$sls_kind" ]  || sls_kind="$(lane_sidecar_field "$sls_root/lane-state.yaml" kind 2>/dev/null || :)"
-    # WHICH TRANSITION ADVANCES THE GENERATION. A new owner or a new operation
-    # does (`RUNNING`, `SWAPPING`, `CLOSED`); the FINISH of an operation
-    # already in flight does not, because `SWAPPED` is the same operation
-    # reaching its commit point and a fence that moved under it would refuse
-    # the very finalizer that is entitled to write.
-    case "$sls_state" in
-      SWAPPED) sls_gen="$sls_nowg"; [ -n "$sls_op" ] || sls_op="${sls_nowo:-none}" ;;
-      *)       sls_gen=$((sls_nowg + 1)); [ -n "$sls_op" ] || sls_op="$(lane_op_id)" ;;
-    esac
-    if lane_state_put "$sls_root" "$lane" "$sls_state" "$sls_gen" "$sls_op" \
-         "$sls_owner" "$sls_agent" "$sls_prof" "$WS" "$sls_kind"; then
-      release_lock
-      LANES_INDEX_NUDGE_INV=1   # opensoft/openRepoTools#161: `cleanup` nudges the indexer
-      printf 'state\t%s\ngeneration\t%s\noperation\t%s\n' "$sls_state" "$sls_gen" "$sls_op"
-    else
-      release_lock
-      die "lane $lane's lifecycle snapshot could not be written under $sls_root (the shell's own error is above). Nothing was changed: the snapshot is replaced atomically, so the one that was there is the one that is there." 1
-    fi
-    ;;
-
-  lane-trees)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-trees <lane>" 64
-    [ "$#" -le 1 ] || die "lane-trees takes one lane: lane-trees <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    ltr_out=""; ltr_rc=0
-    ltr_out="$(lane_trees_list "$lane")" || ltr_rc=$?
-    case "$ltr_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      10) die "lane $lane's worktree inventory directory $(lane_control_root "$lane" 2>/dev/null || printf '<no control root>')/trees is there and could not be listed. That is NOT 'this lane recorded no tree' — 8 says that, and a reader that goes on over it relaunches writers onto trees nobody looked at (R22, Amendment 7(d)). Read it by hand." 10 ;;
-      *) die "lane $lane has no lifecycle control root, so its worktree inventory could not be read. That is NOT 'this lane owns no worktree' (Amendment 7(d))." 1 ;;
-    esac
-    printf '%s\n' "$ltr_out"
-    ;;
-
-  set-lane-tree)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: set-lane-tree <lane> <worktree path> [--checkout <dir>] [--branch <b>] [--head <sha>] [--upstream <ref>] [--dirty <n>] [--unpushed <n>] [--writer <uuid>] [--generation <n>] [--operation <id>]" 64
-    shift
-    slt_path="${1-}"; [ -n "$slt_path" ] || die "set-lane-tree needs the worktree's path" 64
-    shift
-    case "$slt_path" in /*) : ;; *) die "set-lane-tree takes an ABSOLUTE path: a relative one has no meaning to any later reader of this record, which is a different process in a different directory" 64 ;; esac
-    slt_co=""; slt_b=""; slt_h=""; slt_u=""; slt_d=""; slt_n=""; slt_w=""; slt_g=""; slt_op=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --checkout)    slt_co="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_co" ] || die "--checkout needs a value" 64; shift 2 ;;
-        --checkout=*)  slt_co="${1#--checkout=}"; [ -n "$slt_co" ] || die "--checkout needs a value" 64; shift ;;
-        --branch)      slt_b="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_b" ] || die "--branch needs a value" 64; shift 2 ;;
-        --branch=*)    slt_b="${1#--branch=}"; [ -n "$slt_b" ] || die "--branch needs a value" 64; shift ;;
-        --head)        slt_h="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_h" ] || die "--head needs a value" 64; shift 2 ;;
-        --head=*)      slt_h="${1#--head=}"; [ -n "$slt_h" ] || die "--head needs a value" 64; shift ;;
-        --upstream)    slt_u="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_u" ] || die "--upstream needs a value" 64; shift 2 ;;
-        --upstream=*)  slt_u="${1#--upstream=}"; [ -n "$slt_u" ] || die "--upstream needs a value" 64; shift ;;
-        --dirty)       slt_d="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_d" ] || die "--dirty needs a value" 64; shift 2 ;;
-        --dirty=*)     slt_d="${1#--dirty=}"; [ -n "$slt_d" ] || die "--dirty needs a value" 64; shift ;;
-        --unpushed)    slt_n="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_n" ] || die "--unpushed needs a value" 64; shift 2 ;;
-        --unpushed=*)  slt_n="${1#--unpushed=}"; [ -n "$slt_n" ] || die "--unpushed needs a value" 64; shift ;;
-        --writer)      slt_w="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_w" ] || die "--writer needs a value" 64; shift 2 ;;
-        --writer=*)    slt_w="${1#--writer=}"; [ -n "$slt_w" ] || die "--writer needs a value" 64; shift ;;
-        --generation)  slt_g="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_g" ] || die "--generation needs a value" 64; shift 2 ;;
-        --generation=*) slt_g="${1#--generation=}"; [ -n "$slt_g" ] || die "--generation needs a value" 64; shift ;;
-        --operation)   slt_op="${2-}"; [ "$#" -ge 2 ] && [ -n "$slt_op" ] || die "--operation needs a value" 64; shift 2 ;;
-        --operation=*) slt_op="${1#--operation=}"; [ -n "$slt_op" ] || die "--operation needs a value" 64; shift ;;
-        --)            shift ;;
-        *)             die "unknown option '$1' for set-lane-tree" 64 ;;
-      esac
-    done
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    managed_seam_refuse "$lane" "set-lane-tree"     # ruling 2026-10-04
-    slt_root=""; slt_rrc=0
-    slt_root="$(lane_control_root "$lane")" || slt_rrc=$?
-    [ "$slt_rrc" = 0 ] ||
-      die "lane $lane has no lifecycle control root, so its worktree inventory has nowhere to go: its record names no directory (Amendment 11(c)) and \$PROJECTS_ROOT is not a directory here." 1
-    # WHAT THE CALLER SAW BEATS WHAT THIS PROCESS SEES, because a poll and a
-    # record written from it are ONE observation and a second reading of the
-    # same tree a moment later is a different one. Where the caller passed
-    # nothing, the tree is read HERE through the same `lane_tree_now`
-    # `lane-reconcile` recomputes with, so the two cannot disagree.
-    #
-    # AND AN OBSERVATION NOBODY COULD MAKE IS NOT COMPLETED WITH CLEAN-LOOKING
-    # VALUES (Copilot round 5 on #97). Until this round a `lane_tree_now` that
-    # failed left every field empty and `lane_tree_put`'s defaults wrote them as
-    # `unknown` / `none` / `0` — a record saying *branch unknown, nothing dirty,
-    # nothing unpushed* for a tree this process never read, which a later
-    # reconciliation would compare against and call published.
-    if [ -z "$slt_b$slt_h$slt_u$slt_d$slt_n" ]; then
-      slt_now=""; slt_nrc=0
-      slt_now="$(lane_tree_now "$slt_path")" || slt_nrc=$?
-      case "$slt_nrc" in
-        0)
-          slt_b="$(printf '%s' "$slt_now" | awk -F"$US" '{print $1}')"
-          slt_h="$(printf '%s' "$slt_now" | awk -F"$US" '{print $2}')"
-          slt_u="$(printf '%s' "$slt_now" | awk -F"$US" '{print $3}')"
-          slt_d="$(printf '%s' "$slt_now" | awk -F"$US" '{print $4}')"
-          slt_n="$(printf '%s' "$slt_now" | awk -F"$US" '{print $5}')" ;;
-        1) die "no worktree was recorded for lane $lane: there is no directory at $slt_path and this command was given no observation of its own to file. A record of a tree nobody read would say 'branch unknown, 0 dirty, 0 unpushed', which a later reconciliation reads as clean and published. Pass what you saw (--branch/--head/--upstream/--dirty/--unpushed), or record the tree while it is there." 1 ;;
-        2) die "no worktree was recorded for lane $lane: $slt_path exists and git does not answer in it, so there is no observation to file and this command invents none. The path itself was not touched." 1 ;;
-        *) die "no worktree was recorded for lane $lane: git answers in $slt_path and one of the reads an observation is made of FAILED, so nothing was written — a branch, a head, a status or an upstream that could not be read is never recorded as a clean tree (Amendment 7(d)). Read it by hand: git -C $slt_path status" 1 ;;
-      esac
-    # AND A CALLER'S OBSERVATION IS TAKEN WHOLE OR NOT AT ALL (Codex on ec9847e,
-    # PR #97). One flag alone used to skip the reading above and let the rest
-    # reach the record as `unknown`, `none` and — the dangerous two — `dirty 0`
-    # and `unpushed 0`, which a later reconciliation of a vanished tree reads as
-    # clean and published although nobody observed either.
-    elif [ -z "$slt_b" ] || [ -z "$slt_h" ] || [ -z "$slt_u" ] || [ -z "$slt_d" ] || [ -z "$slt_n" ]; then
-      die "set-lane-tree takes the caller's observation WHOLE — --branch, --head, --upstream, --dirty and --unpushed together — or none of them, when the tree is read here. A partial one would be filed with values nobody observed, and 'dirty 0, unpushed 0' is the record a later reconciliation reads as clean and published. Nothing was written." 64
-    fi
-    # AND IN THE SHAPES A RECORD IS READ BACK IN (#115). The two counts are what
-    # a reconciliation decides with, and a record carrying one that is neither a
-    # count nor `unknown` is one no reader may use and no writer may replace —
-    # so it is refused here, before anything is written, rather than filed.
-    case "$slt_d" in
-      ''|*[!0-9]*) die "set-lane-tree's --dirty takes a count of the tree's dirty paths, and '$slt_d' is not one: a record carrying it could be neither read nor replaced. Nothing was written." 64 ;;
-    esac
-    case "$slt_n" in
-      unknown) : ;;
-      ''|*[!0-9]*) die "set-lane-tree's --unpushed takes a count of commits, or 'unknown' where the upstream is configured and its remote-tracking ref is not here; '$slt_n' is neither, and a record carrying it could be neither read nor replaced. Nothing was written." 64 ;;
-    esac
-    # AND NO FIELD THAT IS ONLY BLANKS (review r1 of #252). A reader trims a
-    # value, so `--branch '  '` files a record with no branch — one the rename
-    # below refused only after the lock, with exit 1 and "the shell's own error
-    # is above". It is the caller's usage, said as one, before anything is taken.
-    for slt_fv in "branch=$slt_b" "head=$slt_h" "upstream=$slt_u" "checkout=$slt_co" "writer=$slt_w"; do
-      case "${slt_fv#*=}" in
-        ''|*[![:space:]]*) : ;;
-        *) die "set-lane-tree's --${slt_fv%%=*} is only blanks: a reader trims a value, so the record would carry no ${slt_fv%%=*} and could be neither read nor replaced. Nothing was written." 64 ;;
-      esac
-    done
-    # THE FENCE, AND IT IS THE LANE'S OWN (Copilot round 5 on #97). A caller
-    # that names the generation and the operation it is recording under is
-    # saying *this observation belongs to that transition* — and until this
-    # round the pair was serialized into the sidecar and compared with nothing,
-    # so a handoff that stalled while a recovery advanced the lane filed its
-    # superseded poll straight over the current inventory. The pair is compared
-    # with the lane's own snapshot under the SAME mutex the transition takes,
-    # and the write happens inside that mutex, so a transition cannot land
-    # between the compare and the record. A caller that names NEITHER is making
-    # an observation of its own — a person, or the read above — and has no fence
-    # to fail.
-    #
-    # AND THE MUTEX IS TAKEN WHETHER OR NOT THERE IS A FENCE TO CHECK (Copilot
-    # round 6 on #97). It used to be taken only for a FENCED write, which left
-    # the unfenced ones — a person's `set-lane-tree`, a caller that named no
-    # transition — racing every other writer of the same sidecar: the atomic
-    # rename below stops a reader seeing half a file and stops nothing else, so
-    # an unfenced observation could land after a newer fenced one and replace
-    # it, and the inventory would then hold a reading older than the transition
-    # recorded beside it. One mutex over every write of these files, and the
-    # generation/operation comparison stays what it was for the callers that
-    # name one.
-    #
-    # IT IS TAKEN HERE AND NOT ABOVE THE OBSERVATION, because the observation
-    # runs `git status` and `git rev-list` in somebody's checkout and this lock
-    # is the whole workstation's (design decision 14, and the same argument that
-    # keeps `lane-reconcile` out of it): what must be serialized is the compare
-    # and the write, not the reading of a repository.
-    acquire_lock
-    if [ -n "$slt_g" ] || [ -n "$slt_op" ]; then
-      if ! lane_sidecar_schema_ok "$slt_root/lane-state.yaml"; then
-        release_lock
-        die "the worktree $slt_path was NOT recorded for lane $lane: its lifecycle snapshot is not a record this helper can read ($LSS_WHY), so the generation and operation this observation names cannot be compared with anything. Nothing was written. Upgrade this workstation's lanes-edit.sh if a newer tooling wrote it, or read the snapshot by hand." 1
-      fi
-      slt_ng=""; slt_no=""; slt_ns=""
-      if [ -r "$slt_root/lane-state.yaml" ]; then
-        slt_ns="$(lane_sidecar_field "$slt_root/lane-state.yaml" state)"
-        slt_ng="$(lane_sidecar_field "$slt_root/lane-state.yaml" generation)"
-        slt_no="$(lane_sidecar_field "$slt_root/lane-state.yaml" operation)"
-      fi
-      slt_fence=""
-      [ -z "$slt_g" ]  || [ "$slt_g"  = "${slt_ng:-0}" ]    || slt_fence="generation is ${slt_ng:-0} and --generation named $slt_g"
-      [ -z "$slt_op" ] || [ "$slt_op" = "${slt_no:-none}" ] || slt_fence="${slt_fence:+$slt_fence; }operation is ${slt_no:-none} and --operation named $slt_op"
-      # AND THE OPERATION MUST STILL BE OPEN (opensoft/openRepoTools#114 item 1).
-      # `SWAPPING -> SWAPPED` keeps the generation AND the operation by design —
-      # it is the same operation reaching its commit point, and a fence that
-      # moved under it would refuse the very finalizer entitled to write — so the
-      # two values alone accepted a poll from that operation AFTER it was
-      # finalized: a reading taken before the commit point, filed over the
-      # inventory the commit point closed, and nothing downstream could tell. Every
-      # other transition advances the generation, so `SWAPPED` is the one state in
-      # which a matching pair names a FINISHED operation. An observation of the
-      # lane's own, under no transition, is an unfenced `set-lane-tree`.
-      [ "$slt_ns" != SWAPPED ] || slt_fence="${slt_fence:+$slt_fence; }the lane is SWAPPED: operation ${slt_no:-none} reached its commit point and its inventory is closed"
-      if [ -n "$slt_fence" ]; then
-        release_lock
-        die "the worktree $slt_path was NOT recorded for lane $lane: $slt_fence. The lane moved while this observation was being made — a recovery advanced it, a second handoff did, or the operation it names was finalized — so filing this poll now would put a superseded reading where the current one belongs, and nothing downstream could tell. Nothing was written and the tree itself was not touched. Re-read the lane (lanes-edit.sh lane-reconcile $lane) before recording anything under this operation; an observation filed under no transition is set-lane-tree without --generation and --operation." 7
-      fi
-    fi
-    # AND THE SIDECAR THAT IS THERE IS NOT WALKED OVER EITHER, for the same
-    # reason the snapshot is not: a record written by a newer tooling is one
-    # this helper cannot read, so it is not one this helper may replace.
-    if ! lane_sidecar_schema_ok "$slt_root/trees/$(tree_id_for "$slt_path").yaml"; then
-      release_lock
-      die "the worktree $slt_path was NOT recorded for lane $lane: its sidecar under $slt_root/trees is not a record this helper can read ($LSS_WHY), and a record it cannot read is one it cannot safely replace. Nothing was written. Upgrade this workstation's lanes-edit.sh if a newer tooling wrote it; if you know what wrote that file, move it aside by hand and re-run." 1
-    fi
-    if lane_tree_put "$slt_root" "$lane" "$slt_path" "$slt_co" "$slt_b" "$slt_h" \
-         "$slt_u" "$slt_d" "$slt_n" "$slt_w" "$slt_g" "$slt_op"; then
-      release_lock
-      LANES_INDEX_NUDGE_INV=1   # opensoft/openRepoTools#161: `cleanup` nudges the indexer
-      printf '%s\n' "$(tree_id_for "$slt_path")"
-    else
-      release_lock
-      die "the sidecar for $slt_path could not be written under $slt_root/trees (the shell's own error is above). The tree itself was not touched: this command reads worktrees and writes only its own record of them." 1
-    fi
-    ;;
-
-  # THE OBSERVATION, FROM THE ONE IMPLEMENTATION OF IT (Copilot round 5 on #97).
-  # `lane-handoff` polls the worktrees this reconciliation recomputes, and until
-  # this arm it made that observation ITSELF — a second implementation with its
-  # own error handling, in which a failed upstream lookup became `none` and a
-  # failed `log @{u}..` became `0`. One function answers both now: the handoff
-  # records what this prints, for its WRITERS section and for the sidecar alike,
-  # and `lane-reconcile` recomputes with the same code. It touches no lane, no
-  # register and no lock — it reads one path with git.
-  #
-  #   0  <branch><US><head><US><upstream><US><dirty><US><unpushed>
-  #   8  no checkout there: the path is gone, or git does not answer in it
-  #   1  git ANSWERED there and one of the reads FAILED, so nothing is printed
-  #  64  a usage error of this subcommand's own
-  lane-tree-now)
-    ltna="${1-}"; [ -n "$ltna" ] || die "usage: lane-tree-now <worktree path>" 64
-    [ "$#" -le 1 ] || die "lane-tree-now takes one path: lane-tree-now <worktree path>" 64
-    case "$ltna" in /*) : ;; *) die "lane-tree-now takes an ABSOLUTE path: a relative one means whatever the calling process's directory happens to be, and that is never the tree being asked about" 64 ;; esac
-    ltna_out=""; ltna_rc=0
-    ltna_out="$(lane_tree_now "$ltna")" || ltna_rc=$?
-    case "$ltna_rc" in
-      0)   printf '%s\n' "$ltna_out" ;;
-      1|2) exit 8 ;;
-      *)   die "git answers in $ltna and one of the reads an observation is made of FAILED, so NOTHING is printed: a branch, a head, a status or an upstream that could not be read is never reported as a clean tree (R22, Amendment 7(d)). Read it by hand: git -C $ltna status" 1 ;;
-    esac
-    ;;
-
-  # opensoft/openRepoTools#186, plan task T018 — THE LEGS A CHECKOUT'S
-  # `project.yaml` DECLARES, by path: `assembly_legs` above, which is the one
-  # reader every lane tool asks (`lane-worktrees`' sweep, report and `add`, and
-  # `lane-handoff`'s writer poll), so no two of them can read a triad two ways.
-  # It reads one file and touches no workspace, so it answers on a workstation
-  # with no register configured too (the dispatcher exempts it).
-  #
-  #   0  <repository><TAB><path as declared><TAB><where it is checked out>, a leg a line
-  #   8  no legs: no project.yaml there, or one naming no leg but the checkout itself
-  #   1  a project.yaml is there and could not be read — which is never "no legs"
-  #  64  a usage error of this subcommand's own
-  project-legs)
-    pla="${1-}"; [ -n "$pla" ] || die "usage: project-legs <checkout>" 64
-    [ "$#" -le 1 ] || die "project-legs takes one directory: project-legs <checkout>" 64
-    case "$pla" in /*) : ;; *) die "project-legs takes an ABSOLUTE path: a relative one means whatever the calling process's directory happens to be, and that is never the checkout being asked about" 64 ;; esac
-    pla_out=""; pla_rc=0
-    pla_out="$(assembly_legs "$pla")" || pla_rc=$?
-    case "$pla_rc" in
-      0) printf '%s\n' "$pla_out" ;;
-      8) exit 8 ;;
-      *) die "${pla%/}/project.yaml is there and could not be read, so which legs that checkout declares is NOT known — which is not the same as none (R22, Amendment 7(d))" 1 ;;
-    esac
-    ;;
-
-  lane-reconcile)
-    lane="${1-}"; [ -n "$lane" ] || die "usage: lane-reconcile <lane>" 64
-    [ "$#" -le 1 ] || die "lane-reconcile takes one lane: lane-reconcile <lane>" 64
-    check_lane_name "$lane"
-    log_sync
-    lane="$(canon_lane "$lane")" || exit 2          # Amendment 15
-    lane_reconcile "$lane"; lrec_rc=$?
-    case "$lrec_rc" in
-      0) : ;;
-      8) exit 8 ;;
-      *) die "lane $lane could not be reconciled (exit $lrec_rc)" 1 ;;
-    esac
-    ;;
-
-  # ---------- opensoft/openRepoTools#161: every inventoried worktree, as rows
-  #
-  # `worktree_rows` above, for one lane or every lane on this workstation, and
-  # the READ the `worktrees` table answers when `--index` is TYPED (Amendment
-  # 14(b)): `index_open worktrees` asks `lanes-index export --worktrees` for
-  # every `inventory:<Workstation>` source the store holds — this
-  # workstation's and any other that syncs into the same Postgres, which is the
-  # point of the table — and stderr says which was read: `read: index (<store>)
-  # at inventory:<ws> synced <UTC>` (and `(last error: <UTC> <why>)` after a
-  # source this workstation recorded one for, as `status` shows it), or
-  # `read: sources (index <why>)` and the sidecars answer, exactly as without
-  # the flag. NO ACT READS THIS: not
-  # `lane-reconcile`, not `lane-start`, not `lane-end`, not a sweep — each of
-  # them reads the sidecars and the disk, and this is a listing.
-  #
-  # Local by default, as `lanes` is: `--fetch` refreshes the register first.
-  #   0 rows (`--all`: with one PARTIAL line where the lane listing they were
-  #   read through was not whole, #173) · 8 none · 2 a lane name refused
-  #   (Amendment 15) · 64 usage · 1 a read failed
-  worktrees)
-    wt_lane=""; wt_all=0; wt_index=0; wt_fetch=0
-    wt_usage="worktrees [<lane> | --all] [--index] [--fetch]"
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --all)   wt_all=1; shift ;;
-        --index) wt_index=1; shift ;;
-        --fetch) wt_fetch=1; shift ;;
-        --)      shift ;;
-        -*)      die "unknown option '$1' for worktrees ($wt_usage)" 64 ;;
-        *)       [ -z "$wt_lane" ] || die "worktrees takes ONE lane, or --all: $wt_usage" 64; wt_lane="$1"; shift ;;
-      esac
-    done
-    [ "$wt_all" = 0 ] || [ -z "$wt_lane" ] || die "worktrees takes ONE lane OR --all, not both: $wt_usage" 64
-    [ -z "$wt_lane" ] || check_lane_name "$wt_lane"
-    [ "$wt_fetch" = 1 ] || LANES_NO_FETCH=1
-    log_sync
-    if [ -n "$wt_lane" ]; then
-      wt_lane="$(canon_lane "$wt_lane")" || exit 2          # Amendment 15
-    fi
-    if [ "$wt_index" = 1 ] && index_open worktrees; then
-      wt_out="$(awk -F"$US" -v l="$(lc "$wt_lane")" 'l == "" || tolower($3) == l' "$LANES_WT_IDX_DIR/worktrees" 2>/dev/null)"
-      [ -n "$wt_out" ] || exit 8
-      printf '%s\n' "$wt_out"
-    else
-      wt_out=""; wt_rc=0
-      wt_out="$(worktree_rows "$wt_lane")" || wt_rc=$?
-      case "$wt_rc" in
-        0) : ;;
-        8) exit 8 ;;
-        *) die "the lane listing the inventory is read through could not be read (exit $wt_rc). That is NOT 'no worktree is inventoried' (Amendment 7(d))." 1 ;;
-      esac
-      printf '%s\n' "$wt_out"
-    fi
-    ;;
-
-  # opensoft/openRepoTools#162 — WHAT A HAND COMMIT OF A HANDOFF'S ATTACHMENTS
-  # WOULD STAGE THAT IS BYTECODE, asked BEFORE the commit. `commit_push`
-  # refuses such a pathspec for every write this file makes; attachments are
-  # committed by hand, so this is the same question for a person to ask first.
-  #   0  nothing in those paths would stage bytecode, a cache or an environment
-  #   2  something would: the paths on stdout, the offer on stderr - or git
-  #      could not read what they would stage, which is never "clean" (#170 G13)
-  #  64  usage
-  pathspec-check)
-    [ "$#" -gt 0 ] || die "usage: pathspec-check <path>...   (relative to the workspace repository $LANES_REPO)" 64
-    pck_rc=0
-    pck_out="$(bytecode_in_pathspec "$LANES_REPO" "$@")" || pck_rc=$?
-    if [ "$pck_rc" != 0 ]; then
-      note "git could not read what that pathspec would stage (a pathspec it cannot parse, or an index it cannot read), so whether it holds bytecode is unknown, and an unknown is never reported clean (opensoft/openRepoTools#170 G13)"
-      exit 2
-    fi
-    if [ -n "$pck_out" ]; then
-      printf '%s\n' "$pck_out"
-      note "$(bytecode_refusal_text "$pck_out")"
-      exit 2
-    fi
-    ;;
-
-  *)
-    die "unknown subcommand '$cmd' (verify-row|set-row-state|append-row-status|replace-in-row|append-session-id|append-line|add-row|retire-rows|archive-rows|migrate-state-cells|commit|rename-lane|log|claim|release|who|history|swapped|session-start|guard|idle-holders|live-holder|window-session|transcript-holders|binding|request-handoff|session-lane|window-lane|lane-dir|lane-profile|lane-agent|lane-transcript|lane-last|workspace-root|last-session|forks|duplicate-holder|workstation|fetch-age|lanes|lane-groups|next-free|sibling-filter|resolve-repo|lane-objects|register-row|register-row-local|retired-identity|canon-lane|resolve-home|managed-projection|lane-state|set-lane-state|lane-trees|set-lane-tree|lane-tree-now|project-legs|lane-reconcile|lane-holders|legacy-restart-check|publish-handoff|restart-intent|set-restart-intent|worktrees|pathspec-check)" 2
-    ;;
-esac
diff --git a/lanes-index b/lanes-index
deleted file mode 100755
index a067452e..00000000
--- a/lanes-index
+++ /dev/null
@@ -1,2695 +0,0 @@
-#!/usr/bin/env python3
-# SPDX-License-Identifier: Apache-2.0
-"""lanes-index - the DERIVED INDEX of the lane register (lane-collision-protocol
-Amendment 14, ratified by Brett Heap 2026-10-05, verbatim "ratify 48").
-
-    lanes-index sync      [--source <s>]              write behind what LANDED
-    lanes-index reconcile [--source <s>] [--dry-run]  read the source whole
-    lanes-index status                                 per source: store, lag, errors
-    lanes-index export    --out <dir> [--source <s> | --worktrees]
-                                                       the read flags' reader
-
-THE REGISTER'S TRUTH STAYS WHERE IT IS (clause (a)). The workspace repository's
-`lanes/LANES.md`, `lanes/log/*.md`, `lanes/aliases.tsv` and `lanes/archive/`
-are the record, written only by `lanes-edit.sh`. This file keeps a COPY of what
-they say, in tables a question across lanes can be asked of, and makes nothing
-else true: where the index and the source disagree, the source is right and the
-index is behind.
-
-NOTHING THAT ACTS READS IT (clause (b)). No claim, release, log line, guard,
-hook, launch, row writer, sweep or migration reads this store or waits on it.
-`lanes-edit.sh` starts `lanes-index sync` DETACHED after a push has landed and
-its mutex is released - stdin closed, never waited, its status never read - and
-two read-only words consult it behind a flag typed for that invocation:
-`lanes ... --index` and `lanes-edit.sh history ... --index`, through `export`.
-
-WRITE-BEHIND, BY THE INDEXER ALONE, NEVER BACK (clause (d)). `sync` reads the
-register as `origin/<branch>` of the workspace checkout stands - what the push
-left, never the working tree - and upserts each record keyed by (source, record
-id) and versioned by a digest of its content: an upsert bearing the stored
-digest changes nothing, so a replay or a crash is harmless. The source's
-indexed commit is compared and swapped IN THE SAME TRANSACTION as the rows it
-covers, and a sync from a commit that does not descend from it writes nothing.
-Nothing in any source is ever written from here.
-
-THE INVENTORY IS A SECOND SOURCE (opensoft/openRepoTools#161, the "later word"
-clause (e) left open): `inventory:<Workstation>`, THIS workstation's #97
-worktree inventory, copied into the `worktrees` table. It is read through
-`lanes-edit.sh worktrees --all` - the sidecars, the lifecycle snapshot,
-`managed-projection`'s owner and the listing's liveness, in the helper that
-wrote them - and never through a parser of this file's own or a walk of the
-disk. Its rows are keyed by (source, `<lane>:<path>`) - a second tree of one lane
-with the same path `<lane>:<path><US><n>`, and a lane's unread marker
-`<lane>:<US>unread` - and versioned by the same digest; a tree the inventory no
-longer names leaves in the same sync. Its
-provenance moves only forward PER LANE: a sync that reads a lane's lifecycle
-generation below the one its rows were written at writes nothing for that lane
-(`reconcile` takes the lane as it now stands, and says so); a lane whose
-inventory is there and could not be read keeps its rows and gets one marker
-row, with no path and a branch no git ref can be (#173), which `export
---worktrees` writes back as the source's own `UNREAD` line; a read whose LANE
-LISTING was not whole - the helper's `PARTIAL` line: its register, its archive,
-the list of its logs or a log could not be read - writes nothing at all (#173
-item c1), since a lane it could not name is not a lane with no trees; and the
-source's own row carries a fingerprint of the whole table as its
-compare-and-swap token and a sync generation that only counts up.
-`lanes-edit.sh` nudges `sync --source inventory` after every inventory write.
-Nothing that acts reads this table either: `lane-reconcile`, `lane-start`,
-`lane-end` and the sweep read the sidecars and the disk.
-
-THE STORE (clause (c)): QA Postgres where this workstation's configuration
-names a `url=`, reached through `psql` and only then; otherwise one SQLite file
-on local disk. The configuration is
-`${XDG_CONFIG_HOME:-$HOME/.config}/openRepoTools/lanes-index.conf`, or the file
-`$LANES_INDEX_CONFIG` names: `store=`, `url=`, `passfile=`, `sqlite=`, and for
-the SELECT-only role `reader_url=`/`reader_passfile=`, and `schema=`. It is
-refused when it is group- or world-readable, inside a git work tree or under
-`~/.agents/`, and when a URL carries a password: the secret lives only in the
-0600 libpq password file `passfile=` names. The reads (`status`, `export`)
-connect to Postgres only as `reader_url=` and are refused without it - never
-with the writer's credential.
-
-Exit codes: 0 done · 1 a read or a write failed (nothing half-written) · 2 a
-refusal (the configuration, a `--source` that is not this workstation's, an
-inventory on a workstation with no name) · 3
-`export` only: the index cannot answer (missing, unreachable, wiped, unknown
-schema - the reason is in `<out>/why`) · 64 usage.
-"""
-
-from __future__ import annotations
-
-import datetime as _dt
-import functools
-import hashlib
-import json
-import os
-import re
-import shutil
-import stat
-import subprocess
-import sys
-import time
-from concurrent.futures import ThreadPoolExecutor
-
-PROG = "lanes-index"
-VERSION = "1"
-
-#: THE SCHEMA THIS READER AND WRITER KNOW. A store carrying another number is
-#: never written by this file and never read by `export`: an older indexer
-#: overwriting a newer schema's rows, or a reader guessing at them, is a second
-#: way for the index to be wrong.
-SCHEMA_VERSION = 1
-
-US = "\x1f"
-LANES_DIR = "lanes/"
-REGISTER_PATH = "lanes/LANES.md"
-ALIASES_PATH = "lanes/aliases.tsv"
-ARCHIVE_PATH = "lanes/archive/LANES-retired.md"
-LOG_PREFIX = "lanes/log/"
-
-UUID_RE = re.compile(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
-UUID_FULL_RE = re.compile(r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$")
-UTC_RE = re.compile(r"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}(:[0-9]{2})?Z")
-SHA_RE = re.compile(r"^[0-9a-f]{40}$")
-SCHEMA_NAME_RE = re.compile(r"^[a-z_][a-z0-9_]{0,62}$")
-OPEN_VERBS = ("CLAIMED", "TAKEOVER", "OPENED", "LANDING", "WITHDRAWN")
-INVENTORY_PREFIX = "inventory:"
-
-
-class Refusal(Exception):
-    """A refusal: exit 2, nothing read and nothing written."""
-
-
-class StoreUnusable(Exception):
-    """The store cannot answer: missing, unreachable, wiped or another schema.
-
-    `kind` is the first word of the `read: sources (index <why>)` line."""
-
-    def __init__(self, kind: str, detail: str):
-        super().__init__(f"{kind}: {detail}")
-        self.kind = kind
-        self.detail = detail
-
-
-class CasLost(Exception):
-    """The source's provenance moved under this sync: nothing was written."""
-
-
-class SourceMoved(Exception):
-    """`origin/<branch>` moved while this sync read it: nothing was written,
-    and the caller reads the new tip whole."""
-
-
-def utc_now() -> str:
-    return _dt.datetime.now(_dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def say(text: str = "") -> None:
-    sys.stdout.write(text + "\n")
-
-
-def note(text: str) -> None:
-    sys.stderr.write(f"{PROG}: {text}\n")
-
-
-# =========================================================== configuration
-
-def _home() -> str:
-    return os.environ.get("HOME") or os.path.expanduser("~")
-
-
-def config_path() -> tuple[str, bool]:
-    """The configuration's path, and whether a person NAMED it.
-
-    A named file that is not there is a refusal; the default path that is not
-    there is the ordinary case, and means SQLite at its default path."""
-    named = os.environ.get("LANES_INDEX_CONFIG", "")
-    if named:
-        return named, True
-    base = os.environ.get("XDG_CONFIG_HOME") or os.path.join(_home(), ".config")
-    return os.path.join(base, "openRepoTools", "lanes-index.conf"), False
-
-
-def state_dir() -> str:
-    base = os.environ.get("XDG_STATE_HOME") or os.path.join(_home(), ".local", "state")
-    return os.path.join(base, "openRepoTools")
-
-
-def git_work_tree_of(path: str) -> str:
-    """The work tree `path` sits inside, or "" where it is in none.
-
-    Asked of the nearest directory that EXISTS, because a store or a
-    configuration not created yet is still a file that would land inside it."""
-    probe = os.path.abspath(path)
-    while probe and not os.path.isdir(probe):
-        parent = os.path.dirname(probe)
-        if parent == probe:
-            return ""
-        probe = parent
-    try:
-        proc = subprocess.run(["git", "-C", probe, "rev-parse", "--show-toplevel"],
-                              capture_output=True, text=True, check=False,
-                              stdin=subprocess.DEVNULL)
-    except OSError:
-        return ""
-    if proc.returncode != 0:
-        return ""
-    return proc.stdout.strip()
-
-
-def _agents_root() -> str:
-    return os.environ.get("AGENT_PROTOCOL_ROOT") or os.path.join(_home(), ".agents")
-
-
-def _under(path: str, root: str) -> bool:
-    try:
-        path_r = os.path.realpath(path)
-        root_r = os.path.realpath(root)
-    except OSError:
-        return False
-    return path_r == root_r or path_r.startswith(root_r.rstrip(os.sep) + os.sep)
-
-
-def _url_has_password(url: str) -> bool:
-    """A password in a libpq URL or keyword string, however it is spelled.
-
-    `postgresql://user:secret@host/db`, `?password=secret`, and the keyword
-    form `password=secret` are each a credential in a file that is not the
-    password file - and a URL is what ends up in an argv, a log or a process
-    listing."""
-    low = url.strip()
-    m = re.match(r"^[A-Za-z][A-Za-z0-9+.-]*://([^/?#]*)", low)
-    if m:
-        userinfo = m.group(1).rpartition("@")
-        if userinfo[1] and ":" in userinfo[0]:
-            return True
-        query = low.split("?", 1)[1] if "?" in low else ""
-        for part in re.split(r"[&;]", query):
-            if part.split("=", 1)[0].strip().lower() == "password":
-                return True
-        return False
-    return bool(re.search(r"(^|\s)password\s*=", low, re.IGNORECASE))
-
-
-def _check_private_file(path: str, what: str) -> None:
-    try:
-        st = os.stat(path)
-    except OSError as exc:
-        raise Refusal(f"{what} {path} cannot be read: {exc.strerror or exc}")
-    if not stat.S_ISREG(st.st_mode):
-        raise Refusal(f"{what} {path} is not a regular file")
-    if st.st_mode & 0o077:
-        raise Refusal(
-            f"{what} {path} is mode {oct(st.st_mode & 0o777)[2:]}, so another account "
-            f"on this workstation can read it (Amendment 14(c): mode 0600). "
-            f"Fix it: chmod 600 {path}")
-
-
-def load_config() -> dict:
-    """The per-workstation configuration, refused on any of clause (c)'s grounds."""
-    path, named = config_path()
-    cfg = {"path": path, "present": False, "store": "", "url": "", "passfile": "",
-           "reader_url": "", "reader_passfile": "", "sqlite": "", "schema": "lanes_index"}
-    if not os.path.lexists(path):
-        if named:
-            raise Refusal(f"LANES_INDEX_CONFIG names {path}, which does not exist")
-    else:
-        cfg["present"] = True
-        _check_private_file(path, "the configuration")
-        # RESOLVED FIRST (Copilot round 1 on #164): a 0600 symlink outside every
-        # repository that points at a committed file inside one is that file,
-        # and its directory is the one the question is about.
-        tree = git_work_tree_of(os.path.dirname(os.path.realpath(path)))
-        if tree:
-            raise Refusal(
-                f"the configuration {path} is inside the git work tree {tree}: "
-                f"connection settings are per workstation and never committed "
-                f"(Amendment 14(c)). Move it to "
-                f"${{XDG_CONFIG_HOME:-$HOME/.config}}/openRepoTools/lanes-index.conf")
-        if _under(path, _agents_root()):
-            raise Refusal(
-                f"the configuration {path} is under {_agents_root()}, which on a "
-                f"workstation built from the workspace repository IS that repository "
-                f"(Amendment 14(c)). Move it to "
-                f"${{XDG_CONFIG_HOME:-$HOME/.config}}/openRepoTools/lanes-index.conf")
-        try:
-            with open(path, encoding="utf-8") as handle:
-                lines = handle.read().splitlines()
-        except (OSError, UnicodeDecodeError) as exc:
-            raise Refusal(f"the configuration {path} cannot be read: {exc}")
-        known = ("store", "url", "passfile", "reader_url", "reader_passfile", "sqlite", "schema")
-        for number, raw in enumerate(lines, 1):
-            line = raw.strip()
-            if not line or line.startswith("#"):
-                continue
-            if "=" not in line:
-                raise Refusal(f"{path}:{number} is not `key=value`: {line!r}")
-            key, value = (part.strip() for part in line.split("=", 1))
-            if key not in known:
-                raise Refusal(f"{path}:{number} names `{key}=`, which this indexer does not "
-                              f"know (it reads {', '.join(k + '=' for k in known)})")
-            if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
-                value = value[1:-1]
-            if value.startswith("~/"):
-                value = os.path.join(_home(), value[2:])
-            cfg[key] = value
-    for key in ("url", "reader_url"):
-        if cfg[key] and _url_has_password(cfg[key]):
-            raise Refusal(
-                f"`{key}=` in {path} carries a password. The secret lives only in the "
-                f"0600 libpq password file `passfile=` names (Amendment 14(c)), never in "
-                f"a URL a command line or a log can show")
-    store = cfg["store"] or ("postgres" if cfg["url"] else "sqlite")
-    if store not in ("sqlite", "postgres"):
-        raise Refusal(f"`store={cfg['store']}` in {path}: the store is `sqlite` or `postgres`")
-    if store == "postgres" and not cfg["url"]:
-        raise Refusal(f"`store=postgres` in {path} names no `url=`")
-    cfg["store"] = store
-    if not SCHEMA_NAME_RE.match(cfg["schema"]):
-        raise Refusal(f"`schema={cfg['schema']}` in {path} is not a plain lower-case SQL identifier")
-    for key in ("passfile", "reader_passfile"):
-        if cfg[key]:
-            _check_private_file(cfg[key], f"the libpq password file (`{key}=`)")
-    if store == "sqlite":
-        sqlite_path = cfg["sqlite"] or os.path.join(state_dir(), "lanes-index.sqlite")
-        sqlite_path = os.path.abspath(sqlite_path)
-        tree = git_work_tree_of(os.path.dirname(os.path.realpath(sqlite_path)))
-        if tree:
-            raise Refusal(
-                f"the SQLite store {sqlite_path} would be inside the git work tree {tree}; "
-                f"the index lives on local disk and never inside a work tree "
-                f"(Amendment 14(c)). Name another path with `sqlite=`")
-        cfg["sqlite"] = sqlite_path
-    return cfg
-
-
-# =============================================================== the source
-
-def lanes_edit_path() -> str:
-    """`$LANES_EDIT`, else the `lanes-edit.sh` beside this file, else PATH -
-    the order `lanes` already finds its reader in."""
-    named = os.environ.get("LANES_EDIT", "")
-    if named:
-        return named
-    here = os.path.join(os.path.dirname(os.path.realpath(__file__)), "lanes-edit.sh")
-    if os.access(here, os.X_OK):
-        return here
-    return shutil.which("lanes-edit.sh") or ""
-
-
-def helper_env() -> dict:
-    """The environment `lanes-edit.sh` is run in from here: the caller's own,
-    with the fetch, GitHub and the index switched off. This process reads what
-    landed and reaches no network, and a helper run from inside the indexer
-    must never start an indexer."""
-    env = dict(os.environ)
-    env["LANES_NO_FETCH"] = "1"
-    env["LANES_NO_GITHUB"] = "1"
-    env["LANES_INDEX"] = "off"
-    return env
-
-
-def workspace_root() -> str:
-    helper = lanes_edit_path()
-    if not helper:
-        raise StoreUnusable("unread", "no lanes-edit.sh beside this file or on PATH, so the "
-                            "workspace repository cannot be found (Amendment 9(a))")
-    proc = subprocess.run([helper, "workspace-root"], capture_output=True, text=True,
-                          check=False, env=helper_env(), stdin=subprocess.DEVNULL)
-    root = proc.stdout.strip()
-    if proc.returncode != 0 or not root:
-        why = (proc.stderr.strip().splitlines() or ["no answer"])[0]
-        raise StoreUnusable("unread", f"`lanes-edit.sh workspace-root` exited "
-                            f"{proc.returncode}: {why}")
-    return root
-
-
-def _norm_repo(text: str) -> str:
-    u = text.strip()
-    if u.endswith(".git"):
-        u = u[:-4]
-    for prefix in ("https://github.com/", "ssh://git@github.com/", "git@github.com:",
-                   "http://github.com/"):
-        if u.startswith(prefix):
-            return u[len(prefix):]
-    return u
-
-
-def source_of(root: str) -> str:
-    """`register:<owner/repo>` - the `repository:` this workstation's
-    `workspace.yaml` names, which is how every lane helper names the workspace
-    (Amendment 9(a)); its checkout's `origin` where that file does not answer."""
-    yaml = os.path.join(_agents_root(), "workspace.yaml")
-    repo = ""
-    try:
-        with open(yaml, encoding="utf-8") as handle:
-            for raw in handle:
-                m = re.match(r"^repository:[ \t]*(.*)$", raw.rstrip("\n"))
-                if m:
-                    repo = re.sub(r"[ \t]*#.*$", "", m.group(1)).strip().strip("\"'")
-                    break
-    except OSError:
-        repo = ""
-    if not repo:
-        proc = git(root, "remote", "get-url", "origin", check=False)
-        repo = proc.stdout.strip()
-    repo = _norm_repo(repo) or os.path.basename(root)
-    return f"register:{repo}"
-
-
-def branch() -> str:
-    return os.environ.get("LANES_BRANCH") or "main"
-
-
-def git(root: str, *args: str, check: bool = True, data: bytes | None = None,
-        text: bool = True) -> subprocess.CompletedProcess:
-    proc = subprocess.run(["git", "-C", root, *args], capture_output=True,
-                          check=False, input=data, text=text if data is None else False,
-                          stdin=None if data is not None else subprocess.DEVNULL)
-    if check and proc.returncode != 0:
-        err = proc.stderr if isinstance(proc.stderr, str) else proc.stderr.decode("utf-8", "replace")
-        raise StoreUnusable("unread", f"git {' '.join(args)} failed in {root}: "
-                            f"{(err.strip().splitlines() or ['no message'])[-1]}")
-    return proc
-
-
-def tip_of(root: str) -> str:
-    proc = git(root, "rev-parse", "--verify", "-q", f"refs/remotes/origin/{branch()}^{{commit}}",
-               check=False)
-    sha = proc.stdout.strip()
-    if proc.returncode != 0 or not SHA_RE.match(sha):
-        raise StoreUnusable("unread", f"{root} has no origin/{branch()}: nothing has landed "
-                            f"there for the index to follow")
-    return sha
-
-
-def has_commit(root: str, sha: str) -> bool:
-    return git(root, "cat-file", "-e", f"{sha}^{{commit}}", check=False).returncode == 0
-
-
-def is_ancestor(root: str, old: str, new: str) -> bool:
-    return git(root, "merge-base", "--is-ancestor", old, new, check=False).returncode == 0
-
-
-def commits_between(root: str, old: str, new: str) -> int | None:
-    if not has_commit(root, old):
-        return None
-    proc = git(root, "rev-list", "--count", f"{old}..{new}", check=False)
-    try:
-        return int(proc.stdout.strip())
-    except ValueError:
-        return None
-
-
-def _decode(blob: bytes) -> str:
-    return blob.decode("utf-8", "replace")
-
-
-def read_snapshot(root: str, sha: str) -> dict:
-    """Every file the index derives from, AS OF ONE COMMIT.
-
-    The log list is `git ls-tree <sha> -- lanes/log/` in ITS order, which is the
-    order `lanes-edit.sh`'s own published read walks them in - and that order is
-    kept, because a reader built on the index has to produce the same stream."""
-    snap = {"sha": sha, "register": None, "aliases": None, "archive": None, "logs": [],
-            "blobs": {}}
-    wanted = []
-    proc = git(root, "ls-tree", "-z", sha, "--", REGISTER_PATH, ALIASES_PATH, ARCHIVE_PATH)
-    for entry in proc.stdout.split("\0"):
-        if not entry:
-            continue
-        meta, _, path = entry.partition("\t")
-        _mode, kind, obj = meta.split()
-        if kind != "blob":
-            continue
-        wanted.append((path, obj))
-    logs = []
-    proc = git(root, "ls-tree", "-z", sha, "--", LOG_PREFIX)
-    for entry in proc.stdout.split("\0"):
-        if not entry:
-            continue
-        meta, _, path = entry.partition("\t")
-        _mode, kind, obj = meta.split()
-        if kind != "blob":
-            continue
-        if path.rsplit("/", 1)[-1] == "README.md":
-            continue
-        logs.append((path, obj))
-        wanted.append((path, obj))
-    contents = cat_blobs(root, [obj for _path, obj in wanted])
-    for path, obj in wanted:
-        text = _decode(contents.get(obj, b""))
-        snap["blobs"][path] = obj
-        if path == REGISTER_PATH:
-            snap["register"] = text
-        elif path == ALIASES_PATH:
-            snap["aliases"] = text
-        elif path == ARCHIVE_PATH:
-            snap["archive"] = text
-    for order, (path, obj) in enumerate(logs):
-        snap["logs"].append((path, _decode(contents.get(obj, b"")), obj, order))
-    if snap["register"] is None:
-        raise StoreUnusable("unread", f"{sha[:12]} carries no {REGISTER_PATH}")
-    return snap
-
-
-def cat_blobs(root: str, objs: list[str]) -> dict:
-    """The bytes of every blob named, in ONE `git cat-file --batch`."""
-    out: dict = {}
-    unique = list(dict.fromkeys(objs))
-    if not unique:
-        return out
-    proc = git(root, "cat-file", "--batch", data=("\n".join(unique) + "\n").encode(), text=False)
-    buf = proc.stdout
-    pos = 0
-    for obj in unique:
-        nl = buf.index(b"\n", pos)
-        header = buf[pos:nl].decode("ascii", "replace").split()
-        pos = nl + 1
-        if len(header) < 3 or header[1] == "missing":
-            continue
-        size = int(header[2])
-        out[obj] = buf[pos:pos + size]
-        pos += size + 1
-    return out
-
-
-# ============================================================== the parsers
-#
-# THE LOG GRAMMAR IS `lanes-edit.sh`'s `LOG_AWK`, PORTED LINE FOR LINE. A
-# parser of this file's own that disagreed with that one would make `history
-# --index` print a different diary from `history`, which is the one thing the
-# read flag promises it does not. Every test, every trim and every reason for
-# an unreadable line below is that awk's; `tests/test_lanes_index.py` holds the
-# two to one output over the same logs.
-
-def _trim(text: str) -> str:
-    return text.strip(" \t")
-
-
-def file_lane(path: str) -> str:
-    base = path.rsplit("/", 1)[-1]
-    return re.sub(r"\.[Mm][Dd]$", "", base)
-
-
-def parse_log_line(line: str):
-    """None for a line the grammar skips (a comment or a blank), a dict with
-    `bad` for one it cannot read, else the parsed fields."""
-    if re.match(r"^[ \t]*#", line) or re.match(r"^[ \t]*$", line):
-        return None
-    i = line.find(" — ")
-    if i < 0:
-        return {"bad": 'no " — " after the verb'}
-    verb = _trim(line[:i])
-    rest = line[i + 3:]
-    if " " in verb:
-        return {"bad": f'the verb is one token: "{verb}"'}
-    if not rest.startswith("lane "):
-        return {"bad": 'no "lane <name>" field'}
-    rest = rest[5:]
-    q = rest.find(",")
-    if q < 0:
-        return {"bad": 'no "," after the lane'}
-    written_lane = _trim(rest[:q])
-    rest = _trim(rest[q + 1:])
-    if not rest.startswith("session "):
-        return {"bad": 'no "session <uuid>@<ws>" field'}
-    rest = rest[8:]
-    q = rest.find(",")
-    if q < 0:
-        return {"bad": 'no "," after the session'}
-    sess = _trim(rest[:q])
-    rest = _trim(rest[q + 1:])
-    a = sess.find("@")
-    uuid = sess[:a] if a >= 0 else sess
-    ws = sess[a + 1:] if a >= 0 else ""
-    m = UTC_RE.match(rest)
-    if not m:
-        return {"bad": "no YYYY-MM-DDTHH:MM[:SS]Z"}
-    utc = m.group(0)
-    rest = rest[m.end():]
-    if not rest.startswith(","):
-        return {"bad": 'no "," and object after the UTC'}
-    rest = _trim(rest[1:])
-    sp = rest.find(" ")
-    if sp < 0:
-        obj, rest = rest, ""
-    else:
-        obj, rest = rest[:sp], rest[sp + 1:]
-    ref = payload = txt = ""
-    if rest != "":
-        if rest.startswith("— "):
-            txt = _trim(rest[2:])
-        else:
-            j = rest.find(" — ")
-            if j >= 0:
-                txt = _trim(rest[j + 3:])
-                rest = _trim(rest[:j])
-            if rest.startswith("→ "):
-                ref, payload = "→", _trim(rest[2:])
-            elif rest.startswith("← "):
-                ref, payload = "←", _trim(rest[2:])
-            else:
-                payload = _trim(rest)
-    return {"verb": verb, "written_lane": written_lane, "uuid": uuid, "ws": ws, "utc": utc,
-            "object": obj, "ref": ref, "payload": payload, "text": txt}
-
-
-def payload_fields(payload: str) -> dict:
-    """`payload_subfield`'s split: `; `-separated sub-fields, the first token
-    the name, a quoted value taken whole, and the FIRST of a repeated name wins
-    exactly as that reader's `exit` makes it."""
-    fields: dict = {}
-    if not payload:
-        return fields
-    for piece in payload.split("; "):
-        name, _, value = piece.partition(" ")
-        if not name or name in fields:
-            continue
-        value = _trim(value)
-        if value.startswith('"'):
-            q = value.find('"', 1)
-            if q > 0:
-                value = value[1:q]
-        fields[name] = value
-    return fields
-
-
-def parse_log(path: str, text: str) -> tuple[list, list]:
-    """The log's records - one per line the grammar does not skip, unreadable
-    ones INCLUDED - and the warnings `LOG_AWK` prints for it."""
-    lane = file_lane(path)
-    records, warnings = [], []
-    for ordinal, line in enumerate(text.split("\n"), 1):
-        parsed = parse_log_line(line)
-        if parsed is None:
-            continue
-        rec = {"lane": lane, "file": path, "ordinal": ordinal, "raw": line}
-        if "bad" in parsed:
-            rec.update(unreadable=1, unreadable_why=parsed["bad"])
-            warnings.append(f"unreadable: {path}:{ordinal} ({parsed['bad']})")
-        else:
-            obj = parsed["object"]
-            if lane and obj.startswith("lane:"):
-                obj = "lane:" + lane
-            rec.update(unreadable=0, unreadable_why=None, verb=parsed["verb"],
-                       written_lane=parsed["written_lane"], session=parsed["uuid"],
-                       workstation=parsed["ws"], utc=parsed["utc"], object=obj,
-                       ref=parsed["ref"], payload=parsed["payload"],
-                       free_text=parsed["text"])
-        records.append(rec)
-    if warnings:
-        warnings.append(f"{len(warnings)} unreadable line(s) above — an append-only log is "
-                        f"never rewritten, so a line no parser reads is a hold no tool will "
-                        f"mention again")
-    return records, warnings
-
-
-def row_name(line: str) -> str | None:
-    """`ROW_AWK`'s rule: a line opening with `|` whose first backticked token
-    is the lane. None where the line is not a row by that rule."""
-    if not line.startswith("|"):
-        return None
-    p1 = line.find("`")
-    if p1 < 0:
-        return None
-    rest = line[p1 + 1:]
-    p2 = rest.find("`")
-    if p2 < 0:
-        return None
-    return rest[:p2]
-
-
-def cell_state(row: str) -> str:
-    """`LANES_REGISTER_INDEX_AWK`'s `cell_state`: six ` | ` from the left or it
-    is not knowable which text is the state cell, and then the last piece."""
-    row = row.rstrip(" \t")
-    if not row.startswith("|") or not row.endswith("|"):
-        return ""
-    rest = row[:-1]
-    for _ in range(6):
-        i = rest.find(" | ")
-        if i < 0:
-            return ""
-        rest = rest[i + 3:]
-    if " | " in rest:
-        return ""
-    return rest
-
-
-REGISTER_KIND_RE = re.compile(r"^(HOLD RELEASED|HOLD|LANDING|LANDED)[ \t]+(—|-)[ \t]")
-
-
-def parse_register_line(line: str) -> dict | None:
-    """Rule 6's `LANDING`/`LANDED` and Amendment 10's `HOLD`/`HOLD RELEASED`.
-
-    The kind is the line's own first word(s); every other field is read the way
-    `RULE6_AWK` reads it, best effort, because a `HOLD` is free text by
-    Amendment 10(e) and the raw line is kept beside whatever was found."""
-    m = REGISTER_KIND_RE.match(line)
-    if not m:
-        return None
-    fields = {"kind": m.group(1), "lane": None, "repo": None, "pr": None, "tip": None,
-              "utc": None, "session": None}
-    lm = re.search(r"lane ([A-Za-z0-9._-]+)", line)
-    if lm:
-        fields["lane"] = lm.group(1)
-    pm = re.search(r"PR #([0-9]+)", line) or re.search(r"#([0-9]+)", line)
-    if pm:
-        fields["pr"] = pm.group(1)
-    rm = re.search(r"into ([A-Za-z0-9/._-]+) main", line) or \
-        re.search(r"([A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+) main\b", line)
-    if rm:
-        fields["repo"] = rm.group(1)
-    um = UTC_RE.search(line)
-    if um:
-        fields["utc"] = um.group(0)
-    sm = re.search(r"session ([^,@ ]+)@", line)
-    if sm:
-        fields["session"] = sm.group(1)
-    tm = re.search(r"→ ([0-9a-f]{7,40})\b", line) or re.search(r" main ([0-9a-f]{7,40})\b", line)
-    if tm:
-        fields["tip"] = tm.group(1)
-    return fields
-
-
-# ======================================================== the records built
-
-TABLE_COLUMNS = {
-    "source_files": ["kind", "lane", "ls_order", "blob_sha", "line_count", "unreadable_count"],
-    "lanes": ["lane", "aliases", "home", "workstation", "started_utc", "handoff_path",
-              "state_phrase", "objects_cell", "session_ids", "last_session", "archived",
-              "owner", "row_file", "row_ordinal", "row_text"],
-    "log_lines": ["lane", "file", "ordinal", "verb", "session", "workstation", "utc", "object",
-                  "ref", "payload", "payload_fields", "free_text", "written_lane", "unreadable",
-                  "unreadable_why", "raw"],
-    "register_lines": ["kind", "lane", "repo", "pr", "tip", "utc", "session", "ordinal", "raw"],
-    "lane_aliases": ["old_name", "new_name", "utc", "ordinal", "raw"],
-    "transcript_pointers": ["lane", "kind", "transcript_id", "agent", "position", "workstation",
-                            "estate", "profile_family", "resolved_store", "project_key",
-                            "parent_uuid", "size_bytes", "sha256", "sealed_utc"],
-    # THE LEDGER HALF'S OWN TABLES, created EMPTY: T058 of the 001 feature
-    # writes them under `ledger:<Workstation>` (Amendment 14(g) act 4), and this
-    # indexer writes nothing into them.
-    "swap_states": ["lane", "parent_uuid", "generation", "state", "observed_utc"],
-    "job_summaries": ["lane", "job_id", "result_summary", "observed_utc"],
-    # opensoft/openRepoTools#161: each lane's #97 worktree inventory under
-    # `inventory:<Workstation>`, keyed by (source, lane, path) - the record id
-    # `<lane>:<path>`, `<lane>:<path><US><n>` for a second tree of one lane with
-    # the same path, and `<lane>:<US>unread` for a lane's unread marker (#173).
-    # Amendment 14(e) left inventories to "a later word's"; #161
-    # is that word's issue. Created by schema 1 with these columns before a row
-    # was written into it, so no store needed a new version for it. Written by
-    # `run_inventory` and by nothing that reads the register.
-    "worktrees": ["workstation", "lane", "owner", "path", "branch", "base", "lifecycle",
-                  "generation", "operation", "writer_live", "last_seen_utc", "last_commit",
-                  "dirty_count", "unpushed_count", "pr_number", "pr_state"],
-}
-
-INTEGER_COLUMNS = {"ls_order", "line_count", "unreadable_count", "archived", "row_ordinal",
-                   "ordinal", "unreadable", "position", "size_bytes", "generation",
-                   "writer_live", "dirty_count", "unpushed_count", "pr_number"}
-
-#: The tables `sync` and `reconcile` write for the REGISTER. The ledger's two
-#: are T058's, and `worktrees` is the inventory source's alone.
-REGISTER_TABLES = ("source_files", "lanes", "log_lines", "register_lines", "lane_aliases",
-                   "transcript_pointers")
-
-
-def digest_of(table: str, record: dict) -> str:
-    content = [table] + [record.get(col) for col in TABLE_COLUMNS[table]]
-    blob = json.dumps(content, ensure_ascii=False, separators=(",", ":"), sort_keys=False)
-    return hashlib.sha256(blob.encode("utf-8")).hexdigest()
-
-
-def build_records(snap: dict) -> dict:
-    """Every record of the register half at one commit, WITHOUT the owner
-    column: the owner is `managed-projection`'s answer, asked separately."""
-    out = {table: {} for table in REGISTER_TABLES}
-
-    def put(table: str, record_id: str, record: dict) -> None:
-        out[table][record_id] = record
-
-    # ---- the files themselves
-    for path, kind in ((REGISTER_PATH, "register"), (ALIASES_PATH, "aliases"),
-                       (ARCHIVE_PATH, "archive")):
-        text = snap.get(kind)
-        if text is None:
-            continue
-        put("source_files", path, {"kind": kind, "lane": None, "ls_order": None,
-                                   "blob_sha": snap["blobs"].get(path),
-                                   "line_count": len(text.split("\n")),
-                                   "unreadable_count": None})
-
-    # ---- the logs, every line, the unreadable ones kept (7(b))
-    facts: dict = {}
-    first_log_of: dict = {}
-    for path, text, obj, order in snap["logs"]:
-        records, _warnings = parse_log(path, text)
-        lane = file_lane(path)
-        first_log_of.setdefault(lane.lower(), lane)
-        unreadable = 0
-        for rec in records:
-            rec_id = f"{rec['lane']}:{rec['ordinal']}"
-            # TWO FILES WHOSE NAMES DIFFER ONLY BY CASE are two logs for one
-            # lane - Amendment 15(d)'s hand merge - and each keeps its lines
-            # under its own spelling, so neither file's lines replace the other's.
-            if rec_id in out["log_lines"]:
-                rec_id = f"{rec['file']}:{rec['ordinal']}"
-            if rec["unreadable"]:
-                unreadable += 1
-                row = {col: None for col in TABLE_COLUMNS["log_lines"]}
-                row.update(lane=rec["lane"], file=rec["file"], ordinal=rec["ordinal"],
-                           unreadable=1, unreadable_why=rec["unreadable_why"], raw=rec["raw"])
-            else:
-                row = {col: rec.get(col) for col in TABLE_COLUMNS["log_lines"]}
-                row["payload_fields"] = json.dumps(payload_fields(rec["payload"]),
-                                                   ensure_ascii=False, sort_keys=False)
-            put("log_lines", rec_id, row)
-            if rec["unreadable"]:
-                continue
-            f = facts.setdefault(lane.lower(), {"home": None, "sid": None, "paused": []})
-            fork = rec["payload"].startswith("fork ")
-            if rec["verb"] in ("STARTED", "RESUMED") and not fork:
-                hm = re.search(r"home [^ ;]+", rec["payload"])
-                if hm:
-                    value = hm.group(0)[5:]
-                    if value != "unknown":
-                        f["home"] = value
-            if rec["verb"] in ("PAUSED", "RESUMED") and UUID_FULL_RE.match(rec["session"] or ""):
-                f["sid"] = rec["session"].lower()
-            if rec["verb"] == "PAUSED":
-                pf = payload_fields(rec["payload"])
-                if "transcript" in pf:
-                    f["paused"].append((rec["file"], rec["ordinal"], pf.get("transcript"),
-                                        pf.get("agent")))
-        put("source_files", path, {"kind": "log", "lane": lane, "ls_order": order,
-                                   "blob_sha": obj, "line_count": len(text.split("\n")),
-                                   "unreadable_count": unreadable})
-
-    # ---- the register: its rows and its Rule 6 / Amendment 10 lines
-    rows = []
-    for ordinal, line in enumerate(snap["register"].split("\n"), 1):
-        name = row_name(line)
-        if name is not None:
-            if name != "":
-                rows.append((REGISTER_PATH, ordinal, name, line, 0))
-            continue
-        fields = parse_register_line(line)
-        if fields is not None:
-            fields["ordinal"] = ordinal
-            fields["raw"] = line
-            put("register_lines", str(ordinal), fields)
-    if snap.get("archive") is not None:
-        for ordinal, line in enumerate(snap["archive"].split("\n"), 1):
-            name = row_name(line)
-            if name:
-                rows.append((ARCHIVE_PATH, ordinal, name, line, 1))
-
-    # ---- Amendment 16(e)'s alias table, every line kept
-    alias_map: dict = {}
-    if snap.get("aliases") is not None:
-        for ordinal, line in enumerate(snap["aliases"].split("\n"), 1):
-            if line.strip() == "":
-                continue
-            parts = line.split("\t")
-            old = _trim(parts[0]) if parts else ""
-            new = _trim(parts[1]) if len(parts) > 1 else ""
-            when = _trim(parts[2]) if len(parts) > 2 else ""
-            comment = bool(re.match(r"^[ \t]*#", line))
-            put("lane_aliases", str(ordinal), {
-                "old_name": None if comment else (old or None),
-                "new_name": None if comment else (new or None),
-                "utc": None if comment else (when or None), "ordinal": ordinal, "raw": line})
-            if not comment and old and new:
-                alias_map[old.lower()] = (old, new, ordinal)
-
-    def resolve(name: str) -> str:
-        seen = set()
-        cur = name
-        while cur.lower() in alias_map and cur.lower() not in seen:
-            seen.add(cur.lower())
-            cur = alias_map[cur.lower()][1]
-        return cur
-
-    aliases_of: dict = {}
-    for _key, (old, _new, ordinal) in sorted(alias_map.items(), key=lambda kv: kv[1][2]):
-        aliases_of.setdefault(resolve(old).lower(), []).append(old)
-
-    # ---- one record per lane: every row, then every log with no row
-    used_lower: set = set()
-    for row_file, ordinal, name, line, archived in rows:
-        rec_id = name
-        if rec_id in out["lanes"]:
-            rec_id = f"{name}~{'archive' if archived else 'register'}:{ordinal}"
-        parts = line.split("|")
-        session_cell = parts[2] if len(parts) > 2 else ""
-        ids = UUID_RE.findall(session_cell.lower())
-        f = facts.get(name.lower(), {})
-        state = cell_state(line)
-        put("lanes", rec_id, {
-            "lane": name,
-            "aliases": json.dumps(aliases_of.get(name.lower(), []), ensure_ascii=False),
-            "home": f.get("home"),
-            "workstation": _trim(parts[3]) if len(parts) > 3 else None,
-            "started_utc": _trim(parts[4]) if len(parts) > 4 else None,
-            "objects_cell": _trim(parts[5]) if len(parts) > 5 else None,
-            "handoff_path": _trim(parts[6]) if len(parts) > 6 else None,
-            "state_phrase": _trim(state) if state else None,
-            "session_ids": json.dumps(ids),
-            "last_session": ids[-1] if ids else f.get("sid"),
-            "archived": archived, "owner": None,
-            "row_file": row_file, "row_ordinal": ordinal, "row_text": line})
-        used_lower.add(name.lower())
-        cell_ids = ids
-        for position, tid in enumerate(cell_ids, 1):
-            put("transcript_pointers", f"{rec_id}:cell:{position}", {
-                "lane": name, "kind": "session-cell", "transcript_id": tid, "agent": None,
-                "position": position})
-    for path, _text, _obj, _order in snap["logs"]:
-        lane = file_lane(path)
-        key = lane.lower()
-        if key in used_lower:
-            continue
-        used_lower.add(key)
-        f = facts.get(key, {})
-        put("lanes", lane, {
-            "lane": lane,
-            "aliases": json.dumps(aliases_of.get(key, []), ensure_ascii=False),
-            "home": f.get("home"), "workstation": None, "started_utc": None,
-            "objects_cell": None, "handoff_path": None, "state_phrase": None,
-            "session_ids": json.dumps([]), "last_session": f.get("sid"),
-            "archived": 0, "owner": None, "row_file": None, "row_ordinal": None,
-            "row_text": None})
-    for key, f in facts.items():
-        lane = first_log_of.get(key, key)
-        for path, ordinal, tid, agent in f["paused"]:
-            # KEYED AS `log_lines` IS (Copilot round 1 on #164): two logs whose
-            # names differ only by case are two files, and a PAUSED at the same
-            # line of each is two pointers, never one written over the other.
-            rec_id = f"{lane}:log:{ordinal}"
-            if rec_id in out["transcript_pointers"]:
-                rec_id = f"{path}:log:{ordinal}"
-            put("transcript_pointers", rec_id, {
-                "lane": lane, "kind": "paused", "transcript_id": tid, "agent": agent,
-                "position": ordinal})
-    for table in ("transcript_pointers",):
-        for record in out[table].values():
-            for col in TABLE_COLUMNS[table]:
-                record.setdefault(col, None)
-    return out
-
-
-# ================================================== the owner column's reader
-
-def managed_projection(lane: str) -> str:
-    """`legacy`, `managed <owner>` or `unknown`, AND NOTHING ELSE DECIDES IT.
-
-    #97's own reader answers: `lanes-edit.sh managed-projection <lane>` exits 0
-    with the owner, 8 for a legacy lane, anything else for UNKNOWN. This file
-    carries no parser of the marker, so a malformed one can never be read here
-    as `legacy` (Amendment 14(e)); a reader that could not be run at all is
-    UNKNOWN for the same reason."""
-    helper = lanes_edit_path()
-    if not helper:
-        return "unknown"
-    try:
-        proc = subprocess.run([helper, "managed-projection", lane], capture_output=True,
-                              text=True, check=False, env=helper_env(),
-                              stdin=subprocess.DEVNULL, timeout=120)
-    except (OSError, subprocess.TimeoutExpired):
-        return "unknown"
-    if proc.returncode == 0 and proc.stdout.strip():
-        return f"managed {proc.stdout.strip().splitlines()[0]}"
-    if proc.returncode == 8:
-        return "legacy"
-    return "unknown"
-
-
-def fill_owners(records: dict, stored_lanes: dict | None) -> int:
-    """Ask `managed-projection` for every lane whose row text is new or changed
-    (all of them where `stored_lanes` is None, which is `reconcile`), and carry
-    the stored answer over for a row that has not moved. An `unknown` is never
-    carried: it may be a read that failed, and asking again is how it clears.
-    Returns how many lanes were asked."""
-    ask = []
-    for rec_id, rec in records["lanes"].items():
-        old = (stored_lanes or {}).get(rec_id)
-        if stored_lanes is not None and old is not None and old.get("row_text") == rec["row_text"] \
-                and old.get("lane") == rec["lane"] and old.get("owner") \
-                and old.get("owner") != "unknown":
-            rec["owner"] = old["owner"]
-        else:
-            ask.append(rec_id)
-    if ask:
-        workers = max(1, min(8, len(ask)))
-        with ThreadPoolExecutor(max_workers=workers) as pool:
-            answers = list(pool.map(lambda rid: managed_projection(records["lanes"][rid]["lane"]),
-                                    ask))
-        for rec_id, owner in zip(ask, answers):
-            records["lanes"][rec_id]["owner"] = owner
-    return len(ask)
-
-
-# =============================================================== the stores
-
-def ddl(dialect: str, schema: str) -> list[str]:
-    q = (lambda name: f'"{schema}".{name}') if dialect == "postgres" else (lambda name: name)
-    big = "BIGINT" if dialect == "postgres" else "INTEGER"
-    stmts = [
-        f"CREATE TABLE IF NOT EXISTS {q('schema_version')} "
-        f"(version INTEGER NOT NULL, applied_utc TEXT NOT NULL)",
-        f"CREATE TABLE IF NOT EXISTS {q('provenance')} (source TEXT NOT NULL PRIMARY KEY, "
-        f"commit_sha TEXT, generation {big}, indexed_utc TEXT NOT NULL, "
-        f"schema_version INTEGER NOT NULL)",
-    ]
-    for table, cols in TABLE_COLUMNS.items():
-        defs = ["source TEXT NOT NULL", "record_id TEXT NOT NULL"]
-        for col in cols:
-            defs.append(f"{col} {big if col in INTEGER_COLUMNS else 'TEXT'}")
-        defs += ["digest TEXT NOT NULL", "provenance TEXT", "indexed_utc TEXT NOT NULL",
-                 "schema_version INTEGER NOT NULL", "PRIMARY KEY (source, record_id)"]
-        stmts.append(f"CREATE TABLE IF NOT EXISTS {q(table)} ({', '.join(defs)})")
-    # HOLDS ARE COMPUTED, NEVER STORED (14(e)), and computed AS `holders_of`
-    # COMPUTES THEM (Copilot round 2 on #164), which is `who`'s answer:
-    #   * a lane's state on an object is its own LAST line on it - the lane
-    #     compared case-insensitively (Amendment 15), so two logs one case
-    #     apart are one lane - and "last" is the FILE-ORDERED position
-    #     (file, then line; PER_LANE_AWK's `file "\034" %09d line`), never
-    #     the UTC (R14);
-    #   * it holds while that verb is open, UNLESS another lane's own last line
-    #     on the object is a TAKEOVER (`superseded_by`, R18, #30).
-    # The file comparison is BYTE order, as awk's string comparison is: SQLite's
-    # default BINARY collation, and Postgres's "C".
-    coll = ' COLLATE "C"' if dialect == "postgres" else ""
-    ll = q("log_lines")
-    view = (
-        f"WITH ev AS (SELECT source, lane, lower(lane) AS lk, object, verb, utc, session, "
-        f"file, ordinal FROM {ll} WHERE unreadable = 0 AND object IS NOT NULL "
-        f"AND object NOT LIKE 'lane:%'), "
-        f"last AS (SELECT e.* FROM ev e WHERE NOT EXISTS (SELECT 1 FROM ev m "
-        f"WHERE m.source = e.source AND m.object = e.object AND m.lk = e.lk "
-        f"AND (m.file{coll} > e.file{coll} OR (m.file = e.file AND m.ordinal > e.ordinal)))) "
-        f"SELECT h.source, h.lane, h.object, h.verb, h.utc, h.session, h.file, h.ordinal "
-        f"FROM last h WHERE h.verb IN ({', '.join(repr(v) for v in OPEN_VERBS)}) "
-        f"AND NOT EXISTS (SELECT 1 FROM last t WHERE t.source = h.source "
-        f"AND t.object = h.object AND t.lk <> h.lk AND t.verb = 'TAKEOVER')")
-    stmts.append(f"CREATE INDEX IF NOT EXISTS log_lines_by_object ON {ll} (source, object)")
-    if dialect == "postgres":
-        stmts.append(f"CREATE OR REPLACE VIEW {q('holds')} AS {view}")
-    else:
-        stmts.append(f"CREATE VIEW IF NOT EXISTS holds AS {view}")
-    stmts.append(
-        f"INSERT INTO {q('schema_version')} (version, applied_utc) SELECT {SCHEMA_VERSION}, "
-        f"'{utc_now()}' WHERE NOT EXISTS (SELECT 1 FROM {q('schema_version')})")
-    return stmts
-
-
-class SqliteStore:
-    dialect = "sqlite"
-
-    def __init__(self, cfg: dict):
-        self.path = cfg["sqlite"]
-        self.label = "sqlite"
-        self.where = self.path
-        self.conn = None
-
-    def open_read(self):
-        import sqlite3
-        if not os.path.exists(self.path):
-            raise StoreUnusable("missing", f"{self.path} does not exist")
-        try:
-            self.conn = sqlite3.connect(f"file:{self.path}?mode=ro", uri=True, timeout=10)
-            self.conn.execute("SELECT 1 FROM sqlite_master LIMIT 1").fetchall()
-        except sqlite3.Error as exc:
-            raise StoreUnusable("unreachable", f"{self.path}: {exc}")
-        self._check_schema(writing=False)
-
-    def open_write(self):
-        import sqlite3
-        os.makedirs(os.path.dirname(self.path), mode=0o700, exist_ok=True)
-        try:
-            self.conn = sqlite3.connect(self.path, timeout=30, isolation_level=None)
-            # EVERY WRITE-OPEN, NOT ONLY THE FIRST (Copilot round 2 on #164): a
-            # store whose mode drifted to 0644 is made private again before
-            # another row goes into it, or nothing more is written.
-            try:
-                os.chmod(self.path, 0o600)
-            except OSError as exc:
-                raise StoreUnusable("unreachable", f"{self.path} cannot be made 0600 "
-                                    f"({exc.strerror or exc}); nothing written")
-            have = {r[0] for r in self.conn.execute(
-                "SELECT name FROM sqlite_master WHERE type IN ('table','view')")}
-            if "schema_version" in have:
-                self._check_schema(writing=True)
-            self.conn.execute("BEGIN IMMEDIATE")
-            for stmt in ddl("sqlite", ""):
-                self.conn.execute(stmt)
-            self.conn.execute("COMMIT")
-        except sqlite3.Error as exc:
-            raise StoreUnusable("unreachable", f"{self.path}: {exc}")
-        self._check_schema(writing=True)
-
-    def _check_schema(self, writing: bool):
-        import sqlite3
-        try:
-            rows = self.conn.execute("SELECT version FROM schema_version").fetchall()
-        except sqlite3.Error:
-            if writing:
-                return
-            raise StoreUnusable("wiped", f"{self.path} carries no schema_version table")
-        versions = {r[0] for r in rows}
-        if not versions:
-            if writing:
-                return
-            raise StoreUnusable("wiped", f"{self.path} carries no schema_version row")
-        if versions != {SCHEMA_VERSION}:
-            raise StoreUnusable("unknown-schema",
-                                f"schema {sorted(versions)} in {self.path}; this "
-                                f"{PROG} knows {SCHEMA_VERSION}")
-
-    def provenance(self, source: str) -> dict | None:
-        import sqlite3
-        try:
-            row = self.conn.execute(
-                "SELECT commit_sha, generation, indexed_utc, schema_version FROM provenance "
-                "WHERE source = ?", (source,)).fetchone()
-        except sqlite3.Error as exc:
-            raise StoreUnusable("wiped", f"{self.path}: {exc}")
-        if row is None:
-            return None
-        return {"commit_sha": row[0], "generation": row[1], "indexed_utc": row[2],
-                "schema_version": row[3]}
-
-    def all_provenance(self) -> list:
-        import sqlite3
-        try:
-            return [{"source": r[0], "commit_sha": r[1], "generation": r[2], "indexed_utc": r[3],
-                     "schema_version": r[4]} for r in self.conn.execute(
-                         "SELECT source, commit_sha, generation, indexed_utc, schema_version "
-                         "FROM provenance ORDER BY source")]
-        except sqlite3.Error as exc:
-            raise StoreUnusable("wiped", f"{self.path}: {exc}")
-
-    def rows(self, table: str, source: str, columns: list[str]) -> list:
-        # A TABLE THAT CANNOT BE READ IS A STORE THAT CANNOT ANSWER, said as the
-        # provenance's reads say it (opensoft/openRepoTools#173, Copilot's
-        # fourth review of #171): a `worktrees` table dropped or damaged under
-        # valid provenance was a traceback, before `status` reached its
-        # `rows: unread` line and before `export` could write its `why`.
-        import sqlite3
-        cols = ", ".join(["record_id"] + columns)
-        try:
-            return [dict(zip(["record_id"] + columns, r)) for r in self.conn.execute(
-                f"SELECT {cols} FROM {table} WHERE source = ?", (source,))]
-        except sqlite3.Error as exc:
-            raise StoreUnusable("wiped", f"{self.path}: {exc}")
-
-    def read_image(self, source: str, reads: list) -> tuple:
-        """`provenance(source)`, then `rows(table, source, columns)` for each
-        `(table, columns)` of `reads`, as ONE READ SNAPSHOT (opensoft/openRepoTools#166
-        item 1). Each statement was its own snapshot, so a sync committing
-        between two of them made an image of two commits under a `meta` naming
-        the first. One read transaction holds the SHARED lock in the rollback
-        journal - a writer's commit waits the fraction of a second the export
-        takes - and in WAL mode it is a snapshot."""
-        import sqlite3
-        try:
-            self.conn.execute("BEGIN")
-        except sqlite3.Error as exc:
-            raise StoreUnusable("unreachable", f"{self.path}: {exc}")
-        try:
-            prov = self.provenance(source)
-            tables = [self.rows(table, source, columns) for table, columns in reads]
-        finally:
-            # A read transaction ends however its reads did; nothing was written.
-            try:
-                self.conn.execute("COMMIT")
-            except sqlite3.Error:
-                pass
-        return prov, tables
-
-    def apply(self, source: str, old: dict | None, new_sha: str, upserts: dict,
-              deletes: dict, generation: int | None = None) -> None:
-        """The rows and the provenance, ONE transaction, the compare-and-swap
-        first. `new_sha` is the register's commit, or the inventory's
-        fingerprint of its whole table (#161), and `generation` the inventory's
-        sync count; a record carrying `_provenance` is stamped with that rather
-        than with `new_sha` - the generation its tree's own record was filed
-        under."""
-        import sqlite3
-        now = utc_now()
-        try:
-            self.conn.execute("BEGIN IMMEDIATE")
-            cur = self.conn.execute("SELECT commit_sha FROM provenance WHERE source = ?",
-                                    (source,)).fetchone()
-            want = old["commit_sha"] if old else None
-            if (cur[0] if cur else None) != want or (cur is None) != (old is None):
-                self.conn.execute("ROLLBACK")
-                raise CasLost(f"the provenance of {source} moved under this sync "
-                              f"(it read {str(want)[:12]}, the store now holds "
-                              f"{str(cur[0] if cur else None)[:12]}); nothing was written")
-            if cur is None:
-                self.conn.execute(
-                    "INSERT INTO provenance (source, commit_sha, generation, indexed_utc, "
-                    "schema_version) VALUES (?, ?, ?, ?, ?)",
-                    (source, new_sha, generation, now, SCHEMA_VERSION))
-            else:
-                self.conn.execute(
-                    "UPDATE provenance SET commit_sha = ?, generation = ?, indexed_utc = ?, "
-                    "schema_version = ? WHERE source = ?",
-                    (new_sha, generation, now, SCHEMA_VERSION, source))
-            for table, ids in deletes.items():
-                for rec_id in ids:
-                    self.conn.execute(f"DELETE FROM {table} WHERE source = ? AND record_id = ?",
-                                      (source, rec_id))
-            for table, recs in upserts.items():
-                cols = TABLE_COLUMNS[table]
-                allc = ["source", "record_id"] + cols + ["digest", "provenance", "indexed_utc",
-                                                         "schema_version"]
-                sets = ", ".join(f"{c} = excluded.{c}" for c in allc[2:])
-                sql = (f"INSERT INTO {table} ({', '.join(allc)}) VALUES "
-                       f"({', '.join('?' for _ in allc)}) ON CONFLICT (source, record_id) "
-                       f"DO UPDATE SET {sets}")
-                self.conn.executemany(sql, [
-                    [source, rec_id] + [rec.get(c) for c in cols] +
-                    [rec["digest"], rec.get("_provenance", new_sha), now, SCHEMA_VERSION]
-                    for rec_id, rec in recs.items()])
-            self.conn.execute("COMMIT")
-        except sqlite3.Error as exc:
-            try:
-                self.conn.execute("ROLLBACK")
-            except sqlite3.Error:
-                pass
-            raise StoreUnusable("unreachable", f"{self.path}: {exc}")
-
-
-def _pg_quote(value) -> str:
-    if value is None:
-        return "NULL"
-    if isinstance(value, int):
-        return str(value)
-    return "'" + str(value).replace("'", "''") + "'"
-
-
-def _pg_unescape(field: str):
-    """One field of `COPY ... TO STDOUT` in TEXT format: `\\N` is NULL and a
-    backslash escapes the rest, exactly as the server wrote it."""
-    if field == "\\N":
-        return None
-    if "\\" not in field:
-        return field
-    out, i, n = [], 0, len(field)
-    simple = {"b": "\b", "f": "\f", "n": "\n", "r": "\r", "t": "\t", "v": "\v", "\\": "\\"}
-    while i < n:
-        ch = field[i]
-        if ch != "\\" or i + 1 >= n:
-            out.append(ch)
-            i += 1
-            continue
-        nxt = field[i + 1]
-        if nxt in simple:
-            out.append(simple[nxt])
-            i += 2
-        elif nxt in "01234567":
-            j = i + 1
-            while j < n and j < i + 4 and field[j] in "01234567":
-                j += 1
-            out.append(chr(int(field[i + 1:j], 8)))
-            i = j
-        elif nxt == "x":
-            j = i + 2
-            while j < n and j < i + 4 and field[j] in "0123456789abcdefABCDEF":
-                j += 1
-            out.append(chr(int(field[i + 2:j], 16)) if j > i + 2 else "x")
-            i = j
-        else:
-            out.append(nxt)
-            i += 2
-    return "".join(out)
-
-
-class PostgresStore:
-    """QA Postgres, reached ONLY through `psql` and ONLY where `url=` is
-    configured. Nothing here imports a driver: `psql` is libpq's own client,
-    and the password it needs is in the 0600 file `PGPASSFILE` names - never
-    in this process's arguments and never in an environment it hands on."""
-
-    dialect = "postgres"
-
-    def __init__(self, cfg: dict, role: str):
-        self.schema = cfg["schema"]
-        if role == "reader":
-            # NEVER THE WRITER'S CREDENTIAL FOR A READ (Copilot round 1 on #164).
-            # The writer is the indexer's and no session's (14(c)), and `export`
-            # is run by a session typing `--index`: with no `reader_url=` the
-            # read is refused, and the read flags answer from the sources.
-            if not cfg.get("reader_url"):
-                raise Refusal(
-                    "the configuration names a Postgres `url=` and no `reader_url=`: the "
-                    "reads (`status`, `--index`) connect only as the SELECT-only reader, "
-                    "never with the writer's credential (Amendment 14(c))")
-            self.url, self.passfile = cfg["reader_url"], cfg.get("reader_passfile") or cfg["passfile"]
-        else:
-            self.url, self.passfile = cfg["url"], cfg["passfile"]
-        self.label = "postgres"
-        self.where = re.sub(r"^[A-Za-z][A-Za-z0-9+.-]*://", "", self.url).split("?", 1)[0]
-        self.psql = shutil.which("psql") or ""
-
-    def _env(self) -> dict:
-        # THE CONFIGURED PASSWORD FILE OR NONE AT ALL (14(c); Copilot on #164):
-        # an inherited `PGPASSWORD` or `PGPASSFILE` is dropped, and with no
-        # `passfile=` libpq is handed an EMPTY 0600 file of this command's own -
-        # never left to find `~/.pgpass` or a file some other environment named.
-        env = {k: v for k, v in os.environ.items() if k not in ("PGPASSWORD", "PGPASSFILE")}
-        env["PGPASSFILE"] = self.passfile or _no_password_file()
-        env.setdefault("PGCONNECT_TIMEOUT", "5")
-        env["PGAPPNAME"] = PROG
-        return env
-
-    def _run(self, script: str) -> str:
-        if not self.psql:
-            raise StoreUnusable("unreachable", "`url=` is configured and there is no `psql` on PATH")
-        try:
-            proc = subprocess.run(
-                [self.psql, "--no-psqlrc", "-X", "-q", "-v", "ON_ERROR_STOP=1", "-d", self.url],
-                input=script, capture_output=True, text=True, check=False, env=self._env(),
-                timeout=300)
-        except subprocess.TimeoutExpired:
-            raise StoreUnusable("unreachable", "psql did not answer within 300 s")
-        except OSError as exc:
-            raise StoreUnusable("unreachable", f"psql could not be run: {exc}")
-        if proc.returncode != 0:
-            err = (proc.stderr.strip().splitlines() or [f"psql exited {proc.returncode}"])
-            if "lanes-index: provenance moved" in proc.stderr:
-                raise CasLost(err[-1])
-            if proc.returncode == 2:
-                raise StoreUnusable("unreachable", err[0])
-            raise StoreUnusable("unreachable", err[-1])
-        return proc.stdout
-
-    def _query_many(self, queries: list[str], snapshot: bool = False) -> list[list[list]]:
-        """Several SELECTs in ONE connection, each answered as TEXT-format COPY
-        rows; a marker line no COPY row can be (one field, a control
-        character) separates them. With `snapshot`, in ONE read-only
-        REPEATABLE READ transaction: every SELECT reads the same snapshot."""
-        marker = "\x1eLANES-INDEX-NEXT"
-        parts = [f"SET search_path TO \"{self.schema}\";"]
-        if snapshot:
-            parts.append("BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY;")
-        for query in queries:
-            parts.append(f"COPY ({query}) TO STDOUT;")
-            parts.append("\\echo '\\036LANES-INDEX-NEXT'")
-        if snapshot:
-            parts.append("COMMIT;")
-        out = self._run("\n".join(parts) + "\n")
-        results, current = [], []
-        for line in out.split("\n"):
-            if line == marker:
-                results.append(current)
-                current = []
-                continue
-            if line == "":
-                continue
-            current.append([_pg_unescape(f) for f in line.split("\t")])
-        return results
-
-    def open_read(self):
-        try:
-            res = self._query_many([
-                f"SELECT version FROM \"{self.schema}\".schema_version"])
-        except StoreUnusable as exc:
-            if "does not exist" in exc.detail:
-                raise StoreUnusable("wiped", exc.detail)
-            raise
-        versions = {int(r[0]) for r in res[0]} if res else set()
-        if not versions:
-            raise StoreUnusable("wiped", f"schema {self.schema} carries no schema_version row")
-        if versions != {SCHEMA_VERSION}:
-            raise StoreUnusable("unknown-schema", f"schema {sorted(versions)} in {self.schema}; "
-                                f"this {PROG} knows {SCHEMA_VERSION}")
-
-    def open_write(self):
-        # THE VERSION FIRST (Copilot round 2 on #164): the DDL includes a
-        # `CREATE OR REPLACE VIEW`, so running it against another schema's
-        # store would rewrite that store before `open_read` called it
-        # `unknown-schema`. Only an ABSENT schema (`wiped`) is bootstrapped.
-        try:
-            self.open_read()
-            return
-        except StoreUnusable as exc:
-            if exc.kind != "wiped":
-                raise
-        script = ["SET standard_conforming_strings = on;", "BEGIN;"]
-        script += [s + ";" for s in ddl("postgres", self.schema)]
-        script.append("COMMIT;")
-        self._run("\n".join(script) + "\n")
-        self.open_read()
-
-    def provenance(self, source: str) -> dict | None:
-        res = self._query_many([self._provenance_query(source)])
-        return self._provenance_of(res[0] if res else [])
-
-    def all_provenance(self) -> list:
-        res = self._query_many([
-            "SELECT source, commit_sha, generation, indexed_utc, schema_version "
-            "FROM provenance ORDER BY source"])
-        return [{"source": r[0], "commit_sha": r[1], "generation": r[2], "indexed_utc": r[3],
-                 "schema_version": r[4]} for r in (res[0] if res else [])]
-
-    def rows(self, table: str, source: str, columns: list[str]) -> list:
-        res = self._query_many([self._rows_query(table, source, columns)])
-        return self._rows_of(res[0] if res else [], columns)
-
-    @staticmethod
-    def _provenance_query(source: str) -> str:
-        return (f"SELECT commit_sha, generation, indexed_utc, schema_version FROM provenance "
-                f"WHERE source = {_pg_quote(source)}")
-
-    @staticmethod
-    def _provenance_of(answer: list) -> dict | None:
-        if not answer:
-            return None
-        r = answer[0]
-        return {"commit_sha": r[0], "generation": r[1], "indexed_utc": r[2],
-                "schema_version": r[3]}
-
-    @staticmethod
-    def _rows_query(table: str, source: str, columns: list[str]) -> str:
-        return (f"SELECT {', '.join(['record_id'] + columns)} FROM {table} "
-                f"WHERE source = {_pg_quote(source)}")
-
-    @staticmethod
-    def _rows_of(answer: list, columns: list[str]) -> list:
-        out = []
-        for r in answer:
-            rec = dict(zip(["record_id"] + columns, r))
-            for col in columns:
-                if col in INTEGER_COLUMNS and rec[col] is not None:
-                    rec[col] = int(rec[col])
-            out.append(rec)
-        return out
-
-    def read_image(self, source: str, reads: list) -> tuple:
-        """`SqliteStore.read_image`'s answer, ONE `psql` session and one
-        REPEATABLE READ READ ONLY transaction (opensoft/openRepoTools#166 item 1):
-        each `rows()` was a session of its own, and a snapshot of its own."""
-        res = self._query_many([self._provenance_query(source)] +
-                               [self._rows_query(table, source, columns)
-                                for table, columns in reads], snapshot=True)
-        if len(res) != len(reads) + 1:
-            raise StoreUnusable("unreachable", f"psql answered {len(res)} of the "
-                                f"{len(reads) + 1} reads of one export")
-        return self._provenance_of(res[0]), [self._rows_of(answer, columns)
-                                             for answer, (_table, columns) in zip(res[1:], reads)]
-
-    def apply(self, source: str, old: dict | None, new_sha: str, upserts: dict,
-              deletes: dict, generation: int | None = None) -> None:
-        now = utc_now()
-        want = old["commit_sha"] if old else None
-        lines = ["SET standard_conforming_strings = on;", "BEGIN;",
-                 f"SET LOCAL search_path TO \"{self.schema}\";",
-                 # THE COMPARE-AND-SWAP, FIRST AND IN THE SAME TRANSACTION AS THE
-                 # ROWS: the UPDATE takes the provenance row's lock, so a second
-                 # writer reading the same old commit blocks here and then finds
-                 # it moved, and its whole transaction goes (Amendment 14(d)).
-                 "DO $lanes_index_cas$ DECLARE n integer; BEGIN",
-                 f"  INSERT INTO provenance (source, commit_sha, generation, indexed_utc, "
-                 f"schema_version) VALUES ({_pg_quote(source)}, NULL, NULL, {_pg_quote(now)}, "
-                 f"{SCHEMA_VERSION}) ON CONFLICT (source) DO NOTHING;",
-                 f"  UPDATE provenance SET commit_sha = {_pg_quote(new_sha)}, generation = "
-                 f"{_pg_quote(generation)}, indexed_utc = "
-                 f"{_pg_quote(now)}, schema_version = {SCHEMA_VERSION} WHERE source = "
-                 f"{_pg_quote(source)} AND commit_sha IS NOT DISTINCT FROM {_pg_quote(want)};",
-                 "  GET DIAGNOSTICS n = ROW_COUNT;",
-                 "  IF n <> 1 THEN RAISE EXCEPTION 'lanes-index: provenance moved under this "
-                 "sync; nothing was written'; END IF;",
-                 "END $lanes_index_cas$;"]
-        for table, ids in deletes.items():
-            for rec_id in ids:
-                lines.append(f"DELETE FROM {table} WHERE source = {_pg_quote(source)} AND "
-                             f"record_id = {_pg_quote(rec_id)};")
-        for table, recs in upserts.items():
-            cols = TABLE_COLUMNS[table]
-            allc = ["source", "record_id"] + cols + ["digest", "provenance", "indexed_utc",
-                                                     "schema_version"]
-            sets = ", ".join(f"{c} = EXCLUDED.{c}" for c in allc[2:])
-            for rec_id, rec in recs.items():
-                values = [source, rec_id] + [rec.get(c) for c in cols] + \
-                    [rec["digest"], rec.get("_provenance", new_sha), now, SCHEMA_VERSION]
-                lines.append(f"INSERT INTO {table} ({', '.join(allc)}) VALUES "
-                             f"({', '.join(_pg_quote(v) for v in values)}) ON CONFLICT "
-                             f"(source, record_id) DO UPDATE SET {sets};")
-        lines.append("COMMIT;")
-        self._run("\n".join(lines) + "\n")
-
-
-def _no_password_file() -> str:
-    """An empty 0600 file for libpq to read where no `passfile=` is configured
-    (a passwordless role: peer, trust or certificate authentication)."""
-    path = os.path.join(state_dir(), "lanes-index.nopass")
-    try:
-        os.makedirs(state_dir(), mode=0o700, exist_ok=True)
-        fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
-        os.close(fd)
-        os.chmod(path, 0o600)
-    except OSError as exc:
-        raise StoreUnusable("unreachable", f"{path} could not be made as the empty password "
-                            f"file ({exc.strerror or exc}); nothing was sent to Postgres")
-    return path
-
-
-def open_store(cfg: dict, role: str):
-    return SqliteStore(cfg) if cfg["store"] == "sqlite" else PostgresStore(cfg, role)
-
-
-# ============================================================ local status
-
-def _status_path() -> str:
-    return os.path.join(state_dir(), "lanes-index.status.json")
-
-
-def read_status() -> dict:
-    try:
-        with open(_status_path(), encoding="utf-8") as handle:
-            data = json.load(handle)
-        return data if isinstance(data, dict) else {}
-    except (OSError, ValueError):
-        return {}
-
-
-def write_status(source: str, **fields) -> None:
-    """This workstation's own record of its last attempt, which the store
-    cannot hold for an attempt that could not reach it."""
-    try:
-        os.makedirs(state_dir(), mode=0o700, exist_ok=True)
-        data = read_status()
-        entry = data.get(source, {})
-        entry.update(fields)
-        data[source] = entry
-        tmp = _status_path() + f".{os.getpid()}"
-        with open(tmp, "w", encoding="utf-8") as handle:
-            json.dump(data, handle, indent=1, sort_keys=True)
-        os.chmod(tmp, 0o600)
-        os.replace(tmp, _status_path())
-    except OSError:
-        pass
-
-
-class SyncLock:
-    """ONE SYNC AT A TIME PER WORKSTATION (14(d)). A second sync that finds the
-    lock held leaves a RERUN mark and returns at once - the holder syncs again
-    before it lets go - so a burst of writes is one or two syncs, never a
-    queue of them, and no nudge ever waits."""
-
-    def __init__(self):
-        self.path = os.path.join(state_dir(), "lanes-index.lock")
-        self.rerun = os.path.join(state_dir(), "lanes-index.rerun")
-        self.handle = None
-
-    def acquire(self, wait_seconds: float) -> bool:
-        try:
-            import fcntl
-        except ImportError:
-            return True
-        os.makedirs(state_dir(), mode=0o700, exist_ok=True)
-        self.handle = open(self.path, "a+")
-        try:
-            os.chmod(self.path, 0o600)
-        except OSError:
-            pass
-        deadline = time.monotonic() + wait_seconds
-        while True:
-            try:
-                fcntl.flock(self.handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
-                return True
-            except OSError:
-                if time.monotonic() >= deadline:
-                    self.handle.close()
-                    self.handle = None
-                    return False
-                time.sleep(0.2)
-
-    # ONE MARK PER SOURCE (opensoft/openRepoTools#161). The holder syncs again
-    # for every mark it finds, and a mark says WHICH source asked: a register
-    # sync holding the lock when an inventory write's nudge arrives syncs the
-    # inventory before it lets go, rather than the register a second time. The
-    # register's mark keeps the name it has always had.
-    KINDS = ("register", "inventory")
-
-    def rerun_path(self, kind: str = "register") -> str:
-        return self.rerun if kind == "register" else f"{self.rerun}-{kind}"
-
-    def mark_rerun(self, kind: str = "register") -> None:
-        try:
-            with open(self.rerun_path(kind), "w", encoding="utf-8") as handle:
-                handle.write(utc_now() + "\n")
-        except OSError:
-            pass
-
-    def take_rerun(self, kind: str = "register") -> bool:
-        try:
-            os.unlink(self.rerun_path(kind))
-            return True
-        except OSError:
-            return False
-
-    def take_reruns(self) -> list:
-        return [kind for kind in self.KINDS if self.take_rerun(kind)]
-
-    def has_rerun(self) -> bool:
-        return any(os.path.exists(self.rerun_path(kind)) for kind in self.KINDS)
-
-    def release(self) -> None:
-        if self.handle is not None:
-            self.handle.close()
-            self.handle = None
-
-
-# ================================================================ the acts
-
-def resolve_source(requested: str | None, root: str) -> str:
-    source = source_of(root)
-    if requested and requested != source:
-        if is_inventory(requested):
-            raise Refusal(f"{requested} is this workstation's worktree inventory, which "
-                          f"`sync`/`reconcile --source inventory` write and `export "
-                          f"--worktrees` reads; this is the register's path")
-        if requested.startswith("ledger:"):
-            raise Refusal(f"{requested} is the managed ledger's half, which T058 of the 001 "
-                          f"feature writes (Amendment 14(g) act 4); this indexer writes the "
-                          f"register half only")
-        raise Refusal(f"this workstation's register is {source}, not {requested}")
-    return source
-
-
-def diff_records(store, source: str, records: dict, verify_content: bool) -> tuple:
-    """The upserts and deletes that take the stored source to `records`.
-
-    `sync` compares DIGESTS: an upsert bearing the stored digest changes
-    nothing. `reconcile` recomputes each stored row's digest from its CONTENT,
-    so a row somebody changed by hand - which still carries its old digest - is
-    found and put right."""
-    upserts, deletes, kept = {}, {}, {}
-    for table in REGISTER_TABLES:
-        cols = TABLE_COLUMNS[table]
-        stored = {r["record_id"]: r for r in store.rows(table, source,
-                                                         cols + ["digest"])}
-        for rec in records[table].values():
-            rec["digest"] = digest_of(table, rec)
-        for rec_id, rec in records[table].items():
-            old = stored.get(rec_id)
-            if old is not None:
-                have = digest_of(table, old) if verify_content else old["digest"]
-                if have == rec["digest"] and (not verify_content or old["digest"] == rec["digest"]):
-                    kept[table] = kept.get(table, 0) + 1
-                    continue
-            upserts.setdefault(table, {})[rec_id] = rec
-        gone = [rec_id for rec_id in stored if rec_id not in records[table]]
-        if gone:
-            deletes[table] = gone
-    return upserts, deletes, kept
-
-
-def has_unknown_owner(store, source: str) -> bool:
-    return any(r["owner"] == "unknown" for r in store.rows("lanes", source, ["owner"]))
-
-
-def stored_lanes_of(store, source: str) -> dict:
-    return {r["record_id"]: r for r in store.rows("lanes", source,
-                                                   ["lane", "owner", "row_text"])}
-
-
-def run_index(mode: str, requested: str | None, dry_run: bool) -> int:
-    cfg = load_config()
-    root = workspace_root()
-    source = resolve_source(requested, root)
-    tip = tip_of(root)
-    store = open_store(cfg, "writer")
-    if dry_run:
-        try:
-            store.open_read()
-        except StoreUnusable as exc:
-            if exc.kind not in ("missing", "wiped"):
-                raise
-            store = None
-    else:
-        store.open_write()
-    old = store.provenance(source) if store is not None else None
-    label = f"{source} at register@{tip[:12]} ({cfg['store']})"
-    if old and old.get("commit_sha"):
-        prev = old["commit_sha"]
-        if not has_commit(root, prev):
-            say(f"{PROG} {mode}: the index holds register@{prev[:12]}, which this checkout has "
-                f"not fetched - another workstation is ahead of it; nothing written")
-            write_status(source, last_attempt_utc=utc_now(), last_result="behind (unknown commit)")
-            return 0
-        # NOT WHILE AN OWNER IS `unknown` (Codex on #164): an `unknown` may be a
-        # read that failed, and asking again is how it clears - so a sync at
-        # the same commit goes the long way round, asks only those, and writes
-        # nothing where nothing has changed.
-        if prev == tip and mode == "sync" and not has_unknown_owner(store, source):
-            say(f"{PROG} sync: {label} - the index is at the tip; nothing to write")
-            write_status(source, last_attempt_utc=utc_now(), last_sync_utc=utc_now(),
-                         last_result="current", last_error="")
-            return 0
-        if not is_ancestor(root, prev, tip):
-            behind = is_ancestor(root, tip, prev)
-            why = ("this checkout is BEHIND the index" if behind else
-                   "the two have diverged - a register history rewritten under the index is "
-                   "rebuilt by wiping the index and reconciling")
-            say(f"{PROG} {mode}: register@{tip[:12]} does not descend from the indexed "
-                f"register@{prev[:12]}: {why}. The provenance only moves forward "
-                f"(Amendment 14(d)); nothing written")
-            write_status(source, last_attempt_utc=utc_now(),
-                         last_result="not a descendant; nothing written")
-            return 0 if behind else 1
-    snap = read_snapshot(root, tip)
-    records = build_records(snap)
-    if store is None:
-        fill_owners(records, None)
-        upserts = {t: dict(r) for t, r in records.items() if r}
-        for table, recs in upserts.items():
-            for rec in recs.values():
-                rec["digest"] = digest_of(table, rec)
-        deletes, kept = {}, {}
-    else:
-        stored = None if mode == "reconcile" else stored_lanes_of(store, source)
-        fill_owners(records, stored)
-        upserts, deletes, kept = diff_records(store, source, records,
-                                              verify_content=(mode == "reconcile"))
-    # THE OWNERS ARE ASKED OF `origin/<branch>` AS IT STANDS, and the rows were
-    # read at ONE commit (Copilot round 1 on #164): `managed-projection` reads
-    # the ref, not a sha. So the ref is asked again once every owner is in, and
-    # a ref that moved meanwhile writes NOTHING - not rows of one commit beside
-    # owners of another - and the caller starts over at the new tip.
-    if not dry_run and tip_of(root) != tip:
-        raise SourceMoved(f"origin/{branch()} moved from {tip[:12]} while the owners were "
-                          f"read; nothing was written from that read")
-    n_up = sum(len(v) for v in upserts.values())
-    n_del = sum(len(v) for v in deletes.values())
-    if mode == "reconcile":
-        say(f"{PROG} reconcile: {label}{' - DRY RUN' if dry_run else ''}")
-        for table in REGISTER_TABLES:
-            say(f"  {table:<20} {kept.get(table, 0):>6} kept  {len(upserts.get(table, {})):>6} "
-                f"upserted  {len(deletes.get(table, [])):>6} removed")
-    if dry_run:
-        say(f"  total: {n_up} to upsert, {n_del} to remove - nothing written (--dry-run)")
-        return 0
-    if old and old.get("commit_sha") == tip and not upserts and not deletes:
-        if mode == "sync":
-            say(f"{PROG} sync: {label} - the index is at the tip; nothing to write")
-        else:
-            say("  total: nothing differs; nothing written")
-        write_status(source, last_attempt_utc=utc_now(), last_sync_utc=utc_now(),
-                     last_result="current", last_error="")
-        return 0
-    store.apply(source, old, tip, upserts, deletes)
-    write_status(source, last_attempt_utc=utc_now(), last_sync_utc=utc_now(),
-                 last_result=f"{n_up} upserted, {n_del} removed at {tip[:12]}", last_error="")
-    if mode == "sync":
-        say(f"{PROG} sync: {label} - {n_up} upserted, {n_del} removed")
-    else:
-        say(f"  total: {n_up} upserted, {n_del} removed")
-    return 0
-
-
-# ======================================== the inventory (opensoft/openRepoTools#161)
-#
-# THIS WORKSTATION'S #97 WORKTREE INVENTORY, AS A SECOND SOURCE. Amendment 14(e)
-# left "#97's lifecycle snapshots and worktree inventories, local to one
-# workstation by design" to a later word; #161 is it. The source is
-# `inventory:<Workstation>` - one per workstation, because the sidecars are on
-# that workstation's disk and nowhere else - and its rows are what
-# `lanes-edit.sh worktrees --all` prints, which is the inventory read through
-# the helper that writes it. Nothing here parses a sidecar, a snapshot or an
-# ownership marker, and nothing here lists a directory.
-
-def _helper_run(args: list, timeout: float, what: str) -> subprocess.CompletedProcess:
-    helper = lanes_edit_path()
-    if not helper:
-        raise StoreUnusable("unread", f"no lanes-edit.sh beside this file or on PATH, so {what} "
-                            f"cannot be read")
-    try:
-        return subprocess.run([helper, *args], capture_output=True, encoding="utf-8",
-                              errors="replace", check=False, env=helper_env(),
-                              stdin=subprocess.DEVNULL, timeout=timeout)
-    except subprocess.TimeoutExpired:
-        raise StoreUnusable("unread", f"`lanes-edit.sh {' '.join(args)}` did not answer within "
-                            f"{int(timeout)} s")
-    except OSError as exc:
-        raise StoreUnusable("unread", f"`lanes-edit.sh {' '.join(args)}` could not be run: {exc}")
-
-
-@functools.lru_cache(maxsize=None)
-def this_workstation() -> tuple[str, str]:
-    """`lanes-edit.sh workstation`'s first two columns: the name every row of
-    this workstation is filed under, and where it came from.
-
-    ASKED ONCE A PROCESS (the review of #219): the refusal `cmd_sync` makes
-    before the lock asks it, and the sync that then takes the lock asked again
-    for the same answer - one environment, one name. A read that failed raises,
-    and is not kept."""
-    proc = _helper_run(["workstation"], 60, "this workstation's name")
-    first = (proc.stdout.splitlines() or [""])[0].split("\t")
-    if proc.returncode != 0 or not first[0]:
-        why = (proc.stderr.strip().splitlines() or ["no answer"])[-1]
-        raise StoreUnusable("unread", f"`lanes-edit.sh workstation` exited {proc.returncode}: {why}")
-    return first[0], (first[1] if len(first) > 1 else "")
-
-
-def inventory_source(requested: str | None) -> str:
-    """`inventory:<this workstation>`. `--source inventory` is the short name for
-    it; another workstation's is refused, as another register is - its sidecars
-    are on its own disk. AND A CONTAINER WITH NO NAME FILES NOTHING (Amendment
-    11, `R-A11-14`): a source named for a container's own id is a source no
-    restart of any workstation will ever find again."""
-    name, how = this_workstation()
-    if how == "container-unset":
-        raise Refusal("this container has no LANES_WORKSTATION, so its inventory would be "
-                      f"filed under the container's own id `{name}` - a source no restart of "
-                      "any workstation finds again (Amendment 11, R-A11-14). Export "
-                      "LANES_WORKSTATION, as the launcher does")
-    source = f"{INVENTORY_PREFIX}{name}"
-    if requested and requested not in ("inventory", source):
-        raise Refusal(f"this workstation's inventory is {source}, not {requested}: an "
-                      f"inventory is synced by the workstation whose disk holds it")
-    return source
-
-
-def _int_or_none(value: str):
-    return int(value) if value.isdigit() else None
-
-
-def tree_record(fields: list) -> dict:
-    """One `TREE` line of `lanes-edit.sh worktrees`, as the `worktrees` row it
-    is. An empty field is NULL: a count the inventory recorded as `unknown`, a
-    base or a last commit that could not be read, a lane with no snapshot."""
-    text = [f if f != "" else None for f in fields]
-    return {"workstation": text[1], "lane": fields[2], "owner": text[3], "path": fields[4],
-            "branch": text[5], "base": text[6], "lifecycle": text[7],
-            "generation": _int_or_none(fields[8]), "operation": text[9],
-            "writer_live": _int_or_none(fields[10]), "last_seen_utc": text[11],
-            "last_commit": text[12], "dirty_count": _int_or_none(fields[13]),
-            "unpushed_count": _int_or_none(fields[14]), "pr_number": None, "pr_state": None,
-            "_provenance": text[15]}
-
-
-def tree_line(row: dict, provenance) -> str:
-    """The `TREE` line a stored row came from - the inverse of `tree_record`, so
-    that `lanes --index --worktrees` and `lanes --worktrees` print the same
-    bytes wherever the index is current."""
-    def text(value) -> str:
-        return "" if value is None else str(value)
-    return US.join(["TREE"] + [text(row.get(c)) for c in (
-        "workstation", "lane", "owner", "path", "branch", "base", "lifecycle", "generation",
-        "operation", "writer_live", "last_seen_utc", "last_commit", "dirty_count",
-        "unpushed_count")] + [text(provenance)])
-
-
-#: THE BRANCH OF A LANE'S UNREAD MARKER (opensoft/openRepoTools#173): a
-#: `worktrees` row with no path and a branch `unreadable inventory (<why>)`,
-#: saying the lane's inventory was there and could not be read at the last
-#: sync, and why. A MARKER IS ITS KEY, `unread_key(<lane>)` - `<lane>:` and a
-#: US - and nothing else decides it (the review of #219 and its delta check):
-#: no tree's key can carry a US after the colon but its own `<US><n>`, while a
-#: tree's path can be empty (a current-schema sidecar with no `path:`) and a
-#: hand-made sidecar's branch can read like this one.
-UNREAD_BRANCH = "unreadable inventory"
-
-
-def is_unread_marker(row: dict) -> bool:
-    return row.get("record_id") == unread_key(row.get("lane") or "")
-
-
-def unread_key(lane: str) -> str:
-    return f"{lane}:{US}unread"
-
-
-def unread_record(workstation: str, lane: str, why: str) -> dict:
-    """The marker row of a lane whose inventory could not be read."""
-    record = {col: None for col in TABLE_COLUMNS["worktrees"]}
-    record.update(workstation=workstation, lane=lane, path="",
-                  branch=f"{UNREAD_BRANCH} ({why})", _provenance=None)
-    return record
-
-
-def unread_line(row: dict) -> str:
-    """The `UNREAD` line a marker row came from - `UNREAD <workstation> <lane>
-    <why>`, as `lanes-edit.sh worktrees` prints it, so that `lanes --index
-    --worktrees` says NOT READ wherever the source read said it."""
-    why = row.get("branch") or ""
-    if why.startswith(f"{UNREAD_BRANCH} (") and why.endswith(")"):
-        why = why[len(UNREAD_BRANCH) + 2:-1]
-    return US.join(["UNREAD", row.get("workstation") or "", row.get("lane") or "", why])
-
-
-def inventory_digest(record: dict) -> str:
-    """The register's digest, and the row's provenance with it: two
-    observations of one tree filed under two generations are two versions."""
-    content = ["worktrees"] + [record.get(col) for col in TABLE_COLUMNS["worktrees"]] + \
-        [record.get("_provenance")]
-    blob = json.dumps(content, ensure_ascii=False, separators=(",", ":"), sort_keys=False)
-    return hashlib.sha256(blob.encode("utf-8")).hexdigest()
-
-
-def lane_generation(lane: str) -> tuple:
-    """`(generation, None)` of a lane's lifecycle snapshot, asked of `lanes-edit.sh
-    lane-state` - 0 where the lane has no snapshot or no control root here - or
-    `(None, why)` where the snapshot is there and could not be read."""
-    proc = _helper_run(["lane-state", lane], 120, f"lane {lane}'s lifecycle snapshot")
-    if proc.returncode in (1, 8):
-        return 0, None
-    if proc.returncode != 0:
-        return None, f"its lifecycle snapshot could not be read (lane-state exited {proc.returncode})"
-    fields = dict(line.split("\t", 1) for line in proc.stdout.splitlines() if "\t" in line)
-    if fields.get("state") == "UNKNOWN-SCHEMA":
-        return None, f"its lifecycle snapshot records schema {fields.get('schema')}"
-    gen = fields.get("generation", "")
-    return (int(gen) if gen.isdigit() else 0), None
-
-
-def collect_inventory() -> tuple[dict, dict]:
-    """Every tree the inventory names, keyed `<lane>:<path>` (a second tree of
-    one lane with the same path `<lane>:<path><US><n>`), and every lane whose
-    inventory is there and could not be read - whose rows are KEPT, never taken
-    for a lane with no trees (Amendment 7(d)).
-
-    A READ WHOSE LANE LISTING WAS NOT WHOLE IS NO ANSWER AT ALL
-    (opensoft/openRepoTools#173 item c1). The helper lists the lanes out of the
-    register, the archive and the object logs, and where one of those reads
-    failed it says so in a `PARTIAL <workstation> <why>` line beside the rows it
-    did reach. A lane it could not name is not a lane with no trees, and which
-    lanes those are is exactly what the read does not know - so nothing is
-    written from it, as nothing is from a listing that could not be read at
-    all: the index stays at the last whole read, which `synced <UTC>` dates. An
-    indexer older than this line refuses it too, as a line it does not read."""
-    proc = _helper_run(["worktrees", "--all"], 600, "the worktree inventory")
-    if proc.returncode == 8:
-        return {}, {}
-    if proc.returncode != 0:
-        why = (proc.stderr.strip().splitlines() or ["no answer"])[-1]
-        raise StoreUnusable("unread", f"`lanes-edit.sh worktrees --all` exited "
-                            f"{proc.returncode}: {why}")
-    trees, unread = {}, {}
-    for line in proc.stdout.split("\n"):
-        if not line:
-            continue
-        fields = line.split(US)
-        if fields[0] == "PARTIAL" and len(fields) >= 3:
-            raise StoreUnusable("unread", f"the lane listing `lanes-edit.sh worktrees --all` "
-                                f"reads the inventory through was not whole - {fields[2]} - so "
-                                f"a lane it could not name would read as a lane with no "
-                                f"worktrees and its rows would be removed (R22, Amendment 7(d))")
-        if fields[0] == "UNREAD" and len(fields) >= 4:
-            unread[fields[2]] = fields[3]
-            continue
-        if fields[0] != "TREE" or len(fields) != 16:
-            raise StoreUnusable("unread", f"`lanes-edit.sh worktrees` printed a line this "
-                                f"indexer does not read ({len(fields)} fields): {line[:120]!r} - "
-                                f"is the helper on PATH another version?")
-        record = tree_record(fields)
-        # TWO TREES OF ONE LANE WITH ONE PATH ARE TWO ROWS (the review of #219):
-        # a current-schema sidecar with no `path:` is a tree whose path is
-        # EMPTY, and a second one replaced the first here. A later one is keyed
-        # with its place among them, after a US, which no path in a
-        # US-separated line can carry. The read is sorted, so a place holds
-        # while those trees keep their order; a change that reorders them - a
-        # renamed branch, say - moves both keys, and that sync upserts both.
-        key = f"{record['lane']}:{record['path']}"
-        if key in trees:
-            n = 2
-            while f"{key}{US}{n}" in trees:
-                n += 1
-            key = f"{key}{US}{n}"
-        trees[key] = record
-    return trees, unread
-
-
-def _github_repo(path: str) -> str:
-    if not os.path.isdir(path):
-        return ""
-    proc = subprocess.run(["git", "-C", path, "remote", "get-url", "origin"], capture_output=True,
-                          encoding="utf-8", errors="replace", check=False,
-                          stdin=subprocess.DEVNULL)
-    url = proc.stdout.strip()
-    if proc.returncode != 0 or "github.com" not in url:
-        return ""
-    repo = _norm_repo(url)
-    return repo if re.match(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$", repo) else ""
-
-
-def pr_of(path: str, branch_name: str):
-    """`(number, state)` of the newest pull request whose head is this branch,
-    asked of `gh` - BEST EFFORT, and `(None, None)` wherever it does not answer.
-    The one network read of this source, and only of it."""
-    repo = _github_repo(path)
-    if not repo:
-        return None, None
-    env = dict(os.environ)
-    env["GH_PROMPT_DISABLED"] = "1"
-    try:
-        proc = subprocess.run(["gh", "pr", "list", "--repo", repo, "--head", branch_name,
-                               "--state", "all", "--json", "number,state", "--limit", "1"],
-                              capture_output=True, encoding="utf-8", errors="replace",
-                              check=False, env=env, stdin=subprocess.DEVNULL, timeout=20)
-        found = json.loads(proc.stdout) if proc.returncode == 0 else []
-    except (OSError, subprocess.TimeoutExpired, ValueError):
-        return None, None
-    if not isinstance(found, list) or not found or not isinstance(found[0], dict):
-        return None, None
-    number = found[0].get("number")
-    state = found[0].get("state")
-    return (number if isinstance(number, int) else None,
-            state if isinstance(state, str) and state else None)
-
-
-def fill_prs(trees: dict, stored: dict, mode: str, held: dict | None = None) -> int:
-    """`pr_number`/`pr_state` for every tree on a branch. A `sync` carries a
-    stored answer over for a tree whose branch and last commit have not moved
-    where that answer is final (MERGED, CLOSED) or `gh` is not to be asked;
-    `reconcile` asks again. Returns how many were asked."""
-    use_gh = os.environ.get("LANES_NO_GITHUB", "") != "1" and bool(shutil.which("gh"))
-    ask = []
-    for rec_id, rec in trees.items():
-        name = rec.get("branch") or ""
-        if not name or " " in name or name in ("unknown", "HEAD") or rec["lane"] in (held or {}):
-            continue
-        old = stored.get(rec_id)
-        if mode == "sync" and old is not None and old.get("branch") == rec["branch"] \
-                and old.get("last_commit") == rec["last_commit"] \
-                and (old.get("pr_state") in ("MERGED", "CLOSED") or not use_gh):
-            rec["pr_number"], rec["pr_state"] = old.get("pr_number"), old.get("pr_state")
-            continue
-        if use_gh:
-            ask.append(rec_id)
-    if ask:
-        with ThreadPoolExecutor(max_workers=max(1, min(8, len(ask)))) as pool:
-            answers = list(pool.map(lambda rid: pr_of(trees[rid]["path"], trees[rid]["branch"]),
-                                    ask))
-        for rec_id, (number, state) in zip(ask, answers):
-            trees[rec_id]["pr_number"], trees[rec_id]["pr_state"] = number, state
-    return len(ask)
-
-
-def run_inventory(mode: str, requested: str | None, dry_run: bool) -> int:
-    cfg = load_config()
-    source = inventory_source(requested)
-    store = open_store(cfg, "writer")
-    if dry_run:
-        try:
-            store.open_read()
-        except StoreUnusable as exc:
-            if exc.kind not in ("missing", "wiped"):
-                raise
-            store = None
-    else:
-        store.open_write()
-    old = store.provenance(source) if store is not None else None
-    trees, unread = collect_inventory()
-    label = f"{source} ({cfg['store']})"
-    cols = TABLE_COLUMNS["worktrees"]
-    stored = {} if store is None else {
-        r["record_id"]: r for r in store.rows("worktrees", source, cols + ["digest", "provenance"])}
-
-    # THE PROVENANCE MOVES ONLY FORWARD, PER LANE (14(d)). A lane's lifecycle
-    # generation is monotonic by `set-lane-state`'s own fence, so a read BELOW
-    # the generation a lane's rows were written at is a snapshot that was moved
-    # aside or replaced - and a `sync` writes nothing for that lane rather than
-    # roll its rows back. `reconcile` is the act that takes the source as it now
-    # stands, and it says so. A lane whose inventory could not be read keeps its
-    # rows in either: a read that failed is never an answer. (A read whose LANE
-    # LISTING was not whole never gets this far: `collect_inventory` refuses it,
-    # in either act, because which lanes it could not name is what it does not
-    # know - #173 item c1.)
-    held: dict = {}
-    for lane, why in unread.items():
-        held[lane] = f"its inventory is there and could not be read ({why})"
-    read_gen: dict = {}
-    for rec in trees.values():
-        read_gen[rec["lane"]] = max(read_gen.get(rec["lane"], 0), rec["generation"] or 0)
-    stored_gen: dict = {}
-    for row in stored.values():
-        stored_gen[row["lane"]] = max(stored_gen.get(row["lane"], 0), row["generation"] or 0)
-    # A LANE WHOSE ROWS WOULD ALL LEAVE IS FENCED TOO (Copilot round 2 on #171).
-    # It names no tree now, so it carries no generation in the read; its
-    # snapshot is asked for - only for these lanes, which are few - so that one
-    # moved aside and begun again without trees is held for `reconcile` like
-    # any other lane that went back, rather than emptied by a `sync`.
-    for lane in sorted(set(stored_gen) - set(read_gen) - set(held)):
-        if not stored_gen[lane]:
-            continue
-        gen, why = lane_generation(lane)
-        if why:
-            held[lane] = why
-        else:
-            read_gen[lane] = gen
-    taken: list = []
-    for lane, gen in sorted(read_gen.items()):
-        if lane in held or gen >= stored_gen.get(lane, 0):
-            continue
-        if mode == "sync":
-            held[lane] = (f"its lifecycle generation reads {gen} and its rows were written at "
-                          f"{stored_gen[lane]}; the provenance only moves forward, so nothing "
-                          f"is written for it - `{PROG} reconcile --source inventory` takes "
-                          f"the lane as it now stands")
-        else:
-            taken.append(f"  lane {lane}: its lifecycle generation went back from "
-                         f"{stored_gen[lane]} to {gen} (a snapshot moved aside or replaced); "
-                         f"reconcile takes it as it now stands")
-
-    # THE UNREAD STATE IS KEPT AS WELL AS THE ROWS (opensoft/openRepoTools#173,
-    # Copilot's third review of #171). A lane held because its inventory could
-    # not be read gets ONE marker row, which `export --worktrees` writes back as
-    # the source's own `UNREAD` line. Without it a FIRST sync that could not
-    # read a lane committed usable provenance with nothing for it, and the
-    # index answered "no worktree is inventoried" where the source says NOT
-    # READ; and rows held over from an earlier sync read as freshly read - so
-    # the marker says they are kept. It leaves with the first sync that reads
-    # its lane, a lane held for its generation included: that lane was read.
-    workstation = source[len(INVENTORY_PREFIX):]
-    markers: dict = {}
-    for lane, why in unread.items():
-        rows_kept = sum(1 for row in stored.values()
-                        if row["lane"] == lane and not is_unread_marker(row))
-        if rows_kept:
-            why = (f"{why} - the {rows_kept} row(s) listed for it are kept from the last sync "
-                   f"that read it")
-        markers[unread_key(lane)] = unread_record(workstation, lane, why)
-
-    fill_prs(trees, stored, mode, held)
-    upserts, deletes, kept = {}, [], 0
-    for rec_id, rec in list(trees.items()) + list(markers.items()):
-        rec["digest"] = inventory_digest(rec)
-        if rec["lane"] in held and rec_id not in markers:
-            continue
-        row = stored.get(rec_id)
-        if row is not None:
-            if mode == "reconcile":
-                as_written = {c: row.get(c) for c in cols}
-                as_written["_provenance"] = row.get("provenance")
-                same = inventory_digest(as_written) == rec["digest"] == row.get("digest")
-            else:
-                same = row.get("digest") == rec["digest"]
-            if same:
-                kept += 1
-                continue
-        upserts[rec_id] = rec
-    for rec_id, row in stored.items():
-        if rec_id in trees or rec_id in markers:
-            continue
-        if row["lane"] not in held or is_unread_marker(row):
-            deletes.append(rec_id)
-    after = {rid: rec["digest"] for rid, rec in trees.items() if rec["lane"] not in held}
-    after.update({rid: row["digest"] for rid, row in stored.items()
-                  if row["lane"] in held and not is_unread_marker(row)})
-    after.update({rid: rec["digest"] for rid, rec in markers.items()})
-    fingerprint = hashlib.sha256("\n".join(
-        f"{rid}\t{digest}" for rid, digest in sorted(after.items())).encode("utf-8")).hexdigest()
-
-    n_up, n_del = len(upserts), len(deletes)
-    if mode == "reconcile":
-        say(f"{PROG} reconcile: {label}{' - DRY RUN' if dry_run else ''}")
-        say(f"  {'worktrees':<20} {kept:>6} kept  {n_up:>6} upserted  {n_del:>6} removed")
-        for line in taken:
-            say(line)
-    for lane, why in sorted(held.items()):
-        say(f"  lane {lane}: its rows are kept as they are - {why}")
-    if dry_run:
-        say(f"  total: {n_up} to upsert, {n_del} to remove - nothing written (--dry-run)")
-        return 0
-    # NOTHING TO WRITE ONLY WHERE THE SOURCE'S OWN ROW AGREES TOO (Copilot
-    # round 1 on #171): a fingerprint changed by hand, with every row right, is
-    # put right here rather than left disagreeing with the table it names.
-    if old is not None and not upserts and not deletes and old.get("commit_sha") == fingerprint:
-        if mode == "sync":
-            say(f"{PROG} sync: {label} - the index is current; nothing to write")
-        else:
-            say("  total: nothing differs; nothing written")
-        write_status(source, last_attempt_utc=utc_now(), last_sync_utc=utc_now(),
-                     last_result="current", last_error="")
-        return 0
-    try:
-        generation = int((old or {}).get("generation") or 0) + 1
-    except (TypeError, ValueError):
-        generation = 1
-    store.apply(source, old, fingerprint, {"worktrees": upserts} if upserts else {},
-                {"worktrees": deletes} if deletes else {}, generation=generation)
-    write_status(source, last_attempt_utc=utc_now(), last_sync_utc=utc_now(),
-                 last_result=f"{n_up} upserted, {n_del} removed at sync {generation}",
-                 last_error="")
-    if mode == "sync":
-        say(f"{PROG} sync: {label} - {n_up} upserted, {n_del} removed")
-    else:
-        say(f"  total: {n_up} upserted, {n_del} removed")
-    return 0
-
-
-def is_inventory(requested: str | None) -> bool:
-    return bool(requested) and (requested == "inventory" or requested.startswith(INVENTORY_PREFIX))
-
-
-def _sync_once(kind: str, requested: str | None) -> int:
-    if kind == "inventory":
-        # A REFUSAL HERE IS ANSWERED HERE: a register sync that took the
-        # inventory's mark must not lose the marks behind it to an exception.
-        try:
-            return _guarded(lambda: run_inventory("sync", requested, False), requested, kind)
-        except Refusal as exc:
-            note(f"REFUSED: {exc}")
-            return 2
-    return _guarded(lambda: run_index("sync", requested, False), requested, kind)
-
-
-def cmd_sync(requested: str | None) -> int:
-    if os.environ.get("LANES_INDEX", "") == "off":
-        say(f"{PROG} sync: LANES_INDEX=off - nothing indexed")
-        return 0
-    kind = "inventory" if is_inventory(requested) else "register"
-    asked = {kind: requested}
-    # A SOURCE IS REFUSED BEFORE THE LOCK IS ASKED FOR (opensoft/openRepoTools#173,
-    # Copilot's fourth review of #171). Behind a held lock this sync only
-    # leaves a mark of its KIND, and the holder syncs THIS workstation's source
-    # for it - so `--source inventory:Raven` on Eagle, `--source inventory` in
-    # a container with no name, or another register, exited 0 there instead of
-    # 2. A refusal leaves through `main`; a helper that cannot answer is the
-    # sync's own to say and record, as it was.
-    try:
-        if kind == "inventory":
-            inventory_source(requested)
-        elif requested:
-            resolve_source(requested, workspace_root())
-    except StoreUnusable:
-        pass
-    lock = SyncLock()
-    # THE HANDSHAKE, BOTH HALVES (Codex on #164). A sync that finds the lock
-    # held leaves its mark and then tries ONCE MORE: if that fails, somebody
-    # holds the lock NOW, after the mark was written, and the holder looks for
-    # marks after it lets go. The holder, for its part, looks again AFTER it
-    # releases - a mark written between its last look and its release is
-    # found there, and it takes the lock back for it. No mark is left with
-    # nobody due to read it. AND THE MARK NAMES ITS SOURCE (#161): the holder
-    # syncs every source a mark names, its own included, before it lets go.
-    if not lock.acquire(0):
-        lock.mark_rerun(kind)
-        if not lock.acquire(0):
-            say(f"{PROG} sync: another sync holds {lock.path}; it will sync again before "
-                f"it is done")
-            return 0
-    rc = 0
-    try:
-        rounds = 0
-        due = [kind]
-        while True:
-            for marked in lock.take_reruns():
-                if marked not in due:
-                    due.append(marked)
-            if not due:
-                lock.release()
-                if not lock.has_rerun() or not lock.acquire(0):
-                    return rc
-                continue
-            current = due[0]
-            rounds += 1
-            result = _sync_once(current, asked.get(current))
-            if result == MOVED and rounds < 5:
-                continue
-            due.pop(0)
-            if result == MOVED:
-                say(f"{PROG} sync: origin/{branch()} kept moving through {rounds} reads; "
-                    f"nothing written - the next write's nudge syncs it")
-                result = 0
-            # A FAILED SOURCE DOES NOT DROP THE OTHERS (Copilot round 1 on #171):
-            # their marks were taken off the disk with this one's, so the loop
-            # drains them all and the exit is the first failure.
-            if result != 0 and rc == 0:
-                rc = result
-            if rounds >= 8:
-                # THE CAP HANDS BACK WHAT IT DID NOT RUN (Copilot round 2 on
-                # #171): a source whose mark this loop took off the disk and
-                # never synced is marked again, for the next sync, exactly as a
-                # mark this loop never took is left for it.
-                for pending in due:
-                    lock.mark_rerun(pending)
-                return rc
-    finally:
-        lock.release()
-
-
-def cmd_reconcile(requested: str | None, dry_run: bool) -> int:
-    if os.environ.get("LANES_INDEX", "") == "off" and not dry_run:
-        say(f"{PROG} reconcile: LANES_INDEX=off - nothing indexed")
-        return 0
-    kind = "inventory" if is_inventory(requested) else "register"
-    lock = SyncLock()
-    if not dry_run and not lock.acquire(60):
-        note(f"another sync has held {lock.path} for 60 s; nothing written")
-        return 1
-    try:
-        if kind == "inventory":
-            return _guarded(lambda: run_inventory("reconcile", requested, dry_run), requested,
-                            kind)
-        for _attempt in range(3):
-            rc = _guarded(lambda: run_index("reconcile", requested, dry_run), requested)
-            if rc != MOVED:
-                return rc
-        note(f"origin/{branch()} kept moving through three reads; nothing written")
-        return 1
-    finally:
-        lock.release()
-
-
-#: `_guarded`'s answer for a read the source moved under: not an exit code
-#: anybody sees, a signal to the two drivers above to read again.
-MOVED = -1
-
-
-def _guarded(act, requested, kind: str = "register") -> int:
-    try:
-        return act()
-    except SourceMoved as exc:
-        note(str(exc))
-        return MOVED
-    except CasLost as exc:
-        note(str(exc))
-        _record_error(requested, str(exc), kind)
-        return 1
-    except StoreUnusable as exc:
-        note(f"{exc.kind}: {exc.detail} - nothing written")
-        _record_error(requested, f"{exc.kind}: {exc.detail}", kind)
-        return 1
-
-
-def _record_error(requested, message: str, kind: str = "register") -> None:
-    if kind == "inventory":
-        try:
-            source = inventory_source(requested)
-        except (StoreUnusable, Refusal):
-            source = requested if requested and requested != "inventory" else "inventory:?"
-        write_status(source, last_attempt_utc=utc_now(), last_error=f"{utc_now()} {message}")
-        return
-    try:
-        source = requested or source_of(workspace_root())
-    except StoreUnusable:
-        source = requested or "register:?"
-    write_status(source, last_attempt_utc=utc_now(), last_error=f"{utc_now()} {message}")
-
-
-def cmd_status() -> int:
-    cfg = load_config()
-    store = open_store(cfg, "reader")
-    say(f"store: {cfg['store']} {store.where} (configuration: "
-        f"{cfg['path'] if cfg['present'] else 'none - the defaults'})")
-    rc = 0
-    root = ""
-    source = ""
-    tip = ""
-    try:
-        root = workspace_root()
-        source = source_of(root)
-        tip = tip_of(root)
-    except StoreUnusable as exc:
-        say(f"workspace: {exc.detail}")
-        rc = 1
-    provs: list = []
-    try:
-        store.open_read()
-        provs = store.all_provenance()
-        say(f"schema: {SCHEMA_VERSION}")
-    except StoreUnusable as exc:
-        say(f"index: {exc.kind} - {exc.detail}")
-        rc = 1
-    local = read_status()
-    sources = [p["source"] for p in provs]
-    if source and source not in sources:
-        sources.append(source)
-    # THIS WORKSTATION'S INVENTORY TOO (#161), indexed or not - its name is the
-    # helper's, and a helper that cannot say it costs the line, not the status.
-    inv_source = ""
-    try:
-        inv_source = inventory_source(None)
-    except (StoreUnusable, Refusal):
-        inv_source = ""
-    if inv_source and inv_source not in sources:
-        sources.append(inv_source)
-    for name in sorted(set(sources) | set(local)):
-        prov = next((p for p in provs if p["source"] == name), None)
-        say(f"source {name}")
-        if name.startswith(INVENTORY_PREFIX):
-            if prov is None:
-                say("  provenance:  none - this inventory is not indexed (a wiped or "
-                    "never-synced index; `lanes-index reconcile --source inventory` builds it)")
-            else:
-                fp = prov.get("commit_sha") or ""
-                say(f"  provenance:  inventory@{fp[:12]} (sync {prov.get('generation')}, indexed "
-                    f"{prov['indexed_utc']}, schema {prov['schema_version']})")
-                try:
-                    wt_rows = store.rows("worktrees", name, ["lane"])
-                    count = sum(1 for row in wt_rows if not is_unread_marker(row))
-                    # A LANE'S UNREAD MARKER IS NOT A WORKTREE (#173), and is said
-                    # as what it is.
-                    unread = len(wt_rows) - count
-                    say(f"  rows:        {count} worktree(s)" + (
-                        f", and {unread} lane(s) whose inventory could not be read at the "
-                        f"last sync" if unread else ""))
-                except StoreUnusable as exc:
-                    say(f"  rows:        unread - {exc.kind}: {exc.detail}")
-                    rc = 1
-        elif prov is None:
-            say("  provenance:  none - this source is not indexed (a wiped or never-synced "
-                "index; `lanes-index reconcile` builds it)")
-        elif prov.get("commit_sha"):
-            say(f"  provenance:  register@{prov['commit_sha'][:12]} (indexed "
-                f"{prov['indexed_utc']}, schema {prov['schema_version']})")
-        else:
-            say(f"  provenance:  generation {prov.get('generation')} (indexed "
-                f"{prov['indexed_utc']}, schema {prov['schema_version']})")
-        if name == source and tip:
-            say(f"  tip:         register@{tip[:12]} (origin/{branch()} in {root})")
-            if prov is not None and prov.get("commit_sha"):
-                lag = commits_between(root, prov["commit_sha"], tip)
-                say(f"  lag:         {'unknown (the indexed commit is not in this checkout)' if lag is None else f'{lag} commit(s)'}")
-        entry = local.get(name, {})
-        say(f"  last sync:   {entry.get('last_sync_utc') or 'never, from this workstation'}"
-            f"{' (' + entry['last_result'] + ')' if entry.get('last_result') else ''}")
-        say(f"  last error:  {entry.get('last_error') or 'none'}")
-    return rc
-
-
-def cmd_export(out_dir: str, requested: str | None, worktrees: bool = False) -> int:
-    """The read flags' reader, and nothing else's: the index's image of this
-    workstation's register in the shapes `lanes-edit.sh` reads from origin -
-    or, with `worktrees` (#161), every inventory source's rows as the `TREE`
-    lines `lanes-edit.sh worktrees` prints.
-
-    It writes FILES into `out_dir` and prints nothing a caller parses. On
-    success `meta`; on any reason the index cannot answer, `why` - one line,
-    which `lanes-edit.sh` prints as `read: sources (index <why>)`."""
-    if not os.path.isdir(out_dir):
-        note(f"--out {out_dir} is not a directory")
-        return 64
-
-    def unusable(kind: str, detail: str) -> int:
-        with open(os.path.join(out_dir, "why"), "w", encoding="utf-8") as handle:
-            handle.write(f"{kind}: {detail}\n")
-        return 3
-
-    try:
-        cfg = load_config()
-    except Refusal as exc:
-        unusable("refused", str(exc))
-        return 2
-    if worktrees:
-        return _export_worktrees(out_dir, cfg, unusable)
-    try:
-        root = workspace_root()
-        source = resolve_source(requested, root)
-        store = open_store(cfg, "reader")
-        store.open_read()
-        # ONE COMMIT'S IMAGE (opensoft/openRepoTools#166 item 1): the provenance
-        # and every table in one read snapshot, or a sync committing between two
-        # reads writes rows of two commits under a `meta` naming the first.
-        prov, (file_rows, lanes, reg_lines, aliases, log_rows) = store.read_image(source, [
-            ("source_files", TABLE_COLUMNS["source_files"]),
-            ("lanes", ["row_file", "row_ordinal", "row_text"]),
-            ("register_lines", ["ordinal", "raw"]),
-            ("lane_aliases", ["ordinal", "raw"]),
-            ("log_lines", [c for c in TABLE_COLUMNS["log_lines"]
-                           if c not in ("payload_fields", "raw")])])
-        if prov is None or not prov.get("commit_sha"):
-            return unusable("wiped", f"no provenance for {source} in the {cfg['store']} store")
-        files = {r["record_id"]: r for r in file_rows}
-    except Refusal as exc:
-        unusable("refused", str(exc))
-        return 2
-    except StoreUnusable as exc:
-        return unusable(exc.kind, exc.detail)
-
-    def write(name: str, lines: list[str]) -> None:
-        with open(os.path.join(out_dir, name), "w", encoding="utf-8", newline="") as handle:
-            for line in lines:
-                handle.write(line + "\n")
-
-    register = [(r["row_ordinal"], r["row_text"]) for r in lanes if r["row_file"] == REGISTER_PATH]
-    register += [(r["ordinal"], r["raw"]) for r in reg_lines]
-    write("register", [text for _o, text in sorted(register, key=lambda x: x[0])])
-    if ARCHIVE_PATH in files:
-        write("archive", [r["row_text"] for r in sorted(
-            (r for r in lanes if r["row_file"] == ARCHIVE_PATH), key=lambda r: r["row_ordinal"])])
-    if ALIASES_PATH in files:
-        write("aliases", [r["raw"] for r in sorted(aliases, key=lambda r: r["ordinal"])])
-    logs = sorted((f for f in files.values() if f["kind"] == "log"), key=lambda f: f["ls_order"])
-    write("logs", [f["record_id"] for f in logs])
-    by_file: dict = {}
-    for row in log_rows:
-        by_file.setdefault(row["file"], []).append(row)
-    events, warn = [], []
-    for f in logs:
-        bad = 0
-        for row in sorted(by_file.get(f["record_id"], []), key=lambda r: r["ordinal"]):
-            if row["unreadable"]:
-                bad += 1
-                warn.append(f"unreadable: {row['file']}:{row['ordinal']} ({row['unreadable_why']})")
-                continue
-            events.append(US.join([row["utc"] or "", row["lane"] or "", row["verb"] or "",
-                                   row["session"] or "", row["workstation"] or "",
-                                   row["object"] or "", row["ref"] or "", row["payload"] or "",
-                                   row["free_text"] or "", row["file"] or "",
-                                   str(row["ordinal"])]))
-        if bad:
-            warn.append(f"{bad} unreadable line(s) above — an append-only log is never "
-                        f"rewritten, so a line no parser reads is a hold no tool will mention "
-                        f"again")
-    write("events", events)
-    write("warn", warn)
-    write("meta", [f"store={cfg['store']}", f"source={source}",
-                   f"sha={prov['commit_sha']}", f"indexed_utc={prov['indexed_utc']}"])
-    return 0
-
-
-def _export_worktrees(out_dir: str, cfg: dict, unusable) -> int:
-    """EVERY `inventory:<Workstation>` THE STORE HOLDS - this workstation's and
-    any other syncing into the same Postgres, which is what the table is for:
-    the next account, on either workstation, sees every open worktree in one
-    read. `meta` names each source with the time it was synced."""
-    try:
-        store = open_store(cfg, "reader")
-        store.open_read()
-        provs = [p for p in store.all_provenance()
-                 if str(p["source"]).startswith(INVENTORY_PREFIX)]
-        if not provs:
-            return unusable("wiped", f"no {INVENTORY_PREFIX}<Workstation> source in the "
-                            f"{cfg['store']} store")
-        lines = []
-        for prov in provs:
-            for row in store.rows("worktrees", prov["source"],
-                                  TABLE_COLUMNS["worktrees"] + ["provenance"]):
-                # A LANE'S UNREAD MARKER (#173) is written back as the `UNREAD`
-                # line it was read from.
-                lines.append(unread_line(row) if is_unread_marker(row)
-                             else tree_line(row, row.get("provenance")))
-    except Refusal as exc:
-        unusable("refused", str(exc))
-        return 2
-    except StoreUnusable as exc:
-        return unusable(exc.kind, exc.detail)
-    # THE BYTE ORDER `LC_ALL=C sort` GIVES the source read, so this
-    # workstation's rows are the source read's own stream wherever the index is
-    # current; a shared store adds other workstations' rows among them.
-    lines.sort(key=lambda line: line.encode("utf-8"))
-    with open(os.path.join(out_dir, "worktrees"), "w", encoding="utf-8", newline="") as handle:
-        for line in lines:
-            handle.write(line + "\n")
-    # AND THE LAST ERROR THIS WORKSTATION RECORDED FOR THE SOURCE (N2 of the
-    # review of #289): a sync that wrote nothing - a lane listing that was not
-    # whole, among others - leaves the table and its `synced` time as they
-    # were, and only `status` said why. It is `status`'s `last error`, so a
-    # refused `reconcile` is in it too, a `--dry-run` included (NIT-1 of review
-    # r2 of #289). A fifth field, which a reader from before it ignores.
-    # Another workstation's error is in its own record and not here, so a
-    # shared store's other sources never carry one.
-    recorded = read_status()
-    with open(os.path.join(out_dir, "meta"), "w", encoding="utf-8", newline="") as handle:
-        handle.write(f"store={cfg['store']}\n")
-        for prov in sorted(provs, key=lambda p: str(p["source"])):
-            entry = recorded.get(prov["source"])
-            error = entry.get("last_error") if isinstance(entry, dict) else ""
-            error = " ".join(str(error or "").split())
-            handle.write(f"inventory\t{prov['source']}\t{prov['indexed_utc']}\t"
-                         f"{prov.get('generation')}" + (f"\t{error}" if error else "") + "\n")
-    return 0
-
-
-USAGE = f"""\
-{PROG} sync      [--source <s>]              index what LANDED, behind the source
-{PROG} reconcile [--source <s>] [--dry-run]  read the source whole; put the index right
-{PROG} status                                 per source: store, provenance, lag, errors
-{PROG} export    --out <dir> [--source <s> | --worktrees]
-                                             the `--index` read flags' reader
-
-The DERIVED INDEX of the lane register (lane-collision-protocol Amendment 14).
-It is written behind the sources by this command alone, read only by tooling
-that decides nothing, and never a gate: no lane act reads it or waits on it.
-
-  sync        Reads `origin/<branch>` of the workspace repository as the push
-              left it - never the working tree - and upserts each record that
-              differs, keyed by (source, record id) and versioned by a digest,
-              with the source's provenance compared and swapped in the SAME
-              transaction. A sync from a commit that does not descend from the
-              indexed one writes nothing. `lanes-edit.sh` starts it DETACHED
-              after every write that landed; `LANES_INDEX=off` stops that.
-  reconcile   Reads the source whole, compares every stored row by its
-              CONTENT, upserts what differs and removes what is gone: on a
-              wiped index, the rebuild. `--dry-run` prints the counts only.
-  status      The store, each source's provenance against its tip, the lag in
-              commits, and this workstation's last sync and last error.
-  export      Writes the index's image of the register into <dir> for
-              `lanes --index` and `lanes-edit.sh history --index` - or, with
-              `--worktrees`, every inventory source's rows for `lanes --index
-              --worktrees`. Not for people.
-
-  --source <s>  `register:<owner/repo>`, which must be this workstation's own
-                and is the default; `inventory` (or `inventory:<Workstation>`,
-                this one's) is THIS workstation's #97 worktree inventory, read
-                through `lanes-edit.sh worktrees --all` into the `worktrees`
-                table (opensoft/openRepoTools#161) - every inventory write
-                nudges `sync --source inventory`. The managed ledger's
-                `ledger:<Workstation>` is T058's to write.
-
-THE STORE: SQLite at ${{XDG_STATE_HOME:-~/.local/state}}/openRepoTools/lanes-index.sqlite,
-or QA Postgres through `psql` where the configuration names a `url=`.
-THE CONFIGURATION: ${{XDG_CONFIG_HOME:-~/.config}}/openRepoTools/lanes-index.conf, or the
-file $LANES_INDEX_CONFIG names - mode 0600, outside every git work tree and
-outside ~/.agents/, with no password in any URL:
-
-  store=sqlite|postgres     default: postgres where url= is set, else sqlite
-  sqlite=<path>             the SQLite file
-  url=<libpq URL>           the WRITER role (sync, reconcile)
-  passfile=<path>           the 0600 libpq password file for it
-  reader_url=<libpq URL>    the SELECT-only READER role (status, export) -
-                            required beside url=; a read never uses the writer
-  reader_passfile=<path>    its password file, where it is not the same one
-  schema=<name>             the Postgres schema (default lanes_index)
-
-Exit: 0 done · 1 a read or write failed, nothing half-written · 2 refused ·
-3 export: the index cannot answer (the reason is in <dir>/why) · 64 usage."""
-
-
-def main(argv: list[str]) -> int:
-    if not argv:
-        sys.stderr.write(USAGE + "\n")
-        return 64
-    if argv[0] in ("-h", "--help", "help"):
-        say(USAGE)
-        return 0
-    if argv[0] == "--version":
-        say(f"{PROG} {VERSION} (schema {SCHEMA_VERSION})")
-        return 0
-    verb, args = argv[0], argv[1:]
-    source = None
-    dry_run = False
-    worktrees = False
-    out_dir = None
-    i = 0
-    while i < len(args):
-        arg = args[i]
-        if arg in ("-h", "--help"):
-            say(USAGE)
-            return 0
-        if arg == "--source" or arg.startswith("--source="):
-            value = arg.split("=", 1)[1] if "=" in arg else (args[i + 1] if i + 1 < len(args) else "")
-            if not value:
-                note("--source needs a value: register:<owner/repo>")
-                return 64
-            source = value
-            i += 1 if "=" in arg else 2
-            continue
-        if (arg == "--out" or arg.startswith("--out=")) and verb == "export":
-            value = arg.split("=", 1)[1] if "=" in arg else (args[i + 1] if i + 1 < len(args) else "")
-            if not value:
-                note("--out needs a directory")
-                return 64
-            out_dir = value
-            i += 1 if "=" in arg else 2
-            continue
-        if arg == "--dry-run" and verb == "reconcile":
-            dry_run = True
-            i += 1
-            continue
-        if arg == "--worktrees" and verb == "export":
-            worktrees = True
-            i += 1
-            continue
-        note(f"unknown argument '{arg}' for {verb} - see {PROG} --help")
-        return 64
-    try:
-        if verb == "sync":
-            return cmd_sync(source)
-        if verb == "reconcile":
-            return cmd_reconcile(source, dry_run)
-        if verb == "status":
-            if source:
-                note("status takes no --source; it prints every source the store holds")
-                return 64
-            return cmd_status()
-        if verb == "export":
-            if not out_dir:
-                note("export needs --out <dir>")
-                return 64
-            if worktrees and source:
-                note("export --worktrees reads every inventory source the store holds; it "
-                     "takes no --source")
-                return 64
-            return cmd_export(out_dir, source, worktrees)
-    except Refusal as exc:
-        note(f"REFUSED: {exc}")
-        return 2
-    except StoreUnusable as exc:
-        note(f"{exc.kind}: {exc.detail}")
-        return 1
-    note(f"unknown subcommand '{verb}' (sync|reconcile|status|export) - see {PROG} --help")
-    return 64
-
-
-if __name__ == "__main__":
-    sys.exit(main(sys.argv[1:]))
diff --git a/link-estates b/link-estates
deleted file mode 100755
index 173ee8eb..00000000
--- a/link-estates
+++ /dev/null
@@ -1,448 +0,0 @@
-#!/usr/bin/env bash
-#
-# link-estates — place the symlinks that let every path a lane already uses
-# resolve into this repository. Idempotent; rehearses with --dry-run; never
-# deletes a real file.
-#
-# What it links:
-#   ~/projects/<estate>/handoffs   -> <workspace>/handoffs/<estate>
-#                                     for every handoffs/<estate>/ there whose
-#                                     ~/projects/<estate> exists on this
-#                                     workstation. The rest are reported and
-#                                     skipped: an estate this machine has not
-#                                     cloned gets no link.
-#   ~/projects/xFactory/LANES.md   -> <workspace>/lanes/LANES.md
-#   ~/projects/xFactory/lanes-edit.sh -> <the installed lanes-edit.sh>
-#
-# WHAT IT NO LONGER LINKS, and why (Amendment 9(f)(5)). It used to place
-# `~/.local/bin/lane-start` and `~/.local/bin/lane-end` as symlinks into the
-# workspace repository. Those two are INSTALLED COMMANDS now — regular files
-# `openRepoTools --install` places — and this script places neither. It is not
-# only redundancy: workBenches' `setup-estate-commands.sh` refuses the whole
-# estate install (exit 1) when any target "already exists as a symlink", and
-# `setup.sh` swallows that exit into one ⚠ line, so a host still carrying the
-# old symlinks looks set up and has no estate commands on it.
-#
-# The `lanes-edit.sh` link is KEPT AND REPOINTED at the installed command
-# rather than removed, because Amendment 8(e)'s SessionStart hook names
-# `~/projects/xFactory/lanes-edit.sh` as its command string and that string has
-# to keep working across the move.
-#
-# Why: lane-collision-protocol Rule 4 / Amendment 4 (handoffs live in the
-# person's workspace repository, reached through the estate-folder path) and
-# Rule 9 / Amendment 5 (the lane register lives there too). Every existing
-# path in every protocol, memory and habit keeps working because of these
-# links — nothing else has to be rewritten.
-#
-# Adopting a workspace repository on a new workstation is ONE command, and it
-# is not this one: `openRepoTools wip init` creates or clones it, writes the
-# pointer file and then runs this (Amendment 9(c) step 10). This is safe to run
-# by hand any time afterwards.
-#
-# TWO POINTERS, TWO QUESTIONS — and Amendment 9(f)(5) is careful about the
-# difference. `$AGENT_PROTOCOL_ROOT/workspace.yaml` answers *where the person's
-# data is*; `$OPENREPOTOOLS_BIN_DIR` answers *where the commands were
-# installed*. What Amendment 9(a) refuses is two answers to the SAME question,
-# which is exactly what deriving the workspace from this script's own location
-# was.
-#
-# Environment: PROJECTS_ROOT overrides ~/projects; OPENREPOTOOLS_BIN_DIR
-# overrides ~/.local/bin (where lanes-edit.sh was installed);
-# AGENT_PROTOCOL_ROOT overrides ~/.agents; LANES_WORKSPACE_ROOT overrides the
-# workspace checkout itself (the test seam).
-set -euo pipefail
-
-# --- THE WORKSPACE REPOSITORY (lane-collision-protocol Amendment 9(a)) -------
-#
-# The person's data — the register `lanes/LANES.md`, the object logs
-# `lanes/log/`, the handoffs, the manifests `park` writes, and a
-# `lanes/repos.tsv` override — is found through
-# `$AGENT_PROTOCOL_ROOT/workspace.yaml`, and NEVER from this file's own
-# location. `resume:466` and `status:1673` already read that same file under
-# that same name, and Amendment 9(a) mints no second one: a second way to find
-# it is a second answer.
-#
-# Deriving it from here stopped being POSSIBLE the moment this became an
-# installed regular file in `~/.local/bin` with no register anywhere near it,
-# and it stopped being WANTED for a subtler reason: a file's location on disk
-# is evidence about the file, not about a person's data.
-#
-# THESE FOUR FUNCTIONS ARE A DELIBERATE COPY, byte for byte, across
-# `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` — the same trade
-# openRepoTools already makes for its own fetch shim (`openRepoTools:93-100`).
-# A shared `lanes-common.sh` would be a TENTH file for `--install` to place and
-# a broken helper the first time somebody copied only some of them. Each of
-# these is one file a person has on PATH.
-#
-# FAILING TO FIND IT IS A REFUSAL, NEVER A GUESS. No file, no `path:`, no
-# `repository:`, or a `path:` that is not the root of a checkout of the
-# `repository:` named beside it → the caller refuses, exit 1 — the code
-# `lanes-edit.sh` has always used for *registry not found* — with the fix
-# named: `openRepoTools wip init`. Nothing here ever creates that file, writes
-# a register, or falls back to a path derived from its own location. THE
-# CHECKOUT TEST IS NEW: nothing validated it before this, so a `path:` pointing
-# at some other repository used to be accepted and now is not.
-#
-# `LANES_WORKSPACE_ROOT` is the test seam and the only override — the seam
-# `lane-start` already spelled for handoff resolution, widened to the whole
-# question so `test_lane_helpers.sh` can point every helper at one sandbox.
-# --- BEGIN shared workspace resolver (Amendment 9(a)) ----------------------
-# BYTE-IDENTICAL IN ALL FOUR LANE HELPERS, and held there by
-# `tests/test_repo_hygiene.py`. The estate commands carry the same discipline
-# for their own estate resolver and for the same reason its guard gives: a
-# drifted copy is TWO ANSWERS to one question, and "where is this person's
-# workspace" is exactly the question Amendment 9(a) exists to give one answer
-# to. Edit it in one file and the test names the other three.
-LANES_WS_WHY=""
-
-lanes_ws_yaml() { printf '%s\n' "${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"; }
-
-# `key: value` at the TOP LEVEL only, first occurrence, with an inline `#`
-# comment and surrounding quotes stripped and a leading `~` expanded against
-# $HOME (nothing expands a bare `~` inside a file). The anchored `^key:` never
-# reaches into the INDENTED `orgs:` map, which Amendment 9(a) puts out of
-# scope: these helpers read `repository:` and `path:` and nothing else, because
-# one register in the first workspace repository is the whole rule — the
-# register never follows that map. Two lines of sed, because a YAML parser is
-# not a dependency any of these files will take for one scalar.
-lanes_ws_field() {
-  local v
-  v="$(sed -n -e "s/^$1:[[:space:]]*//p" "$2" 2>/dev/null | head -n 1 |
-    sed -e 's/[[:space:]]*#.*$//' -e 's/[[:space:]]*$//')"
-  v="${v%\"}"; v="${v#\"}"
-  v="${v%\'}"; v="${v#\'}"
-  case "$v" in
-  '~') v="$HOME" ;;
-  '~/'*) v="$HOME/${v#'~/'}" ;;
-  esac
-  printf '%s\n' "$v"
-}
-
-# THE WORKSTATION'S NAME IS READ, NEVER INVENTED — AND NEVER `hostname` INSIDE A
-# CONTAINER (lane-collision-protocol Amendment 11, ratified decision 8(d), as
-# corrected by A11 Addendum 3's `R-A11-14`).
-#
-# WHAT WENT WRONG. `opensoft/brett-wip` `origin/main` carries SIX lines in
-# `lanes/log/openRepoProject-1.md` whose workstation is a container id — five
-# `@0e7d1a79a07e`, one `@55cceb3e5bc9` — in an append-only file, written by every
-# writer inside that container and not only by Evidence 6's fork. A row on a
-# workstation that does not exist is a row no reader can match, no crossing can
-# detect and no `swapped <ws>` can answer for; and the log is never rewritten, so
-# each one is wrong for ever.
-#
-# WHO OWNS THE VALUE. `R-A11-14`: the **workBenches launcher**, which runs on the
-# host and exports `LANES_WORKSTATION=<the host's own hostname -s>` into every
-# session AND every container it starts, beside the `CLAUDE_PROFILE_NAME` it
-# already exports. These helpers READ it. They do not write it, they do not
-# derive it from a second file, and THEY NEVER SUBSTITUTE A PLACEHOLDER: an
-# `@unknown-workstation` is the same defect one field along from the `unknown`
-# clause (e) refuses in the session field, and the rejected alternative — a
-# `workstation:` key in `workspace.yaml` — is a SECOND PLACE FOR THE TRUTH TO BE
-# WRONG beside the variable the launcher already sets.
-#
-# THE THREE ANSWERS, as `<name><TAB><source>`:
-#
-#   seam              `$LANES_WORKSTATION` is set. This is the ordinary case
-#                     wherever the launcher started the session.
-#   hostname          no seam, and this is NOT a container: `hostname -s`, which
-#                     is what the seam has defaulted to since Amendment 6 and
-#                     what every row written before this rung was written by.
-#   container-unset   no seam, and this IS a container. The NAME still answers,
-#                     because a read in front of every launch may not refuse —
-#                     it will simply match nothing, which is the honest answer —
-#                     but every WRITER refuses, exit 2, naming the variable and
-#                     the launcher that sets it.
-#
-# IT ANSWERS AS A PAIR, AND THAT IS NOT A STYLE CHOICE. A caller reads the name
-# with `$(lanes_workstation)`, which is a COMMAND SUBSTITUTION and therefore a
-# subshell: a global the function set there dies with it. The source is on the
-# same line as the name, which is the only way out of a subshell there is.
-#
-#   $LANES_IN_CONTAINER   1 or 0, forcing the probe. THE TEST SEAM, and nothing
-#                         else sets it: the suite must be able to exercise both
-#                         halves of this rule on one host, and the host it runs
-#                         on is a container exactly when it is.
-lanes_in_container() {
-  case "${LANES_IN_CONTAINER:-}" in
-  1) return 0 ;;
-  0) return 1 ;;
-  esac
-  [ -e /.dockerenv ] || [ -e /run/.containerenv ]
-}
-
-lanes_workstation_pair() {
-  local v
-  if [ -n "${LANES_WORKSTATION:-}" ]; then
-    printf '%s\t%s\n' "$LANES_WORKSTATION" seam
-    return 0
-  fi
-  v="$(hostname -s 2>/dev/null || hostname 2>/dev/null || printf 'unknown')"
-  if lanes_in_container; then
-    printf '%s\t%s\n' "$v" container-unset
-  else
-    printf '%s\t%s\n' "$v" hostname
-  fi
-}
-
-# THE NAME ALONE, which is what every writer of the workstation column wants.
-lanes_workstation() { lanes_workstation_pair | cut -f1; }
-
-# The ONE SENTENCE a writer refuses with, in one place, so the three writers
-# cannot word it three ways. Empty on every other source, so
-# `[ -n "$(lanes_workstation_why "$src")" ]` is the whole of the test.
-lanes_workstation_why() {   # <source>
-  [ "${1:-}" = container-unset ] || return 0
-  printf '%s\n' "this is a container and \$LANES_WORKSTATION is not set, so there is no workstation name to write. This host's own \`hostname\` is the CONTAINER'S id, not a workstation, and a row on a workstation that does not exist is a row no reader can match — in a log nothing ever rewrites (Amendment 11, decision 8(d); R-A11-14). The value is the workBenches launcher's to export into every session and container it starts. Set it for this one and re-run: export LANES_WORKSTATION=<this host's name>"
-}
-
-# One of the spellings `git remote get-url origin` prints for one GitHub
-# repository, reduced to a bare lowercased `<owner>/<name>` so it can be
-# compared against workspace.yaml's own `<owner>/<name>`. A URL that is not
-# GitHub's is compared as it stands, lowercased — which is what lets a sandbox
-# name a bare local origin and still be checked.
-lanes_ws_norm() {
-  local u="${1%.git}"
-  case "$u" in
-  https://github.com/*) u="${u#https://github.com/}" ;;
-  ssh://git@github.com/*) u="${u#ssh://git@github.com/}" ;;
-  git@github.com:*) u="${u#git@github.com:}" ;;
-  esac
-  printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
-}
-
-# Do these two name one repository? Equal after normalisation, OR the origin's
-# path ENDS in the `<owner>/<name>` the pointer file spells — which is how a
-# GitHub Enterprise host, an ssh alias and a local bare mirror laid out by
-# owner and name all say the same thing as `https://github.com/<owner>/<name>`.
-# The pointer file spells `<owner>/<name>` because that is what a person types;
-# `git remote get-url` spells a URL because that is what git stores.
-lanes_ws_same_repo() {
-  local a b
-  a="$(lanes_ws_norm "$1")"
-  b="$(lanes_ws_norm "$2")"
-  [ -n "$a" ] && [ -n "$b" ] || return 1
-  [ "$a" = "$b" ] && return 0
-  case "$a" in */"$b") return 0 ;; esac
-  return 1
-}
-
-# Prints the workspace checkout's real root, or returns 1 having set
-# $LANES_WS_WHY to the one sentence that says which of the five ways it failed.
-# ROOT-NESS IS ITS OWN CHECK: `rev-parse --is-inside-work-tree` and
-# `remote get-url origin` both succeed from any SUBDIRECTORY of a work tree, so
-# a `path:` naming a subdirectory would otherwise be accepted and resolve
-# `<path>/lanes/LANES.md` inside the wrong directory.
-lanes_workspace_root() {
-  local yaml repo path origin toplevel real
-  LANES_WS_WHY=""
-  if [ -n "${LANES_WORKSPACE_ROOT:-}" ]; then
-    printf '%s\n' "$LANES_WORKSPACE_ROOT"
-    return 0
-  fi
-  yaml="$(lanes_ws_yaml)"
-  if [ ! -r "$yaml" ]; then
-    LANES_WS_WHY="there is no $yaml"
-    return 1
-  fi
-  repo="$(lanes_ws_field repository "$yaml")"
-  path="$(lanes_ws_field path "$yaml")"
-  if [ -z "$repo" ]; then
-    LANES_WS_WHY="$yaml names no \`repository:\`"
-    return 1
-  fi
-  if [ -z "$path" ]; then
-    LANES_WS_WHY="$yaml names no \`path:\`"
-    return 1
-  fi
-  if ! git -C "$path" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    LANES_WS_WHY="$yaml names path: $path, which is not a git checkout"
-    return 1
-  fi
-  origin="$(git -C "$path" remote get-url origin 2>/dev/null || :)"
-  if ! lanes_ws_same_repo "$origin" "$repo"; then
-    LANES_WS_WHY="$yaml names repository: $repo, but $path is a checkout of ${origin:-no origin at all}"
-    return 1
-  fi
-  toplevel="$(git -C "$path" rev-parse --show-toplevel 2>/dev/null || :)"
-  real="$(cd -- "$path" 2>/dev/null && pwd -P)" || real=""
-  if [ -z "$real" ] || [ "$toplevel" != "$real" ]; then
-    LANES_WS_WHY="$yaml names path: $path, which is not the ROOT of that checkout (${toplevel:-unknown} is)"
-    return 1
-  fi
-  printf '%s\n' "$real"
-}
-
-# The refusal's body, so all four helpers say the same thing in the same words.
-#
-# THE REASON IS RE-DERIVED HERE, IN THE PARENT SHELL, and that is the whole
-# point of this line. Every caller reaches the resolver through a command
-# substitution — `LANES_WS_ROOT="$(lanes_workspace_root || :)"` — which runs it
-# in a SUBSHELL, so the $LANES_WS_WHY it set died with that subshell and the
-# parent still holds the empty string it started with. Six distinct diagnoses
-# were being computed and all six were being thrown away; every one of the
-# refusals Amendment 9(a) enumerates printed the same "no reason recorded".
-# The resolver is read-only and cheap — two `sed`s and three `git` reads — and
-# it is reached on the refusal path only, so running it again HERE is the one
-# place its answer survives to be printed.
-lanes_workspace_why() {
-  [ -n "$LANES_WS_WHY" ] || lanes_workspace_root >/dev/null 2>&1 || :
-  printf '%s' "the workspace repository could not be found — ${LANES_WS_WHY:-no reason recorded}.
-    Amendment 9(a): every lane helper reads \`repository:\` and \`path:\` from
-    $(lanes_ws_yaml), never from its own location. One command writes that
-    file, creates or clones the repository and places the symlinks:
-        openRepoTools wip init"
-}
-# --- END shared workspace resolver ------------------------------------------
-
-projects_root="${PROJECTS_ROOT:-$HOME/projects}"
-bin_dir="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-dry_run=0
-
-case "${1:-}" in
-  "") ;;
-  --dry-run) dry_run=1 ;;
-  -h|--help)
-    echo "Usage: link-estates [--dry-run]"
-    exit 0
-    ;;
-  *) echo "Unknown option: $1" >&2; exit 2 ;;
-esac
-
-# THE WORKSPACE, not this file's parent. `:33` used to be
-# `repo_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)"`, and it
-# did not even `readlink -f` first, unlike its two siblings — so as an
-# installed command in `~/.local/bin` that resolved to `$HOME/.local` and it
-# died at the handoffs check. Amendment 9(a) answers the question properly.
-repo_dir="$(lanes_workspace_root || :)"
-if [[ -z "$repo_dir" ]]; then
-  printf 'Error: %s\n' "$(lanes_workspace_why)" >&2
-  exit 1
-fi
-
-# THE LINK TARGET FOR `lanes-edit.sh` IS THE INSTALLED COMMAND, and its absence
-# is a refusal that places NOTHING (Amendment 9(f)(5)). Linking to a file that
-# is not there would leave `~/projects/xFactory/lanes-edit.sh` dangling — which
-# is also the hook's command string, so the failure would be met at every
-# session start rather than here.
-lanes_edit_cmd="$bin_dir/lanes-edit.sh"
-if [[ ! -x "$lanes_edit_cmd" ]]; then
-  echo "Error: no lanes-edit.sh at $lanes_edit_cmd, so the register's writer cannot be linked." >&2
-  echo "       It is placed there by \`openRepoTools --install\`. Run that first; nothing was linked." >&2
-  exit 1
-fi
-
-[[ -d "$repo_dir/handoffs" ]] || { echo "Error: no handoffs/ in $repo_dir" >&2; exit 1; }
-[[ -d "$repo_dir/lanes" ]]    || { echo "Error: no lanes/ in $repo_dir" >&2; exit 1; }
-[[ -d "$projects_root" ]]     || { echo "Error: no projects root: $projects_root" >&2; exit 1; }
-
-stamp="$(date -u +%Y%m%dT%H%M%SZ)"
-linked=0; kept=0; skipped=0; aside=0; stale_links=0
-
-# Never delete a real file, a real directory, or anything whose bytes differ
-# from what is tracked here. Move it out of the way with a stamped suffix so
-# the previous state stays recoverable by hand — the habit scripts/link-home
-# established in brettheap/new-workstation, and the one Amendment 4(f) names.
-move_aside() {
-  local live=$1
-  local target="$live.pre-link-estates-$stamp"
-  if (( dry_run )); then
-    printf 'PLAN  move aside  %s -> %s\n' "$live" "$target"
-  else
-    mv -- "$live" "$target"
-    printf 'ASIDE %s -> %s\n' "$live" "$target"
-  fi
-  aside=$((aside + 1))
-}
-
-link() {
-  local target=$1 live=$2
-  if [[ -L "$live" ]]; then
-    if [[ -e "$live" && "$(readlink -f -- "$live")" == "$(readlink -f -- "$target")" ]]; then
-      printf 'KEEP  %s -> %s\n' "$live" "$target"
-      kept=$((kept + 1))
-      return
-    fi
-    # A symlink pointing somewhere else, or a dangling one. Relinking loses
-    # nothing: the bytes are wherever it pointed, and this prints where.
-    printf 'RELINK %s (was -> %s)\n' "$live" "$(readlink -- "$live")"
-    if (( dry_run )); then
-      printf 'PLAN  relink     %s -> %s\n' "$live" "$target"
-      return
-    fi
-    rm -- "$live"
-  elif [[ -e "$live" ]]; then
-    if [[ -f "$live" && -f "$target" ]] && cmp -s -- "$live" "$target"; then
-      if (( dry_run )); then
-        printf 'PLAN  replace identical file with link  %s\n' "$live"
-        return
-      fi
-      rm -- "$live"
-    else
-      move_aside "$live"
-      (( dry_run )) && { printf 'PLAN  link       %s -> %s\n' "$live" "$target"; return; }
-    fi
-  elif (( dry_run )); then
-    printf 'PLAN  link       %s -> %s\n' "$live" "$target"
-    return
-  fi
-  ln -s -- "$target" "$live"
-  printf 'LINK  %s -> %s\n' "$live" "$target"
-  linked=$((linked + 1))
-}
-
-# ---- handoffs: one link per estate this workstation actually has ----------
-# A GLOB, not `find … -print0 | sort -z` (A9 Addendum 4, R-A9-11): `sort -z` is
-# GNU-only and there is no portable NUL sort to swap it for, while a glob is
-# ordered by the shell itself, needs no second process, and carries a name with
-# a newline in it — which is the only thing the NUL was ever protecting. An
-# empty or absent `handoffs/` leaves the pattern unexpanded and `-d` refuses it.
-for estate_dir in "$repo_dir"/handoffs/*/; do
-  [[ -d "$estate_dir" ]] || continue
-  estate_dir="${estate_dir%/}"
-  estate="$(basename -- "$estate_dir")"
-  if [[ ! -d "$projects_root/$estate" ]]; then
-    printf 'SKIP  %s — no %s on this workstation\n' "$estate" "$projects_root/$estate"
-    skipped=$((skipped + 1))
-    continue
-  fi
-  link "$estate_dir" "$projects_root/$estate/handoffs"
-done
-
-# ---- the lane register, reached from the aggregation folder ---------------
-# Rule 9's paths, unchanged since 2026-09-09 and unchanged by Amendment 5 —
-# only what they point AT changed.
-if [[ -d "$projects_root/xFactory" ]]; then
-  link "$repo_dir/lanes/LANES.md" "$projects_root/xFactory/LANES.md"
-  # THE WRITER'S LINK NOW CROSSES THE SEAM: the register is data in the
-  # workspace repository, its writer is a command in the bin directory, and
-  # this one link is what keeps Amendment 8(e)'s hook string
-  # `~/projects/xFactory/lanes-edit.sh session-start || true` working after
-  # the move.
-  link "$lanes_edit_cmd" "$projects_root/xFactory/lanes-edit.sh"
-else
-  printf 'SKIP  the lane register — no %s on this workstation\n' "$projects_root/xFactory"
-  skipped=$((skipped + 1))
-fi
-
-# ---- the two ends of a lane are NOT linked any more ------------------------
-# `openRepoTools --install` places `lane-start` and `lane-end` as regular files
-# in the bin directory. A host upgrading from the pre-move world still carries
-# this script's old symlinks at those paths; they are reported here, with the
-# one command that replaces them, because leaving them is what makes
-# workBenches' estate install refuse the whole set (Amendment 9(f)(3)).
-for stale in lane-start lane-end; do
-  if [[ -L "$bin_dir/$stale" ]]; then
-    printf 'STALE %s is still a symlink -> %s\n' "$bin_dir/$stale" "$(readlink -- "$bin_dir/$stale")"
-    printf '      It is an installed command now. Remove it and run `openRepoTools --install`:\n'
-    printf '        rm %s && openRepoTools --install\n' "$bin_dir/$stale"
-    stale_links=$((stale_links + 1))
-  fi
-done
-case ":${PATH:-}:" in
-  *":$bin_dir:"*) : ;;
-  *) printf 'NOTE  %s is not on this shell'"'"'s PATH — add it, or call the commands by path\n' "$bin_dir" ;;
-esac
-
-printf -- '----\n%s linked, %s already right, %s skipped, %s moved aside, %s stale%s\n' \
-  "$linked" "$kept" "$skipped" "$aside" "$stale_links" \
-  "$( (( dry_run )) && printf ' (PLAN only — nothing was written)' )"
diff --git a/openRepoTools b/openRepoTools
index ca4fc449..ff432c6d 100755
--- a/openRepoTools
+++ b/openRepoTools
@@ -1,407 +1,68 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: Apache-2.0
 #
-# openRepoTools — the short way to put the estate commands on your PATH.
+# openRepoTools — THE ASSEMBLY'S FRONT DOOR, and nothing else.
 #
-# Install them once, from anywhere, with no checkout and no clone:
+# The installer is the CODE leg's `openRepoTools`. This file is the one the
+# documented one-liners still fetch from this repository's root:
 #
+#   curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/openRepoTools | bash -s -- --install
 #   gh api repos/opensoft/openRepoTools/contents/openRepoTools \
 #       -H 'Accept: application/vnd.github.raw' | bash -s -- --install
 #
-# (or the raw-URL twin, `curl -fsSL …/main/openRepoTools | bash -s -- --install`).
-#
-# IT INSTALLS THE ESTATE'S COMMANDS, AND IT OWNS THE ONE ACT THAT CREATES THE
-# WORKSPACE THOSE COMMANDS READ. `openRepoShape` is the standard's front door
-# and stays there: this scaffolds no product repository, and that refusal is
-# not ours to touch. The two verbs are `park` and `resume`, which add no
-# mechanics of their own — they find the estate under your projects directory
-# and run its own `make park` / `make resume` — and `status` is the read-only
-# view of the same estate.
-#
-# THIS FILE USED TO SAY "There is no verb here and no scaffold", and that line
-# is gone on purpose rather than by accident. Brett Heap RULED the command —
-# lane-collision-protocol Amendment 9, ruling 4, verbatim "openRepoTools wip
-# init" — so the line, the `*)` arm and the test that pinned them are what
-# change (Amendment 9(b), and R-A9-1). The identity that survives is narrower
-# and truer.
-#
-# `--install` PLACES SEVENTEEN FILES, not four: this file, `park`, `resume`,
-# `status` (openRepoShape #82; the fourth under Brett Heap's RULING of
-# 2026-09-10 in this repository, "lets go with a fourth file"), `lane` and
-# `lanes` (lane-collision-protocol Amendment 18 Addendum 1 and Amendment 11's
-# ratified decision 6 — `lane` is where `restart` was, Addendum 2 having retired
-# that word from the PATH), `lane-handoff` (Amendment 17(a), ratified
-# 2026-09-14: the swap IS the handoff, and this is its shell form),
-# `lane-rename` (Amendment 16, ratified 2026-09-14: a lane is renamed by ONE
-# WORD, in ONE COMMIT, and its old name resolves for ever), and the four
-# lane helpers `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` with
-# the alias table `repos.tsv` they read — which came here from
-# `opensoft/brett-wip` with their history under Amendment 9(b), because a
-# person's workspace repository holds their DATA and the code belongs where code
-# goes — `claude-current` and `claude-restart-check`
-# (opensoft/workBenches#119, Brett Heap's home ruling of 2026-09-29: the Claude
-# Code a launch starts, and the RESTART NEEDED line a running session shows) —
-# `lanes-index` (opensoft/openRepoTools#160, lane-collision-protocol
-# Amendment 14, ratified by Brett Heap 2026-10-05: the DERIVED INDEX of the lane
-# register, which nothing that acts reads) — and `lane-worktrees`
-# (opensoft/openRepoTools#162, on Brett Heap's word of 2026-10-05, "build 162":
-# the sweep that retires a lane's abandoned worktrees, rescue first). It also
-# places THREE skills,
-# `/handoff`, `/lane-swap` and `/restart`, at two paths each, THREE command
-# files, `/handoff`, `/ctx` and `/swap`, at that same pair of paths (A11
-# Addendum 4 ruling 9; Amendment 17(a) and (f)), and merges TWO hook entries into
-# `~/.claude/settings.json` — the `SessionStart` one (Amendment 9(b), A8
-# Addendum 2 R-A8-5) and, since lane-collision-protocol Amendment 12 adoption
-# act 3, the `UserPromptSubmit` NAME GUARD beside it — both of them only once
-# `~/projects/xFactory/lanes-edit.sh`, the path they call, answers `guard`
-# (opensoft/openRepoTools#237): TWENTY-NINE artifacts always, plus the two hook
-# entries once that path answers, and the count is the invariant.
-#
-# One install line for the whole toolset, so a second engineer gets the estate
-# commands from the README's one line and nothing depends on anyone's dotfiles.
-#
-# openRepoShape #82 wrote the two verbs and these install semantics; its #92
-# carved them out into this repository, which added `status`; lane protocol
-# Amendment 9 brought the lane tooling home and added `wip init`.
+# and the one `./openRepoTools` runs in a checkout of this repository. It
+# SELECTS the implementation `contracts/code-pin.yaml` pins and hands it every
+# argument. It places nothing, merges nothing, writes no receipt and retires
+# nothing — every one of those is the implementation's, which is also what
+# `--install` puts on a PATH, so an installed `openRepoTools` never needs this
+# file or a checkout of this repository again (opensoft/openRepoTools#186,
+# T007; `specs/004-migrate-to-triad/installer-design.md`).
+#
+#   * IN A CHECKOUT (this file beside `contracts/code-pin.yaml`): the pin, the
+#     gitlink at its `submodule_path` and the implementation's bytes must name
+#     ONE commit, and then this EXECs `<submodule_path>/openRepoTools` with
+#     every argument — the same process, so its exit status and every signal
+#     are the implementation's own. That implementation then checks the rest
+#     of the payload against the same pin before it copies a byte.
+#   * ANYWHERE ELSE (stdin, or a copy of this file on its own): `$OPENREPOTOOLS_REF`
+#     is resolved ONCE to a commit of `$OPENREPOTOOLS_REPO`, the code pin is
+#     read AT that commit, and the gitlink at its `submodule_path` in that
+#     commit must name the pinned commit too — the lockstep rule, checked HERE,
+#     before any implementation is fetched or run, so a stale or rolled-back pin
+#     is named as what it is rather than left to whichever code it selects.
+#     Then the implementation is fetched from the pinned repository AT the
+#     pinned commit and run from stdin — the way the one-liners always ran it —
+#     with `$OPENREPOTOOLS_REF` set to that commit, so the implementation reads
+#     the same pin and no branch that moves in between can give it another.
+#     Reading the gitlink is one level of the assembly's tree: `gh api --jq`,
+#     or `curl` with `jq` (an adopted assembly's one-liner needs api.github.com).
+#
+# NOTHING HERE ASSUMES A FILE THE LEGS MAY NOT CARRY: no `.gitattributes`, no
+# README, no AGENTS.md. Bytes are compared raw (`hash-object --no-filters`).
+#
+# bash 3.2 (macOS's /bin/bash): no `${x,,}`, `mapfile`, `declare -A` or
+# `local -n`, as everywhere in this project.
 
 set -euo pipefail
 
-# $OPENREPOTOOLS_REPO is an owner/name slug: it is an API path and a raw-URL
-# path, and nothing here clones. Name a fork or a mirror once and both fetch
-# forms follow it.
 REPO="${OPENREPOTOOLS_REPO:-opensoft/openRepoTools}"
 REF="${OPENREPOTOOLS_REF:-main}"
 SELF="${BASH_SOURCE[0]:-$0}"
+PIN_FILE="contracts/code-pin.yaml"
 
-MODE=""
-WORKDIR=""
-STAGED=""
-# THE PREFIX OF THE TEMPORARY A PLACEMENT IS MAKING (#167), named here for the
-# `EXIT` trap `workdir` sets, which removes `"$PLACING"*`: `place_by_rename`
-# removes its temporary on every failure it sees, and this is what removes it
-# on the ones it cannot see — a signal, or an `errexit`. A PREFIX, set before
-# `mktemp` runs, so no instant exists in which the file is there and the trap
-# does not know its name (Copilot round 2 on #172).
-PLACING=""
-
-say() { printf '%s\n' "$*"; }
 die() { printf '\nREFUSED: %s\n' "$1" >&2; exit "${2:-2}"; }
 
-usage() {
-	cat <<'USAGE'
-openRepoTools --install            install (or update) the seventeen estate and
-                                   lane commands into ~/.local/bin, plus the
-                                   /handoff, /lane-swap and /restart skills, the
-                                   /handoff, /ctx and /swap command files, the
-                                   SessionStart hook entry and the
-                                   UserPromptSubmit name guard, once
-                                   ~/projects/xFactory/lanes-edit.sh
-                                   answers `guard`
-openRepoTools wip init             create your workspace repository, clone it,
-                                   seed it, and point this workstation at it
-openRepoTools --help | --version
-
-`openRepoShape` is the standard's front door and scaffolds product
-repositories; this command scaffolds none. `--install` places seventeen files
-beside each other — this command, the two verbs, the read-only view, the four
-lane words, the four lane helpers, the alias table they read, the two Claude
-Code launch commands, the derived index of the lane register and the worktree
-sweep:
-
-  park [<Name>]                    commit, push and RECORD an estate's open
-                                   features, so another workstation can take
-                                   the work up
-  resume [<Name>]                  clone or fast-forward that estate here and
-                                   recreate those features
-  status [<Name>]                  what is in and out of sync across that
-                                   estate, as of the last fetch; changes nothing
-  lane [<name> [<profile>]]        the lanes, NUMBERED, and one question: the
-                                   one you pick is bound — a parked lane
-                                   through the launcher in its own directory
-                                   and profile, one live here by attaching to
-                                   its window, one bound elsewhere by naming
-                                   where. With no terminal it asks nothing
-  lanes [--all] [--fetch]          inside a checkout: that repository's lanes
-                                   and the next free position, filled in;
-                                   outside one, or with --all, every lane.
-                                   Reads locally, changes nothing, asks nothing
-  lane-start <repo> <n>            open a lane: name the window, register the
-                                   row, launch or resume the session — with
-                                   --agent <name>, from any agent that can read
-                                   the lane (Amendment 17(c))
-  lane-handoff [--restart|--exit]  hand this lane off: the identity triple, the
-                                   handoff refreshed, the writers polled, the
-                                   PAUSED record written, the restart line
-                                   printed. --restart is /ctx; --exit ends the
-                                   session a second place asked for the lane
-  lane-end <lane>                  close it, and refuse while anything is in
-                                   flight or any tree, branch, scratch or cache
-                                   of it is still on disk (--inventory-only
-                                   ends it anyway, and says so)
-  lane-rename <old> <new>          rename it: the row, the object log, the
-                                   handoff and lanes/aliases.tsv in ONE commit,
-                                   one comment per object it holds, and the old
-                                   name resolving for ever (Amendment 16)
-  lanes-edit.sh <verb> …           the register's and the object logs' only
-                                   writer
-  link-estates                     place the symlinks every lane path already
-                                   uses, into your workspace repository
-  repos.tsv                        the organisation's alias table, which
-                                   `lanes-edit.sh` reads
-  claude-current [--porcelain]     the Claude Code a launch starts: npm's
-                                   published version, updated when behind and
-                                   verified with --version, by absolute path
-                                   and never through PATH (lane-start uses it)
-  claude-restart-check             one RESTART NEEDED line for a running
-                                   session whose binary moved on disk, for the
-                                   shared status line to print
-  lanes-index sync|reconcile|status
-                                   the DERIVED INDEX of the lane register
-                                   (Amendment 14): written behind the sources,
-                                   read only by lanes --index and
-                                   history --index
-  lane-worktrees sweep <lane>      retire a lane's abandoned worktrees: a dry
-                                   run by default; --yes pushes or rescues
-                                   first and removes only what is on origin
-                                   or in a bundle, never a live writer's
-  lane-worktrees add <lane> <slice>
-                                   make a lane's worktree and record it in the
-                                   lane's inventory, in one act
-
-`--install` also places THREE SKILLS at two paths each —
-`~/.claude-profiles/shared/skills/<name>/SKILL.md` and
-`~/.claude/skills/<name>/SKILL.md`, for `handoff`, `lane-swap` and `restart` —
-and THREE COMMAND FILES at the matching pair,
-`~/.claude-profiles/shared/commands/<name>.md` and `~/.claude/commands/<name>.md`,
-for `handoff`, `ctx` and `swap`. `handoff` is the act itself (Amendment 17(a));
-`/ctx` is `/handoff --restart` (clause (f)); `/swap` and `/lane-swap` are the
-aliases the amendment keeps so that nothing written about them stops working,
-and each adds nothing to the skill it names. It merges TWO entries into
-`~/.claude/settings.json` — the `SessionStart` one and, since
-lane-collision-protocol Amendment 12, the `UserPromptSubmit` NAME GUARD, which
-refuses a prompt whose window, session name and register row are not one lane
-(needs `jq`, refuses rather than rewriting a file it cannot parse, and leaves
-every `UserPromptSubmit` hook of your own exactly where it is). It merges the
-two only once `~/projects/xFactory/lanes-edit.sh`, the path both call, exists,
-is executable and answers `guard` — the launcher's own rule (#237). Until then
-it says it DEFERRED them, and takes its own guard entry back out of a file that
-already carries it; `wip init` merges them after `link-estates` links that
-path. It never writes a profile's own settings.json: the launcher owns that one.
-
-It then writes a RECEIPT of the files it placed — one row of
-`<name> <destination> <sha256> <UTC>` each — at
-`${OPENREPOTOOLS_DATA_DIR:-${XDG_DATA_HOME:-~/.local/share}/openRepoTools}/installed.tsv`,
-mode 0600. That is how a later `--install` knows that a command it is about to
-RETIRE is a copy it wrote rather than a file of yours that happens to carry the
-same header: a digest that still matches is removed, one that has moved — or a
-row it cannot check, for want of a digest tool — is named and left for you. A
-receipt it cannot write is one line on this terminal and never a refused
-install.
-
-`/restart` is the INSIDE half and has to be a skill: a running session cannot
-`exec` a launcher over itself, so it binds the window, stamps the record
-through `lane-start --no-launch` and prints — never a picker (Amendment 11
-clause (f), ratified decisions 3 and 7). `lane` is the OUTSIDE half, and it is
-the whole of what a person is given: `restart` left the PATH under Amendment 18
-Addendum 2 (ratified 2026-09-14T16:50:32Z, verbatim "ratify").
-
-`wip init` — the workspace repository, which holds your lane register, your
-object logs, your handoffs and your workspace manifests, and no code at all:
-
-  openRepoTools wip init [--org <org>] [--login <name>] [--team <team>]
-                         [--dry-run]
-
-It asks you at most one question, and only where an administrator has to create
-the repository for you — then it prints the exact commands, already filled in.
-Everything else is derived: your login from `gh api user`, the organisation
-from this toolset's own default, the team from `gh api /user/teams` where
-exactly one matches. Idempotent: a workstation that already has a workspace
-does nothing to it, and only completes the hook pair — running `link-estates`
-again first where that path does not answer and ~/projects/xFactory exists.
-Exits 0 (done, or already done) or 2 (refused); a hook reconcile it cannot
-make is printed, and the exit stays 0.
-
-`park --help`, `resume --help`, `status --help`, `lane-start --help` and
-`lane-end --help` say the rest, and each command's exit codes are its own. The
-two verbs implement none of the mechanics: they find the estate under your
-projects directory and run its own `make park` / `make resume`, which run the
-Speckit git extension's scripts. `status` only reads.
-
-  $OPENREPOTOOLS_REPO       owner/name to fetch from (default opensoft/openRepoTools)
-  $OPENREPOTOOLS_REF        the ref to fetch it at   (default main)
-  $OPENREPOTOOLS_BIN_DIR    where --install puts them (default ~/.local/bin)
-  $OPENREPOTOOLS_DATA_DIR   where the receipt goes    (default
-                            $XDG_DATA_HOME/openRepoTools)
-  $XDG_DATA_HOME            the data root it falls back to (default ~/.local/share)
-  $AGENT_PROTOCOL_ROOT      where workspace.yaml lives (default ~/.agents)
-  $CLAUDE_PROFILES_HOME     the profiles root         (default ~/.claude-profiles)
-  $PROJECTS_DIR             your projects directory   (default ~/projects)
-USAGE
-}
-
-# THE TRAP BELONGS TO THE SHELL THAT DOES THE WRITING, so this makes the
-# directory and takes no output. A `$(workdir)` would be a COMMAND
-# SUBSTITUTION — a subshell, whose `trap … EXIT` fires the instant the
-# substitution closes, so `rm -rf` would run before a single fetched byte had
-# landed and $WORKDIR out here would still be empty (openRepoShape #74). A trap
-# only ever fires in the shell that set it. Callers read $WORKDIR.
-workdir() {
-	if [ -z "$WORKDIR" ]; then
-		WORKDIR="$(mktemp -d)"
-		trap 'rm -rf -- "$WORKDIR"; [ -z "$PLACING" ] || rm -f -- "$PLACING"*' EXIT
-	fi
-}
-
-# THE API FIRST, the raw URL second. `gh api` is authenticated, so it still
-# works inside an organisation whose policy blocks raw.githubusercontent.com;
-# curl is the fallback for a machine with no `gh`. Each attempt writes to a
-# file and is checked before its bytes are used, so a half-written first
-# attempt is never mistaken for a fetch.
-#
-# THESE FORTY LINES ARE A DELIBERATE COPY of openRepoShape's own shim, and the
-# duplication is the cheaper of the two mistakes: a shared `orp-fetch.sh` would
-# be a FIFTH FILE for `--install` to place, and a broken installer the first
-# time somebody copied only some of them. It is the same argument the estate
-# resolver inside `park`, `resume` and `status` already carries, for the same
-# reason — each of these files is one file a person has on PATH. Two installers that
-# fetch the same way is a claim `tests/test_openrepotools_command.py` and
-# openRepoShape's own suite each assert against their own script's text.
-#
-# WHAT IT FETCHES FROM IS THE ONE THING THAT MOVED (#186, T007): the CURRENT
-# SOURCE, `$PAYLOAD_REPO` at `$PAYLOAD_REV`, which is `$REPO` itself until
-# `payload_resolve_remote` has read and checked `$REPO`'s own code pin, and the
-# repository that pin names after that. For a single repository it never
-# moves: `$REPO` at `$REF`, exactly as it always was.
-fetch_from_repo() {
-	local path="$1" dest="$2"
-	if command -v gh >/dev/null 2>&1 &&
-		gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/$path?ref=${PAYLOAD_REV:-$REF}" \
-			-H 'Accept: application/vnd.github.raw' >"$dest" 2>/dev/null &&
-		[ -s "$dest" ]; then
-		return 0
-	fi
-	if command -v curl >/dev/null 2>&1 &&
-		curl -fsSL "https://raw.githubusercontent.com/${PAYLOAD_REPO:-$REPO}/${PAYLOAD_REV:-$REF}/$path" \
-			>"$dest" 2>/dev/null && [ -s "$dest" ]; then
-		return 0
-	fi
-	# RETURNS rather than dying, so a caller fetching SEVERAL files can report
-	# the whole set instead of stopping mid-way through an install
-	# (openRepoShape #82, F10 of the review on its #83).
-	return 1
-}
-
-# ------------------------------------------------ WHERE THE PAYLOAD COMES FROM
-#
-# opensoft/openRepoTools#186 — T007 of `specs/004-migrate-to-triad/tasks.md`,
-# on `specs/004-migrate-to-triad/installer-design.md`. There are TWO LAYOUTS,
-# and this asks which one it is looking at rather than guessing:
-#
-#   * A SINGLE REPOSITORY — `opensoft/openRepoTools` today — carries every
-#     payload file at its root. NOTHING ABOUT IT CHANGES: a directory beside
-#     this file that holds every payload file (a checkout, workBenches'
-#     vendored tree) is copied with no network at all, byte for byte and line
-#     for line what it always was; one that holds only some of them copies
-#     those and fetches the rest; and a run from stdin fetches them all.
-#   * AN ADOPTED ASSEMBLY — the same slug after the triad split — carries
-#     `contracts/code-pin.yaml`, which names the CODE repository and commit,
-#     and a gitlink at the pinned path that must agree with it. The payload is
-#     that repository's, at that commit, and nothing else's.
-#
-# A SINGLE REPOSITORY IS READ EXACTLY AS IT ALWAYS WAS: `$OPENREPOTOOLS_REF`
-# as given, file by file, by `gh api …/contents` and then the raw URL — no
-# other host, no `jq`, no fallback that was not there before. The one request
-# it makes that it did not make before is the question below, by those same
-# two transports, and it prints nothing. Only an ADOPTED ASSEMBLY resolves the
-# ref:
-# `$OPENREPOTOOLS_REF` becomes a commit on the first API round trip and every
-# request after it names that commit, so a branch that moves while the files
-# come down cannot hand one run two versions. That guarantee needs
-# api.github.com (and `jq` on the `curl` path), which a single repository's
-# install never needed and still does not: today's layout keeps today's
-# network needs, byte for byte (#191's review). `$OPENREPOTOOLS_REPO` and
-# `$OPENREPOTOOLS_REF` mean what they always meant: what to install from, and
-# at which ref.
-#
-# WHICH LAYOUT IS DECIDED BY AN ANSWER, NEVER BY A FAILURE. One file is asked
-# for by name at `$REF`, through `fetch_from_repo`'s own two transports
-# (`probe_path`): `contracts/code-pin.yaml`. A pin that is there is the adopted
-# layout. GitHub's 404 for it is a single repository, read as above. An
-# authentication failure, a rate limit, a transport failure or any other status
-# from both transports is a REFUSAL naming what answered — never evidence of
-# the older layout, because reading it that way would install whatever the
-# assembly root happened to carry. NOTHING ELSE IS ASKED on that 404: a second
-# question (the adoption manifest, `project.yaml`) would be a second request on
-# today's layout for a state the adopter never publishes — it writes the pin
-# and the manifest in one commit — and that `make validate` refuses in the
-# assembly itself (#191's review).
-#
-# A PIN THAT IS PRESENT AND WRONG REFUSES. Its grammar is fixed, so it is read
-# here with `read` and `case` rather than a YAML runtime (`pin_parse`), and
-# every field is checked. The payload repository is the pin's own
-# `source_repository`, never a name made by appending `-code` to a fork's: a
-# fork follows the pin it actually carries.
-#
-# WHAT A REMOTE INSTALL DOES NOT CLAIM: the pin's `tree_sha256`. That digest is
-# over the code leg's WHOLE tree and is the composed validator's to recompute
-# (`scripts/validate-pins.py` in the assembly). What is verified here is the
-# identity this run consumes — the commit the ref names, the gitlink at the
-# pinned path, and that the pinned commit is one the pinned repository has.
-#
-# LOCALLY — this file run from the code leg MOUNTED in an assembly checkout,
-# `<root>/<submodule_path>`, whose `contracts/code-pin.yaml` names this
-# directory — the pin and the
-# gitlink must agree and every payload file must be the pinned commit's bytes;
-# then they are copied, offline. A code checkout under an assembly that is NOT
-# its mounted leg (a paired feature worktree, `<root>/worktrees/<NNN>/code`) is
-# somebody installing that checkout ON PURPOSE: its bytes are copied as they
-# are, and the run names that checkout and its commit and says it is not the
-# pinned code. Neither is ever completed from a network — local siblings and
-# remote bytes do not make one install between them. THOSE TWO LAYOUTS AND NO
-# OTHER: a `contracts/code-pin.yaml` anywhere else above this file — another
-# project's assembly that happens to hold a vendored tree deep inside it — is
-# not this tree's, is not read, and changes nothing (`assembly_above`).
-#
-# ALL OF IT HAPPENS BEFORE ANYTHING IS PLACED: `install_commands` asks
-# `payload_select` straight after the targets, before the first byte is
-# collected, and every refusal here places nothing.
-#
-# ONE CURRENT SOURCE, AND IT IS `$REPO`'S. Every request this file makes reads
-# `${PAYLOAD_REPO:-$REPO}`: `$REPO` while its ref, its tree and its pin are
-# read, and — only once that pin has passed every check below — the repository
-# `$REPO`'s own pin names. No other repository is ever reached for the payload,
-# and `tests/test_repo_hygiene.py` holds every fetching line to naming `$REPO`.
-
-PAYLOAD_MODE=""      # "" until chosen: local | siblings | remote
-PAYLOAD_DIR=""       # the directory payload files are copied from, if any
-PAYLOAD_REPO=""      # owner/name every fetch reads, once resolved
-PAYLOAD_REV=""       # the 40-hex commit every fetch reads, once resolved
-SOURCE_SHA=""        # $REF, resolved once
-SOURCE_LAYOUT=""     # single | adopted | feature, once known
-API_SHA=""
-API_WHY=""
-PROBE_LAYOUT=""      # single | adopted | unknown, once contracts/code-pin.yaml is asked for
-PROBE_WHY=""
-RESOLVE_FOR=install  # whose refusal a failed resolution is: install, or wip (`wip init` step 7)
+# ---------------------------------------------------------------------------
+# THE CODE PIN'S GRAMMAR — A DELIBERATE COPY of the implementation's own
+# reader (`pin_parse` and the five helpers above it in the code leg's
+# `openRepoTools`), byte for byte, because this file has to read the pin
+# BEFORE there is an implementation to ask. The code leg's
+# `tests/test_install_payload_source.py` fails when the two copies differ.
+# ---------------------------------------------------------------------------
 
-#: THE CHARACTERS GITHUB SPELLS A NAME WITH, WRITTEN OUT. A bracket RANGE such
-#: as `[a-z]` follows the locale's collation in bash 3.2 and can admit capitals,
-#: and `case` is how this file matches.
 ORT_ALNUM='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
 ORT_TAB="$(printf '\t')"
 ORT_CR="$(printf '\r')"
-#: One listing row per entry: `path<TAB>type<TAB>sha`. `gh` evaluates it itself
-#: (`--jq`); the curl path hands the same filter to `jq`.
-ORT_TREE_JQ='.tree[] | [.path, .type, .sha] | @tsv'
-
-# EVERY FILE `--install` READS, derived from the three lists and from nothing
-# else: the commands at the root, then each skill's and each command file's path.
-payload_names() {
-	local name
-	for name in "${INSTALLABLES[@]}"; do printf '%s\n' "$name"; done
-	for name in "${SKILLS[@]}"; do skill_source_path "$name"; done
-	for name in "${COMMANDS[@]}"; do command_source_path "$name"; done
-}
 
 is_lower_hex() {   # <length> <value>
 	case "$2" in '' | *[!0123456789abcdef]*) return 1 ;; esac
@@ -421,15 +82,6 @@ is_segment() {   # <path> — exactly one path segment
 	return 0
 }
 
-# --- the code pin's fixed grammar ---------------------------------------------
-#
-# `contracts/code-pin.yaml` as openRepoShape's adopter writes it: top-level
-# `key: value` lines, comments, blank lines, and one mapping, `digests:`, whose
-# indented `tree_sha256:` is read. A scalar may be double- or single-quoted.
-# A key this reader does not use (a `tag:` label beside the commit, say) is
-# allowed once; a key it does use must appear exactly once; and every value
-# it uses must have the one form the contract gives it. LF only.
-
 PIN_SCALAR=""
 pin_scalar() {   # <text after the colon> — PIN_SCALAR, or 1 for a quote that does not close
 	local v="$1" q rest
@@ -544,228 +196,63 @@ pin_parse() {   # <file> — the PIN_* fields and 0, or PIN_WHY and 1
 	return 0
 }
 
-# --- the release stamp's fixed grammar ----------------------------------------
-#
-# `openrepotools/_release.py`, beside a package's payload (opensoft/openRepoTools
-# #228; `specs/006-release-pypi/contracts/stamp.md` is the grammar and the
-# refusal table, design.md Decision 5 the reason). BASH IS ITS ONE READER AT RUN
-# TIME: the entry module reads nothing, so Python and bash can never disagree
-# about a stamp. It is read by the rules below and NEVER SOURCED, IMPORTED OR
-# RUN, because its docstring is free text and a `$(…)` in it is only text.
-#
-# EACH REASON IS ONE LINE THAT BEGINS WITH ITS CAUSE, `cannot be read (…)`,
-# `is partial: …` or `is malformed: …`, so that `package_init`'s refusal reads
-# as a sentence around it. Nothing here prints, on either stream: that refusal
-# is the one line a broken stamp gets. And a refused stamp sets none of the
-# five values, because a stamp is all or nothing (FR-010) and is never read as
-# the part it holds. The five, the state and the reason are set here, so that
-# nothing in the environment can set them.
-
-STAMP_STATE=""   # unstamped | stamped, once `stamp_read` has accepted a stamp
-STAMP_VERSION="" STAMP_TAG="" STAMP_COMMIT="" STAMP_DIGEST="" STAMP_REPOSITORY=""
-STAMP_WHY=""     # why `stamp_read` refused, one line
-#: THE THREE LETTERS HATCH'S `(?i)` FOLDS ONTO ONE OF `version`'s, beyond ASCII's
-#: own capitals: U+017F onto `s`, and U+0130 and U+0131 onto `i`. They are every
-#: such letter, counted with Python's `re` over the whole of Unicode. Written as
-#: their UTF-8 bytes, so the guard folds them in any locale.
-STAMP_FOLD_S="$(printf '\305\277')"
-STAMP_FOLD_I_DOT="$(printf '\304\260')"
-STAMP_FOLD_I_DOTLESS="$(printf '\304\261')"
-
-stamp_number() {   # <text> — 0 for a decimal number with no leading zero
-	case "$1" in '' | *[!0123456789]* | 0?*) return 1 ;; esac
-	return 0
-}
-
-#: `X.Y.Z` or `X.Y.ZrcN`, each number with no leading zero: contracts/stamp.md's
-#: pattern, by `case` and parameter expansion. Not `=~`, whose quoting bash 3.2
-#: reads differently from bash 4, and whose `[0-9]` is a range.
-stamp_version_ok() {   # <version>
-	local v="$1" rest="" z=""
-	case "$v" in
-	*rc*)
-		stamp_number "${v##*rc}" || return 1
-		v="${v%rc*}"
-		;;
-	esac
-	rest="${v#*.}"
-	[ "$rest" != "$v" ] && stamp_number "${v%%.*}" || return 1
-	z="${rest#*.}"
-	[ "$z" != "$rest" ] && stamp_number "${rest%%.*}" && stamp_number "$z"
-}
+# ---------------------------------------------------------------------------
+# IN A CHECKOUT: three facts, one commit, then the implementation itself.
+# ---------------------------------------------------------------------------
 
-#: THE DOCSTRING GUARD (rule 3): a line that begins, in any case, with `version`
-#: or `__version__`, then optional spaces and `=`. Hatch's version source takes
-#: the first line ANYWHERE in the file that its pattern matches, docstring or
-#: not, so such a line would give the wheel one version and `--version`
-#: another. "Any case" is hatch's own, so the three letters it folds are folded
-#: here first; the guard is wider than hatch's pattern, which also wants a quote.
-stamp_hatch_reads() {   # <docstring line> — 0 when hatch could read it as the version
-	local s="$1"
-	s=${s//$STAMP_FOLD_S/s}
-	s=${s//$STAMP_FOLD_I_DOT/i}
-	s=${s//$STAMP_FOLD_I_DOTLESS/i}
-	case "$s" in
-	[Vv][Ee][Rr][Ss][Ii][Oo][Nn]*) s="${s#???????}" ;;
-	__[Vv][Ee][Rr][Ss][Ii][Oo][Nn]__*) s="${s#???????????}" ;;
-	*) return 1 ;;
-	esac
-	while :; do case "$s" in ' '*) s="${s#?}" ;; *) break ;; esac; done
-	case "$s" in '='*) return 0 ;; esac
-	return 1
+#: THE COMMIT A SUPERPROJECT RECORDS AT <path>: the index first and HEAD
+#: second, the order openRepoShape's `recorded_gitlink` asks them in.
+recorded_gitlink() {   # <superproject> <path>
+	# `read`, not `awk`: the offline path needs nothing a minimal PATH lacks.
+	local listed mode oid stage kind path
+	listed="$(git -C "$1" ls-files -s -- "$2" 2>/dev/null)" || listed=""
+	read -r mode oid stage path <<<"$listed" || :
+	if [ "$mode" != 160000 ] || [ "$stage" != 0 ] || [ "$path" != "$2" ]; then
+		listed="$(git -C "$1" ls-tree HEAD -- "$2" 2>/dev/null)" || listed=""
+		read -r mode kind oid path <<<"$listed" || :
+		[ "$mode" = 160000 ] && [ "$kind" = commit ] && [ "$path" = "$2" ] || return 1
+	fi
+	is_lower_hex 40 "$oid" || return 1
+	printf '%s\n' "$oid"
 }
 
-stamp_names() {   # <name>… — them in prose with their verb: `A is`, `A and B are`, `A, B and C are`
-	local out="${1-}" verb=is
-	shift || :
-	while [ $# -gt 0 ]; do
-		verb=are
-		if [ $# -eq 1 ]; then out="$out and $1"; else out="$out, $1"; fi
-		shift
-	done
-	printf '%s %s\n' "$out" "$verb"
+delegate_local() {   # <assembly root> <args…>
+	local root="$1" link code blob
+	shift
+	pin_parse "$root/$PIN_FILE" || die "$root/$PIN_FILE is not a code pin this can follow: $PIN_WHY.
+    A pin that is present and wrong is refused rather than read around; nothing ran."
+	link="$(recorded_gitlink "$root" "$PIN_SUBMODULE_PATH")" ||
+		die "$root records no gitlink at $PIN_SUBMODULE_PATH, where $PIN_FILE mounts the code
+    leg, so which implementation it pins cannot be checked; nothing ran."
+	[ "$link" = "$PIN_COMMIT" ] || die "$root records $link at $PIN_SUBMODULE_PATH and $PIN_FILE says
+    $PIN_COMMIT. The gitlink and the pin move in ONE commit (the lockstep rule), so
+    this checkout does not say which implementation it means; nothing ran. Make
+    them agree — \`make validate\` names the drift — then re-run."
+	code="$root/$PIN_SUBMODULE_PATH"
+	[ -f "$code/openRepoTools" ] || die "the code leg is not checked out at $code, so there is no
+    implementation to run; nothing ran. Mount it, then re-run:
+        git -C \"$root\" submodule update --init --recursive    (or: make bootstrap)"
+	git -C "$code" cat-file -e "$PIN_COMMIT^{commit}" 2>/dev/null ||
+		die "the pinned commit $PIN_COMMIT is not in $code's object store, so the
+    implementation there cannot be checked against it; nothing ran. Run
+    \`make bootstrap\` at $root, then re-run."
+	blob="$(git -C "$code" rev-parse --verify --quiet "$PIN_COMMIT:openRepoTools" 2>/dev/null)" ||
+		die "the pinned commit $PIN_COMMIT has no openRepoTools at its root; nothing ran."
+	[ "$(git -C "$code" hash-object --no-filters -- openRepoTools 2>/dev/null)" = "$blob" ] ||
+		die "$code/openRepoTools is not the implementation $root pins ($PIN_SOURCE_REPOSITORY
+    at $PIN_COMMIT), so this front door does not run it; nothing ran. Put the code
+    leg back at its pin (git -C \"$code\" checkout $PIN_COMMIT, or make bootstrap),
+    or run a code checkout's own openRepoTools ON PURPOSE, which says what it installs."
+	exec "${BASH:-bash}" "$code/openRepoTools" ${1+"$@"}
 }
 
-#: contracts/stamp.md's rules 1 to 5, line by line, then the checks after the
-#: read. `pin_parse`'s shape: each refusal returns at once with its reason, and
-#: the five values are copied out only once the whole file has passed.
-stamp_read() {   # <file> — STAMP_STATE, the five STAMP_* values and 0, or STAMP_WHY and 1
-	local line="" rest="" name="" value="" n=0 doc=none doc_line=0 guarded=0
-	local seen=" " field="" ref="" missing="" set_names="" partial=""
-	local f_VERSION="" f_TAG="" f_COMMIT="" f_DIGEST="" f_REPOSITORY=""
-	local tq='"""' sep=' = "' dq='"'
-	local shape='is not NAME = "VALUE" in column 0, with one space either side of ='
-	STAMP_STATE="" STAMP_VERSION="" STAMP_TAG="" STAMP_COMMIT="" STAMP_DIGEST=""
-	STAMP_REPOSITORY="" STAMP_WHY=""
-	# A FILE THAT CANNOT BE READ is said before any read is tried. A directory
-	# opens on Linux and fails at its first `read`, with bash's own line on
-	# stderr; a FIFO would wait for ever.
-	if [ -d "$1" ]; then
-		STAMP_WHY="cannot be read (it is a directory)"; return 1
-	elif [ ! -e "$1" ]; then
-		STAMP_WHY="cannot be read (there is no such file)"; return 1
-	elif [ ! -f "$1" ]; then
-		STAMP_WHY="cannot be read (it is not a regular file)"; return 1
-	elif [ ! -r "$1" ]; then
-		STAMP_WHY="cannot be read (it is not readable by this user)"; return 1
-	fi
-	while IFS= read -r line || [ -n "$line" ]; do
-		n=$((n + 1))
-		# RULE 1, BEFORE EVERY OTHER: on a `#` line and in the docstring too.
-		case "$line" in *"$ORT_CR"*) STAMP_WHY="is malformed: line $n has a carriage return"; return 1 ;; esac
-		# RULE 3, INSIDE THE DOCSTRING: every line is skipped. The first that
-		# hatch could read as the version is held until the docstring closes,
-		# so that one which never closes is refused as that, and not as one of
-		# the assignments it swallowed.
-		if [ "$doc" = open ]; then
-			if [ "$guarded" -eq 0 ] && stamp_hatch_reads "$line"; then guarded=$n; fi
-			case "$line" in *"$tq"*) doc=closed ;; esac
-			if [ "$doc" = closed ] && [ "$guarded" -ne 0 ]; then
-				STAMP_WHY="is malformed: line $guarded, in the docstring, would be read by hatch as the version"
-				return 1
-			fi
-			continue
-		fi
-		# RULE 2: a blank line, or a `#` in column 0, before the docstring as
-		# well as after it.
-		case "$line" in '#'*) continue ;; esac
-		rest="$line"
-		while :; do case "$rest" in ' '* | "$ORT_TAB"*) rest="${rest#?}" ;; *) break ;; esac; done
-		[ -n "$rest" ] || continue
-		# RULE 3, ITS OPENING: the one line beginning `"""` before any
-		# assignment. It closes on that line when a second `"""` follows.
-		case "$line" in
-		"$tq"*)
-			if [ "$doc" = none ] && [ "$seen" = " " ]; then
-				doc=open doc_line=$n
-				case "${line#"$tq"}" in *"$tq"*) doc=closed ;; esac
-				continue
-			fi
-			;;
-		esac
-		# RULE 4: `NAME = "VALUE"` and nothing else, NAME one of the five and
-		# VALUE free of `"`, `\` and `$`.
-		case "$line" in
-		*"$sep"*"$dq") ;;
-		*) STAMP_WHY="is malformed: line $n $shape"; return 1 ;;
-		esac
-		name="${line%%"$sep"*}"
-		value="${line#*"$sep"}"
-		value="${value%"$dq"}"
-		case "$name" in
-		VERSION | TAG | COMMIT | DIGEST | REPOSITORY) ;;
-		'' | [0123456789]* | *[!${ORT_ALNUM}_]*) STAMP_WHY="is malformed: line $n $shape"; return 1 ;;
-		*) STAMP_WHY="is malformed: line $n assigns $name, which is not one of the stamp's five names"; return 1 ;;
-		esac
-		case "$value" in
-		*"$dq"* | *\\* | *'$'*)
-			STAMP_WHY="is malformed: line $n has a quote, a backslash or a dollar sign in its value"; return 1 ;;
-		esac
-		# RULE 5: each of the five exactly once.
-		case "$seen" in *" $name "*) STAMP_WHY="is malformed: $name is assigned twice, the second time on line $n"; return 1 ;; esac
-		seen="$seen$name "
-		case "$name" in
-		VERSION) f_VERSION="$value" ;;
-		TAG) f_TAG="$value" ;;
-		COMMIT) f_COMMIT="$value" ;;
-		DIGEST) f_DIGEST="$value" ;;
-		REPOSITORY) f_REPOSITORY="$value" ;;
-		esac
-	done 2>/dev/null <"$1" || { STAMP_WHY="cannot be read (it could not be opened)"; return 1; }
-	if [ "$doc" = open ]; then
-		STAMP_WHY="is malformed: the docstring opened on line $doc_line never closes"; return 1
-	fi
-	for field in VERSION TAG COMMIT DIGEST REPOSITORY; do
-		case "$seen" in *" $field "*) ;; *) missing="$missing $field" ;; esac
-	done
-	if [ -n "$missing" ]; then
-		STAMP_WHY="is malformed: $(stamp_names $missing) missing"; return 1
-	fi
-	# UNSTAMPED is TAG, COMMIT and DIGEST all empty, and then VERSION is 0.0.0
-	# and REPOSITORY is empty: a REPOSITORY with no commit names nothing.
-	if [ -z "$f_TAG$f_COMMIT$f_DIGEST" ]; then
-		[ "$f_VERSION" = 0.0.0 ] || partial="VERSION is ${f_VERSION:-empty} rather than 0.0.0"
-		[ -z "$f_REPOSITORY" ] || partial="${partial:+$partial and }REPOSITORY is $f_REPOSITORY"
-		if [ -n "$partial" ]; then
-			STAMP_WHY="is partial: $partial, but TAG, COMMIT and DIGEST are empty"; return 1
-		fi
-		STAMP_STATE=unstamped
-	else
-		# STAMPED is everything else, and then every field is set and has the
-		# one shape its rule gives it.
-		for field in VERSION TAG COMMIT DIGEST REPOSITORY; do
-			ref="f_$field"
-			if [ -n "${!ref}" ]; then set_names="$set_names $field"; else missing="$missing $field"; fi
-		done
-		if [ -n "$missing" ]; then
-			STAMP_WHY="is partial: $(stamp_names $set_names) set, but $(stamp_names $missing) empty"; return 1
-		fi
-		if [ "$f_VERSION" = 0.0.0 ]; then
-			STAMP_WHY="is malformed: VERSION is 0.0.0, the unstamped version, and TAG, COMMIT and DIGEST are set"; return 1
-		fi
-		stamp_version_ok "$f_VERSION" ||
-			{ STAMP_WHY="is malformed: VERSION is $f_VERSION, not X.Y.Z or X.Y.ZrcN with no leading zeros"; return 1; }
-		[ "$f_TAG" = "v$f_VERSION" ] || { STAMP_WHY="is malformed: TAG is $f_TAG, not v$f_VERSION"; return 1; }
-		is_lower_hex 40 "$f_COMMIT" ||
-			{ STAMP_WHY="is malformed: COMMIT is $f_COMMIT, not 40 lowercase hex digits"; return 1; }
-		is_lower_hex 64 "$f_DIGEST" ||
-			{ STAMP_WHY="is malformed: DIGEST is $f_DIGEST, not 64 lowercase hex digits"; return 1; }
-		is_slug "$f_REPOSITORY" ||
-			{ STAMP_WHY="is malformed: REPOSITORY is $f_REPOSITORY, not an owner/name repository"; return 1; }
-		STAMP_STATE=stamped
-	fi
-	STAMP_VERSION="$f_VERSION" STAMP_TAG="$f_TAG" STAMP_COMMIT="$f_COMMIT"
-	STAMP_DIGEST="$f_DIGEST" STAMP_REPOSITORY="$f_REPOSITORY"
-	return 0
-}
+# ---------------------------------------------------------------------------
+# ANYWHERE ELSE: resolve once, read the pin there, run the pinned implementation.
+# ---------------------------------------------------------------------------
 
-# --- one round trip, `gh` first and the API by `curl` second ------------------
-#
-# The same order as `fetch_from_repo`, for the same reason, and for the same
-# identities. Each sets API_WHY to what BOTH answered when neither did, which
-# is what a refusal prints.
+TMP=""
 
-api_said() {   # <tool> <its stderr> — its first line, as one clause
+said() {   # <tool> <its stderr file> — its first line, as one clause
 	local first=""
 	IFS= read -r first <"$2" 2>/dev/null || :
 	case "$first" in
@@ -775,4470 +262,137 @@ api_said() {   # <tool> <its stderr> — its first line, as one clause
 	esac
 }
 
-#: A COMMIT OF THE CURRENT SOURCE, BY REF: API_SHA and 0, or API_WHY and 1. An
-#: answer that is not 40 lowercase hex is no answer — `gh` prints a failed
-#: request's JSON on stdout.
-api_sha() {   # <ref, URL-escaped>
-	local out="$WORKDIR/api-sha" why="" sha=""
-	API_SHA="" API_WHY=""
+#: `gh api` first and the raw URL second, the implementation's own order, into
+#: a file that is checked before it is used. WHY holds what both said.
+fetch_at() {   # <owner/name> <commit> <path> <dest>
+	WHY=""
 	if command -v gh >/dev/null 2>&1; then
-		if gh api "repos/${PAYLOAD_REPO:-$REPO}/commits/$1" -H 'Accept: application/vnd.github.sha' \
-			>"$out" 2>"$out.err"; then
-			IFS= read -r sha <"$out" || :
-			if is_lower_hex 40 "$sha"; then API_SHA="$sha"; return 0; fi
-			why="gh: an answer that is not a commit"
-		else
-			why="$(api_said gh "$out.err")"
+		if gh api "repos/$1/contents/$3?ref=$2" -H 'Accept: application/vnd.github.raw' \
+			>"$4" 2>"$TMP/err" && [ -s "$4" ]; then
+			return 0
 		fi
+		WHY="$(said gh "$TMP/err")"
 	else
-		why="gh: not installed"
+		WHY="gh: not installed"
 	fi
 	if command -v curl >/dev/null 2>&1; then
-		if curl -fsSL -H 'Accept: application/vnd.github.sha' \
-			"https://api.github.com/repos/${PAYLOAD_REPO:-$REPO}/commits/$1" >"$out" 2>"$out.err"; then
-			sha=""
-			IFS= read -r sha <"$out" || :
-			if is_lower_hex 40 "$sha"; then API_SHA="$sha"; return 0; fi
-			why="$why; curl: an answer that is not a commit"
-		else
-			why="$why; $(api_said curl "$out.err")"
+		if curl -fsSL "https://raw.githubusercontent.com/$1/$2/$3" >"$4" 2>"$TMP/err" &&
+			[ -s "$4" ]; then
+			return 0
 		fi
+		WHY="$WHY; $(said curl "$TMP/err")"
 	else
-		why="$why; curl: not installed"
+		WHY="$WHY; curl: not installed"
 	fi
-	API_WHY="$why"
 	return 1
 }
 
-tree_listing_ok() {   # <file> — one or more `path<TAB>blob|tree|commit<TAB>40-hex` rows
-	[ -s "$1" ] || return 1
-	awk -F'\t' 'NF != 3 || ($2 != "blob" && $2 != "tree" && $2 != "commit") ||
-		length($3) != 40 || $3 ~ /[^0123456789abcdef]/ { bad = 1 }
-		END { exit bad ? 1 : 0 }' "$1"
-}
-
-#: A TREE OF THE CURRENT SOURCE, ONE LEVEL: the listing in <dest> and 0, or
-#: API_WHY and 1.
-api_tree() {   # <commit or tree sha> <dest>
-	local out="$2" why=""
-	API_WHY=""
+#: THE GITLINK `$REPO` RECORDS AT <path> IN <commit>, from one level of its tree:
+#: `gh --jq` first, `curl` + `jq` second. 0 with GITLINK — empty when the tree
+#: holds no gitlink there, which is an answer — or 1 with WHY when neither
+#: transport answered. <path> is a pin's `submodule_path`, which `pin_parse`
+#: has already held to one segment of letters, digits, `.`, `_` and `-`.
+gitlink_at() {   # <commit> <path>
+	local filter=".tree[] | select(.type == \"commit\" and .path == \"$2\") | .sha"
+	GITLINK="" WHY=""
 	if command -v gh >/dev/null 2>&1; then
-		if gh api "repos/${PAYLOAD_REPO:-$REPO}/git/trees/$1" --jq "$ORT_TREE_JQ" >"$out" 2>"$out.err"; then
-			tree_listing_ok "$out" && return 0
-			why="gh: an answer that is not a tree listing"
-		else
-			why="$(api_said gh "$out.err")"
+		if gh api "repos/$REPO/git/trees/$1" --jq "$filter" >"$TMP/link" 2>"$TMP/err"; then
+			IFS= read -r GITLINK <"$TMP/link" || :
+			return 0
 		fi
+		WHY="$(said gh "$TMP/err")"
 	else
-		why="gh: not installed"
+		WHY="gh: not installed"
 	fi
 	if ! command -v curl >/dev/null 2>&1; then
-		why="$why; curl: not installed"
+		WHY="$WHY; curl: not installed"
 	elif ! command -v jq >/dev/null 2>&1; then
-		why="$why; curl: not asked, because reading api.github.com's JSON needs \`jq\` and there is none"
-	elif ! curl -fsSL "https://api.github.com/repos/${PAYLOAD_REPO:-$REPO}/git/trees/$1" >"$out.json" 2>"$out.err"; then
-		why="$why; $(api_said curl "$out.err")"
-	elif jq -r "$ORT_TREE_JQ" "$out.json" >"$out" 2>/dev/null && tree_listing_ok "$out"; then
+		WHY="$WHY; curl: not asked, because reading api.github.com's JSON needs \`jq\` and there is none"
+	elif ! curl -fsSL "https://api.github.com/repos/$REPO/git/trees/$1" >"$TMP/tree.json" 2>"$TMP/err"; then
+		WHY="$WHY; $(said curl "$TMP/err")"
+	elif jq -er '.tree | arrays | length >= 0' "$TMP/tree.json" >/dev/null 2>&1 &&
+		jq -r "$filter" "$TMP/tree.json" >"$TMP/link" 2>/dev/null; then
+		IFS= read -r GITLINK <"$TMP/link" || :
 		return 0
 	else
-		why="$why; curl: an answer that is not a tree listing"
+		WHY="$WHY; curl: an answer that is not a tree listing"
 	fi
-	API_WHY="$why"
 	return 1
 }
 
-tree_entry() {   # <listing> <name> — "<type> <sha>" of that entry, or 1
-	awk -F'\t' -v name="$2" '$1 == name { print $2 " " $3; found = 1; exit }
-		END { exit found ? 0 : 1 }' "$1"
-}
-
-url_ref() {   # <ref> — with the two characters a URL path reads otherwise escaped
-	local r="$1" out=""
-	while [ -n "$r" ]; do
-		case "$r" in
-		'%'*) out="$out%25" ;;
-		'#'*) out="$out%23" ;;
-		*) out="$out${r:0:1}" ;;
-		esac
-		r="${r#?}"
-	done
-	printf '%s' "$out"
-}
-
-# --- the two questions every remote run asks first ----------------------------
-
-#: IS <path> IN THE CURRENT SOURCE? Asked exactly the way `fetch_from_repo`
-#: asks for a payload file — `gh api …/contents` first, the raw URL second — and
-#: of the same source, which is `$REPO` at `$REF` until an adopted assembly's
-#: own commit is known, so the question today's layout is asked needs no host
-#: and no tool its install did not already need. 0: it is there, its bytes in
-#: <dest>. 3: it is not, which is GitHub's own 404 (`gh` names the status in
-#: what it prints; the raw URL's is read with `-w`). 1: no answer either way.
-#: PROBE_WHY says what each transport said, for 3 and for 1.
-probe_path() {   # <path> <dest>
-	local path="$1" dest="$2" status="" why=""
-	PROBE_WHY=""
+delegate_remote() {   # <args…>
+	local sha="" ref="" impl
+	is_slug "$REPO" || die "\$OPENREPOTOOLS_REPO is '$REPO', which is not an owner/name repository; nothing ran."
+	TMP="$(mktemp -d)"
+	trap 'rm -rf -- "$TMP"' EXIT
+	# `%` and `#` mean something else in a URL path; nothing else a ref may hold does.
+	ref="$(printf '%s' "$REF" | sed -e 's/%/%25/g' -e 's/#/%23/g')"
+	WHY=""
 	if command -v gh >/dev/null 2>&1; then
-		if gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/$path?ref=${PAYLOAD_REV:-$REF}" \
-			-H 'Accept: application/vnd.github.raw' >"$dest" 2>"$dest.err"; then
-			return 0
+		if gh api "repos/$REPO/commits/$ref" -H 'Accept: application/vnd.github.sha' \
+			>"$TMP/sha" 2>"$TMP/err"; then
+			IFS= read -r sha <"$TMP/sha" || :
+			is_lower_hex 40 "$sha" || { sha=""; WHY="gh: an answer that is not a commit"; }
+		else
+			WHY="$(said gh "$TMP/err")"
 		fi
-		why="$(api_said gh "$dest.err")"
-		case "$why" in *'HTTP 404'*) PROBE_WHY="$why"; return 3 ;; esac
 	else
-		why="gh: not installed"
-	fi
-	if command -v curl >/dev/null 2>&1; then
-		if status="$(curl -sSL -o "$dest" -w '%{http_code}' "https://raw.githubusercontent.com/${PAYLOAD_REPO:-$REPO}/${PAYLOAD_REV:-$REF}/$path" 2>"$dest.err")"; then
-			case "$status" in
-			200) return 0 ;;
-			404) PROBE_WHY="$why; curl: HTTP 404"; return 3 ;;
-			esac
-			why="$why; curl: HTTP ${status:-with no status}"
+		WHY="gh: not installed"
+	fi
+	if [ -z "$sha" ]; then
+		if command -v curl >/dev/null 2>&1 &&
+			curl -fsSL -H 'Accept: application/vnd.github.sha' \
+				"https://api.github.com/repos/$REPO/commits/$ref" >"$TMP/sha" 2>"$TMP/err"; then
+			IFS= read -r sha <"$TMP/sha" || :
+			is_lower_hex 40 "$sha" || { sha=""; WHY="$WHY; curl: an answer that is not a commit"; }
+		elif command -v curl >/dev/null 2>&1; then
+			WHY="$WHY; $(said curl "$TMP/err")"
 		else
-			why="$why; $(api_said curl "$dest.err")"
+			WHY="$WHY; curl: not installed"
 		fi
-	else
-		why="$why; curl: not installed"
-	fi
-	PROBE_WHY="$why"
-	return 1
-}
-
-#: WHICH LAYOUT `$REPO` HAS AT `$REF`: PROBE_LAYOUT single, adopted or unknown,
-#: with PROBE_WHY for unknown. One request, and it refuses nothing; what each
-#: answer means is its callers' (`payload_resolve_remote`, `wip_shape_ref`).
-payload_probe() {
-	[ -z "$PROBE_LAYOUT" ] || return 0
-	local rc=0
-	workdir
-	probe_path contracts/code-pin.yaml "$WORKDIR/probe-code-pin" || rc=$?
-	case "$rc" in
-	0) PROBE_LAYOUT=adopted ;;
-	3) PROBE_LAYOUT=single ;;
-	*) PROBE_LAYOUT=unknown ;;
-	esac
-}
-
-#: A RESOLUTION THAT FAILED, refused in the words of the run it failed: an
-#: `--install`, which has placed nothing yet, or `wip init`'s step 7, which
-#: comes after its repository was made and cloned, so "nothing was written"
-#: would not be true there.
-resolve_refuse() {   # <what happened>
-	case "$RESOLVE_FOR" in
-	wip) die "$1
-    Step 7 seeded nothing: no template file was written into the checkout and
-    nothing was staged. What the steps before it made is kept as it is, and a
-    re-run picks up from here." ;;
-	*) die "$1
-    NOTHING was installed and nothing already installed was replaced." ;;
-	esac
-}
-
-# --- the remote source, resolved once ---------------------------------------
-
-payload_resolve_remote() {
-	[ -z "$SOURCE_LAYOUT" ] || return 0
-	local listing contracts pin entry link
-	workdir
-	payload_probe
-	case "$PROBE_LAYOUT" in
-	single)
-		# TODAY'S LAYOUT, READ AS TODAY: `$REPO` at `$REF` as given, file by
-		# file, by the transports that always fetched it.
-		PAYLOAD_REPO="$REPO" PAYLOAD_REV="" SOURCE_LAYOUT=single
-		return 0 ;;
-	unknown)
-		resolve_refuse "could not fetch contracts/code-pin.yaml from $REPO at $REF, the file that
-    says whether it is a single repository or an adopted assembly, and a failed
-    answer is a refusal, never a reading of the layout. What answered:
-        $PROBE_WHY
-    Both ways were tried:
-        gh api repos/$REPO/contents/contracts/code-pin.yaml?ref=$REF
-        curl -sSL https://raw.githubusercontent.com/$REPO/$REF/contracts/code-pin.yaml" ;;
-	esac
-	# AN ADOPTED ASSEMBLY: everything again, at ONE commit.
-	listing="$WORKDIR/source-root.tsv"
-	contracts="$WORKDIR/source-contracts.tsv"
-	pin="$WORKDIR/code-pin.yaml"
-	is_slug "$REPO" || resolve_refuse "\$OPENREPOTOOLS_REPO is '$REPO', which is not an owner/name repository,
-    so the code its contracts/code-pin.yaml names cannot be asked for."
-	# THE CURRENT SOURCE IS $REPO until its own pin says otherwise.
-	PAYLOAD_REPO="$REPO" PAYLOAD_REV=""
-	api_sha "$(url_ref "$REF")" || resolve_refuse "could not resolve $REPO at $REF to a commit. What answered:
-        $API_WHY
-    Both were asked:
-        gh api repos/$REPO/commits/$REF -H 'Accept: application/vnd.github.sha'
-        curl -fsSL -H 'Accept: application/vnd.github.sha' https://api.github.com/repos/$REPO/commits/$REF
-    An adopted assembly is installed from ONE commit, and a failed answer is a
-    refusal, never a reading of the repository's layout."
-	SOURCE_SHA="$API_SHA" PAYLOAD_REV="$API_SHA"
-	api_tree "$SOURCE_SHA" "$listing" || resolve_refuse "could not list $REPO at $SOURCE_SHA ($REF), so the gitlink its code pin
-    must agree with cannot be read. What answered:
-        $API_WHY"
-	entry=""
-	if entry="$(tree_entry "$listing" contracts)" && [ "${entry%% *}" = tree ]; then
-		api_tree "${entry#* }" "$contracts" || resolve_refuse "could not list contracts/ in $REPO at $SOURCE_SHA ($REF). What answered:
-        $API_WHY"
-		entry="$(tree_entry "$contracts" code-pin.yaml)" || entry=""
-	else
-		entry=""
 	fi
-	[ -n "$entry" ] || resolve_refuse "$REPO carried contracts/code-pin.yaml at $REF when it was first asked,
-    and $SOURCE_SHA, the commit $REF named a moment later, does not: the ref moved
-    between the two reads, so this run would not be installing one answer.
-    Re-run once it has settled."
-	[ "${entry%% *}" = blob ] || resolve_refuse "contracts/code-pin.yaml in $REPO at $SOURCE_SHA is a ${entry%% *}, not a
-    file."
-	# ASKED BY `probe_path`, not `fetch_from_repo`, so that a refusal can say
-	# what answered and not only what was asked (#191's review, lane 2's (d)).
-	probe_path contracts/code-pin.yaml "$pin" ||
-		resolve_refuse "could not fetch contracts/code-pin.yaml from $REPO at $SOURCE_SHA ($REF), which
-    the listing shows is there. What answered:
-        $PROBE_WHY
-    Both were asked:
-        gh api repos/$REPO/contents/contracts/code-pin.yaml?ref=$SOURCE_SHA
-        curl -sSL https://raw.githubusercontent.com/$REPO/$SOURCE_SHA/contracts/code-pin.yaml"
-	pin_parse "$pin" || resolve_refuse "contracts/code-pin.yaml in $REPO at $SOURCE_SHA ($REF) is not a code pin
-    this installer can follow: $PIN_WHY. A pin that is present and wrong is
-    refused rather than read around."
-	link="$(tree_entry "$listing" "$PIN_SUBMODULE_PATH")" || link=""
-	[ "${link%% *}" = commit ] || resolve_refuse "$REPO at $SOURCE_SHA ($REF) records no gitlink at $PIN_SUBMODULE_PATH, where
-    contracts/code-pin.yaml mounts the code leg."
-	[ "${link#* }" = "$PIN_COMMIT" ] || resolve_refuse "$REPO at $SOURCE_SHA ($REF) records ${link#* } at $PIN_SUBMODULE_PATH
-    and its contracts/code-pin.yaml says $PIN_COMMIT. The gitlink and the pin move
-    in ONE commit (the lockstep rule), so this assembly does not say which code it
-    means."
-	# THE PIN HAS PASSED: the source is now the repository it names.
-	PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY" PAYLOAD_REV="$PIN_COMMIT"
-	if ! api_sha "$PIN_COMMIT" || [ "$API_SHA" != "$PIN_COMMIT" ]; then
-		resolve_refuse "contracts/code-pin.yaml in $REPO at $SOURCE_SHA ($REF) pins $PIN_SOURCE_REPOSITORY
-    at $PIN_COMMIT, and that is not a commit $PIN_SOURCE_REPOSITORY answers for.
+	[ -n "$sha" ] || die "could not resolve $REPO at $REF to a commit, so no implementation was
+    selected and nothing ran. What answered:
+        $WHY"
+	fetch_at "$REPO" "$sha" "$PIN_FILE" "$TMP/pin" || die "could not read $PIN_FILE from $REPO at
+    $sha ($REF), so which implementation it pins is not known and nothing ran.
     What answered:
-        ${API_WHY:-$PIN_SOURCE_REPOSITORY answered $API_SHA}"
-	fi
-	SOURCE_LAYOUT=adopted
-}
-
-payload_where() {   # the source collected from, for a refusal to name
-	case "$SOURCE_LAYOUT" in
-	single) printf '%s at %s' "$REPO" "$REF" ;;
-	adopted) printf '%s at %s (the code %s at %s pins)' "$PAYLOAD_REPO" "$PAYLOAD_REV" "$REPO" "$REF" ;;
-	*) printf '%s at %s' "$REPO" "$REF" ;;
-	esac
-}
-
-# --- the local source ---------------------------------------------------------
-
-#: DOES <pin> MOUNT ITS CODE LEG AT <name>? Its `submodule_path:` line, read
-#: with `pin_scalar`'s grammar (quotes, a trailing `# comment`) and, where that
-#: grammar refuses the value, leniently — the strict read is `pin_parse`'s, once
-#: the pin is known to be this checkout's — so that another project's pin,
-#: however it is written, is only ever compared with this directory's name, and
-#: a valid pin of this checkout's is never missed for the way it is written.
-pin_mounts() {   # <pin> <name>
-	local line value
-	while IFS= read -r line || [ -n "$line" ]; do
-		case "$line" in
-		submodule_path:*)
-			value="${line#submodule_path:}"
-			value="${value%"$ORT_CR"}"
-			if pin_scalar "$value" && [ -n "$PIN_SCALAR" ] && [ "$PIN_SCALAR" = "$2" ]; then
-				return 0
-			fi
-			value="${value#"${value%%[! $ORT_TAB]*}"}"
-			value="${value%"${value##*[! $ORT_TAB]}"}"
-			value="${value#[\"\']}"
-			value="${value%[\"\']}"
-			[ -n "$value" ] && [ "$value" = "$2" ]
-			return
-			;;
-		esac
-	done <"$1"
-	return 1
-}
-
-#: THE ASSEMBLY <dir> IS A CODE LEG OF, in one of the two layouts the design
-#: names and no other: `<root>/<submodule_path>`, the mounted leg, or
-#: `<root>/worktrees/<NNN>/<submodule_path>`, a paired feature worktree — each
-#: with `<root>/contracts/code-pin.yaml` naming that `<submodule_path>`. A pin
-#: anywhere else above <dir> is another project's (#191's review: workBenches
-#: vendors a complete tree deep inside whatever holds it). Logical paths, so
-#: what is printed is what the person typed; the one comparison that must see
-#: through links (`payload_local_adopted`) asks `pwd -P` itself.
-assembly_above() {   # <dir>
-	local name parent up
-	name="${1##*/}"
-	parent="$(dirname -- "$1")"
-	if [ -f "$parent/contracts/code-pin.yaml" ] &&
-		pin_mounts "$parent/contracts/code-pin.yaml" "$name"; then
-		printf '%s\n' "$parent"
-		return 0
-	fi
-	up="$(dirname -- "$parent")"
-	[ "${up##*/}" = worktrees ] || return 1
-	up="$(dirname -- "$up")"
-	if [ -f "$up/contracts/code-pin.yaml" ] &&
-		pin_mounts "$up/contracts/code-pin.yaml" "$name"; then
-		printf '%s\n' "$up"
-		return 0
-	fi
-	return 1
-}
-
-#: THE COMMIT A SUPERPROJECT RECORDS AT <path>: the index first and HEAD
-#: second, the order openRepoShape's `recorded_gitlink` asks them in — the index
-#: is what the next commit records, so a gitlink staged and not yet committed is
-#: the one that counts.
-recorded_gitlink() {   # <superproject> <path>
-	# `read`, not `awk`: the offline path needs nothing a minimal PATH lacks.
-	local listed mode oid stage kind path
-	listed="$(git -C "$1" ls-files -s -- "$2" 2>/dev/null)" || listed=""
-	read -r mode oid stage path <<<"$listed" || :
-	if [ "$mode" != 160000 ] || [ "$stage" != 0 ] || [ "$path" != "$2" ]; then
-		listed="$(git -C "$1" ls-tree HEAD -- "$2" 2>/dev/null)" || listed=""
-		read -r mode kind oid path <<<"$listed" || :
-		[ "$mode" = 160000 ] && [ "$kind" = commit ] && [ "$path" = "$2" ] || return 1
-	fi
-	is_lower_hex 40 "$oid" || return 1
-	printf '%s\n' "$oid"
-}
-
-payload_local_adopted() {   # <assembly root> <the directory this file runs from>
-	local root="$1" here="$2" pin="$1/contracts/code-pin.yaml" me mount link name blob snap
-	local bad="" missing=""
-	pin_parse "$pin" || die "$pin is not a code pin this installer can follow: $PIN_WHY.
-    It is the pin of the assembly this checkout sits in, and a pin that is present
-    and wrong is refused rather than read around. NOTHING was installed and nothing
-    already installed was replaced."
-	me="$(cd -- "$here" && pwd -P)"
-	mount="$(cd -- "$root/$PIN_SUBMODULE_PATH" 2>/dev/null && pwd -P)" || mount=""
-	if [ "$mount" != "$me" ]; then
-		payload_local_feature "$root" "$here"
-		return 0
-	fi
-	link="$(recorded_gitlink "$root" "$PIN_SUBMODULE_PATH")" ||
-		die "$root records no gitlink at $PIN_SUBMODULE_PATH, where its contracts/code-pin.yaml
-    mounts this checkout, so which code it pins cannot be checked. NOTHING was
-    installed and nothing already installed was replaced."
-	[ "$link" = "$PIN_COMMIT" ] || die "$root records $link at $PIN_SUBMODULE_PATH and its
-    contracts/code-pin.yaml says $PIN_COMMIT. The gitlink and the pin move in ONE
-    commit (the lockstep rule), so this assembly does not say which code it means.
-    NOTHING was installed and nothing already installed was replaced. Make them
-    agree — \`make validate\` at $root names the drift — then re-run."
-	git -C "$here" cat-file -e "$PIN_COMMIT^{commit}" 2>/dev/null ||
-		die "the pinned commit $PIN_COMMIT is not in $here's object store, so its
-    payload cannot be checked against it. NOTHING was installed and nothing already
-    installed was replaced. Fetch it — git -C \"$here\" fetch origin — or run
-    \`make bootstrap\` at $root, then re-run."
-	# WHAT IS CHECKED IS WHAT IS INSTALLED: each payload file is copied into
-	# this run's work directory FIRST, and the copy is what is hashed against
-	# the pinned commit and what `collect_commands`/`collect_skills` later read
-	# — so an edit to the checkout between the check and the copy cannot put
-	# unchecked bytes in place (#191, Copilot's first round).
-	workdir
-	snap="$WORKDIR/pinned-payload"
-	for name in $(payload_names); do
-		if [ -L "$here/$name" ]; then bad="${bad:+$bad }$name"; continue; fi
-		if [ ! -f "$here/$name" ]; then missing="${missing:+$missing }$name"; continue; fi
-		blob="$(git -C "$here" rev-parse --verify --quiet "$PIN_COMMIT:$name" 2>/dev/null)" ||
-			{ bad="${bad:+$bad }$name"; continue; }
-		mkdir -p -- "$snap/$(dirname -- "$name")" &&
-			cp -p -- "$here/$name" "$snap/$name" ||
-			{ bad="${bad:+$bad }$name"; continue; }
-		[ "$(git -C "$here" hash-object --no-filters -- "$snap/$name" 2>/dev/null)" = "$blob" ] ||
-			bad="${bad:+$bad }$name"
-	done
-	[ -z "$missing" ] || die "the code mounted at $root/$PIN_SUBMODULE_PATH is missing $missing,
-    so it is not the payload $root pins ($PIN_SOURCE_REPOSITORY at $PIN_COMMIT), and
-    an incomplete local set is never completed from a network. NOTHING was
-    installed and nothing already installed was replaced. Restore them —
-        git -C \"$here\" checkout $PIN_COMMIT -- $missing
-    — or run \`make bootstrap\` at $root, then re-run."
-	[ -z "$bad" ] || die "in the code mounted at $root/$PIN_SUBMODULE_PATH, $bad
-    differ from $PIN_COMMIT, the commit $root pins, so these are not the pinned
-    bytes. NOTHING was installed and nothing already installed was replaced. To
-    install the pinned code, restore them:
-        git -C \"$here\" checkout $PIN_COMMIT -- $bad
-    To install a code feature on purpose, run the openRepoTools of its own worktree
-    (<root>/worktrees/<NNN>/code), which installs that checkout's bytes and says so."
-	PAYLOAD_MODE=local PAYLOAD_DIR="$snap" SOURCE_LAYOUT=adopted
-	say "openRepoTools: source: the code mounted at $root/$PIN_SUBMODULE_PATH, $PIN_SOURCE_REPOSITORY at $PIN_COMMIT as $root pins it; every payload file was checked against that commit and nothing fetched"
-}
-
-payload_local_feature() {   # <assembly root> <checkout>
-	local root="$1" here="$2" name missing="" top="" head="" dirty=""
-	for name in $(payload_names); do
-		[ -f "$here/$name" ] || missing="${missing:+$missing }$name"
-	done
-	[ -z "$missing" ] || die "$here is a code checkout under the assembly $root and not
-    the code it mounts, so \`--install\` from it installs THIS checkout's bytes or
-    none — and it is missing $missing. NOTHING was installed and nothing already
-    installed was replaced. Restore them in $here, or install the code $root pins
-    with $root/openRepoTools --install."
-	top="$(git -C "$here" rev-parse --show-toplevel 2>/dev/null)" || top=""
-	if [ -n "$top" ] && [ "$(cd -- "$top" && pwd -P)" = "$(cd -- "$here" && pwd -P)" ]; then
-		head="$(git -C "$here" rev-parse --verify --quiet HEAD 2>/dev/null)" || head=""
-		# shellcheck disable=SC2046
-		[ -z "$(git -C "$here" status --porcelain -- $(payload_names) 2>/dev/null)" ] ||
-			dirty=" with uncommitted changes to its payload"
-	fi
-	PAYLOAD_MODE=local PAYLOAD_DIR="$here" SOURCE_LAYOUT=feature
-	say "openRepoTools: source: the code checkout $here at ${head:-a commit this installer could not read (it is not a git checkout of its own)}$dirty, installed because its own openRepoTools was run — NOT the code $root pins, $PIN_SOURCE_REPOSITORY at $PIN_COMMIT"
-}
-
-# --- the one decision `--install` makes ---------------------------------------
-
-payload_select() {
-	[ -z "$PAYLOAD_MODE" ] || return 0
-	local selfdir="" root name missing=""
-	if [ -f "$SELF" ]; then
-		selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-		if root="$(assembly_above "$selfdir")"; then
-			payload_local_adopted "$root" "$selfdir"
-			return 0
-		fi
-		for name in $(payload_names); do
-			[ -f "$selfdir/$name" ] || missing="${missing:+$missing }$name"
-		done
-		# EVERY PAYLOAD FILE IS BESIDE THIS ONE: copied, and nothing is asked
-		# of any network — the run is today's to the line (workBenches runs it
-		# with a sentinel repository precisely so that only this can succeed).
-		if [ -z "$missing" ]; then
-			PAYLOAD_MODE=local PAYLOAD_DIR="$selfdir"
-			return 0
-		fi
-		payload_resolve_remote
-		# A SINGLE REPOSITORY KEEPS ITS SIBLING RULE: what is beside this file
-		# is copied and only what is missing is fetched, at `$REF`, as it was.
-		if [ "$SOURCE_LAYOUT" = single ]; then
-			PAYLOAD_MODE=siblings PAYLOAD_DIR="$selfdir"
-			return 0
-		fi
-		# AN ADOPTED SOURCE IS NEVER TOPPED UP: the files beside an installed
-		# copy are whatever an earlier run left, and pinned skills beside them
-		# would be two versions in one install.
-		PAYLOAD_MODE=remote
-		say "openRepoTools: source: $REPO at $REF ($SOURCE_SHA) pins $PAYLOAD_REPO at $PAYLOAD_REV; the files beside $selfdir are not used, because an incomplete local set is never topped up with pinned files"
-		return 0
-	fi
-	payload_resolve_remote
-	PAYLOAD_MODE=remote
-	[ "$SOURCE_LAYOUT" = single ] ||
-		say "openRepoTools: source: $REPO at $REF ($SOURCE_SHA) pins $PAYLOAD_REPO at $PAYLOAD_REV"
-}
-
-# THE SEVENTEEN FILES `--install` PLACES. One list, so the installer, the fetch
-# fallback and the tests cannot disagree about what a complete install is.
-# `openRepoTools` is first because it is the one a person types to get the
-# others.
-#
-# EVERY ONE OF THEM IS RESOLVED BY BARE NAME AT THE REPOSITORY ROOT — `cp --
-# "$selfdir/$name"` below, and `fetch_from_repo "$name"` — which is why
-# Amendment 9's move landed the four lane helpers and the table at the root and
-# nowhere else.
-#
-# `repos.tsv` IS DATA AND IS PLACED WITH THE COMMANDS, at 755 like everything
-# else here. That is one honest ugliness — a data file carrying an executable
-# bit it has no use for — and the cost of the alternative was a second
-# destination and a second mode in this file, in the loop below, and again in
-# workBenches' `setup-estate-commands.sh`, whose post-install verify refuses any
-# target whose mode is not exactly 755. Amendment 9(b) chose the ugliness.
-#
-# ELEVEN SINCE AMENDMENT 11. `restart` and `lanes` joined the list under
-# RATIFIED DECISIONS 7 and 6 (2026-09-13T18:05:29Z, "Ratify all four" and "Yes,
-# build `lanes` in A11"), and `openRepoTools --install` owns them because THIS
-# IS THE ONLY INSTALLER IN THE ESTATE THAT PUTS A WORD ON PATH. Adoption act 6
-# vendors skills and command files through workBenches' `setup-claude-profiles.sh`
-# into the shared commands directory and `~/.claude/commands/`, and neither of
-# those is a `PATH` entry — which is exactly what decision 7 point 8 says.
-#
-# ELEVEN STILL, AND ONE NAME CHANGED: `lane` takes `restart`'s place under
-# AMENDMENT 18 ADDENDUM 1 (the word, ratified 2026-09-14T14:05:54Z) and ADDENDUM
-# 2 (the retirement, ratified 2026-09-14T16:50:32Z, verbatim "ratify" on Brett
-# Heap's ruling *"i think we can drop restart as a cli command and keep it
-# inside a claude session with /restart … lane does all the things a user
-# wants"*). `lane <name>` is `restart <lane>`'s act to the byte — the launcher's
-# path, the lane's own recorded directory and profile, asking nothing — and adds
-# the pick, the attach and the handoff branch. The count did not move because
-# one word left as another arrived, which is why nothing below it is a number.
-# AND TWELVE SINCE AMENDMENT 17(a): `lane-handoff` is the swap's shell form,
-# placed beside the rest because it is a word a person has on PATH (#47).
-# THIRTEEN SINCE AMENDMENT 16, ratified 2026-09-14T09:24:35Z verbatim "Ratify as
-# drafted (Recommended)": `lane-rename <old> <new>` is the word Brett Heap asked
-# for that day, and clause (h) is why it is a word rather than a `lanes` option —
-# `lanes` writes nothing, and a rename is four files in one commit. Its write is
-# `lanes-edit.sh rename-lane`; the word exists because the tmux window and the
-# session's own name are not a register writer's to touch (clause (f)).
-# FIFTEEN SINCE opensoft/workBenches#119, on Brett Heap's home ruling of
-# 2026-09-29 ("this work is really for openRepoTools repo"): `claude-current`
-# is the Claude Code a launch starts — npm's published version, verified by
-# `--version` and named by absolute path — which `lane-start` and workBenches'
-# `claude-profile` call, and `claude-restart-check` is the RESTART NEEDED line
-# the shared status line prints for a session whose binary moved on disk. They
-# are placed at the END of the list, so every index a test takes into it holds.
-# SIXTEEN SINCE opensoft/openRepoTools#160 (lane-collision-protocol Amendment 14,
-# ratified by Brett Heap 2026-10-05, verbatim "ratify 48"): `lanes-index` keeps
-# the DERIVED INDEX of the lane register — `sync`, `reconcile`, `status` — which
-# `lanes-edit.sh` nudges after a write lands and which `lanes --index` and
-# `lanes-edit.sh history --index` read; nothing that acts reads it. It is the one
-# command in the list that is Python rather than bash, and it is placed at the
-# END like the two before it, for the same reason.
-# SEVENTEEN SINCE opensoft/openRepoTools#162 (Brett Heap's word of 2026-10-05,
-# "build 162"): `lane-worktrees sweep <lane>` retires a lane's abandoned
-# worktrees, branches, scratch and killed-suite sandboxes - a dry run unless
-# `--yes`, and nothing removed that is not first on origin or in a bundle. It is
-# Python like `lanes-index`, and at the END for the same reason.
-INSTALLABLES=(openRepoTools park resume status lane lanes lane-handoff lane-rename lanes-edit.sh lane-start lane-end link-estates repos.tsv claude-current claude-restart-check lanes-index lane-worktrees)
-
-# ------------------------------------------ THE RECEIPT OF WHAT IT PLACED
-#
-# opensoft/openRepoTools#57, and it descends from COPILOT'S ROUND-3 FINDING ON
-# #45 (`openRepoTools:263`) — which is a finding about the retirement directly
-# below this section:
-#
-#     "This ownership test is only a searchable content substring, not proof
-#     that this installer created the file. A user-owned `restart` script
-#     copied from an old installation or containing the same banner will
-#     satisfy `grep` and be deleted on the next install […] Use durable
-#     ownership metadata or another check that distinguishes installer output
-#     from a user file before removing it."
-#
-# IT WAS DECLINED FOR `restart`, AND THE REASON DOES NOT GENERALISE. No
-# installer that ever placed `restart` wrote a receipt, so no receipt can
-# identify the copies that are on people's PATHs today: for that population the
-# header marker is the only evidence that exists, and it stays exactly where it
-# is. What #57 asks is that EVERY RETIREMENT AFTER THIS ONE have better — which
-# costs nothing except that this run write down what it did.
-#
-# SO IT WRITES DOWN WHAT IT PLACED, one row per regular file:
-#
-#     <name><TAB><destination><TAB><sha256><TAB><UTC>
-#
-# and the name is the word this command PRINTED beside that placement — `park`,
-# `handoff`, `/ctx` — because one name is a skill AND a command file at four
-# different paths, and a row's subject is therefore its DESTINATION — spelled as
-# its CANONICAL ABSOLUTE PATH (`receipt_dest`), so that a relative
-# `$OPENREPOTOOLS_BIN_DIR` means the same file to the run that wrote the row and
-# to every later run from any other directory. A run
-# REPLACES the row of every destination it placed and KEEPS every other row, so
-# a person who moves `$OPENREPOTOOLS_BIN_DIR` keeps the evidence for the copies
-# in the old one, which are the copies a later retirement will meet there.
-#
-# THE ROWS ARE READ OFF DISK, FROM THE SAME LISTS THE PLACEMENTS ARE MADE FROM,
-# after the last of them. Nothing is remembered from inside the loops: the
-# planners have already refused every target that is not a regular file this
-# user can write, the loops have written them, and what a receipt must carry is
-# the digest of the bytes that ARE THERE. That is also why this is one call in
-# `install_commands` and not a line inside each loop — the smallest hunk in the
-# two functions this estate's other branches are editing.
-#
-# IT IS NOT AN ARTIFACT OF THE COUNT. The count is the invariant of what
-# `--install` PLACES; this is the record of that placement. A ROW GOES TO EVERY
-# PLACED REGULAR FILE — the `INSTALLABLES` plus the skill files and the command
-# files at both of their destinations — and to nothing else: the two hook
-# entries get no row, because an entry inside somebody else's JSON file is not a
-# file this command placed, and the receipt carries no row for itself.
-#
-# THE NUMBER THAT COMES OUT IS DERIVED, NOT STATED, because every statement of
-# it went stale the next time a list moved (Copilot on #103, `openRepoTools:325`,
-# which found twenty-six where there were twenty-seven): `ARTIFACTS - HOOK_ENTRIES`
-# in `tests/test_openrepotools_command.py`, which is `len(INSTALLED) + 2 *
-# len(SKILL_NAMES) + 2 * len(COMMAND_NAMES)`. Today that is 31 artifacts, 29 of
-# them files, 29 rows — 17 + 6 + 6, since opensoft/openRepoTools#162 put
-# `lane-worktrees` in `INSTALLABLES` — and it moves with `INSTALLABLES`, `SKILLS`
-# and `COMMANDS`, and with nothing else.
-#
-# A RECEIPT THAT CANNOT BE WRITTEN IS A NOTE AND NEVER A REFUSAL (#57's own
-# words, and the same rule the retirement follows one function down). The
-# commands, the skills and the hook entries are what a person asked for; a
-# record of them this installer could not write is its problem and not theirs,
-# and the marker is still there for a retirement to fall back to. Fail closed,
-# out loud, in one line, and carry on.
-#
-# AND THE RECEIPT IS ONLY EVER ASKED ABOUT A PATH THIS COMMAND COMPUTED. It is
-# never read as a list of paths to remove: `retire_commands` walks `RETIRED`
-# against its own `$dir` and asks the receipt one question about the target it
-# already has in hand — is the file at THIS path the one I wrote. So a receipt
-# somebody else authored can change an answer and can never name a file for
-# removal, which is the difference between a record and an instruction.
-
-#: WHERE THE RECEIPT LIVES. `$OPENREPOTOOLS_DATA_DIR`, else the XDG data
-#: directory — `$XDG_DATA_HOME`, else `~/.local/share`. It is DATA and does not
-#: belong beside the commands in `$OPENREPOTOOLS_BIN_DIR`: a bin directory is a
-#: PATH entry, and a `.tsv` in one is a file every shell walks past for ever
-#: (`repos.tsv` is there under protest, and Amendment 9(b) says so). XDG is the
-#: one convention that answers "where does a tool keep its own record" on Linux
-#: and macOS alike, and the override is there because the bin directory has one.
-#:
-#: THE DIRECTORY AS CONFIGURED IS ONE THING AND THE PATH THIS FILE READS AND
-#: WRITES IS ANOTHER (Copilot round 4 on #103, `openRepoTools:365`). The first
-#: shape handed the configured string to every caller, so a relative
-#: `$OPENREPOTOOLS_DATA_DIR` was `data/installed.tsv` in every line and every
-#: `[ -f ]`: a spelling, not a file. `receipt_file` is the CANONICAL path — the
-#: directory resolved by `receipt_dest`, the same `pwd -P` the destinations in
-#: the rows go through — whenever the directory is THERE TO RESOLVE, and the
-#: configured spelling otherwise: a directory that does not exist has no
-#: receipt in it to read, and the one caller that MAKES it (`receipt_replace`)
-#: creates it first and asks again. A getter that created directories would
-#: make a retirement's read a write.
-#:
-#: WHAT RESOLVING DOES NOT DO is make a relative `data` mean the same directory
-#: from two working directories: that is what being relative IS. So
-#: `receipt_record` says so, on the line beside the one that names the
-#: receipt, rather than leaving a person to find out from a later run that
-#: could not see the first one's evidence.
-receipt_data_dir() {   # the directory as configured, which may be relative
-	printf '%s\n' "${OPENREPOTOOLS_DATA_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/openRepoTools}"
-}
-receipt_file() {
-	receipt_dest "$(receipt_data_dir)/installed.tsv"
-}
-
-#: A TAB AND A NEWLINE AS VALUES, because the receipt is a TSV and a
-#: destination carrying either would split one row into two columns or into two
-#: rows. `$'\t'` is the shorter spelling and no file in this repository uses
-#: one; `printf` is the spelling every one of them does use. The `X` is there
-#: because `$( )` strips TRAILING newlines and there would otherwise be nothing
-#: left to assign.
-RECEIPT_TAB="$(printf '\t')"
-RECEIPT_NEWLINE="$(printf '\nX')"
-RECEIPT_NEWLINE="${RECEIPT_NEWLINE%X}"
-
-RECEIPT_ROWS=""   # this run's rows, staged in $WORKDIR
-RECEIPT_DESTS=""  # their destinations, one per line, for the merge
-RECEIPT_STAMP=""  # the UTC of this run
-RECEIPT_COUNT=0   # how many rows it wrote
-RECEIPT_WHY=""    # why it could not, where it could not
-
-# THE DIGEST, IN WHICHEVER SPELLING THIS MACHINE HAS. `sha256sum` is GNU and a
-# stock macOS ships none; `shasum -a 256` is in the Perl toolchain macOS does
-# ship, and is on every Linux this estate runs. Neither is a hard dependency —
-# a machine with neither gets the note and the marker — so this is the one
-# place either name is spelled.
-#
-# THE FILE IS FED ON STDIN AND NEVER NAMED AS AN OPERAND, and that is not a
-# style choice: GNU `sha256sum` ESCAPES a filename containing a backslash or a
-# newline and prefixes the whole line with `\`, so `${out%% *}` off a named
-# operand hands back `\<digest>` for a bin directory somebody spelled with a
-# backslash in it. Read from stdin, both spellings print `<digest>  -`.
-sha256_of() {   # <path> — its digest, or 1 and nothing at all
-	local out=""
-	[ -f "$1" ] && [ -r "$1" ] || return 1
-	if command -v sha256sum >/dev/null 2>&1; then
-		out="$(sha256sum <"$1" 2>/dev/null)" || return 1
-	elif command -v shasum >/dev/null 2>&1; then
-		out="$(shasum -a 256 <"$1" 2>/dev/null)" || return 1
-	else
-		return 1
-	fi
-	out="${out%% *}"
-	[ -n "$out" ] || return 1
-	printf '%s\n' "$out"
-}
-
-# THE ONE LINE A RECEIPT THAT COULD NOT BE WRITTEN GETS. It says where, why,
-# that the install is not affected, and what a retirement falls back to — and
-# it is `say` and not `die`, which is the whole of #57's ruling on this.
-#
-# THE EXIT BELONGS TO THE REASON AND NOT TO THE LINE, which is why it is a
-# sentence a caller puts in its `why` rather than a tail on every note: a
-# machine with no `sha256sum` and no `shasum` is not a machine that wants to be
-# told to name a different directory.
-RECEIPT_ELSEWHERE='name a directory this installer may write with $OPENREPOTOOLS_DATA_DIR'
-receipt_note() {   # <file> <why>
-	say "receipt: NOT written to $1 — $2. Everything above is installed; a later retirement falls back to the \`Installed on PATH by\` header, which is the evidence it has today."
-}
-
-# THE DESTINATION AS THE RECEIPT SPELLS IT: ABSOLUTE, AND WITH EVERY SYMLINK IN
-# ITS DIRECTORY RESOLVED (Copilot on #103, `openRepoTools:524`). A row is
-# evidence about ONE FILE, and `$OPENREPOTOOLS_BIN_DIR=bin` — which the planner
-# accepts — names a different file from every directory it is run in: the first
-# shape stored `$dir/$name` as supplied, so a row written from one working
-# directory was compared, as a string, against the `bin/restart` of another, and
-# that other file was hashed and could be removed. So the one spelling every
-# read and write goes through is the PHYSICAL path of the file's directory plus
-# its own name — `record`, `verdict` and `forget` all ask THIS, never the
-# `$dir/$name` they were handed, and the line a person reads still prints the
-# path as they spelled it.
-#
-# THE DIRECTORY IS RESOLVED, NEVER THE FILE: `receipt_add` has already refused a
-# symlink at the path itself, and a link is somebody's decision about their own
-# PATH, which is no business of a row's. `(cd -- "$dir" && pwd -P)` is the
-# portable spelling (macOS and bash 3.2 have no `realpath`, and `readlink -f`
-# is not in a stock macOS userland — `lanes-edit.sh` asks the same question the
-# same way). `CDPATH` is emptied first, because a `cd` through one PRINTS the
-# directory it went to and the substitution would hold two lines. And the
-# trailing `X` is the one `RECEIPT_NEWLINE` uses: `$( )` strips trailing
-# newlines, and a directory whose name ENDS in one would otherwise resolve to a
-# DIFFERENT, shorter path — one with no newline in it, past the TSV guard.
-#
-# IT NEVER FAILS: a directory that cannot be entered answers with the path as
-# given, which is not absolute, and the one caller that WRITES a row refuses a
-# destination that is not — the callers that only READ simply never match it.
-receipt_dest() {   # <path> — its canonical absolute spelling, else the path as given
-	local dir="" base="" real=""
-	case "$1" in
-	*/*) dir="${1%/*}"; base="${1##*/}" ;;
-	*) dir="."; base="$1" ;;
-	esac
-	[ -n "$dir" ] || dir="/"
-	real="$(CDPATH= cd -- "$dir" >/dev/null 2>&1 && pwd -P && printf X)" ||
-		{ printf '%s\n' "$1"; return 0; }
-	real="${real%X}"
-	real="${real%"$RECEIPT_NEWLINE"}"
-	case "$real" in
-	/) printf '/%s\n' "$base" ;;
-	*) printf '%s/%s\n' "$real" "$base" ;;
-	esac
-}
-
-# WHETHER A PATH CANNOT BE A COLUMN OF THE RECEIPT: it carries a tab or a newline.
-receipt_tsv_unsafe() {   # <path> — 0 if it cannot, 1 if it can
-	case "$1" in
-	*"$RECEIPT_TAB"*|*"$RECEIPT_NEWLINE"*) return 0 ;;
-	esac
-	return 1
-}
-
-# ONE ROW, STAGED. The digest is of the bytes at the destination, so a run that
-# placed nothing new still records what is there — which is the point: the
-# receipt answers "is the file at this path mine", not "did I write it today".
-#
-# A DESTINATION CARRYING A TAB OR A NEWLINE GETS NO RECEIPT AT ALL, rather than
-# a row that is silently two columns or two rows. `$OPENREPOTOOLS_BIN_DIR` is a
-# path a person chooses — the retirement one function down already prints its
-# `rm` quoted because of the spaces people put in them — and a TSV has no
-# escape. Failing the whole receipt rather than dropping the row is the fail-
-# closed half: a receipt missing exactly the file a retirement will ask about,
-# with nothing on screen, is worse than no receipt at all.
-receipt_add() {   # <name> <destination> — 0, or 1 with $RECEIPT_WHY set
-	local name="$1" given="$2" dest="" digest=""
-	[ -f "$given" ] && [ ! -L "$given" ] || return 0
-	# THE TAB AND NEWLINE QUESTION IS ASKED OF BOTH SPELLINGS — the one the person
-	# supplied, BEFORE anything resolves it, and the canonical one, which a symlink
-	# in the directory can make carry a tab the supplied one never had.
-	if receipt_tsv_unsafe "$given"; then
-		RECEIPT_WHY="$given has a tab or a newline in it and this file is tab-separated"
-		return 1
-	fi
-	dest="$(receipt_dest "$given")"
-	if receipt_tsv_unsafe "$dest"; then
-		RECEIPT_WHY="$dest has a tab or a newline in it and this file is tab-separated"
-		return 1
-	fi
-	case "$dest" in
-	/*) ;;
-	*)
-		RECEIPT_WHY="$given could not be resolved to an absolute path"
-		return 1
-		;;
-	esac
-	digest="$(sha256_of "$dest")" || {
-		RECEIPT_WHY="$dest could not be digested"
-		return 1
-	}
-	printf '%s\t%s\t%s\t%s\n' "$name" "$dest" "$digest" "$RECEIPT_STAMP" \
-		>>"$RECEIPT_ROWS" || {
-		RECEIPT_WHY="the rows could not be staged in $WORKDIR"
-		return 1
-	}
-	printf '%s\n' "$dest" >>"$RECEIPT_DESTS" || {
-		RECEIPT_WHY="the rows could not be staged in $WORKDIR"
-		return 1
-	}
-	RECEIPT_COUNT=$((RECEIPT_COUNT + 1))
-	return 0
-}
-
-# EVERY ROW OF THE RECEIPT WHOSE DESTINATION IS NOT ONE OF THESE, appended to a
-# staged file. ONE implementation for the two callers that need it — the merge,
-# which keeps what this run did not replace, and the retirement, which drops
-# the row of the file it removed — because two copies of one parse is how the
-# two come to disagree about what a row is.
-#
-# A ROW IS FOUR FIELDS OR MORE, and anything else in that file is ignored
-# rather than repaired: a comment somebody added, a truncated line, a column a
-# later version appends. Reading "at least four" rather than "exactly four" is
-# what lets a fifth column arrive without this half having to be taught about
-# it first.
-#
-# AND A ROW WHOSE FILE IS NO LONGER AT THAT PATH IS NOT KEPT (Copilot round 1
-# on #103). `receipt_forget` runs AFTER the `rm` it accompanies, so a write
-# that fails in the instant between them leaves the receipt naming a path this
-# installer's copy has left — and nothing would ever clear it. This makes that
-# window CLOSE BY ITSELF: the next `--install` reads the same file, finds that
-# file gone, and drops the row. It is also what stops the receipt growing for
-# ever with the bin directories and profile roots people delete.
-#
-# WHAT IS KEPT IS WHAT COULD HAVE BEEN WRITTEN: a REGULAR FILE THAT IS NOT A
-# LINK, which is `receipt_add`'s own test one function up, spelled the same way
-# (Copilot round 2 on #103, `openRepoTools:468`). The first shape of this asked
-# `[ -e ] || [ -L ]` — "is there anything at all at that path" — which kept the
-# row of a destination that had become a directory, a socket, a FIFO or a
-# symlink. A row is evidence about a REGULAR FILE this installer placed, and
-# where one of those sits at that path the file it is evidence about is not
-# there; the two halves now say that in one sentence each rather than two
-# different ones.
-receipt_rows_except() {   # <receipt> <destinations file> <staged file>
-	local row="" rest="" dest=""
-	[ -f "$1" ] && [ ! -L "$1" ] || return 0
-	# A RECEIPT THAT EXISTS AND CANNOT BE OPENED IS A FAILURE, NOT AN EMPTY ONE
-	# (Copilot round 4 on #103, `openRepoTools:575`). The `done <"$1"` below
-	# fails quietly when it cannot open the file, and the `return 0` this
-	# function ends in then reported a clean scan of no rows — so
-	# `receipt_record` replaced the receipt with this run's rows alone and every
-	# row about a copy this run did not place was gone. OPENED, not `-r`: the
-	# answer that matters is the one the loop is about to get, and for root those
-	# two agree anyway. Both callers already print their note on a non-zero.
-	: 2>/dev/null <"$1" || return 1
-	while IFS= read -r row || [ -n "$row" ]; do
-		case "$row" in
-		*"$RECEIPT_TAB"*"$RECEIPT_TAB"*"$RECEIPT_TAB"*) ;;
-		*) continue ;;
-		esac
-		rest="${row#*"$RECEIPT_TAB"}"
-		dest="${rest%%"$RECEIPT_TAB"*}"
-		# A RELATIVE DESTINATION IS NEVER KEPT (Copilot on #103, `openRepoTools:524`).
-		# This command writes none any more, and a row that says `bin/park` is a
-		# row about whichever directory the next run is standing in: the `-f` just
-		# below would answer for THAT run's `bin/park`, which is the cwd-dependence
-		# `receipt_dest` removes from every other read.
-		case "$dest" in
-		/*) ;;
-		*) continue ;;
-		esac
-		if grep -qFx -e "$dest" -- "$2"; then continue; fi
-		[ -f "$dest" ] && [ ! -L "$dest" ] || continue
-		printf '%s\n' "$row" >>"$3" || return 1
-	done <"$1"
-	return 0
-}
-
-# THE WRITE ITSELF: `mktemp` in the same directory, `mv -f`. It is the shape
-# `place_skill_and_hook` writes `settings.json` with and for the same reason —
-# a half-written receipt is a receipt that says a file is not this installer's.
-# AND NO `chmod`: the receipt's mode is the 0600 `mktemp` gives the temporary,
-# whatever the umask, which is `settings.json`'s mode too. Two rules meet here
-# and this is how both are kept. #48 (PR #102) rules that EVERY `chmod` this
-# command performs fails through `die` — a mode-stamp failure is a refusal —
-# and `tests/test_openrepotools_command.py` reads the script's text to hold
-# every site to it; #57 rules that a receipt this command cannot write is a
-# NOTE and never a refused install. A stamp that may not `die` and may not
-# fall silent is a stamp that must not exist, and 0600 wants none: this is one
-# account's evidence, read by that account's own retirements, and nothing else
-# reads it.
-#
-# `mv -f` DOES NOT FOLLOW A SYMLINK — it replaces the link itself — which is
-# why `receipt_record` refuses one BEFORE reaching this: silently swapping a
-# person's link for a regular file is the same act `cp` through one is, in the
-# other direction.
-receipt_replace() {   # <staged file> — 0, or 1 having changed nothing
-	local file="" dir="" tmp=""
-	file="$(receipt_file)"
-	dir="$(dirname -- "$file")"
-	mkdir -p -- "$dir" 2>/dev/null || return 1
-	# THE DIRECTORY EXISTS NOW, so the canonical path can be had (round 4 on
-	# #103, `openRepoTools:365`): on a first install the answer above was still
-	# the configured spelling.
-	file="$(receipt_file)"
-	dir="$(dirname -- "$file")"
-	tmp="$(mktemp -- "$dir/installed.tsv.XXXXXX" 2>/dev/null)" || return 1
-	cp -- "$1" "$tmp" 2>/dev/null || { rm -f -- "$tmp"; return 1; }
-	mv -f -- "$tmp" "$file" 2>/dev/null || { rm -f -- "$tmp"; return 1; }
-	return 0
-}
-
-# THE RECEIPT FOR THIS RUN, from the same three lists the placements are made
-# from. Called once, after the last placement and before the one removal.
-receipt_record() {
-	local dir="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-	local file="" kind="" name="" target="" why=""
-	file="$(receipt_file)"
-	# WHAT IS AT THAT PATH, BEFORE A BYTE OF IT IS READ OR WRITTEN — the same
-	# question `plan_install_targets` and `plan_skill_targets` put to every
-	# path this command writes, asked through the same `path_kind`. A symlink,
-	# a directory or anything else there is not this installer's receipt: it is
-	# neither read nor replaced, and the note says which it found.
-	if kind="$(path_kind "$file")"; then
-		receipt_note "$file" "it is $kind, and this installer's receipt is a regular file it makes itself — $RECEIPT_ELSEWHERE"
-		return 0
-	fi
-	# AND WHETHER THERE IS ANYTHING HERE TO DIGEST WITH, asked once and named as
-	# the cause it is. Without this the first file would fail `sha256_of` and
-	# the note would say that FILE could not be digested — true, and not the
-	# sentence a person needs to read on a machine that has neither tool.
-	if ! command -v sha256sum >/dev/null 2>&1 && ! command -v shasum >/dev/null 2>&1; then
-		receipt_note "$file" "there is no \`sha256sum\` and no \`shasum -a 256\` on this PATH, and a row without a digest is a row that proves nothing"
-		return 0
-	fi
-	workdir
-	RECEIPT_ROWS="$WORKDIR/receipt-rows"
-	RECEIPT_DESTS="$WORKDIR/receipt-dests"
-	RECEIPT_COUNT=0
-	RECEIPT_WHY=""
-	RECEIPT_STAMP="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-	: >"$RECEIPT_ROWS" 2>/dev/null || { receipt_note "$file" "its rows could not be staged in $WORKDIR"; return 0; }
-	: >"$RECEIPT_DESTS" 2>/dev/null || { receipt_note "$file" "its rows could not be staged in $WORKDIR"; return 0; }
-	for name in "${INSTALLABLES[@]}"; do
-		receipt_add "$name" "$dir/$name" || { receipt_note "$file" "$RECEIPT_WHY"; return 0; }
-	done
-	# THE SKILLS AND THE COMMAND FILES TOO, under the name each was PRINTED
-	# with: they are regular files this run placed, at paths it chose, and a
-	# record of what was placed that left them out — every one a path a
-	# retirement could one day meet — would answer only part of the question
-	# anybody asks it.
-	for name in "${SKILLS[@]}"; do
-		for target in "$(skills_home)/shared/skills/$name/SKILL.md" "$(claude_home)/skills/$name/SKILL.md"; do
-			receipt_add "$name" "$target" || { receipt_note "$file" "$RECEIPT_WHY"; return 0; }
-		done
-	done
-	for name in "${COMMANDS[@]}"; do
-		for target in "$(skills_home)/shared/commands/$name.md" "$(claude_home)/commands/$name.md"; do
-			receipt_add "/$name" "$target" || { receipt_note "$file" "$RECEIPT_WHY"; return 0; }
-		done
-	done
-	# THIS RUN'S ROWS FIRST, THEN EVERY EARLIER ROW IT DID NOT REPLACE.
-	receipt_rows_except "$file" "$RECEIPT_DESTS" "$RECEIPT_ROWS" ||
-		{ receipt_note "$file" "the rows already there could not be read"; return 0; }
-	if receipt_replace "$RECEIPT_ROWS"; then
-		file="$(receipt_file)"
-		say "receipt: $RECEIPT_COUNT placed files recorded in $file"
-		case "$(receipt_data_dir)" in
-		/*) ;;
-		*)
-			say "  the data directory $(receipt_data_dir) is a RELATIVE path, which names a different directory from every working directory — this run resolved it to $(dirname -- "$file"). Name an absolute one with \$OPENREPOTOOLS_DATA_DIR so a later \`--install\` from anywhere reads this receipt."
-			;;
-		esac
-	else
-		why="$(unusable_dir_kind "$(dirname -- "$file")")" || why="the write failed"
-		receipt_note "$file" "$why — $RECEIPT_ELSEWHERE"
-	fi
-	return 0
-}
-
-# WHAT THE RECEIPT SAYS ABOUT ONE PATH, in one word, and never an exit code: a
-# `$( )` that returned non-zero under `set -e` would take the install with it,
-# and "I have nothing to say about this file" is an ANSWER here rather than a
-# failure.
-#
-#   placed  — a row names this path and the bytes there still have its digest.
-#             This installer's copy beyond argument.
-#   edited  — a row names it and the digest has MOVED. Somebody's edit of an
-#             installed command, or their own file at a path one used to be:
-#             either way not this installer's to remove.
-#   unknown — no receipt, or no row for THIS path. The header marker is what
-#             answers then, exactly as it does today.
-#   unverified — a row names it and NOTHING COULD BE DIGESTED to compare with:
-#             no `sha256sum` and no `shasum` on this PATH, a tool that failed, or
-#             a file this user cannot read (Copilot on #103, `openRepoTools:711`).
-#             It is NOT `unknown`, and the difference is the whole of #57: the
-#             header marker is the answer for a path the receipt has NOTHING TO
-#             SAY about, and a path it HAS a row for and cannot check is a path
-#             it has something to say about and cannot say yet. The first shape
-#             of this folded the two into one word, so the marker removed an
-#             edited, receipt-tracked command on exactly the machine that could
-#             not tell it was edited — the ownership mistake the receipt exists
-#             to prevent, made by the code that carries it. Named and left.
-#   unreadable — the receipt EXISTS and cannot be OPENED (Copilot round 4 on
-#             #103, `openRepoTools:716`). The scan never ran, so "no row" is not
-#             something it found: it is the same ignorance as `unverified`, one
-#             step earlier, and it gets the same answer — named and left —
-#             with its own sentence, because the person's remedy is the
-#             receipt's mode and not a digest tool. `unknown` is for a scan that
-#             RAN and found nothing.
-#
-# THE FIRST MATCHING ROW WINS. This command writes one row per destination, so
-# a second is a hand-edit, and picking the first is the only rule that does not
-# depend on which end of the file somebody appended to.
-receipt_verdict() {   # <target> — placed | edited | unverified | unreadable | unknown, always 0
-	local file="" row="" rest="" dest="" digest="" disk="" want=""
-	file="$(receipt_file)"
-	[ -f "$file" ] && [ ! -L "$file" ] || { printf 'unknown\n'; return 0; }
-	: 2>/dev/null <"$file" || { printf 'unreadable\n'; return 0; }
-	# THE ROW IS ABOUT A FILE, AND THE FILE IS ASKED ABOUT BY THE SAME SPELLING
-	# THE ROW WAS WRITTEN IN (`receipt_dest`, Copilot on #103, `openRepoTools:524`).
-	want="$(receipt_dest "$1")"
-	while IFS= read -r row || [ -n "$row" ]; do
-		case "$row" in
-		*"$RECEIPT_TAB"*"$RECEIPT_TAB"*"$RECEIPT_TAB"*) ;;
-		*) continue ;;
-		esac
-		rest="${row#*"$RECEIPT_TAB"}"
-		dest="${rest%%"$RECEIPT_TAB"*}"
-		[ "$dest" = "$want" ] || continue
-		digest="${rest#*"$RECEIPT_TAB"}"
-		digest="${digest%%"$RECEIPT_TAB"*}"
-		disk="$(sha256_of "$1")" || { printf 'unverified\n'; return 0; }
-		if [ "$disk" = "$digest" ]; then printf 'placed\n'; else printf 'edited\n'; fi
-		return 0
-	done <"$file"
-	printf 'unknown\n'
-	return 0
-}
-
-# AND THE ROW OF A FILE THAT IS NO LONGER THERE IS DROPPED, because a receipt
-# that still names a removed path would answer `edited` about whatever somebody
-# puts there next — which is the safe direction, and still a sentence about
-# their file that is not true.
-#
-# NOT ONE OF ITS FAILURES IS SILENT (Copilot round 1 on #103, `openRepoTools:660`).
-# Three of the four steps here used to `return 0` on a write that failed — a
-# full disk while staging, a data directory that went away between the read and
-# the write — so the receipt could keep a live row for a path the `rm` above had
-# just emptied and NOTHING on screen would say so. Every one of them now reaches
-# the same note, and the note names the repair: `receipt_rows_except` drops a
-# row whose file is gone, so the next `--install` clears it whatever happened
-# here. Still never a `die`: the retirement has already done its work.
-receipt_forget() {   # <destination>
-	local file="" kept="" dests="" dropped=1
-	file="$(receipt_file)"
-	[ -f "$file" ] && [ ! -L "$file" ] || return 0
-	workdir
-	kept="$WORKDIR/receipt-kept"
-	dests="$WORKDIR/receipt-forget"
-	# THE ROW IS DROPPED BY THE SPELLING IT WAS WRITTEN IN (`receipt_dest`); the
-	# note below still names the path as the person spelled it.
-	if : >"$kept" 2>/dev/null && printf '%s\n' "$(receipt_dest "$1")" >"$dests" 2>/dev/null &&
-		receipt_rows_except "$file" "$dests" "$kept" &&
-		receipt_replace "$kept"; then
-		dropped=0
-	fi
-	[ "$dropped" = 0 ] ||
-		receipt_note "$file" "its row for $1 could not be dropped, so it still names a path this installer's copy has left — the next \`--install\` drops it, because a row whose file is gone is not kept"
-	return 0
-}
-
-# ---------------------------------------------- THE WORDS THAT WERE RETIRED
-#
-# A WORD THAT LEAVES THE LIST HAS TO LEAVE THE DIRECTORY (Copilot round 1 on
-# #45, `openRepoTools:234`). Dropping `restart` from `INSTALLABLES` stops THIS
-# run from copying it and does nothing at all about the copy the LAST run
-# placed — so a workstation that took the install before lane-collision-protocol
-# Amendment 18 Addendum 2 would keep `restart` on its PATH for ever, which is
-# the one thing that addendum says must stop: *"`restart` is no longer a command
-# a person is given"*, ratified 2026-09-14T16:50:32Z verbatim "ratify". An
-# installer whose only act is to stop writing a file is not a retirement; it is
-# a file nobody will ever clean up.
-#
-# AND IT REMOVES ONLY WHAT IT WROTE. The test is the header this installer puts
-# in every command it owns — `Installed on PATH by ` + the installer's own name
-# — so a person's own script that happens to be called `restart` is NAMED and
-# LEFT EXACTLY AS IT IS, with the one line to run printed beside it. Deleting a
-# file this command did not write is not an act an installer may take on
-# somebody's behalf, and a retirement that did would be the worst possible way
-# to learn the difference.
-RETIRED=(restart)
-retire_commands() {
-	local dir="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-	local name target verdict=""
-	for name in "${RETIRED[@]}"; do
-		target="$dir/$name"
-		# `-e` FOLLOWS THE LINK AND IS FALSE FOR A DANGLING ONE (Copilot round 4 on
-		# #45, `openRepoTools:261`), so a `restart` SYMLINK whose target has since
-		# gone — and the pre-move `link-estates` put exactly such links in a
-		# workstation's `~/.local/bin`, pointing into a checkout that may no longer
-		# be there — was NEITHER removed NOR named: it stayed on PATH, and the one
-		# run that was going to mention it said nothing. `-L` is the other half of
-		# "is there anything at this path at all"; what happens next is the same as
-		# for any other link, which is that it is named and left.
-		[ -e "$target" ] || [ -L "$target" ] || continue
-		# `! -L` BEFORE `-f`, BECAUSE `-f` FOLLOWS THE LINK (Copilot round 2 on
-		# #45). A person's own `restart` SYMLINK pointing at a file that happens
-		# to carry this installer's header would otherwise be unlinked — and
-		# `plan_install_targets` refuses a `-L` target for exactly that reason
-		# (`unplaceable_kind`, which names the link rather than writing through
-		# it). A link is somebody's decision about their own PATH; it is named
-		# here and left, like every other file this installer did not write.
-		#
-		# THE RECEIPT IS ASKED FIRST, AND THE MARKER IS WHAT ANSWERS WHEN IT HAS
-		# NOTHING TO SAY (#57, on Copilot's round-3 finding on #45). A row whose
-		# digest still matches is this installer's copy beyond argument; a row
-		# whose digest has MOVED is a file this installer may not remove even
-		# though the header is still in it, because what the header proves is
-		# where those lines came from and not who owns the bytes now. It is
-		# asked only of a REGULAR FILE THAT IS NOT A LINK, for the reason the
-		# `! -L` below gives: a link is somebody's decision about their own
-		# PATH, whatever the receipt remembers about the path it sits at.
-		verdict=unknown
-		if [ ! -L "$target" ] && [ -f "$target" ]; then
-			verdict="$(receipt_verdict "$target")"
-		fi
-		if [ "$verdict" = placed ]; then
-			rm -f -- "$target"
-			# AND THE ROW GOES WITH THE FILE, so the receipt never names a path
-			# nothing of this installer's is at any more.
-			receipt_forget "$target"
-			say "$name: RETIRED, removed from $target — this installer's own receipt carries its digest (lane-collision-protocol Amendment 18 Addendum 2; \`lane <name>\` is that act now)"
-		elif [ "$verdict" = edited ]; then
-			say "$name: RETIRED by lane-collision-protocol Amendment 18 Addendum 2, and $target no longer holds the bytes this installer's receipt recorded — an edit of it, or your own file at that path. Left exactly as it is; remove it yourself if it is stale:  rm -f -- \"$target\""
-		elif [ "$verdict" = unverified ]; then
-			# A ROW IT CANNOT CHECK IS NEVER THE HEADER'S TO ANSWER (Copilot on #103,
-			# `openRepoTools:711`): the receipt names this path, so the marker is not
-			# the evidence — and the digest that would have settled it could not be
-			# taken. One line, the same shape as the two above: where, why, the `rm`.
-			say "$name: RETIRED by lane-collision-protocol Amendment 18 Addendum 2, and $target has a row in this installer's receipt that could not be checked, because no digest tool answered (\`sha256sum\`, \`shasum -a 256\`) — so it is NOT removed on the strength of its header either. Left exactly as it is; remove it yourself if it is stale:  rm -f -- \"$target\""
-		elif [ "$verdict" = unreadable ]; then
-			# A RECEIPT THAT CANNOT BE OPENED CANNOT SAY "NO ROW" (Copilot round 4 on
-			# #103, `openRepoTools:716`): it may carry exactly the row that says this
-			# file is an edit. Same shape as the arm above, and it names the receipt,
-			# because that is the file whose mode the person has to look at.
-			say "$name: RETIRED by lane-collision-protocol Amendment 18 Addendum 2, and this installer's receipt $(receipt_file) exists but could not be read, so whether $target is its copy is not known — it is NOT removed on the strength of its header either. Left exactly as it is; remove it yourself if it is stale:  rm -f -- \"$target\""
-		elif [ ! -L "$target" ] && [ -f "$target" ] && grep -qF -e 'Installed on PATH by `openRepoTools --install`' -- "$target" 2>/dev/null; then
-			rm -f -- "$target"
-			say "$name: RETIRED, removed from $target (lane-collision-protocol Amendment 18 Addendum 2; \`lane <name>\` is that act now)"
-		else
-			# THE PRINTED REMOVAL IS QUOTED, AND IT IS THIS FILE'S OWN SPELLING
-			# (Copilot round 9 on #45, `openRepoTools:281`): both planners print
-			# `rm -f -- "<path>" "<path>"` out of a `paths` they build with the
-			# quotes IN, because `OPENREPOTOOLS_BIN_DIR` is a path a person chooses
-			# and a bare one with a space in it is a line that removes nothing. `-f`
-			# for the reason those two give: what a removal needs is the DIRECTORY's
-			# write bit, not the file's.
-			say "$name: RETIRED by lane-collision-protocol Amendment 18 Addendum 2, and $target is NOT this installer's copy — left exactly as it is. Remove it yourself if it is stale:  rm -f -- \"$target\""
-		fi
-	done
-}
-
-# ALL OF THEM IN HAND BEFORE ANY OF THEM IS PLACED (openRepoShape #82, F10 of
-# the review on its #83). One file at a time, dying on the first fetch that
-# failed, leaves a person with a NEW `openRepoTools` and no `park` — a
-# half-install that says `installed at` and is not one — and nothing on screen
-# to say which were missing. Every one is collected into the temporary directory
-# first: a failure there replaces NOTHING, names what was not fetched, and exits.
-#
-# NO NUMBER IS SPELLED IN THIS BLOCK, and that is the fix rather than a bigger
-# number (#26, the review of `37632b1`, `openRepoTools:226`). It said "ALL FOUR"
-# and "which of the four" while `INSTALLABLES` carried ELEVEN — the count grew
-# under a comment stating the old one, which is the same defect as the stale
-# artifact counts `2f44da0` corrected and as `lane-start`'s "no fifth rung". The
-# code below already derives every count it prints from `${#INSTALLABLES[@]}`.
-collect_commands() {
-	local name missing=""
-	# Run from a file, install THOSE bytes: `--install` then needs no network
-	# and no `gh` at all — and `park`, `resume` and `status` sit BESIDE this
-	# file, in the checkout and in the repository alike, so the siblings that
-	# are there are copied and only a missing one is fetched. Run from stdin
-	# (`curl … | bash -s -- --install`) there is no file to copy from at all,
-	# so each one is fetched at this same ref. WHICH of those it is, and from
-	# where, is `payload_select`'s one decision (#186), made before this runs.
-	payload_select
-	workdir
-	STAGED="$WORKDIR/staged"
-	mkdir -p "$STAGED"
-	for name in "${INSTALLABLES[@]}"; do
-		if [ -n "$PAYLOAD_DIR" ] && [ -f "$PAYLOAD_DIR/$name" ]; then
-			cp -- "$PAYLOAD_DIR/$name" "$STAGED/$name"
-			continue
-		fi
-		# A LOCAL SOURCE IS NEVER COMPLETED FROM A NETWORK: it was whole when
-		# it was chosen, and a file gone since is missing, not fetched.
-		if [ "$PAYLOAD_MODE" != local ]; then
-			fetch_from_repo "$name" "$STAGED/$name" && continue
-		fi
-		missing="${missing:+$missing }$name"
-	done
-	[ -z "$missing" ] || die "could not fetch $missing from $(payload_where), so NOTHING was installed
-    and nothing already installed was replaced. \`--install\` places all
-    ${#INSTALLABLES[@]} files or none: a new openRepoTools beside a missing park is
-    a half-install that reads like a whole one. Both ways were tried:
-    gh api repos/${PAYLOAD_REPO:-$REPO}/contents/<file>?ref=${PAYLOAD_REV:-$REF}
-    curl -fsSL https://raw.githubusercontent.com/${PAYLOAD_REPO:-$REPO}/${PAYLOAD_REV:-$REF}/<file>"
-}
-
-# WHAT MODE A PLACED ARTIFACT IS AT, asked without `stat`. GNU spells that
-# `stat -c %a` and BSD `stat -f %Lp`, and nothing this repository ships may
-# reach for one of the two without the other beside it — so `find` answers it
-# instead, in the one spelling both agree on: with the octal preceded by
-# neither `-` nor `+`, GNU and BSD `find` each evaluate `-perm` true only where
-# the permission bits are EXACTLY that number.
-#
-# IT IS ASKED SO THAT A LINE CAN TELL THE TWO CASES APART. `--install` stamps
-# the documented mode on every artifact whether or not the bytes changed
-# (#40, findings 2 and 3), and a run that repaired a mode and reported
-# `unchanged` is a run that told a person there was nothing to look at.
-mode_is() {   # <octal> <path>
-	[ -n "$(find "$2" -maxdepth 0 -perm "$1" -print 2>/dev/null)" ]
-}
-
-# WHO OWNS A PATH, as `<uid>:<gid>`, and nothing where it cannot be read —
-# asked without `stat` for the reason `mode_is` gives. `ls -n` prints both as
-# numbers, in its third and fourth fields, on GNU, BSD and busybox alike, and
-# `-d` keeps the answer about the path itself. The `|| :` keeps a path `ls`
-# cannot read an empty answer rather than a `pipefail` exit.
-owner_of() {   # <path>
-	{ ls -lnd -- "$1" 2>/dev/null || :; } | awk 'NR == 1 { print $3 ":" $4 }'
-}
-
-# EVERY FILE `--install` PLACES IS WRITTEN BESIDE ITS TARGET AND RENAMED OVER IT
-# (opensoft/openRepoTools#167): a temporary in the target's own directory, the
-# bytes, the mode, then `mv -f`. It was `cp` onto the target, which keeps the
-# target's INODE and rewrites its bytes — and bash reads a script from its file
-# while it runs it, at an offset, so a lane tool that was running when an
-# install replaced it went on reading the NEW text from the OLD offset. Measured
-# on 2026-09-30: `A.sh: line 4: ript,: command not found`, then the new text's
-# commands run from its middle. `lanes-edit.sh`, `lane-start` and the landers
-# run for minutes, so a repair install at a busy moment could corrupt a lane's
-# register write mid-flight. A rename puts a NEW inode at the path in one step:
-# a process that has the old one open reads the old text to its end, and the
-# next one to start reads the new. The SAME directory, because a rename is
-# atomic only within one filesystem, and the same shape the receipt and
-# `settings.json` were already written in.
-#
-# THE MODE GOES ON THE TEMPORARY, so the target never exists at the wrong mode
-# for even an instant, and a stamp that fails (#48) leaves whatever was at the
-# target exactly as it was.
-#
-# EVERY FAILURE REMOVES THE TEMPORARY, then refuses naming the target, and a
-# run killed while one exists leaves nothing behind either: `$PLACING` holds
-# its PREFIX — `.<name>.openrepotools.<this pid>.` — from BEFORE `mktemp` runs
-# until after the `mv`, and the `EXIT` trap removes whatever starts with it. A
-# name the trap learnt only from `mktemp`'s answer had a window, between the
-# file being made and the answer being assigned, in which a signal left it
-# behind (Copilot round 2 on #172); the pid keeps the prefix this run's own.
-# The leading dot keeps it out of a listing, and the suffix after the name
-# keeps it out of every glob a reader of these directories takes (`*.md` in
-# `commands/`).
-#
-# THE OWNER STAYS WHO IT WAS (Copilot on #172). A rename puts the TEMPORARY's
-# inode at the path, and the temporary belongs to whoever runs this — so a root
-# `--install` into another user's home, which this file goes out of its way to
-# allow (search "WHAT `-w` DOES NOT PROVE"), would hand that user root-owned
-# copies that their own next `--install` refuses as unwritable. `cp` kept the
-# owner by keeping the inode; this keeps it by giving the temporary the
-# target's uid and gid before the rename. Where that `chown` is refused and the
-# OWNER differs — an account placing over a file another account owns, which
-# only root may give away — the placement refuses rather than take the file
-# over. Where only the GROUP differs and cannot be kept, it is placed anyway:
-# at 755 and 644 the group's bits are the other bits, so nobody gains or loses
-# a permission by it (Copilot round 2 on #172 asked that it not be silent, and
-# this is why it may be). And an owner NOBODY COULD READ is not "nothing to
-# keep": `owner_of` answers nothing where `ls` cannot say, which is also what an
-# absent target gives, so a target that EXISTS with no readable owner is
-# refused before the rename rather than handed this run's owner (Copilot on
-# #172 at bef4b85).
-#
-# A DIRECTORY AT THE TARGET IS REFUSED HERE as well as in planning, because `mv`
-# moves a file INTO a directory named as its destination rather than failing,
-# and the planners are a phase earlier. Two installs that race (#106) each
-# still place whole files; serializing them is #106's lock, not this.
-place_by_rename() {   # <staged source> <target> <mode> <what a refusal adds>
-	local source="$1" target="$2" mode="$3" rest="$4" tmp="" was="" now=""
-	PLACING="$(dirname -- "$target")/.${target##*/}.openrepotools.$$."
-	tmp="$(mktemp -- "${PLACING}XXXXXX")" ||
-		{ rm -f -- "$PLACING"*; PLACING=""; die "could not create a temporary file beside $target, so it was not placed.
-    $rest"; }
-	cp -- "$source" "$tmp" ||
-		{ rm -f -- "$tmp"; PLACING=""; die "could not write $target, so it was not placed and what was there is untouched.
-    $rest"; }
-	chmod "$mode" "$tmp" ||
-		{ rm -f -- "$tmp"; PLACING=""; die "could not set mode $mode on $target, so it was not placed and what was there is untouched.
-    $rest"; }
-	was="$(owner_of "$target")"
-	now="$(owner_of "$tmp")"
-	if [ -z "$was" ] && { [ -e "$target" ] || [ -L "$target" ]; }; then
-		rm -f -- "$tmp"
-		PLACING=""
-		die "could not read who owns $target, so it was not placed and what was there is untouched: a rename would give it this run's owner.
-    $rest"
-	fi
-	if [ -n "$was" ] && [ "$was" != "$now" ] &&
-		! chown -- "$was" "$tmp" 2>/dev/null &&
-		[ "${was%%:*}" != "${now%%:*}" ]; then
-		rm -f -- "$tmp"
-		PLACING=""
-		die "$target belongs to uid ${was%%:*}, and this run cannot give the new copy that owner, so it was not placed and what was there is untouched.
-    $rest"
-	fi
-	if [ -d "$target" ]; then
-		rm -f -- "$tmp"
-		PLACING=""
-		die "$target is a directory, so nothing was placed there: \`mv\` would have put the file inside it.
-    $rest"
-	fi
-	mv -f -- "$tmp" "$target" ||
-		{ rm -f -- "$tmp"; PLACING=""; die "could not move the new $target into place, so what was there is untouched.
-    $rest"; }
-	PLACING=""
-}
-
-install_commands() {
-	local dir="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-	local name target source verb placed=0
-	# ALL THIRTY-ONE IN HAND BEFORE ANY IS PLACED. The seventeen files, the
-	# three skills, the three command files, and the TWO artifacts that are not
-	# whole files — the two hook entries merged into one `settings.json` —
-	# are all computed here, so a fetch that failed replaces nothing and a merge
-	# that cannot be computed refuses having placed nothing. That last one is
-	# the same rule `--install` already had, extended to cover a merge: an
-	# installer that got half way through a person's settings is worse than one
-	# that did not start. BOTH OUTCOMES OF THAT MERGE ARE IN HAND (#237) — the
-	# pair added, and the pair deferred with our guard entry taken out — and
-	# which one is written is asked only after the bin loop, because the path
-	# the two entries call is a link to the `lanes-edit.sh` that loop places.
-	#
-	# THE TARGETS ARE ASKED ABOUT FIRST, before even the fetch: a target that
-	# cannot be written THROUGH is a refusal that costs nothing at all here,
-	# and a network round-trip if it waits (A9 Addendum 4, R-A9-12).
-	plan_install_targets
-	# THE SOURCE NEXT, AND ONCE (#186): which bytes, from where, at which
-	# commit — every refusal in it costs nothing, because nothing is collected
-	# or placed until it has answered.
-	payload_select
-	collect_commands
-	collect_skills || die "could not fetch one of the ${#SKILLS[@]} skills (${SKILLS[*]}) or the ${#COMMANDS[@]} command file (${COMMANDS[*]}) from $(payload_where), so
-    NOTHING was installed and nothing already installed was replaced."
-	plan_hook_merge
-	plan_skill_targets
-	# EVERY FAILURE FROM HERE IS A `die`, and this was the one that was not
-	# (#44 round 1, Sourcery's `README.md:237`). `plan_install_targets` has
-	# proved the nearest existing ancestor writable, so what is left for this to
-	# meet is a race or a full disk — and under `set -e` an unguarded `mkdir`
-	# exits 1, which reads as a report of findings from a run that placed none.
-	mkdir -p -- "$dir" || die "could not create $dir for the ${#INSTALLABLES[@]} commands.
-    NOTHING was installed and nothing already installed was replaced."
-	for name in "${INSTALLABLES[@]}"; do
-		source="$STAGED/$name"
-		target="$dir/$name"
-		# PIPX'S LINK IS LEFT TO PIPX (#228, FR-016), as `plan_install_targets`
-		# decided: nothing is placed over it or through it, it is not counted,
-		# and its line says what updates it.
-		if [ -n "$PIPX_LINK" ] && [ "$target" = "$PIPX_LINK" ]; then
-			say "openRepoTools: left to pipx at $PIPX_LINK (a link into pipx's openrepotools environment); update it with \`pipx upgrade openrepotools\`, then run \`openRepoTools --install\` again"
-			continue
-		fi
-		if [ -e "$target" ] && cmp -s "$source" "$target"; then
-			# THE BYTES WERE RIGHT, WHICH IS NOT THE SAME AS NOTHING TO DO
-			# (#40, finding 2). The `chmod` below has always run on this arm
-			# too — the eleven are the one set this installer never got wrong —
-			# but the line said `unchanged` over a mode it had just repaired.
-			# The mode is asked BEFORE it is stamped, and the line says which
-			# of the two happened.
-			if mode_is 755 "$target"; then
-				verb="already installed at $target (unchanged)"
-			else
-				verb="already installed at $target (mode restored to 755)"
-			fi
-			# STAMPED EVERY TIME, AND ITS FAILURE IS A REFUSAL (#48). A copy that
-			# is not executable is not a command, and this was the ONE mode stamp
-			# in this file with no `die` beside it: under `set -e` a failure here
-			# left the shell's own 1, which this toolset spends on "findings were
-			# printed", as the answer from a run that was refusing with the
-			# commands before it already placed. On THIS arm it is stamped in
-			# place — a mode is metadata, and no running copy reads it — and on
-			# the other `place_by_rename` stamps the temporary (#167).
-			#
-			# AND NO OWNERSHIP PREFLIGHT IN FRONT OF IT, which is the decision
-			# `unplaceable_kind` already carries — search "WHAT `-w` DOES NOT PROVE"
-			# for the whole of it. `[ -O ]` is the question that would catch this
-			# first, and it is a guard no test in this suite can reach and one that
-			# would refuse a root `--install` into another user's home, where the
-			# stamp does in fact succeed. R-A9-15 is the ruling that a guard nobody
-			# can test is a guard nobody can rely on, so the stamp's own failure is
-			# the refusal, naming the file it could not mode.
-			chmod 755 "$target" ||
-				die "could not set mode 755 on $target, so that command is not executable.
-    Whatever the lines above report is placed; this one has its bytes and not its
-    mode, and the skills, the command files and the hook entries are not placed at
-    all."
-		else
-			if [ -e "$target" ]; then verb="updated at $target"; else verb="installed at $target"; fi
-			# WRITTEN BESIDE ITSELF AND RENAMED OVER ITSELF, never rewritten in
-			# place (#167): a lane tool running from this path finishes on the
-			# text it started with. `place_by_rename` says why.
-			place_by_rename "$source" "$target" 755 "Whatever the lines above report is placed; the skills, the command files and the
-    hook entries are not placed at all."
-		fi
-		placed=$((placed + 1))
-		say "$name: $verb"
-	done
-	# THE COUNT, out loud: a person reading eight lines cannot tell whether a
-	# ninth was meant to be there.
-	if [ -z "$PIPX_LINK" ]; then
-		say "openRepoTools: $placed of ${#INSTALLABLES[@]} placed in $dir"
-	elif pipx_own_run; then
-		# BESIDE PIPX'S LINK the count says where the missing one is
-		# (contracts/cli-output.md), and from pipx's own environment that is
-		# all it says.
-		say "openRepoTools: $placed of ${#INSTALLABLES[@]} placed in $dir, and 1 left to pipx"
-	else
-		# ANY OTHER RUN BESIDE IT — a checkout's, the one-line install's, a
-		# package outside pipx's venv — also says where the other sixteen now
-		# come from and which release is beside the link (research R5,
-		# FR-019): `install_source` and `pipx_release` say why each is spelt so.
-		say "openRepoTools: $placed of ${#INSTALLABLES[@]} placed in $dir, and 1 left to pipx; the other $placed now come from $(install_source), not from $(pipx_release)"
-	fi
-	# THE RETIREMENT IS THE LAST ACT OF THE INSTALL, AFTER EVERY PLACEMENT
-	# (Copilot round 7 on #45, `openRepoTools:369`). It is the one DESTRUCTIVE
-	# step here, and it ran before `place_skill_and_hook` — so a skill directory
-	# or a `settings.json` this run could not write left a workstation with the
-	# old word already deleted and the adoption it was migrating to unfinished.
-	# Every other refusal in this file places NOTHING rather than half of it; this
-	# one removes nothing until the rest of the install has actually happened.
-	place_skill_and_hook
-	# THE RECEIPT IS WRITTEN BETWEEN THE LAST PLACEMENT AND THE ONE REMOVAL
-	# (#57). After the placements, because a row carries the digest of the bytes
-	# that are actually at a destination and every destination has to have been
-	# written first; before the retirement, because that reads it and then drops
-	# the row of anything it removes. A run that REFUSED part way through the
-	# placements writes none of it and leaves the header marker as the evidence,
-	# which is the population the marker exists for anyway.
-	receipt_record
-	retire_commands
-	# ONE PATH NOTE for everything it placed: the directory is the same one.
-	case ":${PATH:-}:" in
-	*":$dir:"*) ;;
-	*)
-		say "  $dir is not on \$PATH. Add it:"
-		say "    export PATH=\"$dir:\$PATH\""
-		;;
-	esac
-	venv_note
-	# AND LAST, IN A PACKAGE: whether the `openRepoTools` a shell will run is
-	# this package's (FR-021). It changes nothing and leaves the exit status.
-	path_report
-}
-
-# ONE VIRTUAL ENVIRONMENT PER REPOSITORY, OUTSIDE THE ESTATE
-# (opensoft/openRepoTools#162, cause 3: "968 of 1,000 removals were dependency
-# caches"). `${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/venvs/<repo>/` is
-# the convention `docs/README-lanes.md` states, and this repository's own is
-# NAMED here with its state - and NOT CREATED: making one needs pip and the
-# network, and an install from a checkout needs neither. `tests/run.sh` runs
-# the suite from it once it is there and has pytest.
-venv_note() {
-	local venv="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/venvs/openRepoTools"
-	if [ -x "$venv/bin/python3" ]; then
-		say "openRepoTools: this repository's virtual environment is $venv (present; tests/run.sh runs from it when it has pytest)"
-	else
-		say "openRepoTools: this repository's virtual environment is $venv (not created; one per repository, outside the estate):"
-		# QUOTED FOR THE SHELL IT IS PASTED INTO: `$XDG_CACHE_HOME` is the
-		# person's to choose, spaces and all.
-		say "    python3 -m venv $(printf '%q' "$venv") && $(printf '%q' "$venv/bin/python3") -m pip install pytest"
-	fi
-}
-
-
-# =========================================================================
-# THE FOURTEEN ARTIFACTS THAT ARE NOT ONE OF THE SEVENTEEN FILES
-# =========================================================================
-#
-# lane-collision-protocol Amendment 9(b), inheriting A8 Addendum 2's R-A8-5
-# unvaried — and that ruling is itself ratified. Measured on Eagle 2026-09-12:
-# every `pclaude run` execs with `CLAUDE_CONFIG_DIR=<profile dir>`; 418 profile
-# config dirs exist; 0 of them carry a SessionStart hook; and every profile's
-# `skills` is a symlink to ONE shared directory. So:
-#
-#   * EACH SKILL goes to `$CLAUDE_PROFILES_HOME/shared/skills/<name>/SKILL.md`
-#     — one write that all 418 profiles read through their own symlinks;
-#   * `~/.claude` KEEPS A COPY of each skill for a bare `claude` run outside the
-#     launcher, plus ONE MERGED ENTRY in `~/.claude/settings.json`;
-#   * THE PROFILE `SessionStart` ENTRY IS NOT THIS COMMAND'S. It stays the
-#     launcher's, which already rewrites each profile's settings.json on every
-#     run and preserves hook keys. This command never writes a profile's
-#     settings.json at all. One path, one writer, in both halves.
-#
-# TWENTY-NINE ARTIFACTS ALWAYS, PLUS THE TWO HOOK ENTRIES ONCE THEIR TARGET
-# ANSWERS, AND THE COUNT IS THE INVARIANT: seventeen files in the bin
-# directory, three skills in the shared skills directory, their three bare-run
-# copies, THREE COMMAND FILES at those same two paths, and — once
-# `~/projects/xFactory/lanes-edit.sh` exists, is executable and answers `guard`
-# (opensoft/openRepoTools#237, the launcher's own rule) — TWO merged entries in
-# `~/.claude/settings.json`. It was twelve before Amendment 11 added a SECOND
-# WORD ON PATH — `restart` then, `lane` since Amendment 18 Addendum 2 retired
-# that one — `lanes` and the `/restart` skill, sixteen before ruling 9 added
-# `commands/swap.md`, eighteen before Amendment 12 adoption act 3 added the
-# `UserPromptSubmit` name guard beside the `SessionStart` entry, and nineteen
-# before Amendment 17 added `lane-handoff`, the `handoff` skill and the
-# `/handoff` and `/ctx` command files, twenty-six before Amendment 16 added
-# `lane-rename`, twenty-seven before opensoft/workBenches#119 added
-# `claude-current` and `claude-restart-check`, twenty-nine before
-# opensoft/openRepoTools#160 added `lanes-index`, and thirty before
-# opensoft/openRepoTools#162 added `lane-worktrees`; #237 then held the last
-# two back until the path they call answers, which moves no list. The count
-# moves with the lists rather than being restated from memory.
-#
-# WHY A COMMAND FILE IS HERE AT ALL, WHEN ADOPTION ACT 6 SAYS THE LAUNCHER
-# VENDORS THEM (F-X28, A11 Addendum 4 ruling 9, ratified "a11 addendum 4 yes").
-# `opensoft/workBenches#74` @`0b7f6bc` deletes the whole `claude/commands` lane
-# surface along with the launcher's copy of the `lane-swap` skill — and act 6,
-# which would have `--install` inherit the command files, comes AFTER act 3,
-# which is this PR's base. So on the day 4b lands, clause (g)'s `/swap` — a
-# RATIFIED decision, and one of the six edits to in-force text — would be
-# installed by NOBODY. The alternative was a PR of its own between now and then,
-# and the ruling took this one.
-
-#: THE SKILLS THIS REPOSITORY SHIPS, each placed at the same two paths. A
-#: skill's DIRECTORY NAME is what `/<name>` invokes, so the list is the names
-#: and every path is derived from one.
-#:
-#: `restart` joins `lane-swap` under Amendment 11 clause (f) and ratified
-#: decision 7: `/restart` is the INSIDE half and `lane <name>` on `PATH` is the
-#: outside one (Amendment 18 Addendum 2 retired `restart` from the PATH and
-#: moved its act to that word), and the inside half has to be a skill because a
-#: running session cannot `exec` a launcher over itself.
-SKILLS=(handoff lane-swap restart)
-skill_source_path() { printf 'skills/%s/SKILL.md\n' "$1"; }
-
-#: THE COMMAND FILES THIS REPOSITORY SHIPS, each placed at the same two paths a
-#: skill is (A11 Addendum 4 ruling 9). A command file's BASENAME is what
-#: `/<name>` invokes, so the list is the names and every path is derived from
-#: one — the same shape `SKILLS` has, for the same reason.
-#:
-#: `swap` is clause (g)'s ratified alias: `/swap` invokes the `lane-swap` skill
-#: and adds nothing to it. The file is vendored BYTE FOR BYTE from
-#: `opensoft/workBenches#71`, which is where it was written, because two copies
-#: of one procedure that must stay byte-equal is the alternative that clause
-#: rejects by name — and `#74` deletes that copy, which is why this one exists.
-COMMANDS=(handoff ctx swap)
-command_source_path() { printf 'commands/%s.md\n' "$1"; }
-#: Kept as a single name for the one thing that is still singular: the
-#: `SessionStart` hook's own entry, which belongs to the handoff skill's
-#: amendment and not to the skill set. The name moved with the skill under
-#: Amendment 17(a) — one act, three names — and the ENTRY it keys is unchanged,
-#: because its only idempotence is the exact command string.
-SKILL_NAME="handoff"
-SKILL_SOURCE_PATH="$(skill_source_path "$SKILL_NAME")"
-
-skills_home() { printf '%s\n' "${CLAUDE_PROFILES_HOME:-$HOME/.claude-profiles}"; }
-claude_home() { printf '%s\n' "${CLAUDE_USER_DIR:-$HOME/.claude}"; }
-
-#: THE HOOK ENTRY, byte for byte Amendment 8 clause (e)'s and byte for byte
-#: what opensoft/workBenches#63's launcher ensures in each profile. The string
-#: is the ONLY idempotence any of the three places has — a re-formatted
-#: quotation of a string whose only idempotence is exact match is a SECOND
-#: string — so it is spelled once here and never rebuilt.
-HOOK_COMMAND='~/projects/xFactory/lanes-edit.sh session-start || true'
-HOOK_MATCHER='startup|resume|clear|fork'
-HOOK_TIMEOUT=5
-
-hook_block_text() {
-	cat <<'BLOCK'
-  {
-    "matcher": "startup|resume|clear|fork",
-    "hooks": [
-      { "type": "command", "command": "~/projects/xFactory/lanes-edit.sh session-start || true", "timeout": 5 }
-    ]
-  }
-BLOCK
-}
-
-#: THE SECOND HOOK — lane-collision-protocol AMENDMENT 12's NAME GUARD, adoption
-#: act 3 (opensoft/openRepoTools#25). Same shape, same file, same all-or-nothing
-#: merge, and TWO deliberate differences from the entry above:
-#:
-#:   * NO `|| true`. On `SessionStart` that suffix is the whole safety property —
-#:     a hook that dies must not break the session it was meant to orient. On
-#:     `UserPromptSubmit` it would be the OPPOSITE of the mechanism: exit 2 is
-#:     what BLOCKS a prompt (code.claude.com/docs/en/hooks), and `cmd || true`
-#:     exits 0 for every code the command can produce. Copying the string with
-#:     its suffix would have installed a guard that refuses nothing, silently,
-#:     which is the exact state Amendment 12 exists to end.
-#:   * NO MATCHER. `UserPromptSubmit` has no source to match on; the `matcher`
-#:     key belongs to the events that do.
-#:
-#: The `~/projects/xFactory/lanes-edit.sh` spelling is the estate's convention
-#: and `link-estates` places that link — the same path the entry above uses, so
-#: one workstation has one spelling of one file.
-GUARD_COMMAND='~/projects/xFactory/lanes-edit.sh guard'
-GUARD_TIMEOUT=5
-
-guard_block_text() {
-	cat <<'BLOCK'
-  {
-    "hooks": [
-      { "type": "command", "command": "~/projects/xFactory/lanes-edit.sh guard", "timeout": 5 }
-    ]
-  }
-BLOCK
-}
-
-#: THE GATE ON THE PAIR (opensoft/openRepoTools#237, opensoft/workBenches#107).
-#: Both entries call `~/projects/xFactory/lanes-edit.sh`, a symlink `link-estates`
-#: places — and on a fresh workstation only `openRepoTools wip init` runs that,
-#: AFTER this install. Merged before the link exists, the guard is a command that
-#: is not there at every prompt: exit 127, a hook error per prompt, and never the
-#: refusal (exit 2) it is for. So the pair is merged only once that path EXISTS,
-#: IS EXECUTABLE AND ANSWERS `guard`, by the probe opensoft/workBenches'
-#: `claude-profile` launcher puts to the same path before it ensures the same two
-#: strings in each profile: the `awk` below is that probe byte for byte — comment
-#: lines dropped, the case arm anchored where a line begins, one process and no
-#: pipe. The `-x` is the one test it adds, because a file that is there and not
-#: executable fails the hook the same way (exit 126).
-#:
-#: UNTIL THEN THE PAIR IS DEFERRED, AND EVERY RUN SAYS SO, with the remedy.
-#: Nothing is added, and OUR EXACT GUARD ENTRY, in a file that already carries
-#: it, is taken out — the launcher's own downgrade (workBenches#90), filtered on
-#: each entry's NESTED array (workBenches#89), so every other hook, grouped with
-#: ours or not, stays where it is, and the file is written back at 600. The
-#: `SessionStart` entry is LEFT where it is: it ends in `|| true` and cannot fail
-#: a session, which is the launcher's rule too. The strings, their exact-match
-#: identity, the rival refusal and the receipt do not move; the count does —
-#: twenty-nine artifacts always, plus these two once the path answers.
-#:
-#: `$HOME/projects`, and not `$PROJECTS_DIR`: the `~` in both strings is the
-#: harness's to expand, so that is the one directory the hooks ever run from.
-hook_target() { printf '%s\n' "$HOME/projects/xFactory/lanes-edit.sh"; }
-
-HOOK_TARGET_WHY=""
-hook_target_answers() {   # 0 when the pair may be merged; 1 with $HOOK_TARGET_WHY set
-	local target
-	target="$(hook_target)"
-	HOOK_TARGET_WHY=""
-	if [ ! -e "$target" ]; then
-		if [ -L "$target" ]; then
-			HOOK_TARGET_WHY="${target} is a symlink to $(readlink -- "$target" 2>/dev/null || :), which does not resolve (it is not there, or the links loop)"
-		elif [ -d "$HOME/projects/xFactory" ]; then
-			HOOK_TARGET_WHY="${target} is not there"
-		else
-			HOOK_TARGET_WHY="${target} is not there (nor is $HOME/projects/xFactory, which \`link-estates\` links it into)"
-		fi
-		return 1
-	fi
-	if [ ! -f "$target" ]; then
-		HOOK_TARGET_WHY="${target} is not a regular file"
-		return 1
-	fi
-	if [ ! -x "$target" ]; then
-		HOOK_TARGET_WHY="${target} is not executable"
-		return 1
-	fi
-	# A SCRIPT THAT CANNOT BE READ CANNOT BE RUN, and the probe below cannot
-	# read it either: without this, mode 111 read as "no `guard` subcommand".
-	if [ ! -r "$target" ]; then
-		HOOK_TARGET_WHY="${target} is not readable"
-		return 1
-	fi
-	if ! awk '
-		/^[[:space:]]*#/ { next }
-		/^[[:space:]]*([A-Za-z0-9_-]+\|)*guard(\|[A-Za-z0-9_-]+)*\)/ { found=1; exit }
-		END { exit !found }
-	' "$target" 2>/dev/null; then
-		HOOK_TARGET_WHY="${target} has no \`guard\` subcommand"
-		return 1
-	fi
-	return 0
-}
-
-#: The remedy every deferral and every removal prints, in one place.
-hook_pair_remedy() {
-	# WITH NO `~/projects/xFactory` THE REMEDY BELOW LOOPS: `link-estates` links
-	# into that directory only where it exists, so a re-run alone changes
-	# nothing. That is said first, where it is the case.
-	if [ ! -d "$HOME/projects/xFactory" ]; then
-		say "  ~/projects/xFactory has to exist first: \`link-estates\` links that path only into it."
-	fi
-	say "  The pair is merged once that path answers \`guard\`: \`openRepoTools wip init\` runs"
-	say "  \`link-estates\`, which links it where ~/projects/xFactory exists, and then merges"
-	say "  the pair; or run \`link-estates\` yourself and \`openRepoTools --install\` again."
-}
-
-# EVERY SKILL'S BYTES, by `--install`'s own rule: from the checkout beside this
-# file when run from one, else fetched at this same ref. ALL OF THEM IN HAND
-# BEFORE ANY IS PLACED, which is the same all-or-nothing rule the seventeen files
-# already have — a new `/restart` beside a `handoff` that could not be fetched
-# is a half-install that reads like a whole one.
-collect_skills() {
-	local name src
-	payload_select
-	workdir
-	for name in "${SKILLS[@]}"; do
-		src="$(skill_source_path "$name")"
-		if [ -n "$PAYLOAD_DIR" ] && [ -f "$PAYLOAD_DIR/$src" ]; then
-			cp -- "$PAYLOAD_DIR/$src" "$WORKDIR/skill-$name.md"
-			continue
-		fi
-		[ "$PAYLOAD_MODE" != local ] || return 1
-		fetch_from_repo "$src" "$WORKDIR/skill-$name.md" || return 1
-	done
-	# THE COMMAND FILES IN THE SAME BREATH, under the same all-or-nothing rule
-	# (ruling 9). A `/swap` that could not be fetched beside a `/lane-swap` that
-	# could is a half-install of an ALIAS PAIR, which is worse than either
-	# alone: the skill is installed, the alias the text ratifies is not, and
-	# nothing on screen says which.
-	for name in "${COMMANDS[@]}"; do
-		src="$(command_source_path "$name")"
-		if [ -n "$PAYLOAD_DIR" ] && [ -f "$PAYLOAD_DIR/$src" ]; then
-			cp -- "$PAYLOAD_DIR/$src" "$WORKDIR/command-$name.md"
-			continue
-		fi
-		[ "$PAYLOAD_MODE" != local ] || return 1
-		fetch_from_repo "$src" "$WORKDIR/command-$name.md" || return 1
-	done
-	return 0
-}
-
-# THE TWO MERGES INTO `~/.claude/settings.json`, COMPUTED BEFORE ANYTHING IS
-# PLACED. It is the same all-or-nothing rule `--install` already has, extended
-# to the two artifacts that are not whole files: a merge that cannot be
-# computed refuses having placed nothing — and since Amendment 12 adoption act
-# 3 the rule covers the PAIR, because a settings file that took the
-# `SessionStart` entry and refused the `UserPromptSubmit` guard is a half
-# install of a hook pair and nothing on screen would say which half.
-#
-#   * it is written with `jq`, and refuses naming `jq` where it is absent. This
-#     repository carries no JSON-handling code otherwise, so the dependency is
-#     named rather than assumed. It is not bash, so the macOS bash-3.2 parse
-#     gate is unaffected;
-#   * it NEVER writes the file whole and never replaces it: the file already
-#     carries a `UserPromptSubmit` hook of the person's own — the usage guard
-#     — and a user's settings are not an installer's to own. THAT IS WHY THE
-#     `UserPromptSubmit` ARM KEYS ON THE VERB `guard` AS A WHOLE ARGUMENT and
-#     not as a substring: this command adds an entry to an event a person is
-#     already using, and every entry already there stays exactly where it is;
-#   * it is idempotent by EXACT MATCH on the entry's `command` string;
-#   * an entry under SessionStart whose `command` DIFFERS, one under
-#     UserPromptSubmit that RUNS `guard` with a different string, a file it
-#     cannot parse, or a `hooks` value that is not an object → refuse, print
-#     the exact block, place nothing. An installer that repairs a file it does
-#     not understand is how a person loses a setting they meant;
-#   * it WRITES THE FILE BACK AT MODE 600 — it sets that mode, it does not
-#     preserve one (F8 of the #24 review: a pre-existing file at 640 comes out
-#     600, measured). workBenches' setup-claude-profiles.sh writes this same
-#     file on every ./setup.sh through jq + mktemp + chmod 600 + mv -f, so 600
-#     is the mode this file already has on a host that has run that script, and
-#     an installer that widened it would be silently undone or would widen it
-#     behind that script's back.
-HOOK_PLAN=""      # "absent" | "present" | "nofile"
-GUARD_PLAN=""     # the same three, for Amendment 12's UserPromptSubmit entry
-HOOK_MERGED=""    # a staged whole file, ready to move into place
-HOOK_DEFERRED=""  # the same file with OUR guard entry taken out, or "" (#237)
-HOOK_STRIP_WHY="" # why that entry could not be taken out, or ""
-
-# THE DESTINATIONS, PROVED WRITABLE BEFORE ANY OF THE SEVENTEEN IS PLACED — every
-# directory the artifacts that are not one of the seventeen files go into, derived
-# from the two lists and NOT counted in this sentence. It said "THE THREE
-# DESTINATIONS" while the loop below built seven of them, which is the same
-# defect `collect_commands` names above: a number restated beside a list that
-# grew is a number that goes stale where nobody is looking.
-#
-# Amendment 9(b) computes the merge in hand "so a merge that cannot be computed
-# refuses having placed nothing" — and the merge computing fine against a
-# directory nobody may write to is the same failure one step later. A
-# filesystem gives no transaction, so this cannot make those placements
-# atomic; what it does is move the failure that actually happens — a directory
-# that is not ours to write — back to the planning phase, where the refusal
-# still costs nothing. IT MAKES NONE OF THEM: the question is put to the nearest
-# ancestor that exists, so a run that refuses leaves a machine exactly as it
-# found it, and the placement's own guarded `mkdir -p` is the one writer of
-# these directories (#44 round 1, Sourcery's
-# `tests/test_install_skill_and_hook.py:658`).
-plan_skill_targets() {
-	local d name dirs=() target kind bad="" paths=""
-	for name in "${SKILLS[@]}"; do
-		dirs+=("$(skills_home)/shared/skills/$name" "$(claude_home)/skills/$name")
-	done
-	# A COMMAND FILE HAS NO DIRECTORY OF ITS OWN — it is a file in the commands
-	# directory, where a skill is a `SKILL.md` in a directory named for it — so
-	# the two command destinations are added once rather than once per name.
-	if [ "${#COMMANDS[@]}" -gt 0 ]; then
-		dirs+=("$(skills_home)/shared/commands" "$(claude_home)/commands")
-	fi
-	dirs+=("$(claude_home)")
-	for d in "${dirs[@]}"; do
-		if kind="$(unusable_dir_kind "$d")"; then
-			die "\`--install\` places a skill, a command file or the SessionStart entry in
-    $d (Amendment 9(b)), and $kind.
-    NOTHING was installed and nothing already installed was replaced."
-		fi
-	done
-	# AND THE SIX FILES INSIDE THEM, BY R-A9-12 (F-X17). The loop above proved
-	# the DIRECTORIES writable and stopped there, while `place_skill_and_hook`
-	# then reaches each `SKILL.md` with `[ -e ]`, `cmp -s` and `cp` — not one of
-	# which can tell a regular file from a link to one. So a symlink at
-	# `~/.claude/skills/restart/SKILL.md` was followed and WRITTEN THROUGH: the
-	# skill stays uninstalled, the target stays a link, and the bytes land
-	# wherever it points. That is the same failure R-A9-12 was ruled on for the
-	# seventeen in the bin directory, one directory along, and the ruling says
-	# nothing about which path it applies to.
-	#
-	# `unplaceable_kind` is asked rather than re-tested, because two copies of
-	# one rule is how the bin half would come to refuse a dangling link and the
-	# skill half would not — and that is exactly what happened to the second
-	# half of the question it answers: a target that IS a regular file and is
-	# not this user's to write (#40, finding 4). The eleven were already placed
-	# by the time `cp` met it, on the one path that promises all or none, so the
-	# `-w` is asked here beside the `-L`.
-	#
-	# BOTH QUESTIONS OUTLIVE THE `cp` (#167). The write is a rename now, which
-	# follows no link and needs the DIRECTORY's write bit rather than the
-	# file's — so neither target would FAIL any more; each would be REPLACED,
-	# without a word. A link is somebody's link, and swapping it for a regular
-	# file unasked is the same act as writing through it, in the other
-	# direction (the receipt's own rule, `receipt_replace`); a read-only file
-	# is somebody saying "not this one". The refusal is the same refusal.
-	for name in "${SKILLS[@]}"; do
-		for target in "$(skills_home)/shared/skills/$name/SKILL.md" "$(claude_home)/skills/$name/SKILL.md"; do
-			kind="$(unplaceable_kind "$target")" || continue
-			bad="${bad:+$bad
-}    $target — $kind"
-			paths="${paths:+$paths }\"$target\""
-		done
-	done
-	for name in "${COMMANDS[@]}"; do
-		for target in "$(skills_home)/shared/commands/$name.md" "$(claude_home)/commands/$name.md"; do
-			kind="$(unplaceable_kind "$target")" || continue
-			bad="${bad:+$bad
-}    $target — $kind"
-			paths="${paths:+$paths }\"$target\""
-		done
-	done
-	[ -z "$bad" ] || die "\`--install\` places a REGULAR FILE IT CAN WRITE at each of these skill and
-    command targets, and these are not that:
-$bad
-    Each file is placed by renaming a new copy over its path, so installing
-    over a symlink would replace somebody's link with a regular file, over a
-    directory would put the file inside it, and over a file this user cannot
-    write would replace a file somebody made read-only — none of it asked for.
-    NOTHING was installed and nothing already installed was replaced.
-    Clear them, then re-run — \`rm -f\` takes a read-only file, because what a
-    removal needs is the DIRECTORY's write bit and not the file's:
-        rm -f -- $paths"
-}
-
-# THE SEVENTEEN TARGETS, PROVED PLACEABLE BEFORE ANY OF THE THIRTY-ONE IS PLACED
-# (A9 Addendum 4, R-A9-12, ruled on F5 of the #24 review).
-#
-# `cp` FOLLOWS A SYMLINK. The loop below tested `[ -e "$target" ]`, compared
-# with `cmp -s` and then copied, and not one of the three can tell a regular
-# file from a link to one — so against the bin directory the pre-move
-# `link-estates` actually leaves on a workstation, `--install` printed
-# `lane-start: updated at …`, `9 of 9 placed`, exit 0, and BOTH claims were
-# false: the target stayed a symlink, so the command was never installed, and
-# the post-move bytes landed in `opensoft/brett-wip`'s WORKING TREE on the
-# other end of it. That repository is the one every lane writes:
-# `lanes-edit.sh`'s `refuse_dirty_checkout` then refuses `log`, `claim` and
-# `release` on that workstation until somebody runs `git checkout -- lanes/`.
-# workBenches' `setup-estate-commands.sh` refuses the whole estate install on a
-# target that "already exists as a symlink" too, so a host in this state also
-# fails the estate install that follows — the exact failure clause (f)(3) is
-# written about.
-#
-# THE REFUSAL OUTLIVES THE `cp` (#167). The loop places by RENAME now, which
-# follows no link: it would swap the link itself for a regular file, without a
-# word, which is the same act in the other direction — the person's link gone
-# and nothing on screen saying so. `plan_skill_targets` says the same of the
-# files it walks.
-#
-# A HOST STILL CARRYING THOSE SYMLINKS IS THE NORMAL PRE-ACT-5 CASE, not an
-# exotic one: adoption act 6 clears them on each workstation before the first
-# `--install` that carries this, and act 5 strips `brett-wip` to data. So the
-# refusal names every offending path, says what each one IS, and prints the one
-# `rm` that clears them — rather than leaving a person to remember a step.
-# WHAT IS AT A PATH, WHERE IT IS NOT A REGULAR FILE.
-# ONE implementation of R-A9-12's test, for every path this command writes: the
-# seventeen in the bin directory, the six `SKILL.md`s (F-X17), the six command
-# files, and `~/.claude/settings.json` (#44 round 1, `openRepoTools:878`).
-# Prints what is there and returns 0; returns 1 — saying nothing — where the
-# path is absent or is a regular file.
-#
-# `-L` AS WELL AS `-e`, because a DANGLING symlink is the sharper case: `[ -e ]`
-# is false on one, so it reads as ABSENT. `cp` through it created the file at the
-# far end — a write into a repository this command was never told about — and
-# the rename that replaced `cp` (#167) would swap the link for a file unasked.
-#
-# IT IS ASKED APART FROM THE `-w`, because the `-w` is not asked of every path.
-# Every write here is a rename since #167, and a rename needs the DIRECTORY's
-# write bit and never the file's: `unplaceable_kind` asks the file's own `-w` of
-# the files this installer owns, as a person's "not this one", while the
-# SessionStart merge — which has always replaced `settings.json` through
-# `mktemp` + `mv -f` — merges into one this user cannot write. A single walk that
-# asked `-w` of all three would refuse an install that works.
-path_kind() {   # <path>
-	local t="$1"
-	if [ -L "$t" ]; then
-		printf 'a symlink to %s' "$(readlink -- "$t" 2>/dev/null || printf '<unreadable>')"
-		return 0
-	fi
-	if [ -d "$t" ]; then
-		printf 'a directory'
-		return 0
-	fi
-	if [ -e "$t" ] && [ ! -f "$t" ]; then
-		printf 'not a regular file'
-		return 0
-	fi
-	return 1
-}
-
-# AND WHETHER IT MAY BE WRITTEN OVER: `-w` as well as `-f` (#40, finding 4).
-# This answered "a regular file" with `return 1` and asked nothing else, so
-# every existing file counted as one `--install` may place over — and
-# `plan_skill_targets` let a READ-ONLY `SKILL.md` or command file through.
-# `install_commands` has already copied the seventeen PATH files by the time
-# `place_skill_and_hook` reaches the `cp`, so an ordinary permission failure
-# there left a host with seventeen of the thirty-one artifacts placed, on the one
-# path in this file that promises all or none. A mode is not an exotic state
-# either: `chmod 444` on a file a person did not want overwritten is what a
-# person does.
-#
-# THAT LAST SENTENCE IS NOW THE WHOLE REASON (#167). The write is a rename, which
-# needs the directory's write bit and not the file's, so a read-only target would
-# no longer FAIL half way — it would be replaced without a word. The question
-# stays, so that a person's `chmod 444` is still the refusal it was.
-#
-# WHAT `-w` DOES NOT PROVE IS THAT THE MODE STAMP CAN SUCCEED, and that limit is
-# deliberate (#44 round 1, the suppressed comment at `openRepoTools:635`). A
-# GROUP-WRITABLE file owned by another account passes `-w` and refuses the
-# `chmod` where the stamp is made IN PLACE — the arm whose bytes were already
-# right; the arm that writes stamps its own temporary (#167) — and the question
-# that would settle it — `[ -O ]`, this euid against
-# the file's owner — is one no test in this suite can put: `tmp_path` cannot
-# make a second account, and it would refuse a root `--install` into another
-# user's home, where the `chmod` does in fact succeed. A guard no test reaches
-# is the guard R-A9-15 was ruled about, so this asks what it can prove and the
-# stamp's own failure stays a `die` naming the artifact it could not mode.
-#
-# THE REFUSAL'S ONE REMEDY STAYS TRUE OF THE NEW KIND, which is why it is
-# answered here rather than in a second walk: `rm -f` takes a read-only file —
-# what a removal needs is the DIRECTORY's write bit, not the file's — so the
-# `rm -f -- <paths>` both planners print clears every path either of them names.
-unplaceable_kind() {   # <target>
-	local t="$1" kind
-	if kind="$(path_kind "$t")"; then
-		printf '%s' "$kind"
-		return 0
-	fi
-	if [ -f "$t" ] && [ ! -w "$t" ]; then
-		printf 'a regular file this user cannot write'
-		return 0
-	fi
-	return 1
-}
-
-# WHETHER A DIRECTORY THIS RUN MUST CREATE A FILE IN CAN TAKE ONE — asked of the
-# NEAREST ANCESTOR THAT EXISTS, because a directory that is not there yet is
-# exactly as placeable as the directory it would be created in (#44 round 1,
-# `openRepoTools:653`, and Sourcery's `README.md:237`). `plan_install_targets`
-# asked `[ -d "$dir" ]` first and so asked NOTHING AT ALL where the answer was
-# "not yet": a `$OPENREPOTOOLS_BIN_DIR` under a parent this user cannot write
-# passed planning and met the `mkdir -p` in `install_commands`, which died with
-# the shell's own 1 under `set -e` — the code this toolset spends on "findings
-# were printed" — instead of the refusal this phase exists to print.
-#
-# `-x` AS WELL AS `-w`, because creating a file in a directory takes both of its
-# bits (#44 round 1, the suppressed comment at `openRepoTools:658`): a directory
-# at 0600 accepts no new file at all, and `-w` alone passed it. ONE
-# implementation for the bin directory and for the seven destinations
-# `plan_skill_targets` walks, for the reason `unplaceable_kind` is one: two
-# copies of one rule is how the bin half comes to refuse what the skill half
-# allows.
-#
-# AND IT CREATES NOTHING. `plan_skill_targets` proved a directory writable by
-# `mkdir -p`-ing it first, so a run that then REFUSED had already left seven
-# directories on a machine that had none — which is not what "NOTHING was
-# installed" says (#44 round 1, Sourcery's
-# `tests/test_install_skill_and_hook.py:658`). Every place this command writes
-# into is made in the PLACEMENT phase, by the guarded `mkdir -p` each `cp`
-# already carries.
-#
-# `-L` STOPS THE WALK TOO, not only `-e` (#44 round 2, `openRepoTools:701`).
-# `-e` follows a symlink, so it is FALSE on a DANGLING one — the walk read
-# that as "not there yet" and stepped past it to ask about ITS parent instead,
-# so a dangling `skills_home` or bin-directory ancestor passed this planner and
-# met `mkdir -p` after other artifacts were already placed, on the one path
-# that promises all or none. A symlink, dangling or not, is something AT that
-# path; the walk stops at the nearest one of those, exactly as it stops at the
-# nearest directory, file or anything else that is there.
-unusable_dir_kind() {   # <directory>
-	local d="$1" up
-	while [ ! -e "$d" ] && [ ! -L "$d" ]; do
-		up="$(dirname -- "$d")"
-		[ "$up" != "$d" ] || break
-		d="$up"
-	done
-	if [ -L "$d" ] && [ ! -e "$d" ]; then
-		printf '%s is a symlink to %s, which is not there' "$d" \
-			"$(readlink -- "$d" 2>/dev/null || printf '<unreadable>')"
-		return 0
-	fi
-	if [ ! -d "$d" ]; then
-		printf '%s is not a directory' "$d"
-		return 0
-	fi
-	if [ ! -w "$d" ]; then
-		printf '%s is not writable' "$d"
-		return 0
-	fi
-	if [ ! -x "$d" ]; then
-		printf '%s is not searchable (a create takes its `x` bit as well as its `w`)' "$d"
-		return 0
-	fi
-	return 1
-}
-
-# ------------------------------------------------------------- PIPX'S LINK
-#
-# opensoft/openRepoTools#228, User Story 1: `specs/006-release-pypi/contracts/
-# pipx-link.md` is the rule and `contracts/cli-output.md` the exact lines (the
-# change's design.md Decision 6). `pipx install openrepotools` places ONE
-# command, `<dir>/openRepoTools`, as a symbolic link into its own venv, and that
-# link may be the only `openRepoTools` on the workstation that can run
-# `--install` at all. So it is the one link `--install` LEAVES WHERE IT IS: it
-# is skipped, said out loud, counted as left to pipx, and given no receipt row
-# (`receipt_add` writes none for a link); no refusal lists it and no line ever
-# advises its `rm`. `retire_commands` never meets it, because `RETIRED` does not
-# hold `openRepoTools`.
-#
-# IT IS DECIDED FROM PATHS AND THE EXISTENCE OF FILES, AND FROM NOTHING ELSE. No
-# JSON is parsed, so it needs no `jq` and is decided before the `jq` check,
-# which stays where it is (FR-018); `PIPX_HOME` is never read, so it holds under
-# every home pipx uses — `$PIPX_HOME`, `~/.local/pipx`, `~/.local/share/pipx`
-# and macOS's `~/Library/Application Support/pipx`, whose SPACE is why every
-# expansion here is quoted. And it holds in every mode: the package's own
-# `--install`, a checkout's and the one-line install's.
-#
-# A LINK THAT LOOKS LIKE A VENV AND FAILS THE RULE — a later pipx layout, or a
-# `pip install` into a plain venv — is still refused, because it is not provably
-# pipx's. It is named for what it is, and NO `rm` IS PRINTED FOR IT: removing it
-# may remove the only command that can run `--install` (ADV3, SC-006).
-
-PIPX_LINK=""      # <dir>/openRepoTools, once it is known to be pipx's link
-PIPX_VENV=""      # the canonical venv that link resolves into
-PIPX_PAYLOAD=""   # that venv's canonical lib/python*/site-packages/openrepotools/payload
-
-#: EVERY LINK FOLLOWED, BY PLAIN `readlink`, which prints a link's own value on
-#: Linux, macOS and BSD alike: `readlink -f` is not in a stock macOS userland and
-#: neither is `realpath`. A relative value is joined to the LINK'S OWN directory,
-#: as the kernel reads it. Past 40 hops — a longer chain, or a cycle — it fails,
-#: and such a path is not pipx's link, whatever it ends at. Then the last path's
-#: DIRECTORY is canonicalised with `cd -P` and `pwd -P`, its own name kept, so
-#: the answer is one spelling of one file. `CDPATH` is emptied, because a `cd`
-#: through one prints where it went. Nothing outside it is read, because the PATH
-#: report reuses it and the suite cuts it out to run alone (`installer_function`).
-link_resolve() {   # <path> — its canonical path with every link followed; 1 past 40 hops
-	local p="$1" v="" dir="" hops=0
-	while [ -L "$p" ]; do
-		hops=$((hops + 1))
-		[ "$hops" -le 40 ] || return 1
-		v="$(readlink -- "$p")" || return 1
-		case "$v" in
-		/*) ;;
-		*) v="$(dirname -- "$p")/$v" ;;
-		esac
-		p="$v"
-	done
-	dir="$(CDPATH= cd -P -- "$(dirname -- "$p")" 2>/dev/null && pwd -P)" || return 1
-	printf '%s/%s\n' "${dir%/}" "${p##*/}"
-}
-
-#: PACKAGE MODE, FROM PATHS (design.md Decision 4): this file's directory,
-#: resolved with `cd -P` and `pwd -P`, is named `payload`, its parent is named
-#: `openrepotools`, and that parent holds a regular `_release.py` — the layout an
-#: installed wheel of this package has, and no other. A checkout's directory is
-#: its root, and the one-line install runs from a pipe or from a placed file in
-#: `<dir>`, so neither ever matches. Prints that directory, or returns 1.
-#:
-#: `package_init` asks it once, before the arguments are read, and keeps the
-#: answer in PACKAGE_DIR: the payload directory, canonical, in package mode, and
-#: empty in a checkout or the one-line install. It is set here, so that nothing
-#: in the environment can set it.
-PACKAGE_DIR=""
-package_payload_dir() {
-	local here="" parent=""
-	[ -f "$SELF" ] || return 1
-	here="$(CDPATH= cd -P -- "$(dirname -- "$SELF")" 2>/dev/null && pwd -P)" || return 1
-	[ "${here##*/}" = payload ] || return 1
-	parent="${here%/*}"
-	[ "${parent##*/}" = openrepotools ] && [ -f "$parent/_release.py" ] || return 1
-	printf '%s\n' "$here"
-}
-
-#: STEPS 1 TO 3 OF THE RULE, which the match and the venv-shaped refusal share:
-#: <target> is a symbolic link, it resolves, and what it resolves to is a regular
-#: file named `openRepoTools` in a directory named `bin`. Prints that `bin`'s
-#: parent — the venv, as far as a path can say — which is canonical because the
-#: resolution is.
-link_venv() {   # <target> — the venv it links into, or 1
-	local resolved="" bin="" venv=""
-	[ -L "$1" ] || return 1
-	resolved="$(link_resolve "$1")" || return 1
-	[ -f "$resolved" ] && [ "${resolved##*/}" = openRepoTools ] || return 1
-	bin="${resolved%/*}"
-	[ "${bin##*/}" = bin ] || return 1
-	venv="${bin%/*}"
-	printf '%s\n' "${venv:-/}"
-}
-
-#: PIPX'S LINK (FR-015): steps 1 to 3, then the two things only pipx's venv of
-#: this package holds — a regular `pipx_metadata.json` beside its `bin/`, of
-#: which nothing but its EXISTENCE is read, and a regular `openRepoTools` in some
-#: `lib/python*/site-packages/openrepotools/payload` under it. The glob is looped
-#: over with a `-f` test, because bash leaves a glob that matches nothing as its
-#: own text. A match records the three values the run reads, and nothing else.
-pipx_link_match() {   # <dir>/openRepoTools — 0 with PIPX_LINK, PIPX_VENV and PIPX_PAYLOAD set, else 1
-	local venv="" payload="" canonical=""
-	venv="$(link_venv "$1")" || return 1
-	[ -f "${venv%/}/pipx_metadata.json" ] || return 1
-	for payload in "${venv%/}"/lib/python*/site-packages/openrepotools/payload; do
-		[ -f "$payload/openRepoTools" ] || continue
-		canonical="$(CDPATH= cd -P -- "$payload" 2>/dev/null && pwd -P)" || continue
-		PIPX_LINK="$1" PIPX_VENV="$venv" PIPX_PAYLOAD="$canonical"
-		return 0
-	done
-	return 1
-}
-
-#: A LINK INTO A PYTHON ENVIRONMENT THAT FAILS THE RULE: steps 1 to 3 hold, the
-#: venv holds a regular `pyvenv.cfg`, as every venv does, and the whole match
-#: does not hold. Prints the venv, for the refusal to name. The match is asked in
-#: a subshell, so that asking it here records nothing.
-venv_shaped_link() {   # <dir>/openRepoTools — the venv, or 1
-	local venv=""
-	venv="$(link_venv "$1")" || return 1
-	[ -f "${venv%/}/pyvenv.cfg" ] || return 1
-	if (pipx_link_match "$1"); then return 1; fi
-	printf '%s\n' "$venv"
-}
-
-#: PIPX'S OWN ENVIRONMENT (research R5): a package-mode run whose payload,
-#: PACKAGE_DIR, is under the venv pipx's link resolves into. Both paths are
-#: canonical, so this compares one spelling of each.
-pipx_own_run() {
-	[ -n "$PIPX_VENV" ] && [ -n "$PACKAGE_DIR" ] || return 1
-	case "$PACKAGE_DIR/" in
-	"${PIPX_VENV%/}"/lib/*) return 0 ;;
-	esac
-	return 1
-}
-
-#: WHERE THE OTHER SIXTEEN NOW COME FROM, for the count line of every run beside
-#: pipx's link but pipx's own (research R5). A PACKAGE names its own release,
-#: from the stamp `package_init` read, in a pipx venv or not: it placed its own
-#: payload and fetched from nothing, so `$REPO @ $REF` would name a source it
-#: never used. A checkout and the one-line install name the source they
-#: collected from, `payload_where`'s pair with `@` in place of `at`. An adopted
-#: source mounted in a local assembly fetches nothing and so sets no
-#: PAYLOAD_REPO or PAYLOAD_REV: the pin its payload was checked against names
-#: that same pair there.
-install_source() {
-	if [ -n "$PACKAGE_DIR" ]; then
-		printf 'openrepotools %s\n' "$STAMP_VERSION"
-	elif [ "$SOURCE_LAYOUT" = adopted ]; then
-		printf '%s @ %s\n' "${PAYLOAD_REPO:-${PIN_SOURCE_REPOSITORY-}}" "${PAYLOAD_REV:-${PIN_COMMIT-}}"
-	else
-		printf '%s @ %s\n' "$REPO" "$REF"
-	fi
-}
-
-#: WHAT IS BESIDE PIPX'S LINK, for the same line: `openrepotools <VERSION>` of
-#: the stamp beside pipx's payload, `0.0.0` where it is unstamped. It is read in
-#: a SUBSHELL, because `stamp_read` sets the STAMP_* values and this run's own
-#: are the ones `install_source` names. A stamp there that fails the reader is
-#: another install's, not this one's, so it refuses nothing: the clause says it
-#: cannot be read, and the install goes on.
-pipx_release() {
-	local version=""
-	if version="$(stamp_read "${PIPX_PAYLOAD%/*}/_release.py" && printf '%s' "$STAMP_VERSION")"; then
-		printf 'openrepotools %s\n' "$version"
-	else
-		printf '%s\n' "the openrepotools beside pipx's link, whose stamp cannot be read"
-	fi
-}
-
-#: `^from openrepotools(\.[A-Za-z_][A-Za-z0-9_]*)* import ` by `case`, the
-#: import pip's console-script template writes for the entry point at column 0.
-#: The name characters are written out, for the reason ORT_ALNUM gives.
-pip_imports_entry() {   # <line>
-	local rest="" name=""
-	case "$1" in "from openrepotools"*) ;; *) return 1 ;; esac
-	rest="${1#from openrepotools}"
-	while :; do
-		case "$rest" in
-		' import '*) return 0 ;;
-		.*) rest="${rest#.}" ;;
-		*) return 1 ;;
-		esac
-		name="${rest%%[!${ORT_ALNUM}_]*}"
-		case "$name" in '' | [0123456789]*) return 1 ;; esac
-		rest="${rest#"$name"}"
-	done
-}
-
-#: PIP'S CONSOLE SCRIPT FOR THIS PACKAGE (FR-020, contracts/pipx-link.md), at a
-#: target that is a regular file and not a link: what `pip install --user
-#: openrepotools` leaves at `~/.local/bin/openRepoTools`. It is another
-#: installer's command, and `--install` refuses to replace it in every mode, its
-#: own run included. Both halves of pip's template must hold:
-#:
-#:   * A PYTHON INTERPRETER, in either form pip writes: a `#!` line whose first
-#:     word's last `/` segment begins with `python`, or the three-line `/bin/sh`
-#:     trampoline pip writes when that path holds a space or is too long for a
-#:     shebang — `#!/bin/sh`, then `'''exec' <python> … "$0" "$@"` with the
-#:     interpreter quoted up to the next `"` or unquoted up to the first space,
-#:     then `' '''`;
-#:   * THE ENTRY POINT'S IMPORT at column 0 in one of the first 20 lines
-#:     (`pip_imports_entry`).
-#:
-#: Read by `IFS= read -r`, `case` and parameter expansion: bash 3.2's.
-pip_script_is() {   # <dir>/openRepoTools — 0 when it is pip's console script for openrepotools
-	local line="" n=0 first="" second="" third="" imports=1 word="" rest=""
-	local exec_word="'''exec' " tail=' "$0" "$@"' close="' '''" dq='"'
-	[ -f "$1" ] && [ ! -L "$1" ] && [ -r "$1" ] || return 1
-	while [ "$n" -lt 20 ] && { IFS= read -r line || [ -n "$line" ]; }; do
-		n=$((n + 1))
-		case "$n" in
-		1) first="$line" ;;
-		2) second="$line" ;;
-		3) third="$line" ;;
-		esac
-		if [ "$imports" -ne 0 ] && pip_imports_entry "$line"; then imports=0; fi
-	done 2>/dev/null <"$1" || return 1
-	[ "$imports" -eq 0 ] || return 1
-	# THE SHEBANG FORM: the first word after `#!` names a Python.
-	case "$first" in '#!'*) ;; *) return 1 ;; esac
-	word="${first#??}"
-	while :; do case "$word" in ' '* | "$ORT_TAB"*) word="${word#?}" ;; *) break ;; esac; done
-	word="${word%%[ $ORT_TAB]*}"
-	case "${word##*/}" in python*) return 0 ;; esac
-	# THE TRAMPOLINE FORM, its three lines exactly as pip writes them.
-	[ "$first" = '#!/bin/sh' ] && [ "$third" = "$close" ] || return 1
-	case "$second" in "$exec_word"*) ;; *) return 1 ;; esac
-	rest="${second#"$exec_word"}"
-	case "$rest" in
-	"$dq"*)
-		rest="${rest#?}"
-		case "$rest" in *"$dq"*) ;; *) return 1 ;; esac
-		word="${rest%%"$dq"*}"
-		rest="${rest#*"$dq"}"
-		;;
-	*)
-		word="${rest%% *}"
-		rest="${rest#"$word"}"
-		;;
-	esac
-	case "$rest" in *"$tail") ;; *) return 1 ;; esac
-	case "${word##*/}" in python*) return 0 ;; esac
-	return 1
-}
-
-#: THE `openRepoTools` A SHELL WILL RUN, asked last in a package-mode
-#: `--install` (FR-021, research R7). `<prefix>` is five levels above the
-#: payload, the parent of its `lib/`, and is named only where the four
-#: directories between are an installed wheel's — `openrepotools`,
-#: `site-packages`, `python*` and `lib` — so a layout that names no prefix gets
-#: no note. The first `openRepoTools` on PATH, as `type -P` finds it, and this
-#: package's console script, `<prefix>/bin/openRepoTools`, are each followed
-#: through `link_resolve`, so pipx's link and the script it points at are one
-#: file. A mismatch, or no `openRepoTools` on PATH at all, is the one note. It
-#: changes nothing, and never fails: the exit status stays the install's.
-path_report() {
-	local up="$PACKAGE_DIR" prefix="" want="" first="" got="" expected=""
-	[ -n "$up" ] || return 0
-	up="${up%/*}"
-	[ "${up##*/}" = openrepotools ] || return 0
-	up="${up%/*}"
-	[ "${up##*/}" = site-packages ] || return 0
-	up="${up%/*}"
-	case "${up##*/}" in python*) ;; *) return 0 ;; esac
-	up="${up%/*}"
-	[ "${up##*/}" = lib ] || return 0
-	prefix="${up%/*}"
-	want="$prefix/bin/openRepoTools"
-	first="$(type -P openRepoTools 2>/dev/null)" || first=""
-	if [ -z "$first" ]; then
-		say "openRepoTools: note: the first openRepoTools on your PATH is none, not this package's $want, so the release you just installed is not the one that runs; put the directory that holds pipx's link to it on PATH"
-		return 0
-	fi
-	got="$(link_resolve "$first")" || got=""
-	expected="$(link_resolve "$want")" || expected=""
-	if [ -n "$got" ] && [ "$got" = "$expected" ]; then
-		return 0
-	fi
-	say "openRepoTools: note: the first openRepoTools on your PATH is $first, not this package's $want, so the release you just installed is not the one that runs; put the directory that holds pipx's link to it ahead of $(dirname -- "$first") on PATH"
-}
-
-plan_install_targets() {
-	local dir="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}"
-	local name target kind bad="" paths="" venv="" leave="" clear=""
-	PIPX_LINK="" PIPX_VENV="" PIPX_PAYLOAD=""
-	# THE DIRECTORY FIRST, which is the `-w` question for every target that is
-	# not there yet: an absent file is placeable exactly where the directory it
-	# would be created in takes a write. `plan_skill_targets` asks this of the
-	# ones it writes into; the bin directory is the same question for the eleven,
-	# and without it a `$OPENREPOTOOLS_BIN_DIR` that is not this user's failed at
-	# the first `cp` under `set -e` — exit 1, which this toolset spends on
-	# "findings were printed", from a run that placed nothing and said nothing.
-	# A directory that is not there YET is asked about through the nearest
-	# ancestor that is, because `install_commands` creates it and a parent that
-	# refuses the `mkdir -p` is a refusal this phase can print for nothing.
-	if kind="$(unusable_dir_kind "$dir")"; then
-		die "\`--install\` places the ${#INSTALLABLES[@]} commands in $dir, and $kind.
-    NOTHING was installed and nothing already installed was replaced."
-	fi
-	for name in "${INSTALLABLES[@]}"; do
-		target="$dir/$name"
-		# PIPX'S LINK IS ASKED ABOUT BEFORE ANY LINK IS REFUSED (FR-015), at the
-		# one command pipx places. It is no bad target: the placement loop skips
-		# it. A venv-shaped link IS one, listed for what it is, with the
-		# paragraph that says to leave it, and kept out of the `rm -f` line.
-		if [ "$name" = openRepoTools ]; then
-			if pipx_link_match "$target"; then
-				continue
-			fi
-			if venv="$(venv_shaped_link "$target")"; then
-				bad="${bad:+$bad
-}    $target — a link into a Python environment, perhaps pipx's ($venv), in a layout this installer does not recognise"
-				leave="
-    Leave $target where it is: it may be the only openRepoTools that can
-    run \`--install\`. Run \`pipx reinstall openrepotools\`, then \`openRepoTools --install\`
-    again, and if this refusal stays, open an issue on opensoft/openRepoTools naming
-    the layout under $venv."
-				continue
-			fi
-			# PIP'S CONSOLE SCRIPT IS NOT THIS INSTALLER'S TO REPLACE (FR-020),
-			# in any mode: refused here, before anything is fetched or placed.
-			if pip_script_is "$target"; then
-				die "\`--install\` will not replace $target: it is pip's console script for openrepotools (\`pip install --user openrepotools\` leaves it there), and another installer's command is not this installer's to overwrite.
-    NOTHING was installed and nothing already installed was replaced.
-    pipx is the one package route. To move to it:
-        pip uninstall openrepotools
-        pipx install openrepotools
-        openRepoTools --install"
-			fi
-		fi
-		kind="$(unplaceable_kind "$target")" || continue
-		bad="${bad:+$bad
-}    $target — $kind"
-		paths="${paths:+$paths }\"$target\""
-	done
-	[ -n "$bad" ] || return 0
-	# THE `rm -f` LINE NAMES ONLY WHAT IT IS SAFE TO REMOVE, so with a
-	# venv-shaped link the only bad target there is no "Clear them" at all.
-	[ -z "$paths" ] || clear="
-    Clear them, then re-run — \`rm -f\` takes a read-only file, because what a
-    removal needs is the DIRECTORY's write bit and not the file's:
-        rm -f -- $paths
-    (The pre-move \`link-estates\` puts exactly these links in a workstation's
-    \`~/.local/bin\`, pointing into \`opensoft/brett-wip\` — the checkout every
-    lane writes. Amendment 9's adoption act 6 removes them per host before the
-    first \`--install\` that carries this, and act 5 strips that repository to
-    data.)"
-	die "\`--install\` places a REGULAR FILE IT CAN WRITE at each of these, and these are
-    not that:
-$bad$leave
-    Each command is placed by renaming a new copy over its path, so installing
-    over a symlink would replace somebody's link with a regular file, over a
-    directory would put the file inside it, and over a file this user cannot
-    write would replace a file somebody made read-only — none of it asked for.
-    NOTHING was installed and nothing already installed was replaced.$clear"
-}
-
-# THE RIVALS THEMSELVES, FOR A REFUSAL TO NAME (#59). It is the conflict half of
-# the read in `plan_hook_merge` with the answer taken off: every command under
-# this event that runs this hook's verb AND IS NOT OURS, one per line and
-# indented into the refusal's block.
-#
-# ONE IMPLEMENTATION FOR BOTH ENTRIES, for the reason `unplaceable_kind` is one:
-# what differs between the two arms is the EVENT, OUR OWN STRING and the VERB a
-# rival is recognised by, and a second copy of this is how one arm comes to name
-# what the other cannot.
-#
-# IT MATTERS NOW IN A WAY IT DID NOT BEFORE. With `conflict` beating `present`, a
-# refused file may carry OUR entry as well as the rival — so "remove that entry"
-# with nothing named is a remedy a person can read as "remove the one this
-# installer just printed", which would leave the second writer exactly where it
-# is and take the working entry away instead.
-hook_rivals() {   # <settings> <event> <our command> <verb pattern>
-	jq -r --arg e "$2" --arg c "$3" --arg v "$4" '
-		[ (.hooks[$e] // [])[]? | (.hooks // [])[]? | .command // empty ]
-		| map(select(. != $c and test($v)))
-		| map("        " + .) | join("\n")' "$1" 2>/dev/null ||
-		printf '        (that file could not be re-read to name them)'
-}
-
-plan_hook_merge() {
-	local settings existing kind
-	settings="$(claude_home)/settings.json"
-	command -v jq >/dev/null 2>&1 || die "\`--install\` needs \`jq\` to merge its TWO hook entries into
-    $settings, and there is no \`jq\` on this PATH. It refuses rather than
-    rewriting a JSON file by hand, and NOTHING was installed. Install jq, then
-    re-run. The entries it would have merged — the \`SessionStart\` one and
-    Amendment 12's \`UserPromptSubmit\` name guard, which are ONE all-or-nothing
-    merge:
-$(hook_block_text)
-$(guard_block_text)"
-
-	# WHAT IS AT THAT PATH, BEFORE A BYTE OF IT IS READ (#44 round 1,
-	# `openRepoTools:878`). This file carries the LAST TWO artifacts — the
-	# thirtieth and thirty-first — since Amendment 12 adoption act 3 put the
-	# name guard beside the `SessionStart` entry, and it is the only path no
-	# walk asked about; the
-	# `present` arm now CHMODs it, and `chmod`
-	# follows a symlink, so a `~/.claude/settings.json` linked into a dotfiles
-	# checkout had the 600 stamped on the file at the far end — an unrelated
-	# file re-moded by an installer that reported `already installed
-	# (unchanged)` for it. The two merge arms are the older half of the same
-	# defect: `mv -f` REPLACES a symlink with the regular file it wrote, so the
-	# link a person put there was swallowed and the far end silently stopped
-	# being what `claude` reads.
-	#
-	# `path_kind` AND NOT `unplaceable_kind`, because this file is not placed
-	# with `cp`: the merge writes a temporary beside it and moves that into
-	# place, which takes the DIRECTORY's write bit and not the file's, so a
-	# read-only `settings.json` is one this command may still merge into.
-	if kind="$(path_kind "$settings")"; then
-		die "\`--install\` merges its two hook entries into a REGULAR FILE, and this is not
-    one:
-    $settings — $kind
-    A \`chmod\` follows a link, so the mode this installer stamps would land on
-    whatever is on the other end of it; and the merge itself writes a temporary
-    beside this path and moves it here, which would take the link away.
-    NOTHING was installed and nothing already installed was replaced.
-    Clear it — what is on the other end keeps its bytes and its mode — then
-    re-run:
-        rm -f -- \"$settings\""
-	fi
-
-	workdir
-	HOOK_MERGED="$WORKDIR/settings.json"
-	HOOK_DEFERRED=""
-	HOOK_STRIP_WHY=""
-	local staged="$WORKDIR/settings.stage.json"
-
-	if [ ! -e "$settings" ]; then
-		HOOK_PLAN="nofile"; GUARD_PLAN="nofile"
-		jq -n --arg c "$HOOK_COMMAND" --arg m "$HOOK_MATCHER" --argjson t "$HOOK_TIMEOUT" \
-		      --arg g "$GUARD_COMMAND" --argjson gt "$GUARD_TIMEOUT" \
-			'{hooks: {SessionStart: [{matcher: $m, hooks: [{type: "command", command: $c, timeout: $t}]}],
-			          UserPromptSubmit: [{hooks: [{type: "command", command: $g, timeout: $gt}]}]}}' \
-			>"$HOOK_MERGED" || die "could not compose $settings; nothing was installed."
-		return 0
-	fi
-
-	jq -e . "$settings" >/dev/null 2>&1 || die "$settings is not valid JSON, so \`--install\` cannot merge its two entries into
-    it and will not rewrite it. NOTHING was installed and nothing already installed was
-    replaced. Fix that file, then re-run. The entries it would have merged:
-$(hook_block_text)
-$(guard_block_text)"
-
-	jq -e '(has("hooks") | not) or (.hooks | type == "object")' "$settings" >/dev/null 2>&1 ||
-		die "$settings has a \`hooks\` that is not an object, so there is nothing to merge
-    either entry into. NOTHING was installed. The entries it would have merged:
-$(hook_block_text)
-$(guard_block_text)"
-
-	# THE THREE ANSWERS, in one read: our exact command already there; some
-	# OTHER SessionStart entry that runs `session-start` (a second writer of
-	# this very hook, which is the case Amendment 9(b) says must refuse); or
-	# nothing of ours at all.
-	#
-	# THE CONFLICT ARM IS NARROWED, AND THE NARROWING IS RATIFIED: A9 Addendum 3
-	# R-A9-8 with A9 Addendum 4 R-A9-14, on brettheap/new-workstation#17.
-	# Amendment 9(b)'s clause reads "an entry under `SessionStart` whose
-	# `command` DIFFERS … → refuse, print the exact block, and place nothing at
-	# all", unqualified. Read literally, a person whose `~/.claude/settings.json`
-	# carries ANY unrelated SessionStart hook — a statusline refresh, a `git
-	# fetch` — could never run `--install` at all, and no amount of removing OUR
-	# entry would help them. This workstation carries exactly such an entry
-	# today (`herdr-agent-state.sh session`, matcher `*`), so the narrowing is
-	# not hypothetical.
-	#
-	# IT KEYS ON `session-start`, WHICH IS WHAT R-A9-8 SAYS, and not on
-	# `lanes-edit.sh`, which is what this line said until R-A9-14 (F7 of the #24
-	# review). The two are not the same set either way round: an entry running
-	# `lanes-edit.sh who` is no competing writer of this hook and was refused,
-	# and `~/bin/lane-hook.sh session-start` IS one — a second program running
-	# the same hook verb — and was merged beside, which fires the hook twice,
-	# the one harm the clause names. The verb is what collides; the file that
-	# carries it is not.
-	#
-	# AND THE RIVAL IS ASKED ABOUT FIRST, WHICH IS THE WHOLE OF #59. `present`
-	# was tested first, so a settings file carrying our exact entry AND a second
-	# writer of the same hook answered `present`: `--install` added nothing,
-	# said nothing, and left a person with the two writers this arm exists to
-	# refuse, with the run reporting success. Nothing was installed twice by
-	# such a run — with the exact entry there, there is nothing to add — but the
-	# state was never NAMED, and somebody who runs `--install` expecting it to
-	# police this hook was told everything was fine.
-	#
-	# WHICH IS WHY THE RIVAL TEST EXCLUDES OUR OWN STRING (`. != $c`) rather
-	# than being asked second: our entry is no rival to itself, and an arm that
-	# read it as one would refuse every re-run of `--install` on a workstation
-	# that had already taken it. `present` keeps the rest of its meaning — our
-	# entry there and nothing competing with it — and `conflict` means what it
-	# says whatever else the file carries.
-	#
-	# THE VERB IS SPELLED ONCE, in `hook_verb` here and `guard_verb` below: the
-	# answer and the list of rivals the refusal prints are the same question
-	# asked twice, and a pattern written twice is a pair that drifts.
-	local hook_verb='session-start'
-	existing="$(jq -r --arg c "$HOOK_COMMAND" --arg v "$hook_verb" '
-		[ (.hooks.SessionStart // [])[]? | (.hooks // [])[]? | .command // empty ] as $cmds
-		| if ($cmds | map(select(. != $c and test($v))) | length) > 0 then "conflict"
-		  elif ($cmds | index($c)) then "present"
-		  else "absent" end' "$settings" 2>/dev/null || printf 'error')"
-
-	# AND THE SAME THREE ANSWERS FOR AMENDMENT 12's ENTRY, keyed on its own verb.
-	#
-	# `guard` AS A WHOLE ARGUMENT, and not as a substring — the one place this
-	# read differs from the one above, and the difference is load-bearing. The
-	# `SessionStart` arm keys on `session-start`, a word that appears in nothing
-	# else; `guard` appears in `~/projects/xFactory/guard.sh`, a plain
-	# `UserPromptSubmit` hook a person's settings may already carry and one this
-	# installer must leave exactly where it is. So the test is the verb with a
-	# boundary on both sides: a command RUNNING `guard` collides, a file merely
-	# NAMED guard does not. That is R-A9-14's rule one event over — the verb is
-	# what collides; the file that carries it is not.
-	#
-	# THE ORDER IS THE ONE ABOVE'S, FOR THE REASON ABOVE (#59), and so is every
-	# other byte of this read: the two arms differ in the EVENT, in OUR OWN
-	# STRING and in the verb a rival is recognised by, and in nothing else. An
-	# arm that answered a question the other does not is how a person comes to
-	# be refused for one entry of a pair and not for the other.
-	local existing_guard guard_verb='(^|\s)guard(\s|$)'
-	existing_guard="$(jq -r --arg c "$GUARD_COMMAND" --arg v "$guard_verb" '
-		[ (.hooks.UserPromptSubmit // [])[]? | (.hooks // [])[]? | .command // empty ] as $cmds
-		| if ($cmds | map(select(. != $c and test($v))) | length) > 0 then "conflict"
-		  elif ($cmds | index($c)) then "present"
-		  else "absent" end' "$settings" 2>/dev/null || printf 'error')"
-
-	case "$existing" in
-	conflict)
-		die "$settings already carries a SessionStart entry that runs \`session-start\` with a
-    DIFFERENT command string:
-$(hook_rivals "$settings" SessionStart "$HOOK_COMMAND" "$hook_verb")
-    Exact-string match is the only idempotence this entry has, so merging would fire
-    the hook twice — and repairing a setting a person meant is not an installer's to
-    do. A SECOND WRITER REFUSES WHETHER OR NOT OUR OWN ENTRY IS BESIDE IT: two writers
-    of one hook is the state this arm exists to refuse, and a file carrying both is
-    that state. NOTHING was installed.
-    Remove EVERY entry listed above — all of them are second writers of this hook,
-    and one left behind refuses the next run the same way — but not the block below,
-    which is this installer's own. Then re-run. The entry this places, byte for byte:
-$(hook_block_text)
-    (Amendment 9's adoption act 6 removes the hand-installed entry on each
-    workstation before the first \`--install\` that carries this.)"
-		;;
-	present | absent) HOOK_PLAN="$existing" ;;
-	*) die "$settings could not be read for a SessionStart entry; nothing was installed." ;;
-	esac
-
-	case "$existing_guard" in
-	conflict)
-		die "$settings already carries a UserPromptSubmit entry that runs \`guard\` with a
-    DIFFERENT command string:
-$(hook_rivals "$settings" UserPromptSubmit "$GUARD_COMMAND" "$guard_verb")
-    Exact-string match is the only idempotence this entry has, so merging would fire
-    the name guard twice — two refusals for one prompt. Repairing a setting a person
-    meant is not an installer's to do, and A SECOND WRITER REFUSES WHETHER OR NOT OUR
-    OWN ENTRY IS BESIDE IT: two writers of one hook is that state either way. So
-    NOTHING was installed. Remove EVERY entry listed above — all of them are second
-    writers of this hook, and one left behind refuses the next run the same way —
-    but not the block below, which is this installer's own. Then re-run.
-    The entry this places, byte for byte:
-$(guard_block_text)"
-		;;
-	present | absent) GUARD_PLAN="$existing_guard" ;;
-	*) die "$settings could not be read for a UserPromptSubmit entry; nothing was installed." ;;
-	esac
-
-	# BOTH MERGES ARE COMPUTED BEFORE EITHER IS PLACED, into one staged file, so
-	# the all-or-nothing rule covers the PAIR: a settings file that took the
-	# SessionStart entry and refused the guard is a half-install of a hook pair,
-	# and nothing on screen would say which half.
-	cp -- "$settings" "$HOOK_MERGED" ||
-		die "could not stage $settings for merging; nothing was installed."
-	if [ "$HOOK_PLAN" = absent ]; then
-		jq --arg c "$HOOK_COMMAND" --arg m "$HOOK_MATCHER" --argjson t "$HOOK_TIMEOUT" '
-			.hooks = (.hooks // {})
-			| .hooks.SessionStart = ((.hooks.SessionStart // []) + [{
-				matcher: $m,
-				hooks: [{type: "command", command: $c, timeout: $t}]
-			  }])' "$HOOK_MERGED" >"$staged" ||
-			die "could not merge the SessionStart entry into $settings; nothing was installed."
-		mv -f -- "$staged" "$HOOK_MERGED" ||
-			die "could not stage the merged $settings; nothing was installed."
-	fi
-	if [ "$GUARD_PLAN" = absent ]; then
-		jq --arg c "$GUARD_COMMAND" --argjson t "$GUARD_TIMEOUT" '
-			.hooks = (.hooks // {})
-			| .hooks.UserPromptSubmit = ((.hooks.UserPromptSubmit // []) + [{
-				hooks: [{type: "command", command: $c, timeout: $t}]
-			  }])' "$HOOK_MERGED" >"$staged" ||
-			die "could not merge the UserPromptSubmit entry into $settings; nothing was installed."
-		mv -f -- "$staged" "$HOOK_MERGED" ||
-			die "could not stage the merged $settings; nothing was installed."
-	fi
-
-	# THE OTHER OUTCOME, STAGED BESIDE THAT ONE (#237): this same file with OUR
-	# EXACT GUARD ENTRY taken out, for a run whose target does not answer
-	# `guard`. Only where the file carries it — with nothing of ours to take out,
-	# a deferred run has nothing to write, and writes nothing.
-	#
-	# THE NESTED ARRAY IS FILTERED, NOT THE OUTER ENTRY (workBenches#89): an
-	# entry that grouped our command with somebody else's keeps the other
-	# command and every other key it has; an entry we took nothing from passes
-	# through untouched; and an outer entry goes only when our command was the
-	# last thing in it. A shape this does not take apart — a `UserPromptSubmit`
-	# or an entry's `hooks` that is not an array — is left exactly as it is, and
-	# the read below, the same one `existing_guard` asks, says so.
-	if [ "$GUARD_PLAN" = present ]; then
-		HOOK_DEFERRED="$WORKDIR/settings.deferred.json"
-		jq --arg g "$GUARD_COMMAND" '
-			if (.hooks.UserPromptSubmit | type) == "array" then
-			  .hooks.UserPromptSubmit = [ .hooks.UserPromptSubmit[]
-			    | if type == "object" and ((.hooks | type) == "array") then
-			        .hooks as $inner
-			        | ($inner | map(select((type == "object" and .command == $g) | not))) as $kept
-			        | if ($kept | length) == ($inner | length) then .
-			          elif ($kept | length) > 0 then .hooks = $kept
-			          else empty end
-			      else . end ]
-			else . end' "$settings" >"$HOOK_DEFERRED" ||
-			die "could not compute $settings without its UserPromptSubmit name guard; nothing was installed."
-		if jq -e --arg g "$GUARD_COMMAND" '
-			[ (.hooks.UserPromptSubmit // [])[]? | (.hooks // [])[]? | .command // empty ]
-			| index($g)' "$HOOK_DEFERRED" >/dev/null 2>&1; then
-			HOOK_STRIP_WHY="its \`UserPromptSubmit\`, or the entry carrying the guard, is not the array of entries this command takes apart"
-		fi
-	fi
-
-	# A GUARD ENTRY THIS COMMAND CANNOT TAKE OUT, AGAINST A TARGET THAT WILL NOT
-	# ANSWER, IS A REFUSAL — AND IT IS DECIDED HERE, BEFORE ANYTHING IS PLACED
-	# (the #237 review, M2), like every other file this merge cannot handle. The
-	# one target the bin loop can still repair is let through to placement: a
-	# link to the bin directory's own `lanes-edit.sh`, which that loop puts back
-	# and which then answers, so the run merges instead. `hook_pair_defer` keeps
-	# the same refusal for the case this read got wrong.
-	if [ -n "$HOOK_STRIP_WHY" ] && ! hook_target_answers && ! hook_target_is_ours_to_place; then
-		die "$(hook_strip_refusal "NOTHING was installed and nothing already installed was replaced.")"
-	fi
-}
-
-# THE ONE TARGET A RUN OF `--install` CAN STILL MAKE ANSWER: a symlink spelled
-# the way `link-estates` spells it, to the bin directory's own `lanes-edit.sh`,
-# which the bin loop places. A bench recreate that emptied that directory
-# leaves exactly this link dangling.
-hook_target_is_ours_to_place() {
-	local target
-	target="$(hook_target)"
-	[ -L "$target" ] &&
-		[ "$(readlink -- "$target" 2>/dev/null || :)" = "${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}/lanes-edit.sh" ]
-}
-
-hook_strip_refusal() {   # <what was and was not placed>
-	printf '%s' "$(claude_home)/settings.json carries the UserPromptSubmit name guard, and ${HOOK_TARGET_WHY},
-    so that entry would fail every prompt — but ${HOOK_STRIP_WHY}, and a file this
-    command does not understand is not one it rewrites. Nothing in that file was
-    changed. $1 Remove the entry below by hand, then re-run:
-$(guard_block_text)"
-}
-
-# The fourteen artifacts that are not bin-directory files, in thirteen writes
-# (the two hook entries go into settings.json in one), AFTER the seventeen files
-# and the merge are all in hand. The last two only once their target answers
-# (#237): `place_hook_pair` asks, and says which.
-place_skill_and_hook() {
-	local shared_dir bare_dir target verb name
-	for name in "${SKILLS[@]}"; do
-	shared_dir="$(skills_home)/shared/skills/$name"
-	bare_dir="$(claude_home)/skills/$name"
-
-	# EVERY FAILURE HERE IS A `die`, never the shell's own 1. `--install`'s
-	# codes are this toolset's — 0 done, 1 findings printed, 2 a refusal — and
-	# an unguarded `mkdir` or `cp` under `set -e` exits 1, which reads as a
-	# report of findings from a command that placed seventeen of thirty-one artifacts.
-	for target in "$shared_dir/SKILL.md" "$bare_dir/SKILL.md"; do
-		mkdir -p -- "$(dirname -- "$target")" ||
-			die "could not create $(dirname -- "$target") for the $name skill.
-    The $placed commands above are placed; the skills and the hook are not."
-		if [ -e "$target" ] && cmp -s "$WORKDIR/skill-$name.md" "$target"; then
-			# THE MODE IS STAMPED WHETHER OR NOT THE BYTES MOVED (#40, finding
-			# 2). This arm reported the file unchanged and then SKIPPED the
-			# `chmod` below, which sat inside the `else` — so a `SKILL.md` that
-			# had drifted to 755, or to anything else, kept that mode for as
-			# long as its bytes stayed right and no re-run of `--install` ever
-			# put it back. The eleven in the bin directory have been stamped
-			# every time all along; this is that same rule, one directory on.
-			if mode_is 644 "$target"; then
-				verb="already installed at $target (unchanged)"
-			else
-				verb="already installed at $target (mode restored to 644)"
-			fi
-			chmod 644 "$target" || die "could not set the mode on $target."
-		else
-			if [ -e "$target" ]; then verb="updated at $target"; else verb="installed at $target"; fi
-			# BY RENAME, as the bin directory's files are (#167). A session reads
-			# a `SKILL.md` whole rather than running it, so nothing here executes
-			# garbage — but one way to place a file is one rule to read, and a
-			# reader that opens it mid-install still sees the old text or the
-			# new, never a truncated one.
-			place_by_rename "$WORKDIR/skill-$name.md" "$target" 644 "The $placed commands above are placed; the skills and the hook are not."
-		fi
-		# 644: a SKILL.md is a document a session READS, not a command. The
-		# seventeen in the bin directory are stamped 755 for the reason that loop
-		# gives — "a copy that is not executable is not a command" — and
-		# that reason does not reach this file. Amendment 9(b) describes
-		# `--install` as stamping 755 "on everything it places" while
-		# arguing why adoption act 4b must delete workBenches#63's 0644
-		# loop; the deletion is required either way, because two writers of
-		# one path is the defect and the mode was only its symptom.
-		say "$name: $verb"
-	done
-	done
-
-	# THE COMMAND FILES, AT THE SAME TWO DESTINATIONS AND THE SAME MODE
-	# (A11 Addendum 4 ruling 9). `setup-claude-profiles.sh` makes
-	# `<profiles>/shared/commands` and links it into every profile as
-	# `<profile>/commands`, exactly as it does for `skills` — so a file placed
-	# in the shared directory is `/swap` in every profile, and the bare copy in
-	# `~/.claude/commands/` is `/swap` in a `claude` run outside one. Two
-	# destinations, for the two ways a session is started, which is the same
-	# reason a skill has two.
-	#
-	# 644 for the same reason a `SKILL.md` is: a command file is a document a
-	# session READS. The 755 argument belongs to the seventeen in the bin
-	# directory, where a copy that is not executable is not a command.
-	for name in "${COMMANDS[@]}"; do
-		for target in "$(skills_home)/shared/commands/$name.md" "$(claude_home)/commands/$name.md"; do
-			mkdir -p -- "$(dirname -- "$target")" ||
-				die "could not create $(dirname -- "$target") for the /$name command.
-    The $placed commands above are placed; the skills, the command files and the hook are not."
-			if [ -e "$target" ] && cmp -s "$WORKDIR/command-$name.md" "$target"; then
-				# The same stamp on the same arm, for the same reason a skill's
-				# is (#40, finding 2): the mode is this installer's to set on
-				# every artifact it places, and a mode it repaired is a line
-				# that says so rather than `unchanged`.
-				if mode_is 644 "$target"; then
-					verb="already installed at $target (unchanged)"
-				else
-					verb="already installed at $target (mode restored to 644)"
-				fi
-				chmod 644 "$target" || die "could not set the mode on $target."
-			else
-				if [ -e "$target" ]; then verb="updated at $target"; else verb="installed at $target"; fi
-				place_by_rename "$WORKDIR/command-$name.md" "$target" 644 "The $placed commands above are placed; the skills, the command files and the hook are not."
-			fi
-			say "/$name: $verb"
-		done
-	done
-
-	place_hook_pair
-}
-
-# THE PAIR, BY ONE OF THE TWO OUTCOMES `plan_hook_merge` STAGED (#237), and the
-# question that picks it is asked HERE, after the bin loop: the path both entries
-# call is a link to the `lanes-edit.sh` that loop has just placed, so a link a
-# bench recreate left dangling over an emptied `~/.local/bin` answers again by
-# now, and the pair goes in on this same run. Asked earlier, it would defer the
-# pair on the one run that put the link's far end back.
-#
-# `wip init` places the pair through this same function (`wip_hook_pair`), after
-# `link-estates`, so the two writers of this file cannot come to two rules.
-place_hook_pair() {
-	local settings
-	settings="$(claude_home)/settings.json"
-	if hook_target_answers; then
-		hook_pair_merge "$settings"
-	else
-		hook_pair_defer "$settings"
-	fi
-}
-
-# WRITTEN THROUGH A TEMPORARY IN THE SAME DIRECTORY, then moved into place:
-# `mktemp` + `chmod 600` + `mv -f`, which is what workBenches'
-# `scripts/setup-claude-profiles.sh:167-194` does to this very file on every
-# `./setup.sh` and what Amendment 9(b) cites approvingly. A plain `cp` that fails
-# half way leaves a person's settings TRUNCATED, and this is the one file in this
-# installer that is not ours to own. 600, the mode workBenches' own writer of this
-# file uses: an installer that widened it would be silently undone, or would widen
-# it behind that script's back. Stamped on the TEMPORARY, so the file never
-# exists at a wider mode for even an instant. One writer for both outcomes.
-hook_write_settings() {   # <the staged whole file> <settings>
-	local staged="$1" settings="$2" hook_tmp
-	mkdir -p -- "$(dirname -- "$settings")" ||
-		die "could not create $(dirname -- "$settings") for the hook entries."
-	hook_tmp="$(mktemp -- "$(dirname -- "$settings")/settings.json.openrepotools.XXXXXX")" ||
-		die "could not create a temporary file beside $settings."
-	cp -- "$staged" "$hook_tmp" ||
-		{ rm -f -- "$hook_tmp"; die "could not stage the merged $settings."; }
-	chmod 600 "$hook_tmp" ||
-		{ rm -f -- "$hook_tmp"; die "could not set mode 600 on the merged $settings."; }
-	mv -f -- "$hook_tmp" "$settings" ||
-		{ rm -f -- "$hook_tmp"; die "could not move the merged settings into $settings."; }
-}
-
-# THE TARGET ANSWERS: the pair, merged exactly as it was before #237.
-hook_pair_merge() {   # <settings>
-	local settings="$1"
-	case "$HOOK_PLAN" in
-	present)
-		# THE ENTRY BEING THERE SAYS NOTHING ABOUT THE MODE (#40, finding 3).
-		# The two arms below write this file through `mktemp` + `chmod 600` +
-		# `mv -f`, so a file THEY wrote is 600 — and a file whose entry was
-		# already present was never given one, which is how a direct `--install`
-		# could leave `~/.claude/settings.json` world-readable for ever. 600 is
-		# the narrowing of the two and the mode workBenches'
-		# `setup-claude-profiles.sh` writes this same file at, so an installer
-		# that left it wider would be silently undone or would widen it behind
-		# that script's back.
-		#
-		# THIS CHMOD CAN FAIL FOR THE SAME REASON `unplaceable_kind`'s CAN (#44
-		# round 1, the suppressed comment at `openRepoTools:880`): a
-		# `settings.json` this euid can write but does not own takes `jq` and
-		# every check `plan_hook_merge` puts to it, then refuses the mode
-		# stamp, with the seventeen commands, the skills and the command files —
-		# twenty-nine of the thirty-one artifacts — already placed. The guard that
-		# would catch it first is the same `[ -O ]` `unplaceable_kind`'s own
-		# comment declines, for the same reason: no test in this suite can
-		# make a second account to own this file, and the check would refuse a
-		# root `--install` into another user's home, where this `chmod` does
-		# in fact succeed. The failure stays a `die` naming this file.
-		if mode_is 600 "$settings"; then
-			say "SessionStart hook: already installed in $settings (unchanged)"
-		else
-			chmod 600 "$settings" ||
-				die "could not set mode 600 on $settings, which already carries this entry.
-    Nothing in that file was changed."
-			say "SessionStart hook: already installed in $settings (mode restored to 600)"
-		fi
-		;;
-	esac
-	case "$GUARD_PLAN" in
-	present)
-		# THE GUARD ENTRY'S OWN LINE, AND NO SECOND `chmod`: the mode belongs to
-		# the FILE and not to either entry, so the arm above has already asked
-		# for it on every run that reaches this one. Saying it twice would tell
-		# a person their settings were re-moded twice for one file.
-		say "UserPromptSubmit guard: already installed in $settings (unchanged)"
-		;;
-	esac
-	# ONE WRITE FOR THE TWO ENTRIES: they live in one file, and writing it twice
-	# would move a person's settings through a state carrying one of the pair.
-	if [ "$HOOK_PLAN" != present ] || [ "$GUARD_PLAN" != present ]; then
-		hook_write_settings "$HOOK_MERGED" "$settings"
-		case "$HOOK_PLAN" in
-		nofile) say "SessionStart hook: installed in $settings (the file was created, mode 600)" ;;
-		absent) say "SessionStart hook: merged into $settings (one entry added; written back at mode 600)" ;;
-		esac
-		case "$GUARD_PLAN" in
-		nofile) say "UserPromptSubmit guard: installed in $settings (the file was created, mode 600)" ;;
-		absent) say "UserPromptSubmit guard: merged into $settings (one entry added; written back at mode 600)" ;;
-		esac
-	fi
-}
-
-# THE TARGET DOES NOT ANSWER: the pair is DEFERRED, and each entry's line says
-# what this run did about it. Nothing is added. OUR GUARD ENTRY, where the file
-# carries it, is taken out — an entry calling a path that does not answer
-# `guard` fails every prompt, by exit 127, by exit 126 or by `unknown
-# subcommand`'s 2 — and the file is written back at 600 with every other hook
-# where it was. Our `SessionStart` entry, where it is there, is LEFT: its
-# `|| true` keeps it from failing a session, and the file that carries it keeps
-# the mode this installer stamps on it. No line here says `unchanged` or
-# `installed`, so a deferred run's count is the twenty-nine it placed.
-hook_pair_defer() {   # <settings>
-	local settings="$1" wrote=0
-	if [ "$GUARD_PLAN" = present ]; then
-		[ -z "$HOOK_STRIP_WHY" ] ||
-			die "$(hook_strip_refusal "Whatever the lines above report is placed.")"
-		hook_write_settings "$HOOK_DEFERRED" "$settings"
-		wrote=1
-	fi
-	case "$HOOK_PLAN" in
-	present)
-		if [ "$wrote" -eq 1 ] || mode_is 600 "$settings"; then
-			say "SessionStart hook: left in $settings as an earlier run placed it (it ends in \`|| true\`, so it cannot fail a session while the pair is deferred)"
-		else
-			chmod 600 "$settings" ||
-				die "could not set mode 600 on $settings, which already carries the SessionStart entry.
-    Nothing in that file was changed."
-			say "SessionStart hook: left in $settings as an earlier run placed it (it ends in \`|| true\`, so it cannot fail a session while the pair is deferred; mode restored to 600)"
-		fi
-		;;
-	*)
-		say "SessionStart hook: deferred, not added to $settings, because ${HOOK_TARGET_WHY}"
-		;;
-	esac
-	case "$GUARD_PLAN" in
-	present)
-		say "UserPromptSubmit guard: REMOVED from $settings, because ${HOOK_TARGET_WHY}, and left there it would fail every prompt. Only that entry was taken out: every other hook is where it was, and the file was written back at mode 600"
-		;;
-	*)
-		say "UserPromptSubmit guard: deferred, not added to $settings, because ${HOOK_TARGET_WHY}"
-		;;
-	esac
-	hook_pair_remedy
-}
-# =========================================================================
-# `wip init` — THE ONE ACT THAT CREATES THE WORKSPACE THOSE COMMANDS READ
-# =========================================================================
-#
-# lane-collision-protocol Amendment 9(c), under Brett Heap's ruling 4,
-# "openRepoTools wip init". It is why the line at the top of this file changed:
-# this command installs the estate's commands, and owns the one act that
-# creates the workspace repository those commands read. It still scaffolds no
-# product repository — that refusal is `openRepoShape`'s, and nothing here
-# touches it.
-#
-# IT ASKS AT MOST ONE QUESTION, and only where an administrator has to act
-# (step 5). Brett Heap, 2026-09-12T18:56Z, on the onboarding chain: "there are
-# two options in resume. we need to also keep that clean so there is the least
-# choices possible to not confuse the user." Everything else is DERIVED, and no
-# value it prints is ever left as a placeholder for a person to fill (R-A9-3,
-# ratified).
-#
-# EXIT CODES ARE 0 AND 2, and 2 only. 0 is done or already done; 2 is a
-# refusal. There is no 1 here: `1` in this toolset means "findings were
-# printed", and this command reports no findings. THE MOVED LANE HELPERS KEEP
-# THEIR OWN CODES, which are the lane protocol's — `lanes-edit.sh` exits 1 for
-# *registry not found*. Two toolsets ship under one installer now, so one
-# number means two things across that seam: no caller may read a number without
-# knowing which command produced it.
-#
-# A REFUSAL FROM HERE IS NOT A CAPABILITY SIGNAL. `die`'s default exit is also
-# 2, so an unknown argument and a genuine refusal are the same number. A caller
-# that wants to know whether `wip` exists PROBES `openRepoTools --help` for the
-# verb pair, never an exit code — read the other way round, a genuine refusal
-# with the administrator's `gh repo create` block already on the terminal would
-# be reported as "no such subcommand", and a degradation recipe printed over
-# the top of the one thing the person needed. opensoft/workBenches#68 probes
-# `--help` for exactly this reason.
-
-#: The organisation the repository is created in. Shipped organisation data,
-#: the same kind `repos.tsv` is (ruling 3) — never asked for and never printed
-#: unfilled. The repository is org-owned rather than personal so that the index
-#: survives offboarding and a later lane can read the handoffs.
-# THE SHIPPED DEFAULT ORGANISATION, a constant and not an environment
-# variable. Amendment 9(c) step 3 derives the organisation from `--org` where
-# given and otherwise from "the toolset's shipped default organisation", and
-# clause (e) says of workBenches' setup step that it passes `--org` only where
-# an operator set `WORKBENCHES_WORKSPACE_ORG`, "because an operator override
-# has NO OTHER WAY IN". A second way in here would falsify that sentence and
-# give one value three sources.
-WIP_ORG_DEFAULT="opensoft"
-
-#: `{{SHAPE_REPOSITORY}}`'s value: a constant here, by clause (c) step 7's
-#: substitution table.
-SHAPE_REPOSITORY="opensoft/openRepoShape"
-
-#: The template, `templates/workspace-root/` in openRepoShape (clause (d)).
-#: Nine files, named here because the amendment names them: a directory listing
-#: fetched at runtime would make the set whatever upstream happened to hold.
-WIP_TEMPLATE_DIR="templates/workspace-root"
-WIP_TEMPLATE_FILES=(
-	README.md
-	AGENTS.md
-	CLAUDE.md
-	.gitattributes
-	.gitignore
-	handoffs/README.md
-	lanes/LANES.md
-	lanes/log/README.md
-	workspaces/.gitkeep
-)
-
-WIP_LOGIN=""
-WIP_ORG=""
-WIP_TEAM=""
-WIP_TEAM_WHY=""
-WIP_DRY_RUN=0
-
-wip_config_file() { printf '%s\n' "${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"; }
-
-# Where a new clone goes. `$PROJECTS_DIR` names one directory when it is set;
-# otherwise `~/projects`, then `~/Projects` where that exists and is a
-# different directory — the block `park`, `resume` and `status` already carry,
-# narrowed to the one question this command asks of it.
-wip_projects_dir() {
-	if [ -n "${PROJECTS_DIR:-}" ]; then printf '%s\n' "$PROJECTS_DIR"; return 0; fi
-	[ -d "$HOME/projects" ] && { printf '%s\n' "$HOME/projects"; return 0; }
-	if [ -d "$HOME/Projects" ]; then printf '%s\n' "$HOME/Projects"; return 0; fi
-	printf '%s\n' "$HOME/projects"
-}
-
-wip_yaml_field() {
-	local v
-	v="$(sed -n -e "s/^$1:[[:space:]]*//p" "$2" 2>/dev/null | head -n 1 |
-		sed -e 's/[[:space:]]*#.*$//' -e 's/[[:space:]]*$//')"
-	v="${v%\"}"; v="${v#\"}"
-	v="${v%\'}"; v="${v#\'}"
-	case "$v" in
-	'~') v="$HOME" ;;
-	'~/'*) v="$HOME/${v#'~/'}" ;;
-	esac
-	printf '%s\n' "$v"
-}
-
-wip_norm_repo() {
-	local u="${1%.git}"
-	case "$u" in
-	https://github.com/*) u="${u#https://github.com/}" ;;
-	ssh://git@github.com/*) u="${u#ssh://git@github.com/}" ;;
-	git@github.com:*) u="${u#git@github.com:}" ;;
-	esac
-	printf '%s' "$u" | tr '[:upper:]' '[:lower:]'
-}
-
-# Is $2 the ROOT of a checkout of $1? The same three-part test the four lane
-# helpers make, because step 1's idempotence and their refusal have to agree on
-# what "already has a workspace" means, or a host can pass one and fail the
-# other. Local only; no network.
-wip_is_checkout_of() {
-	local want="$1" path="$2" origin toplevel real
-	[ -n "$path" ] || return 1
-	git -C "$path" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 1
-	origin="$(wip_norm_repo "$(git -C "$path" remote get-url origin 2>/dev/null || :)")"
-	want="$(wip_norm_repo "$want")"
-	if [ -z "$origin" ] || [ "$origin" != "$want" ]; then
-		# The origin's path ENDING in the `<owner>/<name>` the pointer file
-		# spells is the same repository: a GitHub Enterprise host, an ssh alias
-		# and a local bare mirror laid out by owner and name all say that, and
-		# the pointer file spells `<owner>/<name>` because that is what a person
-		# types. The four lane helpers make this same test, in the same words.
-		case "$origin" in
-		*/"$want") ;;
-		*) return 1 ;;
-		esac
-	fi
-	toplevel="$(git -C "$path" rev-parse --show-toplevel 2>/dev/null || :)"
-	real="$(cd -- "$path" 2>/dev/null && pwd -P)" || return 1
-	[ "$toplevel" = "$real" ]
-}
-
-wip_have_gh() { command -v gh >/dev/null 2>&1; }
-
-# --- step 2: the login ------------------------------------------------------
-#
-# `gh api user -q .login`, LOWERCASED — the naming contract's own definition of
-# `<user>`. A login that cannot form a compliant name under that family's
-# pattern is a refusal naming the pattern and its source, never a name repaired
-# by guesswork (R-A9-3).
-wip_login_is_compliant() {
-	case "$1" in
-	'' | *[![:lower:][:digit:]-]* | -* | *- | *--*) return 1 ;;
-	*) return 0 ;;
-	esac
-}
-
-wip_derive_login() {
-	local login
-	wip_have_gh || die "\`wip init\` needs your GitHub login and there is no \`gh\` to read it with.
-    Install GitHub CLI, run \`gh auth login\`, then run \`openRepoTools wip init\` again.
-    Nothing was created."
-	if command -v timeout >/dev/null 2>&1; then
-		login="$(timeout 20 gh api user -q .login 2>/dev/null || :)"
-	else
-		login="$(gh api user -q .login 2>/dev/null || :)"
-	fi
-	login="$(printf '%s' "$login" | tr '[:upper:]' '[:lower:]')"
-	[ -n "$login" ] || die "\`gh api user\` did not answer with a login, so this command does not know whose
-    workspace to create. That is the one precondition it has:
-        gh auth login
-    Then run \`openRepoTools wip init\` again. Nothing was created."
-	wip_login_is_compliant "$login" || die "the GitHub login '$login' cannot form a compliant \`<user>-wip\` name.
-    openRepoShape's naming contract requires \`^[a-z0-9]+(-[a-z0-9]+)*-wip\$\`, and an
-    underscore, a doubled hyphen or a leading or trailing one does not fit it. This
-    command does not repair a name by guesswork. Name the repository yourself:
-        openRepoTools wip init --login <name>
-    Nothing was created."
-	printf '%s\n' "$login"
-}
-
-# --- step 4: the team, or no team ------------------------------------------
-#
-# `gh api /user/teams` filtered to the organisation. EXACTLY ONE match is used.
-# None, or more than one, and `--team` is omitted ENTIRELY — from what is run
-# and from what is printed — with one line saying why. A placeholder a person
-# must fill is a question wearing a different hat, and this command asks at
-# most once. (Ratified decision 2.)
-wip_derive_team() {
-	local org="$1" teams count
-	WIP_TEAM=""
-	WIP_TEAM_WHY=""
-	if ! wip_have_gh; then
-		WIP_TEAM_WHY="no \`gh\` to read /user/teams with"
-		return 0
-	fi
-	teams="$(gh api --paginate /user/teams \
-		-q ".[] | select((.organization.login | ascii_downcase) == \"$(printf '%s' "$org" | tr '[:upper:]' '[:lower:]')\") | .slug" \
-		2>/dev/null || :)"
-	count="$(printf '%s' "$teams" | grep -c . || :)"
-	case "${count:-0}" in
-	1)
-		WIP_TEAM="$(printf '%s' "$teams" | head -n 1)"
-		;;
-	0)
-		WIP_TEAM_WHY="you are in no team in $org"
-		;;
-	*)
-		WIP_TEAM_WHY="you are in $count teams in $org, and this command does not choose between them"
-		;;
-	esac
-	return 0
-}
-
-# --- step 5: the block an administrator runs -------------------------------
-#
-# THREE ADMINISTRATOR ACTS, NOT TWO (Addendum 1(2) on brettheap/new-workstation#17).
-# Every value of steps 2 to 4 is already substituted, so what is printed runs as
-# it stands. The third is not a fixed command, because a ruleset's id is not
-# derivable without reading the organisation's rulesets: the block prints the
-# one call that lists them, with the organisation substituted, and names the
-# change to make.
-# GIT'S OWN WORDS, KEPT (F9 of the #24 review, ruled R-A9-15). The three
-# failures a FRESH workstation actually meets are here — the clone, the stage
-# and the commit — and all three ran `>/dev/null 2>&1` and died with a summary
-# of this command's own devising. A machine with no `user.email` configured got
-# `could not commit the seed in <path>.` and nothing else, from the command
-# whose whole job is to set up a new machine, when git had already said exactly
-# what to do about it. So the command runs, its stderr is kept, and the last of
-# it is printed UNDER the refusal — the shape `fetch_from_repo`'s refusal
-# already has, where it names both ways it tried.
-#
-# STDOUT IS STILL DROPPED FROM THE REPORT, and it is now dropped INTO A FILE
-# rather than into `/dev/null`: `gh repo clone` and `git commit` are chatty on
-# success and this command's own `say` lines are what a person reads, so nothing
-# here ever prints it. It is the WORDS OF A FAILURE that were being thrown away,
-# not progress. The file is what lets a command whose OUTPUT is the answer — step
-# 6a's `git status`, #49 — run through this one wrapper instead of carrying a
-# second copy of the stderr-capture below: `$WIP_LAST_OUT` names it, it lives in
-# the workdir the `EXIT` trap removes, and it is rewritten by every call, so a
-# caller reads it before making the next one.
-WIP_LAST_ERR=""
-WIP_LAST_OUT=""
-wip_quietly() {   # <command> [args…] — 0 or 1, stderr in $WIP_LAST_ERR, stdout AT $WIP_LAST_OUT
-	workdir
-	WIP_LAST_ERR=""
-	WIP_LAST_OUT="$WORKDIR/cmd-out"
-	if "$@" >"$WIP_LAST_OUT" 2>"$WORKDIR/cmd-err"; then
-		return 0
-	fi
-	WIP_LAST_ERR="$(tail -n 6 -- "$WORKDIR/cmd-err" 2>/dev/null | sed -e 's/^/    | /')"
-	[ -n "$WIP_LAST_ERR" ] || WIP_LAST_ERR="    | (it printed nothing at all)"
-	return 1
-}
-
-wip_admin_block() {
-	local target="$1" org="$2" team="$3"
-	say ""
-	say "  # 1. create the repository (org-owned, private)"
-	if [ -n "$team" ]; then
-		say "  gh repo create $target --private --team $team \\"
-	else
-		say "  gh repo create $target --private \\"
-	fi
-	say "      --description \"${WIP_LOGIN}'s workspace repository: lanes, handoffs, workspaces\""
-	say ""
-	if [ -n "$team" ]; then
-		say "  # 2. give the team read; --team alone grants the org default, not read"
-		say "  gh api --method PUT \\"
-		say "      /orgs/$org/teams/$team/repos/$target -f permission=pull"
-		say ""
-		say "  # 3. exclude it from the organisation's PR-only ruleset. Without this,"
-	else
-		say "  # 2. exclude it from the organisation's PR-only ruleset. Without this,"
-	fi
-	say "  #    Rule 9's one commit per write cannot land and the register is"
-	say "  #    unwritable. List the rulesets, then add $target to the"
-	say "  #    PR-only one's exempt repositories:"
-	say "  gh api /orgs/$org/rulesets"
-	say ""
-	if [ -z "$team" ]; then
-		say "  (No \`--team\` and no team grant: ${WIP_TEAM_WHY:-no single team matched}. The"
-		say "   repository is created without one and an administrator may add one.)"
-		say ""
-	fi
-}
-
-# --- step 7: the template, and the whole of its substitution table ----------
-#
-# openRepoTools substitutes the placeholders ITSELF. openRepoShape's engine
-# (`scripts/shape_materialize.py`) is reached only by that repository's own
-# tools, and `grep -rn 'workspace-root'` finds no code path there for this
-# template at all — so the consumer substitutes, the consumer is this command,
-# and the tokens are exactly these three (clause (c) step 7):
-#
-#   {{LOGIN}}             the lowercased GitHub login      step 2
-#   {{ORG}}               the organisation                 step 3
-#   {{SHAPE_REPOSITORY}}  opensoft/openRepoShape           constant here
-#
-# A TOKEN THE TABLE DOES NOT CARRY IS A REFUSAL NAMING THE TOKEN — never a
-# blank, and never a literal `{{…}}` written into a person's repository. That
-# is what openRepoShape's own engine does with an unsubstituted token
-# (`Refusal("template-unsubstituted", …)`), and it is why the table is written
-# here rather than left to a private function that is no published contract.
-wip_substitute() {
-	local file="$1" left
-	# `|` as the sed delimiter would collide with the table rows in LANES.md;
-	# these three values are a login, an `<org>` and an `<owner>/<name>`, so `#`
-	# cannot appear in any of them and is safe as the delimiter.
-	sed -e "s#{{LOGIN}}#$WIP_LOGIN#g" \
-		-e "s#{{ORG}}#$WIP_ORG#g" \
-		-e "s#{{SHAPE_REPOSITORY}}#$SHAPE_REPOSITORY#g" \
-		-- "$file" >"$file.subst" || die "could not substitute the template file $file"
-	left="$(grep -o -e '{{[A-Z_]*}}' "$file.subst" 2>/dev/null | sort -u | tr '\n' ' ' || :)"
-	if [ -n "$left" ]; then
-		rm -f -- "$file.subst"
-		die "the template carries a placeholder this command has no value for: $left
-    (in ${file##*/}). Amendment 9(c) step 7's substitution table is {{LOGIN}}, {{ORG}}
-    and {{SHAPE_REPOSITORY}}, and a token outside it is a refusal naming the token —
-    never a blank, and never a literal {{…}} written into your repository.
-    Nothing was created."
-	fi
-	# THE WORKSPACE'S `.gitignore` CARRIES THE BYTECODE AND CACHE RULES
-	# (opensoft/openRepoTools#162, cause 19: generated bytecode committed into
-	# handoff attachments). Added HERE, in the one function both step 7 paths
-	# go through, so the bytes a seed writes and the bytes a re-run compares
-	# an earlier run's leftover against are the same bytes. A line the template
-	# already carries is not repeated.
-	case "${file##*/}" in
-	tpl-.gitignore) wip_hygiene_lines "$file.subst" >>"$file.subst" ||
-		die "could not add the bytecode and cache rules to the template file $file" ;;
-	esac
-	mv -f -- "$file.subst" "$file"
-}
-
-#: The lines every `<user>-wip` ignores (#162): bytecode, test and type-check
-#: caches, dependency trees and virtual environments - a handoff attachment
-#: is evidence, and none of these is.
-WIP_HYGIENE_LINES=(
-	"__pycache__/"
-	"*.pyc"
-	"*.pyo"
-	".pytest_cache/"
-	".mypy_cache/"
-	".ruff_cache/"
-	"node_modules/"
-	".venv/"
-	"venv/"
-	"site-packages/"
-)
-
-# The hygiene block, less every line `$1` already carries; nothing at all when
-# it carries them all. A bare `grep`, never `command grep`
-# (opensoft/openRepoTools#292): its failure IS the missing line, and macOS's
-# bash 3.2 ends a `set -e` script where a utility run through `command` fails,
-# even on the left of `||`.
-wip_hygiene_lines() {   # <the .gitignore as it stands>
-	local line missing=""
-	for line in "${WIP_HYGIENE_LINES[@]}"; do
-		grep -Fqx -- "$line" "$1" 2>/dev/null || missing="$missing$line
-"
-	done
-	[ -n "$missing" ] || return 0
-	printf '\n# Bytecode, caches, dependency trees and virtual environments are never\n'
-	printf '# a workspace repository'"'"'s: a handoff attachment is evidence, not a build\n'
-	printf '# (opensoft/openRepoTools#162). `lanes-edit.sh` refuses to commit them.\n'
-	printf '%s' "$missing"
-}
-
-# The template's bytes, materialized EXACTLY the way `--install` gets its own
-# files: from the checkout beside this command when run from one, else
-# `gh api …/contents/<path>` at the pinned ref, else the raw URL. *That the
-# template travels by the installer's own fetch path is the drafter's; the
-# issue named the template and not its transport.*
-wip_shape_ref() {
-	local pin selfdir=""
-	[ -f "$SELF" ] && selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-	if [ -n "$selfdir" ] && [ -f "$selfdir/contracts/openreposhape-pin.yaml" ]; then
-		pin="$(sed -n -e 's/^commit:[[:space:]]*//p' "$selfdir/contracts/openreposhape-pin.yaml" | head -n 1)"
-		pin="${pin%\"}"; pin="${pin#\"}"
-		[ -n "$pin" ] && { printf '%s\n' "$pin"; return 0; }
-	fi
-	workdir
-	# NO PIN BESIDE THIS FILE — the installed copy, a vendored tree: the pin is
-	# the one the CODE carries (#186). A single repository's is read exactly as
-	# it always was, at `$REF`; an adopted assembly's is the code leg's, at the
-	# commit the assembly pins, never the assembly's own `contracts/`. A source
-	# that does not answer leaves `main`, as it always did, and so does a pin
-	# the source does not carry. An adopted assembly whose code cannot be
-	# resolved refuses, in step 7's words (`resolve_refuse`).
-	RESOLVE_FOR=wip
-	payload_probe
-	case "$PROBE_LAYOUT" in
-	unknown) printf 'main\n'; return 0 ;;
-	single) : ;;
-	*) payload_resolve_remote ;;
-	esac
-	if fetch_from_repo "contracts/openreposhape-pin.yaml" "$WORKDIR/pin.yaml"; then
-		pin="$(sed -n -e 's/^commit:[[:space:]]*//p' "$WORKDIR/pin.yaml" | head -n 1)"
-		pin="${pin%\"}"; pin="${pin#\"}"
-		[ -n "$pin" ] && { printf '%s\n' "$pin"; return 0; }
-	fi
-	printf 'main\n'
-}
-
-wip_fetch_template_file() {
-	local rel="$1" dest="$2" ref="$3" selfdir="" path="$WIP_TEMPLATE_DIR/$rel"
-	[ -f "$SELF" ] && selfdir="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-	if [ -n "$selfdir" ] && [ -f "$selfdir/upstream/openRepoShape/$path" ]; then
-		cp -- "$selfdir/upstream/openRepoShape/$path" "$dest"
-		return 0
-	fi
-	if command -v gh >/dev/null 2>&1 &&
-		gh api "repos/$SHAPE_REPOSITORY/contents/$path?ref=$ref" \
-			-H 'Accept: application/vnd.github.raw' >"$dest" 2>/dev/null &&
-		[ -s "$dest" ]; then
-		return 0
-	fi
-	if command -v curl >/dev/null 2>&1 &&
-		curl -fsSL "https://raw.githubusercontent.com/$SHAPE_REPOSITORY/$ref/$path" \
-			>"$dest" 2>/dev/null && [ -s "$dest" ]; then
-		return 0
-	fi
-	# `workspaces/.gitkeep` is zero bytes upstream, so `-s` above is false for
-	# it on every path. It carries no placeholder and no content by definition:
-	# git tracks no empty directory, and that is the whole of its job.
-	case "$rel" in
-	*/.gitkeep | .gitkeep) : >"$dest"; return 0 ;;
-	esac
-	return 1
-}
-
-# --- step 6a's history question: is this commit one `wip init` made? --------
-#
-# STEP 6a LETS THROUGH, AHEAD OF origin's `main`, THIS COMMAND'S OWN SEED AND
-# NOTHING ELSE (#64), so the answer here is ALL of what step 8's own commit is
-# and never one part of it a person's commit could happen to share. Four tests,
-# and a commit has to pass every one:
-#
-#   * ONE PARENT OR NONE. Step 8 commits on top of HEAD — on an empty `main`
-#     that is a root commit — and never merges. It is asked first because the
-#     path test below cannot ask it: `diff-tree` prints NOTHING for a merge
-#     unless it is asked for a combined diff, so a merge would answer "no path
-#     outside the template" by naming no path at all.
-#   * THE SUBJECT step 8 writes, `Seed this workspace repository from …` — a
-#     PREFIX, because what follows it names the template's repository and
-#     directory, which are this file's constants and not a part of the promise.
-#   * THE BODY'S `Written by \`openRepoTools wip init\`` line, which is the
-#     sentence in that message that says whose commit it is.
-#   * AND A TREE THAT DIFFERS FROM ITS PARENT'S — the empty tree, for a root
-#     commit, which is what `--root` compares it with — AT ONE OR MORE TEMPLATE
-#     PATHS AND AT NO OTHER. Step 8 commits `"${written[@]}"` by pathspec, which
-#     is template paths and nothing else, and commits only where `diff --cached`
-#     says there is something to commit, so it has never made an empty one.
-#
-# A MESSAGE IS SOMETHING ANYBODY CAN TYPE, which is why the tree is asked as
-# well as the words: a commit wearing the seed's subject and trailer and
-# touching a path the template does not name is somebody's own work in a
-# borrowed coat, and it is refused like any other. What this does NOT do is
-# compare the bytes at those paths with the template: the seed it is looking
-# at was written from the template at whatever commit THAT run pinned, which
-# need not be this run's, and Brett Heap's ruling on #64 asks for the subject,
-# the trailer and the tree — the parent count is the tree test made sound —
-# and not the bytes. A person who writes this command's own message over
-# their own edit of a template file has said, in so many words, that it is
-# the seed.
-#
-# `--no-show-signature` ON EVERY `log` HERE, because `log.showSignature` is a
-# person's own config and it prints the signature check's report ON STDOUT,
-# ahead of the format: a seed this command committed on a machine with
-# `commit.gpgSign` set would then read back with that report as its first
-# line — `No signature`, `Good "git" signature …` — instead of its subject,
-# and be refused as somebody else's.
-#
-# EVERY READ THAT FAILS IS A NO, so a commit this could not ask about is
-# refused and never passed (#49's lesson, asked of history). Paths are
-# compared as `diff-tree` prints them: one it had to C-quote is never one of
-# `$WIP_TEMPLATE_FILES`, which are nine plain ASCII paths, so it is refused
-# rather than misread.
-wip_is_own_seed() {   # <checkout> <commit> — 0 only for a commit `wip init` itself made
-	local checkout="$1" commit="$2" parents subject body paths path rel known
-	parents="$(git -C "$checkout" log -1 --no-show-signature --format=%P "$commit" 2>/dev/null)" ||
-		return 1
-	case "$parents" in *' '*) return 1 ;; esac
-	subject="$(git -C "$checkout" log -1 --no-show-signature --format=%s "$commit" 2>/dev/null)" ||
-		return 1
-	case "$subject" in
-	'Seed this workspace repository from '*) ;;
-	*) return 1 ;;
-	esac
-	body="$(git -C "$checkout" log -1 --no-show-signature --format=%b "$commit" 2>/dev/null)" ||
-		return 1
-	case "$body" in
-	*'Written by `openRepoTools wip init`'*) ;;
-	*) return 1 ;;
-	esac
-	paths="$(git -C "$checkout" diff-tree --root --no-commit-id --name-only -r "$commit" 2>/dev/null)" ||
-		return 1
-	[ -n "$paths" ] || return 1
-	while IFS= read -r path; do
-		known=0
-		for rel in "${WIP_TEMPLATE_FILES[@]}"; do
-			if [ "$path" = "$rel" ]; then
-				known=1
-				break
-			fi
-		done
-		[ "$known" -eq 1 ] || return 1
-	done <<EOF
-$paths
-EOF
-	return 0
-}
-
-# --- step 10's two acts: the links, then the hook pair (#237) ---------------
-#
-# `link-estates` places the symlinks and reports the ones it skipped. One of
-# them is `~/projects/xFactory/lanes-edit.sh`, the path both of `--install`'s
-# hook entries call — which is why the pair is completed here, after it, and
-# why step 1 runs this again on a workstation whose link is missing.
-wip_run_link_estates() {
-	local linker="${OPENREPOTOOLS_BIN_DIR:-$HOME/.local/bin}/link-estates"
-	[ -x "$linker" ] || linker="$(command -v link-estates 2>/dev/null || :)"
-	if [ -n "$linker" ] && [ -x "$linker" ]; then
-		say ""
-		say "  link-estates:"
-		# ONE PROJECTS TREE ACROSS THE SEAM. This toolset spells that directory
-		# `$PROJECTS_DIR` (`park:131`, `resume:114`, and `wip_init`'s step 6); the lane
-		# protocol's commands, which arrived from the workspace repository,
-		# spell it `$PROJECTS_ROOT` (`link-estates:200`, `lane-start:427`).
-		# Amendment 9(g) keeps every mechanic of Amendments 6 to 8, so the
-		# helpers keep their name — but step 10 must run the linker against the
-		# tree step 6 actually cloned into, or a host with `$PROJECTS_DIR` set
-		# to anything but the default gets a clone in one tree and its symlinks
-		# looked for in another. Passed only where the person has not set
-		# `$PROJECTS_ROOT` themselves: their answer wins over our inference.
-		PROJECTS_ROOT="${PROJECTS_ROOT:-$(wip_projects_dir)}" "$linker" ||
-			say "  (link-estates reported the above and changed nothing else)"
-	else
-		say ""
-		say "  link-estates is not installed, so no symlinks were placed."
-		say "  \`openRepoTools --install\` places it; then run \`link-estates\`."
-	fi
-}
-
-# THE HOOK PAIR, BY `--install`'s OWN READ AND ITS OWN WRITE (#237): the rival
-# refusal, the two staged outcomes and the gate are `plan_hook_merge` and
-# `place_hook_pair`, word for word, so `wip init` and `--install` are one rule
-# for one file. In a SUBSHELL, because a refusal there is `die`: it prints what
-# `--install` would have refused with and exits 2 — the subshell, not this run.
-# The workspace this command exists to make is made by then, so the refusal is a
-# note beside it and the exit stays 0, the way a `link-estates` that refused is
-# (step 10). ONE RULE ON BOTH PATHS: on step 1's the reconcile is the only act,
-# and the exit is still 0 — a 2 there would tell a caller the workspace failed,
-# which it did not — so the usage and the README say so where the exit codes
-# are (the #237 review, S1). `set -e` is put back on INSIDE the subshell: the
-# `set +e` that lets this read the subshell's status would otherwise reach
-# everything the two functions run, and they are written for `--install`'s
-# `set -e`.
-wip_hook_pair() {
-	local rc
-	say ""
-	say "  hook entries in $(claude_home)/settings.json:"
-	workdir
-	set +e
-	( set -e; plan_hook_merge; place_hook_pair )
-	rc=$?
-	set -e
-	if [ "$rc" -ne 0 ]; then
-		say "  (not reconciled: the refusal above is the one \`openRepoTools --install\` makes, and"
-		say "   nothing in that file was changed. Fix what it names, then run \`openRepoTools wip init\` again.)"
-	fi
-	return 0
-}
-
-wip_hook_pair_would() {
-	say "  would merge   the SessionStart and UserPromptSubmit hook entries into"
-	say "                $(claude_home)/settings.json, once ~/projects/xFactory/lanes-edit.sh"
-	say "                answers \`guard\` (until then each run says it deferred them)"
-}
-
-# --- the command itself -----------------------------------------------------
-wip_init() {
-	local config target checkout ref rel dest seeded=0 owed=0 kind
-	local existing_repo existing_path
-	local ancestor rest comp staged_mode staged_entry index_tag ancestor_mode
-	# THE TEMPLATE PATHS THIS CHECKOUT HAS IN HEAD AND NOT ON DISK, because the
-	# index marks them `skip-worktree` (#69). Counted as well as collected, for
-	# the reason `written` is: an empty array expanded as `"${sparse_paths[@]}"`
-	# is an UNBOUND VARIABLE under `set -u` in the bash 3.2 macOS ships.
-	local sparse=0 sparse_paths
-	sparse_paths=()
-	# THE PATHS THE SEED OWES THIS CHECKOUT, which is what step 8 stages and
-	# commits and the whole of what it commits: the ones step 7 wrote (`seeded`)
-	# and the ones an earlier run wrote and could not commit (`owed`). Two
-	# counters rather than `${#written[@]}`: an empty array expanded as
-	# `"${written[@]}"` is an UNBOUND VARIABLE under `set -u` in the bash 3.2
-	# macOS ships, so every reader of this list is guarded on a count, and the
-	# count that says how many were COPIED is the one step 7's line prints.
-	local written
-	written=()
-
-	# ---- step 1: DETECT. A file test, not a network call, and the whole of the
-	# idempotence. A host that already has a workspace does nothing at all.
-	config="$(wip_config_file)"
-	if [ -f "$config" ]; then
-		existing_repo="$(wip_yaml_field repository "$config")"
-		existing_path="$(wip_yaml_field path "$config")"
-		if [ -n "$existing_repo" ] && [ -n "$existing_path" ] &&
-			wip_is_checkout_of "$existing_repo" "$existing_path"; then
-			say "workspace repository: $existing_repo"
-			say "  checked out at      $existing_path"
-			say "  named by            $config"
-			say "openRepoTools wip init: nothing to do for the workspace itself."
-			# THE HOOK PAIR IS THE ONE THING A RE-RUN STILL OWES (#237). A run cut
-			# off between step 9 and step 10 — or one whose `link-estates` could
-			# not link yet — left a workspace this file test accepts and no link
-			# for `--install`'s two entries to call, and nothing else would ever
-			# heal it: every later run returned here. So, only where that path
-			# does not answer `guard` and `~/projects/xFactory` is there for the
-			# link to go into, `link-estates` runs again; then the pair is
-			# reconciled, which on a healthy workstation writes nothing.
-			if [ "$WIP_DRY_RUN" -eq 1 ]; then
-				say ""
-				say "--dry-run, so nothing below was done:"
-				if ! hook_target_answers && [ -d "$HOME/projects/xFactory" ]; then
-					say "  would run     link-estates (${HOOK_TARGET_WHY})"
-				fi
-				wip_hook_pair_would
-				return 0
-			fi
-			if ! hook_target_answers && [ -d "$HOME/projects/xFactory" ]; then
-				say "  ${HOOK_TARGET_WHY}, so link-estates runs again:"
-				wip_run_link_estates
-			fi
-			wip_hook_pair
-			return 0
-		fi
-		# A file that names a repository the path is NOT a checkout of is a
-		# refusal, never a silent overwrite: which private repository holds a
-		# person's unfinished work is theirs to name, and this command has
-		# exactly one write to that file and only on a machine that has none.
-		if [ -n "$existing_repo" ]; then
-			die "$config already names \`repository: $existing_repo\`, and its \`path: ${existing_path:-<none>}\`
-    is not the root of a checkout of it. This command never overwrites that file.
-    Either fix the two lines by hand, or move the file aside and re-run. Nothing
-    was created."
-		fi
-		die "$config exists and names no \`repository:\`. This command never overwrites
-    that file — a half-written pointer is still somebody's. Fix it by hand, or move
-    it aside and re-run. Nothing was created."
-	fi
-
-	# ---- steps 2 to 4: DERIVE. Nothing here is asked.
-	[ -n "$WIP_LOGIN" ] || WIP_LOGIN="$(wip_derive_login)"
-	[ -n "$WIP_ORG" ] || WIP_ORG="$WIP_ORG_DEFAULT"
-	target="$WIP_ORG/$WIP_LOGIN-wip"
-	if [ -z "$WIP_TEAM" ]; then
-		wip_derive_team "$WIP_ORG"
-	fi
-	say "workspace repository: $target"
-	say "  login               $WIP_LOGIN (derived from gh api user)"
-	say "  organisation        $WIP_ORG"
-	if [ -n "$WIP_TEAM" ]; then
-		say "  team                $WIP_TEAM (the one team you are in there)"
-	else
-		say "  team                none — ${WIP_TEAM_WHY:-no single team matched}, so --team is omitted"
-		say "                      entirely and an administrator may add one later."
-	fi
-
-	checkout="$(wip_projects_dir)/$WIP_LOGIN-wip"
-
-	if [ "$WIP_DRY_RUN" -eq 1 ]; then
-		say ""
-		say "--dry-run, so nothing below was done:"
-		say "  would create  $target (private, org-owned)"
-		say "  would clone   $target -> $checkout"
-		say "  would seed    ${#WIP_TEMPLATE_FILES[@]} files from $SHAPE_REPOSITORY $WIP_TEMPLATE_DIR"
-		say "  would push    one commit to main (which is also the ruleset probe)"
-		say "  would write   $config (repository:, path:)"
-		say "  would run     link-estates"
-		wip_hook_pair_would
-		return 0
-	fi
-
-	# ---- step 5: CREATE IT, OR PRINT THE COMMANDS — ruling 2.
-	wip_have_gh || die "\`wip init\` needs \`gh\` to create or find $target. Install GitHub CLI,
-    run \`gh auth login\`, then run this again. Nothing was created."
-	if gh repo view "$target" >/dev/null 2>&1; then
-		say ""
-		say "  $target is already there; this run adopts it."
-	else
-		say ""
-		say "  creating $target"
-		local create_args
-		create_args=(repo create "$target" --private)
-		[ -n "$WIP_TEAM" ] && create_args+=(--team "$WIP_TEAM")
-		create_args+=(--description "$WIP_LOGIN's workspace repository: lanes, handoffs, workspaces")
-		if gh "${create_args[@]}" >/dev/null 2>&1; then
-			say "  created $target"
-			if [ -n "$WIP_TEAM" ]; then
-				# `--team` alone grants the ORG DEFAULT, not read.
-				# THE LINE ITSELF, not a pointer to a block that is not printed
-				# on this path: `wip_admin_block` is reached only where the
-				# CREATE failed, and this arm is the one where it succeeded
-				# (F8 of the #24 review).
-				gh api --method PUT \
-					"/orgs/$WIP_ORG/teams/$WIP_TEAM/repos/$target" -f permission=pull \
-					>/dev/null 2>&1 || {
-					say "  (could not give team $WIP_TEAM read. An administrator can:"
-					say "     gh api --method PUT /orgs/$WIP_ORG/teams/$WIP_TEAM/repos/$target -f permission=pull)"
-				}
-			fi
-		else
-			# RULING 2: PRINT THE COMMAND, and continue once the repository
-			# exists. It never asks for a token and never tries a second
-			# credential.
-			say ""
-			# NAMED FOR WHAT HAPPENED, not for a cause this has not proved. The
-			# usual cause is that the account may not create a repository in
-			# this organisation, and the block below is the answer to that; a
-			# network that was down is the other, and the same block re-run
-			# costs nothing. Claiming the first outright would send a person to
-			# an administrator over a dropped connection.
-			say "\`gh repo create $target\` did not succeed — most often because this account"
-			say "may not create a repository in $WIP_ORG."
-			say "These are the acts an administrator runs. Every value is already filled in:"
-			wip_admin_block "$target" "$WIP_ORG" "$WIP_TEAM"
-			# ONE QUESTION, ONE RE-CHECK, no poll loop and no timeout to choose:
-			# an unbounded wait is a decision the person never asked to make.
-			if [ -t 0 ]; then
-				printf '%s' "Press Enter when the administrator has run these (Ctrl-C to stop): " >&2
-				read -r _ || :
-				if gh repo view "$target" >/dev/null 2>&1; then
-					say "  $target is there now; carrying on."
-				else
-					die "$target is still not there, so there is nothing to clone. Run the block
-    above, then: openRepoTools wip init   (it is idempotent and picks up here)."
-				fi
-			else
-				# An unattended launch must not block on a person.
-				die "$target does not exist and this run has no terminal to wait on. Run the block
-    above, then: openRepoTools wip init"
-			fi
-		fi
-	fi
-
-	# ---- step 6: CLONE IT. Before the seed, because the seed is a commit and a
-	# commit needs a checkout.
-	if [ -d "$checkout/.git" ]; then
-		wip_is_checkout_of "$target" "$checkout" ||
-			die "$checkout is already a checkout, and not of $target. This command will not
-    write into a clone of somebody else's repository, and it will not move one aside.
-    Move it yourself, or pass a different projects directory with \$PROJECTS_DIR.
-    $target exists; NOTHING was written into that checkout, and a re-run picks
-    up from here."
-		say "  $checkout is already a checkout of $target"
-	elif [ -e "$checkout" ]; then
-		die "$checkout already exists and is not a git checkout. $target exists;
-    NOTHING was written into that path, and a re-run picks up from here once it
-    is moved aside."
-	else
-		mkdir -p -- "$(dirname -- "$checkout")"
-		say "  cloning $target -> $checkout"
-		wip_quietly gh repo clone "$target" "$checkout" -- --quiet ||
-			die "could not clone $target into $checkout. Nothing else was changed.
-    What it said:
-$WIP_LAST_ERR"
-	fi
-
-	# ---- step 6a: AN ADOPTED CHECKOUT CARRIES THE TEMPLATE AND NOTHING ELSE,
-	# OR THIS COMMAND STOPS (#40, finding 1).
-	#
-	# Step 8 staged with `git add -A -- .` and committed whatever
-	# `status --porcelain` had found, so a checkout ADOPTED at the derived path —
-	# or one a half-finished earlier run left behind — had every unrelated
-	# modified, deleted and untracked file it carried staged, committed and
-	# `push origin HEAD:main`ed as part of the seed. The repository on the other
-	# end of that push is the one a person keeps their unfinished work in, which
-	# is the last place a file should arrive by accident.
-	#
-	# ASKED HERE, BEFORE STEP 7 WRITES A SINGLE BYTE INTO THAT CHECKOUT, for the
-	# reason `plan_install_targets` is asked before the fetch: a refusal costs
-	# nothing at all at this point, and the person's own files are still exactly
-	# where they left them when they read it.
-	#
-	# THE TEMPLATE'S OWN PATHS ARE NOT `UNRELATED`, which is why the question is
-	# put to git as an EXCLUSION and not as "is it clean": a first run that
-	# fetched and copied the ${#WIP_TEMPLATE_FILES[@]} files and then could not
-	# commit them — no `user.email`, the case F9 is written about — leaves
-	# exactly those paths behind, and step 7's promise is that a re-run after a
-	# half-finished run is safe. `--untracked-files=all` because git collapses an
-	# untracked DIRECTORY to one line otherwise, and `handoffs/` is not a path
-	# any exclusion below spells.
-	#
-	# AND A `git status` THIS COMMAND COULD NOT RUN IS A REFUSAL, NEVER A CLEAN
-	# ANSWER (#49). The question was asked as
-	# `… 2>/dev/null | sed … || :`, which discarded git's own diagnostic and then
-	# turned ANY failure of the pipeline — under this file's `set -o pipefail`,
-	# `git status`'s own: a corrupt index, an unreadable `.git`, a submodule
-	# error — into a plain empty string. An empty change list is exactly what
-	# "nothing unrelated, proceed" looks like, so a checkout this command could
-	# not even ASK about was read as clean and step 7 wrote template bytes into
-	# it, past the one gate that exists to refuse before a byte is written. The
-	# run is `wip_quietly`'s now: its stdout is the change list, read from
-	# `$WIP_LAST_OUT` and never from a capture a failure can empty, and its
-	# stderr is git's own words under the refusal — the shape every other
-	# failure in this function already has.
-	local status_args
-	status_args=(status --porcelain --untracked-files=all -- .)
-	for rel in "${WIP_TEMPLATE_FILES[@]}"; do
-		status_args+=(":(exclude)$rel")
-	done
-	wip_quietly git -C "$checkout" "${status_args[@]}" ||
-		die "could not ask git what $checkout carries, so this run cannot tell whether that
-    checkout holds anything this command did not write — and it will not seed a checkout
-    it could not put that question to. NOTHING was written into that checkout on this run
-    and nothing was staged.
-    What it said:
-$WIP_LAST_ERR"
-	if [ -s "$WIP_LAST_OUT" ]; then
-		die "$checkout carries changes this command did not write:
-$(sed -e 's/^/    /' -- "$WIP_LAST_OUT")
-    A seed commit is $SHAPE_REPOSITORY's $WIP_TEMPLATE_DIR and nothing else, and the
-    push that follows it goes straight to $target's main — so anything else
-    staged beside it is somebody's unfinished work published. NOTHING was written
-    into that checkout on this run and nothing was staged.
-    Commit, stash or remove those paths, then re-run:
-        openRepoTools wip init"
-	fi
-
-	# ---- AND A CHECKOUT AHEAD OF origin's `main` BY ANYTHING BUT THIS
-	# COMMAND'S OWN SEED IS REFUSED THE SAME WAY (#64, Brett Heap's RULING of
-	# 2026-10-02, verbatim "go with option 1 on #64").
-	#
-	# The question above is the WORKTREE and the INDEX, and it never looked at
-	# HISTORY. Step 8 pushes `HEAD:main` wherever HEAD is not what origin's
-	# `main` already carries, and HEAD carries every commit beneath it — so a
-	# clean adopted checkout holding commits of a person's own that never left
-	# this workstation (a register edit made here and not pushed, a note
-	# committed on the wrong clone) had every one of them published to the
-	# `main` of their workspace repository by a command that came to place a
-	# template. That is #40's finding 1 one layer down, and it is closed at the
-	# same gate for the same reason: before step 7 writes a byte, where a
-	# refusal costs nothing and the person's commits are exactly where they
-	# left them, with the list in front of them. Pushing those commits, or
-	# discarding them, is theirs to do; this command does neither.
-	#
-	# THE SEED IS EXEMPT, AND HAS TO BE, or step 8's own promise breaks. A
-	# first run whose push the organisation's PR-only ruleset refused leaves a
-	# clean worktree and EXACTLY ONE commit ahead of `main` — its seed — and
-	# step 8's refusal tells the person that "a re-run after that has only to
-	# push". So a commit this command made is let through, and it is known by
-	# everything that makes it this command's own, never by its message alone:
-	# `wip_is_own_seed` above. Every OTHER commit in `<origin main>..HEAD` is a
-	# refusal naming all of them, seed or not, because what step 8 would push
-	# is the whole range and the person should see the whole range.
-	#
-	# THE REMOTE IS ASKED HERE, ONCE, AND STEP 8 READS THE SAME ANSWER. One
-	# `ls-remote`, one `remote_head`: the range this gate checked and the push
-	# step 8 decides on can never be two different readings of `main`. And the
-	# line read is `refs/heads/main` BY NAME, never the first line: a pattern
-	# of `main` matches every ref whose name ENDS in it, so a branch such as
-	# `refs/heads/backup/main` sorts before `refs/heads/main`, and the first
-	# line was then that branch's tip read as `main` — which would wave through
-	# every commit the branch carries, and tell step 8 that a `main` it never
-	# pushed to already had them.
-	#
-	# A REMOTE THAT COULD NOT BE ASKED IS STEP 8'S OWN ARM, KEPT, as the ruling
-	# keeps it: this check is skipped, said in one line, and the run goes on to
-	# the push, which is the probe. Not a refusal, because there is nothing
-	# true to refuse with — no `main` to name commits against — and because the
-	# remote that will not answer `ls-remote` is the remote step 8 pushes to,
-	# by the same URL, transport and credential, so the push almost always
-	# meets the same wall and step 8 stops the run before the pointer file is
-	# written. And NOT an empty `main` either: `remote_asked` is kept apart
-	# from `remote_head` because an unanswered question read as "no `main`
-	# yet" would put EVERY local commit ahead — refusing the very seed re-run
-	# the exemption above exists for. The window this leaves is a remote that
-	# refuses the question and takes the push a moment later, and that is the
-	# trade the ruling chose with this arm.
-	#
-	# A RANGE THAT CANNOT BE LISTED IS A REFUSAL, NEVER AN EMPTY ONE (#49's
-	# lesson, asked of history). Its usual cause is a `main` this checkout has
-	# never fetched — another workstation pushed to it since — and an empty
-	# list read from that failure is exactly what "nothing ahead, proceed"
-	# looks like.
-	local remote_head="" remote_asked=0 remote_refs history_range where ahead ahead_log commit
-	local seeds_ahead=0
-	if remote_refs="$(git -C "$checkout" ls-remote origin main 2>/dev/null)"; then
-		remote_asked=1
-		remote_head="$(printf '%s\n' "$remote_refs" |
-			awk '$2 == "refs/heads/main" && !seen { print $1; seen = 1 }')"
-	fi
-	if [ "$remote_asked" -eq 0 ]; then
-		say "  could not ask origin where $target's main is, so the commits this checkout"
-		say "  carries were not checked against it here; the push below is the probe."
-	elif git -C "$checkout" rev-parse -q --verify 'HEAD^{commit}' >/dev/null 2>&1; then
-		if [ -n "$remote_head" ]; then
-			history_range="$remote_head..HEAD"
-			where="$target's main ($(printf '%.7s' "$remote_head"))"
-		else
-			history_range="HEAD"
-			where="$target's main (it has none yet)"
-		fi
-		wip_quietly git -C "$checkout" rev-list "$history_range" ||
-			die "could not list the commits $checkout carries that are not on $where,
-    so this run cannot tell whether any of them is somebody's unreviewed work — and a
-    history this command could not read is never one it may push. Most often that \`main\`
-    is a commit this checkout has never fetched, because another workstation pushed to it
-    since. NOTHING was written into that checkout on this run and nothing was staged.
-    Fetch it, merge or rebase this checkout's own commits onto origin/main, then re-run:
-        git -C $checkout fetch origin
-        openRepoTools wip init
-    What it said:
-$WIP_LAST_ERR"
-		ahead="$(cat -- "$WIP_LAST_OUT")"
-		for commit in $ahead; do
-			if wip_is_own_seed "$checkout" "$commit"; then
-				seeds_ahead=$((seeds_ahead + 1))
-				continue
-			fi
-			ahead_log="$(git -C "$checkout" log --oneline --no-decorate --no-color \
-				--no-show-signature "$history_range" 2>/dev/null)" || ahead_log="$ahead"
-			die "$checkout carries commits that are not on $where,
-    and not every one of them is this command's own seed:
-$(printf '%s\n' "$ahead_log" | sed -e 's/^/    /')
-    This command ends by pushing HEAD to $target's main, so it would publish every
-    commit above to your workspace repository unreviewed — and what it came to push
-    is $SHAPE_REPOSITORY's $WIP_TEMPLATE_DIR and nothing else.
-    NOTHING was written into that checkout on this run and nothing was staged.
-    Push those commits yourself, or discard them, then re-run:
-        openRepoTools wip init"
-		done
-		case "$seeds_ahead" in
-		0) ;;
-		1) say "  one seed an earlier run committed is not on $target main yet; the push below carries it" ;;
-		*) say "  $seeds_ahead seeds earlier runs committed are not on $target main yet; the push below carries them" ;;
-		esac
-	fi
-
-	# ---- step 7: SEED IT FROM THE TEMPLATE, additively. A repository that
-	# already has a commit on `main` is NOT re-seeded: files the template would
-	# place and that are already there are left exactly as they are, and the
-	# missing ones are added — which is what makes a re-run after a
-	# half-finished first run safe.
-	ref="$(wip_shape_ref)" || exit "$?"
-	workdir
-	for rel in "${WIP_TEMPLATE_FILES[@]}"; do
-		dest="$WORKDIR/tpl-$(printf '%s' "$rel" | tr '/' '_')"
-		# ---- THE PATH'S OWN ANCESTORS ARE ASKED ABOUT FIRST, AND A SYMLINK AT
-		# ONE OF THEM IS REFUSED BEFORE ANY BRANCH BELOW OPENS, CREATES OR
-		# WRITES THROUGH IT (#62).
-		#
-		# `path_kind` below asks what is at `$rel` ITSELF; nothing asked what is
-		# at `handoffs`, `lanes`, `lanes/log` or `workspaces` — every directory
-		# component the ${#WIP_TEMPLATE_FILES[@]} template paths have. An
-		# adopted checkout can carry a TRACKED symlink at one of those: a person
-		# whose `handoffs` is a link into another tree of their own, committed,
-		# which step 6a sees as a clean worktree because it IS what HEAD says.
-		# Every test the branches below make then answers as though nothing were
-		# at `$rel` at all — `[ -e ]` and `[ -L ]` are false when the link's
-		# target holds no such file, and git has no notion of a path INSIDE a
-		# tracked symlink, so `:$rel`, `HEAD:$rel` and `ls-files -u` are false
-		# too — and the MISSING branch is reached: its `mkdir -p` succeeds
-		# without creating anything, because the link resolves to a directory
-		# that is already there, and its `cp` then writes this run's template
-		# bytes through the link, OUTSIDE this checkout if that is where the
-		# link leads. Only the `git add` two steps later notices, with
-		# `fatal: … is beyond a symbolic link` — after the bytes have landed
-		# somewhere this command was never pointed at.
-		#
-		# AND AN ANCESTOR THAT IS NOT A DIRECTORY AT ALL IS REFUSED IN THE SAME
-		# WALK, because the same MISSING branch meets it one line earlier: a
-		# regular file committed at `handoffs` fails that `mkdir -p`, and a
-		# failing `mkdir` under this file's `set -e` exits 1 — the code this
-		# toolset spends on "findings were printed" — from a run that meant to
-		# refuse with 2 and never printed a word about why.
-		#
-		# `unusable_dir_kind` IS NOT THIS QUESTION, which is why this walk is
-		# written rather than that one called: it climbs UP to the nearest
-		# ancestor that EXISTS and asks whether a file can be created there, so
-		# a symlink to a directory that is really there answers it `-d`, `-w`
-		# and `-x` — usable — and it never looks at the components below. This
-		# walk goes DOWN the exact relative path and asks what each component
-		# IS.
-		ancestor=""
-		rest=""
-		case "$rel" in */*) rest="${rel%/*}" ;; esac
-		while [ -n "$rest" ]; do
-			case "$rest" in
-			*/*) comp="${rest%%/*}"; rest="${rest#*/}" ;;
-			*) comp="$rest"; rest="" ;;
-			esac
-			ancestor="${ancestor:+$ancestor/}$comp"
-			if [ -L "$checkout/$ancestor" ]; then
-				die "$checkout/$ancestor is $(path_kind "$checkout/$ancestor"), and the template's
-    $rel sits under it — so a \`mkdir -p\` there creates nothing and the \`cp\` that follows
-    writes this run's template bytes through that link, outside this checkout if that is
-    where it leads. A seed commit is the template's own bytes at a REGULAR FILE inside this
-    checkout, and nothing else there could be. Nothing beyond this run's own template bytes was
-    written into that checkout, and nothing was staged.
-    Replace that component with a real directory, then re-run:
-        openRepoTools wip init"
-			fi
-			if [ -e "$checkout/$ancestor" ] && [ ! -d "$checkout/$ancestor" ]; then
-				die "$checkout/$ancestor is not a directory, and the template's $rel sits under it —
-    so this run can neither create that directory nor write the file inside it. Nothing beyond
-    this run's own template bytes was written into that checkout, and nothing was staged.
-    Replace that component with a real directory, then re-run:
-        openRepoTools wip init"
-			fi
-			# AND A DIRECTORY THAT IS ANOTHER REPOSITORY'S IS NOT THIS ONE'S TO
-			# WRITE IN (#101 round 2, on this walk's own diff). A tracked
-			# SUBMODULE at `handoffs` is a gitlink in this repository and a
-			# whole repository on disk: `-d` is true, `-L` is false, step 6a
-			# sees a CLEAN worktree because a clean submodule reports nothing,
-			# and every presence test below answers false because a gitlink
-			# carries no `handoffs/README.md` for `:$rel` or `HEAD:$rel` to
-			# find. So the MISSING branch wrote this run's template bytes
-			# INSIDE somebody's nested repository, and the `git add` two steps
-			# later answered `fatal: Pathspec … is in submodule …` — after the
-			# bytes had landed there, in a repository this command has no
-			# business in and does not clean up.
-			#
-			# ASKED OF THE INDEX, because that is what makes it a submodule and
-			# it is true whether or not the thing is checked out: a `deinit`ed
-			# submodule is an EMPTY directory with no `.git` in it at all, and
-			# the `git add` fails exactly the same way. `$4` is the path column
-			# of `ls-files -s` and every component here comes from
-			# `$WIP_TEMPLATE_FILES`, which is nine fixed ASCII paths, so it is
-			# never a quoted or split field. The `.git` test beside it catches
-			# the other shape — a nested repository nobody tracked, which an
-			# ignore rule can hide from step 6a as well.
-			ancestor_mode="$(git -C "$checkout" ls-files -s -- "$ancestor" 2>/dev/null |
-				awk -v p="$ancestor" '$4 == p { print $1; exit }' || :)"
-			if [ "$ancestor_mode" = "160000" ] || [ -e "$checkout/$ancestor/.git" ]; then
-				die "$checkout/$ancestor is another git repository's working tree — a submodule of this
-    one, or a clone somebody left there — and the template's $rel sits under it. A seed commit
-    is this repository's own files: bytes written in there belong to that repository, this one
-    cannot stage them (\`git add\` answers \`Pathspec … is in submodule …\`), and this command
-    does not write into a repository it was never pointed at. Nothing beyond this run's own
-    template bytes was written into that checkout, and nothing was staged.
-    Move that repository aside, or seed a workspace that does not carry one at $ancestor, then
-    re-run:
-        openRepoTools wip init"
-			fi
-		done
-		if [ -e "$checkout/$rel" ] || [ -L "$checkout/$rel" ] ||
-			git -C "$checkout" cat-file -e ":$rel" 2>/dev/null ||
-			git -C "$checkout" cat-file -e "HEAD:$rel" 2>/dev/null ||
-			[ -n "$(git -C "$checkout" ls-files -u -- "$rel" 2>/dev/null)" ]
-		then
-			# ALREADY THERE, OR AS GOOD AS — AND THE SEED CAN STILL OWE IT. A template path the
-			# WORKTREE carries and HEAD does not is what an earlier run of this
-			# command leaves behind when it copied the template and could not
-			# commit it: no `user.email`, the case the refusal below is written
-			# about. Step 8 has to carry those, or the re-run this step promises
-			# commits nothing, pushes nothing, and writes the pointer file over
-			# an EMPTY main — the one state no later run can dig out of.
-			#
-			# A TEMPLATE PATH HEAD ALREADY CARRIES IS THE PERSON'S, whatever it
-			# says now: this command has never modified a committed file, so a
-			# change at one is not its leftover and never enters its commit
-			# (#44 round 1, `openRepoTools:1525`).
-			#
-			# `! cat-file -e HEAD:…` ALONE IS NOT PROOF (#44 round 2,
-			# `openRepoTools:1621`): a template path that is UNTRACKED and
-			# carries a PERSON'S OWN CONTENT is absent from HEAD exactly as
-			# this command's own leftover is, so it answered this question the
-			# same way and went into the seed regardless of whose bytes they
-			# were. The bytes settle what the question alone could not: this
-			# command's own leftover is what THIS RUN would itself write
-			# there, so the template is fetched and substituted the same way
-			# a MISSING file below is, and the two are compared before either
-			# is trusted as this command's own.
-			#
-			# THE WORKTREE TEST ALONE MISSES FOUR MORE SHAPES (#44 round 3,
-			# `openRepoTools:1613`/`:1615`/`:1699`): a DANGLING symlink answers
-			# `[ -e ]` false exactly as nothing-there-at-all does, so without
-			# the `-L` above the MISSING branch below would meet it at `cp` and
-			# follow it — writing this run's bytes wherever it points, inside
-			# this checkout or far outside it; a person's own `git add` of a
-			# template path, followed by removing the worktree file, leaves
-			# the INDEX carrying something the worktree no longer does, which
-			# the same MISSING branch would silently overwrite at `cp` and
-			# step 8 would then stage over; a `git rm` of a path HEAD already
-			# carries — staged, worktree gone, index gone too — passes none of
-			# the first three tests either, so without asking `HEAD` directly
-			# here the same MISSING branch would put the file straight back,
-			# undoing a deletion this command has never modified a committed
-			# file to make; and an UNRESOLVED MERGE CONFLICT can leave a path
-			# at stages 1-3 with no stage 0, no worktree file and no `HEAD`
-			# entry at all — invisible to all four other tests — so it is
-			# asked for directly too. All four are asked for here instead,
-			# beside the worktree.
-			if ! git -C "$checkout" cat-file -e "HEAD:$rel" 2>/dev/null; then
-				# THE SAME QUESTION `unplaceable_kind` ASKS OF AN INSTALL TARGET,
-				# asked of an owed candidate: a SYMLINK is never this command's
-				# own, dangling or not, because `cmp` reads through a live one to
-				# whatever it names — so one whose target happens to hold the
-				# template's own bytes would pass the comparison below, and a
-				# `git add` of it stages the LINK ITSELF, not the bytes at its far
-				# end — and a FIFO, a socket or a device node is worse: `cmp`
-				# opens it and can block waiting for a writer, or read whatever a
-				# device answers, rather than refusing. `path_kind` already
-				# answers all three the same way `--install`'s own planners rely
-				# on; this command has placed none of them at a template path, so
-				# any of them here is refused before either branch can act on it,
-				# open it, or write through it.
-				if kind="$(path_kind "$checkout/$rel")"; then
-					die "$checkout/$rel is $kind, and a seed commit is the template's own bytes
-    at a REGULAR FILE and nothing else there could be. Nothing beyond this run's own
-    template bytes was written into that checkout, and nothing was staged.
-    Remove or replace that path, then re-run:
-        openRepoTools wip init"
-				fi
-				# AN UNRESOLVED MERGE CONFLICT'S STAGES ARE INVISIBLE TO A
-				# STAGE-0 QUESTION: `:$rel` reads stage 0 alone, so a path with
-				# only stages 1-3 (added differently on both sides of a merge,
-				# say) answers `cat-file -e ":$rel"` false exactly as an empty
-				# index does, and step 6a's own exclusion of template paths
-				# means no earlier gate has seen it either. This command has
-				# never resolved anybody's merge, so a conflict here is refused
-				# rather than silently settled by whichever branch the
-				# worktree's own state happens to satisfy.
-				if [ -n "$(git -C "$checkout" ls-files -u -- "$rel" 2>/dev/null)" ]; then
-					die "$checkout has an unresolved merge conflict at $rel, and HEAD does not
-    carry $rel either, so this command cannot tell which side, if either, is its own
-    template substitution. This command has never resolved anybody's merge. Nothing beyond
-    this run's own template bytes was written into that checkout, and nothing was staged.
-    Resolve that conflict, then re-run:
-        openRepoTools wip init"
-				fi
-				# AND THE INDEX CAN OWE SOMETHING THE WORKTREE NO LONGER HAS AT ALL:
-				# this command has never staged a path and then removed its own file
-				# from under it, so an index entry with nothing on disk behind it is
-				# somebody else's, whatever it holds.
-				if [ ! -e "$checkout/$rel" ]; then
-					die "$checkout/$rel does not exist, HEAD does not carry $rel, and something is
-    staged there anyway — so this is somebody's own staged addition, removed from the
-    worktree after being added, and not this command's to overwrite or commit over. Nothing
-    beyond this run's own template bytes was written into that checkout, and nothing
-    already staged was changed.
-    Commit, stash or unstage that path, then re-run:
-        openRepoTools wip init"
-				fi
-				# AND THE WORKTREE CARRIES A MODE OF ITS OWN, which is the half
-				# the index question below cannot see (#101 round 1, on the #63
-				# fix's own diff). Step 8 stages from the WORKTREE, so an owed
-				# candidate whose file is EXECUTABLE goes into the seed commit
-				# as `100755` — and it reaches here two ways the stage-0
-				# question never asks about: an UNTRACKED template path whose
-				# bytes match and whose file somebody chmod'ed, and a path
-				# staged `100644` whose worktree file got the bit afterwards.
-				# This command copies the template's own bytes from a 0644 file
-				# and has never chmod'ed anything it wrote, so an executable
-				# file at a template path is not its leftover whatever its
-				# bytes say — it is somebody's own, and this branch's answer to
-				# that is a refusal.
-				#
-				# ASKED ONLY WHERE GIT WOULD RECORD IT. On a filesystem that
-				# reports every file executable, `git clone` sets
-				# `core.fileMode=false` and git stages `100644` regardless; a
-				# refusal there would refuse every re-run on that mount over a
-				# bit that means nothing, so the config that decides it is
-				# asked. Unset is TRUE — the read answers 1 and nothing, which
-				# is not `false`, so the refusal stands: an answer this command
-				# could not get is never permission to publish a mode. `--bool`
-				# because git's own spelling of false is `false`, `no`, `off` or
-				# `0` and this compares one string.
-				if [ -x "$checkout/$rel" ] &&
-					[ "$(git -C "$checkout" config --bool --get core.fileMode 2>/dev/null || :)" != "false" ]
-				then
-					die "$checkout/$rel is executable, and every file in $SHAPE_REPOSITORY's
-    $WIP_TEMPLATE_DIR is a plain 100644 — this command copies the template's own bytes from a
-    0644 file and has never chmod'ed anything it wrote, so an executable file at a template
-    path is somebody's own, whatever its bytes say. Staging it would record 100755 in the seed
-    commit and push that to $target's main. Nothing beyond this run's own template bytes was
-    written into that checkout, and nothing was staged.
-    \`chmod 644\` that path, or commit, stash or remove it, then re-run:
-        openRepoTools wip init"
-				fi
-				# AND WHAT IS STAGED IS A MODE AS WELL AS A BLOB (#63). The
-				# index comparison this branch makes below is
-				# `cat-file -p ":$rel"`, which prints a blob's BYTES and never
-				# its mode — so a template path a person staged with
-				# `git add --chmod=+x`, byte-identical to the template and
-				# executable, passed it as "the index carries the template", and
-				# step 8's `git add` then restaged that path from the worktree
-				# at the worktree's own mode: their `100755` silently replaced
-				# by `100644` and committed. Every file in $SHAPE_REPOSITORY's
-				# $WIP_TEMPLATE_DIR is a plain `100644`, and this command has
-				# never chmod'ed anything it wrote, so a stage-0 entry at any
-				# other mode is NOT an earlier run's leftover whatever its bytes
-				# say — it is somebody's own, which in this branch is the same
-				# refusal the bytes themselves get below and not a thing to
-				# stage over. Asked BEFORE the fetch, with the branch's other
-				# local questions: the answer does not depend on the template's
-				# bytes, and a machine that cannot reach the network deserves
-				# the refusal that names the real reason rather than one about
-				# a fetch.
-				# AND THE INDEX IS ASKED OF THE INDEX (#101 round 3, on this
-				# guard's own diff). `cat-file -e ":$rel"` answers false in TWO
-				# states — no stage-0 entry at all, and an entry whose BLOB the
-				# object store has lost — because it resolves the name through
-				# the index and then looks the OBJECT up. Gating on it spent the
-				# second state as though it were the first: the mode guard was
-				# skipped, the comparison below took its "no entry" arm, a
-				# worktree that reads back as the template was accepted, and
-				# step 8's `add` replaced what the person had staged with this
-				# run's copy — measured, the staged sha changes and the `add`
-				# reports nothing. `ls-files -s` reads the index and never the
-				# object store, so presence is ITS answer now; a read that FAILS
-				# is a refusal rather than an empty index, which is #49's own
-				# lesson one question over; and an entry whose blob cannot be
-				# read gets its own refusal, because an entry this command
-				# cannot READ is not one it may stage over. `$3` is the stage
-				# column and `$4` the path — every path here comes from
-				# `$WIP_TEMPLATE_FILES`, nine fixed ASCII paths.
-				if staged_entry="$(git -C "$checkout" ls-files -s -- "$rel" 2>/dev/null)"; then
-					staged_mode="$(printf '%s\n' "$staged_entry" |
-						awk -v p="$rel" '$3 == "0" && $4 == p { print $1; exit }')"
-				else
-					die "could not read what $checkout has staged at $rel, so this run cannot tell whether
-    anything is staged there at all — and an index this command could not read is never an
-    empty one. Nothing beyond this run's own template bytes was written into that checkout,
-    and nothing already staged was changed.
-    Check that checkout (\`git status\`), then re-run:
-        openRepoTools wip init"
-				fi
-				if [ -n "$staged_mode" ]; then
-					git -C "$checkout" cat-file -e ":$rel" 2>/dev/null ||
-						die "$checkout has $rel staged and this command cannot read what is staged there: the
-    index carries an entry and git's object store has no blob behind it. An entry this command
-    cannot READ is not one it may stage over — step 8's \`git add\` would replace it with this
-    run's copy, silently, and commit that. Nothing beyond this run's own template bytes was
-    written into that checkout, and nothing already staged was changed.
-    Repair that object (\`git fsck\`), or commit, stash or unstage that path, then re-run:
-        openRepoTools wip init"
-					[ "$staged_mode" = "100644" ] ||
-						die "$checkout has $rel staged with mode $staged_mode, and every file in
-    $SHAPE_REPOSITORY's $WIP_TEMPLATE_DIR is a plain 100644 — this command has never chmod'ed
-    anything it wrote, so a mode of its own at that path is somebody's own \`git add\`, not an
-    earlier run's leftover, whatever the staged bytes say. Staging this run's copy over it would
-    replace that mode with the worktree's and commit the change. Nothing beyond this run's own
-    template bytes was written into that checkout, and nothing already staged was changed.
-    Commit, stash or unstage that path, then re-run:
-        openRepoTools wip init"
-				fi
-				wip_fetch_template_file "$rel" "$dest" "$ref" ||
-					die "could not fetch $WIP_TEMPLATE_DIR/$rel from $SHAPE_REPOSITORY at $ref, so $rel
-    itself was NOT seeded. Nothing beyond an earlier template path's own bytes in
-    this same run, if it reached one before this fetch, was written into that
-    checkout, and nothing was staged; a re-run picks up from here. Both ways were tried:
-    gh api repos/$SHAPE_REPOSITORY/contents/$WIP_TEMPLATE_DIR/$rel?ref=$ref
-    curl -fsSL https://raw.githubusercontent.com/$SHAPE_REPOSITORY/$ref/$WIP_TEMPLATE_DIR/$rel"
-				wip_substitute "$dest"
-				# THE WORKTREE IS NOT THE ONLY PLACE THOSE BYTES CAN LIE EITHER (#44
-				# round 3, `openRepoTools:1647`): HEAD lacking `$rel` says nothing
-				# about the INDEX, so a person's own edit `git add`ed at this path
-				# — staged before this run and never committed — sits exactly
-				# where step 8's `add` would overwrite it, and a worktree that
-				# happens to read back as the template is not permission to stage
-				# over what is already staged there. The index is asked the same
-				# question the worktree already answers: no entry is this
-				# command's own leftover exactly as no file is, and an entry
-				# whose bytes are not the template fails it exactly as the
-				# worktree's would.
-				if cmp -s -- "$dest" "$checkout/$rel" &&
-					{ [ -z "$staged_mode" ] ||
-					git -C "$checkout" cat-file -p ":$rel" 2>/dev/null |
-						cmp -s -- "$dest" -; }
-				then
-					written+=("$rel")
-					owed=$((owed + 1))
-				else
-					die "$checkout/$rel exists, HEAD does not carry it, and its worktree bytes, its staged
-    bytes, or both are not what $SHAPE_REPOSITORY's $WIP_TEMPLATE_DIR/$rel substitutes to at
-    $ref — so this is not an earlier run's own leftover; it is somebody's own file, staged or
-    not, at a path the template also names. A seed commit is the template and nothing else, and
-    this command will not publish it or stage over what is already staged there. Nothing beyond
-    this run's own template bytes was written into that checkout, and nothing was staged.
-    Commit, stash or remove that path, then re-run:
-        openRepoTools wip init"
-				fi
-			else
-				# ---- A PATH HEAD CARRIES THAT IS NOT ON DISK BECAUSE THE INDEX
-				# SAYS SO IS NAMED, NOT SEEDED AND NOT SILENTLY PASSED (#69).
-				#
-				# `skip-worktree` — which is also what `git sparse-checkout`
-				# sets — tells git not to compare the worktree at that path at
-				# all: HEAD carries it, the stage-0 entry carries it, `git
-				# status` is clean, and the file is nonetheless physically
-				# absent. That answers this branch's question exactly as a
-				# person's own deliberate `git rm` does, and the principle above
-				# still stands — a template path HEAD already carries is the
-				# person's, and this command has never modified a committed file
-				# — so it is still not seeded, not written into and not
-				# committed for. What it is not is INVISIBLE: the run would
-				# otherwise print "the workspace already carries every template
-				# file" and write the pointer file, while a file this command
-				# seeds and the lane tooling reads is not on disk. So it is
-				# counted and said, and the person decides.
-				#
-				# `ls-files -v`'s tag is `S` for skip-worktree and the LOWERCASE
-				# `s` where that entry is also assume-unchanged — `-v`'s
-				# lowercase means assume-unchanged, whatever the letter — and
-				# BOTH are this case. `h`, assume-unchanged ALONE, is not: that
-				# bit is a person telling git to stop stat-ing a path they own
-				# and keep on disk, not a checkout that never materialized one,
-				# and naming it "skip-worktree" would be false. An ordinary
-				# tracked path whose file a person simply deleted is `H`, which
-				# `git status` reports for itself.
-				if [ ! -e "$checkout/$rel" ] && [ ! -L "$checkout/$rel" ]; then
-					index_tag="$(git -C "$checkout" ls-files -v -- "$rel" 2>/dev/null |
-						awk 'NR == 1 { print $1 }' || :)"
-					case "$index_tag" in
-					S | s)
-						sparse=$((sparse + 1))
-						sparse_paths+=("$rel")
-						;;
-					esac
-				fi
-			fi
-			continue
-		fi
-		wip_fetch_template_file "$rel" "$dest" "$ref" ||
-			die "could not fetch $WIP_TEMPLATE_DIR/$rel from $SHAPE_REPOSITORY at $ref, so $rel
-    itself was NOT seeded. Nothing beyond an earlier template path's own bytes in
-    this same run, if it reached one before this fetch, was written into that
-    checkout, and nothing was staged; a re-run picks up from here. Both ways were tried:
-    gh api repos/$SHAPE_REPOSITORY/contents/$WIP_TEMPLATE_DIR/$rel?ref=$ref
-    curl -fsSL https://raw.githubusercontent.com/$SHAPE_REPOSITORY/$ref/$WIP_TEMPLATE_DIR/$rel"
-		wip_substitute "$dest"
-		mkdir -p -- "$checkout/$(dirname -- "$rel")"
-		cp -- "$dest" "$checkout/$rel"
-		written+=("$rel")
-		seeded=$((seeded + 1))
-	done
-	if [ "$seeded" -gt 0 ]; then
-		say "  seeded $seeded of ${#WIP_TEMPLATE_FILES[@]} template files from $SHAPE_REPOSITORY @ $ref"
-	else
-		say "  the workspace already carries every template file; none was replaced"
-	fi
-	# THE ONE LINE #69 IS FOR, and the whole of what this command does about it.
-	if [ "$sparse" -gt 0 ]; then
-		for rel in "${sparse_paths[@]}"; do
-			say "  $rel: HEAD carries it, the index marks it skip-worktree, and it is not on disk"
-		done
-		say "      (a sparse checkout leaves a tracked path there and off the disk; nothing"
-		say "       was written or committed at it. \`git update-index --no-skip-worktree --\`"
-		say "       that path, or \`git sparse-checkout\`, is what brings it back.)"
-	fi
-
-	# ---- step 8: COMMIT AND PUSH — AND THAT PUSH IS THE RULESET PROBE.
-	# A newly created repository is not excluded from the organisation's PR-only
-	# ruleset until an administrator excludes it, and until it is, every register
-	# write will be refused by the gate. So this push is not only the seed
-	# landing; it is the verification (Addendum 1(2)).
-	#
-	# EACH PATH BY NAME, NEVER `git add -A -- .` (#40, finding 1). Step 6a means
-	# there is nothing unrelated left in the worktree for a `-A` to sweep up —
-	# and this means that a path step 6a could not see as unrelated, because the
-	# template names it and a person had edited it, is still not published by a
-	# command that came to place a template. Two answers to one finding, and the
-	# cheaper one is the one that runs first.
-	if [ "$((seeded + owed))" -gt 0 ]; then
-		wip_quietly git -C "$checkout" add -- "${written[@]}" ||
-			die "could not stage the seed in $checkout.
-    What it said:
-$WIP_LAST_ERR"
-	fi
-	# AND THE COMMIT IS THOSE PATHS AND NO OTHERS (#44 round 1,
-	# `openRepoTools:1525`). `git commit` with no pathspec commits THE INDEX, so
-	# a person's own `git add` of a file step 6a is deliberately blind to — a
-	# TEMPLATE path they had edited — rode into the seed commit and out to
-	# `main` on the push below, which is the finding this round was opened for
-	# one layer down. The pathspec commits the worktree at those paths and
-	# leaves every other staged change exactly where the person left it: staged,
-	# uncommitted, unpushed.
-	#
-	# THE `diff --cached` ASKS ABOUT THE SAME PATHS, because after an `add` of
-	# paths that are already in HEAD there can be nothing to commit at all — a
-	# checkout that had a template file DELETED gets it back from the template
-	# above, and where those bytes match HEAD `git commit` refuses with one.
-	if [ "$((seeded + owed))" -gt 0 ] &&
-		! git -C "$checkout" diff --cached --quiet -- "${written[@]}" 2>/dev/null; then
-		wip_quietly git -C "$checkout" commit -q \
-			-m "Seed this workspace repository from $SHAPE_REPOSITORY $WIP_TEMPLATE_DIR
-
-Written by \`openRepoTools wip init\` (lane-collision-protocol Amendment 9(c)).
-It holds data only: the register, the object logs, the handoffs and the
-workspace manifests. The lane tooling is installed from opensoft/openRepoTools." \
-			-- "${written[@]}" ||
-			die "could not commit the seed in $checkout. A machine with no
-    \`user.email\` configured is the usual reason, and git says so itself:
-$WIP_LAST_ERR"
-		say "  committed the seed in $checkout"
-	fi
-
-	# THE PUSH IS GATED ON THE REMOTE, NOT ON THE WORKTREE, and that is the
-	# whole of what makes the re-run this step promises actually work. A first
-	# run whose push the ruleset rejected leaves a CLEAN worktree and an
-	# unpushed commit — so a `status --porcelain` gate would report "already
-	# carries the seed", write the pointer file and exit 0 over an empty
-	# `main`, and step 1's file test would then return on every later run.
-	# That is the failure step 8 exists to prevent, met one step further on.
-	#
-	# AND THE REMOTE IS THE ONE STEP 6a ASKED (#64). `remote_head` is that one
-	# `ls-remote`'s answer, so the commits 6a checked against `main` and the
-	# push decided here are a single reading of it, never two. Where 6a could
-	# not ask, `remote_head` is empty and the push below runs: the push IS the
-	# probe, and a question we could not put to the remote is not an answer
-	# from it.
-	local local_head
-	local_head="$(git -C "$checkout" rev-parse HEAD 2>/dev/null || :)"
-	if [ -z "$local_head" ]; then
-		say "  $checkout has no commit to push"
-	elif [ -n "$remote_head" ] && [ "$local_head" = "$remote_head" ]; then
-		say "  $target main already carries this commit ($(printf '%.7s' "$local_head"))"
-	elif ! git -C "$checkout" push -q origin HEAD:main >/dev/null 2>&1; then
-		die "the seed commit could not be pushed to $target's main.
-    THAT IS THE RULESET, and it is the thing this push exists to find out: the
-    organisation's PR-only ruleset refuses a direct commit, and Rule 9's one commit
-    per write cannot land through a PR gate — so the register would be unwritable.
-    An administrator excludes $target from it:
-        gh api /orgs/$WIP_ORG/rulesets
-    then adds $target to the PR-only ruleset's exempt repositories.
-    The clone and the seed commit are left exactly where they are, so a re-run after
-    that has only to push:
-        openRepoTools wip init"
-	else
-		say "  pushed the seed to $target main (which is also the ruleset probe)"
-	fi
-
-	# ---- step 9: WRITE THE POINTER FILE. The SECOND thing in this toolset that
-	# writes a file outside a repository, after `resume --workspace`, for the
-	# same reason and under the same condition: only on a machine that has none,
-	# and only because the person asked for the repository by running this. It
-	# never overwrites one — step 1 already returned where one existed.
-	local written="$checkout"
-	case "$checkout" in "$HOME"/*) written="~${checkout#"$HOME"}" ;; esac
-	mkdir -p -- "$(dirname -- "$config")" ||
-		die "could not create $(dirname -- "$config") for the pointer file.
-    The repository is created, cloned, seeded and pushed; only this file is
-    missing, and a re-run writes it."
-	[ ! -e "$config" ] ||
-		die "$config appeared while this ran; it was not overwritten."
-	# GUARDED, because this command's exit codes are 0 and 2 and nothing else:
-	# an unguarded redirect fails under `set -e` with the shell's own status 1,
-	# which is the code this toolset reserves for "findings were printed". A
-	# refusal that reads as a report is the defect openRepoTools' own convention
-	# exists to prevent (`status:3076-3078`).
-	printf 'repository: %s\npath: %s\n' "$target" "$written" >"$config" ||
-		die "could not write $config. The repository is created, cloned, seeded and
-    pushed; only this file is missing, and a re-run writes it."
-	say "  wrote $config"
-	say "        repository: $target"
-	say "        path: $written"
-
-	# ---- step 10: LINK-ESTATES, which places the symlinks and reports the ones
-	# it skipped — and then THE HOOK PAIR (#237), which `--install` deferred on a
-	# workstation that had no link yet for its two entries to call.
-	wip_run_link_estates
-	wip_hook_pair
-
-	# ---- step 11: THE NEXT STEP, which is one line. `<profile>` is the one
-	# value a person supplies and the one this command cannot derive: it is not
-	# a function of the workspace repository.
-	say ""
-	say "Done. The next step is one line:"
-	if command -v lclaude >/dev/null 2>&1; then
-		say "    lclaude --lane <repo>-<n> <profile>"
-	else
-		say "    pclaude --lane <repo>-<n> <profile>"
-	fi
-	say ""
-	say "  <profile>   \`pclaude list\` names them"
-	say "  <repo>-<n>  the lane naming rule: the repository the lane is homed on,"
-	say "              and its position — openRepoProject-1, workBenches-2"
-	return 0
-}
-
-# `wip <verb>` — one noun, one verb, and a refusal that names the one there is.
-wip_dispatch() {
-	local verb="${1-}"
-	shift || :
-	case "$verb" in
-	init) ;;
-	'') die "\`wip\` takes one verb and it is \`init\`:
-        openRepoTools wip init [--org <org>] [--login <name>] [--team <team>] [--dry-run]" ;;
-	*) die "\`wip $verb\` is not a thing this command does. The one verb is \`init\`:
-        openRepoTools wip init" ;;
-	esac
-	while [ $# -gt 0 ]; do
-		case "$1" in
-		--org) shift; [ $# -gt 0 ] || die "--org needs a value"; WIP_ORG="$1"; shift ;;
-		--login) shift; [ $# -gt 0 ] || die "--login needs a value"; WIP_LOGIN="$(printf '%s' "$1" | tr '[:upper:]' '[:lower:]')"; shift ;;
-		--team) shift; [ $# -gt 0 ] || die "--team needs a value"; WIP_TEAM="$1"; shift ;;
-		--dry-run) WIP_DRY_RUN=1; shift ;;
-		*) die "\`wip init\` takes --org, --login, --team and --dry-run, and nothing else.
-    It got '$1'." ;;
-		esac
-	done
-	if [ -n "$WIP_LOGIN" ] && ! wip_login_is_compliant "$WIP_LOGIN"; then
-		die "--login '$WIP_LOGIN' cannot form a compliant \`<user>-wip\` name: openRepoShape's
-    naming contract requires \`^[a-z0-9]+(-[a-z0-9]+)*-wip\$\`. Nothing was created."
-	fi
-	wip_init
-}
-
-# --- package mode -----------------------------------------------------------
-#
-# A PACKAGE READS ITS OWN STAMP BEFORE IT ACTS ON ANY ARGUMENT (#228, FR-012,
-# design.md Decision 4). So a broken one refuses every invocation, `--help`,
-# `--version`, `--install`, `wip` and none at all alike, and a build that
-# cannot name its release places nothing. Package mode is decided from this
-# file's own path (`package_payload_dir`), and the stamp is the file beside its
-# payload and nothing else: no environment variable names it, mends it or
-# stands in for it (FR-011, research R4). In a checkout or the one-line install
-# this sets nothing and reads nothing.
-package_init() {
-	local here=""
-	here="$(package_payload_dir)" || return 0
-	PACKAGE_DIR="$here"
-	stamp_read "${here%/*}/_release.py" ||
-		die "this package's stamp (openrepotools/_release.py) $STAMP_WHY, so this build is broken and nothing ran. A package's stamp is a release's whole stamp or the unstamped one. Reinstall it: pipx reinstall openrepotools"
-}
-
-# `--version` IN PACKAGE MODE names the release this command IS, from the stamp
-# `package_init` read: never the release of the files `--install` placed, and
-# never the source a fetch would read (contracts/cli-output.md, FR-014).
-package_version() {
-	if [ "$STAMP_STATE" = stamped ]; then
-		say "openRepoTools $STAMP_VERSION ($STAMP_REPOSITORY @ $STAMP_COMMIT)"
-		say "  version   $STAMP_VERSION"
-		say "  tag       $STAMP_TAG"
-		say "  commit    $STAMP_COMMIT"
-		say "  digest    $STAMP_DIGEST (sorted-ls-tree-r-v1)"
-	else
-		say "openRepoTools 0.0.0 (an unstamped package)"
-		say "  version   0.0.0, unstamped: a package built from a checkout, not a release"
-		say "  tag       none"
-		say "  commit    none"
-		say "  digest    none"
-	fi
-}
-
-# ONCE, AFTER EVERY FUNCTION IS DEFINED AND BEFORE THE FIRST ARGUMENT IS READ.
-package_init
-
-# --- arguments ------------------------------------------------------------
-#
-# THREE FLAGS AND ONE VERB PAIR, and no others. The refusal names the commands
-# rather than repeating the usage: somebody typing `openRepoTools park` wants
-# `park`, and the shortest true answer is where it is.
-#
-# `wip` CONSUMES THE REST OF THE LINE, because `wip init --org x` is one
-# command with its own options and not four arguments to this one.
-while [ $# -gt 0 ]; do
-	case "$1" in
-	-h | --help) usage; exit 0 ;;
-	--version)
-		# A PACKAGE NAMES ITS RELEASE. A checkout and the one-line install name
-		# the repository and the ref they fetch from, as they always have.
-		if [ -n "$PACKAGE_DIR" ]; then package_version; else say "openRepoTools ($REPO @ $REF)"; fi
-		exit 0 ;;
-	--install) MODE="install"; shift ;;
-	wip) shift; wip_dispatch "$@"; exit $? ;;
-	*)
-		die "openRepoTools installs the estate commands and creates the workspace they read.
-    It takes --install, \`wip init\`, --help or --version. The commands themselves:
-    \`park --help\`, \`resume --help\`, \`status --help\`."
-		;;
-	esac
-done
-
-if [ "$MODE" = "install" ]; then
-	install_commands
-	exit 0
+        $WHY
+    This is the assembly's front door. A single repository is installed by its own
+    root openRepoTools: gh api repos/$REPO/contents/openRepoTools?ref=$REF ..."
+	pin_parse "$TMP/pin" || die "$PIN_FILE in $REPO at $sha ($REF) is not a code pin this can
+    follow: $PIN_WHY. A pin that is present and wrong is refused rather than read
+    around; nothing ran."
+	# THE LOCKSTEP RULE, BEFORE ANYTHING IS FETCHED TO RUN: the gitlink at the
+	# pinned path in this same commit names the pinned commit, or nothing runs.
+	gitlink_at "$sha" "$PIN_SUBMODULE_PATH" || die "could not list $REPO at $sha ($REF), so the gitlink its $PIN_FILE
+    must agree with cannot be read, and nothing ran. What answered:
+        $WHY"
+	[ "$GITLINK" = "$PIN_COMMIT" ] || die "$REPO at $sha ($REF) records ${GITLINK:-no gitlink} at $PIN_SUBMODULE_PATH and
+    its $PIN_FILE says $PIN_COMMIT. The gitlink and the pin move in ONE commit
+    (the lockstep rule), so this assembly does not say which code it means, and
+    nothing ran."
+	fetch_at "$PIN_SOURCE_REPOSITORY" "$PIN_COMMIT" openRepoTools "$TMP/impl" ||
+		die "could not fetch openRepoTools from $PIN_SOURCE_REPOSITORY at $PIN_COMMIT, the
+    implementation $REPO at $sha ($REF) pins, so nothing ran. What answered:
+        $WHY"
+	case "$(head -n 1 "$TMP/impl")" in
+	'#!'*) ;;
+	*) die "what came back for openRepoTools from $PIN_SOURCE_REPOSITORY at $PIN_COMMIT is not a
+    script, so nothing ran." ;;
+	esac
+	impl="$(cat "$TMP/impl")"
+	rm -rf -- "$TMP"
+	trap - EXIT
+	# THE REF THE IMPLEMENTATION RESOLVES IS THE COMMIT THIS ONE READ, so the
+	# pin it reads is this pin; it runs from stdin, as the one-liners run it.
+	OPENREPOTOOLS_REPO="$REPO"
+	OPENREPOTOOLS_REF="$sha"
+	export OPENREPOTOOLS_REPO OPENREPOTOOLS_REF
+	exec bash -s -- ${1+"$@"} <<<"$impl"
+}
+
+if [ -f "$SELF" ] && [ -f "$(cd -- "$(dirname -- "$SELF")" && pwd)/$PIN_FILE" ]; then
+	delegate_local "$(cd -- "$(dirname -- "$SELF")" && pwd)" ${1+"$@"}
 fi
-
-# NO ARGUMENT AT ALL is the usage, on stdout and exit 0: a person who typed the
-# name to see what it is has asked a question, not made a mistake.
-usage
-exit 0
+delegate_remote ${1+"$@"}
diff --git a/openspec/changes/add-crash-consistent-lane-worktree-recovery/.openspec.yaml b/openspec/changes/add-crash-consistent-lane-worktree-recovery/.openspec.yaml
deleted file mode 100644
index 96db9a43..00000000
--- a/openspec/changes/add-crash-consistent-lane-worktree-recovery/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-09-15
diff --git a/openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md b/openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md
deleted file mode 100644
index 1536c52d..00000000
--- a/openspec/changes/add-crash-consistent-lane-worktree-recovery/design.md
+++ /dev/null
@@ -1,574 +0,0 @@
-## Context
-
-Lane identity is stable across Claude profile rotation, but the process running a lane has one checkout directory while its writers may occupy several linked Git worktrees. Current records can resume a transcript and, for newer lanes, recover the coordinator directory. They do not provide a complete machine-readable worktree inventory or a crash-consistent distinction between token exhaustion before `/swap`, interruption during `/swap`, and a completed handoff.
-
-The existing systems retain separate authority:
-
-- the lane event log is append-only history and binding evidence;
-- the handoff is the human/agent resume narrative and current writer inventory;
-- Git and the filesystem are truth about surviving worktrees and unpublished work;
-- estate `park`, `status`, and `resume` own durable cross-workstation reconstruction;
-- openRepoShape/Speckit owns governed feature-worktree placement.
-
-The design must run in Bash 3.2 environments, avoid unguarded shared-register rewrites, preserve legacy lanes, and never delete, reset, or overwrite an unknown worktree.
-
-## Goals / Non-Goals
-
-**Goals:**
-
-- Make every worktree owned by a lane discoverable after its coordinator dies.
-- Distinguish `RUNNING`, `SWAPPING`, and `SWAPPED` across every token-exhaustion window.
-- Make swap completion and resume ownership atomic, exclusive, and generation-fenced.
-- Recalculate worktree and publication state before launching replacement writers.
-- Keep profile rotation independent from lane and worktree identity.
-- Reuse the estate reconstruction mechanism for work that was durably parked.
-
-**Non-Goals:**
-
-- Reconstructing uncommitted file contents after their directory is lost.
-- Automatically deleting unknown paths or stale worktree registrations.
-- Replacing the lane event log, handoff, or estate parked record.
-- Moving existing shape-governed feature worktrees merely to satisfy a lane-first visual layout.
-- Treating an absolute path or profile as stable lane identity.
-
-## Decisions
-
-### 1. Separate stable identity, coordinator checkout, and writer trees
-
-The stable lane record carries canonical lane name, `home owner/repo`, and estate. The workstation resolves those values to a canonical primary checkout. The coordinator SHALL launch from that base after migration to this capability; mutable feature work SHALL occur in writer worktrees.
-
-This makes the coordinator location derivable and prevents a profile rotation from silently selecting a feature checkout. Existing lanes that were deliberately launched from a worktree require explicit migration rather than automatic rebinding.
-
-Alternative considered: preserve arbitrary coordinator directories indefinitely. This retains flexibility but makes a feature path part of lane identity and prevents deterministic recovery when that worktree is removed.
-
-### 2. Use a lane control root with sidecars outside Git worktrees
-
-The shape-resolved worktree root gains a lane namespace conceptually equivalent to:
-
-```text
-<worktree-root>/.lanes/<canonical-lane>/
-├── lane-state.yaml
-└── trees/
-    └── <tree-id>.yaml
-```
-
-Each tree sidecar records repository identity, role, path relative to the resolved worktree root, branch or detached state, HEAD, upstream, writer agent/session, lifecycle state, and the last observed dirty and unpushed counts.
-
-The sidecar is an index: a governed Speckit worktree remains at its shape-prescribed feature-first path. A lane-specific scratch tree may use a lane-derived physical path only where that does not violate the owning repository's worktree contract.
-
-Sidecars do not live inside worktrees because orchestration metadata must not dirty a checkout or disappear with it.
-
-### 3. Pair an atomic current-state snapshot with append-only events
-
-`lane-state.yaml` is atomically replaced under the same lane lock used to authorize transitions. Every successful transition also appends an event to the existing lane history. The snapshot makes current-state reads cheap; the event log preserves provenance and explains how the snapshot arose.
-
-The state document carries `generation`, `operation_id`, owner transcript/session, agent, profile, binding, and update time. Finalization uses compare-and-swap semantics over state, generation, and operation ID.
-
-Alternative considered: derive everything from append-only events. That preserves one source but makes exclusive multi-step transitions and stale-finalizer rejection substantially harder for every reader.
-
-### 4. Make `/swap` a two-phase transition
-
-`/swap` performs these ordered acts:
-
-1. lock the lane and compare-and-swap `RUNNING` to `SWAPPING`, minting an operation ID and next generation;
-2. enumerate and snapshot every expected and discovered writer tree;
-3. poll live writers and require their existing commit/push or explicit unresolved-work outcome;
-4. refresh and commit the handoff, including the reconciled writer inventory;
-5. write the protocol's `PAUSED`/swap records;
-6. compare-and-swap the same operation from `SWAPPING` to `SWAPPED`.
-
-Any refusal, token exhaustion, or process death before step 6 leaves `SWAPPING`. The operation is not reported ready to swap until `SWAPPED` lands.
-
-An old finalizer whose generation or operation ID no longer matches is refused. This prevents a delayed `/swap` from overwriting a recovered or newly running generation.
-
-### 5. Let confirmed SessionStart own `RUNNING`
-
-Resume does not mark a lane running when the launcher is invoked. State remains `SWAPPED` while the process starts. The SessionStart path changes `SWAPPED` to `RUNNING` only after it confirms canonical lane, transcript/session, agent, directory, and exclusive binding.
-
-The first implementation does not persist `RESUMING`; an idempotent retry remains possible while state is `SWAPPED`. A future `RESUMING` state may be added if concurrent launch reservation cannot be expressed by the binding lock alone.
-
-### 6. Reconcile intent with evidence before resume
-
-Resume compares:
-
-- lane and tree sidecars;
-- the latest handoff inventory;
-- live holder/session evidence;
-- `git worktree list --porcelain` for every owning repository;
-- actual paths beneath the resolved worktree root;
-- current branch or detached HEAD, commit, upstream, dirty state, and unpushed commits.
-
-Stored Git values are prior observations, not truth. Unknown or inconsistent paths are reported and preserved. A matching live holder blocks a duplicate; an absent holder under `RUNNING` or `SWAPPING` creates a recovery-required result.
-
-### 7. Rebuild only through durable estate records
-
-A missing tree may be reconstructed only when the estate parked record and its normal `resume` command authorize it. Lane tooling does not hand-roll `git worktree add`, WIP commits, soft resets, or force operations. A missing tree that may have held uncommitted work is a possible-loss refusal.
-
-### 8. Treat profile as launch metadata only
-
-Profile remains selectable on every launch. It is stored for diagnostics and default relaunch behavior but does not participate in lane identity, worktree paths, or generation ownership. A profile change resumes the same lane and validated worktree inventory.
-
-## Decisions taken in implementation (opensoft/openRepoTools#91)
-
-The eight decisions above were written before the openRepoTools lane tooling was
-read against them. Each of the following records where the implementation
-DEVIATES from one of them, and why; none of them is a silent departure, and
-every one names the ratified rule or the AGENTS.md ruling it answers to.
-
-### 9. `RUNNING` is written by the confirming act, not by the SessionStart hook
-
-Decision 5 gives `RUNNING` to "the SessionStart path". In this estate that path
-is `lanes-edit.sh session-start`, whose three properties are ratified and
-load-bearing: **it never writes, it never touches the network, and it always
-exits 0** (lane-collision-protocol Amendment 8, `R-A8-1`) — which is what makes
-it safe to put in front of every session on the workstation. A hook that writes
-is a hook that can break the session it was meant to orient, and a hook that
-fetches puts two network round-trips in front of every session start.
-
-The act that actually proves canonical lane, transcript, agent, directory and
-exclusive binding is `lane-start` (with or without `--no-launch`), and the proof
-it leaves is its `STARTED`/`RESUMED` line. So `RUNNING` follows THAT line, in
-`write_event` — the register's single writer, which already validates the
-session field and Amendment 17(b)'s sub-fields there for the same reason: from
-any caller, over one implementation. `ENDED`/`RETIRED` become `CLOSED` by the
-same rule. The hook still only reports, and the capability specification is
-worded as *the confirming act* rather than *SessionStart* for this reason.
-
-### 10. The lifecycle snapshot is local, and it is written where `R-A11-14` stops the register
-
-Decision 3 pairs a snapshot with the append-only history. The snapshot is NOT
-in the register: `lanes/LANES.md` is one file shared by every lane on every
-workstation and every write of it is a commit, a `pull --rebase` and a push
-(Amendment 5), while a transition is taken three times per handoff and must work
-with no network at all. Nor is it inside a git worktree, for decision 2's own
-reason.
-
-It follows that Amendment 11's `R-A11-14` — no record is FILED UNDER A
-WORKSTATION where none is configured, because such a record is unfindable by
-every restart of every workstation — does not reach it. The snapshot is filed
-under nothing, never committed and never leaves the machine that wrote it, so a
-container with no `$LANES_WORKSTATION` still keeps a lifecycle it can recover
-itself from. The two writers are therefore deliberately absent from
-`lanes-edit.sh`'s dispatcher workstation guard, and the register and object-log
-writes stop there exactly as they did.
-
-### 11. The control root is derived from the lane's own checkout, not from a shape-governed worktree root
-
-Decision 2 places the control root under "the shape-resolved worktree root". In
-openRepoTools a lane keeps its writers in two places — `<checkout>/.claude/
-worktrees/<name>` and `<projects>/.lane-worktrees/<lane>/<name>` — and NEITHER
-is under `$SPECKIT_GIT_WORKTREE_ROOT`, which is where openRepoShape puts
-governed FEATURE worktrees and where `AGENTS.md` forbids this tooling to
-hand-roll anything at all.
-
-So the control root is resolved in three rungs, none of them the caller's
-current directory: `$LANES_LANE_STATE_ROOT/<lane>`; else `<parent of the lane's
-recorded `dir`>/.lane-state/<lane>`, the same parent the lane's own
-`.lane-worktrees/<lane>` root sits in, where `dir` is Amendment 11(c)'s recorded
-field; else `$PROJECTS_ROOT/.lane-state/<lane>`. No answer is the honest answer
-`8` — a lane that has not started under Amendment 11(c) has no directory to
-derive one from, and Amendment 7(i)'s cutover rule is that nothing is
-backfilled. This keeps decision 2's actual rule — *the sidecar is an index over
-shape-governed paths, which are never moved* — and spells it for this
-repository.
-
-**And it is only half of the brainstorm's "derivable lane root".** That document
-asks for a root resolved *"without relying on a historical absolute path"*, and
-rung 2 is exactly such a path: Amendment 11(c)'s recorded `dir`. It is a
-RECORDED fact rather than a guess or the caller's current directory, which is
-what makes it safe to act on — but resolving the root from `home owner/repo`
-and the estate, with no recorded path at all, is the coordinator-base work of
-tasks 1.2 and 5.3 and is not in this implementation.
-
-### 12. This change adds no lane-kind verb to the append-only log
-
-Decision 3's alternative (derive everything from events) was rejected there for
-the reasons it gives. As first written, this decision also argued that a sixth
-lane-kind verb would change what `swapped_candidates`, `lane_row_facts`,
-`lane_payload_field`, `lane-last`, `who` and `lane-end` each mean by *a lane's
-last lane-kind line*. **Amendment 18(g) has since added a sixth lane-kind verb,
-`HANDOFF-REQUESTED`, without that effect**: it changes no state, and every
-reader that decides a lane's state enumerates the five state verbs by name and
-skips it. So that argument no longer holds as stated, and the decision now
-rests on two others:
-
-- **A transition is local and frequent, and a log line is neither.** The
-  lifecycle moves three times per handoff and must move with no network at all,
-  while every log line is a commit, a `pull --rebase` and a push (Amendment 5)
-  in a file every workstation shares.
-- **`SWAPPING` is a state, and `HANDOFF-REQUESTED` is not.** A state verb in
-  the log is exactly what the readers that enumerate the five state verbs would
-  have to learn, in a file nothing rewrites, on every workstation until adoption
-  reaches it.
-
-`SWAPPING` is therefore a snapshot state and never a log line, and every
-existing reader is untouched.
-
-### 13. `SWAPPED` needs three landed writes, and the swap still completes without them
-
-Decision 4 says the operation "is not reported ready to swap until `SWAPPED`
-lands". Amendment 11 Addendum 4 ruling 11 (`R-A11-11`) says a swap is never left
-unwritten, and `lane-handoff` implements it: the restart line is printed even
-where the row flip or the handoff refresh was refused, because a person whose
-session is about to die needs the command either way.
-
-Both are kept by separating them. The lifecycle commits `SWAPPED` only when all
-three of the lane's `PAUSED` record, the row's state cell and the handoff file
-have landed — the same three `--restart` and `--exit` already gate on — and
-otherwise the state STAYS `SWAPPING` and the output names the unfinished step.
-The READY line still prints, and now names the state it is printing under. A
-lane called `SWAPPED` on two of the three is a lane whose recovery would skip
-the third.
-
-### 14. Reconciliation reports; `resume` remains the only rebuild, and it is NAMED, not invoked
-
-Decision 7 says the system "names or invokes the estate `resume` path". It
-names it. `AGENTS.md` rule 1 is that **`park` CREATES NOTHING and `resume`
-RESETS NOTHING**, and `resume <Name>` runs that estate's own `make resume`
-across every member of it — which is not a thing a read may do as a side effect
-of a report. `lane-reconcile` runs `git status`, `git log @{u}..`,
-`git rev-parse` and `git worktree list --porcelain` and nothing else; it never
-deletes, resets, force-adds or prunes, and a stale worktree registration is
-reported with the `git worktree prune` that clears it rather than pruned.
-
-**Nor does the report take the lane lock.** The brainstorm has resume *"acquire
-the lane lock"* before it reconciles; the lock here is the register's own mutex,
-and taking it for a READ would serialize every launch on the workstation behind
-every register write for the length of a `git worktree list` in each of a
-lane's checkouts. The lock is taken where it decides something — around the
-read of the fence and the replacement of the snapshot together, in
-`set-lane-state`, so two transitions cannot both read the state before either
-writes it. A report that raced a transition would print a state one moment
-stale, which is what the `VERDICT` line is for.
-
-### 15. An unreadable holder is `indeterminate`, and never a crash
-
-The crash kinds are the lifecycle word crossed with the live-holder read, and
-that read has three answers, not two: `0` a holder, `8` none, and anything else
-**the records could not be read** — which is never "no holder" (`R22`, and
-Amendment 7(d): a read that failed is never an answer). A holder that could not
-be established therefore yields the verdict `indeterminate` and no crash is
-pronounced on a read nobody got. `RESUMING` remains unpersisted, as decision 5
-proposes.
-
-## Decisions taken in the review round (Copilot round 5 on opensoft/openRepoTools#97)
-
-### 16. EVERY lifecycle write is serialized and fenced, the follow-up included
-
-The first implementation fenced `set-lane-state` and left the follow-up at the
-foot of `write_event` unfenced *deliberately* — a confirmed `STARTED`/`RESUMED`
-is a new owner arriving, and advancing the generation over the `SWAPPING` it
-supersedes is exactly what the fence is for. What that argument missed is that
-the two cases are the same act read at different moments. `write_event` appends
-the line, commits it and pushes it before the snapshot is moved, and a lane can
-be recovered by somebody else inside that window: a `RUNNING` written out of an
-event that landed minutes ago would then overwrite a `SWAPPING` that began
-since, which is precisely the overwrite the generation exists to refuse.
-
-So the follow-up reads the snapshot under the same mutex `set-lane-state`
-takes, and compares it with the PRE-IMAGE `write_event` took before its own
-line existed — state, generation and operation in one string. Equal means this
-write is the newest act on the lane and it proceeds; unequal means another act
-got there first and NOTHING is written, with the lane named so a person can read
-it. The mutex is taken **without dying for it**: the event line is already on
-disk, so a lock nobody could take within 20 seconds costs the snapshot and says
-so, never the event (`R-A11-11`).
-
-### 17. A sidecar this helper cannot read is one it must not replace
-
-`lane_state_read` fails closed for a schema version it does not know, and both
-writers beside it read the raw fields and renamed their own file over the top —
-so an older helper meeting a newer tooling's snapshot destroyed a record it
-could not even read, and nothing later can undo that. The fail-closed contract
-therefore binds the WRITERS too: `set-lane-state`, `set-lane-tree` and the
-`write_event` follow-up each ask the schema first and refuse (exit 1) rather
-than replace. The refusal is 1 and not 7 — 7 says a race was lost and invites
-the caller to re-read and try again, and no re-read makes an unknown schema
-readable. The inventory READER gained the same rule: `lane-trees` reports an
-unknown sidecar by its id, path and schema and reads not one other field of it,
-and `lane-reconcile` classifies it `unknown-schema` rather than recomputing git
-against fields it is guessing at.
-
-**And the inventory's own fence is compared rather than merely recorded.** Every
-tree sidecar carried the generation and operation it was written under from the
-first commit of this change, and nothing read them: a handoff that stalled while
-a recovery advanced the lane filed its superseded poll straight over the current
-one. `set-lane-tree` now compares both with the lane's snapshot under the mutex
-and refuses with **7**; and where an observation is legitimately older than the
-lane's current generation, `lane-reconcile` says so on the tree's own line.
-
-### 18. One implementation of the observation, and an incomplete one is never completed
-
-`lane-handoff` computed its own branch, head, upstream, dirty and unpushed for
-every writer it polled and handed all five to `set-lane-tree` — a second
-implementation of `lane_tree_now` with its own error handling, so the WRITERS
-section a person reads and the sidecar a recovery reads could disagree about
-what git said. The observation is now one function behind one read verb,
-`lanes-edit.sh lane-tree-now <path>`, and the handoff records what it answers.
-
-That one function no longer converts a git read which FAILED into a value.
-Every read after the first `rev-parse --git-dir` used to end in
-`|| printf 'unknown'`, `|| printf 'none'` or a count that fell back to `0`, so a
-partially unreadable repository produced a record that looked CLEAN AND
-PUBLISHED — and a later reconciliation comparing against it would call a tree
-holding work `missing` rather than `possible-loss`. A failed read is now an
-incomplete observation that prints nothing, which `set-lane-tree` refuses to
-file and `lane-reconcile` reports as `unreadable`. Two states are answers rather
-than failures and are spelled: `unborn` for a branch with no commit yet, and —
-for a branch whose upstream is configured while its remote-tracking ref is not
-in this checkout, the ordinary state after a merged branch is deleted — the
-configured upstream with `unknown` unpushed, never the `0` that reads as
-*everything here is published*.
-
-## Decisions taken in the sixth review round (capped at two rounds; see `tasks.md` section 7)
-
-### 19. An unreadable snapshot is `indeterminate`, exactly as an unreadable holder is
-
-Decision 15 gave the HOLDER read three answers and made the third
-`indeterminate`. The SNAPSHOT read one file earlier had two: `lane_state_read`
-answered 8 — *this lane has no snapshot* — for a record that exists and cannot
-be opened, and `lane_reconcile` mapped every non-zero read to `NONE`, whose
-verdict is `no-state`: the cutover answer that tells a launcher this lane never
-ran under this capability and there is nothing to recover. A permission or an
-I/O error therefore came out of the report as a clearance, which is fail-OPEN on
-a crash pronouncement — the one class this change exists to close.
-
-So the two cases are told apart at the read: **10** where the record is there and
-could not be opened, 8 where there is none. `lane-state` spends the same 10 at
-the CLI (8 stays *there is none*, which every launcher answers by going on), and
-`lane-reconcile` reports the state word `UNREADABLE` with the verdict
-`indeterminate`. `[ -L ]` sits beside `[ -e ]` in that test because a dangling
-symlink is `-e` false: the name is there and the bytes are not, which is
-present-and-unreadable and not absent.
-
-### 20. Every sidecar write is serialized, fence or no fence
-
-`set-lane-tree` took the lane mutex only when the caller named a
-`--generation`/`--operation` to compare. The atomic temp-file rename underneath
-it stops a reader seeing half a file and stops nothing else, so an UNFENCED
-observation — a person's, or a caller that names no transition — could land
-after a newer fenced one and replace it, leaving the inventory holding a reading
-older than the transition recorded beside it. The mutex is now taken for every
-write of these files, with the generation/operation comparison unchanged for the
-callers that name one.
-
-It is taken AFTER the observation and not before it, for the reason decision 14
-keeps `lane-reconcile` out of the lock entirely: `lane_tree_now` runs
-`git status` and `git rev-list` in somebody's checkout, and what must be
-serialized is the compare and the write, not the reading of a repository.
-
-## Decisions taken in the rework of 2026-10-04
-
-### 21. The managed ledger owns enrolled lanes; this change owns legacy lanes only
-
-Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled lanes; #97 owns legacy — rework both".
-
-**The seam is the register row's state cell.** A lane the managed ledger has
-enrolled carries a managed-owner marker there, in the long form
-`<STATE> · <UTC> · managed-owner mode=managed daemon=<id> generation=<n> bound-lane=<lane>`
-or the historical shorthand `MANAGED OWNER · <token>`. The reader is
-`3c26041:lanes-edit.sh:776-898` — branch `001-separate-swap-ctx-handoff`'s
-projection reader (its T019) — **ported verbatim**, with an empty diff as the
-proof, so that branch's T024 merges as "keep either". Its four dependencies
-(`row_split_state_cell`, `rstrip_spaces`, `lc`, `row_of_lane`) are
-byte-identical on `main`. One wrapper, `lane_is_managed_owned`, answers 0 with
-the owner, 8 for a legacy lane and 1 for unknown, and closes the one gap the
-ported reader leaves: an unrendered published register reads as an empty one,
-which the wrapper answers as unknown. `managed-projection <lane>` is that
-answer as a read verb (64 for usage).
-
-**The rule is the reader's own — "no malformed marker may be downgraded to
-absence".** A valid marker refuses with 2, naming the owner; managed-owner
-vocabulary that does not parse, a row that is not seven columns or a register
-that cannot be read refuses with 1 (unknown); no vocabulary is a legacy lane and
-nothing changes. Every refusal comes before the act's first write: `write_event`
-for every lane-kind verb (the four that move a lifecycle, `PAUSED`, and
-`HANDOFF-REQUESTED`, which `request-handoff` writes and which refuses at its
-head, `--dry-run` included), `set-lane-state`, `set-lane-tree`,
-`retire-rows` (any hit refuses the whole sweep), `migrate-state-cells` (any
-row it would rewrite refuses the whole migration, which is one commit),
-`archive-rows` (any RETIRED row it would move refuses the whole move),
-`append-session-id`, `add-row` for a lane that already has a row,
-`set-row-state`,
-`replace-in-row`, `rename-lane`, the entry of `lane-start` (before Amendment
-18's binding gate) and of `lane-handoff` (before every mode), and `lane-end`
-(at the head of its `--retire <pid>` door, and on the ending path right after
-its own row refusals, so that Amendment 15(d)'s pair refusal is still the one a
-person reads through a helper that predates both reads).
-`lane-reconcile` is read-only and answers `managed-owned`. `row_state_check`,
-`add-row`, `append-line`, and the new text of `replace-in-row`,
-`append-session-id` and `rename-lane`'s new name refuse the marker's
-vocabulary, so no legacy writer forges a marker. The refusal reads this
-checkout's row as well as the published one, because every legacy row writer
-rewrites this checkout's row: vocabulary in one copy and not the other is
-unknown (1). Object-kind lines (a claim, a release) concern the object a lane
-holds and are not refused (Copilot rounds 2 and 3 on #97).
-
-**`RUNNING` is written only on a legacy verdict.** `lane_state_follow` moves a
-snapshot only when the verb is `STARTED`/`RESUMED` (to `RUNNING`) or
-`ENDED`/`RETIRED` (to `CLOSED`), the caller's seam read was 8, and a pre-image
-was taken and still matches; a missing verdict or pre-image writes nothing. A
-later change may own `RUNNING` for an operation it holds — the
-`SWAPPED → RUNNING` readiness write of a supervised restart, for one — and no
-stub of that ships here.
-
-**What is not asserted.** Branch 001's governance review is PROPOSED — NOT
-APPROVED; nothing here adopts it, and no supersession of Amendment 17 is
-asserted. When 001's T024 lands, the ported block resolves "keep either" and
-`lane_is_managed_owned` gives way to its `managed_legacy_check`.
-
-### 22. An unreadable snapshot is exit 10, because `main` spent 9
-
-Decision 19 gave an unreadable snapshot exit 9. `main`'s #61 landed first with 9
-as `claim --force`'s abandoned takeover; each change took 9 as unused, and the
-one that had not landed moved. 10 is spent nowhere else in the shipped scripts.
-
-### 23. A lane bound elsewhere is `indeterminate` (Amendment 18(b))
-
-Amendment 18(b): *"Liveness is pronounced only from inside the binding's own
-`host` and `container` … from anywhere else a binding is UNKNOWN, never dead."*
-`lane-reconcile` decided its verdict from this workstation's snapshot and this
-workstation's session records alone, so a lane bound on another host read as an
-ungraceful stop or as resumable. It now reads the binding through the same
-`lane_binding_scan` and `binding_is_here` rule as `binding` and
-`holder_is_dead`, prints a `BINDING` line, and turns every verdict into
-`indeterminate` where the binding is elsewhere or its log cannot be read —
-keeping clause (b)'s one exception, a window gone from this host's tmux.
-
-### 24. Every writer of a lane-kind line moves the lifecycle, and a rename carries it
-
-Amendment 19's sweep appends `RETIRED` lines without `write_event`, so the
-follow-up of decision 9 never ran for a lane it retired; the sweep now takes each
-lane's pre-image in its scan and follows each line after its lock, as
-`write_event` does. Amendment 16's `rename-lane` moved the row, the log, the
-handoff and the alias table but not the control root, which is keyed by the
-lane's name, so a renamed lane read `no-state`; it now moves that directory once
-its commit has landed, never over an existing one.
-
-## Decisions taken on Codex's review of `ec9847e`
-
-### 25. The inventory says what it could not read, keeps one record per path, and takes an observation whole
-
-Four findings, each a tree a recovery would misread, and each a part of a
-follow-up this change had filed and deferred:
-
-- **An unreadable sidecar was skipped** (`[ -r ] || continue`), so a record
-  nobody could read and no record at all were one silence. It is now a row of
-  `lane-trees` named by its file, with no field and the schema `<unreadable>`,
-  and `lane-reconcile` reports it as `unreadable-sidecar` and counts it toward
-  recovery (#113's second read).
-- **The tree id was not injective.** The fold to the file-name alphabet makes
-  `…/a+b` and `…/a-b` one name, so the second tree's record replaced the
-  first's. The `cksum` of the whole path, which only an over-long id carried,
-  now prefixes EVERY id. No migration: no released tooling has written a
-  sidecar (#116's first half).
-- **A partial observation was completed with clean-looking defaults.** One flag
-  skipped the reading and the rest were filed as `unknown`, `none`, `dirty 0`
-  and `unpushed 0`. It is now a usage refusal, 64, and nothing is written — the
-  answer decision 18 gives the other path (#114's second half).
-- **`lane-start` stayed silent over a `resumable` lane** whatever its trees
-  held. `resumable` says the swap completed; it is now quiet only when the
-  `TREES` line counts nothing dirty or unpushed, nothing requiring recovery and
-  nothing unmanaged or stale, and the report it prints names the binding when
-  it is neither here nor free.
-
-## Decisions taken on the filed findings #113, #114 and #115
-
-### 26. Every read the reconciliation rests on has a status, and a failed one is never an empty one
-
-#113's three remaining reads, and the one beside its second that 8.12 left:
-the holder ids (#67's `session_ids_checked`: a published register or this
-checkout's copy that could not be read is `HOLDER unknown` and so
-`indeterminate`, never an empty id set `live_holder` answers 8 for);
-`branch.<b>.remote` (the `case` its `merge` sibling already had, so a failed
-read is `lane_tree_now`'s 3, never the local upstream `./<merge>`); `git
-worktree list --porcelain` in the lane's checkout; and `lane-trees`' 10 for an
-inventory directory that cannot be listed. The last two, and a lane root that
-cannot be listed or searched, leave trees nobody read, so each makes the
-verdict `indeterminate` and is named in it. A per-record failure stays a row
-counted toward recovery, as `unreadable-sidecar` is, and leaves the verdict as
-it was — the line T018 draws for an unreadable leg. A recorded directory that is NO
-repository registers nothing, and that alone is an absence — `lane-worktrees`'
-`no_repository`, #170 G5's rule — so the two readers of one checkout agree.
-
-### 27. An inventory fence names an operation that must still be open
-
-#114 offered two exits: require `SWAPPING` while an observation is filed under
-an operation, or invalidate the operation id at finalization. The first refuses
-a write this change's own suite makes on purpose — a lane `RUNNING` after a
-resume records under its current generation and operation (repoRC-5, section
-11(c)) — and the second changes what `SWAPPED` writes, which decision 13 and
-`lane-handoff`'s finalizer read back. So the fence refuses where the lane reads
-`SWAPPED`: every other transition advances the generation, which already
-refuses an older pair, and `SWAPPED` is the one state in which a matching pair
-names a FINISHED operation. Exit 7, as every fence refusal is; an observation
-under no transition is an unfenced `set-lane-tree`.
-
-### 28. A record of the known schema is valid only when it is whole
-
-#115. `lane_sidecar_schema_ok` keeps its name and its callers, and now asks of
-a record of the current schema every key its writer writes, the shapes the
-readers decide with, and the id a tree record's file gives it. Both writers
-have written exactly those keys since #97 landed, so no released record fails.
-A malformed record takes the unknown schema's path everywhere: refused by every
-writer (1), `lane-state` 10 and `MALFORMED` in the reconciliation (no new exit
-code — 10 already means *there, and nothing could be read out of it*), and a
-`<malformed>` row of `lane-trees` that `lane-reconcile` reports as
-`malformed-sidecar`. `lane_sidecar_put` asks the same of its temporary file
-before the rename, and `set-lane-tree` refuses with 64 a count that is not one
-or a field that is only blanks, so no writer files a record its own readers
-would refuse. Which kind of record a file is comes from where it is filed, and
-the snapshot's `*/lane-state.yaml` is asked first: `*` matches `/`, so a tree's
-`*/trees/*.yaml` would also match a snapshot under any directory named `trees`,
-and no tree file is named `lane-state.yaml` (its id is `c<cksum>-…`). A record's
-`lane:` is required but not compared with the lane it is filed under, because
-`rename-lane` moves the control root and leaves that line naming the old lane
-until the next write (`lane_state_rename`); its readers do not key on it.
-
-## Risks / Trade-offs
-
-- **[Risk] Lane-first discovery conflicts with feature-first Speckit paths** → Use a sidecar index over shape-governed paths; do not move governed trees.
-- **[Risk] Snapshot and append-only history diverge** → Write under one lane lock, verify the event append, and surface disagreement as recovery-required.
-- **[Risk] A stale PID appears live in another namespace** → Use the existing binding/session provenance contract, not PID alone.
-- **[Risk] `RUNNING` remains after a process dies normally without `/swap`** → Treat `RUNNING` plus no verified holder as ungraceful and inspect all trees.
-- **[Risk] A swap records `SWAPPING` and then permanently stalls** → Permit an explicit recovery/takeover operation that advances the generation while retaining the interrupted operation in history.
-- **[Risk] Sidecars claim work is clean when Git changed later** → Recalculate all Git observations on resume and before `SWAPPED`.
-- **[Risk] Coordinator-base enforcement disrupts legacy lanes** → Introduce explicit migration and warning stages before enforcing the invariant.
-- **[Risk] Concurrent tooling versions interpret new state differently** → Version the sidecar schema and retain conservative fail-closed behavior for unknown versions or states.
-- **[Risk] The managed-owner hint over-matches** → The reader matches its vocabulary anywhere in a row, so a legacy row carrying `managed:` reads as unknown and is refused. Measured on 2026-10-04 at 0 of the 57 rows of the published register (brett-wip `225b9f90a`, the hint's own three patterns); no legacy writer can now write the vocabulary, so the count cannot grow from this side.
-- **[Risk] A marker published since the last fetch is missed** → A caller running with `LANES_NO_FETCH=1` reads the register as last fetched, until branch 001's lease closes the window.
-
-## Migration Plan
-
-1. Add read-only discovery and reporting for the new control root and state schema.
-2. On an explicitly named lane start or successful `/swap`, create sidecars from verified repository identity, current binding, Git registrations, and the handoff; never scrape arbitrary prose silently.
-3. Continue accepting legacy lanes with no sidecar through the existing explicit `--dir` path, while reporting that crash recovery is incomplete.
-4. Add `SWAPPING` and `SWAPPED` writes behind compatibility detection so older installed readers fail closed rather than misclassify them.
-5. Enable resume reconciliation before coordinator-base enforcement.
-6. After existing lanes have been migrated, require the coordinator base and structured writer registration for newly created trees.
-
-Rollback disables new writes but preserves sidecars and append-only events for diagnosis. It must not rewrite or remove lane history, worktrees, or handoffs.
-
-## Open Questions
-
-- ~~Which existing lane lock becomes the single transition lock?~~ **Settled by
-  the implementation**: `lanes-edit.sh`'s own mutex, taken around the read of
-  the fence and the replacement of the snapshot together, so two transitions
-  cannot both read the state before either writes it. How it is shared across a
-  host/container boundary remains open — the snapshot is local to a machine by
-  decision 10, so today it is not shared at all.
-- ~~Does recovery complete an interrupted operation ID or always supersede it?~~
-  **Settled**: it supersedes. A handoff that finds the lane still `SWAPPING`
-  takes it over with a NEW generation and names the operation that never
-  finished; that new generation is precisely what refuses the old finalizer if
-  it ever wakes. Nothing of the interrupted operation is undone.
-  **What it cannot yet tell** is an interrupted operation from one that is
-  still running (Copilot round 2 on #97). That takes the handoff process's
-  liveness, which the snapshot does not record, and a PID alone does not
-  establish it (Risks). So a second handoff begun during a live one supersedes
-  it too. The fence bounds the harm: every later finalizer and inventory write
-  of the superseded operation is refused with 7 and changes nothing. Refusing a
-  live competitor is deferred to opensoft/openRepoTools#157.
-- Which tree-level discrepancies block the entire coordinator versus only that writer's relaunch?
-- What subset of sidecar data is replicated through the workspace repository for another workstation?
-- How should lane-specific scratch worktrees be named without colliding with Speckit feature identifiers?
diff --git a/openspec/changes/add-crash-consistent-lane-worktree-recovery/proposal.md b/openspec/changes/add-crash-consistent-lane-worktree-recovery/proposal.md
deleted file mode 100644
index f4556f20..00000000
--- a/openspec/changes/add-crash-consistent-lane-worktree-recovery/proposal.md
+++ /dev/null
@@ -1,39 +0,0 @@
-## Why
-
-A lane may coordinate several Git worktrees containing dirty or unpushed work, but its current launch record identifies only one directory and cannot distinguish a clean swap from token exhaustion before or during `/swap`. Resume therefore needs a structured, crash-consistent inventory that can find every lane-owned worktree and explain whether the previous session stopped cleanly before another process writes to it.
-
-**Scope, by ruling.** Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled lanes; #97 owns legacy — rework both". This change governs **legacy lanes only**. A lane the managed ledger has enrolled — one whose register row carries a valid managed-owner marker — is that ledger's, and every act of this change refuses it before writing anything; a lane whose ownership cannot be read is refused the same way. See design decision 21.
-
-## What Changes
-
-- Give each lane a structured worktree root derived from its stable repository/estate identity and canonical lane name, with one sidecar record per lane-owned tree.
-- Record repository, branch, HEAD, upstream, writer/session identity, and last-observed dirty and unpushed state for each tree without placing orchestration files inside Git worktrees.
-- Add a guarded lane lifecycle: `RUNNING` when SessionStart confirms the owner, `SWAPPING` before `/swap` begins preservation work, and `SWAPPED` only after every required handoff and pause write succeeds.
-- Fence transitions with a generation and operation ID so a delayed swap or competing resume cannot overwrite a newer owner.
-- Reconcile sidecar intent against live holders, `git worktree list --porcelain`, filesystem paths, branches, commits, dirty files, and unpushed commits before resuming.
-- Classify `RUNNING` or `SWAPPING` without a matching live owner as recovery-required rather than treating it as a clean swap.
-- Delegate reconstruction of durably parked feature worktrees to the existing estate `resume` mechanism; never recreate over unknown paths or claim that missing uncommitted files can be recovered.
-- Migrate legacy lanes on an explicit, verified start or swap rather than inferring paths from prose or the caller's current directory.
-- **BREAKING**: lane launch and swap become state transitions requiring exclusive ownership; ambiguous or inconsistent lane/worktree state blocks a competing launch instead of silently starting.
-
-## Capabilities
-
-### New Capabilities
-
-- `lane-worktree-recovery`: Canonical lane worktree discovery, crash-consistent swap state, and evidence-based resume reconciliation for multi-writer lanes.
-
-### Modified Capabilities
-
-None. This repository has no existing OpenSpec capability specifications; current behavior is documented by the lane collision protocol and command manual.
-
-## Impact
-
-Tracked by [opensoft/openRepoTools#91](https://github.com/opensoft/openRepoTools/issues/91), with the existing `openRepoTools-3` Claude lane as the active implementation owner.
-
-**Delivered in the first implementation**: the lifecycle snapshot with its generation and operation fence (`lane-state`, `set-lane-state`), the machine-readable worktree inventory taken at every handoff (`set-lane-tree`, `lane-trees`), the resume reconciliation that reports and resets nothing (`lane-reconcile`, printed by `lane-start` before it writes anything), the two-phase `/swap`, and `RUNNING` written by the act that confirms the binding. Design decisions 9 to 15 record where each of these departs from the decisions above and why.
-
-**Delivered in the rework of 2026-10-04**: the seam that keeps every act of this change off a managed-owned lane (design decision 21), and four fixes the merge of `main` made necessary — the unreadable-snapshot exit moved from 9 to 10, a lane retired by Amendment 19's sweep closes its snapshot, a lane bound elsewhere is `indeterminate` under Amendment 18(b), and a renamed lane keeps its snapshot (decisions 22 to 24).
-
-**Not yet delivered**: the coordinator-base invariant and its staged enforcement, the inventory of shape-governed feature worktrees beyond the two roots a lane already owns, and any replication of this state to a second workstation. Each remains a task in `tasks.md`, and the lifecycle is local to one machine until they land.
-
-The change affects `lane`, `lanes`, `lane-start`, `lane-handoff`, `/swap`/`/handoff`, the SessionStart integration, `lanes-edit.sh`, lane status rendering, and lane helper tests. It integrates with—but does not replace—the workspace register, handoff documents, `git worktree` plumbing, openRepoShape/Speckit worktree conventions, and estate `park`, `status`, and `resume` commands. Existing lane records and ad hoc writer worktrees require an explicit compatibility and migration path.
diff --git a/openspec/changes/add-crash-consistent-lane-worktree-recovery/specs/lane-worktree-recovery/spec.md b/openspec/changes/add-crash-consistent-lane-worktree-recovery/specs/lane-worktree-recovery/spec.md
deleted file mode 100644
index d2bf185f..00000000
--- a/openspec/changes/add-crash-consistent-lane-worktree-recovery/specs/lane-worktree-recovery/spec.md
+++ /dev/null
@@ -1,197 +0,0 @@
-## ADDED Requirements
-
-Capability `lane-worktree-recovery`, tracked in [opensoft/openRepoTools#91](https://github.com/opensoft/openRepoTools/issues/91). Where a requirement below is narrower than the brainstorm that proposed it, the reason is a numbered decision in `design.md`.
-
-### Requirement: Canonical lane worktree inventory
-The system SHALL maintain a structured inventory for every worktree owned by a lane, rooted or indexed beneath the worktree root derived from the lane's stable repository and estate identity. The inventory SHALL remain discoverable without parsing handoff prose or trusting the caller's current directory.
-
-#### Scenario: Lane owns several worktrees
-- **WHEN** one lane coordinates writers in multiple registered worktrees
-- **THEN** the lane inventory identifies every tree by stable tree ID, repository, path, branch or detached state, HEAD, upstream, and writer identity
-
-#### Scenario: Shape governs the physical path
-- **WHEN** a Speckit or openRepoShape contract prescribes a feature-first worktree path
-- **THEN** the lane inventory references that path without moving it into a conflicting lane-first layout
-
-#### Scenario: Two paths fold to the same record name
-- **WHEN** two worktree paths differ only in characters outside the record-name alphabet
-- **THEN** the lane inventory keeps two records, each with its own observation, and neither replaces the other
-
-#### Scenario: A caller supplies part of an observation
-- **WHEN** a caller records a tree with some but not all of branch, HEAD, upstream, dirty state and unpushed count
-- **THEN** the system refuses the write as a usage error and records nothing, rather than completing the observation with values nobody read
-
-### Requirement: Coordinator base checkout
-The system SHALL resolve the lane coordinator's checkout from canonical lane, home repository, estate, and workstation shape. After migration, the coordinator SHALL launch from the canonical base checkout while mutable feature work occurs in inventoried writer worktrees.
-
-#### Scenario: Profile rotation
-- **WHEN** an operator resumes a migrated lane under a different valid profile
-- **THEN** the system uses the same canonical coordinator checkout and worktree inventory
-
-#### Scenario: Legacy coordinator directory is ambiguous
-- **WHEN** a legacy lane has no verified base-checkout record
-- **THEN** the system requires an explicit directory or migration act and does not infer one from the current directory or handoff prose
-
-### Requirement: Sidecar metadata remains outside worktrees
-The system SHALL store lane and tree lifecycle metadata outside Git worktree directories.
-
-#### Scenario: State update does not dirty work
-- **WHEN** the system updates lane or tree state
-- **THEN** no tracked or untracked orchestration file is added inside the associated Git worktree
-
-### Requirement: Running ownership is confirmed
-The system SHALL write `RUNNING` only from the act that confirms the canonical lane, transcript or session, agent, coordinator directory, and exclusive binding, and SHALL NOT write it from a read-only session-start report. See design decision 9: in this repository the confirming act is the lane start that records the binding, and the SessionStart hook never writes.
-
-#### Scenario: Launcher dies before the binding is recorded
-- **WHEN** a resume command begins but no replacement binding is confirmed and recorded
-- **THEN** the system does not record the lane as `RUNNING`
-
-#### Scenario: A read-only session-start report runs
-- **WHEN** the session-start hook reports on a lane
-- **THEN** it writes no lifecycle state, makes no network call, and exits successfully
-
-#### Scenario: Confirmed replacement starts
-- **WHEN** the confirming act proves the replacement owns the expected lane and binding
-- **THEN** the system atomically records `RUNNING` with that owner and a newly advanced generation
-
-### Requirement: Swap uses a two-phase lifecycle
-The system SHALL transition a running lane to `SWAPPING` before `/swap` performs preservation work and SHALL transition it to `SWAPPED` only after every mandatory inventory, writer, handoff, and pause-record step succeeds.
-
-#### Scenario: Token exhaustion before swap
-- **WHEN** the running process disappears before invoking `/swap`
-- **THEN** persisted state remains `RUNNING` and resume classifies the lane as an ungraceful stop
-
-#### Scenario: Token exhaustion during swap
-- **WHEN** the process disappears after `SWAPPING` is recorded but before all mandatory swap steps complete
-- **THEN** persisted state remains `SWAPPING` and resume classifies the lane as an interrupted swap
-
-#### Scenario: Graceful swap completes
-- **WHEN** every mandatory swap step succeeds
-- **THEN** the same operation atomically records `SWAPPED` before printing that the lane is ready to resume
-
-### Requirement: Transitions are generation-fenced
-Every ownership transition SHALL carry a monotonically advancing generation and unique operation ID, and a transition finalizer SHALL succeed only when its expected state, generation, and operation ID still match. Every write that follows a recorded act SHALL be serialized under the one transition lock and refused when the lane has moved past the state that write observed. A swap that begins while the lane is recorded `SWAPPING` SHALL supersede the recorded operation, as it does an interrupted swap (design.md, Open Questions). The snapshot records no liveness for the handoff process, so a live operation cannot yet be told from an interrupted one. Refusing a live competitor instead is deferred to opensoft/openRepoTools#157.
-
-#### Scenario: A lifecycle write is overtaken while it lands
-- **WHEN** the lane's state, generation, or operation changes between the moment a lifecycle-moving event is recorded and the moment its current-state snapshot is updated
-- **THEN** the snapshot is left exactly as the later act wrote it, the recorded event still stands, and the overtaken write reports what it found
-
-#### Scenario: An observation is filed under a superseded operation
-- **WHEN** an inventory write names a generation or operation the lane has already moved past
-- **THEN** the system refuses the write, changes no recorded observation, and directs the caller to re-read the lane
-
-#### Scenario: Two writers record the same tree at once
-- **WHEN** an inventory observation is written while another run holds the lane transition lock
-- **THEN** the write waits for that lock before replacing the sidecar, whether or not it names a generation and operation to compare
-
-#### Scenario: Delayed swap finalizer
-- **WHEN** an old `/swap` process attempts to record `SWAPPED` after another recovery or resume has advanced the generation
-- **THEN** the system refuses the stale finalizer without changing current state
-
-#### Scenario: Competing swap begins
-- **WHEN** a second `/swap` starts while the lane is already recorded `SWAPPING`
-- **THEN** the system names the recorded operation and supersedes it with a new generation and operation
-- **AND** every later finalizer or inventory write of the superseded operation is refused without changing current state
-
-### Requirement: Resume reconciles records with live evidence
-Before launching replacement writers, the system SHALL compare lane and tree sidecars with the latest handoff, verified live holders, Git worktree registrations, filesystem paths, branches, commits, dirty files, and unpushed commits.
-
-#### Scenario: Existing writer remains live
-- **WHEN** reconciliation finds a verified live writer for an inventoried worktree
-- **THEN** the system does not launch a second writer into that worktree
-
-#### Scenario: Running state has no holder
-- **WHEN** persisted state is `RUNNING` and no verified owner remains live
-- **THEN** the system reports an ungraceful stop and inspects every inventoried and discovered worktree before permitting recovery
-
-#### Scenario: Liveness cannot be established
-- **WHEN** the holder records cannot be read at all
-- **THEN** the system reports that liveness is not established and pronounces neither crash kind, because a read that failed is not an answer
-
-#### Scenario: The lifecycle snapshot cannot be read
-- **WHEN** a lane's persisted state record exists at its control root and cannot be read
-- **THEN** the system reports the state as unreadable and the outcome as indeterminate, and never as a lane that has no persisted state
-
-#### Scenario: The lane is bound elsewhere
-- **WHEN** a lane's last binding names another host or container and its window is not known to be gone from this host
-- **THEN** the system reports the binding as elsewhere and the verdict as indeterminate, and pronounces no crash, clearance or closure from outside that binding
-
-#### Scenario: Swapping state has no holder
-- **WHEN** persisted state is `SWAPPING` and no verified owner remains live
-- **THEN** the system reports the interrupted operation ID and preserves all trees for recovery
-
-#### Scenario: Stored Git observations are stale
-- **WHEN** current branch, HEAD, dirty state, or unpushed commits differ from the sidecar
-- **THEN** the system reports current Git evidence and does not treat the stored observation as truth
-
-#### Scenario: Unknown tree is discovered
-- **WHEN** Git or the filesystem contains a worktree beneath the lane root that is absent from the inventory
-- **THEN** the system reports it as unmanaged and does not delete, overwrite, or automatically assign it
-
-#### Scenario: A tree cannot be read
-- **WHEN** Git answers in a tree's path and one of the reads an observation is made of fails
-- **THEN** the system reports the tree as unreadable, records no observation of it, and assumes neither clean nor dirty state for it
-
-#### Scenario: A tree record cannot be read
-- **WHEN** a tree's inventory record exists at the lane's control root and cannot be read
-- **THEN** the system reports the record as unreadable, counts it toward recovery, and never reads the lane as owning one tree fewer
-
-#### Scenario: A resumable lane's trees need reading
-- **WHEN** a swap completed and the reconciliation counts a tree that is dirty, unpushed, requires recovery, or is unmanaged or stale
-- **THEN** the launcher reports the reconciliation before it writes anything, rather than starting the lane in silence
-
-### Requirement: Missing worktrees are rebuilt only from durable records
-The lane system SHALL delegate worktree reconstruction to the existing estate resume mechanism and SHALL not hand-roll worktree creation, WIP commits, resets, or force operations.
-
-#### Scenario: Parked worktree is missing
-- **WHEN** an inventoried worktree is absent and its last observation recorded no dirty or unpushed work
-- **THEN** the system reports it as missing and NAMES the estate `resume` path as the only rebuild, without running it (design decision 14)
-
-#### Scenario: A stale worktree registration is discovered
-- **WHEN** a repository registers a worktree whose directory is gone
-- **THEN** the system reports the stale registration and names the `git worktree prune` that clears it, and prunes nothing itself
-
-#### Scenario: Potentially uncommitted worktree is missing
-- **WHEN** a missing worktree's last evidence indicates dirty or unpublished work without a durable parked commit
-- **THEN** the system reports possible loss and refuses to claim that the worktree can be reconstructed
-
-### Requirement: Closed and swapped states remain distinguishable
-The system SHALL distinguish a lane or tree that completed a temporary swap from one whose work is permanently closed.
-
-#### Scenario: Swapped lane resumes
-- **WHEN** a `SWAPPED` lane passes reconciliation and SessionStart confirms its replacement
-- **THEN** the lane returns to `RUNNING` without changing the identity of its worktrees
-
-#### Scenario: Closed tree is unexpectedly dirty
-- **WHEN** a tree marked `CLOSED` contains dirty files or unpushed commits
-- **THEN** the system reports a closure inconsistency and refuses automatic cleanup
-
-### Requirement: Legacy lifecycle refuses a managed-owned lane
-The system SHALL govern legacy lanes only (Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled lanes; #97 owns legacy — rework both"). Before its first write, every lifecycle, inventory, lane-kind log line, register-row, sweep, archive, migration, start, handoff and end act SHALL read the lane's managed-owner marker, in the published register and in the checkout whose row it rewrites. It SHALL refuse a valid marker, refuse an unreadable or malformed one (or two copies that disagree) as unknown, and run unchanged for a lane with none. No legacy writer SHALL write the marker's vocabulary into the register. Object-kind lines (a claim or a release of an issue or pull request) concern the object a lane holds, not the lane's ownership, and are unchanged.
-
-#### Scenario: A lane carries a valid managed-owner marker
-- **WHEN** any legacy act is invoked for a lane whose register row carries a valid managed-owner marker
-- **THEN** the act exits 2 naming the owner, and the register, the lane's object log, its lifecycle control root and its tmux window are unchanged, and the reconciliation reports `managed-owned` without pronouncing anything else
-
-#### Scenario: A managed-owner marker cannot be read
-- **WHEN** a lane's register row carries managed-owner vocabulary that does not parse, this checkout's row carries vocabulary the published row does not, or the register cannot be read
-- **THEN** the act exits 1 reporting ownership as unknown, and nothing is changed
-
-#### Scenario: A legacy lane is acted on
-- **WHEN** a lane's register row carries no managed-owner vocabulary
-- **THEN** every act behaves exactly as it did before the seam, and the lifecycle moves only on that legacy verdict and an unchanged pre-image
-
-### Requirement: Legacy migration is explicit and non-destructive
-The system SHALL create structured state for a legacy lane only from an explicitly named start, swap, or migration using verified repository and Git evidence.
-
-#### Scenario: Legacy lane is migrated during swap
-- **WHEN** a legacy lane successfully completes `/swap` from a verified coordinator checkout
-- **THEN** the system creates its structured lane and tree inventory without rewriting historical handoff or lane events
-
-#### Scenario: Migration encounters an unknown path
-- **WHEN** legacy evidence names a path that cannot be verified against the expected repository
-- **THEN** the system refuses to adopt the path and leaves existing files unchanged
-
-#### Scenario: A sidecar records a schema this tooling does not write
-- **WHEN** a lane snapshot or a tree sidecar records a schema version this tooling does not write
-- **THEN** every reader reports it as unknown without interpreting any other field of it, and every writer refuses to replace it rather than overwriting a record it cannot read
diff --git a/openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md b/openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md
deleted file mode 100644
index eb490845..00000000
--- a/openspec/changes/add-crash-consistent-lane-worktree-recovery/tasks.md
+++ /dev/null
@@ -1,216 +0,0 @@
-## 1. Structured State Model
-
-- [x] 1.1 Define and version the lane-state and tree-sidecar schemas, including canonical lane, repository/estate identity, relative path, Git observations, owner, state, generation, operation ID, and timestamps.
-- [ ] 1.2 Implement shape-aware resolution of the coordinator base, worktree root, and lane control root without deriving identity from profile or current directory.
-- [x] 1.3 Implement atomic sidecar reads and writes under one lane transition lock, with conservative refusal for unknown schema versions and malformed state.
-- [ ] 1.4 Append an auditable lane event for every successful current-state transition and detect disagreement between the snapshot and event history.
-
-## 2. Worktree Inventory
-
-- [x] 2.1 Implement registration and update of lane-owned tree sidecars without placing metadata inside Git worktrees.
-- [ ] 2.2 Inventory governed feature worktrees by reference to their shape-prescribed paths rather than moving them into a conflicting lane-first layout.
-- [x] 2.3 Reconcile expected sidecars, latest handoff writers, `git worktree list --porcelain`, and directories present beneath the resolved worktree root.
-- [x] 2.4 Recalculate repository identity, branch or detached HEAD, commit, upstream, dirty files, untracked files, and unpushed commits for every discovered tree.
-
-## 3. Crash-Consistent Swap
-
-- [x] 3.1 Change `/swap` and `lane-handoff` to compare-and-swap `RUNNING` to `SWAPPING` before inventory or preservation work begins.
-- [x] 3.2 Carry one generation and operation ID through writer polling, handoff refresh, lane pause records, and finalization.
-- [x] 3.3 Finalize `SWAPPING` to `SWAPPED` only after every mandatory step succeeds, and print readiness only after that transition lands.
-- [x] 3.4 Refuse stale or competing finalizers whose expected state, generation, operation ID, or owner no longer matches.
-- [x] 3.5 Preserve `SWAPPING` on every refusal or interrupted path and report the unfinished operation and completed steps.
-
-## 4. Guarded Resume
-
-- [x] 4.1 Classify `RUNNING` without a verified owner as an ungraceful stop and `SWAPPING` without one as an interrupted swap.
-- [ ] 4.2 Refuse duplicate coordinator or writer launches when a verified holder remains live.
-- [x] 4.3 Produce a resume reconciliation report that distinguishes safe, dirty, unpushed, unmanaged, missing, stale-registration, and possible-loss trees.
-- [x] 4.4 Keep state `SWAPPED` during launch and transition to `RUNNING` only after SessionStart confirms lane, transcript/session, agent, directory, and exclusive binding.
-- [x] 4.5 Delegate eligible missing-tree reconstruction to estate `resume` and refuse hand-rolled recreation or recovery claims for missing unpublished work.
-
-## 5. Compatibility and Migration
-
-- [x] 5.1 Add a read-only compatibility path for lanes with no sidecar, preserving the existing explicit `--dir` refusal and launch behavior.
-- [x] 5.2 Create structured state for a legacy lane only during an explicitly named, repository-verified start, swap, or migration.
-- [ ] 5.3 Introduce coordinator-base enforcement in a staged mode that first reports legacy feature-worktree launches before making them refusals.
-- [x] 5.4 Keep profile selection independent of lane identity and verify that profile rotation resumes the same coordinator and worktree inventory.
-
-## 6. Verification and Delivery
-
-- [x] 6.1 Add tests for token exhaustion before `/swap`, during every mandatory swap step, after `SWAPPED`, and before replacement SessionStart.
-- [ ] 6.2 Add race tests for competing swaps, competing resumes, stale finalizers, and live duplicate writers.
-- [ ] 6.3 Add worktree tests for dirty and unpushed trees, missing parked trees, missing unpublished trees, unknown trees, stale registrations, detached HEAD, and shape-governed paths.
-- [ ] 6.4 Add migration tests for legacy lanes with no directory, verified explicit directories, invalid repository identities, and repeated idempotent migration.
-- [x] 6.5 Update the lane manual and installed `/swap`/handoff guidance with the state meanings, recovery output, profile-switch sequence, and non-destructive boundaries.
-- [x] 6.6 Run `tests/run.sh`, capture the exact acceptance evidence, and link the implementation PR and final behavior back to this OpenSpec change before archive.
-
-## 7. What the first implementation left (opensoft/openRepoTools#91)
-
-The unticked items above are not oversights; each is named here with what
-stands in its place today.
-
-- **1.2 / 5.3 — the coordinator base.** Only the lane CONTROL ROOT is resolved
-  (design decision 11). The coordinator-base invariant and its staged
-  enforcement are not implemented, so a lane launched from a feature worktree is
-  neither refused nor reported as one.
-- **1.4 — snapshot/history disagreement.** Every transition that follows a
-  lane-kind line is audited by that line, and the swap's own `PAUSED` is the
-  event for the handoff; `SWAPPING` has no log event by design decision 12, and
-  there is no detector that compares the two and reports a divergence.
-- **2.2 — shape-governed feature worktrees.** The inventory covers the two roots
-  a lane already owns. Worktrees at Speckit's feature-first paths are not
-  indexed, and moving them is forbidden either way.
-- **4.2 — duplicate refusal.** `lane-reconcile` REPORTS a live holder;
-  `lane-start`'s existing duplicate refusals are unchanged, and no new refusal
-  is added by this change.
-- **6.2 — races.** Competing swaps, competing resumes, stale finalizers, a
-  lifecycle write overtaken between its event line and its snapshot, and an
-  inventory write filed under a superseded operation each have a case; a live
-  duplicate WRITER on one worktree does not.
-- **6.3 — worktrees.** Dirty, unpushed, missing-and-clean, missing-with-work,
-  unknown, stale-registration, detached HEAD, a tree git answers in and cannot
-  be read through, and a sidecar whose schema this tooling does not write each
-  have a case; shape-governed paths do not, because 2.2 does not.
-- **6.4 — migration.** A lane with no snapshot answering 8 everywhere, and a
-  snapshot created by the first transition that runs, both have cases; an
-  invalid repository identity and a repeated idempotent migration do not.
-- **Cross-workstation replication** remains the open question the design states.
-  The snapshot is local to one machine by decision 10.
-
-### The sixth review round, and where each of its fourteen findings went
-
-Automated review rounds are capped at **two per pull request** (Brett Heap's
-ruling of 2026-09-16), and this change is at round six. That round was therefore
-TRIAGED rather than taken: the two findings that are safety holes this capability
-could not land with are in the branch, and the other twelve are filed as issues,
-claimed by this lane, and named below with what each costs and what decides it.
-Nothing is left as a comment thread and nothing is left unnamed.
-
-**Taken on this branch.**
-
-- **An unreadable lifecycle snapshot is no longer read as a lane that has none.**
-  `lane_state_read` answers **10** for a record that IS there and cannot be
-  opened, `lane-state` exits 10 rather than the 8 a launcher goes past, and
-  `lane-reconcile` reports `UNREADABLE` / `indeterminate`. Fail-OPEN on a crash
-  pronouncement is the one class this change exists to close (`R22`,
-  Amendment 7(d)).
-- **Every inventory write is serialized under the lane mutex.** `set-lane-tree`
-  took it only for a FENCED write; the atomic rename underneath stops a reader
-  seeing half a file and stops nothing else, so an unfenced observation could
-  land after a newer fenced one and replace it.
-
-**Filed, claimed, and deferred.**
-
-- **`opensoft/openRepoTools#113` — the four reads that still turn a failure into
-  an answer.** The holder ids (`|| :`, so an unreadable register reads as *no
-  holder* and a crash is pronounced on liveness nobody established), an
-  unreadable tree sidecar (`[ -r ] || continue`, so a record nobody can read and
-  no record at all are one silence — and one such sidecar alone answers *this
-  lane owns no worktree*), `git config --get branch.<b>.remote` (`|| :`, so a
-  failed read fabricates the local upstream `./<merge>`), and `git worktree list
-  --porcelain` (`|| :`, so a checkout whose registrations cannot be read looks
-  exactly like one with none and the report can still say `resumable`). Each
-  costs a wrong verdict or an omitted tree on exactly the machine a recovery is
-  running on; what decides them is whether `indeterminate` is the answer at
-  every one of these reads, as it already is at the holder's — a decision for
-  the round that also settles how `lane-trees` carries a row it could not read.
-  *The unreadable sidecar is taken in 8.12* — a row of its own, and the
-  `unreadable-sidecar` class; the other three reads remain. *They are taken in
-  decision 26*, with `lane-trees`' 10 for an inventory directory that cannot be
-  listed, which the reconciliation also swallowed.
-- **`opensoft/openRepoTools#114` — the inventory fence, and the partial
-  observation.** `SWAPPING -> SWAPPED` keeps the generation AND the operation by
-  design (decision 13), so `set-lane-tree --generation G --operation O` still
-  succeeds after that operation was finalized and a delayed poll overwrites the
-  completed inventory; and the *all five empty* guard means `--dirty 1` alone
-  files `upstream none, 0 unpushed` for a tree nobody read, which is the
-  clean-and-published shape decision 18 removed from the other path. The cost is
-  a superseded or invented reading that nothing downstream can tell from a
-  current one; what decides the first is whether the lifecycle STATE joins the
-  compare-and-swap (at minimum `SWAPPING`) or the operation id is invalidated at
-  finalization, and the second is whether a partial observation is a usage
-  refusal or is completed from one `lane_tree_now`. *The second is taken in
-  8.12*, as a usage refusal (64); the fence remains. *The fence is taken in
-  decision 27*: a fenced write is refused (7) where the lane reads `SWAPPED`.
-- **`opensoft/openRepoTools#115` — validation beyond the `schema:` line.**
-  `lane_sidecar_schema_ok` asks one question, so a truncated `schema: 1` file
-  with no state and no generation passes it: readers emit empty fields and
-  writers replace it, which is the act decision 17 refuses for an UNKNOWN schema
-  performed against a known one whose content is not valid. The cost is the one
-  loss no later reader can undo; what decides it is which keys, types and
-  identity each kind of sidecar requires, and whether a malformed record of a
-  known schema takes the same refusal path an unknown schema takes. *Taken in
-  decision 28*: every key its writer writes, their shapes and a tree's id, and
-  the unknown schema's refusal path on both sides.
-- **`opensoft/openRepoTools#116` — the tree's identity.** `tree_id_for` folds
-  every character outside the manifest-key set to `-` and squeezes repeats, so
-  `/tmp/a/b` and `/tmp/a-b` share one sidecar and a lane with two valid trees
-  loses one from the inventory and from every classification; and the recorded
-  `checkout` is never compared with the repository git reports, so a path
-  occupied by a different checkout on the same branch at the same commit reads
-  `ok` and a recovery relaunches a writer into it. Both cost a tree that is
-  silently the wrong tree; what decides them is an injective id — or the `cksum`
-  prefix on every path rather than on long ones only — WITH a migration for the
-  sidecars already on disk, and a repository identity that is stable across a
-  clone and answerable for a worktree. *The `cksum` prefix on every path is
-  taken in 8.12*, with no migration, because no released tooling has written a
-  sidecar; the `checkout` comparison remains.
-- **`opensoft/openRepoTools#117` — what the READY line and the report claim.**
-  `writer_count` rises before the observation and the sidecar write are known to
-  have worked, so the READY line says *N worktree(s) recorded* for trees
-  `lane-trees` does not carry; and the seen-set is seeded from every sidecar
-  before the registration sweep, so a tree that WAS inventoried and whose
-  directory is gone is reported `missing`/`possible-loss` and never
-  `stale-registration`, with the `git worktree prune` remedy omitted and the
-  estate's `resume` left to fail on it. The cost is a completeness signal a
-  recovery operator should not trust; what decides the second is the tension
-  with *one tree, one row* (`612ba5c`) — whether one row can carry both facts,
-  or the registered-but-gone case is decided before the path is deduplicated.
-- **`opensoft/openRepoTools#118` — `lane-handoff` takes a `CLOSED` lane to
-  `SWAPPING`.** `--expect` asks only *has the lane moved since I read it*, so
-  every state is a legal source for the swap transition and a terminal lane is
-  reopened, polled, and finished at `SWAPPED` with a `PAUSED` record appended.
-  The cost is a lifecycle that says a swap is what last happened to a lane that
-  was ended; what decides it is a ruling rather than a guard, because
-  `R-A11-11` binds this command — *a swap is never left unwritten* — so refusing
-  the handoff would be the first time the lifecycle stopped the swap, and
-  declining the transition silently would leave a `PAUSED` record beside a
-  `CLOSED` snapshot.
-- **`opensoft/openRepoTools#157` — the lifecycle reads fetch first.**
-  `lane-reconcile`, `lane-state`, `lane-trees` and `managed-projection` run
-  `log_sync` before they read, as every read in `lanes-edit.sh` does, so a
-  direct call offline waits up to `LANES_GIT_TIMEOUT` before reading the ref as
-  it stands. Kept here because the binding, the alias table and the marker they
-  read are published state a stale ref misreports; `LANES_NO_FETCH=1` is the
-  opt-out `lane-start` already uses. What decides it is which default an
-  operator's recovery read during an outage should have.
-- **`opensoft/openRepoTools#157`, its second finding — a second swap supersedes
-  a live one.** `lifecycle_begin` (`lane-handoff:426-435`) takes over any lane
-  still recorded `SWAPPING`, which is design.md's settled answer for an
-  interrupted swap. It cannot tell a live operation from an interrupted one:
-  that takes the handoff process's liveness, which the snapshot does not
-  record, and design.md's risks rule out a PID alone. The fence bounds the
-  harm: the superseded operation's finalizer and inventory writes are refused
-  with 7 (repoRC-2, repoRC-3, repoRC-5). The spec's "Competing swap begins"
-  scenario now says that, rather than promising no new owner is minted. What
-  decides it is a liveness record for the handoff process that a second
-  handoff can read and trust; 6.2 stays open for it.
-
-## 8. The rework of 2026-10-04 — managed ledger owns enrolled lanes; this change owns legacy
-
-Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled lanes; #97 owns legacy — rework both".
-
-- [x] 8.1 Merge `origin/main` (`daed209`) into the branch with every intent of both sides kept, and no rebase.
-- [x] 8.2 Move the unreadable-snapshot exit from 9 (spent by `main`'s #61 on `claim --force`) to 10 (design decision 22).
-- [x] 8.3 Close the snapshot of a lane retired by Amendment 19's sweep, which appends its lines without `write_event` (decision 24).
-- [x] 8.4 Stop claiming the log keeps five lane-kind verbs; Amendment 18(g) added `HANDOFF-REQUESTED` (decision 12 reworded).
-- [x] 8.5 Report a lane bound elsewhere as `indeterminate`, never a crash or a clearance (Amendment 18(b), decision 23).
-- [x] 8.6 Carry a renamed lane's control root to its new name (Amendment 16, decision 24).
-- [x] 8.7 Port `3c26041:lanes-edit.sh:776-898` verbatim; add `lane_is_managed_owned` and `managed-projection` (decision 21).
-- [x] 8.8 Refuse a managed lane (2) and an unknown one (1) before the first write of every act decision 21 lists, and refuse the marker's vocabulary in every legacy row writer.
-- [x] 8.9 Move the lifecycle only on a legacy verdict and an unchanged pre-image.
-- [x] 8.10 Document the seam in the manual, the proposal, this design and the spec.
-- [x] 8.11 Prove each act on a valid long marker, a valid shorthand, a legacy row and five malformed rows, with zero change on every refusal, and leave every existing assertion of this change's suite section unchanged.
-- [x] 8.12 Take Codex's four inventory findings on `ec9847e` (decision 25): `lane-start` reports a `resumable` lane whose trees need reading; `set-lane-tree` refuses a partial observation with 64 (#114's second half); every tree id carries a `cksum` of its whole path (#116's first half); and an unreadable tree sidecar is a row of `lane-trees` and an `unreadable-sidecar` class of the reconciliation (#113's second read).
-- [x] 8.13 Refuse a managed or unknown row in Amendment 13(e)'s `migrate-state-cells` before its plan is built, aborting the whole migration (Copilot round 2 on #97), with zero change proved in the seam section's case 6.
-- [x] 8.14 Close the seam on every legacy writer arm (Copilot round 3 on #97, taken as seam completeness under the ruling): every lane-kind log line, `request-handoff` (`--dry-run` included), `archive-rows`, `append-session-id` and `add-row` for an existing lane refuse a managed or unknown lane. `append-line`, `append-session-id`'s text and `rename-lane`'s new name refuse the marker's vocabulary. The refusal reads this checkout's row as well as the published one. Each arm is proved on every managed and unknown fixture with zero change.
diff --git a/openspec/changes/add-supervised-context-restart/.openspec.yaml b/openspec/changes/add-supervised-context-restart/.openspec.yaml
deleted file mode 100644
index 96db9a43..00000000
--- a/openspec/changes/add-supervised-context-restart/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-09-15
diff --git a/openspec/changes/add-supervised-context-restart/design.md b/openspec/changes/add-supervised-context-restart/design.md
deleted file mode 100644
index 80cee759..00000000
--- a/openspec/changes/add-supervised-context-restart/design.md
+++ /dev/null
@@ -1,251 +0,0 @@
-> Current authority: [2026-10-04 legacy decision](legacy-authority-decision.md).
-> Earlier shared #97 lifecycle/counter designs below are superseded. The
-> implementation contract is `specs/005-supervised-legacy-ctx/spec.md`.
-
-## Context
-
-`/ctx` is a semantic context rollover: the current Claude coordinator captures its reasoning, polls writers, refreshes the lane handoff, records the lane as paused, and starts a new Claude transcript whose first prompt is the handoff's top block. The shipped tail calls `tmux respawn-pane -k` with `lane <name>` or `pclaude` and exits successfully when tmux accepts that command. Tmux acceptance says nothing about whether the child selected an attach-only path, resolved a profile, executed Claude, remained alive, or consumed the intended handoff.
-
-A measured run completed the preservation side and killed the old process but produced no replacement session. The valid handoff made manual recovery possible, but the pane and launch error disappeared. Three related facts make this more than a missing error check:
-
-- the fresh-session requirement currently exists only as `LANE_START_FRESH=1` in the attempted command;
-- `lane-start` records the lane `LIVE` before its final `exec`;
-- `lane` is a human dispatcher whose valid outcomes include selecting or attaching to an existing session without launching anything.
-
-**Measured before implementation (`opensoft/openRepoTools#94`, Eagle 2026-09-15T20:59Z).** The first of those three is not merely weak, it is *broken across the launcher boundary*. `claude-profile` re-creates its child through tmux, and its own `act1_compose_child_command` says why that matters: *"`tmux new-session` hands the command the SERVER's environment, not this client's, so a variable the operator exported in their own shell reaches the child only if it is written into the command string"*. It threads six values in explicitly; `LANE_START_FRESH` is not among them, so the respawn's fresh-session requirement was dropped at a boundary this repository does not own, and the pane came up resuming the transcript the `/ctx` had just paused. `lane-start`'s own `(( ! fresh ))` gates were correct and were simply never reached with `fresh` set. This is why decision 3's intent file is the *authority* and not a convenience, and why decision 6's environment seam is documented as a compatibility detail from the start rather than as a mechanism.
-
-This change depends on the generation and operation fencing introduced by `add-crash-consistent-lane-worktree-recovery`. It supplies the reliable execution primitive required before `add-automatic-context-rollover` may act at 65% context. Bash 3.2, Linux, macOS, WSL2, existing lane records, the read-only SessionStart hook contract, and non-destructive worktree behavior remain constraints.
-
-## Goals / Non-Goals
-
-**Goals:**
-
-- Preserve the one-command `/ctx` experience on success.
-- Refuse before killing the old process when semantic preparation, lifecycle ownership, or any mandatory preservation write fails.
-- Persist the exact fresh launch as operation-scoped data before process replacement.
-- Keep a process in the pane that can display and retry every post-handoff launch failure.
-- Launch through a narrow operation consumer rather than the human-facing `lane` dispatcher.
-- Mark a lane `RUNNING` only after positive replacement identity and liveness evidence.
-- Make restart retries idempotent and reject stale operations and competing owners.
-- Make the end-to-end behavior testable without a real GitHub repository or real Claude account.
-
-**Non-Goals:**
-
-- Replacing Claude's semantic handoff with a shell-generated summary.
-- Interrupting an active turn or implementing the 65% threshold controller.
-- Adding a continuously running machine-wide daemon.
-- Rebuilding or modifying Git worktrees outside the existing estate and recovery contracts.
-- Making profile part of stable lane identity.
-- Changing the generic SessionStart hook into a blocking or networked writer.
-
-## Decisions
-
-### 1. Split semantic preparation from the mechanical restart transaction
-
-The handoff skill SHALL produce the human narrative, writer replies, and a machine-readable staged payload. It SHALL then call one backend operation. The backend SHALL own identity validation, generation acquisition, lifecycle transitions, canonical handoff replacement, protocol records, restart intent, tmux replacement, and result classification.
-
-The staged payload is not yet the canonical handoff and cannot authorize a restart. This allows the model to finish semantic work before the backend acquires the lane lock while preventing a model-authored shell recipe from becoming a second implementation of the destructive tail.
-
-Alternative considered: retain executable tmux recipes in the skill. That preserves flexibility but caused the current implementation to have overlapping orchestration paths and makes exact failure behavior dependent on how the model follows prose.
-
-### 2. Treat lifecycle ownership as a hard precondition
-
-The backend SHALL compare-and-swap the current lane from `RUNNING` to `SWAPPING` under the prerequisite change's lane lock. Failure to read state, acquire the lock, match the expected generation, or establish the current owner SHALL refuse the restart while the old process remains alive.
-
-An ordinary `/ctx` SHALL NOT supersede an existing `SWAPPING` operation. Takeover requires a separately named recovery action that first proves there is no matching live holder, retains the interrupted operation in history, and advances generation under lock.
-
-Alternative considered: allow the semantic handoff and pause records to continue when lifecycle state cannot be written. That retains a best-effort handoff but permits competing operations to kill each other's coordinators, defeating generation fencing.
-
-### 3. Preserve the existing swap states and add an operation-scoped restart intent
-
-The lane lifecycle remains:
-
-```text
-RUNNING -> SWAPPING -> SWAPPED -> RUNNING
-```
-
-The launch interval is represented by a restart-intent sidecar beneath the lane control root rather than a new top-level `STARTING` state. The intent has states `pending`, `starting`, `failed`, and `ready`. While it is `pending`, `starting`, or `failed`, the lane remains `SWAPPED`; only positive readiness moves the lane to `RUNNING`.
-
-The intent includes schema version, lane, generation, operation ID, old transcript, agent, profile, canonical directory, handoff path and digest, launch mode `fresh-from-handoff`, pane binding, timestamps, attempt count, and bounded failure diagnostics. It contains no credentials. All writes use atomic replacement under the lane lock. Callers use `lanes-edit.sh` operations rather than parsing or rewriting the YAML themselves.
-
-This makes the fresh-session requirement durable and retryable without expanding the top-level state machine needed by other lane operations.
-
-### 4. Make `SWAPPED` and restart intent one pre-kill commit point
-
-The guarded backend performs these acts in order:
-
-1. validate the current lane/transcript/pane/directory identity;
-2. acquire `RUNNING -> SWAPPING`, minting generation and operation ID;
-3. verify the staged semantic payload and snapshot the current writer/worktree evidence;
-4. refresh the canonical handoff and complete all mandatory protocol and lifecycle writes;
-5. atomically create `pending` restart intent for the same generation and operation;
-6. finalize the lifecycle to `SWAPPED` only when both preservation and intent are readable and consistent;
-7. preflight the absolute supervisor executable and tmux target;
-8. ask tmux to replace the pane with the supervisor for that exact operation.
-
-Any failure through step 7 refuses without intentionally killing the old process. A tmux refusal leaves the lane `SWAPPED` with pending intent and the old process still present; the command reports the explicit terminal recovery command. Once tmux accepts step 8, the supervisor—not the old Claude—owns recovery.
-
-Alternative considered: create restart intent after respawn. The originating process may already be dead, recreating the unrecorded launch gap this change exists to remove.
-
-### 5. Use a restart-only pane supervisor owned by openRepoTools
-
-The first implementation adds an openRepoTools command such as `lane-restart-supervisor`. Tmux starts it by absolute installed path with only lane and operation identifiers. The supervisor validates the pending intent and changes it to `starting` with compare-and-swap semantics before launching anything.
-
-The supervisor invokes the installed profile launcher as a child, supplying the recorded lane, profile, directory, and fresh-from-handoff operation. It never invokes `lane`, never runs a picker, and never rediscovers launch choices from current directory, window title, or rotating defaults. `pclaude` may still perform account configuration and execute Claude inside the child process; because the supervisor is the parent, child exit does not close the pane.
-
-The supervisor remains for the child's lifetime. Before readiness, child failure changes the intent to `failed` and leaves a diagnostic prompt in the pane. After readiness, a later normal child exit is reported and the supervisor exits according to the ordinary lane-end contract; it does not automatically relaunch an intentionally exited session.
-
-Alternative considered: modify workBenches so every `pclaude` invocation has a permanent supervisor. That may be valuable later but broadens this fix across repositories. A restart-only wrapper can be delivered and tested entirely by openRepoTools while treating `pclaude` as a child dependency.
-
-### 6. Launch by exact operation, not by human lane dispatch
-
-The supervisor passes a new explicit operation input through the launcher to `lane-start`, for example `LANE_RESTART_OPERATION=<id>` during the compatibility phase and ultimately an explicit launcher option where workBenches can expose one. `lane-start` reads all launch facts from the fenced restart intent and rejects command-line or environment values that conflict.
-
-`LANE_START_FRESH=1` may remain temporarily as an internal compatibility detail, but it is no longer the authority for deciding fresh launch. The intent's `mode: fresh-from-handoff` is authoritative. Normal `lane <name>` behavior remains unchanged for people.
-
-### 7. Confirm readiness without changing the generic SessionStart contract
-
-`lane-start` SHALL stop writing `LIVE`/`RUNNING` before `exec` for supervised operations. It may write launch-prepared identity and the intended new transcript while the lifecycle remains `SWAPPED`.
-
-The supervisor waits up to 60 seconds for a local readiness predicate that combines:
-
-- the launched child remains alive;
-- the expected new transcript has been created by the selected profile;
-- the canonical lane, agent, directory, pane, and transcript binding match the restart intent;
-- no competing live holder exists.
-
-The predicate is implemented as a read-only helper over process, transcript, register, and local sidecar evidence. It does not require the generic SessionStart hook to write or touch the network. Once the predicate succeeds, a separate supervisor-owned, generation-fenced writer atomically moves `SWAPPED` to `RUNNING`, marks the intent `ready`, and appends the normal resumed evidence.
-
-If the child exits first, readiness is `failed`. If the 60-second deadline expires while the child remains alive, the result is `indeterminate`: the supervisor does not kill the child, does not retry automatically, and does not mark `RUNNING`; it displays inspection and explicit finalize-or-stop instructions.
-
-Alternative considered: regard successful `exec` or a short grace period as readiness. Neither proves transcript creation, correct binding, or survival. A write from the generic SessionStart hook was also rejected because its read-only, always-zero contract is load-bearing.
-
-### 8. Retry the same operation and make recovery explicit
-
-When intent is `failed` and no matching child or competing holder is live, the supervisor offers a retry that compare-and-swaps the same intent back to `starting` and increments its attempt count. The retry uses the same handoff digest, generation, operation, directory, and launch mode.
-
-Stale generation, changed handoff digest, mismatched pane, or live-holder ambiguity refuses retry. Replacing or superseding the operation requires the explicit lifecycle recovery command, not an automatic fallback. No path resets, deletes, stashes, or reconstructs a worktree.
-
-### 9. Test the process boundary, not only the generated tmux string
-
-Tests SHALL run the real supervisor against fake launch children and isolated tmux-compatible harnesses. They SHALL assert process survival, state transitions, transcript/binding readiness, exact first-prompt handoff content, retries, and stale-operation refusal. Existing string-construction tests remain useful but are insufficient as the end-to-end gate.
-
-### 10. The supervisor is a MODE of `lane-handoff`, not a new word on `PATH`
-
-Decision 5 proposes "an openRepoTools command such as `lane-restart-supervisor`", installed by absolute path (tasks 4.1 and 4.6). **That contradicts Amendment 18 Addendum 2 (i-8) as ratified**, which removed `restart` from the installed set on exactly this ground: *"no word is kept on `PATH` for it alone — 'if we need it for ctx, keep it for that' is met by `lane`, which does the same thing under the one name"*, over Brett Heap's own ruling *"i do not see any reason to expose this to the user"*. A thirteenth installed word whose only caller is `/ctx` is the thing that clause refuses.
-
-The supervisor is therefore `lane-handoff --supervise --lane <lane> --operation <id>` — a mode of the command that already owns the `/ctx` transaction and is already installed. Everything the decision actually requires is kept: it is still a separate process from the launch it supervises, it is still what tmux starts, and it is still resolved **by absolute path** into the respawn line, because a respawned pane's `PATH` is whatever the person's shell profile makes of it. What is dropped is the new installed word, the twelve-file installer count it would have moved, and task 4.6's installer work, which becomes nothing to install. A person still has exactly one word, `lane`.
-
-`--restart-status <lane>` is the read-only surface of task 6.1 on the same command, for the same reason.
-
-### 11. (i-8)'s two doors are kept one level down, and `lane <name>` is not one of them for `/ctx`
-
-Clause (i-8) names two doors for the respawn: *"relaunches the lane's own pane with `lane <name>` … or through the launcher directly"*. This change respawns into the supervisor and the supervisor takes **the second door** — `pclaude --lane <lane> <profile>`, the launcher directly — falling to `lane-start` itself where the workstation has no launcher or the lane's record names no profile.
-
-The first door is not used for `/ctx` any more, and the reason is measured rather than argued. `lane <name>` is the human dispatcher: its valid outcomes include attaching to a live session and refusing, and the spec's requirement *Internal restart bypasses human lane dispatch* is incompatible with it. It was also the door through which #94 happened, because the fresh-session requirement it was asked to carry was an environment variable it could not protect.
-
-**This is a deviation from in-force protocol text and it is not treated as ratified by this proposal.** Task 7.4 owes an amendment (an addendum to Amendment 18 Addendum 2, or to Amendment 17(f)) that authorises a supervised respawn and a durable restart intent. Until that is ratified the implementation is what it is and the divergence is named here, in the pull request, and in `lane-handoff`'s own comment at the respawn.
-
-### 12. `RUNNING` before `exec` is scoped to #91's lifecycle, never to Amendment 8(d)'s `RESUMED`
-
-Decision 7 says `lane-start` "SHALL stop writing `LIVE`/`RUNNING` before `exec` for supervised operations". Read widely that would repeal **Amendment 8(d)**, which makes `lane-start` the writer of the row stamp, the object log's `RESUMED`/`STARTED` line and the handoff's Rule 3 stamp, *before* the launch and deliberately — *"on a restart the session makes no register write at all"*. Those three are the append-only record of an act that did happen (a launch was prepared and made), every other lane reads them, and removing them would break `swapped`, the launcher's own resolution and Rule 3's stamp in one move.
-
-So the decision is scoped: what must not be written before readiness is **#91's lifecycle snapshot** — the `RUNNING` word in `lane-state.yaml`, which is the thing that means *this lane has a confirmed holder*. On a workstation where #91 has landed, `lane_state_follow` moves the snapshot to `RUNNING` on any `STARTED`/`RESUMED` line, and reconciling that with this change is work #91's own branch must take when the two merge; this change's supervisor writes `SWAPPED → RUNNING` itself, fenced, only after readiness, and its finalizer's `--expect SWAPPED` is what refuses a snapshot something else already moved.
-
-**Honest residual, stated rather than hidden:** on `main` today there is no lifecycle snapshot at all, so between `lane-start`'s pre-`exec` `RESUMED` and the supervisor's readiness confirmation the register row reads as running while the restart intent still reads `starting`. The spec's *Swapped state remains non-running until readiness* is therefore met **in the restart intent, which this change owns**, and only met in the lane's lifecycle once #91 lands. Nothing in this change marks a lane ready on anything but positive evidence, which is the property the requirement exists for.
-
-### 13. The lifecycle is fail-closed on the KILL and fail-open on the RECORD
-
-Decision 2 and task 1.3 ask for fail-closed lifecycle ownership: refuse when state cannot be read, locked or compare-and-swapped. #91's landed integration is explicitly the opposite — *"THE LIFECYCLE NEVER REFUSES THE SWAP"* — and it supersedes an interrupted `SWAPPING` rather than refusing it, citing that a swap is never left unwritten (Amendment 8(a) step 4; the rule is `R-A11-5`, which this repository's own comments mis-cite as `R-A11-11`).
-
-Both are right about different acts, and the reconciliation is the line Amendment 17(f) already draws:
-
-- **The record is never refused.** The handoff, the `PAUSED` line and the row's state cell are written on every path, with any gap named in the handoff. #91's fail-open lifecycle stands.
-- **The kill is always refused** when the record is incomplete: *"a `/ctx` whose record could not be written REFUSES before it kills anything (a pane is never respawned over an unrecorded lane)"*. This change adds the restart intent to that record — a pane respawned with no intent has a supervisor with nothing to launch from, which is the same unrecorded restart one step along — so the intent is the fourth gate beside the `PAUSED` line, the row and the handoff, and it is checked, written, and **read back**, before tmux is asked for anything.
-
-A second `/ctx` over an operation that is still `pending` or `starting` is refused by the intent's own compare-and-swap (`--expect 'none|ready|failed'`), which is the spec's *ordinary `/ctx` does not supersede an existing operation* expressed as one argument, and it refuses **before** the kill rather than after it.
-
-### 14. The restart intent lands without waiting for #91, under #91's control root
-
-Task 1.1 assumes the prerequisite has landed. It has not: `add-crash-consistent-lane-worktree-recovery` is in flight on its own branch with its own writer. Blocking a measured, reproducible defect on another change's merge is the worse trade, so the restart intent is implemented now as a **sibling sidecar** — `restart-intent.yaml` beside `lane-state.yaml` — under a `lane_control_root` written byte-identical to #91's three rungs (`$LANES_LANE_STATE_ROOT`, the lane checkout's parent `.lane-state/<lane>`, `$PROJECTS_ROOT/.lane-state/<lane>`), with the same flat `key: value` grammar, the same atomic replace, the same `lane_op_id` shape and the same exit-code contract (0/1/2/**7 fence lost**/8/64).
-
-The merge of the two branches is therefore a textual conflict whose resolution is *keep either copy of the four shared helpers*, and no second scheme is created. The generation the intent carries is read from #91's `lane-state` where the workstation has it and is `0` where it does not, which is what a workstation before that change can honestly say.
-
-### 15. Readiness is proved from evidence `main` actually has
-
-Decision 7's predicate names "the expected new transcript has been created by the selected profile". On `main` the readable, positive form of that is the workstation's own live-session records, read through `lanes-edit.sh live-holder <lane>`, which is the same read every other collision check in this estate makes. The predicate is therefore: the child is alive; exactly one live holder answers for the lane (a second is Amendment 18(h)'s collision, and a restart that confirmed itself with two processes answering would be the tooling making the very thing the protocol refuses); that holder's transcript is the one `lane-start` recorded it was about to make, or at minimum is **not** the transcript the `/ctx` paused; and it is in the pane the intent names.
-
-Decision 7 also has the supervisor "display inspection and finalize-or-stop instructions" on an indeterminate. It **writes** them instead, into the intent's bounded `reason`, because the child is an interactive terminal program that owns the pane's screen and a line printed over a running Claude is a line nobody reads. `lane-handoff --restart-status --lane <lane>` from any other window is where it is read, and the supervisor prints the same thing in the pane the moment the child exits.
-
-## Risks / Trade-offs
-
-- **[Risk] The supervisor and interactive child contend for the terminal** → Launch the child in the foreground with the supervisor blocked in `wait`; print only before launch and after child exit or timeout handling through a separate observation path.
-- **[Risk] Transcript creation is delayed on a slow machine** → Use a 60-second readiness deadline, preserve an alive child on timeout, and classify the result as indeterminate rather than failed or running.
-- **[Risk] pclaude does not yet expose an operation option** → Thread an operation environment variable through its existing environment-preservation seam first, then add an explicit option in coordinated workBenches work without making the environment value authoritative by itself.
-- **[Risk] Local sidecar and shared lane records disagree** → Fence all finalization on generation and operation, report disagreement, and retain the intent and handoff for recovery.
-- **[Risk] Strict refusal leaves an interrupted `SWAPPING` lane requiring attention** → Provide a read-only reconciliation report and separately named takeover action; never let ordinary `/ctx` silently seize it.
-- **[Risk] The handoff changes after intent creation** → Store and verify its digest on every launch and retry.
-- **[Risk] Automatic rollover mistakes tmux acceptance for completion** → Expose completion only from the readiness-gated `RUNNING` transition and make the automatic controller consume that outcome.
-
-## Migration Plan
-
-1. Land the prerequisite lifecycle operations with fail-closed compare-and-swap behavior; do not merge the current fail-open handoff integration.
-2. Add restart-intent read/write/CAS operations and read-only status reporting without changing current `/ctx`.
-3. Add the supervisor, exact-operation launch path, and fake-child tests behind an opt-in environment gate.
-4. Refactor supervised `lane-start` so pre-exec work cannot write `RUNNING`; add readiness and finalization tests.
-5. Switch manual `/ctx` to stage semantic input and invoke the guarded supervised backend. Retain a documented `/handoff` plus manual terminal launch as rollback.
-6. Install the supervisor alongside the other openRepoTools commands and verify absolute-path resolution on Linux, macOS, and WSL2.
-7. Run a manual canary that proves both successful continuation and visible child-launch failure before enabling the behavior globally.
-8. Update `add-automatic-context-rollover` to require supervised readiness completion, then canary automatic rollover separately.
-
-Rollback disables supervised respawn and returns `/ctx` to warning plus non-restarting `/handoff`; it does not restore the unsafe direct self-respawn. Pending intents and lifecycle history remain for diagnosis and can be closed only through explicit recovery.
-
-## Open Questions
-
-- Should successful readiness archive old restart intents immediately or retain a bounded per-lane history outside the append-only event log?
-- What explicit operator command names best distinguish retry, finalize an indeterminate-but-valid child, cancel, and generation-advancing recovery?
-- When workBenches adds a first-class operation option, should the compatibility environment seam be removed immediately or after one release overlap?
-
-
-### 2026-10-05 preparation recovery correction
-
-Exact-head Codex review on PR #121 identified that failed preparation was being
-routed to a supervisor which correctly refuses preservation-only mode. Within
-the approved legacy scope, distinguish a never-launched failed preparation from
-a failed fresh launch. Normal resume may recover the former only with strict
-all-holder absence, no operation/attempt tokens, attempt 0 and no new transcript.
-Recheck the same operation/generation and qualifying fields before binding acts
-and before exec. Preserve the failed intent as diagnostics; never label it ready
-or import its counters into ordinary resume. These checks retain normal launch
-safeguards and do not create an atomic ordinary-launch reservation. Failed
-supervised launches and preparing reservations remain refused by ordinary resume.
-
-
-### 2026-10-05 durable restart control-root correction
-
-Exact-head Codex review at b20882a identified a reservation whose initial
-projects-root fallback changes after PAUSED first records a nested checkout.
-Keep restart intent discovery bounded to the recorded-checkout and projects-root
-candidates: a sole existing physical intent retains authority independently of
-state or validity; distinct occupied intent locations or unreadable ancestry
-refuse. Aliases of the same control-root directory count once; leaf symlinks and
-hardlinks in distinct directories refuse because atomic replacement would split
-their records. An explicit state-root override remains authoritative,
-and checkout hints remain a last resort when no established rung exists.
-Root selection and CAS run under the same writer mutex. This fixes completion,
-cleanup and later readers without an environment-only pin or a new pointer/schema.
-PR #97 diagnostic roots remain unchanged: restart storage can retain its original
-fallback while diagnostics follow the recorded checkout. Broader root discovery
-and explicit checkout hint creation remain deferred in #159.
-
-
-### 2026-10-05 reconciliation with landed derived index (#164)
-
-Main fea9a29 adds Amendment 14's derived lane index. Retain its landed
-implementation and published read flags, while restart ownership, CAS, holder
-checks and launch decisions continue to read their existing sources. No restart
-act enables the index. Its detached post-push nudge remains non-gating. Both
-appended shell-suite sections are retained, with the incoming index section
-before the supervised restart section so the former's snapshot/restore cases
-finish before the latter creates its intent fixtures. This is integration of
-landed main within the approved scope, not a new restart authority.
diff --git a/openspec/changes/add-supervised-context-restart/legacy-authority-decision.md b/openspec/changes/add-supervised-context-restart/legacy-authority-decision.md
deleted file mode 100644
index 9685c3cb..00000000
--- a/openspec/changes/add-supervised-context-restart/legacy-authority-decision.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# PR #121 authority decision — 2026-10-04
-
-Brett Heap selected: “Legacy compatibility; refuse managed lanes”.
-
-The approved scope is supervised manual context restart for confirmed legacy
-lanes. The YAML intent is legacy-only restart bookkeeping. It never supplies
-managed lifecycle/readiness, managed generation/operation counters, or PR #97
-lifecycle transitions. A managed or unknown ownership answer refuses before
-canonical preservation writes or launch. PR #97 remains separate work owned
-by openRepoTools-3.
-
-This decision supersedes earlier shared-lifecycle/counter proposals in this
-change. Those proposals are design history, not the current implementation
-contract. The implementation handoff is exactly one Speckit feature:
-`specs/005-supervised-legacy-ctx/`. Its spec, plan and tasks own completion and
-validation. OpenSpec records governance, scope and this handoff.
-
-This decision authorizes rework of PR #121, not release of the existing merge
-hold, deployment, automatic rollover or a destructive real-session canary.
diff --git a/openspec/changes/add-supervised-context-restart/proposal.md b/openspec/changes/add-supervised-context-restart/proposal.md
deleted file mode 100644
index e14d8f7a..00000000
--- a/openspec/changes/add-supervised-context-restart/proposal.md
+++ /dev/null
@@ -1,65 +0,0 @@
-> Current authority: [2026-10-04 legacy decision](legacy-authority-decision.md).
-> Earlier shared #97 lifecycle/counter designs below are superseded. The
-> implementation contract is `specs/005-supervised-legacy-ctx/spec.md`.
-
-## Why
-
-`/ctx` currently kills its own pane after writing a handoff and treats `tmux respawn-pane` accepting a command as proof that a fresh Claude session started. A measured failure left the lane `PAUSED` with a valid handoff but no replacement process or visible error, and the planned automatic 65% rollover would reproduce that unsafe boundary without a stronger restart primitive.
-
-**The measured failure is `opensoft/openRepoTools#94`** (Eagle, 2026-09-15T20:59Z, lane `openRepoTools-3`), and the cause was established before this change was implemented rather than inferred from it. `/ctx` respawned its own pane with `LANE_START_FRESH=1 … lane openRepoTools-3` and what came up was `claude --name openRepoTools-3 --resume <the uuid the /ctx had just paused>`. `lane-start` was not at fault — both of its `(( ! fresh ))` gates are present in the installed copy and in PR #87's branch version — and neither was `lane`, whose available branch ends in a plain `exec`. The variable never arrived: the installed launcher re-creates its child through tmux, and `claude-profile`'s own `act1_compose_child_command` states the rule it has to obey — *"`tmux new-session` hands the command the SERVER's environment, not this client's, so a variable the operator exported in their own shell reaches the child only if it is written into the command string"* — which is why it threads six values explicitly, and `LANE_START_FRESH` is not one of them. The defect capture's window, `claude-max-001-20260915205926-456327:@6`, is that launcher's own `claude-<profile>-<timestamp>-<pid>` pattern, so this is what happened rather than what might have.
-
-Two consequences follow, and they are what this change is:
-
-- **An environment seam cannot carry the fresh-session requirement**, because the boundary it must cross belongs to another repository; a seventh threaded variable would move the same fragility one release along. The requirement becomes a durable restart intent on disk, written before the old process is killed and read back whatever the environment did.
-- **Nothing noticed**, because what tmux started *was* the launch: a launch that ends takes the pane with it. Amendment 11's own invariant is *"No path the launcher opened exits the pane"*, and `/ctx` opened a path that did.
-
-## What Changes
-
-- Make context restart a generation-fenced transaction that preserves exact fresh-session launch intent before replacing the old process.
-- Replace direct respawn into the human-facing `lane` dispatcher with a pane-resident supervisor and a narrow internal launch operation.
-- Keep a diagnostic and retry surface alive when profile resolution, launcher execution, Claude startup, or readiness confirmation fails.
-- Keep the lane non-running until the replacement's transcript, agent, directory, binding, and liveness are positively confirmed.
-- Require lifecycle ownership and mandatory preservation writes to succeed before `/ctx` can kill the current process.
-- Separate model-authored semantic handoff preparation from deterministic state, tmux, launch, and retry mechanics.
-- Add real process-lifecycle tests that distinguish tmux command acceptance from a confirmed replacement session.
-
-## Capabilities
-
-### New Capabilities
-
-- `supervised-context-restart`: Defines the guarded `/ctx` transaction, durable restart intent, surviving pane supervisor, internal fresh-session launch, readiness confirmation, and idempotent failure recovery.
-
-### Modified Capabilities
-
-None. This repository currently has no baseline OpenSpec capabilities; relationships to the in-progress crash-recovery and automatic-rollover changes are expressed as dependencies rather than fictional baseline modifications.
-
-## Dependencies and cross-links
-
-- **`opensoft/openRepoTools#94`** — the measured failure this change answers. Its root cause is quoted above and recorded as a comment on the issue.
-- **`opensoft/openRepoTools#91`** (`add-crash-consistent-lane-worktree-recovery`) — the lane control root, the `RUNNING → SWAPPING → SWAPPED → CLOSED` lifecycle and the generation/operation fence the restart intent is meant to sit beside. That change is in flight as **pull request `opensoft/openRepoTools#97`** on `feat/crash-consistent-lane-worktree-recovery` and is **not on `main`**, so the restart intent is implemented as a sibling sidecar under the *same* control root, resolved by a `lane_control_root` written to be byte-identical to #91's, and the `SWAPPED → RUNNING` finalization is made through #91's `set-lane-state` **where the workstation has it** and skipped in silence where it does not. Nothing here blocks on #91 landing, and nothing here re-implements it.
-- **`add-automatic-context-rollover`** — consumes this change's readiness-confirmed completion rather than raw `respawn-pane` acceptance.
-- **Lane collision protocol** — Amendment 17(f) (the record before the kill), Amendment 17 Addendum 1 (h)–(k) (the kind, the writer count, one worktree one writer), Amendment 18(h) (one binding), Amendment 18 Addendum 2 (i-8) (the respawn's two doors, and *"no word is kept on `PATH` for it alone"*), Amendment 8(f) (ending somebody's process is not a boundary script's act), Amendment 8(a) step 4 / `R-A11-5` (a swap is never left unwritten) and `R-A8-1` (the `SessionStart` hook never writes, never touches the network, always exits 0).
-
-## Review verdicts — the implementation against the documents it came from
-
-Brett Heap's brainstorm packet (`ideation/brainstorm/supervised-context-restart-*.md`, captured 2026-09-15) is committed with this change, as `opensoft/openRepoTools#97` committed its own. Each document was read against what shipped, and where the two differ the difference is a numbered decision in `design.md` rather than a silence.
-
-| document | verdict |
-|---|---|
-| `ideation/README.md` | **matches**, carried with the one bullet this branch's files answer to. Brett's working copy lists three packets; the other two are committed by their own changes (#97 carries the crash-recovery packet), and a link to a document no branch has is worse than a list that grows one packet at a time. The merge with #97's copy is a union of the bullets. |
-| `…-overview.md` | **matches.** Every goal and every non-goal is honoured, and two of the non-goals are honoured by refusal rather than by omission: *"Making the human-facing `lane` dispatcher a narrower internal API"* — `lane` is not touched at all, the restart simply stops calling it (decision 11); and *"Adding a continuously polling system daemon"* — the supervisor exists for ONE operation and ends with its child. Its system model's `STARTING` box is answered as the alternative the document itself offers: no fifth lifecycle word, a fenced attempt beneath `SWAPPED` (decision 3). Its open question *"whether the supervisor belongs in openRepoTools or workBenches"* is answered openRepoTools, and narrowed by decision 10 to not being a new word anywhere. |
-| `…-durable-intent.md` | **matches, with its field spellings changed and six fields added.** Its YAML sample writes `operation_id`, `directory` and `requested_at`; the record writes `operation`, `dir` and `created`, because it shares its grammar, its reader, its atomic replace and its three-rung control root with #91's `lane-state.yaml` byte for byte (decision 14), and a second spelling of one estate's fields is a second scheme. Six fields are added, each because a requirement of this change cannot be checked without it: `digest` (*a changed handoff blocks launch*), `pane` and `window` (the supervisor must prove it stands in the pane the `/ctx` respawned), `new_transcript` (readiness has nothing to confirm against otherwise), `attempt`, and `workstation`. Its open question *"which failure details are safe to persist without capturing credentials"* is answered by construction — there is no credential field and the profile is a manifest key, asserted by a test. Its *"can an operator cancel a pending restart"* is **not** answered: task 6.5, open. |
-| `…-pane-supervisor.md` | **deviates, recorded as decision 10.** It proposes a new command, `lane-restart-supervisor --lane <lane> --operation <id>`. Amendment 18 Addendum 2 (i-8) took `restart` off `PATH` on the ground that *"no word is kept on `PATH` for it alone"*, so the supervisor is `lane-handoff --supervise --lane <lane> --operation <id>` — everything the document requires (a separate process, the thing tmux starts, resolved by absolute path, the launcher as its child, never `lane`, never a picker) and nothing added to a person's `PATH`. Its *"a cancellation or inspection command where supported"* is half-delivered: retry, read and by-hand are printed; cancel is task 6.5. Its open question *"remain for the full Claude lifetime or only through confirmed startup"* is answered — the full lifetime, and a child that exits AFTER readiness is reported and never relaunched. |
-| `…-semantic-mechanical-boundary.md` | **partly delivered, and the missing half is named.** Its phase 2 lands whole: `/ctx`'s skill step is one command and the executable `tmux respawn-pane` recipe is gone from it, which is the document's own *"allows a session to reconstruct the destructive tail instead of calling one authoritative transaction"*. Its phase 1 **structured staged payload does not** — tasks 3.1–3.3, open, listed as deferred in `tasks.md` §0. The model's semantic work still reaches the backend as the handoff file it wrote and the writers it polled, not as an operation-scoped payload with binding checks. |
-| `…-startup-confirmation.md` | **matches, with the evidence narrowed to what `main` can actually prove** (decision 15). It asks for nine facts; the predicate asks four — the child alive, exactly one live holder of the lane, that holder's transcript the one `lane-start` recorded it was preparing (or at minimum NOT the one the `/ctx` paused), and the pane. Agent, profile and directory are fenced *earlier*, where a conflict refuses the launch before it is made, rather than re-checked after. Its *"Only confirmation may write `RUNNING`"* is scoped by decision 12 — it is #91's lifecycle snapshot that waits, never Amendment 8(d)'s append-only `RESUMED` line, whose removal would break three other readers — and the residual that follows on a `main` with no snapshot is stated there rather than hidden. Its *"how long may `STARTING` remain"* is answered: 60 seconds, then INDETERMINATE, which kills nothing. |
-| `…-synthesis-reliable-rollover.md` | **matches**, with one collision resolved: its *"Failures before `SWAPPED` preserve the old session wherever it is still alive"* meets #91's landed *"THE LIFECYCLE NEVER REFUSES THE SWAP"*. Decision 13 draws the line Amendment 17(f) already draws — the RECORD is never refused, the KILL always is when the record is incomplete — so both are kept and neither is overruled. |
-| `proposal.md` | **matches**, extended with the measured cause and a dependencies/cross-links section. No line of the original was removed. |
-| `design.md` | decisions 1–9 stand as written; **decisions 10–15 are added**, one per deviation. Two of the original decisions could not be taken as written — decision 5's new installed command, and decision 7's unscoped *"stop writing `LIVE`/`RUNNING` before `exec`"* — and each is answered in place, beside the text it qualifies, rather than quietly. |
-| `specs/supervised-context-restart/spec.md` | four requirements **extended** (the intent as the authority, with #94's launcher boundary as the reason; the supervisor as a mode and not a `PATH` word; the pane invariant and the never-kill rule; the first prompt holding *with no fresh-session environment variable present at all*), and three scenarios added — one of them #94's own measured case. No requirement and no scenario was removed. |
-| `tasks.md` | 29 of 46 ticked. §0 is added, naming what this slice landed and what it did not with a reason for each, and three tasks are **rewritten rather than ticked as written** (4.1, 4.6 and 5.1) and say so in their own lines. |
-
-**The one deviation from in-force protocol text**, and it is not treated as ratified by this change: Amendment 18 Addendum 2 (i-8) names two doors for the `/ctx` respawn — `lane <name>`, *"or through the launcher directly"* — and this change respawns into neither, because what tmux now starts is the supervisor. The supervisor then takes the clause's SECOND door. The clause's stated ground (*no word on `PATH` for it alone*) is honoured exactly; its stated mechanism is not. Task 7.4 owes the amendment, and the divergence is named in `design.md` decisions 10 and 11, in `lane-handoff`'s own comment at the respawn, and in this change's pull request.
-
-## Impact
-
-The change affects `commands/ctx.md`, the handoff skill, `lane-handoff`, `lane-start`, `lanes-edit.sh`, lane lifecycle sidecars, tmux process management, and lane helper tests. It introduces an integration boundary with the installed `pclaude` launcher owned by workBenches: either the new supervisor invokes that launcher as a child, or coordinated work there supplies the equivalent non-`exec` supervision seam. The `add-crash-consistent-lane-worktree-recovery` change must expose fail-closed transition ownership, and `add-automatic-context-rollover` must depend on confirmed supervised restart rather than raw respawn acceptance.
diff --git a/openspec/changes/add-supervised-context-restart/specs/supervised-context-restart/spec.md b/openspec/changes/add-supervised-context-restart/specs/supervised-context-restart/spec.md
deleted file mode 100644
index d34de7dc..00000000
--- a/openspec/changes/add-supervised-context-restart/specs/supervised-context-restart/spec.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# Supervised legacy context restart
-
-The approved 2026-10-04 authority decision supersedes the earlier shared-lifecycle
-requirements. OpenSpec owns this decision; `specs/005-supervised-legacy-ctx/`
-owns implementation and validation tasks.
-
-## ADDED Requirements
-
-### Requirement: Managed ownership refuses legacy restart
-The manual supervised `/ctx` compatibility path SHALL establish canonical lane
-identity and affirmative absence of managed ownership before preservation writes,
-every child claim and every prepared launch. It SHALL refuse unreadable ownership
-and SHALL NOT mutate feature 001's JSON ledger or PR #97's lifecycle snapshot.
-
-#### Scenario: Managed lane invokes ctx
-- **WHEN** managed ownership exists or cannot be verified
-- **THEN** the legacy path refuses before canonical preservation or respawn
-
-### Requirement: Reservation precedes preservation
-The backend SHALL atomically reserve `preparing` before changing the handoff,
-register, log or window. It SHALL complete the same reservation as `pending`
-only after preservation succeeds, and SHALL refuse another active operation.
-Catchable failure SHALL fence cleanup to that exact reservation. An abandoned
-reservation SHALL have an explicit inspection and reconciliation path.
-Without an explicit state-root override, reservation, completion, cleanup and
-later reads SHALL retain the sole existing intent among recorded-checkout and
-projects-root candidates. Distinct occupied intent locations or unreadable
-candidate ownership SHALL refuse. Root selection and CAS SHALL share the writer
-mutex. Recording a nested checkout SHALL NOT strand the reserved operation.
-
-#### Scenario: Preservation records a previously unknown nested checkout
-- **WHEN** a reservation was created at the projects-root fallback and PAUSED records a nested checkout
-- **THEN** pending completion, failed cleanup and later readers retain that existing intent
-- **AND** a second distinct intent in the other candidate refuses without changing either record
-
-#### Scenario: Two context restarts overlap
-- **WHEN** a second ctx finds an active reservation
-- **THEN** it refuses without altering the first operation's preservation files
-
-### Requirement: Each attempt owns one child transcript
-Claims, child writes, failure and readiness SHALL compare operation, legacy
-generation and attempt. The first child SHALL reserve an unclaimed transcript
-exactly once; repeated consumers and stale attempts SHALL refuse before mutation
-or exec. Launch facts SHALL bind agent, profile, directory, pane and row handoff.
-
-#### Scenario: An old child races a retry
-- **WHEN** its attempt token is no longer current
-- **THEN** its reservation and launch refuse
-
-### Requirement: Owned stamp publication remains recoverable
-The exact prior and verified stamped handoff checksums SHALL be recorded before
-atomically publishing the stamp to the resolved target, preserving symlinks.
-Retries SHALL accept either complete owned version and reject unrelated edits.
-The replacement's first prompt SHALL be that same validated handoff's top block.
-
-#### Scenario: Stamp publication is interrupted
-- **WHEN** interruption occurs on either side of atomic replacement
-- **THEN** the complete old or complete stamped version remains acceptable
-
-### Requirement: Readiness is positive and asynchronous
-An observer SHALL reread the current attempt's prepared transcript and confirm
-child liveness, the canonical lane, exactly one live holder, a distinct fresh
-transcript and matching pane. Only the legacy intent becomes `ready`.
-
-#### Scenario: Transcript is prepared after observation starts
-- **WHEN** lane-start records the intended UUID
-- **THEN** the observer reads that current UUID and validates its live evidence
-
-### Requirement: Recovery cannot duplicate a live child
-Cancellation before claim SHALL preserve the unclaimed intent. A live or unknown
-child or unknown holder absence SHALL retain `starting` with an indeterminate
-reason, blocking retry. Only a proven ended launch with no live holder SHALL
-become a failed launch. Retry SHALL preserve operation and increment attempt.
-Ordinary lane resume SHALL refuse a failed supervised launch. Caught preparation
-failure SHALL retain a failed preservation-only intent with attempt 0 and no new
-transcript. That class SHALL permit ordinary resume only without restart tokens or fresh-session selectors,
-after confirmed absence of every holder, and with unchanged operation/generation
-and qualifying fields checked before binding changes and before launch. The
-intent SHALL remain unchanged; no readiness or supervised claim is manufactured.
-`preparing` SHALL remain blocked. Historical ready intents SHALL NOT override
-ordinary resume. No automatic rollover or real session canary
-is authorized by this change.
-
-#### Scenario: Supervisor ends while its child lives
-- **WHEN** TERM or HUP reaches the claimed supervisor
-- **THEN** the child is left alive and retry remains blocked
-
-
-#### Scenario: Preparation fails and the original session later exits
-- **WHEN** preservation fails before pending, then every original holder is confirmed absent
-- **THEN** ordinary lane resume uses its normal source and retains the failed preparation intent
-- **AND** a live/unknown holder, restart token, changed operation or nonzero attempt refuses recovery
diff --git a/openspec/changes/add-supervised-context-restart/tasks.md b/openspec/changes/add-supervised-context-restart/tasks.md
deleted file mode 100644
index 9201793f..00000000
--- a/openspec/changes/add-supervised-context-restart/tasks.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Governance handoff
-
-The original executable checklist is retained in Git history at head `5164ce1`.
-The 2026-10-04 legacy authority decision supersedes its shared lifecycle scope.
-
-Implementation tasks now have exactly one owner: `specs/005-supervised-legacy-ctx/tasks.md`.
-See [the decision](legacy-authority-decision.md) for approval, scope and hold status.
diff --git a/openspec/changes/interactive-lane-name-repair/.openspec.yaml b/openspec/changes/interactive-lane-name-repair/.openspec.yaml
deleted file mode 100644
index 96db9a43..00000000
--- a/openspec/changes/interactive-lane-name-repair/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-09-15
diff --git a/openspec/changes/interactive-lane-name-repair/design.md b/openspec/changes/interactive-lane-name-repair/design.md
deleted file mode 100644
index 33870a79..00000000
--- a/openspec/changes/interactive-lane-name-repair/design.md
+++ /dev/null
@@ -1,77 +0,0 @@
-## Context
-
-The `UserPromptSubmit` guard currently treats a window lane and a live Claude
-session name that disagree as a hard identity failure. It already has a
-pending-answer mechanism for a user-created rename, but that mechanism only
-offers moving to the session's lane or renaming back, and it cannot explicitly
-accept a deliberate mismatch.
-
-## Goals / Non-Goals
-
-**Goals:**
-
-- Make recoverable lane/session name drift an explicit, one-prompt decision.
-- Keep the decision scoped to the current lane/session pair and preserve the
-  existing fail-closed behavior for unreadable or ambiguous state.
-- Support three choices: allow this lane, move the lane binding to the session
-  name, or rename the session to the lane name.
-- Ensure the session-to-lane choice types `/rename <lane>` into the verified
-  active Claude pane.
-- Keep `pclaude --lane` on the exact-ID path when a restart records a harness
-  UUID while continuing the Claude transcript named by the last PAUSED record.
-
-**Non-Goals:**
-
-- Changing the installed hook command or Claude hook configuration.
-- Making unreadable registers, missing session records, duplicate transcripts,
-  or superseded sessions permissive.
-- Changing lane-start's session naming contract.
-
-## Decisions
-
-1. **Use the existing pending offer file, extended with a mode and choice.**
-   This keeps the answer on the next prompt, prevents an unprompted write, and
-   avoids introducing another state store. An allowed mismatch is recorded for
-   the current session/lane pair so later prompts warn but do not repeatedly
-   block; changing either name invalidates that allowance.
-
-2. **Present numbered choices rather than interpreting free-form yes/no.**
-   The guard prints `1` allow, `2` adjust lane to session, and `3` adjust
-   session to lane. Only the exact numbered answer is acted on; invalid input
-   leaves the offer pending and blocks that answer prompt.
-
-3. **Reuse the established move and pane-typing mechanics.**
-   Choice 2 renames the tmux window first, runs `lane-start --no-launch`, binds
-   the current UUID to the destination row, and marks the source row moved.
-   Choice 3 types `/rename <lane>` into the verified pane. The answer prompt
-   is consumed in both repair cases so the repair lands before work resumes.
-
-4. **Keep safety failures blocking.**
-   The guard continues to return exit 2 when it cannot read the workspace,
-   tmux, session record, or register, and for duplicate/superseded transcripts.
-   Only a readable, current lane/session name mismatch reaches the three-choice
-   offer.
-
-5. **Use the same-agent PAUSED transcript only when the row-last transcript is
-   absent.** The row remains the first source. If its last UUID has no
-   transcript, the last PAUSED record names agent `claude`, and that record's
-   transcript exists, `lane-start` resumes that exact UUID and appends it to
-   the end of the session cell before the RESUMED status. A live session in
-   the current window still wins, and an agent mismatch never borrows another
-   agent's transcript.
-
-## Risks / Trade-offs
-
-- [Risk] Allowing a mismatch can make cross-session addressing less obvious.
-  → The choice is explicit, scoped to the current pair, and emits a warning on
-  every later prompt while the mismatch remains.
-- [Risk] A pane may stop accepting `/rename` keys.
-  → Reuse the existing verified-pane result handling and print the manual
-  `/rename` command while keeping the offer/repair state visible.
-- [Risk] Moving a lane can race with a register update.
-  → Continue using `lane-start` and the existing published-row anchors; do not
-  add a direct register rewrite.
-- [Risk] An old handoff could point at a superseded transcript.
-  → Consult it only after the row-last transcript is absent, require the same
-  recorded agent, retain duplicate-holder checks, and restore the selected ID
-  through the existing anchored session-cell writer.
diff --git a/openspec/changes/interactive-lane-name-repair/proposal.md b/openspec/changes/interactive-lane-name-repair/proposal.md
deleted file mode 100644
index d01d2a7b..00000000
--- a/openspec/changes/interactive-lane-name-repair/proposal.md
+++ /dev/null
@@ -1,37 +0,0 @@
-## Why
-
-The prompt guard currently blocks a lane when the Claude session name and the
-lane/register name drift, even when the operator can identify and repair the
-drift safely. A single accidental rename can therefore strand an otherwise
-valid working session; the guard needs an explicit, auditable repair choice.
-
-## What Changes
-
-- Replace the hard block for a recoverable lane/session name mismatch with a
-  one-prompt repair offer.
-- Offer exactly three explicit choices: allow this lane, change the lane
-  binding to the session name, or rename the session to the lane name.
-- Make the session-to-lane choice perform `/rename <lane>` in the active
-  Claude pane before allowing work to continue.
-- Preserve blocking for ambiguous, unreadable, superseded, or otherwise
-  unsafe lane identity states.
-- When a lane row ends in a harness UUID that has no transcript, recover the
-  exact Claude transcript from the same agent's last PAUSED record instead of
-  launching Claude's title-filtered resume picker.
-
-## Capabilities
-
-### New Capabilities
-
-- `interactive-lane-name-repair`: explicit repair choices for recoverable
-  lane/session name drift.
-
-### Modified Capabilities
-
-
-## Impact
-
-The `lanes-edit.sh guard` `UserPromptSubmit` hook, its pending-answer state,
-the lane/register update helpers, `lane-start`'s exact transcript selection,
-the active-pane rename path, and the shell tests for lane helper behavior. The
-installed hook command and existing safe failure behavior remain unchanged.
diff --git a/openspec/changes/interactive-lane-name-repair/specs/interactive-lane-name-repair/spec.md b/openspec/changes/interactive-lane-name-repair/specs/interactive-lane-name-repair/spec.md
deleted file mode 100644
index a29a71a5..00000000
--- a/openspec/changes/interactive-lane-name-repair/specs/interactive-lane-name-repair/spec.md
+++ /dev/null
@@ -1,117 +0,0 @@
-## ADDED Requirements
-
-### Requirement: Recoverable name drift offers explicit choices
-
-When the guard can read a current lane row, the current transcript, the tmux
-window, and the live session name, and the lane name differs from the session
-name, it MUST warn and offer exactly these choices: `1` explicitly allow the
-current lane/session mismatch, `2` adjust the lane binding to the session name,
-or `3` adjust the session name to the lane name.
-
-#### Scenario: Mismatch is offered instead of silently blocking
-
-- **WHEN** the current window is lane `repo-1`, its latest transcript belongs to
-  that row, and the live session is named `repo-2`
-- **THEN** the guard prints the three numbered choices and records a pending
-  answer without changing the window, session, or register
-
-#### Scenario: Invalid answer remains safe
-
-- **WHEN** the pending mismatch offer receives an answer other than `1`, `2`,
-  or `3`
-- **THEN** the answer prompt is refused, the offer remains pending, and no
-  rename or register write occurs
-
-### Requirement: Explicit allow is scoped and warning-only
-
-When the operator selects `1`, the guard MUST consume that answer prompt and
-retain an explicit allowance for the current lane/session pair. While that pair
-remains unchanged, later prompts MUST pass with a warning and MUST NOT require
-another repair choice. If either name changes, the allowance MUST no longer
-apply.
-
-#### Scenario: Allow permits the current work
-
-- **WHEN** the operator answers `1` to a pending mismatch offer
-- **THEN** the guard consumes the answer, records the allowance, and reports
-  that later prompts will pass with a warning for the current lane/session pair
-
-#### Scenario: Allow is invalidated by a changed name
-
-- **WHEN** an explicitly allowed session or lane name changes
-- **THEN** the guard presents the three choices again rather than silently
-  carrying the old allowance forward
-
-### Requirement: Lane-to-session repair moves the lane binding
-
-When the operator selects `2`, the guard MUST adjust the active lane binding to
-the session's lane name using the existing lane-start/register mechanics. It
-MUST rename the tmux window before running the binding operation, preserve the
-current transcript UUID in the destination row, mark the source lane as moved,
-and consume the answer prompt.
-
-#### Scenario: Existing destination lane is selected
-
-- **WHEN** the operator answers `2` and the session name identifies an existing
-  lane
-- **THEN** the window and register bind to that destination lane, the current
-  UUID is recorded there, the old lane records the move, and the answer prompt
-  is consumed
-
-#### Scenario: Destination cannot be derived safely
-
-- **WHEN** the session name cannot provide the directory or lane arguments
-  required by `lane-start`
-- **THEN** choice `2` refuses without writing or renaming and prints the
-  operator-supplied command needed to complete the move
-
-### Requirement: Session-to-lane repair renames the session
-
-When the operator selects `3`, the guard MUST type `/rename <lane>` into the
-verified active Claude pane, consume the answer prompt, and report whether the
-rename was typed successfully. It MUST NOT silently change the register.
-
-#### Scenario: Pane accepts the rename
-
-- **WHEN** the operator answers `3` and the active pane accepts tmux input
-- **THEN** `/rename <lane>` is typed, the mismatch repair prompt is consumed,
-  and the next prompt can be evaluated with the session name aligned
-
-#### Scenario: Pane cannot accept the rename
-
-- **WHEN** the operator answers `3` but the active pane cannot be verified or
-  does not accept tmux input
-- **THEN** no register write occurs, the guard reports the manual
-  `/rename <lane>` command, and the mismatch offer remains available
-
-### Requirement: Unsafe identity states remain blocked
-
-The guard MUST continue to refuse with its blocking exit status when the
-workspace, tmux window, live session record, register row, or transcript
-identity cannot be verified, or when the transcript is superseded or duplicated.
-
-#### Scenario: Register or session cannot be read
-
-- **WHEN** the guard cannot establish the current lane/session/register triple
-- **THEN** it refuses the prompt and does not offer a permissive choice
-
-### Requirement: Lane launch recovers an exact same-agent transcript
-
-When the lane row's last UUID has no transcript, but the lane's last PAUSED
-record names the same agent and an existing transcript UUID, `lane-start` MUST
-resume that exact transcript rather than pass the lane name to Claude's
-title-filtered resume picker. It MUST restore the selected UUID to the end of
-the session cell using the existing anchored writer before recording RESUMED.
-
-#### Scenario: Harness UUID does not name a transcript
-
-- **WHEN** a Claude lane's row ends in UUID `new`, no `new.jsonl` exists, and
-  the same lane's last PAUSED record names existing transcript UUID `old`
-- **THEN** the launch command contains `--resume old`, never `--resume <lane>`,
-  and the row's session cell ends in `old` for the next launch
-
-#### Scenario: Current-window evidence remains authoritative
-
-- **WHEN** the current window contains a live session being bound to the lane
-- **THEN** `lane-start` does not replace that live session with a transcript
-  from an older PAUSED record
diff --git a/openspec/changes/interactive-lane-name-repair/tasks.md b/openspec/changes/interactive-lane-name-repair/tasks.md
deleted file mode 100644
index 5b91b901..00000000
--- a/openspec/changes/interactive-lane-name-repair/tasks.md
+++ /dev/null
@@ -1,21 +0,0 @@
-## 1. Guard state and interaction
-
-- [x] 1.1 Extend the pending name-drift offer state to distinguish the three numbered choices and an explicit allow for the current lane/session pair.
-- [x] 1.2 Replace recoverable lane/session mismatch hard-lock behavior with the numbered warning offer while retaining fail-closed handling for unsafe identity states.
-- [x] 1.3 Implement choice `1` as a scoped warning-only allowance that is invalidated when either compared name changes.
-- [x] 1.4 Implement choice `2` using the existing window-first `lane-start --no-launch` move path and current UUID/register anchoring.
-- [x] 1.5 Implement choice `3` by typing `/rename <lane>` into the verified pane, with manual fallback when typing fails.
-
-## 2. Verification and documentation
-
-- [x] 2.1 Add shell coverage for the three choices, invalid answers, scoped allow, lane-to-session moves, and session-to-lane `/rename` typing.
-- [x] 2.2 Add regression coverage proving unreadable, superseded, duplicate, and ambiguous identity states still block.
-- [x] 2.3 Run the canonical `tests/run.sh` focused tests and update user-facing lane documentation for the new prompt behavior.
-
-## 3. Exact lane relaunch
-
-- [x] 3.1 Diagnose the immediate `pclaude --lane openRepoTools-3 max001` exit against the installed helper, register row, PAUSED record, and transcript files.
-- [x] 3.2 Make `lane-start` recover the same agent's exact PAUSED transcript when the row-last UUID has no transcript, preserving live-window and duplicate-holder fences.
-- [x] 3.3 Restore the recovered UUID to the end of the session cell through the anchored writer before recording RESUMED.
-- [x] 3.4 Add regression coverage for exact-ID recovery and exclusion of the title picker.
-- [x] 3.5 Install the verified helper and confirm the real lane's dry-run launch argv.
diff --git a/openspec/changes/migrate-to-triad/.openspec.yaml b/openspec/changes/migrate-to-triad/.openspec.yaml
deleted file mode 100644
index 6a87d2b2..00000000
--- a/openspec/changes/migrate-to-triad/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-10-03
diff --git a/openspec/changes/migrate-to-triad/adoption-plan.yaml b/openspec/changes/migrate-to-triad/adoption-plan.yaml
deleted file mode 100644
index 8b360179..00000000
--- a/openspec/changes/migrate-to-triad/adoption-plan.yaml
+++ /dev/null
@@ -1,445 +0,0 @@
-# Rehearsal input, NOT the cutover plan: regenerated 2026-10-08 from source 837928a1029ac53b050a9bdcbc0ef4055b10719b (main)
-# with openRepoShape adopt-project.py at 7f84ca42ca86a8902928345109d2bf6bad87bd91.
-# Run C: the run B plan's 22 resolutions (the October 4 mapping's 19, plus lane-worktrees and
-# lanes-index to code and ideation/ to spec) are reapplied verbatim; no new top-level path.
-# Disposable rehearsal evidence: ../../../specs/004-migrate-to-triad/adopter-rehearsal-2026-10-08.md.
-# Gate B remains open (T006-T011); execution needs a frozen baseline and explicit Gate C approval.
-# Paths are relative to the source checkout (local_path published as "."); generated metadata
-# does not authorize repository creation.
-schema_version: 1
-kind: adoption-plan
-
-# Written by `adopt-project.py plan`. IT IS MEANT TO BE EDITED.
-# Every entry with `review_required: true` carries a `question:`; a
-# human or an AI answers it by setting `leg:` to spec, code, root or
-# drop and adding one line of `resolution:` beside it. `check` then
-# has to pass, and `execute` REFUSES while any leg is still null.
-
-generated_on: 2026-10-08
-tool: opensoft/openRepoShape adopt-project.py
-
-source:
-  repository: opensoft/openRepoTools
-  local_path: .
-  default_branch: main
-  commit: "837928a1029ac53b050a9bdcbc0ef4055b10719b"
-  files: 120
-  bytes: 6292407
-  commits: 92
-
-# The adopted repository KEEPS its name, its identity and
-# its history and becomes the assembly root. `new-root` — a new
-# root with the source reduced to one leg — is not implemented
-# in v0.2; the field records which posture this plan took.
-mode: in-place
-
-project: openRepoTools
-org: opensoft
-id: openrepotools
-visibility: public
-tracking_branch: main
-adopt_branch: adopt/three-repo-shape
-elected_by: "Brett Heap"
-elected_on: "2026-10-04"
-reference: "openxFactory docs/project-repo-schema.md"
-
-legs:
-  assembly: openRepoTools
-  spec: openRepoTools-spec
-  code: openRepoTools-code
-  spec_path: spec
-  code_path: code
-
-# Neutral products this project declares a pin on. A
-# `<Domainx><Product>` assembly root is a DESCENDANT only when
-# its `open<Product>` is listed here (2026-09-02).
-pins: []
-
-# A leg that NO entry below assigns a path to is SEEDED from the
-# shape's own leg template as one initial commit, instead of being
-# extracted: `git filter-repo` over an empty path list yields an
-# empty HISTORY, which is not an empty repository. The split still
-# mounts it. This block RECORDS what the entries said when the plan
-# was written; `check` and `execute` re-derive it from the entries,
-# which are edited afterwards, and the entries always win.
-seeding:
-  spec:
-    seeded_from_template: false
-  code:
-    seeded_from_template: false
-
-# Seeding a leg is EXPLICIT HUMAN INTENT, so `execute` refuses to do
-# it unless the leg is named here (or on its own command line) with
-# `--allow-empty-leg <leg>`. A repository that turns out to have no
-# code is a fact worth confirming; a plan that lost every code path
-# to a bad edit looks exactly the same from here.
-allow_empty_legs: []
-
-paths:
-  - path: .gitattributes
-    leg: root
-    confidence: high
-    rule: root-front-door
-    reason: "What a person or a forge reads BEFORE deciding which leg to open. The licence and the code of conduct govern all three repositories; the README is the front door of the thing an engineer clones."
-    files: 1
-    bytes: 1857
-    review_required: false
-  - path: .github/
-    leg: code
-    confidence: high
-    rule: code-ci-workflows
-    reason: "CI runs the implementation's own gate — build, test, analysis. The assembly root gets its own `validate.yml` from the shape, so a workflow moved here is not a workflow lost."
-    files: 1
-    bytes: 18865
-    review_required: false
-  - path: .gitignore
-    leg: root
-    confidence: high
-    rule: root-front-door
-    reason: "What a person or a forge reads BEFORE deciding which leg to open. The licence and the code of conduct govern all three repositories; the README is the front door of the thing an engineer clones."
-    files: 1
-    bytes: 38
-    review_required: false
-  - path: .gitmodules
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 121
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Keep existing nested dependency registration with its upstream gitlink in code; assembly spec/code registrations are generated separately."
-  - path: AGENTS.md
-    leg: root
-    confidence: high
-    rule: root-assistant-instructions
-    reason: "The AI-assistant instruction files and their one-file directories are the same document ten times over, and it addresses the whole project. An assistant that read it from inside the code leg would be told about specifications it cannot see. Root, ruled 2026-09-02."
-    files: 1
-    bytes: 21092
-    review_required: false
-  - path: CLAUDE.md
-    leg: root
-    confidence: high
-    rule: root-assistant-instructions
-    reason: "The AI-assistant instruction files and their one-file directories are the same document ten times over, and it addresses the whole project. An assistant that read it from inside the code leg would be told about specifications it cannot see. Root, ruled 2026-09-02."
-    files: 1
-    bytes: 16
-    review_required: false
-  - path: LICENSE
-    leg: root
-    confidence: high
-    rule: root-front-door
-    reason: "What a person or a forge reads BEFORE deciding which leg to open. The licence and the code of conduct govern all three repositories; the README is the front door of the thing an engineer clones."
-    files: 1
-    bytes: 11357
-    review_required: false
-  - path: README.md
-    leg: root
-    confidence: high
-    rule: root-front-door
-    reason: "What a person or a forge reads BEFORE deciding which leg to open. The licence and the code of conduct govern all three repositories; the README is the front door of the thing an engineer clones."
-    files: 1
-    bytes: 31198
-    review_required: false
-  - path: claude-current
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 29335
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable installer payload added by merged PR #134; keep resolver/checker with commands and their implementation tests in code."
-  - path: claude-restart-check
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 11880
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable installer payload added by merged PR #134; keep resolver/checker with commands and their implementation tests in code."
-  - path: commands/
-    leg: code
-    confidence: medium
-    rule: extension-majority
-    reason: "no rule names this path; the `.md` extension is classified as spec by the policy's extension table"
-    files: 3
-    bytes: 8906
-    review_required: false
-    resolution: "These Markdown command files are shipped runtime installer payloads with implementation tests, not OpenSpec or Speckit decisions."
-  - path: contracts/
-    leg: code
-    confidence: high
-    rule: spec-governance
-    reason: "Requirements, decisions, contracts and governance prose — what the project has DECIDED, as opposed to what it currently runs. `contracts/` is here by the 2026-09-02 ruling even where the code reads it: the code reads across the assembly-root mount (`spec/contracts` from the root, `../spec/contracts` from `code/`), which is what the legs are mounted for."
-    files: 1
-    bytes: 3299
-    review_required: false
-    resolution: "At this baseline the only contract is openreposhape-pin.yaml, a dependency lock coupled to the code gitlink and installer; future product governance contracts belong in spec and assembly pins are generated at root."
-  - path: docs/
-    leg: spec
-    confidence: high
-    rule: spec-governance
-    reason: "Requirements, decisions, contracts and governance prose — what the project has DECIDED, as opposed to what it currently runs. `contracts/` is here by the 2026-09-02 ruling even where the code reads it: the code reads across the assembly-root mount (`spec/contracts` from the root, `../spec/contracts` from `code/`), which is what the legs are mounted for."
-    files: 2
-    bytes: 287738
-    review_required: false
-  - path: ideation/
-    leg: spec
-    confidence: medium
-    rule: extension-majority
-    reason: "no rule names this path; the `.md` extension is classified as spec by the policy's extension table"
-    files: 12
-    bytes: 49688
-    review_required: false
-    resolution: "Feature ideation and brainstorm packets are planning prose about what the project is deciding, not shipped payload; spec beside openspec/, specs/ and docs/, as the October 6 rehearsal assigned it."
-  - path: lane
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 83555
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lane-end
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 141860
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lane-handoff
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 153546
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lane-rename
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 17116
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lane-start
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 270707
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lane-worktrees
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 277594
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lanes
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 45015
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: lanes-edit.sh
-    leg: code
-    confidence: medium
-    rule: extension-majority
-    reason: "no rule names this path; the `.sh` extension is classified as code by the policy's extension table"
-    files: 1
-    bytes: 1007136
-    review_required: false
-  - path: lanes-index
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 114193
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: link-estates
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 21694
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: openRepoTools
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 193656
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: openspec/
-    leg: spec
-    confidence: high
-    rule: spec-governance
-    reason: "Requirements, decisions, contracts and governance prose — what the project has DECIDED, as opposed to what it currently runs. `contracts/` is here by the 2026-09-02 ruling even where the code reads it: the code reads across the assembly-root mount (`spec/contracts` from the root, `../spec/contracts` from `code/`), which is what the legs are mounted for."
-    files: 28
-    bytes: 185941
-    review_required: false
-  - path: park
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 50113
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: repos.tsv
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 2651
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Runtime alias data installed beside the lane commands."
-  - path: resume
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 63671
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: skills/
-    leg: code
-    confidence: medium
-    rule: extension-majority
-    reason: "no rule names this path; the `.md` extension is classified as spec by the policy's extension table"
-    files: 3
-    bytes: 80497
-    review_required: false
-    resolution: "These three skills are installed product payloads; project workflow skills remain local root bootstrap artifacts."
-  - path: specs/
-    leg: spec
-    confidence: high
-    rule: spec-governance
-    reason: "Requirements, decisions, contracts and governance prose — what the project has DECIDED, as opposed to what it currently runs. `contracts/` is here by the 2026-09-02 ruling even where the code reads it: the code reads across the assembly-root mount (`spec/contracts` from the root, `../spec/contracts` from `code/`), which is what the legs are mounted for."
-    files: 23
-    bytes: 123603
-    review_required: false
-  - path: status
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 347320
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
-  - path: tests/
-    leg: code
-    confidence: high
-    rule: code-source-and-tests
-    reason: "The implementation, the tests that hold it, and the scripts and images that build and run it. `scripts/` moves whole: a harness that reads `contracts/` from beside it reads them across the root mount afterwards, which is a code change the plan records as a follow-up rather than a reason to split the directory."
-    files: 22
-    bytes: 2637149
-    review_required: false
-  - path: upstream/
-    leg: code
-    confidence: review
-    rule: default
-    reason: "No rule matched and the file extensions did not agree. This is the honest answer, not a failure: the tool has said what it does not know, at the exact path where it does not know it."
-    files: 1
-    bytes: 0
-    review_required: false
-    question: "Which leg owns this path — spec, code, or the assembly root? Answer by editing `leg:` and writing one line into `resolution:` beside it."
-    resolution: "Mounted openRepoShape is the implementation/test dependency; preserve its exact gitlink with the original .gitmodules and dependency pin."
-
-follow_ups:
-  - "code/claude-current names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/lane-start names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/lanes-edit.sh names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/openRepoTools names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/tests/run.sh names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/tests/test_install_skill_and_hook.py names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/tests/test_lane_helpers.sh names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "code/tests/test_lane_start_claude_current.py names `docs/`, which moves to the spec leg: it must read across the assembly root — `../spec/docs/` relative to `code/` — or take the path from the environment"
-  - "… and 1 more file(s) under the code leg naming `docs/`"
-  - "code/lane-handoff names `openspec/`, which moves to the spec leg: it must read across the assembly root — `../spec/openspec/` relative to `code/` — or take the path from the environment"
-  - "code/lanes-edit.sh names `openspec/`, which moves to the spec leg: it must read across the assembly root — `../spec/openspec/` relative to `code/` — or take the path from the environment"
-  - "code/tests/test_lane_helpers.sh names `openspec/`, which moves to the spec leg: it must read across the assembly root — `../spec/openspec/` relative to `code/` — or take the path from the environment"
-  - "code/tests/test_park_resume_commands.py names `specs/`, which moves to the spec leg: it must read across the assembly root — `../spec/specs/` relative to `code/` — or take the path from the environment"
-  - "merge shape/.gitattributes into .gitattributes: the source repository already has that name, so the shape's copy was written beside it and NOTHING was overwritten"
-  - "merge shape/.gitignore into .gitignore: the source repository already has that name, so the shape's copy was written beside it and NOTHING was overwritten"
-  - "add the line `Read AGENTS-shape.md first — the rules of this repository's shape.` to the existing AGENTS.md rather than replacing it with shape/AGENTS.md: AGENTS.md is what this project's agents ALREADY read, and `contracts/path-classification.yaml` keeps it at the root (`root-assistant-instructions`) because it addresses the whole project. Then delete shape/AGENTS.md. Nothing was overwritten."
-  - "add the line `Read AGENTS-shape.md first — the rules of this repository's shape.` to the existing CLAUDE.md rather than replacing it with shape/CLAUDE.md: CLAUDE.md is what this project's agents ALREADY read, and `contracts/path-classification.yaml` keeps it at the root (`root-assistant-instructions`) because it addresses the whole project. Then delete shape/CLAUDE.md. Nothing was overwritten."
-  - "merge shape/README.md into README.md: the source repository already has that name, so the shape's copy was written beside it and NOTHING was overwritten"
-  - "open the split as a pull request against the source's default branch; the legs openRepoTools-spec and openRepoTools-code are seeded before it, so review the root's diff and the two new repositories together"
-  - "Preserve original .gitmodules, upstream/openRepoShape gitlink and contracts/openreposhape-pin.yaml together in code; rehearse existing-submodule extraction/removal and recursive bootstrap before real execution. Never weaken blob verification or edit the standard in place."
-  - "Add an assembly openRepoTools compatibility entry point after byte-preserving split verification; resolve one immutable code pin for all installer artifacts and preserve OPENREPOTOOLS_REPO/REF forks, raw/gh and offline checkout behavior."
-  - "Separate code, assembly and spec roots in test fixtures and hygiene checks; code CI must supply the exact compatible spec/assembly context where a test reads product documentation."
-  - "Current .specify and agent links are ignored local bootstrap artifacts, not the 120-file source tree; capture local configuration and regenerate root workflow using setup-openspeckit after manifest/legs are present."
-  - "Preserve all branch/PR/worktree and dirty/untracked work; source main extraction does not transport unfinished feature branches. Migrate selected patches to paired feature branches with old-to-new receipts before rebinding lanes."
-  - "Regenerate this preliminary plan after planning lands and baseline freeze; require current coverage check, local bare-remote rehearsal, prerequisite availability and explicit approval before execute."
-  - "Review genuine bounded features/<NNN-feature>/openspec/ amendment records explicitly as code; canonical/full proposals and archives remain spec even when created on a feature branch. No existing bounded amendment paths were observed; do not manufacture them for historical features."
-  - "Preserve approved original repository/commit/path provenance and verify correspondence to extracted spec identities, repairing relative links, selected OpenSpec roots/stores and paired feature paths without guessing filtered commit hashes."
-  - "Use the adopted manual amendment workflow with immediate working Speckit updates and one docs reconciliation issue at the first amendment. Schema, root routing, bootstrap distribution and upstream placement automation are pending in their owners; do not patch pinned shape copies or assume other workstations are updated."
-  - "Reconcile the tested migration net effect and all amendment dispositions in one final docs batch before completed assembly advancement; prepare docs/code PRs together, link landed code/evidence, close reconciliation after docs landing, and archive only after implementation and assembly pins land."
-
-summary:
-  spec:
-    files: 65
-    bytes: 646970
-    file_share: 0.5417
-    byte_share: 0.1028
-  code:
-    files: 49
-    bytes: 5579879
-    file_share: 0.4083
-    byte_share: 0.8868
-  root:
-    files: 6
-    bytes: 65558
-    file_share: 0.0500
-    byte_share: 0.0104
-  unresolved:
-    files: 0
-    bytes: 0
-    file_share: 0.0000
-    byte_share: 0.0000
-planning_status: rehearsal-input-not-cutover
-execution_authorized: false
diff --git a/openspec/changes/migrate-to-triad/design.md b/openspec/changes/migrate-to-triad/design.md
deleted file mode 100644
index a51ee15a..00000000
--- a/openspec/changes/migrate-to-triad/design.md
+++ /dev/null
@@ -1,174 +0,0 @@
-# Design: in-place triad adoption
-
-## Context
-
-The refreshed preliminary source is main `daed20957f2dd2f22cca24053bb5bc8636ff6b3f`:
-64 tracked paths, 80 commits, one nested standard submodule. The inspected
-standard is `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`. The October 4 refresh
-found merged PR #134 on main, six worktrees including planning and the retained
-`feat/claude-current` checkout, and six local branches. The two open PRs
-are #121 and #97. #134, #61 and #146 are
-included in main and need no separate replay. Feature 001 is now committed
-and clean at `3c26041`, including restored rollover/workspace packets and the
-selected local Omnigent launcher contract. Main extraction alone still omits
-that branch work. Preserve its contracts, external launcher ownership and
-unmet runtime gates during replay. Removed worktrees are not an active replay queue. The
-[inventory](../../../specs/004-migrate-to-triad/inventory.json) is a snapshot.
-
-## Goals / Non-Goals
-
-Preserve project identity/history, all user work, installed command behavior
-and a reproducible pinned assembly. Separate product decisions from shipped
-implementation; migrate unfinished features without restarting specification.
-Do not redesign swap, enable its experimental capability, change WIP ownership,
-rewrite published source history or remove old worktrees during adoption.
-
-## Decisions
-
-### Assembly identity and source baseline
-
-Use the standard's in-place adoption. `openRepoTools` stays the existing
-assembly; `openRepoTools-spec` and `openRepoTools-code` are new legs mounted
-at `spec` and `code`. Public visibility is a proposal matching current source
-visibility, subject to final approval. A new assembly name would strand
-existing issues, URLs and PRs, so is outside this design.
-
-Run real adoption from a fresh clean default-branch clone with no linked
-worktrees attached. Original working clones remain preserved. Freeze the
-baseline only after planning and any agreed prerequisite changes land; refresh
-the generated plan whenever that commit moves. Approval binds the actual
-baseline, standard commit, complete mapping and follow-ups.
-
-### Placement and dependency custody
-
-The [resolved adoption plan](adoption-plan.yaml) accounts for all 64 baseline
-paths: 18 spec, 40 code, six root, none dropped, with 28 follow-ups. It records reasons for all
-16 originally unresolved paths and overrides for shipped Markdown payloads
-and the dependency lock. Product documentation/OpenSpec/Speckit go to spec.
-Root owns front-door guidance, license, project metadata and workflow bootstrap.
-
-Genuine bounded feature amendment records at
-`features/<NNN-feature>/openspec/` are the narrow code exception. Review them
-explicitly with reasoned resolutions until the upstream rule is qualified.
-No such tracked records were observed in current main/retained feature heads;
-do not manufacture them or move full feature-branch proposals into code.
-
-Keep executable files, `repos.tsv`, shipped `commands/` and `skills/`, tests
-and implementation CI in code. The original `.gitmodules`, mounted standard
-and `contracts/openreposhape-pin.yaml` also stay together in code. At this
-baseline that contract is solely a dependency lock, not product governance.
-Generated root shape/spec/code pins are distinct. Future governance contracts
-belong in spec; regenerate the path plan if the source adds such contracts.
-
-Keeping the standard in root would move its gitlink away from its dependency
-pin and implementation consumers, and mutate the original `.gitmodules` during
-the byte-accounted split. Keeping that dependency unit in code preserves its
-existing paths. The provisional local rehearsal measured a mounting refusal
-after staging deletion of the original `.gitmodules`; see the
-[reproduction](../../../specs/004-migrate-to-triad/adopter-blocker.md).
-Resolve upstream and repeat before composed acceptance;
-plan coverage validation alone is not execution certification.
-
-### Public installation compatibility
-
-After successful byte accounting, add a root `openRepoTools` compatibility
-entry point. It resolves one assembly revision and its exact code pin, then
-loads the implementation at that immutable commit. All install payloads come
-from that same code commit. Preserve the existing `gh api .../openRepoTools`
-and raw-URL one-liners, local/offline invocation, override/fork behavior,
-destination names, artifact counts, permissions, hooks, receipts and atomic
-refusal semantics. No request may silently combine root/spec/code main tips.
-
-The code installer has a self-contained local payload tree; installed commands
-must not depend on the developer's assembly checkout. Source/ref resolution
-must support the existing monorepo override form, an adopted assembly fork and
-explicit code checkout execution. Missing or inconsistent pins refuse before
-installation effects. Implementation tests define the compatibility matrix;
-this document does not invent a second installer implementation.
-
-### Development and active work
-
-The sole executable list is the linked Speckit feature. `.specify/` and agent
-links are currently ignored local scaffolding, so baseline blob extraction
-does not preserve them. Inventory local configuration and regenerate workflow
-at the assembly root with the shape-aware bootstrap. Retain the root guidance
-and the named team assignments in feature 001. Leg guidance points back to root.
-
-Classify each active feature's delta relative to its own reviewed merge base;
-translate it into selected spec/code/root changes with old-to-new commit/file
-receipts. Include dirty/untracked files in preservation and replay validation.
-Preserve original branches and PRs while replacement branches are reviewed.
-Paired leg worktrees use the existing feature name under root `worktrees/`.
-Do not cherry-pick a mixed monorepo commit wholesale into either leg, or merge
-an old feature branch into the adopted assembly. Do not retire/rebind a live
-lane until its owner has reached a safe breakpoint and replacement evidence
-is reviewed. WIP records remain in their existing private repository and use
-the supported estate workflow; public records contain no private backups.
-
-Retain approved original proposal repository/commit/path provenance and verify
-correspondence to the extracted spec history; filtered commits can differ.
-Repair links and feature/task references without guessing new approval hashes.
-Explicitly select the intended spec checkout for full proposals and the code
-feature root for bounded amendments. A local root overrides a docs-store pointer;
-verified `--store` support is optional, not assumed. Never edit pinned base
-mounts by accidental store selection. Keep manual amendment records and update
-working Speckit files immediately; runtime/capability/authority/external scope
-changes retain full governance. Schema, command routing, workstation distribution
-and shape placement automation are pending, not delivered by this migration.
-
-### CI and exact-pin delivery
-
-Code CI runs implementation checks; root CI validates manifest/pins and the
-exact composed assembly. Supply explicit code/spec/assembly roots to tests
-that inspect docs or history; preserve the nested dependency pin assertions
-in the code Git repository. Use the canonical serialized `tests/run.sh`,
-Bash 3.2 parsing and current platform/fixture timing policies. Missing-spec
-context cannot turn a required integration check into a silent skip.
-
-Prepare code/spec PRs together. At the first bounded amendment create one spec
-reconciliation issue; collect net tested effects, all dispositions, dated
-departures, as-built record, evidence and landed code identity in one final
-spec batch. Preserve archived approval history through linked records. Code
-may land first, but completed assembly advancement waits for reconciled spec
-and matching code. Close the issue after spec landing; the feature landing
-record tracks assembly. Archive only after implementation and assembly landing
-with explicit full-spec root selection, and advance later archive commits by
-ordinary pinning. Reopen reconciliation for later behavior changes; cancellation
-records abandonment. Local archival cannot satisfy reconciliation.
-
-Land follow-up leg changes before the root pin bump that selects them. Root
-gitlinks, leg pins and workflow SHAs move through the standard's bump tool.
-The historical upstream dependency remains one-way and unedited; needed
-standard fixes land there before a deliberate pin bump here.
-
-## Risks / Trade-offs
-
-- Local mapping passes while existing-submodule extraction fails: gate real
-  execution on an isolated local bare-remote rehearsal with intact gitlink,
-  module metadata, pin and recursive bootstrap.
-- Historical commits/files change or disappear: retain original repository,
-  bundles/private work backups and migration receipts; require blob accounting
-  for the frozen baseline and explicit verification of each replayed delta.
-- An active lane writes during capture: coordinate a bounded owner-approved
-  breakpoint, then refresh capture and compare checksums before cutover.
-- Installer entry point vanishes or mixes revisions: add compatibility before
-  root merge; validate exact-ref/fork/offline and all-or-none installation.
-- CI cannot read the selected assembly/spec context: publish explicit composed
-  checkout instructions and preserve the original canonical regression gate.
-- New roots make WIP paths stale: use supported park/resume contracts and
-  reviewed migration records; never overwrite workspace pointers or force a
-  refusal through with resets.
-
-## Migration Plan
-
-The [Speckit plan](../../../specs/004-migrate-to-triad/plan.md) owns sequencing,
-gates, active PR decisions, cutover and rollback. This change is planning-only.
-`git-filter-repo` is absent in the inspected `py-bench`; make prerequisite
-availability an execution gate, without installing it during planning.
-
-## Approval decisions
-
-Confirm public new legs, the refreshed frozen baseline/mapping, branch/PR
-dispositions, coordinated cutover and repository creation only after the
-local rehearsal and compatibility work are reviewable. No approval is inferred
-from OpenSpec artifact completeness or the generated election metadata.
diff --git a/openspec/changes/migrate-to-triad/proposal.md b/openspec/changes/migrate-to-triad/proposal.md
deleted file mode 100644
index 1275c04e..00000000
--- a/openspec/changes/migrate-to-triad/proposal.md
+++ /dev/null
@@ -1,92 +0,0 @@
-# Proposal: migrate openRepoTools to the assembly/spec/code triad
-
-## Why
-
-Preparation is authorized while PRs #97/#121 are active; real conversion waits
-for both to land. The [preparation receipt](../../../specs/004-migrate-to-triad/preparation.md)
-records provisional preservation and a local adopter refusal. Resolve that
-upstream blocker and refresh the merged baseline, preservation and rehearsal
-before the existing real-execution approval gate.
-
-openRepoTools currently keeps product decisions, implementation and project
-workflow in one repository. Elect the openRepoShape triad so specifications
-and implementation can evolve independently while the existing repository
-pins their exact tested combination and preserves its identity and history.
-
-## What Changes
-
-- Adopt `opensoft/openRepoTools` in place as the assembly root; extract
-  `opensoft/openRepoTools-spec` and `opensoft/openRepoTools-code` with history.
-  Public legs are proposed to match the existing public source; execution
-  requires explicit approval of the reviewed plan, visibility and follow-ups.
-- Put OpenSpec, Speckit specifications and product documentation in `spec/`;
-  executable tooling, shipped skills/commands, tests, CI and the mounted
-  standard dependency in `code/`. Root agent guidance and workflow bootstrap
-  span both legs. No source path is proposed for deletion.
-- Apply the adopted October 4 manual amendment workflow: full proposals and
-  canonical specs stay in spec; genuine bounded feature records stay in code.
-  Preserve verified approved-baseline correspondence, update working Speckit
-  files immediately and reconcile net tested effects once before completed
-  assembly advancement. Schema/routing/distribution/placement automation remains
-  pending with workBenches/openRepoShape.
-- **BREAKING:** development paths and PR destinations change. Preserve command
-  names, install artifacts, published one-line installation and installed
-  behavior through a pinned assembly-to-code compatibility entry point.
-- Preserve all open PRs, branch histories, dirty/untracked work, detached
-  worktrees and workspace records before migration. Continue unfinished
-  features through explicit paired spec/code branches with migration receipts;
-  do not merge old monorepo feature branches over the adopted root.
-- Validate a local bare-remote rehearsal before any real repository creation.
-  Keep original clones/worktrees and the installed toolset usable until a
-  reviewed assembly PR and exact-pin integration checks establish cutover.
-
-## Capabilities
-
-### New Capabilities
-
-- `repository-triad-migration`: history-preserving adoption, placement,
-  installation compatibility, active-work migration, exact-pin delivery and
-  evidence-gated cutover/rollback.
-
-### Modified Capabilities
-
-None. No canonical capability inventory exists on the inspected source main.
-Swap, context, handoff and estate-command semantics remain governed by their
-existing changes; this migration does not activate experimental capabilities.
-
-## Impact
-
-- `openRepoTools` installer/default source selection and its bare-name payload
-  lookups; assembly entry point and leg-pin resolution; fork/ref behavior.
-- `tests/conftest.py`, pin/status/install/hygiene tests, `tests/run.sh`,
-  `.github/workflows/tests.yml`, and cross-leg documentation references.
-- `.gitmodules`, the mounted `upstream/openRepoShape` dependency and its
-  `contracts/openreposhape-pin.yaml` lockstep relationship. Keep all three in
-  code; generated assembly shape/spec/code pins are separate contracts.
-- Global OpenSpec/Speckit bootstrap, currently ignored local `.specify/` and
-  agent links, lane directory bindings, open PR destinations, and WIP records.
-- Governing change: this directory. Sole implementation feature:
-  [004-migrate-to-triad](../../../specs/004-migrate-to-triad/spec.md).
-  See its [migration plan](../../../specs/004-migrate-to-triad/plan.md) and
-  executable task list; the OpenSpec checklist records governance only.
-
-## Planning status
-
-Requested on October 3, 2026. Planning is authorized; migration execution,
-repository creation, software installation, PR merge and lane relocation are
-not authorized by this request. The attached adoption plan is a preliminary
-mapping regenerated from source main `daed20957f2dd2f22cca24053bb5bc8636ff6b3f`, not a promise
-that this will be the final split commit. Refresh after planning lands and the
-cutover baseline is frozen. No runtime or migration success is claimed.
-
-The protocol refresh retains the October 3 cleanup history and records six
-current worktrees, including the retained merged PR #134 checkout. #134 is
-included in the new main baseline; feature 001 is committed and clean at `3c26041` with
-restored rollover/workspace packets and the selected local launcher contract.
-Feature 001/main remain clean; concurrent #121 work now includes dirty/untracked
-feature 005 and its full legacy authority decision. Both #61 and #146 remain
-included through main. Open PRs are now #97 and #121. Continued feature branches and the two
-remote-only preservation refs still require preservation/review receipts;
-repository adoption does not implement or activate the feature 001 launch stack.
-The [protocol review](../../../specs/004-migrate-to-triad/protocol-review.md)
-records the adopted manual instructions and the working-draft source snapshots.
diff --git a/openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md b/openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md
deleted file mode 100644
index f5ff667b..00000000
--- a/openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md
+++ /dev/null
@@ -1,154 +0,0 @@
-# Repository triad migration
-
-## Purpose
-
-Convert the existing openRepoTools repository to a pinned assembly/spec/code
-project while preserving history, unfinished work and supported installation.
-
-## ADDED Requirements
-
-### Requirement: Adoption preserves source identity and accounts for content
-
-The migration SHALL retain the existing repository name, identity and full
-published history. It SHALL freeze a reviewed source commit and account for
-each tracked source path by blob or gitlink identity in exactly one leg/root,
-or an explicitly approved drop. It SHALL refuse stale/unresolved mappings and
-SHALL NOT force-push the original history or weaken verification to pass.
-
-#### Scenario: Source changes after plan generation
-- **WHEN** the default-branch commit differs from the reviewed adoption plan
-- **THEN** execution SHALL require regenerated mapping/checks and renewed
-  approval of the actual baseline before creating real repositories.
-
-#### Scenario: Existing nested dependency is extracted
-- **WHEN** the code leg receives the mounted standard dependency
-- **THEN** its registration, exact gitlink and coupled pin SHALL remain valid
-  and SHALL be demonstrated by local rehearsal and recursive bootstrap.
-
-### Requirement: Active work is preserved before cutover
-
-The migration SHALL inventory open PRs, all branches/worktrees, detached work,
-dirty/untracked files and local workflow configuration. It SHALL preserve
-their contents and recovery evidence before cutover, including work absent
-from the default branch. Each continued feature SHALL have a reviewed
-old-to-new mapping and validated spec/code/root changes before rebinding.
-Original worktrees and installed tools SHALL remain available until acceptance.
-
-#### Scenario: Swap feature has uncommitted proposal and code work
-- **WHEN** source main is extracted without those feature changes
-- **THEN** the migration SHALL retain complete original feature contents and
-  migrate the reviewed delta separately, preserving feature identity and roles
-- **AND** absence from the extracted main SHALL NOT imply abandonment.
-
-### Requirement: Installation retains the public interface and one revision
-
-Existing one-line installation, command names, payload destinations/modes,
-skills/hooks/receipts and supported fork/ref/local invocation SHALL remain
-usable. An adopted assembly entry point SHALL resolve one immutable code
-revision for the complete installation. Missing/inconsistent pin evidence
-SHALL refuse before partial installation. Installed tools SHALL function
-without a developer assembly checkout.
-
-#### Scenario: Assembly code main advances independently
-- **WHEN** the operator installs from a selected assembly revision
-- **THEN** every payload SHALL come from that revision's selected code commit
-  rather than whichever code main tip exists at request time.
-
-#### Scenario: Offline checkout installation
-- **WHEN** a complete local adopted checkout is used without network access
-- **THEN** installation SHALL use its verified local payload and preserve the
-  existing all-or-none installation and refusal behavior.
-
-### Requirement: Project workflow operates across the pinned legs
-
-The assembly SHALL own project workflow and its manifest/pins; product
-Full proposals, archives and canonical OpenSpec/Speckit artifacts SHALL live
-in spec, implementation in code. Genuine bounded feature amendment records
-SHALL remain in code as the narrow reviewed placement exception, not a second
-canonical baseline. A feature-branch origin SHALL NOT change a full proposal's
-role. Historical features SHALL NOT require manufactured local amendments.
-Continued features SHALL use paired leg worktrees with preserved feature IDs.
-Delivery SHALL land leg changes and select them through a root pin bump.
-CI SHALL test the exact composed state without silently skipping required
-cross-leg tests. The standard dependency SHALL remain unedited in place.
-
-#### Scenario: Implementation and specification land separately
-- **WHEN** new leg commits are ready for project delivery
-- **THEN** root gitlinks, pin records and workflow commit references SHALL move
-  together through the established pin-bump procedure and integration checks.
-
-#### Scenario: Bounded amendment folder exists before extraction
-- **WHEN** source content contains genuine `features/<NNN-feature>/openspec/` records
-- **THEN** the reviewed plan SHALL explicitly assign them to code until upstream
-  placement is qualified
-- **AND** pinned standard copies/digests SHALL NOT be edited to make placement pass.
-
-### Requirement: Migration retains provenance and explicit planning roots
-
-The migration SHALL preserve approved original repository/commit/path identities
-and verify correspondence to extracted spec identities when filtering changes
-hashes. It SHALL repair cross-leg links, baseline references and feature/task
-paths without guessing approved commits. Full proposal operations SHALL select
-the intended spec feature checkout; local amendments SHALL select their code
-root. A store pointer SHALL NOT override explicit local-root verification or
-authorize accidental changes to pinned base mounts. Pending schema/routing,
-bootstrap distribution and upstream placement automation SHALL remain distinct
-from adopted manual use on a target workstation.
-
-#### Scenario: Extraction changes an approved proposal commit
-- **WHEN** the extracted spec history has a different commit identity
-- **THEN** original approved provenance SHALL remain recorded
-- **AND** migration evidence SHALL establish the corresponding spec repository,
-  commit and path rather than substituting a guessed hash.
-
-#### Scenario: Local amendment root and docs store coexist
-- **WHEN** an operation could resolve to either planning root
-- **THEN** the operator SHALL verify its intended checkout, branch and root
-- **AND** a local amendment archive SHALL NOT prove canonical reconciliation.
-
-### Requirement: Tested reconciliation precedes completed assembly advancement
-
-Accepted bounded migration adjustments SHALL record unique feature-local IDs,
-governing baseline, affected requirements/tasks, authority/source, verification
-impact and dispositions. Working Speckit files SHALL update before dependent
-implementation. Larger scope/runtime/authority/external changes SHALL use full
-spec governance; unnecessary larger ideas SHALL be linked to future-proposal
-issues and excluded from current requirements/tasks. Speckit SHALL remain the
-only executable task list.
-
-At the first amendment, the feature SHALL create one spec reconciliation issue.
-After implementation and verification, it SHALL reconcile net tested effects
-once into governing specs/contracts/design with dated departures/as-built
-evidence, every disposition and the landed code identity. Inactive deltas SHALL
-be excluded while approved, archived and amendment history remains traceable.
-Spec/code PRs SHALL be prepared together. Code MAY land first, but reconciliation
-and matching spec/code pins SHALL precede completed assembly advancement.
-The issue SHALL close after spec landing; the feature landing record SHALL track
-assembly. Full spec archival SHALL explicitly select its root and wait for
-implementation/assembly landing; subsequent archive commits SHALL advance by
-ordinary pinning. Later behavior changes SHALL reopen reconciliation;
-cancellation SHALL record abandonment rather than as-built completion.
-
-#### Scenario: Code lands before final spec reconciliation
-- **WHEN** the code PR lands while final reconciliation remains open
-- **THEN** completed assembly advancement SHALL wait for the matching spec landing
-- **AND** the reconciliation SHALL reference the actual landed code commit.
-
-#### Scenario: Amendment was reverted or deferred
-- **WHEN** final reconciliation computes the tested semantic effect
-- **THEN** the inactive delta SHALL be excluded from governing behavior
-- **AND** its disposition, history and any future-proposal issue SHALL remain linked.
-
-### Requirement: Execution and cutover require reviewable evidence
-
-Real execution SHALL require an explicit approved plan, visibility, baseline,
-mapping and follow-ups. A local bare-remote rehearsal, preservation receipts,
-compatibility checks and required platform/CI checks SHALL precede cutover.
-Execution SHALL use a clean isolated source clone without linked worktrees.
-Failed verification SHALL retain the source/work and stop landing; rollback
-SHALL restore a reviewed prior state without destructive history rewriting.
-
-#### Scenario: Preparation is complete but approval is absent
-- **WHEN** mapping and planning validation have passed without execution approval
-- **THEN** the migration SHALL remain a plan and SHALL create no real leg
-  repositories, move no lanes and change no installed tools.
diff --git a/openspec/changes/migrate-to-triad/tasks.md b/openspec/changes/migrate-to-triad/tasks.md
deleted file mode 100644
index 6ef4d5bc..00000000
--- a/openspec/changes/migrate-to-triad/tasks.md
+++ /dev/null
@@ -1,26 +0,0 @@
-# Governance and Speckit handoff
-
-The sole executable list is [004-migrate-to-triad/tasks.md](../../../specs/004-migrate-to-triad/tasks.md).
-This checklist tracks governance, not duplicate implementation tasks.
-
-## 1. Proposal and handoff
-
-- [x] 1.1 Record the migration proposal, design, capability requirements,
-  preliminary adoption mapping and sole linked Speckit feature; verify all
-  artifacts exist and planning validation is recorded.
-- [ ] 1.2 Approve the frozen source/standard revisions, repository visibility,
-  final path mapping, follow-ups and active-work dispositions after Gates A/B;
-  verify #97/#121 have landed, their content is accounted for through the
-  refreshed baseline, and approval explicitly names the actual execution plan.
-
-## 2. Migration evidence and closure
-
-- [ ] 2.1 Accept exact assembled-head, preservation, feature-transition and
-  rollback evidence from Speckit Gates C–E; verify required CI and ownership
-  boundaries without enabling unrelated experimental runtime features.
-- [ ] 2.2 Accept final tested spec reconciliation, amendment dispositions and
-  approved-baseline correspondence; verify matched spec/code landings before
-  completed assembly advancement. Close reconciliation after spec landing.
-- [ ] 2.3 Archive only after the adopted assembly and selected leg pins land
-  and continued work is accounted for; verify root delivery and recorded
-  old-PR/worktree dispositions before closure.
diff --git a/openspec/changes/release-tags-pypi/.openspec.yaml b/openspec/changes/release-tags-pypi/.openspec.yaml
deleted file mode 100644
index b699b88b..00000000
--- a/openspec/changes/release-tags-pypi/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-10-17
diff --git a/openspec/changes/release-tags-pypi/clarifications.md b/openspec/changes/release-tags-pypi/clarifications.md
deleted file mode 100644
index a16fb102..00000000
--- a/openspec/changes/release-tags-pypi/clarifications.md
+++ /dev/null
@@ -1,147 +0,0 @@
-# Clarifications
-
-_Captured during proposal council review. These constrain the design._
-_Generated by /opsx:propose council on 2026-10-17_
-
-The council reviewed `proposal.md` at `698cf30`. It had three read-only
-reviewers: the product advocate (PA), the systems architect (SA) and the
-adversary engineer (ADV). Lane openRepoTools-3, the lead, assigned the
-verdicts on 2026-10-17 at about 22:4xZ. Its nine VALID verdicts are applied
-to `proposal.md`, and its correction to the release owner's `LICENSE` check
-followed lane openRepoTools-1's D3 and D4 (#186 comment 6242560541). The
-five NOTED verdicts are below, and the three DISMISSED ones are at the end.
-
-## Council-Identified Constraints
-
-### N1: how the pipx link is detected
-
-**Raised by:** systems-architect (SA1) and adversary-engineer (ADV3)
-
-**Concern:** `plan_install_targets` runs first (`openRepoTools:1853`), and
-the `jq` check comes only later, in `plan_hook_merge` (`openRepoTools:1863`,
-its refusal at `:2500`). `unplaceable_kind` refuses every link, and the
-generic refusal prints `rm -f -- "<dir>/openRepoTools"` (`openRepoTools:2466`).
-On a machine with no `jq`, or under a future pipx metadata format, a
-detection that read `pipx_metadata.json` would fail. The person would then
-follow the printed `rm`, and nothing on `PATH` could run `--install` again.
-Reading that file in bash without `jq` would also mean writing a JSON
-parser: pipx writes it with sorted keys, so `injected_packages` comes before
-`main_package`, and `"package"` keys appear more than once.
-
-**Design impact:**
-- The detection is the proposal's path rule ("The pipx link is skipped"). It
-  derives everything from the resolved link and asks only whether files and
-  directories exist. It parses no JSON, needs no `jq`, and takes nothing
-  from the environment or from the entry module.
-- Moving the `jq` check ahead of `plan_install_targets` is the design's
-  call. If it moves, a missing `jq` refuses before any link advice is
-  printed.
-- The fixtures mirror the venv layouts of pipx 1.11.1, 1.17.8 and 1.18.3,
-  under each of the three pipx homes the proposal names.
-
-### N2: the grammar bash reads the stamp with
-
-**Raised by:** systems-architect (SA2) and adversary-engineer (ADV4)
-
-**Concern:** bash reads `_release.py` itself and trusts no environment
-variable for the stamp. So the file needs a reader that cannot be talked
-into a half-stamp, and that runs under the oldest bash the payload supports.
-
-**Design impact:**
-- The reader is a fixed grammar modelled on `pin_parse`
-  (`openRepoTools:458`). It reads lines, takes only the five names, and
-  never sources, imports or runs the file.
-- It refuses, each with its own reason:
-  - an unreadable file;
-  - a partial stamp, meaning one that breaks the proposal's all-or-nothing
-    rule;
-  - a malformed field.
-- It holds to bash 3.2: no `${x,,}`, `mapfile`, `declare -A` or `local -n`,
-  and an `awk -v` value carries one line only (AGENTS.md).
-- The release build's stamp writer and this reader must agree. A test passes
-  the writer's output through the reader.
-
-### N3: where the release notes live after the cutover
-
-**Raised by:** systems-architect (SA3)
-
-**Concern:** `docs/` goes to the spec leg
-(`openspec/changes/migrate-to-triad/adoption-plan.yaml:183-184`). A release
-step in the code leg that read `docs/release-notes/`, or a code-leg test of
-the notes, would read across legs, like the follow-ups the plan already lists
-(`adoption-plan.yaml:393-401`).
-
-**Design impact:**
-- There are two ways to meet the proposal's cutover invariant that no release
-  step reads across legs:
-  - the notes stay in `docs/release-notes/`, in the spec leg with `docs/`,
-    and `release.yml` reads none of them;
-  - or they move into the code leg, and the adoption plan carries an
-    exception.
-- The design chooses. **The default** is that no release step reads them,
-  and the GitHub Release links to them.
-- Lane openRepoTools-1's reading of the plan at openRepoShape v1.1.0 already
-  puts `docs/release-notes/` in spec (#186 comment 6242560541).
-
-### N4: the file modes in hatchling's wheel
-
-**Raised by:** systems-architect (SA4). The reviewer gave this point from
-memory and marked it unverified.
-
-**Concern:** the proposal's mode check (each packaged file's mode in the
-wheel equals the commit's `100755` or `100644`) assumes that hatchling
-1.27.0's reproducible wheel keeps 0644 and 0755.
-
-**Design impact:**
-- Check whether hatchling 1.27.0's reproducible wheel keeps 0644/0755. If it
-  does not, the installer must set each placed file's mode itself.
-- Either way, the design relies on the installer for modes, never on the
-  wheel. `--install` already sets 755 on each command it places, and 644 or
-  600 on the rest.
-- **Checked while writing this file.** In hatchling 1.27.0's published wheel
-  (sha256
-  `d3a2f3567c4f926ea39849cdf924c7e99e6686c9c8e288ae1037c8fa2a5d937b`),
-  `normalize_file_permissions`
-  (`hatchling/builders/utils.py:96-110`) maps any mode to 0644, or to 0755
-  when the owner's execute bit is set. The wheel builder applies it whenever
-  the target is reproducible (`hatchling/builders/wheel.py:97-101` and
-  `:140`), and `reproducible` defaults to true
-  (`hatchling/builders/config.py:377-383`). So the mode check can hold as
-  written. The design still relies on the installer.
-
-### N5: the wording of VALID 9's refusal and report, and how pip's script is recognised
-
-**Raised by:** adversary-engineer (ADV2)
-
-**Concern:** the proposal makes `--install` refuse to replace pip's console
-script for openrepotools, and makes a package-mode `--install` report when
-the first `openRepoTools` on `PATH` is not the package's console script.
-Neither line's text is fixed yet, and neither is the test that tells pip's
-script from any other regular file.
-
-**Design impact:**
-- The design fixes the exact text of the refusal and of the shadow report.
-  - The refusal names the file and says it is pip's console script for
-    openrepotools. It says nothing was installed, and names the way out.
-  - The report names the `openRepoTools` that `PATH` finds first, and the
-    console script it expected.
-- A console script is recognised by its shebang, a `#!` line naming a
-  Python, together with the import of the `openrepotools` entry point that
-  pip's console-script template writes.
-
-## Considered and dismissed
-
-These were raised and ruled out. The design does not reopen them.
-
-- **D1: a sixth `--version` line read from the receipt** (PA3's first
-  option). This would be a new capability, out of scope for v1.1.0. The
-  proposal's non-goal "`--version` names the command's release, not the
-  placed files'" covers it.
-- **D2: binding the stamp's environment variables to the payload
-  directory** (SA2's variant: pass the payload directory, compare it with
-  `pwd -P`, then unset the variables). Bash reading `_release.py` beside its
-  own payload replaces it, and leaves no environment surface at all.
-- **D3: having the entry module pass its venv to bash** (ADV3's
-  suggestion). It only works when the package itself runs. A checkout's or
-  the one-line install's `--install` must recognise pipx's link too, and the
-  proposal's path rule covers every mode.
diff --git a/openspec/changes/release-tags-pypi/design.md b/openspec/changes/release-tags-pypi/design.md
deleted file mode 100644
index d716c602..00000000
--- a/openspec/changes/release-tags-pypi/design.md
+++ /dev/null
@@ -1,708 +0,0 @@
-# Design
-
-## Context
-
-See proposal.md for the why and the what, and the two delta specs for the
-behaviour contract. This file covers how. It answers the five constraints in
-clarifications.md (N1–N5) and does not reopen D1–D3.
-
-What the design builds on, as the code stands at `aaa7bc8`. The
-`openRepoTools` line numbers are re-derived at `c1c1c71`, where each fact
-still holds:
-
-- **`openRepoTools` is one bash file**, written for bash 3.2.
-  - `SELF="${BASH_SOURCE[0]:-$0}"` (`openRepoTools:74`).
-  - `die` prints `REFUSED: …` and exits 2 (`:88`).
-  - `--install` plans everything before it places anything. The order is
-    `plan_install_targets`, `payload_select`, the collection, then
-    `plan_hook_merge` and `plan_skill_targets` (`:2083-2092`).
-  - Each file is placed by renaming a temporary file over its path. The
-    `EXIT` trap removes `"$PLACING"*` (`:251`, `:2027`).
-  - `receipt_add` already skips a link (`:1515-1517`).
-  - `payload_select` copies locally when every `payload_names` file sits
-    beside `$SELF` (`:1192-1223`).
-  - `pin_parse` is the existing fixed-grammar reader (`:469`), with the shape
-    helpers `is_lower_hex` and `is_slug` (`:406-417`).
-- **The model is openRepoShape v1.1.0 (`190133d`).**
-  - Its package is declarative hatchling 1.27.0 under `src/`, with
-    force-include and no build hook.
-  - Its stamp rule is `read_stamp` (`src/openreposhape/standard.py:141-162`).
-  - Its `tests.yml` `package` job builds the wheel twice with `pip wheel`, and
-    runs pipx 1.11.1 on Python 3.9 with `PIPX_HOME` and `PIPX_BIN_DIR` in the
-    job's own temporary directories.
-  - Its `release.yml` holds the gates, the two-build `cmp`, the blob check,
-    the `.dist-info` check (`:649-655`) and the digest-definition assertion
-    (`:438-440`).
-- **Facts checked for this design:**
-  - **Hatchling 1.27.0's published wheel:**
-    - its reproducible mode is on by default and normalises modes to
-      0644/0755 (clarifications N4);
-    - a `license-files` pattern that matches nothing raises nothing
-      (`hatchling/metadata/core.py:757-770`);
-    - its version source searches its file with
-      `(?i)^(__version__|VERSION) *= *(['"])v?(?P<version>.+?)\2` under
-      `re.MULTILINE`, and takes the first match (`hatchling/version/core.py:6`
-      and `:32`).
-  - **pipx 1.17.12's source:**
-    - the default home is platformdirs' user data directory
-      (`pipx/paths.py:14`), which on macOS is
-      `~/Library/Application Support/pipx`, a path with a space;
-    - it falls back to `~/.local/pipx` where that exists (`:15`);
-    - the default bin directory is `~/.local/bin` (`:19`).
-- **The triad.**
-  - The adoption plan sends `.github/`, `upstream/` and `contracts/` to the
-    code leg, and `docs/` to the spec leg. `README.md`, `LICENSE` and
-    `.gitattributes` go to the root (`adoption-plan.yaml:79-80`, `:87-88`,
-    `:129-130`, `:137-138`, `:183-184`, `:381-382`).
-  - openRepoShape v1.1.0's split appends a 10-line LF block to the root's
-    `.gitattributes` (#186 comment 6242560541).
-
-## Goals / Non-Goals
-
-**Goals:**
-
-- **One list of payload files.** Bash's `payload_names` stays the only list.
-  The wheel's force-include map is written out once and held to that list by
-  a test.
-- **No channel from Python to bash.** Bash decides package mode, reads the
-  stamp and recognises pipx's link from paths and files alone. The entry
-  module passes nothing but the person's arguments.
-- **Every new refusal happens in the planning phase.** That means pipx's
-  link, pip's console script and a broken stamp, so a refusal places
-  nothing.
-- **The model's checks are taken as they are wherever they apply.** Each
-  place this design departs from them is named below.
-
-**Non-Goals:**
-
-- No hatch build hook, and no code that runs at build time apart from
-  hatchling.
-- No change to the receipt's format, to `payload_select`'s modes or to the
-  one-line install's fetch.
-- No reading of `pipx_metadata.json`'s contents, and no use of `PIPX_HOME`.
-- No Windows behaviour. `os.execvp` is not a true exec on Windows, and there
-  is no native Windows command (proposal, Non-goals).
-
-## Decisions
-
-### 1. The package lives in `src/openrepotools/`
-
-The wheel holds `openrepotools/__init__.py`, `openrepotools/_release.py`
-(the stamp), one entry module, and `openrepotools/payload/<P>` for every
-payload path P. `[tool.hatch.build.targets.wheel] packages` names
-`src/openrepotools`.
-
-- **Why `src/`.** The root already holds the bash file `openRepoTools`. A
-  directory `openrepotools/` beside it is the same name on a
-  case-insensitive disk, macOS's and Windows' default, so one clone could not
-  hold both. openRepoShape made the same choice for the same reason (its
-  `pyproject.toml` header).
-- **Alternative rejected:** a top-level package directory, for the collision
-  above.
-
-### 2. The force-include map is written out, and a test holds it to `payload_names`
-
-`pyproject.toml` lists each payload path explicitly, as
-`"<P>" = "openrepotools/payload/<P>"`, plus
-`"contracts/openreposhape-pin.yaml"`.
-
-A test runs `payload_names` from the bash file and compares its output, plus
-the pin file, with the map's keys and with the built wheel's names, in both
-directions.
-
-- **Alternative rejected:** a hatch build hook that generates the map from
-  `payload_names`. It would put repository code into every build, change
-  what the reproducibility check proves, and depart from the model's
-  declarative build.
-
-### 3. The entry module execs bash, and reads nothing
-
-The console script's function does one thing. It calls
-`os.execvp("bash", ["bash", <payload>/openRepoTools, *sys.argv[1:]])`, where
-`<payload>` is the `payload` directory beside the module's own file.
-
-- On `FileNotFoundError` it prints `REFUSED: openRepoTools needs bash, and
-  there is no bash on this PATH. Nothing ran.` to stderr and exits 2, the
-  same status as bash's `die`.
-- It does not read the stamp. Bash is the one reader at run time
-  (Decision 5), so Python and bash can never disagree about a stamp.
-- **Amended 2026-10-18 by the lead, on T007's measured report** (task T026):
-  - **The ignored signals are put back first.** Python starts with SIGPIPE
-    and SIGXFSZ ignored, an exec keeps an ignored disposition, and a
-    non-interactive bash cannot reset a signal that was ignored on entry.
-    Measured: bash's `SigIgn` is `0x4` when run directly and `0x1001004`
-    through the exec, and `yes | head -1` gives `141` directly but `1` and
-    a "Broken pipe" line through it. So the function sets both back to
-    `SIG_DFL` before the exec, as `subprocess`'s `restore_signals` does.
-    FR-003 needs it, and the module's allowlist gains `signal`.
-  - **`NotADirectoryError` is the same refusal.** With no bash on `PATH`
-    and a `PATH` whose last entry is a file, `execvp` raises
-    `NotADirectoryError`. The function refuses for it too, with the same
-    message and exit 2 (FR-004).
-  - **A named limit: the C locale.** Under a C or POSIX locale, Python's
-    locale coercion (PEP 538) sets `LC_CTYPE=C.UTF-8` before the function
-    runs, so bash sees it. The function does not undo it, because it cannot
-    tell coercion from a person's own `LC_CTYPE`. `PYTHONCOERCECLOCALE=0`
-    avoids it, and FR-003 names the exception.
-- **Alternative rejected:** a `subprocess` that passes the status back. A
-  signal would come back as a negative return code, and the `EXIT` trap would
-  run in a child the person's terminal does not own.
-- **Alternative rejected:** validating the stamp in Python as well, as the
-  model's `read_stamp` does. That makes two readers that can drift, which is
-  why D2 was dismissed.
-
-### 4. Bash decides package mode from paths
-
-Package mode holds when `$SELF`'s directory, resolved with `cd -P` and
-`pwd -P`, is named `payload`, its parent is named `openrepotools`, and that
-parent holds a regular file `_release.py`.
-
-- A checkout's `$SELF` is the root's `openRepoTools`, whose directory is the
-  root, so a checkout never matches. Neither does the one-line install, whose
-  `$SELF` is a pipe or a placed file in `<dir>`.
-- **In package mode bash reads its own stamp at start-up, before any
-  argument is acted on.** A broken stamp refuses every invocation, `--help`
-  included, with exit 2:
-
-  ```text
-  REFUSED: this package's stamp (openrepotools/_release.py) <why>, so this build is broken and nothing ran. A package's stamp is a release's whole stamp or the unstamped one. Reinstall it: pipx reinstall openrepotools
-  ```
-
-  `<why>` names one of the three causes:
-  - `cannot be read (<detail>)`;
-  - `is partial: <detail>`;
-  - `is malformed: <detail>`.
-
-  So the one line fits each of them (the lead's ruling 11, Open
-  Questions). This is the model's refusal, adapted. It names the stamp file
-  and the fix, `pipx reinstall openrepotools` (ruling 3).
-- **Alternative rejected:** reading the stamp only for `--version`. A broken
-  build would then run `--install` and place files under a release identity
-  nobody can name.
-
-### 5. The stamp's grammar, the writer and the reader (N2)
-
-**The file.** The committed file has a module docstring, then exactly five
-lines, in this order:
-
-```text
-VERSION = "<v>"
-TAG = "<t>"
-COMMIT = "<c>"
-DIGEST = "<d>"
-REPOSITORY = "<r>"
-```
-
-The committed file has `0.0.0` and four empty strings. The release build
-rewrites only those five lines, from the tag, the commit, the digest and
-`$GITHUB_REPOSITORY`, and leaves the docstring byte for byte. The grammar
-allows a docstring, and does not require one.
-
-**The reader** is a bash function in `pin_parse`'s style. It sets `STAMP_*`
-and returns 0, or sets `STAMP_WHY` and returns 1.
-
-- It reads LF only. A carriage return is refused with its line number.
-- It skips blank lines, `#` comments, and the one leading docstring if
-  there is one: from a line that begins with `"""` to the next line that
-  contains `"""`.
-- Every other line must be `NAME = "value"` at column 0. NAME is one of the
-  five, each appears exactly once, and the value holds no `"`, `\` or `$`.
-- An unknown name, a repeated name, a missing name or an unclosed docstring is
-  refused.
-
-**The checks, after the read:**
-
-- **Unstamped** is `TAG`, `COMMIT` and `DIGEST` all empty. Then `VERSION`
-  must be `0.0.0` and `REPOSITORY` empty. Anything else is a partial stamp.
-  - This is stricter than the model, which returns `version or "0.0.0"`. The
-    proposal says an unstamped package's `VERSION` is `0.0.0`, and a
-    `REPOSITORY` without a commit names nothing.
-- **Stamped** is everything else. Then:
-  - `VERSION` matches `X.Y.Z` or `X.Y.ZrcN` (digits, no leading zeros) and is
-    not `0.0.0`;
-  - `TAG` is exactly `v$VERSION`;
-  - `is_lower_hex 40 "$COMMIT"` and `is_lower_hex 64 "$DIGEST"` both hold;
-  - `is_slug "$REPOSITORY"` holds.
-  - Any failure is "a malformed field", named in `STAMP_WHY`.
-  - The `TAG = v$VERSION` and slug checks go further than the model, which
-    asks only that the tag is non-empty.
-
-**Hatch and bash read the same `VERSION`.**
-
-- Hatch takes the first line anywhere in the file that matches its
-  case-insensitive pattern.
-- So the reader also refuses a docstring line that begins, in any case, with
-  `version` or `__version__` followed by optional spaces and `=`.
-  - The guard first folds the three non-ASCII letters that Python's `(?i)`
-    matches: U+017F onto `s`, and U+0130 and U+0131 onto `i` (T011).
-  - A guarded line is refused when the docstring closes, not when it is
-    read, so an unclosed docstring is reported as unclosed (T011).
-- A test runs hatch's pattern and the reader on the committed file and on a
-  stamped one, and requires one answer.
-
-**Writer and reader agree.** A test writes a stamp with the build's writer,
-reads it back with the bash reader, and covers each refusal with one fixture:
-
-- an unreadable file;
-- a carriage return;
-- a missing, repeated or unknown name;
-- a partial stamp, each way;
-- each malformed field.
-
-### 6. Recognising pipx's link (N1, proposal VALID 5)
-
-The check runs inside `plan_install_targets`, for the target `openRepoTools`
-only, before `unplaceable_kind` is asked about it.
-
-**Resolve.**
-
-- While the path is a link, read it with plain `readlink`. Join a relative
-  value to the link's own directory.
-- Stop after 40 hops. A longer chain, or a cycle, is not pipx's link.
-- Then canonicalise the final file's directory with `cd -P -- … && pwd -P`.
-- Every expansion is quoted, because macOS's default pipx home contains a
-  space.
-
-**Match.**
-
-- The resolved file is a regular file named `openRepoTools`, in a directory
-  named `bin`.
-- `<venv>` is that directory's parent. `<venv>/pipx_metadata.json` is a
-  regular file.
-- Some `<venv>/lib/python*/site-packages/openrepotools/payload/openRepoTools`
-  is a regular file. The glob is looped with a `-f` test, because an
-  unmatched glob stays literal in bash.
-
-**Result.** On a match, three variables record the skip:
-`PIPX_LINK=<dir>/openRepoTools`, `PIPX_VENV` and `PIPX_PAYLOAD`.
-
-- The placement loop skips that name.
-- `receipt_add` already writes no row for a link.
-- The count line and the skip line are the proposal's.
-- Retirement code never touches `PIPX_LINK`.
-
-**The `jq` check stays where it is (N1's open choice).**
-
-- Since pipx's link is recognised before any link refusal, a missing `jq` no
-  longer leads to `rm` advice for it. The run reaches `plan_hook_merge`'s
-  `jq` refusal instead.
-- Moving `jq` ahead of `plan_install_targets` would change the order of
-  refusals that A9 Addendum 4 (R-A9-12) fixed, "the targets are asked about
-  first", for no further gain.
-
-**A venv-shaped link that fails the rule** (a future pipx layout, say) is
-still refused, because it is not provably pipx's. It resolves to
-`…/bin/openRepoTools` in a directory that also holds `pyvenv.cfg`.
-
-- Its refusal line calls it "a link into a Python environment, perhaps
-  pipx's".
-- It prints no `rm -f` for it. It names `pipx reinstall openrepotools`, and
-  asks for an issue with the layout.
-- That keeps ADV3's failure, deleting the only working command, out of every
-  path.
-
-**The fixtures.**
-
-- A fake venv tree per case: `bin/openRepoTools`, `pipx_metadata.json` with
-  placeholder content (the rule reads only its existence),
-  `lib/python3.X/site-packages/openrepotools/payload/…`, and `pyvenv.cfg`.
-- The cases cross pipx 1.11.1, 1.17.8 and 1.18.3 with four homes:
-  `$PIPX_HOME`, `~/.local/pipx`, `~/.local/share/pipx`, and a home with a
-  space in it, which is the macOS default.
-- The python directory differs as those releases' Pythons do: `python3.9`
-  for 1.11.1's leg, and a 3.1x for the others.
-- The negative cases: a link into a venv without the payload, without the
-  metadata file, or not under `bin/`; a chain of 41 links; a cycle.
-
-### 7. The count line when the run is not pipx's own
-
-"pipx's own environment" means package mode with `$SELF` under
-`$PIPX_VENV`'s `site-packages`. Then the count line is
-`openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx`.
-
-Otherwise the line adds
-`; the other 16 now come from <source>, not from <pipx's>`.
-
-- **`<source>`.** A package-mode run names its own release:
-  `openrepotools <version>`, from its own stamp, whether or not it runs
-  inside a pipx venv (the lead's ruling 10). Its stamp is always readable,
-  because `package_init` refuses a broken one first.
-  - A checkout or a one-line install names the repository and ref it
-    collected from. That is the pair `payload_where` names
-    (`openRepoTools:1023-1029`), written `<repo> @ <ref>` as `--version`
-    writes it.
-  - For an adopted source, it is the pinned code repository and revision.
-  - One test pins the exact line for each layout.
-- **`<pipx's>`** is `openrepotools <version>`, from the reader of Decision 5
-  run on the `_release.py` beside `PIPX_PAYLOAD`. An unstamped one gives
-  `0.0.0`.
-- **An unreadable stamp there.** When that stamp fails the reader,
-  `<pipx's>` is `the openrepotools beside pipx's link, whose stamp cannot be
-  read`, and the install goes on. That stamp belongs to another install, and
-  this run's own bytes are not in question.
-
-### 8. pip's console script, and the PATH report (N5, VALID 9)
-
-**Recognising it.** A regular file at `<dir>/openRepoTools` is pip's console
-script for openrepotools when:
-
-- **its interpreter is a Python.** This holds in either of the two forms
-  pip writes:
-  - its first line is `#!` and names a path whose last segment begins with
-    `python`;
-  - or it is pip's `/bin/sh` trampoline, which pip writes when the
-    interpreter's path holds a space or is too long for a shebang. That is
-    a first line `#!/bin/sh`, then `'''exec' <python> "$0" "$@"`, then
-    `' '''`. Here `<python>` is quoted when it holds a space, and its last
-    segment begins with `python`. The form is pip 26.2.1's
-    (`pip/_vendor/distlib/scripts.py:180-182`), and the lead's ruling 9 adds
-    it;
-- **and it imports the entry point.** One of its first 20 lines matches
-  `^from openrepotools(\.[A-Za-z_][A-Za-z0-9_]*)* import `. pip's own
-  template writes that line at column 0, after the trampoline as without it
-  (`PipScriptMaker`, `pip/_internal/operations/install/wheel.py:417-424` in
-  pip 26.2.1).
-
-The check runs in `plan_install_targets`, in every mode. That includes a
-package-mode `--install` run from a `pip install --user` of this package, so
-the pip route is refused even when it is pip's own command running.
-
-**The refusal (exit 2):**
-
-```text
-REFUSED: `--install` will not replace <dir>/openRepoTools: it is pip's console script for openrepotools (`pip install --user openrepotools` leaves it there), and another installer's command is not this installer's to overwrite.
-    NOTHING was installed and nothing already installed was replaced.
-    pipx is the one package route. To move to it:
-        pip uninstall openrepotools
-        pipx install openrepotools
-        openRepoTools --install
-```
-
-**The PATH report** runs last in a package-mode `--install`, after every
-placement, and changes nothing.
-
-- `type -P openRepoTools` finds the first on `PATH`. bash 3.2 has `type -P`.
-- It is resolved with Decision 6's loop.
-- It is compared with `<prefix>/bin/openRepoTools`, where `<prefix>` is the
-  directory five levels above the payload directory, the parent of its
-  `lib/` (`<prefix>/lib/pythonX.Y/site-packages/openrepotools/payload`).
-- On a mismatch, or when nothing is found, it prints one line, and the exit
-  status is unchanged:
-
-  ```text
-  openRepoTools: note: the first openRepoTools on your PATH is <first, or "none">, not this package's <prefix>/bin/openRepoTools, so the release you just installed is not the one that runs; put the directory that holds pipx's link to it ahead of <first's directory> on PATH
-  ```
-
-- **Alternative rejected:** refusing the install on a mismatch. The files are
-  placed correctly, and only the order of `PATH` is wrong, which is the
-  person's to change.
-
-### 9. The `package` job and the package tests
-
-The job runs on `ubuntu-latest` with Python 3.9.
-
-- **The checkout uses `submodules: true`**, because the command tests skip
-  without the submodule (AGENTS.md).
-- **The build follows the model's `package` job:** `pip wheel` twice with
-  `SOURCE_DATE_EPOCH` at the commit's time, then `cmp`. The isolated build
-  takes hatchling at `pyproject.toml`'s pin.
-- **The wheel checks:**
-  - each file outside `.dist-info` is checked against its blob:
-    `openrepotools/payload/<P>` against `git show HEAD:<P>` with its mode
-    against `git ls-tree`, and every module against `src/<name>`;
-  - the `.dist-info` names are checked, `licenses/LICENSE` included, as the
-    release build checks them;
-  - the stamp is checked to be byte-identical to the committed
-    `_release.py`.
-- **pipx is the model's:** 1.11.1 on 3.9, with `PIPX_HOME` and
-  `PIPX_BIN_DIR` under `$RUNNER_TEMP`. Then come the unstamped `--version`,
-  and an offline `--install` into a temporary `HOME`. The skip and count
-  lines are compared exactly.
-- **The package tests, run so that a skip fails the job:**
-  - pytest at the suite's pin, with `--junitxml`;
-  - a step then fails unless the report has at least one test and zero
-    skipped.
-  - The package tests read `pyproject.toml` with `tomllib`, or with `tomli`
-    where `tomllib` is missing. The job installs `tomli` at a pinned
-    version, by hash, beside pytest.
-  - **Alternative rejected:** an environment switch inside the tests that
-    turns a skip into a failure. That couples the tests to CI, and a JUnit
-    count also catches zero tests collected.
-- **The pipx-skip tests build Decision 6's fixtures,** with no pipx and no
-  wheel. So they also run in the `tests` job, and skip in
-  `tests-no-submodule` exactly as the other command tests do.
-
-### 10. The release workflow: the model's, with these differences
-
-`release.yml` is adapted from openRepoShape v1.1.0. Its gates, the two
-`git archive` builds, the `cmp`, the blob check, the `.dist-info` check, the
-sha256 record, the upload re-reads and the served-digest check are taken
-over as they are. It differs in these places:
-
-- **The version.** `X.Y.ZrcN` is accepted for TestPyPI. The `pypi` job
-  uploads only a final `X.Y.Z`: it is skipped for a pre-release, and its
-  first step refuses one if it ever starts.
-- **The repository guard** (the lead's ruling 6). The model has none, so it
-  is new here. It puts Brett Heap's answers 2 and 3 into the workflow's
-  code:
-  - in `opensoft/openRepoTools`, `testpypi` takes only a pre-release, and
-    `pypi` refuses outright;
-  - in `opensoft/openRepoTools-code`, a pre-release goes to TestPyPI only,
-    and a final goes to TestPyPI and then to PyPI;
-  - in any other repository, both upload jobs refuse.
-
-  The build decides it from `$GITHUB_REPOSITORY`, the version and the ref,
-  before any approval is asked. It refuses a tag dispatch that this
-  repository may not upload, and records which uploads may run. Each upload
-  job's condition reads that record, and its first step checks the rule
-  again. The absent pypi.org publisher is the second line of defence.
-- **The stamp's fifth field.** `REPOSITORY` is set to `$GITHUB_REPOSITORY`.
-- **The digest-definition assertion.** It compares the pinned
-  `repo_shape.TREE_DIGEST_DEFINITION` with the literal `sorted-ls-tree-r-v1`
-  and with `contracts/openreposhape-pin.yaml`'s `digest_definition`.
-  - A test holds bash's `--version` label to the same literal, so the three
-    are tied.
-  - The model compares with its package's constant instead, which this
-    package does not have.
-- **The payload blob and mode check** covers `openrepotools/payload/`
-  against the commit's paths, not `src/`.
-- **The install check.**
-  - Its legs are ubuntu and macOS on Python 3.x, and ubuntu on 3.9, with no
-    Windows leg.
-  - Each leg runs `--version`, then an offline `--install` into a temporary
-    `HOME`, and compares the skip and count lines exactly.
-  - On macOS, the leg reruns `--install` with `PATH="/bin:$PATH"` so that
-    `/bin/bash` 3.2 runs, and prints `BASH_VERSION`.
-  - On 3.9, the leg compiles `lanes-index` and `lane-worktrees` with
-    `compile()`, which writes no bytecode.
-- **The release notes.** `release.yml` reads none (Decision 11).
-
-### 11. The release notes stay in the spec leg, and no release step reads them (N3)
-
-- `docs/release-notes/` stays under `docs/`, which goes to spec. That is the
-  plan's own mapping, and lane openRepoTools-1's reading at v1.1.0 (#186
-  comment 6242560541).
-- No step of `release.yml` reads a notes file, and no code-leg test reads
-  one.
-- The GitHub Release is created by the release owner, by hand, after PyPI
-  serves the version: `gh release create v<version> --repo <repository>
-  --verify-tag --notes-file <spec>/docs/release-notes/v<version>.md`, from a
-  checkout that has the spec leg. `<repository>` is the one the tag is in,
-  `opensoft/openRepoTools-code` for v1.1.0.
-  - That is a person's act and not a release step, so it does not break the
-    invariant.
-  - The Release's body is the notes file's text, as v1.0.0's is. The v1.1.0
-    draft ends with a line naming its own path in the spec leg, so the
-    Release also links to the notes, as N3's default asks.
-  - `release.yml`'s RELEASING header writes the step down.
-- **Alternative rejected:** moving the notes to code. It needs an exception
-  in the plan, and buys nothing, since nothing at run time reads them.
-
-### 12. File modes: the installer is the source (N4)
-
-- `--install` already sets 755 on each command it places, and 644 or 600 on
-  everything else, on every run. That stays the only thing modes depend on
-  at run time.
-- The wheel's mode check stays as a build check. Hatchling 1.27.0 normalises
-  to 0644/0755 from the owner's execute bit, so a `100755` blob is 0755 in
-  the wheel and a `100644` blob is 0644.
-
-## Risks / Trade-offs
-
-- **[A pipx release changes its venv layout]** → The path rule then stops
-  matching, and the install is refused. The venv-shaped refusal of Decision 6
-  prints no `rm` for that link, and names `pipx reinstall`. The fixtures name
-  the three pipx versions they mirror, so a new layout gets a new fixture.
-- **[`readlink` behaves differently across platforms]** → Only plain
-  `readlink <path>` is used, which prints the link's own value on Linux,
-  macOS and BSD alike. The canonicalisation is bash's `cd -P` and `pwd -P`.
-  The macOS install-check leg runs the rule under bash 3.2.
-- **[Hatch and bash read different versions from `_release.py`]** →
-  Decision 5's reader refuses every line hatch could match before the real
-  `VERSION`, and a test runs both readers on the same files.
-- **[The code leg ships without `LICENSE`]** → Hatchling would build a wheel
-  without it. The `.dist-info` check in the `package` job and in the release
-  build refuses that wheel. `code-0001` is the code leg's first commit, and
-  lane openRepoTools-3 checks blob `261eeb9` before the first `package` run
-  (proposal, "Release owner").
-- **[`git archive` changes bytes through `.gitattributes`]** → The blob check
-  compares every packaged file with `git show`, so an `eol`, `ident`,
-  `export-subst` or `filter` transform refuses the build, never ships. An
-  `export-ignore` on a payload path fails the wheel-versus-`payload_names`
-  test. The plan puts `.gitattributes`, with openRepoShape v1.1.0's appended
-  LF block, at the assembly root and not in the code leg (Context). An `eol=lf`
-  rule on files that are already LF changes no byte in any case.
-- **[A job id changes in the code leg's `tests.yml`]** → The gate finds no
-  run of that job and refuses (delta spec, "The cutover invariants"). Lane
-  openRepoTools-1's plan carries the four ids as an invariant.
-- **[A stale bash `openRepoTools` shadows pipx's]** → Decision 8's report
-  names it after a package-mode install. After a plain `pipx install` over
-  the one-line install's file, no package-mode run happens, so no report can
-  appear. pipx's own warning is then the only signal, and README gives
-  `pipx install --force` for that reason.
-- **[Strictness costs compatibility]** → Decision 5 refuses some stamps the
-  model would accept: a non-`0.0.0` version with no commit, a tag other than
-  `v<version>`, or a repository that is not a slug. Only the release build
-  writes a stamp, and its writer is tested against the reader, so no
-  legitimate stamp is refused.
-
-## Migration Plan
-
-Proposal "Sequencing with the triad cutover" holds the order. What the design
-adds to it:
-
-1. **Feature 006 lands in `opensoft/openRepoTools`.** One PR, or a short
-   series, as `/speckit.tasks` splits it. Each lands by squash once it is
-   reviewed and green. These land before lane openRepoTools-1's rehearsal
-   and plan.
-2. **A branch rehearsal of `release.yml`** builds and runs the install check,
-   and uploads nothing. Then, on Brett Heap's word, the `v1.1.0rc1` TestPyPI
-   rehearsal runs.
-3. **The cutover.** `execute` runs, then `code-0001` as the code leg's first
-   commit, then the `LICENSE` blob check. Then Brett's code-side acts, then
-   v1.1.0, then the README PR.
-
-**Rollback.**
-
-- Before any upload, a defect is fixed by a PR on `main`, or the PR that
-  introduced it is reverted. Nothing outside the repository has changed.
-- After an upload, a defect is fixed forward by the next patch version. A
-  tag is never moved, and an index never takes a file name twice.
-- A workstation can always leave the package: `pipx uninstall openrepotools`,
-  then the one-line install's `--install`. The uninstall scenario in the
-  `pypi-package` delta spec holds this.
-
-## Open Questions
-
-### Resolved by the lead
-
-Lane openRepoTools-3, the lead, ruled on the points this file's writer
-raised. Each is marked with the date of the ruling.
-
-1. **The `.dist-info` check is confirmed.** Resolved by the lead,
-   2026-10-17.
-   - The release build and the `package` job both require the wheel's
-     `.dist-info` to hold exactly `METADATA`, `WHEEL`, `RECORD`,
-     `entry_points.txt` and `licenses/LICENSE`, with that `LICENSE` equal to
-     the commit's (Decisions 9 and 10).
-   - This check is how "the package never tolerates a missing `LICENSE`" is
-     enforced, because hatchling 1.27.0's `license-files` glob does not fail
-     on a missing file.
-   - The order stands: T006's `code-0001` is the code leg's first commit,
-     right after `execute`.
-2. **workBenches main is noted at `bdab3e2`.** Resolved by the lead,
-   2026-10-17. Both of its checks, `check_target_preflight` and
-   `verify_installed`, still hold there, and this change cites `bdab3e2`.
-3. **The stricter stamp rules are confirmed.** Resolved by the lead,
-   2026-10-17.
-   - Unstamped means `VERSION` `0.0.0` with an empty `REPOSITORY`.
-   - `TAG` equals `v$VERSION`.
-   - `REPOSITORY` is an owner/name slug.
-   - A broken stamp refuses every package-mode invocation, `--help`
-     included (Decision 4).
-   - The refusal names the stamp file and the fix,
-     `pipx reinstall openrepotools`. Decision 4's line says so, in place of
-     the `pipx install --force openrepotools` it named before this ruling.
-4. **The design's additions are confirmed.** Resolved by the lead,
-   2026-10-17.
-   - The `jq` check stays where it is (Decision 6).
-   - A venv-shaped link that fails the pipx rule is refused, with no `rm`
-     advice (Decision 6).
-   - The stamp reader keeps the docstring guard (Decision 5).
-   - The fixtures include a pipx home with a space in it (Decision 6).
-5. **The checkout's count line is confirmed.** Resolved by the lead,
-   2026-10-17. It is exactly the line the proposal ("Coexistence with the
-   other installers") and the `pypi-package` delta spec fix (Decision 7).
-
-### Resolved by the lead, 2026-10-18
-
-The lead ruled on the report at `335d226`. Each item below is resolved by
-the lead, 2026-10-18.
-
-6. **The uploads are guarded by repository**, in code (Decision 10).
-7. **The tag-bound checks stand down on a branch rehearsal**, as in
-   openRepoShape's `release.yml:200-249`, and every other check still runs.
-   The proposal and the `pypi-package` delta spec now say so.
-8. **`main` is not merged into the branch now.** The implementation's first
-   act is that merge, made as a merge commit.
-9. **pip's `/bin/sh` trampoline is recognised** as pip's console script
-   (Decision 8).
-10. **A package-mode run names its own release** as the count line's source
-    (Decision 7).
-11. **Wording.** Each of these is settled:
-    - the count line with an unreadable stamp (Decision 7);
-    - the broken-stamp line, made to fit its three causes (Decision 4);
-    - "venv-shaped" is the one term for that link;
-    - the `pypi` job is "skipped" in an rc rehearsal;
-    - a branch rehearsal builds with the version of the tag it rehearses.
-      Before v1.1.0 that is the next pre-release, `1.1.0rc1` for the first,
-      as the model rehearsed v1.1.0 from `l3-rehearsal-v1.1.0`.
-
-Ruled after #237 merged, so numbered after item 12 below:
-
-13. **006's counts follow #237 (merged as `586dea2`).**
-    - Before: `--install` placed 31 artifacts always; with pipx's link, 30
-      placed, 1 left to pipx and 28 receipt rows.
-    - After: it places 29 always; with pipx's link, 28 placed, 1 left to pipx
-      and 28 receipt rows; and the two hook entries on top of either, once
-      `~/projects/xFactory/lanes-edit.sh` answers `guard`.
-
-Ruled on T013's report, so numbered after item 13:
-
-14. **T013's two points.**
-    - A local adopted source sets no `PAYLOAD_REPO` or `PAYLOAD_REV`, so the
-      count line's `<source>` is the pin's own pair,
-      `<PIN_SOURCE_REPOSITORY> @ <PIN_COMMIT>`, the one a remote adopted run
-      reads.
-    - The PATH report's skip case is silent: where the directory names
-      above the payload do not match, it prints nothing (research R7).
-
-### Resolved by Brett Heap, 2026-10-18
-
-12. **The workBenches condition.** Resolved by Brett Heap, 2026-10-18: (c).
-    His words were "go with (c)".
-    - Lane openRepoTools-3 has filed opensoft/workBenches#165, for
-      workBenches' `scripts/setup-estate-commands.sh` to accept pipx's link.
-    - README offers the pipx route only after opensoft/workBenches#165
-      lands. Until then, README says that a workstation uses one route or
-      the other, never both.
-    - The proposal's single bullet that depends on it, position (c), now
-      states his choice.
-    - As this file said while the question was open, the choice changes
-      only that bullet and when the README PR of step 6 can open. It also
-      adds README's one-route sentence, in feature 006's README task. It
-      changes none of the code, delta specs or decisions here.
-
-### Resolved by the lead, 2026-10-18, on T020
-
-The lead ruled on T020's first doubt. The item below is resolved by the
-lead, 2026-10-18, and numbered after item 14.
-
-15. **The upload jobs' empty-index check is the model's form.** Resolved by
-    the lead, 2026-10-18.
-    - Before the upload, the index holds no file of the version but the
-      verified wheel at its recorded digest. A 404 passes. The verified
-      wheel already there at that digest, not yanked, passes, and the
-      upload (`skip-existing`) adds nothing new. A file of any other name,
-      the wheel's name at another digest, or the verified wheel yanked
-      refuses the job before the upload (Decision 10).
-    - FR-031 stands as written: "The index MUST hold no other file of that
-      version before the upload, and MUST serve exactly the recorded digest
-      after it". FR-028 stands too: the model's checks, as they are.
-    - The reason: the strict form, the index holding no file at all, would
-      make "Re-run failed jobs" impossible after an upload that went
-      through but whose served-digest check timed out.
-    - Three places said the strict form, and now say this one:
-      `contracts/workflows.md`'s `testpypi` bullet on TestPyPI's JSON,
-      spec.md's User Story 5, acceptance scenario 5, and the `pypi-package`
-      delta spec's scenario for an index that already holds a file of the
-      version.
-
-### Still open
-
-- **The `release/*` ruleset.** #850 leaves the choice to Brett: no
-  force-push and no deletion, or a rule requiring PRs. It decides only
-  whether a back-port is a fast-forward or a cherry-pick PR, and both are
-  specified.
-- **The text of `docs/release-notes/v1.1.0.md`** is drafted in feature 006
-  and settled before the tag.
diff --git a/openspec/changes/release-tags-pypi/proposal.md b/openspec/changes/release-tags-pypi/proposal.md
deleted file mode 100644
index 63e1411e..00000000
--- a/openspec/changes/release-tags-pypi/proposal.md
+++ /dev/null
@@ -1,790 +0,0 @@
-# Proposal: release tags, release branches and `openrepotools` on PyPI
-
-Governing issue: opensoft/openRepoTools#228. Sole implementation feature:
-Speckit `006-release-pypi`, on the branch of that name cut from main `aaa7bc8`.
-`specs/006-release-pypi/` is written by `/speckit.specify`.
-
-## Why
-
-Brett Heap, 2026-10-17: "lets setup tagging and release branches. we will
-publish on pypi. lets assume we are currently on 1.0.0 and we will do our first
-real release on pypi with v1.1.0. look at the way we did this for openRepoShape
-and lets do similar."
-
-openRepoTools has no release identity. README.md says "There is no version
-number here", and `--version` names only a repository and a ref. So:
-
-- a workstation cannot say which release it runs;
-- a fix cannot be shipped to an older line;
-- the only way to install is a network fetch of whatever `$OPENREPOTOOLS_REF`
-  (default `main`) holds at that moment.
-
-openRepoShape now has a reviewed model for all three problems. It uses
-annotated tags, `release/vX.Y` branches (opensoft/openRepoShape#850), and a
-gated, reproducible upload to PyPI by trusted publishing
-(opensoft/openRepoShape#563). If openRepoTools adopts that model now, the
-regenerated triad adoption plan (#186) carries the packaging into
-`openRepoTools-code`, which is where v1.1.0 is published.
-
-## Brett Heap's decisions (2026-10-17, about 20:55Z, as recorded on #228)
-
-No transcript-free source gives the exact second. The `v1.0.0` tag that
-decision 2 made has the tagger time 20:57:55Z, so the answers came before it.
-
-1. **v1.1.0 is published after the triad cutover.** The packaging and the
-   release workflow land now and are rehearsed on TestPyPI now. v1.1.0 is
-   published from `openRepoTools-code` after lane openRepoTools-1's cutover
-   (#186).
-2. **The baseline is done.** An annotated `v1.0.0` tag (tag object `6a826f8`)
-   points at main `aaa7bc8`, and its GitHub Release was published at
-   20:57:57Z. Nothing is on PyPI.
-3. **The wheel carries the whole tool payload, installed offline.**
-   `openRepoTools --install` learns to skip a target that pipx placed.
-4. **Merging.** Lane openRepoTools-3 squash-merges the release-setup PRs once
-   they are reviewed and green. Tags, the release branch and every upload
-   still wait for Brett's word and for his approval in the environment.
-
-**A correction to the record.** #228's decision 3 says `--install` skips a
-pipx-placed command "as opensoft/openRepoShape#563 did". That was lane 3's
-wording error, in its question to Brett. #563 *refuses* a target that is a
-symbolic link (its decision 2, approved 2026-10-15T13:32:51Z).
-
-### Addendum: Brett Heap's answers of 2026-10-17T21:51:50Z
-
-He answered the alignment review's questions in lane 3's session. They are
-recorded on #228 as comment 6241784787.
-
-1. **Skip the pipx link.** `--install` skips the `openRepoTools` that pipx
-   placed, places the other 16 files, and names `pipx upgrade openrepotools`
-   as the way to update the skipped command. Every other link is still
-   refused. The reason: pipx's command is the one that runs `--install`, so
-   skipping is how the two installers coexist.
-2. **Upload `1.1.0rc1` to TestPyPI.** A real pre-release upload proves the
-   workflow, TestPyPI publishing and the pipx install end to end. It departs
-   from openRepoShape, which uploads nothing before a final release. The
-   `v1.1.0rc1` tag still needs his word, and the `testpypi` deployment his
-   approval. The `pypi` job refuses every pre-release.
-3. **No pypi.org publisher for opensoft/openRepoTools.** Nothing will ever
-   upload to PyPI from this repository, and a pending publisher does not
-   reserve the name. The pypi.org publisher is made only for
-   `openRepoTools-code`, at the cutover. This supersedes the pypi.org part of
-   #228's plan step 5. The test.pypi.org publisher for this repository is
-   still needed, for the rc rehearsal.
-4. **The openRepoShape pin waits for v1.1.0.** Lane openRepoTools-1 pins
-   openRepoShape straight to v1.1.0, skipping v1.0.0: one pin update and one
-   migration rehearsal, then the cutover (#186 comment 6241785035, his words
-   "Yes, wait for v1.1.0"). openRepoShape v1.1.0 is the annotated tag
-   `b9c5099` on `190133d`, tagged at 2026-10-17T21:29:43Z and published on
-   PyPI by its `release.yml` run 39071178232.
-
-## What Changes
-
-Each item names what a test or a workflow run checks.
-
-### The package
-
-- **`pyproject.toml`** is a new root file. It declares:
-  - the build backend, pinned at `hatchling==1.27.0`;
-  - `name = "openrepotools"`;
-  - `dynamic = ["version"]`, which `[tool.hatch.version]` reads from
-    `src/openrepotools/_release.py`;
-  - `requires-python = ">=3.9"` and `dependencies = []`;
-  - `license = "Apache-2.0"`, with `license-files = ["LICENSE"]`;
-  - exactly one console script, `openRepoTools`;
-  - no `readme`, because README.md goes to the assembly root at the cutover
-    (see "The cutover invariants"). openRepoShape's declares none either.
-
-  A test holds `dependencies` empty, the scripts table to that one entry, and
-  the `readme` key absent.
-- **`src/openrepotools/`** is new. It holds the stamp and an entry module that
-  uses only the standard library. The entry module replaces itself with
-  `bash <payload>/openRepoTools` through `os.execvp`, with its arguments
-  unchanged. `<payload>` is the wheel's `openrepotools/payload/`. Because this
-  is an exec and not a subprocess, signals, the `EXIT` trap that removes
-  `"$PLACING"*` (`openRepoTools:240`) and the exit status pass between the
-  person and bash unchanged. A subprocess killed by a signal would instead
-  return a negative code.
-  - **Which bash.** It runs the first `bash` on `PATH`, as the payload's
-    `#!/usr/bin/env bash` line would. With no `bash` on `PATH`, it refuses,
-    naming the missing command, and runs nothing.
-  - **Held to the standard library.** A new test in `tests/test_repo_hygiene.py`
-    fails when a module under `src/openrepotools/` imports anything outside
-    the standard library. No rule holds that today, and
-    `test_the_python_files_compile` (`tests/test_repo_hygiene.py:2722-2741`)
-    compiles only `tests/*.py`, `lanes-index` and `lane-worktrees`. It also
-    compiles `src/openrepotools/*.py` from now on.
-- **The whole payload, byte for byte.** The wheel force-includes every file
-  that `payload_names` lists, each payload path P at `openrepotools/payload/P`:
-  - the seventeen `INSTALLABLES`, which are sixteen commands and the data file
-    `repos.tsv`;
-  - the three skills;
-  - the three command files;
-  - and also `contracts/openreposhape-pin.yaml`, so that `wip init` reads the
-    release's own pin.
-
-  A test compares the wheel with `payload_names`, so a file added to those
-  lists but not to the wheel fails. The `package` job and the release build
-  compare every packaged file with the commit's blob, and its mode in the
-  wheel with the commit's (`100755` or `100644`). Nothing at run time depends
-  on those modes: the entry module runs `bash <file>`, and `--install` sets
-  mode 755 on each file it places (`openRepoTools:1871-1919`).
-- **Offline install.** After `pipx install` of the wheel, run
-  `openRepoTools --install` with every network path refused: a sentinel
-  `$OPENREPOTOOLS_REPO`, no `gh`, and a `curl` that fails. It places the same
-  artifacts and receipt rows as an install from beside a full checkout, except
-  the one pipx link below. This holds because:
-  - `payload_select` takes its local mode only when every `payload_names` file
-    sits beside `$SELF` (`openRepoTools:969-984`);
-  - `assembly_above` finds no `contracts/code-pin.yaml` above
-    `openrepotools/payload/` (`openRepoTools:843-861`, run first at :971);
-  - `wip_shape_ref` reads `$selfdir/contracts/openreposhape-pin.yaml`
-    (`openRepoTools:3242`).
-
-### The stamp and `--version`
-
-- **The committed stamp is unstamped:** `VERSION = "0.0.0"`, `TAG = ""`,
-  `COMMIT = ""`, `DIGEST = ""` and `REPOSITORY = ""`. Only the release build
-  writes it. It writes five values:
-  - the version, taken from the tag (`v1.1.0` gives `1.1.0`);
-  - the tag;
-  - the tag's 40-hex commit;
-  - the commit's tree digest, `sorted-ls-tree-r-v1`. This is the definition
-    `contracts/openreposhape-pin.yaml` already names;
-  - the source repository, the release run's `$GITHUB_REPOSITORY`:
-    `opensoft/openRepoTools` for the rc rehearsal, and
-    `opensoft/openRepoTools-code` for v1.1.0. `$REPO` cannot serve here. It
-    defaults to `opensoft/openRepoTools` (`openRepoTools:70`), which becomes
-    the assembly at the cutover, so a v1.1.0 `--version` would name the wrong
-    repository.
-
-  No other file carries a version number.
-- **The stamp is all or nothing.** The rule is openRepoShape's
-  (`src/openreposhape/standard.py:153-156` at v1.1.0), adapted to this
-  stamp's five fields. With `TAG`, `COMMIT` and `DIGEST` all empty, the
-  package is unstamped, and its `VERSION` is `0.0.0`. Otherwise every field
-  is set, `VERSION` is not `0.0.0`, `COMMIT` is 40 hex digits and `DIGEST`
-  is 64. Any other stamp is a broken build: it is refused, and never read as
-  the part it holds.
-- **The digest code is the pinned standard's.** The build job runs
-  `upstream/openRepoShape/scripts/repo_shape.py` at the pin: `tree_digest` on
-  the checkout, and `tree_digest_from_gh` on the forge's tree listing. Its
-  checkout is at `submodules: true`, because the script exists here only
-  inside the submodule, and `git archive` leaves the submodule out. No copy is
-  added. openRepoShape runs its own checkout's copy the same way
-  (`release.yml:417-452` at v1.1.0). The adoption plan puts `upstream/` in the
-  code leg (`openspec/changes/migrate-to-triad/adoption-plan.yaml:381-382`), so
-  `openRepoTools-code` has it.
-- **How the stamp reaches `--version`.** The packaged bash stays the commit's
-  own blob, so the stamp is never written into it. Bash reads the stamp
-  itself, from the `_release.py` that sits beside its own payload directory
-  (`openrepotools/_release.py`, next to `openrepotools/payload/`). It reads
-  that file with a fixed grammar, as `pin_parse` reads the pin
-  (`openRepoTools:458`), and never imports or runs it. No environment
-  variable carries the stamp, and bash trusts none for it. So nothing leaks
-  to bash's children, a variable left in an environment cannot make a
-  checkout's `--version` name a release, and the tests have nothing to
-  clear. Bash's `--version` arm prints the package form when it runs from a
-  package's `openrepotools/payload/` with that `_release.py` beside it, and
-  today's line when it does not. Bash alone still parses the arguments, so
-  `--help`, `--install --version` and the refusal behave as they do in a
-  checkout. Bash refuses a stamp that breaks the all-or-nothing rule as a
-  broken build. The model is openRepoShape's `print_version`
-  (`src/openreposhape/cli.py:366-396` at v1.1.0), adapted because this
-  command's parser is bash.
-- **A stamped package's `--version`** prints exactly these five lines:
-
-  ```text
-  openRepoTools 1.1.0 (opensoft/openRepoTools-code @ <commit>)
-    version   1.1.0
-    tag       v1.1.0
-    commit    <commit>
-    digest    <digest> (sorted-ls-tree-r-v1)
-  ```
-- **An unstamped package's `--version`**, as the `package` job builds it,
-  prints exactly these five lines:
-
-  ```text
-  openRepoTools 0.0.0 (an unstamped package)
-    version   0.0.0, unstamped: a package built from a checkout, not a release
-    tag       none
-    commit    none
-    digest    none
-  ```
-- **A checkout or a one-line install** prints exactly what it prints today,
-  `openRepoTools (<repo> @ <ref>)`. The assertions in
-  `tests/test_openrepotools_command.py:299-319` stay as they are. Only their
-  docstring, which says "no version number", is rewritten.
-
-### `--install` and pipx
-
-- **The pipx link is skipped,** on Brett Heap's answer 1. The detection rule
-  is exact. `<dir>` is `$OPENREPOTOOLS_BIN_DIR`, by default `~/.local/bin`.
-  `<dir>/openRepoTools` is pipx's link when all three of these hold:
-  - it is a symbolic link;
-  - its target, resolved, is a regular file `<venv>/bin/openRepoTools`;
-  - that `<venv>` holds a `pipx_metadata.json`, and an
-    `openrepotools/payload/` tree in its `lib/python*/site-packages/`.
-
-  The rule reads paths and asks whether files exist, and nothing more. It
-  needs no `jq`, and bash parses no JSON for it. It resolves the link with a
-  loop of plain `readlink` that runs under bash 3.2, never `readlink -f` or
-  `realpath`. It holds in every mode: the package's own `--install`, a
-  checkout's and the one-line install's. It runs before any link refusal, so
-  the refusal's `rm -f` advice (`openRepoTools:2466`) is never printed for
-  pipx's link.
-
-  Nothing reads `PIPX_HOME`, so a venv under `$PIPX_HOME`, `~/.local/pipx` or
-  `~/.local/share/pipx` is found the same way. A test runs each of the three.
-  **The pipx versions.** The fixtures mirror the layouts of three pipx
-  releases: 1.11.1 and 1.17.8, which openRepoShape's install check locks for
-  Python below 3.10 and from 3.10 on (`.github/release-pipx-requirements.txt:52-55`
-  at v1.1.0), and 1.18.3, the newest on PyPI on 2026-10-17. 1.17.12 is only
-  the version installed on the bench where this proposal was drafted.
-  Then `--install`:
-  - skips that one target, and prints exactly
-    ``openRepoTools: left to pipx at <dir>/openRepoTools (a link into pipx's openrepotools environment); update it with `pipx upgrade openrepotools`, then run `openRepoTools --install` again``;
-  - places every other artifact;
-  - prints the count line exactly as
-    `openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx`, in place of
-    today's `$placed of ${#INSTALLABLES[@]}` (`openRepoTools:1921`), when it
-    runs from pipx's own environment. Run from anywhere else, the line names
-    its source too (see "Coexistence with the other installers");
-  - writes no receipt row for the link. Today the rows come from the full
-    `INSTALLABLES` list (`openRepoTools:1457`), so the receipt has 28 rows
-    against a full install's 29 (17 + 6 + 6).
-
-  No later install, and no retirement of `restart`, ever removes the link,
-  replaces it or writes through it.
-- **The upgrade order.** After `pipx upgrade openrepotools`, the other 16
-  files, the skills, the command files and any merged hook entries stay the
-  earlier release's until `openRepoTools --install` runs again, which the
-  skip line says. A test installs one wheel, upgrades to a second, and checks
-  that the second `--install` replaces the 16 files and still skips the
-  link.
-- **Uninstall.** `pipx uninstall openrepotools` removes only the link and its
-  environment. The 16 files, the skills, the command files, any merged hook
-  entries and the receipt stay, and README says so. A test removes the link
-  and the environment, checks that the 16 files are still there, and checks
-  that a checkout's `--install` then places a regular `openRepoTools` at that
-  path.
-- **`pip install --user`.** It places a regular file at `<dir>/openRepoTools`,
-  not a link, so the skip never applies. `--install` refuses to replace it
-  (see "Coexistence with the other installers").
-- **Every other link is still refused.** Today `plan_install_targets` refuses
-  the whole install when any target is a link ("NOTHING was installed"). That
-  stays true for every link except pipx's `openRepoTools`.
-- **This differs from opensoft/openRepoShape#563 on purpose.** In
-  openRepoShape, a pipx link at the target is refused, because pipx and
-  `--install` are rival installers of one command. Here, pipx's
-  `openRepoTools` is the command that runs `--install`, so skipping the link
-  is how the two installers coexist. The rule kept from #563 is that a link
-  is never a place to copy to.
-
-### Coexistence with the other installers
-
-pipx's command can meet the one-line install, a checkout's `--install`, pip
-and workBenches' `./setup.sh` on one workstation. Each pairing has one
-defined outcome. None of them may leave a person believing they run a release
-while they track `main`, which is the failure the Why exists to prevent.
-
-- **From the one-line install to pipx.** Run
-  `pipx install --force openrepotools`, then `openRepoTools --install`.
-  - A plain `pipx install` meets the regular file the one-line install left
-    at `<dir>/openRepoTools`. It only warns "File exists … Not modifying"
-    (pipx's `commands/common.py`), places no link and exits 0. The bash file
-    stays at that path and keeps running, and its next `--install` finds no
-    payload beside it and fetches `main` (`payload_select`,
-    `openRepoTools:966-997`). README gives `--force` for that reason.
-  - A test covers this order with fake layouts: a one-line install, then
-    pipx's link in its place as `--force` leaves it, then `--install` from
-    the fake venv's payload, which skips the link and replaces the other 16.
-- **A checkout's or the one-line install's `--install` meeting pipx's link.**
-  It skips the link by the same rule, and places the other 16 from its own
-  source. Its count line then says where they came from:
-  `openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx; the other 16 now come from <repo> @ <ref>, not from openrepotools <version>`.
-  `<version>` is the stamp beside the link's payload, read as `--version`
-  reads it. A package-mode run from outside pipx's environment names its
-  own release in place of `<repo> @ <ref>`: `openrepotools <its version>`,
-  from its own stamp. A test holds each line.
-- **Never replace another installer's command.** In every mode, `--install`
-  refuses to replace a regular file at `<dir>/openRepoTools` that is pip's
-  console script for openrepotools, as `pip install --user` leaves it.
-  Today `--install` would rename the payload's bash file over it in silence.
-  The refusal is made in the planning phase, like every other, so nothing is
-  placed. README names pipx as the one package route. A test holds this.
-- **Never shadow it either.** Once a package-mode `--install` has placed its
-  files, it reports when the first `openRepoTools` on `PATH` is not that
-  package's console script once links are resolved. That covers a
-  `PIPX_BIN_DIR` that differs from `$OPENREPOTOOLS_BIN_DIR`, and an older
-  bash file ahead of pipx's link on `PATH`. A test holds each case.
-- **The workBenches condition.** This bullet is the only place that states
-  it; the rest of the proposal calls it "the workBenches condition".
-  - README's route on a new workstation is workBenches' `./setup.sh`
-    (README.md:208-221). Its `scripts/setup-estate-commands.sh` lists
-    `openRepoTools` in `TOOLS_FILES`. It refuses a symlinked target before it
-    installs anything (`check_target_preflight`). After installing, it
-    requires a regular file identical to its vendored copy
-    (`verify_installed`). These are lines 191, 383-386 and 490-493 at
-    workBenches main `bdab3e2`, and the same checks stand at `b2bed1c` before
-    it. On a workstation with pipx's link, every `./setup.sh` therefore
-    refuses its estate step and names that link.
-  - **Position (c), decided by Brett Heap on 2026-10-18** ("go with (c)"):
-    lane openRepoTools-3 has filed opensoft/workBenches#165, for workBenches
-    to accept pipx's link. README offers pipx only after
-    opensoft/workBenches#165 lands. Until then, README says that a
-    workstation uses one route or the other, never both.
-
-### The release workflow
-
-- **`.github/workflows/release.yml`** is new, adapted from the one in
-  openRepoShape v1.1.0 (`190133d`), as published on PyPI by run 39071178232.
-  It runs on `workflow_dispatch` only, with a `version` input. It
-  sets `permissions: {}` and grants each job its own permissions. Only one
-  release runs at a time, and a running release is never cancelled.
-- **The build job refuses unless every check passes:**
-  - The version is a final `X.Y.Z`, and not `0.0.0`. A TestPyPI rehearsal may
-    instead use `X.Y.ZrcN` (see "Two rehearsals" below).
-  - On a dispatch on a tag, the dispatched ref is the annotated tag
-    `v<version>`, and the tag object names the run's commit. This is read
-    both from the forge and from git.
-  - On a dispatch on a tag, that commit is on `main` or on `release/v<X.Y>`.
-  - The dispatched ref is a tag or a branch, and nothing else.
-  - The checkout is that commit, and it is clean.
-  - The environments `testpypi` and `pypi` each name a required reviewer, and
-    each has a deployment limit of exactly one rule, the tag pattern `v*`.
-  - Each of the jobs `guard-launch-mode`, `tests`, `tests-no-submodule` and
-    `package` ran in a push or dispatch run of `tests.yml` whose head is that
-    commit. None of those runs is still running it, and the newest to finish
-    succeeded. This is the model's rule, and #852's "its tests.yml runs have
-    all finished, and the newest is green".
-  - The tree digest computed locally equals the digest computed from the
-    forge's tree listing, both by the pinned `repo_shape.py` (see "The digest
-    code is the pinned standard's").
-  - The pinned `repo_shape.py`'s `TREE_DIGEST_DEFINITION` equals
-    `sorted-ls-tree-r-v1`, the definition `--version` labels the digest with
-    and `contracts/openreposhape-pin.yaml` names. openRepoShape's build makes
-    the same assertion (`release.yml:438-440` at v1.1.0). A later pin that
-    changes the definition then refuses the build, and never ships a wrong
-    label.
-
-  A dispatch on a branch is the branch rehearsal (see "Two rehearsals"). The
-  two tag-bound checks above stand down there, because a branch has no tag
-  and no release branch to be on. Every other check still runs. This is
-  openRepoShape's rule (`release.yml:200-249` at v1.1.0).
-- **The build:**
-  - The release tools are installed from `.github/release-build-requirements.txt`,
-    which locks them by hash and installs wheels only. Hatchling is at
-    `pyproject.toml`'s own pin.
-  - `git archive` extracts the commit twice, into two different directories.
-    Both copies are stamped, and each is built with `SOURCE_DATE_EPOCH` set to
-    the commit's time.
-  - The two wheels must be one file (`cmp`).
-  - Every file in the wheel, except the stamp and the metadata, must be the
-    commit's own blob.
-  - The wheel's `.dist-info` must hold exactly `METADATA`, `WHEEL`, `RECORD`,
-    `entry_points.txt` and `licenses/LICENSE`, and that `LICENSE` must be the
-    commit's, as openRepoShape's build checks (`release.yml:649-655` at
-    v1.1.0). This check, and not hatchling, is what makes a missing `LICENSE`
-    fatal. Hatchling 1.27.0 builds its licence list from a `glob` of each
-    `license-files` pattern and raises nothing when a pattern matches no file
-    (`hatchling/metadata/core.py:757-770` in its published wheel), so a tree
-    with no `LICENSE` would otherwise build a wheel without one.
-  - The wheel's sha256 is recorded. It is checked again before and after each
-    upload.
-- **The uploads.** TestPyPI comes first, in the environment `testpypi`. Then
-  the install check runs. Then PyPI, in the environment `pypi`.
-  - Only the two upload jobs are granted `id-token: write`.
-  - Both upload with
-    `pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33`
-    (v1.14.2). This is trusted publishing: there is no token and no stored
-    secret.
-  - Before it uploads, each upload job reads again its environment's rules,
-    this run's approval and the tag. The index must hold no other file of
-    that version.
-  - After it uploads, the index must serve exactly the recorded digest.
-  - **The repository guard,** on the lead's ruling of 2026-10-18, puts Brett
-    Heap's answers 2 and 3 into the workflow's code:
-    - in `opensoft/openRepoTools`, the `testpypi` job takes only a
-      pre-release `X.Y.ZrcN`, and the `pypi` job refuses outright;
-    - in `opensoft/openRepoTools-code`, a pre-release goes to TestPyPI
-      only, and a final `X.Y.Z` goes to TestPyPI and then to PyPI;
-    - in any other repository, both upload jobs refuse.
-
-    The build decides this from the repository and the version, before any
-    approval is asked. Each upload job checks the rule again before it
-    uploads. The absence of a pypi.org publisher for
-    `opensoft/openRepoTools` stays as the second line of defence.
-    openRepoShape's v1.1.0 workflow has no such guard; it is new here.
-- **The install check** runs on `ubuntu-latest` and `macos-latest` with
-  Python 3.x, and on `ubuntu-latest` with Python 3.9. Each leg checks that:
-  - pipx, installed from its own hash lock
-    (`.github/release-pipx-requirements.txt`), installs the wheel, taken by
-    its digest;
-  - pipx placed exactly one command, `openRepoTools`;
-  - `--version` names the source repository, the version, the tag, the commit
-    and the digest;
-  - `openRepoTools --install`, run offline into a temporary home, places every
-    artifact and skips pipx's link, with the skip and count lines above;
-  - on the macOS leg, that `--install` runs again with Apple's `/bin/bash`
-    (3.2) first on `PATH`, and prints its `BASH_VERSION`. No other job runs
-    the payload under bash 3.2;
-  - on the Python 3.9 leg, Python compiles `lanes-index` and
-    `lane-worktrees`.
-
-  There is no Windows leg, because the payload is bash and on Windows it runs
-  under WSL2 (AGENTS.md). The decision of 2026-10-15 took macOS out of the
-  test suite. This macOS leg is a release check that runs only on dispatch,
-  just as openRepoShape's `release.yml` kept its macOS leg after the same
-  decision.
-- **Two rehearsals.**
-  - **The branch rehearsal.** A dispatch on a branch runs every build check,
-    and runs the install check on the build's own wheel. It uploads nothing.
-    This is openRepoShape's rehearsal. It builds with the version of the tag
-    it rehearses, as the model rehearsed v1.1.0 from its branch
-    `l3-rehearsal-v1.1.0`. Because no rehearsal uses `1.1.0` itself, that is
-    the next pre-release, `1.1.0rc1` for the first.
-  - **The TestPyPI rehearsal, which is new.** A pre-release `X.Y.ZrcN`,
-    dispatched on its annotated tag, may reach TestPyPI and the install check.
-    The first is `1.1.0rc1`, on the tag `v1.1.0rc1`. In it, the `pypi` job
-    is skipped, because it never uploads a pre-release. This departs from openRepoShape, which uploads nothing
-    before a final release ("Only final releases are published", #563
-    decision 4). It is on Brett Heap's answer 2 of 21:51:50Z. The `v1.1.0rc1`
-    tag still needs his word, and the `testpypi` deployment his approval.
-
-  A rehearsal never uses `1.1.0` itself. An index never accepts the same file
-  name twice, and v1.1.0 will later be built from a different commit, in
-  `openRepoTools-code`. If a rehearsal uploaded a `1.1.0`, the real release's
-  TestPyPI step would be refused.
-- **The release procedure** (RELEASING) is written in `release.yml`'s header,
-  as openRepoShape's is. It includes the branch rules from #850 (see "Branch
-  and tag policy").
-
-### `tests.yml`
-
-- **The push trigger.** `push` runs on `main` and on `release/v*`. Every commit
-  on a release branch then gets the push run that the build job requires. This
-  is the first work item of opensoft/openRepoShape#850, drafted there as #852.
-- **A new `package` job** runs on `ubuntu-latest` with Python 3.9. It:
-  - builds the wheel twice at the commit's time and compares the two;
-  - checks every packaged payload file against the commit's blob, and its
-    mode against the commit's;
-  - checks the wheel's `.dist-info`, `licenses/LICENSE` included, as the
-    release build does;
-  - installs the wheel with pipx;
-  - runs the unstamped `--version`;
-  - runs an offline `--install` into a temporary home with a pipx link in
-    place;
-  - runs the package's tests, the pipx-skip tests among them, and fails if
-    any of them was skipped rather than run. The pipx-skip tests build fake
-    venv layouts, with no real pipx and no wheel.
-- The three existing jobs are unchanged.
-- **The header comment** that says "`push` (main only)" and that the push and
-  nightly runs run "those same three jobs" (`tests.yml:34-35`) is rewritten
-  for the two branches and the four jobs. #852's concurrency fix does not
-  apply here, because this `tests.yml` has no `concurrency:` block.
-- **AGENTS.md's CI paragraph** (`AGENTS.md:232-239`) says `tests.yml` runs
-  three jobs and pushes only on main. It is rewritten to match. AGENTS.md is
-  314 lines against a cap of 316 (`tests/test_repo_hygiene.py:1748`), so any
-  cap move goes in a dated entry, as that test requires.
-
-### Release notes and README
-
-- **`docs/release-notes/v1.0.0.md`** holds the body of the published v1.0.0
-  Release, byte for byte as `gh release view v1.0.0` returns it.
-- **`docs/release-notes/v1.1.0.md`** is a draft. Each of its placeholders is
-  filled in or cut before the tag.
-- **Each GitHub Release** is created from its file, after PyPI serves the
-  version, so the notes never name a version that PyPI lacks.
-- **README.md's paragraph** that says "There is no version number here" is
-  rewritten. It says that releases are annotated tags, that the version comes
-  only from the tag, and what `--version` prints when stamped and when
-  unstamped.
-- **Three README passages are corrected by feature 006** for a workstation
-  with pipx's link:
-  - the count (README.md:240, "SEVENTEEN"), which becomes sixteen placed and
-    one left to pipx;
-  - the symlink paragraph (README.md:251-262), which says every symlink is
-    refused, and now names pipx's `openRepoTools` as the one link skipped;
-  - the count invariant (README.md:302, "Twenty-nine artifacts always, plus
-    the two hook entries once the path they call answers `guard`" since
-    #237), where such a workstation has twenty-eight placed always, one left
-    to pipx and 28 receipt rows, with the two hook entries on top once that
-    path answers.
-- **The pipx route's text is fixed now:**
-
-  > **The second way, from PyPI:** `pipx install openrepotools`, then
-  > `openRepoTools --install`. pipx owns `~/.local/bin/openRepoTools`. The
-  > install places the other sixteen and says `1 left to pipx`. To update,
-  > run `pipx upgrade openrepotools`, then `--install` again.
-  > `pipx uninstall openrepotools` removes only that command.
-
-  Beside it, README gives the move from the one-line install,
-  `pipx install --force openrepotools` (see "Coexistence with the other
-  installers").
-- **README gains that text only** once PyPI serves v1.1.0 and the workBenches
-  condition holds. After the cutover README sits at the assembly root, so the
-  text goes there by PR. Lane openRepoTools-3 opens that PR, on Brett Heap's
-  word (sequencing step 6). The README never offers a package that is not
-  published.
-- **The README's cap** in `tests/test_repo_hygiene.py` moves only by a dated
-  entry, as that test requires.
-
-## Branch and tag policy
-
-This mirrors opensoft/openRepoShape#850 (Brett Heap's ruling of
-2026-10-17T19:52:26Z).
-
-- **The trunk.** `main` is the trunk, and every PR lands on main.
-- **A release is an annotated tag `vX.Y.Z`.** It is never a branch, and never
-  a committed version number. The tag message has the form `v1.0.0` already
-  uses:
-  - `openRepoTools vX.Y.Z`;
-  - a paragraph;
-  - `Tagged on Brett Heap's word (<time>, "<words>")`, where `<time>` is the
-    exact UTC second. v1.0.0's message says `2026-10-17T20:5xZ`, and it stays,
-    because a tag is never moved;
-  - `Lane: <lane>`.
-- **Release branches.** `release/vX.Y` is cut at the `vX.Y.0` tag, right after
-  the tag. Each `vX.Y.Z` patch is tagged on that branch.
-- **Back-ports.** A fix lands on main first, through its own review and CI.
-  Then it is back-ported:
-  - by fast-forwarding `release/vX.Y` (or a merge of main), while main holds
-    only that patch line's work;
-  - otherwise, by a PR to `release/vX.Y` of
-    `git cherry-pick -x <squash commit>`.
-- **Patch tags.** A patch is tagged on `release/vX.Y` only once that commit's
-  `tests.yml` runs have all finished, and the newest is green. This is
-  opensoft/openRepoShape#852's wording. A commit that reaches the branch by
-  fast-forward has main's push run and then the branch's own, and the newer
-  one decides.
-- **The lanes' side,** as #850 states it:
-  - one HOLD at a time on `release/vX.Y`;
-  - the lane that landed a PR back-ports it, unless the release owner (see
-    "Release owner") fast-forwards;
-  - a LANDED line names both commits.
-- **One upload per version.** A version is uploaded once. A bad upload is
-  fixed by the next patch, never by moving a tag or reusing one.
-- **Tags in the triad.** Release tags are made in `openRepoTools-code`, where
-  the release is built. `v1.0.0`, and any `rc` rehearsal tag, stay in
-  `opensoft/openRepoTools`, which becomes the assembly. Tags are not carried
-  to the legs.
-
-## Release owner
-
-- **Brett Heap decides** every tag, every release-branch cut and every
-  upload, and he approves each deployment to the `testpypi` and `pypi`
-  environments.
-- **Lane openRepoTools-3 carries them out on his word:** the tags, the
-  dispatches, the GitHub Releases, the cut of `release/v1.1` and step 6 of the
-  sequencing below. It is the release owner that #850's lanes' side names.
-- **The code leg's `LICENSE`.** T006's patch `code-0001` is the code leg's
-  first commit, right after `execute` and before any CI, package or release
-  run there, because the wheel must carry `LICENSE` and the `package` job and
-  the release build refuse one that does not (see "The build"). Lane
-  openRepoTools-3 checks that `LICENSE` on `openRepoTools-code` is blob
-  `261eeb9` before the first `package` run. The package never tolerates a
-  missing `LICENSE`.
-
-## Brett Heap's acts outside the repository
-
-None of these acts is a lane's to perform. `release.yml` refuses every
-dispatch until the two environments exist with their rules.
-
-- **Now, in `opensoft/openRepoTools`.** Create the environments `testpypi` and
-  `pypi`. Each names brettheap as a required reviewer and has a deployment
-  limit of exactly the tag pattern `v*`. (Today the repository has only the
-  environment `copilot`.) Recommended: a ruleset on the tags `v*` that lets
-  only him create, move or delete one.
-- **Now, on test.pypi.org.** Create a pending trusted publisher with:
-  - project `openrepotools`;
-  - owner `opensoft`;
-  - repository `openRepoTools`;
-  - workflow `release.yml`;
-  - environment `testpypi`. The environment is required here, though the form
-    calls it optional.
-- **For the TestPyPI rehearsal.** His word for the `v1.1.0rc1` tag, and his
-  approval of the `testpypi` deployment (answer 2).
-- **In the cutover sequence, after `execute`:**
-  - in `opensoft/openRepoTools-code`, the environments `testpypi` and `pypi`,
-    each naming brettheap as a required reviewer with a deployment limit of
-    exactly the tag pattern `v*`, and the `v*` tag ruleset;
-  - on test.pypi.org, the trusted publisher pointed at `openRepoTools-code`.
-    The project exists by then, from the rc rehearsal;
-  - on pypi.org, a pending publisher for `openrepotools`, naming
-    `openRepoTools-code`, `release.yml` and the environment `pypi`. It is the
-    only pypi.org publisher.
-
-  v1.1.0 is published only after both publishers and both environments
-  exist. There is no pypi.org publisher for `opensoft/openRepoTools` at all, on
-  Brett Heap's answer 3 of 21:51:50Z. Nothing will ever upload to PyPI from
-  that repository, and a pending publisher does not reserve the name. Until
-  v1.1.0 is uploaded, nothing reserves `openrepotools` on pypi.org: PyPI's
-  documentation says a pending publisher "does not create a project or
-  reserve a project's name until it is actually used to publish". The rc
-  rehearsal makes the project on TestPyPI only.
-- **For v1.1.0:**
-  - his word for the tag;
-  - his approvals of both deployments;
-  - his word for `release/v1.1`;
-  - the `release/*` ruleset choice that #850 leaves to him. One option is no
-    force-push and no deletion, which keeps fast-forward back-ports. The other
-    is a rule that requires a PR, which makes every back-port a cherry-pick.
-
-## Sequencing with the triad cutover (#186)
-
-1. **Feature 006 lands** in `opensoft/openRepoTools` by squash merge
-   (decision 4).
-2. **The rehearsals.** Brett creates the environments and the TestPyPI
-   publisher. Then a branch rehearsal runs. Then, on his word, the `v1.1.0rc1`
-   TestPyPI rehearsal runs.
-3. **The openRepoShape pin bump, before the plan.** On Brett Heap's answer 4, lane
-   openRepoTools-1 moves the pin straight to openRepoShape v1.1.0
-   (`190133d`), skipping v1.0.0, in its own PR (#186 comment 6241785035).
-   The pinned `repo_shape.py` is then v1.1.0's, which digests by the same
-   `sorted-ls-tree-r-v1`.
-4. **One fresh migration rehearsal, and the regenerated adoption plan at that
-   pin.** It belongs to lane openRepoTools-1, and it depends on step 1:
-   #228's PRs land before lane 1's rehearsal and adoption plan, so the plan
-   is generated on the tree that will be cut over (#186 comment 6242560541,
-   D1, on Brett Heap's decision 1). A plan generated before them would be
-   refused as `plan-uncovered` once they are in the baseline. The plan
-   carries the new paths:
-   - `pyproject.toml` and `src/` are new top-level paths, assigned to `code`.
-   - `release.yml` and the two hash locks fall under the existing `.github/`
-     entry, which goes to code (`adoption-plan.yaml:87-88`; under
-     `consensus` at openRepoShape v1.1.0, as that comment reads it).
-     `docs/release-notes/` falls under the `docs/` entry, which goes to spec
-     (`adoption-plan.yaml:183-184`).
-   - **The code leg's `LICENSE` comes from T006's patch `code-0001`.** The
-     plan assigns `LICENSE` to the root (`adoption-plan.yaml:129-130`), and
-     `code-0001` gives the code leg a byte-identical copy, blob `261eeb9`
-     (`specs/004-migrate-to-triad/root-guidance-2026-10-08.md:160`). The code
-     leg does not exist until `execute`, so `code-0001` cannot land before
-     the cutover. It is the code leg's first commit, right after `execute`
-     and before any CI, package or release run there (see "Release owner").
-   - **The cutover invariants,** which this change depends on and the plan
-     carries:
-     - the release gate's required jobs, `guard-launch-mode`, `tests`,
-       `tests-no-submodule` and `package`, keep those ids in the code leg's
-       `tests.yml`. Today they are job ids with no `name:` (`tests.yml:50`,
-       `:70`, `:124`), and the plan's follow-ups change the code leg's CI
-       (`adoption-plan.yaml:414`);
-     - no release step reads across legs: everything `release.yml` reads is
-       in the code leg;
-     - `pyproject.toml` declares no `readme`, because README.md goes to the
-       root (`adoption-plan.yaml:137-138`). A test asserts this.
-
-   Lane 1 edits that plan. This change asks for these entries, and does not
-   edit `openspec/changes/migrate-to-triad/`.
-5. **The cutover** (#186), through `execute`. `code-0001` is the code leg's
-   first commit, right after it.
-6. **After `execute`, in the cutover sequence.** Brett Heap decides each act,
-   and lane openRepoTools-3 carries out each one on his word (see "Release
-   owner"):
-   - lane 3 checks that the code leg's `LICENSE` is blob `261eeb9` before
-     the first `package` run;
-   - Brett makes his code-side acts (see "Brett Heap's acts outside the
-     repository"): the two environments and the `v*` tag ruleset in
-     `openRepoTools-code`, the test.pypi.org publisher pointed at it, and the
-     pypi.org pending publisher for it. Nothing below runs until both
-     publishers and both environments exist;
-   - v1.1.0 is tagged on `openRepoTools-code`'s `main` once that commit's
-     `tests.yml` runs have all finished, and the newest is green;
-   - the release is dispatched, and Brett approves both deployments;
-   - the GitHub Release is created from `docs/release-notes/v1.1.0.md`;
-   - `release/v1.1` is cut at `v1.1.0`;
-   - lane 3 opens the assembly's README PR with the pipx route's text, once
-     PyPI serves v1.1.0 and the workBenches condition holds.
-
-If the cutover slips, only step 6 waits for it. Nothing is published to PyPI
-in the meantime.
-
-## Non-goals
-
-- **No PyPI upload before the cutover,** and none ever from
-  `opensoft/openRepoTools`. From there, TestPyPI takes pre-releases only.
-- **No new runtime dependency.** The wheel's `dependencies` is empty. The
-  entry module uses only the standard library, and the new test in
-  `tests/test_repo_hygiene.py` holds it to that. The payload's own
-  requirements do not change: bash, git, python3 for two commands, and `gh`
-  or `curl` where they already fetch.
-- **No change to the one-line install.** `curl … | bash -s -- --install` and
-  its default `$OPENREPOTOOLS_REF=main` stay as they are. So does `wip init`'s
-  fetch of the nine openRepoShape template files at the pin.
-- **`--version` names the command's release, not the placed files'.** After
-  `pipx upgrade`, the 16 placed files stay the earlier release's until
-  `--install` runs again (see "The upgrade order"). Checking the placed
-  files against the receipt is left to a later release.
-- **No sdist, no native Windows command, and no second console script.**
-- **No edit** to `upstream/openRepoShape`, to its pin, or to the triad
-  change's files. The pin moves to v1.1.0 in lane openRepoTools-1's own PR.
-
-## Open questions for review
-
-The TestPyPI rehearsal and the pypi.org publisher were open here. Brett
-Heap's answers 2 and 3 of 21:51:50Z settle them (see the addendum).
-
-- **Where the release notes live.** `docs/release-notes/` can stay with
-  `docs/` in the spec leg. This is recommended: it needs no exception in the
-  plan, and nothing reads the notes at run time. Or it can move to code,
-  beside the workflow that makes the release. The council left the choice to
-  the design, under the cutover invariant that no release step reads across
-  legs. Lane openRepoTools-1's reading of the plan at openRepoShape v1.1.0
-  already puts `docs/release-notes/` in spec (#186 comment 6242560541).
-
-## Capabilities
-
-### New Capabilities
-
-- `release-tags-and-branches`:
-  - annotated `vX.Y.Z` tags and `release/vX.Y` branches;
-  - back-ports and patch tags;
-  - the push trigger on release branches;
-  - release notes and GitHub Releases.
-- `pypi-package`:
-  - the `openrepotools` wheel and its offline payload;
-  - the stamp and `--version`;
-  - the pipx skip in `--install`;
-  - coexistence with the one-line install, pip and workBenches;
-  - the `package` CI job;
-  - the release workflow: its gates, its reproducible build, its TestPyPI and
-    PyPI uploads, and its install check.
-
-### Modified Capabilities
-
-None. `openspec list --specs` reports no canonical capability on main. The
-triad change's `repository-triad-migration` capability is still in flight, so
-this change depends on it (see the sequencing section) rather than modifying
-it.
-
-## Impact
-
-- **New files:** `pyproject.toml`, `src/openrepotools/`,
-  `.github/workflows/release.yml`, `.github/release-build-requirements.txt`,
-  `.github/release-pipx-requirements.txt` and `docs/release-notes/`.
-- **Changed files:**
-  - `openRepoTools`: how `--install` handles links and pip's console
-    script, its count line and its `PATH` report, and `--version` when run
-    from a package;
-  - `.github/workflows/tests.yml`: the trigger, the `package` job, and the
-    header comment that says "`push` (main only)" (`tests.yml:34-35`);
-  - `AGENTS.md`: the CI paragraph (`AGENTS.md:232-239`). AGENTS.md is 314
-    lines against a cap of 316, so any cap move goes in a dated entry;
-  - `README.md`;
-  - `tests/test_openrepotools_command.py`, and `tests/test_repo_hygiene.py`
-    with its new standard-library test;
-  - new tests for the package, the stamp, the pipx skip and the release
-    workflow.
-- **Governed files:** `.github/workflows/` and every file that records a pin
-  or a digest are governed in every repository (the protocol's "Governed
-  invariants"). That includes the hash locks and the action pins.
-- **Outside the repository:**
-  - GitHub environments and rulesets, in two repositories;
-  - trusted publishers on test.pypi.org and pypi.org;
-  - the openRepoShape pin bump to v1.1.0, and the triad's regenerated
-    adoption plan at that pin (#186), with the cutover invariants;
-  - opensoft/workBenches, as the workBenches condition states.
-- **Unchanged:** the behaviour of the sixteen commands and `repos.tsv`, except
-  `--install`'s handling of pipx's link and pip's console script, its count
-  line and `PATH` report, and the package's `--version`; the receipt format;
-  `wip init`'s template fetch, and every lane tool.
diff --git a/openspec/changes/release-tags-pypi/specs/pypi-package/spec.md b/openspec/changes/release-tags-pypi/specs/pypi-package/spec.md
deleted file mode 100644
index cb880bc6..00000000
--- a/openspec/changes/release-tags-pypi/specs/pypi-package/spec.md
+++ /dev/null
@@ -1,483 +0,0 @@
-# Spec Delta
-
-## Purpose
-
-Publishes openRepoTools as the `openrepotools` wheel. The wheel carries the
-whole tool payload, so `pipx install` followed by `openRepoTools --install`
-works offline, names its release in `--version`, and coexists with every
-other way the command is installed.
-
-## ADDED Requirements
-
-### Requirement: Package metadata
-
-The package SHALL be named `openrepotools`, and SHALL require Python 3.9 or
-later. It SHALL declare no dependencies, exactly one console script,
-`openRepoTools`, and the licence `Apache-2.0` with the file `LICENSE`. It
-SHALL declare no `readme`. Its version SHALL be read only from the package's
-stamp. The wheel's `.dist-info` SHALL hold exactly `METADATA`, `WHEEL`,
-`RECORD`, `entry_points.txt` and `licenses/LICENSE`, and that `LICENSE`
-SHALL be the commit's. The `package` job and the release build SHALL refuse
-any other wheel. The package SHALL NOT be made to tolerate a missing
-`LICENSE`.
-
-#### Scenario: The metadata is held by a test
-
-- **WHEN** the suite reads `pyproject.toml`
-- **THEN** `dependencies` is empty, the scripts table has the one entry
-  `openRepoTools`, and there is no `readme` key
-
-#### Scenario: A code leg without LICENSE
-
-- **WHEN** a wheel is built from a tree that has no `LICENSE`
-- **THEN** the `package` job and the release build refuse it, and nothing is
-  uploaded
-
-### Requirement: The entry point runs the payload's bash unchanged
-
-The console script SHALL replace its own process with the first `bash` on
-`PATH`, running the packaged `openRepoTools` with the person's arguments
-unchanged. Signals, the exit status, and the payload's own clean-up on exit
-SHALL pass through as if the person had run the payload with bash directly.
-With no `bash` on `PATH`, it SHALL refuse with a message naming `bash`, and
-SHALL run nothing. The package's Python modules SHALL import only the
-standard library.
-
-#### Scenario: The exit status passes through
-
-- **WHEN** `openRepoTools` is run from the package with arguments that the
-  payload refuses
-- **THEN** it exits with the payload's own status, and prints the payload's
-  own message
-
-#### Scenario: An interrupted install
-
-- **WHEN** a package-mode `--install` is interrupted by a signal while it is
-  placing a file
-- **THEN** no temporary placement file is left beside the target, as for a
-  checkout's `--install`
-
-#### Scenario: No bash
-
-- **WHEN** the console script runs with no `bash` on `PATH`
-- **THEN** it refuses, naming `bash`, and nothing else runs
-
-#### Scenario: A third-party import
-
-- **WHEN** a module of the package imports anything outside the standard
-  library
-- **THEN** a hygiene test fails
-
-### Requirement: The wheel carries the whole payload byte for byte
-
-The wheel SHALL include, at `openrepotools/payload/<path>`, every file that
-the installer's payload list names: the seventeen installables (sixteen
-commands and `repos.tsv`), the three skills, the three command files, and
-`contracts/openreposhape-pin.yaml`. Each SHALL be byte-identical to the
-commit's blob. Its mode in the wheel SHALL match the commit's mode, `100755`
-or `100644`.
-
-#### Scenario: A file added to the payload but not to the wheel
-
-- **WHEN** a file is added to the installer's payload list and not to the
-  wheel's contents
-- **THEN** a test fails, naming that file
-
-#### Scenario: A packaged file differs from its blob
-
-- **WHEN** any packaged payload file differs from the commit's blob, in bytes
-  or in mode
-- **THEN** the `package` job and the release build both fail
-
-### Requirement: An install from the package needs no network
-
-After `pipx install` of the wheel, `openRepoTools --install` SHALL place
-every artifact and write every receipt row from the payload inside the
-package, with every network path refused. These SHALL be the same as an
-install from beside a full checkout, except for pipx's link. `wip init` run
-from the package SHALL read the release's own openRepoShape pin.
-
-#### Scenario: Offline install
-
-- **WHEN** `--install` runs from the package with a sentinel
-  `$OPENREPOTOOLS_REPO`, no `gh`, and a `curl` that fails
-- **THEN** it succeeds, and places the same artifacts and receipt rows as a
-  checkout's install, apart from pipx's link
-
-### Requirement: The stamp is all or nothing
-
-The committed stamp SHALL be unstamped: `VERSION` `0.0.0`, and `TAG`,
-`COMMIT`, `DIGEST` and `REPOSITORY` empty. Only the release build SHALL
-write a stamp. It writes the version taken from the tag, the tag, the tag's
-40-hex commit, that commit's `sorted-ls-tree-r-v1` tree digest, and the
-release run's source repository. With `TAG`, `COMMIT` and `DIGEST` all
-empty, the package SHALL be read as unstamped, and its `VERSION` is `0.0.0`.
-Otherwise every field SHALL be set, `VERSION` SHALL NOT be `0.0.0`, `COMMIT`
-SHALL be 40 hex digits and `DIGEST` 64. Any other stamp SHALL be refused as a
-broken build, and never read as the part it holds. The command SHALL read
-the stamp only from the package's own stamp file, and SHALL trust no
-environment variable for it. No other file SHALL carry a version number.
-
-#### Scenario: A partial stamp
-
-- **WHEN** a package's stamp has a commit but no digest
-- **THEN** `--version` refuses, calling the build broken, and prints no
-  version
-
-#### Scenario: A variable in the environment
-
-- **WHEN** a checkout's or the one-line install's `openRepoTools --version`
-  runs with any `OPENREPOTOOLS_PACKAGE_*` variable set
-- **THEN** it prints exactly what it prints without it,
-  `openRepoTools (<repo> @ <ref>)`
-
-### Requirement: `--version` names the release
-
-A stamped package's `--version` SHALL print exactly five lines:
-
-```text
-openRepoTools <version> (<repository> @ <commit>)
-  version   <version>
-  tag       <tag>
-  commit    <commit>
-  digest    <digest> (sorted-ls-tree-r-v1)
-```
-
-An unstamped package's `--version` SHALL print exactly:
-
-```text
-openRepoTools 0.0.0 (an unstamped package)
-  version   0.0.0, unstamped: a package built from a checkout, not a release
-  tag       none
-  commit    none
-  digest    none
-```
-
-A checkout's and the one-line install's `--version` SHALL print what they
-print today, `openRepoTools (<repo> @ <ref>)`. `--help`,
-`--install --version` and the parser's refusals SHALL behave in the package
-as they do in a checkout. `--version` names the command's release, not the
-release of the files `--install` placed.
-
-#### Scenario: v1.1.0
-
-- **WHEN** the v1.1.0 package from `openRepoTools-code` runs `--version`
-- **THEN** its first line is
-  `openRepoTools 1.1.0 (opensoft/openRepoTools-code @ <commit>)`, followed by
-  the version, the tag `v1.1.0`, the commit and the digest
-
-#### Scenario: The package job's build
-
-- **WHEN** the `package` job's unstamped wheel runs `--version`
-- **THEN** it prints the five unstamped lines exactly
-
-### Requirement: `--install` skips pipx's link and refuses every other link
-
-`<dir>` is `$OPENREPOTOOLS_BIN_DIR`, by default `~/.local/bin`.
-`<dir>/openRepoTools` SHALL be treated as pipx's link only when all of
-these hold: it is a symbolic link; it resolves to a regular file
-`<venv>/bin/openRepoTools`; and that `<venv>` holds a `pipx_metadata.json`
-and an `openrepotools/payload/` tree in its `lib/python*/site-packages/`.
-The check SHALL use only paths and the existence of files, SHALL need no
-`jq`, and SHALL hold under bash 3.2. It SHALL hold in every mode: the
-package's own `--install`, a checkout's and the one-line install's. It SHALL
-NOT depend on `PIPX_HOME`. It SHALL be decided before any link refusal, and
-no refusal SHALL advise removing pipx's link.
-
-On pipx's link, `--install` SHALL skip that one target and print exactly
-``openRepoTools: left to pipx at <dir>/openRepoTools (a link into pipx's openrepotools environment); update it with `pipx upgrade openrepotools`, then run `openRepoTools --install` again``.
-It SHALL place every other artifact, and SHALL write no receipt row for the
-link: 28 rows, against a full install's 29. Run from pipx's own environment,
-its count line SHALL be exactly
-`openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx`. No install,
-and no retirement, SHALL ever remove, replace or write through pipx's link.
-Every other link at a target SHALL still refuse the whole install before
-anything is placed.
-
-#### Scenario: A package-mode install with pipx's link
-
-- **WHEN** `--install` runs from the package and `<dir>/openRepoTools` is
-  pipx's link
-- **THEN** it prints the skip line and the count line exactly, places the
-  other sixteen files, and leaves the link as it was
-
-#### Scenario: Any pipx home
-
-- **WHEN** pipx's venv lives under `$PIPX_HOME`, under `~/.local/pipx`, or
-  under `~/.local/share/pipx`, with the layout of pipx 1.11.1, 1.17.8 or
-  1.18.3
-- **THEN** the link is recognised the same way in each case
-
-#### Scenario: A link into a venv without the payload
-
-- **WHEN** `<dir>/openRepoTools` links to `<venv>/bin/openRepoTools`, but
-  that venv has no `openrepotools/payload/` tree
-- **THEN** it is an ordinary link, and the install refuses before placing
-  anything
-
-#### Scenario: No jq on a machine with pipx's link
-
-- **WHEN** `--install` runs with no `jq` on `PATH`, and `<dir>/openRepoTools`
-  is pipx's link
-- **THEN** it refuses for want of `jq`, and its output advises no `rm` of
-  pipx's link
-
-#### Scenario: Another link
-
-- **WHEN** any target other than pipx's `openRepoTools` is a symbolic link
-- **THEN** `--install` refuses, names it, and places nothing
-
-### Requirement: Upgrade and uninstall
-
-After `pipx upgrade openrepotools`, the placed files, skills, command files
-and any merged hook entries SHALL stay the earlier release's until
-`--install` runs again. That `--install` SHALL replace them and still skip
-the link. `pipx uninstall openrepotools` removes only the link and its
-environment. The placed files, the skills, the command files, any merged
-hook entries and the receipt SHALL stay, and a later checkout's `--install`
-SHALL place a regular `openRepoTools` at the freed path.
-
-#### Scenario: Upgrade
-
-- **WHEN** one wheel is installed with `--install`, then upgraded to a
-  second, then `--install` runs again
-- **THEN** the second `--install` replaces the sixteen files with the second
-  wheel's and still skips the link
-
-#### Scenario: Uninstall
-
-- **WHEN** pipx's link and its environment are removed
-- **THEN** the sixteen files are still there, and a checkout's `--install`
-  places a regular file at `<dir>/openRepoTools`
-
-### Requirement: Coexistence with the other installers
-
-The documented move from the one-line install to pipx SHALL be
-`pipx install --force openrepotools`, then `openRepoTools --install`. A
-checkout's or the one-line install's `--install` that meets pipx's link
-SHALL skip it, and its count line SHALL be exactly
-`openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx; the other 16 now come from <repo> @ <ref>, not from openrepotools <version>`,
-where `<version>` is the stamp beside the link's payload. A package-mode run
-from outside pipx's environment SHALL name `openrepotools <its version>`,
-from its own stamp, in place of `<repo> @ <ref>`. In every mode,
-`--install` SHALL refuse to replace a regular file at `<dir>/openRepoTools`
-that is pip's console script for openrepotools, before anything is placed.
-Once a package-mode `--install` has placed its files, it SHALL report when
-the first `openRepoTools` on `PATH`, with its links resolved, is not that
-package's console script.
-
-#### Scenario: From the one-line install
-
-- **WHEN** a one-line install is followed by pipx's link in its place, as
-  `pipx install --force` leaves it, and then by `--install` from the venv's
-  payload
-- **THEN** the link is skipped and the other sixteen are replaced with the
-  package's
-
-#### Scenario: A checkout's install beside pipx
-
-- **WHEN** a checkout's `--install` meets pipx's link
-- **THEN** it skips the link, places the sixteen from the checkout, and its
-  count line names the checkout's repository and ref and pipx's version
-
-#### Scenario: pip's console script
-
-- **WHEN** `<dir>/openRepoTools` is the regular file `pip install --user`
-  writes for openrepotools
-- **THEN** `--install` refuses, names that file as pip's, and places nothing
-
-#### Scenario: A shadowed command
-
-- **WHEN** a package-mode `--install` finishes, and the first
-  `openRepoTools` on `PATH` is an older bash file in another directory, or
-  pipx's bin directory differs from `$OPENREPOTOOLS_BIN_DIR`
-- **THEN** it reports which `openRepoTools` the shell will run, and which it
-  expected
-
-### Requirement: The README offers only a published package
-
-README SHALL NOT offer the pipx route until PyPI serves the version it
-installs, and the workBenches condition stated in this change's proposal
-holds. Feature 006 SHALL correct the README's file count, its symlink
-paragraph and its artifact-count invariant for a workstation with pipx's
-link.
-
-#### Scenario: Before v1.1.0 is on PyPI
-
-- **WHEN** PyPI does not serve `openrepotools` 1.1.0
-- **THEN** README has no `pipx install openrepotools` line
-
-### Requirement: The package job
-
-`tests.yml` SHALL have a `package` job on ubuntu with Python 3.9. It SHALL
-build the wheel twice at the commit's time and require the two to be one
-file. It SHALL check every packaged payload file against the commit's blob
-and mode, install the wheel with pipx, and run the unstamped `--version`.
-It SHALL run an offline `--install` into a temporary home with a pipx link
-in place. It SHALL run the package's tests, the pipx-skip tests among them,
-and SHALL fail if any of them was skipped rather than run. The pipx-skip
-tests SHALL use fake venv layouts, with no real pipx and no wheel.
-
-#### Scenario: A package test skips
-
-- **WHEN** a package test reports skipped in the `package` job
-- **THEN** the job fails
-
-### Requirement: The release build's gates
-
-The release workflow SHALL run only on `workflow_dispatch`, with a
-`version` input. It SHALL grant no permission at the workflow level, and
-SHALL run one release at a time, never cancelling one in progress. Its build
-SHALL refuse unless all of these hold:
-- the version is a final `X.Y.Z` other than `0.0.0`, or a pre-release
-  `X.Y.ZrcN` bound for TestPyPI;
-- on a dispatch on a tag, the dispatched ref is the annotated tag
-  `v<version>`, and the tag object names the run's commit, read both from
-  the forge and from git;
-- on a dispatch on a tag, that commit is on `main` or on `release/v<X.Y>`;
-- the dispatched ref is a tag or a branch, and nothing else;
-- the checkout is that commit, and it is clean;
-- the environments `testpypi` and `pypi` each name a required reviewer, and
-  each has a deployment limit of exactly one rule, the tag pattern `v*`;
-- each of `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`
-  ran in a push or dispatch run of `tests.yml` on that commit, none of those
-  runs is still in progress, and the newest to finish succeeded;
-- the tree digest computed locally equals the one computed from the forge's
-  tree listing, both by the pinned openRepoShape's own digest code;
-- the pinned standard's digest definition is `sorted-ls-tree-r-v1`.
-
-A dispatch on a branch is the rehearsal. The two tag-bound checks above
-SHALL stand down there, as in openRepoShape's `release.yml:200-249` at
-v1.1.0, and every other check SHALL still run.
-
-#### Scenario: A branch dispatch is a rehearsal, not a refusal
-
-- **WHEN** the release workflow is dispatched on a branch
-- **THEN** the tag check and the release-branch check pass it as a
-  rehearsal, and every other check runs
-
-#### Scenario: A changed digest definition
-
-- **WHEN** the pinned openRepoShape digests by a definition other than
-  `sorted-ls-tree-r-v1`
-- **THEN** the build refuses, and no wheel is uploaded with a wrong label
-
-#### Scenario: A red or running CI
-
-- **WHEN** the newest finished `tests.yml` run on the commit failed, or one
-  is still running
-- **THEN** the build refuses
-
-### Requirement: The release build is reproducible
-
-The build SHALL install its tools from a hash lock, wheels only. It SHALL
-extract the commit twice with `git archive`, into two different
-directories, and stamp and build each with `SOURCE_DATE_EPOCH` at the
-commit's time. The two wheels SHALL be one file. Every file in the wheel,
-apart from the stamp and the metadata, SHALL be the commit's own blob. The
-wheel's sha256 SHALL be recorded, and checked again before and after each
-upload.
-
-#### Scenario: Two builds differ
-
-- **WHEN** the two wheels are not byte-identical
-- **THEN** nothing is uploaded
-
-### Requirement: Uploads by trusted publishing only
-
-TestPyPI SHALL come first, in the environment `testpypi`, then the install
-check, then PyPI, in the environment `pypi`. Only the two upload jobs SHALL
-be granted `id-token: write`. There SHALL be no token and no stored secret.
-Before it uploads, each upload job SHALL read again its environment's rules,
-this run's approval and the tag. The index SHALL hold no other file of that
-version, and after the upload it SHALL serve exactly the recorded digest.
-The `pypi` job SHALL never upload a pre-release. Nothing SHALL be uploaded
-to PyPI from `opensoft/openRepoTools`. v1.1.0 SHALL be published from
-`openRepoTools-code`, only once both of its environments and both trusted
-publishers exist.
-
-The uploads SHALL be guarded by repository, in the workflow's code:
-- in `opensoft/openRepoTools`, the `testpypi` job SHALL take only a
-  pre-release `X.Y.ZrcN`, and the `pypi` job SHALL refuse outright;
-- in `opensoft/openRepoTools-code`, a pre-release SHALL go to TestPyPI only,
-  and a final `X.Y.Z` to TestPyPI and then to PyPI;
-- in any other repository, both upload jobs SHALL refuse.
-
-The build SHALL decide this before any approval is asked, and each upload
-job SHALL check it again before it uploads. The absence of a pypi.org
-publisher for `opensoft/openRepoTools` stays as a second line of defence.
-
-#### Scenario: The rc rehearsal
-
-- **WHEN** `1.1.0rc1` is dispatched on its annotated tag in
-  `opensoft/openRepoTools`, and the `testpypi` deployment is approved
-- **THEN** it reaches TestPyPI and the install check, and the `pypi` job
-  is skipped
-
-#### Scenario: A final version in the wrong repository
-
-- **WHEN** a final `X.Y.Z` is dispatched on its tag in
-  `opensoft/openRepoTools`, or any version on a tag in a repository other
-  than the two
-- **THEN** the build refuses before any approval is asked, and both upload
-  jobs refuse if they are ever reached
-
-#### Scenario: The index already holds a file of the version other than the verified wheel
-
-- **WHEN** the index already holds a file of the version being uploaded
-  other than the verified wheel at its recorded digest, or holds that wheel
-  yanked
-- **THEN** the upload job refuses before uploading
-
-#### Scenario: The index already holds the verified wheel
-
-- **WHEN** the index holds only the verified wheel at its recorded digest,
-  not yanked, as after an upload that went through
-- **THEN** the upload job does not refuse, and its upload adds nothing new
-
-### Requirement: The install check
-
-The install check SHALL run on ubuntu and macOS with a current Python 3, and
-on ubuntu with Python 3.9. Each leg SHALL install pipx from its own hash lock
-and install the wheel by its digest. Each SHALL check that pipx placed
-exactly one command, `openRepoTools`, and that `--version` names the source
-repository, the version, the tag, the commit and the digest. Each SHALL
-check that an offline `--install` into a temporary home places every artifact
-and skips pipx's link with the exact skip and count lines. The macOS leg
-SHALL run that `--install` again with Apple's `/bin/bash` 3.2 first on
-`PATH`, and print its `BASH_VERSION`. The Python 3.9 leg SHALL compile
-`lanes-index` and `lane-worktrees`.
-
-#### Scenario: bash 3.2
-
-- **WHEN** the macOS leg reruns `--install` under `/bin/bash`
-- **THEN** it prints a `BASH_VERSION` of 3.2, and the install succeeds with
-  the same skip and count lines
-
-### Requirement: Rehearsals never spend the real version
-
-A dispatch on a branch SHALL run every build check and the install check on
-its own wheel, and SHALL upload nothing. It builds with the version of the
-tag it rehearses; before v1.1.0 that is the next pre-release, `1.1.0rc1` for
-the first. A TestPyPI rehearsal SHALL use a pre-release `X.Y.ZrcN` on its
-annotated tag. No rehearsal SHALL use the version `1.1.0` itself.
-
-#### Scenario: The branch rehearsal
-
-- **WHEN** the release workflow is dispatched on a branch
-- **THEN** every build check and the install check run, and no upload job
-  runs
-
-### Requirement: The cutover invariants
-
-In `openRepoTools-code`, `tests.yml` SHALL keep the job ids
-`guard-launch-mode`, `tests`, `tests-no-submodule` and `package` that the
-release gate requires. No release step SHALL read a file outside the code
-leg. The code leg's `LICENSE` SHALL be blob `261eeb9`, from its first commit
-after `execute` on, before any CI, package or release run there.
-
-#### Scenario: A missing job
-
-- **WHEN** the code leg's `tests.yml` no longer has one of the four job ids
-- **THEN** the release build refuses, because no run of that job on the
-  commit succeeded
diff --git a/openspec/changes/release-tags-pypi/specs/release-tags-and-branches/spec.md b/openspec/changes/release-tags-pypi/specs/release-tags-and-branches/spec.md
deleted file mode 100644
index e018156f..00000000
--- a/openspec/changes/release-tags-pypi/specs/release-tags-and-branches/spec.md
+++ /dev/null
@@ -1,151 +0,0 @@
-# Spec Delta
-
-## Purpose
-
-Gives openRepoTools a release identity: annotated version tags, release
-branches that carry patch lines, the CI runs a tag waits for, and release
-notes that never name a version the index lacks.
-
-## ADDED Requirements
-
-### Requirement: A release is an annotated version tag
-
-A release SHALL be an annotated tag `vX.Y.Z` on a commit that is on `main`
-or on `release/vX.Y`. A release SHALL NOT be a branch, and SHALL NOT be a
-version number committed to any file. The tag message SHALL have the form
-`v1.0.0` already uses: the line `openRepoTools vX.Y.Z`, a paragraph, the
-line `Tagged on Brett Heap's word (<time>, "<words>")` with `<time>` the
-exact UTC second, and the line `Lane: <lane>`. A tag SHALL NOT be moved,
-deleted or reused once pushed. A version that was uploaded badly SHALL be
-fixed by the next patch version.
-
-#### Scenario: The baseline tag stays as it is
-
-- **WHEN** a later release is tagged
-- **THEN** `v1.0.0` still names tag object `6a826f8` on commit `aaa7bc8`, and
-  its message still says `2026-10-17T20:5xZ`
-
-#### Scenario: A bad upload is fixed forward
-
-- **WHEN** a published version is found to be broken
-- **THEN** the fix is released as the next patch version, and the broken
-  version's tag and upload are left in place
-
-#### Scenario: A lightweight tag is not a release
-
-- **WHEN** the release workflow is dispatched on a lightweight tag, or on an
-  annotated tag whose object names a different commit
-- **THEN** the build refuses, and nothing is built or uploaded
-
-### Requirement: Release branches carry patch lines
-
-`release/vX.Y` SHALL be cut at the `vX.Y.0` tag, right after that tag is
-made. Each patch `vX.Y.Z` with Z above 0 SHALL be tagged on `release/vX.Y`.
-Every PR SHALL land on `main`, the trunk.
-
-#### Scenario: The first release branch
-
-- **WHEN** v1.1.0 has been tagged and released from `openRepoTools-code`'s
-  `main`
-- **THEN** `release/v1.1` is cut at `v1.1.0`, and v1.1.1, when it comes, is
-  tagged on `release/v1.1`
-
-### Requirement: Back-ports land on main first
-
-A fix SHALL land on `main` first, through its own review and CI, before it
-reaches a release branch. While `main` holds only that patch line's work,
-the back-port SHALL be a fast-forward of `release/vX.Y`, or a merge of
-`main`. Otherwise it SHALL be a PR to `release/vX.Y` of
-`git cherry-pick -x <squash commit>`. At most one HOLD SHALL be open at a
-time on `release/vX.Y`. The lane that landed the PR SHALL make the back-port,
-unless the release owner fast-forwards. The LANDED line SHALL name both
-commits.
-
-#### Scenario: main holds only the patch
-
-- **WHEN** a fix lands on `main` and `main` has nothing since `release/v1.1`
-  except that patch line's work
-- **THEN** `release/v1.1` is fast-forwarded to it, and the LANDED line names
-  the commit on both branches
-
-#### Scenario: main has moved on
-
-- **WHEN** a fix lands on `main` after work for the next minor version
-- **THEN** it reaches `release/v1.1` only by a PR of
-  `git cherry-pick -x <squash commit>`, which runs its own CI
-
-### Requirement: A patch tag waits for its commit's CI
-
-A patch SHALL be tagged on `release/vX.Y` only once that commit's
-`tests.yml` runs have all finished, and the newest of them has succeeded.
-When a commit reached the branch by fast-forward, it has `main`'s push run
-and then the branch's own, and the newer run SHALL decide.
-
-#### Scenario: A run is still in progress
-
-- **WHEN** one of the commit's `tests.yml` runs has not finished
-- **THEN** the patch is not tagged yet
-
-#### Scenario: The newer run is red
-
-- **WHEN** `main`'s push run for the commit succeeded, and the branch's newer
-  push run for the same commit failed
-- **THEN** the patch is not tagged
-
-### Requirement: Release branches get the push runs the gate needs
-
-`tests.yml` SHALL run on `push` to `main` and to every `release/v*` branch,
-as well as on its existing triggers. Every run SHALL include the jobs
-`guard-launch-mode`, `tests`, `tests-no-submodule` and `package`.
-
-#### Scenario: A push to a release branch
-
-- **WHEN** a commit is pushed to `release/v1.1`
-- **THEN** a `tests.yml` push run runs all four jobs on that commit
-
-### Requirement: Release notes and GitHub Releases
-
-Each release SHALL have its notes in `docs/release-notes/vX.Y.Z.md`.
-`docs/release-notes/v1.0.0.md` SHALL hold the body of the published v1.0.0
-Release, byte for byte. A draft's placeholders SHALL be filled in or cut
-before its tag is made. A release's GitHub Release SHALL be created from its
-notes file, and, for a version published on PyPI, only after PyPI serves that
-version. No step of the release workflow SHALL read the notes.
-
-#### Scenario: The baseline notes
-
-- **WHEN** `docs/release-notes/v1.0.0.md` is compared with the body
-  `gh release view v1.0.0` returns
-- **THEN** the two are identical
-
-#### Scenario: The Release waits for the index
-
-- **WHEN** the v1.1.0 release run has uploaded to TestPyPI, but PyPI does not
-  serve 1.1.0 yet
-- **THEN** no GitHub Release for v1.1.0 exists yet
-
-### Requirement: Brett Heap decides every release act
-
-Every tag, every release-branch cut and every upload SHALL wait for Brett
-Heap's word. Each deployment to the `testpypi` and `pypi` environments SHALL
-wait for his approval. Lane openRepoTools-3, the release owner, SHALL carry
-out these acts on his word, and no other lane SHALL make them.
-
-#### Scenario: An approval is missing
-
-- **WHEN** a release run reaches an upload job and no approval for that
-  environment has been given
-- **THEN** the job waits, and nothing is uploaded
-
-### Requirement: Tags in the triad
-
-Release tags from v1.1.0 on SHALL be made in `openRepoTools-code`, where the
-release is built. `v1.0.0`, and every `rc` rehearsal tag, SHALL stay in
-`opensoft/openRepoTools`. Tags SHALL NOT be carried from one repository to
-another at the cutover.
-
-#### Scenario: The cutover
-
-- **WHEN** `opensoft/openRepoTools` becomes the assembly
-- **THEN** `v1.0.0` and `v1.1.0rc1` remain its tags, and neither is carried
-  to `openRepoTools-code` or to the spec leg
diff --git a/openspec/changes/release-tags-pypi/tasks.md b/openspec/changes/release-tags-pypi/tasks.md
deleted file mode 100644
index 8f00898f..00000000
--- a/openspec/changes/release-tags-pypi/tasks.md
+++ /dev/null
@@ -1,117 +0,0 @@
-# Tasks: governance and Speckit handoff
-
-This checklist tracks approval, the single Speckit feature link, the acts
-outside the repository, landing, and archival readiness. It holds no
-implementation steps. The only executable task list will be
-`specs/006-release-pypi/tasks.md` (see "Speckit Handoff"). Tick an item here
-only when the step it names has actually happened, and with its evidence.
-
-## 1. Proposal, review and planning artifacts
-
-- [x] 1.1 Record the proposal with Brett Heap's decisions (#228's body) and
-  his answers of 2026-10-17T21:51:50Z (#228 comment 6241784787); verify
-  proposal.md cites both and the alignment review's fixes are in it
-  (commit `698cf30`).
-- [x] 1.2 Apply the council's verdicts: VALID 1–9 in proposal.md, NOTED
-  N1–N5 and dismissed D1–D3 in clarifications.md, and the lead's correction
-  to VALID 4 after #186 comment 6242560541; verify commits `56669c1` and
-  `ea306de` are on `origin/006-release-pypi`.
-- [x] 1.3 Record the two delta specs and design.md; verify
-  `openspec validate release-tags-pypi --strict` reports the change valid
-  and `openspec status --change release-tags-pypi` shows proposal, specs,
-  design and tasks done.
-- [x] 1.4 Record Brett Heap's word on the workBenches position, (a), (b) or
-  (c); verify the proposal's "workBenches condition" bullet states his
-  choice and is the only bullet that changed. Resolved 2026-10-18: Brett
-  Heap chose (c) ("go with (c)"), and lane openRepoTools-3 filed
-  opensoft/workBenches#165. The proposal's position (c) bullet states
-  that, in the commit that ticks this item, and no other proposal bullet
-  changed in it.
-
-## 2. The single Speckit feature
-
-- [x] 2.1 Create the one Speckit feature for this change with
-  `/speckit.specify`; verify `specs/006-release-pypi/spec.md` exists on
-  branch `006-release-pypi`, and that no other Speckit feature names
-  `release-tags-pypi` or #228. Done 2026-10-17 at `eb12177`: `grep -rl` for
-  either name under `specs/` finds only `specs/006-release-pypi/`.
-- [ ] 2.2 Plan and task the feature with `/speckit.plan` and
-  `/speckit.tasks`; verify `specs/006-release-pypi/tasks.md` exists, that
-  every task carries a tier, a `files:` list and a `verify:` command, and
-  that together they cover every requirement of both delta specs and every
-  decision in design.md.
-- [x] 2.3 Fill in the handoff below with the feature's final path; verify
-  "Speckit Handoff" names exactly one feature, branch and task path, and is
-  no longer marked pending. Done 2026-10-17 at `760281b`; the task path
-  exists since `01ff6d6`.
-
-## 3. Landing in opensoft/openRepoTools
-
-- [ ] 3.1 Land feature 006's PRs by squash once each is independently
-  reviewed and green on Linux CI (decision 4); verify each LANDED line
-  names its squash commit on `main`.
-- [ ] 3.2 Confirm the order lane openRepoTools-1 depends on: #228's PRs
-  land before lane 1's single rehearsal and regenerated adoption plan (#186
-  comment 6242560541, D1); verify the rehearsal's baseline commit contains
-  #228's last squash commit.
-
-## 4. Rehearsals, on Brett Heap's word
-
-- [ ] 4.1 Brett Heap creates the `testpypi` and `pypi` environments in
-  `opensoft/openRepoTools` (required reviewer brettheap, deployment limit the
-  tag pattern `v*`) and the test.pypi.org pending publisher; verify the
-  release build's environment gate passes on a branch dispatch.
-- [ ] 4.2 Run the branch rehearsal; verify every build check and the install
-  check pass, and no upload job runs.
-- [ ] 4.3 On his word for the tag `v1.1.0rc1`, and his approval of the
-  `testpypi` deployment, run the TestPyPI rehearsal; verify TestPyPI serves
-  exactly the recorded digest, the install check passes, and the `pypi` job
-  is skipped.
-
-## 5. The cutover's dependencies (#186, lane openRepoTools-1)
-
-- [ ] 5.1 Lane openRepoTools-1's adoption plan at openRepoShape v1.1.0
-  carries this change's entries; verify `pyproject.toml` and `src/` go to
-  code, `.github/` to code, and `docs/release-notes/` to spec, and that the
-  plan states the cutover invariants: the four job ids, no release step
-  reading across legs, and no `readme` in `pyproject.toml`.
-- [ ] 5.2 After `execute`, `code-0001` is the code leg's first commit;
-  verify that `LICENSE` on `openRepoTools-code`'s `main` is blob `261eeb9`
-  before the first `package` run there, and record the check (lane
-  openRepoTools-3).
-
-## 6. v1.1.0, after `execute`, on Brett Heap's word
-
-- [ ] 6.1 Brett Heap's code-side acts: in `opensoft/openRepoTools-code`,
-  the two environments and the `v*` tag ruleset; the test.pypi.org
-  publisher pointed at `openRepoTools-code`; the pypi.org pending publisher
-  for it, the only one on pypi.org; verify all four exist before any v1.1.0
-  dispatch.
-- [ ] 6.2 Tag v1.1.0 on `openRepoTools-code`'s `main` once that commit's
-  `tests.yml` runs have all finished and the newest is green; dispatch the
-  release and take Brett Heap's approvals; verify PyPI serves exactly the
-  recorded digest.
-- [ ] 6.3 Create the GitHub Release from `docs/release-notes/v1.1.0.md`
-  after PyPI serves 1.1.0, then cut `release/v1.1` at `v1.1.0`; verify both
-  exist and the Release's body is the notes file's text.
-- [ ] 6.4 Open the assembly's README PR with the pipx route's text once PyPI
-  serves 1.1.0 and the workBenches condition holds (lane openRepoTools-3);
-  verify the README's text matches the proposal's.
-
-## 7. Verification and archive readiness
-
-- [ ] 7.1 Accept the Speckit feature's evidence; verify every task in
-  `specs/006-release-pypi/tasks.md` is checked, with its verify command's
-  result recorded.
-- [ ] 7.2 Archive only once v1.1.0 is published and the README PR has
-  landed or been recorded as waiting on the workBenches condition; verify
-  `openspec validate release-tags-pypi --strict` still passes before
-  `/opsx:archive`.
-
-## Speckit Handoff
-
-- **Feature:** `006-release-pypi`
-- **Branch:** `006-release-pypi`
-- **Tasks:** `specs/006-release-pypi/tasks.md`
-- **Specified:** 2026-10-17, by `/speckit.specify`
-  (`specs/006-release-pypi/spec.md`)
diff --git a/openspec/changes/skip-no-lane-guard/.openspec.yaml b/openspec/changes/skip-no-lane-guard/.openspec.yaml
deleted file mode 100644
index 1aca8b91..00000000
--- a/openspec/changes/skip-no-lane-guard/.openspec.yaml
+++ /dev/null
@@ -1,2 +0,0 @@
-schema: spec-driven
-created: 2026-09-30
diff --git a/openspec/changes/skip-no-lane-guard/design.md b/openspec/changes/skip-no-lane-guard/design.md
deleted file mode 100644
index c595bf11..00000000
--- a/openspec/changes/skip-no-lane-guard/design.md
+++ /dev/null
@@ -1,19 +0,0 @@
-## Context
-
-See proposal.md. workBenches selects profile and lane modes per launch; profile settings can be used concurrently by both modes.
-
-## Goals / Non-Goals
-
-Honor the process's no-lane marker without editing shared profile settings. Other lane checks and commands retain their existing behavior.
-
-## Decisions
-
-The `guard` handler exits silently with status 0 for the exact environment value `CLAUDE_NO_LANE=1`, before reading hook input or validating lane identity. All other values use the existing enforcement path. Changing profile settings would affect concurrent lane sessions, so the exemption belongs to the child process environment.
-
-## Risks / Trade-offs
-
-An inherited marker could exempt a later lane launch. workBenches clears it for explicit lane requests and lane handoff; only explicit `--no-lane` wins over those requests. Existing Claude processes keep their launch environment and must be relaunched to change mode.
-
-## Migration Plan
-
-Install the marker-aware guard with the normal openRepoTools installation path and install the matching workBenches launcher. Revert both changes to roll back. Do not edit the pinned workBenches vendor copy directly.
diff --git a/openspec/changes/skip-no-lane-guard/proposal.md b/openspec/changes/skip-no-lane-guard/proposal.md
deleted file mode 100644
index baa4ed5b..00000000
--- a/openspec/changes/skip-no-lane-guard/proposal.md
+++ /dev/null
@@ -1,22 +0,0 @@
-## Why
-
-Profile-only Claude launches currently encounter the lane name guard even though the operator chose to work without a lane. The guard must honor that launch mode for the lifetime of the process.
-
-## What Changes
-
-- Skip the prompt guard when the launcher supplies `CLAUDE_NO_LANE=1`.
-- Keep the hook installed and enforce existing checks for every other value.
-- Document the process environment contract with workBenches.
-- Run the expanded guard and repository hygiene checks in a focused CI job using the canonical serialized wrapper.
-
-## Capabilities
-
-### New Capabilities
-
-- `profile-only-lane-guard`: per-session exemption for a launch without a lane.
-
-### Modified Capabilities
-
-## Impact
-
-`lanes-edit.sh guard`, lane documentation and regression coverage. workBenches supplies the marker. Implementation handoff: `specs/002-skip-no-lane-guard/`.
diff --git a/openspec/changes/skip-no-lane-guard/specs/profile-only-lane-guard/spec.md b/openspec/changes/skip-no-lane-guard/specs/profile-only-lane-guard/spec.md
deleted file mode 100644
index b29184ff..00000000
--- a/openspec/changes/skip-no-lane-guard/specs/profile-only-lane-guard/spec.md
+++ /dev/null
@@ -1,43 +0,0 @@
-## Purpose
-
-Allow Claude sessions launched without a lane to submit prompts while lane sessions retain their normal identity checks.
-
-## ADDED Requirements
-
-### Requirement: Profile-only prompts avoid lane initialization
-
-The guard SHALL apply the exact launch exemption before probing workspace
-configuration, git, workstation identity or its own command path.
-
-#### Scenario: Infrastructure probes are unavailable
-
-- **WHEN** a marked guard invocation would encounter unavailable identity commands
-- **THEN** it exits silently with status 0 without invoking those commands
-
-#### Scenario: Invalid guard arguments accompany the marker
-
-- **WHEN** a marked guard invocation includes unexpected arguments
-- **THEN** it prints usage and returns status 2 without identity probes
-
-### Requirement: Respect the session launch mode
-
-The prompt guard SHALL silently return status 0 when `CLAUDE_NO_LANE=1`, including when lane identity cannot be read. It SHALL keep existing enforcement for all other values and SHALL NOT alter profile hook settings or lane records for the exempt prompt.
-
-#### Scenario: Profile session inside the projects root
-
-- **WHEN** a prompt arrives from a process launched with `CLAUDE_NO_LANE=1` inside the projects root
-- **THEN** it is allowed without consulting tmux or requiring a lane row
-
-#### Scenario: Unsupported marker value
-
-- **WHEN** the marker is absent, empty, `0`, or `true` and no lane workspace can be read
-- **THEN** the guard returns status 2 through its existing refusal path
-
-### Requirement: Limit the exemption to the prompt guard
-
-Other lane commands SHALL retain their existing validation even when `CLAUDE_NO_LANE=1` is present.
-
-#### Scenario: Registry read with no workspace
-
-- **WHEN** a registry read runs with `CLAUDE_NO_LANE=1` and no workspace configuration
-- **THEN** it still refuses the missing workspace
diff --git a/openspec/changes/skip-no-lane-guard/tasks.md b/openspec/changes/skip-no-lane-guard/tasks.md
deleted file mode 100644
index be0972a9..00000000
--- a/openspec/changes/skip-no-lane-guard/tasks.md
+++ /dev/null
@@ -1,5 +0,0 @@
-## 1. Speckit handoff
-
-- [x] 1.1 Record the authorized behavior and hand off implementation to `specs/002-skip-no-lane-guard/tasks.md`; verify the spec, plan and task files exist.
-
-Implementation tracking is owned by that Speckit task file.
diff --git a/openspec/config.yaml b/openspec/config.yaml
deleted file mode 100644
index b4bbeb94..00000000
--- a/openspec/config.yaml
+++ /dev/null
@@ -1 +0,0 @@
-schema: spec-driven
diff --git a/park b/park
deleted file mode 100755
index d558d053..00000000
--- a/park
+++ /dev/null
@@ -1,1294 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# park — leave this workstation with your half-finished work carried, from any
-# folder: `park InkRouter`, or just `park` from inside the estate.
-#
-# Installed with the other three by `openRepoTools --install`.
-#
-# IT ADDS NO MECHANICS, exactly as the `openRepoShape` command adds none. It
-# FINDS THE ESTATE and runs the estate's own `make park` — the family holder's,
-# which fans out to each member's, or the assembly root's — and those targets
-# run the SPECKIT GIT EXTENSION's `park.sh`, which is the one implementation of
-# the WIP commit, the push and the record (#77, RULING 2026-09-09 ruling 1).
-# Then it says what did NOT park and why none of it is park's to touch. It
-# creates nothing, commits nothing and pushes nothing of its own.
-#
-# openRepoShape #82, under Brett Heap's RULING of 2026-09-09: `--repo` matches
-# a LOCAL clone (ruling 1); the command is `park` (ruling 4). WITH NO <Name>
-# the estate around the current directory is parked — the walk-up, unchanged
-# since #82. WITH NO ESTATE AROUND IT EITHER, `park` lists every estate under
-# the projects directory and ASKS whether to park them all; `park --all` (or
-# `-a`) is the same sweep without the question, from anywhere. That is Brett
-# Heap's RULING of 2026-09-10 in this repository, verbatim: "lets change that
-# so it parks the current repo. if not in a repo, then asks if want to park
-# all. and park all should be park -a or park --all" — and it supersedes his
-# #91 ruling of the same day ("so just park will do park-all"), under which
-# the bare form PARKED EVERY ESTATE unasked, which had itself superseded
-# ruling 3 of #82 (the bare form REFUSES and lists what it found). With no
-# terminal on stdin nothing can be asked, so the bare form refuses and names
-# `--all`: a script that wants the sweep says so. THE SWEEP ITSELF is #91's —
-# every estate in name order, continuing past a refusal, one summary. IN THAT
-# SWEEP ONLY, a standalone root carrying no Speckit git overlay is SKIPPED and
-# named instead of being run and counted as a refusal — Brett Heap's RULING
-# of 2026-09-10 on openRepoShape #92, "skip roots without the overlay": a
-# root nobody ever installed the overlay in is not a park that FAILED. Naming
-# that same root still relays its own `make park` refusal. `resume` has no
-# sweep and no `--all`: its bare form KEEPS ruling 3's refusal (see its
-# header) — rebuilding every estate on a fresh machine by accident is the
-# opposite risk from failing to park the one you meant.
-# openRepoShape #82 wrote this, its #91 and #93 changed it, its #92 moved it
-# here, and this repository's #6 and then its #8 last changed it.
-
-set -euo pipefail
-
-SELF_NAME="park"
-
-NAME=""
-REPO_SLUG=""
-REPO_ARG=""
-DRY_RUN=0
-LANE=""
-PASSTHROUGH=()
-#: `flag_value`'s three answers, declared with the other globals so that a
-#: `die` reaching `$FLAG_HINT` before any arm has asked is an empty hint under
-#: `set -u`, never "unbound variable" at exit 1 — the one exit these arms must
-#: not produce (the independent review of this branch, 2026-09-11).
-FLAG_VALUE=""
-FLAG_SHIFT=2
-FLAG_HINT=""
-#: 1 when EVERY estate under the projects directory is to be parked: set by
-#: `--all` / `-a` on the command line, or by a YES to the question the bare
-#: form asks when the walk-up found no estate around the cwd. Every other
-#: path leaves this 0. `ALL_ROWS` is what the sweep will run, `<name><TAB>
-#: <dir>` per estate, discovered ONCE by whichever of the two set it — so what
-#: was listed, or asked about, is exactly what runs.
-PARK_ALL=0
-ALL_ROWS=""
-
-say() { printf '%s\n' "$*"; }
-# THE SAME STDERR SHAPE AS `die`, BUT IT RETURNS: a park-everything run (#91)
-# has to report one estate's refusal and carry on to the next, which `die`'s
-# own `exit` cannot do. `die` is this plus the exit, so the two can never
-# print differently by accident.
-refuse() { printf '\nREFUSED: %s\n' "$1" >&2; }
-die() { refuse "$1"; exit "${2:-2}"; }
-
-usage() {
-    cat <<'USAGE'
-park [<Name>] [--repo <owner/name>] [--dry-run] [--lane <name>] [-- ARGS...]
-park --all | -a [--dry-run] [--lane <name>] [-- ARGS...]
-park --help
-
-Commit, push and RECORD every open feature of one estate, so another
-workstation can take the work up with `resume <Name>`.
-
-<Name> is the estate's folder under your projects directory: a FAMILY folder
-(<Name>/<Name>/family.yaml) or a standalone project root (<Name>/project.yaml).
-With no <Name> the estate around the current directory is parked. With NO
-estate around it either, `park` lists every estate under your projects
-directory and ASKS whether to park them all; anything but `y` parks nothing.
-`park --all` (or `-a`) is that same sweep WITHOUT the question, from anywhere:
-every estate in name order, continuing past a refusal or a non-zero `make
-park`, then one summary. Where stdin is not a terminal the bare form cannot
-ask, so it refuses and names `--all` - a script that wants the sweep says so.
-(Brett Heap's RULING of 2026-09-10, superseding his #91 ruling of the same
-day, under which the bare form swept unasked.) In the sweep a root with NO
-Speckit git overlay is SKIPPED and counted apart rather than failed (his
-RULING of the same day on #92); naming that root still relays its own
-refusal, which names `setup-openspeckit`. `resume` has no `--all`: rebuilding
-every estate on a fresh machine by accident is a worse mistake than failing
-to park the one you meant. `--repo <owner/name>` names the estate by the
-origin of a clone you ALREADY HAVE - in any spelling: the slug, the slug with
-`.git`, or the whole https or ssh url. It never clones (`resume` is the
-command that clones).
-
-  --all, -a           park EVERY estate under your projects directory, unasked
-  --project <Name>    the positional under a flag (also --name)
-  --dry-run           rehearse: `make park ARGS=--dry-run`, which writes nothing
-  --lane <name>       the lane recorded in the WIP commit subject
-  --flag=<value>      every flag that takes a value takes it after an `=` too
-                      (`--repo=<owner/name>`): the one way to give a value
-                      that begins with `-`, which the spaced spelling refuses
-  -- ARGS...          passed on to the extension through `make park ARGS='...'`
-
-  $PROJECTS_DIR       your projects directory (default: ~/projects, then
-                      ~/Projects - people spell it both ways)
-
-WHAT PARK NEVER DOES: it creates nothing, and it moves nobody's HEAD. Commits
-on a `main` that were never pushed, a dirty root mid pin-bump, and ignored
-local files (.env, credentials) are REPORTED and left exactly where they are.
-USAGE
-}
-
-# --- BEGIN shared estate resolver (park, resume, status: byte for byte) -----
-#
-# THIS BLOCK IS DUPLICATED IN THE OTHER COMMANDS, DELIBERATELY, and
-# `tests/test_park_resume_commands.py` asserts the three copies are IDENTICAL.
-# Each of these is one file a person has on PATH: a shared `orp-estate.sh`
-# would be a fifth file for `--install` to place and a broken command the
-# first time somebody copied only one of them. The rules themselves are NOT
-# new: `<dir>/<Name>/family.yaml` carrying `kind: family-manifest` and naming
-# `<Name>` is `setup-project.py`'s `family_folder_here`, doubled-name layout
-# and all (#76, RULING ruling 3). What "naming" accepts is widened by #236,
-# at `is_family_folder` below: the display `name:` or the repository's name.
-
-# `$PROJECTS_DIR` names ONE directory when it is set. Otherwise both
-# spellings, in that order, because people really do use both - and DEDUPED by
-# inode, because on a case-insensitive filesystem (a stock Mac) `~/projects`
-# and `~/Projects` are the same directory, and listing every estate twice
-# would read as two estates.
-PROJECTS_DIRS=()
-if [ -n "${PROJECTS_DIR:-}" ]; then
-    PROJECTS_DIRS=("$PROJECTS_DIR")
-else
-    PROJECTS_DIRS=("$HOME/projects")
-    if [ -d "$HOME/Projects" ]; then
-        if [ -d "$HOME/projects" ] && [ "$HOME/Projects" -ef "$HOME/projects" ]; then
-            : # one directory under two spellings; name it once
-        else
-            PROJECTS_DIRS+=("$HOME/Projects")
-        fi
-    fi
-fi
-
-# Where a NEW clone would go: the first spelling that already exists, else the
-# first named.
-#
-# shellcheck disable=SC2329  # `park` and `status` create nothing and never
-# call this. The block is byte-identical in all three commands BY DESIGN, so
-# each carries a couple of functions only another one asks.
-projects_dir_for_new() {
-    local dir
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        if [ -d "$dir" ]; then
-            printf '%s\n' "$dir"
-            return 0
-        fi
-    done
-    printf '%s\n' "${PROJECTS_DIRS[0]}"
-}
-
-# ONE SCALAR'S TEXT, read the way openRepoShape v1.1.0's `parse_yaml` reads
-# it (`scripts/repo_shape.py`: `_strip_comment`, `_quote_end`,
-# `_quoted_scalar`), so a file both of them read gets one answer (#243). A
-# value that OPENS WITH A QUOTE is the text up to the quote that closes it -
-# inside `"..."` a `\` takes the character after it along, and inside `'...'`
-# a doubled `''` is one quote, so neither closes it - and whatever follows
-# the close, a `# comment` included, is not the value: a ` #` inside the
-# quotes is text. Any other value is cut at the first `#` that opens it or
-# follows a space or tab, which is a comment, and trimmed; `a#b` is the text
-# `a#b`. The escapes are honoured to find the close and never unescaped, as
-# this reader never unescaped them: no branch, path, folder or repository
-# name it is asked for carries one. A quote nothing closes is not YAML at
-# all, and the text is kept whole, as before. What is NULL is not said here:
-# `null` and `"null"` are both the text `null`, and `yaml_scalar` says which
-# of the two it was.
-trim_unquote() {
-    local value="$1" quote="" ch="" i=1
-    value="${value%$'\r'}"
-    value="${value#"${value%%[![:space:]]*}"}"
-    case "$value" in
-    '"'* | "'"*)
-        quote="${value:0:1}"
-        while [ "$i" -lt "${#value}" ]; do
-            ch="${value:$i:1}"
-            if [ "$quote" = '"' ] && [ "$ch" = "\\" ]; then
-                i=$((i + 2))
-            elif [ "$ch" != "$quote" ]; then
-                i=$((i + 1))
-            elif [ "$quote" = "'" ] && [ "${value:$((i + 1)):1}" = "'" ]; then
-                i=$((i + 2))
-            else
-                printf '%s' "${value:1:$((i - 1))}"
-                return 0
-            fi
-        done
-        ;;
-    *)
-        value=" $value"
-        value="${value%%[[:space:]]#*}"
-        value="${value#"${value%%[![:space:]]*}"}"
-        ;;
-    esac
-    printf '%s' "${value%"${value##*[![:space:]]}"}"
-}
-
-# ONE FOLDER NAME, and never a path. A `<Name>` off the command line and a
-# `root:` out of somebody's workspace manifest both end up joined to the
-# projects directory, so both are held to this: no empty string, no `/`, and
-# no leading `.` — which is what stops `resume ../../elsewhere/X` from cloning
-# outside the projects directory at all, rather than noticing afterwards.
-is_safe_folder_name() {
-    local name="$1"
-    case "$name" in
-    "" | .* | */*) return 1 ;;
-    esac
-    case "$name" in
-    *[!A-Za-z0-9_.+@-]*) return 1 ;;
-    esac
-    return 0
-}
-
-# One indent-zero scalar out of a small YAML file, with parameter expansion
-# only: no YAML library, no python per line, no forks per line. The line is
-# found the way the Speckit extension's `workspace_read_scalar` finds one, at
-# indent zero by its key; the VALUE is `trim_unquote`'s, above, which is
-# openRepoShape v1.1.0's reading of it and differs from the extension's where
-# a `#` sits inside quotes or with no space in front of it, and on a line that
-# is not YAML at all (#243). The keys the three commands ask for are
-# `family.yaml`'s and `project.yaml`'s, a record's `family:`, the two of
-# `workspace.yaml`, and the shape pin's.
-# `YAML_QUOTED` is 1 when the value was QUOTED: YAML's null is an unquoted
-# `null` or `~`, and a quoted `"null"` is the text, which is a difference
-# `trim_unquote`'s answer alone cannot carry (`named_for_repository`).
-YAML_VALUE=""
-YAML_QUOTED=0
-yaml_scalar() {
-    local file="$1" key="$2" line value
-    YAML_VALUE=""
-    YAML_QUOTED=0
-    [ -f "$file" ] || return 1
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "$key":*) ;;
-        *) continue ;;
-        esac
-        value="${line#"$key":}"
-        case "${value#"${value%%[![:space:]]*}"}" in
-        '"'* | "'"*) YAML_QUOTED=1 ;;
-        esac
-        YAML_VALUE="$(trim_unquote "$value")"
-        return 0
-    done <"$file"
-    return 1
-}
-
-# A LINKED WORKTREE, not a checkout of its own: `.git` is a FILE holding a
-# `gitdir:` line, and `--git-dir` and `--git-common-dir` disagree. A
-# single-repository project's FEATURE worktree is a whole `project.yaml` root
-# by construction, so without this the walk-up would answer `<worktree_root>/
-# 001-my-feature` as an estate named after the branch — and `park` would run
-# the write verb inside the very worktree the extension is about to park.
-# GIT'S OWN ANSWER, and not the `.git`-is-a-file shortcut, because that shape
-# is shared with a SUBMODULE and a leg must not be mistaken for a worktree:
-# in a linked worktree `--git-dir` is `<common>/worktrees/<name>` and the two
-# differ; in a submodule both are `<super>/.git/modules/<name>`; in an
-# ordinary checkout both are `.git`. Verified against all three.
-is_linked_worktree() {
-    local dir="$1" gitdir common
-    [ -e "$dir/.git" ] || return 1
-    gitdir="$(git -C "$dir" rev-parse --git-dir 2>/dev/null || true)"
-    common="$(git -C "$dir" rev-parse --git-common-dir 2>/dev/null || true)"
-    [ -n "$gitdir" ] && [ -n "$common" ] && [ "$gitdir" != "$common" ]
-}
-
-# The PINNED copy inside a family holder: `<Family>/<Family>/members/<X>`, so
-# the grandparent carries the `family.yaml`. It is detached, it is what
-# `bootstrap` and `validate` read, and nobody's in-flight work is in it — a
-# walk-up that answered it would run a WRITE verb on a detached HEAD. The
-# working clone BESIDE the holder is the one a person works in, which is the
-# same rule #80's holder dispatch follows.
-is_pinned_member() {
-    local dir="$1" parent grandparent
-    parent="${dir%/*}"
-    [ -n "$parent" ] && [ "$parent" != "$dir" ] || return 1
-    grandparent="${parent%/*}"
-    [ -n "$grandparent" ] && [ "$grandparent" != "$parent" ] || return 1
-    yaml_scalar "$grandparent/family.yaml" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ]
-}
-
-# Is `<dir>` a FAMILY FOLDER? All three facts have to agree: the holder clone
-# sits at `<dir>/<basename>`, its `family.yaml` says `kind: family-manifest`,
-# and the folder is named for the family. A family has TWO names and either
-# one is the folder's (#236): its display `name:`, which is the rule this
-# block began with and what an estate laid out before openRepoShape v1.1.0
-# has, or the LAST PART of its `repository:`, which is v1.1.0's rule - the
-# holder, and the folder around it, are named for the REPOSITORY, `name:`
-# being only a title (opensoft/openRepoShape#629), and the holder's `make
-# siblings` stops before cloning when the folder is not that name
-# (opensoft/openRepoShape#543). A family whose two names differ has no layout
-# that works for both unless both are accepted. A directory called Northwind
-# is a directory called Northwind; what makes it a family folder is read,
-# never guessed from a name. The repository arm is `named_for_repository`,
-# below, which `status` and `resume` also ask when one family is on disk in
-# both layouts (#243).
-is_family_folder() {
-    local dir="$1" name manifest
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    manifest="$dir/$name/family.yaml"
-    yaml_scalar "$manifest" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ] || return 1
-    if yaml_scalar "$manifest" name && [ "$YAML_VALUE" = "$name" ]; then
-        return 0
-    fi
-    named_for_repository "$dir"
-}
-
-# Is `<dir>` named for its holder's REPOSITORY: the LAST PART of
-# `<dir>/<basename>/family.yaml`'s `repository:`, as v1.1.0's `repo_basename`
-# takes it (`rsplit("/", 1)[-1]`)? That is the folder v1.1.0 prescribes, and
-# where `make siblings` moves a holder that is not in it. AN UNQUOTED `null`
-# OR `~` IS NO REPOSITORY (#243) - nor `Null` or `NULL`, the spellings
-# v1.1.0's `_scalar` reads as null too - so a folder called `null` is not
-# named for one, and `is_family_folder` has only the display `name:` left to
-# go on, which is v1.1.0's own fallback. A QUOTED `"null"` is the text.
-named_for_repository() {
-    local dir="$1" name
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    yaml_scalar "$dir/$name/family.yaml" repository || return 1
-    if [ "$YAML_QUOTED" -eq 0 ]; then
-        case "$YAML_VALUE" in null | Null | NULL | '~') return 1 ;; esac
-    fi
-    [ "${YAML_VALUE##*/}" = "$name" ]
-}
-
-is_project_root() {
-    local dir="$1"
-    yaml_scalar "$dir/project.yaml" kind || return 1
-    [ "$YAML_VALUE" = "project-manifest" ] || return 1
-    is_pinned_member "$dir" && return 1
-    is_linked_worktree "$dir" && return 1
-    return 0
-}
-
-ESTATE_KIND=""
-ESTATE_DIR=""
-ESTATE_ROOT=""
-ESTATE_NAME=""
-
-# Is THIS directory an estate? A FAMILY FOLDER WINS over a standalone root of
-# the same name: the holder is what drives the members, so a family answered as
-# one of its own members would act on one project and report the estate done.
-estate_here() {
-    local dir="$1"
-    if is_family_folder "$dir"; then
-        ESTATE_KIND="family"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir/$ESTATE_NAME"
-        return 0
-    fi
-    if is_project_root "$dir"; then
-        ESTATE_KIND="standalone"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir"
-        return 0
-    fi
-    return 1
-}
-
-# The NEAREST estate at or above `<dir>`: the holder beside you, or the project
-# root you are standing in. NEAREST WINS, so standing inside a member of a
-# family acts on that member - the estate the person is standing in. A pinned
-# copy and a linked worktree are WALKED PAST rather than answered, so
-# `<Family>/<Family>/members/<X>` reaches the family folder and a feature
-# worktree reaches the root that owns it.
-estate_walk_up() {
-    local dir="$1"
-    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
-        estate_here "$dir" && return 0
-        dir="${dir%/*}"
-    done
-    return 1
-}
-
-estate_by_name() {
-    local want="$1" dir
-    is_safe_folder_name "$want" || return 1
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        estate_here "$dir/$want" && return 0
-    done
-    return 1
-}
-
-# Every estate under the projects directory, one row each. What ruling 3 asks
-# a refusal to print: a person who typed the command in the wrong folder needs
-# the names, not an instruction to go and look for them.
-list_estates() {
-    local dir child
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            if is_family_folder "$child"; then
-                printf '  family   %-20s %s\n' "${child##*/}" "$child"
-            elif is_project_root "$child"; then
-                printf '  project  %-20s %s\n' "${child##*/}" "$child"
-            fi
-        done
-    done
-}
-
-estates_or_none() {
-    local rows
-    rows="$(list_estates)"
-    if [ -n "$rows" ]; then
-        printf '%s\n' "$rows"
-    else
-        printf '  (none)\n'
-    fi
-}
-
-# Every FAMILY FOLDER under the projects directory whose holder's
-# `family.yaml` says `id: <id>`, one per line, in `list_estates`' order, and
-# nothing for an empty <id>. The id is what `park.sh` files a family's record
-# under (`workspace_family_name` reads it), and it is the SAME in every layout
-# of one family: v1.1.0's folder named for the repository and the
-# display-name folder before it are two directories, two estates and ONE
-# record (#243). So this is how `resume` finds a holder its record's folder
-# no longer names, and how `status` sees one family laid out twice.
-#
-# ONE FOLDER IS LISTED ONCE, however many spellings reach it. `PROJECTS_DIRS`
-# is deduped by inode, but the folders inside two distinct directories are
-# not: a `~/Projects/Quill` that is a LINK to `~/projects/Quill` is one
-# holder, and listing it twice made `resume` refuse "2 family folders" and
-# `status` report one family "laid out 2 times" (the review of #251, finding
-# 1). So a folder that is `-ef` one already listed is skipped, and the first
-# spelling, in `PROJECTS_DIRS`' order, is the one named.
-#
-# shellcheck disable=SC2329  # `park` never asks: it files the record, and
-# never looks a holder up by it. The block is byte-identical by design.
-family_folders_with_id() {
-    local want="$1" dir child prior dup
-    local -a found=()
-    [ -n "$want" ] || return 0
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            is_family_folder "$child" || continue
-            yaml_scalar "$child/${child##*/}/family.yaml" id || continue
-            [ "$YAML_VALUE" = "$want" ] || continue
-            dup=0
-            for prior in ${found[@]+"${found[@]}"}; do
-                if [ "$child" -ef "$prior" ]; then dup=1; fi
-            done
-            [ "$dup" -eq 0 ] || continue
-            found+=("$child")
-            printf '%s\n' "$child"
-        done
-    done
-}
-
-lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
-
-# `owner/name` — CASE PRESERVED, so a refusal prints back what a person can
-# type — out of any spelling git accepts: owner/name, owner/name.git,
-# https://host/owner/name(.git), git@host:owner/name.git,
-# ssh://git@host/owner/name.git, and a token-bearing https url. Callers
-# compare with `lower` on both sides, because GitHub owners and names are
-# case-insensitive.
-#
-# A FILESYSTEM PATH IS REFUSED rather than parsed, for the reason the
-# extension's own `workspace_org_from_url` refuses one: `/srv/remotes/Name.git`
-# has a name but no owner, and inventing `remotes` as the owner would let
-# `--repo remotes/Name` match a bare repository on disk. Such a clone answers
-# `<Name>` and the walk-up; it does not answer `--repo`.
-repo_slug_of() {
-    local url="$1" rest owner name
-    rest="$url"
-    case "$rest" in
-    /* | ./* | ../* | [A-Za-z]:[/\\]* | file://*) return 1 ;;
-    esac
-    rest="${rest%/}"
-    rest="${rest%.git}"
-    case "$rest" in
-    *://*)
-        rest="${rest#*://}"
-        rest="${rest#*@}"
-        rest="${rest#*/}"
-        ;;
-    *@*:*)
-        rest="${rest#*@}"
-        rest="${rest#*:}"
-        ;;
-    esac
-    case "$rest" in
-    */*) ;;
-    *) return 1 ;;
-    esac
-    name="${rest##*/}"
-    owner="${rest%/*}"
-    owner="${owner##*/}"
-    [ -n "$owner" ] && [ -n "$name" ] || return 1
-    case "$owner$name" in
-    *[!A-Za-z0-9_.-]*) return 1 ;;
-    esac
-    printf '%s/%s\n' "$owner" "$name"
-}
-
-# The clone under the projects directory whose `origin` IS that repository -
-# ruling 1. Two levels deep, because the estates this standard places are
-# `<projects>/<Project>` and `<projects>/<Family>/<Project>`.
-clone_with_origin() {
-    local want dir candidate origin found
-    want="$(lower "$1")"
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for candidate in "$dir"/*/ "$dir"/*/*/; do
-            candidate="${candidate%/}"
-            [ -e "$candidate/.git" ] || continue
-            origin="$(git -C "$candidate" remote get-url origin 2>/dev/null || true)"
-            [ -n "$origin" ] || continue
-            found="$(repo_slug_of "$origin" || true)"
-            [ -n "$found" ] || continue
-            if [ "$(lower "$found")" = "$want" ]; then
-                printf '%s\n' "$candidate"
-                return 0
-            fi
-        done
-    done
-    return 1
-}
-
-# The family's members, by the same `  - project: <Project>` row `family.py`
-# writes and `siblings.py` reads. The working clone is `<family folder>/
-# <Project>`, beside the holder.
-family_members() {
-    local manifest="$1" line
-    [ -f "$manifest" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "  - project: "*) printf '%s\n' "$(trim_unquote "${line#  - project: }")" ;;
-        esac
-    done <"$manifest"
-}
-
-# The branch a checkout belongs on: its OWN manifest's `tracking_branch:` —
-# the field `scripts/bootstrap.py` already reads to place the legs — falling
-# back to `main`. The workspace manifest records a `tracking_branch` too, but
-# that is PROVENANCE from the machine that parked; the local declaration is
-# what this machine's clone actually tracks, and the extension takes the same
-# line about `worktree_root`.
-tracking_branch_of() {
-    local root="$1"
-    if yaml_scalar "$root/family.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    if yaml_scalar "$root/project.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    printf 'main\n'
-}
-
-# The legs a root declares, by path, out of `project.yaml`'s `legs:` block —
-# the same rows `scripts/bootstrap.py` reads, and in the order it reads them,
-# `role:` before `path:`. The assembly leg is `path: "."` and is the root
-# itself, so it is not one of these.
-#
-# shellcheck disable=SC2329  # only `resume` bootstraps a root, so only
-# `resume` has to ask where its legs are; see the note above.
-legs_of() {
-    local root="$1" line role="" path=""
-    [ -f "$root/project.yaml" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            [ -n "$role" ] || continue
-            [ "$role" != "assembly" ] || continue
-            [ "$path" != "." ] || continue
-            [ -n "$path" ] && printf '%s\n' "$path"
-            ;;
-        [![:space:]]*) role=""; path="" ;;
-        esac
-    done <"$root/project.yaml"
-}
-
-# The branch a leg's OWN row declares for it: `leg_branch_of <root> <leg path>`
-# prints the `branch:` of the `legs:` row whose `path:` is <leg path>, and
-# NOTHING when that row declares none, or no row has the path. It is the
-# value `scripts/bootstrap.py` puts first — `str(leg.get("branch") or branch)`
-# — so a leg is placed on its own `branch:` and on the root's
-# `tracking_branch:` only when its row has no `branch:` of its own; a caller
-# falls back to `tracking_branch_of` on an empty answer, which is that `or`.
-#
-# Read the way `legs_of` reads the same rows — `role:` before `path:`, the
-# assembly row and a row with no role skipped — except that `branch:` may sit
-# on either side of `path:` in its row, so the answer comes the moment the
-# row has shown both, and a row that does not open with `- role:` clears what
-# the row before it left. A leg is found by its path SPELLED EITHER WAY: the
-# caller may hold `.gitmodules`' `spec` (`status`) or the manifest's own text
-# (`resume`), and `./spec` and `spec/` are one leg, so a leading `./` and a
-# trailing `/` come off both sides before they are compared.
-#
-# WHAT IS NO BRANCH: an empty value, `null`, `Null`, `NULL` or `~`, once a
-# trailing ` # comment` is cut off the value (a branch name holds no space, so
-# ` #` cannot be inside one). The loader is not matched to the letter: it keeps
-# a QUOTED `"null"` and `'~'` as branches and reads `false` and `0` as no
-# branch, while this does the opposite for both. No real branch is named any
-# of those, so nothing here chases the difference. (Since #243 `trim_unquote`
-# cuts that comment as well; the cut here runs first and is kept.)
-#
-# WHO ASKS IT: `resume`'s leg guard (`root_legs_ok`), `status`'s
-# `estate_repos` and `read_leg`, and `park`'s not-carried report
-# (`report_repos`, #242, PR #249) - each to know the branch a leg belongs on.
-#
-# shellcheck disable=SC2329  # a `park` from before #249 never calls it;
-# the disable can go once #249 has landed.
-leg_branch_of() {
-    local root="$1" want="$2" line role="" path="" branch=""
-    [ -n "$want" ] || return 0
-    [ -f "$root/project.yaml" ] || return 0
-    want="${want#./}"
-    want="${want%/}"
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            branch=""
-            ;;
-        '  - '*) role=""; path=""; branch="" ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            path="${path#./}"
-            path="${path%/}"
-            [ -n "$role" ] || path=""
-            [ "$role" != "assembly" ] || path=""
-            ;;
-        '    branch:'*)
-            branch="${line#*:}"
-            branch="$(trim_unquote "${branch%%[[:space:]]#*}")"
-            case "$branch" in null | Null | NULL | '~') branch="" ;; esac
-            ;;
-        [![:space:]]*) role=""; path=""; branch="" ;;
-        esac
-        if [ -n "$path" ] && [ "$path" = "$want" ] && [ -n "$branch" ]; then
-            printf '%s\n' "$branch"
-            return 0
-        fi
-    done <"$root/project.yaml"
-}
-# --- END shared estate resolver ---------------------------------------------
-
-# The legs AS MOUNTED, out of `.gitmodules` — the same file `make bootstrap`
-# mounts them from. Not the shared `legs_of`, which reads what `project.yaml`
-# DECLARES: the report is about what is on disk and might hold an unpushed
-# commit, so a leg mounted somewhere unusual, or one whose manifest row was
-# hand-edited away, still has to be asked. `git config --get-regexp` prints
-# `key value`, so the value is everything after the first space.
-# `-z`, so the key and the value cannot be confused: a submodule NAME may
-# carry a space (`[submodule "sp ace"]`), and splitting the plain output at
-# its first space would hand back `ace.path spec` and miss the leg; with `-z`
-# each entry is `key<LF>value<NUL>`, and a key with no value has no LF at all
-# and is not a path.
-submodule_paths() {
-    local root="$1" record path
-    [ -f "$root/.gitmodules" ] || return 0
-    while IFS= read -r -d '' record; do
-        case "$record" in
-        *$'\n'*) path="${record#*$'\n'}" ;;
-        *) continue ;;
-        esac
-        [ -n "$path" ] || continue
-        [ -e "$root/$path/.git" ] || continue
-        printf '%s\n' "$path"
-    done < <(git -C "$root" config --file .gitmodules -z \
-        --get-regexp '^submodule\..*\.path$' 2>/dev/null || true)
-}
-
-# --- what did not park ------------------------------------------------------
-
-# `label<TAB>path` per repository the report reads.
-#
-# `members/<Project>` INSIDE A FAMILY HOLDER IS DELIBERATELY NOT HERE. That
-# copy is pinned and DETACHED, for `bootstrap` and `validate`; nobody's
-# in-flight work is in it, and it carries no local `main` to be ahead of. The
-# working clone BESIDE the holder is where a person works, so it is what is
-# read - the same reason the holder's own `park` target dispatches there (#80).
-report_repos() {
-    local leg member branch legbranch
-    if [ "$ESTATE_KIND" = "family" ]; then
-        printf 'holder\t%s\t%s\n' "$(tracking_branch_of "$ESTATE_ROOT")" \
-            "$ESTATE_ROOT"
-        while IFS= read -r member; do
-            [ -e "$ESTATE_DIR/$member/.git" ] || continue
-            branch="$(tracking_branch_of "$ESTATE_DIR/$member")"
-            printf 'root\t%s\t%s\n' "$branch" "$ESTATE_DIR/$member"
-            while IFS= read -r leg; do
-                # A LEG'S branch is the `branch:` its own row declares, else
-                # the ROOT's `tracking_branch:` — what `scripts/bootstrap.py`
-                # places it on (#235, #238; #242 here). Its unpushed commits
-                # are on THAT branch, so that is the one the report counts.
-                # `|| true`: a `project.yaml` that cannot be read fails
-                # `leg_branch_of`, and under `set -e` that would end this
-                # subshell and drop this leg's row and every row after it,
-                # silently; the root's branch is the answer then.
-                legbranch="$(leg_branch_of "$ESTATE_DIR/$member" "$leg" || true)"
-                printf 'leg\t%s\t%s\n' "${legbranch:-$branch}" "$ESTATE_DIR/$member/$leg"
-            done < <(submodule_paths "$ESTATE_DIR/$member")
-        done < <(family_members "$ESTATE_ROOT/family.yaml")
-        return 0
-    fi
-    branch="$(tracking_branch_of "$ESTATE_ROOT")"
-    printf 'root\t%s\t%s\n' "$branch" "$ESTATE_ROOT"
-    while IFS= read -r leg; do
-        # The leg's own `branch:`, else the root's, and `|| true` for the
-        # reason the family loop gives.
-        legbranch="$(leg_branch_of "$ESTATE_ROOT" "$leg" || true)"
-        printf 'leg\t%s\t%s\n' "${legbranch:-$branch}" "$ESTATE_ROOT/$leg"
-    done < <(submodule_paths "$ESTATE_ROOT")
-}
-
-# Commits on the TRACKING BRANCH that origin has never seen. The branch is
-# the root's own `tracking_branch:` — or, for a leg, the `branch:` its own row
-# declares (`report_repos`, #242) — and not a hard-coded `main`: a project
-# that ships from `trunk` would otherwise have been asked a question about a
-# branch it does not have and answered "nothing", which is worse than not
-# asking. BOTH refs must exist locally or there is no question to ask — a
-# detached pinned checkout has no local branch, and a clone with no remote has
-# no remote-tracking one. It is read against the remote-tracking ref this
-# machine already has: park fetches nothing, so the count is as of the last
-# fetch and the report says so.
-unpushed_on_tracking() {
-    local repo="$1" branch="$2"
-    [ -n "$branch" ] || return 1
-    git -C "$repo" rev-parse --verify -q "refs/heads/$branch" >/dev/null 2>&1 || return 1
-    git -C "$repo" rev-parse --verify -q "refs/remotes/origin/$branch" >/dev/null 2>&1 || return 1
-    git -C "$repo" rev-list --count "origin/$branch..$branch" 2>/dev/null || return 1
-}
-
-# A dirty ROOT, which is where a pin bump happens. It also answers for a dirty
-# LEG: `git status --porcelain` at a root with submodules reports a leg whose
-# checkout has changes as ` M <leg>`, so one question covers both.
-dirty_count() {
-    local repo="$1" out
-    out="$(git -C "$repo" status --porcelain 2>/dev/null || true)"
-    [ -n "$out" ] || return 1
-    printf '%s\n' "$out" | wc -l | tr -d ' '
-}
-
-LEFT=0
-
-not_parked_report() {
-    local label branch path count
-    say ""
-    say "what park does NOT carry, and why none of it is park's to touch:"
-    while IFS=$'\t' read -r label branch path; do
-        [ -n "${path:-}" ] || continue
-        count="$(unpushed_on_tracking "$path" "$branch" || true)"
-        if [ -n "$count" ] && [ "$count" != "0" ]; then
-            LEFT=$((LEFT + 1))
-            printf '  unpushed %-6s %-7s %s\n' "$branch" "$label" "$path"
-            printf '                 %s commit(s) on %s that origin has not seen (as of the last fetch).\n' "$count" "$branch"
-            if [ "$label" = "leg" ]; then
-                printf '                 A leg goes up as a pull request too; park carries FEATURE branches only.\n'
-            else
-                printf '                 The root is PR-only - land them as a pull request; park never pushes %s.\n' "$branch"
-            fi
-        fi
-        case "$label" in
-        holder | root)
-            count="$(dirty_count "$path" || true)"
-            if [ -n "$count" ]; then
-                LEFT=$((LEFT + 1))
-                printf '  uncommitted    %-7s %s\n' "$label" "$path"
-                printf '                 %s path(s) changed at the root. A pin bump in progress is not\n' "$count"
-                printf "                 park's to commit: the root carries no feature branch at all.\n"
-            fi
-            ;;
-        esac
-    done < <(report_repos)
-    printf '  ignored files  never travel. .env, credentials and every other\n'
-    printf '                 gitignored file come back from your secrets manager, not from git.\n'
-    if [ "$LEFT" -eq 0 ]; then
-        say "  nothing else was left behind: no unpushed tracking-branch commit, no dirty root."
-    fi
-}
-
-require_make() {
-    command -v make >/dev/null 2>&1 ||
-        die "no \`make\` on PATH, so the estate's own \`make park\` cannot be run.
-    Install it (\`xcode-select --install\` on macOS, \`sudo apt-get install -y
-    make\` on Debian and Ubuntu), then re-run \`$SELF_NAME\`."
-}
-
-# --- run one estate's own `make park` ---------------------------------------
-#
-# FACTORED OUT so park-everything (#91, below) calls exactly what `park
-# <Name>` calls: one `make park`, one not-carried report, one outcome line.
-# ESTATE_KIND / ESTATE_DIR / ESTATE_ROOT / ESTATE_NAME must already be set —
-# by `estate_walk_up`, `estate_by_name`, `clone_with_origin`, or, for
-# park-everything, a direct `estate_here` on a discovered child. RETURNS a
-# status rather than exiting, so a park-everything run can carry on to the
-# next estate instead of dying on the first refusal or non-zero `make`; the
-# single-estate call site below turns that same return straight into its own
-# exit code, so nothing here behaves differently for either caller.
-run_one_estate() {
-    LEFT=0
-    if [ ! -f "$ESTATE_ROOT/Makefile" ]; then
-        refuse "$ESTATE_ROOT has no Makefile, so it has no \`park\` target to run.
-    A scaffolded root and a family holder both ship one; a root that has lost
-    it is re-synced with \`update-shape.py\`."
-        return 2
-    fi
-
-    # ONE `ARGS=` STRING, because that is the whole interface the two
-    # Makefiles offer (#80): the recipe word-splits `$(ARGS)`, so an argument
-    # carrying a space cannot survive the trip and this command does not
-    # pretend otherwise.
-    MAKE_ARGS=""
-    [ "$DRY_RUN" -eq 0 ] || MAKE_ARGS="--dry-run"
-    if [ -n "$LANE" ]; then
-        MAKE_ARGS="${MAKE_ARGS:+$MAKE_ARGS }--lane $LANE"
-    fi
-    if [ ${#PASSTHROUGH[@]} -gt 0 ]; then
-        MAKE_ARGS="${MAKE_ARGS:+$MAKE_ARGS }${PASSTHROUGH[*]}"
-    fi
-
-    if [ "$ESTATE_KIND" = "family" ]; then
-        say "park: $ESTATE_NAME - the family holder at $ESTATE_ROOT"
-        say "  the members' working clones beside it are where the verb runs."
-    else
-        say "park: $ESTATE_NAME - the assembly root at $ESTATE_ROOT"
-    fi
-    # shellcheck disable=SC2016  # the single quotes are LITERAL: this line is
-    # the `make` invocation a person can copy, and `ARGS='...'` is how they
-    # must type it.
-    say "  make park${MAKE_ARGS:+ ARGS='$MAKE_ARGS'}"
-    say ""
-
-    # THE EXIT CODE IS MAKE'S, UNCHANGED. `park.sh`'s own 0/1/2/3 do not
-    # survive make - GNU make reports ANY non-zero recipe status as its own
-    # exit 2 and prints `Error <code>` - and this command neither rewrites
-    # nor rescues that: the code is in make's diagnostic, and a run that
-    # refused must never read as success. #80's Makefile says the same thing
-    # at the target.
-    # AN ARRAY, so `ARGS=--feature 001-a --dry-run` reaches make as ONE
-    # assignment. `${var:+"..."}` unquoted is one word in bash today and a
-    # thing a reader has to squint at; an array is neither.
-    local -a park_call=(make park)
-    [ -z "$MAKE_ARGS" ] || park_call+=("ARGS=$MAKE_ARGS")
-    local one_status
-    set +e
-    (cd "$ESTATE_ROOT" && exec "${park_call[@]}")
-    one_status=$?
-    set -e
-
-    not_parked_report
-
-    say ""
-    say "park: $ESTATE_NAME - \`make park\` exited $one_status; $LEFT thing(s) above are not park's to carry."
-    if [ "$DRY_RUN" -eq 1 ]; then
-        say "  --dry-run: nothing was committed, pushed or recorded."
-    fi
-    return "$one_status"
-}
-
-# --- park-everything (#91): asked for with --all, or asked about; and what it
-# --- SKIPS (#92) -------------------------------------------------------------
-#
-# THE SWEEP is #91's - Brett Heap's RULING of 2026-09-10, verbatim: "for the
-# park-all, lets make that be park with no estate option. so just park will
-# do park-all." HOW IT IS REACHED changed the same day, under his later
-# RULING in this repository, verbatim: "lets change that so it parks the
-# current repo. if not in a repo, then asks if want to park all. and park all
-# should be park -a or park --all." So: `park --all` / `park -a` runs the
-# sweep from anywhere, unasked. Bare `park` with no <Name> and no estate
-# around the cwd LISTS the estates and ASKS (`ask_before_parking_every_estate`,
-# below); a YES runs the same sweep, anything else parks nothing, and with no
-# terminal on stdin nothing is asked - the bare form refuses and names
-# `--all`, because a sweep a script did not spell out is a sweep nobody
-# chose. `park <Name>`, `park --repo` and the walk-up above (NEAREST STILL
-# WINS - standing inside an estate parks THAT estate, never the workstation)
-# are exactly as they were under #82. `resume` has no sweep and no `--all`:
-# its bare form keeps ruling 3 of #82's refusal - see the note in its header
-# - because rebuilding every estate on a fresh machine by accident is the
-# opposite risk from failing to park the one you meant.
-#
-# Brett Heap's SECOND RULING of that day, on openRepoShape #92, verbatim:
-# "rule on the #92 open item: skip roots without the overlay." The sweep on
-# a real workstation found four roots with no Speckit git overlay, whose own
-# `make park` refuses with exit 2 - so a bare `park` there could only ever
-# exit 1, and the one summary line that matters was four false failures deep.
-# A root nobody installed the overlay in is not a park that FAILED; it is a
-# park there was never anything to run. So THE SWEEP skips it, names it, and
-# counts it apart. ONLY THE SWEEP: `park <Name>` and `park --repo` named a
-# root, and a person who named one gets its refusal, which names the
-# installer.
-
-# Every estate under the projects directory, `<name><TAB><dir>` per row, in
-# NAME order rather than discovery order: `~/projects` and `~/Projects` can
-# each hold estates when both exist, and reading them in discovery order
-# would print every estate under one spelling before any estate under the
-# other, instead of together, alphabetically. THE SAME RULES `list_estates`
-# USES - a family folder or a standalone project root, one level under a
-# projects directory - which is what already leaves out a pinned
-# `members/<X>` copy (three levels down) and a linked feature worktree
-# (rejected by `is_project_root` itself).
-all_estate_dirs() {
-    local dir child
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            if is_family_folder "$child" || is_project_root "$child"; then
-                printf '%s\t%s\n' "${child##*/}" "$child"
-            fi
-        done
-    done | LC_ALL=C sort -t $'\t' -k1,1
-}
-
-# Does this root carry the Speckit git overlay its own `make park` requires?
-# THE SAME TEST THE MAKEFILE MAKES, spelled the same way: `templates/
-# assembly-root/Makefile` opens the target with `test -x $(PARK) || { echo
-# 'make park $(OVERLAY_MISSING)' >&2; exit 2; }`, where `$(PARK)` is
-# `.specify/extensions/git/scripts/bash/park.sh`. Asking the question the
-# target's own way is what keeps the sweep's answer and the target's answer
-# from ever disagreeing - a probe that tested for the DIRECTORY, say, would
-# skip a root the target would have run, or run one it would refuse.
-#
-# ONLY A STANDALONE ROOT IS ASKED. A family holder's Makefile makes no such
-# test: it fans out with `scripts/siblings.py --make park`, and each member's
-# own root refuses for itself and is REPORTED BY THE HOLDER. Pre-checking a
-# holder here would skip a whole family for want of a file its own Makefile
-# never reads, and pre-checking its members would answer, worse and earlier,
-# a question the holder already answers per member.
-has_speckit_overlay() {
-    [ -x "$1/.specify/extensions/git/scripts/bash/park.sh" ]
-}
-
-# Run `run_one_estate` for every estate in `$1` (`all_estate_dirs`'s rows),
-# in name order, CONTINUING PAST A REFUSAL OR A NON-ZERO `make park`: one
-# estate's trouble is not a reason to leave the others unparked. A SKIP IS
-# NOT A PASS (#80's rule), so an estate whose own report is not clean - a
-# non-zero `make park`, or a zero one that still left something behind -
-# counts against the overall exit code exactly as a refusal does.
-#
-# THE CALLER HAS ALREADY LISTED THE ROWS - `--all` under its own heading, the
-# bare form above its question - so nothing prints here before the first
-# `=== park <Name> ===`, and the rows are passed in rather than discovered
-# again: what was listed is exactly what runs.
-#
-# A ROOT WITHOUT THE OVERLAY IS THE ONE THING THAT COUNTS NEITHER WAY (#92's
-# ruling, above): nothing ran in it, so there is no report to be clean or
-# unclean, and the exit code is computed over the estates that DID run. That
-# is not #80's rule bent - #80 is about a verb that was asked and did not
-# answer; this is a verb that was never askable.
-park_every_estate() {
-    local rows="$1" name dir estate_status total=0 bad=0 skipped=0 skipped_clause=""
-    local -a summary=()
-
-    while IFS=$'\t' read -r name dir; do
-        [ -n "$name" ] || continue
-        estate_here "$dir" || continue
-        say "=== park $ESTATE_NAME ==="
-        # ONE LINE, AND NOTHING RUNS HERE (#92's ruling). The block still
-        # gets its `=== park <Name> ===` heading, because a root left out of
-        # the run silently is a root a person has to go and look for.
-        #
-        # `= standalone` AND NOT `!= family`, though `estate_here` sets only
-        # those two today: the kinds are matched POSITIVELY so that a kind
-        # nobody has invented yet is RUN and answered by its own Makefile,
-        # rather than silently skipped by a test written before it existed.
-        # Skipping is the answer for the one shape whose Makefile we have
-        # read (Copilot's review of #7).
-        if [ "$ESTATE_KIND" = "standalone" ] && ! has_speckit_overlay "$ESTATE_ROOT"; then
-            if [ "$DRY_RUN" -eq 1 ]; then
-                say "  would skip (no Speckit overlay; install it with: setup-openspeckit)"
-            else
-                say "  SKIPPED (no Speckit overlay; install it with: setup-openspeckit)"
-            fi
-            summary+=("  skipped    $ESTATE_NAME (no Speckit overlay)")
-            skipped=$((skipped + 1))
-            say ""
-            continue
-        fi
-        total=$((total + 1))
-        estate_status=0
-        run_one_estate || estate_status=$?
-        if [ "$estate_status" -ne 0 ]; then
-            summary+=("  refused    $ESTATE_NAME (exit $estate_status)")
-            bad=$((bad + 1))
-        elif [ "$LEFT" -ne 0 ]; then
-            summary+=("  findings   $ESTATE_NAME ($LEFT thing(s) not carried)")
-            bad=$((bad + 1))
-        else
-            summary+=("  parked     $ESTATE_NAME")
-        fi
-        say ""
-    done <<<"$rows"
-
-    say "park: summary"
-    local line
-    for line in "${summary[@]}"; do
-        say "$line"
-    done
-    # THE #91 LINE, UNCHANGED, when nothing was skipped - which is every
-    # workstation whose roots all carry the overlay. The clause appears only
-    # when there is something to say, and it says what was NOT run rather
-    # than padding the line with a zero.
-    [ "$skipped" -eq 0 ] || skipped_clause=", $skipped skipped (no overlay)"
-    say "park: $((total - bad)) estate(s) parked, $bad refused or with findings$skipped_clause"
-    if [ "$total" -eq 0 ] && [ "$skipped" -ne 0 ]; then
-        say "park: nothing here was park-able: every estate found is without the"
-        say "      Speckit git overlay, so nothing ran and nothing failed. Install"
-        say "      it where you want park to work: setup-openspeckit"
-    fi
-    [ "$bad" -eq 0 ]
-}
-
-# The bare form, standing outside every estate: LIST, then ASK. Brett Heap's
-# RULING of 2026-09-10 in this repository (quoted at the section head): "if
-# not in a repo, then asks if want to park all." ONLY A TERMINAL CAN ANSWER,
-# so with anything else on stdin - a pipe, /dev/null, a cron job, an
-# assistant's tool call - nothing is asked and nothing is parked: the refusal
-# names `--all`, which is how a script says it meant the sweep. Anything but
-# y/yes is a no, in either case: parking every estate on a workstation is an
-# answer a person has to give, not one they get by pressing Enter. Sets
-# PARK_ALL and ALL_ROWS on a yes; every other way out is a `die`.
-ask_before_parking_every_estate() {
-    local answer
-    ALL_ROWS="$(all_estate_dirs)"
-    [ -n "$ALL_ROWS" ] ||
-        die "no estate around $PWD, no <Name> was given, and there is no estate under
-    ${PROJECTS_DIRS[*]} at all, so there is nothing to park. An estate is a
-    FAMILY folder (<Name>/<Name>/family.yaml) or a standalone project root
-    (<Name>/project.yaml), one level under your projects directory;
-    \`resume <Name>\` brings one back."
-    [ -t 0 ] ||
-        die "no estate around $PWD, and no <Name> was given. Outside every estate
-    \`$SELF_NAME\` ASKS before parking them all, and stdin is not a terminal
-    here, so nobody could answer: nothing was parked. \`$SELF_NAME --all\`
-    parks every estate below without asking; \`$SELF_NAME <Name>\` parks one:
-
-$(estates_or_none)"
-    require_make
-    say "park: no estate around $PWD, and no <Name> was given. Every estate under ${PROJECTS_DIRS[*]}:"
-    say ""
-    say "$(estates_or_none)"
-    say ""
-    # THE QUESTION GOES TO STDERR, where a prompt belongs: with stdout sent to
-    # a file the question still reaches the terminal rather than the file,
-    # and a run hung on a question nobody can see is the one shape this must
-    # never take. `read` fails on end-of-file (Ctrl-D), which is a no.
-    printf 'park every estate above? [y/N] ' >&2
-    IFS= read -r answer || answer=""
-    case "$answer" in
-    [Yy] | [Yy][Ee][Ss]) PARK_ALL=1 ;;
-    *)
-        die "nothing was parked: the answer was not yes. \`$SELF_NAME <Name>\` parks one of
-    the estates above, \`$SELF_NAME --all\` parks every one of them without
-    asking, and \`$SELF_NAME\` from inside an estate parks that one."
-        ;;
-    esac
-}
-
-# --- arguments -------------------------------------------------------------
-
-# THE VALUE OF A VALUE-TAKING FLAG, in either spelling, read in ONE place so
-# that the ways of not giving one are ONE refusal. `flag_value "$@"` from an
-# arm sets `FLAG_VALUE` and `FLAG_SHIFT` — the arguments that arm then
-# consumes, 2 for `--flag value` and 1 for `--flag=value` — or it returns 1
-# with `FLAG_HINT` carrying whatever that refusal has to add. THE WORDS STAY
-# AT THE ARM: each flag says what its own value is, and this says only whether
-# one was given.
-# A VALUE BEGINNING WITH `-` IS NOT ONE in the spaced spelling — the hole #17
-# named and left open. `park Atlas --lane --dry-run` ran a REAL park with the
-# lane set to `--dry-run`: the flag a person typed was swallowed as a value,
-# `--dry-run` itself never took effect, and the only sign was a WIP commit
-# subject labelled with it. Nothing here swallows the next word whatever it
-# is, so that is a refusal.
-# `--flag=value` IS THE OTHER HALF, and the escape that refusing `-*` would
-# otherwise foreclose: a value that really does begin with `-` is spelled
-# `--lane=--weird`, which takes whatever follows the FIRST `=` and asks
-# nothing about it. An `=` with nothing after it is an empty value and is
-# refused as #17 refuses one.
-# BYTE-IDENTICAL IN `park`, `resume` AND `status`, held by
-# `tests/test_repo_hygiene.py` the way the estate resolver and `expand_home`
-# are: three files a person has on PATH, and one answer to what a flag's value
-# is.
-flag_value() {
-    FLAG_VALUE=""
-    FLAG_SHIFT=2
-    FLAG_HINT=""
-    case "$1" in
-    *=*)
-        FLAG_SHIFT=1
-        FLAG_VALUE="${1#*=}"
-        [ -n "$FLAG_VALUE" ] || return 1
-        return 0 ;;
-    esac
-    [ $# -ge 2 ] && [ -n "$2" ] || return 1
-    # THE NEXT ARGUMENT, ONLY IF IT CANNOT BE A FLAG. The hint names the `=`
-    # spelling because that is the whole exit: this refuses nothing a person
-    # cannot then say.
-    case "$2" in
-    -*)
-        FLAG_HINT="
-    \`$2\` begins with a \`-\`, so it is a flag and not this one's value:
-    nothing here swallows the next word whatever it is. A value that really
-    does begin with \`-\` is given after an \`=\`:
-
-      $1=$2"
-        return 1 ;;
-    esac
-    FLAG_VALUE="$2"
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-    -h | --help) usage; exit 0 ;;
-    --dry-run) DRY_RUN=1; shift ;;
-    # THE SWEEP, ASKED FOR: every estate under the projects directory, from
-    # anywhere, with no question (the RULING of 2026-09-10 at the sweep's
-    # section head: "park all should be park -a or park --all").
-    -a | --all) PARK_ALL=1; shift ;;
-    # A MISSING, EMPTY OR FLAG-SHAPED VALUE IS THIS COMMAND'S REFUSAL, exit 2,
-    # in its own words: `${2:?…}` would be bash's message and bash's exit 1,
-    # which is not a status this command means anything by (`status` gave the
-    # reason first: its 1 is "findings"; here, a typo must not read like `make
-    # park`'s own exit).
-    # EMPTY IS REFUSED THE SAME WAY, and so is a flag where a value belongs:
-    # `flag_value` above asks all three questions once for every arm below,
-    # and each arm keeps its own words. `${2:?…}` rejected
-    # unset AND null; `[ $# -ge 2 ]` alone rejects only the first, and what it
-    # lets through is read later as "was this given at all?" — so
-    # `park --lane ""` would carry on with `LANE` empty, the lane is then left
-    # out of the `make park` invocation, and the WIP commit subject a person
-    # asked to be labelled comes back unlabelled. `park --repo ""` is the same
-    # silence with more behind it: an empty slug falls past the `--repo` branch
-    # of the resolver into the walk-up, which is the one thing naming a clone's
-    # origin was there to prevent. A value that came out empty is a flag that
-    # was typed and lost, never one that was never typed, and the two must not
-    # do different things (Copilot's review of #14).
-    --lane | --lane=*)
-        flag_value "$@" ||
-            die "--lane needs a value: the lane recorded in the WIP commit subject.$FLAG_HINT"
-        LANE="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    --repo | --repo=*)
-        flag_value "$@" ||
-            die "--repo needs a value: <owner>/<name>, or any url spelling of one.$FLAG_HINT"
-        REPO_SLUG="$FLAG_VALUE"; REPO_ARG="$REPO_SLUG"; shift "$FLAG_SHIFT" ;;
-    # `--project <Name>` and `--name <Name>` are the positional under a flag,
-    # because the issue's own words are "park --project <project> or park
-    # --repo <repo> and it defaults to project" (Brett Heap, 2026-09-09). The
-    # value is never mistaken for the positional this way, which is the same
-    # reason `openRepoShape` names its value-taking flags.
-    --name | --project | --name=* | --project=*)
-        flag_value "$@" ||
-            die "${1%%=*} needs a value: one estate folder name under your projects directory.$FLAG_HINT"
-        NAME="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    # EVERYTHING AFTER `--` IS THE EXTENSION'S, verbatim. `park.sh` has flags
-    # this command has no opinion about (--feature, --message, --no-push,
-    # --retire-parked-wip) and a command that ate them would be a command
-    # people have to stop using the moment the extension grows one.
-    --) shift; PASSTHROUGH+=("$@"); break ;;
-    -*)
-        usage >&2
-        die "$SELF_NAME does not know $1. Its own flags are listed above; the
-    extension's own flags travel after a \`--\`, so what you want is:
-
-      $SELF_NAME -- $1"
-        ;;
-    *)
-        [ -z "$NAME" ] ||
-            die "two estate names, '$NAME' and '$1'. One positional <Name>, then flags."
-        NAME="$1"; shift ;;
-    esac
-done
-
-[ -z "$NAME" ] || [ -z "$REPO_SLUG" ] ||
-    die "both <Name> ('$NAME') and --repo '$REPO_SLUG'. One estate per run: name it
-    either way, not both."
-if [ "$PARK_ALL" -eq 1 ]; then
-    [ -z "$NAME" ] ||
-        die "both <Name> ('$NAME') and --all. \`--all\` parks EVERY estate under your
-    projects directory; <Name> parks one. Drop one of them."
-    [ -z "$REPO_SLUG" ] ||
-        die "both --repo '$REPO_ARG' and --all. \`--all\` parks EVERY estate under your
-    projects directory; \`--repo\` parks the one that clone belongs to. Drop one
-    of them."
-fi
-
-# --- resolve ---------------------------------------------------------------
-if [ "$PARK_ALL" -eq 1 ]; then
-    # `--all`: nothing to resolve, and nothing to ask. The sweep discovers for
-    # itself, and it runs from ANYWHERE - standing inside an estate does not
-    # narrow a flag that says every one of them.
-    ALL_ROWS="$(all_estate_dirs)"
-    [ -n "$ALL_ROWS" ] ||
-        die "--all found no estate under ${PROJECTS_DIRS[*]}, so nothing was parked.
-    An estate is a FAMILY folder (<Name>/<Name>/family.yaml) or a standalone
-    project root (<Name>/project.yaml), one level under your projects
-    directory; \`resume <Name>\` brings one back."
-    require_make
-    say "park --all: parking every estate under ${PROJECTS_DIRS[*]}:"
-    say ""
-    say "$(estates_or_none)"
-    say ""
-elif [ -n "$REPO_SLUG" ]; then
-    # ANY SPELLING A PERSON MIGHT PASTE, through the same reader that reads a
-    # clone's `origin`: `TestOrg/Atlas`, `TestOrg/Atlas.git`, a trailing
-    # slash, or the whole https url they copied out of the browser. Both
-    # sides of the comparison then come from one parser, and the refusal
-    # below can print a clone line that is a url rather than a url wrapped
-    # around another one.
-    REPO_SLUG="$(repo_slug_of "$REPO_SLUG" || true)"
-    [ -n "$REPO_SLUG" ] || die "--repo '$REPO_ARG' is not a repository: it wants <owner>/<name>, or any
-    url spelling of one (https://…/<owner>/<name>.git, git@host:<owner>/<name>).
-    A family's members may live in another organisation, so there is no owner
-    to assume, and a path on disk has none to read."
-    MATCH="$(clone_with_origin "$REPO_SLUG" || true)"
-    [ -n "$MATCH" ] || die "no clone under your projects directory has origin $REPO_SLUG.
-    \`--repo\` names a clone you ALREADY HAVE; it never clones one (RULING
-    2026-09-09 ruling 1). Get it, or bring the whole estate back from its
-    record:
-
-      git clone --recurse-submodules https://github.com/$REPO_SLUG.git
-      resume <Name>          # rebuilds the estate from your workspace record
-
-estates found under your projects directory:
-$(estates_or_none)"
-    estate_walk_up "$MATCH" ||
-        die "$MATCH is a clone of $REPO_SLUG, but nothing at or above it is an
-    estate: no \`family.yaml\` holder beside it and no \`project.yaml\` root. It
-    is a clone, not a project of this shape - \`park\` has no verb to run in it."
-elif [ -n "$NAME" ]; then
-    # A FOLDER NAME, NEVER A PATH. `park ../x` or `park /abs` would otherwise
-    # be joined to the projects directory and land somewhere nobody named.
-    is_safe_folder_name "$NAME" ||
-        die "'$NAME' is not an estate name: it is a path, or it carries a
-    character an estate folder may not. <Name> is ONE folder name under your
-    projects directory — no slash, no leading dot. To act on a checkout
-    somewhere else, stand in it and run \`$SELF_NAME\` with no <Name>."
-    estate_by_name "$NAME" || die "no estate named '$NAME' under your projects directory.
-    An estate is a FAMILY folder ($NAME/$NAME/family.yaml) or a standalone
-    project root ($NAME/project.yaml). Bring it back with \`resume $NAME\`, or
-    park one of these:
-
-$(estates_or_none)"
-else
-    # THE WALK-UP WINS FIRST: standing inside an estate parks THAT estate,
-    # never the whole workstation — "it parks the current repo" (the RULING
-    # of 2026-09-10 quoted at the sweep's section head). With no estate
-    # around the cwd the estates are listed and the question is asked;
-    # `--all` is the way past the question, not a folder to stand in.
-    estate_walk_up "$PWD" || ask_before_parking_every_estate
-fi
-
-if [ "$PARK_ALL" -eq 1 ]; then
-    STATUS=0
-    park_every_estate "$ALL_ROWS" || STATUS=$?
-    exit "$STATUS"
-fi
-
-require_make
-
-STATUS=0
-run_one_estate || STATUS=$?
-exit "$STATUS"
diff --git a/project.yaml b/project.yaml
new file mode 100644
index 00000000..6e29b9e6
--- /dev/null
+++ b/project.yaml
@@ -0,0 +1,277 @@
+schema_version: 1
+kind: project-manifest
+
+# ===========================================================================
+# project.yaml — this project's SELF-DESCRIBING MANIFEST, and the SOURCE.
+#
+# Where an aggregation exists, its `project-register.yaml` row is DERIVED from
+# this file; this file is never derived from the register. That direction is
+# what lets an organisation with no aggregation, no register and no
+# openxFactory still be conformant — a file inside the project is readable by
+# anyone who cloned it, which is exactly the population that needs it.
+#
+# IT CONFERS NOTHING. `schema`, `legs[].role` and `topic` are descriptive
+# navigation. No field here grants review authority, clearance eligibility,
+# gate standing or lifecycle state over any repository it names. A project
+# that declines this schema is reviewed identically to this one, because the
+# authority travels in the grants rather than in the layout. A consumer
+# deriving a permission from `role:` is defective.
+#
+# THE TRIAD IS THE PREFERRED SHAPE, AND THAT CHANGES NONE OF THE ABOVE. This
+# file is how a Triad — an assembly root with a spec leg and a code leg, also
+# called a three-leg or three-repository project — is declared, and the Triad
+# is the recommended default for a new project and the recommended target for
+# an existing single repository: ruled by Brett Heap on 2026-10-06, "ratify
+# 1249 as recommended" (openxFactory `prefer-triad-project-shape`). Preferred
+# is not required. Electing it is still a human's act per project, it
+# confers nothing, and a project kept in one repository is reviewed
+# identically and owes no declaration.
+# ===========================================================================
+
+id: "openrepotools"
+name: "openRepoTools"
+
+# The elected schema, and the document the election followed. For a project
+# elected on or after 2026-09-02 this is openxFactory's ratified
+# `docs/project-repo-schema.md`; a project elected earlier recorded the staged
+# fragment's path and keeps it. The default the scaffold writes FOLLOWS
+# `elected_on` below, for that reason, and `--reference` overrides it.
+# Recording it is what makes a project started ahead of ratification legible
+# rather than undeclared.
+schema: project-repo-schema
+reference: "openxFactory docs/project-repo-schema.md"
+
+# Electing the shape is a human's act (a `PA` decision, `CA`-constrained and
+# `PM`-sequenced), so the manifest records whose act it was and when.
+elected_by: "Brett Heap"
+elected_on: "2026-10-04"
+
+# The GitHub topic every one of this project's repositories carries. Names
+# carry the human eye, topics carry the organisation's search, and the
+# register — where one exists — is the only one of the three that is reviewed.
+topic: xf-project-openrepotools
+
+# `private`, `public` or `internal` (an enterprise org-internal repository).
+# NOT ENFORCED HERE — GitHub is the source of truth for what a repository's
+# visibility actually is — but recording it is what lets a reader tell,
+# without three `gh repo view` calls, why the legs are internal. For a
+# scaffolded project this is all three repositories' visibility; for an
+# in-place adoption it is the value the two NEW legs were created with — the
+# assembly root IS the adopted source and keeps whatever visibility it
+# already had on GitHub, unchanged by this tool.
+visibility: "public"
+
+# The branch `scripts/bootstrap.py` places each leg on, AT its pinned commit.
+# The pin stays exact: `.gitmodules` carries no `branch=`, so there is exactly
+# one authoritative answer to "what commit is this project".
+tracking_branch: "main"
+
+# The openRepoShape revision this project was scaffolded from, pinned by
+# commit and digest under the same rule the family's neutral products use: a
+# tag can be moved and a commit cannot. `contracts/shape-pin.yaml` carries the
+# same commit plus a per-file sha256 for every file the scaffold COPIED out of
+# openRepoShape, which is how an edit to a copied validator is detected.
+shape:
+  repository: opensoft/openRepoShape
+  revision_kind: commit
+  commit: "190133d5e704e380c430f87ca9c4e31746de0012"
+  digest_algorithm: sha256
+  digest_definition: sorted-ls-tree-r-v1
+  digests:
+    tree_sha256: "7a66972c7de193c050f77f97bffa13d8543c28d74f61ea210644e65aa3f37912"
+
+# The neutral products this project declares a pin on, by name. OPTIONAL, and
+# empty in a fresh scaffold. It is what makes a `<Domainx><Product>` name a
+# domain DESCENDANT rather than merely a name shaped like one: ruled by Brett
+# Heap on 2026-09-02, "descendant only if it pins open<Product>". Add the name
+# here and the matching `contracts/<name lowercased>-pin.yaml` beside it, in
+# one commit, and the classification changes with the pin — never before it.
+# The check is OFFLINE: this list is a fact in this tree, so no lookup of any
+# organisation's repositories is involved.
+#
+# A project may pin a LAYER of the product rather than the product itself —
+# `codexDox` pins `openXdox`, which pins `openDox` — and then the referent is
+# reached through the chain the leg's `naming.referent_chain:` records, below.
+# The first entry of that chain is one of the names in THIS list, because it
+# is the pin this project actually holds.
+neutral_product_pins: []
+
+# The three legs. `assembly` is THIS repository — the one an engineer clones —
+# and its path is `.`; `spec` and `code` are submodules mounted at the paths
+# below. Roles are exactly {assembly, spec, code}, once each.
+#
+# Each leg carries an OPTIONAL `naming:` record: the form the name classified
+# as, the role it was declared in, and `also_matches` — every OTHER form the
+# name satisfies. `MedxScribe` is an ordinary assembly root that also matches
+# the descendant form; recording that is how the next reader sees an overlap
+# that was RESOLVED rather than one nobody noticed. It confers nothing, like
+# every other field here; `scripts/validate-manifest.py` checks it agrees with
+# the name, and refuses `referent_declared: true` with no pin file beside it.
+#
+# THE ASSEMBLY LEG NEED NOT BE A BARE CamelCase TOKEN. Two other forms may be
+# the root, and both RECORD the overlap here rather than losing it:
+#
+#   - a DECLARED domain descendant (Brett Heap, 2026-09-02) — `MedxGlass` pins
+#     `openGlass` AND mounts `MedxGlass-spec` and `MedxGlass-code`;
+#   - a NEUTRAL PRODUCT that has elected the shape (Brett Heap, 2026-09-05,
+#     "elect the shape for both, follow the pin chain, no family yet") —
+#     `openDox` mounts `openDox-spec` and `openDox-code` and records
+#
+#         naming:
+#           form: neutral-product
+#           role: assembly
+#           also_matches: [project-leg/assembly]
+#
+# In both cases the FORM won the classification and the declared role was
+# ADDED to it; electing confers nothing, so a neutral product that is its own
+# root is a fact about LAYOUT and not a claim about its neutrality. The legs
+# are unaffected either way: `openDox-spec` carries the lowercase suffix and
+# is an ordinary project leg, a descendant of nothing and a neutral product of
+# nothing. An `<X>-Install` is admitted into no role at all.
+#
+# A descendant that reaches its referent through a CHAIN records that chain
+# too (ruled by Brett Heap on 2026-09-05, "follow the pin chain"):
+#
+#     naming:
+#       form: domain-descendant
+#       role: assembly
+#       also_matches: [project-leg/assembly]
+#       descendant_referent: openDox        # what the NAME claims
+#       referent_declared: true
+#       referent_chain: [openXdox, openDox] # how it is REACHED
+#
+# The FIRST entry is what `neutral_product_pins:` above declares and what
+# `contracts/<it>-pin.yaml` holds; the LAST is the referent the name claims;
+# each link between them is a declaration in THAT link's own `project.yaml`
+# (`openXdox` declaring `neutral_product_pins: [openDox]`). The validator
+# verifies a link when that repository is checked out beside this one — or
+# named by `SHAPE_PIN_SOURCE_<PRODUCT>` — and otherwise reports it as
+# `declared-unverified`, which is a warning and not a finding: the check is
+# offline, and a recorded declaration is the fact it reads. A chain that does
+# NOT hold is a finding, and it names the link that broke.
+legs:
+  - role: assembly
+    repository: opensoft/openRepoTools
+    path: "."
+    naming:
+      form: neutral-product
+      role: assembly
+      also_matches: [project-leg/assembly]
+  - role: spec
+    repository: opensoft/openRepoTools-spec
+    path: "spec"
+    naming:
+      form: project-leg
+      role: spec
+      also_matches: []
+  - role: code
+    repository: opensoft/openRepoTools-code
+    path: "code"
+    naming:
+      form: project-leg
+      role: code
+      also_matches: []
+
+# THE SOURCE'S OWN SUBMODULES, and the leg each one was ANSWERED into
+# when this repository was adopted (#189). Written once, by
+# `adopt-project.py execute`, from the adoption plan: one row per
+# submodule the split kept in a leg, its path inside that leg, the
+# `resolution:` the plan gave the entry that covered it, and the source
+# commit the plan was answered at. `shape-doctor.py` checks each
+# submodule a leg holds against it. Like every field here, it confers
+# nothing.
+submodules:
+  - path: "upstream/openRepoShape"
+    leg: code
+    resolution: "Mounted openRepoShape is the implementation/test dependency; preserve its exact gitlink with the original .gitmodules and dependency pin."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+
+# THE PATHS THE ADOPTION'S POLICY ASKED ABOUT OR PUT IN ANOTHER LEG,
+# and the leg each was ANSWERED into (#525, #655). Written once, by
+# `adopt-project.py execute`, from the adoption plan: one row per entry
+# kept in a leg that covers a path `contracts/path-classification.yaml`
+# could not call, or called for the other leg or the root, its path
+# inside that leg (a directory's with its `/`: without it, a row names
+# a file), the `resolution:` the plan gave it, and the source commit the
+# plan was answered at. `shape-doctor.py` takes each row as the answer
+# for that path in that leg: not asked again, and not misplaced. A
+# directory's row answers for every file under it, one added after the
+# adoption too: the doctor does not hold a file to `source_commit:`.
+# Like every field here, it confers nothing.
+answered_paths:
+  - path: "claude-current"
+    leg: code
+    resolution: "Executable installer payload added by merged PR #134; keep resolver/checker with commands and their implementation tests in code."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "claude-restart-check"
+    leg: code
+    resolution: "Executable installer payload added by merged PR #134; keep resolver/checker with commands and their implementation tests in code."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "commands/"
+    leg: code
+    resolution: "These Markdown command files are shipped runtime installer payloads with implementation tests, not OpenSpec or Speckit decisions."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "contracts/"
+    leg: code
+    resolution: "At this baseline the only contract is openreposhape-pin.yaml, a dependency lock coupled to the code gitlink and installer; future product governance contracts belong in spec and assembly pins are generated at root."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane-end"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane-handoff"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane-rename"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane-start"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lane-worktrees"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lanes"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "lanes-index"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "link-estates"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "openRepoTools"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "park"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "repos.tsv"
+    leg: code
+    resolution: "Runtime alias data installed beside the lane commands."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "resume"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "skills/"
+    leg: code
+    resolution: "These three skills are installed product payloads; project workflow skills remain local root bootstrap artifacts."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
+  - path: "status"
+    leg: code
+    resolution: "Executable product command; keep with its sibling helpers and installation payload in the code repository."
+    source_commit: "33ce26dffc5286e68f1d29ab5c6458edef0330c0"
diff --git a/pyproject.toml b/pyproject.toml
deleted file mode 100644
index 092abbac..00000000
--- a/pyproject.toml
+++ /dev/null
@@ -1,100 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-#
-# THE openrepotools PACKAGE (#228): A SECOND WAY IN, NEVER A REQUIREMENT.
-# Cloning this repository and running `openRepoTools --install`, or the
-# one-line install, keeps working and needs nothing from this file. Brett
-# Heap asked for the package on 2026-10-17 ("we will publish on pypi").
-#
-# WHOLE, WHERE openRepoShape's IS THIN: the wheel holds `src/openrepotools/`
-# as `openrepotools/`, and under `openrepotools/payload/` every file the
-# installer's `payload_names` lists, byte for byte, with the openRepoShape
-# pin. So `openRepoTools --install` run from the package takes everything
-# from inside it and reaches no network.
-#
-# `src/`, AND NOT THE ROOT, because the root already holds `openRepoTools`,
-# the bash installer: a directory `openrepotools/` beside it is the same name
-# on a case-insensitive disk (macOS's and Windows' default), and a clone
-# there could not hold both. openRepoShape made the same choice for the same
-# reason.
-#
-# NO `readme`, because README.md goes to the assembly root at the triad
-# cutover (#186), while this file goes to the code leg: a `readme` here would
-# name a file the release's own tree does not hold. openRepoShape's declares
-# none either.
-
-[build-system]
-# PINNED, as every tool this repository's CI installs is: a build that
-# resolves the newest backend on the day it runs is a build whose bytes
-# depend on that day. 1.27.0 is the newest hatchling that still runs on
-# Python 3.9, the oldest Python this package supports (1.28.0 and later need
-# 3.10, by their own `Requires-Python`), and it is the pin openRepoShape
-# v1.1.0 was published with. Hatchling, because `force-include` below puts
-# the payload into the wheel declaratively, with no build hook. Any hash
-# lock that names hatchling names this same version.
-requires = ["hatchling==1.27.0"]
-build-backend = "hatchling.build"
-
-[project]
-name = "openrepotools"
-description = "The commands for the estates openRepoShape scaffolds, the lane tooling that records the work in them, and the installer that places all of it"
-# THE TAG IS THE ONE SOURCE OF THE VERSION: the release build writes it into
-# the stamp, `src/openrepotools/_release.py`, with the tag, the commit, the
-# digest and the repository, and `[tool.hatch.version]` below reads it from
-# there. The committed stamp says 0.0.0, unstamped.
-dynamic = ["version"]
-requires-python = ">=3.9"
-license = "Apache-2.0"
-license-files = ["LICENSE"]
-# NONE: the payload is bash, and the entry module uses the standard library
-# alone. What the payload runs (git, `jq` for `--install`, python3 for two
-# commands) it finds on PATH, as a checkout's does.
-dependencies = []
-# no `readme` key: README.md goes to the assembly root at the cutover (above)
-
-# THE ONE COMMAND, the name a checkout's `--install` places.
-# `openrepotools.cli:main` replaces its own process with the first `bash` on
-# PATH, running the packaged `openRepoTools` with the person's arguments
-# unchanged, and reads no stamp: bash is the one reader at run time, and
-# hatch reads `VERSION` at build time (`[tool.hatch.version]` below).
-[project.scripts]
-openRepoTools = "openrepotools.cli:main"
-
-[tool.hatch.version]
-path = "src/openrepotools/_release.py"
-
-[tool.hatch.build.targets.wheel]
-packages = ["src/openrepotools"]
-
-# THE WHOLE PAYLOAD, BYTE FOR BYTE: each payload path P at
-# `openrepotools/payload/P`. First the installer's `payload_names`, in its
-# own order (the seventeen INSTALLABLES, then the three skills, then the
-# three command files), and then the openRepoShape pin, which `wip init`
-# reads from beside the installer (`wip_shape_ref`). `payload_names` stays
-# the only list: a test compares it, plus the pin, with these keys and with
-# the built wheel, both ways round. A payload file joins both lists in one
-# commit.
-[tool.hatch.build.targets.wheel.force-include]
-"openRepoTools" = "openrepotools/payload/openRepoTools"
-"park" = "openrepotools/payload/park"
-"resume" = "openrepotools/payload/resume"
-"status" = "openrepotools/payload/status"
-"lane" = "openrepotools/payload/lane"
-"lanes" = "openrepotools/payload/lanes"
-"lane-handoff" = "openrepotools/payload/lane-handoff"
-"lane-rename" = "openrepotools/payload/lane-rename"
-"lanes-edit.sh" = "openrepotools/payload/lanes-edit.sh"
-"lane-start" = "openrepotools/payload/lane-start"
-"lane-end" = "openrepotools/payload/lane-end"
-"link-estates" = "openrepotools/payload/link-estates"
-"repos.tsv" = "openrepotools/payload/repos.tsv"
-"claude-current" = "openrepotools/payload/claude-current"
-"claude-restart-check" = "openrepotools/payload/claude-restart-check"
-"lanes-index" = "openrepotools/payload/lanes-index"
-"lane-worktrees" = "openrepotools/payload/lane-worktrees"
-"skills/handoff/SKILL.md" = "openrepotools/payload/skills/handoff/SKILL.md"
-"skills/lane-swap/SKILL.md" = "openrepotools/payload/skills/lane-swap/SKILL.md"
-"skills/restart/SKILL.md" = "openrepotools/payload/skills/restart/SKILL.md"
-"commands/handoff.md" = "openrepotools/payload/commands/handoff.md"
-"commands/ctx.md" = "openrepotools/payload/commands/ctx.md"
-"commands/swap.md" = "openrepotools/payload/commands/swap.md"
-"contracts/openreposhape-pin.yaml" = "openrepotools/payload/contracts/openreposhape-pin.yaml"
diff --git a/repos.tsv b/repos.tsv
deleted file mode 100644
index f088e78a..00000000
--- a/repos.tsv
+++ /dev/null
@@ -1,57 +0,0 @@
-# lanes/repos.tsv — repo alias table (lane-collision-protocol Amendment 7)
-#
-# alias<TAB>owner/repo. Consulted by lanes-edit.sh when an object key omits
-# the owner, and when the spelling a lane typed is not the canonical GitHub
-# nameWithOwner. Lookup is CASE-INSENSITIVE, so one row covers `OpsxFactory`,
-# `opsXfactory` and `opsxfactory` — all three of which the register uses.
-#
-# An alias that is NOT here is REFUSED, with the hint to spell owner/repo. That
-# is deliberate: guessing is how `opensoft/codexFactory` became a fifth
-# spelling of one repository. Spellings the register uses but that could not be
-# resolved to a repository are therefore LEFT OUT rather than guessed at —
-# `oxF`, `xF`, `OMI`, `OWI`, `CloudPC`, `LedgerxFactory`, `MedxEHR`,
-# `MedxFactory`, `MedxGlass`, and the bare `InkRouter` and `IRSS`, which are
-# ambiguous between the `opensoft` org and the separate `InkRouter` org.
-#
-# Seeded 2026-09-11 from the register's own LANDING lines
-#   grep -oE 'into [A-Za-z0-9/._-]+ main' lanes/LANES.md | sort -u
-# and from the estate-wide spelling survey, each resolved against GitHub with
-# `gh repo view <r> --json nameWithOwner`. All four codexFactory spellings map
-# to `codeXfactory/codexFactory`: the repository moved org while the register
-# was live, and that is the redirect GitHub itself answers with today.
-#
-# Add a row when a new repo first appears in a LANDING line. Keep it sorted.
-
-AdxFactory	opensoft/AdxFactory
-CloudPC-Install	opensoft/CloudPC-Install
-Hermes-Install	opensoft/Hermes-Install
-IRRS	InkRouter/IRRS
-IRRS-code	InkRouter/IRRS-code
-IRRS-spec	InkRouter/IRRS-spec
-IRSS-code	InkRouter/IRSS-code
-IRSS-spec	InkRouter/IRSS-spec
-InkRouter/IRRS	InkRouter/IRRS
-InkRouter/IRRS-code	InkRouter/IRRS-code
-InkRouter/IRRS-spec	InkRouter/IRRS-spec
-InkRouter/IRSS	InkRouter/IRSS
-InkRouter/IRSS-code	InkRouter/IRSS-code
-InkRouter/IRSS-spec	InkRouter/IRSS-spec
-InkRouter/InkRouter	InkRouter/InkRouter
-Keycloak-Install	opensoft/Keycloak-Install
-OmniWorker-Install	opensoft/OmniWorker-Install
-Omnigent-Install	opensoft/Omnigent-Install
-OpenSpec	brettheap/OpenSpec
-Opensoft-Tenant	opensoft/Opensoft-Tenant
-OpsxFactory	opensoft/OpsxFactory
-brett-wip	opensoft/brett-wip
-codeXfactory	codeXfactory/codexFactory
-codeXfactory/codexFactory	codeXfactory/codexFactory
-new-workstation	brettheap/new-workstation
-openRepoProject	opensoft/openRepoProject
-openRepoShape	opensoft/openRepoShape
-openRepoTools	opensoft/openRepoTools
-opensoft/codexFactory	codeXfactory/codexFactory
-openxFactory	opensoft/openxFactory
-workBenches	opensoft/workBenches
-xFactory	opensoft/xFactory
-xFactory-Hermes-Install	opensoft/xFactory-Hermes-Install
diff --git a/resume b/resume
deleted file mode 100755
index 045d608c..00000000
--- a/resume
+++ /dev/null
@@ -1,1758 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# resume — arrive at a workstation and get the estate back: `resume InkRouter`.
-#
-# Installed with the other three by `openRepoTools --install`.
-#
-# IT ADDS NO MECHANICS, exactly as the `openRepoShape` command adds none. It
-# REBUILDS OR REFRESHES the estate with the tools that already exist — `git
-# clone`, the root's own `make bootstrap`, the holder's own `make siblings` —
-# and then runs the estate's own `make resume`, which runs the SPECKIT GIT
-# EXTENSION's `resume.sh`: the one implementation of `git worktree add`, the
-# `.specify/feature.json` rewrite and the soft reset (#77, RULING 2026-09-09
-# ruling 1). Every worktree, branch and refusal is that script's.
-#
-# openRepoShape #82, under Brett Heap's RULING of 2026-09-09: this is the ONLY
-# command that clones, and it clones from the manifest (ruling 1); it
-# fast-forwards each sibling's tracking branch with `--ff-only` and REFUSES BY
-# NAME a sibling that is dirty or on a feature branch, never resetting one
-# (ruling 2); the command is `resume` (ruling 4).
-#
-# BARE `resume`, WITH NO <Name> AND NO ESTATE AROUND THE CWD, STILL REFUSES —
-# deliberately NOT changed by Brett Heap's RULING of 2026-09-10 (#91), which
-# supersedes ruling 3 of #82 for `park`'s own bare form only, nor by his later
-# RULING of the same day in openRepoTools, under which `park` ASKS there and
-# sweeps on a yes or a `--all`. `resume` has no `--all` and asks nothing:
-# rebuilding every estate this machine has a record of, by accident, from one
-# bare `resume` in the wrong folder, is the opposite risk from `park` failing
-# to park the one estate you meant — a clone or a fast-forward per estate is
-# real network and real disk, and undoing an accidental one is not as simple
-# as re-running the command. Both rulings name `park` only; this refusal
-# stands.
-# openRepoShape #82 wrote this, its #93 last changed it, its #92 moved it here.
-#
-# THE ONLY FILE THIS STANDARD EVER WRITES OUTSIDE A REPOSITORY is the two-line
-# user config, and only when `--workspace <owner/name>` asks for it by name on
-# a machine that has none. A person names their own private repository.
-
-set -euo pipefail
-
-SELF_NAME="resume"
-
-NAME=""
-REPO_SLUG=""
-REPO_ARG=""
-WORKSPACE_SLUG=""
-ORG_WANTED=""
-DRY_RUN=0
-PASSTHROUGH=()
-#: `flag_value`'s three answers, declared with the other globals so that a
-#: `die` reaching `$FLAG_HINT` before any arm has asked is an empty hint under
-#: `set -u`, never "unbound variable" at exit 1 — the one exit these arms must
-#: not produce (the independent review of this branch, 2026-09-11).
-FLAG_VALUE=""
-FLAG_SHIFT=2
-FLAG_HINT=""
-
-say() { printf '%s\n' "$*"; }
-die() { printf '\nREFUSED: %s\n' "$1" >&2; exit "${2:-2}"; }
-
-usage() {
-    cat <<'USAGE'
-resume [<Name>] [--repo <owner/name>] [--workspace <owner/name>] [--org <org>]
-       [--dry-run] [-- ARGS...]
-resume --help
-
-Bring one estate back on this workstation: clone or fast-forward it, bootstrap
-it, place the family's members beside the holder, and then recreate every
-feature `park` recorded.
-
-<Name> is the family or the project as your workspace record names it - the
-manifest file `workspaces/<org>/<Name>.yaml` in the private repository you own.
-With no <Name> the estate around the current directory is refreshed.
-
-  --repo <owner/name>   the estate of a clone you already have, by its
-                        origin - in any url spelling of that repository
-  --workspace <owner/name>
-                        the FIRST time on a fresh machine: clone that private
-                        repository and write ~/.agents/workspace.yaml. This is
-                        the only thing here that writes that file, and only
-                        when you ask for it by name
-  --project <Name>      the positional under a flag (also --name)
-  --org <org>           which org's manifest, when two of them record a <Name>
-  --dry-run             say what would happen; clone nothing, pull nothing
-  --flag=<value>        every flag that takes a value takes it after an `=`
-                        too (`--org=<org>`): the one way to give a value that
-                        begins with `-`, which the spaced spelling refuses
-  -- ARGS...            passed on to the extension through `make resume ARGS=`
-
-  $PROJECTS_DIR             your projects directory (default: ~/projects, then
-                            ~/Projects - people spell it both ways)
-  $AGENT_PROTOCOL_ROOT      where workspace.yaml lives (default: ~/.agents)
-  $OPENREPOTOOLS_REMOTE_BASE
-                            TEST PATH: clone from bare repositories in this
-                            directory (<name>.git) instead of from GitHub, so
-                            the whole flow runs offline
-
-WHAT RESUME NEVER DOES: it resets nothing and it moves nobody's HEAD. A clone
-that is dirty, or on a branch that is not its tracking branch, is REFUSED BY
-NAME and skipped - it is neither fast-forwarded, nor bootstrapped, nor given
-the verb - and so is a root one of whose LEGS is off the branch that root's own
-`make bootstrap` places it on (its row's `branch:`, else the root's
-`tracking_branch`), because bootstrap would move the leg. The rest of the
-estate still comes back.
-USAGE
-}
-
-# --- BEGIN shared estate resolver (park, resume, status: byte for byte) -----
-#
-# THIS BLOCK IS DUPLICATED IN THE OTHER COMMANDS, DELIBERATELY, and
-# `tests/test_park_resume_commands.py` asserts the three copies are IDENTICAL.
-# Each of these is one file a person has on PATH: a shared `orp-estate.sh`
-# would be a fifth file for `--install` to place and a broken command the
-# first time somebody copied only one of them. The rules themselves are NOT
-# new: `<dir>/<Name>/family.yaml` carrying `kind: family-manifest` and naming
-# `<Name>` is `setup-project.py`'s `family_folder_here`, doubled-name layout
-# and all (#76, RULING ruling 3). What "naming" accepts is widened by #236,
-# at `is_family_folder` below: the display `name:` or the repository's name.
-
-# `$PROJECTS_DIR` names ONE directory when it is set. Otherwise both
-# spellings, in that order, because people really do use both - and DEDUPED by
-# inode, because on a case-insensitive filesystem (a stock Mac) `~/projects`
-# and `~/Projects` are the same directory, and listing every estate twice
-# would read as two estates.
-PROJECTS_DIRS=()
-if [ -n "${PROJECTS_DIR:-}" ]; then
-    PROJECTS_DIRS=("$PROJECTS_DIR")
-else
-    PROJECTS_DIRS=("$HOME/projects")
-    if [ -d "$HOME/Projects" ]; then
-        if [ -d "$HOME/projects" ] && [ "$HOME/Projects" -ef "$HOME/projects" ]; then
-            : # one directory under two spellings; name it once
-        else
-            PROJECTS_DIRS+=("$HOME/Projects")
-        fi
-    fi
-fi
-
-# Where a NEW clone would go: the first spelling that already exists, else the
-# first named.
-#
-# shellcheck disable=SC2329  # `park` and `status` create nothing and never
-# call this. The block is byte-identical in all three commands BY DESIGN, so
-# each carries a couple of functions only another one asks.
-projects_dir_for_new() {
-    local dir
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        if [ -d "$dir" ]; then
-            printf '%s\n' "$dir"
-            return 0
-        fi
-    done
-    printf '%s\n' "${PROJECTS_DIRS[0]}"
-}
-
-# ONE SCALAR'S TEXT, read the way openRepoShape v1.1.0's `parse_yaml` reads
-# it (`scripts/repo_shape.py`: `_strip_comment`, `_quote_end`,
-# `_quoted_scalar`), so a file both of them read gets one answer (#243). A
-# value that OPENS WITH A QUOTE is the text up to the quote that closes it -
-# inside `"..."` a `\` takes the character after it along, and inside `'...'`
-# a doubled `''` is one quote, so neither closes it - and whatever follows
-# the close, a `# comment` included, is not the value: a ` #` inside the
-# quotes is text. Any other value is cut at the first `#` that opens it or
-# follows a space or tab, which is a comment, and trimmed; `a#b` is the text
-# `a#b`. The escapes are honoured to find the close and never unescaped, as
-# this reader never unescaped them: no branch, path, folder or repository
-# name it is asked for carries one. A quote nothing closes is not YAML at
-# all, and the text is kept whole, as before. What is NULL is not said here:
-# `null` and `"null"` are both the text `null`, and `yaml_scalar` says which
-# of the two it was.
-trim_unquote() {
-    local value="$1" quote="" ch="" i=1
-    value="${value%$'\r'}"
-    value="${value#"${value%%[![:space:]]*}"}"
-    case "$value" in
-    '"'* | "'"*)
-        quote="${value:0:1}"
-        while [ "$i" -lt "${#value}" ]; do
-            ch="${value:$i:1}"
-            if [ "$quote" = '"' ] && [ "$ch" = "\\" ]; then
-                i=$((i + 2))
-            elif [ "$ch" != "$quote" ]; then
-                i=$((i + 1))
-            elif [ "$quote" = "'" ] && [ "${value:$((i + 1)):1}" = "'" ]; then
-                i=$((i + 2))
-            else
-                printf '%s' "${value:1:$((i - 1))}"
-                return 0
-            fi
-        done
-        ;;
-    *)
-        value=" $value"
-        value="${value%%[[:space:]]#*}"
-        value="${value#"${value%%[![:space:]]*}"}"
-        ;;
-    esac
-    printf '%s' "${value%"${value##*[![:space:]]}"}"
-}
-
-# ONE FOLDER NAME, and never a path. A `<Name>` off the command line and a
-# `root:` out of somebody's workspace manifest both end up joined to the
-# projects directory, so both are held to this: no empty string, no `/`, and
-# no leading `.` — which is what stops `resume ../../elsewhere/X` from cloning
-# outside the projects directory at all, rather than noticing afterwards.
-is_safe_folder_name() {
-    local name="$1"
-    case "$name" in
-    "" | .* | */*) return 1 ;;
-    esac
-    case "$name" in
-    *[!A-Za-z0-9_.+@-]*) return 1 ;;
-    esac
-    return 0
-}
-
-# One indent-zero scalar out of a small YAML file, with parameter expansion
-# only: no YAML library, no python per line, no forks per line. The line is
-# found the way the Speckit extension's `workspace_read_scalar` finds one, at
-# indent zero by its key; the VALUE is `trim_unquote`'s, above, which is
-# openRepoShape v1.1.0's reading of it and differs from the extension's where
-# a `#` sits inside quotes or with no space in front of it, and on a line that
-# is not YAML at all (#243). The keys the three commands ask for are
-# `family.yaml`'s and `project.yaml`'s, a record's `family:`, the two of
-# `workspace.yaml`, and the shape pin's.
-# `YAML_QUOTED` is 1 when the value was QUOTED: YAML's null is an unquoted
-# `null` or `~`, and a quoted `"null"` is the text, which is a difference
-# `trim_unquote`'s answer alone cannot carry (`named_for_repository`).
-YAML_VALUE=""
-YAML_QUOTED=0
-yaml_scalar() {
-    local file="$1" key="$2" line value
-    YAML_VALUE=""
-    YAML_QUOTED=0
-    [ -f "$file" ] || return 1
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "$key":*) ;;
-        *) continue ;;
-        esac
-        value="${line#"$key":}"
-        case "${value#"${value%%[![:space:]]*}"}" in
-        '"'* | "'"*) YAML_QUOTED=1 ;;
-        esac
-        YAML_VALUE="$(trim_unquote "$value")"
-        return 0
-    done <"$file"
-    return 1
-}
-
-# A LINKED WORKTREE, not a checkout of its own: `.git` is a FILE holding a
-# `gitdir:` line, and `--git-dir` and `--git-common-dir` disagree. A
-# single-repository project's FEATURE worktree is a whole `project.yaml` root
-# by construction, so without this the walk-up would answer `<worktree_root>/
-# 001-my-feature` as an estate named after the branch — and `park` would run
-# the write verb inside the very worktree the extension is about to park.
-# GIT'S OWN ANSWER, and not the `.git`-is-a-file shortcut, because that shape
-# is shared with a SUBMODULE and a leg must not be mistaken for a worktree:
-# in a linked worktree `--git-dir` is `<common>/worktrees/<name>` and the two
-# differ; in a submodule both are `<super>/.git/modules/<name>`; in an
-# ordinary checkout both are `.git`. Verified against all three.
-is_linked_worktree() {
-    local dir="$1" gitdir common
-    [ -e "$dir/.git" ] || return 1
-    gitdir="$(git -C "$dir" rev-parse --git-dir 2>/dev/null || true)"
-    common="$(git -C "$dir" rev-parse --git-common-dir 2>/dev/null || true)"
-    [ -n "$gitdir" ] && [ -n "$common" ] && [ "$gitdir" != "$common" ]
-}
-
-# The PINNED copy inside a family holder: `<Family>/<Family>/members/<X>`, so
-# the grandparent carries the `family.yaml`. It is detached, it is what
-# `bootstrap` and `validate` read, and nobody's in-flight work is in it — a
-# walk-up that answered it would run a WRITE verb on a detached HEAD. The
-# working clone BESIDE the holder is the one a person works in, which is the
-# same rule #80's holder dispatch follows.
-is_pinned_member() {
-    local dir="$1" parent grandparent
-    parent="${dir%/*}"
-    [ -n "$parent" ] && [ "$parent" != "$dir" ] || return 1
-    grandparent="${parent%/*}"
-    [ -n "$grandparent" ] && [ "$grandparent" != "$parent" ] || return 1
-    yaml_scalar "$grandparent/family.yaml" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ]
-}
-
-# Is `<dir>` a FAMILY FOLDER? All three facts have to agree: the holder clone
-# sits at `<dir>/<basename>`, its `family.yaml` says `kind: family-manifest`,
-# and the folder is named for the family. A family has TWO names and either
-# one is the folder's (#236): its display `name:`, which is the rule this
-# block began with and what an estate laid out before openRepoShape v1.1.0
-# has, or the LAST PART of its `repository:`, which is v1.1.0's rule - the
-# holder, and the folder around it, are named for the REPOSITORY, `name:`
-# being only a title (opensoft/openRepoShape#629), and the holder's `make
-# siblings` stops before cloning when the folder is not that name
-# (opensoft/openRepoShape#543). A family whose two names differ has no layout
-# that works for both unless both are accepted. A directory called Northwind
-# is a directory called Northwind; what makes it a family folder is read,
-# never guessed from a name. The repository arm is `named_for_repository`,
-# below, which `status` and `resume` also ask when one family is on disk in
-# both layouts (#243).
-is_family_folder() {
-    local dir="$1" name manifest
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    manifest="$dir/$name/family.yaml"
-    yaml_scalar "$manifest" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ] || return 1
-    if yaml_scalar "$manifest" name && [ "$YAML_VALUE" = "$name" ]; then
-        return 0
-    fi
-    named_for_repository "$dir"
-}
-
-# Is `<dir>` named for its holder's REPOSITORY: the LAST PART of
-# `<dir>/<basename>/family.yaml`'s `repository:`, as v1.1.0's `repo_basename`
-# takes it (`rsplit("/", 1)[-1]`)? That is the folder v1.1.0 prescribes, and
-# where `make siblings` moves a holder that is not in it. AN UNQUOTED `null`
-# OR `~` IS NO REPOSITORY (#243) - nor `Null` or `NULL`, the spellings
-# v1.1.0's `_scalar` reads as null too - so a folder called `null` is not
-# named for one, and `is_family_folder` has only the display `name:` left to
-# go on, which is v1.1.0's own fallback. A QUOTED `"null"` is the text.
-named_for_repository() {
-    local dir="$1" name
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    yaml_scalar "$dir/$name/family.yaml" repository || return 1
-    if [ "$YAML_QUOTED" -eq 0 ]; then
-        case "$YAML_VALUE" in null | Null | NULL | '~') return 1 ;; esac
-    fi
-    [ "${YAML_VALUE##*/}" = "$name" ]
-}
-
-is_project_root() {
-    local dir="$1"
-    yaml_scalar "$dir/project.yaml" kind || return 1
-    [ "$YAML_VALUE" = "project-manifest" ] || return 1
-    is_pinned_member "$dir" && return 1
-    is_linked_worktree "$dir" && return 1
-    return 0
-}
-
-ESTATE_KIND=""
-ESTATE_DIR=""
-ESTATE_ROOT=""
-ESTATE_NAME=""
-
-# Is THIS directory an estate? A FAMILY FOLDER WINS over a standalone root of
-# the same name: the holder is what drives the members, so a family answered as
-# one of its own members would act on one project and report the estate done.
-estate_here() {
-    local dir="$1"
-    if is_family_folder "$dir"; then
-        ESTATE_KIND="family"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir/$ESTATE_NAME"
-        return 0
-    fi
-    if is_project_root "$dir"; then
-        ESTATE_KIND="standalone"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir"
-        return 0
-    fi
-    return 1
-}
-
-# The NEAREST estate at or above `<dir>`: the holder beside you, or the project
-# root you are standing in. NEAREST WINS, so standing inside a member of a
-# family acts on that member - the estate the person is standing in. A pinned
-# copy and a linked worktree are WALKED PAST rather than answered, so
-# `<Family>/<Family>/members/<X>` reaches the family folder and a feature
-# worktree reaches the root that owns it.
-estate_walk_up() {
-    local dir="$1"
-    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
-        estate_here "$dir" && return 0
-        dir="${dir%/*}"
-    done
-    return 1
-}
-
-estate_by_name() {
-    local want="$1" dir
-    is_safe_folder_name "$want" || return 1
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        estate_here "$dir/$want" && return 0
-    done
-    return 1
-}
-
-# Every estate under the projects directory, one row each. What ruling 3 asks
-# a refusal to print: a person who typed the command in the wrong folder needs
-# the names, not an instruction to go and look for them.
-list_estates() {
-    local dir child
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            if is_family_folder "$child"; then
-                printf '  family   %-20s %s\n' "${child##*/}" "$child"
-            elif is_project_root "$child"; then
-                printf '  project  %-20s %s\n' "${child##*/}" "$child"
-            fi
-        done
-    done
-}
-
-estates_or_none() {
-    local rows
-    rows="$(list_estates)"
-    if [ -n "$rows" ]; then
-        printf '%s\n' "$rows"
-    else
-        printf '  (none)\n'
-    fi
-}
-
-# Every FAMILY FOLDER under the projects directory whose holder's
-# `family.yaml` says `id: <id>`, one per line, in `list_estates`' order, and
-# nothing for an empty <id>. The id is what `park.sh` files a family's record
-# under (`workspace_family_name` reads it), and it is the SAME in every layout
-# of one family: v1.1.0's folder named for the repository and the
-# display-name folder before it are two directories, two estates and ONE
-# record (#243). So this is how `resume` finds a holder its record's folder
-# no longer names, and how `status` sees one family laid out twice.
-#
-# ONE FOLDER IS LISTED ONCE, however many spellings reach it. `PROJECTS_DIRS`
-# is deduped by inode, but the folders inside two distinct directories are
-# not: a `~/Projects/Quill` that is a LINK to `~/projects/Quill` is one
-# holder, and listing it twice made `resume` refuse "2 family folders" and
-# `status` report one family "laid out 2 times" (the review of #251, finding
-# 1). So a folder that is `-ef` one already listed is skipped, and the first
-# spelling, in `PROJECTS_DIRS`' order, is the one named.
-#
-# shellcheck disable=SC2329  # `park` never asks: it files the record, and
-# never looks a holder up by it. The block is byte-identical by design.
-family_folders_with_id() {
-    local want="$1" dir child prior dup
-    local -a found=()
-    [ -n "$want" ] || return 0
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            is_family_folder "$child" || continue
-            yaml_scalar "$child/${child##*/}/family.yaml" id || continue
-            [ "$YAML_VALUE" = "$want" ] || continue
-            dup=0
-            for prior in ${found[@]+"${found[@]}"}; do
-                if [ "$child" -ef "$prior" ]; then dup=1; fi
-            done
-            [ "$dup" -eq 0 ] || continue
-            found+=("$child")
-            printf '%s\n' "$child"
-        done
-    done
-}
-
-lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
-
-# `owner/name` — CASE PRESERVED, so a refusal prints back what a person can
-# type — out of any spelling git accepts: owner/name, owner/name.git,
-# https://host/owner/name(.git), git@host:owner/name.git,
-# ssh://git@host/owner/name.git, and a token-bearing https url. Callers
-# compare with `lower` on both sides, because GitHub owners and names are
-# case-insensitive.
-#
-# A FILESYSTEM PATH IS REFUSED rather than parsed, for the reason the
-# extension's own `workspace_org_from_url` refuses one: `/srv/remotes/Name.git`
-# has a name but no owner, and inventing `remotes` as the owner would let
-# `--repo remotes/Name` match a bare repository on disk. Such a clone answers
-# `<Name>` and the walk-up; it does not answer `--repo`.
-repo_slug_of() {
-    local url="$1" rest owner name
-    rest="$url"
-    case "$rest" in
-    /* | ./* | ../* | [A-Za-z]:[/\\]* | file://*) return 1 ;;
-    esac
-    rest="${rest%/}"
-    rest="${rest%.git}"
-    case "$rest" in
-    *://*)
-        rest="${rest#*://}"
-        rest="${rest#*@}"
-        rest="${rest#*/}"
-        ;;
-    *@*:*)
-        rest="${rest#*@}"
-        rest="${rest#*:}"
-        ;;
-    esac
-    case "$rest" in
-    */*) ;;
-    *) return 1 ;;
-    esac
-    name="${rest##*/}"
-    owner="${rest%/*}"
-    owner="${owner##*/}"
-    [ -n "$owner" ] && [ -n "$name" ] || return 1
-    case "$owner$name" in
-    *[!A-Za-z0-9_.-]*) return 1 ;;
-    esac
-    printf '%s/%s\n' "$owner" "$name"
-}
-
-# The clone under the projects directory whose `origin` IS that repository -
-# ruling 1. Two levels deep, because the estates this standard places are
-# `<projects>/<Project>` and `<projects>/<Family>/<Project>`.
-clone_with_origin() {
-    local want dir candidate origin found
-    want="$(lower "$1")"
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for candidate in "$dir"/*/ "$dir"/*/*/; do
-            candidate="${candidate%/}"
-            [ -e "$candidate/.git" ] || continue
-            origin="$(git -C "$candidate" remote get-url origin 2>/dev/null || true)"
-            [ -n "$origin" ] || continue
-            found="$(repo_slug_of "$origin" || true)"
-            [ -n "$found" ] || continue
-            if [ "$(lower "$found")" = "$want" ]; then
-                printf '%s\n' "$candidate"
-                return 0
-            fi
-        done
-    done
-    return 1
-}
-
-# The family's members, by the same `  - project: <Project>` row `family.py`
-# writes and `siblings.py` reads. The working clone is `<family folder>/
-# <Project>`, beside the holder.
-family_members() {
-    local manifest="$1" line
-    [ -f "$manifest" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "  - project: "*) printf '%s\n' "$(trim_unquote "${line#  - project: }")" ;;
-        esac
-    done <"$manifest"
-}
-
-# The branch a checkout belongs on: its OWN manifest's `tracking_branch:` —
-# the field `scripts/bootstrap.py` already reads to place the legs — falling
-# back to `main`. The workspace manifest records a `tracking_branch` too, but
-# that is PROVENANCE from the machine that parked; the local declaration is
-# what this machine's clone actually tracks, and the extension takes the same
-# line about `worktree_root`.
-tracking_branch_of() {
-    local root="$1"
-    if yaml_scalar "$root/family.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    if yaml_scalar "$root/project.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    printf 'main\n'
-}
-
-# The legs a root declares, by path, out of `project.yaml`'s `legs:` block —
-# the same rows `scripts/bootstrap.py` reads, and in the order it reads them,
-# `role:` before `path:`. The assembly leg is `path: "."` and is the root
-# itself, so it is not one of these.
-#
-# shellcheck disable=SC2329  # only `resume` bootstraps a root, so only
-# `resume` has to ask where its legs are; see the note above.
-legs_of() {
-    local root="$1" line role="" path=""
-    [ -f "$root/project.yaml" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            [ -n "$role" ] || continue
-            [ "$role" != "assembly" ] || continue
-            [ "$path" != "." ] || continue
-            [ -n "$path" ] && printf '%s\n' "$path"
-            ;;
-        [![:space:]]*) role=""; path="" ;;
-        esac
-    done <"$root/project.yaml"
-}
-
-# The branch a leg's OWN row declares for it: `leg_branch_of <root> <leg path>`
-# prints the `branch:` of the `legs:` row whose `path:` is <leg path>, and
-# NOTHING when that row declares none, or no row has the path. It is the
-# value `scripts/bootstrap.py` puts first — `str(leg.get("branch") or branch)`
-# — so a leg is placed on its own `branch:` and on the root's
-# `tracking_branch:` only when its row has no `branch:` of its own; a caller
-# falls back to `tracking_branch_of` on an empty answer, which is that `or`.
-#
-# Read the way `legs_of` reads the same rows — `role:` before `path:`, the
-# assembly row and a row with no role skipped — except that `branch:` may sit
-# on either side of `path:` in its row, so the answer comes the moment the
-# row has shown both, and a row that does not open with `- role:` clears what
-# the row before it left. A leg is found by its path SPELLED EITHER WAY: the
-# caller may hold `.gitmodules`' `spec` (`status`) or the manifest's own text
-# (`resume`), and `./spec` and `spec/` are one leg, so a leading `./` and a
-# trailing `/` come off both sides before they are compared.
-#
-# WHAT IS NO BRANCH: an empty value, `null`, `Null`, `NULL` or `~`, once a
-# trailing ` # comment` is cut off the value (a branch name holds no space, so
-# ` #` cannot be inside one). The loader is not matched to the letter: it keeps
-# a QUOTED `"null"` and `'~'` as branches and reads `false` and `0` as no
-# branch, while this does the opposite for both. No real branch is named any
-# of those, so nothing here chases the difference. (Since #243 `trim_unquote`
-# cuts that comment as well; the cut here runs first and is kept.)
-#
-# WHO ASKS IT: `resume`'s leg guard (`root_legs_ok`), `status`'s
-# `estate_repos` and `read_leg`, and `park`'s not-carried report
-# (`report_repos`, #242, PR #249) - each to know the branch a leg belongs on.
-#
-# shellcheck disable=SC2329  # a `park` from before #249 never calls it;
-# the disable can go once #249 has landed.
-leg_branch_of() {
-    local root="$1" want="$2" line role="" path="" branch=""
-    [ -n "$want" ] || return 0
-    [ -f "$root/project.yaml" ] || return 0
-    want="${want#./}"
-    want="${want%/}"
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            branch=""
-            ;;
-        '  - '*) role=""; path=""; branch="" ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            path="${path#./}"
-            path="${path%/}"
-            [ -n "$role" ] || path=""
-            [ "$role" != "assembly" ] || path=""
-            ;;
-        '    branch:'*)
-            branch="${line#*:}"
-            branch="$(trim_unquote "${branch%%[[:space:]]#*}")"
-            case "$branch" in null | Null | NULL | '~') branch="" ;; esac
-            ;;
-        [![:space:]]*) role=""; path=""; branch="" ;;
-        esac
-        if [ -n "$path" ] && [ "$path" = "$want" ] && [ -n "$branch" ]; then
-            printf '%s\n' "$branch"
-            return 0
-        fi
-    done <"$root/project.yaml"
-}
-# --- END shared estate resolver ---------------------------------------------
-
-# --- the user config and the workspace repository ---------------------------
-
-CONFIG_FILE="${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"
-
-# shellcheck disable=SC2088  # a literal leading ~ is what is matched here
-expand_home() {
-    local value="$1"
-    case "$value" in
-    '~') printf '%s\n' "$HOME" ;;
-    '~/'*) printf '%s\n' "$HOME/${value#\~/}" ;;
-    *) printf '%s\n' "$value" ;;
-    esac
-}
-
-# The optional per-org override, as `org<TAB>path` rows. The config's shape is
-# the plan's own (#77 S1, §2.3):
-#
-#     repository: opensoft/brett-wip
-#     path: ~/projects/brett-wip
-#     orgs:
-#       MedxSoft:
-#         repository: MedxSoft/brett-wip
-#         path: ~/projects/MedxSoft-wip
-#
-# READ ONLY, AND NEVER A REFUSAL HERE. The extension refuses a malformed
-# `orgs:` block because it is about to WRITE a manifest and filing a
-# confidential org's work in the wrong repository is the one thing that
-# override exists to prevent. Nothing in this command writes a manifest: it
-# looks for one, so an entry it cannot read is an entry it does not find, and
-# `park.sh`'s own refusal is still the authority on the block being wrong.
-config_org_paths() {
-    local file="$1" line org="" path="" in_orgs=0
-    [ -f "$file" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '#'*) continue ;;
-        orgs:*)
-            in_orgs=1; org=""; path=""
-            continue
-            ;;
-        [![:space:]]*)
-            # ANY other indent-zero key ends the block, so a two-space key
-            # under something else is never read as an org override.
-            [ -z "$org" ] || [ -z "$path" ] || printf '%s\t%s\n' "$org" "$path"
-            in_orgs=0; org=""; path=""
-            continue
-            ;;
-        esac
-        [ "$in_orgs" -eq 1 ] || continue
-        case "$line" in
-        '  '[![:space:]]*)
-            [ -z "$org" ] || [ -z "$path" ] || printf '%s\t%s\n' "$org" "$path"
-            org="$(trim_unquote "${line%:}")"
-            path=""
-            ;;
-        '    path:'*) path="$(trim_unquote "${line#*path:}")" ;;
-        esac
-    done <"$file"
-    [ -z "$org" ] || [ -z "$path" ] || printf '%s\t%s\n' "$org" "$path"
-}
-
-config_path_for_org() {
-    local want org path
-    want="$(lower "$1")"
-    while IFS=$'\t' read -r org path; do
-        [ -n "${path:-}" ] || continue
-        if [ "$(lower "$org")" = "$want" ]; then
-            expand_home "$path"
-            return 0
-        fi
-    done < <(config_org_paths "$CONFIG_FILE")
-    return 1
-}
-
-is_checkout() {
-    local path="$1"
-    [ -n "$path" ] || return 1
-    [ -e "$path/.git" ] || return 1
-    git -C "$path" rev-parse --git-dir >/dev/null 2>&1
-}
-
-# `https://github.com/<owner>/<name>.git` by default.
-#
-# `$OPENREPOTOOLS_REMOTE_BASE` IS THE OFFLINE TEST PATH, and it is the same
-# concession `setup-project.py --local-remote-dir` and `family.py
-# --local-remote-dir` make: a directory of BARE repositories named
-# `<name>.git`, used as origins, so this whole flow — clone the workspace,
-# clone the holder, place the siblings — is provable with no network and no
-# real repository. It is documented here for the same reason the shim
-# documents `$OPENREPOSHAPE_SETUP_SH`, and it grants no file-protocol
-# permission of its own: a test that needs `protocol.file.allow` sets it in
-# git's own environment, which is how it stays a test's decision.
-clone_url_for() {
-    local slug="$1" base="${OPENREPOTOOLS_REMOTE_BASE:-}"
-    if [ -n "$base" ]; then
-        printf '%s/%s.git\n' "${base%/}" "${slug##*/}"
-        return 0
-    fi
-    printf 'https://github.com/%s.git\n' "$slug"
-}
-
-# --- the manifest -----------------------------------------------------------
-
-# `<org>\t<file>\t<workspace>` for every `workspaces/<org>/<Name>.yaml` that
-# records this name, in every workspace checkout this config knows about. The
-# basename is compared CASE-INSENSITIVELY: a standalone project's manifest is
-# named for its `project.yaml` id (`atlas`), and the folder a person types is
-# the repository name (`Atlas`).
-manifest_candidates() {
-    local want workspace dir file base
-    want="$(lower "$1")"
-    shift
-    for workspace in "$@"; do
-        [ -d "$workspace/workspaces" ] || continue
-        for dir in "$workspace"/workspaces/*/; do
-            dir="${dir%/}"
-            [ -d "$dir" ] || continue
-            for file in "$dir"/*.yaml; do
-                [ -f "$file" ] || continue
-                base="${file##*/}"
-                base="${base%.yaml}"
-                [ "$(lower "$base")" = "$want" ] || continue
-                printf '%s\t%s\t%s\n' "${dir##*/}" "$file" "$workspace"
-            done
-        done
-    done
-}
-
-# One field of the FIRST `projects[]` block, read the way the extension's own
-# reader does: on the indent width and the leading `- ` of a list item, which
-# is safe because this file is written by that extension with a fixed layout.
-manifest_project_field() {
-    local file="$1" field="$2" line seen=0
-    [ -f "$file" ] || return 1
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - id:'*)
-            [ "$seen" -eq 0 ] || return 1
-            seen=1
-            continue
-            ;;
-        esac
-        [ "$seen" -eq 1 ] || continue
-        case "$line" in
-        "    $field:"*)
-            printf '%s\n' "$(trim_unquote "${line#*:}")"
-            return 0
-            ;;
-        esac
-    done <"$file"
-    return 1
-}
-
-# --- the refresh ------------------------------------------------------------
-
-REFUSED=0
-
-# RULING 2, and its whole point: a clone that is dirty or on a feature branch
-# is REFUSED BY NAME AND SKIPPED, never reset. `pull --ff-only origin <branch>`
-# rather than a bare `pull`, so a clone with no upstream configured is
-# fast-forwarded rather than told to set one - and `--ff-only` is what makes a
-# divergent branch a refusal from git itself instead of a merge commit nobody
-# asked for.
-pull_ff_only() {
-    local label="$1" repo="$2" branch="${3:-}" head dirty
-    # THE BRANCH IS AN ARGUMENT so the WORKSPACE repository can be checked
-    # too: it is a private repository with no `project.yaml` and no declared
-    # tracking branch, and refusing it for being on `master` rather than
-    # `main` would be a refusal about nothing. Its caller passes the branch it
-    # is already on, which keeps the dirty guard and the `--ff-only` guard and
-    # drops only the off-branch one.
-    [ -n "$branch" ] || branch="$(tracking_branch_of "$repo")"
-    head="$(git -C "$repo" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
-    if [ "$head" != "$branch" ]; then
-        REFUSED=$((REFUSED + 1))
-        say "  REFUSED $label: HEAD is '$head', not its tracking branch '$branch'."
-        say "          Nothing was fast-forwarded and nothing was reset. Your work is where you left it."
-        say "            look:  git -C $repo status --short --branch"
-        say "            then:  git -C $repo checkout $branch && $SELF_NAME $ESTATE_NAME"
-        return 1
-    fi
-    dirty="$(git -C "$repo" status --porcelain 2>/dev/null || true)"
-    if [ -n "$dirty" ]; then
-        REFUSED=$((REFUSED + 1))
-        say "  REFUSED $label: uncommitted changes in $repo."
-        say "          Nothing was fast-forwarded and nothing was reset."
-        say "            look:  git -C $repo status --short"
-        say "            then:  commit or stash them yourself, and re-run \`$SELF_NAME $ESTATE_NAME\`."
-        return 1
-    fi
-    if [ "$DRY_RUN" -eq 1 ]; then
-        say "  would fast-forward $label: git -C $repo pull --ff-only origin $branch"
-        return 0
-    fi
-    if ! git -C "$repo" pull --ff-only origin "$branch"; then
-        REFUSED=$((REFUSED + 1))
-        say "  REFUSED $label: \`git pull --ff-only origin $branch\` did not fast-forward."
-        say "          Local commits are on that branch, or the remote has none. Nothing was reset."
-        return 1
-    fi
-    return 0
-}
-
-# THE LEGS, BEFORE A ROOT IS BOOTSTRAPPED (F3 of the review on #83). A root's
-# own `make bootstrap` — `templates/assembly-root/scripts/bootstrap.py`,
-# `checkout_tracking_branch` — MOVES A LEG'S HEAD onto the branch it places the
-# leg on: `git checkout <branch>` in a leg whose local <branch> tip equals the
-# pin, `checkout -b <branch> <pin>` in a leg that has no local one and, since
-# openRepoShape v1.1.0, a fast-forward of a <branch> BEHIND the pin to the pin
-# and a checkout of it — from that branch, from a HEAD detached at the pin, or
-# from ANOTHER branch (opensoft/openRepoShape#475, and opensoft/openRepoShape#603
-# → opensoft/openRepoShape#615) — and a move of a <branch> AHEAD of the pin,
-# with no commit of its own, back to the pin from a HEAD detached at it. A leg
-# sitting on a clean feature branch at the pin makes the superproject clean,
-# so the dirty and off-branch guards above see nothing and say nothing — and
-# `resume` used to walk that leg off `001-my-feature` onto `main` and exit 0.
-#
-# WHICH <branch> IS THE LEG'S OWN (#235). `bootstrap.py` places a leg on
-# `str(leg.get("branch") or branch)`: the `branch:` its row in the root's
-# `project.yaml` declares for that leg when it declares one, and the root's
-# `tracking_branch` ONLY when the row has none (`leg_branch_of`, then
-# `tracking_branch_of`, above). Every leg held to the ROOT's branch lets a leg
-# declaring `branch: develop` be moved onto `develop` while `resume` exits 0,
-# and refuses a leg that is already on `develop`.
-#
-# So the legs are asked first, and a root with one off the branch bootstrap
-# would put it on is REFUSED BY NAME and neither pulled nor bootstrapped,
-# whichever of the two that branch comes from, and the refusal says which.
-# DETACHED AT THE PIN is not a refusal: that is the state a fresh clone arrives
-# in and precisely what bootstrap exists to fix.
-root_legs_ok() {
-    local label="$1" root="$2" branch leg want kind from head pin at
-    branch="$(tracking_branch_of "$root")"
-    while IFS= read -r leg; do
-        [ -n "$leg" ] || continue
-        [ -e "$root/$leg/.git" ] || continue
-        want="$(leg_branch_of "$root" "$leg")"
-        if [ -n "$want" ]; then
-            kind="its own branch"
-            from="the \`branch:\` of its row in project.yaml"
-        else
-            want="$branch"
-            kind="its tracking branch"
-            from="the root's \`tracking_branch\`"
-        fi
-        head="$(git -C "$root/$leg" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
-        [ "$head" != "$want" ] || continue
-        if [ "$head" = "HEAD" ]; then
-            pin="$(git -C "$root" rev-parse "HEAD:$leg" 2>/dev/null || true)"
-            at="$(git -C "$root/$leg" rev-parse HEAD 2>/dev/null || true)"
-            if [ -n "$pin" ] && [ "$pin" = "$at" ]; then
-                continue
-            fi
-            head="detached at ${at:-?}, and the pin is ${pin:-?}"
-        fi
-        REFUSED=$((REFUSED + 1))
-        say "  REFUSED $label: leg $leg is on '$head', not $kind '$want' ($from);"
-        say "          \`make bootstrap\` would move it - nothing was touched."
-        say "            look:  git -C $root/$leg status --short --branch"
-        say "            then:  finish or park that leg's work, put it back on $want, and re-run."
-        return 1
-    done < <(legs_of "$root")
-    return 0
-}
-
-# One root: the legs, then the fast-forward, then its own bootstrap - and a
-# REFUSAL AT ANY STEP SKIPS THE ONES AFTER IT (F1 of the review on #83). The
-# holder's bootstrap is `git submodule update --init --recursive`, which snaps
-# every `members/<X>` back to the recorded gitlink: running it after saying
-# "nothing was reset" would have reset exactly the pin bump the refusal was
-# protecting. Returns 1 when the root was refused.
-refresh_root() {
-    local label="$1" root="$2"
-    root_legs_ok "$label" "$root" || {
-        say "  [$label] bootstrap skipped: refused above. Nothing here was fetched, moved or reset."
-        return 1
-    }
-    pull_ff_only "$label" "$root" || {
-        say "  [$label] bootstrap skipped: refused above. Nothing here was fetched, moved or reset."
-        return 1
-    }
-    run_make "$label" "$root" bootstrap || {
-        REFUSED=$((REFUSED + 1))
-        say "  FINDING: [$label] \`make bootstrap\` did not exit 0; its legs may not be placed."
-    }
-    return 0
-}
-
-run_make() {
-    local label="$1" root="$2" target="$3" args="${4:-}" status
-    if [ ! -f "$root/Makefile" ]; then
-        say "  [$label] no Makefile; \`make $target\` skipped. Re-sync the root with update-shape.py."
-        return 0
-    fi
-    if [ "$DRY_RUN" -eq 1 ]; then
-        # shellcheck disable=SC2016  # the single quotes are LITERAL: this is
-        # the `make` line a person can copy, and `ARGS='...'` is how it is typed.
-        say "  would run: make $target${args:+ ARGS='$args'}   ($root)"
-        return 0
-    fi
-    say "  --- $label: make $target ---"
-    # AN ARRAY, so `ARGS=--feature 001-a --dry-run` reaches make as ONE
-    # assignment. `${var:+"..."}` unquoted is one word in bash today and a
-    # thing a reader has to squint at; an array is neither.
-    local call=(make "$target")
-    [ -z "$args" ] || call+=("ARGS=$args")
-    set +e
-    (cd "$root" && exec "${call[@]}")
-    status=$?
-    set -e
-    return "$status"
-}
-
-# --- arguments -------------------------------------------------------------
-
-# THE VALUE OF A VALUE-TAKING FLAG, in either spelling, read in ONE place so
-# that the ways of not giving one are ONE refusal. `flag_value "$@"` from an
-# arm sets `FLAG_VALUE` and `FLAG_SHIFT` — the arguments that arm then
-# consumes, 2 for `--flag value` and 1 for `--flag=value` — or it returns 1
-# with `FLAG_HINT` carrying whatever that refusal has to add. THE WORDS STAY
-# AT THE ARM: each flag says what its own value is, and this says only whether
-# one was given.
-# A VALUE BEGINNING WITH `-` IS NOT ONE in the spaced spelling — the hole #17
-# named and left open. `park Atlas --lane --dry-run` ran a REAL park with the
-# lane set to `--dry-run`: the flag a person typed was swallowed as a value,
-# `--dry-run` itself never took effect, and the only sign was a WIP commit
-# subject labelled with it. Nothing here swallows the next word whatever it
-# is, so that is a refusal.
-# `--flag=value` IS THE OTHER HALF, and the escape that refusing `-*` would
-# otherwise foreclose: a value that really does begin with `-` is spelled
-# `--lane=--weird`, which takes whatever follows the FIRST `=` and asks
-# nothing about it. An `=` with nothing after it is an empty value and is
-# refused as #17 refuses one.
-# BYTE-IDENTICAL IN `park`, `resume` AND `status`, held by
-# `tests/test_repo_hygiene.py` the way the estate resolver and `expand_home`
-# are: three files a person has on PATH, and one answer to what a flag's value
-# is.
-flag_value() {
-    FLAG_VALUE=""
-    FLAG_SHIFT=2
-    FLAG_HINT=""
-    case "$1" in
-    *=*)
-        FLAG_SHIFT=1
-        FLAG_VALUE="${1#*=}"
-        [ -n "$FLAG_VALUE" ] || return 1
-        return 0 ;;
-    esac
-    [ $# -ge 2 ] && [ -n "$2" ] || return 1
-    # THE NEXT ARGUMENT, ONLY IF IT CANNOT BE A FLAG. The hint names the `=`
-    # spelling because that is the whole exit: this refuses nothing a person
-    # cannot then say.
-    case "$2" in
-    -*)
-        FLAG_HINT="
-    \`$2\` begins with a \`-\`, so it is a flag and not this one's value:
-    nothing here swallows the next word whatever it is. A value that really
-    does begin with \`-\` is given after an \`=\`:
-
-      $1=$2"
-        return 1 ;;
-    esac
-    FLAG_VALUE="$2"
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-    -h | --help) usage; exit 0 ;;
-    --dry-run) DRY_RUN=1; shift ;;
-    # A MISSING, EMPTY OR FLAG-SHAPED VALUE IS THIS COMMAND'S REFUSAL, exit 2,
-    # in its own words: `${2:?…}` would be bash's message and bash's exit 1 —
-    # and a `resume` that exits non-zero is read as "something was refused",
-    # so the refusal has to be one this command wrote and a person can act on.
-    # EMPTY IS REFUSED THE SAME WAY, and so is a flag where a value belongs:
-    # `flag_value` above asks all three questions once for every arm below,
-    # and each arm keeps its own words. `${2:?…}` rejected
-    # unset AND null; `[ $# -ge 2 ]` alone rejects only the first, and every
-    # value here is read later as "was this given at all?" — so
-    # `resume --repo ""` would fall past the `--repo` branch of the resolver
-    # into the walk-up and resume the estate around the cwd, which is the one
-    # thing naming a clone's origin was there to prevent, and `--org ""` would
-    # stop narrowing the very manifests it was passed to choose between.
-    # `--workspace ""` GOES TWO WAYS, and neither is the one that was typed.
-    # WITH A CONFIG ALREADY HERE, the empty slug slips past the refusal below
-    # that never silently replaces an existing config — that comparison is
-    # `[ -n "$WORKSPACE_SLUG" ]`-guarded — and this machine's own config is
-    # used, unchecked, in place of the repository named on the command line.
-    # WITH NO CONFIG, the run reaches the refusal that says no workspace
-    # record is configured: true about the machine, and a lie about the
-    # command line, which named one. That second branch is the one the tests
-    # exercise, their `$HOME` having no `~/.agents` in it.
-    # A value that came out empty is a flag that was typed and lost, never one
-    # that was never typed, and the two must not do different things
-    # (Copilot's review of #14).
-    --repo | --repo=*)
-        flag_value "$@" ||
-            die "--repo needs a value: <owner>/<name>, or any url spelling of one.$FLAG_HINT"
-        REPO_SLUG="$FLAG_VALUE"; REPO_ARG="$REPO_SLUG"; shift "$FLAG_SHIFT" ;;
-    --workspace | --workspace=*)
-        flag_value "$@" ||
-            die "--workspace needs a value: <owner>/<name> of your private workspace repository.$FLAG_HINT"
-        WORKSPACE_SLUG="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    --org | --org=*)
-        flag_value "$@" ||
-            die "--org needs a value: the organisation whose manifest to read.$FLAG_HINT"
-        ORG_WANTED="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    --name | --project | --name=* | --project=*)
-        flag_value "$@" ||
-            die "${1%%=*} needs a value: one estate folder name under your projects directory.$FLAG_HINT"
-        NAME="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    # `park --all` exists; `resume --all` deliberately does not (see the
-    # header). Said here in so many words, because the generic answer below
-    # - "put it after `--`" - would hand the extension a flag it does not
-    # have and nobody meant.
-    -a | --all) die "\`$SELF_NAME\` has no \`--all\`, deliberately: rebuilding every estate on this
-    machine from one command is the accident its own bare-form refusal exists
-    to prevent. Name the one you want: \`$SELF_NAME <Name>\`." ;;
-    # EVERYTHING AFTER `--` IS THE EXTENSION'S, verbatim: `resume.sh` has
-    # flags this command has no opinion about (--feature, --keep-staged), and
-    # a command that ate them would be a command people stop using the moment
-    # the extension grows one. NOTE that `--workspace` above is THIS
-    # command's, and takes `<owner/name>`; the extension's own `--workspace`
-    # takes a PATH and reaches it through `--`.
-    --) shift; PASSTHROUGH+=("$@"); break ;;
-    -*)
-        usage >&2
-        die "$SELF_NAME does not know $1. Its own flags are listed above; the
-    extension's own flags travel after a \`--\`, so what you want is:
-
-      $SELF_NAME -- $1"
-        ;;
-    *)
-        [ -z "$NAME" ] ||
-            die "two estate names, '$NAME' and '$1'. One positional <Name>, then flags."
-        NAME="$1"; shift ;;
-    esac
-done
-
-[ -z "$NAME" ] || [ -z "$REPO_SLUG" ] ||
-    die "both <Name> ('$NAME') and --repo '$REPO_SLUG'. One estate per run: name it
-    either way, not both."
-
-# A FOLDER NAME, NEVER A PATH. `resume ../x` or `resume /abs` would otherwise
-# be joined to the projects directory and clone somewhere nobody named.
-[ -z "$NAME" ] || is_safe_folder_name "$NAME" ||
-    die "'$NAME' is not an estate name: it is a path, or it carries a character
-    an estate folder may not. <Name> is ONE name — the family or project your
-    workspace record names — with no slash and no leading dot."
-
-command -v git >/dev/null 2>&1 ||
-    die "no \`git\` on PATH, so nothing can be cloned or fast-forwarded."
-command -v make >/dev/null 2>&1 ||
-    die "no \`make\` on PATH, so the estate's own \`make resume\` cannot be run.
-    Install it (\`xcode-select --install\` on macOS, \`sudo apt-get install -y
-    make\` on Debian and Ubuntu), then re-run \`$SELF_NAME\`."
-
-# --- which estate, by name ---------------------------------------------------
-if [ -n "$REPO_SLUG" ]; then
-    # ANY SPELLING A PERSON MIGHT PASTE, through the same reader that reads a
-    # clone's `origin`, so both sides of the comparison come from one parser.
-    REPO_SLUG="$(repo_slug_of "$REPO_SLUG" || true)"
-    [ -n "$REPO_SLUG" ] || die "--repo '$REPO_ARG' is not a repository: it wants <owner>/<name>, or any
-    url spelling of one (https://…/<owner>/<name>.git, git@host:<owner>/<name>).
-    A family's members may live in another organisation, so there is no owner
-    to assume, and a path on disk has none to read."
-    MATCH="$(clone_with_origin "$REPO_SLUG" || true)"
-    [ -n "$MATCH" ] || die "no clone under your projects directory has origin $REPO_SLUG.
-    \`--repo\` names a clone you ALREADY HAVE (RULING 2026-09-09 ruling 1). To
-    bring an estate back that is not here yet, name it as your workspace
-    record does:
-
-      $SELF_NAME <Name>
-
-estates found under your projects directory:
-$(estates_or_none)"
-    estate_walk_up "$MATCH" ||
-        die "$MATCH is a clone of $REPO_SLUG, but nothing at or above it is an
-    estate: no \`family.yaml\` holder beside it and no \`project.yaml\` root."
-    NAME="$ESTATE_NAME"
-elif [ -z "$NAME" ]; then
-    estate_walk_up "$PWD" || die "no estate around $PWD, and no <Name> was given.
-    On a machine that has none of it yet, \`$SELF_NAME <Name>\` is how it comes
-    back - <Name> being the family or project your workspace record names.
-    Estates already here:
-
-$(estates_or_none)"
-    NAME="$ESTATE_NAME"
-fi
-
-# --- (1) the workspace repository -------------------------------------------
-say "resume: $NAME"
-say ""
-say "(1) the workspace record"
-
-CONFIG_REPO=""
-CONFIG_PATH=""
-if [ -f "$CONFIG_FILE" ]; then
-    yaml_scalar "$CONFIG_FILE" repository && CONFIG_REPO="$YAML_VALUE"
-    yaml_scalar "$CONFIG_FILE" path && CONFIG_PATH="$(expand_home "$YAML_VALUE")"
-fi
-
-WORKSPACE=""
-if [ -f "$CONFIG_FILE" ]; then
-    say "  config          $CONFIG_FILE"
-    [ -n "$CONFIG_PATH" ] || die "$CONFIG_FILE names no \`path:\`, so there is no workspace checkout
-    to read your record from. It wants exactly two lines:
-
-      repository: <owner>/<repo>
-      path: ~/projects/<repo>"
-    # `--workspace` NEVER SILENTLY REPLACES AN EXISTING CONFIG. Two different
-    # private repositories for one person's work is a state nothing here can
-    # arbitrate, so it is said out loud rather than picked.
-    if [ -n "$WORKSPACE_SLUG" ] && [ -n "$CONFIG_REPO" ] &&
-        [ "$(lower "$WORKSPACE_SLUG")" != "$(lower "$CONFIG_REPO")" ]; then
-        die "--workspace $WORKSPACE_SLUG, but $CONFIG_FILE already names
-    $CONFIG_REPO. This command writes that file only on a machine that has
-    none, and it never overwrites one. Drop the flag to use the config, or
-    edit the file yourself."
-    fi
-    if is_checkout "$CONFIG_PATH"; then
-        WORKSPACE="$CONFIG_PATH"
-        # THE SAME GUARD EVERY OTHER CHECKOUT GETS, and a refusal here is a
-        # refusal: the record is what the whole run reads, and cloning an
-        # estate out of a manifest whose checkout is dirty or mid-conflict is
-        # exactly the wrong thing to do quietly. The branch passed is the one
-        # it is already on — a private repository declares no tracking branch,
-        # so being on `master` is not a finding.
-        if ! pull_ff_only "workspace" "$WORKSPACE" \
-            "$(git -C "$WORKSPACE" rev-parse --abbrev-ref HEAD 2>/dev/null || printf 'main')"; then
-            die "your workspace checkout at $WORKSPACE was not fast-forwarded, so the
-    record this run would read may not be the one \`park\` last wrote.
-    Nothing was cloned and nothing was resumed. Sort that checkout out — the
-    lines above name what it is — and re-run \`$SELF_NAME $NAME\`."
-        fi
-    else
-        [ -n "$CONFIG_REPO" ] || die "$CONFIG_PATH, which $CONFIG_FILE names as your workspace checkout,
-    is not a Git checkout, and the config names no \`repository:\` to clone.
-    Add it, or clone the repository there yourself."
-        WORKSPACE="$CONFIG_PATH"
-        if [ "$DRY_RUN" -eq 1 ]; then
-            say "  would clone      $(clone_url_for "$CONFIG_REPO") -> $WORKSPACE"
-        else
-            say "  cloning         $CONFIG_REPO -> $WORKSPACE"
-            mkdir -p -- "$(dirname -- "$WORKSPACE")"
-            git clone "$(clone_url_for "$CONFIG_REPO")" "$WORKSPACE"
-        fi
-    fi
-else
-    [ -n "$WORKSPACE_SLUG" ] || die "no workspace record is configured, so there is nothing to resume from.
-    \`park\` writes the feature list into a PRIVATE REPOSITORY YOU OWN, and
-    this machine has not been told which one. Name it once, by name:
-
-      $SELF_NAME $NAME --workspace <owner>/<repo>
-
-    which clones it and writes two lines into
-
-      $CONFIG_FILE
-
-    Nothing else in this standard writes that file, and nothing guesses the
-    repository."
-    case "$WORKSPACE_SLUG" in
-    */*) ;;
-    *) die "--workspace '$WORKSPACE_SLUG' is not <owner/name>." ;;
-    esac
-    WORKSPACE="$(projects_dir_for_new)/${WORKSPACE_SLUG##*/}"
-    if [ "$DRY_RUN" -eq 1 ]; then
-        say "  would clone      $(clone_url_for "$WORKSPACE_SLUG") -> $WORKSPACE"
-        say "  would write      $CONFIG_FILE (repository:, path:)"
-    else
-        say "  cloning         $WORKSPACE_SLUG -> $WORKSPACE"
-        mkdir -p -- "$(dirname -- "$WORKSPACE")"
-        git clone "$(clone_url_for "$WORKSPACE_SLUG")" "$WORKSPACE"
-        # THE ONLY WRITE TO THIS FILE ANYWHERE IN THIS STANDARD, and only
-        # because it was asked for by name. Two keys, `~` where the path is
-        # under $HOME so the file travels with the thing it points at.
-        CONFIG_WRITTEN="$WORKSPACE"
-        case "$WORKSPACE" in
-        "$HOME"/*) CONFIG_WRITTEN="~${WORKSPACE#"$HOME"}" ;;
-        esac
-        mkdir -p -- "$(dirname -- "$CONFIG_FILE")"
-        [ ! -e "$CONFIG_FILE" ] ||
-            die "$CONFIG_FILE appeared while this ran; it was not overwritten."
-        printf 'repository: %s\npath: %s\n' "$WORKSPACE_SLUG" "$CONFIG_WRITTEN" \
-            >"$CONFIG_FILE"
-        say "  wrote           $CONFIG_FILE"
-        say "                  repository: $WORKSPACE_SLUG"
-        say "                  path: $CONFIG_WRITTEN"
-    fi
-fi
-
-# --- (2) the manifest -------------------------------------------------------
-say ""
-say "(2) the manifest for $NAME"
-
-# ONE ENTRY PER DIRECTORY, compared as a PHYSICAL path (F4 of the review on
-# #83): two spellings of one checkout — an `orgs:` override pointing at the
-# same clone as the default, a symlinked projects directory — would otherwise
-# be searched twice and every manifest in it counted twice, which read as
-# "two orgs record this name" and could not be answered by `--org` at all.
-WORKSPACES=()
-add_workspace() {
-    local candidate="$1" physical existing
-    [ -n "$candidate" ] || return 0
-    is_checkout "$candidate" || return 0
-    physical="$(cd "$candidate" 2>/dev/null && pwd -P)" || physical="$candidate"
-    for existing in ${WORKSPACES[@]+"${WORKSPACES[@]}"}; do
-        [ "$existing" != "$physical" ] || return 0
-    done
-    WORKSPACES+=("$physical")
-}
-add_workspace "$WORKSPACE"
-# `orgs:` IS HONOURED IN THE ONLY ORDER THAT IS POSSIBLE. The override is
-# keyed by the estate's org, and the org is a fact recorded IN the manifest
-# (`workspaces/<org>/<Name>.yaml`), so the file has to be found before the org
-# is known: every workspace the config names is searched, and `--org` says
-# which answer was meant when two of them have one.
-if [ -n "$ORG_WANTED" ]; then
-    ORG_PATH="$(config_path_for_org "$ORG_WANTED" || true)"
-    [ -z "$ORG_PATH" ] || add_workspace "$ORG_PATH"
-fi
-while IFS=$'\t' read -r _ override; do
-    [ -n "${override:-}" ] || continue
-    add_workspace "$(expand_home "$override")"
-done < <(config_org_paths "$CONFIG_FILE")
-# Nothing readable at all: the dry-run branch below says so, and a real run
-# has already refused if the config named no checkout it could clone.
-[ ${#WORKSPACES[@]} -gt 0 ] || WORKSPACES=("$WORKSPACE")
-
-MANIFEST_ORG=""
-MANIFEST_FILE=""
-FOUND=0
-FOUND_ORGS=""
-FOUND_ROWS=""
-if [ "$DRY_RUN" -eq 1 ] && [ ! -d "${WORKSPACES[0]}" ]; then
-    say "  (--dry-run: the workspace is not here, so no manifest could be read)"
-else
-    # WHAT MAKES THE QUESTION UNANSWERABLE IS TWO ORGS, not two files (F4 of
-    # the review on #83). The same `<org>/<name>.yaml` reached through two
-    # checkouts of one workspace repository is ONE record, and `--org` could
-    # not have told them apart; two DISTINCT orgs is the case `--org` exists
-    # for. So the pairs are deduped on `<org>` plus the file's basename and
-    # the refusal counts the orgs that are left. BOTH HALVES OF THAT KEY ARE
-    # LOWERED, because both were MATCHED that way: `manifest_candidates`
-    # compares the basename case-insensitively, so `Atlas.yaml` in one
-    # checkout and `atlas.yaml` in another are one record — a key that folded
-    # only the org counted them as two and refused, naming one org twice
-    # (Copilot on openRepoTools #18).
-    while IFS=$'\t' read -r org file _; do
-        [ -n "${file:-}" ] || continue
-        if [ -n "$ORG_WANTED" ] && [ "$(lower "$org")" != "$(lower "$ORG_WANTED")" ]; then
-            continue
-        fi
-        case " $FOUND_ORGS " in
-        *" $(lower "$org")/$(lower "${file##*/}") "*) continue ;;
-        esac
-        FOUND_ORGS="$FOUND_ORGS $(lower "$org")/$(lower "${file##*/}")"
-        FOUND=$((FOUND + 1))
-        FOUND_ROWS="$FOUND_ROWS  $org/${file##*/}   $file
-"
-        MANIFEST_ORG="$org"
-        MANIFEST_FILE="$file"
-    done < <(manifest_candidates "$NAME" "${WORKSPACES[@]}")
-fi
-
-if [ "$FOUND" -gt 1 ]; then
-    die "$FOUND workspace manifests record '$NAME', in different orgs:
-
-$FOUND_ROWS
-    Two projects in two organisations may share a name, so nothing here picks
-    one. Say which:
-
-      $SELF_NAME $NAME --org <org>"
-fi
-
-ESTATE_PRESENT=0
-if estate_by_name "$NAME"; then
-    ESTATE_PRESENT=1
-fi
-
-if [ "$FOUND" -eq 0 ]; then
-    if [ "$ESTATE_PRESENT" -eq 0 ] && [ "$DRY_RUN" -eq 0 ]; then
-        die "no workspace manifest records '$NAME', and there is no estate of that
-    name here, so there is nothing to clone and nothing to recreate.
-    Either it was never parked, or it was parked under another name:
-
-      grep -rn 'id: ' $WORKSPACE/workspaces/
-      ls $WORKSPACE/workspaces/*/
-
-    A family's manifest is \`workspaces/<org>/<Family>.yaml\`; a standalone
-    project's is named for its \`project.yaml\` id."
-    fi
-    say "  none found; the estate that IS here will be refreshed, and \`make resume\`"
-    say "  will print the extension's own refusal if it has no record either."
-else
-    say "  $MANIFEST_FILE"
-    say "  org             $MANIFEST_ORG"
-fi
-
-# --- what the manifest says the estate is -----------------------------------
-MANIFEST_KIND=""
-MANIFEST_DIRNAME=""
-MANIFEST_FAMILY=""
-MANIFEST_ROOT_VALUE=""
-ROOT_REPOSITORY=""
-if [ -n "$MANIFEST_FILE" ]; then
-    MANIFEST_ROOT_VALUE="$(manifest_project_field "$MANIFEST_FILE" root || true)"
-    if yaml_scalar "$MANIFEST_FILE" family && [ -n "$YAML_VALUE" ]; then
-        MANIFEST_KIND="family"
-        MANIFEST_FAMILY="$YAML_VALUE"
-        # THE FOLDER COMES FROM `root:`, NEVER FROM `family:` (F2 of the
-        # review on #83, and the headline of it). `park.sh` writes `family:`
-        # from `family.yaml`'s `id:` — `workspace_family_name` reads that key
-        # — and an id is LOWERCASE by construction (`family.py`'s
-        # `--id ... or family.lower()`, checked against
-        # `PROJECT_ID_RE = ^[a-z0-9][a-z0-9-]*$`). The FOLDER is one of the
-        # family's CamelCase names - its repository's last part, or its
-        # display `name:` - which is what `is_family_folder` requires to
-        # match the directory. Deriving the folder from `family:` therefore
-        # produced `~/projects/inkrouter/inkrouter`, a clone of
-        # `<org>/inkrouter` that 404s on any case-sensitive remote, and then a
-        # "not an estate" refusal over the half-estate it had just made.
-        #
-        # `workspace_manifest_root_value` writes each MEMBER's `root:` as
-        # `<family folder>/<project folder>` with the real casing, so the
-        # first segment is the family folder and — the holder repository being
-        # the family's own name in its org, #76 ruling 3's doubled-name layout,
-        # and v1.1.0's rule (opensoft/openRepoShape#629) — it is the holder
-        # repository's name too. `family:` stays what it is good for: the flag
-        # that says this file is a family's at all.
-        #
-        # THE RECORD NEVER CARRIES THE HOLDER'S REPOSITORY (#236): it has the
-        # id in `family:`, each member's OWN `repository:` and `root:`, and is
-        # filed under the holder's org. So the repository is derived from that
-        # org and the folder, which is exact under v1.1.0 and is also what a
-        # fresh machine, with no `family.yaml` to read yet, has to go on. A
-        # holder this machine already has says which repository it is, and
-        # that is read below, from the estate this run resolved.
-        MANIFEST_DIRNAME="${MANIFEST_ROOT_VALUE%%/*}"
-        [ -n "$MANIFEST_ROOT_VALUE" ] &&
-            [ "$MANIFEST_DIRNAME" != "$MANIFEST_ROOT_VALUE" ] ||
-            die "$MANIFEST_FILE says \`family: $YAML_VALUE\` but its first project records
-    \`root: ${MANIFEST_ROOT_VALUE:-(nothing)}\`, which names no family folder. A member of a
-    family is recorded as <family folder>/<project folder>, so this file
-    cannot say where the holder goes. It is written by \`park\`; a
-    hand-edited one is fixed by hand."
-        ROOT_REPOSITORY="$MANIFEST_ORG/$MANIFEST_DIRNAME"
-    else
-        MANIFEST_KIND="standalone"
-        ROOT_REPOSITORY="$(manifest_project_field "$MANIFEST_FILE" repository || true)"
-        MANIFEST_DIRNAME="$MANIFEST_ROOT_VALUE"
-        [ -n "$MANIFEST_DIRNAME" ] || MANIFEST_DIRNAME="${ROOT_REPOSITORY##*/}"
-        [ -n "$ROOT_REPOSITORY" ] || die "$MANIFEST_FILE records no \`repository:\` for its first project, so
-    there is no repository to clone. That file is written by \`park\`; a
-    hand-edited one is fixed by hand."
-    fi
-    # A NAME, NEVER A PATH (F7 of the review on #83). `root:` is somebody's
-    # file and the schema's own invariant is that it is relative and POSIX —
-    # but a hand-edited `root: ../../elsewhere/X` would otherwise be joined to
-    # the projects directory and cloned outside it. Checked BEFORE any path is
-    # built from it, so nothing is created to be noticed afterwards.
-    is_safe_folder_name "$MANIFEST_DIRNAME" ||
-        die "$MANIFEST_FILE records \`root: $MANIFEST_ROOT_VALUE\`, whose folder name
-    '$MANIFEST_DIRNAME' is not one: an estate folder is a single name under your
-    projects directory, with no slash and no leading dot. Nothing was cloned.
-    That file is written by \`park\`; a hand-edited one is fixed by hand."
-fi
-
-# THE ESTATE ON DISK WINS over the manifest's idea of where it is: the manifest
-# records a RELATIVE folder name and this machine's own layout is the truth
-# about where that folder sits.
-if [ "$ESTATE_PRESENT" -eq 0 ] && [ -n "$MANIFEST_DIRNAME" ] &&
-    [ "$MANIFEST_DIRNAME" != "$NAME" ]; then
-    if estate_by_name "$MANIFEST_DIRNAME"; then
-        ESTATE_PRESENT=1
-    fi
-fi
-
-# THE HOLDER BY ITS ID, when neither the name typed nor the record's folder is
-# an estate here (#243). A record goes stale the moment its holder moves -
-# `make siblings`' own `mv QuillWorks/QuillWorks Quill/Quill` - until the next
-# park rewrites it, and `resume quill`, the id, is how park files it: both
-# lookups above then miss a holder that IS on disk, and the run went on to
-# clone the record's folder BESIDE it, which is one family laid out twice.
-# `park.sh` writes `family:` from `family.yaml`'s `id:`, the same in every
-# layout of one family, so the holder is the family folder whose `family.yaml`
-# says it - by either naming rule, `is_family_folder`'s. ONE is that estate.
-# TWO OR MORE is one family laid out twice, which is ONE record that a park
-# from either rewrites: nothing here picks one and nothing is cloned over
-# either, so it is REFUSED by name, the folder to keep named as `status` names
-# it. NONE is a family that is not here, and it is cloned as before. Every
-# name `resume` was handed has been held to `is_safe_folder_name` above; the
-# one found here is held to it too before it is used.
-FOUND_BY_ID=""
-if [ "$ESTATE_PRESENT" -eq 0 ] && [ "$MANIFEST_KIND" = "family" ]; then
-    BY_ID_COUNT=0
-    BY_ID_ROWS=""
-    BY_ID_KEEP=""
-    BY_ID_KEEPS=0
-    while IFS= read -r BY_ID_FOLDER; do
-        [ -n "$BY_ID_FOLDER" ] || continue
-        BY_ID_COUNT=$((BY_ID_COUNT + 1))
-        BY_ID_ROWS="$BY_ID_ROWS      $BY_ID_FOLDER
-"
-        FOUND_BY_ID="$BY_ID_FOLDER"
-        if named_for_repository "$BY_ID_FOLDER"; then
-            BY_ID_KEEP="$BY_ID_FOLDER"
-            BY_ID_KEEPS=$((BY_ID_KEEPS + 1))
-        fi
-    done < <(family_folders_with_id "$MANIFEST_FAMILY")
-    if [ "$BY_ID_COUNT" -gt 1 ]; then
-        if [ "$BY_ID_KEEPS" -eq 1 ]; then
-            BY_ID_EXIT="Keep $BY_ID_KEEP, the folder named for its repository
-    (openRepoShape v1.1.0's layout, where \`make siblings\` moves a holder),
-    move the rest aside, and re-run \`$SELF_NAME $NAME\`."
-        else
-            BY_ID_EXIT="Keep the one folder named for its repository's last part
-    (openRepoShape v1.1.0's layout, where \`make siblings\` moves a holder),
-    move the rest aside, and re-run \`$SELF_NAME $NAME\`."
-        fi
-        die "$MANIFEST_FILE records family '$MANIFEST_FAMILY' at
-    \`root: $MANIFEST_ROOT_VALUE\`, where there is no estate. Yet
-    $BY_ID_COUNT family folders under your projects directory carry
-    \`id: $MANIFEST_FAMILY\` in their family.yaml:
-
-$BY_ID_ROWS
-    One family laid out twice is ONE record, and a park from either replaces
-    the member blocks the other parked. So nothing here picks one, and
-    nothing was cloned over either. $BY_ID_EXIT"
-    fi
-    if [ "$BY_ID_COUNT" -eq 1 ]; then
-        is_safe_folder_name "${FOUND_BY_ID##*/}" ||
-            die "the holder of family '$MANIFEST_FAMILY' is at $FOUND_BY_ID, and
-    '${FOUND_BY_ID##*/}' is not a name an estate folder may have: no slash, no
-    leading dot, and nothing but letters, digits and \`_.+@-\`. Nothing was
-    cloned. Rename the folder, then re-run \`$SELF_NAME $NAME\`."
-        if estate_here "$FOUND_BY_ID"; then
-            ESTATE_PRESENT=1
-        fi
-    fi
-fi
-
-# WHAT THE RECORD SAYS THE ESTATE IS, said once the estate on disk is known,
-# because a holder that is here knows its own repository (#236): the HOLDER
-# THIS RUN RESOLVED, whatever the record's folder is. A record goes stale the
-# moment a person moves the holder to the folder v1.1.0 names (`make
-# siblings`' own `mv`), and a lookup by the record's folder would then miss a
-# holder that is on disk and print a repository that does not exist. Nothing
-# above prints, so the order of the lines a run says is unchanged.
-if [ -n "$MANIFEST_FILE" ]; then
-    if [ "$MANIFEST_KIND" = "family" ] && [ "$ESTATE_PRESENT" -eq 1 ] &&
-        [ "$ESTATE_KIND" = "family" ] &&
-        yaml_scalar "$ESTATE_ROOT/family.yaml" repository &&
-        [ -n "$YAML_VALUE" ]; then
-        ROOT_REPOSITORY="$YAML_VALUE"
-    fi
-    say "  records         a $MANIFEST_KIND estate, root repository $ROOT_REPOSITORY"
-fi
-
-# --- (3) rebuild or refresh the estate --------------------------------------
-say ""
-say "(3) the estate"
-
-SIBLINGS_LOG=""
-# shellcheck disable=SC2329  # invoked by the EXIT trap on the next line but one
-cleanup() { [ -z "$SIBLINGS_LOG" ] || rm -f -- "$SIBLINGS_LOG"; }
-# THE TRAP BELONGS TO THE SHELL THAT DOES THE WRITING, so it is set here in
-# the main shell and never inside a `$(...)` — the defect #74 was, in the shim.
-trap cleanup EXIT
-
-# WHICH MEMBERS ALREADY HAD A WORKING CLONE, as a space-delimited list with
-# sentinel spaces so `case` can ask about one. A project name carries no space
-# — `family.py` refuses one that does — so this is a set and not a guess.
-EXISTING_SIBLINGS=" "
-# Members whose working clone was refused, so the verb is not run in them
-# either (F9 of the review on #83), and the root itself when it was refused.
-REFUSED_MEMBERS=" "
-ROOT_REFUSED=0
-
-if [ "$ESTATE_PRESENT" -eq 1 ]; then
-    say "  present         $ESTATE_DIR ($ESTATE_KIND)"
-    if [ -n "$FOUND_BY_ID" ]; then
-        say "                  found by its family.yaml id '$MANIFEST_FAMILY': the record's \`root: $MANIFEST_ROOT_VALUE\` names another folder until the next park rewrites it"
-    fi
-    if [ "$ESTATE_KIND" = "family" ]; then
-        refresh_root "holder $ESTATE_NAME" "$ESTATE_ROOT" || ROOT_REFUSED=1
-    else
-        refresh_root "root $ESTATE_NAME" "$ESTATE_ROOT" || ROOT_REFUSED=1
-    fi
-else
-    if [ -z "$ROOT_REPOSITORY" ]; then
-        # A DRY RUN ON A FRESH MACHINE CANNOT KNOW MORE THAN THIS, and saying
-        # so is the honest answer: the manifest lives in a workspace this run
-        # deliberately did not clone, so the plan genuinely stops here. It is
-        # not a refusal - nothing was asked for that could not be answered.
-        if [ "$DRY_RUN" -eq 1 ]; then
-            say "  absent          the workspace was not cloned, so the manifest that names the"
-            say "                  estate's repository could not be read. A real run clones the"
-            say "                  workspace first and then the estate."
-            say ""
-            say "resume: $NAME - --dry-run: nothing was cloned, pulled, bootstrapped or recreated."
-            exit 0
-        fi
-        die "there is no estate named '$NAME' here and no manifest to clone one
-    from, so nothing was created."
-    fi
-    ESTATE_KIND="$MANIFEST_KIND"
-    ESTATE_NAME="$MANIFEST_DIRNAME"
-    if [ "$ESTATE_KIND" = "family" ]; then
-        ESTATE_DIR="$(projects_dir_for_new)/$ESTATE_NAME"
-        ESTATE_ROOT="$ESTATE_DIR/$ESTATE_NAME"
-    else
-        ESTATE_DIR="$(projects_dir_for_new)/$ESTATE_NAME"
-        ESTATE_ROOT="$ESTATE_DIR"
-    fi
-    say "  absent          cloning $ROOT_REPOSITORY -> $ESTATE_ROOT"
-    if [ "$DRY_RUN" -eq 1 ]; then
-        say "  would clone      git clone --recurse-submodules $(clone_url_for "$ROOT_REPOSITORY") $ESTATE_ROOT"
-        say "  would run        make bootstrap in $ESTATE_ROOT"
-        [ "$ESTATE_KIND" != "family" ] || say "  would run        make siblings in $ESTATE_ROOT"
-        say ""
-        say "resume: $NAME - --dry-run: nothing was cloned, pulled, bootstrapped or recreated."
-        exit 0
-    fi
-    mkdir -p -- "$ESTATE_DIR"
-    git clone --recurse-submodules "$(clone_url_for "$ROOT_REPOSITORY")" "$ESTATE_ROOT"
-    # The clone is what makes the estate readable; from here on the facts come
-    # off disk, exactly as they would for an estate that was already here.
-    estate_here "$ESTATE_DIR" ||
-        die "$ESTATE_ROOT was cloned, but $ESTATE_DIR is not an estate: no
-    \`family.yaml\` holder and no \`project.yaml\` root. The manifest named
-    $ROOT_REPOSITORY; that repository is not a root of this shape."
-    run_make "$ESTATE_NAME" "$ESTATE_ROOT" bootstrap || {
-        REFUSED=$((REFUSED + 1))
-        say "  FINDING: \`make bootstrap\` did not exit 0 in $ESTATE_ROOT; its legs may not be placed."
-    }
-fi
-
-if [ "$ESTATE_KIND" = "family" ]; then
-    # WHICH SIBLINGS WERE ALREADY HERE, recorded BEFORE `make siblings` runs:
-    # a clone that command places is already on its tracking branch with its
-    # own bootstrap run, so fast-forwarding it again would be work for
-    # nothing. The ones that were here are the ones ruling 2 is about.
-    while IFS= read -r member; do
-        [ -e "$ESTATE_DIR/$member/.git" ] || continue
-        EXISTING_SIBLINGS="$EXISTING_SIBLINGS$member "
-    done < <(family_members "$ESTATE_ROOT/family.yaml")
-
-    if [ "$DRY_RUN" -eq 1 ]; then
-        say "  would run: make siblings   ($ESTATE_ROOT)"
-    else
-        SIBLINGS_LOG="$(mktemp)"
-        say "  --- $ESTATE_NAME: make siblings ---"
-        set +e
-        (cd "$ESTATE_ROOT" && exec make siblings) 2>&1 | tee "$SIBLINGS_LOG"
-        SIBLINGS_STATUS=${PIPESTATUS[0]}
-        set -e
-        if [ "$SIBLINGS_STATUS" -ne 0 ]; then
-            REFUSED=$((REFUSED + 1))
-            say "  FINDING: \`make siblings\` exited $SIBLINGS_STATUS; read its findings above."
-        fi
-    fi
-
-    say ""
-    say "  each member's own working clone, fast-forwarded (RULING ruling 2)"
-    while IFS= read -r member; do
-        [ -n "$member" ] || continue
-        if [ ! -e "$ESTATE_DIR/$member/.git" ]; then
-            # `make siblings` above is what places one, and it has already
-            # reported this as a finding of its own. Said again here because
-            # the line a person reads next is this list.
-            say "  [$member] still no working clone beside the holder; \`make siblings\` places one."
-            continue
-        fi
-        case "$EXISTING_SIBLINGS" in
-        *" $member "*) ;;
-        *)
-            # JUST PLACED by `make siblings`, which clones on the tracking
-            # branch and runs the member's own bootstrap. Fast-forwarding a
-            # clone one command old would be work for nothing.
-            say "  [$member] placed by \`make siblings\`: on its tracking branch, its own bootstrap run."
-            continue
-            ;;
-        esac
-        refresh_root "$member" "$ESTATE_DIR/$member" ||
-            REFUSED_MEMBERS="$REFUSED_MEMBERS$member "
-    done < <(family_members "$ESTATE_ROOT/family.yaml")
-fi
-
-# --- (4) the verb -----------------------------------------------------------
-# ONE `ARGS=` STRING, because that is the whole interface the two Makefiles
-# offer (#80): the recipe word-splits `$(ARGS)`, so an argument carrying a
-# space cannot survive the trip and this command does not pretend otherwise.
-MAKE_ARGS=""
-[ "$DRY_RUN" -eq 0 ] || MAKE_ARGS="--dry-run"
-if [ ${#PASSTHROUGH[@]} -gt 0 ]; then
-    MAKE_ARGS="${MAKE_ARGS:+$MAKE_ARGS }${PASSTHROUGH[*]}"
-fi
-
-say ""
-# shellcheck disable=SC2016  # the single quotes are LITERAL, as above
-say "(4) make resume${MAKE_ARGS:+ ARGS='$MAKE_ARGS'}   ($ESTATE_ROOT)"
-
-# THE EXIT CODE IS MAKE'S, UNCHANGED. `resume.sh`'s own 0/1/2/3 do not survive
-# make - GNU make reports ANY non-zero recipe status as its own exit 2 and
-# prints `Error <code>` - and this command neither rewrites nor rescues that:
-# the code is in make's diagnostic, and a run that refused must never read as
-# success. #80's Makefile says the same thing at the target.
-STATUS=0
-RESUME_CALL=(make resume)
-[ -z "$MAKE_ARGS" ] || RESUME_CALL+=("ARGS=$MAKE_ARGS")
-
-# A CLONE THIS RUN REFUSED DOES NOT GET THE VERB EITHER (F9 of the review on
-# #83). The holder's `make resume` is `siblings.py --make resume`, whose whole
-# flag set is `--root`, `--dry-run`, `--make` and `--make-arg`: there is no
-# exclusion to hand it, so with a refusal on the board the verb is run PER
-# NON-REFUSED SIBLING here instead, and the holder's own dispatch is used
-# whenever there is nothing to exclude - which is every ordinary run. Adding
-# an `--exclude` to `siblings.py` is a change to a PINNED template file that
-# reaches every holder through `update-shape.py`, and it is not this object's
-# to make; #82's follow-up can propose it.
-run_the_verb_per_sibling() {
-    local member status worst=0
-    say "  the holder's dispatch is NOT used: it has no way to leave a refused member out,"
-    say "  so the verb runs in each member that was not refused, and in no other."
-    while IFS= read -r member; do
-        [ -n "$member" ] || continue
-        case "$REFUSED_MEMBERS" in
-        *" $member "*)
-            say "  [$member] refused above; \`make resume\` NOT run. Nothing here was touched."
-            continue
-            ;;
-        esac
-        [ -e "$ESTATE_DIR/$member/.git" ] || continue
-        status=0
-        run_make "$member" "$ESTATE_DIR/$member" resume "$MAKE_ARGS" || status=$?
-        [ "$status" -eq 0 ] || worst="$status"
-    done < <(family_members "$ESTATE_ROOT/family.yaml")
-    return "$worst"
-}
-
-if [ "$DRY_RUN" -eq 1 ] && [ ! -f "$ESTATE_ROOT/Makefile" ]; then
-    say "  would run: make resume"
-elif [ "$ROOT_REFUSED" -eq 1 ] && [ "$ESTATE_KIND" != "family" ]; then
-    # A standalone root that was refused is one checkout, and it is the one
-    # the verb would run in. Nothing here was touched, and that includes this.
-    say "  NOT run: $ESTATE_ROOT was refused above. Nothing here was touched."
-    say "  Sort that checkout out - the lines above name what it is - and re-run."
-elif [ "$REFUSED_MEMBERS" != " " ]; then
-    set +e
-    run_the_verb_per_sibling
-    STATUS=$?
-    set -e
-else
-    set +e
-    (cd "$ESTATE_ROOT" && exec "${RESUME_CALL[@]}")
-    STATUS=$?
-    set -e
-fi
-
-# --- (5) the layout, and the summary ----------------------------------------
-say ""
-say "(5) the layout"
-if [ -n "$SIBLINGS_LOG" ] && [ -s "$SIBLINGS_LOG" ] &&
-    grep -q '^(b) the layout$' "$SIBLINGS_LOG"; then
-    # `make siblings`' OWN TABLE, reprinted rather than recomputed: two
-    # readings of "what is beside the holder" is how they start disagreeing.
-    sed -n '/^(b) the layout$/,/^$/p' "$SIBLINGS_LOG"
-elif [ "$ESTATE_KIND" = "standalone" ]; then
-    printf '  %-9s %-18s %-22s %s\n' "what" "name" "state" "branch"
-    printf '  %-9s %-18s %-22s %s\n' "root" "$ESTATE_NAME" "the assembly root" \
-        "$(git -C "$ESTATE_ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
-    while IFS= read -r line; do
-        [ -n "$line" ] || continue
-        printf '  %-9s %-18s %-22s %s\n' "leg" "$line" "mounted" \
-            "$(git -C "$ESTATE_ROOT/$line" rev-parse --abbrev-ref HEAD 2>/dev/null || printf '?')"
-    done < <(git -C "$ESTATE_ROOT" config --file .gitmodules \
-        --get-regexp '^submodule\..*\.path$' 2>/dev/null | sed 's/^[^ ]* //' || true)
-else
-    say "  (no layout table: \`make siblings\` did not run)"
-fi
-
-say ""
-say "resume: $ESTATE_NAME - \`make resume\` exited $STATUS; $REFUSED refusal(s) or finding(s) above."
-say "  ct / cts land you in the feature the record named active; agent sessions do not travel,"
-say "  and a handoff document is the bridge for those."
-if [ "$DRY_RUN" -eq 1 ]; then
-    say "  --dry-run: nothing was cloned, pulled, bootstrapped or recreated."
-fi
-
-[ "$STATUS" -eq 0 ] || exit "$STATUS"
-# A REFUSAL IS NOT A PASS, and neither is a skip: a run that could not
-# fast-forward a member must not exit 0, or somebody reads it as the estate
-# being current when part of it is not (#80's rule, for the same reason).
-[ "$REFUSED" -eq 0 ] || exit 1
-exit 0
diff --git a/scripts/bootstrap.py b/scripts/bootstrap.py
new file mode 100755
index 00000000..f92f8047
--- /dev/null
+++ b/scripts/bootstrap.py
@@ -0,0 +1,1144 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""The one command an engineer runs after `git clone --recurse-submodules`.
+
+    git clone --recurse-submodules <assembly-root-url>
+    cd <Project>
+    make bootstrap          # or: python3 scripts/bootstrap.py (python on Windows)
+
+WHAT IT DOES, in order:
+
+  (a) MOVES EACH LEG OFF DETACHED HEAD WITHOUT MOVING THE PIN. A fresh
+      recursive clone leaves every submodule detached at the pinned commit —
+      the thing that makes people hate submodules, and the first thing an
+      engineer meets on day one. Bootstrap creates the tracking branch AT the
+      pinned commit, so the WORKING state is branch-shaped while the RECORDED
+      state stays an exact pin. It never advances the pin. A tracking branch
+      that already exists is FAST-FORWARDED to the pin when its tip is an
+      ancestor of it, because that move loses nothing: it is the state
+      `bump-leg.py` leaves, the leg detached at the new pin over a branch at
+      the old one. A branch AHEAD of the pin with no commit of its own, its
+      tip being its upstream's remote-tracking ref, is MOVED BACK to the pin
+      from a leg detached there, because that loses nothing either: it is
+      what git's own recursive clone leaves when the leg's remote has moved
+      past the pin, and the remote-tracking ref still holds every commit.
+      Any other branch holding a commit the pin does not contain is never
+      moved; bootstrap prints both and leaves them alone. A leg DETACHED at a
+      commit that is not the pin is never moved off it either, whether its
+      branch is at the pin, behind it, ahead of it or not there at all, and
+      whatever the branch or `origin` holds: a commit made there is on no
+      branch, and a checkout would leave it only in the reflog, so bootstrap
+      says where the leg is instead, and so is one whose HEAD is on a ref
+      outside `refs/heads/`, where a commit lands on that ref (#704). A leg
+      with a merge, a cherry-pick, a revert, a rebase or an `am` in progress
+      is not moved at all: a checkout ends the first three, carrying what
+      they staged onto the branch, and leaves the last two to go on over
+      it, as it does a cherry-pick or a revert of several commits whose
+      stop was committed by hand (its `sequencer/todo` is still there), so
+      the line names the operation and the commands that finish or abort
+      it (#704). A move git would make over an IGNORED file at a path
+      the pin tracks is refused, in git's words, as one over an untracked
+      file is. A branch no command can be given (a NUL,
+      or a lone surrogate this system cannot encode) is never tried: the leg
+      is left as it is and the line says why (#455); step (b)'s manifest
+      validator names the key when the manifest holds it. Advancing a pin
+      remains an explicit commit in this repository — see `README.md`, "The
+      lockstep invariant". This is why `.gitmodules` carries no `branch=`:
+      that would buy the same ergonomics by weakening the pin, and then "what
+      commit is this project" would have two answers.
+
+  (b) RUNS THE NEUTRAL VALIDATORS — naming, manifest, lockstep pins. These are
+      the only ones a fork with no review lane and no wallet register has, and
+      they are enough: a project with no overlays is fully conformant. It then
+      prints ONE line if this machine can tell OFFLINE that the upstream shape
+      has moved past the pinned commit — see `shape_upstream_notice`, which
+      adds no network call and is silent when it cannot answer.
+
+  (c) READS A WALLET REVIEW-AUTHORITY REGISTER IF ONE EXISTS, and prints the
+      grants whose objects name this project. If none is found it prints
+      exactly `authority is not wallet-carried in this org` and CONTINUES. The
+      readout degrades; it never fails. An organisation that has not adopted
+      wallet-carried authority is not misconfigured, and a bootstrap that
+      failed there would have made the layout load-bearing again.
+
+  (d) EXITS 0 unless a validator failed, and 2 where step (a) or the
+      upstream notice cannot start git, refused `git-not-runnable` as the
+      validators refuse it (#694).
+
+SCHEMA-NEUTRAL BY CONTRACT. A one-repository project runs the same command:
+step (a) is a no-op where there are no submodules, and steps (c) and (d) are
+unchanged. A bootstrap that existed only for electing projects would make the
+election worth something operationally, which is exactly what the ratified
+doctrine forbids.
+"""
+
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import shlex
+import subprocess
+import sys
+from collections.abc import Iterator
+from contextlib import contextmanager
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from repo_shape import (  # noqa: E402
+    Refusal, escape_unencodable_stdout, find_repo_root, git_out, load_yaml,
+    recorded_gitlink, spelled,
+)
+
+DEGRADE_LINE = "authority is not wallet-carried in this org"
+
+#: The two OFFLINE ways this command can learn where the upstream shape is.
+#: Both are opt-in and neither is consulted unless it is already there:
+#: `SHAPE_UPSTREAM_PATH` points at a clone of openRepoShape on this machine,
+#: and `.shape-upstream-tip` is a 40-hex commit a nightly job or a human wrote
+#: into the root. NO NETWORK CALL IS ADDED HERE, deliberately — `make
+#: bootstrap` runs in organisations that cannot reach the upstream at all, and
+#: a bootstrap that paused to ask GitHub a question would have made the shape
+#: a dependency again, which is the whole thing the copies exist to avoid.
+SHAPE_UPSTREAM_ENV = "SHAPE_UPSTREAM_PATH"
+SHAPE_UPSTREAM_CACHE = ".shape-upstream-tip"
+COMMIT_40 = re.compile(r"^[0-9a-fA-F]{40}$")
+#: Where a remote-tracking ref lives. Only an upstream there holds a branch's
+#: commits on the remote's behalf; an upstream of `.` is another local branch.
+REMOTE_TRACKING = "refs/remotes/"
+#: What step (a) prints under git's own lines when git refuses a move.
+NOTHING_ELSE = ("          nothing else is tried; the recorded pin is "
+                "authoritative. Deal with what git said and run bootstrap "
+                "again.")
+#: What a leg's git dir holds while git has an operation in progress there,
+#: each with what step (a) calls it and the command that ends it, asked in
+#: this order (#704): the two rebases first, as git's own `status` asks
+#: them, since a pick a rebase stops on is the rebase's to finish or abort.
+IN_PROGRESS = (
+    ("rebase-apply/applying", "an `am`", "am"),
+    ("rebase-apply", "a rebase", "rebase"),
+    ("rebase-merge", "a rebase", "rebase"),
+    ("MERGE_HEAD", "a merge", "merge"),
+    ("CHERRY_PICK_HEAD", "a cherry-pick", "cherry-pick"),
+    ("REVERT_HEAD", "a revert", "revert"),
+)
+#: What a cherry-pick or a revert of SEVERAL commits leaves while it is not
+#: done, asked after `IN_PROGRESS`: its stop committed by hand takes the
+#: head file away and leaves this, whose first word says which it is.
+SEQUENCER_TODO = "sequencer/todo"
+#: The remedy of the `git-not-runnable` refusal (#694).
+GIT_NOT_RUNNABLE = (
+    "Remediation: put git on PATH and run this again. Step (a) reads each "
+    "leg's pin and moves the leg through git, and the validators read the "
+    "pins through git, so without it nothing here can be placed or checked.")
+REGISTER_RELPATH = Path("governance") / "review-authority" / "register.yaml"
+VALIDATORS = (
+    ("naming", ["scripts/validate-repository-naming.py", "--project",
+                "project.yaml", "--quiet"]),
+    ("manifest", ["scripts/validate-manifest.py"]),
+    ("pins", ["scripts/validate-pins.py"]),
+)
+
+
+def _run(root: Path, args: list[str]) -> int:
+    # Flush first: this process's own stdout is block-buffered when it is a
+    # pipe, and a child writing straight to the fd would otherwise appear
+    # BEFORE the heading that introduces it.
+    sys.stdout.flush()
+    proc = subprocess.run([sys.executable, *args], cwd=str(root), check=False)
+    sys.stdout.flush()
+    return proc.returncode
+
+
+def _try_git(args: list[str], cwd: Path) -> str | None:
+    try:
+        return git_out(args, cwd=cwd)
+    except Refusal:
+        return None
+
+
+@contextmanager
+def _git_runs(unread: str) -> Iterator[None]:
+    """`git-not-runnable`, exit 2, where git could not be STARTED in the
+    block (#694), with `unread` saying what was being done.
+
+    `git_out` and `_git_says` raise `OSError` then, and nothing here caught
+    it: `make bootstrap` with no git on PATH ended in a `FileNotFoundError`
+    traceback, exit 1, which is `bootstrap FAILED`'s code. The code and the
+    words are the validators'. Which `OSError` is git's is read as
+    `validate-pins.py` reads it, by NAME: one whose `filename` is `git`, or
+    a nameless `FileNotFoundError` or `PermissionError`, which is what
+    Windows raises for a program it cannot start. An error that names a
+    directory, which `subprocess` raises for a `cwd` it cannot enter, is
+    not git's, and goes on as it did.
+    """
+    try:
+        yield
+    except OSError as exc:
+        if exc.filename != "git" and (exc.filename is not None or not (
+                isinstance(exc, (FileNotFoundError, PermissionError)))):
+            raise
+        raise Refusal("git-not-runnable",
+                      f"{unread}: git could not be run "
+                      f"({exc.strerror or exc})", GIT_NOT_RUNNABLE) from exc
+
+
+def _argument_fault(branch: str) -> str | None:
+    """What stops `branch` being an argument to a command, or `None` (#455).
+
+    WHAT WAS WRONG. A branch reaches git as argv (`rev-parse --verify --quiet
+    refs/heads/<branch>`, `checkout -q -b <branch> <pin>`) through `_try_git`,
+    which catches `Refusal` and nothing else, and `subprocess` cannot hand a
+    command a NUL (`ValueError: embedded null byte`) or a lone surrogate the
+    system cannot encode (`UnicodeEncodeError`). `tracking_branch: "a\\ud83db"`
+    or a leg's `branch: "a\\x00b"` ended `make bootstrap` in a traceback from
+    `subprocess.py` in step (a), one step before `validate-manifest.py`, the
+    validator that names the key, was reached.
+
+    ASKED BEFORE ANY COMMAND IS BUILT FROM THE VALUE, and not read off an
+    exception `_try_git` would then have to swallow: a `UnicodeDecodeError`,
+    which `git_out` raises over output that is not UTF-8, is a `ValueError`
+    too, and catching that there would read a leg whose HEAD is on such a
+    branch as detached. Only a NUL and a lone surrogate are looked for; a
+    character the system's encoding merely lacks is not this fix's.
+
+    A surrogate that is ONE BYTE of a name is not refused. POSIX spells a name
+    that is not UTF-8 with U+DC80 to U+DCFF and `os.fsencode` writes each back
+    as the single byte it stands for, so git is handed that byte, as it was
+    before this check. Any other surrogate has no byte: `os.fsencode` raises,
+    or (`surrogatepass`, Windows) writes the three bytes of a sequence that
+    is not UTF-8 for ANY of them, so a lone surrogate is never handed to git
+    there either, where a `CreateProcess` would pass it on mangled. The answer
+    is `os.fsencode`'s own, so it is the system's and not a list kept here.
+    """
+    for char in branch:
+        if char == "\x00":
+            return "U+0000, a NUL"
+        if "\ud800" <= char <= "\udfff" and _fsencoded_length(char) != 1:
+            return f"U+{ord(char):04X}, a lone surrogate"
+    return None
+
+
+def _fsencoded_length(char: str) -> int:
+    """How many bytes `os.fsencode` writes for `char`; 0 when it cannot."""
+    try:
+        return len(os.fsencode(char))
+    except UnicodeEncodeError:
+        return 0
+
+
+def _say_not_tried(where: str, named: str, fault: str) -> None:
+    """A branch `_argument_fault` found: no command was run with it. The leg
+    stays where it is, and the line says which of the three places the
+    person's value can have come from holds it (#455)."""
+    print(f"  {where}: could not create branch {named}: it holds {fault}, "
+          "which no command can be given as an argument; the leg is left as "
+          "it is")
+    print("          the branch is the leg's `branch:`, else `--branch`, else "
+          "`tracking_branch`. Give that one a name git can create and run "
+          "bootstrap again.")
+
+
+def _short(sha: str | None) -> str:
+    return sha[:12] if sha else "?"
+
+
+def _git_says(args: list[str], cwd: Path) -> list[str] | None:
+    """`None` when `git <args>` succeeds in `cwd`, else the lines git wrote
+    to say why not (never an empty list, and never a blank line).
+
+    `_try_git` answers only whether a command worked, which is all a read
+    needs. A MOVE git refuses has a reason the person has to act on (an
+    untracked file in the way, a branch another worktree has checked out),
+    so bootstrap prints git's own words rather than a guess. The bytes are
+    decoded here, with `replace`, so no locale's codec decides whether the
+    reason can be read. The blank line git puts between two paragraphs is
+    dropped: printed under the indent, it was a line of trailing spaces.
+    """
+    proc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True,
+                          check=False)
+    if proc.returncode == 0:
+        return None
+    said = proc.stderr.decode("utf-8", "replace").splitlines()
+    verb = args[2] if args[0] == "-c" else args[0]
+    return [line.rstrip() for line in said if line.strip()] or [
+        f"`git {verb}` exited {proc.returncode}"]
+
+
+def _head_of(sub: Path) -> tuple[str | None, str | None]:
+    """The commit the leg has checked out, and the ref HEAD is on (`None`
+    when it is detached).
+
+    The ref is read as BYTES and decoded as this system decodes a name it
+    is given (`os.fsdecode`), so a branch whose name is not UTF-8 reads
+    back as the `refs/heads/<branch>` built from the same name. `git_out`'s
+    strict decoding raised `UnicodeDecodeError` over it: a second run with
+    `--branch` such a name ended in a traceback in `place_at_pin`, and the
+    check of where `checkout -b` left HEAD would end the first (#704)."""
+    try:
+        ref = git_out(["symbolic-ref", "--quiet", "HEAD"], cwd=sub,
+                      binary=True)
+    except Refusal:
+        ref = None
+    return (_try_git(["rev-parse", "--verify", "--quiet", "HEAD"], sub),
+            None if ref is None else os.fsdecode(ref.rstrip(b"\r\n")))
+
+
+def _is_ancestor(sub: Path, commit: str | None, of: str | None) -> bool:
+    """Whether `commit` is an ancestor of `of`, as `git merge-base
+    --is-ancestor` answers it. A commit this leg has not fetched is not
+    known to be one, and is answered no."""
+    return commit is not None and of is not None and _try_git(
+        ["merge-base", "--is-ancestor", commit, of], sub) is not None
+
+
+def _upstream_holding(sub: Path, branch: str, local: str) -> str | None:
+    """The remote-tracking ref `branch` builds on, when the branch tip
+    `local` IS that ref's commit: a branch with no commit of its own.
+
+    `None` for every other branch: one with no upstream, one whose upstream
+    is another local branch (`branch.<name>.remote` of `.`), one whose
+    remote-tracking ref is not there (never fetched, or pruned) and one
+    whose tip is not the upstream's. The two are compared by object id.
+    `for-each-ref` names the upstream whether or not its ref exists, and
+    takes the branch after `refs/heads/`, where git reads no option.
+    """
+    upstream = _try_git(["for-each-ref", "--format=%(upstream)",
+                         f"refs/heads/{branch}"], sub)
+    if not upstream or not upstream.startswith(REMOTE_TRACKING):
+        return None
+    held = _try_git(["rev-parse", "--verify", "--quiet", upstream], sub)
+    return upstream if held == local else None
+
+
+def _held_upstream_past_the_pin(sub: Path, branch: str, local: str,
+                                pin: str | None) -> str | None:
+    """`_upstream_holding`'s ref when `move_back_to_pin` loses nothing,
+    else `None`: the branch is AHEAD of the pin, the pin an ancestor of its
+    tip; it has no commit of its own; and HEAD is detached AT the pin, so
+    no file changes. Every other branch past the pin keeps its refusal."""
+    upstream = _upstream_holding(sub, branch, local)
+    if (upstream is None or not _is_ancestor(sub, pin, local)
+            or _head_of(sub) != (pin, None)):
+        return None
+    return upstream
+
+
+def _check_out(sub: Path, branch: str,
+               pin: str) -> tuple[bool, list[str] | None]:
+    """`git checkout <branch>`, judged by WHERE HEAD IS AFTERWARDS, not by
+    git's exit code. Returns whether HEAD is on the branch at the pin, and
+    git's lines when it exited non-zero (never `None` when HEAD is not).
+
+    The two disagree both ways. A checkout git refused (a stale
+    `index.lock`, a local edit in the way) leaves HEAD where it was, and a
+    later run used to print `on <branch>` over a leg still detached. A
+    post-checkout hook's exit status is the checkout's own, so a hook that
+    fails after HEAD has moved makes git exit non-zero over a checkout that
+    happened, which is not a refusal.
+
+    `--no-overwrite-ignore` (#704): git's default overwrites an IGNORED
+    file at a path the branch tracks, silently, where it refuses an
+    untracked one; with it, git refuses both, in the same words.
+    """
+    why = _git_says(["checkout", "-q", "--no-overwrite-ignore", branch], sub)
+    if _head_of(sub) == (pin, f"refs/heads/{branch}"):
+        return True, why
+    return False, why or [
+        "`git checkout` exited 0, and HEAD is not on the branch at the pin"]
+
+
+def _move_and_check_out(sub: Path, branch: str,
+                        pin: str) -> tuple[bool, bool, list[str] | None]:
+    """From HEAD DETACHED AT THE PIN, or on ANOTHER BRANCH (#603, D1):
+    `branch -f <branch> <pin>`, then `_check_out` of the branch.
+
+    From the pin the branch is by then the commit already checked out, so
+    no file in the leg changes, a local edit included. From another branch
+    the checkout changes files, as `place_at_pin`'s does, and git refuses
+    it where a local change to a file that differs, or an untracked or
+    IGNORED file (#704), is in the way: the branch has moved by then, and
+    HEAD has not. A leg with an operation in progress is never brought
+    here: `checkout_tracking_branch` refuses it first (#704).
+
+    Returns whether the branch moved, whether HEAD is on it at the pin, and
+    git's lines (`None` when both steps exited 0). The checkout runs only
+    once `branch -f` has worked. A branch that moved is left at the pin when
+    the checkout is refused, never put back: putting it back is a second
+    ref write a stale lock refuses as well, and the next run finds the
+    branch at the pin, which is `place_at_pin`'s state, and says again
+    whether it could check it out. Not `checkout -B`: git 2.43 resets a
+    branch another worktree has checked out with it, leaving that
+    worktree's files behind its own HEAD, where `branch -f` refuses.
+    """
+    why = _git_says(["branch", "-f", branch, pin], sub)
+    if why is not None:
+        return False, False, why
+    placed, why = _check_out(sub, branch, pin)
+    return True, placed, why
+
+
+def _say_lines(why: list[str]) -> None:
+    for line in why:
+        print(f"          {spelled(line.strip())}")
+
+
+def _say_refused(first: str, why: list[str]) -> None:
+    """A move git refused: `first`, git's own lines under it, spelled
+    (#391), then what to do."""
+    print(first)
+    _say_lines(why)
+    print(NOTHING_ELSE)
+
+
+def _say_after(why: list[str] | None, moved: bool = True) -> None:
+    """What git said when it exited non-zero AFTER HEAD reached the branch
+    (a failing post-checkout hook): the move happened and its line has been
+    printed, so git's words follow it as they are, not as a refusal.
+
+    `moved` is whether the checkout changed where HEAD is. HEAD already on
+    the branch at the pin, there was nothing to check out, so `checked out,
+    and then git said:` over a stale `.git/index.lock` was false (#533). What
+    is true of that state whatever git exited over (a stale lock, a failing
+    post-checkout hook, an unmerged index) is that there was nothing to check
+    out, so that is what it says, and never `refused`: a hook failing is not
+    a refusal. Git's lines follow either way: the same lock blocks the
+    person's next commit.
+    """
+    if why:
+        print("          checked out, and then git said:" if moved else
+              "          nothing to check out, and then git said:")
+        _say_lines(why)
+
+
+def _place_of(current: str | None) -> str:
+    """Where HEAD is, for a line that names it: `detached`, or `on <branch>`
+    with the branch spelled (#391)."""
+    if current is None:
+        return "detached"
+    return "on " + spelled(current.split("refs/heads/", 1)[-1])
+
+
+def _say_left(head: str | None, current: str, named: str) -> None:
+    """The line under `fast-forwarded` (#603), or under `on <branch>` or
+    `created` (#704), when the leg started on ANOTHER branch, `current`,
+    and is on the tracking branch `named` now.
+
+    The person is told, since their next commit lands on `named`. P9
+    (`place_at_pin`) used to say nothing of the branch it left, where T7
+    (`fast_forward_to_pin`) said it for the same move (#704). `head` is
+    `None` for a branch with no commit yet, which has no commit to keep, so
+    it is said so. Its own function, so that `fast_forward_to_pin` stays
+    within Sonar's cognitive-complexity limit (S3776).
+    """
+    kept = ("a branch with no commit yet" if head is None
+            else "which keeps its commits")
+    print(f"          the leg was {_place_of(current)}, {kept}; it is on "
+          f"{named} now")
+
+
+def _say_keep(options: str = "the pin or the branch") -> None:
+    """What to do about a checkout step (a) will not move, in the words
+    both refusals of it share. Nothing moves."""
+    print("          not moving the checkout off it. Keep any commit made "
+          f"there on a branch, check out {options} in the leg, and run "
+          "bootstrap again.")
+
+
+def _say_neither(label: str, state: str, head: str | None,
+                 current: str | None) -> None:
+    """The checkout is not one a move starts from: `state` says what the
+    branch is to the pin, and the line names where the leg stands instead.
+    Nothing moves. A commit made on a leg detached off the pin is on no
+    branch, so checking the branch out would leave it only in the reflog,
+    and one made on a HEAD on a ref outside `refs/heads/` lands on that ref
+    (#704). A leg on another branch is not said here (#603): that branch
+    holds its commits, so the leg is moved off it."""
+    print(f"  {label}: {state}, and the checkout is at {_short(head)} "
+          f"({_place_of(current)}), which is neither")
+    _say_keep()
+
+
+def _on_a_branch(current: str | None) -> bool:
+    """Whether HEAD is on a branch, `refs/heads/<name>`, one with no commit
+    yet included: the one checkout besides the pin a move starts from."""
+    return current is not None and current.startswith("refs/heads/")
+
+
+def _in_progress(sub: Path) -> tuple[str, str, str] | None:
+    """The `IN_PROGRESS` row of the operation git has in progress in the
+    leg, or `None` (#704).
+
+    Asked of the leg's own git dir, which `git rev-parse --git-dir` names
+    (a submodule's is under the root's `.git/modules/`, a linked
+    worktree's under the leg's `worktrees/`, and each operation's state is
+    that worktree's own). Read as bytes and decoded as the system decodes a
+    path, so no name of a directory can fail the read. A leg git names no
+    git dir for has nothing to read here, and the move after this says what
+    git says of it.
+    """
+    try:
+        said = git_out(["rev-parse", "--git-dir"], cwd=sub, binary=True)
+    except Refusal:
+        return None
+    gitdir = sub / os.fsdecode(said.rstrip(b"\r\n"))
+    for row in IN_PROGRESS:
+        if os.path.lexists(gitdir / row[0]):
+            return row
+    return _sequence_in_progress(gitdir)
+
+
+def _sequence_in_progress(gitdir: Path) -> tuple[str, str, str] | None:
+    """A cherry-pick or a revert of several commits that is not done, or
+    `None` (rv704's S1 on #704).
+
+    `git cherry-pick A B` stops on a conflict in A, the person resolves it
+    and commits by hand: `CHERRY_PICK_HEAD` is gone, and `git status` still
+    says `Cherry-pick currently in progress.` and to run `git cherry-pick
+    --continue`, which picks B onto wherever HEAD is by then. A move onto
+    the tracking branch put B there. `sequencer/todo` is what is left, and
+    its first word is `revert` for a revert and `pick` for a cherry-pick;
+    a file that cannot be read is taken as the cherry-pick, the commoner."""
+    todo = gitdir / SEQUENCER_TODO
+    if not os.path.lexists(todo):
+        return None
+    try:
+        first = todo.read_bytes().split(None, 1)[:1]
+    except OSError:
+        first = []
+    if first == [b"revert"]:
+        return SEQUENCER_TODO, "a revert", "revert"
+    return SEQUENCER_TODO, "a cherry-pick", "cherry-pick"
+
+
+def _say_in_progress(label: str, path: str,
+                     row: tuple[str, str, str]) -> None:
+    """A leg with an operation in progress (#704): what is in progress,
+    that nothing moved, and the two commands that end it, the leg's path
+    shell-quoted, then spelled, as `move_back_to_pin` prints its command.
+
+    No move is made from here. A checkout of the tracking branch, even from
+    HEAD on it already or detached at the pin, ends a merge, a cherry-pick
+    or a revert, taking away the head file `--continue` reads and carrying
+    the staged result onto the branch, and it puts a rebase or an `am` on
+    the branch, which goes on from there, as a cherry-pick or a revert of
+    several commits does once its stop is committed by hand (its
+    `sequencer/todo`); `merge --ff-only` refuses some of them and not
+    others. It is the operation's own to finish or abort, so every such leg
+    is refused alike, before any path of step (a) is chosen."""
+    marker, doing, verb = row
+    command = f"git -C {spelled(shlex.quote(path))} {verb}"
+    print(f"  {label}: {doing} is in progress in the leg ({marker} is in its "
+          "git dir), so nothing moved")
+    print(f"          finish it (`{command} --continue`) or abort it "
+          f"(`{command} --abort`), then run bootstrap again.")
+
+
+def place_at_pin(sub: Path, label: str, branch: str, pin: str) -> None:
+    """Step (a) for a leg whose tracking branch IS the pin: check it out,
+    and say `on <branch>` only when HEAD is on it afterwards.
+
+    A checkout git refuses is said in git's words, and the leg stays where
+    it is. It used to be ignored and the `on` line printed anyway, over a
+    leg left detached (a stale `index.lock`) or on another branch (a local
+    edit in the way): the next commit made there was on no branch, or on
+    the wrong one, under a line saying otherwise.
+
+    HEAD is read first (#533). Detached at a commit that is NOT the pin, the
+    leg is left there, as `fast_forward_to_pin` leaves it. `bump-leg.py` to
+    a branch's own tip, then a commit made on the detached leg, then
+    bootstrap, checked the branch out and printed `on <branch> at <pin>`
+    over a commit that was then on no branch, held by HEAD's reflog alone.
+    Detached AT the pin, or already on the branch, the checkout is as it was.
+    On ANOTHER branch it is as it was too: that branch holds its commits,
+    and the line under `on <branch>` now says the leg left it, as T7's does
+    (#704). A HEAD on a ref outside `refs/heads/` (`git symbolic-ref HEAD
+    refs/remotes/origin/main`) is left where it is, as T7 leaves it: a
+    commit made there lands on that ref, and this placed the leg while T7
+    said `which is neither` of the same HEAD (#704).
+    """
+    named = spelled(branch)
+    head, current = _head_of(sub)
+    if not (_on_a_branch(current) or (current is None and head == pin)):
+        _say_neither(label, f"branch {named} is at the pin {_short(pin)}",
+                     head, current)
+        return
+    already = (head, current) == (pin, f"refs/heads/{branch}")
+    placed, why = _check_out(sub, branch, pin)
+    if not placed:
+        _say_refused(f"  {label}: branch {named} is at the pin "
+                     f"{_short(pin)}, and git refused to check it out:", why)
+        return
+    print(f"  {label}: on {named} at {_short(pin)} (branch tip == pin)")
+    if current not in (None, f"refs/heads/{branch}"):
+        _say_left(head, current, named)
+    _say_after(why, moved=not already)
+
+
+def fast_forward_to_pin(sub: Path, label: str, branch: str, local: str,
+                        pin: str, remote: str | None) -> None:
+    """Step (a) for a leg whose tracking branch is BEHIND the pin (#475).
+
+    The branch tip `local` is an ancestor of `pin`, so moving the branch to
+    the pin loses nothing. It is the state `bump-leg.py` leaves: the leg
+    DETACHED at the new pin over the branch an earlier bootstrap placed at
+    the old one. It used to stay detached, and the next commit made in the
+    leg was on no branch. The branch is moved, and the leg put on it, from
+    exactly three checkouts:
+
+    - HEAD on the branch itself: `merge --ff-only`, which moves the working
+      tree too, and moves nothing when a local change to a file the move
+      changes, or an untracked file, is in the way, or an ignored one
+      (`--no-overwrite-ignore`, #704). `merge.autostash` is
+      off for it: with it on, git stashes the change, moves the branch,
+      applies the stash back into conflicts and exits 0, and the leg was
+      left unmerged under a line saying it had been fast-forwarded. `-c`,
+      not `--no-autostash`, which a git before 2.27 refuses as an unknown
+      option; such a git has no autostash and ignores the key.
+    - HEAD detached AT THE PIN: `_move_and_check_out`.
+    - HEAD on ANOTHER BRANCH, a `refs/heads/` ref that is not the tracking
+      branch (#603, D1 of its checklist triage): `_move_and_check_out`. The
+      other branch is not touched and keeps every commit made on it, so the
+      move loses no commit and that work is no reason to leave the leg
+      there. `place_at_pin` already checks the tracking branch out from
+      this checkout when it is AT the pin; leaving the leg for a branch
+      BEHIND the pin was a difference nobody could explain (#458). The
+      checkout changes files from here, so git can refuse it over a local
+      edit or an untracked or ignored file, and `_move_and_check_out` says
+      what is left then. A HEAD on a branch with no commit yet takes this
+      path too, as it does in `place_at_pin`. When the checkout is made,
+      one line under the `fast-forwarded` one says the leg left that
+      branch, and that it keeps its commits, since the next commit made in
+      the leg is on the tracking branch now. NO COMMIT IS LOST, AND NOTHING
+      ELSE A PERSON HAS (#704): git used to overwrite an IGNORED file at a
+      path the pin tracks, here, in `place_at_pin`, in the missing-branch
+      path and in the on-branch `merge --ff-only`, and a checkout ended a
+      merge in progress on the other branch, its `MERGE_HEAD` removed and
+      its staged result carried onto the tracking branch. Every move now
+      refuses the first, and no leg with an operation in progress reaches
+      here (`_say_in_progress`).
+
+    A LEG DETACHED OFF THE PIN IS LEFT WHERE IT IS: a commit made on the
+    detached leg after the bump is on no branch, and checking the branch
+    out would leave it only in the reflog. That is said, with what to do,
+    and nothing moves. So is a HEAD on a ref outside `refs/heads/`, which
+    `place_at_pin` now leaves too (#704).
+
+    `label` is the leg as `checkout_tracking_branch` prints it, already
+    spelled; the branch names and git's own lines are spelled here (#391).
+    """
+    named = spelled(branch)
+    head, current = _head_of(sub)
+    other_branch = (_on_a_branch(current)
+                    and current != f"refs/heads/{branch}")
+    if current == f"refs/heads/{branch}":
+        why = _git_says(["-c", "merge.autostash=false", "merge", "--ff-only",
+                         "--no-overwrite-ignore", "-q", pin], sub)
+        moved = placed = why is None
+    elif other_branch or (current is None and head == pin):
+        moved, placed, why = _move_and_check_out(sub, branch, pin)
+    else:
+        _say_neither(label, f"branch {named} tip {_short(local)} is behind "
+                     f"the PIN {_short(pin)}", head, current)
+        return
+    if not placed:
+        if moved:
+            first = (f"  {label}: branch {named} moved {_short(local)} -> "
+                     f"{_short(pin)}, the pin, and git refused to check it "
+                     "out:")
+        else:
+            first = (f"  {label}: branch {named} tip {_short(local)} is "
+                     f"behind the PIN {_short(pin)}, and git refused to move "
+                     "it:")
+        _say_refused(first, why or [])
+        return
+    note = ""
+    if remote is not None and remote != pin:
+        note = (f"; origin/{named} is {_short(remote)}, which the pin "
+                "deliberately does NOT follow")
+    print(f"  {label}: branch {named} fast-forwarded {_short(local)} -> "
+          f"{_short(pin)}, the pin{note}")
+    if other_branch:
+        _say_left(head, current, named)
+    _say_after(why)
+
+
+def move_back_to_pin(sub: Path, label: str, path: str, branch: str,
+                     local: str, pin: str, upstream: str) -> None:
+    """Step (a) for a tracking branch AHEAD of the pin with no commit of
+    its own (#475).
+
+    `git clone --recurse-submodules` makes each leg's branch at its
+    remote's tip and leaves HEAD detached at the pin. Where the leg's
+    remote has moved past the pin, which is the ordinary state of an active
+    project, the branch is ahead of the pin, and step (a) used to leave the
+    leg detached, where the next commit made in it is on no branch: the
+    harm `bump-leg.py` left, met on the first day instead.
+
+    The caller has made sure that moving the branch back loses nothing: its
+    tip `local` IS the commit of `upstream`, a remote-tracking ref, which
+    still holds every commit the branch has past the pin; and HEAD is
+    detached AT the pin, so `_move_and_check_out` changes no file. The one
+    line printed says where those commits are and names the command that
+    brings the branch forward, which is the person's to run: what this
+    project records is the pin. The command's leg path and upstream are
+    shell-quoted, then spelled, as `scripts/family.py` quotes the commands
+    it prints.
+
+    "Nothing is lost" holds at the last fetch. A commit the branch held
+    that the remote has since DROPPED, by a force-push to the leg's shared
+    branch, is left only in the reflog once the next fetch moves the
+    remote-tracking ref; nothing in the leg can see that before it fetches.
+    """
+    named = spelled(branch)
+    short = upstream[len(REMOTE_TRACKING):]
+    held = spelled(short)
+    moved, placed, why = _move_and_check_out(sub, branch, pin)
+    if not placed:
+        if moved:
+            first = (f"  {label}: branch {named} moved back {_short(local)} "
+                     f"-> {_short(pin)}, the pin ({held} still holds "
+                     f"{_short(local)}), and git refused to check it out:")
+        else:
+            first = (f"  {label}: branch {named} tip {_short(local)} is "
+                     f"ahead of the PIN {_short(pin)} with no commit {held} "
+                     "lacks, and git refused to move it back:")
+        _say_refused(first, why or [])
+        return
+    print(f"  {label}: branch {named} moved back {_short(local)} -> "
+          f"{_short(pin)}, the pin; nothing is lost, {held} still holds "
+          f"those commits, and `git -C {spelled(shlex.quote(path))} merge "
+          f"--ff-only {spelled(shlex.quote(short))}` brings the branch "
+          "forward")
+    _say_after(why)
+
+
+def _stays(sub: Path, branch: str, pin: str) -> str:
+    """Where the checkout stays, for the `not moving an existing branch`
+    line (#533): `on <branch> at its tip` when HEAD is on the branch that
+    holds the commits the pin lacks, `at the pin` when it is detached there,
+    and else `at <sha> (detached)` or `at <sha> (on <other branch>)`, as
+    `_say_neither` names the place. The line said `at the pin` whatever the
+    checkout was, which was false for a HEAD on the branch itself."""
+    head, current = _head_of(sub)
+    if current == f"refs/heads/{branch}":
+        return f"on {spelled(branch)} at its tip"
+    if current is None and head == pin:
+        return "at the pin"
+    return f"at {_short(head)} ({_place_of(current)})"
+
+
+def create_at_pin(sub: Path, label: str, branch: str, pin: str,
+                  remote: str | None) -> None:
+    """Step (a) for a leg whose tracking branch IS NOT THERE: `checkout -b
+    <branch> <pin>`, from HEAD detached at the pin or on a branch, a branch
+    with no commit yet included.
+
+    A checkout git refuses is said in git's own words under the line that
+    says the branch could not be made (#704), with `--no-overwrite-ignore`,
+    so an IGNORED file at a path the pin tracks is refused as an untracked
+    one is, where git overwrote it silently. The line used to say `leaving
+    detached` of a leg on another branch, too; it says where the leg stays.
+    A HEAD on a ref outside `refs/heads/` is left where it is, as the
+    branch-at-the-pin and the behind-branch paths leave it (#704).
+
+    The checkout is judged by WHERE HEAD IS AFTERWARDS, as `_check_out`
+    judges one (#533; rv704's S3): a post-checkout hook that fails after
+    the branch is made makes git exit non-zero, and the line said `could
+    not create` over a leg on the branch at the pin. It says `created`,
+    and git's words follow it (`_say_after`). From another branch, the line
+    under `created` says the leg left it, as P9's and T7's do (rv704's S2).
+    """
+    named = spelled(branch)
+    head, current = _head_of(sub)
+    if head is not None and current is None and head != pin:
+        # `checkout -b <branch> <pin>` from a leg detached anywhere else
+        # leaves the commit made there on no branch (#533), as placing a
+        # branch that exists would. The branch is not there to check
+        # out, so the way out names the pin alone. A HEAD git cannot
+        # read (the leg's gitdir is gone) is no commit to keep: the
+        # checkout below fails, and says it could not.
+        print(f"  {label}: branch {named} does not exist, and the "
+              f"checkout is at {_short(head)} (detached), which is not "
+              f"the pin {_short(pin)}")
+        _say_keep("the pin")
+        return
+    if current is not None and not _on_a_branch(current):
+        print(f"  {label}: branch {named} does not exist, and the checkout "
+              f"is at {_short(head)} ({_place_of(current)}), which is not a "
+              "branch")
+        _say_keep("the pin")
+        return
+    why = _git_says(["checkout", "-q", "--no-overwrite-ignore", "-b", branch,
+                     pin], sub)
+    if _head_of(sub) != (pin, f"refs/heads/{branch}"):
+        stays = "detached" if current is None else f"it {_place_of(current)}"
+        _say_refused(f"  {label}: could not create branch {branch!r} at "
+                     f"the pin {_short(pin)}; leaving {stays}", why or [
+                         "`git checkout -b` exited 0, and HEAD is not on the "
+                         "branch at the pin"])
+        return
+    if remote is not None:
+        _try_git(["branch", "-q", f"--set-upstream-to=origin/{branch}",
+                  branch], sub)
+    state = "at the pin"
+    if remote is not None and remote != pin:
+        state = (f"at the pin; origin/{named} is {_short(remote)}, which "
+                 f"the pin deliberately does NOT follow")
+    print(f"  {label}: branch {named} created at "
+          f"{_short(pin)} — {state}")
+    if current not in (None, f"refs/heads/{branch}"):
+        _say_left(head, current, named)
+    _say_after(why)
+
+
+def checkout_tracking_branch(root: Path, leg: dict, branch: str) -> None:
+    """Step (a) for one leg. Prints; never moves the pin; and never raises,
+    but an `OSError` where git cannot be started (#694), which
+    `_checkout_all_tracking_branches` turns into `git-not-runnable`.
+
+    A leg with an operation in progress is refused before any path is
+    chosen (`_say_in_progress`, #704), so no move below meets one."""
+    path = str(leg.get("path") or "")
+    sub = root / path
+    # What is PRINTED of the leg is spelled (#391): `role`, `path` and `branch`
+    # are the manifest's text, read before any validator has had its say.
+    where = f"[{spelled(leg.get('role'))}] {spelled(path)}"
+    named = spelled(branch)
+    if not (sub / ".git").exists():
+        print(f"  {where}: NOT INITIALIZED. Run "
+              f"`git submodule update --init {spelled(path)}` — the "
+              f"validators below will refuse until you do.")
+        return
+    fault = _argument_fault(branch)
+    if fault is not None:
+        _say_not_tried(where, named, fault)
+        return
+    pin = recorded_gitlink(root, path)
+    local = _try_git(["rev-parse", "--verify", "--quiet",
+                      f"refs/heads/{branch}"], sub)
+    remote = _try_git(["rev-parse", "--verify", "--quiet",
+                       f"refs/remotes/origin/{branch}"], sub)
+    doing = _in_progress(sub)
+    if doing is not None:
+        _say_in_progress(where, path, doing)
+        return
+
+    if local is None:
+        if pin is None:
+            print(f"  {where}: no gitlink recorded; leaving as is")
+        else:
+            create_at_pin(sub, where, branch, pin, remote)
+        return
+
+    if local == pin:
+        place_at_pin(sub, where, branch, pin)
+        return
+
+    if _is_ancestor(sub, local, pin):
+        fast_forward_to_pin(sub, where, branch, local, pin, remote)
+        return
+
+    upstream = _held_upstream_past_the_pin(sub, branch, local, pin)
+    if upstream is not None:
+        move_back_to_pin(sub, where, path, branch, local, pin, upstream)
+        return
+
+    print(f"  {where}: PIN {_short(pin)} != branch {named} tip "
+          f"{_short(local)}")
+    print("          not moving an existing branch. The checkout stays "
+          f"{_stays(sub, branch, pin)}; the recorded pin is authoritative "
+          "and advancing it is an explicit commit in this repository.")
+
+
+def shape_upstream_notice(root: Path) -> None:
+    """ONE LINE, and only when this machine can already answer offline.
+
+    The pin says which openRepoShape the copied files came from; it cannot say
+    whether that revision is still the current one. Where the answer happens to
+    be on this machine — a clone at `SHAPE_UPSTREAM_PATH`, or a tip somebody
+    cached at `.shape-upstream-tip` — saying so costs nothing and closes the
+    gap that had two projects updated by hand. Where it is not, this is silent:
+    an absent answer is not a finding, and it never fails the bootstrap. A
+    clone named there that git cannot be STARTED to read is no absent
+    answer but a machine with no git, refused `git-not-runnable` (#694).
+    """
+    pin_path = root / "contracts" / "shape-pin.yaml"
+    if not pin_path.is_file():
+        return
+    try:
+        pin = load_yaml(pin_path)
+    except Refusal:
+        return
+    pinned = str((pin or {}).get("commit") or "").lower()
+    if not COMMIT_40.match(pinned):
+        return
+    tip = None
+    upstream = os.environ.get(SHAPE_UPSTREAM_ENV)
+    if upstream and Path(upstream).is_dir():
+        with _git_runs(f"the clone {SHAPE_UPSTREAM_ENV} names, "
+                       f"{spelled(upstream)}, could not be read"):
+            tip = _try_git(["rev-parse", "HEAD"], Path(upstream))
+    if tip is None:
+        cache = root / SHAPE_UPSTREAM_CACHE
+        if cache.is_file():
+            tip = cache.read_text(encoding="utf-8").strip()
+    if not tip or not COMMIT_40.match(tip):
+        return
+    if tip.lower() == pinned:
+        return
+    print(f"  shape: the upstream is at {tip[:12]} and this project is pinned "
+          f"at {pinned[:12]}. Run openRepoShape's "
+          f"`update-shape.py check --root .` to see what moved; nothing here "
+          f"is wrong until you have.")
+
+
+def _register_paths(root: Path, legs: list[dict]) -> list[Path]:
+    candidates = [root / REGISTER_RELPATH]
+    for leg in legs:
+        path = str(leg.get("path") or "")
+        if path and path != ".":
+            candidates.append(root / path / REGISTER_RELPATH)
+    return [c for c in candidates if c.is_file()]
+
+
+def _row_objects(row: dict) -> list[str]:
+    """Every object identifier a register row scopes authority to.
+
+    Tolerant on purpose: the register's shape is a declared successor rather
+    than a ratified schema, and the sibling topic proposes adding path-prefix
+    objects below repository granularity. This reads what is there and claims
+    nothing about what is not.
+    """
+    objects: list[str] = []
+    for key in ("target_repo", "target_repository", "object"):
+        value = row.get(key)
+        if isinstance(value, str):
+            objects.append(value)
+    for container in (row, row.get("scope") if isinstance(row.get("scope"), dict) else {}):
+        values = (container or {}).get("objects")
+        if isinstance(values, list):
+            objects.extend(str(v) for v in values if isinstance(v, (str, int)))
+    return objects
+
+
+def _matches(obj: str, repositories: set[str], prefixes: list[str]) -> bool:
+    repo, _, path = obj.partition(":")
+    if repo in repositories:
+        return True
+    if path:
+        return any(path.startswith(prefix) for prefix in prefixes)
+    return False
+
+
+def _load_register_rows(register_path: Path) -> list[dict] | None:
+    """One register file's rows, tolerant of which key holds them.
+
+    Split from `read_authority` for #132. Returns `None` when the file
+    itself could not be read — already printed in that case — so the
+    caller's loop moves on to the next register file exactly as the
+    original loop's `continue` did.
+    """
+    try:
+        data = load_yaml(register_path)
+    except Refusal as exc:
+        print("    unreadable, so nothing is claimed from it: "
+              f"{spelled(exc.detail)}")
+        return None
+    rows = []
+    if isinstance(data, dict):
+        for key in ("rows", "grants", "entries"):
+            value = data.get(key)
+            if isinstance(value, list):
+                rows.extend(r for r in value if isinstance(r, dict))
+    return rows
+
+
+def _row_report_line(row: dict, repositories: set[str],
+                     prefixes: list[str]) -> str | None:
+    """One register row, formatted for `read_authority`'s report — or
+    `None` when it names none of this project's repositories or paths.
+
+    Split from `read_authority` for #132.
+    """
+    objects = [o for o in _row_objects(row)
+              if _matches(o, repositories, prefixes)]
+    if not objects:
+        return None
+    # A register row is a file's text (#391): each value is spelled.
+    holder = spelled(row.get("holder_ref") or row.get("holder") or "?")
+    act = spelled(row.get("act") or row.get("acts") or "?")
+    state = spelled(row.get("state") or "?")
+    expires = spelled(row.get("expires_at") or "-")
+    return (f"    {holder} · {act} · {', '.join(map(spelled, objects))} · "
+           f"{state} · expires {expires}")
+
+
+def _report_one_register(register_path: Path, root: Path,
+                         repositories: set[str], prefixes: list[str]) -> None:
+    """One register file, start to finish: read it, print each row that
+    names this project, and the "no rows"/"no row names…" line when there
+    is nothing to show.
+
+    Split from `read_authority` for #132 so its loop over every register
+    file found is a single call per file.
+    """
+    # POSIX, on every platform: this line names a file in the repository,
+    # and git and the reader both spell it that way.
+    print("  register: "
+          f"{spelled(register_path.relative_to(root).as_posix())}")
+    rows = _load_register_rows(register_path)
+    if rows is None:
+        return
+    if not rows:
+        print("    no rows")
+        return
+    hits = 0
+    for row in rows:
+        line = _row_report_line(row, repositories, prefixes)
+        if line is None:
+            continue
+        hits += 1
+        print(line)
+    if not hits:
+        print("    no row names this project's repositories or paths")
+
+
+def read_authority(root: Path, legs: list[dict]) -> None:
+    """Step (c). Prints the degrade line and returns when no register exists."""
+    found = _register_paths(root, legs)
+    if not found:
+        print(DEGRADE_LINE)
+        print("  (no `governance/review-authority/register.yaml` in the "
+              "assembly root or in any leg. Wallet-carried authority is an "
+              "OVERLAY; the shape confers nothing without it, and nothing "
+              "with it.)")
+        return
+    repositories = {str(leg.get("repository")) for leg in legs
+                    if leg.get("repository")}
+    prefixes = [str(leg.get("path")) for leg in legs
+                if leg.get("path") and leg.get("path") != "."]
+    for register_path in found:
+        _report_one_register(register_path, root, repositories, prefixes)
+    print("  Grants are read here for REPORTING only. This command confers "
+          "nothing and enforces nothing; a required check in the repository "
+          "that owns the object is what confers.")
+
+
+def _load_root_and_manifest(args) -> tuple[Path, dict | None]:
+    """`--root`'s repository, and its `project.yaml` if it has one.
+
+    Split from `main` for #132 so its `try` wraps one call — a `Refusal`
+    from either step is `main`'s early exit 2, exactly as the original
+    function's two separate `try`/`except Refusal` blocks around these same
+    two steps both were.
+    """
+    root = find_repo_root(args.root or Path(__file__).resolve().parents[1])
+    manifest_path = root / "project.yaml"
+    manifest: dict | None = None
+    if manifest_path.is_file():
+        loaded = load_yaml(manifest_path)
+        manifest = loaded if isinstance(loaded, dict) else None
+    return root, manifest
+
+
+def _checkout_all_tracking_branches(root: Path, sub_legs: list[dict],
+                                    manifest: dict | None,
+                                    branch_arg: str | None) -> None:
+    """Step (a): place every submodule leg on its tracking branch.
+
+    Split from `main` for #132. Git that cannot be started is
+    `git-not-runnable`, naming the leg it met it at (#694): one fact about
+    the machine, so no leg after it is tried.
+    """
+    if not sub_legs:
+        print("  no submodule legs declared. A one-repository project runs "
+              "the same command and this step is a no-op.")
+        return
+    branch = branch_arg or (manifest or {}).get("tracking_branch") or "main"
+    for leg in sub_legs:
+        with _git_runs(f"the {spelled(leg.get('role'))} leg at "
+                       f"{spelled(leg.get('path') or '')} could not be "
+                       "placed on its tracking branch"):
+            checkout_tracking_branch(root, leg,
+                                     str(leg.get("branch") or branch))
+
+
+def _run_neutral_validators(root: Path, manifest: dict | None,
+                            skip: bool) -> list[str]:
+    """Step (b): run the neutral validators, then the upstream notice.
+
+    Split from `main` for #132. Returns the labels of any validator that
+    failed, exactly as `main`'s local `failed` list used to accumulate them.
+    """
+    if skip:
+        print("  skipped (--skip-validators)")
+        return []
+    if manifest is None:
+        print("  no project.yaml: this project has not elected the schema, "
+              "so there is no manifest and no pins to check. It is not less "
+              "governed for that.")
+        return []
+    failed = []
+    for label, argv_ in VALIDATORS:
+        if not (root / argv_[0]).is_file():
+            print(f"  {label}: {argv_[0]} is absent; SKIPPED")
+            continue
+        print(f"  --- {label} ---")
+        code = _run(root, argv_)
+        if code != 0:
+            failed.append(f"{label} (exit {code})")
+    shape_upstream_notice(root)
+    return failed
+
+
+def main(argv: list[str] | None = None) -> int:
+    escape_unencodable_stdout()
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--root", type=Path, default=None)
+    parser.add_argument("--branch", default=None,
+                        help="tracking branch to place the legs on "
+                             "(default: project.yaml `tracking_branch`, else main)")
+    parser.add_argument("--skip-validators", action="store_true")
+    args = parser.parse_args(argv)
+
+    try:
+        root, manifest = _load_root_and_manifest(args)
+    except Refusal as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    legs = [leg for leg in ((manifest or {}).get("legs") or [])
+            if isinstance(leg, dict)]
+    sub_legs = [leg for leg in legs if leg.get("role") != "assembly"]
+
+    name = (manifest or {}).get("name") or root.name
+    print(f"bootstrap: {spelled(name)} ({spelled(root)})")
+
+    try:
+        print("\n(a) legs on tracking branches, pins untouched")
+        _checkout_all_tracking_branches(root, sub_legs, manifest, args.branch)
+
+        print("\n(b) neutral validators")
+        failed = _run_neutral_validators(root, manifest, args.skip_validators)
+    except Refusal as exc:
+        # Only `git-not-runnable` reaches here (#694): nothing else in the
+        # two steps raises one. Stdout first, so a log of both streams
+        # reads in the order the run went.
+        sys.stdout.flush()
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    print("\n(c) review authority")
+    read_authority(root, legs)
+
+    print()
+    if failed:
+        print("bootstrap FAILED: " + ", ".join(failed), file=sys.stderr)
+        return 1
+    print("bootstrap ok")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/repo_shape.py b/scripts/repo_shape.py
new file mode 100644
index 00000000..d6892966
--- /dev/null
+++ b/scripts/repo_shape.py
@@ -0,0 +1,3388 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Shared, dependency-free helpers for the openRepoShape validators.
+
+STANDARD LIBRARY ONLY, ON PURPOSE. This repository is meant to be forked into
+an organisation that has no openxFactory, no codexFactory and, quite possibly,
+no permission to `pip install` anything on the machine where the scaffold runs.
+Everything here therefore uses `python3` and `git` and nothing else. That
+constraint is what forces the small YAML reader below: PyYAML would be one
+dependency, and one dependency is one more than "clone it and run it" allows.
+
+WHAT THIS MODULE OWNS
+  - `parse_yaml` / `load_yaml` — a deliberately SMALL, fail-closed reader for
+    the YAML subset this standard's own files are written in, and
+    `double_quoted`, the writer's half of its double-quoted escapes (#199).
+  - `tree_digest` — the ONE definition of what "the digest of a commit" means
+    here (see `TREE_DIGEST_DEFINITION` below; the choice is argued in README).
+  - `tree_digest_from_gh` — the SAME definition, read from the forge's
+    recursive tree listing instead of a local clone; how a `validate-pins.py`
+    re-check answers for a neutral-product pin with no local checkout.
+  - `file_sha256` — the per-file digest used by the shape pin's `files:` block,
+    mirroring `neutral-product-pin`'s per-file `sha256` rows.
+  - `NamingPolicy` — the classifier over `contracts/repository-naming.yaml`.
+  - `path_spelling_fault` — whether a path is spelled the one way Git
+    records it, asked of a leg's mount path and of a recorded submodule's.
+  - `same_repository` and the remote-url arithmetic under it — the ONE
+    definition of whether two remote spellings name one repository, which
+    `shape-doctor.py` reports by and `scripts/siblings.py` refuses by.
+  - `Refusal` — the fail-closed exception every validator raises, carrying
+    the remediation its caller names, because a refusal that names what is
+    wrong without naming what to run puts the exit in tribal memory instead
+    of the message. Where the caller names none it carries none (#370):
+    a wrong remedy is worse than the `REFUSED` line alone.
+  - `spelled` and `escape_unencodable_stdout` — how both roots'
+    `bootstrap.py` print a person's text: what a terminal must not be handed
+    raw is escaped, and a stdout that cannot encode it never raises (#391).
+  - `shell_quoted` and `shell_line` — how `scripts/family.py` and a holder's
+    `scripts/siblings.py` spell a path in a command a person pastes, so that
+    it reaches the command as ONE argument in `sh` or PowerShell (#486).
+
+This file is COPIED into a scaffolded assembly root by `scaffold-project.py`
+and its sha256 is recorded in that project's `contracts/shape-pin.yaml`, so an
+edit to the copy is drift the project's own `validate-pins.py` reports.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import stat
+import subprocess
+import sys
+import unicodedata
+from pathlib import Path
+from typing import Any
+
+# ---------------------------------------------------------------------------
+# Shared vocabulary
+# ---------------------------------------------------------------------------
+
+#: Exactly 40 hex, case-insensitive, normalised to lowercase before comparison.
+#: 40 means 40 — an abbreviated oid, a branch name or a tag cannot pass, which
+#: is `neutral-product-pin`'s "a tag can be moved" written as a regex.
+COMMIT_RE = re.compile(r"^[0-9a-fA-F]{40}$")
+SHA256_RE = re.compile(r"^[0-9a-fA-F]{64}$")
+
+#: A project id is the lowercase machine name; the GitHub topic is derived.
+PROJECT_ID_RE = re.compile(r"^[a-z0-9][a-z0-9-]*$")
+TOPIC_PREFIX = "xf-project-"
+
+#: The digest definition recorded in every pin this standard writes. Bumping
+#: the algorithm bumps this string, so a pin never silently means something
+#: else than it did when it was written.
+TREE_DIGEST_DEFINITION = "sorted-ls-tree-r-v1"
+
+#: Every neutral `open<Product>` repository lives under THIS organisation.
+#: Domain repositories never author a neutral product, only pin the opensoft
+#: original (README, "Working rules"), so an UNQUALIFIED `--pin
+#: openGlass@<sha>` always resolves here — never under the pinning project's
+#: own `--org`, which owns no neutral product at all. `--pin-owner` overrides
+#: it for the rare pin on a fork of the neutral original.
+NEUTRAL_PRODUCT_OWNER = "opensoft"
+
+#: How a neutral product's tree is read when no local checkout answers for
+#: it. `scaffold-project.py`'s own `pin_digest_from_gh` reads this exact
+#: endpoint when it FIRST computes a `neutral-product-pin`'s digest;
+#: `tree_digest_from_gh` below reads it again so a later re-check recomputes
+#: the same number from the same shape of data.
+GH_TREE_API = "repos/{repo}/git/trees/{commit}?recursive=1"
+
+#: The GitHub repository-visibility values this standard accepts, everywhere
+#: it accepts one: `scaffold-project.py --visibility`, `setup.sh
+#: --visibility`, `adopt-project.py plan --visibility`, and the `visibility:`
+#: field `validate-manifest.py` checks. ONE tuple, so a fourth value never has
+#: to be added in four places and inevitably missed in a fifth. `internal` is
+#: an enterprise org-internal repository (`gh repo create --internal`,
+#: `gh repo view --json visibility` -> `INTERNAL`) — the same population as
+#: PRIVATE and PUBLIC, not a narrower or wider one.
+VISIBILITY_CHOICES = ("private", "public", "internal")
+
+#: Every value this family lets a caller put on a `git` or `gh` command line.
+#: Deliberately narrow: letters, digits, and the punctuation that real branch
+#: names, paths, repository names and commits are spelled with.
+SAFE_ARG_RE = re.compile(r"^[A-Za-z0-9._/@+~-]{1,255}$")
+
+#: The same guard for a value that is a FILESYSTEM PATH the operator named,
+#: rather than a branch, a repository or a commit. A Windows path is
+#: `D:\a\_temp\t\remotes\Atlas-spec.git` and a real home directory is
+#: `C:\Users\Jane Doe\...`: a drive letter, a colon, backslashes and a
+#: space, none of which `SAFE_ARG_RE` admits and NONE OF WHICH IS THE THREAT.
+#: The threat is that `git` reads its own arguments, so a leading `-` is
+#: refused by `checked_value` itself; and that a control character reaches a
+#: command line, which this alphabet excludes by naming what it allows. The
+#: colon is admitted only as a drive letter's, so a value cannot become git's
+#: `host:path` scp syntax by accident.
+SAFE_PATH_RE = re.compile(r"^(?:[A-Za-z]:)?[A-Za-z0-9._/@+~ \\-]{1,4096}$")
+
+#: How to spell "run Python" in a message a person is meant to retype. On
+#: Windows there is usually no `python3` on PATH at all — the python.org
+#: installer ships `python.exe` and the `py` launcher — so a remediation
+#: naming `python3` is a command that fails on the machine reading it.
+#:
+#: THE PLATFORM'S CONVENTIONAL COMMAND, not the running interpreter's
+#: basename. A basename need not be on PATH at all: inside a virtualenv
+#: `sys.executable` is `…/venv/bin/python`, and on a Debian box without
+#: `python-is-python3` there is no `python` to type. `python3` is the command
+#: every POSIX install of a supported Python answers to, and `python` is what
+#: both python.org and the Microsoft Store put on PATH on Windows. A
+#: remediation names the command its reader can type, not the binary that
+#: happened to run.
+PYTHON = "python" if os.name == "nt" else "python3"
+
+#: THE ASSEMBLY ROOT'S LOCKSTEP REMEDY, and no longer every refusal's (#370).
+#: It names `validate-pins.py`, a leg's gitlink and `contracts/<leg>-pin.yaml`,
+#: so it is right where an assembly root's legs are the question, and that
+#: is `validate-pins.py`, which prints it under each refusal of its own that
+#: names no other. As `Refusal`'s default it reached every tool: a family
+#: holder, which has no legs and no `validate-pins.py`, was told to run that
+#: file and move a leg pin, and so was everyone refused over an adoption
+#: plan, a shape pin or a naming policy.
+REMEDIATION = (
+    "Remediation: run `git submodule update --init --recursive`, then "
+    f"`{PYTHON} scripts/validate-pins.py`. If the PIN itself is stale, advance "
+    "the gitlink, `contracts/<leg>-pin.yaml` and every workflow `@<sha>` that "
+    "names the leg in ONE commit (see README, 'The lockstep invariant')."
+)
+
+
+class Refusal(Exception):
+    """A named, remediable refusal.
+
+    `code` is machine-readable and `detail` is for humans; `str(exc)` renders
+    code, detail and the remediation trailer together, so a caller that prints
+    the exception cannot accidentally drop the remedy.
+
+    NO REMEDY IS ASSUMED (#370). A refusal built without one prints its
+    `REFUSED` line alone, which already says what failed and where, because
+    this module cannot know which tool, or which kind of root, it refuses
+    for: a default here was one tool's remedy printed under all of them. A
+    caller with a remedy to name passes it; `validate-pins.py` gives its own
+    refusals the lockstep one, `REMEDIATION`.
+    """
+
+    def __init__(self, code: str, detail: str, remediation: str = ""):
+        super().__init__(code, detail)
+        self.code = code
+        self.detail = detail
+        self.remediation = remediation
+
+    def __str__(self) -> str:  # pragma: no cover - trivial
+        line = f"REFUSED {self.code}: {self.detail}"
+        return f"{line}\n{self.remediation}" if self.remediation else line
+
+
+class YamlError(Exception):
+    """The reader met a construct it does not implement.
+
+    Raising rather than guessing is the whole point: a validator that silently
+    mis-reads its own contract file is worse than one that will not start.
+
+    `line` AND `remediation` ARE FOR `load_yaml`, WHICH NAMES A FILE (#708).
+    Where the fix is one edit of the value, the same in every file, the
+    refusal carries it (`_indicator_refusal`); every other refusal carries
+    none. Such a refusal is raised where the value is read, which knows no
+    line, so the block reader records the line it read the value on
+    (`_block_value`), and `load_yaml` names it. It stays out of the words:
+    a tool that asks the reader about ONE rendered line (`k: @a`) quotes
+    those words in a sentence of its own, where `line 1:` would be noise.
+    """
+
+    def __init__(self, message: str, remediation: str = ""):
+        super().__init__(message)
+        self.line: int | None = None
+        self.remediation = remediation
+
+
+# ---------------------------------------------------------------------------
+# The YAML subset reader
+# ---------------------------------------------------------------------------
+#
+# SUPPORTED: one document (an optional leading `---`), block mappings, block
+# sequences, `#` comments, single- and double-quoted scalars, plain scalars
+# with int / float / bool / null coercion, single-level flow sequences and flow
+# mappings (`[a, b]`, `{k: v}`), and literal / folded block scalars (`|`, `>`,
+# with the `-` and `+` chomping indicators accepted and `-` honoured).
+#
+# REFUSED (raises YamlError): tabs used for indentation, anchors and aliases
+# (`&`, `*`), tags (`!`), merge keys (`<<`), explicit keys (`? `), a
+# single-pair mapping in a flow sequence (`[a: b]`, #392), and more than one
+# document. Each of those has a meaning this reader would have to invent, and
+# an invented meaning in a validator is a wrong answer with a confident tone.
+#
+# A QUOTE OPENS A QUOTED SCALAR ONLY WHERE A SCALAR BEGINS, as in YAML; in
+# the middle of a plain scalar (`it's`) it is a character of it (#249). A
+# quoted scalar must close on its own line, with nothing after its closing
+# quote but a comment or the structure that ends it, or it is REFUSED (#250):
+# a quoted scalar spanning lines is outside this subset. See `_unquoted`.
+#
+# A FLOW MAPPING READS AS ITS BLOCK TWIN (#252): an entry opening `? ` is an
+# explicit key and is refused as a block line opening `? ` is, and an empty
+# value (`{k: }`, `{k:}`) is null as a block `k:` is.
+#
+# THESE INDICATORS OPEN NO PLAIN SCALAR, AND A FLOW ENTRY IS NEVER EMPTY
+# (#392, #393), which is what YAML says and PyYAML refuses: `]`, `}`, `,`, `@`,
+# a backtick and `%` open no plain scalar, nor does a lone `?`, `-` or `:`, and
+# a flow entry opens with none of `:`, `#`, `- ` and `? `. So `k: ]` is not the
+# text `]`, and `k: [,a]` is not `['a']`. These are not refused, and still read
+# as text where PyYAML refuses them: `k: - a`, `k: : a`, a block key such as
+# `@a: 1`, and `|` or `>` opening a plain scalar. See `_scalar`,
+# `_refuse_entry_indicator` and `_split_flow`.
+
+_DASH_RE = re.compile(r"^-(\s+|$)")
+
+
+class _Rec:
+    """One significant line, as `_parse_nodes` reads it.
+
+    `block` is a block scalar's `(key, body)`, set on the record its header
+    makes and on no other, and its `text` is empty. THE PAIR IS NEVER JOINED
+    INTO ONE STRING, so no character a key can hold collides with the
+    record's own structure. It was joined, as a NUL-delimited marker + key +
+    NUL + body split again at the NULs (#248): a key holding a NUL -- the
+    escape `\\x00` in a double-quoted key since #199, or a raw NUL, which YAML
+    forbids and this reader takes -- was cut short there with the rest of it
+    read into the body, and an ordinary line whose text began with that
+    marker read as a block scalar it never was.
+    """
+
+    __slots__ = ("indent", "text", "dash", "line", "block")
+
+    def __init__(self, indent: int, text: str, dash: bool, line: int,
+                 block: tuple[str, str] | None = None):
+        self.indent = indent
+        self.text = text
+        self.dash = dash
+        self.line = line
+        self.block = block
+
+
+def _quote_end(text: str, start: int) -> int | None:
+    """The index just past the quoted scalar that opens at `text[start]`,
+    or None when nothing on the line closes it.
+
+    A `"` closes it where no backslash escapes it: the character after each
+    backslash is taken with the backslash, so the `"` of `\\\\"` closes and
+    the `"` of `\\"` does not. A `'` closes it where it is not doubled, `''`
+    being a single-quoted scalar's one escape.
+    """
+    quote = text[start]
+    i = start + 1
+    while i < len(text):
+        if quote == '"' and text[i] == "\\":
+            i += 2
+        elif text[i] != quote:
+            i += 1
+        elif quote == "'" and text[i + 1:i + 2] == "'":
+            i += 2
+        else:
+            return i + 1
+    return None
+
+
+def _unquoted(text: str, flow: bool = False):
+    """Each `(index, character)` of `text` that no quoted scalar holds: the
+    characters `_strip_comment`, `_split_key` and `_split_flow` may read as
+    structure.
+
+    THE ONE DEFINITION OF WHERE A QUOTED SCALAR STARTS AND ENDS, which those
+    three used to spell as three toggles that opened a quote at ANY `"` or
+    `'` (#249). A quote opens one only where a scalar BEGINS: at the start
+    of the text, or after `- `, `: `, `[` or `{`, or after a `,` inside a
+    flow, with any spaces after each. Anywhere else, as in `it's` or `a"b`,
+    it is a character of a plain scalar, so the `,`, `#` or `: ` after it is
+    still structure and `k: [it's, a]` is two items, as its block twin is.
+    The quoted scalar ends at `_quote_end`. When nothing closes it, the rest
+    of the text is inside it and nothing more is yielded; `_scalar` then
+    refuses it by name (#250).
+
+    `flow` says `text` is a flow collection's body, where every `,`, `[` and
+    `{` is structure. On a block line they are structure only inside a flow
+    the line opens where a scalar begins, so `k: a, 'b # c'` is the plain
+    scalar `a, 'b` and a comment, as YAML reads it.
+    """
+    depth, begins, i = 0, True, 0
+    while i < len(text):
+        ch = text[i]
+        if begins and ch in "\"'":
+            end = _quote_end(text, i)
+            if end is None:
+                return
+            i, begins = end, False
+            continue
+        yield i, ch
+        i += 1
+        if ch in "[{" and (begins or flow or depth):
+            depth += 1
+        elif ch in "]}" and depth:
+            depth -= 1
+        spaced = text[i:i + 1] in ("", " ", "\t")
+        if ch not in " \t" and not (ch == "-" and begins and spaced):
+            begins = (ch in "[{," and (flow or depth > 0)
+                      or ch == ":" and spaced)
+
+
+def _strip_comment(text: str) -> str:
+    """Drop a trailing `#` comment: a `#` no quoted scalar holds
+    (`_unquoted`), at the start of the text or after a space or tab."""
+    for i, ch in _unquoted(text):
+        if ch == "#" and (i == 0 or text[i - 1] in " \t"):
+            return text[:i].rstrip()
+    return text.rstrip()
+
+
+def _split_key(text: str) -> tuple[str, str] | None:
+    """Split `key: rest` on the first `:` followed by space or EOL that no
+    quoted scalar holds (`_unquoted`).
+
+    A `[` OR `{` THAT OPENS THE TEXT makes it a flow collection, which is not
+    a key in this subset, so `- [a, b]` and `- {a: b}` stay flow items. One
+    LATER IN A KEY, before its `: `, is REFUSED by name: YAML reads
+    `a[b]: c` as the key `a[b]`, but a block key and a flow-entry key would
+    have to be told apart to read it, and returning `None` made `- a[b]: c`
+    the string `'a[b]: c'` where a mapping was meant (#249).
+    """
+    bracket = False
+    for i, ch in _unquoted(text):
+        if ch in "[{":
+            if not text[:i].strip():
+                return None  # a flow collection cannot be a key in this subset
+            bracket = True
+        elif ch == ":" and (i + 1 == len(text) or text[i + 1] in " \t"):
+            if bracket:
+                raise YamlError("a key holding `[` or `{` is not supported: "
+                                f"{text[:i].strip()!r}")
+            return _unquote_key(text[:i].strip()), text[i + 1:].strip()
+    return None
+
+
+def _unquote_key(key: str) -> str:
+    """A key that begins with a quote is one quoted scalar, or `_scalar`
+    refuses it: `"a" b: 1` is not the key `"a" b` (#250)."""
+    if key[:1] in ('"', "'"):
+        return str(_scalar(key))
+    return key
+
+
+#: THE ESCAPES OF A DOUBLE-QUOTED SCALAR: the one table the reader
+#: (`_unescape`) and the writer (`double_quoted`) both read, so that a plan
+#: `adopt-project.py` writes is a plan this reader takes back unchanged
+#: (#199). Each is YAML's own spelling with YAML's meaning, so the file is
+#: still YAML another reader takes the same way -- except a lone surrogate's
+#: `\udce9`, which libyaml (PyYAML's `CSafeLoader`) refuses as an invalid
+#: escape, while PyYAML's pure-Python `SafeLoader` reads it back as this
+#: reader does. Anything else after a backslash keeps its backslash, because
+#: inventing a meaning for `\q` is how a reader starts disagreeing with the
+#: writer.
+DOUBLE_QUOTED_ESCAPES = {"n": "\n", "r": "\r", "t": "\t", '"': '"', "\\": "\\"}
+
+#: YAML's CODE-POINT escapes, by how many hex digits each takes: `\xNN`,
+#: `\uNNNN` and `\UNNNNNNNN` each name the code point those digits spell, so
+#: `\x85` is U+0085 and never the byte 0x85. The writer takes the shortest
+#: that holds the character; the reader resolves exactly that many hex digits
+#: and keeps the backslash of one with fewer, or past U+10FFFF.
+CODE_POINT_ESCAPES = {"x": 2, "u": 4, "U": 8}
+
+#: The writer's half of `DOUBLE_QUOTED_ESCAPES`: each character to its escape.
+_ESCAPE_OF = {char: "\\" + letter
+              for letter, char in DOUBLE_QUOTED_ESCAPES.items()}
+_HEX_DIGITS = frozenset("0123456789abcdefABCDEF")
+
+
+def double_quoted(text: str) -> str:
+    """`text` as a double-quoted scalar `_scalar` reads back as `text`.
+
+    The subset's one writer quotes with this: `adopt-project.py`'s `y`, for
+    the adoption plan and for `shape-doctor.py`'s placement plan, and its
+    `submodule_record`, for the `submodules:` record `execute` appends to
+    `project.yaml`, which the doctor holds a submodule to only where a row
+    reads back as its path (#189). It escapes a backslash and a double
+    quote, which would bend or end the quoting; `\\n`, `\\r` and `\\t` by
+    name; and every other character `str.isprintable` refuses by its code
+    point. PART OF THAT CLASS THE READER CANNOT TAKE
+    RAW. It reads a file line by line with `str.splitlines`, which ends a
+    line at `\\n` and `\\r` -- the macOS folder icon is a file named
+    `Icon\\r` -- and also at `\\x0b`, `\\x0c`, `\\x1c`-`\\x1e`, `\\x85`,
+    `\\u2028` and `\\u2029`: ten characters, not one of them printable. And
+    no UTF-8 file can hold a lone surrogate raw, which is how
+    `adopt-project.py` keeps a name's byte that is not UTF-8
+    (`surrogateescape`); `\\udce9` reads back as that same surrogate, so
+    `check` finds the entry's name in the tree. THE REST A PERSON CANNOT
+    SEE: the reader takes a raw TAB, NUL, ESC or DEL, or a zero-width or
+    bidirectional control, inside the quotes, but a person reading the plan
+    could not tell it was there, so the same rule spells it. Whatever the
+    string, the scalar is one line of printable text.
+    """
+    return '"' + "".join(map(_escaped, text)) + '"'
+
+
+def _escaped(char: str) -> str:
+    """One character of a `double_quoted` body."""
+    named = _ESCAPE_OF.get(char)
+    if named is not None:
+        return named
+    if char.isprintable():
+        return char
+    code = ord(char)
+    letter, digits = next((letter, digits)
+                          for letter, digits in CODE_POINT_ESCAPES.items()
+                          if code < 16 ** digits)
+    return f"\\{letter}{code:0{digits}x}"
+
+
+def _escape_at(body: str, index: int) -> tuple[str, int] | None:
+    """What the backslash at `body[index]` and what follows it stand for,
+    and how many characters that escape spans; None for one this reader does
+    not resolve, which then keeps its backslash."""
+    letter = body[index + 1:index + 2]
+    if letter in DOUBLE_QUOTED_ESCAPES:
+        return DOUBLE_QUOTED_ESCAPES[letter], 2
+    digits = CODE_POINT_ESCAPES.get(letter, 0)
+    spelled = body[index + 2:index + 2 + digits]
+    if not digits or len(spelled) != digits or not _HEX_DIGITS.issuperset(
+            spelled) or int(spelled, 16) > sys.maxunicode:
+        return None
+    return chr(int(spelled, 16)), 2 + digits
+
+
+def _unescape(body: str) -> str:
+    """A double-quoted scalar's body, ONE PASS, LEFT TO RIGHT, resolving the
+    escapes `double_quoted` writes: `DOUBLE_QUOTED_ESCAPES` and
+    `CODE_POINT_ESCAPES`, and no others.
+
+    NOT A CHAIN OF `str.replace` CALLS, and the reason is a Windows path. An
+    adoption plan escapes each backslash it writes, so the source directory
+    `D:\\a\\_temp\\t` reaches here doubled. Replacing the two-character `\\t`
+    before the two-character `\\\\` matches the SECOND backslash of that pair
+    and turns a directory named `t` into a TAB — the path then does not
+    exist, and `adopt-project.py check` refuses a plan it wrote itself.
+    Consuming the backslash and the characters it escapes together is the
+    only spelling that cannot read one escape's output as another escape's
+    input -- `\\\\x41` is a backslash and `x41`, never a backslash and `A`.
+    """
+    out: list[str] = []
+    index = 0
+    while index < len(body):
+        escape = _escape_at(body, index) if body[index] == "\\" else None
+        if escape is None:
+            out.append(body[index])
+            index += 1
+        else:
+            out.append(escape[0])
+            index += escape[1]
+    return "".join(out)
+
+
+def _quoted_scalar(text: str) -> str:
+    """The value of `text`, which begins with a quote and must be ONE whole
+    quoted scalar (#250).
+
+    Not "starts and ends with a quote": that took `"a" b "c"` for one scalar,
+    `"a\\"` for `a\\` and an unclosed `"abc` for plain text, where YAML
+    refuses each. Nothing may follow the closing quote, because a comment
+    after it is gone before this runs and the structure after it is not part
+    of `text`.
+    """
+    end = _quote_end(text, 0)
+    if end is None:
+        raise YamlError(f"quoted scalar without a closing quote: {text!r}")
+    if end < len(text):
+        raise YamlError(
+            f"quoted scalar with text after its closing quote: {text!r}")
+    if text[0] == "'":
+        return text[1:-1].replace("''", "'")
+    return _unescape(text[1:-1])
+
+
+#: What each indicator a refusal below names DOES where a plain scalar would
+#: begin, in YAML (#392, #393): the reason the refusal gives. `?` is not
+#: here: the scalar it opens is an explicit key, and refused as one.
+_INDICATOR_ROLES = {
+    "]": "closes a flow sequence",
+    "}": "closes a flow mapping",
+    ",": "separates flow entries",
+    "#": "opens a comment",
+    "@": "is reserved",
+    "`": "is reserved",
+    "%": "opens a directive",
+    ":": "opens a value",
+    "-": "opens a sequence entry",
+}
+
+
+def _indicator_refusal(text: str) -> YamlError:
+    """The refusal of the plain scalar `text`, which opens with an indicator
+    YAML does not let open one (#392, #393): the indicator, what it does, and
+    the scalar. One `?` opens an explicit key, refused in #252's words.
+
+    IT SAYS WHAT TO DO (#708). The likeliest hand to meet it is an adoption
+    plan's `resolution:`, which AGENTS.md asks for in words, and a reason
+    such as `` `adopt-project.py` reads it `` read as text until #392 and
+    #393. Whatever the file, the value is kept by writing it between double
+    quotes, spelled by `double_quoted`, the writer this reader takes back
+    unchanged, or by rewording it, so the refusal carries that remedy."""
+    char = text[0]
+    remedy = ("Remediation: unquoted, YAML does not read this value as text, "
+              "so this reader refuses it rather than guess. Write it in "
+              f"double quotes, as {double_quoted(text)}, or reword it so that "
+              "it opens with another character, and run the command again.")
+    if char == "?":
+        return YamlError(f"explicit keys are not supported: {text!r}", remedy)
+    shown = "a backtick" if char == "`" else f"`{char}`"
+    return YamlError(f"a plain scalar cannot open with {shown}, which "
+                     f"{_INDICATOR_ROLES[char]} in YAML: {text!r}", remedy)
+
+
+def _scalar(raw: str) -> Any:
+    """One scalar's value: null, a quoted scalar's text, a bool, a number, or
+    a plain scalar's text.
+
+    THE READER OF EVERY PLAIN VALUE, block and flow, so A PLAIN SCALAR THAT
+    OPENS WITH AN INDICATOR IS REFUSED HERE (#393). YAML lets none open with
+    `]`, `}`, `,`, `@`, a backtick or `%`, and none be a lone `?` or `:`,
+    and PyYAML refuses each, but the one test of the first character here
+    was `&*!`, so the rest was text: `tracking_branch: ]`, left by a
+    half-deleted flow list, read as the branch `]`. Refused, it is a
+    `yaml-unparsable` naming the scalar. A lone `-` is refused where the
+    block reader reads a value (`_parse_mapping`), because a flow collection
+    reads `[-]` as the text `-`, as PyYAML does. The same characters later in
+    a scalar (`k: a]`, `- see [1]`, `k: a, b`), and every quoted scalar
+    (`k: "]"`), read as before.
+    """
+    text = raw.strip()
+    if text == "" or text in ("null", "~", "Null", "NULL"):
+        return None
+    if text[0] in "\"'":
+        return _quoted_scalar(text)
+    if text[0] in "&*!":
+        raise YamlError(f"anchors, aliases and tags are not supported: {text!r}")
+    if text[0] in "]},@`%" or text in ("?", ":"):
+        raise _indicator_refusal(text)
+    if text in ("true", "True", "TRUE"):
+        return True
+    if text in ("false", "False", "FALSE"):
+        return False
+    if re.fullmatch(r"-?\d+", text):
+        return int(text)
+    if re.fullmatch(r"-?\d+\.\d+", text):
+        return float(text)
+    return text
+
+
+def _refuse_flow_indicator(text: str) -> None:
+    """Refuse a PLAIN scalar of a flow collection that holds `[`, `]`, `{` or
+    `}` (#301); a quoted one is `_scalar`'s to judge, and its brackets are
+    text.
+
+    In YAML a plain scalar inside a flow collection ENDS at any of the four,
+    as it ends at the `,` `_split_flow` splits at, so a scalar holding one is
+    never the text it looks like, and PyYAML refuses the document. `k: [a]]`
+    closes the sequence after `a` and leaves a `]` nothing opened, and
+    `k: [x [a, b]]` opens a sequence while an item is still being read.
+    `_split_flow` counts brackets to find its commas and never asked whether
+    the count went below zero or ended above it, so the rest was read as
+    text: `['a]']`, `['x [a, b]']`, and the key of `k: {a"]:}` as `a"]`
+    since #284 stopped reading that `"` as a quote. Refused, a stray
+    bracket typed into `pins: [a, b]]` is a `yaml-unparsable` naming it, not
+    the pin `b]`.
+    """
+    if text.startswith(('"', "'")):
+        return
+    held = next((char for char in text if char in "[]{}"), None)
+    if held is not None:
+        raise YamlError(f"a plain scalar in a flow collection holds `{held}`, "
+                        f"which ends it in YAML: {text!r}")
+
+
+def _refuse_entry_indicator(text: str, remedy: bool = True) -> None:
+    """Refuse a flow ENTRY -- an item of a flow sequence, or an entry of a
+    flow mapping, whose key it opens -- that opens with an indicator (#392).
+
+    Inside a flow collection YAML takes a `:` as a value and a `#` as a
+    comment wherever a scalar would begin, and `- ` (with a space or tab) as
+    a sequence entry, which a flow collection cannot hold; `@`, a backtick
+    and `%` open no scalar at all. PyYAML refuses each. The plain-scalar
+    reader tested only `&*!`, so `k: [:]` read `[':']`, `k: [#a]` read
+    `['#a']`, `k: [- a]` read `['- a']` and `k: {: a}` read the empty key.
+    A `?` with a space or nothing after it opens an explicit key, refused as
+    #252 refuses `{? a: b}`, so `k: [? a]` is no longer the text `? a`.
+
+    A QUOTED entry opens with its quote, and `-`, `-a` and `?a` open no
+    indicator, as in YAML and #252: `[-]`, `[-a]`, `{-: 1}` and `{?a: b}`
+    read as they did. A `]` or `}` is left to `_refuse_flow_indicator`, which
+    names it in #301's words.
+    """
+    first, after = text[:1], text[1:2]
+    if (first in ":#@`%" or first in "-?" and after in (" ", "\t")
+            or text == "?"):
+        refusal = _indicator_refusal(text)
+        if not remedy:
+            refusal.remediation = ""
+        raise refusal
+
+
+def _flow_value(text: str, item: bool = False) -> Any:
+    """A flow entry is itself a flow collection when it OPENS with `[` or `{`.
+
+    AN EMPTY ENTRY OPENS NOTHING (#252): `{a: }` and `{a:}` give this `''`,
+    and `'' in "[{"` is True for any string, so the test used to run `_flow`
+    on it and refuse `{a: }` as `not a flow collection: ''`, a text nobody
+    wrote. `_scalar('')` is the null a block `a:` reads.
+
+    ONE THAT OPENS NOTHING HOLDS NO BRACKET OR BRACE (#301): a plain item or
+    value holding one is refused by `_refuse_flow_indicator`.
+
+    A FLOW SEQUENCE'S `item` OPENS WITH NO INDICATOR AND IS NO PAIR (#392).
+    The first is `_refuse_entry_indicator`'s. The second: YAML reads
+    `[a: b]` as `[{'a': 'b'}]`, and this read the string `'a: b'`. It is
+    refused, not read as YAML reads it, because no file this reader serves
+    can hold one. Every flow sequence in them is a list of names
+    (`neutral_product_pins`, `allow_empty_legs`, `also_matches`,
+    `referent_chain`), where a mapping would reach the tool as a name --
+    `{'openGlass': 'x'}` -- and every list of mappings (`legs`, `members`,
+    `files`, `submodules`, a policy's rules, and a plan's entries and
+    `pins`, whose rows are `product`, `repository`, `commit`, `tree_sha256`
+    and `digest_source`) has rows of two keys or more, which a single pair
+    cannot spell. So
+    `pins: [openGlass: x]` is a typo, refused as one. `{a: b}` in a sequence
+    is a flow mapping and reads, and `[a:b]` is the text `a:b`, as before.
+    """
+    if text.startswith(("[", "{")):
+        return _flow(text)
+    _refuse_flow_indicator(text)
+    if item:
+        _refuse_entry_indicator(text)
+        if _split_key(text) is not None:
+            raise YamlError("a single-pair mapping in a flow sequence is not "
+                            f"supported: {text!r}")
+    return _scalar(text)
+
+
+def _flow(text: str) -> Any:
+    text = text.strip()
+    if text.startswith("[") and text.endswith("]"):
+        body = text[1:-1].strip()
+        return [] if not body else [_flow_value(p, item=True)
+                                    for p in _split_flow(body)]
+    if text.startswith("{") and text.endswith("}"):
+        body = text[1:-1].strip()
+        out: dict[str, Any] = {}
+        if body:
+            for part in _split_flow(body):
+                kv = _split_key_flow(part)
+                if kv is None:
+                    raise YamlError(f"flow mapping entry without a key: {part!r}")
+                out[kv[0]] = _flow_value(kv[1])
+        return out
+    raise YamlError(f"not a flow collection: {text!r}")
+
+
+def _split_key_flow(text: str) -> tuple[str, str] | None:
+    """`_split_key` for a flow-mapping entry, where the value MAY open a flow.
+
+    IT IS `_split_key`, and not a second scanner, because it used to be one:
+    the same loop spelled again, minus the step that skips the character
+    after a backslash inside double quotes, so `{"a\\": b": 1}` read as the
+    key `a\\` (#213). `_split_key` already lets the value open a flow -- it
+    returns at the first top-level `:`, before any `[` or `{` after it.
+
+    AN ENTRY OPENING `? ` IS AN EXPLICIT KEY, AND IS REFUSED as the block
+    reader refuses it (`_refuse_unsupported`, which runs on block lines only):
+    an explicit key has a meaning this reader would have to invent, and
+    `? a: b` used to read as the literal key `? a` (#252). The block form
+    names its line, and a flow collection has none to name, so this names the
+    entry. A QUOTED key, `"? a"`, does not open with the `?`, and `?a` is not
+    the indicator, which needs a space after it: both read as they did.
+
+    AND AN ENTRY OPENS WITH NO OTHER INDICATOR (#392): `{: a}` read the
+    empty key, `{:":}` the key `:"`, `{#a: 1}` the key `#a` and `{- a: 1}`
+    the key `- a`, where PyYAML refuses each. `_refuse_entry_indicator`
+    refuses them, and the explicit key above, in one test.
+
+    A PLAIN KEY HOLDS NO `]` OR `}` EITHER (#301). `_split_key` refuses a
+    `[` or `{` later in a key, and in a flow a closer ends the key as surely,
+    so `{a"]:}` read as the key `a"]` and `{]:}` as `]`, where PyYAML
+    refuses both. `_refuse_flow_indicator` refuses them; a quoted key is
+    still text.
+    """
+    # A MAPPING ENTRY opens its KEY: quoting the whole entry, as the
+    # remedy would spell it, reads as an entry without a key (#708).
+    _refuse_entry_indicator(text, remedy=False)
+    kv = _split_key(text)
+    if kv is not None and not text.startswith(('"', "'")):
+        _refuse_flow_indicator(kv[0])
+    return kv
+
+
+def _split_flow(body: str) -> list[str]:
+    """A flow collection's body, split at its top-level commas.
+
+    The commas, brackets and braces it reads are the ones `_unquoted` yields,
+    so one inside a quoted item is not structure, and neither is a quote in
+    the middle of a plain item (#249). Inside a DOUBLE-quoted item the
+    character after a backslash is taken with it, so `\\"` neither ends the
+    item nor lets a `,` or `]` after it read as structure (#213). A
+    single-quoted item has no backslash escape: its `''` is a quote.
+
+    NO ENTRY IS EMPTY BUT THE ONE AFTER A TRAILING COMMA (#392). YAML allows
+    one comma after the last entry, `[a,]`, and no other empty entry. This
+    dropped every empty part, so `k: [,a]` read `['a']`, `k: [a,,b]` read
+    two names and `k: {,}` read `{}`, where PyYAML refuses each: a pin list
+    with its first name deleted read as the rest. The one trailing empty
+    part is dropped and any other is refused, naming the body.
+    """
+    parts, depth, start = [], 0, 0
+    for i, ch in _unquoted(body, flow=True):
+        if ch in "[{":
+            depth += 1
+        elif ch in "]}":
+            depth -= 1
+        elif ch == "," and depth == 0:
+            parts.append(body[start:i].strip())
+            start = i + 1
+    parts.append(body[start:].strip())
+    if len(parts) > 1 and parts[-1] == "":
+        parts.pop()
+    if "" in parts:
+        raise YamlError("a flow collection holds an empty entry, which YAML "
+                        f"allows only after its last comma: {body!r}")
+    return parts
+
+
+#: A block scalar's HEADER: `|` or `>`, optionally with a chomping indicator
+#: and an explicit indentation digit. Spelled once, beside the pair of
+#: functions that read the body it introduces.
+_BLOCK_HEADER_RE = re.compile(r"[|>][-+]?\d*")
+
+
+def _significant_text(raw: str, line: int) -> str | None:
+    """The stripped line, or `None` for a line that tokenises to nothing.
+
+    Split out of `_tokenise` for #135. One refusal and both of this reader's
+    "nothing here" cases are decided by the raw line ALONE, before any
+    indentation, marker or key has been read: a tab in the indentation is
+    refused outright, and a blank line or a whole-line comment carries no
+    record at all.
+    """
+    if "\t" in raw[: len(raw) - len(raw.lstrip())]:
+        raise YamlError(f"line {line}: tab used for indentation")
+    stripped = raw.strip()
+    if not stripped or stripped.startswith("#"):
+        return None
+    return stripped
+
+
+def _document_marker(marker: str, seen_doc: bool) -> bool:
+    """`seen_doc` after a `---` or `...` line. Split out of `_tokenise` (#135).
+
+    A SECOND `---` opens a second document, which this reader refuses rather
+    than guess which of them its caller meant. `...` ends a document and says
+    nothing about how many there have been, so it leaves the flag where it is.
+    """
+    if marker == "---":
+        if seen_doc:
+            raise YamlError("multiple documents are not supported")
+        return True
+    return seen_doc
+
+
+def _peel_dashes(recs: list[_Rec], indent: int, content: str,
+                 line: int) -> tuple[int, str]:
+    """Peel leading `- ` markers into DASH records so a sequence item's
+    content sits at its own column, which is where its sibling keys are.
+
+    Split out of `_tokenise` for #135. It returns the column and the text that
+    are LEFT once every marker on the line has a record of its own, which is
+    what the rest of the line is then read at.
+    """
+    while True:
+        m = _DASH_RE.match(content)
+        if not m:
+            return indent, content
+        recs.append(_Rec(indent, "", True, line))
+        indent += len(m.group(0))
+        content = content[m.end():]
+
+
+def _refuse_unsupported(content: str, line: int) -> None:
+    """The two constructs this reader will not guess at, refused by name.
+
+    Split out of `_tokenise` for #135. An explicit key and a merge key each
+    have a meaning the reader would have to invent, and an invented meaning in
+    a validator is a wrong answer with a confident tone.
+    """
+    if content.startswith("? "):
+        raise YamlError(f"line {line}: explicit keys are not supported")
+    if content.startswith("<<"):
+        raise YamlError(f"line {line}: merge keys are not supported")
+
+
+def _opens_block_scalar(kv: tuple[str, str] | None) -> bool:
+    """Does a split `key: rest` introduce a literal or folded block scalar?
+
+    Split out of `_tokenise` for #135. `|`, `>`, `|-`, `>2` and the rest of
+    that alphabet are HEADERS, and the value is the lines below them; a `rest`
+    that merely BEGINS with one of those characters (`>= 3`) is an ordinary
+    scalar and is read as one, which is why the whole of it must match.
+    """
+    return (kv is not None and kv[1][:1] in ("|", ">")
+            and _BLOCK_HEADER_RE.fullmatch(kv[1]) is not None)
+
+
+def _block_scalar_body(raw_lines: list[str], i: int,
+                       indent: int) -> tuple[list[str], int]:
+    """A block scalar's body lines, and the index of the line after them.
+
+    Split out of `_tokenise` for #135. The body is every following line MORE
+    INDENTED than the key, with the first such line's column taken as the
+    block's own indentation and stripped from all of them. A blank line
+    belongs to the body whatever its column, because it has none.
+    """
+    body: list[str] = []
+    block_indent = None
+    while i < len(raw_lines):
+        nxt = raw_lines[i]
+        if nxt.strip() == "":
+            body.append("")
+            i += 1
+            continue
+        nxt_indent = len(nxt) - len(nxt.lstrip(" "))
+        if nxt_indent <= indent:
+            break
+        if block_indent is None:
+            block_indent = nxt_indent
+        body.append(nxt[block_indent:])
+        i += 1
+    return body, i
+
+
+def _fold_block_body(body: list[str]) -> str:
+    """A FOLDED (`>`) block scalar's body, joined the way folding joins it.
+
+    Split out of `_tokenise` for #135. A blank line is a newline of its own
+    and every other line is joined to the one before it with a space; a body
+    whose LAST line is blank is stripped of newlines at both ends, because the
+    trailing one is the chomping indicator's to decide.
+    """
+    folded: list[str] = []
+    for line in body:
+        if line == "":
+            folded.append("\n")
+        elif folded and folded[-1] not in ("", "\n"):
+            folded.append(" " + line)
+        else:
+            folded.append(line)
+    if body and body[-1] == "":
+        return "".join(folded).strip("\n")
+    return "".join(folded)
+
+
+def _block_scalar_text(header: str, body: list[str]) -> str:
+    """A block scalar's body as the one string its key takes as a value.
+
+    Split out of `_tokenise` for #135. `|` keeps every line break and `>`
+    folds them; the `-` chomping indicator drops the trailing newline, and its
+    absence leaves exactly one, which is YAML's clip behaviour.
+    """
+    if header[0] == "|":
+        joined = "\n".join(body)
+    else:
+        joined = _fold_block_body(body)
+    if header.endswith("-"):
+        return joined.rstrip("\n")
+    return joined.rstrip("\n") + "\n"
+
+
+def _tokenise(text: str) -> list[_Rec]:
+    """The `_Rec` stream `_parse_nodes` reads, one record per significant line.
+
+    THE RULE THIS FUNCTION IMPLEMENTS IS THE ORDER, which is why each step of
+    it is a named helper above (#135): a line that tokenises to nothing, a
+    document marker, the `- ` markers peeled off the front, the two refusals,
+    a block scalar's header and the body swallowed under it, and last an
+    ordinary line kept as its own record.
+    """
+    recs: list[_Rec] = []
+    raw_lines = text.splitlines()
+    i = 0
+    seen_doc = False
+    while i < len(raw_lines):
+        raw = raw_lines[i]
+        i += 1
+        stripped = _significant_text(raw, i)
+        if stripped is None:
+            continue
+        if stripped in ("---", "..."):
+            seen_doc = _document_marker(stripped, seen_doc)
+            continue
+        indent, content = _peel_dashes(
+            recs, len(raw) - len(raw.lstrip(" ")), _strip_comment(stripped), i)
+        if content == "":
+            continue
+        _refuse_unsupported(content, i)
+        kv = _split_key(content)
+        if _opens_block_scalar(kv):
+            # A block scalar: swallow every following line more indented than
+            # the key, and keep the key and the body as the record's pair.
+            body, i = _block_scalar_body(raw_lines, i, indent)
+            recs.append(_Rec(indent, "", False, i,
+                             (kv[0], _block_scalar_text(kv[1], body))))
+            continue
+        recs.append(_Rec(indent, content, False, i))
+    return recs
+
+
+def _parse_nodes(recs: list[_Rec], i: int, indent: int) -> tuple[Any, int]:
+    if i >= len(recs):
+        return None, i
+    if recs[i].dash:
+        return _parse_sequence(recs, i, indent)
+    return _parse_mapping(recs, i, indent)
+
+
+def _parse_sequence(recs: list[_Rec], i: int, indent: int) -> tuple[list[Any], int]:
+    items: list[Any] = []
+    while i < len(recs) and recs[i].dash and recs[i].indent == indent:
+        i += 1
+        if i < len(recs) and recs[i].indent > indent:
+            rec = recs[i]
+            if not rec.dash and rec.block is None \
+                    and _split_key(rec.text) is None:
+                # A plain or flow SCALAR item (`- openAvatar`, `- [a, b]`).
+                value = _block_value(rec.text, rec.line)
+                i += 1
+            else:
+                value, i = _parse_nodes(recs, i, rec.indent)
+        else:
+            value = None
+        items.append(value)
+    return items, i
+
+
+def _nested_value(recs: list[_Rec], i: int, indent: int) -> tuple[Any, int]:
+    """The value of a `key:` with NOTHING after the colon, and the index past it.
+
+    Split out of `_parse_mapping` for #135. A sequence may sit at the key's own
+    column or deeper, because `- ` markers are conventionally written flush
+    with the key they belong to, so it is admitted at `>= indent`. A nested
+    mapping must be strictly deeper, or it is a SIBLING key rather than this
+    key's value. Neither, and the key's value is null.
+    """
+    if i < len(recs) and recs[i].dash and recs[i].indent >= indent:
+        return _parse_sequence(recs, i, recs[i].indent)
+    if i < len(recs) and recs[i].indent > indent:
+        return _parse_nodes(recs, i, recs[i].indent)
+    return None, i
+
+
+def _parse_mapping(recs: list[_Rec], i: int, indent: int) -> tuple[dict, int]:
+    """A block mapping's keys and values, from record `i` at `indent`.
+
+    A VALUE THAT IS A LONE `-` IS REFUSED (#393): in a block it opens a
+    sequence entry, which cannot stand on a key's line, so `k: -` is not the
+    text `-`, and PyYAML refuses it. `_scalar` refuses the other indicators;
+    this one is refused here because a flow collection reads `[-]` and
+    `{a: -}` as the text `-`, as PyYAML does.
+    """
+    out: dict[str, Any] = {}
+    while i < len(recs) and not recs[i].dash and recs[i].indent == indent:
+        rec = recs[i]
+        if rec.block is not None:
+            key, body = rec.block
+            out[key] = body
+            i += 1
+            continue
+        kv = _split_key(rec.text)
+        if kv is None:
+            raise YamlError(f"line {rec.line}: expected `key: value`, got {rec.text!r}")
+        key, rest = kv
+        i += 1
+        if rest == "":
+            out[key], i = _nested_value(recs, i, indent)
+        else:
+            out[key] = _block_value(rest, rec.line)
+    return out, i
+
+
+def _block_value(text: str, line: int) -> Any:
+    """A block mapping's value or a block sequence's scalar item, read on
+    `line`: a flow collection where `text` opens one, and otherwise a
+    scalar. A lone `-` is `_parse_mapping`'s refusal, made here: no
+    sequence item is one, because `_peel_dashes` takes `- -` for two
+    entries.
+
+    THE ONE PLACE A VALUE'S REFUSAL LEARNS ITS LINE (#708). `_scalar` and
+    `_flow` read text and know no line, so their refusals named the file
+    and not where in it: an adoption plan whose `resolution:` opened with
+    a backtick was `REFUSED yaml-unparsable: <plan>: a plain scalar cannot
+    open with a backtick ...`, among the hundreds of lines a plan holds.
+    The line is recorded on the refusal (`YamlError.line`), never put in
+    its words, where the refusal carries a remedy (`_indicator_refusal`'s):
+    one that tells a person to edit a value says where it is. The others
+    keep the words they had, which the naming gate's `declared-unverified`
+    reason and the root's `validate-pins.py` print, and tests quote, whole.
+    """
+    try:
+        if text[0] in "[{":
+            return _flow(text)
+        if text == "-":
+            raise _indicator_refusal(text)
+        return _scalar(text)
+    except YamlError as exc:
+        if exc.remediation:
+            exc.line = line
+        raise
+
+
+def parse_yaml(text: str) -> Any:
+    """Parse the supported YAML subset. Raises `YamlError` on anything else."""
+    recs = _tokenise(text)
+    if not recs:
+        return None
+    value, end = _parse_nodes(recs, 0, recs[0].indent)
+    if end != len(recs):
+        raise YamlError(f"line {recs[end].line}: unexpected indentation")
+    return value
+
+
+def load_yaml(path: Path) -> Any:
+    """Read and parse one YAML file, or raise a `Refusal` that names the file.
+
+    `UnicodeDecodeError` is caught on its own, beside `OSError` and not under
+    it, because it is a `ValueError`: `read_text` opens the file successfully
+    and only then fails to decode it, so the `OSError` clause never sees it
+    and, uncaught, it left every reader as a Python traceback (#192) rather
+    than the `REFUSED yaml-unreadable` line a missing file already gets.
+    """
+    try:
+        text = Path(path).read_text(encoding="utf-8")
+    except OSError as exc:
+        raise Refusal("yaml-unreadable", f"{path}: {exc}") from exc
+    except UnicodeDecodeError as exc:
+        raise Refusal(
+            "yaml-unreadable",
+            f"{path}: not UTF-8 at byte {exc.start} ({exc.reason})",
+            "Remediation: every YAML file this tool reads must be UTF-8. "
+            f"Byte {exc.start}, counting from 0 at the start of the file, is "
+            "the first one that is not: re-save the file as UTF-8, or replace "
+            "that byte with the character it was meant to be, and run the "
+            "command again.") from exc
+    try:
+        return parse_yaml(text)
+    except YamlError as exc:
+        # The remedy a value's refusal carries, and the line it was read on
+        # (#708): with neither, a plan that read as text before #392 and
+        # #393 ended `check` with a refusal a person could not act on.
+        where = "" if exc.line is None else f"line {exc.line}: "
+        raise Refusal("yaml-unparsable", f"{path}: {where}{exc}",
+                      exc.remediation) from exc
+
+
+# ---------------------------------------------------------------------------
+# git helpers and the digest definition
+# ---------------------------------------------------------------------------
+
+
+def git_out(args: list[str], cwd: Path, binary: bool = False,
+            env: dict[str, str] | None = None) -> Any:
+    """`git <args>` in `cwd`, its stdout, or a `git-failed` refusal.
+
+    `env` is the whole environment git runs in, None for this process's
+    own. A git that cannot be STARTED (none on PATH) raises `OSError` from
+    here, never a refusal: whether that is a question the caller cannot
+    answer is the caller's to say (#368).
+
+    THE REFUSAL'S TWO UNTRUSTED PARTS ARE SPELLED (#610), because it is
+    printed as a line, and a root's `validate-pins.py` prints it inside the
+    `neutral-pin-source-unreadable` FINDING. `cwd` is a person's path, named
+    with `shown_path`: as it is, unless a character in it is not printable.
+    What git printed is `spelled`, as ONE line. git echoes the paths it
+    reads (`invalid gitfile format: <cwd>/.git`, `not a git repository:
+    <gitdir>`, `detected dubious ownership in repository at '<cwd>'`) and
+    passes a line break through, so a folder named with a line break, then
+    `WARNING forged-line: ...`, began a line the tool never printed; git
+    2.43 replaces an ESC, a CR or a BEL that it echoes with `?` but passes
+    a line break and a C1 control (U+0080 to U+009F) through, and another
+    git may replace nothing, so everything git printed is spelled. A line
+    break git itself printed between two lines of its message is `\\n`
+    here, because it cannot be told from a path's. Printable text, UTF-8
+    included, is unchanged. `args`, which the caller wrote, are named as
+    they were.
+    """
+    proc = subprocess.run(
+        ["git", *args], cwd=str(cwd), capture_output=True, check=False,
+        env=env,
+    )
+    if proc.returncode != 0:
+        raise Refusal(
+            "git-failed",
+            "`git {}` in {} exited {}: {}".format(
+                " ".join(args), shown_path(cwd), proc.returncode,
+                spelled(proc.stderr.decode("utf-8", "replace").strip()),
+            ),
+        )
+    return proc.stdout if binary else proc.stdout.decode("utf-8").strip()
+
+
+def tree_digest(repo: Path, rev: str) -> str:
+    """sha256 of the CANONICAL LISTING of the tree reachable from `rev`.
+
+    Definition (`sorted-ls-tree-r-v1`), exactly:
+
+        records = `git ls-tree -r -z <rev>` split on NUL, empty records dropped
+        each record is `<mode> SP <type> SP <oid> TAB <path>`, path UNQUOTED
+        sort the records bytewise ascending
+        digest = sha256( b"".join(record + b"\\n" for record in records) )
+
+    `-r` walks the whole tree and emits blobs and gitlinks but no tree entries;
+    `-z` is what makes the path column raw bytes rather than something whose
+    quoting depends on `core.quotePath`. Mode is included, so a permission
+    change is drift; the oid is included, so any content change is drift; a
+    submodule entry appears as `160000 commit <oid>`, so a leg's own pin moving
+    is drift too. The output is therefore a complete content address of the
+    tree, computed with sha256 rather than with git's object hash.
+    """
+    raw = git_out(["ls-tree", "-r", "-z", rev], cwd=repo, binary=True)
+    records = sorted(r for r in raw.split(b"\x00") if r)
+    digest = hashlib.sha256()
+    for record in records:
+        digest.update(record)
+        digest.update(b"\n")
+    return digest.hexdigest()
+
+
+def tree_digest_from_gh(repository: str, commit: str) -> str:
+    """The same `sorted-ls-tree-r-v1` digest, read from the forge's own
+    recursive tree listing — no clone, no working tree, just `gh api`.
+
+    A SHALLOW READ, not a clone: `git/trees/<commit>?recursive=1` returns one
+    row per object with `mode`, `type`, `sha` and `path` — exactly the four
+    columns `git ls-tree -r -z` emits, which is what makes the two readings
+    the same number. Tree rows are dropped because `-r` emits none; a
+    submodule arrives as `type: commit` with mode `160000` and is kept, as
+    `ls-tree` keeps it. This mirrors `scaffold-project.py`'s own
+    `pin_digest_from_gh`, which computes a `neutral-product-pin`'s digest
+    this exact way the first time a project declares one; a validator that
+    reads it back must agree with the tool that wrote it.
+
+    Raises `Refusal` — `gh-not-found`, `gh-unreadable`, `gh-response-
+    unreadable` or `gh-tree-truncated` — naming exactly what went wrong. A
+    caller with an offline story to try first, and a SKIP to report if this
+    also fails, always catches this rather than letting it reach a user
+    directly: an unanswerable neutral-product pin is a gap in the check, not
+    a reason to fail a project that only lacks a `gh` login.
+    """
+    try:
+        proc = subprocess.run(
+            ["gh", "api", GH_TREE_API.format(repo=repository, commit=commit)],
+            # UTF-8 and STRICT, not `errors="replace"`: this JSON becomes a
+            # digest, and a replaced byte would be a wrong digest with a
+            # confident tone (#217).
+            capture_output=True, text=True, encoding="utf-8", check=False)
+    except FileNotFoundError as exc:
+        raise Refusal("gh-not-found",
+                      f"the `gh` CLI is not on PATH: {exc}") from exc
+    if proc.returncode != 0:
+        raise Refusal(
+            "gh-unreadable",
+            f"`gh api` could not read {repository} @ {commit}: "
+            f"{proc.stderr.strip()}",
+        )
+    try:
+        payload = json.loads(proc.stdout)
+    except json.JSONDecodeError as exc:
+        raise Refusal("gh-response-unreadable",
+                      f"{repository} @ {commit}: {exc}") from exc
+    if payload.get("truncated"):
+        raise Refusal(
+            "gh-tree-truncated",
+            f"the forge truncated its tree listing for {repository} @ "
+            f"{commit}, so the digest would be computed over a PARTIAL tree",
+        )
+    records = sorted(
+        f"{row['mode']} {row['type']} {row['sha']}\t{row['path']}".encode()
+        for row in payload.get("tree") or [] if row.get("type") != "tree")
+    digest = hashlib.sha256()
+    for record in records:
+        digest.update(record)
+        digest.update(b"\n")
+    return digest.hexdigest()
+
+
+FREE_PLAN_HINT = """\
+NOTE {org} is on the GitHub FREE plan, where ORGANISATION Actions secrets are
+     delivered only to PUBLIC repositories. {what} private, so org-level
+     SHAPE_LEGS_APP_ID / SHAPE_LEGS_APP_PRIVATE_KEY resolve to EMPTY inside
+     the workflow and the `validate` check degrades to `credential source:
+     none` — green, because it skips the pin check rather than failing, which
+     is the worst way to be wrong. Set them as REPOSITORY secrets instead:
+
+         gh secret set SHAPE_LEGS_APP_ID --repo {repo} --body '<app id>'
+         gh secret set SHAPE_LEGS_APP_PRIVATE_KEY --repo {repo} < key.pem
+
+     or upgrade the organisation to Team, where the org secrets work as
+     written. Measured on InkRouter, 2026-09-04: the App was installed and
+     the org secrets existed at `visibility: all`, and both split pull
+     requests still fetched no legs."""
+
+
+def free_plan_secret_hint(org: str, repo: str, what: str) -> str | None:
+    """The Free-plan repository-secret hint, or None if it does not apply.
+
+    THE FAILURE THIS EXISTS FOR IS SILENT. On the Free plan an organisation
+    secret is simply not delivered to a private repository — no error, no
+    warning, `secrets.SHAPE_LEGS_APP_ID` is the empty string — so the App
+    steps skip, the legs go unfetched, and `validate` reports SUCCESS with
+    the lockstep pin check quietly skipped. Somebody who set the org secrets
+    correctly, on an org where the App is correctly installed, gets a green
+    check that verified nothing. That is worth one `gh api` call at create
+    time.
+
+    Returns None whenever the answer is not a confident "free": no `gh` on
+    PATH, an unreadable or unparseable response, a plan the API did not name.
+    A tool running offline or against a local remote must print nothing
+    rather than guess — a wrong hint about credentials is worse than none.
+    """
+    try:
+        proc = subprocess.run(
+            ["gh", "api", f"orgs/{org}", "--jq", ".plan.name"],
+            capture_output=True, text=True, encoding="utf-8",
+            errors="replace", check=False)
+    except OSError:  # FileNotFoundError (no `gh` on PATH) is already an OSError
+        return None
+    if proc.returncode != 0:
+        return None
+    if proc.stdout.strip().lower() != "free":
+        return None
+    return FREE_PLAN_HINT.format(org=org, repo=repo, what=what)
+
+
+def file_sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with open(path, "rb") as handle:
+        for chunk in iter(lambda: handle.read(65536), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+#: How to read the gitlink out of each listing, INDEX FIRST: the argv, which
+#: column holds the oid once the tab is folded into the spaces, and which
+#: holds the merge STAGE, if the listing has one. `ls-files -s` emits
+#: `<mode> SP <oid> SP <stage> TAB <path>` and `ls-tree` emits
+#: `<mode> SP <type> SP <oid> TAB <path>` — the same shape with a DIFFERENT
+#: third column, so the two cannot share one index.
+#:
+#: BOTH LISTINGS TAKE THE PATH LITERALLY (#367), with the global
+#: `--literal-pathspecs`. A pathspec is a glob to `ls-files`, so a row whose
+#: hand-edited `path:` was `members/*` read the first member's gitlink and
+#: answered with it, a neighbour's commit, for every caller. Not
+#: `:(literal)` magic on the path, which a caller's own exported
+#: `GIT_LITERAL_PATHSPECS=1` switches off, and then it matches nothing.
+GITLINK_LISTINGS = (
+    (["--literal-pathspecs", "ls-files", "-s", "--"], 1, 2),
+    (["--literal-pathspecs", "ls-tree", "HEAD", "--"], 2, None),
+)
+
+#: The two pathspec settings a caller's environment can carry that git
+#: refuses BESIDE `--literal-pathspecs` ("global 'literal' pathspec setting
+#: is incompatible with all other global pathspec settings", exit 128). Both
+#: listings would then fail, and `recorded_gitlink` reads a failed listing as
+#: "no gitlink here", so an operator who exports either would see every gate
+#: refuse a gitlink that is there. They are left out of those two git calls
+#: alone. `GIT_NOGLOB_PATHSPECS` stays: git takes it beside the literal
+#: setting, and with it the path is literal anyway.
+PATHSPEC_ENV_REFUSED_BESIDE_LITERAL = ("GIT_GLOB_PATHSPECS",
+                                       "GIT_ICASE_PATHSPECS")
+
+
+def recorded_gitlink(repo: Path, path: str) -> str | None:
+    """The commit the SUPERPROJECT records for the submodule at `path`.
+
+    INDEX FIRST, HEAD SECOND. In a clean tree the two agree and the order is
+    invisible; it decides the answer only when they disagree, and when they
+    disagree the index is what the NEXT COMMIT will record. That is the moment
+    this is asked: an operator bumps a leg (`git add <leg>` moves the gitlink
+    in the index), edits the pin file to match, and runs the validator to find
+    out whether the commit they are about to make is in lockstep. Answering
+    from HEAD there reports the commit being REPLACED, which fails a correct
+    bump and passes a stale pin. HEAD remains the fallback, for a path the
+    commit records and the index does not hold at stage 0 — one the index
+    never had, and one a conflicted merge holds only at stages 1, 2 and 3.
+
+    `path` IS TAKEN LITERALLY (#367): `members/*` is the entry of that name,
+    which no index holds, and never every gitlink a glob would match. A git
+    that cannot be started raises `OSError` through this, never "no
+    gitlink": only a listing git RAN and refused is read as nothing (#368).
+    """
+    env = {name: value for name, value in os.environ.items()
+           if name.upper() not in PATHSPEC_ENV_REFUSED_BESIDE_LITERAL}
+    for args, oid_at, stage_at in GITLINK_LISTINGS:
+        try:
+            out = git_out([*args, path], cwd=repo, env=env)
+        except Refusal:
+            continue
+        for line in out.splitlines():
+            fields = line.replace("\t", " ").split()
+            if len(fields) <= oid_at or fields[0] != "160000":
+                continue
+            # STAGE 0 OR NOTHING. A conflicted merge leaves the index holding
+            # stages 1, 2 and 3 for the same path — base, ours and theirs —
+            # and none of them is a commit anybody is about to make. Taking
+            # whichever came first would answer with the merge base as often
+            # as not, so an unmerged path falls through to HEAD instead.
+            if stage_at is not None and fields[stage_at] != "0":
+                continue
+            return fields[oid_at].lower()
+    return None
+
+
+# ---------------------------------------------------------------------------
+# The naming policy
+# ---------------------------------------------------------------------------
+
+
+#: The forms decided by the CHARACTERS ALONE: `open` in front, `-Install`
+#: behind, `-wip` behind (2026-09-10, openRepoShape#81). They need nothing
+#: declared — no role, no pin, no manifest — so `classify()` answers them
+#: BEFORE the forms that do. The order WITHIN this tuple is inert, because no
+#: name can satisfy two of them.
+#:
+#: IN CODE RATHER THAN IN THE POLICY DATA, deliberately, and it is the one
+#: rule here that is. A `unambiguous_by_construction:` key read out of the
+#: file would mean a NEW classifier reading an OLD copied policy — the two are
+#: separate rows of a project's `shape-pin.yaml` and `update-shape.py` can
+#: move one without the other — classifying every `open<Product>` as a project
+#: leg, because a file silent about the key would grant nothing. So the list
+#: lives with the code that consults it, and a fork that adds a form of its
+#: own adds it here beside its pattern.
+UNAMBIGUOUS_FORMS = ("neutral-product", "install", "workspace")
+
+#: How a `<Domainx><Product>` name is split into the domain stem and the
+#: PRODUCT it claims descent from. The stem is greedy, so a name carrying two
+#: `x<Upper>` splits (`MedxDataxChart`) is read at the RIGHTMOST one, which is
+#: the same reading the family's own pattern gives.
+DESCENDANT_SPLIT_PATTERN = r"^(?P<stem>[A-Za-z][A-Za-z0-9]*)x(?P<product>[A-Z][A-Za-z0-9]*)$"
+
+#: `open<Product>` is the canonical referent and is what a manifest records.
+#: `openx<Product>` is accepted as well because the neutral family itself
+#: admits an x-stem (`openxFactory`) and `codexFactory` descends from exactly
+#: that; a descendant that pinned the x-stem spelling has a referent, and
+#: refusing it would be a spelling rule masquerading as a semantic one.
+DESCENDANT_REFERENT_TEMPLATES = ("open{product}", "openx{product}")
+
+#: Where a descendant RECORDS the pin chain it reaches its referent through
+#: (2026-09-05). It is a key of a leg's `naming:` block in `project.yaml`, and
+#: the policy file names it too (`referent.chain.record_field`) so a fork reads
+#: the rule rather than this constant.
+CHAIN_RECORD_FIELD = "referent_chain"
+
+#: The key read in a LINK's own manifest when a link is verified: `openXdox`
+#: is a link of `codexDox`'s chain because `openXdox`'s `project.yaml` declares
+#: `neutral_product_pins: [openDox]`.
+CHAIN_LINK_DECLARED_BY = "neutral_product_pins"
+
+#: A recorded chain longer than this is BROKEN rather than walked. Overridable
+#: from the policy data (`referent.chain.max_length`).
+CHAIN_MAX_LENGTH = 8
+
+#: The status of a link whose tree could not be read. It is a WARNING and
+#: never changes the classification: the recorded declaration is the offline
+#: fact, and verification is the stronger check available when the other tree
+#: happens to be on the disk.
+CHAIN_UNVERIFIED = "declared-unverified"
+
+#: The env var naming a local checkout of a neutral product, so a CI job that
+#: pre-seeds one checkout per pinned product can be read without a flag.
+#: `<PRODUCT>` is the declared name, upper-cased, with every character outside
+#: `[A-Z0-9_]` turned into `_` — `openGlass` -> `SHAPE_PIN_SOURCE_OPENGLASS`.
+#: ONE variable answers both questions asked of such a checkout: the digest
+#: `validate-pins.py` recomputes from it, and the chain-link declaration
+#: `resolve_referent` verifies against it.
+#:
+#: THE NAME IS NOT INJECTIVE (#275). `.`, `-` and `_` are all legal in a
+#: product's name and all become `_`, so `open-glass`, `open_glass` and
+#: `open.glass` share `SHAPE_PIN_SOURCE_OPEN_GLASS` while naming three pin
+#: files. Every existing name is kept, because an operator may have set it and
+#: the docs name it. What is done instead (`pin_source_env_collisions`): a
+#: variable two declared products share answers for NEITHER, wherever it is
+#: read; `scaffold-project.py --pin` refuses to create such a pair; and
+#: `validate-pins.py` NOTES a pair a project already declares, and never fails
+#: it, because the project did nothing wrong that an update could undo.
+PIN_SOURCE_ENV_PREFIX = "SHAPE_PIN_SOURCE_"
+
+
+def pin_source_env_name(product: str) -> str:
+    return PIN_SOURCE_ENV_PREFIX + re.sub(r"[^A-Z0-9_]", "_", product.upper())
+
+
+def pin_product_key(product: str) -> str:
+    """What makes two declarations ONE product: the name its pin file carries,
+    `contracts/<product lowercased>-pin.yaml` (`neutral_pin_path` in
+    `shape_materialize.py` writes it; `validate-pins.py` reads it, and spells
+    it again because it ships into projects).
+
+    `lower()`, and not `casefold()`. The two agree over ASCII and part
+    company outside it: `casefold()` folds `ß` to `ss`, `ſ` to `s`, `fi` to
+    `fi` and `ς` to `σ`, which `lower()` leaves alone, so `openß` and `openss`
+    are two pin files that a casefold took for one product (#275's re-review,
+    N2). Whether two names are the same pin is whether they are the same
+    file, so that is what is asked here, and
+    `tests/test_pin_source_env_collisions.py` holds it to `neutral_pin_path`.
+    """
+    return product.lower()
+
+
+def pin_source_env_collisions(products) -> dict[str, list[str]]:
+    """The variables two or more DISTINCT products share, each with them:
+    `{variable: [product, ...]}` (#275).
+
+    PURE, and the one place the question is answered, so `scaffold-project.py`,
+    `validate-pins.py` and the chain readers below cannot disagree about it.
+    `products` is any iterable of product NAMES (`openGlass`, never
+    `opensoft/openGlass@<sha>`): an entry that is not a non-empty string is
+    not a name and is left out, as `validate-pins.py` reports it as
+    malformed on its own.
+
+    DISTINCT MEANS DISTINCT PIN FILES (`pin_product_key`): `openGlass` and
+    `OpenGlass` are one product and name one variable rightly, and whether the
+    same product is declared twice is a different question, which
+    `scaffold-project.py` answers as `scaffold-pin-collides` (#241). A product
+    listed twice is therefore never a collision here, and two that differ in
+    more than the case `lower()` folds are, when `pin_source_env_name` maps
+    them to one name. That includes names no ASCII `--pin` can spell, such as
+    `openß` and `openss`, which share `SHAPE_PIN_SOURCE_OPENSS` and have two
+    pin files.
+
+    Variables are in the order their first product was given, and each
+    group's products are in that order too, each in the spelling it was first
+    given in. A variable only one product names is not in the result.
+    """
+    by_variable: dict[str, dict[str, str]] = {}
+    for product in products or ():
+        if not isinstance(product, str) or not product:
+            continue
+        group = by_variable.setdefault(pin_source_env_name(product), {})
+        group.setdefault(pin_product_key(product), product)
+    return {variable: list(group.values())
+            for variable, group in by_variable.items() if len(group) > 1}
+
+
+def pin_source_env_shared(products) -> set[str]:
+    """The `pin_product_key` of each of `products` whose variable another of
+    them shares (#275): the products a variable must not answer for, because
+    it does not say which. A caller asks `pin_product_key(name) in` the
+    result."""
+    return {pin_product_key(product)
+            for group in pin_source_env_collisions(products).values()
+            for product in group}
+
+
+def form_id(family_id: str, role_id: str | None) -> str:
+    """`("project-leg", "assembly")` -> `"project-leg/assembly"`."""
+    return f"{family_id}/{role_id}" if role_id else family_id
+
+
+class ReferentResolution:
+    """WHETHER, and HOW, a `<Domainx><Product>` name reaches its referent.
+
+    Five answers, and the classification depends on which one:
+
+      `none`                 nothing is declared — the form is a bare claim
+      `direct`               the referent itself is pinned (2026-09-02)
+      `verified`             a recorded chain, every link read and agreeing
+      `declared-unverified`  a recorded chain, at least one link's tree not
+                             reachable. STILL A DESCENDANT: the declaration is
+                             the offline fact and the tree is the stronger
+                             check, available or not
+      `broken`              a recorded chain that does not hold — it does not
+                             start at a pin this project declares, does not
+                             end at a referent this name could have, is longer
+                             than the policy admits, repeats a link, or names
+                             a link whose OWN manifest declares something else
+
+    `warnings` are for a reader, never for an exit code; `reason` is the
+    sentence `--explain` prints, and for `broken` it NAMES the link that broke,
+    because "the chain is invalid" sends the reader to read four manifests.
+    """
+
+    REACHED = ("direct", "verified", CHAIN_UNVERIFIED)
+
+    def __init__(self, status: str = "none", referent: str | None = None,
+                 chain=(), reason: str = "", warnings=(), unverified=()):
+        self.status = status
+        self.referent = referent
+        self.chain = tuple(chain)
+        self.reason = reason
+        self.warnings = tuple(warnings)
+        self.unverified = tuple(unverified)
+
+    @property
+    def reached(self) -> bool:
+        """Is the referent reached — by a direct pin or by a held chain?"""
+        return self.status in self.REACHED
+
+    @property
+    def by_chain(self) -> bool:
+        return self.status in ("verified", CHAIN_UNVERIFIED)
+
+    def __repr__(self) -> str:  # pragma: no cover - diagnostics only
+        return (f"ReferentResolution({self.status!r}, {self.referent!r}, "
+                f"chain={list(self.chain)!r})")
+
+
+class Classification(tuple):
+    """`(family_id, role_id)`, carrying every OTHER form the name satisfies.
+
+    A 2-tuple BY CONSTRUCTION: `classify()` has always returned one and every
+    caller compares against `("project-leg", "assembly")`, so widening it would
+    have been a silent break at every call site. What is new rides alongside —
+    `also_matches`, the forms that were not chosen, and `reason`, the sentence
+    `--explain` prints — because an overlap that is resolved without being
+    RECORDED is exactly the failure this change exists to fix.
+    """
+
+    def __new__(cls, family: str, role: str | None,
+                also_matches=(), reason: str = "",
+                referent: ReferentResolution | None = None):
+        self = super().__new__(cls, (family, role))
+        self.family = family
+        self.role = role
+        self.also_matches = tuple(also_matches)
+        self.reason = reason
+        # HOW the referent was reached, when the name claimed one at all —
+        # `None` for a name that is not in `<Domainx><Product>` form. A caller
+        # that only ever compared the 2-tuple is unaffected; a caller that
+        # needs to RECORD the chain (the manifest's `naming:` block) or to
+        # WARN about an unverified link reads it here rather than re-deriving
+        # it, which is how the writer and the checker stay one rule.
+        self.referent = referent or ReferentResolution()
+        return self
+
+    def __repr__(self) -> str:  # pragma: no cover - diagnostics only
+        return (f"Classification({self.family!r}, {self.role!r}, "
+                f"also_matches={list(self.also_matches)!r})")
+
+
+# ---------------------------------------------------------------------------
+# The pieces a referent resolution is assembled from
+# ---------------------------------------------------------------------------
+#
+# Split out of `NamingPolicy.resolve_referent` for #135, each answering one
+# question that function used to answer inline. NONE OF THEM KNOWS WHAT A
+# `ReferentResolution` IS, deliberately: a resolution is still built in
+# exactly the places it was, so the reader who wants to know how a STATUS is
+# chosen still finds the whole of that in one function.
+
+
+def _pinned_basenames(declared_pins) -> set[str]:
+    """The products a manifest's `neutral_product_pins:` name, each keyed by
+    `pin_product_key`.
+
+    Folded because every comparison made against them — a referent
+    template's output, a chain's first link — is written in whatever case its
+    own file chose, and a pin is a fact about WHICH product, not about how
+    it was typed.
+
+    ONE IDENTITY FOR A PRODUCT (#444). Every reader of a chain — this, the
+    referent and link compares below, `resolve_link_source`'s keyed lookup,
+    `link_pins_from_trees`' table and the naming validator's `--link-source`
+    table — keys a name by `pin_product_key`, the pin file's own fold, which
+    `validate-pins.py` reads by. They used `casefold()`, so `openß` and
+    `openss`, two pin files, were one link: a holder whose tree declares
+    `openss` verified a chain that says `openß`, a project pinning `openss`
+    verified a chain beginning at `openß`, `--link-source openss=` answered
+    for `openß`, and a chain naming both was refused as a cycle. Over ASCII
+    the two folds make the same groups, and `lower()` only ever splits one
+    that `casefold()` makes, so no name GitHub, `--pin` or the naming policy
+    can spell answers differently.
+    """
+    return {pin_product_key(repo_basename(str(pin)))
+            for pin in (declared_pins or ()) if pin}
+
+
+def _chain_links(referent_chain) -> list[str]:
+    """A recorded chain's links, as basenames, in the spelling it records.
+
+    An empty or whitespace-only entry is not a link and is dropped, so a
+    manifest that left a blank list item behind has not thereby recorded a
+    chain that cannot hold.
+    """
+    return [repo_basename(str(link)) for link in (referent_chain or ())
+            if str(link).strip()]
+
+
+def _referent_in(referents, wanted) -> str | None:
+    """The first of `referents` whose `pin_product_key` is one of `wanted`
+    (#444: the pin file's fold, as `_pinned_basenames` says)."""
+    return next((r for r in referents if pin_product_key(r) in wanted), None)
+
+
+def _link_declarations(link_pins) -> dict[str, set[str]]:
+    """`{link: the pins ITS manifest declares}` for the links that answered.
+
+    The pins are kept in the SPELLING THAT LINK'S MANIFEST USES, so a
+    broken-link message quotes what the other tree actually says. A link whose
+    tree could not be read is ABSENT rather than empty: the two mean opposite
+    things — unverified, and declaring nothing at all — and the caller reads
+    the difference. Each link is keyed by `pin_product_key` (#444).
+    """
+    return {pin_product_key(str(link)):
+            {repo_basename(str(pin)) for pin in (pins_of or ()) if pin}
+            for link, pins_of in (link_pins or {}).items()
+            if pins_of is not None}
+
+
+def _chain_link_findings(chain, link_pins) -> tuple:
+    """What each link of a recorded chain says about the next one along it.
+
+    Split out of `NamingPolicy.resolve_referent` for #135. Returns the detail
+    of the FIRST contradiction — or `None` when there is none — beside the
+    warnings and the links whose own trees could not be read. A link that did
+    not answer is `declared-unverified` and never a failure: the recorded
+    declaration is the offline fact, and reading the other tree is the
+    stronger check, available or not.
+
+    A `LinkPins` carries, beside the links that answered, why a tree that WAS
+    reached could not: a warning for such a link says so, where a plain
+    mapping's says the tree is not reachable (#338).
+
+    A tree that is not reachable is offered the sources that would let it be
+    read: the caller's own, where its `LinkPins` has `remedies` for the link
+    (the scaffold's, #610), and otherwise the naming validator's, which
+    reads a checkout beside the project and takes `--link-source`.
+
+    A holder's tree and the next link are matched by `pin_product_key`
+    (#444): a tree declaring `openss` does not declare `openß`, whose pin
+    file is another. A holder's `remedies` entry is found by it too, so in a
+    chain naming both, each is offered its own sources and not the other's.
+    """
+    available = _link_declarations(link_pins)
+    unreadable = getattr(link_pins, "unreadable", None) or {}
+    remedies = getattr(link_pins, "remedies", None) or {}
+    warnings: list[str] = []
+    unverified: list[str] = []
+    # A link whose variable another link of the chain shares is never offered
+    # that variable: it would be read for both (#275).
+    shared = pin_source_env_shared(chain)
+    for holder, held in zip(chain, chain[1:]):
+        declared = available.get(pin_product_key(holder))
+        why = unreadable.get(pin_product_key(holder))
+        if declared is None and why is not None:
+            # A source REACHED this tree and could not read a declaration out
+            # of it, so "not reachable here" would be untrue (#338).
+            unverified.append(holder)
+            warnings.append(
+                f"{CHAIN_UNVERIFIED}: {holder} declaring a pin on {held} "
+                f"is a fact in {holder}'s own tree, which was reached but "
+                f"could not be read as a declaration ({why}). The recorded "
+                "chain still classifies.")
+            continue
+        if declared is None:
+            unverified.append(holder)
+            remedy = remedies.get(pin_product_key(holder))
+            if remedy is None:
+                variable = ("" if pin_product_key(holder) in shared
+                            else f", {pin_source_env_name(holder)},")
+                remedy = (f"a sibling checkout{variable} or --link-source "
+                          f"{holder}=<path> would let it be read")
+            warnings.append(
+                f"{CHAIN_UNVERIFIED}: {holder} declaring a pin on {held} "
+                f"is a fact in {holder}'s own tree, which is not "
+                f"reachable here ({remedy}). The recorded chain still "
+                "classifies.")
+            continue
+        if pin_product_key(held) not in {pin_product_key(pin)
+                                         for pin in declared}:
+            return (f"{holder} declares "
+                    + (", ".join(sorted(declared)) if declared else "no "
+                       "neutral-product pin at all")
+                    + f", not {held}", warnings, unverified)
+    return None, warnings, unverified
+
+
+def _unverified_note(unverified) -> str:
+    """The parenthetical a held chain's reason carries when a link went unread.
+
+    An independent statement rather than a ternary nested inside a ternary
+    (python:S3358) — the plural "s" is decided before the note it belongs to
+    is built, not while it is being built.
+    """
+    if not unverified:
+        return ""
+    plural = "" if len(unverified) == 1 else "s"
+    return f" ({len(unverified)} link{plural} declared-unverified)"
+
+
+# ---------------------------------------------------------------------------
+# The pieces a classification is assembled from
+# ---------------------------------------------------------------------------
+#
+# Split out of `NamingPolicy.classify` for #135. The two that decide a branch
+# return an ANSWER'S INGREDIENTS — `(family_id, role_id, reason, matched_key)`
+# — and never a `Classification`, because `classify`'s own `answer()` closure
+# is the single place `also_matches` is computed: a branch that built its own
+# classification would be a second place for that record to be got wrong.
+
+
+def _forms_by_family(matched) -> dict:
+    """`[(family, role), …]` grouped as `{family: [role, …]}`, order kept.
+
+    `matches()` reports every form a name satisfies in the data's precedence
+    order; this is that same list read BY FAMILY, which is how each branch of
+    the classifier asks whether the form it decides is among them.
+    """
+    by_family: dict[str, list[str | None]] = {}
+    for family_id, role_id in matched:
+        by_family.setdefault(family_id, []).append(role_id)
+    return by_family
+
+
+def _leg_roles(by_family) -> list:
+    """The leg roles the NAME satisfies, read once.
+
+    Every branch of the classifier consults them, the unambiguous forms
+    included, because a role is only ever admitted where the name can actually
+    spell it: `openDox` may carry the `assembly` role it declares because
+    `openDox` also satisfies `project-leg/assembly`, and `Widget-Install`
+    carries none because a hyphenated name satisfies no leg form at all.
+    """
+    return [r for r in (by_family.get("project-leg") or []) if r]
+
+
+def _other_forms(matched, key) -> list:
+    """Every form the name satisfies EXCEPT the one an answer consumes.
+
+    This is `Classification.also_matches`: an overlap resolved without being
+    RECORDED is exactly the failure that field exists to prevent.
+    """
+    return [form_id(f, r) for f, r in matched if (f, r) != key]
+
+
+def _descendant_reason(declared, resolution, role: str | None) -> str:
+    """The sentence `--explain` prints for a descendant-form classification.
+
+    HOW the referent was reached is the first half — through the recorded
+    chain, by a direct pin, or not required at all by this policy — and the
+    role the name also carries is the second. A policy that requires no
+    referent never reaches that second half, because it has no referent to
+    name and nothing was declared for it to carry.
+    """
+    if declared and resolution.by_chain:
+        reason = (f"descendant form reaching {declared} through the "
+                  f"{resolution.reason} → domain descendant")
+    elif declared:
+        reason = (f"descendant form with a declared pin on {declared} "
+                  "→ domain descendant")
+    else:
+        return "descendant form (this policy does not require a referent)"
+    if role:
+        reason += (f", carrying the {role} role it declares (a "
+                   "descendant may carry legs)")
+    return reason
+
+
+def _leg_answer(claimed: bool, leg_roles, declared_role, resolution,
+                referents) -> tuple | None:
+    """The answer for the residual `project-leg` reading, or None.
+
+    The role is the DECLARED one where the name satisfies it, and the widest
+    leg form it satisfies otherwise. The reason records what the name ALSO
+    claimed, and for a broken chain it quotes `resolution.reason` rather than
+    summarising it: NAME THE LINK — "the chain is invalid" sends the reader
+    off to read four manifests, and that sentence says which one broke.
+    """
+    chosen = None
+    if declared_role is not None and declared_role in leg_roles:
+        chosen, how = declared_role, "by declared role"
+    elif leg_roles:
+        chosen, how = leg_roles[0], "by its residual project-leg form"
+    if chosen is None:
+        return None
+    if claimed and resolution.status == "broken":
+        reason = (f"descendant form, {resolution.reason} → {chosen} "
+                  f"root {how}")
+    elif claimed:
+        reason = (f"descendant form, no referent pin declared (it would "
+                  f"need {referents[0]}) → {chosen} root {how}")
+    else:
+        reason = f"project leg, {chosen} {how}"
+    return ("project-leg", chosen, reason, None)
+
+
+class NamingPolicy:
+    """Ordered classifier over `contracts/repository-naming.yaml`.
+
+    ORDER IS SEMANTIC, AND THREE OF THE SIX FORMS ARE UNAMBIGUOUS BY
+    CONSTRUCTION. `open<Product>`, `<X>-Install` and `<user>-wip` say what
+    they are in their own characters: nothing else can spell them and nothing
+    else needs to be consulted, so they win outright. `UNAMBIGUOUS_FORMS` is
+    the list, and says why it is in code rather than in the data.
+
+    A NEUTRAL PRODUCT MAY ELECT THE SHAPE, and that does not disturb the
+    sentence above. Ruled by Brett Heap on 2026-09-05: "elect the shape for
+    both, follow the pin chain, no family yet", for `openDox` and `openXdox`.
+    The FORM still wins — `openDox` classifies as `neutral-product`, and no
+    declaration turns it into a leg — and it ADDITIONALLY carries the role the
+    project declares, where the family's `admits_declared_role:` lists that
+    role AND the name also satisfies that `project-leg` form. Electing confers
+    nothing, so `openDox` mounting `openDox-spec` and `openDox-code` is a fact
+    about LAYOUT and not a claim about neutrality: the same reasoning that
+    already lets a DECLARED domain descendant be an assembly root (2026-09-02).
+    `<X>-Install` is admitted into no role and could not be — a hyphenated name
+    satisfies no leg form at all — so it stays refused as any leg.
+
+    THE DESCENDANT FORM IS DIFFERENT, and this is the ruling of 2026-09-02
+    (Brett Heap): `<Domainx><Product>` is a CLAIM OF DESCENT, and a claim needs
+    a REFERENT. The name is classified as a domain descendant only when the
+    project declares a pin on the matching `open<Product>`. Without that pin
+    the DECLARED ROLE wins — `MedxScribe` in a `MedxSoft` org is an ordinary
+    project's assembly root, not a descendant of an `openScribe` that does not
+    exist — and the descendant form is recorded in `also_matches` rather than
+    thrown away. The check stays OFFLINE: a declared pin is a fact in the
+    project's own tree, so no GitHub lookup is ever needed to classify a name.
+
+    A DECLARED-ONLY FORM IS REPORTED ONLY WHEN IT IS ASKED FOR. The `family`
+    holder form (2026-09-04) is spelled exactly like an assembly root — one
+    CamelCase token — and what makes a repository a family is `family.yaml` in
+    its own tree, not its characters. A family carrying `declared_only: true`
+    is therefore skipped by `matches()` unless the caller passes that family's
+    id as `declared_role`. That is not a convenience: without it, adding the
+    form would have widened `also_matches` for every bare CamelCase name in
+    every manifest already in the wild, and `validate-manifest.py` compares
+    that list exactly.
+
+    THE SIXTH FORM IS NOT A REPOSITORY OF A PROJECT AT ALL. `workspace`
+    (2026-09-10, openRepoShape#81) is `<user>-wip`, the private repository one
+    person owns to index their own unfinished work, and it is unambiguous by
+    construction rather than declared-only: the literal `-wip` suffix is
+    spelled by no other form, so it needs no `--role` and is admitted into no
+    role — `accepts_role` refuses it as an assembly leg, which is how "nothing
+    in this standard creates one" is enforced rather than merely written down.
+    Adding it changed no existing name's answer for a reason the family form
+    could not give: no form above admits a `-wip` suffix, so every name it
+    classifies is a name that matched NOTHING before.
+
+    `matches()` still reports every form a name satisfies, in the data's
+    precedence order, so an overlap stays visible instead of being resolved in
+    silence.
+    """
+
+    def __init__(self, data: dict):
+        self.data = data
+        families = data.get("families") or []
+        if not families:
+            raise Refusal("policy-empty", "the naming policy declares no families")
+        self.families = sorted(families, key=lambda f: f.get("precedence", 99))
+        for family in self.families:
+            family["_re"] = re.compile(family["pattern"])
+            for role in family.get("roles") or []:
+                role["_re"] = re.compile(role["pattern"])
+            referent = family.get("referent") or {}
+            family["_split_re"] = re.compile(
+                referent.get("split_pattern") or DESCENDANT_SPLIT_PATTERN)
+            templates = [referent.get("canonical_template")
+                         or DESCENDANT_REFERENT_TEMPLATES[0]]
+            templates += list(referent.get("also_accepted") or [])
+            family["_referent_templates"] = tuple(templates)
+        topic = data.get("topic") or {}
+        self.topic_pattern = re.compile(topic.get("pattern", r"^xf-project-[a-z0-9-]+$"))
+        self.topic_template = topic.get("template", "xf-project-{id}")
+
+    @classmethod
+    def load(cls, path: Path) -> "NamingPolicy":
+        data = load_yaml(path)
+        if not isinstance(data, dict):
+            raise Refusal("policy-unreadable", f"{path}: not a mapping")
+        if data.get("kind") != "repository-naming-policy":
+            raise Refusal(
+                "policy-wrong-kind",
+                f"{path}: kind is {data.get('kind')!r}, expected "
+                "'repository-naming-policy'",
+            )
+        return cls(data)
+
+    # -- the data ----------------------------------------------------------
+
+    def family(self, family_id: str) -> dict | None:
+        return next((f for f in self.families if f["id"] == family_id), None)
+
+    def requires_referent(self, family_id: str) -> bool:
+        """Does this family's form only CLAIM membership until something else
+        is declared? Declared in the data, so a fork can read the rule."""
+        family = self.family(family_id)
+        return bool(family and family.get("requires_referent"))
+
+    # -- referents ---------------------------------------------------------
+
+    def descendant_referents(self, name: str) -> tuple[str, ...]:
+        """The neutral products `name` would have to pin to BE a descendant.
+
+        Empty when the name is not in `<Domainx><Product>` form at all. The
+        first entry is canonical and is what a manifest records.
+        """
+        family = self.family("domain-descendant")
+        if family is None or not family["_re"].match(name):
+            return ()
+        match = family["_split_re"].match(name)
+        if not match:
+            return ()
+        product = match.groupdict().get("product")
+        if not product:
+            return ()
+        return tuple(t.format(product=product)
+                     for t in family["_referent_templates"])
+
+    def descendant_referent(self, name: str) -> str | None:
+        """The CANONICAL `open<Product>` a descendant-form name claims."""
+        referents = self.descendant_referents(name)
+        return referents[0] if referents else None
+
+    def chain_rule(self) -> dict:
+        """The `referent.chain:` block of the descendant family, as data.
+
+        Empty when a fork's policy declares none, which switches the chain off
+        without switching the referent rule off: the direct pin is the older
+        rule and answers on its own.
+        """
+        family = self.family("domain-descendant") or {}
+        return (family.get("referent") or {}).get("chain") or {}
+
+    def resolve_referent(self, name: str, declared_pins=None,
+                         referent_chain=None,
+                         link_pins=None) -> ReferentResolution:
+        """How `name` reaches its referent, given what is DECLARED about it.
+
+        `declared_pins` is `project.yaml`'s `neutral_product_pins:`;
+        `referent_chain` is the chain that manifest RECORDS (2026-09-05);
+        `link_pins` maps a link's name to the pins ITS OWN manifest declares,
+        for the links whose trees were reachable — a link absent from the
+        mapping is `declared-unverified`, which is not a failure.
+
+        A RECORDED CHAIN IS READ FIRST, because it is what the project says it
+        relies on and a record nothing consults is not a record. The direct pin
+        answers when no chain is recorded and whenever a recorded one does not
+        hold, so no name that classified as a descendant on 2026-09-02 stops
+        being one here: the chain only ever ADDS an answer.
+        """
+        referents = self.descendant_referents(name)
+        if not referents:
+            return ReferentResolution()
+        pins = _pinned_basenames(declared_pins)
+        direct = _referent_in(referents, pins)
+
+        def directly(extra_warnings=()) -> ReferentResolution:
+            return ReferentResolution(
+                "direct", direct, reason=f"declared pin on {direct}",
+                warnings=extra_warnings)
+
+        chain = _chain_links(referent_chain)
+        if not chain:
+            if direct is not None:
+                return directly()
+            return ReferentResolution(
+                reason="no referent pin declared (it would need "
+                       + " or ".join(referents) + ")")
+
+        rendered = " → ".join(chain)
+
+        def broken(detail: str) -> ReferentResolution:
+            said = f"the declared chain {rendered} is broken ({detail})"
+            if direct is not None:
+                # The direct pin was sufficient before any chain was recorded
+                # and stays sufficient now. A broken chain beside it is a
+                # RECORD to repair, reported as a warning, never an answer
+                # taken away.
+                return directly((f"{said}; the direct pin on {direct} is what "
+                                 "classifies this name",))
+            return ReferentResolution("broken", None, chain, reason=said)
+
+        problem = self._chain_shape_problem(name, chain, pins, referents)
+        if problem is not None:
+            return broken(problem)
+        final = _referent_in(referents, {pin_product_key(chain[-1])})
+        contradiction, warnings, unverified = _chain_link_findings(chain,
+                                                                   link_pins)
+        if contradiction is not None:
+            return broken(contradiction)
+        status = CHAIN_UNVERIFIED if unverified else "verified"
+        return ReferentResolution(
+            status, final, chain,
+            reason=f"declared pin chain {rendered}"
+                   + _unverified_note(unverified),
+            warnings=warnings, unverified=unverified)
+
+    def _chain_shape_problem(self, name: str, chain: list,
+                             pins: set, referents) -> str | None:
+        """What is wrong with a recorded chain's SHAPE, or None if nothing is.
+
+        Split out of `resolve_referent` for #135, asking the four questions in
+        the order that function asked them: is the chain longer than the
+        policy admits, does it repeat a link, does it begin at a pin this
+        project actually holds, and does it end at a referent this name could
+        have. Each answer becomes the `detail` of a `broken` resolution, which
+        is where the reader is told WHICH link broke rather than merely that
+        one did.
+
+        A link is one product by `pin_product_key` (#444), so `openß` and
+        `openss` in one chain are two links and not a repeat, and a chain
+        beginning at `openß` does not begin at a pin on `openss`.
+        """
+        max_length = int(self.chain_rule().get("max_length") or CHAIN_MAX_LENGTH)
+        if len(chain) > max_length:
+            return (f"it names {len(chain)} links and the policy admits "
+                    f"at most {max_length}")
+        seen = [pin_product_key(link) for link in chain]
+        if len(set(seen)) != len(seen):
+            return "it repeats a link, so it is a cycle rather than a chain"
+        if pin_product_key(chain[0]) not in pins:
+            return (f"it begins at {chain[0]}, which is not in this "
+                    "project's `neutral_product_pins:` — the first "
+                    "entry is the pin this project actually holds")
+        if _referent_in(referents, {pin_product_key(chain[-1])}) is None:
+            return (f"it ends at {chain[-1]}, but {name} would need "
+                    + " or ".join(referents))
+        return None
+
+    def reads_link_declarations(self, name: str, declared_pins=None,
+                                referent_chain=None) -> bool:
+        """Does `resolve_referent` ask what a link's OWN manifest declares?
+
+        Only for a name in `<Domainx><Product>` form whose recorded chain's
+        SHAPE holds: a name that claims no referent never reads a chain, and
+        a chain that is broken in its shape is reported broken before any
+        link is consulted. A caller about to read link trees asks this first,
+        so that it neither reads nor reports on a tree no classification
+        will use (#338). `tests/test_naming_policy.py` holds the two
+        together: `resolve_referent` is run with a mapping that notes
+        whether it was read, over every way a chain is not.
+        """
+        referents = self.descendant_referents(name)
+        chain = _chain_links(referent_chain)
+        if not referents or not chain:
+            return False
+        return self._chain_shape_problem(
+            name, chain, _pinned_basenames(declared_pins), referents) is None
+
+    # -- classification ----------------------------------------------------
+
+    def declared_only(self, family_id: str) -> bool:
+        """Is this form reported ONLY when the reader declares it?
+
+        Declared in the data, like `requires_referent`, so a fork can read the
+        rule rather than infer it from the classifier's behaviour.
+        """
+        family = self.family(family_id)
+        return bool(family and family.get("declared_only"))
+
+    def matches(self, name: str,
+                declared_role: str | None = None) -> list[tuple[str, str | None]]:
+        """Every (family_id, role_id) the name satisfies, in precedence order.
+
+        A `declared_only` family is included only when `declared_role` is that
+        family's own id — `matches("InkRouter")` is unchanged by the family
+        form existing, and `matches("InkRouter", "family")` reports it.
+        """
+        found: list[tuple[str, str | None]] = []
+        for family in self.families:
+            if family.get("declared_only") and declared_role != family["id"]:
+                continue
+            roles = family.get("roles") or []
+            hit = False
+            for role in roles:
+                if role["_re"].match(name):
+                    found.append((family["id"], role["id"]))
+                    hit = True
+            if not hit and family["_re"].match(name):
+                found.append((family["id"], None))
+        return found
+
+    def classify(self, name: str, declared_role: str | None = None,
+                 declared_pins=None, referent_chain=None,
+                 link_pins=None) -> Classification | None:
+        """Classify `name`, given what the project DECLARES about itself.
+
+        `declared_role` is one of {assembly, spec, code}; `declared_pins` is the
+        set of neutral products the project declares a pin on; `referent_chain`
+        is the chain of neutral-product pins the manifest RECORDS as reaching
+        its referent, and `link_pins` is what the reachable links declare. All
+        are optional and all are read from `project.yaml` where one exists.
+
+        The order:
+          1. `neutral-product`, 2. `install` and 3. `workspace` — unambiguous
+             by construction (`UNAMBIGUOUS_FORMS`), carrying a DECLARED role
+             their family ADMITS where the name also satisfies that leg form
+             (2026-09-05). `install` and `workspace` admit none.
+          4. a DECLARED-ONLY form the caller asked for by name (`family`).
+          5. `domain-descendant` — ONLY when a referent is REACHED, directly
+             (2026-09-02) or through the recorded chain (2026-09-05).
+          6. `project-leg` in the DECLARED role, when the name satisfies it.
+          7. `project-leg` residual — the widest form, deliberately last.
+        """
+        matched = self.matches(name, declared_role)
+        if not matched:
+            return None
+        by_family = _forms_by_family(matched)
+        resolution = self.resolve_referent(name, declared_pins, referent_chain,
+                                           link_pins)
+
+        def answer(family_id: str, role_id: str | None, reason: str,
+                   matched_key: tuple | None = None) -> Classification:
+            # `matched_key` is the entry of `matched` this answer CONSUMES. It
+            # differs from the answer itself in exactly one case: a descendant
+            # that takes its role from the declared one, where the consumed
+            # entry is `("domain-descendant", None)`. Without it the family a
+            # name was classified INTO would also be listed among the forms it
+            # was not, which is a record contradicting itself.
+            key = matched_key if matched_key is not None else (family_id, role_id)
+            return Classification(family_id, role_id,
+                                  _other_forms(matched, key), reason, resolution)
+
+        leg_roles = _leg_roles(by_family)
+        unambiguous = self._unambiguous_answer(by_family, declared_role,
+                                               leg_roles)
+        if unambiguous is not None:
+            return answer(*unambiguous)
+
+        # A declared-only form the caller ASKED for. It sits above the leg
+        # forms in the decision even though its precedence is below them: the
+        # precedence orders the residual reading of a bare name, and this is
+        # not a residual reading — somebody said which question they were
+        # asking, and `family.yaml` in that tree is what let them.
+        if declared_role and self.declared_only(declared_role) \
+                and declared_role in by_family:
+            return answer(declared_role, by_family[declared_role][0],
+                          f"the {declared_role} form, DECLARED — the name is "
+                          "spelled like an assembly root and only the "
+                          "declaration tells them apart")
+
+        claimed = "domain-descendant" in by_family
+        referents = self.descendant_referents(name) if claimed else ()
+        # REACHED, not merely pinned (2026-09-05). A direct pin answers exactly
+        # as it did before; a RECORDED chain that holds answers too, and a
+        # chain with an unreadable link answers with a warning rather than
+        # falling back — the declaration is the offline fact.
+        declared = resolution.referent if resolution.reached else None
+        if claimed and (declared or not self.requires_referent("domain-descendant")):
+            return answer(*self._descendant_answer(by_family, declared_role,
+                                                   leg_roles, declared,
+                                                   resolution))
+
+        leg = _leg_answer(claimed, leg_roles, declared_role, resolution,
+                          referents)
+        if leg is not None:
+            return answer(*leg)
+
+        # Unreachable with the shipped patterns — every descendant-form name is
+        # also a bare CamelCase token — but a policy file is data, and data can
+        # be edited. An unresolved claim is reported as one rather than being
+        # promoted to a classification by exhaustion.
+        if claimed:
+            return answer("domain-descendant", by_family["domain-descendant"][0],
+                          f"descendant form, no referent pin declared (it would need "
+                          f"{referents[0] if referents else 'open<Product>'}) and the "
+                          "name satisfies no other form")
+
+        # AND A FORM NO BRANCH ABOVE CLAIMED IS STILL REPORTED, not raised.
+        # `matched` is not empty — some family's pattern said yes — so the
+        # honest answer is its highest-precedence entry, with a reason saying
+        # this classifier has no rule of its own for it. That is the path a
+        # SEVENTH form reaches on the day it is added to the data and before
+        # anybody writes its branch here: until `workspace` was wired into
+        # `UNAMBIGUOUS_FORMS` (2026-09-10) the descendant line above raised
+        # `KeyError: 'domain-descendant'` for `brett-wip`, which is a data file
+        # crashing the tool that reads it instead of being read by it.
+        family_id, role_id = matched[0]
+        return answer(family_id, role_id,
+                      f"the {family_id} form, by precedence; this classifier "
+                      "has no rule of its own for it")
+
+    def _unambiguous_answer(self, by_family, declared_role,
+                            leg_roles) -> tuple | None:
+        """The answer for a form decided by the CHARACTERS ALONE, or None.
+
+        Split out of `classify` for #135. It returns an answer's INGREDIENTS —
+        `(family_id, role_id, reason, matched_key)` — rather than a
+        `Classification`, so `classify`'s own `answer()` closure stays the one
+        place `also_matches` is computed and a classification is built.
+
+        A NEUTRAL PRODUCT MAY ELECT THE SHAPE (Brett Heap, 2026-09-05). The
+        form is not being overridden — it is still the answer, and the entry
+        this CONSUMES is `(family_id, None)`, so `project-leg/assembly`
+        survives in `also_matches` exactly as it did before. What is added is
+        the ROLE the project declares, and only where the family's data admits
+        it and the name satisfies that leg form. Electing confers nothing, so
+        this records a layout, not a claim; it is the same MECHANISM as
+        `_descendant_answer` below, both reading `admits_declared_role:` — but
+        this one is deliberately STRICTER about what an absent key means. With
+        no `admits_declared_role:` in the data it admits NOTHING (`or ()`),
+        because the admission itself is the 2026-09-05 rule and the file must
+        say so or grant nothing. `_descendant_answer` falls back to
+        `or ("assembly",)` instead, because that key predates this ruling: it
+        keeps the 2026-09-02 behaviour for a policy file that never wrote the
+        key at all, and changing the fallback would be changing that ruling's
+        answer out from under a file silent about it.
+        """
+        for family_id in UNAMBIGUOUS_FORMS:
+            if family_id not in by_family:
+                continue
+            family = self.family(family_id) or {}
+            admitted = family.get("admits_declared_role") or ()
+            if by_family[family_id][0] is None and declared_role is not None \
+                    and declared_role in admitted and declared_role in leg_roles:
+                title = str(family.get("title") or family_id).lower()
+                return (family_id, declared_role,
+                        f"the {family_id} form is unambiguous by construction; it "
+                        f"carries the {declared_role} role it declares — a {title} "
+                        "may elect the shape (Brett Heap, 2026-09-05)",
+                        (family_id, None))
+            return (family_id, by_family[family_id][0],
+                    f"the {family_id} form is unambiguous by "
+                    "construction, so it needs nothing declared", None)
+        return None
+
+    def _descendant_answer(self, by_family, declared_role, leg_roles,
+                           declared, resolution) -> tuple:
+        """The answer for a descendant claim `classify` decided to honour.
+
+        Split out of `classify` for #135, returning the same
+        `(family_id, role_id, reason, matched_key)` ingredients as
+        `_unambiguous_answer` above. TWO PATHS REACH IT, and
+        `_descendant_reason` words both: a referent REACHED — by a direct pin
+        or through a chain that holds, with `declared` naming it — and a
+        policy whose descendant family does not require a referent at all,
+        where `declared` is None and the reason says exactly that.
+
+        A DESCENDANT MAY CARRY LEGS (Brett Heap, 2026-09-02). The descendant
+        family declares no roles of its own, so the role a descendant answers
+        with is the one the project DECLARES, and only where the name also
+        satisfies that leg form. `MedxGlass` pins `openGlass` AND mounts
+        `MedxGlass-spec` and `MedxGlass-code`: it is a descendant AND the
+        assembly root. Refusing that pair would have made the descendant
+        ruling and the three-repository shape mutually exclusive, which
+        neither ruling says and both organisations that have one need both of.
+        """
+        family = self.family("domain-descendant") or {}
+        admitted = family.get("admits_declared_role") or ("assembly",)
+        role = by_family["domain-descendant"][0]
+        if role is None and declared_role is not None \
+                and declared_role in leg_roles \
+                and declared_role in admitted:
+            role = declared_role
+        return ("domain-descendant", role,
+                _descendant_reason(declared, resolution, role),
+                ("domain-descendant", by_family["domain-descendant"][0]))
+
+    def topic_for(self, project_id: str) -> str:
+        return self.topic_template.format(id=project_id)
+
+
+def checked_value(what: str, value, pattern: re.Pattern = SAFE_ARG_RE) -> str:
+    """Validate one caller-supplied value BEFORE it becomes a command argument.
+
+    ARGUMENT INJECTION IS THE THREAT, not shell injection: every command here
+    is a list with `shell=False`, so there is no shell to inject into — but
+    `git` reads its own arguments, and a `--tracking-branch` of
+    `--upload-pack=…` is a command, not a branch. A value that begins with `-`
+    is therefore refused outright, and the rest must be spellable as a branch
+    name, a path, a repository name or a commit.
+
+    The values that reach here come from a command line, from `project.yaml`
+    and — in `adopt-project.py` — from an adoption plan that an AI assistant
+    may have written. The last of those is exactly why this is a check in the
+    code rather than a note in the README.
+
+    `pattern` is `SAFE_PATH_RE` for a value that is a FILESYSTEM PATH the
+    operator named: a Windows path carries a drive colon and backslashes, and
+    refusing those would refuse the platform rather than the threat. Whichever
+    pattern is passed, a leading `-` and a value that is nothing but
+    whitespace are refused here, before it is consulted.
+    """
+    text = str(value)
+    if text.startswith("-") or not text.strip() or not pattern.fullmatch(text):
+        raise Refusal(
+            "unsafe-value",
+            f"{what} is {text!r}, which is not a value this tool will put on "
+            "a `git` or `gh` command line",
+            "Remediation: a leading `-` is refused because git reads its own "
+            "arguments (`--upload-pack=…` is a command, not a branch); the "
+            f"rest must match {pattern.pattern}.")
+    return text
+
+
+# ---------------------------------------------------------------------------
+# A path spelled the one way Git records it (#179, #189)
+# ---------------------------------------------------------------------------
+#
+# Git records a path in exactly one spelling: relative to the top of its
+# repository, `/` between segments, and no segment empty, `.` or `..`.
+# `git update-index` refuses `./x`, `x/`, `a//b`, `a/./b`, `a/../b`, `/x` and
+# `.` alike as `Invalid path`, so a record that names a path in any other
+# spelling names one no tree holds, and nothing is ever found at it.
+#
+# TWO RULES ASK IT. The leg-path rule in `shape_materialize.py` asks it of a
+# leg's mount path (#179), and a project's own `validate-manifest.py` asks it
+# of each path `project.yaml`'s `submodules:` records (#189) -- which is why
+# it lives HERE: a project carries this file and not `shape_materialize.py`.
+# Each says the answer in its own sentence, about a leg or about a submodule.
+#
+# A BACKSLASH AND A DRIVE LETTER ARE NOT ASKED. On POSIX each is an ordinary
+# character of a name -- Git records `vendor/a\b` and `C:/x` there, refusing
+# them only on Windows -- and an adoption records a source submodule at
+# either. They are faults only in a path a PERSON types for commands that
+# Windows also runs, which is the leg-path rule's own question.
+
+#: The ways a path can fail to be spelled as Git records it, in the order
+#: `path_spelling_fault` asks: empty, absolute, climbing out with `..`,
+#: naming the top itself, and any other empty or `.` segment.
+PATH_EMPTY = "empty"
+PATH_ABSOLUTE = "absolute"
+PATH_CLIMBS = "climbs"
+PATH_ITSELF = "itself"
+PATH_NOT_CANONICAL = "not-canonical"
+
+
+def path_spelling_fault(text: str) -> str | None:
+    """Why `text` is not one path spelled as Git records it, as one of the
+    `PATH_*` codes above, or None when it is."""
+    if not text:
+        return PATH_EMPTY
+    if text.startswith("/"):
+        return PATH_ABSOLUTE
+    segments = text.split("/")
+    if ".." in segments:
+        return PATH_CLIMBS
+    if all(segment in ("", ".") for segment in segments):
+        return PATH_ITSELF
+    if "" in segments or "." in segments:
+        return PATH_NOT_CANONICAL
+    return None
+
+
+def accepts_role(found, role: str) -> bool:
+    """Is `found` an acceptable classification for a leg DECLARED as `role`?
+
+    ONE definition, consulted by the scaffold, by `adopt-project.py` and by a
+    project's own `validate-manifest.py`, because three copies of "which forms
+    may be an assembly root" is how the second one starts disagreeing with the
+    first.
+
+    Three forms pass. The ordinary one is the project-leg family in exactly the
+    declared role. The second is the 2026-09-02 ruling that a DECLARED domain
+    descendant may be an assembly root carrying legs: `MedxGlass` pins
+    `openGlass` and still mounts `MedxGlass-spec` and `MedxGlass-code`. The
+    third is the 2026-09-05 ruling that a NEUTRAL PRODUCT may elect the shape
+    and be its own assembly root: `openDox` mounts `openDox-spec` and
+    `openDox-code`, and electing confers nothing, so that is a fact about
+    layout and not a claim about neutrality.
+
+    EVERY ONE OF THE THREE ADMITS A FACT, NEVER A CLAIM. `classify` returns
+    `("domain-descendant", "assembly")` only when the pin is DECLARED, and
+    `("neutral-product", "assembly")` only when the policy's
+    `admits_declared_role:` admits the role AND the name satisfies the
+    `project-leg/assembly` form — so by the time a tuple reaches here, the
+    question this function asks has already been answered by the policy.
+
+    `spec` and `code` are unreachable for the two CamelCase forms on purpose:
+    `openDox-spec` and `MedxGlass-spec` carry the lowercase suffix and are
+    ordinary project legs, which is why the check is `role == "assembly"`.
+    """
+    if found is None:
+        return False
+    if tuple(found) == ("project-leg", role):
+        return True
+    return role == "assembly" and tuple(found) in (
+        ("domain-descendant", "assembly"), ("neutral-product", "assembly"))
+
+
+def repo_basename(repository: str) -> str:
+    """`opensoft/openRepoShape` -> `openRepoShape`; a bare name is returned."""
+    return repository.rsplit("/", 1)[-1]
+
+
+# ---------------------------------------------------------------------------
+# Is this the SAME REPOSITORY? (2026-09-12, #146, #155, #149 and #157)
+# ---------------------------------------------------------------------------
+#
+# ONE DEFINITION, BECAUSE TWO TOOLS ACT ON IT AND MUST NOT DISAGREE.
+# `templates/family-root/scripts/siblings.py` REFUSES to fetch into a clone
+# beside a family holder whose `origin` is not the member's remote (`WRONG
+# ORIGIN`), and `shape-doctor.py`'s `members` row REPORTS whether that same
+# directory is the member's working clone. While those two answered out of
+# two copies of the rule, a fork beside the holder was counted by the report
+# and skipped by the tool — about the same directory, which is the one thing
+# a doctor must not do (#146).
+#
+# WHY HERE. The doctor imports nothing out of `templates/`: those files are
+# the standard's PAYLOAD, materialized into somebody else's repository, and a
+# report that imported them would be reading the copy it is meant to be
+# comparing against. This module is the one file both may read — it is
+# stdlib-only, `scaffold-project.py` copies it into every assembly root and
+# `family.py init` into every family holder, where it lands beside
+# `siblings.py` in `scripts/` and is imported by the same `sys.path` line
+# `bootstrap.py` and `validate-family.py` already use. The cost is that this
+# file is DIGEST-PINNED, so every estate reads `upstream-changed` for it until
+# it re-pins; #147 paid for a second copy instead while a re-pin was in
+# flight, and #155 is the change that was told to ride the next one.
+#
+# ONE BEHAVIOUR CHANGED WITH THE MOVE, AND ONLY ONE (#149): case folds for a
+# remote that names a HOST and is PRESERVED for a filesystem path, so two bare
+# repositories on a case-sensitive disk that differ only in case stop being
+# called one repository. It is argued where it is decided, in
+# `_remote_names_a_host` below. Everything else answered exactly what the two
+# copies answered, spelling for spelling.
+#
+# ONE CHANGED AFTER IT, AND ONLY ONE (2026-09-13, #157): two remotes that are
+# BOTH filesystem paths are one repository only when their normalised keys are
+# EQUAL. The trailing `owner/repo` fallback used to match them too, which made
+# `/srv/a/IRRS.git` and `/other/a/IRRS.git` one repository — two bare
+# repositories under two roots, told apart by exactly the prefix the tail
+# throws away. It is argued where it is decided, in `same_repository` below.
+#
+# NOTHING HERE FETCHES ANYTHING, ASKS GIT ANYTHING OR TOUCHES A DISK. Every
+# function below is string arithmetic over remotes a caller has already read,
+# which is what lets `tests/test_windows_paths.py` ask the Windows questions
+# from Linux and `tests/test_shape_doctor.py` hold the whole rule to one
+# table. IT IS ALSO WHY `remote_local_path` STOPS WHERE IT DOES (#157): it
+# says which spelling names a path and what path it names, and the CALLER
+# that has the disk resolves it — `os.path.realpath` lives in
+# `siblings.py::same_repository_here` and its twin in the doctor, never
+# here, because one directory reached through a symlink is a fact about a
+# machine and not about a string. Those two ask THIS function first and the
+# disk only if it says no, so resolving can add an answer and never take one
+# away (Codex, PR #160).
+
+#: ANY `<scheme>://` prefix, by PATTERN rather than by a list of the schemes
+#: git happens to speak. Two reasons, in that order: a list has to be kept in
+#: step with git's transports — `ssh`, `git`, `file`, `https`, `git+ssh` and
+#: whatever an estate's own helper registers — and a list is also a list of
+#: LITERALS, one of them the clear-text HTTP scheme, which a scanner reads as
+#: a transport this file chose rather than as a string it strips (SonarCloud
+#: python:S5332, on PR #79). Dropping it is what makes
+#: `file:///srv/mirrors/Repo.git` and `/srv/mirrors/Repo.git` one answer, and
+#: `ssh://git@example.com/Org/Repo.git` and the scp spelling
+#: `git@example.com:Org/Repo.git` another.
+REMOTE_SCHEME_RE = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*://")
+
+#: The same scheme with NOTHING AFTER IT, which is what one `..` too many
+#: would leave behind if it were allowed to go on trimming.
+REMOTE_SCHEME_ONLY_RE = re.compile(r"^[A-Za-z][A-Za-z0-9+.-]*:/*$")
+
+#: A Windows drive, and the ONLY colon a filesystem path may carry: without
+#: this, `D:\remotes\Repo.git` reads as git's `host:path` scp syntax and its
+#: drive letter is eaten as a host. The same distinction `SAFE_PATH_RE` above
+#: draws for a value on a command line, for the same reason.
+REMOTE_DRIVE_RE = re.compile(r"^[A-Za-z]:$")
+
+#: A `:<port>` after the HOST of a `<scheme>://` url: where its transport
+#: connects, never which repository it reaches. Only such a url has one; in
+#: git's scp spelling `host:22/Repo.git` the `22` is the path's, and stays.
+#: Digits are required, so a drive's bare colon is never read as one.
+REMOTE_PORT_RE = re.compile(r":\d+$")
+
+#: A host that is another door into the repositories of the host it maps
+#: to: GitHub's SSH-over-the-HTTPS-port endpoint, which GitHub's own
+#: documentation spells `ssh://git@ssh.github.com:443/Org/Repo.git`.
+REMOTE_HOST_ALIASES = {"ssh.github.com": "github.com"}
+
+
+def _remote_body(url: str) -> str:
+    """A remote with its scheme, its credential and its trailing `/` gone.
+
+    THE PART EVERY QUESTION BELOW IS ASKED OF, taken off in one place rather
+    than in each of them: `<scheme>://` because the transport is not the
+    identity, `[user[:password]@]` because whoever fetches is not the
+    repository, and `\\` for `/` because only the SPELLING of a separator is
+    at stake. What is left is a host and a path, git's scp `host:path`, or a
+    path on its own — which is exactly the question `_remote_names_a_host`
+    then answers.
+
+    AND THE EMPTY AUTHORITY IN FRONT OF A WINDOWS DRIVE GOES WITH THE SCHEME
+    (2026-09-13, #157, Copilot). `file:///D:/mirrors/Fam.git` is the file url
+    RFC 8089 blesses and git accepts, and taking `file://` off it leaves
+    `/D:/mirrors/Fam.git` — a leading `/` that belongs to the URL and not to
+    the path. Without this it is the one spelling of a Windows remote that
+    does not fold to `D:\\mirrors\\Fam.git`'s key, and a person who mounted a
+    member by its file url would be told their working clone is a stranger.
+    It comes off here, where every question below is asked, rather than in
+    whichever one noticed.
+
+    ONLY WHEN A SCHEME WAS THERE TO LEAVE IT BEHIND, though, because that `/`
+    is the URL's and a remote with no scheme never had one (Copilot, PR
+    #160). `/D:/mirrors/IRRS.git` written as a PATH is a directory called
+    `D:` under a POSIX root — absurd, and somebody's — and folding it into
+    the Windows drive `D:/mirrors/IRRS.git` would report two paths that no
+    single machine could even both hold as one repository.
+    """
+    stripped = url.strip().replace("\\", "/").rstrip("/")
+    text = REMOTE_SCHEME_RE.sub("", stripped)
+    if text != stripped and text.startswith("/") and REMOTE_DRIVE_RE.match(
+            text[1:3]):
+        text = text[1:]                  # file:///D:/mirrors/Fam.git
+    if "@" in text.split("/", 1)[0]:      # git@github.com:Org/Repo.git
+        text = text.split("@", 1)[1]
+    return text
+
+
+def _remote_names_a_host(url: str) -> bool:
+    """Does this remote name a HOST rather than a filesystem PATH?
+
+    THE CASE QUESTION, AND ONLY THE CASE QUESTION (2026-09-12, #149). A
+    remote that names a host compares case-INSENSITIVELY: GitHub treats an
+    owner and a repository name that way, so `https://GitHub.com/Org/Repo`
+    and `https://github.com/org/repo` are one repository, and a report that
+    called them two would send somebody to delete a good clone over a
+    capitalisation. A FILESYSTEM PATH does not: `/srv/mirrors/IRRS.git` and
+    `/srv/mirrors/irrs.git` are two different bare repositories on a
+    case-sensitive host, and the estates that mount members from bare
+    repositories on disk — every fixture in this suite, and any mirror-based
+    family — are exactly the ones where a remote is a path.
+
+    A REMOTE IS A PATH WHEN IT IS ONE OF THESE FOUR, and a host otherwise:
+
+      * an ABSOLUTE path, `/srv/mirrors/Repo.git`;
+      * `file:///srv/mirrors/Repo.git`, which is the same answer arrived at
+        by a different road — that spelling carries an EMPTY authority, so
+        the scheme leaves an absolute path and no host behind it;
+      * a WINDOWS DRIVE, `D:\\a\\remotes\\Fam.git` — the one colon that is
+        NOT scp syntax;
+      * a RELATIVE path written `./` or `../`, which is the spelling git
+        itself requires of a relative remote (Copilot and Codex, PR #156):
+        a holder whose own `origin` is `../mirrors/Fam.git` is as much on a
+        disk as one whose origin is absolute, and lowercasing it would put
+        back the very false positive #149 is about.
+
+    Everything else names a host: `<scheme>://<host>/…`, git's scp spelling
+    `[user@]host:path`, and the bare `Org/Repo` a `family.yaml` `repository:`
+    row is written as, which names a forge repository and no directory at all.
+
+    THE BARE TWO-SEGMENT FORM IS READ AS A FORGE NAME, DELIBERATELY, and it
+    is the one place this cannot be decided from the string: `mirrors/Fam.git`
+    might be a directory under whatever the process is standing in, and
+    nothing in it says so. `Org/Repo` is what every manifest in this standard
+    writes and what `siblings.py::clone_url` turns into
+    `https://github.com/Org/Repo.git`, so that is what an unanchored value is
+    taken for — and a person who means a path from somewhere writes `./`,
+    which git requires of them anyway.
+
+    STRICT ON EVERY PLATFORM, DELIBERATELY. Windows and macOS filesystems are
+    case-INsensitive by default, so a platform probe would make a report
+    change its answer with the machine it ran on; "a path compares
+    case-sensitively" is the honest rule, and the one #149 argues for.
+    """
+    text = _remote_body(url)
+    if not text or text.startswith("/"):
+        return False
+    first = text.split("/", 1)[0]
+    if first in (".", ".."):
+        return False
+    return REMOTE_DRIVE_RE.match(first) is None
+
+
+def remote_key(url: str) -> str:
+    """ONE remote spelling folded to the identity underneath it.
+
+    A HUMAN'S OWN CLONE IS NOT REQUIRED TO SPELL A REMOTE THE WAY A MANIFEST
+    OR `.gitmodules` DOES. `git@github.com:Org/Repo.git`,
+    `https://github.com/Org/Repo` and `ssh://git@github.com/Org/Repo.git` are
+    one repository, and a report that called them three would tell somebody
+    their working clone is a stranger's over a punctuation difference. So the
+    scheme, the credential prefix, the scp colon, a trailing `/` and a `.git`
+    suffix all come off, and what is left — `host/owner/repo` — is the thing
+    worth comparing. A bare `owner/repo`, which is how `family.yaml`'s
+    `repository:` is written, folds to itself and is matched by its tail in
+    `same_repository` below.
+
+    THE CASE IS FOLDED ONLY FOR A REMOTE THAT NAMES A HOST, which
+    `_remote_names_a_host` decides and #149 argues; a path keeps the case it
+    was written in. It is asked of the remote AS IT WAS WRITTEN, because the
+    scp colon this function is about to turn into a `/` is the one thing that
+    tells a Windows drive from a host.
+
+    A PORT COMES OFF TOO, AND `ssh.github.com` IS `github.com` (#190).
+    `ssh://git@github.com:22/Org/Repo.git` and GitHub's documented
+    `ssh://git@ssh.github.com:443/Org/Repo.git` are
+    `git@github.com:Org/Repo.git` reached through another door; with the
+    port's colon taken for the scp one they keyed as `github.com/22/org/repo`,
+    which no other spelling of that repository does, and a caller comparing
+    keys -- `adopt-project.py`'s relative-url check -- called them two.
+    """
+    text = _remote_body(url)
+    fold_case = _remote_names_a_host(url)
+    first, slash, rest = text.partition("/")
+    if REMOTE_SCHEME_RE.match(url.strip()):   # only a url's host has a port
+        first = REMOTE_PORT_RE.sub("", first)
+    # The scp spelling's one separator, `host:path`, becomes a `/`.
+    host, slash, rest = (first.replace(":", "/", 1) + slash
+                         + rest).partition("/")
+    text = REMOTE_HOST_ALIASES.get(host.lower(), host) + slash + rest
+    if text.lower().endswith(".git"):
+        text = text[:-4]
+    return (text.lower() if fold_case else text).strip("/")
+
+
+def remote_is_a_path(base: str) -> bool:
+    """Is this remote a FILESYSTEM PATH rather than a url?
+
+    THE SEPARATOR QUESTION, which is a different one from the case question
+    above: only a path may be WALKED with a backslash in it, because a url's
+    separator is `/` on every platform, and `file:///srv/mirrors/Repo.git` is
+    a url by that measure however absolute the path inside it is.
+
+    THE COLON IS A DRIVE LETTER'S OR IT IS SCP SYNTAX.
+    `D:\\a\\remotes\\Fam.git` is a path; `git@host:org/Repo.git` and
+    `host:path/Repo.git` are urls in git's scp spelling; anything with a
+    `<scheme>://` is a url outright.
+    """
+    if REMOTE_SCHEME_RE.match(base):
+        return False
+    head = base.replace("\\", "/").split("/", 1)[0]
+    return ":" not in head or REMOTE_DRIVE_RE.match(head) is not None
+
+
+#: A `file://` url, which is a path on this machine written as a url (#521).
+FILE_URL_RE = re.compile(r"^file://", re.IGNORECASE)
+#: git's scp spelling with a bracketed host, `[::1]:org/repo.git`: the
+#: host's own colons are inside the brackets, and its path starts after `]:`.
+SCP_BRACKETED_HOST_RE = re.compile(r"^(?:[^@/]*@)?\[[^\]/]*\]:")
+
+
+def origin_is_a_path(url: str) -> bool:
+    """Whether a repository's `origin` is a FILESYSTEM PATH, which names no
+    repository (`url_repository`): `remote_is_a_path`'s answer -- absolute
+    or relative, with `/` or `\\`, a drive or a share -- or a `file://` url,
+    which `remote_is_a_path` calls a url for its separator alone."""
+    return remote_is_a_path(url) or FILE_URL_RE.match(url) is not None
+
+
+def url_repository(url: str) -> str | None:
+    """`<org>/<repo>`: the last two segments of the path a url names, case
+    kept, however the url ends; None for a url whose path has fewer, and for
+    a filesystem PATH, however it is written (#521).
+
+    THE ONE READING OF AN `origin`, for both tools that need one:
+    `adopt-project.py plan` takes `--org` from it and compares `--org` and
+    `--project` with it (#499), and `shape-doctor.py`'s adoption line asks
+    for `--org` exactly where `plan` reads none (`origin_org`, #545). Each
+    kept a regex of its own until #521, and the doctor's was a copy of
+    `plan`'s that a test held to it; one function is the same answer by
+    construction.
+
+    FOR EVERY SPELLING GIT TAKES. A url names its repository with or
+    without `.git` and with or without a trailing `/`:
+    `https://github.com/acme/Atlas/` and `.../Atlas.git/` named nothing to
+    the regex this replaced, whose `$` came after `[^/]+?`, so nothing was
+    compared and a mistyped `--project` planned with exit 0. The path of a
+    url is what follows its host: `<scheme>://<host>[:<port>]/`, git's scp
+    colon (`[user@]host:`), or `]:` after a bracketed host (`[::1]:`), whose
+    own colons are not that one.
+
+    A PATH NAMES NO REPOSITORY (`origin_is_a_path`). It is a directory on
+    this machine, and says nothing of the repository on GitHub that
+    `adopt-project.py execute` acts on without `--local-remote-dir`
+    (`https://github.com/<org>/<project>.git`). Read as its last two
+    directories, as the regex read it, a clone of `/srv/clones/Atlas.git`
+    was the repository `clones/Atlas`, and the right `--org` was refused
+    `adopt-not-the-source` and sent to `--org clones`, a directory's name;
+    written with backslashes, as Windows writes it, the same path named
+    nothing and was not compared. So no path is compared, in either
+    separator, and `plan` says so in a NOTE; nor does one give `plan` an
+    organisation, so it asks for `--org` (`adopt-no-org`), and so does the
+    doctor's adoption line.
+    """
+    if origin_is_a_path(url):
+        return None
+    scheme = REMOTE_SCHEME_RE.match(url)
+    bracketed = SCP_BRACKETED_HOST_RE.match(url)
+    if scheme:
+        path = url[scheme.end():].partition("/")[2]
+    elif bracketed:
+        path = url[bracketed.end():]
+    else:
+        path = url.partition(":")[2]
+    path = path.rstrip("/")
+    if path.endswith(".git"):
+        path = path[:-4]
+    above, _, name = path.rpartition("/")
+    org = above.rpartition("/")[2]
+    return f"{org}/{name}" if org and name else None
+
+
+def remote_local_path(url: str) -> str | None:
+    """The path on A MACHINE this remote names, or None when it names none.
+
+    THE STRING HALF OF A QUESTION THIS MODULE MAY NOT FINISH (2026-09-13,
+    #157). `same_repository` answers for two filesystem paths by exact
+    equality, so one directory reached through a SYMLINK — `/var/folders/…`
+    and `/private/var/folders/…` are the same temporary directory on macOS,
+    which is how this suite's own fixtures reach one — is two repositories to
+    it. Only the machine holding that symlink can say otherwise, and nothing
+    here is allowed to ask a disk anything. So this says which spelling names
+    a path and what path it names, and the two callers that HAVE a disk —
+    `templates/family-root/scripts/siblings.py::verify_sibling` and
+    `shape-doctor.py::working_clone` — resolve it with `os.path.realpath`
+    before they compare. The string rule stays in one place either way (#155).
+
+    A PATH IS THE SAME FOUR-WAY QUESTION `_remote_names_a_host` DECIDES, asked
+    once rather than twice, and what comes back is `_remote_body`'s spelling
+    of it — the scheme gone, `\\` folded to `/`, the empty authority in front
+    of a Windows drive dropped — which is the spelling every other question
+    here is asked of. `file:///srv/mirrors/Repo.git` and
+    `/srv/mirrors/Repo.git` name one directory, `file:///D:/mirrors/Fam.git`
+    and `D:\\mirrors\\Fam.git` name another, and Windows opens a path spelled
+    with either separator.
+
+    NONE FOR A RELATIVE REMOTE, DELIBERATELY, though `./mirrors/Fam.git` is as
+    much a path as an absolute one. `..` is resolved against the
+    SUPERPROJECT'S REMOTE by git's own rule and by `join_remote` above — a
+    caller that handed it to `realpath` would resolve it against whatever
+    directory the process happens to be standing in, which is the trap
+    `siblings.py::resolve_relative` exists to avoid.
+    """
+    if _remote_names_a_host(url):
+        return None
+    text = _remote_body(url)
+    if text.startswith("/") or REMOTE_DRIVE_RE.match(text.split("/", 1)[0]):
+        return text
+    return None
+
+
+def _up_one(flat: str) -> str | None:
+    """`flat` with its last component dropped, or None when it has none.
+
+    A `..` TOO MANY CONSUMES NOTHING. What is left after the last component
+    can be a scheme (`https:/`), an scp host (`git@host:`) or nothing at all,
+    and none of those is a directory a `..` may eat — a url like that is
+    wrong wherever it is read, and the clone that fails prints it. The one
+    case where nothing left IS an answer is a POSIX root: the parent of
+    `/Repo.git` is `/`, so the empty string comes back and the next name
+    appended makes `/Other.git`. A Windows DRIVE is a component of its own
+    for the same reason, and is the one colon that is not scp syntax — so it
+    is asked FIRST, because `D:` is also what a one-letter scheme looks like.
+    """
+    if "/" not in flat:
+        return None
+    head = flat.rsplit("/", 1)[0]
+    if REMOTE_DRIVE_RE.match(head):
+        return head
+    if REMOTE_SCHEME_ONLY_RE.match(head) or head.endswith(":"):
+        return None
+    return head
+
+
+def join_remote(base: str, url: str) -> str:
+    """`base` with `url`'s `../` applied — PURE STRING ARITHMETIC.
+
+    GIT'S OWN RULE FOR A RELATIVE SUBMODULE URL, which is textual and has no
+    filesystem and no platform in it: one trailing component dropped per
+    `..`, one appended per name, `.` ignored. A clone that took `../Repo.git`
+    literally would fetch from wherever the process happens to be standing,
+    which is why git resolves it against the SUPERPROJECT'S REMOTE instead.
+
+    THE SEPARATOR IS THE BASE'S OWN. A local path on Windows arrives from
+    `git remote get-url` as `D:\\a\\_temp\\remotes\\Fam.git` with no forward
+    slash anywhere in it, so a walk that split on `/` alone would drop
+    nothing and append to the whole string (the `windows-latest` failure on
+    PR #79). The walk therefore normalises to `/` and hands the result back
+    in the spelling the remote used: git accepts either, a human comparing
+    this against `git remote -v` should not have to translate it, and
+    `same_repository` folds both spellings to one answer anyway.
+    """
+    native_backslash = remote_is_a_path(base) and "\\" in base
+    flat = (base.replace("\\", "/") if native_backslash else base).rstrip("/")
+    for part in url.split("/"):
+        if part == "..":
+            up = _up_one(flat)
+            if up is not None:
+                flat = up
+        elif part not in (".", ""):
+            flat = f"{flat}/{part}"
+    return flat.replace("/", "\\") if native_backslash else flat
+
+
+def resolved_remote(url: str, base: str) -> str:
+    """A submodule url spelled `../<Repo>.git`, against THIS remote.
+
+    Absolute urls are handed straight back, and so is a relative one when
+    there is no remote to resolve it against — a holder with no `origin`
+    names nothing this can complete, and inventing a base would be worse than
+    saying so. `siblings.py::resolve_relative` is the wrapper that reads the
+    holder's own `origin` and hands it here as `base`; the doctor reads the
+    root's and does the same.
+    """
+    if not url.startswith(("./", "../")):
+        return url
+    return join_remote(base, url) if base else url
+
+
+#: A url's CREDENTIAL — `[user[:password]@]` in front of the host, and only
+#: in a url that has a scheme, which is the spelling a token is ever written
+#: in (`https://x-access-token:<pat>@github.com/Org/Repo.git`). The scp form
+#: `git@host:Org/Repo.git` carries a user name and no secret — ssh takes no
+#: password in a url — and is left legible.
+CREDENTIAL_RE = re.compile(r"^([A-Za-z][A-Za-z0-9+.-]*://)[^/@]*@")
+
+
+def redacted(url: str) -> str:
+    """A remote url with any credential in it replaced by `***`.
+
+    A REPORT PRINTS WHAT IT FINDS, AND WHAT IT FINDS CAN BE A TOKEN. Git
+    permits a credential in a remote url, people do put one there, and
+    `shape-doctor.py --json` is pasted into issues and kept as a CI artifact
+    — so a row that quoted `origin` verbatim would publish somebody's PAT to
+    everywhere the report goes (Codex and Copilot, PR #147). The raw value is
+    still what `same_repository` compares; this is what gets stored and
+    printed, and the host and the path — the whole of what a person needs in
+    order to see which repository it is — survive.
+    """
+    return CREDENTIAL_RE.sub(r"\1***@", url)
+
+
+def same_repository(one: str, two: str) -> bool:
+    """Do two remote spellings name the SAME repository?
+
+    The normalised identities, and failing that — when either side names a
+    FORGE — the TRAILING `owner/repo` of the second: a manifest records
+    `Org/Repo` with no host in it at all, and a mirror or an enterprise host
+    spells the same repository under a different one. Only the second
+    argument's tail is tried, because that is the reference being matched
+    against — the row, or the mount — and the first is whatever a clone on
+    somebody's disk happens to say.
+
+    THE TAIL IS A FORGE QUESTION, AND ONLY A FORGE QUESTION (2026-09-13,
+    #157). When BOTH sides are filesystem PATHS there is no tail match at all
+    and the normalised keys must be EQUAL, so `/srv/a/IRRS.git` and
+    `/other/a/IRRS.git` are two repositories — and so, still, are
+    `/srv/mirrors/IRRS.git` and `/srv/mirrors/irrs.git`, which is #149's case
+    rule arrived at the same way. THE DIFFERENCE IS NOT ARBITRARY: in a forge
+    name the two trailing components ARE the whole identity — `Org/Repo` is an
+    owner and a repository and there is nothing in front of it to lose —
+    while in a path everything in front of the tail is part of the identity,
+    and a fallback that drops it calls two bare repositories under two roots
+    one repository (Copilot, PR #156).
+
+    A PATH AGAINST A FORGE NAME KEEPS THE MATCH, DELIBERATELY, because that is
+    what the two callers below actually need: a member mounted from a MIRROR
+    has an `origin` that is a path — `/srv/mirrors/InkRouter/IRRS.git` — and
+    the reference it is matched against is either the bare `InkRouter/IRRS` a
+    `family.yaml` row is written as or the
+    `https://github.com/InkRouter/IRRS.git` that `siblings.py::clone_url`
+    derives from it. Dropping that match would call every clone in a
+    mirror-based estate `WRONG ORIGIN`, the InkRouter estate's own layout
+    included. It folds case for the same reason it exists: the row was typed
+    by a human and is case-insensitive at the forge, so comparing it strictly
+    would report a legitimate mirror clone as a stranger over a
+    capitalisation, which is the fault #149 is against and not for (Copilot
+    and Codex, PR #156).
+
+    WHICH LEAVES ONE DIRECTORY SPELLED TWO WAYS TO THE CALLERS, on purpose:
+    `/var/folders/…` and `/private/var/folders/…` are one temporary directory
+    on macOS, only the machine holding that symlink can say so, and nothing in
+    this module may ask a disk anything. `remote_local_path` above is the
+    string half, and `siblings.py::same_repository_here` and
+    `shape-doctor.py::same_repository_here` are the `os.path.realpath` half —
+    each of them THIS function first, and the disk only when it has said no.
+
+    THE DEFINITION `make siblings` REFUSES BY AND THE DOCTOR REPORTS BY, one
+    function imported by both: `templates/family-root/scripts/siblings.py`
+    and `shape-doctor.py` each import this name, and
+    `tests/test_shape_doctor.py` asserts they are the same object before it
+    runs the table.
+    """
+    left, right = remote_key(one), remote_key(two)
+    if left == right:
+        return True
+    if not (_remote_names_a_host(one) or _remote_names_a_host(two)):
+        # TWO PATHS, AND THE KEYS ARE THE WHOLE ANSWER (#157).
+        return False
+    tail = right.split("/")
+    if len(tail) < 2:
+        return False
+    suffix = "/".join(tail[-2:])
+    return left.lower().endswith(suffix.lower())
+
+
+# ---------------------------------------------------------------------------
+# Reading a CHAIN LINK's own declaration, offline
+# ---------------------------------------------------------------------------
+#
+# A recorded chain (2026-09-05) says `codexDox` pins `openXdox` and `openXdox`
+# pins `openDox`. The first half is a fact in codexDox's tree; the second is a
+# fact in openXdox's, and these three helpers read it WHERE THAT TREE HAPPENS
+# TO BE ON THE DISK and nowhere else. Nothing here fetches, clones or asks a
+# host: a link that cannot be read locally is reported as declared-unverified
+# by the caller, which is not a failure.
+#
+# The lookup order is the one `validate-pins.py` already uses for a neutral
+# product's checkout, down to the same environment variable, because it is the
+# same checkout answering a second question about the same product.
+
+#: Why a source did not answer when there is nothing at its path, and when it
+#: is a directory holding no manifest: the two ORDINARY absences, which a
+#: checkout looked for beside the project is allowed to have without anybody
+#: being told. Every other reason is the system's own (#338).
+LINK_SOURCE_ABSENT = "no such file or directory"
+LINK_SOURCE_NO_MANIFEST = "it holds no project.yaml"
+
+
+def _os_reason(exc: BaseException) -> str:
+    """The system's own reason for an `OSError` (`Permission denied`, `File
+    name too long`), or the exception's text where it carries none (a
+    `ValueError` for a name the system cannot be handed at all)."""
+    return getattr(exc, "strerror", None) or str(exc)
+
+
+def shown_path(path) -> str:
+    """A path as a line about it names it: as it is, unless a character in
+    it is not printable (`str.isprintable`), and then as Python's `repr`
+    spells it -- `\\x1b`, `\\n`, `\\r`, and `\\udcff` for a byte that is not
+    UTF-8, as `sys.argv` keeps one (#610).
+
+    THE SPELLING `pin-source-unreadable` GIVES A `--pin-source` (#339):
+    `shape_materialize.shown_source` is this function. Printed raw, an ESC
+    in a path reached the terminal, and a line break or a carriage return
+    began a line of the path's choosing. A printable path is named byte for
+    byte as it always was.
+    """
+    text = str(path)
+    return text if text.isprintable() else repr(text)
+
+
+def link_manifest_lookup(path) -> tuple[Path | None, str | None]:
+    """`(manifest, None)` where `path` can answer as a link's tree, else
+    `(None, why)`. `<dir>` -> `<dir>/project.yaml`; a file is taken as the
+    manifest. IT NEVER RAISES (#338). It replaced `link_manifest_path`, which
+    is gone: that said only `None`, and both of its callers needed the reason.
+
+    `stat()` INSIDE THE GUARD, not `is_dir()` and `is_file()`: before 3.14
+    those two swallow only ENOENT, ENOTDIR, EBADF and ELOOP and raise every
+    other `OSError`, so a source under a parent this user cannot enter, a
+    checkout beside the project at mode 000, or a name longer than the
+    filesystem takes ended the naming gate in a traceback on 3.9 to 3.13 and,
+    on 3.14, went unread with nobody told why. `validate-pins.py`'s
+    `_digest_from_source` asks the same way for the same reason (#295).
+    `stat()` follows a symlink, as `is_dir()` did, so a checkout linked into
+    place still answers.
+    """
+    candidate = Path(path)
+    try:
+        mode = candidate.stat().st_mode
+    except (FileNotFoundError, NotADirectoryError):
+        return None, LINK_SOURCE_ABSENT
+    except (OSError, ValueError) as exc:
+        return None, _os_reason(exc)
+    if stat.S_ISDIR(mode):
+        candidate = candidate / "project.yaml"
+        try:
+            mode = candidate.stat().st_mode
+        except (FileNotFoundError, NotADirectoryError):
+            return None, LINK_SOURCE_NO_MANIFEST
+        except (OSError, ValueError) as exc:
+            return None, f"its project.yaml: {_os_reason(exc)}"
+        if not stat.S_ISREG(mode):
+            return None, "its project.yaml is not a file"
+    elif not stat.S_ISREG(mode):
+        return None, "it is neither a directory nor a file"
+    return candidate, None
+
+
+def link_declarations(manifest_path, key: str = CHAIN_LINK_DECLARED_BY
+                      ) -> tuple[set[str] | None, str | None]:
+    """The neutral products a link's manifest DECLARES a pin on, with why the
+    tree could not answer beside it: `(pins, None)`, or `(None, why)`.
+
+    `None` means "this tree could not answer" and is deliberately distinct
+    from the empty set, which means "this tree answered, and declares no pin
+    at all". The first is unverified and the second breaks a chain that runs
+    through it. A tree cannot answer when there is no manifest, when it
+    cannot be read, when it is not a mapping, or when its `key` is not a list
+    of names: a scalar, a number or a mapping there is not a declaration, and
+    iterating it as one read `openDox` as the characters `D`, `e`, `n`, `o`,
+    `p`, `x` and ended the run in a `TypeError` for `5` (#338). An absent or
+    empty `key`, and a blank entry in the list, declare nothing, as ever.
+
+    THE MANIFEST'S PATH IN `why` IS `shown_path`'S (#610). It is the
+    scaffold's `--pin-source`, or a `--link-source`, with `/project.yaml`
+    after it, and the scaffold prints `why` in its `declared-unverified`
+    WARNING: a `--pin-source` holding an ESC put a raw `\\x1b[31m` on
+    stderr. A printable path is the bytes it always was.
+    """
+    path, why = link_manifest_lookup(manifest_path)
+    if path is None:
+        return None, why
+    named = shown_path(path)
+    try:
+        data = load_yaml(path)
+    except Refusal as exc:
+        cause = exc.__cause__
+        if isinstance(cause, OSError):
+            return None, f"{named}: {_os_reason(cause)}"
+        return None, exc.detail.replace(str(path), named)
+    except (YamlError, OSError, UnicodeDecodeError) as exc:
+        return None, f"{named}: {exc}"
+    if not isinstance(data, dict):
+        return None, f"{named}: not a mapping"
+    declared = data.get(key)
+    if declared is None:
+        return set(), None
+    if not isinstance(declared, list):
+        return None, f"{named}: {key} is not a list"
+    pins: set[str] = set()
+    for pin in declared:
+        if pin is None or pin == "":
+            continue
+        if not isinstance(pin, str):
+            return None, f"{named}: {key} holds an entry that is not text"
+        pins.add(repo_basename(pin))
+    return pins, None
+
+
+def resolve_link_source(product: str, root: Path | None = None,
+                        keyed_sources: dict | None = None,
+                        default_source=None,
+                        env_shared: bool = False, *,
+                        tried: list | None = None
+                        ) -> tuple[Path | None, str | None]:
+    """Where `product`'s own manifest can be read, if anywhere at all.
+
+      1. `--link-source <product>=<path>`, `keyed_sources` keyed by
+         `pin_product_key` (#444): case-insensitive on the name, as its pin
+         file is, so `openss=` answers for `openss` and never for `openß`
+      2. `SHAPE_PIN_SOURCE_<PRODUCT>` in the environment
+      3. a checkout sitting BESIDE this project (`../openXdox`)
+      4. a bare `--link-source <path>` with no `product=` prefix, which is
+         asked only when `default_source` is passed: `link_pins_from_trees`
+         passes it for a chain's FIRST link and for no other (#441)
+
+    The first that holds a manifest answers, and one that does not is passed
+    over whatever the reason: one that cannot be entered no longer raises
+    (#338).
+
+    WHAT WAS ASKED (#338). `tried`, when given, receives one `(rule, how,
+    path, why)` per source asked, in order: `rule` is `keyed`, `env`,
+    `sibling` or `bare`, the four above; `why` is None for the one that
+    answered, else `link_manifest_lookup`'s reason. Nothing here prints, so
+    each caller says what it needs to: the naming validator names a
+    `--link-source` that could not be read, and one no link used.
+
+    `env_shared` says another product asked about alongside this one names
+    the same variable, so rule 2 is skipped: a variable that does not say
+    which product it holds is not read for either (#275).
+    """
+    candidates: list[tuple[str, Path, str]] = []
+    keyed = (keyed_sources or {}).get(pin_product_key(product))
+    if keyed is not None:
+        candidates.append(("keyed", Path(keyed),
+                           f"--link-source {product}=..."))
+    env_name = pin_source_env_name(product)
+    env_value = None if env_shared else os.environ.get(env_name)
+    if env_value:
+        candidates.append(("env", Path(env_value), f"${env_name}"))
+    if root is not None:
+        sibling = Path(root).resolve().parent / product
+        candidates.append(("sibling", sibling,
+                           f"sibling checkout ({sibling})"))
+    if default_source is not None:
+        candidates.append(("bare", Path(default_source), "--link-source"))
+    for rule, path, how in candidates:
+        manifest, why = link_manifest_lookup(path)
+        if tried is not None:
+            tried.append((rule, how, path, why))
+        if manifest is not None:
+            return path, how
+    return None, None
+
+
+class LinkPins(dict):
+    """`link_pins_from_trees`'s answer for a caller that asks it to say why:
+    the same `{link: the pins ITS manifest declares}`, equal to a plain one,
+    with `unreadable` beside it, `{pin_product_key(link): why}` for each link
+    whose source REACHED a manifest that could not be read as a declaration
+    (#338, #444).
+
+    A link in `unreadable` is absent from the mapping, as one that is not on
+    the disk is. What differs is the warning `_chain_link_findings` writes for
+    it, which names the reason instead of saying the tree is "not reachable
+    here". Only a caller that asks for one gets one, so every other
+    reader's warning is exactly the text it always was.
+
+    `remedies`, `{pin_product_key(link): what would let its tree be read}`,
+    is the sources a caller that reads OTHER sources than the naming
+    validator's has to offer for a tree that is not reachable (#610, #444).
+    That warning offers "a sibling checkout, SHAPE_PIN_SOURCE_<LINK>, or
+    --link-source <link>=<path>", and the scaffold reads no sibling checkout
+    and has no `--link-source`, so it names its own here. A link with no
+    entry, and every link for a caller that gives none, gets the naming
+    validator's words, as ever.
+    """
+
+    def __init__(self, found=(), unreadable: dict | None = None,
+                 remedies: dict | None = None) -> None:
+        super().__init__(found)
+        self.unreadable: dict[str, str] = dict(unreadable or {})
+        self.remedies: dict[str, str] = dict(remedies or {})
+
+
+def link_pins_from_trees(links, root: Path | None = None,
+                         keyed_sources: dict | None = None,
+                         default_source=None,
+                         key: str = CHAIN_LINK_DECLARED_BY, *,
+                         tried: dict | None = None,
+                         with_reasons: bool = False,
+                         remedies: dict | None = None) -> dict[str, set]:
+    """`{link: the pins ITS manifest declares}` for the links that answered.
+
+    A link whose tree is not on the disk is simply ABSENT from the mapping,
+    which is what `NamingPolicy.resolve_referent` reads as declared-unverified.
+    So is one whose tree cannot be entered or whose manifest cannot be read:
+    nothing a source does raises out of here (#338).
+
+    `tried`, when given, maps each link, by the name `repo_basename` gives
+    it, to what `resolve_link_source` asked for it. The source that answered
+    carries the reason its manifest could not be read, when it could not,
+    because that is where the link stopped (#338).
+
+    `with_reasons` returns a `LinkPins`, which remembers that reason for each
+    link a source reached and could not read, so that the caller that has no
+    line of its own for it (the scaffold) can have the warning say so. It is
+    off for the callers that print the reason themselves, and for the rest.
+
+    `remedies` returns a `LinkPins` too, carrying them: what would let each
+    link's tree be read, in the caller's own sources, for the warning about
+    a tree that is not reachable (#610). Given without `with_reasons`, the
+    `LinkPins` remembers no reason, as the plain mapping does not.
+
+    A link whose `SHAPE_PIN_SOURCE_<PRODUCT>` another of `links` names too is
+    not read through it (#275): one tree would answer for two links, and a
+    chain verified against the wrong tree is worse than one left
+    declared-unverified. Only a hand-written chain can hold two such links:
+    `scaffold-project.py` takes every link but the first from the naming
+    policy's `open<Product>` form, which has no `-`, `.` or `_` to fold.
+
+    `default_source` IS THE FIRST LINK'S TREE AND NO OTHER'S (#441). It is
+    one tree — the naming validator's bare `--link-source`, the scaffold's
+    `--pin-source` — and the first link is the pin this project holds, the
+    one tree a person who typed one path has to hand. It used to be offered
+    to every link, so in a chain of three or more links a later link with
+    no other source was read from the same tree: `openXdox`'s manifest,
+    declaring `openYdox`, read again as `openYdox`'s, which "declares
+    openYdox, not openInk", and a chain that holds was broken. A later link
+    is read through rules 1 to 3 of `resolve_link_source`, or is
+    declared-unverified.
+
+    THE TABLE IS KEYED BY `pin_product_key` (#444), the key the variable
+    guard above already asks by. It was `casefold()`, so `openß` and
+    `openss`, each with its own tree, shared one entry and the later tree
+    answered for both.
+    """
+    found: dict[str, set] = {}
+    unreadable: dict[str, str] = {}
+    links = list(links)
+    shared = pin_source_env_shared(repo_basename(str(link)) for link in links)
+    for index, link in enumerate(links):
+        name = repo_basename(str(link))
+        asked: list = []
+        path, _how = resolve_link_source(name, root, keyed_sources,
+                                         None if index else default_source,
+                                         pin_product_key(name) in shared,
+                                         tried=asked)
+        if tried is not None:
+            tried[name] = asked
+        if path is None:
+            continue
+        pins, why = link_declarations(path, key)
+        if pins is None:
+            rule, how, _path, _answered = asked[-1]
+            asked[-1] = (rule, how, path, why)
+            unreadable[pin_product_key(name)] = why
+            continue
+        found[pin_product_key(name)] = pins
+    if not (with_reasons or remedies):
+        return found
+    return LinkPins(found, unreadable if with_reasons else None, remedies)
+
+
+def find_repo_root(start: Path) -> Path:
+    path = Path(start).resolve()
+    for candidate in [path, *path.parents]:
+        if (candidate / ".git").exists():
+            return candidate
+    raise Refusal("not-a-git-repo", f"no .git found at or above {start}")
+
+
+def die(exc: Refusal, stream=sys.stderr) -> int:
+    print(str(exc), file=stream)
+    return 2
+
+
+# ---------------------------------------------------------------------------
+# Printing a person's text (#391)
+# ---------------------------------------------------------------------------
+#
+# BOTH ROOTS' `bootstrap.py` print what a manifest, a register row or the
+# disk says, before any validator has had its say about it. Each imports
+# these two from here, as it imports the YAML reader: this file is the one
+# library a project and a family holder carry beside it.
+
+#: The characters `spelled` writes as an escape, besides the bidirectional
+#: controls below: the controls (Cc), the surrogates (Cs), and the line and
+#: paragraph separators (Zl, Zp). Nothing else is escaped, `spelled` says why.
+ESCAPED_CATEGORIES = frozenset(("Cc", "Cs", "Zl", "Zp"))
+#: The bidirectional controls: U+061C, U+200E and U+200F, the embeddings and
+#: overrides U+202A to U+202E, and the isolates U+2066 to U+2069.
+ESCAPED_BIDI_CONTROLS = frozenset(
+    "\u061c\u200e\u200f\u202a\u202b\u202c\u202d\u202e\u2066\u2067\u2068\u2069")
+
+
+def escape_unencodable_stdout() -> None:
+    """A character stdout cannot encode is printed escaped, never raised on (#391).
+
+    WHAT WAS WRONG. Each root's `bootstrap.py` `main` printed the manifest's
+    `name` with a plain `print` before any step ran, so `name: "a\\ud83db"` (a
+    lone surrogate, which no UTF-8 stdout can write) or `name: "日本"` on a
+    stdout that is not UTF-8 (`PYTHONIOENCODING=ascii`, or the ANSI code page
+    Windows gives a stdout that is not the console) ended `make bootstrap` in a
+    `UnicodeEncodeError` traceback one step before `validate-manifest.py`, the
+    validator that names the problem, was reached. Their own wording raised on
+    such a stdout too, wherever it carries a dash or a middle dot.
+
+    A `strict` or `surrogateescape` stdout, the two handlers that raise, is
+    reconfigured ONCE, at the start of each root's `main`, to
+    `backslashreplace`, the handler stderr already has: what the stdout holds
+    is written as it was, and what it cannot hold as `\\u65e5`. Any other
+    handler, one somebody chose, is left alone, and the ENCODING is never
+    changed. `scripts/validate-pins.py` does the same for its report (#295).
+    The tools run from a checkout of the standard use
+    `shape_materialize.escape_what_stdout_cannot_encode` (#214), which no
+    project carries. This module is what every project and every family holder
+    carries beside its `bootstrap.py`, so both roots import this function and
+    `spelled` from here, where each is written once.
+
+    GUARDED, because failing to set a handler is no reason to refuse the run: a
+    stream a caller replaced may have no `reconfigure`, a closed one raises
+    `ValueError`, and `pythonw` has no stdout at all.
+    """
+    if getattr(sys.stdout, "errors", None) in ("strict", "surrogateescape"):
+        try:
+            sys.stdout.reconfigure(errors="backslashreplace")
+        except (AttributeError, ValueError, OSError):
+            pass
+
+
+def spelled(value: object) -> str:
+    """`value` as ONE line of text, with what a terminal must not be handed
+    written as escapes (#391).
+
+    What `escape_unencodable_stdout` cannot do. A raw ESC or CR is encodable on
+    every stdout, so it reaches the terminal as the control it is, and a
+    manifest's `name` or a register row is a person's text. EXACTLY these
+    characters are written as the escape Python spells it (`\\x1b`, `\\r`,
+    `\\u2028`, `\\ud83d`, `\\u202e`), and no others:
+
+    - the controls (Unicode category Cc: C0, DEL and C1), which move a cursor,
+      clear a screen or end a line;
+    - the surrogates (Cs), which no UTF-8 text holds, so a lone one is named
+      whatever handler the stdout has;
+    - the line and paragraph separators (Zl and Zp, U+2028 and U+2029), which
+      end a line in some viewers, so the value would not stay on its line;
+    - the bidirectional controls (U+061C, U+200E, U+200F, U+202A to U+202E and
+      U+2066 to U+2069), which reorder the text around them so that a name
+      reads as another name.
+
+    EVERY OTHER CHARACTER PRINTS AS IT IS, as it did before this function
+    existed: the zero-width non-joiner a Persian or Indic name needs, the
+    zero-width joiner that makes an emoji sequence, the ideographic space of a
+    Japanese full name, the no-break space, the soft hyphen, and any other
+    format, space or unassigned character. `str.isprintable` is not the test:
+    it refuses all of those, which `validate-manifest.py` accepts and a UTF-8
+    terminal shows correctly, and what it counts as unassigned moves with the
+    interpreter's Unicode database. A backslash prints as it is too, so a name
+    holding the four characters `\\x1b` prints as one holding ESC does.
+
+    Each root's `bootstrap.py` applies it to every value it prints that it
+    read from the manifest, a register row or the disk, and to none of its
+    own wording.
+    """
+    return "".join(
+        char.encode("unicode_escape").decode("ascii")
+        if (char in ESCAPED_BIDI_CONTROLS
+            or unicodedata.category(char) in ESCAPED_CATEGORIES)
+        else char
+        for char in str(value))
+
+
+# ---------------------------------------------------------------------------
+# How a command a person pastes spells a path (#486)
+# ---------------------------------------------------------------------------
+#
+# `scripts/family.py` and a family holder's `scripts/siblings.py` print
+# commands for a person to paste, and printed every path in them bare. A
+# family folder whose path holds a space is ordinary ("My Projects" on macOS,
+# a Windows profile directory), and under a holder at `.../my work/Sonata/
+# Sonata` the `rm -rf` of a cached object store split into `rm -rf .../my`,
+# an absolute directory that is NOT the store, and a second argument relative
+# to wherever the person stood. `siblings.py` is a copy every holder carries,
+# and this file is the one library a holder carries beside it, so the quoting
+# both use is written here, once.
+
+#: A word `sh` reads as itself, needing no quotes: letters, digits and the
+#: punctuation a path, a flag, a commit or a branch name is spelled with. `~`
+#: is absent, because a leading one is expanded, and so is every character
+#: `sh` reads as syntax. `shape-doctor.py`'s `UNQUOTED_POSIX`, the same set.
+SHELL_BARE_POSIX = re.compile(r"[A-Za-z0-9_./:@%+=,-]+")
+#: PowerShell's, and NOT the same set: it gains the backslash a Windows path
+#: is spelled with and loses `,`, PowerShell's list separator, and `@`, which
+#: leading is splatting. `shape-doctor.py`'s `UNQUOTED_NT`, the same set.
+SHELL_BARE_NT = re.compile(r"[A-Za-z0-9_./:%+=\\-]+")
+#: What PowerShell takes for a single quote: the apostrophe and the four
+#: typographic single quotes, which a folder name on macOS or Windows can
+#: hold. Inside a verbatim string each is written by doubling it.
+POWERSHELL_SINGLE_QUOTES = frozenset("'‘’‚‛")
+
+
+def shell_quoted(value: object, platform: str | None = None) -> str:
+    """`value` as ONE word of a command a person pastes into the shell of
+    `platform` (`os.name` when None): bare where that shell reads every
+    character of it as itself, else whole, in single quotes (#486).
+
+    THE DOCTOR'S RULE, `shape-doctor.py`'s `quote_arg`, which has quoted
+    every path its NEXT lines print since #101/#102: `sh` and PowerShell are
+    two dialects, and each reads the other's escape as a different value
+    with no error to say so. `sh` closes the quotation, escapes the
+    apostrophe and reopens it (`'O'\\''Brien'`), and `shlex.split` hands
+    that back as the value that went in; PowerShell doubles it inside a
+    verbatim string (`'O''Brien'`), where `\\` is an ordinary character.
+    What needs no quoting is left alone, so an ordinary path prints as it
+    always did. `platform` lets a test ask for either dialect on any host.
+
+    ONE DIFFERENCE FROM THE DOCTOR, ON PURPOSE. Its report is pure ASCII, so
+    `quote_arg` flattens a value to ASCII before it quotes it, and a path
+    holding `é` is printed as some other path. A command that deletes or
+    moves a directory has to name THAT directory, so nothing here is
+    flattened. The typographic single quotes are the price: PowerShell reads
+    each of them as an apostrophe, so each is doubled too. On a value made
+    of ASCII the two functions give the same answer, which
+    `tests/test_family_printed_quoting.py` holds them to, but one:
+
+    A WORD THAT BEGINS WITH `=` IS QUOTED, in both dialects. zsh, the login
+    shell macOS ships, expands a bare `=word` to the path of the command
+    `word` (its EQUALS option, on by default), so `=ls` reaches the command
+    as `/bin/ls` and `=x` as an error. `=` anywhere else is itself to every
+    shell, and quoting a leading one costs PowerShell nothing. The doctor's
+    `quote_arg` still leaves it bare: a known gap, named where #486 lands.
+    """
+    text = str(value)
+    windows = (os.name if platform is None else platform) == "nt"
+    bare = SHELL_BARE_NT if windows else SHELL_BARE_POSIX
+    if not text.startswith("=") and bare.fullmatch(text):
+        return text
+    if windows:
+        return "'" + "".join(char * 2 if char in POWERSHELL_SINGLE_QUOTES
+                             else char for char in text) + "'"
+    return "'" + text.replace("'", "'\\''") + "'"
+
+
+def shell_line(words, platform: str | None = None) -> str:
+    """`words` as one command line, each spelled by `shell_quoted` (#486)."""
+    return " ".join(shell_quoted(word, platform) for word in words)
diff --git a/scripts/validate-manifest.py b/scripts/validate-manifest.py
new file mode 100755
index 00000000..ab6344f2
--- /dev/null
+++ b/scripts/validate-manifest.py
@@ -0,0 +1,1043 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Validate this project's `project.yaml` — the SOURCE of the group.
+
+`project.yaml` is the self-describing manifest of a project that has elected
+the three-repository shape. It is the SOURCE and an aggregation's
+`project-register.yaml` row is DERIVED from it, never the other way round —
+which is the only construction that works for an organisation that has no
+aggregation and no register at all. A register that disagrees with a manifest
+is register drift, not manifest drift.
+
+IT CONFERS NOTHING. `schema:`, `legs[].role` and the topic are descriptive
+navigation. No field here grants review authority, clearance eligibility, gate
+standing or lifecycle state over any repository it names; authority travels in
+grants, and a one-repository project is reviewed identically to this one.
+
+WHAT IS CHECKED
+  - the envelope: `schema_version`, `kind`, `id`, `name`, `schema`
+  - `elected_by` / `elected_on`, because an election with no elector and no
+    date is not an election
+  - `tracking_branch`, and a leg's own `branch`, both OPTIONAL: that none
+    holds a NUL or a lone surrogate, which no command can be given and which
+    `make bootstrap` would hand to git (#455). Whether the value is a name
+    git will create is not asked here.
+  - `topic` equals `xf-project-<id>` derived from the id
+  - `shape`: a commit-and-digest pin of the openRepoShape revision this
+    project was scaffolded from, `revision_kind: commit`, never a tag
+  - `legs`: EXACTLY the roles {assembly, spec, code}, once each, all in one
+    organisation, at distinct relative paths, with the assembly leg at `.`
+  - every leg's repository name against `contracts/repository-naming.yaml`,
+    and the classified form against the declared role. THREE forms may be an
+    assembly root: the bare project-leg form; since 2026-09-02 a DECLARED
+    domain descendant, because a descendant may carry legs (`MedxGlass` pins
+    `openGlass` and still mounts `MedxGlass-spec` and `MedxGlass-code`); and
+    since 2026-09-05 a NEUTRAL PRODUCT that has elected the shape (`openDox`
+    mounts `openDox-spec` and `openDox-code`). The pin is what admits the
+    second, so the refusal for `referent_declared: true` with no pin file
+    beside it stands unchanged; the policy's `admits_declared_role:` is what
+    admits the third, and the form still wins, so such a leg records
+    `form: neutral-product, role: assembly` with the leg form in
+    `also_matches`. None of the three may be the spec or code leg, and an
+    `<X>-Install` may be no leg at all.
+  - each leg's OPTIONAL `naming:` record — that `form` and `role` are the
+    classification the policy actually returns for that name given what this
+    manifest declares, that `also_matches` lists every other form the name
+    satisfies, and that `referent_declared: true` has the pin file to show for
+    it. A `<Domainx><Product>` name is a domain descendant only when the
+    matching `open<Product>` is REACHED: pinned directly in
+    `neutral_product_pins:` (2026-09-02: a claim needs a referent), or reached
+    through the pin chain this leg records in `naming.referent_chain:`
+    (2026-09-05: `codexDox` pins `openXdox`, `openXdox` pins `openDox`), with
+    `contracts/<the pin this project holds>-pin.yaml` in the tree either way.
+    A link of the chain is VERIFIED against that link's own manifest when its
+    tree is beside this root, and reported as `declared-unverified` — a
+    WARNING, not a finding — when it is not. The whole check is OFFLINE.
+  - `submodules`, OPTIONAL: the record an adoption writes of the leg each
+    source submodule was answered into (#189). Absent is fine, because a
+    project with no source submodule has none, and nor does one adopted
+    before the record existed. Present, it is a list of mappings, one per
+    submodule a leg keeps:
+      `path`           the submodule's path inside its leg, spelled the one
+                       way Git records a path -- relative, `/` between
+                       segments, none empty, `.` or `..` -- and named by one
+                       row only. A backslash or a drive letter is a
+                       character of the name, which Git records on POSIX.
+      `leg`            `spec` or `code`: the assembly root keeps no
+                       submodule but its legs.
+      `resolution`     OPTIONAL text: the reason the adoption plan gave.
+      `source_commit`  OPTIONAL, 40 hex: the source commit it was answered
+                       at.
+    `adopt-project.py execute` writes it, once, from the adoption plan, and
+    `shape-doctor.py` holds each submodule a leg keeps to the row naming its
+    path. A row whose `path` or `leg` is refused here holds nothing there.
+  - `answered_paths`, OPTIONAL: the record an adoption writes of the leg each
+    entry covering a path the path policy asked about, or put in another
+    leg, was answered into (#525, #655), in the same rows, except that a
+    directory's `path` ends with the one `/` the adoption plan wrote it
+    with, and no row's path lies under another's. `shape-doctor.py` takes a
+    row as the answer for that path in that leg: not asked again, and not
+    misplaced. A directory's row answers for every file under it, one added
+    after the adoption too: nothing holds a file to `source_commit`.
+    Neither record is checked against the legs: this runs where they are
+    not checked out, so a directory's row written without its `/`, which
+    names a file, is the doctor's to say (#655).
+
+EXIT CODES: 0 valid · 1 findings · 2 refusal (the file is missing or unreadable)
+"""
+
+from __future__ import annotations
+
+import argparse
+import inspect
+import re
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from repo_shape import (  # noqa: E402
+    CHAIN_RECORD_FIELD, COMMIT_RE, PATH_NOT_CANONICAL, PROJECT_ID_RE,
+    SHA256_RE, TREE_DIGEST_DEFINITION, VISIBILITY_CHOICES, NamingPolicy,
+    Refusal, accepts_role, find_repo_root, link_pins_from_trees, load_yaml,
+    path_spelling_fault, pin_product_key, pin_source_env_name,
+    pin_source_env_shared, repo_basename,
+)
+
+DATE_RE = re.compile(r"^\d{4}-\d{2}-\d{2}$")
+QUALIFIED_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9_.-]*/[A-Za-z0-9][A-Za-z0-9_.-]*$")
+REQUIRED_ROLES = {"assembly", "spec", "code"}
+
+
+def _declared_pins(manifest: dict) -> set[str]:
+    """The neutral products this manifest DECLARES a pin on.
+
+    `neutral_product_pins:` is the declaration and the ONLY declaration. A
+    leg's `naming.referent_declared:` is a RECORD of one, checked against this
+    set — never folded into it. Reading the record as a declaration would let
+    a `naming:` block assert its own descent, which is a claim promoting
+    itself to a referent: exactly the move the 2026-09-02 ruling forbids.
+
+    A VALUE THAT IS NOT A LIST DECLARES NOTHING (#443), as `_recorded_chain`
+    reads a chain that is not one, and `_neutral_product_pins_type_finding`
+    reports it. `_findings` asks this first, so iterating `5`, `true` or
+    `1.5` ended the run in a `TypeError` before that finding could print, and
+    a scalar `openXdox` was read as the pins `X`, `d`, `e`, `n`, `o`, `p`,
+    `x` for every leg's classification.
+    """
+    declared = manifest.get("neutral_product_pins")
+    if not isinstance(declared, list):
+        return set()
+    return {str(pin) for pin in declared if pin}
+
+
+def _recorded_chain(naming: dict) -> tuple:
+    """The pin chain this leg RECORDS, as a tuple of names.
+
+    A single string is read as a one-link chain rather than as characters, and
+    anything else yields `()` — the caller reports the shape separately, so a
+    malformed record never becomes a silently different question.
+    """
+    recorded = naming.get(CHAIN_RECORD_FIELD)
+    if isinstance(recorded, str):
+        recorded = [recorded]
+    if not isinstance(recorded, list):
+        return ()
+    return tuple(str(link) for link in recorded if str(link).strip())
+
+
+def _chain_and_links(naming, root: Path | None) -> tuple[tuple, dict]:
+    """The chain a leg RECORDS, and what its READABLE links declare.
+
+    Read ONCE and handed to both the leg's own classification and the check of
+    its `naming:` record, because a leg classified two ways in one file is the
+    drift this validator exists to find rather than a thing it may do.
+
+    THE LINKS ARE READ WHERE THEY ARE, OR NOT AT ALL. `openXdox` declaring a
+    pin on `openDox` is a fact in openXdox's tree; a checkout beside this root
+    (or `SHAPE_PIN_SOURCE_<PRODUCT>`) is read when there is one, and its
+    absence is a warning, never a failure. Nothing here goes to a host.
+
+    THE WARNING OFFERS WHAT THIS READS (#661): `_link_remedies`,
+    handed over only where `link_pins_from_trees` takes `remedies=`
+    (`_library_takes_remedies`).
+    """
+    chain = _recorded_chain(naming) if isinstance(naming, dict) else ()
+    if not chain:
+        return chain, {}
+    offered = ({"remedies": _link_remedies(chain)}
+               if _library_takes_remedies() else {})
+    return chain, link_pins_from_trees(chain, root, **offered)
+
+
+def _link_remedies(chain) -> dict[str, str]:
+    """What would let each chain link's own tree be read, in THIS
+    validator's sources: `{pin_product_key(link): the words}`, for the
+    `declared-unverified` WARNING about a tree that is not reachable
+    (#661).
+
+    The library's own words are the naming gate's: "a sibling checkout,
+    SHAPE_PIN_SOURCE_<LINK>, or --link-source <link>=<path>". This file
+    takes `--root`, `--policy` and `--quiet` and no `--link-source`, so the
+    offer was a flag it refuses as `unrecognized arguments`. It reads
+    `SHAPE_PIN_SOURCE_<LINK>`, unless another link of the chain shares the
+    variable (#275), and a checkout beside this root (`resolve_link_source`'s
+    rules 2 and 3, as `_chain_and_links` asks), so it offers those. Every
+    holder is offered both, or the checkout alone where another link shares
+    its variable; the chain's end holds no pin and has no entry.
+
+    Keyed by `pin_product_key`, the key `_chain_link_findings` looks a
+    holder's entry up by (#444), and the links are read as that function
+    reads them: by `repo_basename`, a blank entry dropped.
+    """
+    links = [repo_basename(str(link)) for link in chain if str(link).strip()]
+    shared = pin_source_env_shared(links)
+    remedies: dict[str, str] = {}
+    for link in links[:-1]:
+        beside = f"a checkout of {link} beside this root"
+        if pin_product_key(link) in shared:
+            words = f"{beside} would let it be read"
+        else:
+            words = (f"{pin_source_env_name(link)}, or {beside}, would let "
+                     "it be read")
+        remedies[pin_product_key(link)] = words
+    return remedies
+
+
+def _library_takes_remedies() -> bool:
+    """Does this root's `scripts/repo_shape.py` take `remedies=`?
+
+    THE SKEW RULE (#661). This file is copied into every project and
+    may run beside a `repo_shape.py` older than itself (a half-applied
+    update, `update-shape.py apply --accept-local`). Before #610 the library
+    had no `remedies=`, and passing it ended this validator in a `TypeError`
+    before it checked a leg. So it is passed only where the function's own
+    signature names it, and an older library's warning keeps that library's
+    words."""
+    try:
+        return "remedies" in inspect.signature(
+            link_pins_from_trees).parameters
+    except (TypeError, ValueError):
+        return False
+
+
+def _naming_chain_field_finding(leg_role, naming: dict) -> list[str]:
+    """Is `naming[CHAIN_RECORD_FIELD]`, if present, a string or a list?
+
+    Split from `_naming_findings` for #132.
+    """
+    recorded = naming.get(CHAIN_RECORD_FIELD)
+    if recorded is not None and not isinstance(recorded, (str, list)):
+        return [f"FINDING naming-referent-chain: leg {leg_role!r}: "
+                f"{CHAIN_RECORD_FIELD} is {recorded!r}, expected a list of "
+                "neutral-product names"]
+    return []
+
+
+def _naming_classification_findings(leg_role, name: str, naming: dict,
+                                    found) -> list[str]:
+    """Everything the classifier's own result says about this leg: a broken
+    referent chain, its warnings, and whether the recorded `form`/`role`/
+    `also_matches` agree with what `name` actually classifies as.
+
+    Split from `_naming_findings` for #132 so one call replaces the middle
+    third of that function's checks, each of which reads `found` but
+    nothing computed after it.
+    """
+    out: list[str] = []
+    if found.referent.status == "broken":
+        out.append(f"FINDING naming-referent-chain: leg {leg_role!r}: "
+                   f"{found.referent.reason}. The first entry is what this "
+                   "project pins and the last is the referent the name "
+                   "claims.")
+    out.extend(f"WARNING naming-referent-chain: leg {leg_role!r}: {text}"
+               for text in found.referent.warnings)
+    if naming.get("form") != found.family:
+        out.append(f"FINDING naming-form: leg {leg_role!r}: naming.form is "
+                   f"{naming.get('form')!r}, but {name!r} classifies as "
+                   f"{found.family!r}")
+    recorded_role = naming.get("role")
+    if (recorded_role or None) != found.role:
+        out.append(f"FINDING naming-role: leg {leg_role!r}: naming.role is "
+                   f"{recorded_role!r}, but {name!r} classifies as "
+                   f"{found.role!r}")
+    also = naming.get("also_matches")
+    if also is None:
+        also = []
+    if not isinstance(also, list):
+        out.append(f"FINDING naming-also-matches: leg {leg_role!r}: "
+                   f"also_matches is {also!r}, expected a list")
+    elif sorted(str(a) for a in also) != sorted(found.also_matches):
+        out.append(
+            f"FINDING naming-also-matches: leg {leg_role!r}: also_matches is "
+            f"{sorted(str(a) for a in also)}, but {name!r} also satisfies "
+            f"{sorted(found.also_matches)}. `also_matches` records the forms "
+            "that were NOT chosen; it is not a place to add or drop one.")
+    return out
+
+
+def _naming_referent_findings(leg_role, name: str, naming: dict,
+                              referents: list) -> tuple[list[str], bool]:
+    """Does `descendant_referent`, if recorded, name one of `name`'s
+    `<Domainx><Product>` forms?
+
+    Split from `_naming_findings` for #132. Returns the findings so far,
+    and whether there is a referent to check further — `name` is not in
+    descendant form, so the caller stops here exactly as the original
+    function's `return out` inside `if not referents:` did.
+    """
+    recorded_referent = naming.get("descendant_referent")
+    if not referents:
+        if recorded_referent is not None:
+            return ([
+                f"FINDING naming-referent: leg {leg_role!r}: "
+                f"descendant_referent is {recorded_referent!r}, but {name!r} "
+                "is not in `<Domainx><Product>` form and claims descent from "
+                "nothing"], False)
+        return ([], False)
+    out = []
+    if recorded_referent is not None and str(recorded_referent) not in referents:
+        out.append(
+            f"FINDING naming-referent: leg {leg_role!r}: descendant_referent "
+            f"is {recorded_referent!r}, but {name!r} would need "
+            + " or ".join(referents))
+    return (out, True)
+
+
+def _how_referent_reached(satisfied, resolution) -> str:
+    """Phrase how a leg's referent was reached, for the
+    naming-referent-declared finding.
+
+    Split from `_naming_referent_declared_findings` for #132 — an
+    independent statement rather than a ternary nested inside a ternary
+    (python:S3358): how the referent is reached is decided on its own
+    before it is appended to the finding.
+    """
+    if satisfied is None:
+        return f" (directly or through {CHAIN_RECORD_FIELD})"
+    if resolution.by_chain:
+        return f" through the recorded chain {' → '.join(resolution.chain)}"
+    return " directly"
+
+
+def _naming_referent_declared_mismatch_finding(leg_role, naming: dict,
+                                               referents: list,
+                                               found) -> list[str]:
+    """Does `referent_declared`, if recorded, agree with whether the
+    referent was actually reached?
+
+    Split from `_naming_referent_declared_findings` for #132.
+    """
+    resolution = found.referent
+    satisfied = resolution.referent if resolution.reached else None
+    declared = naming.get("referent_declared")
+    if declared is None or bool(declared) == (satisfied is not None):
+        return []
+    how_reached = _how_referent_reached(satisfied, resolution)
+    return [
+        f"FINDING naming-referent-declared: leg {leg_role!r}: "
+        f"referent_declared is {declared!r}, but " + " / ".join(referents)
+        + (" is" if len(referents) == 1 else " are")
+        + (" not" if satisfied is None else "")
+        + " reached by this manifest's `neutral_product_pins:`"
+        + how_reached
+        + ". A descendant form is a claim; the pin is the referent."]
+
+
+def _naming_referent_missing_pin_finding(leg_role, naming: dict, found,
+                                         root: Path | None) -> list[str]:
+    """When `referent_declared: true`, does the pin file for the referent
+    this leg actually holds exist in the tree?
+
+    Split from `_naming_referent_declared_findings` for #132. A direct pin
+    is the referent's own pin file; a chain's is the FIRST LINK's, because
+    that is the pin this project actually holds.
+    """
+    resolution = found.referent
+    satisfied = resolution.referent if resolution.reached else None
+    held = (resolution.chain[0] if resolution.by_chain and resolution.chain
+            else satisfied)
+    declared = naming.get("referent_declared")
+    if not (declared is True and held and root is not None):
+        return []
+    pin_path = root / "contracts" / f"{held.lower()}-pin.yaml"
+    if pin_path.is_file():
+        return []
+    return [
+        f"FINDING naming-referent-missing: leg {leg_role!r}: "
+        f"{held} is "
+        + (f"the first link of this leg's recorded chain, reaching "
+           f"{satisfied}" if held != satisfied else
+           "declared as this leg's referent")
+        + f", but {pin_path.relative_to(root).as_posix()} does not "
+        "exist. A declared pin that is not in the tree is a claim "
+        "wearing the costume of a referent."]
+
+
+def _naming_referent_declared_findings(leg_role, naming: dict, referents: list,
+                                       found, root: Path | None) -> list[str]:
+    """REACHED, not merely pinned (2026-09-05): whether `referent_declared`
+    agrees with what the classifier resolved, and, when it is `true`,
+    whether the pin file for the referent this leg actually holds exists.
+
+    Split from `_naming_findings` for #132.
+    """
+    out = list(_naming_referent_declared_mismatch_finding(
+        leg_role, naming, referents, found))
+    out.extend(_naming_referent_missing_pin_finding(leg_role, naming, found,
+                                                    root))
+    return out
+
+
+def _naming_findings(leg_role, name: str, naming, policy: NamingPolicy,
+                     pins: set[str], root: Path | None,
+                     chain: tuple, link_pins: dict) -> list[str]:
+    """Check one leg's OPTIONAL `naming:` record against the policy.
+
+    Absent is fine: the block is a record, not a requirement, and a manifest
+    written before this field existed is not thereby wrong. Present and
+    disagreeing with the classifier is a FINDING, because a record that can
+    drift from the thing it records is worse than no record.
+
+    `WARNING`-prefixed lines are returned alongside the findings and are NOT
+    findings: a chain link whose tree is not checked out here is the ordinary
+    case offline, and `main` prints those without changing the exit code.
+    """
+    if naming is None:
+        return []
+    if not isinstance(naming, dict):
+        return [f"FINDING manifest-naming: leg {leg_role!r}: naming is "
+                f"{naming!r}, expected a mapping"]
+    out = list(_naming_chain_field_finding(leg_role, naming))
+    found = policy.classify(name, str(leg_role) if leg_role else None, pins,
+                            chain, link_pins)
+    if found is None:
+        return out  # already reported as naming-unclassified
+    out.extend(_naming_classification_findings(leg_role, name, naming, found))
+
+    # The referent. `descendant_referents()` returns every spelling that would
+    # serve — `open<Product>` canonically, and the x-stem `openx<Product>` the
+    # neutral family also admits — so the record and the pins are checked
+    # against the same set the classifier consulted, not against one spelling.
+    referents = policy.descendant_referents(name)
+    referent_findings, has_referent = _naming_referent_findings(
+        leg_role, name, naming, referents)
+    out.extend(referent_findings)
+    if not has_referent:
+        return out
+    out.extend(_naming_referent_declared_findings(leg_role, naming, referents,
+                                                  found, root))
+    return out
+
+
+def _finding(code: str, detail: str) -> str:
+    """Format one `FINDING <code>: <detail>` line.
+
+    Split from `_findings`' local `bad` closure for #132, so each function
+    it split into can build its own list without capturing an enclosing
+    `out`.
+    """
+    return f"FINDING {code}: {detail}"
+
+
+def _envelope_findings(manifest: dict) -> list[str]:
+    """schema_version, kind and schema: the envelope that says what KIND of
+    document this is, checked before anything about its content.
+
+    Split from `_findings` for #132.
+    """
+    out = []
+    if manifest.get("schema_version") != 1:
+        out.append(_finding(
+            "manifest-schema-version",
+            f"schema_version is {manifest.get('schema_version')!r}, expected 1"))
+    if manifest.get("kind") != "project-manifest":
+        out.append(_finding(
+            "manifest-kind",
+            f"kind is {manifest.get('kind')!r}, expected 'project-manifest'"))
+    if manifest.get("schema") != "project-repo-schema":
+        out.append(_finding(
+            "manifest-schema",
+            f"schema is {manifest.get('schema')!r}, expected "
+            "'project-repo-schema'"))
+    return out
+
+
+def _id_findings(manifest: dict) -> tuple[list[str], str | None]:
+    """`id`, checked against `PROJECT_ID_RE`.
+
+    Split from `_findings` for #132. Returns the findings and the id to use
+    for the `topic` check later — `None` when it failed to validate, exactly
+    as `_findings` used to null out its local `project_id` on that path.
+    """
+    project_id = manifest.get("id")
+    if not isinstance(project_id, str) or not PROJECT_ID_RE.match(project_id):
+        return ([_finding(
+            "manifest-id",
+            f"id is {project_id!r}; it must match {PROJECT_ID_RE.pattern}")],
+            None)
+    return [], project_id
+
+
+def _name_finding(manifest: dict) -> list[str]:
+    """`name`.
+
+    Split from `_findings` for #132.
+
+    A NAME HOLDING A LONE SURROGATE IS A FINDING (#280). The double-quoted
+    escape `"a\\ud83db"` reads as one, as PyYAML's own Python reader reads it
+    (libyaml refuses the file). The reader keeps that escape on purpose: it
+    is how an adoption plan spells a path byte that is not UTF-8 (#199). A
+    display name is text a person chose, and no UTF-8 file, commit message
+    or console can hold a surrogate, so this file's `manifest ok` line
+    raised `UnicodeEncodeError` on it; `make validate` and `shape-doctor.py`
+    reported that traceback, while `bump-leg.py` and `update-shape.py apply`
+    passed the name, and the bump wrote it into its commit as `a?b`. Every
+    launcher now meets this finding instead. A pair of `\\u` escapes is two
+    surrogates here, as it is to PyYAML, so the finding asks for the
+    character itself or its one `\\U` escape.
+    """
+    name = manifest.get("name")
+    if not isinstance(name, str) or not name.strip():
+        return [_finding("manifest-name", f"name is {name!r}")]
+    surrogate = next((char for char in name if "\ud800" <= char <= "\udfff"),
+                     None)
+    if surrogate is not None:
+        return [_finding(
+            "manifest-name",
+            f"name is {name!r}, which holds U+{ord(surrogate):04X}, a lone "
+            "surrogate: no UTF-8 file, commit message or console can hold "
+            "it. Write each character as itself, or as one `\\U` escape "
+            "(`\\U0001F600`, not the pair `\\uD83D\\uDE00`).")]
+    return []
+
+
+def _elected_by_finding(manifest: dict) -> list[str]:
+    """`elected_by`.
+
+    Split from `_findings` for #132.
+    """
+    if not isinstance(manifest.get("elected_by"), str) or \
+            not manifest["elected_by"].strip():
+        return [_finding(
+            "manifest-elected-by",
+            "elected_by is empty. Electing the shape is a human's act and "
+            "the manifest records whose.")]
+    return []
+
+
+def _elected_on_finding(manifest: dict) -> list[str]:
+    """`elected_on`.
+
+    Split from `_findings` for #132.
+    """
+    elected_on = manifest.get("elected_on")
+    if not isinstance(elected_on, str) or not DATE_RE.match(elected_on):
+        return [_finding(
+            "manifest-elected-on",
+            f"elected_on is {elected_on!r}, expected an ISO date YYYY-MM-DD")]
+    return []
+
+
+def _topic_finding(manifest: dict, policy: NamingPolicy,
+                   project_id: str) -> list[str]:
+    """`topic`, derived from a VALID `id`.
+
+    Split from `_findings` for #132; the caller only calls this when
+    `_id_findings` returned a `project_id`, exactly as the original
+    `if project_id:` guard did.
+    """
+    expected_topic = policy.topic_for(project_id)
+    if manifest.get("topic") != expected_topic:
+        return [_finding(
+            "manifest-topic",
+            f"topic is {manifest.get('topic')!r}, expected {expected_topic!r} "
+            f"derived from id {project_id!r}")]
+    return []
+
+
+def _reference_finding(manifest: dict) -> list[str]:
+    """`reference`, OPTIONAL.
+
+    Split from `_findings` for #132.
+    """
+    reference = manifest.get("reference")
+    if reference is not None and (not isinstance(reference, str) or not reference.strip()):
+        return [_finding(
+            "manifest-reference",
+            f"reference is {reference!r}; drop the key or name the document "
+            "the election followed")]
+    return []
+
+
+def _visibility_finding(manifest: dict) -> list[str]:
+    """`visibility`, OPTIONAL like `reference:` — a manifest scaffolded
+    before this field existed is not thereby wrong. Present and not one of
+    the three real GitHub visibilities is a finding.
+
+    Split from `_findings` for #132.
+    """
+    visibility = manifest.get("visibility")
+    if visibility is not None and visibility not in VISIBILITY_CHOICES:
+        return [_finding(
+            "manifest-visibility",
+            f"visibility is {visibility!r}, expected one of "
+            f"{sorted(VISIBILITY_CHOICES)} or no field at all")]
+    return []
+
+
+def _branch_finding(code: str, what: str, value) -> list[str]:
+    """One branch value of the manifest: `tracking_branch`, or a leg's
+    `branch`.
+
+    A VALUE NO COMMAND CAN BE GIVEN IS A FINDING (#455). `bootstrap.py` hands
+    the branch to git as an argument, and a NUL or a lone surrogate (the
+    double-quoted escapes `"a\\x00b"` and `"a\\ud83db"` read as them, as in
+    #280) cannot be one: step (a) used to end in a traceback from
+    `subprocess.py` and, with that fixed, would only say it could not place
+    the leg, while this file said `manifest ok`. So no tool named the key.
+    Any surrogate is found, as `name` is (#280): no UTF-8 file or console can
+    hold one, so none is a name anybody wrote. That is the whole of the
+    question. Whether the value is a name git will create (`a..b`, `x.lock`)
+    is `git check-ref-format`'s to answer, as the scaffold asks it for
+    `--tracking-branch` (#283); and a value that is not text is left alone,
+    as `bootstrap.py` turns it into text.
+    """
+    if not isinstance(value, str):
+        return []
+    char = next((c for c in value if c == "\x00" or "\ud800" <= c <= "\udfff"),
+                None)
+    if char is None:
+        return []
+    kind = ("a NUL: no argument, file name or ref name can hold one"
+            if char == "\x00" else
+            "a lone surrogate: no UTF-8 file or console can hold it, so no "
+            "branch name is spelled with one")
+    return [_finding(
+        code,
+        f"{what} is {value!r}, which holds U+{ord(char):04X}, {kind}. Name a "
+        "branch git can create, such as `main` or `release/1.2`.")]
+
+
+def _tracking_branch_finding(manifest: dict) -> list[str]:
+    """`tracking_branch`, OPTIONAL (#455); see `_branch_finding`."""
+    return _branch_finding("manifest-tracking-branch", "tracking_branch",
+                           manifest.get("tracking_branch"))
+
+
+def _leg_branch_findings(legs: list) -> list[str]:
+    """Each leg's own `branch`, OPTIONAL, which wins over `tracking_branch`
+    in `bootstrap.py` (#455); see `_branch_finding`. A leg that is not a
+    mapping is `_leg_findings`' to name."""
+    out: list[str] = []
+    for leg in legs:
+        if isinstance(leg, dict):
+            out.extend(_branch_finding(
+                "manifest-leg-branch", f"leg {leg.get('role')!r}: branch",
+                leg.get("branch")))
+    return out
+
+
+def _shape_findings(manifest: dict) -> list[str]:
+    """`shape`: the commit-and-digest pin of the openRepoShape revision this
+    project was scaffolded from.
+
+    Split from `_findings` for #132.
+    """
+    shape = manifest.get("shape")
+    if not isinstance(shape, dict):
+        return [_finding(
+            "manifest-shape",
+            "shape is missing; a scaffolded project records the "
+            "openRepoShape revision it was cut from")]
+    out = []
+    if not isinstance(shape.get("repository"), str):
+        out.append(_finding("manifest-shape-repository",
+                            f"shape.repository is {shape.get('repository')!r}"))
+    if shape.get("revision_kind") != "commit":
+        out.append(_finding(
+            "pin-tag-only",
+            f"shape.revision_kind is {shape.get('revision_kind')!r}. A tag "
+            "can be moved and a commit cannot."))
+    if not COMMIT_RE.match(str(shape.get("commit") or "")):
+        out.append(_finding(
+            "manifest-shape-commit",
+            f"shape.commit is {shape.get('commit')!r}, not 40 hex"))
+    digests = shape.get("digests")
+    if not isinstance(digests, dict) or \
+            not SHA256_RE.match(str(digests.get("tree_sha256") or "")):
+        out.append(_finding(
+            "manifest-shape-digest",
+            f"shape.digests.tree_sha256 is not 64 hex: {digests!r}"))
+    if shape.get("digest_definition") != TREE_DIGEST_DEFINITION:
+        out.append(_finding(
+            "manifest-shape-digest-definition",
+            f"shape.digest_definition is "
+            f"{shape.get('digest_definition')!r}, expected "
+            f"{TREE_DIGEST_DEFINITION!r}"))
+    return out
+
+
+def _neutral_product_pins_type_finding(manifest: dict) -> list[str]:
+    """`neutral_product_pins`, OPTIONAL.
+
+    Split from `_findings` for #132.
+    """
+    declared_pins = manifest.get("neutral_product_pins")
+    if declared_pins is not None and not isinstance(declared_pins, list):
+        return [_finding(
+            "manifest-neutral-product-pins",
+            f"neutral_product_pins is {declared_pins!r}, expected a list of "
+            "neutral product names")]
+    return []
+
+
+def _roles_finding(legs: list) -> list[str]:
+    """Are the declared roles exactly {assembly, spec, code}, once each?
+
+    Split from `_findings` for #132.
+    """
+    roles = [leg.get("role") for leg in legs if isinstance(leg, dict)]
+    if sorted(r for r in roles if r) != sorted(REQUIRED_ROLES):
+        return [_finding(
+            "manifest-roles",
+            f"legs declare roles {roles!r}; this schema requires exactly "
+            f"{sorted(REQUIRED_ROLES)}, once each")]
+    return []
+
+
+def _leg_role_classification_finding(role, name: str, found) -> list[str]:
+    """Does the declared `role` accept the family/form `name` actually
+    classifies as?
+
+    Split from `_findings`' per-leg loop for #132.
+    """
+    if found is None:
+        return [_finding(
+            "naming-unclassified",
+            f"leg {role!r}: {name!r} matches no family in the naming policy")]
+    if accepts_role(found, str(role or "")):
+        # The project-leg family in exactly the declared role; or a
+        # DECLARED domain descendant serving as the assembly root, which
+        # the 2026-09-02 ruling admits (a descendant may carry legs); or a
+        # NEUTRAL PRODUCT serving as its own assembly root, which the
+        # 2026-09-05 ruling admits (a neutral product may elect the shape,
+        # and electing confers nothing, so the root is a layout fact).
+        # `accepts_role` is the one definition; see `repo_shape`.
+        return []
+    if found[0] != "project-leg":
+        return [_finding(
+            "naming-not-a-leg",
+            f"leg {role!r}: {name!r} classifies as {found[0]!r}, not as a "
+            f"project leg ({found.reason})")]
+    return [_finding(
+        "naming-role-mismatch",
+        f"leg {role!r}: {name!r} is the {found[1]!r} form of the "
+        "project-leg family")]
+
+
+def _leg_path_findings(role, path, paths: dict[str, str]) -> list[str]:
+    """One leg's `path:`.
+
+    Split from `_findings`' per-leg loop for #132. Mutates `paths` exactly
+    as the original loop body did, so the next leg's collision check sees
+    this one recorded.
+    """
+    if not isinstance(path, str) or not path:
+        return [_finding("manifest-leg-path", f"leg {role!r}: path is {path!r}")]
+    out = []
+    if role == "assembly" and path != ".":
+        out.append(_finding(
+            "manifest-assembly-path",
+            f"the assembly leg is this repository, so its path is '.', not "
+            f"{path!r}"))
+    if role != "assembly":
+        if path.startswith("/") or ".." in Path(path).parts or path == ".":
+            out.append(_finding(
+                "manifest-leg-path",
+                f"leg {role!r}: path {path!r} must be a relative path "
+                "inside the assembly root"))
+        if path in paths:
+            out.append(_finding(
+                "manifest-leg-path-collision",
+                f"legs {paths[path]!r} and {role!r} both claim path {path!r}"))
+        paths[path] = str(role)
+    return out
+
+
+def _leg_findings(leg, policy: NamingPolicy, pins: set[str], root,
+                  owners: set[str], paths: dict[str, str]) -> list[str]:
+    """One `legs:` entry, start to finish: its repository name against the
+    naming policy, its optional `naming:` record, and its path.
+
+    Split from `_findings` for #132 so the loop over `legs` is a single
+    call per entry. Mutates `owners` and `paths` exactly as the original
+    loop body did, so the path-collision check and the owners-span check
+    after the loop see the same accumulated state; every `continue` in the
+    original loop is a `return` here.
+    """
+    if not isinstance(leg, dict):
+        return [_finding("manifest-leg", f"a leg is not a mapping: {leg!r}")]
+    role = leg.get("role")
+    repository = leg.get("repository")
+    path = leg.get("path")
+    if not isinstance(repository, str) or not QUALIFIED_RE.match(repository):
+        return [_finding(
+            "manifest-leg-repository",
+            f"leg {role!r}: repository is {repository!r}, expected "
+            "`<org>/<Name>`")]
+    owners.add(repository.split("/", 1)[0])
+    name = repo_basename(repository)
+    # The DECLARED role, the declared pins and the RECORDED CHAIN are
+    # what the classifier is given, because that is what the project says
+    # about itself. A role only wins where the NAME satisfies it, so
+    # declaring `assembly` over `<Project>-spec` still lands in
+    # naming-role-mismatch below.
+    naming = leg.get("naming")
+    chain, link_pins = _chain_and_links(naming, root)
+    found = policy.classify(name, str(role) if role else None, pins,
+                            chain, link_pins)
+    out = list(_leg_role_classification_finding(role, name, found))
+    out.extend(_naming_findings(role, name, naming, policy, pins, root,
+                                chain, link_pins))
+    out.extend(_leg_path_findings(role, path, paths))
+    return out
+
+
+#: The legs a record's row may name (#189, #525). The assembly is not one of
+#: them: the root keeps no submodule but its legs, and an answer that kept a
+#: path in the root is recorded nowhere.
+SUBMODULE_LEGS = ("spec", "code")
+
+
+class _Record:
+    """One of the two records an adoption appends, each a list of `path:` /
+    `leg:` rows (#189, #525), and how its findings are spelled.
+
+    ONE CHECKER FOR BOTH, because the rows are one shape and the doctor
+    reads both the same way. What differs is said here: the key, the stem of
+    each finding's code, what a row's path is, why a leg other than `spec`
+    or `code` says nothing, and whether a row names a directory -- with the
+    one `/` the adoption plan wrote it with -- that covers every path under
+    it.
+    """
+
+    def __init__(self, key: str, code: str, path_is: str, not_canonical: str,
+                 why_leg: str, directories: bool):
+        self.key = key
+        self.code = code
+        self.path_is = path_is
+        self.not_canonical = not_canonical
+        self.why_leg = why_leg
+        self.directories = directories
+
+
+SUBMODULE_ROWS = _Record(
+    "submodules", "manifest-submodule",
+    "it is the submodule's path inside its leg, relative and without `..`",
+    "Git records no path with a `.` segment, a trailing `/` or a doubled "
+    "`/`, so no submodule is ever at it",
+    "the assembly root keeps no submodule but its legs", False)
+
+ANSWER_ROWS = _Record(
+    "answered_paths", "manifest-answered",
+    "it is a path inside its leg, relative and without `..`, and a "
+    "directory's ends with one `/`",
+    "Git records no path with a `.` segment or a doubled `/`, and only a "
+    "directory's row ends with one `/`, so no path is ever at it",
+    "an answer that kept a path in the root is recorded nowhere", True)
+
+
+def _covers(row_path: str, path: str) -> bool:
+    """Does a row naming `row_path` cover `path`: the path itself, or a
+    directory above it (#525)."""
+    return row_path == path or (row_path.endswith("/")
+                                and path.startswith(row_path))
+
+
+def _record_path_problem(record: _Record, path, seen: list) -> str | None:
+    """Why one recorded `path` is not a path the record's reader can find, or
+    None. Records a good one in `seen`, so a second row for it is named, and,
+    where rows name directories, so is a row under another.
+
+    SPELLED THE ONE WAY GIT RECORDS A PATH (`repo_shape.path_spelling_fault`,
+    the rule a leg's mount path is held to as well). The doctor finds a
+    submodule by the path its leg's index records, and Git records none with
+    a leading `./`, a trailing `/`, a doubled `/` or a `.` segment, so a row
+    spelled that way would name nothing the doctor could ever hold to it. A
+    directory's answer keeps the one `/` the plan wrote after it, and is
+    spelled as Git records a path without it (#525). A backslash or a drive
+    letter is accepted: on POSIX each is a character of a name Git records,
+    and an adoption records a submodule at one.
+    """
+    named = (path[:-1] if record.directories and isinstance(path, str)
+             and path.endswith("/") else path)
+    fault = path_spelling_fault(named) if isinstance(named, str) else None
+    if fault == PATH_NOT_CANONICAL:
+        return f"path is {path!r}; {record.not_canonical}"
+    if fault is not None or not isinstance(path, str):
+        return f"path is {path!r}; {record.path_is}"
+    if path in seen:
+        return f"path {path!r} is recorded twice"
+    under = next((other for other in seen
+                  if _covers(other, path) or _covers(path, other)), None)
+    seen.append(path)
+    if under is not None:
+        return (f"path {path!r} overlaps the row for {under!r}: a path is "
+                "answered once")
+    return None
+
+
+def _record_row_findings(record: _Record, index: int, row,
+                         seen: list) -> list[str]:
+    """One row of a record.
+
+    Split from `_record_findings` so that each reads as one question.
+    """
+    where = f"{record.key}[{index}]"
+    if not isinstance(row, dict):
+        return [_finding(
+            f"manifest-{record.key.replace('_', '-')}",
+            f"{where} is {row!r}, expected a mapping with `path:` and "
+            "`leg:`")]
+    out = []
+    problem = _record_path_problem(record, row.get("path"), seen)
+    if problem:
+        out.append(_finding(f"{record.code}-path", f"{where}: {problem}"))
+    if row.get("leg") not in SUBMODULE_LEGS:
+        out.append(_finding(
+            f"{record.code}-leg",
+            f"{where}: leg is {row.get('leg')!r}, expected one of "
+            f"{list(SUBMODULE_LEGS)}: {record.why_leg}"))
+    resolution = row.get("resolution")
+    if resolution is not None and not isinstance(resolution, str):
+        out.append(_finding(
+            f"{record.code}-resolution",
+            f"{where}: resolution is {resolution!r}, expected the text the "
+            "adoption plan gave"))
+    commit = row.get("source_commit")
+    if commit is not None and not COMMIT_RE.match(str(commit)):
+        out.append(_finding(
+            f"{record.code}-commit",
+            f"{where}: source_commit is {commit!r}, not 40 hex"))
+    return out
+
+
+def _record_findings(manifest: dict, record: _Record) -> list[str]:
+    """`submodules` or `answered_paths`, OPTIONAL: the leg each source
+    submodule (#189), or each path the policy asked about or put in another
+    leg (#525, #655), was answered into when this project was adopted.
+
+    A RECORD IS CHECKED BECAUSE SOMETHING READS IT. `shape-doctor.py` holds
+    every submodule a leg keeps to the row naming its path, and calls one in
+    the other leg MISPLACED; it takes an answered path's row as the answer
+    for it in that leg. A row it could not read would leave that submodule
+    unchecked, or that path asked about or misplaced, and nothing would say
+    so. Absent is fine: a project with nothing to record has none, and nor
+    does one adopted before the record was written.
+    """
+    rows = manifest.get(record.key)
+    if rows is None:
+        return []
+    if not isinstance(rows, list):
+        return [_finding(
+            f"manifest-{record.key.replace('_', '-')}",
+            f"{record.key} is {rows!r}, expected a list of `path:` and "
+            "`leg:` records")]
+    seen: list[str] = []
+    out: list[str] = []
+    for index, row in enumerate(rows):
+        out.extend(_record_row_findings(record, index, row, seen))
+    return out
+
+
+def _owners_span_finding(owners: set[str]) -> list[str]:
+    """Do the legs span more than one organisation?
+
+    Split from `_findings` for #132.
+    """
+    if len(owners) > 1:
+        return [_finding(
+            "manifest-legs-split",
+            f"the legs span more than one organisation: {sorted(owners)}")]
+    return []
+
+
+def _findings(manifest: dict, policy: NamingPolicy, root=None) -> list[str]:
+    out: list[str] = list(_envelope_findings(manifest))
+
+    id_findings, project_id = _id_findings(manifest)
+    out.extend(id_findings)
+    out.extend(_name_finding(manifest))
+    out.extend(_elected_by_finding(manifest))
+    out.extend(_elected_on_finding(manifest))
+    if project_id:
+        out.extend(_topic_finding(manifest, policy, project_id))
+    out.extend(_reference_finding(manifest))
+    out.extend(_visibility_finding(manifest))
+    out.extend(_tracking_branch_finding(manifest))
+    out.extend(_shape_findings(manifest))
+    out.extend(_record_findings(manifest, SUBMODULE_ROWS))
+    out.extend(_record_findings(manifest, ANSWER_ROWS))
+
+    legs = manifest.get("legs")
+    if not isinstance(legs, list) or not legs:
+        out.append(_finding("manifest-legs", "legs is missing or empty"))
+        return out
+
+    pins = _declared_pins(manifest)
+    out.extend(_neutral_product_pins_type_finding(manifest))
+    out.extend(_roles_finding(legs))
+    out.extend(_leg_branch_findings(legs))
+
+    owners: set[str] = set()
+    paths: dict[str, str] = {}
+    for leg in legs:
+        out.extend(_leg_findings(leg, policy, pins, root, owners, paths))
+    out.extend(_owners_span_finding(owners))
+    return out
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--root", type=Path, default=None)
+    parser.add_argument("--policy", type=Path, default=None)
+    parser.add_argument("--quiet", action="store_true")
+    args = parser.parse_args(argv)
+
+    try:
+        root = find_repo_root(args.root or Path(__file__).resolve().parents[1])
+        manifest_path = root / "project.yaml"
+        if not manifest_path.is_file():
+            raise Refusal(
+                "manifest-missing",
+                f"{manifest_path} does not exist. A project that has elected "
+                "this schema declares it in `project.yaml`; a project that has "
+                "not, does not run this validator.",
+            )
+        manifest = load_yaml(manifest_path)
+        if not isinstance(manifest, dict):
+            raise Refusal("manifest-unreadable", f"{manifest_path}: not a mapping")
+        policy_path = args.policy or (root / "contracts" / "repository-naming.yaml")
+        policy = NamingPolicy.load(policy_path)
+    except Refusal as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    notes = _findings(manifest, policy, root)
+    # A WARNING is a note about what could not be CHECKED here (a chain link
+    # whose tree is not on this disk), never about what is wrong. It is
+    # printed and then forgotten by the exit code, deliberately.
+    findings = [note for note in notes if not note.startswith("WARNING")]
+    for note in notes:
+        print(note, file=sys.stderr)
+    if findings:
+        print(f"\n{len(findings)} finding(s) in {manifest_path}", file=sys.stderr)
+        return 1
+    if not args.quiet:
+        print(f"manifest ok: {manifest.get('name')} "
+              f"({manifest.get('id')}), {len(manifest.get('legs') or [])} legs")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/validate-pins.py b/scripts/validate-pins.py
new file mode 100755
index 00000000..63247720
--- /dev/null
+++ b/scripts/validate-pins.py
@@ -0,0 +1,1626 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""THE LOCKSTEP VALIDATOR — three things move in one commit, or this refuses.
+
+For every leg of this project, THREE facts name the same commit and they are
+advanced TOGETHER, in ONE commit, or not at all:
+
+    1. the GITLINK      — the `160000` entry this repository records for the
+                          submodule at the leg's path
+    2. the PIN FILE     — `commit:` in `contracts/<role>-pin.yaml`
+    3. every WORKFLOW `@<sha>` REFERENCE naming that leg's repository, in
+       `.github/workflows/*.yml`
+
+This is not a hypothesis. In the xFactory aggregation the same invariant
+(gitlink, `review-lane-reusable.yml@<sha>`, and a `PIN` constant in a test) was
+practice for months and written down nowhere; seven consecutive pin-syncs from
+2026-08-25 moved the gitlink alone and left the `validate` check red on every
+pull request until 2026-08-26 — unnoticed for a day because `validate` runs on
+pull requests only, so `main` never reported it and the breakage surfaced on
+somebody else's change. Shipping the check in the template is what turns that
+into a one-time scaffold cost instead of a per-project tribal rule.
+
+The DIGEST is checked too: the pin records the sha256 of the leg's tree at the
+pinned commit under the `sorted-ls-tree-r-v1` definition, recomputed here from
+the submodule's own object store. A gitlink and a pin file that agree on a
+commit whose bytes are not the bytes the pin was written against is drift the
+commit comparison alone cannot see.
+
+NEUTRAL-PRODUCT PINS ARE RECHECKED TOO. `project.yaml`'s `neutral_product_pins:`
+names every `open<Product>` this project declares descent from; each name's
+`contracts/<product lowercased>-pin.yaml` is a claim of descent with a REFERENT
+(2026-09-02) and this recomputes it the same way `scaffold-project.py` computed
+it in the first place — OFFLINE from a local checkout when one is findable
+(`--pin-source`, `SHAPE_PIN_SOURCE_<PRODUCT>`, or a checkout sitting beside this
+assembly root), else from `gh api` when `gh` is authenticated. Neither is
+available, this is a SKIP with a named notice, never a failure: a project with
+no network and no local checkout of the product is not thereby lying about its
+descent, and this check must never punish the absence of what would answer it.
+A source somebody NAMED is the other way round (#295): a `--pin-source` or
+`SHAPE_PIN_SOURCE_<PRODUCT>` that cannot answer is a FINDING, and a
+`--pin-source` no declared pin used is a note.
+
+EXIT CODES
+    0  every leg's three facts agree, every digest recomputes, and no
+       recheckable neutral-product pin disagrees
+    1  a FINDING: drift a reviewer can act on
+    2  a REFUSAL: the question could not be asked — an uninitialized submodule,
+       an unresolvable commit, an unreadable pin or workflow file (one that is
+       not UTF-8, or that this user cannot open), or a `.github/workflows/`
+       directory this user cannot list or search (#434). An unanswerable pin
+       question is never an implicit pass.
+       No git to run is one too (`git-not-runnable`, #412), a git that is
+       missing, will not run or cannot be executed: the gitlinks and the
+       digests are read through git.
+"""
+
+from __future__ import annotations
+
+import argparse
+import errno
+import os
+import re
+import shlex
+import stat
+import sys
+from collections.abc import Callable, Iterator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import NamedTuple
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+#: The interpreter the `pin-gitlink-mismatch` repair lines name (#478).
+from repo_shape import PYTHON  # noqa: E402
+from repo_shape import (  # noqa: E402
+    COMMIT_RE, SHA256_RE, TREE_DIGEST_DEFINITION, Refusal, file_sha256,
+    find_repo_root, git_out, load_yaml, pin_product_key,
+    pin_source_env_collisions, pin_source_env_name, pin_source_env_shared,
+    recorded_gitlink, repo_basename, tree_digest, tree_digest_from_gh,
+)
+#: The lockstep remedy, which is this validator's own (#370): see `main`.
+from repo_shape import REMEDIATION  # noqa: E402
+
+# `PIN_SOURCE_ENV_PREFIX` / `pin_source_env_name` live in `repo_shape` because
+# the SAME checkout answers two questions about a neutral product: the digest
+# recomputed here, and the chain-link declaration `NamingPolicy` verifies
+# (2026-09-05). Two definitions of one variable name is how the second one
+# starts disagreeing with the first.
+
+#: `owner/repo[/path]@<40 hex>` as it appears in a `uses:` line.
+WORKFLOW_REF_RE = re.compile(
+    r"(?P<repo>[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+)(?P<path>/[^@\s'\"]*)?"
+    r"@(?P<sha>[0-9a-fA-F]{40})"
+)
+
+LOCKSTEP = (
+    "THE LOCKSTEP RULE: a leg's gitlink, its `contracts/<role>-pin.yaml` "
+    "`commit:`, and EVERY `.github/workflows/*.yml` reference of the form "
+    "`<org>/<leg>/...@<sha>` are ONE invariant. Move all three in ONE commit "
+    "or the next pull request is red on somebody else's change."
+)
+
+#: The findings THE LOCKSTEP RULE is about (#539): the three facts it names,
+#: out of step, and the pin's digest of the commit they name. The rule ends
+#: each of them, and the closing count only where one of them was found: a
+#: lone `shape-copy-drift` is an edited copy, not a leg moved alone.
+LOCKSTEP_CODES = frozenset({"pin-gitlink-mismatch", "pin-digest-mismatch",
+                            "pin-workflow-ref-mismatch"})
+
+
+class Curable(NamedTuple):
+    """A `pin-digest-mismatch` or a `pin-workflow-ref-mismatch`, for
+    `_end_curable_findings` (#539): where it is in `findings`, the leg, the
+    commit its gitlink and its pin name, and a reference's own commit (None
+    for a digest)."""
+
+    index: int
+    role: object
+    path: str
+    commit: str
+    reference: str | None
+
+
+class Report:
+    def __init__(self) -> None:
+        self.findings: list[str] = []
+        self.notes: list[str] = []
+        #: Each finding's code, and the role of the leg whose `bump-leg.py`
+        #: line puts it right, or None: in step with `findings` (#478).
+        self.cleared_by: list[tuple[str, object]] = []
+        #: Each `pin-gitlink-mismatch`, as `(its index in findings, role,
+        #: path, gitlink, pin commit)`, for `_end_gitlink_mismatches` (#478).
+        self.mismatches: list[tuple[int, object, str, str, str]] = []
+        #: Each `pin-digest-mismatch` and `pin-workflow-ref-mismatch`, for
+        #: `_end_curable_findings` (#539).
+        self.curable: list[Curable] = []
+
+    def finding(self, code: str, detail: str, leg=None) -> None:
+        """`leg` is the role of the leg a `bump-leg.py` line moves when that
+        line also clears this finding: the leg's gitlink against its pin,
+        its pin's digest, and a workflow reference to its repository, the
+        three facts it rewrites (#478)."""
+        self.findings.append(f"FINDING {code}: {detail}")
+        self.cleared_by.append((code, leg))
+
+    def note(self, text: str) -> None:
+        self.notes.append(f"  ok  {text}")
+
+    def skip(self, text: str) -> None:
+        """An entry this run could not answer for, by design rather than by
+        drift — printed, but never a FINDING and never the reason for a
+        nonzero exit. A network absence is not evidence of anything."""
+        self.notes.append(f"  skip {text}")
+
+    def advise(self, text: str) -> None:
+        """A NOTE: something a person should know that is no fault of the
+        project's — printed beside the skips and, like them, never a FINDING
+        and never the reason for a nonzero exit."""
+        self.notes.append(f"  note {text}")
+
+    def unused(self, text: str) -> None:
+        """A `--pin-source` no declared pin read (#295): the person named a
+        source that did not answer, and nothing about any pin is wrong for
+        that. A note, as every one of those is."""
+        self.advise(text)
+
+
+class _Unreadable(NamedTuple):
+    """One workflow file that could not be read (#359): the line that names it,
+    and whether it failed on its ENCODING (`True`) or on being opened."""
+
+    line: str
+    encoding: bool
+
+
+def _read_workflow(root: Path, path: Path) -> tuple[str, _Unreadable | None]:
+    """`(text, None)` for a workflow file read as UTF-8, or `("", why)` for one
+    that cannot be (#359).
+
+    The line is `<path relative to root>: not UTF-8 at byte N (<reason>)`, in
+    the words `repo_shape.load_yaml` gives the same failure (#192), so a file
+    this script cannot read is named the way its other readers name one.
+    POSIX, on every platform, and never the absolute path: the reader pastes
+    it into git and into an editor that opens it from the root.
+    A file this user cannot open (`OSError`) is the same line with the
+    operating system's own reason, because it is the same unguarded read.
+    """
+    rel = path.relative_to(root).as_posix()
+    try:
+        return path.read_text(encoding="utf-8"), None
+    except UnicodeDecodeError as exc:
+        return "", _Unreadable(
+            f"{rel}: not UTF-8 at byte {exc.start} ({exc.reason})", True)
+    except OSError as exc:
+        return "", _Unreadable(
+            f"{rel}: cannot be read ({exc.strerror or type(exc).__name__})",
+            False)
+
+
+def _workflow_unreadable(files: list[_Unreadable]) -> Refusal:
+    """The ONE refusal for every workflow file that could not be read (#359).
+
+    EVERY FILE IS NAMED, in one refusal, so the operator repairs them in one
+    pass instead of meeting them one run at a time; `_workflow_refs` reads
+    them all before it raises. The first line follows the id and the rest
+    follow it, one file to a line, so `shape-doctor.py`, which quotes the
+    first `REFUSED` line of this script's output, quotes a file's name.
+    """
+    advice = ""
+    if any(one.encoding for one in files):
+        advice += (
+            "In each `not UTF-8` line the byte is counted from 0 at the start "
+            "of the file and is the first that is not UTF-8: re-save the file "
+            "as UTF-8 (a UTF-16 file with a byte-order mark needs converting, "
+            "not editing), or replace that byte with the character it was "
+            "meant to be, and commit it. ")
+    if not all(one.encoding for one in files):
+        advice += (
+            "A `cannot be read` file is not an encoding failure: this user "
+            "cannot open it, so restore read access to it, and search access "
+            "to every directory above it inside the root (a file in a "
+            "directory this user can list but not search cannot be opened). ")
+    return Refusal(
+        "workflow-unreadable",
+        "\n".join(one.line for one in files),
+        f"Remediation: {len(files)} workflow file(s) under "
+        ".github/workflows/ cannot be read, and every one is named above. "
+        "This validator reads every `.yml` and `.yaml` file there, whether or "
+        "not it names a leg, and neither skips one nor reads one lossily: a "
+        "workflow it skipped could hide a `@<sha>` reference that is out of "
+        "lockstep, which is what it exists to find, and a lossy read would "
+        "call green a tree that the project's other readers refuse. "
+        + advice + "Then run the same command again.")
+
+
+#: The `OSError`s that `Path.is_file()` and `Path.is_dir()` answered False to
+#: on Python 3.9 to 3.13 (pathlib's `_ignore_error`), because each means there
+#: is nothing at the name to open: no such file, a part of the path that is
+#: not a directory, a bad descriptor, a symlink loop, and Windows' "not
+#: ready", "invalid name" and "cannot resolve". Every other one was raised.
+_ABSENT_ERRNOS = (errno.ENOENT, errno.ENOTDIR, errno.EBADF, errno.ELOOP)
+_ABSENT_WINERRORS = (21, 123, 1921)
+
+
+def _is_a(path: Path, kind: Callable[[int], bool]) -> bool:
+    """Whether `path` is there and of `kind` (`stat.S_ISREG`, `stat.S_ISDIR`),
+    raising the `OSError` of a `stat` the operating system REFUSED (#434).
+
+    NOT `Path.is_file()` OR `Path.is_dir()`, whose answer depends on the
+    Python. Up to 3.13 they raised a refused `stat` (`PermissionError`) and
+    answered False only when nothing was there; from 3.14 they call
+    `os.path.isfile` and `isdir`, which answer False to ANY `OSError`. On
+    3.14 a `.github/` this user cannot search read as "no workflows", and
+    every file of a workflows directory it can list but not search read as
+    "not a file": `pins ok` over workflows nobody read, which is the one
+    thing this validator exists to prevent. Asked here, every Python answers
+    as 3.9 to 3.13 did, and a refused `stat` is an error that is named. The
+    same reason `_digest_from_source` gives for its own `stat()`.
+    """
+    try:
+        mode = path.stat().st_mode
+    except OSError as exc:
+        if (exc.errno in _ABSENT_ERRNOS
+                or getattr(exc, "winerror", None) in _ABSENT_WINERRORS):
+            return False
+        raise
+    return kind(mode)
+
+
+def _workflows_unlistable(root: Path, workflows: Path,
+                          exc: OSError) -> Refusal:
+    """`workflow-unreadable` for the DIRECTORY, named as one (#434).
+
+    The id a workflow file this user cannot open has (#359), so one id says
+    "this validator cannot read the workflows" whatever the cause, in the
+    words that file's line uses: `<path relative to root>: cannot be listed
+    (<the operating system's reason>)`, POSIX and never absolute. The
+    remediation is its own, because `_workflow_unreadable`'s counts files and
+    a directory this user cannot list has none to count.
+
+    The advice follows the cause. A refusal of permission (`PermissionError`,
+    `EACCES` and `EPERM`) is put right by the mode or the owner, on the
+    directory and on every one above it inside the root, since a `.github/`
+    this user cannot search hides `workflows/` as surely as its own mode.
+    Any other `OSError` (an I/O error, too many open files, a directory
+    replaced while this ran) is not a permission and is not told to `chmod`.
+    """
+    advice = (
+        "Restore read and search access to .github/workflows/ and to every "
+        "directory above it inside the root (`chmod u+rx` on each, or fix who "
+        "owns them). " if isinstance(exc, PermissionError) else
+        "Where the operating system gave another reason, put a directory "
+        "this user can list back in its place, and make sure nothing is "
+        "changing it while this runs. ")
+    return Refusal(
+        "workflow-unreadable",
+        f"{workflows.relative_to(root).as_posix()}: cannot be listed "
+        f"({exc.strerror or type(exc).__name__})",
+        "Remediation: this validator reads every `.yml` and `.yaml` file "
+        "under .github/workflows/, whether or not it names a leg, and "
+        "neither skips one nor reads one lossily: a workflow it skipped "
+        "could hide a `@<sha>` reference that is out of lockstep, which is "
+        "what it exists to find, and a directory it cannot list is one whose "
+        "workflows it cannot read. " + advice
+        + "Then run the same command again.")
+
+
+def _workflow_refs(root: Path) -> list[tuple[Path, str, str]]:
+    """Every (file, owner/repo, sha) `@<sha>` reference in the workflows, or
+    ONE refusal naming each workflow file that cannot be read (#359), or the
+    workflows directory when this user cannot list it (#434).
+
+    EVERY FILE IS READ, whether or not it names a leg: the file is opened
+    before it is known to hold a reference, so a UTF-16 workflow that names no
+    leg used to stop the run in a `UnicodeDecodeError` (a `ValueError`, which
+    `main()` does not catch: a traceback, exit 1 -- the code this validator
+    uses for a finding). It is a REFUSAL, exit 2, `workflow-unreadable`, as a
+    pin that is not UTF-8 is `yaml-unreadable`: the question cannot be asked.
+
+    THE DIRECTORY IS THE SAME REFUSAL, BY ANOTHER CAUSE (#434). The three
+    calls that reach a workflow had no handler either: `workflows.is_dir()`,
+    `workflows.iterdir()` and `is_file()` on each child, and `main()` catches
+    `Refusal` alone, so a `.github/workflows/` this user could not list, one
+    it could list and not search, or a `.github/` it could not search ended
+    the run in a `PermissionError` traceback, exit 1. A directory it cannot
+    reach is refused by name, and so is each file whose `stat` is refused (the
+    directory listable and not searchable): the same `cannot be read` line a
+    file it cannot open gets, never a file skipped as "not a file", because a
+    skipped workflow could hide a `@<sha>` reference that is out of lockstep.
+    Only a name with nothing at it (`_is_a` is False) is "no workflows", as it
+    always was.
+    """
+    out: list[tuple[Path, str, str]] = []
+    unreadable: list[_Unreadable] = []
+    workflows = root / ".github" / "workflows"
+    try:
+        if not _is_a(workflows, stat.S_ISDIR):
+            return out
+        children = sorted(workflows.iterdir())
+    except OSError as exc:
+        raise _workflows_unlistable(root, workflows, exc) from exc
+    for path in children:
+        if path.suffix not in (".yml", ".yaml"):
+            continue
+        try:
+            if not _is_a(path, stat.S_ISREG):
+                continue
+        except OSError as exc:
+            # The words `_read_workflow` gives a file it cannot open.
+            unreadable.append(_Unreadable(
+                f"{path.relative_to(root).as_posix()}: cannot be read "
+                f"({exc.strerror or type(exc).__name__})", False))
+            continue
+        text, problem = _read_workflow(root, path)
+        if problem is not None:
+            unreadable.append(problem)
+            continue
+        for match in WORKFLOW_REF_RE.finditer(text):
+            out.append((path, match.group("repo"), match.group("sha").lower()))
+    if unreadable:
+        raise _workflow_unreadable(unreadable)
+    return out
+
+
+def _load_leg_pin(root: Path, role, path: str, repository: str,
+                  report: Report) -> tuple[dict, str, str]:
+    """Read `<role>-pin.yaml` and check its own fields, before any fact in it
+    is compared against another.
+
+    Split from `_check_leg` for #132: everything that answers "does the pin
+    file itself look right" belongs together. Returns the pin, its path
+    relative to `root`, and its `commit:` lowercased.
+    """
+    pin_path = root / "contracts" / f"{role}-pin.yaml"
+    if not pin_path.is_file():
+        raise Refusal(
+            "pin-missing",
+            f"leg {role!r} declares {repository} at {path!r} but "
+            f"{pin_path.relative_to(root).as_posix()} does not exist",
+        )
+    pin = load_yaml(pin_path)
+    if not isinstance(pin, dict):
+        raise Refusal("pin-unreadable", f"{pin_path}: not a mapping")
+
+    # POSIX, on every platform: a finding names a path in THIS repository,
+    # and `str()` of a relative Path on Windows spells it with backslashes —
+    # a path the reader cannot paste back into git.
+    rel = pin_path.relative_to(root).as_posix()
+    if pin.get("kind") != "pinned_contract_manifest":
+        report.finding("pin-wrong-kind",
+                       f"{rel}: kind is {pin.get('kind')!r}, expected "
+                       "'pinned_contract_manifest'")
+    if pin.get("revision_kind") != "commit":
+        report.finding(
+            "pin-tag-only",
+            f"{rel}: revision_kind is {pin.get('revision_kind')!r}. A tag can "
+            "be moved and a commit cannot; a pin is a commit or it is nothing.",
+        )
+    commit = str(pin.get("commit") or "")
+    if not COMMIT_RE.match(commit):
+        raise Refusal(
+            "pin-tag-only",
+            f"{rel}: `commit:` is {commit!r}, which is not 40 hex. An "
+            "abbreviated oid, a branch or a tag is a moving reference.",
+        )
+    commit = commit.lower()
+    if pin.get("submodule_path") != path:
+        report.finding("pin-path-mismatch",
+                       f"{rel}: submodule_path is {pin.get('submodule_path')!r} "
+                       f"but project.yaml puts the {role} leg at {path!r}")
+    if pin.get("source_repository") != repository:
+        report.finding("pin-repository-mismatch",
+                       f"{rel}: source_repository is "
+                       f"{pin.get('source_repository')!r} but project.yaml "
+                       f"declares {repository!r}")
+    return pin, rel, commit
+
+
+@contextmanager
+def _git_runs(unread: str) -> Iterator[None]:
+    """The `git-not-runnable` refusal, exit 2, for a check that reads this
+    repository through git and could not start it (#412).
+
+    `git_out` raises `FileNotFoundError` when there is no git on PATH,
+    `PermissionError` when the `git` found there will not run, and a plain
+    `OSError` (`ENOEXEC`) when it is no program this machine can execute, a
+    binary for another architecture or a script with no shebang, and nothing
+    here caught any of them: the run ended in a traceback, which exits 1, a
+    FINDING's code, though nothing was found. The module's own exit codes
+    make 1 "drift a reviewer can act on" and 2 "the question could not be
+    asked ... never an implicit pass". So every call that runs git runs
+    inside this, and `unread` says which check it was and what it could not
+    read. ONE code, whichever check meets the missing git first; every one
+    of them is the same fact about the machine.
+
+    ONLY AN ERROR FROM STARTING GIT COUNTS, told apart two ways. The block
+    is around the git calls alone, never around a whole check: a pin file or
+    a submodule directory nobody may read is an `OSError` too, and it is not
+    this, nor is telling that operator to put git on PATH any help. And
+    inside a git call the class is not enough: `subprocess` raises the same
+    `FileNotFoundError` or `PermissionError` when the DIRECTORY it was to run
+    git in cannot be entered, and on POSIX names that directory in
+    `filename` where a program that will not start names `git`. So the rule
+    is the NAME: any `OSError` whose `filename` is `git` counts, `ENOEXEC`'s
+    included, and an error that names a directory or any other file passes
+    through unchanged, and so does any `OSError` that names none. The one
+    nameless error that counts is a `FileNotFoundError` or a
+    `PermissionError`: Windows' `CreateProcess` failures carry no filename,
+    so a missing git there is `[WinError 2]` with `filename` None, and
+    nothing says it was the directory.
+
+    `recorded_gitlink`'s `except Refusal` is not in the way: an `OSError` is
+    no `Refusal`, so a missing git reaches here instead of reading as "no
+    gitlink recorded", which would be a false `pin-gitlink-absent`.
+    """
+    try:
+        yield
+    except OSError as exc:
+        nameless = (exc.filename is None
+                    and isinstance(exc, (FileNotFoundError, PermissionError)))
+        if exc.filename != "git" and not nameless:
+            raise
+        raise Refusal(
+            "git-not-runnable",
+            f"{unread}: git could not be run ({exc.strerror or exc})",
+            "Remediation: put git on PATH and run `scripts/validate-pins.py` "
+            "again. This assembly root's lockstep gate reads each leg's "
+            "gitlink and recomputes its pinned tree digest through git, so "
+            "without it nothing says whether the pins agree, and a gate that "
+            "cannot answer is never a pass.") from exc
+
+
+def _gitlink_repairs(root: Path, role, gitlink: str, commit: str) -> str:
+    """The two commands a `pin-gitlink-mismatch` ends on, when they can
+    commit (#478; `_end_gitlink_mismatches` says when).
+
+    WHICH COMMIT STAYS IS THE PERSON'S CALL, so both are named and neither
+    is chosen. A gitlink moved and committed by hand (`git -C spec pull`,
+    then `git add spec` in the root) wants the first, `--to` the gitlink's
+    commit, if the move was meant and the second, `--to` the pin's, if it
+    was not; a pin edited by hand reads the same with the two the other way
+    round. Either is `bump-leg.py`, which puts all three facts at one commit
+    in ONE commit and runs this validator before it commits: a gitlink put
+    back by hand is the same single-fact move this check refuses. Its
+    `--dry-run` comes first, as openRepoShape's AGENTS.md says of advancing
+    a leg.
+
+    FROM A CHECKOUT OF openRepoShape, as `validate-family.py` names
+    `family.py`: no project carries `bump-leg.py`, and this file cannot know
+    where the reader's checkout is, so the script is relative to one and the
+    root, which it does know, is absolute and quoted.
+    """
+    return _two_repairs(root, role, "the first command keeps the gitlink's "
+                        "commit and the second the pin's", gitlink, commit)
+
+
+def _bump_command(root: Path, role) -> str:
+    """`bump-leg.py` for this root's leg `role`, up to its `--to` (#478)."""
+    return (f"{PYTHON} scripts/bump-leg.py --root {shlex.quote(str(root))} "
+            f"--leg {shlex.quote(str(role))} --to")
+
+
+#: What a `bump-leg.py` line needs to commit, said once for every finding
+#: that names one (#478, #539).
+BUMP_COMMITS = ("on a branch other than the tracking branch, once this "
+                "validator and validate-manifest.py pass on its rewrite (it "
+                "rolls the bump back when either is red), and refuses a "
+                "commit no branch of the leg's remote contains")
+
+
+def _two_repairs(root: Path, role, choice: str, first: str,
+                 second: str) -> str:
+    """Two `bump-leg.py` lines for one leg, `--to` `first` and `--to`
+    `second`, and `choice`, saying what each keeps: which commit stays is
+    the person's call, so neither is chosen (#478, #539)."""
+    bump = _bump_command(root, role)
+    return ("Which commit stays is the person's call. From a checkout of "
+            f"openRepoShape, {choice}; run either with `--dry-run` first. "
+            f"Either puts all three at it in one commit, {BUMP_COMMITS}, so "
+            f"push one made in the leg first:\n    {bump} {first}\n"
+            f"    {bump} {second}")
+
+
+def _digest_repair(root: Path, role, commit: str) -> str:
+    """The one `bump-leg.py` line a lone `pin-digest-mismatch` ends on
+    (#539): `--to` the commit the gitlink and the pin already name, which
+    recomputes the digest from the leg's own objects and writes it into the
+    pin, the one fact it moves. Never a hand edit of the digest, which is
+    the drift this check exists to find."""
+    return ("From a checkout of openRepoShape, this recomputes the digest "
+            f"at {commit[:12]}, the commit the gitlink and the pin already "
+            "name, from the leg's own objects and writes it into the pin; "
+            "run it with `--dry-run` first. It commits "
+            f"{BUMP_COMMITS}, so push that commit from the leg first if no "
+            f"branch holds it:\n    {_bump_command(root, role)} {commit}")
+
+
+def _reference_repairs(root: Path, role, gitlink: str,
+                       reference: str) -> str:
+    """The two `bump-leg.py` lines a lone `pin-workflow-ref-mismatch` ends
+    on (#539), as `pin-gitlink-mismatch` ends on two (#478): a reference
+    edited by hand wants the first, which puts it back at the commit the
+    gitlink and the pin name, unless the edit was meant, and then the
+    second moves the gitlink and the pin to the reference's commit."""
+    return _two_repairs(
+        root, role, "the first command keeps the commit the gitlink and the "
+        "pin name and moves every reference to the leg's repository to it, "
+        "and the second moves the gitlink and the pin to this reference's",
+        gitlink, reference)
+
+
+class Back(NamedTuple):
+    """The one leg whose gitlink is off its pin while another leg is out of
+    step (#677): its path, the commit its gitlink names, and whether its
+    own `pin-digest-mismatch` stands, which is recomputed at the pin's
+    commit and so outlasts the gitlink put back there."""
+
+    path: str
+    gitlink: str
+    digest: bool
+
+
+def _digest_stands(report: Report, role) -> bool:
+    """Whether the leg `role`'s own `pin-digest-mismatch` was found."""
+    return any(one.role == role and one.reference is None
+               for one in report.curable)
+
+
+def _put_back(paths: list[str]) -> str:
+    """The step by hand a held-back line waits on while two legs are out of
+    step (#478, #677): one of `paths`' gitlinks back at its pin, or the
+    commit that moved them undone. No `bump-leg.py` line takes it, since
+    the other leg rolls that line back.
+
+    A LEG'S WORKFLOW REFERENCES GO BACK WITH ITS GITLINK: a reference moved
+    with it stays at the move, and stands as that leg's finding beside the
+    other leg's, which holds the next line back and asks for this step
+    again. AN UNDO IS FOLLOWED BY `git submodule update` over the legs: it
+    puts the gitlink back and leaves the leg checked out at the move, a
+    root `bump-leg.py` refuses as dirty."""
+    one = len(paths) == 1
+    which, moved = (f"{paths[0]}'s", "it") if one else ("one leg's", "them")
+    legs = " ".join(shlex.quote(path) for path in paths)
+    return (f"put {which} gitlink back at its pin (check that leg out at the "
+            "pin's commit and commit its gitlink in this root, with every "
+            "workflow reference to its repository at that commit too), or "
+            f"undo the commit that moved {moved} and run `git submodule "
+            f"update -- {legs}` in this root")
+
+
+def _held_then(lines: str, whom: str, back: Back | None,
+               other_legs: dict | None) -> str:
+    """What a held-back finding says comes after its first step: `lines`
+    for `whom`. Never a line while `back`'s own digest stands, since two
+    legs are then out of step with no gitlink off; and in the gitlink's own
+    finding (`other_legs`), how its move is kept if it was meant: the
+    whole commit, which is the only `--to` `bump-leg.py` takes."""
+    if back is not None and back.digest:
+        return (f"names no line while {back.path}'s own pin-digest-mismatch "
+                "stands.")
+    if back is not None and other_legs:
+        after = ("after that line" if lines.endswith("line")
+                 else "after one of them")
+        return (f"names {lines} for {whom}, and if {back.path}'s move was "
+                f"meant, bumping {back.path} to {back.gitlink} {after} keeps "
+                "it.")
+    return f"names {lines} for {whom}."
+
+
+def _gitlink_repairs_held_back(paths: list[str], others: list[str],
+                               lines: str = "the two bump-leg.py lines",
+                               back: Back | None = None,
+                               other_legs: dict[str, list[str]] | None = None
+                               ) -> str:
+    """Why a `pin-gitlink-mismatch` names no command, and what comes first
+    (#478): `bump-leg.py` runs this validator before it commits and rolls
+    the bump back when it is red, so no single line commits while another
+    leg is off its pin or another finding stands. A `pin-digest-mismatch`
+    held back by another finding says the same, naming `lines`, the one
+    line it would end on (#539).
+
+    `others` are findings no bump clears, and they are cleared first.
+    ANOTHER LEG'S DIGEST OR WORKFLOW REFERENCE IS NOT ONE (#677): a bump of
+    THAT leg clears it, and is rolled back while `back`, the one leg whose
+    gitlink is off its pin, stays off, as a bump of `back` is while that
+    finding stands. "First clear that finding" named a step no line could
+    take, so both findings name the step two gitlinks off their pins name,
+    by hand, for `back`. The gitlink's own finding is given `other_legs`,
+    `{path: codes}`, and `lines` are then that leg's; the other leg's
+    finding names its own `lines`, for itself by its path, since "that leg"
+    would read as `back`. `_held_then` says what follows.
+    """
+    what, first, whom = [], [], "that leg"
+    if len(paths) > 1:
+        what.append(" and ".join(paths) + (" are both" if len(paths) == 2
+                                           else " are all")
+                    + " off their pins")
+        whom = "the leg that is left"
+    elif other_legs:
+        whom = " and ".join(other_legs)
+    elif back is not None:
+        what.append(f"{back.path} is off its pin")
+        whom = paths[0]
+    what += [f"{path} is out of step too ({', '.join(codes)})"
+             for path, codes in (other_legs or {}).items()]
+    if others:
+        what.append("this validator also reports " + ", ".join(others))
+        first.append("clear " + ("that finding" if len(others) == 1
+                                 else "those findings"))
+    if len(paths) > 1 or back is not None:
+        first.append(_put_back(paths if len(paths) > 1 else [back.path]))
+    return ("No single bump-leg.py line can commit while "
+            + " and ".join(what) + ": bump-leg.py moves one leg and runs "
+            "this validator before it commits, rolling the bump back when it "
+            "is red. First " + ", and ".join(first) + "; this validator then "
+            + _held_then(lines, whom, back, other_legs))
+
+
+def _has_own_gate(root: Path) -> bool:
+    """Whether `root` has a `scripts/validate-pins.py` of its own, the gate
+    `bump-leg.py` runs before it commits and skips when it is absent
+    (#478)."""
+    return os.path.isfile(root / "scripts" / "validate-pins.py")
+
+
+def _end_gitlink_mismatches(root: Path, report: Report) -> object:
+    """What each `pin-gitlink-mismatch` ends on, once every check has run
+    (#478). Returns the role of the leg whose two lines it named, or None.
+
+    `bump-leg.py` RUNS THIS WHOLE VALIDATOR after its rewrite and before it
+    commits, and rolls the bump back when it is red. So its two lines are
+    named only where they can commit: ONE leg's gitlink is off its pin, and
+    every other finding is one a bump of that leg clears (`Report.finding`'s
+    `leg`). Two legs off, or any other finding, and either line is rolled
+    back, so the finding names none and says what comes first instead:
+    another leg's digest or workflow reference is that leg's to clear, and
+    what comes first is this gitlink, put back by hand (#677).
+
+    ONLY OVER A ROOT THAT HAS THIS GATE OF ITS OWN. `bump-leg.py` runs the
+    root's `scripts/validate-pins.py` and skips an absent one, so this copy
+    run against a root that has none cannot say what the bump's run will:
+    the finding ends at THE LOCKSTEP RULE, as it did before #478, and the
+    root's own gate is the thing to put back first.
+    """
+    if not report.mismatches or not _has_own_gate(root):
+        return None
+    roles = [role for _, role, _, _, _ in report.mismatches]
+    others = _out_of_step(report)[1]
+    other_legs = _other_legs(report, roles)
+    if len(report.mismatches) == 1 and not others and not other_legs:
+        index, role, _, gitlink, commit = report.mismatches[0]
+        report.findings[index] += "\n  " + _gitlink_repairs(root, role,
+                                                            gitlink, commit)
+        return role
+    paths = [path for _, _, path, _, _ in report.mismatches]
+    lines, back = "the two bump-leg.py lines", None
+    if other_legs:
+        lines = ("the bump-leg.py line" if all(
+            code == "pin-digest-mismatch" for codes in other_legs.values()
+            for code in codes) else "the bump-leg.py lines")
+        _, role, path, gitlink, _ = report.mismatches[0]
+        back = Back(path, gitlink, _digest_stands(report, role))
+    why = _gitlink_repairs_held_back(paths, others, lines, back, other_legs)
+    for index, *_ in report.mismatches:
+        report.findings[index] += "\n  " + why
+    return None
+
+
+def _other_legs(report: Report, roles: list) -> dict[str, list[str]]:
+    """`{path: codes}` for each leg not in `roles` whose own digest or
+    workflow reference is out of step, a finding only a bump of THAT leg
+    clears, each code once and in the order found (#677)."""
+    found: dict[str, list[str]] = {}
+    for one in report.curable:
+        if one.role is None or one.role in roles:
+            continue
+        codes = found.setdefault(one.path, [])
+        code = report.cleared_by[one.index][0]
+        if code not in codes:
+            codes.append(code)
+    return found
+
+
+def _end_curable_findings(root: Path, report: Report, named) -> None:
+    """What each `pin-digest-mismatch` and `pin-workflow-ref-mismatch` ends
+    on, once every check has run (#539). `named` is the role of the leg
+    whose `pin-gitlink-mismatch` names its two lines, or None.
+
+    THEY ENDED AT THE LOCKSTEP RULE AND NAMED NO COMMAND, though
+    `bump-leg.py --to` the commit the gitlink and the pin name cures both:
+    it recomputes the pin's digest from the leg's own objects and moves
+    every workflow reference to the leg's repository, in one commit. So a
+    digest names that line, and a reference names it and the line `--to`
+    its own commit, since an edit to the reference may have been meant:
+    which commit stays is the person's call, as it is for a gitlink (#478).
+
+    ONLY WHERE A LINE CAN COMMIT, by `_end_gitlink_mismatches`' rule: the
+    root has this gate of its own, and every finding is the leg's own,
+    which a bump of it clears. Where another finding stands with them and
+    no other leg is out of step, the finding says to clear that first, in
+    the words a held-back `pin-gitlink-mismatch` uses. Where the leg's own
+    gitlink is off its pin, that finding's lines clear this one too, and
+    this says so where they are named. Where ANOTHER leg's gitlink is off
+    its pin, the step that comes first is putting it back by hand, and the
+    finding says so in the words the gitlink's own uses, then names this
+    leg's lines (#677), or, where that leg's own digest stands too, that it
+    names none. Where another leg's own digest or reference is out of step
+    with no gitlink off, no line can commit and the finding ends at THE
+    LOCKSTEP RULE, as it did before: no bump-leg.py line clears either
+    leg's finding first, so there is no first step this could name that
+    the other's would not contradict.
+    """
+    if not report.curable or not _has_own_gate(root):
+        return
+    legs, untagged = _out_of_step(report)
+    off = {role: Back(path, gitlink, _digest_stands(report, role))
+           for _, role, path, gitlink, _ in report.mismatches}
+    for one in report.curable:
+        ending = _curable_ending(root, one, legs, untagged, off, named)
+        if ending:
+            report.findings[one.index] += "\n  " + ending
+
+
+def _out_of_step(report: Report) -> tuple[list, list[str]]:
+    """`(legs, codes)`: each leg a finding names as the one whose bump
+    clears it, and the code of each finding no bump clears, each once and
+    in the order found (#539)."""
+    legs: list = []
+    untagged: list[str] = []
+    for code, leg in report.cleared_by:
+        if leg is None and code not in untagged:
+            untagged.append(code)
+        elif leg is not None and leg not in legs:
+            legs.append(leg)
+    return legs, untagged
+
+
+def _curable_ending(root: Path, one: Curable, legs: list,
+                    untagged: list[str], off: dict, named) -> str:
+    """What `_end_curable_findings` adds to the finding `one`, or `""`.
+    `off` is `{role: Back}` of each leg whose gitlink is off its pin."""
+    if one.role in off:
+        return (f"Either bump-leg.py line under {one.path}'s "
+                "pin-gitlink-mismatch above clears this finding too."
+                if one.role == named else "")
+    # Every other leg out of step, as the `Back` of its gitlink off its pin,
+    # or None where that leg's own digest or reference is out of step.
+    back = [off.get(leg) for leg in legs if leg != one.role]
+    if one.role is None or len(back) > 1 or None in back:
+        return ""
+    if untagged or back:
+        return _gitlink_repairs_held_back(
+            [one.path], untagged, "the bump-leg.py line"
+            if one.reference is None else "the two bump-leg.py lines",
+            back[0] if back else None)
+    if one.reference is None:
+        return _digest_repair(root, one.role, one.commit)
+    return _reference_repairs(root, one.role, one.commit, one.reference)
+
+
+def _check_gitlink_matches_pin(root: Path, role, path: str, commit: str,
+                               rel: str, report: Report) -> str:
+    """Fact 1 vs fact 2: the recorded gitlink against the pin file's
+    `commit:`. Split from `_check_leg` for #132. Returns the gitlink so the
+    caller can check it again against fact 3, the workflow references.
+    """
+    with _git_runs(f"the {role} leg's gitlink recorded at {path!r} could "
+                   "not be read"):
+        gitlink = recorded_gitlink(root, path)
+    if gitlink is None:
+        raise Refusal(
+            "pin-gitlink-absent",
+            f"no gitlink (mode 160000) recorded at {path!r}. The {role} leg is "
+            "declared in project.yaml but this repository does not record it "
+            "as a submodule.",
+        )
+    if gitlink != commit:
+        report.finding(
+            "pin-gitlink-mismatch",
+            f"{path}: gitlink {gitlink} != {rel} commit {commit}\n  " + LOCKSTEP,
+            leg=role,
+        )
+        report.mismatches.append((len(report.findings) - 1, role, path,
+                                  gitlink, commit))
+    else:
+        report.note(f"{path}: gitlink == {rel} commit {commit[:12]}")
+    return gitlink
+
+
+def _check_pin_digest(root: Path, path: str, commit: str, pin: dict, rel: str,
+                      report: Report, role=None) -> None:
+    """The digest: split from `_check_leg` for #132. Recomputes the leg's
+    tree sha256 at the pinned commit, because a gitlink and a pin file that
+    agree on a commit may still disagree on that commit's bytes. A mismatch
+    is one `bump-leg.py` clears, since it recomputes the digest (#478).
+    """
+    submodule = root / path
+    if not (submodule / ".git").exists():
+        raise Refusal(
+            "pin-submodule-uninitialized",
+            f"{path} is not an initialized submodule checkout, so the pinned "
+            "digest cannot be recomputed. Presence is not identity and an "
+            "unreadable surface must fail rather than degrade.",
+        )
+    # `_git_runs` OUTSIDE the `try`: the refusal it raises is a `Refusal`, and
+    # inside, the `except Refusal` below would turn "no git to run" into
+    # `pin-commit-unresolvable`, which says the commit is missing.
+    with _git_runs(f"{path}: the pinned commit {commit[:12]} could not be "
+                   "looked up in that submodule"):
+        try:
+            git_out(["rev-parse", "--verify", "--quiet",
+                     f"{commit}^{{commit}}"], cwd=submodule)
+        except Refusal as exc:
+            raise Refusal(
+                "pin-commit-unresolvable",
+                f"{path}: the pinned commit {commit} is not in that "
+                f"submodule's object store ({exc.detail})",
+            ) from exc
+    recorded = (pin.get("digests") or {}).get("tree_sha256")
+    if not isinstance(recorded, str) or not SHA256_RE.match(recorded):
+        report.finding("pin-digest-malformed",
+                       f"{rel}: digests.tree_sha256 is {recorded!r}, not 64 hex")
+    elif pin.get("digest_definition") != TREE_DIGEST_DEFINITION:
+        report.finding(
+            "pin-digest-definition",
+            f"{rel}: digest_definition is {pin.get('digest_definition')!r}, "
+            f"expected {TREE_DIGEST_DEFINITION!r}. A digest whose definition is "
+            "unstated is a number, not an identity.",
+        )
+    else:
+        with _git_runs(f"{path}: the tree digest at {commit[:12]} could not "
+                       "be recomputed"):
+            actual = tree_digest(submodule, commit)
+        if actual.lower() != recorded.lower():
+            report.finding(
+                "pin-digest-mismatch",
+                f"{rel}: digests.tree_sha256 {recorded}\n"
+                f"       recomputed at {commit[:12]} {actual}\n"
+                f"  The gitlink and the pin may agree on a commit whose bytes "
+                f"are not the bytes the pin was written against.\n  " + LOCKSTEP,
+                leg=role,
+            )
+            report.curable.append(Curable(len(report.findings) - 1, role,
+                                          path, commit, None))
+        else:
+            report.note(f"{path}: tree digest recomputes ({recorded[:12]}…)")
+
+
+def _check_workflow_refs_for_leg(refs, repository: str, path: str,
+                                 gitlink: str, report: Report,
+                                 role=None) -> None:
+    """Fact 3: split from `_check_leg` for #132 — every workflow `@<sha>`
+    reference naming this leg's repository must agree with the gitlink. A
+    mismatch is one `bump-leg.py` clears, since it moves every one (#478).
+    """
+    seen = 0
+    for wf_path, wf_repo, wf_sha in refs:
+        if wf_repo != repository:
+            continue
+        seen += 1
+        if wf_sha != gitlink:
+            report.finding(
+                "pin-workflow-ref-mismatch",
+                f"{wf_path.name}: `{wf_repo}@{wf_sha}` != the gitlink "
+                f"{gitlink} recorded at {path!r}\n  " + LOCKSTEP,
+                leg=role,
+            )
+            report.curable.append(Curable(len(report.findings) - 1, role,
+                                          path, gitlink, wf_sha))
+    if seen:
+        report.note(f"{repository}: {seen} workflow @<sha> reference(s) "
+                    f"agree with the gitlink")
+
+
+def _check_leg(root: Path, leg: dict, report: Report, refs) -> None:
+    role = leg.get("role")
+    path = str(leg.get("path") or "")
+    repository = str(leg.get("repository") or "")
+    pin, rel, commit = _load_leg_pin(root, role, path, repository, report)
+    gitlink = _check_gitlink_matches_pin(root, role, path, commit, rel, report)
+    _check_pin_digest(root, path, commit, pin, rel, report, role)
+    _check_workflow_refs_for_leg(refs, repository, path, gitlink, report,
+                                 role)
+
+
+def _check_shape_pin_header(root: Path, manifest: dict, report: Report
+                            ) -> tuple[dict, str]:
+    """Load `shape-pin.yaml` and check the fields that describe its own
+    commit, before the files it lists are checked one by one.
+
+    Split from `_check_shape_pin` for #132. Returns the pin and its path
+    relative to `root`.
+    """
+    pin_path = root / "contracts" / "shape-pin.yaml"
+    if not pin_path.is_file():
+        raise Refusal("shape-pin-missing", f"{pin_path} does not exist")
+    pin = load_yaml(pin_path)
+    rel = pin_path.relative_to(root).as_posix()
+    if not isinstance(pin, dict):
+        raise Refusal("shape-pin-unreadable", f"{pin_path}: not a mapping")
+    if pin.get("revision_kind") != "commit":
+        report.finding("pin-tag-only",
+                       f"{rel}: revision_kind is {pin.get('revision_kind')!r}")
+    commit = str(pin.get("commit") or "")
+    if not COMMIT_RE.match(commit):
+        report.finding("shape-pin-commit",
+                       f"{rel}: `commit:` {commit!r} is not 40 hex")
+    declared = (manifest.get("shape") or {}).get("commit")
+    if declared and str(declared).lower() != commit.lower():
+        report.finding("shape-pin-manifest-disagree",
+                       f"{rel} commit {commit} != project.yaml shape.commit "
+                       f"{declared}")
+    return pin, rel
+
+
+def _check_shape_copy(root: Path, row, rel: str, report: Report) -> None:
+    """One `files:` row of the shape pin.
+
+    Split from `_check_shape_pin` for #132 so the loop over the pinned files
+    is a single call per row: is it a mapping, is the file still there, and
+    does its sha256 still match what the pin recorded. A row whose `path:`
+    is absent, empty or no string is `shape-pin-row`, as `update-shape.py`
+    refuses it `update-pin-row`: its `path:` was read as a path, so a row
+    with none was `None is pinned but absent` (#681).
+    """
+    if not isinstance(row, dict):
+        report.finding("shape-pin-row", f"{rel}: a files row is not a mapping")
+        return
+    path = row.get("path")
+    if not isinstance(path, str) or not path:
+        report.finding("shape-pin-row", f"{rel}: a files row's `path:` is "
+                                        f"{path!r}, not the path of a file")
+        return
+    target = root / path
+    if not target.is_file():
+        report.finding("shape-copy-missing",
+                       f"{rel}: {row.get('path')} is pinned but absent")
+        return
+    actual = file_sha256(target)
+    if actual != str(row.get("sha256", "")).lower():
+        report.finding(
+            "shape-copy-drift",
+            f"{row.get('path')}: sha256 {actual}\n"
+            f"       {rel} records {row.get('sha256')}\n"
+            "  A shape file was edited in place. Either revert it, or "
+            "carry the change upstream to openRepoShape and re-pin.",
+        )
+
+
+def _check_shape_pin(root: Path, manifest: dict, report: Report) -> None:
+    """The shape pin is a COPY pin, and it is checked as one.
+
+    openRepoShape is not a submodule of a scaffolded project: the scaffold
+    COPIES a small set of files out of it so the project is self-contained in
+    an org that may never obtain the upstream. There is therefore no gitlink to
+    compare — the identity of the copies is carried by the per-file `sha256`
+    rows, exactly the half of `neutral-product-pin`'s shape that exists for
+    artifacts a consumer holds rather than mounts.
+    """
+    pin, rel = _check_shape_pin_header(root, manifest, report)
+    before = len(report.findings)
+    files = pin.get("files") or []
+    if not isinstance(files, list):
+        # Asked, not assumed (#290): `files: 5` was iterated, and the run
+        # ended in a TypeError with no finding naming the pin.
+        report.finding("shape-pin-row",
+                       f"{rel}: `files:` is {files!r}, not a list of "
+                       "`path:`/`sha256:` rows, so nothing about the copied "
+                       "shape files is actually asserted")
+        return
+    if not files:
+        report.finding("shape-pin-no-files",
+                       f"{rel}: no `files:` rows, so nothing about the copied "
+                       "shape files is actually asserted")
+    for row in files:
+        _check_shape_copy(root, row, rel, report)
+    if len(report.findings) == before:
+        report.note(f"{rel}: {len(files)} copied shape file(s) match their digests")
+
+
+def _shown(typed: str) -> str:
+    """A `--pin-source` value as a note names it: as typed, unless a
+    character in it is not printable (`str.isprintable`), and then as
+    Python's `repr` spells it, `'x\\x1b[31mRED'` (#610). It is the spelling
+    the scaffold's `pin-source-unreadable` gives a `--pin-source`
+    (`repo_shape.shown_path`), written here rather than imported: a root
+    whose `scripts/repo_shape.py` is older than this file has no such name,
+    and this gate would end in an `ImportError` before it checked a pin.
+    Printed raw, an ESC in the value reached the terminal as the control it
+    is."""
+    return typed if typed.isprintable() else repr(typed)
+
+
+class PinSources:
+    """Every `--pin-source` value AS TYPED, read against the neutral-product
+    pins `project.yaml` declares, and which of them a pin actually read.
+
+    THE READING (#295). `PRODUCT=PATH` and a bare `PATH` are told apart by an
+    `=`, and a path may hold one: a stand-in cloned under `a=b/` is
+    `--pin-source a=b/openGlass`. Splitting every value at its first `=` made
+    that a source keyed to a product `a` that nothing declares, which no pin
+    ever looked up — the digest went to `gh api` and a `skip`, exit 0, with
+    the skip line itself suggesting the `--pin-source` the person had just
+    passed. So the text before the first `=` is a PRODUCT only when it
+    casefolds to a declared pin's name, the same casefold the lookup below
+    uses, and any other value is a bare PATH, whole. A declared name wins
+    even when a directory is spelled like the whole value
+    (`openGlass=x/openGlass` beside a directory `openGlass=x`): the reading is
+    decided by the manifest and never by what happens to be on the disk, and
+    `./openGlass=x/openGlass` is how to mean that directory.
+
+    WHAT NO PIN READ (#295). A value no declared pin used — a mistyped key, a
+    bare path every pin had a more specific answer for, an earlier value a
+    later one replaced — is said once the pins are checked, by
+    `_note_unused_pin_sources`. Saying nothing is how a mistyped key read as
+    a pass that never looked.
+
+    A VALUE THAT NAMES NO PATH IS REFUSED (#442), `pin-source-no-path`:
+    `openGlass=` with nothing after its `=`, or an empty value. Either was
+    `Path("")`, which is `.`, so the directory this ran in was asked for the
+    pinned commit and the finding blamed `.`. `.` typed still means it.
+    """
+
+    def __init__(self, values: list[str], declared) -> None:
+        #: The declared pins, spelled as `project.yaml` spells them.
+        self.declared = [p for p in declared if isinstance(p, str) and p]
+        names = {product.casefold(): product for product in self.declared}
+        #: `{product casefolded: (typed, path)}`, the last value given wins.
+        self.keyed: dict[str, tuple[str, Path]] = {}
+        #: `(typed, path)` of the last bare value, if any.
+        self.bare: tuple[str, Path] | None = None
+        #: Every distinct value in the order given, and the declared pin it
+        #: was read as keyed to, or None for a bare PATH.
+        self.reading: dict[str, str | None] = {}
+        #: `{typed: the later value that took its place}`.
+        self.replaced: dict[str, str] = {}
+        #: The values a pin's digest was asked of, readable or not.
+        self.used: set[str] = set()
+        for typed in values:
+            key, sep, path = typed.partition("=")
+            product = names.get(key.casefold()) if sep else None
+            self.reading[typed] = product
+            if product is not None:
+                earlier = self.keyed.get(product.casefold())
+                self.keyed[product.casefold()] = (typed, Path(path))
+            else:
+                earlier = self.bare
+                self.bare = (typed, Path(typed))
+            self.replaced.pop(typed, None)
+            if earlier is not None and earlier[0] != typed:
+                self.replaced[earlier[0]] = typed
+        no_path = [f"`--pin-source {typed}` names no path for {product}"
+                   if typed else "`--pin-source ''` names no path"
+                   for typed, product in self.reading.items()
+                   if not (typed.partition("=")[2] if product else typed)]
+        if no_path:
+            raise Refusal(
+                "pin-source-no-path",
+                "; ".join(no_path) + ". An empty path would be read as the "
+                "directory this runs in.",
+                "Remediation: give the checkout's path (`--pin-source "
+                "<product>=<path>`), or `.` to mean this directory.")
+
+    def read_as_path(self, typed: str | None) -> str:
+        """The sentence saying a value holding `=` was read as a bare PATH,
+        or `""` — what a person who meant `PRODUCT=PATH` and mistyped the
+        product needs told, since nothing else in the run names it. Nothing
+        when no pin is declared: the note has already said so. The key is
+        spelled as `_shown` spells the value (#610)."""
+        if typed is None or self.reading.get(typed) is not None \
+                or "=" not in typed or not self.declared:
+            return ""
+        key = typed.partition("=")[0]
+        what = f"`{_shown(key)}` is not" if key else "nothing before its `=` is"
+        return (f"It was read as a PATH: {what} a declared neutral-product "
+                f"pin (declared: {', '.join(self.declared)}).")
+
+
+def resolve_neutral_pin_source(root: Path, product: str, repository: str,
+                               sources: PinSources,
+                               env_shared: bool = False,
+                               ) -> tuple[Path | None, str | None, str | None]:
+    """Where to read `product`'s tree OFFLINE, if anywhere at all.
+
+    Tried in order, the most explicit ask first:
+
+      1. `--pin-source <product>=<path>` (case-insensitive on the name, which
+         must be a declared pin's for the value to be read this way, #295)
+      2. `SHAPE_PIN_SOURCE_<PRODUCT>` in the environment
+      3. a checkout sitting BESIDE this assembly root, named for the pinned
+         repository (`opensoft/openGlass` -> `../openGlass`) — the ordinary
+         shape of a workspace that clones a project and its neutral products
+         side by side
+      4. a bare `--pin-source <path>` with no `product=` prefix, which applies
+         to whichever pin does not already have a more specific answer — the
+         common case is exactly one declared neutral-product pin
+
+    Rule 2 is skipped when `env_shared` is true, which is when another
+    declared pin names the same variable (#275): a variable that cannot say
+    which product it holds answers for neither, and `neutral-pin-source-
+    collides` is noted for the pair. The pin still verifies through rule 1,
+    3 or 4.
+
+    Returns `(path, how, typed)`, `typed` being the `--pin-source` value as
+    given when one of those answered, so the caller can mark it used (#295).
+    `(None, None, None)` when nothing above answers; the caller's next step
+    is `gh api`, and after that, a SKIP.
+    """
+    keyed = sources.keyed.get(product.casefold())
+    if keyed is not None:
+        typed, path = keyed
+        return path, f"--pin-source {product}=...", typed
+    env_name = pin_source_env_name(product)
+    env_value = None if env_shared else os.environ.get(env_name)
+    if env_value:
+        return Path(env_value), f"${env_name}", None
+    sibling = root.parent / repo_basename(repository)
+    if (sibling / ".git").exists():
+        return sibling, f"sibling checkout ({sibling})", None
+    if sources.bare is not None:
+        typed, path = sources.bare
+        return path, "--pin-source", typed
+    return None, None, None
+
+
+def _digest_from_source(source: Path, commit: str) -> str:
+    """`tree_digest` over a local source, with every way that source can fail
+    to answer raised as a `Refusal` (#295).
+
+    `tree_digest` runs `git` IN the source, and a directory that is not there
+    is not a git failure but a `FileNotFoundError` out of `subprocess.run`
+    (`NotADirectoryError` for a file, `PermissionError` for a directory this
+    user cannot enter), which nothing caught: `--pin-source
+    openGlass=<missing>` died on a traceback, exit 1, where a directory that
+    is not a checkout is the `neutral-pin-source-unreadable` FINDING. An
+    explicit source that cannot answer is that finding however it fails.
+
+    `stat()` INSIDE THE GUARD, and not `exists()`/`is_dir()`: before 3.14
+    those two swallow only a missing path and raise every other `OSError`,
+    so a source under a parent this user cannot enter, or a name longer than
+    the filesystem takes, was still a traceback on 3.9 to 3.13 and, on 3.14,
+    a finding saying "no such directory" about a directory that exists. The
+    reason the finding gives is the system's own.
+    """
+    try:
+        mode = source.stat().st_mode
+    except (FileNotFoundError, NotADirectoryError):
+        raise Refusal("pin-source-missing", "no such directory") from None
+    except OSError as exc:
+        raise Refusal("pin-source-unreadable",
+                      f"{exc.strerror or exc}") from exc
+    if not stat.S_ISDIR(mode):
+        raise Refusal("pin-source-not-a-directory",
+                      "it is a file, not a directory")
+    try:
+        return tree_digest(source, commit)
+    except OSError as exc:
+        raise Refusal("pin-source-unreadable",
+                      f"{exc.strerror or exc}") from exc
+
+
+def _check_neutral_pin_entry_and_load(root: Path, product, report: Report
+                                      ) -> tuple[dict, str] | None:
+    """Validate one `neutral_product_pins:` entry and load its pin file.
+
+    Split from `_check_neutral_product_pins` for #132. Returns `None` when
+    the entry itself is malformed — already reported, and there is no pin
+    file name to go read — so the caller moves on to the next entry exactly
+    as the original loop's `continue` did.
+    """
+    if not isinstance(product, str) or not product:
+        report.finding(
+            "neutral-pin-entry-malformed",
+            f"project.yaml neutral_product_pins entry {product!r} is not "
+            "a non-empty product name",
+        )
+        return None
+    pin_path = root / "contracts" / f"{product.lower()}-pin.yaml"
+    if not pin_path.is_file():
+        raise Refusal(
+            "neutral-pin-missing",
+            f"project.yaml declares a pin on {product!r} but "
+            f"{pin_path.relative_to(root).as_posix()} does not exist",
+            "Remediation: `scaffold-project.py --pin "
+            f"{product}@<commit>` writes that file. A declaration in "
+            "project.yaml with no pin file beside it is a claim with no "
+            "referent — either restore the file or remove the "
+            "declaration.",
+        )
+    pin = load_yaml(pin_path)
+    rel = pin_path.relative_to(root).as_posix()
+    if not isinstance(pin, dict):
+        raise Refusal("neutral-pin-unreadable", f"{pin_path}: not a mapping")
+    return pin, rel
+
+
+def _check_neutral_pin_commit_and_digest_fields(pin: dict, rel: str,
+                                                report: Report
+                                                ) -> tuple[str, str] | None:
+    """The pin's own `revision_kind`/`commit`/digest fields, before any
+    recompute of the referent is attempted.
+
+    Split from `_check_neutral_product_pins` for #132. Returns `None` when
+    the digest fields are themselves malformed — already reported, and
+    recomputing anything to compare against them would be pointless — else
+    `(commit, recorded_digest)`.
+    """
+    if pin.get("revision_kind") != "commit":
+        report.finding(
+            "neutral-pin-tag-only",
+            f"{rel}: revision_kind is {pin.get('revision_kind')!r}. A tag "
+            "can be moved and a commit cannot; a pin is a commit or it is "
+            "nothing.",
+        )
+    commit = str(pin.get("commit") or "")
+    if not COMMIT_RE.match(commit):
+        raise Refusal(
+            "neutral-pin-tag-only",
+            f"{rel}: `commit:` is {commit!r}, which is not 40 hex. An "
+            "abbreviated oid, a branch or a tag is a moving reference.",
+        )
+    commit = commit.lower()
+
+    recorded = (pin.get("digests") or {}).get("tree_sha256")
+    if not isinstance(recorded, str) or not SHA256_RE.match(recorded):
+        report.finding("neutral-pin-digest-malformed",
+                       f"{rel}: digests.tree_sha256 is {recorded!r}, not "
+                       "64 hex")
+        return None
+    if pin.get("digest_definition") != TREE_DIGEST_DEFINITION:
+        report.finding(
+            "neutral-pin-digest-definition",
+            f"{rel}: digest_definition is "
+            f"{pin.get('digest_definition')!r}, expected "
+            f"{TREE_DIGEST_DEFINITION!r}. A digest whose definition is "
+            "unstated is a number, not an identity.",
+        )
+        return None
+    return commit, recorded
+
+
+def _also_a_directory(typed: str | None, sources: PinSources) -> str:
+    """The line for a value read as `PRODUCT=PATH` that ALSO names an
+    existing directory whole (#295): the keyed reading won, and this is how
+    to ask for the other one. `os.path.isdir`, which is False for every
+    `OSError` on every Python, where `Path.is_dir` before 3.14 raised a name
+    too long out of the finding it was adding a line to.
+
+    THE VALUE IS NAMED AS `_shown` NAMES IT, in the sentence and in the
+    command (#610): a value that is not printable is `repr`'d, as the "not
+    used" note names it."""
+    if typed is None or sources.reading.get(typed) is None \
+            or not os.path.isdir(typed):
+        return ""
+    named = _shown(typed)
+    return (f"`{named}` is also a directory; `--pin-source ./{named}` "
+            "reads it as one.")
+
+
+def _recompute_neutral_pin_digest(root: Path, product: str, repository: str,
+                                  commit: str, rel: str, sources: PinSources,
+                                  report: Report,
+                                  shared: frozenset[str] = frozenset()
+                                  ) -> tuple[str, str] | None:
+    """Recompute the referent's tree digest: offline where a source can be
+    found, else from `gh api`, else a named SKIP that never fails the run.
+
+    Split from `_check_neutral_product_pins` for #132. Returns `(actual,
+    how)`, or `None` when nothing could answer — a finding or a skip is
+    already reported in that case, exactly as the original loop's
+    `continue` left it.
+    """
+    env_shared = pin_product_key(product) in shared
+    source, how, typed = resolve_neutral_pin_source(root, product, repository,
+                                                    sources, env_shared)
+    if source is not None:
+        if typed is not None:
+            sources.used.add(typed)
+        try:
+            return _digest_from_source(source, commit), how
+        except Refusal as exc:
+            report.finding(
+                "neutral-pin-source-unreadable",
+                f"{rel}: {_shown(str(source))} ({how}) could not answer for "
+                f"{repository} @ {commit}: {exc.detail}"
+                + "".join(f"\n  {line}" for line in (
+                    sources.read_as_path(typed),
+                    _also_a_directory(typed, sources),
+                    f"Remediation: point it at a clone of {repository} that "
+                    "has that commit (`git fetch` in it first), or drop it "
+                    "so the next source in the order answers.") if line),
+            )
+            return None
+    try:
+        return tree_digest_from_gh(repository, commit), "gh-api-tree-recursive"
+    except Refusal as exc:
+        # A variable another pin shares is not offered, and neither is the
+        # bare `--pin-source`, which answers for every pin that has no more
+        # specific answer: the keyed form is the one that says which pin it
+        # is for (#275).
+        offered = (f"A --pin-source {product}=<path> or" if env_shared else
+                   f"A --pin-source, {pin_source_env_name(product)}, or")
+        report.skip(
+            f"{product}: pin commit {commit[:12]} digest NOT "
+            f"rechecked — no local checkout ({exc.code}: "
+            f"{exc.detail}). {offered} a checkout at "
+            f"../{repo_basename(repository)} beside "
+            "this assembly root would verify it offline.",
+        )
+        return None
+
+
+def _check_one_neutral_product_pin(root: Path, product, report: Report,
+                                   sources: PinSources,
+                                   shared: frozenset[str] = frozenset()
+                                   ) -> None:
+    """One `neutral_product_pins:` entry, start to finish.
+
+    Split from `_check_neutral_product_pins` for #132 so the loop in that
+    function is a single call per entry instead of the whole re-check
+    inline; each `return` below is one of the original loop's `continue`s.
+    """
+    loaded = _check_neutral_pin_entry_and_load(root, product, report)
+    if loaded is None:
+        return
+    pin, rel = loaded
+    repository = str(pin.get("source_repository") or "")
+    fields = _check_neutral_pin_commit_and_digest_fields(pin, rel, report)
+    if fields is None:
+        return
+    commit, recorded = fields
+    recomputed = _recompute_neutral_pin_digest(root, product, repository,
+                                               commit, rel, sources, report,
+                                               shared)
+    if recomputed is None:
+        return
+    actual, how = recomputed
+    if actual.lower() != recorded.lower():
+        report.finding(
+            "neutral-pin-digest-mismatch",
+            f"{rel}: digests.tree_sha256 {recorded}\n"
+            f"       recomputed at {commit[:12]} {actual} ({how})\n"
+            "  A neutral-product pin's digest no longer matches the "
+            "bytes it names — the referent this project's name claims "
+            "descent from has moved, or the pin was hand-edited.",
+        )
+    else:
+        report.note(f"{product}: pin commit {commit[:12]} digest "
+                   f"recomputes ({how})")
+
+
+def _report_pin_source_collisions(products, report: Report) -> None:
+    """One `neutral-pin-source-collides` NOTE for each variable two or more
+    declared products share (#275), naming every one of them and the
+    variable. It is a note and never a finding: such a project did nothing
+    the standard forbade when it was made (`scaffold-project.py` has refused
+    it only since #275), every pin in it still verifies through the keyed
+    `--pin-source <product>=<path>` or a checkout beside this assembly root,
+    and a finding would make `update-shape.py apply` refuse every shape
+    update (`update-validators-red`) until a person dropped a true
+    declaration of descent. Which declaration stays is that person's
+    decision, so the note says so and nothing here asks for one to go.
+    `pin_source_env_collisions` is `repo_shape`'s, the one answer
+    `scaffold-project.py` refuses on too: products are distinct by their pin
+    files, so a product listed twice is not a collision here. The names are
+    quoted with `repr`, as `neutral-pin-entry-malformed` quotes an entry: they
+    are the manifest's own text and may hold a newline, and a note is one
+    line."""
+    for variable, group in pin_source_env_collisions(products).items():
+        names = " and ".join(repr(product) for product in group)
+        report.advise(
+            "neutral-pin-source-collides: project.yaml neutral_product_pins "
+            f"declares {names}, and one variable, {variable}, names the local "
+            "checkout of each: it cannot say which it holds, so it is read "
+            "for none of them. Each pin still verifies from the keyed "
+            "`--pin-source <product>=<path>` or from a checkout beside this "
+            "assembly root; a bare `--pin-source` answers for every pin that "
+            "has no more specific source. Which declaration stays is the "
+            "human's decision, and nothing here fails on it.")
+
+
+def _check_neutral_product_pins(root: Path, manifest: dict, report: Report,
+                                pin_source_values: list[str]) -> None:
+    """Re-check every `neutral_product_pins:` entry `project.yaml` declares.
+
+    `<Domainx><Product>` is a CLAIM of descent and a claim needs a REFERENT
+    (Brett Heap, 2026-09-02): the referent is `contracts/<product lowercased>-
+    pin.yaml`, and this recomputes its digest the same way
+    `scaffold-project.py` computed it when the pin was first written — from a
+    local checkout when one can be found, else from `gh api`. Neither
+    available is a SKIP, never a finding and never a refusal: the absence of
+    a way to answer is not evidence that the pin is wrong.
+
+    TWO PRODUCTS THAT SHARE ONE VARIABLE ARE A NOTE (#275), and neither
+    reads it. `SHAPE_PIN_SOURCE_<PRODUCT>` is the product's name upper-cased
+    with every character outside `[A-Z0-9_]` turned into `_`, so `open-glass`,
+    `open_glass` and `open.glass` are three pin files and one variable.
+    Whichever checkout it named answered for all of them, and the pin it was
+    not a checkout of was reported as `neutral-pin-source-unreadable`: drift
+    in the project, said about a variable. Now no pin reads it, each pin
+    verifies from its own source, and `neutral-pin-source-collides` says so
+    and goes no further: it is not a finding, because a project that already
+    declares such a pair could not otherwise take a shape update, and which
+    declaration to drop is a human's to decide.
+
+    The `--pin-source` values are READ here rather than in `main`, because
+    whether `a=b/openGlass` is keyed to a product or a bare path depends on
+    the pins this manifest declares (#295); each one no pin used is noted
+    once every pin has been checked.
+
+    A VALUE THAT IS NOT A LIST IS A FINDING AND DECLARES NOTHING (#443),
+    asked before `PinSources` reads it, in `validate-manifest.py`'s words for
+    the same field (`manifest-neutral-product-pins`). Iterated as it stood,
+    `5`, `true` or `1.5` ended this validator in a `TypeError`, and a scalar
+    `openXdox` (or a mapping) was read one character (or key) at a time, so
+    the run refused `neutral-pin-missing` for a pin on `'o'`, a name nobody
+    wrote. Absent or null declares no pin, as ever; `0`, `false` and `''`,
+    which `or []` read as an empty list, are the finding too.
+    """
+    products = manifest.get("neutral_product_pins")
+    if products is not None and not isinstance(products, list):
+        report.finding(
+            "manifest-neutral-product-pins",
+            f"neutral_product_pins is {products!r}, expected a list of "
+            "neutral product names")
+    if not isinstance(products, list):
+        products = []
+    sources = PinSources(pin_source_values, products)
+    _report_pin_source_collisions(products, report)
+    shared = frozenset(pin_source_env_shared(products))
+    for product in products:
+        _check_one_neutral_product_pin(root, product, report, sources, shared)
+    _note_unused_pin_sources(sources, report)
+
+
+def _note_unused_pin_sources(sources: PinSources, report: Report) -> None:
+    """A note for each `--pin-source` value no declared pin read (#295),
+    naming it as typed and why: a later value replaced it, its pin was never
+    recomputed, nothing is declared, or every pin had a more specific
+    answer. A value holding `=` that was read as a PATH says so, because
+    that is the mistyped key's only trace in the run.
+
+    "As typed" is `_shown`'s (#610): a value that is not printable, and the
+    later value that replaced it, are named as `repr` spells them.
+    """
+    for typed, product in sources.reading.items():
+        if typed in sources.used:
+            continue
+        later = sources.replaced.get(typed)
+        if later is not None:
+            why = f"the later `--pin-source {_shown(later)}` replaced it"
+        elif product is not None:
+            why = f"{product}'s digest was not recomputed from any source"
+        elif not sources.declared:
+            why = "project.yaml declares no neutral-product pin"
+        else:
+            why = ("each declared pin had a more specific source (a keyed "
+                   "--pin-source, SHAPE_PIN_SOURCE_<PRODUCT>, or a checkout "
+                   "beside this assembly root) or was not recomputed")
+        report.unused(" ".join(filter(None, (
+            f"--pin-source {_shown(typed)}: not used — {why}.",
+            sources.read_as_path(typed)))))
+
+
+def _load_legs_to_check(root: Path) -> tuple[dict, list[dict]]:
+    """The manifest and its non-assembly legs, or a Refusal naming why there
+    is nothing here to check. Split from `main` for #132.
+    """
+    manifest_path = root / "project.yaml"
+    if not manifest_path.is_file():
+        raise Refusal(
+            "manifest-missing",
+            f"{manifest_path} does not exist, so there is no declaration of "
+            "which legs to check. A one-repository project has no legs and "
+            "does not run this validator.",
+        )
+    manifest = load_yaml(manifest_path)
+    if not isinstance(manifest, dict):
+        raise Refusal("manifest-unreadable", f"{manifest_path}: not a mapping")
+    legs = [leg for leg in (manifest.get("legs") or [])
+            if isinstance(leg, dict) and leg.get("role") != "assembly"]
+    if not legs:
+        raise Refusal("manifest-no-legs",
+                      f"{manifest_path}: no non-assembly legs declared")
+    return manifest, legs
+
+
+def _run_all_checks(root: Path, report: Report,
+                    pin_source_values: list[str]) -> None:
+    """Every check `main` runs inside its one `try`, in order. Split from
+    `main` for #132 so that `try` wraps a single call.
+    """
+    manifest, legs = _load_legs_to_check(root)
+    refs = _workflow_refs(root)
+    for leg in legs:
+        _check_leg(root, leg, report, refs)
+    _check_shape_pin(root, manifest, report)
+    _check_neutral_product_pins(root, manifest, report, pin_source_values)
+    _end_curable_findings(root, report, _end_gitlink_mismatches(root, report))
+
+
+def _emit_report(report: Report, quiet: bool) -> int:
+    """Print the notes and findings and choose the exit code. Split from
+    `main` for #132.
+
+    A CHARACTER STDOUT CANNOT ENCODE IS PRINTED ESCAPED (#295). A note names
+    a `--pin-source` as typed, and a `sibling checkout (<path>)` line names a
+    path, so a stdout in cp1252 (what Windows gives one that is not the
+    console) raised `UnicodeEncodeError` on `日本` and turned a passing run
+    into a traceback. A `strict` or `surrogateescape` stdout, the two that
+    raise, becomes `backslashreplace`, the handler stderr already has; any
+    other handler, one somebody chose, is left alone. The tools run from a
+    checkout of the standard use `escape_what_stdout_cannot_encode` (#214),
+    which also writes a byte `surrogateescape` read in back as that byte; it
+    lives in `shape_materialize.py`, which no project carries, and this file
+    imports nothing but `repo_shape`, so here such a byte prints as `\\udcXX`,
+    as it already does on stderr.
+
+    THE COUNT ENDS AT THE LOCKSTEP RULE ONLY WHERE IT APPLIES (#539): where
+    one of `LOCKSTEP_CODES` was found. Every other finding names its own
+    exit, and a lone `shape-copy-drift`, an edited copy that `update-shape.py`
+    or a revert puts right, was followed by a rule about moving a gitlink, a
+    pin and the workflows together.
+    """
+    if getattr(sys.stdout, "errors", None) in ("strict", "surrogateescape"):
+        try:
+            sys.stdout.reconfigure(errors="backslashreplace")
+        except (AttributeError, ValueError, OSError):
+            pass
+    if not quiet:
+        for note in report.notes:
+            print(note)
+    for finding in report.findings:
+        print(finding, file=sys.stderr)
+    if report.findings:
+        rule = any(code in LOCKSTEP_CODES for code, _ in report.cleared_by)
+        print(f"\n{len(report.findings)} finding(s)."
+              + (" " + LOCKSTEP if rule else ""), file=sys.stderr)
+        return 1
+    print("pins ok")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("--root", type=Path, default=None,
+                        help="assembly root (default: the enclosing repository)")
+    parser.add_argument("--quiet", action="store_true")
+    parser.add_argument(
+        "--pin-source", action="append", default=[],
+        metavar="[PRODUCT=]PATH",
+        help="a local checkout to recompute a neutral-product pin's digest "
+             "from, instead of `gh api` — e.g. --pin-source openGlass=../"
+             "openGlass. The text before the first `=` is a PRODUCT only when "
+             "it names a pin project.yaml declares, and then that reading "
+             "wins even over a directory spelled like the whole value "
+             "(./PATH reads that directory); any other value is a bare PATH, "
+             "which applies to whichever declared pin has no more specific "
+             "answer (the common case is exactly one). Repeatable; a value no "
+             "pin used is noted, and one that cannot be read is a finding. "
+             "SHAPE_PIN_SOURCE_<PRODUCT> (env) and a checkout sitting beside "
+             "this assembly root are also tried, before `gh api` and before "
+             "this flag's bare form.")
+    args = parser.parse_args(argv)
+
+    report = Report()
+    try:
+        root = find_repo_root(args.root or Path(__file__).resolve().parents[1])
+        _run_all_checks(root, report, args.pin_source)
+    except Refusal as exc:
+        # THE LOCKSTEP REMEDY IS THIS VALIDATOR'S (#370). `repo_shape` gives a
+        # refusal built without a remedy none, because it cannot know whose
+        # it is; here it is the assembly root's, and every refusal this
+        # prints that names no remedy of its own -- its own, and those
+        # `load_yaml`, `git_out` and `find_repo_root` raise for it -- gets
+        # `REMEDIATION`, exactly as it always did. Only that name is
+        # imported, which every `repo_shape.py` a root has ever been given
+        # defines, and one that still defaults to it prints it the same way.
+        print(exc if exc.remediation else f"{exc}\n{REMEDIATION}",
+              file=sys.stderr)
+        return 2
+
+    return _emit_report(report, args.quiet)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/validate-repository-naming.py b/scripts/validate-repository-naming.py
new file mode 100755
index 00000000..fcd5a1c7
--- /dev/null
+++ b/scripts/validate-repository-naming.py
@@ -0,0 +1,1095 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: Apache-2.0
+"""Classify repository names against `contracts/repository-naming.yaml`.
+
+USAGE
+    validate-repository-naming.py NAME [NAME ...]
+    validate-repository-naming.py --project project.yaml
+    printf '%s\\n' openChart MedxChart | validate-repository-naming.py
+    validate-repository-naming.py --explain openxFactory
+    validate-repository-naming.py --explain --role assembly MedxScribe
+    validate-repository-naming.py --pins openChart --explain MedxChart
+    validate-repository-naming.py --pins openXdox \\
+        --referent-chain openXdox,openDox --explain codexDox
+
+A NAME may be given bare (`openChart`) or fully qualified (`opensoft/openChart`);
+only the part after the last `/` is classified, because the organisation login
+is not part of any family.
+
+WHAT `--role` AND `--pins` ARE FOR. A name in `<Domainx><Product>` form is a
+CLAIM of descent, and since the 2026-09-02 ruling a claim needs a REFERENT: it
+classifies as a domain descendant only when the project declares a pin on the
+matching `open<Product>`. `--pins` supplies those declarations for a one-off
+check and `--role` supplies the role the project would declare, so a name can
+be classified here on exactly the facts `project.yaml` would carry. With
+`--project` both are READ from the manifest instead — the legs' roles, and
+`neutral_product_pins:` — which is what the scaffolded project's own gate runs.
+
+`--role` IS ALSO WHAT ASKS WHETHER AN ELECTED FORM CARRIES ITS ROLE. Since
+2026-09-05 a neutral product may ELECT the shape and be its own assembly root,
+so `--explain --role assembly openDox` answers `neutral-product / assembly`
+and names the admission, while `--explain openDox` — nothing declared — answers
+`neutral-product` as it always did. The form is never overridden by the
+declaration; the role is ADDED to it, and the leg form it also satisfies stays
+in `also_matches`.
+
+ONLY A FORM THAT NEEDS A DECLARATION IS A `--role` VALUE. `family` is one,
+because the holder form is declared-only and the characters cannot tell you.
+`workspace` is not, for the same reason `install` and `neutral-product` are
+not: `<user>-wip` is unambiguous by construction, so there is nothing to
+declare and `--role workspace` is refused as the unknown choice it is. A role
+that IS a choice, declared over such a name, is ignored rather than carried —
+`--role assembly brett-wip` answers `workspace`, exactly as it does for
+`<X>-Install`.
+
+WHAT `--referent-chain` AND `--link-source` ARE FOR. Since 2026-09-05 the
+referent may be reached through a CHAIN of neutral-product pins: `codexDox`
+pins `openXdox`, and `openXdox` pins `openDox`. The chain is RECORDED, in the
+descendant's own manifest under `naming.referent_chain:` (which `--project`
+reads); `--referent-chain openXdox,openDox` supplies the same record for a
+one-off check. Every link beyond the first is a declaration in ANOTHER tree,
+and `--link-source [PRODUCT=]PATH` — like `SHAPE_PIN_SOURCE_<PRODUCT>` and a
+checkout sitting beside the project — says where that tree is. A link no
+source answers for is reported as `declared-unverified` and the name STILL
+classifies as a descendant: the check is offline, and a recorded declaration
+is the fact it reads.
+
+A BARE PATH IS THE FIRST LINK'S TREE AND NO OTHER'S (#441). A `--link-source`
+with no `PRODUCT=` is read for the chain's first link, the pin the project
+holds, when nothing more specific answers for it, and never for a later link:
+one tree cannot be two links' declarations, and reading `openXdox`'s
+`project.yaml` again as `openYdox`'s called a chain that holds broken. A later
+link needs its own `PRODUCT=PATH`, its variable or a checkout beside the
+project. While the chains read in one run begin at more than one link, a bare
+PATH is read for none of them. A value that names no path — `PRODUCT=`, or an
+empty one — is refused (#442): an empty path is the current directory, and
+`.` is how to mean that.
+
+A CALLER THAT PASSES A SOURCE FOR SOMEONE ELSE SAYS IT IN ITS OWN WORDS
+(#661). `--link-source-label=FLAG` is the flag the person typed for the bare
+PATH (setup's step (4) passes `--pin-source`): the `link-source-unreadable`
+WARNING and the "not used" NOTE name that value by FLAG, and neither says a
+value holding `=` was read as a PATH. The `link-source-no-path` REFUSED
+line, and the NOTE's advice to name the link (`--link-source <link>=PATH`)
+where the chains begin at more than one link, keep this script's own flag.
+`--link-remedy LINK=TEXT` is what would let LINK's tree be read in that
+caller's sources, offered in place of this script's own for a link that is
+declared-unverified. A project's own runs pass neither. Every `--link-source`
+value and path this prints, and the path of a `SHAPE_PIN_SOURCE_<PRODUCT>`
+or of a checkout beside the project it names, is named as it is, or as
+Python's `repr` spells it where a character in it is not printable
+(`_shown`). A caller's FLAG and the words it offers for a link, a chain
+link's name, and the `--project` and `--policy` paths are printed as given.
+
+EXIT CODES, the same three in every validator this standard ships:
+    0  every name classified (and, with `--project`, every declared role and
+       the topic agreed with the classification)
+    1  a FINDING: at least one name matches no family, or a leg's declared role
+       disagrees with the form of its name, or (#443) `neutral_product_pins:`
+       or a leg's `naming.referent_chain:` is not a list
+    2  a REFUSAL: the question could not be asked at all — the policy file is
+       missing, unparsable, or not a naming policy, or a `--link-source`
+       names no path
+
+A chain link whose tree could not be read prints a WARNING and changes no exit
+code, deliberately: see `--link-source` below. A SOURCE that could not answer
+is a WARNING too, with the system's reason (#338): a `--link-source` given
+here, a `SHAPE_PIN_SOURCE_<PRODUCT>`, or a checkout beside the project that is
+there and still cannot answer. An explicit source stays a warning here, where
+`validate-pins.py` makes its `--pin-source` a finding (#295): the variable
+answers that validator's digest question too, from a checkout that need not
+carry a manifest, and a source that cannot answer is passed over for the next
+one in the order, which may. A `--link-source` no link used is a NOTE saying
+why.
+
+The 1/2 split is deliberate. "This name is wrong" and "I could not read the
+policy" are different facts and a gate that renders them identically invites a
+workflow that treats the second as the first.
+"""
+
+from __future__ import annotations
+
+import argparse
+import inspect
+import os
+import sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+from repo_shape import (  # noqa: E402
+    CHAIN_RECORD_FIELD, LINK_SOURCE_ABSENT, LINK_SOURCE_NO_MANIFEST,
+    UNAMBIGUOUS_FORMS, Classification, NamingPolicy, Refusal,
+    link_pins_from_trees, load_yaml, pin_product_key, repo_basename,
+)
+
+DEFAULT_POLICY = Path(__file__).resolve().parents[1] / "contracts" / "repository-naming.yaml"
+
+
+def _shown(path) -> str:
+    """A path as a line about it names it: as it is, unless a character in
+    it is not printable (`str.isprintable`), and then as Python's `repr`
+    spells it (#610). It is `repo_shape.shown_path`, which spells the
+    manifest in a `link-source-unreadable` reason, so one line holds one
+    spelling. Written here rather than imported: this file is copied into
+    every project and may meet a `scripts/repo_shape.py` older than itself,
+    which has no such name, and the gate would end in an `ImportError` before
+    it classified a name."""
+    text = str(path)
+    return text if text.isprintable() else repr(text)
+
+
+def _library_takes_remedies() -> bool:
+    """Does this root's `scripts/repo_shape.py` take `remedies=`? The
+    skew rule `validate-manifest.py` states (#661): an older library has
+    none, and passing it would end the gate in a `TypeError`."""
+    try:
+        return "remedies" in inspect.signature(
+            link_pins_from_trees).parameters
+    except (TypeError, ValueError):
+        return False
+
+
+def _link_remedy(value: str) -> tuple[str, str]:
+    """One `--link-remedy LINK=TEXT`: the link, by `repo_basename`, and
+    the words. The text before the first `=` is the link; a value with no
+    `=`, no link or no words is refused, exit 2."""
+    link, sep, text = value.partition("=")
+    link = repo_basename(link.strip())
+    if not (sep and link and text.strip()):
+        raise argparse.ArgumentTypeError(
+            f"{_shown(value)} is not LINK=TEXT: name a chain link, then `=`, "
+            "then the words for what would let its tree be read")
+    return link, text
+
+
+class Target:
+    """One name to classify, with everything DECLARED about it.
+
+    `chain` is the recorded `naming.referent_chain:` and `root` is the tree the
+    chain's links are looked for beside, which is why a target is a small
+    object rather than the tuple it used to be: a link is read from another
+    repository's manifest, so the question "where am I standing?" is now part
+    of the question being asked.
+    """
+
+    def __init__(self, name: str, role: str | None, pins: set[str],
+                 chain=(), root: Path | None = None):
+        self.name = name
+        self.role = role
+        self.pins = pins
+        self.chain = tuple(chain)
+        self.root = root
+
+
+class LinkSources:
+    """Every `--link-source` value AS TYPED, read against the chain links this
+    run names, and what each lookup made of it (#338).
+
+    THE READING. `PRODUCT=PATH` and a bare `PATH` are told apart by an `=`,
+    and a path may hold one: a link tree cloned under `a=b/` is
+    `--link-source a=b/openXdox`. Splitting every value at its first `=` made
+    that a source keyed to a link `a` that no chain names, which no lookup
+    ever asked for — the link stayed declared-unverified, exit 0, under a
+    WARNING suggesting the very `--link-source` the person had passed. So the
+    text before the first `=` is a LINK only when it names a link of a
+    referent chain this run reads (`--referent-chain`'s, or a leg's
+    `naming.referent_chain:` under `--project`) by `pin_product_key`, the key
+    the lookup uses, and any other value is a bare PATH, whole. A link's name
+    wins even where a directory is spelled like the whole value: the reading
+    is decided by the chains and never by the disk, and `./` asks for the
+    directory.
+    That is `validate-pins.py`'s reading of `--pin-source` (#295), with a
+    chain link where that file has a declared pin, so the two copied tools
+    read `[PRODUCT=]PATH` one way OVER ASCII ONLY (#444). Outside it they part
+    company: `templates/assembly-root/scripts/validate-pins.py` still keys
+    `--pin-source PRODUCT=` by `casefold()`, in `PinSources.__init__`, which
+    builds the table, and in `resolve_neutral_pin_source`, which looks a pin
+    up in it, so `--pin-source openss=` answers for a declared `openß`
+    where `--link-source openss=` no longer answers for the link `openß`. It
+    is left, and the issue leaves it as its own change, because a pin's digest
+    stops a wrong source from passing: `validate-pins.py` checks it, a wrong
+    source cannot match it, and so that reading can turn a wrong source into
+    a finding and never into a pass. The follow-up is on #459's checklist
+    (the shipped validators and the helpers they share).
+
+    WHAT EACH VALUE CAME TO. Every lookup records what it asked
+    (`link_pins_from_trees(..., tried=)`), so once every name is classified a
+    value is USED (a link that holds a pin read it), UNREAD (asked for one,
+    and it could not answer: a WARNING with the system's reason) or NOT USED
+    (never asked for one: a NOTE saying why). A `SHAPE_PIN_SOURCE_<PRODUCT>`,
+    or a checkout beside the project that is there and cannot answer, is
+    named the same way when such a link needed it. None of these is a
+    finding, and none ends the run: a link whose tree could not be read is a
+    warning in this validator, deliberately, and an explicit source is no
+    exception — the module docstring says why.
+
+    ONE VALUE, ONE LINK (#441). A keyed value is asked for its own link
+    alone. The bare PATH is asked for the FIRST link of a chain a name here
+    reads (`link_pins_from_trees` offers it to no later link), and only
+    while every such chain begins at that one link, so it is never counted
+    as the answer for two. `firsts` are those first links, found before any
+    chain is read (`_first_links_read`). A chain of one link has no holder,
+    reads no declaration, and so adds none.
+
+    A VALUE THAT NAMES NO PATH IS REFUSED (#442). `openXdox=` is
+    `Path("")`, which is `.`: run from a project root it read the project's
+    own manifest as openXdox's, and a chain that holds was broken. That and
+    an empty bare value are in `no_path`, and `no_path_refusal` says so.
+
+    EVERY LINK IS KEYED BY `pin_product_key` (#444), the pin file's own fold,
+    as `repo_shape.py`'s chain readers key it. With `casefold()` here,
+    `openß` and `openss` were one link: `--link-source openss=` answered for
+    `openß`, two values for the pair replaced each other, and two chains
+    beginning at them counted one first link, so a bare PATH was read as both
+    products' trees.
+    """
+
+    def __init__(self, values: list[str], links, firsts=(),
+                 label: str | None = None, remedies=()) -> None:
+        #: The caller's own name for the bare PATH it passes, or None
+        #: (`--link-source-label`, #661).
+        self.label = label
+        #: `{pin_product_key(link): the caller's words}` from
+        #: `--link-remedy`, the last value given for a link wins (#661).
+        self.remedies: dict[str, str] = {
+            pin_product_key(link): text for link, text in remedies}
+        #: Every link of every chain this run reads, in its first spelling.
+        self.links: list[str] = []
+        names: dict[str, str] = {}
+        for link in links:
+            name = repo_basename(str(link))
+            if name and pin_product_key(name) not in names:
+                names[pin_product_key(name)] = name
+                self.links.append(name)
+        #: `{pin_product_key: first spelling}` of the first link of every
+        #: chain a name here reads (#441). `link_pins` adds a chain's first
+        #: link as it reads it, which matters only for names read from stdin:
+        #: they come when no other name does, all with `--referent-chain`.
+        self.firsts: dict[str, str] = {}
+        for link in firsts:
+            name = repo_basename(str(link))
+            self.firsts.setdefault(pin_product_key(name), name)
+        #: `{pin_product_key(link): (typed, path)}`, the last value given
+        #: wins.
+        self.keyed: dict[str, tuple[str, Path]] = {}
+        #: `(typed, path)` of the last bare value, if any.
+        self.bare: tuple[str, Path] | None = None
+        #: Every distinct value in the order given, and the link it was read
+        #: as keyed to, or None for a bare PATH.
+        self.reading: dict[str, str | None] = {}
+        #: `{typed: the later value that took its place}`.
+        self.replaced: dict[str, str] = {}
+        for typed in values:
+            key, sep, path = typed.partition("=")
+            link = names.get(pin_product_key(key)) if sep else None
+            self.reading[typed] = link
+            if link is not None:
+                earlier = self.keyed.get(pin_product_key(link))
+                self.keyed[pin_product_key(link)] = (typed, Path(path))
+            else:
+                earlier = self.bare
+                self.bare = (typed, Path(typed))
+            self.replaced.pop(typed, None)
+            if earlier is not None and earlier[0] != typed:
+                self.replaced[earlier[0]] = typed
+        #: The values that name no path (#442), in the order given: a keyed
+        #: value with nothing after its `=`, and an empty bare one.
+        self.no_path: list[str] = [
+            typed for typed, link in self.reading.items()
+            if not (typed.partition("=")[2] if link is not None else typed)]
+        #: The links some name's lookup asked about, by `pin_product_key`.
+        self.asked: set[str] = set()
+        #: The values a link read: each the answer for one link (#441).
+        self.used: set[str] = set()
+        #: `{typed: (path, how, why, [links])}` for a value asked and never
+        #: answering.
+        self.unread: dict[str, tuple] = {}
+        #: `{(path, how, why): [links]}` for a `SHAPE_PIN_SOURCE_<PRODUCT>`
+        #: or a checkout beside the project that could not answer.
+        self.unanswered: dict[tuple, list[str]] = {}
+
+    def link_pins(self, policy: NamingPolicy, target: Target) -> dict:
+        """What the chain's links declare, for the links whose trees answer,
+        with what each lookup asked recorded against the values given.
+
+        A chain no classification reads asks nothing and says nothing:
+        `policy.classify` consults a link's declaration only for a name that
+        claims a referent, with a chain whose shape holds. A source asked for
+        any other chain (a spec leg's record, a name with no `open<Product>`
+        to reach, a chain that does not begin at a held pin) was reported
+        unreadable, or counted as used, for a question nobody asked."""
+        if not policy.reads_link_declarations(target.name, target.pins,
+                                              target.chain):
+            return {}
+        if len(target.chain) > 1:
+            first = repo_basename(str(target.chain[0]))
+            self.firsts.setdefault(pin_product_key(first), first)
+        tried: dict = {}
+        offered = ({"remedies": self.remedies}
+                   if self.remedies and _library_takes_remedies() else {})
+        found = link_pins_from_trees(
+            target.chain, target.root,
+            {key: path for key, (_typed, path) in self.keyed.items()},
+            self._bare_path(), tried=tried, **offered)
+        # ONLY A LINK THAT HOLDS A PIN COUNTS. The lookup asks for every link,
+        # the last one too, but only a holder's own declaration is ever read
+        # (`_chain_link_findings`): a source asked only for the chain's end
+        # decided nothing, and saying it answered, or failed to, would be a
+        # report about a question nobody asked.
+        holders = {pin_product_key(repo_basename(str(link)))
+                   for link in target.chain[:-1]}
+        for link, asked in tried.items():
+            if pin_product_key(link) not in holders:
+                continue
+            self.asked.add(pin_product_key(link))
+            for rule, how, path, why in asked:
+                self._record(link, rule, how, path, why)
+        return found
+
+    def _bare_path(self) -> Path | None:
+        """The bare PATH for `link_pins_from_trees`, which asks it for a
+        chain's first link alone (#441), or None: none was given, or the
+        chains read here begin at more than one link, and one tree read as
+        two first links' would be the defect over again."""
+        if self.bare is None or len(self.firsts) > 1:
+            return None
+        return self.bare[1]
+
+    def _record(self, link: str, rule: str, how: str, path: Path,
+                why: str | None) -> None:
+        """One source a holder's lookup asked. A value typed here is
+        accounted for whatever the answer; a variable whenever it could not
+        answer; a checkout beside the project only where it is there and
+        still could not answer, since one that is absent, or holds no
+        manifest, is the ordinary case."""
+        if rule in ("keyed", "bare"):
+            typed = (self.keyed[pin_product_key(link)] if rule == "keyed"
+                     else self.bare)[0]
+            if why is None:
+                self.used.add(typed)
+                return
+            if rule == "bare" and self.label:
+                how = self.label
+            links = self.unread.setdefault(typed, (path, how, why, []))[3]
+        elif why is None or (rule == "sibling" and why in (
+                LINK_SOURCE_ABSENT, LINK_SOURCE_NO_MANIFEST)):
+            return
+        else:
+            # A checkout beside the project is named in `how` too (#661).
+            how = how.replace(str(path), _shown(path))
+            links = self.unanswered.setdefault((path, how, why), [])
+        if link not in links:
+            links.append(link)
+
+    def read_as_path(self, typed: str) -> str:
+        """The sentence saying a value holding `=` was read as a bare PATH,
+        or `""` — the only trace in the run of a mistyped link name. Nothing
+        when no chain names a link: the note has already said so."""
+        if self.reading.get(typed) is not None or "=" not in typed \
+                or not self.links or self.label:
+            return ""
+        key = typed.partition("=")[0]
+        what = f"`{_shown(key)}` is not" if key else "nothing before its `=` is"
+        return (f"It was read as a PATH: {what} a link of a referent chain "
+                f"here (links: {', '.join(self.links)}).")
+
+    def _also_a_directory(self, typed: str) -> str:
+        """The line for a value read as `LINK=PATH` that ALSO names an
+        existing directory whole: the keyed reading won, and this is how to
+        ask for the other one. `os.path.isdir`, which is False for every
+        `OSError` on every Python."""
+        if self.reading.get(typed) is None or not os.path.isdir(typed):
+            return ""
+        named = _shown(typed)
+        return (f"`{named}` is also a directory; `--link-source ./{named}` "
+                "reads it as one.")
+
+    def unread_lines(self) -> list[str]:
+        """One `link-source-unreadable` WARNING per source that was asked and
+        could not answer, with the system's reason, in the order given."""
+        lines = []
+        for typed in self.reading:
+            # A value is read as ONE link's keyed source, or is the one bare
+            # PATH, so every lookup that asked it asked the same path and got
+            # the same answer: it is `used` or `unread`, never both.
+            if typed not in self.unread:
+                continue
+            path, how, why, links = self.unread[typed]
+            lines.append(
+                f"link-source-unreadable: {_shown(path)} ({how}) could not "
+                f"answer for {', '.join(links)}: {why}"
+                + "".join(f"\n  {line}" for line in (
+                    self.read_as_path(typed), self._also_a_directory(typed))
+                    if line))
+        for (path, how, why), links in self.unanswered.items():
+            lines.append(f"link-source-unreadable: {_shown(path)} ({how}) "
+                         f"could not answer for {', '.join(links)}: {why}")
+        return lines
+
+    def no_path_refusal(self) -> str:
+        """The `REFUSED` line naming every value that names no path (#442),
+        each by the link it is keyed to, or `""` when there is none."""
+        if not self.no_path:
+            return ""
+        said = [f"`--link-source {_shown(typed)}` names no path for "
+                f"{self.reading[typed]}" if typed
+                else "`--link-source ''` names no path"
+                for typed in self.no_path]
+        return ("REFUSED link-source-no-path: " + "; ".join(said)
+                + ". An empty path would be read as the directory this runs "
+                "in. Give the tree's path (`--link-source <link>=<path>`), "
+                "or `.` to mean this directory.")
+
+    def _not_asked_why(self) -> str:
+        """Why the bare PATH was never asked, where a chain link's own
+        declaration was read: it is a chain's first link's tree alone
+        (#441), and that link had a more specific source, or the chains read
+        here begin at more than one link. Where only first links are read,
+        the sentence is the one it always was."""
+        if len(self.firsts) > 1:
+            return ("a bare PATH is one first link's tree, and the chains "
+                    "read here begin at " + ", ".join(self.firsts.values())
+                    + ": name the link it is, as --link-source <link>=PATH")
+        keyed = "" if self.label else "a keyed --link-source, "
+        sources = (f"a more specific source ({keyed}"
+                   "SHAPE_PIN_SOURCE_<PRODUCT>, or a checkout beside the "
+                   "project)")
+        if self.asked <= set(self.firsts):
+            return f"each link whose own declaration is read had {sources}"
+        return ("a bare PATH is the tree of a chain's first link alone, "
+                f"{', '.join(self.firsts.values())}, which had {sources}")
+
+    def unused_lines(self) -> list[str]:
+        """A NOTE for each value no lookup asked, named as typed, with why:
+        a later value replaced it, no name reads its link's declaration, no
+        name records a chain, none reads a link's declaration, or the one
+        link a bare PATH answers for had a more specific source
+        (`_not_asked_why`). A value holding `=` that was read as a PATH says
+        so too."""
+        lines = []
+        for typed, link in self.reading.items():
+            if typed in self.used or typed in self.unread:
+                continue
+            flag = self._flag(link)
+            later = self.replaced.get(typed)
+            if later is not None:
+                why = f"the later `{flag} {_shown(later)}` replaced it"
+            elif link is not None:
+                why = f"no name classified here reads {link}'s own declaration"
+            elif not self.links:
+                why = "no name classified here records a referent chain"
+            elif not self.asked:
+                why = ("no name classified here reads a chain link's own "
+                       "declaration")
+            else:
+                why = self._not_asked_why()
+            lines.append(" ".join(filter(None, (
+                f"{flag} {_shown(typed)}: not used — {why}.",
+                self.read_as_path(typed)))))
+        return lines
+
+    def _flag(self, link: str | None) -> str:
+        """The flag a value is named by: `--link-source`, or for a bare
+        PATH the caller's label where it gave one (#661)."""
+        return self.label if link is None and self.label else "--link-source"
+
+
+def _no_family_lines(policy: NamingPolicy, name: str) -> list[str]:
+    """The `--explain` lines for a name that matches no family at all.
+
+    Split from `_describe` for #136: what to print when nothing classifies is
+    one question, answered once, so the per-family row below never has to
+    guard against a `found` that does not exist.
+    """
+    lines = [f"  {name}: NO FAMILY"]
+    lines.append(f"    the {len(policy.families)} families are: " + ", ".join(
+        f["id"] for f in policy.families))
+    for family in policy.families:
+        lines.append(f"    {family['id']:<18} {family['pattern']}")
+    return lines
+
+
+def _admission_note(family: dict, role: str | None, carried: str | None) -> str:
+    """The `[ADMITS ...]` note for a family whose data admits a declared role.
+
+    Split from `_describe` for #136: THREE ANSWERS, not two — nothing
+    declared, a role declared and ADMITTED, or a role declared and REFUSED
+    (`--role spec openDox` declares a role this family does not admit).
+    Collapsing the last two into "none is declared here" told the reader a
+    declaration was absent when it was in fact refused (2026-09-05); giving
+    the three answers their own function is what keeps them three.
+    """
+    admits = ", ".join(str(r) for r in family["admits_declared_role"])
+    if role is None:
+        admission = "; none is declared here"
+    elif carried:
+        admission = f" — this name carries {carried}"
+    else:
+        admission = f"; {role} is declared here and is not admitted"
+    return (f" [ADMITS a declared role of {admits}: the form still "
+            "wins and carries the role the project declares, where "
+            "the name also satisfies that leg form"
+            + admission
+            + "]")
+
+
+def _referent_claim_note(policy: NamingPolicy, family: dict, name: str) -> str:
+    """The `[a CLAIM: ...]` note for a family that `requires_referent`.
+
+    Split from `_family_claim_and_role_note` for #136: WHAT WOULD BE
+    ACCEPTED, both halves of it. Naming only the direct pin is what sent
+    `codexDox` looking for an `openDox` pin its family does not hold
+    (2026-09-05).
+    """
+    return (" [a CLAIM: needs a declared pin on " + " or ".join(
+        policy.descendant_referents(name))
+        + ", or a declared chain (`"
+        + str(policy.chain_rule().get("record_field")
+              or CHAIN_RECORD_FIELD)
+        + "`) of pins ending in one of them]")
+
+
+def _declared_only_note(family: dict) -> str:
+    """The `[DECLARED-ONLY: ...]` note for a family only reported by name.
+
+    Split from `_family_claim_and_role_note` for #136.
+    """
+    return (" [DECLARED-ONLY: reported only with --role "
+             + family["id"] + "; " + str(family.get("declared_by") or
+                                         "a declaration").strip() + "]")
+
+
+def _unambiguous_note() -> str:
+    """The `[UNAMBIGUOUS BY CONSTRUCTION: ...]` note.
+
+    Split from `_family_claim_and_role_note` for #136: WHY THIS ROW NEEDED
+    NOTHING. The other three notes are each a reason a reader might have to
+    declare something; this is the answer for `<X>-Install` and
+    `<user>-wip` — nothing to declare, and admitted into no role either.
+    `neutral-product` is unambiguous too and answered by `_admission_note`
+    instead, because it has the further thing to say about the role it
+    admits.
+    """
+    return (" [UNAMBIGUOUS BY CONSTRUCTION: nothing else spells this "
+             "form, so it needs nothing declared — no --role and no "
+             "pin — and it is admitted into no role either]")
+
+
+def _admission_row(role_note: str, family: dict, role: str | None,
+                   found: Classification) -> tuple[str, str]:
+    """`(role_note, claim)` for a family whose data admits a declared role.
+
+    Split from `_family_claim_and_role_note` for #136: NAME THE ADMISSION,
+    not just its effect — a reader who sees `openDox: neutral-product /
+    assembly` and no explanation has to go and read the classifier to learn
+    that the form still won and the role was ADDED to it (2026-09-05).
+    `role_note` is the plain note the caller already computed, kept
+    as-is unless this name CARRIES the admitted role.
+    """
+    carried = (found.role if found.family == family["id"]
+               and found.role else None)
+    claim = _admission_note(family, role, carried)
+    if carried:
+        role_note = f" (role {carried}, ADMITTED)"
+    return role_note, claim
+
+
+def _family_claim_and_role_note(policy: NamingPolicy, family: dict, hits: list,
+                                role: str | None, name: str,
+                                found: Classification) -> tuple[str, str]:
+    """The `(role_note, claim)` suffixes for one family's `--explain` row.
+
+    Split from `_describe` for #136: what a family's row says about what
+    claiming it would need is one question with four mutually exclusive
+    answers, each now its own named note, asked once per family instead of
+    inline in the row loop.
+    """
+    role_note = f" (role {hits[0][1]})" if hits and hits[0][1] else ""
+    claim = ""
+    if hits and policy.requires_referent(family["id"]):
+        claim = _referent_claim_note(policy, family, name)
+    elif policy.declared_only(family["id"]):
+        claim = _declared_only_note(family)
+    elif hits and family.get("admits_declared_role"):
+        role_note, claim = _admission_row(role_note, family, role, found)
+    elif hits and family["id"] in UNAMBIGUOUS_FORMS:
+        claim = _unambiguous_note()
+    return role_note, claim
+
+
+def _family_row(policy: NamingPolicy, family: dict, matches: list,
+                role: str | None, name: str, found: Classification) -> str:
+    """The one `--explain` line for a single family, MATCH or not.
+
+    Split from `_describe` for #136: composing one family's row — whether it
+    matched, and what it would need declared — is one question, asked once
+    per family instead of inline in the name's own loop.
+    """
+    hits = [m for m in matches if m[0] == family["id"]]
+    mark = "MATCH " if hits else "      "
+    role_note, claim = _family_claim_and_role_note(
+        policy, family, hits, role, name, found)
+    return f"    {mark}{family['id']:<18} {family['pattern']}{role_note}{claim}"
+
+
+def _referent_lines(target: Target, matches: list,
+                    found: Classification) -> list[str]:
+    """The CHAIN / WARNING / OVERLAP lines after a name's family rows.
+
+    Split from `_describe` for #136: what to say about the referent, and
+    about an overlap, are two more questions asked once per name after every
+    row has already been printed, not per family.
+    """
+    lines: list[str] = []
+    if target.chain:
+        lines.append("    CHAIN " + " → ".join(target.chain)
+                     + f"   [{found.referent.status}]")
+    for warning in found.referent.warnings:
+        lines.append("    WARNING " + warning)
+    if len(matches) > 1:
+        lines.append("    OVERLAP " + found.reason)
+        lines.append("    also_matches: " + ", ".join(found.also_matches))
+    return lines
+
+
+def _describe(policy: NamingPolicy, target: Target, link_pins: dict) -> list[str]:
+    """Every family `target.name` satisfies, why one of them won, and what
+    the others are recorded as — the full `--explain` report for one name.
+
+    Split into `_family_row` (one family's line) and `_referent_lines` (the
+    CHAIN/WARNING/OVERLAP trailer) for #136: this function now only decides
+    WHICH lines to assemble, not how each one reads.
+    """
+    name, role, pins = target.name, target.role, target.pins
+    matches = policy.matches(name, role)
+    if not matches:
+        return _no_family_lines(policy, name)
+    found = policy.classify(name, role, pins, target.chain, link_pins)
+    lines = [f"  {name}: {found[0]}" + (f" / {found[1]}" if found[1] else "")]
+    for family in policy.families:
+        lines.append(_family_row(policy, family, matches, role, name, found))
+    lines.extend(_referent_lines(target, matches, found))
+    return lines
+
+
+def _pins_from_project(data: dict) -> set[str]:
+    """The neutral products the manifest DECLARES a pin on.
+
+    `neutral_product_pins:` and nothing else. A leg's
+    `naming.referent_declared:` is a RECORD of a declaration, checked by
+    `validate-manifest.py` against this list; reading it as a declaration here
+    would let a claim vouch for itself.
+
+    A VALUE THAT IS NOT A LIST DECLARES NOTHING (#443), and
+    `_pins_field_findings` says so. Iterated as it stood, `5`, `true` or `1.5`
+    ended this gate, the first command of `make validate`, in a `TypeError`;
+    a scalar `openXdox` was read as the pins `X`, `d`, `e`, `n`, `o`, `p`,
+    `x`, and a mapping as its keys, and the names classified, exit 0.
+    """
+    declared = data.get("neutral_product_pins")
+    if not isinstance(declared, list):
+        return set()
+    return {str(pin) for pin in declared if pin}
+
+
+def _pins_field_findings(data: dict) -> list[str]:
+    """`validate-manifest.py`'s finding for a `neutral_product_pins:` that is
+    not a list, in its words (#443), so the first command of `make validate`
+    names the field where it used to end in a traceback, and every validator
+    that reads the field says the same sentence. Absent or null declares no
+    pin and is no finding; anything else that is not a list is one, `0`,
+    `false` and `''` included, as that validator says."""
+    declared = data.get("neutral_product_pins")
+    if declared is None or isinstance(declared, list):
+        return []
+    return [f"manifest-neutral-product-pins: neutral_product_pins is "
+            f"{declared!r}, expected a list of neutral product names"]
+
+
+def _chain_from_leg(leg: dict) -> tuple:
+    """The pin chain a leg's `naming:` block RECORDS, if it records one.
+
+    Read from the manifest and nowhere else: the chain is a declaration, and
+    inferring one from the pins would be the classifier writing the record it
+    then checks.
+
+    `validate-manifest.py`'s `_recorded_chain`, rule for rule (#443): a
+    string is a one-link chain, and anything else that is not a list records
+    no chain, which `_chain_field_findings` reports. This copy had the string
+    rule and not the list rule, so `5`, `true` or `1.5` ended the gate in a
+    `TypeError` and a mapping was read as a chain of its keys.
+    """
+    naming = leg.get("naming")
+    if not isinstance(naming, dict):
+        return ()
+    recorded = naming.get(CHAIN_RECORD_FIELD)
+    if isinstance(recorded, str):
+        recorded = [recorded]
+    if not isinstance(recorded, list):
+        return ()
+    return tuple(str(link) for link in recorded if str(link).strip())
+
+
+def _chain_field_findings(leg: dict) -> list[str]:
+    """`validate-manifest.py`'s finding for a leg's `naming.referent_chain:`
+    that is neither a string nor a list, in its words (#443): the leg named
+    by its declared `role:`, as that validator names it. Absent or null
+    records no chain, and a string is one link, so neither is a finding."""
+    naming = leg.get("naming")
+    if not isinstance(naming, dict):
+        return []
+    recorded = naming.get(CHAIN_RECORD_FIELD)
+    if recorded is None or isinstance(recorded, (str, list)):
+        return []
+    return [f"naming-referent-chain: leg {leg.get('role')!r}: "
+            f"{CHAIN_RECORD_FIELD} is {recorded!r}, expected a list of "
+            "neutral-product names"]
+
+
+def _leg_target(policy: NamingPolicy, path: Path, leg, root: Path,
+                pins: set, sources: LinkSources
+                ) -> tuple[Target | None, list[str]]:
+    """One leg's `Target` and what is wrong with it, from its manifest entry.
+
+    Split from `_targets_from_project` for #136: what one leg's own entry
+    says is a question asked once per leg, not folded into the loop that
+    walks every leg in the manifest. `(None, [finding])` is a leg with no
+    `repository:` to classify at all — the same case the loop's own `finding`
+    list has always carried, now returned instead of appended in place.
+    """
+    if not isinstance(leg, dict) or "repository" not in leg:
+        return None, [f"{path}: a leg has no `repository:`"]
+    name = repo_basename(str(leg["repository"]))
+    declared = leg.get("role")
+    declared = str(declared) if declared else None
+    target = Target(name, declared, pins, _chain_from_leg(leg), root)
+    found = policy.classify(name, declared, pins, target.chain,
+                            sources.link_pins(policy, target))
+    # A chain record that is not a list is said FIRST, where
+    # `validate-manifest.py` says it first, and the leg is classified as one
+    # that records no chain (#443).
+    findings: list[str] = _chain_field_findings(leg)
+    # `declared_role` only wins where the NAME satisfies it, so a role that
+    # disagrees with its own name still lands here rather than being made
+    # true by declaring it.
+    if found and found[0] == "project-leg" and declared and found[1] != declared:
+        findings.append(
+            f"{name}: declared role {declared!r} but the name is the "
+            f"{found[1]!r} form of the project-leg family"
+        )
+    # A RECORDED chain that does not hold is drift in the record, and the
+    # finding names the link. Unverified is not this: it is a warning,
+    # printed by the caller, and never an exit code.
+    if found and found.referent.status == "broken":
+        findings.append(f"{name}: {found.referent.reason}")
+    return target, findings
+
+
+def _topic_finding(policy: NamingPolicy, project_id, topic) -> str | None:
+    """The one finding a manifest's `topic:` disagreeing with its `id:` needs.
+
+    Split from `_targets_from_project` for #136.
+    """
+    if project_id is None:
+        return None
+    expected = policy.topic_for(str(project_id))
+    if topic is not None and topic != expected:
+        return f"topic {topic!r} != {expected!r} derived from id {project_id!r}"
+    return None
+
+
+def _project_manifest(path: Path) -> dict:
+    """The `project.yaml` mapping `--project` names, or a `Refusal`."""
+    data = load_yaml(path)
+    if not isinstance(data, dict):
+        raise Refusal("manifest-unreadable", f"{path}: not a mapping")
+    return data
+
+
+def _project_leg_chains(data: dict) -> list[tuple[str, tuple]]:
+    """`(name, the chain it records)` for each leg `_leg_target` makes a
+    target of, and no other."""
+    return [(repo_basename(str(leg["repository"])), _chain_from_leg(leg))
+            for leg in data.get("legs") or []
+            if isinstance(leg, dict) and "repository" in leg]
+
+
+def _project_chain_links(data: dict) -> list[str]:
+    """Every link every leg's `naming.referent_chain:` records.
+
+    Read BEFORE any leg is classified, because whether `openXdox=../x` is a
+    source keyed to a link or a bare path depends on the links the chains
+    name (#338), and the first leg is classified with the sources already
+    read. The same legs `_leg_target` makes targets of, and no others.
+    """
+    return [link for _name, chain in _project_leg_chains(data)
+            for link in chain]
+
+
+def _first_links_read(policy: NamingPolicy, targets: list,
+                      data: dict | None) -> list[str]:
+    """The first link of every chain a name here READS, found before any is
+    read (#441): a bare `--link-source` is that link's tree, and only while
+    the chains begin at one link. A chain of one link has no holder, reads
+    no declaration, and so has no first link to count. The names on the
+    command line and the legs `_leg_target` makes targets of; names on stdin
+    come only when there are neither, all with `--referent-chain`, so they
+    cannot add a second."""
+    readers = [(target.name, target.pins, target.chain) for target in targets]
+    if data is not None:
+        pins = _pins_from_project(data)
+        readers.extend((name, pins, chain)
+                       for name, chain in _project_leg_chains(data))
+    return [chain[0] for name, pins, chain in readers
+            if len(chain) > 1
+            and policy.reads_link_declarations(name, pins, chain)]
+
+
+def _targets_from_project(policy: NamingPolicy, path: Path, data: dict,
+                          sources: LinkSources) -> tuple[list, list[str]]:
+    """Return ([Target], findings) for a `project.yaml` manifest."""
+    pins = _pins_from_project(data)
+    root = path.resolve().parent
+    targets: list[Target] = []
+    # Pins that are not a list are said before any leg's finding, and every
+    # leg is classified as declaring none (#443).
+    findings: list[str] = _pins_field_findings(data)
+    for leg in data.get("legs") or []:
+        target, leg_findings = _leg_target(policy, path, leg, root, pins,
+                                           sources)
+        if target is not None:
+            targets.append(target)
+        findings.extend(leg_findings)
+    topic_finding = _topic_finding(policy, data.get("id"), data.get("topic"))
+    if topic_finding is not None:
+        findings.append(topic_finding)
+    return targets, findings
+
+
+def _targets_from_stdin(role: str | None, pins: set, chain: tuple,
+                        here: Path) -> list[Target]:
+    """The targets read from stdin, one per non-blank line.
+
+    Split from `main` for #136: reading the stdin fallback is its own
+    question, asked only once `main` has decided no other source answered.
+    """
+    return [Target(repo_basename(line.strip()), role, pins, chain, here)
+            for line in sys.stdin if line.strip()]
+
+
+def _print_classification(name: str, found: Classification | None) -> None:
+    """The one plain-listing line `main` prints for a name, un-`--explain`d.
+
+    Split from `main` for #136: composing this line is a single question —
+    what to call the name, and what else it also matched — asked once per
+    name instead of inline in the classify loop.
+    """
+    # An independent statement rather than a ternary nested inside a
+    # ternary (python:S3358): the family/role suffix is decided on
+    # its own before it is appended to the label.
+    if not found:
+        label = "NO FAMILY"
+    else:
+        role_suffix = f"/{found[1]}" if found[1] else ""
+        label = found[0] + role_suffix
+    also = f"   also_matches {','.join(found.also_matches)}" \
+        if found and found.also_matches else ""
+    print(f"  {name:<32} {label}{also}")
+
+
+def _classify_targets(policy: NamingPolicy, targets: list, args,
+                      sources: LinkSources) -> tuple[list[str], list[str]]:
+    """Classify every target, printing as `args` asks; return `(unclassified
+    names, warnings)`.
+
+    Split from `main` for #136: walking every target and deciding what to
+    print for EACH is one question; what to do with the totals afterwards
+    (the exit code, the FINDING/WARNING lines) stays `main`'s, unchanged.
+    """
+    unclassified: list[str] = []
+    warnings: list[str] = []
+    for target in targets:
+        name = target.name
+        link_pins = sources.link_pins(policy, target)
+        found = policy.classify(name, target.role, target.pins, target.chain,
+                                link_pins)
+        if args.explain:
+            print("\n".join(_describe(policy, target, link_pins)))
+        elif not args.quiet:
+            _print_classification(name, found)
+        if found:
+            warnings.extend(f"{name}: {text}"
+                            for text in found.referent.warnings)
+        else:
+            unclassified.append(name)
+    return unclassified, warnings
+
+
+def _emit_reports(args, unclassified: list[str], warnings: list[str],
+                  findings: list[str], sources: LinkSources) -> int:
+    """Print the WARNING/NOTE/FINDING lines owed once, and return the exit
+    code.
+
+    Split from `main` for #136: what to print once classification is
+    finished, and what code to exit with, is one question asked once at the
+    end, not interleaved with the loop that classifies.
+
+    What became of each `--link-source` (#338) is said here too, after every
+    name's own WARNINGs and before the FINDINGs, under `--explain` as well:
+    it is about the run's sources, not one name's, so no name's `--explain`
+    block carries it. `--quiet` drops it with the WARNINGs.
+    """
+    # A WARNING IS NOT A FINDING. An unread link tree is the ordinary case in
+    # a fork-and-run checkout, and an exit code that punished it would make the
+    # answer depend on which repositories happen to be on the disk.
+    for warning in warnings:
+        if not args.quiet and not args.explain:
+            print(f"WARNING {warning}", file=sys.stderr)
+    if not args.quiet:
+        for line in sources.unread_lines():
+            print(f"WARNING {line}", file=sys.stderr)
+        for line in sources.unused_lines():
+            print(f"NOTE {line}", file=sys.stderr)
+    for finding in findings:
+        print(f"FINDING {finding}", file=sys.stderr)
+    if unclassified:
+        print(
+            "FINDING naming-unclassified: "
+            + ", ".join(unclassified)
+            + "\n  These names match none of the families in "
+            + str(args.policy)
+            + ".\n  A project's three repositories are `<Project>`, "
+            "`<Project>-spec` and `<Project>-code`; `<Project>` is one "
+            "CamelCase token with no hyphen, underscore, dot or space.",
+            file=sys.stderr,
+        )
+    return 1 if (unclassified or findings) else 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    parser.add_argument("names", nargs="*", help="repository names to classify")
+    parser.add_argument("--policy", type=Path, default=DEFAULT_POLICY)
+    parser.add_argument("--project", type=Path, default=None,
+                        help="read the leg names, their roles and the declared "
+                             "neutral-product pins from a project.yaml manifest")
+    parser.add_argument("--role", default=None,
+                        choices=("assembly", "spec", "code", "family"),
+                        help="the role the NAMES on the command line are "
+                             "offered as; a descendant-form name with no "
+                             "referent pin is classified by this, and "
+                             "`family` is what asks whether a name is a valid "
+                             "HOLDER — a form spelled exactly like an assembly "
+                             "root, so it is reported only when declared")
+    parser.add_argument("--pins", default="",
+                        help="comma-separated neutral products the project "
+                             "declares a pin on, e.g. --pins openChart. A "
+                             "`<Domainx><Product>` name is a domain descendant "
+                             "only when its `open<Product>` is in this list.")
+    parser.add_argument("--referent-chain", default="",
+                        help="the pin chain the project RECORDS as reaching "
+                             "its referent, e.g. --referent-chain "
+                             "openXdox,openDox. The first entry must be in "
+                             "--pins and the last must be the name's "
+                             "`open<Product>`; with --project it is read from "
+                             "each leg's `naming.referent_chain:` instead.")
+    parser.add_argument("--link-source", action="append", default=[],
+                        metavar="[PRODUCT=]PATH",
+                        help="where a chain LINK's own tree is, so its "
+                             "`neutral_product_pins:` can be read and the "
+                             "link VERIFIED — e.g. --link-source "
+                             "openXdox=../openXdox. The text before the "
+                             "first `=` is a PRODUCT only when it names a "
+                             "chain link (an entry of --referent-chain, or "
+                             "of a leg's naming.referent_chain: under "
+                             "--project), and then that reading wins even "
+                             "over a directory spelled like the whole value "
+                             "(./PATH reads that directory); any other value "
+                             "is a bare PATH: the tree of the chain's FIRST "
+                             "link (the pin the project holds), read when "
+                             "that link has no more specific answer, and "
+                             "never a later link's, which needs its own "
+                             "PRODUCT=PATH, its SHAPE_PIN_SOURCE_<PRODUCT> "
+                             "or a checkout beside the project. When the "
+                             "chains read here begin at two different "
+                             "links, a bare PATH is read for neither. A "
+                             "value that names no path (PRODUCT=, or "
+                             "empty) is refused. Repeatable; a value no "
+                             "link used is noted. Every link is tried "
+                             "against PRODUCT=PATH, SHAPE_PIN_SOURCE_"
+                             "<PRODUCT> and a checkout beside the project, "
+                             "in that order, and a bare PATH last, for the "
+                             "first link alone. A link no "
+                             "source answers for is declared-unverified, and "
+                             "a source that cannot be read is named with the "
+                             "system's reason: both are warnings and not "
+                             "findings, an explicit source included.")
+    parser.add_argument("--link-source-label", default=None,
+                        metavar="FLAG",
+                        help="the caller's own name for the bare "
+                             "--link-source it passes, such as --pin-source "
+                             "(a FLAG that starts with - is given after an "
+                             "=): the link-source-unreadable WARNING and the "
+                             "not-used NOTE name that value by FLAG, and "
+                             "neither says a value holding = was read as a "
+                             "PATH")
+    parser.add_argument("--link-remedy", action="append", default=[],
+                        type=_link_remedy, metavar="LINK=TEXT",
+                        help="the caller's words for what would let LINK's "
+                             "tree be read, offered in place of this "
+                             "script's own where that link is "
+                             "declared-unverified. Repeatable; the last "
+                             "value for a link wins.")
+    parser.add_argument("--explain", action="store_true",
+                        help="print every family each name satisfies, why one "
+                             "of them won, and what the others are recorded as")
+    parser.add_argument("--quiet", action="store_true")
+    args = parser.parse_args(argv)
+
+    try:
+        policy = NamingPolicy.load(args.policy)
+    except Refusal as exc:
+        print(str(exc), file=sys.stderr)
+        return 2
+
+    cli_pins = {p.strip() for p in args.pins.split(",") if p.strip()}
+    cli_chain = tuple(c.strip() for c in args.referent_chain.split(",")
+                      if c.strip())
+    here = Path.cwd()
+    targets: list[Target] = [
+        Target(repo_basename(n), args.role, cli_pins, cli_chain, here)
+        for n in args.names]
+    findings: list[str] = []
+    data = None
+    if args.project is not None:
+        try:
+            data = _project_manifest(args.project)
+        except Refusal as exc:
+            print(str(exc), file=sys.stderr)
+            return 2
+    # The `--link-source` values are READ here, once every chain this run
+    # reads is known and before any name is classified (#338, #441).
+    sources = LinkSources(args.link_source, [
+        *cli_chain, *(_project_chain_links(data) if data is not None
+                      else ())], _first_links_read(policy, targets, data),
+        args.link_source_label, args.link_remedy)
+    if sources.no_path:
+        print(sources.no_path_refusal(), file=sys.stderr)
+        return 2
+    if data is not None:
+        extra, findings = _targets_from_project(policy, args.project, data,
+                                                sources)
+        targets.extend(extra)
+    if not targets and not sys.stdin.isatty():
+        targets = _targets_from_stdin(args.role, cli_pins, cli_chain, here)
+    if not targets:
+        print("REFUSED naming-no-target: no names given. Pass names, "
+              "`--project project.yaml`, or names on stdin.", file=sys.stderr)
+        return 2
+
+    unclassified, warnings = _classify_targets(policy, targets, args, sources)
+    return _emit_reports(args, unclassified, warnings, findings, sources)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/shape/.gitattributes b/shape/.gitattributes
new file mode 100644
index 00000000..aeaa603c
--- /dev/null
+++ b/shape/.gitattributes
@@ -0,0 +1,25 @@
+# THE BYTES A CLONE SEES ARE THE BYTES THE PIN DESCRIBES.
+#
+# `contracts/shape-pin.yaml` records a sha256 of every copied shape file, and
+# `scripts/validate-pins.py` recomputes each one from the bytes on disk. Git
+# for Windows' installer default is `core.autocrlf=true`, so a clone there
+# writes CRLF into the worktree; the digest of CRLF bytes is not the digest of
+# the LF bytes the pin records, and `make validate` then goes red on EVERY
+# pinned file for a colleague who did nothing but clone the repository.
+#
+# That is fixed here rather than on each machine because the repository is
+# what knows: `* text=auto eol=lf` normalises text to LF in the object store
+# on check-in and checks it out as LF on every platform, whatever
+# `core.autocrlf` is set to. Nobody has to be told a git setting before
+# cloning, and nobody who was never told is punished for it.
+#
+# NO PATH IS LISTED BY NAME, and that is a decision rather than an omission. A
+# file git's heuristic read as binary would not be normalised, so a pinned
+# file it misjudged would need `text eol=lf` spelled out for it. Every pinned
+# file is text — YAML, Python, Markdown, a Makefile, a workflow — so there is
+# nothing for the heuristic to get wrong, and `text=auto` leaves binary
+# detection where it belongs: with git, for the files this project adds later.
+#
+# openRepoShape #51, ruled by Brett Heap on 2026-09-05.
+
+* text=auto eol=lf
diff --git a/shape/.gitignore b/shape/.gitignore
new file mode 100644
index 00000000..eedaeaff
--- /dev/null
+++ b/shape/.gitignore
@@ -0,0 +1,4 @@
+__pycache__/
+*.py[cod]
+.venv/
+.DS_Store
diff --git a/skills/handoff/SKILL.md b/skills/handoff/SKILL.md
deleted file mode 100644
index aba1d6d9..00000000
--- a/skills/handoff/SKILL.md
+++ /dev/null
@@ -1,953 +0,0 @@
----
-name: handoff
-description: "/handoff (aliases /swap, /lane-swap; /ctx is /handoff --restart) hands this lane off — for a context clear, a usage reset, a profile switch, or a handoff another place requested. It fixes the identity triple, refreshes the handoff with a fresh Rule 3 top block listing every running writer, polls the writers, writes the PAUSED record with the window, the lane's directory, the profile, the agent and its transcript, and prints the one restart command (lane-collision-protocol Amendment 8(a), amended by Amendments 11, 17 and 18(d))."
----
-
-<!-- PROMPTS TO THE PERSON: 1 — step 3, and only when a writer still holds
-     unpushed work and has not replied. It was 3 before A8 Addendum 2 (R-A8-7):
-     the identity fix, the row's leading state word and the restart command are
-     all DERIVED here now, and step 5 prints one command, never a menu. If a
-     step below cannot derive something, it stops and says so — it does not ask. -->
-
-# `/handoff` — hand this lane off (the swap, the context clear, the handoff)
-
-Lane-collision-protocol **Amendment 8(a) as Amendment 17(a) names it**: *"the act Amendment 8(a) calls the
-swap is the HANDOFF"*. One act, three names — `/handoff` here, `/swap` and `/lane-swap` as its aliases, and
-`lane-handoff` on `PATH` for the same steps from a shell. What differs between a context clear, a usage
-reset, a profile switch and handing the lane to someone else is only WHY, and the record's free text has
-always carried that.
-
-**For `/ctx` or `--restart`, use this bounded legacy path instead of the ordinary
-preservation sequence below.** Resolve the lane read-only, then run
-`lanes-edit.sh legacy-restart-check <lane>` before renaming anything, updating a
-handoff, messaging writers or writing lane state. Refuse managed ownership and
-unreadable ownership; feature 001 owns those lanes. Collect the running writers'
-worktree/branch/brief facts into a temporary TSV (`<worktree><TAB><brief>`) without
-editing the canonical handoff. After the ownership check, ask those writers to
-commit and push as this skill normally requires. Invoke `lane-handoff --restart
---lane <lane> --writers-file <temporary TSV> clear` once. Follow its refusal or
-supervisor output; do not execute steps 1–5 as independent canonical writes, and
-do not run a second tmux respawn recipe. The backend reserves `preparing` before
-all preservation writes and completes that reservation as `pending` before respawn.
-
-This compatibility path owns `restart-intent.yaml` only. It does not use PR #97's
-lifecycle snapshot as a state or counter authority, and does not mutate the managed
-JSON ledger. A failed restart recovers through the same-operation supervisor;
-ordinary lane resume refuses it. A live or unknown child leaves `starting` and
-blocks retry even if the supervisor was terminated.
-
-**The other flags run the ordinary steps 1–5 below.** Their ends differ as follows:
-
-| | what it adds after the record | when |
-|---|---|---|
-| `/handoff [why]` | nothing — the restart line is printed and the person types it | a swap, a reset, a switch |
-| `/ctx`, `/handoff --restart` | the lane's own pane is respawned through the launcher, the new session's first prompt being this handoff's top block (Amendment 17(f)) | a context clear: *"the one word is the whole act"* |
-| `/handoff --exit [requested by …]` | `/exit` is typed into this lane's own pane, because a handoff to ANOTHER PLACE is a handoff and not a restart (Amendment 18(d)) | the bound session answering another place's `HANDOFF-REQUESTED` |
-| `lane-handoff --late --at <UTC>` | nothing — it writes the record a swap NEVER LEFT, from a shell, BEFORE the relaunch | a session that died at a usage limit with no swap |
-
-**A `/ctx` WHOSE RECORD COULD NOT BE WRITTEN REFUSES BEFORE IT KILLS ANYTHING** (Amendment 17(f)): a pane is
-never respawned over an unrecorded lane, and a session is never ended without one.
-
-Run every step, in order, before telling the operator it is safe to reset usage or switch profiles. `$L`
-below is `lanes-edit.sh` on `PATH` — `openRepoTools --install` puts it there — else the symlink Amendment 5
-left in place, which is how `/restart` finds it; every command is copy-pasteable as written once `lane` is
-derived in step 1. **From a shell, `lane-handoff` is these same steps as one command** — it is the same act
-and writes the same record; a session runs the steps here because a session can message its subagents and a
-shell cannot.
-
-```sh
-L="$(command -v lanes-edit.sh || printf '%s' ~/projects/xFactory/lanes-edit.sh)"
-
-# EVERY READ IN STEP 1 GOES THROUGH THIS ONE FENCE, and Amendment 7(d) is the
-# whole of it: `0` an answer · `8` NO ANSWER · `2` a helper predating the read —
-# both of those fall to the next rung, save the one `2` that is a REFUSAL (the
-# last paragraph below) — and ANYTHING ELSE is a read that FAILED, which is
-# neither of them (#26, the review of `c3ebcfe`, this file's `:28` and `:72`).
-# All three of step 1's reads collapsed every code into the ordinary case, and
-# what is beneath them is not a refusal: it is THE NEXT RUNG, and the last rung
-# is the workstation's NEWEST SWAP — a different lane. A register that could
-# not be read is not "this window is not a lane", and step 4 would then write a
-# PAUSED record, a stamp and a restart command for a lane this window is not.
-#
-# IT IS `/restart`'s `lread` WITH TWO DIFFERENCES, STATED RATHER THAN LEFT TO
-# BE FOUND. Step 4's `dir` read does NOT come through here, because this fence
-# STOPS and that read may not — `R-A11-11`, *a swap is never left unwritten*.
-# It drops the sub-field and names the read instead, where it stands. And an
-# exit 2 carrying Amendment 15(d)'s words is a REFUSAL here (the last paragraph
-# below), where `lread` still reads every 2 as no answer.
-#
-# IT SETS A VARIABLE RATHER THAN PRINTING ITS ANSWER, and that is load-bearing:
-# a refusal inside `$( )` kills only the substitution's subshell and the skill
-# would carry on with an empty answer.
-#
-# AND `2` IS TWO ANSWERS (#72 item 8; `lane-handoff`'s own fence took it in
-# Copilot round 2 on openRepoTools#47, and this is that fence's rule). It is
-# what a helper predating a subcommand spends on an unknown one — the rung this
-# fence falls through for — and it is ALSO `canon_lane`'s refusal of a register
-# holding two rows that differ only by case (Amendment 15(d)), which every read
-# that takes a lane name now carries. Falling through THAT is binding this
-# window to whichever lane the next rung happens to answer with, and then
-# renaming the window and writing a PAUSED record and a restart command for it.
-# So the refusal is asked for BY ITS OWN WORDS — no old helper emits them from
-# an unknown subcommand, which is how `lane-handoff`, `lane-start`, `lane-end`
-# and `lane` tell the two apart — and relayed, with the fall-through for a
-# genuinely old helper left as it was. The words come from asking the same read
-# a second time with only its stderr kept, as `lane-handoff` does: the first
-# answer's stderr is discarded, and asking a read twice changes nothing.
-sread() {                      # sread <var> "<what the failure is NOT>" <verb> [args…]
-  sr_var="$1"; sr_not="$2"; shift 2
-  sr_out=""; sr_rc=0
-  sr_out="$(LANES_NO_FETCH=1 "$L" "$@" 2>/dev/null)" || sr_rc=$?
-  case "$sr_rc" in
-    0)   : ;;
-    2)   sr_why="$(LANES_NO_FETCH=1 "$L" "$@" 2>&1 >/dev/null || :)"
-         case "$sr_why" in
-           *"Amendment 15(d)"*)
-             printf 'REFUSED: `%s %s` says the register holds two rows for this lane that differ only by case, so no read of it is unambiguous and this skill will not pick one (Amendment 15(d)). It will not bind a lane, rename the window, write a PAUSED record or print a restart command; merge the two rows by hand first. The helper said:\n%s\n' \
-               "$L" "$1" "$sr_why" >&2
-             exit 2 ;;
-         esac
-         sr_out="" ;;
-    8)   sr_out="" ;;
-    *)   printf 'REFUSED: `%s %s` failed (exit %s). That is NOT %s — a read that failed is never an answer (Amendment 7(d)), and this skill will not bind a lane, write a PAUSED record or print a restart command on one. Run it by hand to see what it says.\n' \
-           "$L" "$1" "$sr_rc" "$sr_not" >&2
-         exit 1 ;;
-  esac
-  eval "$sr_var=\$sr_out"
-}
-```
-
-**THE WHY IS ONE LINE, AND IT IS REFUSED BEFORE STEP 1** (`opensoft/openRepoTools#85`; `lane-handoff` took
-the same refusal in #218). `$why` below is the operator's words, verbatim: the `[why]` of `/handoff [why]`.
-It reaches step 2's top block, where a line break writes a malformed prompt (a `---` line is where
-`lane-start` ends the prompt it hands the next session), and step 4's object-log `PAUSED` line and register
-line, two files nothing rewrites. Both of those writers refuse a newline or a carriage return before they
-write, but step 4 runs after step 2 has refreshed and committed the handoff, so a refusal there would end the
-act with a top block and no record behind it. So the test is made here, before step 1 renames anything and
-before anything is written. It is the test `lane-handoff` makes right after reading its arguments, because
-the skill and `lane-handoff` are one act (Amendment 17(a)) and refuse the same why. Step 4 still spells a
-break `; `, as `lane-handoff`'s `sanitize` does, and that is the second line of defence, not this one. A
-why the operator did not give is no why at all: it passes, and step 4 writes `handoff`. That holds in a shell
-running under `set -u` too, which is why the check reads `${why-}`.
-
-```sh
-case "${why-}" in
-  *$'\n'*|*$'\r'*)
-    printf '%s\n' "REFUSED: the why is ONE line: it is written into the handoff's top block, the object log's PAUSED line and the register's file-level line, and a newline or carriage return in it would split each of them — the last two in files nothing rewrites. Nothing was renamed or written. Put it on one line, with '; ' where the break was, and run /handoff again." >&2
-    exit 2 ;;
-esac
-```
-
-## 1. Usage, then the identity triple — derived, not asked
-
-```bash
-claude-usage
-window="$(tmux display-message -p '#W')"                     # Amendment 8(b): the window IS the lane
-lane="$window"
-sread row_probe "'this window is not a lane'" register-row "$lane"
-[[ -n "$row_probe" ]] || lane=""
-# THE WORKSTATION COMES FROM CONFIGURATION, NEVER FROM `hostname` (Amendment 11,
-# ratified decision 8(d), from Evidence 6): a forked orchestrator wrote a bench
-# container's id into a register whose every other row says `Eagle`, and a row
-# on a workstation that does not exist is a row no reader can match. `$L`'s own
-# `workstation` read is the one implementation; its second tab-separated field
-# says which rung answered.
-ws_pair=""; ws_rc=0
-ws_pair="$("$L" workstation 2>/dev/null)" || ws_rc=$?
-ws="${ws_pair%%	*}"
-# AND IT NEVER WRITES A PLACEHOLDER (`R-A11-14`). Inside a container with no
-# `LANES_WORKSTATION`, the helper's own writers refuse — `@unknown-workstation`
-# is the same defect one field along from the `unknown` clause (e) refuses in
-# the session field, and the log is never rewritten.
-#
-# WHAT STOPS IS THE REGISTER AND LOG WRITES, NOT THE SWAP (A11 Addendum 4
-# ruling 11, ratified "a11 addendum 4 yes"). This step used to `exit 2` HERE,
-# before the handoff refresh, the subagent poll, the register line and the
-# printed restart command — so a container with no workstation lost the one
-# thing a swap exists to leave behind. Clause (k) rule (d)'s cost is *"until the
-# value is exported, every lane write from a container stops"*, and that is the
-# register and the logs; step 2's handoff commit is a commit in the LANE'S OWN
-# repository and is not one of them. Clause (e)'s shape for a fact a writer
-# cannot carry is *"the gap named in the handoff"*, and that is what happens
-# here: `$ws_missing` is carried to step 2, which names it, and to step 4, which
-# skips (a), (b) and (c) alike — every register and log write.
-#
-# AND A HELPER PREDATING THE READ IS NOT A CONTAINER (#26, the review of
-# `29d3417`, this file's `:70`). `workstation` is one of Amendment 11's reads,
-# so a `lanes-edit.sh` that has not taken adoption act 3's install exits **2**
-# from its unknown-subcommand arm and prints nothing — and `-z "$ws"` then told
-# the operator of a perfectly ordinary host that they were in a container with
-# `$LANES_WORKSTATION` unset, which is a sentence they cannot act on. Until the
-# install reaches every workstation, **2 is the answer every one of them gives**
-# (`R-A11-8`), so this is the common case and not the corner.
-#
-# THE OUTCOME IS THE SAME AND THE REASON IS NOT. The writes still stop, for the
-# same reason they stop in a container: `$ws` is written into the PAUSED line's
-# payload and into `session <uuid>@<ws>`, and a record filed under nothing is
-# the placeholder `R-A11-14` refuses. What changes is that the gap is named
-# truthfully and the act that closes it is the install rather than an export.
-ws_missing=""
-if [[ "$ws_rc" != 0 && "$ws_rc" != 8 ]] && [[ -z "$ws" ]]; then
-  ws_missing=1
-  echo "NO WORKSTATION READ: \`$L workstation\` exited $ws_rc and named none. Exit 2 is a lanes-edit.sh predating Amendment 11 — expected, and every workstation gives it until adoption act 3's install reaches it (\`R-A11-8\`); anything else is a read that failed. Either way this skill will not write a record filed under no workstation (\`R-A11-14\`), so the register and object-log writes of step 4 are NOT made and the row is NOT flipped. The swap itself goes on: the handoff is refreshed and NAMES this gap, and the restart command is still printed, with --lane. To close it: openRepoTools --install, then re-run step 4."
-elif [[ "${ws_pair##*	}" == container-unset || -z "$ws" ]]; then
-  ws_missing=1
-  echo "NO WORKSTATION: this is a container and \$LANES_WORKSTATION is not set. The register and object-log writes of step 4 will NOT be made — a record filed under a container id is a record no restart of any workstation will ever find, and both logs are append-only (\`R-A11-14\`). The swap itself goes on: the handoff is refreshed and NAMES this gap, and the restart command is still printed — with --lane, because the row is NOT flipped either and a restart cannot resolve this lane from a row that was never written. The workBenches launcher exports the value into every session it starts and \`wave-container-shell.sh\` into every container it opens; to close the gap now: export LANES_WORKSTATION=<this host name> and re-run step 4."
-fi
-if [[ -z "$lane" ]]; then
-  # AMENDMENT 11 CLAUSE (b) INSERTS A STEP BETWEEN THE NAME AND THE RECORD, AND
-  # THIS SKILL TAKES IT TOO (clause (h): one read, three callers). `window-lane`
-  # answers "the lane bound to THIS window of THIS workstation" — the register
-  # row whose name is the window's name, else this workstation's swap record
-  # whose `window` sub-field names this window's `<@id>` or its
-  # `<session>:<index>`, and only where that window still exists. Without it the
-  # skill and the launcher disagree in precisely the case the new step exists
-  # for: a window whose name is gone but whose record names it.
-  # 0 is a lane, 8 is none, and 2 is a `lanes-edit.sh` predating Amendment 11 —
-  # expected and silent, and a fall to the next rung rather than a refusal.
-  wl_ref="$(tmux display-message -p '#{window_id}' 2>/dev/null)"
-  [[ -n "$wl_ref" ]] || wl_ref="$(tmux display-message -p '#S:#I' 2>/dev/null)"
-  sread candidate "'no lane is bound to this window'" window-lane "$ws" "$wl_ref"
-  [[ "$candidate" =~ ^[A-Za-z0-9_][A-Za-z0-9._-]*$ ]] && lane="$candidate"
-fi
-if [[ -z "$lane" ]]; then
-  # The swap record, read exactly as the launcher reads it: the STATUS decides
-  # whether there is an answer at all, and the contract is the tab. A row that
-  # printed before a failed read, or one with no tab, is not a record row —
-  # `cut -f 1` would hand back the whole line, lane-shaped and wrong.
-  sread rows "'this workstation has no swap record'" swapped "$ws"
-  first="$(printf '%s\n' "$rows" | head -n 1)"
-  if [[ -n "$rows" && "$first" == *$'\t'* ]]; then
-    candidate="${first%%$'\t'*}"
-    [[ "$candidate" =~ ^[A-Za-z0-9_][A-Za-z0-9._-]*$ ]] && lane="$candidate"
-  fi
-fi
-# ONE NAME UNDER ANY CASE, WHICHEVER RUNG ANSWERED (Amendment 15; #72 item 8).
-# Rung 1 reads the window's name through `register-row`, which resolves it
-# through `canon_lane` and so refuses a register holding two rows that differ
-# only by case. Rungs 2 and 3 answer with a record's lane field and the swap
-# row's first cell, and nothing above reads either through the resolver, so a
-# lane a case twin makes ambiguous bound from them. The bound name is therefore
-# read once more, here, through `canon-lane` and the fence — `lane-handoff`'s
-# own step after its rungs — before anything is renamed or written. Its 15(d)
-# exit 2 refuses through the fence, an old helper's 2 keeps the name as it is,
-# a read that failed stops the skill as every failed read does, and its answer
-# is the register row's spelling, which the rename, the record and the restart
-# line then carry. It is NOT a check that the lane has a row: `canon_lane`
-# answers a name no row matches with the name as typed.
-if [[ -n "$lane" ]]; then
-  sread lane_canon "'this lane has no row'" canon-lane "$lane"
-  [[ "$lane_canon" =~ ^[A-Za-z0-9_][A-Za-z0-9._-]*$ ]] && lane="$lane_canon"
-fi
-printf 'lane=%s\n' "${lane:-<none>}"
-```
-
-The window name answers first, the window's own RECORD second and the workstation's newest swap third —
-the launcher's own order, with Amendment 11 clause (b)'s new zero-question step in the middle, so the skill
-and the launcher never disagree about which lane this is. Whichever of the three answered, the name is then
-read once more through `canon-lane`, as `lane-handoff` does: a register holding two rows for it that differ
-only by case refuses there, and the row's own spelling is the name used below. Then make the other two names
-match it, mechanically:
-
-- window name ≠ lane → `tmux rename-window "$lane"`;
-- Claude session name ≠ lane → type `/rename <lane>` (Amendment 2: the session name is the lane's
-  messaging address).
-
-If `lane` is empty, **nothing binds this window**. Stop, and print the command FILLED IN — the repo and
-the number are the window's own name split on its last `-` (clause (e) does the same, for the same reason:
-nobody should have to translate a placeholder at the one moment they are trying to get back to work):
-
-```bash
-case "$window" in
-  *-[0-9]*) printf 'run: lane-start --no-launch %s %s\n' "${window%-*}" "${window##*-}" ;;
-  *)        printf 'run: lane-start --no-launch REPO N; this window is named "%s", which is not a lane name, so the repo and the number have to come from the operator\n' "$window" ;;
-esac
-```
-
-Only the second branch leaves anything blank, and it leaves it blank because nothing here knows it.
-
-## 2. Refresh the handoff
-
-Manual preservation and restart/resume-stamp publication is serialized by `lanes-edit.sh publish-handoff`.
-Read the current file's SHA-256, write semantic updates to a temporary file, then
-publish that complete prepared file with:
-
-```sh
-"$L" publish-handoff "$lane" "$handoff_file" "$prepared_file" --expect-digest "$prior_sha256"
-```
-
-The helper checks the expected bytes and atomically replaces the resolved target
-while holding the workspace writer mutex. It refuses an active restart owned by
-another operation. Do not edit or redirect into the canonical handoff directly;
-perform the existing explicit-pathspec commit/push after successful publication.
-Legacy `rename-lane` is a separate four-file transaction under the same mutex;
-it refuses unfinished/failed restart ownership and uses EXIT rollback. Its
-stamp now atomically replaces the handoff through a temporary file beside it
-(#158), but the four-file rename itself is still not crash-atomic (#224).
-
-
-The handoff path is the row's own handoff column. Derive it; do not guess it — and read the row FETCHED,
-because this decides state (Amendment 7's read-after-fetch rule governs it; step 1's window/record probe is
-the only no-fetch read this skill makes):
-
-```sh
-row="$("$L" register-row "$lane" 2>/dev/null | grep '^|' | tail -n 1)"
-# The handoff path is the row's SIXTH column: awk field 7, because $1 is the empty string before the
-# leading pipe — lanes-edit.sh's own row_cell/handoff_of_lane convention. NEVER count back from NF: this
-# lane's own row alone carries 27 fields today, every extra one of them in the state history to the RIGHT
-# of the handoff column, so `$(NF-2)` landed on the empty string and this step used to `git add ""` and
-# commit nothing — silently, in the one step Amendment 6(e) exists for.
-handoff="$(printf '%s' "$row" | awk -F'|' '{print $7}' | awk '{$1=$1};1')"
-uuid="$(printf '%s' "$row" | awk -F'|' '{print $3}' \
-  | grep -o '[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}' | tail -n 1)"
-# THE SESSION'S OWN ID COMES FIRST AND THE ROW'S SECOND, which is `lane-handoff`'s
-# order (*"THE SHELL'S OWN SESSION BEATS THE RECORD"*) and `R-A11-5`'s premise: *"a
-# swap taken by a running session always has a uuid: `$CLAUDE_CODE_SESSION_ID` is
-# it"*. It is shape-checked, as the launcher's window exports and
-# `$CLAUDE_PROFILE_NAME` are in step 4.
-sid_re='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
-[[ "${CLAUDE_CODE_SESSION_ID:-}" =~ $sid_re ]] && uuid="$CLAUDE_CODE_SESSION_ID"
-printf 'handoff=%s\nuuid=%s\n' "${handoff:-<none>}" "${uuid:-<none>}"
-# WHERE NEITHER ANSWERS, THE LANE HAS NEVER HAD A SESSION RECORDED, and `R-A11-5`
-# (A11 Addendum 1, F7) has the skill SAY SO BEFORE IT WRITES, naming the act that
-# supplies one: the writer's own refusal is the guard behind this one, and the
-# caller who would meet it is mid-swap with a session about to die. IT IS ASKED
-# OF A ROW THAT WAS READ — a read that failed is no row recording nothing
-# (Amendment 7(d)), and that case is the `$handoff` stop below. THE SWAP GOES ON,
-# as `ws_missing`'s does (*a swap is never left unwritten*, `R-A11-11`):
-# `$uuid_missing` is carried to the handoff below, which names the gap, and to
-# step 4, which skips the two writes that name a session. A `session_…` footer id
-# is no uuid, here as to the writer, and reads as none.
-uuid_missing=""
-if [[ -n "$row" && -z "$uuid" ]]; then
-  uuid_missing=1
-  # SPLIT BY PARAMETER EXPANSION, AS STEP 1 DOES: zsh, a session's own shell,
-  # fills `$match` and not `BASH_REMATCH`, so a split read from the match would
-  # print this command with both fields empty.
-  uuid_fix='lane-start --no-launch <repo> <n>'
-  [[ "$lane" =~ ^.+-[0-9]+$ ]] && uuid_fix="lane-start --no-launch ${lane%-*} ${lane##*-}"
-  uuid_cell="while the row's state cell still is"
-  [[ -z "$ws_missing" ]] || uuid_cell="and neither is the row's state cell, for want of a workstation"
-  echo "NO SESSION RECORDED: neither \$CLAUDE_CODE_SESSION_ID nor lane $lane's row carries a session uuid, so there is no session to name, and the writer refuses a \`session\` field that is not a transcript uuid (\`R-A11-5\`, clause (e)). Step 4's object-log PAUSED and register-line writes are therefore NOT made — the second would read \`session @<ws>\` — $uuid_cell. The swap itself goes on: the handoff is refreshed and NAMES this gap, and the restart command is still printed. The act that gives the lane a session is Amendment 6(c)'s session-cell append: run \`$uuid_fix\` in this lane's window, then re-run steps 2 and 4."
-fi
-```
-
-If `$handoff` came back empty, **stop here** — this row does not split the way `row_cell` expects, a
-`git add ""` below commits nothing while looking like it worked, and Amendment 6(e) exists for exactly this
-step. Read the row's own text by hand and take its handoff token; do not guess one.
-
-`$uuid` is this session's own id — `$CLAUDE_CODE_SESSION_ID`, which a running session always has — else the
-**last** id in the session cell, the only one Amendment 6(b) calls the lane's. Rewrite the handoff's state line, **every word given and not yet executed**, and the resume prompt;
-a stale handoff is how given words die with the session (Amendment 6(e)).
-
-**THE TOP BLOCK'S TEMPLATE GAINS A `WRITERS` SECTION AND A FIRST LINE** (Amendment 17(f): the block *"LISTS
-EVERY WRITER THE LANE HAS RUNNING (its worktree, its branch, its brief, what it had committed)"*, as
-**Addendum 1 (i)** reads that section — *"a list to COUNT, not a list to relaunch"*, in force 2026-09-14T20:59:31Z).
-Write it exactly this shape, and prepend it — a handoff is the one document in this protocol whose purpose is
-to be read by a later session, so nothing below is rewritten and everything already there stays as history
-under a `---` rule:
-
-```text
-Lane: <lane> (<profile>, session <uuid>) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)
-
-## RESUME PROMPT — PAUSED <UTC> (<why>), agent <agent>, transcript <id|none>, kind <in-process|respawn|unknown> — <the kind's expectation, from the table below>
-
-**FIRST ACTS, in order.** (1) You are lane `<lane>` in tmux window `<window>`, checkout `<dir>`. Stamp this
-block RESUMED before anything else (Rule 3, single use). (2) Read AGENTS.md, then this block. (3) COUNT THE
-LIVE WRITERS before relaunching anything — the WRITERS section below is a list to COUNT, not a list to
-relaunch (Addendum 1 (i)). ONE WORKTREE, ONE WRITER (k): a worktree is one writer's for as long as that
-writer is live, a relaunch onto a live writer's worktree is the writers' form of Amendment 18(h)'s second
-binding, and where you find one made you retire the newer before either commits. <the kind's own sentence,
-from the table below.> Older sections below are history.
-
-**STATE at <UTC>.** <what is true, what is owed, every word given and not yet executed> Kind `<kind>`: <its
-sentence>.
-
-**WRITERS at <UTC>** (<n> found under `<dir>`) — FIRST count the live writers: `ListAgents` in Claude, the agent's equivalent elsewhere. A writer still live OWNS its worktree: do not relaunch it; one message telling it that its in-flight call died and who the coordinator now is, is enough. Relaunch only a writer that is NOT live, from where it stands — `git status` and `git log @{u}..` in its worktree, then its brief. WHERE THE COUNT AND THIS LIST DISAGREE, THE COUNT WINS: this list is what the paused session expected, the count is what is true.
-
-- `<worktree>` — branch `<branch>`, last commit `<sha> <subject>`, <n> dirty, <m> unpushed; brief: <the brief that writer was given>
-```
-
-**THE KIND IS NOT COSMETIC, AND IT WAS MEASURED HERE ON 2026-09-14** — the measurement Amendment 17
-Addendum 1 was drafted and ratified on the same day. A harness `/clear` — and any `/ctx` that clears IN PLACE
-rather than respawning the pane — mints a NEW TRANSCRIPT ID IN THE SAME PROCESS: every subagent this lane has
-running SURVIVES it, and only the tool calls they had in flight die (a `Bash` killed that way exits 137). The
-handoff written a minute before that clear said *every agent dies with this context* and *relaunch every
-writer below*; the live count a minute after it showed all five alive, each still on its worktree. Followed as
-written, the block would have put a SECOND writer on each of five worktrees. Only a new process — the pane
-respawned (`--restart`), the session ended (`--exit`), a profile switch, a usage-reset relaunch — takes the
-writers with it.
-
-| kind | when | the sentence act (3) carries | what the count then finds |
-|---|---|---|---|
-| `in-process` | a `/clear`, or a `/ctx` that clears in place | *THIS HANDOFF WAS WRITTEN FOR AN IN-PROCESS CLEAR: the process was not replaced, so expect every writer below live and the count to name them all.* | every writer below, live and owning its worktree |
-| `respawn` | `--restart`, `--exit`, a profile switch, a usage-reset relaunch, `lane <name>` | *THIS HANDOFF WAS WRITTEN FOR A RESPAWN: the process that ran the writers is gone, so expect the count to name none of them.* | none of them — each is relaunched from where it stood |
-| `unknown` | a plain `/handoff`, after which the person may `/clear` or may relaunch | *THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT: a plain handoff may be followed by a `/clear` in this process or by a relaunch, so nothing below assumes either — the count is the answer.* | whatever is true; the count decides |
-
-`lane-handoff` writes whichever of the three applies — `--in-process` for the first, `--restart`/`--exit` for
-the second, nothing for the third — and the `PAUSED` payload carries it as `kind <in-process|respawn|unknown>`
-beside `agent` and `transcript`, with the same word in the line's FREE TEXT after the why (`clear in-process`,
-`clear respawn`, `kind unknown` — Addendum 1 (h)), because the record is what a later reader has. **THE KIND
-SAYS WHAT TO EXPECT AND NEVER WHAT TO DO** (j): clause (i)'s count is what says what to do, it is the same in
-all three, and where the count and the list disagree the count wins.
-
-**Line 1 and the blank line after it are STRUCTURAL**: `lane-start` splices its `RESUMED by …` stamp at the
-line immediately after the first blank line that follows line 1, so a block that does not open that way is a
-block the stamps land in the middle of.
-
-**If the read above set `$uuid_missing`, THE HANDOFF NAMES THAT GAP TOO** (`R-A11-5`: *"the gap named in the
-handoff"*). Say in the state line, in as many words, that neither this session nor the lane's row names a
-session uuid, that step 4's object-log `PAUSED` line and register line were therefore NOT written (nor the
-row's state cell, where `$ws_missing` is also set), and that the `lane-start --no-launch` the message above
-printed, filled in, is the act that records one — so the next session knows the log holds no record of this
-swap, and that its next start is a start rather than a resume, instead of believing the lane never paused.
-Write `session unknown` where the top block's first line carries `<uuid>`, as `lane-handoff` does.
-
-**If step 1 set `$ws_missing`, THE HANDOFF IS WHERE THE GAP IS NAMED** (A11 Addendum 4 ruling 11, clause
-(e)'s shape for a fact a writer cannot carry). Say in the state line, in as many words, that this session ran
-in a container with no `LANES_WORKSTATION`, that step 4's register and object-log writes were therefore NOT
-made, and that the row still reads as it did — so the next session knows the register is behind its own
-handoff rather than believing the lane never paused. This commit is in the LANE'S OWN repository and is not
-one of the writes that stop.
-
-**COMMIT IN THE CHECKOUT THE HANDOFF WAS PUBLISHED IN, BY ITS OWN PATH, AND NOTHING ELSE** (Amendment 4(d):
-*"with explicit pathspecs — never `git add -A`, never a bare `git commit`"*; Amendment 5(c) and (d)). The
-checkout is RESOLVED, never spelled: `$LANES_REPO` first, then the helper's own `workspace-root`, which is the
-order `lane-handoff` uses — a lane window exports `LANES_REPO` to the lane's own clone, and step 4's writes go
-there. Step 2's publication target `$handoff_file` is the same file (`$LANES_REPO/$handoff` where that exists,
-else the workspace root's), so the file published is the file committed. A STAGED ENTRY THIS HANDOFF DID NOT
-MAKE IS A REFUSAL, read before the `git add`: a bare commit would publish it, and with a pathspec the pull would
-refuse on it. So is a rebase, merge, cherry-pick or revert in progress. Then the Rule 5 `Lane:` trailer,
-pull-rebase and push:
-
-```sh
-# THE CHECKOUT IS RESOLVED, NEVER SPELLED: `$LANES_REPO` first, then the
-# helper's own `workspace-root`, the order `lane-handoff` uses. Lane windows
-# export `LANES_REPO` to the lane's own clone, and step 4's writes go there.
-hc_root=""; hc_why=""; hc_staged=""
-for hc_base in "${LANES_REPO:-}" "$("$L" workspace-root 2>/dev/null)"; do
-  if [ -n "$hc_base" ] && [ -f "$hc_base/$handoff" ]; then hc_root="$hc_base"; break; fi
-done
-if [ -z "$hc_root" ]; then
-  hc_why="$handoff is under neither \$LANES_REPO nor the workspace root"
-else
-  hc_git="$(git -C "$hc_root" rev-parse --absolute-git-dir)"
-  for hc_op in rebase-merge rebase-apply MERGE_HEAD CHERRY_PICK_HEAD REVERT_HEAD; do
-    [ ! -e "$hc_git/$hc_op" ] || hc_why="$hc_root has an operation in progress ($hc_op)"
-  done
-  # A STAGED ENTRY THIS HANDOFF DID NOT MAKE, read BEFORE the add: a bare
-  # commit would publish it, and with a pathspec the pull would refuse on it.
-  hc_staged="$(git -C "$hc_root" diff --cached --name-only | grep -vxF -- "$handoff")"
-  [ -z "$hc_staged" ] || hc_why="${hc_why:+$hc_why; }the index of $hc_root holds $(printf '%s\n' "$hc_staged" | wc -l | tr -d ' ') staged path(s) this handoff did not make"
-fi
-if [ -n "$hc_why" ]; then
-  printf 'HANDOFF NOT COMMITTED: %s. The file is written; nothing was committed or pushed. Never commit staged entries you did not make.\n' "$hc_why"
-  [ -z "$hc_staged" ] || printf '%s\n' "$hc_staged" | head -n 20 | sed 's/^/  staged: /'
-elif ! { git -C "$hc_root" add -- "$handoff" &&
-         git -C "$hc_root" commit -m "handoff(<lane>@<ws>): PAUSED, <one-line state>" -m "Lane: <lane>" -- "$handoff"; }; then
-  printf 'HANDOFF NOT COMMITTED: git refused the add or the commit in %s (its words are above).\n' "$hc_root"
-elif git -C "$hc_root" pull --rebase origin "${LANES_BRANCH:-main}" &&
-     git -C "$hc_root" push origin "${LANES_BRANCH:-main}"; then
-  echo "handoff pushed from $hc_root"
-else
-  git -C "$hc_root" rebase --abort 2>/dev/null || :
-  printf 'HANDOFF NOT PUSHED: it is a local commit in %s, any rebase is aborted, and git said why above. Never force; look first:\n  git -C %s fetch origin && git -C %s cherry -v origin/%s HEAD\n' \
-    "$hc_root" "$hc_root" "$hc_root" "${LANES_BRANCH:-main}"
-fi
-```
-
-A refusal, a conflict or a rejected push does not stop the swap (`R-A11-11`, *a swap is never left
-unwritten*): the handoff file is written, the block prints what it did NOT do, and the report carries that
-line. On a rebase conflict the block aborts and leaves the tree clean. Never force, and never commit staged
-entries you did not make.
-
-## 3. Subagents and worktrees — the one question, and the sweep that fills WRITERS
-
-Run `ListAgents`, then send each running subagent one `SendMessage`: "Handoff imminent: commit and push what
-you have now, with the usual trailers and explicit pathspecs; reply with the sha or 'nothing to push'."
-
-**THEN SWEEP THE DISK, because an agent that has already died names nothing.** Every worktree under the
-lane's own checkout and beside it is polled, and what it reports is what step 2's `WRITERS` section carries —
-`$worktree` below is each of those paths in turn:
-
-```bash
-for worktree in "$dir"/.claude/worktrees/* "$(dirname "$dir")"/.lane-worktrees/"$lane"/*; do
-  [ -d "$worktree" ] || continue
-  git -C "$worktree" rev-parse --abbrev-ref HEAD  # its branch
-  git -C "$worktree" log -1 --format='%h %s'      # what it had committed
-  git -C "$worktree" status --short               # dirty files
-  git -C "$worktree" log '@{u}..' --oneline       # unpushed commits
-done
-```
-
-`lane-handoff` makes exactly this sweep and writes the section from it; the BRIEF of each writer is the one
-fact only this session has, so it is the one this step supplies.
-
-**Ask the operator exactly one question, and only if a writer still has unpushed work and has not replied:**
-*"<agent> has unpushed work and has not replied — wait, or swap now?"* Everything else here is a report, not
-a question. Never move on to step 4 with an unanswered writer unless the operator said so.
-
-## 4. Write the swap record
-
-First sanitize the operator's words **once**, as `lane-handoff`'s `sanitize` does: replace every ` — ` with
-`; `, and spell every line break `; ` as well, whether it is a CRLF, a lone CR or a lone LF, one `; ` each
-(#85). Amendment 7(b)/R26 refuses any payload or free text containing ` — ` (exit 2), because that separator
-is what divides a line's fields from its free text, and both one-line writers below refuse a line break before
-they write. The check before step 1 has already refused a why that carries a break, so spelling it here is
-the second line of defence: where one arrives anyway, the record is still written, on one line. An empty why
-is written `handoff`, as `lane-handoff` writes it. Both record writes then carry that text, `$why_text`
-below, and never a template placeholder (#80 item 7).
-
-```sh
-# AMENDMENT 11 CLAUSE (c) — THE RECORD'S TWO NEW SUB-FIELDS, AND ITS SECOND REF.
-# A swap is the ONE moment the lane is certainly running, so it is the one
-# moment both are certainly knowable; neither is derived and neither is guessed.
-#   dir      the lane's CHECKOUT — its own recorded directory where it has one
-#            (`lane-dir`, written by `lane-start` at every start under this
-#            amendment), and only failing that this session's own checkout root.
-#            NEVER a subagent's worktree: a lane's `dir` is where the lane is
-#            restarted, and restarting into a worktree is Evidence 3's silent
-#            loss of the repository's CLAUDE.md and the lane's memory.
-#   profile  `$CLAUDE_PROFILE_NAME`, which the launcher exports into every
-#            session it starts. Without it a `restart <lane>` typed anywhere but
-#            in the lane's surviving window cannot name the profile the launcher
-#            needs, because today the profile is recoverable only from the tmux
-#            session name, which act 1's window reuse and any rename destroy.
-#   window   gains its `<@id>` beside the `<session>:<index>` it already had —
-#            two space-separated refs in ONE sub-field under 7(b)'s grammar.
-# A path containing a space is WRITTEN QUOTED, which is what makes it one ref;
-# a path containing `, `, ` — `, `; ` or `"` is DROPPED — the sub-field, not the
-# line — and what was dropped is PRINTED (A11 Addendum 4 ruling 10; SPEC rev 6
-# §5 for the `; `).
-#
-# WHY DROPPED HERE AND REFUSED IN `lane-start`, WHICH IS THE SAME RULE READ
-# TWICE. Both writers refuse the same VALUES — the list is identical — and they
-# differ only in what happens next, because of where they stand.
-# `lane-start:686-690` is in front of a LAUNCH: it can exit 2 and the operator
-# moves the checkout and starts again. This is the LAST act of a session that is
-# about to die, and `R-A11-11` binds it: *a swap is never left unwritten*. An
-# `exit 2` here loses the PAUSED line the launcher restarts from, over a
-# sub-field that is information. So the offending sub-field goes, the line
-# stays, and the reader is told which fact it does not carry — which is
-# Amendment 7(i)'s reader rule given a writer that speaks.
-#
-# `window` IS NOT WIDENED to `; ` and that is a ruling rather than an oversight
-# (SPEC rev 6 §5): its list is Amendment 8(b)'s, narrowing it would be a SEVENTH
-# edit to in-force text where the ratified count is six (`R-A11-15`), and a
-# `window` value is a launcher-built session name, an index and an `<@id>`.
-#
-# `dir` IS THE LANE'S CHECKOUT AND NEVER A WORKTREE (`R-A11-11`, A11 Addendum 2;
-# Evidence 3). THREE SOURCES, every one of them a RECORD rather than a
-# derivation:
-#   1. the lane's own recorded `dir` (`lane-dir`), written by `lane-start` at
-#      every start under this amendment — the lane's checkout as the lane's own
-#      writer recorded it;
-#   2. the launcher's `WORKBENCHES_CLAUDE_LANE_DIR`, exported only where the
-#      directory order's rungs 1-3 answered;
-#   3. THE LIVE SESSION'S OWN RECORD — the harness writes `"cwd"` beside
-#      `"tmux"` in `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, keyed by
-#      `sessionId`, which is this session's directory as the harness itself
-#      keyed it, and the directory whose CLAUDE.md and memory it loaded.
-#
-# `git rev-parse --show-toplevel` AND `$PWD` WERE THE NEXT TWO RUNGS AND ARE
-# GONE (ruling 10). They record the git toplevel of wherever the shell stands,
-# which in a subagent's scratchpad worktree is THAT WORKTREE — and `restart
-# <lane>` then `cd`s into it, losing the repository's CLAUDE.md and the lane's
-# memory (Evidence 3). A record with NO `dir` is complete in the same way a
-# record with no `@id` is; a record with the WRONG one is not, because
-# `lane-start` writes the lane's home from that tree's `origin` and every `#n`
-# after it inherits that.
-# AND A READ THAT FAILED IS NOT A RECORD THAT NAMES NO DIRECTORY (#26, the
-# review of `c3ebcfe`, this file's `:236`). `|| dir=""` made those two the same
-# fact, and sources 2 and 3 are NOT rungs beneath a failed read: they answer for
-# a lane whose record names no directory, and the third of them is THIS
-# SESSION'S OWN `cwd`. A swap typed in one checkout for a lane that lives in
-# another would then record this session's directory as that lane's, in a log
-# nothing rewrites — Evidence 3's wrong checkout, written by the one act that
-# exists to leave the lane findable. So a failed read takes no substitute: the
-# two sources below are skipped and the sub-field is absent.
-#
-# IT DOES NOT STOP, AND THAT IS `R-A11-11`: *a swap is never left unwritten*.
-# The offending sub-field goes and the line stays — the same answer this file
-# already gives for a `dir` it may not write (the DROP below) — and the reader
-# of the record is told WHICH READ was lost rather than handed a plausible wrong
-# path. That is why this one read does not come through `sread`, which stops.
-dir=""; dir_read_failed=""; dir_rc=0
-dir="$(LANES_NO_FETCH=1 "$L" lane-dir "$lane" 2>/dev/null)" || dir_rc=$?
-case "$dir_rc" in
-  0)   : ;;
-  8|2) dir="" ;;
-  *)   dir=""; dir_read_failed="\`$L lane-dir $lane\` failed (exit $dir_rc)" ;;
-esac
-if [[ -z "$dir" && -z "$dir_read_failed" ]]; then
-  dir="${WORKBENCHES_CLAUDE_LANE_DIR:-}"
-  if [[ -z "$dir" && -n "${CLAUDE_CODE_SESSION_ID:-}" && -n "${CLAUDE_CONFIG_DIR:-}" ]]; then
-    dir="$(jq -r --arg id "$CLAUDE_CODE_SESSION_ID" \
-      'select((.sessionId // "") == $id) | .cwd // empty' \
-      "$CLAUDE_CONFIG_DIR"/sessions/*.json 2>/dev/null | head -n 1)"
-  fi
-fi
-# AN ABSOLUTE PATH OR NOTHING AT ALL: a relative one has no meaning without the
-# writer's cwd, which no reader of this log has, and `~` is the writing shell's.
-[[ "$dir" == /* ]] || dir=""
-# AND BOTH REFS FALL BACK TO WHAT THE LAUNCHER EXPORTED, which is `F-X13`'s
-# row (h) and is absorbed under `R-A11-26`'s own rule — *"the survivor is the
-# SUPERSET, so a seventh divergence found after this is absorbed on the same
-# ground and needs no ruling of its own"*. On the normal path the launcher
-# started this session and threaded the window it captured across its re-exec
-# (`WORKBENCHES_CLAUDE_WINDOW_REF`, `_WINDOW_ID`, clause (b) act 1); a `tmux`
-# that is missing, a server that has gone, or a shim that answers nothing then
-# costs the record a `window` sub-field it already had in hand. Each is SHAPE
-# CHECKED before it is taken, by the same two tests the live reads get, because
-# an environment variable is no more trustworthy than a shim.
-# A `<session>:<index>` IS CHECKED AS A WHOLE STRING (#80 item 4, the same
-# finding `lane-handoff`'s `window_ref_ok` took as item 3). `*:[0-9]*` was a
-# prefix glob, so `s:1junk` passed — from a shim and from the launcher's export
-# alike — and went into the append-only `window` sub-field, where `window-lane`
-# can never resolve it: a live `#S:#I` always ends in an index, which is digits.
-# So the value is held to `^.+:[0-9]+$`, the same form as the `<@id>` test
-# below — a session part that is not empty, then digits and nothing else after
-# the last `:`. AND IT CARRIES NO LINE BREAK: the regex's `.` matches a newline,
-# so `junk<LF>s:1` passes it, and `log PAUSED` refuses a payload carrying a
-# newline or a carriage return — the whole record, not the sub-field. So a
-# value with either is dropped here, beside each regex check.
-win="$(tmux display-message -p '#S:#I' 2>/dev/null)"
-[[ "$win" =~ ^.+:[0-9]+$ ]] || win=""
-case "$win" in *$'\n'*|*$'\r'*) win="" ;; esac
-[[ -n "$win" ]] || win="${WORKBENCHES_CLAUDE_WINDOW_REF:-}"
-[[ "$win" =~ ^.+:[0-9]+$ ]] || win=""
-case "$win" in *$'\n'*|*$'\r'*) win="" ;; esac
-wid="$(tmux display-message -p '#{window_id}' 2>/dev/null)"
-[[ "$wid" =~ ^@[0-9]+$ ]] || wid="${WORKBENCHES_CLAUDE_WINDOW_ID:-}"
-# AN `<@id>` IS `@<digits>` AND NOTHING ELSE (F-X13(a), A11 Addendum 4 ruling 10).
-# `== @*` accepted anything starting with an at-sign, and two things that are
-# not ids do: a tmux too old to know `#{window_id}` PRINTS THE FORMAT BACK, and
-# a shim on PATH may print anything at all. Recording that string puts a lie in
-# an append-only log — worse than an absence, because the sub-field then names a
-# window `window-lane` can never resolve while looking complete. This is the
-# same check the launcher makes on the same value (`claude-profile`'s own copy
-# of this skill) and the one `lane-start:727` now makes.
-[[ "$wid" =~ ^@[0-9]+$ ]] && win="${win:+$win }$wid"
-# THE DROP, ON THE SAME VALUES `lane-start` REFUSES, BEFORE THE QUOTING — a test
-# that ran after it would fire on the `"` the quoting adds itself.
-refused=""
-case "$win" in *', '*|*' — '*) refused="$refused window=$win"; win="" ;; esac
-case "$dir" in *', '*|*' — '*|*'; '*|*'"'*) refused="$refused dir=$dir"; dir="" ;; esac
-case "$dir" in *' '*) dir="\"$dir\"" ;; esac
-[[ -z "$refused" ]] || printf 'DROPPED sub-field (not appended, and the line is still written):%s\n' "$refused"
-# A MISSING `dir` IS SAID, NOT GUESSED AT (ruling 10). Where none of the three
-# sources answered there is no sub-field, and the reader of this record is told
-# which fact it will not carry rather than handed a plausible wrong one.
-[[ -n "$dir" ]] || printf 'NO dir sub-field: %s, so the record is written without one (Amendment 11 clause (c)).\n' \
-  "${dir_read_failed:-neither the lane log, the launcher nor this session record names the lane checkout}"
-# A PROFILE NAME IS A MANIFEST KEY — letters, digits, `.`, `_`, `-` — and the
-# shape check is also how `profile` gets SPEC rev 6 §5's `; ` rule without a
-# token of its own: the pattern admits neither a `;` nor a space, so a value
-# carrying either is omitted rather than written. A record with no `profile` is
-# complete; one naming a profile `pclaude list` does not print is not.
-profile_name="${CLAUDE_PROFILE_NAME:-}"
-[[ "$profile_name" =~ ^[A-Za-z0-9._-]+$ ]] || profile_name=""
-# AMENDMENT 17(b) — THE RECORD NAMES THE AGENT, in two sub-fields after
-# Amendment 11(c)'s three:
-#   agent       `claude`, `codex`, or the launcher's name for whatever wrote
-#               the line — A MANIFEST KEY (letters, digits, `.`, `_`, `-`),
-#               which is also how it gets SPEC rev 6 §5's `; ` rule without a
-#               token of its own. `lane-start --agent <name>` reads it back to
-#               know WHICH LAUNCHER to use with no flag, so a value this
-#               pattern would not admit is a launch nobody can make.
-#   transcript  the agent's own resumable id where it has one, else the word
-#               `none` — which is an ANSWER and not a gap. For `claude` it is
-#               this session's transcript uuid, the same id the row's session
-#               cell ends on.
-# `lanes-edit.sh`'s writer validates both and refuses the line rather than
-# writing a sub-field no reader can use: this log is append-only.
-agent_name="${LANES_AGENT:-claude}"
-transcript_id="${uuid:-none}"
-payload="swap"
-[[ -z "$win" ]] || payload="$payload; window $win"
-[[ -z "$dir" ]] || payload="$payload; dir $dir"
-[[ -z "$profile_name" ]] || payload="$payload; profile $profile_name"
-# `workstation <ws>` is NOT omitted the way `dir` and `profile` are, and that is
-# the difference `R-A11-14` settles: those two say something about the lane, and
-# this one is the KEY the records are filed under — a record without it is not
-# incomplete, it is unfindable. So where there is none the register and log
-# writes stop instead — (a), (b) and (c) below, all three (ruling 11, `R-A11-27`)
-# — and what goes on is step 2's handoff, which is not one of them.
-[[ -z "$ws" ]] || payload="$payload; workstation $ws"
-payload="$payload; agent $agent_name; transcript $transcript_id"
-# AND THE KIND, AFTER THEM (Amendment 17 Addendum 1 (h), in force
-# 2026-09-14T20:59:31Z). `in-process` where the clear that follows keeps THIS
-# process — a harness `/clear` — `respawn` where it does not (`/ctx`, `/exit`,
-# a relaunch), and `unknown` where this act cannot know which will follow,
-# which is a plain `/handoff`. `lane-handoff` writes the same sub-field, and a
-# record from the skill that carried none would be a record no reader can tell
-# a surviving writer from a dead one by. The same word goes in the line's FREE
-# TEXT after the why — `clear in-process`, `clear respawn`, `kind unknown`.
-kind="${kind:-unknown}"       # in-process | respawn | unknown
-payload="$payload; kind $kind"
-# THE OPERATOR'S WORDS, SANITIZED ONCE, AS `lane-handoff`'s `sanitize` DOES
-# (#85): every line break is one `; `, CRLF first so that it is one and not
-# two, and so is every ` — `. A why left empty is `handoff`, `lane-handoff`'s
-# own word for it. The kind's word follows, as the free text carries it.
-why_text="${why:-handoff}"
-why_text="${why_text//$'\r\n'/; }"
-why_text="${why_text//$'\r'/; }"
-why_text="${why_text//$'\n'/; }"
-why_text="${why_text// — /; }"
-if [[ "$kind" == unknown ]]; then why_text="$why_text kind unknown"; else why_text="$why_text $kind"; fi
-# BOTH RECORD WRITES BELOW CARRY THIS TEXT (#80 item 7). They used to carry the
-# template's angle-bracket placeholders instead, for the operator's words and
-# for what is open, so a block run as printed wrote the placeholders into two
-# files nothing rewrites. `lane-handoff` hands both writes its computed text,
-# and (b) is its line word for word. What is open is for the handoff's state
-# line to say, as it is in `lane-handoff`'s record.
-
-# (a) the Amendment 7 object-log PAUSED line — the record `swapped` reads.
-# AMENDMENT 11 CLAUSE (e) — THE SKILL SUPPLIES THE UUID, AND `LANES_SESSION` IS
-# HOW. The defect was never that the skill wrote `unknown`; it is that the skill
-# HAS the uuid in hand ($uuid, bound in step 1 and written into the register's
-# own PAUSED line two lines below) AND DOES NOT PASS IT, so `session_for()` fell
-# to the row's last uuid and, for a row with none, to the literal — four such
-# lines are in the append-only log in two lanes, and a log that may carry
-# `unknown` in that field is a log clause (d) rule 3 cannot read as a resume
-# target. One environment prefix is the fix; the writer's own refusal is the
-# guard behind it, not the fix.
-#
-# AND THE SKILL'S OWN REFUSAL IS THE GUARD IN FRONT OF IT (`R-A11-5`: *"the skill
-# refuses BEFORE it writes and says which act supplies the uuid"*). Step 2 set
-# `$uuid_missing` where neither this session's id nor the row names a session —
-# the rare case, because a running session always has the first — and there the
-# writer would refuse (a) while (b) would read `session @<ws>`, the placeholder
-# clause (e) keeps out of the log and `R-A11-14` out of this file. So neither is
-# attempted, step 2 having said why and named the act. `lane-handoff` skips (b)
-# the same way but still attempts (a) and prints the writer's refusal; the caller
-# is told first here, which is the guard `R-A11-5` asks for. The row's state cell
-# names no session and is still set below.
-#
-# (a) AND (b) ARE THE TWO WRITES A MISSING WORKSTATION STOPS (ruling 11), and
-# the dispatcher guard would refuse them anyway — `lanes-edit.sh`'s dispatcher
-# gates `log`, `append-line`, `set-row-state` and every other writer on a
-# configured workstation (the list is the `case` above its `verify-row` arm; a
-# line number here would be stale the next time a verb joined it). Skipping them here means the skill says WHY once, in its own
-# words, instead of the helper saying it twice in the middle of a swap.
-if [[ -z "$ws_missing" ]]; then
-if [[ -z "$uuid_missing" ]]; then
-LANES_LANE="$lane" LANES_SESSION="$uuid" "$L" log PAUSED "lane:$lane" \
-  → "$payload" \
-  "$why_text"
-# (b) the LANES.md file-level line, the shape every prior PAUSED/RESUMED used.
-# IT IS WRITTEN WHETHER OR NOT (a) COULD BE (A8(a) step 4, `R-A11-11`): a swap
-# is never left unwritten, so a lane whose object line was refused still gets
-# this line and the row's state cell, with the gap named in the handoff — EXCEPT
-# where there is no uuid to name, which is the `$uuid_missing` that skips both.
-"$L" append-line "PAUSED — lane $lane, session $uuid@$ws, $(date -u +%Y-%m-%dT%H:%M:%SZ), $why_text; handoff refreshed"
-fi
-fi
-# (c) the row: ONE WRITE, which sets the whole state cell (Amendment 13(a)).
-# row_write_refused is what step 5 reads: empty on success, "1" the moment the
-# write below does not land.
-# IT USED TO BE TWO WRITES AND BOTH WERE GUESSES AT A CELL THAT WAS A HISTORY:
-# `replace-in-row` flipping the leading state word — found by grepping the row
-# for `| WORD ·`, or `| WORD |` for a cell with no history after it, because the
-# anchor had to occur exactly once — and then an `append-row-status` putting
-# `PAUSED — <payload>` at the END of the same cell, so the row said PAUSED twice
-# with a day of narrative between. The cell is now ONE PHRASE that
-# `set-row-state` replaces: no anchor, no second write, and a row whose cell
-# opens with anything at all takes the same call.
-# FOUR THINGS THE CELL'S LINE MAY NOT CARRY, and `set-row-state` refuses all
-# four: ` · ` (the phrase's own separator, spelled `; `), `|` (a cell boundary
-# in the row, spelled `¦` — a `dir` or a launch flag may hold one), CR and LF (a
-# row is ONE line of a table, so a newline would split it in two), and more than
-# ratified decision O1's 240 characters. The cut is at 230 with the last partial
-# WORD dropped, because `${s:0:n}` counts BYTES wherever the locale is not a
-# UTF-8 one and a byte offset can land inside `—`, `·` or `→`. This is
-# `cut_to_line` in `lane-start`, `lane-end` and `lane-handoff`, and it is kept
-# in step with them — a copy that dropped one of the four would be refused by
-# the writer where the command is not (Copilot round 4 on openRepoTools#82).
-hs_line="${payload//$'\r'/ }"
-hs_line="${hs_line//$'\n'/; }"
-hs_line="${hs_line// · /; }"
-hs_line="${hs_line//|/¦}"
-if [[ ${#hs_line} -gt 230 ]]; then
-  hs_line="${hs_line:0:230}"; hs_line="${hs_line% *} ..."
-fi
-row_write_refused=""
-# AND (c) IS A REGISTER WRITE TOO, so a missing workstation stops it as well and
-# says so ONCE rather than being refused twice by the helper. Ruling 11's
-# *"still refreshes the handoff naming the gap"* is step 2's commit, which is in
-# the LANE'S OWN repository and is not a register write; this is. `#71`'s copy
-# promised *"(c) below still runs"*, and against this repository's own
-# dispatcher guard that promise is a write the helper refuses — so the promise
-# is corrected here rather than repeated.
-if [[ -n "$ws_missing" ]]; then
-  row_write_refused=1
-  echo "NOT WRITTEN: the row's state cell stays as it is, because every register write from a container with no \$LANES_WORKSTATION stops (clause (k) rule (d)). The handoff refreshed in step 2 names this gap, and step 5 prints the restart command with --lane, because a restart cannot resolve this lane from a row that was never set."
-else
-"$L" set-row-state "$lane" "PAUSED · $hs_line" || row_write_refused=1
-fi
-```
-
-If (a) still exits 2, re-run it with the free-text argument **dropped entirely** and say so in the report:
-the PAUSED line is what the launcher reads on restart, and step 4 is never left unwritten. If (c) is
-refused — a rebase conflict, a push race, a row the writer calls ambiguous, anything `set-row-state` itself
-reports — leave `row_write_refused` set and say so in the report; step 5 reads it, because a restart cannot
-resolve this lane from a record that was never set to `PAUSED`.
-
-## 5. Print the restart command — one command, no menu
-
-```sh
-if command -v lclaude >/dev/null 2>&1; then
-  if [[ -n "${row_write_refused:-}" ]]; then
-    restart_cmd="lclaude --lane $lane ${CLAUDE_PROFILE_NAME:-<profile>}"
-  else
-    restart_cmd="lclaude ${CLAUDE_PROFILE_NAME:-<profile>}"
-  fi
-else
-  restart_cmd="pclaude --lane $lane ${CLAUDE_PROFILE_NAME:-<profile>}"
-fi
-restart_note=''
-[[ -z "${row_write_refused:-}" ]] || restart_note=' (row write was refused; the lane must be named explicitly)'
-printf 'READY TO SWAP — restart with: %s%s\n' "$restart_cmd" "$restart_note"
-lane-start --help 2>/dev/null | grep -q -- '--confirm' \
-  && echo 'restart stamps: written by lane-start (Amendment 8(d))' \
-  || echo 'restart stamps: MANUAL, as the next session first act (Rule 3 / Amendment 6(c))'
-# AND THE NAME THE NEXT SESSION COMES UP WITH — `R-A11-16` (A11 Addendum 3,
-# ratified "a11 addendum 3 yes"), brought here by A11 Addendum 4 ruling 10
-# because `opensoft/workBenches#74` deletes the copy the ruling was written
-# into. THE ACT STAYS AND ITS PREMISE HAS MOVED, because the estate overtook it.
-#
-# THE TRUE PREMISE: `lane-start` names EVERY session it launches. Adoption act 0
-# merged as `opensoft/brett-wip#5` @`3719d97` — "--name on every launch" — and at
-# that commit `lanes/lane-start:846`, `:855` and `:866` all carry
-# `--name "$LANE"`: the two branches that RESUME as well as the one that
-# CREATES. So a restart that reaches `lane-start` comes up named for the lane
-# and this line says nothing at all.
-#
-# WHAT IT IS STILL FOR is the session that comes up WITHOUT `lane-start`: the
-# launcher's two documented degradations — no `lane-start` on PATH (Evidence 5)
-# and a `lane-start` that refused, both of which start bare Claude in the same
-# window — a `claude` typed by hand, and a workstation whose `lane-start`
-# PREDATES `3719d97`, because the fix is in a checkout and not in the air. Those
-# come up with the name the harness DERIVED (`openrepoproject-b9`, Evidence 4),
-# and a lane whose messaging address (Amendment 2) is a derived name is a lane
-# nobody can address.
-#
-# WHICH ACT REMOVES THIS LINE: none is scheduled, and that is why it is printed
-# CONDITIONALLY rather than always — it is fenced on *if its name is not the
-# lane*, and that test is the whole of it. There is no API to rename a running
-# session from inside, but a keystroke is not an API, and Amendment 12's name
-# guard sends it: the `SessionStart` hook (`lanes-edit.sh session-start`) and the
-# `UserPromptSubmit` guard (`lanes-edit.sh guard`) TYPE `/rename <lane>` into the
-# session's own tmux pane. So the session that comes up outside `lane-start` is
-# usually renamed for the person, and the operator's `/rename <lane>` is the
-# FALLBACK for where the guard has not run or could not type — hooks not
-# installed, a pane that is not running `claude`, tmux not answering.
-echo 'then, in the session that comes up: if its name is not the lane, type /rename <lane> (lane-start names every session it launches, the resume branches included, since adoption act 0 landed as opensoft/brett-wip#5 @3719d97; a session that came up WITHOUT it — a missing or refusing lane-start, a bare claude, or a workstation whose lane-start predates that commit — carries the name the harness derived, and no API renames one from inside)'
-```
-
-That one command is the whole restart: `lclaude <profile>` resolves this lane from the window name,
-and from the swap record step 4 just wrote when the window is gone (Amendment 8(c)). **The SHORT form is
-the printed one, and that is an edit to in-force text rather than a preference**: Amendment 11 clause (a) —
-*"Every printed restart command becomes the short form … Amendment 8(a) step 5's prescribed
-`pclaude run <profile>` becomes that short form wherever it is printed"* — which the amendment counts as
-**edit 5 of six**. The verb was always optional and nothing breaks: the short and the long form build the
-SAME argv (`claude-profile`'s `action="${1:-list}"` falls through to `run` on any first word that is not
-`list|login|status|run`, without shifting), and the long form is not deprecated. What changes is what this
-file prints. The profile argument is the only part the operator changes, and only when switching accounts.
-
-The fallback for an older installation without `lclaude` is explicit `pclaude --lane <lane> <profile>`;
-bare `pclaude` is profile-only on updated installations. With `lclaude`, **`--lane <lane>` is printed only
-where step 4's row write was refused** — the row was never set to
-`PAUSED`, so a restart cannot resolve this lane from it and the operator must name it explicitly. `--lane`
-is a **leading** option to `claude-profile`, read before the action or the profile — measured in the
-launcher itself, *"the first token that is not one of them ends this loop"* — so it goes BEFORE the profile
-and never after it: `pclaude <profile> --lane <lane>` would be handed to Claude itself, not to the
-launcher, and the lane would never be taken. The capability probe above decides whether the RESUMED stamps
-are `lane-start`'s act or the next session's — do not assert either from memory.
-
-**`/resume` and `claude --resume <title>` are not lane surfaces** (A8 Addendum 2, R-A8-6): a lane is entered
-through `lclaude`, explicit `pclaude --lane`, or `lane-start`, and by no other door. Do not offer either as a fallback.
-
-## 6. The end this handoff has — and the record comes first, always
-
-Steps 1–5 are the whole act for a plain `/handoff`. The two flags add ONE act each, **after** the record,
-and both refuse where step 4's `PAUSED` line did not land: *"a `/ctx` whose record could not be written
-REFUSES before it kills anything (a pane is never respawned over an unrecorded lane)"* (Amendment 17(f)).
-
-**`/ctx` (`/handoff --restart`) — the context clear, and the person types nothing else.** IT IS ONE COMMAND
-AND THIS STEP DOES NOT SPELL IT OUT IN SHELL:
-
-```sh
-lane-handoff --restart "$why"
-```
-
-**THE TMUX RECIPE THAT USED TO BE HERE IS GONE, AND `opensoft/openRepoTools#94` IS WHY.** This step used to
-carry an executable respawn — `tmux respawn-pane -k -t "$pane" "LANE_START_FRESH=1 lane $lane"` — for a
-session to run itself. On 2026-09-15T20:59Z that is what ran, with two extra environment assignments the
-model added on the spot, and what came up in the pane was `claude --name <lane> --resume <the uuid the
-handoff had just paused>`: the same conversation resumed by id, not a fresh session primed by the block
-step 2 had just written, and no process left in the pane to notice. Two things were wrong and only one of
-them was the recipe:
-
-- **`LANE_START_FRESH=1` is an ENVIRONMENT seam and it does not cross the launcher.** `claude-profile`
-  re-creates its child through tmux, and a command tmux starts gets the tmux SERVER's environment, not the
-  caller's — the launcher's own code says so and threads six values into the command string for exactly
-  that reason. The fresh-session requirement was not one of them. It is now a RESTART INTENT written to
-  disk under the lane's own control root before anything is killed, and `lane-start` reads it back whatever
-  the environment did.
-- **A prose recipe is a second implementation of the destructive tail.** Two copies of one procedure that
-  must stay byte-equal is the rejected alternative everywhere else in this file, and the one place it was
-  allowed is the one place a session kills its own pane.
-
-So the whole of `/ctx`'s end is the one command above, and `lane-handoff` owns it: the restart intent
-written and read back as a FOURTH gate beside the `PAUSED` line, the row and the handoff; the pane
-respawned with `lane-handoff --supervise --lane <lane> --operation <id>` **by absolute path**; the
-supervisor claiming that intent, running the launch as its CHILD through the launcher, confirming the
-replacement came up, and STAYING IN THE PANE with a diagnostic and a retry when it did not.
-
-**WHAT TO DO WITH WHAT IT PRINTS.** Exit 0 is the pane handed over — this session is about to be killed by
-the command it just ran, and there is nothing after it. Exit 2 is a REFUSAL and this pane is exactly as it
-was: read the line, it names which of the four writes did not land, or says a restart is already in flight
-(`lane-handoff --restart-status --lane <lane>` reads that one), or that tmux would not take the pane. In
-every refusal the record is already written, so the fallback is the printed restart line and never a second
-`--restart`.
-
-**`lane <name>` IS STILL A PERSON'S DOOR AND IS NO LONGER THIS ONE** (Amendment 18 Addendum 2 (i-8) names
-two doors: `lane <name>`, *"or through the launcher directly"*). The supervisor takes the second, because
-`lane` is a HUMAN DISPATCHER whose valid outcomes include attaching to a live session without launching
-anything — and because it was the door #94 came through. The clause's own ground is kept: *"no word is
-kept on `PATH` for it alone"*, and none is — the supervisor is a mode of `lane-handoff`, which is already
-installed.
-
-**`/ctx` SAYS WHICH IT DID** (Addendum 1 (j)). The respawn above replaces the pane's process, so every writer
-of this lane dies with it: the kind is `respawn`, and the count the next session makes first then finds none,
-which is what makes relaunching each one right. If what is about to happen is an IN-PROCESS clear instead
-(the harness's own `/clear`, which mints a new transcript id in the SAME process), the writers LIVE THROUGH
-IT: write the record with `lane-handoff --in-process` (or the same two texts by hand), the kind is
-`in-process`, and the block tells the next session to EXPECT every writer below live. Either way the block
-carries clause (i)'s first line, because **the kind says what to expect and never what to do**. **Never
-relaunch a writer that is still live** — a worktree is one writer's for as long as that writer is live
-(clause (k)), and that is what this lane measured on 2026-09-14.
-
-**`/handoff --exit requested by <uuid>@<host>/<container>` — the handoff another place asked for.** After
-the record, `/exit` is typed into this lane's own pane (Amendment 12's M1, the one mechanism there is), and
-the session ENDS: *"a handoff to another place is a handoff and not a restart"* (Amendment 18(d)). The `why`
-is the requester, verbatim.
-
-```sh
-tmux send-keys -t "$pane" '/exit' Enter
-```
-
-**`lane-handoff --late --at <UTC>` — the record a swap never left.** A session that died at a usage limit
-wrote no `PAUSED`, and the lane's log still reads as running. The late record closes it, and **it is written
-from a shell BEFORE the relaunch**: this log is append-only and FILE ORDER is what every state read means by
-"last", so a `PAUSED` appended after the relaunch's `RESUMED` would make a lane that is RUNNING read as
-paused. `lane-handoff --late` therefore requires `--at <UTC>` — the moment the old session ended, which is
-what dates the line — and refuses unless the lane's last lane-kind line is a `STARTED` or `RESUMED` older
-than that instant. Run from inside the session that has already been resumed, it refuses and says so: the
-honest record of the state that session holds is its own next `/handoff`.
-
-```sh
-lane-handoff --late --at 2026-09-14T12:02:27Z "late; usage limit hit before the swap"
-lclaude "${CLAUDE_PROFILE_NAME:-<profile>}"      # and only then; use pclaude --lane <lane> if lclaude is unavailable
-```
diff --git a/skills/lane-swap/SKILL.md b/skills/lane-swap/SKILL.md
deleted file mode 100644
index 38ace252..00000000
--- a/skills/lane-swap/SKILL.md
+++ /dev/null
@@ -1,26 +0,0 @@
----
-name: lane-swap
-description: "/lane-swap is the alias of /handoff kept by lane-collision-protocol Amendment 17(a): the swap IS the handoff, under one name. It invokes the handoff skill and adds nothing to it — the identity triple fixed, the handoff refreshed with a fresh Rule 3 top block listing every running writer, the writers polled, the PAUSED record written with the window, the directory, the profile, the agent and its transcript, and the one restart command printed."
----
-
-<!-- PROMPTS TO THE PERSON: 0 of its own. Every question this act asks is the
-     `handoff` skill's one question, asked there. -->
-
-# `/lane-swap` — the alias of `/handoff`
-
-**Invoke the `handoff` skill now and follow every step of it, in order, to the end.**
-
-That is the whole of this file. Lane-collision-protocol **Amendment 17(a)**, in force 2026-09-14T09:45:33Z:
-*"The act Amendment 8(a) calls the swap is the HANDOFF: `lane-handoff` on `PATH` … from a shell, `/handoff`
-from inside a session; `/lane-swap` and `/swap` remain as aliases of `/handoff` so that nothing written
-about them stops working."*
-
-The steps are **not restated here**, and that is the amendment's own reasoning rather than a preference: two
-copies of one procedure that must stay byte-equal is the alternative clause (g) rejects by name, and it is
-why `commands/swap.md` has been a pointer since A11 Addendum 4 ruling 9. One skill is the source of the act;
-`/handoff`, `/swap`, `/lane-swap` and `lane-handoff` are four doors to it, and they write the same record.
-
-**What differs between a swap and a handoff is only WHY**, and the record's free text has always carried
-that — `clear`, `reset`, `switch`, `handoff to <who>`, `requested by <uuid>@<host>/<container>`. Nothing else
-changes with the why. If what you meant was a context clear, the word is `/ctx` (`/handoff --restart`),
-which is the same act with the restart attached.
diff --git a/skills/restart/SKILL.md b/skills/restart/SKILL.md
deleted file mode 100644
index b68dc4fe..00000000
--- a/skills/restart/SKILL.md
+++ /dev/null
@@ -1,397 +0,0 @@
----
-name: restart
-description: "/restart binds THIS session to its lane and stamps the record, for a session that started bare or in a window nothing renamed. It reads its own window, its own uuid and the register, binds through lane-start --no-launch, and where this session is not the lane's conversation it prints exactly one command and stops. Never a picker (lane-collision-protocol Amendment 11 clause (f), ratified decisions 3 and 7)."
----
-
-<!-- PROMPTS TO THE PERSON: 0. Every rung of step 2 is an EXACT MATCH — on the
-     window's own name, on this session's own uuid, on the window the operator
-     is standing in — and the last rung PRINTS THE PER-REPO LISTING AND STOPS
-     rather than asking the one confirmation the first draft had. That
-     confirmation offered the workstation's newest swap, which on the estate
-     this was measured on was the WRONG lane and the only correct answer was to
-     decline (decision 7 point 6, ratified 2026-09-13T18:05:29Z). The one
-     OPERATOR ACT this skill ever asks for is `/rename <lane>`, at step 7, and
-     it is not a question: there is exactly one lane and exactly one spelling
-     of it. -->
-
-# `/restart [<lane>]` — bind this session to its lane
-
-Lane-collision-protocol **Amendment 11 clause (f)**, with **decision 7**'s argument. This is the act for a
-session that **started bare or in an unnamed window** — the windows still called `claude`, a `claude` typed
-by hand, a session that came up before the launcher carried clause (b). It runs **in** that session.
-
-**What it never does, and why each one was paid for:**
-
-- **It never runs the launcher and never resumes anything itself.** `lane <name>` is the outside half and
-  it `exec`s; a session cannot exec a launcher over itself, so this one binds the window and prints.
-  (That word was `restart <lane>` until Amendment 18 Addendum 2 retired it from the PATH; this skill,
-  the INSIDE half, is unchanged by that and keeps its name.)
-- **It never opens a picker and never names a title.** Ratified decision 3: *"never a picker, never a
-  menu"*. The one command it may print carries an **exact uuid**, so no picker opens and no title is
-  filtered.
-- **It asks at most nothing.** A printed listing is not a picker: it asks nothing, returns nothing, and the
-  next act is a new command the operator types.
-
-`$L` is the register's reader and writer. Prefer it on `PATH` — `openRepoTools --install` puts it there —
-and fall back to the symlink Amendment 5 left:
-
-```sh
-L="$(command -v lanes-edit.sh || printf '%s' ~/projects/xFactory/lanes-edit.sh)"
-WS="$("$L" workstation 2>/dev/null | cut -f1)"    # decision 8(d): configuration, never `hostname`
-
-# EVERY READ BELOW GOES THROUGH THIS ONE FENCE, and Amendment 7(d) is the whole
-# of it: `0` an answer · `8` NO ANSWER · `2` a helper predating the read — both
-# of those fall to the next rung — and ANYTHING ELSE is a read that FAILED,
-# which is a REFUSAL naming the read and never a rung. It sets a VARIABLE rather
-# than printing, because a refusal inside `$( )` would only kill the
-# substitution's subshell and the skill would carry on with an empty answer.
-lread() {                      # lread <var> "<what the failure is NOT>" <verb> [args…]
-  ln_var="$1"; ln_not="$2"; shift 2
-  ln_out=""; ln_rc=0
-  # AND ITS STDERR IS KEPT, MINUS THE ONE SENTENCE THIS READ ASKS FOR (#34,
-  # the third site of the shape `lanes` and `restart` took at `29d3417`).
-  # `2>/dev/null` was written when the only thing on that stream was
-  # `LANES_NO_FETCH=1 — not fetching …`, which is why the whole stream was
-  # silenced; anything else there — this workstation's session records
-  # unreadable, say — is a read this fence must still be able to name.
-  ln_err_file="$(mktemp "${TMPDIR:-/tmp}/restart-lread.XXXXXX" 2>/dev/null || printf '')"
-  if [ -n "$ln_err_file" ]; then
-    ln_out="$(LANES_NO_FETCH=1 "$L" "$@" 2>"$ln_err_file")" || ln_rc=$?
-    grep -v -e 'not fetching; reading origin/' -- "$ln_err_file" >&2 || :
-    rm -f -- "$ln_err_file"
-  else
-    # No capture file, so nothing is filtered and everything reaches the
-    # person — never silence in place of a stream this fence could not open.
-    ln_out="$(LANES_NO_FETCH=1 "$L" "$@")" || ln_rc=$?
-  fi
-  case "$ln_rc" in
-    0)   : ;;
-    8|2) ln_out="" ;;
-    *)   printf 'REFUSED: `%s %s` failed (exit %s). That is NOT %s — a read that failed is never an answer (Amendment 7(d)), and this skill will not bind a window, write a stamp or print a resume command on one. Run it by hand to see what it says.\n' \
-           "$L" "$1" "$ln_rc" "$ln_not" >&2
-         exit 1 ;;
-  esac
-  eval "$ln_var=\$ln_out"
-}
-```
-
-## 1. The window
-
-```sh
-# THE PROBE'S OWN STATUS IS THE REFUSAL, not a sentence below it (#26, the
-# review of `37632b1`, this file's `:64`). The paragraph under this block has
-# always said "No tmux → REFUSED", and nothing here captured or tested the
-# status: `tmux display-message` on a host with no server prints its error and
-# exits non-zero, and the steps below would then go on resolving a lane for a
-# window that does not exist — which is the one thing this skill binds.
-win_line=""
-win_line="$(tmux display-message -p '#{session_name}:#{window_index} #{window_id} #{window_name}' 2>/dev/null)" || win_line=""
-if [ -z "$win_line" ]; then
-  printf 'REFUSED: there is no tmux window to bind (`tmux display-message` answered nothing). This skill binds a WINDOW; with no window there is nothing to bind. The manual act is: lane-start --no-launch --dir <path> <lane>\n' >&2
-  exit 1
-fi
-printf '%s\n' "$win_line"
-```
-
-**No tmux → REFUSED**, naming the manual act: `lane-start --no-launch --dir <path> <lane>`. This skill binds
-a **window**; with no window there is nothing to bind — and the block above is where that refusal happens,
-rather than in this sentence.
-
-## 2. The lane
-
-**With a `<lane>` argument, SKIP THIS STEP ENTIRELY and go to step 3 with that lane** — the operator's word
-beats every inference, exactly as `--lane` does at clause (b)'s precedence 1 (decision 7 point 6). Check only
-that the register has a row for it — `lread row_probe "'the register has no row for this lane'" register-row
-<lane>`, through the same fence as every other read here, so the check is LOCAL (`LANES_NO_FETCH=1`, like
-every read in this skill: a check in front of a bind must not sit on the network or block on ssh) and a read
-that FAILED refuses instead of being read as "no such lane". An empty answer — the contract's 8 — is a
-**REFUSED** naming `lanes`.
-
-With no argument, four rungs, **first answer wins, and every one of them is an exact match**:
-
-```sh
-# (a) THE WINDOW'S OWN NAME. `lane-start` is the only thing that ever writes it,
-#     so the name is a statement of intent in the way `--lane` is.
-lane=""
-win_name="$(tmux display-message -p '#{window_name}')"
-lread row_probe "'this window is not a lane'" register-row "$win_name"
-[ -z "$row_probe" ] || lane="$win_name"
-
-# (b) THIS SESSION'S OWN UUID, in the register's session cell (R-A11-7).
-#     THE READ THAT ANSWERED ON THIS ESTATE THE MORNING THIS WAS WRITTEN: this
-#     lane's session had resumed through a bare `claude --resume`, Amendment
-#     8(e)'s SessionStart hook fired and printed the lane, and NO STAMP WAS
-#     WRITTEN and the window stayed `claude`, because `lane-start` did not run.
-#     (a) answers nothing there; the window read answers nothing on a tmux
-#     server that has just been replaced; and the swap record offers the
-#     workstation's newest swap, which was a different lane. THE HOOK KNEW,
-#     exactly and with no question, through this same read — `lane_of_session`,
-#     which clause (h) exposes as a subcommand. One implementation, two callers.
-[ -n "$lane" ] || lread lane "'no row names this session'" session-lane "$CLAUDE_CODE_SESSION_ID"
-
-# (c) THE WINDOW THE OPERATOR IS STANDING IN, out of the swap records. The
-#     `<@id>` first and the `<session>:<index>` second, and either only where
-#     that window still exists — `window-lane` owns that fence AND the rule that
-#     a record carrying an `<@id>` is matched on its ref only where the window
-#     now holding that ref reports that same id. Three callers, one
-#     implementation: this skill, the launcher's precedence 3 and `/lane-swap`.
-if [ -z "$lane" ]; then
-  wid="$(tmux display-message -p '#{window_id}')"
-  lread lane "'no lane is bound to this window'" window-lane "$WS" "$wid"
-  [ -n "$lane" ] || lread lane "'no lane is bound to this window'" window-lane "$WS" "$(tmux display-message -p '#S:#I')"
-fi
-
-# (d) NOTHING MATCHED — PRINT THE PER-REPO LISTING AND STOP (decision 7 point 6).
-#     This replaces the first draft's one confirmation on the workstation's
-#     newest swap, which on a real estate offered the wrong lane.
-if [ -z "$lane" ]; then
-  root="$(git rev-parse --show-toplevel 2>/dev/null)"
-  origin="$(git -C "${root:-.}" remote get-url origin 2>/dev/null | sed -E 's#\.git$##; s#^git@[^:]+:##; s#^ssh://[^/]+/##; s#^https?://[^/]+/##')"
-  # AND THIS ONE GOES THROUGH THE FENCE TOO, which the stop below made matter
-  # (#26, the review of `90cef58`, this file's `:133`). It was the last read in
-  # the file that ignored its own status, and while the block fell through that
-  # cost nothing; the moment it ENDS in an outcome, a `lanes` that exited 1 or
-  # 64 would be printed as **[8]**, *no lane for this window* — a refusal turned
-  # into a no-answer, at the one rung whose next act is `lane-start`, which
-  # CREATES a row. `lread` sets a variable rather than printing, so the listing
-  # is printed from it.
-  lread listing "'no lane of this checkout is in the register'" lanes ${origin:+--repo "$origin"} ${root:+--dir "$root"}
-  [ -z "$listing" ] || printf '%s\n' "$listing"
-  # AND THIS RUNG IS TERMINAL, WHICH THE BLOCK SAID EVERYWHERE BUT IN ITS CODE
-  # (#26, the review of `29d3417`, this file's `:134`). The heading says PRINT
-  # THE LISTING AND STOP and the outcome table ends step 2 here; with `$lane`
-  # still empty the lines below would carry on — into a step 3 that resolves a
-  # directory for no lane and a step 5 that binds one.
-  printf 'NO LANE FOR THIS WINDOW [8] — the listing above is every lane of this checkout. Open one with: lane-start --no-launch <repo> <n>, filled in from this window name where it parses.\n' >&2
-  exit 8
-fi
-```
-
-**AN EXIT `2` FROM ANY RUNG FALLS TO THE NEXT RUNG, NEVER TO A REFUSAL.** `2` is what a `lanes-edit.sh` that
-has never heard of `session-lane`, `window-lane` or `lane-dir` exits for an unknown subcommand, exactly as a
-pre-Amendment-8 one did for `swapped` — **a helper predating the amendment that added the read, expected and
-silent**, told from a caller's bug by the helper's own words rather than by its status. Until the tooling is
-installed everywhere, **2 is the answer every workstation gives**, and a `/restart` that refused there would
-refuse everywhere (`R-A11-8`, on RV-T3).
-
-**Outcome where every rung answered 8 or 2: `NO LANE FOR THIS WINDOW` [8]**, with the listing above and
-`lane-start --no-launch <repo> <n>` filled in from the window's own name where it parses as `<repo>-<n>`.
-
-## 3. The directory
-
-```sh
-lread dir "'this lane has no recorded directory'" lane-dir "$lane"
-if [ -z "$dir" ]; then                                # 8 → the default; nothing is backfilled
-  # `<repo>` IS THE NAME WITH ITS POSITION REMOVED, AND A POSITION IS DIGITS.
-  # `${lane%-*}` strips the last `-`-separated token WHATEVER it is, so for
-  # `openxfactory-4-opendox-extraction` — a lane this estate has — it answered
-  # `openxfactory-4-opendox`, a repository that does not exist. The rule is
-  # `lane-start:565-578`'s, which is the writer of these names: a lane is
-  # `<repo>-<position>` where the position matches `[0-9]+[A-Za-z]?`, and a name
-  # that does not end that way has no position to strip and is its own `<repo>`.
-  tail="${lane##*-}"
-  case "${tail%[A-Za-z]}" in
-    '' | *[!0-9]*) repo="$lane" ;;
-    *)             repo="${lane%-*}" ;;
-  esac
-  dir="$PROJECTS_ROOT/$repo"
-  # AND A DEFAULT THAT IS NOT THERE IS NOT A REFUSAL — IT IS `lane-start`'s
-  # QUESTION (#26, the review of `c3ebcfe`, this file's `:152`). This rung is a
-  # SECOND COPY of `lane-start`'s rung 4 and of nothing else, and `708395e` gave
-  # that ladder two more: the estate's `project.yaml` legs, and a checkout named
-  # for the lane's recorded home one or two levels under `$PROJECTS_ROOT`, each
-  # PROVED by that directory's own `origin`. The paragraph below this step has
-  # said since then that where those answer "step 5 resolves it and this step
-  # never fires" — and that was not true, because this step fires FIRST: it
-  # refused for EVIDENCE 7's own lane, whose checkout rung 5 or 6 can prove, and
-  # told the operator to name a directory the estate could already find.
-  # So where the DERIVED default is not there, none is passed on: step 5 runs
-  # `lane-start` without `--dir`, the one implementation of clause (c)'s order
-  # answers, and its own exit 2 is the line this step would have printed. Clause
-  # (h) forbids the second implementation the alternative would need here.
-  [ -d "$dir" ] || dir=""
-fi
-```
-
-**A directory the lane's own RECORD names, which is not there → REFUSED**, and the refusal is ONE LINE that
-names the act which RECORDS the directory — not just the flag that gets past this run. A restart that lands
-in the right transcript and the wrong directory loses the repository's `CLAUDE.md` and the lane's memory,
-silently (Evidence 3).
-
-**A DERIVED default that is not there is a different case and is not that refusal.** Nothing was recorded,
-so there is nothing to contradict; `$dir` is left empty and `lane-start`'s own ladder — rungs 2 to 6, three
-of which this step cannot see — answers next. Step 5 passes no `--dir` there, and `lane-start`'s exit 2 is
-this step's refusal, printed once by the command that owns the resolution.
-
-**EVIDENCE 7 is this case, and it is why the refusal must be a refusal.** Measured 2026-09-13T23:01Z: a lane
-whose record predates clause (c) carries `home` and `estate` and **no `dir`**, and whose checkout is nested —
-`opsXfactory-5`, at `~/projects/xFactory/xFactories/OpsxFactory`. `lane-start` derived
-`$PROJECTS_ROOT/<repo>`, found nothing, and **exited 1 behind the launcher's `exec`**: a pane that said
-`[exited]` with the message scrolled past it. So print, verbatim and filled in:
-
-```text
-lane-start --dir <the lane's checkout> <repo> <n>
-```
-
-and say that it RECORDS the directory in the lane's own log, so no later restart on any surface has to be
-told again (Amendment 11 clause (c); nothing is backfilled, Amendment 7(i)). **Do not guess a directory**:
-`lane-start` writes the lane's home from that directory's `origin`, so a checkout that merely has the right
-name re-homes the lane for every `#n` it writes afterwards. `lane-start` itself now tries two further rungs
-before it refuses — the estate's `project.yaml` legs and a checkout of the lane's recorded home one or two
-levels under `$PROJECTS_ROOT`, each **proved by that directory's own `origin`** — so where those answer, step
-5 resolves it and this step never fires.
-
-## 4. The decision — **before** anything is written
-
-```sh
-lread row "'the register has no row for this lane'" register-row "$lane"
-# AND AN EMPTY ANSWER IS A REFUSAL HERE, not a rung: step 4 decides what to
-# WRITE, and `lane-start --no-launch` on a lane-shaped name the register has
-# never carried CREATES a row. A read that answered 8 must not reach it.
-[ -n "$row" ] || { printf 'REFUSED: the register has no row for lane %s. Find it with `lanes`, or open it with `lane-start <repo> <n>` — this skill binds an existing lane and never creates one.\n' "$lane" >&2; exit 1; }
-# `last-session` AND NOT `register-row` ALONE, AND THAT IS RULED RATHER THAN
-# ASSUMED (A11 Addendum 4 ruling 14, ratified "a11 addendum 4 yes": *"`/restart`'s
-# step 4 may read `last-session` (the cell, then the log) rather than clause
-# (f)'s `register-row`, and clause (f) is corrected to say so."*).
-#
-# WHAT IT CHANGES, said rather than left to be found (F-X15). Clause (f) step 4
-# named the last uuid in the PUBLISHED SESSION CELL. `last-session` reads that
-# cell first and falls through to the LANE'S OWN LOG where the cell names none
-# — the session field of its last `PAUSED`/`RESUMED` — so outcome 4(a)'s *"or
-# the cell names no uuid"* stops being reachable for a lane whose log carries
-# one, and 4(b) or 4(c) fires there instead. That is the better answer: a lane
-# whose row was never stamped but whose log records the session it paused in
-# HAS a resume target, and 4(a) would have walked past it into a bind that
-# silently orphaned the transcript. The cost is that two sources answer where
-# the clause named one, which is why it is a ruling and not a preference.
-lread cell_last "'this lane has no resume target'" last-session "$lane"
-```
-
-Compare `$cell_last` with `$CLAUDE_CODE_SESSION_ID`:
-
-- **(a) they MATCH, or the cell names no uuid → step 5.**
-- **(b) they DIFFER and a transcript for `$cell_last` is in the lane's directory** →
-  **print exactly `claude --resume <uuid>` and STOP.** Nothing appended, no window renamed, no stamp, no
-  object line. Outcome `RESUME REQUIRED <lane>` **[0]**.
-- **(c) they DIFFER and that uuid has no transcript here → step 5**, and step 5's report says so and names
-  Amendment 8(d)'s deferral.
-- **`$dir` is empty — the record names no directory and no default exists → (b) CANNOT BE DECIDED AND IS NOT
-  CLAIMED.** That test is a look inside the lane's directory and there is no directory yet. Say so, go to
-  step 5 as (a) and (c) both do, and let `lane-start`'s own rungs resolve it; the report names the uuid step
-  4 read and says the transcript could not be looked for — never (c)'s *"no transcript here"* about a place
-  this skill never looked.
-
-**THE DECISION COMES BEFORE THE BIND, AND THAT IS `R-A11-2`.** Binding first and comparing after makes the
-comparison a **tautology**: `lane-start --no-launch` performs step 3b and the `append-session-id` itself, so
-the cell's last id after it is by construction this session's, and the `RESUME REQUIRED` outcome could fire
-only where that append had been **refused** — the one place printing an old uuid is wrong. Comparing first
-also refuses the contamination clause (d) rule 1 names: a session that is not the lane's lineage must not
-rename the lane's window or stamp its row on the way to telling the operator where the lane actually is.
-
-## 5. The bind
-
-```sh
-lane-start --no-launch ${dir:+--dir "$dir"} "$lane"
-```
-
-`--dir` is passed only where step 3 HAS a directory — the lane's own record, or a default that exists. Where
-it has none, the flag is absent and not empty: `--dir` with an empty value is refused by the two spellings of
-that arm, and passing a directory this skill DERIVED as `--dir` would put a guess at rung 1, the operator's
-own word, in front of the other five rungs `lane-start` reads for itself.
-
-It renames the window, writes the row stamp, Amendment 6(c)'s session-cell append where it can prove the
-window is the lane's, the lane's `RESUMED` object line with clause (c)'s `dir`, `profile` and `window`
-sub-fields, and the handoff's Rule 3 stamp — and it prints the `claude` command on stdout.
-**`/restart` does NOT run that command.**
-
-## 6. The cell — **on 4(c) only**, and only after step 5 exited 0 and renamed the window
-
-```sh
-# THE `profile` SUB-FIELD IS WRITTEN ONLY WHERE THERE IS ONE. No
-# `$CLAUDE_PROFILE_NAME` is a lane started outside the launcher, and inventing
-# `unknown` for it is the same defect clause (e) refuses in the session field —
-# which is the rule `lane-start` states and follows at `:1553-1558`, in this
-# clause's own words: *"each sub-field is appended only where its value is
-# actually in hand"*. The `:-unknown` that was here wrote the one literal the
-# writer refuses, into the one cell Amendment 6(b) resumes from.
-cell="→ harness <this session's uuid> (transcript uuid"
-[ -n "${CLAUDE_PROFILE_NAME:-}" ] && cell="$cell; profile $CLAUDE_PROFILE_NAME"
-"$L" append-session-id "$lane" "<the uuid step 4 read>" "$cell)"
-```
-
-Exit 0 → the cell now names the conversation the operator is in. **Refused → the cell is REPORTED STALE and
-the act is printed verbatim; `RESTARTED` is never printed over a cell that stayed stale.**
-
-**It is `/restart`'s act and not `lane-start`'s, and it is a step that can find its work already done.**
-Under clause (d) rule 1 as corrected, `lane-start` takes the window's live session **unless a veto fires** —
-so on the 4(c) path there are two cases and not one. Where the helper carries both reads, neither veto has
-anything to fire on (step 2(b) already answered 8, so no row's cell names this session; and the window's name
-is not yet the lane, because `lane-start` renames it a hundred lines **after** step 3b), and `lane-start`
-performs Amendment 6(c)'s append **itself** — step 6 then finds the cell already naming this session and
-appends nothing. Where the helper does **not** carry them, `lane-start` leaves the cell alone and step 6 is
-the act that extends it: a helper predating `session-lane` exits 2 and the fence fails closed, which is the
-state of every workstation until adoption act 0's read reaches it. Either way `/restart`
-has the proof already: step 2 resolved this window to this lane out of the register, and step 4 read the
-anchor out of the published cell. The cell is **appended to**, never replaced — Amendment 6(c)'s own act, so
-the old id stays in the row as history.
-
-Where the row records **no** uuid at all there is no anchor to append to: `lane-start` prints its own hint,
-`/restart` passes that hint through **verbatim**, prints no `--resume` beside it, and reports the same
-outcome.
-
-## 7. The name — the last line, and the one act it ever asks for
-
-Where the harness's record name for **this** session is not `<lane>`, the **last** line printed is:
-
-```text
-/rename <lane>
-```
-
-**Printed, never run.** There is no API to rename a running session from inside. Evidence 4: this lane's
-transcript carries `customTitle: openRepoProject-1`, set once by `/rename`, while every process that resumed
-it through a bare `claude --resume <uuid>` carried a **derived** record name — `openrepoproject-b9`, `-1e`,
-`-27`, `-45` — and the derived name is what the statusline's `session_name` and `ListAgents` display.
-Amendment 8(e)'s `SessionStart` hook prints the same line where the record's name differs from the lane, for
-the session that never runs `/restart` at all. It is not a question and not a choice: there is exactly one
-lane and exactly one spelling of it.
-
-## The outcomes
-
-A skill has no process exit status, so these are the words `/restart` prints; the helper codes it read are in
-brackets, on Amendment 7(d)'s fail-closed convention. **`3` is not among them**, because `lanes-edit.sh`
-already uses 3 for an unpushed commit or a rebase conflict and a code that already means something else is a
-code a caller cannot act on.
-
-| outcome | when | what is printed |
-|---|---|---|
-| `RESUME REQUIRED <lane>` **[0]** | 4(b) | exactly one line, `claude --resume <uuid>`, and stop. Nothing is written. |
-| `RESTARTED <lane>` **[0]** | 4(a) with step 5 at 0; or 4(c) with step 5 at 0 **and** step 6 extending the cell | the lane, the window, the directory, and the `claude` command step 5 printed and `/restart` did not run. On 4(c), two further lines: that the recorded session has no transcript here, naming Amendment 8(d)'s deferral, and that the cell now names this session |
-| `RESTARTED <lane>, CELL STALE` **[8]** | step 5 at 0, but step 6 was refused **or** the row records no uuid to anchor to | everything the `RESTARTED` row prints, plus the exact `append-session-id` act verbatim and which of the two cases it is. **8**, not 0: the bind happened and one fact is still missing |
-| `NO LANE FOR THIS WINDOW` **[8]** | **every** rung of step 2 answered **8** or **2** | the per-repo listing, and `lane-start --no-launch <repo> <n>` filled in from the window's own name where it parses |
-| `REFUSED: <reason>` **[2]** | no tmux, no directory, a `<lane>` the register does not carry, or step 5 exited 2 | the reason, and the helper's own stderr verbatim |
-| `REFUSED: <reason>` **[1]** | any other non-zero from any helper, step 4's read included | which read failed, and its stderr |
-
-**Step 3b's fence is TWO VETOES and no permission, and `/restart` never trips either.** When step 5 runs
-`lane-start --no-launch`, that script decides whether to learn the uuid live in this window. Its fence is the
-**register veto** — a uuid that belongs to another row is never taken, read through `session-lane` and
-fail-closed — and the **window-name veto**: a window named for another lane never lends its session. Neither
-the window's name being the lane nor `live-holder` answering `here` is a *condition for taking*, because at
-step 3b the window is usually still called `claude` and there is no holder here (`R-A11-12`, which corrects
-`R-A11-1` a second time). `/restart` reaches step 5 only after step 2 resolved this window to this lane out
-of the register and step 4 compared the ids, so by then neither veto has anything to fire on — which is why
-step 6 is `/restart`'s act and not `lane-start`'s.
-
-**A live FORK of this lane's transcript is a defect, and it is named wherever this skill meets one**
-(ratified decision 8(e), from Evidence 6). `"$L" forks <lane>` lists them, one `<uuid> <pid> <kind> <cwd>`
-per fork. A fork is never the holder and must never write the register, and the ONE act is clause (k) rule
-(e)'s — **`lane-end <lane> --retire <pid|uuid>`**, typed by a person. It is the DOOR to Amendment 6(d)'s
-retire act, not a record of one: it proves the pid or uuid is this lane's live fork and prints 6(d) filled
-in — the `/rename <lane> · retired <date>` for a session with a prompt, 6(d)'s *"an idle background session
-still holding a lane name is ended"* for a `kind: bg` holder that has none. It writes **nothing** (a
-`RETIRED` carrying a payload would be a seventh edit to in-force text, and Amendment 7(b) gives that verb
-none) and it does **not** kill the process, because ending somebody's process is not a tool's act
-(Amendment 8(f)). This skill used to print `kill <pid>` here, which is the act the ruling says neither
-surface prints.
-
-**`/restart` binds a window. It does not choose a conversation.** Those are two questions and this skill
-answers only the first; the second is Amendment 6(b)'s and stays there.
diff --git a/spec b/spec
new file mode 160000
index 00000000..64a1a989
--- /dev/null
+++ b/spec
@@ -0,0 +1 @@
+Subproject commit 64a1a989fe7b04daf3bc2a236739a01f0aa7291a
diff --git a/specs/002-skip-no-lane-guard/plan.md b/specs/002-skip-no-lane-guard/plan.md
deleted file mode 100644
index f41d2fe1..00000000
--- a/specs/002-skip-no-lane-guard/plan.md
+++ /dev/null
@@ -1,7 +0,0 @@
-# Implementation Plan
-
-Governance: `openspec/changes/skip-no-lane-guard/`.
-
-Add an exact-value early exit before script initialization using Bash 3.2 syntax, preserving global option parsing and status-2 argument validation. Update the scope documentation and repository contract. Add subprocess regression coverage against isolated home/config directories and sentinels for tmux, git, hostname, readlink and workspace parsing. Verify with `tests/run.sh -k guard_launch_mode`, Bash syntax checks and `openspec validate skip-no-lane-guard --strict`.
-
-Dependency: workBenches feature `017-export-no-lane-mode` supplies and clears the process marker. Installed estate commands and vendored pins use their existing release paths.
diff --git a/specs/002-skip-no-lane-guard/spec.md b/specs/002-skip-no-lane-guard/spec.md
deleted file mode 100644
index 83f49ae8..00000000
--- a/specs/002-skip-no-lane-guard/spec.md
+++ /dev/null
@@ -1,30 +0,0 @@
-# Feature Specification: Skip the guard for no-lane sessions
-
-**Feature Branch**: `002-skip-no-lane-guard`
-**Created**: 2026-09-30
-**Status**: Approved for implementation by the user's request
-**Input**: Implement the agreed per-session no-lane hook exemption.
-
-## User Scenarios & Testing
-
-### User Story 1 - Work without a lane (Priority: P1)
-
-A profile session submits prompts even inside a projects directory with no tmux or readable lane workspace. Test the guard with the launch marker and missing lane infrastructure.
-
-### User Story 2 - Keep lane enforcement (Priority: P1)
-
-A lane session must still satisfy the existing identity checks. Test absent and unsupported marker values against the same missing-workspace fixture and expect status 2.
-
-## Requirements
-
-- **FR-001**: Exact `CLAUDE_NO_LANE=1` bypasses only the prompt guard, silently and before reading hook input.
-- **FR-002**: Absent or unsupported values retain the existing checks.
-- **FR-003**: Exempt prompts cause no lane record or tmux mutation.
-- **FR-004**: Keep shared profile hooks installed.
-- **FR-005**: Marked guard invocations avoid workspace, git, workstation and command-path probes, including when global flags are present; invalid guard arguments still return status 2.
-
-## Success Criteria
-
-- Exempt prompt fixtures return status 0 with empty stdout and stderr.
-- Non-exempt fixtures refuse unreadable lane identity with status 2.
-- Other lane commands still refuse missing workspace configuration.
diff --git a/specs/002-skip-no-lane-guard/tasks.md b/specs/002-skip-no-lane-guard/tasks.md
deleted file mode 100644
index 9fbf0573..00000000
--- a/specs/002-skip-no-lane-guard/tasks.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Tasks
-
-- [x] T001 Add the guard exemption and document its scope.
-- [x] T002 Add regression cases for exact marker handling, unreadable identity and unaffected non-guard commands.
-- [x] T003 Run focused tests, syntax checks and governance validation; record results.
-
-## Verification
-
-- The canonical focused CI command `bash tests/run.sh -k 'guard_launch_mode or repo_hygiene'` passed 165 checks, with 528 deselected, on implementation commit `64f4e93`. This includes all 13 expanded launch-mode cases and proves marked prompts do not invoke identity probes.
-- The launcher/guard end-to-end smoke check passed: a profile-only launch exports the marker and permits its prompt, while an unmarked guard still refuses unreadable identity with status 2.
-- Changed shell files pass `bash -n`; diff whitespace checks and strict OpenSpec validation pass.
-- Windows checks and macOS Bash 3.2 syntax parsing passed. The focused CI runner honors the same wrapper and serialization rules as local runs.
diff --git a/specs/003-binary-only-guard-runner/plan.md b/specs/003-binary-only-guard-runner/plan.md
deleted file mode 100644
index 7064e6a1..00000000
--- a/specs/003-binary-only-guard-runner/plan.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Plan
-
-Add pip's `--only-binary=:all:` flag to the focused guard job, preserving the
-pinned runner version and canonical test wrapper. Validate through that focused
-CI job and Sonar analysis. This is an implementation correction within the
-existing guard change, so it adds no separate OpenSpec governance proposal.
diff --git a/specs/003-binary-only-guard-runner/spec.md b/specs/003-binary-only-guard-runner/spec.md
deleted file mode 100644
index 80b87e7f..00000000
--- a/specs/003-binary-only-guard-runner/spec.md
+++ /dev/null
@@ -1,6 +0,0 @@
-# Feature: Install the focused guard test runner from wheels
-
-Follow-up to feature `002-skip-no-lane-guard` and PR #135. A late Sonar review
-flagged the new focused job's ability to execute package source build scripts.
-Require binary distributions for its pinned pytest installation. Runtime guard
-behavior and vendored command bytes do not change.
diff --git a/specs/003-binary-only-guard-runner/tasks.md b/specs/003-binary-only-guard-runner/tasks.md
deleted file mode 100644
index c999c81f..00000000
--- a/specs/003-binary-only-guard-runner/tasks.md
+++ /dev/null
@@ -1,8 +0,0 @@
-# Tasks
-
-- [x] T001 Restrict the focused test-runner installation to binary distributions.
-
-## Verification
-
-The diff changes the new focused job's install command only. CI verifies the
-wheel installation and reruns the same canonical 165-check guard/hygiene suite.
diff --git a/specs/004-migrate-to-triad/adopter-blocker.md b/specs/004-migrate-to-triad/adopter-blocker.md
deleted file mode 100644
index d10580b3..00000000
--- a/specs/004-migrate-to-triad/adopter-blocker.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Pinned adopter refuses an existing submodule split
-
-**Upstream:** opensoft/openRepoShape, pinned revision
-`39d5c986fcfac1a160474bfe91c5f1c37fccc72c`.
-**Consumer:** openRepoTools main
-`daed20957f2dd2f22cca24053bb5bc8636ff6b3f`.
-**Measured:** October 4, 2026; disposable local remotes only.
-
-**October 6 update:** a fix is published in draft
-[openRepoShape PR #162](https://github.com/opensoft/openRepoShape/pull/162).
-The [candidate rehearsal](adopter-rehearsal.md) passes against current consumer
-main. The unchanged pinned revision still has the refusal documented below;
-upstream landing and a tested consumer pin update remain pending.
-
-The reviewed mapping moves the existing `.gitmodules` together with
-`upstream/openRepoShape` and its dependency contract into code. Plan `check`
-passes. Both filtered legs are created, then assembly mounting returns 2:
-
-```text
-REFUSED a git or gh command failed. THE EXACT COMMAND WAS:
-    git -c protocol.file.allow=always submodule add -q <local-spec-worktree> spec
-    (in <local-assembly-worktree>)
-    exit 128
---- output ---
-fatal: please make sure that the .gitmodules file is in the working tree
---- end output ---
-```
-
-`adopt-project.py`'s `_mount_the_legs` (line 1201 at this pin) removes moved
-paths with `git rm`, then immediately invokes `git submodule add`. `.gitmodules`
-is among the moved files; its tracked deletion is still staged when the new
-submodule registration is attempted. The root index contains only the six
-original front-door files at refusal. The generated assembly registrations
-have not been created. Git's missing-file guard is the observed failure; no
-assumption about nested dependency correctness substitutes for this evidence.
-
-## Reproduction for upstream review
-
-Use a fresh isolated clone of the consumer at the recorded commit, a copy of
-the resolved [adoption plan](../../openspec/changes/migrate-to-triad/adoption-plan.yaml),
-git-filter-repo 2.47.0, and empty disposable local directories:
-
-```sh
-python3 <pinned-shape>/adopt-project.py check \
-  --source <isolated-source> --plan <copied-plan>
-python3 <pinned-shape>/adopt-project.py execute \
-  --source <isolated-source> --plan <copied-plan> \
-  --local-remote-dir <fresh-local-remotes> \
-  --work-dir <fresh-local-work-dir> --yes
-```
-
-The yes here covers the reviewed local test only. Never use the live consumer
-as `--source` for this reproduction: local mode still pushes an adoption
-branch to its source clone if execution reaches that step.
-
-Expected behavior: preserve the original registration in code, create fresh
-assembly registrations for spec/code, complete source accounting, and retain
-the dependency gitlink/contract identity. The source repository must remain
-unchanged if execution refuses.
-
-The upstream regression should cover a populated existing submodule, its
-registration explicitly assigned to code, the generated assembly registrations,
-recursive clone/bootstrap, exact mode/object accounting, and failure recovery.
-Also cover partial registration ownership and no-existing-module inputs so a
-fix cannot silently erase retained registrations or create duplicate owners.
-
-At the October 4 measurement no upstream issue or PR had been published and
-no patch was applied to the pinned checkout or failing candidate. The October 6
-candidate is maintained in its own upstream worktree. Resolve through normal
-review, then bump to a commit on its main and recompute the dependency digest.
-Repeat the consumer rehearsal with fresh remotes after repinning. Gate B still
-requires the reviewed upstream fix and the remaining integration work, even
-though the separate candidate rehearsal now succeeds.
-
-Private execution log SHA256:
-`ca2a11775ca3b6d179fc038436a28090f65b05feb2a1611d4578b315733b5168`.
diff --git a/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-07.md b/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-07.md
deleted file mode 100644
index 218d5fa0..00000000
--- a/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-07.md
+++ /dev/null
@@ -1,229 +0,0 @@
-# Gate B rehearsal with the merged adopter fix — October 7, 2026
-
-**Task:** T003–T005 rehearsal evidence under [#186](https://github.com/opensoft/openRepoTools/issues/186).
-No task is checked complete by it.
-**Tool:** openRepoShape `7f84ca42ca86a8902928345109d2bf6bad87bd91`, the merged
-[PR #162](https://github.com/opensoft/openRepoShape/pull/162) adopter fix on its
-`main` (`compare main...7f84ca4`: `identical` at measurement).
-**Rehearsal sources:** run A, main `c4864ac5e59db49d01f638a80ed38daf1d788182`;
-run B, the repin candidate `chore/openreposhape-pin-7f84ca4`
-([#188](https://github.com/opensoft/openRepoTools/pull/188)) at
-`e43b2432976a22eb3bf8c419c96209399251d375`, whose only change from `c4864ac`
-is the `upstream/openRepoShape` gitlink and its contract, both now at `7f84ca4`.
-**Private receipt ID:** `adopter-fix-20261007-iM20tv`.
-
-The [October 6 rehearsal](adopter-rehearsal.md) ran the draft candidate
-`91d5685`. This run uses the fix as merged, which is the repeat
-[adopter-blocker.md](adopter-blocker.md) asks for after repinning. It uses fresh isolated clones
-and fresh disposable local remotes. Clone paths, local remote URLs, exact command lines
-and complete logs stay in the private receipt.
-
-## Setup
-
-- `git-filter-repo` 2.47.0 in a private venv for this rehearsal only. The
-  `pip download` wheel SHA256 is
-  `2cd04929b9024e83e65db571cbe36aec65ead0cb5f9ec5abe42158654af5ad83`, matching
-  the value recorded in [preparation.md](preparation.md).
-  `git filter-repo --version` printed `a40bce548d2c`.
-- The tool is a fresh clone of openRepoShape checked out at `7f84ca4`. Nothing
-  in it was edited. The first `plan` run left an ignored `scripts/__pycache__/`,
-  which was removed; bytecode writing stayed off after that. The clone was
-  clean, ignored files included, after both runs.
-- Each source is a fresh `--single-branch` clone with one worktree and no
-  linked worktrees. The source's nested `upstream/openRepoShape` was **not**
-  initialized: the tool's adoption documentation does not ask for it, and
-  `plan`, `check` and `execute` read the source through `ls-tree` and
-  non-recursive clones.
-- Git transport was restricted to local files (`GIT_ALLOW_PROTOCOL=file`);
-  `gh` and `curl` shims first on `PATH` logged and refused every call. No
-  call was logged during `plan`, `check`, `execute`, the recursive clone or
-  bootstrap. The recursive clone reached code's nested openRepoShape through a
-  local URL rewrite to a bare mirror of the tool clone.
-- Read-only lookups of `opensoft/openRepoTools-spec` and `-code` returned
-  HTTP 404: not visible to the current credentials, which is not a guarantee
-  of name availability or creation permission. Recheck at Gate C.
-
-## Mapping (T003)
-
-`plan` ran against each source with the committed plan's recorded election
-values (`--org opensoft --visibility public --elected-by "Brett Heap"
---elected-on 2026-10-04`). It left 18 paths unresolved: `.gitmodules`,
-`upstream/`, `repos.tsv` and fifteen executables. All 19 reasoned overrides of
-the [October 4 mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml)
-were reapplied with their resolution text unchanged. Sixteen answer those
-questions; three override the tool: `commands/` and `skills/` (installed
-Markdown payloads) and `contracts/` (only the dependency lock) go to code.
-
-Paths new since the October 4 source `daed209` (36 files) and the October 6
-source `f5444c5` (6 files) were resolved by the same rules:
-
-| New path | New since | Leg | Reason |
-| --- | --- | --- | --- |
-| `lane-worktrees` | `f5444c5` | code | Executable lane command in the installer's `INSTALLABLES`; the committed executable resolution text. |
-| `lanes-index` | `daed209` | code | Same, as the October 6 rehearsal assigned it. |
-| `ideation/` (12 files) | `daed209` | spec | The tool already says spec; a resolution line records the review. |
-| 11 files under `openspec/changes/` | `daed209` | spec | Covered by `openspec/`. |
-| 4 files under `specs/005-supervised-legacy-ctx/` | `daed209` | spec | Covered by `specs/`. |
-| 7 test files under `tests/` (5 since `f5444c5`) | `daed209` | code | Covered by `tests/`. |
-
-No bounded `features/<NNN>/openspec/` amendment paths exist, so none are
-recorded. Nothing is dropped. The follow-ups are the tool's own
-`follow_ups_for()` re-derived over the resolved entries (19), then the October
-4 plan's ten reasoned follow-ups. One stale count in them changed: "64-file"
-became the current source's file count. `check` printed `plan ok` and exited
-0 for both runs.
-
-## Run A — current main `c4864ac`
-
-`execute --local-remote-dir … --work-dir … --yes` exited **0** and printed
-`adoption verified: every source path is in exactly one place`.
-
-| Source accounting (the standard's table) | Original entries |
-| --- | ---: |
-| Spec | 45 |
-| Code | 49 |
-| Assembly root | 6 |
-| Dropped | 0 |
-| Total | 100 |
-
-The standard reported 18 added assembly paths: `project.yaml`, `Makefile`,
-`AGENTS-shape.md`, `.github/workflows/validate.yml`, four `contracts/`
-files (`code-pin.yaml`, `spec-pin.yaml`, `shape-pin.yaml`,
-`repository-naming.yaml`), five `scripts/` files and five collision copies
-under `shape/` (`.gitattributes`, `.gitignore`, `AGENTS.md`, `CLAUDE.md`,
-`README.md`). The assembly also holds the two leg gitlinks and a fresh
-`.gitmodules`, which its table does not count as added.
-
-An independent comparison matched **path, mode, object type and object ID**
-for all 100 entries of `ls-tree -r c4864ac`: 45 spec, 49 code, 6 root, with
-zero missing owners, zero duplicate owners and zero owners that differ from
-the plan's leg. Neither leg holds an entry that is not in the source. The
-`160000` gitlink `upstream/openRepoShape` at `39d5c98` has exactly one owner,
-code. The original `.gitmodules` blob is in code; the assembly's new one is
-a different blob.
-
-| Disposable repository | Commit | Kept commits |
-| --- | --- | ---: |
-| Spec | `558a12b674008bc9129e4f5438cdff42053963da` | 34 |
-| Code | `48d98cd8793493646adb71163eac15b56fffee9c` | 87 |
-| Assembly split | `9e5f934e98122c5da37428b064e044e807c9680e` | — |
-
-The split commit's only parent is `c4864ac`. A recursive clone of the split
-branch passed. The generated `scripts/bootstrap.py` exited 0 (`bootstrap ok`),
-and its naming, manifest and pins checks passed. The three validators also
-passed when run on their own. The assembly, both legs and the nested
-dependency were clean afterwards. Code's nested openRepoShape was checked out
-at `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`, matching code's
-`contracts/openreposhape-pin.yaml`. That checkout's own `scripts/repo_shape.py`
-recomputed the tree digest as
-`a44c0165beb9d3b6ddfce46925bf04b8d19934d5327b5a304b5f3f11af699b02`, which
-matches the contract.
-
-The source clone's `HEAD`, `status --porcelain --ignored`, existing refs, local
-configuration and worktree list were unchanged. Local mode added one ref, as
-documented: `refs/heads/adopt/three-repo-shape`, which points at the split
-commit. The live checkout gained no `adopt/` ref.
-
-## Run B — the repin candidate `e43b243`
-
-`plan` produced the same 18 open questions. The resolved mapping is the same
-as run A's, with the same 22 decisions and follow-ups and the same
-45/49/6 split. It differs only in the source fields: commit, `commits: 91`,
-and `default_branch: chore/openreposhape-pin-7f84ca4`. A single-branch clone
-of that branch has no `origin/HEAD`, so the tool takes the checked-out branch
-as the default. `check` passed. `execute` exited **0** and printed
-`adoption verified: every source path is in exactly one place`.
-
-| Source accounting (the standard's table) | Original entries |
-| --- | ---: |
-| Spec | 45 |
-| Code | 49 |
-| Assembly root | 6 |
-| Dropped | 0 |
-| Total | 100 |
-
-The standard again reported 18 added assembly paths, the same set as in
-run A. The independent path/mode/type/object comparison of all 100 entries
-of `ls-tree -r e43b243` found 45 spec, 49 code and 6 root owners. It found
-zero missing, duplicate or misplaced owners and no leg extras. The gitlink
-`upstream/openRepoShape` at `7f84ca4` has exactly one owner, code.
-
-| Disposable repository | Commit | Kept commits |
-| --- | --- | ---: |
-| Spec | `558a12b674008bc9129e4f5438cdff42053963da` | 34 |
-| Code | `6d5216292186b5b2d2e4daa08afa3dd4580db80f` | 88 |
-| Assembly split | `2726d3a935369c18472623b904c21ca3a825d09b` | — |
-
-The spec leg is the same commit as in run A, because its paths and their
-history did not change. Code has one more kept commit: the repin. The split
-commit's only parent is `e43b243`. The recursive clone,
-`scripts/bootstrap.py` (`bootstrap ok`) and the three validators all passed.
-Every tree was clean afterwards. Code's nested openRepoShape was checked out
-at `7f84ca42ca86a8902928345109d2bf6bad87bd91`, matching code's
-`contracts/openreposhape-pin.yaml`. The pinned checkout's own
-`scripts/repo_shape.py` recomputed
-`3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8`, which
-matches the contract. Code still holds the source's original `.gitmodules`
-blob, `8043147a`. The source clone was unchanged except for the one new ref
-`refs/heads/adopt/three-repo-shape` at the split commit.
-
-## Notes for review
-
-- The regenerated follow-ups list nine code files that name `docs/`. The
-  ninth, shown as "… and 1 more", is `tests/test_repo_hygiene.py`. Three code
-  files name `openspec/`: `lane-handoff` is new since the October 4 list, at a
-  `:2439` comment that cites the supervised-restart design. One file names
-  `specs/`. Neither `lane-worktrees` nor `lane-end` names a spec-leg
-  directory, so neither needs a follow-up.
-- On this branch, the
-  [mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml) is
-  the regenerated run B plan, with a header saying what it is. The October 4
-  version is unchanged in history at `ff6f6a7`. [plan.md](plan.md),
-  [quickstart.md](quickstart.md) and [preparation.md](preparation.md) still
-  describe the October 4 version; the plan's owner decides when to refresh
-  them.
-- *Dated 2026-10-09 (#193 item 8):* since #192, the mapping link above opens
-  run C's plan ([adopter-rehearsal-2026-10-08.md](adopter-rehearsal-2026-10-08.md)),
-  and run B's stays in history at `63810dd`. #188 landed as `837928a`. The
-  bench restart of 2026-10-08 cleared both runs' disposable repositories, so
-  their logs survive only in this file's receipt. Run C's legs still carry
-  `558a12b` and `48d98cd`, as the parents of their heads.
-- Each run used a fresh, empty `--local-remote-dir` and `--work-dir`. Without
-  the first, `execute` calls `gh repo create`. The plan's
-  `execution_authorized: false` is informational and the tool does not read it.
-- The published plan differs from the executed run B plan in only three ways:
-  the header, `local_path: .` instead of the scratch path, and the October 4
-  file's two closing status fields. `check` against the published copy also
-  passed.
-
-## Private log SHA256s
-
-- Run A execute: `885fa0d0f8b00513536683bafcf355ca15e2d26c34908935675c5898361f73a0`.
-- Run A bootstrap: `e5d06e2e406d1b6ddae1dceb0b17004ce615c3d044cee4cb36828abdf27949fc`.
-- Run A independent comparison: `9ae2fa322360b705761a9ca628a265c610cd7dceaaf29fc369fb1576cc84c5de`.
-- Run B execute: `e894b78e1ca4b4ba8a95b2b5d2be428fa30d4a75b894ce48d90a550b0de78839`.
-- Run B bootstrap: `6a010feb6a56b190690a097af396a94f29802ef125bf6c544afe0f807c557c0f`.
-- Run B independent comparison: `fe933dd169375fb62a09967efb89fcac014d0c8d96868f0d007d0c1ed060a46b`.
-
-The receipt holds every log with its SHA256. None was over 2 MB, so none was
-trimmed.
-
-## Remaining gates
-
-**Gate B is not complete.** This evidence covers the extraction, accounting,
-nested-pin and bootstrap parts of T003–T005 for both sources. T005's pin
-bump is PR #188, which still follows the usual landing rules. T006–T011
-remain open:
-
-- root collisions and leg guidance;
-- the installer entry point;
-- composed tests and CI;
-- the restore and rollback rehearsal.
-
-Gate A preservation must be refreshed at a coordinated breakpoint. Before
-Gate C, regenerate the plan from the frozen source that is actually chosen.
-Brett Heap's explicit Gate C approval must name the revisions, the leg
-repositories, their visibility and the final plan.
-
-This evidence authorizes no real conversion, repository creation, merge,
-default-branch move or lane rebinding.
diff --git a/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-08.md b/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-08.md
deleted file mode 100644
index 2bf0d970..00000000
--- a/specs/004-migrate-to-triad/adopter-rehearsal-2026-10-08.md
+++ /dev/null
@@ -1,204 +0,0 @@
-# Gate B rehearsal, run C, at the post-landing source — October 8, 2026
-
-**Task:** T003–T005 rehearsal evidence under [#186](https://github.com/opensoft/openRepoTools/issues/186).
-No task is checked complete by it.
-**Tool:** openRepoShape `7f84ca42ca86a8902928345109d2bf6bad87bd91` on its `main`
-(`compare main...7f84ca4`: `identical` at measurement).
-**Source:** main `837928a1029ac53b050a9bdcbc0ef4055b10719b`, read with `git ls-remote`
-at 2026-10-08T20:54:21Z just before cloning. It is `c4864ac` plus #187, the
-planning documents squashed as `44983ce`, and #188, the repin to `7f84ca4`
-squashed as `837928a`.
-**Private receipt ID:** `adopter-fix-20261008-1HztL0`.
-
-**Run C supersedes nothing.** Runs A (`c4864ac`) and B (the repin candidate
-`e43b243`) stand as recorded in
-[adopter-rehearsal-2026-10-07.md](adopter-rehearsal-2026-10-07.md). That file
-is on branch `004-migrate-to-triad-rehearsal` and reaches main with the
-combined evidence PR. Run C is the same rehearsal, with the same tool and the
-same resolutions, at the source that now exists after both landings. It is
-also the durable rehearsed arrangement that T006–T010 take as input. It is
-kept host-local outside every repository so it survives a bench restart.
-Clone paths, local remote URLs, exact command lines and complete logs stay in
-the private receipt.
-
-**Dated 2026-10-09, after #192 landed (#193 items 8 and 13):**
-
-- **Where the records are.** #192 brought this file and run C's plan to
-  main. The 2026-10-07 record has been on main since #189 (`63810dd`), not
-  on a branch as the paragraph above says.
-- **What run C superseded.** No record: runs A and B stand as recorded. Its
-  plan did replace run B's as the
-  [mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml), on
-  main in #192's squash `1abee1d`. (On #192's branch it was merge `1a26463`,
-  which main does not contain.) On main that link opens run C's plan from
-  both records.
-  So "On this branch" in the mapping section below holds for main, and the
-  2026-10-07 record's "On this branch, the mapping is the regenerated run B
-  plan" held only on its own branch. Run B's plan stays in history at
-  `63810dd` (blob `f1067e3`). Neither plan is the cutover plan.
-- **Runs A and B are gone from the bench.** The bench restart of
-  2026-10-08, at about 09:45Z, cleared `/tmp` (#186 comment 6068861167).
-  Both runs were built in a session scratch directory there, as the
-  2026-10-07 receipt's README records, so their disposable repositories are
-  gone and their logs survive only in that receipt. Two of their commits
-  live on in run C's legs: `558a12b`, the spec head of runs A and B, is the
-  parent of run C's spec head, and `48d98cd`, run A's code head, is the
-  parent of run C's code head. The splits `9e5f934` and `2726d3a`, run B's
-  code head `6d52162` and the local remotes are gone. That is why run C is
-  kept host-local.
-- **An observation left out.** The run C comment on #186 (6068938765)
-  noted that `openspec validate migrate-to-triad --strict` with `openspec`
-  1.2.0 fails on pristine `837928a` too (`ADDED "Installation retains the
-  public interface and one revision" must contain SHALL or MUST`), so run C
-  does not cause it. Lane 2's bench had `openspec` 1.13.1 (read on
-  2026-10-09, #186 comment 6088829392 item 8, and again on 2026-10-10,
-  6103482530). On 2026-10-09 the same command exited 0 on `837928a` and on
-  `71b05cb`, #192's head, whose tree its squash `1abee1d` carries unchanged.
-  *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 9): this note first
-  said "The bench's `openspec` is now 1.13.1", as if one version held on every
-  host. The version depends on the container. On lane 3's host on 2026-10-11 at
-  00:1xZ, `which -a openspec` lists a user-level npm install first, at 1.2.0,
-  and the system install second, at 1.6.0. The validate command above exits 1
-  under 1.2.0 (the SHALL or MUST error) and 0 under 1.6.0. So the result follows
-  which `openspec` comes first on the reader's `PATH`. Lane 1's walk records
-  the same split
-  ([gate-b-status-2026-10-09.md](gate-b-status-2026-10-09.md), section 4 (a)).*
-
-## Setup
-
-- **filter-repo:** `git-filter-repo` 2.47.0 from a private venv.
-  `python3 -m venv` refused with
-  `The virtual environment was not created successfully because ensurepip is
-  not available.` So the venv was created with `--without-pip`. The wheel
-  came from `pip download` with SHA256
-  `2cd04929b9024e83e65db571cbe36aec65ead0cb5f9ec5abe42158654af5ad83`, matching
-  the recorded value. That exact file was installed into the venv with
-  `--no-index`. The venv's `git-filter-repo` came first on `PATH`, and
-  `git filter-repo --version` printed `a40bce548d2c`.
-  - *Corrected 2026-10-09 (#193 item 12):* this bullet first gave the cause
-    as "the rebuilt bench has no `ensurepip`", and the bench contradicts it.
-    Its dpkg log has `python3-venv` and `python3.12-venv` installed on
-    2026-09-23 at 00:18:06Z, before the 2026-10-08 boot.
-    `/usr/bin/python3 -m ensurepip --version` prints `pip 24.0`, and
-    `/usr/bin/python3 -m venv` succeeds (lane 2, #186 comments 6072333212
-    and 6072724043; measured again on 2026-10-09). The refusal itself is
-    real: the receipt's setup log records it. Its cause is not established.
-    The `python3` the writer ran was the first on its `PATH`: the venv's
-    `pyvenv.cfg`, in run C's host-local arrangement, records a user-local
-    `python3` based on `/usr/bin/python3.12`. That entry is no longer on
-    the bench, so the refusal cannot be retried as it ran.
-- **Tool and source:** a fresh clone of openRepoShape at `7f84ca4`, unedited
-  and clean afterwards, ignored files included. A fresh `--single-branch`
-  clone of main, with one worktree and no linked worktrees. Its nested
-  `upstream/openRepoShape` was not initialized.
-- **Transport:** limited to local files (`GIT_ALLOW_PROTOCOL=file`). `gh` and
-  `curl` shims refused and logged; no call was logged. The recursive clone
-  reached code's nested openRepoShape through a local mirror of the tool clone.
-
-## Mapping (T003)
-
-Since the run B source, the tree gained 20 files and no new top-level path:
-
-- 13 under `specs/004-migrate-to-triad/`;
-- 6 under `openspec/changes/migrate-to-triad/`, including the October 4
-  `adoption-plan.yaml` itself;
-- `openspec/config.yaml`.
-
-The pin change is the one run B already carried; its contract blob is
-identical. `plan` left the same 18 questions. All 22 resolutions of the run B
-plan were reapplied verbatim: the October 4 mapping's 19, plus
-`lane-worktrees` and `lanes-index` to code and `ideation/` to spec. Every
-other entry kept the tool's leg, unchanged from run B. The 20 new files are
-spec through the existing `openspec/` and `specs/` entries.
-
-The tool's follow-ups, re-derived over the resolved entries, are identical to
-run B's. The ten reasoned follow-ups are unchanged except the source file
-count, now 120. `check` printed `plan ok` for the executed plan and again
-for the published copy. On this branch the
-[mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml) is that
-published copy. It differs from the executed plan only by its header,
-`local_path: .`, and the two closing status fields
-(`execution_authorized: false`).
-
-*Added 2026-10-09 (#193 item 10):* `check` validates against the source
-clone's local `main`, not its `HEAD`. In openRepoShape `7f84ca4`'s
-`adopt-project.py`, `_default_branch` (:288) takes the branch name from
-`origin/HEAD`, and `git rev-parse` of that name (:256-257) is the commit
-compared with the plan's source commit (:1026-1032). This plan therefore
-passes `check` only in a clone whose local `main` is `837928a`. Against any
-newer `main` it exits 1 with `FINDING plan-stale: the plan was written
-against 837928a1029a but main is now at …`, whatever `HEAD` is checked out.
-That includes main once this plan is on it: a plan cannot name the commit
-that carries it. Measured on 2026-10-09 with this plan and a fresh clone,
-local `main` at `63810dd` gave that finding and exit 1, also with `HEAD`
-detached at `837928a`. Local `main` moved to `837928a` gave `plan ok` and
-exit 0, also with `HEAD` detached at `63810dd`.
-
-## Run C — main `837928a`
-
-`execute --local-remote-dir … --work-dir … --yes` exited **0** and printed
-`adoption verified: every source path is in exactly one place`.
-
-| Source accounting (the standard's table) | Original entries |
-| --- | ---: |
-| Spec | 65 |
-| Code | 49 |
-| Assembly root | 6 |
-| Dropped | 0 |
-| Total | 120 |
-
-The standard reported 18 added assembly paths, the same set as runs A and B.
-An independent comparison matched path, mode, object type and object ID for
-all 120 entries of `ls-tree -r 837928a`: 65 spec, 49 code and 6 root. It
-found zero missing, duplicate or misplaced owners and no leg extras. The
-gitlink `upstream/openRepoShape` at `7f84ca4` has exactly one owner, code.
-
-| Disposable repository | Commit | Kept commits |
-| --- | --- | ---: |
-| Spec | `593250d600ca291f610671d993c2a6fc36cd690e` | 35 |
-| Code | `73b04d637634f897ad24e22ee4c12bed287172d6` | 88 |
-| Assembly split | `69b89245029d0339afd3317df7c9b1b3bbaf7fc1` | — |
-
-Spec gained one kept commit, the planning squash. Code's tree digest
-`b4940a13bd8ecbe2d1c6ed49368d1545d1a5f1f7a92623c7fe11ac1cb3617604` has the
-same prefix run B recorded. Only the code commit identities differ, because
-the repin landed as a different commit. The split commit's only parent is
-`837928a`.
-
-The recursive clone, `scripts/bootstrap.py` (`bootstrap ok`) and the
-naming, manifest and pins validators all passed, and every tree was clean
-afterwards. Code's nested openRepoShape was checked out at `7f84ca4`, matching
-code's `contracts/openreposhape-pin.yaml`. The pinned checkout's own
-`scripts/repo_shape.py` recomputed
-`3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8`, which
-matches the contract.
-
-The source clone was unchanged except for the one documented local-mode ref,
-`refs/heads/adopt/three-repo-shape` at the split commit. That ref and the
-two leg remotes are left in place, read-only, as the input to T006–T010.
-
-## Private log SHA256s
-
-- Execute: `f766bc707c88272598b6947ae850d9d42922763f0820940a0202ebcbc1835a46`.
-- Bootstrap: `ea2be5dc7455c869a48c7bd36d73024c53ef6f233916cbf8e67ba897b3b732f7`.
-- Independent comparison: `d3acbcd6274267eeadd36892bdbe2a08a9b08269d3215b373f84d630b91da007`.
-
-The receipt holds every log with its SHA256. None was over 2 MB, so none was
-trimmed.
-
-## Remaining gates
-
-**Gate B is not complete.** T006–T011 remain:
-
-- root collisions and leg guidance;
-- the installer entry point;
-- composed tests and CI;
-- the restore and rollback rehearsal.
-
-Gate A preservation must be refreshed at a coordinated breakpoint. Before
-Gate C, regenerate the plan from the frozen source that is actually chosen.
-Brett Heap's explicit Gate C approval must name the revisions, the leg
-repositories, their visibility and the final plan.
-
-This evidence authorizes no real conversion, repository creation, merge,
-default-branch move or lane rebinding.
diff --git a/specs/004-migrate-to-triad/adopter-rehearsal.md b/specs/004-migrate-to-triad/adopter-rehearsal.md
deleted file mode 100644
index fd8a3ac2..00000000
--- a/specs/004-migrate-to-triad/adopter-rehearsal.md
+++ /dev/null
@@ -1,103 +0,0 @@
-# Adopter fix and disposable rehearsal — October 6, 2026
-
-**Task:** T005, with additional T003/T004 rehearsal evidence.
-**Upstream candidate:** [openRepoShape PR #162](https://github.com/opensoft/openRepoShape/pull/162),
-draft, commit `91d568563f98ddbe159167d82652d8e85214bb93`, based on
-`39d5c986fcfac1a160474bfe91c5f1c37fccc72c`.
-**Consumer rehearsal source:** `f5444c5e1f3c6c9ed43aeafcc000b0e78b10497a`.
-
-The [October 4 refusal](adopter-blocker.md) is reproduced by a new regression
-on the unchanged upstream revision. The candidate creates and stages a fresh
-assembly `.gitmodules` after extraction only when that file is absent. It
-preserves registrations retained in assembly. Original registrations remain
-with their dependency gitlinks in the extracted leg. Verification is unchanged.
-
-## Regression evidence
-
-Ran inside py-bench with the existing private git-filter-repo 2.47.0 venv:
-
-```sh
-python3 -m pytest tests/test_adopt_*.py -q
-```
-
-Result: **90 passed, 1 skipped**. A final run of
-`tests/test_adopt_submodules.py` after adding explicit gitlink-mode and
-bootstrap assertions passed all **4** cases. Those cases cover:
-
-- A populated dependency moved with its original `.gitmodules` into either
-  code or spec: registration blob, gitlink mode/identity, dependency bytes and
-  registration history survive; recursive clone, validators and bootstrap pass.
-- A retained assembly registration survives mounting alongside a moved
-  dependency. This exercises the mount boundary; it does not qualify every
-  mixed-registration plan for complete adoption.
-- A mount failure after the first new leg leaves the original source refs,
-  registration bytes and worktree intact; mounting from a fresh clone succeeds.
-
-Existing adopter coverage includes sources without submodules. No full
-consumer suite or upstream CI pass is claimed by these local runs.
-
-## Current-main local rehearsal
-
-Private receipt ID: `adopter-fix-20261006-c2G9Dp`. Clone paths, local remote
-URLs, commands and complete logs stay host-local outside the repository.
-
-Generated a new plan from a clean, single-branch isolated source clone.
-Reapplied the previous reasoned ownership overrides; explicitly assigned the
-new `lanes-index` executable to code. The new `ideation/` content is spec.
-The only existing dependency contract remains with code's registration/gitlink.
-All ownership questions were resolved before `check` and execution.
-This private plan is preliminary rehearsal input, not the final cutover plan.
-
-`check` and `execute --local-remote-dir … --yes` both passed with the candidate.
-Git transport was restricted to local files. The two leg remotes, assembly and
-adoption branch exist only in the disposable rehearsal; no real leg repository
-was created. The source remained clean on its original main commit.
-
-| Source accounting | Original entries |
-| --- | ---: |
-| Spec | 45 |
-| Code | 43 |
-| Assembly root | 6 |
-| Dropped | 0 |
-| Total | 94 |
-
-The standard reported every source path in exactly one place and 18 added
-assembly paths. An independent comparison also checked **path, mode, object
-type and object ID** for every original entry: zero missing or duplicate
-owners. This includes the existing dependency gitlink.
-
-| Disposable repository | Commit | Kept commits |
-| --- | --- | ---: |
-| Spec | `2374d2ec8f8f448c3d086b4546920f875c392ca6` | 29 |
-| Code | `af25d6d9094285aa2f1d540c839518e6610adf89` | 81 |
-| Assembly split | `52f0c18f239b3fbda1c0656e2aefd9c387164d26` | — |
-
-Recursive clone and the generated `scripts/bootstrap.py` passed, including
-naming, manifest and exact leg/copy pin validation. Assembly and legs were
-clean afterwards. Code's nested openRepoShape remained at
-`39d5c986fcfac1a160474bfe91c5f1c37fccc72c`; the recomputed tree digest is
-`a44c0165beb9d3b6ddfce46925bf04b8d19934d5327b5a304b5f3f11af699b02`,
-matching the original dependency contract. Live consumer main, its gitlink and
-that contract were unchanged.
-
-Private log SHA256s:
-
-- Execute: `0e25dbec207e34694321c604201fb0437d70cbb0e4aba8314d34fbeae11636b3`.
-- Bootstrap: `d83e3ca6b76e13bb6f4ec7d99ee64ea159634079d87015c3cc10b5699f042b9a`.
-
-## Remaining delivery gates
-
-T005 remains open: review and land the upstream fix, then use a commit on
-upstream main for the tested consumer pin/gitlink update and recomputed digest.
-The existing consumer pin has not been changed to the candidate branch.
-
-PRs #97 and #121 have landed. On October 6 the remaining open consumer PRs
-were #168, #169, #174 and draft #172. Refresh the final source mapping,
-inventory and coordinated preservation after their landings and any other
-baseline changes. The October 4 committed adoption plan and preservation
-snapshot remain historical inputs.
-
-Installer adaptations, composed code/spec tests and CI, rollback receipts,
-owner dispositions and explicit execution approval remain required. Gates
-A/B/C are not completed by this rehearsal. This evidence authorizes no real
-conversion, merge, account move or lane rebinding.
diff --git a/specs/004-migrate-to-triad/candidate-2026-10-09.md b/specs/004-migrate-to-triad/candidate-2026-10-09.md
deleted file mode 100644
index 7b63eb6d..00000000
--- a/specs/004-migrate-to-triad/candidate-2026-10-09.md
+++ /dev/null
@@ -1,561 +0,0 @@
-# The composed candidate carrying every follow-up — October 9, 2026
-
-**For:** Gate B of [tasks.md](tasks.md), under
-[#186](https://github.com/opensoft/openRepoTools/issues/186). It answers item 3 of
-section 7 of `gate-ab-evidence-2026-10-09.md` (branch `004-migrate-to-triad-rollback`
-at `fa44d75`): "No composed candidate carrying every follow-up has run the suite."
-No task is checked complete by this record, and it approves nothing.
-*2026-10-13, where that gap is recorded:*
-- **The quoted sentence** is `gate-ab-evidence-2026-10-09.md:347` at `fa44d75`.
-  `git ls-remote` at 18:46Z shows `004-migrate-to-triad-rollback` still at `fa44d75`.
-- **In #196** (`004-migrate-to-triad-evidence-3` @ `7c08f7e`) the same sentence is
-  `:590`. That file's dated refresh at `:602–608` (2026-10-09T20:30Z) says no suite run of
-  the candidate "is recorded on origin".
-- **That was true then.** This record's suite results reached origin later: r2's in
-  `16e6ea4` (2026-10-10T23:47Z) and r3's in `e81100c` (2026-10-11T17:00Z).
-**Writer:** lane openRepoTools-1, 2026-10-09: 01:47Z–02:42Z (r1), 13:29Z–18:20Z (r2), and
-the classification from 21:56Z to 2026-10-10T02:4xZ.
-**Evidence branch:** `004-migrate-to-triad-candidate`, from `main` `63810dd`.
-**Private receipt ID:** `candidate-20261009-JR8YyA` (brett-wip `migration/openRepoTools/`).
-It holds every script, log, patch and install snapshot named below. Machine paths stay
-there.
-
-**Two builds.** **r1** was built at 01:5xZ from PR #190 `dbc6837` and PR #191 `2411f40`.
-Its composed run was stopped at about 20% by the 02:42Z checkpoint for an account swap.
-**r2** is the candidate of record. It was rebuilt at 13:3xZ from the moved heads, #190
-`b50f197` and #191 `13cc752`, on the coordinator's order. Everything below is r2's unless
-it says r1.
-
-**State: final for r2 (2026-10-10T02:4xZ).** All three suite runs finished:
-
-| Run | Passed | Failed | Skipped |
-| --- | --- | --- | --- |
-| composed | 1411 | 5 | 0 |
-| standalone | 1389 | 3 | 24 |
-| no-submodule | 1168 | 6 | 242 |
-
-- **Two failures are candidate defects with owners.** F1 is fixed in #191's next head.
-  F2 is #193 item 14.
-- **The rest are environment.** Each is shown the same on main, or in isolation
-  (section 5).
-- **Two inputs have moved since r2:** #191 to `6568f08` (with F1's fix), and T007's
-  entry-point patch to v3 (`004-migrate-to-triad-installer` `4f773b8`). Neither is in
-  this record (section 6).
-
-**r3 (2026-10-11), section 9:** #191 at its final head `8246983`, with T007 v3 (patch
-sha256 `67d8e7ce…`). Code `9c11276`, spec `9e1d006`, assembly `3891943`. The install
-modules, composed: 281 passed, 0 failed, 0 skipped. F1 is gone. The install differs from
-main `f87fd5a` only in the implementation it hands over to.
-
-*2026-10-13:* #191 landed on `main` as `a74c7fc`, a squash of `8246983` with parent
-`f87fd5a`. Its tree, `d77e80b3`, is `8246983`'s, and `openRepoTools` is blob `7aa697c` at
-`cddd1f7`, `8246983` and `a74c7fc` alike. So r3 measured the code now on `main`.
-
-## 1. Inputs
-
-Every input was read without checking it out in any existing worktree. Patches were
-taken with `git show <branch>:<path>`, and the PR commits with `git format-patch` from
-the shared checkout.
-
-| Input | Where | Identity |
-| --- | --- | --- |
-| Run C's rehearsed arrangement | private prep `work-20261008/rehearsal` (read-only) | source `837928a`, split `69b8924`, spec `593250d`, code `73b04d6`, nested openRepoShape `7f84ca4` |
-| T006 patches (5) | `004-migrate-to-triad-root-guidance` `041a273` | each blob equals `465fa6d`'s; sha256 `cd69c2a9…`, `574c0df1…`, `a7f8521b…`, `74b98ff9…`, `c11070f0…`, as `gate-ab-evidence` records. *Superseded 2026-10-19: `cd69c2a9…` is the earlier `assembly-0001`; the file at its path is re-cut, sha256 `2ec48bbf…eaead7` (`gate-b-status-2026-10-09.md`, checklist line 17).* |
-| T010 patches (2) | `004-migrate-to-triad-ci` `cc7c7a1` (r1); the branch is at `d28e2cc` for r2, with both patch blobs unchanged | code `tests.yml` `7ee3c6d0…`; assembly `composed.yml` `6ee09f00…`. *Superseded 2026-10-19: `7ee3c6d0…` is the earlier code-leg patch; the file at its path is regenerated, sha256 `1406ead3…ef6d56` (`gate-b-status-2026-10-09.md`, checklist line 32).* *Superseded 2026-10-21: `6ee09f00…74670b` is the earlier assembly patch; the file at its path is regenerated, sha256 `60245cb9…f0f653`, with `runs-on: ubuntu-24.04` (`gate-b-status-2026-10-09.md`, checklist line 32).* |
-| T007 entry point | `004-migrate-to-triad-installer` `51993a4` | `t007-assembly-entry-point.patch` `361c037d…`, as `installer-2026-10-08.md` records |
-| PR #190 | r2: `b50f197` (on origin as `feat/test-roots-manual-guard`, a fast-forward of the PR head). r1: `dbc6837` | r2: 4 commits on `c4864ac`: `c139e88`, `e3a76b5`, `dbc6837`, `b50f197` |
-| PR #191 | r2: `13cc752`, Linux CI green. r1: `2411f40` | r2: 5 commits on `c4864ac`: `6337a52`, `e406e0e`, `ecd7aa4`, `2411f40`, `13cc752` |
-| The shape's `bump-leg.py` | a clone of the rehearsal's openRepoShape mirror, in scratch | `7f84ca4` |
-
-`assembly-0002` and `assembly-0003` were **not applied**. As `root-guidance-2026-10-08.md`
-says, they pin the rehearsal's own leg hashes; the two pins were regenerated here with
-`bump-leg.py` against this candidate's legs.
-
-#191 will move again in T007's fix cycle. This record is at `13cc752`; a later head
-needs a delta rerun.
-
-## 2. How it was built
-
-All of it ran in private scratch (`work-20261008/ort-triad-candidate/`):
-
-- **Own copies first.** Bare copies, made with `--no-hardlinks`, of run C's two leg
-  remotes, of its assembly branch and of its openRepoShape mirror. Every write went to
-  these copies. In every clone the submodule URLs were set to them before any commit, and
-  a `url.<copy>.insteadOf` rule sent `.gitmodules`' run C paths and the nested GitHub URL
-  to the copies. r2 has its own set of copies, so r1's commits stay where they were.
-- **No network.** `PATH` began with refusing `gh`, `curl` and `wget` shims that log every
-  call; `GIT_ALLOW_PROTOCOL=file`. The shim log is empty.
-- **Run C unchanged.** A listing of the rehearsal directory (type, mode, size, mtime of
-  every entry) was taken before the work and compared after it (section 8).
-
-### Apply order and results (r2)
-
-Every patch was applied with `git am`. **Every one exited 0; no hunk needed a resolution,
-and none was dropped.**
-
-| # | Leg | Patch | `git am` | Commit | Tree |
-| --- | --- | --- | --- | --- | --- |
-| 1–4 | code, on `73b04d6` | PR #190's four commits | exit 0 | `b112e01`, `4ee37cf`, `e80350e`, `6e294fe` | `08d5b4ca` after the fourth |
-| 5–9 | code | PR #191's five commits | exit 0 | `eab478f`, `85e6ffb`, `5758859`, `69b4785`, `b52df0a` | `cceeb37d` after the fifth |
-| 10 | code | T006 `code-0001` | exit 0 | `085ec81` | `c3437ded` |
-| 11 | code | T010 `t010-code-leg-tests-workflow.patch` | exit 0 | **`4dbcf6c`** | **`c0bedc53`** |
-| 12 | spec, on `593250d` | T006 `spec-0001` (r1's commit; no spec input moved) | exit 0 | **`9e1d006`** | **`10256135`**, the tree T006 and T011 recorded |
-| 13 | assembly, on `69b8924` | T006 `assembly-0001` | exit 0 | `4f1e522` | `5060f3be` |
-| 14 | assembly | T010 `t010-assembly-exact-pin-job.patch` (`composed.yml`) | exit 0 | `738857c` | `7905d570` |
-| 15 | assembly | T007 `t007-assembly-entry-point.patch` | exit 0 | `f4133d6` | `8b0c860b` |
-| 16 | assembly | `bump-leg.py --leg spec --to 9e1d006…` | exit 0 | `f0a4feb` | `94e9d9be` |
-| 17 | assembly | `bump-leg.py --leg code --to 4dbcf6c…` | exit 0 | **`5d92962`** | **`d263907a`** |
-
-Steps 12–16 are r1's commits, reused: none of their inputs moved. Step 17 is new.
-
-*Superseded 2026-10-19 (steps 11 and 13):* those steps applied the earlier code-leg
-`t010-code-leg-tests-workflow.patch` (`7ee3c6d0…`) and the earlier `assembly-0001` (`cd69c2a9…`), and their
-results stand as recorded. The files at those paths are now the regenerated and the re-cut ones
-(`1406ead3…ef6d56`, `2ec48bbf…eaead7`), made against the files #228's series leaves, so these two results are
-not results for them. A third code-leg patch, T009's `t009-assembly-caps.patch` (`2dd4aac2…b2bbe5`), goes on
-after steps 10 and 11 and sets the assembly-root length caps the re-cut needs.
-
-What was checked at each step:
-
-- **The PR commits are the PR heads.** Every path #190 touches has `b50f197`'s blob after
-  the stack, and every path #191 touches has `13cc752`'s blob. The exception is the one
-  file both touch.
-- **The one shared file.** Both PRs touch `tests/test_openrepotools_command.py`. On top of
-  #190, #191 applied the same hunks as its own diff, at an offset. The hunk bodies are
-  identical: 14 lines at `13cc752`, and 26 at r1's `2411f40`.
-- **T006's `.gitattributes` and #190's decision agree.** #190 reads `.gitattributes` from
-  the code root, and `code-0001` puts the monorepo's blob `3560973` there.
-  `git check-attr eol` on `openRepoTools`, `park` and `tests/run.sh` in the leg gives
-  `lf`.
-- **The entry point is T007's.** `openRepoTools` at the assembly root is blob `4c2525d`,
-  mode 100755, sha256 `3b0d59f5…`, as `installer-2026-10-08.md` records.
-- **Clean text.** `git diff --check` exits 0 over the code range (`73b04d6..4dbcf6c`), the
-  spec range and the assembly range.
-
-The legs' commits were pushed to `main` of their own bare copies, as fast-forwards from
-run C's heads. The assembly was pushed as branch `candidate-r2`. `bump-leg.py` ran with
-`--local-remote-dir` set to the copies, a dry run first each time, all exit 0. It added
-`Lane:` and `Co-Authored-By:` trailers. Its `NEXT … push` line was not followed.
-
-### The candidate's identities
-
-| Repository | Commit | Tree | Pinned digest (`sorted-ls-tree-r-v1`) |
-| --- | --- | --- | --- |
-| assembly (`candidate-r2`) | `5d9296216fbf8255440c315344f29ac2aa1c19f8` | `d263907a4ab2b675c9b5272a4c60ffb2ea65ce12` | — |
-| spec leg | `9e1d006e2c870615f159ad1ebab719bb7b38cc2a` | `10256135f87ae4d05166d2c5934a152c42ce19ae` | `3a4a84beb20b343390f5bae64cb166df4d0cfd693baff6309fc13c8060d1c866` (T006's spec digest) |
-| code leg | `4dbcf6ce40fe897a8caf770abc5cf55535b5f0b6` | `c0bedc535b4c69afc32e6235140a874c05821c3a` | `7a5dc958db2ea74213f604b883bc2bfd374960015313bd4de24494965ccc32a6` |
-| code's nested openRepoShape | `7f84ca42ca86a8902928345109d2bf6bad87bd91` | — | unchanged from run C |
-| r1, superseded | assembly `3bd95a7`, code `f0af7d9` (tree `a832c8a0`, digest `6550ae2e…`), spec `9e1d006` | | |
-
-The commit hashes are this run's alone, because `git am` stamps a new committer and date.
-The trees are what reproduce.
-
-## 3. Bootstrap, validators and the composed job's own steps
-
-| Check (in the assembly) | Result |
-| --- | --- |
-| `python3 scripts/bootstrap.py` | exit 0; "spec: on main at 9e1d006e2c87 (branch tip == pin)", "code: on main at 4dbcf6ce40fe (branch tip == pin)", `pins ok`, `manifest ok`, "bootstrap ok" |
-| `make validate` (naming, manifest, pins) and `make pins` | exit 0 and 0. Both gitlinks equal their pins, both tree digests recompute, and all 11 copied shape files match `contracts/shape-pin.yaml` |
-| `composed.yml`'s step "every context the composed run claims is here", run as written | exit 0 |
-| `composed.yml`'s `validate-manifest.py`, then `validate-pins.py` | exit 0, exit 0 |
-| A fresh recursive clone of the candidate from its bare copy, then `bootstrap.py` and `make validate` | exit 0 and 0. Spec `9e1d006`, code `4dbcf6c`, nested `7f84ca4`. `status --ignored` is empty |
-| The assembly's `AGENTS.md` and `README.md` | 340 and 510 lines, exactly #190's assembly caps |
-
-`.gitmodules` still names run C's local remote paths, as the adopter wrote them in the
-rehearsal. A recursive clone that does not redirect them fetches from run C, whose
-remotes lack this candidate's leg commits. A real leg is an https remote and does not
-have this problem.
-
-## 4. The install, compared with today's main
-
-Both installs used the same disposable home path, rebuilt from one seed, so that
-absolute paths written into `settings.json` and the receipt compare byte for byte.
-- **Environment:** `env -i`, with `HOME`, every `XDG_*` variable and `TMPDIR` in scratch.
-  `PATH` was the refusing shims, then `/usr/bin:/bin`. `GIT_ALLOW_PROTOCOL=file`.
-- **The seed:** an unrelated `settings.json` (model, env, permissions, a status line, and
-  `SessionStart`, `UserPromptSubmit` and `Stop` hooks of its own), a foreign command in
-  `~/.local/bin`, and a foreign skill under each of the two skill roots.
-- **The shims logged 0 calls**, in r1 and in r2.
-
-| Stage | Source | Result (r2, 13:34Z) |
-| --- | --- | --- |
-| A | today's main `63810dd` (a shallow clone of `origin/main`), `./openRepoTools --install` | exit 0; `17 of 17 placed`; 29 `installed at`; both hooks merged; 29 receipt rows |
-| B | a freshly seeded home; the candidate assembly root `./openRepoTools --install` (the T007 entry point) | exit 0. First line: "source: the code mounted at `<clone>/code`, opensoft/openRepoTools-code at 4dbcf6ce40fe… as `<clone>` pins it; every payload file was checked against that commit and nothing fetched". Then `17 of 17 placed`, 29 `installed at`, both hooks merged, 29 receipt rows |
-| B2 | the candidate again, over B | exit 0; 31 `unchanged` (29 files and 2 hooks) |
-| C | today's main again, over B: rollback by reinstall | exit 0; `openRepoTools: updated at …`, 30 `unchanged` |
-| — | the candidate's `./openRepoTools --version`; `./openRepoTools nope` | "openRepoTools (opensoft/openRepoTools @ main)", exit 0; exit 2 |
-
-**Every difference between A and B**, by path, type, mode and sha256 over the whole home:
-
-| Path | A (main) | B (candidate r2) |
-| --- | --- | --- |
-| `~/.local/bin/openRepoTools` | 755 `47cfe74ea96e6ce9e56b47220a71e1de8c608af2f51f33cfdffa351410a4f373` | 755 `a6eda1f4b7b72a8e832f93185dc4604de66dab5a677472f57452b3ee09342588` |
-| `~/.local/share/openRepoTools/installed.tsv` | 600, its `openRepoTools` row names `47cfe74e…` | 600, its row names `a6eda1f4…`; the UTC column differs too |
-
-Nothing else differs:
-- **The other 28 placed files** have the same path, mode and sha256.
-- **`settings.json`** is byte-identical: the seed's model, env, permissions, status line
-  and three hooks of its own, plus the same two entries the installer merges, at mode 600.
-- **The receipt's name, destination and sha256 columns** differ in the `openRepoTools`
-  row only.
-- **The foreign command and both foreign skills** are untouched.
-
-The installed `openRepoTools` (`a6eda1f4…`) is the bytes of `code/openRepoTools`, PR #191's
-implementation at `13cc752`. It is not the root entry point (`3b0d59f5…`), so the entry
-point handed over as T007 designed. r1 gave the same result with `2411f40`'s
-implementation, `118cc2cc…`; between r1's and r2's candidate installs, that file and its
-receipt row are the only differences.
-
-**Rollback by reinstall (C) restores main.** C's whole-home listing equals A's except for
-the receipt file's own digest. The receipt's name, destination and sha256 columns equal
-A's; only the UTC stamps differ. This is the (c2) path of `gate-ab-evidence-2026-10-09.md`
-section 2, repeated at this candidate's own commits, as its section 2 asked.
-
-## 5. The suite: composed, standalone, and standalone without the dependency
-
-**How the runs were made.** The three runs ran one after another, 13:33Z–18:20Z, from one
-driver script. Each took the workstation lock on its own and released it before the next.
-- **Environment:** `env -i` with only `HOME`, `PATH=/usr/bin:/bin`, `LANG=C.UTF-8`, the
-  user names and the CI jobs' four `GIT_AUTHOR_*`/`GIT_COMMITTER_*` variables. So no
-  `LANES_*`, `TMUX`, `CLAUDE_*` or workstation binding variable reached the suite.
-- **Composed.** `tests/run.sh -rfEs` waited 5 minutes on the workstation census. As
-  briefed, this writer then stopped its own waiter and ran `run.sh`'s exact pytest line
-  under `flock` on the same lock, with `run.sh`'s run root.
-- **Standalone and no-submodule.** `tests/run.sh -rfEs` itself started pytest in each.
-- **The load average at each run's start** was 131.7 (composed), 6.9 (standalone) and
-  8.6 (no-submodule).
-
-| Run | Where, and the variables | Result | Time |
-| --- | --- | --- | --- |
-| **Composed** | `<assembly>/code`; `OPENREPOTOOLS_COMPOSED=1`, `OPENREPOTOOLS_ASSEMBLY_ROOT=<assembly>`, `OPENREPOTOOLS_SPEC_ROOT=<assembly>/spec` | **1411 passed, 5 failed, 0 skipped** (1416) | 1:48:00 |
-| **Standalone** | a clone of the code leg alone, its dependency initialized; no `OPENREPOTOOLS_*` variable | **1389 passed, 3 failed, 24 skipped** (1416) | 1:00:08 |
-| **No submodule** | a clone of the code leg alone, dependency not initialized ("the submodule really is not materialized", the job's own check); `tests.yml`'s workflow env, `OPENREPOTOOLS_CODE_ROOT=<clone>` and `OPENREPOTOOLS_COMPOSED=0` | **1168 passed, 6 failed, 242 skipped** (1416) | 1:31:30 |
-
-**The skips are the designed ones.** The composed run skipped nothing, so no check went
-green by skipping. The standalone run's 24 skips are:
-- 10 for `README.md`, 3 for `AGENTS.md` and 1 for `CLAUDE.md`, each naming the assembly
-  root it needs;
-- 3 for `docs/README-lanes.md`, naming the spec root;
-- 7 composed-acceptance tests of #191, which skip in standalone code.
-
-The no-submodule run has the same 24, plus 218 that name
-`git submodule update --init upstream/openRepoShape`. Inside the lane helpers' shell suite
-in both leg runs, the three manual sections printed `skip … no spec root in this run`.
-There is no `unbound variable` anywhere: `b50f197`'s guard holds, and the abort that
-`dbc6837` had in a code leg does not occur.
-
-**Against CI.** All three runs collected 1416 tests: main's 1296 plus #190's and #191's
-additions. On CI the PR heads read:
-- main `63810dd`: `tests` 1296 passed; `tests-no-submodule` 1084 passed, 212 skipped;
-- #190 `dbc6837`: 1318 passed; 1105 passed, 213 skipped;
-- #191 `2411f40`: 1379 passed, 7 skipped; 1165 passed, 221 skipped.
-
-None of those jobs is composed.
-
-### Every failure, classified
-
-| # | Test | Runs | First assertion line | Class | Owner |
-| --- | --- | --- | --- | --- | --- |
-| F1 | `test_install_payload_source.py::test_r14_the_documented_upstream_skip_is_unchanged` | composed only | `KeyError: 'reason'` at `conftest.NEEDS_UPSTREAM.kwargs["reason"]` (line 1697) | **Candidate defect, new, from combining #190 and #191.** Under #190's conftest a composed run makes `NEEDS_UPSTREAM` `pytest.mark.usefixtures("required_dependency")`, a fixture that fails, not a `skipif`, so it has no `reason`. #191's test assumed a `skipif`. It passes standalone (both leg runs) | **#191.** Fixed by the T007 writer in `6fa3b43`, inside #191's head `6568f08`: the test now reads the command from conftest's own text, which names it in both modes. Not re-run here |
-| F2 | `test_repo_hygiene.py::test_agents_md_names_the_pin_rules` | composed only | `assert 'Never edit anything under \`upstream/openRepoShape\` in place' in "Read AGENTS-shape.md first …"` | **Candidate defect, known: #193 item 14**, predicted by lane 3. T006's `assembly-0001` rewrites the two `AGENTS.md` lines the test checks, and in the composed run the test reads the assembly's `AGENTS.md` | the decision is pending with lane 1's coordinator |
-| F3 | `test_lane_helpers_suite.py::test_the_lane_helper_suite_passes`: shell `FAIL …with clause (c)'s directory and window in the tail` and `FAIL the row's stamp states clause (c)'s two facts for a person, in its TAIL` | all three | `expected to contain [; dir <sandbox HOME>/projects/repoA; window ]`, the sandbox HOME being `<run root>/tmp/tmp.*/home`; the row ends `…; dir <sandbox HOME>/projects/repoA; ... \|` | **Environment, pre-existing: #180.** The register row's stamp is cut, and under `run.sh` the directory sits under the long run root `~/.local/state/openRepoTools/tmp/<UTC>-<pid>/tmp`, so the expected text falls past the cut. **On main `63810dd` the same three FAIL.** The shell suite ran directly, at a run root of the same 71 characters as the standalone run's, under one `flock`: `4595 passed, 3 failed, 0 skipped`, F3's two and F4. CI's runner has a short `TMPDIR` and passes them. | #180 |
-| F4 | the same shell suite: `FAIL …having found the checkout by its real directory name, not the typed one` | standalone and no-submodule only | `expected to contain [dir <sandbox HOME>/projects/repoCase;]`; the row ends `— lane-start on Eagle: window renamed, no launch; dir ... \|` | **Environment, pre-existing: #180, the same cut.** The run root here was one character longer than the composed run's (`<pid>` had 7 digits, against 6), and this third row crosses the cut at that length | #180 |
-| F5 | `test_run_wrapper.py::test_a_killed_run_removes_its_run_root_and_stops_the_suite[flock-2-130]` and `[mkdir-lock-2-130]` | all three | `subprocess.TimeoutExpired: … tests/run.sh … timed out after 30 seconds` | **Environment, of this writer's harness, and not load.** The driver was launched as an asynchronous command of a non-interactive shell, so every run inherited SIGINT *ignored*, and bash cannot trap a signal ignored at entry. Only the SIGINT cases failed; the SIGTERM cases passed. Measured isolated at load 42–61: with SIGINT at its default, 4 passed in 1.9 s; launched the way the runs were, the same 2 failed with the same timeout. Main `63810dd` behaves identically (4 passed, then 2 failed) | none for the candidate. The test could start its wrapper with both signals at default, as `test_openrepotools_command.py::test_a_run_killed_mid_placement_leaves_no_temporary` already does (`preexec_fn=default_signals`, whose docstring names this very trap) (follow-up 4) |
-| F6 | `test_supervised_restart_regressions.py::test_restart_observer_confirms_late_uuid_prepared_by_real_child[live]`, `::test_respawn_restores_configured_roots_in_new_pane`, `::test_completed_observer_cleanup_never_signals_saved_pid[signal]` | no-submodule only | `subprocess.TimeoutExpired: … lane-handoff --supervise …` / `Failed: observer never confirmed readiness` | **Environment: timing under load.** These files and `lane-handoff` are byte-identical to main's. All three passed in the composed and standalone runs of the same code. Rerun isolated at load 48–54: all three passed, once with SIGINT at default and once ignored. But a sibling, `test_completed_observer_cleanup_never_signals_saved_pid[exit]`, failed once in that rerun. So these tests are timing-sensitive on this bench, independent of the candidate | none for the candidate; the flake is pre-existing (follow-up 5) |
-
-*2026-10-13, F2's decision.*
-- **Decided on 2026-10-11: the test gives.** #193 item 14 was settled by lane 1's
-  decision (#186 comment 6103665910, 00:16Z), as #195's writer recommended in 6103460962.
-  T006's `assembly-0001` is unchanged. *(Superseded 2026-10-19: it is re-cut since, for the root files
-  #228's series leaves, and not because of this decision.)*
-- **Implemented in #195 at `e378871`.** At an assembly root,
-  `test_agents_md_names_the_pin_rules` now expects `code/upstream/openRepoShape` and
-  `git -C code submodule update --init upstream/openRepoShape`, taking the prefix from
-  the code pin.
-- **#195's status at 18:46Z:** open at `e378871`. Its CI on the merge with `a74c7fc` is
-  still running (run 38447402302), and lane 1 lands it when green.
-- **Until #195 lands, F2 stands** against `main`'s test.
-
-**Lane 2's reading** (#186 comment 6087267593) **checked against the logs.** Its counts are
-right for all three runs, and so is its S2 finding (no abort on r2). One refinement and
-one correction:
-- **The lane-suite FAILs** are all #180 row-stamp cases, as lane 2 says. They are 2 in the
-  composed run and 3 in each leg run; the third is F4.
-- **The `test_run_wrapper` pair** is not a load timeout. It is the inherited ignored SIGINT
-  of F5, and it fails the same way on main.
-
-**One other test sends SIGINT:** `test_a_run_killed_mid_placement_leaves_no_temporary`.
-It resets both signals in its child for exactly this reason, and it failed in none of the
-three runs.
-
-### r1's stopped composed run
-
-It reached result 288 of 1408 before the 02:42Z checkpoint stopped it. Its one failure, at
-result 211, was F1. That test alone, rerun in r1's tree, failed the same way. So it was
-not the `$ln_doc` abort, which only a code leg without a spec root can reach; the composed
-run has one.
-
-## 6. What this proves for Gate B, and what it does not
-
-**What it proves:**
-- **Every recorded follow-up composes.** T006's three portable patches, T010's two, T007's
-  entry point, #190 at `b50f197` and #191 at `13cc752` stack onto run C with no conflict
-  and no resolution. That is the stack `gate-ab-evidence` section 5 only checked as
-  text.
-  *Superseded 2026-10-19:* that holds for the files of that date on run C. The earlier `assembly-0001` and
-  code-leg `tests.yml` patch no longer apply to #228's files, and their replacements have been tried in
-  scratch trees and layouts only, not in a candidate built through the adoption tool
-  (`gate-b-status-2026-10-09.md`, checklist lines 17 and 32).
-- **The result is a valid triad.** It bootstraps and validates: legs at their pins, both
-  digests recomputed, all 11 copied shape files intact, and `composed.yml`'s own
-  context and validator steps green.
-- **The whole canonical suite has run on it.**
-  - Composed at the exact pins, nothing skipped: **1411 of 1416 pass**.
-  - Of the 5 failures, 2 are candidate defects with owners. F1's fix is in #191's head
-    `6568f08`. F2 is #193 item 14, with a decision pending.
-  - The other 3 are this bench's environment. F3 is #180, the same on main (section 5).
-    F5 is this writer's harness, the same on main.
-- **The standalone code leg behaves as T009/T010 designed.** Its document checks skip,
-  naming the root they need. Its dependency checks skip, naming the command. Nothing
-  aborts. It has no failure of its own: its 3 and 6 failures are F3–F6, all environment.
-- **The install from the assembly root hands over to the code leg.** It places the same
-  29 files as today's main, every one byte-identical except the implementation itself,
-  and merges the same hooks into a byte-identical `settings.json`. A reinstall from main
-  restores main.
-
-**What it does not prove:**
-- **Hosted CI.** Not the code leg's `tests`, `tests-no-submodule`, `tests-windows`,
-  `parse-macos` or `tests-macos` jobs, and not `composed.yml` checking out over https.
-  They need the real legs, which only exist after Gate C (checklist line 35).
-- **The real legs and remotes.** This used local bare copies: https `.gitmodules`,
-  `bump-leg.py` against the real legs, and the raw and `gh` one-liners against GitHub
-  are T015's.
-- **The final heads.** #191 is now `6568f08`, which carries F1's fix (`6fa3b43`) and
-  changes the implementation `openRepoTools` (159 changed lines since `13cc752`).
-  T007's entry-point patch is now v3 (`4f773b8`). #190 landed as `f87fd5a`, whose
-  `tests/` equal `b50f197`'s, so that leg input is unchanged.
-  - Neither moved input ran here: not the suite, and not the install comparison.
-  - The T007 writer did run part of it (`installer-2026-10-08.md` at `3cca1e7`).
-    - Its strict composed run of the install suites, `repo_hygiene` and
-      `openrepotools_command` at `6568f08` with root v3: 429 passed, 1 failed. The one
-      is `.gitattributes`: that code leg did not carry T006's `code-0001`.
-    - CI on `6568f08`: `tests` 1416 passed, 9 skipped.
-    - Neither is this candidate, and neither is the full composed suite.
-  - The record owes a composed rerun at `6568f08` with T007 v3. *(2026-10-11: done in
-    scoped form at the final head `8246983`, in section 9. The full composed suite is
-    redone at the frozen source for Gate C.)* The rebuild takes about 5
-    minutes: the code leg plus a regenerated code bump, and the assembly with the v3
-    patch in place of v1.
-  - The full composed run took 1:48 at load 130 here. CI's `tests` takes 45–48 minutes.
-    Add the wait for the lock.
-  - A scoped composed rerun of the install modules (`test_install_payload_source.py`,
-    `test_openrepotools_command.py`, `test_install_*`), plus the install comparison, is
-    about 15–20 minutes.
-- **A clean composed green.** Gate B's "passing compatibility test matrix" is not met
-  until the composed rerun at `6568f08` shows F1 gone and F2 is decided. F3 and F5 do not occur on a CI
-  runner (main's own `tests` is 1296 of 1296 there).
-- **The bash 3.2 parse of the root entry point.** `parse-macos` parses the
-  implementation, not the entry point.
-
-## 7. Follow-ups
-
-1. **#191 carries F1's fix** (`6fa3b43`, in its head `6568f08`: the r14 test reads
-   conftest's text). The composed rerun at `6568f08` with T007 v3 is owed (section 6).
-   *2026-10-13, reconciled with section 9.*
-   - **What was asked.** Lane 3's review 5481348534, finding 6, asked for the composed
-     suite and the install comparison at #191's final head.
-   - **What r3 covered,** at `8246983` (`a74c7fc` on `main`): the install comparison in
-     full, and the composed suite for the four install modules only (281 passed).
-   - **Still owed:** the full composed suite on this candidate at the final head.
-   - **Why it is not run now.** openRepoShape v1.0.0 holds any new rehearsal at
-     `7f84ca4` (Brett Heap's word, #186 comment 6152410188). The coordinator's order of
-     2026-10-11 runs it once, at the frozen source, for Gate C.
-   - **Lane 2's run is not this record's.** Lane 2's full composed run on its own r3
-     (`f87fd5a` + #191 `8246983` + #195 `e378871`) gave 1454 passed and 1 failed: the
-     lane suite's 5400 s timeout (#186 comment 6152491855).
-2. **F2, #193 item 14:** decide whether `test_agents_md_names_the_pin_rules` or T006's
-   `assembly-0001` gives, before the composed run is the record.
-   *2026-10-13:* decided on 2026-10-11, the test gives. It is implemented in #195
-   `e378871`; see the dated note under section 5's table.
-3. **#180:** under `tests/run.sh`'s run root the row-stamp cases fail locally. There are 2
-   at a 70-character run root and 3 at 71, the third being F4. CI is unaffected. Today
-   any local full run is red on them, main included.
-4. **`test_run_wrapper.py`:** start the wrapper with SIGINT and SIGTERM at their defaults,
-   as `test_openrepotools_command.py` does. Otherwise a suite launched from a background
-   shell reports two false failures (F5), on main too.
-5. **`test_supervised_restart_regressions.py`'s observer tests are timing-sensitive** on a
-   loaded bench (F6). They are pre-existing and unchanged by the candidate.
-6. **Launch any rerun of this candidate with SIGINT at default (F5).**
-7. **The rehearsed split's `.gitmodules` names run C's local remote paths.** A real
-   adoption writes https URLs, so nothing is owed unless the rehearsal is reused for
-   another candidate.
-
-## 8. Acts outside scratch, and log SHA256s
-
-**Every write went to private scratch** (`work-20261008/ort-triad-candidate/`), with these
-exceptions, listed so nothing is hidden:
-- **The evidence worktree.** `lane-worktrees add openRepoTools-1 ort-triad-candidate`
-  made it (exit 0): the worktree, its new branch and one record in lane 1's host-local
-  tree inventory.
-- **This branch.** Its commits, and fast-forward pushes of `004-migrate-to-triad-candidate`.
-- **In the shared checkout, reads only.** Fetches (remote-tracking refs only),
-  `git show`/`format-patch` reads, and one shallow `file://` clone of `main` from its
-  object store.
-- **`gh`, reads only.** PR views, run lists, CI job logs, and issues #180, #184 and #193.
-- **`tests/run.sh`'s own conventions.**
-  - Run roots under `~/.local/state/openRepoTools/tmp/<UTC>-<pid>/`, each removed when
-    its run ended. The r1 composed run's root was removed by hand after this writer
-    stopped that run at the 02:42Z checkpoint.
-  - Bytecode under `~/.cache/openRepoTools/pycache`.
-- **The workstation lock.** This writer held `/tmp/openrepotools-pytest.lock`:
-  - r1 composed, 02:10:40–02:42:37Z (stopped);
-  - r2 composed, 13:59:33–15:47:49Z;
-  - through `tests/run.sh`, the r2 standalone and no-submodule runs, 15:4xZ–18:20Z;
-  - main's lane suite at the same run-root length, about 22:07Z to 23:09:57Z.
-
-  It was released between runs. The isolated reruns of F5 and F6 (2 seconds to 2
-  minutes 16 seconds each) ran without it, under the coordinator's rule for runs of about
-  two minutes. The r1 test collection and F1's single-test reproduction took it with
-  `flock -w 600`.
-- **A stray file moved at once.** A temporary file was written into the private
-  `work-20261008/` directory by mistake, outside the rehearsal tree, and moved into scratch
-  within a minute.
-- **The receipt and the comment.** One commit to brett-wip `main` (`git add -- <receipt
-  dir>`), from a single-branch clone in scratch, never the shared checkout. One comment
-  on #186.
-
-**Real surfaces, before (2026-10-09T01:59Z) and after (2026-10-10T02:44Z):**
-- the real home's 29 installed files (path, mode, sha256), its receipt and its
-  `settings.json`: **unchanged**;
-- `~/.agents/workspace.yaml` (size, inode, mtime, mode; its contents not read):
-  **unchanged**;
-- run C's rehearsal directory, as a whole-tree listing (type, mode, size, mtime of 1830
-  entries): **byte-identical** before (2026-10-09T01:47Z) and after (2026-10-10T02:44Z).
-
-**No network:** the refusing shims logged no call in any build, install or suite step.
-Nothing was pushed to run C. No real repository was created, and the register was not
-written.
-
-| Log (in the receipt's `logs/`) | SHA256 |
-| --- | --- |
-| `41-r2-code-leg.log` | `053af3830c118885238f1f50dfc2ff50bf29c2f4ac9db9cc6d539f407633d12b` |
-| `42-r2-assembly.log` | `7d8f086587e63e4a78c93cc2db5d1f4996aab4a983a28e0ab389d4265c7ad272` |
-| `43-r2-clones-and-steps.log` | `295db90bcfe12c626919d0a49710d8e98e080851997deab68853d80bf03bd59b` |
-| `run-51-r2-composed.log` | `d57492a6be710493c51b052eef14119c248d0d5de29f8d58f2dc8a99e7b1c5c6` |
-| `run-52-r2-standalone.log` | `18562f7cf544179060917128660fef4d535b95e0ac94240cd101d862fd5171da` |
-| `run-53-r2-nosub.log` | `1b9cc2668593e7c44075528acef9cbfc4540a12fe2a5f2a055819131f6e7d366` |
-| `44-r2-install-check.log` | `ba9e6df4f0aff84e5e362c3de35bd236d45073e5b3b1aabfbe309f9d27ae4c3d` |
-| `45-r2-install-compare.log` | `eb0de425bfee2214d39490498e5e0a2ed5fc8e331258cc48c498b8033cbe20d9` |
-| `60-r14-classification.log` | `920cf5db6cdbf47b03294c022d5e15087fed61e30edabde2958ab39e236af088` |
-| `61-rerun-run-wrapper.log` | `5ca28af487ca34b6957b7601672005a067bcc598358bfa209ce185d0616cefb4` |
-| `62-rerun-supervised-restart.log` | `e6409f8fdd7d4a96ed8c158d85ad00bde77a6e214fec43bedb89f5ff8211c927` |
-| `63-run-wrapper-on-main.log` | `f5a3724535d12ff887fc44613cf011dc2adc17d6a7416f6cebed068b32b4b29f` |
-| `64-main-lane-suite-at-length.log` | `d07652d526e131d271347138c7c204efb3c15c86445e6b7f8c37a36de73dcdb9` |
-| `killed/run-21-composed.r1-stopped-at-checkpoint.log` | `60c90271e3fb6acaa78ebbfd56b3483598b03cd67e5cfb19711ae0036e1daf7a` |
-| `killed/r1-composed-F211-repro.log` | `3df58782bf4a317516cb5f098c2b8460e63e119e8fb5a98efb7159dd6f3cd750` |
-| `10-code-leg.log` | `70f1af98b15b7f52fff2c47de6a68930f156138cfcfceacaf813382fac84a378` |
-| `12-assembly.log` | `256decaff94d57c4fc14ddf0a6e03dbfa39c485e3056ccec66c65a68100d119d` |
-| `13-bump.log` | `5523b0e9df43ff2f11b7207e901e1bf69e084dc461752a36b17104b2b458dfed` |
-| `32-install-compare.log` | `c4f48b9f4649fb775874fa1bb962773a269778dc28eb92e6c4e28420d7cc4108` |
-| `rehearsal-listing-before.txt` | `1dbf1ae38a9f98fac7b9f1ded1f0b6b2d699cc8ecb7b4f914c2cd5171f412038` |
-| `rehearsal-listing-after.txt` | `1dbf1ae38a9f98fac7b9f1ded1f0b6b2d699cc8ecb7b4f914c2cd5171f412038` |
-| `network-shim-calls.log` | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` |
-
-## 9. r3: the install path at #191's final head — October 10–11, 2026
-
-**Why a scoped rerun.** After r2, #191 moved on:
-- `6568f08` carried F1's fix;
-- `cddd1f7` installs exactly the bytes that were checked from a mounted code leg;
-- `8246983` is lane 3's LAND.
-
-T007's entry point also moved, to v3. On the coordinator's order this is the scoped
-rerun section 6 offered: the install modules composed, plus the install comparison. The
-full composed suite is redone once, at the frozen source, for Gate C.
-
-**Inputs.** Every input not listed here is r2's:
-
-| Input | Identity |
-| --- | --- |
-| PR #191 | `8246983`. Its 10 non-merge commits since `f87fd5a`, by `git format-patch f87fd5a..8246983`. The merge of main, `45979a4`, has no conflict hunks (`git show --cc` is empty) |
-| PR #190 | as landed, `f87fd5a`. Every path under `tests/` has `b50f197`'s blob, so r2's #190 stack (`6e294fe`) is the base |
-| T007 entry point v3 | `specs/004-migrate-to-triad/patches/t007-assembly-entry-point.patch` at `004-migrate-to-triad-installer` `67a978c`: blob `407741b`, unchanged since `4f773b8`; **sha256 `67d8e7ce8b0f7008d2151a44c0eabaf74cda7cd2697c6e09ee7da0c341c671b5`**, as `installer-2026-10-08.md` records. It writes `openRepoTools` as blob `ff432c6`, mode 100755, sha256 `8248224d…` |
-
-**Build. Every `git am` exited 0, with no resolution:**
-
-| Leg | Steps | Commit | Tree |
-| --- | --- | --- | --- |
-| code | `6e294fe` + #191's 10 commits (`e06fd90` … `830f673`) | `830f673` | `b0d15e4a` |
-| code | + T006 `code-0001` (`6e4761b`) + T010 `tests.yml` | **`9c112769d4311675b4eee89852cf7e51384bfb4b`** | **`e53dfa62`**; pinned digest `268cd8ca6dcb5cd35a1c7060ee112399d060db41bba9d4b0ed4a08bcdb10dd0b` |
-| spec | unchanged | **`9e1d006`** | `10256135` |
-| assembly | `69b8924` + `assembly-0001` (`4f1e522`) + `composed.yml` (`738857c`) + T007 v3 (`325131e`) + `bump-leg.py` spec (`23439bb`) and code | **`3891943274f74b6c87683153e35ee9a961b5b1eb`** | **`fd997c3d`** |
-
-*Superseded 2026-10-19:* r3's code row applied the earlier code-leg `tests.yml` patch, and its assembly row the
-earlier `assembly-0001`; the paths now hold the regenerated and the re-cut files (the note under section 2's
-apply table).
-
-What was checked:
-- **The code leg is #191's final head.** All 51 code-leg paths that `8246983` carries
-  have its blob.
-- **The assembly is valid.** `bootstrap.py` reports both legs "branch tip == pin";
-  `make validate` exits 0; `composed.yml`'s context step exits 0.
-- **It reproduces.** A fresh recursive clone bootstraps and validates the same way.
-
-**The install modules, composed** (`test_install_payload_source.py`,
-`test_openrepotools_command.py`, `test_install_skill_and_hook.py`,
-`test_install_by_rename.py`):
-- **How:** isolated, with `HOME`, `TMPDIR`, `--basetemp` and `PYTHONPYCACHEPREFIX` in
-  scratch. `OPENREPOTOOLS_COMPOSED=1`, with the assembly and spec roots named.
-- **SIGINT at its default:** reset before `flock`, and printed as
-  `default_int_handler` by the process that then became pytest, so F5 cannot recur.
-- **The lock:** one `flock` on the workstation lock, 2026-10-11T16:33:32Z–16:59:15Z,
-  at load about 150.
-
-| Run | Result |
-| --- | --- |
-| **r3, `8246983` + T007 v3** | **281 passed, 0 failed, 0 skipped** in 25:39 |
-| r3a, `6568f08` + T007 v3 (2026-10-10T23:52Z, superseded within the hour by `cddd1f7`) | 278 passed, 0 failed, 0 skipped in 10:59; code `663d775`, assembly `e195ba9` |
-
-**F1 is gone.** `test_r14_the_documented_upstream_skip_is_unchanged` passes in both
-module runs. Run alone in r3's composed tree it is `PASSED` (0.53 s). At `8246983` the
-test reads the command from conftest's own text, so composed mode no longer depends on
-`NEEDS_UPSTREAM` being a `skipif`.
-
-**The install, compared with main `f87fd5a`.** Same method as section 4 (one disposable
-home path, the same seed, `env -i`, refusing shims: **0 calls**):
-
-| Stage | Result |
-| --- | --- |
-| A: main `f87fd5a`'s `./openRepoTools --install` | exit 0; `17 of 17 placed`; 29 `installed at`; 29 receipt rows |
-| B: the r3 assembly root's `./openRepoTools --install` (T007 v3) | exit 0. First line: "source: the code mounted at `<clone>/code`, opensoft/openRepoTools-code at 9c112769d431… as `<clone>` pins it; every payload file was checked against that commit and nothing fetched". Then `17 of 17 placed`, 29 rows |
-| B2: the candidate again | exit 0; 31 `unchanged` |
-| C: main again, over B | exit 0; 1 `updated`, 30 `unchanged` |
-
-Between A and B the only differences are these two:
-- `~/.local/bin/openRepoTools`: `47cfe74e…` becomes `697fdbd4977454f18b80f33d3501c8d2b7dee44335f1afafbd1e1595d76f2aed`,
-  which is the bytes of `8246983:openRepoTools`, not the entry point (`8248224d…`);
-- that file's receipt row, and the receipt's timestamps.
-
-`settings.json` is byte-identical, and the foreign command and skills are untouched. C
-restores A, except the receipt's timestamps. r3a gave the same result with
-`6568f08`'s implementation, `b2ff0f1c…`.
-
-**What r3 changes, and what it does not.**
-- **F1 is closed** at #191's final head.
-- **The install path is green** in composed mode with T007 v3.
-- **F2–F6 stand as classified in section 5.** None is in these modules.
-- **This is not the full composed suite.** That run is redone once at the frozen source,
-  for Gate C.
-
-| r3 log (in the receipt's `logs/`) | SHA256 |
-| --- | --- |
-| `90-r3f-build.log` | `1654219464e453fdea2cc652b07decea9e6baf374055660b0ea485b9863b252a` |
-| `92-r3f-install-modules-composed.log` | `3eb6c875cdd223aaaf174ea5a8cb4fd09f1d2238323406326fd4664641e572b3` |
-| `93-r3f-install-check.log` | `364bd77941704c420008fa5f9ad13fc90da43e6cf6c3009acdc5e23149eb5095` |
-| `94-r3f-install-compare.log` | `09369829865ad226f4c2e8a4e71852c738ccb5981a5082dc8891caebd40acee0` |
-| `95-r3f-r14-composed.log` | `e66b0843a2ffa3fb74f386615ae0e6d40ad3a4f42bdbf6f3d127856e78c7f567` |
-| `80-r3-build.log` (r3a) | `1663134c45fbc3c3f8588a72d461d2e20205d653eca28861b0323e50d6325754` |
-| `82-r3-install-modules-composed.log` (r3a) | `bc11cf7936a75b9ba0851beca7b311dae7fd9d614103296ff36207b8cf156ddf` |
-| `84-r3-install-compare.log` (r3a) | `d3d15457017dc0fe84a0a5338a005c177ea0b5c118233a12ffb595c853d42674` |
-
-This record authorizes no conversion, repository creation, merge, default-branch move or
-lane rebinding.
diff --git a/specs/004-migrate-to-triad/consumer-reads-2026-10-07.md b/specs/004-migrate-to-triad/consumer-reads-2026-10-07.md
deleted file mode 100644
index 4d88c86a..00000000
--- a/specs/004-migrate-to-triad/consumer-reads-2026-10-07.md
+++ /dev/null
@@ -1,410 +0,0 @@
-# Consumer-side reads for T006/T007/T008: what outside openRepoTools depends on its layout or its installer
-
-Paths under the home directory are written portably (`~/`) because the repository's hygiene test refuses host-absolute paths in committed files; the originals are in lane 2's transcript.
-
-Bench paths are written as placeholders, defined here once, for the same reason. Each is a directory on the bench where the reads ran, and the commands below need them as shell variables:
-
-- `$PROJECTS`: the bench's projects directory, the one `~/projects` stood for there.
-- `$WB`: the workBenches checkout, `$PROJECTS/workBenches`.
-- `$BW`: the brett-wip checkout, `$PROJECTS/brett-wip`.
-- `$LS`: the lane-state root, `$PROJECTS/.lane-state`.
-- `$XF`: the xFactory checkout, `$PROJECTS/xFactory`.
-- `$ORT`: the openRepoTools checkout, `$PROJECTS/openRepoTools`.
-- `$ORTW`: the single-repository Speckit worktree root, `$PROJECTS/openRepoTools-worktrees`.
-- `$READS`: lane 2's worktree at the planning branch's commit ff6f6a7 (on lane 2's branch `004-migrate-to-triad-reads`), `$PROJECTS/.lane-worktrees/openRepoTools-2/triad-reads`.
-
-Three recorded searches keep a path inside a single-quoted `grep` pattern exactly as it was typed (the workBenches and brett-wip `grep -e '…'` lines, and the `.lane-state` count), because a placeholder in the pattern would change what was searched for. The hygiene test allows a path inside a single-quoted `grep` pattern and nowhere else. The paths these placeholders stand for are in lane 2's transcript and in this file as #189 landed it.
-
-Read at 2026-10-07T10:04:44Z–11:07:10Z by lane openRepoTools-2's writer, under #186, from ff6f6a7. An API-side error cut the run, and it resumed at 11:03:49Z, when every head was checked again.
-
-HEADs read:
-
-- workBenches `7fd01e30816b2f96e20e913208bd07b8682274af`. Dirty: yes, one modified submodule pointer, `sysBenches/cloudBench`. Every read used committed objects at that sha.
-- brett-wip `ab88a10347fb605588643e7ea2e528217dab9a67`. It had 215 untracked entries, which were not read. HEAD moved to `466c3a8` by 11:03:49Z and to `349caef` by 11:07:10Z. The line numbers below were checked again at `ab88a10`.
-- openRepoShape 7f84ca4 (`7f84ca42ca86a8902928345109d2bf6bad87bd91`).
-- openRepoTools main c4864ac (`c4864ac5e59db49d01f638a80ed38daf1d788182`).
-
-The plan files are read at `ff6f6a7c7b7921ca1e0b0234e898900f98532366` from lane 2's worktree. Brett Heap's 004 worktree was not entered.
-
-2026-10-07, relayed by the coordinator and not read here: Brett Heap opened PR #187 (planning branch `004-migrate-to-triad` at ff6f6a7 → main; lane 1 lands it). He also confirmed the leg names `openRepoTools-spec` / `openRepoTools-code`, both public, as recorded on #186.
-
-Revised 2026-10-07T11:21Z at lane 1's request: appended the section "Gate C follow-up list: outside changes and timing" (dated). No existing row, list or count above was changed.
-
-This document records facts only. "Covered" means installer-design.md at ff6f6a7 names the case; `l.N` cites that file. "(inferred)" marks a statement that was worked out rather than read.
-
-## Split as read from adoption-plan.yaml at ff6f6a7
-
-- **root (6 files):** `.gitattributes` (l.41), `.gitignore` (l.57), `AGENTS.md` (l.75), `CLAUDE.md` (l.83), `LICENSE` (l.91), `README.md` (l.99).
-- **spec (18 files):** `docs/` (l.145), `openspec/` (l.241), `specs/` (l.288).
-- **code (40 files):**
-  - `.github/`
-  - `.gitmodules`, `upstream/`
-  - the whole `contracts/` directory (l.136–144). Its `rule:` is `spec-governance`, but its `resolution:` puts it in code, because at the baseline it holds only `openreposhape-pin.yaml`.
-  - `commands/`, `skills/`, `repos.tsv`, `tests/`
-  - the executables: `claude-current`, `claude-restart-check`, `lane`, `lane-end`, `lane-handoff`, `lane-rename`, `lane-start`, `lanes`, `lanes-edit.sh`, `link-estates`, `openRepoTools`, `park`, `resume`, `status`
-- **Baseline:** `daed209` with 64 files (l.13–14). Main c4864ac tracks 100. Three of its top-level paths are under no mapped entry: `lane-worktrees`, `lanes-index` (both are in `INSTALLABLES` at `openRepoTools:338`) and `ideation/` (12 files). plan.md:58 puts "feature 001's retained `ideation/`" in spec.
-- **Planned additions at the root** (not in the mapping):
-  - the assembly `openRepoTools` entry point (installer-design.md:9–14; plan.md:64–67)
-  - generated manifest, Makefile, validators and assembly pins (plan.md:57)
-  - the shape's `validate.yml` (adoption-plan.yaml:53)
-
-## Exact commands
-
-Plan files (lane 2's worktree, same commit as the planning branch):
-
-```sh
-date -u +%Y-%m-%dT%H:%M:%SZ
-git -C $READS rev-parse HEAD
-git -C $READS status --short
-cat -n $READS/openspec/changes/migrate-to-triad/adoption-plan.yaml
-cat -n $READS/specs/004-migrate-to-triad/installer-design.md
-cat -n $READS/specs/004-migrate-to-triad/tasks.md
-cat -n $READS/specs/004-migrate-to-triad/plan.md
-cat -n $READS/specs/004-migrate-to-triad/spec.md
-```
-
-openRepoTools main (read-only; no fetch):
-
-```sh
-git -C $ORT rev-parse main c4864ac
-git -C $ORT ls-tree --name-only c4864ac
-git -C $ORT ls-tree -r --name-only c4864ac | wc -l                                   # 100
-git -C $ORT ls-tree -r --name-only daed20957f2dd2f22cca24053bb5bc8636ff6b3f | wc -l   # 64
-git -C $ORT diff --name-status daed20957f2dd2f22cca24053bb5bc8636ff6b3f c4864ac
-git -C $ORT ls-tree c4864ac upstream/openRepoShape
-git -C $ORT show c4864ac:.gitmodules
-git -C $ORT ls-tree -r --name-only c4864ac contracts
-git -C $ORT show c4864ac:openRepoTools > <scratchpad>/openRepoTools.c4864ac
-grep -n 'raw.githubusercontent\|gh api\|OPENREPOTOOLS_REPO\|OPENREPOTOOLS_REF\|^REPO=\|^REF=\|INSTALLABLES\|repos.tsv\|SCRIPT_DIR\|script_dir\|BASH_SOURCE\|\$0' <scratchpad>/openRepoTools.c4864ac
-grep -n 'selfdir\|skills/\|commands/\|contracts/\|upstream/\|docs/\|^[a-z_]*() *{' <scratchpad>/openRepoTools.c4864ac
-sed -n '1,135p;136,440p;955,1002p;1210,1222p;1285,1368p;1365,1400p;2490,2545p' <scratchpad>/openRepoTools.c4864ac
-git -C $ORT grep -n 'raw.githubusercontent\|gh api repos/opensoft/openRepoTools\|bash -s -- --install\|OPENREPOTOOLS_REF\|OPENREPOTOOLS_REPO' c4864ac -- README.md AGENTS.md docs
-git -C $ORT show c4864ac:repos.tsv
-git -C $ORT show c4864ac:lanes-edit.sh | grep -n 'repos.tsv'
-git -C $ORT show c4864ac:lanes-edit.sh | grep -n '\.lane-state'
-git -C $ORT show c4864ac:lane-worktrees | grep -n 'inventor'
-git -C $ORT show c4864ac:lane-worktrees | sed -n '2120,2128p;2164,2175p;2708,2716p;4808,4822p'
-git -C $ORT show c4864ac:link-estates | grep -n 'handoffs\|PROJECTS\|projects/\|estate'
-git -C $ORT show c4864ac:.gitignore
-for c in 2fb854f 5eb3d5f 500687c c4864ac; do git -C $ORT show $c:openRepoTools | sha256sum; done
-git -C $ORT show c4864ac:lane-worktrees | sha256sum
-git -C $ORT show c4864ac:lanes-edit.sh | sha256sum
-ls -la $ORT
-git -C $ORT status --porcelain=v1 --ignored
-cat $ORT/.git/info/exclude
-stat -c '%y' $ORT/.git/index   # 2026-10-07 04:28:20Z, before this read: the status call wrote no index
-```
-
-workBenches (read-only; committed objects at HEAD `7fd01e3`):
-
-```sh
-git -C $WB rev-parse HEAD
-git -C $WB status --porcelain=v1                     # " M sysBenches/cloudBench"
-git -C $WB worktree list
-git -C $WB show HEAD:.gitmodules
-git -C $WB submodule status
-git -C $WB grep -n -i 'openRepoTools' HEAD -- .       # 939 lines; per-file counts via cut | sort | uniq -c
-git -C $WB grep -n -e '/workspace/projects/openRepoTools' -e 'openRepoTools-worktrees' -e '\.lane-worktrees' -e 'raw.githubusercontent.com/opensoft/openRepoTools' -e 'repos/opensoft/openRepoTools' -e 'github.com/opensoft/openRepoTools' -e 'opensoft/openRepoTools/' -e 'projects/openRepoTools' HEAD -- .
-git -C $WB show HEAD:devBenches/base-image/upstream-pin.yaml
-git -C $WB show HEAD:devBenches/base-image/Dockerfile | sed -n '136,285p'
-git -C $WB show HEAD:devBenches/base-image/update-upstream.py | sed -n '68,90p;886,960p'
-git -C $WB show HEAD:devBenches/base-image/files/estate/estate-commands-start
-git -C $WB show HEAD:devBenches/base-image/files/estate/workbench-entrypoint | grep -n 'estate-commands-start\|openrepotools\|exec'
-git -C $WB ls-tree -r --name-only HEAD devBenches/base-image/files/openrepotools
-git -C $WB show HEAD:scripts/setup-estate-commands.sh | grep -n -i 'openRepoTools\|vendor\|files/\|OPENREPOTOOLS\|INSTALLABLES\|skills/\|commands/\|755\|link-estates'
-git -C $WB show HEAD:scripts/setup-estate-commands.sh | sed -n '158,200p;276,330p;370,405p'
-git -C $WB show HEAD:setup.sh | sed -n '176,200p'
-git -C $WB show HEAD:README.md | sed -n '188p;190p'
-stat -c '%y' $WB/.git/index    # 2026-10-06 13:08:26Z, before this read
-```
-
-openRepoShape at 7f84ca4 (bare clone in lane 2's scratchpad, `ors-verify/ors.git`):
-
-```sh
-git -C <ors.git> log -1 --format='%H %cI %s' 7f84ca42ca86a8902928345109d2bf6bad87bd91
-git -C <ors.git> grep -n -i 'openRepoTools' 7f84ca42ca86a8902928345109d2bf6bad87bd91 -- .        # 79 lines
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:openRepoShape" | grep -n 'raw.githubusercontent.com/opensoft/openRepoTools\|park and resume are installed by\|^[a-z_]*() *{'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:openRepoShape" | sed -n '14,22p;76,86p;158,164p;268,290p'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:README.md" | sed -n '400,410p;1355,1359p'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:docs/cli.md" | sed -n '143,148p'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:templates/workspace-root/AGENTS.md" | sed -n '28,34p;68,78p;88,95p'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:scripts/shape_advisory.py" | sed -n '504,512p'
-git -C <ors.git> show "7f84ca42ca86a8902928345109d2bf6bad87bd91:.github/workflows/tests.yml" | sed -n '268,282p'
-git -C <ors.git> ls-tree -r --name-only 7f84ca42ca86a8902928345109d2bf6bad87bd91 | grep -i 'pin\|gitmodules'
-git -C <ors.git> grep -n -i 'openRepoTools' 7f84ca42ca86a8902928345109d2bf6bad87bd91 -- contracts .gitmodules   # 0 lines
-```
-
-brett-wip (read-only; reads pinned at `ab88a10`):
-
-```sh
-git -C $BW rev-parse HEAD
-git -C $BW status --porcelain=v1 | wc -l             # 215, all untracked
-git -C $BW ls-tree --name-only HEAD
-git -C $BW ls-tree HEAD lanes/
-git -C $BW ls-tree -r --name-only HEAD | grep -i 'workspace.yaml'   # none
-git -C $BW grep -n -e '/workspace/projects/openRepoTools' -e 'openRepoTools-worktrees' -e '\.lane-worktrees/openRepoTools' -e '~/projects/openRepoTools' -e 'projects/openRepoTools' ab88a10347fb605588643e7ea2e528217dab9a67 -- .   # 341 lines
-git -C $BW show "ab88a10347fb605588643e7ea2e528217dab9a67:lanes/LANES.md" > <scratchpad>/LANES.md
-grep -n '^| lane\|^| `openRepoTools' <scratchpad>/LANES.md
-git -C $BW show "ab88a10347fb605588643e7ea2e528217dab9a67:lanes/log/openRepoTools-1.md"   # likewise -2, -3; sampled lines
-git -C $BW show "ab88a10347fb605588643e7ea2e528217dab9a67:lanes/repos.tsv" | sha256sum
-git -C $BW grep -n -e '\.local/bin/\(openRepoTools\|park\|resume\|status\|lane\|lanes\|lane-handoff\|lane-rename\|lanes-edit\.sh\|lane-start\|lane-end\|link-estates\|repos\.tsv\|claude-current\|claude-restart-check\|lanes-index\|lane-worktrees\)\b' -e 'share/openRepoTools' -e 'raw.githubusercontent.com/opensoft/openRepoTools' -e 'docs/README-lanes' -e 'openRepoTools-\(code\|spec\)' ab88a10347fb605588643e7ea2e528217dab9a67 -- .
-git -C $BW grep -n -i -e 'openRepoTools' -e '\.local/bin' HEAD -- README.md AGENTS.md CLAUDE.md scripts/link-estates
-ls -la $XF/lanes-edit.sh $XF/LANES.md
-find $LS/openRepoTools-{1,2,3} -type f
-grep -rn '^checkout:' $LS/openRepoTools-{1,2,3}
-grep -rn '^path: /workspace/projects/openRepoTools/' $LS/openRepoTools-{1,2,3} | wc -l
-```
-
-`~/.agents` and the home directory:
-
-```sh
-ls -la ~/.agents ~/.agents/protocols ~/.agents/templates
-cat -n ~/.agents/workspace.yaml
-grep -rn -i -c 'openRepoTools' ~/.agents/AGENTS.md ~/.agents/protocols/*
-grep -rn -e 'projects/openRepoTools' -e 'openRepoTools-worktrees' -e 'lane-worktrees/openRepoTools' -e 'raw.githubusercontent.com/opensoft/openRepoTools' -e 'repos/opensoft/openRepoTools' -e 'openRepoTools/installed.tsv' -e 'share/openRepoTools' -e 'openRepoTools/docs' -e 'docs/README-lanes' -e 'openRepoTools --install' -e 'openRepoTools/[A-Za-z]' ~/.agents/{AGENTS.md,protocols,workspace.yaml,templates}   # 59 lines
-grep -rln -i 'openRepoTools' ~/.agents/skills ~/.agents/templates ~/.agents/.skill-lock.json   # none
-cat ~/.agents/protocols/project-agent-bootstrap.md
-cat ~/.agents/protocols/openspec-speckit-workflow.md
-awk -F'\t' '{print NR, $1, $2, substr($3,1,12), $4}' ~/.local/share/openRepoTools/installed.tsv   # 29 rows
-sha256sum ~/.local/bin/openRepoTools
-grep -n 'lanes-edit\|lane-start\|xFactory\|openRepoTools\|\.local/bin' ~/.claude/settings.json
-grep -n -i 'openRepoTools' ~/.claude/CLAUDE.md                          # none
-grep -n -i 'projects/openRepoTools\|lane-worktrees\|raw.githubusercontent\|opensoft/openRepoTools\|docs/README-lanes' ~/.claude/skills/{handoff,restart,lane-swap}/SKILL.md ~/.claude/commands/*.md
-sed -n '318,336p' ~/.claude/skills/handoff/SKILL.md
-```
-
-## workBenches (`7fd01e3`)
-
-| file:line | what it assumes today | what the split changes | installer-design.md coverage |
-|---|---|---|---|
-| `devBenches/base-image/upstream-pin.yaml:56-125` (and `:30-32`) | Source `openrepotools` = `opensoft/openRepoTools` at `b1015f4`. Its 21 `path:` rows (15 commands, `skills/<n>/SKILL.md` ×3, `commands/<n>.md` ×3) sit at the repository root. `path` is "the path in the source repository and the path under `vendor_dir`". | After the split those paths are root files of `openRepoTools-code`. In the assembly they sit behind the `code` gitlink, so a re-vendor against `opensoft/openRepoTools` at a post-split commit would not find them (inferred). The pin is still at `b1015f4` with 15 names; main has 17. | not covered |
-| `devBenches/base-image/update-upstream.py:917-938, 941-956, 890-914` | `fetch_file` calls `gh api repos/<source>/contents/<path>?ref=<commit>`, falling back to `raw.githubusercontent.com/<source>/<commit>/<path>`. `fetch_tree_modes` reads `git/trees/<commit>?recursive=1`. `assert_on_default_branch` compares the commit with the source's default branch. All three expect blobs at those paths in that one repository. | Same as the row above. In the assembly tree, `code` is a gitlink, so neither the contents API nor tree modes reach the files (inferred). | not covered |
-| `devBenches/base-image/Dockerfile:216-238` (comment `:148-156`) | `COPY files/openrepotools/<15 names>` to `/usr/local/bin`, then `chmod 0755`. The comment says openRepoTools pins openRepoShape "as a submodule in that repository". | The flat vendored layout is unchanged if it is vendored from the code leg, which keeps the same file names at its root (inferred from the mapping). The submodule and its pin move to `openRepoTools-code`. | not covered |
-| `devBenches/base-image/Dockerfile:262-269` (`:240-249`) | Copies the whole vendored tree to `/usr/local/share/openrepotools`, then checks `openRepoTools`, `link-estates`, `skills/handoff/SKILL.md` and `commands/handoff.md` there. `--install` runs from that directory and copies every artifact "from its own directory". | That vendored `openRepoTools` must stay the code implementation, with siblings beside it. If the vendored file were an assembly entry point instead, it would have to delegate (inferred). | partial: l.9-14 ("Installed `openRepoTools` remains the code implementation"), l.40-48 ("legacy sibling behavior"). A vendored tree that is not a checkout is not named. |
-| `devBenches/base-image/files/estate/estate-commands-start:134, 157-186` | Requires `$ESTATE_VENDOR_DIR/openRepoTools` to be executable. It `sed`-reads the one-line `INSTALLABLES=(`, `SKILLS=(` and `COMMANDS=(` arrays out of that file, derives `skills/<n>/SKILL.md` and `commands/<n>.md`, and installs nothing if any file is missing. | The file it parses has to keep those three one-line arrays. An entry point without them stops this step at `:177` ("could not read openRepoTools' own INSTALLABLES/SKILLS/COMMANDS lists") (inferred). | not covered |
-| `estate-commands-start:239-240`; `scripts/setup-estate-commands.sh:378-381` | Runs `--install` with `OPENREPOTOOLS_REPO` and `OPENREPOTOOLS_REF` set to the sentinel `pinned-by-workBenches-no-fetch`, so that only sibling copies succeed. | The design resolves remote installs through `contracts/code-pin.yaml` at REPO/REF and refuses on transport or parse errors. A sentinel REPO with siblings and no pin is the legacy-sibling path. Today `wip_shape_ref` falls back to `main` when the pin fetch fails (`openRepoTools:2516`). | partial: l.30-33, l.47-48, l.83. The sentinel case is not named. |
-| `scripts/setup-estate-commands.sh:162, 173, 266-268, 285, 312-321, 402, 434` | `TOOLS_SHIM` is the vendored file. `TOOLS_FILES` (15) is checked against the shim's `INSTALLABLES`, `SKILLS` and `COMMANDS` (`check_shim_list`). Every one of the 21 files must have a pin row. After `--install`, each placed file must `cmp` equal to its vendored copy at mode 755. | Depends on the vendored tree mirroring the source root and on the shim's arrays, the same as the two rows above. `check_shim_list` would now see 17 `INSTALLABLES` against 15 (a fact on main, not caused by the split). | not covered |
-| `setup.sh:179-186, 208-209` | The host one-liner path: runs `scripts/setup-estate-commands.sh`, then `scripts/setup-workspace-repo.sh` (`openRepoTools wip init`). | Command names and help must hold. The route goes through the vendored tree (rows above). | partial: names and help, l.75. The vendored route is not named. |
-| `scripts/setup-workspace-repo.sh:253-265, 271, 361` | Finds `$OPENREPOTOOLS_BIN_DIR/openRepoTools`, otherwise `PATH`. Asks `openRepoTools --help` whether `wip` is documented. Prints `update-upstream.py … --source openrepotools --at <commit> --yes`. | The installed name, the `--help` text and `wip init` must hold. The `--source openrepotools` advice points at the pin source in the first row. | covered: l.75, l.87 |
-| `base-image/files/claude-profile:54-55, 557, 1649-1653`; `scripts/setup-claude-profiles.sh:213-224` | Matches the guard hook string byte for byte with openRepoTools's `GUARD_COMMAND` (cited as `openRepoTools:460-461`). Parses `openRepoTools --help`. Its install act is the string `openRepoTools --install`. Says `--install` owns the skill and command destinations. | Only installed names, help text, hook strings and destinations are read. The `openRepoTools:<line>` cites point into a file that moves to `code/`. | covered: l.59, l.75, l.86 |
-| `README.md:80, 93, 155-156, 172, 188, 190` | "the lane tooling is installed from `opensoft/openRepoTools`" (`:188`); "places fifteen files" (`:190`). | The implementation moves to `openRepoTools-code`. The assembly keeps the slug and the one-liner (installer-design l.9-11). | not covered |
-| `devBenches/base-image/files/openreposhape/openRepoShape:83, 280` (openRepoShape pin `71cf5de`) | A vendored copy of openRepoShape's raw-URL pointer `…/opensoft/openRepoTools/main/openRepoTools` (see the openRepoShape table). | The URL resolves only if the assembly root carries an `openRepoTools` file (inferred). | covered: l.9-11, l.75 |
-| `devBenches/base-image/files/openrepotools/lane-handoff:813, 913`; `…/lanes-edit.sh:11412, 11939`; `…/skills/handoff/SKILL.md:292` | Vendored openRepoTools code (`b1015f4`) derives `<parent of lane dir>/.lane-worktrees/<lane>`. | The same as the code's own assumption (installer table, lane-worktrees row). It holds while lanes keep `dir $ORT` (inferred). | not covered |
-| `devcontainer.test/test-setup-estate-commands.sh` (80 lines), `test-claude-profile-amendment-11.sh` (61), `test-setup-workspace-repo.sh` (52), and 8 more files under `devcontainer.test/` (57, including `README.md:70`); `test-claude-profile-lane-default.sh:282, 293`; `.github/workflows/speckit-git-bash.yml:19, 53` | The suites run or fake the vendored shim and its layout. `:282` and `:293` print `cwd $ORT`. The CI path filters are `devBenches/base-image/files/openrepotools/**`. | They follow whatever the vendored tree becomes. | not covered |
-| `docs/claude-multi-account-profiles.md` (20 lines; `:314` cites `:1559`, `:1568`, `:1579` of openRepoTools `63a74af`), `openspec/**` and `specs/**` (52 lines), `base-image/files/claude-statusline-command.sh:477`, `scripts/wave-container-shell.sh:55`, `files/speckit-worktree/…/resume.sh:451, 465`, `devBenches/devcontainer.test/test-speckit-git-feature.sh:3425, 3487` | Prose that names `opensoft/openRepoTools`, its issues, or file:line inside it. | The slug stays as the assembly. The files named move to `code/`. | not covered |
-
-## openRepoShape (`7f84ca4`)
-
-openRepoShape pins nothing of openRepoTools.
-
-| file:line | what it assumes today | what the split changes | installer-design.md coverage |
-|---|---|---|---|
-| `openRepoShape:279-280` (inside `install_commands`, which starts at `:250`): **the `--install` pointer line** | Prints `curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/openRepoTools`, piped to `bash -s -- --install`. That file must be the installer at the root of `opensoft/openRepoTools` on `main`. | The `openRepoTools` file moves to the code leg. The URL keeps resolving only through the planned assembly root entry point, which must delegate (inferred). | covered: l.9-14, l.75 (T007) |
-| `openRepoShape:81-83` (`--help`) | The same line. | Same as the row above. | covered: l.9-11, l.75 |
-| `README.md:404-408`, `docs/cli.md:145-147`, `docs/handbook.html:1542` (and `README.md:1357`, `docs/handbook.html:1646`) | The same line, byte for byte. | Same as the row above. | covered: l.9-11, l.75 |
-| `tests/test_repo_hygiene.py:1202-1224`; `tests/test_openreposhape_command.py:55-57, 154, 272, 278` | `OPENREPOTOOLS_INSTALL` is pinned byte for byte in `openRepoShape`, `README.md` and `docs/handbook.html`. `:278` asserts that `--install` makes no request naming openRepoTools. | The tests hold only while the URL string is unchanged. | partial: l.10-11 keeps the one-liners. These tests are not named. |
-| `templates/workspace-root/AGENTS.md:32, 71-76, 91-95`; `README.md:16, 18, 31, 58`; `handoffs/README.md:24`; `lanes/LANES.md:19, 40`; `lanes/log/README.md:4, 6`; `.gitattributes:8` | The template text that `openRepoTools wip init` copies into a WIP repository. It says the lane tooling (`lanes-edit.sh`, `lane-start`, `lane-end`, `test_lane_helpers.sh`, `link-estates`) and "README-lanes" live in `opensoft/openRepoTools`. | `docs/README-lanes.md` moves to `openRepoTools-spec`. The tools and `tests/` move to `openRepoTools-code`. | not covered: l.57 and l.87 cover only which template is selected, not its text |
-| `scripts/shape_advisory.py:509` | `workspace.yaml` is "the shape `opensoft/openRepoTools`' `resume` reads". | `resume` moves to `code/`. The shape of `workspace.yaml` is unchanged (inferred). | not covered |
-| `openRepoShape:19-25, 162`; `README.md:246, 1239`; `docs/handbook.html:495, 773, 782, 1538, 1739`; `AGENTS.md:429`; `.github/workflows/tests.yml:274`; the remaining test prose (for example `tests/test_openreposhape_command.py:17, 44`; `tests/test_repo_hygiene.py:70, 1190, 1230-1246`) | Provenance prose: `park` and `resume` are "opensoft/openRepoTools'". `AGENTS.md:429` says to read openRepoTools's `AGENTS.md` (which stays at the root). | The slug stays as the assembly. The named files move to `code/`. | not covered |
-| `contracts/**` and `.gitmodules` | No line names openRepoTools (`git grep` returns 0). The pins found in the tree are template pins only. | Nothing; openRepoShape still pins nothing of openRepoTools. | n/a |
-
-## brett-wip (`ab88a10`) and the host-local register state
-
-| file:line | what it assumes today | what the split changes | installer-design.md coverage |
-|---|---|---|---|
-| `lanes/log/openRepoTools-1.md:2`, `openRepoTools-2.md:2`, `openRepoTools-3.md:59` … (52 lines: 11 + 11 + 30) | STARTED, RESUMED and PAUSED records carry `home opensoft/openRepoTools; estate openRepoTools; dir $ORT`. That is the directory a lane is relaunched in. | In-place adoption keeps the slug as the assembly. The checkout keeps holding only 6 root files plus `spec/` and `code/` (inferred). The executables a lane runs from the checkout root move to `code/`. | not covered (rebinding is plan.md:223-224, T018) |
-| `lanes/log/openRepoTools-1.md:19`, `openRepoTools-3.md:291`, `:405`; `openXfactory-3.md:60`, `openXfactory-5.md:390`, `openxfactory-1.md:169` (+ `:253, 324, 411`) — 10 lines | Notes that name `.lane-worktrees/openRepoTools-1` and `-3`, `openRepoTools-cleanup-archives/…`, or `$ORT` as a working directory. | These are records of past acts. The paths stay valid while the assembly sits at the same path (inferred). | not covered |
-| `lanes/LANES.md:1109` (`openRepoTools-3`), `:1303` (`openRepoTools-1`), `:2581` (`openRepoTools-2`) | The rows carry a handoff path `handoffs/openRepoTools/…` and no directory column (header `:76`). Only `:1109` names a checkout: `--dir ~/projects/openRepoTools`. `~/projects` → `$PROJECTS`. | The handoff paths are in brett-wip and unaffected. The estate name `openRepoTools` stays. | not covered |
-| `lanes/LANES.md:36` (and `:1305`); 12 `docs/README-lanes` lines in 9 files (first: `handoffs/openRepoTools/brief-lane-openRepoTools-1-2026-09-16.md:9`, `session-handoff-2026-09-16-lane-openRepoTools-1.md:33`, `lanes/log/openRepoTools-1.md:22`) | "the manual lives at `docs/README-lanes.md` in `opensoft/openRepoTools`". | `docs/` moves to `openRepoTools-spec`. | not covered |
-| `lanes/repos.tsv:52` | The per-WIP alias override, read by `lanes-edit.sh` as `LANES_REPOS_TSV` (`lanes-edit.sh:2448`). It is byte-identical to the shipped table (sha256 `e4f9160a07ea…`). The only openRepoTools row is `openRepoTools` → `opensoft/openRepoTools`. | There are no `openRepoTools-spec` or `openRepoTools-code` rows, while the IRRS legs have them (`:29-30`, `:34-35`). The table header says an alias not in the table is refused, with a hint to spell owner/repo (shipped `repos.tsv:8`). | not covered |
-| handoffs naming the checkout root `$ORT`: 145 lines (first: `handoffs/openRepoTools/migration-handoff-2026-10-06.md:15, 16, 32`) | Reads, cwd records and commands run in the monorepo checkout. | After cutover, the checkout at that path is the assembly. Code and docs are under `code/` and `spec/` (inferred). | not covered |
-| `.lane-worktrees/openRepoTools-1` (50 lines), `-2` (3), `-3` (59) (first: `migration-handoff-2026-10-06.md:202`; `session-handoff-2026-10-02-lane-openRepoTools-2.md:19`; `session-handoff-2026-09-13-lane-openRepoTools-3.md:6`) | Lane worktrees are siblings of the lane directory, as monorepo worktrees. | Worktrees made after cutover would be worktrees of leg repositories. The triad protocol puts Speckit features under `<root>/worktrees/<NNN>/{spec,code}` (inferred from the protocol table below). | not covered |
-| `openRepoTools-worktrees`: 16 lines (first: `migration-handoff-2026-10-06.md:204-206`) | The single-repository Speckit worktree root, `../<repo>-worktrees`. | It becomes `<assembly root>/worktrees/<NNN>/{spec,code}` (`openspec-speckit-workflow.md:114`). | not covered (plan.md:207-208, T006, T016-T018) |
-| `~/projects/openRepoTools/lanes-edit.sh` (and `$HOME/…`): 20 lines (first: `handoffs/xFactory/attachments/opsXfactory-1/briefs/DELTA-land-444-r2.md:9`, `…-r4.md:4`, `…-r5-MERGE-WORKER.md:5`; also `session-handoff-2026-09-13-lane-openRepoTools-3.md:296`) | Runs the helper from the checkout root. | `lanes-edit.sh` moves to `code/` (path `~/projects/openRepoTools/code/lanes-edit.sh`, inferred). | not covered |
-| installed-tool paths `~/.local/bin/<command>`: 82 lines in 30 files (first: `README.md:85`, `README.md:86`, `scripts/link-estates:16`); `~/.local/share/openRepoTools/installed.tsv`: 7 lines in 3 files (first: `migration-handoff-2026-10-06.md:17, 57, 114`) | Installed destinations. `README.md:85-86` and `scripts/link-estates:16-17` are the pre-Amendment-9 legacy map from `~/.local/bin/lane-start` and `lane-end` to `brett-wip/lanes/*`. They name no openRepoTools checkout path, and neither do the legacy copies `lanes/{lane-start,lane-end,lanes-edit.sh,test_lane_helpers.sh,README-lanes.md}`. | Destinations are expected to stay the same. | covered: l.75, l.86 |
-| host-local `$LS/openRepoTools-{1,2,3}/trees/*.yaml` (not in git), e.g. `…/openRepoTools-2/trees/c95160057-…-triad-reads.yaml:5` | 37 tree records carry `checkout: $ORT`. 19 of them have a `path:` under `$ORT/.claude/worktrees/`, and 18 under `.lane-worktrees/openRepoTools-N`, including lane 1's workBenches worktrees (`…wb-image-rebuild-key.yaml:5`). | After cutover, new worktrees are of leg repositories. The checkout is the assembly root (inferred). | not covered |
-| `$ORT/handoffs` → `$BW/handoffs/openRepoTools` (symlink placed by `link-estates:399-408`) | The checkout root holds an untracked symlink. It is ignored by `.git/info/exclude` (`/handoffs`), not by the tracked `.gitignore` (3 lines). | The assembly root keeps the path (in place, inferred). Its `.gitignore` gets the shape merge (adoption-plan.yaml:338). | not covered |
-
-## `~/.agents` and the home directory
-
-| file:line | what it assumes today | what the split changes | installer-design.md coverage |
-|---|---|---|---|
-| `~/.agents/AGENTS.md:273-278` | The lane helpers "are commands `openRepoTools --install` places from `opensoft/openRepoTools` — with the alias table `repos.tsv` beside them". | The source of the bytes becomes the code leg, through the root entry point. The names stay. | partial: l.9-14, l.75 |
-| `~/.agents/AGENTS.md:327, 347-348, 367, 391-392, 419, 430, 443-444, 462, 488, 498` | "The code lands in `opensoft/openRepoTools`" for each amendment. | Code PRs land in `openRepoTools-code`, followed by an assembly pin bump (`openspec-speckit-workflow.md`, "Landing a feature"; inferred for this repository). | not covered |
-| `protocols/lane-collision-protocol-amendment-9.md:735, 943`; `-11.md:1511`; `-12.md:315`; `-14.md:185`; `-17.md:175`; `-18.md:222` | Name `docs/README-lanes.md` as the tooling's manual. | `docs/` moves to `openRepoTools-spec`. | not covered |
-| `protocols/lane-collision-protocol.md:659-666`; about 45 lines in amendments 8, 9, 11, 12, 16, 17 and 18 (first: `-8.md:194`, `-9.md:150`, `-11.md:1290`) | Name `openRepoTools --install` as the act that places the lane commands, skills and hooks. | Only the command name and act are read. | covered: l.75 |
-| `protocols/lane-collision-protocol-amendment-9.md:673, 1000` | `:673`: `--install` runs from the copies vendored at workBenches' `upstream-pin.yaml`. `:1000`: `gh api repos/opensoft/openRepoTools/contents/<f>` returned 404 for files not yet in the repository. | The contents-API paths at the assembly root change. | partial: l.54 covers the fetch. The protocol text is not covered. |
-| `protocols/openspec-speckit-workflow.md:114, 279-309`; `protocols/project-agent-bootstrap.md:96-131` | Single-repository `worktree_root: ../<repo>-worktrees`. Three-leg layout: `worktree_root: worktrees`, with `<root>/worktrees/<NNN>/{spec,code}`. | openRepoTools's feature worktrees move from `$ORTW/` to under the assembly root. | not covered (plan.md:207-208, T006) |
-| `protocols/project-agent-bootstrap.md:138-178, 221-226`; `openspec-speckit-workflow.md:57-66` | `setup-openspeckit` detects a triad from `project.yaml`. It writes `.specify/`, managed blocks, opsx commands and skill links at the root, and OpenSpec scaffolding in the spec leg. The first line of `AGENTS.md` is an invariant. The shared checkout's `.specify/`, `.claude/`, `.agents/` and `.codex/` are local and ignored (`.git/info/exclude`). | The bootstrap must be re-run in the assembly root after the legs exist. | not covered (T006; adoption-plan.yaml:346) |
-| `~/.agents/workspace.yaml:4-5` | `repository: opensoft/brett-wip`, `path: ~/projects/brett-wip`. No openRepoTools path. It is read by `openRepoTools:2211` and by `park`/`resume`. | Nothing in the file. | n/a |
-| `~/.agents/AGENTS.md:384`; `lane-collision-protocol.md:681`; `-14.md:93` | `${XDG_CONFIG_HOME:-$HOME/.config}/openRepoTools/lanes-index.conf`, a per-workstation configuration path. | Nothing layout-dependent (inferred). | n/a |
-| `~/.local/share/openRepoTools/installed.tsv` rows 1-29 (all stamped `2026-10-07T04:26:26Z`) | Rows 1-17 are `~/.local/bin/<INSTALLABLES>`. Rows 18-23 are the skills at `~/.claude-profiles/shared/skills/` and `~/.claude/skills/`. Rows 24-29 are the command files at both command dirs. The digests of `openRepoTools`, `lanes-edit.sh` and `lane-worktrees` equal the blobs at c4864ac. These rows consume the install, not the layout. | Names, destinations and receipt semantics are expected to stay the same. | covered: l.59, l.85-86 |
-| `~/.claude/settings.json:25, 37` | Hook commands `~/projects/xFactory/lanes-edit.sh guard` and `… session-start \|\| true`. That path is a symlink to `~/.local/bin/lanes-edit.sh`. These consume the install. | Nothing, if destinations hold. | covered: l.59, l.86 |
-| installed `~/.claude/skills/handoff/SKILL.md:329` (receipt rows 18-19; the `~/.claude-profiles/shared` copy has the same digest and was not opened) | The writer-poll loop sweeps `"$dir"/.claude/worktrees/*` and `"$(dirname "$dir")"/.lane-worktrees/"$lane"/*`. | Triad feature worktrees under `<root>/worktrees/<NNN>/{spec,code}` are outside both globs (inferred). | not covered |
-| `~/.claude/CLAUDE.md`; `~/.agents/skills/**`, `templates/**`; `openspec-speckit-workflow.md` and `project-agent-bootstrap.md` by name | None of them name openRepoTools. | — | n/a |
-
-## The installer's own assumptions (openRepoTools main `c4864ac`)
-
-| file:line | what it assumes today | what the split changes | installer-design.md coverage |
-|---|---|---|---|
-| `openRepoTools:6-11`; `README.md:228, 236-237` | The raw-URL one-liner `…/opensoft/openRepoTools/main/openRepoTools` and `gh api repos/opensoft/openRepoTools/contents/openRepoTools`, both piped to `bash -s -- --install`. | The file moves to code. The assembly root needs the entry point. | covered: l.9-14, l.75 |
-| `openRepoTools:70-72, 219-220`; `README.md:336-337` | `REPO="${OPENREPOTOOLS_REPO:-opensoft/openRepoTools}"`, `REF="${OPENREPOTOOLS_REF:-main}"`, `SELF="${BASH_SOURCE[0]:-$0}"`. | The default REPO now names the assembly. Payloads live in `openRepoTools-code`. | covered: l.16-21, l.79 |
-| `openRepoTools:258-275` (`fetch_from_repo`) | Fetches `repos/$REPO/contents/$path?ref=$REF`, falling back to `raw.githubusercontent.com/$REPO/$REF/$path`. The path is relative to REPO's root. | Code paths are not at the assembly's root. | covered: l.54 |
-| `openRepoTools:282-285, 338, 962-990` (`INSTALLABLES`, `collect_commands`) | "EVERY ONE OF THEM IS RESOLVED BY BARE NAME AT THE REPOSITORY ROOT". It copies `$selfdir/<name>` and fetches `<name>` otherwise. | The names sit at the code root, not the assembly root. | covered: l.40-48, l.55 |
-| `openRepoTools:1290, 1303, 1370-1398` (`collect_skills`) | `skills/<n>/SKILL.md` and `commands/<n>.md` beside `$SELF`, fetched otherwise. Run from `~/.local/bin`, the 12 skill and command files are fetched from REPO/REF (inferred: they are not in the bin directory). | A fetch from the assembly misses them. | covered: l.16-18, l.55, l.78 |
-| `openRepoTools:2502-2517` (`wip_shape_ref`) | Reads `$selfdir/contracts/openreposhape-pin.yaml`, else fetches `contracts/openreposhape-pin.yaml` from REPO/REF, else falls back to `main` (`:2516`). | `contracts/` moves to code. A fetch from the assembly would silently fall back to `main` (inferred from `:2516`). | covered: l.56 |
-| `openRepoTools:2519-2523, 2187, 2192` (`wip_fetch_template_file`) | `$selfdir/upstream/openRepoShape/templates/workspace-root/<rel>`, else `opensoft/openRepoShape` at the pinned ref. | `upstream/` moves to code. | covered: l.57, l.87 |
-| `openRepoTools:1218-1222` (`venv_note` comment) | Names the "convention `docs/README-lanes.md` states". | `docs/` moves to spec. | not covered (adoption-plan.yaml:328 follow-up) |
-| `openRepoTools:28-56, 393-396` against installer-design.md:61-64 | Main: 17 `INSTALLABLES`; "31 artifacts, 29 of them files, 29 rows". The design: "15 names … 27 placed files plus two hook entries, 29 artifacts". | The design's numbers are those of `daed209`. | partial: l.64-65 ("Derive counts from the lists") |
-| c4864ac tree against adoption-plan.yaml (baseline `daed209`) | `lane-worktrees`, `lanes-index` and `ideation/` (12 files) are tracked on main. | They are under no mapped path in the plan of record. | not covered (regeneration: T003, T012) |
-| `repos.tsv:52` (`:8`, `:29-30`) | The only openRepoTools alias is `openRepoTools` → `opensoft/openRepoTools`. Unknown aliases are refused. | There are no leg aliases. | not covered |
-| `openRepoTools:1320, 1352, 2211` | Hook commands name `~/projects/xFactory/lanes-edit.sh`. `workspace.yaml` is read from `${AGENT_PROTOCOL_ROOT:-$HOME/.agents}`. Neither depends on the layout. | Nothing (inferred). | covered: l.59, l.86 |
-| `lane-worktrees:2164-2172, 2712`; `lanes-edit.sh:12146-12214` | Lane roots are `<dir>/.claude/worktrees` and `<parent of dir>/.lane-worktrees/<lane>`. The inventory is `<parent of dir>/.lane-state/<lane>`. | There is no `<dir>/worktrees` root for triad Speckit features (inferred from `_roots`). | not covered |
-| `openRepoTools:291-292, 298-300, 322` | The comments name external consumers: workBenches' `setup-estate-commands.sh` 755 verification, `setup-claude-profiles.sh`, and `claude-profile` calling `claude-current`. | These are the workBenches rows above. | not covered |
-| `.gitmodules:1-3`; `upstream/openRepoShape` gitlink `39d5c986`; `contracts/openreposhape-pin.yaml` | The dependency unit read by `wip_shape_ref` and `wip_fetch_template_file`. | All three move to code together (plan.md:60, FR-004). | covered: l.56-57 |
-
-## Not covered by installer-design.md
-
-**workBenches (9):**
-
-1. `upstream-pin.yaml` source rows
-2. `update-upstream.py` fetch and tree-mode reads
-3. Dockerfile `/usr/local/bin` COPY and submodule comment
-4. `estate-commands-start` array parse
-5. `setup-estate-commands.sh` shim and pin checks
-6. `README.md` "installed from `opensoft/openRepoTools`"
-7. vendored lane code's `.lane-worktrees` derivation
-8. devcontainer tests and CI path filters
-9. prose and spec references
-
-**openRepoShape (3):**
-
-1. `templates/workspace-root` text naming README-lanes and the tooling's home
-2. `shape_advisory.py:509`
-3. provenance prose
-
-**brett-wip and register state (11):**
-
-1. lane log `dir` records
-2. other path-bearing log lines
-3. LANES.md rows
-4. README-lanes location lines
-5. `repos.tsv` override without leg aliases
-6. handoffs naming the checkout root
-7. `.lane-worktrees` lines
-8. `openRepoTools-worktrees` lines
-9. `~/projects/openRepoTools/lanes-edit.sh` lines
-10. host-local `.lane-state` tree records
-11. the `handoffs` symlink in the checkout root
-
-**`~/.agents` and the home directory (5):**
-
-1. "code lands in `opensoft/openRepoTools`"
-2. `docs/README-lanes.md` in the protocols
-3. the Speckit worktree root
-4. the `setup-openspeckit` re-run
-5. the installed handoff skill's writer-poll globs
-
-**Installer, own assumptions (5):**
-
-1. `venv_note`'s `docs/` reference
-2. the paths unmapped against the baseline (`lane-worktrees`, `lanes-index`, `ideation/`)
-3. `repos.tsv` leg aliases
-4. lane-worktrees and `.lane-state` roots
-5. comments naming external consumers
-
-Total: 33 rows not covered. A further 7 are partial: workBenches 3, openRepoShape 1, `~/.agents` 2, installer 1.
-
-## Could not read
-
-- **Brett Heap's worktree `$ORTW/004-migrate-to-triad`:** not entered, under the hard rule. The plan files were read from lane 2's worktree at the same commit, ff6f6a7.
-- **workBenches submodules** (`sysBenches/cloudBench`, which is modified, and `devBenches/*Bench`, `sysBenches/365Bench`): `git grep` at HEAD does not recurse into them. Not read.
-- **Other writers' trees:** workBenches feature worktrees (`speckit-worktrees/012`–`017`) and lane 1's `wb-*` worktrees. Not read.
-- **brett-wip:** the 215 untracked entries (`handoffs/xFactory/attachments/lane-opendox/…`) were not read. Commits after `ab88a10` (`466c3a8`, `349caef`) were not read.
-- **GitHub, live:** no network read was made. Every statement that a URL or contents path would 404 after the split is marked inferred. PR #187 and the #186 record were not read here.
-- **Raven** and any other workstation: not reachable from this bench.
-- **`~/.claude-profiles/shared/skills/*` and `shared/commands/*`:** not opened. The receipt shows the same digests as the `~/.claude` copies that were read.
-- **`git status` without `--no-optional-locks`** ran in `$ORT`, `$WB` and `$BW`. The first two `.git/index` mtimes (`2026-10-07 04:28:20Z`, `2026-10-06 13:08:26Z`) predate this read. brett-wip's (`11:05:49Z`) postdates other writers' commits, and this read ran only `show`, `grep` and `rev-parse` there after 10:06Z.
-
-## Gate C follow-up list: outside changes and timing (2026-10-07T11:21Z)
-
-Added at lane 1's request. The table has one row per not-covered item, 33 in all.
-
-- **`#`** follows the numbering of "Not covered by installer-design.md" above: W = workBenches, S = openRepoShape, B = brett-wip and register state, A = `~/.agents` and home, I = the installer's own assumptions.
-- **Outside change?** "yes" names the repository or host file to change. "no" means the change is in openRepoTools only. "no change" means nothing has to change.
-- **Timing:**
-  - ADDITIVE BEFORE CUTOVER: the change works against both today's single repository and the assembly.
-  - WAITS FOR REAL LEGS: the change needs the real leg repositories, their commits, the real code pin, or a lane rebinding.
-  - "—" means nothing to time.
-
-All timings are judged from the reads above. Rows that rest on judgement are marked "(inferred)".
-
-| # | consumer / file:line | change needed outside openRepoTools? | timing | one-line reason |
-|---|---|---|---|---|
-| W1 | workBenches `devBenches/base-image/upstream-pin.yaml:56-125` | yes: workBenches, the `openrepotools` source block (`source_repository`, `commit`, rows) | WAITS FOR REAL LEGS | `apply` refuses a commit not on the source's default branch (`update-upstream.py:890-914`) and reads modes from that commit's tree (`:941-956`), so it needs `openRepoTools-code` with the files landed. |
-| W2 | workBenches `update-upstream.py:917-956` | no change, if W1 names `opensoft/openRepoTools-code` (inferred) | — | The updater fetches `<path>` at any repository's root; only the pin's source changes. |
-| W3 | workBenches `devBenches/base-image/Dockerfile:148-156` (comment), `:216-238` | yes: workBenches, comment `:148-152` only. The COPY lines stay while the vendored tree mirrors the code root (inferred). | WAITS FOR REAL LEGS (inferred) | The comment says where openRepoShape is a submodule, which changes only when the dependency unit moves into the code leg. |
-| W4 | workBenches `estate-commands-start:157-186` | no: openRepoTools only. The code implementation that workBenches vendors keeps the one-line `INSTALLABLES`/`SKILLS`/`COMMANDS` arrays. | ADDITIVE BEFORE CUTOVER (inferred) | It is a constraint, and a test of it, that holds for today's file and for the code leg's; nothing in workBenches changes. |
-| W5 | workBenches `scripts/setup-estate-commands.sh:162-434` | no change for the split, if W1 keeps the source id `openrepotools` (read at `:285`) and the flat layout (inferred) | — | Its 15 `TOOLS_FILES` against main's 17 `INSTALLABLES` is a gap that exists on main today, not one the split causes. |
-| W6 | workBenches `README.md:188, 190` | yes: workBenches (optional prose) | ADDITIVE BEFORE CUTOVER (inferred) | `:188` ("installed from `opensoft/openRepoTools`") stays true through the assembly entry point; a clause naming `openRepoTools-code` after the split is true in both states. |
-| W7 | workBenches vendored lane code (`files/openrepotools/lane-handoff:913`, `lanes-edit.sh:11939`, `skills/handoff/SKILL.md:292`) | no: openRepoTools only. The fix lands in openRepoTools and reaches workBenches only through W1's re-vendor. | ADDITIVE BEFORE CUTOVER (inferred) | A worktree search can add `<dir>/worktrees/*/{spec,code}` today; a directory that does not exist is skipped. |
-| W8 | workBenches `devcontainer.test/*`, `.github/workflows/speckit-git-bash.yml:19, 53` | yes: workBenches, only if W1's re-vendor changes the vendored tree (inferred) | WAITS FOR REAL LEGS | These follow the vendored bytes, which change only with W1. |
-| W9 | workBenches prose: `docs/claude-multi-account-profiles.md`, `openspec/**`, `specs/**`, and others | no change (inferred) | — | The cites are pinned to commits (for example `63a74af`) or sit in archived or dated records. |
-| S1 | openRepoShape `templates/workspace-root/AGENTS.md:32, 71-76, 91-95`; `README.md:16, 18, 31, 58`; `handoffs/README.md:24`; `lanes/LANES.md:19, 40`; `lanes/log/README.md:4, 6` | yes: openRepoShape (optional template wording) | ADDITIVE BEFORE CUTOVER (inferred) | The text names the project slug, which survives; a clause naming the spec leg after the split reads true before and after. It reaches WIP repositories only once the openRepoShape pin openRepoTools carries moves (`openRepoTools:2502-2517`). |
-| S2 | openRepoShape `scripts/shape_advisory.py:509` | no change (inferred) | — | `resume` still reads `workspace.yaml`, so the docstring stays true. |
-| S3 | openRepoShape provenance prose (`openRepoShape:19-25, 162`; `README.md:246, 1239`; `docs/handbook.html`; `AGENTS.md:429`; tests) | no change (inferred) | — | The slug survives as the assembly, and the files are still `opensoft/openRepoTools`' at project level. |
-| B1 | brett-wip `lanes/log/openRepoTools-{1,2,3}.md` `dir` records (52 lines) | yes: brett-wip, new STARTED/RESUMED lines written by `lane-start`/`lanes-edit.sh`, only if a lane's directory changes at rebinding. In-place adoption keeps `$ORT` (inferred). | WAITS FOR REAL LEGS | The recorded `dir` changes only through a lane rebinding (T018); past lines are history. |
-| B2 | brett-wip other path-bearing log lines (10) | no change | — | The log is append-only history. |
-| B3 | brett-wip `lanes/LANES.md:1109, 1303, 2581` | no change (inferred) | — | The rows name brett-wip handoff paths, which do not move. |
-| B4 | brett-wip `lanes/LANES.md:36` (the other 11 README-lanes lines are dated records) | yes: brett-wip, the `LANES.md:36` header prose | ADDITIVE BEFORE CUTOVER (inferred) | A pointer naming the manual by project and by its spec-leg `docs/` location after the split is true in both states. Writes follow the file's HAZARD rule (`:1-8`). |
-| B5 | brett-wip `lanes/repos.tsv:52` (per-WIP override) | no: openRepoTools only (the shipped table, I3). The override need not change: "an override row … adds rows the shipped table does not carry" (`lanes-edit.sh:2440-2442`). | WAITS FOR REAL LEGS | Same reason as I3. |
-| B6 | brett-wip handoffs naming `$ORT` (145 lines) | no change (inferred) | — | In-place adoption keeps the checkout path, and the lines are dated records. |
-| B7 | brett-wip `.lane-worktrees/openRepoTools-{1,2,3}` lines (112) | no change (inferred) | — | The root is derived from the lane `dir`, which stays; the lines are dated records. |
-| B8 | brett-wip `openRepoTools-worktrees` lines (16), live in the canonical top blocks `session-handoff-2026-09-13-lane-openRepoTools-3.md:6`, `…-2026-09-16-lane-openRepoTools-1.md:8`, `…-2026-10-02-lane-openRepoTools-2.md:45` | yes: brett-wip, those top blocks, rewritten by each lane at its next handoff | WAITS FOR REAL LEGS | Live feature worktrees move to `<root>/worktrees/<NNN>/{spec,code}` only through T016-T017 translation and T018 rebinding. |
-| B9 | brett-wip `~/projects/openRepoTools/lanes-edit.sh` lines (20, all in `handoffs/xFactory/**`) | no change | — | All 20 are dated September records. The live hooks use `~/projects/xFactory/lanes-edit.sh`, which points at the installed copy. |
-| B10 | host `$LS/openRepoTools-{1,2,3}/trees/*.yaml` | no: openRepoTools only. These are host files written by `lanes-edit.sh`/`lane-worktrees`, not by hand. | WAITS FOR REAL LEGS | Records for leg worktrees can be written only once leg worktrees exist. |
-| B11 | host symlink `$ORT/handoffs` | no outside change. The host's `.git/info/exclude` (`/handoffs`) survives in-place adoption (inferred). An optional root `.gitignore` line would be an openRepoTools change. | ADDITIVE BEFORE CUTOVER (inferred) | An ignore line for `/handoffs` is valid in both shapes. |
-| A1 | `~/.agents/AGENTS.md:327, 347-348, 367, 391-392, 419, 430, 443-444, 462, 488, 498` | yes: `~/.agents/AGENTS.md`, only the lines whose code has not landed; landed ones are history | WAITS FOR REAL LEGS (inferred) | A landing can name `openRepoTools-code` only once that repository exists and takes PRs. |
-| A2 | `~/.agents/protocols/lane-collision-protocol-amendment-9.md:735, 943`; `-11.md:1511`; `-12.md:315`; `-14.md:185`; `-17.md:175`; `-18.md:222` | yes: `~/.agents/protocols` (ratified texts; any edit is the protocol owner's) | ADDITIVE BEFORE CUTOVER (inferred) | A pointer naming the manual's location in both shapes is true before and after. |
-| A3 | host `$ORT/.specify/extensions/git/git-config.yml:83` (`worktree_root: ../openRepoTools-worktrees`, ignored) | yes: that host file. The `~/.agents` protocols already describe both layouts (`openspec-speckit-workflow.md:114`). | WAITS FOR REAL LEGS | `setup-openspeckit` writes `worktree_root: worktrees` only for a detected three-leg root (`project-agent-bootstrap.md:117, 163`). |
-| A4 | host: the checkout root's ignored `.specify/`, `.claude/`, `.agents/`, `.codex/` | yes: those host files, through a `setup-openspeckit` re-run | WAITS FOR REAL LEGS | The bootstrap refuses a manifest whose spec leg is missing or empty (`project-agent-bootstrap.md:242-246`). |
-| A5 | installed `~/.claude/skills/handoff/SKILL.md:329` | no: openRepoTools only (`skills/handoff/SKILL.md`). It reaches `~/.claude*` through `--install` and workBenches through W1. | ADDITIVE BEFORE CUTOVER (inferred) | A third glob `"$dir"/worktrees/*/*` works today: an absent directory fails `[ -d "$worktree" ]` (`:330`) and is skipped. |
-| I1 | `openRepoTools:1218-1222` (`venv_note` comment) | no: openRepoTools only | ADDITIVE BEFORE CUTOVER (inferred) | A comment can name the manual in both places (adoption-plan.yaml:328 follow-up). |
-| I2 | c4864ac paths missing from adoption-plan.yaml (`lane-worktrees`, `lanes-index`, `ideation/`) | no: openRepoTools only (regenerate the plan; T003, T012) | ADDITIVE BEFORE CUTOVER | It is a plan-file change with no effect on today's repository, and the regenerated plan is the input to `execute`. |
-| I3 | `repos.tsv:52` (no leg aliases) | no: openRepoTools only (the shipped table) | WAITS FOR REAL LEGS | `repos.tsv:10-12` leaves out spellings not resolved to a repository, and `:23` adds a row "when a new repo first appears in a LANDING line". |
-| I4 | `lane-worktrees:2164-2172, 2712`; `lanes-edit.sh:12146-12214` | no: openRepoTools only | ADDITIVE BEFORE CUTOVER (inferred) | `_roots` can add `<dir>/worktrees` today; an absent directory yields nothing. |
-| I5 | `openRepoTools:291-292, 298-300, 322` (comments naming consumers) | no change (inferred) | — | The workBenches files named there keep those roles after the split. |
-
-**Outside-change rows (12):**
-
-- workBenches 4 (W1, W3, W6, W8)
-- openRepoShape 1 (S1)
-- brett-wip 3 (B1, B4, B8)
-- `~/.agents` 2 (A1, A2)
-- host-local files in the shared checkout 2 (A3, A4)
-
-**Timing, all 33 rows:** ADDITIVE BEFORE CUTOVER 11, WAITS FOR REAL LEGS 11, no change 11. Of the 12 outside-change rows, 4 are additive (W6, S1, B4, A2) and 8 wait (W1, W3, W8, B1, B8, A1, A3, A4).
-
-**Partial rows not included.** None of the 7 partials is judged to need an outside change (inferred):
-
-- workBenches 3 (the `/usr/local/share` vendored tree, the sentinel REPO/REF case, and `setup.sh`): all rest on openRepoTools's code implementation staying the vendored file.
-- openRepoShape 1: its install-line tests change only if the URL changes, and installer-design keeps the URL.
-- `~/.agents` 2: `AGENTS.md:273-278` stays true through the root entry point, and the `amendment-9.md:673, 1000` text is a dated record.
-- installer 1: the stale counts in installer-design.md are an openRepoTools-side fix.
-
-**Erratum, no row changed.** The brett-wip row for `~/projects/openRepoTools/lanes-edit.sh` in the table above also cites `session-handoff-2026-09-13-lane-openRepoTools-3.md:296`. That line names `$ORT/handoffs/`, not `lanes-edit.sh`. All 20 `lanes-edit.sh` lines are in `handoffs/xFactory/**`. The command used to check this:
-
-```sh
-git -C $BW show "ab88a10347fb605588643e7ea2e528217dab9a67:handoffs/openRepoTools/session-handoff-2026-09-13-lane-openRepoTools-3.md" | sed -n '296p'
-```
-
-The commands this revision added (read-only):
-
-```sh
-git -C $ORT show c4864ac:lanes-edit.sh | sed -n '2440,2470p'
-git -C $ORT show c4864ac:repos.tsv | sed -n '8,14p;23p'
-grep -n 'missing or empty\|worktree_root: worktrees\|exits non-zero when the manifest' ~/.agents/protocols/project-agent-bootstrap.md
-grep -n '\[ -d "\$worktree" \]' ~/.claude/skills/handoff/SKILL.md
-ls $ORT/.specify/extensions/git/
-grep -n 'worktree_root\|checkout_mode\|base_branch' $ORT/.specify/extensions/git/git-config.yml
-```
diff --git a/specs/004-migrate-to-triad/data-model.md b/specs/004-migrate-to-triad/data-model.md
deleted file mode 100644
index 2dc89f10..00000000
--- a/specs/004-migrate-to-triad/data-model.md
+++ /dev/null
@@ -1,21 +0,0 @@
-# Migration records
-
-These records describe migration evidence; they confer no runtime ownership
-and never replace lane claims, workspace pointers or the standard's pins.
-
-| Record | Required facts |
-| --- | --- |
-| Adoption plan | Source repository/commit, standard revision evidence, names/visibility, reasoned path owners, follow-ups, coverage result and approval binding. Relative paths only in shared artifacts. |
-| Work inventory | Observation time, branch/PR/head identity, detached status, readable/dirty indication and snapshot limits. Public `inventory.json` omits host paths and private work. |
-| Private preservation receipt | Exact original worktree/binding, branch refs, staged/unstaged/untracked/ignored content digests, backup location and verified restore result. Stored host-locally or in existing private WIP storage. |
-| Feature migration receipt | Original merge base/head and captured content; approved original proposal repository/commit/path; verified extracted spec correspondence; spec/code/root mapping; resulting branches/commits/checksums; repaired links/task roots, conflict decisions, roles and approval. |
-| Bounded amendment record | Feature-local ID, governing proposal/immutable approved baseline, authority/source, affected requirements/tasks, interpretation, verification impact, implementation/evidence references and disposition. Relative code paths; no second canonical spec/task store. |
-| Final spec reconciliation | One issue created at first amendment; all dispositions/net effect, dated departures/as-built record, preserved approval/archive history, verification, landed code identity, deferred future issues and matching spec/code/assembly landing references. |
-| Workflow qualification | Explicit root/store/branch selection; manual instruction availability on each target workstation; pending schema/routing/distribution/upstream placement owners and any reviewed local exception. |
-| Composed candidate evidence | Root/spec/code/standard commits, pin/digest consistency, installer payload revision, platform/CI/rehearsal/rollback results and outstanding findings. |
-| Cutover approval | Actual candidate/baseline, visibility, leg names, preservation/rehearsal references, lane breakpoints and authorized actions. |
-
-Generated `elected_by`/date metadata and `execution_authorized: false` in the
-preliminary plan are informational. The adoption script does not enforce the
-custom planning flag; the operator must not call real `execute` before the
-reviewed approval gate. An inventory snapshot is never proof of backed-up work.
diff --git a/specs/004-migrate-to-triad/gate-ab-evidence-2026-10-09.md b/specs/004-migrate-to-triad/gate-ab-evidence-2026-10-09.md
deleted file mode 100644
index d0362242..00000000
--- a/specs/004-migrate-to-triad/gate-ab-evidence-2026-10-09.md
+++ /dev/null
@@ -1,705 +0,0 @@
-# Gate A/B evidence, the restore and rollback rehearsal, and the follow-up inventory — October 9, 2026
-
-**Task:** T011 of [tasks.md](tasks.md), under [#186](https://github.com/opensoft/openRepoTools/issues/186).
-No task is checked complete by this record, and it approves nothing.
-**Writer:** lane openRepoTools-1, 2026-10-09T00:36Z–01:1xZ.
-**Refreshed:** lane openRepoTools-2, 2026-10-09T18:51Z–20:3xZ (commit `c1283b5`), on branch
-`004-migrate-to-triad-rollback-refresh` (from `fa44d75`). It answers lane 3's review of
-`fa44d75` (#186 comment 6082139424, whose findings are cited here as F1–F22) and folds in
-lane 2's verification of the receipt (#186 comment 6082370012). Each refreshed passage
-starts with "Refreshed" or "Corrected"; the 01:1xZ text it qualifies stays as written
-unless a finding showed it wrong. Origin was read at 2026-10-09T20:29:34Z–20:30:29Z, with
-main at `f87fd5a`, and again before the push (section 8). Lane 3's review of `c1283b5`
-(#186 comment 6089982753, N1–N9) is answered by two later commits on this branch.
-**Evidence branch:** `004-migrate-to-triad-rollback` (from main `837928a`).
-**Private receipt ID:** `rollback-20261009-ILvoVC` (brett-wip `migration/openRepoTools/`),
-holding every script, log, snapshot and digest named below. Machine paths stay there. It
-has two commits (F17):
-- `56f1e7c4` (00:59:32Z): 424 files, 423 of them listed in one `SHA256SUMS`;
-- `076062af` (01:14:30Z): 18 more files, the final real-surface snapshot (`state/final/`,
-  01:13:46Z; section 3) and the two hygiene logs (section 8), with `README.md` and
-  `SHA256SUMS` updated: 442 files, 441 listed.
-
-Refreshed: brett-wip `ea6c09d1` holds the receipt exactly as `076062af` left it, and
-`sha256sum -c SHA256SUMS` gives 441 OK.
-
-T011 asks for three things. First, a rehearsal of restoring the local candidate and the
-installed payload from the preserved artifacts. Second, proof that user work, jobs and claims
-survive with no force push, no destructive reset and no workspace-pointer rewrite. Third,
-publication of the Gate A/B evidence with the follow-up patch and commit inventory.
-Sections 1–3 are the rehearsals, measured today. Sections 4–6 are the index and the
-inventory. Section 7 is what Gate B still lacks.
-
-**Short answer.**
-- **Source restore:** passes, 90 checks of 90.
-- **Installed payload:** the 29 placed files restore to the main install exactly by either
-  path; only the reinstall (c2) also restores the receipt. Refreshed (F13): the target is
-  main's install, not the home before any install, because the first install rewrites
-  `settings.json` at mode 600 and both rollbacks keep that.
-- **Hooks and settings: not rehearsed** (F11). No stage changed a hook entry or
-  `settings.json`, so section 2's hook rows test nothing about hooks, and the Gate A
-  backup holds no `settings.json` for `RESTORE.md`'s copy-back to restore.
-- **What the rehearsals wrote:** only private scratch. Nothing in a real repository, the
-  real home or the register.
-- **Gate B is still open.** Section 7 lists what is missing.
-
-## 1. Restore rehearsal of the source
-
-The source is the Gate A backup `prep-20261007T100559Z` (host-local, read-only). The
-rehearsal followed its `RESTORE.md` commands, with only the placeholder paths replaced by
-private scratch. **90 checks passed, 0 failed.**
-
-Refreshed (F5): how the 90 add up, from receipt `logs/10-restore.log`.
-- 22 single checks: the manifest 1; `RESTORE.md`'s mirror clone, working clone, fetch and
-  `set-url` 4; `bundle verify` inside the clone 1; refs 3 (each restore against the
-  capture, and the capture against the shared checkout today); `fsck` 2; the object set 1;
-  `RESTORE.md`'s worktree procedure on `main` 6; the dependency bundle 4.
-- 68 tree checks: 4 for each of the 17 captured trees.
-
-The 97 of #189 (`preservation-2026-10-07.md:89`; receipt `prep-20261007T100559Z`,
-`verify.log`) were 12 single checks plus 5 for each tree (85).
-- This run did not repeat 18 of them: the status-and-lists comparison for the 16 trees
-  other than `main` (October 7 made it for all 17, `preservation-2026-10-07.md:95–98`;
-  this run made it for `main` only, below), the bundle's `HEAD` against the main
-  checkout's (`verify.log:12`), and one check that the bundle carries the 16 per-worktree
-  `HEAD` refs (`verify.log:13`: one check, not 16).
-- It added 11: the manifest, the mirror clone, `set-url`, `bundle verify`, the capture
-  against the shared checkout today, the second `fsck`, and five steps of the worktree
-  procedure on `main`.
-- `main`'s status-and-lists comparison moved from the tree checks to the single ones
-  (`logs/10-restore.log:160`). So the single checks are 12 − 2 + 1 + 11 = 22, the tree
-  checks are 85 − 17 = 68, and the total is 97 − 18 + 11 = 90.
-
-- The manifest (414 entries) passes `sha256sum -c`. Refreshed (F4): it lists the two
-  bundles restored here, source `60db3acd…` and dependency `aa5a6eca…`, which are the
-  digests #189 published (`preservation-2026-10-07.md:49–50, 54`), and its own digest is
-  #189's `2a46dff9…` (`:59`). So the bundle restored here is the one #189 recorded. Both
-  bundle files still hash to those values (re-hashed 2026-10-09T20:35:05Z).
-- **`RESTORE.md`'s `git bundle verify`, run from the backup directory as written, exits 1:**
-  `error: need a repository to verify a bundle`. Run inside the restored clone, it exits 0.
-  This is a defect in `RESTORE.md`'s text. It is recorded here; the backup is read-only and
-  was not edited.
-- The `--mirror` restore and the working clone each list the same 33 refs, with the same SHA
-  each, as the live `for-each-ref` at bundle time. The working clone is a `clone`, then
-  `fetch --update-head-ok --prune '+refs/*:refs/*'`. `git fsck --full` prints nothing and
-  exits 0 for both.
-- The 2902 objects reachable from the 50 bundled tips are identical. The sorted-list SHA256
-  is `338cb7bdd397076eeced1de0852eeb1510b4f97e02fb3f62de434531c7be327d`.
-- **Against the live repository today, two days on**, the 33 captured refs are as below.
-  Corrected: "live" here is the shared checkout's own `for-each-ref`, read at 00:44:08Z
-  (`10-restore.sh:58`, `logs/10-restore.log:1`), not GitHub. #189 had merged on GitHub as
-  `63810dd` at 00:44:03Z, and that checkout's `main` still read `837928a`.
-  - 26 identical;
-  - 7 moved forward only: `main`, `origin/main` and `origin/HEAD` to `837928a`, the three
-    October 7 evidence branches, and lane 3's `feat/triad-lane-tooling`;
-  - 0 deleted;
-  - **0 moved by anything other than a fast-forward**.
-
-  18 refs were added since the capture.
-
-  Refreshed 2026-10-09T20:29:34Z, against GitHub (`git ls-remote`; a local branch and its
-  remote-tracking ref are read as the GitHub branch of that name, and `pr/N` as
-  `refs/pull/N/head`): 15 identical, 9 moved forward only, 9 with no GitHub ref of that
-  name, and **0 moved by anything other than a fast-forward**. Each of those 9 commits is
-  still contained in a GitHub ref; for example `e43b243` is in `refs/pull/188/head`.
-- **All 17 captured trees:**
-  - each HEAD resolves in the restore;
-  - each tree ID equals the live one;
-  - every index object is present;
-  - the index a checkout of each HEAD makes equals the captured `index.ls-files-s` byte
-    for byte (17 of 17).
-
-  Refreshed (F6): two of these four prove little on their own.
-  - "Tree ID equals the live one" compares the tree of the same commit ID, read in the
-    restore and in the shared checkout (`10-restore.sh:94–95`). A commit ID fixes its
-    tree ID, and `fsck` already covers the objects.
-  - All 17 captures were clean (`preservation-2026-10-07.md:69–85`, Dirty 0), so each
-    captured index is its HEAD's tree. The byte-equal index proves that the objects are
-    present, not that index state survives a restore. The dirty-tree stand-in below is
-    the evidence on index state.
-- **One tree by `RESTORE.md`'s own procedure**: `main`, the capture with workflow files.
-  - The steps: `worktree add --detach`, copy the captured files back, restore the captured
-    exclude file.
-  - Its index (100 entries) equals the capture.
-  - All 70 copied files match `files.sha256`. Refreshed (F7): these are the 70 regular
-    files. With one symlink they are the 71 workflow entries #189 counts for `main`
-    (`preservation-2026-10-07.md:61`; receipt `prep-20261007T100559Z`,
-    `file-lists/main.classified.tsv`: 70 `workflow-copied-verified`, 1
-    `workflow-copied-symlink-verified`), and `files.sha256` lists regular files only. 71
-    ignored files are restored (`logs/10-restore.log:160`).
-  - Its tracked status and its untracked and ignored lists equal the capture's, less the 4
-    cache entries the capture lists as not copied. Corrected: those 4 are nested
-    repositories (`nested-repository-not-copied` in the same file), not caches.
-- Both dependency commits resolve from the dependency bundle. Each one's own `tree_digest`
-  gives the recorded value: `39d5c98` → `a44c0165…`, `7f84ca4` → `3be52767…`.
-
-### A worktree captured dirty
-
-The 17 Gate A captures were all clean, so the dirty case was rehearsed on a disposable
-stand-in: a clone of the Gate A bundle given every kind of change:
-- an unstaged edit and a staged edit;
-- a staged new file and a partly staged file;
-- an unstaged deletion and a staged deletion;
-- a mode change;
-- an untracked note;
-- ignored workflow configuration and an ignored cache.
-
-Each capture was bundled and rebuilt into a fresh clone that held only the bundle's objects,
-as a real restore would.
-
-| Capture | Index equal | Status equal | Every file equal (100) |
-| --- | --- | --- | --- |
-| A: the per-worktree block of the backup's own `capture.sh`, verbatim (corrected below: a copy) | **no**: 3 staged blobs are in no bundle | **no** | **no** |
-| B: A plus `git diff --cached --binary`, `git diff --binary` and every untracked file | yes | yes | yes |
-
-Corrected (lane 2's verification, #186 comment 6082370012): the receipt's copy of that
-block (`11-dirty.sh:42–66`) is not verbatim. Against the backup's `capture.sh:68–92` it
-drops the info-exclude copy (`:75–77`) and the `skipped-secret-like.tsv` append (`:82`).
-Lane 2 ran the backup's own block, verbatim, on the same stand-in: 0 of 3 again, with the
-same 3 staged blobs in no bundle. Corrected: the public comment states that result and
-marks as inferred only its conclusion, that the omissions change nothing. The run's own
-log is host-local, in lane 2's private prep area, and is not published, so no public
-citation for the run itself exists.
-
-**Finding for Gate A.** The October 7 capture takes three things from a tree: its index
-*listing*, its ignored workflow configuration, and its HEAD. It takes none of its working
-state. That was enough only because all 17 trees were clean. For any tree that is not clean,
-the final capture at the owner-coordinated freeze must take B's three extra artifacts, or
-must refuse to call that tree captured. B's rebuild is:
-1. `worktree add --detach <HEAD>`;
-2. `git apply --index staged.patch`;
-3. `git apply unstaged.patch`;
-4. unpack the untracked archive;
-5. copy back the workflow files.
-
-## 2. Rollback rehearsal of the installed payload
-
-All of it ran in disposable homes under private scratch, never the real home.
-- Every `--install` ran under `env -i` with:
-  - `HOME` and every `XDG_*` variable pointed into that home;
-  - `TMPDIR` in scratch;
-  - `PATH` = refusing `gh`/`curl`/`wget` shims, then `/usr/bin:/bin`;
-  - `GIT_ALLOW_PROTOCOL=file`.
-- **The shims logged 0 calls.**
-- Each home was seeded with things an install must leave alone:
-  - unrelated `settings.json` content: a model, an env, permissions, a status line, and
-    unrelated `SessionStart`, `UserPromptSubmit` and `Stop` hooks;
-  - a foreign command in `~/.local/bin`;
-  - a foreign skill under each of the two skill roots.
-
-| Stage | Source | Commit |
-| --- | --- | --- |
-| (a) today's main | a fresh clone of `origin/main` from GitHub, `./openRepoTools --install` | `63810dd` |
-| (b) the rehearsed candidate | run C's assembly cloned recursively; installed from **`code/`**, the code leg's own `openRepoTools` | assembly `69b8924`, code `73b04d6` |
-| (b″) a candidate whose payload differs | PR #191's head, a fresh clone | `ecd7aa4` |
-| (c1) roll back by copy | `cp -a <backup>/installed/. "$HOME/"`, `RESTORE.md`'s command | the Gate A copies of the 2026-10-07T04:26:26Z install |
-| (c2) roll back by reinstall | `./openRepoTools --install` from the source restored in section 1 | `c4864ac` |
-
-Notes on the sources:
-- **(a):** main moved during the run. #189 landed as `63810dd` at 00:44Z. It touched
-  only `specs/` and `openspec/`, so its payload is byte-identical to `837928a`'s.
-- **(b):** T007's assembly root entry point was **not** used. No
-  `004-migrate-to-triad-installer` branch is on origin, so (b) installed through
-  `code/openRepoTools`. Refreshed (F15): that branch has been on origin since 01:21:15Z,
-  at `51993a4`, 7 min 40 s after this branch's last push (section 4).
-- **(b″):** it is not the T007 candidate. It is used only because a rollback is shown best
-  where the payload differs.
-
-**The four homes:**
-- H1: (a), (b), (c1).
-- H2: (a), (b), (c2).
-- H3: (a), (b″), (c1).
-- H4: (a), (b″), (c2).
-
-Every install exited 0, printed `17 of 17 placed` and wrote 29 receipt rows. The first in each
-home merged the 2 hook entries; every later one printed `already installed … (unchanged)` for
-both.
-
-**Refreshed (F11): so no stage changed a hook, and the hook rollback is vacuous.**
-- In all four homes the two hook entries and the canonical `settings.json` are identical at
-  (a), at (b) or (b″), and at (c) (receipt `state/homes/H1`–`H4`, `hooks.ours` and
-  `settings.canon`). Every candidate here writes the same two entries main writes.
-- So the row "(c) the two hook entries: same" below shows that nothing moved, not that a
-  moved hook comes back. Commit `849592b`'s subject, "both rollbacks return every placed
-  file, mode and hook to main's install", holds for hooks only in that sense.
-- (c1) cannot roll back a hook or a setting at all. The Gate A backup's `installed/` holds
-  the 29 placed files and no `settings.json`; no file in the backup is a `settings.json`;
-  and `RESTORE.md:45` copies back `installed/` only. The backup does hold the 29-row
-  `installed.tsv` of 2026-10-07T04:26:26Z at its top level, which `RESTORE.md` does not
-  copy back (F14; section 7, item 6).
-- No candidate measured to date changes a hook or `settings.json`:
-  - (b) and (b″) here;
-  - PR #191 at `13cc752`: `settings.json` and both hook entries are byte-identical to
-    main's install (lane 3's delta review 5471121210, finding 2);
-  - the composed candidate at `935f53f`: `settings.json` is byte-identical (lane 3's
-    review, #186 comment 6082068576, finding 4).
-
-  A candidate that does change one would need this rollback rehearsed, by (c2), with a
-  payload whose hook entry differs.
-
-| Compared with (a) | H1 (b)→(c1) | H2 (b)→(c2) | H3 (b″)→(c1) | H4 (b″)→(c2) |
-| --- | --- | --- | --- | --- |
-| (b) placed files (path, mode, sha256) | same | same | **1 differs** | **1 differs** |
-| (c) placed files (path, mode, sha256), 29 | same | same | same | same |
-| (c) receipt rows (name, destination, sha256) | same | same | **1 stale row** | same |
-| (c) the two hook entries (never changed; see above) | same | same | same | same |
-| (c) `settings.json`, canonical; its mode | same; same | same; same | same; same | same; same |
-| unrelated settings after every stage = the seed | yes | yes | yes | yes |
-| foreign command and skills after every stage | untouched | untouched | untouched | untouched |
-| (c) the set of paths under the home | same | same | same | same |
-
-**Every difference, verbatim:**
-- **(b″) vs (a), in H3 and H4.** `~/.local/bin/openRepoTools  755
-  47cfe74ea96e6ce9e56b47220a71e1de8c608af2f51f33cfdffa351410a4f373` became
-  `71e9ba2c9a06b755c79f3d01b52516ce0c1cfcc3a3c6a92b5fd200976b0787a4`, PR #191's installer.
-  Both rollbacks put `47cfe74e…` back.
-- **(c1) in H3: the copy-back leaves the receipt stale.** The receipt row
-  `openRepoTools  ~/.local/bin/openRepoTools  71e9ba2c…` still names the replaced file. The
-  file on disk is `47cfe74e…`. `RESTORE.md`'s copy-back restores the 29 files and not
-  `installed.tsv`. A later `--install` that retires a file asks the receipt whether it wrote
-  that file, and would get the wrong answer. **(c2) rewrites the receipt** and has no such
-  row.
-- **In every home, (c) vs (a), the whole-home comparison differs in one file only:**
-  `installed.tsv`. That is its UTC stamp column, plus H3's stale row above. Examples:
-  - H2: `145f4de8…` vs `09a03339…`;
-  - H4: `74cfc104…` vs `9e8b2a59…`.
-- **The first install changes `settings.json`'s mode from 644 to 600.** The installer prints
-  that it writes the file back at mode 600. This is by design and is the same in (a) and (c).
-
-**What this run cannot show.** The rehearsed candidate's payload is blob-identical to
-main's: filter-repo keeps every blob. So (b)→(c) in H1/H2 rolls back no bytes, and only
-checks the mechanism. Receipts, hooks, unrelated settings and foreign files hold through a
-candidate install and a rollback. H3/H4 show a real byte rollback with PR #191's installer.
-The real T014/T015 candidate, with #191 and the T007 entry point, must repeat (c2) at its
-own exact commits.
-
-Refreshed (F13): two more things it cannot show.
-- **No stage adds or retires a placed file.** All 12 snapshots after the seed, in the four
-  homes, place the same 29 paths (receipt `state/homes/*/*/placed.tsv`). So two hazards are
-  argued here, not run: (c1) leaving behind a file a candidate added, and the stale receipt
-  misleading a later `--install` that retires a file (above).
-- **The rollback target is main's install, not the home before it.** The first install
-  rewrites `settings.json` at mode 600, and neither rollback returns it to the seed's 644.
-
-**Run 1, kept as evidence of all-or-none.** The first seed's unrelated `SessionStart`
-command contained the word `session-start`. Every install refused it as a second writer of
-that hook: 10 runs across main, the candidate, #191 and the restored source, exit 2,
-`NOTHING was installed`. After each refusal, every file and `settings.json` was
-byte-identical to the seed. The seed was then reworded and all four homes were rebuilt.
-
-**The rollback targets match what Eagle runs today:**
-- the real home's 29 installed files equal (a)'s placed files (path, mode, sha256), read-only;
-- the Gate A backup's 29 copies carry the same 29 digests.
-
-## 3. User work, jobs and claims survive
-
-**Every command the rehearsals ran that writes anything** — 18 groups in the receipt's
-`mutations.tsv` — wrote only into private scratch:
-- **temp dir only: 18;**
-- **real repository: 0;**
-- **real home: 0;**
-- **register: 0.**
-
-The groups are:
-- restore clones, the throwaway indexes, the `RESTORE.md` worktree and its copied files;
-- the dirty stand-in and its two rebuilds;
-- the install sources;
-- the seeds;
-- 10 installs and 10 refused ones. Corrected (F12): this said 12. The receipt's
-  `README.md:35` and `mutations.tsv:15` say 12, but `logs/22-installs.log` has 10
-  `--install` runs and the 2 copy-backs of the next line, 12 `exit=0` lines in all;
-- two copy-backs, snapshots and comparisons;
-- the patch-application clones.
-
-**No script pushes, stashes, cleans, kills a process, deletes a branch, removes a worktree,
-runs `checkout -f` or `update-ref`, or writes `workspace.yaml`** (`grep` over every script
-in the receipt). The one `reset --hard` is in a scratch clone of the rehearsal that section 5
-patched. The live repository was only read, with `GIT_OPTIONAL_LOCKS=0`: `for-each-ref`,
-`rev-parse`, `cat-file`, `merge-base`, `ls-tree`, `show`.
-
-Corrected (lane 2's verification, F22): the rehearsal scripts only read the live
-repository, but not all of them with `GIT_OPTIONAL_LOCKS=0`. `10-restore.sh` (`:7`) and
-`snapshot-real.sh` (`:5`) set it; `snapshot-real.sh:15` also runs `worktree list`, which
-the list above omits. `24-patches.sh` runs `ls-tree` and `show` there (`:14–15`) without
-it (`:7`). The four fetches under "Acts outside the rehearsals" did write there:
-remote-tracking refs and their objects.
-
-**Real surfaces, before (00:42:08Z) and after (00:53:06Z):**
-
-Refreshed (F17): a third snapshot, final (01:13:46Z, `state/final/`, added by `076062af`),
-came after this branch's three pushes (the last at 01:13:35Z) and the first brett-wip
-commit. It came before the second brett-wip commit (01:14:30Z), which adds it, and before
-the comment on #186 (01:14:55Z). The rows below hold at final too, except where a
-correction says otherwise.
-
-| Surface | Result |
-| --- | --- |
-| The real home's 29 installed files, its receipt, its `~/.claude/settings.json` | unchanged (sha256 and mode) |
-| `~/.agents/workspace.yaml` | exists; size, inode, mtime and mode unchanged; its contents were not read |
-| The Gate A backup | manifest passes both times; whole-tree listing (size, mode, mtime) unchanged |
-| The run C rehearsal | whole-tree listing (size, mode, mtime) unchanged |
-| Lane 1's register row and objects (`lanes --all`, `lane-objects`, both with `LANES_NO_FETCH=1`) | the row unchanged but for its age column; objects gained one line, `LANDED opensoft/openRepoTools#189` (00:49:25Z, the coordinator's). Corrected: they also gained two lines from another lane's log that the reader reports as unreadable (its count went from 3 to 5) |
-| The live repository's 25 worktrees | the same 25 before and after; none locked, prunable or detached. Corrected: the same 25 paths at final, but four HEADs moved forward: the shared checkout's `main` `837928a` → `63810dd`, #191's branch `e406e0e` → `2411f40`, #190's `c139e88` → `e3a76b5`, and this writer's `837928a` → `fa44d75` |
-| The live repository's refs | this writer added `refs/heads/004-migrate-to-triad-rollback` and its remote-tracking ref (fast-forward pushes). Other writers' acts moved the rest: `main` to `63810dd`, the T006 and run C branches, `004-migrate-to-triad-evidence-2`, and the #190/#191 heads. Corrected: the branch was already in the baseline at `837928a` (`state/before/live-refs.sorted:27`), made by this writer's `lane-worktrees add`; its commits moved it, and only its remote-tracking ref was new. The remote-tracking `origin/004-migrate-to-triad-evidence` (`3f7c48f`) was pruned before 00:53:06Z; #189's branch is no longer on GitHub. A remote-tracking ref here moves on a push from any worktree of this repository or on a fetch, this writer's four included, so which act moved each one is not recorded (F22) |
-
-Corrected (lane 2's verification): the receipt's `README.md:65–67` says these final
-surfaces "all equal `state/before/`". Byte for byte, three do not, as the rows above now
-say: the register row (its age column), the register objects, and the worktree list (four
-HEADs). The real home's files, receipt and `settings.json`, `workspace.yaml`'s metadata,
-the backup and the rehearsal do.
-
-The lane's register clone and brett-wip's shared checkout both moved during the window.
-Both moves were other actors' commits: the coordinator's LANDING/LANDED lines for #189, and
-other lanes' handoffs. This writer ran no register write.
-
-**What a cutover, or a rollback after one, must preserve.**
-
-Lane 1's live register row, read-only:
-- `openRepoTools-1  LIVE  Eagle  team-008`;
-- window `openRepoTools-1:@20`;
-- transcript `df82f553-7803-49c4-8ddf-3f9acdcb8ee0`;
-- the shared checkout as its directory;
-- holds `CLAIMED opensoft/openRepoTools#186`.
-
-In-place adoption keeps that directory, so neither the row nor the claim needs rewriting.
-A rebinding is T018's, at a safe breakpoint, through `lane-start`/`lanes-edit.sh`.
-
-`~/.agents/workspace.yaml` exists. Only `resume --workspace` and `wip init` write it, and
-neither is in any rollback path; this run left its metadata unchanged.
-
-**The rollback path in the plan's own words:** revert or pin-bump PRs, plus the preserved
-installer, through (c2). It needs:
-- no force push: every captured ref has only ever moved forward, or was deleted with its
-  commit still on GitHub (refreshed: section 1; re-checked 2026-10-09T22:05:16Z);
-- no destructive reset;
-- no pointer rewrite.
-
-Refreshed (F8, F19): this is an argument, not a rehearsal.
-- "Every captured ref has only ever moved forward" describes two days of other writers'
-  work. It shows that nothing has needed a force push so far.
-- No revert or pin-bump PR was rehearsed, and neither was a restore of the local
-  candidate (run C's triad) from preserved artifacts. Section 7 lists both.
-- Jobs: no before/after list of running jobs was taken, although the plan preserves
-  "uncertain jobs" (plan.md:245). The only evidence is that no script kills a process.
-
-**Acts outside the rehearsals.** These are publication and bookkeeping, listed so nothing is
-hidden:
-- four fetches in the live repository: three before the baseline, and one after the
-  rehearsals to re-read the evidence branches that had moved (remote-tracking refs only);
-- `lane-worktrees add openRepoTools-1 ort-triad-rollback`: the worktree, its new branch, and
-  one record in lane 1's host-local tree inventory;
-- the commits and fast-forward pushes of this branch;
-- one commit to brett-wip `main` (`git add -- <receipt dir>`), from a sparse clone in scratch,
-  never the shared checkout;
-- one comment on #186;
-- a stray empty file this writer made by mistake in the private `work-20261008` directory,
-  outside the rehearsal tree, and removed at once.
-
-## 4. Gate A/B evidence index
-
-Verification marked "T011" was done by this run: checksums and the git identities it names.
-
-| Branch, head | Document or receipt | What it proves | Verified by |
-| --- | --- | --- | --- |
-| main `63810dd` (#189) | `preservation-2026-10-07.md`, `inventory.json` | Gate A refresh (T001–T002): 17 trees, 33 refs, backup `prep-20261007T100559Z` | the writer's restore (97 PASS); lane 3's #189 review (LAND); **T011's restore today (90 PASS)** |
-| main `63810dd` (#189) | `adopter-rehearsal-2026-10-07.md`, `adoption-plan.yaml` (run B's, source `e43b243`) | runs A and B at tool `7f84ca4`: 45/49/6 of 100, 0 dropped, bootstrap ok | lane 2's six-check verification (#186 comment 6036838832); #189 review |
-| main `63810dd` (#189) | `consumer-reads-2026-10-07.md` | 33 outside consumers not covered, their timing | #189 review |
-| main `63810dd` (#189) | `gate-b-checklist.md` | the 46-line Gate B walk of October 7 | #189 review |
-| `004-migrate-to-triad-rehearsal-c` `1a26463` (#192, as `71b05cb`) | `adopter-rehearsal-2026-10-08.md`, run C's `adoption-plan.yaml` (source `837928a`) | run C: 65/49/6 of 120, 0 dropped, bootstrap ok; the arrangement T006–T011 used | **T011:** its receipt passes `sha256sum -c` (44); its three log digests are in it; the rehearsed commits resolve (`69b8924`, `593250d`, `73b04d6`, `7f84ca4`); its tree is unchanged by this run. #192 is not reviewed yet |
-| `004-migrate-to-triad-root-guidance` `041a273` (#192) | `root-guidance-2026-10-08.md`, `patches/t006/` (5) | T006: 5 collisions, 32 repaired links, leg front doors, 35/35 provenance, bootstrap and validators | **T011:** the 5 patch digests match the document; every patch `git am`s onto its base; the trees equal the recorded ones (section 5). Lane 3's T006 review is not posted |
-| `004-migrate-to-triad-ci` `cc7c7a1` (no PR) | `test-roots-and-ci-2026-10-08.md`, `patches/t010-*.patch` (2) | T009/T010: what the split breaks, the root rules, the composed contract, local proofs P1–P4 | **T011:** its 16 published log digests match the host-local logs (`sha256sum -c`, 16 OK); both patches apply (section 5). No review is recorded |
-| PR #190 `e3a76b5` | the test-roots change | T009's explicit roots on today's layout | its own CI; lane 3's review is in progress |
-| PR #191 `ecd7aa4` | the installer payload-source change | T007/T008's code side and the 15-row matrix as tests | its own CI; lane 3's review is in progress; lane 2's T008 verification is held |
-| this branch | `gate-ab-evidence-2026-10-09.md` | T011 | — |
-| brett-wip `f0ea2df7` | receipt `prep-20261007T100559Z` | Gate A's private record | **T011:** its manifest copy is the backup's (`2a46dff9…`), and the backup passes it |
-| brett-wip `c311a78b` | receipt `adopter-fix-20261007-iM20tv` | runs A and B | **T011:** `sha256sum -c` 58 OK; the six published log digests are in it |
-| brett-wip `3de0d37c` | receipt `adopter-fix-20261008-1HztL0` | run C | **T011:** `sha256sum -c` 44 OK |
-| brett-wip `56f1e7c4` | receipt `rollback-20261009-ILvoVC` | T011 | its own `SHA256SUMS` (423 entries) |
-| brett-wip `076062af` (refreshed, F17) | the same receipt, plus the final snapshot and two hygiene logs | T011 | its own `SHA256SUMS` (441 entries); lane 2's verification (#186 comment 6082370012) |
-| host-local | backup `prep-20261007T100559Z`; rehearsal `work-20261008/rehearsal` | the preserved artifacts | **T011**, read-only, before and after |
-
-No private receipt exists for T006 or T009/T010. Their logs are host-local only, in the
-private prep area.
-
-**Refreshed 2026-10-09T20:30Z (F15).** Origin moved after this index was written. Main is
-`f87fd5a` (`git ls-remote`, 20:29:34Z): lane 3 landed #192 as `1abee1d` (20:24:59Z) and
-then #190 as `f87fd5a` (20:26:03Z), on Brett Heap's word (#186 comment 6088703549). Each
-squash equals its reviewed head: `1abee1d`'s tree is `71b05cb`'s, and `f87fd5a`'s diff is
-`c4864ac..b50f197`'s. Every other move below is a fast-forward (`git merge-base
---is-ancestor`, each step).
-
-| Branch or PR, head now | Since 01:13Z | Reviews and verification now |
-| --- | --- | --- |
-| #192, landed as `1abee1d` (head `71b05cb`; `004-migrate-to-triad-evidence-2` deleted) | run C's records, its plan and T006's `root-guidance-2026-10-08.md` and five patches are on main | lane 3: **LAND** on `71b05cb` (review 5464893559), with an exact rebuild of all five T006 patch commits; lane 2: run C's receipt verified, all six checks pass (#186 comment 6072724043) |
-| `004-migrate-to-triad-root-guidance` `041a273`, `004-migrate-to-triad-rehearsal-c` `1a26463` | unchanged; their content landed with #192 | as #192 |
-| #190, landed as `f87fd5a` (head `b50f197`; `feat/test-roots-for-the-triad` deleted) | `e3a76b5` → `dbc6837` (01:22:43Z) → `b50f197` (13:59:10Z, the manual guard, #193 item 1) | **LAND** on `dbc6837` from lane 3 (5464931249) and lane 1's independent review (5464938427); **LAND** on the `b50f197` delta (5471080687); CI green on `b50f197`, `tests-macos` included |
-| `004-migrate-to-triad-ci` `d28e2cc` | `cc7c7a1` → `b4ef6b5` → `d28e2cc` (02:30:57Z); only `test-roots-and-ci-2026-10-08.md` changed, and both T010 patch blobs are identical at both heads | no review verdict posted; lane 3's reviewer of the T010 patches has resumed (#186 comment 6088703549). *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 7): the verdict came after this record's origin read of 20:29–20:30Z. It is #186 comment 6089801221 (2026-10-09T21:47Z), on `d28e2cc` (unchanged): fit for evidence-3, carried as its three new files on main. One thing must be settled before the composed job is relied on: `composed.yml` runs the suite through `run.sh`, which brings #180 into the one job that must be green (its finding 13).* |
-| #191 `13cc752` | `ecd7aa4` → `2411f40` (01:20:38Z) → `13cc752` (02:42:51Z) | **DO NOT LAND** on `2411f40` from lane 3 (5464963807) and lane 1's independent review (5465121368); **LAND** on `13cc752` from lane 3's delta review (5471121210), on condition that the PR body is corrected before the squash and `tests-macos` runs on `ready`. CI on `13cc752`: every job passed except `tests-macos`, skipped without `ready`. Lane 1's next head, `fdc5f18`, is announced and not on origin (#186 comment 6088714587, item 3) |
-| `004-migrate-to-triad-installer` `51993a4` (new, 01:21:15Z; no PR) | T007's entry point, `patches/t007-assembly-entry-point.patch` (sha256 `361c037d…a277d`), and `installer-2026-10-08.md` | lane 3: **CHANGES REQUIRED** on the patch: confirm the gitlink before running the pinned implementation on the remote path (review 5471121210, T3). Lane 1 puts that change on this branch (#186 comment 6088714587, item 3) |
-| `004-migrate-to-triad-candidate` `935f53f` (new: created at `b21c511` at 01:58:43Z, then `b21c511` → `935f53f` at 02:43:24Z; no PR) | `candidate-2026-10-09.md`: the composed candidate, built from #190 `dbc6837` and #191 `2411f40` (`:29–30`); receipt `candidate-20261009-JR8YyA` | lane 3: **REPRODUCES**, fit for the composed run (#186 comment 6082068576). Its section 5 records that no suite run had finished. Lane 1's r2 runs finished at 18:20:47Z (lane 2's reading, #186 comment 6087267593); no record of them is on origin. The receipt is not on brett-wip `ea6c09d1` |
-| `004-migrate-to-triad-t018` `63bff08` (new, 20:28:03Z; no PR) | lane 1's T018 exercise (#186 comment 6088703549) | — |
-| `feat/triad-lane-tooling` `30f9dc0` | `c45a452` → `2aa8a59` → `96da9af` → `30f9dc0` (14:18:02Z) | no PR |
-| `feat/test-roots-manual-guard` `b50f197` (new: created at 02:29:44Z; no PR of its own) | the manual-guard fix, one commit on `dbc6837`, which #190 has carried since 13:59:10Z | landed with #190 (row above); the branch is still on origin |
-| `feat/test-roots-followups` `01ccc86` (new: created at `2064390` at 02:14:37Z) | #190's follow-ups (#193 items 2–7); `2064390` → `7144eef` (02:31:20Z), then `7144eef` → `01ccc86` (20:31:02Z), a merge of main `f87fd5a` (re-read 20:36:57Z) | lane 3's review has resumed (#186 comment 6088703549). *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 7): the verdict came after this record's origin read (20:36:57Z for this head). It is #186 comment 6089801221 (2026-10-09T21:47Z), on `01ccc86`: fit for a PR onto main after one edit, which is to drop or re-premise the 340 → 347 assembly cap (its finding 7). The branch `01ccc86` answers the code-half part of #193 item 2.* |
-| `004-migrate-to-triad-reads` `a7a8e00` | `a6830a1` → `a7a8e00` (13:50:08Z): lane 2's `gate-b-status-2026-10-09.md` | no PR; lane 1's own walk goes into its next evidence PR (#186 comment 6088714587, item 1) |
-| brett-wip `99eed35` | Gate A capture tooling v2, which answers this record's three findings (#186 comment 6073036070) | lane 2's final verification: `capture.sh:170` rewrites its source's index, and `restore.sh:132` can aim at `/` (#186 comment 6087261307). Lane 1 accepts both; no capture runs on a real checkout until a fixed version is re-verified (#186 comment 6088714587, item 4) |
-| issue #193 (13:42:32Z; updated 20:26:33Z) | the follow-ups deferred at the landing of #190 and #192: item 1 resolved by #190, item 15 added | — |
-
-## 5. Follow-up patch and commit inventory
-
-Every recorded patch for the rehearsed arrangement was re-applied by this run with `git am`,
-in a fresh clone out of run C, onto the commit it names. Trees are compared, not commit
-hashes: the committer differs, so the hashes do.
-
-| # | Patch (branch, head) | sha256 | Leg | Applies to | Rehearsed result | Re-applied tree (T011) | At T014 |
-| --- | --- | --- | --- | --- | --- | --- | --- |
-| 1 | `patches/t006/assembly-0001-…front-door…` (root-guidance `041a273`) | `cd69c2a9…c5d096` | assembly | split `69b8924` | `3361812` | — (the three stack, below) | **applies as-is** onto the real split, after the frozen source's root files are checked unchanged. *Superseded 2026-10-19: the file at this path is re-cut, sha256 `2ec48bbf…eaead7`, because the root files did change (#227, #237 and #228 rewrote the lines seven of its hunks stand on), so this row's file no longer applies to them (`gate-b-status-2026-10-09.md`, checklist line 17).* |
-| 2 | `patches/t006/assembly-0002-Bump-spec-leg-to-39c18877e042…` | `574c0df1…3647f9` | assembly | `3361812` | `1024f18` | — | **regenerated**: `bump-leg.py` against the real spec commit |
-| 3 | `patches/t006/assembly-0003-Bump-code-leg-to-6169e8e96164…` | `a7f8521b…ec14aa` | assembly | `1024f18` | `3e87e39` | 1–3: `6eb8145e…`, as recorded | **regenerated**: `bump-leg.py` against the real code commit |
-| 4 | `patches/t006/code-0001-…own-front-door…` | `74b98ff9…2ae1ec1` | code | code `73b04d6` | `6169e8e` | `ca65c3b9…`, as recorded | **applies as-is** |
-| 5 | `patches/t006/spec-0001-…own-front-door…` | `c11070f0…8210b3` | spec | spec `593250d` | `39c1887` | `10256135…`, as recorded | **applies as-is** |
-| 6 | `patches/t010-code-leg-tests-workflow.patch` (ci `cc7c7a1`) | `7ee3c6d0…786c3b` | code | code `73b04d6` | `b95d667` | alone: exit 0; on #4: exit 0 (`007509d2…`) | **applies as-is**; its env names mean something once PR #190 is in the code. *Superseded 2026-10-19: the file at this path is regenerated, sha256 `1406ead3…ef6d56`, against the `tests.yml` #228's PR 2 leaves (blob `2cfa173`), because #227 and #209 rewrote `tests.yml` and this row's file (base blob `e27bc64`) no longer applies (`gate-b-status-2026-10-09.md`, checklist lines 32 and 33).* |
-| 7 | `patches/t010-assembly-exact-pin-job.patch` | `6ee09f00…74670b` | assembly | split `69b8924` (proof commit `386be81` sat on the rehearsal-only bump `6ccdaf8`) | `386be81` | alone: exit 0 (`c37aa4f0…`); on #1–3: exit 0 (`b351c8e9…`) | **applies as-is** (a new file); `bash code/tests/run.sh` with `OPENREPOTOOLS_COMPOSED=1` needs PR #190 in the code leg. *Superseded 2026-10-21: the file at this path is regenerated, sha256 `60245cb9…f0f653`, with `runs-on: ubuntu-24.04` under a three-line comment, because #296 pinned the code leg's Ubuntu runners and this job runs that leg's suite; it still applies as a new file (`gate-b-status-2026-10-09.md`, checklist line 32).* |
-| — | T007's assembly root `openRepoTools` entry point | — | assembly | — | — | — | **absent**: no `004-migrate-to-triad-installer` on origin; PR #191's body says it will be recorded there |
-| — | the rehearsal-only bump `6ccdaf8` (code leg to `8ebf4ec`, PR #190 on `73b04d6`) | not a patch file | assembly | — | — | — | **regenerated**, like #2–3 |
-
-**Counts:**
-- **7 recorded patches:** T006 5, T010 2.
-- **5 apply as-is:** #1, #4, #5, #6, #7.
-- **2 regenerate at T014:** #2 and #3, plus the T010 proof's bump `6ccdaf8`, which has no
-  patch file.
-- **T007's entry point: 0 recorded.**
-
-`git diff --check` exits 0 over the assembly stack (4) and the code stack (2).
-
-**They stack:**
-- **assembly:** #1, #2, #3, then #7;
-- **code:** #4, then #6, then PR #190's code diff (`apply --check` 0), then PR #191's on top
-  of that (`apply --check` 0, also with `--3way`);
-- **spec:** #5 alone.
-
-This is a text-level check only. **No test ran on the stacked candidate.**
-
-*Superseded 2026-10-19:* the counts, the stacking and the `git diff --check` results above are for the files
-of that date. #1 is re-cut and #6 regenerated (their rows say why), and neither earlier file applies to the
-root files and `tests.yml` that #228's series leaves. The inventory has an eighth file,
-`patches/t009-assembly-caps.patch` (code leg, sha256 `2dd4aac2…b2bbe5`), which goes on after #4 and #6 and sets
-the assembly-root length caps the re-cut `assembly-0001` needs. The statuses now are in
-`gate-b-status-2026-10-09.md`, checklist lines 17, 32, 33, 40 and 46.
-
-Corrected (F20; lane 2's verification, #186 comment 6082370012):
-- "As recorded" holds for the T006 trees (#1–#3 as a stack, #4, #5). Nothing recorded a
-  tree for the T010 patches before this run. `test-roots-and-ci-2026-10-08.md` names commit
-  `386be81` and no tree, and #6's commit `b95d667` appears only in the patch's own `From`
-  line. So #6's and #7's trees above are this run's first record of them, not a match.
-- #7 was re-applied on the split `69b8924`, not on its rehearsed base `6ccdaf8`.
-- Commit `849592b`'s body says "the seven recorded patches re-applied onto their rehearsed
-  bases with matching trees". The two points above are the exceptions.
-- The first attempt to fetch the two PR heads ran under `GIT_ALLOW_PROTOCOL=file` and was
-  refused (`fatal: transport 'ssh' not allowed`, exit 128; receipt
-  `logs/24-patches.log:21–32`). `25-prs.sh` redid it, and the stack result above is the
-  redo's (`logs/25-prs.log`).
-
-**Refreshed 2026-10-09T20:30Z: the follow-up inventory (F15, F18).**
-- T007's entry point has been recorded since 01:21:15Z, so "T007's entry point: 0
-  recorded" above no longer holds.
-- The stack check above used #190 `e3a76b5` and #191 `ecd7aa4`. Two later builds
-  supersede it. One is the composed candidate at `dbc6837` and `2411f40`
-  (`candidate-2026-10-09.md` section 2), which lane 3 rebuilt exactly (#186 comment
-  6082068576). The other is lane 1's r2 at `b50f197` and `13cc752`, which lane 2 rebuilt
-  with every `git am --3way` step exiting 0 and the same trees (#186 comment 6087232548,
-  item 3).
-
-Gate B asks for "reviewed follow-up patches" (plan.md:140–141). Each named follow-up below
-maps to a patch, a branch or PR, an owner, or "deferred". Line numbers in run C's plan and
-in `root-guidance-2026-10-08.md` are on main since #192 (`1abee1d`).
-
-| Follow-up (where named) | Patch, branch or PR | Owner | State at 20:30Z |
-| --- | --- | --- | --- |
-| T006's five patches (the table above) | `patches/t006/`, on main since #192 | lane 1 (T006) | reviewed: LAND (5464893559). #2, #3 and the bump `6ccdaf8` regenerate at T014. *Superseded 2026-10-19: the review covers the earlier `assembly-0001`. The re-cut has none yet; its review is the independent review of the cutover-patches PR (branch `004-triad-cutover-patches`).* |
-| T010's two patches (the table above) | `004-migrate-to-triad-ci` `d28e2cc` | lane 1 (T010) | no review verdict posted; lane 3's reviewer has resumed (#186 comment 6088703549). Both are authored by the fixture identity, to carry a real author at T014 (#186 comment 6082068576, finding 9). *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 7): the verdict came after this record's origin read. It is #186 comment 6089801221 (2026-10-09T21:47Z), on `d28e2cc`: both patches apply (to run C, and the code-leg patch also to `f87fd5a`), and the code leg's `tests.yml` keeps everything the gate reads. It is fit for evidence-3, with #180 to settle before the composed job is relied on, because `composed.yml` runs the suite through `run.sh` (its finding 13). It repeats the author point: give both patches a real author at T014.* *Superseded 2026-10-19: that verdict covers the earlier code-leg patch. The regenerated one has no review yet.* |
-| T007's assembly entry point | `004-migrate-to-triad-installer` `51993a4` | lane 1 (T007) | CHANGES REQUIRED (5471121210, T3) |
-| T007/T008's code side | #191 `13cc752` | lane 1 (T007) | LAND with conditions (5471121210); next head `fdc5f18` announced. Open there: the parent-directory walk (delta 4, which `fdc5f18` answers per lane 1) and the hygiene test passing by spelling (delta 5) |
-| #190's manual guard (#193 item 1) | in #190 since `b50f197` | lane 1 (T009) | resolved: landed with #190 |
-| #190's other follow-ups (#193 items 2–7) | `feat/test-roots-followups` `01ccc86` (main merged in at 20:31:02Z) | lane 1 (T009) | no PR yet; one against main is now possible (#186 comment 6088703549). Its `AGENTS.md` hunk does not apply to the triad's assembly `AGENTS.md` (#186 comment 6082068576, finding 8) |
-| The named-root refusal wording (#193 item 15) | — | lane 1 (T009) | open (#186 comment 6088714587, item 6) |
-| T006 × #190, `test_agents_md_names_the_pin_rules` (#193 item 14) | — | lane 1 decides | open; it fails in r2's composed run (#186 comment 6087267593) |
-| r2's other failures: `test_r14_the_documented_upstream_skip_is_unchanged` (`KeyError: 'reason'`), the lane suite's row-stamp cases, `test_run_wrapper`'s timeouts | — | lane 1 | being classified by lane 1 (#186 comment 6088714587, item 5) |
-| #192's text findings (#193 items 8–13) | lane 2's `004-migrate-to-triad-evidence-2-followups` (#186 comment 6082466833, item 3) | lane 2, for lane 1 | on origin since 20:32:51Z at `096de93`, with main `f87fd5a` merged in; no PR (re-read 20:36:57Z) |
-| Gate A capture tooling v2 | brett-wip `99eed35` | lane 1 | to be fixed and re-verified before any real capture (#186 comments 6087261307, 6088714587) |
-| Run C's `follow_ups`: 29 entries (`adoption-plan.yaml:392–421`) | the next five rows | | |
-| … 13 entries: a shipped command or test names `docs/`, `openspec/` or `specs/` (`:393–405`) | lane 3's `feat/triad-lane-tooling` `30f9dc0`, no PR; #190 (landed) for the suite's roots | `root-guidance-2026-10-08.md:188–194` routes the files it names: `lane-start`, `lanes-edit.sh`, `test_lane_helpers.sh` and the OpenSpec keys in `lanes-edit.sh` and `lane-handoff` to lane 3; `openRepoTools` to T007; `test_repo_hygiene.py`, `test_lane_start_claude_current.py` and `tests/run.sh` to T009/T010; `claude-current` to its text owner | that routing names neither `test_install_skill_and_hook.py` (`:398`) nor `test_park_resume_commands.py` (`:405`): no owner is recorded for those two. Corrected: the plan's unnamed ninth `docs/` file is `tests/test_repo_hygiene.py` (`git grep -l 'docs/'` at `837928a`, outside `docs/`, `specs/`, `openspec/` and the root front doors, gives exactly nine files), which `root-guidance-2026-10-08.md:191` routes to T009/T010 |
-| … 5 `shape/` collisions (`:406–410`) | T006's `assembly-0001` (`root-guidance-2026-10-08.md:69–76`) | lane 1 (T006) | resolved in the patch; deleting the unpinned `shape/AGENTS.md`, `shape/CLAUDE.md` and `shape/README.md` is deferred to T014's reviewer (`:76`, `:394`) |
-| … open the split as a pull request (`:411`) | — | T013 (tasks.md:96–98) | deferred |
-| … the entry point (`:413`) and the test roots (`:414`) | the T007 rows above; #190 and the T010 row above | lane 1 | as above |
-| … 8 more plan-level items (`:412`, `:415–421`) | `:412` was rehearsed in runs B and C; `:415`, the workflow bootstrap, in T006 | by tasks.md: `:412` and `:415` T013; `:416` T016–T018; `:417` T012; `:418` and `:420` T014; `:419` T016; `:421` T015 | deferred |
-| The 33 outside consumers not covered (`consumer-reads-2026-10-07.md:303`) | — | the owners listed there | deferred |
-
-## 6. Pull requests to main with layout-neutral changes
-
-| PR | Head | Files | State at 00:5xZ |
-| --- | --- | --- | --- |
-| #190 `feat/test-roots-for-the-triad` | `e3a76b5` | `tests/` only (8 files) | open; `guard-launch-mode`, `tests-windows`, `parse-macos` and SonarCloud green; `tests` and `tests-no-submodule` running; no `ready` label |
-| #191 `feat/installer-payload-source-resolution` | `ecd7aa4` | `openRepoTools`, two test files | open; the same green set, `tests` and `tests-no-submodule` running. At `e406e0e` (00:3xZ), `guard-launch-mode` and `tests-windows` had failed; `ecd7aa4` is the push after that |
-
-Both are based on `c4864ac`. Both touch `tests/test_openrepotools_command.py`, and they
-stack cleanly in the order #190 then #191. Neither touches a root front-door file, so T006's
-`assembly-0001` is unaffected by either.
-
-Lane 3's `feat/triad-lane-tooling` (`c45a452`) is on origin with no PR.
-
-**Refreshed 2026-10-09T20:30Z (F15)** (`gh pr view`, 20:29:45Z; check runs, 20:30:23Z):
-
-| PR | Head | State |
-| --- | --- | --- |
-| #190 | `b50f197` | **landed** as `f87fd5a` at 20:26:03Z, after #192. CI on `b50f197` was green, `tests-macos` included. |
-| #191 | `13cc752` | open; no `ready` label. On `13cc752` every CI job passed except `tests-macos`, which was skipped. LAND from lane 3's delta review, with conditions (section 4). Next head announced, not pushed. |
-| #192 | `71b05cb` | **landed** as `1abee1d` at 20:24:59Z. CI on `71b05cb` was green, `tests-macos` included. |
-
-#191 is still based on `c4864ac`. It still stacks on #190 in that order:
-- lane 2 applied `dbc6837` then `13cc752` cleanly onto the patched code leg (#186 comment
-  6082370012, check (v));
-- lane 2's rebuild of lane 1's r2 applied `b50f197` then `13cc752`, every `git am --3way`
-  step exit 0 (#186 comment 6087232548, item 3).
-
-Lane 3's `feat/triad-lane-tooling` is at `30f9dc0`, still with no PR.
-
-## 7. What Gate B still lacks
-
-Gate B is "complete local rehearsal evidence, restore rehearsal, reviewed follow-up patches,
-resolved mapping and a passing compatibility test matrix" (plan.md). Against that:
-
-1. **Restore rehearsal.** Done for the source and for the installed payload, with two
-   findings:
-   - for any tree that is not clean, the October 7 capture procedure is not a restore
-     (section 1);
-   - `RESTORE.md`'s copy-back leaves `installed.tsv` stale. Rollback should be (c2): a
-     reinstall from the preserved source, or the copy-back followed by restoring the
-     receipt. Refreshed: the latter for the 29 files and the receipt only; it restores no
-     `settings.json` and no hook entry (section 2).
-
-   `RESTORE.md`'s `git bundle verify` line also needs a repository to run in.
-
-   Refreshed 2026-10-09T20:30Z (F11, F13): the hook and settings rollback is not rehearsed,
-   and no stage added or retired a placed file (section 2). Gate A's capture tooling v2
-   (brett-wip `99eed35`, #186 comment 6073036070) answers the two findings and the
-   `bundle verify` line. Lane 2's final verification found that its `capture.sh` rewrites
-   its source's index (#186 comment 6087261307), and no capture runs on a real checkout
-   until a fixed version is re-verified (#186 comment 6088714587, item 4).
-2. **T007's root entry point is not published.** Without it the inventory has no assembly
-   `openRepoTools`. PR #191, the code side, is open.
-
-   Refreshed 2026-10-09T20:30Z (F15): it has been recorded since 01:21:15Z, on
-   `004-migrate-to-triad-installer` @ `51993a4`. Lane 3 requires one change before it goes
-   into the root-split PR: confirm the gitlink before running the pinned implementation on
-   the remote path (review 5471121210, T3). #191 has LAND on `13cc752` with conditions,
-   and a next head is announced (section 4).
-3. **No composed candidate carrying every follow-up has run the suite.** That candidate is
-   T006 + T010 + #190 + #191 + the entry point. It was only checked to apply (section 5).
-   The October 8 proof P1 (285 passed, 2 failed) ran on run C's code leg with #190 alone:
-   - one failure is the leg's missing `.gitattributes`, which T006's `code-0001` adds;
-   - the other is two lane-suite assertions that depend on run-root length.
-
-   Lane 2's run C composed-suite discovery has not reported on #186. The hosted-runner part
-   (Windows, macOS) is blocked until real legs exist (checklist line 35).
-
-   Refreshed 2026-10-09T20:30Z (F15):
-   - Lane 2's discovery reported at 01:21:53Z (#186 comment 6072319462, with its addendum
-     6072333212).
-   - The composed candidate is recorded on `004-migrate-to-triad-candidate` @ `935f53f`,
-     and lane 3 rebuilt it exactly (#186 comment 6082068576).
-   - Lane 1's r2 runs (code with #190 at `b50f197` and #191 at `13cc752`) finished at
-     18:20:47Z. In lane 2's reading of the logs (#186 comment 6087267593): composed, 5
-     failed and 1411 passed; standalone, 3 failed; without the dependency, 6 failed.
-     Lane 1 is classifying them (#186 comment 6088714587, item 5).
-   - **No suite run of the composed candidate passes yet, and none is recorded on origin.**
-4. **Reviews.** Lane 3's reviews of #190 and #191 are in progress. No review is recorded for
-   the T006 patch set (#192) or the T010 patches (checklist line 46).
-
-   Refreshed 2026-10-09T20:30Z (F15):
-   - #190: LAND twice and on its delta, and landed (section 4).
-   - The T006 patch set: lane 3's #192 review rebuilt all five patch commits exactly (LAND,
-     5464893559), and #192 landed.
-   - #191: LAND on `13cc752` with conditions (5471121210).
-   - The T007 patch: CHANGES REQUIRED (5471121210).
-   - The T010 patches: no verdict yet; lane 3's reviewer has resumed (#186 comment
-     6088703549). *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 7): the
-     verdict came after this record's origin read. It is #186 comment 6089801221
-     (2026-10-09T21:47Z): fit for evidence-3, with #180 to settle before the composed
-     job is relied on (its finding 13).*
-   - *Superseded 2026-10-19:* lane 3's #192 review covers the earlier `assembly-0001`, and #186 comment
-     6089801221 the earlier code-leg patch. The re-cut, the regenerated patch and
-     `patches/t009-assembly-caps.patch` have no review yet (the notes under section 5's tables).
-5. **Mapping.** Main carries run B's plan, source `e43b243`, which survives only as
-   `refs/pull/188/head`. Run C's plan, source `837928a`, is in #192, unlanded.
-
-   Corrected (F9): `e43b243` survives on origin only as `refs/pull/188/head` (`git
-   ls-remote`, 20:29:34Z). It is also in the Gate A bundle, as the captured branch
-   `chore/openreposhape-pin-7f84ca4` (`inventory.json` `local_branches`), and that branch
-   was still in the shared checkout at 01:13:46Z (receipt `state/final/live-refs.sorted`).
-   Refreshed 2026-10-09T20:30Z: #192 landed, so main now carries run C's plan, source
-   `837928a`, in place of run B's.
-6. **Gate A**, for orientation:
-   - the final capture at an owner-coordinated freeze, taking finding 1;
-   - installed-file receipts for py-bench and other profiles and workstations;
-   - owner dispositions.
-
-   Refreshed (F14): T002 asks for "installed receipts/config" (tasks.md:28–29; plan.md:79).
-   The Gate A backup holds the receipt (`installed.tsv`, 29 rows) but no `settings.json`,
-   and `RESTORE.md`'s copy-back restores neither (section 2). So the backup cannot restore
-   the hooks and settings an install writes.
-7. **T011's own acceptance (refreshed, F19).** This record checks no task complete.
-   - Rehearsed: the source restore from the Gate A bundle, and the rollback of the
-     installed payload's 29 files and receipt.
-   - Not rehearsed:
-     - a restore of the local candidate (run C's triad) from preserved artifacts;
-     - the post-merge rollback the plan names, "reviewed revert/pin-bump PRs and the
-       preserved installer" (plan.md:243);
-     - a hook or settings rollback (section 2);
-     - a before/after list of running jobs (plan.md:245).
-   - Published: the evidence index and the follow-up inventory, refreshed above.
-
-**Gate C is Brett Heap's explicit approval.** It names the source and standard revisions,
-the leg repositories, their visibility and the final plan. Nothing here asks for it or
-infers it.
-
-## 8. Log SHA256s
-
-The logs and snapshots are in the private receipt.
-
-| Log | SHA256 |
-| --- | --- |
-| `10-restore.log` (section 1, 90 PASS) | `bb3a5829d3a1e5ea6924331456b9f6b81b4a8380d878617344adf2807e70a848` |
-| `11-dirty.log` (section 1, A 0/3, B 3/3) | `e6d1448fd18ebe2889b7c564307024ef8e2e49b48e2ef642838c8e0f89d1a9da` |
-| `21-clones.log` (section 2 sources) | `d4b39b1cabeae6d2395f5db3610157689863af40bb2fc1354a2116ddaf855139` |
-| `22-installs.log` (section 2, 10 installs and 2 copy-backs; corrected from "12 installs") | `4a7beffda610253de630b389f1be09c07df660df4d06a8745e10ed8d1703f2a6` |
-| `23-compare.log` (section 2 comparisons) | `dca56f959f8075ac0054745965896dd43e4eb9b58cc07409b89d583e0f91e72c` |
-| `24-patches.log` (section 5) | `f6a385eef8a32d683643aa7637e31cc88900af69888836c7fef7923cfac6de66` |
-| `25-prs.log` (section 5, the two PRs) | `4ae121cd04df1bc87b796ec2c6969ab355273582f763375b13f9f7adb5787300` |
-| `network-shim-calls.log` (empty) | `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` |
-| `mutations.tsv` (section 3) | `76fc8521b1738fde5471f99e1641c6d901ebf72a65bb677d612700caf7ed77b1` |
-| `refs-vs-live-now.tsv` (section 1) | `d3b5de9d85fe9ae8fe8a7a965d9015cb177c1e67d77beb30639cd51a02644249` |
-| `restore-trees.tsv` (section 1, 17 trees) | `ace098036ebcec7fe47dd56a0bb7f38b97b9b10bc4753c9dd2d652349a57db98` |
-
-**This document's own check.** `tests/run.sh -k repo_hygiene` did not run:
-- the wrapper waited 5 minutes (00:57–01:02Z) on 7 other repositories' pytest processes
-  (corrected: the log says "7 foreign pytest processes", receipt `logs/31-hygiene-flock.log:1`);
-- its exact pytest line under `flock` on the workstation lock then queued 10 minutes behind
-  the T007/T008 writer's full suite and was stopped before pytest started.
-
-Two hygiene tests read every tracked file: the host-absolute-path test and the act-0 citation
-test. Their own regexes, taken from `tests/test_repo_hygiene.py`, find nothing in this
-file. CI is the suite of record.
-
-Refreshed (2026-10-09T20:3xZ): on this refreshed file, `git diff --check` exits 0. The same two
-regexes, read from `tests/test_repo_hygiene.py` at `fa44d75` (`HOST_ABSOLUTE_PATH` and
-`ACT0_CITATION`), find nothing, and neither does a stricter scan for any host-absolute path
-prefix. No pytest ran: another lane's openRepoTools suite was live on the workstation. CI
-is still the suite of record, and this branch has no PR. Origin was re-read before the
-push, at 20:36:57Z (`git ls-remote`). Main `f87fd5a`, #191 `13cc752` and
-`004-migrate-to-triad-rollback` `fa44d75` were unchanged since 20:29:34Z.
-`feat/test-roots-followups` and `004-migrate-to-triad-evidence-2-followups` had moved,
-and sections 4 and 5 say so.
-
-This record authorizes no conversion, repository creation, merge, default-branch move or
-lane rebinding.
diff --git a/specs/004-migrate-to-triad/gate-b-checklist.md b/specs/004-migrate-to-triad/gate-b-checklist.md
deleted file mode 100644
index f7d0a066..00000000
--- a/specs/004-migrate-to-triad/gate-b-checklist.md
+++ /dev/null
@@ -1,299 +0,0 @@
-# Gate B checklist walk — 2026-10-07
-
-**Sources read:** 2026-10-07T10:05Z, from commit
-`ff6f6a7c7b7921ca1e0b0234e898900f98532366` (branch `004-migrate-to-triad`,
-also the head of PR #187). **Live state rechecked:** 2026-10-07T11:06Z.
-**By:** lane openRepoTools-2's writer, under opensoft/openRepoTools#186.
-**For:** lane openRepoTools-1, to walk before it asks Brett Heap for Gate C.
-
-This walk records facts. It approves nothing, and it changes no status in
-`tasks.md`, where all 19 tasks remain open. Gate C stays Brett Heap's explicit
-approval naming the actual revisions (plan.md:161–163).
-
-## How it was read
-
-These commands ran inside lane 2's `triad-reads` worktree, which is checked out
-at ff6f6a7. The host path given to `git -C` is left out here because the
-feature's public files carry no machine paths (plan.md:38–39). All `gh` calls
-were reads.
-
-```sh
-for f in plan tasks spec verification preparation adopter-blocker adopter-rehearsal \
-         installer-design quickstart research data-model protocol-review; do
-  git show ff6f6a7:specs/004-migrate-to-triad/$f.md | cat -n
-done
-git show ff6f6a7:specs/004-migrate-to-triad/inventory.json   # parsed with python3 -I json
-git show ff6f6a7:openspec/changes/migrate-to-triad/tasks.md | cat -n
-git show ff6f6a7:openspec/changes/migrate-to-triad/design.md | cat -n
-git show ff6f6a7:openspec/changes/migrate-to-triad/proposal.md | cat -n
-git show ff6f6a7:openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md | cat -n
-git show ff6f6a7:openspec/changes/migrate-to-triad/adoption-plan.yaml | cat -n | sed -n '1,80p;325,380p'
-git grep -n -i -E 'gate ?b|gates a/b|gate a/b' ff6f6a7 -- .
-git show c4864ac:.github/workflows/tests.yml | grep -n -E '^  [a-z][a-z0-9_-]*:$|runs-on'
-git show c4864ac:tests/test_upstream_pin.py | sed -n '170,200p'
-git ls-tree c4864ac upstream/openRepoShape
-git ls-tree -r --name-only c4864ac | wc -l
-git ls-tree -r --name-only c4864ac | grep -c '^features/'
-git show --stat e43b243; git show --format= e43b243 -- contracts/openreposhape-pin.yaml
-git worktree list --porcelain; git for-each-ref refs/heads    # branch heads only
-gh issue view 186 --repo opensoft/openRepoTools --json body,comments
-gh pr list --repo opensoft/openRepoTools --state open --json number,headRefName,title
-gh pr view 187 --repo opensoft/openRepoTools --json body,headRefOid,state
-gh pr view 188 --repo opensoft/openRepoTools --json statusCheckRollup,labels,reviews,headRefOid
-gh pr view 162 --repo opensoft/openRepoShape --json state,mergedAt,mergeCommit,reviews,comments
-gh api repos/opensoft/openRepoShape/compare/39d5c986fcfac1a160474bfe91c5f1c37fccc72c...7f84ca42ca86a8902928345109d2bf6bad87bd91
-gh api repos/opensoft/openRepoTools-spec; gh api repos/opensoft/openRepoTools-code
-gh api 'repos/opensoft/openRepoTools/branches?per_page=100' --paginate
-```
-
-Short names used below: **cap-spec** is
-`openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md`,
-and **#186 first act N** is the numbered "First acts" list in #186's body.
-Every `file:line` refers to ff6f6a7 unless another commit is named.
-
-## State at read time
-
-- openRepoTools `main` is `c4864ac`. Its gitlink `upstream/openRepoShape` is
-  still `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`, and it tracks 100 paths.
-- Two PRs are open:
-  - **#187**: `004-migrate-to-triad` at ff6f6a7 into `main`, opened
-    10:03:43Z. Lane 1 lands it.
-  - **#188**: `chore/openreposhape-pin-7f84ca4` at `e43b243`, opened 10:10:43Z.
-    This is the repin PR.
-- openRepoShape PR #162 is MERGED (2026-10-07T01:09:14Z) as `7f84ca4`, which
-  is still openRepoShape `main`'s head. The compare `39d5c98...7f84ca4` shows
-  ahead 2, behind 0: `1a9fc53` (#164) and `7f84ca4` (#162).
-- The local branches `004-migrate-to-triad-exec` (Gate A writer),
-  `004-migrate-to-triad-rehearsal` (rehearsal writer) and
-  `004-migrate-to-triad-reads` (lane 2) all point at ff6f6a7. None of them is
-  on the remote. Lane 2's reads branch then gained ae70dc556 (line 24).
-- `opensoft/openRepoTools-spec` and `opensoft/openRepoTools-code` both return
-  HTTP 404 to the read-only API. Neither the shared repository nor the remote
-  has an `adopt/` ref.
-- #186 comment
-  [6035767825](https://github.com/opensoft/openRepoTools/issues/186#issuecomment-6035767825)
-  (10:11:58Z) records four things:
-  - Brett Heap's words "open the PR for the planning branch; legs and
-    visibility confirmed".
-  - The legs and visibility are CONFIRMED. The comment calls this "a Gate C
-    input, not Gate C".
-  - The Gate A backup root is host-local, beside `prep-20261004T211123Z`; the
-    comment names the path.
-  - Lane 3's independent recompute of the 7f84ca4 tree digest matches #188's
-    row.
-
-## Status legend
-
-Each line has exactly one status.
-
-- **EXISTS on ff6f6a7**: the artifact is in the tree at ff6f6a7. The cell
-  cites it and says what it shows. Line 24 alone reads **EXISTS on
-  004-migrate-to-triad-reads @ ae70dc556**: its artifact was committed on top
-  of ff6f6a7 on this branch.
-- **DECIDED**: settled by Brett Heap's word, recorded outside ff6f6a7. Line 1
-  is the only line with this status, on the coordinator's instruction.
-- **IN PROGRESS by …**: a named writer holds the work at read time. The cell
-  says what was observed of that work.
-- **NOBODY**: no lane writer holds the work at read time. If the work has to
-  wait for something, the cell names it as "starts after".
-- **BLOCKED on …**: lane work alone cannot satisfy the line as the plan
-  stands. The cell names what it waits on.
-
-## Gate B in the plan's words
-
-> **Gate B:** complete local rehearsal evidence, restore rehearsal, reviewed
-> follow-up patches, resolved mapping and a passing compatibility test matrix.
-> Mapping `check` alone does not satisfy this gate. (plan.md:140–142)
-
-> Stop adoption on this refusal; resolve upstream and repeat into fresh local
-> remotes before treating Gate B as passed. Installer/topology design can
-> proceed while that resolution is pending. (plan.md:146–148)
-
-| Gate B term (plan.md:140–141) | Checklist lines |
-| --- | --- |
-| complete local rehearsal evidence | 2, 7–16, 39, 41–45 |
-| restore rehearsal | 36–37 |
-| reviewed follow-up patches | 17–22, 25–26, 29, 32–33, 40, 46 |
-| resolved mapping | 1, 3–6 |
-| passing compatibility test matrix | 27–28, 30–31, 34–35 |
-| inputs and publication (design, consumer reads, Gate A evidence) | 23–24, 38 |
-
-## Checklist
-
-### T003: mapping, leg names, prerequisites (tasks.md:33–40)
-
-T003 sits under the heading "Phase 1 — Preservation and baseline (Gate A)"
-(tasks.md:19). Its mapping is Gate B's "resolved mapping" (plan.md:141), and
-#186 first act 3 groups it with the rehearsal as "Gate B rehearsal (T003–T005)".
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 1 | "Confirm proposed leg names/visibility" (tasks.md:33). FR-012: "Treat visibility, baseline, branch disposition and lane rebinding as reviewed execution decisions" (spec.md:66–67). "Public new legs are proposed … Their creation is not approved." (spec.md:115–116) | Brett Heap's word naming the legs and their visibility, matching `visibility: public` (adoption-plan.yaml:21) and `legs:` (adoption-plan.yaml:27–30). | **DECIDED.** #186 comment 6035767825 quotes "open the PR for the planning branch; legs and visibility confirmed" and records `openRepoTools-spec`, `openRepoTools-code` and `public` as CONFIRMED, "a Gate C input, not Gate C". Name availability is a separate recheck at Gate C (preparation.md:53–56, plan.md:162–163). |
-| 2 | "inspect prerequisite availability" (tasks.md:33–34). "Make `git-filter-repo` available through the approved prerequisite path" (plan.md:105–106). It "must be made available before rehearsal/execution" (spec.md:116–117). | The rehearsal receipt names the git-filter-repo version, its wheel SHA256 and the private venv, and states that bench/system installs were left unchanged. preparation.md:60–65 shows the form. | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3 specifies "`git-filter-repo` 2.47.0 in a private venv". preparation.md:60–65 holds the October 4 receipt, for the 39d5c98 run only. No line on ff6f6a7 says who approved the private-venv path; it was installed "for this rehearsal" (preparation.md:62–63). |
-| 3 | "regenerate `adoption-plan.yaml` for the reviewed preliminary rehearsal source, retaining reasoned overrides" (tasks.md:34–35). "Regenerate the mapping using the standard rather than editing its source SHA" (preparation.md:112). "Do not change the baseline field to suppress a stale-plan finding" (quickstart.md:29–30). | A plan produced by `adopt-project.py plan` at 7f84ca4 from the repinned candidate, with `source.commit` set to that candidate. Every earlier `resolution:` is kept or re-reasoned, and every path added since daed209 is resolved with a reason. adopter-rehearsal.md:44–48 shows the October 6 precedent: `lanes-index` to code, `ideation/` to spec. | **IN PROGRESS by lane 1's rehearsal writer.** The plan committed on ff6f6a7 is from daed209 at 39d5c98 and covers 64 paths (adoption-plan.yaml:13–16), marked `proposed-preliminary-baseline` (adoption-plan.yaml:374). Main `c4864ac` tracks 100 paths. |
-| 4 | "Verify standard `check` passes and records all source paths with no unapproved drops" (tasks.md:35–36). FR-002 (spec.md:40–41). SC-001 (spec.md:95–96). | `check` exits 0 at 7f84ca4 against the regenerated plan. The plan summary shows `unresolved` 0, and drops are 0 or each one is approved. | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3: "regenerate …, `check`". |
-| 5 | "Explicitly classify genuine bounded feature amendment folders as code until upstream qualification; preserve full proposals/archives/canonical Speckit as spec regardless of branch origin" (tasks.md:36–38). FR-006 and FR-013 (spec.md:50–53, 68–72). plan.md:115–118. | The regenerated plan assigns `openspec/`, `specs/`, `docs/` and `ideation/` to spec. Any `features/<NNN-feature>/openspec/` path goes to code with a `resolution:`. | **IN PROGRESS by lane 1's rehearsal writer**, as part of the regeneration in line 3. Observation: `git ls-tree -r --name-only c4864ac \| grep -c '^features/'` prints 0. |
-| 6 | "Record no amendment paths when none exist; do not manufacture historical amendments" (tasks.md:39–40). | A per-head record of bounded amendment paths at the rehearsal source and the retained heads, empty where there are none. The form is inventory.json `protocol_review.amendment_path_observations` (inventory.json:342), which on ff6f6a7 covers only daed209 and the October 4 heads. | **IN PROGRESS by lane 1's Gate A writer**, as part of the `inventory.json` refresh. That the refresh keeps this field is (inferred). |
-
-### T004: isolated clone and local bare-remote rehearsal (tasks.md:44–47)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 7 | "Prepare a clean isolated source clone with no linked worktrees" (tasks.md:44–45), "at the chosen source commit" (plan.md:104). FR-010 (spec.md:62–63). "Execution SHALL use a clean isolated source clone without linked worktrees" (cap-spec:147). | A receipt naming the clone's HEAD (the repinned candidate) and showing a single-branch clone, a clean status and one `git worktree list` entry. | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3: "fresh isolated single-branch clone of the repinned candidate". |
-| 8 | "rehearse the standard adoption against temporary local bare remotes" (tasks.md:45–46), "with no real GitHub repository creation or default-branch movement" (plan.md:107–108). | `execute --local-remote-dir … --work-dir … --yes` exits 0 at 7f84ca4, into fresh disposable bare remotes, with network transport disabled except local file transport. preparation.md:67–70 and adopter-rehearsal.md:51–54 show the form. | **IN PROGRESS by lane 1's rehearsal writer.** |
-| 9 | "Verify source identity/history, path/blob accounting" (tasks.md:46–47). FR-002 and SC-001. Each tracked path accounted "by blob or gitlink identity in exactly one leg/root" (cap-spec:12–16). "full baseline accounting, leg histories" (plan.md:110–111). | The standard's accounting table (spec, code, root, dropped, total). An independent comparison of path, mode, object type and object ID showing zero missing or duplicate owners. The leg commits with their kept-commit counts. adopter-rehearsal.md:56–73 shows the form. | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3: "Record source accounting, leg commits". #186 does not say whether the independent comparison is part of that writer's scope. |
-| 10 | "… and recoverability without real GitHub creation" (tasks.md:46–47). "The source repository must remain unchanged if execution refuses" (adopter-blocker.md:58–59). | Source clone HEAD, refs and status identical before and after. The disposable legs kept for diagnosis. The live consumer's main, gitlink and pin contract unchanged. adopter-rehearsal.md:52–54 and 80–81 show the form. | **NOBODY.** It is not in #186 first act 3's record list ("source accounting, leg commits, recursive bootstrap, nested pin and digest"). |
-
-### T005: nested dependency and pin (tasks.md:48–52)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 11 | "If standard tooling refuses, record its refusal" (tasks.md:50–51). | The refusal, with the exact command, the exit status and the step that failed. | **EXISTS on ff6f6a7.** adopter-blocker.md:15–35 records `git submodule add` exiting 128 and `execute` returning 2. The same refusal is in preparation.md:72–77 and verification.md:13–16, and adopter-blocker.md:75–76 gives the private log's SHA256. |
-| 12 | "resolve upstream" (tasks.md:51). The upstream regression "should cover a populated existing submodule, its registration explicitly assigned to code, the generated assembly registrations, recursive clone/bootstrap, exact mode/object accounting, and failure recovery", plus "partial registration ownership and no-existing-module inputs" (adopter-blocker.md:61–65). | Regression results covering each named case for the fix. | **EXISTS on ff6f6a7, for the candidate only.** adopter-rehearsal.md:15–37 records `tests/test_adopt_*.py` at 90 passed, 1 skipped, and four `test_adopt_submodules.py` cases at draft `91d5685`. The mixed-registration case "does not qualify every mixed-registration plan" (adopter-rehearsal.md:30–32). PR #162 merged at a later head. Its GitHub review list is empty, and its review is a PR comment (2026-10-07T01:08:38Z) titled "Review, and what changed since 91d5685". |
-| 13 | "before a tested pin bump" (tasks.md:51). "bump to a commit on its main and recompute the dependency digest" (adopter-blocker.md:70). "use a commit on upstream main for the tested consumer pin/gitlink update and recomputed digest" (adopter-rehearsal.md:90–92). | One consumer commit that moves the gitlink and `contracts/openreposhape-pin.yaml` to a commit on openRepoShape main with `tree_sha256` recomputed, passes the required CI and lands on `main`. | **IN PROGRESS by lane 1's repin PR writer** (PR #188, open, not landed). `e43b243` (parent `c4864ac`) changes 2 files: gitlink to `7f84ca4`, `tree_sha256` to `3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8`. Checks at 11:04Z: `guard-launch-mode`, `tests`, `tests-no-submodule`, `tests-windows` and `parse-macos` SUCCESS; `tests-macos` SKIPPED; no `ready` label. The upstream side is done: #162 MERGED as `7f84ca4`, openRepoShape main's head. Lane 3 holds the adversarial review. |
-| 14 | "Exercise the existing nested submodule path, original `.gitmodules` extraction/removal" (tasks.md:48–49). FR-004 (spec.md:44–46). "source `.gitmodules` handling" (plan.md:110). | At 7f84ca4 the mount step that refused at 39d5c98 passes. The code leg carries the original `.gitmodules` bytes with the `upstream/openRepoShape` gitlink and contract. The assembly carries a fresh `.gitmodules` for spec and code only (the expected behavior, adopter-blocker.md:56–59). | **IN PROGRESS by lane 1's rehearsal writer.** |
-| 15 | "pin integrity" and "Verify the code gitlink/pin/registration remain coupled" (tasks.md:49–50). "its registration, exact gitlink and coupled pin SHALL remain valid" (cap-spec:23–26). | In the extracted code leg: the gitlink equals the contract's `commit:`, the pinned checkout's own helper recomputes a digest equal to the contract's `tree_sha256`, and the registration is unchanged. preparation.md:90–94 and adopter-rehearsal.md:77–81 show the form. | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3: "nested pin and digest". |
-| 16 | "recursive bootstrap" (tasks.md:49). It must be "demonstrated by local rehearsal and recursive bootstrap" (cap-spec:25–26). SC-004 (spec.md:101–102). | A recursive clone of the disposable assembly and the generated `scripts/bootstrap.py` both pass (naming, manifest, exact leg and copy pins), and the trees are clean afterwards. adopter-rehearsal.md:75–77 shows the form. On October 4 this was "blocked" (preparation.md:94–95). | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3: "recursive bootstrap". |
-
-### T006: root collisions, leg guidance, workflow roots (tasks.md:53–61)
-
-"T004–T006 precede integration validation" (tasks.md:162). Lane 2's consumer-side
-reads for T006 (`consumer-reads-2026-10-07.md`, committed at ae70dc556) are reads. They are
-not the patches these lines require.
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 17 | "Resolve materialized root collisions and new leg guidance in reviewable patches" (tasks.md:53–54). "Exercise all actual file-placement collisions" (plan.md:111–112). "Add leg root guidance without overwriting original root guidance" (plan.md:127). | The list of collisions that `execute` at 7f84ca4 actually materializes. At daed209 the plan lists five: `.gitattributes`, `.gitignore`, `AGENTS.md`, `CLAUDE.md` and `README.md` (adoption-plan.yaml:337–341). Then one reviewed patch per resolution against the rehearsed assembly commit, keeping the original root guidance. | **NOBODY.** Starts after line 8. |
-| 18 | "bootstrap selected root workflow after manifest/legs exist" (tasks.md:54–55). "regenerate root workflow using setup-openspeckit after manifest/legs are present" (adoption-plan.yaml:346). | The shape-aware bootstrap run at the rehearsed assembly root, with its result recorded. | **NOBODY.** Starts after line 8. |
-| 19 | "Verify first-line shape guidance, relative paths, actual `.specify` configuration and paired feature selection without copying machine secrets" (tasks.md:55–56). "Put `Read AGENTS-shape.md first...` guidance first" (plan.md:184–185). | The first lines of the root `AGENTS.md` and `CLAUDE.md`. The `.specify` configuration compared with the captured ignored workflow configuration, with no secret-bearing file copied. Paired feature selection resolving. | **NOBODY.** Its input, the Gate A writer's capture of ignored workflow configuration, is IN PROGRESS. |
-| 20 | "Record original approved repository/commit/path and verified extracted spec correspondence … Repair relative links, selected roots/stores and task paths without guessing new baseline identities" (plan.md:118–121). FR-014 (spec.md:73–77), which tasks.md:188 maps to T006. | A correspondence table from original repository, commit and path to extracted spec commit and path. Reviewed patches for the cross-leg references; at daed209 the code files that name `docs/`, `openspec/` and `specs/` are listed at adoption-plan.yaml:325–336. | **NOBODY.** |
-| 21 | "Verify explicit full-spec/local-amendment roots and intended feature branches, local-root precedence over store pointers and supported CLI store selection" (tasks.md:57–58, plan.md:131–135). | Runs in the rehearsed topology showing the selected root and branch for each operation, and a local root winning over a store pointer. `--store` is used only after recording that the installed CLI supports it. | **NOBODY.** |
-| 22 | "check protocol/command distribution per target workstation through owning workBenches delivery, without treating a scaffold bootstrap as distribution" (tasks.md:59–61, plan.md:136–138). | For each target workstation, the identities and digests of the installed protocol and commands, in the form of protocol-review.md:11–16. | **NOBODY.** |
-
-### T007: installer entry point (tasks.md:65–68)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 23 | "Installer/topology design can proceed while that resolution is pending" (plan.md:148). The installer design "is ready for follow-up implementation after successful standard split verification" (plan.md:15–16). | A design naming the entry point, the payload-source resolution, the consumers that change and the acceptance matrix. | **EXISTS on ff6f6a7.** installer-design.md:1–97, prepared against daed209 (installer-design.md:3). |
-| 24 | "refresh this inventory after landing" (installer-design.md:4–5). "Derive counts from the lists" (installer-design.md:64–65). At daed209 there were 15 `INSTALLABLES` and 29 artifacts (installer-design.md:61–64). | A read of the current source covering `INSTALLABLES`, the skills and commands lists, the destinations and the consumers at installer-design.md:52–59, with line cites. | **EXISTS on 004-migrate-to-triad-reads @ ae70dc556** (`specs/004-migrate-to-triad/consumer-reads-2026-10-07.md`). Its lines 235–239 cover the consumers at installer-design.md:52–59 with `openRepoTools` line cites. Line 241 records that main c4864ac has 17 `INSTALLABLES` and "31 artifacts, 29 of them files, 29 rows", while the design's numbers are those of daed209. |
-| 25 | "Add the assembly `openRepoTools` entry point and coherent payload-source resolution in the code installer after source byte accounting" (tasks.md:65–66). FR-005 (spec.md:47–49). "Record their patches and resulting commits" (plan.md:125–126). | Reviewed patches with their resulting commit ids: the entry point in the rehearsed assembly and the resolution in the rehearsed code leg. | **NOBODY.** Starts after line 9 (tasks.md:163). |
-| 26 | "Verify gh/raw one-liners resolve one code pin and do not duplicate installer mechanics or depend on developer checkouts after installation" (tasks.md:67–68). cap-spec:52–55. SC-003 (spec.md:99–100). | Runs in fresh disposable homes against disposable remotes, showing every payload coming from one immutable code commit and the installed commands working with the developer checkout absent. | **NOBODY.** |
-
-### T008: compatibility matrix (tasks.md:69–72)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 27 | "Cover local/offline, legacy monorepo overrides, adopted forks, branch/commit refs, immutable code selection, missing/mismatched pins and failed partial fetch" (tasks.md:69–71). "All rows below are pending measured tests in fresh disposable homes/remotes" (installer-design.md:70–71); the matrix has 15 rows (installer-design.md:75–89). | One measured test per matrix row, with its result recorded. | **NOBODY.** |
-| 28 | "Verify unchanged command/artifact names, counts, destinations/modes, hooks, ownership receipts and all-or-none refusal" (tasks.md:71–72). cap-spec:43–50. | A before-and-after comparison against the current installer's derived lists (line 24), and refusal runs that leave the prior install unchanged. | **NOBODY.** |
-
-### T009: explicit roots in fixtures and hygiene checks (tasks.md:73–76)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 29 | "Separate code/spec/assembly/dependency roots in fixture and hygiene consumers, including docs/OpenSpec/Speckit references" (tasks.md:73–74, installer-design.md:91–94). | Reviewed patches giving the fixtures and hygiene tests explicit roots. `tests/test_repo_hygiene.py` reads the root README, the install line and the agent guidance (installer-design.md:92–94). | **NOBODY.** |
-| 30 | "Verify the existing upstream pin checks run against code Git identity" (tasks.md:74–75). "Do not bypass the wrapper to obtain a pass" (preparation.md:99). | `tests/run.sh -k upstream_pin` passing inside the rehearsed code leg, with the output quoted. On October 4 the run stayed in the serialization wait and "No pytest assertion ran" (preparation.md:95–99). | **NOBODY.** #188's Linux `tests` job runs against the monorepo layout, not a code leg. Lane 2's verification pass (#186 comment 6035767825: the eight files `tests/test_upstream_pin.py` mounts are byte-identical between 39d5c98 and 7f84ca4) is evidence for the repin, not for this line. |
-| 31 | "required composed checks cannot silently skip absent spec/dependency context" (tasks.md:75–76). "Preserve the Bash 3.2 floor and original no-submodule test behavior, while requiring complete dependencies for composed acceptance" (plan.md:127–129). SC-004, "no hidden skips" (spec.md:101–102). installer-design.md:88, 97. | A run with the spec or dependency context absent in which the composed checks refuse, while the documented standalone no-submodule skips stay as they are. | **NOBODY.** |
-
-### T010: CI and composed acceptance (tasks.md:77–81)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 32 | "Adapt implementation CI and root exact-pin integration checks with explicit compatible checkout context" (tasks.md:77–78). "The assembly exact-pin integration job must refuse absent required contexts" (installer-design.md:97). design.md:121–126. | Reviewed workflow patches for the code leg and for the assembly root. | **NOBODY.** |
-| 33 | "preserve current Linux/macOS/Windows/WSL policies, Bash 3.2 parsing and serialized `tests/run.sh` locking" (tasks.md:78–79). | The patched workflows keep every job of `.github/workflows/tests.yml` at c4864ac and delete no assertion. The jobs are `guard-launch-mode`, `tests` and `tests-no-submodule` (ubuntu-latest), `tests-windows` (windows-latest), and `parse-macos` and `tests-macos` (macos-latest), at tests.yml:52, 72, 126, 157, 232 and 285. *2026-10-21: that is the file at c4864ac, where `ubuntu-latest` was Ubuntu 24.04 (CI run 37571444349 on c4864ac: `Image: ubuntu-24.04`). Since #296 the patched file holds four jobs, `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, all on `ubuntu-24.04`, at lines 90, 113, 173 and 218 (`gate-b-status-2026-10-09.md`, line 33).* | **NOBODY.** |
-| 34 | "Verify the exact rehearsed composed state passes required checks and the compatibility matrix, recording failures rather than deleting assertions" (tasks.md:80–81): the part that runs on this host. | `tests/run.sh` and the matrix run against the exact rehearsed assembly, spec, code and standard commits ("Composed candidate evidence", data-model.md:15), with failures recorded. | **NOBODY.** |
-| 35 | The same clause (tasks.md:80–81): the part that needs GitHub-hosted runners (the `tests-windows`, `parse-macos` and `tests-macos` jobs). | Those jobs' results against the exact rehearsed commits. | **BLOCKED on somewhere GitHub-hosted runners can check the rehearsed commits out from (inferred).** The rehearsed legs exist only in disposable local bare remotes. The suite's checkouts take `submodules: true` (tests.yml:7). #186 allows "no real leg repository … before Gate C". T015 later validates "the real exact assembled head using … required platform/CI" (tasks.md:107–108). |
-
-### T011: restore/rollback rehearsal and publication (tasks.md:82–85)
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 36 | "Rehearse restoration/rollback of the local candidate and installed payload using preserved artifacts" (tasks.md:82–83). Gate B's "restore rehearsal" (plan.md:140). Rollback (plan.md:238–247). SC-005 (spec.md:103–104). "Additional profiles/workstations and actual installer rollback still need receipts" (preparation.md:36–37). | A rollback-rehearsal receipt: the candidate left unmerged, original development and installation restored from the preserved artifacts, the installed payload returned to its pre-install receipt state, and digests compared. | **NOBODY.** Its input, the Gate A writer's preserved artifacts, is IN PROGRESS. The October 4 snapshot restores (preparation.md:22–30) are "not an owner-coordinated freeze or live rollback". |
-| 37 | "Verify user work/jobs/claims survive and no force push, destructive reset or workspace-pointer rewrite is needed" (tasks.md:83–85, plan.md:243–247). | A before-and-after inventory of branches, worktrees and dirty content; register claims and WIP pointers unchanged; a command log with no force push and no hard reset. | **NOBODY.** |
-| 38 | "Publish Gate A/B evidence" (tasks.md:85): the Gate A part. | A refreshed `inventory.json` and public-safe receipt identities and digests on `004-migrate-to-triad-exec`. The private bundle stays host-local beside `prep-20261004T211123Z`, and its receipt goes in the private WIP repository (#186 body, "Rules in force"; #186 comment 6035767825). | **IN PROGRESS by lane 1's Gate A writer.** At 11:06Z its branch is at ff6f6a7 locally and not on the remote. |
-| 39 | "Publish Gate A/B evidence" (tasks.md:85): the Gate B rehearsal part. | A receipt for the 7f84ca4 rehearsal, in the form of adopter-rehearsal.md. | **IN PROGRESS by lane 1's rehearsal writer.** At 11:06Z its branch is at ff6f6a7 locally and not on the remote. |
-| 40 | "… and follow-up patch/commit inventory" (tasks.md:85). "Record their patches and resulting commits so real execution can apply the reviewed changes after source verification" (plan.md:125–126). | One table of every T006–T010 patch, giving the target leg, the rehearsed base commit, the resulting commit and the review reference. | **NOBODY.** |
-
-### Cross-cutting conditions that no single task owns
-
-| # | Requirement (cite) | Evidence that would satisfy it | Status |
-| --- | --- | --- | --- |
-| 41 | "Stop adoption on this refusal; resolve upstream and repeat into fresh local remotes before treating Gate B as passed" (plan.md:146–148). "Repeat the consumer rehearsal with fresh remotes after repinning. Gate B still requires the reviewed upstream fix and the remaining integration work, even though the separate candidate rehearsal now succeeds" (adopter-blocker.md:71–73). | A rehearsal that runs the consumer's pinned openRepoShape at a commit on its main (7f84ca4) into fresh remotes. The October 6 run against draft `91d5685` (adopter-rehearsal.md:4–7) does not count. | **IN PROGRESS by lane 1's rehearsal writer.** "after repinning" depends on line 13. |
-| 42 | "Never use the live consumer as `--source` for this reproduction: local mode still pushes an adoption branch to its source clone if execution reaches that step" (adopter-blocker.md:52–54). | The receipt shows `--source` was the fresh isolated clone. Afterwards neither the live repository nor the remote has an `adopt/three-repo-shape` branch (adoption-plan.yaml:23). | **IN PROGRESS by lane 1's rehearsal writer.** #186 first act 3 restates the rule. At 11:06Z neither the shared repository nor the remote has an `adopt/` ref. |
-| 43 | "do not patch the pinned submodule or adjust digests to manufacture success" (plan.md:113–114). "never patch `upstream/openRepoShape` in place or weaken verification" (tasks.md:51–52). "pinned standard copies/digests SHALL NOT be edited to make placement pass" (cap-spec:84). #186 first act 1: "`tree_sha256` RECOMPUTED …, never adjusted". | The repin's `tree_sha256` equals an independent recomputation at 7f84ca4, `tests/test_upstream_pin.py` passes in the required CI, and the submodule has no in-place edit. | **IN PROGRESS by lane 1's repin PR writer** (#188, not landed). #186 comment 6035767825 records that lane 3's independent recompute at 7f84ca4 matches `3be52767…`. Lane 3 holds the adversarial review. |
-| 44 | "No real repository is created for a test" (plan.md:253). plan.md:107–108. FR-010 (spec.md:62–63). Without approval the migration "SHALL create no real leg repositories" (cap-spec:151–154). #186 rules: "no real leg repository, PR to a real leg, default-branch move or lane rebinding before Gate C". | A rehearsal receipt recording transport restricted to local files and refusing `gh`/`curl` shims (the form of preparation.md:67–70). Read-only lookups of the leg names. | **IN PROGRESS by lane 1's rehearsal writer.** At 11:06Z both leg names return HTTP 404, which means "not visible to the current credentials, not a guarantee of name availability" (preparation.md:53–55). |
-| 45 | "Reviewed preliminary inventory, mapping and prerequisite availability from T001–T003 permit disposable provisional rehearsal while writers remain active" (tasks.md:159–161). | A reviewed, refreshed `inventory.json` (T001), together with lines 2–6. | **IN PROGRESS by lane 1's Gate A writer**, as the T001 inventory refresh. The committed inventory was observed at 2026-10-04T21:24:50Z (`observed_at`). |
-| 46 | "reviewed follow-up patches" (plan.md:140–141). Implement "and review" the follow-ups "in the rehearsed arrangement" (plan.md:123–125). | A review record for each T006–T010 patch: reviewer, verdict and the commit reviewed. | **NOBODY.** No reviewer is named for T006–T010; lane 3's review covers #188 only. |
-
-## What closes Gate B
-
-The Dependencies section in tasks.md:162–165 says, verbatim:
-
-> T004–T006 precede integration validation;
-> T007–T010 may progress within the rehearsed topology after byte accounting.
-> T011 closes Gate B. T012 requires Gate A/B and is the real-creation approval
-> boundary.
-
-The plan adds that "Mapping `check` alone does not satisfy this gate"
-(plan.md:142) and that Gate B is not passed until the consumer rehearsal is
-repeated into fresh local remotes after the upstream resolution
-(plan.md:146–148, adopter-blocker.md:71–73). Gate B is recorded as open in
-three places on ff6f6a7: inventory.json:513 `"gate_b_complete": false`,
-verification.md:25 "Gate B remains open", and adopter-rehearsal.md:101–102
-"Gates A/B/C are not completed by this rehearsal".
-
-**Counts (46 lines):**
-
-| Status | Lines |
-| --- | ---: |
-| EXISTS (3 on ff6f6a7; 1 on 004-migrate-to-triad-reads @ ae70dc556) | 4 |
-| DECIDED | 1 |
-| IN PROGRESS | 19 |
-| NOBODY | 21 |
-| BLOCKED | 1 |
-
-The 19 IN PROGRESS lines are held as follows: lane 1's rehearsal writer 14,
-lane 1's Gate A writer 3, lane 1's repin PR writer 2.
-
-**NOBODY lines (21):**
-
-- 10: proof that the rehearsal left the source unchanged and recoverable
-- 17: the collisions the rehearsal materializes, with a reviewed patch for each
-- 18: the shape-aware root workflow bootstrap in the rehearsed assembly
-- 19: first-line guidance, `.specify` and paired feature selection verified
-- 20: provenance correspondence and cross-leg link repair
-- 21: explicit spec/amendment roots, local-root precedence and store selection
-- 22: per-workstation protocol/command distribution check
-- 25: the assembly entry point and payload-source resolution patches
-- 26: one-liners resolving one code pin with no developer checkout
-- 27: the 15-row compatibility matrix measured
-- 28: names, counts, modes, hooks, receipts and all-or-none refusal unchanged
-- 29: explicit roots in fixtures and hygiene tests
-- 30: `tests/run.sh -k upstream_pin` passing in the rehearsed code leg
-- 31: composed checks refusing absent context instead of skipping
-- 32: code-leg CI and root exact-pin integration patches
-- 33: every current CI job and platform policy kept
-- 34: the composed state passing the required checks and the matrix locally
-- 36: the restore/rollback rehearsal of the candidate and installed payload
-- 37: work, jobs, claims and WIP pointers surviving with no force or reset
-- 40: the follow-up patch/commit inventory
-- 46: a review record for each T006–T010 patch
-
-**BLOCKED line (1):**
-
-- 35: the hosted-runner part of T010's verification. It waits on somewhere
-  GitHub-hosted runners can check out the rehearsed commits before Gate C
-  (inferred).
-
-## Outside Gate B (for orientation)
-
-These conditions sit next to Gate B but belong to other gates:
-
-- **Gate A completion.** "complete Gate A preservation is required before real
-  source freeze" (tasks.md:161). Gate A is not a precondition of the
-  rehearsal, but line 36 uses Gate A's preserved artifacts.
-- **Gate C.** "approval names the actual source/standard revisions, leg
-  repositories, visibility and final plan; prerequisites, Gate A/B evidence and
-  no-name-collision checks are current" (plan.md:161–163). Governance item 1.2
-  runs "after Gates A/B" (openspec/changes/migrate-to-triad/tasks.md:11–14). The
-  leg names and visibility are a confirmed Gate C input (line 1). The frozen
-  source commit and the final mapping are not yet approved.
diff --git a/specs/004-migrate-to-triad/gate-b-status-2026-10-09.md b/specs/004-migrate-to-triad/gate-b-status-2026-10-09.md
deleted file mode 100644
index f6eec7a3..00000000
--- a/specs/004-migrate-to-triad/gate-b-status-2026-10-09.md
+++ /dev/null
@@ -1,692 +0,0 @@
-# Gate B status walk and the Gate C open questions — October 9, 2026
-
-**Checked:** 2026-10-09T20:30Z–20:55Z, refreshed 21:56Z–22:15Z (UTC). The git state is a
-`fetch --all --prune` at 22:07:06Z. The GitHub reads were made between 20:32Z and 20:41Z and again
-between 21:58Z and 22:10Z. #186's comments were read through 22:06:49Z. Anything later is not in
-this walk.
-**Updated 2026-10-11T16:3xZ, after lane 3's review of #196 (5481348731 findings 12 and 14):**
-lines 20, 29 and 31 move from MET to PARTLY, because each carries an open defect, which this
-walk's own legend makes PARTLY (the legend now also says what does not count); and the walk now
-agrees with two records #196 carries beside it: the candidate record at `16e6ea4`, which
-publishes r2 and classifies every failure, and lane 2's slice B at `40f26f7`, which lane 3
-reviewed as LAND. Nothing else was re-walked. These later facts are not read into the lines:
-- #191 is at `8246983`, with lane 3's LAND (5481368124), `ready` since 16:31:43Z (6111192078).
-  *2026-10-13:* it landed on `main` as `a74c7fc`, the squash of `8246983`.
-- IN is at `67a978c`. #196 carries `3cca1e7`, whose line 13 still names a host path, which
-  section 2 and section 5 item 4 say must go first (5481348731 finding 13). *2026-10-13:* the
-  host path is gone from `7668c51` on, and #196's final refold carries the installer record
-  from there (the 2026-10-13 entry below).
-- The test-root follow-ups are #195, open at `e378871`. Lane 3's LAND (5481360555) covers
-  `fb77bed`; `e378871` adds #193 item 14, decided as "the test gives".
-- Lane 2's verification of T18 is posted (6103482530): the record holds, with five minor
-  contradictions and findings a–g the record does not report.
-- T007's v3 entry-point patch makes the T3 change, and #196 carries it. Its re-review is not
-  recorded here.
-- openRepoShape `main` is `20e13f0`, 8 ahead of `7f84ca4`. `e4decfb` (#194) makes a plan that
-  sends `.gitmodules` and a submodule it registers to different legs a `check` finding; this
-  plan sends both to code (5481348731 finding 14), so line 12 stays MET. `20e13f0` refuses a
-  leg mount path inside a path the root holds. Both change `adopt-project.py`, so six of the
-  eight commits do. Still only `22c9fdd` touches a mounted file. Question e1 names the head
-  current at the request.
-
-**Updated 2026-10-13T18:4xZ, before #196's final refold.** No line's status changes; the counts
-stay MET 27 · PARTLY 18 · OPEN 0 · AFTER-GATE-C 1.
-- #191 landed on `main` as `a74c7fc` on 2026-10-13, the squash of `8246983`. #195 is still
-  open at `e378871`.
-- #196's final refold carries each record from the earliest head that holds its fixes. The exact
-  heads are in #196's "Input heads carried" table, which moves with each fold:
-  - the installer record from `7668c51` on: no host path at its line 13, and lane 3's 5481368376
-    answered; from `7428e78` on, also lane 2's check at `8246983`;
-  - slice B from `2c040d6` on, for lane 3's 5481348731 items 7–9: item 8's leftover at
-    `1578f99`, item 7 at `17dd54f`, item 9 (the host behind openspec 1.13.1) at `2c040d6`. The
-    T011 record, `gate-ab-evidence-2026-10-09.md`, is now taken from slice B, which carries RR
-    `2e7e55e`'s file with those corrections;
-  - the candidate record from `e81100c` on: r3, #191 at its final head `8246983` with T007's v3,
-    the four install modules green in composed mode, and F1 gone. The full composed suite is
-    redone at the frozen source for Gate C.
-
-**Hold, 2026-10-13, on Brett Heap's word relayed by lane 3 (#186 6152410188, 18:29:47Z):** the
-cutover (Gate C), any new adoption rehearsal or adoption plan at `7f84ca4`, and any bump of
-`upstream/openRepoShape` wait until openRepoShape v1.0.0 is tagged. After the tag, in order: the
-pin-bump PR, a fresh rehearsal and adoption plan at v1.0.0, then the cutover. #196 is not held,
-because it is evidence of what held at `7f84ca4`, which is what the statuses here record. The
-same comment reports that five of the eight mounted files have changed upstream since
-`7f84ca4`. For that later `main`, this supersedes the 2026-10-11 count of one above. Read
-question e1 with this hold.
-
-**Updated 2026-10-19, with the cutover patches (branch `004-triad-cutover-patches`, part of
-[#186](https://github.com/opensoft/openRepoTools/issues/186)):** lines 17 and 33 move from MET to PARTLY, and
-lines 32 and 33 now describe the regenerated code-leg workflow patch. Nothing else was re-walked. The counts are
-MET 25 · PARTLY 20 · OPEN 0 · AFTER-GATE-C 1 (they were 27 · 18 · 0 · 1).
-- The branch replaces two patch files and adds one. The earlier `assembly-0001` (sha256
-  `cd69c2a9afb7bb111a8af038d3c19ef9db08ff64147717a7dba78c7102c5d096`) and the earlier code-leg `tests.yml` patch
-  (`7ee3c6d041a4343894a9e56cdbcfbd93dd98c3d1848157ecd02ee6fd58786c3b`) stopped applying after #227, #237 and
-  #228. Their replacements are the re-cut `assembly-0001`
-  (`2ec48bbf00a90e857c77c6d8de8a68f8643e5351bf611bfc47476816a3eaead7`), the regenerated
-  `t010-code-leg-tests-workflow.patch` (`1406ead36f1edab24254257d430d084306c618c3f1694faf647152d00cef6d56`) and the
-  new `t009-assembly-caps.patch` (`2dd4aac276f54bebc164e12cf34c0aa64c6348b32414501f291e49f4d9b2bbe5`), which sets
-  the assembly-root length caps the re-cut needs.
-- None of the three has a review. The independent review of the branch's PR is owed until it is recorded (lines 17,
-  32 and 46).
-- The measurements are lane 1's, in its private prep of 2026-10-19. The rows say what ran.
-
-**By:** lane openRepoTools-1's reviewer, under [#186](https://github.com/opensoft/openRepoTools/issues/186).
-It ran read-only everywhere except this file and its own scratch. A first, unpublished pass was
-made at 13:27Z–13:50Z; section 1 says which statuses moved since.
-**Walks:** the 46 lines of [gate-b-checklist.md](gate-b-checklist.md) (main, from #189).
-**Cross-check:** lane openRepoTools-2's independent walk, which has the same path as this file,
-`specs/004-migrate-to-triad/gate-b-status-2026-10-09.md`, on `004-migrate-to-triad-reads` @
-`a7a8e00` (reads to 13:48:37Z). Section 2 reconciles the two line by line, and also answers lane
-2's review of this walk's first pass (#186 6088829392). Lane 2's copy stays on its branch as a
-cross-check and goes into no PR.
-
-This walk records facts. It approves nothing and changes no status in [tasks.md](tasks.md), where
-all 19 tasks stay open. Gate C stays Brett Heap's explicit approval naming the actual revisions
-(plan.md:160–163). Machine paths are left out (plan.md:38–39). Private receipts are named by id
-only, and their contents are not quoted. Logs held only in lane 1's private scratch are cited
-through the #186 comment that reported them.
-
-## Refs read
-
-Paths are under `specs/004-migrate-to-triad/` unless they start with `openspec/`.
-
-| Short | Ref | Head read |
-| --- | --- | --- |
-| M | `main` | `f87fd5a` (#190), on `1abee1d` (#192), on `63810dd` (#189) |
-| CI | `004-migrate-to-triad-ci` | `d28e2cc` |
-| IN | `004-migrate-to-triad-installer` | `51993a4` |
-| RB | `004-migrate-to-triad-rollback` | `fa44d75` |
-| RR | `004-migrate-to-triad-rollback-refresh` (lane 2's slice A) | `2e7e55e` (`c1283b5`, `612ea94`, `2e7e55e` on RB). *2026-10-13:* #196's final refold takes this file from slice B |
-| EF | `004-migrate-to-triad-evidence-2-followups` (lane 2's slice B) | `40f26f7`, as #196 carries it: `096de93` plus lane 3's findings 1–3 and one nit (the branch has since moved to `1578f99`). *2026-10-13:* the final refold carries it from `2c040d6` on |
-| CA | `004-migrate-to-triad-candidate` | `16e6ea4`, r2 published and classified, as #196 carries it (on 2026-10-09 the branch was `935f53f`, the r1 build). *2026-10-13:* the final refold carries r3, from `e81100c` on |
-| T18 | `004-migrate-to-triad-t018` | `63bff08` |
-| L2 | `004-migrate-to-triad-reads` | `a7a8e00` |
-| #191 | `feat/installer-payload-source-resolution` | `13cc752` |
-| FU | `feat/test-roots-followups` (no PR) | `01ccc86` |
-
-Main's planning files (plan, spec, tasks, the capability spec and the change's tasks) are
-unchanged since `63810dd`; `git diff --stat 63810dd f87fd5a` over them is empty. Every `plan.md`,
-`spec.md` and `tasks.md` line cited below holds on `f87fd5a`.
-
-**Live facts at the check:**
-- `gh api repos/opensoft/openRepoTools-spec` and `-code`: HTTP 404 (20:32Z, 21:58Z and 22:08Z). The `gh`
-  account is `brettheap`, an active admin of `opensoft`.
-- openRepoShape `main` is `22c9fdd`, ahead 6 and behind 0 of the pinned and rehearsed `7f84ca4`:
-  `b18cca9`, `21f5c33`, `f25d805`, `bc09bc5`, `4ce9cb0`, `22c9fdd` (question e1).
-- `git ls-remote origin 'refs/heads/adopt/*'`: nothing.
-- #191 is the only open PR, at `13cc752`. Lane 3's delta review 5471121210 is LAND, with
-  conditions. Lane 1's next head was announced (#186 6088714587) and was not on origin at
-  22:07Z. Lane 2's T008 matrix at `13cc752` is final (#186 6088812080).
-- Lane 2's slices are on origin, both meant for the evidence-3 PR. A is RR: lane 3 reviewed
-  `c1283b5` as LAND within evidence-3 (#186 6089982753), and `612ea94` and `2e7e55e` take in its
-  notes N1–N9 (6090048356). B is EF: lane 3 reviewed `096de93` as LAND within evidence-3
-  (6092925484), and `40f26f7` takes in its findings 1–3 and one nit (6103529172).
-- Lane 3's review of FU and the T010 patches is posted (#186 6089801221, 21:47Z).
-- The r2 composed candidate's three suites finished at 18:20:47Z. Lane 2's reading of the logs is
-  #186 6087267593; this walk checked the summary lines against the logs. CA at `16e6ea4`
-  publishes them and classifies every failure, F1–F6 (CA §5).
-- In progress, so not counted as evidence: the Gate A capture-tool fix (#186 6087232548,
-  6087261307; nothing new in brett-wip since `99eed35`, per 6089772323 and 6089982753); lane 2's
-  verification of T18 (6089772323).
-- Not counted, because its head is not on origin: lane 2's pre-push T008 matrix on lane 1's
-  unpushed #191 head and v3 entry-point patch (#186 6090038382). It reports the ancestor-walk
-  cases, (c) and (e) fixed, v3 refusing a gitlink that disagrees with the pin, and nine items
-  still open. It is a preview of the next head's check.
-
-## Status legend
-
-- **MET**: the evidence named in the checklist's "Evidence that would satisfy it" column exists
-  on a pushed ref and, where the line asks for a review, the review is recorded.
-- **PARTLY**: evidence exists but is incomplete, unreviewed, measured on a head that has moved,
-  or carries an open defect or an open decision.
-- **OPEN**: no finished evidence.
-- **AFTER-GATE-C**: cannot be met before real legs exist.
-
-An open #193 item that is a defect in the line's own evidence makes the line PARTLY. A later
-step listed under "What remains", such as a rerun at the frozen source or a recheck at the
-request, does not (added 2026-10-11).
-
-Publishing the T006–T011 records on `main` is not itself a checklist line. It is listed among the
-blockers in section 5.
-
-## 1. The 46 checklist lines, at 2026-10-09T22:1xZ
-
-| # | Line (short) | Status | Evidence | What remains | Owner |
-| --- | --- | --- | --- | --- | --- |
-| 1 | Leg names and visibility confirmed (T003, FR-012) | MET | #186 6035767825 ("legs and visibility confirmed"); M:`openspec/changes/migrate-to-triad/adoption-plan.yaml` (legs; `visibility: public`) | Recheck at the Gate C request. 404 is not proof the names are free (preparation.md:53–56) | Brett (given); lane 1 (recheck) |
-| 2 | `git-filter-repo` via the approved prerequisite path | PARTLY | M:adopter-rehearsal-2026-10-08.md#Setup; M:adopter-rehearsal-2026-10-07.md#Setup; #186 6072724043 (i) | No record names who approves the private-venv path for the real `execute` (plan.md:105–106, :160–162): question e4. Neither receipt carries the October 4 receipt's "existing bench/system installations were unchanged" (preparation.md:62–63), which the evidence column asks for (lane 2, 6088829392 item 10). The "no ensurepip" cause is withdrawn on EF; the refusal's cause is not established (#193 item 12) | Brett; lane 1 |
-| 3 | Plan regenerated for the rehearsal source, overrides kept | MET | M:`openspec/changes/migrate-to-triad/adoption-plan.yaml` (source `837928a`, 22 resolutions); M:adopter-rehearsal-2026-10-08.md#Mapping (T003); #192 review 5464893559; #186 6072724043 (iv) | The final plan is regenerated at the frozen source before the request (question e2). `check` reads the clone's local `main`, so the committed plan is `plan-stale` against any later `main` (#193 item 10; EF:adopter-rehearsal-2026-10-08.md:113–125) | lane 1 |
-| 4 | Standard `check` passes, every path, no unapproved drop | MET | M:adopter-rehearsal-2026-10-08.md#Run C (`plan ok`; 120 = 65/49/6/0); #186 6072724043 (ii) | Rerun at the frozen source | lane 1 |
-| 5 | Amendment folders to code; full proposals and specs to spec | MET | M plan: `docs/`, `ideation/`, `openspec/`, `specs/` to spec; 0 `features/` paths on `main` | Re-observe at the frozen source | lane 1 |
-| 6 | No amendment paths recorded where none exist | MET | M:inventory.json `refreshed.amendment_path_observations` (every head empty) | Re-observe at the Gate A final capture | lane 1 |
-| 7 | Clean isolated source clone | MET | M:adopter-rehearsal-2026-10-08.md#Setup; receipt `adopter-fix-20261008-1HztL0`, verified in #186 6072724043 | — | — |
-| 8 | Rehearsal into temporary local bare remotes | MET | M run C (`execute` 0, file transport only, 0 shim calls) | — | — |
-| 9 | Identity, history and path/blob accounting | MET | M:adopter-rehearsal-2026-10-08.md#Run C; #186 6072724043 (iii); #192 review finding 4 | — | — |
-| 10 | Recoverability; source unchanged | MET | M run C; M:adopter-rehearsal-2026-10-07.md#Run A; RB:gate-ab-evidence-2026-10-09.md#1; no `adopt/` ref on origin | — | — |
-| 11 | Standard's refusal recorded | MET | M:adopter-blocker.md | — | — |
-| 12 | Upstream resolution with regressions | MET | M:adopter-rehearsal.md#Regression evidence (draft `91d5685`: each case adopter-blocker.md:61–65 names); openRepoShape #162's CI at its head `6fa4e07`: `tests`, `tests-windows` and `tests-macos` SUCCESS (2026-10-07T00:57Z–01:06Z); its merge `7f84ca4`: `tests` (`python3 -m pytest tests -q`, `tests/test_adopt_submodules.py` included) SUCCESS at 01:13:26Z | The regression "does not qualify every mixed-registration plan" (adopter-rehearsal.md:30–32); this repository's plan is not one (line 14). openRepoShape `main` has moved 6 commits past `7f84ca4`: question e1. Lane 2 holds PARTLY (section 2) | Brett; openRepoShape owner |
-| 13 | Tested consumer pin bump on `main` | MET | M@`837928a` (#188); #186 6068861167 | — | — |
-| 14 | Nested submodule; original `.gitmodules` | MET | M runs B and C (code keeps blob `8043147a`; the assembly gets its own) | — | — |
-| 15 | Pin integrity, coupled | MET | M run C (`3be52767…` MATCH); #186 6072724043 (v) | — | — |
-| 16 | Recursive bootstrap | MET | M run C (`bootstrap ok`, three validators) | — | — |
-| 17 | Root collisions and leg guidance as reviewed patches | PARTLY | M:root-guidance-2026-10-08.md#1, #4; M:patches/t006/*; #192 review 5464893559 finding 7 (exact rebuild). *2026-10-19, `assembly-0001` is re-cut:* that review (a pull-request review on #192, LAND on `71b05cb`) covers the earlier file (sha256 `cd69c2a9…c5d096`), which no longer applies to the root files #228's series leaves: `git am --3way` exits 128 on a split-like root, and seven of its 20 hunks fail (`AGENTS.md` 3, 6, 7 and 8; `README.md` 4, 5 and 6), where #227, #237 and #228 rewrote the lines around them. The re-cut, `patches/t006/assembly-0001-…` (sha256 `2ec48bbf…eaead7`), maps the 20 hunks one for one and keeps the repairs at 16 and 13. On the root files of #228's stack top (T025 `b3aab89` with pr3fix `c6cea2a` merged in), `apply --check` and `git am --3way` exit 0 on the six-file root and on a split root built by openRepoShape `190133d`'s own `materialize_assembly_root` (24 files), with the #471 block still last in `.gitattributes`: `AGENTS.md` goes 330 → 354 lines and `README.md` 505 → 529, and `patches/t009-assembly-caps.patch` sets the assembly-root caps to those counts. Through `tests/run.sh` with `-k 'repo_hygiene or test_roots or openrepotools_command'`, in scratch layouts: 342 passed, 0 failed, 0 skipped on the stack top's files, standalone and composed, and on the materialized root; 374 passed with `006-release-pypi` `d10cfb1` merged in. Both controls fail as built to: the re-cut without the caps, 2 failed ("AGENTS.md is 354 lines; the cap is 347", "README.md is 529 lines; the cap is 510"); the assembly without the re-cut, 1 failed (`test_agents_md_names_the_pin_rules`) | The re-cut has no review: it replaces the file lane 3 reviewed, so its review is the independent review of the cutover-patches PR (branch `004-triad-cutover-patches`), owed until it is recorded. Its `.gitattributes` hunk is tied to openRepoShape `190133d`'s nine-path block, so a later pin regenerates that hunk. It has met scratch layouts only, never a candidate built through the adoption tool (run D). #193 items 8–13, the text fixes: on EF, LAND by lane 3 (6092925484), carried by #196 at `40f26f7`; item 9's count stays open (line 20). The `shape/*.md` deletion is T014's reviewer's | lane 1 (EF by lane 2); an independent reviewer |
-| 18 | Shape-aware root bootstrap after the legs exist | PARTLY | M:root-guidance#7; T18:t018-disposable-2026-10-09.md#1 (a second run: `setup-openspeckit --shape on` exit 0, `worktree_root: worktrees`) | Neither run is reviewed, and neither has a receipt: EF now says so plainly (#193 item 11; EF:root-guidance-2026-10-08.md:31–56). Lane 2's verification of T18 has since been posted (6103482530; the dated note). T18 finds the bootstrap leaves the root "dirty" to `resume` (T18 §5 item 1): question e7 | lane 1; Brett |
-| 19 | First-line guidance, relative paths, actual `.specify`, paired selection, no secrets | PARTLY | M:root-guidance#2, #3 (both verified by #192 review finding 7), #7, #8; T18 §2 (paired selection from the root, either leg and either worktree; `check-prerequisites.sh` agrees ×5) | `.specify` was read from today's checkout, not from Gate A's captured configuration (lane 2, L2 line 19). The `.specify` posture is undecided (question e7). `SPECIFY_FEATURE` alone gives a branch and directory that disagree (T18 §5 item 8). T18 is unreviewed | lane 1; Brett |
-| 20 | Provenance correspondence; link repair without guessed hashes | PARTLY | M:root-guidance#6 (35/35; 47 citations resolve in the assembly), #3; #192 review finding 10 | The record's own count is open: "23 mentions in 9 files" sums to 26 in 11, and no recount settles it. EF says so and leaves it "not established" (EF:root-guidance-2026-10-08.md:210–211), and lane 3 rates that part of #193 item 9 PARTLY (6092925484). T017 recounts, with feature 004's own pre-split paths | lane 1 |
-| 21 | Explicit roots, local-root precedence, supported store selection | PARTLY | M:root-guidance#7 (store precedence; strict validate in the spec leg); T18 §3 (OpenSpec from each root with 1.2.0 and 1.6.0) | Store precedence rests on the document alone (#193 item 11). T18 shows the root and the code leg pass `validate --all --strict` vacuously, so validation must run in the spec leg (T18 §5 item 7). `--store` needs openspec 1.6.0 or later (question a) | lane 1; workBenches owner |
-| 22 | Protocol/command distribution per target workstation through workBenches | PARTLY (no owner) | M:root-guidance#9: Eagle's two installed protocol files carry "Triad Feature Amendments" (sha256 `f9dd6464…`, `bbbc2b2c…`) | Not via workBenches delivery; command and skill digests absent; no other workstation; no target list; no writer holds it (lane 2 read only vendoring, consumer-reads-2026-10-07.md:85–105). Section 2 records lane 2's NOBODY | Brett (names the workstations); workBenches owner; a holder to be named by lane 1 |
-| 23 | Installer design | MET | M:installer-design.md | — | — |
-| 24 | Installer inventory refreshed | MET | M:consumer-reads-2026-10-07.md#The installer's own assumptions; IN:installer-2026-10-08.md#Lane 2's installer rows (17/23/29/31) | installer-design.md:61–64 still carries `daed209`'s counts | lane 1 |
-| 25 | Entry point and payload-source resolution as reviewed patches | PARTLY | IN:patches/t007-assembly-entry-point.patch; #191 @ `13cc752`: LAND with conditions (review 5471121210; delta 8 is the stale PR body, plus `tests-macos` under `ready`) | The next #191 head needs its own check; it was not on origin at 22:07Z. The entry-point patch is CHANGES REQUIRED (5471121210 T3: on the remote path, confirm the gitlink before running the pinned implementation). Not landed | lane 1; lane 3 |
-| 26 | One-liners resolve one code pin; no developer checkout | PARTLY | 5471121210 T1–T2 (a disposable assembly at `13cc752`: one code commit, the installed tree byte-identical to a checkout install, local delegation with no fallback); #186 6088812080 (final matrix at `13cc752`) | Rerun at the next head with the T3 fix. On the single layout a ref that moves mid-install mixes versions, as on `main` (6088812080 item 7); the PR body should scope "resolve once" to the adopted layout (5471121210 delta 8). Real one-liners are T015's | lane 2; lane 1 |
-| 27 | 15-row compatibility matrix measured | PARTLY | #186 6073209094 and 6073234714 (15/15 at `2411f40`); #186 6088812080 (final at `13cc752`, 337 row logs; F1, F2, (b) and (d) fixed) | Rows 18–22 bear on the next head (6088812080 items 1–6): the layout search walks every ancestor, and a HOME holding `contracts/code-pin.yaml` refuses to reinstall; a missing ref or repository is read as a single repository and never named; a 502 on a probe refuses where `main` installs; the 404 path; garbage at 200 is reported as a moved ref; (c) and (e) remain. Rerun at the next head | lane 2; lane 1 |
-| 28 | Names, counts, modes, hooks, receipts, all-or-none unchanged | PARTLY | 5471121210 delta 2 (offline install byte-identical at `13cc752`); #186 6088812080 (210 of 210 refusals placed nothing; 82 of 83 installs 29/29 byte-exact, the exception row 7's deliberate mixed case; 40 of 40 receipts consistent; both hook entries present); #186 6087267593 and CA §4 (the r2 install from the assembly root: the same 29 files as main's, byte-identical except the implementation, and a byte-identical `settings.json`) | Rerun at the next head. An adopted `wip init` that refuses still leaves an empty server repository behind (#186 6087232548, its F2 row) | lane 2; lane 1 |
-| 29 | Explicit roots in fixtures and hygiene checks | PARTLY | M@`f87fd5a` (#190 at `b50f197`): lane 3's LAND 5464931249 and 5464938427, and its verdict on `b50f197`, 6089801221 (a) (lane 1's own delta review is 5471080687); CI green including `tests-macos` | #193 items 2–7 and 15 are open defects of these fixtures on `main`. Item 5, the paired layout, is a Gate C item lane 3 wants settled before Gate C (section 5, item 2). The command test still reads the README before its `--help` half (6089801221 finding 9). The follow-ups were FU @ `01ccc86` at the read; see the dated note for #195 | lane 1; lane 3 |
-| 30 | `tests/run.sh -k upstream_pin` inside the rehearsed code leg | MET | #186 6072319462 (all 14 `test_upstream_pin.py` pass in code leg `73b04d6`); CI:test-roots-and-ci-2026-10-08.md#1 | The runs used `tests/run.sh`'s own pytest line under the same lock, not its census (#184) | lane 1 |
-| 31 | Composed checks refuse instead of skipping | PARTLY | M@`f87fd5a` (#190); #186 6087267593 (five refusal cases exit 4 on an r2-equivalent); 6089801221 finding 15 | The checklist's evidence column is met, but this refusal carries two open defects. #193 item 15: it misnames a root that was named (6089801221 finding 14). Item 4: conftest never reads a pin's `commit:`, closed in CI only by `composed.yml`'s step order (finding 13). Lane 2 confirms both fixed on #195 (6103529172), which is open. About forty other conditional skips can still pass a composed run; none fires on `ubuntu-24.04` (finding 13 (ii), read when `ubuntu-latest` was that image), which is the runner `composed.yml` names since 2026-10-21 | lane 1 |
-| 32 | Code-leg CI and assembly exact-pin job patches | PARTLY | CI:`patches/t010-assembly-exact-pin-job.patch` (a new file, so it applies to any split); CI:test-roots-and-ci#5–#6; lane 3's review 6089801221 (c), which read both patches at `d28e2cc`: fit for evidence-3, both apply to run C and the code-leg patch to `f87fd5a`. *2026-10-19, the code-leg patch is regenerated:* the one lane 3 reviewed (sha256 `7ee3c6d0…786c3b`, base `e27bc64`, `tests.yml` at `f87fd5a`) no longer applies, because #227 (`aaa7bc8`) rewrote `tests.yml` to `3c7caa4` and #209 to `ee69264`, main's today; on the post-#228 file its hunks 1 and 4 are rejected, and the two that still apply carry a `-rs` on the `tests` job that fails `tests/test_tests_workflow.py` (1 failed, 29 passed). The new `patches/t010-code-leg-tests-workflow.patch` (sha256 `1406ead3…ef6d56`, three hunks, +41 −1) is made against `tests.yml` `2cfa173`, the file #228's PR 2 leaves (queue head `4b3ba5e`; PR 3 and PR 4 leave it unchanged). On fresh copies of that tree `git apply --check`, `git apply` and `git am --3way` are clean and give blob `e2d1fe2`. `tests.yml` is the same blob `2cfa173` at the queue head, PR 2, PR 3, PR 4 and the merged stack top (T025 `ef6c18d` with pr3fix `c6cea2a` merged in), so the patch applies at every #228 head read; on the stack top `git apply --check` and `git am --3way` exit 0 and give `e2d1fe2`, and the heads that moved since (`006-release-pypi` `d10cfb1`, T025 `b3aab89`) cherry-pick clean on top of it. The result parses with PyYAML 6.0.3 and with the pinned standard's `load_yaml`, and differs from `2cfa173` in data by one new top-level `env`, so no job, trigger or `run:` line moves. Through `tests/run.sh`: `-k tests_yml` 30 passed, 0 skipped; in a leg-like tree (front doors and spec trees removed) with the workflow's own `env`, `-k 'tests_yml or repo_hygiene or upstream_pin'` 265 passed, 16 skipped, each naming its root, and the `package` job's three test modules 280 passed, 5 skipped (the wheel tests, which need `OPENREPOTOOLS_TEST_WHEEL`). *Also 2026-10-19, on the stack top:* in a leg-like tree of it with the patch applied (109 tracked files removed: `docs/`, `ideation/`, `openspec/`, `specs/` and the three front doors) no test goes RED in the leg. `-k 'tests_yml or repo_hygiene or upstream_pin'` gives 234 passed, 17 skipped, 0 failed; the install, package, release-workflow, tests-workflow, hygiene, test-roots and command modules (`install_pipx`, `openrepotools_command`, `package` with `package_stamp`, `release_workflow`, `repo_hygiene`, `test_roots`, `tests_workflow`) give 993 passed, 23 skipped, 0 failed, and 1040 passed, 23 skipped with main `55aae16` merged in and `upstream_pin` added; no run has a failure or an error. Each skip names its root (`README.md` 11, `AGENTS.md` 3, `CLAUDE.md` 1, `docs/README-lanes.md` 3) or is one of the 5 wheel tests. *Lane 1's `-rs` ruling, 2026-10-19:* no `-rs` on `tests` or `guard-launch-mode`, so the leg's skip reasons are read in `tests-no-submodule`, which already carries `-rs`. `tests/test_tests_workflow.py` pins those two jobs' `run:` lines, and #228's `contracts/workflows.md` keeps them byte for byte. *2026-10-21, the assembly patch is regenerated:* `ubuntu-latest` became Ubuntu 26.04 that day, #296 pins the code leg's Ubuntu runners to `ubuntu-24.04`, and `exact-pins` runs the same suite (`bash code/tests/run.sh -rs`), whose `[host]` kill test fails on 26.04. The file lane 3 reviewed (sha256 `6ee09f00…74670b`) names `runs-on: ubuntu-latest`. The new `patches/t010-assembly-exact-pin-job.patch` (sha256 `60245cb9…f0f653`) names `runs-on: ubuntu-24.04` under a three-line comment in #296's words, at patch lines 63–66 (`THIS` for `EVERY`, and no Python 3.9 clause, because this job installs `3.x`). Only those lines, the diffstat, the hunk header, the `index` blob (`113f094`) and the `From` line (a scratch commit, `247f63df`) differ from the reviewed file; author, date, subject and body, with the `Lane:` trailer, do not. On a tree with no `composed.yml`, `git apply --check` exits 0 and `git am` gives blob `113f094`, which PyYAML 6.0.3 parses. The change has no review beyond the pull request that carries it | The regenerated patch has no review of its own: lane 3's covers the old one, and the independent review of the cutover-patches PR (branch `004-triad-cutover-patches`) is owed until it is recorded. It has met scratch trees, leg-like trees and #228's stack top only: never a real leg, a hosted runner (line 35) or a built wheel (the 5 wheel tests have not run: hatchling is not on the host that ran them); `actionlint` is not installed (it last ran 2026-10-07). Its base moves if PR 2 is amended again: re-run `git apply --check` on the landed `tests.yml`. `package` and the `release/v*` trigger need nothing from this patch (FR-041, FR-046): the leg needs `LICENSE` (blob `261eeb9`) and its own `.gitattributes` from T006's `code-0001`, its first commit after the split, or the `package` wheel check and the hygiene test are red. `composed.yml` runs the suite through `run.sh`, whose long run root makes #180's two row-stamp assertions fail, so `exact-pins` would be red until #180 is fixed or the job uses a short `TMPDIR` (finding 13 (i), inferred); its header (patch lines 38–43) still calls macOS's bash 3.2 parse, the `ready` suite and Windows "the code leg's own `tests` workflow", which #227 made untrue. Both patches need a real author at T014 (finding 13 (iv)). SonarCloud and required checks: question e9, now four code-leg checks (`guard-launch-mode`, `tests`, `tests-no-submodule`, `package`) and the assembly's `composed / exact-pins` | lane 1; lane 3; Brett |
-| 33 | Platform policies, Bash 3.2 and serialized locking kept | PARTLY | CI:test-roots-and-ci#5. *2026-10-19, what this line rested on is gone:* lane 3's review 6089801221 finding 12 read six jobs (`tests-macos` with its `ready` gate, `parse-macos`'s bash 3.2 file list, a Windows env), and #227 (`aaa7bc8`, Brett Heap's decision of 2026-10-15 for the whole estate) removed `tests-macos`, `tests-windows` and `parse-macos`. The policy of record is Linux only. `tests.yml` at `2cfa173` (#228's PR 2) holds four jobs, `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, all `ubuntu-latest`, at lines 54, 74, 130 and 175. *2026-10-21:* #296 pins them to `ubuntu-24.04` (`ubuntu-latest` became Ubuntu 26.04 that day) and adds a three-line comment at `tests.yml:55-57`, so on its `tests.yml` (blob `46feb68`) they are at lines 54, 77, 133 and 178. The regenerated code-leg patch (line 32) keeps all four, at lines 90, 113, 173 and 218 of the patched file (blob `a24d126`, all four on `ubuntu-24.04`; on `2cfa173` the patched file, blob `e2d1fe2`, has them at 90, 110, 170 and 215), with the same ids, no `name:` and no `if:`, the same triggers (`pull_request` with `labeled`, push to `main` and `release/v*`, nightly 04:17Z, `workflow_dispatch`) and the same `run:` lines, which `tests/test_tests_workflow.py` pins and which pass (30 passed). Lane 1 ruled on 2026-10-19 that `tests` and `guard-launch-mode` take no `-rs` (line 32). On #228's stack top no test goes RED in a leg-like run (line 32). Serialized locking is as today: `tests/run.sh` is untouched, and `guard-launch-mode` is the job that calls it. No `tests.yml` job parses bash 3.2 any more, and the one 3.2 run is the release workflow's macOS install leg, on dispatch only, from PR 3 (AGENTS.md at PR 2 says both). WSL stays a documentation policy (AGENTS.md) | The line is PARTLY until the regenerated patch is on a pushed ref with a recorded review (the independent review of the cutover-patches PR is owed): its MET rested on lane 3's review of a patch that no longer applies. `tasks.md:78–79` and this line's checklist text ("preserve current Linux/macOS/Windows/WSL policies, Bash 3.2 parsing") name policies the 2026-10-15 decision took out of CI; the plan owner should restate it, for example as "the Linux-only policy and serialized `tests/run.sh` locking, the bash 3.2 parse living in `release.yml`'s macOS install leg", and the line can then be met on that wording. The assembly has no `tests-macos` check and neither has the code leg now, so finding 12's second half (T015's landing tooling must allow for it) matters only if landing tooling still reads that name, which was not checked | lane 1; plan owner |
-| 34 | Exact composed state passes required checks and the matrix (local) | PARTLY | CA `16e6ea4` §§2, 5: r2 = code `4dbcf6c` (#190 `b50f197`, #191 `13cc752`, T006, T010), spec `9e1d006`, assembly `5d92962`; composed 1411 passed / 5 failed / 0 skipped; standalone 1389 / 3 / 24; no submodule 1168 / 6 / 242; every failure classified; private receipt `candidate-20261009-JR8YyA`. Lane 2's counts agree (6087267593) | It does not pass yet (CA §6). Two failures are candidate defects: F1, r14's `KeyError: 'reason'`, first seen in r1, fixed in #191's `6fa3b43` and not re-run; F2, `test_agents_md_names_the_pin_rules`, #193 item 14, pending in CA and since implemented on #195 as "the test gives". F3 and F4 are #180's row stamps; F5 is the harness's inherited ignored SIGINT, not load; both fail the same on main. F6 is timing under load, pre-existing. Owed: a composed rerun at #191's final head with T007's v3, F1 gone and F2 decided | lane 1 |
-| 35 | Hosted-runner part of T010 | AFTER-GATE-C | CI:test-roots-and-ci#5 ("Neither patch can run on GitHub until the legs exist"), #8 | Question d | Brett |
-| 36 | Restore/rollback of the candidate and installed payload | PARTLY | RB:gate-ab-evidence-2026-10-09.md#1–#2; lane 2's independent check (#186 6082370012: restore 91 PASS, four homes reproduce); CA §4 (r2's install; a reinstall from main restores main); RR (the record now says the hook rollback is vacuous and the backup holds no `settings.json`; lane 3 LAND at `c1283b5`, 6089982753) | No hook-changing rollback, no restore of the local candidate from preserved artifacts and no post-merge revert/pin-bump rollback is rehearsed (lane 3 6082139424 findings 11 and 19; 6082370012 (iv)). The capture tooling v2 cannot stand as evidence until A1 is fixed (6087261307). RR is not on `main` | lane 1 |
-| 37 | Work, jobs and claims survive; no force push, reset or pointer rewrite | PARTLY | RB:gate-ab-evidence#3; #186 6082370012 (verified; 0 non-fast-forward against GitHub); RR §3 | Jobs have no before/after record, only "no script … kills a process" (6082139424 finding 19). No force push is argued for a real rollback, not shown | lane 1 |
-| 38 | Publish the Gate A evidence | MET | M:preservation-2026-10-07.md, M:inventory.json (#189); receipt `prep-20261007T100559Z` | Gate A itself stays open (section 5) | lane 1; Brett |
-| 39 | Publish the Gate B rehearsal evidence (a receipt in adopter-rehearsal form) | MET | M:adopter-rehearsal-2026-10-07.md (runs A and B, #189) and M:adopter-rehearsal-2026-10-08.md (run C, #192); receipts `adopter-fix-20261007-iM20tv`, `adopter-fix-20261008-1HztL0`, verified in #186 6036838832 and 6072724043 | The other Gate B records are not on `main` (section 5, item 4) | lane 1 |
-| 40 | Follow-up patch/commit inventory | PARTLY | RB:gate-ab-evidence#5 (7 patches; *2026-10-19: eight files now, because T009's `t009-assembly-caps.patch` is new, and the inventory's #1 and #6 are replaced by a re-cut and a regenerated file*); RR §5 (maps each follow-up to a patch, PR, owner or "deferred", including run C's 29 `follow_ups`; lane 3: finding 18 RESOLVED at `c1283b5` except N3, which `612ea94` takes in, 6089982753 and 6090048356) | Lane 3's finding 18 (6082139424) lists what the inventory lacked. Since 01:13Z: T007's entry point; #190's follow-ups (`b50f197`, the `ln_doc` abort fix, FU); #191's heads `2411f40` and `13cc752`; capture tooling v2. Known at 01:13Z: run C's 29 named `follow_ups`; the routing in root-guidance-2026-10-08.md:186–194; lane 3's `feat/triad-lane-tooling`; the 33 outside consumers not covered; the `shape/` deletion left to T014. The stack check used superseded heads. RR answers all of it, and states that T010's two patches have no recorded resulting tree (finding 20). It is not on `main`, and the heads it lists are not final: T007's entry point (T3), #191's next head and FU's edit, so it is refreshed once more at the final heads | lane 1 |
-| 41 | Repeated into fresh remotes after the upstream fix | MET | M runs B and C at `7f84ca4` on openRepoShape `main` | A repin needs a new run (question e1) | — |
-| 42 | Never the live consumer as `--source` | MET | M run C setup; no `adopt/` ref on origin | — | — |
-| 43 | No in-place submodule edit; digests not adjusted | MET | #186 6035767825 and 6036838832 (v); M:root-guidance#1 (11/11 shape digests) | — | — |
-| 44 | No real repository created for a test | MET | Both legs 404 at 20:32Z and 21:58Z; RB:gate-ab-evidence#3; T18 §1 (network namespace, 0 successful network calls) | Recheck at Gate C | lane 1 |
-| 45 | Reviewed refreshed inventory (T001) with lines 2–6 | MET | M:inventory.json (stamp 2026-10-07T10:09:03Z; #189 LAND) | Refresh at the Gate A final capture | lane 1 |
-| 46 | A review record for each T006–T010 patch | PARTLY | T006: 5464893559 LAND (landed). T009: #190 LAND ×2 and delta LAND (landed). T007/T008 code side: #191 `13cc752` LAND with conditions (5471121210). T010: lane 3 6089801221 (c), fit for evidence-3 | The T007 entry-point patch is CHANGES REQUIRED (5471121210 T3). #191's next head: unchecked. T010's `composed.yml` carries finding 13 (line 32). *2026-10-19:* reviews of the three cutover patches are owed, all of them the independent review of the cutover-patches PR (branch `004-triad-cutover-patches`): the re-cut `assembly-0001` (5464893559 covers the earlier file), the regenerated code-leg `tests.yml` patch (6089801221 (c) covers the earlier file) and `t009-assembly-caps.patch`, which has none. The T006 and T010 verdicts in the Evidence cell are for the earlier files | lane 3; lane 1; the PR's independent reviewer |
-
-**Counts (46):** MET 25 · PARTLY 20 · OPEN 0 · AFTER-GATE-C 1 (on 2026-10-09: 30 · 15 · 0 · 1; on 2026-10-11: 27 · 18 · 0 · 1).
-- **PARTLY:** 2, 17, 18, 19, 20, 21, 22, 25, 26, 27, 28, 29, 31, 32, 33, 34, 36, 37, 40, 46.
-- **AFTER-GATE-C:** 35.
-
-**Moved since lane 1's first pass (13:27Z–13:50Z, unpublished; then MET 29 · PARTLY 15 · OPEN 1 ·
-AFTER-GATE-C 1):**
-- **29: PARTLY → MET.** #190 landed at `b50f197`.
-- **33: PARTLY → MET.** Lane 3's review of the T010 patches (21:47Z) confirms every job, gate and
-  policy the line names.
-- **34: OPEN → PARTLY.** The r2 suites finished, with failures.
-- **36 and 37: MET → PARTLY.** Lane 3's T011 review (13:43Z) shows the hook rollback, the
-  candidate restore, the post-merge rollback and jobs are not rehearsed.
-- **39: PARTLY → MET.** Run C landed with #192. This walk now reads line 39 by the checklist's own
-  evidence column; the other records' publication moves to section 5.
-
-**Moved on 2026-10-11** (lane 3's 5481348731 finding 12, by this walk's own legend):
-- **29: MET → PARTLY.** #193 items 2–7 and 15 are open defects of the fixtures it names.
-- **31: MET → PARTLY.** #193 items 4 and 15 are open defects of the refusal it names.
-- **20: MET → PARTLY.** The record's "23 in 9" count is open.
-
-**Moved on 2026-10-19** (the cutover patches: the earlier `assembly-0001` and code-leg workflow patch no longer
-apply, and the files that replace them have no review):
-- **17: MET → PARTLY.** The reviewed `assembly-0001` (lane 3's 5464893559, a pull-request review on #192) no longer
-  applies to the root files #228's series leaves. The branch `004-triad-cutover-patches` re-cuts it, and the
-  re-cut's review, the independent review of that branch's PR, is owed until it is recorded.
-- **33: MET → PARTLY.** The line's MET rested on lane 3's review of a code-leg workflow patch that no longer applies,
-  and on six jobs, three of which #227 removed. The regenerated patch has no review yet, and the plan owner
-  restates the line's wording (line 33's What-remains cell).
-
-## 2. Reconciliation with lane 2's walk at `a7a8e00`
-
-Lane 2's walk is `004-migrate-to-triad-reads` @ `a7a8e00`:
-`specs/004-migrate-to-triad/gate-b-status-2026-10-09.md`, the same path as this file. Lane 2
-keeps it on that branch, unrevised, as a cross-check; it goes into no PR (lane 2, #186
-6088829392). Lane 2 read to 13:48:37Z; this walk reads to 22:10Z.
-
-Lane 2's legend is the checklist's own: EXISTS, IN PROGRESS, NOBODY, BLOCKED, DECIDED. It
-describes who holds a line. This walk's legend describes the evidence. The two map as follows:
-- DECIDED ≈ MET;
-- BLOCKED ≈ AFTER-GATE-C;
-- IN PROGRESS ≈ PARTLY;
-- EXISTS is MET when nothing remains, and PARTLY when a review, a receipt or a decision does.
-
-**Lines that differ in substance, with this walk's verdict:**
-
-| # | Lane 2 | This walk | Verdict |
-| --- | --- | --- | --- |
-| 22 | NOBODY | PARTLY (no owner) | **Both are right about different things, and they agree on the gap.** Lane 2 records that no writer holds it. This walk records that a start exists: Eagle's installed protocol-file digests (root-guidance §9). But that start is not "through owning workBenches delivery" and has no command or skill digests, so even Eagle is partial. Kept as PARTLY, flagged as having **no owner**; no lane-2 writer holds it either (6088829392 item 6). It cannot finish until Brett names the target workstations (question e8) and the workBenches owner delivers. Lane 1 should name a holder. |
-| 2 | EXISTS | PARTLY | Lane 2 itself notes that no source names who approved the private-venv path, and later adds that neither receipt says bench and system installs were left unchanged (6088829392 item 10). plan.md:105–106 asks for "the approved prerequisite path", and Gate C asks that "prerequisites … are current". Kept as PARTLY until Brett answers question e4. |
-| 12 | EXISTS, candidate only; PARTLY in 6088829392 item 2 | MET | Lane 2 found no regression record at the merged head and asks this walk to cite #162's CI at `6fa4e07` or say there is none. This walk cites it: at #162's head `6fa4e07`, `tests`, `tests-windows` and `tests-macos` succeeded, and at its merge `7f84ca4` the `tests` job, `python3 -m pytest tests -q` with `tests/test_adopt_submodules.py` included, succeeded at 2026-10-07T01:13:26Z (Windows and macOS are skipped on that push). Each case adopter-blocker.md:61–65 names is covered by adopter-rehearsal.md:23–36, and those tests pass at the merged head. The stated limit, "does not qualify every mixed-registration plan", does not reach this repository, whose one registration moves whole to code (line 14). MET. |
-| 18 | EXISTS (document only) | PARTLY | A row that exists only in the writer's document, with no receipt and no independent rerun, is evidence not yet checked (#193 item 11). T18 adds a second run by lane 1 itself, also unreviewed, and a new finding: the bootstrapped root is "dirty" to `resume`. PARTLY. |
-| 19 | EXISTS | PARTLY | Lane 2's own note that `.specify` was read from today's checkout and not from Gate A's capture is a gap against the checklist's evidence column. The posture decision is open (e7), and T18 adds the `SPECIFY_FEATURE` disagreement. PARTLY. |
-| 21 | EXISTS (document only) | PARTLY | As for 18. T18 also shows that validation run from the root passes vacuously. PARTLY. |
-| 20, 29, 31 | EXISTS (unlanded) | PARTLY (2026-10-11) | All three landed (#192, #190), and each still carries an open defect in its own evidence: 20 the "23 in 9" count, 29 #193 items 2–7 and 15, 31 items 4 and 15. Lane 3's 5481348731 finding 12. PARTLY. |
-
-**Lines that agree in substance:**
-- **Same status, different legend:** 1, 4–11, 13–16, 23, 24, 30, 35, 38, 41–45 (MET or
-  AFTER-GATE-C here; DECIDED, EXISTS or BLOCKED there).
-- **Unlanded at lane 2's cutoff, landed since:** 3 and 17 (lane 2's "EXISTS (unlanded)"
-  are MET now). 20, 29 and 31 also landed, and are in the table above since 2026-10-11.
-- **Line 33:** EXISTS there, MET here since lane 3's review of the T010 patches (6089801221
-  finding 12). This walk's earlier PARTLY waited only on that review.
-- **IN PROGRESS there, PARTLY here:** 25–28, 32, 34, 36, 37, 40, 46.
-  - The newer facts are 5471121210 (#191 LAND with conditions; T007 patch CHANGES REQUIRED),
-    6088812080 (the final matrix at `13cc752`), 6087267593 (r2's three suites), 6089801221
-    (lane 3's T010 review), 6089982753 (lane 3's LAND on RR), and RR and EF (lane 2's slices).
-  - Lane 2 also holds 36 and 37 open on its T011 verification. That verification has since
-    passed (6082370012), and lines 36 and 37 stay PARTLY on lane 3's review findings instead.
-  - Lane 2's `a7a8e00` still names holders for lines 32, 36, 37 and 40 that have since finished
-    (6088829392).
-- **Line 39:** EXISTS there, MET here. Both read the run C receipt, which is now on `main`.
-- **Lines 17 and 33 (added 2026-10-19):** both are PARTLY again, for the reasons under "Moved on 2026-10-19" in
-  section 1. The bullets above give their statuses on 2026-10-11.
-
-**Lane 2's "Facts noticed" — this walk's verdicts:**
-- **Item 16 (a host-absolute path in IN:installer-2026-10-08.md:13): agree.** It must be removed
-  before IN goes into the evidence-3 PR; plan.md:38–39. *2026-10-13:* it is removed from
-  `7668c51` on, and #196's final refold carries the record from there.
-- **Items 1 and 8 (the candidate receipt is absent from brett-wip; the record cites #191 at
-  `2411f40`): agree, and both are answered.** CA at `16e6ea4` names the receipt
-  `candidate-20261009-JR8YyA` and records r2 against #191 at `13cc752` (line 34).
-- **Item 13 (two openspec results): agree.** It is question a. T18 §3 now measures 1.2.0 and
-  1.6.0 side by side.
-- **Item 14 (two reviews of lane 1's PRs are headed "lane openRepoTools-1"): agree; a note, not a
-  status change.** The reviews of record for #190 and #191 are lane 3's; lane 1's are same-lane
-  second opinions.
-- **Items 2–7, 9–12, 15 and 17: agree.** They are overtaken by the landings, or are text fixes
-  carried by #193.
-
-**Lane 2's review of this walk's first pass (#186 6088829392), item by item:**
-1. Lines 36 and 37 to PARTLY: **adopted.**
-2. Line 12 to PARTLY: **not adopted.** The merged-head CI record it asks for is cited (the table
-   above); MET stands.
-3. Line 34 to PARTLY with the r2 numbers: **adopted**, with the note that r2 rests on `13cc752`.
-4. Lines 25 and 46, 5471121210's CHANGES REQUIRED (T3) and #191's LAND with conditions:
-   **adopted.**
-5. Question e1 is stale: **adopted.** `main` is `22c9fdd`, and its `scripts/repo_shape.py` change
-   is the only one of the six commits that touches a mounted file (question e1).
-6. Line 22, drop "lane 2" from the owner: **adopted.**
-7. Re-cites: **adopted.** Run C's records are cited on `main`; "Land #192" and "fold `b50f197`"
-   are gone; line 39 is MET.
-8. Question a, record `command -v` and `--version` for each CLI: **adopted** (question a).
-9. Questions e6, c and b: **adopted** (section 4).
-10. Lines 40 and 2: **adopted** (section 1).
-
-Lane 2's corrections to its own records stand as it gives them: r14's `KeyError 'reason'` was
-first seen in lane 1's r1, and #193 item 15 was found on lane 2's own r2-equivalent build, not in
-lane 1's r2 logs (#193 now says so).
-
-## 3. T001–T019 against the evidence
-
-Every task stays open on `main`.
-
-| Task | What the evidence already covers | What remains before Gate C | After Gate C |
-| --- | --- | --- | --- |
-| T001 inventory | M:inventory.json, M:preservation-2026-10-07.md (17 trees, 33 refs, the estate-status refusal relayed, amendment observations) | Owner dispositions for every retained object, approved by Brett (question e5); a refreshed inventory at the final capture | — |
-| T002 preservation | Gate A bundle; restore 97 PASS (October 7), 90 PASS (RB), 91 PASS (lane 2's independent run) | Capture tooling v3: lane 2 found that v2 rewrites the source's index (A1) and can write under `/` (A2) (#186 6087232548, 6087261307). No fix was posted by 21:44Z, and no capture runs on a real checkout until lane 2 re-verifies one. Then the owner-coordinated freeze, the final capture, and installed-file receipts for py-bench and the other workstations | — |
-| T003 mapping | Names and visibility confirmed; filter-repo; run C's plan (`plan ok`, 0 drops) on `main` | Approve the prerequisite path (e4); regenerate and `check` at the frozen source; the final mapping goes into the approval (e2) | — |
-| T004 rehearsal | Run C on `main` | A rerun at the frozen source if question e3 requires one | The real `execute` is T013 |
-| T005 nested pin | Refusal, upstream fix and repin; the nested pin and bootstrap in runs B and C; upstream CI at `6fa4e07` and `7f84ca4` | Question e1 (stay on `7f84ca4`, or repin and rehearse again) | — |
-| T006 root/leg guidance | Collisions, 32 repairs, leg front doors, provenance 35/35 (on `main`); bootstrap, paired selection and OpenSpec roots measured twice (root-guidance §7; T18 §§1–3) | #193 items 8–13 (EF: LAND, carried by #196 at `40f26f7`; item 9's count open); lane 2's verification of T18 (posted, 6103482530), then a review; a receipt, or the sentence EF adds saying there is none; questions a, c, e7, e8 | T014 applies `assembly-0001`, `code-0001` and `spec-0001`, regenerates the two bumps with `bump-leg.py`, and settles `shape/*.md`. T18's follow-ups go to workBenches and lane 3. *2026-10-19: `assembly-0001` is the re-cut (line 17), and it needs T009's `t009-assembly-caps.patch` in the code leg.* |
-| T007 entry point | The entry-point patch (IN); #191's code side, LAND with conditions at `13cc752`; T1–T2 of 5471121210 | #191's next head: proof, lane 3's check, the PR body, `tests-macos`, landing, against the matrix findings of 6088812080. The entry-point patch's T3 change, then its re-review | T014: the entry point ships in the root-split PR itself (lane 3, #186 6072087071); T015: the real one-liners |
-| T008 matrix | 15 rows at `2411f40`; the final matrix at `13cc752` (337 row logs) | A rerun at #191's next head (one command, lane 2) | T015 against the real GitHub; workBenches re-vendors (W1/W3/W8) once the legs exist |
-| T009 test roots | #190 landed with `b50f197`; its CI green, macOS included | Land the follow-ups (FU @ `01ccc86` at the read; #195 since): #193 items 2–7, 14 and 15, with item 5 (paired layout) before Gate C | Verify at the real head (T015). *2026-10-19: T014 applies `patches/t009-assembly-caps.patch` in the code leg, after `code-0001` and the code-leg workflow patch, once it has a review (line 46).* |
-| T010 CI | Two workflow patches; local proofs P1–P4; lane 3's review, fit for evidence-3. *2026-10-19: the code-leg patch is regenerated (line 32), and lane 3's review covers the earlier file.* *2026-10-21: the assembly patch is regenerated too, for the runner pin (line 32).* | `composed.yml` against #180 (finding 13 (i)); a composed run of the final candidate that passes (line 34); question d | Hosted runs at the real legs (T015); a real author on both patches (T014); SonarCloud binding and required checks (e9) |
-| T011 restore/rollback | Source restore and four rollback homes, independently verified; RR refreshes the record, LAND by lane 3 within evidence-3 | A hook-changing rollback, the candidate restore and a post-merge pin-bump rollback, or a dated statement of what cannot be rehearsed; jobs before/after | Rollback checks at the real head (T015) |
-| T012 freeze and approval | #97 and #121 landed and are in the baseline | Freeze; regenerate and `check`; recheck the names; present the plan, follow-ups and dispositions; Brett's approval | Refuse source drift before `execute` |
-| T013–T015 | Prepared patches re-apply (RB §5; the candidate's §2) | — | All of them; T015 carries the hosted CI that question d moves there |
-| T016–T019 | T18 is the disposable half of T018 (unreviewed, on its branch; lane 2 is verifying it) | — | All of them. T016–T018 are prepared in the candidate once the legs exist; the real half of T018 and T019 follow cutover |
-
-## 4. Gate C open questions
-
-Each question ends in text for Brett Heap to approve, correct or reject. None of it is approved
-by being written here.
-
-### (a) `openspec validate migrate-to-triad --strict` fails on `main` with the CLI first on `PATH`
-
-**Run** in a scratch single-branch clone of `main` at `f87fd5a` (22:00Z; the first run, at
-`63810dd`, gave the same results). The change's files are identical at both heads. On lane 1's
-workstation, `command -v openspec` is `~/.npm-global/bin/openspec`, and `--version` prints
-`1.2.0`. The system openspec, second on `PATH`, prints `1.6.0`.
-
-```text
-$ ~/.npm-global/bin/openspec validate migrate-to-triad --strict    # 1.2.0, first on PATH
-Change 'migrate-to-triad' has issues
-✗ [ERROR] repository-triad-migration/spec.md: ADDED "Installation retains the public interface and one revision" must contain SHALL or MUST
-exit=1
-$ <system openspec> validate migrate-to-triad --strict             # 1.6.0
-Change 'migrate-to-triad' is valid
-exit=0
-```
-
-On lane 2's host the system openspec is 1.13.1, and it passes `migrate-to-triad` and 5 of 5
-changes on `main` (6088829392 item 8). EF records 1.13.1 on the bench it measured
-(EF:adopter-rehearsal-2026-10-08.md:53). On lane 3's host on 2026-10-11 the order was 1.2.0,
-then 1.6.0, as here (5481348731 finding 9). Which CLI runs depends on the container.
-
-**Cause.** 1.2.0's `extractRequirementText` (`dist/core/validation/validator.js:369-390` in its
-package) takes only the first non-blank body line of a requirement. Line 45 of
-`openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md` reads `Existing
-one-line installation, command names, payload destinations/modes,`, and the requirement's SHALL
-is on line 46. 1.6.0 reads the whole body. Every other requirement in the file puts SHALL on its
-first body line. The same 1.2.0 rule fails `interactive-lane-name-repair` (two requirements),
-which is not this migration's change. T18 §3 and §5 item 7 add that from the root or the code
-leg, `validate --all --strict` finds no change and passes vacuously, so validation belongs in the
-spec leg. verification.md:28, :66, :96, :126 and :144 record strict validation as passed without
-naming a CLI version.
-
-**Proposed minimal change.** Tested in scratch copies: 1.2.0 and 1.6.0 both exit 0. No
-requirement is added, removed or renamed, and no scenario changes.
-
-```diff
- ### Requirement: Installation retains the public interface and one revision
-
--Existing one-line installation, command names, payload destinations/modes,
--skills/hooks/receipts and supported fork/ref/local invocation SHALL remain
--usable. An adopted assembly entry point SHALL resolve one immutable code
--revision for the complete installation. Missing/inconsistent pin evidence
-+The migration SHALL keep the existing one-line installation, command names,
-+payload destinations/modes, skills/hooks/receipts and supported fork/ref/local
-+invocation usable. An adopted assembly entry point SHALL resolve one immutable
-+code revision for the complete installation. Missing/inconsistent pin evidence
- SHALL refuse before partial installation. Installed tools SHALL function
- without a developer assembly checkout.
-```
-
-A no-wording alternative also passes both CLIs: join the first sentence onto one line.
-
-**Brett decides one of:**
-1. "Approve replacing lines 45–48 of
-   `openspec/changes/migrate-to-triad/specs/repository-triad-migration/spec.md` with: *The
-   migration SHALL keep the existing one-line installation, command names, payload
-   destinations/modes, skills/hooks/receipts and supported fork/ref/local invocation usable. An
-   adopted assembly entry point SHALL resolve one immutable code revision for the complete
-   installation. Missing/inconsistent pin evidence* (the rest unchanged). It changes no
-   requirement's meaning."
-2. "Leave the text. The validator of record is openspec 1.6.0 or later, run in the spec leg, and
-   the 1.2.0 copy in `~/.npm-global/bin` is removed or upgraded on every workstation that
-   validates."
-
-Optional in the same edit: line 64 ends `…its manifest/pins; product` and line 65 begins `Full
-proposals`, so the sentence reads "pins; product Full proposals". The stray word does not affect
-validation.
-
-### (b) "account move"
-
-**Every use.** `git grep -n -i -E 'account[ -]?move'` over `main` and every evidence branch, and
-#186's body and comments, find one line:
-
-```text
-specs/004-migrate-to-triad/adopter-rehearsal.md:103:conversion, merge, account move or lane rebinding.
-```
-
-It came in with `ff6f6a7` (2026-10-06, "docs: record successful triad adopter candidate
-rehearsal"), squashed into `main` by #187 as `44983ce`.
-
-**plan.md, spec.md and tasks.md never say it**, nor do the change's proposal, design, tasks and
-capability spec. Their "account" words are all about accounting for content: "account for",
-"accounting", "accounted" and "misaccounts" (for example plan.md:111–112, :152, :169, :209;
-spec.md:14, :40, :95, :111; tasks.md:47, :66, :89, :97, :135, :163; the capability spec's :13).
-Nothing in the plan defines an account move, and no task performs one.
-
-**What it needs.** The phrase sits in a list of acts the October 6 receipt does not authorize.
-Gate C's approval should say whether any account act belongs to the migration:
-- the legs would be created in the `opensoft` organization (adoption-plan.yaml `org: opensoft`),
-  and `gh` here is `brettheap`, an active admin of `opensoft`;
-- in-place adoption keeps `opensoft/openRepoTools` where it is;
-- no repository is transferred between accounts or organizations.
-
-The lanes' Claude "account swaps" in #186's comments are operational and unrelated.
-adopter-rehearsal.md is a dated receipt and is best left as written.
-
-**Text for Brett to approve or correct:** "No account move is part of this migration:
-`opensoft/openRepoTools` stays in place, `opensoft/openRepoTools-spec` and
-`opensoft/openRepoTools-code` are created in the `opensoft` organization by `brettheap`, and no
-repository is transferred between accounts or organizations."
-
-### (c) `.gitattributes`: plan.md against the code on `main`
-
-**The plan** (M:plan.md:55–62, § Target placement):
-
-```text
-57 | Assembly `openRepoTools` | `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitattributes`, `.gitignore`; generated manifest/Makefile/validators and assembly pins | Front door and project coordination across legs. |
-59 | Code `openRepoTools-code` | All executable tools, `repos.tsv`, `commands/`, `skills/`, `tests/`, implementation CI | Shipped implementation and its installer payload. |
-```
-
-**The code on `main`** since #190: `f87fd5a:tests/conftest.py:62–68` says everything outside the
-front-door documents and spec trees is the code leg's, "and that includes `.gitattributes`,
-DELIBERATELY: the placement table puts it at the assembly, but git reads a submodule's attributes
-from the submodule's own tree". So `main` now disagrees with plan.md:57 (6088829392 item 9).
-
-Related, and unchanged by this question: `openspec/changes/migrate-to-triad/design.md:48` ("Root owns front-door guidance, license,
-project metadata and workflow bootstrap") and adoption-plan.yaml's `.gitattributes` → `root`,
-which is correct for extraction. The original file and its history stay at the root.
-
-**Why** (#190's PR body, "Decision: `.gitattributes` stays in the code leg";
-CI:test-roots-and-ci-2026-10-08.md#2):
-- Git never applies a superproject's attributes inside a submodule. Measured in the composed
-  candidate: `code/park` and `code/tests/run.sh` are `text: unspecified`.
-- A leg split exactly by the table is red on `test_the_root_carries_the_line_ending_rule`.
-- T006's `code-0001` adds the code leg's own copy, and `spec-0001` gives the spec leg one. The
-  candidate confirms `text: auto`, `eol: lf` in the leg.
-
-**Proposed amendment** (the plan is Brett's own). Row 57 is unchanged. Row 59 becomes:
-
-```text
-| Code `openRepoTools-code` | All executable tools, `repos.tsv`, `commands/`, `skills/`, `tests/`, implementation CI; its own `.gitattributes`, added after extraction | Shipped implementation and its installer payload. Git never applies the assembly's `.gitattributes` inside a submodule, so the leg carries the LF rule its bash files and byte-for-byte installer checks need. |
-```
-
-Add after the table:
-
-```text
-Extraction gives each original front-door file one owner, the assembly. T006's leg patches then
-add new files to the legs: each leg's own `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE` and
-`.gitattributes`, and the code leg's `.gitignore`. `spec-0001` also re-points three test paths in
-the spec leg's `docs/README-claude-current.md`. These are reviewed changes after byte accounting,
-not moved paths, so the adoption mapping does not change.
-```
-
-**Text for Brett:** "Approve amending plan.md § Target placement: the code leg carries its own
-`.gitattributes` (and each leg its own short front door), added after extraction; the assembly
-keeps the originals." The minimal form, exactly what #190 asks, is the row 59 change alone.
-
-### (d) Hosted CI before the real legs exist
-
-**The conflict.**
-- T010 is in "Phase 3 — Installation and checks (Gate B completion)" and asks to "Verify the exact
-  rehearsed composed state passes required checks and the compatibility matrix" (tasks.md:77–81).
-- "T011 closes Gate B" (tasks.md:164).
-- The rehearsed commits live only in host-local bare remotes, which GitHub-hosted runners cannot
-  check out (checklist line 35).
-- "No real repository is created for a test" (plan.md:253). #186's rules forbid a real leg
-  repository or a PR to one before Gate C.
-- CI:test-roots-and-ci#5: "Neither patch can run on GitHub until the legs exist."
-- T015 already validates "the real exact assembled head using … required platform/CI"
-  (tasks.md:107–108) before the root adoption merge.
-
-**What exists today.** The code these jobs would test already runs on hosted runners, on today's
-layout:
-- #190: `tests`, `tests-no-submodule`, `tests-windows`, `parse-macos`, `tests-macos`,
-  `guard-launch-mode` and SonarCloud, all green;
-- #191: the same less `tests-macos`, which waits on `ready`. *2026-10-13:* #191 landed as
-  `a74c7fc`.
-
-What only the legs can show:
-- the code leg standalone with its document checks skipping by name;
-- the Windows LF check on the leg's own `.gitattributes`;
-- the assembly's `composed.yml` with an https recursive checkout, which lane 3 expects to be red
-  until #180 is fixed (6089801221 finding 13 (i)).
-
-**Options for Brett:**
-1. **(Recommended by this walk.)** "Gate B does not wait for hosted runners on rehearsed
-   commits. The hosted runs of the code leg's `tests.yml` jobs (including `tests-windows`,
-   `parse-macos` and `tests-macos`) and of the assembly's `composed.yml` move to T015, before the
-   root adoption merge. Before Gate C, the same jobs green on the code-side PRs against today's
-   layout and the local composed and standalone runs of the exact candidate stand in for them. No
-   repository is created to host them." Matching addition to tasks.md T010: "Hosted-runner checks
-   that need the real leg repositories run at T015 against the real exact assembled head."
-2. "Approve a never-merged draft PR on `opensoft/openRepoTools` whose tree is the candidate code
-   leg, to run its `tests.yml` on hosted runners before Gate C." It creates no repository, but it
-   is a PR against the real assembly repository whose tree deletes most of `main`, and it cannot
-   run `composed.yml`.
-3. "Approve temporary repositories <names, visibility> for hosted CI of the rehearsed commits,
-   deleted after T015." This contradicts plan.md:253, which would need amending in the same word.
-
-Two facts T015 must carry whichever option is chosen:
-- The assembly has no `tests-macos` check, so landing tooling that reads `tests-macos` by name
-  has nothing to read on an assembly PR (6089801221 finding 12).
-- After cutover the documented curl one-liner needs api.github.com, 5 API calls per install, and
-  `jq` on the curl path. A gh-less, rate-limited machine cannot install (5471121210 T4; question
-  e10).
-
-### (e) Other decisions only Brett can make
-
-In dependency order. Each is a sentence Brett approves, corrects or rejects.
-
-1. **The standard revision.** openRepoShape `main` is `22c9fdd`, six commits past the pinned and
-   rehearsed `7f84ca4`: #170 (`b18cca9`: `execute` refuses every finding `check` reports), #182
-   (`21f5c33`: shape files past a source `.gitignore` are force-staged and verified), #187
-   (`f25d805`: canonical leg mount paths), #185 (`bc09bc5`: scaffold force-staging), #186
-   (`4ce9cb0`: shape-doctor's submodule note) and #193 (`22c9fdd`: `load_yaml` refuses a
-   non-UTF-8 byte). Four of them change `adopt-project.py` itself. Only `22c9fdd` touches one of
-   the eight files this repository mounts (`scripts/repo_shape.py`; the eight are listed in
-   `837928a`'s message). A repin to `4ce9cb0` or earlier moves no mounted file. Gate C "names the
-   actual source/standard revisions" (plan.md:161), and the rules allow only a commit on
-   openRepoShape `main`.
-   - Either: "Execute with openRepoShape `7f84ca42ca86a8902928345109d2bf6bad87bd91`, the pinned
-     and rehearsed revision."
-   - Or: "Repin to <a commit on openRepoShape `main`, for example
-     `22c9fddc5635f7bfd2cc021ad7dfe3ade9c934f8`> first, through a pin PR with a recomputed digest,
-     and rehearse again (run D) before Gate C."
-2. **The frozen source, the landing hold and where the final plan lives.** A committed plan
-   counts `openspec/`, which contains the plan, so no commit that carries the plan can be its
-   source (#192 finding 17). `check` reads the clone's local `main` (#193 item 10).
-   - Text: "Freeze `main` at <40-hex> once the pre-Gate-C PRs land. Hold every landing on `main`
-     from then until the root-split PR merges or is abandoned. The final plan for that commit is
-     presented in the Gate C request and kept in the private receipt, not committed to `main`
-     before `execute`."
-   - The freeze also starts Gate A's owner-coordinated final capture (plan.md:77, :154–155).
-3. **Whether the rehearsal is repeated at the frozen source.** T012: "Verify current …
-   rehearsal evidence; refuse any source drift before execution". Gate C: "Gate A/B evidence …
-   current".
-   - Either: "A source that differs from `837928a` only under paths the plan already assigns
-     needs a regenerated plan and `check`, not a new rehearsal."
-   - Or: "Rehearse again (run D) at the frozen source before Gate C."
-4. **The prerequisite path.** "`git-filter-repo` 2.47.0, installed into a private venv from the
-   wheel with SHA256 `2cd04929b9024e83e65db571cbe36aec65ead0cb5f9ec5abe42158654af5ad83`
-   (`--no-index`), is the approved prerequisite path for the real `execute`; bench and system
-   installs stay unchanged, and the execution receipt says so." (plan.md:105–106; checklist
-   line 2)
-5. **Work dispositions.** T012 asks for approval of "work dispositions", and the change's
-   tasks.md 1.2 for "active-work dispositions". The October 7 inventory's dispositions are
-   proposals held in a private receipt (M:preservation-2026-10-07.md#Inventory (T001)). Text:
-   "Approve the dispositions in receipt <id> as listed."
-6. **#191's behaviour on today's layout.** The review rule makes any change to today's
-   single-repository behaviour before Gate C a Gate C item (#191 review 5464963807 finding 3).
-   Measured differences at `13cc752`:
-   - two extra probe requests per install (26 raw requests against `main`'s 24 with no gh; 25 gh
-     contents against 23), each answered 404 (5471121210 delta 3);
-   - an offline installed-copy reinstall refuses in new words that name the layout question,
-     where `main` names the skills (delta 3);
-   - the ancestor walk, unreachable in today's estate, adds an output line under an unrelated
-     LF pin and exits 2 under a CRLF one (delta 4);
-   - lane 2's matrix adds a 502 on a probe refusing where `main` installs, a missing ref read as
-     a single repository after 34 requests with `main`'s words, and a HOME holding
-     `contracts/code-pin.yaml` refusing a reinstall (6088812080 items 1–3).
-
-   Re-check every one at #191's next head. Lane 2's pre-push matrix on that head (6090038382,
-   not counted here) already reports the ancestor-walk and HOME-pin cases fixed, and the missing
-   ref, the 502, the garbage body and the offline wording still different from `main`, plus a
-   residual walk match where an unrelated pin's own `submodule_path` lines up. Text, for whatever
-   remains: "Accept <the named differences> on today's layout as the price of telling the layouts
-   apart, disclosed in #191's body."
-7. **The `.specify` posture at the assembly root.** "Keep `.specify/`, the managed blocks and the
-   generated agent files local and ignored per clone, as today (`.git/info/exclude`), with only
-   `/worktrees/` in the tracked `.gitignore`." The alternatives are to ignore them in the tracked
-   `.gitignore` or to commit `.specify/` (root-guidance §8). T18 §5 item 1 adds that a
-   bootstrapped root is "dirty" to `resume`, and measures the options: land the spec leg's three
-   OpenSpec scaffold files before cutover, run the bootstrap with `--no-repo-agent-pointers` or
-   commit its block, and carry four exact-path root excludes.
-8. **Target workstations** for T006's distribution check and SC-006: "The target workstations
-   are <Eagle, …>; each needs the workBenches delivery receipt before cutover." Only Eagle has
-   evidence (root-guidance §9).
-9. **Owner acts on the new repositories** (after Gate C, but part of the plan approved there):
-   "Bind SonarCloud to `opensoft/openRepoTools-code`; protect each leg's `main` with its
-   `tests.yml` jobs required; require `composed / exact-pins` on the assembly's `main`."
-   CI:test-roots-and-ci#5 and #8 name the SonarCloud binding as an owner's act.
-10. **The post-cutover one-liner's dependencies** (5471121210 T4). Either: "Accept that after
-    cutover the curl one-liner needs api.github.com (5 calls per install) and `jq`; document it
-    beside the one-liner." Or: "Require the one-liner to install without the API, and make that
-    a T007 change before Gate C."
-
-**A Gate C approval sentence that would cover the above** (a draft for the request, with blanks):
-"Gate C for #186: I approve the in-place adoption of `opensoft/openRepoTools` as the assembly,
-executed once with openRepoShape `adopt-project.py` at <standard 40-hex>, from an isolated
-single-branch clone of `main` at <source 40-hex>, with the plan regenerated for that source
-(sha256 <…>); creating `opensoft/openRepoTools-spec` and `opensoft/openRepoTools-code`, both
-public; `git-filter-repo` 2.47.0 from the private venv (wheel `2cd04929…ad83`); the follow-ups
-<T006 assembly-0001, code-0001, spec-0001; T010's two workflows; T007's entry point; the two leg
-bumps regenerated with `bump-leg.py`> applied after source verification through leg and root
-PRs; the work dispositions in <receipt>; and a landing hold on `main` from <source> until the
-root-split PR merges or is abandoned. It does not approve lane rebinding, closing old PRs or
-retiring worktrees."
-
-*2026-10-19:* the follow-ups in that draft also include T009's `patches/t009-assembly-caps.patch`, and
-`assembly-0001` and T010's code-leg workflow patch are the re-cut and the regenerated files (lines 17 and 32), each
-owed a review before the request.
-
-## 5. Blockers to requesting Gate C, in dependency order
-
-1. **#191 to a landable head.** Push the next head; prove its red/green claims; lane 2's matrix
-   rerun and lane 3's check at that head, against 6088812080's items 1–7 and the open items of
-   lane 2's pre-push run (6090038382); correct the PR body
-   (5471121210 delta 8); `tests-macos` under `ready`; land. Then the T007 entry-point patch's T3
-   change and its re-review. Or Brett's ruling on any kept difference (question e6).
-2. **The test-root follow-ups and the T010 patches.** The follow-ups, now #195 (#193 items
-   2–7, 14 and 15, item 5's paired-layout discovery among them), reviewed at their final head
-   and landed before Gate C; `composed.yml` against #180 (finding 13 (i)).
-3. **The composed candidate at the final heads.** r2 is published with its receipt, and every
-   failure is classified (CA `16e6ea4`). Owed: a composed rerun at #191's final head with
-   T007's v3, with F1 gone and F2 (#193 item 14) decided, then the install and rollback recheck
-   at those heads (lines 34, 36, 40).
-4. **The evidence-3 PR, #196.** Fold CI (`d28e2cc`'s three new files), IN (with the host-absolute path
-   at installer-2026-10-08.md:13 removed), RR at `2e7e55e` (the branch tip's file: a cherry-pick of
-   `c1283b5` alone conflicts, 6089982753), EF `096de93`, the candidate record, T18
-   and this walk onto `main`; do not reuse `849592b`'s subject or body (6088884829); review;
-   land. *2026-10-13:* the final refold carries the installer record from `7668c51` on (host
-   path removed), slice B from `2c040d6` on (with the T011 record now taken from it), and the
-   candidate record from `e81100c` on (r3). The exact heads are in #196's "Input heads carried"
-   table.
-5. **Gate A.** Capture tooling v3 (A1, A2) and lane 2's re-verification; the owner-coordinated
-   freeze; the final capture; owner dispositions (question e5); installed-file receipts for
-   py-bench and the other workstations.
-6. **Brett's decisions:** questions a–e, e10 included.
-7. **The request.** Regenerate the plan at the frozen source and `check` it, rehearsing again if
-   question e3 says so; recheck the leg names; present the plan, follow-ups, dispositions and the
-   approval sentence above.
-
-## 6. How this walk was read
-
-Read-only except this file and scratch. `<checkout>` is lane 1's checkout of this repository and
-`<scratch>` is lane 1's private scratch.
-
-```sh
-git -C <checkout> fetch --all --prune                                  # 20:30:48Z, 21:58:55Z, 22:07:06Z
-git -C <checkout> rev-parse --short origin/<each ref in "Refs read">
-git -C <checkout> show <ref>:<path>                                    # every document cited
-git -C <checkout> diff --stat 63810dd f87fd5a -- <the planning files>  # empty
-git -C <checkout> ls-remote origin 'refs/heads/adopt/*'                # empty
-gh pr list --repo opensoft/openRepoTools --state open                  # #191 at 13cc752 only
-gh issue view 186 --repo opensoft/openRepoTools --json body,comments   # through 22:06:49Z
-gh issue view 193 --repo opensoft/openRepoTools --json body
-gh pr view {190,191,192} --repo opensoft/openRepoTools --json body,reviews,comments
-gh api repos/opensoft/openRepoTools-{spec,code}                        # 404, 404
-gh api user; gh api user/memberships/orgs/opensoft                     # brettheap; admin, active
-gh api repos/opensoft/openRepoShape/compare/7f84ca4...main             # ahead 6, behind 0
-gh api repos/opensoft/openRepoShape/commits/<each of the six>          # files changed
-gh api repos/opensoft/openRepoShape/pulls/162                          # head 6fa4e07, merge 7f84ca4
-gh api repos/opensoft/openRepoShape/commits/{6fa4e07,7f84ca4}/check-runs
-gh api repos/opensoft/openRepoTools/pulls/196/reviews                   # 5481348731 (2026-10-11)
-git -C <checkout> show 16e6ea4:specs/004-migrate-to-triad/candidate-2026-10-09.md   # CA
-git -C <checkout> show 40f26f7:<each of slice B's three records>                     # EF
-git clone -q --no-local --single-branch --branch main <checkout> <scratch>/main-clone
-command -v openspec; which -a openspec; <each> --version               # 1.2.0 first, 1.6.0 second
-(cd <scratch>/main-clone && ~/.npm-global/bin/openspec validate migrate-to-triad --strict)  # exit 1
-(cd <scratch>/main-clone && <system openspec> validate migrate-to-triad --strict)          # exit 0
-# the proposed text and the one-line join, each in a scratch copy: both CLIs exit 0
-git grep -n -i -E 'account[ -]?move' <each ref> -- .
-git grep -n -i account origin/main -- specs/004-migrate-to-triad openspec/changes/migrate-to-triad
-```
diff --git a/specs/004-migrate-to-triad/installer-2026-10-08.md b/specs/004-migrate-to-triad/installer-2026-10-08.md
deleted file mode 100644
index ea63cf29..00000000
--- a/specs/004-migrate-to-triad/installer-2026-10-08.md
+++ /dev/null
@@ -1,243 +0,0 @@
-# Installer payload source and the assembly entry point: October 8–9, 2026
-
-**Task:** T007 and T008 of [tasks.md](tasks.md), under [#186](https://github.com/opensoft/openRepoTools/issues/186). Neither task is checked complete by this record.
-
-**Code:** [#191](https://github.com/opensoft/openRepoTools/pull/191), branch `feat/installer-payload-source-resolution` (head `8246983`, based on `c4864ac` with main `f87fd5a` merged in as `45979a4`).
-
-**Landed:** #191 landed on main as `a74c7fc` on 2026-10-13, the squash of `8246983`.
-
-**Assembly entry point:** [patches/t007-assembly-entry-point.patch](patches/t007-assembly-entry-point.patch). It cannot land on `main` before the split, because its path is the implementation's.
-
-**Writer:** lane openRepoTools-1.
-
-## The rehearsed arrangement relied on
-
-Run C (its `rehearsal/README.txt` in the private prep area's `work-20261008/`), cloned out of it read-only:
-
-| Repository | Commit |
-| --- | --- |
-| Source (`main` when cloned) | `837928a1029ac53b050a9bdcbc0ef4055b10719b` |
-| Assembly split (`adopt/three-repo-shape`) | `69b89245029d0339afd3317df7c9b1b3bbaf7fc1` |
-| Spec leg | `593250d600ca291f610671d993c2a6fc36cd690e` |
-| Code leg | `73b04d637634f897ad24e22ee4c12bed287172d6` |
-| Code's nested openRepoShape | `7f84ca42ca86a8902928345109d2bf6bad87bd91` |
-
-Clone commands:
-
-```sh
-git -c protocol.file.allow=always clone -b adopt/three-repo-shape <rehearsal>/source <clone>
-git -C <clone> -c protocol.file.allow=always \
-  -c url.<rehearsal>/mirror/openRepoShape.git.insteadOf=https://github.com/opensoft/openRepoShape.git \
-  submodule update --init --recursive
-```
-
-The brief named run B (split `2726d3a`, code `6d52162`, spec `558a12b`). The 2026-10-08 bench restart wiped it from `/tmp`. Before run C existed, this writer rebuilt run B in its own scratch to see whether it reproduces. The rebuild used the same tool (`adopt-project.py` at `7f84ca4`), the same published plan (`004-migrate-to-triad-rehearsal` at `36c0324`), the same source (`e43b243`), local bare remotes, and refusing `gh`/`curl` shims (zero calls).
-
-- `execute` exited 0 with the same 45/49/6/0 accounting and 18 added paths.
-- Spec reproduced as `558a12b` and code as `6d52162`, byte for byte.
-- The split (`fea6ad8`) differed from `2726d3a` only in its commit time and in three files that embed local paths: `.gitmodules`, `shape/README.md` and `shape/AGENTS.md`.
-
-Run C, which the coordinator made the arrangement of record, superseded it.
-
-### The pin grammar validated
-
-This is `contracts/code-pin.yaml` as run C's adopter writes it. It is read with `read` and `case`; there is no YAML runtime.
-
-| Field | Required value |
-| --- | --- |
-| `schema_version` | `1` |
-| `kind` | `pinned_contract_manifest` |
-| `leg_role` | `code` |
-| `source_repository` | an owner/name slug; never inferred by appending `-code` |
-| `submodule_path` | one path segment |
-| `commit` | 40 lowercase hex |
-| `revision_kind` | `commit` |
-| `digest_algorithm` | `sha256` |
-| `digest_definition` | `sorted-ls-tree-r-v1` |
-| `digests.tree_sha256` | 64 lowercase hex |
-| `verify_pin`, `resync_runbook` | present |
-
-Each key that is read must appear once. The file must be LF-only, quotes must close, and backslashes are refused.
-
-## T007: the assembly entry point
-
-- Commit `6acc147f751e5a2ca57b4814395769b7b75b339e` sits on `69b8924` in the writer's clone, on branch `t007-assembly-entry-point-v3`.
-  - Tree: `87782af2ff3075284682f02fa41763d5df7112ff`.
-  - `openRepoTools`: blob `ff432c6dc189ce272e778a89e375076094737b48`, mode 100755, sha256 `8248224d3bb425f69a944a41cdfe0a68f0b449d13978f67c76b6bc5a0a73a773`.
-  - The patch file's sha256 is `67d8e7ce8b0f7008d2151a44c0eabaf74cda7cd2697c6e09ee7da0c341c671b5`.
-  - `git am` of the patch on a fresh clone of run C's split reproduces tree `87782af` exactly.
-  - History:
-    - v1, `a02a45c` (tree `a9fa46e`): the first version.
-    - v2, `8ed83b7` (tree `79db0a4`): `recorded_gitlink` reads the gitlink with `read` instead of `awk` (see the runs below).
-    - v3, this commit: on the remote path, the gitlink is checked against the pin BEFORE any implementation is fetched or run. That is the change T3 of lane 3's review of v2 required (#191 review 5471121210): a pin its gitlink disagrees with now refuses, naming both commits, with no request to the code repository (measured by lane 3 in 5481368376, finding 1).
-    - **What v3 does not close** is T3's second case, a pin and gitlink that agree on code from before #191 (a rollback, or run C's own `73b04d6`). It passes the check, and the root then runs that older installer, which reads the assembly root as a single repository. On a real root that is a refusal in that installer's words, with nothing placed and the cause unnamed. With decoy files at the root (synthetic) it installs them (lane 2's item 7; lane 3's 5481368376, finding 2). This is recorded as a T015 item below, and a capability check is proposed for #193.
-- **In a checkout,** it requires the pin (strict grammar), the gitlink (index first, then HEAD) and `code/openRepoTools`'s raw bytes (`hash-object --no-filters`) to name one commit. Then it `exec`s `code/openRepoTools` with every argument. That is the same process, so the exit status, signals and the implementation's own temporary-file cleanup are the implementation's. There are no temporaries of its own.
-- **Anywhere else** (stdin, or a copy of the file on its own), it does five things:
-  - it resolves `OPENREPOTOOLS_REF` once, `gh` first and `curl` second;
-  - it reads `contracts/code-pin.yaml` at that commit;
-  - it reads the gitlink at the pin's `submodule_path` in that commit (one level of the tree, by `gh api --jq`, or by `curl` and `jq`). It refuses, naming both commits and with "nothing ran", unless the gitlink is the pinned commit;
-  - it fetches `openRepoTools` from the pin's `source_repository` at the pinned commit (the file must begin `#!`);
-  - it runs it from stdin, as the one-liners always ran it, with `OPENREPOTOOLS_REF` set to the resolved commit, so the implementation reads the same pin and checks it again.
-- **It has no installer mechanics.** It does no placement, receipt, merge or retirement.
-- **It assumes nothing the legs may not carry.** That covers `.gitattributes`, README, AGENTS and LICENSE (T006 §10.2).
-- **It is bash 3.2-clean.** Arguments are forwarded as `${1+"$@"}`, because a bare `"$@"` under `set -u` is unbound in 3.2.
-- **Its pin reader is a deliberate copy** of the implementation's (10 definitions: three character constants, the six pin-reader functions and `recorded_gitlink`). `test_r15_composed_the_root_entry_points_pin_reader_is_the_implementations` fails when the two differ.
-
-**Rehearsal-only pin moves (not part of the patch).**
-
-- Openrepotools' PR #191 was applied to code `73b04d6` in a clone. It was pushed only to the writer's own bare copy of the code remote, never to run C.
-- The standard's `scripts/bump-leg.py` (tool `7f84ca4`, with `--local-remote-dir` pointing at that copy) made the lockstep commits. Its validators printed `pins ok` and `manifest ok` and recomputed both digests:
-  - on `t007-assembly-entry-point`, `9321107` moved the code pin to `ecb4ef3` (PR at `e406e0e`), and `58e3ac5` moved it to `d12345b` (PR at `ecd7aa4`);
-  - on `t007-assembly-entry-point-v2`, `7bbd60b` moved it to `ea17f30` (PR at `2411f40`), then `e5a901e` and `316aed6` to the round-1 heads;
-  - on `t007-assembly-entry-point-v3`, `4c6a0b7` moved it to `fa460f2`. That commit is the whole code leg as the PR head `6568f08` has it, merged with main `f87fd5a`. It includes #190's test roots, and every one of the leg's paths is the PR head's blob. `4b8b05a` then moved the pin to `3fc1e95`, the code leg at the final head `8246983`.
-- Each bump printed bump-leg's `NEXT … push -u origin …` line. It was deliberately not followed.
-- The clone's push URL is disabled.
-
-### The one-liner contract
-
-| Command line | What it resolves |
-| --- | --- |
-| `curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/openRepoTools \| bash -s -- --install` (README:228; openRepoShape's `--install` pointer, openRepoShape:280 at `7f84ca4`, byte for byte) | 1. The root entry point at `main`.<br>2. `main` resolved once to assembly commit *A*.<br>3. `contracts/code-pin.yaml` at *A*.<br>4. The gitlink at `submodule_path` in *A* must be `commit`, or nothing runs.<br>5. `openRepoTools` from `source_repository` at `commit`.<br>6. That implementation, with `OPENREPOTOOLS_REF=A`, resolves *A* (a commit, which cannot move), lists *A*'s tree, re-reads and re-checks the pin, checks the gitlink, confirms the commit exists in `source_repository`, fetches the 23 payload files from there, and places 29 files and 2 hook entries. |
-| `gh api repos/opensoft/openRepoTools/contents/openRepoTools -H 'Accept: application/vnd.github.raw' \| bash -s -- --install` (README:236–237) | The same, through `gh`. |
-| `./openRepoTools --install` in an assembly checkout | Checks that pin, gitlink and implementation bytes agree, then `exec`s `code/openRepoTools`. The implementation checks every payload file against the pinned commit and copies offline. |
-| `openRepoTools --install`, installed in `~/.local/bin` | The implementation alone. Its default `REPO` is the assembly, which it resolves itself. It never needs the root file or a checkout again. |
-
-With run C's identities, *A* = `69b8924` and the pin names `opensoft/openRepoTools-code` at `73b04d6`. `73b04d6` predates T007, so the real cutover must pin a code commit that carries this change. That is T015's to verify at the assembled head.
-
-Transcript of row 3 in the writer's clone (assembly `7bbd60b`, code pin `ea17f30`), into a throwaway `HOME` with `gh`/`curl` shims that log and refuse:
-
-- exit 0, and **0 network calls**;
-- first line: `openRepoTools: source: the code mounted at <clone>/code, opensoft/openRepoTools-code at ea17f302310fa75fdf61ad7199912a74971513bd as <clone> pins it; every payload file was checked against that commit and nothing fetched`;
-- 29 `installed at` lines and 29 receipt rows;
-- the installed `openRepoTools` is byte-identical to `code/openRepoTools`, the implementation and not the root file;
-- `--version` prints `openRepoTools (opensoft/openRepoTools @ main)`;
-- `./openRepoTools nope` exits 2.
-
-**Against T006's README sentence** (root-guidance-2026-10-08.md §10.9: "the `openRepoTools` they fetch is this root's entry point, which hands over to the installer `code/openRepoTools` at the commit this root pins"), the contract matches, with two precisions:
-
-1. Remotely, the implementation is fetched from the pin's `source_repository` at the pinned commit, which is the repository `code/` mounts.
-2. In a one-liner run, `--version` prints the resolved commit rather than `main`, because the handover freezes `OPENREPOTOOLS_REF`.
-
-## T008: the compatibility matrix
-
-The tests are `tests/test_install_payload_source.py` at #191's final head `8246983`, which is main `a74c7fc`: 52 tests, 109 cases. Every `def test_` line in that file is in the table below, and no name outside it is. The fixtures build their own GitHub out of bare repositories, answered by one fake for `gh api`, `gh repo` and `curl` that runs `git` and logs every request. There is no real `gh` or `curl` on `PATH`, and every `$HOME` is temporary.
-
-`tests/test_openrepotools_command.py` gains no test. Its fake `gh` answers the one layout question (`contracts/code-pin.yaml`) with GitHub's 404, and 4 of its 63 tests run the single-repository fetch path through that fake: `test_install_places_all_nine_or_none`, `test_a_withheld_command_file_places_nothing_either`, `test_install_from_stdin_fetches_itself_into_a_live_workdir` and `test_a_fetching_install_follows_the_ref_it_was_given`. No assertion of theirs changed.
-
-**Base column:** `8246983`'s module was run against `c4864ac`'s installer, under the lock, on 2026-10-11: **27 passed, 73 failed, 9 skipped** (the composed cases). Every pass is a case that must behave exactly as base does (today's single repository, or a tree that is not this assembly's), or a static check. **The `8246983` column:** CI run 38097860219 (`tests`: 1419 passed, 9 skipped, the 9 being the composed cases). The composed tests passed in the strict composed runs recorded below.
-
-| # | Row | Tests at `8246983` (cases) | Base `c4864ac`, per test | `8246983` |
-| --- | --- | --- | --- | --- |
-| 1 | Raw/gh one-liners | `test_r01_the_one_liner_against_a_single_repository_installs_as_before`; `test_r01_the_one_liner_against_an_adopted_assembly_installs_the_pinned_code` (2); `test_r01_a_single_repository_by_curl_never_needs_api_github_com` (2); `test_r01_a_single_repository_without_jq_fetches_then_names_jq_as_it_always_did`; `test_r01_a_single_repository_by_gh_asks_for_files_and_nothing_else`; `test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point` (2); `test_r01_composed_the_root_entry_point_delegates_locally`; `test_r01_composed_a_signal_reaches_the_implementation_and_its_temporaries_go` | pass; 2 red; 2 pass; pass; pass; skip (composed); skip (composed); skip (composed) | pass; composed tests pass composed |
-| 2 | Offline local single / adopted checkout | `test_r02_a_complete_single_repository_tree_installs_offline_byte_for_byte`; `test_r02_a_complete_tree_inside_another_projects_assembly_installs_as_before` (2); `test_r02_an_adopted_checkout_installs_its_pinned_code_offline`; `test_r02_an_adopted_checkout_whose_pin_comments_its_path_is_still_its_assembly` | pass; 2 pass; red; red | pass |
-| 3 | Explicit local code feature | `test_r03_an_explicit_code_feature_checkout_installs_its_own_bytes_and_names_them`; `test_r03_an_incomplete_code_feature_checkout_is_refused_not_completed_from_elsewhere` | red; red | pass |
-| 4 | Installed reinstall / skill-only | `test_r04_an_installed_copy_reinstalls_from_the_adopted_source_without_any_checkout`; `test_r04_an_installed_copy_on_a_single_repository_keeps_the_sibling_rule` | red; pass | pass |
-| 5 | Override / adopted fork | `test_r05_a_single_repository_fork_named_by_the_override_installs_as_before`; `test_r05_an_adopted_fork_follows_its_own_pin_not_a_guessed_code_name` | pass; red | pass |
-| 6 | Branch, tag, commit, slash refs | `test_r06_every_ref_form_is_resolved_once_and_every_payload_names_one_commit` (4); `test_r06_a_single_repository_reads_every_ref_form_as_it_always_did` (4) | 4 red; 4 pass | pass |
-| 7 | Branch moves between downloads | `test_r07_a_branch_that_moves_between_downloads_never_mixes_versions`; `test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit` (2) | red; 2 red | pass |
-| 8 | Missing pin (single) / partial or wrong pin | `test_r08_a_single_repository_without_a_code_pin_is_permitted`; `test_r08_an_assembly_root_without_its_code_pin_refuses_as_a_single_repository_would`; `test_r08_composed_the_root_entry_point_refuses_a_pin_its_gitlink_disagrees_with` (2); `test_r08_a_malformed_code_pin_is_refused_never_read_as_a_single_repository` (19); `test_r08_a_pin_the_gitlink_disagrees_with_is_refused`; `test_r08_a_pin_naming_a_commit_its_repository_lacks_is_refused` | pass; pass; skip (composed); 19 red; red; red | pass; composed tests pass composed |
-| 9 | API answer missing/malformed, auth, transport | `test_r09_an_api_failure_is_a_refusal_never_a_fallback_to_a_single_repository` (24); `test_r09_a_pin_the_listing_shows_but_that_will_not_come_back_is_refused_saying_what_answered` | 24 red; red | pass |
-| 10 | Changed gitlink / payload, incomplete local set | `test_r10_a_local_gitlink_that_disagrees_with_the_pin_is_refused_before_staging`; `test_r10_a_changed_local_payload_is_refused_before_staging`; `test_r10_an_incomplete_local_adopted_payload_is_refused_without_a_fetch` | red; red; red | pass |
-| 11 | Missing command/skill/alias, failed merge | `test_r11_a_payload_file_missing_from_the_pinned_code_changes_nothing` (3); `test_r11_a_single_repository_missing_a_file_refuses_in_the_words_it_always_did` (2); `test_r11_a_single_repository_at_a_ref_it_lacks_refuses_in_the_words_it_always_did` (2); `test_r11_a_settings_merge_that_cannot_be_computed_changes_nothing` | 3 red; 2 pass; 2 pass; red | pass |
-| 12 | Modes, receipts, targets, foreign files, hooks | `test_r12_an_adopted_install_keeps_modes_receipts_targets_and_what_is_not_ours` | red | pass |
-| 13 | WIP init / template lookup | `test_r13_wip_init_takes_the_standard_from_codes_dependency_pin_not_the_assemblys`; `test_r13_an_installed_wip_init_whose_source_does_not_answer_seeds_from_main_as_before`; `test_r13_an_installed_wip_init_at_a_ref_the_source_lacks_seeds_from_main_as_before`; `test_r13_an_installed_wip_init_never_needs_a_single_repositorys_commit_lookup`; `test_r13_an_installed_wip_init_on_a_single_repository_reads_its_pin_as_before`; `test_r13_an_adopted_source_wip_init_cannot_follow_refuses_in_step_7s_words` | red; pass; pass; pass; pass; red | pass |
-| 14 | Missing nested dependency | `test_r14_with_no_nested_standard_anywhere_the_dependency_pin_alone_selects`; `test_r14_the_documented_upstream_skip_is_unchanged`; `test_r14_composed_acceptance_requires_the_nested_dependency` | red; pass; skip (composed) | pass; composed tests pass composed |
-| 15 | bash 3.2, Windows/WSL | `test_r15_the_installer_uses_nothing_bash_3_2_lacks`; `test_r15_the_three_lists_stay_one_line_arrays_a_consumer_parses`; `test_r15_the_adopted_path_holds_under_macos_one_true_awk`; `test_r15_composed_the_root_entry_points_pin_reader_is_the_implementations`; `test_r15_composed_the_root_entry_point_parses_and_uses_nothing_bash_3_2_lacks` | pass; pass; red; skip (composed); skip (composed) | pass; composed tests pass composed |
-
-The module is `WINDOWS_SKIP`, like every bash-driven test here. The composed tests skip in standalone code, and under `OPENREPOTOOLS_COMPOSED=1` (T009's convention) they fail instead.
-
-### Runs
-
-Locked runs used `tests/run.sh`'s own invocation under its lock. That is the coordinator's deviation for a census that never reaches zero. They ran with `PATH=/usr/bin:$PATH`, because this profile's `~/bin/python3` is a venv without pytest. Runs marked "unlocked" are scoped proofs of about two minutes, run under the coordinator's rule of 2026-10-09, with HOME, TMPDIR, `--basetemp` and `PYTHONPYCACHEPREFIX` all in the writer's scratch.
-
-| Run | Code | Selection | Result |
-| --- | --- | --- | --- |
-| Red at base, 2026-10-08T21:04–21:10Z | `6337a52` (installer `c4864ac`) | the module | **75 failed, 8 passed, 6 skipped**. The 8 are the single-repository preservation tests, two static checks and the documented-skip check; every red was checked against its first failing assertion. |
-| Green | `e406e0e` | module + `openrepotools_command`, `install_skill_and_hook`, `install_by_rename`, `wip_init` | **318 passed, 7 skipped** (the composed cases) |
-| CI on `e406e0e` | | | `test_the_installer_reaches_only_this_repository` failed. Every fetching line must name `$REPO`; the helpers took the repository as an argument. Fixed in `ecd7aa4` (one current source, `${PAYLOAD_REPO:-$REPO}`), with no behaviour change. |
-| Green with hygiene | `ecd7aa4` | the above + `repo_hygiene`, `upstream_pin` | **479 passed, 5 failed, 7 skipped**. All 5 are `test_wip_init_and_the_lane_helpers_read_one_pointer_file_the_same_way` cases whose failing assertion is the exit status of `lanes-edit.sh`, which is unchanged from base, as are its test and conftest. They passed in the green run above. This session inherits `LANES_WORKSPACE_ROOT` and other `LANES_*` binding variables, and with those unset 3 still fail on workstation state. CI's clean runner is the record. |
-| Composed, strict | entry point `a02a45c` + code `ecb4ef3` | the module | **90 passed, 0 skipped** |
-| Composed, strict, 2026-10-09T00:47–01:01Z | entry point `a02a45c` + code `d12345b` (= `ecd7aa4`) | module + install suites + `repo_hygiene` | **395 passed, 19 failed**. 17 `repo_hygiene` checks and `test_the_help_and_the_readme_say_the_mode_the_receipt_is_born_at` are T006 §10.6's front-door findings (T009's): they read root documents the code leg does not carry. The 19th was this change's. `test_without_jq_it_refuses_and_places_nothing` saw exit 2 but `line 734: awk: command not found` instead of "needs `jq`": the mounted-leg path read the gitlink with `awk`, which the test's minimal `PATH` lacks. Fixed in `2411f40` and in the entry point (`8ed83b7`) by reading it with `read`. |
-| Green with the `read` fix, 2026-10-09T01:05–01:20Z | `2411f40` | as "Green with hygiene" | **479 passed, 5 failed, 7 skipped**: the same five `lanes-edit.sh` cases, nothing else. |
-| Composed, strict | entry point `8ed83b7` + code `ea17f30` (= `2411f40`) | module + install suites + `repo_hygiene` | Not completed. The 2026-10-09T01:3xZ account swap stopped it, and `6568f08`'s run below superseded it. |
-| CI on `ecd7aa4` | | | All jobs green (run 37866464029). |
-| CI on `2411f40` | | | All jobs green (run 37869321635). `tests-macos` skipped (no `ready`). |
-| Review of #191 at `2411f40` | | | DO NOT LAND (lane 1's reviewer, 5465121368; lane 3's 5464963807 reached the same verdict on F1). F1: on today's layout, the curl path needed api.github.com and `jq`. F2: an installed `wip init` refused at step 7 where base fell back to `main`. |
-| F1/F2 fix | `13cc752` | module | 90 passed, 7 skipped. CI on `13cc752`: green. Lane 3's delta review: LAND (5471121210), with the stale body (delta 8) and the `ready` macOS run as conditions. |
-| Round 2 | `fdc5f18`, `6fa3b43`, `6568f08` | | Dropped the `project.yaml` probe; bounded the assembly search (delta 4); the adopted pin refusal now says what answered (delta 6); r14 reads conftest's text (the `KeyError 'reason'` under #190's composed mode); a composed test for the root's gitlink check; merged main `f87fd5a`. |
-| Module, under the lock | `fdc5f18` content | `-k payload_source` | **96 passed, 7 skipped** |
-| New and changed tests × four installers, unlocked | `c4864ac` / `2411f40` / `13cc752` / `fdc5f18` | the 20 new and changed tests | **19 pass + 1 fail** (the adopted step-7 words, which are new behaviour) / **20 fail** / **16 pass + 4 fail** (the `project.yaml` request, the parent walk ×2, the partial refusal) / **20 pass** |
-| Delta 6 and r14, unlocked | `6fa3b43` | what-answered, documented skip, malformed pins, gitlink pins | **23 passed** |
-| Composed root gitlink test, strict, unlocked | root v2 `8ed83b7` / v3 `6acc147`, with code `fa460f2` | the module's composed tests | v2: the new test fails ×2. v3: **9 passed**. |
-| Broader suites, under the lock | `6568f08` | `payload_source`, `openrepotools_command`, `wip_init`, `install_skill_and_hook`, `install_by_rename`, `repo_hygiene`, `upstream_pin`, `test_roots` | **516 passed, 9 skipped, 5 failed**. The 5 are the `lanes-edit.sh who` exit-8 cases on this workstation's lane state. That file and its test are outside the diff, and CI runs them green. |
-| Composed, strict, under the lock, 2026-10-09T22:08–23:18Z | assembly `4c6a0b7` = root v3 `6acc147` + code `fa460f2` (this head's whole code leg) | module + install suites + `repo_hygiene` + `openrepotools_command` | **429 passed, 1 failed**. The failure is `test_the_root_carries_the_line_ending_rule`, which needs `.gitattributes` in the code leg; run C's legs carry none (T006 §10.2). After #190's roots, the 17 earlier front-door failures read the assembly root and pass. |
-| CI on `6568f08` | | | Run 37997688693: `tests` 1416 passed, 9 skipped. `tests-no-submodule`: 1196 passed, 229 skipped. `tests-windows`: 177 passed. `guard-launch-mode`: 165 passed. `parse-macos`, SonarCloud and Sourcery: pass. `tests-macos` waits on `ready`. |
-| Copilot round 1, on `6568f08` | `cddd1f7` | | Three findings. Fixed: a copy-time race on the mounted-leg path (the checked snapshot is what is installed), and a commented `submodule_path` that `pin_mounts` missed (its new test fails at `6568f08` and passes at `cddd1f7`, scoped and unlocked). Kept: the index-then-HEAD gitlink fallback, which is openRepoShape's `recorded_gitlink` contract. Local rows r02/r03/r10/r15, scoped and unlocked: **13 passed, 2 skipped**. |
-| CI on `cddd1f7` | | | Run 38096352239: `tests` 1417 passed, 9 skipped. `tests-no-submodule`: 1197 passed, 229 skipped. `tests-windows`, `guard-launch-mode` and `parse-macos`: pass. `tests-macos` skipped (no `ready`). |
-| Copilot round 2, on `cddd1f7` | `8246983` | | One finding: the PR body overclaimed a refusal for a ref that moves between the probe and the resolution. The body is corrected, and a test (moved right after the probe: adopted → installed whole at the second commit; single → refused) passes, together with row 7, scoped and unlocked: **3 passed**. The cap is reached. |
-| Composed, strict, unlocked | assembly `4b8b05a` = root v3 + code `3fc1e95` (= `8246983`) | the module's composed tests + r02, r03, r07, r10 | **22 passed** |
-| CI on `8246983` | | | Run 38097860219: `tests` 1419 passed, 9 skipped. `tests-no-submodule`: 1199 passed, 229 skipped. `tests-windows`: 177 passed. `guard-launch-mode`: 165 passed. `parse-macos`, SonarCloud and Sourcery: pass. `tests-macos` ran on the `ready` label (run 38155833862). Lane 3's delta check: LAND (5481368124). |
-| Base column, under the lock, 2026-10-11 | module at `8246983`, installer `c4864ac` | `-k payload_source` | **27 passed, 73 failed, 9 skipped** (the composed cases). This is the T008 table's base column. |
-| Landed | `a74c7fc` | | #191 landed on main as `a74c7fc` on 2026-10-13, the squash of `8246983`. |
-
-## Lane 2's installer rows
-
-These are the 15 rows of "The installer's own assumptions" in `consumer-reads-2026-10-07.md`.
-
-| Row (`openRepoTools` at `c4864ac`) | Disposition |
-| --- | --- |
-| `:6-11`, README one-liners | Covered: the entry point patch and the composed one-liner tests. |
-| `:70-72` `REPO`/`REF`/`SELF` | Covered: the meanings are unchanged; the adopted source is resolved through the pin. |
-| `:258-275` `fetch_from_repo` | Covered: it reads the resolved source, still `gh` first. |
-| `:282-285, 338, 962-990` `INSTALLABLES`/`collect_commands` | Covered: the names sit at the code root, and the three arrays stay one line (`test_r15_…one_line_arrays…`, the W4 constraint). |
-| `:1290-1398` `collect_skills` from `~/.local/bin` | Covered: rows 4 and 11. |
-| `:2502-2517` `wip_shape_ref` | Covered: rows 13 and 14. For a single repository the pin is read at `$REF` as before. For an adopted assembly it is the pinned code's pin. `main` is the fallback, as on main, for a source that carries no pin, a source that does not answer, and a ref the source lacks (#191's F2 fix: `test_r13_an_installed_wip_init_whose_source_does_not_answer_…`, `…_at_a_ref_the_source_lacks_…`, `…_never_needs_a_single_repositorys_commit_lookup`). An adopted source that cannot be followed refuses at step 7, in step 7's words (`test_r13_an_adopted_source_wip_init_cannot_follow_refuses_in_step_7s_words`). |
-| `:2519-2523` `wip_fetch_template_file` | Unchanged. Row 13 shows the template comes from the standard the code pins. |
-| `:1218-1222` `venv_note` names `docs/README-lanes.md` | **Not changed.** It is a comment this PR does not touch, and it names a spec-leg path after the split. Listed for T014's reconciliation (also T006 §10.9). |
-| `:28-56, 393-396` counts vs design `:61-64` | Recorded: 17 commands, 23 payload files, 29 placed files, 31 artifacts on this layout, derived from the lists. The design's 15/27/29 are `daed209`'s. |
-| Paths unmapped against `daed209` | Not this task's (plan regeneration, T003/T012). Run C's accounting covers all 120 entries. |
-| `repos.tsv` leg aliases | Not this task's (lane 3; waits for real legs). |
-| `:1320, 1352, 2211` hooks, `workspace.yaml` | Unchanged. |
-| `lane-worktrees`/`lanes-edit.sh` lane roots | Not this task's (lane 3, I4). |
-| `:291-292, 298-300, 322` consumer comments | Unchanged. |
-| `.gitmodules`, `upstream/`, `contracts/openreposhape-pin.yaml` | Covered: the dependency unit is code's, and `wip init` reads code's pin. |
-
-workBenches-side: the sentinel REPO/REF partial row is covered (`test_r02_…byte_for_byte`), and so is W4 (one-line arrays). W1, W3 and W8 (re-vendoring from `openRepoTools-code`) are workBenches follow-ups that wait for real legs; nothing here changes workBenches.
-
-## Lane 2's open items on #191 (#186 comment 6090038382)
-
-Lane 2's matrix ran on `6568f08` with v3, and lane 2 re-ran it on each later head:
-
-- at `cddd1f7`, of 341 rows only the new row 25 changed, and it is fixed (#186 comment 6103618033);
-- at `8246983`, 0 of 341 verdicts differ from `cddd1f7` (lane 2's register note of 2026-10-13T18:22:15Z, `lanes/log/openRepoTools-2.md` in brett-wip). The installer is the same blob at both heads, `7aa697c`, and at `a74c7fc`.
-
-So each item below holds at the final head as measured. Each is fixed, accepted (with the reason), or given to another task:
-
-| Item | Disposition |
-| --- | --- |
-| 1. The walk residue: an unrelated pin whose `submodule_path` names this directory (lane 2's rows 24a–c, re-measured by lane 3 at `cddd1f7` in #191 review 5481368124, finding 5). Main installs in all three. | **Accepted residual (low), proposed for #193.** `fdc5f18` limited the walk to the two layouts the design names, and the pin must name this directory, but the walk takes that name match as identity. The code then reads the gitlink at that name, and where none is recorded it refuses instead of taking the plain-tree path main takes (`openRepoTools:894-897` at `8246983`). 24a, a complete tree at `outer/product` under `outer/contracts/code-pin.yaml` with `submodule_path: product`, exits 2 with "…/outer records no gitlink at product". 24c, an installed copy in `$H/bin` under a `$H` pin with `submodule_path: bin`, refuses to reinstall with "… records no gitlink at bin" after 0 requests. 24b, at `outer/worktrees/001-x/product`, installs with one extra line, "NOT the code … pins". Lane 3's cheaper tightening uses that same gitlink read: take the parent as the mount only when it records a gitlink at that name, and otherwise fall through to the plain-tree path (5481368124, finding 5). That would close 24a and 24c. #193 item 21 proposes the stricter identity match (the checkout's `origin` is the pin's `source_repository`, or its HEAD is the pinned commit). Unreachable today: no ancestor of a checkout or of `~/.local/bin` carries `contracts/` (lane 3, #191 review 5471121210, delta 4, and 5481368124, finding 5). #191's body sentence "A pin anywhere else above the file is another project's and is not read" is true except for this name match (5481368124, finding 7). |
-| 2. A missing ref or repository is read as a single repository and refused in main's words, without naming the ref. | **Accepted, by the byte-for-byte rule.** These are main's words for the same request (`test_r11_a_single_repository_at_a_ref_it_lacks_refuses_in_the_words_it_always_did[gh, curl]`). That test is single-layout only. In lane 2's rows, an adopted assembly at a missing ref (19c, 19d, 19h) and a missing repository (19e, 19f) end the same way, in main's words, with one request more than main (35 against 34; 18 against 17 with curl only). |
-| 3. A 502 on `contracts/code-pin.yaml` refuses where main installs. | **Accepted and disclosed.** It is the one extra request on today's layout. An unanswered layout question is a refusal, never a reading of the older layout (the design's "no silent legacy fallback"). #191's body says so. |
-| 4. Garbage or an empty body at 200 on `code-pin.yaml` refuses where main installs, saying "the ref moved between the two reads" (lane 2's rows: 8 of 8 exit 2, with nothing placed and 0 payload requests). | **A refusal where main installs, like item 3: accepted, and disclosed here; clearer words proposed for #193 (item 20).** On today's layout, `probe_path` takes any `gh` success or curl 200 as a pin (`openRepoTools:656-658`, `:668` at `8246983`). The listing at the resolved commit then shows no pin, and the run refuses at `:761-764`. Main never asks for that file, so it installs. As for item 3, an answer that is not GitHub's 404 is never read as the older layout. #191's body does not disclose this case. It says that "anything but a 404 (offline, 5xx, 401/403, a portal)" refuses "naming what answered", and that the one new refusal on this layout is a layout question with no answer at all. A 200 that is not GitHub's, a portal's page among them, is an answer: it refuses, names nothing that answered, and blames a moved ref. The proposed words name both readings (the ref moved, or the first answer was not GitHub's). They keep "the ref moved", which `test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit[single]` asserts. |
-| 5. The offline reinstall from an installed copy refuses in different words from main's. | **Accepted and disclosed** in #191's body, under its one new refusal on today's layout, a layout question with no answer at all (lane 3's delta 3). Base refused there too. |
-| 6. A missing pin on the adopted path is read as a single repository, so decoys at the root (synthetic) install. | **Accepted, by structure.** Asking `project.yaml` on the 404 would add a second request to today's layout. An adopter writes the pin and the manifest in one commit, and `make validate` refuses one without the other. A real assembly root carries no payload, so it refuses in main's words (`test_r08_an_assembly_root_without_its_code_pin_refuses_as_a_single_repository_would`). For T015: confirm that the real assembled root carries no payload file. |
-| 7. v3 with pin = gitlink at code before #191. | **T015 item** (see T007 above). The cutover must pin a code commit that carries #191, and T015 checks it at the assembled head. Proposed for #193: the root refuses an implementation that lacks the adopted resolver (a declared marker, or `payload_resolve_remote()`), naming the pin as older than T007. The patch's header comment ("a stale or rolled-back pin is named as what it is") and its commit message ("not left to whichever code a stale pin selects") overstate: a rolled-back pin that agrees with its gitlink is not named. The patch stays as it is, because this residual is a named T015 item (lane 3, 5481368376). |
-| 8. The adopted one-liner needs `jq` at the entry point on the curl path. | **T014** (the network-needs sentence below). |
-| 9. Row 7, single: a branch that moves mid-install still mixes versions, as on main (lane 2's row 7 single: a failure, with 5 + 24 files placed). | **Accepted, by the byte-for-byte rule.** Freezing the ref needs api.github.com, which today's layout never needed. Row 7's tests are about an adopted ref. `test_r07_a_branch_that_moves_between_downloads_never_mixes_versions` is adopted only. In `test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit`, the `[adopted]` case moves to another adopted commit and installs it whole. The `[single]` case moves an adopted ref to a commit with no pin, which is refused as "the ref moved". Neither is a single repository moving, and no test freezes one. |
-
-## For other tasks
-
-- **T009:** `test_the_installer_reaches_only_this_repository` holds because every fetching line names `$REPO`. Its docstring should say that the one other repository reached is the one `$REPO`'s own validated pin names. The composed hygiene results above are T006 §10.6's front-door findings.
-- **T010:** a composed run whose code leg is checked out at a commit other than its pin will see `--install` from the mounted leg refuse (changed payload). Run install tests from the pinned state or from a standalone copy.
-- **T014:**
-  - `venv_note`'s `docs/README-lanes.md` comment.
-  - The README's one-liners need a sentence on network needs after the cutover, next to the one-liner (lane 3's T4 on the v2 patch). Today's single repository needs raw.githubusercontent.com only, or `gh`. After the cutover, the curl one-liner needs api.github.com and `jq`. By reading v3 and the PR head, that is 6 api.github.com requests per install: the root makes 2 (`commits`, `git/trees`), and the implementation makes 4 (`commits`, two `git/trees`, the pinned commit). Lane 3 measured 5 on v2, which had no root tree read. So a gh-less machine that is rate-limited (60 an hour per address, unauthenticated) cannot install.
-- **T015:**
-  - Validate at the real assembled head, with a code pin that carries this change, against the real GitHub. That includes the one-liners, `bump-leg.py`'s lockstep, and the 3.2 parse of the root entry point (`parse-macos` covers the implementation only).
-  - **Named item, the pre-T007 pin:** confirm that the pinned code carries #191 before the cutover. v3 does not refuse a lockstep-consistent pin at older code (lane 2's item 7).
-  - **Named item, a root with no payload:** confirm that the assembled root carries no payload file (lane 2's item 6).
-- **#193 (follow-ups, proposed):** a capability check in the root entry point (item 7); a 200-garbage probe, which refuses where main installs, and clearer words for it (item 4); an identity match for the walk (item 1).
-
-## What this does not do
-
-It creates no repository, pushes nothing to run C, moves no default branch, rebinds no lane and authorizes no real conversion. Gate B remains open; Gate C is Brett Heap's word.
diff --git a/specs/004-migrate-to-triad/installer-design.md b/specs/004-migrate-to-triad/installer-design.md
deleted file mode 100644
index 4f174789..00000000
--- a/specs/004-migrate-to-triad/installer-design.md
+++ /dev/null
@@ -1,97 +0,0 @@
-# Installer follow-up design and compatibility matrix
-
-Prepared for [T007–T010](tasks.md), against main `daed20957f2dd2f22cca24053bb5bc8636ff6b3f`.
-Implementation patches wait for successful standard split verification. PRs
-#97/#121 can change payloads and tests; refresh this inventory after landing.
-
-## One implementation, two entry contexts
-
-Keep the current implementation in code. Add a small assembly `openRepoTools`
-entry point that selects that implementation; preserve the documented raw and
-gh installation one-liners. Installed `openRepoTools` remains the code
-implementation so it runs independently of developer worktrees. The assembly
-entry point must delegate all installation, merging, ownership and retirement
-mechanics to it.
-
-The root entry point alone is insufficient: subsequent installed `--install`,
-`--skill` and WIP template operations currently fetch from the monorepo's
-`REPO`/`REF`. Those code-side consumers need the same payload-source resolution.
-Separate the selected assembly source from the resolved code payload source;
-keep the existing public `OPENREPOTOOLS_REPO`/`OPENREPOTOOLS_REF` meanings.
-Do not infer a code repository by appending `-code` to a fork name.
-
-For an adopted remote, resolve the requested assembly ref once to an immutable
-commit. Read `contracts/code-pin.yaml` at that commit, strictly validate the
-code role, repository slug, commit, path and digest grammar, and confirm the
-assembly gitlink agrees. Fetch the implementation and all its payloads from
-that same code repository/commit. Moving branches cannot mix artifact versions.
-A present malformed pin must refuse rather than fall back to the legacy layout.
-
-For a legacy monorepo with no adoption manifest/pin, retain the established
-owner/repository/ref override path. Distinguish an authoritative missing path
-from authentication, transport and parse errors; those errors are refusals,
-not evidence of a legacy repository. Forks use their selected assembly pin.
-gh-first and curl fallback apply to the same resolved identities. Reuse jq
-where needed; no new general YAML runtime dependency is justified by a fixed
-pin grammar. Do not claim whole-tree digest validation from one downloaded
-file: the composed validator checks the complete tree, while remote installation
-must at least verify the gitlink and immutable identity it actually consumes.
-
-For a local adopted checkout, require a consistent assembly/code pin and
-materialized selected payload set, then copy those local bytes offline. An
-explicit code feature checkout must remain a supported development context;
-record its actual code identity without pretending it is the assembled pin.
-Incomplete local payloads must refuse or fetch only from the established
-matching source; arbitrary local siblings plus unrelated remote bytes must not
-form a successful adopted install. Define this distinction in the implementation
-and user-facing diagnostics before acceptance. Preserve normal legacy sibling
-behavior where the legacy installer currently promises it.
-
-## Code consumers that change
-
-| Existing consumer | Required adjustment |
-| --- | --- |
-| `fetch_from_repo` | Use the resolved payload repository/immutable revision for code assets; retain transport fallback and useful refusal output. |
-| `collect_commands`, `collect_skills` | Establish coherent local/remote source before collecting; preserve all-before-placement staging. |
-| `wip_shape_ref` | Read/fetch code's `contracts/openreposhape-pin.yaml`, distinct from assembly's code pin. Preserve its existing upstream-standard role. |
-| `wip_fetch_template_file` | Continue selecting the template from the upstream standard pinned by code; do not repoint templates to spec or assembly. |
-| Root entry point | Resolve/select/delegate; forward arguments, exit status and signal/temporary-file cleanup. It adds no installer mechanics. |
-| Installed receipts, settings/hook merge and retire functions | Preserve existing ownership, mode, target and refusal behavior; source routing must finish before placement. |
-
-Current command/data payloads are the 15 names in `INSTALLABLES`, including
-`claude-current` and `claude-restart-check`. Three skills and three command
-files each have two destinations: 27 placed files plus two hook entries, 29
-artifacts. Derive counts from the lists; source comments with historical counts
-are not the contract. Hooks stay in the user's existing settings, preserving
-unrelated entries. No machine-specific config enters a payload archive.
-
-## Compatibility acceptance
-
-All rows below are pending measured tests in fresh disposable homes/remotes.
-They describe coverage for the existing executable tasks, not completion claims.
-
-| Scenario | Required observation |
-| --- | --- |
-| Existing raw/gh one-liners | Root delegates to selected code implementation; same names, help and destinations. |
-| Offline local legacy / adopted checkout | Legacy behavior retained; complete adopted payload copied without network and pinned identity checked. |
-| Explicit local code feature | Intentional feature bytes selected coherently and actual identity recorded. |
-| Installed reinstallation and skill-only operation | Works without the developer checkout and resolves the selected assembly/code source. |
-| Legacy override / adopted fork | Existing overrides work; fork follows its actual code pin rather than a guessed repository. |
-| Branch, tag, commit and slash-containing refs | Ref resolved once; every remote payload uses one immutable code identity. |
-| Branch changes between downloads | No mixed versions; subsequent requests use the frozen identity. |
-| Missing pin in valid legacy / partial adopted layout | Valid legacy permitted; adopted missing/malformed/mismatched pin refused. |
-| Missing or malformed API response / authorization / transport failure | No silent legacy fallback; actionable refusal, no placed files. |
-| Changed local gitlink / changed payload / incomplete local payload | Coherence decision enforced before staging/placement; no unrelated-source mix. |
-| Missing command, skill, alias or failed settings merge | Existing all-before-placement guarantee holds; prior install remains unchanged. |
-| Modes, ownership receipts and custom target paths | Same modes and computed targets; foreign files and unrelated hook entries preserved. |
-| WIP init/template lookup | Code dependency pin selects upstream templates; workspace writer restrictions unchanged. |
-| Missing nested dependency in standalone code | Existing documented test skips remain; composed acceptance requires complete dependencies. |
-| Linux/macOS Bash 3.2 and Windows/WSL policies | Correct parses/platform gates; no new Bash features or PowerShell implementation. |
-
-Tests and fixtures need explicit **code**, **spec**, **assembly** and
-**dependency** roots. In particular, `tests/test_repo_hygiene.py` reads the root
-README/install line and agent guidance, while `tests/test_upstream_pin.py`
-reads code Git identity and the nested dependency. CI must supply the matching
-contexts rather than delete those checks. Keep `tests/run.sh` as the serialized
-test entry point, selecting with pytest filters such as `-k upstream_pin`.
-The assembly exact-pin integration job must refuse absent required contexts.
diff --git a/specs/004-migrate-to-triad/inventory.json b/specs/004-migrate-to-triad/inventory.json
deleted file mode 100644
index 17e764df..00000000
--- a/specs/004-migrate-to-triad/inventory.json
+++ /dev/null
@@ -1,1649 +0,0 @@
-{
-  "observed_at": "2026-10-07T10:09:03.632310+00:00",
-  "source_repository": "opensoft/openRepoTools",
-  "source_main": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-  "github_main": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-  "github_main_matches_local": true,
-  "standard_commit": "39d5c986fcfac1a160474bfe91c5f1c37fccc72c",
-  "cleanup_summary": {
-    "previous_snapshot_worktrees": 12,
-    "worktrees_before_refresh": 5,
-    "local_branches_before_refresh": 6,
-    "worktrees_after_reopening_before_concurrent_cleanup": 6,
-    "registered_worktrees_including_reopened_planning_checkout": 5,
-    "local_branches_after_concurrent_cleanup": 5,
-    "planning_checkout_reopened": "004-migrate-to-triad",
-    "removed_before_refresh": [
-      {
-        "identity": "lclaude-finalize",
-        "previous_head": "7e4dc31c4571cf8d7b11e24941568edf66f82a94",
-        "local_branch_present": false
-      },
-      {
-        "identity": "detached-08dad90a67bc",
-        "previous_head": "08dad90a67bc6699283589c2222c53833a6603cd",
-        "local_branch_present": false
-      },
-      {
-        "identity": "002-skip-no-lane-guard",
-        "previous_head": "a2861bbdf0bf4793108bf3b2da2fc65f38d642bd",
-        "local_branch_present": false
-      },
-      {
-        "identity": "003-binary-only-guard-runner",
-        "previous_head": "42860a93be192f025a725708d7a016083ff82923",
-        "local_branch_present": false
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "previous_head": "c1bac0dfc99a62583cb62eafc93a192911b2ff22",
-        "local_branch_present": true
-      },
-      {
-        "identity": "chore/preserve-local-planning-20261003",
-        "previous_head": "135c18b258d02136ed834e5a446e552db385d50c",
-        "local_branch_present": false
-      },
-      {
-        "identity": "detached-92eab6c4fa2e",
-        "previous_head": "92eab6c4fa2e68f7e2202d529ee0f2e4bebce874",
-        "local_branch_present": false
-      },
-      {
-        "identity": "fix/claim-takeover-and-retire-fork",
-        "previous_head": "3de40b1865d31d3bb96a52e3822c1386c9e52634",
-        "local_branch_present": false
-      }
-    ],
-    "new_worktrees_since_previous_snapshot": [],
-    "worktrees_after_concurrent_cleanup_excluding_planning_checkout": 4,
-    "removed_during_refresh": [
-      {
-        "identity": "fix/107-pty-driver-bound-and-lane-per-call-cost",
-        "previous_head": "da0e5bb257b3b2b60a57ca544b7c75528c97f2a5",
-        "local_branch_present": false,
-        "reason": "PR #146 merged into main; concurrent cleanup removed checkout and local branch."
-      }
-    ],
-    "currency": "Historical October 3 cleanup only; use latest_refresh and worktrees for current counts."
-  },
-  "worktrees": [
-    {
-      "identity": "main",
-      "worktree_name": "main",
-      "owner": "shared main checkout (cwd of lanes openRepoTools-1/2/3)",
-      "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-      "layout": "root",
-      "linked": false,
-      "readable_here": true,
-      "upstream": "origin/main",
-      "upstream_configured": "origin/main",
-      "upstream_state": null,
-      "ahead_of_upstream": 0,
-      "behind_upstream": 0,
-      "ahead_of_origin_main": 0,
-      "behind_origin_main": 0,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 5,
-      "ignored_files": 75,
-      "workflow_config_files_preserved": 71,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Source baseline c4864ac (= GitHub main, PR #175's squash). The migration source; freeze it at Gate C."
-    },
-    {
-      "identity": "feat/lane-worktrees-residue-tests",
-      "worktree_name": "ort-179-tests",
-      "owner": "lane openRepoTools-1",
-      "head": "6c79121ea0288ac495ea5d0cd856083059c631bb",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": "origin/feat/lane-worktrees-residue-tests",
-      "upstream_state": "[gone]",
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 98,
-      "behind_origin_main": 2,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip 6c79121 is PR #179's merged head (squash 2fb854f); origin branch gone; tip also on GitHub as refs/pull/179/head. No replay."
-    },
-    {
-      "identity": "fix/install-marker-on-every-file-and-one-install-lock",
-      "worktree_name": "ort-install-followups",
-      "owner": "lane openRepoTools-1",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/main",
-      "upstream_configured": "origin/main",
-      "upstream_state": "[behind 4]",
-      "ahead_of_upstream": 0,
-      "behind_upstream": 4,
-      "ahead_of_origin_main": 0,
-      "behind_origin_main": 4,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "empty-shell",
-      "disposition_proposal": "Tip 2080f3d is main's PR #168 squash; no commits of its own; never pushed. Nothing to continue."
-    },
-    {
-      "identity": "chore/openreposhape-pin-7f84ca4",
-      "worktree_name": "ort-shape-pin",
-      "owner": "lane openRepoTools-1",
-      "head": "e43b2432976a22eb3bf8c419c96209399251d375",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 1,
-      "behind_origin_main": 0,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Active writer (T005): one commit e43b243 moving gitlink and pin 39d5c98 -> 7f84ca4 (tree_sha256 3be52767...), unpushed at capture, tests running. Continues through its own PR; this bundle holds the only copy outside the tree at capture."
-    },
-    {
-      "identity": "004-migrate-to-triad-exec",
-      "worktree_name": "ort-triad-exec",
-      "owner": "lane openRepoTools-1",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 6,
-      "behind_origin_main": 13,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "This Gate A evidence tree (T001/T002), branched from ff6f6a7 at 09:58Z; its commits follow the capture."
-    },
-    {
-      "identity": "004-migrate-to-triad-rehearsal",
-      "worktree_name": "ort-triad-rehearsal",
-      "owner": "lane openRepoTools-1",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 6,
-      "behind_origin_main": 13,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Active writer (Gate B rehearsal), branched from ff6f6a7 at 10:01Z; no commits at capture."
-    },
-    {
-      "identity": "fix/wip-init-step7-guarded-writes-and-step8-refusal-words",
-      "worktree_name": "ort-wip-init-followups",
-      "owner": "lane openRepoTools-1",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/main",
-      "upstream_configured": "origin/main",
-      "upstream_state": "[behind 4]",
-      "ahead_of_upstream": 0,
-      "behind_upstream": 4,
-      "ahead_of_origin_main": 0,
-      "behind_origin_main": 4,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "empty-shell",
-      "disposition_proposal": "Tip 2080f3d is main's PR #168 squash; no commits of its own; never pushed. Nothing to continue."
-    },
-    {
-      "identity": "004-migrate-to-triad-reads",
-      "worktree_name": "triad-reads",
-      "owner": "lane openRepoTools-2",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 6,
-      "behind_origin_main": 13,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Active writer of lane openRepoTools-2, branched from ff6f6a7 at 10:03Z; no commits at capture."
-    },
-    {
-      "identity": "feat/triad-lane-tooling",
-      "worktree_name": "triad-lane-tooling",
-      "owner": "lane openRepoTools-3",
-      "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-      "layout": "lane-worktrees",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 0,
-      "behind_origin_main": 0,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Active writer of lane openRepoTools-3, branched from c4864ac at 10:03Z; no commits at capture."
-    },
-    {
-      "identity": "001-separate-swap-ctx-handoff",
-      "worktree_name": "001-separate-swap-ctx-handoff",
-      "owner": "Brett Heap",
-      "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-      "layout": "legacy-sibling",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/001-separate-swap-ctx-handoff",
-      "upstream_configured": "origin/001-separate-swap-ctx-handoff",
-      "upstream_state": null,
-      "ahead_of_upstream": 0,
-      "behind_upstream": 0,
-      "ahead_of_origin_main": 27,
-      "behind_origin_main": 23,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 4,
-      "ignored_files": 70,
-      "workflow_config_files_preserved": 70,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "Feature 001 at 3c26041 (= origin), clean; 27 ahead / 23 behind main. Continue into paired 001 worktrees (T016)."
-    },
-    {
-      "identity": "004-migrate-to-triad",
-      "worktree_name": "004-migrate-to-triad",
-      "owner": "Brett Heap",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "layout": "legacy-sibling",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/004-migrate-to-triad",
-      "upstream_configured": "origin/004-migrate-to-triad",
-      "upstream_state": null,
-      "ahead_of_upstream": 0,
-      "behind_upstream": 0,
-      "ahead_of_origin_main": 6,
-      "behind_origin_main": 13,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "retained-work",
-      "disposition_proposal": "The migration plan at ff6f6a7 (= origin); PR #187 opened 10:03:43Z. Full proposal stays in spec (T017)."
-    },
-    {
-      "identity": "feat/supervised-context-restart",
-      "worktree_name": "005-supervised-legacy-ctx",
-      "owner": "Brett Heap",
-      "head": "f13d32975d7457d662249385d23ee28a7f713c4c",
-      "layout": "legacy-sibling",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/feat/supervised-context-restart",
-      "upstream_configured": "origin/feat/supervised-context-restart",
-      "upstream_state": null,
-      "ahead_of_upstream": 0,
-      "behind_upstream": 0,
-      "ahead_of_origin_main": 30,
-      "behind_origin_main": 8,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 3,
-      "ignored_files": 24,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip f13d329 is PR #121's merged head (squash 00971b9); origin branch present; clean. Any paired 005 continuation is the owner's decision."
-    },
-    {
-      "identity": "feat/claude-current",
-      "worktree_name": "feat-claude-current",
-      "owner": "Brett Heap",
-      "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-      "layout": "legacy-nested",
-      "linked": true,
-      "readable_here": true,
-      "upstream": "origin/feat/claude-current",
-      "upstream_configured": "origin/feat/claude-current",
-      "upstream_state": null,
-      "ahead_of_upstream": 0,
-      "behind_upstream": 0,
-      "ahead_of_origin_main": 19,
-      "behind_origin_main": 11,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 2,
-      "ignored_files": 18,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": false,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip 11037f0 is PR #134's merged head (squash daed209); retained checkout is preservation history; no replay."
-    },
-    {
-      "identity": "feat/amendment-22-sql-primary",
-      "worktree_name": "a22-primary",
-      "owner": "lane openRepoTools-3",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "layout": "harness-nested",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 0,
-      "behind_origin_main": 4,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "empty-shell",
-      "disposition_proposal": "Tip 2080f3d is main's PR #168 squash; no commits of its own; never pushed."
-    },
-    {
-      "identity": "feat/lane-end-closeout-rest",
-      "worktree_name": "closeout-2",
-      "owner": "lane openRepoTools-3",
-      "head": "ed3655184d90e1ac21848aa4c3e294327b9561b6",
-      "layout": "harness-nested",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": "origin/feat/lane-end-closeout",
-      "upstream_state": "[gone]",
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 38,
-      "behind_origin_main": 7,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip ed36551 is an ancestor of PR #175's merged head 5c05ab6 (squash c4864ac); configured upstream gone; on GitHub as part of refs/pull/175/head."
-    },
-    {
-      "identity": "feat/shell-suite-wall-time",
-      "worktree_name": "suite-speed",
-      "owner": "lane openRepoTools-3",
-      "head": "d2f80512902bf85b5993134a3cef6913d131565a",
-      "layout": "harness-nested",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": null,
-      "upstream_state": null,
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 36,
-      "behind_origin_main": 4,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 0,
-      "ignored_files": 0,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip d2f8051 is PR #169's merged head (squash 500687c); never pushed under this branch name; on GitHub as refs/pull/169/head."
-    },
-    {
-      "identity": "feat/lane-worktrees-residue",
-      "worktree_name": "sweep-170",
-      "owner": "lane openRepoTools-1",
-      "head": "4ea84c8c8206347cef3cc5a626e79aee9e12b8c3",
-      "layout": "harness-nested",
-      "linked": true,
-      "readable_here": true,
-      "upstream": null,
-      "upstream_configured": "origin/feat/lane-worktrees-residue",
-      "upstream_state": "[gone]",
-      "ahead_of_upstream": null,
-      "behind_upstream": null,
-      "ahead_of_origin_main": 81,
-      "behind_origin_main": 3,
-      "dirty_entries": 0,
-      "untracked_entries": 0,
-      "ignored_entries": 1,
-      "ignored_files": 1,
-      "workflow_config_files_preserved": 0,
-      "submodule_initialized": true,
-      "locked": false,
-      "prunable": false,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Tip 4ea84c8 is PR #174's merged head (squash 5eb3d5f); origin branch gone; on GitHub as refs/pull/174/head."
-    }
-  ],
-  "local_branches": [
-    {
-      "identity": "001-separate-swap-ctx-handoff",
-      "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-      "upstream_configured": "origin/001-separate-swap-ctx-handoff",
-      "upstream_state": null,
-      "worktree": "001-separate-swap-ctx-handoff"
-    },
-    {
-      "identity": "004-migrate-to-triad",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "upstream_configured": "origin/004-migrate-to-triad",
-      "upstream_state": null,
-      "worktree": "004-migrate-to-triad"
-    },
-    {
-      "identity": "004-migrate-to-triad-exec",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "ort-triad-exec"
-    },
-    {
-      "identity": "004-migrate-to-triad-reads",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "triad-reads"
-    },
-    {
-      "identity": "004-migrate-to-triad-rehearsal",
-      "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "ort-triad-rehearsal"
-    },
-    {
-      "identity": "chore/openreposhape-pin-7f84ca4",
-      "head": "e43b2432976a22eb3bf8c419c96209399251d375",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "ort-shape-pin"
-    },
-    {
-      "identity": "feat/amendment-22-sql-primary",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "a22-primary"
-    },
-    {
-      "identity": "feat/claude-current",
-      "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-      "upstream_configured": "origin/feat/claude-current",
-      "upstream_state": null,
-      "worktree": "feat-claude-current"
-    },
-    {
-      "identity": "feat/lane-end-closeout-rest",
-      "head": "ed3655184d90e1ac21848aa4c3e294327b9561b6",
-      "upstream_configured": "origin/feat/lane-end-closeout",
-      "upstream_state": "[gone]",
-      "worktree": "closeout-2"
-    },
-    {
-      "identity": "feat/lane-worktrees-residue",
-      "head": "4ea84c8c8206347cef3cc5a626e79aee9e12b8c3",
-      "upstream_configured": "origin/feat/lane-worktrees-residue",
-      "upstream_state": "[gone]",
-      "worktree": "sweep-170"
-    },
-    {
-      "identity": "feat/lane-worktrees-residue-tests",
-      "head": "6c79121ea0288ac495ea5d0cd856083059c631bb",
-      "upstream_configured": "origin/feat/lane-worktrees-residue-tests",
-      "upstream_state": "[gone]",
-      "worktree": "ort-179-tests"
-    },
-    {
-      "identity": "feat/shell-suite-wall-time",
-      "head": "d2f80512902bf85b5993134a3cef6913d131565a",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "suite-speed"
-    },
-    {
-      "identity": "feat/supervised-context-restart",
-      "head": "f13d32975d7457d662249385d23ee28a7f713c4c",
-      "upstream_configured": "origin/feat/supervised-context-restart",
-      "upstream_state": null,
-      "worktree": "005-supervised-legacy-ctx"
-    },
-    {
-      "identity": "feat/triad-lane-tooling",
-      "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": "triad-lane-tooling"
-    },
-    {
-      "identity": "fix/install-marker-on-every-file-and-one-install-lock",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "upstream_configured": "origin/main",
-      "upstream_state": "[behind 4]",
-      "worktree": "ort-install-followups"
-    },
-    {
-      "identity": "fix/wip-init-step7-guarded-writes-and-step8-refusal-words",
-      "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "upstream_configured": "origin/main",
-      "upstream_state": "[behind 4]",
-      "worktree": "ort-wip-init-followups"
-    },
-    {
-      "identity": "main",
-      "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-      "upstream_configured": "origin/main",
-      "upstream_state": null,
-      "worktree": "main"
-    },
-    {
-      "identity": "review/20261004-review/branch-004-migrate-to-triad-efc637",
-      "head": "5455805d623b6d3e2943606745c4ac812dc40be5",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": null,
-      "classification": "retained-work",
-      "disposition_proposal": "October 4 review snapshot of 004; ancestor of ff6f6a7; also on origin."
-    },
-    {
-      "identity": "review/20261004-review/branch-feat-crash-consistent-lane-worktree-recovery-897cfc",
-      "head": "07fb3adb8b4ac1476c641685096f00f0d20593c6",
-      "upstream_configured": null,
-      "upstream_state": null,
-      "worktree": null,
-      "classification": "landed-and-preserved",
-      "disposition_proposal": "Ancestor of PR #97's merged head 8c5958f (squash b1015f4); also on origin."
-    }
-  ],
-  "remote_only_branches": [
-    {
-      "identity": "chore/preserve-local-planning-20261003",
-      "head": "135c18b258d02136ed834e5a446e552db385d50c",
-      "on_origin": true,
-      "classification": "remote-only-ref",
-      "disposition_proposal": "Preservation history of the October 3 local planning drafts; no checkout.",
-      "currency": "origin heads read with git ls-remote at the refresh; matches the local remote-tracking ref"
-    },
-    {
-      "identity": "takeover/ort-a9-dirty-snapshot-20260913",
-      "head": "607aee7551a5a7db7e57e294aba193fbc8a8a266",
-      "on_origin": true,
-      "classification": "remote-only-ref",
-      "disposition_proposal": "Preservation snapshot of September 13; no checkout.",
-      "currency": "origin heads read with git ls-remote at the refresh; matches the local remote-tracking ref"
-    },
-    {
-      "identity": "fix/install-by-rename-167",
-      "head": "1905b7984c1f9877569c20971ffcf9ebd08b3e1c",
-      "on_origin": true,
-      "classification": "remote-only-ref",
-      "disposition_proposal": "PR #172's merged head (squash 3660224); no local branch.",
-      "currency": "origin heads read with git ls-remote at the refresh; matches the local remote-tracking ref"
-    }
-  ],
-  "local_only_refs": [
-    {
-      "ref": "refs/lanes/a9-move",
-      "head": "2108ce3ab6f767d993522f96c5e3af58659577b3",
-      "on_origin": false,
-      "classification": "landed-and-preserved",
-      "note": "Ancestor of main; not on origin."
-    },
-    {
-      "ref": "refs/remotes/pr/24",
-      "head": "e3d57ddf4f4e77761cd250faf21664a637c3f298",
-      "on_origin": false,
-      "classification": "landed-and-preserved",
-      "note": "Stale remote-tracking ref (no 'pr' remote configured); ancestor of main (PR #24 merged d4b5710)."
-    },
-    {
-      "ref": "refs/remotes/pr/26",
-      "head": "dae38be3b28cde7086862738bd8ad56fce406efe",
-      "on_origin": false,
-      "classification": "landed-and-preserved",
-      "note": "Stale remote-tracking ref (no 'pr' remote configured); ancestor of PR #26's merged head (squash 63a74af)."
-    }
-  ],
-  "open_prs": [
-    {
-      "number": 187,
-      "title": "Triad migration planning (feature 004-migrate-to-triad): proposal, plan, tasks, adoption mapping and the October rehearsal receipts",
-      "headRefName": "004-migrate-to-triad",
-      "headRefOid": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-      "isDraft": false,
-      "url": "https://github.com/opensoft/openRepoTools/pull/187",
-      "state": "open",
-      "merged": false,
-      "created_at": "2026-10-07T10:03:43Z"
-    }
-  ],
-  "merged_since_previous_snapshot": [
-    {
-      "number": 97,
-      "state": "MERGED",
-      "merged_at": "2026-10-04T23:36:21Z",
-      "merge_commit": "b1015f4672f9c107d939803c39846f8dbd3d78f3",
-      "head_ref": "feat/crash-consistent-lane-worktree-recovery",
-      "head_oid": "8c5958fcb366b0f749e878f13f10877afce85637",
-      "disposition": "Merged; recovery branch and checkout gone; included in source main."
-    },
-    {
-      "number": 164,
-      "state": "MERGED",
-      "merged_at": "2026-10-05T19:36:07Z",
-      "merge_commit": "fea9a2904ce0224ca6a77dff02319bd9656a8fee",
-      "head_ref": "feat/amendment-14-derived-index",
-      "head_oid": "20e23a4c680d17f60f61f53dac16770b01c5225d",
-      "disposition": "Merged; included in source main."
-    },
-    {
-      "number": 121,
-      "state": "MERGED",
-      "merged_at": "2026-10-06T09:38:31Z",
-      "merge_commit": "00971b929f586179828481e7cb34db181f386937",
-      "head_ref": "feat/supervised-context-restart",
-      "head_oid": "f13d32975d7457d662249385d23ee28a7f713c4c",
-      "disposition": "Merged; the 005 checkout at the merged head is preservation history."
-    },
-    {
-      "number": 171,
-      "state": "MERGED",
-      "merged_at": "2026-10-06T15:02:17Z",
-      "merge_commit": "f5444c5e1f3c6c9ed43aeafcc000b0e78b10497a",
-      "head_ref": "feat/amendment-14-worktrees-index",
-      "head_oid": "9b2ec40d465d6ec0a911cb2cbcd836bdff92bb9c",
-      "disposition": "Merged; included in source main."
-    },
-    {
-      "number": 172,
-      "state": "MERGED",
-      "merged_at": "2026-10-06T17:35:06Z",
-      "merge_commit": "3660224cf32e5217f227cf7a740efec462da5151",
-      "head_ref": "fix/install-by-rename-167",
-      "head_oid": "1905b7984c1f9877569c20971ffcf9ebd08b3e1c",
-      "disposition": "Merged; head survives as remote-only fix/install-by-rename-167."
-    },
-    {
-      "number": 168,
-      "state": "MERGED",
-      "merged_at": "2026-10-06T18:45:29Z",
-      "merge_commit": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-      "head_ref": "feat/lane-worktrees-sweep",
-      "head_oid": "df0d6916f59ac2d3c6f6672b9441a1c73b0a0446",
-      "disposition": "Merged; included in source main."
-    },
-    {
-      "number": 169,
-      "state": "MERGED",
-      "merged_at": "2026-10-06T20:43:26Z",
-      "merge_commit": "500687c4b746d038ba14367ae8fca120ab0fbf97",
-      "head_ref": "feat/lane-worktrees-report",
-      "head_oid": "d2f80512902bf85b5993134a3cef6913d131565a",
-      "disposition": "Merged; head kept in lane 3's suite-speed tree."
-    },
-    {
-      "number": 174,
-      "state": "MERGED",
-      "merged_at": "2026-10-07T01:19:18Z",
-      "merge_commit": "5eb3d5f816f8ef81bda44ee8875bf62c56d95d6a",
-      "head_ref": "feat/lane-worktrees-residue",
-      "head_oid": "4ea84c8c8206347cef3cc5a626e79aee9e12b8c3",
-      "disposition": "Merged; head kept in lane 1's sweep-170 tree."
-    },
-    {
-      "number": 179,
-      "state": "MERGED",
-      "merged_at": "2026-10-07T02:08:55Z",
-      "merge_commit": "2fb854f12855079874f970eaee2cbee87bd97200",
-      "head_ref": "feat/lane-worktrees-residue-tests",
-      "head_oid": "6c79121ea0288ac495ea5d0cd856083059c631bb",
-      "disposition": "Merged; head kept in lane 1's ort-179-tests tree."
-    },
-    {
-      "number": 175,
-      "state": "MERGED",
-      "merged_at": "2026-10-07T04:26:10Z",
-      "merge_commit": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-      "head_ref": "feat/lane-end-closeout",
-      "head_oid": "5c05ab6272749df5a11ad68835aa3b737b6a4cdf",
-      "disposition": "Merged as the source commit c4864ac; lane 3's closeout-2 tip is an ancestor of its head."
-    }
-  ],
-  "estate_status": {
-    "command": "status openRepoTools",
-    "fetch": false,
-    "observed_at": "2026-10-07T10:09:08Z",
-    "result": "refused-not-an-estate",
-    "exit": 2,
-    "note": "Read-only and without --fetch: \"REFUSED: no estate named 'openRepoTools' under your projects directory.\" No project.yaml/family.yaml estate root yet. resume was not run to silence it; local refs, git ls-remote and read-only GitHub PR queries were used instead."
-  },
-  "limitations": [
-    "Snapshot of a moving estate, not a writer freeze: five worktrees appeared 09:57Z-10:03Z for this migration's writers, PR #187 opened 10:03:43Z (before capture) and PR #188 10:10:43Z (after). Refresh again at the owner-coordinated freeze.",
-    "Worktree and branch counts are as of the stamp in refreshed.observed_at; capture stability is proven only for 10:05:59Z-10:06:08Z.",
-    "Physical paths, credentials, transcript bodies, WIP data and backup contents are omitted; worktree_name and layout identify trees, and owner attributes them by path.",
-    "Classifications and disposition_proposal are proposals; owner decisions for Brett Heap's and lanes 2/3's objects remain pending (private receipt dispositions.tsv). Landed-and-preserved trees need no replay; empty shells hold no commits of their own.",
-    "Installed files were captured for the host paths in installed.tsv only; py-bench and other profiles/workstations are not in this capture.",
-    "Real conversion waits for refreshed Gates A/B and explicit Gate C approval; gate_a_complete and gate_b_complete stay false."
-  ],
-  "previous_refresh_snapshot": {
-    "observed_at": "2026-10-04T16:37:26.292668+00:00",
-    "source_main": "82ecebee13edaa915b68550170faffdf761754d5",
-    "worktrees": [
-      {
-        "identity": "main",
-        "head": "82ecebee13edaa915b68550170faffdf761754d5",
-        "dirty_entries": 0,
-        "untracked_entries": 0
-      },
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-        "dirty_entries": 0,
-        "untracked_entries": 0
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "8aa119fd5c4286ff836ee2c9c6ee141859cb3710",
-        "dirty_entries": 1,
-        "untracked_entries": 0
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "dirty_entries": 0,
-        "untracked_entries": 0
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "5164ce1535b0f4f21d6b9e5b48318865a3c74295",
-        "dirty_entries": 0,
-        "untracked_entries": 0
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "64dfd9736b1079c16beda0b1ac53a61e68b21d9e",
-        "dirty_entries": 0,
-        "untracked_entries": 0
-      }
-    ],
-    "local_branches": [
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5"
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "8aa119fd5c4286ff836ee2c9c6ee141859cb3710"
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12"
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "64dfd9736b1079c16beda0b1ac53a61e68b21d9e"
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "5164ce1535b0f4f21d6b9e5b48318865a3c74295"
-      },
-      {
-        "identity": "main",
-        "head": "82ecebee13edaa915b68550170faffdf761754d5"
-      }
-    ],
-    "open_prs": [
-      {
-        "number": 134,
-        "headRefName": "feat/claude-current",
-        "headRefOid": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "isDraft": false
-      },
-      {
-        "number": 121,
-        "headRefName": "feat/supervised-context-restart",
-        "headRefOid": "5164ce1535b0f4f21d6b9e5b48318865a3c74295",
-        "isDraft": false
-      },
-      {
-        "number": 97,
-        "headRefName": "feat/crash-consistent-lane-worktree-recovery",
-        "headRefOid": "64dfd9736b1079c16beda0b1ac53a61e68b21d9e",
-        "isDraft": false
-      }
-    ]
-  },
-  "latest_refresh": {
-    "previous_observed_at": "2026-10-04T21:24:50.021151+00:00",
-    "previous_worktrees": 6,
-    "current_worktrees": 17,
-    "current_local_branches": 19,
-    "added_worktrees": [
-      "004-migrate-to-triad-exec",
-      "004-migrate-to-triad-reads",
-      "004-migrate-to-triad-rehearsal",
-      "chore/openreposhape-pin-7f84ca4",
-      "feat/amendment-22-sql-primary",
-      "feat/lane-end-closeout-rest",
-      "feat/lane-worktrees-residue",
-      "feat/lane-worktrees-residue-tests",
-      "feat/shell-suite-wall-time",
-      "feat/triad-lane-tooling",
-      "fix/install-marker-on-every-file-and-one-install-lock",
-      "fix/wip-init-step7-guarded-writes-and-step8-refusal-words"
-    ],
-    "removed_worktrees": [
-      "feat/crash-consistent-lane-worktree-recovery"
-    ],
-    "source_main_changed": true,
-    "protocol": "Triad Feature Amendments adopted manually October 4; automated delivery remains unqualified.",
-    "concurrent_work": "Migration writers active at capture: lane 1 pin bump (e43b243, unpushed at capture, later PR #188), lane 1 Gate B tree, lane 2 triad-reads, lane 3 triad-lane-tooling; Brett Heap's 004 branch has PR #187. All trees clean at capture.",
-    "real_conversion_waits_for_prs": [],
-    "note": "#97 and #121 both merged (2026-10-04T23:36:21Z, 2026-10-06T09:38:31Z); real conversion now waits on Gates A/B and Gate C, not on PR landings."
-  },
-  "protocol_review": {
-    "adopted_on": "2026-10-04",
-    "workflow": "Triad Feature Amendments and Single repository to triad migration",
-    "manual_use": true,
-    "automation_qualified": false,
-    "source_record": "specs/004-migrate-to-triad/protocol-review.md",
-    "amendment_path_observations": [
-      {
-        "identity": "main",
-        "head": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "48934f8d4c662be6ed07ad1b7df96dec22028ab2",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "0e4b311dfa33abca55282a4974cb96c7d1c584ed",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "07fb3adb8b4ac1476c641685096f00f0d20593c6",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      }
-    ]
-  },
-  "preparation_previous_snapshot": {
-    "observed_at": "2026-10-04T17:40:54.465251+00:00",
-    "worktrees": [
-      {
-        "identity": "main",
-        "head": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-        "layout": "root",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "dda91f11c68818ebeca4264d88908c85818ff630",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 14,
-        "untracked_entries": 1,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "5164ce1535b0f4f21d6b9e5b48318865a3c74295",
-        "layout": "legacy-nested",
-        "readable_here": true,
-        "dirty_entries": 43,
-        "untracked_entries": 3,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "8f69e96fbd33d84950b1acdaa2f2f3836c081341",
-        "layout": "legacy-nested",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      }
-    ],
-    "local_branches": [
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5"
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "dda91f11c68818ebeca4264d88908c85818ff630"
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12"
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "8f69e96fbd33d84950b1acdaa2f2f3836c081341"
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "5164ce1535b0f4f21d6b9e5b48318865a3c74295"
-      },
-      {
-        "identity": "main",
-        "head": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f"
-      }
-    ],
-    "open_prs": [
-      {
-        "number": 121,
-        "title": "`/ctx` writes its restart to disk before it kills anything, and what tmux starts is a supervisor that stays in the pane \u2014 the fresh session was an environment variable the launcher dropped (#94)",
-        "headRefName": "feat/supervised-context-restart",
-        "headRefOid": "5164ce1535b0f4f21d6b9e5b48318865a3c74295",
-        "isDraft": false,
-        "url": "https://github.com/opensoft/openRepoTools/pull/121",
-        "state": "open"
-      },
-      {
-        "number": 97,
-        "title": "Crash-consistent lane worktree recovery: a lane now says WHERE its session stopped \u2014 RUNNING \u2192 SWAPPING \u2192 SWAPPED with a generation/operation fence, a machine-readable worktree inventory taken at every handoff, and a resume reconciliation that reports and resets nothing",
-        "headRefName": "feat/crash-consistent-lane-worktree-recovery",
-        "headRefOid": "64dfd9736b1079c16beda0b1ac53a61e68b21d9e",
-        "isDraft": false,
-        "url": "https://github.com/opensoft/openRepoTools/pull/97",
-        "state": "open"
-      }
-    ],
-    "latest_refresh": {
-      "previous_observed_at": "2026-10-04T16:37:26.292668+00:00",
-      "previous_worktrees": 6,
-      "current_worktrees": 6,
-      "current_local_branches": 6,
-      "added_worktrees": [],
-      "removed_worktrees": [],
-      "source_main_changed": true,
-      "protocol": "Shared OpenSpec/Speckit workflow: Triad Feature Amendments, adopted 2026-10-04; manual delivery only.",
-      "concurrent_work": "PR #121 retains staged/unstaged/untracked work including full legacy authority decision and feature 005; recovery branch advanced during refresh. Snapshot only, not a writer freeze."
-    }
-  },
-  "preparation_evidence": {
-    "record": "specs/004-migrate-to-triad/preparation.md",
-    "backup_id": "prep-20261004T211123Z",
-    "all_ref_restore_verified": true,
-    "refs": 18,
-    "dependency_commit_restore_verified": true,
-    "captured_worktrees": 6,
-    "snapshot_git_restores_verified": 6,
-    "git_restore_summary_sha256": "550d1ce96c8a162c3371f95b53be188217f85fac6491e98e628ae307ea35b31e",
-    "gate_a_complete": false,
-    "gate_b_complete": false,
-    "local_adoption_exit": 2,
-    "reproduction": "specs/004-migrate-to-triad/adopter-blocker.md"
-  },
-  "superseded_snapshot_2026_10_04": {
-    "observed_at": "2026-10-04T21:24:50.021151+00:00",
-    "source_main": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-    "github_main": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-    "github_main_matches_local": true,
-    "worktrees": [
-      {
-        "identity": "main",
-        "head": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-        "layout": "root",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "48934f8d4c662be6ed07ad1b7df96dec22028ab2",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 3,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "0e4b311dfa33abca55282a4974cb96c7d1c584ed",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "layout": "legacy-sibling",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "07fb3adb8b4ac1476c641685096f00f0d20593c6",
-        "layout": "legacy-nested",
-        "readable_here": true,
-        "dirty_entries": 0,
-        "untracked_entries": 0,
-        "locked": false,
-        "prunable": false
-      }
-    ],
-    "local_branches": [
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5"
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "48934f8d4c662be6ed07ad1b7df96dec22028ab2"
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12"
-      },
-      {
-        "identity": "feat/crash-consistent-lane-worktree-recovery",
-        "head": "07fb3adb8b4ac1476c641685096f00f0d20593c6"
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "0e4b311dfa33abca55282a4974cb96c7d1c584ed"
-      },
-      {
-        "identity": "main",
-        "head": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f"
-      }
-    ],
-    "remote_only_branches": [
-      {
-        "identity": "chore/preserve-local-planning-20261003",
-        "head": "135c18b258d02136ed834e5a446e552db385d50c",
-        "currency": "local remote-tracking observation; not fetched during refresh"
-      },
-      {
-        "identity": "takeover/ort-a9-dirty-snapshot-20260913",
-        "head": "607aee7551a5a7db7e57e294aba193fbc8a8a266",
-        "currency": "local remote-tracking observation; not fetched during refresh"
-      }
-    ],
-    "open_prs": [
-      {
-        "number": 121,
-        "title": "Keep supervised manual ctx as legacy compatibility and refuse managed lanes",
-        "headRefName": "feat/supervised-context-restart",
-        "headRefOid": "6c5b74176e9dbf7f9aad5a4ff8ec18ef0cbbb136",
-        "isDraft": false,
-        "url": "https://github.com/opensoft/openRepoTools/pull/121",
-        "state": "open",
-        "merged": false,
-        "updated_at": "2026-10-04T21:24:31Z"
-      },
-      {
-        "number": 97,
-        "title": "Crash-consistent lane worktree recovery: a lane now says WHERE its session stopped \u2014 RUNNING \u2192 SWAPPING \u2192 SWAPPED with a generation/operation fence, a machine-readable worktree inventory taken at every handoff, and a resume reconciliation that reports and resets nothing",
-        "headRefName": "feat/crash-consistent-lane-worktree-recovery",
-        "headRefOid": "eada5fff495452cf5da47e52d9550fa4b40a4c96",
-        "isDraft": false,
-        "url": "https://github.com/opensoft/openRepoTools/pull/97",
-        "state": "open",
-        "merged": false,
-        "updated_at": "2026-10-04T21:05:20Z"
-      }
-    ],
-    "merged_since_previous_snapshot": [
-      {
-        "number": 61,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T17:55:42Z",
-        "merge_commit": "14641fd67cee2985c215fc820219c9906935bdf3",
-        "disposition": "Included in current source main; no separate feature replay."
-      },
-      {
-        "number": 146,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T22:07:15Z",
-        "merge_commit": "82ecebee13edaa915b68550170faffdf761754d5",
-        "disposition": "Included in current source main; no separate feature replay."
-      },
-      {
-        "number": 134,
-        "state": "MERGED",
-        "merged_at": "2026-10-04T16:52:38Z",
-        "merge_commit": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-        "disposition": "Included in refreshed source main; retained checkout is preservation only, no separate replay."
-      }
-    ],
-    "estate_status": {
-      "command": "status --fetch openRepoTools",
-      "result": "refused-not-an-estate",
-      "note": "No project.yaml/family.yaml estate root yet; no fetch performed by this refusal. Local refs and read-only GitHub main/PR APIs were checked instead. Do not run resume to silence it."
-    },
-    "limitations": [
-      "Snapshot only; refresh before baseline freeze and cutover.",
-      "Physical paths, credentials, transcript bodies and WIP data are omitted.",
-      "Feature 001 is committed and clean at observation; preserve its current full branch delta, restored rollover/workspace packets and October 4 launcher contracts. Clean status is not a backup/restore receipt.",
-      "Removed worktrees are cleanup history, not instructions to recreate them; verify retained backup/branch receipts before final cutover.",
-      "Remote-only preservation refs are local observations, not active worktrees or proof of fresh remote currency.",
-      "Raw preservation backups belong host-locally or in the designated private WIP repository; public records hold identities/digests only.",
-      "Inventory captures this planning branch before the refresh commit; its final HEAD is recorded by git.",
-      "#97/#121 have active writers; capture local and remote heads independently and recapture at cutover. Prior dirty snapshots remain historical evidence.",
-      "Real conversion waits for both PR landings, upstream adopter resolution, refreshed Gates A/B and explicit Gate C approval."
-    ]
-  },
-  "refreshed": {
-    "observed_at": "2026-10-07T10:09:03.632310+00:00",
-    "capture_window": "2026-10-07T10:05:59Z/2026-10-07T10:06:08Z",
-    "source_commit": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-    "inventory_branch": "004-migrate-to-triad-exec",
-    "inventory_base": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-    "tasks": [
-      "T001",
-      "T002"
-    ],
-    "tracking_issue": "opensoft/openRepoTools#186",
-    "worktree_entries_at_stamp": 17,
-    "worktree_count_note": "As of the stamp: main plus 16 linked. The brief expected 12; five were created 09:57Z-10:03Z by this migration's writers (ort-shape-pin, ort-triad-exec, ort-triad-rehearsal under lane 1; triad-reads under lane 2; triad-lane-tooling under lane 3). The count was 17 again at 11:05Z with the same trees.",
-    "owners_by_path": {
-      "Brett Heap": 4,
-      "lane openRepoTools-1": 7,
-      "lane openRepoTools-2": 1,
-      "lane openRepoTools-3": 4,
-      "shared main checkout": 1
-    },
-    "classification_counts": {
-      "retained-work": 8,
-      "landed-and-preserved": 6,
-      "empty-shell": 3
-    },
-    "local_branches_at_stamp": 19,
-    "refs_at_stamp": 33,
-    "origin_heads": 10,
-    "origin_tags": 0,
-    "open_prs_at_stamp": [
-      187
-    ],
-    "merged_since_2026_10_03": [
-      {
-        "number": 119,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T00:53:08Z",
-        "merge_commit": "92bd21fd7dfd91a370f143dc8b89f351ad637461",
-        "head_ref": "chore/macos-landing-gate-and-cycle-rules",
-        "head_oid": "a0671ece71dbd78808fb3504e0a5a8b8b215d4c5"
-      },
-      {
-        "number": 103,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T02:08:44Z",
-        "merge_commit": "a44a4edf3643648f7c573a5dc7f5832df60cbc61",
-        "head_ref": "feat/install-receipt",
-        "head_oid": "bade19ba459d2a0d60cc69ea626f007989dff56d"
-      },
-      {
-        "number": 83,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T02:46:00Z",
-        "merge_commit": "6faed35f418c628f87b33a3e6a5ae4fa1cdd9dfc",
-        "head_ref": "feat/amendment-18-one-binding",
-        "head_oid": "400d559f403fae02aad61b1d95bcd692de2cf633"
-      },
-      {
-        "number": 139,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T03:16:12Z",
-        "merge_commit": "795016ee074ea442030766f0fa17443368b1d757",
-        "head_ref": "fix/wip-init-refuses-unreviewed-history-ahead-of-main",
-        "head_oid": "c587c4feded45ace3613a86eff17a807ee37a294"
-      },
-      {
-        "number": 93,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T06:30:34Z",
-        "merge_commit": "c1bac0dfc99a62583cb62eafc93a192911b2ff22",
-        "head_ref": "feat/amendment-19-closed-lanes-leave-the-listing",
-        "head_oid": "8fc5e1a7f89d82d479e654dce3d969ad304e4e6b"
-      },
-      {
-        "number": 61,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T17:55:42Z",
-        "merge_commit": "14641fd67cee2985c215fc820219c9906935bdf3",
-        "head_ref": "fix/claim-takeover-and-retire-fork",
-        "head_oid": "3de40b1865d31d3bb96a52e3822c1386c9e52634"
-      },
-      {
-        "number": 146,
-        "state": "MERGED",
-        "merged_at": "2026-10-03T22:07:15Z",
-        "merge_commit": "82ecebee13edaa915b68550170faffdf761754d5",
-        "head_ref": "fix/107-pty-driver-bound-and-lane-per-call-cost",
-        "head_oid": "da0e5bb257b3b2b60a57ca544b7c75528c97f2a5"
-      },
-      {
-        "number": 134,
-        "state": "MERGED",
-        "merged_at": "2026-10-04T16:52:38Z",
-        "merge_commit": "daed20957f2dd2f22cca24053bb5bc8636ff6b3f",
-        "head_ref": "feat/claude-current",
-        "head_oid": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12"
-      },
-      {
-        "number": 97,
-        "state": "MERGED",
-        "merged_at": "2026-10-04T23:36:21Z",
-        "merge_commit": "b1015f4672f9c107d939803c39846f8dbd3d78f3",
-        "head_ref": "feat/crash-consistent-lane-worktree-recovery",
-        "head_oid": "8c5958fcb366b0f749e878f13f10877afce85637",
-        "disposition": "Merged; recovery branch and checkout gone; included in source main."
-      },
-      {
-        "number": 164,
-        "state": "MERGED",
-        "merged_at": "2026-10-05T19:36:07Z",
-        "merge_commit": "fea9a2904ce0224ca6a77dff02319bd9656a8fee",
-        "head_ref": "feat/amendment-14-derived-index",
-        "head_oid": "20e23a4c680d17f60f61f53dac16770b01c5225d",
-        "disposition": "Merged; included in source main."
-      },
-      {
-        "number": 121,
-        "state": "MERGED",
-        "merged_at": "2026-10-06T09:38:31Z",
-        "merge_commit": "00971b929f586179828481e7cb34db181f386937",
-        "head_ref": "feat/supervised-context-restart",
-        "head_oid": "f13d32975d7457d662249385d23ee28a7f713c4c",
-        "disposition": "Merged; the 005 checkout at the merged head is preservation history."
-      },
-      {
-        "number": 171,
-        "state": "MERGED",
-        "merged_at": "2026-10-06T15:02:17Z",
-        "merge_commit": "f5444c5e1f3c6c9ed43aeafcc000b0e78b10497a",
-        "head_ref": "feat/amendment-14-worktrees-index",
-        "head_oid": "9b2ec40d465d6ec0a911cb2cbcd836bdff92bb9c",
-        "disposition": "Merged; included in source main."
-      },
-      {
-        "number": 172,
-        "state": "MERGED",
-        "merged_at": "2026-10-06T17:35:06Z",
-        "merge_commit": "3660224cf32e5217f227cf7a740efec462da5151",
-        "head_ref": "fix/install-by-rename-167",
-        "head_oid": "1905b7984c1f9877569c20971ffcf9ebd08b3e1c",
-        "disposition": "Merged; head survives as remote-only fix/install-by-rename-167."
-      },
-      {
-        "number": 168,
-        "state": "MERGED",
-        "merged_at": "2026-10-06T18:45:29Z",
-        "merge_commit": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-        "head_ref": "feat/lane-worktrees-sweep",
-        "head_oid": "df0d6916f59ac2d3c6f6672b9441a1c73b0a0446",
-        "disposition": "Merged; included in source main."
-      },
-      {
-        "number": 169,
-        "state": "MERGED",
-        "merged_at": "2026-10-06T20:43:26Z",
-        "merge_commit": "500687c4b746d038ba14367ae8fca120ab0fbf97",
-        "head_ref": "feat/lane-worktrees-report",
-        "head_oid": "d2f80512902bf85b5993134a3cef6913d131565a",
-        "disposition": "Merged; head kept in lane 3's suite-speed tree."
-      },
-      {
-        "number": 174,
-        "state": "MERGED",
-        "merged_at": "2026-10-07T01:19:18Z",
-        "merge_commit": "5eb3d5f816f8ef81bda44ee8875bf62c56d95d6a",
-        "head_ref": "feat/lane-worktrees-residue",
-        "head_oid": "4ea84c8c8206347cef3cc5a626e79aee9e12b8c3",
-        "disposition": "Merged; head kept in lane 1's sweep-170 tree."
-      },
-      {
-        "number": 179,
-        "state": "MERGED",
-        "merged_at": "2026-10-07T02:08:55Z",
-        "merge_commit": "2fb854f12855079874f970eaee2cbee87bd97200",
-        "head_ref": "feat/lane-worktrees-residue-tests",
-        "head_oid": "6c79121ea0288ac495ea5d0cd856083059c631bb",
-        "disposition": "Merged; head kept in lane 1's ort-179-tests tree."
-      },
-      {
-        "number": 175,
-        "state": "MERGED",
-        "merged_at": "2026-10-07T04:26:10Z",
-        "merge_commit": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-        "head_ref": "feat/lane-end-closeout",
-        "head_oid": "5c05ab6272749df5a11ad68835aa3b737b6a4cdf",
-        "disposition": "Merged as the source commit c4864ac; lane 3's closeout-2 tip is an ancestor of its head."
-      }
-    ],
-    "register_facts_from_coordinator": {
-      "as_of": "2026-10-07T09:5xZ",
-      "open_prs": 0,
-      "lanes": "openRepoTools-1/2/3 idle, no writers except this migration's",
-      "installed_main_on_Eagle": "c4864ac5e59db49d01f638a80ed38daf1d788182"
-    },
-    "submodule": {
-      "path": "upstream/openRepoShape",
-      "gitlink_at_source": "39d5c986fcfac1a160474bfe91c5f1c37fccc72c",
-      "main_checkout_initialized": true,
-      "pinned_tree_sha256": "a44c0165beb9d3b6ddfce46925bf04b8d19934d5327b5a304b5f3f11af699b02",
-      "pinned_digest_matches_contract": true,
-      "target_commit": "7f84ca42ca86a8902928345109d2bf6bad87bd91",
-      "target_tree_sha256": "3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8",
-      "target_on_openreposhape_main": true,
-      "pin_bump_in_flight": "chore/openreposhape-pin-7f84ca4 at e43b2432976a22eb3bf8c419c96209399251d375 records the same target_tree_sha256; unpushed at capture, PR #188 after it."
-    },
-    "installed": {
-      "receipt_rows": 29,
-      "install_stamp": "2026-10-07T04:26:26Z",
-      "present": 29,
-      "missing": 0,
-      "sha256_matches_receipt": 29
-    },
-    "amendment_path_observations": [
-      {
-        "identity": "main",
-        "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/lane-worktrees-residue-tests",
-        "head": "6c79121ea0288ac495ea5d0cd856083059c631bb",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "fix/install-marker-on-every-file-and-one-install-lock",
-        "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "chore/openreposhape-pin-7f84ca4",
-        "head": "e43b2432976a22eb3bf8c419c96209399251d375",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "004-migrate-to-triad-exec",
-        "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "004-migrate-to-triad-rehearsal",
-        "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "fix/wip-init-step7-guarded-writes-and-step8-refusal-words",
-        "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "004-migrate-to-triad-reads",
-        "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/triad-lane-tooling",
-        "head": "c4864ac5e59db49d01f638a80ed38daf1d788182",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "001-separate-swap-ctx-handoff",
-        "head": "3c26041a4444a10bc240cb64a168ece4d9edf6c5",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "004-migrate-to-triad",
-        "head": "ff6f6a7c7b7921ca1e0b0234e898900f98532366",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/supervised-context-restart",
-        "head": "f13d32975d7457d662249385d23ee28a7f713c4c",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/claude-current",
-        "head": "11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/amendment-22-sql-primary",
-        "head": "2080f3d83520bd1ea5632e754026f8ba3df4eb1f",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/lane-end-closeout-rest",
-        "head": "ed3655184d90e1ac21848aa4c3e294327b9561b6",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/shell-suite-wall-time",
-        "head": "d2f80512902bf85b5993134a3cef6913d131565a",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      },
-      {
-        "identity": "feat/lane-worktrees-residue",
-        "head": "4ea84c8c8206347cef3cc5a626e79aee9e12b8c3",
-        "bounded_amendment_paths": [],
-        "working_bounded_amendment_paths": []
-      }
-    ],
-    "preservation": {
-      "record": "specs/004-migrate-to-triad/preservation-2026-10-07.md",
-      "backup_id": "prep-20261007T100559Z",
-      "backup_root_pattern": "<private-prep>/prep-<UTC stamp>/ (host-local on Eagle, beside prep-20261004T211123Z)",
-      "refs_bundled": 33,
-      "bundle_heads": 50,
-      "source_bundle_sha256": "60db3acd0753b3efde1ee6ae48d2c463e10fee57dbadcf8af543f12332c39c03",
-      "dependency_bundle_sha256": "aa5a6eca83897516331466c2904ec786be3cf423cac3d6647aad5760bfb8d7cb",
-      "manifest_files": 414,
-      "manifest_sha256": "2a46dff9c00b0eba300bd0ad49a5cf42578f741b1e4a3cca2568d9c2784e88ed",
-      "reachable_objects": 2902,
-      "reachable_object_ids_sha256": "338cb7bdd397076eeced1de0852eeb1510b4f97e02fb3f62de434531c7be327d",
-      "capture_stable": true,
-      "captured_worktrees": 17,
-      "all_worktrees_clean": true,
-      "workflow_config_files_preserved": 141,
-      "secret_like_paths_skipped": 0,
-      "all_ref_restore_verified": true,
-      "dependency_commits_restore_verified": true,
-      "worktree_snapshot_restores_verified": 17,
-      "restore_checks": {
-        "pass": 97,
-        "fail": 0
-      },
-      "private_receipt": "brett-wip migration/openRepoTools/prep-20261007T100559Z/",
-      "private_receipt_commit": "f0ea2df7d5c6d95c26413b68843451e953a50018"
-    },
-    "previous_private_backup": {
-      "backup_id": "prep-20261004T211123Z",
-      "present": true,
-      "top_level_entries": 25,
-      "size": "198M",
-      "git_filter_repo_wheel": "git_filter_repo-2.47.0-py3-none-any.whl",
-      "git_filter_repo_version_output": "a40bce548d2c",
-      "note": "Recorded read-only: listing, sizes and one --version print with bytecode writes disabled; no bundle opened; nothing modified."
-    },
-    "gate_a_complete": false,
-    "gate_b_complete": false,
-    "gate_a_open_items": [
-      "Owner dispositions for every retained object (proposals in the private receipt).",
-      "A final capture at the owner-coordinated freeze, after the migration's own writers stop.",
-      "Installed-file receipts for py-bench and any other profile or workstation."
-    ]
-  }
-}
diff --git a/specs/004-migrate-to-triad/patches/t006/assembly-0001-The-assembly-root-s-front-door-resolves-the-split-s-.patch b/specs/004-migrate-to-triad/patches/t006/assembly-0001-The-assembly-root-s-front-door-resolves-the-split-s-.patch
deleted file mode 100644
index b057d1a6..00000000
--- a/specs/004-migrate-to-triad/patches/t006/assembly-0001-The-assembly-root-s-front-door-resolves-the-split-s-.patch
+++ /dev/null
@@ -1,398 +0,0 @@
-From 1d783ce17a73317c3c7cc862cf17186aa7263c34 Mon Sep 17 00:00:00 2001
-From: Brett Heap <1513478+brettheap@users.noreply.github.com>
-Date: Fri, 9 Oct 2026 00:29:16 +0000
-Subject: [PATCH] The assembly root's front door resolves the split's
- collisions: AGENTS.md opens with the shape's pointer and a short map of the
- three repositories, README.md gains them and the lockstep invariant, and
- every path that crossed into a leg names that leg.
-
-Rehearsal patch for opensoft/openRepoTools#186, task T006 of
-specs/004-migrate-to-triad/tasks.md, against run C's rehearsed split
-69b8924. Nothing under shape/ and no file with a row in
-contracts/shape-pin.yaml is touched.
-
-- AGENTS.md: line 1 is the exact pointer that openRepoShape 7f84ca4's
-  SHAPE_POINTER_LINE and its adopt follow-up require. A seven-entry map
-  follows: spec, code, this root, the tests, the lane tooling's code and
-  manual, paired feature worktrees, and the local-rehearsal file-transport
-  flag. The original AGENTS.md comes after it, unchanged except for 16 path
-  repairs (docs/ -> spec/docs/, openspec/ -> spec/openspec/, and upstream/,
-  contracts/, tests/ and .github/ -> code/...). 316 -> 340 lines.
-- README.md: a "Three repositories" section and "The lockstep invariant",
-  which contracts/{spec,code}-pin.yaml's `resync_runbook:
-  README.md#the-lockstep-invariant` names and which only shape/README.md
-  carried. The install section now says the one-liner is unchanged and that
-  the installer is code/openRepoTools. 12 path repairs, and the pin-bump
-  block re-rooted with `cd code`. 486 -> 510 lines.
-- .gitignore: the shape's `.venv/` and `.DS_Store` merged in, and
-  `/worktrees/`, the line the three-leg bootstrap requires.
-- .gitattributes: the same `* text=auto eol=lf` rule, re-explained for this
-  root's pinned copies. The installer reason moved with its files to
-  code/.gitattributes.
-- CLAUDE.md is unchanged: "Read AGENTS.md." is byte-identical to the
-  shape's own rendered shape/CLAUDE.md.
-
-The two length caps in code/tests/test_repo_hygiene.py, 316 and 486, are
-today's counts. Once T009 points those tests at the assembly root, each cap
-is raised in a dated entry naming the rule its lines bought.
-
-Re-cut on 2026-10-19 (lane openRepoTools-1) against the root files
-#228's series leaves, 006-release-pypi-t025 b3aab89 with
-006-release-pypi-pr3fix c6cea2a merged in (neither main
-55aae16 nor 006-release-pypi d10cfb1 changes the four), and the
-.gitattributes block openRepoShape 190133d's split appends, headed
-`# openRepoShape (#471): ...`. Seven hunks had stopped applying where
-#227, #237 and #228 rewrote the lines around them: AGENTS.md's
-skip-no-lane-guard repair and its three under CI ruling 1, ruling 3 and
-the bash 3.2 paragraph, and README.md's install sentence and its
-`code/tests/run.sh` and `code/commands/swap.md` repairs. Each keeps its
-own lines, re-anchored one for one, so the repairs are still 16 and 13:
-ruling 1's `.github/workflows/tests.yml`, in the sentence #227 and #228
-rewrote, is one of them, and no other line added since names a path
-that crossed into a leg. .gitattributes' last paragraph no longer says
-no path is listed by name, because the #471 block after the rule names
-nine; it says the block stays last. AGENTS.md 330 -> 354 lines and
-README.md 505 -> 529; the assembly-root caps move with them in
-t009-assembly-caps.patch.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- .gitattributes | 44 +++++++++++++++------------------------
- .gitignore     |  6 ++++++
- AGENTS.md      | 56 +++++++++++++++++++++++++++++++++++---------------
- README.md      | 44 ++++++++++++++++++++++++++++++---------
- 4 files changed, 97 insertions(+), 53 deletions(-)
-
-diff --git a/.gitattributes b/.gitattributes
-index a9ac338..b27055e 100644
---- a/.gitattributes
-+++ b/.gitattributes
-@@ -1,33 +1,23 @@
--# THIS REPOSITORY'S OWN INSTALLER COMPARES ITS BYTES, so the bytes have to be
--# the same bytes on every platform.
-+# THE BYTES A CLONE SEES ARE THE BYTES THIS ROOT'S CHECKS DESCRIBE.
- #
--# `openRepoTools --install` decides between `installed at`, `updated at` and
--# `already installed … (unchanged)` with `cmp -s`, and
--# `tests/test_openrepotools_command.py` compares an installed copy to this
--# checkout's file BYTE FOR BYTE. Git for Windows' installer default is
--# `core.autocrlf=true`; a checkout of THIS repository made under it turns every
--# `\n` in `openRepoTools`, `park`, `resume` and `status` into `\r\n`, and every one
--# of those comparisons is about line endings rather than about content — a
--# second `--install` reporting three files `updated at` on a machine where
--# nothing changed, and a colleague whose only sin was cloning on a stock
--# Windows laptop watching the suite fail on lines nobody touched. CI never sees
--# it: the Linux and macOS jobs check out LF by default and the Windows job pins
--# `core.autocrlf=false`.
-+# `contracts/shape-pin.yaml` records a sha256 of every shape file copied here,
-+# and `scripts/validate-pins.py` recomputes each one from the bytes on disk.
-+# Git for Windows' installer default is `core.autocrlf=true`; a clone made under
-+# it writes CRLF into the worktree, and `make validate` then goes red on every
-+# pinned file for a colleague who did nothing but clone this repository
-+# (openRepoShape #51, ruled by Brett Heap on 2026-09-05; the shape's own
-+# statement of the rule is `shape/.gitattributes`, pinned and left in place).
- #
--# The same rule for a second reason. `tests/test_park_resume_commands.py`
--# asserts that `park`, `resume` and `status` carry the shared estate resolver
--# BYTE FOR BYTE — that is what makes the deliberate duplication safe — and a CRLF
--# checkout would either break the claim or hide a real drift behind it.
-+# Before the split into three repositories this file carried the same rule for
-+# a second reason: `openRepoTools --install` and its tests compare installed
-+# copies with the checkout BYTE FOR BYTE. Those files are the code leg's now,
-+# and a superproject's attributes never reach into a submodule's worktree, so
-+# that statement moved with them, word for word, to `code/.gitattributes`; the
-+# documents in `spec/` carry their own copy of the rule too.
- #
--# NO PATH IS LISTED BY NAME. Every file this repository ships is text — bash,
--# Python, YAML, Markdown, a workflow — so there is nothing for git's binary
--# heuristic to misjudge, and `text=auto` leaves that detection where it
--# belongs: with git. The pinned `upstream/openRepoShape` is a gitlink and
--# carries its own copy of this rule.
--#
--# openRepoShape #63 wrote this rule for the standard's own root, and its #51
--# (2026-09-05) wrote it for every scaffolded project; this is the same rule
--# retold for the repository that ships the two commands.
-+# NO PATH IS LISTED BY NAME in the rule below: every file here is text, so
-+# `text=auto` leaves binary detection with git. The block after the rule is
-+# the split's (openRepoShape #471), and it stays last: the later line wins.
- 
- * text=auto eol=lf
- # openRepoShape (#471): the pinned shape copies below check out with LF everywhere, as contracts/shape-pin.yaml records their bytes
-diff --git a/.gitignore b/.gitignore
-index a160f49..2d04abf 100644
---- a/.gitignore
-+++ b/.gitignore
-@@ -1,3 +1,9 @@
- __pycache__/
- *.py[cod]
- .pytest_cache/
-+# Merged from the shape's copy, `shape/.gitignore` (pinned, left in place).
-+.venv/
-+.DS_Store
-+# Paired feature worktrees, `worktrees/<NNN-feature>/{spec,code}/`: linked
-+# worktrees of the two legs, machine plumbing, never committed to this root.
-+/worktrees/
-diff --git a/AGENTS.md b/AGENTS.md
-index 47165cb..e8a0388 100644
---- a/AGENTS.md
-+++ b/AGENTS.md
-@@ -1,3 +1,27 @@
-+Read AGENTS-shape.md first — the rules of this repository's shape.
-+
-+This is the assembly root of a three-repository project. The text after
-+this list is what this repository said before the split, each path re-pointed
-+at the leg that now holds it; a path beginning `spec/` or `code/` is relative
-+to this root.
-+
-+- **`spec/`**, `opensoft/openRepoTools-spec`: `openspec/`, `specs/`, `docs/`
-+  (the manuals) and `ideation/`; `openspec` runs there.
-+- **`code/`**, `opensoft/openRepoTools-code`: every command
-+  `openRepoTools --install` places, `repos.tsv`, `commands/`, `skills/`,
-+  `tests/`, its CI, and the pinned standard at `code/upstream/openRepoShape`.
-+- **This root**: the front door, `project.yaml`, the leg pins and the gate
-+  (`make validate`); no product code.
-+- **Tests**: `code/tests/run.sh` from here, or `tests/run.sh` inside `code/`.
-+- **The lane tooling**: its code is in `code/`; its manual is
-+  `spec/docs/README-lanes.md` (`docs/README-lanes.md` in the spec leg).
-+- **Feature work**: paired worktrees `worktrees/<NNN-feature>/{spec,code}/`,
-+  never committed here; full proposals and Speckit files in `spec`, a genuine
-+  bounded amendment only in `code`'s `features/<NNN-feature>/openspec/`.
-+- **A local rehearsal** whose `.gitmodules` names bare repositories on disk
-+  needs `git -c protocol.file.allow=always submodule update --init
-+  --recursive`; the real legs are https and need no flag.
-+
- # Working in openRepoTools
- 
- Three estate commands, `park`, `resume` and `status`; the lane tooling
-@@ -19,7 +43,7 @@ person is driving the two INSTALLED commands.
- 
- The lane tooling answers to a different document — the lane collision protocol
- at `$AGENT_PROTOCOL_ROOT/protocols/lane-collision-protocol.md` and its
--amendments — and `docs/README-lanes.md` is its manual. **The code is here; the
-+amendments — and `spec/docs/README-lanes.md` is its manual. **The code is here; the
- data is not.**
- 
- **A LANE HAS ONE BINDING** (Amendment 18, in force 2026-09-14): the `host`,
-@@ -41,7 +65,7 @@ handoffs through `$AGENT_PROTOCOL_ROOT/workspace.yaml`'s `repository:` and
- unreadable workspace with **2**: only 2 blocks a prompt; 1 would let it through.
- Profile-only guard calls carrying exact `CLAUDE_NO_LANE=1` return 0 before input
- or identity probes, even with unreadable configuration; other values enforce.
--Brett Heap directed this exception in `openspec/changes/skip-no-lane-guard/`;
-+Brett Heap directed this exception in `spec/openspec/changes/skip-no-lane-guard/`;
- Shared hooks stay installed while `~/projects/xFactory/lanes-edit.sh` answers `guard`; until then they are deferred and our guard entry taken out (#237):
- 29 artifacts always, plus those two. Exit 1 means *registry not found* in lane tooling, and *findings were printed* in estate status; identify the command before interpreting it.
- 
-@@ -206,13 +230,13 @@ which is where `make siblings` moves a holder; `status` names both as a finding.
-    reads them all WITHOUT asking, because a read — fetched or not — moves
-    nothing of yours; `status --all` from anywhere says the same thing.
- 
--## The pinned standard at `upstream/openRepoShape`
-+## The pinned standard at `code/upstream/openRepoShape`
- 
- The suite builds real estates out of eight of openRepoShape's own files, and it
--reads them out of a submodule pinned by `contracts/openreposhape-pin.yaml`.
-+reads them out of a submodule pinned by `code/contracts/openreposhape-pin.yaml`.
- Three rules, and none of them is negotiable:
- 
--1. **Never edit anything under `upstream/openRepoShape` in place.** It is
-+1. **Never edit anything under `code/upstream/openRepoShape` in place.** It is
-    somebody else's repository, checked out detached at a commit. A change the
-    standard needs is a pull request THERE, then a pin bump here.
- 2. **Never pin a commit that is not on that repository's `main`.**
-@@ -220,17 +244,17 @@ Three rules, and none of them is negotiable:
-    pull request lands and the next person's fetch of it 404s. Check with
-    `gh api repos/opensoft/openRepoShape/compare/main...<sha>` — `identical` or
-    `behind`.
--3. **The digest is RECOMPUTED, never adjusted.** `contracts/openreposhape-pin.yaml`
-+3. **The digest is RECOMPUTED, never adjusted.** `code/contracts/openreposhape-pin.yaml`
-    carries the bump command. A `tree_sha256` edited to make
--   `tests/test_upstream_pin.py` pass records this checkout as the upstream,
-+   `code/tests/test_upstream_pin.py` pass records this checkout as the upstream,
-    which is the one thing the row exists to prevent. The pin file and the
-    gitlink move in ONE commit.
- 
- ## Testing your changes to this repository
- 
- ```sh
--git submodule update --init upstream/openRepoShape
--tests/run.sh                      # the suite, serialized — pass any pytest argument
-+git -C code submodule update --init upstream/openRepoShape
-+code/tests/run.sh                 # the suite, serialized — pass any pytest argument
- ```
- 
- Brett Heap's RULING of 2026-09-16 ("do all three", on the coordinator's three
-@@ -241,7 +265,7 @@ suite queuing up to 1h20 behind the workstation lock described below):
- 1. **`TESTS-MACOS` LEFT THE PER-PUSH GATE, AND THEN LEFT CI.** This ruling moved
-    `tests-macos` behind the `ready` label; Brett Heap's decision of 2026-10-15,
-    for the whole estate, to run the suite on Linux only, removed `tests-macos`,
--   `tests-windows` and `parse-macos`. `.github/workflows/tests.yml` runs
-+   `tests-windows` and `parse-macos`. `code/.github/workflows/tests.yml` runs
-    `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, all on
-    ubuntu — on `pull_request`, push to `main` and `release/v*`, nightly at
-    04:17Z and `workflow_dispatch`. From PR 3 (#228) on, the release workflow's
-@@ -251,10 +275,10 @@ suite queuing up to 1h20 behind the workstation lock described below):
-    and two are taken; a finding after that is filed as an issue and the PR
-    lands regardless.
- 3. **CI IS THE SUITE OF RECORD.** A writer runs the shell-suite section they
--   touched locally — `bash tests/test_lane_helpers.sh` in full is fine when
--   the box is quiet — and the full local `tests/run.sh` behind the
-+   touched locally — `bash code/tests/test_lane_helpers.sh` in full is fine when
-+   the box is quiet — and the full local `code/tests/run.sh` behind the
-    workstation lock is no longer required before a push: CI's `tests` job is
--   the footer of record. `tests/run.sh` stays exactly as it is above: how to
-+   the footer of record. `code/tests/run.sh` stays exactly as it is above: how to
-    run the whole suite locally, serialized, whenever a person wants that answer
-    anyway, and `python3 -m pytest tests -q` by hand — unserialized against every
-    other lane on the same workstation — is still the thing it exists to stop.
-@@ -288,14 +312,14 @@ while [ "$(pgrep -f "$pat" | awk 'END { print NR + 0 }')" -gt 0 ]; do sleep 20;
- PYTHONPYCACHEPREFIX="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache" flock "${TMPDIR:-/tmp}/openrepotools-pytest.lock" python3 -m pytest tests -q -p no:cacheprovider
- ```
- 
--`awk` AND NOT `pgrep -fc`, which is what `tests/run.sh` does and for the reason
-+`awk` AND NOT `pgrep -fc`, which is what `code/tests/run.sh` does and for the reason
- it gives: `-c` is not in every `pgrep` this repository runs under, and the
- count — never `pgrep`'s exit status — is what decides. The wrapper is the
- canonical implementation of this guard; the lines above are it in one place for
- a person with no checkout in front of them.
- 
--`tests/test_lane_helpers.sh` is 122 KB of bash that arrived with the move;
--`tests/test_lane_helpers_suite.py` is what makes `pytest` run it, so it is one
-+`code/tests/test_lane_helpers.sh` is 122 KB of bash that arrived with the move;
-+`code/tests/test_lane_helpers_suite.py` is what makes `pytest` run it, so it is one
- slow test rather than no test at all. Everything shipped here is written for
- macOS **bash 3.2**, where `${x,,}`, `mapfile`, `declare -A` and `local -n` are
- syntax errors — write `tr '[:upper:]' '[:lower:]'` and a loop. No `tests.yml`
-diff --git a/README.md b/README.md
-index ae0a60f..6344b31 100644
---- a/README.md
-+++ b/README.md
-@@ -101,6 +101,25 @@ parked. No config, or no record, is a note.
- That is all five layers: the local layer, `--fetch`, the fork, the pin and
- the record.
- 
-+## Three repositories
-+
-+This is the ASSEMBLY ROOT of a three-repository project, the shape
-+[openRepoShape](https://github.com/opensoft/openRepoShape) calls the Triad: it
-+holds this front door, `project.yaml`, the pins and the gate, and mounts
-+`opensoft/openRepoTools-spec` at `spec/` (`openspec/`, `specs/`, the manuals in
-+`docs/`, `ideation/`) and `opensoft/openRepoTools-code` at `code/` (every
-+command below, `repos.tsv`, `skills/`, `commands/`, `tests/`, CI and the pinned
-+standard). Clone it with `git clone --recurse-submodules` and run
-+`make bootstrap`. Nothing a person types changes, and a path in this file that
-+begins `spec/` or `code/` is relative to this root.
-+
-+### The lockstep invariant
-+
-+A leg's gitlink, `commit:` in `contracts/<role>-pin.yaml` and every workflow
-+`@<sha>` naming that leg move in ONE commit here, after the leg's own pull
-+request lands: openRepoShape's `scripts/bump-leg.py` writes it, and
-+`make pins` refuses when the three disagree.
-+
- ## The lane tooling
- 
- `lane-start`, `lane-end`, `lanes-edit.sh` and `link-estates` are here too, with
-@@ -154,7 +173,7 @@ and 5 put it and where it stays. What moved here is the CODE. A `<user>-wip` is
- a private repository whose own rules file says "No secrets and no code", nobody
- would look inside somebody else's for a command, and until this move the four
- helpers existed in exactly one place in the world: one person's private
--repository. `docs/README-lanes.md` is the manual; `docs/README-claude-current.md` is the one for the Claude Code `lane-start` launches and the RESTART NEEDED line.
-+repository. `spec/docs/README-lanes.md` is the manual; `spec/docs/README-claude-current.md` is the one for the Claude Code `lane-start` launches and the RESTART NEEDED line.
- 
- Every one of them finds that data through `$AGENT_PROTOCOL_ROOT/workspace.yaml`
- — `repository:` and `path:`, the same pointer file `resume` and `status`
-@@ -180,7 +199,7 @@ different hat).
- 
- Then it clones the repository, seeds it from openRepoShape's
- `templates/workspace-root/` at the commit pinned in
--`contracts/openreposhape-pin.yaml`, and pushes one commit to `main` — **which is
-+`code/contracts/openreposhape-pin.yaml`, and pushes one commit to `main` — **which is
- also the check that matters**: a new repository is inside the organisation's
- PR-only ruleset until an administrator excludes it, and until it is, every
- register write will be refused by that gate. Better to meet it here than at
-@@ -237,6 +256,10 @@ gh api repos/opensoft/openRepoTools/contents/openRepoTools \
-     -H 'Accept: application/vnd.github.raw' | bash -s -- --install
- ```
- 
-+Both lines are unchanged by the split: the `openRepoTools` they fetch is this
-+root's entry point, which hands over to the installer `code/openRepoTools` at
-+the commit this root pins.
-+
- A workstation uses ONE install route or the other, never both — pipx's `openrepotools`
- or workBenches' `./setup.sh` — until opensoft/workBenches#165 lets its
- `scripts/setup-estate-commands.sh` accept pipx's link (Brett Heap's decision of 2026-10-18).
-@@ -266,7 +289,7 @@ its write bit. A refusal creates none of those directories either. `cp` follows
- a symlink, and an install through one leaves the command uninstalled and writes
- these bytes into whatever it points at. The ONE link it skips instead is pipx's,
- at `openRepoTools` (below). Then a `17 of 17 placed in <dir>` line,
--and the `export PATH=…` line if that directory is not on your `PATH`. Last, it names this repository's virtual environment, `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/venvs/openRepoTools/` (one per repository, outside the estate; #162), says whether it is there, and prints the two commands that make it: it never makes one, and `tests/run.sh` runs from it once it has `pytest`.
-+and the `export PATH=…` line if that directory is not on your `PATH`. Last, it names this repository's virtual environment, `${XDG_CACHE_HOME:-~/.cache}/openRepoTools/venvs/openRepoTools/` (one per repository, outside the estate; #162), says whether it is there, and prints the two commands that make it: it never makes one, and `code/tests/run.sh` runs from it once it has `pytest`.
- 
- **Beside pipx's link it places SIXTEEN and leaves the seventeenth to pipx.** A
- `<dir>/openRepoTools` that is a link into pipx's `openrepotools` environment is
-@@ -316,7 +339,7 @@ Twenty-nine artifacts always, plus the two hook entries once the path they call
- answers `guard` (#237), and the count is the invariant. Beside pipx's link it is
- TWENTY-EIGHT placed always, one left to pipx and 28 receipt rows, with the hook
- pair still on top once that path answers. The count was sixteen until A11
--Addendum 4 ruling 9 gave `--install` a command-file list and `commands/swap.md`
-+Addendum 4 ruling 9 gave `--install` a command-file list and `code/commands/swap.md`
- in it, at the same pair of paths a skill takes — because `opensoft/workBenches#74`
- deletes the launcher's copy and `/swap` would otherwise be installed by nobody;
- eighteen until Amendment 12 adoption act 3 added the name guard's entry; and
-@@ -434,19 +457,19 @@ exactly as it is for openRepoShape's `setup.sh`.
- 
- **Tools depend on the shape; the shape depends on nothing.** This repository
- pins the openRepoShape commit its tests were verified against, as a submodule
--at `upstream/openRepoShape` recorded in `contracts/openreposhape-pin.yaml`.
-+at `code/upstream/openRepoShape` recorded in `code/contracts/openreposhape-pin.yaml`.
- openRepoShape pins this repository NOWHERE, and knows of it only through one
- pointer line its own `--install` prints — text, not a fetch. The reverse would
- make the standard unbuildable without its tools.
- 
--MOUNTED, NOT COPIED. `tests/test_park_resume_commands.py` builds real estates
-+MOUNTED, NOT COPIED. `code/tests/test_park_resume_commands.py` builds real estates
- out of EIGHT of the standard's own files — the two root Makefiles, their two
- `.gitignore`s, the two `bootstrap.py`s, `siblings.py` and
- `scripts/repo_shape.py` — and a submodule hands those tests the standard's real
- bytes at the pinned commit rather than copies here that could have been edited
- into agreeing with a broken expectation.
- 
--`tests/test_upstream_pin.py` is what says the pin file and the gitlink still
-+`code/tests/test_upstream_pin.py` is what says the pin file and the gitlink still
- agree. Four of its checks need no submodule at all — the gitlink is read out of
- `git ls-tree HEAD` and nothing imports from the checkout — so the lockstep
- check bites in a clone that never materialized it.
-@@ -454,6 +477,7 @@ check bites in a clone that never materialized it.
- ### Bumping the pin
- 
- ```sh
-+cd code                       # the pin and the gitlink are the code leg's
- git -C upstream/openRepoShape fetch origin
- git -C upstream/openRepoShape checkout <40 hex on openRepoShape's main>
- python3 -c "import sys; sys.path.insert(0, 'upstream/openRepoShape/scripts'); from repo_shape import tree_digest; print(tree_digest('upstream/openRepoShape', 'HEAD'))"
-@@ -466,7 +490,7 @@ git commit
- **The edit comes before the `git add`, and the block is in that order for a
- reason.** Staging first and editing after stages the moved gitlink with the OLD
- pin file — and that is invisible where you are standing, because
--`tests/test_upstream_pin.py` reads the pin out of the WORKING TREE and the
-+`code/tests/test_upstream_pin.py` reads the pin out of the WORKING TREE and the
- gitlink out of `git ls-tree HEAD`: green in your checkout, red in CI, which is
- the wrong way round. The pin and the gitlink are one fact in two places. The
- digest is recomputed with the PINNED CHECKOUT'S OWN `scripts/repo_shape.py`
-@@ -481,10 +505,10 @@ orphaned and the next person's fetch of it 404s.
- 
- ```sh
- git clone --recurse-submodules https://github.com/opensoft/openRepoTools.git
--cd openRepoTools && python3 -m pytest tests -q
-+cd openRepoTools/code && python3 -m pytest tests -q
- ```
- 
--From a clone that already exists, `git submodule update --init
-+From a clone that already exists, `git -C code submodule update --init
- upstream/openRepoShape` first. **Without the submodule the suite SKIPS rather
- than fails**, naming that command: a fork's first `pytest` going red on a
- missing submodule is a fork nobody finishes. The estate tests need `bash`,
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t006/assembly-0002-Bump-spec-leg-to-39c18877e042-in-openRepoTools.patch b/specs/004-migrate-to-triad/patches/t006/assembly-0002-Bump-spec-leg-to-39c18877e042-in-openRepoTools.patch
deleted file mode 100644
index c0d9ea5d..00000000
--- a/specs/004-migrate-to-triad/patches/t006/assembly-0002-Bump-spec-leg-to-39c18877e042-in-openRepoTools.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 1024f186cce1b0c03a295ae6514c43ce6fd52a31 Mon Sep 17 00:00:00 2001
-From: openRepoShape bump-leg <bump-leg@openreposhape.invalid>
-Date: Fri, 9 Oct 2026 00:29:17 +0000
-Subject: [PATCH 2/3] Bump spec leg to 39c18877e042 in openRepoTools
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-593250d600ca -> 39c18877e042, tree 3a4a84beb20b343390f5bae64cb166df4d0cfd693baff6309fc13c8060d1c866.
-
-No workflow reference names this leg, so the gitlink and the pin file are the whole of it.
-
-The gitlink at spec, `commit:` and `digests.tree_sha256` in contracts/spec-pin.yaml, and every workflow reference to opensoft/openRepoTools-spec move in ONE commit because `scripts/validate-pins.py` refuses when they disagree — a gitlink advanced alone is red on the next pull request, and on somebody else's change.
-
-Written by openRepoShape's `scripts/bump-leg.py`; the digest is recomputed from the leg's own objects, not adjusted.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- contracts/spec-pin.yaml | 4 ++--
- spec                    | 2 +-
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/contracts/spec-pin.yaml b/contracts/spec-pin.yaml
-index 65f8736..af1d2f7 100644
---- a/contracts/spec-pin.yaml
-+++ b/contracts/spec-pin.yaml
-@@ -21,7 +21,7 @@ leg_role: spec
- source_repository: opensoft/openRepoTools-spec
- submodule_path: spec
- 
--commit: "593250d600ca291f610671d993c2a6fc36cd690e"
-+commit: "39c18877e042e13156849b861d07bc3c92e64db4"
- revision_kind: commit
- 
- digest_algorithm: sha256
-@@ -36,7 +36,7 @@ digest_algorithm: sha256
- # <oid>`, so a leg's own pin moving is drift too.
- digest_definition: sorted-ls-tree-r-v1
- digests:
--  tree_sha256: "92da0a8a72f8a9ed3c8827b63e2c39b1734bc1e5418612e2fa41e40b2f148b45"
-+  tree_sha256: "3a4a84beb20b343390f5bae64cb166df4d0cfd693baff6309fc13c8060d1c866"
- 
- verify_pin: scripts/validate-pins.py
- resync_runbook: "README.md#the-lockstep-invariant"
-diff --git a/spec b/spec
-index 593250d..39c1887 160000
---- a/spec
-+++ b/spec
-@@ -1 +1 @@
--Subproject commit 593250d600ca291f610671d993c2a6fc36cd690e
-+Subproject commit 39c18877e042e13156849b861d07bc3c92e64db4
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t006/assembly-0003-Bump-code-leg-to-6169e8e96164-in-openRepoTools.patch b/specs/004-migrate-to-triad/patches/t006/assembly-0003-Bump-code-leg-to-6169e8e96164-in-openRepoTools.patch
deleted file mode 100644
index a7eb0ad2..00000000
--- a/specs/004-migrate-to-triad/patches/t006/assembly-0003-Bump-code-leg-to-6169e8e96164-in-openRepoTools.patch
+++ /dev/null
@@ -1,55 +0,0 @@
-From 3e87e3941ff947d8160fa7d8b6204670af7926df Mon Sep 17 00:00:00 2001
-From: openRepoShape bump-leg <bump-leg@openreposhape.invalid>
-Date: Fri, 9 Oct 2026 00:29:18 +0000
-Subject: [PATCH 3/3] Bump code leg to 6169e8e96164 in openRepoTools
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-73b04d637634 -> 6169e8e96164, tree 697a080f3e86d368c31b82daf9088ee834537db6f3f49888dfcc7aa9c9ecfb4f.
-
-No workflow reference names this leg, so the gitlink and the pin file are the whole of it.
-
-The gitlink at code, `commit:` and `digests.tree_sha256` in contracts/code-pin.yaml, and every workflow reference to opensoft/openRepoTools-code move in ONE commit because `scripts/validate-pins.py` refuses when they disagree — a gitlink advanced alone is red on the next pull request, and on somebody else's change.
-
-Written by openRepoShape's `scripts/bump-leg.py`; the digest is recomputed from the leg's own objects, not adjusted.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- code                    | 2 +-
- contracts/code-pin.yaml | 4 ++--
- 2 files changed, 3 insertions(+), 3 deletions(-)
-
-diff --git a/code b/code
-index 73b04d6..6169e8e 160000
---- a/code
-+++ b/code
-@@ -1 +1 @@
--Subproject commit 73b04d637634f897ad24e22ee4c12bed287172d6
-+Subproject commit 6169e8e9616425ce93a49447af5df426f4325312
-diff --git a/contracts/code-pin.yaml b/contracts/code-pin.yaml
-index 68e06c8..18b44c7 100644
---- a/contracts/code-pin.yaml
-+++ b/contracts/code-pin.yaml
-@@ -21,7 +21,7 @@ leg_role: code
- source_repository: opensoft/openRepoTools-code
- submodule_path: code
- 
--commit: "73b04d637634f897ad24e22ee4c12bed287172d6"
-+commit: "6169e8e9616425ce93a49447af5df426f4325312"
- revision_kind: commit
- 
- digest_algorithm: sha256
-@@ -36,7 +36,7 @@ digest_algorithm: sha256
- # <oid>`, so a leg's own pin moving is drift too.
- digest_definition: sorted-ls-tree-r-v1
- digests:
--  tree_sha256: "b4940a13bd8ecbe2d1c6ed49368d1545d1a5f1f7a92623c7fe11ac1cb3617604"
-+  tree_sha256: "697a080f3e86d368c31b82daf9088ee834537db6f3f49888dfcc7aa9c9ecfb4f"
- 
- verify_pin: scripts/validate-pins.py
- resync_runbook: "README.md#the-lockstep-invariant"
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t006/code-0001-The-code-leg-gets-its-own-front-door-the-shape-s-leg.patch b/specs/004-migrate-to-triad/patches/t006/code-0001-The-code-leg-gets-its-own-front-door-the-shape-s-leg.patch
deleted file mode 100644
index 2d2dc029..00000000
--- a/specs/004-migrate-to-triad/patches/t006/code-0001-The-code-leg-gets-its-own-front-door-the-shape-s-leg.patch
+++ /dev/null
@@ -1,417 +0,0 @@
-From 6169e8e9616425ce93a49447af5df426f4325312 Mon Sep 17 00:00:00 2001
-From: Brett Heap <1513478+brettheap@users.noreply.github.com>
-Date: Thu, 8 Oct 2026 21:41:17 +0000
-Subject: [PATCH] The code leg gets its own front door: the shape's leg
- AGENTS.md, CLAUDE.md and README.md, and the LF rule, ignore list and licence
- it lost when the root kept them.
-
-Rehearsal patch for opensoft/openRepoTools#186, task T006 of
-specs/004-migrate-to-triad/tasks.md, against run C's code leg 73b04d6. The
-split left this leg with no AGENTS.md, CLAUDE.md, README.md, LICENSE,
-.gitattributes or .gitignore, because all six stayed in the assembly root,
-and a superproject's attributes and ignore rules never reach into a
-submodule's worktree.
-
-- AGENTS.md, CLAUDE.md and README.md are openRepoShape 7f84ca4's
-  templates/code-root/ files, rendered by its own copy_tree with this
-  project's names, so the leg-clone detector in scripts/shape_advisory.py
-  recognises them. Each AGENTS.md and README.md then adds one short section:
-  where the suite runs, the pinned standard, where the manuals and the
-  specifications now live, and where a feature's code and a bounded
-  amendment are written.
-- .gitattributes is the monorepo's own file, byte for byte (blob 3560973).
-  Its reason, the installer's byte-for-byte comparisons, is this leg's.
-  `git add --renormalize .` changes nothing here.
-- .gitignore is the shape's templates/code-root/.gitignore, a superset of
-  the three lines the monorepo ignored.
-- LICENSE is the root's Apache-2.0 text, byte for byte (blob 261eeb9).
-
-No executable, test or workflow is touched.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- .gitattributes |  32 ++++++++
- .gitignore     |  12 +++
- AGENTS.md      |  40 ++++++++++
- CLAUDE.md      |   1 +
- LICENSE        | 201 +++++++++++++++++++++++++++++++++++++++++++++++++
- README.md      |  45 +++++++++++
- 6 files changed, 331 insertions(+)
- create mode 100644 .gitattributes
- create mode 100644 .gitignore
- create mode 100644 AGENTS.md
- create mode 100644 CLAUDE.md
- create mode 100644 LICENSE
- create mode 100644 README.md
-
-diff --git a/.gitattributes b/.gitattributes
-new file mode 100644
-index 0000000..3560973
---- /dev/null
-+++ b/.gitattributes
-@@ -0,0 +1,32 @@
-+# THIS REPOSITORY'S OWN INSTALLER COMPARES ITS BYTES, so the bytes have to be
-+# the same bytes on every platform.
-+#
-+# `openRepoTools --install` decides between `installed at`, `updated at` and
-+# `already installed … (unchanged)` with `cmp -s`, and
-+# `tests/test_openrepotools_command.py` compares an installed copy to this
-+# checkout's file BYTE FOR BYTE. Git for Windows' installer default is
-+# `core.autocrlf=true`; a checkout of THIS repository made under it turns every
-+# `\n` in `openRepoTools`, `park`, `resume` and `status` into `\r\n`, and every one
-+# of those comparisons is about line endings rather than about content — a
-+# second `--install` reporting three files `updated at` on a machine where
-+# nothing changed, and a colleague whose only sin was cloning on a stock
-+# Windows laptop watching the suite fail on lines nobody touched. CI never sees
-+# it: the Linux and macOS jobs check out LF by default and the Windows job pins
-+# `core.autocrlf=false`.
-+#
-+# The same rule for a second reason. `tests/test_park_resume_commands.py`
-+# asserts that `park`, `resume` and `status` carry the shared estate resolver
-+# BYTE FOR BYTE — that is what makes the deliberate duplication safe — and a CRLF
-+# checkout would either break the claim or hide a real drift behind it.
-+#
-+# NO PATH IS LISTED BY NAME. Every file this repository ships is text — bash,
-+# Python, YAML, Markdown, a workflow — so there is nothing for git's binary
-+# heuristic to misjudge, and `text=auto` leaves that detection where it
-+# belongs: with git. The pinned `upstream/openRepoShape` is a gitlink and
-+# carries its own copy of this rule.
-+#
-+# openRepoShape #63 wrote this rule for the standard's own root, and its #51
-+# (2026-09-05) wrote it for every scaffolded project; this is the same rule
-+# retold for the repository that ships the two commands.
-+
-+* text=auto eol=lf
-diff --git a/.gitignore b/.gitignore
-new file mode 100644
-index 0000000..2fb4cee
---- /dev/null
-+++ b/.gitignore
-@@ -0,0 +1,12 @@
-+__pycache__/
-+*.py[cod]
-+.pytest_cache/
-+.mypy_cache/
-+.ruff_cache/
-+*.egg-info/
-+.venv/
-+venv/
-+.DS_Store
-+*.swp
-+.idea/
-+.vscode/
-diff --git a/AGENTS.md b/AGENTS.md
-new file mode 100644
-index 0000000..810eac1
---- /dev/null
-+++ b/AGENTS.md
-@@ -0,0 +1,40 @@
-+This is the **code leg** of openRepoTools (`openrepotools`): the implementation
-+and its tests.
-+
-+**The project's rules are not here.** They are in the assembly root
-+`opensoft/openRepoTools`, in `AGENTS-shape.md` — read that before touching anything
-+that spans the legs. This leg is mounted there at `code/`, and the other leg,
-+`opensoft/openRepoTools-spec`, beside it at `../spec/`, once the root is cloned with
-+`--recurse-submodules`.
-+
-+Working here is ordinary — an ordinary repository on an ordinary branch. What
-+advancing this leg does NOT do is advance the project: that is ONE commit in
-+`opensoft/openRepoTools` moving the gitlink, `contracts/code-pin.yaml` and every
-+workflow `@<sha>` for this leg together.
-+
-+Being the code leg confers no authority over the implementation. The split is
-+navigation.
-+
-+## What is particular to openRepoTools' code leg
-+
-+The project's own instructions — driving `park`, `resume` and `status`, the
-+lane tooling's protocol, the pinned standard's three rules, how to test and the
-+CI policy — are the assembly root's `AGENTS.md`, and they govern here. This
-+section adds only what standing in this leg changes.
-+
-+- **The suite runs here**: `git submodule update --init upstream/openRepoShape`,
-+  then `tests/run.sh`, which serializes every lane on a workstation behind
-+  `${TMPDIR:-/tmp}/openrepotools-pytest.lock` and passes any pytest argument on.
-+- **The pinned standard is here**: `upstream/openRepoShape`, recorded in
-+  `contracts/openreposhape-pin.yaml`. Never edit it in place, never pin a commit
-+  that is not on openRepoShape's `main`, and recompute the digest rather than
-+  adjust it — the root `AGENTS.md` gives the three rules in full.
-+- **The manuals and the specifications are not here.** They are the spec
-+  leg's `docs/` (`README-lanes.md`, `README-claude-current.md`), `openspec/` and
-+  `specs/`: `../spec/` when this leg is mounted in the assembly root, and
-+  `opensoft/openRepoTools-spec` when it is cloned on its own.
-+- **A feature's code is written in its code worktree**,
-+  `worktrees/<NNN-feature>/code/` under the assembly root, on the feature's
-+  branch. A genuine bounded amendment to an approved spec baseline is recorded
-+  in that worktree's `features/<NNN-feature>/openspec/`; a full proposal never
-+  is, and goes to the spec leg.
-diff --git a/CLAUDE.md b/CLAUDE.md
-new file mode 100644
-index 0000000..5d30268
---- /dev/null
-+++ b/CLAUDE.md
-@@ -0,0 +1 @@
-+Read AGENTS.md.
-diff --git a/LICENSE b/LICENSE
-new file mode 100644
-index 0000000..261eeb9
---- /dev/null
-+++ b/LICENSE
-@@ -0,0 +1,201 @@
-+                                 Apache License
-+                           Version 2.0, January 2004
-+                        http://www.apache.org/licenses/
-+
-+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-+
-+   1. Definitions.
-+
-+      "License" shall mean the terms and conditions for use, reproduction,
-+      and distribution as defined by Sections 1 through 9 of this document.
-+
-+      "Licensor" shall mean the copyright owner or entity authorized by
-+      the copyright owner that is granting the License.
-+
-+      "Legal Entity" shall mean the union of the acting entity and all
-+      other entities that control, are controlled by, or are under common
-+      control with that entity. For the purposes of this definition,
-+      "control" means (i) the power, direct or indirect, to cause the
-+      direction or management of such entity, whether by contract or
-+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-+      outstanding shares, or (iii) beneficial ownership of such entity.
-+
-+      "You" (or "Your") shall mean an individual or Legal Entity
-+      exercising permissions granted by this License.
-+
-+      "Source" form shall mean the preferred form for making modifications,
-+      including but not limited to software source code, documentation
-+      source, and configuration files.
-+
-+      "Object" form shall mean any form resulting from mechanical
-+      transformation or translation of a Source form, including but
-+      not limited to compiled object code, generated documentation,
-+      and conversions to other media types.
-+
-+      "Work" shall mean the work of authorship, whether in Source or
-+      Object form, made available under the License, as indicated by a
-+      copyright notice that is included in or attached to the work
-+      (an example is provided in the Appendix below).
-+
-+      "Derivative Works" shall mean any work, whether in Source or Object
-+      form, that is based on (or derived from) the Work and for which the
-+      editorial revisions, annotations, elaborations, or other modifications
-+      represent, as a whole, an original work of authorship. For the purposes
-+      of this License, Derivative Works shall not include works that remain
-+      separable from, or merely link (or bind by name) to the interfaces of,
-+      the Work and Derivative Works thereof.
-+
-+      "Contribution" shall mean any work of authorship, including
-+      the original version of the Work and any modifications or additions
-+      to that Work or Derivative Works thereof, that is intentionally
-+      submitted to Licensor for inclusion in the Work by the copyright owner
-+      or by an individual or Legal Entity authorized to submit on behalf of
-+      the copyright owner. For the purposes of this definition, "submitted"
-+      means any form of electronic, verbal, or written communication sent
-+      to the Licensor or its representatives, including but not limited to
-+      communication on electronic mailing lists, source code control systems,
-+      and issue tracking systems that are managed by, or on behalf of, the
-+      Licensor for the purpose of discussing and improving the Work, but
-+      excluding communication that is conspicuously marked or otherwise
-+      designated in writing by the copyright owner as "Not a Contribution."
-+
-+      "Contributor" shall mean Licensor and any individual or Legal Entity
-+      on behalf of whom a Contribution has been received by Licensor and
-+      subsequently incorporated within the Work.
-+
-+   2. Grant of Copyright License. Subject to the terms and conditions of
-+      this License, each Contributor hereby grants to You a perpetual,
-+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-+      copyright license to reproduce, prepare Derivative Works of,
-+      publicly display, publicly perform, sublicense, and distribute the
-+      Work and such Derivative Works in Source or Object form.
-+
-+   3. Grant of Patent License. Subject to the terms and conditions of
-+      this License, each Contributor hereby grants to You a perpetual,
-+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-+      (except as stated in this section) patent license to make, have made,
-+      use, offer to sell, sell, import, and otherwise transfer the Work,
-+      where such license applies only to those patent claims licensable
-+      by such Contributor that are necessarily infringed by their
-+      Contribution(s) alone or by combination of their Contribution(s)
-+      with the Work to which such Contribution(s) was submitted. If You
-+      institute patent litigation against any entity (including a
-+      cross-claim or counterclaim in a lawsuit) alleging that the Work
-+      or a Contribution incorporated within the Work constitutes direct
-+      or contributory patent infringement, then any patent licenses
-+      granted to You under this License for that Work shall terminate
-+      as of the date such litigation is filed.
-+
-+   4. Redistribution. You may reproduce and distribute copies of the
-+      Work or Derivative Works thereof in any medium, with or without
-+      modifications, and in Source or Object form, provided that You
-+      meet the following conditions:
-+
-+      (a) You must give any other recipients of the Work or
-+          Derivative Works a copy of this License; and
-+
-+      (b) You must cause any modified files to carry prominent notices
-+          stating that You changed the files; and
-+
-+      (c) You must retain, in the Source form of any Derivative Works
-+          that You distribute, all copyright, patent, trademark, and
-+          attribution notices from the Source form of the Work,
-+          excluding those notices that do not pertain to any part of
-+          the Derivative Works; and
-+
-+      (d) If the Work includes a "NOTICE" text file as part of its
-+          distribution, then any Derivative Works that You distribute must
-+          include a readable copy of the attribution notices contained
-+          within such NOTICE file, excluding those notices that do not
-+          pertain to any part of the Derivative Works, in at least one
-+          of the following places: within a NOTICE text file distributed
-+          as part of the Derivative Works; within the Source form or
-+          documentation, if provided along with the Derivative Works; or,
-+          within a display generated by the Derivative Works, if and
-+          wherever such third-party notices normally appear. The contents
-+          of the NOTICE file are for informational purposes only and
-+          do not modify the License. You may add Your own attribution
-+          notices within Derivative Works that You distribute, alongside
-+          or as an addendum to the NOTICE text from the Work, provided
-+          that such additional attribution notices cannot be construed
-+          as modifying the License.
-+
-+      You may add Your own copyright statement to Your modifications and
-+      may provide additional or different license terms and conditions
-+      for use, reproduction, or distribution of Your modifications, or
-+      for any such Derivative Works as a whole, provided Your use,
-+      reproduction, and distribution of the Work otherwise complies with
-+      the conditions stated in this License.
-+
-+   5. Submission of Contributions. Unless You explicitly state otherwise,
-+      any Contribution intentionally submitted for inclusion in the Work
-+      by You to the Licensor shall be under the terms and conditions of
-+      this License, without any additional terms or conditions.
-+      Notwithstanding the above, nothing herein shall supersede or modify
-+      the terms of any separate license agreement you may have executed
-+      with Licensor regarding such Contributions.
-+
-+   6. Trademarks. This License does not grant permission to use the trade
-+      names, trademarks, service marks, or product names of the Licensor,
-+      except as required for reasonable and customary use in describing the
-+      origin of the Work and reproducing the content of the NOTICE file.
-+
-+   7. Disclaimer of Warranty. Unless required by applicable law or
-+      agreed to in writing, Licensor provides the Work (and each
-+      Contributor provides its Contributions) on an "AS IS" BASIS,
-+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-+      implied, including, without limitation, any warranties or conditions
-+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-+      PARTICULAR PURPOSE. You are solely responsible for determining the
-+      appropriateness of using or redistributing the Work and assume any
-+      risks associated with Your exercise of permissions under this License.
-+
-+   8. Limitation of Liability. In no event and under no legal theory,
-+      whether in tort (including negligence), contract, or otherwise,
-+      unless required by applicable law (such as deliberate and grossly
-+      negligent acts) or agreed to in writing, shall any Contributor be
-+      liable to You for damages, including any direct, indirect, special,
-+      incidental, or consequential damages of any character arising as a
-+      result of this License or out of the use or inability to use the
-+      Work (including but not limited to damages for loss of goodwill,
-+      work stoppage, computer failure or malfunction, or any and all
-+      other commercial damages or losses), even if such Contributor
-+      has been advised of the possibility of such damages.
-+
-+   9. Accepting Warranty or Additional Liability. While redistributing
-+      the Work or Derivative Works thereof, You may choose to offer,
-+      and charge a fee for, acceptance of support, warranty, indemnity,
-+      or other liability obligations and/or rights consistent with this
-+      License. However, in accepting such obligations, You may act only
-+      on Your own behalf and on Your sole responsibility, not on behalf
-+      of any other Contributor, and only if You agree to indemnify,
-+      defend, and hold each Contributor harmless for any liability
-+      incurred by, or claims asserted against, such Contributor by reason
-+      of your accepting any such warranty or additional liability.
-+
-+   END OF TERMS AND CONDITIONS
-+
-+   APPENDIX: How to apply the Apache License to your work.
-+
-+      To apply the Apache License to your work, attach the following
-+      boilerplate notice, with the fields enclosed by brackets "[]"
-+      replaced with your own identifying information. (Don't include
-+      the brackets!)  The text should be enclosed in the appropriate
-+      comment syntax for the file format. We also recommend that a
-+      file or class name and description of purpose be included on the
-+      same "printed page" as the copyright notice for easier
-+      identification within third-party archives.
-+
-+   Copyright [yyyy] [name of copyright owner]
-+
-+   Licensed under the Apache License, Version 2.0 (the "License");
-+   you may not use this file except in compliance with the License.
-+   You may obtain a copy of the License at
-+
-+       http://www.apache.org/licenses/LICENSE-2.0
-+
-+   Unless required by applicable law or agreed to in writing, software
-+   distributed under the License is distributed on an "AS IS" BASIS,
-+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+   See the License for the specific language governing permissions and
-+   limitations under the License.
-diff --git a/README.md b/README.md
-new file mode 100644
-index 0000000..1084a22
---- /dev/null
-+++ b/README.md
-@@ -0,0 +1,45 @@
-+# openRepoTools-code
-+
-+The **code leg** of the `openrepotools` project: the implementation and its
-+tests. The requirements it implements live in
-+[`opensoft/openRepoTools-spec`](https://github.com/opensoft/openRepoTools-spec).
-+
-+**Clone the assembly root, not this repository.** This leg is mounted as a
-+submodule at `code/` inside
-+[`opensoft/openRepoTools`](https://github.com/opensoft/openRepoTools), which
-+is what pins the commit of this repository that the project currently is:
-+
-+```sh
-+git clone --recurse-submodules https://github.com/opensoft/openRepoTools.git
-+cd openRepoTools
-+make bootstrap
-+```
-+
-+Working here directly is fine — it is an ordinary repository with an ordinary
-+branch. What advancing this leg does NOT do is advance the project: that is a
-+commit in the assembly root moving the gitlink, `contracts/code-pin.yaml` and
-+any workflow `@<sha>` reference together.
-+
-+Being the code leg confers no authority over the implementation. The split is
-+navigation; authority travels in grants, and a project that keeps spec and
-+code in one repository is reviewed identically.
-+
-+Topic: `xf-project-openrepotools`.
-+
-+## What is in it
-+
-+Every command `openRepoTools --install` places is a file at this leg's root —
-+`openRepoTools` itself, `park`, `resume`, `status` and the lane tooling — with
-+the alias table `repos.tsv`, the `skills/` and `commands/` it installs, the
-+suite under `tests/` (`tests/run.sh` runs it), the CI under
-+`.github/workflows/`, and the pinned standard at `upstream/openRepoShape`
-+(`contracts/openreposhape-pin.yaml`). Installing is unchanged: the one-liner in
-+the assembly root's `README.md` fetches the root's `openRepoTools`, which hands
-+over to the installer here at the commit the root pins.
-+
-+The manuals — `docs/README-lanes.md` for the lane tooling and
-+`docs/README-claude-current.md` for `claude-current` and
-+`claude-restart-check` — and every specification are in
-+[`opensoft/openRepoTools-spec`](https://github.com/opensoft/openRepoTools-spec).
-+
-+Licence: Apache-2.0. See [LICENSE](LICENSE).
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t006/spec-0001-The-spec-leg-gets-its-own-front-door-the-shape-s-leg.patch b/specs/004-migrate-to-triad/patches/t006/spec-0001-The-spec-leg-gets-its-own-front-door-the-shape-s-leg.patch
deleted file mode 100644
index f8373be7..00000000
--- a/specs/004-migrate-to-triad/patches/t006/spec-0001-The-spec-leg-gets-its-own-front-door-the-shape-s-leg.patch
+++ /dev/null
@@ -1,398 +0,0 @@
-From 39c18877e042e13156849b861d07bc3c92e64db4 Mon Sep 17 00:00:00 2001
-From: Brett Heap <1513478+brettheap@users.noreply.github.com>
-Date: Thu, 8 Oct 2026 21:41:43 +0000
-Subject: [PATCH] The spec leg gets its own front door: the shape's leg
- AGENTS.md, CLAUDE.md and README.md, the LF rule and licence it lost when the
- root kept them, and the claude-current manual's three test paths re-pointed
- at the code leg.
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Rehearsal patch for opensoft/openRepoTools#186, task T006 of
-specs/004-migrate-to-triad/tasks.md, against run C's spec leg 593250d. The
-split left this leg with no AGENTS.md, CLAUDE.md, README.md, LICENSE or
-.gitattributes, because all of them stayed in the assembly root, and a
-superproject's attributes never reach into a submodule's worktree.
-
-- AGENTS.md, CLAUDE.md and README.md are openRepoShape 7f84ca4's
-  templates/spec-root/ files, rendered by its own copy_tree with this
-  project's names, so the leg-clone detector in scripts/shape_advisory.py
-  recognises them. Each AGENTS.md and README.md then adds one short section:
-  what this leg holds; that full proposals and canonical Speckit files live
-  here, and a bounded amendment in the code leg's feature folder; where
-  `openspec validate` runs; and how to read a pre-split path or commit hash.
-- .gitattributes restores the `* text=auto eol=lf` rule the monorepo's root
-  file applied to these documents. `git add --renormalize .` changes nothing.
-- LICENSE is the root's Apache-2.0 text, byte for byte (blob 261eeb9).
-- docs/README-claude-current.md:275-276: `tests/test_claude_current.py`,
-  `tests/test_claude_restart_check.py` and
-  `tests/test_lane_start_claude_current.py` become `code/tests/…`, relative
-  to the assembly root.
-
-No approval record is rewritten. Paths and commit hashes recorded in
-openspec/changes/ and specs/ are left as their authors wrote them, under
-FR-014 of specs/004-migrate-to-triad/spec.md. docs/README-lanes.md is left
-to the lane-tooling analysis.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- .gitattributes                |  10 ++
- AGENTS.md                     |  48 ++++++++
- CLAUDE.md                     |   1 +
- LICENSE                       | 201 ++++++++++++++++++++++++++++++++++
- README.md                     |  39 +++++++
- docs/README-claude-current.md |   4 +-
- 6 files changed, 301 insertions(+), 2 deletions(-)
- create mode 100644 .gitattributes
- create mode 100644 AGENTS.md
- create mode 100644 CLAUDE.md
- create mode 100644 LICENSE
- create mode 100644 README.md
-
-diff --git a/.gitattributes b/.gitattributes
-new file mode 100644
-index 0000000..974ecca
---- /dev/null
-+++ b/.gitattributes
-@@ -0,0 +1,10 @@
-+# LF IN EVERY WORKTREE, as these documents had before the split into three
-+# repositories: the monorepo's `* text=auto eol=lf` covered them, and a
-+# superproject's attributes never reach into a submodule's worktree, so the
-+# rule travels with this leg. The code leg's hygiene tests read the manuals in
-+# `docs/` and match their lines; a CRLF checkout would make those matches about
-+# line endings rather than about content.
-+#
-+# NO PATH IS LISTED BY NAME. Every file here is text.
-+
-+* text=auto eol=lf
-diff --git a/AGENTS.md b/AGENTS.md
-new file mode 100644
-index 0000000..b5504c1
---- /dev/null
-+++ b/AGENTS.md
-@@ -0,0 +1,48 @@
-+This is the **spec leg** of openRepoTools (`openrepotools`): requirements, decisions
-+and acceptance criteria.
-+
-+**The project's rules are not here.** They are in the assembly root
-+`opensoft/openRepoTools`, in `AGENTS-shape.md` — read that before touching anything
-+that spans the legs. This leg is mounted there at `spec/`, and the other leg,
-+`opensoft/openRepoTools-code`, beside it at `../code/`, once the root is cloned with
-+`--recurse-submodules`.
-+
-+Working here is ordinary — an ordinary repository on an ordinary branch. What
-+advancing this leg does NOT do is advance the project: that is ONE commit in
-+`opensoft/openRepoTools` moving the gitlink, `contracts/spec-pin.yaml` and every
-+workflow `@<sha>` for this leg together.
-+
-+Being the spec leg confers no authority over specifications. The split is
-+navigation.
-+
-+## What is particular to openRepoTools' spec leg
-+
-+The project's own instructions are the assembly root's `AGENTS.md`, and they
-+govern here. This section adds only what standing in this leg changes.
-+
-+- **What is here**: `openspec/` (full OpenSpec proposals with their delta
-+  specs, and their archive once archived), `specs/` (the Speckit feature
-+  directories, `specs/<NNN-feature>/`), `docs/` (the manuals:
-+  `README-lanes.md` for the lane tooling, `README-claude-current.md` for
-+  `claude-current` and `claude-restart-check`) and `ideation/` (brainstorm
-+  packets).
-+- **Full proposals and canonical Speckit files live here**, whichever branch
-+  they were written on. The one exception is a genuine bounded amendment to an
-+  approved baseline: it is recorded in the code leg's feature worktree, under
-+  `features/<NNN-feature>/openspec/`, and reconciled here once, when its
-+  feature completes (the shared workflow's "Triad Feature Amendments").
-+- **`openspec` runs here**, never from the assembly root, which has no
-+  `openspec/`: `openspec validate <change> --strict` from this leg's root, or
-+  from a feature's spec worktree, `worktrees/<NNN-feature>/spec/` under the
-+  assembly root, for a change on that feature's branch. A local root takes
-+  precedence over a docs-store pointer; pass `--store` only where it resolves
-+  to the checkout you mean.
-+- **The code these documents describe is the code leg's.** A path such as
-+  `tests/…`, `upstream/openRepoShape` or `contracts/openreposhape-pin.yaml` in a
-+  document written before the split names a file of
-+  `opensoft/openRepoTools-code` (`../code/` when mounted); where such a path has
-+  been repaired it reads `code/…`, relative to the assembly root. A commit of this
-+  project that such a document cites is a commit of `opensoft/openRepoTools`,
-+  the assembly, which kept the whole history and its branches; the split
-+  rewrote this leg's copy of that history, so the same change has a different
-+  hash here.
-diff --git a/CLAUDE.md b/CLAUDE.md
-new file mode 100644
-index 0000000..5d30268
---- /dev/null
-+++ b/CLAUDE.md
-@@ -0,0 +1 @@
-+Read AGENTS.md.
-diff --git a/LICENSE b/LICENSE
-new file mode 100644
-index 0000000..261eeb9
---- /dev/null
-+++ b/LICENSE
-@@ -0,0 +1,201 @@
-+                                 Apache License
-+                           Version 2.0, January 2004
-+                        http://www.apache.org/licenses/
-+
-+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-+
-+   1. Definitions.
-+
-+      "License" shall mean the terms and conditions for use, reproduction,
-+      and distribution as defined by Sections 1 through 9 of this document.
-+
-+      "Licensor" shall mean the copyright owner or entity authorized by
-+      the copyright owner that is granting the License.
-+
-+      "Legal Entity" shall mean the union of the acting entity and all
-+      other entities that control, are controlled by, or are under common
-+      control with that entity. For the purposes of this definition,
-+      "control" means (i) the power, direct or indirect, to cause the
-+      direction or management of such entity, whether by contract or
-+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-+      outstanding shares, or (iii) beneficial ownership of such entity.
-+
-+      "You" (or "Your") shall mean an individual or Legal Entity
-+      exercising permissions granted by this License.
-+
-+      "Source" form shall mean the preferred form for making modifications,
-+      including but not limited to software source code, documentation
-+      source, and configuration files.
-+
-+      "Object" form shall mean any form resulting from mechanical
-+      transformation or translation of a Source form, including but
-+      not limited to compiled object code, generated documentation,
-+      and conversions to other media types.
-+
-+      "Work" shall mean the work of authorship, whether in Source or
-+      Object form, made available under the License, as indicated by a
-+      copyright notice that is included in or attached to the work
-+      (an example is provided in the Appendix below).
-+
-+      "Derivative Works" shall mean any work, whether in Source or Object
-+      form, that is based on (or derived from) the Work and for which the
-+      editorial revisions, annotations, elaborations, or other modifications
-+      represent, as a whole, an original work of authorship. For the purposes
-+      of this License, Derivative Works shall not include works that remain
-+      separable from, or merely link (or bind by name) to the interfaces of,
-+      the Work and Derivative Works thereof.
-+
-+      "Contribution" shall mean any work of authorship, including
-+      the original version of the Work and any modifications or additions
-+      to that Work or Derivative Works thereof, that is intentionally
-+      submitted to Licensor for inclusion in the Work by the copyright owner
-+      or by an individual or Legal Entity authorized to submit on behalf of
-+      the copyright owner. For the purposes of this definition, "submitted"
-+      means any form of electronic, verbal, or written communication sent
-+      to the Licensor or its representatives, including but not limited to
-+      communication on electronic mailing lists, source code control systems,
-+      and issue tracking systems that are managed by, or on behalf of, the
-+      Licensor for the purpose of discussing and improving the Work, but
-+      excluding communication that is conspicuously marked or otherwise
-+      designated in writing by the copyright owner as "Not a Contribution."
-+
-+      "Contributor" shall mean Licensor and any individual or Legal Entity
-+      on behalf of whom a Contribution has been received by Licensor and
-+      subsequently incorporated within the Work.
-+
-+   2. Grant of Copyright License. Subject to the terms and conditions of
-+      this License, each Contributor hereby grants to You a perpetual,
-+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-+      copyright license to reproduce, prepare Derivative Works of,
-+      publicly display, publicly perform, sublicense, and distribute the
-+      Work and such Derivative Works in Source or Object form.
-+
-+   3. Grant of Patent License. Subject to the terms and conditions of
-+      this License, each Contributor hereby grants to You a perpetual,
-+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-+      (except as stated in this section) patent license to make, have made,
-+      use, offer to sell, sell, import, and otherwise transfer the Work,
-+      where such license applies only to those patent claims licensable
-+      by such Contributor that are necessarily infringed by their
-+      Contribution(s) alone or by combination of their Contribution(s)
-+      with the Work to which such Contribution(s) was submitted. If You
-+      institute patent litigation against any entity (including a
-+      cross-claim or counterclaim in a lawsuit) alleging that the Work
-+      or a Contribution incorporated within the Work constitutes direct
-+      or contributory patent infringement, then any patent licenses
-+      granted to You under this License for that Work shall terminate
-+      as of the date such litigation is filed.
-+
-+   4. Redistribution. You may reproduce and distribute copies of the
-+      Work or Derivative Works thereof in any medium, with or without
-+      modifications, and in Source or Object form, provided that You
-+      meet the following conditions:
-+
-+      (a) You must give any other recipients of the Work or
-+          Derivative Works a copy of this License; and
-+
-+      (b) You must cause any modified files to carry prominent notices
-+          stating that You changed the files; and
-+
-+      (c) You must retain, in the Source form of any Derivative Works
-+          that You distribute, all copyright, patent, trademark, and
-+          attribution notices from the Source form of the Work,
-+          excluding those notices that do not pertain to any part of
-+          the Derivative Works; and
-+
-+      (d) If the Work includes a "NOTICE" text file as part of its
-+          distribution, then any Derivative Works that You distribute must
-+          include a readable copy of the attribution notices contained
-+          within such NOTICE file, excluding those notices that do not
-+          pertain to any part of the Derivative Works, in at least one
-+          of the following places: within a NOTICE text file distributed
-+          as part of the Derivative Works; within the Source form or
-+          documentation, if provided along with the Derivative Works; or,
-+          within a display generated by the Derivative Works, if and
-+          wherever such third-party notices normally appear. The contents
-+          of the NOTICE file are for informational purposes only and
-+          do not modify the License. You may add Your own attribution
-+          notices within Derivative Works that You distribute, alongside
-+          or as an addendum to the NOTICE text from the Work, provided
-+          that such additional attribution notices cannot be construed
-+          as modifying the License.
-+
-+      You may add Your own copyright statement to Your modifications and
-+      may provide additional or different license terms and conditions
-+      for use, reproduction, or distribution of Your modifications, or
-+      for any such Derivative Works as a whole, provided Your use,
-+      reproduction, and distribution of the Work otherwise complies with
-+      the conditions stated in this License.
-+
-+   5. Submission of Contributions. Unless You explicitly state otherwise,
-+      any Contribution intentionally submitted for inclusion in the Work
-+      by You to the Licensor shall be under the terms and conditions of
-+      this License, without any additional terms or conditions.
-+      Notwithstanding the above, nothing herein shall supersede or modify
-+      the terms of any separate license agreement you may have executed
-+      with Licensor regarding such Contributions.
-+
-+   6. Trademarks. This License does not grant permission to use the trade
-+      names, trademarks, service marks, or product names of the Licensor,
-+      except as required for reasonable and customary use in describing the
-+      origin of the Work and reproducing the content of the NOTICE file.
-+
-+   7. Disclaimer of Warranty. Unless required by applicable law or
-+      agreed to in writing, Licensor provides the Work (and each
-+      Contributor provides its Contributions) on an "AS IS" BASIS,
-+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-+      implied, including, without limitation, any warranties or conditions
-+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-+      PARTICULAR PURPOSE. You are solely responsible for determining the
-+      appropriateness of using or redistributing the Work and assume any
-+      risks associated with Your exercise of permissions under this License.
-+
-+   8. Limitation of Liability. In no event and under no legal theory,
-+      whether in tort (including negligence), contract, or otherwise,
-+      unless required by applicable law (such as deliberate and grossly
-+      negligent acts) or agreed to in writing, shall any Contributor be
-+      liable to You for damages, including any direct, indirect, special,
-+      incidental, or consequential damages of any character arising as a
-+      result of this License or out of the use or inability to use the
-+      Work (including but not limited to damages for loss of goodwill,
-+      work stoppage, computer failure or malfunction, or any and all
-+      other commercial damages or losses), even if such Contributor
-+      has been advised of the possibility of such damages.
-+
-+   9. Accepting Warranty or Additional Liability. While redistributing
-+      the Work or Derivative Works thereof, You may choose to offer,
-+      and charge a fee for, acceptance of support, warranty, indemnity,
-+      or other liability obligations and/or rights consistent with this
-+      License. However, in accepting such obligations, You may act only
-+      on Your own behalf and on Your sole responsibility, not on behalf
-+      of any other Contributor, and only if You agree to indemnify,
-+      defend, and hold each Contributor harmless for any liability
-+      incurred by, or claims asserted against, such Contributor by reason
-+      of your accepting any such warranty or additional liability.
-+
-+   END OF TERMS AND CONDITIONS
-+
-+   APPENDIX: How to apply the Apache License to your work.
-+
-+      To apply the Apache License to your work, attach the following
-+      boilerplate notice, with the fields enclosed by brackets "[]"
-+      replaced with your own identifying information. (Don't include
-+      the brackets!)  The text should be enclosed in the appropriate
-+      comment syntax for the file format. We also recommend that a
-+      file or class name and description of purpose be included on the
-+      same "printed page" as the copyright notice for easier
-+      identification within third-party archives.
-+
-+   Copyright [yyyy] [name of copyright owner]
-+
-+   Licensed under the Apache License, Version 2.0 (the "License");
-+   you may not use this file except in compliance with the License.
-+   You may obtain a copy of the License at
-+
-+       http://www.apache.org/licenses/LICENSE-2.0
-+
-+   Unless required by applicable law or agreed to in writing, software
-+   distributed under the License is distributed on an "AS IS" BASIS,
-+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-+   See the License for the specific language governing permissions and
-+   limitations under the License.
-diff --git a/README.md b/README.md
-new file mode 100644
-index 0000000..89beb3b
---- /dev/null
-+++ b/README.md
-@@ -0,0 +1,39 @@
-+# openRepoTools-spec
-+
-+The **spec leg** of the `openrepotools` project: requirements, decisions and
-+acceptance criteria. The implementation lives in
-+[`opensoft/openRepoTools-code`](https://github.com/opensoft/openRepoTools-code).
-+
-+**Clone the assembly root, not this repository.** This leg is mounted as a
-+submodule at `spec/` inside
-+[`opensoft/openRepoTools`](https://github.com/opensoft/openRepoTools), which
-+is what pins the commit of this repository that the project currently is:
-+
-+```sh
-+git clone --recurse-submodules https://github.com/opensoft/openRepoTools.git
-+cd openRepoTools
-+make bootstrap
-+```
-+
-+Working here directly is fine — it is an ordinary repository with an ordinary
-+branch. What advancing this leg does NOT do is advance the project: that is a
-+commit in the assembly root moving the gitlink, `contracts/spec-pin.yaml` and
-+any workflow `@<sha>` reference together.
-+
-+Being the spec leg confers no authority over specifications. The split is
-+navigation; authority travels in grants, and a project that keeps spec and
-+code in one repository is reviewed identically.
-+
-+Topic: `xf-project-openrepotools`.
-+
-+## What is in it
-+
-+`openspec/` holds the project's full OpenSpec proposals, `specs/` its Speckit
-+feature directories, `docs/` the manuals — `docs/README-lanes.md` for the lane
-+tooling and `docs/README-claude-current.md` for `claude-current` and
-+`claude-restart-check` — and `ideation/` the brainstorm packets the proposals
-+grew from. The commands, their tests and their CI are in
-+[`opensoft/openRepoTools-code`](https://github.com/opensoft/openRepoTools-code).
-+`openspec validate <change> --strict` runs from this leg's root.
-+
-+Licence: Apache-2.0. See [LICENSE](LICENSE).
-diff --git a/docs/README-claude-current.md b/docs/README-claude-current.md
-index 03687b9..36818dc 100644
---- a/docs/README-claude-current.md
-+++ b/docs/README-claude-current.md
-@@ -272,6 +272,6 @@ The status line that calls it is workBenches'
- 
- Both commands parse and run under bash 3.2, which is what macOS ships. Neither
- uses `mapfile`, associative arrays, `readlink -f` or GNU-only flags.
--`tests/test_claude_current.py`, `tests/test_claude_restart_check.py` and
--`tests/test_lane_start_claude_current.py` are their suites, and every one of
-+`code/tests/test_claude_current.py`, `code/tests/test_claude_restart_check.py` and
-+`code/tests/test_lane_start_claude_current.py` are their suites, and every one of
- them runs against fakes. None reaches npm or runs a real Claude Code.
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t007-assembly-entry-point.patch b/specs/004-migrate-to-triad/patches/t007-assembly-entry-point.patch
deleted file mode 100644
index 407741b3..00000000
--- a/specs/004-migrate-to-triad/patches/t007-assembly-entry-point.patch
+++ /dev/null
@@ -1,441 +0,0 @@
-From 6acc147f751e5a2ca57b4814395769b7b75b339e Mon Sep 17 00:00:00 2001
-From: Brett Heap <1513478+brettheap@users.noreply.github.com>
-Date: Fri, 9 Oct 2026 20:33:03 +0000
-Subject: [PATCH] Add the assembly's openRepoTools front door, which runs the
- implementation the code pin names and nothing else.
-
-T007 of specs/004-migrate-to-triad/tasks.md (opensoft/openRepoTools#186). The
-documented one-liners fetch openRepoTools from this repository's root, and
-after the split the installer is the code leg's. This file keeps that line
-working and adds no installer mechanics.
-
-In a checkout it requires the pin, the gitlink and the implementation's
-bytes to name one commit, and then execs code/openRepoTools with every
-argument. That is the same process, so the exit status and signals are the
-implementation's.
-
-Anywhere else it resolves the ref once and reads contracts/code-pin.yaml at
-that commit. It checks that the gitlink at the pin's submodule_path in that
-commit is the pinned commit, so the lockstep rule is enforced here and not
-left to whichever code a stale pin selects. Only then does it fetch
-openRepoTools from the pinned repository at the pinned commit, and run it
-from stdin with OPENREPOTOOLS_REF set to that commit, so the implementation
-reads the same pin.
-
-The pin reader is a deliberate copy of the implementation's, guarded by the
-code leg's tests/test_install_payload_source.py.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- openRepoTools | 398 ++++++++++++++++++++++++++++++++++++++++++++++++++
- 1 file changed, 398 insertions(+)
- create mode 100755 openRepoTools
-
-diff --git a/openRepoTools b/openRepoTools
-new file mode 100755
-index 0000000..ff432c6
---- /dev/null
-+++ b/openRepoTools
-@@ -0,0 +1,398 @@
-+#!/usr/bin/env bash
-+# SPDX-License-Identifier: Apache-2.0
-+#
-+# openRepoTools — THE ASSEMBLY'S FRONT DOOR, and nothing else.
-+#
-+# The installer is the CODE leg's `openRepoTools`. This file is the one the
-+# documented one-liners still fetch from this repository's root:
-+#
-+#   curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/openRepoTools | bash -s -- --install
-+#   gh api repos/opensoft/openRepoTools/contents/openRepoTools \
-+#       -H 'Accept: application/vnd.github.raw' | bash -s -- --install
-+#
-+# and the one `./openRepoTools` runs in a checkout of this repository. It
-+# SELECTS the implementation `contracts/code-pin.yaml` pins and hands it every
-+# argument. It places nothing, merges nothing, writes no receipt and retires
-+# nothing — every one of those is the implementation's, which is also what
-+# `--install` puts on a PATH, so an installed `openRepoTools` never needs this
-+# file or a checkout of this repository again (opensoft/openRepoTools#186,
-+# T007; `specs/004-migrate-to-triad/installer-design.md`).
-+#
-+#   * IN A CHECKOUT (this file beside `contracts/code-pin.yaml`): the pin, the
-+#     gitlink at its `submodule_path` and the implementation's bytes must name
-+#     ONE commit, and then this EXECs `<submodule_path>/openRepoTools` with
-+#     every argument — the same process, so its exit status and every signal
-+#     are the implementation's own. That implementation then checks the rest
-+#     of the payload against the same pin before it copies a byte.
-+#   * ANYWHERE ELSE (stdin, or a copy of this file on its own): `$OPENREPOTOOLS_REF`
-+#     is resolved ONCE to a commit of `$OPENREPOTOOLS_REPO`, the code pin is
-+#     read AT that commit, and the gitlink at its `submodule_path` in that
-+#     commit must name the pinned commit too — the lockstep rule, checked HERE,
-+#     before any implementation is fetched or run, so a stale or rolled-back pin
-+#     is named as what it is rather than left to whichever code it selects.
-+#     Then the implementation is fetched from the pinned repository AT the
-+#     pinned commit and run from stdin — the way the one-liners always ran it —
-+#     with `$OPENREPOTOOLS_REF` set to that commit, so the implementation reads
-+#     the same pin and no branch that moves in between can give it another.
-+#     Reading the gitlink is one level of the assembly's tree: `gh api --jq`,
-+#     or `curl` with `jq` (an adopted assembly's one-liner needs api.github.com).
-+#
-+# NOTHING HERE ASSUMES A FILE THE LEGS MAY NOT CARRY: no `.gitattributes`, no
-+# README, no AGENTS.md. Bytes are compared raw (`hash-object --no-filters`).
-+#
-+# bash 3.2 (macOS's /bin/bash): no `${x,,}`, `mapfile`, `declare -A` or
-+# `local -n`, as everywhere in this project.
-+
-+set -euo pipefail
-+
-+REPO="${OPENREPOTOOLS_REPO:-opensoft/openRepoTools}"
-+REF="${OPENREPOTOOLS_REF:-main}"
-+SELF="${BASH_SOURCE[0]:-$0}"
-+PIN_FILE="contracts/code-pin.yaml"
-+
-+die() { printf '\nREFUSED: %s\n' "$1" >&2; exit "${2:-2}"; }
-+
-+# ---------------------------------------------------------------------------
-+# THE CODE PIN'S GRAMMAR — A DELIBERATE COPY of the implementation's own
-+# reader (`pin_parse` and the five helpers above it in the code leg's
-+# `openRepoTools`), byte for byte, because this file has to read the pin
-+# BEFORE there is an implementation to ask. The code leg's
-+# `tests/test_install_payload_source.py` fails when the two copies differ.
-+# ---------------------------------------------------------------------------
-+
-+ORT_ALNUM='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'
-+ORT_TAB="$(printf '\t')"
-+ORT_CR="$(printf '\r')"
-+
-+is_lower_hex() {   # <length> <value>
-+	case "$2" in '' | *[!0123456789abcdef]*) return 1 ;; esac
-+	[ "${#2}" -eq "$1" ]
-+}
-+
-+is_slug() {   # <owner/name> — a repository as GitHub spells one, and nothing else
-+	local owner="${1%%/*}" name="${1#*/}"
-+	[ "$owner" != "$1" ] || return 1
-+	case "$owner" in '' | -* | *- | *[!${ORT_ALNUM}-]*) return 1 ;; esac
-+	case "$name" in '' | . | .. | */* | *[!${ORT_ALNUM}._-]*) return 1 ;; esac
-+	return 0
-+}
-+
-+is_segment() {   # <path> — exactly one path segment
-+	case "$1" in '' | . | .. | *[!${ORT_ALNUM}._-]*) return 1 ;; esac
-+	return 0
-+}
-+
-+PIN_SCALAR=""
-+pin_scalar() {   # <text after the colon> — PIN_SCALAR, or 1 for a quote that does not close
-+	local v="$1" q rest
-+	while :; do case "$v" in ' '* | "$ORT_TAB"*) v="${v#?}" ;; *) break ;; esac; done
-+	case "$v" in
-+	'"'* | "'"*)
-+		q="${v:0:1}"
-+		rest="${v#?}"
-+		case "$rest" in *"$q"*) ;; *) return 1 ;; esac
-+		PIN_SCALAR="${rest%%"$q"*}"
-+		rest="${rest#*"$q"}"
-+		while :; do case "$rest" in ' '* | "$ORT_TAB"*) rest="${rest#?}" ;; *) break ;; esac; done
-+		case "$rest" in '' | '#'*) ;; *) return 1 ;; esac
-+		# No escapes in this grammar: a backslash is a value nobody wrote.
-+		case "$PIN_SCALAR" in *\\*) return 1 ;; esac
-+		;;
-+	'#'*) PIN_SCALAR="" ;;
-+	*)
-+		PIN_SCALAR="${v%% #*}"
-+		while :; do
-+			case "$PIN_SCALAR" in *' ' | *"$ORT_TAB") PIN_SCALAR="${PIN_SCALAR%?}" ;; *) break ;; esac
-+		done
-+		;;
-+	esac
-+	return 0
-+}
-+
-+pin_bad() {   # <field> <value> <what it must be> — PIN_WHY, and 1
-+	if [ -z "$2" ]; then
-+		PIN_WHY="\`$1\` is missing"
-+	else
-+		PIN_WHY="\`$1\` is '$2', $3"
-+	fi
-+	return 1
-+}
-+
-+pin_parse() {   # <file> — the PIN_* fields and 0, or PIN_WHY and 1
-+	local line body key n=0 seen=" " block="" tree_seen=0
-+	PIN_SCHEMA="" PIN_KIND="" PIN_LEG_ROLE="" PIN_SOURCE_REPOSITORY=""
-+	PIN_SUBMODULE_PATH="" PIN_COMMIT="" PIN_REVISION_KIND=""
-+	PIN_DIGEST_ALGORITHM="" PIN_DIGEST_DEFINITION="" PIN_TREE_SHA256=""
-+	PIN_VERIFY="" PIN_RUNBOOK="" PIN_WHY=""
-+	[ -s "$1" ] || { PIN_WHY="it is empty"; return 1; }
-+	while IFS= read -r line || [ -n "$line" ]; do
-+		n=$((n + 1))
-+		case "$line" in
-+		*"$ORT_CR"*) PIN_WHY="line $n ends in a carriage return, and the grammar is LF-only"; return 1 ;;
-+		'' | '#'*) continue ;;
-+		' '* | "$ORT_TAB"*)
-+			body="$line"
-+			while :; do case "$body" in ' '* | "$ORT_TAB"*) body="${body#?}" ;; *) break ;; esac; done
-+			case "$body" in '' | '#'*) continue ;; esac
-+			# AN INDENTED LINE BELONGS TO THE KEY ABOVE IT, and the only one
-+			# this reads into is `digests:`.
-+			[ "$block" = digests ] || continue
-+			key="${body%%:*}"
-+			[ "$key" != "$body" ] || { PIN_WHY="line $n is not \`key: value\`"; return 1; }
-+			pin_scalar "${body#*:}" || { PIN_WHY="line $n has a quoted value that does not close cleanly"; return 1; }
-+			if [ "$key" = tree_sha256 ]; then
-+				[ "$tree_seen" -eq 0 ] || { PIN_WHY="\`digests.tree_sha256\` appears twice"; return 1; }
-+				tree_seen=1
-+				PIN_TREE_SHA256="$PIN_SCALAR"
-+			fi
-+			continue ;;
-+		esac
-+		block=""
-+		key="${line%%:*}"
-+		[ "$key" != "$line" ] || { PIN_WHY="line $n is not \`key: value\`"; return 1; }
-+		case "$key" in
-+		'' | *[!abcdefghijklmnopqrstuvwxyz0123456789_]*)
-+			PIN_WHY="line $n's key '$key' is not a key this grammar has"; return 1 ;;
-+		esac
-+		case "$seen" in *" $key "*) PIN_WHY="\`$key\` appears twice"; return 1 ;; esac
-+		seen="$seen$key "
-+		pin_scalar "${line#*:}" || { PIN_WHY="line $n has a quoted value that does not close cleanly"; return 1; }
-+		case "$key" in
-+		schema_version) PIN_SCHEMA="$PIN_SCALAR" ;;
-+		kind) PIN_KIND="$PIN_SCALAR" ;;
-+		leg_role) PIN_LEG_ROLE="$PIN_SCALAR" ;;
-+		source_repository) PIN_SOURCE_REPOSITORY="$PIN_SCALAR" ;;
-+		submodule_path) PIN_SUBMODULE_PATH="$PIN_SCALAR" ;;
-+		commit) PIN_COMMIT="$PIN_SCALAR" ;;
-+		revision_kind) PIN_REVISION_KIND="$PIN_SCALAR" ;;
-+		digest_algorithm) PIN_DIGEST_ALGORITHM="$PIN_SCALAR" ;;
-+		digest_definition) PIN_DIGEST_DEFINITION="$PIN_SCALAR" ;;
-+		verify_pin) PIN_VERIFY="$PIN_SCALAR" ;;
-+		resync_runbook) PIN_RUNBOOK="$PIN_SCALAR" ;;
-+		digests)
-+			[ -z "$PIN_SCALAR" ] || { PIN_WHY="\`digests\` is '$PIN_SCALAR', not a mapping"; return 1; }
-+			block=digests ;;
-+		esac
-+	done <"$1"
-+	[ "$PIN_SCHEMA" = 1 ] || { pin_bad schema_version "$PIN_SCHEMA" "not 1"; return 1; }
-+	[ "$PIN_KIND" = pinned_contract_manifest ] ||
-+		{ pin_bad kind "$PIN_KIND" "not pinned_contract_manifest"; return 1; }
-+	[ "$PIN_LEG_ROLE" = code ] || { pin_bad leg_role "$PIN_LEG_ROLE" "not code"; return 1; }
-+	is_slug "$PIN_SOURCE_REPOSITORY" ||
-+		{ pin_bad source_repository "$PIN_SOURCE_REPOSITORY" "not an owner/name repository"; return 1; }
-+	is_segment "$PIN_SUBMODULE_PATH" ||
-+		{ pin_bad submodule_path "$PIN_SUBMODULE_PATH" "not one path segment"; return 1; }
-+	is_lower_hex 40 "$PIN_COMMIT" ||
-+		{ pin_bad commit "$PIN_COMMIT" "not 40 lowercase hex — a branch, a tag or an abbreviated commit is a moving reference"; return 1; }
-+	[ "$PIN_REVISION_KIND" = commit ] || { pin_bad revision_kind "$PIN_REVISION_KIND" "not commit"; return 1; }
-+	[ "$PIN_DIGEST_ALGORITHM" = sha256 ] ||
-+		{ pin_bad digest_algorithm "$PIN_DIGEST_ALGORITHM" "not sha256"; return 1; }
-+	[ "$PIN_DIGEST_DEFINITION" = sorted-ls-tree-r-v1 ] ||
-+		{ pin_bad digest_definition "$PIN_DIGEST_DEFINITION" "not sorted-ls-tree-r-v1"; return 1; }
-+	is_lower_hex 64 "$PIN_TREE_SHA256" ||
-+		{ pin_bad digests.tree_sha256 "$PIN_TREE_SHA256" "not 64 lowercase hex"; return 1; }
-+	[ -n "$PIN_VERIFY" ] || { pin_bad verify_pin "" ""; return 1; }
-+	[ -n "$PIN_RUNBOOK" ] || { pin_bad resync_runbook "" ""; return 1; }
-+	return 0
-+}
-+
-+# ---------------------------------------------------------------------------
-+# IN A CHECKOUT: three facts, one commit, then the implementation itself.
-+# ---------------------------------------------------------------------------
-+
-+#: THE COMMIT A SUPERPROJECT RECORDS AT <path>: the index first and HEAD
-+#: second, the order openRepoShape's `recorded_gitlink` asks them in.
-+recorded_gitlink() {   # <superproject> <path>
-+	# `read`, not `awk`: the offline path needs nothing a minimal PATH lacks.
-+	local listed mode oid stage kind path
-+	listed="$(git -C "$1" ls-files -s -- "$2" 2>/dev/null)" || listed=""
-+	read -r mode oid stage path <<<"$listed" || :
-+	if [ "$mode" != 160000 ] || [ "$stage" != 0 ] || [ "$path" != "$2" ]; then
-+		listed="$(git -C "$1" ls-tree HEAD -- "$2" 2>/dev/null)" || listed=""
-+		read -r mode kind oid path <<<"$listed" || :
-+		[ "$mode" = 160000 ] && [ "$kind" = commit ] && [ "$path" = "$2" ] || return 1
-+	fi
-+	is_lower_hex 40 "$oid" || return 1
-+	printf '%s\n' "$oid"
-+}
-+
-+delegate_local() {   # <assembly root> <args…>
-+	local root="$1" link code blob
-+	shift
-+	pin_parse "$root/$PIN_FILE" || die "$root/$PIN_FILE is not a code pin this can follow: $PIN_WHY.
-+    A pin that is present and wrong is refused rather than read around; nothing ran."
-+	link="$(recorded_gitlink "$root" "$PIN_SUBMODULE_PATH")" ||
-+		die "$root records no gitlink at $PIN_SUBMODULE_PATH, where $PIN_FILE mounts the code
-+    leg, so which implementation it pins cannot be checked; nothing ran."
-+	[ "$link" = "$PIN_COMMIT" ] || die "$root records $link at $PIN_SUBMODULE_PATH and $PIN_FILE says
-+    $PIN_COMMIT. The gitlink and the pin move in ONE commit (the lockstep rule), so
-+    this checkout does not say which implementation it means; nothing ran. Make
-+    them agree — \`make validate\` names the drift — then re-run."
-+	code="$root/$PIN_SUBMODULE_PATH"
-+	[ -f "$code/openRepoTools" ] || die "the code leg is not checked out at $code, so there is no
-+    implementation to run; nothing ran. Mount it, then re-run:
-+        git -C \"$root\" submodule update --init --recursive    (or: make bootstrap)"
-+	git -C "$code" cat-file -e "$PIN_COMMIT^{commit}" 2>/dev/null ||
-+		die "the pinned commit $PIN_COMMIT is not in $code's object store, so the
-+    implementation there cannot be checked against it; nothing ran. Run
-+    \`make bootstrap\` at $root, then re-run."
-+	blob="$(git -C "$code" rev-parse --verify --quiet "$PIN_COMMIT:openRepoTools" 2>/dev/null)" ||
-+		die "the pinned commit $PIN_COMMIT has no openRepoTools at its root; nothing ran."
-+	[ "$(git -C "$code" hash-object --no-filters -- openRepoTools 2>/dev/null)" = "$blob" ] ||
-+		die "$code/openRepoTools is not the implementation $root pins ($PIN_SOURCE_REPOSITORY
-+    at $PIN_COMMIT), so this front door does not run it; nothing ran. Put the code
-+    leg back at its pin (git -C \"$code\" checkout $PIN_COMMIT, or make bootstrap),
-+    or run a code checkout's own openRepoTools ON PURPOSE, which says what it installs."
-+	exec "${BASH:-bash}" "$code/openRepoTools" ${1+"$@"}
-+}
-+
-+# ---------------------------------------------------------------------------
-+# ANYWHERE ELSE: resolve once, read the pin there, run the pinned implementation.
-+# ---------------------------------------------------------------------------
-+
-+TMP=""
-+
-+said() {   # <tool> <its stderr file> — its first line, as one clause
-+	local first=""
-+	IFS= read -r first <"$2" 2>/dev/null || :
-+	case "$first" in
-+	'') printf '%s failed and said nothing\n' "$1" ;;
-+	"$1:"*) printf '%s\n' "$first" ;;
-+	*) printf '%s: %s\n' "$1" "$first" ;;
-+	esac
-+}
-+
-+#: `gh api` first and the raw URL second, the implementation's own order, into
-+#: a file that is checked before it is used. WHY holds what both said.
-+fetch_at() {   # <owner/name> <commit> <path> <dest>
-+	WHY=""
-+	if command -v gh >/dev/null 2>&1; then
-+		if gh api "repos/$1/contents/$3?ref=$2" -H 'Accept: application/vnd.github.raw' \
-+			>"$4" 2>"$TMP/err" && [ -s "$4" ]; then
-+			return 0
-+		fi
-+		WHY="$(said gh "$TMP/err")"
-+	else
-+		WHY="gh: not installed"
-+	fi
-+	if command -v curl >/dev/null 2>&1; then
-+		if curl -fsSL "https://raw.githubusercontent.com/$1/$2/$3" >"$4" 2>"$TMP/err" &&
-+			[ -s "$4" ]; then
-+			return 0
-+		fi
-+		WHY="$WHY; $(said curl "$TMP/err")"
-+	else
-+		WHY="$WHY; curl: not installed"
-+	fi
-+	return 1
-+}
-+
-+#: THE GITLINK `$REPO` RECORDS AT <path> IN <commit>, from one level of its tree:
-+#: `gh --jq` first, `curl` + `jq` second. 0 with GITLINK — empty when the tree
-+#: holds no gitlink there, which is an answer — or 1 with WHY when neither
-+#: transport answered. <path> is a pin's `submodule_path`, which `pin_parse`
-+#: has already held to one segment of letters, digits, `.`, `_` and `-`.
-+gitlink_at() {   # <commit> <path>
-+	local filter=".tree[] | select(.type == \"commit\" and .path == \"$2\") | .sha"
-+	GITLINK="" WHY=""
-+	if command -v gh >/dev/null 2>&1; then
-+		if gh api "repos/$REPO/git/trees/$1" --jq "$filter" >"$TMP/link" 2>"$TMP/err"; then
-+			IFS= read -r GITLINK <"$TMP/link" || :
-+			return 0
-+		fi
-+		WHY="$(said gh "$TMP/err")"
-+	else
-+		WHY="gh: not installed"
-+	fi
-+	if ! command -v curl >/dev/null 2>&1; then
-+		WHY="$WHY; curl: not installed"
-+	elif ! command -v jq >/dev/null 2>&1; then
-+		WHY="$WHY; curl: not asked, because reading api.github.com's JSON needs \`jq\` and there is none"
-+	elif ! curl -fsSL "https://api.github.com/repos/$REPO/git/trees/$1" >"$TMP/tree.json" 2>"$TMP/err"; then
-+		WHY="$WHY; $(said curl "$TMP/err")"
-+	elif jq -er '.tree | arrays | length >= 0' "$TMP/tree.json" >/dev/null 2>&1 &&
-+		jq -r "$filter" "$TMP/tree.json" >"$TMP/link" 2>/dev/null; then
-+		IFS= read -r GITLINK <"$TMP/link" || :
-+		return 0
-+	else
-+		WHY="$WHY; curl: an answer that is not a tree listing"
-+	fi
-+	return 1
-+}
-+
-+delegate_remote() {   # <args…>
-+	local sha="" ref="" impl
-+	is_slug "$REPO" || die "\$OPENREPOTOOLS_REPO is '$REPO', which is not an owner/name repository; nothing ran."
-+	TMP="$(mktemp -d)"
-+	trap 'rm -rf -- "$TMP"' EXIT
-+	# `%` and `#` mean something else in a URL path; nothing else a ref may hold does.
-+	ref="$(printf '%s' "$REF" | sed -e 's/%/%25/g' -e 's/#/%23/g')"
-+	WHY=""
-+	if command -v gh >/dev/null 2>&1; then
-+		if gh api "repos/$REPO/commits/$ref" -H 'Accept: application/vnd.github.sha' \
-+			>"$TMP/sha" 2>"$TMP/err"; then
-+			IFS= read -r sha <"$TMP/sha" || :
-+			is_lower_hex 40 "$sha" || { sha=""; WHY="gh: an answer that is not a commit"; }
-+		else
-+			WHY="$(said gh "$TMP/err")"
-+		fi
-+	else
-+		WHY="gh: not installed"
-+	fi
-+	if [ -z "$sha" ]; then
-+		if command -v curl >/dev/null 2>&1 &&
-+			curl -fsSL -H 'Accept: application/vnd.github.sha' \
-+				"https://api.github.com/repos/$REPO/commits/$ref" >"$TMP/sha" 2>"$TMP/err"; then
-+			IFS= read -r sha <"$TMP/sha" || :
-+			is_lower_hex 40 "$sha" || { sha=""; WHY="$WHY; curl: an answer that is not a commit"; }
-+		elif command -v curl >/dev/null 2>&1; then
-+			WHY="$WHY; $(said curl "$TMP/err")"
-+		else
-+			WHY="$WHY; curl: not installed"
-+		fi
-+	fi
-+	[ -n "$sha" ] || die "could not resolve $REPO at $REF to a commit, so no implementation was
-+    selected and nothing ran. What answered:
-+        $WHY"
-+	fetch_at "$REPO" "$sha" "$PIN_FILE" "$TMP/pin" || die "could not read $PIN_FILE from $REPO at
-+    $sha ($REF), so which implementation it pins is not known and nothing ran.
-+    What answered:
-+        $WHY
-+    This is the assembly's front door. A single repository is installed by its own
-+    root openRepoTools: gh api repos/$REPO/contents/openRepoTools?ref=$REF ..."
-+	pin_parse "$TMP/pin" || die "$PIN_FILE in $REPO at $sha ($REF) is not a code pin this can
-+    follow: $PIN_WHY. A pin that is present and wrong is refused rather than read
-+    around; nothing ran."
-+	# THE LOCKSTEP RULE, BEFORE ANYTHING IS FETCHED TO RUN: the gitlink at the
-+	# pinned path in this same commit names the pinned commit, or nothing runs.
-+	gitlink_at "$sha" "$PIN_SUBMODULE_PATH" || die "could not list $REPO at $sha ($REF), so the gitlink its $PIN_FILE
-+    must agree with cannot be read, and nothing ran. What answered:
-+        $WHY"
-+	[ "$GITLINK" = "$PIN_COMMIT" ] || die "$REPO at $sha ($REF) records ${GITLINK:-no gitlink} at $PIN_SUBMODULE_PATH and
-+    its $PIN_FILE says $PIN_COMMIT. The gitlink and the pin move in ONE commit
-+    (the lockstep rule), so this assembly does not say which code it means, and
-+    nothing ran."
-+	fetch_at "$PIN_SOURCE_REPOSITORY" "$PIN_COMMIT" openRepoTools "$TMP/impl" ||
-+		die "could not fetch openRepoTools from $PIN_SOURCE_REPOSITORY at $PIN_COMMIT, the
-+    implementation $REPO at $sha ($REF) pins, so nothing ran. What answered:
-+        $WHY"
-+	case "$(head -n 1 "$TMP/impl")" in
-+	'#!'*) ;;
-+	*) die "what came back for openRepoTools from $PIN_SOURCE_REPOSITORY at $PIN_COMMIT is not a
-+    script, so nothing ran." ;;
-+	esac
-+	impl="$(cat "$TMP/impl")"
-+	rm -rf -- "$TMP"
-+	trap - EXIT
-+	# THE REF THE IMPLEMENTATION RESOLVES IS THE COMMIT THIS ONE READ, so the
-+	# pin it reads is this pin; it runs from stdin, as the one-liners run it.
-+	OPENREPOTOOLS_REPO="$REPO"
-+	OPENREPOTOOLS_REF="$sha"
-+	export OPENREPOTOOLS_REPO OPENREPOTOOLS_REF
-+	exec bash -s -- ${1+"$@"} <<<"$impl"
-+}
-+
-+if [ -f "$SELF" ] && [ -f "$(cd -- "$(dirname -- "$SELF")" && pwd)/$PIN_FILE" ]; then
-+	delegate_local "$(cd -- "$(dirname -- "$SELF")" && pwd)" ${1+"$@"}
-+fi
-+delegate_remote ${1+"$@"}
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t009-assembly-caps.patch b/specs/004-migrate-to-triad/patches/t009-assembly-caps.patch
deleted file mode 100644
index 1a68b851..00000000
--- a/specs/004-migrate-to-triad/patches/t009-assembly-caps.patch
+++ /dev/null
@@ -1,133 +0,0 @@
-From acf1a5ed302758c8d354ab7a70f726887bf87dca Mon Sep 17 00:00:00 2001
-From: Brett Heap <1513478+brettheap@users.noreply.github.com>
-Date: Mon, 19 Oct 2026 17:40:00 +0000
-Subject: [PATCH] The assembly root's two length caps are the re-cut
- assembly-0001's own counts, AGENTS.md 354 and README.md 529, each set in a
- dated entry, and tests/test_test_roots.py holds them.
-
-Code-leg patch for opensoft/openRepoTools#186, task T009 of
-specs/004-migrate-to-triad/tasks.md, against the test files #228's series
-leaves: 006-release-pypi-t025 b3aab89 with 006-release-pypi-pr3fix c6cea2a
-merged in. It pairs with the re-cut assembly-0001 of the same day, and it
-goes on the code leg after T006's code-0001 and the T010 code-leg patch.
-
-- tests/test_repo_hygiene.py: `cap = 330 if ROOTS.assembly is None else
-  347` becomes `else 354`, and `cap = 505 if ROOTS.assembly is None else
-  510` becomes `else 529`. Each is this repository's own count plus the
-  twenty-four lines the re-cut adds, measured on the re-cut applied by `git
-  am --3way` to a root built from the split's root files. A dated entry in
-  each docstring says so, under the 2026-10-18 entries that said the re-cut
-  would set them again.
-- tests/test_test_roots.py: the at-cap and one-over fixtures and the two
-  failure messages move with them, 354/355 and 529/530, and the docstring
-  names the new caps.
-
-The standalone caps, 330 and 505, do not move.
-
-Lane: openRepoTools-1
-Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
----
- tests/test_repo_hygiene.py | 26 ++++++++++++++++++++++++--
- tests/test_test_roots.py   | 29 ++++++++++++++---------------
- 2 files changed, 38 insertions(+), 17 deletions(-)
-
-diff --git a/tests/test_repo_hygiene.py b/tests/test_repo_hygiene.py
-index a97f5a8..832998f 100644
---- a/tests/test_repo_hygiene.py
-+++ b/tests/test_repo_hygiene.py
-@@ -1976,9 +1976,19 @@ def test_agents_md_is_short_enough_to_be_read():
-     at offsets seven lines further on. The re-cut that makes the assembly's
-     file again sets its cap, and `tests/test_test_roots.py` holds 347 until
-     then.
-+
-+    330 HERE AND 347 -> 354 AT AN ASSEMBLY ROOT, on 2026-10-19 (#186, T009):
-+    the re-cut again sets its cap, as the entry above says it does.
-+    `assembly-0001`, re-cut against the AGENTS.md #228's series leaves, keeps
-+    the twenty-four lines the 316 entry names — the shape's first-line pointer
-+    and the triad map — and adds none: each hunk that had stopped applying
-+    makes its own path repair on the text that moved under it, one line for
-+    one. So the assembly's file is this one's 330 plus those twenty-four, 354,
-+    measured with the re-cut applied by `git am --3way` to a root built from
-+    the split's root files, and `tests/test_test_roots.py` holds 354.
-     """
-     lines = doc("AGENTS.md").read_text().splitlines()
--    cap = 330 if ROOTS.assembly is None else 347
-+    cap = 330 if ROOTS.assembly is None else 354
-     assert len(lines) <= cap, f"AGENTS.md is {len(lines)} lines; the cap is {cap}"
- 
- 
-@@ -2511,9 +2521,21 @@ def test_readme_is_short_enough_to_be_read():
-     makes the assembly's file again sets its cap, as the 2026-10-18 AGENTS.md
-     entry above says for its 347, and `tests/test_test_roots.py` holds 510
-     until then.
-+
-+    505 HERE AND 510 -> 529 AT AN ASSEMBLY ROOT, on 2026-10-19 (#186, T009):
-+    the re-cut again sets its cap, as the entry above says it does.
-+    `assembly-0001`, re-cut against this README, keeps the twenty-four lines
-+    the 2026-10-08 entry names and adds none: the three-repository section
-+    with the lockstep invariant, nineteen; the assembly's install sentence,
-+    four, still straight after the two install lines and so now above T024's
-+    one-route paragraph; and the `cd code` of the pin-bump block, one. The
-+    three hunks the entry above names keep their own lines, one for one. So
-+    the assembly's README is this one's 505 plus twenty-four, 529, measured on
-+    the re-cut as the AGENTS.md entry of this day measures 354, and
-+    `tests/test_test_roots.py` holds 529.
-     """
-     lines = doc("README.md").read_text().splitlines()
--    cap = 505 if ROOTS.assembly is None else 510
-+    cap = 505 if ROOTS.assembly is None else 529
-     assert len(lines) <= cap, f"README.md is {len(lines)} lines; the cap is {cap}"
- 
- 
-diff --git a/tests/test_test_roots.py b/tests/test_test_roots.py
-index f9c0dca..9c784ed 100644
---- a/tests/test_test_roots.py
-+++ b/tests/test_test_roots.py
-@@ -360,21 +360,20 @@ def test_the_pin_rules_are_read_with_the_assemblys_code_prefix(tmp_path, prefixe
- 
- 
- def test_the_length_caps_are_the_assembly_roots_where_one_is_named(tmp_path):
--    """At an assembly root the two caps are 347 and 510. The dated entries in
--    `tests/test_repo_hygiene.py` made them from this repository's then caps,
--    323 and 486, and the twenty-four lines each that T006's root guidance adds
--    there, and they stand there while this repository's own are 330 and 505 at
--    this head: `assembly-0001` no longer applies to today's AGENTS.md or
--    README, so the re-cut that makes the assembly's files again sets them. And
--    they are asked of the ASSEMBLY's files: one line over FAILS, the cap itself
--    passes. Red at `origin/main`, which counted this checkout's own README and
--    AGENTS.md whatever was named."""
-+    """At an assembly root the two caps are 354 and 529: this repository's 330
-+    and 505 and the twenty-four lines each that T006's root guidance adds
-+    there, set again on 2026-10-19 by the re-cut of `assembly-0001` (the
-+    dated entries in `tests/test_repo_hygiene.py`; they were 347 and 510, from
-+    the 323 and 486 of 2026-10-09, and stood while the old patch no longer
-+    applied). And they are asked of the ASSEMBLY's files: one line over FAILS,
-+    the cap itself passes. Red at `origin/main`, which counted this checkout's
-+    own README and AGENTS.md whatever was named."""
-     def lines(n: int) -> str:
-         return "".join(f"line {i}\n" for i in range(n))
--    at_cap = assembly(tmp_path / "at", readme=lines(510))
--    (at_cap / "AGENTS.md").write_text(lines(347), encoding="utf-8")
--    over = assembly(tmp_path / "over", readme=lines(511))
--    (over / "AGENTS.md").write_text(lines(348), encoding="utf-8")
-+    at_cap = assembly(tmp_path / "at", readme=lines(529))
-+    (at_cap / "AGENTS.md").write_text(lines(354), encoding="utf-8")
-+    over = assembly(tmp_path / "over", readme=lines(530))
-+    (over / "AGENTS.md").write_text(lines(355), encoding="utf-8")
-     select = f"{AGENTS_CAP_TEST} or {README_CAP_TEST}"
-     green = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(at_cap)},
-                    select, "test_repo_hygiene.py")
-@@ -382,8 +381,8 @@ def test_the_length_caps_are_the_assembly_roots_where_one_is_named(tmp_path):
-         assert green.outcome(name)[0] == "passed", green.output[-3000:]
-     red = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(over)},
-                  select, "test_repo_hygiene.py")
--    for name, said in ((AGENTS_CAP_TEST, "AGENTS.md is 348 lines; the cap is 347"),
--                       (README_CAP_TEST, "README.md is 511 lines; the cap is 510")):
-+    for name, said in ((AGENTS_CAP_TEST, "AGENTS.md is 355 lines; the cap is 354"),
-+                       (README_CAP_TEST, "README.md is 530 lines; the cap is 529")):
-         outcome, message = red.outcome(name)
-         assert outcome == "failure" and said in message, (
-             f"{name} {outcome} on an assembly file one line over its cap:\n"
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t010-assembly-exact-pin-job.patch b/specs/004-migrate-to-triad/patches/t010-assembly-exact-pin-job.patch
deleted file mode 100644
index 483b8dff..00000000
--- a/specs/004-migrate-to-triad/patches/t010-assembly-exact-pin-job.patch
+++ /dev/null
@@ -1,131 +0,0 @@
-From 247f63df27ae493f961dc4e6f91df400c9cc6531 Mon Sep 17 00:00:00 2001
-From: openRepoTools CI <ci@openrepotools.invalid>
-Date: Thu, 8 Oct 2026 21:52:59 +0000
-Subject: [PATCH] Add the assembly's exact-pin integration job as its own
- workflow, which runs the code leg's suite composed and refuses any absent
- context.
-
-validate.yml is a pinned shape copy, so the job lives in composed.yml.
-T010 of specs/004-migrate-to-triad/tasks.md (#186).
-
-Lane: openRepoTools-1
----
- .github/workflows/composed.yml | 106 +++++++++++++++++++++++++++++++++
- 1 file changed, 106 insertions(+)
- create mode 100644 .github/workflows/composed.yml
-
-diff --git a/.github/workflows/composed.yml b/.github/workflows/composed.yml
-new file mode 100644
-index 0000000..113f094
---- /dev/null
-+++ b/.github/workflows/composed.yml
-@@ -0,0 +1,106 @@
-+name: composed
-+
-+# THE EXACT-PIN INTEGRATION GATE (opensoft/openRepoTools#186, T010 of
-+# `specs/004-migrate-to-triad/tasks.md`; FR-008). `validate` beside this file
-+# says the three records of each leg agree — gitlink, pin, digest. This says
-+# the code those records name PASSES ITS OWN SUITE, composed with the spec leg
-+# and the dependency it was pinned beside: the whole arrangement at the exact
-+# commits this root records, and nothing allowed to skip its way to green.
-+#
-+# WHY A SIBLING AND NOT A JOB IN `validate.yml`: that file is a COPY of
-+# openRepoShape's, digest-pinned in `contracts/shape-pin.yaml`. An edit to it
-+# is drift `scripts/validate-pins.py` and `status` both report. This file is
-+# this project's own, and it references no leg by `<org>/<leg>@<sha>`, so the
-+# lockstep rule has nothing in it to move.
-+#
-+# LINUX ONLY, on purpose. The platform matrix — macOS's bash 3.2 parse and its
-+# `ready`-label suite, Windows and the no-submodule skip path — is the code
-+# leg's own `tests` workflow, and it stays there. What only this root can run
-+# is the COMPOSED suite: `OPENREPOTOOLS_COMPOSED=1` turns every absent root
-+# into a refusal and every check that would have skipped for want of one into
-+# a failure, so a green run here is a claim about all three legs at once.
-+#
-+# IT REFUSES ABSENT CONTEXT TWICE OVER. The step below fails on any missing
-+# leg, pin or dependency file before a test runs; and the suite's own
-+# `tests/conftest.py` refuses a composed session (pytest's exit 4) when the
-+# assembly or spec root is absent, the dependency is not initialized, or the
-+# code or spec leg is not at the commit this root records for it. A leg this
-+# job cannot fetch — a private leg with no credential — fails the checkout,
-+# which is the same refusal: composed acceptance with a leg missing is the one
-+# thing this job must never report. The legs are fetched over https, as
-+# `.gitmodules` names them; nothing here allows a `file://` transport.
-+
-+on:
-+  pull_request:
-+  push:
-+    branches: [main]
-+  workflow_dispatch:
-+
-+jobs:
-+  exact-pins:
-+    # THIS UBUNTU RUNNER IS ON 24.04: `ubuntu-latest` became Ubuntu 26.04 on
-+    # 2026-10-21. There the `[host]` case of the TERM-ignoring kill test, which
-+    # this job's suite runs, fails. Pinned until 26.04 support is decided.
-+    runs-on: ubuntu-24.04
-+    steps:
-+      # PINNED BY COMMIT, the same two actions the code leg pins. RECURSIVE:
-+      # the legs, and the dependency nested in the code leg.
-+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
-+        with:
-+          submodules: recursive
-+          fetch-depth: 1
-+          persist-credentials: false
-+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
-+        with:
-+          python-version: '3.x'
-+
-+      - name: every context the composed run claims is here
-+        run: |
-+          set -euo pipefail
-+          missing=0
-+          for need in project.yaml contracts/code-pin.yaml contracts/spec-pin.yaml \
-+                      code/openRepoTools code/tests/run.sh code/tests/conftest.py \
-+                      code/contracts/openreposhape-pin.yaml \
-+                      code/upstream/openRepoShape/scripts/repo_shape.py \
-+                      code/upstream/openRepoShape/templates/workspace-root/README.md; do
-+            if [ ! -f "$need" ]; then
-+              echo "::error::the composed run needs $need, and this checkout has none"
-+              missing=1
-+            fi
-+          done
-+          if [ ! -d spec/openspec ] && [ ! -d spec/specs ] && [ ! -d spec/docs ]; then
-+            echo "::error::the spec leg is not checked out at spec/"
-+            missing=1
-+          fi
-+          git submodule status --recursive
-+          exit "$missing"
-+
-+      # The same two the `validate` workflow runs, here as the gate's FIRST
-+      # half: a suite that passes at a gitlink the pin does not name passes
-+      # at the wrong commit.
-+      - name: the manifest and the lockstep pins
-+        run: |
-+          python3 scripts/validate-manifest.py
-+          python3 scripts/validate-pins.py
-+
-+      - name: install the test runner
-+        run: python3 -m pip install --disable-pip-version-check pytest==8.3.4
-+
-+      - name: git identity for the fixture commits (env, not global config)
-+        run: |
-+          {
-+            echo "GIT_AUTHOR_NAME=openRepoTools CI"
-+            echo "GIT_AUTHOR_EMAIL=ci@openrepotools.invalid"
-+            echo "GIT_COMMITTER_NAME=openRepoTools CI"
-+            echo "GIT_COMMITTER_EMAIL=ci@openrepotools.invalid"
-+          } >> "$GITHUB_ENV"
-+
-+      # THE CODE LEG'S OWN ENTRY POINT, serialized as it is everywhere: the
-+      # roots are named, not inferred, and `-rs` prints any skip that remains
-+      # (a platform one; none for want of a root can reach this far).
-+      - name: the code leg's suite, composed, at the exact pins
-+        env:
-+          OPENREPOTOOLS_COMPOSED: '1'
-+          OPENREPOTOOLS_ASSEMBLY_ROOT: ${{ github.workspace }}
-+          OPENREPOTOOLS_SPEC_ROOT: ${{ github.workspace }}/spec
-+        run: bash code/tests/run.sh -rs
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/patches/t010-code-leg-tests-workflow.patch b/specs/004-migrate-to-triad/patches/t010-code-leg-tests-workflow.patch
deleted file mode 100644
index da01ecd6..00000000
--- a/specs/004-migrate-to-triad/patches/t010-code-leg-tests-workflow.patch
+++ /dev/null
@@ -1,88 +0,0 @@
-From 1b10dd968ac63f2ab3a5fe0fbae355aa67b039e4 Mon Sep 17 00:00:00 2001
-From: openRepoTools CI <ci@openrepotools.invalid>
-Date: Mon, 19 Oct 2026 14:28:41 +0000
-Subject: [PATCH] Name the code leg's standalone checkout context in its tests
- workflow (T010, #186).
-
-Made against the tests.yml that #228's PR 2 leaves (blob 2cfa173), the file
-the code leg takes at the cutover. It adds the header paragraphs, the workflow
-`env:` that names the code root and the standalone mode, and the note on
-`tests-no-submodule` that says where the leg's skips are read. It changes no
-job, no trigger and no `run:` line: tests/test_tests_workflow.py pins the first
-three jobs' `run:` lines and the four job ids the release gate reads.
-
-Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
----
- .github/workflows/tests.yml | 42 ++++++++++++++++++++++++++++++++++++-
- 1 file changed, 41 insertions(+), 1 deletion(-)
-
-diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
-index 2cfa173..e2d1fe2 100644
---- a/.github/workflows/tests.yml
-+++ b/.github/workflows/tests.yml
-@@ -25,6 +25,33 @@ name: tests
- # job. A suite nothing runs is not a suite (act 3, obligation 6). It is bash,
- # and with macOS out of CI it runs under Linux's bash 5 only: no job here parses
- # it under Apple's bash 3.2 any more.
-+#
-+# THIS IS THE CODE LEG'S WORKFLOW, AND EVERY JOB IN IT IS STANDALONE
-+# (opensoft/openRepoTools#186, T010 of `specs/004-migrate-to-triad/tasks.md`,
-+# which lives in the spec leg). The leg is cloned at its own root:
-+# `actions/checkout` puts the code root at `$GITHUB_WORKSPACE`, named below as
-+# `OPENREPOTOOLS_CODE_ROOT`, and `submodules: true` (`tests-no-submodule`
-+# excepted, as above) initializes the one submodule the leg has, the
-+# dependency `upstream/openRepoShape`. There is no assembly above it and no
-+# spec leg beside it, so `tests/conftest.py` resolves neither: the checks of
-+# the documents those two own (`README.md`, `AGENTS.md`, `CLAUDE.md`,
-+# `docs/README-lanes.md`) SKIP here, each naming the root it needs, and
-+# `tests-no-submodule`'s `-rs` prints every reason.
-+# `OPENREPOTOOLS_COMPOSED: '0'` says in the file what the jobs are: nothing
-+# here is composed acceptance. That claim is the assembly root's `composed`
-+# workflow, which checks out all three at their exact pins and runs this same
-+# suite with an absent root a refusal and not a skip.
-+#
-+# The jobs and their triggers are not changed by the move: Linux only, as
-+# above, and `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`
-+# on every trigger below. #228's `package` job and its `release/v*` push
-+# trigger belong to this leg, where releases are built and tagged from v1.1.0
-+# on, and the release workflow reads those four job ids by name, so the leg
-+# keeps every one. What the leg needs besides this workflow is two files of
-+# its own: `.gitattributes`, because git never reads the assembly's into a
-+# submodule (`test_the_root_carries_the_line_ending_rule` reads the leg's
-+# copy), and `LICENSE`, which the wheel carries, both from T006's `code-0001`,
-+# the first commit after the split.
- 
- # `pull_request` names `labeled` beside GitHub's own three defaults
- # (`opened`, `synchronize`, `reopened`). It was put there so that the
-@@ -47,6 +74,15 @@ on:
-     - cron: '17 4 * * *'          # 04:17 UTC, nightly
-   workflow_dispatch:
- 
-+# THE CHECKOUT CONTEXT, NAMED (#186, T010): the code root is the checkout's
-+# own root, and the run is standalone. Every job below checks out into
-+# `github.workspace`, so this one `env:` reaches all four, whether the suite
-+# is run through `tests/run.sh`, which passes both variables on as they are,
-+# or by pytest directly.
-+env:
-+  OPENREPOTOOLS_CODE_ROOT: ${{ github.workspace }}
-+  OPENREPOTOOLS_COMPOSED: '0'
-+
- jobs:
-   # Keep the process launch contract independently visible while the full
-   # lane-helper suite runs. Each GitHub job has its own workstation runner;
-@@ -122,7 +158,11 @@ jobs:
-   # one nobody finishes. So one job checks out with NO submodules and asserts
-   # the suite still exits 0: the estate tests skip, naming
-   # `git submodule update --init upstream/openRepoShape`, and the hygiene and
--  # installer tests — which need nothing but this repository — still run.
-+  # installer tests — which need nothing but this repository — still run. In
-+  # the leg the document checks skip here too, naming the assembly or spec
-+  # root, exactly as they do in `guard-launch-mode` and `tests`, which print
-+  # no reasons: a skip a person cannot read is a skip nobody audits, so the
-+  # reasons are read here.
-   #
-   # `pytest -q` exits 0 on skips and 1 on failures, so the job's own status IS
-   # the assertion; `-rs` prints the skip reasons, which is what a person
--- 
-2.43.0
-
diff --git a/specs/004-migrate-to-triad/plan.md b/specs/004-migrate-to-triad/plan.md
deleted file mode 100644
index f0df01fc..00000000
--- a/specs/004-migrate-to-triad/plan.md
+++ /dev/null
@@ -1,258 +0,0 @@
-# Migration plan: openRepoTools assembly/spec/code triad
-
-**Feature**: `004-migrate-to-triad` | **Date**: 2026-10-03
-**State**: Preparation and disposable rehearsal performed; real adoption remains on hold
-**Refresh**: 2026-10-04; adopted amendment protocol and merged PR #134 incorporated
-**Spec**: [spec.md](spec.md)
-**Governance**: [proposal](../../openspec/changes/migrate-to-triad/proposal.md)
-
-## Baseline and deliverables
-
-The user authorized preparation while #97/#121 are active and will notify us
-when they land. **Wait for both landings before real triad conversion.** The
-[preparation receipt](preparation.md) records verified private preservation,
-partial local extraction and a measured pinned-adopter refusal. Gates A/B are
-still open. The [installer design](installer-design.md) is ready for follow-up
-implementation after successful standard split verification.
-
-The [adoption mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml)
-was regenerated from main `daed20957f2dd2f22cca24053bb5bc8636ff6b3f` using pinned
-openRepoShape `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`. All 64 tracked
-paths are resolved: 18 spec, 40 code, six root, zero dropped. There are
-28 named follow-ups, including protocol placement/provenance/reconciliation.
-This is an inspected preliminary baseline; regenerate
-after planning lands and the actual cutover source is frozen.
-
-Main advanced with merged PR #134 and matches the read-only GitHub observation;
-#61 and #146 remain included. There are six
-worktrees and six local branches, including this planning checkout and the
-retained `feat/claude-current` checkout, whose merged changes need no replay.
-The two open PRs are #121 and #97. Feature 001 remains at
-`3c26041a4444a10bc240cb64a168ece4d9edf6c5`, committing its broker/task-recovery
-changes, restored rollover/workspace packets and October 4 launcher contracts.
-Main and feature 001 remain clean. PR #121's earlier dirty work, including
-`005-supervised-legacy-ctx`, has advanced into newer commits; the recovery
-branch also advanced. Local and remote PR heads can differ while owners work.
-The inventory is an observation, not a freeze of active writers.
-The [inventory](inventory.json) keeps the October 3 cleanup as history and
-records current heads, dirty counts and the two remote-only preservation refs.
-Machine paths, secrets/transcripts and backup contents are omitted; private
-receipts must capture them at the execution gate. Clean commits do not replace
-verified preservation/restore receipts.
-
-Cleanup does not require recreating removed worktrees. Continue only the
-retained work below, and verify existing preservation receipts for retired
-objects. Snapshot refresh alone does not complete preservation Gate A.
-
-The [protocol review](protocol-review.md) records the October 4 manual default
-and source snapshots. Full proposals, archives, canonical specs/contracts and
-Speckit files stay in spec. Genuine bounded amendments belong in the code
-feature folder and require immediate working-spec updates plus final docs
-reconciliation. Schema/routing/distribution/placement automation is pending.
-
-## Target placement
-
-| Owner | Existing paths / generated responsibilities | Reason |
-| --- | --- | --- |
-| Assembly `openRepoTools` | `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitattributes`, `.gitignore`; generated manifest/Makefile/validators and assembly pins | Front door and project coordination across legs. |
-| Spec `openRepoTools-spec` | `openspec/`, `specs/`, `docs/`; feature 001's retained `ideation/` and restored planning packets | Product requirements, decisions and manual; feature-only paths need separate replay accounting. |
-| Code `openRepoTools-code` | All executable tools, `repos.tsv`, `commands/`, `skills/`, `tests/`, implementation CI | Shipped implementation and its installer payload. |
-| Code dependency unit | Original `.gitmodules`, `upstream/openRepoShape`, `contracts/openreposhape-pin.yaml` | Keep module registration, exact gitlink and dependency lock together. |
-| Code amendment exception | Genuine bounded `features/<NNN-feature>/openspec/` records, deltas and evidence references | Relative changes against an approved spec baseline; explicitly review placement until upstream qualification. No such tracked paths were observed in the current source or retained feature heads. |
-| Root workflow bootstrap | `.specify/`, project agent links and selected feature pointer | Currently local/ignored; capture config and regenerate shape-aware root scaffolding. |
-
-After byte-preserving extraction, add a root installation entry point that
-resolves the exact code pin. The original installer implementation moves to
-code; the root entry point selects and invokes it. Preserve the existing user
-one-liner and installed command names. Do not duplicate installer mechanics.
-
-## Phase 1 — Review and preserve work
-
-Land the planning artifacts through normal review before freezing execution.
-Refresh GitHub PR/main observations and local branch/worktree state. This
-single repository has no estate manifest yet: `status --fetch openRepoTools`
-currently refuses with no estate named openRepoTools and performs no fetch.
-Relay that refusal; do not run `resume` to silence it. Use the estate status
-surface after a valid adopted root exists. Verify the proposed leg names are available
-and decide visibility. Agree a bounded cutover with current lane owners.
-Capture original history, all branch refs, detached HEADs, staged/unstaged and
-untracked content, ignored workflow config and installed receipts/config.
-Use host-local backups or the existing private WIP repository; public records
-hold only safe identities/digests. Prove restoration before declaring capture
-complete. Never edit workspace.yaml or recreate estate parking logic.
-
-Recommended active-work dispositions are proposals, not merge/closure actions:
-
-| Work | Proposed treatment |
-| --- | --- |
-| `001-separate-swap-ctx-handoff` | Continue from committed, clean head `3c26041`; preserve the complete branch delta, restored rollover/workspace packets and launcher/broker contracts. Migrate to paired `001` worktrees; keep tasks, evidence, roles and activation gates. |
-| PR #97 | Preserve its current advanced recovery branch, review history and diagnostic role separately from managed LS authority and PR #121. Carry useful diagnostics under feature 001's service authority without merging unchanged or auto-closing through adoption. |
-| PR #121 / feature `005-supervised-legacy-ctx` | Preserve complete staged/unstaged/untracked contents and the full legacy authority decision. Continue paired `005` worktrees for confirmed legacy-only supervised restart; managed/unknown ownership refuses. Keep the existing merge hold and PR #97 ownership separate. The full proposal/decision/specs stay in spec, implementation/tests in code; this authority decision is not a bounded local amendment. |
-| PR #146 / `fix/107-pty-driver-bound-and-lane-per-call-cost` | Merged as `82ecebe`; checkout and local branch removed during concurrent cleanup. Included by baseline extraction; do not replay separately. |
-| PR #134 / `feat/claude-current` | Merged as `daed209`; the retained clean checkout at `11037f0` is preservation history. Resolver/checker, installer, preflight/fencing, timeout tests and manual are included by the regenerated baseline. Do not replay separately or retire the checkout as part of planning. |
-| PR #61 | Merged as `14641fd`, an ancestor of current main; included by baseline extraction. Do not replay the retired claim-takeover branch separately. |
-| Retired `002`, `003`, lclaude and detached worktrees | Removed from current registrations/local branches by cleanup. Verify cleanup/preservation receipts; remove from the active replay queue and do not recreate them from the old snapshot. |
-| Remote-only preservation refs | `chore/preserve-local-planning-20261003` and `takeover/ort-a9-dirty-snapshot-20260913` remain locally observed remote-tracking refs with no checkout; review as preservation history, not active writers. |
-| Migration feature `004` | Previous refresh committed at `dda91f1`; existing checkout reused for this update. This full proposal and canonical feature files stay in spec; any genuine bounded implementation amendments belong in code. |
-
-**Gate A:** every preserved object is attributable and restorable; no active
-writer can silently invalidate capture. Baseline, visibility and work
-dispositions are ready for review, with any unresolved owner decision explicit.
-
-## Phase 2 — Rehearse locally and make follow-ups reviewable
-
-Use a fresh isolated source clone at the chosen source commit with no linked
-worktrees. Make `git-filter-repo` available through the approved prerequisite
-path. Regenerate the mapping, retain reasoned overrides and run standard check.
-Rehearse the standard's adoption against temporary local bare remotes with no
-real GitHub repository creation or default-branch movement.
-
-Verify nested dependency extraction, source `.gitmodules` handling, full
-baseline accounting, leg histories and recursive bootstrap. Exercise all
-actual file-placement collisions. If the standard refuses or misaccounts
-content, relay it and resolve through a reviewed standard change/pin bump;
-do not patch the pinned submodule or adjust digests to manufacture success.
-Review genuine amendment paths explicitly as code using a reasoned project-local
-resolution until the upstream exception is qualified. Full proposals created
-on feature branches remain full proposals in spec; do not manufacture amendments
-for historical features. Record original approved repository/commit/path and
-verified extracted spec correspondence: filtering may change commit hashes.
-Repair relative links, selected roots/stores and task paths without guessing
-new baseline identities or replacing approval provenance with the split tip.
-
-Implement and review the necessary installer entry point/resolver, explicit
-test-root context, CI layout, agent pointers, docs paths and workflow bootstrap
-in the rehearsed arrangement. Record their patches and resulting commits so
-real execution can apply the reviewed changes after source verification.
-Add leg root guidance without overwriting original root guidance. Preserve
-the Bash 3.2 floor and original no-submodule test behavior, while requiring
-complete dependencies for composed acceptance.
-
-Operate full proposals from the intended feature spec checkout and bounded
-amendments from the code feature folder. Verify checkout, branch and root for
-each operation; a local root takes precedence over a docs-store pointer.
-Use explicit `--store` only if the installed CLI supports it and resolves the
-intended feature checkout. Maintain amendments manually until schema/routing
-is qualified. Check workBenches protocol/command distribution on each target
-workstation; regeneration of root scaffolding alone does not distribute this
-decision. Pending automation remains with workBenches/openRepoShape.
-
-**Gate B:** complete local rehearsal evidence, restore rehearsal, reviewed
-follow-up patches, resolved mapping and a passing compatibility test matrix.
-Mapping `check` alone does not satisfy this gate.
-
-The provisional rehearsal passed mapping check and preserved extracted bytes,
-then returned 2 mounting the legs because `.gitmodules` was staged for deletion.
-See [adopter-blocker.md](adopter-blocker.md). Stop adoption on this refusal;
-resolve upstream and repeat into fresh local remotes before treating Gate B
-as passed. Installer/topology design can proceed while that resolution is pending.
-
-## Phase 3 — Freeze and approve real adoption
-
-After #97 and #121 land, account for their final merged content through the
-new main baseline instead of replaying it as unfinished work. Review any
-remaining local deltas separately. Coordinate a bounded main landing hold
-using applicable lane protocol. Re-read
-current main and owner state, finalize source commit, mapping, standard pin,
-visibility, follow-ups and preservation receipts. Any source drift requires
-plan regeneration and check, not editing the commit field by hand. Present
-the final plan and follow-ups for explicit approval before real execution.
-
-**Gate C:** approval names the actual source/standard revisions, leg repositories,
-visibility and final plan; prerequisites, Gate A/B evidence and no-name-collision
-checks are current. Do not infer consent from this planning request.
-
-## Phase 4 — Create the legs and assemble the reviewed candidate
-
-Run the standard's approved `execute` from the isolated clone. It creates
-the legs, extracts histories, mounts/pins them, opens the root split PR and
-prints content accounting. Relay its table and refusals. A nonzero verification
-stops landing; preserve source and newly created evidence/branches. Never rerun
-over live legs or bypass a ruleset.
-
-After successful source verification, apply reviewed follow-ups through the
-new leg/root PRs and prepare docs/code review together. For bounded migration
-adjustments, record decision authority, approved baseline, unique amendment ID,
-affected requirements/tasks and evidence in code; update working Speckit files
-in the paired spec worktree before dependent implementation. Create one spec
-reconciliation issue at the first amendment and link every later record. Larger
-scope, runtime, authority or external-contract changes require full spec
-governance; defer unnecessary capabilities to linked future-proposal issues.
-Speckit remains the sole executable task list.
-
-Resolve `shape/` collisions explicitly; do not overwrite
-pinned shape files. Put `Read AGENTS-shape.md first...` guidance first in root
-agent instructions and bootstrap shape-aware OpenSpec/Speckit only when both
-legs exist. Prepare continued-feature translations and disposable workflow
-checks from Phase 5 in the candidate before the final migration batch; actual
-lane rebinding still waits for reviewed cutover. After implementation and verification, reconcile the net tested
-effect in one final spec batch: governing specs/contracts/design, dated departures,
-as-built record, all amendment dispositions, evidence, deferred ideas and the
-actual landed code commit. Retain superseded/reverted/deferred history while
-excluding inactive deltas. Preserve archived approvals through linked records.
-Code may land first; completed assembly advancement waits for reconciliation
-to land and matching spec/code pins. Close the reconciliation issue after the
-spec PR lands; the feature landing record tracks the assembly PR. Advance
-gitlinks, pin digests and workflow SHAs together using the standard bump tool.
-
-**Gate D:** prepared continued-feature receipts and disposable workflow checks
-are reviewed; final reconciliation and matching spec/code commits are landed;
-exact assembled commits pass manifest/pin checks, canonical code
-tests/platform checks, install compatibility and bootstrap. The existing
-source/install remain usable until root adoption review and merge complete.
-
-## Phase 5 — Continue features and cut over lanes
-
-Translate each approved retained feature delta into reviewed spec/code/root
-changes and dirty/untracked replay with checksums. Use paired feature branches
-and worktrees under `worktrees/<feature>/{spec,code}`; preserve feature IDs and
-map old commits to new leg commits. Review conflicts semantically. Account
-for completed/landed work before replaying it. Retain original worktrees.
-
-Prove feature 001's service-owned inventory requirements, restored
-`add-automatic-context-rollover` governance and lane-set workspace/rollover
-brainstorm packets survive the replay. Carry its accepted October 4 launcher
-contract and FR-047/T063–T065 without claiming runtime acceptance: workBenches
-owns `pclaude`/`oclaude`/`lclaude`, openRepoTools owns LS admission/custody, and
-Omnigent owns its local adapter/transport. Required local Omnigent qualification
-for the selected lane stack and separate factory-broker admission gates remain
-feature 001's delivery conditions. Repository adoption neither implements
-those wrappers nor moves their ownership into this repository. Test feature
-selection, OpenSpec/Speckit prerequisites and estate park/resume in disposable
-fixtures. Apply supported WIP record updates only through their established
-contracts; relay refusals. Rebind each lane at its reviewed safe breakpoint,
-using the existing binding tools and exact session records.
-
-**Gate E:** every continued feature has a reviewed migration receipt and
-preserved source; bindings and workflow resolve the intended new trees.
-Each continued feature retains its governing baseline and reconciliation
-obligations; migration does not declare unfinished features implemented.
-Obsolete PR disposition and any old-worktree retirement are separate explicit
-decisions after verification, never an automatic cleanup step.
-Archive the migration's full spec change only after implementation and assembly
-pin landing. Explicitly select that root; a local amendment archive proves no
-reconciliation. Pin subsequent archive-record spec commits normally. Reopen
-reconciliation if behavior changes afterward; cancellation records abandonment
-and dispositions rather than an as-built result.
-
-## Rollback
-
-Before root merge, leave the reviewed candidate unmerged and keep original
-development/install active. Newly created legs/branches remain for diagnosis;
-do not delete them automatically. After root merge, restore the last working
-assembly/code selection through reviewed revert/pin-bump PRs and the preserved
-installer, without force push/resetting user work. Preserve any post-cutover
-feature edits and uncertain jobs before changing bindings. Return lanes only
-through supported tooling at a safe breakpoint; private workspace pointers
-and claims are not rewritten to hide a failure.
-
-## Technical context and checks
-
-Implementation remains Bash (macOS 3.2), Python standard-library tooling and
-Git/GitHub workflows. Run build/test/CLI work in the project bench, with shared
-`tests/run.sh` locking. No real repository is created for a test. The local
-constitution is an unfilled template; no ratification is inferred. Preserve
-the existing root rules, standard pin checks and global workflow protocols.
-
-Planning checks: [verification.md](verification.md). Executable work and
-requirement coverage: [tasks.md](tasks.md). All execution tasks remain open.
diff --git a/specs/004-migrate-to-triad/preparation.md b/specs/004-migrate-to-triad/preparation.md
deleted file mode 100644
index 89f343a6..00000000
--- a/specs/004-migrate-to-triad/preparation.md
+++ /dev/null
@@ -1,119 +0,0 @@
-# Migration preparation evidence
-
-**Initial observation:** October 4, 2026. The preservation and failed rehearsal
-below are historical receipts. **October 6 update:** #97 and #121 have landed;
-a candidate upstream fix and successful disposable current-main rehearsal are
-recorded in [adopter-rehearsal.md](adopter-rehearsal.md). Gates A/B remain open.
-Real conversion waits for the remaining baseline landings, a tested upstream
-pin and refreshed execution approval. This evidence belongs to
-[T001–T011](tasks.md); it is not another executable task list.
-
-## Preservation evidence
-
-Private backup ID: `prep-20261004T211123Z`. Exact locations, file lists,
-configuration, indexes, binary patches and restore copies remain host-local,
-outside the repository. No backup contents are published here.
-
-- Source bundle: all 18 refs verified against a restored mirror and the live
-  ref listing before/after capture. SHA256:
-  `86213b096b6057a1d0fd64b2a950856a6aa8375f87641f49330d205635909c0e`.
-- Dependency bundle: verified and restored the pinned standard commit.
-  SHA256: `2549703215e77353129ebc4d73a5dc7f1f4fd07079b5d86cf259e91a662a20e4`.
-- Six worktrees: copied tracked/untracked files and selected ignored workflow
-  configuration, saved indexes and binary patches, verified restore-copy bytes
-  and symlinks, and checked source HEAD/status/content stability during capture.
-  Restored all six captured heads into independent Git clones, reconstructed
-  the captured index entries, copied captured working/configuration bytes, and
-  verified matching porcelain status, including #121's working edits. Preserved
-  repository-local config/excludes separately; restoring the excludes was
-  necessary to reproduce ignored workflow configuration. This is a restore
-  rehearsal of the snapshots, not an owner-coordinated freeze or live rollback.
-  Private Git restore summary SHA256:
-  `550d1ce96c8a162c3371f95b53be188217f85fac6491e98e628ae307ea35b31e`.
-- Installed files/settings/receipts: captured current configured/default and
-  PATH locations in host and py-bench contexts. Host: 29 locations checked,
-  27 present regular-file copies verified. Bench: 41 checked, 39 present copies
-  verified. These are locations, not the installer artifact count. Additional
-  profiles/workstations and actual installer rollback still need receipts.
-
-| Captured worktree identity | HEAD | Restored files verified |
-| --- | --- | ---: |
-| main | `daed20957f2dd2f22cca24053bb5bc8636ff6b3f` | 130 |
-| 001-separate-swap-ctx-handoff | `3c26041a4444a10bc240cb64a168ece4d9edf6c5` | 309 |
-| 004-migrate-to-triad | `48934f8d4c662be6ed07ad1b7df96dec22028ab2` | 73 |
-| feat/supervised-context-restart | `a9506724c1526a734b2c1b82990ffbb908c4daa4` | 81 |
-| feat/claude-current | `11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12` | 63 |
-| feat/crash-consistent-lane-worktree-recovery | `07fb3adb8b4ac1476c641685096f00f0d20593c6` | 74 |
-
-All six were stable during their own capture. They are active observations;
-heads differ from earlier local/remote snapshots and can change again.
-Owner dispositions, retired-object preservation receipts and a final capture
-at safe breakpoints remain required. This backup is local to this workstation.
-
-Read-only GitHub lookups returned HTTP 404 for both proposed leg repository
-names. That means they were not visible to the current credentials, not a
-guarantee of name availability or creation permission. Recheck at Gate C;
-public visibility remains a proposal requiring the final decision.
-
-## Measured local rehearsal
-
-Used main `daed20957f2dd2f22cca24053bb5bc8636ff6b3f` and unchanged standard
-`39d5c986fcfac1a160474bfe91c5f1c37fccc72c`. A fresh single-branch source clone
-had no linked worktrees. `git-filter-repo` 2.47.0 was installed into a private
-venv for this rehearsal; existing bench/system installations were unchanged.
-The package wheel SHA256 is
-`2cd04929b9024e83e65db571cbe36aec65ead0cb5f9ec5abe42158654af5ad83`.
-
-The standard's `check` passed. `execute --local-remote-dir ... --yes` used only
-disposable local remotes. Network protocols were disabled except local file
-transport; gh/curl shims refused network calls. The source clone and real main
-remained at the recorded commit. No real repository, PR or lane was changed.
-
-Execution returned **2** before an assembly split commit or final verification:
-
-```text
-git -c protocol.file.allow=always submodule add -q <local-spec-worktree> spec
-fatal: please make sure that the .gitmodules file is in the working tree
-```
-
-Both extracted legs exist for diagnosis. Independent comparison of path,
-mode and object ID accounts for all 64 original entries: 18 spec, 40 code and
-six unchanged root entries in the candidate index; zero missing or duplicated
-entries. This is partial extraction evidence, not the standard's completed
-adoption report or a composed candidate.
-
-| Temporary extracted leg | Commit | Kept commits |
-| --- | --- | ---: |
-| spec | `993d1e1d01c9ba28ecee003e518bc444cef7028b` | 25 |
-| code | `ba5f25696ba24012731b356ddb91f10c5386a220` | 77 |
-
-Code retains the original `.gitmodules`, dependency contract and gitlink at
-the pinned SHA. Initializing that nested dependency through a local URL rewrite
-passed. The pinned standard's own tree-digest helper recomputed
-`a44c0165beb9d3b6ddfce46925bf04b8d19934d5327b5a304b5f3f11af699b02`,
-matching the unchanged dependency contract. Full recursive assembly bootstrap
-is blocked. The canonical
-`tests/run.sh -k upstream_pin` remained in its serialization wait; the owned
-waiting wrapper was stopped after 45 seconds. No pytest assertion ran and no
-test pass is claimed. The preceding unfiltered waiting attempt also never ran
-tests. Do not bypass the wrapper to obtain a pass.
-
-See the [upstream reproduction](adopter-blocker.md) and
-[installer design and compatibility matrix](installer-design.md).
-
-## Resume after the PR landings
-
-PRs #97/#121 are now merged; #168/#169/#174 and draft #172 remained open on
-October 6. Their landing notifications trigger a fresh read of actual main
-and owner state. Landed changes are accounted for through the new baseline;
-remaining branch deltas and local edits still need dispositions. Existing
-PR holds and review history are preserved until their owners settle them.
-
-Regenerate the mapping using the standard rather than editing its source SHA.
-Resolve the adopter defect through upstream review, a commit on upstream main
-and the recomputed pin/gitlink update. Repeat into fresh local remotes, then
-prepare and test follow-up patches against the successfully verified split.
-Repeat preservation at coordinated breakpoints. Gates A/B and explicit Gate C
-approval still precede real repositories, root landing and live lane rebinding.
-
-No execution task is checked complete by this provisional evidence.
diff --git a/specs/004-migrate-to-triad/preservation-2026-10-07.md b/specs/004-migrate-to-triad/preservation-2026-10-07.md
deleted file mode 100644
index 9e12ea49..00000000
--- a/specs/004-migrate-to-triad/preservation-2026-10-07.md
+++ /dev/null
@@ -1,111 +0,0 @@
-# Gate A refresh: inventory and preservation, October 7
-
-**Observation:** 2026-10-07. Inventory stamp 10:09:03Z; capture 10:05:59Z–10:06:08Z.
-This is evidence for [T001–T002](tasks.md) on tracking issue opensoft/openRepoTools#186;
-it does not complete them, and Gate A stays open. The
-[October 4 receipt](preparation.md) remains historical evidence; the refreshed
-[inventory](inventory.json) keeps the October 3 cleanup and the October 4 snapshot as history.
-
-## Breakpoint
-
-The coordinator's register facts at 09:5xZ: zero open PRs; lanes openRepoTools-1/2/3 idle with
-no writers except this migration's; main `c4864ac5e59db49d01f638a80ed38daf1d788182` installed on
-Eagle. This capture is a snapshot of that breakpoint while the migration's own writers were
-starting, not an owner-coordinated freeze. Between 09:57Z and 10:03Z the migration's writers
-added five worktrees (lane 1's pin, evidence and rehearsal trees; one tree each under lanes 2
-and 3), and PR #187 (`004-migrate-to-triad` at `ff6f6a7`) opened at 10:03:43Z. Every worktree's
-HEAD and `status --porcelain --ignored`, the worktree list and the ref listing were identical
-before and after the capture, and refs were unchanged across bundle creation. After the
-capture, the pin commit reached origin and PR #188 opened at 10:10:43Z.
-
-## Inventory (T001)
-
-Source main `c4864ac5e59db49d01f638a80ed38daf1d788182` equals GitHub main (PR #175's squash).
-Seventeen worktrees as of the stamp: main plus 16 linked; the brief's expectation of 12 predates
-the five migration trees. 19 local branches, 33 refs under `refs/`; origin has 10 heads and no
-tags. No worktree is locked, prunable or detached. Eighteen PRs merged from October 3 to the
-stamp; one PR (#187) was open at the stamp. The submodule gitlink is
-`39d5c986fcfac1a160474bfe91c5f1c37fccc72c`, initialized in the main checkout.
-
-Classes: 8 retained work (the source baseline, feature 001, the 004 plan and five migration
-writer trees), 6 landed and preserved (trees and refs at the heads of merged PRs #121, #134,
-#169, #174, #175 and #179), 3 empty shells (at main's #168 squash, no commits of their own).
-Remote-only refs: `chore/preserve-local-planning-20261003`, `takeover/ort-a9-dirty-snapshot-20260913`
-and `fix/install-by-rename-167` (PR #172's head). Local-only refs: `refs/lanes/a9-move` and two
-stale `refs/remotes/pr/*`, all of merged history. Dispositions are proposals; owner decisions
-are pending in the private receipt.
-
-`status openRepoTools` (read-only, no fetch) still refuses: "no estate named 'openRepoTools'
-under your projects directory", exit 2. `resume` was not run.
-
-## Preservation evidence (T002)
-
-Private backup ID: `prep-20261007T100559Z`, host-local on Eagle under the private prep
-directory (`.openrepotools-private-prep/prep-<UTC stamp>/`) beside `prep-20261004T211123Z`.
-File lists, ref listings, manifests and logs are in the private WIP repository's receipt.
-No backup contents are published here.
-
-- Source bundle (`git bundle create --all`): all 33 refs, `HEAD` and 16 per-worktree
-  `HEAD`s; every ref present with the same SHA. SHA256:
-  `60db3acd0753b3efde1ee6ae48d2c463e10fee57dbadcf8af543f12332c39c03`.
-- Dependency bundle: the pinned standard `39d5c986fcfac1a160474bfe91c5f1c37fccc72c` and the
-  migration's target `7f84ca42ca86a8902928345109d2bf6bad87bd91` (current openRepoShape main),
-  from a fresh scratch clone. SHA256:
-  `aa5a6eca83897516331466c2904ec786be3cf423cac3d6647aad5760bfb8d7cb`. The standard's own
-  `tree_digest` gives `a44c0165beb9d3b6ddfce46925bf04b8d19934d5327b5a304b5f3f11af699b02`
-  for the pin (matching the contract) and
-  `3be52767e727d924dd05f9e78b18eb70f1682fe48614fab519f85331eeff5fa8` for the target.
-- Manifest: 414 files, `sha256sum -c` passes; manifest SHA256
-  `2a46dff9c00b0eba300bd0ad49a5cf42578f741b1e4a3cca2568d9c2784e88ed`.
-- Worktrees: for all 17, HEAD, porcelain status with ignored entries, index entries, and full
-  untracked and ignored lists. 141 ignored workflow-configuration entries were copied (main 71,
-  feature 001 70); caches were listed but not copied; no path had a secret-like name.
-  Repository-local config and excludes were preserved separately.
-- Installed files: 29 receipt rows (install stamp 2026-10-07T04:26:26Z); 29 present, 0 missing,
-  29 copies verified, 29 SHA256s match the install receipt.
-
-| Worktree | Owner | Branch | HEAD | Dirty | Untracked | Ignored | Class |
-| --- | --- | --- | --- | ---: | ---: | ---: | --- |
-| main | shared main checkout | `main` | `c4864ac5e59db49d01f638a80ed38daf1d788182` | 0 | 0 | 5 | retained-work |
-| ort-179-tests | lane openRepoTools-1 | `feat/lane-worktrees-residue-tests` | `6c79121ea0288ac495ea5d0cd856083059c631bb` | 0 | 0 | 0 | landed-and-preserved |
-| ort-install-followups | lane openRepoTools-1 | `fix/install-marker-on-every-file-and-one-install-lock` | `2080f3d83520bd1ea5632e754026f8ba3df4eb1f` | 0 | 0 | 0 | empty-shell |
-| ort-shape-pin | lane openRepoTools-1 | `chore/openreposhape-pin-7f84ca4` | `e43b2432976a22eb3bf8c419c96209399251d375` | 0 | 0 | 0 | retained-work |
-| ort-triad-exec | lane openRepoTools-1 | `004-migrate-to-triad-exec` | `ff6f6a7c7b7921ca1e0b0234e898900f98532366` | 0 | 0 | 0 | retained-work |
-| ort-triad-rehearsal | lane openRepoTools-1 | `004-migrate-to-triad-rehearsal` | `ff6f6a7c7b7921ca1e0b0234e898900f98532366` | 0 | 0 | 0 | retained-work |
-| ort-wip-init-followups | lane openRepoTools-1 | `fix/wip-init-step7-guarded-writes-and-step8-refusal-words` | `2080f3d83520bd1ea5632e754026f8ba3df4eb1f` | 0 | 0 | 0 | empty-shell |
-| triad-reads | lane openRepoTools-2 | `004-migrate-to-triad-reads` | `ff6f6a7c7b7921ca1e0b0234e898900f98532366` | 0 | 0 | 0 | retained-work |
-| triad-lane-tooling | lane openRepoTools-3 | `feat/triad-lane-tooling` | `c4864ac5e59db49d01f638a80ed38daf1d788182` | 0 | 0 | 0 | retained-work |
-| 001-separate-swap-ctx-handoff | Brett Heap | `001-separate-swap-ctx-handoff` | `3c26041a4444a10bc240cb64a168ece4d9edf6c5` | 0 | 0 | 4 | retained-work |
-| 004-migrate-to-triad | Brett Heap | `004-migrate-to-triad` | `ff6f6a7c7b7921ca1e0b0234e898900f98532366` | 0 | 0 | 0 | retained-work |
-| 005-supervised-legacy-ctx | Brett Heap | `feat/supervised-context-restart` | `f13d32975d7457d662249385d23ee28a7f713c4c` | 0 | 0 | 3 | landed-and-preserved |
-| feat-claude-current | Brett Heap | `feat/claude-current` | `11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12` | 0 | 0 | 2 | landed-and-preserved |
-| a22-primary | lane openRepoTools-3 | `feat/amendment-22-sql-primary` | `2080f3d83520bd1ea5632e754026f8ba3df4eb1f` | 0 | 0 | 0 | empty-shell |
-| closeout-2 | lane openRepoTools-3 | `feat/lane-end-closeout-rest` | `ed3655184d90e1ac21848aa4c3e294327b9561b6` | 0 | 0 | 0 | landed-and-preserved |
-| suite-speed | lane openRepoTools-3 | `feat/shell-suite-wall-time` | `d2f80512902bf85b5993134a3cef6913d131565a` | 0 | 0 | 0 | landed-and-preserved |
-| sweep-170 | lane openRepoTools-1 | `feat/lane-worktrees-residue` | `4ea84c8c8206347cef3cc5a626e79aee9e12b8c3` | 0 | 0 | 1 | landed-and-preserved |
-
-## Restore rehearsal
-
-97 checks passed, 0 failed, repeated from the backup's final location:
-
-- A working clone and an independent mirror restored from the source bundle each list the same
-  33 refs with the same SHA as the live listing at bundle time; `git fsck --full` is clean.
-- The 2902 object IDs reachable from the 50 bundled tips are identical live and restored
-  (sorted-list SHA256 `338cb7bdd397076eeced1de0852eeb1510b4f97e02fb3f62de434531c7be327d`).
-- For each of the 17 worktrees, the HEAD commit resolves, its tree ID is unchanged, every
-  index object exists, a worktree checked out from the restore has a byte-identical index, and
-  after copying the captured configuration back, its tracked status and untracked and ignored
-  lists match the capture (less the caches that were not copied).
-- Both dependency commits resolve from the dependency bundle, and their tree digests,
-  recomputed with each commit's own helper, match the values above.
-
-The previous private backup `prep-20261004T211123Z` is still present (25 top-level entries,
-including its `git-filter-repo` 2.47.0 wheel and venv, whose `--version` prints `a40bce548d2c`).
-It was recorded read-only.
-
-## What remains for Gate A
-
-Owner dispositions for every retained object, and a final capture at an owner-coordinated freeze
-after the migration's own writers stop. Installed-file receipts are still needed for py-bench and
-any other profile or workstation. This backup is local to this workstation. No execution task is
-checked complete by this evidence.
diff --git a/specs/004-migrate-to-triad/protocol-review.md b/specs/004-migrate-to-triad/protocol-review.md
deleted file mode 100644
index fe4464df..00000000
--- a/specs/004-migrate-to-triad/protocol-review.md
+++ /dev/null
@@ -1,48 +0,0 @@
-# Migration protocol review — October 4, 2026
-
-This refresh applies the adopted manual **Triad Feature Amendments** section
-of the installed shared OpenSpec/Speckit workflow, including its
-single-repository-to-triad migration instructions. Approval/extraction/history,
-per-path verification and exact-pin mechanics remain governed by openRepoShape.
-The consumer standard remains pinned at `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`.
-
-## Sources read
-
-| Source identity | Snapshot SHA-256 |
-| --- | --- |
-| `$AGENT_PROTOCOL_ROOT/protocols/openspec-speckit-workflow.md` | `867b09a1329a2ba1c8005f2fbe43a4857f4eba7dd69c474c4e03d54bb2ecc20c` |
-| `$AGENT_PROTOCOL_ROOT/protocols/project-agent-bootstrap.md` | `39341a7d0958e5efb9af5aa69de6e692d03129047cbcad48ad7f32bb8076ee28` |
-| workBenches `docs/triad-feature-amendments.md` | `549d35974d42f474f2c7b2004e900b943c9a4543c479b97c541f47de1035f8d7` |
-| workBenches `docs/triad-feature-amendment-templates.md` | `43647f4419dac8e28a3f428469ae27acd1444846736e9d388d967bb93c500a5f` |
-
-The workBenches documents and governing
-`openspec/changes/adopt-triad-feature-amendments/` were read from its working
-branch, where they were uncommitted at inspection. These content digests identify
-the reviewed drafts; they are not landed commit identities or distribution
-evidence. The installed protocol records Brett Heap's October 4 adoption of
-manual use. Schema, managed root routing, template distribution and upstream
-placement automation remain pending in their owning repositories.
-
-## Application to this migration
-
-- Keep full proposals, archives, canonical specs/contracts and Speckit files
-  in spec, including proposals authored on existing feature branches. Do not
-  manufacture amendments for historical features.
-- Put genuine bounded amendment records in the code feature folder
-  `features/<NNN-feature>/openspec/`. Review them explicitly in the mapping
-  until the upstream exception is qualified. No tracked amendment folders were
-  observed in current main or retained feature heads.
-- Preserve approved original repository/commit/path provenance and verify
-  correspondence to extracted spec identities. Repair links/root selection;
-  filtered hashes cannot be guessed or substituted for approval evidence.
-- Update working Speckit instructions immediately for accepted bounded changes;
-  record authority, requirements/tasks, evidence and dispositions manually.
-  New runtime/capability/authority/external obligations use full governance.
-- At the first amendment, create one spec reconciliation issue. Reconcile all
-  net tested effects once at completion, linking landed code and evidence.
-  Completed assembly advancement waits for matching reconciled spec/code pins.
-  Archive only after implementation and assembly landing; explicitly select
-  the full spec root and preserve inactive/archived history.
-
-Implementation remains in [tasks.md](tasks.md); no external issue, schema,
-protocol distribution, installation or migration was executed by this refresh.
diff --git a/specs/004-migrate-to-triad/quickstart.md b/specs/004-migrate-to-triad/quickstart.md
deleted file mode 100644
index c0b10f9f..00000000
--- a/specs/004-migrate-to-triad/quickstart.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# Review this migration plan
-
-Read [plan.md](plan.md), then the [resolved adoption mapping](../../openspec/changes/migrate-to-triad/adoption-plan.yaml)
-and [work inventory](inventory.json). Read the [protocol review](protocol-review.md)
-for canonical spec placement, bounded code amendments and final reconciliation.
-The mapping is for the recorded source
-main only. A disposable rehearsal extracted both legs and then refused assembly
-mounting; [preparation.md](preparation.md) records the measured limits. Live
-feature transfer and real conversion remain pending #97/#121 landings and the
-execution gates.
-
-From the original source checkout, the planning validation is:
-
-```sh
-python3 upstream/openRepoShape/adopt-project.py check \
-  --source . \
-  --plan ../openRepoTools-worktrees/004-migrate-to-triad/openspec/changes/migrate-to-triad/adoption-plan.yaml
-```
-
-From the migration worktree, validate governance artifacts:
-
-```sh
-openspec validate migrate-to-triad --strict
-git diff --check
-```
-
-Route project CLIs through the declared bench. If source main changes,
-regenerate the plan using `adopt-project.py plan`, retain reviewed resolutions
-and follow-ups, then recheck. Do not change the baseline field to suppress a
-stale-plan finding. Do not run real `execute` as a planning check.
-
-After adoption, full proposal commands select the intended spec feature checkout;
-bounded amendments use their explicitly verified code-local root. Newer CLI
-store selection is optional and must resolve the intended feature branch.
-Use manual records until schema/routing/distribution is qualified. Update working
-Speckit instructions immediately for accepted amendments; reconcile the net
-tested effect once before completed assembly advancement. A local archive
-cannot substitute for full spec reconciliation or assembly landing.
-
-Before execution, complete Gates A/B and review the actual frozen baseline,
-visibility, mapping, follow-ups and preservation receipts. The standard requires
-explicit approval before repository creation. All execution tasks are open in
-[tasks.md](tasks.md); the migration does not require recreating feature 001's
-specifications or claiming its unfinished runtime work is complete.
diff --git a/specs/004-migrate-to-triad/research.md b/specs/004-migrate-to-triad/research.md
deleted file mode 100644
index ee1f0958..00000000
--- a/specs/004-migrate-to-triad/research.md
+++ /dev/null
@@ -1,39 +0,0 @@
-# Planning evidence and decisions
-
-Latest measured preparation is in [preparation.md](preparation.md). Private
-git-filter-repo availability now exists for local rehearsal. Existing-submodule
-mounting is a measured refusal, documented in [adopter-blocker.md](adopter-blocker.md),
-and installer source-routing design is in [installer-design.md](installer-design.md).
-The earlier observations below predate that attempt. Both #97/#121 landings
-precede real conversion and a new baseline/rehearsal.
-
-October 3 inspection and October 4 refresh used the pinned standard's `AGENTS.md`, adoption
-implementation, generated CLI reference and placement policy; root installer,
-CI and fixture code; local branch/worktree state; read-only GitHub PR metadata.
-No external writes, repositories, installation or migration occurred.
-
-| Finding | Decision / execution consequence |
-| --- | --- |
-| Main advanced to `daed209` with merged #134: 80 commits, 64 tracked paths and one standard gitlink; GitHub matches | Regenerate/check the mapping: 18 spec / 40 code / six root, no drops; #61/#146/#134 are included without replay. |
-| Classifier treats shipped Markdown skills/commands as specification | Override to code with written reasons; these are installation payloads. |
-| Original contract is the implementation's upstream dependency lock | Keep code pin/gitlink/.gitmodules together; generated assembly pins are separate. |
-| `.specify` and agent directories are ignored local scaffolding | Preserve local config separately and regenerate root workflow after adoption. |
-| Six current worktrees/local branches; open PRs #121/#97; concurrent #121 staged/unstaged/untracked work and advanced #97 head | Preserve current active contents, not the earlier clean observation. Retain merged #134 checkout without replay; retired checkouts stay out of replay. |
-| PR #121 now owns feature 005 confirmed-legacy-only restart and a full authority decision; managed/unknown ownership refuses and merge hold remains | Preserve the entire index/working/untracked delta and continue paired `005`; full authority/runtime governance remains spec, independent of #97 and feature 001 managed authority. |
-| Feature 001 advanced to clean `3c26041`, committing broker/task-recovery work and restoring rollover/workspace packets | Preserve its complete branch delta and restored governance/ideation; remove the stale requirement to capture the previous dirty files as uncommitted work. |
-| Feature 001 now selects required local Omnigent for `lclaude → oclaude → profile launch`, with implementation/qualification pending | Carry launcher contract, FR-047/T063–T065, LS custody/input fences and separate factory-broker gates; keep wrapper ownership in workBenches and transport ownership in Omnigent. |
-| #134 merged as `daed209`; clean sibling worktree remains at `11037f0` | Installer/resolver/preflight/timeout/test changes and manual are included in the regenerated main baseline; retain checkout as recovery history. |
-| Installed protocol now adopts manual Triad Feature Amendments; workBenches source docs are uncommitted drafts | Record source digests in protocol review; preserve full proposals/canonical files in spec and genuine bounded records in code. Do not claim distribution or automated qualification. |
-| Pinned upstream classifier has no qualified amendment exception; no amendment paths observed in current source/retained heads | Explicitly review future genuine paths as code with reasoned local resolutions or a later reviewed upstream rule; do not edit pinned consumers or manufacture historical amendments. |
-| Filtered commits may change approved spec identity | Preserve original repository/commit/path and verify extracted correspondence; repair links and selected roots without guessed hashes. |
-| Bounded amendments require immediate working files and one final docs reconciliation | Extend the existing 19 tasks; create one spec issue at first amendment, reconcile tested net effect, and block completed assembly advancement until matching reconciled spec/code land. |
-| Two remaining preservation refs have no local worktrees | Review their history as recovery evidence; do not treat them as active writers or require recreation. |
-| Estate status refuses this manifest-free single repository | Relay no-estate refusal; use local Git and read-only GitHub observations now, then estate status after adoption. |
-| Installer fetches bare paths from `openRepoTools` and local sibling payloads | Preserve public root entry point and bind every payload to one code pin. |
-| Tests conflate repo, spec and dependency paths | Introduce explicit checkout context and composed CI, preserving nested-pin tests. |
-| `git-filter-repo` absent in inspected bench | Execution prerequisite; no software installation was performed for planning. |
-| Standard plan `check` covers names/paths, not execution correctness | Local bare-remote rehearsal must cover existing submodule and blob accounting. |
-
-Existing-submodule behavior, exact installation resolver implementation and
-live feature replay are pending measured execution tasks, not assumed successes.
-The final creation approval also confirms proposed public visibility.
diff --git a/specs/004-migrate-to-triad/root-guidance-2026-10-08.md b/specs/004-migrate-to-triad/root-guidance-2026-10-08.md
deleted file mode 100644
index 2feac121..00000000
--- a/specs/004-migrate-to-triad/root-guidance-2026-10-08.md
+++ /dev/null
@@ -1,478 +0,0 @@
-# T006: root and leg guidance, collisions, and workflow bootstrap (run C rebuild)
-
-**Task**: T006 of [tasks.md](tasks.md), for opensoft/openRepoTools#186.
-**Writer**: lane openRepoTools-1, on 2026-10-08 and 2026-10-09.
-**Evidence branch**: `004-migrate-to-triad-root-guidance`.
-**State**: rehearsal evidence only. No patch here is applied to today's layout, which is untouched. (Corrected 2026-10-09: this line first said "Nothing here lands on `main`", but #192 brought this document and the patch files to main as evidence.)
-
-The 2026-10-07 build of this task ran against run B. It was lost when the bench
-restart cleared `/tmp`: clones, patches and logs alike. Nothing from it was ever
-committed. This document is its rebuild on **run C**, the rehearsal regenerated
-on 2026-10-08. Everything below was measured again on run C, and none of it is
-carried over from run B.
-
-## Inputs and outputs
-
-| what | identity |
-|---|---|
-| source (`main` when run C cloned it) | `837928a` (includes #187's planning files and #188's openRepoShape repin) |
-| rehearsed assembly split (`adopt/three-repo-shape`) | `69b8924` |
-| spec leg / code leg (run C bare remotes) | `593250d` (35 commits) / `73b04d6` (88 commits) |
-| code's nested `upstream/openRepoShape`, and the tool | `7f84ca4` (opensoft/openRepoShape `main`) |
-| **code leg patch** (my bare copy, branch `t006/leg-guidance`) | `6169e8e` |
-| **spec leg patch** (my bare copy, branch `t006/leg-guidance`) | `39c1887` |
-| **assembly patch** (my bare copy, branch `t006/root-guidance-c2`) | `3361812`, then `bump-leg.py`'s `1024f18` (spec) and `3e87e39` (code) |
-
-All work happened in host-local private scratch: my own bare copies of the
-three run C remotes and of the openRepoShape mirror. Nothing was written into
-the rehearsal directory, and nothing reached a real remote except this
-evidence branch.
-
-**No receipt (added 2026-10-09, #193 item 11).** T006's evidence cites no
-private receipt. None is named here, in the five patches, in #192's
-description or in T006's comment on #186 (6071824778). brett-wip's
-`migration/openRepoTools/`, which holds the migration's receipts, has none
-for T006 either (read 2026-10-09). Run C has one,
-`adopter-fix-20261008-1HztL0`.
-
-What the committed patches let anyone reproduce from public inputs alone
-(main `837928a` and openRepoShape `7f84ca4`), checked on 2026-10-09:
-- the patch SHA256s below;
-- the leg trees: `code-0001` and `spec-0001`, applied with `git am` to the
-  paths the plan gives each leg at `837928a` (trees `3915e78` and
-  `ad6cdcb`), give exactly `ca65c3b9…` and `10256135…`;
-- `assembly-0001`, applied with `git am` to `837928a`'s six root files,
-  gives section 2's 340-line `AGENTS.md` and 510-line `README.md`.
-
-*Superseded 2026-10-19 (`assembly-0001`):* the file at `patches/t006/assembly-0001-…` is re-cut, sha256
-`2ec48bbf…eaead7`. #227, #237 and #228 rewrote lines of `AGENTS.md` and `README.md` that seven of its hunks
-stand on, so the file this record measured no longer applies to the root files #228's series leaves. The
-re-cut does, and gives a 354-line `AGENTS.md` and a 529-line `README.md`. Every digest, apply result and
-line count this record gives for `assembly-0001` is the earlier file's.
-
-The exact commit IDs, the assembly tree `6eb8145e…`, bootstrap and
-`make validate` need run C's host-local arrangement. These rows exist only
-in this document:
-- section 4's doctor and `shape_advisory` rows;
-- section 7's `setup-openspeckit`, paired-selection, `check-prerequisites`,
-  worktree-override and store-precedence rows, and its `openspec` 1.6.0
-  exits;
-- section 6's 85-token census of cited hashes, whose tokens were resolved
-  against the original checkout's branches as well as `main`;
-- section 9's protocol hashes.
-
-T006's #186 comment repeats some of those exit codes from the same work,
-which is not separate evidence.
-
-The patches are in [patches/t006/](patches/t006/), as `git format-patch`
-output:
-
-| patch | sha256 |
-|---|---|
-| `assembly-0001-…front-door…` | `cd69c2a9afb7bb11…` |
-| `assembly-0002-Bump-spec-leg-to-39c18877e042…` | `574c0df16dddda7d…` |
-| `assembly-0003-Bump-code-leg-to-6169e8e96164…` | `a7f8521bb7dbb9b5…` |
-| `code-0001-…own-front-door…` | `74b98ff97b0b9b6b…` |
-| `spec-0001-…own-front-door…` | `c11070f05a9e4611…` |
-
-*Superseded 2026-10-19:* the `assembly-0001` digest above is the earlier file's. The re-cut is
-`2ec48bbf…eaead7`. The other four digests are unchanged.
-
-Each was applied with `git am` onto its base in a fresh clone, and each
-reproduced the pushed tree exactly:
-
-| patch set | `git am` | tree check | `git diff --check` on the range |
-|---|---|---|---|
-| assembly | exit 0 | `6eb8145e…` = `6eb8145e…` | exit 0 |
-| code | exit 0 | `ca65c3b9…` = `ca65c3b9…` | exit 0 |
-| spec | exit 0 | `10256135…` = `10256135…` | exit 0 |
-
-*Superseded 2026-10-19:* the `assembly` row is the earlier `assembly-0001`'s result. The re-cut applies to #228's
-root files instead, and gives a 354-line `AGENTS.md` and a 529-line `README.md` (the note above the first table).
-The code and spec rows are unchanged.
-
-`assembly-0002` and `-0003` are commits written by openRepoShape's
-`bump-leg.py`, and they pin the rehearsal's leg hashes. At T014 they are
-**regenerated against the real legs with the same tool, not applied**.
-`assembly-0001`, `code-0001` and `spec-0001` are the portable patches.
-
-The evidence branch's first commit, `f06e1af`, recorded an earlier `assembly-0001`.
-Its root additions were 46 and 39 lines. The hygiene caps in section 7 made
-those too long, so this commit replaces the three assembly patches with the
-c2 versions. The legs' patches are unchanged.
-
-## 1. Collision inventory at the assembly root
-
-The root tree after run C's split, path by path. The front-door blobs are the
-monorepo's own: `AGENTS.md` 443880a, `README.md` 18c8f7e, `.gitattributes`
-3560973 and `.gitignore` a160f49, all equal to `main`'s.
-
-| path | class | resolution in this patch set |
-|---|---|---|
-| `AGENTS.md` | **collision** (shape wrote `shape/AGENTS.md`) | Line 1 is the shape's exact pointer, then a short map, then the original text with 16 path repairs. This is the shape's own follow-up: "add the line … to the existing AGENTS.md rather than replacing it". |
-| `CLAUDE.md` | **collision** (shape wrote `shape/CLAUDE.md`) | Unchanged. `Read AGENTS.md.` is byte-identical to the shape's own rendered `shape/CLAUDE.md` (`cmp` equal), so the pointer reaches it through `AGENTS.md` line 1. The shape's generic follow-up text ("add the line to the existing CLAUDE.md") is satisfied the way the shape's own scaffold satisfies it. |
-| `README.md` | **collision** (shape wrote `shape/README.md`) | Merged. A "Three repositories" section and "The lockstep invariant" are added. `contracts/{spec,code}-pin.yaml` name `resync_runbook: "README.md#the-lockstep-invariant"`, an anchor that only `shape/README.md` had. Plus 12 path repairs and a re-rooted pin-bump block. |
-| `.gitignore` | **collision** (shape wrote `shape/.gitignore`, pinned) | The project's file absorbs the shape's two extra lines, `.venv/` and `.DS_Store`, plus `/worktrees/`, the line the three-leg bootstrap requires. Nothing was lost: the root kept `__pycache__/`, `*.py[cod]` and `.pytest_cache/`. |
-| `.gitattributes` | **collision** (shape wrote `shape/.gitattributes`, pinned) | Same rule, `* text=auto eol=lf`, with the comment rewritten for this root's pinned copies. The monorepo's reason (the installer's byte-for-byte comparisons) moved, word for word, to `code/.gitattributes`. |
-| `LICENSE` | front door | Unchanged. A byte-identical copy is added to each leg, which had none. |
-| `shape/.gitignore`, `shape/.gitattributes` | shape-generated, **pinned** (rows in `contracts/shape-pin.yaml`) | Left in place. Deleting or editing them is drift. `update-shape.py` knows a collision copy by its `shape/` row. |
-| `shape/AGENTS.md`, `shape/CLAUDE.md`, `shape/README.md` | shape-generated, **not pinned** (no row; verified) | Left in place under this task's rule. The shape's own follow-up says to delete `shape/AGENTS.md` and `shape/CLAUDE.md` once the pointer line is in `AGENTS.md`, which this patch does, and to merge `shape/README.md`, which this patch also does. Removing all three is drift-free. **Decision for T014's reviewer.** `shape/README.md` also carries the rehearsal's local clone path, an artifact of rehearsing with local remotes. |
-| `AGENTS-shape.md`, `Makefile`, `scripts/{bootstrap,repo_shape,validate-manifest,validate-pins,validate-repository-naming}.py`, `contracts/repository-naming.yaml`, `.github/workflows/validate.yml` | shape-generated, **pinned** | Untouched. 11 rows; all 11 digests match before and after. |
-| `project.yaml`, `contracts/{spec,code,shape}-pin.yaml`, `.gitmodules` (the two mounts) | shape-generated, rendered | Untouched. The leg pins move only through `bump-leg.py`. |
-| `spec`, `code` gitlinks | shape-generated | Moved only by `bump-leg.py`, each together with its pin. |
-| `contracts/`, `.github/`, `.gitmodules` as **names** | not collisions | The source's `contracts/openreposhape-pin.yaml`, `.github/workflows/tests.yml` and `.gitmodules` left whole for the code leg. The root's same-named files are the shape's. No source path exists at `shape/`, `scripts/`, `Makefile`, `project.yaml`, `worktrees/` or `.specify/` (checked at `837928a`). |
-| (lost by the split) | **legs' front door** | Neither leg has `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitattributes` or `.gitignore`. A superproject's attributes and ignore rules never reach into a submodule, so the code leg lost the LF rule its installer depends on. Section 4 restores them. |
-
-## 2. Root agent instructions
-
-- **`AGENTS.md`**, 316 → 340 lines.
-  - Line 1 is `Read AGENTS-shape.md first — the rules of this repository's shape.`, the exact `SHAPE_POINTER_LINE` of openRepoShape 7f84ca4.
-  - A seven-entry map follows:
-    - `spec/`, with `openspec` run there;
-    - `code/`, with the pinned standard;
-    - this root;
-    - where the tests run;
-    - the lane tooling's code (`code/`) and its manual (`spec/docs/README-lanes.md`, or `docs/README-lanes.md` in `opensoft/openRepoTools-spec` standalone);
-    - paired feature worktrees, with full proposals in spec and bounded amendments in code;
-    - the local-rehearsal file-transport flag (the real https legs need none).
-  - The original text follows, unchanged except for the 16 repairs in section 3.
-  - The shape's 14-line rendered repository table is **not** repeated: the map names the same repositories, and the repository's length cap (section 7) admits lines only for a rule.
-- **`README.md`**, 486 → 510 lines.
-  - The front door is kept.
-  - "Three repositories" says what the root is, what each leg holds, the recursive clone and `make bootstrap`, that nothing a person types changes, and how paths read.
-  - "The lockstep invariant" is the anchor the leg pins name.
-  - The install section adds: "Both lines are unchanged by the split: the `openRepoTools` they fetch is this root's entry point, which hands over to the installer `code/openRepoTools` at the commit this root pins." The entry point itself is T007's.
-- **`CLAUDE.md`**: unchanged, as briefed.
-
-## 3. Repaired links (32)
-
-Line numbers refer to the original blobs at `69b8924`. Every repair was
-asserted to match exactly once.
-
-| file:line | was | now |
-|---|---|---|
-| AGENTS.md:22 | `docs/README-lanes.md` | `spec/docs/README-lanes.md` |
-| AGENTS.md:44 | `openspec/changes/skip-no-lane-guard/` | `spec/openspec/changes/skip-no-lane-guard/` |
-| AGENTS.md:200 | heading `upstream/openRepoShape` | `code/upstream/openRepoShape` |
-| AGENTS.md:203 | `contracts/openreposhape-pin.yaml` | `code/contracts/openreposhape-pin.yaml` |
-| AGENTS.md:206 | `upstream/openRepoShape` | `code/upstream/openRepoShape` |
-| AGENTS.md:214 | `contracts/openreposhape-pin.yaml` | `code/contracts/openreposhape-pin.yaml` |
-| AGENTS.md:216 | `tests/test_upstream_pin.py` | `code/tests/test_upstream_pin.py` |
-| AGENTS.md:223 | `git submodule update --init upstream/openRepoShape` | `git -C code submodule update --init upstream/openRepoShape` |
-| AGENTS.md:224 | `tests/run.sh` | `code/tests/run.sh` (the wrapper `cd`s to its own root, so it runs from here) |
-| AGENTS.md:233 | `.github/workflows/tests.yml` | `code/.github/workflows/tests.yml` |
-| AGENTS.md:247 | `bash tests/test_lane_helpers.sh` | `bash code/tests/test_lane_helpers.sh` (it derives `SRC_DIR` from its own path) |
-| AGENTS.md:248, 250, 285 | `tests/run.sh` | `code/tests/run.sh` |
-| AGENTS.md:291 | `tests/test_lane_helpers.sh` | `code/tests/test_lane_helpers.sh` |
-| AGENTS.md:292 | `tests/test_lane_helpers_suite.py` | `code/tests/test_lane_helpers_suite.py` |
-| README.md:157 | `docs/README-lanes.md`, `docs/README-claude-current.md` | `spec/docs/…` (2) |
-| README.md:183 | `contracts/openreposhape-pin.yaml` | `code/contracts/openreposhape-pin.yaml` |
-| README.md:263 | `tests/run.sh` | `code/tests/run.sh` |
-| README.md:303 | `commands/swap.md` | `code/commands/swap.md` |
-| README.md:417 | `upstream/openRepoShape`, `contracts/openreposhape-pin.yaml` | `code/…` (2) |
-| README.md:422 | `tests/test_park_resume_commands.py` | `code/tests/test_park_resume_commands.py` |
-| README.md:429 | `tests/test_upstream_pin.py` | `code/tests/test_upstream_pin.py` |
-| README.md:437–442 | the pin-bump block (`upstream/openRepoShape` ×4, `contracts/openreposhape-pin.yaml` ×2) | re-rooted with one added line, `cd code`, because the pin and gitlink are a commit in the code leg |
-| README.md:449 | `tests/test_upstream_pin.py` | `code/tests/test_upstream_pin.py` |
-| README.md:464 | `cd openRepoTools && python3 -m pytest tests -q` | `cd openRepoTools/code && …` |
-| README.md:467 | `git submodule update --init upstream/openRepoShape` | `git -C code submodule update --init upstream/openRepoShape` (the command the suite's skip message names, run in the code leg) |
-| spec `docs/README-claude-current.md`:275–276 | `tests/test_claude_current.py`, `tests/test_claude_restart_check.py`, `tests/test_lane_start_claude_current.py` | `code/tests/…` (3) |
-
-That is 16 repairs in `AGENTS.md`, 13 in `README.md` (12 rewrites and the
-re-rooted block) and 3 in the spec leg. All six markdown links in the spec leg
-that use relative `](…)` targets stay inside the spec leg, so none crossed a leg.
-
-**Deliberately unchanged:**
-- `AGENTS.md`'s `python3 -m pytest tests -q …` lines describe the command line `tests/run.sh` itself runs, inside the code leg, which is what every other lane's `pgrep` counts.
-- `contracts/shape-pin.yaml` (AGENTS.md:118, README.md:46) names every estate's shape pin, not a path into a leg.
-- README.md:242 `repos.tsv` is a file installed into `~/.local/bin`.
-- README.md:41 `upstream/<branch>` is a git remote.
-
-## 4. Leg guidance added
-
-The shape does provide leg guidance. `templates/code-root/` and
-`templates/spec-root/` carry `AGENTS.md`, `CLAUDE.md`, `README.md` and
-`.gitignore`. `scaffold-project.py` writes them, and `adopt-project.py` seeds them
-only into an empty leg, so an extracted leg gets none. The leg files below are those
-templates, rendered by the shape's own `shape_materialize.copy_tree` with this
-project's values; no placeholder is left. Each `AGENTS.md` and `README.md` then
-appends one short openRepoTools section.
-
-| leg | files | openRepoTools section says |
-|---|---|---|
-| code | `AGENTS.md`, `CLAUDE.md` ("Read AGENTS.md."), `README.md`, `.gitattributes` (monorepo blob 3560973, byte for byte), `.gitignore` (the shape's code-root template, a superset of the monorepo's three lines), `LICENSE` (blob 261eeb9) | The root's guidance governs. The suite runs here: `git submodule update --init upstream/openRepoShape`, then `tests/run.sh` behind `${TMPDIR:-/tmp}/openrepotools-pytest.lock`. The pinned standard's three rules, by pointer. The manuals and specifications are `../spec/` when mounted and `opensoft/openRepoTools-spec` standalone. A feature's code goes in its code worktree, a bounded amendment in `features/<NNN>/openspec/`. |
-| spec | `AGENTS.md`, `CLAUDE.md`, `README.md`, `.gitattributes` (the LF rule the monorepo's root file applied to these documents), `LICENSE` | It holds `openspec/`, `specs/`, `docs/` and `ideation/`. Full proposals and canonical Speckit files live here; bounded amendments live in the code leg's feature folder, under the shared workflow's "Triad Feature Amendments". `openspec validate <change> --strict` runs here, never at the root, and a local root takes precedence over a store pointer. A pre-split path names a code-leg file (`code/…` once repaired), and a cited commit is the assembly's. |
-
-`git add --renormalize .` changes nothing in either leg. Every file is LF:
-code 54 + 1 gitlink, spec 70.
-
-The spec leg gets no `.gitignore`. Nothing ignorable was lost there, and the
-doctor's row for it is a `note`, which the shape's own agent rules say is
-"not a finding and you do not 'fix' it".
-
-**Shape agreement, measured:**
-- **Doctor `leg shape files`.** Before: 6 files missing (AGENTS/CLAUDE/.gitignore × 2). After: "spec: AGENTS.md rendered, CLAUDE.md identical, .gitignore absent; code: AGENTS.md rendered, CLAUDE.md identical, .gitignore identical".
-- **`scripts/shape_advisory.py`'s leg-clone reader on standalone clones.** Before: recognised by name only (`openRepoTools-code` … "is the code-leg form"). After: "its AGENTS.md is the code leg's, as templates/code-root/ writes it", with the assembly `opensoft/openRepoTools` named. The spec leg reads the same way.
-- **Doctor `placement` finding.** Identical before and after: the same 21 flagged paths, `misplaced: 3`, `review_required: 18`. It comes from the adoption plan's reasoned overrides for `commands/`, `skills/` and `contracts/`, and none of the 11 added leg files is flagged. Per the shape's rule 4 it is relayed, not answered.
-
-## 5. Cross-leg references this task does not repair, with owners
-
-- **Spec records (approval provenance, FR-014): kept as written.**
-  - Pre-split code paths appear in 17 files under `openspec/` and `specs/`.
-  - In completed features (002, 003 and the four other changes) they record acts done against the monorepo at a commit. Example: specs/002 tasks.md:9, "`bash tests/run.sh -k …` passed 165 checks … on implementation commit `64f4e93`". Rewriting such a line would falsify the record.
-  - **Feature 004's own working files** carry 23 mentions in 9 files: plan.md 4, installer-design.md 4, proposal.md 4, design.md 3, adoption-plan.yaml 3, tasks.md 2, adopter-rehearsal.md 2, and spec.md, quickstart.md, preparation.md and adopter-blocker.md with 1 each. These are T017's to translate with the feature.
-    - *Noted 2026-10-09 (#193 item 9):* that list adds up to 26 mentions in 11 files, not 23 in 9. Section 10 and T006's comment on #186 (6071824778) repeat 23. The counting rule is not recorded, and three plausible recounts here reproduced neither the list nor the total, so which figure is right is not established.
-  - 005's `analysis.md`:13 is likewise T016/T017's.
-- **`docs/README-lanes.md` (lane 3: the manual's content).** 21 lines name code-leg files:
-  - lines 72, 572, 3601, 4163: `tests/test_lane_helpers.sh`;
-  - lines 573, 576, 594, 3777, 3979, 3997: `tests/run.sh`;
-  - line 3601 (again): `tests/test_lanes_index.py`;
-  - lines 74, 637, 1013, 1062, 1236, 2369, 2477, 4162: `repos.tsv` (some of these mean the installed table);
-  - lines 2551–2553: `skills/handoff/SKILL.md`, `skills/lane-swap/SKILL.md`, `commands/{ctx,handoff,swap}.md`.
-- **Code-leg citations of the manuals: 23 lines in 8 files.**
-  - `lane-start` 2 and `lanes-edit.sh` 1, plus `tests/test_lane_helpers.sh` 4 (lines 3730, 3738, 6222, 6228), go to **lane 3**.
-  - `openRepoTools` 1 (line 1218, the `venv_note` comment) goes to **T007**, which patches that file.
-  - `tests/test_repo_hygiene.py` 11, `tests/test_lane_start_claude_current.py` 1 and `tests/run.sh` 1 (comment, line 36) go to **T009/T010**.
-  - `claude-current` 2: line 89 is a comment, and line 123 is `--help` output, so changing it changes the shipped command. Its owner is whoever owns `claude-current`'s text; it is not changed here.
-  - A comment-only repair ahead of the functional change beside it would leave the comment disagreeing with the code.
-- **Code-leg OpenSpec object keys (lane 3).** `lanes-edit.sh` (12 lines, e.g. 280, 2770, 2814–2827, 2895–2897) and `lane-handoff`:2439 key a claim as `owner/repo:openspec/changes/<name>`. After the split a change lives in `opensoft/openRepoTools-spec`, not the assembly.
-- **External referrers (lane 2's reads; follow-ups, not edited here).** From lane 2's `consumer-reads-2026-10-07.md` on `004-migrate-to-triad-reads` (76dcb93, which contains ae70dc5); line numbers are as lane 2 recorded them. That file has been on main since #189 (`63810dd`), in a later revision than `76dcb93`'s; what is cited here is as read at `76dcb93` (noted 2026-10-09).
-  - **brett-wip:**
-    - `lanes/LANES.md`:36 and :1305;
-    - 12 `docs/README-lanes` lines in 9 files (first: `handoffs/openRepoTools/brief-lane-openRepoTools-1-2026-09-16.md`:9, `session-handoff-2026-09-16-lane-openRepoTools-1.md`:33, `lanes/log/openRepoTools-1.md`:22);
-    - `lanes/repos.tsv`:52, which has no leg aliases.
-  - **`~/.agents`:**
-    - `protocols/lane-collision-protocol-amendment-9.md`:735 and 943, `-11.md`:1511, `-12.md`:315, `-14.md`:185, `-17.md`:175 and `-18.md`:222, all naming the manual;
-    - `AGENTS.md`:273-278 ("places from `opensoft/openRepoTools`");
-    - `AGENTS.md`:327 and others ("the code lands in `opensoft/openRepoTools`").
-  - **openRepoShape 7f84ca4:**
-    - `templates/workspace-root/AGENTS.md`:32, 71-76, 91-95, plus `README.md`:16,18,31,58, `handoffs/README.md`:24, `lanes/LANES.md`:19,40, `lanes/log/README.md`:4,6 and `.gitattributes`:8, all in that template;
-    - `scripts/shape_advisory.py`:509;
-    - the `--install` pointer at `openRepoShape`:279-280.
-  - **workBenches 7fd01e3:**
-    - `README.md`:188 and 190;
-    - `docs/claude-multi-account-profiles.md`:314;
-    - the vendored openrepotools tree and its `upstream-pin.yaml` rows.
-  - **Installed handoff skill:** `~/.claude/skills/handoff/SKILL.md`:329, whose writer-poll globs do not cover `<root>/worktrees/`.
-
-## 6. Provenance correspondence (FR-014)
-
-From run C's own filter-repo `commit-map`, copied read-only. For every
-spec-leg commit, every path that commit changed was compared blob for blob
-with its original commit: **35 of 35 match, 0 mismatches**.
-
-Correspondence is deterministic. The first 34 spec commits have exactly the
-hashes run B produced (for example `30d7bf7`, `b4e1cb7`, `558a12b`). Only
-`593250d`, from #187's `44983ce`, is new. Re-extracting the same history
-reproduces the same leg identities.
-
-| # | spec leg (run C) | original (assembly history) | date | paths | of which openspec/ or specs/ | blob check |
-|---|---|---|---|---|---|---|
-| 1 | `af9806736072` | `3fc62156e798` | 2026-09-10 | 1 | 0 | ok=1 bad=0 |
-| 2 | `7ab0b61163ec` | `9e3e241f4f3c` | 2026-09-10 | 1 | 0 | ok=1 bad=0 |
-| 3 | `1a12f36f7b5e` | `792a9dede1ec` | 2026-09-10 | 1 | 0 | ok=1 bad=0 |
-| 4 | `a1ebef63f4a6` | `3179f50d4d6c` | 2026-09-10 | 1 | 0 | ok=1 bad=0 |
-| 5 | `46ef1be6a9af` | `e6044d3a4189` | 2026-09-12 | 1 | 0 | ok=1 bad=0 |
-| 6 | `780b66740b1a` | `2108ce3ab6f7` | 2026-09-12 | 1 | 0 | ok=1 bad=0 |
-| 7 | `e26759dffc6d` | `bd27fc346682` | 2026-09-13 | 1 | 0 | ok=1 bad=0 |
-| 8 | `422f7f8b6ef4` | `9000e86796b2` | 2026-09-13 | 1 | 0 | ok=1 bad=0 |
-| 9 | `f53e46c45137` | `f97530bb936e` | 2026-09-13 | 1 | 0 | ok=1 bad=0 |
-| 10 | `cfae3d330bae` | `63a74af1b741` | 2026-09-14 | 1 | 0 | ok=1 bad=0 |
-| 11 | `f245d9f16c86` | `8345d2f1dc42` | 2026-09-14 | 1 | 0 | ok=1 bad=0 |
-| 12 | `7a76cad941fe` | `a95443591ab7` | 2026-09-14 | 1 | 0 | ok=1 bad=0 |
-| 13 | `52acec4817a2` | `2faa883db081` | 2026-09-14 | 1 | 0 | ok=1 bad=0 |
-| 14 | `17ba18660c6a` | `fcccbe08b1bd` | 2026-09-14 | 1 | 0 | ok=1 bad=0 |
-| 15 | `6d8aa95504bb` | `f98d7347b8b3` | 2026-09-15 | 1 | 0 | ok=1 bad=0 |
-| 16 | `21c1e268489d` | `9449557495b3` | 2026-09-15 | 1 | 0 | ok=1 bad=0 |
-| 17 | `30d7bf7dc109` | `f9e63f44dc37` | 2026-09-15 | 6 | 5 | ok=6 bad=0 |
-| 18 | `6a9f75c6f1a9` | `4c2ffefdec64` | 2026-09-16 | 1 | 0 | ok=1 bad=0 |
-| 19 | `219184864a87` | `4218e6dacdaf` | 2026-09-23 | 1 | 0 | ok=1 bad=0 |
-| 20 | `b4e1cb7a7797` | `a7d125716829` | 2026-09-30 | 9 | 8 | ok=9 bad=0 |
-| 21 | `4fe91d309f75` | `cbb59813ceea` | 2026-09-30 | 3 | 3 | ok=3 bad=0 |
-| 22 | `ac36505644f4` | `6faed35f418c` | 2026-10-02 | 1 | 0 | ok=1 bad=0 |
-| 23 | `525a95dd752d` | `c1bac0dfc99a` | 2026-10-03 | 1 | 0 | ok=1 bad=0 |
-| 24 | `03818f50c581` | `14641fd67cee` | 2026-10-03 | 1 | 0 | ok=1 bad=0 |
-| 25 | `993d1e1d01c9` | `daed20957f2d` | 2026-10-04 | 1 | 0 | ok=1 bad=0 |
-| 26 | `fa21860f9063` | `b1015f4672f9` | 2026-10-04 | 12 | 5 | ok=12 bad=0 |
-| 27 | `705058619ba5` | `fea9a2904ce0` | 2026-10-05 | 1 | 0 | ok=1 bad=0 |
-| 28 | `75ada176939b` | `00971b929f58` | 2026-10-06 | 18 | 10 | ok=18 bad=0 |
-| 29 | `2374d2ec8f8f` | `f5444c5e1f3c` | 2026-10-06 | 1 | 0 | ok=1 bad=0 |
-| 30 | `0c2b499dc1b4` | `2080f3d83520` | 2026-10-06 | 1 | 0 | ok=1 bad=0 |
-| 31 | `74e48d3b605b` | `500687c4b746` | 2026-10-06 | 1 | 0 | ok=1 bad=0 |
-| 32 | `659087420e44` | `5eb3d5f816f8` | 2026-10-06 | 1 | 0 | ok=1 bad=0 |
-| 33 | `c9b870270cf5` | `2fb854f12855` | 2026-10-06 | 1 | 0 | ok=1 bad=0 |
-| 34 | `558a12b67400` | `c4864ac5e59d` | 2026-10-07 | 1 | 0 | ok=1 bad=0 |
-| 35 | `593250d600ca` | `44983ce250ab` | 2026-10-08 | 20 | 20 | ok=20 bad=0 |
-
-**Per document.** These are the 51 files under `openspec/` and `specs/` at
-`593250d`. They were computed with plain `git log -- <path>`. `--follow` falsely
-linked the tiny `.openspec.yaml` files across changes.
-
-| documents | files | introduced (spec <- original) | last changed (spec <- original) |
-|---|---|---|---|
-| `openspec/changes/add-crash-consistent-lane-worktree-recovery/` | 5 | `fa21860<-b1015f4` | `fa21860<-b1015f4` |
-| `openspec/changes/add-supervised-context-restart/` | 6 | `75ada17<-00971b9` | `75ada17<-00971b9` |
-| `openspec/changes/interactive-lane-name-repair/` | 5 | `30d7bf7<-f9e63f4` | `30d7bf7<-f9e63f4` |
-| `openspec/changes/migrate-to-triad/` | 6 | `593250d<-44983ce` | `593250d<-44983ce` |
-| `openspec/changes/skip-no-lane-guard/` | 5 | `b4e1cb7<-a7d1257` | `b4e1cb7<-a7d1257` |
-| `openspec/config.yaml` | 1 | `593250d<-44983ce` | `593250d<-44983ce` |
-| `specs/002-skip-no-lane-guard/` | 3 | `b4e1cb7<-a7d1257` | `b4e1cb7<-a7d1257` |
-| `specs/003-binary-only-guard-runner/` | 3 | `4fe91d3<-cbb5981` | `4fe91d3<-cbb5981` |
-| `specs/004-migrate-to-triad/` | 13 | `593250d<-44983ce` | `593250d<-44983ce` |
-| `specs/005-supervised-legacy-ctx/` | 4 | `75ada17<-00971b9` | `75ada17<-00971b9` |
-
-**Where cited hashes resolve.** The spec documents at `593250d` contain 85
-distinct hex tokens. Each was resolved against the assembly's history (run C's
-source, `main` only) and against the original checkout's branches:
-
-| resolves | tokens | examples |
-|---|---|---|
-| assembly `main` history | 12 | `daed209`, `b1015f4`, `14641fd`, `82ecebe`, `c1bac0d`, `f5444c5` |
-| original repository's branches or PR objects only | 35 | `3c26041` (001), `5164ce1`/`b20882a` (`feat/supervised-context-restart`), `11037f0` (`feat/claude-current`), `dda91f1`/`52ce64e` (004 planning branch), `64f4e93`/`708395e` (no local branch: PR heads) |
-| openRepoShape | 2 | `39d5c98`, `91d5685` |
-| not an openRepoTools commit | 36 | session uuids, pids, dates, examples (`abc1234`), commits of other repositories |
-
-None of them resolves in the spec leg, whose history filter-repo rewrote. All
-47 openRepoTools citations resolve in `opensoft/openRepoTools`, which keeps its
-whole history and its branches because the adoption is in place. So the
-recorded citations stay valid as written and are not rewritten. The spec
-`AGENTS.md` says so.
-
-One consequence: a citation of a squash-merged branch commit resolves only
-while that branch or its PR ref survives. For example, feature 004's
-`dda91f1` and `52ce64e` predate the #187 squash.
-
-## 7. Bootstrap, validators, OpenSpec and Speckit: results
-
-Every check ran against a fresh clone of my bare copies, with
-`-c protocol.file.allow=always`. On git 2.43.0 the file transport is refused
-without that flag: on run C, plain `submodule update` exits 1 and the flagged
-one exits 0.
-
-| check | before (split `69b8924`) | after (c2 `3e87e39`) |
-|---|---|---|
-| `python3 scripts/bootstrap.py` | exit 0; legs on `main` at their pins | exit 0; spec `39c1887`, code `6169e8e`, both "branch tip == pin" |
-| `make validate` (naming, manifest, pins) | exit 0 | exit 0. Gitlinks equal their pins, tree digests recompute (spec `3a4a84be…`, code `697a080f…`), all 11 copied shape files match |
-| `bump-leg.py --dry-run`, then the real bump (spec, code) | — | exit 0 ×4; the tool's own validators "pins ok" |
-| `shape-doctor.py` | exit 1, `MISPLACED (3 paths)` (pre-existing; section 4) | exit 1, the same `MISPLACED (3 paths)`; `leg shape files` note down to 1 missing file |
-| `setup-openspeckit --shape on --integration codex --base-branch main --no-global-agent-pointers`, in a disposable copy with an isolated HOME and agent root | — | exit 0. **Line 1 unchanged**; the managed block landed before the first `## ` heading (line 72, before line 94), as the protocol prescribes for an adopted root; `git-config.yml` reads `checkout_mode: worktree`, `base_branch: main`, `worktree_root: worktrees`; ".gitignore unchanged" (`/worktrees/` already present); the spec leg gains `openspec/README.md`, `changes/archive/.gitkeep` and `specs/.gitkeep`, and its tracked `openspec/config.yaml` is kept. No file in the real agent root is newer than the run. The only workBenches files newer than it are another writer's QA evidence under `sysBenches/cloudBench/devcontainer.example/tmp/qa1-*`; the bootstrap writes only to its `--repo`. |
-| paired selection: the overlay's `create-new-feature.sh --number 4 --short-name migrate-to-triad` (dry run, then real) | — | exit 0 ×2. `004-migrate-to-triad` branched in both legs from `origin/main`; worktrees at `worktrees/004-migrate-to-triad/{spec,code}`; `.specify/feature.json` = `{"feature_directory":"worktrees/004-migrate-to-triad/spec/specs/004-migrate-to-triad"}`; `git status --ignored` at the root shows only `!! worktrees/` |
-| `.specify/scripts/bash/check-prerequisites.sh --json --paths-only` from the root | — | exit 0; `BRANCH 004-migrate-to-triad`, `FEATURE_DIR worktrees/004-migrate-to-triad/spec/specs/004-migrate-to-triad` |
-| `$SPECKIT_GIT_WORKTREE_ROOT=wt-override` (dry run) | — | exit 0; `WORKTREE_PATH wt-override/009-probe`. The override wins, but a root other than `worktrees/` is **not** covered by the root's ignore line, so point it at `worktrees/` or outside the root. |
-| `openspec validate migrate-to-triad --strict` in the **spec leg** (`main`, `39c1887`) | — | exit 0, "Change 'migrate-to-triad' is valid" |
-| the same in the feature's **spec worktree** | — | exit 0, valid |
-| `openspec validate --changes --strict` in the spec leg | — | exit 0, 5 passed, 0 failed |
-| the same command from the **assembly root** | — | exit 1, "Unknown item"; `openspec context`: "No OpenSpec root found" |
-| store precedence (a disposable spec clone registered as store `ort-spec-main` in the isolated config) | — | spec worktree without `--store` resolves `source: nearest`, the worktree itself (**local root wins**). With `--store` it resolves `source: store`, the store clone (explicit selection overrides, so check where it points). The assembly root without `--store` gives exit 1, naming the store rather than picking it; with `--store` it is valid. |
-| `git diff --check`, every patch range | — | exit 0 ×3 |
-| code-leg hygiene subset, `PATH=/usr/bin:$PATH code/tests/run.sh -k repo_hygiene` (serialized: it waited for a live suite, then held the lock) | 17 failed, 135 passed | 13 failed, 139 passed (exit 1 both times; section 10, finding 6) |
-
-**Tool versions on this bench, 2026-10-08:**
-- git 2.43.0; `/usr/bin/openspec` 1.6.0; `specify` 0.12.12.dev0.
-- `setup-openspeckit` is now a shim that runs workBenches' `devBenches/base-image/files/openspeckit/setup-openspeckit` (last changed in d86ba59, #140). Under an isolated HOME it needs `WORKBENCHES_ROOT`.
-- The `openspec` first on PATH (`~/.npm-global/bin`, 1.2.0) has no `--store`. The checks above name `/usr/bin/openspec`.
-- `python3` on PATH has no pytest, so locked runs need `PATH=/usr/bin:$PATH`.
-- `~/.agents` is a symlink; an isolated copy must dereference it (`cp -rL`). `cp -a` copies the link, and that copy then writes to the real agent root.
-
-## 8. `.specify/` today, and what the triad root needs
-
-**Today, on `main`'s shared checkout:**
-- `.specify/` is local and ignored. It is listed in `.git/info/exclude` (`/.specify/`, beside `.claude/`, `/.agents/`, `/.codex/` and `/handoffs`), not in the tracked `.gitignore`.
-- Its values are machine-local: integration `codex`; Speckit `1.0.7.dev0`; `git-config.yml` with `worktree_root: ../openRepoTools-worktrees` (the single-repository layout); and a `feature.json` pointing into a sibling worktree.
-- No agent file in this repository's history has ever carried the bootstrap's managed block (`git log -S'OPENSPEC-SPECKIT-GLOBAL'`: none).
-
-**What the shape and protocol prescribe for a three-leg root:**
-- `.specify/` at the root;
-- `git-config.yml` with `worktree_root: worktrees`;
-- `/worktrees/` in the root's own `.gitignore`;
-- paired worktrees `worktrees/<NNN>/{spec,code}`;
-- `$SPECKIT_GIT_WORKTREE_ROOT` as an override.
-
-**The root scaffolding patch carries only `/worktrees/`** (plus the shape's
-two ignore lines), and the bootstrap leaves it unchanged. It copies no
-machine-specific configuration or secret: `feature.json`, `init-options.json`,
-`integration.json`, `git-config.yml` and the skill links are all regenerated
-by the bootstrap on each workstation.
-
-It deliberately does **not** commit `.specify/`, the managed blocks, or the
-twenty generated agent files. That keeps today's posture: local scaffolding
-excluded per clone. The in-place checkout keeps its `.git/info/exclude`
-through the adoption. On a fresh clone elsewhere these files show as untracked
-after the bootstrap, exactly as they do on a fresh clone of today's
-monorepo. Changing that posture, by ignoring them in the tracked
-`.gitignore` or by committing `.specify/`, is Brett Heap's decision and is
-not made here. The root `AGENTS.md` map carries what the managed block would
-otherwise say about the split.
-
-## 9. Distribution is not bootstrap
-
-Running the shape-aware bootstrap in a root writes that root's scaffolding.
-It does not distribute the October 4 manual decision ("Triad Feature
-Amendments") to any workstation.
-
-The installed `project-agent-bootstrap.md` says so itself: "Existing global
-protocol files are written only when missing … Do not run a whole bootstrap
-merely to apply this manual decision". The fixture run confirms it: it logged
-"kept existing" for the agent root's `AGENTS.md` and both protocol files.
-
-On this workstation (Eagle) the installed protocol files carry the "Triad
-Feature Amendments" section. Their sha256 (`f9dd6464…`, `bbbc2b2c…`) are newer
-than the October 4 snapshots recorded in protocol-review.md. Nothing here
-speaks for any other workstation.
-
-What workBenches delivery would carry to each target workstation:
-- the updated `openspec-speckit-workflow.md` and `project-agent-bootstrap.md`;
-- the amendment documents and templates (`docs/triad-feature-amendments.md`, `docs/triad-feature-amendment-templates.md`);
-- the opsx command and Speckit skill guidance with its shape blocks;
-- the `setup-openspeckit` installer and the speckit-worktree overlay templates in the bench image.
-
-Each of these is verified per workstation through workBenches' own delivery,
-under its governing `openspec/changes/adopt-triad-feature-amendments/`.
-Lane 2 is reading that side.
-
-## 10. Findings for the other writers
-
-1. **T010.** The root `.github/workflows/validate.yml` has a row in `contracts/shape-pin.yaml` (sha256 `fb8c0360…`). A job added there is drift, and `validate-pins.py` will refuse it. The root integration job needs its own, unpinned workflow file.
-2. **Legs lose their front door.** Neither leg has `AGENTS.md`, `CLAUDE.md`, `README.md`, `LICENSE`, `.gitattributes` or `.gitignore` after the split. The root's attributes never reach a submodule, so the code leg loses the LF rule behind its installer's byte-for-byte comparisons. `code-0001` and `spec-0001` restore them.
-3. **Root README anchor.** `contracts/{spec,code}-pin.yaml` name `README.md#the-lockstep-invariant`, a section only `shape/README.md` had. `assembly-0001` adds it.
-4. **`shape/` copies.** Keep `shape/.gitignore` and `shape/.gitattributes` (pinned). `shape/AGENTS.md`, `shape/CLAUDE.md` and `shape/README.md` are unpinned, and the shape's own follow-up says to delete the first two. Their deletion is left to T014's reviewer.
-5. **Doctor placement.** `MISPLACED (3 paths)` (`code/commands/`, `code/contracts/`, `code/skills/`) is the adoption plan's reasoned overrides, identical before and after. Relay it; do not move files.
-6. **T009: the hygiene tests read the wrong front door after the split.**
-   - At `837928a`, 18 test functions read `README.md`, `AGENTS.md`, `CLAUDE.md`, `.gitattributes` or `docs/README-lanes.md` at the **code leg's** root: 17 in `test_repo_hygiene.py`, 1 in `test_openrepotools_command.py` (`test_the_help_and_the_readme_say_the_mode_the_receipt_is_born_at`). *Corrected 2026-10-09 (#193 item 9): this line first said 17, as 16 + 1.*
-   - Measured on run C's code leg (`837928a`'s code paths) alone with `-k repo_hygiene`, which selects only `test_repo_hygiene.py`: before `code-0001`, 17 failed (all `FileNotFoundError`). After it, 13 fail (4 `FileNotFoundError` on `docs/README-lanes.md`, 9 assertions on the short leg README and AGENTS).
-   - The command test is outside that subset. Called directly on `837928a`'s code paths on 2026-10-09, it fails before `code-0001` (`FileNotFoundError` on `README.md`) and still fails after it (`AssertionError`: the leg's README has no install-receipt paragraph).
-   - *Since #190 (`f87fd5a`; noted 2026-10-10):* 17 of the 18 read their file from the root that owns it, through `ROOTS.path_for` in `tests/conftest.py`. `README.md`, `AGENTS.md` and `CLAUDE.md` belong to the assembly root and `docs/README-lanes.md` to the spec root, so in a standalone code leg these 17 skip, and a composed run reads them from those roots. The 18th, `test_the_root_carries_the_line_ending_rule`, deliberately reads the code root's own `.gitattributes`. Called directly on main's code paths (`f87fd5a`), the 17 skip, including the command test. The 18th raises `FileNotFoundError` before `code-0001` and passes after it.
-   - **At `837928a`, 4 passed only because they read the leg's own files:** `test_agents_md_is_short_enough_to_be_read`, `test_readme_is_short_enough_to_be_read`, `test_claude_md_points_at_agents_md` and `test_the_root_carries_the_line_ending_rule`. For the first three, a green there was about the wrong file. *Corrected 2026-10-11 (lane 3's 5481348731 on #196, item 8): this line first said "4 now pass" and, of all four, "A green there is about the wrong file". Since #190 (`f87fd5a`), the first three read through `ROOTS.path_for`, so in a standalone leg they skip, with or without the leg's own `AGENTS.md`, `CLAUDE.md` and `README.md` from `code-0001`. The fourth still reads the code root's own `.gitattributes`, as it did at `837928a`. #190 changed only its docstring, which makes that read deliberate: the root's attributes never reach a submodule (finding 2). So its green is about the right file. Run directly on main's code paths (`f87fd5a`, spec trees and front-door files removed): before `code-0001`, 3 skip and 1 fails (`FileNotFoundError` on `.gitattributes`); after it, 3 skip and 1 passes.*
-   - Pointed back at the assembly root, the two length caps (`<= 316`, `<= 486`, today's counts) must rise to 340 and 510, each in a dated entry naming the rule its lines buy:
-     - AGENTS.md: the shape's first-line pointer and the triad map the bootstrap protocol requires.
-     - README.md: the lockstep-invariant anchor the leg pins name, and the three-repository front door.
-   - `test_lane_helpers.sh`:3738 and :6228 read the manual through `cat … || :`, so a missing file reads as empty rather than failing.
-7. **Lane 3 (lane tooling).**
-   - `lanes-edit.sh` and `lane-handoff` key an OpenSpec claim as `owner/repo:openspec/changes/<name>`; the triad's changes live in `opensoft/openRepoTools-spec`.
-   - The manual has 21 lines naming code-leg files (section 5).
-   - `lane-worktrees`' and `lanes-edit.sh`'s lane roots (`.claude/worktrees`, `.lane-worktrees/<lane>`) do not include `<root>/worktrees/<NNN>/{spec,code}`.
-   - `repos.tsv` has no `openRepoTools-spec` or `openRepoTools-code` aliases.
-   - The installed handoff skill's writer-poll globs miss `<root>/worktrees/`.
-   - The checkout's `/handoffs` symlink and `.git/info/exclude` persist through the in-place adoption.
-8. **T017.** Feature 004's own working files in the spec leg carry the pre-split path mentions listed in section 5: 23 by its stated total, 26 in 11 files by its per-file list, which is not settled (see there). Some cited 004 commits (`dda91f1`, `52ce64e`) resolve only while the 004 branch or #187's PR ref survives.
-9. **T007.** `assembly-0001`'s README sentence assumes T007's design: the root `openRepoTools` hands over to `code/openRepoTools` at the pinned commit. `code/openRepoTools`:1218 (`venv_note`) still cites `docs/README-lanes.md`.
-
-## 11. What this task did not do
-
-- It patched no executable, test, workflow or lane-tooling file in the code leg. Lane 3, T007, T009 and T010 own those.
-- It did not edit `docs/README-lanes.md`'s content (lane 3), any external referrer, any pinned shape copy, or any approval record.
-- It did not delete the three unpinned `shape/*.md` copies (T014's reviewer decides).
-- It did not commit `.specify/`, managed blocks or generated agent files.
-- It did not change the `.specify/` posture.
-- It did not run the full suite. Only the serialized `repo_hygiene` subset ran.
-- It did not write anything into the rehearsal directory or any real remote except this evidence branch.
-
-## 12. Nothing lands until the real legs exist
-
-These patches apply only to run C's rehearsed arrangement. Today's layout on
-`main` is unchanged. At T014, after Gate C and the real `execute`, the
-portable patches (`assembly-0001`, `code-0001`, `spec-0001`) are applied
-through the real leg and root pull requests. The pin bumps are then
-regenerated with `bump-leg.py` against the real leg commits, and the
-reviewer settles the `shape/*.md` deletion and the hygiene cap raises with
-T009.
diff --git a/specs/004-migrate-to-triad/spec.md b/specs/004-migrate-to-triad/spec.md
deleted file mode 100644
index 273cbff1..00000000
--- a/specs/004-migrate-to-triad/spec.md
+++ /dev/null
@@ -1,120 +0,0 @@
-# Feature specification: migrate openRepoTools to the triad
-
-**Feature**: `004-migrate-to-triad`
-**Created**: 2026-10-03
-**Status**: Proposed; planning complete enough for review, execution gated
-**Governing change**: [migrate-to-triad](../../openspec/changes/migrate-to-triad/proposal.md)
-
-## User scenarios
-
-### US1 — Preserve history and unfinished work (P1)
-
-The operator reviews an exact adoption mapping and current branch/worktree
-inventory, then converts the existing repository without losing unpublished
-or dirty work. Validate byte-accounted baseline extraction, nested dependency
-preservation, and replay receipts for a mixed spec/code feature and its new files.
-Missing content, stale baseline, unavailable backup or an unresolved placement
-blocks execution/cutover. Preserve source branches and local work on refusal.
-
-### US2 — Install through the existing entry point (P1)
-
-A user runs the existing raw-URL or `gh api` one-liner, or installs from an
-offline local checkout. Every payload comes from one selected immutable code
-revision; command names, permissions, artifact counts, hooks and receipts are
-preserved. Test forks/ref overrides, missing pins and partial fetch refusal.
-
-### US3 — Continue feature development and deliver exact pins (P2)
-
-The operator continues existing feature IDs through paired spec/code worktrees
-and lands their changes through leg PRs followed by a validated assembly pin
-bump. Full OpenSpec proposals run in the selected spec checkout; genuine
-bounded amendments use the code feature folder with explicit root selection.
-Speckit runs from assembly with selected feature paths. A code-only clone
-cannot falsely claim composed CI success.
-The migration preserves feature 001's model-role assignments and open gates.
-
-## Functional requirements
-
-- **FR-001**: Keep `opensoft/openRepoTools` as assembly with full original
-  history; extract spec/code using the reviewed standard procedure.
-- **FR-002**: Pin a source commit; resolve every path with reasons, account
-  for blobs/gitlinks, and reject a stale or unresolved plan.
-- **FR-003**: Preserve and verify all active branches/PRs, detached worktrees,
-  dirty/untracked content and ignored workflow configuration before cutover.
-- **FR-004**: Preserve the code dependency unit: `.gitmodules`,
-  `upstream/openRepoShape` and `contracts/openreposhape-pin.yaml`; verify nested
-  extraction/recursive bootstrap and retain the standard's exact pin semantics.
-- **FR-005**: Keep original installation entry points and one immutable payload
-  revision, including forks/ref overrides, local/offline behavior and existing
-  all-or-none ownership/receipt semantics; do not depend on developer checkouts.
-- **FR-006**: Put full proposals, archives, canonical OpenSpec/Speckit/docs in
-  spec and implementation plus shipped skills/commands/tests in code; project
-  workflow stays at root. Genuine bounded feature amendments are the narrow
-  code placement exception under FR-013, not a second spec baseline.
-- **FR-007**: Continue selected feature deltas with old/new identity and
-  content receipts, paired leg worktrees and unchanged feature/role meanings.
-  Do not merge old monorepo branches over the adopted assembly.
-- **FR-008**: Run canonical serialized tests and existing platform/CI policies
-  against explicitly selected compatible roots; preserve required checks and
-  prohibit silent context/dependency skips from claiming composed acceptance.
-- **FR-009**: Land leg changes before the root pin bump; move gitlinks, pin
-  records/digests and applicable workflow SHAs consistently with standard tools.
-- **FR-010**: Require a clean isolated source, available prerequisites, local
-  bare-remote rehearsal and explicit approval before real repository creation.
-- **FR-011**: Preserve original worktrees and installed tools until cutover
-  acceptance; use non-destructive rollback and existing estate/WIP contracts.
-- **FR-012**: Treat visibility, baseline, branch disposition and lane rebinding
-  as reviewed execution decisions; never infer approval from generated metadata.
-- **FR-013**: Explicitly review genuine bounded
-  `features/<NNN-feature>/openspec/` records as code until upstream placement
-  is qualified. Full proposals retain their role regardless of source branch;
-  do not manufacture local amendments for historical features or change pins
-  to hide an unqualified placement rule.
-- **FR-014**: Preserve approved original repository/commit/path provenance and
-  verify correspondence to extracted spec identities after filtering. Repair
-  cross-leg links, baseline references and selected feature roots/stores without
-  guessing new hashes or editing pinned base mounts. Maintain records manually
-  until schema/routing/distribution is qualified in its owning repositories.
-- **FR-015**: Record accepted bounded adjustments with unique feature-local IDs,
-  approved baseline, authority/source, affected requirements/tasks, verification
-  impact and dispositions; update working spec/plan/acceptance/tasks before
-  dependent implementation. Larger scope, runtime/authority or external-contract
-  changes require full spec governance; unnecessary larger ideas remain deferred
-  to linked future-proposal issues. Speckit is the only executable task list.
-- **FR-016**: Create one spec reconciliation issue at the first amendment.
-  Reconcile net tested effects once at completion, retaining all dispositions,
-  approved history, as-built departures, verification and landed code identity.
-  Completed assembly advancement requires landed reconciliation and matching
-  spec/code pins. Close the issue after spec landing; explicitly archive the
-  full spec root only after implementation and assembly landing, advancing any
-  archive commit normally. Reopen for later behavior changes; cancellation
-  records abandonment, not as-built completion.
-
-## Success criteria
-
-- **SC-001**: Every frozen baseline source path is accounted for exactly once;
-  no unapproved drops or content mismatches.
-- **SC-002**: Every retained feature's selected spec/code/root delta and
-  dirty/untracked work has a verified receipt and preserved original.
-- **SC-003**: Installation works through original entry points, offline and
-  fork/ref scenarios, using one code revision with unchanged artifact behavior.
-- **SC-004**: Recursive bootstrap, paired feature workflow, canonical tests and
-  required CI pass for the selected composed project; no hidden skips.
-- **SC-005**: A rehearsed rollback restores usable development/installation
-  without discarding work, altering private workspace pointers or force pushes.
-- **SC-006**: Every continued feature has verified baseline correspondence,
-  explicit root selection and correct artifact roles; local archive cannot
-  satisfy canonical reconciliation. Manual workflow and pending automation are
-  separately evidenced on target workstations.
-- **SC-007**: The tested migration has a final spec reconciliation and matching
-  landed code identity before completed assembly advancement, with every
-  amendment disposition accounted for and inactive deltas excluded.
-
-## Assumptions and approval
-
-Public new legs are proposed to match source visibility. Their creation is
-not approved. `git-filter-repo` must be made available before rehearsal/execution;
-it was absent in the inspected bench. The local constitution remains an
-unfilled template and is not a ratified migration rule; repository/global
-protocols and the pinned standard govern this plan. Refresh all snapshots
-before execution. Source token/swap runtime gates are unaffected.
diff --git a/specs/004-migrate-to-triad/t018-disposable-2026-10-09.md b/specs/004-migrate-to-triad/t018-disposable-2026-10-09.md
deleted file mode 100644
index 9208f407..00000000
--- a/specs/004-migrate-to-triad/t018-disposable-2026-10-09.md
+++ /dev/null
@@ -1,253 +0,0 @@
-# T018, disposable half: feature selection, OpenSpec and the estate verbs in a triad fixture — October 9, 2026
-
-**Task:** [T018](tasks.md)'s disposable workflow checks under
-[#186](https://github.com/opensoft/openRepoTools/issues/186). The tasks.md
-dependency section allows this as provisional rehearsal before Gate C. No task
-is checked complete by it. Real leg repositories, the real cutover, lane
-rebinding and WIP transitions in real estates come after Gate C. None of them
-was attempted.
-**Authority:** Brett Heap's words of 2026-10-07, "start the triad migration"
-(#186), and of 2026-10-09, "usage reset, resume all. read handoff and resume
-and fan out wide and do as much as possible in parallel".
-**Fixture:** the composed candidate of 2026-10-09: assembly `3bd95a7`
-(run C's split `69b8924` plus the T006, T007 and T010 follow-ups and two leg
-bumps), spec leg `9e1d006`, code leg `f0af7d9`, and the code leg's nested
-`upstream/openRepoShape` at `7f84ca4`. Every repository was copied fresh into
-this run's own bare remotes. The candidate and run C were only read.
-**Logs:** host-local, under the run directory (`<run>/logs/00…93`), and not
-committed. Below, `<run>` is that directory and `~` is the temporary HOME of
-the workstation named.
-
-## 1. The sandbox
-
-| Concern | How it was held |
-| --- | --- |
-| HOME | Three temporary homes, `<run>/home1`, `home2` and `home3`, one per simulated workstation. Every command ran under `env -i` with only the variables below. |
-| Agent root | `AGENT_PROTOCOL_ROOT=~/.agents`: a dereferenced copy (`cp -rL`) of the real agent root, with its own two-line `workspace.yaml` (`repository: t018-sandbox/t018-wip`, `path: ~/wip/t018-wip`). The real `workspace.yaml` was never written; its sha256 and mtime are unchanged. |
-| Lane register | No `LANES_*` variable reached any command. No lane command ran in the fixture. |
-| Git transport | `GIT_ALLOW_PROTOCOL=file`; `protocol.file.allow=always`. Each home's `~/.gitconfig` points `https://github.com/opensoft/`, `git@github.com:opensoft/` and run C's bare-remote prefix (the URLs the candidate's `.gitmodules` carries) at `<run>/remotes/`, which holds this run's own bare copies plus a seeded disposable WIP repository. |
-| Network | Every command ran inside `unshare --map-current-user --net`, a namespace in which a TCP connect fails with "Network is unreachable". Refusing `gh`/`curl`/`wget` shims logged two calls, both `gh api` from `status --fetch`, and both were refused. |
-| Commands under test | Installed into each temporary HOME by the candidate assembly's own front door, `./openRepoTools --install`. That printed "every payload file was checked against that commit and nothing fetched", "17 of 17 placed" and "29 placed files recorded". The installed `park`, `resume`, `status` and `openRepoTools` are byte-identical to the code leg's blobs (`132ce6d…`, `92fd430…`, `bb5c255…`, `04769c4…`). |
-| Speckit overlay | `setup-openspeckit` and its overlay templates were copied byte for byte from workBenches `ffd5516` (44 files, each equal to its `HEAD` blob) and run with `WORKBENCHES_ROOT` set to that copy. |
-| No writes outside the run | Afterwards, the ref digests of the eight source repositories (the candidate's four bare copies, run C's two leg remotes, its source clone and its openRepoShape mirror) were unchanged, and no file under run C's remotes, its source's refs or the candidate's remotes was newer than the run's start. The real `~/.agents/workspace.yaml` and the real installed `park`, `resume`, `status`, `openRepoTools` and `setup-openspeckit` were unchanged too. |
-
-Tool versions: git 2.43.0, GNU make 4.3, bash 5.2.21, Python 3.12.3, `specify`
-0.12.12.dev0, and OpenSpec 1.2.0 and 1.6.0. 1.2.0 is the `openspec` first on
-the bench's `PATH`; 1.6.0 is `/usr/bin/openspec`.
-
-The estate on workstation 1 was a recursive clone of the assembly, then
-`make bootstrap`. That exited 0: legs on `main` at their pins, "pins ok", and
-`11 copied shape file(s) match their digests`. Then came the documented
-bootstrap, `setup-openspeckit --shape on --integration codex --base-branch main
---no-global-agent-pointers`. It exited 0 with `git-config.yml` reading
-`checkout_mode: worktree`, `base_branch: main` and `worktree_root: worktrees`.
-It also left the tree dirty, which section 4 turns on:
-
-- at the root, `AGENTS.md` and `CLAUDE.md` each gained the 22-line managed
-  block, and `.specify/`, `.agents/`, `.claude/`, `.codex/` and 17 other agent
-  files or directories became untracked;
-- in the spec leg, `openspec/README.md`, `openspec/changes/archive/.gitkeep`
-  and `openspec/specs/.gitkeep` became untracked, which the root reports as
-  ` M spec`.
-
-## 2. Speckit feature selection and branch naming
-
-| Command (workstation 1, from the assembly root unless named) | Exit | Result |
-| --- | --- | --- |
-| `.specify/extensions/git/scripts/bash/create-new-feature.sh --json --dry-run --short-name t018-probe "T018 disposable probe"` | 0 | `BRANCH_NAME 006-t018-probe`, `REPO_SHAPE three-leg`, `SPEC_WORKTREE_PATH …/worktrees/006-t018-probe/spec`, `CODE_WORKTREE_PATH …/worktrees/006-t018-probe/code`, `FEATURE_DIR …/worktrees/006-t018-probe/spec/specs/006-t018-probe` |
-| The same, invoked as `../.specify/…` from `code/` and from `spec/` | 0, 0 | Identical JSON: `PROJECT_ROOT` is the assembly root, found from the script's own location, not from the current directory |
-| A local branch `009-code-only-probe` in the code leg only, then the same dry run | 0 | `010-t018-probe`: the code leg's branches count |
-| The real creation | 0 | Both legs got branch `006-t018-probe` from `origin/main`, as worktrees at `worktrees/006-t018-probe/{spec,code}`. The root stayed on `main` at `3bd95a7`, registered no worktree and showed only `!! worktrees/`. `.specify/feature.json` = `{"feature_directory":"worktrees/006-t018-probe/spec/specs/006-t018-probe"}` |
-| `.specify/scripts/bash/check-prerequisites.sh --json --paths-only`, run from the root, `code/`, `spec/`, the spec worktree and the code worktree (each by its relative path to the root's script) | 0 ×5 | Identical: `REPO_ROOT` the assembly, `BRANCH 006-t018-probe`, `FEATURE_DIR` in the spec worktree |
-| `.specify/` from inside a leg | — | None exists in either leg or either leg worktree. A cwd-relative `.specify/scripts/…` works only from the root |
-| `SPECIFY_FEATURE_DIRECTORY=worktrees/006-t018-probe/spec/specs/004-migrate-to-triad` | 0 | Overrides `feature.json`: `BRANCH 004-migrate-to-triad`, `FEATURE_DIR` that directory |
-| `SPECIFY_FEATURE=004-migrate-to-triad` | 0 | `BRANCH 004-migrate-to-triad`, but `FEATURE_DIR` stays 006's from `feature.json`. **The pair disagrees** |
-| The `speckit-git-validate` skill's three-leg rule, applied by hand | — | The root's `main` is not validated. Spec and code are both on `006-t018-probe`, which matches `^[0-9]{3,}-.+`; the legs agree; the spec directory was found. The extension's own `speckit.git.validate.md` has no three-leg block; the installed skill does |
-| Upstream of the new branch in each leg | — | `branch.006-t018-probe.merge=refs/heads/main`: it tracks `origin/main` |
-| The code worktree's nested dependency | — | `-7f84ca4… upstream/openRepoShape`, an empty directory: no nested submodule is initialised |
-
-**How the number is chosen.** In a three-leg root the feature number is one more
-than the highest of four sources: `specs/` in the spec leg's `origin/main`;
-`specs/` in its working tree; and the `NNN-` branch names, local and
-remote-tracking, of both legs. The root's own branches are not read. The branch
-name is the same in both legs, and the root never gets one. On workstation 2,
-the next feature came out as `007-nested-pin-probe`.
-
-## 3. OpenSpec from each root (workstation 1, feature 006 open)
-
-| Directory | `openspec list` 1.2.0 / 1.6.0 | `validate --all --strict` 1.2.0 / 1.6.0 | `validate migrate-to-triad --strict` 1.2.0 / 1.6.0 |
-| --- | --- | --- | --- |
-| assembly root | exit 1 "No OpenSpec changes directory found" / **exit 0 "No active changes found."** | **exit 0 "No items found to validate." / exit 0, the same** | exit 1 "Unknown item" / exit 1 |
-| `code/` and the code worktree | as the root | as the root | as the root |
-| `spec/` and the spec worktree | exit 0, five changes / exit 0, five changes | **exit 1, 3 passed and 2 failed** / exit 0, 5 passed | **exit 1** / exit 0, "is valid" |
-
-`openspec list --specs` printed "No specs found." everywhere: no canonical spec
-exists yet under `openspec/specs/`. Under 1.6.0, `openspec context` from the
-root or the code leg exits 1 with "No OpenSpec root found from the current
-directory". From the spec leg or the spec worktree it names that directory as
-the root. The 1.2.0 failures are
-`ADDED "Installation retains the public interface and one revision" must contain SHALL or MUST`
-in `migrate-to-triad`, and two of the same kind in
-`interactive-lane-name-repair`. **They are not caused by the split:** 1.2.0
-gives the same 3 passed, 2 failed on today's single-repository `main`
-`63810dd`, where 1.6.0 passes all five.
-
-## 4. The estate verbs `status`, `park` and `resume`
-
-Workstation 1 created and parked the feature. Workstation 2 started from
-nothing and resumed it. Workstation 3 tested one resume flag. Feature 006
-carried four kinds of change: a new spec file and a staged edit in the spec
-leg, and a tracked edit and an untracked file in the code leg.
-
-| Log | WS | Command | Exit | What it did |
-| --- | --- | --- | --- | --- |
-| 10 | 1 | `status openRepoTools`, before any clone | 2 | Refused: no estate (verbatim below) |
-| 14 | 1 | `status openRepoTools`, cloned and bootstrapped | 0 | `0 finding(s) in 3 repositories` |
-| 15 | 1 | `park openRepoTools --dry-run`, no overlay yet | 2 | `make park` refused (verbatim below) |
-| 18 | 1 | `status`, after `setup-openspeckit` | 1 | Two findings: root `dirty: 23 path(s)`, spec leg `dirty: 3 path(s)` |
-| 50 | 1 | `status`, feature open and edited in both legs | 1 | The same two findings. With no parked record, the open feature worktrees are not listed |
-| 51, 52 | 1 | `park openRepoTools --dry-run --lane t018-sandbox`, then without `--dry-run` | 0, 0 | `PARKED: 006-t018-probe`, spec `4ea12d2` and code `139031a`, each "pushed origin/006-t018-probe". The record `workspaces/opensoft/openrepotools.yaml` was committed as `8f5cb0d` and pushed. Reported, not touched: "24 path(s) changed at the root … the root carries no feature branch at all" |
-| 53 | — | Verification | — | One WIP commit per leg, each with a single parent at the leg's base, subject `wip: park 2026-10-09T13:47:46Z — lane t018-sandbox`. Spec: `M quickstart.md`, `A specs/006-t018-probe/spec.md`. Code: `M README.md`, `A t018-probe.txt`. The code WIP's `upstream/openRepoShape` gitlink was unchanged at `7f84ca4`. **The root was untouched**: still `3bd95a7`, gitlinks `9e1d006` and `f0af7d9`, assembly remote unmoved. Both worktrees were left clean at their WIP commits. The record lists both legs with `role`, `parked_commit`, `wip_depth: 1` and `pushed: true` |
-| 54, 55 | 1 | `status`, then `status --fetch` | 1, 1 | Four findings. Two are the dirt above. The other two say, for each leg, "branch 006-t018-probe: 1 commit(s) unpushed to origin/main", although `origin/006-t018-probe` equals `HEAD` (log 62: the branch tracks `origin/main`). Under `--fetch`, both `gh api` checks were refused by the shim and reported on the row |
-| 58, 59 | 1 | `park --dry-run` from inside the code worktree, and `status` from inside `spec/`, with no name | 0, 1 | Both walk up to the assembly root |
-| 60, 61 | 1 | `park.sh --dry-run`, run directly from `code/` or from the code worktree | 1, 1 | `Error: not inside a Git repository or Speckit checkout.` |
-| 56, 88 | 1 | `resume openRepoTools --dry-run`, then the real run | 1, 1 | **Root refused, because of the bootstrap's own outputs.** `make resume` never ran. The real run pulled the workspace record first |
-| 57, 82 | 1 | `make resume ARGS=--dry-run`, then `make resume` at the root: the extension, as AGENTS-shape.md names it | 0, 0 | Same-workstation resume worked. "worktree already registered … left as it is", "un-committed 1 WIP commit" in each leg, and all four files' sha256 equal their values before the park |
-| 71 | 2 | `resume openRepoTools` on a fresh home | 2 | It pulled the record, cloned the root with both legs and the nested dependency, and passed `make bootstrap`. Then `make resume` refused: overlay missing |
-| 72–74 | 2 | `setup-openspeckit … --no-repo-agent-pointers`, plus the four per-clone excludes today's checkout carries (`/.agents/`, `/.claude/`, `/.codex/`, `/.specify/`), then `resume --dry-run` | 1 | **Still refused**: the three untracked spec-leg files make the root ` M spec` |
-| 75, 76 | 2 | Then three exact-path excludes in the spec leg's common `info/exclude`, then `resume` | 0 | `RESUMED: 006-t018-probe`, "un-committed 1 WIP commit" in both legs. `FEATURE_JSON` and `STATE_FILE` were restored; the root stayed at `3bd95a7`, clean, with legs on `main` |
-| 77 | — | Verification | — | All four sha256 values were OK. The staged edit came back unstaged, by design. The untracked file came back untracked. The branch now tracks `origin/006-t018-probe` |
-| 78 | 2 | `status openRepoTools` | 0 | `0 finding(s)`, although the next `park` here refuses (log 79) |
-| 79, 80 | 2 | A further edit, then `park --dry-run` and `park` | 2, 2 | Refused: behind by one parked WIP commit (verbatim below). No leg ref and no worktree moved. **But the real run still committed and pushed the record as `c1288a1`** ("0 feature(s)"), rewriting `parked_at` and `parked_by_lane` while keeping 006's old entries |
-| 84–86 | 2 | New feature 007: the code worktree's nested dependency initialised, moved to `39d5c98`, plus a new file; then `park` | 2 (`make: *** … Error 3`) | 007 parked. Spec: `wip 0`, branch pushed at its base. Code: WIP `032c85b`, carrying the gitlink move `7f84ca4 → 39d5c98` while `contracts/openreposhape-pin.yaml` still says `7f84ca4`. 006 was refused again. Record `653f67d` |
-| 89, 90 | 1 | `make resume` | 0 | 007 recreated with "un-committed 1 WIP commit". The worktree shows only `?? t018-nested.txt`. **The nested gitlink move is gone from both the index and the working tree**, because the nested submodule is not initialised there, and nothing warned. It survives only in `032c85b` on `origin/007-nested-pin-probe` |
-| 92, 93 | 3 | `make resume "ARGS=--keep-staged --feature 007-nested-pin-probe"` | 0 | The move stays staged (`M  upstream/openRepoShape` at `39d5c98`). `git submodule update --init upstream/openRepoShape` then checks out `39d5c98` |
-
-### Refusals, verbatim
-
-`~` stands for the workstation's temporary HOME.
-
-```text
-REFUSED: no estate named 'openRepoTools' under your projects directory.
-    An estate is a FAMILY folder (openRepoTools/openRepoTools/family.yaml) or a standalone
-    project root (openRepoTools/project.yaml). Bring it back with `resume openRepoTools`, or
-    read one of these:
-
-  (none)
-```
-
-```text
-make park needs the Speckit worktree overlay; install it with: setup-openspeckit
-make: *** [Makefile:55: park] Error 2
-```
-
-```text
-make resume needs the Speckit worktree overlay; install it with: setup-openspeckit
-make: *** [Makefile:59: resume] Error 2
-```
-
-```text
-  REFUSED root openRepoTools: uncommitted changes in ~/projects/openRepoTools.
-          Nothing was fast-forwarded and nothing was reset.
-            look:  git -C ~/projects/openRepoTools status --short
-            then:  commit or stash them yourself, and re-run `resume openRepoTools`.
-  [root openRepoTools] bootstrap skipped: refused above. Nothing here was fetched, moved or reset.
-```
-
-```text
-Error: 006-t018-probe (spec leg) is behind origin by 1 parked WIP commit(s); that feature was NOT parked.
-The parked commit 4ea12d231fdaa50dc2afe0377e5ced2c83575f6b is still the remote tip and this workspace recorded it, so retiring it
-cannot destroy anyone else's work:
-  git -C worktrees/006-t018-probe/spec push --force-with-lease=006-t018-probe:4ea12d231fdaa50dc2afe0377e5ced2c83575f6b origin 006-t018-probe
-park does not force-push on your behalf. Re-run `make park` afterwards, or pass
---retire-parked-wip to let park do exactly that one push.
-```
-
-```text
-Error: not inside a Git repository or Speckit checkout.
-```
-
-No refusal was forced. The leased push and `--retire-parked-wip` are the
-person's to choose, and neither was run. The excludes in rows 72–76 are a
-measured posture, not a repair: they show which local state `resume` reads as
-dirty.
-
-## 5. Follow-ups before cutover
-
-1. **A bootstrapped triad root is "dirty" to `resume`.** `setup-openspeckit`
-   writes the managed block into the tracked `AGENTS.md` and `CLAUDE.md`
-   (unless `--no-repo-agent-pointers` is passed), and leaves `.specify/` and
-   the agent directories untracked. It also writes three untracked files into
-   the spec leg, which the root reports as ` M spec`. Any of these makes
-   `resume <Name>` refuse the root and skip `make resume`. Today's per-clone
-   excludes do not cover the spec-leg files.
-   - This is Brett Heap's posture decision (root-guidance §8). The options
-     measured here: land `openspec/README.md`, `openspec/changes/archive/.gitkeep`
-     and `openspec/specs/.gitkeep` in the spec leg before cutover, through a
-     spec PR and a root pin bump; run the bootstrap with
-     `--no-repo-agent-pointers`, or commit its block; and carry the four root
-     excludes.
-   - A leg's `info/exclude` lives in its common git dir, so it applies to
-     **every feature worktree** of that leg. A directory pattern there would
-     hide feature work from park's `git add -A`. Use exact paths only.
-   - Owners: Brett (posture); workBenches (what the bootstrap writes).
-2. **The overlay does not travel with a clone.** On a fresh workstation,
-   `resume <Name>` clones and bootstraps, then refuses until the person runs
-   `setup-openspeckit` and runs `resume` again. Put that order in the T018
-   real-half and T019 runbook. Under a temporary HOME, the shim also needs
-   `WORKBENCHES_ROOT`.
-3. **Feature worktrees never initialise the code leg's nested dependency.**
-   Neither `create-new-feature.sh` nor `resume.sh` runs a nested
-   `submodule update`. Two consequences:
-   - `upstream/openRepoShape` is empty in every code feature worktree, so the
-     command tests skip there and composed checks lack the dependency.
-   - A parked gitlink move is **silently dropped** by a default resume on
-     another workstation. The workaround measured here is
-     `git submodule update --init upstream/openRepoShape` in the code worktree,
-     and `resume <Name> -- --keep-staged` when the parked code WIP moves a
-     gitlink.
-   - Owner: workBenches (initialise nested submodules in leg worktrees, or warn
-     when an un-committed WIP carries a `160000` change).
-4. **New feature branches track `origin/main`,** so `status` calls a pushed
-   park "unpushed to origin/main". After a resume elsewhere the branch tracks
-   `origin/<branch>`, so the same feature reads differently on two machines.
-   Owners: workBenches (`--no-track`, or `push -u` at park) or this repository
-   (`status` reading `origin/<branch>`).
-5. **A park that refuses every feature still rewrites the record's header.**
-   `parked_at` and `parked_by_lane` change, with the subject "0 feature(s)".
-   A third machine would then misread whose park the record holds. Owner:
-   workBenches `park.sh`.
-6. **Partial parks reach the person as exit 2.** `park.sh` exits 3, make prints
-   `Error 3`, and `park` says "`make park` exited 2". The Makefile header says
-   so, and the make line is the one to read. This repository's `park` could
-   relay the code. Optional.
-7. **Run OpenSpec only from the spec leg or a spec worktree.**
-   - From the root or the code leg, 1.6.0 reports "No active changes found."
-     and `validate --all --strict` passes vacuously with exit 0. Any CI or
-     agent validation step must change into the spec leg, or use a store that
-     resolves it.
-   - The bench's `PATH`-first 1.2.0 fails two of five changes that 1.6.0
-     passes. This predates the split, but the bench should resolve 1.6.0.
-     Owner: workBenches.
-8. **Select a feature with `.specify/feature.json` or `SPECIFY_FEATURE_DIRECTORY`,
-   never `SPECIFY_FEATURE` alone.** The latter yields a `BRANCH` and a
-   `FEATURE_DIR` that disagree.
-9. **`speckit.git.validate.md` has no three-leg rule;** the installed skill
-   does. Owner: workBenches, in the command doc.
-10. **`status` does not report open feature worktrees,** either before any
-    record exists or after a resume that `park` will next refuse (rows 50
-    and 78). Consider a line for each. Owner: this repository.
-11. **Wording:** `resume --dry-run` reports the estate "absent … the workspace
-    was not cloned" when the workspace clone exists but has not been pulled.
-
-## 6. What this did not do
-
-- It touched no real leg repository, real estate or lane register, and did no
-  lane rebinding or real WIP transition. Those are T018's post-Gate-C half.
-- It ran no `--retire-parked-wip`, no force-push and no reset.
-- It wrote nothing to the candidate's or run C's repositories.
-- It ran no suite in the fixture. Only this branch's own hygiene check ran.
-- It did not exercise macOS, or the `gh`-backed fork and shape-currency checks.
-- Every workstation reports the same `parked_on: docker-desktop`, because all
-  three homes are on one host. Distinguishing workstations by host was not
-  tested.
diff --git a/specs/004-migrate-to-triad/tasks.md b/specs/004-migrate-to-triad/tasks.md
deleted file mode 100644
index 2e6ead21..00000000
--- a/specs/004-migrate-to-triad/tasks.md
+++ /dev/null
@@ -1,190 +0,0 @@
-# Implementation tasks: migrate openRepoTools to the triad
-
-The sole executable task list for the governing OpenSpec change. Planning
-artifacts and preliminary mapping validation do not complete these tasks.
-Every task remains open. Run implementation from the selected feature
-worktrees; actual repository creation/cutover require the approval gates.
-The protocol refresh updates snapshot/mapping and planned workflow follow-ups;
-owner decisions, private preservation/restore receipts and execution gates
-remain pending. Retired checkouts are not instructions to recreate worktrees.
-
-Preparation progress is recorded in [preparation.md](preparation.md): partial
-T001–T005 evidence, an [upstream blocker reproduction](adopter-blocker.md),
-and [T007–T010 installer/test design](installer-design.md). No execution task
-is complete. The [October 6 candidate rehearsal](adopter-rehearsal.md) passes;
-T005 still needs upstream landing and a tested consumer pin update. PRs #97
-and #121 have landed. Real conversion waits for the remaining baseline PRs,
-integration/preservation evidence and refreshed execution approval.
-
-## Phase 1 — Preservation and baseline (Gate A)
-
-- [ ] T001 [US1] Refresh `inventory.json`, PR/main/branch/worktree metadata and
-  applicable estate-status output; distinguish retained work from retired
-  cleanup records and remote-only refs. Until an estate manifest exists,
-  relay `status --fetch openRepoTools`'s no-estate refusal without invoking
-  `resume`. Resolve continuation/archive decisions for every retained object
-  in a host-local/private migration receipt. Verify no branch, detached
-  worktree or dirty/untracked/local-workflow content is omitted.
-- [ ] T002 [US1] Coordinate owner breakpoints and preserve source refs/content,
-  ignored workflow configuration and installed receipts/config using the
-  existing estate/private backup contract. Verify restoration and per-object
-  digests, including all feature 001 edits and new files, without altering
-  workspace.yaml or broad process actions.
-- [ ] T003 [US1] Confirm proposed leg names/visibility and inspect prerequisite
-  availability; regenerate `adoption-plan.yaml` for the reviewed preliminary
-  rehearsal source, retaining reasoned overrides. Verify standard `check`
-  passes and records all source paths with no unapproved drops. Explicitly
-  classify genuine bounded feature amendment folders as code until upstream
-  qualification; preserve full proposals/archives/canonical Speckit as spec
-  regardless of branch origin. Record no amendment paths when none exist;
-  do not manufacture historical amendments or weaken shape pins.
-
-## Phase 2 — Local adoption rehearsal (Gate B foundation)
-
-- [ ] T004 [US1] Prepare a clean isolated source clone with no linked
-  worktrees and approved `git-filter-repo` availability; rehearse the standard
-  adoption against temporary local bare remotes. Verify source identity/history,
-  path/blob accounting and recoverability without real GitHub creation.
-- [ ] T005 [US1] Exercise the existing nested submodule path, original
-  `.gitmodules` extraction/removal, pin integrity and recursive bootstrap.
-  Verify the code gitlink/pin/registration remain coupled. If standard tooling
-  refuses, record its refusal and resolve upstream before a tested pin bump;
-  never patch `upstream/openRepoShape` in place or weaken verification.
-- [ ] T006 [US3] Resolve materialized root collisions and new leg guidance in
-  reviewable patches; bootstrap selected root workflow after manifest/legs
-  exist. Verify first-line shape guidance, relative paths, actual `.specify`
-  configuration and paired feature selection without copying machine secrets.
-  Verify explicit full-spec/local-amendment roots and intended feature branches,
-  local-root precedence over store pointers and supported CLI store selection.
-  Keep manual records until schema/routing is qualified; check protocol/command
-  distribution per target workstation through owning workBenches delivery,
-  without treating a scaffold bootstrap as distribution of this manual decision.
-
-## Phase 3 — Installation and checks (Gate B completion)
-
-- [ ] T007 [US2] Add the assembly `openRepoTools` entry point and coherent
-  payload-source resolution in the code installer after source byte accounting.
-  Verify gh/raw one-liners resolve one code pin and do not duplicate installer
-  mechanics or depend on developer checkouts after installation.
-- [ ] T008 [US2] Cover local/offline, legacy monorepo overrides, adopted forks,
-  branch/commit refs, immutable code selection, missing/mismatched pins and
-  failed partial fetch. Verify unchanged command/artifact names, counts,
-  destinations/modes, hooks, ownership receipts and all-or-none refusal.
-- [ ] T009 [US3] Separate code/spec/assembly/dependency roots in fixture and
-  hygiene consumers, including docs/OpenSpec/Speckit references. Verify the
-  existing upstream pin checks run against code Git identity and required
-  composed checks cannot silently skip absent spec/dependency context.
-- [ ] T010 [US3] Adapt implementation CI and root exact-pin integration checks
-  with explicit compatible checkout context; preserve current Linux/macOS/
-  Windows/WSL policies, Bash 3.2 parsing and serialized `tests/run.sh` locking.
-  Verify the exact rehearsed composed state passes required checks and the
-  compatibility matrix, recording failures rather than deleting assertions.
-- [ ] T011 [US1] Rehearse restoration/rollback of the local candidate and
-  installed payload using preserved artifacts. Verify user work/jobs/claims
-  survive and no force push, destructive reset or workspace-pointer rewrite
-  is needed. Publish Gate A/B evidence and follow-up patch/commit inventory.
-
-## Phase 4 — Reviewed real adoption (Gates C and D)
-
-- [ ] T012 [US1] After #97 and #121 land, account for their final merged work
-  in main and disposition any remaining local deltas. Freeze the coordinated
-  source baseline and regenerate/check
-  the full plan after any prerequisite/planning landings. Obtain explicit
-  approval naming revisions, leg repositories/visibility, mapping, follow-ups
-  and work dispositions. Verify current name availability, preservation and
-  rehearsal evidence; refuse any source drift before execution.
-- [ ] T013 [US1] Execute the approved standard adoption from the isolated
-  clone. Verify and relay the complete content-accounting table and root PR
-  details; stop landing on any refusal/mismatch, retaining all source/evidence.
-- [ ] T014 [US3] Apply reviewed follow-ups and prepare code/spec PRs together.
-  For accepted bounded adjustments, retain authority/baseline/requirements/tasks
-  and dispositions in manual code-local records, update working Speckit files
-  before implementation and create one spec reconciliation issue at the first
-  amendment. Escalate larger current scope to full governance; defer unnecessary
-  capabilities to linked future issues. Prepare final reconciliation against
-  tested behavior; code may land first, but completed assembly advancement waits
-  for matching reconciled spec. Verify no in-place pinned-shape edits.
-- [ ] T015 [US2] Validate the real exact assembled head using canonical tests,
-  required platform/CI, installed/local/raw compatibility, bootstrap and rollback
-  checks, including prepared continued-feature translations and disposable
-  workflow evidence from T016–T018. Complete one final spec reconciliation batch with net tested effects,
-  every amendment disposition, dated departures/as-built record, archived approval
-  provenance, deferred issues and actual landed code/evidence. Land spec, close
-  its reconciliation issue and advance matching root gitlinks/pins/workflow SHAs
-  with standard tools; verify final Gate D results at the actual selected commits
-  before root adoption merge. Keep original development/install available.
-
-## Phase 5 — Continue features and controlled cutover (Gate E)
-
-- [ ] T016 [US1] Translate the complete approved feature 001 delta and any
-  dirty/untracked work captured at cutover into paired `001` spec/code branches/worktrees with
-  reviewed root changes. Verify content/old-to-new receipts, roles, inventory
-  amendment and open runtime gates. Carry the clean `3c26041` checkpoint's
-  restored rollover/workspace packets, launcher contract and FR-047/T063–T065;
-  preserve workBenches/Omnigent ownership and required local adapter qualification
-  separately from factory-broker admission. Preserve approved original repository/
-  commit/path and verify extracted spec correspondence, repairing links/task roots
-  without guessed hashes. Full feature-branch proposals remain in spec; preserve
-  any actual bounded records in code and continued reconciliation obligations.
-  Do not replay completed work or claim new
-  runtime acceptance from migration.
-- [ ] T017 [US1] Translate every other approved continued PR/branch/detached
-  worktree, including this migration feature, with explicit spec/code/root
-  mappings and conflict review. Verify each object has a complete receipt or
-  approved archived-original disposition; preserve original PR review history.
-  Current candidates are #97/#121 and feature 004. Account for merged
-  #61/#146/#134 through the baseline and retired/retained merged checkout history
-  through receipts; do not recreate cleaned worktrees or replay integrated changes.
-  Verify approved baseline correspondence and artifact roles for every continued
-  feature, including this migration's full proposal in spec.
-  Capture PR #121's complete active index/working files and untracked `005`
-  feature/full legacy authority decision; carry its confirmed-legacy-only scope,
-  managed/unknown refusal and merge hold into paired `005` continuation. Keep
-  PR #97's separately owned diagnostics and current branch head independent.
-- [ ] T018 [US3] Exercise OpenSpec/Speckit feature selection and estate
-  park/resume in disposable triad fixtures, then perform reviewed binding/WIP
-  transitions through supported tools at owner breakpoints. Verify correct
-  feature roots/session bindings and relay refusals without force repairs.
-- [ ] T019 [US3] Publish Gate E/cutover evidence and actual PR dispositions;
-  verify all continued features are usable and recoverable before requesting
-  separate old-worktree retirement. Verify each continued feature retains its
-  outstanding reconciliation/runtime gates rather than declaring it implemented.
-  Archive the migration's full spec change only after implementation and assembly
-  pin landing; explicitly select its root and pin any later archive commit normally.
-  Reopen reconciliation for subsequent behavior changes; record cancellation as
-  abandonment. Do not auto-close old PRs or delete backups.
-
-## Dependencies
-
-Reviewed preliminary inventory, mapping and prerequisite availability from
-T001–T003 permit disposable provisional rehearsal while writers remain active;
-complete Gate A preservation is required before real source freeze.
-T004–T006 precede integration validation;
-T007–T010 may progress within the rehearsed topology after byte accounting.
-T011 closes Gate B. T012 requires Gate A/B and is the real-creation approval
-boundary. T013–T015 precede root adoption merge. Prepare T016–T017 translations
-and T018 disposable workflow checks in the candidate after legs exist, before
-T015's final reconciliation. Actual T018 lane rebinding follows reviewed root
-adoption/cutover and safe breakpoints. T019 requires validated retained feature
-receipts; later behavior changes reopen reconciliation before another completed
-assembly advancement.
-
-## Requirement coverage
-
-| Requirement | Tasks |
-| --- | --- |
-| FR-001, FR-002 | T003–T005, T012–T013 |
-| FR-003 | T001–T002, T016–T017 |
-| FR-004 | T005, T009, T014 |
-| FR-005 | T007–T008, T015 |
-| FR-006 | T003, T006, T009 |
-| FR-007 | T016–T018 |
-| FR-008 | T009–T010, T015 |
-| FR-009 | T014–T015 |
-| FR-010 | T003–T005, T011–T013 |
-| FR-011 | T002, T011, T018–T019 |
-| FR-012 | T001, T012, T018–T019 |
-| FR-013 | T003, T006, T016–T017 |
-| FR-014 | T006, T016–T018 |
-| FR-015 | T014–T015 |
-| FR-016 | T014–T015, T019 |
diff --git a/specs/004-migrate-to-triad/test-roots-and-ci-2026-10-08.md b/specs/004-migrate-to-triad/test-roots-and-ci-2026-10-08.md
deleted file mode 100644
index 2e1b260f..00000000
--- a/specs/004-migrate-to-triad/test-roots-and-ci-2026-10-08.md
+++ /dev/null
@@ -1,515 +0,0 @@
-# Explicit test roots and the triad's CI — October 8, 2026
-
-**Updated:** October 9, 2026, for `e3a76b5`, `dbc6837`, both reviews and the
-follow-ups.
-**Landed (added October 11, 2026):** #192 landed as `1abee1d`
-(2026-10-09T20:24:58Z), then #190 as `f87fd5a` (20:26:03Z), squashed at
-`b50f197`. `git diff 1abee1d f87fd5a` and `git diff c4864ac b50f197` have the
-same patch-id (`cb2c7bf2…`). So `b50f197`, which is listed below as a
-follow-up outside #190, is in #190 as it landed. #192 landed before #190, as
-section 2 asks. The rest of section 9's follow-ups are #195 and #193.
-**Tasks:** T009 and T010 of [tasks.md](tasks.md), under
-[#186](https://github.com/opensoft/openRepoTools/issues/186). No task is
-checked complete by this record; Gate B stays open.
-**Code change:** [PR #190](https://github.com/opensoft/openRepoTools/pull/190)
-(`feat/test-roots-for-the-triad`, head `dbc6837`: `c139e88`, `e3a76b5` and
-`dbc6837` on `main` `c4864ac`; `ready` applied 2026-10-09T02:11Z).
-**Follow-ups (not in #190):** branch `feat/test-roots-followups`, `6e63083`
-and `2064390` on `dbc6837`; branch `feat/test-roots-manual-guard`, `b50f197`
-on `dbc6837` (sections 6 and 9).
-**CI patches:** [patches/t010-code-leg-tests-workflow.patch](patches/t010-code-leg-tests-workflow.patch)
-and [patches/t010-assembly-exact-pin-job.patch](patches/t010-assembly-exact-pin-job.patch).
-**Superseded 2026-10-19:** the code-leg workflow patch above is regenerated at the same path, sha256
-`1406ead3…ef6d56`, against the `tests.yml` #228's PR 2 leaves (blob `2cfa173`). The earlier file (`7ee3c6d0…786c3b`,
-base `e27bc64`) stopped applying when #227 rewrote `tests.yml` (`gate-b-status-2026-10-09.md`, checklist lines 32 and 33).
-**Superseded 2026-10-21:** the assembly patch above is regenerated at the same path, sha256 `60245cb9…f0f653`, with `runs-on: ubuntu-24.04` under a three-line comment, because #296 pinned the code leg's Ubuntu runners (`gate-b-status-2026-10-09.md`, checklist line 32).
-T009's assembly-root length caps are a third patch beside them,
-[patches/t009-assembly-caps.patch](patches/t009-assembly-caps.patch) (sha256 `2dd4aac2…b2bbe5`, code leg, after
-`code-0001` and the workflow patch). It sets the caps the re-cut `assembly-0001` needs, 354 and 529.
-**Rehearsed arrangement:** run C of 2026-10-08 (private prep
-`work-20261008/rehearsal`): source `main` `837928a`, assembly split
-`69b8924`, spec leg `593250d`, code leg `73b04d6`, code's nested
-openRepoShape `7f84ca4`. Every clone here was taken *out* of it, with
-`-c protocol.file.allow=always` (git 2.43 refuses `file://` submodule
-transport by default) and an offline `insteadOf` for the nested
-openRepoShape URL; nothing was written in it.
-
-The first scratch of this work, and the October 7 run B arrangement it was
-measured against, were lost when the bench restart cleared `/tmp`. An interim
-reproduction of run B into disposable local remotes (adopter `check` and
-`execute` exit 0, `gh`/`curl` shims never called) gave the same leg commits as
-the October 7 receipt — spec `558a12b`, code `6d52162` — and is superseded by
-run C for everything below.
-
-## 1. What the split breaks — measured before the change
-
-The suite at run C's code leg `73b04d6` (that is, `main` without PR #190), run
-with `tests/run.sh -k 'repo_hygiene or upstream_pin or wip_init or park_resume' -rfEs`
-in three contexts:
-
-| Context | Result | Log SHA256 |
-| --- | --- | --- |
-| M1 — the code leg mounted in the recursive assembly clone (`assembly/code`) | **17 failed**, 350 passed | `e1658c99…eed0e` |
-| M2 — the code leg cloned on its own, dependency initialized | **17 failed**, 350 passed | `442588dd…c8dd5` |
-| M3 — the code leg cloned on its own, dependency **not** initialized | **17 failed**, 141 passed, 209 skipped | `59027b3c…08238` |
-
-The 17 are the same tests, failing the same way, in all three: every one is
-`FileNotFoundError` on a file the split moved out of the code leg. M1 equals
-M2 because the suite never looked above its own root.
-
-| Test (`tests/test_repo_hygiene.py`) | Missing file |
-| --- | --- |
-| `test_the_readme_prints_the_install_line_the_pointer_prints`, `…_also_carries_the_gh_api_form`, `…_carries_the_two_line_onboarding_chain`, `test_no_document_offers_a_windows_powershell_twin`, `test_the_documents_say_what_bare_park_does_now`, `…_what_status_is_and_is_not`, `…_the_sweep_skips_a_root_without_the_overlay`, `…_what_a_bare_lanes_lists`, `test_readme_is_short_enough_to_be_read` | `README.md` |
-| `test_claude_md_points_at_agents_md` | `CLAUDE.md` |
-| `test_agents_md_names_the_pin_rules`, `test_agents_md_is_short_enough_to_be_read`, `test_the_suite_wrapper_takes_one_lock_and_names_it_where_agents_read_it` | `AGENTS.md` |
-| `test_the_directory_precedence_states_every_rung_it_implements`, `test_the_exit_3_documentation_agrees_with_the_die_message_it_describes`, `test_the_manual_offers_the_fork_act_and_not_a_kill` | `docs/README-lanes.md` |
-| `test_the_root_carries_the_line_ending_rule` | `.gitattributes` |
-
-What passed in all three is as informative: `tests/test_upstream_pin.py`
-already read the code leg's own gitlink and pin, so it needed no rewiring to
-stay correct in a leg — only names and a guard (below). The dependency-reading
-estate, `wip init` and pin checks skipped in M3 with today's reason, as they
-do today.
-
-Two more readers are outside those selectors and were found by reading:
-`tests/test_openrepotools_command.py`'s receipt-mode check reads `README.md`,
-and two sections of `tests/test_lane_helpers.sh` (14 assertions) read
-`docs/README-lanes.md` with `cat … 2>/dev/null || :`, so in a leg they would
-have run against an empty string rather than fail on a missing file. PR #190
-covers all of them: the 16 hygiene document tests, the installer's README
-check, the two lane-suite sections, and the `.gitattributes` rule (kept on the
-code root, section 2). The T006 writer's independent count of code-leg tests
-reading those documents was 17 functions, two of them in the lane suite.
-
-## 2. The root rules (PR #190)
-
-| Root | Named by | Otherwise |
-| --- | --- | --- |
-| code | `OPENREPOTOOLS_CODE_ROOT` | the tree the suite was loaded from |
-| assembly | `OPENREPOTOOLS_ASSEMBLY_ROOT` | the nearest directory above the code root that carries `contracts/code-pin.yaml` and `project.yaml`, is a repository's top level, and records the code root as the gitlink its code pin's `submodule_path` names; none on today's layout |
-| spec | `OPENREPOTOOLS_SPEC_ROOT` | the assembly's spec leg (`contracts/spec-pin.yaml`'s `submodule_path`) when it is checked out; none otherwise |
-| dependency | — | `<code root>/upstream/openRepoShape`, initialized or not |
-
-A file is read from the root that owns it: `README.md`, `AGENTS.md` and
-`CLAUDE.md` from the assembly; anything under `docs/`, `openspec/`, `specs/`
-or `ideation/` from the spec root; everything else from the code root.
-Today's single repository carries `openspec/` and `specs/` beside the code, so
-it answers for all three roles, and every reader reads exactly the file it
-read before. The layout is decided by those trees and never by the documents,
-so a README deleted from today's tree is still a failure, not a skip.
-
-**Decision: `.gitattributes` stays the code root's** in every layout,
-against the placement table, because git never applies a superproject's
-attributes inside a submodule. Measured in the composed candidate
-(`proof-check-attr-both.log`):
-- `README.md` and `AGENTS.md` at the assembly have `text: auto`, `eol: lf`.
-- `park` and `tests/run.sh` in `code/` have `text: unspecified`,
-  `eol: unspecified`.
-
-Reading the assembly's copy would pass while the leg's bash files went
-unprotected.
-
-This agrees with T006: its leg patch `code-0001` gives the code leg its own
-`.gitattributes`, and the assembly keeps its copy for its own files.
-
-It disagrees with the placement table in `plan.md` § Target placement on
-`main`, which puts `.gitattributes` at the assembly only. Amending that table
-is a follow-up for the plan's owner (section 9). A leg split exactly as the
-table says is red on `test_the_root_carries_the_line_ending_rule`: see P1, P3
-and P4 below, and the independent review's C5 and C6.
-
-**Length caps** (`dbc6837`, T006):
-- On today's layout, `AGENTS.md` stays at 316 and `README.md` at 486.
-- When an assembly root is named, the caps are 340 and 510. The difference is
-  the 24 lines each that T006's `assembly-0001` adds.
-- *2026-10-19:* at an assembly root the caps are 354 and 529 now. On main they were 347 and 510. The re-cut
-  `assembly-0001` adds the same 24 lines to the 330-line `AGENTS.md` and the 505-line `README.md` that #228's
-  series leaves, and `patches/t009-assembly-caps.patch` sets the two caps to those counts in dated entries. The
-  caps with no assembly root stay 330 and 505.
-
-The dated entries cite `root-guidance-2026-10-08.md`, which is on #192's
-branch: #192 should land with or before #190, or that citation points
-nowhere until it does.
-
-## 3. The composed-versus-standalone contract
-
-* **Standalone** (the default, and the only mode today's layout has): a check
-  whose root is absent skips, naming the root — the courtesy the missing
-  submodule already gets. The no-submodule skip is today's, same condition and
-  reason. On today's layout nothing new skips.
-* **Composed** (`OPENREPOTOOLS_COMPOSED=1`): `tests/conftest.py` refuses the
-  session (`pytest.UsageError`, exit 4, `ERROR: …`) when the assembly or spec
-  root is absent, the dependency lacks `scripts/repo_shape.py` or
-  `templates/workspace-root/README.md`, or the code or spec leg is not at the
-  commit the assembly records, has changes to tracked files, or answers no
-  `git status` (`e3a76b5`, Copilot round 1). The refusal names each problem.
-  `NEEDS_UPSTREAM` becomes a fixture that fails, and a document test that
-  reaches an absent root fails. A variable naming the wrong kind of tree, or a
-  mode other than `0`/`1`, is refused in either mode.
-
-The conftest does not check the pin files' own `commit:` and `tree_sha256`.
-That is the job of the standard's `scripts/validate-pins.py`, which the
-assembly job runs in the step before the suite. Copilot's round-2 finding on
-#190 is exactly this gap.
-
-I reproduced it in a copy of the composed candidate (`proof-stale-pin.log`).
-I moved `contracts/code-pin.yaml`'s `commit:` to `73b04d6` and left the
-gitlink and HEAD at `8ebf4ec`. On that tree:
-- `conftest.ROOTS.refusal()` is `None`.
-- `validate-pins.py` exits 1 with `pin-gitlink-mismatch` and
-  `pin-digest-mismatch`.
-
-In CI, the job stops before the suite runs. A composed run made by hand
-without the validator would accept that leg. The follow-up is in section 9.
-
-## 4. Red at the base, green on the branch
-
-* **Red, round 1.** I copied `tests/test_test_roots.py` as of `c139e88`
-  (SHA256 `be4edff7…6cff`) unchanged into a clone of `origin/main` `c4864ac`
-  and ran `tests/run.sh -k roots`. Result: **18 failed**, every test of the
-  module. The 3 passes are tests in other modules whose names contain
-  `roots`.
-  - The seven behavioural tests failed on what they assert. The nested suite
-    read this checkout's README, manual, gitlink and dependency, whatever the
-    variables named. A composed triad with its spec leg moved off its pin ran
-    instead of exiting 4. `tests/run.sh` passed a relative root through
-    unchanged.
-  - The eleven resolver tests failed because `conftest.resolve_roots` and
-    `ROOTS` do not exist at the base.
-
-  Log `eb7d2bc4…525c`.
-* **Red, round 2.** I copied `dbc6837`'s module (SHA256 `aeb4b742…ea0c`) the
-  same way and ran `-k 'length_caps or missing_manual or status_cannot_be_read'`.
-  Result: **3 failed**, the three tests added since round 1:
-  - a leg whose `git status` cannot be read;
-  - the assembly-root caps ("passed on an assembly file one line over its
-    cap");
-  - the lane suite's missing-manual failure.
-
-  Log `bb87a06e…ad16`. The independent review copied the same module whole
-  into `c4864ac` and got **21 failed**: all 21 of the module's test cases.
-* **Green, today's layout**, with `tests/run.sh -k 'repo_hygiene or upstream_pin or roots or composed'`:
-
-  | Tree | Result | Log |
-  | --- | --- | --- |
-  | `c139e88` | **188 passed** | `b0289afa…cf4` |
-  | the working tree that became `e3a76b5` | **189 passed** | `d6f84d7f…65e3` (its header names the HEAD at its start, `c139e88`) |
-  | `dbc6837`, and its merge onto `main` `63810dd` | **191 passed, 0 skipped** | the independent review's run |
-
-  My local run on `dbc6837` itself was queued for the lock at the
-  account-swap checkpoint and was stopped there. CI is the record.
-* **CI on #190, head `dbc6837`** (run 37869489919, merge `5ad6205` onto
-  `63810dd`):
-
-  | Job | `dbc6837` | `main` `63810dd` |
-  | --- | --- | --- |
-  | `tests` | 1318 passed | 1296 passed |
-  | `tests-no-submodule` | 1105 passed, 213 skipped | 1084 passed, 212 skipped |
-  | `tests-windows` | 176 passed, 1142 skipped | — |
-  | `guard-launch-mode` | 165 passed | — |
-  | `parse-macos`, SonarCloud | green | — |
-
-  The added `tests-no-submodule` skip is the composed positive control, and
-  it skips with today's reason. `tests-macos` runs under `ready` (run
-  37873415160). Earlier heads: `c139e88` had `tests` at 1315 passed, and
-  `e3a76b5` was green.
-
-## 5. The two CI patches (T010)
-
-*Superseded 2026-10-19 (the code-leg patch):* the paragraph below describes the earlier file: six jobs and `-rs`
-on `tests`. #227 removed the macOS and Windows jobs. The regenerated file keeps the four jobs #228's PR 2 leaves
-(`guard-launch-mode`, `tests`, `tests-no-submodule` and `package`) and puts no `-rs` on `tests` or
-`guard-launch-mode`, by lane 1's ruling of 2026-10-19: the leg's skip reasons are read in `tests-no-submodule`.
-The `composed.yml` patch was not regenerated for that, and its header comments still name the removed jobs
-(`gate-b-status-2026-10-09.md`, checklist line 32).
-*Superseded 2026-10-21 (the assembly patch):* the `composed.yml` patch is regenerated for the runner pin alone, sha256 `60245cb9…f0f653`: `runs-on: ubuntu-24.04` under a three-line comment, because #296 pinned the code leg's Ubuntu runners. Its header comments are as they were, and still name the removed jobs.
-
-**Code leg, `.github/workflows/tests.yml`** (against run C's code leg
-`73b04d6`, whose copy is byte-identical to `main`'s). The six jobs and their
-trigger policy are kept exactly — `tests`, `tests-no-submodule`,
-`tests-windows`, `parse-macos` and `guard-launch-mode` on every pull-request
-push, `tests-macos` on the `ready` label, on `main`, nightly and on dispatch.
-The leg is cloned at its own root, so its checkout and submodule contexts were
-already right; the patch names them: workflow `env`
-`OPENREPOTOOLS_CODE_ROOT: ${{ github.workspace }}` and
-`OPENREPOTOOLS_COMPOSED: '0'`, `-rs` on `tests` so the leg's document skips
-are printed, and comments saying that nothing in the leg is composed
-acceptance and that the leg must carry its own `.gitattributes`.
-SonarCloud Code Analysis is a GitHub App check, not a job in this file; the
-code leg needs its own SonarCloud project binding, which is an owner's act.
-
-**Assembly, new `.github/workflows/composed.yml`** (against run C's split
-`69b8924`). Its own file because the root `validate.yml` is a pinned shape
-copy: `contracts/shape-pin.yaml` records it at
-`fb8c0360863ad953af7825f3be01ed27f8cf1269e5cab19dc0d6c5423161b487`, which
-the rehearsed file matches, so a job added there is drift that
-`validate-pins.py` refuses. One Linux job, `exact-pins`: checkout with
-`submodules: recursive` over https (no `file://` allowance anywhere in it),
-a step that fails on any missing leg, pin or dependency file, then
-`scripts/validate-manifest.py` and `scripts/validate-pins.py`, then
-`bash code/tests/run.sh -rs` with `OPENREPOTOOLS_COMPOSED=1`,
-`OPENREPOTOOLS_ASSEMBLY_ROOT=$GITHUB_WORKSPACE` and
-`OPENREPOTOOLS_SPEC_ROOT=$GITHUB_WORKSPACE/spec`. The macOS, Windows and
-no-submodule policies stay in the code leg's workflow.
-
-**Neither patch can run on GitHub until the legs exist** (Gate C). Both
-`git apply --check` cleanly against run C, and both were proven locally as
-below.
-
-## 6. Local proofs
-
-The composed candidate is a clone of run C's assembly in which PR #190's
-commit was applied onto the code leg (`8ebf4ec`, on `73b04d6`), pushed to a
-private copy of the code leg's bare remote, and pinned with the standard's own
-`bump-leg.py --leg code --to 8ebf4ec… --local-remote-dir …` (exit 0; commit
-`6ccdaf8`, `contracts/code-pin.yaml` digest recomputed as `577cdcf1…d850`);
-the composed workflow is commit `386be81` on top.
-
-These proofs ran on `c139e88`'s content (`8ebf4ec`). They were not repeated
-for `e3a76b5` or `dbc6837`. The independent review's fake triad exercised
-`dbc6837` both composed and standalone (its C1–C6).
-
-| Check (in the candidate, as the job runs it) | Exit | Log SHA256 |
-| --- | ---: | --- |
-| `python3 scripts/validate-manifest.py` | 0 | `0caaed6c…83a4` |
-| `python3 scripts/validate-pins.py` (both legs at their gitlinks, both digests recompute, 11 shape copies match) | 0 | `fb085bee…cf4b` |
-| `make validate` / `make pins` | 0 / 0 | `85c8fd9f…bbf0` / `440c5bf4…74e4` |
-| the job's context step, all three legs present | 0 | `c4e4cdf2…ac22` |
-| the job's context step, spec leg not checked out | **1** (`::error::the spec leg is not checked out at spec/`) | `fcf47871…444a` |
-| P2: `code/tests/run.sh -k upstream_pin`, composed, spec leg not checked out | **4** — `ERROR: openRepoTools composed run (OPENREPOTOOLS_COMPOSED=1) refused … OPENREPOTOOLS_SPEC_ROOT=… is not a spec root` | `38889cab…1059` |
-| P1: `code/tests/run.sh -k 'repo_hygiene or upstream_pin or roots or composed or openrepotools_command or lane_helpers_suite'`, composed, as the job runs it | 1: **285 passed, 2 failed, 0 skipped** | `f611c198…fe34` |
-| P3: the code leg standalone with the patched workflow's context (`OPENREPOTOOLS_CODE_ROOT`=the leg, `COMPOSED=0`), same selector | 1: **268 passed, 2 failed, 17 skipped** | `0f5e8c21…6144` |
-| P4: the code leg standalone without its dependency, `-k 'repo_hygiene or upstream_pin or roots'` | 1: **159 passed, 1 failed, 28 skipped** | `6cc26bb1…55d3` |
-
-The failures, recorded rather than deleted:
-
-* **`test_the_root_carries_the_line_ending_rule`, in P1, P3 and P4** — the
-  code leg has no `.gitattributes`. A finding for T006: the leg must carry
-  `* text=auto eol=lf` itself (section 2). Until it does, the leg's CI is red
-  on this one test, which is the point of keeping it.
-* **Two assertions of `tests/test_lane_helpers.sh`, in P1 and P3** — "…with
-  clause (c)'s directory and window in the tail" and "the row's stamp states
-  clause (c)'s two facts for a person, in its TAIL". Both expect the lane's
-  directory in a register row that is cut at 240 characters, and under
-  `tests/run.sh` that directory sits beneath the run root
-  (`~/.local/state/openRepoTools/tmp/<UTC>-<pid>/tmp/tmp.*/`, then the
-  fixture home's `projects/…`),
-  long enough to fall past the cut. CI runs the same suite with a short
-  `TMPDIR` and passed it (1315 passed at `c139e88`, 1318 at `dbc6837`). These sections are untouched
-  by PR #190.
-  - The length interaction is **#180**. That is inferred from the expected and
-    actual rows, not bisected.
-  - This record first sent it to the run-root work of #162/#184. It was
-    corrected on 2026-10-11, after lane 3's 6089801221, finding 13 (i).
-  - `composed.yml` runs the suite through `code/tests/run.sh` (assembly patch,
-    line 128, which was 125 before the runner pin of 2026-10-21), so `exact-pins` inherits #180. It would be red on these two
-    assertions until #180 is fixed (section 8).
-* **The lane suite ABORTED in P3**, after those two FAILs, at
-  `test_lane_helpers.sh: line 6595: ln_doc: unbound variable`. This is a
-  defect in PR #190's own guard. `ln_doc` is bound only inside the
-  `if [ -n "$LANE_MANUAL" ]` section, the `--retire` section uses it 350
-  lines later outside any guard, and the suite runs under `set -u`.
-  - This record first attributed P3's lane-suite failure to the stamp
-    assertions alone. Lane openRepoTools-3's review of #190 found the abort,
-    and it is in P3's own log.
-  - At `dbc6837` the lines are 6601–6602.
-  - The fix is `feat/test-roots-manual-guard` @ `b50f197`, one commit on
-    `dbc6837`. It guards the two lines with the same named skip, and adds a
-    text test that every use of the manual's text sits inside such a guard.
-  - With the section run alone under `set -u` and an empty manual
-    (`proof-retire-block.log`): `dbc6837` aborts, exit 1; `b50f197` gives 4
-    passed and 1 skipped, exit 0.
-  - Today's layout always takes the guard.
-
-Every skip in P3 and P4 names its root. P3's 17 are `README.md` ten times
-(nine hygiene tests and the installer's check), `AGENTS.md` three times,
-`CLAUDE.md` once and `docs/README-lanes.md` three times; inside the lane suite
-its two manual sections printed `skip … no spec root in this run` as well.
-P4's 28 are the hygiene module's 16 document skips plus today's 12 dependency
-skips (`the pinned openRepoShape is not checked out; run git submodule update --init upstream/openRepoShape`).
-P1 skipped nothing.
-
-Both workflow files parse and hold their structure (`check_workflows.py`:
-the leg's six jobs, triggers, `ready` gate, per-job submodule contexts and
-`env`; the composed job's one Linux job, recursive checkout, step order and
-`env`). `actionlint` passed both on 2026-10-07, on the same content less one
-comment sentence in `composed.yml`; it was not installed after the bench
-restart, so it was not rerun.
-
-## 7. How the local runs were made
-
-The workstation-wide `pgrep` census in `tests/run.sh` did not reach zero for
-some runs (the xFactory worktrees keep 3–20 `python3 -m pytest` alive), so a
-run that had not started within 5 minutes was replaced, by the coordinator's
-interim rule, with run.sh's own pytest line under `flock` on the same lock
-file (M1 was; each log says which). That census is now a comment on
-[#184](https://github.com/opensoft/openRepoTools/issues/184#issuecomment-6069746447).
-On this profile `~/bin/python3` resolves to a virtual environment without
-pytest, so every local run had `/usr/bin` first on `PATH`. CI is the record.
-
-## 8. What remains for T015
-
-* Run both workflows on GitHub at the real exact pins once the legs exist,
-  including `tests-macos` and `tests-windows` in the real code leg.
-* T006: the code leg's own `.gitattributes`, before the leg's `tests` can be
-  green.
-* A SonarCloud binding for the code leg, and a leg credential for the
-  composed job if the legs are ever private (`project.yaml` says public).
-* Re-measure against the frozen source chosen at Gate C; the run C commits
-  here are rehearsal identities, not the cutover's.
-* The follow-ups of section 9. Items 1, 4, 5 and 6 should land before the
-  real split. Their state on 2026-10-11:
-  - item 6 (1), `b50f197`, is in #190;
-  - items 1–4, 6 (2) and (3), and 7 are #195;
-  - item 5 is the plan owner's.
-* From lane 3's 6089801221 (section 10). The patches here stay byte-identical
-  as rehearsed; each item below changes them at T014/T015, not in this
-  record. *(Superseded 2026-10-19 for the code-leg workflow patch, which is
-  regenerated: the note under the header says why.)*
-  - **#180 before `exact-pins` is relied on.** Fix #180, or give the job
-    `run.sh`'s pytest line with a short `TMPDIR` (finding 13 (i)).
-  - **Make "never skips" a guarantee.** About forty other conditional skips
-    would still pass with exit 0, so fail `exact-pins` on any skip, for
-    example on the junit skipped count (finding 13 (ii)).
-  - **The landing tooling reads `tests-macos` by name, and the assembly has
-    no such check** (finding 12).
-  - **Regenerate both patches with a real author.** They carry the fixture
-    identity `openRepoTools CI <ci@openrepotools.invalid>` (finding 13 (iv)).
-
-## 9. Reviews and dated follow-ups
-
-* **Copilot round 1** (on `c139e88`) raised two findings. Both are fixed in
-  `e3a76b5`, and both threads are resolved:
-  - a `git status` that fails is a refusal;
-  - the fixture code legs keep `.gitattributes`.
-* **Independent adversarial review** (lane 1's reviewer, read-only): **LAND**
-  on `dbc6837`
-  ([review](https://github.com/opensoft/openRepoTools/pull/190#pullrequestreview-5464938427)).
-  Its own fake triad agreed with this record:
-  - a split leg gives 17 = 16 named skips plus `.gitattributes`;
-  - every subprocess of a composed run stayed inside its fixture;
-  - the caps reproduced against T006's `assembly-0001`. *(Superseded 2026-10-19: against the earlier file;
-    the 2026-10-19 bullet under "Length caps" in section 2 gives today's caps.)*
-* **Lane openRepoTools-3, reviewer of record:** **LAND** on `dbc6837`
-  (review 5464931249). It names one defect that is best fixed before the
-  squash, and two later items:
-  - (1) the `ln_doc` abort of section 6 (its finding 10), with the fix ready;
-  - (2) a **Gate C item** (its finding 11): the paired layout
-    `<assembly>/worktrees/<feature>/code` finds no assembly (measured on run
-    C), so in a feature worktree every document test would skip;
-  - (3) a **non-blocking hazard**: `OPENREPOTOOLS_CODE_ROOT` and
-    `OPENREPOTOOLS_ASSEMBLY_ROOT` redirect the suite silently, because the
-    report header is hidden by `-q`.
-
-  Corrected 2026-10-11 (lane 3's 5481348731, finding 5). This record first
-  said all three were to be fixed before the squash, following lane 3's
-  summary on #186 (6072817992). The review itself dates them as above.
-* **Copilot round 2** (on `dbc6837`) raised two findings:
-  - (High) the pin `commit:` gap of section 3;
-  - (Medium, "previously missed") `_carries` accepts a directory where a
-    marker file belongs.
-
-  I answered on the thread. Nothing was pushed, because the macOS gate runs
-  on `dbc6837`.
-
-These follow-ups are dated 2026-10-09 and recorded on #186. None of them was
-in #190 at `dbc6837`. Item 6 (1) landed in it (see **Landed** at the top).
-
-1. **Review finding 11.** Three code-only assertions came after the first
-   document read (`test_repo_hygiene.py:994`, `:1052` and `:1264` at
-   `dbc6837`), so a standalone code leg skipped them along with the
-   documents.
-   - `feat/test-roots-followups` `6e63083` asserts every mixed test's
-     command half first.
-   - `2064390` proves it with a nested run against a fixture leg whose
-     commands lost those lines.
-2. **Review finding 13.** The lane suite's missing-manual failure is checked
-   only by its text. Its `bad` branch did run locally
-   (`proof-manual-block.log`): the block, extracted unchanged with stub
-   helpers, printed `FAIL the lane manual is where the run's roots put it`
-   for `/nonexistent/README-lanes.md` and skipped on an empty value. A
-   behaviour test that runs the block itself is still to do.
-3. **Review finding 14.** The four variables are not in `AGENTS.md`.
-   `6e63083` adds seven lines to "Testing your changes" and moves the cap
-   from 316 to 323 (340 to 347 at an assembly root), in a dated entry.
-4. **Copilot round 2.**
-   - The conftest should refuse a pin whose `commit:` differs from the
-     gitlink, before it compares HEAD, with its own red-at-base test.
-   - Root markers should be regular files.
-5. **Placement table.** The plan's owner amends `plan.md`'s placement table
-   to say the code leg keeps its own `.gitattributes` (section 2).
-6. **Lane 3's review.**
-   - (1) `feat/test-roots-manual-guard` `b50f197`, unless the coordinator
-     takes it into #190 before the squash. He did: it was fast-forwarded at
-     2026-10-09T13:59Z and landed in `f87fd5a`.
-   - (2) Assembly discovery for the paired worktree layout, before Gate C.
-   - (3) Say which roots a run used where `-q` cannot hide it.
-7. **Review nits.**
-   - `Roots.owner_of` gives `LICENSE` and `.gitignore` to the code root.
-     This is latent.
-   - `tests/run.sh`'s `abs_root` turns a quoted `~/x` into `$PWD/~/x`.
-   - The `GIT_ENV` comment in `tests/test_test_roots.py` says "file
-     transport allowed".
-
-## 10. Lane 3's review of the T010 patches (6089801221), dated 2026-10-11
-
-Lane 3's review of #190's follow-ups and of these patches came after this
-record (2026-10-09T21:47Z, on `d28e2cc`). Its verdict on this branch was
-"fit for evidence-3", with one thing to settle before the composed job is
-relied on (finding 13 (i)). Each finding's disposition is below. "#195"
-means that PR as it stands on 2026-10-11: open at `e378871`, with lane 3's
-LAND on `fb77bed` (5481360555), and not landed.
-
-| # | Finding | Disposition |
-| --- | --- | --- |
-| 1–3 | `b50f197` covers every manual read, changes no outcome on today's layout, and does what it says | Confirmed. It landed in #190 (see **Landed** at the top). |
-| 4 | The text test finds the guard by exact line match: a false red, never a false green | Fixed in #195 (`43ee05b`): the test now follows the `if`/`fi` nesting. |
-| 5, 6 | How the follow-ups sit on main; no outcome changes | Confirmed. The follow-ups are #195. |
-| 7 (i) | The AGENTS.md paragraph describes rather than gives a rule | Open. #195 does not change it, and it is not yet filed. |
-| 7 (ii) | The 340 → 347 assembly cap rested on a false premise | Fixed in #195 (`c7b27bc`): the paragraph moved below `assembly-0001`'s hunks, so the patch applies and gives 347. *Superseded 2026-10-19: the earlier `assembly-0001` no longer applies after #227, #237 and #228, and the re-cut gives 354 (`patches/t009-assembly-caps.patch`).* |
-| 7 (iii) | The paragraph names only `docs/` for the spec leg | Open: #193 item 20. |
-| 8 | The nested proof covers 3 of 5 reordered tests, and asserts only the outcome | Open. The missing two are #193 item 20. That the proof checks only the outcome is not yet filed. |
-| 9 | The `--help` half of the receipt test; the refusal wording; items 3–7 and 15 | The `--help` half is #193 item 20. The rest is #195. |
-| 10 | Run C, standalone and composed, with the follow-ups' tests | Recorded. The `.gitattributes` failure is T006's `code-0001` (section 2). |
-| 11 | The patches apply; the branch as pushed conflicts with main | Confirmed. Evidence-3 (#196) carries this branch's three files onto main. |
-| 12 | `tests.yml` keeps everything the gate reads; the assembly has no `tests-macos` check | Confirmed. The missing check is in section 8. |
-| 13 | Copilot round 2's High is closed in CI only, by step order | Closed in the suite too by #195 (`e79bd82`): a pin whose `commit:` differs from the gitlink is refused. |
-| 13 (i) | #180 lands in `exact-pins` through `run.sh` | Open. Section 6 is corrected and section 8 lists it. The patch is unchanged here. |
-| 13 (ii) | "Fails, never skips" holds only for roots and the dependency | Open. Section 8: fail the job on any skip. |
-| 13 (iii), 14 | The refusal misnames a named root | Fixed in #195 (`0c89b9e`, #193 item 15). |
-| 13 (iv) | The patches carry the fixture author | Open. Section 8: regenerate at T014. |
-| 15 | The composed refusal contract holds | Confirmed. |
-| 16 | Eight local shell FAILs attributed to the environment | Recorded. CI is the record. |
-
-## Log SHA256s
-
-The logs stay in the private prep area (`work-20261008/ort-test-roots/logs/`).
-
-| Log | SHA256 |
-| --- | --- |
-| M1 `m1-assembly-code.log` | `e1658c99b088bb2b571369431942a0170a4c78b14da9f5bd88c959ddc89eed0e` |
-| M2 `m2-code-standalone.log` | `442588dd56997ec00f5a2773dfe3e6102bf7b2cfd137b755057d62f2991c8dd5` |
-| M3 `m3-code-nosub.log` | `59027b3ceed4f52e1e6b2d0be926b0b7f3a2c7abfda2846b4fc9656b35208238` |
-| red at base `red-at-base.log` | `eb7d2bc460f5b4d474a71ccfb2a19ecca0798e4fc778685e620311d37384525c` |
-| green on branch `green-branch.log` | `b0289afab41217eb3c1e8ece140233b8a458492b37042727c668066a0f5a8cf4` |
-| red at base, round 2 `red-at-base-r2.log` | `bb87a06e0e09785aae078c0cea5a89be40bef0dc2c90328b3a2e6025a489ad16` |
-| green, 189 `green-branch-r1.log` | `d6f84d7f05d13c1d42d702c7c5c7f846c39b876392e1ee9d94ab6658b25665e3` |
-| green, 191 on the follow-ups tree `6e63083` `green-branch-r3.log` | `78deeb7e2a36a1f10322a15b5bad6def7d2cc5242e503211bd468bc46ce8fb01` |
-| `proof-check-attr-both.log` | `fb0561553b4d3b38554507f48267985eb128b0ff9f39d3665171b90ce9bdc6c3` |
-| `proof-stale-pin.log` | `6b2223d39d58372f73b42f77f7a0d314c431807783f8cc68f4b8e1d8835da68c` |
-| `proof-retire-block.log` | `c593520e6659febe5a7952df174feb4c03a8939a593369d010e3f9d2aa4e0393` |
-| `proof-manual-block.log` | `b8b8217c07ecc82bf95295200f5b2c1a1202667ef7ca66a64feec7206c8f21d9` |
-| P1 `p1-composed.log` | `f611c1981520c4d479556d4b5ec9094845166a69772779dee7539113f473fe34` |
-| P2 `p2-composed-refuses-without-spec.log` | `38889cab1e4a3c842bfddc9687e30b21df9c183b238df0676088dd1e8e981059` |
-| P3 `p3-leg-standalone.log` | `0f5e8c2163fbe1457bb692eba3bdbc4b67e03020cf7ec1ba0ee0fc7e38806144` |
-| P4 `p4-leg-no-submodule.log` | `6cc26bb153da368df80752f0b935ea660c965bb06b135c090f0835d0dbb055d3` |
-| `proof-validate-manifest.log` | `0caaed6c40864ebce25366b7599b3f56149f8698d02d2ba7a42dafb53bc283a4` |
-| `proof-validate-pins.log` | `fb085bee84b9f76fc814a78ca8e5ed17d1d9fd5c0030726633fb92fd7b8fcf4b` |
-| `proof-make-validate.log` | `85c8fd9f834556cc7f8c42ac9625108b4cd33c90cd7db2bf6fbe49bbb39bbbf0` |
-| `proof-make-pins.log` | `440c5bf4b7250418076bce4fb0be5a21c21def76c5fe9990808fa6b1cbc874e4` |
-| `proof-context-step.log` | `c4e4cdf2ed3d39dee6775d9a01a27ab76869e76feefc561399aa686227ffac22` |
-| `proof-context-step-nospec.log` | `fcf47871f23e005da6f06ace2953acdb81a2117b4bc2d0009d80986ca4e7444a` |
-| `bump.log` | `aee4d464a7ef847c92d0acc00c28d539ae24e9ea54426a1747c0ffec8220fc80` |
-
-This record authorizes no conversion, repository creation, merge or
-default-branch move.
diff --git a/specs/004-migrate-to-triad/verification.md b/specs/004-migrate-to-triad/verification.md
deleted file mode 100644
index 2812273b..00000000
--- a/specs/004-migrate-to-triad/verification.md
+++ /dev/null
@@ -1,176 +0,0 @@
-# Migration planning verification — October 4, 2026
-
-## Preparation authorized while #97/#121 are active
-
-[preparation.md](preparation.md) records a verified 18-ref bundle restore,
-pinned dependency restore, six worktree file/config captures and verified
-installed-file/settings/receipt copies in host and bench contexts. All six
-snapshots were also restored into independent Git clones with matching index
-entries, captured file bytes and worktree status. Active writers remain
-unfrozen; installer/live rollback, retired receipts and final preservation
-are pending. Gate A is not complete.
-
-The unchanged pinned standard passed `check` against an isolated source clone,
-then local-only execution returned 2 while adding the spec submodule because
-the original `.gitmodules` had been staged for deletion. No assembly adoption
-commit or final verification was reached. Independent mode/object accounting
-passed for 18 spec, 40 code and six unchanged root index entries. Local nested
-dependency initialization and the standard's recomputed dependency digest
-check passed. Canonical pin tests stayed in serialization
-wait and were stopped before pytest ran; no runtime test pass is claimed.
-The [upstream reproduction](adopter-blocker.md) is reviewable, and the
-[installer compatibility design](installer-design.md) identifies the required
-consumers and pending acceptance scenarios. No pinned-standard changes,
-external writes, user-tool installs, real repository creation or lane moves occurred.
-Gate B remains open. Both PR landings explicitly precede refreshed real
-conversion, which still needs Gates A/B and Gate C approval.
-
-Final pinned mapping check, OpenSpec strict validation and supplemental
-document-link/portable-path/inventory/single-task-list checks passed.
-All 19 execution tasks remain open; provisional evidence does not replace
-their complete acceptance criteria.
-
-The following refresh sections are historical observations.
-
-## Updated migration protocol refresh
-
-Read the installed shared workflow's **Triad Feature Amendments**, including
-**Single repository to triad migration**, the revised bootstrap status and
-workBenches source workflow/templates/governance. [protocol-review.md](protocol-review.md)
-records their identities and snapshot digests, including the uncommitted draft
-state of the workBenches source. Manual adoption does not establish delivered
-schema/routing/distribution/placement automation.
-
-The revised proposal, design, capability requirements and Speckit plan/tasks
-now distinguish canonical spec content from genuine bounded code amendments,
-retain original approved provenance with verified filtered correspondence,
-require explicit root selection and working-spec updates, and require one
-final tested reconciliation before completed assembly advancement. No existing
-tracked bounded amendment paths were observed in main or retained feature heads;
-none were manufactured. All 19 implementation tasks remain open, covering 16
-migration requirements.
-
-Source main advanced to `daed20957f2dd2f22cca24053bb5bc8636ff6b3f` with #134
-merged at `2026-10-04T16:52:38Z`; read-only GitHub main matched. The two open
-PRs are #121 and #97. Six worktrees/local branches remain, including the clean
-merged #134 checkout and clean feature 001 at `3c26041`. Main extraction now
-includes the resolver/checker installer changes, tests and manual.
-The final snapshot check detected concurrent #121 staged/unstaged/untracked
-work, including feature 005 and its full legacy authority decision, plus an
-advanced #97 recovery head. Inventory/dispositions were refreshed to preserve
-those active changes, separate ownership and the existing #121 merge hold;
-the earlier all-clean observation is historical, not current readiness.
-
-The pinned standard regenerated the main-only plan: 64 source paths, 18 spec /
-40 code / six root, no unresolved path or drop, 80 commits and 28 follow-ups.
-Standard `check`, OpenSpec strict validation, supplemental path/link/inventory/
-requirement checks and `git diff --check` passed. Planning checks do not establish
-upstream exception qualification, local rehearsal or runtime acceptance.
-
-Estate `status --fetch` again refused the manifest-free repository and fetched
-nothing; local Git and read-only GitHub supplied current observations. This
-refresh created no external issue, moved no lane, rewrote no workspace pointer,
-changed no pinned standard, distributed no protocol and performed no adoption.
-
-The previous refresh sections below are historical evidence only.
-
-## Earlier October 4 repository refresh — historical
-
-Read-only GitHub main still matches local `82ecebee13edaa915b68550170faffdf761754d5`.
-The pinned standard remains `39d5c986fcfac1a160474bfe91c5f1c37fccc72c`.
-The current open PRs are #134, #121 and #97; #134 is now non-draft at
-`11037f01a45a72fa3fc9a8a2b0e24a64cbf1ed12` with a clean sibling worktree.
-There are six registered worktrees and six local branches. Main and every
-feature checkout were clean before this refresh's planning edits; the inventory
-records its actual observation time and planning edits present when sampled.
-
-Feature 001 is committed and clean at `3c26041a4444a10bc240cb64a168ece4d9edf6c5`.
-The previous dirty broker/task-recovery edits, restored automatic-rollover and
-lane-set workspace packets, and October 4 local launcher contract are retained
-in its branch. The migration plan now carries those documents and their owning
-implementation/runtime gates. It makes no launcher deployment or swap-readiness
-claim. The old dirty-content snapshot and cleanup counts below are historical.
-
-The main-only mapping was regenerated and checked: 58 paths, 17 spec / 35 code /
-six root, no unresolved path or drop, 79 commits and 21 follow-ups. OpenSpec
-strict validation, document/inventory checks and `git diff --check` passed.
-All 19 execution tasks remain open; no adoption rehearsal or runtime suite
-was run for this documentation refresh.
-
-`status --fetch openRepoTools` again refused with no estate named openRepoTools;
-the manifest is still absent and no fetch occurred. Git and read-only GitHub
-REST supplied the snapshot instead. No `resume`, manual fetch, workspace-pointer
-rewrite, PR merge/closure, lane move or migration was performed.
-
-## October 3 cleanup refresh — historical
-
-The refreshed source main is `82ecebee13edaa915b68550170faffdf761754d5`,
-including merged PRs #61 and #146. Read-only GitHub REST main matched local
-main; the live open list is #134, #121 and #97. The initial GraphQL list
-returned HTTP 503; the REST list succeeded. This refresh performed no merge/closure.
-
-Cleanup initially left five registered worktrees and six local branches. The preserved
-migration draft branch `004-migrate-to-triad` was retained separately at
-`52ce64e` without a checkout; reopening it made six worktrees. During validation,
-#146 merged and concurrent cleanup removed its checkout and local branch,
-leaving five worktrees (including planning) and five local branches. The
-refreshed inventory includes those transitions, current
-heads/dirty counts, remote-only refs and retired-worktree history. Removed
-checkouts are excluded from active replay and are not recreated by the plan.
-Feature 001 at `c0b571c` remains dirty with current broker/task-recovery work.
-
-The mapping was regenerated by the pinned standard, retaining reasoned
-resolutions, rather than editing its source commit. The baseline remains 58
-tracked paths: 17 spec, 35 code, six root, zero dropped, with 79 commits and
-21 follow-ups. The first standard `check` detected main moving from `14641fd`
-to `82ecebe`; the plan was regenerated again. Standard `check`, OpenSpec strict
-validation and supplemental document/inventory checks passed; no runtime suite or
-local adoption rehearsal is claimed. All 19 execution tasks remain open.
-
-`status --fetch openRepoTools` refused: no estate named openRepoTools under
-the projects directory (there is no estate manifest yet). It fetched nothing.
-The refresh used local Git plus read-only GitHub main/PR observations and did
-not run `resume`, change workspace pointers or manually fetch to quiet it.
-
-The original verification and snapshot below are historical evidence only.
-
-## Passing planning checks
-
-- Pinned openRepoShape `adopt-project.py check` passed for the preliminary
-  source main `c1bac0dfc99a62583cb62eafc93a192911b2ff22` and resolved mapping:
-  58 source paths, 17 spec / 35 code / six root, no unresolved path or drop.
-  Naming recognizes the existing root as neutral-product/assembly and the
-  proposed repositories as spec/code legs. The plan lists 21 follow-ups.
-- `openspec validate migrate-to-triad --strict` passed in `py-bench`.
-  `openspec status` reports all four governance planning artifacts complete.
-- `git diff --check` passed. Supplemental checks cover newly created planning
-  files, local Markdown targets, host-absolute path exclusion, valid inventory
-  JSON, unique task IDs and requirement coverage.
-- All 19 executable migration tasks remain open. The main checkout is clean;
-  planning artifacts live only in feature `004-migrate-to-triad`.
-
-## Snapshot and interpretation
-
-The original inventory snapshot recorded 12 registered worktrees and open PRs
-#134, #121, #97 and #61. Feature 001 had dirty/untracked content, including work from this
-conversation and concurrent planning. Preserve its complete current contents
-at the execution gate; the public snapshot does not contain a backup.
-
-The generated adoption plan was resolved with written placement reasons and
-normalized to relative source paths. It is a preliminary main-only mapping,
-not a mapping of all feature work. Regenerate after planning/prerequisite
-landings and before frozen-baseline approval. Custom planning/authorization
-fields document scope; the standard does not enforce them as execution guards.
-
-## Not performed or claimed
-
-No local history extraction/adoption rehearsal, runtime regression suite,
-installer changes, real repository creation, software installation, root/leg
-PR creation or merge, lane move, WIP pointer rewrite or migration occurred.
-`git-filter-repo` was absent in the inspected bench. Existing nested-submodule
-handling and actual composed tests remain required Gate B/D evidence.
-
-Planning validity does not establish execution readiness or approve proposed
-public visibility. The standard's procedure requires the reviewed plan and
-follow-ups to receive an explicit yes before real adoption. Original work,
-experimental swap gates and existing PR review decisions remain preserved.
diff --git a/specs/005-supervised-legacy-ctx/analysis.md b/specs/005-supervised-legacy-ctx/analysis.md
deleted file mode 100644
index d446a62e..00000000
--- a/specs/005-supervised-legacy-ctx/analysis.md
+++ /dev/null
@@ -1,67 +0,0 @@
-# Consistency analysis
-
-The approved legacy authority decision maps to FR-001 and T005. OpenSpec records
-governance; this directory owns implementation tasks. Earlier shared-lifecycle
-assumptions are explicitly superseded rather than retained as execution tasks.
-
-The implementation has one restart backend. The `/ctx` command and handoff skill
-delegate to it before canonical preservation writes. The managed ownership reader
-is read-only; legacy operation counters never import PR #97 lifecycle counters.
-
-Preparation (T006), attempt ownership (T007), launch facts (T008), stamp recovery
-(T009), asynchronous readiness (T010) and interruption handling (T011) each have
-entrypoint fault cases in `tests/test_supervised_restart_regressions.py`. The
-existing shell suite retains integration coverage and CI is the full suite of
-record. T013 and T016 passed on the pre-reconciliation head; T018 records the
-fresh integration checks. Expert follow-up review T014 is complete; T017 remains
-pending landing; the user released the merge hold on 2026-10-05.
-
-The final nine-role expert panel verified strict schema preservation, private
-intent temporary files, file-alias identity, complete pre-respawn launch checks,
-rename fencing and cooperative observer cleanup. Focused regression fixtures
-cover those findings and the observer fork/PID-publication signal boundary.
-Shell parsing, error-level ShellCheck and strict OpenSpec validation pass. The
-pre-reconciliation serialized restart run and per-push CI passed. Fresh
-reconciliation validation remains a separate gate, not an assumed pass.
-
-Known boundary: managed enrollment and legacy runtime integration are feature
-001's responsibility. This change refuses existing or unknown managed ownership
-and provides no installation, automatic rollover or real-session canary.
-
-## Reconciliation with landed PR #97
-
-Main b1015f4 supplies the diagnostic lifecycle, worktree inventory and published
-managed projection. Restart helpers use their own namespace so the diagnostic
-functions cannot replace strict restart parsing or private publication. Restart
-readiness and counters remain owned only by restart-intent.yaml. The restart
-entrypoints and private writers refuse the published or locally contradictory
-managed projection. Rename retains completed history under the old name while
-moving only diagnostic files to the new name; unfinished recovery still refuses.
-
-The previous head 69838c5 passed 111 focused cases, 3,537 shell assertions and
-all per-push CI jobs (985 full-suite cases). T018 records fresh integration
-validation; the existing hold and T017 remain in effect. Deferred issues #158
-and #159 retain their scope. The nine-role integration review identified the
-helper collision and completed-history rename boundary, which are addressed
-with focused regression coverage in this reconciliation.
-
-Reconciliation checks passed 26 focused cases (980 deselected), shell parsing,
-error-level ShellCheck, Python compilation and strict OpenSpec validation for
-both changes. The five incoming generic helper bodies match main exactly,
-and no duplicate shell function names remain. The integration panel has no
-remaining verified blockers; case-only rename is already refused before any
-mutation and has explicit regression coverage. The broader serialized local
-suite and fresh-head CI results are recorded in the PR review record when they
-complete, rather than treated as passed before the reconciliation is pushed.
-
-
-## Reconciliation with landed PR #164
-
-Main fea9a29 arrived after fd09e2d passed all landing checks. Its derived index
-remains read-only behind explicitly typed flags, and its detached post-push
-nudge does not decide restart ownership or launch readiness. The production
-changes merge automatically. The sole conflict appends the index act tests and
-supervised restart tests at the same location; retain both sections with the
-index section first. T019–T021 passed at fd09e2d (1047 Linux and macOS tests;
-839 no-submodule passes with 208 expected skips). T022 records the fresh combined
-head's review and CI gate; predecessor results do not substitute for it.
diff --git a/specs/005-supervised-legacy-ctx/plan.md b/specs/005-supervised-legacy-ctx/plan.md
deleted file mode 100644
index 4cc2cc9b..00000000
--- a/specs/005-supervised-legacy-ctx/plan.md
+++ /dev/null
@@ -1,69 +0,0 @@
-# Implementation plan
-
-Single-repository feature on the existing PR #121 worktree and branch.
-OpenSpec governance: `add-supervised-context-restart`.
-
-Merge current main without replacing entire conflicted files. Keep its
-Amendments 18/19/16 behavior, linear lookup optimizations and Claude resolver.
-
-Use the existing locked `set-restart-intent` writer for legacy reservation and
-attempt CAS. Add a preparing state before canonical preservation writes.
-The pending state is the durable pre-kill commit point. A supervisor claims
-one attempt, exports its identity through the in-pane launcher, and observes
-that attempt's prepared UUID. Managed checks are affirmative reads, never
-writers of enrollment or JSON state.
-
-Prepare the expected post-stamp digest durably before publishing a resume
-stamp. Both the prior and proven post-stamp digests are valid during that
-bounded publication transaction; unrelated bytes remain invalid. Keep the
-prompt tied to the validated canonical handoff and capture it before exec.
-
-The supervisor never marks a live or unknown child retryable after a signal.
-Readiness enumerates process witnesses rather than counting the preferred
-holder projection. No lifecycle snapshot or managed generation is advanced.
-
-Validation covers competing reservations, read/write faults, stale attempts,
-late UUID publication, duplicate holders, stamp publication interruption,
-agent/profile/path/pane conflicts, completed-intent ordinary resume and
-supervisor termination before session registration. Use sandboxed local bare
-repositories and fake launchers; no real sessions or GitHub test repositories.
-
-Preparation reservations use `preservation-only`, which is not a launch mode.
-Fenced cleanup may mark that preparation failed without authorizing a child from
-previous preservation facts. An operator can inspect and reconcile an abandoned
-preparing reservation, then request a new `/ctx`.
-
-Each starting attempt consumes `new_transcript: none` exactly once. Later writes
-expect the reserved UUID as well as operation, generation and attempt. Stamp
-publication resolves a final-component symlink and atomically replaces its target
-from a same-directory temporary file. The helper holds the same writer mutex
-through ownership and prior-digest checks and replacement. All restart preservation and resume-stamp
-publishers use this path; manual edits must follow the staging/publication skill
-contract. Existing records with missing, duplicate or invalid fields refuse
-transitions rather than being silently repaired.
-
-Ordinary first launches use the resolved checkout as a control-root hint only
-after all established root rungs fail. Explicit configuration, recorded
-directories and PROJECTS_ROOT retain precedence. Each claimed attempt repeats the
-all-holder absence check before starting, including interactive retries.
-
-Require a known current pane before the supervisor claim. Forward the complete
-launcher host/OS/container binding through respawn. Control-root reads inspect
-existing directory ancestors so an unusable root cannot answer absence. Child
-readiness rejects zombie process state and keeps unknown process state unready.
-
-Final review hardening validates the complete pending launch before pane respawn,
-uses filesystem identity for equivalent handoff aliases, and refuses control
-characters rather than normalizing launch paths. The shared schema parser rejects
-unknown and malformed content on reads, existing-record transitions and generated
-record publication. Intent writes use private same-directory temporary files.
-Rename takes the existing mutex and refuses unfinished/failed restart records.
-Observers stop through a private marker and are reaped before marker removal,
-without signaling a numeric PID that may already have been recycled.
-
-Legacy lane rename is an explicit publication exception: it already holds the
-writer mutex and now refuses unfinished/failed restart ownership before moving
-inputs. Its existing four-file transaction uses EXIT rollback, including stamp
-write failures; it is not crash atomic across those files. This change does not
-claim stronger crash durability for ordinary rename. Restart preservation and
-resume-stamp publishers use the atomic checksum-fenced publication helper.
diff --git a/specs/005-supervised-legacy-ctx/spec.md b/specs/005-supervised-legacy-ctx/spec.md
deleted file mode 100644
index 41fa530f..00000000
--- a/specs/005-supervised-legacy-ctx/spec.md
+++ /dev/null
@@ -1,78 +0,0 @@
-# Supervised legacy context restart
-
-Decision: Brett Heap, 2026-10-04: “Legacy compatibility; refuse managed lanes”.
-This feature completes PR #121 on its existing branch. PR #97 remains owned
-by openRepoTools-3; neither its branch nor its worktree is an input to this work.
-
-## Scope
-
-Provide a supervised manual `/ctx` restart for confirmed legacy Claude lanes. The
-managed JSON ledger remains the sole lifecycle, readiness, operation and
-generation authority for enrolled managed lanes. Legacy entrypoints refuse
-managed or unknown ownership before preservation writes or launch.
-
-The restart YAML stores only legacy restart bookkeeping. Its generations,
-operations and attempts are independent of managed counters and of PR #97's
-diagnostic lifecycle snapshots. Readiness never writes another lifecycle store.
-
-## Requirements
-
-- FR-001: Resolve canonical lane aliases before probing managed ownership.
-  Use the installed managed ownership reader when available; unknown answers
-  refuse. With managed storage but no compatible reader, refuse conservatively.
-- FR-002: Reserve a legacy operation atomically before changing the handoff,
-  pause log or register. A preparing/pending/starting operation cannot be
-  superseded by ordinary `/ctx`. A refused competing restart changes no
-  canonical preservation record and never respawns a pane.
-  Reservation, completion, cleanup and later reads retain the sole existing
-  intent among recorded-checkout and projects-root candidates, unless an
-  explicit state-root override is supplied. Distinct competing records or
-  unreadable candidate ownership refuse. Root selection and CAS share the
-  writer mutex; recording a nested checkout cannot strand the reservation.
-- FR-003: Validate complete intent schema, state, generation, operation,
-  attempt and launch facts. Existing unreadable/malformed records cannot be
-  interpreted as absent or rewritten to a supported schema. Schema 1 rejects
-  unknown keys, duplicate keys, malformed lines and control delimiters; exact
-  launch identities are preserved byte for byte and stored through private
-  same-directory temporary files.
-- FR-004: Fence each attempt's claim, transcript preparation, readiness,
-  timeout, signal and failure writes by operation, generation and attempt.
-  A delayed child of an earlier attempt cannot consume a newer attempt.
-- FR-005: Bind the launch's canonical handoff, agent, profile, directory and
-  pane to the recorded operation. An ordinary launcher cannot consume an
-  active restart without its supervisor token. Before respawn, require an
-  existing absolute checkout and verify every pending launch fact and checksum.
-  Equivalent handoff symlink spellings refer to the same file. Lane rename
-  refuses unfinished and failed restart ownership under the shared mutex.
-- FR-006: Preserve the handoff bytes used for the prompt across owned resume
-  stamps. Prepare durable evidence before publishing a stamp; an interruption
-  at either publication boundary remains diagnosable and retryable. Unrelated
-  handoff changes refuse launch/retry.
-- FR-007: Observe the UUID prepared by the current attempt after launch, and
-  require one live process with the intended transcript and binding. Preserve
-  the existing preferred `live-holder` interface; enumerate all holders for
-  readiness and refuse ambiguity. Claude-native interactive session record
-  provenance supplies agent evidence within this Claude-only contract.
-- FR-008: If a signal leaves a child alive or child absence unproven, preserve
-  an indeterminate active operation. Do not advertise or permit a competing
-  retry. A known-ended child permits retry of the same operation. Observer
-  cleanup uses a private cancellation marker and waits for its owned child;
-  it never signals a saved PID that may have been recycled.
-- FR-009: Failure/status output describes the persisted state. A failed
-  fresh launch requires its supervised operation; ordinary resume cannot bypass
-  it. A failed preparation (`preservation-only`, attempt 0, no new transcript)
-  authorizes no supervised launch. With no explicit/inherited restart tokens or fresh-session selectors
-  and every holder confirmed absent, ordinary resume is permitted. Recheck the
-  same operation/generation and qualifying fields before binding changes and
-  before launch, retaining the failed intent unchanged. `preparing` still refuses.
-  A completed intent remains history and permits ordinary resume.
-- FR-010: Preserve main's binding, holder, performance and Claude resolver
-  behavior. Use Bash 3.2-compatible implementation and the repository test
-  wrapper in the dev container. CI remains the suite of record.
-
-## Delivery gates
-
-Focused fault tests and per-push CI must pass. The existing user hold remains
-until explicitly released. Apply the macOS landing gate immediately before
-an authorized merge. Do not install, deploy, restart a real lane or run a live
-manual canary as an incidental test.
diff --git a/specs/005-supervised-legacy-ctx/tasks.md b/specs/005-supervised-legacy-ctx/tasks.md
deleted file mode 100644
index c8b2af83..00000000
--- a/specs/005-supervised-legacy-ctx/tasks.md
+++ /dev/null
@@ -1,29 +0,0 @@
-# PR #121 completion tasks
-
-- [x] T001 Merge main and preserve current binding/resolver/performance code.
-- [x] T002 Record the approved legacy-only authority decision and governance handoff.
-- [x] T003 Refuse unreadable, malformed and incomplete restart records.
-- [x] T004 Remove PR #97 lifecycle writes and counter imports.
-- [x] T005 Canonicalize and verify managed ownership before legacy operation entry, claims and prepared launches.
-- [x] T006 Reserve preparing operations before canonical preservation writes.
-- [x] T007 Fence supervisor/child/observer writes by exact attempt identity.
-- [x] T008 Validate agent, profile, directory, pane and operation launch facts.
-- [x] T009 Preserve owned stamp publication across interruption and retry.
-- [x] T010 Confirm the asynchronously prepared UUID and all-holder uniqueness.
-- [x] T011 Preserve indeterminate active ownership when a signal leaves a child alive or unknown.
-- [x] T012 Update command, skill, manual and capability contracts to the final scope.
-- [x] T013 Run focused sandboxed restart fault cases and touched shell suite.
-- [x] T014 Complete expert follow-up review and address verified findings, including final schema, rename, pre-kill and observer hardening.
-- [x] T015 Commit/push PR updates and request exact-head Codex review; retain the existing merge hold.
-- [x] T016 Verify pre-reconciliation head 69838c5 per-push CI; record review quota limitations if present.
-- [ ] T017 After hold release/merge authorization, run macOS landing gate and merge.
-
-- [x] T018 Reconcile landed PR #97, preserving separate helper namespaces, managed ownership fences and completed restart history; verify helper identity and focused integration cases. New-head full-suite results are recorded in the PR review record.
-
-- [x] T019 Repair macOS landing regressions: Bash 3.2 control rejection, case-insensitive spelling-only rename preflight, and a controlling terminal with consumed PTY output and guaranteed cleanup for the interactive retry fixture. Run the terminal case first in macOS CI before the full landing suite. Verify locally and rerun exact-head landing CI.
-
-- [x] T020 Distinguish never-launched preparation failure in ordinary resume and status, with repeated identity/holder checks and negative recovery cases; validate and review the final head.
-
-- [x] T021 Keep restart reservation, completion, cleanup and later readers at the sole existing control root; refuse competing/unreadable roots, select under the CAS mutex, and validate nested checkout, failure cleanup, aliases and writer waiting cases.
-
-- [ ] T022 Reconcile landed PR #164, retaining both appended shell-suite sections and the derived index's non-gating boundary; review the combined head and rerun exact-head landing CI.
diff --git a/specs/006-release-pypi/checklists/requirements.md b/specs/006-release-pypi/checklists/requirements.md
deleted file mode 100644
index d9f9a6a1..00000000
--- a/specs/006-release-pypi/checklists/requirements.md
+++ /dev/null
@@ -1,76 +0,0 @@
-# Specification Quality Checklist: Release tags, release branches and the `openrepotools` package on PyPI
-
-**Purpose**: Validate specification completeness and quality before proceeding to planning
-**Created**: 2026-10-17
-**Feature**: [spec.md](../spec.md)
-
-## Content Quality
-
-- [x] No implementation details (languages, frameworks, APIs)
-- [x] Focused on user value and business needs
-- [x] Written for non-technical stakeholders
-- [x] All mandatory sections completed
-
-## Requirement Completeness
-
-- [x] No [NEEDS CLARIFICATION] markers remain
-- [x] Requirements are testable and unambiguous
-- [x] Success criteria are measurable
-- [x] Success criteria are technology-agnostic (no implementation details)
-- [x] All acceptance scenarios are defined
-- [x] Edge cases are identified
-- [x] Scope is clearly bounded
-- [x] Dependencies and assumptions identified
-
-## Feature Readiness
-
-- [x] All functional requirements have clear acceptance criteria
-- [x] User scenarios cover primary flows
-- [x] Feature meets measurable outcomes defined in Success Criteria
-- [x] No implementation details leak into specification
-
-## Notes
-
-- Validated on 2026-10-17, in one iteration, against the governing OpenSpec
-  change `release-tags-pypi`.
-- **Named tools.** The spec names pipx, PyPI, bash, `tests.yml` and
-  `release.yml`, because the governing change fixes them as the product's own
-  surface. Brett Heap's words are "we will publish on pypi" and "look at the
-  way we did this for openRepoShape". The `pypi-package` delta spec states
-  its requirements in those terms. The spec leaves the module layout, the
-  function names, the resolution algorithm and the step structure to
-  plan.md. The content-quality items pass on that reading.
-- **The readers.** They are Brett Heap and the lanes that build and release
-  this toolset, so "non-technical" is read as "states outcomes, not code".
-- **The technology in the success criteria.** SC-001 to SC-010 count
-  outcomes: artifacts placed, facts printed, refusals, uploads. They name a
-  tool only where the tool is the outcome, as with PyPI serving a version.
-- **No `[NEEDS CLARIFICATION]`.** None remains. Brett Heap's choice of
-  (a), (b) or (c) on workBenches, FR-047, is decided: spec.md's FR-047 says
-  "decided: position (c)", and design.md's "Resolved by Brett Heap,
-  2026-10-18", item 12, has his words "go with (c)" and
-  opensoft/workBenches#165. It was never a blocker: it changes only when
-  FR-045's README text may appear, and adds README's one-route sentence.
-  The `release/*` ruleset choice and the v1.1.0 notes text are recorded as
-  assumptions. The change already specifies both outcomes of the first, and
-  the second is settled before the tag.
-- **Coverage.** Every one of the delta specs' 25 requirements maps to a
-  functional requirement: 17 in `pypi-package` and 8 in
-  `release-tags-and-branches`. Their 49 scenarios are acceptance scenarios,
-  edge cases or the exact text of a requirement. The spec adds no scope the
-  proposal, design.md and clarifications.md do not hold.
-- **Revised 2026-10-18** for the lead's rulings on the report at `335d226`.
-  These were applied to the change's documents first, then to the spec:
-  - FR-048, the repository guard;
-  - FR-029's rehearsal rule, which the proposal and delta spec now state
-    too;
-  - pip's `/bin/sh` trampoline in FR-020;
-  - a package-mode run's own release as the count line's source, in FR-019;
-  - the wording of the unreadable-stamp clause and of the broken-stamp line;
-  - the one term "venv-shaped";
-  - "skipped" for the `pypi` job in an rc rehearsal;
-  - the branch rehearsal's version, in FR-033.
-
-  The delta specs gained two scenarios, a branch dispatch as a rehearsal and
-  a final version in the wrong repository. Every item still passes.
-- Items marked incomplete require spec updates before `/speckit.clarify` or `/speckit.plan`
diff --git a/specs/006-release-pypi/contracts/cli-output.md b/specs/006-release-pypi/contracts/cli-output.md
deleted file mode 100644
index 3615aff6..00000000
--- a/specs/006-release-pypi/contracts/cli-output.md
+++ /dev/null
@@ -1,204 +0,0 @@
-# Contract: what the command prints
-
-Every line below is held exactly by a test. `<dir>` is
-`$OPENREPOTOOLS_BIN_DIR`, by default `~/.local/bin`, written as the run
-resolves it. Text in angle brackets is filled in at run time. Everything else
-is literal, and two spaces mean two spaces.
-
-`die` prints a blank line and then `REFUSED: <text>` to stderr, and exits 2
-(`openRepoTools:88`). Every refusal below goes through it, except the one
-from the entry module.
-
-## `--version`
-
-### From a stamped package (stdout, exit 0)
-
-```text
-openRepoTools <VERSION> (<REPOSITORY> @ <COMMIT>)
-  version   <VERSION>
-  tag       <TAG>
-  commit    <COMMIT>
-  digest    <DIGEST> (sorted-ls-tree-r-v1)
-```
-
-For v1.1.0, the first line is
-`openRepoTools 1.1.0 (opensoft/openRepoTools-code @ <commit>)`.
-
-### From an unstamped package (stdout, exit 0)
-
-```text
-openRepoTools 0.0.0 (an unstamped package)
-  version   0.0.0, unstamped: a package built from a checkout, not a release
-  tag       none
-  commit    none
-  digest    none
-```
-
-### From a checkout or the one-line install (stdout, exit 0)
-
-```text
-openRepoTools (<repo> @ <ref>)
-```
-
-This is unchanged. `<repo>` is `${OPENREPOTOOLS_REPO:-opensoft/openRepoTools}`
-and `<ref>` is `${OPENREPOTOOLS_REF:-main}`. No `OPENREPOTOOLS_PACKAGE_*`
-variable changes it. `tests/test_openrepotools_command.py:323-344` keeps its
-assertions, and only the docstring at `:324-327` is rewritten.
-
-The digest label `sorted-ls-tree-r-v1` is one literal. It is held equal to
-the pinned `repo_shape.TREE_DIGEST_DEFINITION` and to
-`contracts/openreposhape-pin.yaml`'s `digest_definition` (FR-029, design.md
-Decision 10).
-
-## A broken stamp, in package mode (stderr, exit 2)
-
-It is printed for every invocation, `--help`, `--version` and `--install`
-included, before any argument is acted on:
-
-```text
-REFUSED: this package's stamp (openrepotools/_release.py) <why>, so this build is broken and nothing ran. A package's stamp is a release's whole stamp or the unstamped one. Reinstall it: pipx reinstall openrepotools
-```
-
-`<why>` is `stamp_read`'s `STAMP_WHY`. It begins with one of the three
-causes, and [stamp.md](stamp.md) gives each reason's cause:
-
-- `cannot be read (<detail>)`, for example `cannot be read (it is a
-  directory)`;
-- `is partial: <detail>`, for example `is partial: VERSION, TAG, COMMIT and
-  REPOSITORY are set, but DIGEST is empty`;
-- `is malformed: <detail>`, for example `is malformed: TAG is v1.2.0, not
-  v1.1.0`, or `is malformed: line 4 has a carriage return`.
-
-So the line reads correctly for each of them.
-
-## No `bash` (the entry module; stderr, exit 2)
-
-```text
-REFUSED: openRepoTools needs bash, and there is no bash on this PATH. Nothing ran.
-```
-
-## `--install` with pipx's link
-
-### The skip line (stdout), printed where the `openRepoTools:` per-file line would be
-
-```text
-openRepoTools: left to pipx at <dir>/openRepoTools (a link into pipx's openrepotools environment); update it with `pipx upgrade openrepotools`, then run `openRepoTools --install` again
-```
-
-### The count line, run from pipx's own environment (stdout)
-
-```text
-openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx
-```
-
-### The count line, run from anywhere else (stdout)
-
-```text
-openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx; the other 16 now come from <source>, not from openrepotools <version>
-```
-
-- `<source>` depends on how the run is installed (research R5):
-  - a package-mode run names its own release, `openrepotools <its
-    VERSION>`, from its own stamp, whether or not it runs inside a pipx
-    venv;
-  - a checkout or the one-line install names `<PAYLOAD_REPO> @
-    <PAYLOAD_REV>` for an adopted source, and `<REPO> @ <REF>` otherwise;
-  - a local adopted source, the code mounted in an assembly on disk, fetches
-    nothing and sets neither, so it names the pin's own pair,
-    `<PIN_SOURCE_REPOSITORY> @ <PIN_COMMIT>`, which a remote adopted run
-    reads too.
-- `<version>` is the `VERSION` of the stamp beside pipx's payload, and
-  `0.0.0` when that stamp is unstamped.
-- When that stamp fails the reader, the line ends differently, and the
-  install still goes on:
-
-  ```text
-  openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx; the other 16 now come from <source>, not from the openrepotools beside pipx's link, whose stamp cannot be read
-  ```
-
-### With no pipx link, the count line is today's
-
-```text
-openRepoTools: 17 of 17 placed in <dir>
-```
-
-### Receipt rows
-
-The rows are 28 with pipx's link (16 + 6 + 6) and 29 without it. The receipt
-format does not change.
-
-## pip's console script at `<dir>/openRepoTools` (stderr, exit 2; planning phase)
-
-This is design.md Decision 8's text, with `die`'s prefix. It is the same for
-both forms pip writes, the Python shebang and the `/bin/sh` trampoline
-([pipx-link.md](pipx-link.md)):
-
-```text
-REFUSED: `--install` will not replace <dir>/openRepoTools: it is pip's console script for openrepotools (`pip install --user openrepotools` leaves it there), and another installer's command is not this installer's to overwrite.
-    NOTHING was installed and nothing already installed was replaced.
-    pipx is the one package route. To move to it:
-        pip uninstall openrepotools
-        pipx install openrepotools
-        openRepoTools --install
-```
-
-## The PATH report (stdout; last in a package-mode `--install`; exit status unchanged)
-
-```text
-openRepoTools: note: the first openRepoTools on your PATH is <first, or "none">, not this package's <prefix>/bin/openRepoTools, so the release you just installed is not the one that runs; put the directory that holds pipx's link to it ahead of <first's directory> on PATH
-```
-
-- It is printed only on a mismatch, or when `type -P openRepoTools` finds
-  nothing.
-- `<first>` is that path as `type -P` gives it.
-- `<first's directory>` is its `dirname`.
-- When nothing is found, `<first's directory>` cannot be filled, so the line
-  is the same up to its last `;`, and then ends differently:
-
-  ```text
-  openRepoTools: note: the first openRepoTools on your PATH is none, not this package's <prefix>/bin/openRepoTools, so the release you just installed is not the one that runs; put the directory that holds pipx's link to it on PATH
-  ```
-- `<prefix>` is five levels above `payload/` (research R7).
-- Nothing is printed when the four directories above `payload/` are not
-  named `openrepotools`, `site-packages`, `python*` and `lib`, from the
-  nearest up. Such a layout names no `<prefix>` (research R7).
-
-## A venv-shaped link that fails the pipx rule (stderr, exit 2; planning phase)
-
-The link resolves to `…/bin/openRepoTools` whose parent holds `pyvenv.cfg`,
-but it fails the pipx rule. It is listed in `plan_install_targets`' refusal
-as this entry:
-
-```text
-    <dir>/openRepoTools — a link into a Python environment, perhaps pipx's (<venv>), in a layout this installer does not recognise
-```
-
-- The refusal's `rm -f -- …` line names only the other bad targets.
-- When that link is the only bad target, the "Clear them, then re-run" lines
-  and the `rm -f` line are not printed at all.
-- In every case, this paragraph follows the list:
-
-```text
-    Leave <dir>/openRepoTools where it is: it may be the only openRepoTools that can
-    run `--install`. Run `pipx reinstall openrepotools`, then `openRepoTools --install`
-    again, and if this refusal stays, open an issue on opensoft/openRepoTools naming
-    the layout under <venv>.
-```
-
-## No `jq`, with pipx's link in place
-
-The existing `plan_hook_merge` refusal (`openRepoTools:3153`) is unchanged.
-The run reaches it because pipx's link is recognised before any link
-refusal. Its whole output holds no `rm` line that names
-`<dir>/openRepoTools`.
-
-## Unchanged
-
-Everything else stays as it is:
-
-- the existing per-file lines (`installed at`, `updated at`, `already
-  installed … (unchanged)`, `(mode restored to 755)`);
-- every other refusal;
-- the `export PATH=…` note;
-- `venv_note`;
-- `--help`'s usage text.
diff --git a/specs/006-release-pypi/contracts/pipx-link.md b/specs/006-release-pypi/contracts/pipx-link.md
deleted file mode 100644
index b16ffe55..00000000
--- a/specs/006-release-pypi/contracts/pipx-link.md
+++ /dev/null
@@ -1,190 +0,0 @@
-# Contract: pipx's link, pip's console script and the PATH report
-
-All of this runs in `plan_install_targets` (`openRepoTools:3051`), for the
-target `<dir>/openRepoTools` only, before `unplaceable_kind` is asked about
-it. The one exception is the PATH report, which runs after every placement.
-It is the same in every mode: package, checkout and one-line install.
-
-## `link_resolve <path>`
-
-```text
-p := <path>; hops := 0
-while p is a symbolic link:
-    hops := hops + 1; if hops > 40: fail          # a longer chain, or a cycle
-    v := `readlink -- "$p"`                        # plain readlink, never -f; never realpath
-    if v is relative: v := "$(dirname -- "$p")/$v"
-    p := v
-dir := `cd -P -- "$(dirname -- "$p")" && pwd -P`  # fail if it does not cd
-print "$dir/${p##*/}"
-```
-
-- Every expansion is quoted. macOS's default pipx home,
-  `~/Library/Application Support/pipx`, holds a space.
-- The PATH report reuses this function.
-
-## `pipx_link_match <dir>/openRepoTools`
-
-pipx's link holds when all of these are true:
-
-1. `[ -L "$target" ]`.
-2. `link_resolve` succeeds, and gives `R`.
-3. `R` is a regular file, `${R##*/}` is `openRepoTools`, and the directory
-   holding it is named `bin`.
-4. `V` is that `bin`'s parent, and `"$V/pipx_metadata.json"` is a regular
-   file.
-5. For some `L` in `"$V"/lib/python*/site-packages/openrepotools/payload`,
-   `"$L/openRepoTools"` is a regular file. The glob is looped over with a
-   `-f` test, because an unmatched glob stays literal.
-
-**On a match** it sets three variables:
-
-- `PIPX_LINK="$target"`;
-- `PIPX_VENV="$V"`;
-- `PIPX_PAYLOAD=` the canonical `L`.
-
-Nothing reads `PIPX_HOME`, parses `pipx_metadata.json`, or needs `jq`.
-
-**Then the run does the following:**
-
-- The placement loop in `install_commands` skips `openRepoTools`, and prints
-  the skip line in its place.
-- `placed` counts 16.
-- The count line takes its pipx form ([cli-output.md](cli-output.md)).
-- `receipt_add` already writes no row for a link (`openRepoTools:1515-1517`).
-- `retire_commands` never names `PIPX_LINK`, because `RETIRED` does not hold
-  `openRepoTools`. A test holds that.
-
-## `venv_shaped_link <dir>/openRepoTools`
-
-It is true when steps 1 to 3 of the match hold, the `bin`'s parent holds a
-regular `pyvenv.cfg`, and the full match fails. Such a target is a refusal,
-in [cli-output.md](cli-output.md)'s words, with no `rm` advice for it.
-
-## The fixtures (`tests/test_install_pipx.py`)
-
-A fake venv per case, with no real pipx and no wheel. Each holds:
-
-- `bin/openRepoTools`, a console-script-shaped file;
-- `pipx_metadata.json`, with placeholder content, since only its existence
-  is read;
-- `pyvenv.cfg`;
-- `lib/python3.N/site-packages/openrepotools/payload/`, holding a copy of
-  every payload file;
-- `lib/python3.N/site-packages/openrepotools/_release.py`.
-
-**The positive matrix**, twelve cases. Each is recognised the same way, and
-each prints the exact skip and count lines:
-
-| pipx release it mirrors | `python3.N` | under `$PIPX_HOME` | under `~/.local/pipx` | under `~/.local/share/pipx` | under a home with a space |
-| --- | --- | --- | --- | --- | --- |
-| 1.11.1 | `python3.9` | case | case | case | case |
-| 1.17.8 | `python3.12` | case | case | case | case |
-| 1.18.3 | `python3.13` | case | case | case | case |
-
-- The venv directory is `<home>/venvs/openrepotools`, which is where each of
-  these pipx releases puts a package's venv.
-- The link in `<dir>` is absolute in some cases and relative in others.
-- `PIPX_HOME` is set only in its own column, to show that nothing reads it.
-- The home with a space is
-  `<tmp>/Library/Application Support/pipx`.
-
-**The negative cases.** Each refuses before anything is placed:
-
-- a link into a venv with no `openrepotools/payload/openRepoTools`. It holds
-  `pyvenv.cfg`, so it is refused as venv-shaped, with no `rm` advice;
-- a link into a venv with no `pipx_metadata.json`. This is venv-shaped too;
-- a link whose target is not in a `bin/` directory. It is an ordinary link,
-  refused with today's text;
-- a chain of 41 links. It is not pipx's link, and is refused;
-- a two-link cycle. It is not pipx's link, and is refused.
-
-**The cross-cutting cases:**
-
-- no `jq` on `PATH`, with pipx's link in place, which ends in the `jq`
-  refusal with no `rm` for the link;
-- a second target that is a link, which is refused, naming it, with
-  today's `rm -f` advice for it alone;
-- a later `--install` with the link still in place;
-- `restart` retirement with the link in place.
-
-## `pip_script_is <dir>/openRepoTools`
-
-It runs for a regular file that is not a link. It is true when both of
-these hold.
-
-1. **The interpreter is a Python**, in either of the two forms pip writes.
-   - **The shebang form.** The first line begins with `#!`, and the first
-     word after `#!` has a last `/` segment that begins with `python`.
-   - **The trampoline form.** pip writes this when the interpreter's path
-     holds a space or is too long for a shebang (pip 26.2.1,
-     `pip/_vendor/distlib/scripts.py:180-182`; the lead's ruling of
-     2026-10-18). It is three lines:
-
-     ```text
-     #!/bin/sh
-     '''exec' "<python>" "$0" "$@"
-     ' '''
-     ```
-
-     - Line 1 is exactly `#!/bin/sh`.
-     - Line 2 begins with `'''exec' `. The interpreter follows: quoted, up
-       to the next `"`, when it begins with `"`; otherwise up to the first
-       space. Then comes anything, and line 2 ends with ` "$0" "$@"`. The
-       interpreter's last `/` segment begins with `python`.
-     - Line 3 is exactly `' '''`.
-     - The interpreter is unquoted when its path is long and holds no space.
-2. **It imports the entry point.** One of the first 20 lines matches
-   `^from openrepotools(\.[A-Za-z_][A-Za-z0-9_]*)* import `. pip's own
-   template writes that line at column 0, in both forms
-   (`PipScriptMaker`, `pip/_internal/operations/install/wheel.py:417-424` in
-   pip 26.2.1).
-
-The rule reads lines with `IFS= read -r`, and uses `case` patterns and
-parameter expansion. It holds to bash 3.2.
-
-On true, the install is refused with [cli-output.md](cli-output.md)'s pip
-refusal, in the planning phase, in every mode. That includes a package-mode
-run whose own command is that script.
-
-**The fixtures.** These are refused:
-
-- pip's shebang form, `#!<abs python>` followed by
-  `from openrepotools.cli import main`;
-- pip's trampoline form, with a quoted interpreter path that holds a space
-  (`'''exec' "<tmp>/py env/bin/python3" "$0" "$@"`);
-- pip's trampoline form, with an unquoted interpreter path longer than 127
-  characters.
-
-These are placed as today:
-
-- the shebang form's file with `#!/bin/bash` in place of the Python;
-- a trampoline whose `exec` names a non-Python interpreter, such as
-  `'''exec' "<tmp>/x/bin/ruby" "$0" "$@"`;
-- a `#!/bin/sh` file that is not the trampoline, holding the import line
-  but no `'''exec'` line;
-- a Python script that imports something else;
-- this installer's own bash file.
-
-## `path_report`
-
-It runs last in a package-mode `--install`, after `retire_commands` and the
-`export PATH` note. It changes nothing, and leaves the exit status as it
-was.
-
-```text
-P := PACKAGE_DIR                                   # …/lib/pythonX.Y/site-packages/openrepotools/payload
-if the four directories above P are not named openrepotools, site-packages, python*, lib: say nothing more
-prefix := the parent of that lib/                  # five levels above payload/
-want := "$prefix/bin/openRepoTools"
-first := `type -P openRepoTools` (empty means none)
-if first is non-empty and link_resolve(first) == link_resolve(want): say nothing
-otherwise: print the note (cli-output.md)
-```
-
-**The fixtures:**
-
-- an older bash `openRepoTools` in a directory ahead of `<dir>` on `PATH`;
-- `PIPX_BIN_DIR`'s link in a directory that differs from
-  `$OPENREPOTOOLS_BIN_DIR`, and is not on `PATH`;
-- no `openRepoTools` on `PATH` at all;
-- pipx's link first on `PATH`, which gives no note.
diff --git a/specs/006-release-pypi/contracts/stamp.md b/specs/006-release-pypi/contracts/stamp.md
deleted file mode 100644
index 661a4ddf..00000000
--- a/specs/006-release-pypi/contracts/stamp.md
+++ /dev/null
@@ -1,143 +0,0 @@
-# Contract: the stamp's grammar, its reader and its writer
-
-## The committed file, `src/openrepotools/_release.py`
-
-The committed file is the SPDX line, then one module docstring, then the
-five assignment lines. The grammar below allows that docstring, and does not
-require it.
-
-```python
-# SPDX-License-Identifier: Apache-2.0
-"""<a module docstring: what the file is, that only the release build writes
-it, and that bash reads it with a fixed grammar and never imports it>"""
-VERSION = "0.0.0"
-TAG = ""
-COMMIT = ""
-DIGEST = ""
-REPOSITORY = ""
-```
-
-- Its first line is the repository's SPDX line,
-  `# SPDX-License-Identifier: Apache-2.0`, as in every tracked `.py` file
-  here and in openRepoShape v1.1.0's own package files (the lead's ruling of
-  2026-10-18). The docstring opens on the next line, with no blank line
-  between, as in those files.
-- It is LF only, with a final newline.
-- No line of the docstring begins, in any case, with `version` or
-  `__version__` followed by optional spaces and `=`.
-
-## The grammar the bash reader accepts (`stamp_read <file>`)
-
-Lines are read in order.
-
-1. A line holding a carriage return is refused, with its line number.
-2. A blank line, or a line whose first character is `#`, is skipped. That
-   holds before the docstring as well as after it. So the SPDX line that
-   opens the file is skipped, and so is any blank line before the docstring.
-3. **The docstring.** Before the first assignment, one line that begins
-   with `"""` opens the docstring.
-   - A file need not have one. Without it, every line rule 2 does not skip
-     is held to rule 4.
-   - It need not be the file's first line. Only lines that rule 2 skips may
-     come before it. The committed file's docstring opens on line 2, after
-     the SPDX line.
-   - The docstring closes on that same line if a second `"""` follows the
-     opening one. Otherwise it closes at the next line that contains `"""`.
-   - Every docstring line is skipped, except one that begins, in any case,
-     with `version` or `__version__` followed by optional spaces and `=`.
-     Such a line is refused, because hatch would read it as the version.
-   - A docstring with no close is refused.
-4. Every other line MUST be `NAME = "VALUE"` from column 0, with one space
-   either side of `=`.
-   - `NAME` is one of `VERSION`, `TAG`, `COMMIT`, `DIGEST` and `REPOSITORY`.
-   - `VALUE` holds no `"`, `\` or `$`.
-5. Each of the five names appears exactly once. A repeated, unknown or
-   missing name is refused.
-
-The reader holds to bash 3.2: no `${x,,}`, `mapfile`, `declare -A` or
-`local -n`, and no `awk -v` value with a newline in it. It never sources,
-imports or runs the file.
-
-## The checks after the read
-
-| State | Condition |
-| --- | --- |
-| unstamped | `TAG`, `COMMIT` and `DIGEST` all empty, `VERSION` is `0.0.0` and `REPOSITORY` is empty |
-| stamped | `VERSION` matches `^(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)\.(0\|[1-9][0-9]*)(rc(0\|[1-9][0-9]*))?$` and is not `0.0.0`; `TAG` is `v$VERSION`; `is_lower_hex 40 "$COMMIT"`; `is_lower_hex 64 "$DIGEST"`; `is_slug "$REPOSITORY"` |
-| broken | anything else |
-
-## Refusal reasons (`STAMP_WHY`), one fixture each
-
-Each reason begins with its cause, exactly one of `cannot be read`,
-`is partial:` and `is malformed:`, so that the broken-stamp line in
-[cli-output.md](cli-output.md) reads correctly. The rest of each reason's
-text is the implementer's. Each MUST be distinct, and each MUST name what
-its row's "Reason names" column gives.
-
-| Fixture | Cause | Reason names |
-| --- | --- | --- |
-| the file is unreadable (no read permission, or it is a directory) | `cannot be read` | the cause, in the form `cannot be read (<detail>)`, such as `cannot be read (it is a directory)`; the refusal line names the file around it |
-| a carriage return on line N | `is malformed:` | line N |
-| a name missing (each of the five in turn) | `is malformed:` | the missing name |
-| a name repeated | `is malformed:` | the repeated name |
-| an unknown name, such as `Version` or `BUILD` | `is malformed:` | the unknown name |
-| a line that is not `NAME = "VALUE"` | `is malformed:` | the line number |
-| an unclosed docstring | `is malformed:` | the docstring |
-| a docstring line hatch could read as the version | `is malformed:` | that line |
-| partial: a `COMMIT` and no `DIGEST` | `is partial:` | the empty fields |
-| partial: a `TAG` alone | `is partial:` | the empty fields |
-| unstamped-looking with a `REPOSITORY` | `is partial:` | `REPOSITORY` |
-| all of `TAG`, `COMMIT` and `DIGEST`, with `VERSION` `0.0.0` | `is malformed:` | `VERSION` |
-| a malformed `VERSION`, such as `1.1`, `01.1.0` or `1.1.0-rc1` | `is malformed:` | `VERSION` |
-| `TAG` other than `v$VERSION` | `is malformed:` | `TAG` |
-| `COMMIT` of 39 digits, or with upper case | `is malformed:` | `COMMIT` |
-| `DIGEST` of 63 digits | `is malformed:` | `DIGEST` |
-| `REPOSITORY` that is not a slug, such as `openRepoTools` or `a/b/c` | `is malformed:` | `REPOSITORY` |
-
-Two rows are read this way:
-
-- A `"`, `\` or `$` inside a value falls under the row of a line that is not
-  `NAME = "VALUE"`, so its reason names the line number.
-- In the "`TAG` alone" fixture, `VERSION` and `REPOSITORY` stay set, so the
-  empty fields its reason names are exactly `COMMIT` and `DIGEST`.
-
-## Agreement with hatch
-
-- Hatch's version source finds the version with
-  `(?i)^(__version__|VERSION) *= *(['"])v?(?P<version>.+?)\2` under
-  `re.MULTILINE`, and takes the first match
-  (`hatchling/version/core.py:6` and `:32` in 1.27.0).
-- A `#` line, such as the SPDX line, can never match that pattern. So the
-  first match is still the `VERSION` line, as long as the docstring guard
-  of rule 3 holds.
-- A test runs that pattern, copied with its citation, and `stamp_read` on
-  the committed file and on a stamped file, and requires one `VERSION` from
-  both.
-- On a fixture with a guarded docstring line, no `VERSION` can come from
-  both. The test holds instead that hatch reads `9.9.9` from that line, and
-  that `stamp_read` refuses the file, naming the line.
-
-## The writer: `release.yml`'s "write the stamp into both extractions" step
-
-- **Input**: the two extractions' `src/openrepotools/_release.py` paths as
-  arguments, and `VERSION`, `TAG`, `COMMIT`, `DIGEST` and `REPOSITORY` from
-  the step's environment. `REPOSITORY` is set from `$GITHUB_REPOSITORY`.
-  Nothing is pasted into the script by an expression.
-- **Checks before writing**: each value has the stamped shape above, and
-  differs from its unstamped value.
-- **The write**:
-  - Each of the five committed lines (`VERSION = "0.0.0"`, `TAG = ""`,
-    `COMMIT = ""`, `DIGEST = ""` and `REPOSITORY = ""`) is replaced exactly
-    once.
-  - A count other than one refuses, so a file already stamped is refused.
-  - The SPDX line, the docstring and every other byte stay as they are.
-- **After writing**: the file is read again, and must assign exactly the
-  five release values.
-- **The test**:
-  - `tests/test_release_workflow.py` extracts this heredoc and runs it on a
-    copy of the committed file.
-  - It then places the result as `_release.py` beside a fake
-    `openrepotools/payload/`, and requires `--version`'s stamped lines to
-    carry the same five values.
-  - It also requires that the step refuses a file already stamped, and a
-    value no release carries.
diff --git a/specs/006-release-pypi/contracts/wheel.md b/specs/006-release-pypi/contracts/wheel.md
deleted file mode 100644
index f5b9bfe8..00000000
--- a/specs/006-release-pypi/contracts/wheel.md
+++ /dev/null
@@ -1,135 +0,0 @@
-# Contract: `pyproject.toml` and the wheel
-
-## `pyproject.toml` (a new root file)
-
-These are the declarations a test holds. Comments in the file follow the
-model's style and give the reasons.
-
-```toml
-[build-system]
-requires = ["hatchling==1.27.0"]
-build-backend = "hatchling.build"
-
-[project]
-name = "openrepotools"
-dynamic = ["version"]
-requires-python = ">=3.9"
-license = "Apache-2.0"
-license-files = ["LICENSE"]
-dependencies = []
-# no `readme` key: README.md goes to the assembly root at the cutover
-
-[project.scripts]
-openRepoTools = "openrepotools.cli:main"
-
-[tool.hatch.version]
-path = "src/openrepotools/_release.py"
-
-[tool.hatch.build.targets.wheel]
-packages = ["src/openrepotools"]
-
-[tool.hatch.build.targets.wheel.force-include]
-# the 24 entries below, each "<P>" = "openrepotools/payload/<P>"
-```
-
-- The `description`, `authors`, `classifiers` and `[project.urls]` keys are
-  allowed, as the model has them.
-- No other table changes what the wheel holds.
-
-**Held by `tests/test_package.py`:**
-
-- `dependencies == []`;
-- `[project.scripts]` is exactly `{"openRepoTools": "openrepotools.cli:main"}`;
-- there is no `readme` key;
-- `requires` is `["hatchling==1.27.0"]`, the same pin as the build lock's
-  hatchling;
-- `requires-python == ">=3.9"`;
-- the license and `license-files` are as above;
-- the force-include keys are exactly `payload_names` plus the pin;
-- each value is `openrepotools/payload/<key>`.
-
-## The force-include map and the committed modes
-
-| # | Path `<P>` | Mode at this branch's head |
-| --- | --- | --- |
-| 1 | `openRepoTools` | `100755` |
-| 2 | `park` | `100755` |
-| 3 | `resume` | `100755` |
-| 4 | `status` | `100755` |
-| 5 | `lane` | `100755` |
-| 6 | `lanes` | `100755` |
-| 7 | `lane-handoff` | `100755` |
-| 8 | `lane-rename` | `100755` |
-| 9 | `lanes-edit.sh` | `100755` |
-| 10 | `lane-start` | `100755` |
-| 11 | `lane-end` | `100755` |
-| 12 | `link-estates` | `100755` |
-| 13 | `repos.tsv` | `100644` |
-| 14 | `claude-current` | `100755` |
-| 15 | `claude-restart-check` | `100755` |
-| 16 | `lanes-index` | `100755` |
-| 17 | `lane-worktrees` | `100755` |
-| 18 | `skills/handoff/SKILL.md` | `100644` |
-| 19 | `skills/lane-swap/SKILL.md` | `100644` |
-| 20 | `skills/restart/SKILL.md` | `100644` |
-| 21 | `commands/handoff.md` | `100644` |
-| 22 | `commands/ctx.md` | `100644` |
-| 23 | `commands/swap.md` | `100644` |
-| 24 | `contracts/openreposhape-pin.yaml` | `100644` |
-
-Rows 1 to 23 are `payload_names` in its own order. The test derives them
-from the bash file and never from this table. The table records what the
-file holds today.
-
-## The wheel's members
-
-```text
-openrepotools/__init__.py
-openrepotools/cli.py
-openrepotools/_release.py
-openrepotools/payload/<P>                      # each of the 24
-openrepotools-<version>.dist-info/METADATA
-openrepotools-<version>.dist-info/WHEEL
-openrepotools-<version>.dist-info/RECORD
-openrepotools-<version>.dist-info/entry_points.txt
-openrepotools-<version>.dist-info/licenses/LICENSE
-```
-
-The wheel holds nothing else.
-
-## The wheel checks
-
-The `package` job and the release build both run these. Each fails the job,
-naming every problem.
-
-1. **One file.** The two builds are one file (`cmp`).
-2. **The payload.** Each `openrepotools/payload/<P>`:
-   - is byte-identical to `git show <commit>:<P>`;
-   - has a mode whose owner-execute bit matches `git ls-tree <commit> -- <P>`
-     (`100755` to `0755`, `100644` to `0644`). Hatchling 1.27.0's
-     reproducible build normalises modes that way, per clarifications N4.
-3. **The modules.** Each `openrepotools/<name>.py` other than `_release.py`
-   is byte-identical to `src/openrepotools/<name>.py` at the commit.
-4. **The stamp.**
-   - In the `package` job, `openrepotools/_release.py` is byte-identical to
-     the committed file.
-   - In the release build, it is the committed file with exactly its five
-     assignment lines changed, to the release's values ([stamp.md](stamp.md)).
-5. **The metadata.** The `.dist-info/` names are exactly the five above, and
-   `licenses/LICENSE` is byte-identical to `git show <commit>:LICENSE`.
-   - This check, and not hatchling, is what makes a missing `LICENSE`
-     fatal. Hatchling 1.27.0's `license-files` glob raises nothing for a
-     pattern that matches no file (`hatchling/metadata/core.py:757-770`).
-6. **Nothing else.** No member falls outside the list above.
-
-**When `OPENREPOTOOLS_TEST_WHEEL` names a built wheel**, `tests/test_package.py`
-runs checks 2, 3, 5 and 6 against it, and compares its payload members with
-`payload_names` plus the pin in both directions.
-
-## Modes at run time
-
-Nothing at run time depends on the wheel's modes:
-
-- the entry module runs `bash <payload>/openRepoTools`;
-- `--install` sets 755 on each command it places, and 644 or 600 on the
-  rest (design.md Decision 12).
diff --git a/specs/006-release-pypi/contracts/workflows.md b/specs/006-release-pypi/contracts/workflows.md
deleted file mode 100644
index 8b46eece..00000000
--- a/specs/006-release-pypi/contracts/workflows.md
+++ /dev/null
@@ -1,372 +0,0 @@
-# Contract: `tests.yml` and `release.yml`
-
-Both files are governed: `.github/workflows/` is governed in every
-repository. Every action is pinned by a full commit, and its release tag is
-written as a comment, the way `tests.yml` writes every one today:
-
-- `actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4`
-- `actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5`
-- `pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2`
-- the artifact actions, at the commits the model's `release.yml` pins at
-  v1.1.0.
-
-Neither file may hold a host path that `HOST_ABSOLUTE_PATH`
-(`tests/test_repo_hygiene.py`) flags, such as one user's home directory on
-Linux or macOS. Use `$RUNNER_TEMP` and `$HOME`.
-
-## `tests.yml`
-
-### Triggers
-
-```yaml
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]   # unchanged
-  push:
-    branches: [main, 'release/v*']                    # was [main]
-  schedule:
-    - cron: '17 4 * * *'                              # unchanged
-  workflow_dispatch:                                  # unchanged
-```
-
-### The header comment
-
-- Lines 29 to 36 are rewritten. They now say that `push` covers `main` and
-  every `release/v*` branch, and that every trigger runs the four jobs.
-- Every other comment stays as it is.
-
-### Jobs
-
-- `guard-launch-mode`, `tests` and `tests-no-submodule` stay byte for byte.
-  These are the gate's job ids, and the code leg keeps them (FR-046).
-- `package` is new, with exactly that id and no `name:`. Its steps, in
-  order:
-
-1. `actions/checkout` with `submodules: true` and `fetch-depth: 1`.
-2. `actions/setup-python` with `python-version: '3.9'`.
-3. **Git identity**, by environment and never by global config, as the
-   `tests` job sets it.
-4. **The test tools.**
-   - First `tomli==2.4.1`, by hash. The step extracts the build lock's
-     whole `tomli` entry, the requirement line and every `--hash` line
-     under it, into a file under `$RUNNER_TEMP`, and installs it with
-     `--require-hashes --only-binary=:all:`. The job holds no digest of its
-     own.
-   - Then `pytest==8.3.4`.
-5. **Build twice, then compare.**
-   - `SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"`.
-   - `python3 -m pip wheel --no-deps -w "$RUNNER_TEMP/a" .`, then the same
-     into `"$RUNNER_TEMP/b"`.
-   - Each directory holds exactly one `.whl`, and the two are one file
-     (`cmp`).
-6. **The wheel check**: a `python3 - <<'PY'` heredoc that runs
-   [wheel.md](wheel.md)'s checks 2 to 6 against `HEAD`, with the stamp equal
-   to the committed file. It names every problem, then exits 1 if there was
-   any. The suite extracts this heredoc and runs it on synthetic wheels
-   (`tests/test_tests_workflow.py`).
-7. **pipx from its hash lock**: `.github/release-pipx-requirements.txt`, with
-   `--require-hashes --only-binary=:all:`. On 3.9 that gives pipx 1.11.1.
-   `PIPX_HOME` and `PIPX_BIN_DIR` sit under `$RUNNER_TEMP`.
-8. **Install the wheel with pipx.** pipx must place exactly one entry in
-   `PIPX_BIN_DIR`, the link `openRepoTools`.
-9. **The unstamped `--version`.** Its output equals
-   [cli-output.md](cli-output.md)'s unstamped lines exactly.
-10. **An offline `--install` beside pipx's link.** The run has:
-    - `HOME` a fresh directory under `$RUNNER_TEMP`;
-    - `OPENREPOTOOLS_BIN_DIR="$PIPX_BIN_DIR"`;
-    - `OPENREPOTOOLS_REPO=offline.invalid/sentinel`;
-    - a `PATH` whose first directory holds a `gh` and a `curl` that each
-      exit 1.
-
-    The skip line and the count line must be exact, there must be 28 rows in
-    the receipt, and the link must be unchanged.
-11. **The package's tests, none skipped.**
-    - `OPENREPOTOOLS_TEST_WHEEL` is the built wheel.
-    - Run `python3 -m pytest tests/test_package.py tests/test_package_stamp.py tests/test_install_pipx.py -q -rs --junitxml="$RUNNER_TEMP/package-tests.xml"`.
-    - Then a `python3` step reads the report and fails unless there is at
-      least one test, and zero skipped, failures and errors.
-
-## `release.yml` (new)
-
-### The file's shape
-
-```yaml
-on:
-  workflow_dispatch:
-    inputs:
-      version: {description: …, required: true, type: string}
-permissions: {}
-concurrency: {group: release, cancel-in-progress: false}
-defaults: {run: {shell: bash}}
-env:
-  VERSION: ${{ inputs.version }}     # scripts read it from the environment; no expression is pasted into a script
-  PYTHONUTF8: '1'
-jobs: {build, testpypi, install, pypi}
-```
-
-### The header (RELEASING), in this order
-
-1. What the workflow does, and that it is adapted from openRepoShape v1.1.0
-   (`190133d`), with design.md Decision 10's differences named.
-2. **The procedure for a release.**
-   - The release owner, lane openRepoTools-3, acts on Brett Heap's word: it
-     tags, dispatches and creates the GitHub Release. Brett approves each
-     deployment.
-   - The tag message's form (FR-036).
-   - A tag waits for its commit's `tests.yml` runs: all of them finished,
-     and the newest green.
-   - Dispatch on the tag, with `version` set to `X.Y.Z`.
-   - Approve `testpypi`, then `pypi`.
-   - After PyPI serves the version, run
-     `gh release create v<version> --repo <repository> --verify-tag --notes-file <spec>/docs/release-notes/v<version>.md`.
-   - Then, for `vX.Y.0`, cut `release/vX.Y` at the tag.
-3. **The branch and tag policy**, from #850:
-   - the trunk;
-   - annotated tags only, never moved and never reused;
-   - release branches cut at `vX.Y.0`;
-   - back-ports by fast-forward or merge while `main` holds only that patch
-     line, otherwise by a PR of `git cherry-pick -x`;
-   - one HOLD at a time, the landing lane back-ports, and the LANDED line
-     names both commits;
-   - patch tags wait for the commit's runs, the newer run deciding;
-   - one upload per version, with a bad one fixed by the next patch.
-4. **The two rehearsals.**
-   - A branch dispatch builds, checks and installs, and uploads nothing.
-   - A `X.Y.ZrcN` dispatched on its annotated tag reaches TestPyPI and the
-     install check, and the `pypi` job is skipped.
-   - A branch rehearsal builds with the version of the tag it rehearses, as
-     the model rehearsed v1.1.0 from its branch `l3-rehearsal-v1.1.0`.
-     Before v1.1.0 that is the next pre-release, so
-     `gh workflow run release.yml --ref <branch> -f version=1.1.0rc1` comes
-     first.
-   - The build's CI gate holds in a rehearsal too, and it counts only push
-     and dispatch runs. A feature branch's commit has only `pull_request`
-     runs, so dispatch `tests.yml` on that branch first, and wait for it to
-     finish green.
-   - No rehearsal uses `1.1.0`.
-5. **Where releases come from.**
-   - From v1.1.0 on, tags are made in `openRepoTools-code`.
-   - `v1.0.0` and every `rc` tag stay in `opensoft/openRepoTools`.
-   - The repository guard (FR-048) applies:
-     - `opensoft/openRepoTools` sends a pre-release to TestPyPI and nothing
-       to PyPI;
-     - `opensoft/openRepoTools-code` sends a pre-release to TestPyPI only,
-       and a final to TestPyPI and then to PyPI;
-     - every other repository uploads nothing.
-
-     `opensoft/openRepoTools` has no pypi.org publisher, which is the
-     second line of defence.
-   - The `testpypi` and `pypi` environments, the `v*` tag ruleset and the
-     trusted publishers are Brett Heap's to create.
-6. **What the workflow never reads**: the release notes, and anything
-   outside the code leg (FR-046).
-
-### `build` (`contents: read`, `actions: read`)
-
-The checkout:
-
-- `submodules: true`, because `repo_shape.py` exists here only in the
-  submodule;
-- `persist-credentials: false`;
-- full history, for the main and release-branch check.
-
-The steps are the model's, in its order. Each is a refusal on failure:
-
-1. **The version, and the repository guard (FR-048).**
-   - The version is `X.Y.Z`, not `0.0.0`, or `X.Y.ZrcN`.
-   - The guard is a `bash` `run:` block that the suite runs. It reads
-     `$GITHUB_REPOSITORY`, `$GITHUB_REF` and `$VERSION`, and decides by this
-     table:
-
-     | `$GITHUB_REPOSITORY` | Ref | Version | Build | `to-testpypi` | `to-pypi` |
-     | --- | --- | --- | --- | --- | --- |
-     | `opensoft/openRepoTools-code` | a tag | `X.Y.Z` | passes | `true` | `true` |
-     | `opensoft/openRepoTools-code` | a tag | `X.Y.ZrcN` | passes | `true` | `false` |
-     | `opensoft/openRepoTools` | a tag | `X.Y.ZrcN` | passes | `true` | `false` |
-     | `opensoft/openRepoTools` | a tag | `X.Y.Z` | refuses | none | none |
-     | any other | a tag | any | refuses | none | none |
-     | any | a branch | any | passes, as the rehearsal | `false` | `false` |
-
-   - The two repository names are compared exactly, as GitHub spells them
-     in `$GITHUB_REPOSITORY`. Any other spelling counts as "any other",
-     so the guard fails closed.
-   - The build job asks for no approval, so a refused run asks for none.
-     The model's workflow has no such guard, so this one is new here.
-2. The ref:
-   - on a tag, it is the annotated tag `v$VERSION`, whose object names
-     `$GITHUB_SHA`, read from the forge and from git;
-   - on a branch, it is a rehearsal, and the version must still parse;
-   - any other ref is refused.
-3. On a tag, `$GITHUB_SHA` is on `main` or on `release/v<X.Y>`. On a
-   branch, the rehearsal has no release branch to be on, and the step says
-   so and passes. This is the model's form (`release.yml:200-249` at
-   v1.1.0), and every later step runs in a rehearsal too.
-4. The checkout is `$GITHUB_SHA`, and it is clean.
-5. Both environments:
-   - each names at least one required reviewer;
-   - each has `deployment_branch_policy.custom_branch_policies` true;
-   - each has exactly one policy, of type `tag`, with the name `v*`.
-6. The `tests.yml` runs on `$GITHUB_SHA`, by `push` or `workflow_dispatch`:
-   - the jobs `guard-launch-mode`, `tests`, `tests-no-submodule` and
-     `package` each ran;
-   - none of those runs is in progress;
-   - the newest to finish succeeded.
-7. **The digest:**
-   - `tree_digest` on the checkout equals `tree_digest_from_gh` on the
-     forge, both run from `upstream/openRepoShape/scripts/repo_shape.py`;
-   - `repo_shape.TREE_DIGEST_DEFINITION` equals the literal
-     `sorted-ls-tree-r-v1`, and equals the pin's `digest_definition`.
-8. The tools come from `.github/release-build-requirements.txt`, in a venv,
-   with `--require-hashes --only-binary :all:`.
-9. Extract the commit twice: `git archive` into two different directories.
-10. Write the stamp into both extractions ([stamp.md](stamp.md)'s writer),
-    with `REPOSITORY="$GITHUB_REPOSITORY"`.
-11. Build each one with
-    `python -m build --wheel --no-isolation`, at
-    `SOURCE_DATE_EPOCH` the commit's time.
-12. The two wheels are one file.
-13. [wheel.md](wheel.md)'s checks 2 to 6, with the stamp as the release's.
-    This is a heredoc, which `tests/test_release_workflow.py` extracts and
-    runs on synthetic wheels.
-14. Record these as job outputs: the wheel's name, its sha256, the digest,
-    and step 1's `to-testpypi` and `to-pypi`. Keep the wheel as an
-    artifact.
-
-### `testpypi` (`environment: testpypi`; permissions exactly `id-token: write`, `actions: read`, `contents: read`)
-
-These are the model's grants (`release.yml:691-694` at v1.1.0):
-`id-token` for trusted publishing, `actions` for the environment's rules and
-this run's approvals, and `contents` for the tag, read again.
-
-- It runs only when `github.ref` is a `refs/tags/v*` tag, `build` succeeded,
-  and `needs.build.outputs.to-testpypi == 'true'`.
-- Its first step runs the repository guard again, on its own. It refuses in
-  `opensoft/openRepoTools` unless the version is a pre-release, passes in
-  `opensoft/openRepoTools-code`, and refuses in every other repository.
-- Download the wheel, and check its sha256 against `build`'s output.
-- Read again the environment's rules, this run's approval of `testpypi`,
-  and the tag.
-- TestPyPI's JSON for the version must list no file but the verified
-  wheel, at the digest `build` recorded, or the job refuses:
-  - a 404, a version with no file yet, passes;
-  - the verified wheel already there at that digest, and not yanked, passes,
-    and the upload (`skip-existing`) adds nothing new. This is a re-run of
-    the job after an upload that went through;
-  - a file of any other name, or the wheel's name at another digest,
-    refuses the job before the upload, and so does the verified wheel when
-    it is yanked.
-- Upload with `pypa/gh-action-pypi-publish@dc37677…` and
-  `repository-url: https://test.pypi.org/legacy/`.
-- Then TestPyPI must serve exactly `{wheel: sha256}`. Read it up to 20
-  times, as the model does.
-
-### `install` (read only)
-
-- It needs `build` and `testpypi`. It runs on a tag after `testpypi`
-  succeeded, and on a branch when `testpypi` was skipped. This is the
-  model's condition.
-- The matrix is `ubuntu-24.04` on `3.x`, `macos-latest` on `3.x`, and
-  `ubuntu-24.04` on `3.9`. There is no Windows leg. The ubuntu legs are
-  pinned because `ubuntu-latest` became Ubuntu 26.04 on 2026-10-21, where
-  setup-python has no Python `3.9`.
-- `PIP_INDEX_URL` is PyPI's, as the model has it.
-
-The steps:
-
-1. On a tag, fetch the wheel from TestPyPI by its recorded digest. On a
-   branch, take the build's artifact. In both cases, check the sha256.
-2. pipx from `.github/release-pipx-requirements.txt`, by hash.
-3. `pipx install` the wheel. pipx must place exactly one command,
-   `openRepoTools`.
-4. `--version`:
-   - on a tag, its five lines must name `$GITHUB_REPOSITORY`, `$VERSION`,
-     `v$VERSION`, `$GITHUB_SHA` and the digest;
-   - on a branch, the build's stamp values.
-5. An offline `--install` into a fresh temporary `HOME`, set up as in the
-   `package` job's step 10. The skip line and the count line must be exact.
-6. On macOS only, run step 5 again with `PATH="/bin:$PATH"`, and print
-   `BASH_VERSION`, which must begin with `3.2`.
-7. On 3.9 only, compile the installed package's own
-   `payload/lanes-index` and `payload/lane-worktrees` with `python3 -c`
-   `compile(...)`. The shipped bytes are what must compile on 3.9.
-
-### `pypi` (`environment: pypi`; permissions exactly `id-token: write`, `actions: read`, `contents: read`)
-
-These are the model's grants (`release.yml:1133-1136` at v1.1.0).
-
-- It needs `build`, `testpypi` and `install`.
-- Its job-level `if:` requires a `refs/tags/v*` tag and
-  `needs.build.outputs.to-pypi == 'true'`, which holds only for a final
-  `X.Y.Z` in `opensoft/openRepoTools-code`. An expression cannot test a
-  pattern, so the build's record decides. In an rc rehearsal the job is
-  skipped, and never asks for the `pypi` approval.
-- Its first step refuses unless `$GITHUB_REPOSITORY` is
-  `opensoft/openRepoTools-code` and the version is a final `X.Y.Z`. So in
-  `opensoft/openRepoTools` it refuses outright, in case the condition is
-  ever loosened.
-- Then come the same download, sha256 check, re-reads and empty-index check
-  as `testpypi`, against PyPI.
-- The upload uses the same pinned action, with the default index.
-- Then PyPI must serve exactly `{wheel: sha256}`.
-
-### Held by `tests/test_release_workflow.py` (offline)
-
-- A dispatch with `version` is the only trigger, and `permissions: {}` is
-  set at the top.
-- Only `testpypi` and `pypi` hold `id-token: write`, each in its own
-  environment and on a `v*` tag alone. Each holds exactly `id-token: write`,
-  `actions: read` and `contents: read`. `build` holds exactly
-  `contents: read` and `actions: read`, and `install` holds exactly
-  `contents: read`.
-- The ref step passes a branch as a rehearsal and refuses any other non-tag
-  ref, and the branch-membership step passes a rehearsal.
-- The wheel-check heredoc is run on four synthetic wheels made from HEAD's
-  blobs:
-  - the wheel as built, which passes;
-  - one with no `licenses/LICENSE`, which fails, naming `LICENSE`;
-  - one with a payload file's byte changed, which fails, naming that file;
-  - one with a payload file's mode changed, which fails, naming that file.
-- Every `uses:` is pinned by 40 hex digits, and the publish action is
-  `dc37677…`.
-- Every `pip install` is from a hash lock, with `--require-hashes`.
-- Every entry in both locks is one version, named by its sha256.
-- The build lock's hatchling is `pyproject.toml`'s pin.
-- The pipx lock gives 1.11.1 below Python 3.10 and 1.17.8 from 3.10.
-- The build gate names exactly the four job ids.
-- The digest step compares `TREE_DIGEST_DEFINITION` with the literal and
-  with the pin.
-- The literal equals the label in `openRepoTools`' `--version` arm.
-- The stamp heredoc round-trips through `stamp_read` ([stamp.md](stamp.md)).
-- The repository guard (`test_release_guard_*`). The build's guard block is
-  run under each row of step 1's table, with `GITHUB_REPOSITORY`,
-  `GITHUB_REF`, `VERSION` and `GITHUB_OUTPUT` set. It must pass or refuse,
-  and record `to-testpypi` and `to-pypi`, exactly as the row says.
-- Each upload job's first-step guard is run in the same way. `testpypi`
-  refuses a final in `opensoft/openRepoTools` and any version elsewhere.
-  `pypi` refuses everything but a final in `opensoft/openRepoTools-code`.
-- `testpypi`'s condition reads `to-testpypi`, and `pypi`'s reads `to-pypi`.
-  So in an rc rehearsal `pypi` is skipped.
-- The install matrix is exactly the three legs. The macOS leg reruns under
-  `/bin/bash`, and the 3.9 leg compiles the two Python commands.
-- No step reads `docs/`, `openspec/`, `specs/`, `README.md`, `AGENTS.md` or
-  `CLAUDE.md`.
-- The header has the RELEASING sections above.
-
-### Held by `tests/test_tests_workflow.py` (offline)
-
-- `push.branches` is exactly `[main, 'release/v*']`, and the other triggers
-  are as above.
-- The four job ids are present.
-- The three existing jobs keep today's `runs-on`, checkout options, Python
-  version and `run:` commands. These are asserted from the file's text, not
-  from history, because CI checks out one commit at `fetch-depth: 1`. The
-  pull request's diff review confirms the rest of "unchanged".
-- The `package` job runs on `ubuntu-24.04` with Python `3.9` and
-  `submodules: true`, and carries steps 4 to 11 in order. The runner is
-  pinned because `ubuntu-latest` became Ubuntu 26.04 on 2026-10-21, where
-  setup-python has no Python `3.9`.
-- Its `tomli` comes from the build lock's own entry, and the job holds no
-  `--hash` of its own.
-- Its wheel-check heredoc (step 6) is run on the same four synthetic wheels
-  as the release build's, with the same four outcomes.
-- The header comment names both push branches and four jobs.
diff --git a/specs/006-release-pypi/data-model.md b/specs/006-release-pypi/data-model.md
deleted file mode 100644
index 8dbdeef6..00000000
--- a/specs/006-release-pypi/data-model.md
+++ /dev/null
@@ -1,199 +0,0 @@
-# Data Model: 006-release-pypi
-
-This feature stores nothing new, beyond the stamp. Its entities are files,
-directory layouts and the state of a run. The receipt's format does not
-change. Each entity names its fields, its validation rules and, where it has
-them, its states.
-
-## The stamp: `src/openrepotools/_release.py`, `openrepotools/_release.py` in the wheel
-
-| Field | Unstamped (committed) | Stamped (release build only) |
-| --- | --- | --- |
-| `VERSION` | `0.0.0` | `X.Y.Z`, or `X.Y.ZrcN`; digits with no leading zeros; not `0.0.0` |
-| `TAG` | empty | exactly `v<VERSION>` |
-| `COMMIT` | empty | 40 lowercase hex digits (`is_lower_hex 40`), the tag's commit |
-| `DIGEST` | empty | 64 lowercase hex digits (`is_lower_hex 64`), that commit's `sorted-ls-tree-r-v1` tree digest |
-| `REPOSITORY` | empty | an owner/name slug (`is_slug`), the release run's `$GITHUB_REPOSITORY` |
-
-**The committed file's shape**: the repository's SPDX line,
-`# SPDX-License-Identifier: Apache-2.0`, then one module docstring, then the
-five assignment lines in the order above (the lead's ruling of 2026-10-18).
-[contracts/stamp.md](contracts/stamp.md) gives the grammar, whose reader
-skips the SPDX line as it skips any `#` comment or blank line before the
-docstring. The grammar allows the docstring, and does not require it.
-
-**States**:
-
-```text
-           release build's writer (five lines, once each)
-unstamped ───────────────────────────────────────────────▶ stamped
-    │                                                          │
-    └────────── anything else the reader sees ─────────────────┘
-                             ▼
-                          broken  (always refused; never read in part)
-```
-
-- **unstamped**: `TAG`, `COMMIT` and `DIGEST` are all empty, `VERSION` is
-  `0.0.0` and `REPOSITORY` is empty.
-- **stamped**: every field is set and passes its rule in the table.
-- **broken**: anything else. That includes a partial stamp (some of `TAG`,
-  `COMMIT` and `DIGEST` set), a malformed field, an unreadable file, a
-  carriage return, and a missing, repeated or unknown name. It also includes
-  an unclosed docstring, and a docstring line that hatch's version pattern
-  could take.
-
-**Readers**: bash's `stamp_read`, which is the only one at run time, and
-hatch's version source, at build time. The two must read the same `VERSION`
-(FR-013).
-
-## The payload list and the force-include map
-
-- **The payload list**: the output of `payload_names` in `openRepoTools`. It
-  is the 17 `INSTALLABLES`, then `skills/<n>/SKILL.md` for the 3 `SKILLS`,
-  then `commands/<n>.md` for the 3 `COMMANDS`, in that order: 23 paths.
-- **The force-include map**: those 23 paths plus
-  `contracts/openreposhape-pin.yaml`, 24 in all. Each key `<P>` maps to the
-  value `openrepotools/payload/<P>`.
-- **Rule**: the map's keys, the built wheel's `openrepotools/payload/`
-  members and the payload list plus the pin are one set, compared in both
-  directions (FR-007).
-- **Modes**: each entry has the commit's mode. At this branch's head that is
-  16 at `100755` (the sixteen commands) and 8 at `100644` (`repos.tsv`, the
-  three skills, the three command files and the pin). The full list is in
-  [contracts/wheel.md](contracts/wheel.md).
-
-## The package layout, installed
-
-```text
-<prefix>/                                  # a pipx venv, or pip's user base
-├── bin/openRepoTools                      # pip's console script for openrepotools.cli:main
-├── pipx_metadata.json                     # pipx's own file (its existence only is read)
-├── pyvenv.cfg                             # present in every venv
-└── lib/pythonX.Y/site-packages/openrepotools/
-    ├── __init__.py
-    ├── cli.py
-    ├── _release.py                        # the stamp
-    └── payload/                           # PACKAGE_DIR in package mode
-        ├── openRepoTools  park  resume  …  lane-worktrees  repos.tsv
-        ├── skills/<n>/SKILL.md
-        ├── commands/<n>.md
-        └── contracts/openreposhape-pin.yaml
-```
-
-- **Package mode** holds when the resolved directory of `$SELF` is named
-  `payload`, its parent is named `openrepotools`, and that parent holds a
-  regular `_release.py`.
-- **`<prefix>`** is five directories above `payload/`, the parent of `lib/`
-  (research R7).
-
-## pipx's link
-
-| Field | Meaning |
-| --- | --- |
-| `PIPX_LINK` | `<dir>/openRepoTools`, the symbolic link |
-| `PIPX_VENV` | the canonical `<venv>`, which is the parent of the resolved file's `bin/` |
-| `PIPX_PAYLOAD` | the canonical `<venv>/lib/python*/site-packages/openrepotools/payload` that holds a regular `openRepoTools` |
-
-**Match** (all of these):
-
-- `<dir>/openRepoTools` is a symbolic link;
-- it resolves, within 40 hops and with no cycle, to a regular file named
-  `openRepoTools` in a directory named `bin`;
-- `<venv>/pipx_metadata.json` is a regular file;
-- some `<venv>/lib/python*/site-packages/openrepotools/payload/openRepoTools`
-  is a regular file.
-
-**The other kinds of `<dir>/openRepoTools`** each take one outcome in the
-planning phase:
-
-| What is at `<dir>/openRepoTools` | Outcome |
-| --- | --- |
-| nothing, or this installer's regular file | placed as today |
-| pipx's link | skipped; the skip line is printed; no receipt row |
-| a venv-shaped link (it resolves to `…/bin/openRepoTools` whose parent holds `pyvenv.cfg`, but fails the match) | refused, with no `rm` advice; names `pipx reinstall openrepotools` |
-| pip's console script (a regular file, in either form pip writes: a Python shebang, or the `/bin/sh` trampoline, with the import) | refused (design.md Decision 8) |
-| any other link, a directory, or an unwritable file | refused as today, with today's `rm -f` advice |
-
-## An install run's result
-
-| Quantity | Full install | With pipx's link |
-| --- | --- | --- |
-| files placed in `<dir>` | 17 | 16 (1 left to pipx) |
-| skill files (3 skills × 2 paths) | 6 | 6 |
-| command files (3 × 2 paths) | 6 | 6 |
-| artifacts placed always | 29 | 28 (1 left to pipx) |
-| hook entries, on top, once `~/projects/xFactory/lanes-edit.sh` answers `guard` (#237) | 2 | 2 |
-| receipt rows (files + skill files + command files) | 29 | 28 |
-
-Until that target answers, the run defers the hook pair and says so, and
-`wip init` adds it. The receipt holds no hook rows.
-
-**The count line** takes one of three forms, given in full in
-[contracts/cli-output.md](contracts/cli-output.md):
-
-- today's form, with no pipx link;
-- a run from pipx's own environment;
-- another source beside pipx's link.
-
-In the third form, the source is:
-
-- `openrepotools <version>`, from the run's own stamp, for any
-  package-mode run;
-- `<repo> @ <ref>`, for a checkout or the one-line install.
-
-If the stamp beside pipx's link cannot be read, the line names that
-openrepotools by its link instead of by a version.
-
-## A release
-
-| Field | Rule |
-| --- | --- |
-| tag | annotated, `vX.Y.Z` (or `vX.Y.ZrcN` for a TestPyPI rehearsal); never moved, deleted or reused |
-| tag message | `openRepoTools vX.Y.Z`, a paragraph, `Tagged on Brett Heap's word (<exact UTC second>, "<words>")`, `Lane: <lane>` |
-| commit | on `main` or `release/vX.Y` |
-| tests.yml runs on the commit | all finished; the newest succeeded; each ran the four jobs |
-| tree digest | `sorted-ls-tree-r-v1`, the same locally and from the forge |
-| notes | `docs/release-notes/vX.Y.Z.md`, in the spec leg after the cutover |
-| GitHub Release | created by hand from the notes file, after PyPI serves the version |
-
-**States of a version on the indexes**:
-
-```text
-tagged ─▶ built (two builds, one file) ─▶ on TestPyPI ─▶ install-checked ─▶ on PyPI ─▶ Released (GitHub)
-             │ any gate fails: nothing uploaded       (pre-release stops at install-checked)
-```
-
-## A release branch
-
-- **Name**: `release/vX.Y`, cut at `vX.Y.0` right after the tag.
-- **What reaches it**: a fast-forward or a merge of `main` while `main`
-  holds only that patch line's work. Otherwise a PR of
-  `git cherry-pick -x <squash commit>`. One HOLD may be open at a time.
-- **Patch tags**: `vX.Y.Z` with Z above 0, once that commit's `tests.yml`
-  runs are all finished and the newest succeeded.
-
-## A release run (`release.yml`)
-
-| Job | Granted | Environment | Runs on |
-| --- | --- | --- | --- |
-| `build` | `contents: read`, `actions: read` | none | every dispatch |
-| `testpypi` | exactly `id-token: write`, `actions: read`, `contents: read` | `testpypi` | a `v*` tag that the guard sends to TestPyPI |
-| `install` | `contents: read` | none | every dispatch the build passes: on the build's wheel for a branch, from TestPyPI for a tag |
-| `pypi` | exactly `id-token: write`, `actions: read`, `contents: read` | `pypi` | a `v*` tag of a final `X.Y.Z` in `opensoft/openRepoTools-code` only |
-
-**Outputs of `build`**: the wheel's file name, its sha256, the tree digest,
-and the repository guard's `to-testpypi` and `to-pypi`. The two upload jobs'
-conditions read the guard's two outputs, and every later job checks the
-wheel and the digest against the others.
-
-**The repository guard** (FR-048):
-
-| Repository | On a tag, a pre-release `X.Y.ZrcN` | On a tag, a final `X.Y.Z` | On a branch |
-| --- | --- | --- | --- |
-| `opensoft/openRepoTools` | TestPyPI only; `pypi` is skipped | refused by the build | the rehearsal; no upload |
-| `opensoft/openRepoTools-code` | TestPyPI only; `pypi` is skipped | TestPyPI, then PyPI | the rehearsal; no upload |
-| any other | refused by the build | refused by the build | the rehearsal; no upload |
-
-**The environments**, which Brett Heap creates: each names a required
-reviewer, and each has a deployment limit of exactly one rule, the tag
-pattern `v*`.
diff --git a/specs/006-release-pypi/plan.md b/specs/006-release-pypi/plan.md
deleted file mode 100644
index 73a21e6d..00000000
--- a/specs/006-release-pypi/plan.md
+++ /dev/null
@@ -1,300 +0,0 @@
-# Implementation Plan: Release tags, release branches and the `openrepotools` package on PyPI
-
-**Branch**: `006-release-pypi` | **Date**: 2026-10-17 | **Spec**: [spec.md](spec.md)
-
-**Input**: Feature specification from `specs/006-release-pypi/spec.md`
-
-**Governance**: the OpenSpec change
-[`release-tags-pypi`](../../openspec/changes/release-tags-pypi/proposal.md),
-opensoft/openRepoTools#228. Its [design.md](../../openspec/changes/release-tags-pypi/design.md)
-holds decisions 1 to 12, and the lead's rulings of 2026-10-17. Its
-[clarifications.md](../../openspec/changes/release-tags-pypi/clarifications.md)
-holds N1 to N5. This plan implements both, and reopens nothing they settle.
-
-## Summary
-
-openRepoTools becomes a release, as well as a checkout.
-
-- **The package.** The `openrepotools` wheel is declarative hatchling 1.27.0
-  under `src/`.
-  - It carries the whole bash payload byte for byte, at
-    `openrepotools/payload/`, together with the openRepoShape pin.
-  - A standard-library entry module `exec`s `bash <payload>/openRepoTools`
-    with the person's arguments unchanged.
-- **The installer.** Bash stays the only reader at run time, and the only
-  parser.
-  - It recognises package mode from its own path.
-  - It reads the five-field stamp beside its payload, with a fixed grammar.
-  - It prints the release in `--version`.
-  - It refuses a broken stamp before any argument.
-  - `--install` skips pipx's link, refuses pip's console script and any
-    other link, and reports a shadowed `PATH`. It decides each of these from
-    paths and file existence alone.
-- **CI.** `tests.yml` gains the `package` job, and push runs on
-  `release/v*`.
-- **The release workflow.** `release.yml` is new, adapted from openRepoShape
-  v1.1.0 (`190133d`).
-  - It gates on the annotated tag, the branch, the environments, the
-    commit's four CI jobs and the tree digest.
-  - It builds twice from `git archive`, stamps the build and compares the
-    two.
-  - It uploads by trusted publishing, first to TestPyPI, then through the
-    install check, then to PyPI. An `rc` reaches TestPyPI only.
-  - A repository guard in its code limits `opensoft/openRepoTools` to
-    pre-releases on TestPyPI, and every other repository but the code leg
-    to nothing (FR-048).
-- **The documents.** The release notes, and the README and AGENTS.md
-  corrections, follow.
-
-[research.md](research.md) R1 to R20 record each choice design.md left to
-this plan.
-
-## Technical Context
-
-**Language/Version**: Each part of the feature is written in one of these:
-
-- bash, written for macOS's bash 3.2 and up, for `openRepoTools`;
-- Python 3.9 or later, standard library only, for `src/openrepotools/`, the
-  tests and the workflows' inline scripts;
-- TOML (`pyproject.toml`);
-- GitHub Actions YAML;
-- Markdown.
-
-**Primary Dependencies**:
-
-- **At run time**: none. `dependencies = []`. The payload's own
-  requirements do not change: bash, git, `jq` for `--install`, python3 for
-  two commands, and `gh` or `curl` where they already fetch.
-- **To build**: `hatchling==1.27.0`. The release adds `build`. Both come
-  from `.github/release-build-requirements.txt`, by hash, wheels only.
-- **In CI**: these, each pinned:
-  - `actions/checkout` and `actions/setup-python`, at the commits
-    `tests.yml` already pins;
-  - the artifact actions, at the model's pins;
-  - `pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33`
-    (v1.14.2);
-  - pipx 1.11.1 and 1.17.8, from `.github/release-pipx-requirements.txt`;
-  - `pytest==8.3.4`, and `tomli==2.4.1` by hash, from the build lock's own
-    entry (research R12).
-- **Reused from the submodule**: openRepoShape's pinned
-  `scripts/repo_shape.py`, for `tree_digest`, `tree_digest_from_gh`,
-  `TREE_DIGEST_DEFINITION` and `load_yaml`. It is never copied.
-
-**Storage**: files only.
-
-- The stamp, `src/openrepotools/_release.py`, is new.
-- The install receipt's TSV is unchanged in format.
-- `settings.json`'s two hook entries are unchanged.
-
-**Testing**:
-
-- pytest through `tests/run.sh`. CI's `tests` job is the suite of record.
-- The tests are standard-library only. Fake venv layouts stand in for pipx.
-  Fake `gh` and `curl` refuse every fetch.
-- Workflow YAML is read by the pinned `load_yaml`.
-- Built-wheel tests read `OPENREPOTOOLS_TEST_WHEEL`. The `package` job fails
-  on any skip, by a JUnit count.
-
-**Target Platform**:
-
-- **Runs on**: Linux and macOS, and WSL2 on Windows. Python 3.9 or later;
-  bash 3.2 or later.
-- **CI**: `ubuntu-24.04`, pinned because `ubuntu-latest` became Ubuntu 26.04
-  on 2026-10-21, where setup-python has no Python 3.9. The release install
-  check adds `macos-latest`, run under `/bin/bash` 3.2.
-
-**Project Type**: a command-line toolset, the bash installer and the
-commands it places, published as one Python wheel, with CI and release
-workflows.
-
-**Performance Goals**: none at run time beyond today's. The build has one
-goal: two builds of one commit are one file.
-
-**Constraints**:
-
-- The package install is offline.
-- There is no channel from Python to bash, and no environment variable is
-  trusted for the stamp.
-- Every new refusal is made in the planning phase and places nothing.
-- The installer's payload list is the only list.
-- The code holds to bash 3.2: no `${x,,}`, `mapfile`, `declare -A`,
-  `local -n`, `readlink -f` or `realpath`, and no multi-line `awk -v` value.
-- The suite reaches no network, and creates no real repository.
-- Command and workflow tests skip without the submodule, and never fail for
-  its absence.
-- No tracked file holds a host path.
-- Line caps move only by dated entries.
-
-**Scale/Scope**:
-
-- 24 payload files in the wheel. 29 artifacts placed by every install, or 28
-  and 1 left to pipx when pipx's link is present. The two hook entries are
-  added on top once `~/projects/xFactory/lanes-edit.sh` answers `guard`
-  (#237).
-- 1 console script.
-- 4 CI jobs in `tests.yml`. 4 jobs in `release.yml`, with 3 install-check
-  legs.
-- 12 positive and 5 negative pipx fixtures.
-
-## Constitution Check
-
-*GATE: Must pass before Phase 0 research. Re-check after Phase 1 design.*
-
-`.specify/memory/constitution.md` is the unfilled Spec Kit template, so it
-states no principle (research R18). The gates below are the rules this
-repository and the governing change do state. Each was checked before
-Phase 0 and again after Phase 1.
-
-| # | Gate (source) | Before Phase 0 | After Phase 1 |
-| --- | --- | --- | --- |
-| G1 | Shipped bash holds to bash 3.2, and `awk -v` carries one line (AGENTS.md) | PASS: design.md Decisions 5 and 6 name the constructs | PASS: [contracts/pipx-link.md](contracts/pipx-link.md) and [contracts/stamp.md](contracts/stamp.md) use plain `readlink`, `cd -P`, `pwd -P`, `case` and loops |
-| G2 | Nothing under `upstream/openRepoShape` is edited, and the pin does not move (AGENTS.md; proposal Non-goals) | PASS | PASS: the digest code and `load_yaml` are run from the submodule, and never copied (R9) |
-| G3 | The suite reaches no network, and creates no real repository (AGENTS.md) | PASS | PASS: wheel tests take a built wheel by variable (R8); the v1.0.0 notes are checked by their task, not the suite (R15) |
-| G4 | Tests skip without the submodule, naming it, and never fail for it (AGENTS.md; `tests-no-submodule`) | PASS | PASS: workflow tests skip like command tests (R9); the `package` job checks out with `submodules: true` and fails on a skip |
-| G5 | AGENTS.md and README caps move only by dated entries (`tests/test_repo_hygiene.py:1981`, `:2516`) | PASS | PASS: R16 |
-| G6 | Governed files (CI workflows, and every file recording a pin or a digest) are `[O]` work (Speckit protocol, Build Tiers) | PASS | PASS: `tests.yml`, `release.yml`, both hash locks, the stamp and every action pin are touched only by `[O]` tasks |
-| G7 | Every refusal is in the planning phase, and a refusal places nothing (design.md Goals) | PASS | PASS: pipx's link, a venv-shaped link and pip's script are decided in `plan_install_targets`; a broken stamp in `package_init` before the argument loop |
-| G8 | Brett Heap decides every tag, cut and upload; no lane act is a build task (proposal "Release owner") | PASS | PASS: environments, publishers, tags, dispatches, uploads, the Release and the assembly README PR stay in the change's `tasks.md` |
-| G9 | No new runtime dependency, and the package's modules are standard-library only (proposal Non-goals) | PASS | PASS: `dependencies = []`, enforced by a hygiene test |
-| G10 | One list of payload files (design.md Goals) | PASS | PASS: the force-include map and the wheel are held to `payload_names` (R2) |
-| G11 | No host path in any tracked file (`HOST_ABSOLUTE_PATH`) | PASS | PASS: workflows use `$RUNNER_TEMP` and `$HOME` ([contracts/workflows.md](contracts/workflows.md)) |
-| G12 | Nothing uploads to PyPI from `opensoft/openRepoTools`, and no rehearsal uses `1.1.0` (Brett Heap's answers 2 and 3) | PASS | PASS: the repository guard decides in `build`, before any approval, and again in each upload job's first step (FR-048, R19); `pypi` is skipped for a pre-release and refuses one if it starts; no pypi.org publisher exists for this repository; the RELEASING header states it |
-
-No gate fails, so Complexity Tracking is empty.
-
-## Project Structure
-
-### Documentation (this feature)
-
-```text
-specs/006-release-pypi/
-├── spec.md              # /speckit.specify
-├── checklists/
-│   └── requirements.md  # /speckit.specify's quality checklist
-├── plan.md              # this file
-├── research.md          # Phase 0: R1 to R20
-├── data-model.md        # Phase 1: the stamp, layouts, the install result, releases
-├── quickstart.md        # Phase 1: validating the feature by hand
-├── contracts/
-│   ├── cli-output.md    # every exact line the command prints
-│   ├── stamp.md         # the stamp's grammar, reader, writer and hatch agreement
-│   ├── pipx-link.md     # pipx's link, pip's script, the PATH report, the fixtures
-│   ├── wheel.md         # pyproject.toml, the 24-entry map, the wheel and its checks
-│   └── workflows.md     # tests.yml's package job, and release.yml
-└── tasks.md             # /speckit.tasks
-```
-
-### Source Code (repository root)
-
-```text
-pyproject.toml                               # NEW: contracts/wheel.md
-src/openrepotools/
-├── __init__.py                              # NEW: the SPDX line and a docstring, no code (R1)
-├── cli.py                                   # NEW: main(), which execs bash (design.md Decision 3)
-└── _release.py                              # NEW: the committed, unstamped stamp (contracts/stamp.md)
-openRepoTools                                # CHANGED: link_resolve, package_payload_dir, stamp_read,
-                                             #   package_init, the --version arm, pipx_link_match,
-                                             #   venv_shaped_link, pip_script_is, path_report, and
-                                             #   plan_install_targets and install_commands (R3)
-.github/
-├── release-build-requirements.txt           # NEW: the model's hash lock, re-headed (R11)
-├── release-pipx-requirements.txt            # NEW: the model's hash lock, re-headed (R11)
-└── workflows/
-    ├── tests.yml                            # CHANGED: release/v* push, the package job, the header
-    └── release.yml                          # NEW: contracts/workflows.md
-tests/
-├── package_layout.py                        # NEW: fixture builders, standard library only, no conftest import
-├── test_package.py                          # NEW: metadata, the map, the entry module, built-wheel checks
-├── test_package_stamp.py                    # NEW: the reader, package mode, --version, the broken stamp
-├── test_install_pipx.py                     # NEW: pipx's link, coexistence, pip, PATH, upgrade, uninstall
-├── test_release_workflow.py                 # NEW: release.yml, both locks, the stamp writer round trip
-├── test_tests_workflow.py                   # NEW: tests.yml's triggers, job ids and package job
-├── test_repo_hygiene.py                     # CHANGED: the standard-library rule, the compile set, caps
-└── test_openrepotools_command.py            # CHANGED: one docstring (:324-327), assertions unchanged
-docs/release-notes/
-├── v1.0.0.md                                # NEW: the published body, byte for byte (R15)
-└── v1.1.0.md                                # NEW: the draft
-README.md                                    # CHANGED: the version paragraph and three passages
-AGENTS.md                                    # CHANGED: the CI paragraph (lines 232-239)
-```
-
-**Structure Decision**: this is a single repository, with the package under
-`src/` beside the root's bash file (design.md Decision 1). After the cutover,
-`pyproject.toml`, `src/`, `.github/`, `tests/` and the payload go to the code
-leg. `docs/release-notes/` goes to the spec leg, and README.md, AGENTS.md
-and LICENSE to the root. Lane openRepoTools-1's regenerated adoption plan
-carries that split. This feature does not edit
-`openspec/changes/migrate-to-triad/`.
-
-### The test layout
-
-These names are fixed here, so that test and implementation tasks agree.
-
-- **`tests/package_layout.py`** imports only the standard library, and
-  finds the repository as `Path(__file__).resolve().parent.parent`. It
-  provides these builders:
-  - `package_tree(prefix, python="python3.12", stamp=None) -> Path` builds
-    `<prefix>/lib/<python>/site-packages/openrepotools/` from the working
-    tree: `__init__.py`, `cli.py`, `_release.py` (or the `stamp` text given)
-    and `payload/` with the 24 files. It returns the payload directory.
-  - `pipx_venv(pipx_home, release, python=None, stamp=None) -> Path` builds
-    `<pipx_home>/venvs/openrepotools/` around `package_tree`, with
-    `bin/openRepoTools`, `pipx_metadata.json` and `pyvenv.cfg`. It returns
-    the venv. `release` is one of `"1.11.1"`, `"1.17.8"` and `"1.18.3"`.
-    `python` defaults to that release's interpreter, and `stamp` is passed
-    on to `package_tree`.
-  - `console_script(path, python, form=None) -> Path` writes pip's
-    console-script template for `openrepotools.cli:main`. `form` is
-    `"shebang"` (`#!<python>`), `"trampoline"` (pip's `/bin/sh`
-    trampoline), or `None` for the form pip itself would choose.
-  - `stamp_text(**fields) -> str` gives the committed file's text with the
-    given values.
-
-  It also exports `payload_paths() -> tuple[str, ...]`, the force-include
-  table's payload paths in its order, and `LayoutError`, which a builder
-  raises when the checkout does not hold what a layout is built from.
-- **Test-name prefixes**, so that each task's `verify:` can select exactly
-  its tests with `-k`:
-
-  | Module | Prefixes |
-  | --- | --- |
-  | `test_install_pipx.py` | `test_pipx_link_`, `test_pipx_skip_`, `test_pipx_offline_`, `test_coexist_`, `test_pip_script_`, `test_path_report_`, `test_pipx_upgrade_`, `test_pipx_uninstall_` |
-  | `test_package.py` | `test_metadata_`, `test_payload_map_`, `test_wheel_`, `test_entry_` |
-  | `test_package_stamp.py` | `test_stamp_reader_`, `test_stamp_hatch_`, `test_package_version_`, `test_package_broken_stamp_`, `test_package_no_env_channel_`, `test_package_parser_` |
-  | `test_release_workflow.py` | `test_release_trigger_`, `test_release_build_`, `test_release_stamp_writer_`, `test_release_upload_`, `test_release_install_check_`, `test_release_lock_`, `test_release_header_`, `test_release_reads_`, `test_release_guard_` |
-  | `test_tests_workflow.py` | `test_tests_yml_` |
-
-- **Reuse.** The command helpers come from `tests/test_openrepotools_command.py`:
-  `COMMAND`, `command_env`, `run_cmd`, `source_tree`, `placement_temporaries`
-  and `NEEDS_JQ`. `tests/test_install_skill_and_hook.py` already imports
-  them that way. The function-cutting helper is
-  `tests/test_install_by_rename.py`'s `installer_function`.
-
-### Governed files in this feature
-
-Every task that touches one of these is `[O]`:
-
-- `.github/workflows/tests.yml` and `.github/workflows/release.yml`;
-- `.github/release-build-requirements.txt` and
-  `.github/release-pipx-requirements.txt`;
-- every action pin;
-- the stamp, `src/openrepotools/_release.py`, and the code that reads or
-  writes it.
-
-### Delivery: a short series of pull requests
-
-These follow design.md's Migration Plan step 1. Each lands by squash once it
-is reviewed and green, as the change's `tasks.md` item 3.1 records. All of
-them land before lane openRepoTools-1's rehearsal and adoption plan (item
-3.2).
-
-1. **The package and the installer.** User Stories 1, 2 and 3: Phases 1 to
-   5 of `tasks.md`.
-2. **CI.** User Story 4: the hash locks, `tests.yml` and AGENTS.md. The
-   `package` job needs both locks.
-3. **The release workflow.** User Story 5: `release.yml` and its tests.
-4. **The record.** User Story 6: the release notes and README.
-
-## Complexity Tracking
-
-No gate fails, so there is nothing to justify.
diff --git a/specs/006-release-pypi/quickstart.md b/specs/006-release-pypi/quickstart.md
deleted file mode 100644
index 91735948..00000000
--- a/specs/006-release-pypi/quickstart.md
+++ /dev/null
@@ -1,144 +0,0 @@
-# Quickstart: validating 006-release-pypi
-
-How a writer or a reviewer proves the feature locally, from the root of the
-feature's worktree. CI is the suite of record (AGENTS.md). These steps are
-the same checks, run by hand.
-
-Run every command from a shell that has no `LANES_*` or `TMUX` variable
-inherited from a lane session. Temporary directories come from `mktemp -d`.
-
-## 0. Prerequisites
-
-```sh
-git submodule update --init upstream/openRepoShape   # the command and workflow tests skip without it
-command -v bash jq git python3                        # all four are needed
-```
-
-Three steps can need the network. Building the wheel (step 3) fetches
-hatchling into pip's isolated build environment. A pipx that installs with
-pip rather than uv (step 5) fetches pip into a new `PIPX_HOME`'s shared
-libraries. Step 8 asks GitHub. Nothing else here does.
-
-## 1. The package's tests, without a wheel
-
-```sh
-bash tests/run.sh -k 'test_package or test_install_pipx or test_release_workflow or test_tests_workflow' -rs
-```
-
-- Expect every test to pass, except the built-wheel tests in
-  `tests/test_package.py`. Those skip, naming `OPENREPOTOOLS_TEST_WHEEL`.
-- The pipx-link tests build fake venvs: the twelve layouts in
-  [contracts/pipx-link.md](contracts/pipx-link.md) and the negative cases.
-  They need no pipx.
-
-## 2. The hygiene and command suites still hold
-
-```sh
-bash tests/run.sh -k 'repo_hygiene or openrepotools_command or install_'
-```
-
-- The standard-library rule now covers `src/openrepotools/`, and the compile
-  test compiles it.
-- The `--version` tests at `tests/test_openrepotools_command.py:323-344` keep
-  their assertions.
-- The README and AGENTS.md caps pass, with any dated entry the change needed.
-
-## 3. Build the wheel twice and compare
-
-```sh
-out="$(mktemp -d)"
-export SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"
-python3 -m pip wheel --no-deps -w "$out/a" .
-python3 -m pip wheel --no-deps -w "$out/b" .
-cmp "$out"/a/*.whl "$out"/b/*.whl && echo "one file"
-python3 -m zipfile -l "$out"/a/*.whl
-```
-
-The listing must be exactly [contracts/wheel.md](contracts/wheel.md)'s
-members: the three modules, the 24 payload files and the five `.dist-info`
-names.
-
-## 4. The built-wheel tests
-
-```sh
-OPENREPOTOOLS_TEST_WHEEL="$(ls "$out"/a/*.whl)" \
-  bash tests/run.sh -k 'test_package' -rs
-```
-
-No test may skip.
-
-## 5. Install with pipx, and install offline
-
-```sh
-t="$(mktemp -d)"
-export PIPX_HOME="$t/pipx" PIPX_BIN_DIR="$t/bin"
-pipx install "$(ls "$out"/a/*.whl)"
-"$t/bin/openRepoTools" --version          # the five unstamped lines, exactly
-
-mkdir -p "$t/user-home" "$t/offline"
-printf '#!/bin/sh\nexit 1\n' > "$t/offline/gh";   chmod 755 "$t/offline/gh"
-printf '#!/bin/sh\nexit 1\n' > "$t/offline/curl"; chmod 755 "$t/offline/curl"
-HOME="$t/user-home" OPENREPOTOOLS_BIN_DIR="$t/bin" \
-  OPENREPOTOOLS_REPO=offline.invalid/sentinel PATH="$t/offline:$PATH" \
-  "$t/bin/openRepoTools" --install
-```
-
-Expect each of these:
-
-- the skip line
-  `openRepoTools: left to pipx at <t>/bin/openRepoTools (a link into pipx's openrepotools environment); …`;
-- `openRepoTools: 16 of 17 placed in <t>/bin, and 1 left to pipx`;
-- 28 rows in the receipt under
-  `"$t/user-home/.local/share/openRepoTools/"`;
-- `"$t/bin/openRepoTools"` still a link into
-  `"$t/pipx/venvs/openrepotools/bin/"`;
-- last, the PATH note, because `$t/bin` is not on `PATH`:
-  `openRepoTools: note: the first openRepoTools on your PATH is <first, or "none">, not this package's <t>/pipx/venvs/openrepotools/bin/openRepoTools, …`.
-
-Then run `--install` again from the checkout's own `openRepoTools`, with the
-same environment:
-
-```sh
-HOME="$t/user-home" OPENREPOTOOLS_BIN_DIR="$t/bin" PATH="$t/offline:$PATH" \
-  bash ./openRepoTools --install
-```
-
-Its count line now ends in
-`; the other 16 now come from opensoft/openRepoTools @ main, not from openrepotools 0.0.0`.
-
-## 6. A broken stamp refuses everything
-
-Edit the installed package's stamp, under
-`"$t/pipx/venvs/openrepotools/lib/python3.*/site-packages/openrepotools/_release.py"`,
-so that it has a `COMMIT` and no `DIGEST`. Then:
-
-```sh
-"$t/bin/openRepoTools" --help; echo "exit $?"   # REFUSED: this package's stamp (openrepotools/_release.py) … pipx reinstall openrepotools; exit 2
-```
-
-## 7. The workflows
-
-```sh
-actionlint .github/workflows/tests.yml .github/workflows/release.yml   # where actionlint is installed
-bash tests/run.sh -k 'test_release_workflow or test_tests_workflow'
-```
-
-- The suite runs the release workflow's stamp writer, and checks the file
-  offline.
-- Nothing here dispatches it. A branch rehearsal is the release owner's act,
-  once Brett Heap has created the `testpypi` and `pypi` environments. The
-  change's `tasks.md` tracks it (item 4.2).
-
-## 8. The release notes
-
-```sh
-gh release view v1.0.0 --repo opensoft/openRepoTools --json body --jq .body \
-  | cmp - docs/release-notes/v1.0.0.md && echo "byte for byte"
-```
-
-## 9. Clean up
-
-```sh
-pipx uninstall openrepotools    # with PIPX_HOME and PIPX_BIN_DIR still exported
-rm -rf -- "$t" "$out"
-```
diff --git a/specs/006-release-pypi/research.md b/specs/006-release-pypi/research.md
deleted file mode 100644
index c23d6721..00000000
--- a/specs/006-release-pypi/research.md
+++ /dev/null
@@ -1,455 +0,0 @@
-# Research: 006-release-pypi
-
-Phase 0 of `/speckit.plan`. The governing change leaves no technical unknown
-open: design.md answers N1 to N5, and the lead's rulings of 2026-10-17 settle
-its remaining points. What is left are the choices that design.md delegates
-to the plan ("as `/speckit.tasks` splits it", "one entry module", "a test
-writes a stamp with the build's writer"), and two slips in design.md that
-this phase found. Each entry is one decision, its rationale and the
-alternatives considered.
-
-Every fact below was read on 2026-10-17. The bash file was read at this
-branch's head. openRepoShape v1.1.0 (`190133d`) and the current pin `7f84ca4`
-were read read-only.
-
-## R1. The entry module is `openrepotools.cli:main`
-
-- **Decision**:
-  - The one console script is `openRepoTools = "openrepotools.cli:main"`.
-  - `src/openrepotools/__init__.py` holds the SPDX line and a docstring,
-    and no code.
-  - `src/openrepotools/cli.py` holds `main()`, which does what design.md
-    Decision 3 says and nothing more.
-  - Both package files open with the repository's SPDX line,
-    `# SPDX-License-Identifier: Apache-2.0`, on the lead's ruling of
-    2026-10-18. Every tracked `.py` file here does the same, and so do
-    openRepoShape v1.1.0's `__init__.py` and `_release.py`, read on
-    2026-10-18. The docstring follows on line 2, with no blank line.
-  - The stamp file, `src/openrepotools/_release.py`, is that SPDX line, then
-    one module docstring, then the five assignment lines
-    ([contracts/stamp.md](contracts/stamp.md)).
-- **Rationale**:
-  - It mirrors the model's `openreposhape.cli`.
-  - pip's console-script template then writes
-    `from openrepotools.cli import main`. That is the line design.md
-    Decision 8's pattern
-    `^from openrepotools(\.[A-Za-z_][A-Za-z0-9_]*)* import ` matches.
-  - An `__init__` with no code keeps the import of the entry point free of
-    side effects.
-- **Alternatives considered**:
-  - `openrepotools.__main__`: it would add `python -m openrepotools`, a
-    second entry the proposal does not ask for.
-  - Code in `__init__.py`: it would run on every import, including hatch's.
-
-## R2. The wheel is declarative hatchling with a written-out force-include map
-
-- **Decision**:
-  - `[tool.hatch.build.targets.wheel] packages = ["src/openrepotools"]`.
-  - `[tool.hatch.version] path = "src/openrepotools/_release.py"`, which is
-    hatch's regex version source.
-  - `[tool.hatch.build.targets.wheel.force-include]` lists the 24 entries of
-    [contracts/wheel.md](contracts/wheel.md), each written as
-    `"<P>" = "openrepotools/payload/<P>"`.
-  - There is no build hook (design.md Decision 2).
-- **Rationale**:
-  - It is the model's form.
-  - The map's keys are compared with `payload_names` by a test (FR-007), so
-    the bash list stays the only list.
-- **Alternatives considered**: a build hook that generates the map, rejected
-  by design.md Decision 2.
-
-## R3. The bash side: named functions, all in `openRepoTools`
-
-- **Decision**: the installer gains these functions. The names are fixed
-  here so that tasks touching one file in sequence agree on them.
-  - `link_resolve <path>`: design.md Decision 6's loop. It uses plain
-    `readlink`, at most 40 hops, joins a relative value to the link's own
-    directory, and canonicalises the final directory with `cd -P` and
-    `pwd -P`. It prints the canonical path, or returns 1 for a chain or a
-    cycle.
-  - `package_payload_dir`: design.md Decision 4. It prints `$SELF`'s resolved
-    directory when that directory is named `payload`, its parent is named
-    `openrepotools`, and that parent holds a regular `_release.py`.
-    Otherwise it returns 1.
-  - `stamp_read <file>`: design.md Decision 5's reader in `pin_parse`'s
-    style. It sets `STAMP_VERSION`, `STAMP_TAG`, `STAMP_COMMIT`,
-    `STAMP_DIGEST`, `STAMP_REPOSITORY` and `STAMP_STATE`
-    (`unstamped` or `stamped`) and returns 0, or sets `STAMP_WHY` and
-    returns 1.
-  - `package_init`: called once, after every function is defined and before
-    the argument loop.
-    - In package mode it sets `PACKAGE_DIR` and runs `stamp_read`.
-    - On a broken stamp it calls `die` with Decision 4's line (exit 2).
-    - Outside package mode it sets nothing.
-  - `pipx_link_match <target>`: design.md Decision 6's match. It sets
-    `PIPX_LINK`, `PIPX_VENV` and `PIPX_PAYLOAD`.
-  - `venv_shaped_link <target>`: the venv-shaped link of Decision 6, for the
-    refusal.
-  - `pip_script_is <file>`: design.md Decision 8's recognition rule.
-  - `path_report`: design.md Decision 8's report, run last in a package-mode
-    `--install`.
-- **Rationale**:
-  - `plan_install_targets`, `install_commands` and the `--version` arm read
-    these values, and each refusal stays in the planning phase.
-  - `tests/test_install_by_rename.py` already cuts a function's text out of
-    the script and runs it alone (`installer_function`). The new reader
-    tests can do the same with `stamp_read` and `link_resolve`.
-- **Alternatives considered**: a helper file beside the bash file. It would
-  be an eighteenth installable, and AGENTS.md's one-file-per-command argument
-  (`openRepoTools:255-268`) refuses that.
-
-## R4. The `--version` arm reads the stamp `package_init` already read
-
-- **Decision**:
-  - `--version` prints [contracts/cli-output.md](contracts/cli-output.md)'s
-    stamped or unstamped form when `PACKAGE_DIR` is set.
-  - Otherwise it prints today's line.
-  - It never reads an environment variable for the stamp. A test sets
-    `OPENREPOTOOLS_PACKAGE_VERSION`, `OPENREPOTOOLS_PACKAGE_TAG`,
-    `OPENREPOTOOLS_PACKAGE_COMMIT`, `OPENREPOTOOLS_PACKAGE_DIGEST` and
-    `OPENREPOTOOLS_PACKAGE_REPOSITORY` on a checkout run, and requires today's
-    line.
-- **Rationale**: bash is the one reader at run time, as D2 and design.md
-  Decision 3 require. The variable names in that test are the ones a future
-  change might reach for, so the test proves that no channel exists.
-- **Alternatives considered**: none. The spec fixes this.
-
-## R5. The count line's `<source>` and `<version>`
-
-- **Decision**:
-  - "pipx's own environment" is package mode with `PACKAGE_DIR` under
-    `$PIPX_VENV/lib/`, compared after both are canonicalised. That run
-    prints the short line.
-  - Any other run beside pipx's link adds the suffix, and its `<source>`
-    depends on how the run is installed:
-    - **in package mode** it names the run's own release,
-      `openrepotools $STAMP_VERSION`, from the stamp `package_init` already
-      read. That holds whether or not the run is inside a pipx venv, and the
-      stamp is always readable there, because a broken one refused first;
-    - **in a checkout or the one-line install** it is
-      `$PAYLOAD_REPO @ $PAYLOAD_REV` when `SOURCE_LAYOUT` is `adopted`, and
-      `$REPO @ $REF` otherwise. That is `payload_where`'s pair
-      (`openRepoTools:1023-1029`), with `@` in place of `at`;
-    - **in a local adopted source**, the code mounted in an assembly on disk
-      (`payload_local_adopted`), nothing is fetched, so neither
-      `PAYLOAD_REPO` nor `PAYLOAD_REV` is set. `install_source` then names
-      the pin's own pair, `$PIN_SOURCE_REPOSITORY @ $PIN_COMMIT`, which a
-      remote adopted run reads too, because it sets both from the pin.
-  - `<version>` is `stamp_read`'s `VERSION` for
-    `$(dirname "$PIPX_PAYLOAD")/_release.py`.
-  - When that stamp fails the reader, the clause after "not from" is `the
-    openrepotools beside pipx's link, whose stamp cannot be read`. The line
-    never reads "openrepotools an unreadable stamp".
-- **Rationale**: these are the lead's rulings 10 and 11 of 2026-10-18. A
-  package names the bytes it placed by its release. `$REPO @ $REF` would
-  claim a fetch source that a package-mode run never used.
-- **Alternatives considered**: the earlier `$REPO @ $REF` for every run
-  outside pipx's venv. That was the open LOW finding R5, now closed by the
-  ruling.
-
-## R6. pip's console script, in both forms pip writes
-
-- **Decision**: `pip_script_is` reads the first lines with `IFS= read -r`.
-  The interpreter must be a Python, in either form:
-  - **a shebang**: line 1 is `#!`, and the first word after it has a last
-    `/` segment beginning with `python`;
-  - **the `/bin/sh` trampoline**: line 1 is exactly `#!/bin/sh`, and line 2
-    is `'''exec' <python>` followed by `"$0" "$@"`. `<python>` is quoted up
-    to the next `"`, or is unquoted up to the first space, and its last
-    segment begins with `python`. Line 3 is exactly `' '''`.
-
-  Then one of the first 20 lines must match the import pattern, at column 0.
-  The check runs inside `plan_install_targets`, for a regular file (not a
-  link) at `<dir>/openRepoTools`, in every mode.
-- **Facts, read in pip 26.2.1 on 2026-10-18**:
-  - `pip/_vendor/distlib/scripts.py:180-182` writes the trampoline when the
-    interpreter's path holds a space or is longer than the shebang limit
-    (127 bytes, or 512 on macOS). `enquote_executable` quotes a spaced path.
-  - pip renders console scripts with its own `PipScriptMaker`
-    (`pip/_internal/operations/install/wheel.py:417-424`). Its template
-    writes `from <module> import <name>` at column 0, in both forms.
-    distlib's own default template indents that import, but pip does not
-    use that template.
-- **Rationale**: the lead's ruling 9 of 2026-10-18. Without the trampoline,
-  VALID 9's "never replace pip's command" misses pip's script on any
-  workstation whose Python lives on a spaced or long path.
-- **Alternatives considered**: matching an indented import as well. It is
-  not needed for pip, and it would widen the rule to other installers'
-  templates, so it was not adopted.
-
-## R7. The PATH report's `<prefix>`: five levels above `payload/`
-
-- **Decision**: `<prefix>` is the parent of the `lib/` above the payload.
-  For `<prefix>/lib/pythonX.Y/site-packages/openrepotools/payload` that is
-  five directories up from `payload/`, and the expected command is
-  `<prefix>/bin/openRepoTools`.
-- **Rationale**: the layout design.md Decision 8 writes out has five
-  components between `<prefix>` and `payload`: `lib`, `pythonX.Y`,
-  `site-packages`, `openrepotools` and `payload`. "Four levels above the
-  payload" would name `lib/`. This is an arithmetic slip, and design.md is
-  corrected in the same commit as this file.
-- **Alternatives considered**: a `..`-count computed at run time from the
-  path's shape. It is the same answer. The implementation checks that the
-  component names match (`openrepotools`, `site-packages`, `python*` and
-  `lib`) and skips the report when they do not. The skip is silent:
-  `path_report` prints nothing there, as pipx-link.md's "say nothing more"
-  and cli-output.md both say.
-
-## R8. Which tests are "the package's tests", and how they get a wheel
-
-- **Decision**: three new modules are the package's tests:
-  - `tests/test_package.py`: the metadata, the map against `payload_names`,
-    the entry module, the standard-library rule's companion checks, and the
-    built wheel;
-  - `tests/test_package_stamp.py`: the stamp reader, package mode,
-    `--version` and the broken-stamp refusal;
-  - `tests/test_install_pipx.py`: the pipx rule and its fixtures, the skip
-    and count lines, the receipt rows, coexistence, pip, the PATH report,
-    upgrade and uninstall.
-
-  The tests that need a built wheel read its path from
-  `OPENREPOTOOLS_TEST_WHEEL`, and skip naming it when it is unset. The
-  `package` job builds the wheel, sets the variable, runs the three modules
-  with `--junitxml`, and fails unless at least one test ran and none
-  skipped.
-- **Rationale**:
-  - The suite reaches no network (AGENTS.md), and building a wheel in a test
-    would fetch hatchling into pip's isolated build environment.
-  - The variable is an input, not a switch that turns a skip into a failure,
-    which design.md Decision 9 rejects. The JUnit count stays the enforcer.
-  - In the `tests` job the wheel tests skip, and every other package test
-    runs there.
-- **Alternatives considered**:
-  - A test that builds the wheel: rejected, it needs the network.
-  - Only a job step that compares the wheel with `payload_names`: rejected,
-    because design.md Decision 2 asks for a test.
-
-## R9. The workflow tests read YAML with the pinned standard's `load_yaml`
-
-- **Decision**:
-  - `tests/test_release_workflow.py` holds `release.yml` and the two hash
-    locks, and runs the workflow's stamp writer.
-  - `tests/test_tests_workflow.py` holds `tests.yml`: the triggers, the four
-    job ids and the `package` job's steps.
-  - Both load YAML with `repo_shape.load_yaml` from
-    `upstream/openRepoShape/scripts`. It exists at the current pin `7f84ca4`
-    (`scripts/repo_shape.py:624`) and at v1.1.0 (`:1050`).
-  - Both skip without the submodule, exactly as the command tests do.
-- **Rationale**:
-  - The model's `tests/test_release_workflow.py` reads its workflow that
-    way.
-  - The suite stays standard-library only, with no PyYAML.
-  - A construct outside the standard's subset then fails in the suite first.
-- **Fallback, inside the same task**: if `load_yaml` refuses a construct
-  `tests.yml` already uses, the test reads that file's lines as text for the
-  assertions it needs. It never adds a dependency.
-- **Alternatives considered**: PyYAML, rejected because the suite imports
-  only the standard library.
-
-## R10. The stamp writer is a heredoc in `release.yml`, run by the suite
-
-- **Decision**:
-  - The build's "write the stamp" step is a `python3 -I - <a> <b> <<'PY'`
-    heredoc, as the model's is (`release.yml:493-523` at v1.1.0).
-  - It is adapted to five fields, with `REPOSITORY` taken from
-    `$GITHUB_REPOSITORY`.
-  - It replaces each of the five committed lines exactly once, refuses a
-    file already stamped, and refuses a value no release carries.
-  - `tests/test_release_workflow.py` extracts that heredoc the way the
-    model's `heredoc()` does, and runs it on a copy of the committed
-    `_release.py`. It reads the result back through `stamp_read`, in a fake
-    package layout, by `--version`.
-- **Rationale**: FR-013 needs one writer that the reader is tested against,
-  and design.md Decision 5 asks that the test use "the build's writer".
-- **Alternatives considered**: a writer script under `.github/`. It would be
-  a new file the proposal's Impact list does not name, and a second place
-  for release logic.
-
-## R11. The hash locks are the model's, re-headed
-
-- **Decision**:
-  - `.github/release-build-requirements.txt` and
-    `.github/release-pipx-requirements.txt` take the model's files at
-    v1.1.0. The lines below each header stay byte for byte.
-  - Each header is rewritten for this repository and #228. It keeps the
-    resolving command, `uv pip compile`, uv 0.12.18, `--exclude-newer
-    2026-10-01T00:00:00Z`.
-  - The build lock pins `hatchling==1.27.0`, which is `pyproject.toml`'s
-    pin.
-  - The pipx lock gives pipx 1.11.1 below Python 3.10 and 1.17.8 from 3.10.
-- **Rationale**:
-  - These are the tools the model's release used, from PyPI as it stood
-    then.
-  - A copy is reproducible from its own header, and it adds no resolution
-    nobody reviewed.
-- **Alternatives considered**: a fresh resolution with a later date. It is
-  allowed later as its own act, as the header says.
-
-## R12. The `package` job's test tools
-
-- **Decision**:
-  - The job installs `tomli==2.4.1` first, by hash, with
-    `--require-hashes --only-binary=:all:`.
-  - The step does not copy any digest. It extracts the build lock's whole
-    `tomli` entry, the `tomli==2.4.1 ; python_full_version < '3.11'` line
-    with every `--hash` line under it, into a requirements file under
-    `$RUNNER_TEMP`. At v1.1.0 that entry has one hash per platform wheel,
-    39 or more of them.
-  - Then it installs `pytest==8.3.4`, as the other jobs do. pip keeps the
-    hashed `tomli`, which satisfies pytest's requirement on Python below
-    3.11.
-  - A test holds that the step reads its `tomli` entry from the build lock,
-    and that the job holds no `--hash` of its own.
-- **Rationale**:
-  - design.md Decision 9 asks for tomli at a pinned version, by hash,
-    beside pytest.
-  - The proposal's file list adds no third lock.
-  - Extracting the entry, rather than copying one digest, keeps the job free
-    of a digest of its own. It does not make the build lock the only record
-    of tomli's digests: the pipx lock carries the same entry, byte for byte,
-    and step 7 installs that lock after step 4's tomli, so the package tests
-    run on the pipx lock's tomli. The two locks' entries must move together,
-    re-resolved in one act, as the build lock's header says.
-- **Alternatives considered**: a third lock file, rejected as a file nothing
-  else needs.
-
-## R13. The `package` job's checks are inline, and so are the release build's
-
-- **Decision**:
-  - Each workflow carries its own wheel check: the blob and mode check, the
-    module check, the stamp check and the `.dist-info` set.
-  - The `package` job builds from the checkout, with `pip wheel --no-deps`
-    twice and `SOURCE_DATE_EPOCH` at the commit's time. The release build
-    builds from two `git archive` extractions.
-  - A test holds the two workflows' `.dist-info` sets to the same five names.
-- **Rationale**:
-  - These are the model's two forms.
-  - A shared script would be read across jobs, and the release build's
-    checks must not depend on a file the `package` job also runs.
-- **Alternatives considered**: one script under `.github/`, rejected as R10's
-  is.
-
-## R14. The `package` job's install run
-
-- **Decision**:
-  - pipx comes from `.github/release-pipx-requirements.txt` by hash, which
-    gives 1.11.1 on 3.9.
-  - `PIPX_HOME` and `PIPX_BIN_DIR` sit under `$RUNNER_TEMP`, and
-    `OPENREPOTOOLS_BIN_DIR` equals `PIPX_BIN_DIR`, so pipx's link is the
-    installer's `<dir>/openRepoTools`.
-  - `HOME` is a fresh directory under `$RUNNER_TEMP`.
-  - The run has these settings:
-    - `OPENREPOTOOLS_REPO=offline.invalid/sentinel`;
-    - a `PATH` holding a `gh` and a `curl` that both exit 1;
-    - the runner's `jq`.
-  - The step compares the unstamped `--version`, the skip line and the count
-    line with [contracts/cli-output.md](contracts/cli-output.md) exactly.
-- **Rationale**: design.md Decision 9 and the proposal's offline install. The
-  sentinel only needs to fail if anything fetches. `.invalid` is the
-  reserved name that never resolves.
-- **Alternatives considered**: none.
-
-## R15. The v1.0.0 notes are fetched once, and checked by the task
-
-- **Decision**:
-  - `docs/release-notes/v1.0.0.md` is the output of
-    `gh release view v1.0.0 --repo opensoft/openRepoTools --json body --jq .body`,
-    unchanged.
-  - The task's verify command runs the same command and compares the two
-    with `cmp`.
-  - The suite does not repeat the check, because it reaches no network.
-- **Rationale**: the spec's "byte for byte as `gh release view v1.0.0`
-  returns it". One command both writes the file and checks it, so the two
-  cannot disagree about a trailing newline.
-- **Alternatives considered**: a suite test with a recorded body. That would
-  compare the file with itself.
-
-## R16. Line caps move by dated entries
-
-- **Decision**:
-  - At this branch's base `aaa7bc8`, README.md is 485 lines against a cap of
-    486 (`tests/test_repo_hygiene.py:2253`), and AGENTS.md is 314 against 316
-    (`:1748`).
-  - `main` has moved since. At `83d2690` (2026-10-18), AGENTS.md is 321
-    against 323, and README is still 485 against 486. The tests are
-    `test_agents_md_is_short_enough_to_be_read` and
-    `test_readme_is_short_enough_to_be_read`, wherever they now sit.
-  - tasks.md has the branch brought up to `main` before Phase 1.
-  - Each file's change is cut to the fewest lines that carry its facts. Where
-    a cap still moves, the move goes in that test's docstring as a dated
-    entry, in that test's own form. It names the lines and why, and states
-    the assembly root's cap beside it.
-- **Rationale**: those two tests require exactly this.
-- **Alternatives considered**: none.
-
-## R17. Two slips in design.md, corrected
-
-- **Decision**:
-  - Decision 8's `<prefix>`: "four levels" becomes "five levels above
-    `payload/`, the parent of its `lib/`" (R7).
-  - Decision 4's refusal names `pipx reinstall openrepotools` already, by the
-    lead's ruling 3, which Step 0 recorded. Nothing further is needed there.
-- **Rationale**: an analysis across the artifacts would otherwise find the
-  plan and design.md in disagreement.
-- **Alternatives considered**: leaving design.md as it was. That was
-  rejected, because the plan would then contradict the decision it
-  implements.
-
-## R18. Where the gates come from: no ratified constitution
-
-- **Decision**:
-  - `.specify/memory/constitution.md` is the unfilled Spec Kit template, so
-    it states no principle a gate could check.
-  - The plan's gates are AGENTS.md's rules, the governed-invariant rule of
-    the Speckit protocol, and the governing change's constraints.
-- **Rationale**: the plan template's gate is "determined based on
-  constitution file". With no principles, the plan must name the rules it
-  does hold itself to.
-- **Alternatives considered**: writing a constitution. That is
-  `/speckit.constitution`'s act, and outside this feature.
-
-## R19. The repository guard on the uploads
-
-- **Decision**: the build's first step decides which indexes this run may
-  reach. It reads `$GITHUB_REPOSITORY`, `$GITHUB_REF` and `$VERSION`, and
-  follows contracts/workflows.md's table:
-  - in `opensoft/openRepoTools`, a pre-release goes to TestPyPI, and a final
-    is refused;
-  - in `opensoft/openRepoTools-code`, a pre-release goes to TestPyPI and a
-    final to both indexes;
-  - in any other repository, a tag dispatch is refused;
-  - a branch dispatch is the rehearsal everywhere, and uploads nothing.
-
-  It records `to-testpypi` and `to-pypi`, and each upload job's `if:` reads
-  them. Each upload job's first step runs its own half of the rule again.
-- **Rationale**:
-  - This is the lead's ruling of 2026-10-18, which puts Brett Heap's
-    answers 2 and 3 into code.
-  - Deciding in `build`, which has no environment, means a run that may not
-    upload is refused before anyone is asked to approve a deployment.
-  - The checks in the jobs' own steps hold if a condition is ever loosened.
-  - The missing pypi.org publisher for `opensoft/openRepoTools` stays as the
-    second line of defence.
-- **Model**: openRepoShape v1.1.0's `release.yml` carries no repository
-  comparison, and neither does any of its workflows on its `main` as of
-  2026-10-18. Its uploads rest on the environments' tag limits and on the
-  publishers. This guard is new here, specified on the lead's ruling, not
-  copied.
-- **Alternatives considered**: guarding only inside the upload jobs. That
-  would ask Brett Heap to approve a deployment that then refuses, so it was
-  rejected as the only guard, and kept as the second check.
-
-## R20. The version a branch rehearsal builds with
-
-- **Decision**: a branch rehearsal is dispatched with the version of the tag
-  it rehearses. Before v1.1.0 that is the next pre-release, `1.1.0rc1` for
-  the first.
-- **Rationale**:
-  - The model rehearsed v1.1.0 from its branch `l3-rehearsal-v1.1.0`. Its
-    branch rehearsals build the version about to be tagged.
-  - FR-033 forbids `1.1.0` for any rehearsal, so the rc stands in for it.
-  - A branch rehearsal uploads nothing, so reusing an rc number spends
-    nothing.
-- **Alternatives considered**: a fixed throwaway version, such as `0.0.1`.
-  It would not rehearse the stamp and `--version` of the release to come.
-
diff --git a/specs/006-release-pypi/spec.md b/specs/006-release-pypi/spec.md
deleted file mode 100644
index 64dc72b3..00000000
--- a/specs/006-release-pypi/spec.md
+++ /dev/null
@@ -1,955 +0,0 @@
-# Feature Specification: Release tags, release branches and the `openrepotools` package on PyPI
-
-**Feature Branch**: `006-release-pypi`
-
-**Created**: 2026-10-17
-
-**Status**: Draft
-
-**Input**: User description: the OpenSpec change `release-tags-pypi`, for
-opensoft/openRepoTools#228. Brett Heap, 2026-10-17: "lets setup tagging and
-release branches. we will publish on pypi. lets assume we are currently on
-1.0.0 and we will do our first real release on pypi with v1.1.0. look at the
-way we did this for openRepoShape and lets do similar."
-
-**Governance**: this is the one Speckit feature of that change. Its sources,
-and the only scope it takes, are:
-
-- [proposal.md](../../openspec/changes/release-tags-pypi/proposal.md), with
-  Brett Heap's decisions and his answers of 2026-10-17T21:51:50Z;
-- [clarifications.md](../../openspec/changes/release-tags-pypi/clarifications.md),
-  the council's constraints N1 to N5 and its dismissals D1 to D3;
-- [design.md](../../openspec/changes/release-tags-pypi/design.md), with the
-  lead's rulings of 2026-10-17 in its Open Questions;
-- the two delta specs,
-  [release-tags-and-branches](../../openspec/changes/release-tags-pypi/specs/release-tags-and-branches/spec.md)
-  and [pypi-package](../../openspec/changes/release-tags-pypi/specs/pypi-package/spec.md).
-
-**What this feature builds**: what lands in `opensoft/openRepoTools` by pull
-request. That is the package, the installer's changes, the tests, the
-`package` CI job, the release workflow and its hash locks, the release notes,
-and the README and AGENTS.md corrections. It builds no act outside the
-repository. Brett Heap makes those acts, or lane openRepoTools-3 makes them on
-his word, and the change's `tasks.md` tracks them:
-
-- the GitHub environments and rulesets;
-- the trusted publishers;
-- every tag, dispatch, upload, GitHub Release and release-branch cut;
-- the assembly's README pull request after v1.1.0;
-- the workBenches issue.
-
-## User Scenarios & Testing *(mandatory)*
-
-The terms used below:
-
-- **`<dir>`** is `$OPENREPOTOOLS_BIN_DIR`, by default `~/.local/bin`.
-- **The package** is the `openrepotools` wheel.
-- **Package mode** is the installer run from inside an installed package.
-- **pipx's link** is the `<dir>/openRepoTools` that pipx places. FR-015
-  defines it exactly.
-
-### User Story 1 - Install the toolset from the package, offline (Priority: P1)
-
-A person installs `openrepotools` with pipx, then runs
-`openRepoTools --install`. The install takes everything from inside the
-package and reaches no network. pipx keeps its own `openRepoTools` command,
-and the install places every other artifact.
-
-**Why this priority**: decision 3 is that the wheel carries the whole tool
-payload and installs offline. Every other story stands on a package that
-installs.
-
-**Independent Test**: build the wheel and install it with pipx into a
-temporary pipx home. Then run `--install` into a temporary home with every
-network path refused. The pipx-link behaviour can also be tested alone, on
-fake venv layouts, with no pipx and no wheel.
-
-**Acceptance Scenarios**:
-
-1. **Given** the package installed by pipx, which placed exactly one command,
-   pipx's link, **When** `openRepoTools --install` runs with a sentinel
-   `$OPENREPOTOOLS_REPO`, no `gh` and a `curl` that fails, **Then** it
-   succeeds, and:
-   - it prints the skip line exactly (FR-016);
-   - it places the other sixteen files, the three skills and the three
-     command files;
-   - it adds the two hook entries once `~/projects/xFactory/lanes-edit.sh`
-     answers `guard`, and until then defers them and says so (#237);
-   - it prints `openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx`;
-   - it writes 28 receipt rows;
-   - it leaves the link as it was.
-2. **Given** pipx's venv laid out as pipx 1.11.1, 1.17.8 or 1.18.3 lays it
-   out, under `$PIPX_HOME`, `~/.local/pipx`, `~/.local/share/pipx` or a home
-   whose path holds a space, **When** `--install` runs, **Then** the link is
-   recognised the same way in every case.
-3. **Given** `<dir>/openRepoTools` links into a venv that has no
-   `openrepotools` payload, or no `pipx_metadata.json`, or a target not under
-   `bin/`, **When** `--install` runs, **Then** it refuses before placing
-   anything.
-4. **Given** any target other than pipx's link is a symbolic link, **When**
-   `--install` runs, **Then** it refuses, names that link, and places
-   nothing.
-5. **Given** no `jq` on `PATH` and pipx's link in place, **When** `--install`
-   runs, **Then** it refuses for want of `jq`, and its output advises no `rm`
-   of pipx's link.
-6. **Given** the console script, **When** the payload refuses the person's
-   arguments, **Then** the exit status and the message are the payload's
-   own.
-7. **Given** the console script, **When** a package-mode `--install` is
-   interrupted by a signal while it is placing a file, **Then** no temporary
-   placement file is left beside the target.
-8. **Given** no `bash` on `PATH`, **When** the console script runs, **Then**
-   it refuses, naming `bash`, and nothing else runs.
-9. **Given** the package, **When** `wip init` runs from it, **Then** it reads
-   the openRepoShape pin packaged with the release.
-
----
-
-### User Story 2 - Know which release is running (Priority: P1)
-
-A person runs `openRepoTools --version`. From a release, it names the
-release: the version, the tag, the commit, the tree digest and the
-repository it was built from. From a package built outside a release, it says
-so. From a checkout or a one-line install, it prints what it prints today.
-A package whose stamp is broken refuses to run at all.
-
-**Why this priority**: "a workstation cannot say which release it runs" is the
-first problem the proposal names. A wrong answer is worse than none.
-
-**Independent Test**: build fake package layouts, each with a stamp file, and
-run `--version`, `--help` and `--install` against each.
-
-**Acceptance Scenarios**:
-
-1. **Given** the v1.1.0 package from `openRepoTools-code`, **When**
-   `--version` runs, **Then** it prints exactly five lines. The first is
-   `openRepoTools 1.1.0 (opensoft/openRepoTools-code @ <commit>)`. The other
-   four are the version, the tag `v1.1.0`, the commit and the digest
-   (FR-014).
-2. **Given** an unstamped package, as the `package` job builds it, **When**
-   `--version` runs, **Then** it prints the five unstamped lines exactly
-   (FR-014).
-3. **Given** a checkout or a one-line install, **When** `--version` runs,
-   with or without any `OPENREPOTOOLS_PACKAGE_*` variable set, **Then** it
-   prints exactly `openRepoTools (<repo> @ <ref>)`, as today.
-4. **Given** a package whose stamp has a commit but no digest, or breaks the
-   all-or-nothing rule in any other way, **When** any invocation runs, such
-   as `--version`, `--help` or `--install`, **Then** it refuses with exit 2.
-   The refusal names the stamp file and the fix,
-   `pipx reinstall openrepotools`, and prints no version.
-5. **Given** a well-stamped package, **When** `--help`, `--install --version`
-   or an unknown argument is given, **Then** it behaves as a checkout does.
-6. **Given** the stamp that the release build's writer produces, **When** the
-   command reads it, **Then** it reads the same five values. The build
-   backend's version reader and the command read the same `VERSION`.
-
----
-
-### User Story 3 - Move between installers without being misled (Priority: P2)
-
-A workstation can carry pipx's command next to the one-line install, a
-checkout's `--install`, pip, or workBenches' `./setup.sh`. Each pairing has
-one defined outcome. None may leave a person believing they run a release
-while they track `main`.
-
-**Why this priority**: this is the failure the Why exists to prevent. It
-matters only once the package exists (User Stories 1 and 2).
-
-**Independent Test**: fake layouts for each pairing: a one-line install, a
-checkout, pip's console script, two wheels in turn, a removed venv, and a
-`PATH` that shadows the package.
-
-**Acceptance Scenarios**:
-
-1. **Given** a one-line install, then pipx's link in its place as
-   `pipx install --force` leaves it, **When** `--install` runs from the venv's
-   payload, **Then** the link is skipped and the other sixteen are replaced
-   with the package's.
-2. **Given** pipx's link, **When** a checkout's or the one-line install's
-   `--install` runs, **Then** it skips the link and places the other sixteen
-   from its own source. Its count line names that source, as
-   `<repo> @ <ref>`, and the version of the stamp beside the link's payload
-   (FR-019).
-3. **Given** `<dir>/openRepoTools` is the regular file that
-   `pip install --user openrepotools` writes, in either form pip writes
-   (a Python shebang, or the `/bin/sh` trampoline for a long or spaced
-   interpreter path), **When** `--install` runs in any mode, pip's own
-   included, **Then** it refuses with the exact refusal, names
-   the file as pip's console script, and places nothing (FR-020).
-4. **Given** a finished package-mode `--install`, **When** the first
-   `openRepoTools` on `PATH` is an older bash file in another directory, or
-   pipx's bin directory differs from `$OPENREPOTOOLS_BIN_DIR`, or there is
-   none, **Then** it prints the exact note naming the `openRepoTools` the
-   shell will run and the one it expected. The exit status does not change
-   (FR-021).
-5. **Given** one wheel installed with `--install`, **When** pipx upgrades it
-   to a second and `--install` runs again, **Then** the second wheel's files
-   replace the sixteen, and the link is still skipped.
-6. **Given** pipx's link and its environment are removed, **When** the person
-   looks, **Then** the sixteen files are still there. A checkout's
-   `--install` then places a regular file at `<dir>/openRepoTools`.
-7. **Given** pipx's link, **When** a package-mode `--install` runs from a
-   package outside pipx's venv, **Then** its count line names
-   `openrepotools <its version>` as the source, never `<repo> @ <ref>`
-   (FR-019).
-
----
-
-### User Story 4 - Every commit proves it packages (Priority: P2)
-
-The release gate trusts only a commit whose own CI ran and passed. That CI
-must therefore build the package, check it against the commit, install it
-and run its tests, on every push to `main` and to every release branch.
-
-**Why this priority**: the release workflow (User Story 5) refuses a commit
-without a green `package` job. Without this story there is no release.
-
-**Independent Test**: push a commit to a branch that `tests.yml` runs on, and
-read the `package` job. Push a tree that has no `LICENSE`, or a payload file
-that differs from its blob, and see the job fail.
-
-**Acceptance Scenarios**:
-
-1. **Given** a commit pushed to `release/v1.1`, **When** CI runs, **Then** a
-   `tests.yml` push run runs `guard-launch-mode`, `tests`,
-   `tests-no-submodule` and `package` on that commit.
-2. **Given** the `package` job, **When** it builds the wheel twice at the
-   commit's time, **Then** the two are one file, and:
-   - every packaged payload file equals the commit's blob, in bytes and in
-     mode;
-   - the `.dist-info` holds exactly the five names, with the commit's
-     `LICENSE`.
-3. **Given** a tree with no `LICENSE`, **When** the `package` job runs,
-   **Then** it fails.
-4. **Given** the `package` job's unstamped wheel installed with pipx,
-   **When** it runs `--version`, and then an offline `--install` into a
-   temporary home with pipx's link in place, **Then** the unstamped lines,
-   the skip line and the count line are exact.
-5. **Given** the package's tests, **When** one of them reports skipped, or
-   none is collected, **Then** the job fails.
-
----
-
-### User Story 5 - Publish a release only through gates (Priority: P2)
-
-The release owner dispatches the release workflow on an annotated tag. It
-builds the wheel reproducibly from that commit and uploads it to TestPyPI.
-It checks the install on three platforms, then uploads to PyPI. Each step
-waits for Brett Heap's approval, and every check runs again where it can.
-Nothing uploads from anywhere else, or by any other means.
-
-**Why this priority**: this is how v1.1.0 reaches PyPI. Its real uploads wait
-for the cutover and for Brett Heap's acts, but the workflow lands now and is
-rehearsed now.
-
-**Independent Test**: dispatch it on a branch, which is the branch rehearsal.
-Every build check and the install check run, and no upload job runs. The
-workflow's file is also checked offline by the suite, which runs the
-workflow's stamp writer.
-
-**Acceptance Scenarios**:
-
-1. **Given** a dispatch on a lightweight tag, or on an annotated tag whose
-   object names a different commit, **When** the build runs, **Then** it
-   refuses, and nothing is built or uploaded.
-2. **Given** the newest finished `tests.yml` run on the commit failed, or
-   one is still running, **When** the build runs, **Then** it refuses.
-3. **Given** the pinned openRepoShape digests by a definition other than
-   `sorted-ls-tree-r-v1`, **When** the build runs, **Then** it refuses, and
-   no wheel is uploaded with a wrong label.
-4. **Given** the two builds are not byte-identical, **When** the build ends,
-   **Then** nothing is uploaded.
-5. **Given** the index already holds a file of the version other than the
-   verified wheel at its recorded digest, or holds that wheel yanked,
-   **When** an upload job runs, **Then** it refuses before uploading.
-   **Given** the index holds only the verified wheel at its recorded
-   digest, not yanked, as after an upload that went through, **When** the
-   failed upload job is re-run, **Then** it does not refuse, and the upload
-   adds nothing new.
-6. **Given** `1.1.0rc1` dispatched on its annotated tag in
-   `opensoft/openRepoTools`, with the `testpypi` deployment approved,
-   **When** the run proceeds, **Then** it reaches TestPyPI and the install
-   check, and the `pypi` job is skipped.
-7. **Given** a dispatch on a branch, **When** the run proceeds, **Then** every
-   build check and the install check run, and no upload job runs.
-8. **Given** a final `X.Y.Z` dispatched on its tag in
-   `opensoft/openRepoTools`, or any version dispatched on a tag in a
-   repository other than `opensoft/openRepoTools` and
-   `opensoft/openRepoTools-code`, **When** the build runs, **Then** it
-   refuses before any approval is asked, and nothing is uploaded (FR-048).
-9. **Given** an upload job and no approval for its environment, **When** the
-   run reaches it, **Then** the job waits, and nothing is uploaded.
-10. **Given** the macOS leg of the install check, **When** it reruns
-    `--install` under `/bin/bash`, **Then** it prints a `BASH_VERSION` of
-    3.2, and the install succeeds with the same skip and count lines.
-
----
-
-### User Story 6 - The record tells the truth about releases (Priority: P3)
-
-A reader of the repository learns how releases work, and finds each one's
-notes, without being offered anything that is not published. The documents
-cover the tags, the release branches, the back-ports and the patch tags.
-
-**Why this priority**: the procedure and the documents follow the mechanisms.
-They are what a person reads, so they must not run ahead of what exists.
-
-**Independent Test**: compare the v1.0.0 notes with the published Release
-body. Then read README for the version paragraph, the three corrected
-passages, and the absence of the pipx route.
-
-**Acceptance Scenarios**:
-
-1. **Given** `docs/release-notes/v1.0.0.md`, **When** it is compared with the
-   body `gh release view v1.0.0` returns, **Then** the two are identical.
-2. **Given** README, **When** PyPI does not serve `openrepotools` 1.1.0,
-   **Then** README has no `pipx install openrepotools` line.
-3. **Given** README's version paragraph, **When** it is read, **Then** it
-   says that:
-   - releases are annotated tags;
-   - the version comes only from the tag;
-   - it shows what `--version` prints, stamped and unstamped.
-4. **Given** a workstation with pipx's link, **When** README's file count,
-   symlink paragraph and artifact-count invariant are read, **Then** they say
-   what that workstation sees: sixteen placed and one left to pipx, pipx's
-   `openRepoTools` the one link skipped, and twenty-eight artifacts placed
-   always, one left to pipx and 28 receipt rows, with the two hook entries
-   on top once the path they call answers `guard` (#237).
-5. **Given** a later release is tagged, **When** `v1.0.0` is read, **Then** it
-   still names tag object `6a826f8` on commit `aaa7bc8`.
-6. **Given** a fix lands on `main` after work for the next minor version,
-   **When** it is back-ported, **Then** it reaches `release/v1.1` only by a
-   pull request of `git cherry-pick -x <squash commit>`.
-
----
-
-### Edge Cases
-
-- **A chain of links or a cycle.** A chain longer than the design's hop limit
-  (40), or a cycle, is not pipx's link. It is refused as any other link is.
-- **A future pipx layout.** A link into a directory that looks like a venv
-  (it holds `pyvenv.cfg`) but fails the pipx rule is refused. The refusal
-  calls it "a link into a Python environment, perhaps pipx's". It prints no
-  `rm` for it, names `pipx reinstall openrepotools`, and asks for an issue
-  with the layout. This keeps the person from deleting the only working
-  command.
-- **The stamp beside another install's payload.** When that stamp fails the
-  reader, the count line says the other 16 do not come from "the openrepotools
-  beside pipx's link, whose stamp cannot be read". The install goes on,
-  because the stamp belongs to another install.
-- **A carriage return, a repeated name or an unclosed docstring in the
-  stamp.** Each is refused with its own reason, as a broken build.
-- **A docstring line that the build backend could read as the version.** It
-  is refused, so the backend and the command never disagree.
-- **A plain `pipx install` over the one-line install's file.** pipx only
-  warns and places no link. No package-mode run happens, so no report can
-  appear. README gives `pipx install --force` for that reason.
-- **`git archive` changing bytes through `.gitattributes`.** The blob check
-  compares every packaged file with the commit's blob, so the build refuses
-  and never ships. An `export-ignore` on a payload path fails the
-  wheel-against-payload-list test.
-- **A job id renamed in the code leg's `tests.yml`.** The gate finds no run
-  of that job and refuses.
-- **A later pin that changes the digest definition.** The build refuses
-  rather than ship a wrong label.
-- **The version `0.0.0`, and a pre-release at the `pypi` job.** The version
-  `0.0.0` is refused. A pre-release never reaches the `pypi` job: the job is
-  skipped for one, and its first step refuses one if it ever starts.
-- **A rehearsal that would use `1.1.0`.** It is ruled out: an index never
-  takes a file name twice, and v1.1.0 is later built from another commit.
-
-## Requirements *(mandatory)*
-
-### Functional Requirements
-
-#### The package
-
-- **FR-001**: The package MUST meet all of these:
-  - it is named `openrepotools` and requires Python 3.9 or later;
-  - it declares no dependencies, exactly one console script,
-    `openRepoTools`, and the licence `Apache-2.0` with the file `LICENSE`;
-  - it declares no `readme`;
-  - its version is read only from the package's stamp.
-
-  A test MUST hold `dependencies` empty, the scripts table to that one
-  entry, and the `readme` key absent.
-- **FR-002**: The wheel's `.dist-info` MUST hold exactly `METADATA`, `WHEEL`,
-  `RECORD`, `entry_points.txt` and `licenses/LICENSE`, and that `LICENSE`
-  MUST be the commit's.
-  - The `package` job and the release build MUST refuse any other wheel,
-    including one built from a tree that has no `LICENSE`.
-  - The package MUST NOT be made to tolerate a missing `LICENSE`.
-- **FR-003**: The console script MUST replace its own process with the first
-  `bash` on `PATH`. That bash runs the packaged `openRepoTools` with the
-  person's arguments unchanged. Signals, the exit status and the payload's
-  clean-up on exit MUST pass through as if the person had run the payload
-  with bash directly. The console script MUST pass bash nothing beyond the
-  arguments, and MUST NOT read the stamp. It MUST put back the signals
-  Python ignores at startup, SIGPIPE and SIGXFSZ, before the exec. The one
-  exception it MAY leave is Python's own locale coercion (PEP 538): under a
-  C or POSIX locale bash also sees `LC_CTYPE=C.UTF-8`, which
-  `PYTHONCOERCECLOCALE=0` avoids (design.md Decision 3, amended
-  2026-10-18).
-- **FR-004**: With no `bash` on `PATH`, the console script MUST refuse with
-  exit 2 and a message naming `bash`, and MUST run nothing.
-- **FR-005**: The package's Python modules MUST import only the standard
-  library. A hygiene test MUST fail when one imports anything else. The
-  existing compile test MUST compile them too.
-- **FR-006**: The wheel MUST hold each of these at
-  `openrepotools/payload/<path>`, every one byte-identical to the commit's
-  blob and with the commit's mode (`100755` or `100644`):
-  - every file the installer's payload list names: the seventeen
-    installables (sixteen commands and `repos.tsv`), the three skills and
-    the three command files;
-  - and `contracts/openreposhape-pin.yaml`.
-- **FR-007**: The installer's payload list MUST stay the only list of payload
-  files. A test MUST fail, naming the file, when a file is in that list but
-  missing from the wheel's declared contents or from the built wheel, or the
-  other way round.
-- **FR-008**: The install from the package MUST need no network.
-  - After `pipx install` of the wheel, `openRepoTools --install` MUST place
-    every artifact and write every receipt row from the payload inside the
-    package, with every network path refused.
-  - The result MUST be the same as an install from beside a full checkout,
-    except for pipx's link.
-  - `wip init` run from the package MUST read the release's own openRepoShape
-    pin.
-
-#### The stamp and `--version`
-
-- **FR-009**: The committed stamp MUST be unstamped: `VERSION` is `0.0.0`,
-  and `TAG`, `COMMIT`, `DIGEST` and `REPOSITORY` are empty.
-  - Only the release build MUST write a stamp. It writes the version taken
-    from the tag, the tag, the tag's 40-hex commit, that commit's
-    `sorted-ls-tree-r-v1` tree digest, and the release run's source
-    repository.
-  - No other file MUST carry a version number.
-- **FR-010**: The stamp MUST be all or nothing.
-  - It is unstamped when `TAG`, `COMMIT` and `DIGEST` are all empty, and then
-    `VERSION` MUST be `0.0.0` and `REPOSITORY` empty.
-  - Otherwise every field MUST be set, and:
-    - `VERSION` is a final `X.Y.Z`, or a pre-release `X.Y.ZrcN`, and is not
-      `0.0.0`;
-    - `TAG` is exactly `v<VERSION>`;
-    - `COMMIT` is 40 lowercase hex digits and `DIGEST` is 64;
-    - `REPOSITORY` is an owner/name slug.
-  - Any other stamp MUST be refused as a broken build, and never read as the
-    part it holds.
-- **FR-011**: The command MUST read the stamp only from the package's own
-  stamp file, beside its payload directory.
-  - It reads it by a fixed grammar, and never sources, imports or runs it.
-  - The reader MUST hold to bash 3.2.
-  - The command MUST trust no environment variable for the stamp.
-  - The reader MUST refuse each of these, each with its own reason: an
-    unreadable file, a carriage return, a missing, repeated or unknown name,
-    a partial stamp, and a malformed field.
-- **FR-012**: In package mode the command MUST read its stamp before it acts
-  on any argument. A broken stamp MUST refuse every invocation, `--help`
-  included, with exit 2. The refusal MUST name the stamp file and the fix,
-  `pipx reinstall openrepotools`.
-- **FR-013**: Readers and writer MUST agree.
-  - The release build's stamp writer and the command's reader MUST agree, and
-    a test MUST pass the writer's output through the reader.
-  - The build backend's version reader and the command's reader MUST read the
-    same `VERSION` from the committed stamp and from a stamped one.
-- **FR-014**: `--version` MUST print exactly:
-  - from a stamped package:
-
-    ```text
-    openRepoTools <version> (<repository> @ <commit>)
-      version   <version>
-      tag       <tag>
-      commit    <commit>
-      digest    <digest> (sorted-ls-tree-r-v1)
-    ```
-
-  - from an unstamped package:
-
-    ```text
-    openRepoTools 0.0.0 (an unstamped package)
-      version   0.0.0, unstamped: a package built from a checkout, not a release
-      tag       none
-      commit    none
-      digest    none
-    ```
-
-  - from a checkout or the one-line install, what it prints today:
-    `openRepoTools (<repo> @ <ref>)`. The existing assertions stay as they
-    are, and only their docstring, which says "no version number", is
-    rewritten.
-
-  In a package whose stamp passes FR-010, `--help`, `--install --version`
-  and the parser's refusals MUST behave as they do in a checkout. A broken
-  stamp refuses all of them first (FR-012). `--version` names the command's
-  release, not the release of the files `--install` placed.
-
-#### `--install` and pipx
-
-- **FR-015**: `<dir>/openRepoTools` MUST be treated as pipx's link only when
-  all of these hold:
-  - it is a symbolic link;
-  - it resolves to a regular file `<venv>/bin/openRepoTools`;
-  - that `<venv>` holds a `pipx_metadata.json`, and an
-    `openrepotools/payload/` tree in its `lib/python*/site-packages/`.
-
-  The check:
-  - MUST use only paths and the existence of files;
-  - MUST parse no JSON and need no `jq`;
-  - MUST NOT depend on `PIPX_HOME`;
-  - MUST hold under bash 3.2;
-  - MUST hold in every mode: the package's own `--install`, a checkout's and
-    the one-line install's;
-  - MUST be decided before any link refusal.
-- **FR-016**: On pipx's link, `--install` MUST skip that one target and print
-  exactly
-  ``openRepoTools: left to pipx at <dir>/openRepoTools (a link into pipx's openrepotools environment); update it with `pipx upgrade openrepotools`, then run `openRepoTools --install` again``.
-  - It MUST place every other artifact.
-  - It MUST write no receipt row for the link: 28 rows, against a full
-    install's 29.
-  - Run from pipx's own environment, its count line MUST be exactly
-    `openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx`.
-  - No install, and no retirement, MUST ever remove, replace or write through
-    pipx's link.
-- **FR-017**: Every other link at a target MUST still refuse the whole install
-  before anything is placed, and no refusal MUST advise removing pipx's
-  link. A venv-shaped link that fails FR-015 MUST be refused in these terms:
-  - the refusal calls it "a link into a Python environment, perhaps pipx's";
-  - it prints no `rm` for that link;
-  - it names `pipx reinstall openrepotools`;
-  - it asks for an issue with the layout.
-- **FR-018**: The `jq` check MUST stay where it is, after the targets are
-  asked about. With no `jq` and pipx's link in place, the run MUST refuse for
-  want of `jq` and print no `rm` for the link.
-- **FR-019**: Any `--install` that meets pipx's link and does not run from
-  pipx's own environment MUST skip the link. That covers a checkout's, the
-  one-line install's, and a package-mode run outside pipx's venv. Its count
-  line MUST be exactly
-  `openRepoTools: 16 of 17 placed in <dir>, and 1 left to pipx; the other 16 now come from <source>, not from openrepotools <version>`.
-  - `<source>` is `<repo> @ <ref>`, the source the run collected from, for
-    a checkout or the one-line install.
-  - A package-mode run names its own release as `<source>`:
-    `openrepotools <its version>`, from its own stamp.
-  - `<version>` is the stamp beside the link's payload, read as `--version`
-    reads it, and `0.0.0` when that stamp is unstamped.
-  - When that stamp fails the reader, the clause after "not from" MUST
-    instead be `the openrepotools beside pipx's link, whose stamp cannot be
-    read`, and the install goes on. The line never says "openrepotools an
-    unreadable stamp".
-- **FR-020**: In every mode, `--install` MUST refuse to replace a regular file
-  at `<dir>/openRepoTools` that is pip's console script for openrepotools.
-  - The refusal MUST come in the planning phase, so nothing is placed.
-  - Its text MUST be design.md Decision 8's: it names the file as pip's
-    console script, says nothing was installed, and names pipx as the way
-    out.
-  - Such a script is recognised by its interpreter being a Python, together
-    with the import of the `openrepotools` entry point that pip's
-    console-script template writes. The interpreter is recognised in either
-    of the two forms pip writes:
-    - a first line `#!` naming a Python;
-    - pip's `/bin/sh` trampoline, which pip writes when the interpreter's
-      path holds a space or is too long for a shebang: a first line
-      `#!/bin/sh`, whose next line `exec`s a Python.
-- **FR-021**: Once a package-mode `--install` has placed its files, it MUST
-  report when the first `openRepoTools` on `PATH`, with its links resolved,
-  is not that package's console script, or when there is none.
-  - The report is design.md Decision 8's one line. It names the
-    `openRepoTools` that `PATH` finds and the one expected.
-  - It MUST change nothing, and MUST leave the exit status as it was.
-- **FR-022**: After `pipx upgrade openrepotools`, the placed files, skills,
-  command files and any merged hook entries MUST stay the earlier release's
-  until `--install` runs again. That `--install` MUST replace them and still
-  skip the link.
-- **FR-023**: `pipx uninstall openrepotools` removes only the link and its
-  environment.
-  - The placed files, the skills, the command files, any merged hook
-    entries and the receipt MUST stay.
-  - A later checkout's `--install` MUST place a regular `openRepoTools` at
-    the freed path.
-- **FR-024**: The documented move from the one-line install to pipx MUST be
-  `pipx install --force openrepotools`, then `openRepoTools --install`.
-
-#### Continuous integration
-
-- **FR-025**: `tests.yml` MUST run on `push` to `main` and to every
-  `release/v*` branch, as well as on its existing triggers.
-  - Every run MUST include the jobs `guard-launch-mode`, `tests`,
-    `tests-no-submodule` and `package`.
-  - The three existing jobs MUST stay unchanged.
-  - The header comment that says "`push` (main only)" and "those same three
-    jobs" MUST be rewritten for the two branches and the four jobs.
-- **FR-026**: `tests.yml` MUST have a `package` job on ubuntu with Python 3.9.
-  It MUST do each of these:
-  - build the wheel twice at the commit's time, and require the two to be
-    one file;
-  - check every packaged payload file against the commit's blob and mode;
-  - check the `.dist-info` as FR-002 states;
-  - install the wheel with pipx;
-  - run the unstamped `--version`;
-  - run an offline `--install` into a temporary home with a pipx link in
-    place;
-  - run the package's tests, the pipx-skip tests among them, and fail if any
-    of them was skipped rather than run, or none ran.
-
-  The pipx-skip tests MUST use fake venv layouts, with no real pipx and no
-  wheel.
-- **FR-027**: AGENTS.md's CI paragraph MUST be rewritten to match FR-025 and
-  FR-026. Its line cap MUST move only by a dated entry, as the hygiene test
-  requires.
-
-#### The release workflow
-
-- **FR-028**: `.github/workflows/release.yml` MUST meet all of these:
-  - it runs only on `workflow_dispatch`, with a `version` input;
-  - it grants no permission at the workflow level, and each job grants its
-    own;
-  - it runs one release at a time, and never cancels one in progress;
-  - it is adapted from openRepoShape v1.1.0's (`190133d`), taking over that
-    workflow's checks as they are, except where design.md Decision 10 names
-    a difference, and holding more where FR-029 and contracts/workflows.md
-    ask for it: the gate on `tests.yml`'s four jobs, the build's full-history
-    checkout with its submodule, and the tag fetch without `--depth`.
-- **FR-029**: The build MUST refuse unless every one of these holds:
-  - the version is a final `X.Y.Z` other than `0.0.0`, or a pre-release
-    `X.Y.ZrcN` bound for TestPyPI;
-  - on a dispatch on a tag, the dispatched ref is the annotated tag
-    `v<version>`, and the tag object names the run's commit, as read both
-    from the forge and from git;
-  - on a dispatch on a tag, that commit is on `main` or on `release/v<X.Y>`;
-  - the dispatched ref is a tag or a branch, and nothing else;
-  - the checkout is that commit, and it is clean;
-  - the environments `testpypi` and `pypi` each name a required reviewer,
-    and each has a deployment limit of exactly one rule, the tag pattern
-    `v*`;
-  - each of `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`
-    ran in a push or dispatch run of `tests.yml` on that commit, none of
-    those runs is still in progress, and the newest to finish succeeded;
-  - the tree digest computed locally equals the one computed from the
-    forge's tree listing, both by the pinned openRepoShape's own digest code;
-  - the pinned standard's digest definition is `sorted-ls-tree-r-v1`, the
-    literal that `--version` labels the digest with and that
-    `contracts/openreposhape-pin.yaml` names.
-
-  A dispatch on a branch is the rehearsal of FR-033, as in the model
-  (`release.yml:200-249` at v1.1.0). The two tag-bound checks above stand
-  down, because a branch has no tag and no release branch to be on. Every
-  other check still runs, and no upload job runs.
-- **FR-030**: The build MUST be reproducible.
-  - It installs its tools from a hash lock, wheels only, with hatchling at
-    the package's own pin.
-  - It extracts the commit twice with `git archive`, into two different
-    directories, and stamps and builds each with `SOURCE_DATE_EPOCH` at the
-    commit's time.
-  - The two wheels MUST be one file.
-  - Every file in the wheel apart from the stamp and the metadata MUST be the
-    commit's own blob, with its mode, and the `.dist-info` MUST pass FR-002.
-  - The wheel's sha256 MUST be recorded, and checked again before and after
-    each upload.
-  - No copy of the digest code MUST be added: the build runs the pinned
-    submodule's.
-- **FR-031**: The uploads MUST go by trusted publishing only.
-  - The order is TestPyPI in the environment `testpypi`, then the install
-    check, then PyPI in the environment `pypi`.
-  - Only the two upload jobs MUST be granted `id-token: write`, and there
-    MUST be no token and no stored secret.
-  - Each upload job, before it uploads, MUST read again its environment's
-    rules, this run's approval and the tag.
-  - The index MUST hold no other file of that version before the upload, and
-    MUST serve exactly the recorded digest after it.
-  - The `pypi` job MUST never upload a pre-release. In an rc rehearsal it
-    is skipped, and its first step refuses a pre-release if it ever starts.
-  - Nothing MUST ever upload to PyPI from `opensoft/openRepoTools`. FR-048
-    enforces that in code, and the absence of a pypi.org publisher is the
-    second line of defence.
-  - v1.1.0 MUST be published from `openRepoTools-code`, and only once both of
-    its environments and both trusted publishers exist.
-- **FR-032**: The install check MUST run on ubuntu and macOS with a current
-  Python 3, and on ubuntu with Python 3.9. Each leg MUST:
-  - install pipx from its own hash lock;
-  - install the wheel by its digest, and check that pipx placed exactly one
-    command, `openRepoTools`;
-  - check that `--version` names the source repository, the version, the
-    tag, the commit and the digest;
-  - check that an offline `--install` into a temporary home places every
-    artifact and skips pipx's link, with the exact skip and count lines.
-
-  The macOS leg MUST run that `--install` again with Apple's `/bin/bash` 3.2
-  first on `PATH`, and print its `BASH_VERSION`. The Python 3.9 leg MUST
-  compile the installed package's own `lanes-index` and `lane-worktrees`.
-  There is no Windows leg.
-- **FR-033**: Rehearsals MUST never spend the real version.
-  - A dispatch on a branch MUST run every build check and the install check
-    on its own wheel, and MUST upload nothing.
-  - A branch rehearsal builds with the version of the tag it rehearses, as
-    the model rehearsed v1.1.0 from its branch `l3-rehearsal-v1.1.0`. Before
-    v1.1.0 that is the next pre-release, `1.1.0rc1` for the first.
-  - A TestPyPI rehearsal MUST use a pre-release `X.Y.ZrcN`, on its annotated
-    tag.
-  - No rehearsal MUST use the version `1.1.0` itself.
-- **FR-034**: The release procedure (RELEASING) MUST be written in
-  `release.yml`'s header, as the model's is. It MUST include the branch and
-  tag policy of FR-036 to FR-041. It MUST also include the step that creates
-  each GitHub Release by hand from its notes file, after PyPI serves the
-  version. No step of the release workflow MUST read the release notes.
-- **FR-035**: Every pin MUST be exact.
-  - Every action the release workflow uses MUST be pinned by a full commit,
-    as `tests.yml` pins its own.
-  - Both uploads MUST use
-    `pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33`
-    (v1.14.2).
-  - The release build's tools MUST come from
-    `.github/release-build-requirements.txt`, and the install check's pipx
-    from `.github/release-pipx-requirements.txt`. Each is installed by hash,
-    wheels only.
-  - These files record pins and digests, so they are governed files.
-- **FR-048**: The uploads MUST be guarded by repository, in the workflow's
-  own code. This is the lead's ruling of 2026-10-18, and it puts Brett Heap's
-  answers 2 and 3 into the workflow:
-  - in `opensoft/openRepoTools`, the `testpypi` job takes only a pre-release
-    `X.Y.ZrcN`, and the `pypi` job refuses outright;
-  - in `opensoft/openRepoTools-code`, a pre-release goes to TestPyPI only,
-    and a final `X.Y.Z` goes to TestPyPI and then to PyPI;
-  - in any other repository, both upload jobs refuse.
-
-  How the guard works:
-  - The build decides this from the repository, the version and the ref,
-    before any approval is asked.
-  - It refuses a tag dispatch whose version this repository may not upload.
-  - It records which upload jobs may run. Each upload job's condition reads
-    that record, and its first step checks the rule again.
-  - A branch dispatch uploads nothing in any repository.
-  - openRepoShape v1.1.0's workflow has no such guard, so this one is new
-    here.
-
-#### Release identity
-
-- **FR-036**: A release MUST be an annotated tag `vX.Y.Z` on a commit that is
-  on `main` or on `release/vX.Y`.
-  - It MUST NOT be a branch, nor a version number committed to any file.
-  - The tag message MUST have the form `v1.0.0` uses: the line
-    `openRepoTools vX.Y.Z`, a paragraph, the line
-    `Tagged on Brett Heap's word (<time>, "<words>")` with `<time>` the exact
-    UTC second, and the line `Lane: <lane>`.
-  - A tag MUST NOT be moved, deleted or reused once pushed.
-  - A version is uploaded once. A bad upload MUST be fixed by the next patch
-    version.
-- **FR-037**: `release/vX.Y` MUST be cut at the `vX.Y.0` tag, right after that
-  tag is made. Each patch `vX.Y.Z` with Z above 0 MUST be tagged on
-  `release/vX.Y`. Every PR MUST land on `main`, the trunk.
-- **FR-038**: A fix MUST land on `main` first, through its own review and CI.
-  - While `main` holds only that patch line's work, the back-port MUST be a
-    fast-forward of `release/vX.Y` or a merge of `main`.
-  - Otherwise it MUST be a PR to `release/vX.Y` of
-    `git cherry-pick -x <squash commit>`.
-  - At most one HOLD MUST be open at a time on `release/vX.Y`.
-  - The lane that landed the PR MUST make the back-port, unless the release
-    owner fast-forwards.
-  - The LANDED line MUST name both commits.
-- **FR-039**: A patch MUST be tagged on `release/vX.Y` only once that commit's
-  `tests.yml` runs have all finished, and the newest of them has succeeded.
-  When a commit reached the branch by fast-forward, the newer of `main`'s
-  push run and the branch's own MUST decide.
-- **FR-040**: Every tag, every release-branch cut and every upload MUST wait
-  for Brett Heap's word, and each deployment to `testpypi` and `pypi` for his
-  approval. Lane openRepoTools-3, the release owner, MUST carry out these
-  acts on his word, and no other lane MUST make them.
-- **FR-041**: From v1.1.0 on, release tags MUST be made in
-  `openRepoTools-code`, where the release is built. `v1.0.0` and every `rc`
-  rehearsal tag MUST stay in `opensoft/openRepoTools`. No tag MUST be carried
-  from one repository to another at the cutover.
-
-#### Release notes and README
-
-- **FR-042**: Each release MUST have its notes in
-  `docs/release-notes/vX.Y.Z.md`.
-  - `docs/release-notes/v1.0.0.md` MUST hold the body of the published v1.0.0
-    Release, byte for byte.
-  - `docs/release-notes/v1.1.0.md` is a draft. Each of its placeholders MUST
-    be filled in or cut before its tag. It ends with a line naming its own
-    path in the spec leg.
-  - Each GitHub Release MUST be created from its notes file, and, for a
-    version published on PyPI, only after PyPI serves that version.
-  - The notes stay under `docs/`, which goes to the spec leg.
-- **FR-043**: README's paragraph that says "There is no version number here"
-  MUST be rewritten. It MUST say:
-  - that releases are annotated tags;
-  - that the version comes only from the tag;
-  - what `--version` prints, stamped and unstamped.
-- **FR-044**: README MUST correct three passages for a workstation with
-  pipx's link:
-  - the count of seventeen files: sixteen placed and one left to pipx;
-  - the symlink paragraph: pipx's `openRepoTools` is the one link skipped;
-  - the artifact-count invariant: twenty-eight placed always, one left to
-    pipx, and 28 receipt rows, with the two hook entries on top once the
-    path they call answers `guard` (#237).
-- **FR-045**: README MUST NOT offer the pipx route until PyPI serves the
-  version it installs, and the workBenches condition holds.
-  - This feature MUST NOT add the pipx route's text.
-  - That text is fixed in the proposal, and lane openRepoTools-3 adds it to
-    the assembly's README by a later PR, on Brett Heap's word.
-  - README's line cap MUST move only by a dated entry.
-
-#### The cutover invariants
-
-- **FR-046**: The release gate's four job ids MUST stay as job ids in
-  `tests.yml`: `guard-launch-mode`, `tests`, `tests-no-submodule` and
-  `package`.
-  - No step of `release.yml` MUST read a file outside what the code leg will
-    hold. That rules out what the adoption plan sends to the spec leg or the
-    root: `docs/`, `openspec/`, `specs/`, `README.md`, `AGENTS.md` and
-    `CLAUDE.md`.
-  - `LICENSE` is the one root file the build reads, because `code-0001`
-    gives the code leg a byte-identical copy.
-  - The code leg's `LICENSE` MUST be blob `261eeb9` from its first commit
-    after `execute` on, before any CI, package or release run there. Lane
-    openRepoTools-3 checks it; the change's `tasks.md` item 5.2 tracks that
-    check.
-  - This feature asks lane openRepoTools-1's adoption plan to carry these
-    invariants, and does not edit `openspec/changes/migrate-to-triad/`.
-
-#### The workBenches condition, decided by Brett Heap (2026-10-18)
-
-- **FR-047 (decided: position (c))**: The workBenches condition.
-  - workBenches' `./setup.sh` refuses a symlinked `openRepoTools` before it
-    installs anything (`check_target_preflight`).
-  - After installing, it requires a regular file identical to its vendored
-    copy (`verify_installed`).
-  - Both checks stand at workBenches main `bdab3e2`. So on a workstation
-    with pipx's link, every `./setup.sh` refuses its estate step.
-  - Brett Heap chose position (c) on 2026-10-18, in his words "go with (c)".
-    Lane openRepoTools-3 has filed opensoft/workBenches#165. It asks
-    workBenches' `scripts/setup-estate-commands.sh` to accept pipx's link
-    by [contracts/pipx-link.md](contracts/pipx-link.md)'s rule, and to skip
-    it as `--install` does.
-  - README MUST NOT offer `pipx install openrepotools` until
-    opensoft/workBenches#165 lands. FR-045's other condition still
-    applies: PyPI must serve the version first.
-  - Until opensoft/workBenches#165 lands, README MUST say that a workstation
-    uses one install route or the other, never both, and MUST cite
-    opensoft/workBenches#165.
-  - This changes only when FR-045's README text may appear, and adds that
-    one sentence to README.
-
-### Key Entities
-
-- **The stamp**: the package's `_release.py`. It holds five fields:
-  `VERSION`, `TAG`, `COMMIT`, `DIGEST` and `REPOSITORY`. It is in one of
-  three states: unstamped (the committed file), stamped (written only by the
-  release build), or broken (anything else, always refused).
-- **The payload list**: the installer's own list of every file `--install`
-  reads, the seventeen installables, three skills and three command files.
-  The wheel adds the openRepoShape pin.
-- **The package**: the `openrepotools` wheel. It holds the entry module, the
-  stamp, and the payload at `openrepotools/payload/`, with a `.dist-info` of
-  exactly five names.
-- **pipx's link**: `<dir>/openRepoTools` as FR-015 defines it, with its venv
-  and that venv's payload. Its counterparts are pip's console script (a
-  regular file) and a venv-shaped link that is not provably pipx's.
-- **An install run's result**: what was placed and counted, what was left to
-  pipx, and the receipt rows. Twenty-nine artifacts are placed always: 17
-  files, 6 skill files and 6 command files. The 2 hook entries are added on
-  top once `~/projects/xFactory/lanes-edit.sh` answers `guard`. Until then
-  they are deferred, and `wip init` adds them (#237). With pipx's link, 28
-  are placed always, 1 is left to pipx, and there are 28 receipt rows. The
-  receipt holds no hook rows.
-- **A release**: an annotated tag `vX.Y.Z`, with its tag message, its commit,
-  its tree digest, its notes file and its GitHub Release. A pre-release
-  `vX.Y.ZrcN` reaches TestPyPI only.
-- **A release branch**: `release/vX.Y`, cut at `vX.Y.0`, carrying patch tags
-  and back-ports.
-- **A release run**: one dispatch of `release.yml`. It has a build and its
-  gates, a recorded wheel and sha256, two environments with their rules and
-  approvals, two trusted publishers, and the install check's legs.
-
-## Success Criteria *(mandatory)*
-
-### Measurable Outcomes
-
-- **SC-001**: A workstation with no network gets a complete install from the
-  package in one `--install` run: of the 29 artifacts placed always, 28 are
-  placed and 1 is left to pipx, with 28 receipt rows. Where
-  `~/projects/xFactory/lanes-edit.sh` answers `guard`, the same run also
-  merges the two hook entries. Where it does not, the run defers them and
-  says so, and `wip init` adds them later (#237). The `package` job and
-  every install-check leg show it, in a temporary home where the pair is
-  deferred.
-- **SC-002**: Every `--version` from a stamped package names all five facts:
-  the version, tag, commit, digest and repository. No `--version` from a
-  checkout or a one-line install prints a version number, whatever is in the
-  environment.
-- **SC-003**: Every broken stamp is refused before any argument is acted on,
-  `--help` included, and no broken build places a file.
-- **SC-004**: Every commit pushed to `main` or to a `release/v*` branch gets a
-  `package` run. In it the two builds are byte-identical, every packaged
-  file equals the commit's blob, and no package test is skipped unnoticed.
-- **SC-005**: No upload happens without Brett Heap's approval in its
-  environment. No pre-release reaches PyPI, nothing uploads to pypi.org from
-  `opensoft/openRepoTools`, nothing uploads from any repository other than
-  the two, and no rehearsal uses `1.1.0`.
-- **SC-006**: A person who follows the advice any refusal prints never
-  removes the only command that can run `--install`. No refusal prints an
-  `rm` for pipx's link or for a venv-shaped link.
-- **SC-007**: Each of the 12 pipx fixture layouts is recognised: 3 pipx
-  releases, each under 4 homes. Each negative layout is refused before
-  anything is placed.
-- **SC-008**: The macOS install-check leg completes the offline install
-  under bash 3.2, with the same skip and count lines.
-- **SC-009**: README never names an install route the index does not serve:
-  it has no `pipx install openrepotools` line before PyPI serves 1.1.0.
-- **SC-010**: The v1.0.0 notes file matches the published Release body, byte
-  for byte.
-
-## Assumptions
-
-- **The baseline is done.** The annotated `v1.0.0` (tag object `6a826f8`) is
-  on main `aaa7bc8`, and its GitHub Release was published at 20:57:57Z.
-  Nothing is on PyPI.
-- **v1.1.0 is published after the triad cutover (#186),** from
-  `openRepoTools-code`. Before then, the workflow is rehearsed on a branch.
-  On Brett Heap's word it is also rehearsed as `1.1.0rc1` on TestPyPI from
-  `opensoft/openRepoTools`.
-- **Brett Heap makes the acts outside the repository.** That means:
-  - the `testpypi` and `pypi` environments, each with brettheap as required
-    reviewer and the deployment limit `v*`, in both repositories in turn;
-  - the `v*` tag rulesets;
-  - the test.pypi.org publisher, for this repository and then for the code
-    leg;
-  - the one pypi.org pending publisher, for `openRepoTools-code` only.
-
-  `release.yml` refuses every dispatch until the environments exist with
-  their rules.
-- **The `release/*` ruleset is Brett Heap's choice,** which #850 leaves to
-  him: no force-push and no deletion, or a rule that requires a pull
-  request. Both back-port forms are specified, so his choice changes only
-  which one applies.
-- **The text of `docs/release-notes/v1.1.0.md`** is drafted here, and settled
-  before the tag.
-- **The model is openRepoShape v1.1.0** (tag `b9c5099` on `190133d`),
-  published on PyPI by its `release.yml` run 39071178232.
-- **Lane openRepoTools-1's work comes after this feature lands.**
-  - Lane 1 moves the openRepoShape pin straight to v1.1.0.
-  - Lane 1 regenerates the adoption plan after this feature lands. The plan
-    sends `pyproject.toml`, `src/` and `.github/` to code, `docs/` to spec
-    and `LICENSE` to the root.
-  - T006's patch `code-0001` is the code leg's first commit, right after
-    `execute`. Lane openRepoTools-3 checks that the code leg's `LICENSE` is
-    blob `261eeb9` before the first `package` run there.
-- **The facts the design checked hold:**
-  - hatchling 1.27.0 normalises wheel modes to 0644 or 0755;
-  - its `license-files` glob does not fail on a missing file;
-  - its version source takes the first line that matches its
-    case-insensitive pattern;
-  - pipx's default home on macOS holds a space.
-- **The pipx layouts.** The fixtures mirror pipx 1.11.1 and 1.17.8, which the
-  model's install check locks for Python below 3.10 and from 3.10 on, and
-  1.18.3, the newest on PyPI on 2026-10-17.
-- **Out of scope, the proposal's non-goals.** This feature makes none of
-  these:
-  - an upload to PyPI before the cutover, or from `opensoft/openRepoTools`
-    ever;
-  - a new runtime dependency;
-  - a change to the one-line install, or to `wip init`'s template fetch;
-  - an sdist, a native Windows command, or a second console script;
-  - a check of the placed files against the receipt;
-  - an edit to `upstream/openRepoShape`, to its pin, or to the triad change's
-    files.
-- **Windows** is reached through WSL2, as for every bash command here.
diff --git a/specs/006-release-pypi/tasks.md b/specs/006-release-pypi/tasks.md
deleted file mode 100644
index 846bb8d9..00000000
--- a/specs/006-release-pypi/tasks.md
+++ /dev/null
@@ -1,465 +0,0 @@
----
-
-description: "Task list for 006-release-pypi: release tags, release branches and the openrepotools package on PyPI"
----
-
-# Tasks: Release tags, release branches and the `openrepotools` package on PyPI
-
-**Input**: the design documents in `specs/006-release-pypi/`
-
-**Prerequisites**: plan.md and spec.md, plus research.md, data-model.md,
-contracts/ and quickstart.md
-
-**Tests**: the spec requires them. Many requirements read "a test holds…".
-Each story's test task comes first, and its tests MUST fail before that
-story's implementation task begins.
-
-**Organization**: tasks are grouped by user story, so that each story can be
-built and tested on its own.
-
-## Format: `[ID] [P?] [Story] [Tier] Description — files: … — verify: …`
-
-- **[P]**: the task can run in parallel with the others marked so in its
-  phase. They touch different files and depend on no incomplete task.
-- **[Story]**: US1 to US6, as in spec.md.
-- **[Tier]**:
-  - `[S]` runs on `sonnet-xhigh`, `[O]` on `opus-xhigh`.
-  - There is no `[H]`, because AGENTS.md has no `## Governed invariants`
-    section.
-  - Every task touching a governed file (plan.md, "Governed files in this
-    feature") is `[O]`. So is every task that makes a design choice, a
-    contract or a boundary, or that is security-sensitive (the release
-    workflow, trusted publishing, the stamp).
-- **`files:`** lists every path the task may create, change or delete,
-  relative to the worktree root. A diff outside it fails the task.
-- **`verify:`** is run from the worktree root, and exits 0 only when the task
-  is done.
-  - A test-writing task verifies with `--collect-only`. It exits 5 when no
-    test is collected and 2 on an import error, so it fails until the tests
-    exist and import cleanly.
-  - `-k` selects tests by the name prefixes that plan.md fixes ("The test
-    layout").
-
-## Before Phase 1: bring the branch up to `main`
-
-These are not tasks with a `files:` list, because a merge touches files of
-every kind. They are recorded here because every task below assumes them.
-
-- **The implementation's first act is to merge `origin/main` into
-  `006-release-pypi`,** by a merge commit, never a rebase or a force-push.
-  This is the lead's ruling of 2026-10-18, and `main` is not merged before
-  then. The branch was cut at `aaa7bc8`, and `main`
-  is at `83d2690` as of 2026-10-18. Since the cut:
-  - `tests/conftest.py` gained the four-roots layout;
-  - `tests/test_repo_hygiene.py` moved by about 260 lines;
-  - AGENTS.md is 321 lines against a cap of 323;
-  - `lane-start` and `skills/handoff/SKILL.md` changed in content. Both are
-    payload files, but their modes and the payload list are unchanged, and
-    the wheel copies whatever bytes the commit holds.
-- **Line numbers.** Line numbers in plan.md, research.md and the contracts
-  are at `aaa7bc8`. Find each test by its name, and each bash function by
-  its name.
-- **The test environment.** Run every verify command from a shell with no
-  `LANES_*` or `TMUX` variable inherited from a lane session (quickstart.md).
-
----
-
-## Phase 1: Setup (shared infrastructure)
-
-**Purpose**: the package's fixed files, which every story reads.
-
-- [X] T001 [P] [O] Create `src/openrepotools/__init__.py` holding the SPDX line and a docstring, and no code (research R1; the lead added the SPDX line on T001's report). Create the committed, unstamped stamp `src/openrepotools/_release.py` exactly as contracts/stamp.md gives it: a module docstring with no line that hatch could read as the version, then the five lines `VERSION = "0.0.0"`, `TAG = ""`, `COMMIT = ""`, `DIGEST = ""` and `REPOSITORY = ""`, LF only, with a final newline — files: `src/openrepotools/__init__.py`, `src/openrepotools/_release.py` — verify: `python3 -I -c "import re,pathlib;t=pathlib.Path('src/openrepotools/_release.py').read_text();assert chr(13) not in t and t.endswith(chr(10));a=re.findall(r'(?m)^([A-Z_]+) *= *\"(.*)\"$',t);assert a==[('VERSION','0.0.0'),('TAG',''),('COMMIT',''),('DIGEST',''),('REPOSITORY','')],a;assert not re.search(r'(?im)^(__version__|version) *=',t.split('VERSION = ')[0]);assert 'import' not in pathlib.Path('src/openrepotools/__init__.py').read_text()"`
-- [X] T002 [P] [O] Create `pyproject.toml` per contracts/wheel.md, holding what is detailed below — files: `pyproject.toml` — verify: `python3 -I -c "import tomllib;d=tomllib.load(open('pyproject.toml','rb'));p=d['project'];w=d['tool']['hatch']['build']['targets']['wheel'];f=w['force-include'];assert d['build-system']['requires']==['hatchling==1.27.0'] and p['name']=='openrepotools' and p['dependencies']==[] and 'readme' not in p and p['requires-python']=='>=3.9' and p['scripts']=={'openRepoTools':'openrepotools.cli:main'} and w['packages']==['src/openrepotools'] and d['tool']['hatch']['version']['path']=='src/openrepotools/_release.py' and len(f)==24 and all(v=='openrepotools/payload/'+k for k,v in f.items())"`
-  - the build system, pinned at `hatchling==1.27.0`;
-  - `[project]`: the name `openrepotools`, a dynamic version, `requires-python = ">=3.9"`, `license = "Apache-2.0"` with `license-files = ["LICENSE"]`, `dependencies = []`, and no `readme`;
-  - the one script, `openRepoTools = "openrepotools.cli:main"`;
-  - the hatch version path, and the wheel's `packages`;
-  - the 24-entry force-include map, in `payload_names` order, then the pin;
-  - header comments in the model's style that give the reasons: `src/` for the case-insensitive clash, no `readme` because of the cutover, and the hatchling pin for Python 3.9.
-
----
-
-## Phase 2: Foundational (blocking prerequisites)
-
-**Purpose**: the fixture builders that four test modules share.
-
-**⚠️ CRITICAL**: No user story's tests can be written until this phase is
-complete.
-
-- [X] T003 [O] Create `tests/package_layout.py`, with the fixture builders `package_tree`, `pipx_venv`, `console_script` and `stamp_text` that plan.md's "The test layout" names, as detailed below — files: `tests/package_layout.py` — verify: `python3 -I -c "import sys,tempfile,pathlib;sys.path.insert(0,'tests');import package_layout as L;d=pathlib.Path(tempfile.mkdtemp())/'Application Support'/'pipx';v=L.pipx_venv(d,'1.11.1','python3.9');p=v/'lib'/'python3.9'/'site-packages'/'openrepotools'/'payload';assert (v/'pipx_metadata.json').is_file() and (v/'pyvenv.cfg').is_file() and (p/'openRepoTools').is_file() and (p/'contracts'/'openreposhape-pin.yaml').is_file() and len([x for x in p.rglob('*') if x.is_file()])==24 and 'from openrepotools.cli import main' in (v/'bin'/'openRepoTools').read_text()"`
-  - imports only the standard library and never imports `conftest`, and finds the repository from its own path;
-  - has `package_tree` copy every `src/openrepotools/*.py` that exists, and the 24 payload files;
-  - has `pipx_venv` mirror pipx 1.11.1, 1.17.8 and 1.18.3, each with `venvs/openrepotools`, `bin/openRepoTools`, `pipx_metadata.json` with placeholder content, and `pyvenv.cfg`;
-  - works under a path that holds a space.
-
-**Checkpoint**: the foundation is ready, and the user stories can begin.
-
----
-
-## Phase 3: User Story 1 - Install the toolset from the package, offline (Priority: P1) 🎯 MVP
-
-**Goal**: an install from the package places every artifact offline, leaves
-pipx's `openRepoTools` to pipx, and refuses every other link, without ever
-advising the `rm` of a working command.
-
-**Independent Test**: `bash tests/run.sh -k 'test_pipx_link_ or test_pipx_skip_ or test_pipx_offline_ or test_entry_'`.
-The tests use fake venv layouts, with no pipx and no wheel.
-
-### Tests for User Story 1 (write first; they MUST fail before T007 and T008)
-
-- [X] T004 [P] [US1] [O] Write the US1 tests of `tests/test_install_pipx.py`, reusing `tests/package_layout.py` and `test_openrepotools_command`'s `command_env`, `source_tree` and `NEEDS_JQ`, as detailed below — files: `tests/test_install_pipx.py` — verify: `bash tests/run.sh --collect-only -q -k 'test_pipx_link_ or test_pipx_skip_ or test_pipx_offline_'`
-  - `test_pipx_link_*`: the twelve-case matrix of contracts/pipx-link.md and its five negative cases, with `PIPX_HOME` set only in its own column.
-  - `test_pipx_skip_*`:
-    - the exact skip line and the pipx-own count line, 28 receipt rows, and the link left unchanged;
-    - a second link at another target, refused with today's `rm -f` advice for that one alone;
-    - the venv-shaped refusal: contracts/cli-output.md's entry and paragraph, with no `rm` line naming the link;
-    - no `jq`: ends in the `jq` refusal, with no `rm` for the link;
-    - `restart` retirement, and a later `--install`, both leaving the link.
-  - `test_pipx_offline_*`: a package-mode `--install` with `OPENREPOTOOLS_REPO=offline.invalid/sentinel` and a `gh` and a `curl` that fail. It places the same artifacts and receipt rows as a checkout's install, apart from the link.
-  - Every test here runs `bash <payload>/openRepoTools` directly, as the entry module's exec would. None runs the console script, which is `test_entry_*`'s job in T005. So these tests need T008 and not T007, and T007 and T008 stay parallel.
-- [X] T005 [P] [US1] [O] Write `tests/test_package.py`, as detailed below — files: `tests/test_package.py` — verify: `bash tests/run.sh --collect-only -q -k 'test_metadata_ or test_payload_map_ or test_wheel_ or test_entry_'`
-  - `test_metadata_*`: contracts/wheel.md's `pyproject.toml` rules, read with `tomllib`, falling back to `tomli`, and skipping, naming `tomli`, when neither imports.
-  - `test_payload_map_*`: the force-include keys and values against `payload_names` (run from the bash file) plus the pin, in both directions, naming every difference.
-  - `test_wheel_*`: read `OPENREPOTOOLS_TEST_WHEEL`, skipping and naming it when it is unset. Run contracts/wheel.md's checks 2, 3, 5 and 6 and the member comparison.
-  - `test_entry_*`, run on a `package_tree`'s console script:
-    - a refused argument gives the payload's own exit status and message;
-    - a SIGTERM mid-placement leaves no placement temporary (`placement_temporaries`);
-    - with no `bash` on `PATH`, the exact no-bash refusal, exit 2, and nothing run;
-    - `wip_shape_ref`, cut out with `installer_function`, reads the packaged pin.
-- [X] T006 [P] [US1] [S] Add the standard-library test to `tests/test_repo_hygiene.py`, and widen its compile test, as detailed below — files: `tests/test_repo_hygiene.py` — verify: `bash tests/run.sh -k 'standard_library or python_files_compile'`
-  - add `test_the_package_imports_only_the_standard_library`. It parses every module under `src/openrepotools/` with `ast`, and holds its imports to an explicit allowlist. Where `sys.stdlib_module_names` exists, the allowlist is itself checked against it, so the test never skips on Python 3.9.
-  - extend `test_the_python_files_compile` to compile `src/openrepotools/*.py`.
-
-### Implementation for User Story 1
-
-- [X] T007 [P] [US1] [O] Create `src/openrepotools/cli.py` with `main()` per design.md Decision 3, as detailed below — files: `src/openrepotools/cli.py` — verify: `bash tests/run.sh -k 'test_entry_ or test_metadata_ or test_payload_map_ or standard_library or python_files_compile'`
-  - it calls `os.execvp("bash", ["bash", <payload>/openRepoTools, *sys.argv[1:]])`, where `<payload>` is the `payload` directory beside the module's own file;
-  - on `FileNotFoundError`, it prints contracts/cli-output.md's no-bash refusal to stderr and returns 2;
-  - it reads no stamp, and passes nothing else.
-- [X] T008 [P] [US1] [O] Teach `openRepoTools` to recognise and skip pipx's link, holding to bash 3.2 throughout, as detailed below — files: `openRepoTools` — verify: `bash tests/run.sh -k 'test_pipx_link_ or test_pipx_skip_ or test_pipx_offline_ or openrepotools_command or install_skill or install_by_rename or install_payload'`
-  - add `link_resolve`, `package_payload_dir`, `pipx_link_match` and `venv_shaped_link` (contracts/pipx-link.md);
-  - call the pipx match in `plan_install_targets`, for `openRepoTools`, before `unplaceable_kind`;
-  - skip that target in `install_commands`' placement loop, printing the exact skip line;
-  - print the pipx-own count line when the run is package mode under `PIPX_VENV`, the same line in any other run that skipped the link (T013 adds its suffix), and today's line otherwise;
-  - list a venv-shaped link with contracts/cli-output.md's entry and paragraph, and keep it out of the `rm -f` line.
-
-- [X] T026 [US1] [O] Put back the signals Python ignores before the exec, and refuse a `PATH` that ends in a file, per design.md Decision 3 as amended by the lead on 2026-10-18 on T007's report, as detailed below — files: `src/openrepotools/cli.py`, `tests/test_package.py`, `tests/test_repo_hygiene.py` — verify: `bash tests/run.sh -k 'test_entry_ or standard_library or python_files_compile'`
-  - `cli.py` sets SIGPIPE and SIGXFSZ to `SIG_DFL` before `os.execvp`, and treats `NotADirectoryError` as it treats `FileNotFoundError`;
-  - `tests/test_repo_hygiene.py`'s allowlist gains `signal`, with its reason;
-  - `tests/test_package.py` gains two `test_entry_*` cases:
-    - a payload `bash` that reads its own ignored-signal set finds neither SIGPIPE nor SIGXFSZ ignored. On Linux it reads `/proc/self/status`'s `SigIgn`; elsewhere, a `yes | head -n 1` pipeline under `pipefail` ends in status 141;
-    - with no `bash` on `PATH` and `PATH`'s last entry a file, the exact no-bash refusal, exit 2, and nothing run.
-  - It runs after T007 and before T009. It was added after T025 by the lead's ruling, so its number is out of order.
-
-**Checkpoint**: User Story 1 works and is tested on its own.
-
----
-
-## Phase 4: User Story 2 - Know which release is running (Priority: P1)
-
-**Goal**: `--version` names a stamped package's release, says when a package
-is unstamped, and is unchanged for a checkout. A broken stamp refuses every
-invocation.
-
-**Independent Test**: `bash tests/run.sh -k 'test_package_stamp or test_version_'`.
-
-### Tests for User Story 2 (write first; they MUST fail before T011)
-
-- [X] T009 [P] [US2] [O] Write `tests/test_package_stamp.py`, as detailed below — files: `tests/test_package_stamp.py` — verify: `bash tests/run.sh --collect-only -q -k 'test_stamp_reader_ or test_stamp_hatch_ or test_package_version_ or test_package_broken_stamp_ or test_package_no_env_channel_ or test_package_parser_'`
-  - `test_stamp_reader_*`: one fixture per row of contracts/stamp.md's refusal table, plus the committed and a stamped file, running `stamp_read` cut out with `installer_function`.
-  - `test_stamp_hatch_*`: hatch's version pattern, copied with its citation (`hatchling/version/core.py:6` and `:32` in 1.27.0), against `stamp_read`, on the committed file, a stamped one and a guarded-docstring fixture.
-  - `test_package_version_*`: the exact stamped and unstamped five lines, from `package_tree` layouts.
-  - `test_package_broken_stamp_*`: exit 2 and the exact refusal for `--help`, `--version` and `--install`, with nothing placed. One fixture is used for each of the three causes of contracts/cli-output.md (`cannot be read`, `is partial:`, `is malformed:`), and each case requires the line to read as that contract gives it.
-  - `test_package_no_env_channel_*`: a checkout's, and a piped one-line install's, exact `openRepoTools (<repo> @ <ref>)`, with each `OPENREPOTOOLS_PACKAGE_*` variable of research R4 set.
-  - `test_package_parser_*`: `--help`, `--install --version` and an unknown argument behave as in a checkout.
-- [X] T010 [P] [US2] [S] Rewrite only the docstring of `test_version_names_the_repository_and_the_ref` in `tests/test_openrepotools_command.py`. It now says that a checkout and the one-line install name the repository and ref they fetch from, and that a package names its release (contracts/cli-output.md). Every assertion of the three `test_version_*` tests stays byte for byte — files: `tests/test_openrepotools_command.py` — verify: `! git diff -U0 "$(git merge-base HEAD origin/main)" -- tests/test_openrepotools_command.py | command grep -qE '^[-+][[:space:]]*(assert|result =)' && bash tests/run.sh -k 'test_version_'`
-
-### Implementation for User Story 2
-
-- [X] T011 [US2] [O] Teach `openRepoTools` to read its stamp and print its release, as detailed below — files: `openRepoTools` — verify: `bash tests/run.sh -k 'test_package_stamp or test_version_ or test_pipx_ or test_entry_'`
-  - add `stamp_read`: contracts/stamp.md's grammar and checks, in `pin_parse`'s style, holding to bash 3.2, and never sourcing the file;
-  - add `package_init`, called once after every function definition and before the argument loop. In package mode it sets `PACKAGE_DIR` and reads the stamp, and on any refusal it calls `die` with contracts/cli-output.md's broken-stamp line;
-  - make the `--version` arm print the stamped or unstamped five lines when `PACKAGE_DIR` is set, and today's line otherwise;
-  - read no environment variable for the stamp.
-
-**Checkpoint**: User Stories 1 and 2 both work on their own. Together they
-are the MVP.
-
----
-
-## Phase 5: User Story 3 - Move between installers without being misled (Priority: P2)
-
-**Goal**: each pairing of pipx with the one-line install, a checkout, pip, an
-upgrade or an uninstall has one defined, honest outcome.
-
-**Independent Test**: `bash tests/run.sh -k 'test_coexist_ or test_pip_script_ or test_path_report_ or test_pipx_upgrade_ or test_pipx_uninstall_'`.
-
-### Tests for User Story 3 (write first; they MUST fail before T013)
-
-- [X] T012 [US3] [O] Add to `tests/test_install_pipx.py`, as detailed below — files: `tests/test_install_pipx.py` — verify: `bash tests/run.sh --collect-only -q -k 'test_coexist_ or test_pip_script_ or test_path_report_ or test_pipx_upgrade_ or test_pipx_uninstall_'`
-  - `test_coexist_*`:
-    - a one-line install, replaced by pipx's link as `pipx install --force` leaves it, then `--install` from the venv's payload: the link is skipped, and the sixteen are replaced;
-    - a checkout's, and a piped one-line install's, `--install` beside pipx's link, with the exact count line naming `<repo> @ <ref>`, for an unstamped stamp, a stamped one and an unreadable one beside the link's payload. The unreadable case ends in contracts/cli-output.md's `the openrepotools beside pipx's link, whose stamp cannot be read`, and no output contains `openrepotools an unreadable stamp`;
-    - a package-mode `--install` from a `package_tree` outside pipx's venv, beside pipx's link, whose count line names `openrepotools <its VERSION>` as the source, never `<repo> @ <ref>`.
-  - `test_pip_script_*`: contracts/pipx-link.md's three refused fixtures (the shebang form; the trampoline with a quoted, spaced interpreter; the trampoline with an unquoted interpreter over 127 characters) and its five placed fixtures. One case is a package-mode run whose own command is pip's script. The refused cases give the exact refusal, and place nothing.
-  - `test_path_report_*`: the four `PATH` fixtures, the exact note, and an unchanged exit status.
-  - `test_pipx_upgrade_*`: one `package_tree` installed, then a second with different payload bytes. A second `--install` replaces the sixteen and still skips the link.
-  - `test_pipx_uninstall_*`: the link and the venv are removed, the sixteen are still there, and a checkout's `--install` places a regular file.
-
-### Implementation for User Story 3
-
-- [X] T013 [US3] [O] Teach `openRepoTools` the coexistence rules, as detailed below — files: `openRepoTools` — verify: `bash tests/run.sh -k 'test_install_pipx or test_package_stamp or test_package or openrepotools_command or install_skill or install_by_rename or install_payload'`
-  - add the other-source count line (research R5):
-    - `<source>` is `openrepotools $STAMP_VERSION` in any package-mode run. In a checkout or the one-line install, it is `PAYLOAD_REPO @ PAYLOAD_REV` for an adopted source, and `REPO @ REF` otherwise;
-    - `<version>` comes from `stamp_read` on the stamp beside `PIPX_PAYLOAD`. When that stamp fails the reader, the line ends in contracts/cli-output.md's unreadable-stamp clause;
-  - add `pip_script_is`, recognising both of pip's forms, the Python shebang and the `/bin/sh` trampoline (contracts/pipx-link.md), with contracts/cli-output.md's planning-phase refusal, in every mode;
-  - add `path_report`, run last in a package-mode `--install`. It uses research R7's `<prefix>` and `link_resolve` on both sides, prints the exact note, and keeps the exit status.
-
-**Checkpoint**: User Stories 1 to 3 are complete. This is pull request 1 of
-plan.md's delivery.
-
----
-
-## Phase 6: User Story 4 - Every commit proves it packages (Priority: P2)
-
-**Goal**: every push to `main` and to `release/v*` runs the four jobs. The
-`package` job builds, checks, installs and tests the wheel, and fails on any
-skip.
-
-**Independent Test**: `bash tests/run.sh -k test_tests_yml_` offline. Then a
-pushed commit's `package` job is green.
-
-### Tests for User Story 4 (write first; they MUST fail before T016)
-
-- [X] T014 [P] [US4] [O] Create `.github/release-build-requirements.txt` and `.github/release-pipx-requirements.txt` from openRepoShape v1.1.0's two files (research R11). Every line below each header stays byte for byte. Each header is rewritten for this repository and #228, with the same uv 0.12.18 command and date — files: `.github/release-build-requirements.txt`, `.github/release-pipx-requirements.txt` — verify: `bash -c 'for f in release-build-requirements.txt release-pipx-requirements.txt; do diff <(sed -n "/^[a-z]/,\$p" ".github/$f") <(gh api -H "Accept: application/vnd.github.raw" "repos/opensoft/openRepoShape/contents/.github/$f?ref=v1.1.0" | sed -n "/^[a-z]/,\$p") || exit 1; done'`
-- [X] T015 [P] [US4] [O] Write `tests/test_tests_workflow.py`. Its `test_tests_yml_*` tests load `.github/workflows/tests.yml` with the pinned `repo_shape.load_yaml`, skipping without the submodule as the command tests do. Inside this task, research R9's text fallback applies if a construct is refused. The tests hold contracts/workflows.md's `tests.yml` list, as detailed below — files: `tests/test_tests_workflow.py` — verify: `bash tests/run.sh --collect-only -q -k test_tests_yml_`
-  - the triggers;
-  - the four job ids;
-  - the three existing jobs' `runs-on`, checkout options, Python version and `run:` commands;
-  - the `package` job's runner, Python 3.9, `submodules: true`, and steps 4 to 11 in order;
-  - the `package` job's `tomli`, extracted from the build lock's own entry with every hash, and no `--hash` held in `tests.yml` itself;
-  - the header comment naming both push branches and four jobs;
-  - step 6's wheel-check heredoc, extracted and run on four synthetic wheels made from HEAD's blobs, with contracts/workflows.md's four outcomes: the wheel as built passes; no `licenses/LICENSE` fails, naming `LICENSE`; a changed payload byte fails, naming the file; a changed payload mode fails, naming the file.
-
-### Implementation for User Story 4
-
-- [X] T016 [US4] [O] Change `.github/workflows/tests.yml`, as detailed below — files: `.github/workflows/tests.yml` — verify: `actionlint .github/workflows/tests.yml && bash tests/run.sh -k 'test_tests_yml_ or repo_hygiene'`
-  - push on `[main, 'release/v*']`;
-  - rewrite the header comment of lines 29 to 36 for two push branches and four jobs;
-  - add the `package` job, with exactly contracts/workflows.md's steps 1 to 11. Those are two `pip wheel` builds at `SOURCE_DATE_EPOCH` compared with `cmp`; the inline wheel check, with the stamp equal to the committed file; pipx 1.11.1 from the lock; the unstamped `--version`; the offline `--install` beside pipx's link, with exact lines and 28 receipt rows; and the three package test modules, with `OPENREPOTOOLS_TEST_WHEEL` and a JUnit count that fails on any skip;
-  - leave the three existing jobs unchanged.
-- [X] T017 [US4] [S] Rewrite AGENTS.md's CI paragraph (point 1 of "Testing your changes to this repository") to match FR-025 and FR-026, as detailed below — files: `AGENTS.md`, `tests/test_repo_hygiene.py` — verify: `bash tests/run.sh -k repo_hygiene`
-  - `tests.yml` runs `guard-launch-mode`, `tests`, `tests-no-submodule` and `package`, all on ubuntu;
-  - it runs on `pull_request`, push to `main` and `release/v*`, nightly, and `workflow_dispatch`;
-  - the release workflow's macOS install leg, which runs on dispatch only, is the one place the payload runs under bash 3.2.
-
-  Keep AGENTS.md within `test_agents_md_is_short_enough_to_be_read`'s cap, or add that test's dated entry for the lines this buys.
-
-**Checkpoint**: User Story 4 is complete. This is pull request 2.
-
----
-
-## Phase 7: User Story 5 - Publish a release only through gates (Priority: P2)
-
-**Goal**: a release reaches the indexes only through every gate, from a
-reproducible build, by trusted publishing, with Brett Heap's approvals. A
-pre-release never reaches PyPI, and a branch dispatch uploads nothing.
-
-**Independent Test**: `bash tests/run.sh -k test_release_` offline. The
-branch rehearsal is the change's `tasks.md` item 4.2, once Brett Heap's
-environments exist.
-
-### Tests for User Story 5 (write first; they MUST fail before T019 to T021)
-
-- [X] T018 [US5] [O] Write `tests/test_release_workflow.py`. It loads `release.yml` with the pinned `load_yaml`, skipping without the submodule, and holds contracts/workflows.md's `release.yml` list under these prefixes, as detailed below — files: `tests/test_release_workflow.py` — verify: `bash tests/run.sh --collect-only -q -k test_release_`
-  - `test_release_trigger_`, `test_release_build_`, `test_release_upload_`, `test_release_install_check_`, `test_release_header_` and `test_release_reads_`;
-  - `test_release_stamp_writer_`: the heredoc, extracted as the model's `heredoc()` does, is run on a copy of the committed stamp and read back by `--version` from a `package_tree`. The step must refuse a file already stamped, and a value no release carries;
-  - `test_release_lock_`, for both locks: one version per entry, by sha256; hatchling equal to `pyproject.toml`'s pin; pipx 1.11.1 below Python 3.10 and 1.17.8 from 3.10.
-  - `test_release_build_` also runs step 13's wheel-check heredoc on the four synthetic wheels of contracts/workflows.md, with their four outcomes. It also holds the ref step and the branch-membership step to the rehearsal rule: a branch passes as a rehearsal, and any other non-tag ref is refused.
-  - `test_release_upload_` also holds each job's permissions exactly: `testpypi` and `pypi` get `id-token: write`, `actions: read` and `contents: read`; `build` gets `contents: read` and `actions: read`; `install` gets `contents: read`. It also holds the two upload conditions: `testpypi` reads `to-testpypi`, and `pypi` reads `to-pypi`, so `pypi` is skipped in an rc rehearsal.
-  - `test_release_guard_` (FR-048) covers the repository guard:
-    - `test_release_guard_build_*`: the build's guard block, run under each row of contracts/workflows.md's table, with `GITHUB_REPOSITORY`, `GITHUB_REF`, `VERSION` and `GITHUB_OUTPUT` set, must pass or refuse, and record `to-testpypi` and `to-pypi`, exactly as the row says;
-    - `test_release_guard_upload_*`: each upload job's first-step guard must refuse what its job may not upload: `testpypi` a final in `opensoft/openRepoTools` and any version elsewhere, and `pypi` everything but a final in `opensoft/openRepoTools-code`.
-
-  The tests also hold the digest-label literal equal to `openRepoTools`' `--version` arm and to the pin's `digest_definition`.
-
-### Implementation for User Story 5
-
-- [X] T019 [US5] [O] Create `.github/workflows/release.yml`'s shape and its `build` job, adapted from openRepoShape v1.1.0 (`190133d`) step for step, as detailed below — files: `.github/workflows/release.yml` — verify: `actionlint .github/workflows/release.yml && bash tests/run.sh -k 'test_release_trigger_ or test_release_build_ or test_release_stamp_writer_ or test_release_lock_ or test_release_reads_ or test_release_guard_build_'`
-  - the shape: `workflow_dispatch` with `version`, `permissions: {}`, the `release` concurrency group without cancelling, `bash` by default, and `VERSION` and `PYTHONUTF8` in `env`;
-  - contracts/workflows.md's build steps 1 to 14, with design.md Decision 10's differences: `X.Y.ZrcN` accepted; the stamp's `REPOSITORY` from `GITHUB_REPOSITORY`; the digest-definition assertion against the literal and the pin; the payload blob and mode check; and the repository guard of step 1 (FR-048), with its `to-testpypi` and `to-pypi` outputs;
-  - the model's rehearsal rule in steps 2 and 3 (FR-029): on a branch, the tag and branch-membership checks pass as a rehearsal, and every other step runs;
-  - every action pinned by a full commit.
-- [X] T020 [US5] [O] Add `release.yml`'s `testpypi`, `install` and `pypi` jobs per contracts/workflows.md, as detailed below — files: `.github/workflows/release.yml` — verify: `actionlint .github/workflows/release.yml && bash tests/run.sh -k 'test_release_upload_ or test_release_install_check_ or test_release_reads_ or test_release_guard_'`
-  - the order: TestPyPI, then the three-leg install check, then PyPI;
-  - `id-token: write` on the two upload jobs alone, each in its environment, on a `v*` tag. Each upload job gets exactly `id-token: write`, `actions: read` and `contents: read`, and `install` gets `contents: read`;
-  - the re-reads, the empty-index check and the served-digest check, around `pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33`;
-  - the install legs: ubuntu 3.x, macOS 3.x and ubuntu 3.9, with no Windows leg. They check the exact skip and count lines; the macOS leg reruns under `/bin/bash`, printing `BASH_VERSION`; the 3.9 leg compiles the installed payload's own `lanes-index` and `lane-worktrees`;
-  - the repository guard in the upload jobs (FR-048):
-    - `testpypi` runs only when `needs.build.outputs.to-testpypi == 'true'`, and its first step runs the guard again;
-    - `pypi` runs only when `needs.build.outputs.to-pypi == 'true'`, so it is skipped in an rc rehearsal;
-    - `pypi`'s first step refuses anything but a final in `opensoft/openRepoTools-code`, so in `opensoft/openRepoTools` it refuses outright.
-- [X] T021 [US5] [O] Write `release.yml`'s header, RELEASING, in contracts/workflows.md's six sections, as detailed below — files: `.github/workflows/release.yml` — verify: `actionlint .github/workflows/release.yml && bash tests/run.sh -k test_release_`
-  - the procedure on Brett Heap's word, with the tag message's form, and the `gh release create` step after PyPI serves the version;
-  - #850's branch and tag policy:
-    - the trunk;
-    - annotated tags, never moved and never reused;
-    - `release/vX.Y` cut at `vX.Y.0`;
-    - back-ports by fast-forward, by a merge, or by a PR of `cherry-pick -x`;
-    - one HOLD at a time, the landing lane back-porting, and the LANDED line naming both commits;
-    - patch tags waiting for the newest run;
-  - the two rehearsals, and never `1.1.0`:
-    - a branch rehearsal builds with the version of the tag it rehearses: before v1.1.0, the next pre-release, `1.1.0rc1` for the first (research R20);
-    - its commit needs a finished, green push or dispatch run of `tests.yml`, so dispatch `tests.yml` on that branch first;
-    - in an rc rehearsal the `pypi` job is skipped;
-  - where releases come from:
-    - the code leg's tags from v1.1.0, and `v1.0.0` and the `rc` tags staying here;
-    - the repository guard's table (FR-048), with the missing pypi.org publisher as the second line of defence;
-    - Brett Heap's environments, ruleset and publishers;
-  - what the workflow never reads.
-
-**Checkpoint**: User Story 5 is complete. This is pull request 3.
-
----
-
-## Phase 8: User Story 6 - The record tells the truth about releases (Priority: P3)
-
-**Goal**: the notes and README say what exists, and offer nothing that the
-index does not serve.
-
-**Independent Test**: the three verify commands below.
-
-- [X] T022 [P] [US6] [S] Create `docs/release-notes/v1.0.0.md` as exactly the output of `gh release view v1.0.0 --repo opensoft/openRepoTools --json body --jq .body` (research R15) — files: `docs/release-notes/v1.0.0.md` — verify: `gh release view v1.0.0 --repo opensoft/openRepoTools --json body --jq .body | cmp - docs/release-notes/v1.0.0.md`
-- [X] T023 [P] [US6] [S] Draft `docs/release-notes/v1.1.0.md`, as detailed below — files: `docs/release-notes/v1.1.0.md` — verify: `tail -n 1 docs/release-notes/v1.1.0.md | command grep -q 'openRepoTools-spec.*docs/release-notes/v1.1.0.md' && command grep -q '^## Before the tag' docs/release-notes/v1.1.0.md && command grep -q 'pipx install --force openrepotools' docs/release-notes/v1.1.0.md`
-  - what v1.1.0 brings: the `openrepotools` package on PyPI; `pipx install` and the offline `--install` that leaves `openRepoTools` to pipx; `--version` naming the release; and the `package` job and the release workflow;
-  - the move from the one-line install (FR-024): `pipx install --force openrepotools`, then `openRepoTools --install`, and why `--force` is needed;
-  - each value not yet known as a named `<placeholder>`, every one listed in a closing `## Before the tag` checklist;
-  - a last line naming the file's own path in the spec leg, `opensoft/openRepoTools-spec`'s `docs/release-notes/v1.1.0.md`.
-- [X] T024 [P] [US6] [S] Correct `README.md`, as detailed below — files: `README.md`, `tests/test_repo_hygiene.py`, `tests/test_test_roots.py` — verify: `! command grep -qE 'pipx install( --force)? openrepotools' README.md && bash tests/run.sh -k 'repo_hygiene or readme'`
-  - rewrite the paragraph that says "There is no version number here". It now says that releases are annotated tags, that the version comes only from the tag, and what `--version` prints, stamped and unstamped, quoting contracts/cli-output.md's first lines;
-  - correct three passages for a workstation with pipx's link: the SEVENTEEN-files count (sixteen placed and one left to pipx), the symlink paragraph (pipx's `openRepoTools` is the one link skipped), and the artifact-count invariant, "Twenty-nine artifacts always, plus the two hook entries once the path they call answers `guard`" since #237 (twenty-eight placed always, one left to pipx and 28 receipt rows, with the hook pair still on top once that path answers, so that nothing contradicts README's #237 text);
-  - add no pipx install route;
-  - say, in one sentence beside the install routes, that a workstation uses one route or the other until opensoft/workBenches#165 lets workBenches' `setup-estate-commands.sh` accept pipx's link (FR-047: Brett Heap's option (c), 2026-10-18);
-  - where README then passes `test_readme_is_short_enough_to_be_read`'s cap, add that test's dated entry.
-
-**Checkpoint**: every user story is complete. This is pull request 4.
-
----
-
-## Phase 9: Polish & cross-cutting concerns
-
-- [X] T025 [O] Run quickstart.md's steps 1 to 8 on a workstation, as detailed below — files: `specs/006-release-pypi/quickstart.md`, `specs/006-release-pypi/plan.md`, `specs/006-release-pypi/contracts/cli-output.md` (the last two added by the lead's ruling, #228 comment 6255121743) — verify: `bash tests/run.sh`
-  - the wheel built twice and compared;
-  - the built-wheel tests, with no skip;
-  - the pipx install into a temporary home;
-  - the offline `--install`, and the checkout's count line;
-  - the broken stamp refusing `--help`;
-  - `actionlint`;
-  - the v1.0.0 `cmp`.
-
-  Correct quickstart.md where a step's text is wrong, and record the outcome in the pull request.
-
----
-
-## Dependencies & Execution Order
-
-### Phase Dependencies
-
-- **Phase 1 (Setup)** has no dependency, once the branch is up to `main`.
-- **Phase 2 (Foundational)** depends on Phase 1. It blocks every story's
-  tests.
-- **US1 (Phase 3)** depends on Phase 2.
-- **US2 (Phase 4)** depends on US1, because `package_init` builds on
-  `package_payload_dir`. T010 can start at any time.
-- **US3 (Phase 5)** depends on US2, because its count line reads
-  `stamp_read`.
-- **US4 (Phase 6)** depends on US1 to US3, because the `package` job runs
-  their tests and checks their exact lines. T014 and T015 can start once
-  Phase 2 is done.
-- **US5 (Phase 7)** depends on T014 (the locks), T011 (the `--version`
-  label) and T003 (the fixture builders). It is landed after US4, because
-  the release gate requires the `package` job's runs.
-- **US6 (Phase 8)**: T022 and T023 can start at any time. T024 waits for US1
-  to US3, so that README describes behaviour that exists.
-- **Polish (Phase 9)** depends on everything.
-
-### Within each story
-
-- The tests come first, and fail.
-- Then the implementation, then the checkpoint.
-- Each task is committed on its own, with explicit pathspecs.
-
-### Parallel opportunities
-
-- T001 ∥ T002.
-- T004 ∥ T005 ∥ T006, then T007 ∥ T008.
-- T009 ∥ T010.
-- T014 ∥ T015.
-- T022 ∥ T023 ∥ T024.
-
-No two `[P]` tasks of one phase share a path.
-
-## Parallel Example: User Story 1
-
-```bash
-# The tests, together (each in its own file):
-Task: "T004 the US1 tests of tests/test_install_pipx.py"
-Task: "T005 tests/test_package.py"
-Task: "T006 the standard-library test in tests/test_repo_hygiene.py"
-
-# Then the implementation, together (one file each):
-Task: "T007 src/openrepotools/cli.py"
-Task: "T008 the pipx rule in openRepoTools"
-```
-
-## Implementation Strategy
-
-### MVP first (User Stories 1 and 2, both P1)
-
-1. Bring the branch up to `main`. Then Phases 1 and 2.
-2. Phase 3 (US1). Stop, and validate the offline install beside a fake pipx
-   venv.
-3. Phase 4 (US2). Stop, and validate `--version` and the broken-stamp
-   refusal.
-4. US3 completes pull request 1, so that the coexistence lines are true
-   before anything is published.
-
-### Incremental delivery
-
-The four pull requests of plan.md land in order, each by squash once it is
-reviewed and green (the change's `tasks.md` item 3.1). All four land before
-lane openRepoTools-1's rehearsal and adoption plan (item 3.2).
-
-## Coverage outside this task list
-
-These requirements are met by acts that the change's `tasks.md` tracks. They
-are Brett Heap's, or lane openRepoTools-3's on his word, and no build task
-makes them. The task list writes down what each act needs, in the RELEASING
-header (T021), the release notes (T022, T023) and the README (T024).
-
-| Requirement | Met by | Tracked at |
-| --- | --- | --- |
-| FR-029, FR-031: the `testpypi` and `pypi` environments, the `v*` ruleset, the trusted publishers | Brett Heap's acts | change `tasks.md` 4.1, 6.1 |
-| FR-033: the branch rehearsal and the `1.1.0rc1` rehearsal | lane 3, on his word | 4.2, 4.3 |
-| FR-036 to FR-041: tags, `release/v1.1`, back-ports, patch tags | lane 3, on his word | 6.2, 6.3, and later releases |
-| FR-042: each GitHub Release, after PyPI serves the version | lane 3, on his word | 6.3 |
-| FR-045: the pipx route in the assembly's README | lane 3, on his word, once the workBenches condition holds | 6.4 |
-| FR-024: README's copy of the move from the one-line install, beside the pipx route (the v1.1.0 notes carry it already, T023) | lane 3, on his word | 6.4 |
-| FR-031 and FR-048, the second line of defence: no pypi.org publisher for `opensoft/openRepoTools` | Brett Heap's answer 3; the code guard itself is T019 and T020 | 4.1, 6.1 |
-| FR-046: the code leg's `LICENSE` blob `261eeb9`; the plan's entries | lane 3's check; lane openRepoTools-1's plan | 5.1, 5.2 |
-| FR-047: the workBenches condition | decided: Brett Heap chose position (c) on 2026-10-18; lane 3 filed opensoft/workBenches#165 | 1.4 |
-
-Brett Heap chose position (c) on 2026-10-18 ("go with (c)": spec.md's FR-047
-and design.md's open question 12). The one sentence the README says until
-opensoft/workBenches#165 lands, "one route or the other, never both", is
-already a task: T024. No other task depends on FR-047.
-
-## Notes
-
-- The tier counts: 25 tasks, of which 19 are `[O]` and 6 are `[S]`, with no
-  `[H]`.
-- Every task carries one tier tag, a `files:` list and a `verify:` command.
-- `actionlint` is used by T016 and T019 to T021. Install it where it is
-  missing; CI does not run it.
-- T014 and T022 read GitHub (`gh api`, `gh release view`). Every other
-  verify command is offline.
diff --git a/src/openrepotools/__init__.py b/src/openrepotools/__init__.py
deleted file mode 100644
index 87bd7f36..00000000
--- a/src/openrepotools/__init__.py
+++ /dev/null
@@ -1,16 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""openrepotools: openRepoTools as a package, installed with pipx (#228).
-
-The wheel carries the installer's whole payload byte for byte under
-`payload/`, together with the openRepoShape pin, so that
-`openRepoTools --install` run from the package reaches no network. Its one
-console script, `openRepoTools`, runs `cli.main`, which replaces its own
-process with the first `bash` on PATH, running the packaged installer with
-the person's arguments unchanged. `_release.py` is the stamp that names the
-release. At run time bash reads it, and no Python does; hatchling reads its
-`VERSION` at build time.
-
-This file holds the SPDX line and this docstring, and no code, so that
-loading the package, as every console script and every build does, runs no
-code.
-"""
diff --git a/src/openrepotools/_release.py b/src/openrepotools/_release.py
deleted file mode 100644
index bab8f967..00000000
--- a/src/openrepotools/_release.py
+++ /dev/null
@@ -1,25 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The release stamp: which release of openRepoTools this package is (#228).
-
-Only the release build writes this file. Its writer replaces each of the
-five assignment lines below exactly once, with the version the tag names
-(`v1.1.0` gives `1.1.0`), the tag, the tag's 40-hex commit, that commit's
-sorted-ls-tree-r-v1 tree digest and the repository the release ran in. It
-refuses a file in which it finds any of those lines twice or not at all. As
-committed, the file is unstamped: 0.0.0 and four empty values, a package
-built from a checkout and not a release, and `openRepoTools --version` says
-so.
-
-Bash is the one reader at run time. The packaged `openRepoTools` reads this
-file by a fixed grammar (`stamp_read`), and never sources, imports or runs
-it; no Python reads it at run time. Hatchling reads `VERSION` from it at
-build time, by a pattern that takes the first line beginning, in any case,
-with that field's name or with __version__, then an equals sign. So no line
-of this docstring may begin that way, or the build and the command would
-disagree. Keep the file LF only, with each assignment on one line.
-"""
-VERSION = "0.0.0"
-TAG = ""
-COMMIT = ""
-DIGEST = ""
-REPOSITORY = ""
diff --git a/src/openrepotools/cli.py b/src/openrepotools/cli.py
deleted file mode 100644
index e8b16540..00000000
--- a/src/openrepotools/cli.py
+++ /dev/null
@@ -1,87 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The `openRepoTools` console script: bash runs the packaged installer (#228).
-
-pip's console script for `openrepotools.cli:main` calls `main()`, and
-`main()` does one thing (design.md Decision 3). It replaces this process with
-the first `bash` on PATH, running `payload/openRepoTools` from beside this
-file with the person's arguments unchanged:
-`os.execvp("bash", ["bash", <payload>/openRepoTools, *sys.argv[1:]])`.
-
-AN EXEC, NOT A CHILD. The pid the person started becomes the payload's bash,
-so a signal reaches bash itself, the `EXIT` trap that removes a placement's
-temporary runs in that process, and bash's exit status is the command's.
-Run as a subprocess, a signal would come back as a negative return code, and
-the trap would run in a process the person's terminal does not own.
-
-THE SIGNALS PYTHON IGNORES ARE PUT BACK FIRST (Decision 3 as amended by the
-lead on 2026-10-18, FR-003). Python starts with SIGPIPE and SIGXFSZ ignored,
-an exec keeps an ignored disposition, and a non-interactive bash cannot reset
-a signal that was ignored on entry. Measured: bash's `SigIgn` was `0x4` run
-directly and `0x1001004` through the exec, and `yes | head -1` ended in 141
-directly but in 1 and a "Broken pipe" line through it. So `main()` sets both
-to `SIG_DFL` just before the exec, as `subprocess`'s `restore_signals` does
-for a child, and a platform that lacks one has nothing to put back for it.
-Where the exec fails, each goes back to what it was, and only then is the
-refusal printed, so the refusal runs exactly as it did before this change.
-
-IT READS NOTHING AND PASSES NOTHING ELSE. Bash finds package mode from its
-own path and reads the stamp, `_release.py`, by its own fixed grammar; no
-Python reads it at run time, so Python and bash can never disagree about a
-release. Hatchling reads its `VERSION` at build time, and the stamp's
-docstring guard keeps that reading and bash's the same (design.md
-Decision 5). This module sets no variable and adds no option for bash: the
-arguments are the only thing it hands on.
-
-ONE NAMED LIMIT, THE C LOCALE. Under a C or POSIX locale, Python's locale
-coercion (PEP 538) sets `LC_CTYPE=C.UTF-8` before `main()` runs, so bash sees
-it. `main()` does not undo it, because it cannot tell coercion from a
-person's own `LC_CTYPE`; `PYTHONCOERCECLOCALE=0` avoids it (FR-003).
-
-With no `bash` on PATH, it prints contracts/cli-output.md's refusal to stderr
-and returns 2, the status bash's own `die` refuses with, and nothing runs. A
-PATH whose last entry is a file is the same case: `execvp` then raises
-`NotADirectoryError` where it would raise `FileNotFoundError`, and the
-refusal is the same (FR-004).
-
-The standard library only, and of it only `os`, `signal` and `sys`: the
-package declares no dependencies, and `tests/test_repo_hygiene.py` holds
-every module's imports to that allowlist (FR-005).
-"""
-
-import os
-import signal
-import sys
-
-#: contracts/cli-output.md's one refusal that does not go through `die`, so
-#: no blank line comes before it.
-NO_BASH = ("REFUSED: openRepoTools needs bash, and there is no bash on this "
-           "PATH. Nothing ran.")
-
-#: The signals Python's start-up sets to `SIG_IGN`, by name: each is set back
-#: to `SIG_DFL` before the exec, where this platform has it.
-IGNORED_BY_PYTHON = ("SIGPIPE", "SIGXFSZ")
-
-
-def main() -> int:
-    """Become `bash <payload>/openRepoTools <arguments>`, or refuse with 2.
-
-    It returns only when there is no `bash` on PATH; otherwise the exec
-    replaces this process, and bash's exit status is the command's.
-    """
-    payload = os.path.join(os.path.dirname(os.path.abspath(__file__)),
-                           "payload")
-    argv = ["bash", os.path.join(payload, "openRepoTools"), *sys.argv[1:]]
-    found = []
-    for name in IGNORED_BY_PYTHON:
-        number = getattr(signal, name, None)
-        if number is not None:
-            found.append((number, signal.signal(number, signal.SIG_DFL)))
-    try:
-        # S8705 is a false positive: argv is the caller's own command line (#228).
-        os.execvp("bash", argv)  # NOSONAR
-    except (FileNotFoundError, NotADirectoryError):
-        for number, before in found:
-            if before is not None:
-                signal.signal(number, before)
-        print(NO_BASH, file=sys.stderr)
-        return 2
diff --git a/status b/status
deleted file mode 100755
index 4f8a7d9d..00000000
--- a/status
+++ /dev/null
@@ -1,6067 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: Apache-2.0
-#
-# status — what is in and out of sync across an estate, READ-ONLY: `status
-# InkRouter`, or just `status` from inside the estate, or `status --all`.
-#
-# Installed with the other three by `openRepoTools --install`.
-#
-# IT CHANGES NOTHING. It finds the estate exactly as `park` and `resume` do,
-# and then only READS — git's refs, index and working tree — for the family
-# holder or the assembly root, each member's working clone beside the holder,
-# and every mounted leg. It fetches nothing unless told to (`--fetch`), so
-# every ahead/behind answer is AS OF THE LAST FETCH — the one it just made,
-# or the one before — and it says which on every run. `make validate` and
-# `make pins` say whether an estate is CONSISTENT with itself (naming,
-# manifests, lockstep pins); this is the view neither gives — whether it is
-# CURRENT with its remotes, and whether anything here has moved and not
-# travelled.
-#
-# THE FOURTH FILE, under Brett Heap's RULING of 2026-09-10 in this repository
-# (its #9), verbatim: "lets go with a fourth file. start with the local status
-# layer."
-# A flag on `park` would have put a read-only report under a verb whose name
-# means commit-and-push; a fourth file costs the shared estate resolver a
-# third copy, which the suite holds byte-identical, and the install story one
-# more line.
-#
-# THIS IS THE LOCAL LAYER PLUS `--fetch`: what this machine already knows,
-# and — only when asked — what origin knows right now. `--fetch` is the
-# second layer, under Brett Heap's RULING of 2026-09-11 (this repository's
-# #10), verbatim: "next layer: --fetch". It runs `git fetch --prune origin`
-# in every repository
-# about to be read, so the ahead/behind answers are current and a remote
-# branch deleted under a feature reads as gone; that fetch is THE ONE WRITE
-# this command ever makes — remote-tracking refs (`refs/remotes/<remote>/*`:
-# origin, and upstream where a fork has one),
-# the objects behind them and `FETCH_HEAD`, and nothing else: no branch, no
-# tag, no HEAD, no index, no working tree, because the refspec is pinned on
-# the command line rather than trusted from config (see `fetch_remote`).
-# What it cannot do is answer a prompt: `GIT_TERMINAL_PROMPT=0` makes an
-# https credential prompt FAIL and be reported, but an ssh host-key or
-# passphrase prompt is ssh's own and blocks exactly as `git fetch` would —
-# so run `--fetch` where ssh is already non-interactive (an agent, a
-# known_hosts entry). Without the flag it fetches nothing, as before.
-#
-# THE THIRD LAYER is the FORK against what it was forked from, under Brett
-# Heap's RULING of 2026-09-11 (this repository's #11), verbatim: "next layer:
-# fork against upstream".
-# A remote named `upstream` is read from local refs — `origin/<branch>`
-# against `upstream/<branch>`, as of the last fetch — and `--fetch` fetches
-# it too, under the same pinned refspec. With no such remote, and only under
-# `--fetch`, an origin on github.com is asked about with `gh api`, once: a
-# fork is a finding that names the parent and the `git remote add upstream …`
-# that makes the drift readable here. See "the fork against its upstream",
-# below.
-#
-# THE FOURTH LAYER is the SHAPE PIN, under Brett Heap's RULING of 2026-09-11
-# (this repository's #12), verbatim: "next layer: shape-pin drift". Every
-# assembly root and family
-# holder carries `contracts/shape-pin.yaml`: the openRepoShape commit its
-# copied shape files were cut from, and a sha256 per copy. The copies are
-# re-hashed here and one that differs is DRIFT — a copy edited in place, whose
-# exit is upstream, never a re-digest; a `shape:` mirror in `project.yaml` /
-# `family.yaml` that names another commit, or is missing, is out of step; and
-# the pin is read against the source's default branch (`main` for
-# openRepoShape, read from the clone's `origin/HEAD` or from GitHub) — from a
-# clone of the source under the projects directory when there is one, found
-# by its origin's slug the way `--repo` finds an estate, as of its last fetch;
-# else under `--fetch` from GitHub, once per pin per run — so a pin that has
-# fallen behind, or sits on a commit the branch never had, is named with
-# `update-shape.py check` as the exit.
-# See "the shape pin", below.
-#
-# THE FIFTH LAYER, the last of the five named when this file landed, is THE
-# PARKED RECORD AGAINST DISK, under Brett Heap's RULING of 2026-09-11 (this
-# repository's #13), verbatim: "next layer: parked record against disk".
-# `park` records every
-# open feature in the person's private workspace repository — the one
-# `~/.agents/workspace.yaml` names — and `resume` rebuilds the worktrees from
-# it; between the two, record and disk drift apart in exactly the ways
-# `resume` later refuses, and this reads them beforehand: a recorded feature
-# with no worktree here (parked, not resumed — `resume <Name>` is the exit,
-# unless `--no-push` left the commit on the workstation that parked it), a
-# worktree whose branch tip is not the parked commit (moved on, or BEHIND a
-# newer record by more than the WIP commits `resume` itself un-committed, or
-# diverged), a leg parked with `--no-push`, a worktree on a recorded branch
-# that is NOT at the path both verbs compute for it, and a worktree on disk
-# the record does not know (never parked). See "the parked record against
-# disk", below.
-# Nothing is left on the list.
-#
-# READ THE LINES, NOT THE EXIT CODE — the rule `park` and `resume` carry.
-# Exit 0: every repository read is in sync and clean, as of the last fetch.
-# Exit 1: at least one finding was printed. Exit 2: refused, and nothing was
-# read. A finding is a fact to look at, not a fault — an unpushed commit on a
-# feature branch is exactly what `park` exists to carry.
-
-set -euo pipefail
-
-SELF_NAME="status"
-
-NAME=""
-REPO_SLUG=""
-REPO_ARG=""
-#: `flag_value`'s three answers, declared with the other globals so that a
-#: `die` reaching `$FLAG_HINT` before any arm has asked is an empty hint under
-#: `set -u`, never "unbound variable" at exit 1 — the one exit these arms must
-#: not produce (the independent review of this branch, 2026-09-11).
-FLAG_VALUE=""
-FLAG_SHIFT=2
-FLAG_HINT=""
-#: 1 when EVERY estate under the projects directory is to be read: `--all` /
-#: `-a`, or the bare form standing outside every estate — which SWEEPS WITHOUT
-#: ASKING, unlike `park`'s, because nothing here writes and a question before
-#: a read is only friction. `ALL_ROWS` is what the sweep reads, `<name><TAB>
-#: <dir>` per estate.
-STATUS_ALL=0
-ALL_ROWS=""
-#: 1 with `--fetch`: `git fetch --prune origin` in every repository before it
-#: is read — the one write this command makes. See `fetch_remote`.
-FETCH=0
-
-say() { printf '%s\n' "$*"; }
-refuse() { printf '\nREFUSED: %s\n' "$1" >&2; }
-die() { refuse "$1"; exit "${2:-2}"; }
-
-usage() {
-    cat <<'USAGE'
-status [<Name>] [--repo <owner/name>] [--fetch]
-status --all | -a [--fetch]
-status --help
-
-What is in and out of sync across ONE estate, read-only. For the family
-holder or the assembly root, each member's working clone, and every mounted
-leg: whether the tracking branch is ahead of or behind its origin; what is
-dirty or stashed; which feature branches carry commits origin has not seen,
-or point at a remote branch that is gone; whether a feature worktree is
-dirty; and whether a leg is checked out away from its pin, or its pin has
-fallen behind its origin. It FETCHES NOTHING unless you say `--fetch`, so
-every answer is AS OF THE LAST FETCH — the one it just made, or the one
-before — and the report says which. A FORK is read against what it was
-forked from: with a remote named `upstream`, `origin/<branch>` against
-`upstream/<branch>` from local refs, and `--fetch` fetches upstream too; with
-none, and only under `--fetch`, an origin on github.com is asked about once
-with `gh api`, and a fork is a finding naming the parent and the `git remote
-add upstream …` to run. Not a fork: nothing to say. THE SHAPE PIN
-(`contracts/shape-pin.yaml`) is read too: a copied shape file whose sha256 is
-not the one recorded is drift, a `shape:` mirror naming another commit is out
-of step, and the pinned commit is compared with the source's default branch
-— from a clone of the source under your projects directory, found by its
-origin like `--repo` finds an estate, or under `--fetch` from GitHub — so a
-pin that has fallen behind is named with the exit, `update-shape.py check
---root <root>`. THE PARKED RECORD (`~/.agents/workspace.yaml` names the
-workspace repository; `workspaces/<org>/<id>.yaml` in it) is read against the
-worktrees on disk: a recorded feature with no worktree here (`resume <Name>`
-brings it back — unless the record says `--no-push`, or its `pushed:` is
-missing or neither true nor false, which `resume` refuses the same way, or it
-names no parked commit for that leg, which `resume` refuses as moved-on, or it
-gives a leg no role at all, or a role this checkout's shape has no place for —
-one it does not mount, or one `resume` maps only onto the other shape, or onto
-neither, as it maps `assembly` — or lists no leg for it at all, which `resume`
-refuses the whole feature for: then only the workstation that parked it can
-park it again — and where the role is really another shape's, only a checkout
-of that shape, and where it is neither shape's, no checkout at all; and unless
-origin has lost the branch, which `resume` refuses as gone from origin, the
-WHOLE feature with it — after a fetch that WORKED in that repository, which is
-the only way it is settled, a missing `origin/<branch>` is origin's answer and
-the exits are the record's own entry where the feature landed or a push of the
-branch from the workstation that parked it, and without one it is named beside
-the `resume` that still brings back a branch this clone has merely not fetched;
-and where the record's KEY ORDER leaves a `- branch:` or a `- role:` where the
-loader reads neither — it shuts the `features:` list at the next key at project
-indent and a feature's `legs:` list at the next key at feature indent — the
-exits are putting that key back, which is yours and not this command's, and a
-re-park only from the workstation that has the feature, since a park anywhere
-else rewrites the block without those lines;
-and where `git worktree list` still holds a registration that is no longer a
-worktree, that is cleared with `worktree prune`, after a `worktree unlock` if
-it is locked and with any leftover directory moved aside, before `resume` can
-recreate anything; and where ANYTHING ELSE is at the path both verbs compute
-for that leg — a directory, a file, a worktree of another branch — `resume`
-refuses the WHOLE feature rather than overwrite a path it did not create, and
-moving that aside first is yours: a `git worktree move` where git holds it as a
-worktree and a plain `mv` where it does not, with the `worktree unlock` a
-LOCKED registration wants in front of either and the `worktree prune` a dead
-one wants beside the `mv`), a worktree whose tip is not the parked commit or a
-record that names no parked commit to compare it with, a recorded branch this
-repository has no `origin/<branch>` for, a leg parked with `--no-push` or whose
-`pushed:` is missing or neither true nor false, a leg the record gives no role
-or a role this shape has no place for, a feature the record lists no leg for, a
-worktree on a recorded branch that is not at the path BOTH VERBS compute for
-that leg — <worktree_root>/<branch>, with the leg's own mount under it in a
-three-leg root, out of $SPECKIT_GIT_WORKTREE_ROOT, else this checkout's
-git-config.yml, else the shape's own default, and not out of the record — which
-is the only worktree `resume` reads as that feature's and the only one `park`
-carries, so the exit is a `git worktree move` of yours — except where no move
-works and the line says so: the leg's own checkout, a leg declared `path: "."`,
-and a symlink anywhere in that path's own parents, each of which names the
-component — anything at that same path that is not that leg's worktree, which
-`resume` refuses the whole feature for before it reads origin, and a worktree
-the record does not know (never parked).
-
-<Name> is the estate's folder under your projects directory: a FAMILY folder
-(<Name>/<Name>/family.yaml) or a standalone project root (<Name>/project.yaml).
-With no <Name> the estate around the current directory is read. With no
-estate around it either, EVERY estate under your projects directory is read,
-without asking, because nothing here writes; `--all` (or `-a`) says the same
-thing from anywhere. `--repo <owner/name>` names the estate by the origin of
-a clone you ALREADY HAVE, in any spelling git accepts.
-
-  --fetch             `git fetch --prune` of origin — and of upstream, where a
-                      fork has one — in every repository first, so the answers
-                      are current: THE ONE WRITE this command makes, to
-                      remote-tracking refs, the objects behind them and
-                      FETCH_HEAD; never a local branch, tag, HEAD, index or
-                      working tree, because the refspec is pinned. EVERY
-                      repository is fetched before the FIRST ROW is printed,
-                      so the report appears after them; a fetch that fails is
-                      a finding on its own row, read as of the last fetch that
-                      worked. An ssh prompt is ssh's own, still blocks, and
-                      blocks with no row in front of it: it belongs to a
-                      fetch, not to the row you are looking at.
-  --all, -a           read EVERY estate under your projects directory
-  --project <Name>    the positional under a flag (also --name)
-  --flag=<value>      every flag that takes a value takes it after an `=` too
-                      (`--project=<Name>`): the one way to give a value that
-                      begins with `-`, which the spaced spelling refuses
-
-  $PROJECTS_DIR       your projects directory (default: ~/projects, then
-                      ~/Projects - people spell it both ways)
-  $SPECKIT_GIT_WORKTREE_ROOT
-                      the extension's own override of `worktree_root`, read
-                      here because `park` and `resume` read it first of all
-                      three: it moves the path a parked feature's worktree
-                      belongs at, and so what this reports about one
-
-EXIT 0: every repository read is in sync and clean, as of the last fetch.
-EXIT 1: at least one finding was printed. EXIT 2: refused; nothing was read.
-WHAT STATUS NEVER DOES: pull, commit, push, reset, or move anything — and it
-fetches only with `--fetch`. It takes no lock while it reads (`git
---no-optional-locks`); `--fetch` takes the ref locks a fetch takes.
-USAGE
-}
-
-# --- BEGIN shared estate resolver (park, resume, status: byte for byte) -----
-#
-# THIS BLOCK IS DUPLICATED IN THE OTHER COMMANDS, DELIBERATELY, and
-# `tests/test_park_resume_commands.py` asserts the three copies are IDENTICAL.
-# Each of these is one file a person has on PATH: a shared `orp-estate.sh`
-# would be a fifth file for `--install` to place and a broken command the
-# first time somebody copied only one of them. The rules themselves are NOT
-# new: `<dir>/<Name>/family.yaml` carrying `kind: family-manifest` and naming
-# `<Name>` is `setup-project.py`'s `family_folder_here`, doubled-name layout
-# and all (#76, RULING ruling 3). What "naming" accepts is widened by #236,
-# at `is_family_folder` below: the display `name:` or the repository's name.
-
-# `$PROJECTS_DIR` names ONE directory when it is set. Otherwise both
-# spellings, in that order, because people really do use both - and DEDUPED by
-# inode, because on a case-insensitive filesystem (a stock Mac) `~/projects`
-# and `~/Projects` are the same directory, and listing every estate twice
-# would read as two estates.
-PROJECTS_DIRS=()
-if [ -n "${PROJECTS_DIR:-}" ]; then
-    PROJECTS_DIRS=("$PROJECTS_DIR")
-else
-    PROJECTS_DIRS=("$HOME/projects")
-    if [ -d "$HOME/Projects" ]; then
-        if [ -d "$HOME/projects" ] && [ "$HOME/Projects" -ef "$HOME/projects" ]; then
-            : # one directory under two spellings; name it once
-        else
-            PROJECTS_DIRS+=("$HOME/Projects")
-        fi
-    fi
-fi
-
-# Where a NEW clone would go: the first spelling that already exists, else the
-# first named.
-#
-# shellcheck disable=SC2329  # `park` and `status` create nothing and never
-# call this. The block is byte-identical in all three commands BY DESIGN, so
-# each carries a couple of functions only another one asks.
-projects_dir_for_new() {
-    local dir
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        if [ -d "$dir" ]; then
-            printf '%s\n' "$dir"
-            return 0
-        fi
-    done
-    printf '%s\n' "${PROJECTS_DIRS[0]}"
-}
-
-# ONE SCALAR'S TEXT, read the way openRepoShape v1.1.0's `parse_yaml` reads
-# it (`scripts/repo_shape.py`: `_strip_comment`, `_quote_end`,
-# `_quoted_scalar`), so a file both of them read gets one answer (#243). A
-# value that OPENS WITH A QUOTE is the text up to the quote that closes it -
-# inside `"..."` a `\` takes the character after it along, and inside `'...'`
-# a doubled `''` is one quote, so neither closes it - and whatever follows
-# the close, a `# comment` included, is not the value: a ` #` inside the
-# quotes is text. Any other value is cut at the first `#` that opens it or
-# follows a space or tab, which is a comment, and trimmed; `a#b` is the text
-# `a#b`. The escapes are honoured to find the close and never unescaped, as
-# this reader never unescaped them: no branch, path, folder or repository
-# name it is asked for carries one. A quote nothing closes is not YAML at
-# all, and the text is kept whole, as before. What is NULL is not said here:
-# `null` and `"null"` are both the text `null`, and `yaml_scalar` says which
-# of the two it was.
-trim_unquote() {
-    local value="$1" quote="" ch="" i=1
-    value="${value%$'\r'}"
-    value="${value#"${value%%[![:space:]]*}"}"
-    case "$value" in
-    '"'* | "'"*)
-        quote="${value:0:1}"
-        while [ "$i" -lt "${#value}" ]; do
-            ch="${value:$i:1}"
-            if [ "$quote" = '"' ] && [ "$ch" = "\\" ]; then
-                i=$((i + 2))
-            elif [ "$ch" != "$quote" ]; then
-                i=$((i + 1))
-            elif [ "$quote" = "'" ] && [ "${value:$((i + 1)):1}" = "'" ]; then
-                i=$((i + 2))
-            else
-                printf '%s' "${value:1:$((i - 1))}"
-                return 0
-            fi
-        done
-        ;;
-    *)
-        value=" $value"
-        value="${value%%[[:space:]]#*}"
-        value="${value#"${value%%[![:space:]]*}"}"
-        ;;
-    esac
-    printf '%s' "${value%"${value##*[![:space:]]}"}"
-}
-
-# ONE FOLDER NAME, and never a path. A `<Name>` off the command line and a
-# `root:` out of somebody's workspace manifest both end up joined to the
-# projects directory, so both are held to this: no empty string, no `/`, and
-# no leading `.` — which is what stops `resume ../../elsewhere/X` from cloning
-# outside the projects directory at all, rather than noticing afterwards.
-is_safe_folder_name() {
-    local name="$1"
-    case "$name" in
-    "" | .* | */*) return 1 ;;
-    esac
-    case "$name" in
-    *[!A-Za-z0-9_.+@-]*) return 1 ;;
-    esac
-    return 0
-}
-
-# One indent-zero scalar out of a small YAML file, with parameter expansion
-# only: no YAML library, no python per line, no forks per line. The line is
-# found the way the Speckit extension's `workspace_read_scalar` finds one, at
-# indent zero by its key; the VALUE is `trim_unquote`'s, above, which is
-# openRepoShape v1.1.0's reading of it and differs from the extension's where
-# a `#` sits inside quotes or with no space in front of it, and on a line that
-# is not YAML at all (#243). The keys the three commands ask for are
-# `family.yaml`'s and `project.yaml`'s, a record's `family:`, the two of
-# `workspace.yaml`, and the shape pin's.
-# `YAML_QUOTED` is 1 when the value was QUOTED: YAML's null is an unquoted
-# `null` or `~`, and a quoted `"null"` is the text, which is a difference
-# `trim_unquote`'s answer alone cannot carry (`named_for_repository`).
-YAML_VALUE=""
-YAML_QUOTED=0
-yaml_scalar() {
-    local file="$1" key="$2" line value
-    YAML_VALUE=""
-    YAML_QUOTED=0
-    [ -f "$file" ] || return 1
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "$key":*) ;;
-        *) continue ;;
-        esac
-        value="${line#"$key":}"
-        case "${value#"${value%%[![:space:]]*}"}" in
-        '"'* | "'"*) YAML_QUOTED=1 ;;
-        esac
-        YAML_VALUE="$(trim_unquote "$value")"
-        return 0
-    done <"$file"
-    return 1
-}
-
-# A LINKED WORKTREE, not a checkout of its own: `.git` is a FILE holding a
-# `gitdir:` line, and `--git-dir` and `--git-common-dir` disagree. A
-# single-repository project's FEATURE worktree is a whole `project.yaml` root
-# by construction, so without this the walk-up would answer `<worktree_root>/
-# 001-my-feature` as an estate named after the branch — and `park` would run
-# the write verb inside the very worktree the extension is about to park.
-# GIT'S OWN ANSWER, and not the `.git`-is-a-file shortcut, because that shape
-# is shared with a SUBMODULE and a leg must not be mistaken for a worktree:
-# in a linked worktree `--git-dir` is `<common>/worktrees/<name>` and the two
-# differ; in a submodule both are `<super>/.git/modules/<name>`; in an
-# ordinary checkout both are `.git`. Verified against all three.
-is_linked_worktree() {
-    local dir="$1" gitdir common
-    [ -e "$dir/.git" ] || return 1
-    gitdir="$(git -C "$dir" rev-parse --git-dir 2>/dev/null || true)"
-    common="$(git -C "$dir" rev-parse --git-common-dir 2>/dev/null || true)"
-    [ -n "$gitdir" ] && [ -n "$common" ] && [ "$gitdir" != "$common" ]
-}
-
-# The PINNED copy inside a family holder: `<Family>/<Family>/members/<X>`, so
-# the grandparent carries the `family.yaml`. It is detached, it is what
-# `bootstrap` and `validate` read, and nobody's in-flight work is in it — a
-# walk-up that answered it would run a WRITE verb on a detached HEAD. The
-# working clone BESIDE the holder is the one a person works in, which is the
-# same rule #80's holder dispatch follows.
-is_pinned_member() {
-    local dir="$1" parent grandparent
-    parent="${dir%/*}"
-    [ -n "$parent" ] && [ "$parent" != "$dir" ] || return 1
-    grandparent="${parent%/*}"
-    [ -n "$grandparent" ] && [ "$grandparent" != "$parent" ] || return 1
-    yaml_scalar "$grandparent/family.yaml" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ]
-}
-
-# Is `<dir>` a FAMILY FOLDER? All three facts have to agree: the holder clone
-# sits at `<dir>/<basename>`, its `family.yaml` says `kind: family-manifest`,
-# and the folder is named for the family. A family has TWO names and either
-# one is the folder's (#236): its display `name:`, which is the rule this
-# block began with and what an estate laid out before openRepoShape v1.1.0
-# has, or the LAST PART of its `repository:`, which is v1.1.0's rule - the
-# holder, and the folder around it, are named for the REPOSITORY, `name:`
-# being only a title (opensoft/openRepoShape#629), and the holder's `make
-# siblings` stops before cloning when the folder is not that name
-# (opensoft/openRepoShape#543). A family whose two names differ has no layout
-# that works for both unless both are accepted. A directory called Northwind
-# is a directory called Northwind; what makes it a family folder is read,
-# never guessed from a name. The repository arm is `named_for_repository`,
-# below, which `status` and `resume` also ask when one family is on disk in
-# both layouts (#243).
-is_family_folder() {
-    local dir="$1" name manifest
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    manifest="$dir/$name/family.yaml"
-    yaml_scalar "$manifest" kind || return 1
-    [ "$YAML_VALUE" = "family-manifest" ] || return 1
-    if yaml_scalar "$manifest" name && [ "$YAML_VALUE" = "$name" ]; then
-        return 0
-    fi
-    named_for_repository "$dir"
-}
-
-# Is `<dir>` named for its holder's REPOSITORY: the LAST PART of
-# `<dir>/<basename>/family.yaml`'s `repository:`, as v1.1.0's `repo_basename`
-# takes it (`rsplit("/", 1)[-1]`)? That is the folder v1.1.0 prescribes, and
-# where `make siblings` moves a holder that is not in it. AN UNQUOTED `null`
-# OR `~` IS NO REPOSITORY (#243) - nor `Null` or `NULL`, the spellings
-# v1.1.0's `_scalar` reads as null too - so a folder called `null` is not
-# named for one, and `is_family_folder` has only the display `name:` left to
-# go on, which is v1.1.0's own fallback. A QUOTED `"null"` is the text.
-named_for_repository() {
-    local dir="$1" name
-    name="${dir##*/}"
-    [ -n "$name" ] || return 1
-    yaml_scalar "$dir/$name/family.yaml" repository || return 1
-    if [ "$YAML_QUOTED" -eq 0 ]; then
-        case "$YAML_VALUE" in null | Null | NULL | '~') return 1 ;; esac
-    fi
-    [ "${YAML_VALUE##*/}" = "$name" ]
-}
-
-is_project_root() {
-    local dir="$1"
-    yaml_scalar "$dir/project.yaml" kind || return 1
-    [ "$YAML_VALUE" = "project-manifest" ] || return 1
-    is_pinned_member "$dir" && return 1
-    is_linked_worktree "$dir" && return 1
-    return 0
-}
-
-ESTATE_KIND=""
-ESTATE_DIR=""
-ESTATE_ROOT=""
-ESTATE_NAME=""
-
-# Is THIS directory an estate? A FAMILY FOLDER WINS over a standalone root of
-# the same name: the holder is what drives the members, so a family answered as
-# one of its own members would act on one project and report the estate done.
-estate_here() {
-    local dir="$1"
-    if is_family_folder "$dir"; then
-        ESTATE_KIND="family"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir/$ESTATE_NAME"
-        return 0
-    fi
-    if is_project_root "$dir"; then
-        ESTATE_KIND="standalone"
-        ESTATE_DIR="$dir"
-        ESTATE_NAME="${dir##*/}"
-        ESTATE_ROOT="$dir"
-        return 0
-    fi
-    return 1
-}
-
-# The NEAREST estate at or above `<dir>`: the holder beside you, or the project
-# root you are standing in. NEAREST WINS, so standing inside a member of a
-# family acts on that member - the estate the person is standing in. A pinned
-# copy and a linked worktree are WALKED PAST rather than answered, so
-# `<Family>/<Family>/members/<X>` reaches the family folder and a feature
-# worktree reaches the root that owns it.
-estate_walk_up() {
-    local dir="$1"
-    while [ -n "$dir" ] && [ "$dir" != "/" ]; do
-        estate_here "$dir" && return 0
-        dir="${dir%/*}"
-    done
-    return 1
-}
-
-estate_by_name() {
-    local want="$1" dir
-    is_safe_folder_name "$want" || return 1
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        estate_here "$dir/$want" && return 0
-    done
-    return 1
-}
-
-# Every estate under the projects directory, one row each. What ruling 3 asks
-# a refusal to print: a person who typed the command in the wrong folder needs
-# the names, not an instruction to go and look for them.
-list_estates() {
-    local dir child
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            if is_family_folder "$child"; then
-                printf '  family   %-20s %s\n' "${child##*/}" "$child"
-            elif is_project_root "$child"; then
-                printf '  project  %-20s %s\n' "${child##*/}" "$child"
-            fi
-        done
-    done
-}
-
-estates_or_none() {
-    local rows
-    rows="$(list_estates)"
-    if [ -n "$rows" ]; then
-        printf '%s\n' "$rows"
-    else
-        printf '  (none)\n'
-    fi
-}
-
-# Every FAMILY FOLDER under the projects directory whose holder's
-# `family.yaml` says `id: <id>`, one per line, in `list_estates`' order, and
-# nothing for an empty <id>. The id is what `park.sh` files a family's record
-# under (`workspace_family_name` reads it), and it is the SAME in every layout
-# of one family: v1.1.0's folder named for the repository and the
-# display-name folder before it are two directories, two estates and ONE
-# record (#243). So this is how `resume` finds a holder its record's folder
-# no longer names, and how `status` sees one family laid out twice.
-#
-# ONE FOLDER IS LISTED ONCE, however many spellings reach it. `PROJECTS_DIRS`
-# is deduped by inode, but the folders inside two distinct directories are
-# not: a `~/Projects/Quill` that is a LINK to `~/projects/Quill` is one
-# holder, and listing it twice made `resume` refuse "2 family folders" and
-# `status` report one family "laid out 2 times" (the review of #251, finding
-# 1). So a folder that is `-ef` one already listed is skipped, and the first
-# spelling, in `PROJECTS_DIRS`' order, is the one named.
-#
-# shellcheck disable=SC2329  # `park` never asks: it files the record, and
-# never looks a holder up by it. The block is byte-identical by design.
-family_folders_with_id() {
-    local want="$1" dir child prior dup
-    local -a found=()
-    [ -n "$want" ] || return 0
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            is_family_folder "$child" || continue
-            yaml_scalar "$child/${child##*/}/family.yaml" id || continue
-            [ "$YAML_VALUE" = "$want" ] || continue
-            dup=0
-            for prior in ${found[@]+"${found[@]}"}; do
-                if [ "$child" -ef "$prior" ]; then dup=1; fi
-            done
-            [ "$dup" -eq 0 ] || continue
-            found+=("$child")
-            printf '%s\n' "$child"
-        done
-    done
-}
-
-lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
-
-# `owner/name` — CASE PRESERVED, so a refusal prints back what a person can
-# type — out of any spelling git accepts: owner/name, owner/name.git,
-# https://host/owner/name(.git), git@host:owner/name.git,
-# ssh://git@host/owner/name.git, and a token-bearing https url. Callers
-# compare with `lower` on both sides, because GitHub owners and names are
-# case-insensitive.
-#
-# A FILESYSTEM PATH IS REFUSED rather than parsed, for the reason the
-# extension's own `workspace_org_from_url` refuses one: `/srv/remotes/Name.git`
-# has a name but no owner, and inventing `remotes` as the owner would let
-# `--repo remotes/Name` match a bare repository on disk. Such a clone answers
-# `<Name>` and the walk-up; it does not answer `--repo`.
-repo_slug_of() {
-    local url="$1" rest owner name
-    rest="$url"
-    case "$rest" in
-    /* | ./* | ../* | [A-Za-z]:[/\\]* | file://*) return 1 ;;
-    esac
-    rest="${rest%/}"
-    rest="${rest%.git}"
-    case "$rest" in
-    *://*)
-        rest="${rest#*://}"
-        rest="${rest#*@}"
-        rest="${rest#*/}"
-        ;;
-    *@*:*)
-        rest="${rest#*@}"
-        rest="${rest#*:}"
-        ;;
-    esac
-    case "$rest" in
-    */*) ;;
-    *) return 1 ;;
-    esac
-    name="${rest##*/}"
-    owner="${rest%/*}"
-    owner="${owner##*/}"
-    [ -n "$owner" ] && [ -n "$name" ] || return 1
-    case "$owner$name" in
-    *[!A-Za-z0-9_.-]*) return 1 ;;
-    esac
-    printf '%s/%s\n' "$owner" "$name"
-}
-
-# The clone under the projects directory whose `origin` IS that repository -
-# ruling 1. Two levels deep, because the estates this standard places are
-# `<projects>/<Project>` and `<projects>/<Family>/<Project>`.
-clone_with_origin() {
-    local want dir candidate origin found
-    want="$(lower "$1")"
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for candidate in "$dir"/*/ "$dir"/*/*/; do
-            candidate="${candidate%/}"
-            [ -e "$candidate/.git" ] || continue
-            origin="$(git -C "$candidate" remote get-url origin 2>/dev/null || true)"
-            [ -n "$origin" ] || continue
-            found="$(repo_slug_of "$origin" || true)"
-            [ -n "$found" ] || continue
-            if [ "$(lower "$found")" = "$want" ]; then
-                printf '%s\n' "$candidate"
-                return 0
-            fi
-        done
-    done
-    return 1
-}
-
-# The family's members, by the same `  - project: <Project>` row `family.py`
-# writes and `siblings.py` reads. The working clone is `<family folder>/
-# <Project>`, beside the holder.
-family_members() {
-    local manifest="$1" line
-    [ -f "$manifest" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        case "$line" in
-        "  - project: "*) printf '%s\n' "$(trim_unquote "${line#  - project: }")" ;;
-        esac
-    done <"$manifest"
-}
-
-# The branch a checkout belongs on: its OWN manifest's `tracking_branch:` —
-# the field `scripts/bootstrap.py` already reads to place the legs — falling
-# back to `main`. The workspace manifest records a `tracking_branch` too, but
-# that is PROVENANCE from the machine that parked; the local declaration is
-# what this machine's clone actually tracks, and the extension takes the same
-# line about `worktree_root`.
-tracking_branch_of() {
-    local root="$1"
-    if yaml_scalar "$root/family.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    if yaml_scalar "$root/project.yaml" tracking_branch && [ -n "$YAML_VALUE" ]; then
-        printf '%s\n' "$YAML_VALUE"
-        return 0
-    fi
-    printf 'main\n'
-}
-
-# The legs a root declares, by path, out of `project.yaml`'s `legs:` block —
-# the same rows `scripts/bootstrap.py` reads, and in the order it reads them,
-# `role:` before `path:`. The assembly leg is `path: "."` and is the root
-# itself, so it is not one of these.
-#
-# shellcheck disable=SC2329  # only `resume` bootstraps a root, so only
-# `resume` has to ask where its legs are; see the note above.
-legs_of() {
-    local root="$1" line role="" path=""
-    [ -f "$root/project.yaml" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            [ -n "$role" ] || continue
-            [ "$role" != "assembly" ] || continue
-            [ "$path" != "." ] || continue
-            [ -n "$path" ] && printf '%s\n' "$path"
-            ;;
-        [![:space:]]*) role=""; path="" ;;
-        esac
-    done <"$root/project.yaml"
-}
-
-# The branch a leg's OWN row declares for it: `leg_branch_of <root> <leg path>`
-# prints the `branch:` of the `legs:` row whose `path:` is <leg path>, and
-# NOTHING when that row declares none, or no row has the path. It is the
-# value `scripts/bootstrap.py` puts first — `str(leg.get("branch") or branch)`
-# — so a leg is placed on its own `branch:` and on the root's
-# `tracking_branch:` only when its row has no `branch:` of its own; a caller
-# falls back to `tracking_branch_of` on an empty answer, which is that `or`.
-#
-# Read the way `legs_of` reads the same rows — `role:` before `path:`, the
-# assembly row and a row with no role skipped — except that `branch:` may sit
-# on either side of `path:` in its row, so the answer comes the moment the
-# row has shown both, and a row that does not open with `- role:` clears what
-# the row before it left. A leg is found by its path SPELLED EITHER WAY: the
-# caller may hold `.gitmodules`' `spec` (`status`) or the manifest's own text
-# (`resume`), and `./spec` and `spec/` are one leg, so a leading `./` and a
-# trailing `/` come off both sides before they are compared.
-#
-# WHAT IS NO BRANCH: an empty value, `null`, `Null`, `NULL` or `~`, once a
-# trailing ` # comment` is cut off the value (a branch name holds no space, so
-# ` #` cannot be inside one). The loader is not matched to the letter: it keeps
-# a QUOTED `"null"` and `'~'` as branches and reads `false` and `0` as no
-# branch, while this does the opposite for both. No real branch is named any
-# of those, so nothing here chases the difference. (Since #243 `trim_unquote`
-# cuts that comment as well; the cut here runs first and is kept.)
-#
-# WHO ASKS IT: `resume`'s leg guard (`root_legs_ok`), `status`'s
-# `estate_repos` and `read_leg`, and `park`'s not-carried report
-# (`report_repos`, #242, PR #249) - each to know the branch a leg belongs on.
-#
-# shellcheck disable=SC2329  # a `park` from before #249 never calls it;
-# the disable can go once #249 has landed.
-leg_branch_of() {
-    local root="$1" want="$2" line role="" path="" branch=""
-    [ -n "$want" ] || return 0
-    [ -f "$root/project.yaml" ] || return 0
-    want="${want#./}"
-    want="${want%/}"
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '  - role:'*)
-            role="$(trim_unquote "${line#*:}")"
-            path=""
-            branch=""
-            ;;
-        '  - '*) role=""; path=""; branch="" ;;
-        '    path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            path="${path#./}"
-            path="${path%/}"
-            [ -n "$role" ] || path=""
-            [ "$role" != "assembly" ] || path=""
-            ;;
-        '    branch:'*)
-            branch="${line#*:}"
-            branch="$(trim_unquote "${branch%%[[:space:]]#*}")"
-            case "$branch" in null | Null | NULL | '~') branch="" ;; esac
-            ;;
-        [![:space:]]*) role=""; path=""; branch="" ;;
-        esac
-        if [ -n "$path" ] && [ "$path" = "$want" ] && [ -n "$branch" ]; then
-            printf '%s\n' "$branch"
-            return 0
-        fi
-    done <"$root/project.yaml"
-}
-# --- END shared estate resolver ---------------------------------------------
-
-# --- reading one repository -------------------------------------------------
-
-# `git` FOR READING, and every git call in this file goes through it.
-# `--no-optional-locks` (git 2.15, 2017) keeps `status --porcelain` from
-# refreshing the index under a lock, so a `status` running beside an editor
-# or a `git commit` is never the thing that says `index.lock exists`. `-C` is
-# first so the call reads exactly as `git -C <repo> …` does.
-g() { git --no-optional-locks -C "$@"; }
-
-short() { printf '%s' "${1:0:7}"; }
-
-has_ref() { g "$1" rev-parse --verify -q "$2" >/dev/null 2>&1; }
-
-# The legs a root DECLARES in `.gitmodules` — the same file `make bootstrap`
-# mounts them from — each marked `mounted` or `unmounted` by whether `.git`
-# is there. Not the shared `legs_of`, which reads what `project.yaml` says:
-# this report is about what is on disk, and a leg that is declared and not
-# mounted is itself one of its findings. `git config --get-regexp` prints
-# `key value`, so the value is everything after the first space.
-declared_legs() {
-    local root="$1" record path
-    [ -f "$root/.gitmodules" ] || return 0
-    # `-z`, so the key and the value cannot be confused: a submodule NAME may
-    # carry a space (`[submodule "sp ace"]`), and splitting the plain output
-    # at its first space would hand back `ace.path spec` and miss the leg;
-    # with `-z` each entry is `key<LF>value<NUL>`, and a key with NO value has
-    # no LF at all and is not a path — not a phantom leg declared and never
-    # mounted. `park`'s `submodule_paths` reads the same way.
-    while IFS= read -r -d '' record; do
-        case "$record" in
-        *$'\n'*) path="${record#*$'\n'}" ;;
-        *) continue ;;
-        esac
-        [ -n "$path" ] || continue
-        if [ -e "$root/$path/.git" ]; then
-            printf 'mounted\t%s\n' "$path"
-        else
-            printf 'unmounted\t%s\n' "$path"
-        fi
-    done < <(g "$root" config --file .gitmodules -z \
-        --get-regexp '^submodule\..*\.path$' 2>/dev/null || true)
-}
-
-# `label<TAB>branch<TAB>path` per repository this estate reads — `park`'s
-# not-carried report's enumeration, with two rows it does not need: `missing`,
-# for a member with no working clone beside the holder, and `unmounted`, for a
-# leg declared and not there. Both are things out of sync with the estate as
-# recorded, which is what this command is for. A LEG'S BRANCH COLUMN IS THE
-# SAME as `park`'s: the `branch:` the leg's own row declares, else the root's
-# `tracking_branch:` (`leg_branch_of`; #235, #242).
-#
-# `members/<Project>` INSIDE A FAMILY HOLDER IS DELIBERATELY NOT HERE, for
-# park's reason: that copy is pinned and DETACHED, for `bootstrap` and
-# `validate`; nobody works in it. The working clone BESIDE the holder is
-# where a person works, so it is what is read.
-estate_repos() {
-    local member branch state leg legbranch
-    if [ "$ESTATE_KIND" = "family" ]; then
-        printf 'holder\t%s\t%s\n' "$(tracking_branch_of "$ESTATE_ROOT")" \
-            "$ESTATE_ROOT"
-        while IFS= read -r member; do
-            [ -n "$member" ] || continue
-            if [ ! -e "$ESTATE_DIR/$member/.git" ]; then
-                printf 'missing\t%s\t%s\n' \
-                    "$(tracking_branch_of "$ESTATE_ROOT")" "$ESTATE_DIR/$member"
-                continue
-            fi
-            branch="$(tracking_branch_of "$ESTATE_DIR/$member")"
-            printf 'root\t%s\t%s\n' "$branch" "$ESTATE_DIR/$member"
-            while IFS=$'\t' read -r state leg; do
-                [ -n "$leg" ] || continue
-                # A LEG'S branch is the `branch:` its own row declares, else
-                # the ROOT's `tracking_branch:` — what `scripts/bootstrap.py`
-                # places it on (#235).
-                legbranch="$(leg_branch_of "$ESTATE_DIR/$member" "$leg")"
-                printf '%s\t%s\t%s\n' "$state" "${legbranch:-$branch}" "$ESTATE_DIR/$member/$leg"
-            done < <(declared_legs "$ESTATE_DIR/$member")
-        done < <(family_members "$ESTATE_ROOT/family.yaml")
-        return 0
-    fi
-    branch="$(tracking_branch_of "$ESTATE_ROOT")"
-    printf 'root\t%s\t%s\n' "$branch" "$ESTATE_ROOT"
-    while IFS=$'\t' read -r state leg; do
-        [ -n "$leg" ] || continue
-        legbranch="$(leg_branch_of "$ESTATE_ROOT" "$leg")"
-        printf '%s\t%s\t%s\n' "$state" "${legbranch:-$branch}" "$ESTATE_ROOT/$leg"
-    done < <(declared_legs "$ESTATE_ROOT")
-}
-
-# The findings for the repository being read, one line each, in the order
-# they were found. Printed by `read_one_estate` under the repository's own
-# row, or replaced by one `in sync` line when there are none. EXPANDED ONLY
-# WHEN NON-EMPTY: `"${arr[@]}"` on an empty array is an unbound-variable
-# error under `set -u` in every bash before 4.4, and a Mac's is 3.2.
-FINDINGS=()
-finding() { FINDINGS+=("$1"); }
-
-# Where HEAD is: `branch<TAB><name>`, `detached<TAB><sha>`, or `unborn`.
-# `symbolic-ref -q` prints the branch when HEAD is symbolic and exits 1,
-# silently, when it is not — which is the whole test.
-head_of() {
-    local repo="$1" name sha
-    name="$(g "$repo" symbolic-ref -q --short HEAD 2>/dev/null || true)"
-    if [ -n "$name" ]; then
-        printf 'branch\t%s\n' "$name"
-        return 0
-    fi
-    sha="$(g "$repo" rev-parse -q --verify HEAD 2>/dev/null || true)"
-    if [ -n "$sha" ]; then
-        printf 'detached\t%s\n' "$sha"
-    else
-        printf 'unborn\t\n'
-    fi
-}
-
-# A ROOT OR A HOLDER belongs on its tracking branch: `resume` refuses one on a
-# feature branch, and a detached root is one `make bootstrap` never ran in.
-read_head() {
-    local repo="$1" branch="$2" kind ref
-    IFS=$'\t' read -r kind ref < <(head_of "$repo")
-    case "$kind" in
-    branch)
-        [ "$ref" = "$branch" ] ||
-            finding "on branch $ref, not $branch (\`resume\` refuses a root on a feature branch)"
-        ;;
-    detached) finding "detached HEAD at $(short "$ref"); expected to be on $branch" ;;
-    unborn) finding "no commits at all" ;;
-    esac
-}
-
-# No `origin/<branch>` locally. Without a fetch that is "never fetched, or no
-# remote named origin"; right after one that WORKED it means origin has no
-# such branch — deleted or renamed there — and saying "never fetched" would
-# contradict the `fetched origin:` line printed just above it.
-no_origin_branch_finding() {
-    if [ "$FETCHED_OK" -eq 1 ]; then
-        finding "no origin/$1 after the fetch: origin has no branch $1 (deleted or renamed there)"
-    else
-        finding "no origin/$1 here: never fetched, or no remote named origin"
-    fi
-}
-
-# The tracking branch against origin's copy of it, AS OF THE LAST FETCH: park
-# fetches nothing and neither does this. BOTH refs must exist locally or there
-# is no question to ask, and each absence is its own finding, because a clone
-# with no `origin/<branch>` is one that was never fetched or has no remote
-# named origin — either way, "in sync" would be a fiction. `rev-list
-# --left-right --count a...b` prints `<only in a> <only in b>`, so with origin
-# on the left the first number is BEHIND and the second AHEAD.
-read_tracking() {
-    local repo="$1" branch="$2" counts behind ahead
-    if ! has_ref "$repo" "refs/heads/$branch"; then
-        finding "no local branch $branch"
-        return 0
-    fi
-    if ! has_ref "$repo" "refs/remotes/origin/$branch"; then
-        no_origin_branch_finding "$branch"
-        return 0
-    fi
-    counts="$(g "$repo" rev-list --left-right --count \
-        "origin/$branch...$branch" 2>/dev/null || true)"
-    [ -n "$counts" ] || return 0
-    behind="${counts%%[[:space:]]*}"
-    ahead="${counts##*[[:space:]]}"
-    [ "$ahead" = 0 ] ||
-        finding "ahead of origin/$branch by $ahead commit(s): unpushed"
-    [ "$behind" = 0 ] ||
-        finding "behind origin/$branch by $behind commit(s), as of the last fetch"
-}
-
-# Dirty and stashed. `--ignore-submodules=all` at a root, because a leg whose
-# checkout has moved shows up in the ROOT's porcelain as ` M <leg>`, and the
-# leg's own row below reports that once, in its own words.
-read_worktree_state() {
-    local repo="$1" out n
-    out="$(g "$repo" status --porcelain --ignore-submodules=all 2>/dev/null || true)"
-    if [ -n "$out" ]; then
-        n="$(printf '%s\n' "$out" | wc -l | tr -d ' ')"
-        finding "dirty: $n path(s)"
-    fi
-    n="$(g "$repo" stash list 2>/dev/null | wc -l | tr -d ' ' || true)"
-    [ "$n" = 0 ] || finding "$n stash(es)"
-}
-
-# Every local branch OTHER than the tracking branch — the feature branches —
-# by what `for-each-ref` knows without a fetch: no upstream at all means
-# never pushed; `[gone]` means the remote branch was deleted under it, which
-# is what a merged pull request leaves behind; `[ahead N]` is unpushed work.
-# `%(upstream:track)` prints `[ahead 1]`, `[behind 2]`, `[ahead 1, behind 2]`,
-# `[gone]` or nothing, so the count is what follows `ahead ` up to the next
-# `]` or `,`. THE FIELDS ARE SEPARATED BY 0x1F, NOT TAB: a tab is IFS
-# whitespace, so a run of tabs collapses and an EMPTY middle field shifts the
-# ones after it left — `name<TAB><TAB>[gone]` would read as upstream=`[gone]`
-# and the finding would vanish. 0x1F (`%1f` to for-each-ref, `$'\037'` to
-# bash 3.2) is not whitespace, so every field stays where it was printed.
-read_branches() {
-    local repo="$1" tracking="$2" name upstream track n base
-    while IFS=$'\037' read -r name upstream track; do
-        [ -n "$name" ] || continue
-        [ "$name" != "$tracking" ] || continue
-        if [ -z "$upstream" ]; then
-            base="origin/$tracking"
-            has_ref "$repo" "refs/remotes/$base" || base="$tracking"
-            n="$(g "$repo" rev-list --count "$base..$name" 2>/dev/null || printf '?')"
-            if [ "$n" = 0 ]; then
-                finding "branch $name: never pushed; no commit of its own yet (no upstream branch)"
-            else
-                finding "branch $name: $n commit(s) never pushed (no upstream branch)"
-            fi
-            continue
-        fi
-        case "$track" in
-        *gone*)
-            finding "branch $name: its remote branch $upstream is gone (merged, or deleted)"
-            ;;
-        *ahead*)
-            n="${track#*ahead }"
-            n="${n%%[],]*}"
-            finding "branch $name: $n commit(s) unpushed to $upstream"
-            ;;
-        esac
-    done < <(g "$repo" for-each-ref refs/heads \
-        --format='%(refname:short)%1f%(upstream:short)%1f%(upstream:track)' \
-        2>/dev/null || true)
-}
-
-# The LINKED worktrees of a root — the Speckit extension's feature worktrees
-# — and whether each is dirty. Their branches are already read above; what a
-# branch cannot say is that the worktree holds uncommitted work, which is
-# exactly the work `park` would refuse to guess about. `worktree list
-# --porcelain` prints blank-line-separated blocks, the main worktree first,
-# so the first block is skipped rather than compared by path (a Mac's
-# `/tmp` is `/private/tmp`, and two spellings of one path would compare
-# unequal).
-#
-# WHAT IS ON DISK IS `worktree_is_usable`'s ANSWER, below, the same rule the
-# record layer and its sweep now apply — so the three readers of this
-# porcelain agree about what a worktree on disk IS: a directory with its own
-# `.git`. A leftover directory without one is not a worktree to read, and
-# reading it is worse than useless where the feature worktrees live UNDER the
-# root, which is where the extension puts them: `git status` there finds no
-# repository, walks UP, and reports the ROOT's dirty paths on the worktree's
-# row, under a branch that has nothing to do with them.
-read_worktrees() {
-    local repo="$1" line path="" branch="" first=1 out n
-    while IFS= read -r line; do
-        case "$line" in
-        "worktree "*) path="${line#worktree }"; branch="" ;;
-        "branch "*) branch="${line#branch refs/heads/}" ;;
-        "")
-            if [ "$first" -eq 1 ]; then
-                first=0
-            elif [ -n "$path" ] && worktree_is_usable "$path"; then
-                out="$(g "$path" status --porcelain --ignore-submodules=all 2>/dev/null || true)"
-                if [ -n "$out" ]; then
-                    n="$(printf '%s\n' "$out" | wc -l | tr -d ' ')"
-                    finding "worktree ${path#"$ESTATE_DIR"/} on ${branch:-a detached HEAD}: dirty, $n path(s)"
-                fi
-            fi
-            path=""; branch=""
-            ;;
-        esac
-    done < <(g "$repo" worktree list --porcelain 2>/dev/null; printf '\n')
-}
-
-# A LEG is read against its PIN, not against its branch's tip: the root's
-# HEAD records a gitlink for it, `make bootstrap` places it there, and
-# `scripts/bump-leg.py` is the one way the pin moves. So: a checkout that is
-# not the gitlink has moved without being pinned; a gitlink with commits on
-# `origin/<branch>` after it is a pin that has fallen behind; and a gitlink
-# that `origin/<branch>` does not contain is a pin on work the leg never
-# pushed. A leg detached AT its pin is the normal state of a submodule and
-# is not a finding. The counts are read in the LEG's repository, where the
-# commits live; if the leg has never fetched, the answer is "unknown" rather
-# than "fine", and says so.
-read_leg() {
-    local root="$1" rel="$2" branch="$3" leg gitlink head n kind ref
-    leg="$root/$rel"
-    gitlink="$(g "$root" rev-parse -q --verify "HEAD:$rel" 2>/dev/null || true)"
-    head="$(g "$leg" rev-parse -q --verify HEAD 2>/dev/null || true)"
-    # A LEG ON A FEATURE BRANCH is the state `resume` refuses a whole root
-    # for — that root's own `make bootstrap` would walk the leg back onto
-    # its branch — and the superproject looks clean in it, which is why the
-    # leg's own row has to say so, pin or no pin. A leg DETACHED at its pin
-    # is a submodule's normal state and is not a finding; one on its branch
-    # is where `make bootstrap` leaves it. THAT BRANCH IS THE LEG'S: the
-    # caller passes the `branch:` the leg's own row declares, else the root's
-    # `tracking_branch` (#235), and a leg that declares one is named so,
-    # because "not main" would be the wrong branch to send a person back to.
-    IFS=$'\t' read -r kind ref < <(head_of "$leg")
-    if [ "$kind" = "branch" ] && [ "$ref" != "$branch" ]; then
-        if [ -n "$(leg_branch_of "$root" "$rel")" ]; then
-            finding "on branch $ref, not $branch, the \`branch:\` this leg's own row declares in project.yaml (\`resume\` refuses a root whose leg sits on any other branch, because \`make bootstrap\` would move it)"
-        else
-            finding "on branch $ref, not $branch (\`resume\` refuses a root whose leg sits on a feature branch)"
-        fi
-    fi
-    if [ -z "$gitlink" ]; then
-        finding "not pinned: the root's HEAD records no gitlink at $rel"
-    elif [ -n "$head" ] && [ "$gitlink" != "$head" ]; then
-        finding "checked out at $(short "$head"), pinned at $(short "$gitlink"): moved but not pinned (scripts/bump-leg.py)"
-    fi
-    if [ -n "$gitlink" ]; then
-        if has_ref "$leg" "refs/remotes/origin/$branch"; then
-            n="$(g "$leg" rev-list --count "$gitlink..origin/$branch" 2>/dev/null || true)"
-            if [ -z "$n" ]; then
-                finding "pin $(short "$gitlink") is not in this leg's history: never fetched?"
-            else
-                [ "$n" = 0 ] ||
-                    finding "pin $(short "$gitlink") is $n commit(s) behind origin/$branch, as of the last fetch"
-                n="$(g "$leg" rev-list --count "origin/$branch..$gitlink" 2>/dev/null || printf 0)"
-                [ "$n" = 0 ] ||
-                    finding "pin $(short "$gitlink") is not on origin/$branch: $n commit(s) unpushed in the leg"
-            fi
-        else
-            no_origin_branch_finding "$branch"
-        fi
-    fi
-    read_worktree_state "$leg"
-    read_branches "$leg" "$branch"
-}
-
-# --- `--fetch`: ask origin first ---------------------------------------------
-#
-# THE ONE WRITE THIS COMMAND MAKES, and only when asked: `git fetch --prune
-# origin` in the repository about to be read. A fetch moves remote-tracking
-# refs (`refs/remotes/origin/*`) and writes objects; it touches no branch, no
-# HEAD, no index and no working tree, which is why it is the one write a
-# read-only report can make and still be one. `--prune` is part of it because
-# a remote branch deleted under a feature is exactly the `[gone]` this report
-# looks for, and a fetch without prune would keep the stale ref that hides
-# it. `--recurse-submodules=no`, because the legs are rows of their own and
-# are fetched as such; git's on-demand default would fetch them again from
-# the root. `GIT_TERMINAL_PROMPT=0` so a fetch that wants an https password
-# FAILS and is reported, rather than stopping the whole report at a prompt
-# nobody is watching; an ssh host-key or passphrase prompt is ssh's own and
-# is NOT stopped by it — that blocks exactly as `git fetch` would. The
-# outcome is one line under the repository's row — not a finding when it
-# worked, a finding when it did not, in which case what follows is as of the
-# last fetch that did work. `FETCHED_OK` tells the reads below whether a
-# missing `origin/<branch>` means "never fetched" or "origin has no such
-# branch".
-#
-# THE REFSPEC IS PINNED ON THE COMMAND LINE, and that is what bounds the
-# write. `--prune` deletes whatever the refspec's destination side no longer
-# has a source for — and a repository whose `remote.origin.fetch` was
-# hand-edited, or made with `--mirror`, maps heads onto LOCAL branches, so a
-# configured refspec plus `--prune` would delete a local branch and this
-# report would then call the repository clean; `fetch.pruneTags` set
-# globally would prune local tags the same way. Naming
-# `+refs/heads/*:refs/remotes/origin/*` here means the only refs that can
-# move or go are under `refs/remotes/origin/`, whatever the config says (the
-# review of this layer deleted a local branch through the configured form to
-# prove it). AND `--refmap`, WITH THE SAME REFSPEC: a refspec on the command
-# line bounds what is fetched and pruned, but git still maps every ref it
-# fetched through the CONFIGURED refspecs as well — "opportunistic
-# remote-tracking updates" — so under a mirror-style config the pinned fetch
-# alone would still move `refs/heads/main` in a detached leg, and refuse
-# outright in a checked-out root. `--refmap` (git 2.1) replaces the
-# configured mapping for this one fetch, so nothing outside
-# `refs/remotes/<remote>/` is written by either route.
-# ONE FUNCTION FOR BOTH REMOTES: `origin` always, `upstream` when a fork has
-# one (the third layer, below). The remote's name is in every line it prints,
-# and in the refspec, so `--prune` on the upstream fetch can only touch
-# `refs/remotes/upstream/*`.
-FETCHED_OK=0
-UPSTREAM_FETCHED_OK=0
-#: WHAT THIS RUN'S `origin` FETCH IN THIS REPOSITORY DID, in one word, because
-#: `FETCHED_OK=0` IS FOUR STATES AND ONE OF THEM IS NOT A FETCH AT ALL
-#: (Copilot's second round on #23). Two of the three returns above the fetch
-#: are reached without running one — a repository git cannot read, and one
-#: with no `origin` remote — and both are STORED by the pre-pass like any
-#: other, so "did the pre-pass enter this repository" answered yes for a
-#: repository nothing was fetched in and the record layer's caveat said "the
-#: fetch this run made there failed" two lines under a row that said "no
-#: remote named origin, so nothing could be fetched". `ok`, `failed`,
-#: `no-remote`, `unreadable` — and `none` for a repository no fetch reached,
-#: which is what the store's absence means and what a run without `--fetch`
-#: is. The word is the ORIGIN remote's alone: `upstream` has its own flag and
-#: its own line, and no reading branches on why its fetch did not happen.
-FETCH_ORIGIN_STATE=none
-fetch_remote() {
-    local repo="$1" branch="$2" remote="$3" before after err what="fetch"
-    [ "$remote" = origin ] || what="fetch $remote"
-    if [ "$remote" = origin ]; then FETCHED_OK=0; else UPSTREAM_FETCHED_OK=0; fi
-    if ! g "$repo" rev-parse --git-dir >/dev/null 2>&1; then
-        [ "$remote" != origin ] || FETCH_ORIGIN_STATE=unreadable
-        finding "fetch: not a readable git repository (a gitfile whose gitdir is gone?), so nothing could be fetched"
-        return 0
-    fi
-    if ! g "$repo" remote get-url "$remote" >/dev/null 2>&1; then
-        [ "$remote" != origin ] || FETCH_ORIGIN_STATE=no-remote
-        finding "fetch: no remote named $remote, so nothing could be fetched"
-        return 0
-    fi
-    before="$(g "$repo" rev-parse -q --verify "refs/remotes/$remote/$branch" 2>/dev/null || true)"
-    if err="$(GIT_TERMINAL_PROMPT=0 git --no-optional-locks -C "$repo" fetch --quiet \
-            --prune --recurse-submodules=no \
-            --refmap="+refs/heads/*:refs/remotes/$remote/*" "$remote" \
-            "+refs/heads/*:refs/remotes/$remote/*" 2>&1)"; then
-        if [ "$remote" = origin ]; then FETCHED_OK=1; FETCH_ORIGIN_STATE=ok; else UPSTREAM_FETCHED_OK=1; fi
-        after="$(g "$repo" rev-parse -q --verify "refs/remotes/$remote/$branch" 2>/dev/null || true)"
-        if [ -n "$before" ] && [ -z "$after" ]; then
-            fetch_say "    fetched $remote: $remote/$branch is GONE (was $(short "$before")): deleted or renamed on $remote"
-        elif [ -n "$after" ] && [ "$before" != "$after" ]; then
-            if [ -n "$before" ]; then
-                fetch_say "    fetched $remote: $remote/$branch moved $(short "$before") -> $(short "$after")"
-            else
-                fetch_say "    fetched $remote: $remote/$branch is here now, at $(short "$after")"
-            fi
-        elif [ -z "$after" ]; then
-            fetch_say "    fetched $remote: there is no $remote/$branch"
-        else
-            fetch_say "    fetched $remote: nothing new on $remote/$branch"
-        fi
-    else
-        [ "$remote" != origin ] || FETCH_ORIGIN_STATE=failed
-        err="${err%%$'\n'*}"
-        finding "$what failed: ${err:-git said nothing}; what follows is as of the last fetch that worked"
-    fi
-}
-
-#: WHAT THE PRE-PASS BELOW STORES, one entry per REPOSITORY of the estate in
-#: row order: the path it is keyed by, the lines its fetch printed, the
-#: findings its fetch made, the two flags the reads branch on, and WHAT THE
-#: ORIGIN FETCH DID in `fetch_remote`'s one word. Parallel arrays and a linear
-#: scan, because bash 3.2 has no associative array and an estate holds a
-#: handful of repositories. `FETCH_SAY` is where `fetch_remote` puts a line
-#: instead of printing it.
-FETCH_KEYS=()
-FETCH_SAID=()
-FETCH_FOUND=()
-FETCH_OK_AT=()
-FETCH_UP_OK_AT=()
-FETCH_STATE_AT=()
-FETCH_SAY=""
-fetch_say() { FETCH_SAY="$FETCH_SAY$1"$'\n'; }
-
-# THE KEY IS THE PHYSICAL PATH, the idiom `locate_record` uses on the
-# workspace checkouts and for the same reason: ONE DIRECTORY HAS MORE THAN ONE
-# SPELLING. The rows come from `estate_repos`, which builds a leg's path out
-# of `.gitmodules`; the record layer asks about the path `project.yaml` gives
-# that role — `./spec` against `spec` is the same leg and two strings — and a
-# symlinked projects directory, or a Mac's `/tmp` beside `/private/tmp`, does
-# the same to a root. A key that is a spelling would have said "never fetched"
-# about a repository fetched two rows below.
-physical_path() {
-    local resolved
-    resolved="$(cd "$1" 2>/dev/null && pwd -P)" || resolved="$1"
-    printf '%s\n' "$resolved"
-}
-
-# WHETHER A DESTINATION EXISTS AS FAR AS `git worktree add` IS CONCERNED,
-# which is NOT `[ -e ]` (Copilot's fourth round on #27, verbatim: "`[ -e
-# "$want" ]` follows symlinks, so a dangling symlink at the computed
-# destination is treated as absent. `git worktree add` still rejects that
-# existing path"). RUN on 2026-09-13: with a dangling symlink at the path,
-# `[ -e ]` is false, `[ -L ]` is true, and `git worktree add` answers "fatal:
-# '…' already exists". So every test that asks "is this path free for the add"
-# asks BOTH — and `path_in_the_way`'s RR3 test does not, because RR3 IS
-# `[ -e "$tree" ]` at the other end and a reading harder than the other end's
-# would invent a refusal `resume` does not make. A dangling link is the ADD's
-# refusal, and it is said in the add's words, with the arms that share them.
-dest_exists() {
-    [ -e "$1" ] || [ -L "$1" ]
-}
-
-# WHETHER ANY COMPONENT OF A PATH IS A SYMLINK, asked lexically because
-# `physical_path` cannot answer it for a link whose target is not there yet
-# (Copilot's fourth round on #27, verbatim: "This symlink guard misses a valid
-# configuration where `worktree_root` is a symlink whose target directory has
-# not been created yet: `physical_path` falls back to the lexical path when
-# `cd` fails, so this condition treats the root as non-symlinked and advertises
-# a move to the lexical destination"). RUN the same day: `cd` into such a link
-# fails, so the fallback returns the lexical path and the two compare equal —
-# and `mkdir -p` through it answers "cannot create directory '…': File exists",
-# so the exit dies on its first operand as well. `[ -L ]` on each prefix is the
-# question that has an answer whether or not the target is there.
-# `SYMLINK_COMPONENT` IS THE FIRST PREFIX THAT IS ONE, because the line has to
-# name the path the person must respell and the root is not always it (Copilot's
-# eighth round on #27, verbatim: "`has_symlink_component` examines every parent
-# of the computed destination, but this message says only that the worktree root
-# is symlinked and tells the user to rewrite `worktree_root`. For a symlink at
-# `$WORKTREE_ROOT/$branch` or a declared mount parent, the root is not the
-# offending component, so the diagnostic points at the wrong setting"). Right,
-# and it is drift the round before it made: widening the QUESTION to every
-# parent left the ANSWER naming the root it no longer means.
-SYMLINK_COMPONENT=""
-has_symlink_component() {
-    local rest="${1#/}" walk="" part
-    SYMLINK_COMPONENT=""
-    while [ -n "$rest" ]; do
-        part="${rest%%/*}"
-        if [ "$part" = "$rest" ]; then rest=""; else rest="${rest#*/}"; fi
-        [ -n "$part" ] || continue
-        walk="$walk/$part"
-        if [ -L "$walk" ]; then
-            SYMLINK_COMPONENT="$walk"
-            return 0
-        fi
-    done
-    return 1
-}
-
-# WHAT TO DO ABOUT A SYMLINKED COMPONENT, worded once because three arms name
-# it: the component itself, what git will spell instead, and the setting that
-# carries it where the component IS the worktree root. Every path this layer
-# computes is built on `$RECORD_WORKTREE_ROOT`, so a link at or above it is a
-# `worktree_root` to respell and a link BELOW it — the feature directory, a
-# mount's parent — is a directory to replace with a real one.
-symlink_exit() {
-    local where="$1" resolved
-    resolved="$(physical_path "$where")"
-    if [ "${RECORD_WORKTREE_ROOT#"$where"}" != "$RECORD_WORKTREE_ROOT" ] ||
-        [ "$where" = "$RECORD_WORKTREE_ROOT" ]; then
-        printf '%s\n' "$where is a symlink, and it is the worktree root this checkout computes (or a directory above it) — spell \`worktree_root\` (or \`\$SPECKIT_GIT_WORKTREE_ROOT\`) as the directory git spells${resolved:+, which is $resolved}"
-    else
-        printf '%s\n' "$where is a symlink under the worktree root — git registers a worktree made there at the path it resolves to${resolved:+, $resolved}, which is not the string either verb compares, so that component has to BE the directory rather than point at one"
-    fi
-}
-
-# THE ONE COMPUTED PATH NO COMMAND CAN TAKE AS AN OPERAND: the mount
-# `collect_legs` spells for a leg the manifest declares `path: "."`, which is
-# `<worktree_root>/<branch>/.`. The tip of this branch recorded why and did not
-# act on it; Copilot's second round on #27 asks for the half that is this
-# file's to give, verbatim: "For a declared `path: "."`, `want` ends in
-# `/<branch>/.` here. This remediation emits `git worktree move <source>
-# <want>`; after `mkdir -p` creates the branch directory, Git treats that `/.`
-# destination as the existing directory and nests the worktree instead of
-# putting it where `resume` can register it. The next `status` run reports the
-# result as an obstruction, so this new remediation is not runnable/idempotent;
-# handle this mount spelling or avoid advertising a move until `collect_legs`
-# is fixed." BOTH HALVES OF THAT WERE RUN on 2026-09-12 and recorded at the tip
-# of this branch: `mv '<…>/001-a-thing/.' <dest>` is refused by coreutils
-# outright ("Device or resource busy", GNU coreutils 9.4) and `mkdir -p
-# <…>/001-a-thing && git worktree move <tree> '<…>/001-a-thing/.'` exits 0 and
-# leaves the worktree at `<…>/001-a-thing/001-a-thing`. SO THE MOVE IS NOT
-# ADVERTISED: the rule at the top of `check_parked_leg` is that an arm may not
-# name an exit that does not run, and this is the one path for which none does
-# — the cure is a `collect_legs` that computes `$WORKTREE_ROOT/$branch` for
-# such a leg, which is workBenches'.
-dot_mount() {
-    local path="$1"
-    # AND EVERY SPELLING OF IT, not the bare `/.` alone (Copilot's sixth round
-    # on #27, verbatim: "`dot_mount` only recognizes a destination whose raw
-    # string ends in `/.`. The manifest parser preserves other non-empty root
-    # spellings such as `path: \"./\"`, so `collect_legs` can produce
-    # `<worktree_root>/<branch>/./`; this helper misses it"). Right:
-    # `_shape_record_leg` keeps any non-empty `path:` verbatim, so `./`, `.//`
-    # and `/.` all reach `collect_legs` and all name the feature directory
-    # itself. Trailing slashes come off, then the `.` is what is left.
-    while [ "$path" != "${path%/}" ] && [ "$path" != "/" ]; do
-        path="${path%/}"
-    done
-    case "$path" in
-    */.) return 0 ;;
-    esac
-    return 1
-}
-
-# THE DIRECTORY A PATH SITS IN, AND NEVER THE EMPTY STRING (Copilot's second
-# round on #27, verbatim: "When the configured worktree root is `/`, `want` can
-# be `/branch`, so `${want%/*}` expands to the empty string. The generated
-# recovery command becomes `mkdir -p '' && git worktree move ...`, which fails
-# before the move even though `resume` only needs the already-existing `/`
-# parent"). It is right and it was run: `mkdir -p ''` answers "cannot create
-# directory ''", so the exit dies on its first operand. `${p%/*}` is the empty
-# string for exactly one shape of path — one whose only slash is the leading
-# one — and the directory it means is `/`.
-parent_dir() {
-    local cut="${1%/*}"
-    case "$1" in
-    */*) printf '%s\n' "${cut:-/}" ;;
-    *) printf '.\n' ;;
-    esac
-}
-
-# A PATH AS A SHELL OPERAND, QUOTED ONLY WHERE A SHELL WOULD NEED IT (Copilot's
-# first round on #27, verbatim: "The remediation command here interpolates
-# `$repo` and `$want` directly into a shell snippet. Valid paths containing
-# spaces split the command, and shell metacharacters make the copy-pasted `git
-# worktree move` unsafe, so the prescribed cleanup is not reliably runnable.
-# Please emit shell-quoted operands through a shared formatter"). Every command
-# this file prints is one a PERSON is told to run — "which is yours to run" —
-# and the rule at the top of `check_parked_leg` is that an exit which does not
-# run is worse than no exit at all, so a projects directory called `~/My
-# Projects` must not turn `git -C <root> worktree move <a> <b>` into four
-# operands. Single quotes, with the one escape that ends and reopens them for a
-# literal `'`, are what a POSIX shell takes verbatim.
-#
-# AND UNQUOTED WHERE NOTHING NEEDS IT, which is why the byte-for-byte pins in
-# the suite do not move: a path of letters, digits and `/._@%+:,=-` is its own
-# operand in every shell, and quoting it would add noise to every line this
-# command prints on an ordinary estate. The set is deliberately narrow — `~`
-# and `$` and `*` are not in it, because a shell would expand them.
-sh_operand() {
-    case "${1-}" in
-    '') printf "''\n" ;;
-    *[!A-Za-z0-9/._@%+:,=-]*)
-        printf "'%s'\n" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
-        ;;
-    *) printf '%s\n' "$1" ;;
-    esac
-}
-
-# EVERY REPOSITORY IS FETCHED BEFORE ANY ROW IS READ, which is what `--fetch`
-# has said since it landed — "in every repository first, so the answers are
-# current" — and what it did not quite do: the fetches ran row by row, and THE
-# RECORD LAYER IS READ ON THE ROOT'S ROW, before the legs, whose own origins
-# hold the commits it compares the record against. A feature parked from
-# another workstation into a LEG's origin was therefore reported as a parked
-# commit that "is not here" by the very run that fetched it a moment later,
-# and the finding vanished on the second run (the review of #18). Nothing
-# else moves: each row still prints its own fetch's lines, carries its own
-# fetch's findings and reads its own fetch's flags — `replay_fetch` puts them
-# back where the row-by-row version printed and counted them — so the report
-# reads exactly as it did.
-fetch_estate_first() {
-    local label branch path key seen
-    FETCH_KEYS=()
-    FETCH_SAID=()
-    FETCH_FOUND=()
-    FETCH_OK_AT=()
-    FETCH_UP_OK_AT=()
-    FETCH_STATE_AT=()
-    while IFS=$'\t' read -r label branch path; do
-        [ -n "${path:-}" ] || continue
-        case "$label" in
-        holder | root | mounted) ;;
-        *) continue ;;
-        esac
-        key="$(physical_path "$path")"
-        # ONE FETCH PER REPOSITORY, not per row. `family.yaml` is a file
-        # people edit, and a member listed twice is one repository: fetching
-        # it twice would make the second fetch report "nothing new" about
-        # what the first had just moved, and the row that replays the one
-        # entry says what was really done.
-        for seen in ${FETCH_KEYS[@]+"${FETCH_KEYS[@]}"}; do
-            [ "$seen" != "$key" ] || continue 2
-        done
-        FETCH_SAY=""
-        FINDINGS=()
-        FETCH_ORIGIN_STATE=none
-        fetch_remote "$path" "$branch" origin
-        if has_upstream "$path"; then
-            fetch_remote "$path" "$branch" upstream
-        fi
-        FETCH_KEYS+=("$key")
-        FETCH_SAID+=("$FETCH_SAY")
-        FETCH_FOUND+=("$(printf '%s\n' ${FINDINGS[@]+"${FINDINGS[@]}"})")
-        FETCH_OK_AT+=("$FETCHED_OK")
-        FETCH_UP_OK_AT+=("$UPSTREAM_FETCHED_OK")
-        FETCH_STATE_AT+=("$FETCH_ORIGIN_STATE")
-    done <<<"$1"
-    FINDINGS=()
-}
-
-# One row's stored fetch, put back: its lines where they were printed before,
-# its findings in this row's list, its flags in the two the reads branch on.
-# A row the pre-pass skipped — an unmounted leg, a member with no clone — and
-# every row of a run without `--fetch` leaves the flags at 0, which is what
-# "as of the last fetch" means there.
-replay_fetch() {
-    local path i=0 line
-    path="$(physical_path "$1")"
-    FETCHED_OK=0
-    UPSTREAM_FETCHED_OK=0
-    while [ "$i" -lt "${#FETCH_KEYS[@]}" ]; do
-        if [ "${FETCH_KEYS[$i]}" = "$path" ]; then
-            [ -z "${FETCH_SAID[$i]}" ] || printf '%s' "${FETCH_SAID[$i]}"
-            if [ -n "${FETCH_FOUND[$i]}" ]; then
-                while IFS= read -r line; do
-                    [ -z "$line" ] || finding "$line"
-                done <<<"${FETCH_FOUND[$i]}"
-            fi
-            FETCHED_OK="${FETCH_OK_AT[$i]}"
-            UPSTREAM_FETCHED_OK="${FETCH_UP_OK_AT[$i]}"
-            return 0
-        fi
-        i=$((i + 1))
-    done
-    return 0
-}
-
-# Whether the fetch THIS RUN made in `<repo>` worked — the store's answer for
-# any repository of the estate, not only the row being read, which is what
-# lets the record layer tell "never fetched here" from "origin has not got
-# it" for a leg it reads from the root's row. False without `--fetch`, and
-# false for a repository the pre-pass never saw.
-fetched_ok_at() {
-    local path i=0
-    [ "$FETCH" -eq 1 ] || return 1
-    path="$(physical_path "$1")"
-    while [ "$i" -lt "${#FETCH_KEYS[@]}" ]; do
-        if [ "${FETCH_KEYS[$i]}" = "$path" ]; then
-            [ "${FETCH_OK_AT[$i]}" = 1 ] || return 1
-            return 0
-        fi
-        i=$((i + 1))
-    done
-    return 1
-}
-
-# WHAT THIS RUN'S `origin` FETCH IN `<repo>` DID, in `fetch_remote`'s one
-# word, for the same reason `fetched_ok_at` exists: the store holds one entry
-# per repository of the estate as `estate_repos` lists them, and the record
-# layer asks about the path `project.yaml` gives a role, which is usually one
-# of them and need not be. So a caller that only wants "did a fetch happen
-# here" tests for `ok` or `failed`.
-#
-# AND THE STORE HAS TWO WAYS OF HOLDING NOTHING, which is Copilot's third
-# round on #23 (2026-09-12), verbatim: "when `--fetch` is active,
-# `fetch_state_at` can still be `none` for a mapped role path that
-# `project.yaml` names but `estate_repos` did not enumerate (the code
-# explicitly allows that path not to be one of the fetch-store entries). This
-# fallback then tells the user to run `status --fetch`, even though that flag
-# has already run and repeated runs will not fetch a path absent from
-# `.gitmodules`". IT IS REAL AND IT IS THE SAME FAULT THE ROUND BEFORE FIXED
-# from its other side: a run that HAS fetched being told to fetch. `none` is
-# the answer for a run made WITHOUT the flag — the one `status --fetch`
-# settles — and `unlisted` for a run made WITH it that never reached this
-# repository, which no rerun of the flag changes: the pre-pass fetches the
-# repositories `estate_repos` lists, the root and the legs `.gitmodules`
-# declares, and a `spec` or `code` leg `project.yaml` mounts somewhere else is
-# not among them. THE FLAG'S SCOPE IS NOT WIDENED TO CLOSE IT: `status
-# --fetch`'s one write is bounded to the repositories the estate declares,
-# which is the rule, so the reading says what this run did instead.
-#
-# IT REPLACED A `fetch_tried_at` THAT ANSWERED THE PRESENCE OF THE ENTRY
-# (Copilot's second round on #23), verbatim: "`fetch_tried_at` is true for
-# every repository entered by the pre-pass, including a readable repository
-# where `fetch_remote` returned early because no `origin` remote exists. In
-# that case this message says "the fetch this run made there failed" even
-# though no fetch was attempted, which makes the new diagnostic inaccurate".
-# Run against e18ec53 on 2026-09-12, with `--fetch` and a `pushed: true`
-# record whose branch has no `origin/<branch>` here: a root with its `origin`
-# removed, a `spec` leg with its `origin` removed in the three-leg fixture,
-# and a leg whose gitdir was deleted all drew "the fetch this run made there
-# failed, so nothing has settled it" — in the last two, on the same report as
-# "fetch: no remote named origin, so nothing could be fetched" and "fetch: not
-# a readable git repository …, so nothing could be fetched". A line that says
-# a fetch failed where none was MADE is as wrong as the one S1 fixed, which
-# said a fetch was still to be made where one had just failed.
-fetch_state_at() {
-    local path i=0
-    if [ "$FETCH" -ne 1 ]; then printf 'none\n'; return 0; fi
-    path="$(physical_path "$1")"
-    while [ "$i" -lt "${#FETCH_KEYS[@]}" ]; do
-        if [ "${FETCH_KEYS[$i]}" = "$path" ]; then
-            printf '%s\n' "${FETCH_STATE_AT[$i]}"
-            return 0
-        fi
-        i=$((i + 1))
-    done
-    printf 'unlisted\n'
-    return 0
-}
-
-# --- the fork against its upstream --------------------------------------------
-#
-# THE THIRD LAYER, under Brett Heap's RULING of 2026-09-11, verbatim: "next
-# layer: fork against upstream". When origin is a FORK, the one question a
-# clone cannot answer about itself is whether the fork has kept up with what
-# it was forked from: a fork's `main` falls behind quietly, and a feature cut
-# from it is a feature cut from stale ground. Two ways to know, in order:
-#
-# 1. A REMOTE NAMED `upstream` — the convention every fork guide teaches — is
-#    read from LOCAL refs: `origin/<branch>` against `upstream/<branch>`, as
-#    of the last fetch. With `--fetch` the upstream remote is fetched too,
-#    under the pinned refspec, so the write stays under `refs/remotes/`.
-# 2. WITH NO SUCH REMOTE, and only under `--fetch` — the one flag that
-#    reaches the network — an origin on github.com is asked about with
-#    `gh api repos/<owner>/<name>`. If GitHub says it is a fork, that is a
-#    finding naming the parent and the `git remote add upstream …` that makes
-#    the drift readable locally from then on, and GitHub's compare endpoint
-#    gives the counts once. `gh` is READ ONLY here, and every call goes
-#    through `gh_api_line`, which pins the host, clears `GH_DEBUG`, and
-#    decides whether the run keeps asking: not on PATH, or not logged in
-#    (gh exit 4), is true of every repository and is said once; a failure on
-#    one repository — a 404 the token cannot see past — is said on its row
-#    and the others are still asked, three in a row settling the run so an
-#    offline machine does not pay a timeout per row. Without `--fetch`
-#    nothing is asked, and a fork with no upstream remote reads exactly as it
-#    did before this layer.
-#
-# An origin that is NOT a fork says nothing here: most estates are the
-# organisation's own repositories, and "not a fork" is not a finding. The
-# origin URL is read from config, not `remote get-url`, because a
-# `url.<base>.insteadOf` rewrite must not hide whose repository it is.
-GH_STATE=""
-GH_FAILS=0
-GH_LINE=""
-
-# Is `gh` there to ask? Settled ONCE per run and shared by every question this
-# command puts to GitHub (the fork check, the shape pin): absent is said once,
-# under the first row that wanted it; `failed` is set by `gh_api_line` when a
-# failure was true of every repository, after which nobody asks again.
-gh_ready() {
-    local what="$1"
-    if [ -z "$GH_STATE" ]; then
-        if command -v gh >/dev/null 2>&1; then
-            GH_STATE=ok
-        else
-            GH_STATE=none
-            say "    $what: no \`gh\` on PATH, so GitHub was not asked (said once per run)"
-        fi
-    fi
-    [ "$GH_STATE" = ok ]
-}
-
-# THE ONE PLACE `gh` IS RUN: `gh api <endpoint> --jq <filter>`, a GET, and the
-# LAST line of its output lands in `GH_LINE` (the jq payload is always last;
-# a `GH_DEBUG` trace would come first, and is cleared anyway, because a stray
-# stderr line read as the payload turns a fork into "clean"). `--hostname
-# github.com`, because that is the host `is_github_origin` admitted and a
-# `GH_HOST` in somebody's environment must not send the question elsewhere.
-# ON FAILURE the run's state is decided here, and said on the row: gh exit 4
-# is "not logged in", true of every repository, so it settles the run; a 404
-# on one repository is true of that one only, so the others are still asked
-# — three failures in a row settle it too, so a machine with no network does
-# not pay a timeout per row. Returns 1 on any failure (the caller says what
-# it could not read), 0 with `GH_LINE` set on success.
-gh_api_line() {
-    local what="$1" endpoint="$2" filter="$3" out rc=0
-    GH_LINE=""
-    gh_ready "$what" || return 1
-    out="$(GH_PROMPT_DISABLED=1 GH_NO_UPDATE_NOTIFIER=1 GH_DEBUG='' gh api "$endpoint" \
-        --hostname github.com --jq "$filter" 2>&1)" || rc=$?
-    if [ "$rc" -ne 0 ]; then
-        out="${out%%$'\n'*}"
-        GH_FAILS=$((GH_FAILS + 1))
-        if [ "$rc" -eq 4 ] || [ "$GH_FAILS" -ge 3 ]; then
-            GH_STATE=failed
-            say "    $what: \`gh api ${endpoint%%\?*}\` failed (${out:-no message}); not asked again this run"
-        else
-            say "    $what: \`gh api ${endpoint%%\?*}\` failed (${out:-no message}); the other repositories are still asked"
-        fi
-        return 1
-    fi
-    GH_FAILS=0
-    GH_LINE="${out##*$'\n'}"
-}
-
-# `github.com` THE HOST, not a substring: `github.company.com` is somebody's
-# GitHub Enterprise and `notgithub.com` is somebody else's server, and the
-# question goes to github.com whatever the origin says — so a match on the
-# substring would ask the wrong server about a repository that is not there,
-# with the person's token. Every spelling git accepts: `https://host/…`,
-# `ssh://user@host:port/…`, `user@host:owner/name`.
-is_github_origin() {
-    local url="$1" host
-    case "$url" in
-    *://*) host="${url#*://}"; host="${host%%/*}" ;;
-    *:*) host="${url%%:*}" ;;
-    *) return 1 ;;
-    esac
-    host="${host##*@}"
-    host="${host%%:*}"
-    [ "$(lower "$host")" = "github.com" ]
-}
-
-# A count from GitHub is digits or it is not read: `tostring` on a field the
-# answer lacks is the word `null`, and "null commit(s) behind" is a lie.
-is_count() {
-    case "$1" in
-    '' | *[!0-9]*) return 1 ;;
-    esac
-    return 0
-}
-
-has_upstream() { g "$1" config --get remote.upstream.url >/dev/null 2>&1; }
-
-read_fork() {
-    local repo="$1" branch="$2" counts behind ahead
-    if ! has_upstream "$repo"; then
-        [ "$FETCH" -eq 0 ] || ask_github_fork "$repo" "$branch"
-        return 0
-    fi
-    if ! has_ref "$repo" "refs/remotes/upstream/$branch"; then
-        if [ "$UPSTREAM_FETCHED_OK" -eq 1 ]; then
-            finding "fork: no upstream/$branch after the fetch: upstream has no branch $branch"
-        elif [ "$FETCH" -eq 1 ]; then
-            finding "fork: no upstream/$branch here, and the fetch of upstream above did not bring one"
-        else
-            finding "fork: no upstream/$branch here: the upstream remote was never fetched (\`--fetch\` asks it)"
-        fi
-        return 0
-    fi
-    # No `origin/<branch>` is already a finding above; nothing to compare.
-    has_ref "$repo" "refs/remotes/origin/$branch" || return 0
-    counts="$(g "$repo" rev-list --left-right --count \
-        "upstream/$branch...origin/$branch" 2>/dev/null || true)"
-    [ -n "$counts" ] || return 0
-    behind="${counts%%[[:space:]]*}"
-    ahead="${counts##*[[:space:]]}"
-    [ "$behind" = 0 ] ||
-        finding "fork: origin/$branch is $behind commit(s) behind upstream/$branch, as of the last fetch"
-    [ "$ahead" = 0 ] ||
-        finding "fork: origin/$branch has $ahead commit(s) upstream/$branch does not"
-}
-
-# `gh api`, read-only, twice at most per repository: is origin a fork, and
-# if so how far is its <branch> from the parent's default branch. The fields
-# come back joined by 0x1F for the reason `read_branches` gives: an empty
-# middle field must stay where it was printed.
-ask_github_fork() {
-    local repo="$1" branch="$2" url slug owner is_fork parent parent_default behind ahead
-    url="$(g "$repo" config --get remote.origin.url 2>/dev/null || true)"
-    is_github_origin "$url" || return 0
-    slug="$(repo_slug_of "$url" || true)"
-    [ -n "$slug" ] || return 0
-    owner="${slug%%/*}"
-    gh_api_line "fork check" "repos/$slug" \
-        '[(.fork|tostring), (.parent.full_name // ""), (.parent.default_branch // "")] | join("\u001f")' ||
-        return 0
-    IFS=$'\037' read -r is_fork parent parent_default <<<"$GH_LINE"
-    [ "$is_fork" = true ] || return 0
-    if [ -z "$parent" ]; then
-        finding "fork of a repository GitHub does not show (deleted, or private to you?), and no remote named upstream here"
-        return 0
-    fi
-    finding "fork of $parent (per GitHub), and no remote named upstream here: \`git remote add upstream https://github.com/$parent.git\` reads the drift locally"
-    if gh_api_line "fork check" \
-            "repos/$parent/compare/$parent_default...$owner:$branch?per_page=1" \
-            '[(.behind_by|tostring), (.ahead_by|tostring)] | join("\u001f")'; then
-        IFS=$'\037' read -r behind ahead <<<"$GH_LINE"
-        if ! is_count "$behind" || ! is_count "$ahead"; then
-            finding "fork: GitHub's compare of origin/$branch with $parent's $parent_default was not two counts; not read"
-            return 0
-        fi
-        [ "$behind" = 0 ] ||
-            finding "fork: origin/$branch is $behind commit(s) behind $parent's $parent_default (per GitHub)"
-        [ "$ahead" = 0 ] ||
-            finding "fork: origin/$branch has $ahead commit(s) $parent's $parent_default does not (per GitHub)"
-    else
-        finding "fork: could not compare origin/$branch with $parent's $parent_default (the fork check line above says why)"
-    fi
-}
-
-# --- the shape pin ------------------------------------------------------------
-#
-# THE FOURTH LAYER, under Brett Heap's RULING of 2026-09-11, verbatim: "next
-# layer: shape-pin drift". An assembly root and a family holder each carry
-# `contracts/shape-pin.yaml` — A COPY PIN, in the standard's own words: the
-# scaffold COPIED a small set of files out of openRepoShape (the Makefile, the
-# validators, the bootstrap, the workflow) so a project runs its own gate with
-# no upstream mounted, and the pin records the commit they came from plus a
-# sha256 per copy. Three things can be out of sync with it, and each is read:
-#
-# 1. A COPY EDITED IN PLACE. Every `files:` row is re-hashed with whatever
-#    sha256 this machine has (GNU `sha256sum`, the `shasum` a Mac ships, or
-#    `openssl`); a digest that differs is DRIFT, and the standard's exit is
-#    named with it — carry the change upstream, never re-digest. The same
-#    check the root's own `scripts/validate-pins.py` (or the holder's
-#    `validate-family.py`) makes on every pull request, read here across the
-#    estate without running the validator, which also asks lockstep questions
-#    a report about the shape does not. A row whose file is missing is named.
-# 2. THE MIRROR. `project.yaml` (or `family.yaml`) carries a `shape:` block
-#    that mirrors the pin's commit; `update-shape.py` moves both together, so
-#    two different commits there is a half-done update.
-# 3. THE PIN AGAINST THE SOURCE'S DEFAULT BRANCH. From a clone of the source
-#    under the projects directory when there is one — found by its origin's
-#    slug, the way `--repo` finds an estate, never by folder name — read from
-#    local refs, as of that clone's last fetch; else, under `--fetch`, from
-#    GitHub's compare endpoint, once per pin per run. Behind is a finding
-#    whose exit is `update-shape.py check --root <root>`; a pin the branch
-#    does not contain is a finding too, because the standard squash-merges
-#    and a branch commit is orphaned the moment its pull request lands. When
-#    neither source answered, the note says currency was NOT read and why,
-#    so nobody mistakes "no finding" for "current".
-#
-# A root with no `contracts/shape-pin.yaml` says nothing here: a root adopted
-# before the pin existed, or a probe, is not out of sync with a pin it never
-# had.
-
-SHA_TOOL=""
-# Which sha256 this machine has: GNU `sha256sum`, the `shasum` a Mac ships, or
-# `openssl`. Chosen ONCE, here, and not inside `file_sha256`, whose caller runs
-# it in a command substitution — a subshell, where nothing chosen would
-# survive to the next file.
-choose_sha_tool() {
-    [ -z "$SHA_TOOL" ] || return 0
-    if command -v sha256sum >/dev/null 2>&1; then SHA_TOOL=sha256sum
-    elif command -v shasum >/dev/null 2>&1; then SHA_TOOL=shasum
-    elif command -v openssl >/dev/null 2>&1; then SHA_TOOL=openssl
-    else SHA_TOOL=none
-    fi
-}
-
-# sha256 of one file's bytes, as `file_sha256` in the standard's
-# `scripts/repo_shape.py` computes it. Empty when the tool could not read the
-# file. GNU `sha256sum` and `shasum` mark a name holding a backslash or a
-# newline by prefixing the whole line with `\`; that is about the name, not
-# the digest, and is dropped.
-file_sha256() {
-    local file="$1" out=""
-    case "$SHA_TOOL" in
-    sha256sum) out="$(sha256sum -- "$file" 2>/dev/null || true)" ;;
-    shasum) out="$(shasum -a 256 -- "$file" 2>/dev/null || true)" ;;
-    openssl) out="$(openssl dgst -sha256 -r -- "$file" 2>/dev/null || true)" ;;
-    esac
-    out="${out%% *}"
-    printf '%s' "${out#\\}"
-}
-
-# `path<TAB>sha256` per row of the pin's `files:` block — the rows
-# `update-shape.py` writes as `  - path: <p>` / `    sha256: "<hex>"`, in
-# that order; a hand-edited row the other way round is dropped, which is one
-# reason the note counts rows. A trailing comment on a path is not part of
-# it. A new top-level key ends the block.
-shape_pin_rows() {
-    local file="$1" line path="" digest in_files=0
-    [ -f "$file" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '#'*) continue ;;
-        'files:'*) in_files=1; path=""; continue ;;
-        [![:space:]]*) in_files=0; continue ;;
-        esac
-        [ "$in_files" -eq 1 ] || continue
-        case "$line" in
-        '  - path:'*)
-            path="$(trim_unquote "${line#*:}")"
-            case "$path" in
-            *' #'*) path="$(trim_unquote "${path%% #*}")" ;;
-            esac
-            ;;
-        '    sha256:'*)
-            digest="$(trim_unquote "${line#*:}")"
-            [ -z "$path" ] || printf '%s\t%s\n' "$path" "$digest"
-            path=""
-            ;;
-        esac
-    done <"$file"
-}
-
-# One two-space-indented scalar out of one top-level section of a manifest —
-# `shape:` / `  commit:` — with parameter expansion only, like `yaml_scalar`.
-nested_scalar() {
-    local file="$1" section="$2" key="$3" line in_section=0
-    [ -f "$file" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '#'*) continue ;;
-        "$section:"*) in_section=1; continue ;;
-        [![:space:]]*) [ "$in_section" -eq 0 ] || return 0 ;;
-        esac
-        [ "$in_section" -eq 1 ] || continue
-        case "$line" in
-        "  $key:"*) printf '%s\n' "$(trim_unquote "${line#*:}")"; return 0 ;;
-        esac
-    done <"$file"
-}
-
-# THE SOURCE'S DEFAULT BRANCH is what a pin is measured against. openRepoShape's
-# is `main`, but `source_repository:` is whatever a fork of the standard was
-# named, so it is READ where it can be — the clone's `origin/HEAD`, or GitHub's
-# `default_branch` — and remembered per source for the run; `main` when
-# neither says. And the answer about ONE pin serves every root that carries
-# it: a family's holder and members are cut from the same commit, and N
-# identical questions would be N round-trips and N strikes against
-# `gh_api_line`'s budget, which the fork check shares.
-SHAPE_DEFAULT_SOURCE=""
-SHAPE_DEFAULT_BRANCH=""
-SHAPE_ASKED=""
-SHAPE_ASKED_BEHIND=""
-SHAPE_ASKED_AHEAD=""
-
-# The pin's commit against the source's default branch, from a clone of the
-# source under the projects directory — found by its origin's slug, the way
-# `--repo` finds an estate, never by folder name. `merge-base --is-ancestor`
-# says whether the branch contains it, `rev-list --count` says how far behind.
-# Returns 0 when it could answer (finding or not), 1 when there is no such
-# clone or it has never fetched its default branch, so the caller can try
-# GitHub or say "not read".
-shape_currency_from_clone() {
-    local root="$1" commit="$2" source="$3" clone n default
-    clone="$(clone_with_origin "$source" || true)"
-    [ -n "$clone" ] || return 1
-    default="$(g "$clone" symbolic-ref -q --short refs/remotes/origin/HEAD 2>/dev/null || true)"
-    default="${default#origin/}"
-    [ -n "$default" ] || default=main
-    has_ref "$clone" "refs/remotes/origin/$default" || return 1
-    SHAPE_DEFAULT_SOURCE="$source"
-    SHAPE_DEFAULT_BRANCH="$default"
-    if ! g "$clone" cat-file -e "$commit^{commit}" 2>/dev/null; then
-        finding "shape pin $(short "$commit") is not in the clone of $source at $clone, as of its last fetch: fetch it, or the pin is on a commit that was squash-merged away"
-        return 0
-    fi
-    if g "$clone" merge-base --is-ancestor "$commit" "origin/$default" 2>/dev/null; then
-        n="$(g "$clone" rev-list --count "$commit..origin/$default" 2>/dev/null || true)"
-        [ -z "$n" ] || [ "$n" = 0 ] ||
-            finding "shape pin $(short "$commit") is $n commit(s) behind $source $default (per the clone at $clone, as of its last fetch): update-shape.py check --root $root"
-    else
-        finding "shape pin $(short "$commit") is not on $source $default (per the clone at $clone): a branch commit, which the standard's squash-merge orphans"
-    fi
-    return 0
-}
-
-# The same question put to GitHub, under `--fetch` only and only when no clone
-# answered: the source's default branch once per source, then `compare/<pin>
-# ...<default>` once per pin, with the pin as base so `ahead_by` is what the
-# branch has since the pin and `behind_by` is what the pin has that the
-# branch never did. Returns 1 when GitHub did not answer (`gh_api_line` has
-# said why, or an earlier failure settled the run).
-ask_github_shape_pin() {
-    local root="$1" commit="$2" source="$3" behind ahead default
-    if [ "$SHAPE_DEFAULT_SOURCE" = "$source" ] && [ -n "$SHAPE_DEFAULT_BRANCH" ]; then
-        default="$SHAPE_DEFAULT_BRANCH"
-    else
-        gh_api_line "shape check" "repos/$source" '.default_branch // "main"' || return 1
-        default="$GH_LINE"
-        [ -n "$default" ] || default=main
-        SHAPE_DEFAULT_SOURCE="$source"
-        SHAPE_DEFAULT_BRANCH="$default"
-    fi
-    if [ "$SHAPE_ASKED" = "$source $commit" ]; then
-        behind="$SHAPE_ASKED_BEHIND"
-        ahead="$SHAPE_ASKED_AHEAD"
-    else
-        gh_api_line "shape check" "repos/$source/compare/$commit...$default?per_page=1" \
-            '[(.behind_by|tostring), (.ahead_by|tostring)] | join("\u001f")' || return 1
-        IFS=$'\037' read -r behind ahead <<<"$GH_LINE"
-        SHAPE_ASKED="$source $commit"
-        SHAPE_ASKED_BEHIND="$behind"
-        SHAPE_ASKED_AHEAD="$ahead"
-    fi
-    if ! is_count "$behind" || ! is_count "$ahead"; then
-        finding "shape: GitHub's compare of pin $(short "$commit") with $source $default was not two counts; not read"
-        return 0
-    fi
-    [ "$behind" = 0 ] ||
-        finding "shape pin $(short "$commit") is not on $source $default: $behind commit(s) of it are not there (per GitHub) — a branch commit, which the standard's squash-merge orphans"
-    [ "$ahead" = 0 ] ||
-        finding "shape pin $(short "$commit") is $ahead commit(s) behind $source $default (per GitHub): update-shape.py check --root $root"
-    return 0
-}
-
-# A root's or holder's shape pin, all three reads, and one note line saying
-# what was pinned, how many copies matched, and where currency came from — or
-# that it was NOT read, and why, so silence is never mistaken for current.
-read_shape() {
-    local root="$1" manifest="$2" pin commit source mirror path digest actual
-    local ok=0 total=0 currency=""
-    pin="$root/contracts/shape-pin.yaml"
-    [ -f "$pin" ] || return 0
-    commit=""; yaml_scalar "$pin" commit && commit="$YAML_VALUE"
-    source=""; yaml_scalar "$pin" source_repository && source="$YAML_VALUE"
-    if [ -z "$commit" ]; then
-        finding "shape: contracts/shape-pin.yaml records no commit"
-        return 0
-    fi
-    choose_sha_tool
-    while IFS=$'\t' read -r path digest; do
-        [ -n "$path" ] || continue
-        total=$((total + 1))
-        if [ ! -f "$root/$path" ]; then
-            finding "shape copy $path is missing; contracts/shape-pin.yaml names it (update-shape.py check --root $root)"
-            continue
-        fi
-        if [ "$SHA_TOOL" = none ]; then
-            finding "shape copy $path not checked: no sha256sum, shasum or openssl on PATH"
-            continue
-        fi
-        actual="$(file_sha256 "$root/$path")"
-        if [ -z "$actual" ]; then
-            finding "shape copy $path not checked: \`$SHA_TOOL\` could not read it"
-        elif [ "$actual" != "$digest" ]; then
-            finding "shape copy $path edited in place: its sha256 is not the one contracts/shape-pin.yaml records (drift: carry the change upstream, never re-digest)"
-        else
-            ok=$((ok + 1))
-        fi
-    done < <(shape_pin_rows "$pin")
-    # THE MIRROR. `update-shape.py` moves the pin and the manifest's `shape:`
-    # block together, and refuses a manifest that has no such block — so a
-    # pin beside a manifest without one is the same half-done state as two
-    # different commits.
-    mirror="$(nested_scalar "$root/$manifest" shape commit)"
-    if [ -z "$mirror" ]; then
-        finding "shape: $manifest carries no \`shape:\` commit beside contracts/shape-pin.yaml (update-shape.py moves both together)"
-    elif [ "$mirror" != "$commit" ]; then
-        finding "shape: $manifest mirrors $(short "$mirror") but contracts/shape-pin.yaml pins $(short "$commit"): out of step (update-shape.py moves both together)"
-    fi
-    # CURRENCY: the clone first, because it is local and free, and reading it
-    # before asking GitHub is what the documents promise; GitHub only under
-    # `--fetch`, and only when no clone answered.
-    if [ -n "$source" ]; then
-        if shape_currency_from_clone "$root" "$commit" "$source"; then
-            currency="; against $source $SHAPE_DEFAULT_BRANCH per a clone under the projects directory"
-        elif [ "$FETCH" -eq 1 ] && ask_github_shape_pin "$root" "$commit" "$source"; then
-            currency="; against $source $SHAPE_DEFAULT_BRANCH per GitHub"
-        elif [ "$FETCH" -eq 1 ]; then
-            currency="; currency NOT read: no clone of $source with its default branch fetched under the projects directory, and GitHub did not answer (an earlier line says why)"
-        else
-            currency="; currency not read (no clone of $source with its default branch fetched under the projects directory; --fetch asks GitHub)"
-        fi
-    fi
-    say "    shape: pinned at $(short "$commit") of ${source:-an unnamed source}; $ok/$total copies match their digests$currency"
-}
-
-# --- the parked record against disk -------------------------------------------
-#
-# THE FIFTH LAYER, under Brett Heap's RULING of 2026-09-11, verbatim: "next
-# layer: parked record against disk". `park` RECORDS every open feature of an
-# estate in the person's private workspace repository — `workspaces/<org>/
-# <id>.yaml`, one block per project, one entry per feature, and per leg the
-# commit it was parked at and whether that commit was pushed — and `resume`
-# rebuilds the worktrees from that record on the next workstation. Between
-# the two, the record and the disk drift apart in exactly the ways `resume`
-# later refuses, and this layer reads them beforehand, the way `resume.sh`
-# will:
-#
-# 1. A RECORDED FEATURE WITH NO WORKTREE HERE on its branch: parked, and not
-#    resumed on this machine. `resume <Name>` is the exit; nothing here adds
-#    a worktree. Unless the record is a `--no-push` one (3), or names no
-#    parked commit for that leg (2): then there is nothing here to resume
-#    FROM, and the exit is the workstation that has it.
-#    And where the porcelain still holds a REGISTRATION for that branch that
-#    is no longer a worktree — its directory gone, or git's own `prunable`
-#    with the directory left behind — what clears it is named first: a prune,
-#    after an unlock where the registration is locked, and a move of any
-#    leftover directory. `resume` cannot recreate a worktree git still
-#    believes it has, nor write over a directory it did not create.
-# 2. A WORKTREE WHOSE BRANCH TIP IS NOT THE PARKED COMMIT: moved on since it
-#    was parked (park again before leaving); or BEHIND it — the record is
-#    newer, parked later on another workstation, which `resume` refuses to
-#    reset; or diverged from it; or a parked commit this machine never
-#    fetched. ONE GAP IS NOT A FINDING: `resume` recreates the worktree at the
-#    parked commit and SOFT-RESETS the WIP commits `park` made, so a resumed
-#    feature's tip is legitimately `<parked>~<wip_depth>` with the work back
-#    in the working tree — `resume.sh`'s `wip_gap_is_ours` is what keeps it
-#    from refusing that, and the same test is made here.
-#    AND A RECORD THAT NAMES NO PARKED COMMIT FOR THE LEG is a state of this
-#    field, not a leg to pass over (the independent review of #20,
-#    2026-09-11, note 7; this repository's #21, recorded there as out of scope). There is nothing
-#    for a tip to be compared WITH, so none of those arms can run; and with
-#    no worktree here `resume` does not bring it back either — its RR1
-#    refuses a leg whose parked commit is not origin's tip, and an absent
-#    one never is — so the line that named `resume <Name>` there named an
-#    exit that cannot work rather than merely staying quiet. Both halves say
-#    what the record does not say, and the exit is a park that parks the
-#    feature THROUGH: a park that refuses it carries the hole forward.
-# 3. A LEG PARKED WITH `--no-push`: the record says `pushed: false`, only the
-#    workstation that parked it has the WIP commit, and `resume` refuses it —
-#    so no line under this state names `resume` as the exit, and none blames
-#    a missing parked commit on a fetch that never had one to make.
-#    AND A `pushed:` THAT IS NEITHER `true` NOR `false` — a bare `pushed:`,
-#    `pushed: ""`, `pushed: yes` — IS A THIRD READING OF THAT FIELD, not a
-#    fourth spelling of one of the two (the second independent review of #18,
-#    2026-09-11, note (d); this repository's #19). `park.sh` writes one of
-#    those two words for every leg it parks and carries an existing entry
-#    forward untouched for one it refuses, so a value that is neither came
-#    from a hand-edit or a bad merge of the record; every arm below used to
-#    fall through the `= false`
-#    tests and say "the record says it was pushed", which is a claim the
-#    record does not make. It is named for what it is instead — a `pushed:`
-#    that cannot be read — and what `resume` will do with it is said with it:
-#    `resume.sh`'s RR6 is `[ "$pushed" != true ]`, so it refuses such a leg
-#    exactly as it refuses a `--no-push` one, and no line here offers
-#    `resume` as the exit either.
-#    AND NO `pushed:` KEY AT ALL IS A FOURTH STATE OF THE FIELD, not a
-#    quieter spelling of the third (the independent review of #19,
-#    2026-09-11, recorded there as out of scope; this repository's #20). It
-#    reads WORSE than the third did: `record_rows` emitted a leg's row at its
-#    `pushed:` line, so a
-#    leg without one had no row, and this layer said nothing whatever about
-#    the record — no finding, exit 0 — while `workspace-common.sh` seeds
-#    every leg's pushed with `false` and RR6 refuses that leg in the
-#    `--no-push` words. A wrong line can be argued with; a missing one
-#    cannot. The row now goes out where the LEG ENDS, a field of its own
-#    keeps `absent` apart from the bare `pushed:` that is `empty`, and the
-#    state gets a finding shaped like the third's: what the record does not
-#    say, what `resume` makes of that, and the one exit that works.
-# 4. A WORKTREE ON DISK THAT THE RECORD DOES NOT KNOW: a feature that was
-#    never parked, which is the one thing `park` exists to carry.
-# 5. A LEG THE RECORD GIVES NO ROLE: a state of the RECORD rather than of the
-#    disk, and read here because `resume` refuses the WHOLE FEATURE for it —
-#    `collect_legs` maps each leg's role onto this checkout and its `*)
-#    return 1` takes every other leg of that feature with it (the independent
-#    review of #20, 2026-09-11, note 8; this repository's #21, recorded there as out of scope). It is
-#    the ROOT's finding, since no leg repository can be found for a leg that
-#    names no role, and the exit is a park that parks the feature through.
-# 6. A LEG WHOSE ROLE THIS CHECKOUT'S SHAPE DOES NOT HAVE — a misspelling, or
-#    another shape's role — which `resume` refuses the WHOLE FEATURE for in
-#    the same breath and the same "shape mismatch" words as 5 (the
-#    independent review of #21, 2026-09-11). The line for it named neither
-#    the refusal nor an exit; it does both now, and it is worded for a role
-#    that is genuinely another shape's as well as for a typo, because this
-#    layer cannot tell those apart and a park cannot make this root mount
-#    what its shape has not got.
-# 7. A FEATURE THE RECORD LISTS NO LEG FOR — an empty `legs:`, the `legs: []`
-#    `workspace_write_manifest` writes for a feature it has no legs for, or
-#    leg items with no `- role:` line — which `collect_legs` refuses whole at
-#    its closing `[ "${#LEG_ROLES[@]}" -gt 0 ]`, in the same "shape mismatch"
-#    words again (note 1 of the independent review of #21, 2026-09-11; this repository's #22, and
-#    the note-8 commit's own "recorded for later"). The first of these states
-#    that is not a LEG's: there is no leg to hang a reading on, so it is read
-#    per FEATURE, in `read_record`, where the comment above that function
-#    says how and why the features are judged before their legs are read.
-#
-# 8. A LEG WHOSE BRANCH ORIGIN HAS LOST — no `origin/<branch>` in that leg's
-#    repository — which `resume` refuses the WHOLE feature for at RR2, in
-#    words and with exits of its own: "<branch> is no longer on origin in the
-#    <role> leg", then the record's `- branch: <branch>` block to delete where
-#    the feature landed, or the branch to push again from the workstation that
-#    parked it where it went by mistake (the independent review of #21,
-#    2026-09-11, recorded there as out of scope; verified against the
-#    extension on 2026-09-12). Read only where there is no worktree here,
-#    because RR4 comes first and calls a leg whose worktree is already at the
-#    path it computes recreated; read before 2, because RR2 comes before RR1;
-#    and READ AS OF THE LAST FETCH, because RR2's own test is a REF in that
-#    repository and this is the same ref. Which is why it is TWO readings and
-#    not one: after a fetch that worked here the ref is origin's answer and
-#    the finding is RR2's refusal with RR2's exits, while without one the
-#    commonest reason for a missing `origin/<branch>` is a feature parked
-#    elsewhere since this clone last fetched — `resume` fetches that branch
-#    itself and brings it back — so state 1's line keeps its exit and carries
-#    the other reading, and `status --fetch` is what settles them. THE
-#    WORKTREE THE TWO ENDS LOOK FOR IS NOT QUITE THE SAME WORKTREE:
-#    `worktree_on_branch` finds one on that branch ANYWHERE in the leg's
-#    repository, while `resume.sh`'s `leg_registered_at` matches the PATH it
-#    computes under the worktree root, so a worktree on the branch at some
-#    other path leaves this reading quiet where RR2 would still refuse (the
-#    independent review of this branch, 2026-09-12, note 4). Pre-existing —
-#    every arm here that asks "is there a worktree" asks it that way — and a
-#    reading of its own, recorded here and not taken.
-#    AND WHERE THE FETCH SETTLES IT THE REFUSAL IS THE FEATURE'S, made with
-#    the three below in `read_record`'s first pass and carried onto every leg
-#    of it: the paragraph under this one is what that means for the lines.
-#
-# 5, 6, 7 AND 8 ARE REFUSALS OF THE WHOLE FEATURE, SO NO LINE OF THAT FEATURE
-# NAMES `resume` (Copilot on #21, second round, 2026-09-11; 8 by the
-# independent review of this branch, 2026-09-12, which found that reading
-# PRINTED as a whole-feature refusal and not MADE one). A leg of such a
-# feature that is otherwise perfectly resumable — parked, pushed, no worktree
-# here — used to draw "`resume <Name>` brings it back" two lines under the
-# one that says `resume` refuses the whole feature, and a person reads the
-# REPORT, not one line of it: the two together name an exit that cannot work,
-# which is the rule at the top of `check_parked_leg`. `read_record`'s first
-# pass makes the verdict for every feature before any of its legs is read and
-# hands it down, so those lines say what `resume` will do and end at the one
-# exit there is. 8 DIFFERS FROM THE OTHER THREE TWICE OVER: its exits are its
-# own, because a re-park settles 5, 6 and 7 and is the wrong thing to name for
-# a branch origin has lost — the feature may have LANDED — and it is a verdict
-# only UNDER `--fetch`, because without one the feature is not known to be
-# refused at all and state 1's line keeps its exit with the other reading
-# beside it. Everything else a sibling can say — dirty, moved on,
-# behind, a commit that is not here — is unchanged: it was never `resume`
-# that answered those.
-#
-# WHAT THE OTHER END'S LOADER DOES WITH AN ABSENT `pushed:` IS CHANGING, AND
-# NO LINE HERE DEPENDS ON IT (the independent review of workBenches #60,
-# 2026-09-11). Paragraph 3's account of the fourth state is workBenches
-# before #60 (ec2b450): `workspace_load_project` seeds every leg's pushed
-# with `false`, so `resume` reads a missing key as `false` and RR6 refuses
-# the leg in the `--no-push` words. workBenches #60, merged as 98b8bd1 and
-# that repository's main since, stops that invention — the seed is the
-# empty string, a new `MANIFEST_LEG_PUSHED_SEEN[]` keeps absent apart from
-# bare, and RR6 refuses the leg in words of its own, "the record has no
-# `pushed:` for this leg" (both run on 2026-09-11, exit 2 each). THE OUTCOME
-# IS THE SAME UNDER BOTH — the leg is not recreated, and only a park that
-# parks the feature through writes a record that reads — so that is what the
-# findings say, and none of them says how the loader reached it.
-#
-# THE RECORD IS FOUND WHERE `park` FILES IT AND `resume` LOOKS FOR IT:
-# `${AGENT_PROTOCOL_ROOT:-~/.agents}/workspace.yaml` names the workspace
-# repository and its checkout (`path:`), plus per-org overrides under
-# `orgs:`, each checkout counted ONCE by physical path (an override pointing
-# at the default's clone is one clone, not two orgs); every checkout's
-# `workspaces/<org>/*.yaml` is scanned for the estate's ID — a standalone
-# project's `project.yaml` `id:`, a family's `family.yaml` `id:`, which is
-# the name `park` files under — and then, if none, for the estate's FOLDER
-# name, which is what `resume <Name>` looks up; basenames are compared
-# case-insensitively, as `resume` compares them. No config, a checkout that
-# is not on this machine, or no record for this estate, is a NOTE, not a
-# finding: a machine that never parked has nothing to be out of sync with.
-# Two orgs recording the same id is a note too, unless one of them is the org
-# this root's origin names. Nothing here reads the workspace repository's
-# remote: the record is as of its last pull, and the estate's line says so.
-#
-# A FAMILY's record has one block per MEMBER, matched by its `root:` —
-# `<family folder>/<member folder>`, the casing `workspace_manifest_root_value`
-# writes — and the holder has none. Each leg is read in the repository it
-# lives in: the root for the `repo` and `assembly` roles, the leg's own
-# checkout for `spec`, `code` and any other role `project.yaml` places.
-
-WORKSPACE_CONFIG="${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"
-RECORD_FILE=""
-RECORD_NOTE=""
-RECORD_ID=""
-#: The `shape:` of the block being read, which `read_record` fills from
-#: `record_rows`'s project row and only the shape reading in
-#: `check_parked_leg` looks at. Declared here because `set -u` is on and a
-#: record with no project row leaves it as it was.
-RECORD_SHAPE=""
-#: WHERE THIS CHECKOUT'S FEATURE WORKTREES BELONG, computed once per root by
-#: `read_record` — `record_worktree_root` reads a config file and the answer is
-#: the ROOT's, not the leg's, so asking it per leg read the same file over
-#: again. Declared here because `set -u` is on and the record layer is entered
-#: for a root whose block the record may not carry.
-RECORD_WORKTREE_ROOT=""
-NL=$'\n'
-
-# shellcheck disable=SC2088  # a literal leading ~ is what is matched here
-expand_home() {
-    local value="$1"
-    case "$value" in
-    '~') printf '%s\n' "$HOME" ;;
-    '~/'*) printf '%s\n' "$HOME/${value#\~/}" ;;
-    *) printf '%s\n' "$value" ;;
-    esac
-}
-
-# Every workspace checkout the config names: the top-level `path:` and each
-# `    path:` under `orgs:`. Read only; a malformed block is a block not found.
-workspace_checkouts() {
-    local file="$1" line
-    [ -r "$file" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        case "$line" in
-        '#'*) continue ;;
-        'path:'* | '    path:'*) expand_home "$(trim_unquote "${line#*:}")" ;;
-        esac
-    done <"$file"
-}
-
-# `<org><TAB><file>` for every `workspaces/<org>/<id>.yaml` in every checkout,
-# basename compared case-insensitively — `resume`'s `manifest_candidates`.
-#
-# ONE ROW PER `<org>/<basename>`, because that is what `resume` counts as one
-# record (F4 of the review on openRepoShape #83): the same `<org>/<id>.yaml`
-# reached through TWO CHECKOUTS of one workspace repository — a second clone
-# of it named by an `orgs:` override — is ONE record, and `--org` could not
-# have told the two apart. The checkouts are already deduped by physical path
-# in `locate_record`; this is the other half of the same rule, for two clones
-# that really are two directories. Without it they counted as two, which read
-# as "two orgs record this id" and, where origin names no owner to settle it,
-# SKIPPED a record that was never ambiguous. BOTH HALVES OF THE KEY ARE
-# LOWERED, because both were MATCHED that way — the basename two lines above,
-# the org as `resume` folds it — so `Atlas.yaml` in one checkout and
-# `atlas.yaml` in another are one record here too (Copilot on #18).
-record_candidates() {
-    local want checkout dir file base key seen
-    local -a keys=()
-    want="$(lower "$1")"
-    shift
-    for checkout in "$@"; do
-        [ -d "$checkout/workspaces" ] || continue
-        for dir in "$checkout"/workspaces/*/; do
-            dir="${dir%/}"
-            [ -d "$dir" ] || continue
-            for file in "$dir"/*.yaml; do
-                [ -f "$file" ] || continue
-                base="${file##*/}"
-                [ "$(lower "${base%.yaml}")" = "$want" ] || continue
-                key="$(lower "${dir##*/}")/$(lower "$base")"
-                for seen in ${keys[@]+"${keys[@]}"}; do
-                    [ "$seen" != "$key" ] || continue 2
-                done
-                keys+=("$key")
-                printf '%s\t%s\n' "${dir##*/}" "$file"
-            done
-        done
-    done
-}
-
-# THIS estate's record, once per estate: RECORD_FILE, or RECORD_NOTE saying
-# why there is none to read. RECORD_ID is what a standalone block is matched
-# by.
-locate_record() {
-    local manifest checkouts candidates count org file owner url line physical seen missing=""
-    local -a dirs=()
-    RECORD_FILE=""
-    RECORD_NOTE=""
-    RECORD_ID=""
-    if [ "$ESTATE_KIND" = "family" ]; then
-        manifest="$ESTATE_ROOT/family.yaml"
-    else
-        manifest="$ESTATE_ROOT/project.yaml"
-    fi
-    if yaml_scalar "$manifest" id; then RECORD_ID="$YAML_VALUE"; fi
-    [ -n "$RECORD_ID" ] || RECORD_ID="$(lower "$ESTATE_NAME")"
-    if [ ! -f "$WORKSPACE_CONFIG" ]; then
-        RECORD_NOTE="parked record: no $WORKSPACE_CONFIG on this machine, so parked features are not read (\`resume --workspace <owner>/<repo>\` writes it)"
-        return 0
-    fi
-    if [ ! -r "$WORKSPACE_CONFIG" ]; then
-        RECORD_NOTE="parked record: $WORKSPACE_CONFIG cannot be read (permissions), so parked features are not read"
-        return 0
-    fi
-    checkouts="$(workspace_checkouts "$WORKSPACE_CONFIG")"
-    if [ -z "$checkouts" ]; then
-        RECORD_NOTE="parked record: $WORKSPACE_CONFIG names no \`path:\`, so parked features are not read"
-        return 0
-    fi
-    # ONE ENTRY PER DIRECTORY, by PHYSICAL path — `resume`'s `add_workspace`,
-    # for its reason (F4 of the review on openRepoShape #83): an `orgs:`
-    # override pointing at the default's clone would otherwise be scanned
-    # twice and every record in it counted twice, which reads as "two orgs
-    # record this id". A checkout the config names and this machine does not
-    # have is skipped and, if none is left, said.
-    while IFS= read -r line; do
-        [ -n "$line" ] || continue
-        [ -d "$line" ] || { missing="${missing:+$missing }$line"; continue; }
-        physical="$(cd "$line" 2>/dev/null && pwd -P)" || physical="$line"
-        for seen in ${dirs[@]+"${dirs[@]}"}; do
-            [ "$seen" != "$physical" ] || continue 2
-        done
-        dirs+=("$physical")
-    done <<<"$checkouts"
-    if [ ${#dirs[@]} -eq 0 ]; then
-        RECORD_NOTE="parked record: the workspace checkout $WORKSPACE_CONFIG names is not on this machine ($missing), so parked features are not read (\`resume\` clones it)"
-        return 0
-    fi
-    candidates="$(record_candidates "$RECORD_ID" "${dirs[@]}")"
-    if [ -z "$candidates" ] && [ "$(lower "$ESTATE_NAME")" != "$(lower "$RECORD_ID")" ]; then
-        # Filed under the id by `park`; looked up by folder by `resume <Name>`.
-        candidates="$(record_candidates "$ESTATE_NAME" "${dirs[@]}")"
-    fi
-    if [ -z "$candidates" ]; then
-        RECORD_NOTE="parked record: none for '$RECORD_ID' under ${dirs[*]} — nothing of this estate has been parked, or not into this workspace"
-        return 0
-    fi
-    count="$(printf '%s\n' "$candidates" | grep -c . || true)"
-    if [ "$count" -eq 1 ]; then
-        RECORD_FILE="${candidates#*	}"
-        return 0
-    fi
-    # Two orgs record this id — genuinely two, the rows being one per
-    # `<org>/<basename>`: the one this root's origin belongs to, if any.
-    url="$(g "$ESTATE_ROOT" config --get remote.origin.url 2>/dev/null || true)"
-    owner="$(repo_slug_of "$url" || true)"
-    owner="${owner%%/*}"
-    while IFS=$'\t' read -r org file; do
-        [ -n "$org" ] || continue
-        if [ -n "$owner" ] && [ "$(lower "$org")" = "$(lower "$owner")" ]; then
-            RECORD_FILE="$file"
-            return 0
-        fi
-    done <<<"$candidates"
-    RECORD_NOTE="parked record: $count records for '$RECORD_ID' in different orgs, and none is the org this root's origin names; not read (\`resume --org\` is how one is chosen)"
-}
-
-# One project block of a record as rows, fields joined by 0x1F (a tab is IFS
-# whitespace, and an absent optional key — `park` writes no key for an empty
-# value — would shift every later field left, the hazard `read_branches`
-# names): `project` with parked_at, parked_on, lane and active, once; `branch`
-# with the branch, per feature; `leg` with branch, role, parked_commit,
-# pushed, wip_depth and whether the record carried a `pushed:` KEY at all,
-# per leg; and, for the lines `workspace_load_project` reads NEITHER a feature
-# nor a leg out of, `nofeature` with the branch and `noleg` with the branch
-# and the role. The block is the one whose `id:` (a standalone) or `root:` (a
-# family member) is the selector's. The layout is the fixed one
-# `workspace_write_manifest` emits — two spaces per level, `pushed:` the last
-# key of a leg. A `pushed:` with no VALUE is read for what it is rather than
-# as either of the two words, which is `check_parked_leg`'s business.
-#
-# THE LEG'S ROW GOES OUT WHERE THE LEG ENDS, NOT AT ITS `pushed:` LINE (the
-# independent review of #19, 2026-09-11). Emitting at `pushed:` was the same
-# position for every record `park` writes, because that key is always last
-# and always there — until it is NOT there, and then the leg had no row and
-# VANISHED from this layer: no finding, exit 0, silence about a record
-# `resume.sh` refuses: RR6 is `[ "$pushed" != true ]`, and no loader of that
-# record makes an absent key `true` — on workBenches before #60 (ec2b450)
-# `workspace-common.sh` defaults the leg's pushed to `false` at the `- role:`
-# line when no `pushed:` follows (the review cited its line 777), and under
-# workBenches #60 the seed is the empty string with the key's absence carried
-# in a field of its own, so the leg is refused either way. The comment that
-# stood here called the dropped leg harmless —
-# its branch is still known from the `branch` row, so it is never accused of
-# being unparked — which is true and beside the point: not being accused is
-# not the same as being read, and this layer exists to read the record the
-# way `resume` will judge it. So the row is emitted when the leg ENDS: the
-# next `- role:`, the next feature's `- branch:`, the next key at any
-# SHALLOWER indent (a project-level `features:` or `root:`, the next project
-# block's `- id:`, a top-level key), or the end of the file. `role` is
-# cleared as the row goes out, so two enders in a row emit once and a block
-# with no leg emits nothing. For a leg whose `pushed:` is there AND LAST —
-# which is every leg `workspace_write_manifest` emits — this is the same
-# line and the same order as before, which is what keeps a well-formed
-# record's rows byte-identical; where a hand-edit moved the key, the row now
-# carries the keys AFTER it too, which is what the loader reads.
-#
-# AND THE PROJECT ROW CARRIES WHAT THE LOADER WOULD HAVE READ, WHICH MEANS
-# EMITTING IT WHERE THE BLOCK ENDS (Copilot's first round on #23): "the
-# project row is serialized when `features:` is encountered, but
-# `workspace_load_project` accepts the other project-level keys at the same
-# indent in any order. If a hand-edited or merged manifest places `shape:`
-# after the feature list … `RECORD_SHAPE` remains empty and the new
-# shape-disagreement diagnostic is silently omitted even though `resume` reads
-# the field." It holds for all five of them — the loader's indent-4 arm is one
-# `case` over `shape`, `root`, `parked_at`, `parked_on`, `parked_by_lane`,
-# `active_feature` and the rest, reached by INDENT and not by position. Run
-# against the extension on 2026-09-12 on a record whose `shape:`, `parked_at:`,
-# `parked_on:`, `parked_by_lane:` and `active_feature:` all sit BELOW its
-# feature list: `workspace_load_project` returned every one of them
-# (`MANIFEST_SHAPE=three-leg`, `MANIFEST_PARKED_AT=2026-09-10T20:00:00Z`,
-# `MANIFEST_PARKED_ON=Falcon`, the lane and the active feature), with the
-# feature and its leg intact — while this reader, emitting at `features:`,
-# read them as absent: the root's note line said "parked ? on ?", the
-# unmappable-role finding lost its "the record calls the project three-leg
-# where this checkout is single" clause, and its re-park exit said "the record
-# does not say where" about a record that says Falcon. So the row is built at
-# the FLUSH, from the values the whole block left behind, and `$has_features`
-# — set by the `features:` key and nothing else — is what decides whether
-# there is a row at all, exactly as the key did before. A block with no
-# `features:` key still emits none — UNLESS a line of it is one this reader
-# owes a finding about, which is the `$unread` half of that gate and the one
-# thing added to it: a block whose `- branch:` sits above every `features:`
-# key has no feature for the row to count, and the finding it gets instead
-# names the date and the workstation out of exactly those fields ("park it
-# again from the workstation that has it"). A record `park` wrote is byte for
-# byte the rows it always was: one block matches, `features:` is the last
-# project-level key in it, nothing in it goes unread, and the row goes out in
-# front of the branch and leg rows it sat in front of.
-#
-# AND THE SIXTH FIELD IS HOW `absent` IS TOLD FROM `empty`, which are two
-# states and not one: a bare `pushed:` is PRESENT and unreadable (note (d) of
-# the second independent review of #18), and no `pushed:` at all is the
-# record saying nothing about that leg. Both leave the `pushed` field empty,
-# so the difference cannot live in it — and a sentinel word put there could
-# be spelled by the hand-edit that produced the record and read back as the
-# sentinel. The sixth field is written by THIS function and never from the
-# file: the word `pushed` where the key was seen, empty where it was not.
-#
-# AND A LEG IS OPEN FROM ITS `- role:` LINE, WHATEVER THAT LINE SAYS (the
-# independent review of #20, 2026-09-11, note 8, recorded there as out of
-# scope). `[ -n "$role" ]` was doing two jobs at both emit sites — "a leg is
-# open" and "the leg has a role" — and the second DROPPED the row for a leg
-# whose `- role:` value is EMPTY, while `workspace_load_project` creates that
-# leg exactly as it creates any other: its indent-10 arm takes the `- ` item,
-# reads `role` as the key, and assigns whatever `_SHAPE_SCALAR` holds, empty
-# or not. A leg the loader has and this reader has not is a leg `resume`
-# refuses the WHOLE FEATURE for while this layer says nothing — the shape of
-# hole the two notes before it closed. `$open` does the first job now, set at
-# the `- role:` line and cleared where the leg ends, so the role's value is
-# left to mean only what it says and the row goes out with an EMPTY role
-# field for `check_parked_leg` to read; the row's SIX FIELDS are unchanged,
-# because an empty field between two 0x1F separators shifts nothing.
-# A LEG WITH NO `- role:` LINE AT ALL is a different thing, and the two
-# readers agree about that one already: the loader's `[ "$key" = "role" ] ||
-# continue` starts no leg for it, and with no `- role:` line there is nothing
-# to open one here either, so neither reader has a leg to read.
-# EVERY VALUE THIS PARSER READS LOSES A `#` COMMENT FIRST, because
-# `workspace_load_project` takes `#` and everything after it off EVERY line
-# (`content="${raw%%#*}"`) before it splits key from value: `- role: repo # the
-# leg` is `repo` there, and `- role: # note` is a leg with no role there. Read
-# whole here, the first was a role this root does not mount and the second was
-# not empty at all, so both went to `leg_repo_for_role` and drew "the record
-# names a leg this root does not mount here" — the mounting arm's true words
-# about a record `resume` refuses for a different reason entirely (Copilot on
-# #21, after #19 had closed the same gap for `pushed:` alone). The parity is
-# per LINE, as the loader's is: a value that itself contains a `#` is cut
-# there too, exactly as `resume.sh` will cut it — this layer reads the record
-# the way `resume.sh` will judge it, and not the way YAML would.
-record_scalar() {
-    local value="$1"
-    case "$value" in *'#'*) value="${value%%#*}" ;; esac
-    trim_unquote "$value"
-}
-
-record_rows() {
-    local file="$1" sel="$2" line matched=0 value open=0 named=0 held="" has_features=0
-    local in_features=0 in_legs=0 dropped=0 unread=0 leg_why=outer why=""
-    local parked_at="" parked_on="" lane="" active="" branch="" role="" commit="" pushed="" depth="" seen="" shape=""
-    [ -f "$file" ] || return 0
-    while IFS= read -r line || [ -n "$line" ]; do
-        line="${line%$'\r'}"
-        # THE LEG ENDS WHERE THE NEXT THING STARTS. Every alternative here is
-        # a line whose first non-space character sits SHALLOWER than a leg's
-        # own keys (which the layout puts at twelve spaces), plus the next
-        # leg's own `- role:` at ten. A blank line is none of them, AND NOR IS
-        # A FULL-LINE COMMENT at any indent: `workspace_load_project` takes
-        # `#` and everything after it off every line before it reads one
-        # (`content="${raw%%#*}"`), so a `# note` a hand left at column 0
-        # between two of a leg's keys is nothing to the loader — and read as
-        # an ender here it closed the leg before its `pushed:`, and the leg
-        # went out as if the record had none (the review of this follow-up,
-        # 2026-09-11). A record with a blank line or a comment between two
-        # keys still has one leg, not two. An indent-10 line that is NOT
-        # `- role:` is deliberately not an ender either: `workspace_load_project`
-        # starts no leg there, and its twelve-space keys keep landing on the
-        # leg above — so the two readers agree.
-        case "${line#"${line%%[![:space:]]*}"}" in
-        '#'*) ;;
-        *)
-            case "$line" in
-            [![:space:]]* | '  '[![:space:]]* | '    '[![:space:]]* | \
-                '      '[![:space:]]* | '        '[![:space:]]* | '          - role:'*)
-                if [ "$named" -eq 1 ] && [ "$open" -eq 1 ]; then
-                    held="$held$(printf 'leg\037%s\037%s\037%s\037%s\037%s\037%s' "$branch" "$role" "$commit" "$pushed" "$depth" "$seen")$NL"
-                fi
-                role=""; open=0
-                ;;
-            esac
-            ;;
-        esac
-        # AND A LIST IS OPEN ONLY WHERE THE LOADER HAS IT OPEN. This is the
-        # reading recorded and not taken by the commit before this one: an
-        # indent-4 key CLOSES the feature list at `workspace_load_project` —
-        # `in_features=false` is the first line of that arm, before the `case`
-        # that sets it true again for `features:` alone — and an indent-8 key
-        # closes a feature's leg list the same way, `in_legs=false` at the top
-        # of ITS arm. Under a shut list the loader reads nothing: its indent-6
-        # arm is behind `[ "$in_features" = true ] || continue` and its
-        # indent-10 arm behind `[ "$in_legs" = true ] || continue`, so a
-        # `- branch:` below a project-level key — or before any `features:` key
-        # at all — is a feature it never makes, and a `- role:` below a
-        # feature-level key is a leg it never makes. Run against the extension
-        # on 2026-09-12 on nine records: a project key between two features
-        # loaded the FIRST feature and its leg and no second feature; one
-        # between a feature's `- branch:` and its `legs:` loaded that feature
-        # with ZERO legs; a `- branch:` above every `features:` key loaded no
-        # feature at all; a feature-level key between `legs:` and its items,
-        # and between two of them, loaded the feature with none and with the
-        # first alone; and a SECOND `features:` key reopened the list, both
-        # features and both legs intact.
-        # This reader had no such state — it matched the indent of a line and
-        # nothing above it — so it emitted a `branch` row for a feature
-        # `resume` never sees and a `leg` row for a leg it never makes, which
-        # is work `status` claimed and `resume` will not bring back: the
-        # direction that most needs a line, because a person reading it
-        # believes the feature is safe. The first two flags below are the
-        # loader's two, set in the same places: every line at indent 0, 2 or 4
-        # shuts the feature list and `features:` alone reopens it, every line
-        # at indent 6 or 8 shuts the leg list and `legs:` reopens it INSIDE an
-        # open feature list. Nothing at indent 10 or 12 moves either, as
-        # nothing does at the loader, and a full-line comment is not a line at
-        # all to either reader. The rows the lines under a shut list get
-        # instead are `nofeature` and `noleg`, read by `read_record`: this
-        # layer drops nothing silently.
-        #
-        # AND `$leg_why` IS WHICH LINE THE PERSON HAS TO GO AND FIND, kept
-        # beside them because a finding that names the wrong one sends a hand
-        # to an indent the record has nothing out of place at. It is three
-        # states and not two (Copilot's first round on this PR, suppressed):
-        # `outer`, a key at PROJECT indent, which shuts the feature list and
-        # every leg list inside it — and which a `features:` key is too, so a
-        # list REOPENED by one is still `outer` until something nearer shuts
-        # it; `legs`, a key at FEATURE indent shutting a list a `legs:` key
-        # had opened; and `nolegs`, where no `legs:` key has opened one at
-        # all since this feature's `- branch:` line. Read whole, the third
-        # was told as the second: "shuts a feature's `legs:` list" for a
-        # record whose feature has no `legs:` key above that line to shut.
-        #
-        # AND `nolegs` IS THE `- branch:` LINE'S AND NO OTHER LINE'S AT
-        # INDENT 6, which is the loader again: its indent-6 arm makes a
-        # feature only where the item's key is `branch` (`[ "$key" = branch ]
-        # || continue`), and at any other line there it reads no feature and
-        # stays in the one above — whose `legs:` key IS above that line. So
-        # that line is a key that SHUT a list, `legs` like the indent-8 keys
-        # beside it, and a `nolegs` there would send a hand looking for a
-        # `legs:` key the feature has got. The third state is the one this
-        # round ADDED, and it may not swallow the second on its way in.
-        case "${line#"${line%%[![:space:]]*}"}" in
-        '#'*) ;;
-        *)
-            case "$line" in
-            '    features:'*)
-                in_features=1; in_legs=0; leg_why=outer
-                # AND A REOPENED LIST IS A CLEAN SLATE FOR `$dropped`
-                # (Copilot's first round on this PR, suppressed). The legs of
-                # a list reopened below an unread `- branch:` are collected
-                # onto the feature ABOVE it — record (k) of the probe — so a
-                # `- role:` under one is that feature's defect and not the
-                # unread branch's said twice. Left set, it suppressed the
-                # `noleg` row for exactly that line, and where the feature
-                # above had no other leg the report then said "the record
-                # lists no leg for it" about a record that lists one, which is
-                # the sentence this commit exists to stop making.
-                dropped=0
-                ;;
-            [![:space:]]* | '  '[![:space:]]* | '    '[![:space:]]*)
-                in_features=0; in_legs=0; leg_why=outer
-                ;;
-            '        legs:'*)
-                in_legs="$in_features"
-                [ "$in_features" -eq 0 ] || leg_why=legs
-                ;;
-            '      - branch:'*)
-                in_legs=0
-                [ "$in_features" -eq 0 ] || leg_why=nolegs
-                ;;
-            '      '[![:space:]]* | '        '[![:space:]]*)
-                in_legs=0
-                [ "$in_features" -eq 0 ] || [ "$leg_why" = nolegs ] ||
-                    leg_why=legs
-                ;;
-            esac
-            ;;
-        esac
-        # A ROW BELONGS TO ITS BLOCK, AND A BLOCK IS NOT KNOWN TO BE THE
-        # SELECTED ONE UNTIL THE KEY THAT SELECTS IT IS READ (Copilot's second
-        # round on #22). An `id=` selector is answered by the block's FIRST
-        # line, so every row after it knew where it stood; a `root=` selector
-        # — the one a family member is matched by, and the one a record found
-        # under the folder name falls back to — is answered at the `root:`
-        # key, which `workspace_write_manifest` writes above `features:` and a
-        # hand-edit or a bad merge can leave below it. Every row emitted
-        # before that line was then thrown away for a block that DID match:
-        # the `project` row, each feature's `branch` row, and every leg that
-        # ended above it. For the layout `park` writes — `features:` last —
-        # that is the whole block, so this function returned nothing and the
-        # layer said "no block for this root" about a record it had just
-        # matched; for a `root:` left INSIDE the feature it was the mangling
-        # Copilot named, a blank `- branch:` row suppressed while the leg row
-        # under it went out, reaching `read_record` with no branch row before
-        # it, taking no feature's verdict and drawing "`resume <Name>` brings
-        # it back" for a feature `resume` refuses at RR2 under a blank name.
-        # `workspace_load_project` has no such order: it matches at the
-        # `- id:` line and reads a block's keys by their INDENT, wherever they
-        # sit in it.
-        #
-        # SO THE ROWS ARE HELD AND FLUSHED, NOT EMITTED AND HOPED FOR. Every
-        # arm below appends to `$held`, the buffer goes out whole where the
-        # block ENDS — in the record's own order, which is the order it was
-        # appended in — and a block that never matched is dropped there
-        # instead. THE EMITTED BYTES ARE UNCHANGED for every record `park`
-        # writes: one block matches, its rows go out in the order they were
-        # appended, with the same fields, and the caller reads this
-        # function's whole output in a `$(…)` either way.
-        case "$line" in
-        '  - id:'*)
-            # THE BLOCK ABOVE ENDS HERE. Its `project` row goes out in front
-            # of the rows it was gathered beside, which is where it has
-            # always been read — see the note above the row itself.
-            if [ "$matched" -eq 1 ]; then
-                if [ "$has_features" -eq 1 ] || [ "$unread" -eq 1 ]; then
-                    printf 'project\037%s\037%s\037%s\037%s\037%s\n' "$parked_at" "$parked_on" "$lane" "$active" "$shape"
-                fi
-                [ -z "$held" ] || printf '%s' "$held"
-            fi
-            held=""; has_features=0; unread=0; dropped=0
-            matched=0
-            parked_at=""; parked_on=""; lane=""; active=""; branch=""; role=""; open=0; named=0; shape=""
-            value="$(record_scalar "${line#*:}")"
-            case "$sel" in
-            id=*) [ "$(lower "$value")" != "$(lower "${sel#id=}")" ] || matched=1 ;;
-            esac
-            ;;
-        '    root:'*)
-            value="$(record_scalar "${line#*:}")"
-            case "$sel" in
-            root=*) [ "$(lower "$value")" != "$(lower "${sel#root=}")" ] || matched=1 ;;
-            esac
-            ;;
-        # THE RECORD'S OWN `shape:`, which `workspace_write_manifest` writes for
-        # every project block it merges (its `PROJECT_KEYS`, second entry) and
-        # `workspace_load_project` loads as `MANIFEST_SHAPE`. IT DECIDES
-        # NOTHING AT EITHER END — `collect_legs` maps roles onto the shape of
-        # THIS CHECKOUT and never reads it — and `resume.sh` only prints it,
-        # in "was parked from a $MANIFEST_SHAPE project and this checkout is
-        # $REPO_SHAPE", which is the sentence the shape reading below
-        # explains. It is read here so that a disagreement between the two can
-        # be NAMED where it is relevant, and nowhere else: a record whose legs
-        # this checkout maps is a record this layer says nothing about,
-        # whatever its `shape:` says.
-        '    shape:'*) shape="$(record_scalar "${line#*:}")" ;;
-        '    parked_at:'*) parked_at="$(record_scalar "${line#*:}")" ;;
-        '    parked_on:'*) parked_on="$(record_scalar "${line#*:}")" ;;
-        '    parked_by_lane:'*) lane="$(record_scalar "${line#*:}")" ;;
-        '    active_feature:'*) active="$(record_scalar "${line#*:}")" ;;
-        '    features:'*) has_features=1 ;;
-        '      - branch:'*)
-            # A `- branch:` WITH NO VALUE IS STILL A FEATURE TO THE LOADER:
-            # `workspace_load_project` appends `MANIFEST_FEATURE_BRANCHES`
-            # at every `- branch:` line, empty or not, and `resume.sh` then
-            # reads a feature named nothing — refusing it at RR2 in RR2's
-            # words with the name blank ("Error:  is no longer on origin in
-            # the repo leg", exit 2, run against the extension 2026-09-12)
-            # where it has legs, and as a shape mismatch where it has none.
-            # Read whole this row was dropped and its legs with it, and the
-            # feature vanished from this layer (Copilot on #22). The row goes
-            # out with the empty name, and `$named` — not the name — is what
-            # lets a leg row out: a leg before any `- branch:` line at all
-            # still has no feature to belong to and is still dropped. A
-            # `- branch:` READ BEFORE THE BLOCK WAS KNOWN TO MATCH — a `root:`
-            # selector answered below it — goes out with the rest of the held
-            # rows and in the record's order, which is the flush above.
-            #
-            # AND A `- branch:` UNDER A SHUT FEATURE LIST IS NO FEATURE AT
-            # ALL, which is the reading above: it gets a `nofeature` row
-            # instead, so the branch the record lists is named in a finding of
-            # its own rather than counted as a feature `resume` will rebuild.
-            # IT DOES NOT BECOME `$branch` EITHER. `$branch` is this reader's
-            # `feature_index` — the last feature the loader MADE — and the
-            # loader's does not move at a line it reads no feature out of: put
-            # a second `features:` key below such a line and the legs under
-            # THAT reopen onto the feature above it, which is the name their
-            # rows have to carry (run against the extension 2026-09-12, record
-            # (k) of the probe). `$dropped` is the other half, and it carries
-            # down to the leg lines under an unread branch: their own rows
-            # would be the same defect said twice, and the branch's is the one
-            # with a name on it — as far as the next `features:` key, which
-            # reopens the list onto the feature above and clears it.
-            #
-            # AND THE ROW CARRIES WHICH LINE TO GO AND FIND, as the `noleg`
-            # row does and for the same reason (Copilot's first round on this
-            # PR, suppressed): `$has_features` is whether a `features:` key
-            # has been read in this block at all, so a `- branch:` ABOVE every
-            # one of them — or in a block that has none — is told that the key
-            # which OPENS the list is missing above it, and not that a key at
-            # project indent below it shut a list there is none of.
-            value="$(record_scalar "${line#*:}")"
-            if [ "$in_features" -eq 1 ]; then
-                branch="$value"
-                dropped=0
-                named=1
-                held="$held$(printf 'branch\037%s' "$branch")$NL"
-            else
-                dropped=1
-                unread=1
-                why=feature
-                [ "$has_features" -eq 1 ] || why=nolist
-                held="$held$(printf 'nofeature\037%s\037%s' "$value" "$why")$NL"
-            fi
-            ;;
-        '          - role:'*)
-            # A `- role:` UNDER A SHUT LEG LIST IS NO LEG, for the reason
-            # above and in the loader's own words: `$open` is what says a leg
-            # is open, and it opens only where the loader's `in_legs` does.
-            # The row it gets instead is `noleg`, carrying the branch first
-            # and the role second exactly as a `leg` row does — `read_record`
-            # files both under the last `branch` row, which is the feature the
-            # loader files a leg under. `$named` and `$dropped` together are
-            # "the last `- branch:` line was one the loader READ": an unread
-            # one sets `$dropped` and its own finding already names the block,
-            # so the legs written under it are not said twice, and a `- role:`
-            # before any `- branch:` line at all has no feature to be a leg of
-            # in either reader.
-            role="$(record_scalar "${line#*:}")"; commit=""; pushed=""; depth=""; seen=""
-            open="$in_legs"
-            if [ "$in_legs" -eq 0 ] && [ "$named" -eq 1 ] && [ "$dropped" -eq 0 ]; then
-                unread=1
-                # AND WHICH LIST WAS SHUT IS THE THIRD FIELD, which is
-                # `$leg_why` above and the line the person has to go and find.
-                held="$held$(printf 'noleg\037%s\037%s\037%s' "$branch" "$role" "$leg_why")$NL"
-            fi
-            ;;
-        '            parked_commit:'*) commit="$(record_scalar "${line#*:}")" ;;
-        '            wip_depth:'*) depth="$(record_scalar "${line#*:}")" ;;
-        '            pushed:'*)
-            # The first value to lose its `#` comment here, in #19 — read
-            # whole, `pushed: true # note` was "neither true nor false" here
-            # and `true` to `resume.sh`; `record_scalar` above now does it for
-            # every value this parser reads, for the same reason.
-            pushed="$(record_scalar "${line#*:}")"
-            seen=pushed
-            ;;
-        esac
-    done <"$file"
-    # THE LAST LEG OF THE BLOCK, which no later line closes. Spelled out
-    # rather than shared with the arm above, because the alternative is a
-    # helper reading this function's locals by dynamic scope — five lines
-    # twice against an idiom this file uses nowhere else. AND THE LAST FLUSH
-    # WITH IT: the end of the file is the last chance the block has to be the
-    # matched one, and a `root:` that sits at the very bottom of it is
-    # answered on the line after which there is none.
-    if [ "$named" -eq 1 ] && [ "$open" -eq 1 ]; then
-        held="$held$(printf 'leg\037%s\037%s\037%s\037%s\037%s\037%s' "$branch" "$role" "$commit" "$pushed" "$depth" "$seen")$NL"
-    fi
-    if [ "$matched" -eq 1 ]; then
-        if [ "$has_features" -eq 1 ] || [ "$unread" -eq 1 ]; then
-            printf 'project\037%s\037%s\037%s\037%s\037%s\n' "$parked_at" "$parked_on" "$lane" "$active" "$shape"
-        fi
-        [ -z "$held" ] || printf '%s' "$held"
-    fi
-    return 0
-}
-
-# THIS CHECKOUT'S SHAPE, COMPUTED THE WAY `git-common.sh` COMPUTES IT, because
-# it is what `resume.sh` judges every recorded leg against and the one thing
-# this layer could not say (the feature-level follow-up's own note, 2026-09-11:
-# "a role this root DOES mount that `collect_legs` refuses anyway … Reading
-# that one means computing this root's shape the way `load_repo_shape` does …
-# which is a reading of its own and is recorded in this commit's message, not
-# taken here").
-#
-# THE RULE IS FOUR CONDITIONS AND EVERY ONE OF THEM IS A DECLARATION IN
-# `project.yaml`, read off `load_repo_shape` itself: the file is there, its
-# indent-zero `kind:` is `project-manifest`, its indent-zero `schema:` is
-# `project-repo-schema`, and its `legs:` list declares BOTH a `spec` LEG and a
-# `code` LEG. THE LEG, NOT ITS `path:` — the two are easy to conflate and the
-# difference is real: `_shape_record_leg` stores `"${path:-spec}"` and
-# `"${path:-code}"`, so a `- role: spec` with no `path:` at all still makes
-# `_SHAPE_LEG_SPEC_PATH` non-empty and still declares the leg, and the test
-# `load_repo_shape` then makes is on those two variables being non-empty (the
-# independent review of this branch's base, 2026-09-12, which found the rule
-# written down in this file as "a `spec` and a `code` leg path" — wrong on
-# both counts, and wrong in the direction that matters: it reads as though a
-# leg declared without one were no leg at all).
-# Anything short of the four is `single`: no manifest at all, another `kind:`,
-# no `schema:` line, one leg of the pair missing. A FAMILY HOLDER IS SINGLE
-# TOO, having no `project.yaml` — `load_repo_shape` says so out loud, "using
-# the single-repository layout" — and this suite's own Atlas fixture is single
-# with a `spec` leg mounted: `kind: project-manifest`, no `schema:` line,
-# `assembly` and `spec` legs and no `code` one.
-#
-# THE PARSER IS THAT PARSER, not `legs_of`'s. `legs_of` reads the same file for
-# another question and drops what this one needs — the `assembly` leg and the
-# `.` path — while `load_repo_shape` keys on INDENT: `#` and everything after
-# it comes off every line first, a `legs:` at indent zero opens the list, a
-# `- ` item at any indent sets the item's key column two past its own, keys at
-# that column belong to the item, an indent-zero line closes the list, and the
-# last item is closed by the end of the file. Both readers therefore agree
-# about a manifest with unusual indentation, which is the only kind where they
-# could differ at all.
-ROOT_SHAPE=single
-ROOT_SHAPE_WHY=""
-#: WHAT THE WALK BELOW FOUND, and the reason it is a walk of its own no
-#: longer: `_shape_record_leg`'s two jobs at every leg boundary. The flags are
-#: the two of the four conditions that live in the `legs:` list; the parallel
-#: arrays are every leg's ROLE and the `path:` the manifest gave it, in the
-#: file's order, which is what `leg_repo_for_role` reads back instead of
-#: scanning `project.yaml` a second time (the independent review of this
-#: branch, 2026-09-12: "ONE parser of project.yaml in this file, not two").
-#: Arrays and a linear scan, because bash 3.2 has no associative array and a
-#: manifest declares a handful of legs; globals because the closer is a
-#: function, and reset at the top of every walk because the next root is a
-#: different manifest.
-ROOT_LEG_ROLES=()
-ROOT_LEG_PATHS=()
-_SHAPE_SAW_SPEC=0
-_SHAPE_SAW_CODE=0
-_shape_close_leg() {
-    case "$1" in
-    spec) _SHAPE_SAW_SPEC=1 ;;
-    code) _SHAPE_SAW_CODE=1 ;;
-    esac
-    # A leg item with no `- role:` line is no leg at either end: `collect_legs`
-    # starts none for it, `_shape_record_leg`'s `case` matches nothing, and a
-    # nameless role is not one this reader could be asked about.
-    [ -n "$1" ] || return 0
-    ROOT_LEG_ROLES+=("$1")
-    ROOT_LEG_PATHS+=("$2")
-}
-read_root_shape() {
-    local root="$1" manifest raw content trimmed indent_ws indent key value rest
-    local kind="" schema="" in_legs=0 key_col=-1 cur_role="" cur_path="" missing=""
-    manifest="$root/project.yaml"
-    ROOT_SHAPE=single
-    ROOT_SHAPE_WHY="there is no \`project.yaml\` here"
-    ROOT_LEG_ROLES=()
-    ROOT_LEG_PATHS=()
-    _SHAPE_SAW_SPEC=0
-    _SHAPE_SAW_CODE=0
-    [ -f "$manifest" ] || return 0
-    while IFS= read -r raw || [ -n "$raw" ]; do
-        content="${raw%%#*}"
-        content="${content%$'\r'}"
-        trimmed="${content#"${content%%[![:space:]]*}"}"
-        trimmed="${trimmed%"${trimmed##*[![:space:]]}"}"
-        [ -n "$trimmed" ] || continue
-        indent_ws="${content%%[![:space:]]*}"
-        indent=${#indent_ws}
-        if [ "$in_legs" -eq 1 ]; then
-            case "$trimmed" in
-            '- '* | '-')
-                if [ "$indent" -gt 0 ]; then
-                    _shape_close_leg "$cur_role" "$cur_path"
-                    cur_role=""
-                    cur_path=""
-                    key_col=$((indent + 2))
-                    rest="${trimmed#-}"
-                    rest="${rest#"${rest%%[![:space:]]*}"}"
-                    key="${rest%%:*}"
-                    if [ -n "$rest" ] && [ "$key" != "$rest" ]; then
-                        case "$key" in
-                        role) cur_role="$(trim_unquote "${rest#*:}")" ;;
-                        path) cur_path="$(trim_unquote "${rest#*:}")" ;;
-                        esac
-                    fi
-                    continue
-                fi
-                ;;
-            esac
-            if [ "$indent" -eq 0 ]; then
-                _shape_close_leg "$cur_role" "$cur_path"
-                cur_role=""
-                cur_path=""
-                in_legs=0
-            elif [ "$indent" -eq "$key_col" ]; then
-                key="${trimmed%%:*}"
-                if [ "$key" != "$trimmed" ]; then
-                    case "$key" in
-                    role) cur_role="$(trim_unquote "${trimmed#*:}")" ;;
-                    path) cur_path="$(trim_unquote "${trimmed#*:}")" ;;
-                    esac
-                fi
-                continue
-            else
-                continue
-            fi
-        fi
-        if [ "$indent" -eq 0 ]; then
-            key="${trimmed%%:*}"
-            [ "$key" != "$trimmed" ] || continue
-            value="$(trim_unquote "${trimmed#*:}")"
-            case "$key" in
-            kind) kind="$value" ;;
-            schema) schema="$value" ;;
-            legs) in_legs=1; key_col=-1 ;;
-            esac
-        fi
-    done <"$manifest"
-    _shape_close_leg "$cur_role" "$cur_path"
-    if [ "$kind" = project-manifest ] && [ "$schema" = project-repo-schema ] &&
-        [ "$_SHAPE_SAW_SPEC" -eq 1 ] && [ "$_SHAPE_SAW_CODE" -eq 1 ]; then
-        ROOT_SHAPE=three-leg
-        ROOT_SHAPE_WHY="its \`project.yaml\` declares both a \`spec\` and a \`code\` leg"
-        return 0
-    fi
-    # EVERY CONDITION THAT FAILED, not the first: a person who reads "no
-    # `schema:`" and adds one finds the checkout still single, because this
-    # fixture's manifest has no `code` leg either. `kind:` is its own clause
-    # because a file that is not a project manifest is not a project manifest
-    # with something missing.
-    ROOT_SHAPE=single
-    if [ "$kind" != project-manifest ]; then
-        ROOT_SHAPE_WHY="its \`project.yaml\` is not \`kind: project-manifest\`"
-        return 0
-    fi
-    [ "$schema" = project-repo-schema ] || missing="no \`schema: project-repo-schema\`"
-    [ "$_SHAPE_SAW_SPEC" -eq 1 ] || missing="${missing:+$missing, }no \`spec\` leg"
-    [ "$_SHAPE_SAW_CODE" -eq 1 ] || missing="${missing:+$missing, }no \`code\` leg"
-    case "$missing" in
-    *', '*) missing="${missing%, *} and ${missing##*, }" ;;
-    esac
-    ROOT_SHAPE_WHY="its \`project.yaml\` declares $missing"
-    return 0
-}
-
-# WHETHER `collect_legs` CAN MAP THIS ROLE ONTO THIS CHECKOUT, which is the
-# whole of its `case`: `spec` and `code` only where `REPO_SHAPE` is
-# `three-leg`, `repo` only where it is `single`, and `*) return 1` for every
-# other word — `assembly` included, which is a role the three-leg SHAPE has
-# and `resume` maps in neither shape, because the assembly root's own worktree
-# is the `repo` leg's. A role it cannot map takes the WHOLE feature with it.
-role_maps_here() {
-    case "$1" in
-    spec | code) [ "$ROOT_SHAPE" = three-leg ] ;;
-    repo) [ "$ROOT_SHAPE" = single ] ;;
-    *) return 1 ;;
-    esac
-}
-
-# The two clauses for a role `collect_legs` cannot map: the SHORT one, which
-# the feature's verdict carries onto every sibling leg's line, and the LONG
-# one, which is the culprit leg's own finding and says which shape this
-# checkout is and why. Both name the ROLE, because "shape mismatch" — all
-# `resume` says out loud — names neither the role nor anything else about it.
-role_shape_short() {
-    case "$1" in
-    spec | code | repo)
-        if [ "$ROOT_SHAPE" = single ]; then
-            printf "its \`%s\` leg names a role \`resume\` maps only onto a three-leg checkout, and this one is single" "$1"
-        else
-            printf "its \`%s\` leg names a role \`resume\` maps only onto a single checkout, and this one is three-leg" "$1"
-        fi
-        ;;
-    *) printf "its \`%s\` leg names a role \`resume\` maps onto no checkout of either shape" "$1" ;;
-    esac
-}
-role_shape_long() {
-    case "$1" in
-    spec | code | repo)
-        if [ "$ROOT_SHAPE" = single ]; then
-            printf "\`resume\` maps the role \`%s\` onto a three-leg checkout only, and this one is single (%s)" "$1" "$ROOT_SHAPE_WHY"
-        else
-            printf "\`resume\` maps the role \`%s\` onto a single checkout only, and this one is three-leg (%s)" "$1" "$ROOT_SHAPE_WHY"
-        fi
-        ;;
-    *) printf "\`resume\` maps the role \`%s\` onto no checkout of either shape — it knows \`spec\` and \`code\` in a three-leg project and \`repo\` in a single one — and this one is %s (%s)" "$1" "$ROOT_SHAPE" "$ROOT_SHAPE_WHY" ;;
-    esac
-}
-
-# AND THE EXITS ARE NOT THE SAME FOR THE TWO KINDS OF UNMAPPABLE ROLE, which
-# is what the one tail both arms below carried said (Copilot's first round on
-# #23): "for roles such as `assembly` or `docs`, `role_shape_long` correctly
-# says that `resume` maps the role onto no checkout of either shape, but this
-# common suffix still says the feature can come back in a checkout of the
-# other shape … contradicts the new help/README wording that a role of neither
-# shape has no resumable checkout." THE REMEDIATION IS NOT IMPOSSIBLE, which
-# is the half of that to disagree with: the tail's "that shape" is the
-# WORKSTATION's, named two clauses earlier, and a park from a three-leg
-# workstation writes `spec` and `code` — `park.sh`'s `build_legs` is
-# `LEG_ROLES=("spec" "code")` in a three-leg root and `("repo")` in a single
-# one, and it writes no other word in either — so the re-park does produce a
-# record some checkout resumes, and this suite's own end-to-end run of
-# `resume.sh` on a `code` leg brought the feature back, exit 0. WHAT IS
-# MISSING IS WHAT THE HELP AND THE README ALREADY SAY: "where the role is
-# really another shape's, only a checkout of that shape, and where it is
-# NEITHER shape's, no checkout at all". The tail said the first of those to
-# both kinds, so a person reading `assembly` was left to think some checkout
-# somewhere resumes this record as it stands, and none does: run against the
-# extension on 2026-09-12, `role: assembly` and `role: docs` in a real
-# three-leg root — both legs mounted, the four conditions met — answered
-# "Error: 001-a-thing was parked from a three-leg project and this checkout is
-# three-leg; that feature was NOT recreated", "REFUSED: 001-a-thing — shape
-# mismatch", exit 2, which is the same refusal both words draw in a single
-# root (the commit before this one, the same estates). Refused in BOTH shapes
-# is a record no checkout brings back, so the `*)` exit says that first and
-# then the one thing that changes it.
-role_shape_exits() {
-    case "$1" in
-    spec | code | repo)
-        printf "park that feature again from the workstation that has it (%s), which writes the roles its own shape has; where that shape is not this checkout's, the feature comes back in a checkout of that shape, not here" "$2"
-        ;;
-    *)
-        printf "nor does any other checkout, of either shape, so the one exit is to park that feature again from the workstation that has it (%s), which writes the roles its own shape has — \`park\` writes \`spec\` and \`code\` in a three-leg project and \`repo\` in a single one, and never this word — and the feature comes back in a checkout of that shape, which is this one only where the two agree" "$2"
-        ;;
-    esac
-}
-
-# The repository a leg role lives in: the root for `repo` and `assembly`, else
-# the path `project.yaml` gives that role, else a folder named for the role,
-# else — for a `spec` or a `code` leg the manifest DECLARES — the role's own
-# name, because that is the path the other end computes for it.
-#
-# THE LOADER DEFAULTS THOSE TWO PATHS, AND ANSWERING NOTHING FOR THEM NAMED A
-# REFUSAL THAT IS NOT THE ONE MADE (the independent review of this branch,
-# 2026-09-12). `git-common.sh`'s `_shape_record_leg` is `spec)
-# _SHAPE_LEG_SPEC_PATH="${path:-spec}"` and `code) … "${path:-code}"`, so a
-# `- role: spec` with no `path:` mounts at `spec/` to `load_repo_shape`, and
-# `collect_legs` maps the role onto that path without ever looking at the
-# directory. Answering NOTHING for such a leg sent a genuinely three-leg root
-# whose `spec/` is not checked out to the whole-feature refusal below — while
-# what `resume` does there is refuse the whole ESTATE before it reads a
-# feature at all: "Error: the spec leg 'spec' is not an initialised Git
-# checkout at '…/spec'. / Run 'git submodule update --init' (or 'make
-# bootstrap') in the project root first.", exit 1 — neither the refusal that
-# line claims nor the exits it offers. Answering the default path returns that
-# state to the short line under it — the leg is not mounted here — which is
-# what this layer can prove.
-#
-# AND THE ANSWER IS `read_root_shape`'s WALK, NOT A SECOND SCAN OF THE SAME
-# FILE (the independent review of this branch, 2026-09-12, verbatim: "have
-# read_root_shape also record the two leg paths it walks past, and let
-# leg_repo_for_role consult those — ONE parser of project.yaml in this file,
-# not two"). What stood here read `project.yaml` again, by COLUMN — `'  - role:'*`
-# and `'    path:'*` — which is not how either loader reads it, and the two
-# answers came apart wherever the file was not indented the way this suite
-# indents it. TWO STATES PROVED IT, both of them manifests `load_repo_shape`
-# reads without blinking: a `legs:` list at FOUR spaces (`    - role: spec` /
-# `      path: docs`) matched neither pattern, so this function answered
-# NOTHING for `spec` and for `code` — and a root the shape reader above calls
-# three-leg then had every leg of every recorded feature refused as "a role
-# this root does not mount", a whole-feature refusal `resume` does not make;
-# and a `path:` under a column-0 `# note` inside the item, which the arm that
-# closed an item on `[![:space:]]*` threw away, leaving a declared `path: docs`
-# on the default `spec/` and the leg read against the wrong repository. Both
-# were fixed AT THIS END twice already — Copilot's two rounds on #22 taught
-# these values to lose a `#` the way `load_repo_shape` loses one, and taught
-# the closer that a full-line comment closes nothing — and the walk above had
-# both from the day it was written, because it is `load_repo_shape`'s own
-# parser: `#` and everything after it comes off every line first, an empty
-# line is skipped, a `- ` item at ANY indent opens a leg, and keys two past
-# its own belong to it. So the walk records each leg's role and `path:` as it
-# passes, and this function reads them back.
-#
-# WHERE A ROLE IS DECLARED TWICE THE LAST ONE WINS, which is
-# `_shape_record_leg` again — it assigns, it does not test for empty — and
-# where the last one gives no `path:` the arms below default it exactly as
-# that function's `${path:-spec}` does.
-#
-# AND `path: .` IS A PATH LIKE ANY OTHER — THE ROOT (Copilot's first round on
-# #23): "a declared `spec` or `code` leg with `path: "."` is mapped to the
-# root repository. Status will instead inspect `$root/spec` or `$root/code`
-# (or report it missing), so its worktree/origin findings disagree with
-# `resume`." `_shape_record_leg` stores `"${path:-spec}"`, and `.` is not
-# empty, so `load_repo_shape` keeps it and builds `SPEC_LEG`/`CODE_LEG` as
-# `$root/$SHAPE_*_PATH` — `$root/.`, which `collect_legs` hands straight to
-# `LEG_REPOS`. Run against the extension on 2026-09-12 on a manifest whose
-# `code` leg carries `path: "."`, `path: .` and `path: '.'` in turn:
-# `REPO_SHAPE=three-leg`, `SHAPE_CODE_PATH=.`, `CODE_LEG=<root>/.` in all
-# three, and an EMPTY `path:` the only spelling that falls to the default
-# `code`. End to end on a scratch estate the same day, that manifest and a
-# record parking a `code` leg: `resume.sh` RESUMED it out of the root —
-# "code  worktrees/001-a-thing/.  <sha>  clean", exit 0, the worktree
-# registered in the ROOT's `git worktree list` — while this reader skipped
-# the declared `.`, found no `code/`, answered the default `$root/code` and
-# drew "the record names a leg this root does not mount here", a whole-feature
-# refusal `resume` does not make. So the declared path is taken whatever it
-# says, and `.` is answered as `$root` rather than as `$root/.`: they are one
-# directory, and `$root` is the spelling `estate_repos` uses, which is what
-# `fetched_ok_at` keys the run's fetches by.
-leg_repo_for_role() {
-    local root="$1" want="$2" i=0 path="" declared=0
-    case "$want" in
-    repo | assembly) printf '%s\n' "$root"; return 0 ;;
-    esac
-    while [ "$i" -lt "${#ROOT_LEG_ROLES[@]}" ]; do
-        if [ "${ROOT_LEG_ROLES[$i]}" = "$want" ]; then
-            declared=1
-            path="${ROOT_LEG_PATHS[$i]}"
-        fi
-        i=$((i + 1))
-    done
-    if [ -n "$path" ]; then
-        case "$path" in
-        .) printf '%s\n' "$root" ;;
-        *) printf '%s\n' "$root/$path" ;;
-        esac
-        return 0
-    fi
-    if [ -d "$root/$want" ]; then
-        printf '%s\n' "$root/$want"
-        return 0
-    fi
-    # AND THE DEFAULT IS THE ROLE'S OWN NAME, for the two roles
-    # `_shape_record_leg` defaults a path for and no others: every other word
-    # is one `collect_legs` refuses at its `*) return 1` however this root is
-    # laid out, and inventing a path for it would hide that.
-    case "$want" in
-    spec | code) [ "$declared" -eq 0 ] || { printf '%s\n' "$root/$want"; return 0; } ;;
-    esac
-    return 1
-}
-
-# THE MOUNT `collect_legs` HANGS THE LEG ON UNDER THE FEATURE DIRECTORY, which
-# is a different question from the one above and gives a different answer for
-# one manifest in every hundred. `collect_legs` builds `LEG_TREES` out of
-# `$SHAPE_SPEC_PATH` / `$SHAPE_CODE_PATH` — `_shape_record_leg`'s
-# `"${path:-spec}"` and `"${path:-code}"`, so the DECLARED path wherever the
-# manifest gives one and the role's own name where it does not — and out of
-# NOTHING for a `repo` leg, whose tree is `$WORKTREE_ROOT/$branch` with no
-# mount under it at all.
-#
-# SUBTRACTING THE LEG'S REPOSITORY FROM THE ROOT ANSWERS THE SAME STRING for
-# every path but one, and the exception is the one `path: "."` makes: that leg
-# IS the root repository at both ends, so there is nothing left to subtract,
-# while `collect_legs` still computes `$WORKTREE_ROOT/$branch/.` for it — a
-# string `leg_registered_at` matches nothing against, because git spells no
-# registered path with a trailing `/.`. Verified against the extension on
-# 2026-09-12 on a three-leg estate whose `code` leg carried `path: "."`, the
-# `spec` leg a real submodule: with nothing at that path `resume.sh` RESUMED
-# the feature, "code  worktrees/001-a-thing/.", exit 0; with the feature's own
-# worktree on the recorded branch AT `worktrees/001-a-thing` it REFUSED —
-# "Error: 'worktrees/001-a-thing/.' exists and is not a registered worktree of
-# the code leg", "REFUSED: 001-a-thing — an unrelated path is in the way",
-# exit 2 — so such a leg has no already-recreated state at all, and reading
-# the mount any other way would call that feature present and clean.
-leg_mount_for_role() {
-    local want="$1" i=0 path=""
-    case "$want" in
-    repo | assembly) return 0 ;;
-    esac
-    while [ "$i" -lt "${#ROOT_LEG_ROLES[@]}" ]; do
-        if [ "${ROOT_LEG_ROLES[$i]}" = "$want" ]; then
-            path="${ROOT_LEG_PATHS[$i]}"
-        fi
-        i=$((i + 1))
-    done
-    printf '%s\n' "${path:-$want}"
-}
-
-# `get_config_value`'s scalar, WHICH IS NOT `record_scalar`'s. The record is
-# read the way `workspace_load_project` reads it — a `#` cut wherever it
-# stands — and `.specify/extensions/git/git-config.yml` is read by a different
-# function with a different rule: `git-common.sh`'s `get_config_value` takes
-# everything after the first colon and runs `sed -E 's/[[:space:]]+#.*$//;
-# s/^[[:space:]]+//; s/[[:space:]]+$//; s/^['\''"]//; s/['\''"]$//'` over it.
-# So a `#` is a comment there only where whitespace comes in front of it —
-# `worktree_root: a#b` is the directory `a#b` to the other end — and ONE
-# leading and ONE trailing quote character come off whether or not they pair.
-# Reading it the other way would compute a path `resume` does not.
-config_scalar() {
-    local value="$1"
-    value="${value%$'\r'}"
-    case "$value" in
-    *[[:space:]]'#'*) value="${value%%[[:space:]]'#'*}" ;;
-    esac
-    value="${value#"${value%%[![:space:]]*}"}"
-    value="${value%"${value##*[![:space:]]}"}"
-    case "$value" in '"'* | "'"*) value="${value#?}" ;; esac
-    case "$value" in *'"' | *"'") value="${value%?}" ;; esac
-    printf '%s' "$value"
-}
-
-# `os.path.abspath`'s normalisation, in bash: `.` dropped, `..` popped, empty
-# segments collapsed, and no `readlink` anywhere — which is the point, because
-# `resolve_path_from_repo_root` is `os.path.abspath(os.path.join(REPO_ROOT,
-# raw))` and that function resolves no symlink either. A path normalised any
-# harder than the other end normalises it would not compare equal to the one
-# the other end computes, which is the whole use this has.
-lexical_path() {
-    local rest="$1" part out=""
-    while [ -n "$rest" ]; do
-        part="${rest%%/*}"
-        if [ "$part" = "$rest" ]; then rest=""; else rest="${rest#*/}"; fi
-        case "$part" in
-        '' | .) ;;
-        ..) out="${out%/*}" ;;
-        *) out="$out/$part" ;;
-        esac
-    done
-    printf '%s\n' "${out:-/}"
-}
-
-# WHERE THIS CHECKOUT'S FEATURE WORKTREES BELONG, computed the way `park.sh`
-# and `resume.sh` compute it and out of the same three sources in the same
-# order: `$SPECKIT_GIT_WORKTREE_ROOT` if it carries a value, else a
-# `worktree_root:` in `.specify/extensions/git/git-config.yml` — the LAST one
-# in the file, at any indent, which is `grep … | tail -n 1` — else the
-# default, and THE DEFAULT IS THE SHAPE'S: `worktrees` under the root for a
-# three-leg checkout, `../<root folder>-worktrees` BESIDE it for a single one.
-# An absolute value is taken as it stands, because `resolve_path_from_repo_root`
-# takes it as it stands.
-#
-# IT IS NOT READ OUT OF THE RECORD, although the record carries a
-# `worktree_root:` of its own: `resume.sh` loads that key into
-# `MANIFEST_WORKTREE_ROOT` and never reads it again, computing the path from
-# THIS checkout's config, and `park.sh` records the value it computed the same
-# way. So the record's copy says where the feature lived on the workstation
-# that parked it, and this says where it goes here; where they differ, this is
-# the one both verbs will use.
-record_worktree_root() {
-    local root="$1" file="$1/.specify/extensions/git/git-config.yml" raw line
-    raw="${SPECKIT_GIT_WORKTREE_ROOT:-}"
-    if [ -z "$raw" ] && [ -f "$file" ]; then
-        line="$(grep -E '^[[:space:]]*worktree_root:[[:space:]]*' "$file" 2>/dev/null | tail -n 1 || true)"
-        [ -z "$line" ] || raw="$(config_scalar "${line#*:}")"
-    fi
-    if [ -z "$raw" ]; then
-        if [ "$ROOT_SHAPE" = three-leg ]; then
-            raw="worktrees"
-        else
-            raw="../${root##*/}-worktrees"
-        fi
-    fi
-    # AND AN ABSOLUTE VALUE IS TAKEN AS IT STANDS, which is not an oversight
-    # and was checked again for Copilot's second round on #27, which read it as
-    # one: `resolve_path_from_repo_root` tests `[[ "$raw_path" == /* ]]` FIRST
-    # and `printf`s the string back unchanged — the `os.path.abspath` it runs
-    # is in the `elif`, for a RELATIVE path only. Sourced and run on
-    # 2026-09-13, it answered `/tmp/wt/../real/` for `/tmp/wt/../real/` and
-    # `/tmp/wt/../real` for `/tmp/wt/../real`, normalising neither. Normalising
-    # here would compute a path the other end does not, which is the one thing
-    # `lexical_path`'s own comment forbids.
-    case "$raw" in
-    /*) printf '%s\n' "$raw" ;;
-    *) lexical_path "$root/$raw" ;;
-    esac
-}
-
-# THE PATH `collect_legs` COMPUTES FOR ONE LEG, which is the only path either
-# verb looks at for it: `$WORKTREE_ROOT/$branch` for a `repo` leg, whose tree
-# carries no mount at all, and `$WORKTREE_ROOT/$branch/$SHAPE_SPEC_PATH` (or
-# `…CODE…`) for a mounted one — the mount being `leg_mount_for_role`'s answer
-# and not the leg repository's own name under the root, which is the same
-# string for every manifest but the one that declares `path: "."`.
-leg_tree_path() {
-    local root="$1" role="$2" branch="$3" mount
-    mount="$(leg_mount_for_role "$role")"
-    printf '%s\n' "$RECORD_WORKTREE_ROOT/$branch${mount:+/$mount}"
-}
-
-# A REGISTERED PATH IS A WORKTREE ONLY WHILE ITS OWN `.git` IS THERE. A linked
-# worktree's is a FILE holding `gitdir: <repo>/.git/worktrees/<name>`; the main
-# worktree's is a DIRECTORY; a path with neither is a leftover directory git
-# will not resume into. Git says as much itself for an unlocked registration
-# — `prunable gitdir file points to non-existent location` — but it computes
-# no `prunable` for a LOCKED one (verified against git 2.43: lock a worktree,
-# delete its `.git` file, and the block says only `locked`), and that pair is
-# what this test catches: the directory is there, the worktree is not, and
-# `resume` is blocked by a registration nothing had reported (Copilot on #18).
-worktree_is_usable() {
-    [ -d "$1" ] && [ -e "$1/.git" ]
-}
-
-# The path of the worktree checked out on `<branch>` in `<repo>`, main or
-# linked. FOUR ANSWERS, because the porcelain has four: 0 and the path when a
-# worktree is really there; 2 AND THE PATH when the only block for that
-# branch is a REGISTRATION WITHOUT A WORKTREE; 3 and the path when such a
-# registration is also LOCKED; 1 and nothing when there is no block at all.
-#
-# GIT'S OWN VERDICT FIRST, THEN THE WORKTREE ITSELF. `worktree list
-# --porcelain` keeps the block of a linked worktree that is no longer one
-# until somebody prunes it, and says so with `prunable <reason>` — which it
-# prints whether or not the DIRECTORY is still there: delete only the
-# worktree's `.git` file and the directory stays, the block says "prunable
-# gitdir file points to non-existent location", and a `-d` test alone would
-# call that live and the recorded feature CLEAN (Copilot on #18). So a
-# `prunable` block is stale whatever is on disk, and what decides the rest is
-# `worktree_is_usable` rather than the directory alone — because git computes
-# no `prunable` for a `locked` block, and a locked one can have a directory
-# with no `.git` in it, or no directory at all, with nothing said either way.
-#
-# AND A STALE BLOCK IS NOT "NOTHING HERE" EITHER, which is why it comes back
-# as 2 or 3 rather than as 1: it is the thing that STOPS the exit this layer
-# would otherwise name — see `check_parked_leg`. The two are told apart
-# because THE EXIT IS NOT THE SAME: `worktree prune` clears an unlocked
-# registration — even one whose directory is still on disk, leaving the
-# directory — and SKIPS a locked one (verified against git 2.43: `prune -v`
-# prints nothing for a locked block, `unlock` then `prune` removes it, and
-# `worktree remove` refuses both a locked one, "cannot remove a locked
-# working tree; use 'remove -f -f' to override or unlock first", and one
-# whose `.git` is gone, "validation failed, cannot remove working tree:
-# '…/.git' does not exist"). Naming a prune that cannot clear it would leave
-# `resume` blocked by the very thing the finding said to clear.
-#
-# TWO STALE REGISTRATIONS FOR ONE BRANCH is a state `worktree add --force`
-# makes, and the LOCKED one is the one to name: `prune` takes every unlocked
-# one in the repository with it, so an `unlock` of the locked path plus that
-# prune clears both, while naming the unlocked path alone would leave the
-# locked registration standing and `resume` still blocked.
-#
-# `locked` AND `prunable` COME AFTER `branch` IN THE BLOCK, so every block is
-# read to its blank line before it is judged, and the whole list is read
-# before the answer is chosen: a live worktree on the branch wins over any
-# stale registration for it, and a locked stale registration wins over an
-# unlocked one.
-worktree_on_branch() {
-    local repo="$1" want="$2" line path="" hit=0 prunable=0 locked=0
-    local live="" stale="" stale_locked=""
-    while IFS= read -r line; do
-        case "$line" in
-        "worktree "*) path="${line#worktree }"; hit=0; prunable=0; locked=0 ;;
-        "branch refs/heads/$want") hit=1 ;;
-        locked | "locked "*) locked=1 ;;
-        prunable | "prunable "*) prunable=1 ;;
-        "")
-            if [ "$hit" -eq 1 ]; then
-                if [ "$prunable" -eq 0 ] && worktree_is_usable "$path"; then
-                    [ -n "$live" ] || live="$path"
-                elif [ "$locked" -eq 1 ]; then
-                    [ -n "$stale_locked" ] || stale_locked="$path"
-                else
-                    [ -n "$stale" ] || stale="$path"
-                fi
-            fi
-            hit=0; prunable=0; locked=0; path=""
-            ;;
-        esac
-    done < <(g "$repo" worktree list --porcelain 2>/dev/null; printf '\n')
-    [ -z "$live" ] || { printf '%s\n' "$live"; return 0; }
-    [ -z "$stale_locked" ] || { printf '%s\n' "$stale_locked"; return 3; }
-    [ -z "$stale" ] || { printf '%s\n' "$stale"; return 2; }
-    return 1
-}
-
-# WHAT IS REGISTERED AT ONE PATH, read the way `resume.sh`'s
-# `leg_registered_at` reads it: an EXACT STRING match against the paths
-# `load_git_worktrees` staged, and NOTHING ABOUT THE BRANCH until the path has
-# matched. That order is the whole point — RR4 asks "is a worktree registered
-# AT this path", and `worktree_on_branch` above asks "where is the worktree on
-# this branch", which is a different question with a different answer whenever
-# the two are not the same path.
-#
-# THREE ANSWERS: 0 for a block `resume` WILL see; 2 for one git calls
-# `prunable`, which `_git_worktree_finalize_record` DROPS before that walk
-# ever starts (`if [ "$prunable" = false ]` around its four `+=` lines), so
-# the other end is blind to it whatever is on disk; 1 where there is no block
-# for that path at all. `REGISTERED_BRANCH` is the branch on the block — the
-# empty string for a detached head, exactly as
-# `"${GIT_WORKTREE_BRANCH_REFS[$index]#refs/heads/}"` is — and
-# `REGISTERED_LOCKED` is 1 where git called it `locked`, which changes no
-# verdict and decides an EXIT: `git worktree move` REFUSES a locked worktree
-# ("fatal: cannot move a locked working tree; use 'move -f -f' to override or
-# unlock first") and `worktree prune` SKIPS a locked registration, so the
-# `unlock` goes in front of either (git 2.43, 2026-09-12).
-#
-# GLOBALS AND NOT A PRINTED STRING, because the caller wants all three and a
-# `$(…)` would take the other two down with the subshell; the `while` reads a
-# process substitution, which bash runs in THIS shell.
-REGISTERED_BRANCH=""
-REGISTERED_LOCKED=0
-registered_at() {
-    local repo="$1" want="$2" line path="" hit=0 prunable=0 locked=0 ref=""
-    REGISTERED_BRANCH=""; REGISTERED_LOCKED=0
-    while IFS= read -r line; do
-        case "$line" in
-        "worktree "*)
-            path="${line#worktree }"; prunable=0; locked=0; ref=""; hit=0
-            [ "$path" != "$want" ] || hit=1
-            ;;
-        "branch refs/heads/"*) ref="${line#branch refs/heads/}" ;;
-        locked | "locked "*) locked=1 ;;
-        prunable | "prunable "*) prunable=1 ;;
-        "")
-            if [ "$hit" -eq 1 ]; then
-                REGISTERED_BRANCH="$ref"; REGISTERED_LOCKED="$locked"
-                [ "$prunable" -eq 0 ] || return 2
-                return 0
-            fi
-            hit=0; prunable=0; locked=0; ref=""; path=""
-            ;;
-        esac
-    done < <(g "$repo" worktree list --porcelain 2>/dev/null; printf '\n')
-    return 1
-}
-
-# WHAT IS IN THE WAY AT THE PATH `resume` COMPUTES, and the one exit, which is
-# the PERSON'S. `IN_THE_WAY_WHAT` is what sits there, `IN_THE_WAY_EXIT` is the
-# clause both the culprit leg's own finding and every sibling leg's carry; 1
-# and all three empty where nothing is in the way.
-#
-# THE TWO REFUSALS ARE ONE STATE READ FROM TWO SIDES, and `resume.sh` words
-# them identically down to the `look:` — "'<path>' exists and is not a
-# registered worktree of the <role> leg … Nothing here overwrites a directory
-# it did not create … Move it aside" — differing only in the REFUSED line's
-# reason. RR4's second arm is `leg_registered_at` matching the path and
-# `[ "$LEG_REGISTERED_BRANCH" = "$branch" ]` failing: "an unrelated worktree
-# is in the way". RR3 is the `[ -e "$tree" ]` under it: "an unrelated path is
-# in the way". Both `break` the leg loop, so BOTH TAKE THE WHOLE FEATURE, its
-# other legs included — and both are reached before RR2 reads origin and
-# before RR1 compares any commit.
-#
-# VERIFIED AGAINST THE EXTENSION on 2026-09-12, on scratch single-shape
-# estates — a bare remote in a temp dir, a fake `$HOME`, workBenches' own
-# `resume.sh`, `park.sh`, `git-common.sh` and `workspace-common.sh` — whose
-# record carried `pushed: true`, `worktree_root: worktrees` and a parked
-# commit that was origin's tip, the feature having no worktree here: a plain
-# DIRECTORY at `worktrees/001-a-thing` answered "REFUSED: 001-a-thing — an
-# unrelated path is in the way", exit 2, and a plain FILE answered the same;
-# a worktree of `002-other` registered there answered "REFUSED: 001-a-thing —
-# an unrelated worktree is in the way", exit 2, and so did one with a DETACHED
-# head, one git held LOCKED, and one locked whose `.git` had been deleted. A
-# PRUNABLE block there — same worktree, `.git` deleted, no lock — answered
-# "an unrelated path is in the way" instead, because `resume` never sees the
-# block and what refuses it is the directory. With nothing at that path at
-# all the same estate RESUMED the feature, exit 0.
-#
-# WHAT IS NOT IN THE WAY. A block `resume` SEES at that path on the RECORDED
-# branch is RR4's FIRST arm — the leg is already recreated, which is not a
-# refusal at all — whether or not the worktree is really there, because a
-# LOCKED block git calls no prunable is one `leg_registered_at` matches and
-# reads as already done, and whether or not a worktree of that branch sits
-# somewhere else too. And a PRUNABLE block on the recorded branch is the
-# stale-registration arms' own state, WHERE THOSE ARMS NAME IT: the prune, the
-# unlock in front of it and the leftover directory behind it are already one
-# line there, ending in the `resume` that follows them, and naming the path
-# twice would be two findings about it. `worktree_on_branch` is asked which
-# block it answered with, because it is the one that decides whether that line
-# is printed at all — with a live worktree on the branch somewhere else it
-# answers with THAT, nothing names this path, and the reading below is the
-# only one that does.
-IN_THE_WAY_WHAT=""
-IN_THE_WAY_WHY=""
-IN_THE_WAY_EXIT=""
-path_in_the_way() {
-    local repo="$1" want="$2" branch="$3" role="$4" rc=0 ghost=""
-    IN_THE_WAY_WHAT=""; IN_THE_WAY_WHY=""; IN_THE_WAY_EXIT=""
-    registered_at "$repo" "$want" || rc=$?
-    if [ "$rc" -eq 0 ]; then
-        # RR4's FIRST arm, which is no refusal: the header's "what is not in
-        # the way", and the branch is the only thing asked after the path.
-        [ "$REGISTERED_BRANCH" != "$branch" ] || return 1
-        if [ -n "$REGISTERED_BRANCH" ]; then
-            IN_THE_WAY_WHAT="a worktree on \`$REGISTERED_BRANCH\`"
-        else
-            IN_THE_WAY_WHAT="a worktree with a detached head"
-        fi
-        IN_THE_WAY_WHY="an unrelated worktree is in the way"
-        # A LINKED worktree's `.git` is a FILE and a main one's is a
-        # DIRECTORY, and a mounted leg's own checkout carries a `.git` file
-        # too — the path test answers that one and the directory test answers
-        # a root reached by a spelling git canonicalises differently. Either
-        # way what is registered there is the leg's own checkout, and `git
-        # worktree move` refuses one: "'…' is a main working tree" (git 2.43,
-        # 2026-09-12). Naming it would be naming an exit that does not work.
-        #
-        # AND THE PATH TEST IS MADE PHYSICAL, because `$want` is built on
-        # `$RECORD_WORKTREE_ROOT`, which the commit that answered blocker 1
-        # made physical, while `$repo` is `leg_repo_for_role`'s string on
-        # `$root` — the lexical one (Copilot's first round on #27). Comparing
-        # one with the other is the shape of that blocker, and the directory
-        # test should not be the only thing standing between a person and an
-        # exit git refuses.
-        if [ "$want" = "$(physical_path "$repo")" ] || [ -d "$want/.git" ]; then
-            IN_THE_WAY_EXIT="$want is the $role leg's OWN checkout rather than a worktree of it, and no \`worktree move\` moves a main working tree, so there is nothing here to move aside: while the worktree root this checkout computes puts this feature on top of that checkout, neither verb can do anything with it"
-        elif worktree_is_usable "$want"; then
-            IN_THE_WAY_EXIT="move it aside with \`git -C $(sh_operand "$repo") worktree move $(sh_operand "$want") <a path of your choosing>\`, which is yours to run — a registered worktree moved with \`mv\` leaves git holding the path it was at"
-            [ "$REGISTERED_LOCKED" -eq 0 ] ||
-                IN_THE_WAY_EXIT="git holds that worktree LOCKED and \`worktree move\` refuses a locked one (\"cannot move a locked working tree\"), so the unlock comes first: \`git -C $(sh_operand "$repo") worktree unlock $(sh_operand "$want")\`, then \`git -C $(sh_operand "$repo") worktree move $(sh_operand "$want") <a path of your choosing>\`, both yours to run — a registered worktree moved with \`mv\` leaves git holding the path it was at"
-        else
-            # NOT PRUNABLE AND NOT A WORKTREE IS LOCKED, and only locked: git
-            # computes `prunable` for every other broken registration, and a
-            # prunable one is answered 2 above and never reaches here. `prune`
-            # is what clears this one once the lock is off — the same pair the
-            # stale-registration arms name, for the same reason, and the same
-            # leftover DIRECTORY behind it, because the prune clears the
-            # registration and touches nothing on disk.
-            IN_THE_WAY_EXIT="the worktree it registers is not there and git holds the registration LOCKED, which is why it calls it no \`prunable\` — clear it with \`git -C $(sh_operand "$repo") worktree unlock $(sh_operand "$want")\`, then \`git -C $(sh_operand "$repo") worktree prune\`, which is yours to run"
-            # AND WHAT THE PRUNE LEAVES BEHIND IS A PATH, NOT A DIRECTORY
-            # (Copilot's second round on #27): `git worktree add` refuses the
-            # destination in the same three words whatever is there — "fatal:
-            # '…' already exists", run on 2026-09-13 with a regular FILE at a
-            # pruned registration's path — so a test for `-d` sent a person
-            # to a `resume` that refuses for a file the line never mentioned.
-            ! dest_exists "$want" ||
-                IN_THE_WAY_EXIT="$IN_THE_WAY_EXIT, and move aside whatever the prune leaves behind there, which \`resume\` refuses for existing whatever git holds"
-        fi
-        return 0
-    fi
-    # AND THE STALE-REGISTRATION ARMS' OWN PATH IS THEIRS, where they name it
-    # — the other half of "what is not in the way" above, and the only place
-    # this function asks anything of `worktree_on_branch`.
-    if [ "$rc" -eq 2 ] && [ "$REGISTERED_BRANCH" = "$branch" ]; then
-        ghost="$(worktree_on_branch "$repo" "$branch" || true)"
-        [ "$ghost" != "$want" ] || return 1
-    fi
-    [ -e "$want" ] || return 1
-    if [ -d "$want" ]; then
-        IN_THE_WAY_WHAT="a directory"
-    else
-        IN_THE_WAY_WHAT="a file"
-    fi
-    IN_THE_WAY_WHY="an unrelated path is in the way"
-    # AND THE MOVE IS THE WHOLE EXIT ONLY WHERE GIT HOLDS NOTHING THERE. With
-    # a PRUNABLE registration still on that path the `mv` clears RR3 and the
-    # `git worktree add` at the end of the run dies on the registration
-    # instead — "is a missing but already registered worktree; use 'add -f'
-    # to override, or 'prune' or 'remove' to clear" — whether or not the
-    # directory was moved first (git 2.43, 2026-09-12, both spellings run).
-    # So the prune is named with it, and neither half is optional.
-    IN_THE_WAY_EXIT="move it aside with \`mv $(sh_operand "$want") <a path of your choosing>\`, which is yours to run — nothing here moves or deletes a path it did not create"
-    [ "$rc" -ne 2 ] ||
-        IN_THE_WAY_EXIT="move it aside with \`mv $(sh_operand "$want") <a path of your choosing>\` and clear the stale registration git still holds for that path with \`git -C $(sh_operand "$repo") worktree prune\`, both yours to run — nothing here moves or deletes a path it did not create, and \`git worktree add\` refuses a path it is still registered at (\"a missing but already registered worktree\")"
-    # AND FOR THE ONE PATH NO `mv` TAKES, no command is named at all: see
-    # `dot_mount`. `[ -e "<…>/001-a-thing/." ]` is the feature directory
-    # itself, so this arm is reachable for such a leg, and every operand it
-    # could print was run and did not work.
-    ! dot_mount "$want" ||
-        IN_THE_WAY_EXIT="and there is no command that clears it: this leg is declared \`path: \".\"\` in \`project.yaml\`, so the path \`collect_legs\` computes for it ends in \`/.\`, which \`mv\` refuses as an operand outright — what answers it is a \`collect_legs\` that computes \`<worktree_root>/<branch>\` for a leg declared at the root, which is the standard's and not this command's"
-    # AND A SYMLINKED PATH NEEDS THE SPELLING FIXED AS WELL AS THE PATH
-    # CLEARED (Copilot's sixth round on #27, whose own example — the `elif
-    # worktree_is_usable "$want"` arm above — cannot be reached under such a
-    # root, because `registered_at` is an exact-string match against git's
-    # ALWAYS-PHYSICAL spelling and the two never compare equal: run on
-    # 2026-09-13, git spelled a worktree made through a link `…/real/wt` where
-    # the config's path was `…/link/wt`, so `$rc` is 1 and this tail is the arm
-    # that speaks. The point stands HERE: clearing the path lets `resume` reach
-    # its add, and the worktree it then makes is registered at the resolved
-    # path, which the next run compares against the lexical one and refuses
-    # again. So the spelling is named beside the move, for the same reason
-    # `off_path_exit` names it instead of one.
-    ! has_symlink_component "$(parent_dir "$want")" ||
-        IN_THE_WAY_EXIT="$IN_THE_WAY_EXIT; and clearing it is only half, because the path itself is reached through a symlink — \`resume\` compares the spelling this checkout computes against the ALWAYS-PHYSICAL one git records, and no worktree made under that spelling ever matches: $(symlink_exit "$SYMLINK_COMPONENT")"
-    return 0
-}
-
-# WHAT BLOCKS THE `git worktree add` THAT NO RR LOOKS AT, asked of a leg row
-# for the reason every question in that pass is: the verdict is the FEATURE's,
-# and a sibling leg that says "`resume <Name>` brings it back" beside a line
-# saying the feature is refused is the pair the rule at the top of
-# `check_parked_leg` forbids (Copilot's seventh and eighth rounds on #27:
-# "In a multi-leg record, the culprit line can then say to clear the path and
-# resume while sibling legs still advertise `resume`, even though the run
-# refuses the whole feature"). THREE STATES, all of them read by
-# `check_parked_leg` already and none of them by an RR: a registration git
-# still holds AT the path with nothing on disk, a DANGLING SYMLINK there —
-# both of which `[ -e ]` and therefore RR3 look straight through — and a
-# feature directory that is not a directory, which `resume`'s own `mkdir -p`
-# refuses before it adds any leg. Each was run against git or the extension on
-# 2026-09-13 and each ends the run; what this adds is that every OTHER leg of
-# the feature now knows.
-ADD_BLOCKED_WHAT=""
-ADD_BLOCKED_EXIT=""
-leg_add_blocked() {
-    local root="$1" role="$2" branch="$3" repo want parent held=0
-    local what="" exits=""
-    ADD_BLOCKED_WHAT=""; ADD_BLOCKED_EXIT=""
-    role_maps_here "$role" || return 1
-    repo="$(leg_repo_for_role "$root" "$role" 2>/dev/null || true)"
-    [ -n "$repo" ] || return 1
-    [ -e "$repo/.git" ] || return 1
-    want="$(leg_tree_path "$root" "$role" "$branch")"
-    # A worktree git SEES at that path is RR4's first arm, and a path `[ -e ]`
-    # finds is RR3's: both are read before this and neither is the add's.
-    registered_at "$repo" "$want" || held=$?
-    [ "$held" -ne 0 ] || return 1
-    [ ! -e "$want" ] || return 1
-    parent="$(parent_dir "$want")"
-    # AND THEY ARE NOT EXCLUSIVE, so the verdict is built rather than chosen
-    # (Copilot's ninth round on #27, verbatim: "When `held == 2` and
-    # `[ ! -e "$want" ]`, this branch wins for both a truly absent destination
-    # and a dangling symlink (and can also hide a missing final component
-    # beneath a non-directory parent). `ADD_BLOCKED_EXIT` then contains only
-    # `worktree prune`, but prune does not remove the dangling link or parent
-    # file; in a multi-leg record, siblings carry that incomplete exit and
-    # `resume` still fails"). Right, and it is the same mistake `off_path_exit`
-    # stopped making a round earlier: the prune clears a REGISTRATION and
-    # touches nothing on disk, so where something is also in the way on disk
-    # both steps belong in the one exit a person pastes.
-    if [ "$held" -eq 2 ]; then
-        what="git still holds a worktree registration at the $want it computes for its \`$role\` leg, with nothing on disk there"
-        exits="\`git -C $(sh_operand "$repo") worktree prune\`"
-    fi
-    if [ -L "$want" ]; then
-        what="${what:+$what, and }a dangling symlink is at the $want it computes for its \`$role\` leg, which \`[ -e ]\` looks straight through and \`git worktree add\` refuses all the same"
-        exits="${exits:+$exits, then }\`mv $(sh_operand "$want") <a path of your choosing>\`"
-    fi
-    if [ "$parent" != "$want" ] && dest_exists "$parent" && [ ! -d "$parent" ]; then
-        what="${what:+$what, and }the $parent it makes that leg's worktrees under is not a directory, and \`resume\` runs \`mkdir -p\` on it before it adds any leg"
-        exits="${exits:+$exits, then }\`mv $(sh_operand "$parent") <a path of your choosing>\`"
-    fi
-    [ -n "$what" ] || return 1
-    ADD_BLOCKED_WHAT="$what"
-    ADD_BLOCKED_EXIT="clear it with $exits, which is yours to run"
-    return 0
-}
-
-# THE SAME QUESTION ASKED OF A RECORD ROW, which is how `read_record`'s first
-# pass asks it — one call in a chain of RRs, where the arms around it are one
-# test each. It works the leg's repository and the path `collect_legs` computes
-# out of the ROLE, leaves that path in `LEG_TREE` for the verdict to name, and
-# answers 1 — nothing in the way — for the three states that are not this
-# reading's to judge: a role this checkout's shape has no place for, which
-# `collect_legs` has already refused the feature for on the line above; a leg
-# whose repository is not a checkout here, which `resume` refuses the whole
-# ESTATE for before it reads a feature; and a path with nothing at it.
-LEG_TREE=""
-leg_path_in_the_way() {
-    local root="$1" role="$2" branch="$3" repo
-    LEG_TREE=""
-    role_maps_here "$role" || return 1
-    repo="$(leg_repo_for_role "$root" "$role" 2>/dev/null || true)"
-    [ -n "$repo" ] || return 1
-    [ -e "$repo/.git" ] || return 1
-    LEG_TREE="$(leg_tree_path "$root" "$role" "$branch")"
-    path_in_the_way "$repo" "$LEG_TREE" "$branch" "$role"
-}
-
-# THE GAP A RESUME ITSELF LEAVES. `park` commits the WIP under a fixed subject
-# prefix and records how many such commits sit on the tip (`wip_depth`);
-# `resume` recreates the worktree at the parked commit and SOFT-RESETS exactly
-# those commits away, so a resumed feature's tip is legitimately `<parked>~
-# <wip_depth>` with the work back in the working tree. `resume.sh`'s
-# `wip_gap_is_ours` is what keeps it from refusing that state, and this is
-# the same test: the gap is exactly `wip_depth` commits, every one of them a
-# `wip: park …` commit. Read-only (`log -1 --format=%s`).
-WIP_PREFIX='wip: park '
-wip_gap_is_ours() {
-    local repo="$1" from="$2" to="$3" depth="$4" count subject step=0
-    is_count "$depth" || return 1
-    [ "$depth" -gt 0 ] || return 1
-    count="$(g "$repo" rev-list --count "$from..$to" 2>/dev/null || printf 0)"
-    [ "$count" = "$depth" ] || return 1
-    while [ "$step" -lt "$depth" ]; do
-        subject="$(g "$repo" log -1 --format=%s "$to~$step" 2>/dev/null || true)"
-        case "$subject" in
-        "$WIP_PREFIX"*) ;;
-        *) return 1 ;;
-        esac
-        step=$((step + 1))
-    done
-    return 0
-}
-
-# A WORKTREE ON `<branch>` IN `<repo>`, COUNTED AS `check_parked_leg` COUNTS
-# ONE: `worktree_on_branch`'s rc 0 and no other. Its 2 and 3 are the stale
-# registrations, which are not worktrees at all — `resume` is BLOCKED by one,
-# never satisfied by it — and its 1 is nothing found. Written as a test of its
-# own because the first pass asks the same question a leg row ahead of the
-# arms below, and the two must count the same thing.
-worktree_here() { worktree_on_branch "$1" "$2" >/dev/null; }
-
-# RR2's TWO EXITS, WORDED ONCE, because the verdict they belong to is the
-# FEATURE's and they are said twice: on the culprit leg's own line and on
-# every sibling's. They are not one exit, and neither of them is the re-park
-# every other exception in this layer ends in — a feature that LANDED is a
-# record entry to delete, a branch deleted by mistake is a branch to push
-# again from where it was parked.
-origin_gone_exits() {
-    printf "the exits are to delete its \`- branch: %s\` block from the record where the feature landed, or to push the branch again from %s where it went by mistake" "$1" "${2:-the workstation that parked it}"
-}
-
-# THE FOUR WAYS RR6 REFUSES, WORDED FOR A LEG THAT IS NOT THE CULPRIT, which
-# is why the leg is named: this clause is printed on a SIBLING's line, where
-# "that leg" would have no antecedent. `resume.sh`'s RR6 is `[ "$pushed" !=
-# true ]` and its own three-armed message is the words `check_parked_leg`'s
-# `$unread` carries for the culprit; these are the same four states said about
-# somebody else's leg. `true` never reaches here — the caller tests it first —
-# and the empty value is two states, told apart by the record's own `$seen`
-# the way that function tells them apart.
-pushed_verdict() {
-    case "$2" in
-    false) printf "its \`%s\` leg was parked with --no-push" "$1" ;;
-    '')
-        if [ -z "$3" ]; then
-            printf "the record has no \`pushed:\` for its \`%s\` leg" "$1"
-        else
-            printf "its \`%s\` leg's \`pushed:\` has no value, which is neither true nor false" "$1"
-        fi
-        ;;
-    *) printf "its \`%s\` leg's \`pushed:\` says '%s', which is neither true nor false" "$1" "$2" ;;
-    esac
-}
-
-# WHETHER RR1 WILL REFUSE THIS LEG AS MOVED ON, asked of the record's absent
-# `parked_commit:` alone — the one reading of RR1 this layer already makes,
-# per leg, in the arm below. `resume.sh`'s RR1 is `[ "$remote_tip" !=
-# "$parked_commit" ]` and an absent parked commit never equals a tip, so the
-# leg is refused wherever origin's tip is. The two conditions under it are the
-# two RRs in front of RR1 that this layer can answer: a leg whose repository
-# is not a checkout here is none of RR1's business — `resume` refuses the
-# whole ESTATE for that, before it reads a feature — and a leg with a worktree
-# on the branch here is RR4's, which calls it already recreated. RR2 is not
-# tested here: the caller asks it first, in `resume.sh`'s order.
-#
-# AND `worktree_here` IS A WIDER QUESTION THAN RR4's, WHICH THIS BRANCH IS
-# WHAT SAYS SO: RR4 matches the path `collect_legs` computes and no other, so
-# a worktree on the branch sitting ANYWHERE ELSE leaves RR1 reached and this
-# answer 1 where `resume` refuses. Run on 2026-09-13 against the extension on
-# a scratch three-leg estate, the `spec` leg's `parked_commit:` left out and
-# its worktree at `$HOME/elsewhere/001-a-thing`: "Error: 001-a-thing (spec
-# leg) has moved since it was parked", "REFUSED: 001-a-thing — divergence",
-# exit 2, while the same estate with that worktree AT
-# `worktrees/001-a-thing/spec` RESUMED, exit 0 — RR4's first arm skipping the
-# leg before RR1 is reached. THE READING IS NOT NARROWED HERE, because the
-# state is one the arms below already answer and answer with an exit that
-# WORKS: the off-path arm names that leg's worktree and the `git worktree
-# move` to the computed path, and after that move RR4 skips the leg and the
-# feature resumes — the second half of the run above. Narrowing it would
-# trade a line about THIS workstation for RR1's re-park, which is a park on
-# another one. It is recorded rather than taken, and the line the off-path
-# arm prints hedges for exactly this: "at whichever of its own checks this
-# leg reaches first".
-moved_on_leg() {
-    local root="$1" role="$2" branch="$3" commit="$4" repo
-    [ -z "$commit" ] || return 1
-    repo="$(leg_repo_for_role "$root" "$role" 2>/dev/null || true)"
-    [ -n "$repo" ] || return 1
-    [ -e "$repo/.git" ] || return 1
-    if worktree_here "$repo" "$branch"; then
-        return 1
-    fi
-    return 0
-}
-
-# RR4's FIRST ARM, ASKED OF A LEG ROW: is a worktree REGISTERED AT the path
-# `collect_legs` computes for this leg, on this branch — which is the one state
-# `resume.sh` calls already recreated and `continue`s past, and therefore the
-# one state in which RR2, RR1 and RR5 are never reached for that leg.
-#
-# IT REPLACED `worktree_here`, WHICH IS A WIDER QUESTION (Copilot's third round
-# on #27, verbatim: "The `worktree_here` check above delegates to
-# `worktree_on_branch`, so it returns true for any live worktree on this
-# branch, not just the path RR4 computes. With `--fetch`, an off-path worktree
-# plus a successfully fetched missing `origin/<branch>` should reach RR2 in
-# `resume`, but this return suppresses the first-pass `gone` verdict and can
-# make sibling legs recommend the wrong re-park/move exit"). IT IS REAL: run
-# against the extension on 2026-09-13 on a scratch three-leg estate, one leg,
-# its worktree at `$HOME/elsewhere/001-a-thing` and its branch deleted on
-# origin, `resume.sh` answered "Error: 001-a-thing is no longer on origin in
-# the spec leg; that feature was NOT recreated", "REFUSED: 001-a-thing — gone
-# from origin", exit 2 — RR4 missing on the path and RR2 refusing — while this
-# layer named a `git worktree move`, hiding RR2's two exits behind one that
-# does not bring a lost branch back.
-already_recreated() {
-    local repo="$1" want="$2" branch="$3"
-    registered_at "$repo" "$want" || return 1
-    [ "$REGISTERED_BRANCH" = "$branch" ] || return 1
-    return 0
-}
-
-# WHETHER RR2 WILL REFUSE THIS LEG, asked a leg row ahead of the arms below
-# because the answer is the FEATURE's: `read_record`'s first pass asks it of
-# every leg, and `check_parked_leg` asks the same three things again of the
-# leg it has in front of it, where a repository, a worktree and a stale
-# registration are already in hand. THE THREE ARE `resume.sh`'s OWN ORDER:
-# RR4 comes first and calls a leg whose worktree is already there recreated,
-# so a leg with one is not RR2's; the fetch must have WORKED in that leg's
-# repository this run, because without one a missing `origin/<branch>` has a
-# second and commoner reading; and then the ref itself, which is what RR2
-# reads and refuses the whole feature on. A leg whose repository is not a
-# checkout here is none of RR2's business either — `resume` refuses the whole
-# ESTATE for that, before it reads a feature.
-origin_lost_leg() {
-    local root="$1" role="$2" branch="$3" repo
-    repo="$(leg_repo_for_role "$root" "$role" 2>/dev/null || true)"
-    [ -n "$repo" ] || return 1
-    [ -e "$repo/.git" ] || return 1
-    fetched_ok_at "$repo" || return 1
-    if has_ref "$repo" "refs/remotes/origin/$branch"; then
-        return 1
-    fi
-    if already_recreated "$repo" "$(leg_tree_path "$root" "$role" "$branch")" "$branch"; then
-        return 1
-    fi
-    return 0
-}
-
-# THE EXIT FOR A WORKTREE THAT IS NOT AT THE COMPUTED PATH, worded ONCE
-# because two readings name it: the leg's own line below, and — through
-# `read_record`'s first pass — every sibling leg of the feature it costs.
-#
-# WHAT THE FIRST TEST ANSWERS IS THE SINGLE-SHAPE `repo` LEG, whose repository
-# IS the root: there `worktree_on_branch` can answer with the root's own
-# checkout, and `git worktree move` refuses one — "'…' is a main working tree"
-# (git 2.43, 2026-09-12) — so naming that move would be naming an exit that
-# does not work. It is NOT a mounted leg's own checkout: git 2.43 reports an
-# absorbed submodule's main worktree at `<root>/.git/modules/<leg>` and never
-# at `<root>/<leg>` (verified the same day on a real submodule), so that path
-# is one `worktree_is_usable` calls a stale registration long before this arm
-# is reached. The directory test answers the same root reached by a spelling
-# git canonicalises differently, where the string comparison misses.
-#
-# AND A DEAD REGISTRATION AT THE DESTINATION MAKES THE PRUNE THE FIRST HALF:
-# `git worktree move` refuses a destination git still holds with nothing on
-# disk there, in the same sentence `git worktree add` refuses it — "is a
-# missing but already registered worktree; use 'move -f' to override, or
-# 'prune' or 'remove' to clear" — so the move alone is an exit that was run
-# and did not work.
-off_path_exit() {
-    local repo="$1" role="$2" tree="$3" want="$4" held="$5"
-    local resolved="" unlock="" prune="" clear_link="" clear_parent=""
-    resolved="$(physical_path "$RECORD_WORKTREE_ROOT")"
-    [ "$resolved" != "$RECORD_WORKTREE_ROOT" ] || resolved=""
-    # AND THE SOURCE'S OWN LOCK GOES IN FRONT OF THE MOVE (Copilot's fourth
-    # round on #27, verbatim: "When the off-path worktree itself is locked,
-    # `worktree_on_branch` still returns it as live, but this branch only
-    # checks `held` for the destination and prints `git worktree move <tree>
-    # <want>`. Git refuses moving a locked source, so the recovery command
-    # cannot run"). RUN on 2026-09-13: `git worktree move` with a locked
-    # source answered "fatal: cannot move a locked working tree; use 'move -f
-    # -f' to override or unlock first", and after `git worktree unlock` the
-    # same move exited 0. `$held` is the DESTINATION's registration; this is
-    # the source's, and it is the same pair the in-the-way arm already names.
-    if registered_at "$repo" "$tree" && [ "$REGISTERED_LOCKED" -eq 1 ]; then
-        unlock="git -C $(sh_operand "$repo") worktree unlock $(sh_operand "$tree") && "
-    fi
-    # AND EVERY STEP THE DESTINATION WANTS IS IN THE COMMAND, not in the prose
-    # beside it (Copilot's fifth round on #27, verbatim: "In the `held == 2`
-    # recovery, the required destination prune appears only in the prose; the
-    # copy-pastable command is `${unlock}mkdir -p ... && git worktree move ...`
-    # and never runs `git worktree prune`. With a live off-path source and a
-    # stale destination registration, the advertised command therefore still
-    # fails at `worktree move`"). It is right, and it is this file's own rule:
-    # an exit a person can run is one they can paste. The prune clears the
-    # registration git holds at the destination; the `mv` clears a DANGLING
-    # SYMLINK left there, which `[ -e ]` looks through and `git worktree add`
-    # refuses all the same (the round before this, run 2026-09-13) — so both
-    # go in front of the `mkdir -p`, in the order the destination needs them.
-    [ "$held" -ne 2 ] ||
-        prune="git -C $(sh_operand "$repo") worktree prune && "
-    if [ ! -e "$want" ] && [ -L "$want" ]; then
-        # AND IT NAMES NO DESTINATION OF ITS OWN (Copilot's sixth round on
-        # #27: "The dangling-link cleanup hard-codes `$want.aside` as the `mv`
-        # destination. If that path already exists as a regular file, the
-        # copy-paste command overwrites it, contradicting the surrounding
-        # guarantee that status never asks the user to overwrite an unrelated
-        # path"). Right, and every other `mv` this file prints has said
-        # `<a path of your choosing>` since the commit that first named one.
-        clear_link="mv $(sh_operand "$want") <a path of your choosing> && "
-    fi
-    # AND THE PARENT THE `mkdir -p` MUST MAKE (Copilot's seventh round on #27:
-    # "When an off-path worktree exists but the computed destination's
-    # feature-directory parent is a regular file, this branch emits `mkdir -p
-    # <parent> && git worktree move ...`. `resume` cannot create that parent,
-    # so `mkdir` exits with "Not a directory" and the move never runs"). RUN on
-    # 2026-09-13: `mkdir -p <file>/spec` answers "mkdir: cannot create
-    # directory '…': Not a directory". So the parent is moved aside first, in
-    # the same sequence, for the same reason the link above it is.
-    if [ "$want" != "$(parent_dir "$want")" ] &&
-        dest_exists "$(parent_dir "$want")" &&
-        [ ! -d "$(parent_dir "$want")" ]; then
-        clear_parent="mv $(sh_operand "$(parent_dir "$want")") <a path of your choosing> && "
-    fi
-    # THE PATH TEST IS MADE PHYSICAL for the reason `path_in_the_way`'s twin
-    # is: `$tree` is `git worktree list`'s, which is always physical, and
-    # `$repo` is `leg_repo_for_role`'s string on `$root`, which is not.
-    if [ "$tree" = "$(physical_path "$repo")" ] || [ -d "$tree/.git" ]; then
-        printf '%s\n' "$tree is the $role leg's OWN checkout rather than a worktree of it, and no \`worktree move\` moves a main working tree, so there is nothing here to move: neither verb sees this feature while that checkout is on that branch"
-    elif dot_mount "$want"; then
-        printf '%s\n' "there is no command that puts it where \`resume\` looks: this leg is declared \`path: \".\"\` in \`project.yaml\`, so the path \`collect_legs\` computes for it ends in \`/.\` — \`mv\` refuses such an operand outright and \`git worktree move\` lands the worktree INSIDE it — and \`resume\` matches that string against no worktree git can spell, so it refuses this feature after every run, including one of its own. What answers it is a \`collect_legs\` that computes \`<worktree_root>/<branch>\` for a leg declared at the root, which is the standard's and not this command's"
-    # AND THE SYMLINKED ROOT COMES BEFORE EVERY ONE OF THEM (Copilot's fifth
-    # round on #27: "The symlink-root safeguard is bypassed when the
-    # destination also has a prunable registration: `held == 2` selects this
-    # branch before `has_symlink_component`. It then recommends pruning and
-    # moving the off-path worktree to the lexical symlink path; Git can
-    # complete that move but records the physical target, so `resume` still
-    # cannot match the lexical path and refuses again"). Right: no sequence
-    # ending in a move to that path works, whatever is cleared out of the way
-    # first, so the spelling is the only exit and it is named before any of
-    # them. `dot_mount` and the leg's own checkout stay above it, because
-    # neither is a path a spelling would fix.
-    # AND OF THE WHOLE COMPUTED PATH, not the root alone (Copilot's sixth
-    # round on #27: "If an existing `$WORKTREE_ROOT/$branch` (or a parent from
-    # a declared mount) is a symlink while the final `$want` is absent, this
-    # branch advertises `mkdir -p ... && git worktree move ...`; both commands
-    # follow the link and Git records the physical target, while `resume`
-    # later compares the lexical `$want` and still refuses at RR3"). Right,
-    # and it is the same fault one level down: `has_symlink_component` walks
-    # every prefix, so asking it of the destination's PARENT asks it of the
-    # root and of every directory between the root and the mount. The final
-    # component is deliberately left out — a link THERE is the leftover the
-    # `mv` above clears, not a spelling the person has to correct.
-    elif has_symlink_component "$(parent_dir "$want")"; then
-        # AND NO MOVE WHERE THE WORKTREE ROOT ITSELF IS A LINK, because the
-        # move succeeds and changes nothing (Copilot's third round on #27,
-        # verbatim: "`off_path_exit` still advertises this move when
-        # `worktree_root` is a symlink. `record_worktree_root` deliberately
-        # preserves that lexical spelling, while Git reports the physical
-        # worktree path; moving an off-path worktree to this `want` therefore
-        # leaves `registered_at` unable to match it, so the next `resume` still
-        # refuses at RR3"). RUN, end to end, on 2026-09-13: the move exited 0,
-        # git then held the worktree at the PHYSICAL `…/real-wt/001-a-thing/
-        # spec`, and `resume.sh` answered "Error: '…/wtlink/001-a-thing/spec'
-        # exists and is not a registered worktree of the spec leg", "REFUSED:
-        # 001-a-thing — an unrelated path is in the way", exit 2. THE EXIT
-        # THAT DOES WORK is the spelling: the same estate with `worktree_root`
-        # set to the path git spells RESUMED the feature, exit 0, on the same
-        # run — so that is what this names, and it is the person's to write.
-        printf '%s\n' "no \`worktree move\` fixes this one, because the path it would land in is reached through a symlink: both verbs compute $want and git registers whatever is made there under the path that link resolves to, so \`resume\` matches nothing however the worktree is moved — $(symlink_exit "$SYMLINK_COMPONENT"), and the \`git worktree move\` this line would otherwise name becomes one that works"
-    else
-        printf '%s\n' "move it where both look: \`${unlock}${prune}${clear_link}${clear_parent}mkdir -p $(sh_operand "$(parent_dir "$want")") && git -C $(sh_operand "$repo") worktree move $(sh_operand "$tree") $(sh_operand "$want")\`, which is yours to run — \`worktree move\` creates no parent directory of its own${unlock:+, and it refuses a LOCKED source until the unlock in front of it}${prune:+, and it refuses a destination git still holds registered (\"a missing but already registered worktree\") until the prune}${clear_link:+, and \`git worktree add\` refuses the dangling symlink at that path (\"already exists\") whatever \`[ -e ]\` says of it}${clear_parent:+, and the \`mkdir -p\` cannot make a parent that is not a directory (\"Not a directory\"), which is why that one is moved first}"
-    fi
-}
-
-# One recorded leg against disk: the four states above, read in the leg's own
-# repository. `$9` is `record_rows`'s sixth field — the word `pushed` where
-# the record carried that key for this leg, empty where it did not — and it
-# is the only thing that tells an ABSENT `pushed:` from a bare one, since
-# both leave `$pushed` empty.
-check_parked_leg() {
-    local root="$1" branch="$2" role="$3" commit="$4" pushed="$5" parked_at="$6" parked_on="$7" depth="$8" seen="$9"
-    # `${10}` and not a tenth name in the line above, because that line is
-    # already the widest in this file; `:-` because `set -u` is on and the
-    # verdict is the one argument a caller may leave off. `${11}` says WHICH
-    # refusal that verdict is — empty for the ones `collect_legs` makes
-    # before any RR runs, `pushed`, `inway`, `gone` or `moved` for the RR that
-    # refuses first in the record's order, and `add` for the `git worktree
-    # add` the other end makes last of all — because they differ in both
-    # directions: RR2's exits are its own, and the leg RR2 refuses for still
-    # says so in RR2's words, where a leg `collect_legs` throws out has said
-    # everything it has to say on the line above this one.
-    #
-    # AND `${12}` IS AN EXIT THE CALLER ALREADY HAS, for the one verdict this
-    # function cannot word for itself. Every `collect_legs` verdict is settled
-    # by a park that parks the feature THROUGH, RR6's and RR1's by the same
-    # park, and RR2's by one of its own two, all of which this function can
-    # say from the leg in front of it; a verdict about a PATH IN THE WAY turns
-    # on what git holds AT that path in ANOTHER leg's repository, which the
-    # first pass has already looked at and this function has not — a park
-    # somewhere else moves none of it, so the leg that costs the feature and
-    # every sibling leg carry the same exit, and it is the one that works.
-    # AND `${13}` AND `${14}` ARE WHICH LEG THIS IS AND WHICH LEG THE VERDICT
-    # BELONGS TO, both ordinals within the feature, because the two arms below
-    # that read a PATH may only speak for the leg `resume` stopped at
-    # (Copilot's first round on #27, verbatim: "If a later leg also has an
-    # obstruction, its own refusal/exit is reported even though `resume` stops
-    # at the earlier leg and the first-pass verdict is meant to be carried to
-    # all siblings. Track the refusing leg and only run these path checks for
-    # that leg"). IT IS REAL: run against the extension on 2026-09-13 on a
-    # scratch three-leg estate with a stray DIRECTORY at the `spec` leg's
-    # computed path and a worktree of another branch at the `code` leg's,
-    # `resume.sh` answered "Error: 'worktrees/001-a-thing/spec' exists and is
-    # not a registered worktree of the spec leg", "REFUSED: 001-a-thing — an
-    # unrelated path is in the way", exit 2, ONCE — while this layer drew both
-    # legs' lines, the second quoting a REFUSED reason that run never printed.
-    local refused="${10:-}" refused_kind="${11:-}" refused_exit="${12:-}"
-    local leg_no="${13:-}" refused_leg="${14:-}"
-    # WHETHER THE LEG IN FRONT OF THIS FUNCTION IS THE ONE THE RUN STOPPED AT.
-    # True where there is no verdict at all — then no leg refuses and each
-    # speaks for itself — and where the verdict's ordinal is this leg's. It
-    # SUBSUMES the RR6 carve-out the rebase needed: a leg whose own `pushed:`
-    # is not `true` IS the leg RR6 stops at, so its own line still stands
-    # beside the `pushed:` arms, and a later leg's does not.
-    local mine=0
-    { [ -n "$refused" ] && [ "$refused_leg" != "$leg_no" ]; } || mine=1
-    local repo tree="" ghost="" ghost_is="" clear="" out rc=0 tip n unread="" refuses="" where=""
-    local gone_exits="" gone_caveat="" shape_line="" shape_says="" settles="" exits=""
-    local want="" move="" held=0 ghost_moved=0
-    # A LEG THE RECORD GIVES NO ROLE IS ANSWERED BEFORE THE ROOT IS ASKED
-    # ABOUT IT, and it is not the arm below (the independent review of #20,
-    # 2026-09-11, note 8, recorded there as out of scope). `record_rows` used
-    # to drop such a leg — `[ -n "$role" ]` at both emit sites — so this layer
-    # said NOTHING about it, and the other end refuses the whole feature for
-    # it: `resume.sh`'s `collect_legs` maps every leg's role onto this
-    # checkout, `spec`, `code` and `repo` being all it knows, and its `*)
-    # return 1` takes the FEATURE with it — every other leg of that feature
-    # included, verified the same day against a record whose good `repo` leg
-    # sat beside an empty-role one. The words it refuses in are about the
-    # SHAPE, which is not what is wrong: "Error: 001-a-thing was parked from a
-    # single project and this checkout is single; that feature was NOT
-    # recreated", a sentence that contradicts itself, and this line is what
-    # explains it in advance.
-    #
-    # IT IS ANSWERED FIRST BECAUSE `leg_repo_for_role` WOULD ANSWER IT WRONG:
-    # asked for the empty role it falls past the `repo | assembly` case and
-    # past every `project.yaml` role, to `[ -d "$root/$want" ]` — which for an
-    # empty `$want` is `[ -d "$root/" ]`, always true — and hands back the
-    # ROOT. The leg would then be read as if the record had named the `repo`
-    # leg, which is a claim about a leg the record does not name. And it is
-    # not the "does not mount here" arm either: those words say this root has
-    # no such leg, which is a true thing to say about `role: nope` and a
-    # misleading thing to say about a record that names no role at all — the
-    # fix is not to mount anything, and the refusal is of the whole feature.
-    #
-    # THE EXIT IS A PARK THAT PARKS IT, as it is for the states above, and for
-    # the same reason at the same end: `emit_recorded_feature` carries a
-    # REFUSED feature's legs forward out of the loaded manifest, and `role` is
-    # the ONE leg key `workspace_write_manifest` does not drop when its value
-    # is empty (`if value == "" and out_key != "role": continue`), so a park
-    # that refuses this feature writes the leg back as `- role: ""` — which
-    # both readers unquote to the empty string again. Only a park that parks
-    # the feature THROUGH writes the roles this checkout's own shape has.
-    if [ -z "$role" ]; then
-        where="the record does not say where"
-        [ -z "$parked_on" ] || where="the record says $parked_on"
-        finding "parked feature $branch: a leg of it in the record has no role; \`resume\` maps each leg's role onto this checkout and refuses the WHOLE feature — the other legs with it — where one does not map, reporting it as a shape mismatch, so nothing here brings it back — park that feature again from the workstation that has it ($where), which writes the roles this checkout's own shape has"
-        return 0
-    fi
-    # AND A ROLE THIS CHECKOUT'S SHAPE DOES NOT HAVE COSTS THE WHOLE FEATURE
-    # TOO, WHICH THE LINE BELOW LEFT OUT ALONG WITH THE EXIT (the independent
-    # review of #21, 2026-09-11, recorded there as nobody's ruling). "The
-    # record names a leg this root does not mount here" is true and stops
-    # there, and it reads as ONE leg going unread — while `resume.sh`'s
-    # `collect_legs` maps EVERY leg's role onto this checkout (`spec` and
-    # `code` only where `REPO_SHAPE` is three-leg, `repo` only where it is
-    # single, `*) return 1` for every other word) and one that does not map
-    # takes the feature with it, its good legs included. Run on 2026-09-11
-    # against a scratch single-shape estate, `role: nope` answered "Error:
-    # 001-a-thing was parked from a single project and this checkout is
-    # single; that feature was NOT recreated", "REFUSED: 001-a-thing — shape
-    # mismatch", exit 2 — the same sentence about the SHAPE that says nothing
-    # about the role, and the same answer with a good `repo` leg beside it.
-    # That is the refusal the empty-role arm above explains in advance, so
-    # this arm explains it in the same words and the same order.
-    #
-    # WHICH ROLES ARE CERTAINLY REFUSED, AND WHICH ARE ONLY UNMOUNTED. The
-    # arm below fired on two different states and now says the refusal for
-    # only one of them, because only one of them is one `collect_legs`
-    # certainly refuses. `leg_repo_for_role` answers the root for `repo` and
-    # `assembly`, else the path `project.yaml` gives the role, else a folder
-    # named for it, else the role's own name where the manifest declares a
-    # `spec` or a `code` leg and gives it no `path:` — the default
-    # `_shape_record_leg` gives it — else NOTHING, and nothing is the state
-    # that proves it: `git-common.sh`'s `load_repo_shape` calls a checkout
-    # `three-leg` only where `project.yaml` says `kind: project-manifest`
-    # AND `schema: project-repo-schema` AND declares BOTH a `spec` and a
-    # `code` LEG — the leg, not its `path:`, which `_shape_record_leg`
-    # defaults to the role's own name. So a role this root has no repository
-    # for is a role `collect_legs` cannot map: a `spec` or a `code` this
-    # manifest declares no leg for, which is a manifest that cannot be
-    # three-leg, or any other word at its `*) return 1` — whether it is a
-    # misspelling (`nope`) or another shape's role (`code` here, `spec` in
-    # the family fixture's members, which declare an `assembly` leg and no
-    # other). Both were verified on 2026-09-11 against a scratch
-    # single-shape estate: "shape mismatch", exit 2, the whole feature.
-    #
-    # THE OTHER STATE IS A LEG THIS ROOT MOUNTS THAT IS NOT A CHECKOUT — a
-    # submodule that was never fetched, which is a directory with no `.git`
-    # in it, the state `git-common.sh`'s own `shape_leg_is_checkout` guards,
-    # and, since `leg_repo_for_role` learned the loader's default, a `spec`
-    # or a `code` this manifest declares whose path is not on disk at all.
-    # `collect_legs` maps that role by NAME onto paths `load_repo_shape`
-    # computed from `project.yaml`, and never looks at the directory, so in a
-    # genuinely three-leg root it maps `spec` and moves on and the feature is
-    # NOT refused for the shape. Claiming the refusal there would be this
-    # layer inventing a `resume.sh` line, so those words keep the sentence
-    # they had: what is true of that state is that the leg is not mounted
-    # here, and it is `make bootstrap`'s to mount.
-    #
-    # THE EXIT IS WORDED FOR BOTH KINDS OF UNMAPPABLE ROLE: a park from the
-    # workstation that has the feature writes the roles ITS shape has, which
-    # is what settles a misspelling; where the role really is another
-    # shape's, the record is right and this checkout is not where that
-    # feature comes back, so the line says so rather than promising that a
-    # re-park will make this root mount it. It is `role_shape_exits` that
-    # words it, because a role of NEITHER shape needs the other half of what
-    # the help and the README say and this arm reaches those words too — a
-    # `spec` or a `code` this manifest declares no leg for is another shape's
-    # role, and any other word that matches no directory here is neither's.
-    #
-    # WHAT THIS ARM DOES NOT SEE, and what is therefore still unsaid: a role
-    # this root DOES mount that `collect_legs` refuses anyway — `assembly`,
-    # `repo` in a root `load_repo_shape` calls three-leg (one project checked
-    # out at two shapes, the commonest mismatch there is), `spec` in a root
-    # whose `project.yaml` declares no `code` leg, or any other word that
-    # matches a directory under the root — for which `leg_repo_for_role`
-    # hands back a repository, so the leg is read against disk and nothing
-    # here mentions the refusal (`role: assembly` in that same scratch
-    # estate: "shape mismatch", exit 2, the same day). Reading that one
-    # means computing this root's shape the way `load_repo_shape` does and
-    # holding the record's `shape:` against it, which is a reading of its
-    # own and is recorded in this commit's message, not taken here.
-    repo="$(leg_repo_for_role "$root" "$role" || true)"
-    if [ -z "$repo" ]; then
-        where="the record does not say where"
-        [ -z "$parked_on" ] || where="the record says $parked_on"
-        finding "parked feature $branch ($role leg): the record names a leg this root does not mount here; \`resume\` maps each leg's role onto this checkout and refuses the WHOLE feature — the other legs with it — where one does not map, reporting it as a shape mismatch, so nothing here brings it back — $(role_shape_exits "$role" "$where")"
-        return 0
-    fi
-    # AND A ROLE THIS ROOT MOUNTS THAT `collect_legs` REFUSES ANYWAY IS THE
-    # STATE THE ARM ABOVE CANNOT SEE, which is what that arm's own note
-    # recorded and left (the feature-level follow-up, 2026-09-11): "a role
-    # this root DOES mount that `collect_legs` refuses anyway — `assembly`,
-    # or `spec` in a root whose `project.yaml` declares no `code` leg, which
-    # `load_repo_shape` therefore calls `single` — for which
-    # `leg_repo_for_role` hands back a repository, so the leg is read against
-    # disk and nothing here mentions the refusal". `read_root_shape` computes
-    # the shape `collect_legs` maps against, so the question can be asked now,
-    # and it is asked of EVERY leg: `spec` and `code` map only onto a
-    # three-leg checkout, `repo` only onto a single one, and every other word
-    # maps onto neither — `assembly`, a role the three-leg shape HAS, and any
-    # word that merely matches a directory under the root, which
-    # `leg_repo_for_role`'s last case answers by folder name. Run against the
-    # extension on 2026-09-12, on scratch estates shaped like this suite's own
-    # fixtures: `role: assembly` and `role: spec` in a single root that mounts
-    # an `assembly` leg at `.` and a `spec` leg at `spec/` both answered
-    # "Error: 001-a-thing was parked from a three-leg project and this
-    # checkout is single; that feature was NOT recreated", "REFUSED:
-    # 001-a-thing — shape mismatch", exit 2; `role: repo` in a real three-leg
-    # root — `kind: project-manifest`, `schema: project-repo-schema`, both
-    # legs mounted — answered the same with "and this checkout is three-leg",
-    # which is ONE PROJECT CHECKED OUT AT TWO SHAPES and the commonest way
-    # into this state; and `role: spec` in that root RESUMED.
-    #
-    # WHAT IS WORTH SAYING ABOUT A SHAPE MISMATCH IS THE SHAPE, which is
-    # exactly what `resume` does not say: its sentence names the record's
-    # `shape:` and this checkout's and stops — no role, and where the record
-    # agrees it contradicts itself, "parked from a single project and this
-    # checkout is single". So this line names the ROLE, the shape this
-    # checkout is AND WHY it is that shape in `load_repo_shape`'s own terms,
-    # and then the refusal and the exits the two arms above already word. THE
-    # RECORD'S OWN `shape:` IS HELD AGAINST IT AND NOT JUDGED: a record that
-    # calls the project three-leg where this checkout is single is either a
-    # record from a workstation whose checkout is the three-leg one, or a
-    # record written before this project's shape changed, and nothing in
-    # either file says which — so the disagreement is named and the exit is
-    # the one that is right under both readings.
-    #
-    # IT IS SAID BEFORE THE MOUNT ARM BELOW, which is the same disk read more
-    # narrowly. A leg this root mounts that is NOT A CHECKOUT wants `make
-    # bootstrap` — true, and beside the point where `collect_legs` refuses the
-    # whole feature whatever that directory holds, because it maps roles by
-    # NAME onto paths `load_repo_shape` computed and never looks at them.
-    # Where the shape DOES map the role that arm keeps its sentence, and its
-    # silence about any refusal, untouched: in a genuinely three-leg root an
-    # unfetched `spec/` is not a shape mismatch at all — `resume.sh` refuses
-    # the whole ESTATE before it reads a feature, "the spec leg 'spec' is not
-    # an initialised Git checkout … Run 'git submodule update --init' (or
-    # 'make bootstrap')", exit 1 — which is that arm's own advice and none of
-    # this arm's business.
-    if ! role_maps_here "$role"; then
-        where="the record does not say where"
-        [ -z "$parked_on" ] || where="the record says $parked_on"
-        if [ -n "$RECORD_SHAPE" ] && [ "$RECORD_SHAPE" != "$ROOT_SHAPE" ]; then
-            shape_says="; the record calls the project $RECORD_SHAPE where this checkout is $ROOT_SHAPE, which is the disagreement \`resume\` reports and not one this layer can settle"
-        fi
-        # AND THE DISAGREEMENT CLAUSE GOES LAST, BECAUSE THE EXIT'S FIRST
-        # WORD LEANS ON THE CLAUSE BEFORE IT (the independent verification of
-        # this branch, 2026-09-12). `role_shape_exits`'s `*)` arm opens "nor
-        # does any other checkout, of either shape", which answers "nothing
-        # here brings it back" — and with the disagreement spliced between the
-        # two the line read "… not one this layer can settle — nor does any
-        # other checkout", where the "nor" has nothing left to deny. Both
-        # halves are true in either order, and only one of them is an
-        # antecedent, so the antecedent keeps its place: the shape the record
-        # names and the shape this checkout is follow "which is this one only
-        # where the two agree", which is the clause they are about.
-        shape_line="parked feature $branch ($role leg): $(role_shape_long "$role"), so it refuses the WHOLE feature — the other legs with it — reporting it as a shape mismatch, and nothing here brings it back — $(role_shape_exits "$role" "$where")$shape_says"
-        # SAID HERE FOR A LEG THAT IS NOT A CHECKOUT, because the arm below
-        # would say the smaller thing instead and there is nothing left to
-        # read in a directory with no `.git` in it; said after the worktree
-        # probe for every other leg, where what is left to read decides what
-        # follows it.
-        if [ ! -e "$repo/.git" ]; then
-            finding "$shape_line"
-            return 0
-        fi
-    fi
-    if [ ! -e "$repo/.git" ]; then
-        finding "parked feature $branch ($role leg): the record names a leg this root does not mount here"
-        return 0
-    fi
-    out="$(worktree_on_branch "$repo" "$branch")" || rc=$?
-    case "$rc" in
-    0) tree="$out" ;;
-    2)
-        ghost="$out"
-        ghost_is="a stale worktree registration for it is still recorded at $ghost"
-        clear="\`git -C $(sh_operand "$repo") worktree prune\`"
-        ;;
-    3)
-        ghost="$out"
-        ghost_is="a stale worktree registration for it is still recorded at $ghost and LOCKED, which \`worktree prune\` skips"
-        clear="\`git -C $(sh_operand "$repo") worktree unlock $(sh_operand "$ghost")\`, then \`git -C $(sh_operand "$repo") worktree prune\`"
-        ;;
-    esac
-    # AND A REGISTRATION AT THE COMPUTED PATH IS THE SAME STATE READ FROM THE
-    # PATH'S SIDE, which the arms above cannot see: they ask
-    # `worktree_on_branch`, which looks for the RECORDED BRANCH and never at
-    # the path. A PRUNABLE block at that path for ANOTHER branch with nothing
-    # on disk is missed by RR4 — `load_git_worktrees` drops a prunable block —
-    # and by RR3, whose `[ -e "$tree" ]` finds nothing, so `resume` runs every
-    # check it has and dies on the LAST thing it does: "fatal: '…' is a
-    # missing but already registered worktree; use 'add -f' to override, or
-    # 'prune' or 'remove' to clear", "REFUSED: 001-a-thing — git worktree add
-    # failed", exit 2 (run against the extension on 2026-09-12, on the same
-    # scratch estates). Its REFUSED line is neither RR3's nor RR4's, and what
-    # settles it is the prune the arms above already name — so it is said in
-    # their words, on their line, and the `resume` after it is the one that
-    # works once the path is clear.
-    if [ -z "$ghost" ] && [ -z "$tree" ] && role_maps_here "$role"; then
-        want="$(leg_tree_path "$root" "$role" "$branch")"
-        held=0
-        registered_at "$repo" "$want" || held=$?
-        if [ "$held" -eq 2 ] && [ ! -e "$want" ]; then
-            ghost="$want"
-            if [ -n "$REGISTERED_BRANCH" ]; then
-                ghost_is="a stale worktree registration for \`$REGISTERED_BRANCH\` is still recorded at the $ghost \`resume\` computes for this leg, with nothing on disk there"
-            else
-                ghost_is="a stale worktree registration with a detached head is still recorded at the $ghost \`resume\` computes for this leg, with nothing on disk there"
-            fi
-            clear="\`git -C $(sh_operand "$repo") worktree prune\`"
-        # AND A DANGLING SYMLINK IS THE SAME REFUSAL WITH NOTHING REGISTERED
-        # AT ALL (Copilot's fourth round on #27). `[ -e ]` follows the link and
-        # finds nothing, so RR3 passes at BOTH ends — `resume.sh`'s RR3 is the
-        # same `[ -e "$tree" ]` — and the run dies on the last thing it does:
-        # `git worktree add` answered "fatal: '…' already exists" for exactly
-        # this path on 2026-09-13. It is neither RR3's nor RR4's, its REFUSED
-        # line is the add's, and what settles it is not a prune but the `mv`
-        # every other leftover at that path wants, because nothing is
-        # registered there to clear.
-        elif [ "$held" -ne 0 ] && [ ! -e "$want" ] && [ -L "$want" ]; then
-            ghost="$want"
-            ghost_is="a dangling symlink is at the $ghost \`resume\` computes for this leg, which \`[ -e ]\` looks straight through and \`git worktree add\` refuses all the same (\"already exists\")"
-            clear="a move of it aside (\`mv $(sh_operand "$want") <a path of your choosing>\`)"
-            ghost_moved=1
-        # AND THE FEATURE DIRECTORY `resume` MAKES FIRST IS A PATH TOO
-        # (Copilot's sixth round on #27, verbatim: "`dest_exists` only checks
-        # the final component. For a three-leg destination, `want` is
-        # `<worktree_root>/<branch>/<mount>`, but `resume` first runs `mkdir -p
-        # <worktree_root>/<branch>`; if that feature directory is a regular
-        # file or dangling symlink, the final path appears absent and status
-        # can recommend `resume` … even though the mkdir fails before the
-        # worktree is added"). RUN on 2026-09-13: `mkdir -p <file>/spec`
-        # answers "cannot create directory '…': Not a directory", so the run
-        # stops before any leg is added — earlier even than the add, and in
-        # `resume.sh`'s own words rather than git's. It is read here because
-        # it is the same shape: a path in the way of a step no RR looks at,
-        # cleared by the same `mv`.
-        elif [ "$want" != "$(parent_dir "$want")" ] &&
-            dest_exists "$(parent_dir "$want")" &&
-            [ ! -d "$(parent_dir "$want")" ]; then
-            ghost="$(parent_dir "$want")"
-            ghost_is="the $ghost \`resume\` makes the feature's worktrees under is not a directory, and \`resume\` runs \`mkdir -p\` on it before it adds any leg (\"cannot create directory …: Not a directory\")"
-            clear="a move of it aside (\`mv $(sh_operand "$ghost") <a path of your choosing>\`)"
-            ghost_moved=1
-        fi
-    fi
-    # WHAT THE PRUNE LEAVES BEHIND is the second half of that exit where git
-    # called the registration stale with something still on disk: the prune
-    # clears the registration and touches nothing on disk, and `git worktree
-    # add` then refuses the path in its own words, "already exists". Whatever
-    # is there holds whatever the worktree held, so it is moved aside rather
-    # than deleted here or anywhere else.
-    #
-    # AND IT IS ASKED WITH `-e`, NOT `-d` (Copilot's second round on #27):
-    # "For a stale registration on the recorded branch whose old worktree path
-    # is now a regular file, the `-d` check is false, so status tells the user
-    # to prune and then resume even though the file remains and `resume` still
-    # rejects the existing destination." Run on 2026-09-13 — a worktree
-    # registered, its directory replaced by a FILE, git calling the block
-    # `prunable`, the prune clearing it — `git worktree add` at that path
-    # answered "fatal: '…' already exists". The clause says "whatever" now,
-    # because the reason is the path existing and not what kind of path it is.
-    if [ -n "$ghost" ] && [ "$ghost_moved" -eq 0 ] && dest_exists "$ghost"; then
-        ghost_is="$ghost_is, whose path is still on disk and is no longer a worktree"
-        clear="$clear and a move of what is there aside (\`git worktree add\` refuses a path that \"already exists\")"
-    fi
-    # AND THE DESTINATION IS ASKED EVEN WHERE THE ARMS ABOVE FOUND A
-    # REGISTRATION SOMEWHERE ELSE (Copilot's fifth round on #27, verbatim:
-    # "Restricting this probe to `[ -z "$ghost" ]` misses a destination
-    # obstruction whenever the recorded branch has a stale registration at some
-    # other path … so the destination is never examined and the report offers
-    # `resume` even though its final `git worktree add` is blocked by the
-    # destination registration"). THE PRUNE ALREADY CLEARS BOTH — it walks
-    # every registration in the repository, not one — so the exit those arms
-    # name is not wrong; what the prune does NOT do is move anything on disk,
-    # and a leftover at the DESTINATION is what `git worktree add` refuses
-    # after it. So the path is named where the two are not the same path.
-    if [ -n "$ghost" ] && [ -z "$tree" ] && role_maps_here "$role"; then
-        want="$(leg_tree_path "$root" "$role" "$branch")"
-        if [ "$want" != "$ghost" ] && dest_exists "$want"; then
-            clear="$clear, and a move aside of what is at the $want \`resume\` computes for this leg, which the prune does not touch and \`git worktree add\` refuses for existing"
-        # AND THE PARENT IS A PATH TOO (Copilot's seventh round on #27: "If a
-        # stale registration exists elsewhere and the three-leg feature
-        # directory (`parent_dir "$want"`) is a regular file or dangling
-        # symlink, the final path is absent, so the report says `prune`, then
-        # `resume`; after pruning, `resume` still fails its `mkdir -p` before
-        # adding any worktree"). The prune touches nothing on disk either way.
-        elif [ "$want" != "$(parent_dir "$want")" ] &&
-            [ "$(parent_dir "$want")" != "$ghost" ] &&
-            dest_exists "$(parent_dir "$want")" &&
-            [ ! -d "$(parent_dir "$want")" ]; then
-            clear="$clear, and a move aside of the $(parent_dir "$want") \`resume\` makes the feature's worktrees under, which is not a directory and which its \`mkdir -p\` refuses before it adds any leg"
-        fi
-    fi
-    # THE SHAPE REFUSAL IS SAID ONCE, AND WHAT IS LEFT TO READ DECIDES
-    # WHETHER ANYTHING FOLLOWS IT. With a worktree here the arms below are
-    # about THIS workstation's own work — moved on, behind, diverged, a parked
-    # commit that is not here — and they are true whatever `collect_legs` does
-    # with the feature, so they run and the line above sits in front of them.
-    # With NO worktree here they are the arms that answer "what would `resume`
-    # do", and the line above has answered it: the feature's verdict below
-    # would say the same thing in shorter words, the `--no-push` and `pushed:`
-    # arms would name a refusal that never runs because `collect_legs` refuses
-    # first, and a `worktree prune` cannot make `resume` recreate a feature it
-    # throws out. So the leg ends here, as it does for the two arms above that
-    # read the record's roles.
-    if [ -n "$shape_line" ]; then
-        finding "$shape_line"
-        [ -n "$tree" ] || return 0
-    fi
-    # A STALE REGISTRATION IS NAMED BEFORE THE EXIT IT BLOCKS, and what
-    # clears it before that, because this layer reads the record THE WAY
-    # `resume.sh` WILL JUDGE IT and `resume.sh` judges this one badly: its
-    # `leg_registered_at` matches on the registered PATH alone — fed by
-    # `git-common.sh`'s `load_git_worktrees`, which takes `worktree list
-    # --porcelain -z` raw, with no test that the directory is there — so a
-    # stale block AT the path it computes reads as already done ("worktree
-    # already registered at …; left as it is") and nothing is recreated,
-    # while a stale block at ANOTHER path leaves its plain `git worktree add`
-    # to be refused ("already used by worktree at …"). `resume.sh` names the
-    # hazard itself, where it rolls back what it created: "a phantom
-    # registration a later resume reads as 'already registered' for a path
-    # that is not there". Naming `resume` alone would be naming an exit that
-    # does not work — and the house rule is that the exit named is one that
-    # does, which is also why the LOCKED registration gets the `unlock` in
-    # front of the prune that would otherwise skip it (Copilot on #18).
-    #
-    # THE RECORD'S `pushed:` HAS THREE READINGS, NOT TWO (the second
-    # independent review of #18, 2026-09-11, note (d)). `park.sh` writes
-    # `true` or `false` for every leg it parks and carries an existing entry
-    # forward untouched for one it refuses — `workspace_write_manifest` drops
-    # a key whose value is empty, so it never writes `pushed:` bare — and
-    # anything else is a hand-edit or a bad merge of the record. Read as
-    # `false` it would be a `--no-push` claim nobody made; read as `true`,
-    # which is what every arm below did with it, `pushed: maybe` and a bare
-    # `pushed:` alike falling through the `= false` tests, it became "the
-    # record says it was pushed". A READER NEVER GUESSES, so it is named for
-    # what it is, and `$unread` non-empty is that state, in the words each
-    # finding needs. THE KEY MISSING ALTOGETHER is not this case, and when
-    # these lines were written it reached this function not at all:
-    # `record_rows` emitted a leg's row AT its `pushed:` line, so a leg
-    # without one had no row. It does now, and the paragraph after next is
-    # what it means.
-    #
-    # AND `resume` IS NOT SILENT ABOUT IT, which these lines have to say
-    # because this layer reads the record THE WAY `resume.sh` WILL JUDGE IT:
-    # `resume.sh`'s RR6 is `[ "$pushed" != true ]`, so an unreadable value is
-    # refused there exactly as `--no-push` is — the leg is not recreated —
-    # and offering `resume` as the exit would be naming an exit that does not
-    # work, the thing the rule above exists to prevent. The exit that does is
-    # the workstation that parked it: parking there again writes the record
-    # afresh, with a `pushed:` that reads.
-    #
-    # A FOURTH STATE: NO `pushed:` KEY AT ALL (the independent review of #19,
-    # 2026-09-11). Not a fourth spelling of the third — `record_rows` keeps
-    # the two apart in `$seen`, because the record is not saying something
-    # that cannot be read, it is saying NOTHING — and what makes it a finding
-    # rather than a shrug is the other end. On workBenches before #60
-    # (ec2b450) `workspace_load_project` seeds every leg's
-    # `MANIFEST_LEG_PUSHED` with `false` AT THE `- role:` LINE and overwrites
-    # it only where a `pushed:` key follows, so `resume.sh` reads a missing
-    # one as `false` and RR6 refuses the leg in the `--no-push` words: run
-    # against a record with no `pushed:` on 2026-09-11, the extension
-    # answered "Error: 001-a-thing
-    # (repo leg) was parked with --no-push; that feature was NOT recreated",
-    # exit 2 — and the paragraph after next is what workBenches #60 changes
-    # about that, which is the words and not the refusal. Until
-    # this change `status` was SILENT about that record — no row, no finding,
-    # exit 0 — which is the worse half of note (d): a wrong line can be
-    # argued with, a missing one cannot. So it is read exactly as the
-    # unreadable one is and rules out exactly as little; only the words
-    # differ, because what is wrong with the record differs, and `$refuses`
-    # is the clause that carries the difference into each arm.
-    #
-    # AND THE EXIT IS A PARK THAT PARKS IT, which is why every arm says from
-    # THERE. `park.sh`'s `emit_recorded_feature` carries a REFUSED feature's
-    # entry forward out of the loaded manifest untouched — `pushed` included,
-    # which for an absent key is whatever that loader seeded: on workBenches
-    # before #60 (ec2b450) the defaulted `false`, so a park that refuses this
-    # feature rewrites the record as `pushed: false`, a `--no-push` claim
-    # nobody made; under workBenches #60 the empty string, which
-    # `workspace_write_manifest` drops rather than writes, so the same park
-    # carries the hole forward as a hole. Neither is a record that says what
-    # happened, and `resume` refuses it after either. Only the workstation
-    # that has the worktree parks it through, and that path
-    # writes `true` or `false` from the push it just made. It is also where
-    # this state comes from WITHOUT a hand-edit: a bare `pushed:` loads as
-    # the empty string, `emit_recorded_feature` carries the empty string
-    # forward, and `workspace_write_manifest` drops any key whose value is
-    # empty — so one park that refuses a note-(d) record degrades it into
-    # this one (both halves verified against those functions the same day).
-    #
-    # AND WHICH LOADER IT IS DECIDES THE WORDS AND NOTHING ELSE, WHICH IS WHY
-    # THE CLAUSE BELOW NAMES NEITHER (the independent review of workBenches
-    # #60, 2026-09-11). That pull request stops `workspace_load_project`
-    # inventing `pushed: false` for a key the record does not carry: the seed
-    # becomes the empty string, and a new `MANIFEST_LEG_PUSHED_SEEN[]` keeps
-    # absent apart from bare exactly as `$seen` does here. So under it
-    # `resume` does not READ a missing one as not pushed — it reads it as
-    # nothing and says so: run against the same record on 2026-09-11 with
-    # #60's scripts, the extension answered "Error: 001-a-thing (repo leg):
-    # the record has no `pushed:` for this leg; that feature was NOT
-    # recreated. / Whether its parked commit <sha> ever left Falcon cannot be
-    # read from the record. / Park it again from there, which writes the
-    # record afresh", exit 2, and its REFUSED line read "the record has no
-    # `pushed:` for the repo leg" where main's read "parked with --no-push".
-    # The clause that stood here — "`resume` reads a missing one as not
-    # pushed and refuses it" — was main's MECHANISM copied into this
-    # command's output, and it would have gone stale the day #60 landed: a
-    # line about the other end that the other end had stopped agreeing with.
-    # WHAT IS TRUE UNDER BOTH is the refusal and the exit, and this layer
-    # only ever needed those: RR6 is `[ "$pushed" != true ]` in both, an
-    # absent key loads as `false` in one and as the empty string in the
-    # other and neither is `true`, so the leg is not recreated either way;
-    # and either way the record is written afresh only by a park that parks
-    # the feature THROUGH, as the paragraph above says. The clause says that
-    # much and stops.
-    if [ -z "$seen" ]; then
-        unread="the record has no \`pushed:\` for that leg"
-        refuses="\`resume\` refuses a leg whose record has no \`pushed:\`"
-    else
-        case "$pushed" in
-        true | false) ;;
-        '') unread="its \`pushed:\` has no value, which is neither true nor false" ;;
-        *) unread="its \`pushed:\` says '$pushed', which is neither true nor false" ;;
-        esac
-        [ -z "$unread" ] || refuses="\`resume\` refuses a leg whose \`pushed:\` is not true"
-    fi
-    # `--no-push` IS THE ONE RECORD `park` WRITES THAT `resume` CANNOT
-    # ANSWER, so no line under it offers `resume` as the exit: the WIP commit
-    # is on the workstation that parked it and nowhere else, which is exactly
-    # what `resume.sh` refuses the leg for. Saying "`resume` refuses it" and
-    # then "`resume <Name>` brings it back" sent the person to the command the
-    # line above had just ruled out, so where both states hold they are ONE
-    # line, and it names the only exit there is: park it again, with the push,
-    # from there. The unreadable `pushed:` above is the record `park` does NOT
-    # write that `resume` refuses just as flatly, so its lines are that pair
-    # again, in its own words.
-    if [ "$pushed" = false ] && [ -z "$tree" ]; then
-        if [ -n "$ghost" ]; then
-            finding "parked feature $branch ($role leg): parked with --no-push on ${parked_on:-another workstation} and no worktree on that branch here, but $ghost_is — clear it with $clear; only that workstation has the WIP commit, so nothing here brings it back — park it again from there"
-        else
-            finding "parked feature $branch ($role leg): parked with --no-push on ${parked_on:-another workstation} and no worktree on that branch here; only that workstation has the WIP commit, so nothing here brings it back — park it again from there"
-        fi
-        return 0
-    fi
-    if [ -n "$unread" ] && [ -z "$tree" ]; then
-        if [ -n "$ghost" ]; then
-            finding "parked feature $branch ($role leg): $unread, and no worktree on that branch here, but $ghost_is — clear it with $clear; whether its parked commit ever left ${parked_on:-that workstation} cannot be read, and $refuses, so nothing here brings it back — park it again from there, which writes the record afresh"
-        else
-            finding "parked feature $branch ($role leg): $unread, and no worktree on that branch here; whether its parked commit ever left ${parked_on:-that workstation} cannot be read, and $refuses, so nothing here brings it back — park it again from there, which writes the record afresh"
-        fi
-        return 0
-    fi
-    if [ "$pushed" = false ]; then
-        finding "parked feature $branch ($role leg): parked with --no-push on ${parked_on:-another workstation}; only that workstation has the WIP commit, and \`resume\` refuses it"
-    fi
-    if [ -n "$unread" ]; then
-        finding "parked feature $branch ($role leg): $unread, so whether its parked commit ever left ${parked_on:-that workstation} cannot be read; $refuses, so park it again from there to write the record afresh"
-    fi
-    # AND WHAT IS AT THAT PATH DECIDES THE FEATURE BEFORE ANYTHING BELOW IT
-    # (the two readings the commit above verified and recorded rather than
-    # took: "`resume.sh`'s RR3 is the same question from the other side — a
-    # path that EXISTS at `<worktree_root>/<branch>` and is not a registered
-    # worktree of that leg refuses the feature … and this layer still says
-    # "`resume <Name>` brings it back" for a record whose feature has no
-    # worktree here and a stray directory in the way"). The arm above asks
-    # where this leg's worktree IS; this one asks what is AT the one path the
-    # other end will look at, which is a question with an answer even where
-    # the feature has no worktree here at all — the ordinary state of a
-    # feature parked on another workstation, and the state where this layer
-    # offered `resume` for a run that cannot get past RR3.
-    #
-    # IT IS BOTH ARMS OF ONE REFUSAL. `resume.sh` reaches `leg_registered_at
-    # "$leg_repo" "$tree"` first: a registration AT that path whose branch is
-    # not this feature's is its second arm, "an unrelated worktree is in the
-    # way", and a path that merely EXISTS there is the `[ -e "$tree" ]` under
-    # it, "an unrelated path is in the way". The stderr they refuse in is the
-    # same sentence, they `break` the same leg loop, and each takes the WHOLE
-    # feature — every other leg of it included — before RR2 reads origin and
-    # before RR1 compares any commit. `path_in_the_way` is where the two are
-    # told apart and where what is NOT in the way is ruled out.
-    #
-    # WHERE IT SITS IS `resume.sh`'s OWN ORDER, and the order decides more
-    # than tidiness here. After the `pushed:` arms, because RR6 is first. In
-    # FRONT of the path-parity arm below, because RR4 and RR3 are reached
-    # before the `git worktree add` that arm predicts: verified on 2026-09-12
-    # on a scratch estate carrying BOTH states — the feature's own worktree at
-    # `$HOME/elsewhere/001-a-thing` and a stray directory at
-    # `worktrees/001-a-thing` — where the extension answered "REFUSED:
-    # 001-a-thing — an unrelated path is in the way", exit 2, and the arm
-    # below named a `git worktree move` INTO that directory. `git worktree
-    # move` into a path that exists does not fail: it behaves like `mv` and
-    # puts the worktree INSIDE it, leaving it at `worktrees/001-a-thing/
-    # 001-a-thing` — still not where either verb looks, and now with the stray
-    # directory on top of it (git 2.43, the same day). An exit that quietly
-    # misfiles the work is worse than one that refuses, which is why this
-    # reading comes first and ends the leg.
-    #
-    # AND IT ENDS THE LEG for the reason every reading in this function ends
-    # it: the arms below name exits that cannot run past this one. RR2's two
-    # exits and the absent-parked-commit arm's re-park are both reached only
-    # after RR3, and `resume` never gets there; the no-worktree arm's `resume
-    # <Name>` is the sentence this reading exists to withdraw. What they would
-    # have said is said on the run after the path is clear.
-    #
-    # AND NOT FOR A LEG RR6 REFUSES, whose `pushed:` is anything but `true`:
-    # `resume.sh` tests that at the top of the leg loop and `break`s there, so
-    # no path is ever looked at for it and the REFUSED line this one quotes is
-    # a line the other end does not print. The two arms above say what that
-    # record is and what settles it — a park from the workstation that has the
-    # WIP commit — and they answer it whatever is at the path.
-    #
-    # AND NOT FOR A LEG THE RUN NEVER REACHES, which is `$mine`: the REFUSED
-    # reason this line quotes is the one `resume` prints for the leg it stops
-    # at, and it stops at the FIRST leg in the record's order. A second
-    # obstructed leg's path is read by nothing.
-    if [ "$pushed" = true ] && role_maps_here "$role" && [ "$mine" -eq 1 ]; then
-        want="$(leg_tree_path "$root" "$role" "$branch")"
-        if path_in_the_way "$repo" "$want" "$branch" "$role"; then
-            finding "parked feature $branch ($role leg): $IN_THE_WAY_WHAT is at $want, which is the path \`resume\` computes for this leg and is not this branch's worktree — \`resume\` reads that path and no other, overwrites nothing it did not create, and refuses the WHOLE feature, the other legs with it (\"… exists and is not a registered worktree of the $role leg\", refused as \"$IN_THE_WAY_WHY\"), so nothing here brings it back while that is there — $IN_THE_WAY_EXIT"
-            return 0
-        fi
-    fi
-    # A WORKTREE ON THE BRANCH IS NOT THIS FEATURE'S WORKTREE UNLESS IT IS AT
-    # THE PATH `resume` COMPUTES (the independent reviewer's note of
-    # 2026-09-12: "`worktree_on_branch` matches any path while RR4 matches
-    # only the computed one"). `worktree_on_branch` above answers with the
-    # worktree checked out on that branch WHEREVER IT SITS, and every arm
-    # below reads "there is one" as "the feature is here". `resume.sh`'s RR4
-    # is `leg_registered_at "$leg_repo" "$tree"`, which walks
-    # `load_git_worktrees`' registered paths looking for ONE string:
-    # `collect_legs` computes `$WORKTREE_ROOT/$branch` for a `repo` leg and
-    # `$WORKTREE_ROOT/$branch/$SHAPE_SPEC_PATH` (or `…CODE…`) for a three-leg
-    # one, out of THIS checkout's `worktree_root` and never out of the
-    # record's. A worktree anywhere else is not that string, so RR4 misses,
-    # RR3 finds nothing in the way, and the run ends at a `git worktree add`
-    # that cannot take a branch another worktree already holds.
-    #
-    # VERIFIED AGAINST THE EXTENSION on 2026-09-12, on a scratch single-shape
-    # estate — a bare remote in a temp dir, a fake `$HOME`, the extension's own
-    # scripts — whose record carried `pushed: true` and a parked commit that
-    # was origin's tip, with the worktree on the branch at
-    # `$HOME/elsewhere/001-a-thing`: "Error: could not add the repo leg
-    # worktree 'worktrees/001-a-thing' for '001-a-thing'; that feature was NOT
-    # recreated. / fatal: '001-a-thing' is already used by worktree at
-    # '…/elsewhere/001-a-thing'", "REFUSED: 001-a-thing — git worktree add
-    # failed", exit 2. `status` at this branch's base answered "0 finding(s)
-    # in 1 repository", exit 0 — the feature read as CLEAN AND PRESENT where
-    # the command this layer exists to predict refuses it whole. With that one
-    # worktree instead at `worktrees/001-a-thing` the extension answered
-    # "[specify] 001-a-thing (repo): worktree already registered at
-    # worktrees/001-a-thing; left as it is", exit 0, and answered the same
-    # after a `git worktree move` between the two runs — which is where the
-    # exit below comes from, and it is a command that works. The `mkdir -p` in
-    # front of it is not decoration: `worktree move` creates no parent
-    # directory, and with the worktree root not yet on disk — which is the
-    # ordinary state where nothing has been resumed here — it answers "fatal:
-    # failed to move '…' to '…': No such file or directory", exit 128
-    # (git 2.43, the same day). `resume.sh` makes that directory itself,
-    # `mkdir -p "$WORKTREE_ROOT/$branch"`, before it adds anything.
-    #
-    # THE LEG ENDS HERE BECAUSE `park` IS BLIND TO IT TOO. Every arm below
-    # exits through "park again" — moved on, and a record naming no parked
-    # commit to read the tip against — and `park.sh` collects a single
-    # checkout's features through `verify_git_worktree_candidate "$REPO_ROOT"
-    # "$WORKTREE_ROOT" …` and a three-leg one's through `shape_load_features
-    # "$WORKTREE_ROOT"`, each of which drops every worktree outside that root.
-    # On the same estate `park --dry-run` answered "[specify] No open features
-    # under 'worktrees'; nothing to park.", and answered "PARKED: 001-a-thing"
-    # with the worktree at the computed path. So those arms would name an exit
-    # that cannot run, which is the one thing the rule at the top of this
-    # function forbids; the move is the exit that can, and after it the next
-    # run says whatever they would have said.
-    #
-    # NOT FOR A FEATURE `resume` REFUSES WHOLE, whose verdict is made before
-    # any RR runs and is the arm below's to say, and not for a role this
-    # checkout's shape has no place for, which never reaches RR4 either. AND
-    # NOT WITH A `worktree move` WHERE THE PATH FOUND IS THE LEG'S OWN
-    # CHECKOUT: git refuses that in its own words, "'…' is a main working
-    # tree" (git 2.43, verified the same day), so that spelling names no
-    # command — `resume` refuses a root on a feature branch in any case, which
-    # is the local layer's own line on the row this one is printed under.
-    #
-    # AND ONLY FOR THE LEG THE RUN STOPPED AT, which `$mine` is: `resume`
-    # breaks at the first refusing leg in the RECORD's order, so a line about
-    # what a LATER leg's path holds is a refusal this layer would be inventing
-    # — and a line about an EARLIER leg's is one the verdict every sibling
-    # carries has already made. Where no leg refuses, every leg is its own and
-    # `$mine` is true for all of them. It is also how "AFTER the `pushed:`
-    # arms and NOT INSTEAD OF THEM" survives `main`'s third round, which made
-    # RR6 a whole-feature verdict: a leg whose own `pushed:` is not `true` IS
-    # the leg RR6 stops at, so this line still stands beside the arms above
-    # it, and a later leg's does not.
-    #
-    # AND ONLY WHERE THE COMPUTED PATH HOLDS NOTHING, because RR4's question
-    # is about that PATH and this arm's exit is a `worktree move` ONTO it (the
-    # independent review of this commit's base, 2026-09-12, blocker 2). A
-    # block `resume` SEES there on the recorded branch is RR4's first arm: the
-    # leg is already recreated and the feature RESUMES, whatever worktree of
-    # that branch sits elsewhere — run against the extension the same day with
-    # a second worktree force-added on the branch outside the root, "[specify]
-    # 001-a-thing (repo): worktree already registered at worktrees/
-    # 001-a-thing; left as it is", exit 0, while this arm at the base refused
-    # the feature whole and named a move onto the worktree that had resumed
-    # it. A block `resume` does NOT see there — a prunable one — is the arm
-    # above's or the stale-registration arms', and it is not a destination
-    # either: `git worktree move` onto a path git still holds registered dies
-    # ("is a missing but already registered worktree"), and onto a path that
-    # EXISTS it exits 0 and puts the worktree INSIDE it, leaving it at
-    # `<want>/<branch>` — still where neither verb looks (git 2.43, the same
-    # day). And a path that merely EXISTS is the same hazard from the other
-    # side — that is the nesting one — so this arm wants BOTH: git holding
-    # nothing there, and nothing on disk there. The arm above answers both
-    # for every leg whose `pushed:` is `true` and returns; RR6 keeps it from
-    # running for the rest, and those are the legs the two conditions below
-    # are here for. The question is therefore asked in its own right rather
-    # than read back off that arm: `registered_at` answers 1, and only 1, for
-    # a path git holds nothing at.
-    #
-    # AND THE MECHANISM IS NOT QUOTED, BECAUSE IT IS ONLY ONE OF FIVE (the
-    # independent review of this branch, 2026-09-12). The `git worktree add`
-    # that cannot take the branch is what refuses this leg where the branch
-    # is still AT the parked commit; off the path and moved on it is RR1's
-    # divergence, off it and behind it is RR5, off it with the branch gone
-    # from origin it is RR2, and with no parked commit recorded it is RR1
-    # again with the commit blank — all four run against the extension the
-    # same day. The CONCLUSION is the same in all five and so is the exit, so
-    # the line names the outcome and keeps the quoted sentence for the state
-    # that prints it: a line about the other end that the other end does not
-    # print is the drift this file's own rules forbid.
-    if [ -n "$tree" ] && role_maps_here "$role" && [ "$mine" -eq 1 ]; then
-        want="$(leg_tree_path "$root" "$role" "$branch")"
-        held=0
-        registered_at "$repo" "$want" || held=$?
-        # AND A DANGLING SYMLINK AT THE DESTINATION DOES NOT SILENCE THIS
-        # (Copilot's fifth round on #27, verbatim: "`dest_exists` treats a
-        # dangling symlink as occupied, but `resume`'s RR3 uses `[ -e ]` and
-        # therefore proceeds to its final `git worktree add`, which still
-        # rejects that symlink. With an off-path live worktree and a dangling
-        # symlink at this computed destination, this condition is false, so no
-        # add verdict is carried to sibling legs and the report can claim the
-        # feature is clean even though `resume` fails"). It is right, and the
-        # round before it had made that silence: `[ -e ]` is the test RR3
-        # makes, so a path only a link occupies is one the run walks past and
-        # the ADD refuses — the feature is refused, the finding is this one,
-        # and clearing the link is a STEP IN ITS EXIT rather than a reason to
-        # say nothing.
-        if [ "$tree" != "$want" ] && [ "$held" -ne 0 ] && [ ! -e "$want" ]; then
-            # AND THE EXIT IS RR2's WHERE RR2 IS WHAT REFUSES (Copilot's third
-            # round on #27): with the branch gone from origin and a fetch that
-            # WORKED there, `resume` reaches RR2 before the add it never makes
-            # — run on 2026-09-13, "Error: 001-a-thing is no longer on origin
-            # in the spec leg", "REFUSED: 001-a-thing — gone from origin",
-            # exit 2 — and a `git worktree move` brings back no branch origin
-            # has lost. The FINDING is still this one, because where the
-            # worktree sits is a fact about this workstation that RR2's line
-            # does not carry and `park` here will not collect either; the
-            # EXITS are RR2's own two, and the line says which refusal it is.
-            if [ "$refused_kind" = gone ]; then
-                move="there is no \`origin/$branch\` in this leg after this run's fetch either, so \`resume\` refuses at that before it reaches any add — $(origin_gone_exits "$branch" "$parked_on")"
-            else
-                move="$(off_path_exit "$repo" "$role" "$tree" "$want" "$held")"
-            fi
-            finding "parked feature $branch ($role leg): its worktree is at $tree, which is not the $want \`resume\` computes for it — \`resume\` matches a leg's worktree on that path alone, so it does not read this one as already recreated and refuses the WHOLE feature, the other legs with it, at whichever of its own checks this leg reaches first (with the branch still at the parked commit that is the \`git worktree add\` it makes last of all, which cannot take a branch another worktree holds); \`park\` does not carry it either, because it parks the features under $RECORD_WORKTREE_ROOT and no others — $move"
-            return 0
-        fi
-    fi
-    # A BRANCH ORIGIN HAS LOST IS A RECORD `resume` REFUSES BEFORE IT COMPARES
-    # ANY COMMIT, and this layer never asked (the independent review of #21,
-    # 2026-09-11, recorded there as out of scope). Every arm below reads the
-    # leg against ITS OWN history — the branch tip here, the parked commit
-    # here — and the arm that names `resume` promised it for any leg with no
-    # worktree. `resume.sh` reads origin between RR3 and RR1: its RR2 refuses
-    # the WHOLE feature where the leg's repository has no
-    # `refs/remotes/origin/<branch>`, in words and with exits of its own.
-    #
-    # WHAT RR2 TESTS IS A REF IN THAT REPOSITORY, NOT A QUESTION TO ORIGIN,
-    # which is why the test here is `has_ref` and nothing new: RR2 fetches
-    # `+refs/heads/<branch>:refs/remotes/origin/<branch>` in the leg's
-    # repository first — quietly, `|| true`, and not at all under
-    # `--dry-run` — and then reads that ref, refusing on the empty string. So
-    # the question is the one the local layer already asks of a tracking
-    # branch, `has_ref "$repo" "refs/remotes/origin/$branch"`, AS OF THE LAST
-    # FETCH. Run on 2026-09-12 against a scratch single-shape estate — a bare
-    # remote in a temp dir, a fake `$HOME`, the extension's own scripts at
-    # workBenches' main — with the branch deleted in the bare and pruned here,
-    # the extension answered "Error: 001-a-thing is no longer on origin in the
-    # repo leg; that feature was NOT recreated. / The manifest recorded it at
-    # <sha>, parked <at> on Falcon. / If the feature landed, delete its entry:
-    # / <workspace>/workspaces/<org>/atlas.yaml  ->  remove the `- branch:
-    # 001-a-thing` block / If it was deleted by mistake, push it again from
-    # the workstation that parked it.", "REFUSED: 001-a-thing — gone from
-    # origin", exit 2. BOTH of those exits are in the line below, because they
-    # are not one: a feature that LANDED is a record entry to delete, a branch
-    # deleted by mistake is a branch to push again, and neither is a `resume`.
-    #
-    # AND A STALE `origin/<branch>` READS AS PRESENT AT BOTH ENDS, which is
-    # the other half of reading the ref rather than origin: a branch deleted
-    # on origin and never pruned here still has its remote-tracking ref, and
-    # RR2's own fetch neither creates nor deletes one — it carries no
-    # `--prune`, and a fetch of a branch origin has not got fails and is
-    # ignored — so RR2 sees the stale ref and passes. Verified the same day on
-    # the same estate: with the ref put back by hand the extension RESUMED the
-    # feature. This layer therefore claims exactly what the ref says.
-    #
-    # WHERE IT SITS IS `resume.sh`'s OWN ORDER. After the `pushed:` arms,
-    # because RR6 is first and refuses those legs before origin is read at
-    # all. Only where there is NO WORKTREE here, because RR4 is next and calls
-    # a leg whose worktree is already at the path it computes recreated —
-    # "[specify] 001-a-thing (repo): worktree already registered at …; left as
-    # it is", exit 0, verified the same day with the branch gone from origin —
-    # so a worktree here is not a leg RR2 judges, and the tip arms below go on
-    # saying exactly what they said. Never for a feature `collect_legs`
-    # refuses WHOLE, whose verdict is made before any RR runs and is the arm
-    # below's to say. And before the absent-parked-commit arm, because RR2 is
-    # before RR1: with no parked commit AND the branch gone, that same estate
-    # answered RR2's refusal and not "has moved since it was parked".
-    #
-    # WITHOUT A FETCH THIS RUN THE PROMISE IS KEPT AND CAVEATED, NOT WITHDRAWN
-    # — `no_origin_branch_finding`'s rule in the one place where the missing
-    # ref is USUALLY BENIGN. A recorded feature this workstation has not
-    # resumed was parked somewhere else, and a branch pushed there after this
-    # clone's last fetch has no `origin/<branch>` here for the most ordinary
-    # reason there is; RR2's own fetch then finds it and the feature comes
-    # back. Refusing to say `resume <Name>` there would withdraw the exit that
-    # works from the commonest state this layer reports, and saying "origin
-    # has not got it" would be inventing a refusal — so the line keeps its
-    # exit and names the other reading with the one command that settles it.
-    # AFTER A FETCH THAT WORKED IN THIS REPOSITORY there is nothing left to
-    # settle: origin has not got the branch, RR2 will refuse the feature, and
-    # the line says so and gives RR2's two exits instead of `resume`.
-    # `fetched_ok_at` is the pre-pass's answer for THIS repository, root or
-    # leg, as the missing-commit arms below use it.
-    # AND WHERE THE FETCH SETTLED IT THE REFUSAL IS THE FEATURE'S, WHICH IS
-    # WHAT THIS ARM PRINTED AND DID NOT MAKE (the independent review of this
-    # branch, 2026-09-12, its blocker). The line said `resume` refuses the
-    # WHOLE feature and the verdict machinery below knew nothing about it, so
-    # a sibling leg of that same feature — pushed, parked, its own branch
-    # still on origin — went on drawing "`resume <Name>` brings it back" two
-    # lines under it: the report as a whole then named an exit that cannot
-    # work, which is the one thing the rule above forbids. The question is
-    # asked of every leg in `read_record`'s first pass now, beside the two
-    # `collect_legs` asks, and the answer comes back as `$refused` with
-    # `$refused_kind` set to `gone`. So this arm runs for a leg of a feature
-    # already refused FOR THIS READING — the culprit says it in RR2's own
-    # words, and a second leg origin has also lost says it for itself, which
-    # is how the shape arm above treats two unmappable roles — and stays
-    # silent for a feature `collect_legs` throws out first, whose verdict is
-    # made before any RR runs and is the arm below's to say — and silent,
-    # too, for a feature an EARLIER LEG refuses at RR6 or RR1, whose verdict
-    # arrives here as a kind that is not `gone` (Copilot's third round on
-    # #23). `resume.sh` breaks at the first refusing leg in the record's
-    # order, so where one of those comes first origin is never read for this
-    # feature at all, and a line claiming it — with RR2's exits, which say to
-    # delete the record's entry — would be this layer inventing the refusal
-    # the round before it stopped inventing.
-    if [ -z "$tree" ] && { [ -z "$refused" ] || [ "$refused_kind" = gone ]; } &&
-        ! has_ref "$repo" "refs/remotes/origin/$branch"; then
-        if fetched_ok_at "$repo"; then
-            gone_exits="$(origin_gone_exits "$branch" "$parked_on")"
-            if [ -n "$ghost" ]; then
-                finding "parked feature $branch ($role leg): no worktree on that branch here, but $ghost_is — clear it with $clear; and no \`origin/$branch\` here after this run's fetch, so origin has not got that branch and \`resume\` refuses the WHOLE feature for it, \"$branch is no longer on origin in the $role leg\" — nothing here brings it back: $gone_exits"
-            else
-                finding "parked feature $branch ($role leg): no worktree on that branch here, parked ${parked_at:-?} on ${parked_on:-?}, and no \`origin/$branch\` here after this run's fetch: origin has not got that branch, so \`resume\` refuses the WHOLE feature for it, \"$branch is no longer on origin in the $role leg\", and nothing here brings it back — $gone_exits"
-            fi
-            return 0
-        fi
-        # AND A FETCH THAT FAILED HERE SETTLED NOTHING, so the caveat does not
-        # send the person to the flag they have just run (the same review,
-        # S1). `fetched_ok_at` is false for FOUR different runs — one without
-        # the flag, one whose fetch in THIS repository failed, one whose fetch
-        # never ran there because the repository has no `origin` remote or
-        # could not be read at all, and one that never fetched there at all —
-        # and only the first and the last are answered by `status --fetch`.
-        # The middle two are answered by the row above, which has already
-        # printed why nothing was fetched there and that what follows is as of
-        # the last fetch that worked; this clause says that the reading below
-        # is one of those things, IN THE WORDS OF WHAT ACTUALLY HAPPENED
-        # (Copilot's second round on #23): the first version of it read the
-        # presence of the store's entry and called all three of them a fetch
-        # that failed, which for the two that never ran is a claim about this
-        # run that the row two lines above contradicts.
-        if [ -z "$refused" ]; then
-            case "$(fetch_state_at "$repo")" in
-            failed) settles="the fetch this run made there failed, so nothing has settled it" ;;
-            no-remote) settles="that repository has no \`origin\` remote for this run's fetch to have asked, so nothing has settled it" ;;
-            unreadable) settles="that repository could not be read this run, so no fetch was made there and nothing has settled it" ;;
-            # AND A REPOSITORY THIS RUN'S FETCH NEVER LISTED IS NOT ONE THE
-            # FLAG WILL SETTLE (Copilot's third round on #23): the pre-pass
-            # fetches what `estate_repos` lists — the root and the legs
-            # `.gitmodules` declares — while this layer reads the path
-            # `project.yaml` gives the role, and a leg mounted somewhere else
-            # is fetched by no rerun of the flag. So the line says what this
-            # run did rather than naming the flag the person is holding.
-            unlisted) settles="this run's fetch did not reach that repository: it fetches the root and the legs \`.gitmodules\` declares, and \`project.yaml\` maps this role onto a path that is not one of them, so nothing has settled it" ;;
-            # `ok` cannot reach here — `fetched_ok_at` answered it above and
-            # returned — so what is left is `none`, which is every repository
-            # of a run made without the flag.
-            *) settles="\`status --fetch\` settles which" ;;
-            esac
-            gone_caveat=", unless origin has lost that branch: there is no \`origin/$branch\` here as of the last fetch, and \`resume\` refuses a leg whose branch is not on origin, taking the WHOLE feature with it (\"$branch is no longer on origin in the $role leg\") — $settles"
-        fi
-    fi
-    # THE RECORD'S `parked_commit:` HAS TWO READINGS, PRESENT AND ABSENT, and
-    # the second was read as neither (the independent review of #20,
-    # 2026-09-11, note 7, recorded there as out of scope). `park.sh` records
-    # the commit it parked each leg at, and `workspace_write_manifest` drops
-    # any key whose value is empty — so a leg it could name none for is
-    # written with no `parked_commit:` line at all. ABSENT AND BARE ARE ONE
-    # STATE HERE, unlike `pushed:`, and the sixth field's argument does not
-    # apply: `workspace_load_project` leaves `MANIFEST_LEG_COMMIT` at the
-    # empty string either way and `trim_unquote` gives the empty string
-    # either way, so the two readers make one state of them and so does this.
-    #
-    # IT IS NOT A LEG LIKE ANY OTHER, BECAUSE `resume.sh` WILL NOT RECREATE
-    # IT. With no worktree here: RR6 passes (`pushed: true` is the only way
-    # through the arms above on that path — with a worktree here the RR6
-    # states fall through to the arm below and it is a second finding),
-    # RR4 finds no worktree to call already-done, RR3 nothing in the way, RR2
-    # the branch on origin, and RR1 — `[ "$remote_tip" != "$parked_commit" ]`
-    # — refuses it, because an absent parked commit never equals a tip: run
-    # against such a record on 2026-09-11 the extension answered "Error:
-    # 001-a-thing (repo leg) has moved since it was parked; that feature was
-    # NOT recreated. / parked commit     (parked 2026-09-10T20:00:00Z on
-    # Falcon) / current tip    050d1ee…   (origin/001-a-thing)", exit 2.
-    # Until this change the `[ -n "$commit" ] || return 0` that stood here
-    # sat AFTER the arm below, so the line a person got was "no worktree on
-    # that branch here; parked … — `resume Atlas` brings it back": the layer
-    # did not merely stay silent about a record `resume` refuses, it NAMED
-    # AN EXIT THAT CANNOT WORK, which is the one thing the rule at the top
-    # of this function forbids.
-    #
-    # AND WITH A WORKTREE HERE IT WAS SILENT, the same hole from its other
-    # side: that `return 0` skipped the three tip arms below, which are the
-    # only thing this layer says about a worktree that IS here. They cannot
-    # run — there is no parked commit to compare the tip with, and the empty
-    # string is not one: the FIRST of them, `cat-file -e "$commit^{commit}"`,
-    # fails on it, so what would fire is "its parked commit  is not here —
-    # the record says it was pushed, so this repository has never fetched it,
-    # or origin no longer has it" — a blank sha and a reason invented for a
-    # commit the record never named (the independent review of this branch,
-    # 2026-09-11, proved it by removing this arm). So the line says what
-    # cannot be compared instead of guessing at one of them, and it names no
-    # refusal: with the worktree at the path it computes, `resume.sh`'s RR4
-    # calls that leg already recreated and only warns — "HEAD is 7b4773d…,
-    # not the parked commit ; the parked WIP was NOT un-committed" (verified
-    # the same day) — so the exit is the moved-on arm's, park again, and the
-    # workstation to park from is the one the worktree is on, which is this.
-    #
-    # THE EXIT IS A PARK THAT PARKS IT, for the reason the paragraph above
-    # gives for an absent `pushed:`: `emit_recorded_feature` carries a
-    # REFUSED feature's entry forward out of the loaded manifest untouched —
-    # the empty commit with it — and `workspace_write_manifest` drops the
-    # empty key again, so a park that refuses this feature writes the hole
-    # back unchanged. Only a park that parks the feature THROUGH records a
-    # commit for it, which is why the no-worktree arm sends the person to the
-    # workstation that has the feature rather than saying "park again" here.
-    if [ -z "$commit" ]; then
-        if [ -z "$tree" ]; then
-            if [ -n "$ghost" ]; then
-                finding "parked feature $branch ($role leg): the record names no parked commit for that leg, and no worktree on that branch here, but $ghost_is — clear it with $clear; \`resume\` matches origin's tip against the parked commit before it recreates anything, an absent one never matches, and it refuses the leg as having moved on since it was parked, so nothing here brings it back — park it again from ${parked_on:-the workstation that has it}, which writes the record afresh"
-            else
-                finding "parked feature $branch ($role leg): the record names no parked commit for that leg, and no worktree on that branch here; \`resume\` matches origin's tip against the parked commit before it recreates anything, an absent one never matches, and it refuses the leg as having moved on since it was parked, so nothing here brings it back — park it again from ${parked_on:-the workstation that has it}, which writes the record afresh"
-            fi
-        else
-            finding "parked feature $branch ($role leg): the record names no parked commit for that leg, so there is nothing to read this worktree's tip against; whether it moved on, fell behind or diverged since it was parked cannot be told here — park again before leaving, which writes that leg's parked commit"
-        fi
-        return 0
-    fi
-    # NO LINE OF A FEATURE `resume` REFUSES WHOLE MAY NAME `resume` (Copilot
-    # on #21, second round, 2026-09-11). These two arms are the only ones in
-    # this function that offer it — the `--no-push`, unreadable-`pushed:` and
-    # absent-parked-commit arms all rule it out for themselves — and they
-    # offered it to a leg whose FEATURE `collect_legs` throws out: a record
-    # with a roleless leg beside a good `repo` leg drew "the record has no
-    # role … `resume` refuses the WHOLE feature" on one line and "`resume
-    # Atlas` brings it back" on the next, and the two together recommend a
-    # command that cannot recreate it. The leg that costs the feature says so
-    # on its own line, but a person reads the REPORT, not one line of it.
-    #
-    # THE VERDICT IS THE FEATURE'S, SO IT IS MADE WHERE THE FEATURES ARE:
-    # `read_record`'s first pass — the one that counts each feature's legs
-    # for state 7 — also asks of each leg the two questions `collect_legs`
-    # asks, has it a role and can this root answer that role, and hands the
-    # answer down as `$refused`, a clause naming the leg that costs the
-    # feature. Empty for every feature `resume` does not refuse whole, which
-    # is what keeps every other record's lines exactly as they were. It is
-    # not computed HERE because by the time this function has the leg in
-    # front of it the sibling that spoils the feature may not have been read
-    # yet: the record's order is the loader's, not the reader's convenience.
-    if [ -z "$tree" ]; then
-        if [ -n "$refused" ]; then
-            # THE EXIT IS THE VERDICT'S, NOT THE ARM'S. A re-park is what
-            # settles every refusal `collect_legs` makes — a misspelt role, a
-            # role of another shape, a feature with no legs — and it is the
-            # wrong thing to name for a branch origin has lost: the feature
-            # may have LANDED, and a park from the workstation that still has
-            # the worktree would push it back. So the gone verdict carries
-            # RR2's own two exits onto the sibling's line, in the words the
-            # culprit leg's line uses. RR6 and RR1 are the re-park again —
-            # the record is what is wrong, and only a park that parks the
-            # feature THROUGH writes it afresh: with the push RR6 wants, and
-            # with the commit RR1 matches against origin's tip — so those two
-            # say it in the words their own culprit lines end in.
-            #
-            # AND A PATH IN THE WAY CARRIES AN EXIT THE FIRST PASS BUILT: a
-            # park somewhere else moves nothing out of this checkout's way,
-            # so neither the re-park nor RR2's two answer it, and the command
-            # that does turns on what git holds at a path in ANOTHER leg's
-            # repository. `read_record` hands down one verdict and the kind
-            # it is, and `inway` and `add` are the two kinds whose exit
-            # travels with it — the second for the same reason as the first,
-            # a worktree of the culprit leg sitting where neither verb looks,
-            # which no park anywhere moves.
-            # AND THE CULPRIT LEG KEEPS ITS OWN LINE where that line already
-            # names the blocker AND the command that clears it — which is the
-            # `add` kind read on the leg it belongs to: the stale-registration
-            # arms, the dangling symlink and the feature directory all end in
-            # "clear it with X, then `resume <Name>` brings it back", and that
-            # `resume` is the run AFTER the clearing, which is the sentence
-            # this branch's third commit chose deliberately. Every OTHER leg
-            # carries the verdict, which is what the first pass exists for.
-            if [ "$refused_kind" = add ] && [ "$mine" -eq 1 ] && [ -n "$ghost" ]; then
-                :
-            else
-            case "$refused_kind" in
-            inway | add) exits="$refused_exit" ;;
-            gone) exits="$(origin_gone_exits "$branch" "$parked_on")" ;;
-            pushed | moved)
-                exits="park that feature again from ${parked_on:-the workstation that has it}, which writes the record afresh"
-                ;;
-            *)
-                where="the record does not say where"
-                [ -z "$parked_on" ] || where="the record says $parked_on"
-                exits="park that feature again from the workstation that has it ($where)"
-                ;;
-            esac
-            if [ -n "$ghost" ]; then
-                finding "parked feature $branch ($role leg): no worktree on that branch here, but $ghost_is — clear it with $clear; and \`resume\` refuses the WHOLE feature in any case, because $refused, so it does not bring this leg back either — $exits"
-            else
-                finding "parked feature $branch ($role leg): no worktree on that branch here, parked ${parked_at:-?} on ${parked_on:-?}; \`resume\` refuses the WHOLE feature, because $refused, so it does not bring this leg back — $exits"
-            fi
-            return 0
-            fi
-        fi
-        if [ -n "$ghost" ]; then
-            finding "parked feature $branch ($role leg): no worktree on that branch here, but $ghost_is — clear it with $clear, then \`resume $ESTATE_NAME\` brings it back$gone_caveat"
-        else
-            finding "parked feature $branch ($role leg): no worktree on that branch here; parked ${parked_at:-?} on ${parked_on:-?} — \`resume $ESTATE_NAME\` brings it back$gone_caveat"
-        fi
-        return 0
-    fi
-    tip="$(g "$repo" rev-parse -q --verify "refs/heads/$branch" 2>/dev/null || true)"
-    [ -n "$tip" ] || return 0
-    [ "$tip" != "$commit" ] || return 0
-    if ! g "$repo" cat-file -e "$commit^{commit}" 2>/dev/null; then
-        # WHAT THE RECORD ITSELF RULES OUT IS NOT OFFERED AS A REASON. With
-        # `pushed: true` the commit left that workstation, so what is left is
-        # this repository never fetching it, or origin not having it any more;
-        # `pushed: false` is the other case, has its own line above, and here
-        # only says where the commit is. A `pushed:` THAT RULES NOTHING OUT
-        # rules nothing out in the line either: the unreadable arms name every
-        # reason still standing, rather than the one the record would have to
-        # be read as `true` to support. AND AFTER A FETCH THAT WORKED IN THIS
-        # REPOSITORY the first of those is ruled out too, so the line says so
-        # — the way `no_origin_branch_finding` does for a missing
-        # `origin/<branch>`, and for the same reason: contradicting the
-        # `fetched origin:` line printed a moment earlier is worse than saying
-        # nothing. `fetched_ok_at` is the pre-pass's answer for THIS
-        # repository, root or leg, because every one of them is fetched before
-        # any row is read.
-        if [ "$pushed" = false ]; then
-            finding "parked feature $branch ($role leg): its parked commit $(short "$commit") is not here, which is what --no-push means — ${parked_on:-that workstation} is the only place it is"
-        elif [ -n "$unread" ] && fetched_ok_at "$repo"; then
-            finding "parked feature $branch ($role leg): its parked commit $(short "$commit") is not here after this run's fetch, and $unread — so neither reason is ruled out: it may never have left ${parked_on:-that workstation}, and origin may not have it either"
-        elif [ -n "$unread" ]; then
-            finding "parked feature $branch ($role leg): its parked commit $(short "$commit") is not here, and $unread — so no reason is ruled out: it may never have left ${parked_on:-that workstation}, or this repository has never fetched it, or origin no longer has it"
-        elif fetched_ok_at "$repo"; then
-            finding "parked feature $branch ($role leg): its parked commit $(short "$commit") is not here after this run's fetch — the record says it was pushed, so origin has not got it either: rewritten there, or pushed somewhere this clone is not looking"
-        else
-            finding "parked feature $branch ($role leg): its parked commit $(short "$commit") is not here — the record says it was pushed, so this repository has never fetched it, or origin no longer has it"
-        fi
-    elif g "$repo" merge-base --is-ancestor "$commit" "$tip" 2>/dev/null; then
-        n="$(g "$repo" rev-list --count "$commit..$tip" 2>/dev/null || true)"
-        finding "parked feature $branch ($role leg): moved on since it was parked, ${n:-?} commit(s) after $(short "$commit") — park again before leaving"
-    elif g "$repo" merge-base --is-ancestor "$tip" "$commit" 2>/dev/null; then
-        # RESUMED HERE, not behind: the gap is the WIP `resume` un-committed.
-        if wip_gap_is_ours "$repo" "$tip" "$commit" "$depth"; then
-            return 0
-        fi
-        finding "parked feature $branch ($role leg): this worktree is BEHIND the parked commit $(short "$commit"), parked ${parked_at:-?} on ${parked_on:-?} — the record is newer, and \`resume\` refuses to reset it"
-    else
-        finding "parked feature $branch ($role leg): diverged from the parked commit $(short "$commit"), parked ${parked_at:-?} on ${parked_on:-?} — reconcile by hand: \`git -C $(sh_operand "$repo") log --oneline $(sh_operand "$(short "$commit")..$branch")\`"
-    fi
-    return 0
-}
-
-# Linked worktrees on disk — in the root and in each mounted leg — whose
-# branch the record does not know: work that was never parked. ON DISK is
-# meant literally, for `worktree_on_branch`'s reason: the porcelain keeps a
-# deleted worktree's block until `git worktree prune` runs, and telling
-# somebody that a directory which is not there was never parked is a finding
-# about nothing. `read_worktrees` checks the same path before reading it.
-# GIT'S `prunable` IS READ HERE TOO, and for the same reason: a registration
-# git itself calls stale is not a worktree `park` could carry, whatever is
-# left in its directory — that leftover is the person's to move aside, and
-# `park` would no more see it than `resume` could write to it. And where git
-# says nothing because the block is `locked`, `worktree_is_usable` is what
-# says it: a directory with no `.git` in it is not a worktree either, and
-# accusing it of never having been parked is the same finding about nothing.
-unrecorded_worktrees() {
-    local root="$1" recorded="$2" repo where line path="" branch="" first=1 state leg prunable=0
-    local -a repos=("$root")
-    while IFS=$'\t' read -r state leg; do
-        [ "$state" = mounted ] || continue
-        repos+=("$root/$leg")
-    done < <(declared_legs "$root")
-    for repo in "${repos[@]}"; do
-        where="${repo#"$root"}"
-        where="${where#/}"
-        [ -n "$where" ] || where="root"
-        first=1; path=""; branch=""
-        while IFS= read -r line; do
-            case "$line" in
-            "worktree "*) path="${line#worktree }"; branch=""; prunable=0 ;;
-            "branch "*) branch="${line#branch refs/heads/}" ;;
-            prunable | "prunable "*) prunable=1 ;;
-            "")
-                if [ "$first" -eq 1 ]; then
-                    first=0
-                elif [ -n "$branch" ] && [ "$prunable" -eq 0 ] &&
-                    worktree_is_usable "$path"; then
-                    case "$recorded" in
-                    *"$NL$branch$NL"*) ;;
-                    *) finding "worktree on $branch ($where): not in the parked record — never parked; \`park\` carries the features under this root's worktree root, anything else is yours to keep or remove" ;;
-                    esac
-                fi
-                path=""; branch=""; prunable=0
-                ;;
-            esac
-        done < <(g "$repo" worktree list --porcelain 2>/dev/null; printf '\n')
-    done
-}
-
-# WHY A LINE THE RECORD CARRIES IS A LINE `resume` NEVER READS, AND WHAT THE
-# PERSON DOES ABOUT IT — both worded once, because the five findings below
-# say them between them and they are one reading: `workspace_load_project`
-# reads a block by INDENT and shuts a list at the first key shallower than
-# its items. The `features:` key opens the feature list and every later key at
-# project indent shuts it (`in_features=false` is the first line of that
-# arm); the `legs:` key opens a feature's leg list and every later key at
-# feature indent shuts it (`in_legs=false`, the same way); and under a shut
-# list the loader makes no feature and no leg, because its `- branch:` arm
-# sits behind `[ "$in_features" = true ] || continue` and its `- role:` arm
-# behind `[ "$in_legs" = true ] || continue`. THE ARM IS NAMED, not both:
-# a line that loses a LEG is not told about the feature list, because the
-# key that shut the list is the one the reader has to go and find.
-#
-# THE FIRST EXIT IS THE RECORD'S OWN KEY ORDER, and it is the person's to
-# make, never this command's: `status` READS AND CHANGES NOTHING, and a hand
-# that moves the key is a hand that has read what it moves. The order to put
-# it back into is the one `workspace_write_manifest` writes, whose
-# `PROJECT_KEYS` it emits before `features:` and whose leg keys it emits under
-# `legs:`. THE SECOND IS THE RE-PARK, and only from the workstation that has
-# the feature, which is stronger here than in the findings around it: a park
-# rewrites this project's WHOLE BLOCK from what its own `workspace_load_project`
-# read plus what it finds on disk — `emit_recorded_feature` carries a REFUSED
-# feature forward out of `MANIFEST_FEATURE_BRANCHES`, and a feature that
-# loader never made is in no such array — so a park run ANYWHERE ELSE writes
-# the block back without these lines at all. That is why the order comes
-# first: the lines are one park from gone.
-record_unread_why() {
-    case "$1" in
-    feature)
-        printf "\`resume\` reads a record by INDENT, and \`workspace_load_project\` SHUTS the \`features:\` list at the next key at project indent, making no feature of a \`- branch:\` below one"
-        ;;
-    # AND A LIST THAT WAS NEVER OPENED HAS NO KEY THAT SHUT IT (Copilot's
-    # first round on this PR, suppressed). `features:` is what OPENS the
-    # feature list and `legs:` a feature's leg list, so a `- branch:` above
-    # every `features:` key — or in a block that has none — and a `- role:`
-    # above its feature's `legs:` key are unread for the opposite reason, and
-    # an arm that names a shutting key sends the reader to a line the record
-    # has not got.
-    nolist)
-        printf "\`resume\` reads a record by INDENT, and the \`features:\` key is what OPENS the list \`workspace_load_project\` reads a \`- branch:\` out of — this block has no such key ABOVE that line, so the loader is in no feature list when it reaches it"
-        ;;
-    nolegs)
-        printf "\`resume\` reads a record by INDENT, and the \`legs:\` key is what OPENS the list \`workspace_load_project\` reads a \`- role:\` out of — this feature has no such key ABOVE that line, so the loader is in no leg list when it reaches it"
-        ;;
-    outer)
-        printf "\`resume\` reads a record by INDENT, and \`workspace_load_project\` SHUTS the \`features:\` list at the next key at project indent, and every feature's \`legs:\` list inside it with it, making no leg of a \`- role:\` below one"
-        ;;
-    *)
-        printf "\`resume\` reads a record by INDENT, and \`workspace_load_project\` SHUTS a feature's \`legs:\` list at the next line shallower than its \`- role:\` items, making no leg of one below it"
-        ;;
-    esac
-}
-record_unread_exits() {
-    printf "the exits are to put the block back in the order \`park\` writes it (every project-level key above \`features:\`, every feature-level key above \`legs:\`) in %s, which is yours to do and not \`status\`'s, or to park that feature again FROM THE WORKSTATION THAT HAS IT (%s), which rewrites the whole block in that order; a park from any other workstation rewrites it out of what its own loader read and takes these lines with it" "$1" "$2"
-}
-# AND THE LEG IS NAMED BY ITS ROLE, OR BY THE ROLE IT HAS NOT GOT (Copilot's
-# second round on this PR, suppressed, verbatim: "When an unread `- role:`
-# has an empty value (for example `- role: # note` under a closed `legs:`
-# list), `feature_drop_role` is empty and this renders `the record lists its
-# `` leg`. That makes the new recovery diagnostic unclear for a roleless
-# record; use an explicit label such as \"a leg with no role\" (and cover this
-# malformed spelling in the regression tests)."). IT IS RIGHT, AND THE
-# SPELLING IS ONE THIS LAYER ALREADY KNOWS: `record_scalar` takes `#` and
-# everything after it off every value because `workspace_load_project` takes
-# it off every LINE, so `- role: # note` is a leg with no role to both
-# readers — the reading #21's round put there, four functions above this one.
-# An empty role between two backticks is a name where the reader is looking
-# for one, and the line it is on exists to send a hand to a line.
-record_unread_leg() {
-    if [ -n "$1" ]; then
-        printf "\`%s\` leg" "$1"
-    else
-        printf "leg with no role"
-    fi
-}
-
-# A root's block of the record against its disk: the note line, one finding
-# per leg that is out of step, one per FEATURE the record leaves with no legs
-# at all, and the worktrees the record does not know. The selectors are tried
-# in order until one names a block: a standalone root by its `id:` first, then
-# by its folder as `root:` — the block a record found by folder name carries —
-# and a family member by its `root:` alone.
-#
-# A FEATURE THE RECORD LISTS NO LEG FOR IS A READING THIS LAYER OWES, AND IT
-# IS PER FEATURE, NOT PER LEG (the independent review of #21, 2026-09-11,
-# note 1, and the note-8 commit's own "recorded for later"; nobody has ruled
-# on it). `collect_legs` ends `[ "${#LEG_ROLES[@]}" -gt 0 ]`, so a feature
-# whose `legs:` is empty — the key with nothing under it, `legs: []`, or leg
-# items with no `- role:` line, which start no leg in either reader — is
-# refused WHOLE, in the shape words again: run on 2026-09-11 against a
-# scratch single-shape estate, each of those three spellings answered "Error:
-# 001-a-thing was parked from a single project and this checkout is single;
-# that feature was NOT recreated", "REFUSED: 001-a-thing — shape mismatch",
-# exit 2. This layer said NOTHING about any of them — no finding, exit 0 —
-# because every reading it had was a LEG's, and there is no leg here to hang
-# one on. That is the hole the last three notes closed for legs, in its
-# per-feature shape.
-#
-# SO THE FEATURES ARE JUDGED BEFORE THE LEGS ARE READ. `record_rows` emits a
-# `branch` row per feature and a `leg` row per leg, in the record's order, so
-# a first pass counts each feature's legs and the main loop reads the count
-# back at that feature's `branch` row — before any of its legs' arms run,
-# which is where the second job needs it. THE SECOND JOB IS THE VERDICT
-# (Copilot on #21, second round, 2026-09-11): the same pass asks of each leg
-# the two questions `collect_legs` asks — has it a role, and can this root
-# answer that role — and keeps the first clause that costs the feature, so
-# `check_parked_leg` can be told that the feature its leg belongs to is one
-# `resume` throws out whole and stop offering `resume` for it. It cannot be
-# asked of a leg as the leg arrives: the leg that spoils the feature may come
-# after the one being read, and the record's order is the loader's, not the
-# reader's convenience. ONE ENTRY PER `branch` ROW, NOT
-# PER BRANCH NAME: `workspace_load_project` makes a new feature of every
-# `- branch:` line it reads, so a name that appears twice is two features to
-# the loader and `collect_legs` judges each on its own legs; `$recorded` and
-# the feature COUNT still fold the duplicates, because those answer "is this
-# branch in the record", which is one question however many entries there
-# are.
-read_record() {
-    local root="$1" sel rows="" kind a b c d e f n_features=0
-    local parked_at="" parked_on="" lane="" active="" recorded="$NL"
-    local seen_branches=0 legs where="" refused="" refused_kind="" unnamed=0
-    local refused_exit="" refused_leg="" legno=0 verdict=""
-    local legrepo="" legtree="" legwt="" legheld=0 legrc=0
-    local -a feature_legs=() feature_why=() feature_rr=() feature_rr_kind=()
-    local -a feature_exit=() feature_rr_leg=()
-    local -a feature_add=() feature_addexit=() feature_add_leg=()
-    local -a feature_drops=() feature_drop_role=() feature_drop_why=()
-    shift
-    RECORD_SHAPE=""
-    [ -n "$RECORD_FILE" ] || return 0
-    # THIS ROOT'S SHAPE IS READ ONCE, HERE, because every leg of every feature
-    # is judged against it and `load_repo_shape` reads a whole file to answer.
-    read_root_shape "$root"
-    # AND THE WORKTREE ROOT WITH IT, for the same reason and in the same
-    # place: it is the ROOT's answer, not the leg's — `$SPECKIT_GIT_WORKTREE_ROOT`,
-    # else this checkout's `git-config.yml`, else the shape's default — and
-    # both passes below want it for every leg of every feature.
-    #
-    # OUT OF THE ROOT GIT WOULD SPELL, which is the first blocker of the
-    # independent review of this branch (2026-09-12): `$root` is
-    # `estate_walk_up`'s or `$PROJECTS_DIRS`' string, symlinks intact, while
-    # `git worktree list --porcelain` is ALWAYS physical and `resume.sh` sets
-    # `REPO_ROOT="$(git rev-parse --show-toplevel)"`, which is physical too.
-    # Comparing one with the other turned a HEALTHY feature into a
-    # whole-feature refusal wherever the projects directory — or the spelling
-    # the person typed — went through a symlink: run both ways on one estate
-    # the same day, `resume.sh` answered "worktree already registered at
-    # worktrees/001-a-thing; left as it is", exit 0, and this layer answered
-    # "a directory is at …/proj-link/Atlas-worktrees/001-a-thing, which is the
-    # path `resume` computes", refusing the feature and naming an `mv` of the
-    # very worktree it had just resumed from.
-    #
-    # AND NO FURTHER THAN GIT RESOLVES IT. `get_config_value` resolves no
-    # symlink in `worktree_root:` and `resolve_path_from_repo_root` is
-    # `os.path.abspath`, so where the WORKTREE ROOT is itself a link both ends
-    # compute the unresolved path, git reports the resolved one, and RR4
-    # misses at the other end exactly as it misses here — verified the same
-    # day, `resume.sh` refusing such an estate at RR3, "REFUSED: 001-a-thing —
-    # an unrelated path is in the way", exit 2. Resolving harder than the
-    # other end resolves would delete a refusal it makes.
-    RECORD_WORKTREE_ROOT="$(record_worktree_root "$(physical_path "$root")")"
-    for sel in "$@"; do
-        rows="$(record_rows "$RECORD_FILE" "$sel")"
-        [ -z "$rows" ] || break
-    done
-    if [ -z "$rows" ]; then
-        # A root the record does not mention: every worktree here is unparked,
-        # which is the one thing worth saying about it.
-        say "    parked record: no block for this root in ${RECORD_FILE##*/}"
-    else
-        # THE FIRST PASS: how many legs each feature entry has, in order. A
-        # `leg` row belongs to the `branch` row before it — `record_rows`
-        # emits one only while a branch is open — so the count goes onto the
-        # last entry; the `-gt 0` guard is for a record so mangled that a leg
-        # row arrives with no branch row before it, which is a row this pass
-        # then ignores rather than an index it invents.
-        while IFS=$'\037' read -r kind a b c d e f; do
-            case "$kind" in
-            branch)
-                feature_legs+=(0); feature_why+=("")
-                feature_rr+=(""); feature_rr_kind+=(""); feature_exit+=("")
-                feature_rr_leg+=(""); feature_add_leg+=("")
-                feature_add+=(""); feature_addexit+=("")
-                feature_drops+=(0); feature_drop_role+=(""); feature_drop_why+=("")
-                ;;
-            # A LEG LINE THE LOADER READS NO LEG OUT OF is counted onto the
-            # same feature, by the same rule and with the same guard: it is
-            # filed under the `- branch:` above it, and the FIRST of them is
-            # the one named, as the first leg that costs the feature is. It
-            # takes no verdict and costs the feature nothing here, because
-            # `collect_legs` never sees it — what it costs is the leg, and
-            # where it costs the feature every leg it has, the feature's own
-            # line below says so. It is no leg to the VERDICT walk either:
-            # the four questions below are asked of the `leg` rows alone, and
-            # `workspace_load_project` puts no such line in `MANIFEST_LEG_ROLE`
-            # for `collect_legs` or for any RR to read.
-            noleg)
-                legs=${#feature_legs[@]}
-                if [ "$legs" -gt 0 ]; then
-                    if [ "${feature_drops[legs - 1]}" -eq 0 ]; then
-                        feature_drop_role[legs - 1]="$b"
-                        feature_drop_why[legs - 1]="$c"
-                    fi
-                    feature_drops[legs - 1]=$((feature_drops[legs - 1] + 1))
-                fi
-                ;;
-            leg)
-                legs=${#feature_legs[@]}
-                if [ "$legs" -gt 0 ]; then
-                    feature_legs[legs - 1]=$((feature_legs[legs - 1] + 1))
-                    # THE FIRST LEG THAT COSTS THE FEATURE IS THE ONE NAMED:
-                    # `collect_legs` walks the legs in the record's order and
-                    # returns at the first role it cannot map, so that is the
-                    # one `resume`'s refusal is about, and a second would only
-                    # lengthen a line about a feature that is already gone.
-                    #
-                    # AND THE THIRD QUESTION IS THE SHAPE'S, ASKED LAST (the
-                    # feature-level follow-up's own note, 2026-09-11).
-                    # `collect_legs` asks one question — can this role be
-                    # mapped onto a checkout of this shape — and the two above
-                    # answer it for the roles that can be answered without
-                    # knowing the shape: no role at all, and a role this root
-                    # has no repository for. A role this root DOES mount can
-                    # still be one no shape maps (`assembly`, or a word that
-                    # happens to match a directory here) or one only the OTHER
-                    # shape maps (`spec` in a single checkout, `repo` in a
-                    # three-leg one), and that is this question. It is asked
-                    # LAST so the two above keep the clauses they had, which
-                    # is what keeps the lines they already explain
-                    # byte-identical.
-                    #
-                    # AND THE FOURTH IS RR2's, WHICH IS NOT `collect_legs`'s
-                    # AT ALL AND IS KEPT APART FROM THE THREE (the independent
-                    # review of this branch, 2026-09-12, its blocker).
-                    # `collect_legs` runs to the end before any RR does, so a
-                    # feature it refuses is refused for THAT, whatever origin
-                    # has lost — which is why this answer goes in an array of
-                    # its own and is read back only where the three above
-                    # found nothing. What it asks is what RR2 will ask of this
-                    # leg: no worktree on the branch here, a fetch that WORKED
-                    # in that leg's repository this run, and no
-                    # `refs/remotes/origin/<branch>` in it — the ref RR2 reads
-                    # and refuses the WHOLE feature on. `[ "$d" = true ]` is
-                    # RR6 coming first: a leg whose `pushed:` is not the
-                    # literal `true` is refused before origin is read at all,
-                    # and that refusal is the leg's own line below, not a
-                    # verdict this layer makes. The origin question is
-                    # skipped without `--fetch`, where a missing ref has a
-                    # second and commoner reading and this layer chooses
-                    # neither.
-                    #
-                    # AND THE FOURTH QUESTION IS ASKED IN `resume.sh`'s OWN
-                    # ORDER, OF THE LEGS IN THE RECORD's (Copilot's third
-                    # round on #23, 2026-09-12): "`feature_gone` is propagated
-                    # to every leg without accounting for an earlier per-leg
-                    # refusal. For example, if the first leg has `pushed:
-                    # false` (RR6) or no `parked_commit:` (RR1) and a later
-                    # leg has a missing origin branch, `resume` stops at the
-                    # first leg in record order, but this makes the whole
-                    # feature report RR2's gone-origin verdict and exits."
-                    # `workspace_load_project` appends each leg in FILE order,
-                    # `collect_legs` walks `MANIFEST_LEG_ROLE` in that order,
-                    # and the loop under it breaks at the first refusal — so
-                    # the refusal the person gets is the first one in the
-                    # record, and a later leg's may not be printed in front of
-                    # it. Run against the extension on 2026-09-12 on a scratch
-                    # three-leg estate, one feature, two legs in two
-                    # repositories, the order the variable: `code` (`pushed:
-                    # false`) then `spec` (branch deleted on origin) answered
-                    # "Error: 001-a-thing (code leg) was parked with
-                    # --no-push", "REFUSED: 001-a-thing — parked with
-                    # --no-push"; `code` (no `parked_commit:`) then the same
-                    # `spec` answered "Error: 001-a-thing (code leg) has moved
-                    # since it was parked", "REFUSED: 001-a-thing —
-                    # divergence"; and the gone leg FIRST answered "Error:
-                    # 001-a-thing is no longer on origin in the spec leg",
-                    # "REFUSED: 001-a-thing — gone from origin". All exit 2.
-                    #
-                    # SO ONE ARRAY HOLDS THE FIRST REFUSAL AND ITS KIND, and
-                    # the arms under it are RR6, RR4 and RR3, RR2 and RR1 in
-                    # that order, which is the order one leg is tested in.
-                    # RR6 is the record alone and is certain — it is the
-                    # FIRST test of the loop, before RR4, so a worktree here
-                    # does not save the leg. RR1 is asked of an absent
-                    # `parked_commit:`, which is the one reading of RR1 this
-                    # layer makes, and only after RR2 has been asked of the
-                    # same leg, because that is where `resume.sh` asks it.
-                    # What this still cannot see is RR5 and the divergence
-                    # half of RR1, which would be `check_parked_leg`'s whole
-                    # job done a second time for every leg of every feature.
-                    #
-                    # AND RR4 AND RR3 ARE THE PATH'S, WHICH IS A REFUSAL OF
-                    # THE WHOLE FEATURE MADE ONE LEG AT A TIME. `collect_legs`
-                    # is answered before any leg is read and the three
-                    # questions above this chain are its; RR3 and RR4's second
-                    # arm are per leg, inside the loop that `break`s — so the
-                    # feature is gone the moment ONE leg's computed path is
-                    # obstructed, and every other leg of it goes with it,
-                    # whatever its own path holds. It sits between RR6 and RR2
-                    # because that is where `resume.sh` asks it: after the
-                    # `pushed:` test at the top of the loop, and before origin
-                    # is read — so a leg whose `pushed:` is not `true` refuses
-                    # the feature with no path looked at for it, and a leg
-                    # whose path is obstructed refuses it with origin never
-                    # read. A leg the record gives no branch name is not asked
-                    # either: there is no branch to compute a path from, and
-                    # `resume` refuses that feature at RR2 under a blank name,
-                    # which `read_record` says once on the feature's own line.
-                    #
-                    # THE ORDER BETWEEN LEGS IS THE ARRAY'S OWN GATE: `[ -z
-                    # "${feature_rr[legs - 1]}" ]` is "no earlier leg has
-                    # refused", so the walk stops at the first refusing leg
-                    # whichever RR refuses it, and one reading never overtakes
-                    # another by being read back in a different order. That is
-                    # the round above extended to the two readings the stacked
-                    # commits add: an in-the-way leg BEFORE a gone-origin one
-                    # is the in-the-way refusal, and a gone-origin leg before
-                    # an in-the-way one is the gone one.
-                    if [ -z "${feature_why[legs - 1]}" ]; then
-                        if [ -z "$b" ]; then
-                            feature_why[legs - 1]="a leg of it in the record has no role"
-                        elif ! leg_repo_for_role "$root" "$b" >/dev/null 2>&1; then
-                            feature_why[legs - 1]="its \`$b\` leg names a role this root does not mount"
-                        elif ! role_maps_here "$b"; then
-                            feature_why[legs - 1]="$(role_shape_short "$b")"
-                        elif [ -z "${feature_rr[legs - 1]}" ]; then
-                            if [ "$d" != true ]; then
-                                feature_rr[legs - 1]="$(pushed_verdict "$b" "$d" "$f")"
-                                feature_rr_kind[legs - 1]=pushed
-                            elif [ -n "$a" ] && leg_path_in_the_way "$root" "$b" "$a"; then
-                                feature_rr[legs - 1]="$IN_THE_WAY_WHAT is at the $LEG_TREE it computes for its \`$b\` leg"
-                                feature_rr_kind[legs - 1]=inway
-                                feature_exit[legs - 1]="$IN_THE_WAY_EXIT"
-                            elif [ "$FETCH" -eq 1 ] && origin_lost_leg "$root" "$b" "$a"; then
-                                feature_rr[legs - 1]="there is no \`origin/$a\` in its \`$b\` leg after this run's fetch"
-                                feature_rr_kind[legs - 1]=gone
-                            elif moved_on_leg "$root" "$b" "$a" "$c"; then
-                                feature_rr[legs - 1]="the record names no parked commit for its \`$b\` leg"
-                                feature_rr_kind[legs - 1]=moved
-                            fi
-                            # WHICH LEG THE VERDICT BELONGS TO, kept beside it
-                            # because the arms in `check_parked_leg` that read
-                            # a path have to know whether the leg in front of
-                            # them is the one `resume` stopped at (Copilot's
-                            # first round on #27).  It is the leg's ORDINAL in
-                            # this feature, which `feature_legs` has just been
-                            # incremented to, and not its role: a record may
-                            # name one role twice, and the second of them is
-                            # not the leg the run refused.
-                            [ -z "${feature_rr[legs - 1]}" ] ||
-                                feature_rr_leg[legs - 1]="${feature_legs[legs - 1]}"
-                        fi
-                    fi
-                    # AND THE FIFTH QUESTION IS THE `git worktree add`'s,
-                    # WHICH CLOSES NOTHING, because it is the LAST thing the
-                    # other end does. `resume.sh` runs its RR loop over every
-                    # leg of the feature first and only then walks the legs
-                    # again to add the worktrees, so an RR refusal on ANY leg
-                    # — including one after this — beats an add that would
-                    # fail on this one, and the walk above must go on. The
-                    # first leg whose add fails is the one named, as in every
-                    # question above it, because the create loop `break`s
-                    # there too, and `[ -z "${feature_rr[legs - 1]}" ]` is
-                    # the walk that stopped: an RR has refused an EARLIER leg
-                    # and no add is reached at all. A LATER leg's RR is not
-                    # visible here and does not need to be — the second pass
-                    # reads the RR array first and this one only where that
-                    # found nothing.
-                    #
-                    # WHAT MAKES IT FAIL is the reading this branch is for: a
-                    # worktree on the recorded branch that is NOT at the
-                    # computed path. RR4 matches on that path alone, so the
-                    # leg is neither `present` nor skipped, and `git worktree
-                    # add` cannot take a branch another worktree holds
-                    # ("already used by worktree at …", verified against the
-                    # extension on 2026-09-12). Without this the leg said so
-                    # on its own line while every SIBLING leg of the same
-                    # feature still said "`resume <Name>` brings it back" —
-                    # the pair the rule at the top of `check_parked_leg`
-                    # forbids, and the one this layer's own reading created.
-                    if [ -z "${feature_rr[legs - 1]}" ] &&
-                        [ -z "${feature_why[legs - 1]}" ] &&
-                        [ -z "${feature_add[legs - 1]}" ] &&
-                        [ -n "$a" ] && [ -n "$b" ] && [ "$d" = true ] &&
-                        role_maps_here "$b"; then
-                        legrepo="$(leg_repo_for_role "$root" "$b" 2>/dev/null || true)"
-                        if [ -n "$legrepo" ] && [ -e "$legrepo/.git" ]; then
-                            legtree="$(leg_tree_path "$root" "$b" "$a")"
-                            legrc=0
-                            legwt="$(worktree_on_branch "$legrepo" "$a")" || legrc=$?
-                            [ "$legrc" -eq 0 ] || legwt=""
-                            legheld=0
-                            registered_at "$legrepo" "$legtree" || legheld=$?
-                            if [ -n "$legwt" ] && [ "$legwt" != "$legtree" ] &&
-                                [ "$legheld" -ne 0 ] && [ ! -e "$legtree" ]; then
-                                feature_add[legs - 1]="its \`$b\` leg's worktree is at $legwt, which is not the $legtree \`resume\` computes for it"
-                                feature_addexit[legs - 1]="$(off_path_exit "$legrepo" "$b" "$legwt" "$legtree" "$legheld")"
-                                feature_add_leg[legs - 1]="${feature_legs[legs - 1]}"
-                            # AND THE DESTINATION CAN BLOCK THE ADD WITH NO
-                            # WORKTREE ANYWHERE, which the question above
-                            # cannot see because it starts from one: a
-                            # registration git holds at that path with nothing
-                            # on disk, a dangling symlink there, or a feature
-                            # directory that is not a directory. Each is read
-                            # by `check_parked_leg` on the culprit leg's own
-                            # line already; what this adds is the FEATURE's
-                            # verdict, so no sibling says `resume <Name>` for a
-                            # run that refuses (Copilot's seventh round on #27).
-                            elif leg_add_blocked "$root" "$b" "$a"; then
-                                feature_add[legs - 1]="$ADD_BLOCKED_WHAT"
-                                feature_addexit[legs - 1]="$ADD_BLOCKED_EXIT"
-                                feature_add_leg[legs - 1]="${feature_legs[legs - 1]}"
-                            fi
-                        fi
-                    fi
-                fi
-                ;;
-            esac
-        done <<<"$rows"
-        while IFS=$'\037' read -r kind a b c d e f; do
-            case "$kind" in
-            project) parked_at="$a"; parked_on="$b"; lane="$c"; active="$d"; RECORD_SHAPE="$e" ;;
-            branch)
-                seen_branches=$((seen_branches + 1))
-                legno=0
-                # A FEATURE THE RECORD GIVES NO BRANCH NAME (Copilot on #22)
-                # is one to the loader and is refused by `resume` whatever its
-                # legs say — with legs, at RR2 with the name blank, "Error:  is
-                # no longer on origin in the repo leg", because no branch is
-                # named nothing on origin; with none, as a shape mismatch
-                # before any leg is read (both run against the extension
-                # 2026-09-12). It is counted as the loader counts it, its
-                # name is not added to the recorded set (an empty name would
-                # match every sweep), and its legs are not read one by one:
-                # there is no branch to find a worktree for, and each would
-                # only print the refusal again with the name blank. One line,
-                # on the root's row, with RR2's own two exits.
-                if [ -z "$a" ]; then
-                    unnamed=1
-                    n_features=$((n_features + 1))
-                    where="the record does not say where"
-                    [ -z "$parked_on" ] || where="the record says $parked_on"
-                    if [ "${feature_drops[seen_branches - 1]:-0}" -gt 0 ] &&
-                        [ "${feature_legs[seen_branches - 1]:-0}" -eq 0 ]; then
-                        # TWO DEFECTS AND ONE LINE: the name is missing AND
-                        # the legs listed under it sit where the loader reads
-                        # none, so "lists no leg" — true of the loader, false
-                        # of the record — is not what this record is told.
-                        # `resume`'s refusal is the one the arm below names,
-                        # because a feature with no leg is refused before a
-                        # leg is read; the exits are still this arm's, since
-                        # both of them settle the branch name and the key
-                        # order together.
-                        finding "parked feature with no branch name: a \`- branch:\` in the record has no value, and the $(record_unread_leg "${feature_drop_role[seen_branches - 1]:-}") listed under it sits where \`resume\` reads no leg, because $(record_unread_why "${feature_drop_why[seen_branches - 1]:-legs}"); \`resume\` reads the feature as one named nothing, collects no leg for it, and refuses it whole as a shape mismatch before it reads one, so nothing here brings it back — if that feature landed, remove its \`- branch:\` block from ${RECORD_FILE##*/}; if it was parked, park it again from the workstation that has it ($where), which writes the branch and the legs it parks"
-                    elif [ "${feature_drops[seen_branches - 1]:-0}" -gt 0 ]; then
-                        # AND THE SAME TWO DEFECTS WHERE THE FEATURE KEEPS A
-                        # LEG (Copilot's third round on this PR, verbatim:
-                        # "When a blank `- branch:` has both a readable leg
-                        # and a `noleg`, this condition skips the new combined
-                        # diagnostic because it only enters the unread-leg
-                        # branch when `feature_legs` is zero. Control then
-                        # falls through to the older blank-branch message;
-                        # `unnamed=1` suppresses all readable leg rows and the
-                        # later `noleg` arm is a no-op, so the unread leg/key-
-                        # order defect is never reported."). IT IS RIGHT, AND
-                        # IT IS THE ONE HOLE THIS WHOLE BRANCH EXISTS TO SHUT:
-                        # a line the record lists, that `resume` reads nothing
-                        # of, said NOWHERE. The blank name suppresses every
-                        # per-leg line by design — there is no branch to find
-                        # a worktree for — and the `noleg` arm below only
-                        # counts, so this line is the only place the unread
-                        # one can be named, and the arm above it was reached
-                        # only where the feature keeps none.
-                        #
-                        # THE REFUSAL IS THE ONE THE ARM BELOW NAMES, not the
-                        # shape mismatch: the feature DOES keep a leg
-                        # `collect_legs` collects, so the run gets as far as
-                        # RR2 and refuses it there with the name blank. The
-                        # exits are still the blank name's — a key put back
-                        # leaves a feature named nothing, which no re-ordering
-                        # settles — and they carry the leg's lines too,
-                        # because the park that writes the branch writes the
-                        # legs it parks with it.
-                        finding "parked feature with no branch name: a \`- branch:\` in the record has no value, and a $(record_unread_leg "${feature_drop_role[seen_branches - 1]:-}") listed under it sits where \`resume\` reads no leg, because $(record_unread_why "${feature_drop_why[seen_branches - 1]:-legs}"); \`resume\` reads the feature as one named nothing and refuses it as a branch origin has not got (\"is no longer on origin\", the name blank), so nothing here brings it back — if that feature landed, remove its \`- branch:\` block from ${RECORD_FILE##*/}; if it was parked, park it again from the workstation that has it ($where), which writes the branch and the legs it parks"
-                    elif [ "${feature_legs[seen_branches - 1]:-0}" -eq 0 ]; then
-                        finding "parked feature with no branch name: a \`- branch:\` in the record has no value and lists no leg; \`resume\` reads it as a feature named nothing and refuses it whole as a shape mismatch before it reads a leg, so nothing here brings it back — if that feature landed, remove its \`- branch:\` block from ${RECORD_FILE##*/}; if it was parked, park it again from the workstation that has it ($where), which writes the branch it parks"
-                    else
-                        finding "parked feature with no branch name: a \`- branch:\` in the record has no value; \`resume\` reads it as a feature named nothing and refuses it as a branch origin has not got (\"is no longer on origin\", the name blank), so nothing here brings it back — if that feature landed, remove its \`- branch:\` block from ${RECORD_FILE##*/}; if it was parked, park it again from the workstation that has it ($where), which writes the branch it parks"
-                    fi
-                    continue
-                fi
-                unnamed=0
-                case "$recorded" in
-                *"$NL$a$NL"*) ;;
-                *) recorded="$recorded$a$NL"; n_features=$((n_features + 1)) ;;
-                esac
-                # NO LEGS, NO LEG TO SAY IT ON: the finding is the feature's,
-                # printed where the feature is, and the exit is the exit the
-                # roleless arm names — a park that parks the feature THROUGH.
-                # `workspace_write_manifest` writes `legs: []` for a feature
-                # it has no legs for, and `emit_recorded_feature` carries a
-                # REFUSED feature's legs forward out of the loaded manifest,
-                # which for this one is none: a park that refuses it writes
-                # the hole back as a hole (read off those two functions the
-                # same day).
-                #
-                # AND "LISTS NO LEG" IS NOT WHAT A RECORD THAT LISTS ONE IS
-                # TOLD. Where the legs are there and the loader reads none of
-                # them, the feature is refused for the same reason and the
-                # sentence is a different one: it names the leg the record
-                # lists, why `resume` reads nothing of it, and the key order
-                # that is the cheap way back. Where SOME of its legs are read,
-                # the feature is not refused at all and the line is about the
-                # one leg that will not come back with it.
-                if [ "${feature_drops[seen_branches - 1]:-0}" -gt 0 ]; then
-                    where="the record does not say where"
-                    [ -z "$parked_on" ] || where="the record says $parked_on"
-                    # AND "BRINGS THE FEATURE BACK" IS NOT SAID OVER A
-                    # FEATURE THIS RUN ALREADY REFUSES (Copilot's first round
-                    # on this PR, suppressed). The legs it DOES read can carry
-                    # a whole-feature verdict of their own — `collect_legs`'s,
-                    # an RR's, or the `git worktree add`'s — and
-                    # `check_parked_leg` then prints that refusal on every one
-                    # of their lines and offers no `resume` at all. A line
-                    # here promising the feature back is the contradictory
-                    # pair the rule at the top of `check_parked_leg` forbids,
-                    # made by this layer against itself. The verdict is read
-                    # back in the order that arm reads it, and where there is
-                    # one the sentence says so and stops.
-                    verdict="${feature_why[seen_branches - 1]:-}"
-                    [ -n "$verdict" ] || verdict="${feature_rr[seen_branches - 1]:-}"
-                    [ -n "$verdict" ] || verdict="${feature_add[seen_branches - 1]:-}"
-                    if [ "${feature_legs[seen_branches - 1]:-0}" -eq 0 ]; then
-                        finding "parked feature $a: the record lists its $(record_unread_leg "${feature_drop_role[seen_branches - 1]:-}") where \`resume\` reads no leg, because $(record_unread_why "${feature_drop_why[seen_branches - 1]:-legs}"); \`resume\` collects NO leg for this feature and refuses it WHOLE, reporting it as a shape mismatch, so nothing here brings it back — $(record_unread_exits "${RECORD_FILE##*/}" "$where")"
-                    elif [ -n "$verdict" ]; then
-                        finding "parked feature $a: the record lists a $(record_unread_leg "${feature_drop_role[seen_branches - 1]:-}") for it where \`resume\` reads no leg, because $(record_unread_why "${feature_drop_why[seen_branches - 1]:-legs}"); \`resume\` refuses this feature WHOLE in any case, for the reason the legs it does read give on their own lines below, so nothing here brings it back — $(record_unread_exits "${RECORD_FILE##*/}" "$where")"
-                    else
-                        finding "parked feature $a: the record lists a $(record_unread_leg "${feature_drop_role[seen_branches - 1]:-}") for it where \`resume\` reads no leg, because $(record_unread_why "${feature_drop_why[seen_branches - 1]:-legs}"); \`resume\` brings the feature back with the legs it does read and leaves that one's work where it was parked — $(record_unread_exits "${RECORD_FILE##*/}" "$where")"
-                    fi
-                elif [ "${feature_legs[seen_branches - 1]:-0}" -eq 0 ]; then
-                    where="the record does not say where"
-                    [ -z "$parked_on" ] || where="the record says $parked_on"
-                    finding "parked feature $a: the record lists no leg for it; \`resume\` collects a feature's legs before it recreates anything and refuses the WHOLE feature where it finds none, reporting it as a shape mismatch, so nothing here brings it back — park that feature again from the workstation that has it ($where), which writes the record afresh with the legs it parks"
-                fi
-                ;;
-            # A `- branch:` THE LOADER MAKES NO FEATURE OF, which is the row
-            # `record_rows` emits in place of the `branch` row it used to
-            # emit for it. It is NOT counted, NOT added to the recorded set —
-            # a worktree on that branch really is one `park` has never
-            # recorded, and `park` reading this record through the same loader
-            # would park it as new — and it takes no leg row with it, because
-            # the legs under it were never emitted either. The second field is
-            # WHICH LINE TO GO AND FIND, as a `noleg` row's third is: a key at
-            # project indent that shut the list, or no `features:` key above
-            # the line at all.
-            nofeature)
-                where="the record does not say where"
-                [ -z "$parked_on" ] || where="the record says $parked_on"
-                if [ -z "$a" ]; then
-                    finding "parked feature with no branch name: the record lists a \`- branch:\` with no value where \`resume\` reads no feature, because $(record_unread_why "${b:-feature}"); it is in none of the features a bare \`resume\` walks, so nothing here brings it back — $(record_unread_exits "${RECORD_FILE##*/}" "$where")"
-                else
-                    finding "parked feature $a: the record lists this branch where \`resume\` reads no feature, because $(record_unread_why "${b:-feature}"); it is in none of the features a bare \`resume\` walks and none \`--feature\` can name, so nothing here brings it back — $(record_unread_exits "${RECORD_FILE##*/}" "$where")"
-                fi
-                ;;
-            # Counted in the first pass and said on the feature's own line
-            # above, where the count of the legs it DOES have decides what
-            # `resume` does with it.
-            noleg) ;;
-            leg)
-                # The legs of a feature with no branch name were answered on
-                # the feature's own line, above.
-                [ "$unnamed" -eq 0 ] || continue
-                # THE SAME GUARD THE FIRST PASS MAKES, for the same mangled
-                # record: a leg row before any branch row has no feature to
-                # take a verdict from, and `${feature_why[-1]}` is "bad array
-                # subscript" on bash 3.2 and the LAST feature's verdict on
-                # bash 5 — a clause about a feature this leg is no leg of
-                # (the independent review of this branch, 2026-09-12).
-                # THE RECORD THAT REACHED IT WAS THE ROW `record_rows` WAS
-                # DROPPING, and it drops it no longer: a leg row goes out only
-                # while a branch is open, `$named` is set by the very line
-                # that appends that branch's row, and the two are flushed in
-                # the record's order — so no record builds this shape now
-                # (Copilot's second round on #22). The guard stays as the belt
-                # to that brace, matching the first pass's, because an index
-                # this reader invents is a claim about a feature the record
-                # does not make.
-                refused=""; refused_kind=""; refused_exit=""; refused_leg=""
-                legno=$((legno + 1))
-                if [ "$seen_branches" -gt 0 ]; then
-                    refused="${feature_why[seen_branches - 1]:-}"
-                    # `collect_legs` BEFORE THE RRs, in the reading as in the
-                    # extension: it runs to the end before any RR does, so a
-                    # feature it refuses is refused for THAT whatever the legs
-                    # go on to say, and the RR verdict is read back only where
-                    # it found nothing. Which RR that verdict is, which leg it
-                    # belongs to and the exit that travels with it were all
-                    # decided in the pass above, in the record's order and in
-                    # `resume.sh`'s — RR6, then RR4 and RR3, then RR2, then
-                    # RR1 — so there is one verdict here and no priority left
-                    # to settle between readings.
-                    if [ -z "$refused" ] &&
-                        [ -n "${feature_rr[seen_branches - 1]:-}" ]; then
-                        refused="${feature_rr[seen_branches - 1]}"
-                        refused_kind="${feature_rr_kind[seen_branches - 1]}"
-                        refused_exit="${feature_exit[seen_branches - 1]}"
-                        refused_leg="${feature_rr_leg[seen_branches - 1]}"
-                    fi
-                    # AND THE ADD IS READ BACK LAST, because it runs last:
-                    # every RR of every leg is asked before the first worktree
-                    # is added, so any verdict above this one is the refusal
-                    # the run actually makes.
-                    if [ -z "$refused" ]; then
-                        refused="${feature_add[seen_branches - 1]:-}"
-                        refused_exit="${feature_addexit[seen_branches - 1]:-}"
-                        refused_leg="${feature_add_leg[seen_branches - 1]:-}"
-                        [ -z "$refused" ] || refused_kind=add
-                    fi
-                fi
-                check_parked_leg "$root" "$a" "$b" "$c" "$d" "$parked_at" "$parked_on" "$e" "$f" "$refused" "$refused_kind" "$refused_exit" "$legno" "$refused_leg"
-                ;;
-            esac
-        done <<<"$rows"
-        say "    parked record: $n_features feature(s), parked ${parked_at:-?} on ${parked_on:-?}${lane:+ (lane $lane)}${active:+; active $active}"
-    fi
-    unrecorded_worktrees "$root" "$recorded"
-}
-
-# --- one family laid out twice ----------------------------------------------
-#
-# A FAMILY FOLDER IS NAMED FOR ITS REPOSITORY OR FOR ITS DISPLAY `name:`
-# (#236), so ONE FAMILY CAN BE ON DISK TWICE - `Quill/Quill`, openRepoShape
-# v1.1.0's layout, and `QuillWorks/QuillWorks`, the one before it, which a
-# person has after resuming a record parked from one layout on a machine that
-# has the other. Each is found by its own name, as an estate of its own. They
-# are ONE RECORD: `park.sh` files a family under `family.yaml`'s `id:` and
-# merges each member's block by that member's own id, so a park from either
-# replaces the member blocks a park from the other one wrote (#243).
-# NOTHING DE-DUPLICATES THEM, deliberately: which copy holds the work is not
-# this command's to decide, and it moves nothing. The holder's row says so,
-# naming every folder of that id and the one to keep - the folder named for
-# the repository, v1.1.0's rule and where `make siblings` moves a holder
-# (opensoft/openRepoShape#543). `resume` refuses to choose between two such
-# holders for the same reason.
-read_family_layouts() {
-    local holder="$1" id folder folders="" count=0 keep="" keeps=0
-    yaml_scalar "$holder/family.yaml" id && [ -n "$YAML_VALUE" ] || return 0
-    id="$YAML_VALUE"
-    while IFS= read -r folder; do
-        [ -n "$folder" ] || continue
-        count=$((count + 1))
-        folders="${folders:+$folders and }$folder"
-        if named_for_repository "$folder"; then
-            keep="$folder"
-            keeps=$((keeps + 1))
-        fi
-    done < <(family_folders_with_id "$id")
-    [ "$count" -gt 1 ] || return 0
-    if [ "$keeps" -eq 1 ]; then
-        keep="Keep $keep, the folder named for its repository (openRepoShape v1.1.0's layout, where \`make siblings\` moves a holder)"
-    else
-        keep="Keep the one folder named for its repository's last part (openRepoShape v1.1.0's layout, where \`make siblings\` moves a holder)"
-    fi
-    finding "family \`$id\` is laid out $count times under the projects directory, at $folders: ONE record holds it, so a park from one replaces the member blocks a park from another wrote. $keep, and move the rest aside; nothing here moves either"
-}
-
-ESTATE_FINDINGS=0
-ESTATE_REPOS=0
-#: The footer's last clause, decided once by `--fetch`: what this run changed.
-CHANGED_CLAUSE="nothing was changed."
-
-# --- one estate -------------------------------------------------------------
-#
-# ESTATE_KIND / ESTATE_DIR / ESTATE_ROOT / ESTATE_NAME must already be set —
-# by `estate_walk_up`, `estate_by_name`, `clone_with_origin`, or, for the
-# sweep, a direct `estate_here` on a discovered child. RETURNS 1 when
-# anything was found and 0 when nothing was, so the sweep can carry on and
-# the single-estate call site can turn that straight into its exit code.
-read_one_estate() {
-    local label branch path current_root="" rel line rows
-    ESTATE_FINDINGS=0
-    ESTATE_REPOS=0
-    if [ "$ESTATE_KIND" = "family" ]; then
-        say "status: $ESTATE_NAME - the family holder at $ESTATE_ROOT"
-        say "  the members' working clones beside it, and their legs, are read too."
-    else
-        say "status: $ESTATE_NAME - the assembly root at $ESTATE_ROOT"
-    fi
-    if [ "$FETCH" -eq 1 ]; then
-        say "  fetched first (--fetch): origin — and upstream, where a fork has one — is asked in every repository below, then it is read."
-    else
-        say "  as of the last fetch: status reads local refs only and fetches nothing."
-    fi
-    # THE ROWS ARE READ ONCE and fetched in full before any of them is
-    # printed, so "then it is read" above is the order this runs in — the
-    # record layer included, which is read on the root's row and compares
-    # against commits the LEGS' origins hold.
-    rows="$(estate_repos)"
-    [ "$FETCH" -eq 0 ] || fetch_estate_first "$rows"
-    locate_record
-    if [ -n "$RECORD_FILE" ]; then
-        say "  parked record: $RECORD_FILE, as of its last pull"
-    else
-        say "  $RECORD_NOTE"
-    fi
-    say ""
-    while IFS=$'\t' read -r label branch path; do
-        [ -n "${path:-}" ] || continue
-        FINDINGS=()
-        FETCHED_OK=0
-        UPSTREAM_FETCHED_OK=0
-        ESTATE_REPOS=$((ESTATE_REPOS + 1))
-        case "$label" in
-        holder | root)
-            current_root="$path"
-            printf '  %-6s %-6s %s\n' "$label" "$branch" "$path"
-            replay_fetch "$path"
-            read_head "$path" "$branch"
-            read_tracking "$path" "$branch"
-            read_fork "$path" "$branch"
-            if [ "$label" = holder ]; then
-                read_shape "$path" family.yaml
-                read_family_layouts "$path"
-            elif [ "$ESTATE_KIND" = "family" ]; then
-                read_shape "$path" project.yaml
-                read_record "$path" "root=$ESTATE_NAME/${path##*/}"
-            else
-                read_shape "$path" project.yaml
-                read_record "$path" "id=$RECORD_ID" "root=$ESTATE_NAME"
-            fi
-            read_worktree_state "$path"
-            read_branches "$path" "$branch"
-            read_worktrees "$path"
-            ;;
-        mounted)
-            printf '  %-6s %-6s %s\n' "leg" "$branch" "$path"
-            replay_fetch "$path"
-            rel="${path#"$current_root"/}"
-            read_leg "$current_root" "$rel" "$branch"
-            read_fork "$path" "$branch"
-            ;;
-        unmounted)
-            printf '  %-6s %-6s %s\n' "leg" "$branch" "$path"
-            finding "declared in .gitmodules and not mounted (\`make bootstrap\` places it)"
-            ;;
-        missing)
-            printf '  %-6s %-6s %s\n' "root" "$branch" "$path"
-            finding "not here: no working clone beside the holder (\`resume $ESTATE_NAME\` places it)"
-            ;;
-        esac
-        if [ ${#FINDINGS[@]} -eq 0 ]; then
-            if [ "$label" = "mounted" ]; then
-                say "    at its pin, which is origin/$branch's tip as of the last fetch; clean"
-            else
-                say "    in sync with origin/$branch; clean"
-            fi
-        else
-            for line in "${FINDINGS[@]}"; do
-                say "    - $line"
-            done
-            ESTATE_FINDINGS=$((ESTATE_FINDINGS + ${#FINDINGS[@]}))
-        fi
-    done <<<"$rows"
-    say ""
-    if [ "$ESTATE_REPOS" -eq 1 ]; then
-        say "status: $ESTATE_NAME - $ESTATE_FINDINGS finding(s) in 1 repository; $CHANGED_CLAUSE"
-    else
-        say "status: $ESTATE_NAME - $ESTATE_FINDINGS finding(s) in $ESTATE_REPOS repositories; $CHANGED_CLAUSE"
-    fi
-    [ "$ESTATE_FINDINGS" -eq 0 ]
-}
-
-# --- every estate -----------------------------------------------------------
-
-# Every estate under the projects directory, `<name><TAB><dir>` per row, in
-# NAME order — `park`'s own discovery, spelled the same way and for the same
-# reason: `~/projects` and `~/Projects` can each hold estates when both
-# exist, and name order reads them together.
-all_estate_dirs() {
-    local dir child
-    for dir in "${PROJECTS_DIRS[@]}"; do
-        [ -d "$dir" ] || continue
-        for child in "$dir"/*; do
-            [ -d "$child" ] || continue
-            if is_family_folder "$child" || is_project_root "$child"; then
-                printf '%s\t%s\n' "${child##*/}" "$child"
-            fi
-        done
-    done | LC_ALL=C sort -t $'\t' -k1,1
-}
-
-# Read every estate in `$1`, in name order, and end with a summary. An estate
-# with findings does not stop the others being read; the exit code is 1 when
-# any had findings. NOTHING IS SKIPPED HERE: `park`'s sweep skips a root
-# without the Speckit overlay because there is nothing to RUN in it; there is
-# always something to read.
-status_every_estate() {
-    local rows="$1" name dir total=0 bad=0 estate_status line
-    local -a summary=()
-    while IFS=$'\t' read -r name dir; do
-        [ -n "$name" ] || continue
-        estate_here "$dir" || continue
-        say "=== status $ESTATE_NAME ==="
-        total=$((total + 1))
-        estate_status=0
-        read_one_estate || estate_status=$?
-        if [ "$estate_status" -eq 0 ]; then
-            summary+=("  in sync    $ESTATE_NAME")
-        else
-            summary+=("  findings   $ESTATE_NAME ($ESTATE_FINDINGS)")
-            bad=$((bad + 1))
-        fi
-        say ""
-    done <<<"$rows"
-    say "status: summary"
-    if [ ${#summary[@]} -gt 0 ]; then
-        for line in "${summary[@]}"; do
-            say "$line"
-        done
-    fi
-    say "status: $((total - bad)) estate(s) in sync, $bad with findings; $CHANGED_CLAUSE"
-    [ "$bad" -eq 0 ]
-}
-
-# --- arguments -------------------------------------------------------------
-
-# THE VALUE OF A VALUE-TAKING FLAG, in either spelling, read in ONE place so
-# that the ways of not giving one are ONE refusal. `flag_value "$@"` from an
-# arm sets `FLAG_VALUE` and `FLAG_SHIFT` — the arguments that arm then
-# consumes, 2 for `--flag value` and 1 for `--flag=value` — or it returns 1
-# with `FLAG_HINT` carrying whatever that refusal has to add. THE WORDS STAY
-# AT THE ARM: each flag says what its own value is, and this says only whether
-# one was given.
-# A VALUE BEGINNING WITH `-` IS NOT ONE in the spaced spelling — the hole #17
-# named and left open. `park Atlas --lane --dry-run` ran a REAL park with the
-# lane set to `--dry-run`: the flag a person typed was swallowed as a value,
-# `--dry-run` itself never took effect, and the only sign was a WIP commit
-# subject labelled with it. Nothing here swallows the next word whatever it
-# is, so that is a refusal.
-# `--flag=value` IS THE OTHER HALF, and the escape that refusing `-*` would
-# otherwise foreclose: a value that really does begin with `-` is spelled
-# `--lane=--weird`, which takes whatever follows the FIRST `=` and asks
-# nothing about it. An `=` with nothing after it is an empty value and is
-# refused as #17 refuses one.
-# BYTE-IDENTICAL IN `park`, `resume` AND `status`, held by
-# `tests/test_repo_hygiene.py` the way the estate resolver and `expand_home`
-# are: three files a person has on PATH, and one answer to what a flag's value
-# is.
-flag_value() {
-    FLAG_VALUE=""
-    FLAG_SHIFT=2
-    FLAG_HINT=""
-    case "$1" in
-    *=*)
-        FLAG_SHIFT=1
-        FLAG_VALUE="${1#*=}"
-        [ -n "$FLAG_VALUE" ] || return 1
-        return 0 ;;
-    esac
-    [ $# -ge 2 ] && [ -n "$2" ] || return 1
-    # THE NEXT ARGUMENT, ONLY IF IT CANNOT BE A FLAG. The hint names the `=`
-    # spelling because that is the whole exit: this refuses nothing a person
-    # cannot then say.
-    case "$2" in
-    -*)
-        FLAG_HINT="
-    \`$2\` begins with a \`-\`, so it is a flag and not this one's value:
-    nothing here swallows the next word whatever it is. A value that really
-    does begin with \`-\` is given after an \`=\`:
-
-      $1=$2"
-        return 1 ;;
-    esac
-    FLAG_VALUE="$2"
-}
-
-while [ $# -gt 0 ]; do
-    case "$1" in
-    -h | --help) usage; exit 0 ;;
-    -a | --all) STATUS_ALL=1; shift ;;
-    # A MISSING, EMPTY OR FLAG-SHAPED VALUE IS A REFUSAL, exit 2, in this
-    # command's own words: `${2:?…}` would be bash's message and bash's exit 1
-    # — and 1 is what this command means by "findings were printed", so a typo
-    # must not be able to read as a report.
-    # EMPTY IS REFUSED THE SAME WAY, and so is a flag where a value belongs:
-    # `flag_value` above asks all three questions once for both arms below,
-    # and each arm keeps its own words. THESE TWO WERE NEVER
-    # `${2:?…}`: they have been arity-only since this file's first commit, so
-    # when Copilot's review of #14 said that `[ $# -ge 2 ]` checks only that
-    # an argument slot exists — said of `park` and `resume`, which had just
-    # swapped `${2:?…}` for exactly that — `status` was not in front of it,
-    # and it kept the hole the other two then closed. It is the same hole:
-    # every value here is read further down as "was this given at all?", so
-    # `status --repo ""` fell past the `--repo` branch of the resolver into
-    # the walk-up and reported the estate around the cwd as though `--repo`
-    # had never been typed. A wrong answer is worse here than in either verb,
-    # not better: nothing was changed, so there is nothing to undo and no
-    # reason for anybody to look twice.
-    --repo | --repo=*)
-        flag_value "$@" ||
-            die "--repo needs a value: <owner>/<name>, or any url spelling of one.$FLAG_HINT"
-        REPO_SLUG="$FLAG_VALUE"; REPO_ARG="$REPO_SLUG"; shift "$FLAG_SHIFT" ;;
-    --name | --project | --name=* | --project=*)
-        flag_value "$@" ||
-            die "${1%%=*} needs a value: one estate folder name under your projects directory.$FLAG_HINT"
-        NAME="$FLAG_VALUE"; shift "$FLAG_SHIFT" ;;
-    # THE SECOND LAYER (Brett Heap's RULING of 2026-09-11, "next layer:
-    # --fetch"): ask origin in every repository first. See `fetch_remote`.
-    --fetch) FETCH=1; CHANGED_CLAUSE="only remote-tracking refs and fetched objects were changed (--fetch)."; shift ;;
-    -*)
-        usage >&2
-        die "$SELF_NAME does not know $1. Its flags are listed above; it takes nothing for
-    the extension, because it runs nothing."
-        ;;
-    *)
-        [ -z "$NAME" ] ||
-            die "two estate names, '$NAME' and '$1'. One positional <Name>, then flags."
-        NAME="$1"; shift ;;
-    esac
-done
-
-[ -z "$NAME" ] || [ -z "$REPO_SLUG" ] ||
-    die "both <Name> ('$NAME') and --repo '$REPO_SLUG'. One estate per run: name it
-    either way, not both."
-if [ "$STATUS_ALL" -eq 1 ]; then
-    [ -z "$NAME" ] ||
-        die "both <Name> ('$NAME') and --all. \`--all\` reads EVERY estate under your
-    projects directory; <Name> reads one. Drop one of them."
-    [ -z "$REPO_SLUG" ] ||
-        die "both --repo '$REPO_ARG' and --all. \`--all\` reads EVERY estate under your
-    projects directory; \`--repo\` reads the one that clone belongs to. Drop one
-    of them."
-fi
-
-# GIT IS THE WHOLE MECHANISM, and every call below is `|| true`-guarded so a
-# missing ref reads as a finding rather than a crash — which means a git that
-# cannot run AT ALL would otherwise be reported as an estate with no commits,
-# no branches and no legs, exit 1, and no line saying nothing was read.
-# `--no-optional-locks` is git 2.15 (2017) and is what makes this command take
-# no lock, so a git that does not know it is refused BY NAME rather than
-# answered wrongly. `--help` has already exited above and needs neither.
-command -v git >/dev/null 2>&1 ||
-    die "no \`git\` on PATH, so nothing can be read."
-git --no-optional-locks --version >/dev/null 2>&1 ||
-    die "this \`git\` does not know \`--no-optional-locks\` (git 2.15, 2017), which is
-    what stops \`$SELF_NAME\` taking a lock on a repository somebody else is using.
-    Upgrade git and re-run; every answer here would otherwise be read off a git
-    that refused every command."
-
-# --- resolve ---------------------------------------------------------------
-if [ "$STATUS_ALL" -eq 1 ]; then
-    ALL_ROWS="$(all_estate_dirs)"
-    [ -n "$ALL_ROWS" ] ||
-        die "--all found no estate under ${PROJECTS_DIRS[*]}, so nothing was read.
-    An estate is a FAMILY folder (<Name>/<Name>/family.yaml) or a standalone
-    project root (<Name>/project.yaml), one level under your projects
-    directory; \`resume <Name>\` brings one back."
-    say "status --all: reading every estate under ${PROJECTS_DIRS[*]}:"
-    say ""
-    say "$(estates_or_none)"
-    say ""
-elif [ -n "$REPO_SLUG" ]; then
-    # ANY SPELLING A PERSON MIGHT PASTE, through the same reader that reads a
-    # clone's `origin` — `park`'s rule, for `park`'s reasons.
-    REPO_SLUG="$(repo_slug_of "$REPO_SLUG" || true)"
-    [ -n "$REPO_SLUG" ] || die "--repo '$REPO_ARG' is not a repository: it wants <owner>/<name>, or any
-    url spelling of one (https://…/<owner>/<name>.git, git@host:<owner>/<name>).
-    A family's members may live in another organisation, so there is no owner
-    to assume, and a path on disk has none to read."
-    MATCH="$(clone_with_origin "$REPO_SLUG" || true)"
-    [ -n "$MATCH" ] || die "no clone under your projects directory has origin $REPO_SLUG.
-    \`--repo\` names a clone you ALREADY HAVE; nothing here clones one. Bring the
-    estate back with \`resume <Name>\`, or read one of these:
-
-$(estates_or_none)"
-    estate_walk_up "$MATCH" ||
-        die "$MATCH is a clone of $REPO_SLUG, but nothing at or above it is an
-    estate: no \`family.yaml\` holder beside it and no \`project.yaml\` root. It
-    is a clone, not a project of this shape."
-elif [ -n "$NAME" ]; then
-    is_safe_folder_name "$NAME" ||
-        die "'$NAME' is not an estate name: it is a path, or it carries a
-    character an estate folder may not. <Name> is ONE folder name under your
-    projects directory — no slash, no leading dot. To read a checkout
-    somewhere else, stand in it and run \`$SELF_NAME\` with no <Name>."
-    estate_by_name "$NAME" || die "no estate named '$NAME' under your projects directory.
-    An estate is a FAMILY folder ($NAME/$NAME/family.yaml) or a standalone
-    project root ($NAME/project.yaml). Bring it back with \`resume $NAME\`, or
-    read one of these:
-
-$(estates_or_none)"
-else
-    # THE WALK-UP WINS FIRST, as it does for `park`: standing inside an estate
-    # reads THAT estate. Outside every estate, every estate is read — WITHOUT
-    # the question `park` asks, because a read changes nothing and the
-    # answer to "which estate did you mean" is, for a report, all of them.
-    if ! estate_walk_up "$PWD"; then
-        ALL_ROWS="$(all_estate_dirs)"
-        [ -n "$ALL_ROWS" ] ||
-            die "no estate around $PWD, no <Name> was given, and there is no estate under
-    ${PROJECTS_DIRS[*]} at all, so there is nothing to read. An estate is a
-    FAMILY folder (<Name>/<Name>/family.yaml) or a standalone project root
-    (<Name>/project.yaml), one level under your projects directory;
-    \`resume <Name>\` brings one back."
-        STATUS_ALL=1
-        say "status: no estate around $PWD; reading every estate under ${PROJECTS_DIRS[*]}:"
-        say ""
-        say "$(estates_or_none)"
-        say ""
-    fi
-fi
-
-if [ "$STATUS_ALL" -eq 1 ]; then
-    STATUS=0
-    status_every_estate "$ALL_ROWS" || STATUS=$?
-    exit "$STATUS"
-fi
-
-STATUS=0
-read_one_estate || STATUS=$?
-exit "$STATUS"
diff --git a/tests/conftest.py b/tests/conftest.py
deleted file mode 100644
index 83411240..00000000
--- a/tests/conftest.py
+++ /dev/null
@@ -1,628 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Shared fixtures, and the one thing this suite needs that it does not ship.
-
-NO NETWORK AND NO GITHUB. Every test here runs `park`, `resume` or
-`openRepoTools` against BARE REPOSITORIES IN A TEMPORARY DIRECTORY, a fake
-`$HOME`, and — where a fetch is under test — a fake `gh` first on `$PATH` with
-a `curl` that refuses. Nothing in this suite may create a real repository; if a
-test ever needs a real `gh`, it is the wrong test.
-
-THE STANDARD IS MOUNTED, NOT COPIED. `tests/test_park_resume_commands.py`
-builds estates out of eight of openRepoShape's own files, and it reads them out
-of the `upstream/openRepoShape` submodule this repository pins in
-`contracts/openreposhape-pin.yaml`. A clone made WITHOUT `--recurse-submodules`
-therefore has no template bytes to copy — so those tests SKIP, naming the one
-command that fixes it. They never fail: a fork's first `pytest` going red on a
-missing submodule is a fork nobody finishes.
-
-FOUR ROOTS, NAMED RATHER THAN ASSUMED (opensoft/openRepoTools#186, T009 of
-`specs/004-migrate-to-triad/tasks.md`). Today this repository is one tree and
-every path the suite reads hangs off it. Adopted into the triad it is three:
-the ASSEMBLY root (`README.md`, `AGENTS.md`, `CLAUDE.md`, the pins), the SPEC
-leg (`docs/`, `openspec/`, `specs/`) and the CODE leg (every command, `tests/`,
-`.gitmodules`, `contracts/openreposhape-pin.yaml`), with the DEPENDENCY,
-`upstream/openRepoShape`, nested in the code leg. `ROOTS` below is the one
-place that says which tree is which for this run, and `ROOTS.path_for(<rel>)`
-is how a test reads a file from the root that owns it. Two modes:
-
-  * STANDALONE (the default, and the only mode today's layout has): a root
-    this checkout does not carry is SKIPPED, naming it — the same courtesy the
-    missing submodule gets, and on today's layout nothing new skips, because
-    the one tree is all four roots at once.
-  * COMPOSED (`OPENREPOTOOLS_COMPOSED=1`, the assembly's exact-pin job): the
-    run is a claim about the whole arrangement, so a missing assembly, spec or
-    dependency root — or a code or spec leg that is not at the commit the
-    assembly pins — REFUSES the session before a test runs, and a test that
-    reaches an absent root FAILS. Nothing skips its way into composed
-    acceptance (FR-008).
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-from typing import Dict, List, Mapping, Optional, Tuple
-
-import pytest
-
-#: THE TREE THIS SUITE WAS LOADED FROM, which is the code root unless
-#: `OPENREPOTOOLS_CODE_ROOT` names another one.
-SUITE_ROOT = Path(__file__).resolve().parents[1]
-
-#: The four variables a caller names the roots and the mode with. `tests/run.sh`
-#: passes them through, made absolute against the directory it was run from.
-ENV_CODE_ROOT = "OPENREPOTOOLS_CODE_ROOT"
-ENV_ASSEMBLY_ROOT = "OPENREPOTOOLS_ASSEMBLY_ROOT"
-ENV_SPEC_ROOT = "OPENREPOTOOLS_SPEC_ROOT"
-ENV_COMPOSED = "OPENREPOTOOLS_COMPOSED"
-
-#: WHERE EACH FILE LIVES, by the adoption mapping's placement table
-#: (`specs/004-migrate-to-triad/plan.md`, "Target placement"): the front-door
-#: documents are the assembly's and the spec trees are the spec leg's.
-#: Everything else is the code leg's — and that includes `.gitattributes`,
-#: DELIBERATELY: the placement table puts it at the assembly, but git reads a
-#: submodule's attributes from the submodule's own tree, so the line-ending
-#: rule protects the bash files only where the bash files are. Reading it from
-#: the assembly would pass while the code leg's checkout went unprotected.
-#: `LICENSE` and `.gitignore` are the code root's for the same kind of reason:
-#: the placement table puts them at the assembly, but T006's `code-0001` gives
-#: the code leg its own copy of each, and the leg's copy is the one that governs
-#: the leg's files (#193 item 7). No test reads either today.
-GUIDANCE_DOCUMENTS = ("README.md", "AGENTS.md", "CLAUDE.md")
-SPEC_TREES = ("docs", "openspec", "specs", "ideation")
-
-#: TODAY'S SINGLE REPOSITORY CARRIES THE CANONICAL SPEC TREES BESIDE THE CODE,
-#: and a code leg never does (FR-006 puts every full proposal and every
-#: canonical spec in the spec leg). So a code root holding either IS the
-#: single-repository layout, whose one tree is assembly, spec and code at once
-#: — decided by the trees and never by the documents, so a deleted README there
-#: is a failure and not a skip.
-SINGLE_REPOSITORY_MARKERS = ("openspec", "specs")
-
-#: What makes a directory the root it is claimed to be. A variable that names
-#: a tree without these is refused, in either mode: it names the wrong tree.
-CODE_MARKERS = ("openRepoTools", "contracts/openreposhape-pin.yaml")
-ASSEMBLY_MARKERS = ("contracts/code-pin.yaml", "project.yaml")
-
-#: The dependency, nested in the code leg, and the files the suite's skips
-#: probe for: `scripts/repo_shape.py` is `NEEDS_UPSTREAM`'s below and
-#: `templates/workspace-root/README.md` is `test_wip_init_command.py`'s. A
-#: composed run needs both, because either one missing is a skip.
-DEPENDENCY_PATH = "upstream/openRepoShape"
-
-#: THE PAIRED LAYOUT. A feature is worked in `<assembly>/worktrees/<feature>/`,
-#: a worktree of each leg named like that leg's mount (`code/`, `spec/`) and
-#: never committed in the assembly (T006's root guidance and the code leg's own
-#: AGENTS.md). A code root there belongs to that assembly as surely as the
-#: mounted one does, so it is found there too (#193 item 5).
-PAIRED_WORKTREES = "worktrees"
-DEPENDENCY_PROBE = "scripts/repo_shape.py"
-DEPENDENCY_PROBES = (DEPENDENCY_PROBE, "templates/workspace-root/README.md")
-
-
-def _absolute(value: str) -> Path:
-    path = Path(os.path.expanduser(value))
-    if not path.is_absolute():
-        path = Path.cwd() / path
-    return path.resolve()
-
-
-def _same(a: Path, b: Path) -> bool:
-    try:
-        return a.resolve() == b.resolve()
-    except OSError:
-        return False
-
-
-def _git_out(cwd: Path, *args: str) -> Optional[str]:
-    """`git <args>` in `cwd`, its stdout stripped, or None if it failed."""
-    try:
-        proc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True,
-                              text=True, check=False)
-    except OSError:
-        return None
-    return proc.stdout.strip() if proc.returncode == 0 else None
-
-
-def _gitlink(repository: Path, rel: str) -> Optional[str]:
-    """The commit `repository`'s HEAD records at `rel`, if it is a gitlink."""
-    row = _git_out(repository, "ls-tree", "HEAD", "--", rel)
-    if not row:
-        return None
-    meta = row.split("\t", 1)[0].split(" ")
-    if len(meta) != 3 or meta[0] != "160000" or meta[1] != "commit":
-        return None
-    return meta[2]
-
-
-def _scalar(path: Path, key: str) -> Optional[str]:
-    """`<key>: <value>` at column 0 of a flat pin or manifest file, with its
-    comment and quotes stripped. The pins are a fixed grammar written by one
-    tool, so a reader of one key is all this needs (no YAML dependency)."""
-    try:
-        text = path.read_text(encoding="utf-8")
-    except OSError:
-        return None
-    for raw in text.splitlines():
-        if raw.startswith(key + ":"):
-            value = raw[len(key) + 1:].split("#", 1)[0].strip()
-            return value.strip('"').strip("'") or None
-    return None
-
-
-def _carries(root: Path, names) -> bool:
-    """Every marker is a REGULAR FILE under `root`. Each marker is one (a
-    command, a pin, a manifest), so a directory spelled like one is not it:
-    with `exists()`, a tree holding a directory named `openRepoTools` or
-    `project.yaml` passed for a root and failed later in unrelated tests
-    (Copilot on #190, #193 item 4)."""
-    return all((root / name).is_file() for name in names)
-
-
-def _carries_a_spec_tree(root: Path) -> bool:
-    return root.is_dir() and any((root / name).is_dir() for name in SPEC_TREES)
-
-
-def _mount(assembly: Path, role: str) -> str:
-    """Where the assembly mounts a leg: its pin's `submodule_path:`."""
-    return _scalar(assembly / "contracts" / f"{role}-pin.yaml",
-                   "submodule_path") or role
-
-
-def _own_repository_holding(root: Path, commit: str) -> bool:
-    """`root` is a repository's own top level, and its object store holds
-    `commit`: a worktree or clone of the leg the assembly pins, not a
-    directory that merely sits where one would."""
-    top = _git_out(root, "rev-parse", "--show-toplevel")
-    return bool(top and _same(Path(top), root)) and _git_out(
-        root, "cat-file", "-e", f"{commit}^{{commit}}") is not None
-
-
-def _paired_with(assembly: Path, code: Path, recorded: str) -> bool:
-    """Whether `code` is a paired feature worktree of `assembly`'s code leg:
-    `<assembly>/worktrees/<feature>/<the code mount's own name>`, a repository
-    of its own, whose object store holds the commit the assembly pins. That
-    last check is what keeps a checkout that merely sits there from being
-    taken for the leg."""
-    mount = _mount(assembly, "code")
-    return (_same(code.parent.parent, assembly / PAIRED_WORKTREES)
-            and code.name == Path(mount).name
-            and _own_repository_holding(code, recorded))
-
-
-def discover_assembly(code: Path) -> Optional[Path]:
-    """The nearest directory above `code` that carries the assembly's pins and
-    manifest, is its repository's top level, records a gitlink where its code
-    pin names, AND holds `code` in one of the two designed places: mounted at
-    that gitlink, or as a paired feature worktree
-    (`<assembly>/worktrees/<feature>/code`). Anything else is None, which is
-    today's layout and a standalone code clone alike.
-
-    An ancestor that carries the markers but fails the rest is SKIPPED, not
-    the end of the search: a stale `project.yaml` and `contracts/code-pin.yaml`
-    under a feature directory must not hide the assembly above it (Copilot
-    round 2 on #195). Skipping cannot borrow an unrelated tree, because
-    acceptance is still one of the two exact placements."""
-    code = code.resolve()
-    for candidate in code.parents:
-        if not _carries(candidate, ASSEMBLY_MARKERS):
-            continue
-        mount = _mount(candidate, "code")
-        top = _git_out(candidate, "rev-parse", "--show-toplevel")
-        recorded = _gitlink(candidate, mount)
-        if not (top and _same(Path(top), candidate) and recorded):
-            continue
-        if _same(candidate / mount, code) or _paired_with(candidate, code, recorded):
-            return candidate
-    return None
-
-
-class Roots:
-    """The code, assembly, spec and dependency roots of one run, and its mode."""
-
-    def __init__(self, code: Path, assembly: Optional[Path],
-                 spec: Optional[Path], composed: bool,
-                 how: Dict[str, str], problems: List[str],
-                 rejected: Optional[Dict[str, str]] = None) -> None:
-        self.code = code
-        self.assembly = assembly
-        self.spec = spec
-        self.dependency = code / DEPENDENCY_PATH
-        self.composed = composed
-        self.how = how
-        self.problems = problems
-        #: A root a variable NAMED and this run refused, by role, with the
-        #: value as it was given: an absent root that was named is absent for
-        #: that reason, never because its variable "is unset" (#193 item 15).
-        self.rejected = dict(rejected or {})
-        #: `single` — today's one tree; `leg` — a code leg, standalone or
-        #: mounted. Decided by the code root alone; the assembly and spec
-        #: roots are found, or named, independently of it.
-        self.layout = ("single" if any((code / name).is_dir()
-                                       for name in SINGLE_REPOSITORY_MARKERS)
-                       else "leg")
-
-    # --- which root a file is read from ------------------------------------
-
-    def owner_of(self, rel: str) -> str:
-        rel = rel.replace("\\", "/")
-        if rel in GUIDANCE_DOCUMENTS:
-            return "assembly"
-        if "/" in rel and rel.split("/", 1)[0] in SPEC_TREES:
-            return "spec"
-        return "code"
-
-    def root_of(self, role: str) -> Optional[Path]:
-        """The tree that answers for `role` in this run. On today's layout the
-        code root answers for all three; in a leg, only what is there."""
-        if role == "code":
-            return self.code
-        found = self.assembly if role == "assembly" else self.spec
-        if found is not None:
-            return found
-        return self.code if self.layout == "single" else None
-
-    def path_for(self, rel: str) -> Path:
-        """`rel` in the root that owns it. Where that root is absent this SKIPS
-        the calling test — or, composed, FAILS it — naming the root."""
-        role = self.owner_of(rel)
-        root = self.root_of(role)
-        if root is None:
-            self.need(role, rel)
-        return root / rel
-
-    def why_absent(self, role: str) -> str:
-        if role in self.rejected:
-            variable = ENV_ASSEMBLY_ROOT if role == "assembly" else ENV_SPEC_ROOT
-            kind = "an assembly root" if role == "assembly" else "a spec root"
-            return (f"{variable} names {self.rejected[role]}, which is not "
-                    f"{kind}, and a named root is never replaced by a found one")
-        if role == "assembly":
-            return (f"no {ENV_ASSEMBLY_ROOT}, and no directory above {self.code} "
-                    f"carries {' and '.join(ASSEMBLY_MARKERS)} mounting it")
-        if self.assembly is not None:
-            return (f"the assembly's spec leg {self.assembly / _mount(self.assembly, 'spec')} "
-                    f"is not checked out, and {ENV_SPEC_ROOT} is unset")
-        return f"no {ENV_SPEC_ROOT}, and no assembly root to find a spec leg in"
-
-    def need(self, role: str, rel: str):
-        """The outcome of a test that reached a root this run does not have."""
-        why = self.why_absent(role)
-        if self.composed:
-            pytest.fail(f"{ENV_COMPOSED}=1 and {rel} is the {role} root's, which "
-                        f"is absent: {why}", pytrace=False)
-        pytest.skip(f"{rel} is the {role} root's, and this standalone code "
-                    f"checkout has none ({why}); the composed run "
-                    f"({ENV_COMPOSED}=1 from the assembly root) reads it")
-
-    def code_mount(self) -> Optional[str]:
-        """Where this run's assembly mounts the code leg (its code pin's
-        `submodule_path:`), or None where there is no assembly root: the
-        prefix a path in the assembly's documents carries to reach the code
-        leg (#193 item 14)."""
-        return None if self.assembly is None else _mount(self.assembly, "code")
-
-    def tracked_roots(self) -> List[Tuple[str, Path]]:
-        """Every distinct repository this run can read, code first."""
-        out: List[Tuple[str, Path]] = []
-        for role in ("code", "assembly", "spec"):
-            root = self.root_of(role)
-            if root is not None and not any(_same(root, seen) for _, seen in out):
-                out.append((role, root))
-        return out
-
-    # --- the dependency ------------------------------------------------------
-
-    def dependency_initialized(self, probes=DEPENDENCY_PROBES) -> bool:
-        return all((self.dependency / probe).is_file() for probe in probes)
-
-    # --- the composed contract -----------------------------------------------
-
-    def _leg_at_its_pin(self, role: str, root: Path) -> List[str]:
-        assert self.assembly is not None
-        mount = _mount(self.assembly, role)
-        recorded = _gitlink(self.assembly, mount)
-        if recorded is None:
-            return [f"the assembly root {self.assembly} records no gitlink at "
-                    f"{mount!r}, which contracts/{role}-pin.yaml names"]
-        # THE PIN AND THE GITLINK ARE ONE INVARIANT (the lockstep rule
-        # `scripts/validate-pins.py` holds). A pin naming another commit than
-        # the gitlink is drift even where the gitlink and the leg's HEAD agree,
-        # so it is refused here too and not only by the validator the assembly
-        # job runs first (Copilot on #190, #193 item 4). The tree digest stays
-        # the validator's: it needs the leg's object store, not this check.
-        pinned = (_scalar(self.assembly / "contracts" / f"{role}-pin.yaml",
-                          "commit") or "").lower()
-        if pinned != recorded:
-            return [f"contracts/{role}-pin.yaml pins {pinned or 'no commit'}, "
-                    f"and the assembly root {self.assembly} records {recorded} "
-                    f"at {mount!r}: the pin and the gitlink are one invariant "
-                    f"(scripts/validate-pins.py calls this pin-gitlink-mismatch), "
-                    f"and composed acceptance refuses a pin that names another "
-                    f"commit"]
-        head = _git_out(root, "rev-parse", "HEAD")
-        if head != recorded:
-            return [f"the {role} root {root} is at {head or 'no commit'}, and the "
-                    f"assembly root records {recorded} at {mount!r}: composed "
-                    f"acceptance is for the pinned {role} leg and no other"]
-        dirty = _git_out(root, "status", "--porcelain", "--untracked-files=no")
-        if dirty is None:
-            return [f"the {role} root {root} answered no `git status` (a corrupt "
-                    f"index, a lock, no repository): whether its tracked files "
-                    f"are the pinned bytes cannot be read, and composed "
-                    f"acceptance refuses what it cannot read"]
-        if dirty:
-            return [f"the {role} root {root} has changes to tracked files "
-                    f"({dirty.splitlines()[0].strip()} …): composed acceptance is "
-                    f"for the committed bytes the pin names"]
-        return []
-
-    def absent(self) -> List[str]:
-        """What a composed run is missing, one line per context."""
-        lines: List[str] = []
-        if self.assembly is None:
-            lines.append(f"the ASSEMBLY root is absent: {self.why_absent('assembly')}")
-        else:
-            lines += self._leg_at_its_pin("code", self.code)
-        if self.spec is None:
-            lines.append(f"the SPEC root is absent: {self.why_absent('spec')}")
-        elif self.assembly is not None:
-            lines += self._leg_at_its_pin("spec", self.spec)
-        if not self.dependency_initialized():
-            missing = [p for p in DEPENDENCY_PROBES
-                       if not (self.dependency / p).is_file()]
-            lines.append(f"the DEPENDENCY {self.dependency} is not initialized "
-                         f"(no {', '.join(missing)}): run `git submodule update "
-                         f"--init --recursive` from the assembly root")
-        return lines
-
-    def refusal(self) -> Optional[str]:
-        """Why this run must not start: a variable naming the wrong tree (either
-        mode), or a composed run missing a context. None when it may run."""
-        lines = list(self.problems)
-        if self.composed:
-            lines += self.absent()
-        if not lines:
-            return None
-        head = ("openRepoTools test roots: " if not self.composed else
-                f"openRepoTools composed run ({ENV_COMPOSED}=1) refused — it "
-                f"never skips its way to acceptance: ")
-        return head + "; ".join(lines)
-
-    def redirected(self) -> bool:
-        """Whether this run's roots are anything but today's one tree taken as
-        it stands: a root named by a variable, an assembly found, a leg, or the
-        composed mode."""
-        return bool(self.how) or self.layout != "single" or self.composed
-
-    def describe(self) -> List[str]:
-        """The roots, one line each, for the report header."""
-        lines = [f"openRepoTools test roots: "
-                 f"{'COMPOSED' if self.composed else 'standalone'}, "
-                 f"{self.layout} layout"]
-        for role in ("code", "assembly", "spec"):
-            root = self.root_of(role)
-            if root is None:
-                lines.append(f"  {role}: absent")
-                continue
-            how = self.how.get(role) or (
-                "default" if role == "code" else "the code root: today's single tree")
-            lines.append(f"  {role}: {root} ({how})")
-        state = "initialized" if self.dependency_initialized() else "NOT initialized"
-        lines.append(f"  dependency: {self.dependency} ({state})")
-        return lines
-
-
-def resolve_roots(environ: Mapping[str, str], suite_root: Path) -> Roots:
-    """The roots `environ` names, else the ones the layout around `suite_root`
-    has. Pure apart from reading the disk and git, so the suite can ask it about
-    a fixture layout as well as about itself."""
-    problems: List[str] = []
-    how: Dict[str, str] = {}
-    rejected: Dict[str, str] = {}
-
-    composed_value = environ.get(ENV_COMPOSED, "")
-    if composed_value not in ("", "0", "1"):
-        problems.append(f"{ENV_COMPOSED}={composed_value!r} is neither 1 "
-                        f"(composed) nor 0 or unset (standalone)")
-    composed = composed_value == "1"
-
-    code = suite_root.resolve()
-    named = environ.get(ENV_CODE_ROOT, "")
-    if named:
-        candidate = _absolute(named)
-        if candidate.is_dir() and _carries(candidate, CODE_MARKERS):
-            code, how["code"] = candidate, ENV_CODE_ROOT
-        else:
-            problems.append(f"{ENV_CODE_ROOT}={named} is not a code root: it "
-                            f"carries no {' and '.join(CODE_MARKERS)}")
-
-    assembly: Optional[Path] = None
-    named = environ.get(ENV_ASSEMBLY_ROOT, "")
-    if named:
-        candidate = _absolute(named)
-        if candidate.is_dir() and _carries(candidate, ASSEMBLY_MARKERS):
-            assembly, how["assembly"] = candidate, ENV_ASSEMBLY_ROOT
-        else:
-            rejected["assembly"] = named
-            problems.append(f"{ENV_ASSEMBLY_ROOT}={named} is not an assembly "
-                            f"root: it carries no {' and '.join(ASSEMBLY_MARKERS)}")
-    else:
-        assembly = discover_assembly(code)
-        if assembly is not None:
-            how["assembly"] = (
-                "found above the code root, which it mounts"
-                if _same(assembly / _mount(assembly, "code"), code) else
-                "found above the code root, a paired feature worktree of its code leg")
-
-    spec: Optional[Path] = None
-    named = environ.get(ENV_SPEC_ROOT, "")
-    if named:
-        candidate = _absolute(named)
-        if _carries_a_spec_tree(candidate):
-            spec, how["spec"] = candidate, ENV_SPEC_ROOT
-        else:
-            rejected["spec"] = named
-            problems.append(f"{ENV_SPEC_ROOT}={named} is not a spec root: it "
-                            f"carries none of {', '.join(SPEC_TREES)}")
-    elif assembly is not None:
-        # A paired feature's own spec worktree, beside its code worktree, is
-        # that feature's spec root, held to the same proof as the paired code
-        # worktree: a repository of its own holding the spec commit the
-        # assembly pins. A stray `docs/` there is not it (Copilot round 2 on
-        # #195), and the assembly's mounted spec leg is read instead.
-        spec_mount = _mount(assembly, "spec")
-        paired = code.parent / Path(spec_mount).name
-        spec_pin = _gitlink(assembly, spec_mount)
-        if (_same(code.parent.parent, assembly / PAIRED_WORKTREES)
-                and _carries_a_spec_tree(paired) and spec_pin
-                and _own_repository_holding(paired, spec_pin)):
-            spec, how["spec"] = paired, "the paired spec worktree beside the code root"
-        else:
-            candidate = assembly / _mount(assembly, "spec")
-            if _carries_a_spec_tree(candidate):
-                spec, how["spec"] = candidate, "the assembly's spec leg"
-
-    return Roots(code, assembly, spec, composed, how, problems, rejected)
-
-
-#: THIS RUN'S ROOTS. Module-level names below are its fields, so the modules
-#: that import `REPO` and `UPSTREAM` read the code root and its dependency
-#: whatever the layout.
-ROOTS = resolve_roots(os.environ, SUITE_ROOT)
-CODE_ROOT = ROOTS.code
-ASSEMBLY_ROOT = ROOTS.assembly
-SPEC_ROOT = ROOTS.spec
-DEPENDENCY_ROOT = ROOTS.dependency
-COMPOSED = ROOTS.composed
-
-#: `REPO` is the CODE root: every module that reads a command, a test or a pin
-#: through it keeps reading the code leg's copy, which is what it always meant.
-#: A document the assembly or the spec leg owns is read through
-#: `ROOTS.path_for(<rel>)` instead.
-REPO = CODE_ROOT
-
-
-def pytest_configure(config):
-    """REFUSE BEFORE THE FIRST TEST, naming every missing or misnamed root.
-
-    A `UsageError` is pytest's own refusal (exit 4, `ERROR: <why>`), which is
-    what a composed run that cannot be the claim it makes should be: not a
-    session of skips that exits 0."""
-    refusal = ROOTS.refusal()
-    if refusal:
-        raise pytest.UsageError(refusal)
-
-
-def pytest_report_header(config):
-    return ROOTS.describe()
-
-
-def pytest_terminal_summary(terminalreporter, exitstatus, config):
-    """THE ROOTS A RUN USED, WHERE `-q` CANNOT HIDE THEM (#193 item 6).
-
-    `OPENREPOTOOLS_CODE_ROOT` re-points `REPO` and `UPSTREAM`, and
-    `OPENREPOTOOLS_ASSEMBLY_ROOT` decides which README, AGENTS.md and length
-    caps are held. The report header says so, but `-q` drops the header, and
-    every CI job and `tests/run.sh` run `-q`. So a run whose roots are not
-    today's one tree says them again at its foot, which `-q` keeps. Today's
-    layout with no variable prints nothing here: its output is unchanged."""
-    if ROOTS.redirected():
-        terminalreporter.write_sep("-", "openRepoTools test roots")
-        for line in ROOTS.describe():
-            terminalreporter.write_line(line)
-
-#: AMENDMENT 14 — NO TEST NUDGES AN INSTALLED INDEXER BY ACCIDENT. Every
-#: `lanes-edit.sh` write that pushes starts a detached `lanes-index sync`
-#: wherever one is on PATH, and several suites here run with the workstation's
-#: own PATH behind their fakes: the day a person installs `lanes-index`, those
-#: writes would start one each. Off for the whole run; `tests/test_lanes_index.py`
-#: builds every environment it runs from scratch and decides for itself.
-os.environ["LANES_INDEX"] = "off"
-
-#: opensoft/openRepoTools#162 — and no `lane-start` a test runs starts the
-#: estate's daily report: it is detached, it reads the whole estate, and the
-#: state directory it stamps may be the workstation's own.
-os.environ["LANE_WORKTREES_REPORT"] = "off"
-
-#: The pinned openRepoShape checkout: the DEPENDENCY root, nested in the code
-#: root. Every path this suite reads out of the standard hangs off this one
-#: name, so a bump of the pin moves one line in
-#: `contracts/openreposhape-pin.yaml` and the gitlink beside it, and nothing
-#: here.
-UPSTREAM = DEPENDENCY_ROOT
-
-#: THE TESTS THAT NEED THE STANDARD'S REAL BYTES. `scripts/repo_shape.py` is
-#: the probe rather than the directory itself, because `git clone` without
-#: `--recurse-submodules` leaves an EMPTY `upstream/openRepoShape/` behind —
-#: the directory exists and holds nothing, so `is_dir()` would answer yes and
-#: the tests would fail on a missing file instead of skipping.
-#:
-#: STANDALONE, THAT SKIP IS EXACTLY TODAY'S — the same condition and the same
-#: reason, which is what the `tests-no-submodule` job asserts. COMPOSED, the
-#: mark is the `required_dependency` fixture instead, which FAILS: a composed
-#: session without the dependency is refused before it starts, and this is the
-#: same rule held at the test, where a `--noconftest` run cannot route round it
-#: (the fixture is then not found, which is an error and not a skip either).
-_DEPENDENCY_SKIP_REASON = ("the pinned openRepoShape is not checked out; "
-                           "run `git submodule update --init upstream/openRepoShape`")
-if COMPOSED:
-    NEEDS_UPSTREAM = pytest.mark.usefixtures("required_dependency")
-else:
-    NEEDS_UPSTREAM = pytest.mark.skipif(
-        not (UPSTREAM / DEPENDENCY_PROBE).is_file(),
-        reason=_DEPENDENCY_SKIP_REASON)
-
-
-@pytest.fixture
-def required_dependency():
-    """`NEEDS_UPSTREAM` in a composed run: the dependency is there, or the test
-    fails naming it."""
-    if not (UPSTREAM / DEPENDENCY_PROBE).is_file():
-        pytest.fail(f"{ENV_COMPOSED}=1 and the dependency {UPSTREAM} is not "
-                    f"initialized; {_DEPENDENCY_SKIP_REASON}", pytrace=False)
-
-#: THE TESTS THAT CANNOT RUN ON WINDOWS. Two shapes of test wear this: one that
-#: runs `bash`, and one that puts a `#!`-shebang script named `gh` on PATH and
-#: expects the operating system to execute it. Windows has neither — `bash.exe`
-#: IS on the GitHub runner, so a `shutil.which("bash")` guard does not fire,
-#: but `park`, `resume` and `openRepoTools` are bash scripts that run `make` in
-#: a root which execs a shebang script, and a shebang means nothing to
-#: CreateProcess. Skipping is honest because there is no Windows twin to run
-#: instead for any shipped bash file, and on Windows the way in is WSL2,
-#: exactly as it is for openRepoShape's own `setup.sh`. What the Windows job
-#: still proves is the checkout and the hygiene tests, which need no shell.
-#: A shared `skipif` object rather than a named marker because there is no
-#: pytest.ini to register one in, and an unregistered marker is a warning.
-WINDOWS_SKIP = pytest.mark.skipif(
-    os.name == "nt",
-    reason="needs a POSIX shell and shebang execution; on Windows the way in "
-           "is WSL2, as it is for openRepoShape's setup.sh")
-
-
-def rmtree(path: Path) -> None:
-    """`shutil.rmtree` that also works over a git object store on Windows.
-
-    Git writes loose objects and packs READ-ONLY, and Windows refuses to
-    unlink a read-only file — so a plain `rmtree` over a checkout raises
-    PermissionError there and succeeds everywhere else. The handler clears the
-    read-only bit and retries the one call that failed. `onerror` rather than
-    `onexc`: the newer spelling is 3.12+, and this standard runs on 3.9.
-    """
-    def clear_readonly(func, target, _exc):
-        os.chmod(target, stat.S_IWRITE)
-        func(target)
-
-    shutil.rmtree(path, onerror=clear_readonly)
-
-
-def git(*args: str, cwd: Path, check: bool = True) -> subprocess.CompletedProcess:
-    proc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True,
-                          text=True, check=False)
-    if check and proc.returncode != 0:
-        raise AssertionError(f"git {' '.join(args)} in {cwd} failed:\n"
-                             f"{proc.stderr}{proc.stdout}")
-    return proc
diff --git a/tests/fixtures/t018-handoff/single-repository-decoys.golden b/tests/fixtures/t018-handoff/single-repository-decoys.golden
deleted file mode 100644
index e547835c..00000000
--- a/tests/fixtures/t018-handoff/single-repository-decoys.golden
+++ /dev/null
@@ -1,148 +0,0 @@
-=== repoD: lane-reconcile before ===
-exit 0
---- stdout
-ROOT<HOME>/projects/.lane-state/repoD-1
-STATERUNNINGgeneration 1operation op-seedowner <HEX>-1111-4180-8180-<HEX>updated <UTC>
-HOLDERnone
-BINDINGhereeagle/none
-TREE<TREE-ID>unmanaged<HOME>/projects/repoD/worktrees/001-d/specgit registers it in <HOME>/projects/repoD and no sidecar of this lane names it; it is left exactly as it is
-TREE<TREE-ID>unpushed<HOME>/projects/.lane-worktrees/repoD-1/depbranch dep head <HEX> upstream origin/main 0 dirty 1 unpushed; observed 0/1 at <UTC>
-TREES1 inventoried1 dirty or unpushed0 require recovery1 unmanaged or stale
-VERDICTungraceful-stopthe lane is recorded RUNNING and no verified holder is live: the session stopped before any handoff began, so nothing was polled, refreshed or recorded — inspect every tree below before relaunching a writer
---- stderr
-
-=== repoD: lane-handoff ===
-exit 0
---- stdout
-
-WRITER <HOME>/projects/.lane-worktrees/repoD-1/dep — branch dep, last commit <HEX> lane work in the dependency
-  git status --short: 0 dirty
-  git log @{u}..: 1 unpushed
-    <HEX> lane work in the dependency
-
-READY — restart with: pclaude --lane repoD-1 <profile>
-  record: PAUSED lane:repoD-1 → swap; dir <HOME>/projects/repoD; workstation Eagle; agent claude; transcript none; kind unknown
-  agent claude, transcript none (lane-start --agent claude resumes it)
-  lifecycle: SWAPPED (generation 2, operation <OPERATION>) — lanes-edit.sh lane-reconcile repoD-1
-  inventory: 1 worktree(s) recorded — lanes-edit.sh lane-trees repoD-1
---- stderr
-lane-handoff: lane=repoD-1 workstation=Eagle
-lanes-edit: LANES_NO_FETCH=1 — not fetching; reading origin/main as the ref already stands here
-lane-handoff: lane=repoD-1 workstation=Eagle
-lane-handoff: lifecycle: RUNNING -> SWAPPING (generation 2, operation <OPERATION>)
-lane-handoff: writers polled: 1 under <HOME>/projects/repoD
-lane-handoff: handoff refreshed: <HOME>/projects/wip/handoffs/repoD-1.md (+14 lines at the head)
-lane-handoff: handoff commit: handoff(repoD-1@Eagle): PAUSED
-lane-handoff: handoff pushed to origin/main
-lanes-edit: 1 line appended to <HOME>/projects/wip/lanes/log/repoD-1.md
-lanes-edit: committed: LOG(repoD-1@Eagle): PAUSED lane:repoD-1
-lanes-edit: pushed origin/main (attempt 1)
-lane-handoff: object log: PAUSED lane:repoD-1 → swap; dir <HOME>/projects/repoD; workstation Eagle; agent claude; transcript none; kind unknown
-lane-handoff: lifecycle: SWAPPING -> SWAPPED (generation 2, operation <OPERATION>)
-
-=== repoD: lane-handoff: top block ===
-Lane: repoD-1 (profile unknown, session <HEX>-1111-4180-8180-<HEX>) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)
-
-## RESUME PROMPT — PAUSED <UTC> (t018 handoff), agent claude, transcript none, kind unknown — the count decides: this handoff cannot know whether the process survived
-
-**FIRST ACTS, in order.** (1) You are lane `repoD-1`, checkout `<HOME>/projects/repoD`. Stamp this block RESUMED before anything else (Rule 3, single use) — `lane-start --no-launch <repo> <n>` in this window writes it. (2) Read AGENTS.md, then this block. (3) COUNT THE LIVE WRITERS before relaunching anything — the WRITERS section below is a list to COUNT, not a list to relaunch (Amendment 17 Addendum 1 (i)). ONE WORKTREE, ONE WRITER (k): a worktree is one writer's for as long as that writer is live, a relaunch onto a live writer's worktree is the writers' form of Amendment 18(h)'s second binding, and where you find one made you retire the newer before either commits. THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT: a plain handoff may be followed by a `/clear` in this process or by a relaunch, so nothing below assumes either — the count is the answer. Older sections below are history.
-
-**STATE at <UTC>.** Handed off by `lane-handoff` on Eagle: t018 handoff. Agent `claude`, transcript `none`. Kind `unknown`: the act that follows this record was not this command's to know (`kind unknown`, Addendum 1 (h)) — the restart line below is one of the two, and a `/clear` typed here is the other.
-
-**WRITERS at <UTC>** (1 found under `<HOME>/projects/repoD`) — FIRST count the live writers: `ListAgents` in Claude, the agent's equivalent elsewhere. A writer still live OWNS its worktree: do not relaunch it; one message telling it that its in-flight call died and who the coordinator now is, is enough. Relaunch only a writer that is NOT live, from where it stands — `git status` and `git log @{u}..` in its worktree, then its brief. WHERE THE COUNT AND THIS LIST DISAGREE, THE COUNT WINS: this list is what the paused session expected, the count is what is true.
-
-- `<HOME>/projects/.lane-worktrees/repoD-1/dep` — branch `dep`, last commit `<HEX> lane work in the dependency`, 0 dirty, 1 unpushed; brief: (fill in: the brief this writer was given)
-
-=== repoD: lane-handoff: inventory ===
-exit 0
---- stdout
-<TREE-ID><HOME>/projects/.lane-worktrees/repoD-1/depdep<HEX>origin/main01<HEX>-1111-4180-8180-<HEX><UTC><HOME>/projects/repoD2<OPERATION>1
---- stderr
-
-=== repoD: lane-reconcile after ===
-exit 0
---- stdout
-ROOT<HOME>/projects/.lane-state/repoD-1
-STATESWAPPEDgeneration 2operation <OPERATION>owner <HEX>-1111-4180-8180-<HEX>updated <UTC>
-HOLDERnone
-BINDINGfreenone
-TREE<TREE-ID>unmanaged<HOME>/projects/repoD/worktrees/001-d/specgit registers it in <HOME>/projects/repoD and no sidecar of this lane names it; it is left exactly as it is
-TREE<TREE-ID>unpushed<HOME>/projects/.lane-worktrees/repoD-1/depbranch dep head <HEX> upstream origin/main 0 dirty 1 unpushed; observed 0/1 at <UTC>
-TREES1 inventoried1 dirty or unpushed0 require recovery1 unmanaged or stale
-VERDICTresumablethe swap completed and no holder is live: the lane may be resumed once the trees below are read
---- stderr
-
-=== repoQ: lane-reconcile before ===
-exit 0
---- stdout
-ROOT<HOME>/projects/.lane-state/repoQ-1
-STATERUNNINGgeneration 1operation op-seedowner <HEX>-1111-4180-8180-<HEX>updated <UTC>
-HOLDERnone
-BINDINGhereeagle/none
-TREE<TREE-ID>unmanaged<HOME>/projects/repoQ/worktrees/001-d/specgit registers it in <HOME>/projects/repoQ and no sidecar of this lane names it; it is left exactly as it is
-TREE<TREE-ID>unpushed<HOME>/projects/.lane-worktrees/repoQ-1/depbranch dep head <HEX> upstream origin/main 0 dirty 1 unpushed; observed 0/1 at <UTC>
-TREES1 inventoried1 dirty or unpushed0 require recovery1 unmanaged or stale
-VERDICTungraceful-stopthe lane is recorded RUNNING and no verified holder is live: the session stopped before any handoff began, so nothing was polled, refreshed or recorded — inspect every tree below before relaunching a writer
---- stderr
-
-=== repoQ: lane-handoff ===
-exit 0
---- stdout
-
-WRITER <HOME>/projects/.lane-worktrees/repoQ-1/dep — branch dep, last commit <HEX> lane work in the dependency
-  git status --short: 0 dirty
-  git log @{u}..: 1 unpushed
-    <HEX> lane work in the dependency
-
-READY — restart with: pclaude --lane repoQ-1 <profile>
-  record: PAUSED lane:repoQ-1 → swap; dir <HOME>/projects/repoQ; workstation Eagle; agent claude; transcript none; kind unknown
-  agent claude, transcript none (lane-start --agent claude resumes it)
-  lifecycle: SWAPPED (generation 2, operation <OPERATION>) — lanes-edit.sh lane-reconcile repoQ-1
-  inventory: 1 worktree(s) recorded — lanes-edit.sh lane-trees repoQ-1
---- stderr
-lane-handoff: lane=repoQ-1 workstation=Eagle
-lanes-edit: LANES_NO_FETCH=1 — not fetching; reading origin/main as the ref already stands here
-lane-handoff: lane=repoQ-1 workstation=Eagle
-lane-handoff: lifecycle: RUNNING -> SWAPPING (generation 2, operation <OPERATION>)
-lane-handoff: writers polled: 1 under <HOME>/projects/repoQ
-lane-handoff: handoff refreshed: <HOME>/projects/wip/handoffs/repoQ-1.md (+14 lines at the head)
-lane-handoff: handoff commit: handoff(repoQ-1@Eagle): PAUSED
-lane-handoff: handoff pushed to origin/main
-lanes-edit: 1 line appended to <HOME>/projects/wip/lanes/log/repoQ-1.md
-lanes-edit: committed: LOG(repoQ-1@Eagle): PAUSED lane:repoQ-1
-lanes-edit: pushed origin/main (attempt 1)
-lane-handoff: object log: PAUSED lane:repoQ-1 → swap; dir <HOME>/projects/repoQ; workstation Eagle; agent claude; transcript none; kind unknown
-lane-handoff: lifecycle: SWAPPING -> SWAPPED (generation 2, operation <OPERATION>)
-
-=== repoQ: lane-handoff: top block ===
-Lane: repoQ-1 (profile unknown, session <HEX>-1111-4180-8180-<HEX>) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)
-
-## RESUME PROMPT — PAUSED <UTC> (t018 handoff), agent claude, transcript none, kind unknown — the count decides: this handoff cannot know whether the process survived
-
-**FIRST ACTS, in order.** (1) You are lane `repoQ-1`, checkout `<HOME>/projects/repoQ`. Stamp this block RESUMED before anything else (Rule 3, single use) — `lane-start --no-launch <repo> <n>` in this window writes it. (2) Read AGENTS.md, then this block. (3) COUNT THE LIVE WRITERS before relaunching anything — the WRITERS section below is a list to COUNT, not a list to relaunch (Amendment 17 Addendum 1 (i)). ONE WORKTREE, ONE WRITER (k): a worktree is one writer's for as long as that writer is live, a relaunch onto a live writer's worktree is the writers' form of Amendment 18(h)'s second binding, and where you find one made you retire the newer before either commits. THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT: a plain handoff may be followed by a `/clear` in this process or by a relaunch, so nothing below assumes either — the count is the answer. Older sections below are history.
-
-**STATE at <UTC>.** Handed off by `lane-handoff` on Eagle: t018 handoff. Agent `claude`, transcript `none`. Kind `unknown`: the act that follows this record was not this command's to know (`kind unknown`, Addendum 1 (h)) — the restart line below is one of the two, and a `/clear` typed here is the other.
-
-**WRITERS at <UTC>** (1 found under `<HOME>/projects/repoQ`) — FIRST count the live writers: `ListAgents` in Claude, the agent's equivalent elsewhere. A writer still live OWNS its worktree: do not relaunch it; one message telling it that its in-flight call died and who the coordinator now is, is enough. Relaunch only a writer that is NOT live, from where it stands — `git status` and `git log @{u}..` in its worktree, then its brief. WHERE THE COUNT AND THIS LIST DISAGREE, THE COUNT WINS: this list is what the paused session expected, the count is what is true.
-
-- `<HOME>/projects/.lane-worktrees/repoQ-1/dep` — branch `dep`, last commit `<HEX> lane work in the dependency`, 0 dirty, 1 unpushed; brief: (fill in: the brief this writer was given)
-
-=== repoQ: lane-handoff: inventory ===
-exit 0
---- stdout
-<TREE-ID><HOME>/projects/.lane-worktrees/repoQ-1/depdep<HEX>origin/main01<HEX>-1111-4180-8180-<HEX><UTC><HOME>/projects/repoQ2<OPERATION>1
---- stderr
-
-=== repoQ: lane-reconcile after ===
-exit 0
---- stdout
-ROOT<HOME>/projects/.lane-state/repoQ-1
-STATESWAPPEDgeneration 2operation <OPERATION>owner <HEX>-1111-4180-8180-<HEX>updated <UTC>
-HOLDERnone
-BINDINGfreenone
-TREE<TREE-ID>unmanaged<HOME>/projects/repoQ/worktrees/001-d/specgit registers it in <HOME>/projects/repoQ and no sidecar of this lane names it; it is left exactly as it is
-TREE<TREE-ID>unpushed<HOME>/projects/.lane-worktrees/repoQ-1/depbranch dep head <HEX> upstream origin/main 0 dirty 1 unpushed; observed 0/1 at <UTC>
-TREES1 inventoried1 dirty or unpushed0 require recovery1 unmanaged or stale
-VERDICTresumablethe swap completed and no holder is live: the lane may be resumed once the trees below are read
---- stderr
-
diff --git a/tests/fixtures/t018/single-repository.golden b/tests/fixtures/t018/single-repository.golden
deleted file mode 100644
index 1d02e805..00000000
--- a/tests/fixtures/t018/single-repository.golden
+++ /dev/null
@@ -1,297 +0,0 @@
-=== add --dry-run ===
-exit 0
---- stdout
-<HOME>/projects/.lane-worktrees/repoS-1/inv
---- stderr
-lane-worktrees: DRY RUN, nothing was made: git -C <HOME>/projects/repoS worktree add --no-track -b inv <HOME>/projects/.lane-worktrees/repoS-1/inv <HEX>; then lanes-edit.sh set-lane-tree repoS-1 <HOME>/projects/.lane-worktrees/repoS-1/inv --checkout <HOME>/projects/repoS
-
-=== add ===
-exit 0
---- stdout
-<HOME>/projects/.lane-worktrees/repoS-1/inv
---- stderr
-lane-worktrees: made <HOME>/projects/.lane-worktrees/repoS-1/inv on branch inv at <HEX> in <HOME>/projects/repoS; recorded in lane repoS-1's inventory as <TREE-ID>
-
-=== sweep porcelain ===
-exit 3
---- stdout
-lane	repoS-1	RUNNING	none	-	here	ungraceful-stop
-tree	wip-rescue+remove	retire	<HOME>/projects/.lane-worktrees/repoS-1/inv	inv	<HEX>	1 dirty or untracked path(s): a WIP commit on a rescue branch, pushed, then removed
-tree	foreign	-	<HOME>/projects/elsewhere	elsewhere	<HEX>	not in lane repoS-1's inventory (#97); registered in the lane's checkout
-tree	live	retire	<HOME>/projects/repoS/.claude/worktrees/tr	tr	<HEX>	a live writer owns it: not in the inventory and active <N> min ago (foreign trees quiet for 24 h only); not in #97's inventory - the lane's by its branch's Lane: trailer
-branch	list	retire	old-work	<HEX> · 1 ahead/0 behind origin/main · last commit <DATE> (<N> d) · owner repoS-1	0	unmerged (not a GitHub origin); upstream origin/main is ahead: a person disposes of it (push it to rescue/repoS-1/..., or a word) - never deleted
-scratch	archive+remove	retire	<HOME>/projects/.lane-worktrees/repoS-1/notes-scratch	-	<N>	lane scratch: tar and sha256 under the sweeps directory, then removed
-cache	remove	-	<HOME>/projects/.lane-worktrees/repoS-1/inv/__pycache__	-	<N>	a dependency cache or bytecode: it holds no work and is rebuilt
-summary	4	3	1	1
---- stderr
-
-=== sweep table ===
-exit 3
---- stdout
-lane-worktrees sweep repoS-1 - DRY RUN - nothing is changed; --yes performs it
-  lane: state RUNNING · holder none · binding here (eagle/none) · verdict ungraceful-stop
-  checkout: <HOME>/projects/repoS · inventory 1 tree(s) · origin as of the last fetch
-  merged means: the register's LANDED line for the branch's PR, or gh's MERGED (gh: LANES_NO_GITHUB=1)
-
-TREES
-  wip-rescue+remove      <HOME>/projects/.lane-worktrees/repoS-1/inv
-                           inv <HEX> · 1 dirty or untracked path(s): a WIP commit on a rescue branch, pushed, then removed
-  foreign                <HOME>/projects/elsewhere
-                           elsewhere <HEX> · not in lane repoS-1's inventory (#97); registered in the lane's checkout
-  live                   <HOME>/projects/repoS/.claude/worktrees/tr
-                           tr <HEX> · a live writer owns it: not in the inventory and active <N> min ago (foreign trees quiet for 24 h only); not in #97's inventory - the lane's by its branch's Lane: trailer
-
-BRANCHES (--branches)
-  list                   old-work
-                           <HEX> · 1 ahead/0 behind origin/main · last commit <DATE> (<N> d) · owner repoS-1 · unmerged (not a GitHub origin); upstream origin/main is ahead: a person disposes of it (push it to rescue/repoS-1/..., or a word) - never deleted
-
-SCRATCH (--include-scratch)
-  archive+remove         <HOME>/projects/.lane-worktrees/repoS-1/notes-scratch · <SIZE>
-                           lane scratch: tar and sha256 under the sweeps directory, then removed
-
-CACHES (--include-caches)
-  remove                 <HOME>/projects/.lane-worktrees/repoS-1/inv/__pycache__ · <SIZE>
-                           a dependency cache or bytecode: it holds no work and is rebuilt
-
-SUMMARY: 3 tree(s): 4 to retire · 1 live · 1 foreign
---- stderr
-
-=== lane-reconcile ===
-exit 0
---- stdout
-ROOT<HOME>/projects/.lane-state/repoS-1
-STATERUNNINGgeneration 1operation op-seedowner <HEX>-1111-4180-8180-<HEX>updated <UTC>
-HOLDERnone
-BINDINGhereeagle/none
-TREE<TREE-ID>dirty<HOME>/projects/.lane-worktrees/repoS-1/invbranch inv head <HEX> upstream none 1 dirty 0 unpushed; observed 0/0 at <UTC>; head was <HEX> and is <HEX>
-TREE<TREE-ID>unmanaged<HOME>/projects/elsewheregit registers it in <HOME>/projects/repoS and no sidecar of this lane names it; it is left exactly as it is
-TREE<TREE-ID>unmanaged<HOME>/projects/repoS/.claude/worktrees/trgit registers it in <HOME>/projects/repoS and no sidecar of this lane names it; it is left exactly as it is
-TREES1 inventoried1 dirty or unpushed0 require recovery2 unmanaged or stale
-VERDICTungraceful-stopthe lane is recorded RUNNING and no verified holder is live: the session stopped before any handoff began, so nothing was polled, refreshed or recorded — inspect every tree below before relaunching a writer
---- stderr
-
-=== lane-end refused ===
-exit 2
---- stdout
---- stderr
-lane-end: in-flight read from lanes/log/repoS-1.md (exact), not from the state cell
-lane-end: lane repoS-1 is NOT ended: the close-out gate (opensoft/openRepoTools#163) found what is still the lane's: 2 tree(s) and 1 branch(es) and 1 scratch dir(s) and 1 cache(s)
-  tree     wip-rescue+remove  <HOME>/projects/.lane-worktrees/repoS-1/inv  [inv <HEX>]
-             git status --ignored: 1 changed; 0 untracked; 2 ignored (.env __pycache__/)
-             1 dirty or untracked path(s): a WIP commit on a rescue branch, pushed, then removed
-  tree     live  <HOME>/projects/repoS/.claude/worktrees/tr  [tr <HEX>]
-             git status --ignored: clean, nothing ignored in it either
-             a live writer owns it: not in the inventory and active <N> min ago (foreign trees quiet for 24 h only); not in #97's inventory - the lane's by its branch's Lane: trailer
-  branch   list  old-work  <HEX> · 1 ahead/0 behind origin/main · last commit <DATE> (<N> d) · owner repoS-1
-             unmerged (not a GitHub origin); upstream origin/main is ahead: a person disposes of it (push it to rescue/repoS-1/..., or a word) - never deleted
-  scratch  archive+remove  <HOME>/projects/.lane-worktrees/repoS-1/notes-scratch  (<N> bytes)
-             lane scratch: tar and sha256 under the sweeps directory, then removed
-  cache    remove  <HOME>/projects/.lane-worktrees/repoS-1/inv/__pycache__  (<N> bytes)
-lane-end: (1 FOREIGN tree(s) beside these are not this lane's, and were not counted.)
-lane-end: the table, which changes nothing:
-lane-end:   lane-worktrees sweep repoS-1 --branches --include-scratch --include-caches
-lane-end: the one act that retires them (--yes removes only what is on origin or in a bundle, never a live writer's tree):
-lane-end:   lane-worktrees sweep repoS-1 --branches --include-scratch --include-caches --yes
-lane-end:   (2 row(s) above marked keep, live, load-bearing or list are left by --yes as well: each says why, and settling it is a person's)
-lane-end: or end the lane and leave them where they are, in its inventory, with the reason written down:
-lane-end:   lane-end repoS-1 --inventory-only
-
-=== lane-end refused: row and log ===
-| `repoS-1` | harness `<HEX>-1111-4180-8180-<HEX>` | Eagle / test / brett | <UTC> | none | handoffs/repoS-1.md | LIVE · <UTC> · working |
-STARTED — lane repoS-1, session <HEX>-1111-4180-8180-<HEX>@Eagle, <UTC>, lane:repoS-1 → home opensoft/repoS; dir <HOME>/projects/repoS; host eagle; container none; os linux
-=== add (manifest, no leg) ===
-exit 0
---- stdout
-<HOME>/projects/.lane-worktrees/repoP-1/w
---- stderr
-lane-worktrees: made <HOME>/projects/.lane-worktrees/repoP-1/w on branch w at <HEX> in <HOME>/projects/repoP; recorded in lane repoP-1's inventory as <TREE-ID>
-
-=== sweep porcelain (manifest, no leg) ===
-exit 3
---- stdout
-lane	repoP-1	RUNNING	none	-	here	ungraceful-stop
-tree	push+remove	retire	<HOME>/projects/.lane-worktrees/repoP-1/w	w	<HEX>	origin has no w: pushed as is, then removed
-summary	1	1	0	0
---- stderr
-
-=== lane-handoff ===
-exit 0
---- stdout
-
-WRITER <HOME>/projects/repoS/.claude/worktrees/tr — branch tr, last commit <HEX> trailer work
-  git status --short: 0 dirty
-  git log @{u}..: 1 unpushed
-    <HEX> trailer work
-
-WRITER <HOME>/projects/.lane-worktrees/repoS-1/inv — branch inv, last commit <HEX> inv work
-  git status --short: 1 dirty
-     M i.txt
-  git log @{u}..: 0 unpushed
-
-READY — restart with: pclaude --lane repoS-1 <profile>
-  record: PAUSED lane:repoS-1 → swap; dir <HOME>/projects/repoS; workstation Eagle; agent claude; transcript none; kind unknown
-  agent claude, transcript none (lane-start --agent claude resumes it)
-  lifecycle: SWAPPED (generation 2, operation <OPERATION>) — lanes-edit.sh lane-reconcile repoS-1
-  inventory: 2 worktree(s) recorded — lanes-edit.sh lane-trees repoS-1
---- stderr
-lane-handoff: lane=repoS-1 workstation=Eagle
-lanes-edit: LANES_NO_FETCH=1 — not fetching; reading origin/main as the ref already stands here
-lane-handoff: lane=repoS-1 workstation=Eagle
-lane-handoff: lifecycle: RUNNING -> SWAPPING (generation 2, operation <OPERATION>)
-lane-handoff: writers polled: 2 under <HOME>/projects/repoS
-lane-handoff: handoff refreshed: <HOME>/projects/wip/handoffs/repoS-1.md (+15 lines at the head)
-lane-handoff: handoff commit: handoff(repoS-1@Eagle): PAUSED
-lane-handoff: handoff pushed to origin/main
-lanes-edit: 1 line appended to <HOME>/projects/wip/lanes/log/repoS-1.md
-lanes-edit: committed: LOG(repoS-1@Eagle): PAUSED lane:repoS-1
-lanes-edit: pushed origin/main (attempt 1)
-lane-handoff: object log: PAUSED lane:repoS-1 → swap; dir <HOME>/projects/repoS; workstation Eagle; agent claude; transcript none; kind unknown
-lane-handoff: lifecycle: SWAPPING -> SWAPPED (generation 2, operation <OPERATION>)
-
-=== lane-handoff: top block ===
-Lane: repoS-1 (profile unknown, session <HEX>-1111-4180-8180-<HEX>) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)
-
-## RESUME PROMPT — PAUSED <UTC> (t018 handoff), agent claude, transcript none, kind unknown — the count decides: this handoff cannot know whether the process survived
-
-**FIRST ACTS, in order.** (1) You are lane `repoS-1`, checkout `<HOME>/projects/repoS`. Stamp this block RESUMED before anything else (Rule 3, single use) — `lane-start --no-launch <repo> <n>` in this window writes it. (2) Read AGENTS.md, then this block. (3) COUNT THE LIVE WRITERS before relaunching anything — the WRITERS section below is a list to COUNT, not a list to relaunch (Amendment 17 Addendum 1 (i)). ONE WORKTREE, ONE WRITER (k): a worktree is one writer's for as long as that writer is live, a relaunch onto a live writer's worktree is the writers' form of Amendment 18(h)'s second binding, and where you find one made you retire the newer before either commits. THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT: a plain handoff may be followed by a `/clear` in this process or by a relaunch, so nothing below assumes either — the count is the answer. Older sections below are history.
-
-**STATE at <UTC>.** Handed off by `lane-handoff` on Eagle: t018 handoff. Agent `claude`, transcript `none`. Kind `unknown`: the act that follows this record was not this command's to know (`kind unknown`, Addendum 1 (h)) — the restart line below is one of the two, and a `/clear` typed here is the other.
-
-**WRITERS at <UTC>** (2 found under `<HOME>/projects/repoS`) — FIRST count the live writers: `ListAgents` in Claude, the agent's equivalent elsewhere. A writer still live OWNS its worktree: do not relaunch it; one message telling it that its in-flight call died and who the coordinator now is, is enough. Relaunch only a writer that is NOT live, from where it stands — `git status` and `git log @{u}..` in its worktree, then its brief. WHERE THE COUNT AND THIS LIST DISAGREE, THE COUNT WINS: this list is what the paused session expected, the count is what is true.
-
-- `<HOME>/projects/repoS/.claude/worktrees/tr` — branch `tr`, last commit `<HEX> trailer work`, 0 dirty, 1 unpushed; brief: (fill in: the brief this writer was given)
-- `<HOME>/projects/.lane-worktrees/repoS-1/inv` — branch `inv`, last commit `<HEX> inv work`, 1 dirty, 0 unpushed; brief: (fill in: the brief this writer was given)
-
-=== lane-handoff: inventory ===
-exit 0
---- stdout
-<TREE-ID><HOME>/projects/.lane-worktrees/repoS-1/invinv<HEX>none10<HEX>-1111-4180-8180-<HEX><UTC><HOME>/projects/repoS2<OPERATION>1
-<TREE-ID><HOME>/projects/repoS/.claude/worktrees/trtr<HEX>origin/main01<HEX>-1111-4180-8180-<HEX><UTC><HOME>/projects/repoS2<OPERATION>1
---- stderr
-
-=== sweep porcelain after the handoff ===
-exit 3
---- stdout
-lane	repoS-1	SWAPPED	none	-	free	resumable
-tree	wip-rescue+remove	retire	<HOME>/projects/.lane-worktrees/repoS-1/inv	inv	<HEX>	1 dirty or untracked path(s): a WIP commit on a rescue branch, pushed, then removed
-tree	push+remove	retire	<HOME>/projects/repoS/.claude/worktrees/tr	tr	<HEX>	origin has no tr: pushed as is, then removed
-tree	foreign	-	<HOME>/projects/elsewhere	elsewhere	<HEX>	not in lane repoS-1's inventory (#97); registered in the lane's checkout
-branch	list	retire	old-work	<HEX> · 1 ahead/0 behind origin/main · last commit <DATE> (<N> d) · owner repoS-1	0	unmerged (not a GitHub origin); upstream origin/main is ahead: a person disposes of it (push it to rescue/repoS-1/..., or a word) - never deleted
-scratch	archive+remove	retire	<HOME>/projects/.lane-worktrees/repoS-1/notes-scratch	-	<N>	lane scratch: tar and sha256 under the sweeps directory, then removed
-cache	remove	-	<HOME>/projects/.lane-worktrees/repoS-1/inv/__pycache__	-	<N>	a dependency cache or bytecode: it holds no work and is rebuilt
-summary	4	3	0	1
---- stderr
-
-=== lane-end passes ===
-exit 0
---- stdout
-## Done (RELEASED, CLAIM-LOST, CLOSED, LANDED)
-
-- nothing recorded as done in this lane's log
-
-## Open (CLAIMED, TAKEOVER, OPENED, LANDING, WITHDRAWN)
-
-- nothing open
---- stderr
-lane-end: in-flight read from lanes/log/repoS-2.md (exact), not from the state cell
-lane-end: close-out gate: nothing of lane repoS-2's is left on disk (lane-worktrees sweep repoS-2 --branches --include-scratch --include-caches --dry-run answered 0)
-lanes-edit: line 6 rewritten in <HOME>/projects/wip/lanes/LANES.md
-lanes-edit: state cell REPLACED: 39 chars → 85 chars
-lanes-edit: committed: LANES(repoS-2@Eagle): state · ENDED · lane-end on Eagle: window closing; NOTHING IN FLIGHT
-lanes-edit: pushed origin/main (attempt 1)
-lane-end: row closed: ENDED
-lanes-edit: 1 line appended to <HOME>/projects/wip/lanes/log/repoS-2.md
-lanes-edit: committed: LOG(repoS-2@Eagle): ENDED lane:repoS-2
-lanes-edit: pushed origin/main (attempt 1)
-lane-end: object log: ENDED
-
-=== lane-end passes: row and log ===
-| `repoS-2` | harness `<HEX>-1111-4180-8180-<HEX>` | Eagle / test / brett | <UTC> | none | handoffs/repoS-2.md | ENDED · <UTC> · lane-end on Eagle: window closing; NOTHING IN FLIGHT |
-ENDED — lane repoS-2, session <HEX>-1111-4180-8180-<HEX>@Eagle, <UTC>, lane:repoS-2 — window closing; NOTHING IN FLIGHT
-=== report ===
-exit 0
---- stdout
-# Estate report - Eagle - <UTC>
-
-`lane-worktrees sweep --all --dry-run --report` over `<HOME>/projects`. It changed nothing.
-
-| finding | count |
-|---|---|
-| FOREIGN repositories | 0 |
-| Orphaned worktrees of ENDED lanes | 0 |
-| Unmerged branches with a missing, diverged or unpushed upstream | 5 |
-| Root main divergence | 0 |
-| Awaiting disposition (older than 14 days) | 0 |
-| Caches and sandboxes (<SIZE> in all) | 1 |
-| Ignored directories over <SIZE> | 0 |
-| Evidence-shaped paths inside the estate | 0 |
-| Sweep archives past retention (90 days) | 0 |
-| Workspace repository hygiene | 1 |
-| `status --all` findings (pin drift and tracking are reported as what they are, never counted as dirt) | 1 |
-| Records the report could not read | 0 |
-| rescue branches (all ages) | 0 |
-| the sweeps directory | <SIZE> |
-
-## FOREIGN repositories
-
-A lane creates worktrees, never clones. Each is a person's to dispose of.
-
-_none: every clone is the estate's own checkout_
-
-## Orphaned worktrees of ENDED lanes
-
-_none_
-
-## Unmerged branches with a missing, diverged or unpushed upstream
-
-Listed, never deleted: a person pushes each to rescue/<lane>/... or gives a word.
-
-- <HOME>/projects/repoP w · <HEX> · no upstream · <N> d · repoP-1 · held by a worktree
-- <HOME>/projects/repoS elsewhere · <HEX> · unpushed [ahead 1] · <N> d · repoS-9 · held by a worktree
-- <HOME>/projects/repoS inv · <HEX> · no upstream · <N> d · repoS-1 · held by a worktree
-- <HOME>/projects/repoS old-work · <HEX> · unpushed [ahead 1] · <N> d · repoS-1
-- <HOME>/projects/repoS tr · <HEX> · unpushed [ahead 1] · <N> d · repoS-1 · held by a worktree
-
-## Root main divergence
-
-_none_
-
-## Awaiting disposition (older than 14 days)
-
-_none_
-
-## Caches and sandboxes (<SIZE> in all)
-
-Removed without archiving by `--include-caches` / `--include-sandboxes`.
-
-- <HOME>/projects/.lane-worktrees/repoS-1/inv/__pycache__ · cache · <SIZE>
-
-## Ignored directories over <SIZE>
-
-_none_
-
-## Evidence-shaped paths inside the estate
-
-One evidence root per repository: ${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/evidence/<repo>/<UTC>-<slug>/. Each is a finding to move.
-
-_none_
-
-## Sweep archives past retention (90 days)
-
-_none_
-
-## Workspace repository hygiene
-
-- <HOME>/projects/wip/.gitignore · lacks __pycache__/ *.pyc *.pyo .pytest_cache/ .mypy_cache/ .ruff_cache/ node_modules/ .venv/ venv/ site-packages/ · printf '%s\n' '__pycache__/' '*.pyc' '*.pyo' '.pytest_cache/' '.mypy_cache/' '.ruff_cache/' 'node_modules/' '.venv/' 'venv/' 'site-packages/' >> <HOME>/projects/wip/.gitignore
-
-## `status --all` findings (pin drift and tracking are reported as what they are, never counted as dirt)
-
-- repoS · a fixed finding
-
-## Records the report could not read
-
-UNKNOWN IS NEVER ABSENT: a lane snapshot, inventory or tree the report could not read is one whose findings above may be missing.
-
-_none_
---- stderr
-
diff --git a/tests/package_layout.py b/tests/package_layout.py
deleted file mode 100644
index df95a105..00000000
--- a/tests/package_layout.py
+++ /dev/null
@@ -1,329 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Fake installed layouts of the `openrepotools` package, for the suite (#228).
-
-The pipx, stamp and entry-module tests need the package as pip and pipx lay
-it out on disk, without pip, without pipx and without a wheel: building a
-wheel fetches hatchling, and this suite reaches no network. These builders
-make that layout out of this checkout's own files, in a directory the test
-owns:
-
-- `package_tree(prefix, python, stamp)` builds
-  `<prefix>/lib/<python>/site-packages/openrepotools/` and returns its
-  `payload/` directory;
-- `pipx_venv(pipx_home, release, python, stamp)` builds
-  `<pipx_home>/venvs/openrepotools/` around a `package_tree`, as pipx 1.11.1,
-  1.17.8 and 1.18.3 lay one out, and returns the venv;
-- `console_script(path, python, form)` writes pip's console script for
-  `openrepotools.cli:main`, in either of the two forms pip writes;
-- `stamp_text(**fields)` gives the committed stamp's text with the given
-  values.
-
-STANDARD LIBRARY ONLY, AND NOTHING FROM THE SUITE: no `conftest`, no pytest.
-So the module loads the same way under pytest, under a task's
-`python3 -I -c` verify command and in a workflow step, on Python 3.9 (the
-`package` job's) and up. It finds the repository from its own path, as the
-parent of the `tests/` it sits in: the code root, which holds `src/`,
-`pyproject.toml` and every payload file in every layout this suite runs in.
-
-PATHS, NEVER A SHELL: every path here is a `pathlib.Path` and no builder runs
-a command, so a directory with a space in it, as macOS's default pipx home
-`~/Library/Application Support/pipx` has, is built like any other.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import re
-import stat
-from pathlib import Path
-
-#: THE CODE ROOT: the parent of this file's `tests/`.
-REPO = Path(__file__).resolve().parent.parent
-
-#: Where the package's modules live in the checkout, and the stamp among them.
-PACKAGE_SOURCE = REPO / "src" / "openrepotools"
-STAMP_SOURCE = PACKAGE_SOURCE / "_release.py"
-
-#: THE WHEEL'S DECLARED PAYLOAD: `pyproject.toml`'s force-include table, each
-#: entry `"<P>" = "openrepotools/payload/<P>"`. A built wheel holds exactly
-#: these files, so a fake layout copies exactly these, in the table's order.
-PYPROJECT = REPO / "pyproject.toml"
-FORCE_INCLUDE = "[tool.hatch.build.targets.wheel.force-include]"
-PAYLOAD_PREFIX = "openrepotools/payload/"
-
-#: The one console script, as `[project.scripts]` declares it.
-ENTRY_POINT = "openrepotools.cli:main"
-
-#: THE PIPX RELEASES THE FIXTURES MIRROR, each with the interpreter its row of
-#: contracts/pipx-link.md's matrix uses. 1.11.1 and 1.17.8 are what the
-#: model's install check locks for Python below 3.10 and from 3.10 on, and
-#: 1.18.3 was the newest on PyPI on 2026-10-17. Each of them puts a package's
-#: venv at `<home>/venvs/<package>`, so the layout is the same in all three;
-#: the release is recorded in the placeholder metadata, so that a fixture
-#: says which row it is.
-PIPX_RELEASES = {"1.11.1": "python3.9", "1.17.8": "python3.12",
-                 "1.18.3": "python3.13"}
-
-#: THE STAMP'S FIVE FIELDS, with the values the committed file holds
-#: (contracts/stamp.md). Each committed line is `NAME = "VALUE"`.
-STAMP_FIELDS = ("VERSION", "TAG", "COMMIT", "DIGEST", "REPOSITORY")
-UNSTAMPED = {"VERSION": "0.0.0", "TAG": "", "COMMIT": "", "DIGEST": "",
-             "REPOSITORY": ""}
-
-#: THE LONGEST SHEBANG LINE pip writes as a plain `#!<python>`, counting the
-#: `#!` and the newline: distlib's limit on Linux
-#: (`pip/_vendor/distlib/scripts.py`, `_build_shebang`, in pip 26.2.1). pip
-#: allows 512 on macOS; a fixture uses Linux's limit on every platform, so
-#: that it is the same file wherever the suite runs, and `form=` forces
-#: either form where a test needs that one.
-SHEBANG_LIMIT = 127
-
-#: PIP'S CONSOLE-SCRIPT TEMPLATE: `PipScriptMaker.script_template`
-#: (`pip/_internal/operations/install/wheel.py:417-426` in pip 26.2.1),
-#: filled in as distlib's `_get_script_text` fills it. The import is at
-#: column 0, in both forms.
-SCRIPT_TEMPLATE = ("import sys\n"
-                   "from %(module)s import %(import_name)s\n"
-                   "if __name__ == '__main__':\n"
-                   "    sys.argv[0] = sys.argv[0].removesuffix('.exe')\n"
-                   "    sys.exit(%(func)s())\n")
-
-
-class LayoutError(RuntimeError):
-    """The checkout does not hold what a fake layout is built from."""
-
-
-def payload_paths() -> tuple[str, ...]:
-    """The payload paths `<P>`, in the force-include table's order.
-
-    READ BY LINE, because Python 3.9 has no `tomllib` and the suite takes
-    nothing outside the standard library. The table's header is found as its
-    own line, and every line up to the next header is a comment, a blank, or
-    `"<P>" = "openrepotools/payload/<P>"` with `<P>` a relative path. Any
-    other line refuses, naming itself, rather than build a layout from a map
-    this reading did not understand. Where `tomllib` exists, it reads the
-    same table, and the two readings must agree.
-
-    Read at each call, not at import: a broken map then fails the builder
-    that needs it, and leaves `tests/test_package.py`'s own map test free to
-    name every difference.
-    """
-    text = PYPROJECT.read_bytes().decode("utf-8")
-    lines = text.split("\n")
-    headers = [i for i, line in enumerate(lines)
-               if line.strip() == FORCE_INCLUDE]
-    if len(headers) != 1:
-        raise LayoutError(f"{PYPROJECT} has {len(headers)} {FORCE_INCLUDE} "
-                          "headers, not one")
-    entry = re.compile(r'"([^"\\]+)" = "([^"\\]+)"')
-    paths: list[str] = []
-    for number in range(headers[0] + 1, len(lines)):
-        line = lines[number].strip()
-        if line.startswith("["):
-            break
-        if not line or line.startswith("#"):
-            continue
-        match = entry.fullmatch(line)
-        rel = match.group(1) if match else ""
-        if (not match or match.group(2) != PAYLOAD_PREFIX + rel
-                or {"", ".", ".."} & set(rel.split("/")) or rel in paths):
-            raise LayoutError(
-                f"{PYPROJECT}:{number + 1}: not a new "
-                f'`"<P>" = "{PAYLOAD_PREFIX}<P>"` entry: {line}')
-        paths.append(rel)
-    if not paths:
-        raise LayoutError(f"{PYPROJECT}'s {FORCE_INCLUDE} table is empty")
-    try:
-        import tomllib
-    except ImportError:   # Python 3.9 and 3.10: the reading above is the one
-        return tuple(paths)
-    table = (tomllib.loads(text).get("tool", {}).get("hatch", {})
-             .get("build", {}).get("targets", {}).get("wheel", {})
-             .get("force-include", {}))
-    if list(table.items()) != [(p, PAYLOAD_PREFIX + p) for p in paths]:
-        raise LayoutError(f"{PYPROJECT}'s {FORCE_INCLUDE} table reads one way "
-                          "by line and another by tomllib")
-    return tuple(paths)
-
-
-def _segment(value: str, what: str) -> str:
-    """`value`, refused unless it is one path segment."""
-    if (not isinstance(value, str) or value in ("", ".", "..")
-            or "/" in value or "\0" in value):
-        raise ValueError(f"{what} must be one path segment, not {value!r}")
-    return value
-
-
-def _place(data: bytes, target: Path, mode: int) -> Path:
-    """Write `data` at `target` with `mode`, replacing what is there.
-
-    A file or link already at `target` is removed first, so a builder run
-    twice over one tree (an upgrade, say) never writes through a link a test
-    left there, and never trips over a mode a test set.
-    """
-    target.parent.mkdir(parents=True, exist_ok=True)
-    if target.is_symlink() or target.is_file():
-        target.unlink()
-    target.write_bytes(data)
-    os.chmod(target, mode)
-    return target
-
-
-def package_tree(prefix: os.PathLike | str, python: str = "python3.12",
-                 stamp: str | bytes | None = None) -> Path:
-    """`<prefix>/lib/<python>/site-packages/openrepotools/`, as pip installs
-    the wheel there. Returns its `payload/` directory.
-
-    - Every `src/openrepotools/*.py` the checkout holds is copied at 0644:
-      `__init__.py` and `_release.py`, and `cli.py` once it exists.
-    - `stamp`, when given, is written as `_release.py` in place of the
-      committed one, byte for byte (`stamp_text` makes one).
-    - `payload/` holds every file the force-include table names, byte for
-      byte from the checkout, at 0755 where the checkout's copy is
-      owner-executable and 0644 otherwise, as hatchling's wheel gives them.
-
-    Nothing is read from anywhere but the checkout, so the tree is the one a
-    wheel built from it would install.
-    """
-    package = (Path(prefix) / "lib" / _segment(python, "python")
-               / "site-packages" / "openrepotools")
-    modules = sorted(p for p in PACKAGE_SOURCE.glob("*.py") if p.is_file())
-    if STAMP_SOURCE not in modules:
-        raise LayoutError(f"{STAMP_SOURCE} is missing: the package has no "
-                          "stamp to copy")
-    for module in modules:
-        _place(module.read_bytes(), package / module.name, 0o644)
-    if stamp is not None:
-        data = stamp.encode("utf-8") if isinstance(stamp, str) else bytes(stamp)
-        _place(data, package / "_release.py", 0o644)
-    payload = package / "payload"
-    for rel in payload_paths():
-        source = REPO / rel
-        if not source.is_file():
-            raise LayoutError(f"{PYPROJECT} names {rel}, and {source} is not "
-                              "a file")
-        mode = 0o755 if source.stat().st_mode & stat.S_IXUSR else 0o644
-        _place(source.read_bytes(), payload / rel, mode)
-    return payload
-
-
-def pipx_venv(pipx_home: os.PathLike | str, release: str,
-              python: str | None = None,
-              stamp: str | bytes | None = None) -> Path:
-    """`<pipx_home>/venvs/openrepotools/`, as pipx `release` leaves it once
-    `pipx install openrepotools` is done. Returns the venv.
-
-    - `lib/<python>/site-packages/openrepotools/` is a `package_tree`, with
-      `stamp` passed on. `python` defaults to `release`'s interpreter in
-      `PIPX_RELEASES`.
-    - `bin/openRepoTools` is pip's console script, naming the venv's own
-      `bin/python` as pip does inside a pipx venv. So under a home whose path
-      holds a space it is pip's `/bin/sh` trampoline, as on macOS's default
-      pipx home, and a plain `#!` line otherwise.
-    - `pipx_metadata.json` and `pyvenv.cfg` hold placeholder content, because
-      pipx's link is recognised by their existence alone: nothing parses
-      either, and no fixture holds an interpreter.
-
-    The link in `<dir>` is the test's to make, absolute or relative, because
-    that is what contracts/pipx-link.md's matrix varies. `PIPX_HOME` is never
-    read here.
-    """
-    if release not in PIPX_RELEASES:
-        raise ValueError(f"pipx {release!r} is not one of the releases the "
-                         f"fixtures mirror: {', '.join(PIPX_RELEASES)}")
-    python = PIPX_RELEASES[release] if python is None else python
-    venv = Path(pipx_home).absolute() / "venvs" / "openrepotools"
-    package_tree(venv, python, stamp)
-    console_script(venv / "bin" / "openRepoTools", str(venv / "bin" / "python"))
-    metadata = {
-        "placeholder": ("a fake pipx venv for openRepoTools' suite: "
-                        "--install reads only that this file exists"),
-        "pipx_release_mirrored": release,
-        "package": "openrepotools",
-    }
-    _place((json.dumps(metadata, indent=4, sort_keys=True) + "\n")
-           .encode("utf-8"), venv / "pipx_metadata.json", 0o644)
-    version = re.sub(r"^[^0-9]*", "", python)
-    _place((f"home = {venv / 'bin'}\n"
-            "include-system-site-packages = false\n"
-            f"version = {version}\n").encode("utf-8"),
-           venv / "pyvenv.cfg", 0o644)
-    return venv
-
-
-def console_script(path: os.PathLike | str, python: str,
-                   form: str | None = None) -> Path:
-    """Pip's console script for `openrepotools.cli:main` at `path`, at 0755
-    as pip leaves it, naming `python` as its interpreter. Returns the path.
-
-    The interpreter is quoted when it holds a space and is not quoted
-    already, as distlib's `enquote_executable` does. Then, as distlib's
-    `_build_shebang` does:
-
-    - `form="shebang"`: `#!<python>` as the first line;
-    - `form="trampoline"`: pip's three-line `/bin/sh` trampoline,
-      `#!/bin/sh`, `'''exec' <python> "$0" "$@"` and `' '''`;
-    - `form=None`, pip's own choice: the trampoline when the interpreter
-      holds a space or the `#!` line would pass `SHEBANG_LIMIT`, and the
-      plain shebang otherwise.
-
-    The template follows, with `from openrepotools.cli import main` at
-    column 0. A `python` that is not a Python, such as `/bin/bash`, makes the
-    same shape around another interpreter, which is a fixture the recognition
-    rule must not take for pip's.
-    """
-    if not isinstance(python, str) or not python or "\n" in python \
-            or "\r" in python:
-        raise ValueError(f"the interpreter must be one non-empty line, not "
-                         f"{python!r}")
-    executable = python
-    if " " in executable and not executable.startswith('"'):
-        executable = f'"{executable}"'
-    if form is None:
-        simple = (" " not in executable
-                  and len(executable.encode("utf-8")) + 3 <= SHEBANG_LIMIT)
-        form = "shebang" if simple else "trampoline"
-    if form == "shebang":
-        shebang = f"#!{executable}\n"
-    elif form == "trampoline":
-        shebang = f"#!/bin/sh\n'''exec' {executable} \"$0\" \"$@\"\n' '''\n"
-    else:
-        raise ValueError(f"form must be 'shebang', 'trampoline' or None, "
-                         f"not {form!r}")
-    module, func = ENTRY_POINT.split(":")
-    body = SCRIPT_TEMPLATE % {"module": module,
-                              "import_name": func.split(".")[0], "func": func}
-    return _place((shebang + body).encode("utf-8"), Path(path), 0o755)
-
-
-def stamp_text(**fields: str) -> str:
-    """The committed stamp's text, with each given field's value in place of
-    the committed one. With no fields, it is the committed file, unstamped.
-
-    The fields are the five of `STAMP_FIELDS`, by those names. Each committed
-    line, `VERSION = "0.0.0"`, `TAG = ""` and the rest, must be in the file
-    exactly once, as the release build's writer requires; it is replaced
-    whole, and every other byte is kept, the SPDX line and the docstring
-    among them. A value is written as given and never checked, so that a
-    test can build any broken stamp the reader must refuse: a partial one,
-    a malformed field or a carriage return.
-    """
-    unknown = sorted(set(fields) - set(STAMP_FIELDS))
-    if unknown:
-        raise TypeError(f"stamp_text() takes {', '.join(STAMP_FIELDS)}, "
-                        f"not {', '.join(unknown)}")
-    for name, value in fields.items():
-        if not isinstance(value, str):
-            raise TypeError(f"{name} must be a str, not {type(value).__name__}")
-    lines = STAMP_SOURCE.read_bytes().decode("utf-8").split("\n")
-    for name in STAMP_FIELDS:
-        committed = f'{name} = "{UNSTAMPED[name]}"'
-        where = [i for i, line in enumerate(lines) if line == committed]
-        if len(where) != 1:
-            raise LayoutError(f"{STAMP_SOURCE} holds `{committed}` "
-                              f"{len(where)} times, not once: it is not the "
-                              "unstamped stamp this builds on")
-        if name in fields:
-            lines[where[0]] = f'{name} = "{fields[name]}"'
-    return "\n".join(lines)
diff --git a/tests/run.sh b/tests/run.sh
deleted file mode 100755
index 316c37f5..00000000
--- a/tests/run.sh
+++ /dev/null
@@ -1,458 +0,0 @@
-#!/usr/bin/env bash
-#
-# tests/run.sh — THE way to run this repository's suite.
-#
-#   tests/run.sh                 the whole suite
-#   tests/run.sh -k lane_helpers  …and anything else pytest takes
-#
-# WHY A WRAPPER AND NOT A LINE IN A DOCUMENT (opensoft/openRepoTools#51,
-# measured 2026-09-14T20:4xZ on Eagle). This suite is minutes of bash and
-# hundreds of `git` processes, and several lanes build in sibling worktrees of
-# ONE checkout on one workstation. Four `python3 -m pytest tests -q` runs were
-# live at once that evening, every one of them past a guard that had been
-# copied into four briefs:
-#
-#     while pgrep -af 'python3 -m pytest' | grep -v pgrep >/dev/null; do sleep 20; done
-#
-# It never waited. Under the harness `grep` is a shell FUNCTION, and its status
-# with stdout on `/dev/null` is 1 even where it matched — the same pipeline
-# captured into a variable returned 0 and six lines. The collision is not a
-# shared path (the suite redirects `$HOME` and `$TMPDIR`); it is TIME: a suite
-# that takes 18 minutes alone takes far longer four-wide and trips every
-# wrapper's timeout around it.
-#
-# So the guard is written ONCE, here, where no brief can retype it wrong:
-#
-#   * THE PATTERN IS ANCHORED AND SPLIT. `^python3 -m pyt` + `est` cannot match
-#     this script's own command line, and the anchor keeps it to real runs.
-#   * `pgrep`'s STATUS IS NEVER READ. The count is what decides, and it is
-#     counted with `awk` rather than with `pgrep -c`, which is not in every
-#     `pgrep` this repository runs under.
-#   * THE POLL IS NOT THE LOCK. A poll alone lets every waiter start the
-#     instant the run it was watching ends, which is the same collision one
-#     step later. The lock is what makes the second one wait, and every lane on
-#     one workstation must name the SAME file or there is no lock at all:
-#     `${TMPDIR:-/tmp}/openrepotools-pytest.lock`, which is what `AGENTS.md`
-#     and `docs/README-lanes.md` both spell, and what a hygiene test pins in
-#     this file and in `AGENTS.md` together.
-#   * THE POLL RUNS AGAIN INSIDE THE LOCK, because a run started by hand —
-#     by somebody who did not use this wrapper — holds no lock to wait on.
-#
-# `flock` IS LINUX-ONLY. macOS ships none, so the fallback is `mkdir`, whose
-# atomicity POSIX guarantees; the holder's pid is left inside it so a lock a
-# killed run left behind is taken over rather than waited on for ever. That
-# pid is the holder's whole claim (#72), so a run that cannot leave it there
-# does not start, and a run's exit removes the lock only while its pid is
-# still the one inside.
-#
-# NOTHING NEW LANDS BESIDE THE CODE (opensoft/openRepoTools#162, causes 3 and
-# 4). A suite run used to leave `tests/__pycache__`, `.pytest_cache` and a
-# killed run's sandboxes behind in whichever worktree ran it, and a lane's
-# leftovers were 968 of 1,000 removals in the estate's cleanup. So:
-#
-#   * BYTECODE goes to `${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache`
-#     (`PYTHONPYCACHEPREFIX`), never into a checkout;
-#   * pytest's cache is off (`-p no:cacheprovider`);
-#   * EVERY TEMPORARY DIRECTORY of the run - pytest's `--basetemp` and the
-#     `TMPDIR` the suite's own `mktemp`s use - is under ONE run root,
-#     `${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/tmp/<UTC>-<pid>/`,
-#     which an EXIT trap removes however the run ends. A SIGKILL is the one
-#     end no trap sees; the pid in the root's name is what lets
-#     `lane-worktrees sweep --include-sandboxes` tell its owner is gone.
-#   * the suite runs from the repository's own virtual environment where one
-#     is there and has pytest (`${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/
-#     venvs/openRepoTools`, which `openRepoTools --install` names), put FIRST
-#     on PATH so the command line still reads `python3 -m pytest` - the shape
-#     every other lane's poll counts.
-#
-# THE LOCK IS COMPUTED BEFORE `TMPDIR` IS MOVED: it is the workstation's, and
-# a run that locked a file under its own run root would lock nothing.
-#
-# bash 3.2 (Apple's stock `/bin/bash`) parses this file in CI, like every other
-# bash file here: no `${x,,}`, no `mapfile`, no `declare -A`, no `local -n`.
-
-set -uo pipefail
-
-prog="${0##*/}"
-
-# THE ROOTS ARE PASSED THROUGH, NEVER CHOSEN HERE (opensoft/openRepoTools#186,
-# T009). `OPENREPOTOOLS_CODE_ROOT`, `_ASSEMBLY_ROOT` and `_SPEC_ROOT` name the
-# trees `tests/conftest.py` reads, and they reach pytest in the environment as
-# they are - except that the `cd` below would read a RELATIVE one against the
-# code root rather than against where the caller stood. So a relative value is
-# made absolute against the caller's directory first, and nothing else is
-# touched. `OPENREPOTOOLS_COMPOSED` is a mode, not a path, and passes as it is.
-# A QUOTED `~` or `~/…` reaches here unexpanded, and conftest reads it as the
-# home directory (`expanduser`); read here as relative it became `$PWD/~/…`,
-# a directory nobody meant, so it is the home directory here too (#193 item 7).
-abs_root() {   # <value> - absolute against the caller's directory; ~ is $HOME
-  case "$1" in
-    /*) printf '%s\n' "$1" ;;
-    '~') printf '%s\n' "$HOME" ;;
-    '~/'*) printf '%s/%s\n' "$HOME" "${1#??}" ;;
-    *) printf '%s/%s\n' "$PWD" "$1" ;;
-  esac
-}
-if [ -n "${OPENREPOTOOLS_CODE_ROOT:-}" ]; then
-  OPENREPOTOOLS_CODE_ROOT="$(abs_root "$OPENREPOTOOLS_CODE_ROOT")"; export OPENREPOTOOLS_CODE_ROOT
-fi
-if [ -n "${OPENREPOTOOLS_ASSEMBLY_ROOT:-}" ]; then
-  OPENREPOTOOLS_ASSEMBLY_ROOT="$(abs_root "$OPENREPOTOOLS_ASSEMBLY_ROOT")"; export OPENREPOTOOLS_ASSEMBLY_ROOT
-fi
-if [ -n "${OPENREPOTOOLS_SPEC_ROOT:-}" ]; then
-  OPENREPOTOOLS_SPEC_ROOT="$(abs_root "$OPENREPOTOOLS_SPEC_ROOT")"; export OPENREPOTOOLS_SPEC_ROOT
-fi
-
-# THE REPOSITORY ROOT, so the suite runs the same from anywhere. `cd -P` is
-# the portable physical path: `readlink -f` is not in the stock macOS userland.
-cd -P -- "$(dirname -- "$0")/.." 2>/dev/null || {
-  printf '%s: cannot find the repository root from %s\n' "$prog" "$0" >&2
-  exit 1
-}
-
-# `--basetemp` IS THIS WRAPPER'S (#170 G8): every temporary directory of a run
-# is under the run root its EXIT trap removes, and pytest takes the LAST
-# `--basetemp` it is given - a caller's, forwarded after the wrapper's, won,
-# and its files landed where nothing removes them. Refused, before any lock.
-for rs_arg in ${1+"$@"}; do
-  case "$rs_arg" in
-    --basetemp|--basetemp=*)
-      printf '%s: --basetemp is the wrapper'"'"'s own (the run root, which it removes); run without it\n' \
-        "$prog" >&2
-      exit 64 ;;
-  esac
-done
-
-LOCK="${TMPDIR:-/tmp}/openrepotools-pytest.lock"
-
-# SPLIT SO IT CANNOT MATCH ITSELF, anchored so it counts only real runs.
-pat='^python3 -m pyt'"est"
-
-pytest_live() {   # how many real `python3 -m pytest` processes are running
-  command -v pgrep >/dev/null 2>&1 || { printf '0\n'; return 0; }
-  pgrep -f "$pat" 2>/dev/null | awk 'END { print NR + 0 }'
-}
-
-wait_for_pytest() {   # <where> — block while any other suite is running
-  wfp_said=0
-  while [ "$(pytest_live)" -gt 0 ]; do
-    if [ "$wfp_said" = 0 ]; then
-      printf '%s: another `python3 -m pytest` is live on this workstation (%s) — waiting\n' \
-        "$prog" "$1" >&2
-      wfp_said=1
-    fi
-    sleep 20
-  done
-  return 0
-}
-
-# THE RUN ROOT AND ITS CLEANUP. `cleanup` is the EXIT trap: it stops whatever
-# is left of the suite's PROCESS GROUP, then removes the run root and, on the
-# `mkdir` path, the lock it holds - while it still holds it (`release_lock`,
-# below). The INT and TERM handlers stop the suite and EXIT, so the EXIT trap
-# runs - a handler that only cleaned up and returned would release the lock
-# while the suite carried on.
-#
-# THE GROUP, NOT THE PID: pytest is waiting on a shell suite, a `git`, a
-# fixture's `sleep` when the signal comes, and a TERM to pytest alone leaves
-# them running with their temp root deleted under them and the lock released
-# around them. The suite is started in a process group of its own (below), and
-# the whole group is stopped and waited for, KILLed after ten seconds.
-RUN_ROOT=""
-LOCKDIR_HELD=""
-SUITE_PID=""
-SUITE_PGID=""
-TTY_PGID=""
-TTY_BEFORE=""
-# A member still RUNNING, read from `ps` and never from `kill -0`: a zombie
-# answers `kill -0` until whoever adopted it reaps it, which may be never.
-group_alive() {
-  ps -A -o pgid= -o stat= 2>/dev/null |
-    awk -v g="$SUITE_PGID" '$1 == g && $2 !~ /^Z/ { n++ } END { exit n ? 0 : 1 }'
-}
-# THE DEADLINE COMES BEFORE THE REAP (#170 item 3): an unbounded `wait` on the
-# leader ran first, so a leader that traps or ignores TERM held this wrapper -
-# and the workstation's lock - for ever, and the KILL below was never reached.
-# The group is polled (zombies are not members that run), KILLed at the
-# deadline, and only then is the leader reaped.
-stop_group() {
-  [ -n "$SUITE_PGID" ] || { stop_strays; return 0; }
-  kill -TERM -- "-$SUITE_PGID" 2>/dev/null || return 0
-  sg_n=0
-  while group_alive && [ "$sg_n" -lt 50 ]; do
-    sleep 0.2
-    sg_n=$((sg_n + 1))
-  done
-  kill -KILL -- "-$SUITE_PGID" 2>/dev/null || :
-  if [ -n "$SUITE_PID" ]; then wait "$SUITE_PID" 2>/dev/null || :; fi
-  return 0
-}
-# THE TERMINAL'S RUN KEEPS ITS GROUP ID TOO (#170 G14). Run in the foreground,
-# the suite is in THIS wrapper's process group, which no `kill -- -<pgid>` can
-# stop without stopping the wrapper and the caller's pipeline (`| tee`) with
-# it. So the group's members are read before the suite starts, and what is in
-# the group afterwards that was not - and is not the wrapper's own sibling, a
-# process its caller started beside it - is what the suite left running: it
-# is stopped, KILLed after ten seconds, before the run root goes and the lock
-# is released.
-group_members() {   # <pgid> - the pids of its running members, one per line
-  ps -A -o pid= -o pgid= -o stat= 2>/dev/null |
-    awk -v g="$1" '$2 == g && $3 !~ /^Z/ { print $1 }'
-}
-#
-# THE SCAN NEVER COUNTS ITSELF (#179, Copilot round 2): run in a command
-# substitution, its subshell, `ps` and `awk` were members of the group that
-# were not there before, so every scan found "strays", every terminal run
-# waited out the whole ten seconds, and the pids it killed were the scan's own,
-# already gone. It is run in THIS shell, writing to a file under the run root:
-# `ps` and `awk` are then this shell's own children (ppid `$$`), and those are
-# passed over - a stray never is one, since the suite, this shell's child, has
-# returned, and what it left was reparented away. bash 3.2 has no `$BASHPID`
-# to name a subshell by.
-strays() {   # <file> - the members of TTY_PGID the suite left running, one per line
-  : > "$1"
-  ps -A -o pid= -o pgid= -o ppid= -o stat= > "$1.ps" 2>/dev/null || return 0
-  awk -v g="$TTY_PGID" -v me="$$" -v parent="$PPID" -v before=" $TTY_BEFORE " '
-    $2 == g && $1 != me && $3 != me && $3 != parent && $4 !~ /^Z/ &&
-      index(before, " " $1 " ") == 0 { print $1 }' "$1.ps" > "$1"
-}
-read_strays() {   # <file> - its pids into SS_PIDS, with no fork
-  SS_PIDS=""
-  while read -r rs_pid; do
-    [ -n "$rs_pid" ] && SS_PIDS="$SS_PIDS $rs_pid"
-  done < "$1"
-}
-stop_strays() {
-  [ -n "$TTY_PGID" ] && [ -n "$RUN_ROOT" ] && [ -d "$RUN_ROOT" ] || return 0
-  ss_file="$RUN_ROOT/.strays"
-  strays "$ss_file"; read_strays "$ss_file"
-  [ -n "$SS_PIDS" ] || return 0
-  # shellcheck disable=SC2086
-  kill -TERM $SS_PIDS 2>/dev/null || :
-  ss_n=0
-  while :; do
-    strays "$ss_file"; read_strays "$ss_file"
-    [ -n "$SS_PIDS" ] && [ "$ss_n" -lt 50 ] || break
-    sleep 0.2
-    ss_n=$((ss_n + 1))
-  done
-  # shellcheck disable=SC2086
-  [ -z "$SS_PIDS" ] || kill -KILL $SS_PIDS 2>/dev/null || :
-  return 0
-}
-# THE `mkdir` LOCK IS REMOVED ONLY WHILE IT IS STILL THIS RUN'S (#72 item 2).
-# A waiter that reads a live holder as gone - a pid `kill -0` cannot signal
-# (another user's), or one not yet written - claims the directory and makes
-# it again with its own pid inside, and an EXIT trap that removed the PATH
-# then deleted that new holder's lock, leaving its suite running under no lock
-# at all. So the lock is read before anything is done:
-#
-#   * A LOCK THAT CARRIES ANOTHER PID IS NOT TOUCHED - not even renamed, since
-#     a rename leaves the name free for an instant, and a waiter that polled in
-#     that instant would start beside its holder.
-#   * ONE THAT CARRIES THIS RUN'S IS RENAMED to a name only this run uses, read
-#     again THERE, and only that copy is removed. A read and then an `rm` of
-#     the path removes whatever is behind the path at the `rm`, which may have
-#     been claimed and made again since the read; once it is renamed, nothing
-#     another run does can change what is removed.
-#   * A COPY THAT IS NOT THIS RUN'S AFTER ALL - claimed and made again in the
-#     instant between the read and the rename - is put straight back.
-#
-# That instant, and the one before a copy is put back, are as close as bash 3.2
-# gets: it has no rename that refuses an existing target (`mv` onto a directory
-# moves INTO it), and the lock is a directory because `mkdir` is the atomic act
-# a shell has. A leftover under this run's private name can only be a killed
-# run's whose pid this one now has, and it goes first, so the rename cannot
-# land inside it.
-release_lock() {   # <lock directory> <the pid this run left in it, or '' for none>
-  rl_pid="$(cat "$1/pid" 2>/dev/null || printf '')"
-  [ "$rl_pid" = "$2" ] || return 0
-  rl_mine="$LOCK.released.$$"
-  rm -rf -- "$rl_mine"
-  mv -- "$1" "$rl_mine" 2>/dev/null || return 0
-  rl_pid="$(cat "$rl_mine/pid" 2>/dev/null || printf '')"
-  if [ "$rl_pid" = "$2" ]; then
-    rm -rf -- "$rl_mine"
-  else
-    mv -- "$rl_mine" "$1" 2>/dev/null || :
-  fi
-  return 0
-}
-cleanup() {
-  stop_group
-  [ -n "$RUN_ROOT" ] && rm -rf -- "$RUN_ROOT"
-  [ -n "$LOCKDIR_HELD" ] && release_lock "$LOCKDIR_HELD" "$$"
-  return 0
-}
-on_signal() {   # <exit code>
-  stop_group
-  exit "$1"
-}
-
-make_run_root() {
-  run_base="${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/tmp"
-  RUN_ROOT="$run_base/$(date -u +%Y%m%dT%H%M%SZ)-$$"
-  mkdir -p -- "$RUN_ROOT/tmp" "$RUN_ROOT/basetemp" || {
-    printf '%s: cannot create the run root %s\n' "$prog" "$RUN_ROOT" >&2
-    exit 1
-  }
-  chmod 700 "$RUN_ROOT" 2>/dev/null || :
-  # THE RUN'S MARK: `lane-worktrees sweep --include-sandboxes` removes a
-  # temporary directory only on proof a suite made it (#170 item 1), and this
-  # pid is that proof for a run root a SIGKILL left behind.
-  printf '%s\n' "$$" > "$RUN_ROOT/.openrepotools-run" 2>/dev/null || :
-  export TMPDIR="$RUN_ROOT/tmp"
-  export PYTHONPYCACHEPREFIX="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache"
-  venv="${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/venvs/openRepoTools"
-  if [ -x "$venv/bin/python3" ] && "$venv/bin/python3" -c 'import pytest' >/dev/null 2>&1; then
-    PATH="$venv/bin:$PATH"; export PATH
-    printf '%s: the suite runs from the repository venv %s\n' "$prog" "$venv" >&2
-  fi
-}
-
-# `${1+"$@"}` AND NEVER A BARE `"$@"`: under `set -u`, BASH 3.2 — Apple's stock
-# shell, and the one this file's `mkdir` lock exists for — treats `"$@"` with no
-# positional parameters as an unbound variable and exits. `"${*:-}"` is the same
-# rule for the line that echoes them.
-#
-# THE SUITE RUNS IN THE BACKGROUND AND IS WAITED FOR, because bash runs a trap
-# only once its FOREGROUND child returns: a TERM sent to this wrapper while
-# pytest ran in the foreground waited out the whole suite. `wait` is
-# interrupted by a trapped signal; the handler then stops the suite itself.
-# `<&0` keeps the suite's stdin this shell's: a background command's default
-# stdin, with job control off, is /dev/null.
-#
-# `set -m` FOR THE ONE LINE THAT STARTS IT puts the suite in a process group of
-# its own, whose id is its pid, so `stop_group` reaches every process it
-# started (one that made a session or group of its own is beyond any wrapper).
-# Monitor mode is off again before the `wait`, so no job notice is printed.
-#
-# A TERMINAL ON STDIN RUNS THE SUITE IN THE FOREGROUND instead, in this
-# wrapper's own process group - the terminal's foreground group. A background
-# group reading the terminal (`--pdb`, `breakpoint()`, `input()`) is stopped by
-# SIGTTIN, and this wrapper would wait on it for ever holding the
-# workstation's lock. In the foreground a Ctrl-C reaches every process of the
-# suite from the terminal itself; the cost is that a TERM sent to this wrapper
-# from elsewhere is acted on once the suite returns.
-run_suite() {
-  printf '%s: python3 -m pytest tests -q -p no:cacheprovider %s\n' "$prog" "${*:-}" >&2
-  if [ -t 0 ]; then
-    TTY_PGID="$(ps -o pgid= -p "$$" 2>/dev/null | tr -d ' ')"
-    TTY_BEFORE="$(group_members "$TTY_PGID" | tr '\n' ' ')"
-    python3 -m pytest tests -q -p no:cacheprovider --basetemp="$RUN_ROOT/basetemp" ${1+"$@"}
-    rs_rc=$?
-    stop_strays
-    return "$rs_rc"
-  fi
-  set -m
-  python3 -m pytest tests -q -p no:cacheprovider --basetemp="$RUN_ROOT/basetemp" ${1+"$@"} <&0 &
-  SUITE_PID=$!
-  SUITE_PGID=$SUITE_PID
-  set +m
-  wait "$SUITE_PID"
-  rs_rc=$?
-  SUITE_PID=""
-  return "$rs_rc"
-}
-
-wait_for_pytest "before the lock"
-
-if command -v flock >/dev/null 2>&1; then
-  # THE FD FORM, so the lock is held for the life of this process and released
-  # by its exit — including a kill, which no `rm` in a trap would survive.
-  exec 9> "$LOCK" || { printf '%s: cannot open the lock file %s\n' "$prog" "$LOCK" >&2; exit 1; }
-  flock 9 || { printf '%s: could not take the lock %s\n' "$prog" "$LOCK" >&2; exit 1; }
-  trap cleanup EXIT
-  trap 'on_signal 130' INT
-  trap 'on_signal 143' TERM
-  wait_for_pytest "inside the lock"
-  make_run_root
-  run_suite ${1+"$@"}
-  exit $?
-fi
-
-# NO `flock` HERE — macOS. `mkdir` is the atomic operation POSIX gives a shell.
-#
-# THREE THINGS A `mkdir` LOCK HAS TO GET RIGHT, and the first shape of this loop
-# got none of them (Copilot round 3 on openRepoTools#47):
-#
-#   * A LOCK WITH NO PID IN IT IS STALE, NOT ETERNAL. The pid is written the
-#     instant after `mkdir` returns, and a run killed in that instant leaves a
-#     directory nothing can validate — which the first shape waited on for ever,
-#     blocking the estate's one test entry point.
-#   * A TAKEOVER IS A CLAIM, NOT A DELETE. Two waiters that both see a dead
-#     holder both `rm -rf` the name; if one has already re-made it, the other
-#     deletes the NEW holder's lock and both suites run. The claim is a
-#     `mv` — one rename, one winner — and the loser simply loops.
-#   * AND THE CLAIM IS RE-READ AFTER THE RENAME, because the only way a live
-#     holder can be behind that name is if it appeared between the read and the
-#     rename. It is put straight back where that is what happened.
-#
-# A stale state must also HOLD for three polls (a minute) before it is claimed:
-# a holder that is merely slow to write its pid is not a holder to evict.
-LOCKDIR="$LOCK.d"
-stale_polls=0
-while ! mkdir "$LOCKDIR" 2>/dev/null; do
-  holder="$(cat "$LOCKDIR/pid" 2>/dev/null || printf '')"
-  stale=0
-  case "$holder" in
-    ''|*[!0-9]*) stale=1 ;;                       # no pid yet, or an unreadable one
-    *) kill -0 "$holder" 2>/dev/null || stale=1 ;;
-  esac
-  if [ "$stale" = 1 ]; then
-    stale_polls=$((stale_polls + 1))
-    if [ "$stale_polls" -ge 3 ]; then
-      claim="$LOCK.claimed.$$"
-      if mv -- "$LOCKDIR" "$claim" 2>/dev/null; then
-        # ONE RENAME, ONE WINNER — and then the re-read, because a live holder
-        # behind that name means it appeared in the instant between the two.
-        back="$(cat "$claim/pid" 2>/dev/null || printf '')"
-        case "$back" in
-          ''|*[!0-9]*) : ;;
-          *) if kill -0 "$back" 2>/dev/null; then
-               mv -- "$claim" "$LOCKDIR" 2>/dev/null || :
-               printf '%s: %s is held by pid %s after all — waiting\n' "$prog" "$LOCKDIR" "$back" >&2
-               stale_polls=0
-               sleep 20
-               continue
-             fi ;;
-        esac
-        printf '%s: the lock %s was left by %s, which is gone — taken over\n' \
-          "$prog" "$LOCKDIR" "${holder:-a run that died before writing its pid}" >&2
-        rm -rf -- "$claim"
-        continue
-      fi
-    fi
-  else
-    stale_polls=0
-  fi
-  printf '%s: waiting for the suite holding %s\n' "$prog" "$LOCKDIR" >&2
-  sleep 20
-done
-# THE PID IS THE HOLDER'S WHOLE CLAIM, SO A RUN THAT CANNOT LEAVE IT DOES NOT
-# START (#72 item 1). The write was `|| :`, and a run whose pid did not get in -
-# a full disk, a quota, a directory it cannot write - went on into the suite
-# holding a lock every waiter reads as stale, claims after three polls and runs
-# beside. So the pid is read back the way a waiter reads it, with the same
-# `cat`, and where it is not there this run releases the directory it made and
-# exits before anything starts. Nothing hides the write's own error: the
-# shell's line saying why, where it gives one, comes just before the refusal.
-# A holder that is only SLOW to write is the waiters' rule above, unchanged.
-printf '%s\n' "$$" > "$LOCKDIR/pid"
-if [ "$(cat "$LOCKDIR/pid" 2>/dev/null || printf '')" != "$$" ]; then
-  release_lock "$LOCKDIR" ""
-  printf '%s: cannot record this run'"'"'s pid in %s, so a waiter would take the lock over while the suite ran — released, and the suite not started\n' \
-    "$prog" "$LOCKDIR/pid" >&2
-  exit 1
-fi
-# THE SIGNAL HANDLERS EXIT, and that is the whole point of writing them out
-# separately: a handler that only cleans up and RETURNS releases the lock while
-# this suite carries on running, which is the collision the lock exists for.
-LOCKDIR_HELD="$LOCKDIR"
-trap cleanup EXIT
-trap 'on_signal 130' INT
-trap 'on_signal 143' TERM
-wait_for_pytest "inside the lock"
-make_run_root
-run_suite ${1+"$@"}
-exit $?
diff --git a/tests/test_claude_current.py b/tests/test_claude_current.py
deleted file mode 100644
index b6794801..00000000
--- a/tests/test_claude_current.py
+++ /dev/null
@@ -1,1149 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`claude-current`: the Claude Code a launch should start (opensoft/workBenches#119).
-
-EVERYTHING HERE IS FAKED, AND NOTHING REACHES A NETWORK OR A REAL INSTALL.
-`$HOME` is a temporary directory; `npm` and `node` are scripts first on the
-command's own seams (`CLAUDE_CURRENT_NPM`, `CLAUDE_CURRENT_NODE`); every
-candidate is a small script that answers `--version`; the user npm prefix,
-the native versions directory, the image's system candidates and the lock
-directory all live under `tmp_path`. `CLAUDE_CURRENT_SYSTEM_CANDIDATES` is
-always set, so the real `/usr/local/bin/claude` and `/usr/bin/claude` of the
-machine running the suite are never read.
-
-The cases follow the issue's Ask 1-8: the published version with a bound,
-candidates by ABSOLUTE PATH and never by PATH, the update when behind under a
-lock, verify and hand back one path, refuse with one escape, offline is not a
-refusal, say what launched.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import subprocess
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-import test_repo_hygiene as hygiene
-
-CMD = REPO / "claude-current"
-PACKAGE = "@anthropic-ai/claude-code"
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="claude-current is a bash script"),
-              WINDOWS_SKIP]
-
-#: A candidate: answers `--version` with `<version> (Claude Code)`, logs every
-#: other call, and, for a NATIVE install, answers `update` by writing the
-#: version `$FAKE_NATIVE_UPDATE_TO` names beside itself.
-FAKE_CLAUDE = r"""#!/usr/bin/env bash
-v='@VERSION@'
-printf '%s %s\n' "$0" "$*" >> "${FAKE_CLAUDE_LOG:-/dev/null}"
-case "${1:-}" in
-  --version) printf '%s (Claude Code)\n' "$v" ;;
-  update)
-    [ "${FAKE_NATIVE_UPDATE_RC:-0}" = 0 ] || exit "$FAKE_NATIVE_UPDATE_RC"
-    to="${FAKE_NATIVE_UPDATE_TO:-}"
-    if [ -n "$to" ]; then
-      sed -e "s/^v='[^']*'/v='$to'/" "$0" > "$(dirname "$0")/$to"
-      chmod 755 "$(dirname "$0")/$to"
-    fi ;;
-esac
-"""
-
-#: npm: `view` answers `$FAKE_NPM_PUBLISHED` (or fails, or sleeps); `install -g
-#: --prefix <p> … <pkg>@<v>` lays the package out the way npm does — the
-#: launcher linked from `<p>/bin/claude` into `lib/node_modules` — and, with
-#: `$FAKE_NPM_HOOK_NEEDED=1`, leaves the launcher a stub until the package's
-#: `install.cjs` has run, which is npm 12's skipped native-binary hook.
-#: `$FAKE_NPM_INSTALL_HOOK` is shell run at the start of an install, while the
-#: launch that runs it holds the update lock.
-FAKE_NPM = r"""#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_NPM_LOG:-/dev/null}"
-case "${1:-}" in
-  view)
-    if [ -n "${FAKE_NPM_VIEW_IGNORE_TERM:-}" ]; then trap '' TERM; fi
-    [ -n "${FAKE_NPM_VIEW_SLEEP:-}" ] && sleep "$FAKE_NPM_VIEW_SLEEP"
-    [ "${FAKE_NPM_VIEW_RC:-0}" = 0 ] || exit "$FAKE_NPM_VIEW_RC"
-    printf '%s\n' "${FAKE_NPM_PUBLISHED:-}" ;;
-  install)
-    [ "${FAKE_NPM_INSTALL_RC:-0}" = 0 ] || { echo "npm ERR! fake failure" >&2; exit "$FAKE_NPM_INSTALL_RC"; }
-    if [ -n "${FAKE_NPM_INSTALL_HOOK:-}" ]; then eval "$FAKE_NPM_INSTALL_HOOK"; fi
-    prefix=""; spec=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        --prefix) prefix="$2"; shift 2 ;;
-        @anthropic-ai/claude-code@*) spec="$1"; shift ;;
-        *) shift ;;
-      esac
-    done
-    v="${spec##*@}"
-    pkg="$prefix/lib/node_modules/@anthropic-ai/claude-code"
-    rm -rf "$pkg"; mkdir -p "$pkg/bin" "$prefix/bin"
-    printf '{\n  "name": "@anthropic-ai/claude-code",\n  "version": "%s"\n}\n' "$v" > "$pkg/package.json"
-    sed -e "s/@VERSION@/$v/" "$FAKE_CLAUDE_TEMPLATE" > "$pkg/claude.real"
-    chmod 755 "$pkg/claude.real"
-    if [ "${FAKE_NPM_HOOK_NEEDED:-0}" = 1 ]; then
-      printf '#!/usr/bin/env bash\necho "the native binary was never installed" >&2\nexit 1\n' > "$pkg/bin/claude.exe"
-    else
-      cp "$pkg/claude.real" "$pkg/bin/claude.exe"
-    fi
-    chmod 755 "$pkg/bin/claude.exe"
-    printf 'cp "%s" "%s"\n' "$pkg/claude.real" "$pkg/bin/claude.exe" > "$pkg/install.cjs"
-    ln -sfn ../lib/node_modules/@anthropic-ai/claude-code/bin/claude.exe "$prefix/bin/claude" ;;
-esac
-"""
-
-#: node: runs the fake package's `install.cjs`, which is a shell line.
-FAKE_NODE = r"""#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_NODE_LOG:-/dev/null}"
-bash "$1"
-"""
-
-#: A native version file that does not run, as `--version` finds it: a binary
-#: for another libc, a download cut short, and a first start that never returns.
-#: Like a working one it logs every call.
-BROKEN_CLAUDE = r"""#!/usr/bin/env bash
-printf '%s %s\n' "$0" "$*" >> "${FAKE_CLAUDE_LOG:-/dev/null}"
-@BODY@
-"""
-BROKEN_BODIES = {
-    "exits": "exit 126",
-    "silent": "exit 0",
-    "garbled": "echo 'cannot execute binary file: Exec format error'",
-    "hangs": "exec sleep 30",
-}
-
-
-class Sandbox:
-    """One hermetic world for one case."""
-
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.home = root / "home"
-        self.bin = root / "bin"
-        self.prefix = root / "prefix"
-        self.native = self.home / ".local" / "share" / "claude" / "versions"
-        self.system = root / "system"
-        self.cache = root / "cache"
-        for d in (self.home, self.bin, self.system, self.cache):
-            d.mkdir(parents=True, exist_ok=True)
-        self.template = root / "fake-claude.template"
-        self.template.write_text(FAKE_CLAUDE)
-        self._script(self.bin / "npm", FAKE_NPM)
-        self._script(self.bin / "node", FAKE_NODE)
-        self.npm_log = root / "npm.log"
-        self.node_log = root / "node.log"
-        self.claude_log = root / "claude.log"
-        for log in (self.npm_log, self.node_log, self.claude_log):
-            log.write_text("")
-        self.system_candidates: list[Path] = []
-
-    @staticmethod
-    def _script(path: Path, text: str) -> Path:
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text)
-        path.chmod(0o755)
-        return path
-
-    def claude(self, path: Path, version: str) -> Path:
-        return self._script(path, FAKE_CLAUDE.replace("@VERSION@", version))
-
-    def native_version(self, version: str) -> Path:
-        return self.claude(self.native / version, version)
-
-    def broken_native(self, version: str, how: str = "exits") -> Path:
-        return self._script(self.native / version,
-                            BROKEN_CLAUDE.replace("@BODY@", BROKEN_BODIES[how]))
-
-    def user_copy(self, version: str) -> Path:
-        """An npm install in the user prefix, laid out the way npm lays it out."""
-        pkg = self.prefix / "lib" / "node_modules" / "@anthropic-ai" / "claude-code"
-        exe = self.claude(pkg / "bin" / "claude.exe", version)
-        (pkg / "package.json").write_text(
-            f'{{\n  "name": "{PACKAGE}",\n  "version": "{version}"\n}}\n')
-        link = self.prefix / "bin" / "claude"
-        link.parent.mkdir(parents=True, exist_ok=True)
-        if link.is_symlink() or link.exists():
-            link.unlink()
-        link.symlink_to(Path("..") / "lib" / "node_modules" / "@anthropic-ai"
-                        / "claude-code" / "bin" / "claude.exe")
-        assert exe.is_file()
-        return link
-
-    def system_copy(self, name: str, version: str) -> Path:
-        path = self.claude(self.system / name / "claude", version)
-        self.system_candidates.append(path)
-        return path
-
-    def env(self, **extra: str) -> dict:
-        env = {k: v for k, v in os.environ.items()
-               if not k.startswith(("CLAUDE_", "FAKE_", "NPM_CONFIG", "npm_config"))}
-        env.update({
-            "HOME": str(self.home),
-            "PATH": f"{self.bin}{os.pathsep}{env.get('PATH', '/usr/bin:/bin')}",
-            "XDG_CACHE_HOME": str(self.root / "xdg-cache"),
-            "CLAUDE_CURRENT_NPM": str(self.bin / "npm"),
-            "CLAUDE_CURRENT_NODE": str(self.bin / "node"),
-            "CLAUDE_CURRENT_NPM_PREFIX": str(self.prefix),
-            "CLAUDE_CURRENT_CACHE_DIR": str(self.cache),
-            "CLAUDE_CURRENT_SYSTEM_CANDIDATES": ":".join(str(p) for p in self.system_candidates),
-            "FAKE_NPM_LOG": str(self.npm_log),
-            "FAKE_NODE_LOG": str(self.node_log),
-            "FAKE_CLAUDE_LOG": str(self.claude_log),
-            "FAKE_CLAUDE_TEMPLATE": str(self.template),
-            "FAKE_NPM_PUBLISHED": "2.1.284",
-        })
-        env.update(extra)
-        return env
-
-    def run(self, *args: str, timeout: float = 60, **extra: str) -> subprocess.CompletedProcess:
-        """From inside the sandbox, so nothing relative lands in the checkout."""
-        return subprocess.run([str(CMD), *args], env=self.env(**extra),
-                              cwd=str(self.root), capture_output=True, text=True,
-                              timeout=timeout, check=False)
-
-    def installs(self) -> list[str]:
-        return [line for line in self.npm_log.read_text().splitlines()
-                if line.startswith("install")]
-
-
-def porcelain(result: subprocess.CompletedProcess) -> dict:
-    fields = dict(line.split("=", 1) for line in result.stdout.splitlines())
-    assert sorted(fields) == ["path", "published", "status", "version"], result.stdout
-    return fields
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    return Sandbox(tmp_path)
-
-
-# --- Ask 4 and 7: verify, hand back one absolute path, say what launched ------
-
-def test_a_current_user_copy_is_verified_and_printed_by_its_absolute_path(box):
-    link = box.user_copy("2.1.284")
-    result = box.run()
-    assert result.returncode == 0, result.stderr
-    assert result.stdout == f"{link}\n"
-    assert f"claude-current: claude 2.1.284 (verified against npm 2.1.284) at {link}" \
-        in result.stderr
-    assert box.installs() == [], "a current copy must not be reinstalled"
-
-
-def test_porcelain_is_four_lines_naming_path_version_published_and_status(box):
-    link = box.user_copy("2.1.284")
-    result = box.run("--porcelain")
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result) == {"path": str(link), "version": "2.1.284",
-                                 "published": "2.1.284", "status": "verified"}
-
-
-def test_the_published_version_is_asked_of_npm_fresh(box):
-    box.user_copy("2.1.284")
-    box.run()
-    views = [line for line in box.npm_log.read_text().splitlines()
-             if line.startswith("view")]
-    assert views == [f"view {PACKAGE} version --prefer-online"]
-
-
-# --- Ask 2: candidates by absolute path, never through PATH ------------------
-
-def test_a_claude_first_on_path_is_never_consulted(box):
-    """The py-bench case of 2026-09-29: two installs competed on PATH. The one
-    on PATH here is the NEWEST and is still never run, because a launch is
-    decided by absolute paths alone."""
-    box.claude(box.bin / "claude", "9.9.9")
-    link = box.user_copy("2.1.284")
-    result = box.run("--porcelain")
-    assert porcelain(result)["path"] == str(link)
-    assert str(box.bin / "claude") not in box.claude_log.read_text()
-
-
-def test_the_image_copy_behind_npm_loses_to_the_user_copy_that_equals_it(box):
-    box.system_copy("usr", "2.1.280")
-    link = box.user_copy("2.1.284")
-    result = box.run("--porcelain")
-    assert porcelain(result)["path"] == str(link)
-
-
-def test_an_image_copy_that_equals_npm_is_launched_when_it_is_the_only_one(box):
-    image = box.system_copy("usr", "2.1.284")
-    result = box.run("--porcelain")
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(image), "verified")
-
-
-def test_an_equal_candidate_beats_a_newer_one(box):
-    box.native_version("2.1.285")
-    link = box.user_copy("2.1.284")
-    fields = porcelain(box.run("--porcelain"))
-    assert (fields["path"], fields["status"]) == (str(link), "verified")
-
-
-def test_the_native_versions_are_ordered_numerically_not_by_name(box):
-    """workBenches #109's ordering: 2.1.10 is newer than 2.1.9."""
-    box.native_version("2.1.9")
-    newest = box.native_version("2.1.10")
-    fields = porcelain(box.run("--porcelain", FAKE_NPM_PUBLISHED="2.1.10"))
-    assert (fields["path"], fields["status"]) == (str(newest), "verified")
-
-
-@pytest.mark.parametrize("how", sorted(BROKEN_BODIES))
-def test_a_native_that_does_not_run_gives_way_to_the_next_one_that_does(box, how):
-    """Copilot on #134, opensoft/openRepoTools#154: the newest native file was
-    chosen by name before its `--version` was read, and when it did not run it
-    was dropped with every older native that did, so a working install read as
-    none. A broken file, a silent one, a garbled one and a hung one all fall
-    back, and the hung one is bounded by the version timeout."""
-    box.broken_native("2.1.285", how)
-    older = box.native_version("2.1.284")
-    started = time.monotonic()
-    result = box.run("--porcelain", CLAUDE_CURRENT_VERSION_TIMEOUT="1")
-    assert time.monotonic() - started < 20, "the version probe was not bounded"
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result) == {"path": str(older), "version": "2.1.284",
-                                 "published": "2.1.284", "status": "verified"}
-    assert box.installs() == [], "a working native was there to launch"
-
-
-def test_the_fall_back_goes_down_every_native_to_the_first_that_runs(box):
-    box.broken_native("2.1.287")
-    box.broken_native("2.1.286", "garbled")
-    working = box.native_version("2.1.285")
-    box.native_version("2.1.284")
-    fields = porcelain(box.run("--porcelain", "--offline"))
-    assert (fields["path"], fields["version"], fields["status"]) == (
-        str(working), "2.1.285", "unverified")
-
-
-def test_only_the_newest_native_that_runs_is_probed(box):
-    """The fall back costs a probe only for each file that fails: with the
-    newest native working, an older one is never run, so a launch's cost is
-    what it was."""
-    box.native_version("2.1.283")
-    newest = box.native_version("2.1.284")
-    result = box.run("--porcelain", "--offline")
-    assert porcelain(result)["path"] == str(newest)
-    assert box.claude_log.read_text().splitlines() == [f"{newest} --version"]
-
-
-def test_a_native_that_does_not_run_is_not_asked_to_update_the_install(box):
-    """`claude update` runs through the native candidate. With the newest file
-    broken it is the older native that runs, so that one updates, and the
-    version it writes beside itself is read next."""
-    box.broken_native("2.1.285")
-    older = box.native_version("2.1.283")
-    result = box.run("--porcelain", FAKE_NATIVE_UPDATE_TO="2.1.284")
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(box.native / "2.1.284"), "verified")
-    calls = box.claude_log.read_text()
-    assert f"{older} update" in calls
-    assert f"{box.native / '2.1.285'} update" not in calls
-    assert box.installs() == [], "the native update reached npm's version"
-
-
-def test_a_native_that_failed_is_not_probed_again_in_the_same_launch(box):
-    """A launch reads the candidates up to four times (before the lock, after
-    it, after each update). A native whose `--version` already failed would
-    cost its whole bound again each time, a hung one ten seconds a pass, so
-    each failure is remembered for the run."""
-    broken = [box.broken_native(v, "garbled") for v in ("2.1.287", "2.1.286", "2.1.285")]
-    box.user_copy("2.1.283")
-    result = box.run(FAKE_NPM_INSTALL_RC="1")
-    assert result.returncode == 2, result.stderr
-    probes = box.claude_log.read_text().splitlines()
-    for path in broken:
-        assert probes.count(f"{path} --version") == 1, probes
-
-
-def test_a_native_the_update_repaired_in_place_is_read_again(box):
-    """The failure that is remembered for the run is forgotten when `claude
-    update` has run: it rewrites files, and here it rewrites the very one that
-    failed. npm's version is that file, broken before the update and a working
-    native after it. The install is made to fail, so the only way to a launch
-    is reading the repaired file again."""
-    box.broken_native("2.1.284")
-    older = box.native_version("2.1.283")
-    result = box.run("--porcelain", FAKE_NATIVE_UPDATE_TO="2.1.284",
-                     FAKE_NPM_INSTALL_RC="1")
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(box.native / "2.1.284"), "verified")
-    assert f"{older} update" in box.claude_log.read_text()
-    assert box.installs() == [], "the repaired native was there to launch"
-
-
-def test_a_native_another_launch_finished_while_this_one_waited_is_read_again(box):
-    """A launch that read a native another launch was still writing, and then
-    waited for that launch's update, must read it again once it has the lock:
-    that read is what lets it say "updated by another launch". The holder
-    completes the file while it holds the lock."""
-    box.broken_native("2.1.284")
-    box.native_version("2.1.283")
-    complete = (f'sed -e "s/@VERSION@/2.1.284/" "{box.template}" > "{box.native / "2.1.284"}"; '
-                f'chmod 755 "{box.native / "2.1.284"}"')
-    holder = _hold_lock(box, 2, then=complete)
-    try:
-        result = box.run("--porcelain", CLAUDE_CURRENT_LOCK_WAIT="30")
-    finally:
-        holder.wait(timeout=30)
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(box.native / "2.1.284"), "verified")
-    assert "updated by another launch" in result.stderr
-    assert box.installs() == [], "nothing was left to update"
-
-
-def test_every_native_broken_and_nothing_else_is_still_no_runnable_claude(box):
-    box.broken_native("2.1.285")
-    box.broken_native("2.1.284", "garbled")
-    for args, env in ((("--offline",), {}), ((), {"FAKE_NPM_INSTALL_RC": "1"})):
-        result = box.run(*args, **env)
-        assert result.returncode == 1, result.stderr
-        assert result.stdout == ""
-        assert "no runnable Claude Code was found by absolute path" in result.stderr
-
-
-def test_every_native_broken_is_replaced_by_the_user_prefix_install(box):
-    box.broken_native("2.1.285")
-    box.broken_native("2.1.284", "silent")
-    fields = porcelain(box.run("--porcelain"))
-    assert (fields["path"], fields["status"]) == (str(box.prefix / "bin" / "claude"), "verified")
-    assert len(box.installs()) == 1
-
-
-def test_a_broken_newest_native_behind_a_stale_user_copy_is_still_a_refusal(box):
-    box.broken_native("2.1.285")
-    link = box.user_copy("2.1.283")
-    result = box.run(FAKE_NPM_INSTALL_RC="1")
-    assert result.returncode == 2, result.stderr
-    assert result.stdout == ""
-    assert f"the newest installed is 2.1.283 at {link}" in result.stderr
-
-
-def test_one_file_under_two_spellings_is_read_once(box):
-    """`~/.local/bin/claude` is the native installer's link to its version
-    file. It is ONE candidate, kept under its first spelling."""
-    native = box.native_version("2.1.283")
-    local = box.home / ".local" / "bin" / "claude"
-    local.parent.mkdir(parents=True)
-    local.symlink_to(native)
-    result = box.run(FAKE_NPM_INSTALL_RC="1", FAKE_NATIVE_UPDATE_RC="1")
-    assert result.returncode == 2, result.stderr
-    assert f"Installed: 2.1.283 at {native}." in result.stderr
-
-
-# --- Ask 3: update when behind, under a lock ---------------------------------
-
-def test_a_user_copy_behind_npm_is_updated_in_the_user_prefix_and_verified(box):
-    link = box.user_copy("2.1.283")
-    result = box.run("--porcelain")
-    assert result.returncode == 0, result.stderr
-    assert box.installs() == [
-        f"install -g --prefix {box.prefix} --no-fund --no-audit {PACKAGE}@2.1.284"]
-    fields = porcelain(result)
-    assert fields == {"path": str(link), "version": "2.1.284",
-                      "published": "2.1.284", "status": "verified"}
-    assert "updated" in result.stderr
-
-
-def test_the_package_hook_npm_skipped_is_run_before_the_version_is_read(box):
-    box.user_copy("2.1.283")
-    result = box.run("--porcelain", FAKE_NPM_HOOK_NEEDED="1")
-    assert result.returncode == 0, result.stderr
-    hook = box.prefix / "lib" / "node_modules" / "@anthropic-ai" / "claude-code" / "install.cjs"
-    assert box.node_log.read_text().splitlines() == [str(hook)]
-    assert porcelain(result)["status"] == "verified"
-
-
-def test_a_native_install_behind_npm_is_updated_with_claude_update(box):
-    box.native_version("2.1.283")
-    result = box.run("--porcelain", FAKE_NATIVE_UPDATE_TO="2.1.284")
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(box.native / "2.1.284"), "verified")
-    assert f"{box.native / '2.1.283'} update" in box.claude_log.read_text()
-    assert box.installs() == [], "the native update reached npm's version"
-
-
-def test_a_native_update_that_stops_short_falls_back_to_the_user_prefix(box):
-    """A native install on another channel (npm's `stable` tag lags `latest`)
-    cannot reach the published version with `claude update`, so the user
-    prefix is installed instead."""
-    box.native_version("2.1.283")
-    result = box.run("--porcelain", FAKE_NATIVE_UPDATE_TO="")
-    assert result.returncode == 0, result.stderr
-    assert len(box.installs()) == 1
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(box.prefix / "bin" / "claude"), "verified")
-
-
-def test_nothing_installed_is_installed_into_the_user_prefix(box):
-    fields = porcelain(box.run("--porcelain"))
-    assert (fields["path"], fields["status"]) == (str(box.prefix / "bin" / "claude"), "verified")
-
-
-def _place() -> str:
-    """The `<place>` a launch on this host writes into its lock: the host's
-    name and, where /proc shows one, the pid namespace's inode."""
-    host = os.uname().nodename
-    if not host or any(c in host for c in "/@:"):
-        host = "unknown"
-    try:
-        ns = "".join(c for c in os.readlink("/proc/self/ns/pid") if c.isdigit())
-    except OSError:
-        ns = ""
-    return f"{host}:{ns}" if ns else host
-
-
-def _hold_lock(box: Sandbox, seconds: float, then: str = ":") -> subprocess.Popen:
-    """Hold the update lock the way a second launch would, then run `then`."""
-    lock = box.cache / "claude-current.lock.l"
-    script = (f'ln -s "pid=$$@{_place()}" "{lock}"; touch "{box.root}/held"; '
-              f'sleep {seconds}; {then}; rm -f "{lock}"')
-    proc = subprocess.Popen(["bash", "-c", script], env=box.env())
-    deadline = time.monotonic() + 10
-    while not (box.root / "held").exists():
-        assert time.monotonic() < deadline, "the lock holder never took the lock"
-        time.sleep(0.05)
-    return proc
-
-
-def test_a_launch_waits_for_another_launchs_update_and_does_not_repeat_it(box):
-    box.user_copy("2.1.283")
-    installer = (f'"{box.bin / "npm"}" install -g --prefix "{box.prefix}" '
-                 f'{PACKAGE}@2.1.284 >/dev/null 2>&1')
-    holder = _hold_lock(box, 2, then=installer)
-    try:
-        result = box.run("--porcelain")
-    finally:
-        holder.wait(timeout=30)
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "verified"
-    assert "updated by another launch" in result.stderr
-    assert len(box.installs()) == 1, "only the other launch installed"
-
-
-def test_a_copy_ahead_of_npm_that_appears_during_the_wait_is_ahead(box):
-    """Copilot on #134: after the wait only an EQUAL copy was accepted, so a
-    copy newer than npm that another launch installed meanwhile (npm moved on
-    while this launch waited) reached the stale refusal, although the same
-    copy is `ahead` before any wait. The other launch takes the lock, installs
-    2.1.285 a second and a half later, and still holds the lock when this
-    launch's four-second wait runs out."""
-    box.user_copy("2.1.283")
-    installer = (f'"{box.bin / "npm"}" install -g --prefix "{box.prefix}" '
-                 f'{PACKAGE}@2.1.285 >/dev/null 2>&1; sleep 8')
-    holder = _hold_lock(box, 1.5, then=installer)
-    try:
-        result = box.run("--porcelain", CLAUDE_CURRENT_LOCK_WAIT="4")
-    finally:
-        holder.kill()
-        holder.wait(timeout=30)
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "ahead"
-    assert porcelain(result)["version"] == "2.1.285"
-    assert "(ahead of npm 2.1.284)" in result.stderr
-    assert "updated by another launch" in result.stderr
-    assert len(box.installs()) == 1, "only the other launch installed"
-
-
-def test_a_lock_that_is_never_free_is_a_refusal_that_names_it(box):
-    box.user_copy("2.1.283")
-    holder = _hold_lock(box, 8)
-    try:
-        result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1")
-    finally:
-        holder.kill()
-        holder.wait(timeout=30)
-    assert result.returncode == 2, result.stderr
-    assert "was not free within 1s" in result.stderr
-    assert box.installs() == []
-
-
-def test_a_lock_directory_that_cannot_be_made_is_named_as_that(box):
-    """Not as a lock somebody else holds: nobody does, and waiting would not
-    help. A regular file where a parent directory should be refuses the
-    `mkdir -p` whoever runs it, root included."""
-    box.user_copy("2.1.283")
-    blocker = box.root / "not-a-directory"
-    blocker.write_text("", encoding="utf-8")
-    result = box.run(CLAUDE_CURRENT_CACHE_DIR=str(blocker / "cache"))
-    assert result.returncode == 2, result.stderr
-    assert f"the update lock's directory {blocker / 'cache'} could not be created" in result.stderr
-    assert "was not free" not in result.stderr
-    assert box.installs() == []
-
-
-# --- Ask 5: refuse, with one escape ------------------------------------------
-
-def test_a_launch_still_behind_after_the_update_is_refused(box):
-    link = box.user_copy("2.1.283")
-    result = box.run(FAKE_NPM_INSTALL_RC="1")
-    assert result.returncode == 2
-    assert result.stdout == "", "a refusal hands back no path to launch"
-    for want in ("REFUSED", "npm publishes claude 2.1.284",
-                 f"the newest installed is 2.1.283 at {link}",
-                 f"Fix: npm install -g --prefix {box.prefix} {PACKAGE}@2.1.284",
-                 "CLAUDE_ALLOW_STALE=1 launches 2.1.283 anyway"):
-        assert want in result.stderr, want
-
-
-def test_claude_allow_stale_launches_the_newest_and_says_it_is_stale(box):
-    link = box.user_copy("2.1.283")
-    result = box.run("--porcelain", FAKE_NPM_INSTALL_RC="1", CLAUDE_ALLOW_STALE="1")
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result) == {"path": str(link), "version": "2.1.283",
-                                 "published": "2.1.284", "status": "stale"}
-    assert "STALE:" in result.stderr
-
-
-def test_a_copy_ahead_of_npm_launches_as_ahead_and_nothing_is_installed(box):
-    link = box.user_copy("2.1.285")
-    result = box.run("--porcelain")
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (str(link), "ahead")
-    assert "ahead of npm 2.1.284" in result.stderr
-    assert box.installs() == []
-
-
-# --- Ask 6: offline is not a refusal -----------------------------------------
-
-def test_npm_unreachable_launches_the_newest_installed_unverified(box):
-    box.native_version("2.1.280")
-    link = box.user_copy("2.1.283")
-    result = box.run("--porcelain", FAKE_NPM_VIEW_RC="1")
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result) == {"path": str(link), "version": "2.1.283",
-                                 "published": "", "status": "unverified"}
-    assert "UNVERIFIED: could not reach npm" in result.stderr
-    assert box.installs() == []
-
-
-def test_npm_that_hangs_is_bounded_by_the_timeout(box):
-    box.user_copy("2.1.283")
-    started = time.monotonic()
-    result = box.run("--porcelain", FAKE_NPM_VIEW_SLEEP="30", CLAUDE_CURRENT_TIMEOUT="1")
-    assert time.monotonic() - started < 20, "npm view was not bounded"
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "unverified"
-    assert "took longer than 1s" in result.stderr
-
-
-def path_without(box: Sandbox, *names: str) -> str:
-    """The sandbox's PATH, with every command the host's PATH finds except
-    `names`: how a stock macOS looks to this command (no `timeout`, no
-    `gtimeout`, no `flock`) on any host, so the fallbacks run everywhere."""
-    shadow = box.root / ("path-without-" + "-".join(names))
-    shadow.mkdir()
-    for directory in os.environ.get("PATH", "").split(os.pathsep):
-        if not directory or not os.path.isdir(directory):
-            continue
-        try:
-            entries = list(os.scandir(directory))
-        except OSError:
-            continue
-        for entry in entries:
-            target = shadow / entry.name
-            if entry.name in names or target.exists() or target.is_symlink():
-                continue
-            try:
-                runnable = entry.is_file() and os.access(entry.path, os.X_OK)
-            except OSError:
-                continue
-            if runnable:
-                target.symlink_to(entry.path)
-    for name in names:
-        assert not (shadow / name).exists()
-    return f"{box.bin}{os.pathsep}{shadow}"
-
-
-def test_the_watchdog_ends_a_hung_commands_children_too(box):
-    """Copilot on #134: with no `timeout` and no `gtimeout` the watchdog killed
-    only the command, and the command's own child (here the fake npm's
-    `sleep 30`) kept the command substitution open for all thirty seconds.
-    The watchdog now ends the whole tree, as `timeout` ends its group."""
-    box.user_copy("2.1.283")
-    started = time.monotonic()
-    result = box.run("--porcelain", FAKE_NPM_VIEW_SLEEP="30", CLAUDE_CURRENT_TIMEOUT="1",
-                     PATH=path_without(box, "timeout", "gtimeout"))
-    elapsed = time.monotonic() - started
-    assert elapsed < 15, f"the watchdog did not end the tree: {elapsed:.1f}s"
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "unverified"
-    assert "npm view took longer than 1s" in result.stderr
-
-
-def test_the_watchdog_rejects_output_when_term_is_handled_as_success(box):
-    box.user_copy("2.1.284")
-    (box.bin / "npm").write_text('''#!/usr/bin/env bash
-trap 'exit 0' TERM
-printf '2.1.284\\n'
-sleep 30
-''')
-    started = time.monotonic()
-    result = box.run("--porcelain", CLAUDE_CURRENT_TIMEOUT="1",
-                     PATH=path_without(box, "timeout", "gtimeout"))
-    assert time.monotonic() - started < 15
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "unverified"
-    assert porcelain(result)["published"] == ""
-    assert "npm view took longer than 1s" in result.stderr
-
-
-def test_the_watchdog_kills_children_spawned_by_a_term_handler(box):
-    box.user_copy("2.1.284")
-    (box.bin / "npm").write_text('''#!/usr/bin/env bash
-trap 'sleep 30 & exit 0' TERM
-printf '2.1.284\\n'
-sleep 30
-''')
-    started = time.monotonic()
-    result = box.run("--porcelain", CLAUDE_CURRENT_TIMEOUT="1",
-                     PATH=path_without(box, "timeout", "gtimeout"))
-    assert time.monotonic() - started < 15
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "unverified"
-    assert porcelain(result)["published"] == ""
-    assert "npm view took longer than 1s" in result.stderr
-
-
-@pytest.mark.parametrize("fallback", [False, True], ids=["host", "watchdog"])
-def test_a_command_that_ignores_term_is_killed_after_the_grace(box, fallback):
-    """Copilot on #134: TERM was the only signal, so a command that ignored it
-    (with its children) held the launch for as long as it liked. KILL follows
-    five seconds later on every branch: `timeout -k` on a host that has it,
-    and the watchdog's own on one that does not."""
-    box.user_copy("2.1.283")
-    env = {"FAKE_NPM_VIEW_SLEEP": "30", "FAKE_NPM_VIEW_IGNORE_TERM": "1",
-           "CLAUDE_CURRENT_TIMEOUT": "1"}
-    if fallback:
-        env["PATH"] = path_without(box, "timeout", "gtimeout")
-    started = time.monotonic()
-    result = box.run("--porcelain", **env)
-    elapsed = time.monotonic() - started
-    assert elapsed < 20, f"KILL never came: {elapsed:.1f}s"
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "unverified"
-    assert "npm view took longer than 1s" in result.stderr
-
-
-def _dead_pid() -> int:
-    proc = subprocess.Popen(["true"])
-    proc.wait()
-    return proc.pid
-
-
-def _link_lock(box: Sandbox, pid: int, place: str | None = None) -> Path:
-    """The lock as every launch makes it: a symlink whose text names its
-    owner, `pid=<pid>@<place>`, at this host's place unless told another."""
-    lock = box.cache / "claude-current.lock.l"
-    lock.symlink_to(f"pid={pid}@{_place() if place is None else place}")
-    return lock
-
-
-def test_a_link_lock_whose_owner_died_is_taken_over(box):
-    """No `flock`: the lock is a symlink whose text names its owner, and a pid
-    that is no longer running is a lock nobody holds."""
-    box.user_copy("2.1.283")
-    lock = _link_lock(box, _dead_pid())
-    result = box.run("--porcelain", CLAUDE_CURRENT_LOCK_WAIT="5",
-                     PATH=path_without(box, "flock"))
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "verified"
-    assert len(box.installs()) == 1
-    assert not lock.is_symlink(), "the lock was not released"
-    assert not (box.cache / "claude-current.lock.l.reap").exists()
-
-
-def test_the_link_lock_names_its_owner_while_it_is_held(box):
-    """Copilot on #134: a directory lock was made first and given its owner's
-    pid a line later, so a launch killed between the two left a lock with no
-    owner, which every later launch waited on and refused. `ln -s` makes the
-    lock and names the owner in one act. Observed from inside the update: the
-    fake npm reads the lock while the launch that holds it is installing."""
-    box.user_copy("2.1.283")
-    seen = box.root / "seen-lock"
-    lock = box.cache / "claude-current.lock.l"
-    result = box.run("--porcelain", PATH=path_without(box, "flock"),
-                     FAKE_NPM_INSTALL_HOOK=f'readlink "{lock}" > "{seen}"')
-    assert result.returncode == 0, result.stderr
-    owner = re.fullmatch(r"pid=([0-9]+)@(.+)", seen.read_text().strip())
-    assert owner, seen.read_text()
-    assert int(owner.group(1)) > 0
-    assert owner.group(2) == _place(), "the lock does not name where its pid runs"
-    assert not lock.is_symlink(), "the lock was not released"
-
-
-def test_a_directory_at_the_lock_path_is_refused_not_taken(box):
-    """`ln -s` onto a directory puts the link inside it and succeeds, which
-    would be a lock this launch believes it holds and nobody else can see."""
-    box.user_copy("2.1.283")
-    stray = box.cache / "claude-current.lock.l"
-    stray.mkdir()
-    result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1", PATH=path_without(box, "flock"))
-    assert result.returncode == 2, result.stderr
-    assert f"{stray} is a directory and not this command's lock" in result.stderr
-    assert list(stray.iterdir()) == [], "the link it made inside was left behind"
-    assert box.installs() == []
-
-
-def test_a_dead_owners_lock_another_launch_is_reaping_is_left_to_it(box):
-    """Copilot on #134: two launches that both saw one dead owner each removed
-    "the stale lock", and the second removal took the first one's new lock.
-    Only the launch holding the reaper directory removes it, so a launch that
-    finds the reaper taken leaves the lock alone and waits."""
-    box.user_copy("2.1.283")
-    lock = _link_lock(box, _dead_pid())
-    reaper = box.cache / "claude-current.lock.l.reap"
-    reaper.mkdir()
-    result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1", PATH=path_without(box, "flock"))
-    assert result.returncode == 2, result.stderr
-    assert lock.is_symlink(), "a launch removed a lock another launch was reaping"
-    assert "was not free within 1s" in result.stderr
-    assert f"{reaper}, the directory a launch holds while it removes a dead owner's lock" in result.stderr
-    assert box.installs() == []
-
-
-def test_a_live_link_lock_is_waited_on_and_never_removed(box):
-    box.user_copy("2.1.283")
-    lock = _link_lock(box, os.getpid())
-    result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1", PATH=path_without(box, "flock"))
-    assert result.returncode == 2, result.stderr
-    assert os.readlink(lock) == f"pid={os.getpid()}@{_place()}"
-    assert "was not free within 1s" in result.stderr
-    assert "the directory a launch holds" not in result.stderr
-    assert box.installs() == []
-
-
-def _flock_on_path(box: Sandbox) -> tuple[str, Path]:
-    """A PATH that HAS a `flock`, on any host: a shim first on it that logs
-    every call and hands it to the host's own `flock` where there is one."""
-    shim_dir = box.root / "flock-shim"
-    log = box.root / "flock.log"
-    log.write_text("")
-    real = shutil.which("flock") or ""
-    box._script(shim_dir / "flock",
-                f'#!/usr/bin/env bash\nprintf \'%s\\n\' "$*" >> "{log}"\n'
-                + (f'exec "{real}" "$@"\n' if real else "exit 0\n"))
-    return f"{box.bin}{os.pathsep}{shim_dir}{os.pathsep}{os.environ.get('PATH', '/usr/bin:/bin')}", log
-
-
-@pytest.mark.parametrize("holder_has_flock", [True, False],
-                         ids=["flock-holds-no-flock-waits", "no-flock-holds-flock-waits"])
-def test_launches_with_and_without_flock_on_path_exclude_each_other(box, holder_has_flock):
-    """Copilot on #134: the lock was `flock` when PATH had one and a symlink
-    when it did not, so a launch of each kind held its own lock and both
-    updated at once. Two real launches here, one with a `flock` on PATH and
-    one without, in both orders: the second waits for the first's update and
-    installs nothing, and `flock` is never called at all."""
-    box.user_copy("2.1.283")
-    with_flock, flock_log = _flock_on_path(box)
-    without_flock = path_without(box, "flock")
-    held = box.root / "held"
-    first, second = ((with_flock, without_flock) if holder_has_flock
-                     else (without_flock, with_flock))
-    holder = subprocess.Popen(
-        [str(CMD), "--porcelain"], cwd=str(box.root), text=True,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-        env=box.env(PATH=first, FAKE_NPM_INSTALL_HOOK=f'touch "{held}"; sleep 3'))
-    try:
-        deadline = time.monotonic() + 30
-        while not held.exists():
-            assert holder.poll() is None, holder.communicate()
-            assert time.monotonic() < deadline, "the first launch never began its update"
-            time.sleep(0.05)
-        result = box.run("--porcelain", PATH=second, CLAUDE_CURRENT_LOCK_WAIT="30")
-    finally:
-        out, err = holder.communicate(timeout=60)
-    assert holder.returncode == 0, err
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["status"] == "verified"
-    assert "updated by another launch" in result.stderr
-    assert len(box.installs()) == 1, "both launches updated: two locks, not one"
-    assert flock_log.read_text() == "", "flock was consulted, so PATH still picks the lock"
-
-
-def test_a_dead_owners_lock_made_at_another_place_is_waited_on_and_named(box):
-    """A container that shares this home shares this lock, and a pid read in
-    another pid namespace says nothing about its owner. So a lock whose place
-    is not this launch's is never taken over, dead as its pid looks here, and
-    the refusal says whose it is and where."""
-    box.user_copy("2.1.283")
-    dead = _dead_pid()
-    lock = _link_lock(box, dead, place="another-host:4026531999")
-    result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1")
-    assert result.returncode == 2, result.stderr
-    assert lock.is_symlink(), "a lock made at another place was taken over"
-    assert f"held by pid {dead} at another-host:4026531999" in result.stderr
-    assert f"this launch runs at {_place()}" in result.stderr
-    assert box.installs() == []
-
-
-def test_a_file_at_the_lock_path_is_named_not_waited_on_silently(box):
-    """Nothing this command makes: the refusal says what it reads there."""
-    box.user_copy("2.1.283")
-    stray = box.cache / "claude-current.lock.l"
-    stray.write_text("", encoding="utf-8")
-    result = box.run(CLAUDE_CURRENT_LOCK_WAIT="1")
-    assert result.returncode == 2, result.stderr
-    assert "It is not a lock this command makes (it reads 'not a symlink')" in result.stderr
-    assert stray.is_file()
-    assert box.installs() == []
-
-
-@pytest.mark.skipif(hasattr(os, "geteuid") and os.geteuid() == 0,
-                    reason="root writes in a read-only directory")
-def test_a_lock_directory_it_cannot_write_in_is_named_at_once(box):
-    """`flock` said "could not be opened" at once; the symlink lock must not
-    wait out its whole bound for a lock nobody holds."""
-    box.user_copy("2.1.283")
-    box.cache.chmod(0o555)
-    try:
-        started = time.monotonic()
-        result = box.run(CLAUDE_CURRENT_LOCK_WAIT="30")
-        elapsed = time.monotonic() - started
-    finally:
-        box.cache.chmod(0o755)
-    assert result.returncode == 2, result.stderr
-    assert f"the update lock {box.cache / 'claude-current.lock.l'} could not be made in {box.cache}" in result.stderr
-    assert "was not free" not in result.stderr
-    assert elapsed < 15, f"it waited for a lock nobody holds: {elapsed:.1f}s"
-    assert box.installs() == []
-
-
-def test_offline_reads_no_npm_and_installs_nothing(box):
-    link = box.user_copy("2.1.283")
-    result = box.run("--porcelain", "--offline")
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["path"] == str(link)
-    assert porcelain(result)["status"] == "unverified"
-    assert box.npm_log.read_text() == ""
-
-
-def test_nothing_installed_and_npm_unreachable_is_exit_1(box):
-    result = box.run(FAKE_NPM_VIEW_RC="1")
-    assert result.returncode == 1
-    assert result.stdout == ""
-    assert "no runnable Claude Code was found by absolute path" in result.stderr
-
-
-def test_no_npm_at_all_is_unverified_not_a_crash(box):
-    link = box.user_copy("2.1.283")
-    result = box.run("--porcelain", CLAUDE_CURRENT_NPM=str(box.root / "no-such-npm"))
-    assert result.returncode == 0, result.stderr
-    assert porcelain(result)["path"] == str(link)
-    assert "there is no npm" in result.stderr
-
-
-# --- the user prefix ----------------------------------------------------------
-
-@pytest.mark.parametrize("setting", ["CLAUDE_CURRENT_CACHE_DIR", "XDG_CACHE_HOME"])
-def test_relative_cache_shares_the_update_lock_across_checkouts(box, setting):
-    """Two checkouts sharing one install must not get independent cwd locks."""
-    box.user_copy("2.1.283")
-    first_cwd = box.root / "repo-a"
-    second_cwd = box.root / "repo-b"
-    first_cwd.mkdir()
-    second_cwd.mkdir()
-    entered = box.root / "updating"
-    release = box.root / "release"
-    overrides = {"CLAUDE_CURRENT_CACHE_DIR": "", setting: "relative-cache"}
-    cache = box.home / "relative-cache"
-    if setting == "XDG_CACHE_HOME":
-        cache /= "openrepotools"
-    holder_env = box.env(**overrides, FAKE_NPM_INSTALL_HOOK=(
-        'touch "$HOME/../updating"; '
-        'while [ ! -e "$HOME/../release" ]; do sleep 0.05; done'))
-    holder = subprocess.Popen([str(CMD), "--porcelain"], cwd=first_cwd,
-                              env=holder_env, stdout=subprocess.PIPE,
-                              stderr=subprocess.PIPE, text=True)
-    try:
-        deadline = time.monotonic() + 15
-        while not entered.exists():
-            assert holder.poll() is None, "first launch exited before updating"
-            assert time.monotonic() < deadline, "first launch never began updating"
-            time.sleep(0.02)
-        result = subprocess.run([str(CMD), "--porcelain"], cwd=second_cwd,
-                                env=box.env(**overrides, CLAUDE_CURRENT_LOCK_WAIT="1"),
-                                capture_output=True, text=True, timeout=30)
-        assert result.returncode == 2, result.stderr
-        assert "was not free within 1s" in result.stderr
-        assert (cache / "claude-current.lock.l").is_symlink()
-        assert len(box.installs()) == 1, "second checkout started a competing install"
-        assert not (first_cwd / "relative-cache").exists()
-        assert not (second_cwd / "relative-cache").exists()
-    finally:
-        release.touch()
-        stdout, stderr = holder.communicate(timeout=30)
-    assert holder.returncode == 0, stderr
-    assert porcelain(subprocess.CompletedProcess([], 0, stdout, stderr))["status"] == "verified"
-    assert len(box.installs()) == 1
-
-
-def test_the_user_prefix_falls_back_to_npm_config_prefix_then_to_npm_global(box):
-    elsewhere = box.root / "configured-prefix"
-    env = {"CLAUDE_CURRENT_NPM_PREFIX": ""}
-    result = box.run("--porcelain", NPM_CONFIG_PREFIX=str(elsewhere), **env)
-    assert porcelain(result)["path"] == str(elsewhere / "bin" / "claude")
-    result = box.run("--porcelain", **env)
-    assert porcelain(result)["path"] == str(box.home / ".npm-global" / "bin" / "claude")
-
-
-def test_the_user_prefix_is_read_from_the_npmrc_prefix_line(box):
-    (box.home / ".npmrc").write_text("fund=false\nprefix = ~/tools/npm\n")
-    result = box.run("--porcelain", CLAUDE_CURRENT_NPM_PREFIX="")
-    assert porcelain(result)["path"] == str(box.home / "tools" / "npm" / "bin" / "claude")
-
-
-@pytest.mark.parametrize("where", ["environment", ".npmrc"])
-def test_a_relative_user_prefix_is_taken_under_home(box, where):
-    """Copilot on #134: npm takes a relative `--prefix` and installs there, and
-    the candidate read back was then refused as not absolute, so the update
-    worked and the launch exited 1. Both commands anchor it at $HOME."""
-    env = {"CLAUDE_CURRENT_NPM_PREFIX": ""}
-    if where == "environment":
-        env["NPM_CONFIG_PREFIX"] = "rel-prefix"
-    else:
-        (box.home / ".npmrc").write_text("prefix=rel-prefix\n")
-    result = box.run("--porcelain", **env)
-    assert result.returncode == 0, result.stderr
-    fields = porcelain(result)
-    assert (fields["path"], fields["status"]) == (
-        str(box.home / "rel-prefix" / "bin" / "claude"), "verified")
-    assert box.installs() == [
-        f"install -g --prefix {box.home / 'rel-prefix'} --no-fund --no-audit {PACKAGE}@2.1.284"]
-
-
-# --- usage --------------------------------------------------------------------
-
-def test_help_and_an_unknown_argument(box):
-    result = box.run("--help")
-    assert result.returncode == 0
-    assert result.stdout.startswith("claude-current [--porcelain] [--offline]\n")
-    result = box.run("--bogus")
-    assert result.returncode == 64
-    assert "unknown argument: --bogus" in result.stderr
-
-
-@pytest.mark.parametrize("name", ["TIMEOUT", "VERSION_TIMEOUT", "UPDATE_TIMEOUT", "LOCK_WAIT"])
-def test_a_malformed_bound_is_refused_before_anything_runs(box, name):
-    """64, the usage status, and not 1: a launcher reports 1 as "no Claude
-    Code", which a typo in a bound is not (opensoft/workBenches#121)."""
-    result = box.run(**{f"CLAUDE_CURRENT_{name}": "soon"})
-    assert result.returncode == 64
-    assert f"CLAUDE_CURRENT_{name} must be a whole number" in result.stderr
-    assert box.npm_log.read_text() == ""
-
-
-# --- the file itself ------------------------------------------------------------
-
-#: The rules `tests/test_repo_hygiene.py` holds every listed bash file to,
-#: asked of the two #119 commands, which its lists do not name yet. That file
-#: is being changed by another open pull request, opensoft/openRepoTools#93,
-#: so this one calls its per-file rules rather than editing its lists. Once #93
-#: lands, `claude-current` belongs in its `SHIPPED_BASH` (`set -euo pipefail`)
-#: and `claude-restart-check` in its `HELPER_BASH` (`set -u`, no workspace
-#: resolver), and this list and the LF check below go (Copilot on #134).
-HYGIENE_RULES = [
-    hygiene.test_shipped_bash_parses_under_bash,
-    hygiene.test_the_two_spellings_of_a_flag_refuse_the_same_empty_value,
-    hygiene.test_no_shipped_bash_ends_its_options_after_an_operand,
-    hygiene.test_no_shipped_bash_leaves_a_variable_name_to_bash_3_2s_locale,
-    hygiene.test_no_shipped_bash_quotes_the_replacement_half_of_a_substitution,
-    hygiene.test_no_shipped_bash_opens_a_case_inside_a_command_substitution,
-    hygiene.test_no_shipped_bash_reaches_for_gnu_only_utilities_unaccompanied,
-]
-
-
-@pytest.mark.parametrize("rule", HYGIENE_RULES, ids=lambda r: r.__name__)
-@pytest.mark.parametrize("name", ["claude-current", "claude-restart-check"])
-def test_the_two_commands_keep_the_repositorys_bash_rules(name, rule):
-    rule(name)
-
-
-def test_claude_current_fails_loudly_and_claude_restart_check_never_does():
-    """`claude-current` is a launch's gate, so it stops at the first failure;
-    `claude-restart-check` runs inside every status line render, so it takes
-    `set -u` and never `set -e` — `lane-handoff`'s exception, for its reason."""
-    hygiene.test_shipped_bash_is_executable_and_fails_loudly("claude-current")
-    hygiene.test_the_lane_helpers_are_executable_and_declare_their_discipline(
-        "claude-restart-check")
-    code = [line for line in
-            (REPO / "claude-restart-check").read_text(encoding="utf-8").splitlines()
-            if not line.lstrip().startswith("#")]
-    assert not [line for line in code if re.match(r"\s*set\s+-[a-z]*e", line)], (
-        "claude-restart-check must not `set -e`: a failed read has to reach its "
-        "own 'print nothing, exit 0', not end the status line's render")
-
-
-def test_both_commands_are_tracked_with_lf_in_the_index():
-    """`test_every_shipped_bash_file_is_tracked_with_lf`, which reads its
-    names from `ALL_BASH`, asked of these two."""
-    proc = subprocess.run(["git", "ls-files", "--eol", "--", "claude-current",
-                           "claude-restart-check"], cwd=str(REPO),
-                          capture_output=True, text=True, check=True)
-    rows = proc.stdout.splitlines()
-    assert len(rows) == 2, proc.stdout
-    for row in rows:
-        assert "i/lf" in row, f"not LF in the index:\n    {row}"
-
-
-def _function(text: str, name: str) -> str:
-    match = re.search(rf"^{name}\(\) \{{\n.*?^\}}\n", text, re.S | re.M)
-    assert match, f"no {name}() in the file"
-    return match.group(0)
-
-
-@pytest.mark.parametrize("name", ["numcmp", "precmp", "vercmp", "npm_user_prefix"])
-def test_both_commands_order_versions_with_the_same_code(name):
-    """One idea of "newer" in both commands, and one idea of where the user
-    npm copy is: a restart notice that disagreed with the resolver about
-    either would contradict it."""
-    current = (REPO / "claude-current").read_text(encoding="utf-8")
-    check = (REPO / "claude-restart-check").read_text(encoding="utf-8")
-    assert _function(current, name) == _function(check, name)
-
-
-#: (a, b, vercmp a b). The pre-release rows are SemVer 2.0.0 rule 11's own
-#: example chain, 1.0.0-alpha < 1.0.0-alpha.1 < 1.0.0-alpha.beta < 1.0.0-beta
-#: < 1.0.0-beta.2 < 1.0.0-beta.11 < 1.0.0-rc.1 < 1.0.0, plus the case Copilot
-#: raised on #134: beta.9 against beta.10 as strings put beta.9 ahead.
-VERSION_ORDER = [
-    ("2.1.284", "2.1.284", "0"),
-    ("2.1.10", "2.1.9", "1"),
-    ("2.1.9", "2.1.10", "-1"),
-    ("10.0.0", "9.99.99", "1"),
-    ("2.1.284-beta.9", "2.1.284-beta.10", "-1"),
-    ("2.1.284-beta.10", "2.1.284-beta.9", "1"),
-    ("1.0.0-alpha", "1.0.0-alpha.1", "-1"),
-    ("1.0.0-alpha.1", "1.0.0-alpha.beta", "-1"),
-    ("1.0.0-alpha.beta", "1.0.0-beta", "-1"),
-    ("1.0.0-beta", "1.0.0-beta.2", "-1"),
-    ("1.0.0-beta.2", "1.0.0-beta.11", "-1"),
-    ("1.0.0-beta.11", "1.0.0-rc.1", "-1"),
-    ("1.0.0-rc.1", "1.0.0", "-1"),
-    ("1.0.0", "1.0.0-rc.1", "1"),
-    ("1.0.0-Beta", "1.0.0-alpha", "-1"),
-    ("1.0.0-rc.1+build.5", "1.0.0-rc.1", "0"),
-]
-
-
-@pytest.mark.parametrize("a,b,want", VERSION_ORDER)
-def test_versions_are_ordered_by_semver(a, b, want):
-    """vercmp as claude-current carries it, run on its own. Byte order for
-    the alphanumeric identifiers, so `Beta` sorts before `alpha` in every
-    locale, which is SemVer's rule and not the locale's."""
-    text = (REPO / "claude-current").read_text(encoding="utf-8")
-    funcs = "".join(_function(text, n) for n in ("numcmp", "precmp", "vercmp"))
-    result = subprocess.run(["bash", "-c", funcs + 'vercmp "$1" "$2"', "_", a, b],
-                            capture_output=True, text=True, timeout=30, check=False)
-    assert (result.returncode, result.stdout) == (0, want + "\n"), result.stderr
diff --git a/tests/test_claude_restart_check.py b/tests/test_claude_restart_check.py
deleted file mode 100644
index d84cae70..00000000
--- a/tests/test_claude_restart_check.py
+++ /dev/null
@@ -1,435 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`claude-restart-check`: the RESTART NEEDED line for a running session
-(opensoft/workBenches#119, the added scope of 2026-09-29).
-
-THE PROCESS TABLE IS A DIRECTORY THIS SUITE BUILDS. `CLAUDE_RESTART_CHECK_PROC`
-points the command at a fake `/proc` under `tmp_path`: each process is a
-directory holding a `status` file with its `PPid:` and an `exe` symlink whose
-TEXT is the target the kernel would report, including the ` (deleted)`
-suffix a replaced binary carries. Nothing here reads the real `/proc` or runs
-a real Claude Code.
-
-The shape measured on py-bench, 2026-09-29, is the default fixture: the status
-line command runs under `/bin/sh -c`, dash does not exec it, so its parent is
-the shell and claude is the shell's parent. npm renames the old package
-directory before deleting it, so the running exe path names a directory like
-`.claude-code-h9B5EqFE` that no longer exists.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-CMD = REPO / "claude-restart-check"
-GREEN, RESET = "\033[32m", "\033[0m"
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="claude-restart-check is a bash script"),
-              WINDOWS_SKIP]
-
-
-class Proc:
-    """A fake process table plus the installs it points into."""
-
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.proc = root / "proc"
-        self.proc.mkdir()
-        self.prefix = root / "npm-global"
-        self.versions = root / "home" / ".local" / "share" / "claude" / "versions"
-
-    def process(self, pid: int, ppid: int, exe: str | None = None) -> None:
-        d = self.proc / str(pid)
-        d.mkdir()
-        (d / "status").write_text(f"Name:\tx\nPid:\t{pid}\nPPid:\t{ppid}\n")
-        if exe is not None:
-            (d / "exe").symlink_to(exe)
-
-    def npm_package(self, version: str) -> Path:
-        pkg = self.prefix / "lib" / "node_modules" / "@anthropic-ai" / "claude-code"
-        (pkg / "bin").mkdir(parents=True, exist_ok=True)
-        (pkg / "package.json").write_text(
-            '{\n  "name": "@anthropic-ai/claude-code",\n'
-            f'  "version": "{version}",\n  "bin": {{ "claude": "bin/claude.exe" }}\n}}\n')
-        exe = pkg / "bin" / "claude.exe"
-        exe.write_text("#!/bin/sh\n")
-        exe.chmod(0o755)
-        return exe
-
-    def replaced_npm_exe(self) -> str:
-        """What the kernel reports after npm swapped the package underneath."""
-        return str(self.prefix / "lib" / "node_modules" / "@anthropic-ai"
-                   / ".claude-code-h9B5EqFE" / "bin" / "claude.exe") + " (deleted)"
-
-    def native(self, *versions: str, directory: Path | None = None) -> None:
-        directory = directory or self.versions
-        directory.mkdir(parents=True, exist_ok=True)
-        for v in versions:
-            f = directory / v
-            f.write_text("#!/bin/sh\n")
-            f.chmod(0o755)
-
-    def run(self, *args: str, **env: str) -> subprocess.CompletedProcess:
-        """The installs are read from `$HOME` and the user npm prefix as
-        claude-current reads them, so both point into this fixture and every
-        seam the host exports is dropped."""
-        full = {k: v for k, v in os.environ.items()
-                if k != "NO_COLOR" and not k.startswith(("CLAUDE_", "NPM_CONFIG_", "npm_config_"))}
-        full["HOME"] = str(self.root / "home")
-        full["NPM_CONFIG_PREFIX"] = str(self.prefix)
-        full["CLAUDE_RESTART_CHECK_PROC"] = str(self.proc)
-        full.update(env)
-        return subprocess.run([str(CMD), *args], env=full, cwd=str(self.root),
-                              capture_output=True, text=True, timeout=30,
-                              check=False)
-
-
-@pytest.fixture
-def table(tmp_path: Path) -> Proc:
-    return Proc(tmp_path)
-
-
-def status_line_tree(t: Proc, claude_exe: str) -> None:
-    """claude (200) -> /bin/sh -c (100): the status line passes --pid 100."""
-    t.process(200, 1, claude_exe)
-    t.process(100, 200, "/usr/bin/dash")
-
-
-def restart(old: str, new: str) -> str:
-    return f"RESTART NEEDED: running {old}, installed {new}; /ctx at your next breakpoint"
-
-
-def newer_copy(old: str, new: str) -> str:
-    return (f"NEWER COPY INSTALLED: running {old}, installed {new}; "
-            "/ctx checks npm before selecting a version")
-
-
-@pytest.mark.parametrize("color", [True, False])
-def test_a_newer_copy_does_not_promise_the_resolver_will_choose_it(table, color):
-    # The resolver prefers the npm-equal 2.1.284 over native 2.1.285 when
-    # npm publishes 2.1.284. This disk-only check cannot read that publication.
-    exe = table.npm_package("2.1.284")
-    table.native("2.1.285")
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.284", "--pid", "100",
-                       **({} if color else {"NO_COLOR": "1"}))
-    line = newer_copy("2.1.284", "2.1.285")
-    assert result.stdout == (f"{GREEN}{line}{RESET}\n" if color else line + "\n")
-    assert "RESTART NEEDED" not in result.stdout
-
-
-def test_a_binary_npm_replaced_under_the_session_asks_for_a_restart(table):
-    table.npm_package("2.1.284")
-    status_line_tree(table, table.replaced_npm_exe())
-    result = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1")
-    assert result.returncode == 0, result.stderr
-    assert result.stdout == restart("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_minified_package_json_is_read_too(table):
-    """Copilot on #134: only a `"version"` key on a line of its own was read,
-    so a minified package.json gave no installed version and a behind session
-    no notice. Pretty or minified, the first "version" is the one."""
-    exe = table.npm_package("2.1.283")
-    (exe.parent.parent / "package.json").write_text(
-        '{"name":"@anthropic-ai/claude-code","version":"2.1.284",'
-        '"bin":{"claude":"bin/claude.exe"},"engines":{"node":">=18"}}')
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_the_line_is_green_unless_no_color_is_set(table):
-    table.npm_package("2.1.284")
-    status_line_tree(table, table.replaced_npm_exe())
-    result = table.run("--running", "2.1.283", "--pid", "100")
-    assert result.stdout == f"{GREEN}{restart('2.1.283', '2.1.284')}{RESET}\n"
-
-
-def test_a_current_session_prints_nothing(table):
-    exe = table.npm_package("2.1.284")
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.284", "--pid", "100")
-    assert (result.returncode, result.stdout) == (0, "")
-
-
-def test_an_installed_version_newer_than_the_running_one_asks_even_undeleted(table):
-    exe = table.npm_package("2.1.284")
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_native_session_behind_the_newest_native_version_asks(table):
-    """The native updater writes the new version beside the old one, so the
-    running file is still there: the version comparison is what notices."""
-    table.native("2.1.283", "2.1.284")
-    status_line_tree(table, str(table.versions / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_native_session_on_the_newest_version_prints_nothing(table):
-    table.native("2.1.9", "2.1.10")
-    status_line_tree(table, str(table.versions / "2.1.10"))
-    assert table.run("--pid", "100").stdout == ""
-
-
-def test_a_running_version_that_is_not_a_version_falls_back_to_the_path(table):
-    table.native("2.1.283", "2.1.284")
-    status_line_tree(table, str(table.versions / "2.1.283"))
-    result = table.run("--running", "unknown", "--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_replaced_binary_with_no_readable_versions_still_asks(table):
-    status_line_tree(table, table.replaced_npm_exe())
-    result = table.run("--pid", "100", NO_COLOR="1")
-    assert result.stdout == restart("an older build", "a newer build") + "\n"
-
-
-def test_the_walk_reaches_claude_three_processes_up_and_no_further(table):
-    table.npm_package("2.1.284")
-    table.process(300, 1, table.replaced_npm_exe())
-    table.process(200, 300, "/usr/bin/bash")
-    table.process(100, 200, "/usr/bin/dash")
-    found = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1")
-    assert found.stdout == restart("2.1.283", "2.1.284") + "\n"
-    table.process(50, 100, "/usr/bin/bash")
-    too_far = table.run("--running", "2.1.283", "--pid", "50")
-    assert (too_far.returncode, too_far.stdout) == (0, "")
-
-
-def test_the_walk_starts_at_the_parent_by_default(table):
-    """No --pid: the walk starts at this command's own parent, which for a
-    `subprocess.run` is the test process itself."""
-    table.npm_package("2.1.284")
-    table.process(200, 1, table.replaced_npm_exe())
-    table.process(os.getpid(), 200, "/usr/bin/python3")
-    result = table.run("--running", "2.1.283", NO_COLOR="1")
-    assert result.stdout == restart("2.1.283", "2.1.284") + "\n"
-
-
-def test_an_npm_session_behind_a_newer_native_install_asks(table):
-    """Copilot on #134: the installed version was read only from the running
-    binary's own family, so an npm 2.1.283 session beside a native 2.1.284
-    said nothing. The notice leaves selection to the next registry check."""
-    exe = table.npm_package("2.1.283")
-    table.native("2.1.284")
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_native_session_behind_the_user_npm_copy_asks(table):
-    table.native("2.1.283")
-    table.npm_package("2.1.284")
-    status_line_tree(table, str(table.versions / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_an_older_install_in_the_other_family_is_no_reason(table):
-    exe = table.npm_package("2.1.284")
-    table.native("2.1.280")
-    status_line_tree(table, str(exe))
-    assert table.run("--running", "2.1.284", "--pid", "100").stdout == ""
-
-
-def test_the_native_directory_is_the_one_claude_current_reads(table):
-    exe = table.npm_package("2.1.283")
-    elsewhere = table.root / "native-elsewhere"
-    elsewhere.mkdir()
-    newer = elsewhere / "2.1.290"
-    newer.write_text("#!/bin/sh\n")
-    newer.chmod(0o755)
-    status_line_tree(table, str(exe))
-    result = table.run("--running", "2.1.283", "--pid", "100", NO_COLOR="1",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(elsewhere))
-    assert result.stdout == newer_copy("2.1.283", "2.1.290") + "\n"
-
-
-# --- a native directory CLAUDE_CURRENT_NATIVE_DIR moved (opensoft/openRepoTools#155) ---
-
-def custom_native(table: Proc, *versions: str) -> Path:
-    """A native versions directory that is not `.../claude/versions`, which is
-    the only spelling the process check used to know."""
-    directory = table.root / "custom" / "native"
-    table.native(*versions, directory=directory)
-    return directory
-
-
-def test_a_session_from_a_custom_native_directory_is_found(table):
-    """Copilot on #134: the installed versions were read from
-    CLAUDE_CURRENT_NATIVE_DIR but the running process was recognised only under
-    `.../claude/versions/`, so a session launched from the configured directory
-    was missed and a newer sibling went unannounced."""
-    directory = custom_native(table, "2.1.283", "2.1.284")
-    status_line_tree(table, str(directory / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(directory))
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_session_on_the_newest_custom_native_version_is_recognised_and_current(table):
-    """Silence alone would also be what a session the check never recognised
-    looks like. So the same process is asked twice: current, it prints nothing,
-    and told it runs an older version it names the newest, which only a
-    recognised session can do."""
-    directory = custom_native(table, "2.1.9", "2.1.10")
-    status_line_tree(table, str(directory / "2.1.10"))
-    env = {"CLAUDE_CURRENT_NATIVE_DIR": str(directory), "NO_COLOR": "1"}
-    current = table.run("--pid", "100", **env)
-    assert (current.returncode, current.stdout) == (0, "")
-    behind = table.run("--running", "2.1.9", "--pid", "100", **env)
-    assert behind.stdout == newer_copy("2.1.9", "2.1.10") + "\n"
-
-
-def test_a_binary_replaced_in_a_custom_native_directory_asks_for_a_restart(table):
-    directory = custom_native(table, "2.1.284")
-    status_line_tree(table, str(directory / "2.1.283") + " (deleted)")
-    result = table.run("--pid", "100", NO_COLOR="1",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(directory))
-    assert result.stdout == restart("2.1.283", "2.1.284") + "\n"
-
-
-@pytest.mark.parametrize("spelling", ["trailing-slash", "dot-dot"])
-def test_the_configured_directory_is_compared_by_its_canonical_path(table, spelling):
-    directory = custom_native(table, "2.1.283", "2.1.284")
-    configured = {"trailing-slash": f"{directory}/",
-                  "dot-dot": f"{directory}/../native"}[spelling]
-    status_line_tree(table, str(directory / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1", CLAUDE_CURRENT_NATIVE_DIR=configured)
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-@pytest.mark.skipif(not hasattr(os, "symlink"), reason="no symlinks here")
-def test_a_symlinked_native_directory_matches_the_path_the_kernel_reports(table):
-    """`/proc/<pid>/exe` resolves every symlink, so a session launched through
-    a link into the configured directory reports the directory's real path."""
-    real = custom_native(table, "2.1.283", "2.1.284")
-    link = table.root / "versions-link"
-    link.symlink_to(real)
-    status_line_tree(table, str(real.resolve() / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(link))
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-@pytest.mark.skipif(not hasattr(os, "symlink"), reason="no symlinks here")
-def test_a_symlinked_default_native_directory_is_found_with_no_variable_set(table):
-    """The default directory is compared by its canonical path too: with
-    `~/.local/share/claude` a link to `/x/persist/cl-native` the kernel reports
-    `/x/persist/cl-native/versions/<x.y.z>`, which holds no `/claude/versions/`,
-    and a session there was missed until CLAUDE_CURRENT_NATIVE_DIR was set to
-    that same default."""
-    real = table.root / "persist" / "cl-native"
-    table.native("2.1.283", "2.1.284", directory=real / "versions")
-    share = table.root / "home" / ".local" / "share"
-    share.mkdir(parents=True)
-    (share / "claude").symlink_to(real)
-    status_line_tree(table, str(real.resolve() / "versions" / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_a_session_from_the_default_directory_is_still_found_when_another_is_set(table):
-    table.native("2.1.283", "2.1.284")
-    status_line_tree(table, str(table.versions / "2.1.283"))
-    elsewhere = table.root / "elsewhere"
-    elsewhere.mkdir()
-    result = table.run("--pid", "100", NO_COLOR="1",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(elsewhere))
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-@pytest.mark.parametrize("exe", ["tool", "nested/2.1.283", "2.1.283/claude"])
-def test_only_a_version_file_in_the_configured_directory_is_a_claude_binary(table, exe):
-    """Not every executable in the directory, and not one below it: the check
-    stays as narrow as `.../claude/versions/<x.y.z>` was."""
-    directory = custom_native(table, "2.1.284")
-    status_line_tree(table, str(directory / exe) + " (deleted)")
-    result = table.run("--pid", "100", CLAUDE_CURRENT_NATIVE_DIR=str(directory))
-    assert (result.returncode, result.stdout) == (0, "")
-
-
-def test_a_version_file_outside_the_configured_directory_is_not_claude(table):
-    directory = custom_native(table, "2.1.284")
-    other = table.root / "other" / "2.1.283"
-    other.parent.mkdir()
-    status_line_tree(table, str(other) + " (deleted)")
-    result = table.run("--pid", "100", CLAUDE_CURRENT_NATIVE_DIR=str(directory))
-    assert (result.returncode, result.stdout) == (0, "")
-
-
-def test_a_configured_directory_that_is_not_there_changes_nothing(table):
-    status_line_tree(table, str(table.root / "gone" / "2.1.283"))
-    result = table.run("--pid", "100",
-                       CLAUDE_CURRENT_NATIVE_DIR=str(table.root / "gone"))
-    assert (result.returncode, result.stdout, result.stderr) == (0, "", "")
-
-
-def test_a_custom_native_directory_with_no_process_table_prints_nothing(table):
-    directory = custom_native(table, "2.1.284")
-    result = table.run("--running", "2.1.283", "--pid", "100",
-                       CLAUDE_RESTART_CHECK_PROC=str(table.root / "no-proc"),
-                       CLAUDE_CURRENT_NATIVE_DIR=str(directory))
-    assert (result.returncode, result.stdout, result.stderr) == (0, "", "")
-
-
-def test_a_relative_user_prefix_is_read_under_home(table):
-    """The same anchor claude-current installs under (Copilot on #134)."""
-    table.native("2.1.283")
-    pkg = (table.root / "home" / "rel-prefix" / "lib" / "node_modules"
-           / "@anthropic-ai" / "claude-code")
-    pkg.mkdir(parents=True)
-    (pkg / "package.json").write_text('{\n  "version": "2.1.284"\n}\n')
-    status_line_tree(table, str(table.versions / "2.1.283"))
-    result = table.run("--pid", "100", NO_COLOR="1", NPM_CONFIG_PREFIX="rel-prefix")
-    assert result.stdout == newer_copy("2.1.283", "2.1.284") + "\n"
-
-
-def test_no_home_reads_only_the_running_install(table):
-    exe = table.npm_package("2.1.284")
-    table.native("2.1.290")
-    status_line_tree(table, str(exe))
-    env = {k: v for k, v in os.environ.items() if k != "HOME"}
-    env["CLAUDE_RESTART_CHECK_PROC"] = str(table.proc)
-    result = subprocess.run(["env", "-u", "HOME", str(CMD), "--running", "2.1.284",
-                             "--pid", "100"], env=env, capture_output=True,
-                            text=True, timeout=30, check=False)
-    assert (result.returncode, result.stdout, result.stderr) == (0, "", "")
-
-
-def test_no_claude_above_it_prints_nothing(table):
-    table.process(200, 1, "/usr/bin/tmux")
-    table.process(100, 200, "/usr/bin/dash")
-    assert table.run("--pid", "100").stdout == ""
-
-
-def test_a_host_with_no_process_table_prints_nothing_and_exits_0(table):
-    result = table.run("--running", "2.1.283", "--pid", "100",
-                       CLAUDE_RESTART_CHECK_PROC=str(table.root / "no-proc"))
-    assert (result.returncode, result.stdout, result.stderr) == (0, "", "")
-
-
-def test_a_pid_that_is_not_a_number_prints_nothing_and_exits_0(table):
-    result = table.run("--pid", "not-a-pid")
-    assert (result.returncode, result.stdout) == (0, "")
-
-
-def test_help_and_an_unknown_argument(table):
-    result = table.run("--help")
-    assert result.returncode == 0
-    assert result.stdout.startswith("claude-restart-check [--running <version>] [--pid <pid>]\n")
-    result = table.run("--bogus")
-    assert result.returncode == 64
-    assert "unknown argument: --bogus" in result.stderr
-    assert table.run("--pid").returncode == 64
diff --git a/tests/test_command_builtin_errexit_292.py b/tests/test_command_builtin_errexit_292.py
deleted file mode 100644
index 7cb93591..00000000
--- a/tests/test_command_builtin_errexit_292.py
+++ /dev/null
@@ -1,401 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""A utility run through `command` under `set -e`, on macOS's bash 3.2 (#292).
-
-THE QUIRK. Under `set -e`, GNU bash 3.2.57, the `/bin/bash` every Mac ships,
-exits when a utility run through the `command` builtin fails, even where
-`set -e` is suspended: on the left of `||` or `&&`, after `!`, in an `if`,
-`while` or `until` condition, and in a function called from any of those.
-bash 5.2 carries on there, as POSIX says it must. Measured under
-`set -euo pipefail` on a musl build of GNU bash 3.2.57 and on bash 5.2.21:
-
-* exits under 3.2 and carries on under 5.2: `command false || :`,
-  `if command grep -q x /dev/null; then :; fi`, `! command false`,
-  `rc=0; command false || rc=$?`, `while command false; do :; done`,
-  `{ command false; } || :`, `FOO=1 command false || :`, a `case` arm's
-  `command cd /nonexistent || :`, and `f() { command false || :; }; f`;
-* the same under both: `grep -q x /dev/null || :`, with no `command`;
-  `command -v nonexistent || :`; `printf '' | command grep -q x || :`, where
-  bash forks the pipeline element; `x=$(command false; echo after)`, because
-  neither bash runs a command substitution under `set -e` outside POSIX mode;
-  and `(command false) || :`, a subshell whose whole body is the command.
-
-THE THREE PLACES IT ENDED A SHIPPED COMMAND on `a42946e`, each run below the
-way its script runs it. Each case FAILS under bash 3.2.57 before #292's fix
-and passes under bash 5.2, before the fix and after it:
-
-* `lanes --worktrees` (`lanes:317`): `grep -v` drops the helper's "not
-  fetching" note from its stderr, and exits 1 when it has selected nothing, so
-  a helper that said nothing else ended `lanes` with exit 1 and no output;
-* `openRepoTools`' `wip_hygiene_lines` (`:4014`): its `grep -Fqx` fails
-  exactly when a hygiene line is missing from the `.gitignore`, which is the
-  case the function exists for;
-* `lane-end`'s `dh_settle_gone` (`:1377`): `command -p ps -p` fails exactly
-  when the pid is gone, which is the answer the function waits for.
-
-THESE CASES RUN UNDER THE `bash` ON PATH, which is the bash the scripts run
-under, since each starts `#!/usr/bin/env bash`. CI cannot show their red: the
-macOS jobs left `tests.yml` with #227, so every job runs Linux's bash 5. To
-see it, put a directory holding a bash 3.2 first on PATH and run them again;
-on a Mac whose PATH has no other bash, that is `/bin/bash` already.
-
-WHAT LINUX CI CAN SEE is the scan below. It reads every shipped bash file that
-turns `set -e` on with bash's OWN PARSER, and it allows a `command <utility>`
-only where `ALLOWED` names the use and the reason it cannot trip the quirk.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import subprocess
-from collections import Counter
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP,
-              pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="bash is not installed")]
-
-LANES = REPO / "lanes"
-OPEN_REPO_TOOLS = REPO / "openRepoTools"
-LANE_END = REPO / "lane-end"
-
-#: The note `lanes-edit.sh` prints when it reads the register without a fetch,
-#: and the one line `lanes --worktrees` drops from the helper's stderr.
-NOT_FETCHING = ("lanes-edit: LANES_NO_FETCH=1 — not fetching; reading origin/main "
-                "as the ref already stands here")
-
-
-def bash_env(**extra: str) -> dict:
-    """The caller's environment, without what could change what bash runs.
-
-    `BASH_ENV` and `ENV` are files a non-interactive bash sources first, and
-    an exported `BASH_FUNC_*` is a function every bash child defines, so a
-    developer's own would change these answers. PATH STAYS: the `bash` on it
-    is the bash under test.
-    """
-    env = {k: v for k, v in os.environ.items()
-           if not k.startswith(("LANES_", "TMUX", "CLAUDE_", "BASH_FUNC_"))
-           and k not in ("BASH_ENV", "ENV")}
-    env.update(extra)
-    return env
-
-
-def source_between(path: Path, start: str, end: str, after: str = "") -> str:
-    """The text of `path` from `start` through the first `end` that follows
-    `after` (itself searched for from `start`)."""
-    source = path.read_text(encoding="utf-8")
-    for mark in (start, after):
-        assert mark in source, f"{path.name} no longer carries {mark.strip()!r}"
-    i = source.index(start)
-    return source[i:source.index(end, source.index(after, i)) + len(end)]
-
-
-# --- lanes --worktrees (lanes:317) --------------------------------------------
-
-def tree_row() -> str:
-    """One `TREE` row of `lanes-edit.sh worktrees`, sixteen fields joined by
-    the unit separator, in the order `lanes` reads them."""
-    return "\x1f".join([
-        "TREE", "Eagle", "openRepoTools-4", "lane", "/w/openRepoTools-4/tree-292",
-        "fix/bash32-command-errexit-292", "main", "RUNNING", "1", "-", "1",
-        "2026-10-20T23:00Z", "-", "0", "0", "inventory"]) + "\n"
-
-
-@pytest.mark.parametrize("helper_stderr", [
-    pytest.param(NOT_FETCHING + "\n", id="only-the-not-fetching-note"),
-    pytest.param("", id="nothing"),
-    pytest.param(NOT_FETCHING + "\nlanes-edit: read: the sidecars\n",
-                 id="the-note-and-another-line"),
-])
-def test_lanes_worktrees_lists_the_trees_whatever_the_helper_said_on_stderr(
-        tmp_path, helper_stderr):
-    """`lanes --worktrees` filters the helper's stderr with `grep -v`, which
-    exits 1 when it selects nothing: when the helper printed only the "not
-    fetching" note, or nothing at all. Spelled `command grep … || :`, that
-    ended `lanes` under bash 3.2 with exit 1 and NO OUTPUT, before the header.
-    The third case selects a line, so it never tripped; it pins that the
-    filter passes every other line on and drops only the note."""
-    rows = tmp_path / "rows"
-    rows.write_text(tree_row(), encoding="utf-8")
-    err = tmp_path / "err"
-    err.write_text(helper_stderr, encoding="utf-8")
-    helper = tmp_path / "lanes-edit.sh"
-    helper.write_text('#!/bin/sh\n'
-                      '[ "$1" = worktrees ] || { echo "unexpected: $*" >&2; exit 70; }\n'
-                      'cat -- "$FAKE_ROWS"\ncat -- "$FAKE_ERR" >&2\n', encoding="utf-8")
-    helper.chmod(0o755)
-    (tmp_path / "home").mkdir()
-    (tmp_path / "tmp").mkdir()
-    proc = subprocess.run(
-        ["bash", str(LANES), "--worktrees", "--all"], capture_output=True, text=True,
-        check=False, timeout=60, stdin=subprocess.DEVNULL,
-        env=bash_env(HOME=str(tmp_path / "home"), TMPDIR=str(tmp_path / "tmp"),
-                     LANES_EDIT=str(helper), FAKE_ROWS=str(rows), FAKE_ERR=str(err)))
-    assert proc.returncode == 0, (
-        f"lanes --worktrees exited {proc.returncode}\nstdout: {proc.stdout!r}\n"
-        f"stderr: {proc.stderr!r}")
-    assert "/w/openRepoTools-4/tree-292" in proc.stdout, proc.stdout
-    assert "1 worktree(s) in 1 lane(s) on 1 workstation(s)" in proc.stdout, proc.stdout
-    assert "not fetching" not in proc.stderr, proc.stderr
-    for line in helper_stderr.splitlines():
-        if "not fetching" not in line:
-            assert line in proc.stderr, (line, proc.stderr)
-
-
-# --- openRepoTools' wip_hygiene_lines (openRepoTools:4014) -----------------------
-
-#: `openRepoTools`' `WIP_HYGIENE_LINES`, restated so a case can name its answer.
-HYGIENE_LINES = ("__pycache__/", "*.pyc", "*.pyo", ".pytest_cache/", ".mypy_cache/",
-                 ".ruff_cache/", "node_modules/", ".venv/", "venv/", "site-packages/")
-
-
-@pytest.mark.parametrize("have", [
-    pytest.param("*.swp\n", id="carries-none-of-them"),
-    pytest.param("__pycache__/\n*.pyc\nvenv/\n", id="carries-three"),
-    pytest.param("".join(f"{x}\n" for x in HYGIENE_LINES), id="carries-them-all"),
-])
-def test_wip_hygiene_lines_collects_the_missing_lines_under_set_e(tmp_path, have):
-    """`wip_hygiene_lines` runs under `openRepoTools`' `set -euo pipefail`,
-    called as its caller calls it: on the left of `||`, appending to the file
-    it reads. Its `grep -Fqx` fails exactly when a line is MISSING, which is the
-    case the function is for; spelled `command grep`, that ended the script
-    under bash 3.2 instead of collecting the line, part-way through writing a
-    template's `.gitignore`. A file that carries every line never fails a
-    `grep`, so that case never tripped; it pins that nothing is repeated."""
-    gitignore = tmp_path / "gitignore"
-    gitignore.write_text(have, encoding="utf-8")
-    function = source_between(OPEN_REPO_TOOLS, "\nWIP_HYGIENE_LINES=(", "\n}\n",
-                              after="\nwip_hygiene_lines()")
-    script =("set -euo pipefail\n" + function
-              + '\nwip_hygiene_lines "$1" >>"$1" || { echo "the caller refused" >&2; exit 3; }\n'
-              + "printf 'reached\\n'\n")
-    proc = subprocess.run(["bash", "-c", script, "bash", str(gitignore)],
-                          capture_output=True, text=True, check=False, timeout=60,
-                          env=bash_env())
-    assert (proc.returncode, proc.stdout) == (0, "reached\n"), (
-        f"exit {proc.returncode}\nstdout: {proc.stdout!r}\nstderr: {proc.stderr!r}")
-    lines = gitignore.read_text(encoding="utf-8").splitlines()
-    for line in HYGIENE_LINES:
-        assert lines.count(line) == 1, (line, lines)
-
-
-# --- lane-end's dh_settle_gone (lane-end:1377) -----------------------------------
-
-def test_lane_end_settles_a_gone_pid_as_gone_under_set_e(tmp_path):
-    """`dh_settle_gone` answers 0 once `kill -0` AND `ps -p` both say a pid is
-    gone. It runs under `lane-end`'s `set -euo pipefail`, called on the left of
-    `||` and asking `ps` after `!` in an `if`, and `ps -p` fails exactly when
-    the pid is gone: spelled `! command -p ps -p …`, that ended `lane-end`
-    under bash 3.2 at the moment it had its answer.
-
-    THE `ps` ON PATH HERE CALLS EVERY PID ALIVE, as the shell suite's fake does
-    for its whole run. `command -p` is how `dh_settle_gone` reaches the REAL
-    `ps` past it (the comment above the function says why), so a bare `ps -p`
-    would answer "still alive" for two seconds and this case would fail too.
-    """
-    fakebin = tmp_path / "fakebin"
-    fakebin.mkdir()
-    (fakebin / "ps").write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
-    (fakebin / "ps").chmod(0o755)
-    gone = subprocess.Popen(["true"])
-    gone.wait()
-    function = source_between(LANE_END, "\n    dh_settle_gone() {", "\n    }\n",
-                              after="\n    dh_settle_gone() {")
-    script = ("set -euo pipefail\n" + function
-              + 'settled=1; dh_settle_gone "$1" || settled=0\n'
-              + "printf 'settled=%s\\n' \"$settled\"\n")
-    env = bash_env()
-    env["PATH"] = str(fakebin) + os.pathsep + env.get("PATH", "")
-    proc = subprocess.run(["bash", "-c", script, "bash", str(gone.pid)],
-                          capture_output=True, text=True, check=False, timeout=60, env=env)
-    assert (proc.returncode, proc.stdout) == (0, "settled=1\n"), (
-        f"exit {proc.returncode}\nstdout: {proc.stdout!r}\nstderr: {proc.stderr!r}")
-
-
-# --- the scan Linux CI can see ---------------------------------------------------
-
-#: THE SCAN, IN BASH. `command` and `set` are aliased to marker words, and the
-#: file is parsed as the body of a function that is never called. bash expands
-#: an alias only where the word is in COMMAND POSITION, as the parser reads it,
-#: and `declare -f` prints the parsed function back with the markers in place.
-#: So a `command` in a string, a heredoc or a comment is never a finding, and
-#: every `command` bash would run as the builtin is one. bash 3.2.57 and 5.2.21
-#: print every line this file keys on alike.
-#:
-#: A command substitution's text is printed as it was written, so a `command`
-#: inside `$( )` or backticks is not seen. Neither bash runs a command
-#: substitution under `set -e` outside POSIX mode (measured: under 3.2.57,
-#: `x=$(command false; echo after)` sets `after`), so none can trip the quirk.
-SCAN = r"""
-shopt -s expand_aliases
-alias command=__ort292_command_word__
-alias set=__ort292_set_word__
-scanned=$(cat -- "$1") || exit 3
-eval "__ort292_scanned__() {
-$scanned
-}" || exit 4
-declare -f __ort292_scanned__
-"""
-COMMAND_WORD = "__ort292_command_word__"
-SET_WORD = "__ort292_set_word__"
-
-#: `command -v`, `-V` and `-pv` look a name up and run nothing.
-LOOKUP = re.compile(r"-[pvV]*[vV][pvV]*")
-
-#: THE USES THAT STAY, each with the reason it cannot trip the quirk. A key is
-#: the line as `declare -f` prints it, `command` put back; the scan's failure
-#: prints a new use in exactly this form. Each entry allows ONE occurrence.
-ALLOWED = {
-    ("lanes", r"""printf '%s\n' "$fetch_err" | command grep '^read: ' 1>&2 || :"""):
-        "a pipeline element: bash forks it, so `set -e` ending that child at "
-        "`grep` ends it with grep's own status, which the pipeline hands to "
-        "`|| :` as under bash 5 (measured: `printf '' | command grep -q x || :` "
-        "carries on under 3.2.57)",
-    ("lane-end", r"""if ! kill -0 "$1" 2> /dev/null && ! ( command -p ps -p "$1" > /dev/null 2>&1 ); then"""):
-        "the whole body of a subshell, whose status is ps's whether or not "
-        "`set -e` ends it there (measured: `(command false) || :` carries on "
-        "under 3.2.57). `command -p` stays: the shell suite fakes `ps` on PATH "
-        "for its whole run, and `command -p` reaches the real one on the "
-        "default PATH, as the comment above `dh_settle_gone` says",
-}
-
-
-def shipped_bash() -> list:
-    """Every bash file `--install` places, read out of the installer's own
-    `INSTALLABLES`, as `test_repo_hygiene` reads it for the modes: the next
-    command this repository ships is scanned without anyone coming here."""
-    text = OPEN_REPO_TOOLS.read_text(encoding="utf-8")
-    match = re.search(r"^INSTALLABLES=\(([^)]*)\)$", text, re.MULTILINE)
-    assert match, "openRepoTools no longer declares `INSTALLABLES=( … )`"
-    return [name for name in match.group(1).split()
-            if (REPO / name).read_text(encoding="utf-8").startswith("#!/usr/bin/env bash\n")]
-
-
-def parsed(path: Path) -> str:
-    """`path` as bash's parser read it, with the two marker words in place."""
-    proc = subprocess.run(["bash", "-c", SCAN, "scan", str(path)], capture_output=True,
-                          encoding="utf-8", errors="replace", check=False, timeout=120,
-                          env=bash_env())
-    assert proc.returncode == 0, f"bash could not parse {path}:\n{proc.stderr}"
-    return proc.stdout
-
-
-def turns_errexit_on(printed: str) -> bool:
-    """Whether any `set` the parser saw turns `set -e` on (`-e`, a cluster
-    holding `e`, or `-o errexit`). A `set -e` anywhere counts for the whole
-    file: a function the scan reads is not asked where it is called from."""
-    for match in re.finditer(re.escape(SET_WORD) + r"((?:[ \t]+[^ \t;&|]+)*)", printed):
-        args = match.group(1).split()
-        for i, arg in enumerate(args):
-            if arg == "--":
-                break
-            if re.fullmatch(r"-[A-Za-z]*e[A-Za-z]*", arg):
-                return True
-            if arg == "-o" and args[i + 1:i + 2] == ["errexit"]:
-                return True
-    return False
-
-
-def command_uses(printed: str) -> list:
-    """Every line holding a `command` that runs a utility, as printed, with
-    `command` and `set` put back and the trailing `;` dropped; once per use."""
-    found = []
-    for line in printed.splitlines():
-        for match in re.finditer(re.escape(COMMAND_WORD) + r"(?=[ \t]|$)", line):
-            first = line[match.end():].split()[:1]
-            if first and LOOKUP.fullmatch(first[0]):
-                continue
-            found.append(line.strip().rstrip(";").rstrip()
-                         .replace(COMMAND_WORD, "command").replace(SET_WORD, "set"))
-    return found
-
-
-def test_no_shipped_errexit_script_runs_a_utility_through_command_where_bash_32_exits():
-    """THE QUIRK CANNOT COME BACK UNSEEN. Every `command <utility>` in a
-    shipped bash file that turns `set -e` on is either named in `ALLOWED`, with
-    the reason it cannot trip bash 3.2, or a finding.
-
-    The scan asks no question about CONTEXT, on purpose: a plain statement
-    inside a function is in a suspended context whenever the function is
-    called from one, and no scan of one file sees every caller. So every use is
-    named or gone. The fix for a finding is the bare utility, as the rest of
-    these files write it; or a subshell whose whole body is the command, where
-    `command` matters, with an `ALLOWED` entry saying why.
-
-    A FILE THAT NEVER TURNS `set -e` ON IS NOT SCANNED, because no failure
-    ends it: `lanes-edit.sh`, `lane-handoff`, `lane-rename` and
-    `claude-restart-check` today, each for the reason `test_repo_hygiene`
-    gives. The day one of them turns it on, its uses are findings here.
-    """
-    scanned, found = [], Counter()
-    for name in shipped_bash():
-        printed = parsed(REPO / name)
-        text = (REPO / name).read_text(encoding="utf-8")
-        if "\nset -euo pipefail\n" in text:
-            assert turns_errexit_on(printed), f"the scan missed {name}'s `set -euo pipefail`"
-        if not turns_errexit_on(printed):
-            continue
-        scanned.append(name)
-        found.update((name, line) for line in command_uses(printed))
-    assert {"openRepoTools", "lanes", "lane-end"} <= set(scanned), scanned
-    allowed = Counter(ALLOWED.keys())
-    unexplained = sorted((found - allowed).elements())
-    stale = sorted((allowed - found).elements())
-    assert not unexplained and not stale, (
-        "macOS's bash 3.2 ends a `set -e` script where a utility run through "
-        "`command` fails, even on the left of `||` or `&&`, after `!`, in a "
-        "condition, or in a function called from one (#292).\n"
-        + "".join(f"  NOT IN ALLOWED: {n}: {line}\n" for n, line in unexplained)
-        + "".join(f"  ALLOWED BUT GONE: {n}: {line}\n" for n, line in stale)
-        + "Drop `command`, or make the command a subshell's whole body and say "
-          "why in ALLOWED; delete an entry whose use is gone.")
-
-
-SYNTHETIC = r"""#!/usr/bin/env bash
-set -euo pipefail
-note="prose: this command grep -q x is text
-command grep -q x on a line of its own is text too"
-# command grep -q x in a comment
-cat <<'TEXT'
-command grep -q x in a heredoc
-TEXT
-command -v git >/dev/null || :
-x=$(command grep -q x /dev/null || echo none)
-printf '' | command grep -q x || :
-(command false) || :
-f() { command grep -q x "$1" || return 1; }
-if command test -e /nonexistent; then :; fi
-while command false; do :; done
-! command false
-FOO=1 command -p false || :
-"""
-
-
-@pytest.mark.parametrize("set_line, errexit", [
-    ("set -euo pipefail", True), ("set -e", True), ("set -o errexit", True),
-    ("set -u", False), ("set +e", False), ("set -- -e", False),
-])
-def test_the_scan_finds_every_command_in_command_position_and_nothing_else(
-        tmp_path, set_line, errexit):
-    """The scan's own rule, on a file whose answer is known: prose, a comment,
-    a heredoc, a command substitution and `command -v` are not uses; every
-    other `command` bash runs as the builtin is one, the safe shapes included,
-    because the scan names uses and `ALLOWED` judges them."""
-    source = tmp_path / "synthetic"
-    source.write_text(SYNTHETIC.replace("set -euo pipefail", set_line, 1), encoding="utf-8")
-    printed = parsed(source)
-    assert turns_errexit_on(printed) is errexit
-    assert command_uses(printed) == [
-        "printf '' | command grep -q x || :",
-        "( command false ) || :",
-        'command grep -q x "$1" || return 1',
-        "if command test -e /nonexistent; then",
-        "while command false; do",
-        "! command false",
-        "FOO=1 command -p false || :",
-    ]
diff --git a/tests/test_commit_push_published_edit_194.py b/tests/test_commit_push_published_edit_194.py
deleted file mode 100644
index d27e44ee..00000000
--- a/tests/test_commit_push_published_edit_194.py
+++ /dev/null
@@ -1,641 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""A register edit that is already a local commit is PUBLISHED by the re-run
-its own RECOVERY prints (opensoft/openRepoTools#194).
-
-`commit_push` returned at *"nothing staged … no commit made"* BEFORE its push
-loop. So when a peer's uncommitted file had blocked the rebase and the helper
-had exited 3 with the edit as a local commit, the RECOVERY it printed — the
-peer commits its file, then `LANES_LANE=<lane> lanes-edit.sh commit "<what you
-wrote>"` — staged nothing, exited 0 and pushed nothing. The commit stayed local
-until some later write from that checkout happened to carry it.
-
-Every run here is the real `lanes-edit.sh` in a sandbox: a bare origin, the
-workstation's shared workspace checkout `wip` that `workspace.yaml` names, and
-a second clone `peer` standing in for another workstation. `LANES_GIT` is a
-wrapper that logs every NETWORK call the helper makes and runs the real git,
-so a case can say whether the push loop was reached at all. Nothing reaches a
-real remote.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="lanes-edit.sh is a bash script"),
-              pytest.mark.skipif(shutil.which("git") is None,
-                                 reason="the register is a git repository"),
-              WINDOWS_SKIP]
-
-LANE = "repoP-1"
-PEER_LANE = "repoQ-1"
-REGISTER = "lanes/LANES.md"
-PEER_HANDOFF = f"handoffs/{PEER_LANE}.md"
-#: A tracked file outside `lanes/` and `handoffs/`, the kind the #214 review
-#: saw a queued commit delete from origin.
-TOOL = "scripts/link-estates"
-SUBJECT = "row rewritten by hand"
-
-#: The environment a case must not inherit from the host that runs it.
-SCRUBBED_PREFIXES = ("LANES_", "LANE_START_", "CLAUDE_", "OPENREPOTOOLS_",
-                     "FAKE_", "GIT_", "TMUX")
-SCRUBBED = {"AGENT_PROTOCOL_ROOT", "PROJECTS_ROOT", "XDG_CONFIG_HOME",
-            "XDG_CACHE_HOME"}
-
-#: With FAKE_NET_RACE naming a tracked file, the FIRST push is raced: another
-#: lane commits that file's deletion into the shared checkout after the
-#: helper's fence has read the queue and before the push runs.
-NET_GIT = """#!/usr/bin/env bash
-printf '%s\\n' "$*" >> "$FAKE_NET_LOG"
-if [ -n "${FAKE_NET_RACE:-}" ] && [ "${3:-}" = push ] && [ ! -e "$FAKE_NET_LOG.raced" ]; then
-  : > "$FAKE_NET_LOG.raced"
-  git -C "$2" rm -q -- "$FAKE_NET_RACE" && git -C "$2" commit -q -m "another lane, racing: retire the tool"
-fi
-exec git "$@"
-"""
-
-FAKE_GH = """#!/usr/bin/env bash
-printf 'FAKE gh REFUSED: %s -- this suite reaches no GitHub surface\\n' "$*" >&2
-exit 90
-"""
-
-
-def _row(lane: str, state: str) -> str:
-    return (f"| `{lane}` | `{lane}-uuid` / window `{lane}` | Eagle / WSL2 / tester "
-            f"| 2026-10-11T00:00Z | — | handoffs/{lane}.md | {state} |")
-
-
-class Box:
-    """One workstation's shared workspace checkout, its origin and a peer."""
-
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.home = root / "home"
-        self.origin = root / "origin.git"
-        self.wip = self.home / "projects" / "wip"
-        self.peer = root / "peer"
-        self.net_log = root / "net.log"
-        fakebin = root / "fakebin"
-        for d in (self.home / ".agents", self.home / "projects", root / "tmp", fakebin):
-            d.mkdir(parents=True, exist_ok=True)
-        self.net_log.write_text("", encoding="utf-8")
-        for name, text in (("net-git", NET_GIT), ("gh", FAKE_GH)):
-            (fakebin / name).write_text(text, encoding="utf-8")
-            (fakebin / name).chmod(0o755)
-
-        env = {k: v for k, v in os.environ.items()
-               if k not in SCRUBBED and not k.startswith(SCRUBBED_PREFIXES)}
-        env.update({
-            "HOME": str(self.home),
-            "TMPDIR": str(root / "tmp"),
-            "XDG_CONFIG_HOME": str(self.home / ".config"),
-            "XDG_CACHE_HOME": str(self.home / ".cache"),
-            "PATH": f"{fakebin}{os.pathsep}{env.get('PATH', '')}",
-            "AGENT_PROTOCOL_ROOT": str(self.home / ".agents"),
-            "LANES_WORKSTATION": "Eagle",
-            "LANES_NO_GITHUB": "1",
-            "LANES_INDEX": "off",
-            "LANES_GIT": str(fakebin / "net-git"),
-            "FAKE_NET_LOG": str(self.net_log),
-            "GIT_AUTHOR_NAME": "commit_push tests",
-            "GIT_AUTHOR_EMAIL": "test@example.invalid",
-            "GIT_COMMITTER_NAME": "commit_push tests",
-            "GIT_COMMITTER_EMAIL": "test@example.invalid",
-        })
-        self.env = env
-
-        self.git("init", "-q", "--bare", "-b", "main", str(self.origin))
-        self.git("clone", "-q", str(self.origin), str(self.wip))
-        self.write(self.wip, REGISTER,
-                   "# LANES.md -- the sandbox register\n\n"
-                   "| lane | session id | workstation / env / user | started (UTC) "
-                   "| objects owned | handoff path | state |\n"
-                   "|---|---|---|---|---|---|---|\n"
-                   f"{_row(LANE, 'LIVE · seeded')}\n"
-                   f"{_row(PEER_LANE, 'LIVE · seeded')}\n")
-        self.write(self.wip, PEER_HANDOFF, f"# {PEER_LANE}\n")
-        self.write(self.wip, TOOL, "#!/usr/bin/env bash\n")
-        self.git("-C", str(self.wip), "add", "--", REGISTER, PEER_HANDOFF, TOOL)
-        self.git("-C", str(self.wip), "commit", "-q", "-m", "seed")
-        self.git("-C", str(self.wip), "push", "-q", "origin", "main")
-        self.git("clone", "-q", str(self.origin), str(self.peer))
-        (self.home / ".agents" / "workspace.yaml").write_text(
-            f"repository: {self.origin}\npath: {self.wip}\n", encoding="utf-8")
-
-    def git(self, *args: str) -> str:
-        return subprocess.run(["git", *args], env=self.env, check=True,
-                              capture_output=True, text=True).stdout
-
-    def wgit(self, *args: str) -> str:
-        return self.git("-C", str(self.wip), *args)
-
-    def ogit(self, *args: str) -> str:
-        return self.git("--git-dir", str(self.origin), *args)
-
-    @staticmethod
-    def write(checkout: Path, rel: str, text: str) -> None:
-        path = checkout / rel
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text, encoding="utf-8")
-
-    def set_state(self, checkout: Path, lane: str, state: str) -> None:
-        """A hand edit of one row's state cell, the edit `commit` wraps."""
-        path = checkout / REGISTER
-        text = path.read_text(encoding="utf-8")
-        old = _row(lane, "LIVE · seeded")
-        assert old in text, text
-        path.write_text(text.replace(old, _row(lane, state)), encoding="utf-8")
-
-    def peer_pushes(self, rel: str, text: str, message: str) -> None:
-        """Origin moves on: a commit from another workstation."""
-        self.write(self.peer, rel, text)
-        self.git("-C", str(self.peer), "add", "--", rel)
-        self.git("-C", str(self.peer), "commit", "-q", "-m", message)
-        self.git("-C", str(self.peer), "push", "-q", "origin", "main")
-
-    def peer_edit_in_wip(self, line: str) -> None:
-        """A peer lane's handoff, mid-write and uncommitted in THIS checkout."""
-        with (self.wip / PEER_HANDOFF).open("a", encoding="utf-8") as fh:
-            fh.write(line + "\n")
-
-    def queue(self, message: str, *, write: str = "", delete: str = "") -> str:
-        """A commit made in THIS checkout and not pushed: someone's queue."""
-        if write:
-            with (self.wip / write).open("a", encoding="utf-8") as fh:
-                fh.write(f"{message}\n")
-            self.wgit("add", "--", write)
-        if delete:
-            self.wgit("rm", "-q", "--", delete)
-        self.wgit("commit", "-q", "-m", message)
-        return self.wgit("rev-parse", "HEAD").strip()
-
-    def helper(self, *args: str, lane: str = LANE, **extra: str) -> subprocess.CompletedProcess:
-        self.net_log.write_text("", encoding="utf-8")
-        env = dict(self.env, LANES_LANE=lane, **extra)
-        return subprocess.run(["bash", str(REPO / "lanes-edit.sh"), *args],
-                              env=env, cwd=str(self.wip), capture_output=True,
-                              text=True, timeout=180, check=False)
-
-    def net_calls(self) -> list[str]:
-        return self.net_log.read_text(encoding="utf-8").splitlines()
-
-    def unpublished(self) -> list[str]:
-        return self.wgit("rev-list", "origin/main..HEAD").split()
-
-    def origin_file(self, rel: str) -> str:
-        return self.ogit("show", f"main:{rel}")
-
-    def origin_subjects(self) -> list[str]:
-        return self.ogit("log", "--format=%s", "main").splitlines()
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Box:
-    return Box(tmp_path)
-
-
-def _line_of(stderr: str, needle: str) -> int:
-    for number, line in enumerate(stderr.splitlines()):
-        if needle in line:
-            return number
-    raise AssertionError(f"{needle!r} is on no line of:\n{stderr}")
-
-
-def test_the_printed_recovery_publishes_the_edit_it_stranded(box):
-    """THE ISSUE'S OWN SEQUENCE, END TO END. Origin moves on; a peer's handoff
-    is uncommitted in the shared checkout; a register write commits, cannot
-    pull, has its push rejected six times and exits 3 with the RECOVERY. The
-    peer then commits its file exactly as that RECOVERY says, and the re-run it
-    names must PUBLISH: one copy of the edit on origin, the peer's commit with
-    it, and the commit origin already had kept — not exit 0 with nothing sent.
-    """
-    box.peer_pushes("handoffs/repoR-1.md", "# repoR-1\n",
-                    "handoff(repoR-1@Raven): another workstation's write")
-    box.peer_edit_in_wip("a peer's line, mid-write")
-    box.set_state(box.wip, LANE, "LIVE · edited by hand")
-
-    stranded = box.helper("commit", SUBJECT)
-    assert stranded.returncode == 3, stranded.stderr
-    assert "a peer's uncommitted file blocks the rebase" in stranded.stderr
-    assert len(box.unpublished()) == 1, "the edit is a local commit and only that"
-    # The RECOVERY names the re-run and says what it does once nothing is staged.
-    assert 'LANES_LANE=<lane> lanes-edit.sh commit "<what you wrote>"' in stranded.stderr
-    assert "If lanes/LANES.md is clean, that re-run makes no commit of its own" in stranded.stderr
-    assert "pushes the local commits this lists" in stranded.stderr, stranded.stderr
-
-    box.wgit("commit", "-q", "-m", f"handoff({PEER_LANE}@Eagle): the mid-write line",
-             "--", PEER_HANDOFF)
-    rerun = box.helper("commit", SUBJECT)
-    assert rerun.returncode == 0, rerun.stderr
-    assert "pushed origin/main" in rerun.stderr, rerun.stderr
-    assert box.wgit("rev-parse", "HEAD") == box.ogit("rev-parse", "main")
-    assert _row(LANE, "LIVE · edited by hand") in box.origin_file(REGISTER)
-    assert "a peer's line, mid-write" in box.origin_file(PEER_HANDOFF)
-    assert box.origin_file("handoffs/repoR-1.md") == "# repoR-1\n"
-    subjects = box.origin_subjects()
-    assert sum(s.endswith(f"): {SUBJECT}") for s in subjects) == 1, subjects
-    assert len(subjects) == 4, ("seed, the other workstation's write, the edit and "
-                                f"the peer's handoff — no commit of the re-run's own: {subjects}")
-
-
-def test_a_clean_checkout_with_nothing_ahead_is_still_a_no_op(box):
-    """TODAY'S BEHAVIOUR, KEPT. Nothing staged and nothing on HEAD that origin
-    lacks: the same note, exit 0, no commit and no network call at all."""
-    head, origin = box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 0, result.stderr
-    assert f"nothing staged for {REGISTER} — no commit made" in result.stderr
-    assert "push" not in result.stderr, result.stderr
-    assert box.net_calls() == []
-    assert (box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")) == (head, origin)
-
-
-def test_a_checkout_behind_origin_with_nothing_of_its_own_is_still_a_no_op(box):
-    """Behind is not ahead: origin's newer commits are no local commit to
-    publish, so this is the no-op above and not a pull."""
-    box.peer_pushes("handoffs/repoR-1.md", "# repoR-1\n", "a newer commit elsewhere")
-    box.wgit("fetch", "-q", "origin")
-    head = box.wgit("rev-parse", "HEAD")
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 0, result.stderr
-    assert f"nothing staged for {REGISTER} — no commit made" in result.stderr
-    assert box.net_calls() == []
-    assert box.wgit("rev-parse", "HEAD") == head
-
-
-def test_publishing_past_a_peers_dirty_file_keeps_the_dirty_elsewhere_guard(box):
-    """The publish takes the SAME push loop a commit does, guard included: with
-    a peer's file still uncommitted it warns, names the file, skips the pull,
-    pushes straight out, and leaves that file exactly as it found it."""
-    box.set_state(box.wip, LANE, "LIVE · edited by hand")
-    box.wgit("commit", "-q", "-m", f"LANES({LANE}@Eagle): {SUBJECT}", "--", REGISTER)
-    box.peer_edit_in_wip("a peer's line, still mid-write")
-
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 0, result.stderr
-    assert f"nothing staged for {REGISTER} — no commit made" in result.stderr
-    assert ("WARNING: this checkout has uncommitted changes to files OTHER than the register"
-            in result.stderr)
-    assert PEER_HANDOFF in result.stderr
-    assert "pushed origin/main (attempt 1, no pull" in result.stderr, result.stderr
-    calls = [f" {c} " for c in box.net_calls()]
-    assert not any(" pull " in c for c in calls), calls
-    assert any(" push " in c for c in calls), calls
-    assert box.wgit("rev-parse", "HEAD") == box.ogit("rev-parse", "main")
-    assert _row(LANE, "LIVE · edited by hand") in box.origin_file(REGISTER)
-    assert box.wgit("diff", "--name-only").split() == [PEER_HANDOFF]
-    assert "still mid-write" not in box.origin_file(PEER_HANDOFF)
-
-
-def test_the_conflict_recovery_warns_that_a_reset_drops_a_peers_commits(box):
-    """The issue's near-loss of 2026-10-09: the conflict RECOVERY ended in
-    `reset --hard origin/main`, which in a shared checkout also drops a PEER's
-    unpushed commit. The RECOVERY lists every unpublished commit by content and
-    says, before the reset, that it must not run while any of them is not the
-    reader's own — and the helper itself leaves the peer's commit in place."""
-    box.peer_edit_in_wip("a peer's handoff, committed and not yet pushed")
-    box.wgit("commit", "-q", "-m", f"handoff({PEER_LANE}@Eagle): unpushed",
-             "--", PEER_HANDOFF)
-    peer_commit = box.wgit("rev-parse", "HEAD").strip()
-    box.set_state(box.peer, LANE, "LIVE · the peer rewrote this row")
-    box.git("-C", str(box.peer), "commit", "-q", "-am", "the same row, elsewhere")
-    box.git("-C", str(box.peer), "push", "-q", "origin", "main")
-    box.set_state(box.wip, LANE, "LIVE · edited by hand")
-
-    result = box.helper("commit", SUBJECT)
-    err = result.stderr
-    assert result.returncode == 3, err
-    assert "REBASE CONFLICT on origin/main" in err
-    assert box.wgit("merge-base", "--is-ancestor", peer_commit, "HEAD") == ""
-
-    aborted_at = box.wgit("rev-parse", "HEAD").strip()
-    count = _line_of(err, "cherry origin/main")
-    moved = _line_of(err, f"rev-parse HEAD   # if this is not {aborted_at}, STOP")
-    listing = _line_of(err, "cherry -v origin/main HEAD")
-    warning = _line_of(err, "Never reset, stash or overwrite a peer's work")
-    drops = _line_of(err, "drops EVERY '+' commit in this checkout")
-    reset = _line_of(err, "reset --hard origin/main")
-    assert count < moved < listing < warning < drops < reset, err
-    assert f"cherry origin/main {aborted_at}" in err.splitlines()[count]
-    captures = "\n".join(err.splitlines()[listing:drops + 1])
-    assert "LANES(concurrent@" in captures, captures
-    assert "LANES(pre-existing@" in captures, captures
-    assert "names no lane, so it is NOT yours" in captures, captures
-    # NIT 5 (lane openRepoShape-2, 6243280936): the two lines that stop a
-    # reader from resetting a peer's commit away, word for word, because
-    # lane openRepoTools-5's #68 waits on these words.
-    stop = _line_of(err, "if any '+' line is not your own write, STOP and take it to the lane its subject names")
-    assert listing < stop < warning, err
-    assert "# only if every '+' line is yours" in err.splitlines()[reset], err
-
-    # The listing reads HEAD, which is what the reset acts on: a peer's commit
-    # made AFTER the abort is in it too, and the moved-checkout STOP fires.
-    later = box.queue(f"handoff({PEER_LANE}@Eagle): written after the abort", write=PEER_HANDOFF)
-    assert box.wgit("rev-parse", "HEAD").strip() != aborted_at
-    command = err.splitlines()[listing].split("lanes-edit: ", 1)[1].split("#", 1)[0].split()
-    listed = subprocess.run(command, env=box.env, capture_output=True,
-                            text=True, check=True).stdout
-    assert f"+ {peer_commit}" in listed, listed
-    assert any(line.startswith("+ ") and later in line.split()[1] for line in listed.splitlines()), listed
-
-
-def test_the_dirty_checkout_refusal_names_the_act_to_re_run(box):
-    """`refuse_dirty_checkout`'s RECOVERY used to end in *"then re-run:"*
-    followed by two COMMIT commands, which read as if `lanes-edit.sh commit`
-    were the re-run. The authors commit their files; what is re-run is the
-    act that was refused, whose own push publishes their commits."""
-    box.peer_edit_in_wip("a peer's line, mid-write")
-    # An event names the transcript taking the act (Amendment 7(b)); without
-    # one the write refuses before it ever reads the checkout.
-    result = box.helper("log", "NOTED", f"lane:{LANE}", "a note",
-                        LANES_SESSION="0e3c9a52-6d1b-4b8e-9f3a-2a7c5d4e6f81")
-    assert result.returncode == 2, result.stderr
-    assert "RECOVERY — whoever wrote those files commits them:" in result.stderr
-    assert "then re-run the refused write NOTED" in result.stderr, result.stderr
-
-
-@pytest.mark.parametrize("exported", [False, True], ids=["plain", "CP_PUBLISH_AHEAD-exported"])
-def test_a_no_op_write_never_publishes_what_the_checkout_queued(box, exported):
-    """THE #214 REVIEW'S BLOCKER. This shared checkout holds another lane's
-    unpushed commit that deletes a file outside lane tooling's trees. A write
-    whose result is the line already there must stay what it is on `main`:
-    exit 0, no network call, origin untouched. Only `commit` publishes, and
-    `CP_PUBLISH_AHEAD=1` EXPORTED changes nothing: the flag is the `commit`
-    arm's alone (lane openRepoShape-2's mutant M01 read it from the
-    environment and survived every other case)."""
-    queued = box.queue("another lane's commit: retire the tool", delete=TOOL)
-    head, origin = box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")
-    extra = {"CP_PUBLISH_AHEAD": "1"} if exported else {}
-    result = box.helper("replace-in-row", LANE, "seeded", "seeded", **extra)
-    assert result.returncode == 0, result.stderr
-    assert box.net_calls() == [], result.stderr
-    assert (box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")) == (head, origin)
-    assert box.origin_file(TOOL) == "#!/usr/bin/env bash\n"
-    assert box.unpublished()[0].startswith(queued)
-    assert f"nothing staged for {REGISTER} — no commit made" in result.stderr
-    assert "stay local. `lanes-edit.sh commit` would publish all of them" in result.stderr
-    assert "another lane's commits are its own to publish" in result.stderr
-
-
-def test_the_publish_counts_what_its_list_leaves_out(box):
-    """The list of commits being pushed shows ten and counts the rest."""
-    for n in range(12):
-        box.queue(f"handoff({PEER_LANE}@Eagle): stamp {n}", write=PEER_HANDOFF)
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 0, result.stderr
-    assert "pushing the 12 local commit(s) origin/main does not have, up to" in result.stderr
-    assert "  … and 2 more" in result.stderr, result.stderr
-    assert box.wgit("rev-parse", "HEAD") == box.ogit("rev-parse", "main")
-
-
-# ---- #214's adversarial check and its two reviews: three ordinary checkout
-# states got a deletion past the first fence (`fab2cbc`), and a fourth was a
-# race. The cases below pin each, and the fence's other rules beside them.
-
-def _stranded_edit(box: Box) -> None:
-    box.set_state(box.wip, LANE, "LIVE · edited by hand")
-    box.wgit("commit", "-q", "-m", f"LANES({LANE}@Eagle): {SUBJECT}", "--", REGISTER)
-
-
-def _refused_untouched(box: Box, result, head: str, origin: str) -> None:
-    assert result.returncode == 2, result.stderr
-    assert "nothing was pushed" in result.stderr, result.stderr
-    assert box.net_calls() == [], result.stderr
-    assert (box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")) == (head, origin)
-    assert box.origin_file(TOOL) == "#!/usr/bin/env bash\n"
-
-
-# ---- `commit` refuses a queue it cannot vouch for. Each setup leaves the
-# stranded register edit queued with one more commit, or in one more checkout
-# state, and returns the words the refusal must name. The last three are the
-# adversarial check's bypasses, and each published a deletion at `fab2cbc`.
-
-def _deletes_a_tool(box: Box) -> str:
-    _stranded_edit(box)
-    return f"  {box.queue('a queued commit', delete=TOOL)[:12]} D 000000 {TOOL}"
-
-
-def _outside_lane_tooling(box: Box) -> str:
-    _stranded_edit(box)
-    (box.wip / "workspaces").mkdir(exist_ok=True)
-    sha = box.queue("a queued commit", write="workspaces/repoP.yaml")
-    return f"  {sha[:12]} A 100644 workspaces/repoP.yaml"
-
-
-def _deletes_a_handoff(box: Box) -> str:
-    _stranded_edit(box)
-    return f"  {box.queue('a queued commit', delete=PEER_HANDOFF)[:12]} D 000000 {PEER_HANDOFF}"
-
-
-def _type_change(box: Box) -> str:
-    """A handoff turned into a symlink is a `T`, not a modification."""
-    _stranded_edit(box)
-    (box.wip / PEER_HANDOFF).unlink()
-    (box.wip / PEER_HANDOFF).symlink_to(f"../{TOOL}")
-    box.wgit("add", "--", PEER_HANDOFF)
-    box.wgit("commit", "-q", "-m", "peer: the handoff becomes a symlink to the tool")
-    return f"  {box.wgit('rev-parse', 'HEAD').strip()[:12]} T 120000 {PEER_HANDOFF}"
-
-
-def _bytecode_in_handoffs(box: Box) -> str:
-    """#162's list rides out of a publish no more than out of a commit."""
-    _stranded_edit(box)
-    (box.wip / "handoffs" / "__pycache__").mkdir()
-    path = "handoffs/__pycache__/x.cpython-312.pyc"
-    return f"  {box.queue('peer: bytecode beside a handoff', write=path)[:12]} A 100644 {path}"
-
-
-def _merge_in_queue(box: Box) -> str:
-    """BYPASS 1. `git log --name-status` prints no diff for a merge, so a
-    deletion made while resolving one went out unread, by the straight push a
-    peer's dirty file takes."""
-    _stranded_edit(box)
-    box.wgit("checkout", "-q", "-b", "side", "origin/main")
-    box.queue(f"handoff({PEER_LANE}@Eagle): a side line", write=PEER_HANDOFF)
-    box.wgit("checkout", "-q", "main")
-    box.wgit("merge", "-q", "--no-ff", "--no-commit", "side")
-    box.wgit("rm", "-q", "--", TOOL)
-    box.wgit("commit", "-q", "-m", "Merge branch side")
-    merge = box.wgit("rev-parse", "HEAD").strip()
-    box.peer_edit_in_wip("a peer mid-write")
-    return f"  {merge[:12]} is a merge commit"
-
-
-def _head_off_branch(box: Box) -> str:
-    """BYPASS 2. The fence read HEAD while the push sent `refs/heads/main`:
-    with a deletion queued on local main and HEAD on a scratch branch holding a
-    register edit, the fence saw only the edit."""
-    box.queue("another lane: retire the tool", delete=TOOL)
-    box.wgit("checkout", "-q", "-b", "scratch", "origin/main")
-    _stranded_edit(box)
-    return "HEAD is refs/heads/scratch, not refs/heads/main"
-
-
-def _shadowing_origin_main(box: Box) -> str:
-    """BYPASS 3. A local branch named `origin/main` shadowed the tracking ref."""
-    sha = box.queue("peer: retire the tool", delete=TOOL)
-    box.wgit("branch", "origin/main", "HEAD")
-    _stranded_edit(box)
-    return f"  {sha[:12]} D 000000 {TOOL}"
-
-
-def _renames_out_of_lanes(box: Box) -> str:
-    """SHOULD 4 (lane openRepoShape-2, 6243280936), THE RENAME GUARD. A log
-    moved out of `lanes/` is a deletion there, and `--no-renames` names it so.
-    Read with rename detection it would be one `R100` line instead."""
-    log = f"lanes/log/{PEER_LANE}.md"
-    box.write(box.wip, log, f"# {PEER_LANE}'s log\n")
-    box.wgit("add", "--", log)
-    box.wgit("commit", "-q", "-m", f"LANES({PEER_LANE}@Eagle): its log")
-    box.wgit("push", "-q", "origin", "main")
-    _stranded_edit(box)
-    box.wgit("mv", log, f"scripts/{PEER_LANE}.md")
-    box.wgit("commit", "-q", "-m", "peer: move a log out of lanes/")
-    return f"  {box.wgit('rev-parse', 'HEAD').strip()[:12]} D 000000 {log}"
-
-
-def _beside_the_register_directory(box: Box) -> str:
-    """SHOULD 4, THE PREFIX GUARD. `lanes/` is a directory: `lanes-archive/`
-    beside it is not the register's, though its name starts the same way."""
-    _stranded_edit(box)
-    (box.wip / "lanes-archive").mkdir()
-    path = "lanes-archive/notes.md"
-    return f"  {box.queue('peer: notes beside the register', write=path)[:12]} A 100644 {path}"
-
-
-REFUSALS = {
-    "deletes-a-tool": _deletes_a_tool,
-    "outside-lane-tooling": _outside_lane_tooling,
-    "deletes-a-handoff": _deletes_a_handoff,
-    "type-change": _type_change,
-    "bytecode-in-handoffs": _bytecode_in_handoffs,
-    "merge-in-queue": _merge_in_queue,
-    "head-off-branch": _head_off_branch,
-    "shadowing-origin-main": _shadowing_origin_main,
-    "renames-out-of-lanes": _renames_out_of_lanes,
-    "beside-the-register-directory": _beside_the_register_directory,
-}
-
-
-@pytest.mark.parametrize("variant", list(REFUSALS))
-def test_commit_refuses_a_queue_that_is_not_lane_toolings_to_publish(box, variant):
-    """`commit` publishes register and handoff writes, by path and kind, and
-    nothing else. One queued commit, or one checkout state, it cannot vouch for
-    refuses the WHOLE publish with 2, names it, makes no network call and
-    pushes nothing, not even the stranded register edit."""
-    expect = REFUSALS[variant](box)
-    head, origin = box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")
-    result = box.helper("commit", SUBJECT)
-    _refused_untouched(box, result, head, origin)
-    assert expect in result.stderr, result.stderr
-    assert "pushing the" not in result.stderr
-
-
-@pytest.mark.parametrize("path", ["rebase", "straight"])
-def test_the_push_sends_the_commit_the_fence_read(box, path):
-    """THE RACE. Another lane commits a deletion into this shared checkout
-    after the fence read the queue and before the push: the push sends the
-    commit the fence read, `<sha>:refs/heads/main`, so the late commit stays
-    local, on both roads out (the pull-and-rebase and the straight push a
-    peer's dirty file forces)."""
-    _stranded_edit(box)
-    if path == "straight":
-        box.peer_edit_in_wip("a peer mid-write")
-    result = box.helper("commit", SUBJECT, FAKE_NET_RACE=TOOL)
-    assert result.returncode == 0, result.stderr
-    assert box.origin_file(TOOL) == "#!/usr/bin/env bash\n", result.stderr
-    assert _row(LANE, "LIVE · edited by hand") in box.origin_file(REGISTER)
-    late = box.wgit("log", "-1", "--format=%s", "HEAD").strip()
-    assert late == "another lane, racing: retire the tool", late
-    assert box.wgit("rev-parse", "HEAD~1") == box.ogit("rev-parse", "main")
-
-
-def test_a_publish_the_pull_empties_says_so_and_sends_no_push(box):
-    """Lane openRepoShape-2's trap (6243280936). The queue `commit` read can
-    already be on origin by content, under other shas: here another workstation
-    made the same edit. `pull --rebase` drops it, and the push that followed
-    sent origin its own tip and printed "pushed". The re-read after the pull
-    finds nothing left, says so, sends no push and exits 0."""
-    _stranded_edit(box)
-    box.set_state(box.peer, LANE, "LIVE · edited by hand")
-    box.git("-C", str(box.peer), "commit", "-q", "-am", "the same edit, made elsewhere")
-    box.git("-C", str(box.peer), "push", "-q", "origin", "main")
-    origin = box.ogit("rev-parse", "main")
-
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 0, result.stderr
-    assert "pushing the 1 local commit(s) origin/main does not have" in result.stderr
-    assert ("origin/main already holds every commit this publish listed: `pull --rebase` "
-            "found each one there by content and dropped it") in result.stderr, result.stderr
-    assert "pushed origin/" not in result.stderr, result.stderr
-    calls = [f" {c} " for c in box.net_calls()]
-    assert any(" pull " in c for c in calls), calls
-    assert not any(" push " in c for c in calls), calls
-    assert box.ogit("rev-parse", "main") == origin
-    assert box.wgit("rev-parse", "HEAD") == origin
-    assert box.origin_subjects().count("the same edit, made elsewhere") == 1
-
-
-def test_a_lane_rename_is_refused_and_told_what_carries_it(box):
-    """A DELIBERATE OVER-REFUSAL. A lane rename deletes its log to re-add it,
-    and a deletion is the one change the fence never lets through: the refusal
-    says so, and names what does carry it."""
-    box.write(box.wip, "lanes/log/repocase-1.md", "# log\n")
-    box.wgit("add", "--", "lanes/log/repocase-1.md")
-    box.wgit("commit", "-q", "-m", "seed a log")
-    box.wgit("push", "-q", "origin", "main")
-    box.wgit("mv", "lanes/log/repocase-1.md", "lanes/log/repoCase-1.md")
-    box.wgit("commit", "-q", "-m", "LANES(repoCase-1@Eagle): RENAMED lane repocase-1 → repoCase-1")
-    head, origin = box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")
-
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 2, result.stderr
-    assert " D 000000 lanes/log/repocase-1.md" in result.stderr, result.stderr
-    assert "A lane rename (Amendment 16) deletes and re-adds its log" in result.stderr
-    assert "the next register write from this checkout carries it" in result.stderr
-    assert box.net_calls() == []
-    assert (box.wgit("rev-parse", "HEAD"), box.ogit("rev-parse", "main")) == (head, origin)
-
-
-def test_the_fence_follows_the_registers_own_directory(box):
-    """The register's directory is derived (`LANES_PREFIX`), never spelled
-    `lanes/`: a register kept in `registry/` publishes its own stranded edit."""
-    text = (box.wip / REGISTER).read_text(encoding="utf-8")
-    box.write(box.wip, "registry/LANES.md", text)
-    box.wgit("add", "--", "registry/LANES.md")
-    box.wgit("commit", "-q", "-m", "a register kept elsewhere")
-    box.wgit("push", "-q", "origin", "main")
-    path = box.wip / "registry/LANES.md"
-    path.write_text(text.replace(_row(LANE, "LIVE · seeded"), _row(LANE, "LIVE · edited by hand")),
-                    encoding="utf-8")
-    box.wgit("commit", "-q", "-m", f"LANES({LANE}@Eagle): {SUBJECT}", "--", "registry/LANES.md")
-
-    result = box.helper("commit", SUBJECT, LANES_DIR=str(box.wip / "registry"))
-    assert result.returncode == 0, result.stderr
-    assert box.wgit("rev-parse", "HEAD") == box.ogit("rev-parse", "main")
-    assert _row(LANE, "LIVE · edited by hand") in box.origin_file("registry/LANES.md")
-
-
-def test_a_queued_commit_git_cannot_read_refuses(box):
-    """FAIL CLOSED. `diff-tree --stdin` passes over a commit it cannot read and
-    still exits 0, so a queued commit whose tree is missing must refuse, not
-    read as a commit with nothing in it."""
-    _stranded_edit(box)
-    tree = box.wgit("rev-parse", "HEAD^{tree}").strip()
-    box.queue(f"handoff({PEER_LANE}@Eagle): a line", write=PEER_HANDOFF)
-    # The EARLIER queued commit's tree, so HEAD's own stays readable and the
-    # refusal is the fence's, not the index check's.
-    (box.wip / ".git" / "objects" / tree[:2] / tree[2:]).unlink()
-    origin = box.ogit("rev-parse", "main")
-
-    result = box.helper("commit", SUBJECT)
-    assert result.returncode == 2, result.stderr
-    assert "nothing was pushed" in result.stderr, result.stderr
-    assert box.ogit("rev-parse", "main") == origin
diff --git a/tests/test_deferred_97_findings_157.py b/tests/test_deferred_97_findings_157.py
deleted file mode 100644
index 0f63a1d3..00000000
--- a/tests/test_deferred_97_findings_157.py
+++ /dev/null
@@ -1,193 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""opensoft/openRepoTools#157, section 4: findings of #97's round on `8c5958f`
-that were filed rather than taken there. Items 4a, 4d and 4e, each through the
-real `lane-start` and `lanes-edit.sh` in the lane-start sandbox (a bare origin,
-a register clone, a fake tmux and a fake gh; nothing reaches the network).
-
-  * 4a. `managed-projection` read the published row only, while every
-    `lanes-edit.sh` writer also reads THIS checkout's row (`managed_seam_refuse`)
-    and refuses vocabulary that only this copy carries. So a marker committed
-    here and not pushed passed `lane-start`'s gate, which asks that read, and
-    the launch went on until a later writer refused. The read now answers 1
-    for it, as the writers do.
-  * 4d. NO CHANGE, as the issue's own reasoning says: a malformed row with no
-    managed-owner vocabulary cannot be a marker, so it is legacy in either
-    copy, and the writer that rewrites it refuses its shape on its own. The
-    case below pins both halves, and that the 4a read stops at vocabulary.
-  * 4e. A `trees/` directory that is there and cannot be listed was read as no
-    inventory at all (8). `lane-trees` now answers 10 for it.
-"""
-
-from __future__ import annotations
-
-import os
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, pytestmark  # noqa: F401
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    box = Sandbox(tmp_path)
-    box.env["LANES_LANE_STATE_ROOT"] = str(tmp_path / "state")
-    box.resolver()
-    seeded = box.start("--no-launch")
-    assert seeded.returncode == 0, seeded.stderr
-    return box
-
-
-def helper(box: Sandbox, *args: str) -> subprocess.CompletedProcess:
-    return subprocess.run([str(box.bin / "lanes-edit.sh"), *args],
-                          cwd=box.lane_dir, env=box.env, text=True,
-                          capture_output=True, timeout=60, check=False)
-
-
-def register(box: Sandbox) -> Path:
-    return box.wip / "lanes" / "LANES.md"
-
-
-def commit_state_cell_here(box: Sandbox, cell: str, message: str,
-                           checkout: Path | None = None) -> None:
-    """Replace the lane's state cell in THIS checkout (or `checkout`) and commit
-    it, unpushed — as a writer that crashed between its commit and its push
-    leaves it."""
-    checkout = checkout or box.wip
-    path = checkout / "lanes" / "LANES.md"
-    lines = path.read_text(encoding="utf-8").splitlines(keepends=True)
-    for i, line in enumerate(lines):
-        if line.startswith(f"| `{LANE}` "):
-            body = line.rstrip("\n").rstrip()
-            assert body.endswith(" |"), line
-            head, _, _ = body[:-2].rpartition(" | ")
-            lines[i] = f"{head} | {cell} |\n"
-            break
-    else:
-        raise AssertionError(f"no row for {LANE} in the sandbox register")
-    path.write_text("".join(lines), encoding="utf-8")
-    box.git("-C", str(checkout), "commit", "-qam", message)
-
-
-def says_which_copy(stderr: str, read: Path) -> None:
-    """The refusal names the register file it READ and both ways the two
-    copies can disagree, each with its remedy."""
-    assert f"register file, {read.resolve()}, carries" in stderr, stderr
-    assert "AHEAD of origin" in stderr and "publish that change or undo it" in stderr
-    assert "BEHIND it" in stderr and "fast-forward it" in stderr
-    assert f"git -C {read.resolve().parent} status --short --branch -- LANES.md" in stderr
-
-
-def fingerprint(box: Sandbox) -> tuple:
-    return (box.git("-C", str(box.wip), "rev-parse", "HEAD"),
-            box.git("--git-dir", str(box.origin), "rev-parse", "main"),
-            box.git("-C", str(box.wip), "status", "--porcelain"),
-            register(box).read_bytes(), box.lane_log(), box.claude_runs(),
-            box.tmux_log.read_text(encoding="utf-8"))
-
-
-# ---------------------------------------------------------------- 4a
-
-def test_4a_an_unpushed_local_marker_reads_as_unknown_not_legacy(box):
-    published = helper(box, "managed-projection", LANE)
-    assert published.returncode == 8, published.stderr
-    commit_state_cell_here(box, "MANAGED OWNER · ledger-1",
-                           "an unpushed marker, in this checkout only")
-    result = helper(box, "managed-projection", LANE)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert result.stdout == ""
-    assert "UNKNOWN" in result.stderr
-    says_which_copy(result.stderr, register(box))
-
-
-def test_4a_a_checkout_behind_an_origin_that_dropped_the_marker_reads_as_unknown(box):
-    commit_state_cell_here(box, "MANAGED OWNER · ledger-1", "the ledger's marker")
-    box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    assert helper(box, "managed-projection", LANE).stdout == "ledger-1\n"
-    peer = box.root / "peer"
-    box.git("clone", "-q", str(box.origin), str(peer))
-    commit_state_cell_here(box, "PAUSED · 2026-10-13T00:00:00Z · the ledger let go",
-                           "the ledger drops its marker, elsewhere", checkout=peer)
-    box.git("-C", str(peer), "push", "-q", "origin", "main")
-    result = helper(box, "managed-projection", LANE)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    says_which_copy(result.stderr, register(box))
-
-
-def test_4a_a_runtime_clone_names_the_register_file_read_not_the_clone(box):
-    clone = box.root / "runtime-clone"
-    box.git("clone", "-q", str(box.origin), str(clone))
-    commit_state_cell_here(box, "MANAGED OWNER · ledger-1",
-                           "an unpushed marker, in this checkout only")
-    env = dict(box.env, LANES_REPO=str(clone))
-    result = subprocess.run([str(box.bin / "lanes-edit.sh"), "managed-projection", LANE],
-                            cwd=box.lane_dir, env=env, text=True,
-                            capture_output=True, timeout=60, check=False)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    says_which_copy(result.stderr, register(box))
-    assert str(clone) not in result.stderr
-
-
-def test_4a_lane_start_refuses_an_unpushed_local_marker_at_its_gate(box):
-    commit_state_cell_here(box, "MANAGED OWNER · ledger-1",
-                           "an unpushed marker, in this checkout only")
-    before = fingerprint(box)
-    result = box.start()
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    # THE GATE'S OWN REFUSAL, before the binding, the transcript move and every
-    # write — not a later writer's.
-    assert f"managed-projection {LANE}` exited 1" in result.stderr
-    assert "a lane start is refused here" in result.stderr
-    assert fingerprint(box) == before
-
-
-# ---------------------------------------------------------------- 4d
-
-def test_4d_a_malformed_local_row_with_no_vocabulary_is_legacy_and_its_writer_refuses_it(box):
-    commit_state_cell_here(box, "PAUSED · 2026-10-11T00:00:00Z · a literal | pipe",
-                           "a seventh separator, in this checkout only")
-    result = helper(box, "managed-projection", LANE)
-    assert result.returncode == 8, (result.stdout, result.stderr)
-    before = fingerprint(box)
-    result = helper(box, "set-row-state", LANE, "PAUSED · the writer asks")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "separators where a seven-column row carries 6" in result.stderr
-    assert "UNKNOWN" not in result.stderr
-    assert fingerprint(box) == before
-
-
-# ---------------------------------------------------------------- 4e
-
-def trees_dir(box: Sandbox) -> Path:
-    return Path(box.env["LANES_LANE_STATE_ROOT"]) / LANE / "trees"
-
-
-def test_4e_an_empty_trees_directory_is_still_no_inventory(box):
-    recorded = helper(box, "set-lane-tree", LANE, str(box.lane_dir))
-    assert recorded.returncode == 0, recorded.stderr
-    listed = helper(box, "lane-trees", LANE)
-    assert listed.returncode == 0, listed.stderr
-    assert str(box.lane_dir) in listed.stdout
-    for sidecar in trees_dir(box).iterdir():
-        sidecar.unlink()
-    assert helper(box, "lane-trees", LANE).returncode == 8
-
-
-@pytest.mark.parametrize("mode", [0o000, 0o300, 0o600],
-                         ids=["no-access", "no-read", "no-search"])
-def test_4e_a_trees_directory_that_cannot_be_listed_is_never_no_inventory(box, mode):
-    if os.geteuid() == 0:
-        pytest.skip("permission regression requires an unprivileged runner")
-    recorded = helper(box, "set-lane-tree", LANE, str(box.lane_dir))
-    assert recorded.returncode == 0, recorded.stderr
-    trees = trees_dir(box)
-    trees.chmod(mode)
-    try:
-        result = helper(box, "lane-trees", LANE)
-    finally:
-        trees.chmod(0o700)
-    assert result.returncode == 10, (result.stdout, result.stderr)
-    assert result.stdout == ""
-    assert "could not be listed" in result.stderr
-    assert str(trees) in result.stderr
diff --git a/tests/test_guard_launch_mode.py b/tests/test_guard_launch_mode.py
deleted file mode 100644
index e323ff47..00000000
--- a/tests/test_guard_launch_mode.py
+++ /dev/null
@@ -1,98 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The prompt guard respects process launch mode without lane infrastructure."""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import subprocess
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="the guard is a bash command")]
-
-
-@pytest.fixture
-def guard_launch_mode(tmp_path):
-    home = tmp_path / "home"
-    projects = home / "projects"
-    projects.mkdir(parents=True)
-    fakebin = tmp_path / "bin"
-    fakebin.mkdir()
-    tmux_log = tmp_path / "tmux.log"
-    tmux = fakebin / "tmux"
-    tmux.write_text('#!/bin/sh\nprintf "%s\\n" "$*" >> "$GUARD_TMUX_LOG"\nexit 1\n')
-    tmux.chmod(0o755)
-    probe_log = tmp_path / "identity-probes.log"
-    for name in ("git", "hostname", "readlink", "sed"):
-        probe = fakebin / name
-        probe.write_text('#!/bin/sh\nprintf "%s\\n" "$0 $*" >> "$GUARD_PROBE_LOG"\nexit 1\n')
-        probe.chmod(0o755)
-    env = {name: value for name, value in os.environ.items()
-           if not name.startswith(("LANES_", "CLAUDE_", "WORKBENCHES_", "TMUX"))}
-    env.update(HOME=str(home), AGENT_PROTOCOL_ROOT=str(home / ".agents"),
-               PROJECTS_ROOT=str(projects), GUARD_TMUX_LOG=str(tmux_log),
-               GUARD_PROBE_LOG=str(probe_log),
-               PATH=str(fakebin) + os.pathsep + env.get("PATH", ""))
-    payload = json.dumps({"session_id": "profile-session", "cwd": str(projects),
-                          "prompt": "do the work", "hook_event_name": "UserPromptSubmit"})
-
-    def run(marker, *, command="guard", hook_input=payload, prefix_args=(), extra_args=()):
-        child_env = dict(env)
-        if marker is not None:
-            child_env["CLAUDE_NO_LANE"] = marker
-        return subprocess.run(["bash", str(REPO / "lanes-edit.sh"), *prefix_args, command, *extra_args],
-                              input=hook_input, text=True, capture_output=True,
-                              env=child_env, timeout=10, check=False)
-
-    return run, home, tmux_log, probe_log
-
-
-@pytest.mark.parametrize("hook_input", [None, "not JSON", ""])
-def test_guard_launch_mode_profile_session_skips_identity_reads(guard_launch_mode, hook_input):
-    run, home, tmux_log, probe_log = guard_launch_mode
-    result = run("1") if hook_input is None else run("1", hook_input=hook_input)
-    assert result.returncode == 0, result.stderr
-    assert result.stdout == result.stderr == ""
-    assert not tmux_log.exists()
-    assert not probe_log.exists()
-    assert not (home / ".agents").exists()
-    assert not (home / ".claude").exists()
-
-
-@pytest.mark.parametrize("marker", [None, "", "0", "true", "2"])
-def test_guard_launch_mode_other_values_keep_enforcement(guard_launch_mode, marker):
-    run, _, _, _ = guard_launch_mode
-    result = run(marker)
-    assert result.returncode == 2, result.stderr
-    assert "THE NAME GUARD REFUSES" in result.stderr
-
-
-def test_guard_launch_mode_does_not_exempt_other_commands(guard_launch_mode):
-    run, _, _, _ = guard_launch_mode
-    result = run("1", command="verify-row")
-    assert result.returncode == 1, result.stderr
-    assert "openRepoTools wip init" in result.stderr
-
-
-@pytest.mark.parametrize("flag", ["--no-sweep", "--sweep", "--no-github"])
-def test_guard_launch_mode_global_flags_keep_early_exemption(guard_launch_mode, flag):
-    run, _, tmux_log, probe_log = guard_launch_mode
-    result = run("1", prefix_args=(flag,))
-    assert result.returncode == 0, result.stderr
-    assert result.stdout == result.stderr == ""
-    assert not tmux_log.exists()
-    assert not probe_log.exists()
-
-
-def test_guard_launch_mode_invalid_arguments_still_refuse(guard_launch_mode):
-    run, _, tmux_log, probe_log = guard_launch_mode
-    result = run("1", extra_args=("unexpected",))
-    assert result.returncode == 2
-    assert "usage: guard" in result.stderr
-    assert not tmux_log.exists()
-    assert not probe_log.exists()
diff --git a/tests/test_handoff_skill_72_80.py b/tests/test_handoff_skill_72_80.py
deleted file mode 100644
index d7d9e87c..00000000
--- a/tests/test_handoff_skill_72_80.py
+++ /dev/null
@@ -1,475 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`skills/handoff/SKILL.md`'s step-1 fence and step-4 `window` ref, held to
-opensoft/openRepoTools#72 item 8 and #80 item 4.
-
-#72 ITEM 8 — AN EXIT 2 IS TWO ANSWERS, AND THE SKILL HEARD ONE. Every read in
-step 1 goes through `sread`, whose `8|2) sr_out=""` arm read every exit 2 as
-"no answer" and fell to the next rung. But `2` is also `canon_lane`'s refusal
-of a register holding two rows that differ only by case (Amendment 15(d)),
-which `register-row` and every other read that takes a lane name carry. Falling
-through THAT binds the window to whatever the next rung answers, and the last
-rung is the workstation's NEWEST SWAP: a different lane, which the skill then
-renames the window for and writes a PAUSED record and a restart command about.
-`lane-handoff`'s own `sread` tells the two apart by the helper's words (#47
-round 2); the skill now does the same, and an old helper's unknown-subcommand
-2 still falls through as it did. And because only rung 1 reads its name
-through the resolver, the bound name is then read through `canon-lane` and
-the same fence whichever rung answered, as `lane-handoff` does after its rungs
-(the independent review of #260): a case twin bound by `window-lane` or by
-the newest swap refuses there too.
-
-#80 ITEM 4 — A `<session>:<index>` CHECKED BY A PREFIX GLOB. Step 4 held the
-live `#S:#I` and the launcher's `WORKBENCHES_CLAUDE_WINDOW_REF` to
-`case "$win" in *:[0-9]*)`, so `s:1junk` passed and went into the append-only
-`window` sub-field, where `window-lane` can never resolve it. Both checks are
-now the whole-string `[[ "$win" =~ ^.+:[0-9]+$ ]]` the `<@id>` beside them
-already used, and because that regex's `.` matches a line break, a value
-carrying a newline or a carriage return is dropped beside each check:
-`log PAUSED` would refuse the whole record over it.
-
-THE BLOCKS ARE RUN, NOT READ. They are found the way
-`tests/test_skill_shell_blocks.py` finds them (its own fence reader, imported
-rather than copied), cut by the same two ranges the shell suite's
-`sfence_probe` and `skill_win_of` cut, and run under `bash` and under `zsh -f`
-where one is installed, because a session's Bash tool runs a skill's block
-under the user's own shell. Every RED case below fails against the block as it
-stood at 08e7550 and passes with the fix, and the review round's cases (the
-lower rungs, `canon-lane`'s answers and a line break before the index) fail
-against c9d681f as well; the rest pin what did not change.
-
-NOTHING HERE READS THE CALLER'S ENVIRONMENT. A lane window exports
-`WORKBENCHES_CLAUDE_WINDOW_REF`, `_WINDOW_ID`, `TMUX` and the `LANES_*` seams,
-which are exactly what these blocks read, so the environment is an explicit
-dict and never `os.environ` plus changes. `lanes-edit.sh` is a stub on a
-private `PATH` and `tmux` is a shell function, so nothing reaches a register,
-a tmux server or the network.
-"""
-
-from __future__ import annotations
-
-import os
-import shlex
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-from typing import Dict, List, NamedTuple, Optional
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-from test_skill_shell_blocks import SHELL_TAGS, fenced_blocks
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="the skill's blocks are shell")]
-
-SKILL = REPO / "skills/handoff/SKILL.md"
-
-SHELLS = [
-    pytest.param("bash", id="bash"),
-    pytest.param("zsh", id="zsh", marks=pytest.mark.skipif(
-        shutil.which("zsh") is None, reason="no zsh here")),
-]
-
-#: What `lanes-edit.sh`'s `canon_lane` writes to stderr before it returns 2 for
-#: two rows whose lane names differ only by case (`lanes-edit.sh`, the
-#: `cl_n -gt 1` arm), cut to its first sentence of advice.
-WORDS_15D = (
-    "lanes-edit: the register has 2 rows whose lane names differ only by case "
-    "for 'repo-1': repo-1 Repo-1\n"
-    "lanes-edit: a lane name is ONE name under any case (Amendment 15), so no "
-    "read and no write under it is unambiguous. Merge them into one row "
-    "(Amendment 15(d)): append the newer row's session id(s) to the older "
-    "row's session cell, in order.\n")
-
-#: What a `lanes-edit.sh` predating a subcommand writes from its `*)` arm.
-WORDS_OLD = "lanes-edit: unknown subcommand 'some-verb' (verify-row|log|who)\n"
-
-
-# --- the blocks, as the file holds them --------------------------------------
-
-def _shell_blocks() -> List[str]:
-    return [b.body for b in fenced_blocks(SKILL.read_text(encoding="utf-8"))
-            if b.tag in SHELL_TAGS]
-
-
-def _one_block(marker: str) -> List[str]:
-    found = [b for b in _shell_blocks() if marker in b]
-    assert len(found) == 1, (
-        f"expected exactly one shell block of {SKILL.name} carrying "
-        f"{marker!r}, found {len(found)}: this test is stale")
-    return found[0].split("\n")
-
-
-def _cut(lines: List[str], first: str, last: str, exact_last: bool) -> str:
-    """The lines from the one starting `first` to the next one that is `last`
-    (or starts with it), inclusive — the shell suite's awk ranges."""
-    starts = [i for i, line in enumerate(lines) if line.startswith(first)]
-    assert len(starts) == 1, f"{first!r} opens {len(starts)} lines: stale"
-    for j in range(starts[0] + 1, len(lines)):
-        if (lines[j] == last) if exact_last else lines[j].startswith(last):
-            return "\n".join(lines[starts[0]:j + 1]) + "\n"
-    raise AssertionError(f"no {last!r} after {first!r}: this test is stale")
-
-
-def sread_fence() -> str:
-    """`sread()` through its closing `}` — `sfence_probe`'s
-    `awk '/^sread\\(\\) \\{/,/^\\}$/'`."""
-    return _cut(_one_block("sread() {"), "sread() {", "}", exact_last=True)
-
-
-def step1_block() -> str:
-    """Step 1's whole block: the window name, the workstation and the three
-    rungs, each read through `sread`."""
-    return "\n".join(_one_block('sread row_probe ')) + "\n"
-
-
-def window_block() -> str:
-    """Step 4's `window` sub-field, from the live `#S:#I` read through the line
-    that puts the `<@id>` beside it — `skill_win_of`'s range."""
-    first = "win=\"$(tmux display-message -p '#S:#I'"
-    return _cut(_one_block(first), first,
-                '[[ "$wid" =~ ^@[0-9]+$ ]] && win=', exact_last=False)
-
-
-# --- a sandbox with a stub helper and no inherited environment ---------------
-
-class Verb(NamedTuple):
-    rc: int
-    out: str = ""
-    err: str = ""
-
-
-class Sandbox:
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.bin = root / "bin"
-        self.bin.mkdir()
-        (root / "home").mkdir()
-        (root / "tmp").mkdir()
-        self.calls = root / "helper-calls"
-        self.helper = self.bin / "lanes-edit.sh"
-        usage = self.bin / "claude-usage"
-        usage.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
-        usage.chmod(usage.stat().st_mode | stat.S_IXUSR)
-        dirs: List[str] = [str(self.bin)]
-        for tool in ("bash", "zsh"):
-            found = shutil.which(tool)
-            if found and os.path.dirname(found) not in dirs:
-                dirs.append(os.path.dirname(found))
-        for fallback in ("/usr/bin", "/bin"):
-            if fallback not in dirs:
-                dirs.append(fallback)
-        self.env: Dict[str, str] = {
-            "HOME": str(root / "home"), "PATH": os.pathsep.join(dirs),
-            "TMPDIR": str(root / "tmp"), "LC_ALL": "C", "TZ": "UTC",
-        }
-
-    def stub(self, verbs: Dict[str, Verb]) -> None:
-        """`lanes-edit.sh`: each verb answers as given, and any other one is an
-        old helper's unknown subcommand. Every call is logged with the
-        `LANES_NO_FETCH` it was made under."""
-        arms = []
-        for verb, (rc, out, err) in verbs.items():
-            arms.append(f"  {verb}) printf '%s' {shlex.quote(out)}; "
-                        f"printf '%s' {shlex.quote(err)} >&2; exit {rc} ;;")
-        self.helper.write_text(
-            "#!/bin/sh\n"
-            f"printf '%s|%s\\n' \"${{LANES_NO_FETCH-unset}}\" \"$*\" >> "
-            f"{shlex.quote(str(self.calls))}\n"
-            "case \"$1\" in\n" + "\n".join(arms) + "\n"
-            "  *) printf \"lanes-edit: unknown subcommand '%s'\\n\" \"$1\" >&2;"
-            " exit 2 ;;\nesac\n", encoding="utf-8")
-        self.helper.chmod(self.helper.stat().st_mode | stat.S_IXUSR)
-
-    def logged(self) -> List[str]:
-        if not self.calls.exists():
-            return []
-        return self.calls.read_text(encoding="utf-8").splitlines()
-
-    def run(self, shell: str, script: str,
-            extra: Optional[Dict[str, str]] = None) -> subprocess.CompletedProcess:
-        env = dict(self.env)
-        env.update(extra or {})
-        argv = [shutil.which(shell) or shell]
-        if shell == "zsh":
-            argv.append("-f")
-        return subprocess.run([*argv, "-c", script], cwd=str(self.root),
-                              env=env, capture_output=True, text=True,
-                              stdin=subprocess.DEVNULL, check=False,
-                              timeout=60)
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    return Sandbox(tmp_path)
-
-
-def _sread_script(box: Sandbox) -> str:
-    return (f"L={shlex.quote(str(box.helper))}\n" + sread_fence() +
-            "v=unset\n"
-            "sread v \"'a thing it is not'\" some-verb arg1\n"
-            "printf 'AFTER rc=%s v=[%s]\\n' \"$?\" \"$v\"\n")
-
-
-# --- #72 item 8: the fence ---------------------------------------------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_an_exit_2_carrying_amendment_15d_stops_the_skill(box: Sandbox,
-                                                          shell: str) -> None:
-    """RED at 08e7550. A read that exits 2 with `canon_lane`'s words is a
-    REFUSAL: the fence stops the skill where it stands (nothing after the read
-    runs), says so naming the read, and relays the helper's own words. The
-    words come from asking the same read again with only its stderr kept, so
-    the helper sees the same arguments and `LANES_NO_FETCH=1` both times."""
-    box.stub({"some-verb": Verb(2, "ANSWER\n", WORDS_15D)})
-    proc = box.run(shell, _sread_script(box))
-    assert "AFTER" not in proc.stdout, (
-        "the fence fell through on Amendment 15(d)'s refusal and the skill "
-        f"carried on with an empty answer (#72 item 8):\n{proc.stdout}")
-    assert proc.returncode == 2, (proc.returncode, proc.stderr)
-    assert "REFUSED" in proc.stderr, proc.stderr
-    assert "Amendment 15(d)" in proc.stderr, proc.stderr
-    assert "some-verb" in proc.stderr, "the refusal must name the read"
-    assert "differ only by case for 'repo-1'" in proc.stderr, (
-        "the helper's own words must be relayed")
-    assert "will not bind a lane" in proc.stderr, proc.stderr
-    assert box.logged() == ["1|some-verb arg1", "1|some-verb arg1"], box.logged()
-
-
-class FenceCase(NamedTuple):
-    verb: Verb
-    stdout: str
-    returncode: int
-
-
-FENCE_CASES = {
-    # 2 from a helper predating the read: still the next rung, as before.
-    "old-helper-2": FenceCase(Verb(2, "ANSWER\n", WORDS_OLD),
-                              "AFTER rc=0 v=[]\n", 0),
-    "silent-2": FenceCase(Verb(2, "ANSWER\n", ""), "AFTER rc=0 v=[]\n", 0),
-    "no-answer-8": FenceCase(Verb(8, "ANSWER\n", ""), "AFTER rc=0 v=[]\n", 0),
-    "answer-0": FenceCase(Verb(0, "ANSWER\n", ""), "AFTER rc=0 v=[ANSWER]\n", 0),
-    # A failed read stops the skill, as it did: exit 1, and nothing after it.
-    "failed-6": FenceCase(Verb(6, "", "boom\n"), "", 1),
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(FENCE_CASES))
-def test_every_other_code_reads_as_it_did(box: Sandbox, shell: str,
-                                          case: str) -> None:
-    """What did not change: an old helper's 2 and a silent 2 still fall to the
-    next rung with the variable empty, 8 does too, 0 is the answer, and any
-    other code is a read that failed and stops the skill."""
-    want = FENCE_CASES[case]
-    box.stub({"some-verb": want.verb})
-    proc = box.run(shell, _sread_script(box))
-    assert (proc.stdout, proc.returncode) == (want.stdout, want.returncode), (
-        proc.stdout, proc.returncode, proc.stderr)
-    if case == "failed-6":
-        assert "failed (exit 6)" in proc.stderr, proc.stderr
-    else:
-        assert "REFUSED" not in proc.stderr, proc.stderr
-
-
-STEP1_TMUX = (
-    "tmux() { case \"$*\" in *'#W'*) printf '%s\\n' \"$STUB_WINDOW\" ;; "
-    "*window_id*) printf '@5\\n' ;; *'#S:#I'*) printf 's:1\\n' ;; esac; }\n")
-
-SWAP_ROW = "other-7\t2026-10-18T00:00:00Z\n"
-
-#: Amendment 15(d)'s words for the lane rungs 2 and 3 bind below.
-WORDS_15D_OTHER = WORDS_15D.replace("repo-1", "other-7").replace(
-    "Repo-1", "Other-7")
-
-#: The two rungs below the window name, each answering `other-7` for a window
-#: named `zsh` — which the register has no row for (`register-row` 8). This is
-#: the shape the independent review of #260 measured.
-LOWER_RUNGS = {
-    "rung-2-window-lane": {"register-row": Verb(8),
-                           "window-lane": Verb(0, "other-7\n")},
-    "rung-3-swapped": {"register-row": Verb(8), "window-lane": Verb(8),
-                       "swapped": Verb(0, SWAP_ROW)},
-}
-
-
-def _step1(box: Sandbox, shell: str, window: str,
-           verbs: Dict[str, Verb]) -> subprocess.CompletedProcess:
-    box.stub(dict(verbs, workstation=Verb(0, "Eagle\tconfigured\n")))
-    script = (f"L={shlex.quote(str(box.helper))}\n" + sread_fence() +
-              STEP1_TMUX + step1_block())
-    return box.run(shell, script, {"STUB_WINDOW": window})
-
-
-def _verbs(box: Sandbox) -> List[str]:
-    return [line.split("|", 1)[1].split()[0] for line in box.logged()]
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_step_1_does_not_bind_the_newest_swap_over_a_case_twin_row(
-        box: Sandbox, shell: str) -> None:
-    """RED at 08e7550, the consequence #72 item 8 names. The window is named
-    `repo-1` and the register holds `repo-1` and `Repo-1`, so `register-row`
-    refuses with 2 and Amendment 15(d)'s words. The skill used to read that as
-    "this window is not a lane", ask `window-lane` (8, none) and then take the
-    workstation's NEWEST SWAP, `other-7`: a different lane, printed as this
-    one. Now step 1 stops before any rung below the refusal is asked."""
-    proc = _step1(box, shell, "repo-1", {
-        "register-row": Verb(2, "", WORDS_15D),
-        "window-lane": Verb(8),
-        "swapped": Verb(0, SWAP_ROW),
-    })
-    assert "lane=" not in proc.stdout, (
-        "step 1 bound a lane over Amendment 15(d)'s refusal (#72 item 8):\n"
-        f"{proc.stdout}")
-    assert proc.returncode == 2, (proc.returncode, proc.stderr)
-    assert "Amendment 15(d)" in proc.stderr, proc.stderr
-    assert "window-lane" not in _verbs(box), (
-        f"a rung below the refusal was asked: {box.logged()}")
-    assert "swapped" not in _verbs(box), (
-        f"a rung below the refusal was asked: {box.logged()}")
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("rung", sorted(LOWER_RUNGS))
-def test_step_1_refuses_a_case_twin_lane_whichever_rung_bound_it(
-        box: Sandbox, shell: str, rung: str) -> None:
-    """RED at c9d681f (the review of #260). Rung 1 is refused through
-    `register-row`, but rungs 2 and 3 answer with a record's lane field and the
-    swap row's first cell, which nothing read through the resolver: a lane
-    whose register holds `other-7` and `Other-7` bound from either, and step 1
-    printed `lane=other-7` and exited 0. The bound name is now read through
-    `canon-lane` and the fence, as `lane-handoff` does after its rungs, so
-    Amendment 15(d)'s 2 refuses there whichever rung answered."""
-    proc = _step1(box, shell, "zsh", dict(
-        LOWER_RUNGS[rung], **{"canon-lane": Verb(2, "", WORDS_15D_OTHER)}))
-    assert "lane=" not in proc.stdout, (
-        f"step 1 bound a case-twin lane from {rung} (#72 item 8, the review "
-        f"of #260):\n{proc.stdout}")
-    assert proc.returncode == 2, (proc.returncode, proc.stderr)
-    assert "Amendment 15(d)" in proc.stderr, proc.stderr
-    assert "canon-lane" in proc.stderr, "the refusal must name the read"
-    assert "1|canon-lane other-7" in box.logged(), box.logged()
-
-
-class CanonCase(NamedTuple):
-    verb: Verb
-    returncode: int
-    lane: Optional[str]      # the `lane=` line step 1 prints, None for none
-
-
-CANON_CASES = {
-    # The register row's spelling replaces the bound one.
-    "row-spelling": CanonCase(Verb(0, "Other-7\n"), 0, "Other-7"),
-    # A read that failed stops the skill (66 is an alias table that could not
-    # be read, which `canon-lane` carries rather than flattening to 2).
-    "failed-66": CanonCase(Verb(66, "", "lanes-edit: aliases.tsv COULD NOT "
-                                "BE READ\n"), 1, None),
-    "same-name": CanonCase(Verb(0, "other-7\n"), 0, "other-7"),
-    "old-helper-2": CanonCase(Verb(2, "", WORDS_OLD), 0, "other-7"),
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(CANON_CASES))
-def test_step_1_reads_the_bound_name_through_canon_lane(
-        box: Sandbox, shell: str, case: str) -> None:
-    """What `canon-lane`'s other answers do to a lane rung 3 bound: the
-    register row's spelling replaces the bound one, a failed read stops the
-    skill like every failed read through the fence, and an answer naming the
-    same lane or an old helper's 2 leaves `other-7` as it was. Every case is
-    RED at c9d681f, where `canon-lane` was never asked; `row-spelling` and
-    `failed-66` also printed a different answer there."""
-    want = CANON_CASES[case]
-    proc = _step1(box, shell, "zsh", dict(
-        LOWER_RUNGS["rung-3-swapped"], **{"canon-lane": want.verb}))
-    assert proc.returncode == want.returncode, (proc.returncode, proc.stderr)
-    if want.lane is None:
-        assert "lane=" not in proc.stdout, proc.stdout
-        assert "failed (exit 66)" in proc.stderr, proc.stderr
-    else:
-        assert proc.stdout.splitlines()[-1] == f"lane={want.lane}", proc.stdout
-    assert "1|canon-lane other-7" in box.logged(), box.logged()
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_step_1_still_falls_through_an_old_helpers_2(box: Sandbox,
-                                                     shell: str) -> None:
-    """The fall-through the fence keeps: a `register-row` that exits 2 as an
-    old helper's unknown subcommand is "no answer", and step 1 goes on to the
-    newest swap exactly as it did before the fix. That helper has no
-    `canon-lane` either (the stub's unknown-subcommand 2), and the swap's name
-    is kept."""
-    proc = _step1(box, shell, "repo-1", {
-        "register-row": Verb(2, "", WORDS_OLD),
-        "window-lane": Verb(8),
-        "swapped": Verb(0, SWAP_ROW),
-    })
-    assert proc.returncode == 0, (proc.returncode, proc.stderr)
-    assert proc.stdout.splitlines()[-1] == "lane=other-7", proc.stdout
-
-
-# --- #80 item 4: the `<session>:<index>` ref ---------------------------------
-
-class WinCase(NamedTuple):
-    live_ref: str
-    live_id: str
-    env_ref: str
-    env_id: str
-    want: str
-
-
-WIN_CASES = {
-    "clean": WinCase("s:1", "@12", "", "", "s:1 @12"),
-    # RED at 08e7550: each of these was taken by the prefix glob.
-    "live-ref-junk": WinCase("s:1junk", "@12", "", "", "@12"),
-    "env-ref-junk": WinCase("", "", "s:1junk", "@12", "@12"),
-    "live-junk-falls-to-env": WinCase("s:1junk", "", "s:4", "", "s:4"),
-    "no-session-part": WinCase(":1", "", "", "", ""),
-    "env-ref-newline": WinCase("", "", "s:1\njunk", "", ""),
-    # RED at c9d681f too (the review of #260): the regex's `.` matches a line
-    # break, so a ref with one BEFORE the index passed it, and `log PAUSED`
-    # refuses a payload carrying a newline or a carriage return.
-    "env-ref-newline-before-index": WinCase("", "", "junk\ns:1", "", ""),
-    "live-ref-newline-falls-to-env": WinCase("junk\ns:1", "", "s:4", "", "s:4"),
-    "env-ref-carriage-return": WinCase("", "", "junk\rs:1", "", ""),
-    # Unchanged: digits after the LAST colon, no index at all, and the
-    # `<@id>` beside it, which was already checked whole.
-    "last-colon": WinCase("s:1:2", "", "", "", "s:1:2"),
-    "no-index": WinCase("s:", "", "", "", ""),
-    "id-junk-live-and-env": WinCase("s:1", "@12junk", "", "@12junk", "s:1"),
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(WIN_CASES))
-def test_the_window_ref_is_checked_as_a_whole_string(box: Sandbox, shell: str,
-                                                     case: str) -> None:
-    """Step 4's `window` sub-field takes a `<session>:<index>` only where the
-    WHOLE value is one — from tmux and from the launcher's export alike — so
-    `s:1junk` is dropped, and a live value that is dropped falls back to the
-    export as an empty one does."""
-    want = WIN_CASES[case]
-    script = (
-        "tmux() { case \"$*\" in *'#S:#I'*) printf '%s\\n' \"$STUB_REF\" ;; "
-        "*window_id*) printf '%s\\n' \"$STUB_ID\" ;; esac; }\n"
-        + window_block() + "printf '[%s]' \"$win\"\n")
-    proc = box.run(shell, script, {
-        "STUB_REF": want.live_ref, "STUB_ID": want.live_id,
-        "WORKBENCHES_CLAUDE_WINDOW_REF": want.env_ref,
-        "WORKBENCHES_CLAUDE_WINDOW_ID": want.env_id,
-    })
-    assert proc.returncode == 0, (proc.returncode, proc.stderr)
-    assert proc.stdout == f"[{want.want}]", (
-        f"{case}: tmux #S:#I={want.live_ref!r} #{{window_id}}="
-        f"{want.live_id!r}, exported ref={want.env_ref!r} id={want.env_id!r} "
-        f"recorded {proc.stdout!r}, expected [{want.want}] (#80 item 4)")
-
-
-def test_no_prefix_glob_is_left_on_a_window_ref() -> None:
-    """The two globs #80 item 4 names are gone from every shell block of the
-    skill, so a later copy cannot bring one back beside the fixed lines."""
-    left = [line.strip() for block in _shell_blocks()
-            for line in block.split("\n") if "*:[0-9]*)" in line]
-    assert not left, f"a prefix glob still checks a window ref: {left}"
diff --git a/tests/test_handoff_skill_80_85.py b/tests/test_handoff_skill_80_85.py
deleted file mode 100644
index abf66de5..00000000
--- a/tests/test_handoff_skill_80_85.py
+++ /dev/null
@@ -1,450 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`skills/handoff/SKILL.md`'s two record writes and the why they carry, held to
-opensoft/openRepoTools#80 item 7 and #85's skill half.
-
-#80 ITEM 7 — THE RECORD WRITES CARRIED THE TEMPLATE, NOT THE VALUE. Step 4
-computes `why_text` (the operator's why, then the kind's word) and then wrote
-neither line with it. The object log's PAUSED free text was the literal
-`on <operator>'s word: <sanitized verbatim>`, and the register's file-level
-line carried `<sanitized verbatim>` and `<what's open, or NOTHING CLAIMED>`,
-so a person who ran the block as printed recorded the placeholders.
-`lane-handoff`, the same act from a shell (Amendment 17(a)), passes its
-computed text to both writes. The two are now held to write the same lines for
-the same why.
-
-#85, THE SKILL'S HALF — A LINE BREAK IN THE WHY. #218 made `append-line` and
-`lane-handoff` refuse a why carrying a newline or a carriage return before
-anything is written, and made `lane-handoff`'s `sanitize` spell every break
-`; ` as the second line of defence. The skill did neither. Its why reached step
-2's top block and step 4's two one-line writes as typed, and step 4 did not
-replace ` — ` either, though its own prose says it does. The skill now refuses
-such a why before step 1, as `lane-handoff` does right after reading its
-arguments, and step 4 sanitizes the why as `lane-handoff`'s `sanitize` does.
-
-THE BLOCKS ARE RUN, NOT READ. They are found with
-`tests/test_skill_shell_blocks.py`'s own fence reader and run in
-`tests/test_handoff_skill_72_80.py`'s sandbox (both imported, not copied),
-under `bash` and under `zsh -f` where one is installed, because a session's
-Bash tool runs a skill's block under the user's own shell.
-`lane-handoff`'s side of every comparison is ITS OWN code: its `sanitize`
-function, its kind-word lines and its register-line template, cut out of the
-file. So the two cannot drift apart with this file still green. Every case
-marked RED fails against the skill at b707bd7 and passes with the fix.
-
-NOTHING HERE READS THE CALLER'S ENVIRONMENT. A lane window exports
-`WORKBENCHES_CLAUDE_*`, `TMUX`, `LANES_AGENT` and the other `LANES_*` seams,
-which are exactly what these blocks read, so the environment is an explicit
-dict and never `os.environ` plus changes. `lanes-edit.sh` is a stub on a
-private `PATH` that records every call's arguments, `tmux` answers nothing and
-`date` answers one fixed instant, so nothing reaches a register, a tmux server
-or the network.
-"""
-
-from __future__ import annotations
-
-import re
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-from typing import Dict, List, NamedTuple, Optional
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-from test_handoff_skill_72_80 import SHELLS
-from test_handoff_skill_72_80 import Sandbox as SkillSandbox
-from test_skill_shell_blocks import SHELL_TAGS, Block, fenced_blocks
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="the skill's blocks are shell")]
-
-SKILL = REPO / "skills/handoff/SKILL.md"
-LANE_HANDOFF = REPO / "lane-handoff"
-
-LANE = "repoHS-1"
-WS = "Eagle"
-UUID = "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d"
-#: What the stub `date` answers, so the register line can be compared whole.
-NOW = "2026-10-19T01:02:03Z"
-
-#: The three verbs step 4 writes with. Nothing else it calls writes.
-WRITES = ("log", "append-line", "set-row-state")
-
-#: A template placeholder: `<` and `>` around words, as the template spells
-#: `<sanitized verbatim>`, `<operator>` and `<what's open, or NOTHING CLAIMED>`.
-PLACEHOLDER = re.compile(r"<[^<>\n]+>")
-
-#: The markers that find the blocks, each carried by exactly one shell block.
-STEP4 = "# (c) the row: ONE WRITE"
-DOOR = "REFUSED: the why is ONE line"
-
-
-# --- the blocks, as the files hold them --------------------------------------
-
-def _skill_text() -> str:
-    return SKILL.read_text(encoding="utf-8")
-
-
-def _shell_blocks() -> List[Block]:
-    return [b for b in fenced_blocks(_skill_text()) if b.tag in SHELL_TAGS]
-
-
-def _one_block(marker: str) -> Block:
-    found = [b for b in _shell_blocks() if marker in b.body]
-    assert len(found) == 1, (
-        f"expected exactly one shell block of {SKILL.name} carrying "
-        f"{marker!r}, found {len(found)}")
-    return found[0]
-
-
-def _lane_handoff_lines() -> List[str]:
-    return LANE_HANDOFF.read_text(encoding="utf-8").split("\n")
-
-
-def _the_line(lines: List[str], start: str) -> str:
-    found = [line for line in lines if line.startswith(start)]
-    assert len(found) == 1, (
-        f"lane-handoff has {len(found)} top-level lines starting {start!r}: "
-        "this test is stale")
-    return found[0]
-
-
-def lane_handoff_why_text() -> str:
-    """`lane-handoff`'s own `sanitize` and the three lines that build its
-    `why_text` from `$why` and `$handoff_kind`, cut out of the file."""
-    lines = _lane_handoff_lines()
-    starts = [i for i, line in enumerate(lines) if line == "sanitize() {"]
-    assert len(starts) == 1, "lane-handoff's `sanitize() {` is gone: stale"
-    end = next(j for j in range(starts[0] + 1, len(lines)) if lines[j] == "}")
-    return "\n".join(lines[starts[0]:end + 1] + [
-        _the_line(lines, 'kind_word="$handoff_kind"'),
-        _the_line(lines, '[ "$handoff_kind" = unknown ] && kind_word='),
-        _the_line(lines, 'why_text="$(sanitize '),
-    ]) + "\n"
-
-
-def lane_handoff_register_line() -> str:
-    """The double-quoted word `lane-handoff` hands `append-line` for the
-    register's file-level PAUSED line, cut out of the file."""
-    found = re.findall(r'append-line ("PAUSED — lane [^"\n]*")',
-                       LANE_HANDOFF.read_text(encoding="utf-8"))
-    assert len(found) == 1, (
-        f"lane-handoff has {len(found)} register PAUSED lines: stale")
-    return found[0]
-
-
-# --- a sandbox with a stub helper and no inherited environment ---------------
-
-#: Each call is one file holding the `LANES_SESSION` it was made under, then
-#: every argument, NUL-separated, so an argument carrying a line break is
-#: recorded as the one argument it is. `lane-dir` answers 8, no answer, and
-#: every other verb succeeds.
-STUB = """#!/usr/bin/env bash
-n=$(ls "$STUB_CALLS" | wc -l)
-n=$((n + 1))
-printf '%s\\0' "${LANES_SESSION-<unset>}" "$@" > "$STUB_CALLS/$(printf '%04d' "$n")"
-case "$1" in
-  lane-dir) exit 8 ;;
-esac
-exit 0
-"""
-
-
-class Call(NamedTuple):
-    session: str
-    argv: List[str]
-
-
-class Sandbox(SkillSandbox):
-    """`tests/test_handoff_skill_72_80.py`'s sandbox: its private `PATH`, its
-    explicit environment and its `run` under `bash` or `zsh -f`. On top of it
-    go a helper stub that records every argument, a `tmux` that answers
-    nothing and a `date` that answers `NOW`."""
-
-    def __init__(self, root: Path) -> None:
-        super().__init__(root)
-        self.calls_dir = root / "calls"
-        self.calls_dir.mkdir()
-        for name, body in (("lanes-edit.sh", STUB),
-                           ("tmux", "#!/bin/sh\nexit 1\n"),
-                           ("date", f"#!/bin/sh\nprintf '%s\\n' '{NOW}'\n")):
-            tool = self.bin / name
-            tool.write_text(body, encoding="utf-8")
-            tool.chmod(tool.stat().st_mode | stat.S_IXUSR)
-        self.env["STUB_CALLS"] = str(self.calls_dir)
-
-    def recorded(self) -> List[Call]:
-        out = []
-        for path in sorted(self.calls_dir.iterdir()):
-            fields = path.read_bytes().decode("utf-8").split("\0")[:-1]
-            out.append(Call(fields[0], fields[1:]))
-        return out
-
-    def writes(self, verb: str) -> List[Call]:
-        return [c for c in self.recorded() if c.argv and c.argv[0] == verb]
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    return Sandbox(tmp_path)
-
-
-def _why_env(why: Optional[str], kind: Optional[str] = None) -> Dict[str, str]:
-    env: Dict[str, str] = {}
-    if why is not None:
-        env["STUB_WHY"] = why
-    if kind is not None:
-        env["STUB_KIND"] = kind
-    return env
-
-
-#: How a session holds the operator's words when it reaches a block: `$why`,
-#: set where the operator gave one and unset where they did not.
-WHY_PRELUDE = ('if [ "${STUB_WHY+set}" = set ]; then why="$STUB_WHY"; '
-               'else unset why; fi\n')
-
-
-def _step4(box: Sandbox, shell: str, why: Optional[str],
-           kind: Optional[str] = None) -> subprocess.CompletedProcess:
-    """Step 4's whole block, with what steps 1 and 2 would have bound."""
-    script = (f'L="{box.helper}"\nlane={LANE}\nws={WS}\nuuid={UUID}\n'
-              'ws_missing=""\nuuid_missing=""\n' + WHY_PRELUDE +
-              '[ -z "${STUB_KIND-}" ] || kind="$STUB_KIND"\n' +
-              _one_block(STEP4).body)
-    proc = box.run(shell, script, _why_env(why, kind))
-    assert proc.returncode == 0, (proc.returncode, proc.stderr)
-    return proc
-
-
-def _lane_handoff_writes(box: Sandbox, why: str,
-                         kind: Optional[str]) -> List[str]:
-    """What `lane-handoff`'s own code hands the two writes for this why: the
-    log's free text and the register line, with the same lane, session,
-    workstation and instant the skill is run with."""
-    script = ('why="$STUB_WHY"; handoff_kind="$STUB_KIND"\n' +
-              lane_handoff_why_text() +
-              f'lane={LANE}; uuid={UUID}; ws={WS}; UTC={NOW}\n'
-        f'printf \'%s\\0%s\\0\' "$why_text" {lane_handoff_register_line()}\n')
-    proc = box.run("bash", script, _why_env(why, kind or "unknown"))
-    assert proc.returncode == 0, (proc.returncode, proc.stderr)
-    return proc.stdout.split("\0")[:-1]
-
-
-def _the_one(box: Sandbox, verb: str) -> Call:
-    found = box.writes(verb)
-    assert len(found) == 1, (verb, box.recorded())
-    return found[0]
-
-
-# --- #80 item 7: the two writes carry the computed why -----------------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_both_record_writes_carry_the_why_the_block_computed(
-        box: Sandbox, shell: str) -> None:
-    """RED at b707bd7. The object log's PAUSED line takes the why, then the
-    kind's word, as its free text, and the register's file-level line is the
-    shape `lane-handoff` writes: lane, session@workstation, the instant, that
-    same text, then `handoff refreshed`."""
-    _step4(box, shell, "a usage reset")
-    log = _the_one(box, "log")
-    assert log.argv[:4] == ["log", "PAUSED", f"lane:{LANE}", "→"], log.argv
-    assert log.session == UUID, log
-    assert log.argv[-1] == "a usage reset kind unknown", (
-        "the object log's PAUSED free text is not the why the block computed "
-        f"(#80 item 7): {log.argv[-1]!r}")
-    line = _the_one(box, "append-line")
-    assert line.argv[1:] == [
-        f"PAUSED — lane {LANE}, session {UUID}@{WS}, {NOW}, "
-        "a usage reset kind unknown; handoff refreshed"], (
-        f"the register's PAUSED line is not the computed one (#80 item 7): "
-        f"{line.argv[1:]!r}")
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_no_write_records_a_template_placeholder(box: Sandbox,
-                                                 shell: str) -> None:
-    """RED at b707bd7. Run as printed, no argument of any write is a
-    `<placeholder>`: what the template showed a reader is never what the
-    block records."""
-    _step4(box, shell, "a usage reset")
-    left = [(c.argv[0], arg) for c in box.recorded() if c.argv[0] in WRITES
-            for arg in c.argv if PLACEHOLDER.search(arg)]
-    assert not left, f"a write recorded the template's placeholder: {left}"
-    assert [c.argv[0] for c in box.recorded() if c.argv[0] in WRITES] == \
-        list(WRITES), box.recorded()
-
-
-def test_no_shell_block_carries_the_placeholders_80_item_7_names() -> None:
-    """RED at b707bd7. The three placeholders the finding quotes are gone from
-    every shell block of the skill, so no later copy brings one back beside
-    the fixed writes."""
-    left = [line.strip() for block in _shell_blocks()
-            for line in block.body.split("\n")
-            if "<sanitized verbatim>" in line or "<operator>" in line
-            or "<what's open" in line]
-    assert not left, f"a shell block still carries a placeholder: {left}"
-
-
-class WhyCase(NamedTuple):
-    why: str
-    kind: Optional[str]      # None leaves `$kind` unset, which is `unknown`
-
-
-WHY_CASES = {
-    "plain": WhyCase("a usage reset", None),
-    "em-dash": WhyCase("swap — usage reset", None),
-    "respawn": WhyCase("clear", "respawn"),
-    "in-process": WhyCase("clear", "in-process"),
-    "empty": WhyCase("", None),
-    # `lane-handoff` refuses these at its door; its `sanitize` is the second
-    # line of defence, and the skill's step 4 is held to that too.
-    "line-breaks": WhyCase("a\r\nb\rc\nd — e", None),
-    "trailing-newline": WhyCase("usage reset\n", "respawn"),
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(WHY_CASES))
-def test_the_skill_writes_what_lane_handoff_writes_for_the_same_why(
-        box: Sandbox, shell: str, case: str) -> None:
-    """RED at b707bd7. For the same why and the same kind, the skill hands
-    `log PAUSED` and `append-line` exactly what `lane-handoff`'s own code
-    hands them: `sanitize` (` — ` and every line break spelled `; `), an empty
-    why written `handoff`, then the kind's word (`kind unknown`, `respawn`,
-    `in-process`), and its register-line template around that."""
-    want = WHY_CASES[case]
-    free_text, register_line = _lane_handoff_writes(box, want.why, want.kind)
-    _step4(box, shell, want.why, want.kind)
-    assert _the_one(box, "log").argv[-1] == free_text, (
-        f"{case}: the skill's PAUSED free text differs from lane-handoff's")
-    assert _the_one(box, "append-line").argv[1:] == [register_line], (
-        f"{case}: the skill's register line differs from lane-handoff's")
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_line_break_reaches_neither_one_line_write(box: Sandbox,
-                                                     shell: str) -> None:
-    """RED at b707bd7 (#85). A break that reaches step 4 anyway, whatever its
-    spelling, is one `; `, as #218 spelled it for `lane-handoff`: the record
-    is still written, on one line, and no write is handed a newline or a
-    carriage return."""
-    _step4(box, shell, "a\r\nb\rc\nd — e")
-    assert _the_one(box, "log").argv[-1] == "a; b; c; d; e kind unknown"
-    broken = [(c.argv[0], arg) for c in box.recorded() if c.argv[0] in WRITES
-              for arg in c.argv if "\n" in arg or "\r" in arg]
-    assert not broken, f"a write was handed a line break (#85): {broken}"
-
-
-# --- #85: the door ------------------------------------------------------------
-
-def _door(box: Sandbox, shell: str,
-          why: Optional[str]) -> subprocess.CompletedProcess:
-    script = WHY_PRELUDE + _one_block(DOOR).body + "printf 'AFTER\\n'\n"
-    return box.run(shell, script, _why_env(why))
-
-
-REFUSED_WHYS = {
-    "newline": "clear\nsecond line",
-    "carriage-return": "clear\rsecond line",
-    "crlf": "clear\r\nsecond line",
-    "trailing-newline": "usage reset\n",
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(REFUSED_WHYS))
-def test_a_why_carrying_a_line_break_is_refused_at_the_door(
-        box: Sandbox, shell: str, case: str) -> None:
-    """RED at b707bd7, where there was no door. A why carrying a newline or a
-    carriage return stops the skill where it stands (nothing after the block
-    runs) with exit 2, and says what `lane-handoff` says at its own door: the
-    why is ONE line, nothing was written, put `; ` where the break was."""
-    proc = _door(box, shell, REFUSED_WHYS[case])
-    assert "AFTER" not in proc.stdout, (
-        f"{case}: the skill went on with a why carrying a line break (#85)")
-    assert proc.returncode == 2, (proc.returncode, proc.stderr)
-    for words in ("the why is ONE line", "Nothing was renamed or written",
-                  "with '; ' where the break was"):
-        assert words in proc.stderr, (words, proc.stderr)
-    assert "the why is ONE line" in LANE_HANDOFF.read_text(encoding="utf-8"), (
-        "lane-handoff's own door no longer says the why is ONE line: the two "
-        "refusals were written to say the same thing")
-    assert box.recorded() == []
-
-
-PASSED_WHYS = {
-    "plain": "a usage reset",
-    "em-dash": "swap — usage reset",
-    "empty": "",
-    "unset": None,
-}
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("case", sorted(PASSED_WHYS))
-def test_a_one_line_why_passes_the_door_untouched(box: Sandbox, shell: str,
-                                                  case: str) -> None:
-    """What the door leaves alone: a one-line why, a ` — ` (step 4's sanitize
-    spells it), an empty why and none at all go through with nothing said."""
-    proc = _door(box, shell, PASSED_WHYS[case])
-    assert (proc.returncode, proc.stdout, proc.stderr) == (0, "AFTER\n", ""), (
-        case, proc.returncode, proc.stdout, proc.stderr)
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_an_unset_why_passes_the_door_under_set_u_and_is_written_handoff(
-        box: Sandbox, shell: str) -> None:
-    """RED at 9b80eed, where the door read `$why` bare: under `set -u` an
-    unset why stopped the shell there ("why: unbound variable" in bash,
-    "parameter not set" in zsh), before step 1. A why the operator did not
-    give is no why at all. It passes the door with nothing said, and step 4,
-    run in the same `set -u` shell, writes it `handoff`, as `lane-handoff`
-    does."""
-    script = (f'set -u\nL="{box.helper}"\nlane={LANE}\nws={WS}\nuuid={UUID}\n'
-              'ws_missing=""\nuuid_missing=""\nunset why\n' +
-              _one_block(DOOR).body + "printf 'AFTER\\n'\n" +
-              _one_block(STEP4).body)
-    proc = box.run(shell, script)
-    assert proc.returncode == 0, (proc.returncode, proc.stderr)
-    assert proc.stdout.startswith("AFTER\n"), (proc.stdout, proc.stderr)
-    assert "why" not in proc.stderr, proc.stderr
-    assert _the_one(box, "log").argv[-1] == "handoff kind unknown"
-    assert _the_one(box, "append-line").argv[1:] == [
-        f"PAUSED — lane {LANE}, session {UUID}@{WS}, {NOW}, "
-        "handoff kind unknown; handoff refreshed"]
-
-
-def test_the_door_stands_before_anything_is_renamed_or_written() -> None:
-    """RED at b707bd7. The door is asked before step 1, which renames the
-    window, and before every block that publishes, commits or writes a record,
-    so its refusal leaves nothing to undo, as `lane-handoff`'s does."""
-    door = _one_block(DOOR)
-    lines = _skill_text().split("\n")
-    step1 = [n for n, line in enumerate(lines, 1) if line.startswith("## 1. ")]
-    assert len(step1) == 1, "the skill's `## 1.` heading is gone: stale"
-    assert door.opens < step1[0], (
-        f"the door opens at line {door.opens}, after step 1 (line {step1[0]})")
-    acts = ('"$L" log', "append-line", "set-row-state", "publish-handoff",
-            "commit", "rename-window", "send-keys", "lane-handoff")
-
-    def code(block: Block) -> List[str]:
-        """The lines that run: a comment that NAMES an act (the preamble's
-        fence cites `lane-handoff`'s own) is not that act."""
-        return [line for line in block.body.split("\n")
-                if not line.lstrip().startswith("#")]
-
-    later = [b.opens for b in _shell_blocks() if b.opens != door.opens
-             and any(act in line for line in code(b) for act in acts)]
-    assert later and all(opens > door.opens for opens in later), (
-        door.opens, later)
-
-
-def test_step_4s_prose_says_a_line_break_is_spelled_too() -> None:
-    """RED at b707bd7. The sentence that tells a reader what "sanitize" means
-    names the line break beside the ` — `, as the code under it now does."""
-    text = _skill_text()
-    start = text.index("First sanitize the operator's words")
-    paragraph = text[start:text.index("```sh", start)]
-    assert "line break" in paragraph, paragraph
-    assert "lane-handoff" in paragraph, paragraph
diff --git a/tests/test_handoff_skill_98_99_100.py b/tests/test_handoff_skill_98_99_100.py
deleted file mode 100644
index 18ce42b7..00000000
--- a/tests/test_handoff_skill_98_99_100.py
+++ /dev/null
@@ -1,435 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`skills/handoff/SKILL.md`, held to three findings of opensoft/workBenches#93's
-audit of it (opensoft/openRepoTools#98, #99 and #100), in seconds rather than
-the shell suite's hour. The skill is prose a session follows, so what can be
-RUN is run: the fenced blocks are extracted from the file and executed under
-bash against a stub `lanes-edit.sh` that records every call it is given, and
-what cannot is read as text.
-
-  * #98 — a lane that has NEVER HAD A SESSION RECORDED has no uuid in its row,
-    and `R-A11-5` says the skill refuses before it writes, naming the act that
-    supplies one, and names the gap in the handoff, exactly as `R-A11-14` does
-    for a missing workstation. Step 2 sets `$uuid_missing`; step 4 then writes
-    neither the object-log `PAUSED` (the writer refuses a `session` field that
-    is not a transcript uuid) nor the register's file-level line (which would
-    read `session @<ws>`), and still sets the row's state cell, as
-    `lane-handoff` does.
-  * #99 — a comment said `(c) below still runs` of a swap with no workstation,
-    the promise `R-A11-27` exists to refuse: the code gates (c) behind
-    `$ws_missing` with (a) and (b). The code is run here, so the comment is
-    held to what the code does.
-  * #100 — `$L` was `~/projects/xFactory/lanes-edit.sh` alone, where every
-    sibling resolves `lanes-edit.sh` on `PATH` first, `/restart` included.
-
-NOTHING HERE TOUCHES A REAL REGISTER OR A REAL `$HOME`: the helper is a stub,
-`tmux` is a stub that answers nothing, and every path is under `tmp_path`.
-"""
-
-from __future__ import annotations
-
-import re
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="the skill's steps are bash")]
-
-BASH = shutil.which("bash") or "bash"
-ZSH = shutil.which("zsh")
-
-#: zsh is a session's own shell and the one its Bash tool runs in, so a block a
-#: session pastes runs under it, and it differs from bash where this file has
-#: tripped before (`BASH_REMATCH` is empty there; zsh fills `$match`). The
-#: blocks are held to the same answers under both wherever zsh is installed.
-NEEDS_ZSH = pytest.mark.skipif(
-    ZSH is None, reason="zsh is not installed, so the skill's blocks are not "
-                        "run under a session's own shell")
-SKILL = REPO / "skills/handoff/SKILL.md"
-RESTART_SKILL = REPO / "skills/restart/SKILL.md"
-UUID = "0a1b2c3d-4e5f-4a6b-8c7d-9e0f1a2b3c4d"
-OLDER_UUID = "11111111-2222-4333-8444-555555555555"
-
-#: What a session records the helper's calls as: verb, the `LANES_SESSION` it
-#: was handed, then every argument. `lane-dir` answers 8 (no answer) and
-#: `register-row` prints `$STUB_ROW` and exits `$STUB_REGISTER_RC`, which are the
-#: only two reads these blocks make of it that matter here.
-STUB = """#!/usr/bin/env bash
-printf '%s\\tsession=[%s]\\t%s\\n' "$1" "${LANES_SESSION-<unset>}" "$*" >> "$STUB_LOG"
-case "$1" in
-  lane-dir) exit 8 ;;
-  register-row) [ -z "${STUB_ROW:-}" ] || printf '%s\\n' "$STUB_ROW"; exit "${STUB_REGISTER_RC:-0}" ;;
-esac
-exit 0
-"""
-
-
-def _text() -> str:
-    return SKILL.read_text(encoding="utf-8")
-
-
-def _blocks(text: str) -> list[str]:
-    return re.findall(r"^```(?:sh|bash)\n(.*?)\n```$", text,
-                      re.DOTALL | re.MULTILINE)
-
-
-def _block(marker: str) -> str:
-    found = [b for b in _blocks(_text()) if marker in b]
-    assert len(found) == 1, (
-        f"expected exactly one fenced block of {SKILL.name} carrying "
-        f"{marker!r}, found {len(found)}: this test is stale")
-    return found[0]
-
-
-def _section(heading: str) -> str:
-    """The prose-and-code of one numbered `## <n>. …` step of the skill. It
-    ends at the next NUMBERED step, because the handoff's own template, in a
-    fence of step 2, opens with a `## RESUME PROMPT` of its own."""
-    text = _text()
-    start = text.index(heading)
-    end = re.compile(r"\n## \d+\. ").search(text, start + 1)
-    return text[start:end.start() if end else len(text)]
-
-
-def _row(session_cell: str) -> str:
-    return (f"| `repoHS-1` | {session_cell} | Eagle / test / brett | "
-            "2026-09-11T00:00Z | none | handoffs/repoHS/repoHS-1.md | ACTIVE |")
-
-
-class Estate:
-    """A stub helper and a hermetic environment for running a skill block."""
-
-    def __init__(self, root: Path) -> None:
-        root.mkdir(parents=True, exist_ok=True)
-        self.bin = root / "bin"
-        self.bin.mkdir()
-        self.log = root / "calls.tsv"
-        self.log.write_text("")
-        self.helper = self.bin / "lanes-edit.sh"
-        self.helper.write_text(STUB)
-        # A `tmux` that answers nothing, so the host's own server is never read.
-        (self.bin / "tmux").write_text("#!/bin/sh\nexit 1\n")
-        for tool in (self.helper, self.bin / "tmux"):
-            tool.chmod(tool.stat().st_mode | stat.S_IXUSR)
-        self.home = root / "home"
-        self.home.mkdir()
-
-    def run(self, script: str, row: str = "", extra: dict | None = None,
-            shell: str = "bash") -> subprocess.CompletedProcess:
-        env = {"HOME": str(self.home), "PATH": f"{self.bin}:/usr/bin:/bin",
-               "STUB_LOG": str(self.log), "STUB_ROW": row,
-               "TMPDIR": str(self.home), **(extra or {})}
-        argv = [BASH, "-c", script] if shell == "bash" else [ZSH, "-f", "-c", script]
-        return subprocess.run(argv, env=env, cwd=str(self.home),
-                              capture_output=True, text=True, check=False)
-
-    def calls(self) -> list[tuple[str, str, str]]:
-        out = []
-        for line in self.log.read_text(encoding="utf-8").splitlines():
-            verb, session, args = line.split("\t", 2)
-            out.append((verb, session, args))
-        return out
-
-    def verbs(self) -> list[str]:
-        return [verb for verb, _, _ in self.calls()]
-
-
-@pytest.fixture
-def estate(tmp_path: Path) -> Estate:
-    return Estate(tmp_path)
-
-
-# --- #100: `$L` is resolved PATH-first, the way `/restart` resolves it --------
-
-def _l_assignment(path: Path) -> str:
-    for block in _blocks(path.read_text(encoding="utf-8")):
-        for line in block.splitlines():
-            if line.startswith("L="):
-                return line
-    raise AssertionError(f"{path.name} has no `L=` assignment in a fenced block")
-
-
-def test_the_helper_is_resolved_the_way_the_restart_skill_resolves_it():
-    handoff, restart = _l_assignment(SKILL), _l_assignment(RESTART_SKILL)
-    assert "command -v lanes-edit.sh" in restart, (
-        "the sibling this is held to no longer resolves the helper on PATH")
-    assert handoff == restart, (
-        "the handoff skill and the restart skill resolve `$L` differently:\n"
-        f"  handoff: {handoff}\n  restart: {restart}")
-
-
-@pytest.mark.parametrize("on_path", [True, False])
-def test_the_helper_on_path_wins_and_the_symlink_is_the_fallback(estate, on_path):
-    script = f'{_l_assignment(SKILL)}\nprintf "%s" "$L"'
-    env_path = str(estate.bin) if on_path else str(estate.home / "empty")
-    (estate.home / "empty").mkdir()
-    proc = subprocess.run([BASH, "-c", script],
-                          env={"HOME": str(estate.home), "PATH": env_path},
-                          capture_output=True, text=True, check=False)
-    assert proc.returncode == 0, proc.stderr
-    want = (str(estate.helper) if on_path
-            else str(estate.home / "projects/xFactory/lanes-edit.sh"))
-    assert proc.stdout == want, (
-        f"`$L` came out {proc.stdout!r}, wanted {want!r}")
-
-
-def test_the_prose_says_where_the_helper_is_found():
-    prose = _text()[:_text().index("```sh")]
-    sentence = re.search(r"`\$L`.*?\.(?=\s)", prose, re.DOTALL)
-    assert sentence, "the sentence that introduces `$L` is gone"
-    assert "PATH" in sentence.group(0) and "symlink" in sentence.group(0), (
-        "the sentence introducing `$L` must say it is found on PATH first and "
-        f"the symlink second, to agree with the line under it: {sentence.group(0)!r}")
-
-
-# --- #99: no comment promises that (c) runs where there is no workstation ----
-
-def test_no_line_promises_that_the_row_flip_runs_without_a_workstation():
-    lines = _text().splitlines()
-    promises = [n + 1 for n, line in enumerate(lines)
-                if "still does (c)" in line
-                or ("(c) below still runs" in line and "promised" not in line)]
-    assert not promises, (
-        "these lines assert as current fact what R-A11-27 refuses (the code "
-        f"gates (c) behind $ws_missing with (a) and (b)): {promises}")
-
-
-def test_the_comments_name_all_three_writes_a_missing_workstation_stops():
-    text = _text()
-    after = text[text.index("`workstation <ws>` is NOT omitted"):]
-    assert "(a), (b) and (c)" in after[:after.index("payload=")], (
-        "the comment on the `workstation` sub-field must say that (a), (b) and "
-        "(c) all stop where there is none (ruling 11, R-A11-27)")
-    before = text[:text.index("ws_missing=\"\"")]
-    assert "skips (a), (b) and (c)" in before[before.rindex("# AND IT NEVER WRITES"):], (
-        "step 1's comment must say step 4 skips (a), (b) and (c) alike")
-
-
-def _step4(estate: Estate, *, uuid: str, ws_missing: str = "",
-           uuid_missing: str = "") -> subprocess.CompletedProcess:
-    block = _block("# (c) the row: ONE WRITE")
-    script = "\n".join([
-        f'L="{estate.helper}"', "lane=repoHS-1", "ws=Eagle", 'why="a usage reset"',
-        f'uuid="{uuid}"', f'ws_missing="{ws_missing}"',
-        f'uuid_missing="{uuid_missing}"', block,
-        'printf "row_write_refused=[%s]\\n" "$row_write_refused"'])
-    proc = estate.run(script)
-    assert proc.returncode == 0, proc.stderr
-    return proc
-
-
-def test_with_a_workstation_and_a_session_all_three_writes_are_made(estate):
-    """THE CONTROL: the harness records what step 4 really calls."""
-    proc = _step4(estate, uuid=UUID)
-    assert estate.verbs() == ["lane-dir", "log", "append-line", "set-row-state"]
-    (_, session, args) = estate.calls()[1]
-    assert session == f"session=[{UUID}]" and args.startswith("log PAUSED lane:repoHS-1")
-    assert f"session {UUID}@Eagle" in estate.calls()[2][2]
-    assert "row_write_refused=[]" in proc.stdout
-
-
-def test_a_missing_workstation_stops_all_three_register_writes(estate):
-    proc = _step4(estate, uuid=UUID, ws_missing="1")
-    assert estate.verbs() == ["lane-dir"], estate.calls()
-    assert "row_write_refused=[1]" in proc.stdout
-    assert "NOT WRITTEN" in proc.stdout
-
-
-# --- #98: a lane that has never had a session recorded -----------------------
-
-STEP2 = "register-row \"$lane\" 2>/dev/null | grep '^|'"
-
-
-def _step2(estate: Estate, row: str, *, lane: str = "repoHS-1",
-           ws_missing: str = "", extra: dict | None = None,
-           shell: str = "bash") -> subprocess.CompletedProcess:
-    script = "\n".join([f'L="{estate.helper}"', f"lane={lane}",
-                        f'ws_missing="{ws_missing}"', _block(STEP2),
-                        'printf "uuid_missing=[%s]\\n" "${uuid_missing:-}"'])
-    proc = estate.run(script, row=row, extra=extra, shell=shell)
-    assert proc.returncode == 0, proc.stderr
-    return proc
-
-
-def _swap(estate: Estate, row: str, extra: dict | None = None) -> subprocess.CompletedProcess:
-    """Step 2 and step 4 in ONE shell, as a session runs them, so what step 2
-    decides is what step 4 does."""
-    script = "\n".join([
-        f'L="{estate.helper}"', "lane=repoHS-1", "ws=Eagle", 'why="a usage reset"',
-        'ws_missing=""', _block(STEP2), _block("# (c) the row: ONE WRITE"),
-        'printf "uuid_missing=[%s] row_write_refused=[%s]\\n" '
-        '"${uuid_missing:-}" "$row_write_refused"'])
-    proc = estate.run(script, row=row, extra=extra)
-    assert proc.returncode == 0, proc.stderr
-    return proc
-
-
-@pytest.mark.parametrize("cell", [
-    "none",
-    "harness `unknown`",
-    "harness `session_01AbCdEf` / `session_02GhIjKl`",
-], ids=["no-session", "the-placeholder", "footer-ids-only"])
-def test_a_row_that_records_no_session_uuid_is_flagged_before_any_write(estate, cell):
-    proc = _step2(estate, _row(cell))
-    assert "uuid=<none>" in proc.stdout
-    assert "uuid_missing=[1]" in proc.stdout, proc.stdout
-    assert "NO SESSION" in proc.stdout, "the guard must say so, not only flag it"
-    assert "lane-start --no-launch" in proc.stdout, (
-        "and name the act that supplies a uuid (Amendment 6(c)'s session-cell "
-        "append), which is what R-A11-5 asks the skill to do")
-    assert estate.verbs() == ["register-row"], (
-        f"step 2 only reads; it must write nothing: {estate.calls()}")
-
-
-@pytest.mark.parametrize("cell", [
-    f"harness `{UUID}`",
-    f"harness `{OLDER_UUID}` / `{UUID}`",
-], ids=["one", "the-last-of-two"])
-def test_a_row_that_records_a_session_is_not_flagged_and_says_nothing(estate, cell):
-    proc = _step2(estate, _row(cell))
-    assert f"uuid={UUID}" in proc.stdout
-    assert "uuid_missing=[]" in proc.stdout
-    assert "NO SESSION" not in proc.stdout
-
-
-def test_a_missing_session_stops_the_two_session_keyed_writes_and_keeps_the_row(estate):
-    proc = _step4(estate, uuid="", uuid_missing="1")
-    assert estate.verbs() == ["lane-dir", "set-row-state"], (
-        "with no transcript uuid the writer refuses `log PAUSED` and the "
-        "register line would read `session @Eagle`, so neither is attempted, "
-        f"while the row's state cell, which keys on no session, is: {estate.calls()}")
-    assert not any("session @" in args for _, _, args in estate.calls())
-    (_, _, args) = estate.calls()[1]
-    assert "PAUSED · swap" in args and "transcript none" in args, args
-    assert "row_write_refused=[]" in proc.stdout
-
-
-def test_a_missing_session_and_a_missing_workstation_stop_every_write(estate):
-    proc = _step4(estate, uuid="", ws_missing="1", uuid_missing="1")
-    assert estate.verbs() == ["lane-dir"], estate.calls()
-    assert "row_write_refused=[1]" in proc.stdout
-
-
-def test_the_handoff_is_told_to_name_the_missing_session():
-    section = _section("## 2. Refresh the handoff")
-    prose = re.sub(r"```.*?```", "", section, flags=re.DOTALL)
-    assert "$uuid_missing" in prose, (
-        "step 2's prose must say what to write in the handoff when the lane "
-        "has no session recorded (R-A11-5: *the gap named in the handoff*)")
-    paragraph = " ".join(next(p for p in prose.split("\n\n")
-                              if "$uuid_missing" in p).split())
-    assert "lane-start --no-launch" in paragraph
-    assert "NOT written" in paragraph or "NOT made" in paragraph, (
-        "the paragraph must say that the object-log and register writes were "
-        "not made, so the next session knows the log is behind the handoff")
-    assert "`session unknown`" in paragraph and "`session none`" not in paragraph, (
-        "the top block's first line carries the word `lane-handoff` writes "
-        "(`${uuid:-unknown}`), not another")
-    assert "nor the row's state cell" in paragraph, (
-        "with the workstation also missing the row's cell is NOT set either, "
-        "and the paragraph must not tell the next session it was")
-
-
-# --- #98, review round: the session's own id answers first; a failed read is
-# --- not an answer; the message says only what step 4 will do ----------------
-
-def test_the_sessions_own_id_answers_where_the_row_records_none(estate):
-    """`R-A11-5`: *a swap taken by a running session always has a uuid:
-    `$CLAUDE_CODE_SESSION_ID` is it … the refusal fires on no ordinary path.*"""
-    proc = _swap(estate, _row("none"), extra={"CLAUDE_CODE_SESSION_ID": UUID})
-    assert f"uuid={UUID}" in proc.stdout and "uuid_missing=[]" in proc.stdout, proc.stdout
-    assert "NO SESSION" not in proc.stdout, proc.stdout
-    assert estate.verbs() == ["register-row", "lane-dir", "log", "append-line",
-                              "set-row-state"], estate.calls()
-    calls = {verb: (session, args) for verb, session, args in estate.calls()}
-    assert calls["log"][0] == f"session=[{UUID}]"
-    assert f"session {UUID}@Eagle" in calls["append-line"][1]
-
-
-def test_the_sessions_own_id_beats_the_rows_last_one(estate):
-    _swap(estate, _row(f"harness `{OLDER_UUID}`"),
-          extra={"CLAUDE_CODE_SESSION_ID": UUID})
-    calls = dict((v, s) for v, s, _ in estate.calls())
-    assert calls.get("log") == f"session=[{UUID}]", estate.calls()
-
-
-def test_an_environment_id_that_is_not_a_uuid_is_ignored(estate):
-    proc = _swap(estate, _row(f"harness `{UUID}`"),
-                 extra={"CLAUDE_CODE_SESSION_ID": "not-a-uuid"})
-    assert f"uuid={UUID}" in proc.stdout
-    assert dict((v, s) for v, s, _ in estate.calls())["log"] == f"session=[{UUID}]"
-
-
-def test_neither_id_answering_skips_the_two_writes_and_keeps_the_row(estate):
-    """The rare case that is left: no session of its own (a plain shell) and a
-    row that records none."""
-    proc = _swap(estate, _row("none"))
-    assert "uuid_missing=[1]" in proc.stdout and "NO SESSION RECORDED" in proc.stdout
-    assert estate.verbs() == ["register-row", "lane-dir", "set-row-state"], estate.calls()
-
-
-def test_a_failed_row_read_is_not_a_lane_that_never_had_a_session(estate):
-    """Amendment 7(d): a read that failed is never an answer. With
-    `register-row` exiting 3 and printing nothing there is no row to say it
-    records no session; the `$handoff` stop beneath is what handles it."""
-    estate.log.write_text("")
-    script = "\n".join([f'L="{estate.helper}"', "lane=repoHS-1", 'ws_missing=""',
-                        _block(STEP2),
-                        'printf "uuid_missing=[%s] handoff=[%s]\\n" '
-                        '"${uuid_missing:-}" "$handoff"'])
-    proc = estate.run(script, row="", extra={"STUB_REGISTER_RC": "3"})
-    assert proc.returncode == 0, proc.stderr
-    assert "NO SESSION" not in proc.stdout, proc.stdout
-    assert "uuid_missing=[] handoff=[]" in proc.stdout
-
-
-@pytest.mark.parametrize("ws_missing, says, never", [
-    ("", "while the row's state cell still is", "for want of a workstation"),
-    ("1", "and neither is the row's state cell, for want of a workstation",
-     "still is"),
-], ids=["workstation-present", "workstation-also-missing"])
-def test_the_message_says_only_what_step_4_will_do_to_the_row(estate, ws_missing,
-                                                              says, never):
-    proc = _step2(estate, _row("none"), ws_missing=ws_missing)
-    assert says in proc.stdout and never not in proc.stdout, proc.stdout
-    _step4(estate, uuid="", ws_missing=ws_missing, uuid_missing="1")
-    called_row = "set-row-state" in estate.verbs()
-    assert called_row == (ws_missing == ""), (
-        "the message and step 4 disagree about whether the row's cell is set")
-
-
-def test_the_command_in_the_message_is_filled_in_from_the_lane(estate):
-    proc = _step2(estate, _row("none"), lane="repoHS-17")
-    assert "`lane-start --no-launch repoHS 17`" in proc.stdout, proc.stdout
-    proc = _step2(estate, _row("none"), lane="odd-lane-name")
-    assert "`lane-start --no-launch <repo> <n>`" in proc.stdout, (
-        "a lane name that is not <repo>-<n> must not be split into a guess")
-
-
-@NEEDS_ZSH
-@pytest.mark.parametrize("name, row, extra, lane", [
-    ("no-session", _row("none"), {}, "repoHS-17"),
-    ("no-session-odd-name", _row("none"), {}, "odd-lane-name"),
-    ("own-id", _row("none"), {"CLAUDE_CODE_SESSION_ID": UUID}, "repoHS-1"),
-    ("row-id", _row(f"harness `{OLDER_UUID}` / `{UUID}`"), {}, "repoHS-1"),
-    ("failed-read", "", {"STUB_REGISTER_RC": "3"}, "repoHS-1"),
-])
-def test_step_2_says_the_same_under_zsh_as_under_bash(tmp_path, name, row, extra, lane):
-    """The restart command was filled from `BASH_REMATCH`, which zsh does not
-    set: under it the message named a `lane-start --no-launch` with both
-    fields empty, and the tests, which ran bash only, never saw it."""
-    under_bash = _step2(Estate(tmp_path / "b"), row, lane=lane, extra=extra)
-    under_zsh = _step2(Estate(tmp_path / "z"), row, lane=lane, extra=extra,
-                       shell="zsh")
-    assert under_zsh.stdout == under_bash.stdout, (
-        f"zsh and bash disagree:\n--- bash\n{under_bash.stdout}\n--- zsh\n"
-        f"{under_zsh.stdout}")
-    if name == "no-session":
-        assert "`lane-start --no-launch repoHS 17`" in under_zsh.stdout
-    if name == "no-session-odd-name":
-        assert "`lane-start --no-launch <repo> <n>`" in under_zsh.stdout
diff --git a/tests/test_handoff_skill_commit_block.py b/tests/test_handoff_skill_commit_block.py
deleted file mode 100644
index 43c952a3..00000000
--- a/tests/test_handoff_skill_commit_block.py
+++ /dev/null
@@ -1,483 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`skills/handoff/SKILL.md`'s step-2 handoff commit, held to
-opensoft/openRepoTools#197, in seconds rather than the shell suite's hour.
-
-The block a session runs after publishing its handoff was
-
-    cd ~/projects/brett-wip
-    git add "$handoff"
-    git commit -m "handoff(<lane>@<ws>): PAUSED, <one-line state>" -m "Lane: <lane>"
-    git pull --rebase && git push
-
-and its own paragraph said "Commit with an explicit pathspec" and "On a
-rebase conflict: abort". A bare `git commit` takes the WHOLE index, so in a
-checkout holding another lane's staged entry it published that entry; the
-spelled path is not the checkout a lane window writes (`LANES_REPO` names the
-lane's own clone); and a same-file conflict left the checkout mid-rebase.
-Amendment 4(d) requires *"explicit pathspecs — never `git add -A`, never a bare
-`git commit` … on a rebase conflict the writer ABORTS, leaves the checkout
-clean and reports"*, and Amendment 5(c) bans a bare `git commit` too.
-
-THE BLOCK IS RUN, NOT READ. It is extracted from the skill by the commit
-message it writes, which the shipped block and the fixed one BOTH carry, so
-every behavioural case below runs whichever block the file holds: each RED
-case fails against the shipped block for the reason #197 measured, and passes
-with the fix. Each runs under `bash`, and under `zsh` where one is installed,
-because the Bash tool runs a skill's block under the user's own shell.
-
-NOTHING HERE READS THE CALLER'S ENVIRONMENT. The block READS `LANES_REPO`,
-and a lane window exports it to that lane's REAL clone, so the environment is
-an explicit dict, never `os.environ` plus changes: no `LANES_*`, no `TMUX*`,
-`HOME` under `tmp_path`, no system git config. Every repository is under
-`tmp_path`: a bare origin, the "shared" checkout at
-`$HOME/projects/brett-wip` (which the stub `lanes-edit.sh` names as the
-workspace root), the lane's own clone, and a peer clone that lands other
-lanes' work. `maintenance.auto=false` and `gc.auto=0` keep git from starting
-background work in the fixtures (#599's cleanup flake).
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shlex
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-from typing import Dict, List, Optional
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None or shutil.which("git") is None,
-    reason="the skill's blocks are shell, and they run git")]
-
-SKILL = REPO / "skills/handoff/SKILL.md"
-
-#: THE COMMIT MESSAGE, which the shipped block and the fixed one both write and
-#: no other fenced block of the skill carries: it is how the block is found.
-MARKER = "PAUSED, <one-line state>"
-
-HANDOFF = "handoffs/h1.md"      # this lane's handoff: the row's own cell
-PEER = "handoffs/h2.md"         # another lane's handoff
-REGISTER = "lanes/LANES.md"
-
-H1_V1, H1_V2 = "h1 v1\n", "h1 v2 (this lane PAUSED)\n"
-H2_V1, H2_V2 = "h2 v1\n", "h2 v2 (peer P1)\n"
-ROWS = "| row1 | a |\n| row2 | a |\n| row3 | a |\n| row4 | {} |\n"
-
-GITCONFIG = """[user]
-\tname = sandbox
-\temail = sandbox@example.invalid
-[init]
-\tdefaultBranch = main
-[maintenance]
-\tauto = false
-[gc]
-\tauto = 0
-[advice]
-\tdetachedHead = false
-[commit]
-\tgpgsign = false
-"""
-
-#: The stub helper: `workspace-root` is the only verb the block calls.
-STUB = """#!/bin/sh
-case "$1" in
-  workspace-root) printf '%s\\n' "$HOME/projects/brett-wip" ;;
-  *) exit 2 ;;
-esac
-"""
-
-SHELLS = [
-    pytest.param("bash", id="bash"),
-    pytest.param("zsh", id="zsh", marks=pytest.mark.skipif(
-        shutil.which("zsh") is None, reason="no zsh here")),
-]
-
-
-def _text() -> str:
-    return SKILL.read_text(encoding="utf-8")
-
-
-def _blocks(text: str) -> List[str]:
-    return re.findall(r"^```(?:sh|bash)\n(.*?)\n```$", text,
-                      re.DOTALL | re.MULTILINE)
-
-
-def _block() -> str:
-    found = [b for b in _blocks(_text()) if MARKER in b]
-    assert len(found) == 1, (
-        f"expected exactly one fenced block of {SKILL.name} carrying "
-        f"{MARKER!r}, found {len(found)}: this test is stale")
-    return found[0]
-
-
-def _section(heading: str) -> str:
-    """The prose-and-code of one numbered `## <n>. …` step of the skill."""
-    text = _text()
-    start = text.index(heading)
-    end = re.compile(r"\n## \d+\. ").search(text, start + 1)
-    return text[start:end.start() if end else len(text)]
-
-
-class Sandbox:
-    """A bare origin, the clones a lane meets, and a hermetic environment."""
-
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.home = root / "home"
-        (self.home / "projects").mkdir(parents=True)
-        (self.root / "tmp").mkdir()
-        (self.home / ".gitconfig").write_text(GITCONFIG, encoding="utf-8")
-        self.bin = root / "bin"
-        self.bin.mkdir()
-        self.helper = self.bin / "lanes-edit.sh"
-        self.helper.write_text(STUB, encoding="utf-8")
-        self.helper.chmod(self.helper.stat().st_mode | stat.S_IXUSR)
-        self.origin = root / "origin.git"
-        self.shared = self.home / "projects" / "brett-wip"
-        self.own = self.home / "projects" / "brett-wip-own"
-        self.peer = root / "peer"
-        dirs: List[str] = [str(self.bin)]
-        for tool in ("git", "bash", "zsh"):
-            found = shutil.which(tool)
-            if found and os.path.dirname(found) not in dirs:
-                dirs.append(os.path.dirname(found))
-        for fallback in ("/usr/bin", "/bin"):
-            if fallback not in dirs:
-                dirs.append(fallback)
-        self.env: Dict[str, str] = {
-            "HOME": str(self.home), "PATH": os.pathsep.join(dirs),
-            "TMPDIR": str(self.root / "tmp"), "LC_ALL": "C", "TZ": "UTC",
-            "GIT_CONFIG_NOSYSTEM": "1", "GIT_TERMINAL_PROMPT": "0",
-            "GIT_EDITOR": "true",
-        }
-        self._seed()
-
-    # --- git, always in the sandbox's own environment ---------------------
-
-    def git(self, *args: str, cwd: Optional[Path] = None,
-            check: bool = True) -> subprocess.CompletedProcess:
-        proc = subprocess.run(["git", *args], cwd=str(cwd or self.root),
-                              env=self.env, capture_output=True, text=True,
-                              stdin=subprocess.DEVNULL, check=False,
-                              timeout=120)
-        if check and proc.returncode != 0:
-            raise AssertionError(f"git {' '.join(args)} in {cwd} failed:\n"
-                                 f"{proc.stderr}{proc.stdout}")
-        return proc
-
-    def out(self, *args: str, cwd: Optional[Path] = None) -> str:
-        return self.git(*args, cwd=cwd).stdout.strip()
-
-    def _seed(self) -> None:
-        self.git("init", "-q", "--bare", str(self.origin))
-        seed = self.root / "seed"
-        self.git("init", "-q", str(seed))
-        (seed / "handoffs").mkdir()
-        (seed / "lanes").mkdir()
-        (seed / HANDOFF).write_text(H1_V1, encoding="utf-8")
-        (seed / PEER).write_text(H2_V1, encoding="utf-8")
-        (seed / REGISTER).write_text(ROWS.format("a"), encoding="utf-8")
-        self.git("add", "--", HANDOFF, PEER, REGISTER, cwd=seed)
-        self.git("commit", "-q", "-m", "seed", "--", HANDOFF, PEER, REGISTER,
-                 cwd=seed)
-        self.git("remote", "add", "origin", str(self.origin), cwd=seed)
-        self.git("push", "-q", "origin", "main", cwd=seed)
-
-    def clone(self, dest: Path) -> Path:
-        self.git("clone", "-q", str(self.origin), str(dest))
-        return dest
-
-    def land(self, path: str, content: str, message: str) -> None:
-        """Another lane lands `path` on origin, from its own clone."""
-        if not self.peer.exists():
-            self.clone(self.peer)
-        self.git("pull", "-q", "--rebase", "origin", "main", cwd=self.peer)
-        (self.peer / path).write_text(content, encoding="utf-8")
-        self.git("commit", "-q", "-m", message, "--", path, cwd=self.peer)
-        self.git("push", "-q", "origin", "main", cwd=self.peer)
-
-    def regime2(self, checkout: Path) -> None:
-        """The shared checkout's state from 2026-10-11T20:07Z (#197): a peer's
-        v2 of `h2` lands, then `main` moves to it WITHOUT the index (a linked
-        worktree's `checkout -B`), so the index still holds `h2` v1 — a
-        STAGED reversal of the peer's work."""
-        self.land(PEER, H2_V2, "P1: peer handoff v2")
-        self.git("fetch", "-q", "origin", cwd=checkout)
-        self.git("update-ref", "refs/heads/main", "origin/main", cwd=checkout)
-
-    # --- reads -------------------------------------------------------------
-
-    def head(self, checkout: Path) -> str:
-        return self.out("rev-parse", "HEAD", cwd=checkout)
-
-    def origin_head(self) -> str:
-        return self.out("--git-dir", str(self.origin), "rev-parse", "main")
-
-    def origin_file(self, path: str) -> str:
-        return self.git("--git-dir", str(self.origin), "show",
-                        f"main:{path}").stdout
-
-    def staged(self, checkout: Path) -> List[str]:
-        return self.out("diff", "--cached", "--name-only",
-                        cwd=checkout).splitlines()
-
-    def counts(self, checkout: Path) -> tuple:
-        """(ahead, behind) against origin's main, after a fetch."""
-        self.git("fetch", "-q", "origin", cwd=checkout)
-        row = self.out("rev-list", "--left-right", "--count",
-                       "HEAD...origin/main", cwd=checkout).split()
-        return int(row[0]), int(row[1])
-
-    def in_progress(self, checkout: Path) -> List[str]:
-        gitdir = Path(self.out("rev-parse", "--absolute-git-dir", cwd=checkout))
-        return [op for op in ("rebase-merge", "rebase-apply", "MERGE_HEAD",
-                              "CHERRY_PICK_HEAD", "REVERT_HEAD")
-                if (gitdir / op).exists()]
-
-    # --- the block ----------------------------------------------------------
-
-    def run(self, shell: str, lanes_repo: Optional[Path] = None,
-            block: Optional[str] = None) -> subprocess.CompletedProcess:
-        script = "\n".join([f"L={shlex.quote(str(self.helper))}",
-                            f"handoff={shlex.quote(HANDOFF)}",
-                            block if block is not None else _block()])
-        env = dict(self.env)
-        if lanes_repo is not None:
-            env["LANES_REPO"] = str(lanes_repo)
-        argv = [shutil.which(shell) or shell]
-        if shell == "zsh":
-            argv.append("-f")
-        return subprocess.run([*argv, "-c", script], cwd=str(self.home),
-                              env=env, capture_output=True, text=True,
-                              stdin=subprocess.DEVNULL, check=False,
-                              timeout=120)
-
-
-@pytest.fixture
-def sb(tmp_path: Path) -> Sandbox:
-    return Sandbox(tmp_path)
-
-
-def _said(proc: subprocess.CompletedProcess) -> str:
-    return f"--- stdout\n{proc.stdout}--- stderr\n{proc.stderr}"
-
-
-# --- RED 1: a foreign staged entry is never committed -----------------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_foreign_staged_entry_is_refused_and_nothing_is_published(sb, shell):
-    shared = sb.clone(sb.shared)
-    sb.regime2(shared)
-    sb.land(REGISTER, ROWS.format("P2"), "P2: peer row4")   # another FILE moves
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    assert sb.staged(shared) == [PEER], "the precondition: a staged reversal"
-    head, origin = sb.head(shared), sb.origin_head()
-
-    proc = sb.run(shell)
-
-    assert sb.origin_file(PEER) == H2_V2, (
-        "origin's copy of the PEER's handoff was reverted: the commit took a "
-        f"staged entry this handoff did not make, and pushed it\n{_said(proc)}")
-    assert sb.origin_head() == origin, f"origin moved\n{_said(proc)}"
-    assert sb.head(shared) == head, f"a commit was made\n{_said(proc)}"
-    assert "HANDOFF NOT COMMITTED" in proc.stdout, _said(proc)
-    assert f"staged: {PEER}" in proc.stdout, (
-        f"the refusal must name the staged path\n{_said(proc)}")
-    assert sb.staged(shared) == [PEER], "the peer's entry is left as found"
-    assert (shared / HANDOFF).read_text(encoding="utf-8") == H1_V2, (
-        "the handoff file stays written")
-
-
-# --- RED 2 and 3: the checkout is RESOLVED, `LANES_REPO` first --------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_lanes_repo_is_where_the_handoff_is_committed_and_the_shared_one_is_untouched(
-        sb, shell):
-    shared, own = sb.clone(sb.shared), sb.clone(sb.own)
-    sb.regime2(shared)
-    sb.git("pull", "-q", "--rebase", "origin", "main", cwd=own)
-    (own / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    shared_head = sb.head(shared)
-
-    proc = sb.run(shell, lanes_repo=own)
-
-    assert sb.origin_file(PEER) == H2_V2, (
-        "origin's copy of the peer's handoff was reverted from the SHARED "
-        f"checkout, which this lane did not write\n{_said(proc)}")
-    assert sb.origin_file(HANDOFF) == H1_V2, (
-        f"the lane's handoff never reached origin\n{_said(proc)}")
-    assert f"handoff pushed from {own}" in proc.stdout, _said(proc)
-    assert sb.git("status", "--porcelain", cwd=own).stdout == "", (
-        "the lane's own clone is left with its handoff uncommitted")
-    assert sb.counts(own) == (0, 0)
-    assert sb.head(shared) == shared_head, "the shared checkout was committed in"
-    assert sb.staged(shared) == [PEER], "the shared checkout's index was touched"
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_lanes_repo_is_used_when_the_shared_checkout_is_clean(sb, shell):
-    shared, own = sb.clone(sb.shared), sb.clone(sb.own)
-    sb.land(PEER, H2_V2, "P1: peer handoff v2")
-    for checkout in (shared, own):
-        sb.git("pull", "-q", "--rebase", "origin", "main", cwd=checkout)
-    (own / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    shared_head = sb.head(shared)
-
-    proc = sb.run(shell, lanes_repo=own)
-
-    assert sb.origin_file(HANDOFF) == H1_V2, (
-        "the block exited without committing the handoff the lane wrote in "
-        f"its own clone\n{_said(proc)}")
-    assert sb.counts(own) == (0, 0), _said(proc)
-    assert sb.head(shared) == shared_head
-
-
-# --- RED 4: a same-file conflict is aborted, never left mid-rebase ----------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_conflict_is_aborted_and_the_commit_stays_local(sb, shell):
-    shared = sb.clone(sb.shared)
-    sb.land(HANDOFF, "h1 v2 (someone else)\n", "P3: conflicting h1")
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    origin = sb.origin_head()
-
-    proc = sb.run(shell)
-
-    assert sb.in_progress(shared) == [], (
-        f"the checkout was left mid-operation\n{_said(proc)}")
-    assert "HANDOFF NOT PUSHED" in proc.stdout, _said(proc)
-    assert sb.origin_head() == origin
-    assert sb.counts(shared) == (1, 1), _said(proc)
-    assert sb.out("show", "--name-only", "--format=", "HEAD",
-                  cwd=shared).splitlines() == [HANDOFF]
-    assert sb.git("status", "--porcelain", cwd=shared).stdout == ""
-
-
-# --- RED 5: an operation in progress is a refusal ---------------------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-@pytest.mark.parametrize("operation", ["rebase", "merge"])
-def test_an_operation_in_progress_is_refused_before_any_commit(sb, shell, operation):
-    shared = sb.clone(sb.shared)
-    (shared / HANDOFF).write_text("h1 local\n", encoding="utf-8")
-    sb.git("commit", "-q", "-m", "local h1", "--", HANDOFF, cwd=shared)
-    sb.land(HANDOFF, "h1 peer\n", "P3: conflicting h1")
-    if operation == "rebase":
-        sb.git("pull", "-q", "--rebase", "origin", "main", cwd=shared, check=False)
-    else:
-        sb.git("fetch", "-q", "origin", cwd=shared)
-        sb.git("merge", "-q", "--no-edit", "origin/main", cwd=shared, check=False)
-    before = sb.in_progress(shared)
-    assert before, f"the precondition: a {operation} stopped on its conflict"
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    head, origin = sb.head(shared), sb.origin_head()
-
-    proc = sb.run(shell)
-
-    assert sb.head(shared) == head, (
-        f"a commit was made in the middle of a {operation}\n{_said(proc)}")
-    assert sb.origin_head() == origin, _said(proc)
-    found = re.search(r"has an operation in progress \(([A-Za-z_-]+)\)",
-                      proc.stdout)
-    assert found and found.group(1) in before, (
-        f"the refusal must name the operation ({before})\n{_said(proc)}")
-    assert "HANDOFF NOT COMMITTED" in proc.stdout
-    assert sb.in_progress(shared) == before, "the block finished what it did not start"
-
-
-# --- RED 6: the text --------------------------------------------------------
-
-def test_the_skill_never_spells_the_shared_checkout():
-    spelled = [n + 1 for n, line in enumerate(_text().splitlines())
-               if "~/projects/brett-wip" in line]
-    assert not spelled, (
-        "the handoff's checkout is resolved (`$LANES_REPO`, then the helper's "
-        f"`workspace-root`), never spelled; these lines spell it: {spelled}")
-
-
-#: A git INVOCATION of `add` or `commit`, with or without `-C <dir>` — and not
-#: a message that only says the words ("git refused the add or the commit").
-_GIT_VERB = r'\bgit(?:\s+-C\s+"[^"]*")?\s+{}\b'
-
-
-def test_the_add_and_the_commit_name_the_handoff_by_its_own_path():
-    lines = _block().splitlines()
-    commits = [line for line in lines if re.search(_GIT_VERB.format("commit"), line)]
-    adds = [line for line in lines if re.search(_GIT_VERB.format("add"), line)]
-    assert commits and adds, "the block no longer adds and commits"
-    for line in commits + adds:
-        assert '-- "$handoff"' in line, (
-            "every `git add` and `git commit` in the block carries the handoff's "
-            f"own pathspec (Amendment 4(d): never a bare `git commit`): {line.strip()}")
-
-
-def test_the_publication_target_is_named_as_the_committed_file():
-    """`publish-handoff` writes `$handoff_file`, which no block defines; the
-    prose must say it is the file the commit block resolves."""
-    prose = re.sub(r"```.*?```", "", _section("## 2. Refresh the handoff"),
-                   flags=re.DOTALL)
-    assert "$handoff_file" in prose, (
-        "step 2's prose never says which checkout `$handoff_file` is in, so the "
-        "file published and the file committed can differ")
-    assert "$LANES_REPO/$handoff" in prose
-
-
-def test_the_block_parses_under_bash(tmp_path):
-    """A keeper: the shipped block parsed too."""
-    script = tmp_path / "block.sh"
-    script.write_text(_block() + "\n", encoding="utf-8")
-    proc = subprocess.run([shutil.which("bash") or "bash", "-n", str(script)],
-                          capture_output=True, text=True, check=False)
-    assert proc.returncode == 0, proc.stderr
-
-
-# --- where the handoff is nowhere the block looks ---------------------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_handoff_under_neither_root_is_refused(sb, shell):
-    """`$LANES_REPO` names no checkout and the workspace root has none: the
-    block says so rather than running git wherever the shell stands."""
-    origin = sb.origin_head()
-    proc = sb.run(shell, lanes_repo=sb.root / "nowhere")
-    assert "HANDOFF NOT COMMITTED" in proc.stdout, _said(proc)
-    assert "under neither" in proc.stdout, _said(proc)
-    assert sb.origin_head() == origin
-
-
-# --- keepers: what the shipped block already did, still done ----------------
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_clean_current_checkout_is_committed_and_pushed(sb, shell):
-    shared = sb.clone(sb.shared)
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    proc = sb.run(shell)
-    assert sb.origin_file(HANDOFF) == H1_V2, _said(proc)
-    assert sb.counts(shared) == (0, 0)
-    assert sb.out("log", "-1", "--format=%B", "origin/main",
-                  cwd=shared).splitlines()[-1] == "Lane: <lane>"
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_the_handoff_already_staged_by_an_earlier_attempt_is_its_own(sb, shell):
-    shared = sb.clone(sb.shared)
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    sb.git("add", "--", HANDOFF, cwd=shared)
-    proc = sb.run(shell)
-    assert sb.origin_file(HANDOFF) == H1_V2, _said(proc)
-    assert sb.counts(shared) == (0, 0)
-
-
-@pytest.mark.parametrize("shell", SHELLS)
-def test_a_lanes_repo_without_the_handoff_falls_back_to_the_workspace_root(sb, shell):
-    shared = sb.clone(sb.shared)
-    (sb.root / "elsewhere").mkdir()
-    (shared / HANDOFF).write_text(H1_V2, encoding="utf-8")
-    proc = sb.run(shell, lanes_repo=sb.root / "elsewhere")
-    assert sb.origin_file(HANDOFF) == H1_V2, _said(proc)
-    assert sb.counts(shared) == (0, 0)
diff --git a/tests/test_install_by_rename.py b/tests/test_install_by_rename.py
deleted file mode 100644
index af2a4842..00000000
--- a/tests/test_install_by_rename.py
+++ /dev/null
@@ -1,179 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""THE WRITE `--install` PLACES EVERY FILE WITH, ON EVERY PLATFORM CI HAS (#167).
-
-`openRepoTools --install` writes each file it places to a temporary beside the
-target and renames it over the target, so a lane tool that is RUNNING from that
-path when an install replaces it finishes on the text it started with. The
-installer's own tests (`tests/test_openrepotools_command.py`) prove that end to
-end, but they carry `WINDOWS_SKIP` — the whole installer needs `jq`, `make` and
-shebang execution, and on Windows the way in is WSL2 — so they say nothing
-about Git Bash. Git Bash is exactly where the rename's semantics differ most:
-renaming over a file another process has open is the one step of this write
-that Windows can refuse.
-
-So this module runs the installer's OWN `place_by_rename` — its text, cut out
-of the script, never a copy written here — under each platform's bash: `bash`
-on PATH on Linux and macOS, and on Windows the Git Bash that ships with the
-`git` running this suite (skipped where there is none). The function needs
-only `die`, `$PLACING`, the `owner_of` beside it and coreutils, which is why
-the two can be run on their own.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import subprocess
-
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO
-
-COMMAND = REPO / "openRepoTools"
-
-
-def platform_bash() -> str | None:
-    """`bash` on PATH where the OS is POSIX, and GIT BASH on Windows.
-
-    On Windows `shutil.which("bash")` can answer WSL's launcher in System32,
-    which is not the shell this is about, so Git Bash is found through the
-    `git` that runs this suite: `<git>/bin/bash.exe`, reached from either
-    `git --exec-path` (`<git>/mingw64/libexec/git-core`) or `git.exe` itself
-    (`<git>/cmd/git.exe`).
-    """
-    if os.name != "nt":
-        return shutil.which("bash")
-    git = shutil.which("git")
-    if git is None:
-        return None
-    roots = [Path(git).resolve().parents[1]]
-    exec_path = subprocess.run([git, "--exec-path"], capture_output=True,
-                               text=True, check=False).stdout.strip()
-    if exec_path:
-        roots.insert(0, Path(exec_path).parents[2])
-    for root in roots:
-        candidate = root / "bin" / "bash.exe"
-        if candidate.is_file():
-            return str(candidate)
-    return None
-
-
-BASH = platform_bash()
-
-pytestmark = pytest.mark.skipif(
-    BASH is None, reason="no bash here (on Windows: no Git Bash beside git)")
-
-#: The same running text as the installer's end-to-end test: it announces
-#: itself, then waits — `sleep` forks, which is what makes bash seek back and
-#: read on from its file — until `$GO` exists, and finishes. Bounded.
-OLD_RUNNING = ("#!/usr/bin/env bash\n"
-               "printf 'old: started\\n'\n"
-               'i=0; until [ -e "$GO" ] || [ "$i" -ge 1200 ]; do '
-               'sleep 0.05; i=$((i + 1)); done\n')
-OLD_TAIL = "printf 'old: finished\\n'\nexit 0\n"
-
-
-def posix(path: Path) -> str:
-    """A path every bash here reads: Git Bash takes `C:/…` with forward
-    slashes, and a backslash would be an escape to it."""
-    return path.as_posix()
-
-
-def installer_function(name: str) -> str:
-    """One function as the installer carries it, cut out of the script."""
-    text = COMMAND.read_text(encoding="utf-8")
-    match = re.search(rf"^{re.escape(name)}\(\) \{{[^\n]*\n.*?^\}}\n", text,
-                      re.MULTILINE | re.DOTALL)
-    assert match, f"`{name}() {{` … `}}` is no longer in openRepoTools"
-    return match.group(0)
-
-
-def place(tmp_path: Path, source: Path, target: Path,
-          mode: str = "755") -> subprocess.CompletedProcess:
-    """One placement, through the installer's function, under this bash."""
-    harness = tmp_path / "harness.sh"
-    harness.write_bytes((
-        "set -euo pipefail\n"
-        'PLACING=""\n'
-        "die() { printf 'REFUSED: %s\\n' \"$1\" >&2; exit 2; }\n"
-        + installer_function("owner_of")
-        + installer_function("place_by_rename")
-        + 'place_by_rename "$1" "$2" "$3" "nothing else was placed."\n'
-    ).encode("utf-8"))
-    return subprocess.run([BASH, posix(harness), posix(source), posix(target),
-                           mode], capture_output=True, text=True, check=False)
-
-
-def temporaries(directory: Path) -> list[str]:
-    return sorted(p.name for p in directory.iterdir()
-                  if ".openrepotools." in p.name)
-
-
-def test_a_running_script_finishes_on_its_own_text_when_it_is_placed_over(
-        tmp_path):
-    """THE DEFECT #167 IS ABOUT, ON THIS PLATFORM'S BASH.
-
-    A script is running from the target when the placement replaces it. The
-    running process must finish on its own text, and the path must hold the
-    new bytes afterwards. On Windows this is the question whether Git Bash's
-    `mv -f` may replace a file a running bash has open; a rewrite in place
-    would make the process read the new text from its old offset instead.
-    """
-    bin_dir = tmp_path / "bin"
-    bin_dir.mkdir()
-    target = bin_dir / "lanes-edit.sh"
-    target.write_bytes((OLD_RUNNING + OLD_TAIL).encode("utf-8"))
-    # A line of the NEW text starts at exactly the byte the old one resumes
-    # reading at, so a rewrite in place reads it, says so, and exits 7.
-    head = "#!/usr/bin/env bash\n# "
-    new = (head + "x" * (len(OLD_RUNNING) - len(head) - 1) + "\n"
-           + "printf 'new: read from the old offset\\n'; exit 7\n"
-           ).encode("utf-8")
-    source = tmp_path / "staged"
-    source.write_bytes(new)
-
-    go = tmp_path / "go"
-    running = subprocess.Popen([BASH, posix(target)], stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE, text=True,
-                               env={**os.environ, "GO": posix(go)})
-    try:
-        assert running.stdout.readline() == "old: started\n"
-        placed = place(tmp_path, source, target)
-        assert placed.returncode == 0, placed.stdout + placed.stderr
-        go.touch()
-        out, err = running.communicate(timeout=120)
-    finally:
-        if running.poll() is None:
-            running.kill()
-            running.communicate()
-    assert (out, err, running.returncode) == ("old: finished\n", "", 0), (
-        f"the running copy did not finish on its own text:\nstdout {out!r}\n"
-        f"stderr {err!r}\nexit {running.returncode}")
-    assert target.read_bytes() == new
-    if os.name != "nt":
-        assert target.stat().st_mode & 0o777 == 0o755
-    assert temporaries(bin_dir) == []
-
-
-def test_a_directory_at_the_target_is_refused_and_leaves_no_temporary(
-        tmp_path):
-    """`mv` MOVES A FILE INTO A DIRECTORY NAMED AS ITS DESTINATION rather than
-    failing, so the function refuses one itself — the planners catch it a
-    phase earlier, and this is the step that must not depend on that. The
-    directory keeps exactly what it had, and the temporary is removed."""
-    bin_dir = tmp_path / "bin"
-    target = bin_dir / "park"
-    target.mkdir(parents=True)
-    (target / "kept").write_bytes(b"kept\n")
-    source = tmp_path / "staged"
-    source.write_bytes(b"#!/usr/bin/env bash\n")
-
-    placed = place(tmp_path, source, target)
-    assert placed.returncode == 2, placed.stdout + placed.stderr
-    assert "REFUSED:" in placed.stderr and "is a directory" in placed.stderr, (
-        placed.stderr)
-    assert sorted(p.name for p in target.iterdir()) == ["kept"]
-    assert temporaries(bin_dir) == []
diff --git a/tests/test_install_hook_gate.py b/tests/test_install_hook_gate.py
deleted file mode 100644
index f9470590..00000000
--- a/tests/test_install_hook_gate.py
+++ /dev/null
@@ -1,663 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The gate on `--install`'s hook pair (opensoft/openRepoTools#237).
-
-THE DEFECT. `--install` merged the `SessionStart` entry and Amendment 12's
-`UserPromptSubmit` name guard into `~/.claude/settings.json` before anything had
-placed the path both of them call, `~/projects/xFactory/lanes-edit.sh` — a
-symlink `link-estates` makes, and that only `openRepoTools wip init` runs on a
-fresh workstation, AFTER the install (opensoft/workBenches#107, whose `setup.sh`
-orders the two that way on purpose). The `SessionStart` entry ends in `|| true`
-and swallowed it; the guard has no such suffix by design, so a bare `claude`
-got a command-not-found hook error at every prompt: exit 127, where the guard's
-whole mechanism is exit 2.
-
-THE RULE NOW IS THE LAUNCHER'S OWN (the lead's ruling 1, approach (A)). The pair
-is merged only once that path exists, is executable and answers `guard`, by the
-probe opensoft/workBenches' `claude-profile` puts to the same path before it
-ensures the same two strings in each profile. Until then the pair is DEFERRED
-and every run says so, with the remedy; where a file already carries OUR guard
-entry and the path does not answer, that entry alone is taken out — the
-launcher's downgrade (workBenches#90), filtered on the nested array
-(workBenches#89) — and the `SessionStart` entry, which cannot fail a session, is
-left. `wip init` completes the pair after `link-estates`, and on its "nothing
-to do" path too.
-
-THE CONTRACT CHANGE IS THE COUNT: twenty-nine artifacts always, plus the two
-hook entries once the target answers. The strings, their exact-match identity,
-the rival refusal, the receipt and the guard's real exit 2 do not move, and
-the cases below hold each of them.
-
-NO NETWORK, NO REAL HOME: every run is from the checkout into a sandbox `HOME`
-under `tmp_path`, with every `LANES_*`, `TMUX*` and `CLAUDE_*` variable of the
-shell running the suite taken out, and `wip init` meets the bare-repository
-`gh` of `tests/test_wip_init_command.py`.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-from test_install_skill_and_hook import (GUARD_COMMAND, GUARD_TIMEOUT,
-                                         HOOK_COMMAND, HOOK_MATCHER,
-                                         HOOK_TIMEOUT, hook_commands,
-                                         session_start_commands, settings_of,
-                                         user_prompt_commands)
-from test_openrepotools_command import (ALWAYS, ARTIFACTS, COMMAND,
-                                        HOOK_ENTRIES, NEEDS_JQ, command_env,
-                                        link_xfactory, placed_files,
-                                        receipt_rows)
-from test_wip_init_command import NEEDS_TEMPLATE, fake_gh, wip_env
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP, NEEDS_JQ]
-
-#: The words every deferral and every removal ends with: the remedy, both ways.
-REMEDY = ("`openRepoTools wip init` runs", "`link-estates`",
-          "`openRepoTools --install` again")
-
-
-def scrubbed(environ: dict) -> dict:
-    """`environ` with nothing of the shell running the suite that a lane tool
-    reads: no `LANES_*` (the real register), no `TMUX*` (the real window), no
-    `CLAUDE_*` (`CLAUDE_NO_LANE` exempts the guard; `CLAUDE_USER_DIR` would move
-    `~/.claude` out of the sandbox), no `WORKBENCHES_*`, no `PROJECTS_ROOT`,
-    and no data directory but the sandbox's own."""
-    for name in list(environ):
-        if name.startswith(("LANES_", "TMUX", "CLAUDE_", "WORKBENCHES_")) or \
-                name in ("PROJECTS_ROOT", "XDG_DATA_HOME", "OPENREPOTOOLS_DATA_DIR"):
-            environ.pop(name)
-    return environ
-
-
-def install(home: Path, env: dict | None = None) -> subprocess.CompletedProcess:
-    """`openRepoTools --install` from the checkout, into `home`."""
-    environ = scrubbed(command_env(home))
-    environ["CLAUDE_PROFILES_HOME"] = str(home / ".claude-profiles")
-    environ["CLAUDE_USER_DIR"] = str(home / ".claude")
-    environ.update(env or {})
-    return subprocess.run(["bash", str(COMMAND), "--install"],
-                          capture_output=True, text=True, check=False,
-                          input="", cwd=str(REPO), env=environ)
-
-
-def wip_world(tmp_path: Path) -> tuple[Path, dict]:
-    """A sandbox `HOME` and the environment both halves of a fresh workstation
-    run in — `--install` and then `wip init`, workBenches' own order — with ONE
-    bin directory, so the `link-estates` that `wip init` runs is the one this
-    `--install` placed, and the `lanes-edit.sh` it links is that one too."""
-    home = tmp_path / "home"
-    (home / "projects").mkdir(parents=True)
-    return home, scrubbed(wip_env(home, fake_gh(tmp_path)))
-
-
-def run_with(env: dict, *args: str) -> subprocess.CompletedProcess:
-    return subprocess.run(["bash", str(COMMAND), *args], capture_output=True,
-                          text=True, check=False, input="", cwd=str(REPO),
-                          env=env)
-
-
-def naming_the_target(home: Path) -> list[str]:
-    """Every hook command in `home`'s settings that calls the gated path."""
-    if not settings_of(home).exists():
-        return []
-    return [c for event in ("SessionStart", "UserPromptSubmit")
-            for c in hook_commands(home, event)
-            if "~/projects/xFactory/lanes-edit.sh" in c]
-
-
-def our_pair(home: Path, *, mode: int = 0o644) -> Path:
-    """`home`'s settings carrying both of OUR entries, as a run before #237
-    left them, beside foreign hooks — one of them GROUPED with our guard in a
-    single entry, the hand-edit workBenches#89 is about."""
-    settings = settings_of(home)
-    settings.parent.mkdir(parents=True, exist_ok=True)
-    settings.write_text(json.dumps({
-        "model": "opus",
-        "statusLine": {"type": "command", "command": "~/.claude/statusline.sh"},
-        "hooks": {
-            "SessionStart": [
-                {"matcher": HOOK_MATCHER,
-                 "hooks": [{"type": "command", "command": HOOK_COMMAND,
-                            "timeout": HOOK_TIMEOUT}]},
-                {"matcher": "startup",
-                 "hooks": [{"type": "command", "command": "~/bin/hello.sh"}]}],
-            "UserPromptSubmit": [
-                {"hooks": [{"type": "command", "command": GUARD_COMMAND,
-                            "timeout": GUARD_TIMEOUT}]},
-                {"hooks": [{"type": "command",
-                            "command": "~/projects/xFactory/guard.sh",
-                            "timeout": 5}]},
-                {"note": "operator grouped these",
-                 "hooks": [{"type": "command", "command": GUARD_COMMAND},
-                           {"type": "command", "command": "~/bin/audit.sh"}]},
-                {"hooks": []}],
-            "PreToolUse": [{"matcher": "Bash",
-                            "hooks": [{"type": "command", "command": "audit"}]}],
-        },
-    }, indent=2), encoding="utf-8")
-    os.chmod(settings, mode)
-    return settings
-
-
-# --- a fresh workstation, before `wip init` -----------------------------------
-
-def test_fresh_install_defers_the_hook_pair_and_says_so(tmp_path):
-    """THE DEFECT'S OWN CASE: no workspace, no link. The pair is deferred —
-    neither entry is written, so no settings file is made for nothing — and
-    each entry's line says so, why, and what completes it."""
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    settings = settings_of(tmp_path)
-    target = tmp_path / "projects" / "xFactory" / "lanes-edit.sh"
-    assert not settings.exists(), "a deferred pair has nothing to write"
-    assert f"SessionStart hook: deferred, not added to {settings}, because " \
-           f"{target} is not there" in result.stdout, result.stdout
-    assert f"UserPromptSubmit guard: deferred, not added to {settings}, because " \
-           f"{target} is not there" in result.stdout, result.stdout
-    for words in REMEDY:
-        assert words in result.stdout, f"the remedy lost {words!r}:\n{result.stdout}"
-    assert "~/projects/xFactory has to exist first" in result.stdout, (
-        "with no ~/projects/xFactory the remedy alone loops (the #237 review, N6)")
-    assert "REMOVED" not in result.stdout, "there was nothing of ours to remove"
-
-
-def test_deferred_install_places_29_and_writes_29_receipt_rows(tmp_path):
-    """TWENTY-NINE ARTIFACTS ALWAYS: the seventeen files, the six skill copies
-    and the six command files are placed whether or not the pair can be, and
-    the receipt — which never had hook rows — says the same twenty-nine. A
-    second run reports exactly those twenty-nine `unchanged`, and no line of
-    the deferred pair claims to be one of them."""
-    assert ALWAYS == ARTIFACTS - HOOK_ENTRIES == 29
-    first = install(tmp_path)
-    assert first.returncode == 0, first.stdout + first.stderr
-    for dest in placed_files(tmp_path):
-        assert Path(dest).is_file(), f"{dest} was not placed:\n{first.stdout}"
-    assert len(placed_files(tmp_path)) == ALWAYS
-    assert len(receipt_rows(tmp_path)) == ALWAYS
-    second = install(tmp_path)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert second.stdout.count("unchanged") == ALWAYS, second.stdout
-    assert "deferred, not added" in second.stdout
-
-
-@pytest.mark.parametrize("state", ["nothing", "the estate directory",
-                                   "settings of the person's own"])
-def test_interrupted_setup_leaves_no_hook_naming_a_missing_path(tmp_path, state):
-    """SETUP CUT OFF BETWEEN THE INSTALL AND `wip init`, in the three states it
-    leaves: no `~/projects/xFactory` at all; the directory there and no link in
-    it (`link-estates` never ran); and a settings file of the person's own.
-    In none of them is there a hook that calls the missing path — so there is
-    no prompt hook to fail, and the person's own hooks are exactly as they
-    were — and so is that file's MODE: a deferred run with nothing of ours to
-    add or take out writes nothing, so the 644 it found is the 644 it leaves
-    (the #237 review, M1)."""
-    own = {"hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": "~/projects/xFactory/guard.sh"}]}]}}
-    if state == "the estate directory":
-        (tmp_path / "projects" / "xFactory").mkdir(parents=True)
-    if state == "settings of the person's own":
-        settings_of(tmp_path).parent.mkdir(parents=True)
-        settings_of(tmp_path).write_text(json.dumps(own), encoding="utf-8")
-        os.chmod(settings_of(tmp_path), 0o644)
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert naming_the_target(tmp_path) == [], (
-        "a hook calls a path that does not exist:\n" + result.stdout)
-    if state == "settings of the person's own":
-        assert json.loads(settings_of(tmp_path).read_text(encoding="utf-8")) == own
-        assert stat.S_IMODE(settings_of(tmp_path).stat().st_mode) == 0o644, (
-            "a run that wrote nothing into the file changed its mode")
-    assert not (tmp_path / "projects" / "xFactory" / "lanes-edit.sh").exists()
-
-
-# --- an existing install whose target stopped answering (the migration) -------
-
-def test_dangling_link_strips_only_our_guard_entry_keeps_session_start_foreign_hooks_and_600(
-        tmp_path):
-    """THE WORKSTATION THAT ALREADY HAS THE PAIR, AND A LINK THAT DANGLES — a
-    bench recreate that emptied the far end, or a link into a tree that went.
-
-    Our exact guard entry is taken out, because left there it fails every
-    prompt. NOTHING ELSE MOVES: the `SessionStart` entry (its `|| true` keeps
-    it inert), the person's own `UserPromptSubmit` hooks, the foreign command
-    GROUPED with ours in one entry — kept with that entry's own `note` — an
-    entry with an empty `hooks`, and every key outside `hooks`. The file comes
-    back at 600 from the 644 it had. A second run removes nothing more and
-    writes nothing.
-    """
-    far = tmp_path / "gone" / "lanes-edit.sh"
-    link_xfactory(tmp_path, far)
-    settings = our_pair(tmp_path)
-    before = json.loads(settings.read_text(encoding="utf-8"))
-
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    after = json.loads(settings.read_text(encoding="utf-8"))
-    target = tmp_path / "projects" / "xFactory" / "lanes-edit.sh"
-    assert f"UserPromptSubmit guard: REMOVED from {settings}, because {target} " \
-           f"is a symlink to {far}, which does not resolve" in result.stdout, result.stdout
-    assert f"SessionStart hook: left in {settings} as an earlier run placed it" \
-        in result.stdout, result.stdout
-    for words in REMEDY:
-        assert words in result.stdout, words
-
-    assert after["hooks"]["UserPromptSubmit"] == [
-        {"hooks": [{"type": "command", "command": "~/projects/xFactory/guard.sh",
-                    "timeout": 5}]},
-        {"note": "operator grouped these",
-         "hooks": [{"type": "command", "command": "~/bin/audit.sh"}]},
-        {"hooks": []}]
-    assert after["hooks"]["SessionStart"] == before["hooks"]["SessionStart"]
-    for key in ("model", "statusLine"):
-        assert after[key] == before[key], key
-    assert after["hooks"]["PreToolUse"] == before["hooks"]["PreToolUse"]
-    assert stat.S_IMODE(settings.stat().st_mode) == 0o600
-
-    written = settings.read_bytes()
-    second = install(tmp_path)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert settings.read_bytes() == written, "a second deferred run rewrote the file"
-    assert "REMOVED" not in second.stdout
-    assert f"UserPromptSubmit guard: deferred, not added to {settings}" in second.stdout
-
-
-def test_a_guard_entry_in_a_shape_it_cannot_take_apart_is_refused_not_rewritten(
-        tmp_path):
-    """A `UserPromptSubmit` that is not an array, carrying our command, against
-    a target that does not answer: the entry would fail every prompt, and the
-    file is not one this command understands well enough to rewrite. So it
-    refuses, names the entry, and leaves the file exactly as it was — IN THE
-    PLANNING PHASE, with nothing placed, like every other file this merge
-    cannot handle (the #237 review, M2: it used to refuse after placing 29)."""
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    odd = json.dumps({"hooks": {"UserPromptSubmit": {"ours": {"hooks": [
-        {"type": "command", "command": GUARD_COMMAND, "timeout": 5}]}}}})
-    settings.write_text(odd, encoding="utf-8")
-    result = install(tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "is not the array of entries this command takes apart" in result.stderr
-    assert GUARD_COMMAND in result.stderr, "the refusal names the entry"
-    assert "NOTHING was installed" in result.stderr, result.stderr
-    assert settings.read_text(encoding="utf-8") == odd
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "the refusal came after the commands were placed")
-    assert not (tmp_path / ".claude" / "skills").exists()
-
-
-def test_an_odd_guard_entry_beside_a_link_the_bin_loop_repairs_is_not_refused(tmp_path):
-    """THE ONE TARGET A RUN CAN STILL MAKE ANSWER is let through planning: a
-    `link-estates` link to the bin directory's own `lanes-edit.sh`, dangling
-    until this run's bin loop puts the far end back. After that loop the target
-    answers, so the guard entry — whatever shape it is in — is ours and stays,
-    and the run completes instead of refusing."""
-    link_xfactory(tmp_path)
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    odd = {"hooks": {"UserPromptSubmit": {"ours": {"hooks": [
-        {"type": "command", "command": GUARD_COMMAND, "timeout": 5}]}}}}
-    settings.write_text(json.dumps(odd), encoding="utf-8")
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    after = json.loads(settings.read_text(encoding="utf-8"))
-    assert after["hooks"]["UserPromptSubmit"] == odd["hooks"]["UserPromptSubmit"]
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-
-
-@pytest.mark.parametrize("why", ["no guard verb", "not executable", "not readable"])
-def test_lanes_edit_without_guard_verb_defers(tmp_path, why):
-    """A `lanes-edit.sh` THAT IS THERE AND DOES NOT ANSWER `guard`: one that
-    predates the verb, or one that is not executable. The probe is the
-    launcher's — comment lines dropped, the case arm anchored where a line
-    begins — so neither the word `guard` in a comment nor an arm that merely
-    starts with it (`guards)`) passes for the verb. The pair is deferred, and a
-    guard entry already there is taken out, with the reason named — an
-    executable that cannot be READ by its own name, not as a missing verb."""
-    if why == "not readable" and hasattr(os, "geteuid") and os.geteuid() == 0:
-        pytest.skip("root reads a file whose mode says otherwise")
-    old = tmp_path / "old" / "lanes-edit.sh"
-    old.parent.mkdir()
-    old.write_text(
-        "#!/usr/bin/env bash\n"
-        "# the dispatcher guard), so no READ can return it\n"
-        'case "$1" in\n'
-        "  session-start) exit 0 ;;\n"
-        "  guards) exit 0 ;;\n"
-        '  *) echo "unknown subcommand" >&2; exit 2 ;;\n'
-        "esac\n", encoding="utf-8")
-    if why == "no guard verb":
-        old.chmod(0o755)
-        reason = "has no `guard` subcommand"
-    else:
-        old.write_text(old.read_text(encoding="utf-8") + "# guard)\n  guard) exit 0 ;;\n",
-                       encoding="utf-8")
-        old.chmod(0o644 if why == "not executable" else 0o111)
-        reason = "is " + why
-    link_xfactory(tmp_path, old)
-    settings = our_pair(tmp_path, mode=0o600)
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    target = tmp_path / "projects" / "xFactory" / "lanes-edit.sh"
-    assert f"REMOVED from {settings}, because {target} {reason}" in result.stdout, \
-        result.stdout
-    assert GUARD_COMMAND not in user_prompt_commands(tmp_path)
-    assert session_start_commands(tmp_path)[0] == HOOK_COMMAND
-
-
-def test_a_link_into_an_emptied_bin_directory_answers_once_the_bin_loop_refills_it(
-        tmp_path):
-    """THE GATE IS ASKED AFTER THE BIN LOOP, and this is why. A bench recreate
-    empties `~/.local/bin` and leaves `link-estates`' link dangling over it; the
-    next `--install` puts the far end back in its own bin loop. Asked before
-    that loop, the gate would defer — and strip — the pair on the very run that
-    repaired its target. Asked after it, the pair goes in on that run."""
-    link = link_xfactory(tmp_path)
-    assert not link.exists(), "the fixture's link must dangle before the install"
-    result = install(tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-    assert user_prompt_commands(tmp_path) == [GUARD_COMMAND]
-    assert "deferred" not in result.stdout
-
-
-# --- the rival refusal does not move ------------------------------------------
-
-@pytest.mark.parametrize("event,rival", [
-    ("SessionStart", "~/bin/lane-hook.sh session-start || true"),
-    ("UserPromptSubmit", "~/bin/lane-hook.sh guard"),
-])
-def test_rival_refuses_while_deferred(tmp_path, event, rival):
-    """A SECOND WRITER OF EITHER HOOK REFUSES THE WHOLE INSTALL, deferred or
-    not: the rival read comes before the gate is asked, so a workstation with
-    no link yet is refused for the rival exactly as one with the link is, and
-    nothing at all is placed."""
-    entry = {"hooks": [{"type": "command", "command": rival, "timeout": 5}]}
-    if event == "SessionStart":
-        entry["matcher"] = HOOK_MATCHER
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    before = json.dumps({"hooks": {event: [entry]}})
-    settings.write_text(before, encoding="utf-8")
-    result = install(tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "DIFFERENT command string" in result.stderr
-    assert rival in result.stderr, "the refusal names the rival"
-    assert "NOTHING was installed" in result.stderr
-    assert settings.read_text(encoding="utf-8") == before
-    assert not (tmp_path / ".local" / "bin").exists()
-
-
-@pytest.mark.parametrize("target", ["answers", "does not answer"])
-def test_without_jq_install_still_ends_in_the_jq_refusal(tmp_path, target):
-    """THE `jq` REFUSAL COMES FIRST, WHATEVER THE GATE WOULD SAY. The gate is
-    asked only at placement, after the bin loop; `plan_hook_merge` asks for
-    `jq` before anything is placed, as it always has. So with no `jq` on the
-    PATH, `--install` refuses naming it — exit 2, the message opening the
-    stream, the two entries printed, nothing placed — both on a workstation
-    whose target answers `guard` and on one where the pair would be deferred
-    (006's FR-018, which its no-`jq` test depends on)."""
-    if target == "answers":
-        link_xfactory(tmp_path)
-    stub = tmp_path / "nojq"
-    stub.mkdir()
-    for name in ("bash", "git", "cp", "mkdir", "chmod", "cmp", "printf",
-                 "mktemp", "sed", "cat", "tr", "grep", "head", "dirname",
-                 "rm", "mv", "awk", "readlink"):
-        found = shutil.which(name)
-        if found:
-            (stub / name).symlink_to(found)
-    result = install(tmp_path, env={"PATH": str(stub)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert result.stderr.startswith(
-        "\nREFUSED: `--install` needs `jq` to merge its TWO hook entries"), result.stderr
-    assert HOOK_COMMAND in result.stderr and GUARD_COMMAND in result.stderr
-    assert not (tmp_path / ".local" / "bin").exists(), "a file was placed"
-    assert not settings_of(tmp_path).exists()
-
-
-# --- `wip init` completes the pair ---------------------------------------------
-
-@NEEDS_TEMPLATE
-def test_wip_init_completes_the_pair_after_link_estates(tmp_path):
-    """THE WORKSTATION'S WHOLE FIRST RUN, in workBenches' order: `--install`
-    defers the pair, because nothing has linked its target yet; `wip init`
-    creates the workspace, runs `link-estates` — which links
-    `~/projects/xFactory/lanes-edit.sh` to the installed one — and then merges
-    the pair, one entry each, at mode 600, without anyone touching the
-    settings file by hand."""
-    home, env = wip_world(tmp_path)
-    (home / "projects" / "xFactory").mkdir()
-    first = run_with(env, "--install")
-    assert first.returncode == 0, first.stdout + first.stderr
-    assert "deferred, not added" in first.stdout
-    assert naming_the_target(home) == []
-
-    result = run_with(env, "wip", "init")
-    assert result.returncode == 0, result.stdout + result.stderr
-    link = home / "projects" / "xFactory" / "lanes-edit.sh"
-    assert link.is_symlink() and link.resolve() == (home / "bin" / "lanes-edit.sh").resolve()
-    assert f"LINK  {link}" in result.stdout, result.stdout
-    assert result.stdout.index("link-estates:") < result.stdout.index("hook entries in"), (
-        "the pair is reconciled AFTER link-estates, which places its target")
-    assert session_start_commands(home) == [HOOK_COMMAND]
-    assert user_prompt_commands(home) == [GUARD_COMMAND]
-    assert stat.S_IMODE(settings_of(home).stat().st_mode) == 0o600
-    assert "SessionStart hook: installed in" in result.stdout, result.stdout
-    assert "UserPromptSubmit guard: installed in" in result.stdout
-
-
-@NEEDS_TEMPLATE
-def test_wip_init_nothing_to_do_still_reconciles_the_pair(tmp_path):
-    """STEP 1's "NOTHING TO DO" IS NOT WHERE THE PAIR IS LEFT DEFERRED. A first
-    `wip init` on a workstation with no `~/projects/xFactory` cannot link the
-    target, so the pair stays deferred and says so; once the link is there, the
-    next run — which finds the workspace and does nothing to it — completes the
-    pair, and the one after that writes nothing."""
-    home, env = wip_world(tmp_path)
-    assert run_with(env, "--install").returncode == 0
-    first = run_with(env, "wip", "init")
-    assert first.returncode == 0, first.stdout + first.stderr
-    assert "deferred, not added" in first.stdout, first.stdout
-    assert naming_the_target(home) == []
-
-    link_xfactory(home, home / "bin" / "lanes-edit.sh")
-    second = run_with(env, "wip", "init")
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert "nothing to do" in second.stdout
-    assert session_start_commands(home) == [HOOK_COMMAND]
-    assert user_prompt_commands(home) == [GUARD_COMMAND]
-
-    written = settings_of(home).read_bytes()
-    third = run_with(env, "wip", "init")
-    assert third.returncode == 0, third.stdout + third.stderr
-    assert settings_of(home).read_bytes() == written
-    assert "UserPromptSubmit guard: already installed" in third.stdout
-
-
-@NEEDS_TEMPLATE
-def test_wip_init_rerun_links_and_completes_a_pair_a_cut_run_left_unlinked(tmp_path):
-    """A RUN CUT OFF BEFORE LINKING HEALS ON THE NEXT RUN (the lead's ruling 3).
-    The first `wip init` wrote the workspace and could not link the target —
-    here, because `~/projects/xFactory` was not there yet. The re-run finds the
-    workspace, sees the target does not answer and that the directory it goes
-    into is there now, runs `link-estates` again, and completes the pair."""
-    home, env = wip_world(tmp_path)
-    assert run_with(env, "--install").returncode == 0
-    assert run_with(env, "wip", "init").returncode == 0
-    (home / "projects" / "xFactory").mkdir()
-    rerun = run_with(env, "wip", "init")
-    assert rerun.returncode == 0, rerun.stdout + rerun.stderr
-    assert "nothing to do" in rerun.stdout
-    assert "so link-estates runs again" in rerun.stdout, rerun.stdout
-    assert (home / "projects" / "xFactory" / "lanes-edit.sh").is_symlink()
-    assert user_prompt_commands(home) == [GUARD_COMMAND]
-    assert session_start_commands(home) == [HOOK_COMMAND]
-
-
-@NEEDS_TEMPLATE
-@pytest.mark.parametrize("state", ["the target answers", "no ~/projects/xFactory"])
-def test_wip_init_nothing_to_do_reruns_link_estates_only_where_ruling_9_says(
-        tmp_path, state):
-    """RULING 9's OTHER HALF: step 1 runs `link-estates` again ONLY where the
-    target does not answer AND `~/projects/xFactory` is there for the link. A
-    healthy workstation's re-run does not relink, and neither does one with no
-    `~/projects/xFactory`, where a relink could change nothing."""
-    home, env = wip_world(tmp_path)
-    if state == "the target answers":
-        (home / "projects" / "xFactory").mkdir()
-    assert run_with(env, "--install").returncode == 0
-    assert run_with(env, "wip", "init").returncode == 0
-    rerun = run_with(env, "wip", "init")
-    assert rerun.returncode == 0, rerun.stdout + rerun.stderr
-    assert "nothing to do" in rerun.stdout
-    for marker in ("link-estates runs again", "link-estates:",
-                   "link-estates is not installed"):
-        assert marker not in rerun.stdout, f"{marker!r} on a re-run:\n{rerun.stdout}"
-
-
-@NEEDS_TEMPLATE
-def test_a_hook_reconcile_wip_init_cannot_make_is_a_note_and_the_exit_stays_0(tmp_path):
-    """ONE RULE ON BOTH PATHS (the #237 review, S1). A second writer of the
-    guard, added after `--install`, makes the reconcile refuse — with
-    `--install`'s own refusal, naming the rival. On step 10's path the
-    workspace is made all the same, so the refusal is a note, `Done.` is
-    printed and the exit is 0; on step 1's path, where the reconcile is the
-    only act, the exit is 0 too, and the note says so. The file is left
-    exactly as it was both times."""
-    home, env = wip_world(tmp_path)
-    (home / "projects" / "xFactory").mkdir()
-    assert run_with(env, "--install").returncode == 0
-    rival = "~/bin/other.sh guard"
-    settings = settings_of(home)
-    settings.parent.mkdir(parents=True, exist_ok=True)
-    before = json.dumps({"hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}})
-    settings.write_text(before, encoding="utf-8")
-
-    fresh = run_with(env, "wip", "init")
-    assert fresh.returncode == 0, fresh.stdout + fresh.stderr
-    assert "(not reconciled:" in fresh.stdout, fresh.stdout
-    assert rival in fresh.stderr, "the refusal names the rival"
-    assert "Done." in fresh.stdout, "the workspace step did not finish"
-    assert settings.read_text(encoding="utf-8") == before
-
-    again = run_with(env, "wip", "init")
-    assert again.returncode == 0, again.stdout + again.stderr
-    assert "nothing to do" in again.stdout
-    assert "(not reconciled:" in again.stdout, again.stdout
-    assert rival in again.stderr
-    assert settings.read_text(encoding="utf-8") == before
-
-
-@NEEDS_TEMPLATE
-@pytest.mark.parametrize("where", ["a fresh workstation", "one with a workspace"])
-def test_wip_init_dry_run_names_the_hook_merge(tmp_path, where):
-    """`--dry-run` SAYS IT WOULD MERGE THE PAIR, and writes nothing: no settings
-    file on a fresh workstation, and none on one whose workspace is there and
-    whose target does not answer yet."""
-    home, env = wip_world(tmp_path)
-    if where == "one with a workspace":
-        assert run_with(env, "wip", "init").returncode == 0
-        assert not settings_of(home).exists()
-        (home / "projects" / "xFactory").mkdir()
-    result = run_with(env, "wip", "init", "--dry-run")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "would merge   the SessionStart and UserPromptSubmit hook entries" \
-        in result.stdout, result.stdout
-    assert f"{home / '.claude' / 'settings.json'}" in result.stdout
-    assert not settings_of(home).exists(), "a dry run wrote the settings file"
-    assert not (home / "projects" / "xFactory" / "lanes-edit.sh").exists()
-    if where == "one with a workspace":
-        assert "would run     link-estates" in result.stdout
-
-
-@NEEDS_TEMPLATE
-def test_repeat_install_after_init_is_unchanged_one_entry_each(tmp_path):
-    """ONCE THE TARGET ANSWERS, `--install` IS WHAT IT WAS: a repeat after
-    `wip init` reports all thirty-one artifacts `unchanged`, rewrites nothing,
-    and leaves exactly one entry of each."""
-    home, env = wip_world(tmp_path)
-    (home / "projects" / "xFactory").mkdir()
-    assert run_with(env, "--install").returncode == 0
-    assert run_with(env, "wip", "init").returncode == 0
-    written = settings_of(home).read_bytes()
-    again = run_with(env, "--install")
-    assert again.returncode == 0, again.stdout + again.stderr
-    assert again.stdout.count("unchanged") == ARTIFACTS, again.stdout
-    assert settings_of(home).read_bytes() == written
-    assert session_start_commands(home) == [HOOK_COMMAND]
-    assert user_prompt_commands(home) == [GUARD_COMMAND]
-
-
-# --- the guard's real refusal is still exit 2 ------------------------------------
-
-def guard_run(home: Path, tmp_path: Path, command: str) -> subprocess.CompletedProcess:
-    """The hook's own command string, run the way the harness runs it: by a
-    shell that expands its `~` against `HOME`, with the hook's JSON on stdin and
-    a `cwd` under the projects root, outside tmux. `tmux` itself answers
-    nothing, so no real server is ever asked."""
-    cwd = home / "projects" / "somewhere"
-    cwd.mkdir(parents=True, exist_ok=True)
-    fakebin = tmp_path / "no-tmux"
-    fakebin.mkdir(exist_ok=True)
-    (fakebin / "tmux").write_text("#!/bin/sh\nexit 1\n", encoding="utf-8")
-    (fakebin / "tmux").chmod(0o755)
-    environ = scrubbed(dict(os.environ))
-    environ.update(HOME=str(home), AGENT_PROTOCOL_ROOT=str(home / ".agents"),
-                   PATH=f"{fakebin}{os.pathsep}{environ.get('PATH', '')}")
-    # COMPACT, as the harness writes it: the guard reads `"cwd":"…"` with no
-    # space after the colon, and an input it cannot read a `cwd` out of is a
-    # refusal of its own (clause (d)) — the right exit for the wrong reason.
-    payload = json.dumps({"session_id": "a-bare-claude", "cwd": str(cwd),
-                          "prompt": "do the work",
-                          "hook_event_name": "UserPromptSubmit"},
-                         separators=(",", ":"))
-    return subprocess.run(["bash", "-c", command], input=payload, text=True,
-                          capture_output=True, cwd=str(cwd), env=environ,
-                          timeout=30, check=False)
-
-
-def installed_guard(home: Path) -> str:
-    [command] = [c for c in user_prompt_commands(home) if c == GUARD_COMMAND]
-    return command
-
-
-def test_genuine_guard_rejection_exits_2(tmp_path):
-    """NO BLANKET `|| true`, AND THE PROOF IS THE EXIT CODE. With the pair
-    merged against a target that answers, the installed entry — read back out
-    of the settings file, not the constant — refuses a bare session under the
-    projects root with no workspace by exit 2, which is what blocks a prompt:
-    not 127 (the defect), and not the 0 a suffix would make of it."""
-    link_xfactory(tmp_path)
-    assert install(tmp_path).returncode == 0
-    result = guard_run(tmp_path, tmp_path, installed_guard(tmp_path))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "THE NAME GUARD REFUSES" in result.stderr, result.stderr
-    assert "the ROW cannot be read" in result.stderr, (
-        "refused, but not for the missing workspace:\n" + result.stderr)
-    assert "carried no `cwd`" not in result.stderr
-
-
-@NEEDS_TEMPLATE
-def test_after_wip_init_the_guard_still_refuses_by_exit_2(tmp_path):
-    """…AND THE SAME ONCE THE WORKSPACE IS THERE: after `wip init` has linked
-    and merged, a session outside any tmux window is refused by exit 2 — the
-    register is readable now, and the refusal is the guard's own (D2), not a
-    missing file."""
-    home, env = wip_world(tmp_path)
-    (home / "projects" / "xFactory").mkdir()
-    assert run_with(env, "--install").returncode == 0
-    assert run_with(env, "wip", "init").returncode == 0
-    result = guard_run(home, tmp_path, installed_guard(home))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "not in a tmux window at all" in result.stderr, result.stderr
-    assert "the ROW cannot be read" not in result.stderr
diff --git a/tests/test_install_payload_source.py b/tests/test_install_payload_source.py
deleted file mode 100644
index 0347e1b1..00000000
--- a/tests/test_install_payload_source.py
+++ /dev/null
@@ -1,2028 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""WHERE `--install` TAKES ITS BYTES FROM: the compatibility matrix of the triad
-migration (opensoft/openRepoTools#186, T007/T008 of
-`specs/004-migrate-to-triad/tasks.md`; the matrix is
-`specs/004-migrate-to-triad/installer-design.md`'s "Compatibility acceptance").
-
-Every test here builds its own GitHub out of BARE REPOSITORIES IN A TEMPORARY
-DIRECTORY: a fake `gh` and a fake `curl` (one Python program, `FAKE_GITHUB`
-below) answer the calls the installer makes from those repositories with
-`git` itself — `commits/<ref>` is `git rev-parse`, `git/trees/<sha>` is
-`git ls-tree`, `contents/<path>?ref=` and the raw URL are `git show` — so a
-branch that MOVES, a tag, a commit and a ref with a slash in it behave as they
-do on GitHub, and every request is written to a log a test can read back. No
-real `gh` or `curl` is reachable: the `$PATH` a run gets is a farm of the real
-one's executables with both names left out, and the fakes put back only where a
-test asks for them. Every `$HOME` is a temporary directory.
-
-THE TWO LAYOUTS:
-
-* LEGACY — one repository whose root carries every payload file (today's
-  `opensoft/openRepoTools`). It installs EXACTLY as before: a complete checkout
-  offline, byte for byte; a remote install fetching every payload file at the
-  ref it was given, by `gh` and then the raw URL, with no other host and no
-  `jq`. The only new request is the one that tells the layouts apart —
-  `contracts/code-pin.yaml`, answered 404 — asked by those same two
-  transports.
-* ADOPTED — an ASSEMBLY root whose `contracts/code-pin.yaml` pins the CODE
-  leg by repository and commit, with the gitlink at the pinned path agreeing.
-  The payload comes from the code repository at the pinned commit and from
-  nowhere else, and the ref is resolved ONCE, so a moving branch cannot mix
-  two versions. That needs api.github.com (and `jq` on the `curl` path), which
-  is why it is the adopted layout's and not the legacy one's.
-
-A test whose name carries `composed` needs THIS checkout mounted as an
-assembly's code leg with the assembly's root entry point beside it; standalone
-code skips it, naming why, and T015 runs it at the real assembled head.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import json
-import os
-import re
-import shutil
-import signal
-import stat
-import subprocess
-import sys
-import textwrap
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-COMMAND = REPO / "openRepoTools"
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP]
-
-#: `--install` merges two hook entries with jq and refuses without it, and the
-#: fake `gh`'s `--jq` is answered by the real jq: every test that installs
-#: needs one, as `tests/test_openrepotools_command.py`'s own NEEDS_JQ says.
-NEEDS_JQ = pytest.mark.skipif(shutil.which("jq") is None,
-                              reason="`--install` merges two hook entries with jq")
-
-#: THE PINNED STANDARD'S TEMPLATE BYTES — what `wip init` seeds a workspace
-#: from. Without the submodule these tests SKIP with conftest's own words, which
-#: is the documented skip row 14 of the matrix keeps.
-UPSTREAM = REPO / "upstream" / "openRepoShape"
-NEEDS_TEMPLATES = pytest.mark.skipif(
-    not (UPSTREAM / "templates" / "workspace-root").is_dir(),
-    reason="the pinned openRepoShape is not checked out; "
-           "run `git submodule update --init upstream/openRepoShape`")
-
-#: THE COMPOSED CONTEXT: this checkout mounted as an assembly's code leg, the
-#: assembly's root entry point beside it. Read from disk, never assumed.
-ASSEMBLY = REPO.parent
-
-
-def composed_context() -> tuple[bool, str]:
-    pin = ASSEMBLY / "contracts" / "code-pin.yaml"
-    if not pin.is_file() or not (ASSEMBLY / "openRepoTools").is_file():
-        return False, ("composed acceptance: needs this checkout mounted as an "
-                       "assembly's code leg with the assembly's root "
-                       "`openRepoTools` beside it; standalone code skips it and "
-                       "T015 runs it at the real assembled head")
-    path = re.search(r"^submodule_path:\s*\"?([^\"\s]+)", pin.read_text(
-        encoding="utf-8"), re.MULTILINE)
-    if not path or path.group(1) != REPO.name:
-        return False, f"{ASSEMBLY} pins a code leg that is not this checkout"
-    return True, ""
-
-
-COMPOSED, COMPOSED_WHY = composed_context()
-#: `OPENREPOTOOLS_COMPOSED=1` is the assembly's exact-pin job saying the run IS
-#: composed acceptance (T009's convention): there, an absent context FAILS and
-#: nothing skips its way in. Anywhere else, standalone code skips these.
-STRICT_COMPOSED = os.environ.get("OPENREPOTOOLS_COMPOSED") == "1"
-NEEDS_COMPOSED = pytest.mark.skipif(not COMPOSED and not STRICT_COMPOSED,
-                                    reason=COMPOSED_WHY)
-
-
-def require_composed() -> None:
-    if not COMPOSED:
-        pytest.fail(f"OPENREPOTOOLS_COMPOSED=1, and {COMPOSED_WHY}")
-
-
-# --- the payload, read the way a consumer reads it -------------------------
-
-def one_line_array(text: str, name: str) -> list[str]:
-    """`NAME=(a b c)` on ONE line, the way workBenches' `estate-commands-start`
-    `sed`-reads it out of the vendored `openRepoTools` (consumer-reads row W4):
-    a list that wrapped would read as nothing there, so it is asserted here."""
-    lines = [line for line in text.splitlines() if line.startswith(f"{name}=(")]
-    assert len(lines) == 1, f"{name}=( is not one line: {lines}"
-    line = lines[0]
-    assert line.endswith(")") and line.count("(") == 1 and line.count(")") == 1, line
-    return line[len(name) + 2:-1].split()
-
-
-SOURCE_TEXT = COMMAND.read_text(encoding="utf-8")
-INSTALLABLES = one_line_array(SOURCE_TEXT, "INSTALLABLES")
-SKILLS = one_line_array(SOURCE_TEXT, "SKILLS")
-COMMANDS = one_line_array(SOURCE_TEXT, "COMMANDS")
-SKILL_PATHS = [f"skills/{n}/SKILL.md" for n in SKILLS]
-COMMAND_PATHS = [f"commands/{n}.md" for n in COMMANDS]
-#: EVERY FILE `--install` READS, derived from the three lists and nothing else.
-PAYLOAD = INSTALLABLES + SKILL_PATHS + COMMAND_PATHS
-
-
-def destinations(home: Path, *, bin_dir: Path | None = None,
-                 profiles: Path | None = None,
-                 claude: Path | None = None) -> dict[str, str]:
-    """Every placed file's destination → the payload path it carries."""
-    bin_dir = bin_dir or home / ".local" / "bin"
-    profiles = profiles or home / ".claude-profiles"
-    claude = claude or home / ".claude"
-    out = {str(bin_dir / n): n for n in INSTALLABLES}
-    for n, p in zip(SKILLS, SKILL_PATHS):
-        out[str(profiles / "shared" / "skills" / n / "SKILL.md")] = p
-        out[str(claude / "skills" / n / "SKILL.md")] = p
-    for n, p in zip(COMMANDS, COMMAND_PATHS):
-        out[str(profiles / "shared" / "commands" / f"{n}.md")] = p
-        out[str(claude / "commands" / f"{n}.md")] = p
-    return out
-
-
-def variant(path: str, tag: str | None) -> bytes:
-    """This checkout's bytes for `path`, MARKED with `tag` so a test can tell
-    which commit an installed file came from. A comment line at the end, which
-    every payload file — bash, Python, Markdown and the alias table — reads
-    past."""
-    data = (REPO / path).read_bytes()
-    if tag is None:
-        return data
-    return data + f"\n# payload variant {tag}\n".encode()
-
-
-def payload_files(tag: str | None, *, without: tuple[str, ...] = ()) -> dict[str, bytes]:
-    return {p: variant(p, tag) for p in PAYLOAD if p not in without}
-
-
-# --- repositories, built with git plumbing ---------------------------------
-
-def git(*args: str, cwd: Path | None = None, input: bytes | None = None,
-        env: dict | None = None) -> str:
-    proc = subprocess.run(["git", *args], cwd=str(cwd) if cwd else None,
-                          input=input, capture_output=True, check=False,
-                          env={**os.environ, **(env or {})})
-    if proc.returncode != 0:
-        raise AssertionError(f"git {' '.join(args)} failed:\n"
-                             f"{proc.stderr.decode(errors='replace')}")
-    return proc.stdout.decode()
-
-
-IDENTITY = {"GIT_AUTHOR_NAME": "payload tests", "GIT_AUTHOR_EMAIL": "t@example.invalid",
-            "GIT_COMMITTER_NAME": "payload tests",
-            "GIT_COMMITTER_EMAIL": "t@example.invalid",
-            "GIT_AUTHOR_DATE": "2026-10-07T00:00:00Z",
-            "GIT_COMMITTER_DATE": "2026-10-07T00:00:00Z"}
-
-
-def bare(server: Path, slug: str) -> Path:
-    path = server / f"{slug}.git"
-    if not path.exists():
-        path.parent.mkdir(parents=True, exist_ok=True)
-        git("init", "-q", "--bare", "-b", "main", str(path))
-    return path
-
-
-def commit(repo: Path, files: dict[str, bytes], *, gitlinks: dict[str, str] | None = None,
-           branch: str | None = "main", message: str = "payload tests") -> str:
-    """One commit of exactly `files` (and `gitlinks`) in the bare `repo`.
-
-    Executable bits follow this checkout: a payload command is 100755 because
-    its source is. Built from the object store up, so the tests pay for no
-    working tree."""
-    index = repo / f"index-{os.getpid()}-{time.monotonic_ns()}"
-    env = {"GIT_INDEX_FILE": str(index), **IDENTITY}
-    lines = []
-    for path, data in sorted(files.items()):
-        oid = git("--git-dir", str(repo), "hash-object", "-w", "--stdin",
-                  input=data).strip()
-        source = REPO / path
-        mode = "100755" if (source.is_file() and os.access(source, os.X_OK)) else "100644"
-        lines.append(f"{mode} {oid}\t{path}")
-    for path, oid in sorted((gitlinks or {}).items()):
-        lines.append(f"160000 {oid}\t{path}")
-    git("--git-dir", str(repo), "update-index", "--index-info",
-        input=("\n".join(lines) + "\n").encode(), env=env)
-    tree = git("--git-dir", str(repo), "write-tree", env=env).strip()
-    index.unlink()
-    sha = git("--git-dir", str(repo), "commit-tree", tree, "-m", message,
-              env=env).strip()
-    if branch:
-        git("--git-dir", str(repo), "update-ref", f"refs/heads/{branch}", sha)
-    return sha
-
-
-def tree_digest(repo: Path, sha: str) -> str:
-    """`sorted-ls-tree-r-v1`, as `contracts/code-pin.yaml` defines it."""
-    out = subprocess.run(["git", "--git-dir", str(repo), "ls-tree", "-r", "-z", sha],
-                         capture_output=True, check=True).stdout
-    records = sorted(r for r in out.split(b"\0") if r)
-    return hashlib.sha256(b"".join(r + b"\n" for r in records)).hexdigest()
-
-
-#: THE PIN, in the grammar the rehearsed assembly carries (2726d3a's
-#: `contracts/code-pin.yaml`), comments and quoting included.
-PIN_TEXT = """\
-schema_version: 1
-kind: pinned_contract_manifest
-
-# ===========================================================================
-# code-pin.yaml — the CODE leg, pinned by commit and digest.
-# ===========================================================================
-
-leg_role: code
-source_repository: {source}
-submodule_path: {path}
-
-commit: "{commit}"
-revision_kind: commit
-
-digest_algorithm: sha256
-
-# WHAT IS DIGESTED, exactly. `sorted-ls-tree-r-v1`.
-digest_definition: sorted-ls-tree-r-v1
-digests:
-  tree_sha256: "{digest}"
-
-verify_pin: scripts/validate-pins.py
-resync_runbook: "README.md#the-lockstep-invariant"
-"""
-
-PROJECT_YAML = """\
-schema_version: 1
-kind: project-manifest
-id: openrepotools
-legs:
-  - role: assembly
-    repository: opensoft/openRepoTools
-    path: "."
-  - role: code
-    repository: opensoft/openRepoTools-code
-    path: code
-"""
-
-#: WHAT SITS AT THE ASSEMBLY ROOT IN THESE FIXTURES where the real assembly has
-#: its entry point. It is never a payload: an install that placed it would put
-#: a command that exits 97 on somebody's PATH, which these tests assert never
-#: happens.
-ROOT_PLACEHOLDER = (b"#!/usr/bin/env bash\n"
-                    b"echo 'the assembly entry point placeholder ran' >&2\nexit 97\n")
-
-
-def shape_pin(sha: str) -> bytes:
-    return (f"schema_version: 1\nkind: pinned_contract_manifest\n"
-            f"pin_role: upstream-standard\nsource_repository: opensoft/openRepoShape\n"
-            f"submodule_path: upstream/openRepoShape\n"
-            f'commit: "{sha}"\nrevision_kind: commit\n').encode()
-
-
-class World:
-    """One fake GitHub, its repositories and its request log."""
-
-    def __init__(self, root: Path):
-        self.root = root
-        self.server = root / "github"
-        self.server.mkdir(parents=True, exist_ok=True)
-        self.log = root / "requests.log"
-        self.conf = root / "fake-github.json"
-        self.state = root / "fake-github.state"
-        self.faults: list[dict] = []
-        self.moves: list[dict] = []
-        self.write_conf()
-
-    def write_conf(self) -> None:
-        self.conf.write_text(json.dumps({
-            "server": str(self.server), "log": str(self.log),
-            "state": str(self.state), "faults": self.faults,
-            "moves": self.moves}), encoding="utf-8")
-        if self.state.exists():
-            self.state.unlink()
-
-    def repo(self, slug: str) -> Path:
-        return bare(self.server, slug)
-
-    # -- the code leg, the assembly and the single repository --------------
-    def code(self, slug: str = "opensoft/openRepoTools-code", tag: str | None = "pinned",
-             *, without: tuple[str, ...] = (), shape: str | None = None,
-             branch: str | None = "main") -> str:
-        files = payload_files(tag, without=without)
-        files["contracts/openreposhape-pin.yaml"] = (
-            shape_pin(shape) if shape else
-            (REPO / "contracts" / "openreposhape-pin.yaml").read_bytes())
-        return commit(self.repo(slug), files, branch=branch,
-                      message=f"code {tag}")
-
-    def assembly(self, code_commit: str, *, slug: str = "opensoft/openRepoTools",
-                 code_slug: str = "opensoft/openRepoTools-code",
-                 pin: str | None = None, gitlink: str | None = None,
-                 manifest: bool = True, with_pin: bool = True,
-                 extra: dict[str, bytes] | None = None,
-                 root_entry: bytes = ROOT_PLACEHOLDER,
-                 branch: str | None = "main") -> str:
-        code_repo = self.repo(code_slug)
-        if pin is None:
-            pin = PIN_TEXT.format(source=code_slug, path="code", commit=code_commit,
-                                  digest=tree_digest(code_repo, code_commit))
-        files = {"README.md": b"# openRepoTools\n", "openRepoTools": root_entry}
-        if manifest:
-            files["project.yaml"] = PROJECT_YAML.encode()
-        if with_pin:
-            files["contracts/code-pin.yaml"] = pin.encode()
-        files["contracts/shape-pin.yaml"] = b"schema_version: 1\n"
-        files.update(extra or {})
-        return commit(self.repo(slug), files,
-                      gitlinks={"code": gitlink or code_commit}, branch=branch,
-                      message="assembly")
-
-    def single(self, slug: str = "opensoft/openRepoTools", tag: str | None = "legacy",
-               *, branch: str | None = "main", without: tuple[str, ...] = (),
-               shape: str | None = None) -> str:
-        """Today's layout: every payload file at the root, the dependency pin
-        in `contracts/`, and no adoption manifest."""
-        files = payload_files(tag, without=without)
-        files["contracts/openreposhape-pin.yaml"] = (
-            shape_pin(shape) if shape else
-            (REPO / "contracts" / "openreposhape-pin.yaml").read_bytes())
-        files["README.md"] = b"# openRepoTools\n"
-        files["AGENTS.md"] = b"# Working in openRepoTools\n"
-        return commit(self.repo(slug), files, branch=branch,
-                      message=f"single {tag}")
-
-    def ref(self, slug: str, ref: str, sha: str) -> None:
-        git("--git-dir", str(self.repo(slug)), "update-ref", ref, sha)
-
-    def tree_of(self, slug: str, sha: str, path: str) -> str:
-        return git("--git-dir", str(self.repo(slug)), "rev-parse",
-                   f"{sha}:{path}").strip()
-
-    # -- the request log ---------------------------------------------------
-    def requests(self) -> list[dict]:
-        if not self.log.exists():
-            return []
-        return [json.loads(line) for line in
-                self.log.read_text(encoding="utf-8").splitlines() if line]
-
-    def payload_requests(self) -> list[dict]:
-        """Every request for a payload FILE (not a listing, not a commit)."""
-        out = []
-        for r in self.requests():
-            target = r["target"]
-            for path in PAYLOAD:
-                if (f"/contents/{path}?" in target
-                        or target.endswith(f"/{path}") and "raw.githubusercontent" in target):
-                    out.append({**r, "path": path})
-        return out
-
-
-#: A fake GitHub in one program: `gh api`, `gh repo …` and `curl`, answered from
-#: bare repositories with git. Faults and branch moves come from its JSON
-#: configuration, and every request is logged before it is answered.
-FAKE_GITHUB = r'''
-import json, os, re, subprocess, sys, urllib.parse
-
-conf_path, tool, args = sys.argv[1], sys.argv[2], sys.argv[3:]
-with open(conf_path) as fh:
-    conf = json.load(fh)
-server = conf["server"]
-
-
-def repo_dir(slug):
-    return os.path.join(server, slug + ".git")
-
-
-def git(repo, *a, data=None):
-    return subprocess.run(["git", "--git-dir", repo, *a], capture_output=True,
-                          input=data)
-
-
-def resolve(repo, ref):
-    p = git(repo, "rev-parse", "--verify", "--quiet", ref + "^{commit}")
-    return p.stdout.decode().strip() if p.returncode == 0 else ""
-
-
-def log(entry):
-    with open(conf["log"], "a") as fh:
-        fh.write(json.dumps(entry) + "\n")
-
-
-def tick():
-    try:
-        with open(conf["state"]) as fh:
-            state = json.load(fh)
-    except (OSError, ValueError):
-        state = {"count": 0, "applied": []}
-    for i, move in enumerate(conf.get("moves", [])):
-        if i not in state["applied"] and state["count"] >= move["after"]:
-            git(repo_dir(move["repo"]), "update-ref", move["ref"], move["to"])
-            state["applied"].append(i)
-    state["count"] += 1
-    with open(conf["state"], "w") as fh:
-        json.dump(state, fh)
-
-
-def api(path, query, accept):
-    m = re.match(r"repos/([^/]+)/([^/]+)/(.*)$", path)
-    if not m:
-        return 404, json.dumps({"message": "Not Found"}).encode()
-    owner, name, rest = m.groups()
-    repo = repo_dir(owner + "/" + name)
-    if not os.path.isdir(repo):
-        return 404, json.dumps({"message": "Not Found"}).encode()
-    if rest.startswith("commits/"):
-        ref = urllib.parse.unquote(rest[len("commits/"):])
-        sha = resolve(repo, ref)
-        if not sha:
-            return 422, json.dumps({"message": "No commit found for SHA: " + ref,
-                                    "status": "422"}).encode()
-        if accept == "application/vnd.github.sha":
-            return 200, sha.encode()
-        return 200, json.dumps({"sha": sha}).encode()
-    if rest.startswith("git/trees/"):
-        ref = rest[len("git/trees/"):]
-        kind = git(repo, "cat-file", "-t", ref).stdout.decode().strip()
-        if kind == "commit":
-            ref = git(repo, "rev-parse", ref + "^{tree}").stdout.decode().strip()
-        elif kind != "tree":
-            return 404, json.dumps({"message": "Not Found"}).encode()
-        listing = git(repo, "ls-tree", "-z", ref).stdout.decode()
-        tree = []
-        for record in filter(None, listing.split("\0")):
-            meta, path_ = record.split("\t", 1)
-            mode, typ, sha = meta.split()
-            tree.append({"path": path_, "mode": mode, "type": typ, "sha": sha})
-        return 200, json.dumps({"sha": ref, "tree": tree, "truncated": False}).encode()
-    if rest.startswith("contents/"):
-        path_ = urllib.parse.unquote(rest[len("contents/"):])
-        ref = query.get("ref", ["main"])[0]
-        return blob(repo, ref, path_)
-    return 404, json.dumps({"message": "Not Found"}).encode()
-
-
-def blob(repo, ref, path_):
-    sha = resolve(repo, ref)
-    if not sha:
-        return 404, json.dumps({"message": "No commit found for the ref " + ref}).encode()
-    obj = sha + ":" + path_
-    if git(repo, "cat-file", "-t", obj).stdout.decode().strip() != "blob":
-        return 404, json.dumps({"message": "Not Found"}).encode()
-    return 200, git(repo, "cat-file", "blob", obj).stdout
-
-
-def raw(url_path):
-    parts = url_path.split("/")
-    if len(parts) < 4:
-        return 404, b"404: Not Found"
-    repo = repo_dir(parts[0] + "/" + parts[1])
-    if not os.path.isdir(repo):
-        return 404, b"404: Not Found"
-    rest = parts[2:]
-    for k in range(1, len(rest)):
-        ref, path_ = "/".join(rest[:k]), "/".join(rest[k:])
-        if resolve(repo, ref):
-            status, body = blob(repo, ref, path_)
-            return (status, body) if status == 200 else (404, b"404: Not Found")
-    return 404, b"404: Not Found"
-
-
-def fault_for(target):
-    for f in conf.get("faults", []):
-        if f.get("tool", "any") in ("any", tool) and re.search(f["match"], target):
-            return f
-    return None
-
-
-MESSAGES = {401: "Bad credentials", 403: "API rate limit exceeded for 203.0.113.7.",
-            404: "Not Found", 500: "Server Error"}
-
-
-def gh_main():
-    if args[:1] == ["repo"]:
-        return gh_repo(args[1:])
-    if args[:1] != ["api"]:
-        sys.stderr.write("fake gh: unexpected call: %s\n" % " ".join(args))
-        return 1
-    endpoint, accept, jq, method = None, "", None, "GET"
-    i = 1
-    while i < len(args):
-        a = args[i]
-        if a in ("-H", "--header"):
-            h = args[i + 1]
-            if h.lower().startswith("accept:"):
-                accept = h.split(":", 1)[1].strip()
-            i += 2
-        elif a in ("--jq", "-q"):
-            jq = args[i + 1]
-            i += 2
-        elif a in ("--method", "-X"):
-            method = args[i + 1]
-            i += 2
-        elif a in ("--paginate", "--silent"):
-            i += 1
-        elif a.startswith("-"):
-            i += 2
-        elif endpoint is None:
-            endpoint = a
-            i += 1
-        else:
-            i += 1
-    endpoint = (endpoint or "").lstrip("/")
-    log({"tool": "gh", "target": endpoint, "accept": accept})
-    tick()
-    if method == "PUT":
-        return 0
-    if endpoint == "user":
-        sys.stdout.write("brettheap\n")
-        return 0
-    f = fault_for(endpoint)
-    if f and f["kind"] == "transport":
-        sys.stderr.write("error connecting to api.github.com\n"
-                         "check your internet connection or https://githubstatus.com\n")
-        return 1
-    if f and f["kind"] == "status":
-        status = f["status"]
-        msg = MESSAGES.get(status, "Error")
-        sys.stdout.write(json.dumps({"message": msg}))
-        sys.stderr.write("gh: %s (HTTP %d)\n" % (msg, status))
-        return 1
-    path, _, q = endpoint.partition("?")
-    status, body = api(path, urllib.parse.parse_qs(q), accept)
-    if f and f["kind"] == "garbage":
-        status, body = 200, b"<html>a captive portal answered this</html>"
-    if status >= 400:
-        sys.stdout.write(body.decode(errors="replace"))
-        msg = json.loads(body).get("message", "Error")
-        sys.stderr.write("gh: %s (HTTP %d)\n" % (msg, status))
-        return 1
-    if jq is not None:
-        p = subprocess.run(["jq", "-r", jq], input=body, capture_output=True)
-        if p.returncode != 0:
-            sys.stderr.write("failed to parse jq expression or JSON: "
-                             + p.stderr.decode(errors="replace"))
-            return 1
-        sys.stdout.buffer.write(p.stdout)
-        return 0
-    sys.stdout.buffer.write(body)
-    return 0
-
-
-def gh_repo(rest):
-    log({"tool": "gh", "target": "repo " + " ".join(rest), "accept": ""})
-    verb, slug = rest[0], rest[1]
-    repo = repo_dir(slug)
-    if verb == "view":
-        return 0 if os.path.isdir(repo) else 1
-    if verb == "create":
-        os.makedirs(os.path.dirname(repo), exist_ok=True)
-        subprocess.run(["git", "init", "-q", "--bare", "-b", "main", repo], check=True)
-        return 0
-    if verb == "clone":
-        p = subprocess.run(["git", "clone", "-q", repo, rest[2]])
-        return p.returncode
-    return 1
-
-
-def curl_main():
-    url, accept, out, fmt, fail = None, "", None, None, False
-    i = 0
-    while i < len(args):
-        a = args[i]
-        if a in ("-H", "--header"):
-            h = args[i + 1]
-            if h.lower().startswith("accept:"):
-                accept = h.split(":", 1)[1].strip()
-            i += 2
-        elif a in ("-o", "--output"):
-            out = args[i + 1]
-            i += 2
-        elif a in ("-w", "--write-out"):
-            fmt = args[i + 1]
-            i += 2
-        elif a == "--fail" or (a.startswith("-") and not a.startswith("--") and "f" in a):
-            fail = True
-            i += 1
-        elif a.startswith("-"):
-            i += 1
-        else:
-            url = a
-            i += 1
-    log({"tool": "curl", "target": url or "", "accept": accept})
-    tick()
-    f = fault_for(url or "")
-    if f and f["kind"] == "transport":
-        sys.stderr.write("curl: (6) Could not resolve host: %s\n"
-                         % urllib.parse.urlsplit(url).netloc)
-        return 6
-    parts = urllib.parse.urlsplit(url or "")
-    if f and f["kind"] == "status":
-        status, body = f["status"], json.dumps({"message": MESSAGES.get(f["status"], "Error")}).encode()
-    elif parts.netloc == "api.github.com":
-        status, body = api(urllib.parse.unquote(parts.path.lstrip("/")),
-                           urllib.parse.parse_qs(parts.query), accept)
-    elif parts.netloc == "raw.githubusercontent.com":
-        status, body = raw(parts.path.lstrip("/"))
-    else:
-        sys.stderr.write("curl: (6) Could not resolve host: %s\n" % parts.netloc)
-        return 6
-    if f and f["kind"] == "garbage":
-        status, body = 200, b"<html>a captive portal answered this</html>"
-    if status >= 400 and fail:
-        sys.stderr.write("curl: (22) The requested URL returned error: %d\n" % status)
-        return 22
-    if out:
-        with open(out, "wb") as fh:
-            fh.write(body)
-    else:
-        sys.stdout.buffer.write(body)
-    if fmt:
-        sys.stdout.write(fmt.replace("%{http_code}", str(status)))
-    return 0
-
-
-sys.exit(gh_main() if tool == "gh" else curl_main())
-'''
-
-
-def path_farm(root: Path, leave_out: tuple[str, ...]) -> Path:
-    """A directory of links to every executable on the real `$PATH` except
-    `leave_out`: a machine on which those names do not EXIST."""
-    farm = root / "path-farm"
-    if farm.exists():
-        return farm
-    farm.mkdir()
-    for directory in os.environ.get("PATH", "").split(os.pathsep):
-        try:
-            entries = sorted(os.listdir(directory))
-        except OSError:
-            continue
-        for entry in entries:
-            source = os.path.join(directory, entry)
-            link = farm / entry
-            if entry in leave_out or link.is_symlink() or not (
-                    os.path.isfile(source) and os.access(source, os.X_OK)):
-                continue
-            link.symlink_to(source)
-    return farm
-
-
-def network(world: World, *, gh: bool = True, curl: bool = True,
-            extra_shims: dict[str, str] | None = None) -> str:
-    """The `$PATH` a run gets: the fakes that are switched on, first, then a
-    farm with no real `gh` and no real `curl` in it at all."""
-    fake = world.root / ("fake-" + ("g" if gh else "") + ("c" if curl else "")
-                         + ("x" if extra_shims else ""))
-    fake.mkdir(exist_ok=True)
-    program = world.root / "fake_github.py"
-    program.write_text(FAKE_GITHUB, encoding="utf-8")
-    for name, wanted in (("gh", gh), ("curl", curl)):
-        if wanted:
-            shim = fake / name
-            shim.write_text(f"#!/bin/sh\nexec '{sys.executable}' -I '{program}' "
-                            f"'{world.conf}' {name} \"$@\"\n", encoding="utf-8")
-            shim.chmod(0o755)
-    for name, body in (extra_shims or {}).items():
-        (fake / name).write_text(body, encoding="utf-8")
-        (fake / name).chmod(0o755)
-    farm = path_farm(world.root, ("gh", "curl"))
-    return f"{fake}{os.pathsep}{farm}"
-
-
-def env_for(home: Path, path: str, **extra: str) -> dict:
-    environ = dict(os.environ)
-    for name in list(environ):
-        if name.startswith("OPENREPOTOOLS_") or name in (
-                "XDG_DATA_HOME", "CLAUDE_PROFILES_HOME", "CLAUDE_USER_DIR",
-                "AGENT_PROTOCOL_ROOT", "PROJECTS_DIR", "GH_TOKEN", "GITHUB_TOKEN"):
-            environ.pop(name)
-    environ.update({"HOME": str(home), "PATH": path,
-                    "CLAUDE_PROFILES_HOME": str(home / ".claude-profiles"),
-                    "CLAUDE_USER_DIR": str(home / ".claude"),
-                    "AGENT_PROTOCOL_ROOT": str(home / ".agents"),
-                    "XDG_CACHE_HOME": str(home / ".cache"), **IDENTITY})
-    environ.update(extra)
-    return environ
-
-
-def run_stdin(world: World, home: Path, path: str, *args: str,
-              script: Path = COMMAND, **extra: str) -> subprocess.CompletedProcess:
-    """The documented one-liner's shape: the implementation on stdin, from a
-    directory holding nothing named `bash`, so it runs as no file at all."""
-    cwd = world.root / "cwd"
-    cwd.mkdir(exist_ok=True)
-    return subprocess.run(["bash", "-s", "--", *args], input=script.read_text(encoding="utf-8"),
-                          capture_output=True, text=True, check=False, cwd=str(cwd),
-                          env=env_for(home, path, **extra))
-
-
-def run_file(script: Path, home: Path, path: str, *args: str,
-             **extra: str) -> subprocess.CompletedProcess:
-    return subprocess.run(["bash", str(script), *args], input="", capture_output=True,
-                          text=True, check=False, cwd=str(home.parent),
-                          env=env_for(home, path, **extra))
-
-
-def snapshot(root: Path) -> dict[str, bytes]:
-    if not root.exists():
-        return {}
-    return {str(p.relative_to(root)): (p.read_bytes() if p.is_file() else b"<dir>")
-            for p in sorted(root.rglob("*"))}
-
-
-def assert_installed(home: Path, tag: str | None, result, **dirs) -> None:
-    for dest, path in destinations(home, **dirs).items():
-        target = Path(dest)
-        assert target.is_file(), f"{dest} not placed\n{result.stdout}\n{result.stderr}"
-        assert target.read_bytes() == variant(path, tag), (
-            f"{dest} does not hold the {tag!r} bytes of {path}\n{result.stdout}")
-
-
-def assert_nothing_placed(home: Path, result) -> None:
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED" in result.stderr, result.stderr
-    for dest in destinations(home):
-        assert not Path(dest).exists(), f"{dest} was placed by a refused run"
-
-
-def local_tree(root: Path, tag: str | None) -> Path:
-    """A complete directory of payload files, the way a checkout or a vendored
-    tree holds them, with the executable bits the repository gives them."""
-    root.mkdir(parents=True, exist_ok=True)
-    for path, data in payload_files(tag).items():
-        target = root / path
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_bytes(data)
-        if os.access(REPO / path, os.X_OK):
-            target.chmod(0o755)
-    return root
-
-
-def install_prior(world: World, home: Path, tag: str = "prior") -> None:
-    """An earlier, complete install, from a local tree, offline."""
-    tree = local_tree(world.root / f"tree-{tag}", tag)
-    result = run_file(tree / "openRepoTools", home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-
-
-# --- a local assembly checkout ----------------------------------------------
-
-def local_assembly(world: World, *, tag: str = "local") -> tuple[Path, Path, str]:
-    """An assembly CHECKOUT with its code leg mounted at `code/`: the pin, the
-    manifest, and the gitlink in the assembly's index, all naming the code
-    checkout's own HEAD."""
-    assembly = world.root / "checkout"
-    code = assembly / "code"
-    local_tree(code, tag)
-    (code / "contracts").mkdir(exist_ok=True)
-    shutil.copy2(REPO / "contracts" / "openreposhape-pin.yaml",
-                 code / "contracts" / "openreposhape-pin.yaml")
-    git("init", "-q", "-b", "main", cwd=code)
-    git("add", "-A", cwd=code)
-    git("commit", "-q", "-m", "code", cwd=code, env=IDENTITY)
-    head = git("rev-parse", "HEAD", cwd=code).strip()
-    git("init", "-q", "-b", "main", cwd=assembly)
-    (assembly / "contracts").mkdir()
-    digest = tree_digest(code / ".git", head)
-    (assembly / "contracts" / "code-pin.yaml").write_text(PIN_TEXT.format(
-        source="opensoft/openRepoTools-code", path="code", commit=head,
-        digest=digest), encoding="utf-8")
-    (assembly / "project.yaml").write_text(PROJECT_YAML, encoding="utf-8")
-    (assembly / "openRepoTools").write_bytes(ROOT_PLACEHOLDER)
-    git("add", "contracts", "project.yaml", "openRepoTools", cwd=assembly)
-    git("update-index", "--add", "--cacheinfo", f"160000,{head},code", cwd=assembly)
-    git("commit", "-q", "-m", "assembly", cwd=assembly, env=IDENTITY)
-    return assembly, code, head
-
-
-# =========================================================================
-# ROW 1 — the existing raw/gh one-liners
-# =========================================================================
-
-@NEEDS_JQ
-def test_r01_the_one_liner_against_a_single_repository_installs_as_before(tmp_path):
-    """Today's layout through today's one-liner: every name, every destination,
-    and no line a person has not seen before — the output of a fetching
-    install is the output of a local one."""
-    world = World(tmp_path)
-    world.single(tag=None)
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, None, result)
-    local_home = tmp_path / "local-home"
-    local = run_file(local_tree(tmp_path / "tree", None) / "openRepoTools", local_home,
-                     network(world), "--install")
-    assert local.returncode == 0, local.stderr
-    assert (result.stdout.replace(str(home), "<home>")
-            == local.stdout.replace(str(local_home), "<home>"))
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("transport", ["gh", "curl"])
-def test_r01_the_one_liner_against_an_adopted_assembly_installs_the_pinned_code(
-        tmp_path, transport):
-    """The default `opensoft/openRepoTools` is the ASSEMBLY after the split:
-    the implementation and its payload are the code leg's, at the commit the
-    assembly pins, by `gh` or — where there is none — by `curl` and `jq`."""
-    world = World(tmp_path)
-    code = world.code()
-    world.assembly(code)
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world, gh=transport == "gh"), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "pinned", result)
-    assert (f"openRepoTools: source: opensoft/openRepoTools at main"
-            in result.stdout), result.stdout
-    assert f"opensoft/openRepoTools-code at {code}" in result.stdout
-
-
-#: Every request a single repository's install may make: a file at the ref it
-#: was given, by `gh api …/contents` or by the raw URL. Nothing else.
-def single_layout_requests_only(world: World, ref: str = "main") -> None:
-    for r in world.requests():
-        target = r["target"]
-        if r["tool"] == "gh":
-            assert re.fullmatch(rf"repos/opensoft/openRepoTools/contents/[^?]+\?ref={re.escape(ref)}",
-                                target), f"a single repository's install asked {target}"
-        else:
-            assert target.startswith(
-                f"https://raw.githubusercontent.com/opensoft/openRepoTools/{ref}/"), (
-                f"a single repository's install asked {target}")
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("api_fault", ["transport", "rate-403"])
-def test_r01_a_single_repository_by_curl_never_needs_api_github_com(tmp_path, api_fault):
-    """Today's layout on a machine with no `gh`: the one-liner always needed
-    raw.githubusercontent.com and nothing else, so an api.github.com that is
-    unreachable or rate-limited (60 an hour, unauthenticated, per address)
-    changes nothing. #191's review, F1: the single repository keeps its network
-    needs byte for byte."""
-    world = World(tmp_path)
-    world.single(tag="single")
-    fault = ({"kind": "transport"} if api_fault == "transport"
-             else {"kind": "status", "status": 403})
-    world.faults = [{"tool": "curl", "match": r"^https://api\.github\.com/", **fault}]
-    world.write_conf()
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world, gh=False), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "single", result)
-    single_layout_requests_only(world)
-    assert len(world.payload_requests()) == len(PAYLOAD)
-
-
-def test_r01_a_single_repository_without_jq_fetches_then_names_jq_as_it_always_did(tmp_path):
-    """No `gh` and no `jq`: today's layout fetches every payload file by the raw
-    URL and THEN refuses naming `jq` for the hook merge, placing nothing — the
-    order and the words it always had (#191's review, F1)."""
-    world = World(tmp_path)
-    world.single(tag="single")
-    fakes = network(world, gh=False).split(os.pathsep)[0]
-    (world.root / "farm-without-jq").mkdir()
-    farm = path_farm(world.root / "farm-without-jq", ("gh", "curl", "jq"))
-    home = tmp_path / "home"
-    result = run_stdin(world, home, f"{fakes}{os.pathsep}{farm}", "--install")
-    assert_nothing_placed(home, result)
-    assert result.stderr.startswith("\nREFUSED: `--install` needs `jq` to merge its TWO hook entries"), result.stderr
-    single_layout_requests_only(world)
-    assert len(world.payload_requests()) == len(PAYLOAD)
-
-
-@NEEDS_JQ
-def test_r01_a_single_repository_by_gh_asks_for_files_and_nothing_else(tmp_path):
-    """With `gh`: every request is `contents/<file>?ref=<the ref given>` — no
-    `commits/`, no `git/trees/` — and the only file asked for that is not
-    payload is, at most, the one that tells the layouts apart."""
-    world = World(tmp_path)
-    world.single(tag="single")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "single", result)
-    single_layout_requests_only(world)
-    others = {r["target"] for r in world.requests()} - {
-        r["target"] for r in world.payload_requests()}
-    assert others <= {"repos/opensoft/openRepoTools/contents/contracts/code-pin.yaml?ref=main"}, others
-    assert len(world.payload_requests()) == len(PAYLOAD)
-
-
-@NEEDS_COMPOSED
-@NEEDS_JQ
-@pytest.mark.parametrize("line", ["openRepoShape", "gh"])
-def test_r01_composed_the_documented_one_liners_resolve_through_the_root_entry_point(
-        tmp_path, line):
-    """openRepoShape's own `--install` pointer (openRepoShape:547 at 190133d)
-    and README's `gh api` line, BYTE FOR BYTE, against an assembly whose root
-    carries the real entry point: the root resolves `main` ONCE, reads the code
-    pin there and hands every argument to the pinned implementation, which
-    places the pinned payload."""
-    require_composed()
-    world = World(tmp_path)
-    code = world.code()
-    world.assembly(code, root_entry=(ASSEMBLY / "openRepoTools").read_bytes())
-    home = tmp_path / "home"
-    pipeline = {
-        "openRepoShape": "curl -fsSL https://raw.githubusercontent.com/opensoft/"
-                         "openRepoTools/main/openRepoTools | bash -s -- --install",
-        "gh": "gh api repos/opensoft/openRepoTools/contents/openRepoTools "
-              "-H 'Accept: application/vnd.github.raw' | bash -s -- --install",
-    }[line]
-    cwd = tmp_path / "cwd"
-    cwd.mkdir()
-    result = subprocess.run(["bash", "-c", "set -o pipefail; " + pipeline],
-                            capture_output=True, text=True, check=False, cwd=str(cwd),
-                            env=env_for(home, network(world)))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "pinned", result)
-    resolutions = [r for r in world.requests()
-                   if r["target"].startswith("repos/opensoft/openRepoTools/commits/")
-                   or "/repos/opensoft/openRepoTools/commits/" in r["target"]]
-    assert [r["target"].rsplit("/", 1)[1] for r in resolutions].count("main") == 1, resolutions
-
-
-@NEEDS_COMPOSED
-@NEEDS_JQ
-def test_r01_composed_the_root_entry_point_delegates_locally(tmp_path):
-    """`./openRepoTools` at an assembly checkout IS the pinned implementation
-    for every argument: the same help, the same refusal and exit status, the
-    same install."""
-    require_composed()
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    root = ASSEMBLY / "openRepoTools"
-    path = network(world)
-    for args in (("--help",), ("--version",), ("park",)):
-        mine = run_file(root, home, path, *args)
-        theirs = run_file(COMMAND, home, path, *args)
-        assert (mine.returncode, mine.stdout, mine.stderr) == \
-            (theirs.returncode, theirs.stdout, theirs.stderr), args
-    result = run_file(root, home, path, "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, None, result)
-    assert "nothing fetched" in result.stdout
-    assert world.requests() == []
-
-
-@NEEDS_COMPOSED
-@NEEDS_JQ
-def test_r01_composed_a_signal_reaches_the_implementation_and_its_temporaries_go(tmp_path):
-    """The root EXECs the implementation, so a TERM sent to the pid the person
-    started is a TERM to the installer itself, whose own EXIT trap removes its
-    temporary directory."""
-    require_composed()
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    gate = tmp_path / "gate"
-    real_cp = shutil.which("cp")
-    slow_cp = (f"#!/bin/sh\n: > '{gate}'\n"
-               f"while [ -e '{gate}' ]; do sleep 0.1; done\nexec '{real_cp}' \"$@\"\n")
-    tmp = tmp_path / "t"
-    tmp.mkdir()
-    proc = subprocess.Popen(["bash", str(ASSEMBLY / "openRepoTools"), "--install"],
-                            stdout=subprocess.PIPE, stderr=subprocess.PIPE,
-                            env=env_for(home, network(world, extra_shims={"cp": slow_cp}),
-                                        TMPDIR=str(tmp)))
-    for _ in range(300):
-        if gate.exists():
-            break
-        time.sleep(0.05)
-    assert gate.exists(), "the install never reached its first copy"
-    proc.send_signal(signal.SIGTERM)
-    try:
-        proc.wait(timeout=20)
-    finally:
-        gate.unlink()
-    assert proc.returncode in (-signal.SIGTERM, 128 + signal.SIGTERM), proc.returncode
-    assert list(tmp.iterdir()) == [], "the installer's temporary directory survived"
-
-
-# =========================================================================
-# ROW 2 — offline local single repository / adopted checkout
-# =========================================================================
-
-@NEEDS_JQ
-def test_r02_a_complete_single_repository_tree_installs_offline_byte_for_byte(tmp_path):
-    """workBenches runs `--install` from its vendored tree with a SENTINEL
-    `$OPENREPOTOOLS_REPO`/`$OPENREPOTOOLS_REF` so that only sibling copies can
-    succeed (consumer-reads W5). A complete tree is copied, nothing is asked of
-    any network, and the output is today's to the line."""
-    world = World(tmp_path)
-    tree = local_tree(tmp_path / "vendored", None)
-    home = tmp_path / "home"
-    result = run_file(tree / "openRepoTools", home, network(world), "--install",
-                      OPENREPOTOOLS_REPO="pinned-by-workBenches-no-fetch",
-                      OPENREPOTOOLS_REF="pinned-by-workBenches-no-fetch")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, None, result)
-    assert world.requests() == []
-    assert "source:" not in result.stdout
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("pin", ["valid", "crlf"])
-def test_r02_a_complete_tree_inside_another_projects_assembly_installs_as_before(tmp_path, pin):
-    """workBenches vendors a complete tree deep inside whatever holds it. A
-    `contracts/code-pin.yaml` above that tree which does not mount it as a code
-    leg — in the two layouts the design names, `<root>/<submodule_path>` and
-    `<root>/worktrees/<NNN>/<submodule_path>` — is another project's: it is not
-    read, and the sentinel run is today's to the line (#191's review, note 7)."""
-    world = World(tmp_path)
-    triad = tmp_path / "someTriad"
-    (triad / "contracts").mkdir(parents=True)
-    text = PIN_TEXT.format(source="opensoft/someTriad-code", path="code", commit="a" * 40,
-                           digest="b" * 64)
-    (triad / "contracts" / "code-pin.yaml").write_bytes(
-        (text if pin == "valid" else text.replace("\n", "\r\n")).encode())
-    tree = local_tree(triad / "code" / "devBenches" / "base-image" / "files" / "openrepotools",
-                      None)
-    sentinel = {"OPENREPOTOOLS_REPO": "pinned-by-workBenches-no-fetch",
-                "OPENREPOTOOLS_REF": "pinned-by-workBenches-no-fetch"}
-    home = tmp_path / "home"
-    result = run_file(tree / "openRepoTools", home, network(world), "--install", **sentinel)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, None, result)
-    assert world.requests() == []
-    plain_home = tmp_path / "plain-home"
-    plain = run_file(local_tree(tmp_path / "plain", None) / "openRepoTools", plain_home,
-                     network(world), "--install", **sentinel)
-    assert plain.returncode == 0, plain.stderr
-    assert (result.stdout.replace(str(home), "<home>")
-            == plain.stdout.replace(str(plain_home), "<home>")), result.stdout
-
-
-@NEEDS_JQ
-def test_r02_an_adopted_checkout_installs_its_pinned_code_offline(tmp_path):
-    """Run from the code leg mounted in an assembly checkout: the pin and the
-    gitlink agree, every payload file is the pinned commit's bytes, and they
-    are copied with no network at all — and the run says which commit that
-    was."""
-    world = World(tmp_path)
-    assembly, code, head = local_assembly(world)
-    home = tmp_path / "home"
-    result = run_file(code / "openRepoTools", home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "local", result)
-    assert world.requests() == []
-    assert (f"openRepoTools: source: the code mounted at {assembly}/code, "
-            f"opensoft/openRepoTools-code at {head}") in result.stdout, result.stdout
-    assert "nothing fetched" in result.stdout
-
-
-@NEEDS_JQ
-def test_r02_an_adopted_checkout_whose_pin_comments_its_path_is_still_its_assembly(tmp_path):
-    """A pin `pin_parse` accepts — `submodule_path: code  # the mounted leg` —
-    is recognised as this checkout's assembly, so the pin, the gitlink and the
-    bytes are all checked, rather than the tree being copied as a plain
-    complete tree with none of them checked (#191, Copilot's first round)."""
-    world = World(tmp_path)
-    assembly, code, head = local_assembly(world)
-    pin = assembly / "contracts" / "code-pin.yaml"
-    text = pin.read_text(encoding="utf-8")
-    assert "submodule_path: code\n" in text
-    pin.write_text(text.replace("submodule_path: code\n",
-                                "submodule_path: code  # the mounted leg\n"), encoding="utf-8")
-    home = tmp_path / "home"
-    result = run_file(code / "openRepoTools", home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "local", result)
-    assert world.requests() == []
-    assert (f"openRepoTools: source: the code mounted at {assembly}/code, "
-            f"opensoft/openRepoTools-code at {head}") in result.stdout, result.stdout
-
-
-# =========================================================================
-# ROW 3 — an explicit local code feature
-# =========================================================================
-
-@NEEDS_JQ
-def test_r03_an_explicit_code_feature_checkout_installs_its_own_bytes_and_names_them(tmp_path):
-    """A paired feature worktree, `<assembly>/worktrees/<NNN>/code`, run by
-    its own `openRepoTools`: ITS bytes — committed and uncommitted — are what
-    is placed, and the run names that checkout and its commit and says it is
-    not the code the assembly pins."""
-    world = World(tmp_path)
-    assembly, code, pinned = local_assembly(world)
-    feature = assembly / "worktrees" / "001-x" / "code"
-    git("clone", "-q", str(code), str(feature))
-    (feature / "park").write_bytes(variant("park", "feature-committed"))
-    git("commit", "-q", "-am", "feature", cwd=feature, env=IDENTITY)
-    head = git("rev-parse", "HEAD", cwd=feature).strip()
-    (feature / "status").write_bytes(variant("status", "feature-uncommitted"))
-    home = tmp_path / "home"
-    result = run_file(feature / "openRepoTools", home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    bin_dir = home / ".local" / "bin"
-    assert (bin_dir / "park").read_bytes() == variant("park", "feature-committed")
-    assert (bin_dir / "status").read_bytes() == variant("status", "feature-uncommitted")
-    assert world.requests() == []
-    assert f"the code checkout {feature} at {head} with uncommitted changes" \
-        in result.stdout, result.stdout
-    assert f"NOT the code {assembly} pins" in result.stdout
-    assert pinned in result.stdout
-
-
-@NEEDS_JQ
-def test_r03_an_incomplete_code_feature_checkout_is_refused_not_completed_from_elsewhere(tmp_path):
-    """A feature checkout missing a payload file is not completed from any
-    remote: its own bytes or none."""
-    world = World(tmp_path)
-    world.code()
-    world.assembly(world.code(tag="remote"))
-    assembly, code, _ = local_assembly(world)
-    feature = assembly / "worktrees" / "002-y" / "code"
-    git("clone", "-q", str(code), str(feature))
-    (feature / "lanes-index").unlink()
-    home = tmp_path / "home"
-    result = run_file(feature / "openRepoTools", home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert "lanes-index" in result.stderr
-    assert world.requests() == []
-
-
-# =========================================================================
-# ROW 4 — installed reinstallation and skill-only operation
-# =========================================================================
-
-@NEEDS_JQ
-def test_r04_an_installed_copy_reinstalls_from_the_adopted_source_without_any_checkout(tmp_path):
-    """The INSTALLED `openRepoTools` has its seventeen siblings beside it and
-    no skills: that is an incomplete local set, and on an adopted source it is
-    never topped up with pinned skills. Every payload file comes from the code
-    the assembly pins NOW, and the run says the siblings were not used."""
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    install_prior(world, home, "prior")
-    code = world.code(tag="pinned-now")
-    world.assembly(code)
-    result = run_file(home / ".local" / "bin" / "openRepoTools", home, network(world),
-                      "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "pinned-now", result)
-    assert "are not used" in result.stdout, result.stdout
-
-
-@NEEDS_JQ
-def test_r04_an_installed_copy_on_a_single_repository_keeps_the_sibling_rule(tmp_path):
-    """Today's promise, unchanged on today's layout: the commands beside the
-    installed copy are copied, and only the skills and command files, which are
-    not beside it, are fetched."""
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    install_prior(world, home, "prior")
-    world.single(tag="remote")
-    result = run_file(home / ".local" / "bin" / "openRepoTools", home, network(world),
-                      "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    for dest, path in destinations(home).items():
-        want = "prior" if path in INSTALLABLES else "remote"
-        assert Path(dest).read_bytes() == variant(path, want), dest
-    assert "source:" not in result.stdout
-
-
-# =========================================================================
-# ROW 5 — single-repository override / adopted fork
-# =========================================================================
-
-@NEEDS_JQ
-def test_r05_a_single_repository_fork_named_by_the_override_installs_as_before(tmp_path):
-    world = World(tmp_path)
-    world.single("someone/fork", tag="fork")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install",
-                       OPENREPOTOOLS_REPO="someone/fork")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "fork", result)
-
-
-@NEEDS_JQ
-def test_r05_an_adopted_fork_follows_its_own_pin_not_a_guessed_code_name(tmp_path):
-    """A fork of the assembly whose pin names `forker/tools-implementation`:
-    that repository is the payload, and neither `forker/openRepoTools-code`
-    (the guess an appended `-code` makes) nor the upstream code leg is asked
-    for anything."""
-    world = World(tmp_path)
-    world.code("forker/openRepoTools-code", tag="guessed")
-    world.code("opensoft/openRepoTools-code", tag="upstream")
-    code = world.code("forker/tools-implementation", tag="fork-pinned")
-    world.assembly(code, slug="forker/openRepoTools",
-                   code_slug="forker/tools-implementation")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install",
-                       OPENREPOTOOLS_REPO="forker/openRepoTools")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "fork-pinned", result)
-    assert not [r for r in world.requests() if "openRepoTools-code" in r["target"]]
-
-
-# =========================================================================
-# ROW 6 — branch, tag, commit and slash-containing refs
-# =========================================================================
-
-def ref_world(world: World, form: str, layout: str) -> tuple[str, str, str]:
-    """`opensoft/openRepoTools` with the `form` payload at a ref of that form,
-    and something else entirely on `main`, so a run that read `main` instead of
-    the ref it was given installs the decoy. The ref, the commit it names, and
-    the commit the payload is at."""
-    if layout == "adopted":
-        code = world.code(tag=form)
-        sha = world.assembly(code, branch=None)
-        payload_commit = code
-        world.assembly(world.code(tag="decoy-main", branch=None))
-    else:
-        sha = world.single(tag=form, branch=None)
-        payload_commit = sha
-        world.single(tag="decoy-main")
-    ref = {"branch": "release", "tag": "v1.0", "commit": sha,
-           "slash": "feature/triad-x"}[form]
-    if form == "tag":
-        world.ref("opensoft/openRepoTools", f"refs/tags/{ref}", sha)
-    elif form != "commit":
-        world.ref("opensoft/openRepoTools", f"refs/heads/{ref}", sha)
-    return ref, sha, payload_commit
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("form", ["branch", "tag", "commit", "slash"])
-def test_r06_every_ref_form_is_resolved_once_and_every_payload_names_one_commit(
-        tmp_path, form):
-    """ADOPTED: the ref is asked about ONCE, and every payload request after
-    that names the one immutable commit — never the ref, which can move."""
-    world = World(tmp_path)
-    ref, sha, payload_commit = ref_world(world, form, "adopted")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install",
-                       OPENREPOTOOLS_REF=ref)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, form, result)
-    asked = [r for r in world.requests()
-             if re.search(r"repos/opensoft/openRepoTools/commits/", r["target"])]
-    assert len(asked) == 1, asked
-    payload = world.payload_requests()
-    assert len(payload) == len(PAYLOAD), payload
-    for r in payload:
-        assert payload_commit in r["target"], r
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("form", ["branch", "tag", "commit", "slash"])
-def test_r06_a_single_repository_reads_every_ref_form_as_it_always_did(tmp_path, form):
-    """LEGACY: every ref form installs its own payload, and every request names
-    the ref exactly as it was given — the one-liner's behaviour before the
-    triad, kept byte for byte (#191's review, F1). Resolving it to a commit
-    first would need api.github.com, which this layout never needed."""
-    world = World(tmp_path)
-    ref, _, _ = ref_world(world, form, "single")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install",
-                       OPENREPOTOOLS_REF=ref)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, form, result)
-    single_layout_requests_only(world, ref)
-
-
-# =========================================================================
-# ROW 7 — a branch that moves between downloads
-# =========================================================================
-
-@NEEDS_JQ
-def test_r07_a_branch_that_moves_between_downloads_never_mixes_versions(tmp_path):
-    """ADOPTED. A single repository is read file by file at its ref, as it
-    always was (`test_r06_a_single_repository_reads_every_ref_form_as_it_always_did`):
-    freezing it would need api.github.com, which that layout never needed."""
-    world = World(tmp_path)
-    first = world.assembly(world.code(tag="first"))
-    second = world.assembly(world.code(tag="second", branch=None), branch=None)
-    assert first != second
-    world.moves = [{"after": 6, "repo": "opensoft/openRepoTools",
-                    "ref": "refs/heads/main", "to": second}]
-    world.write_conf()
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "first", result)
-    assert git("--git-dir", str(world.repo("opensoft/openRepoTools")), "rev-parse",
-               "main").strip() == second, "the branch never moved: the test proved nothing"
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("to", ["adopted", "single"])
-def test_r07_a_branch_that_moves_right_after_the_layout_question_is_read_at_one_commit(
-        tmp_path, to):
-    """The probe asks `contracts/code-pin.yaml` at the moving ref, and the ref
-    moves before it is resolved (#191, Copilot's second round). The probe only
-    decides the layout, and its bytes are never used. The commit the ref
-    resolves to is read whole: another adopted commit is installed entirely
-    from the code IT pins, never a mix. A commit that no longer carries a pin
-    is refused as a ref that moved between the two reads."""
-    world = World(tmp_path)
-    world.assembly(world.code(tag="first"))
-    if to == "adopted":
-        second_code = world.code(tag="second", branch=None)
-        second = world.assembly(second_code, branch=None)
-    else:
-        second = world.single(tag="second", branch=None)
-    world.moves = [{"after": 1, "repo": "opensoft/openRepoTools",
-                    "ref": "refs/heads/main", "to": second}]
-    world.write_conf()
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert world.requests()[0]["target"].endswith("contents/contracts/code-pin.yaml?ref=main")
-    assert git("--git-dir", str(world.repo("opensoft/openRepoTools")), "rev-parse",
-               "main").strip() == second, "the branch never moved: the test proved nothing"
-    if to == "adopted":
-        assert result.returncode == 0, result.stdout + result.stderr
-        assert_installed(home, "second", result)
-        for r in world.payload_requests():
-            assert second_code in r["target"], r
-    else:
-        assert_nothing_placed(home, result)
-        assert "the ref moved" in result.stderr, result.stderr
-        assert world.payload_requests() == []
-
-
-# =========================================================================
-# ROW 8 — missing pin in a valid single repository / partial adopted layout
-# =========================================================================
-
-@NEEDS_JQ
-def test_r08_a_single_repository_without_a_code_pin_is_permitted(tmp_path):
-    """Today's tree has `contracts/` — the dependency pin — and no code pin,
-    and no adoption manifest: a single repository, installed as one."""
-    world = World(tmp_path)
-    world.single(tag="single")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "single", result)
-
-
-@NEEDS_JQ
-def test_r08_an_assembly_root_without_its_code_pin_refuses_as_a_single_repository_would(
-        tmp_path):
-    """GitHub's 404 for `contracts/code-pin.yaml` IS the single-repository
-    answer, and nothing more is asked: a second question on that path (the
-    manifest, `project.yaml`) would be a second request on today's layout. An
-    adopter writes the pin and the manifest in ONE commit and `make validate`
-    refuses one without the other, so a published assembly without its pin is
-    a broken one — and since an assembly root carries no payload, it refuses
-    exactly as a single repository missing those files always did."""
-    world = World(tmp_path)
-    world.assembly(world.code(), with_pin=False)
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    missing = [n for n in INSTALLABLES if n != "openRepoTools"]
-    assert result.stderr == "\nREFUSED: " + single_refusal(missing), result.stderr
-    single_layout_requests_only(world)
-
-
-@NEEDS_COMPOSED
-@NEEDS_JQ
-@pytest.mark.parametrize("transport", ["gh", "curl"])
-def test_r08_composed_the_root_entry_point_refuses_a_pin_its_gitlink_disagrees_with(
-        tmp_path, transport):
-    """The assembly's root entry point checks the lockstep rule ITSELF, before
-    it fetches or runs any implementation: the gitlink at the pin's
-    `submodule_path`, in the commit it resolved, must be the pinned commit.
-    A stale or rolled-back pin is refused there, naming both commits, and the
-    code repository is never asked for anything (lane 3's review of the T007
-    patch, T3)."""
-    require_composed()
-    world = World(tmp_path)
-    old = world.code(tag="old")
-    new = world.code(tag="new")
-    world.assembly(new, gitlink=old, root_entry=(ASSEMBLY / "openRepoTools").read_bytes())
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world, gh=transport == "gh"), "--install",
-                       script=ASSEMBLY / "openRepoTools")
-    assert_nothing_placed(home, result)
-    assert old in result.stderr and new in result.stderr, result.stderr
-    assert "nothing ran" in result.stderr, result.stderr
-    assert not [r for r in world.requests() if "openRepoTools-code" in r["target"]], \
-        world.requests()
-
-
-def malformed(pin: str, how: str) -> str:
-    sha = re.search(r'commit: "([0-9a-f]{40})"', pin).group(1)
-    return {
-        "leg-role": lambda: pin.replace("leg_role: code", "leg_role: spec"),
-        "commit-abbreviated": lambda: pin.replace(sha, sha[:7]),
-        "commit-uppercase": lambda: pin.replace(sha, sha.upper()),
-        "commit-a-branch": lambda: pin.replace(f'"{sha}"', "main"),
-        "repository-not-a-slug": lambda: pin.replace("opensoft/openRepoTools-code",
-                                                     "openRepoTools-code"),
-        "repository-traversal": lambda: pin.replace("opensoft/openRepoTools-code",
-                                                    "opensoft/.."),
-        "path-nested": lambda: pin.replace("submodule_path: code", "submodule_path: legs/code"),
-        "digest-short": lambda: re.sub(r'tree_sha256: "([0-9a-f]{63})[0-9a-f]"',
-                                       r'tree_sha256: "\1"', pin),
-        "digest-definition": lambda: pin.replace("digest_definition: sorted-ls-tree-r-v1",
-                                                 "digest_definition: tarball-v0"),
-        "digest-algorithm": lambda: pin.replace("digest_algorithm: sha256",
-                                                "digest_algorithm: md5"),
-        "revision-kind": lambda: pin.replace("revision_kind: commit", "revision_kind: tag"),
-        "kind": lambda: pin.replace("kind: pinned_contract_manifest", "kind: something-else"),
-        "duplicate-commit": lambda: pin.replace("revision_kind: commit",
-                                                f'commit: "{"0" * 40}"\nrevision_kind: commit'),
-        "missing-verify-pin": lambda: pin.replace("verify_pin: scripts/validate-pins.py\n", ""),
-        "missing-resync-runbook": lambda: re.sub(r"resync_runbook: .*\n", "", pin),
-        "crlf": lambda: pin.replace("\n", "\r\n"),
-        "unterminated-quote": lambda: pin.replace(f'"{sha}"', f'"{sha}'),
-        "digests-not-a-mapping": lambda: pin.replace("digests:\n", 'digests: "x"\n'),
-        "empty": lambda: "",
-    }[how]()
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("how", [
-    "leg-role", "commit-abbreviated", "commit-uppercase", "commit-a-branch",
-    "repository-not-a-slug", "repository-traversal", "path-nested", "digest-short",
-    "digest-definition", "digest-algorithm", "revision-kind", "kind",
-    "duplicate-commit", "missing-verify-pin", "missing-resync-runbook", "crlf",
-    "unterminated-quote", "digests-not-a-mapping", "empty"])
-def test_r08_a_malformed_code_pin_is_refused_never_read_as_a_single_repository(tmp_path, how):
-    """A pin that is PRESENT and wrong refuses, naming what is wrong — and the
-    assembly root's own copies of the payload (decoys here) are never what a
-    refusal falls back to."""
-    world = World(tmp_path)
-    code = world.code()
-    good = PIN_TEXT.format(source="opensoft/openRepoTools-code", path="code", commit=code,
-                           digest=tree_digest(world.repo("opensoft/openRepoTools-code"), code))
-    world.assembly(code, pin=malformed(good, how),
-                   extra={p: variant(p, "decoy") for p in PAYLOAD})
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert "contracts/code-pin.yaml" in result.stderr, result.stderr
-    assert world.payload_requests() == []
-
-
-@NEEDS_JQ
-def test_r08_a_pin_the_gitlink_disagrees_with_is_refused(tmp_path):
-    world = World(tmp_path)
-    old = world.code(tag="old")
-    new = world.code(tag="new")
-    world.assembly(new, gitlink=old)
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert old in result.stderr and new in result.stderr, result.stderr
-    assert world.payload_requests() == []
-
-
-@NEEDS_JQ
-def test_r08_a_pin_naming_a_commit_its_repository_lacks_is_refused(tmp_path):
-    world = World(tmp_path)
-    elsewhere = world.code("someone/else", tag="elsewhere")
-    world.repo("opensoft/openRepoTools-code")
-    world.assembly(elsewhere, pin=PIN_TEXT.format(
-        source="opensoft/openRepoTools-code", path="code", commit=elsewhere,
-        digest=tree_digest(world.repo("someone/else"), elsewhere)))
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert "opensoft/openRepoTools-code" in result.stderr, result.stderr
-    assert world.payload_requests() == []
-
-
-# =========================================================================
-# ROW 9 — missing or malformed API answers, authorization, transport
-# =========================================================================
-
-STEPS = {
-    "resolve": lambda w, a, c: r"repos/opensoft/openRepoTools/commits/",
-    "list-root": lambda w, a, c: rf"repos/opensoft/openRepoTools/git/trees/{a}",
-    "list-contracts": lambda w, a, c: (r"repos/opensoft/openRepoTools/git/trees/"
-                                       + w.tree_of("opensoft/openRepoTools", a, "contracts")),
-    "pin": lambda w, a, c: r"contracts/code-pin\.yaml",
-    "code-commit": lambda w, a, c: r"repos/opensoft/openRepoTools-code/commits/",
-}
-FAULTS = {
-    "auth-401": {"kind": "status", "status": 401},
-    "rate-403": {"kind": "status", "status": 403},
-    "missing-404": {"kind": "status", "status": 404},
-    "transport": {"kind": "transport"},
-    "garbage": {"kind": "garbage"},
-}
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("step,fault", [
-    # GitHub's own 404 for the pin is not a failure: it is the answer that
-    # there is no pin, which is a single repository (row 8). Every other
-    # answer at every step is a failure.
-    (step, fault) for step in STEPS for fault in FAULTS
-    if (step, fault) != ("pin", "missing-404")])
-def test_r09_an_api_failure_is_a_refusal_never_a_fallback_to_a_single_repository(
-        tmp_path, step, fault):
-    """Every round trip the resolution makes, failing every way a network
-    fails, on BOTH transports: a refusal that says what answered, nothing
-    placed, and never the assembly root's own copies (the decoys an older
-    installer would fetch as a single repository)."""
-    world = World(tmp_path)
-    code = world.code()
-    sha = world.assembly(code, extra={p: variant(p, "decoy") for p in PAYLOAD})
-    world.faults = [{"tool": "any", "match": STEPS[step](world, sha, code), **FAULTS[fault]}]
-    world.write_conf()
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert world.payload_requests() == [], world.payload_requests()
-    tried = {r["tool"] for r in world.requests()}
-    if (step, fault) != ("pin", "garbage"):
-        # A pin `gh` DID deliver is refused for what it says, not re-fetched.
-        assert tried == {"gh", "curl"}, f"both transports are tried: {tried}"
-
-
-@NEEDS_JQ
-def test_r09_a_pin_the_listing_shows_but_that_will_not_come_back_is_refused_saying_what_answered(
-        tmp_path):
-    """The adopted path's pin fetch at the resolved commit: when it fails, the
-    refusal says what each transport ANSWERED, not only what was asked (#191's
-    review, lane 2's (d))."""
-    world = World(tmp_path)
-    code = world.code()
-    sha = world.assembly(code, extra={p: variant(p, "decoy") for p in PAYLOAD})
-    world.faults = [{"tool": "any", "kind": "status", "status": 503,
-                     "match": rf"code-pin\.yaml\?ref={sha}|/{sha}/contracts/code-pin\.yaml"}]
-    world.write_conf()
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert world.payload_requests() == []
-    assert "What answered:" in result.stderr, result.stderr
-    assert "gh: Error (HTTP 503)" in result.stderr and "curl: HTTP 503" in result.stderr, result.stderr
-
-
-# =========================================================================
-# ROW 10 — changed local gitlink / changed payload / incomplete local payload
-# =========================================================================
-
-@NEEDS_JQ
-def test_r10_a_local_gitlink_that_disagrees_with_the_pin_is_refused_before_staging(tmp_path):
-    world = World(tmp_path)
-    assembly, code, head = local_assembly(world)
-    (code / "README-moved").write_text("x\n", encoding="utf-8")
-    git("add", "README-moved", cwd=code)
-    git("commit", "-q", "-m", "moved on", cwd=code, env=IDENTITY)
-    moved = git("rev-parse", "HEAD", cwd=code).strip()
-    git("update-index", "--cacheinfo", f"160000,{moved},code", cwd=assembly)
-    home = tmp_path / "home"
-    result = run_file(code / "openRepoTools", home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert moved in result.stderr and head in result.stderr, result.stderr
-    assert world.requests() == []
-
-
-@NEEDS_JQ
-def test_r10_a_changed_local_payload_is_refused_before_staging(tmp_path):
-    world = World(tmp_path)
-    assembly, code, head = local_assembly(world)
-    (code / "park").write_bytes(variant("park", "edited-in-place"))
-    home = tmp_path / "home"
-    result = run_file(code / "openRepoTools", home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert "park" in result.stderr and head in result.stderr, result.stderr
-    assert world.requests() == []
-
-
-@NEEDS_JQ
-def test_r10_an_incomplete_local_adopted_payload_is_refused_without_a_fetch(tmp_path):
-    world = World(tmp_path)
-    world.assembly(world.code(tag="remote"))
-    assembly, code, head = local_assembly(world)
-    (code / "skills" / "restart" / "SKILL.md").unlink()
-    home = tmp_path / "home"
-    result = run_file(code / "openRepoTools", home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert "skills/restart/SKILL.md" in result.stderr, result.stderr
-    assert world.requests() == []
-
-
-# =========================================================================
-# ROW 11 — missing command, skill or alias, or a settings merge that fails
-# =========================================================================
-
-@NEEDS_JQ
-@pytest.mark.parametrize("withheld", ["park", "skills/restart/SKILL.md", "commands/swap.md"])
-def test_r11_a_payload_file_missing_from_the_pinned_code_changes_nothing(tmp_path, withheld):
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    install_prior(world, home)
-    before = snapshot(home)
-    code = world.code(without=(withheld,))
-    world.assembly(code)
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert snapshot(home) == before, "a refused install changed the prior one"
-    # The refusal is today's all-or-none text, naming the source it could not
-    # complete from: the code the assembly pins, never the assembly root.
-    assert "NOTHING was installed" in result.stderr, result.stderr
-    assert f"opensoft/openRepoTools-code at {code}" in result.stderr, result.stderr
-
-
-#: `--install`'s refusals for a single repository missing files, in the words
-#: `openRepoTools` at `c4864ac` printed them, from `$REPO` at `$REF` as given.
-def single_refusal(withheld: str | list[str], ref: str = "main") -> str:
-    names = withheld if isinstance(withheld, list) else [withheld]
-    if names[0] in INSTALLABLES:
-        return (f"could not fetch {' '.join(names)} from opensoft/openRepoTools at {ref}, so NOTHING was installed\n"
-                "    and nothing already installed was replaced. `--install` places all\n"
-                f"    {len(INSTALLABLES)} files or none: a new openRepoTools beside a missing park is\n"
-                "    a half-install that reads like a whole one. Both ways were tried:\n"
-                f"    gh api repos/opensoft/openRepoTools/contents/<file>?ref={ref}\n"
-                f"    curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/{ref}/<file>\n")
-    return (f"could not fetch one of the {len(SKILLS)} skills ({' '.join(SKILLS)}) or the "
-            f"{len(COMMANDS)} command file ({' '.join(COMMANDS)}) from opensoft/openRepoTools at {ref}, so\n"
-            "    NOTHING was installed and nothing already installed was replaced.\n")
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("withheld", ["park", "skills/restart/SKILL.md"])
-def test_r11_a_single_repository_missing_a_file_refuses_in_the_words_it_always_did(
-        tmp_path, withheld):
-    """#191's review, F1: the single repository's refusal names `$REPO` at
-    `$REF` as given, and not a commit it was never asked to resolve."""
-    world = World(tmp_path)
-    world.single(tag="single", without=(withheld,))
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world), "--install")
-    assert_nothing_placed(home, result)
-    assert result.stderr == "\nREFUSED: " + single_refusal(withheld), result.stderr
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("transport", ["gh", "curl"])
-def test_r11_a_single_repository_at_a_ref_it_lacks_refuses_in_the_words_it_always_did(
-        tmp_path, transport):
-    """A ref the repository does not have: every file 404s, and the refusal
-    names every one of them at that ref, as it always did — not a commit
-    lookup that failed first (#191's review, F1)."""
-    world = World(tmp_path)
-    world.single(tag="single")
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world, gh=transport == "gh"), "--install",
-                       OPENREPOTOOLS_REF="no-such-ref")
-    assert_nothing_placed(home, result)
-    assert result.stderr == "\nREFUSED: " + single_refusal(list(INSTALLABLES), "no-such-ref"), \
-        result.stderr
-    single_layout_requests_only(world, "no-such-ref")
-
-
-@NEEDS_JQ
-def test_r11_a_settings_merge_that_cannot_be_computed_changes_nothing(tmp_path):
-    world = World(tmp_path)
-    home = tmp_path / "home"
-    install_prior(world, home)
-    (home / ".claude" / "settings.json").write_text("{ not json\n", encoding="utf-8")
-    before = snapshot(home)
-    world.assembly(world.code())
-    result = run_stdin(world, home, network(world), "--install")
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert snapshot(home) == before
-    assert "settings.json" in result.stderr, result.stderr
-    assert world.payload_requests(), "the source was resolved before the merge was planned"
-
-
-# =========================================================================
-# ROW 12 — modes, ownership receipts, custom targets, foreign files, hooks
-# =========================================================================
-
-@NEEDS_JQ
-def test_r12_an_adopted_install_keeps_modes_receipts_targets_and_what_is_not_ours(tmp_path):
-    world = World(tmp_path)
-    code = world.code()
-    world.assembly(code)
-    home = tmp_path / "home"
-    bin_dir, profiles, claude, data = (tmp_path / "custom-bin", tmp_path / "profiles",
-                                       tmp_path / "claude", tmp_path / "data")
-    bin_dir.mkdir()
-    (bin_dir / "mytool").write_text("#!/bin/sh\necho mine\n", encoding="utf-8")
-    (bin_dir / "mytool").chmod(0o750)
-    claude.mkdir()
-    # THE PAIR NEEDS A TARGET THAT ANSWERS `guard` (#237): the link
-    # `link-estates` makes, to the `lanes-edit.sh` this install places.
-    xfactory = home / "projects" / "xFactory"
-    xfactory.mkdir(parents=True)
-    (xfactory / "lanes-edit.sh").symlink_to(bin_dir / "lanes-edit.sh")
-    settings = {"theme": "dark", "hooks": {
-        "UserPromptSubmit": [{"hooks": [{"type": "command", "command": "usage-guard check"}]}],
-        "PreToolUse": [{"matcher": "Bash", "hooks": [{"type": "command", "command": "audit"}]}]}}
-    (claude / "settings.json").write_text(json.dumps(settings), encoding="utf-8")
-    result = run_stdin(world, home, network(world), "--install",
-                       OPENREPOTOOLS_BIN_DIR=str(bin_dir), CLAUDE_PROFILES_HOME=str(profiles),
-                       CLAUDE_USER_DIR=str(claude), OPENREPOTOOLS_DATA_DIR=str(data))
-    assert result.returncode == 0, result.stdout + result.stderr
-    placed = destinations(home, bin_dir=bin_dir, profiles=profiles, claude=claude)
-    assert_installed(home, "pinned", result, bin_dir=bin_dir, profiles=profiles, claude=claude)
-    for dest, path in placed.items():
-        want = 0o755 if path in INSTALLABLES else 0o644
-        assert stat.S_IMODE(Path(dest).stat().st_mode) == want, dest
-    rows = [line.split("\t") for line in
-            (data / "installed.tsv").read_text(encoding="utf-8").splitlines() if line]
-    assert {row[1] for row in rows} == set(placed), rows
-    for row in rows:
-        assert row[2] == hashlib.sha256(Path(row[1]).read_bytes()).hexdigest(), row
-    assert len(rows) == len(INSTALLABLES) + 2 * len(SKILLS) + 2 * len(COMMANDS)
-    assert (bin_dir / "mytool").read_text(encoding="utf-8") == "#!/bin/sh\necho mine\n"
-    assert stat.S_IMODE((bin_dir / "mytool").stat().st_mode) == 0o750
-    merged = json.loads((claude / "settings.json").read_text(encoding="utf-8"))
-    assert merged["theme"] == "dark"
-    assert merged["hooks"]["PreToolUse"] == settings["hooks"]["PreToolUse"]
-    commands = [h["command"] for e in merged["hooks"]["UserPromptSubmit"] for h in e["hooks"]]
-    assert "usage-guard check" in commands
-    assert "~/projects/xFactory/lanes-edit.sh guard" in commands
-    assert stat.S_IMODE((claude / "settings.json").stat().st_mode) == 0o600
-
-
-# =========================================================================
-# ROWS 13 AND 14 — `wip init` takes the standard from code's dependency pin
-# =========================================================================
-
-def shape_repository(world: World) -> tuple[str, str]:
-    """`opensoft/openRepoShape` with the pinned standard's real templates at
-    one commit and a DECOY of them on `main`, so a seed taken from the wrong
-    commit is visible in its bytes."""
-    templates = UPSTREAM / "templates" / "workspace-root"
-    files = {}
-    for p in sorted(templates.rglob("*")):
-        if p.is_file():
-            files[f"templates/workspace-root/{p.relative_to(templates).as_posix()}"] = p.read_bytes()
-    repo = world.repo("opensoft/openRepoShape")
-    pinned = commit(repo, files, branch=None, message="pinned standard")
-    decoy = {k: (v + b"\n<!-- DECOY FROM MAIN -->\n" if k.endswith(".md") else v)
-             for k, v in files.items()}
-    main = commit(repo, decoy, message="moved on")
-    return pinned, main
-
-
-def run_installed_wip(world: World, tmp_path: Path,
-                      **extra: str) -> tuple[subprocess.CompletedProcess, Path]:
-    home = tmp_path / "home"
-    bin_dir = home / "bin"
-    bin_dir.mkdir(parents=True)
-    shutil.copy2(COMMAND, bin_dir / "openRepoTools")
-    (home / "projects").mkdir()
-    result = subprocess.run(
-        ["bash", str(bin_dir / "openRepoTools"), "wip", "init", "--login", "brettheap",
-         "--team", "platform", "--org", "opensoft"],
-        input="", capture_output=True, text=True, check=False, cwd=str(home),
-        env=env_for(home, network(world), PROJECTS_DIR=str(home / "projects"),
-                    OPENREPOTOOLS_BIN_DIR=str(bin_dir), **extra))
-    return result, home / "projects" / "brettheap-wip"
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_wip_init_takes_the_standard_from_codes_dependency_pin_not_the_assemblys(tmp_path):
-    """An INSTALLED `openRepoTools` (no checkout beside it) seeding a workspace
-    against an adopted assembly: the template comes from the openRepoShape
-    commit the CODE leg pins in `contracts/openreposhape-pin.yaml` — not a
-    same-named file at the assembly root, and not `main`."""
-    world = World(tmp_path)
-    pinned, moved = shape_repository(world)
-    code = world.code(shape=pinned)
-    world.assembly(code, extra={"contracts/openreposhape-pin.yaml": shape_pin(moved)})
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"template files from opensoft/openRepoShape @ {pinned}" in result.stdout, result.stdout
-    assert "DECOY FROM MAIN" not in (checkout / "README.md").read_text(encoding="utf-8")
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_an_installed_wip_init_whose_source_does_not_answer_seeds_from_main_as_before(
-        tmp_path):
-    """#191's review, F2: an installed `wip init` whose `$REPO` does not answer
-    at all (both transports fail to reach it) takes the standard's `main`, as it
-    always did, rather than refusing at step 7 after steps 5 and 6 made and
-    cloned the repository."""
-    world = World(tmp_path)
-    shape_repository(world)
-    world.single(tag="single")
-    world.faults = [{"tool": "any", "match": r"opensoft/openRepoTools/", "kind": "transport"}]
-    world.write_conf()
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "template files from opensoft/openRepoShape @ main" in result.stdout, result.stdout
-    assert (checkout / "README.md").is_file()
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_an_installed_wip_init_at_a_ref_the_source_lacks_seeds_from_main_as_before(
-        tmp_path):
-    """#191's review, F2: `OPENREPOTOOLS_REF` naming a ref the repository does
-    not have leaves the standard's `main`, as it always did — not a refusal at
-    step 7 after steps 5 and 6 made and cloned the repository."""
-    world = World(tmp_path)
-    shape_repository(world)
-    world.single(tag="single")
-    result, checkout = run_installed_wip(world, tmp_path, OPENREPOTOOLS_REF="no-such-ref")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "template files from opensoft/openRepoShape @ main" in result.stdout, result.stdout
-    assert (checkout / "README.md").is_file()
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_an_installed_wip_init_never_needs_a_single_repositorys_commit_lookup(tmp_path):
-    """#191's review, F2: a 502 on `commits/<ref>` — an endpoint a single
-    repository's `wip init` never asked — changes nothing: the dependency pin
-    is read at the ref as given and the template comes from it."""
-    world = World(tmp_path)
-    pinned, _ = shape_repository(world)
-    world.single(tag="single", shape=pinned)
-    world.faults = [{"tool": "any", "match": r"repos/opensoft/openRepoTools/commits/",
-                     "kind": "status", "status": 502}]
-    world.write_conf()
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"template files from opensoft/openRepoShape @ {pinned}" in result.stdout, result.stdout
-    assert "DECOY FROM MAIN" not in (checkout / "README.md").read_text(encoding="utf-8")
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_an_installed_wip_init_on_a_single_repository_reads_its_pin_as_before(tmp_path):
-    """Today's layout: the dependency pin at `$REPO`'s `contracts/`, at the ref
-    given, by `gh api …/contents` — and no `commits/` or `git/trees/` request
-    for `$REPO`."""
-    world = World(tmp_path)
-    pinned, moved = shape_repository(world)
-    world.single(tag="single", shape=pinned)
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"template files from opensoft/openRepoShape @ {pinned}" in result.stdout, result.stdout
-    assert "DECOY FROM MAIN" not in (checkout / "README.md").read_text(encoding="utf-8")
-    asked = [r["target"] for r in world.requests()
-             if "opensoft/openRepoTools/" in r["target"]]
-    assert asked and all("/contents/" in t and t.endswith("?ref=main") for t in asked), asked
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r13_an_adopted_source_wip_init_cannot_follow_refuses_in_step_7s_words(tmp_path):
-    """An adopted assembly whose pin is wrong refuses at step 7 — after steps 5
-    and 6 made and cloned the repository — so the refusal says what step 7 did
-    not do and keeps what came before, rather than claiming nothing was
-    written (#191's review, F2)."""
-    world = World(tmp_path)
-    pinned, _ = shape_repository(world)
-    code = world.code(shape=pinned)
-    good = PIN_TEXT.format(source="opensoft/openRepoTools-code", path="code", commit=code,
-                           digest=tree_digest(world.repo("opensoft/openRepoTools-code"), code))
-    world.assembly(code, pin=malformed(good, "leg-role"))
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "contracts/code-pin.yaml" in result.stderr, result.stderr
-    assert "Step 7 seeded nothing" in result.stderr, result.stderr
-    assert "nothing was fetched, placed or written" not in result.stderr
-    assert "NOTHING was installed" not in result.stderr
-    assert (checkout / ".git").is_dir(), "step 6's clone is what the refusal keeps"
-    assert not (checkout / "README.md").exists()
-
-
-@NEEDS_TEMPLATES
-@NEEDS_JQ
-def test_r14_with_no_nested_standard_anywhere_the_dependency_pin_alone_selects(tmp_path):
-    """Standalone code with its nested dependency nowhere on disk — the
-    installed copy, the vendored tree: the dependency PIN is what selects the
-    standard, fetched from the code the assembly pins; `main` is only the
-    documented answer when that pin cannot be read at all."""
-    world = World(tmp_path)
-    pinned, moved = shape_repository(world)
-    world.assembly(world.code(shape=pinned))
-    result, checkout = run_installed_wip(world, tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"@ {pinned}" in result.stdout, result.stdout
-    assert moved not in result.stdout
-    assert "DECOY FROM MAIN" not in (checkout / "README.md").read_text(encoding="utf-8")
-
-
-def test_r14_the_documented_upstream_skip_is_unchanged():
-    """Without the submodule the command tests SKIP, naming the one command
-    that fixes it (AGENTS.md, "Testing your changes"); conftest says so."""
-    import conftest
-    # Read from conftest's text: in a composed run `NEEDS_UPSTREAM` is a
-    # fixture that FAILS instead (#190), and the standalone skip is still there.
-    assert "git submodule update --init upstream/openRepoShape" in \
-        Path(conftest.__file__).read_text(encoding="utf-8")
-
-
-@NEEDS_COMPOSED
-def test_r14_composed_acceptance_requires_the_nested_dependency():
-    """Composed acceptance REFUSES an absent dependency rather than skipping
-    it: a mounted code leg without its pinned standard is not the assembled
-    state T015 accepts."""
-    require_composed()
-    assert (UPSTREAM / "scripts" / "repo_shape.py").is_file(), (
-        "the code leg is mounted but its nested openRepoShape is not: run "
-        "`git submodule update --init --recursive` (or `make bootstrap`) at the assembly")
-
-
-# =========================================================================
-# ROW 15 — Linux/macOS bash 3.2, Windows/WSL
-# =========================================================================
-
-BASH4 = [(re.compile(r"\$\{[A-Za-z_][A-Za-z0-9_]*(,,|\^\^)"), "${x,,} / ${x^^}"),
-         (re.compile(r"\bmapfile\b|\breadarray\b"), "mapfile/readarray"),
-         (re.compile(r"\bdeclare\s+-[a-zA-Z]*[An]"), "declare -A / -n"),
-         (re.compile(r"\blocal\s+-n\b"), "local -n"),
-         (re.compile(r"\|&"), "|&"),
-         (re.compile(r"\bcoproc\b"), "coproc"),
-         (re.compile(r"\[\[\s+-v\b"), "[[ -v ]]")]
-
-
-def bash4_constructs(text: str) -> list[str]:
-    found = []
-    for number, line in enumerate(text.splitlines(), 1):
-        code = line.split("#", 1)[0] if not line.lstrip().startswith("#") else ""
-        for pattern, name in BASH4:
-            if pattern.search(code):
-                found.append(f"{number}: {name}: {line.strip()}")
-    return found
-
-
-def test_r15_the_installer_uses_nothing_bash_3_2_lacks():
-    """CI's `parse-macos` parses every shipped file under Apple's bash 3.2;
-    this names the constructs a Linux bash 5 would accept silently."""
-    assert bash4_constructs(SOURCE_TEXT) == []
-    assert subprocess.run(["bash", "-n", str(COMMAND)]).returncode == 0
-
-
-def test_r15_the_three_lists_stay_one_line_arrays_a_consumer_parses():
-    """workBenches' `estate-commands-start` `sed`-reads `INSTALLABLES`,
-    `SKILLS` and `COMMANDS` out of the vendored `openRepoTools` (consumer-reads
-    row W4): one line each, or that step reads nothing."""
-    for name in ("INSTALLABLES", "SKILLS", "COMMANDS"):
-        assert one_line_array(SOURCE_TEXT, name)
-
-
-@NEEDS_JQ
-def test_r15_the_adopted_path_holds_under_macos_one_true_awk(tmp_path):
-    """macOS's awk refuses a newline in an `awk -v` value (exit 2, no output);
-    gawk and mawk accept it, so no Linux job sees it. The adopted resolution
-    runs here under a shim that IS that rule."""
-    real_awk = shutil.which("awk")
-    shim = textwrap.dedent(f"""\
-        #!/bin/sh
-        prev=""
-        for a in "$@"; do
-          if [ "$prev" = "-v" ]; then
-            case "$a" in *'
-        '*) echo "awk: newline in string $a" >&2; exit 2 ;; esac
-          fi
-          prev="$a"
-        done
-        exec '{real_awk}' "$@"
-        """)
-    world = World(tmp_path)
-    world.assembly(world.code())
-    home = tmp_path / "home"
-    result = run_stdin(world, home, network(world, extra_shims={"awk": shim}), "--install")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert_installed(home, "pinned", result)
-
-
-#: THE PIN READER THE ROOT ENTRY POINT CARRIES IS A DELIBERATE COPY of the
-#: implementation's: the root must read the pin before there is an
-#: implementation to ask. Copies that may not drift are compared, here.
-PIN_READER = ("ORT_ALNUM", "ORT_TAB", "ORT_CR", "is_lower_hex", "is_slug",
-              "is_segment", "pin_scalar", "pin_bad", "pin_parse", "recorded_gitlink")
-
-
-def shell_definitions(text: str) -> dict[str, str | None]:
-    out: dict[str, str | None] = {}
-    for name in PIN_READER:
-        if name.isupper():
-            m = re.search(rf"^{name}=.*$", text, re.M)
-        else:
-            m = re.search(rf"^{name}\(\) \{{.*?^\}}\n", text, re.S | re.M)
-        out[name] = m.group(0) if m else None
-    return out
-
-
-@NEEDS_COMPOSED
-def test_r15_composed_the_root_entry_points_pin_reader_is_the_implementations():
-    require_composed()
-    mine = shell_definitions((ASSEMBLY / "openRepoTools").read_text(encoding="utf-8"))
-    theirs = shell_definitions(SOURCE_TEXT)
-    assert all(theirs.values()), theirs
-    assert mine == theirs, [n for n in PIN_READER if mine[n] != theirs[n]]
-
-
-@NEEDS_COMPOSED
-def test_r15_composed_the_root_entry_point_parses_and_uses_nothing_bash_3_2_lacks():
-    require_composed()
-    root = ASSEMBLY / "openRepoTools"
-    assert bash4_constructs(root.read_text(encoding="utf-8")) == []
-    assert subprocess.run(["bash", "-n", str(root)]).returncode == 0
diff --git a/tests/test_install_pipx.py b/tests/test_install_pipx.py
deleted file mode 100644
index a97135a0..00000000
--- a/tests/test_install_pipx.py
+++ /dev/null
@@ -1,1724 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`--install` beside pipx's `openRepoTools`: the link it leaves to pipx, every
-link it still refuses, and every other installer it meets
-(opensoft/openRepoTools#228, User Stories 1 and 3).
-
-pipx places ONE command, `<dir>/openRepoTools`, as a symbolic link into its
-own venv. `--install` must leave that link exactly where it is, place every
-other artifact, and never advise removing it, because it may be the only
-`openRepoTools` on the workstation that can run `--install` at all.
-contracts/pipx-link.md is the rule and contracts/cli-output.md the exact
-lines; this file holds both:
-
-- `test_pipx_link_*`: the twelve layouts pipx 1.11.1, 1.17.8 and 1.18.3 leave
-  under four homes, and the five that are not pipx's link;
-- `test_pipx_skip_*`: the skip line, the count line, the 28 receipt rows, the
-  link left alone by a refusal, a retirement and a later install, and the
-  venv-shaped refusal that prints no `rm` for a link;
-- `test_pipx_offline_*`: a package-mode install that reaches no network and
-  places what a checkout's install places, apart from the link;
-- `test_coexist_*`: pipx's link beside the one-line install, a checkout and a
-  package outside pipx's venv, and the count line that names where the other
-  sixteen now come from and which release is beside the link (research R5),
-  for a single repository and for each layout an assembly gives: the one-line
-  install from an adopted assembly, the code mounted in one, and a code
-  feature worktree;
-- `test_pip_script_*`: pip's console script at `<dir>/openRepoTools`, in both
-  forms pip writes, refused in every mode, and the files that only look like
-  it, placed as today;
-- `test_path_report_*`: the note a package-mode install prints last when the
-  first `openRepoTools` on `PATH` is not its own, and its silence where the
-  package's layout names no `<prefix>` (research R7);
-- `test_pipx_upgrade_*` and `test_pipx_uninstall_*`: a second wheel in the
-  same venv, and the link and the venv gone.
-
-FAKE VENVS, NO PIPX, NO WHEEL. `tests/package_layout.py` lays each venv out
-of this checkout's own files. EVERY PACKAGE RUN HERE IS
-`bash <payload>/openRepoTools`, as the entry module's `exec` runs it, and never
-the console script: `test_entry_*` in `tests/test_package.py` holds that half.
-A one-line install is `bash -s` fed the installer's text, with a fake `gh`
-serving the payload and a `curl` that refuses, so no run reaches a network.
-An assembly's layouts take `World` from `tests/test_install_payload_source.py`,
-whose `gh` and `curl` answer from bare repositories under the test's own
-directory, and that file's `PATH` with no real `gh` or `curl` on it.
-
-THE LINES THE CONTRACTS NAME, AND NO OTHERS. Nothing here compares a whole
-`--install` output or reads a hook-entry line, because another change may add
-lines of its own: opensoft/openRepoTools#237 holds the hook pair back in a
-sandbox `HOME` and says so. The receipt rows are asserted whole, because hook
-entries never had rows.
-
-EVERY PATH IS CANONICAL. Each test resolves its `tmp_path` first, so `<dir>`,
-the `<venv>` a refusal names and the receipt's canonical destinations are one
-spelling of each path, on Linux and under macOS's `/private` alike.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import os
-import re
-import shlex
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-
-import pytest
-
-import package_layout as layout
-from conftest import REPO, WINDOWS_SKIP
-from test_install_payload_source import (World, git, local_assembly, network,
-                                         variant)
-from test_openrepotools_command import (ARTIFACTS, COMMAND, FETCHED,
-                                        HOOK_ENTRIES, INSTALLED, NEEDS_JQ,
-                                        command_env, path_without,
-                                        placed_files, placement_temporaries,
-                                        receipt_path, receipt_rows,
-                                        source_tree)
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP]
-
-# --- the exact lines (contracts/cli-output.md) ------------------------------
-
-#: The skip line, printed where the `openRepoTools:` per-file line would be.
-SKIP_LINE = ("openRepoTools: left to pipx at {link} (a link into pipx's "
-             "openrepotools environment); update it with `pipx upgrade "
-             "openrepotools`, then run `openRepoTools --install` again")
-
-#: The count line of a run from pipx's own environment. The contract spells
-#: it `16 of 17`, which is today's `INSTALLED`, so it is derived from that list
-#: as every count in this suite is.
-PIPX_OWN_COUNT = ("openRepoTools: {placed} of {total} placed in {dir}, "
-                  "and 1 left to pipx")
-
-#: The receipt rows beside pipx's link: every placed regular file but the
-#: link, 28 today (16 + 6 + 6).
-ROWS_BESIDE_THE_LINK = ARTIFACTS - HOOK_ENTRIES - 1
-
-#: A venv-shaped link's entry in `plan_install_targets`' refusal, and the
-#: paragraph that follows the list. Its line breaks are the contract's own.
-VENV_SHAPED_ENTRY = ("    {link} — a link into a Python environment, perhaps "
-                     "pipx's ({venv}), in a layout this installer does not "
-                     "recognise")
-VENV_SHAPED_PARAGRAPH = (
-    "    Leave {link} where it is: it may be the only openRepoTools that can\n"
-    "    run `--install`. Run `pipx reinstall openrepotools`, then "
-    "`openRepoTools --install`\n"
-    "    again, and if this refusal stays, open an issue on "
-    "opensoft/openRepoTools naming\n"
-    "    the layout under {venv}.")
-
-#: Today's link refusal, which every other link still gets: its first line,
-#: the sentence that introduces the `rm -f` line, and the `jq` refusal.
-TARGETS_REFUSAL = ("`--install` places a REGULAR FILE IT CAN WRITE at each of "
-                   "these, and these are")
-CLEAR_THEM = "Clear them, then re-run"
-JQ_REFUSAL = "REFUSED: `--install` needs `jq` to merge its TWO hook entries into"
-
-#: The repository a package-mode install must never need (research R14):
-#: `.invalid` never resolves.
-SENTINEL_REPO = "offline.invalid/sentinel"
-
-#: THE COUNT LINE OF ANY OTHER RUN BESIDE PIPX'S LINK (FR-019): a checkout's,
-#: the one-line install's, or a package's from outside pipx's venv. `{source}`
-#: is where this run's sixteen came from, and `{pipx}` names what is beside
-#: the link. The contract's `the other 16` is the same number as `{placed}`.
-OTHER_SOURCE_COUNT = ("openRepoTools: {placed} of {total} placed in {dir}, "
-                      "and 1 left to pipx; the other {placed} now come from "
-                      "{source}, not from {pipx}")
-
-#: `{pipx}` when the stamp beside pipx's payload passes the reader (`0.0.0`
-#: for an unstamped one), and the clause that takes its place when it fails.
-PIPX_BY_ITS_VERSION = "openrepotools {version}"
-PIPX_STAMP_UNREADABLE = ("the openrepotools beside pipx's link, whose stamp "
-                         "cannot be read")
-#: ...and the words no line may ever say instead (research R5).
-NEVER_SAID = "openrepotools an unreadable stamp"
-
-#: PIP'S CONSOLE SCRIPT AT `<dir>/openRepoTools` (FR-020): design.md Decision
-#: 8's text with `die`'s prefix, the same for both forms pip writes. Its line
-#: breaks and indents are the contract's own.
-PIP_REFUSAL = (
-    "REFUSED: `--install` will not replace {target}: it is pip's console "
-    "script for openrepotools (`pip install --user openrepotools` leaves it "
-    "there), and another installer's command is not this installer's to "
-    "overwrite.\n"
-    "    NOTHING was installed and nothing already installed was replaced.\n"
-    "    pipx is the one package route. To move to it:\n"
-    "        pip uninstall openrepotools\n"
-    "        pipx install openrepotools\n"
-    "        openRepoTools --install")
-
-#: THE PATH REPORT (FR-021), and its form when `type -P` finds nothing, which
-#: is the same up to its last `;`. `{want}` is `<prefix>/bin/openRepoTools`.
-PATH_NOTE = ("openRepoTools: note: the first openRepoTools on your PATH is "
-             "{first}, not this package's {want}, so the release you just "
-             "installed is not the one that runs; put the directory that "
-             "holds pipx's link to it ahead of {first_dir} on PATH")
-PATH_NOTE_NONE = ("openRepoTools: note: the first openRepoTools on your PATH "
-                  "is none, not this package's {want}, so the release you "
-                  "just installed is not the one that runs; put the directory "
-                  "that holds pipx's link to it on PATH")
-NOTE_PREFIX = "openRepoTools: note: "
-
-#: THE TWO RELEASES A COEXISTENCE CAN NAME: the one pipx placed, and another,
-#: which a package outside pipx's venv carries. Two versions, so a line that
-#: names one can never be read as naming the other. Both pass every rule of
-#: contracts/stamp.md.
-PIPX_RELEASE = {"VERSION": "1.1.0", "TAG": "v1.1.0",
-                "COMMIT": "0123456789abcdef0123456789abcdef01234567",
-                "DIGEST": "89abcdef01234567" * 4,
-                "REPOSITORY": "opensoft/openRepoTools-code"}
-OTHER_RELEASE = {"VERSION": "1.2.0rc1", "TAG": "v1.2.0rc1",
-                 "COMMIT": "fedcba98" * 5,
-                 "DIGEST": "0f1e2d3c4b5a6978" * 4,
-                 "REPOSITORY": "opensoft/openRepoTools"}
-
-#: `<repo> @ <ref>` when nothing names them, and a pair that does, with the
-#: variables that name it.
-DEFAULT_SOURCE = ("opensoft/openRepoTools", "main")
-NAMED_SOURCE = ("someone/fork", "v1.2.3")
-SOURCES = {
-    "default-source": (DEFAULT_SOURCE, {}),
-    "named-source": (NAMED_SOURCE, {"OPENREPOTOOLS_REPO": NAMED_SOURCE[0],
-                                    "OPENREPOTOOLS_REF": NAMED_SOURCE[1]}),
-}
-
-# --- the layouts -----------------------------------------------------------
-
-#: contracts/pipx-link.md's rows: the pipx releases the fixtures mirror.
-RELEASES = tuple(layout.PIPX_RELEASES)
-
-#: AND ITS FOUR COLUMNS, each a pipx home under the sandbox `HOME`. The home
-#: with a space is `<tmp>/Library/Application Support/pipx`, macOS's default,
-#: because the sandbox `HOME` is `<tmp>` itself.
-PIPX_HOMES = {
-    "PIPX_HOME": ("custom", "pipx-home"),
-    "dot-local-pipx": (".local", "pipx"),
-    "dot-local-share-pipx": (".local", "share", "pipx"),
-    "home-with-a-space": ("Library", "Application Support", "pipx"),
-}
-
-#: THE TWELVE CASES. The link is absolute in half of them and relative in the
-#: other half, alternating like a chessboard so that every release and every
-#: home meets both forms.
-MATRIX = [
-    pytest.param(release, column, ("absolute", "relative")[(row + col) % 2],
-                 id=f"pipx-{release}-{column}-"
-                    f"{('absolute', 'relative')[(row + col) % 2]}")
-    for row, release in enumerate(RELEASES)
-    for col, column in enumerate(PIPX_HOMES)
-]
-
-#: contracts/pipx-link.md's five negative cases, by the outcome each gets.
-VENV_SHAPED = ("no-payload", "no-pipx-metadata")
-ORDINARY = ("not-in-bin", "chain-of-41-links", "two-link-cycle")
-
-
-def bin_dir(home: Path) -> Path:
-    """`<dir>`: `$OPENREPOTOOLS_BIN_DIR` unset, so `~/.local/bin`, which is
-    also pipx's default `PIPX_BIN_DIR`."""
-    return home / ".local" / "bin"
-
-
-def payload_of(prefix: Path) -> Path:
-    """The one `lib/python*/site-packages/openrepotools/payload` under
-    `prefix`: the directory the entry module runs `openRepoTools` from."""
-    found = sorted(prefix.glob("lib/python*/site-packages/openrepotools/payload"))
-    assert len(found) == 1, f"{prefix} holds {len(found)} payloads: {found}"
-    return found[0]
-
-
-def point(link: Path, target: Path, form: str = "absolute") -> None:
-    """A symbolic link at `link` to `target`, spelled absolute or relative to
-    the link's own directory."""
-    link.parent.mkdir(parents=True, exist_ok=True)
-    value = (os.path.relpath(target, link.parent) if form == "relative"
-             else str(target))
-    link.symlink_to(value)
-
-
-def pipx_install(home: Path, release: str = "1.17.8",
-                 pipx_home: Path | None = None,
-                 form: str = "absolute") -> tuple[Path, Path]:
-    """What `pipx install openrepotools` leaves: the venv under `pipx_home`
-    (by default `~/.local/share/pipx`) and its link in `<dir>`. Returns
-    `(venv, link)`."""
-    venv = layout.pipx_venv(pipx_home or home / ".local" / "share" / "pipx",
-                            release)
-    link = bin_dir(home) / "openRepoTools"
-    point(link, venv / "bin" / "openRepoTools", form)
-    return venv, link
-
-
-def chain(link: Path, final: Path, links: int) -> None:
-    """`links` symbolic links in a row, the first at `link` and the last
-    pointing at `final`; the ones between sit in `<home>/chain`."""
-    between = [link.parent.parent.parent / "chain" / f"hop-{n:02d}"
-               for n in range(1, links)]
-    sequence = [link, *between, final]
-    for here, there in zip(sequence, sequence[1:]):
-        point(here, there)
-    assert sum(p.is_symlink() for p in sequence) == links
-
-
-def broken_link(kind: str, home: Path) -> tuple[Path, Path | None]:
-    """`<dir>/openRepoTools` as one of the five negative cases leaves it.
-    Returns the link, and for a venv-shaped one the venv its refusal names.
-
-    Each starts from a whole pipx venv and takes away exactly one thing the
-    rule asks for, so that one thing is what the refusal answers."""
-    venv, link = pipx_install(home)
-    script = venv / "bin" / "openRepoTools"
-    if kind == "no-payload":
-        (payload_of(venv) / "openRepoTools").unlink()
-        return link, venv
-    if kind == "no-pipx-metadata":
-        (venv / "pipx_metadata.json").unlink()
-        return link, venv
-    link.unlink()
-    if kind == "not-in-bin":
-        elsewhere = venv / "Scripts" / "openRepoTools"
-        elsewhere.parent.mkdir()
-        shutil.copy2(script, elsewhere)
-        point(link, elsewhere)
-    elif kind == "chain-of-41-links":
-        chain(link, script, 41)
-    elif kind == "two-link-cycle":
-        other = home / "cycle" / "openRepoTools"
-        point(other, link)
-        point(link, other)
-    else:
-        raise ValueError(kind)
-    return link, None
-
-
-def installer_for(mode: str, home: Path) -> Path:
-    """An `openRepoTools` that is not pipx's: a checkout's, or the payload of
-    a package installed outside any pipx venv."""
-    if mode == "checkout":
-        return source_tree(home / "checkout") / "openRepoTools"
-    return layout.package_tree(home / "pip-prefix") / "openRepoTools"
-
-
-def pipx_env(home: Path, pipx_home: Path | None = None,
-             extra: dict | None = None) -> dict:
-    """`command_env`, with every `PIPX_*` variable of the caller's shell
-    removed, and `PIPX_HOME` set only where a case passes one: the column
-    of contracts/pipx-link.md's matrix that shows nothing reads it."""
-    env = command_env(home, extra)
-    for name in [n for n in env if n.startswith("PIPX_")]:
-        del env[name]
-    if pipx_home is not None:
-        env["PIPX_HOME"] = str(pipx_home)
-    return env
-
-
-def install(installer: Path, home: Path, env: dict) -> subprocess.CompletedProcess:
-    """`bash <installer> --install`, as the entry module's `exec` runs it."""
-    home.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(["bash", str(installer), "--install"],
-                          capture_output=True, text=True, check=False,
-                          input="", env=env, cwd=str(home))
-
-
-def transcript(result: subprocess.CompletedProcess) -> str:
-    return (f"exit {result.returncode}\n--- stdout\n{result.stdout}"
-            f"--- stderr\n{result.stderr}")
-
-
-def link_state(link: Path) -> tuple:
-    """What "left as it was" means for a link: still a link, the same value,
-    the same inode and the same mtime, so it was neither replaced nor
-    rewritten."""
-    st = os.lstat(link)
-    return (stat.S_ISLNK(st.st_mode), os.readlink(link), st.st_ino,
-            st.st_mtime_ns)
-
-
-def tree_state(top: Path, skip: tuple = (), home: Path | None = None) -> dict:
-    """Every regular file and link under `top`, by relative path: a file as
-    its mode and digest, a link as its value. Paths under `skip` are left
-    out. With `home`, a file's own mention of that home is read as `<HOME>`,
-    so two installs into two homes compare by what they placed."""
-    state: dict = {}
-
-    def skipped(rel: str) -> bool:
-        return any(rel == s or rel.startswith(s + "/") for s in skip)
-
-    for dirpath, dirnames, filenames in os.walk(top):
-        here = Path(dirpath)
-        dirnames[:] = sorted(d for d in dirnames
-                             if not skipped((here / d).relative_to(top).as_posix()))
-        for name in dirnames + sorted(filenames):
-            path = here / name
-            rel = path.relative_to(top).as_posix()
-            if skipped(rel):
-                continue
-            st = os.lstat(path)
-            if stat.S_ISLNK(st.st_mode):
-                state[rel] = ("link", os.readlink(path))
-            elif stat.S_ISREG(st.st_mode):
-                data = path.read_bytes()
-                if home is not None:
-                    data = data.replace(os.fsencode(str(home)), b"<HOME>")
-                state[rel] = ("file", oct(stat.S_IMODE(st.st_mode)),
-                              hashlib.sha256(data).hexdigest())
-    return state
-
-
-def rm_lines_naming(text: str, path: Path) -> list[str]:
-    """Every line of `text` that runs or advises an `rm` and names `path`."""
-    return [line for line in text.splitlines()
-            if re.search(r"\brm\b", line) and str(path) in line]
-
-
-def rm_f_lines(text: str) -> list[str]:
-    """Every `rm -f -- …` line of a refusal."""
-    return [line for line in text.splitlines()
-            if line.strip().startswith("rm -f --")]
-
-
-# --- what each outcome looks like ------------------------------------------
-
-def assert_left_to_pipx(result: subprocess.CompletedProcess, link: Path) -> None:
-    """A run from pipx's own environment: exit 0, the exact skip line and the
-    exact pipx-own count line, once each, and no per-file line and no
-    seventeen-of-seventeen count for `openRepoTools`."""
-    out = result.stdout.splitlines()
-    total = len(INSTALLED)
-    skip = SKIP_LINE.format(link=link)
-    count = PIPX_OWN_COUNT.format(placed=total - 1, total=total, dir=link.parent)
-    assert result.returncode == 0, transcript(result)
-    assert out.count(skip) == 1, f"the skip line, once:\n{skip}\n{transcript(result)}"
-    assert out.count(count) == 1, f"the count line, once:\n{count}\n{transcript(result)}"
-    for verb in ("installed at", "updated at", "already installed at"):
-        assert not [line for line in out
-                    if line.startswith(f"openRepoTools: {verb}")], (
-            f"openRepoTools was placed although it is pipx's:\n{transcript(result)}")
-    assert f"openRepoTools: {total} of {total} placed" not in result.stdout
-
-
-def assert_rows_beside_the_link(home: Path, link: Path) -> None:
-    """The 28 rows: one for every placed regular file but the link, each
-    with the digest of the bytes now at its destination."""
-    rows = receipt_rows(home)
-    expected = placed_files(home)
-    expected.pop(str(link))
-    assert len(rows) == ROWS_BESIDE_THE_LINK == len(expected), (
-        f"{len(rows)} rows:\n" + receipt_path(home).read_text(encoding="utf-8"))
-    assert {row[1] for row in rows} == set(expected)
-    for name, destination, digest, _utc in rows:
-        assert name == expected[destination], destination
-        assert digest == hashlib.sha256(
-            Path(destination).read_bytes()).hexdigest(), destination
-
-
-def assert_refused_before_placing(result: subprocess.CompletedProcess,
-                                  home: Path, left: set) -> None:
-    """Exit 2, one `REFUSED:`, and nothing placed: `<dir>` holds what the
-    fixture put there and nothing else, and no skill, command file, hook
-    entry or receipt exists."""
-    assert result.returncode == 2, transcript(result)
-    assert result.stderr.count("REFUSED:") == 1, transcript(result)
-    assert {p.name for p in bin_dir(home).iterdir()} == left, transcript(result)
-    for made in (home / ".claude", home / ".claude-profiles", receipt_path(home)):
-        assert not made.exists(), f"{made} was made by a refused run"
-
-
-def assert_ordinary_link_refusal(result: subprocess.CompletedProcess,
-                                 link: Path) -> None:
-    """Today's refusal of a link, unchanged: the entry naming it, and the
-    `rm -f` line naming it alone."""
-    lines = result.stderr.splitlines()
-    assert TARGETS_REFUSAL in result.stderr, transcript(result)
-    assert f"    {link} — a symlink to {os.readlink(link)}" in lines, transcript(result)
-    assert CLEAR_THEM in result.stderr, transcript(result)
-    assert rm_f_lines(result.stderr) == [f'        rm -f -- "{link}"'], (
-        transcript(result))
-
-
-def assert_venv_shaped_refusal(result: subprocess.CompletedProcess, link: Path,
-                               venv: Path, others: tuple = ()) -> None:
-    """contracts/cli-output.md's entry and paragraph, and no `rm` for the
-    link. With no other bad target there is no "Clear them" and no `rm -f`
-    line at all; with others, the `rm -f` line names only them."""
-    venv = Path(os.path.realpath(venv))
-    err = result.stderr
-    entry = VENV_SHAPED_ENTRY.format(link=link, venv=venv)
-    paragraph = VENV_SHAPED_PARAGRAPH.format(link=link, venv=venv)
-    assert entry in err.splitlines(), f"the entry:\n{entry}\n{transcript(result)}"
-    assert paragraph in err, f"the paragraph:\n{paragraph}\n{transcript(result)}"
-    assert err.index(paragraph) > err.index(entry), "the paragraph follows the list"
-    assert rm_lines_naming(result.stdout + err, link) == [], transcript(result)
-    if not others:
-        assert CLEAR_THEM not in err, transcript(result)
-        assert rm_f_lines(err) == [], transcript(result)
-        return
-    assert CLEAR_THEM in err, transcript(result)
-    (line,) = rm_f_lines(err)
-    assert shlex.split(line)[3:] == [str(o) for o in others], transcript(result)
-
-
-# --- test_pipx_link_: the matrix and its negative cases --------------------
-
-@pytest.mark.parametrize("release, column, form", MATRIX)
-@NEEDS_JQ
-def test_pipx_link_is_recognised_in_every_layout_pipx_leaves(tmp_path, release,
-                                                             column, form):
-    """THE TWELVE LAYOUTS, RECOGNISED THE SAME WAY (contracts/pipx-link.md,
-    SC-007): three pipx releases, each with its venv under `$PIPX_HOME`,
-    `~/.local/pipx`, `~/.local/share/pipx` and a home whose path holds a
-    space, linked absolute or relative. Run from that venv's own payload,
-    each prints the exact skip line and the pipx-own count line, writes the
-    28 rows, and leaves the link and the venv as they were.
-
-    `PIPX_HOME` is set only in its own column, so the other nine show the
-    rule finds the venv from the link alone.
-    """
-    home = tmp_path.resolve()
-    pipx_home = home.joinpath(*PIPX_HOMES[column])
-    venv, link = pipx_install(home, release, pipx_home, form)
-    env = pipx_env(home, pipx_home if column == "PIPX_HOME" else None)
-    assert ("PIPX_HOME" in env) == (column == "PIPX_HOME")
-    before = link_state(link), tree_state(venv)
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(result, link)
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-    assert_rows_beside_the_link(home, link)
-    assert placement_temporaries(home) == []
-
-
-@NEEDS_JQ
-def test_pipx_link_followed_through_forty_links_is_still_pipx_s_link(tmp_path):
-    """THE HOP LIMIT'S OTHER SIDE. `link_resolve` fails only past 40 hops
-    (contracts/pipx-link.md), so a chain of exactly 40 links ending at pipx's
-    console script is still pipx's link: skipped, and left as it was, with
-    every link of the chain."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.18.3")
-    link.unlink()
-    chain(link, venv / "bin" / "openRepoTools", 40)
-    hops = sorted((home / "chain").iterdir())
-    before = [link_state(p) for p in (link, *hops)]
-
-    result = install(payload_of(venv) / "openRepoTools", home, pipx_env(home))
-    assert_left_to_pipx(result, link)
-    assert [link_state(p) for p in (link, *hops)] == before
-    assert_rows_beside_the_link(home, link)
-
-
-@pytest.mark.parametrize("mode", ["checkout", "package"])
-@pytest.mark.parametrize("kind", VENV_SHAPED + ORDINARY)
-def test_pipx_link_refuses_what_is_not_pipx_s_link_before_placing_anything(
-        tmp_path, kind, mode):
-    """THE FIVE NEGATIVE CASES, IN TWO MODES (contracts/pipx-link.md). Each
-    refuses in the planning phase and places nothing, from a checkout's
-    `openRepoTools` and from a package's outside any pipx venv:
-
-    - a venv with no `openrepotools/payload/openRepoTools`, and one with no
-      `pipx_metadata.json`: both hold `pyvenv.cfg`, so each is refused as
-      venv-shaped, naming the venv, with no `rm` advice for the link;
-    - a link to a console script that is not in a `bin/`, a chain of 41
-      links, and a two-link cycle: none is pipx's link or venv-shaped, so
-      each gets today's refusal, `rm -f` line and all.
-
-    The link is left as it was in every case.
-    """
-    home = tmp_path.resolve()
-    installer = installer_for(mode, home)
-    link, venv = broken_link(kind, home)
-    before = link_state(link)
-
-    result = install(installer, home, pipx_env(home))
-    assert_refused_before_placing(result, home, {"openRepoTools"})
-    if venv is not None:
-        assert_venv_shaped_refusal(result, link, venv)
-    else:
-        assert_ordinary_link_refusal(result, link)
-    assert link_state(link) == before
-
-
-# --- test_pipx_skip_: the skip, and the refusals beside it -----------------
-
-@NEEDS_JQ
-def test_pipx_skip_leaves_pipx_s_link_and_places_every_other_artifact(tmp_path):
-    """THE SKIP ITSELF (FR-016, User Story 1 scenario 1). Run from pipx's own
-    environment: the exact skip line, the other sixteen files placed from
-    the payload at 755, the skills and command files placed, the exact
-    pipx-own count line and 28 receipt rows, with no row for the link. The
-    link, its console script and the rest of the venv are as they were."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.17.8")
-    payload = payload_of(venv)
-    before = link_state(link), tree_state(venv)
-
-    result = install(payload / "openRepoTools", home, pipx_env(home))
-    assert_left_to_pipx(result, link)
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-    out = result.stdout.splitlines()
-    for name in INSTALLED:
-        if name == "openRepoTools":
-            continue
-        target = bin_dir(home) / name
-        assert f"{name}: installed at {target}" in out, transcript(result)
-        assert not target.is_symlink() and target.is_file(), name
-        assert stat.S_IMODE(target.stat().st_mode) == 0o755, name
-        assert target.read_bytes() == (payload / name).read_bytes(), name
-    for destination, name in placed_files(home).items():
-        if destination == str(link):
-            continue
-        if name.startswith("/"):
-            source = payload / "commands" / f"{name[1:]}.md"
-        elif destination.endswith("/SKILL.md"):
-            source = payload / "skills" / name / "SKILL.md"
-        else:
-            source = payload / name
-        assert Path(destination).read_bytes() == source.read_bytes(), destination
-    assert_rows_beside_the_link(home, link)
-    assert (f"receipt: {ROWS_BESIDE_THE_LINK} placed files recorded in "
-            f"{receipt_path(home)}") in out, transcript(result)
-    assert placement_temporaries(home) == []
-
-
-def test_pipx_skip_a_second_link_is_refused_with_today_s_rm_for_it_alone(tmp_path):
-    """EVERY OTHER LINK STILL REFUSES (FR-017, User Story 1 scenario 4).
-    Beside pipx's link, `<dir>/park` is a link too. The install refuses in
-    the planning phase, naming `park` with today's entry and an `rm -f` line
-    for `park` alone: pipx's link is neither listed nor offered for removal,
-    and neither link is touched."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.18.3")
-    mine = home / "my-own" / "park"
-    mine.parent.mkdir()
-    mine.write_text("#!/usr/bin/env bash\necho my own park\n", encoding="utf-8")
-    park = bin_dir(home) / "park"
-    point(park, mine)
-    before = link_state(link), link_state(park)
-
-    result = install(payload_of(venv) / "openRepoTools", home, pipx_env(home))
-    assert_refused_before_placing(result, home, {"openRepoTools", "park"})
-    assert_ordinary_link_refusal(result, park)
-    assert f"    {link} — " not in result.stderr, (
-        f"pipx's link was listed as a bad target:\n{transcript(result)}")
-    assert rm_lines_naming(result.stdout + result.stderr, link) == [], (
-        transcript(result))
-    assert (link_state(link), link_state(park)) == before
-
-
-def test_pipx_skip_a_venv_shaped_link_is_refused_without_rm_advice(tmp_path):
-    """A LINK INTO A PYTHON ENVIRONMENT THAT FAILS THE RULE (FR-017, the
-    "future pipx layout" edge case). The venv is macOS's, under
-    `~/Library/Application Support/pipx`, linked relative, and holds a whole
-    payload and `pyvenv.cfg` but no `pipx_metadata.json`: the layout
-    `pip install openrepotools` leaves in a plain venv. A checkout's install
-    refuses with contracts/cli-output.md's entry and paragraph, the venv's
-    spaced path in both, and prints neither "Clear them" nor any `rm` line,
-    because that link may be the only `openRepoTools` that can run
-    `--install`."""
-    home = tmp_path.resolve()
-    pipx_home = home.joinpath(*PIPX_HOMES["home-with-a-space"])
-    venv, link = pipx_install(home, "1.18.3", pipx_home, "relative")
-    (venv / "pipx_metadata.json").unlink()
-    installer = installer_for("checkout", home)
-    before = link_state(link), tree_state(venv)
-
-    result = install(installer, home, pipx_env(home))
-    assert_refused_before_placing(result, home, {"openRepoTools"})
-    assert_venv_shaped_refusal(result, link, venv)
-    assert (link_state(link), tree_state(venv)) == before
-
-
-def test_pipx_skip_a_venv_shaped_link_is_left_out_of_another_link_s_rm(tmp_path):
-    """THE `rm -f` LINE NAMES ONLY THE OTHER BAD TARGETS (contracts/cli-output.md).
-    A venv-shaped link at `<dir>/openRepoTools` and an ordinary link at
-    `<dir>/park`: both are listed, the paragraph follows the list, and the
-    one `rm -f` line names `park` and not the venv-shaped link."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.11.1")
-    (payload_of(venv) / "openRepoTools").unlink()
-    mine = home / "my-own" / "park"
-    mine.parent.mkdir()
-    mine.write_text("#!/usr/bin/env bash\necho my own park\n", encoding="utf-8")
-    park = bin_dir(home) / "park"
-    point(park, mine)
-    installer = installer_for("package", home)
-    before = link_state(link), link_state(park)
-
-    result = install(installer, home, pipx_env(home))
-    assert_refused_before_placing(result, home, {"openRepoTools", "park"})
-    assert f"    {park} — a symlink to {mine}" in result.stderr.splitlines(), (
-        transcript(result))
-    assert_venv_shaped_refusal(result, link, venv, others=(park,))
-    assert (link_state(link), link_state(park)) == before
-
-
-def test_pipx_skip_without_jq_ends_in_the_jq_refusal_and_no_rm_for_the_link(
-        tmp_path):
-    """NO `jq`, AND PIPX'S LINK IN PLACE (FR-018, User Story 1 scenario 5).
-    The link is recognised before any link refusal, so the run reaches the
-    `jq` check where it stands and ends in that refusal, unchanged. Nothing
-    is placed, no link refusal is printed, and no line advises an `rm` of
-    the link."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.17.8")
-    before = link_state(link)
-    env = pipx_env(home, extra={"PATH": path_without(home, "jq")})
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_refused_before_placing(result, home, {"openRepoTools"})
-    assert JQ_REFUSAL in result.stderr, transcript(result)
-    assert "there is no `jq` on this PATH" in result.stderr, transcript(result)
-    assert TARGETS_REFUSAL not in result.stderr, transcript(result)
-    assert rm_lines_naming(result.stdout + result.stderr, link) == [], (
-        transcript(result))
-    assert link_state(link) == before
-
-
-@NEEDS_JQ
-def test_pipx_skip_a_restart_retirement_leaves_the_link(tmp_path):
-    """THE RETIREMENT NEVER REACHES PIPX'S LINK (FR-016). A `restart` this
-    installer once placed is retired in the same run that skips the link:
-    `restart` goes, said out loud, and the link stays exactly as it was,
-    named by no `RETIRED` line and no `rm`."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.17.8")
-    stale = bin_dir(home) / "restart"
-    stale.write_text(
-        "#!/usr/bin/env bash\n"
-        "# SPDX-License-Identifier: Apache-2.0\n"
-        "#\n"
-        "# restart — the word this installer used to place.\n"
-        "#\n"
-        "# Installed on PATH by `openRepoTools --install`, which is where it came from.\n"
-        "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    before = link_state(link), tree_state(venv)
-
-    result = install(payload_of(venv) / "openRepoTools", home, pipx_env(home))
-    assert_left_to_pipx(result, link)
-    assert not stale.exists(), transcript(result)
-    assert "restart: RETIRED" in result.stdout, transcript(result)
-    assert not [line for line in result.stdout.splitlines()
-                if line.startswith("openRepoTools: RETIRED")], transcript(result)
-    assert rm_lines_naming(result.stdout + result.stderr, link) == [], (
-        transcript(result))
-    assert (link_state(link), tree_state(venv)) == before
-    assert_rows_beside_the_link(home, link)
-
-
-def test_pipx_skip_no_retired_word_is_openrepotools():
-    """WHY THE RETIREMENT CANNOT NAME THE LINK (contracts/pipx-link.md):
-    `retire_commands` walks `RETIRED` alone, and `RETIRED` does not hold
-    `openRepoTools`. Read out of the script, because no run can show a word
-    the list does not carry."""
-    found = re.findall(r"^RETIRED=\(([^)\n]*)\)$",
-                       COMMAND.read_text(encoding="utf-8"), re.MULTILINE)
-    assert len(found) == 1, f"{COMMAND} defines RETIRED {len(found)} times"
-    words = found[0].split()
-    assert words, "RETIRED is empty; this test is proving less than it says"
-    assert "openRepoTools" not in words, words
-
-
-@NEEDS_JQ
-def test_pipx_skip_a_later_install_leaves_the_link_and_changes_nothing(tmp_path):
-    """A SECOND `--install` FROM THE SAME VENV (FR-016, FR-022). The link is
-    skipped again with the same two lines, the sixteen are already
-    installed and unchanged, the receipt still holds 28 rows, one per
-    destination, and the link and the venv are as they were before the
-    first run."""
-    home = tmp_path.resolve()
-    venv, link = pipx_install(home, "1.11.1")
-    installer = payload_of(venv) / "openRepoTools"
-    before = link_state(link), tree_state(venv)
-    first = install(installer, home, pipx_env(home))
-    assert_left_to_pipx(first, link)
-
-    second = install(installer, home, pipx_env(home))
-    assert_left_to_pipx(second, link)
-    out = second.stdout.splitlines()
-    for name in INSTALLED:
-        if name != "openRepoTools":
-            target = bin_dir(home) / name
-            assert f"{name}: already installed at {target} (unchanged)" in out, (
-                transcript(second))
-    assert (link_state(link), tree_state(venv)) == before
-    assert_rows_beside_the_link(home, link)
-    assert len({row[1] for row in receipt_rows(home)}) == ROWS_BESIDE_THE_LINK
-
-
-# --- test_pipx_offline_: the package install, offline ----------------------
-
-def refusing_network(root: Path) -> tuple[str, Path]:
-    """A `PATH` whose first `gh` and `curl` fail, each recording that it was
-    called. Returns the `PATH` and the record, which no offline run makes."""
-    fake = root / "refusing-network"
-    fake.mkdir()
-    calls = root / "network-calls.log"
-    for tool in ("gh", "curl"):
-        (fake / tool).write_text(
-            "#!/bin/sh\n"
-            f"printf '%s %s\\n' {tool} \"$*\" >> '{calls}'\n"
-            f"printf 'fake {tool}: this install must reach no network\\n' >&2\n"
-            "exit 1\n", encoding="utf-8")
-        (fake / tool).chmod(0o755)
-    return f"{fake}{os.pathsep}{os.environ['PATH']}", calls
-
-
-@pytest.mark.parametrize("release", RELEASES)
-@NEEDS_JQ
-def test_pipx_offline_a_package_install_places_what_a_checkout_does_but_the_link(
-        tmp_path, release):
-    """FROM INSIDE THE PACKAGE, AND NO NETWORK (FR-008, User Story 1
-    scenario 1). A package-mode `--install` from pipx's venv, with
-    `OPENREPOTOOLS_REPO=offline.invalid/sentinel` and a `gh` and a `curl`
-    that fail, succeeds without calling either. Beside it, a checkout's
-    install into a second home, under the same settings. Every file and
-    link the two placed is the same, in bytes and mode, apart from
-    `<dir>/openRepoTools`, which is the checkout's file in one and pipx's
-    untouched link in the other; and the receipts hold the same rows, apart
-    from the checkout's row for that file.
-    """
-    root = tmp_path.resolve()
-    path, calls = refusing_network(root)
-    offline = {"OPENREPOTOOLS_REPO": SENTINEL_REPO, "PATH": path}
-
-    package_home = root / "package-home"
-    venv, link = pipx_install(package_home, release)
-    before = link_state(link)
-    package = install(payload_of(venv) / "openRepoTools", package_home,
-                      pipx_env(package_home, extra=offline))
-    assert_left_to_pipx(package, link)
-    assert link_state(link) == before
-
-    checkout_home = root / "checkout-home"
-    checkout = install(source_tree(root / "checkout") / "openRepoTools",
-                       checkout_home, pipx_env(checkout_home, extra=offline))
-    assert checkout.returncode == 0, transcript(checkout)
-    assert not calls.exists(), (
-        "an install reached for the network:\n" + calls.read_text(encoding="utf-8"))
-
-    the_link = link.relative_to(package_home).as_posix()
-    receipt = receipt_path(package_home).relative_to(package_home).as_posix()
-    pipx_tree = venv.parent.parent.relative_to(package_home).as_posix()
-    got = tree_state(package_home, (pipx_tree, receipt, the_link), package_home)
-    want = tree_state(checkout_home, (receipt, the_link), checkout_home)
-    assert got == want, (
-        f"placed by the checkout only: {sorted(set(want) - set(got))}\n"
-        f"placed by the package only: {sorted(set(got) - set(want))}\n"
-        f"placed differently: "
-        f"{sorted(k for k in set(got) & set(want) if got[k] != want[k])}")
-    assert (checkout_home / the_link).is_file()
-    assert not (checkout_home / the_link).is_symlink()
-
-    def rows(home: Path) -> set:
-        return {(name, Path(dest).relative_to(home).as_posix(), digest)
-                for name, dest, digest, _utc in receipt_rows(home)}
-
-    package_rows, checkout_rows = rows(package_home), rows(checkout_home)
-    assert package_rows - checkout_rows == set(), (
-        f"rows only the package wrote: {sorted(package_rows - checkout_rows)}")
-    assert checkout_rows - package_rows == {(
-        "openRepoTools", the_link,
-        hashlib.sha256((checkout_home / the_link).read_bytes()).hexdigest())}
-    assert len(package_rows) == ROWS_BESIDE_THE_LINK
-
-
-# --- the other installers (User Story 3) -----------------------------------
-
-def stamp_of(payload: Path) -> Path:
-    """The stamp beside a payload: its `openrepotools/_release.py`."""
-    return payload.parent / "_release.py"
-
-
-#: WHAT THE STAMP BESIDE PIPX'S PAYLOAD CAN BE: the committed one, a
-#: release's, and one fixture for each of contracts/cli-output.md's three
-#: causes. The one that cannot be read is a directory, which no account reads
-#: as a file, so that case holds for root too.
-PIPX_SIDES = ("unstamped", "stamped", "cannot-be-read", "is-partial",
-              "is-malformed")
-
-
-def give_pipx_a_stamp(venv: Path, side: str) -> str:
-    """Make the stamp beside `venv`'s payload what `side` names, and return
-    what the count line says after "not from" (FR-019): `openrepotools
-    <VERSION>` for a stamp the reader accepts, `0.0.0` for the unstamped one,
-    and the unreadable-stamp clause for one it refuses. That stamp belongs to
-    another install, so a run beside it goes on either way."""
-    stamp = stamp_of(payload_of(venv))
-    if side == "unstamped":
-        assert stamp.read_bytes() == layout.STAMP_SOURCE.read_bytes(), (
-            "the fixture is wrong: pipx's venv does not hold the committed stamp")
-        return PIPX_BY_ITS_VERSION.format(version="0.0.0")
-    if side == "stamped":
-        stamp.write_bytes(layout.stamp_text(**PIPX_RELEASE).encode("utf-8"))
-        return PIPX_BY_ITS_VERSION.format(version=PIPX_RELEASE["VERSION"])
-    if side == "cannot-be-read":
-        stamp.unlink()
-        stamp.mkdir()
-    elif side == "is-partial":
-        stamp.write_bytes(layout.stamp_text(
-            **{**PIPX_RELEASE, "DIGEST": ""}).encode("utf-8"))
-    elif side == "is-malformed":
-        stamp.write_bytes(layout.stamp_text(
-            **{**PIPX_RELEASE, "TAG": "v1.2.0"}).encode("utf-8"))
-    else:
-        raise ValueError(side)
-    return PIPX_STAMP_UNREADABLE
-
-
-def mark(tree: Path, note: str) -> None:
-    """`# <note>` appended to every payload file under `tree`, so that its
-    bytes are its own and each placement can be traced to the tree it came
-    from. A comment line after everything else, so each file still does what
-    it did: bash never reads past the installer's final `exit 0`."""
-    for rel in FETCHED:
-        path = tree / rel
-        path.write_bytes(path.read_bytes() + f"# {note}\n".encode("utf-8"))
-
-
-def github_serving(root: Path, source: Path) -> Path:
-    """A directory whose `gh` answers as GitHub answers for a single
-    repository: each payload file `<P>` under `contents/<P>?ref=…`, from
-    `source`, and the code pin `contracts/code-pin.yaml` as GitHub's 404
-    (#186). Anything else it is asked, it refuses, and its `curl` refuses
-    everything, so a run reaches no network whatever it asks. Returns the
-    directory, to go first on `PATH`."""
-    fake = root / "fake-github"
-    fake.mkdir(parents=True)
-    routes = "".join(
-        f"*/contents/{rel}\\?*) exec cat {shlex.quote(str(source / rel))} ;;\n"
-        for rel in FETCHED)
-    routes += ("*/contents/contracts/code-pin.yaml\\?*) "
-               "printf 'gh: Not Found (HTTP 404)\\n' >&2; exit 1 ;;\n")
-    (fake / "gh").write_text(
-        "#!/bin/sh\n"
-        'case "$*" in\n' + routes + "esac\n"
-        "printf 'fake gh: unexpected call: %s\\n' \"$*\" >&2\n"
-        "exit 1\n", encoding="utf-8")
-    (fake / "curl").write_text(
-        "#!/bin/sh\n"
-        "printf 'fake curl: no test here may reach the network\\n' >&2\n"
-        "exit 1\n", encoding="utf-8")
-    for tool in ("gh", "curl"):
-        (fake / tool).chmod(0o755)
-    return fake
-
-
-def with_github(env: dict, root: Path, source: Path = REPO) -> dict:
-    """`env`, with `github_serving(root, source)` first on its `PATH`."""
-    fake = github_serving(root, source)
-    return {**env, "PATH": f"{fake}{os.pathsep}{env['PATH']}"}
-
-
-def install_piped(home: Path, env: dict,
-                  script: Path = COMMAND) -> subprocess.CompletedProcess:
-    """The one-line install: `script`'s text piped into `bash -s -- --install`,
-    run in `home`, which holds nothing named `bash`, so `$SELF` is no file and
-    every payload file is fetched."""
-    home.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(["bash", "-s", "--", "--install"],
-                          capture_output=True, text=True, check=False,
-                          input=script.read_text(encoding="utf-8"), env=env,
-                          cwd=str(home))
-
-
-#: THE THREE WAYS AN `--install` RUNS THAT ARE NOT PIPX'S OWN: a checkout's,
-#: the one-line install's, and a package's from outside any pipx venv.
-MODES = ("checkout", "one-line-install", "package")
-
-
-def install_as(how: str, root: Path, home: Path,
-               env: dict) -> subprocess.CompletedProcess:
-    """`--install` into `home`, run as `how` names, from a tree under `root`
-    that holds this checkout's bytes."""
-    if how == "checkout":
-        return install(source_tree(root / "checkout") / "openRepoTools", home,
-                       env)
-    if how == "one-line-install":
-        return install_piped(home, with_github(env, root / "github"))
-    if how == "package":
-        return install(layout.package_tree(root / "pip-prefix")
-                       / "openRepoTools", home, env)
-    raise ValueError(how)
-
-
-def source_of(tree: Path, destination: str, name: str) -> Path:
-    """The file under `tree` that a placed `destination` comes from: a command
-    file, a skill or one of the seventeen, by the name `--install` printed."""
-    if name.startswith("/"):
-        return tree / "commands" / f"{name[1:]}.md"
-    if destination.endswith("/SKILL.md"):
-        return tree / "skills" / name / "SKILL.md"
-    return tree / name
-
-
-def file_state(path: Path) -> tuple:
-    """A file as a test compares it: its type, mode, inode, mtime and bytes."""
-    st = os.lstat(path)
-    return (stat.S_IFMT(st.st_mode), stat.S_IMODE(st.st_mode), st.st_ino,
-            st.st_mtime_ns, path.read_bytes())
-
-
-def assert_placed_from(home: Path, link: Path, tree: Path) -> None:
-    """Every file an install beside `link` places holds `tree`'s bytes: the
-    sixteen as regular files at 755, the skills and command files beside
-    them."""
-    for destination, name in placed_files(home).items():
-        if destination == str(link):
-            continue
-        path = Path(destination)
-        assert path.is_file() and not path.is_symlink(), destination
-        assert path.read_bytes() == source_of(tree, destination,
-                                              name).read_bytes(), (
-            f"{destination} does not hold the bytes of {tree}")
-        if path.parent == link.parent:
-            assert stat.S_IMODE(path.stat().st_mode) == 0o755, destination
-
-
-def assert_beside_the_link(result: subprocess.CompletedProcess, link: Path,
-                           source: str, pipx: str) -> None:
-    """Any run but pipx's own, beside pipx's link (FR-019): exit 0, the exact
-    skip line and the exact other-source count line once each, naming
-    `source` and, after "not from", `pipx`. Not the pipx-own line, not a
-    seventeen-of-seventeen count, no per-file line for `openRepoTools`, and
-    never "openrepotools an unreadable stamp" anywhere."""
-    out = result.stdout.splitlines()
-    total = len(INSTALLED)
-    skip = SKIP_LINE.format(link=link)
-    count = OTHER_SOURCE_COUNT.format(placed=total - 1, total=total,
-                                      dir=link.parent, source=source,
-                                      pipx=pipx)
-    own = PIPX_OWN_COUNT.format(placed=total - 1, total=total, dir=link.parent)
-    assert result.returncode == 0, transcript(result)
-    assert out.count(skip) == 1, f"the skip line, once:\n{skip}\n{transcript(result)}"
-    assert out.count(count) == 1, (
-        f"the count line, once:\n{count}\n{transcript(result)}")
-    assert own not in out, (
-        f"the line of a run from pipx's own environment:\n{transcript(result)}")
-    for verb in ("installed at", "updated at", "already installed at"):
-        assert not [line for line in out
-                    if line.startswith(f"openRepoTools: {verb}")], (
-            f"openRepoTools was placed although it is pipx's:\n{transcript(result)}")
-    assert f"openRepoTools: {total} of {total} placed" not in result.stdout
-    assert NEVER_SAID not in result.stdout + result.stderr, transcript(result)
-
-
-# --- test_coexist_: pipx's link beside the other installers ----------------
-
-@NEEDS_JQ
-def test_coexist_pipx_install_force_over_the_one_line_install_then_install_replaces_the_sixteen(
-        tmp_path):
-    """US3 SCENARIO 1, THE MOVE FROM THE ONE-LINE INSTALL (FR-024). The
-    one-line install places all seventeen from an older release. Then
-    `pipx install --force openrepotools` puts pipx's link where that
-    `openRepoTools` was, which is what `--force` is for, and `--install` runs
-    from the venv's payload. The link is skipped with the exact skip line
-    and the pipx-own count line; each of the other sixteen, and each skill
-    and command file, is UPDATED to the package's bytes; the link and the
-    venv are as they were; and the receipt holds the 28 rows, the one-line
-    install's row for `<dir>/openRepoTools` gone with the file it was about.
-    """
-    root = tmp_path.resolve()
-    home = root / "home"
-    older = source_tree(root / "older-release")
-    mark(older, "an older release, as the one-line install fetched it")
-    env = pipx_env(home)
-    one_line = install_piped(home, with_github(env, root / "github", older),
-                             older / "openRepoTools")
-    assert one_line.returncode == 0, transcript(one_line)
-    link = bin_dir(home) / "openRepoTools"
-    assert not link.is_symlink() and link.read_bytes() == (
-        older / "openRepoTools").read_bytes(), transcript(one_line)
-    assert len(receipt_rows(home)) == ARTIFACTS - HOOK_ENTRIES
-
-    # `pipx install --force openrepotools`: the venv, and its link in place
-    # of the one-line install's file.
-    venv = layout.pipx_venv(home / ".local" / "share" / "pipx", "1.17.8")
-    link.unlink()
-    point(link, venv / "bin" / "openRepoTools")
-    payload = payload_of(venv)
-    before = link_state(link), tree_state(venv)
-
-    result = install(payload / "openRepoTools", home, env)
-    assert_left_to_pipx(result, link)
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-    out = result.stdout.splitlines()
-    for destination, name in placed_files(home).items():
-        if destination != str(link):
-            assert f"{name}: updated at {destination}" in out, transcript(result)
-    assert_placed_from(home, link, payload)
-    assert_rows_beside_the_link(home, link)
-    assert placement_temporaries(home) == []
-
-
-@pytest.mark.parametrize("side", PIPX_SIDES)
-@pytest.mark.parametrize("source", SOURCES)
-@pytest.mark.parametrize("how", ["checkout", "one-line-install"])
-@NEEDS_JQ
-def test_coexist_a_checkout_or_the_one_line_install_names_its_source_and_pipx_s_release(
-        tmp_path, how, source, side):
-    """US3 SCENARIO 2 (FR-019). A checkout's `--install`, and the one-line
-    install's, beside pipx's link: the link is skipped, the other sixteen
-    are placed from the run's own source, and the count line is exactly
-    contracts/cli-output.md's other-source line. It names that source as
-    `<repo> @ <ref>`, `opensoft/openRepoTools @ main` where nothing names
-    them, and the release beside the link by the `VERSION` of the stamp
-    beside pipx's payload: `0.0.0` for an unstamped one, the release's for a
-    stamped one. A stamp there that fails the reader ends the line in
-    `the openrepotools beside pipx's link, whose stamp cannot be read`, for
-    each of the three causes, and the install goes on; no output ever reads
-    "openrepotools an unreadable stamp".
-
-    pipx's payload carries bytes of its own, so the sixteen being the
-    source's bytes shows they came from the run and not from the venv.
-    """
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3")
-    clause = give_pipx_a_stamp(venv, side)
-    mark(payload_of(venv), "pipx's release, which this run does not place")
-    before = link_state(link), tree_state(venv)
-    (repo, ref), named = SOURCES[source]
-
-    result = install_as(how, root, home, pipx_env(home, extra=named))
-    assert_beside_the_link(result, link, f"{repo} @ {ref}", clause)
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-    assert_placed_from(home, link, REPO)
-    assert_rows_beside_the_link(home, link)
-
-
-@pytest.mark.parametrize("side", ["unstamped", "stamped", "is-partial"])
-@pytest.mark.parametrize("own", ["unstamped", "stamped"])
-@pytest.mark.parametrize("where", ["a-prefix", "another-pipx-venv"])
-@NEEDS_JQ
-def test_coexist_a_package_outside_pipx_s_venv_names_its_own_release_never_repo_and_ref(
-        tmp_path, where, own, side):
-    """US3 SCENARIO 7 (FR-019, research R5). A package-mode `--install` from a
-    package outside the venv pipx's link resolves into, beside that link: a
-    `package_tree` under a plain prefix, as pip leaves one, and one inside
-    another pipx venv. The link is skipped, the sixteen are this package's
-    bytes, and the count line names the package's own release from its own
-    stamp, `openrepotools <its VERSION>`, as the source. It never names
-    `<repo> @ <ref>`, though `$OPENREPOTOOLS_REPO` and `$OPENREPOTOOLS_REF`
-    are set: a package never fetched from them. After "not from" it names
-    the stamp beside pipx's payload, as every other run beside the link
-    does."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.17.8")
-    clause = give_pipx_a_stamp(venv, side)
-    text = None if own == "unstamped" else layout.stamp_text(**OTHER_RELEASE)
-    version = "0.0.0" if own == "unstamped" else OTHER_RELEASE["VERSION"]
-    if where == "a-prefix":
-        payload = layout.package_tree(root / "pip-prefix", stamp=text)
-    else:
-        payload = payload_of(layout.pipx_venv(root / "another-pipx-home",
-                                              "1.11.1", stamp=text))
-    mark(payload, "the package this run is")
-    before = link_state(link), tree_state(venv)
-
-    result = install(payload / "openRepoTools", home,
-                     pipx_env(home, extra=SOURCES["named-source"][1]))
-    assert_beside_the_link(result, link, f"openrepotools {version}", clause)
-    for pair in (NAMED_SOURCE, DEFAULT_SOURCE):
-        assert " @ ".join(pair) not in result.stdout, (
-            f"a package named a source it never fetched:\n{transcript(result)}")
-    assert (link_state(link), tree_state(venv)) == before
-    assert_placed_from(home, link, payload)
-    assert_rows_beside_the_link(home, link)
-
-
-#: THE CODE LEG an assembly's `contracts/code-pin.yaml` names, as
-#: `tests/test_install_payload_source.py` builds both: the repository the
-#: sixteen come from once `opensoft/openRepoTools` is the assembly.
-CODE_LEG = "opensoft/openRepoTools-code"
-
-
-@NEEDS_JQ
-def test_coexist_the_one_line_install_from_an_adopted_assembly_names_the_pinned_code(
-        tmp_path):
-    """US3 SCENARIO 2 AFTER THE CUTOVER (FR-019, research R5). The one-line
-    install, beside pipx's link, from `opensoft/openRepoTools` at `main`,
-    which is an assembly whose `contracts/code-pin.yaml` pins the code leg.
-    The sixteen are fetched from `opensoft/openRepoTools-code` at the pinned
-    commit, so the count line names that pair, `<PAYLOAD_REPO> @
-    <PAYLOAD_REV>`, and never `opensoft/openRepoTools @ main`, the source
-    the run was given."""
-    root = tmp_path.resolve()
-    world = World(root / "github-world")
-    code = world.code()
-    world.assembly(code)
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3")
-    clause = give_pipx_a_stamp(venv, "stamped")
-    before = link_state(link), tree_state(venv)
-
-    result = install_piped(home, pipx_env(home, extra={"PATH": network(world)}))
-    assert_beside_the_link(result, link, f"{CODE_LEG} @ {code}", clause)
-    assert " @ ".join(DEFAULT_SOURCE) not in result.stdout, transcript(result)
-    assert (bin_dir(home) / "park").read_bytes() == variant("park", "pinned"), (
-        f"the sixteen are not the pinned code's bytes:\n{transcript(result)}")
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-
-
-@NEEDS_JQ
-def test_coexist_the_code_mounted_in_an_assembly_names_the_pin_s_own_pair(
-        tmp_path):
-    """THE CODE LEG MOUNTED IN AN ASSEMBLY CHECKOUT, `<assembly>/code`, run
-    by its own `openRepoTools` beside pipx's link. Its payload is checked
-    against the pin and fetched from nowhere, so nothing sets `PAYLOAD_REPO`
-    or `PAYLOAD_REV`, and the count line names the pin's own pair,
-    `<PIN_SOURCE_REPOSITORY> @ <PIN_COMMIT>` (contracts/cli-output.md's
-    `<source>`): `opensoft/openRepoTools-code` at the commit the assembly
-    pins, the pair a remote adopted run names."""
-    root = tmp_path.resolve()
-    world = World(root / "github-world")
-    _assembly, code, pinned = local_assembly(world)
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3")
-    clause = give_pipx_a_stamp(venv, "stamped")
-    before = link_state(link), tree_state(venv)
-
-    result = install(code / "openRepoTools", home,
-                     pipx_env(home, extra={"PATH": network(world)}))
-    assert_beside_the_link(result, link, f"{CODE_LEG} @ {pinned}", clause)
-    assert world.requests() == [], (
-        f"the mounted code asked the fake GitHub: {world.requests()}")
-    assert (bin_dir(home) / "park").read_bytes() == variant("park", "local"), (
-        f"the sixteen are not the mounted code's bytes:\n{transcript(result)}")
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-
-
-@NEEDS_JQ
-def test_coexist_a_code_feature_worktree_names_repo_and_ref_never_the_pin(
-        tmp_path):
-    """A PAIRED FEATURE WORKTREE, `<assembly>/worktrees/<NNN>/code`, run by
-    its own `openRepoTools` beside pipx's link. It installs its own bytes and
-    is not an adopted source, so the count line names `<REPO> @ <REF>` as
-    any other checkout does, `opensoft/openRepoTools @ main` where nothing
-    names them (contracts/cli-output.md's `<source>`). It never names the
-    pin's pair, `opensoft/openRepoTools-code @ <PIN_COMMIT>`: that is the
-    code the assembly pins, which this run did not install."""
-    root = tmp_path.resolve()
-    world = World(root / "github-world")
-    assembly, code, pinned = local_assembly(world)
-    feature = assembly / "worktrees" / "001-x" / "code"
-    git("clone", "-q", str(code), str(feature))
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3")
-    clause = give_pipx_a_stamp(venv, "stamped")
-    before = link_state(link), tree_state(venv)
-
-    result = install(feature / "openRepoTools", home,
-                     pipx_env(home, extra={"PATH": network(world)}))
-    assert_beside_the_link(result, link, " @ ".join(DEFAULT_SOURCE), clause)
-    assert f"{CODE_LEG} @ {pinned}" not in result.stdout, transcript(result)
-    assert world.requests() == [], (
-        f"the feature worktree asked the fake GitHub: {world.requests()}")
-    assert (link_state(link), tree_state(venv)) == before, (
-        "the install wrote through pipx's link or into its venv")
-
-
-# --- test_pip_script_: pip's console script at <dir>/openRepoTools ----------
-
-#: contracts/pipx-link.md's fixtures: the three forms of pip's own script,
-#: refused, and five files that only look like it, placed as today.
-PIP_S_SCRIPTS = ("pip-s-shebang", "pip-s-trampoline-quoted-with-a-space",
-                 "pip-s-trampoline-unquoted-and-long")
-NOT_PIP_S = ("a-bash-shebang", "a-trampoline-to-ruby",
-             "a-sh-file-with-no-exec-line",
-             "a-python-script-importing-another-package", "this-installer")
-
-
-def lines_of(path: Path) -> list:
-    return path.read_text(encoding="utf-8").split("\n")
-
-
-def put_fixture(target: Path, root: Path, which: str) -> None:
-    """`<dir>/openRepoTools` as fixture `which` leaves it, at 0755, each
-    checked to be the shape contracts/pipx-link.md names, so that a case
-    proves what it says. Interpreters are paths under `root`, never run."""
-    python = f"{root}/pyenv/bin/python3.12"
-    if which == "pip-s-shebang":
-        layout.console_script(target, python, form="shebang")
-        assert lines_of(target)[:3] == [
-            f"#!{python}", "import sys", "from openrepotools.cli import main"]
-    elif which == "pip-s-trampoline-quoted-with-a-space":
-        spaced = f"{root}/py env/bin/python3"
-        layout.console_script(target, spaced, form="trampoline")
-        assert lines_of(target)[:3] == [
-            "#!/bin/sh", f"'''exec' \"{spaced}\" \"$0\" \"$@\"", "' '''"]
-    elif which == "pip-s-trampoline-unquoted-and-long":
-        long = f"{root}/{'p' * max(8, 130 - len(str(root)))}/bin/python3"
-        assert len(long) > 127 and " " not in long
-        layout.console_script(target, long, form="trampoline")
-        assert lines_of(target)[:3] == [
-            "#!/bin/sh", f"'''exec' {long} \"$0\" \"$@\"", "' '''"]
-    elif which == "a-bash-shebang":
-        layout.console_script(target, "/bin/bash", form="shebang")
-        assert lines_of(target)[:3] == [
-            "#!/bin/bash", "import sys", "from openrepotools.cli import main"]
-    elif which == "a-trampoline-to-ruby":
-        ruby = f"{root}/x/bin/ruby"
-        layout.console_script(target, f'"{ruby}"', form="trampoline")
-        assert lines_of(target)[:3] == [
-            "#!/bin/sh", f"'''exec' \"{ruby}\" \"$0\" \"$@\"", "' '''"]
-    elif which == "a-sh-file-with-no-exec-line":
-        layout.console_script(target, "/bin/sh", form="shebang")
-        lines = lines_of(target)
-        assert lines[0] == "#!/bin/sh"
-        assert "from openrepotools.cli import main" in lines
-        assert not [line for line in lines if line.startswith("'''exec'")]
-    elif which == "a-python-script-importing-another-package":
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text(f"#!{python}\n" + layout.SCRIPT_TEMPLATE % {
-            "module": "openreposhape.cli", "import_name": "main",
-            "func": "main"}, encoding="utf-8")
-        target.chmod(0o755)
-        assert "from openreposhape.cli import main" in lines_of(target)
-    elif which == "this-installer":
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_bytes(COMMAND.read_bytes())
-        target.chmod(0o755)
-    else:
-        raise ValueError(which)
-    assert stat.S_IMODE(target.stat().st_mode) == 0o755
-
-
-def assert_pip_s_refusal(result: subprocess.CompletedProcess, home: Path,
-                         target: Path, before: tuple) -> None:
-    """FR-020's refusal, in the planning phase: exit 2, stderr exactly
-    contracts/cli-output.md's text after `die`'s blank line, nothing placed,
-    and pip's script exactly as it was."""
-    assert_refused_before_placing(result, home, {"openRepoTools"})
-    expected = "\n" + PIP_REFUSAL.format(target=target) + "\n"
-    assert result.stderr == expected, (
-        f"stderr is not exactly the pip refusal:\n{expected}\n"
-        f"{transcript(result)}")
-    assert file_state(target) == before, "pip's console script was touched"
-
-
-def assert_placed_over(result: subprocess.CompletedProcess, home: Path,
-                       target: Path, was: bytes) -> None:
-    """PLACED AS TODAY: exit 0, `<dir>/openRepoTools` replaced by this
-    installer's own bytes at 755 (or left as it was, where it already was
-    them), today's count line, and a row for it among the 29."""
-    total = len(INSTALLED)
-    out = result.stdout.splitlines()
-    assert result.returncode == 0, transcript(result)
-    verb = (f"already installed at {target} (unchanged)"
-            if was == COMMAND.read_bytes() else f"updated at {target}")
-    assert f"openRepoTools: {verb}" in out, transcript(result)
-    assert f"openRepoTools: {total} of {total} placed in {target.parent}" in out
-    assert target.is_file() and not target.is_symlink()
-    assert stat.S_IMODE(target.stat().st_mode) == 0o755
-    assert target.read_bytes() == COMMAND.read_bytes()
-    assert len(receipt_rows(home)) == ARTIFACTS - HOOK_ENTRIES
-    assert str(target) in {row[1] for row in receipt_rows(home)}
-
-
-@pytest.mark.parametrize("how", MODES)
-@pytest.mark.parametrize("which", PIP_S_SCRIPTS)
-def test_pip_script_is_refused_in_every_mode_and_nothing_is_placed(
-        tmp_path, which, how):
-    """US3 SCENARIO 3 (FR-020): pip's console script at `<dir>/openRepoTools`,
-    as `pip install --user openrepotools` writes it, in each form pip writes:
-    a Python shebang; the `/bin/sh` trampoline with a quoted interpreter path
-    that holds a space; and the trampoline with an unquoted interpreter path
-    longer than 127 characters. A checkout's `--install`, the one-line
-    install's and a package's from outside any venv each refuse in the
-    planning phase with the exact refusal, place nothing, and leave pip's
-    script as it was."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    target = bin_dir(home) / "openRepoTools"
-    put_fixture(target, root, which)
-    before = file_state(target)
-
-    result = install_as(how, root, home, pipx_env(home))
-    assert_pip_s_refusal(result, home, target, before)
-
-
-@pytest.mark.parametrize("form", ["shebang", "trampoline"])
-def test_pip_script_a_package_whose_own_command_is_pip_s_script_is_refused(
-        tmp_path, form):
-    """IN EVERY MODE, PIP'S OWN INCLUDED (FR-020). `pip install --user
-    openrepotools` puts the package under the user base, `~/.local`, and its
-    console script at `~/.local/bin/openRepoTools`, which is `<dir>`'s. That
-    script's own run, `bash <payload>/openRepoTools --install` as the entry
-    module execs it, is refused with the exact refusal and places nothing:
-    over its own command as over anyone else's. pip's own choice of form,
-    for an interpreter at a short path and at one that holds a space."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    payload = layout.package_tree(home / ".local", "python3.12")
-    python = ("/usr/bin/python3.12" if form == "shebang"
-              else f"{root}/Python Framework/bin/python3.12")
-    target = bin_dir(home) / "openRepoTools"
-    layout.console_script(target, python)
-    assert (lines_of(target)[0] == "#!/bin/sh") == (form == "trampoline")
-    assert "from openrepotools.cli import main" in lines_of(target)
-    before = file_state(target)
-
-    result = install(payload / "openRepoTools", home, pipx_env(home))
-    assert_pip_s_refusal(result, home, target, before)
-
-
-@pytest.mark.parametrize("how", MODES)
-@pytest.mark.parametrize("which", NOT_PIP_S)
-@NEEDS_JQ
-def test_pip_script_what_only_looks_like_pip_s_script_is_placed_as_today(
-        tmp_path, which, how):
-    """THE RULE IS BOTH HALVES (contracts/pipx-link.md): a Python interpreter,
-    in one of pip's two forms, AND the import of `openrepotools`. So each of
-    these is placed over as today, in every mode: the shebang form with
-    `#!/bin/bash`; a trampoline that `exec`s ruby; a `#!/bin/sh` file with
-    the import and no `'''exec'` line; a Python script that imports another
-    package (pip's own script for `openreposhape`); and this installer's own
-    bash file."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    target = bin_dir(home) / "openRepoTools"
-    put_fixture(target, root, which)
-    was = target.read_bytes()
-
-    result = install_as(how, root, home, pipx_env(home))
-    assert_placed_over(result, home, target, was)
-
-
-@pytest.mark.parametrize("which", ["the-import-on-line-20",
-                                   "the-import-on-line-21",
-                                   "an-indented-import"])
-@NEEDS_JQ
-def test_pip_script_the_import_counts_at_column_0_in_the_first_20_lines(
-        tmp_path, which):
-    """THE IMPORT'S RULE, AT ITS EDGES (contracts/pipx-link.md, rule 2): one of
-    the first 20 lines matches `^from openrepotools(\\.<name>)* import `, at
-    column 0, as pip's template writes it. A Python script whose import is
-    line 20 is pip's and refused; one whose import is line 21 is not, and
-    is placed over; and so is one whose only import is indented, which pip
-    never writes (research R6)."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    target = bin_dir(home) / "openRepoTools"
-    python = f"{root}/pyenv/bin/python3.12"
-    if which == "an-indented-import":
-        lines = [f"#!{python}", "import sys", "if __name__ == '__main__':",
-                 "    from openrepotools.cli import main", "    sys.exit(main())"]
-        refused = False
-    else:
-        at = int(which.rsplit("-", 1)[1])
-        lines = ([f"#!{python}"] + [f"# line {n}" for n in range(2, at)]
-                 + ["from openrepotools.cli import main", "import sys",
-                    "sys.exit(main())"])
-        assert lines[at - 1] == "from openrepotools.cli import main"
-        refused = at <= 20
-    target.parent.mkdir(parents=True)
-    target.write_text("\n".join(lines) + "\n", encoding="utf-8")
-    target.chmod(0o755)
-    before = file_state(target)
-
-    result = install_as("checkout", root, home, pipx_env(home))
-    if refused:
-        assert_pip_s_refusal(result, home, target, before)
-    else:
-        assert_placed_over(result, home, target, before[-1])
-
-
-# --- test_path_report_: the openRepoTools a shell will run -----------------
-
-def a_path(root: Path, *ahead: Path) -> str:
-    """A `PATH` of `ahead`, in order, then every tool the suite's own `PATH`
-    carries except `openRepoTools`: so the first `openRepoTools` on it is one
-    a case put there, or none at all, whatever the workstation has."""
-    farm = path_without(root, "openRepoTools")
-    return os.pathsep.join([*(str(p) for p in ahead), farm])
-
-
-def notes(result: subprocess.CompletedProcess) -> list:
-    return [line for line in result.stdout.splitlines()
-            if line.startswith(NOTE_PREFIX)]
-
-
-def assert_the_note(result: subprocess.CompletedProcess, note: str) -> None:
-    """FR-021: the exact note, once, on stdout, as the run's last line (it
-    runs last in a package-mode `--install`), with the exit status of an
-    install that succeeded: the report changes nothing."""
-    assert result.returncode == 0, transcript(result)
-    assert "REFUSED:" not in result.stderr, transcript(result)
-    assert notes(result) == [note], (
-        f"the note, once:\n{note}\n{transcript(result)}")
-    assert result.stdout.splitlines()[-1] == note, (
-        f"the PATH report is not the run's last line:\n{transcript(result)}")
-
-
-@NEEDS_JQ
-def test_path_report_names_an_older_openrepotools_ahead_on_path(tmp_path):
-    """US3 SCENARIO 4, THE FIRST FIXTURE: an older bash `openRepoTools`, in a
-    directory ahead of `<dir>` on `PATH`. After a package-mode `--install`
-    from pipx's venv, the note names that file as the first on `PATH`, and
-    `<venv>/bin/openRepoTools` as this package's, and says to put pipx's
-    link's directory ahead of that one. The exit status is the install's."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.17.8")
-    older = root / "older-bin" / "openRepoTools"
-    older.parent.mkdir()
-    older.write_bytes(COMMAND.read_bytes()
-                      + b"# an older openRepoTools, which a shell runs first\n")
-    older.chmod(0o755)
-    env = pipx_env(home, extra={"PATH": a_path(root, older.parent,
-                                                bin_dir(home))})
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(result, link)
-    assert_the_note(result, PATH_NOTE.format(
-        first=older, want=venv / "bin" / "openRepoTools",
-        first_dir=older.parent))
-
-
-@NEEDS_JQ
-def test_path_report_names_this_installer_s_copy_when_pipx_s_bin_dir_is_elsewhere(
-        tmp_path):
-    """THE SECOND FIXTURE: `PIPX_BIN_DIR`'s link is in a directory other than
-    `$OPENREPOTOOLS_BIN_DIR`, and that directory is not on `PATH`. So
-    `<dir>` holds no link, the install places all seventeen there with
-    today's count line, and the first `openRepoTools` on `PATH` is the bash
-    file it just placed in `<dir>`: the note names it, and the package's
-    `<venv>/bin/openRepoTools`. pipx's own link is left as it was."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv = layout.pipx_venv(home / ".local" / "share" / "pipx", "1.18.3")
-    pipx_bin = home / "pipx-bin"
-    pipx_link = pipx_bin / "openRepoTools"
-    point(pipx_link, venv / "bin" / "openRepoTools")
-    before = link_state(pipx_link)
-    target_dir = bin_dir(home)
-    target_dir.mkdir(parents=True)
-    env = pipx_env(home, extra={"PATH": a_path(root, target_dir),
-                                "OPENREPOTOOLS_BIN_DIR": str(target_dir)})
-    env["PIPX_BIN_DIR"] = str(pipx_bin)
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    total = len(INSTALLED)
-    placed = target_dir / "openRepoTools"
-    assert (f"openRepoTools: {total} of {total} placed in {target_dir}"
-            in result.stdout.splitlines()), transcript(result)
-    assert placed.is_file() and not placed.is_symlink()
-    assert_the_note(result, PATH_NOTE.format(
-        first=placed, want=venv / "bin" / "openRepoTools",
-        first_dir=target_dir))
-    assert link_state(pipx_link) == before
-
-
-@NEEDS_JQ
-def test_path_report_says_none_when_no_openrepotools_is_on_path(tmp_path):
-    """THE THIRD FIXTURE: no `openRepoTools` on `PATH` at all, `<dir>` among
-    the absent. The note is its `none` form, which cannot name a directory
-    to put ahead of, and it comes after the `export PATH` note, last."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.11.1")
-    env = pipx_env(home, extra={"PATH": a_path(root)})
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(result, link)
-    note = PATH_NOTE_NONE.format(want=venv / "bin" / "openRepoTools")
-    assert_the_note(result, note)
-    out = result.stdout.splitlines()
-    export = f'    export PATH="{link.parent}:$PATH"'
-    assert export in out, transcript(result)
-    assert out.index(export) < out.index(note)
-
-
-@pytest.mark.parametrize("column, form", [("dot-local-share-pipx", "absolute"),
-                                          ("home-with-a-space", "relative")])
-@NEEDS_JQ
-def test_path_report_says_nothing_when_pipx_s_link_is_first_on_path(
-        tmp_path, column, form):
-    """THE FOURTH FIXTURE: pipx's link is the first `openRepoTools` on
-    `PATH`, and it resolves to this package's `<venv>/bin/openRepoTools`, so
-    there is no note. Both sides go through `link_resolve`, so a relative
-    link into a venv under a home whose path holds a space is the same file."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3", home.joinpath(*PIPX_HOMES[column]),
-                              form)
-    env = pipx_env(home, extra={"PATH": a_path(root, link.parent)})
-
-    result = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(result, link)
-    assert notes(result) == [], transcript(result)
-
-
-#: LAYOUTS THAT NAME NO `<prefix>` (research R7): a package's own
-#: `openrepotools/` under directories that are not `lib/python*/site-packages`,
-#: each wrong in one of the names `path_report` reads above it. The fourth
-#: name, `openrepotools`, is one package mode itself requires (design.md
-#: Decision 4), so no package-mode run reaches the skip that reads it.
-NO_PREFIX = {
-    "dist-packages": ("lib", "python3.12", "dist-packages"),
-    "a-pypy-directory": ("lib", "pypy3.10", "site-packages"),
-    "lib64": ("lib64", "python3.12", "site-packages"),
-}
-
-
-def package_under(prefix: Path, *between: str) -> Path:
-    """A `package_tree`'s `openrepotools/`, every byte and mode kept, moved to
-    `<prefix>/<between…>/openrepotools/`. Returns its `payload/`."""
-    built = layout.package_tree(prefix.parent / f"{prefix.name}-built")
-    package = prefix.joinpath(*between, "openrepotools")
-    package.parent.mkdir(parents=True)
-    built.parent.rename(package)
-    return package / "payload"
-
-
-@pytest.mark.parametrize("shape", NO_PREFIX)
-@NEEDS_JQ
-def test_path_report_says_nothing_where_the_layout_names_no_prefix(tmp_path,
-                                                                  shape):
-    """THE SILENT SKIP (research R7, contracts/cli-output.md). A package whose
-    directories above `openrepotools/` are not `lib/python*/site-packages`
-    names no `<prefix>`, so there is no `<prefix>/bin/openRepoTools` to
-    compare the first `openRepoTools` on `PATH` with, and the report prints
-    nothing. No `openRepoTools` is on `PATH`, which in R7's shape is the
-    `none` note (`test_path_report_says_none_when_no_openrepotools_is_on_path`).
-    The run is in package mode, as its `--version` shows, and the install
-    exits 0 with today's count line: the skip changes nothing else."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    payload = package_under(root / "prefix", *NO_PREFIX[shape])
-    env = pipx_env(home, extra={"PATH": a_path(root)})
-    home.mkdir()
-    version = subprocess.run(["bash", str(payload / "openRepoTools"),
-                              "--version"], capture_output=True, text=True,
-                             check=False, input="", env=env, cwd=str(home))
-    assert (version.returncode, version.stdout.splitlines()[:1]) == (
-        0, ["openRepoTools 0.0.0 (an unstamped package)"]), (
-        f"the fixture is wrong: not a package-mode run:\n{transcript(version)}")
-
-    result = install(payload / "openRepoTools", home, env)
-    total = len(INSTALLED)
-    assert result.returncode == 0, transcript(result)
-    assert "REFUSED:" not in result.stderr, transcript(result)
-    assert (f"openRepoTools: {total} of {total} placed in {bin_dir(home)}"
-            in result.stdout.splitlines()), transcript(result)
-    assert notes(result) == [], transcript(result)
-
-
-@NEEDS_JQ
-def test_path_report_is_a_package_s_report_and_a_checkout_prints_none(tmp_path):
-    """THE REPORT BELONGS TO A PACKAGE-MODE `--install` (FR-021). A checkout's
-    `--install`, with no `openRepoTools` on `PATH` before it ran, places its
-    own `openRepoTools` and prints no note, because it has no package
-    whose console script could be the one expected."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    env = pipx_env(home, extra={"PATH": a_path(root)})
-
-    result = install_as("checkout", root, home, env)
-    assert result.returncode == 0, transcript(result)
-    assert notes(result) == [], transcript(result)
-
-
-# --- test_pipx_upgrade_: a second wheel in the same venv --------------------
-
-@NEEDS_JQ
-def test_pipx_upgrade_a_second_wheel_replaces_the_sixteen_and_the_link_is_still_skipped(
-        tmp_path):
-    """US3 SCENARIO 5 (FR-022). One release installed by pipx and placed by
-    `--install`; then `pipx upgrade openrepotools` puts a second package, with
-    payload bytes of its own, in the same venv. Until `--install` runs
-    again, nothing it placed has moved. Then it does: each of the sixteen, the
-    skills and the command files is UPDATED to the second package's bytes,
-    the link is skipped with the same two lines and left as it was, and the
-    28 rows carry the new digests."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    pipx_home = home / ".local" / "share" / "pipx"
-    venv = layout.pipx_venv(pipx_home, "1.17.8",
-                            stamp=layout.stamp_text(**PIPX_RELEASE))
-    link = bin_dir(home) / "openRepoTools"
-    point(link, venv / "bin" / "openRepoTools")
-    env = pipx_env(home)
-    first = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(first, link)
-    before = link_state(link)
-    pipx_tree = pipx_home.relative_to(home).as_posix()
-    placed_by_the_first = tree_state(home, (pipx_tree,))
-
-    # `pipx upgrade openrepotools`: the second wheel's package, in this venv.
-    second_release = {**PIPX_RELEASE, "VERSION": "1.2.0", "TAG": "v1.2.0"}
-    assert layout.pipx_venv(pipx_home, "1.17.8", stamp=layout.stamp_text(
-        **second_release)) == venv
-    mark(payload_of(venv), "the second wheel")
-    assert tree_state(home, (pipx_tree,)) == placed_by_the_first, (
-        "something placed changed before `--install` ran again")
-
-    second = install(payload_of(venv) / "openRepoTools", home, env)
-    assert_left_to_pipx(second, link)
-    assert link_state(link) == before
-    out = second.stdout.splitlines()
-    for destination, name in placed_files(home).items():
-        if destination != str(link):
-            assert f"{name}: updated at {destination}" in out, transcript(second)
-    assert_placed_from(home, link, payload_of(venv))
-    assert_rows_beside_the_link(home, link)
-
-
-# --- test_pipx_uninstall_: the link and the venv gone ----------------------
-
-@NEEDS_JQ
-def test_pipx_uninstall_leaves_what_was_placed_and_a_checkout_then_places_a_regular_file(
-        tmp_path):
-    """US3 SCENARIO 6 (FR-023). `pipx uninstall openrepotools` removes its link
-    and its venv, and nothing else: the sixteen, the skills, the command
-    files, `settings.json` and the receipt are as the install left them.
-    A checkout's `--install` then places a regular `openRepoTools` at the
-    freed path, with today's count line and a row for it among the 29."""
-    root = tmp_path.resolve()
-    home = root / "home"
-    venv, link = pipx_install(home, "1.18.3")
-    first = install(payload_of(venv) / "openRepoTools", home, pipx_env(home))
-    assert_left_to_pipx(first, link)
-    pipx_tree = venv.parent.parent.relative_to(home).as_posix()
-    the_link = link.relative_to(home).as_posix()
-    kept = tree_state(home, (pipx_tree, the_link))
-
-    # `pipx uninstall openrepotools`: its link and its venv.
-    link.unlink()
-    shutil.rmtree(venv)
-    assert not os.path.lexists(link) and not venv.exists()
-    assert tree_state(home, (pipx_tree, the_link)) == kept
-    assert_placed_from(home, link, REPO)
-    assert len(receipt_rows(home)) == ROWS_BESIDE_THE_LINK
-
-    result = install_as("checkout", root, home, pipx_env(home))
-    total = len(INSTALLED)
-    out = result.stdout.splitlines()
-    assert result.returncode == 0, transcript(result)
-    assert f"openRepoTools: installed at {link}" in out, transcript(result)
-    assert f"openRepoTools: {total} of {total} placed in {link.parent}" in out
-    assert "left to pipx" not in result.stdout, transcript(result)
-    assert link.is_file() and not link.is_symlink()
-    assert stat.S_IMODE(link.stat().st_mode) == 0o755
-    assert link.read_bytes() == COMMAND.read_bytes()
-    for name in INSTALLED:
-        if name != "openRepoTools":
-            target = link.parent / name
-            assert f"{name}: already installed at {target} (unchanged)" in out
-    rows = receipt_rows(home)
-    assert len(rows) == ARTIFACTS - HOOK_ENTRIES
-    assert ("openRepoTools", str(link), hashlib.sha256(
-        link.read_bytes()).hexdigest()) in {row[:3] for row in rows}
diff --git a/tests/test_install_skill_and_hook.py b/tests/test_install_skill_and_hook.py
deleted file mode 100644
index b0bd4032..00000000
--- a/tests/test_install_skill_and_hook.py
+++ /dev/null
@@ -1,1503 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`--install`'s artifacts that are not one of the SEVENTEEN files: the three
-skills at two paths each, the three command files at two more each, and the
-TWO merged hook entries.
-
-lane-collision-protocol Amendment 9(b), inheriting A8 Addendum 2's R-A8-5
-unvaried — the skill into the SHARED skills directory every profile reads
-through its own symlink, a copy into `~/.claude` for a bare `claude` run
-outside the launcher, and the merged entries in `~/.claude/settings.json`:
-the `SessionStart` one, and — since Amendment 12 adoption act 3
-(opensoft/openRepoTools#25) — the `UserPromptSubmit` NAME GUARD beside it.
-
-WHY THE HOOKS ARE THE HARD ONES, and why most of this file is about them. Every
-other thing `--install` places is a whole file, so "already there and
-identical" is a `cmp`. A hook is one entry inside a file somebody else owns
-and two other programs also write, and its ONLY idempotence is an exact match
-on the command string. So the tests below are about the four answers that
-string can have — present, absent, differing, unreadable — asked of EACH entry,
-and about the one rule that makes a wrong answer survivable: both merges are
-computed with the seventeen files in hand, BEFORE any of them is placed, so a
-refusal costs a whole install rather than half of one — and, since the pair,
-a settings file never passes through a state carrying one entry of the two.
-
-NO NETWORK: every run here is from the checkout, so nothing is fetched at all.
-"""
-
-from __future__ import annotations
-
-import json
-import os
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-from test_openrepotools_command import (COMMAND, command_env, run_cmd,
-                                        COMMAND_NAMES, COMMAND_PATHS,
-                                        INSTALLED, NEEDS_JQ, SKILL_NAMES,
-                                        SKILL_PATH, link_xfactory)
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP]
-
-#: The hook entry, byte for byte Amendment 8 clause (e)'s and byte for byte
-#: what opensoft/workBenches#63's launcher ensures in each profile. Spelled
-#: once here and compared against the command's own copy, because two
-#: spellings of a string whose only idempotence is exact match is one of them
-#: being wrong — and because `--install` and the launcher write DIFFERENT
-#: files, so nothing but the shared string keeps an exact-match ensure from
-#: treating one as absent.
-HOOK_COMMAND = "~/projects/xFactory/lanes-edit.sh session-start || true"
-HOOK_MATCHER = "startup|resume|clear|fork"
-HOOK_TIMEOUT = 5
-
-#: The CANONICAL skill's own name, derived from the path the installer test
-#: derives from `SKILL_NAMES` — Amendment 17(a) renamed the act from `lane-swap`
-#: to `handoff` and kept `lane-swap` as an alias file, so a name spelled here
-#: would be a second place to rename.
-SKILL_DIR_NAME = Path(SKILL_PATH).parent.name
-
-#: AMENDMENT 12's SECOND ENTRY, adoption act 3: the NAME GUARD under
-#: `UserPromptSubmit`, `~/projects/xFactory/lanes-edit.sh guard`, timeout 5.
-#: Spelled once here for the reason the string above is, and with TWO
-#: deliberate differences from it that the tests below assert separately:
-#:
-#:   * NO `|| true`. On `SessionStart` that suffix is the whole safety property
-#:     — a hook that dies must not break the session it was meant to orient. On
-#:     `UserPromptSubmit` it would be the OPPOSITE of the mechanism: exit 2 is
-#:     what BLOCKS a prompt (code.claude.com/docs/en/hooks), and `cmd || true`
-#:     exits 0 for every code the command can produce. An entry copied WITH its
-#:     suffix is a guard that refuses nothing, silently, which is the exact
-#:     state Amendment 12 exists to end.
-#:   * NO MATCHER. `UserPromptSubmit` has no source to match on.
-GUARD_COMMAND = "~/projects/xFactory/lanes-edit.sh guard"
-GUARD_TIMEOUT = 5
-
-def skill_paths(home: Path) -> tuple[Path, Path]:
-    return (home / ".claude-profiles" / "shared" / "skills" / SKILL_DIR_NAME / "SKILL.md",
-            home / ".claude" / "skills" / SKILL_DIR_NAME / "SKILL.md")
-
-
-def settings_of(home: Path) -> Path:
-    return home / ".claude" / "settings.json"
-
-
-def hook_commands(home: Path, event: str) -> list[str]:
-    data = json.loads(settings_of(home).read_text(encoding="utf-8"))
-    out = []
-    for entry in data.get("hooks", {}).get(event, []):
-        for hook in entry.get("hooks", []):
-            if "command" in hook:
-                out.append(hook["command"])
-    return out
-
-
-def session_start_commands(home: Path) -> list[str]:
-    return hook_commands(home, "SessionStart")
-
-
-def user_prompt_commands(home: Path) -> list[str]:
-    return hook_commands(home, "UserPromptSubmit")
-
-
-# --- the skill --------------------------------------------------------------
-
-@NEEDS_JQ
-def test_install_places_the_skill_at_both_paths(tmp_path):
-    """ONE WRITE FOR 418 PROFILES, plus one for the bare run. Measured on Eagle
-    2026-09-12: every `pclaude run` execs with `CLAUDE_CONFIG_DIR=<profile
-    dir>`, and every profile's `skills` is a symlink to one shared directory —
-    so `~/.claude/skills` is NOT read under the launcher and the shared
-    directory is the one write that reaches all of them (R-A8-5(a)). The
-    `~/.claude` copy stays for a bare `claude` run outside it (R-A8-5(c))."""
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    source = (REPO / SKILL_PATH).read_bytes()
-    for target in skill_paths(tmp_path):
-        assert target.is_file(), result.stdout
-        assert target.read_bytes() == source, target
-        assert stat.S_IMODE(target.stat().st_mode) == 0o644, target
-        assert f"{SKILL_DIR_NAME}: installed at {target}" in result.stdout
-
-
-@NEEDS_JQ
-def test_the_shipped_skill_is_the_one_the_launcher_invokes(tmp_path):
-    """`/handoff` is what Claude Code invokes, and what it invokes is the
-    skill's own `name:` (Addendum 1(3) on brettheap/new-workstation#17).
-    A directory named one thing and a front-matter name that is another is a
-    skill nobody can call.
-
-    HELD FOR EVERY SKILL SHIPPED, not just the canonical one: Amendment 17(a)
-    renamed this act and left `lane-swap` as an ALIAS FILE at its old path, and
-    an alias whose front matter still named the old directory would be a skill
-    Claude Code invokes under one name and finds under another."""
-    for name in SKILL_NAMES:
-        path = REPO / f"skills/{name}/SKILL.md"
-        text = path.read_text(encoding="utf-8")
-        assert text.startswith("---\n"), name
-        assert f"\nname: {name}\n" in text, name
-    assert Path(SKILL_PATH).parent.name == "handoff", (
-        "the canonical skill is `handoff` — Amendment 17(a): one act, three names")
-
-
-@NEEDS_JQ
-def test_a_drifted_skill_is_replaced_and_an_identical_one_is_left_alone(tmp_path):
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    shared, _bare = skill_paths(tmp_path)
-    shared.write_text(shared.read_text(encoding="utf-8") + "\n<!-- drift -->\n",
-                      encoding="utf-8")
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert f"{SKILL_DIR_NAME}: updated at {shared}" in second.stdout
-    assert shared.read_bytes() == (REPO / SKILL_PATH).read_bytes()
-
-
-@NEEDS_JQ
-def test_a_skill_whose_bytes_are_right_and_whose_mode_is_not_is_re_moded(tmp_path):
-    """THE MODE IS STAMPED WHETHER OR NOT THE BYTES MOVED (#40, finding 2).
-
-    `chmod 644` sat inside the `else` of the bytes comparison, so a `SKILL.md`
-    whose bytes were right and whose mode was not was reported `unchanged` and
-    left exactly as it was — for ever, because every later `--install` compared
-    the same matching bytes and took the same arm. 755 is the drift that
-    actually happens: Amendment 9(b) describes `--install` as stamping 755 "on
-    everything it places", and workBenches#63's own 0644 loop wrote this same
-    path until adoption act 4b deleted it, so a host can carry either.
-
-    And the LINE has to say which of the two happened: a run that repaired a
-    mode and printed `unchanged` told a person there was nothing to look at.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    shared, bare = skill_paths(tmp_path)
-    before = shared.read_bytes()
-    os.chmod(shared, 0o755)
-
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert stat.S_IMODE(shared.stat().st_mode) == 0o644, (
-        "the bytes matched, so the mode was never stamped")
-    assert shared.read_bytes() == before, "it rewrote a file to repair a mode"
-    # `{SKILL_DIR_NAME}` AND NEVER THE LITERAL, which is what `skill_paths`
-    # above already derives from `SKILL_NAMES`: Amendment 17(a) renamed this act
-    # from `lane-swap` to `handoff` and kept `lane-swap` as an ALIAS FILE, so a
-    # name spelled here is a name that goes stale the next time the act is
-    # named — and it did, in the merge that brought this case (#40, #44) on to
-    # the branch that made the rename (#36). The paths above are the first
-    # skill's; the line the installer prints for them carries that skill's name.
-    assert f"{SKILL_DIR_NAME}: already installed at {shared} (mode restored to 644)" \
-        in second.stdout, second.stdout
-    # …and the copy that was already right still reports what it is.
-    assert f"{SKILL_DIR_NAME}: already installed at {bare} (unchanged)" in second.stdout
-
-
-# --- the command file (A11 Addendum 4 ruling 9) -----------------------------
-
-def command_paths(home: Path, name: str) -> tuple[Path, Path]:
-    """The two places `--install` writes a command file — the pair a skill has,
-    for the same two ways a session is started."""
-    return (home / ".claude-profiles" / "shared" / "commands" / f"{name}.md",
-            home / ".claude" / "commands" / f"{name}.md")
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("name", COMMAND_NAMES)
-def test_install_places_the_command_file_at_both_paths(tmp_path, name):
-    """AFTER `workBenches#74`, `/swap` HAS NO OTHER OWNER (F-X28).
-
-    `#74` @`0b7f6bc` deletes `base-image/files/claude/commands/` along with the
-    launcher's copy of the `lane-swap` skill, and adoption act 6 — which would
-    have `--install` inherit command files — lands AFTER act 3, which is this
-    PR's base. So on the day `#74` lands, clause (g)'s `/swap`, a ratified
-    decision and one of the six edits to in-force text, would be installed by
-    nobody. Ruling 9 puts it here.
-
-    `setup-claude-profiles.sh:140,295` makes `<profiles>/shared/commands` and
-    links it into every profile as `<profile>/commands`, exactly as it does for
-    `skills` — so the shared copy is `/swap` under the launcher and the
-    `~/.claude` copy is `/swap` in a bare `claude` run.
-    """
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    source = (REPO / f"commands/{name}.md").read_bytes()
-    for target in command_paths(tmp_path, name):
-        assert target.is_file(), result.stdout
-        assert target.read_bytes() == source, target
-        assert stat.S_IMODE(target.stat().st_mode) == 0o644, target
-        assert f"/{name}: installed at {target}" in result.stdout
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("name", COMMAND_NAMES)
-def test_the_shipped_command_is_an_alias_and_restates_no_step(name):
-    """CLAUSE (g) MAKES `/swap` AN ALIAS, AND AN ALIAS THAT RESTATES THE STEPS
-    IS THE ALTERNATIVE IT REJECTS BY NAME: *"Two copies of one procedure that
-    must stay byte-equal is the rejected alternative."*
-
-    So each command file's whole content is an instruction to invoke the skill,
-    and none of them may carry a step list of its own. Held here because the day
-    someone "helpfully" pastes the procedure into one is the day the copies can
-    differ — and Amendment 17 made that THREE doors to one act (`/handoff`,
-    `/ctx` = `/handoff --restart`, and `/swap`) plus the `lane-swap` alias skill,
-    so the rule is checked per file rather than on the one that had it first.
-    """
-    text = (REPO / f"commands/{name}.md").read_text(encoding="utf-8")
-    assert text.startswith("---\n"), "a command file opens with front matter"
-    assert "handoff" in text, "the alias must name the skill it invokes"
-    assert f"/{name}" in text, "the alias is named in its own description"
-    # The skill's own numbered steps, which no command file may carry.
-    skill = (REPO / SKILL_PATH).read_text(encoding="utf-8")
-    for heading in ("## 1.", "## 2.", "## 3.", "## 4.", "## 5."):
-        assert heading in skill, f"the skill lost {heading} — this test is stale"
-        assert heading not in text, (
-            f"commands/{name}.md restates the skill's {heading}; the alias adds "
-            "nothing, and two copies of one procedure is what is rejected")
-
-
-@NEEDS_JQ
-def test_the_alias_skill_names_the_act_and_restates_no_step():
-    """AMENDMENT 17(a) KEPT `/lane-swap` — *"so that nothing written about them
-    stops working"* — AS AN ALIAS AND NOT AS A SECOND COPY.
-
-    The steps moved to `skills/handoff/SKILL.md` with their history; the file at
-    the old path names the skill that now carries them and adds nothing. This is
-    the same rule the command files take, one directory along, and it is what
-    makes "same steps, same record" true by construction rather than by
-    somebody keeping two files byte-equal.
-    """
-    text = (REPO / "skills/lane-swap/SKILL.md").read_text(encoding="utf-8")
-    assert "\nname: lane-swap\n" in text, "the alias keeps its own invocable name"
-    assert "`handoff` skill" in text, "the alias must name the skill it invokes"
-    skill = (REPO / SKILL_PATH).read_text(encoding="utf-8")
-    for heading in ("## 1.", "## 2.", "## 3.", "## 4.", "## 5."):
-        assert heading in skill, f"the skill lost {heading} — this test is stale"
-        assert heading not in text, (
-            f"skills/lane-swap/SKILL.md restates {heading}; it is an alias")
-
-
-@NEEDS_JQ
-def test_a_drifted_command_file_is_replaced_and_an_identical_one_is_left_alone(tmp_path):
-    """The same idempotence the skills have, for the same reason: a person who
-    edits the installed copy gets it back, and a run that changes nothing says
-    so instead of reporting a write."""
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    shared, _bare = command_paths(tmp_path, "swap")
-    shared.write_text(shared.read_text(encoding="utf-8") + "\n<!-- drift -->\n",
-                      encoding="utf-8")
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert f"/swap: updated at {shared}" in second.stdout
-    assert shared.read_bytes() == (REPO / "commands/swap.md").read_bytes()
-    third = run_cmd("--install", home=tmp_path)
-    assert f"/swap: already installed at {shared} (unchanged)" in third.stdout
-
-
-@NEEDS_JQ
-def test_a_command_file_whose_mode_drifted_is_re_moded_too(tmp_path):
-    """The same stamp on the same arm, one directory along (#40, finding 2).
-    A command file is a document a session READS, at 644 for the reason a
-    `SKILL.md` is, and an installer that owns the mode owns it on every run."""
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    shared, _bare = command_paths(tmp_path, "swap")
-    before = shared.read_bytes()
-    os.chmod(shared, 0o600)
-
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert stat.S_IMODE(shared.stat().st_mode) == 0o644
-    assert shared.read_bytes() == before
-    assert f"/swap: already installed at {shared} (mode restored to 644)" \
-        in second.stdout, second.stdout
-
-
-# --- the one question the mode stamp asks (#44 round 1, `openRepoTools:277`) -
-
-def helper_source(name: str) -> str:
-    """One function lifted out of the command, so a test can ask it directly.
-
-    Anchored on the function's own opening line and the `}` in the first column
-    that closes it, which is how every function in that file is written — a
-    rename or a reshape fails this loudly rather than silently testing nothing.
-    """
-    text = COMMAND.read_text(encoding="utf-8")
-    start = text.index(f"\n{name}() {{")
-    end = text.index("\n}\n", start)
-    return text[start + 1:end + 3]
-
-
-#: Every mode `--install` stamps, asked of a file at each of them: 755 for the
-#: eleven, 644 for the four skill copies and the two command files, 600 for
-#: `settings.json`.
-MODE_ANSWERS = (
-    (0o755, "755", True), (0o644, "644", True), (0o600, "600", True),
-    (0o755, "644", False), (0o644, "755", False), (0o600, "644", False),
-    (0o640, "600", False),
-)
-
-
-@pytest.mark.parametrize("on_disk,asked,expected", MODE_ANSWERS,
-                         ids=[f"{o:03o} is {a}" for o, a, _ in MODE_ANSWERS])
-def test_mode_is_answers_the_find_this_platform_ships(tmp_path, on_disk, asked,
-                                                      expected):
-    """THE CLAIM `mode_is` MAKES IS A PORTABILITY CLAIM, SO IT IS ASKED ON EACH
-    PLATFORM THAT RUNS THIS SUITE (#44 round 1, `openRepoTools:277`).
-
-    The round's review held that `find -maxdepth` is not in the stock BSD/macOS
-    `find`, so `mode_is` would answer FALSE for every mode on that platform and
-    every artifact would report `(mode restored …)` for ever. It is in it —
-    `-maxdepth` is a FreeBSD primary, documented in that `find`'s own page in
-    the words *"`-maxdepth 0` limits the whole search to the command line
-    arguments"*, and this repository already ships three of them in
-    `lanes-edit.sh` — and the `tests-macos` job is where that stops being a
-    claim about a manual page: this test asks the helper the three octals
-    `--install` actually stamps, and both answers for each, on whatever `find`
-    the platform running it has.
-
-    That is the whole reason the helper is `find` and not `stat`: GNU spells it
-    `stat -c %a` and BSD `stat -f %Lp`, nothing here may reach for one without
-    the other beside it (`test_repo_hygiene.py`'s GNU-only rule), and
-    `-perm <octal>` with neither a `-` nor a `+` in front of it is EXACT on
-    both.
-    """
-    target = tmp_path / "artifact"
-    target.write_text("whatever this installer placed\n", encoding="utf-8")
-    os.chmod(target, on_disk)
-    script = helper_source("mode_is") + \
-        f'\nif mode_is {asked} "$1"; then echo yes; else echo no; fi\n'
-    done = subprocess.run(["bash", "-c", script, "mode_is", str(target)],
-                          capture_output=True, text=True, check=False)
-    assert done.stdout.strip() == ("yes" if expected else "no"), (
-        f"`mode_is {asked}` on a file at {on_disk:03o} answered "
-        f"{done.stdout.strip()!r} — this platform's `find` does not take the "
-        f"one spelling GNU and BSD agree on:\n{done.stderr}")
-
-
-def test_mode_is_says_no_about_a_path_that_is_not_there(tmp_path):
-    """The other answer it has to get right: `find` prints a diagnostic and
-    exits non-zero on a missing path, and a helper that read that as `yes`
-    would report a mode on a file nothing placed."""
-    script = helper_source("mode_is") + \
-        '\nif mode_is 644 "$1"; then echo yes; else echo no; fi\n'
-    done = subprocess.run(["bash", "-c", script, "mode_is",
-                           str(tmp_path / "never-placed")],
-                          capture_output=True, text=True, check=False)
-    assert done.stdout.strip() == "no", done.stdout + done.stderr
-    assert done.stderr == "", "the diagnostic reached a person's terminal"
-
-
-# --- the hook entry ---------------------------------------------------------
-
-@NEEDS_JQ
-def test_the_hook_entry_is_byte_identical_to_the_amendments(tmp_path):
-    """THE STRING IS THE WHOLE MECHANISM. `--install` writes the user-local
-    file and the launcher writes each profile's; the two never write one file,
-    and only the shared string keeps an exact-match ensure from treating one as
-    absent and adding a second entry that fires the hook twice (R-A9-4)."""
-    link_xfactory(tmp_path)
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    data = json.loads(settings_of(tmp_path).read_text(encoding="utf-8"))
-    entries = data["hooks"]["SessionStart"]
-    assert len(entries) == 1, entries
-    assert entries[0]["matcher"] == HOOK_MATCHER
-    assert entries[0]["hooks"] == [{"type": "command",
-                                    "command": HOOK_COMMAND,
-                                    "timeout": HOOK_TIMEOUT}]
-    assert HOOK_COMMAND in COMMAND.read_text(encoding="utf-8"), (
-        "the command string this test asserts on is the one the file writes")
-
-
-@NEEDS_JQ
-def test_the_merge_keeps_every_other_setting_and_the_mode(tmp_path):
-    """IT NEVER WRITES THE FILE WHOLE. The file already carries a
-    `UserPromptSubmit` hook (Amendment 8(e)) and a `statusLine` that
-    workBenches' own `setup-claude-profiles.sh` writes on every `./setup.sh` —
-    and a user's settings are not an installer's to own.
-
-    MODE 600 IS PRESERVED for the same reason: that script writes this file
-    through `jq` + `mktemp` + `chmod 600` + `mv -f`, so an installer that
-    widened the mode would be silently undone, or would widen it behind that
-    script's back.
-    """
-    link_xfactory(tmp_path)
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({
-        "statusLine": {"type": "command", "command": "~/.claude/statusline-command.sh"},
-        "model": "opus",
-        "hooks": {"UserPromptSubmit": [{"hooks": [
-            {"type": "command", "command": "~/projects/xFactory/guard.sh", "timeout": 5}]}]},
-    }, indent=2), encoding="utf-8")
-    os.chmod(settings, 0o600)
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    data = json.loads(settings.read_text(encoding="utf-8"))
-    assert data["model"] == "opus"
-    assert data["statusLine"]["command"] == "~/.claude/statusline-command.sh"
-    assert data["hooks"]["UserPromptSubmit"][0]["hooks"][0]["command"] \
-        == "~/projects/xFactory/guard.sh"
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-    assert stat.S_IMODE(settings.stat().st_mode) == 0o600
-    assert "merged into" in result.stdout
-
-
-@NEEDS_JQ
-def test_installing_twice_adds_one_entry_and_not_two(tmp_path):
-    link_xfactory(tmp_path)
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-    assert "SessionStart hook: already installed" in second.stdout
-    assert "unchanged" in second.stdout
-
-
-@NEEDS_JQ
-def test_a_present_hook_in_a_widened_settings_file_is_narrowed_to_600(tmp_path):
-    """`HOOK_PLAN=present` NEVER APPLIED THE DOCUMENTED MODE (#40, finding 3).
-
-    The `nofile` and `absent` arms write this file through `mktemp` +
-    `chmod 600` + `mv -f`, so a file THEY wrote is 600. The `present` arm — an
-    existing settings file whose expected entry is already there — printed one
-    line and touched nothing, so a direct `--install` could leave
-    `~/.claude/settings.json` world-readable for ever, and no later run would
-    ever narrow it: the entry stays present on every one of them.
-
-    600 is not this installer's preference either. workBenches'
-    `setup-claude-profiles.sh` writes this same file at 600 on every
-    `./setup.sh`, so a wider mode left here is either silently undone by that
-    script or widened behind its back.
-
-    THE FILE IS NOT REWRITTEN TO FIX A MODE: a user's settings are not an
-    installer's to own, and `chmod` changes no byte of them.
-    """
-    link_xfactory(tmp_path)
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    settings = settings_of(tmp_path)
-    before = settings.read_bytes()
-    os.chmod(settings, 0o644)
-
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert stat.S_IMODE(settings.stat().st_mode) == 0o600, (
-        "a `present` hook left the file at the mode it found")
-    assert settings.read_bytes() == before, "it rewrote the file to repair a mode"
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-    assert f"SessionStart hook: already installed in {settings} " \
-           f"(mode restored to 600)" in second.stdout, second.stdout
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("entry", ["present", "absent"])
-def test_a_symlinked_settings_file_is_refused_rather_than_written_through(
-        tmp_path, entry):
-    """`chmod` FOLLOWS A SYMLINK, AND SO DOES NOTHING ELSE ABOUT IT (#44 round
-    1, `openRepoTools:878`).
-
-    The mode stamp this round put on the `present` arm is the sharper half: a
-    `~/.claude/settings.json` linked into a dotfiles checkout — which is how a
-    person who versions their settings has it — got the 600 stamped on the file
-    at the FAR END, an unrelated file re-moded by a run that reported the entry
-    `already installed`. The `absent` arm is the older half of the same
-    question: it writes a temporary beside this path and `mv -f`s it here,
-    which REPLACES the link with a regular file, so the link a person put there
-    is gone and their dotfiles copy silently stops being what `claude` reads.
-
-    One refusal answers both, in the planning phase and with the same shape the
-    other seventeen artifacts are refused with: the path, what it is, and the
-    `rm` that clears it. What is on the other end keeps its bytes and its mode,
-    which is the assertion that tells this from either defect.
-    """
-    far = tmp_path / "dotfiles" / "settings.json"
-    far.parent.mkdir(parents=True)
-    payload = {"model": "opus"}
-    if entry == "present":
-        payload["hooks"] = {"SessionStart": [
-            {"matcher": HOOK_MATCHER,
-             "hooks": [{"type": "command", "command": HOOK_COMMAND,
-                        "timeout": HOOK_TIMEOUT}]}]}
-    far.write_text(json.dumps(payload, indent=2), encoding="utf-8")
-    os.chmod(far, 0o644)
-    before = far.read_bytes()
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.symlink_to(far)
-    bin_dir = tmp_path / ".local" / "bin"
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{settings} — a symlink to {far}" in result.stderr, result.stderr
-    assert f'rm -f -- "{settings}"' in result.stderr, result.stderr
-    assert "NOTHING was installed" in result.stderr
-    assert stat.S_IMODE(far.stat().st_mode) == 0o644, (
-        "the mode was stamped through the link onto the file at the far end")
-    assert far.read_bytes() == before, "the far end was written through"
-    assert settings.is_symlink(), "the merge replaced the link with its own file"
-    assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-        "the eleven commands were placed by a run that refused")
-
-
-@NEEDS_JQ
-def test_a_differing_session_start_entry_refuses_and_places_nothing(tmp_path):
-    """THE ENTRY INSTALLED BY HAND ON EAGLE DOES NOT MATCH, and refusing is the
-    right outcome. Amendment 8's adoption act 6 placed
-    `bash -lc '"$HOME/projects/xFactory/lanes-edit.sh" session-start
-    2>/dev/null || true'` under the same matcher; its `command` is not clause
-    (e)'s string, so merging would quietly add a SECOND entry and fire the hook
-    twice.
-
-    AND THE COST IS A WHOLE INSTALL, NOT HALF OF ONE: both merges are computed
-    with the seventeen files in hand, before any of them is placed, so the bin
-    directory is untouched. That is the same all-or-nothing rule `--install`
-    already had, extended to the two artifacts that are not whole files.
-    """
-    hand = ('bash -lc \'"$HOME/projects/xFactory/lanes-edit.sh" session-start '
-            '2>/dev/null || true\'')
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"SessionStart": [
-        {"matcher": HOOK_MATCHER,
-         "hooks": [{"type": "command", "command": hand, "timeout": 5}]}]}}),
-        encoding="utf-8")
-    bin_dir = tmp_path / ".local" / "bin"
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "a SessionStart entry that runs `session-start` with a" in result.stderr
-    assert "DIFFERENT command string" in result.stderr
-    assert "NOTHING was installed" in result.stderr
-    assert HOOK_COMMAND in result.stderr, "the refusal prints the exact block"
-    assert session_start_commands(tmp_path) == [hand], "it changed the file"
-    assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-        "the refusal must cost a whole install, not half of one")
-    for target in skill_paths(tmp_path):
-        assert not target.exists(), target
-
-
-@NEEDS_JQ
-def test_a_settings_file_that_is_not_json_refuses_and_places_nothing(tmp_path):
-    """The same refusal workBenches' own writer of this file already makes
-    (`setup-claude-profiles.sh` hard-exits 1 when it is not valid JSON). An
-    installer that repairs a file it does not understand is how a person loses
-    a setting they meant."""
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text("{ this is not json\n", encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "is not valid JSON" in result.stderr
-    assert "NOTHING was installed" in result.stderr
-    assert settings.read_text(encoding="utf-8") == "{ this is not json\n"
-    assert not (tmp_path / ".local" / "bin").exists()
-
-
-@NEEDS_JQ
-def test_a_hooks_value_that_is_not_an_object_refuses(tmp_path):
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": ["not", "an", "object"]}),
-                        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "not an object" in result.stderr
-    assert not (tmp_path / ".local" / "bin").exists()
-
-
-@NEEDS_JQ
-def test_an_unrelated_session_start_entry_is_kept_and_ours_is_added(tmp_path):
-    """Somebody else's SessionStart hook is not ours to remove. Only an entry
-    that runs `session-start` with a different string is a conflict — anything
-    else is a setting a person meant, and this merges beside it."""
-    link_xfactory(tmp_path)
-    other = "~/bin/say-hello.sh"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"SessionStart": [
-        {"matcher": "startup",
-         "hooks": [{"type": "command", "command": other, "timeout": 3}]}]}}),
-        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert session_start_commands(tmp_path) == [other, HOOK_COMMAND]
-
-
-def test_without_jq_it_refuses_and_places_nothing(tmp_path):
-    """`jq` IS A NEW DEPENDENCY AND THE TEXT NAMES IT rather than assuming it:
-    this repository carried no JSON-handling code before the merge. It is not
-    bash, so the macOS bash-3.2 parse gate is unaffected."""
-    stub = tmp_path / "nojq"
-    stub.mkdir()
-    for name in ("bash", "git", "cp", "mkdir", "chmod", "cmp", "printf",
-                 "mktemp", "sed", "cat", "tr", "grep", "head", "dirname",
-                 "rm", "mv"):
-        found = shutil.which(name)
-        if found:
-            (stub / name).symlink_to(found)
-    result = subprocess.run(
-        ["bash", str(COMMAND), "--install"], capture_output=True, text=True,
-        check=False, input="", cwd=str(REPO),
-        env=command_env(home=tmp_path, env={"PATH": str(stub)}))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "needs `jq`" in result.stderr
-    assert HOOK_COMMAND in result.stderr, "the refusal prints the entry"
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "NOTHING was installed: the merge is computed before any file is placed")
-
-
-# --- the destination, proved before anything is placed ----------------------
-
-NOT_ROOT = pytest.mark.skipif(
-    hasattr(os, "geteuid") and os.geteuid() == 0,
-    reason="root may write a directory whose mode says otherwise")
-
-
-@NEEDS_JQ
-@NOT_ROOT
-@pytest.mark.parametrize("which", ["shared skills", "~/.claude"])
-def test_a_destination_that_cannot_be_written_refuses_before_anything_is_placed(
-        tmp_path, which):
-    """THE MERGE COMPUTING FINE AGAINST A DIRECTORY NOBODY MAY WRITE IS THE SAME
-    FAILURE ONE STEP LATER.
-
-    Amendment 9(b) computes the merge in hand "so a merge that cannot be
-    computed refuses having placed nothing". A filesystem offers no transaction
-    across thirty-one artifacts, so nothing can make the last fourteen atomic
-    with the first seventeen — but the failure that actually happens is not an
-    exotic one, it
-    is a directory that is not this installer's to write, and that question can
-    be asked in the planning phase where the refusal still costs nothing.
-
-    Without the check the run places seventeen files and some of the remaining
-    artifacts, then dies — leaving a host with commands installed,
-    neither hook entry, and an installer that reports the same "already
-    installed (unchanged)" for the seventeen on every re-run while never reaching
-    the one that failed.
-    """
-    if which == "shared skills":
-        blocked = tmp_path / ".claude-profiles" / "shared" / "skills"
-    else:
-        blocked = tmp_path / ".claude"
-    blocked.mkdir(parents=True)
-    blocked.chmod(0o500)
-    bin_dir = tmp_path / ".local" / "bin"
-    try:
-        result = run_cmd("--install", home=tmp_path)
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-            "the seventeen files were placed against a destination that was never "
-            "going to take the other fourteen")
-    finally:
-        blocked.chmod(0o700)
-
-
-# --- the seventeen targets, and what they are (R-A9-12) ----------------------
-
-@NEEDS_JQ
-@NOT_ROOT
-def test_a_leaf_destination_that_exists_unwritable_refuses_before_anything_is_placed(
-        tmp_path):
-    """EVERY DESTINATION IS ASKED ABOUT, AND NOT ONLY THE ROOTS THEY HANG UNDER
-    (F6 of the #24 review, ruled R-A9-15).
-
-    When the arm was `mkdir -p` and then `[ -w "$d" ]`, the case above — which
-    chmods the PARENT — never reached the `-w` at all, because the `mkdir`
-    refused first; measured then: `mkdir -p` returns 0 on a directory that
-    already EXISTS at 0500, so the leaf was the only way in, and with the arm
-    mutated to a no-op the whole review's run of this file stayed at 13 passed.
-    Since #44 round 1 the planner creates nothing and asks the nearest ancestor
-    that exists, so both cases land on one arm — and this fixture is what says
-    the walk covers the LEAF each artifact actually goes in, rather than the
-    two roots above it. A guard no test reaches is a guard nobody can rely on.
-
-    The bin directory is the assertion that tells the two apart: the refusal
-    here is a PLANNING one and nothing is placed, where the mutant places all
-    seventeen files and dies on the `cp` into this same directory, which is the
-    half-install the planning phase exists to prevent.
-    """
-    blocked = tmp_path / ".claude-profiles" / "shared" / "skills" / SKILL_DIR_NAME
-    blocked.mkdir(parents=True)
-    blocked.chmod(0o500)
-    bin_dir = tmp_path / ".local" / "bin"
-    try:
-        result = run_cmd("--install", home=tmp_path)
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert "is not writable" in result.stderr, result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-            "the seventeen files were placed against a leaf directory that was "
-            "never going to take the skill")
-    finally:
-        blocked.chmod(0o700)
-
-
-def _wip_with_links(tmp_path) -> tuple[Path, Path, dict]:
-    """A bin directory carrying exactly what the pre-move `link-estates` leaves
-    on a workstation: `lane-start` and `lane-end` as symlinks into a checkout.
-    Returns the bin directory, the checkout, and each linked file's bytes."""
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    wip = tmp_path / "projects" / "brett-wip" / "lanes"
-    wip.mkdir(parents=True)
-    contents = {}
-    for name in ("lane-start", "lane-end"):
-        real = wip / name
-        real.write_text(f"the {name} this checkout had before --install ran\n",
-                        encoding="utf-8")
-        contents[name] = real.read_bytes()
-        (bin_dir / name).symlink_to(real)
-    return bin_dir, wip, contents
-
-
-@NEEDS_JQ
-def test_a_symlinked_target_is_refused_and_nothing_is_written_through_it(tmp_path):
-    """`cp` FOLLOWS A SYMLINK, AND THE FAR END IS THE REGISTER'S CHECKOUT
-    (F5 of the #24 review, ruled R-A9-12).
-
-    Measured before the fix, against exactly this fixture: `lane-start: updated
-    at $BIN/lane-start`, `9 of 9 placed in $BIN`, exit 0 — and both claims
-    false. The targets stayed symlinks, so the two commands were never
-    installed (workBenches' `setup-estate-commands.sh` then refuses the whole
-    estate install on them), and the post-move bytes landed in the working tree
-    on the other end: `git -C $WIP status --porcelain` answered
-    ` M lanes/lane-end` and ` M lanes/lane-start`. That is the repository every
-    lane writes, so `lanes-edit.sh`'s `refuse_dirty_checkout` then refuses
-    `log`, `claim` and `release` on that workstation.
-
-    A host still carrying those links is the NORMAL pre-act-5 case, which is
-    why the refusal names each path, what it is, and the `rm` that clears them.
-    """
-    bin_dir, wip, contents = _wip_with_links(tmp_path)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "NOTHING was installed" in result.stderr
-    for name in ("lane-start", "lane-end"):
-        assert f"{bin_dir / name} — a symlink to {wip / name}" in result.stderr, (
-            "the refusal must name every offending target and say what it "
-            f"is:\n{result.stderr}")
-    assert f'rm -f -- "{bin_dir / "lane-start"}" "{bin_dir / "lane-end"}"' in result.stderr, (
-        f"the refusal must print the exact `rm` that clears them:\n{result.stderr}")
-    # THE POINT OF THE WHOLE ROUND: the checkout on the far end is untouched.
-    for name, before in contents.items():
-        assert (wip / name).read_bytes() == before, (
-            f"--install wrote through the symlink into {wip / name}")
-        assert (bin_dir / name).is_symlink(), (
-            f"{bin_dir / name} is no longer the link it was")
-    # …and it refused in the PLANNING phase: none of the other seven arrived.
-    assert sorted(p.name for p in bin_dir.iterdir()) == ["lane-end", "lane-start"]
-    assert not (tmp_path / ".claude").exists(), (
-        "the hook or the skill was placed by a run that refused")
-
-
-@NEEDS_JQ
-def test_a_directory_where_a_command_goes_is_refused_the_same_way(tmp_path):
-    """THE RULE IS `A REGULAR FILE`, not `not a symlink`. A directory at
-    `$BIN/park` is the same refusal for the same reason — `cp` cannot place a
-    file over it, and finding that out after sixteen of the seventeen are placed is
-    the half-install the planning phase exists to prevent."""
-    bin_dir = tmp_path / ".local" / "bin"
-    (bin_dir / "park").mkdir(parents=True)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{bin_dir / 'park'} — a directory" in result.stderr, result.stderr
-    assert sorted(p.name for p in bin_dir.iterdir()) == ["park"]
-
-
-@NEEDS_JQ
-def test_a_dangling_symlink_is_refused_rather_than_followed(tmp_path):
-    """`[ -e ]` IS FALSE ON A DANGLING LINK, AND `cp` THROUGH ONE CREATES THE
-    FILE AT THE FAR END. So the planning walk asks `-L` as well: a link into a
-    checkout that is not on this machine yet is the same write into a
-    repository this command was never told about, one `git clone` later."""
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    missing = tmp_path / "projects" / "brett-wip" / "lanes" / "lane-start"
-    (bin_dir / "lane-start").symlink_to(missing)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{bin_dir / 'lane-start'} — a symlink to {missing}" in result.stderr, result.stderr
-    assert not missing.exists(), "--install created the file at the far end"
-
-
-
-@NEEDS_JQ
-@NOT_ROOT
-def test_an_unwritable_command_in_the_bin_directory_is_refused(tmp_path):
-    """`unplaceable_kind` TREATED EVERY EXISTING REGULAR FILE AS WRITABLE
-    (#40, finding 4).
-
-    It answered `return 1` — placeable — for any `[ -f ]`, so a target this
-    user may not write passed the plan and met `cp` instead. In the bin
-    directory that is a run that dies part way through the eleven; one
-    directory along it is worse, because `install_commands` has already copied
-    all eleven by then.
-
-    The remedy the refusal prints is still the right one for this kind: `rm -f`
-    takes a read-only file, because what a removal needs is the DIRECTORY's
-    write bit and not the file's.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    target = bin_dir / "park"
-    target.write_text("the park a person chmod 444'd\n", encoding="utf-8")
-    before = target.read_bytes()
-    os.chmod(target, 0o444)
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{target} — a regular file this user cannot write" \
-            in result.stderr, result.stderr
-        assert f'rm -f -- "{target}"' in result.stderr, result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert target.read_bytes() == before, "it wrote the file anyway"
-        assert sorted(p.name for p in bin_dir.iterdir()) == ["park"], (
-            "the other ten were placed by a run that refused")
-        assert not (tmp_path / ".claude").exists(), (
-            "the skills or the hook were placed by a run that refused")
-    finally:
-        os.chmod(target, 0o644)
-
-
-@NEEDS_JQ
-@NOT_ROOT
-def test_a_bin_directory_that_cannot_be_written_refuses_before_anything(tmp_path):
-    """THE `-w` QUESTION FOR EVERY TARGET THAT IS NOT THERE YET (#40, finding
-    4). An absent file is placeable exactly where the directory it would be
-    created in takes a write, and `plan_skill_targets` has always asked that of
-    the directories it writes into. The bin directory was never asked, so a
-    `$OPENREPOTOOLS_BIN_DIR` that is not this user's failed at the first `cp`
-    under `set -e` — exit 1, the code this toolset spends on "findings were
-    printed", from a run that placed nothing and printed none.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    bin_dir.chmod(0o500)
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{bin_dir} is not writable" in result.stderr, result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert not any(bin_dir.iterdir())
-        assert not (tmp_path / ".claude").exists(), (
-            "the skills or the hook were placed by a run that refused")
-    finally:
-        bin_dir.chmod(0o700)
-
-
-@NEEDS_JQ
-@NOT_ROOT
-def test_a_bin_directory_that_cannot_be_created_is_refused_in_planning(tmp_path):
-    """THE `-w` THAT WAS NEVER ASKED, BECAUSE THE DIRECTORY WAS NOT THERE TO ASK
-    (#44 round 1, Sourcery's `README.md:237`, and `openRepoTools:653`).
-
-    The round before this one added the bin directory to the planning phase and
-    asked `[ -d "$dir" ]` first, so a `$OPENREPOTOOLS_BIN_DIR` that does not
-    exist YET was asked nothing at all — and an absent directory under a parent
-    this user cannot write is the case that fails. It reached the `mkdir -p` in
-    `install_commands`, which was unguarded: `set -e` exits 1 there, and 1 is
-    the code this toolset spends on "findings were printed", so the run said
-    nothing and a person reading the exit code was told the wrong thing.
-
-    The question is put to the NEAREST ANCESTOR THAT EXISTS, which is the same
-    question `-w` on an existing directory is — and it is put before the fetch,
-    so a refusal costs no network round-trip either.
-    """
-    parent = tmp_path / "opt"
-    parent.mkdir()
-    bin_dir = parent / "bin"
-    parent.chmod(0o500)
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{parent} is not writable" in result.stderr, (
-            f"the refusal must name the ancestor that refuses the create:\n"
-            f"{result.stderr}")
-        assert "NOTHING was installed" in result.stderr
-        assert not bin_dir.exists(), "the run created the directory it refused"
-        assert not (tmp_path / ".claude").exists(), (
-            "the skills or the hook were placed by a run that refused")
-    finally:
-        parent.chmod(0o700)
-
-
-@NEEDS_JQ
-@NOT_ROOT
-@pytest.mark.parametrize("which", ["the bin directory", "a skill destination"])
-def test_a_destination_whose_search_bit_is_off_is_refused_in_planning(
-        tmp_path, which):
-    """`-w` DOES NOT MAKE A DIRECTORY ONE A FILE CAN BE CREATED IN (#44 round 1,
-    the suppressed comment at `openRepoTools:658`).
-
-    Creating a file takes the directory's `w` AND its `x`, so a directory at
-    0600 accepts nothing at all — and both planners asked only `-w`, passed it,
-    and met the failure at a `cp` with artifacts already placed. The two halves
-    are parametrized together because the rule is one implementation: two
-    copies of it is how the bin half comes to refuse what the skill half
-    allows.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    if which == "the bin directory":
-        blocked = bin_dir
-    else:
-        blocked = tmp_path / ".claude-profiles" / "shared" / "skills"
-        blocked.mkdir(parents=True)
-    blocked.chmod(0o600)
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{blocked} is not searchable" in result.stderr, result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert not any(bin_dir.iterdir()), (
-            "the eleven commands were placed against a directory that takes "
-            "no file at all")
-    finally:
-        blocked.chmod(0o700)
-
-
-@NEEDS_JQ
-@NOT_ROOT
-def test_a_planning_refusal_creates_none_of_the_destination_directories(tmp_path):
-    """"NOTHING WAS INSTALLED" INCLUDED SEVEN DIRECTORIES (#44 round 1,
-    Sourcery's `tests/test_install_skill_and_hook.py:658`).
-
-    `plan_skill_targets` proved each destination writable by `mkdir -p`-ing it
-    and reading the result, so a run that then refused — on a target one
-    directory along, or on the hook — had already made `~/.claude`,
-    `~/.claude/skills/<each>`, `~/.claude/commands` and the shared trio on a
-    machine that had none of them. The refusal says nothing was installed, and
-    a person who then removes what they were told about is left with the rest.
-
-    The question is put to the nearest ancestor that exists instead, and the
-    places are made in the placement phase by the guarded `mkdir -p` each `cp`
-    already carries. The offending target here is in the SHARED tree, so
-    `~/.claude` is the assertion: a fixture cannot both put a file at a path
-    and leave that path's directory unmade.
-    """
-    target = skill_target(tmp_path, True, "lane-swap")
-    target.parent.mkdir(parents=True)
-    target.write_text("the SKILL.md a person made read-only\n", encoding="utf-8")
-    os.chmod(target, 0o444)
-    bin_dir = tmp_path / ".local" / "bin"
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert not (tmp_path / ".claude").exists(), (
-            "planning made ~/.claude on a machine that had none, over a "
-            "refusal that says nothing was installed")
-        assert not skill_target(tmp_path, True, "restart").parent.exists(), (
-            "planning made the other skill's shared directory")
-        assert not (tmp_path / ".claude-profiles" / "shared" / "commands").exists(), (
-            "planning made the shared commands directory")
-        assert not bin_dir.exists() or not any(bin_dir.iterdir())
-    finally:
-        os.chmod(target, 0o644)
-
-
-@NEEDS_JQ
-def test_a_dangling_symlink_ancestor_is_refused_rather_than_stepped_over(tmp_path):
-    """`-e` FOLLOWS A SYMLINK AND IS FALSE ON A DANGLING ONE (#44 round 2,
-    `openRepoTools:701`).
-
-    `unusable_dir_kind`'s walk asked `[ ! -e "$d" ]` alone to decide "not there
-    yet, keep walking up" — and `-e` is false on a DANGLING symlink exactly as
-    it is on a path with nothing at it at all, so the walk stepped PAST a
-    dangling `$OPENREPOTOOLS_BIN_DIR` parent and asked about its grandparent
-    instead, which passed. `mkdir -p` then meets the dangling link and fails —
-    on the one path that promises all or none.
-
-    A symlink is something AT that path, dangling or not: the walk now stops
-    there, exactly as it stops at a real directory or file.
-    """
-    parent = tmp_path / "opt"
-    parent.symlink_to(tmp_path / "nowhere-at-all")
-    bin_dir = parent / "bin"
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{parent} is a symlink to" in result.stderr, (
-        f"the refusal must name the dangling ancestor, not step past it:\n"
-        f"{result.stderr}")
-    assert "NOTHING was installed" in result.stderr
-    assert not bin_dir.exists(), "mkdir -p ran despite the dangling ancestor"
-    assert not (tmp_path / ".claude").exists(), (
-        "the skills or the hook were placed by a run that refused")
-
-
-# --- R-A9-12 reaches the skill paths too (F-X17) -----------------------------
-
-SKILL_TARGETS = tuple(
-    (profiles, name)
-    for name in SKILL_NAMES
-    for profiles in (True, False)
-)
-
-
-def skill_target(home: Path, shared: bool, name: str) -> Path:
-    """The two places `--install` writes each skill, by Amendment 9(b)."""
-    if shared:
-        return home / ".claude-profiles" / "shared" / "skills" / name / "SKILL.md"
-    return home / ".claude" / "skills" / name / "SKILL.md"
-
-
-@NEEDS_JQ
-@pytest.mark.parametrize("shared,name", SKILL_TARGETS)
-def test_a_symlinked_skill_target_is_refused_and_nothing_written_through_it(
-        tmp_path, shared, name):
-    """R-A9-12 IS ABOUT WHAT `cp` DOES, NOT ABOUT WHICH DIRECTORY (F-X17).
-
-    `plan_install_targets` refuses a symlink for every one of the seventeen files
-    in the bin directory. `plan_skill_targets` proved only the DIRECTORIES
-    writable, and `place_skill_and_hook` then reached each `SKILL.md` with
-    `[ -e ]`, `cmp -s` and `cp` — none of which can tell a regular file from a
-    link to one. Measured before the fix on exactly this fixture: exit 0, the
-    skill reported `updated at <target>`, the target still a symlink, and the
-    skill's bytes written into the file on the far end.
-
-    Six paths, because each round has added a skill: the pre-A11 exposure was
-    `lane-swap` alone, `restart` arrived beside it, and Amendment 17(a) added
-    `handoff` — the act itself, with `lane-swap` kept as its alias file. The
-    list is `SKILL_NAMES`, so the next skill is covered by existing itself.
-    """
-    far = tmp_path / "elsewhere" / f"{name}-SKILL.md"
-    far.parent.mkdir(parents=True)
-    far.write_text("whatever was on the other end of this link\n", encoding="utf-8")
-    before = far.read_bytes()
-    target = skill_target(tmp_path, shared, name)
-    target.parent.mkdir(parents=True)
-    target.symlink_to(far)
-    bin_dir = tmp_path / ".local" / "bin"
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "NOTHING was installed" in result.stderr, result.stderr
-    assert f"{target} — a symlink to {far}" in result.stderr, (
-        f"the refusal must name the offending skill path and say what it is:\n"
-        f"{result.stderr}")
-    assert f'rm -f -- "{target}"' in result.stderr, (
-        f"the refusal must print the exact `rm` that clears it:\n{result.stderr}")
-    assert far.read_bytes() == before, f"--install wrote through the link into {far}"
-    assert target.is_symlink(), f"{target} is no longer the link it was"
-    # AND IT REFUSED IN THE PLANNING PHASE: the seventeen commands never arrived
-    # either, which is what makes `NOTHING was installed` true rather than
-    # nearly true.
-    assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-        "the commands were placed by a run that refused on a skill target")
-
-
-@NEEDS_JQ
-def test_a_dangling_skill_symlink_is_refused_rather_than_followed(tmp_path):
-    """`[ -e ]` IS FALSE ON A DANGLING LINK and `cp` through one CREATES the
-    file at the far end — the same sharper case the bin half already refuses,
-    one directory along."""
-    missing = tmp_path / "elsewhere" / "restart-SKILL.md"
-    target = skill_target(tmp_path, False, "restart")
-    target.parent.mkdir(parents=True)
-    target.symlink_to(missing)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(tmp_path / ".local" / "bin")})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{target} — a symlink to {missing}" in result.stderr, result.stderr
-    assert not missing.exists(), "--install created the file at the far end"
-
-
-@NEEDS_JQ
-def test_a_directory_where_a_skill_goes_is_refused_the_same_way(tmp_path):
-    """THE RULE IS `A REGULAR FILE`, not `not a symlink` — the same sentence
-    the bin half's own directory case is written for."""
-    target = skill_target(tmp_path, True, SKILL_DIR_NAME)
-    target.mkdir(parents=True)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(tmp_path / ".local" / "bin")})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{target} — a directory" in result.stderr, result.stderr
-
-
-@NEEDS_JQ
-@NOT_ROOT
-@pytest.mark.parametrize("shared,name", SKILL_TARGETS)
-def test_an_unwritable_skill_target_refuses_before_anything_is_placed(
-        tmp_path, shared, name):
-    """AN UNWRITABLE `SKILL.md` PASSED THE TARGET PLAN, AND THE ALL-OR-NOTHING
-    RULE THEN COVERED ELEVEN OF THE EIGHTEEN (#40, finding 4).
-
-    `unplaceable_kind` answered `return 1` for every `[ -f ]` and asked nothing
-    else, so `plan_skill_targets` let a read-only `SKILL.md` through.
-    `install_commands` copies the eleven PATH files BEFORE `place_skill_and_hook`
-    reaches `cp`, so an ordinary permission failure there left a host with the
-    eleven commands installed, no skills, no `/swap` and no `SessionStart`
-    entry — on the one path in this file that promises all or none, and with
-    every later `--install` reporting the eleven `already installed
-    (unchanged)` while never reaching the one that failed.
-
-    THE BIN DIRECTORY IS THE ASSERTION THAT TELLS THE FIX FROM THE DEFECT: the
-    refusal here is a PLANNING one and nothing is placed at all.
-    """
-    target = skill_target(tmp_path, shared, name)
-    target.parent.mkdir(parents=True)
-    target.write_text("the SKILL.md a person made read-only\n", encoding="utf-8")
-    before = target.read_bytes()
-    os.chmod(target, 0o444)
-    bin_dir = tmp_path / ".local" / "bin"
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{target} — a regular file this user cannot write" \
-            in result.stderr, result.stderr
-        assert f'rm -f -- "{target}"' in result.stderr, result.stderr
-        assert "NOTHING was installed" in result.stderr
-        assert target.read_bytes() == before, f"--install wrote over {target}"
-        assert not bin_dir.exists() or not any(bin_dir.iterdir()), (
-            "the eleven commands were placed against a skill target that was "
-            "never going to take the skill")
-    finally:
-        os.chmod(target, 0o644)
-
-
-@NEEDS_JQ
-@NOT_ROOT
-@pytest.mark.parametrize("name", COMMAND_NAMES)
-def test_an_unwritable_command_target_is_refused_the_same_way(tmp_path, name):
-    """The same rule at the command file's own pair of destinations, because
-    the rule is `unplaceable_kind` and not a list of paths."""
-    target = command_paths(tmp_path, name)[0]
-    target.parent.mkdir(parents=True)
-    target.write_text("the alias a person made read-only\n", encoding="utf-8")
-    before = target.read_bytes()
-    os.chmod(target, 0o444)
-    bin_dir = tmp_path / ".local" / "bin"
-    try:
-        result = run_cmd("--install", home=tmp_path,
-                         env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"{target} — a regular file this user cannot write" \
-            in result.stderr, result.stderr
-        assert target.read_bytes() == before
-        assert not bin_dir.exists() or not any(bin_dir.iterdir())
-    finally:
-        os.chmod(target, 0o644)
-
-
-# --- what the conflict arm keys on (R-A9-14) --------------------------------
-
-@NEEDS_JQ
-def test_a_second_writer_of_this_hook_refuses_whatever_file_carries_it(tmp_path):
-    """THE VERB IS WHAT COLLIDES, NOT THE FILE THAT CARRIES IT (F7 of the #24
-    review, ruled R-A9-14).
-
-    A9 Addendum 3's R-A9-8 narrows clause (b)'s unqualified "whose `command`
-    DIFFERS" to the case the clause gives a REASON for: "an entry that runs
-    `session-start` with a DIFFERENT command — a competing writer of our own
-    hook", whose harm is that merging fires the hook twice. Keyed on
-    `lanes-edit.sh` instead, this arm merged beside exactly that — a second
-    program running the same hook verb — and refused an entry that runs
-    `lanes-edit.sh who`, which competes with nothing.
-    """
-    rival = "~/bin/lane-hook.sh session-start || true"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"SessionStart": [
-        {"matcher": HOOK_MATCHER,
-         "hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}}),
-        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "a SessionStart entry that runs `session-start` with a" in result.stderr
-    assert session_start_commands(tmp_path) == [rival], "it changed the file"
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "the refusal must cost a whole install, not half of one")
-
-
-@NEEDS_JQ
-def test_our_own_entry_beside_a_rival_refuses_rather_than_reading_present(tmp_path):
-    """`conflict` BEATS `present`, AND THE ORDER IS THE WHOLE OF #59.
-
-    `present` was asked FIRST, so a settings file carrying our exact entry AND a
-    second writer of the same hook answered `present`: `--install` added
-    nothing, said nothing, and the person kept two writers of one hook — the
-    state the arm above exists to refuse — with the run reporting success.
-
-    NOTHING WAS INSTALLED TWICE BY SUCH A RUN, which is why it went unnoticed:
-    with the exact entry already there, there is nothing to add and the file is
-    unchanged. The defect is that the state was never NAMED, and that somebody
-    who runs `--install` expecting it to police this hook was told everything
-    was fine. The cost of naming it is this repository's own rule: `conflict`
-    refuses the WHOLE install (R-A9-12), so a workstation carrying a rival
-    cannot install or update any artifact until the rival is gone — which is
-    already the answer a file with no entry of ours gets.
-
-    THE REFUSAL NAMES BOTH, and here that is not a nicety. This file carries our
-    entry as well as the rival, so "remove that entry" with nothing named is a
-    line a person can read as "remove the block this installer just printed",
-    which would take the working entry away and leave the second writer.
-
-    The two halves of the same read are asserted beside this: the rival ALONE
-    still refuses (the test above), and our entry alone still answers `present`,
-    silently (`test_installing_twice_adds_one_entry_and_not_two`).
-    """
-    rival = "~/bin/lane-hook.sh session-start || true"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    before = json.dumps({"hooks": {"SessionStart": [
-        {"matcher": HOOK_MATCHER,
-         "hooks": [{"type": "command", "command": HOOK_COMMAND,
-                    "timeout": HOOK_TIMEOUT}]},
-        {"matcher": HOOK_MATCHER,
-         "hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}},
-        indent=2)
-    settings.write_text(before, encoding="utf-8")
-    os.chmod(settings, 0o644)
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "a SessionStart entry that runs `session-start` with a" in result.stderr
-    assert "DIFFERENT command string" in result.stderr
-    assert rival in result.stderr, (
-        "the refusal must NAME the rival: this file carries ours too, and "
-        "'remove that entry' would otherwise be ambiguous\n" + result.stderr)
-    assert HOOK_COMMAND in result.stderr, "the refusal prints the exact block"
-    assert "NOTHING was installed" in result.stderr
-    assert settings.read_text(encoding="utf-8") == before, "it changed the file"
-    assert stat.S_IMODE(settings.stat().st_mode) == 0o644, (
-        "the `present` arm's mode stamp ran on a file the merge refused")
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "the refusal must cost a whole install, not half of one")
-    for target in skill_paths(tmp_path):
-        assert not target.exists(), target
-
-
-@NEEDS_JQ
-def test_an_entry_that_merely_names_the_same_file_is_no_conflict(tmp_path):
-    """…AND THE OTHER HALF OF THE SAME RULING. `lanes-edit.sh who` under
-    `SessionStart` is somebody's own setting: it writes nothing, it is not this
-    hook, and firing it does not fire ours twice. It is kept, and ours is added
-    beside it — the same answer any unrelated entry gets."""
-    link_xfactory(tmp_path)
-    other = "~/projects/xFactory/lanes-edit.sh who || true"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"SessionStart": [
-        {"matcher": "startup",
-         "hooks": [{"type": "command", "command": other, "timeout": 5}]}]}}),
-        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert session_start_commands(tmp_path) == [other, HOOK_COMMAND]
-
-
-# --- Amendment 12's second entry: the UserPromptSubmit name guard ------------
-#
-# ADOPTION ACT 3, ratified 2026-09-13T18:20:44Z ("Ratify revision 2"):
-# "`openRepoTools --install` places the hook string under `UserPromptSubmit` in
-# the profile's `settings.json` beside the `SessionStart` one —
-# `~/projects/xFactory/lanes-edit.sh guard`, timeout 5". The cases below are
-# the pair's own, and each of them is a way the pair can go wrong that a single
-# entry could not.
-
-@NEEDS_JQ
-def test_the_guard_entry_is_byte_identical_to_amendment_12(tmp_path):
-    """THE STRING IS THE WHOLE MECHANISM HERE TOO, and the SHAPE is half of it.
-
-    `UserPromptSubmit` takes no `matcher` — there is no source to match on —
-    so the entry is `{"hooks": [ ... ]}` and nothing else, and an installer
-    that copied the `SessionStart` block wholesale would write a key the event
-    does not have.
-    """
-    link_xfactory(tmp_path)
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    data = json.loads(settings_of(tmp_path).read_text(encoding="utf-8"))
-    entries = data["hooks"]["UserPromptSubmit"]
-    assert len(entries) == 1, entries
-    assert "matcher" not in entries[0], (
-        "UserPromptSubmit has no source to match on; the key belongs to the "
-        "events that do")
-    assert entries[0]["hooks"] == [{"type": "command",
-                                    "command": GUARD_COMMAND,
-                                    "timeout": GUARD_TIMEOUT}]
-    assert GUARD_COMMAND in COMMAND.read_text(encoding="utf-8"), (
-        "the command string this test asserts on is the one the file writes")
-
-
-@NEEDS_JQ
-def test_the_guard_entry_carries_no_or_true_and_that_is_the_mechanism(tmp_path):
-    """`|| true` ON THIS ENTRY WOULD INSTALL A GUARD THAT REFUSES NOTHING.
-
-    Exit 2 is what BLOCKS a `UserPromptSubmit` prompt
-    (code.claude.com/docs/en/hooks) and `cmd || true` exits 0 for every code the
-    command can produce, so the suffix that is the `SessionStart` entry's whole
-    safety property is this one's whole defeat — and silently, which is the
-    exact state Amendment 12 exists to end. Asserted separately from the shape
-    above because copying the neighbouring string is the obvious way to write
-    this and the result would pass every other test in this file.
-    """
-    link_xfactory(tmp_path)
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    assert user_prompt_commands(tmp_path) == [GUARD_COMMAND]
-    assert "|| true" not in GUARD_COMMAND
-    assert "|| true" in HOOK_COMMAND, (
-        "the SessionStart entry keeps its suffix; only this one must not")
-
-
-@NEEDS_JQ
-def test_installing_twice_adds_one_guard_entry_and_not_two(tmp_path):
-    """Idempotent by EXACT MATCH, the same as the entry beside it — and firing
-    this hook twice is two refusals for one prompt."""
-    link_xfactory(tmp_path)
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    assert user_prompt_commands(tmp_path) == [GUARD_COMMAND]
-    assert "UserPromptSubmit guard: already installed" in second.stdout
-
-
-@NEEDS_JQ
-def test_a_differing_guard_entry_refuses_and_places_nothing(tmp_path):
-    """A SECOND WRITER OF THIS VERY HOOK, and the same refusal its neighbour
-    makes: merging beside it would fire the name guard twice, which is two
-    refusals for one prompt, and repairing a setting a person meant is not an
-    installer's to do."""
-    rival = "~/bin/lane-hook.sh guard"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}}),
-        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "a UserPromptSubmit entry that runs `guard` with a" in result.stderr
-    assert "DIFFERENT command string" in result.stderr
-    assert "NOTHING was installed" in result.stderr
-    assert GUARD_COMMAND in result.stderr, "the refusal prints the exact block"
-    assert user_prompt_commands(tmp_path) == [rival], "it changed the file"
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "the refusal must cost a whole install, not half of one")
-
-
-@NEEDS_JQ
-def test_our_own_guard_entry_beside_a_rival_refuses_the_same_way(tmp_path):
-    """THE SAME ORDER ON THIS ARM, IN THE SAME COMMIT (#59).
-
-    The two reads are one question asked of two events, and the whole reason
-    they are a byte-for-byte mirror is that an arm answering something the other
-    does not is how a person comes to be policed for one entry of a pair and not
-    for the other. So the ordering #59 fixes is the pair's, not the
-    `SessionStart` arm's: with our guard entry beside a second writer of this
-    very hook, the run refuses, names the rival as well as the block it would
-    have placed, and installs nothing — two refusals for one prompt is the harm
-    either way round, and it does not become harmless because one of the two
-    writers is ours.
-    """
-    rival = "~/bin/other.sh guard"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    before = json.dumps({"model": "opus", "hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": GUARD_COMMAND,
-                    "timeout": GUARD_TIMEOUT}]},
-        {"hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}},
-        indent=2)
-    settings.write_text(before, encoding="utf-8")
-    os.chmod(settings, 0o644)
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "a UserPromptSubmit entry that runs `guard` with a" in result.stderr
-    assert "DIFFERENT command string" in result.stderr
-    assert rival in result.stderr, (
-        "the refusal must NAME the rival: this file carries ours too\n"
-        + result.stderr)
-    assert GUARD_COMMAND in result.stderr, "the refusal prints the exact block"
-    assert "NOTHING was installed" in result.stderr
-    assert settings.read_text(encoding="utf-8") == before, "it changed the file"
-    assert stat.S_IMODE(settings.stat().st_mode) == 0o644, (
-        "the `present` arm's mode stamp ran on a file the merge refused")
-    assert session_start_commands(tmp_path) == [], (
-        "the SessionStart entry would have merged cleanly, and must not be "
-        "placed while its pair refuses")
-    assert not (tmp_path / ".local" / "bin").exists(), (
-        "the refusal must cost a whole install, not half of one")
-
-
-@NEEDS_JQ
-def test_an_entry_that_merely_names_guard_in_a_path_is_no_conflict(tmp_path):
-    """THE VERB IS WHAT COLLIDES, NOT THE FILE THAT CARRIES IT — R-A9-14's rule
-    one event over, and this is where it BITES rather than being a nicety.
-
-    `~/projects/xFactory/guard.sh` is a plain `UserPromptSubmit` hook a person's
-    settings may already carry, and this estate's do: the usage guard. Keyed on
-    `guard` as a substring it would be read as a competing writer of Amendment
-    12's hook and the whole install would refuse; keyed on the verb with a
-    boundary on both sides it is what it is — somebody's own setting, kept
-    exactly where it is, with ours added beside it.
-    """
-    link_xfactory(tmp_path)
-    other = "~/projects/xFactory/guard.sh"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    settings.write_text(json.dumps({"hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": other, "timeout": 5}]}]}}),
-        encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert user_prompt_commands(tmp_path) == [other, GUARD_COMMAND]
-
-
-@NEEDS_JQ
-def test_the_two_entries_are_one_all_or_nothing_merge(tmp_path):
-    """A SETTINGS FILE THAT TOOK ONE OF THE PAIR IS A HALF-INSTALL OF A HOOK
-    PAIR, and nothing on screen would say which half.
-
-    The conflict here is on the GUARD entry alone — the file's `SessionStart`
-    is empty and would merge cleanly — so this is the case that proves the
-    all-or-nothing rule covers the pair and not each entry separately. Both
-    merges are computed into one staged file before either is placed, so the
-    refusal leaves the settings file exactly as it was: no `SessionStart` entry
-    either.
-    """
-    rival = "~/bin/other.sh guard"
-    settings = settings_of(tmp_path)
-    settings.parent.mkdir(parents=True)
-    before = json.dumps({"model": "opus", "hooks": {"UserPromptSubmit": [
-        {"hooks": [{"type": "command", "command": rival, "timeout": 5}]}]}})
-    settings.write_text(before, encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert settings.read_text(encoding="utf-8") == before, (
-        "the refusal wrote nothing at all")
-    assert session_start_commands(tmp_path) == [], (
-        "the SessionStart entry would have merged cleanly, and must not be "
-        "placed while its pair refuses")
-    assert not (tmp_path / ".local" / "bin").exists()
-
-
-@NEEDS_JQ
-def test_one_write_places_both_entries_in_one_file(tmp_path):
-    """ONE WRITE FOR THE TWO ENTRIES. They live in one file, and writing it
-    twice would move a person's settings through a state carrying one of the
-    pair — which is the half-install the test above refuses, reached by the
-    happy path instead of by a conflict."""
-    link_xfactory(tmp_path)
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert session_start_commands(tmp_path) == [HOOK_COMMAND]
-    assert user_prompt_commands(tmp_path) == [GUARD_COMMAND]
-    assert stat.S_IMODE(settings_of(tmp_path).stat().st_mode) == 0o600
diff --git a/tests/test_lane_helpers.sh b/tests/test_lane_helpers.sh
deleted file mode 100755
index 9d166e8b..00000000
--- a/tests/test_lane_helpers.sh
+++ /dev/null
@@ -1,17469 +0,0 @@
-#!/usr/bin/env bash
-#
-# test_lane_helpers.sh — lane-start and lane-end, exercised end to end in a
-# sandbox that touches nothing real.
-#
-# WHAT IS FAKED, AND WHY
-#   HOME        a temp directory, so the session records the liveness check
-#               reads, the projects tree it looks for transcripts in, and
-#               ~/projects are all the test's own.
-#   the register  a bare repo plus a clone, seeded with a header and rows.
-#               lanes-edit.sh runs FOR REAL against it — commit, pull, push —
-#               so the tests prove the whole write path, not a stub of it.
-#   tmux        a script that answers display-message and logs rename-window.
-#   claude      a script that logs its argv, so the launch can be watched
-#               even when lane-start exec's it.
-#   liveness    a real `sleep` process for the live case and a reaped pid for
-#               the dead one; nothing is mocked out of /proc.
-#   the logs    Amendment 7's `lanes/log/<lane>.md` live in the sandbox clone,
-#               never beside this file, and a SECOND clone plays the other
-#               workstation so the lost-claim race is run for real.
-#               NO TEST MAY REACH GITHUB, and the thing that guarantees it is
-#               `export LANES_NO_GITHUB=1` below plus `--no-github` on every
-#               case: with it set, gh_reads, gh_comment and gh_stale_claim_url
-#               all return before any `gh` or `git ls-remote` call. The fake
-#               bin is PREPENDED to PATH, not substituted for it, so a real
-#               `gh` on this workstation is still on PATH and is not what
-#               stops the call.
-#
-# WHERE THE FILES ARE, after lane-collision-protocol Amendment 9's move. The
-# lane commands and the shipped alias table live at the ROOT of
-# `opensoft/openRepoTools` and are INSTALLED into a bin directory; the person's
-# workspace repository holds data and no code at all. This suite reproduces
-# exactly that: it copies those files into a sandbox bin directory, seeds a
-# workspace repository with nothing but data in it, and writes the sandbox's own
-# `$AGENT_PROTOCOL_ROOT/workspace.yaml` to join the two — which is the default
-# resolution under test, since `:55` unsets every LANES_* seam so that the
-# DEFAULT is what runs.
-#
-# Run it from anywhere: ./tests/test_lane_helpers.sh
-# Exit 0 when every assertion passes, 1 otherwise.
-
-set -uo pipefail          # NOT -e: a failing assertion must not end the run
-
-SELF="$(readlink -f -- "${BASH_SOURCE[0]}")"
-TESTS_DIR="$(cd -- "$(dirname -- "$SELF")" && pwd)"
-# RE-ANCHORED AT THE REPOSITORY ROOT (Amendment 9, act 3 obligation 5). This
-# file used to require `lane-start`, `lane-end`, `lanes-edit.sh` and
-# `repos.tsv` BESIDE it, because in `opensoft/brett-wip` they were. They are at
-# the root of `opensoft/openRepoTools` now and this suite is in `tests/`.
-SRC_DIR="$(cd -- "$TESTS_DIR/.." && pwd)"
-# THE LANE MANUAL IS THE SPEC LEG'S (opensoft/openRepoTools#186, T009). Two
-# sections below quote `docs/README-lanes.md` back against the code, and in the
-# triad that file is in the spec leg, not beside the code. The pytest runner
-# (`tests/test_lane_helpers_suite.py`) names it from the run's roots; SET AND
-# EMPTY means the run has no spec root - a standalone code leg - and those
-# quotes are SKIPPED, naming it. Unset, it is this checkout's own copy, as it
-# always was, and a composed run never reaches here without one.
-LANE_MANUAL="${OPENREPOTOOLS_LANE_MANUAL-$SRC_DIR/docs/README-lanes.md}"
-
-for f in lane-start lane-end lanes-edit.sh link-estates lane lanes lane-rename lane-worktrees; do
-  [ -x "$SRC_DIR/$f" ] || { echo "missing or not executable: $SRC_DIR/$f" >&2; exit 1; }
-done
-[ -f "$SRC_DIR/repos.tsv" ] || { echo "missing: $SRC_DIR/repos.tsv" >&2; exit 1; }
-
-# WHERE THE TIME GOES, MEASURED BEFORE ANYTHING IS CHANGED (opensoft/openRepoTools#77,
-# step 1a). The nightly runs this file for about 45 minutes and the only number
-# anybody has is the whole of it: lane 1's one instrumented run on WSL put 56% of
-# the wall in the exit trap's `rm -rf "$SANDBOX"` and 57% of the rest in two
-# sections, from ONE run, under contention, on one workstation. Nothing about a
-# CI runner's own split was ever printed, and the pytest wrapper printed this
-# file's transcript only when the suite FAILED, so a green run said nothing at
-# all (step 1b: the wrapper now prints the table and the teardown line below on
-# a pass too). Three things, all of them reading and none of them changing what
-# is run:
-#
-#   `section "== … =="`  prints a heading exactly as `echo` did and stamps the
-#                        clock beside it, so each section's whole-second wall
-#                        time is a row by the time the footer is reached;
-#   `section_report`     prints those rows, longest first, just before the
-#                        footer — which stays the LAST line on stdout, because
-#                        the wrapper looks for ` passed, 0 failed` there;
-#   `cleanup`            times its own `rm -rf` and says so on stderr.
-#
-# AND BOTH GO TO THE JOB'S STEP SUMMARY where CI names one. A passing run's
-# stdout and stderr are both captured by the wrapper, which prints from them
-# only the table and the teardown line (step 1b) and drops the rest. The step
-# summary is the formatted copy, for a person signed in to the web UI.
-# `$GITHUB_STEP_SUMMARY` is a file the runner reads after the step, it
-# is an absolute path and survives the `HOME` and `TMPDIR` this suite moves
-# below, and a write to it that fails is a note on stderr and never a failed
-# assertion: a timing table is not a reason to turn a green run red.
-#
-# `$SECONDS` AND NOT `date +%s` OR `$EPOCHREALTIME`: it is bash's own clock, so
-# a heading costs no process (this file spawns enough of them), and it is in the
-# bash 3.2 this file is written for, which `$EPOCHREALTIME` (5.0) is not. The price
-# is whole seconds, so a row is good to one second either way — which is nothing
-# beside the sections and the teardown this is here to find. It is read as a
-# DIFFERENCE from `SUITE_T0`, because bash takes a `SECONDS` from the
-# environment as its starting value and an absolute read would carry it.
-#
-# Rows are kept as `<seconds><TAB><heading>` lines in one string, not in an
-# array: `"${rows[@]}"` on an empty array is an unbound variable under `set -u`
-# in the bash 3.2 above. The first row, `(preamble …)`, is everything before the
-# first heading — the fakes and the fixtures — and the rows add up to the clock
-# at the table exactly, because each heading closes the last one at the very
-# reading it opens its own with.
-SUITE_T0=$SECONDS
-SECTION_TAB=$'\t'
-SECTION_NAME="(preamble, before the first heading)"
-SECTION_T0=$SUITE_T0
-SECTION_ROWS=""
-TEARDOWN_SAID=""
-
-section_close() {   # <clock reading> — the open section's row, once
-  [ -n "$SECTION_NAME" ] || return 0
-  SECTION_ROWS="${SECTION_ROWS}$(($1 - SECTION_T0))${SECTION_TAB}${SECTION_NAME}"$'\n'
-  SECTION_NAME=""
-}
-
-section() {   # <== heading ==> — printed as `echo` printed it, and clocked
-  local sc_now=$SECONDS
-  section_close "$sc_now"
-  echo "$1"
-  SECTION_NAME="${1#== }"
-  SECTION_NAME="${SECTION_NAME% ==}"
-  SECTION_T0=$sc_now
-}
-
-step_summary() {   # <markdown> — appended to the job's step summary, when CI names one
-  [ -n "${GITHUB_STEP_SUMMARY:-}" ] || return 0
-  printf '%s\n' "$1" >> "$GITHUB_STEP_SUMMARY" ||
-    echo "note: could not append to GITHUB_STEP_SUMMARY ($GITHUB_STEP_SUMMARY)" >&2
-  return 0
-}
-
-section_report() {
-  local sr_now=$SECONDS sr_total sr_sorted sr_secs sr_name sr_pct sr_text="" sr_md=""
-  section_close "$sr_now"
-  sr_total=$((sr_now - SUITE_T0))
-  # Longest first, and by name within a second, so two runs of one suite print
-  # their ties in one order. `LC_ALL=C` because the headings carry em dashes and
-  # a locale's collation is not what a table of seconds is for.
-  sr_sorted="$(printf '%s' "$SECTION_ROWS" | LC_ALL=C sort -t "$SECTION_TAB" -k1,1nr -k2,2)"
-  while IFS="$SECTION_TAB" read -r sr_secs sr_name; do
-    [ -n "$sr_name" ] || continue
-    sr_pct=$(( sr_total > 0 ? sr_secs * 100 / sr_total : 0 ))
-    sr_text="${sr_text}$(printf '%6s s  %3s%%  %s' "$sr_secs" "$sr_pct" "$sr_name")"$'\n'
-    # No heading holds a `|`, which would split its cell; none ever has.
-    sr_md="${sr_md}| ${sr_secs} | ${sr_pct}% | ${sr_name} |"$'\n'
-  done <<SECTION_SORTED
-${sr_sorted}
-SECTION_SORTED
-  printf 'wall time per section, longest first (whole seconds; opensoft/openRepoTools#77):\n'
-  printf '%s' "$sr_text"
-  printf '%6s s  100%%  the whole run, from the top of this file to this table\n' "$sr_total"
-  step_summary "### Shell suite: wall time per section
-
-Whole seconds read from bash's own clock, so each row is good to one second; longest first. The sandbox teardown at exit is timed separately, below.
-
-| seconds | share | section |
-|---:|---:|---|
-${sr_md}| **${sr_total}** | 100% | **the whole run, from the top of the suite to this table** |
-"
-}
-
-teardown_report() {   # <seconds> <took|failed> — stderr, because the footer is stdout's last line
-  if [ "$2" = took ]; then
-    printf 'teardown: rm -rf of the sandbox took %s s\n' "$1" >&2
-    step_summary "### Shell suite: sandbox teardown
-
-The exit trap's \`rm -rf\` of the suite's sandbox took **$1 s** (whole seconds). It runs after the footer, so it is in none of the rows above."
-  else
-    printf 'teardown: rm -rf of the sandbox FAILED after %s s, so part of it is left behind\n' "$1" >&2
-    step_summary "### Shell suite: sandbox teardown
-
-The exit trap's \`rm -rf\` of the suite's sandbox **FAILED after $1 s** (whole seconds), so part of it is left behind. It runs after the footer, so it is in none of the rows above."
-  fi
-}
-
-SANDBOX="$(mktemp -d)"
-# Set before the traps below, so `cleanup` never reads an inherited value.
-A11T_ROOT=""
-REAL_HOME="$HOME"
-
-# THE GUARDS AT THE FOOT OF THIS FILE, re-pointed (Amendment 9, act 3
-# obligation 5). They used to watch `$SRC_DIR/log` and `$SRC_DIR`'s register,
-# which after the move are not in this repository at all — against
-# openRepoTools' root they would pass vacuously and stop guarding the thing
-# they were written for. What they were written for is the OPERATOR'S OWN
-# register and logs, and those are now somewhere this suite can name: the
-# workspace repository the real `~/.agents/workspace.yaml` points at. Read here,
-# before `$HOME` is redirected, and compared again at the end.
-real_ws_path() {
-  local y p
-  y="$REAL_HOME/.agents/workspace.yaml"
-  [ -r "$y" ] || return 1
-  p="$(sed -n -e 's/^path:[[:space:]]*//p' "$y" 2>/dev/null | head -n1)"
-  p="${p%\"}"; p="${p#\"}"; p="${p%\'}"; p="${p#\'}"
-  case "$p" in '~') p="$REAL_HOME" ;; '~/'*) p="$REAL_HOME/${p#'~/'}" ;; esac
-  [ -n "$p" ] && [ -d "$p" ] || return 1
-  printf '%s\n' "$p"
-}
-REAL_WS="$(real_ws_path 2>/dev/null || :)"
-cleanup() {
-  # Every long-lived fixture process, because they now outlive the whole run by
-  # design (see `$LIVE_SLEEP` below) and a suite that dies early must not leave
-  # one behind. `kill` on an empty or already-reaped pid is a no-op here.
-  [ -n "${LIVE_PID:-}" ] && kill "$LIVE_PID" 2>/dev/null
-  [ -n "${G_PANE:-}" ] && kill "$G_PANE" 2>/dev/null
-  [ -n "${G_OUT:-}" ] && kill "$G_OUT" 2>/dev/null
-  [ -n "${DUP_PARENT:-}" ] && kill "$DUP_PARENT" 2>/dev/null
-  [ -n "${DUP_CHILD:-}" ] && kill "$DUP_CHILD" 2>/dev/null
-  [ -n "${RACE_PARENT:-}" ] && kill "$RACE_PARENT" 2>/dev/null
-  [ -n "${RACE_CHILD:-}" ] && kill "$RACE_CHILD" 2>/dev/null
-  # opensoft/openRepoTools#76 and #86's fixtures. `PART_CHILD_B` ignores TERM
-  # on purpose, so it is the one that takes KILL.
-  [ -n "${SP_PARENT:-}" ] && kill "$SP_PARENT" 2>/dev/null
-  [ -n "${SP_CHILD:-}" ] && kill "$SP_CHILD" 2>/dev/null
-  [ -n "${TWO_PARENT:-}" ] && kill "$TWO_PARENT" 2>/dev/null
-  [ -n "${TWO_CHILD_A:-}" ] && kill "$TWO_CHILD_A" 2>/dev/null
-  [ -n "${TWO_CHILD_B:-}" ] && kill "$TWO_CHILD_B" 2>/dev/null
-  [ -n "${PART_PARENT:-}" ] && kill "$PART_PARENT" 2>/dev/null
-  [ -n "${PART_CHILD_A:-}" ] && kill "$PART_CHILD_A" 2>/dev/null
-  [ -n "${PART_CHILD_B:-}" ] && kill -KILL "$PART_CHILD_B" 2>/dev/null
-  [ -n "${GD_DUP:-}" ] && kill "$GD_DUP" 2>/dev/null
-  [ -n "${TH73_PID:-}" ] && kill "$TH73_PID" 2>/dev/null
-  # opensoft/openRepoTools#77, step 1a: THE TEARDOWN IS TIMED, both removals
-  # together, and said ONCE, by a flag. The INT and TERM handlers below call
-  # this and then `exit`, which runs the EXIT trap and so this function a second
-  # time; a second line would repeat the first, or say "took 0 s" about nothing.
-  # The flag is not "is the sandbox still there": a removal that FAILED (a
-  # directory inside it that is not writable) leaves it there, and a guard that
-  # reads that said it twice. The second call still tries the removal again,
-  # as it always did, and says nothing. And a removal that failed is said to
-  # have failed, with the seconds it took to do so, not "took": a number that
-  # reads as a teardown that finished is the one thing this line must not be.
-  local cl_t0=$SECONDS cl_ok=1
-  # #180's short checkout root for the clause (c) TAIL case, which is outside
-  # `$SANDBOX` wherever the run root is long.
-  [ -n "${A11T_ROOT:-}" ] && [ -d "$A11T_ROOT" ] && { rm -rf -- "$A11T_ROOT" || cl_ok=0; }
-  if [ -n "${SANDBOX:-}" ] && [ -d "$SANDBOX" ]; then
-    rm -rf -- "$SANDBOX" || cl_ok=0
-    if [ -z "${TEARDOWN_SAID:-}" ]; then
-      TEARDOWN_SAID=1
-      if [ "$cl_ok" = 1 ]; then
-        teardown_report "$((SECONDS - cl_t0))" took
-      else
-        teardown_report "$((SECONDS - cl_t0))" failed
-      fi
-    fi
-  fi
-  return 0
-}
-# AND A SIGNAL HANDLER THAT CLEANS UP MUST ALSO EXIT. `tests/run.sh` states
-# this rule for its own lock — *"a handler that only cleans up and RETURNS
-# releases the lock while this suite carries on running, which is the collision
-# the lock exists for"* — and one handler on all three signals broke it here in
-# the other direction. Measured 2026-09-16: a `TERM` sent to a run somebody
-# wanted stopped removed `$SANDBOX` and then RETURNED, so the run carried on
-# against a sandbox that was gone — every case after it `env:
-# '.../bin/lane-start': No such file or directory` — and it printed
-# `1567 passed, 233 failed`. A killed run that reports two hundred failures is a
-# transcript that lies about this repository, and somebody reads those.
-# `EXIT` still returns, because the status it carries is the suite's own.
-trap cleanup EXIT
-trap 'cleanup; exit 130' INT
-trap 'cleanup; exit 143' TERM
-
-export HOME="$SANDBOX/home"
-export TMPDIR="$SANDBOX/tmp"
-mkdir -p "$HOME/projects" "$TMPDIR" "$SANDBOX/fakebin"
-export PATH="$SANDBOX/fakebin:$PATH"
-export CLAUDE_CONFIG_DIR="$HOME/.claude"
-# `LANES_WORKSPACE_ROOT` joins the list Amendment 9(a) made it part of: with
-# every seam unset, the DEFAULT resolution — `$AGENT_PROTOCOL_ROOT/workspace.yaml`
-# — is what every case below exercises, which is the whole point of unsetting
-# them. `AGENT_PROTOCOL_ROOT` is then re-exported into the sandbox, two lines
-# down, so the default finds the sandbox's file and never the operator's.
-unset LANES_FILE LANES_EDIT LANES_REPO LANES_PATH LANES_LANE LANES_WORKSPACE_ROOT \
-      LANES_REPOS_TSV LANES_REPOS_TSV_SHIPPED PROJECTS_ROOT CLAUDE_PROJECTS_DIR CLAUDE_BIN CLAUDE_NO_LANE 2>/dev/null
-export AGENT_PROTOCOL_ROOT="$HOME/.agents"
-mkdir -p "$AGENT_PROTOCOL_ROOT"
-# THE ONE `LANES_*` SEAM THIS SUITE SETS RATHER THAN UNSETS, for the reason the
-# line above unsets the rest (A9 Addendum 4, R-A9-13). Every seed row below
-# spells the workstation column `Eagle` — 55 of them — and what those rows are
-# for is the REGISTER'S READING of that column: which rows are this
-# workstation's, which are another's, which crossing is a live lane here and
-# which an orphan there. The host's own name is not under test in any of them,
-# so taking it from the host made the whole file green on a workstation
-# literally named Eagle and red on every other machine, GitHub's runners
-# included: `lanes-edit.sh:438` reads `${LANES_WORKSTATION:-$(hostname -s)}`
-# and `lane-start`/`lane-end` now read the same. Pinned here, the rows and the
-# helpers agree wherever this runs.
-#
-# THE DEFAULT IS STILL UNDER TEST, one section from the end: `== the
-# workstation seam ==` unsets this variable and asserts all three writers fall
-# back to `hostname -s` — so pinning it here cannot hide a helper that stopped
-# reading the host at all.
-export LANES_WORKSTATION=Eagle
-
-# `timeout(1)` IS GNU coreutils AND A STOCK macOS DOES NOT SHIP IT (A9 Addendum
-# 4, R-A9-11). `lanes-edit.sh:810` bounds its network calls with it and reaches
-# for it through `command -v`, so on such a host Amendment 8(h)'s bound is
-# simply ABSENT: a push that hangs holds the mutex until it is killed. That is
-# a real platform gap and it is recorded rather than shimmed — a fake `timeout`
-# in `$SANDBOX/fakebin` would make these cases green on a host where the
-# behaviour they assert does not happen. Read AFTER the fake bin is on PATH, so
-# it answers for the PATH the cases actually run under.
-HAVE_TIMEOUT=0; command -v timeout >/dev/null 2>&1 && HAVE_TIMEOUT=1
-NO_TIMEOUT_WHY="no timeout(1) on this host, so lanes-edit.sh's Amendment 8(h) bound is absent here and there is nothing to assert"
-
-pass=0; fail=0; skipped=0
-ok()  { pass=$((pass + 1)); printf 'ok   %s\n' "$1"; }
-bad() { fail=$((fail + 1)); printf 'FAIL %s\n       %s\n' "$1" "${2-}"; }
-# A THIRD ANSWER, because two were not enough and the third was being given
-# SILENTLY (A9 Addendum 4, R-A9-11). A case that cannot run on this host must
-# say so: `timeout(1)` is not on a stock macOS, and the four cases that drive
-# `lanes-edit.sh`'s hung-push bound were not passing there — two were red, and
-# two more were GREEN AND VACUOUS, having asserted that a command which never
-# ran printed nothing. A skip is printed, counted, and named in the footer.
-skip() { skipped=$((skipped + 1)); printf 'skip %s\n       %s\n' "$1" "${2-}"; }
-# AN ASSERTION THAT IS OWED TO A COMMIT LANDING IN ANOTHER REPOSITORY, NAMED
-# RATHER THAN OMITTED. Amendment 11's tooling round was directed to build ON the
-# `opensoft/brett-wip` hotfix of 2026-09-13 — step 3b's ownership fence, `--name`
-# on every launch branch, and `log` refusing `unknown` — which `openRepoTools#24`
-# (Amendment 9's adoption act 3, merged as `d4b5710`) ports into this tree, and NOT to write those three a second time. The tests
-# that would catch each are written here anyway, because a test written after the
-# fix is a test that never proved anything; until the port arrives they report
-# PENDING with the exact expectation, and the moment it does they are ordinary
-# assertions that pass or fail. PENDING is neither a pass nor a failure and the
-# count is printed at the foot, so nothing is hidden by it.
-pending_n=0; pending_list=""
-pending() {   # <name> <got> <want> <what lands it>
-  if [ "$2" = "$3" ]; then ok "$1"; return 0; fi
-  pending_n=$((pending_n + 1))
-  pending_list="${pending_list}  $1
-      expected [$3], got [$2]
-      lands with: $4
-"
-  printf 'PEND %s\n       expected [%s], got [%s]\n       lands with: %s\n' "$1" "$3" "$2" "$4"
-}
-is()  { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected [$3], got [$2]"; fi; }
-# NO `tr` AND NO `cut`: THE ONLY PLACE A FAILURE IS EVER RENDERED MUST NOT
-# DEPEND ON EITHER (A9 Addendum 4, R-A9-11), and this estate's messages are
-# full of em dashes. Both spellings this line has already had were lost on the
-# macOS job, in opposite directions:
-#
-#   `tr '\n' '~' | cut -c1-400`   BSD `tr` is not multibyte-aware and answers
-#   (`9000e86`)                   `Illegal byte sequence` for an em dash,
-#                                 printing NOTHING. A failure whose `got:` is
-#                                 empty is a failure nobody can read.
-#   `LC_ALL=C tr | LC_ALL=C cut`  fixes that, and then truncates BYTES — which
-#   (`dcf1027`, `d3d59b5`)        split one em dash in half and cost the WHOLE
-#                                 998-line transcript to a single
-#                                 `UnicodeDecodeError` in the pytest wrapper.
-#
-# Bash does both jobs with no process at all: `${e//…}` swaps the newlines and
-# `${e:0:400}` truncates by CHARACTER wherever the locale is a UTF-8 one. The
-# macOS runner's is — that is not an assumption, it is what the first spelling
-# proved: BSD `tr` reports `Illegal byte sequence` only in a multibyte locale,
-# and it reported it there. And the guarantee does not rest on that reading
-# anyway: `tests/test_lane_helpers_suite.py` decodes this transcript with
-# `errors="replace"`, so the very worst a locale nobody expected can now do is
-# put one `\ufffd` in one line, where it used to hide all 998.
-#
-# `$tilde`, NOT a literal `~`: bash TILDE-EXPANDS the replacement half of
-# `${var//pattern/replacement}`, so a bare `~` there puts `$HOME` between every
-# pair of lines — measured, and it made a one-line excerpt unreadable in
-# exactly the failures it exists to render.
-excerpt() { local e tilde='~'; e="${1//$'\n'/$tilde}"; printf '%s' "${e:0:400}"; }
-has() { case "$2" in *"$3"*) ok "$1" ;; *) bad "$1" "expected to contain [$3]; got: $(excerpt "$2")" ;; esac; }
-hasnt() { case "$2" in *"$3"*) bad "$1" "did NOT expect [$3]; got: $(excerpt "$2")" ;; *) ok "$1" ;; esac; }
-# lane-start mints a fresh uuid for a NEW session, so its launch line carries a
-# value no test can predict. `launch_of` removes just that pair, leaving the
-# rest of the command line exactly comparable; `minted_of` returns the uuid.
-UUID_RE='[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}'
-launch_of() { printf '%s' "$1" | sed -E "s/ --session-id $UUID_RE//"; }
-minted_of() { printf '%s' "$1" | grep -oE -- "--session-id $UUID_RE" | head -n1 | awk '{print $2}'; }
-
-rc=0; out=""; err=""
-run() { out="$("$@" 2>"$SANDBOX/stderr")"; rc=$?; err="$(cat "$SANDBOX/stderr")"; }
-
-# THIS SUITE'S CLOCK, AND IT IS PORTABLE (A9 Addendum 4, R-A9-11). Ten fixture
-# stamps below are written relative to now, and `date -u -d '-5 hours'` is
-# GNU-only: BSD `date` — macOS's, and this file RUNS on the macOS job, because
-# obligation 4's gate is a run gate by design — answers `illegal option -- d`
-# and prints its usage, which is what every one of those ten used to get. BSD
-# spells the same arithmetic `-v-5H`, so the adjustments are written HERE in
-# that spelling, once, and translated for GNU: `utc_at -3H -26S` is three hours
-# and twenty-six seconds ago on either. GNU is asked first, because it is what
-# every lane workstation runs.
-#
-# `ua_bsd` is declared and assigned on separate lines because `local x=()` is
-# not something bash 3.2 — the bash this file is parsed by on that runner — can
-# be relied on to take.
-utc_at() {   # <+|-><n><H|M|S> …
-  local ua_a ua_n ua_unit ua_gnu=""
-  local ua_bsd; ua_bsd=()
-  [ $# -gt 0 ] || { echo "utc_at: needs at least one <+|-><n><H|M|S>" >&2; return 1; }
-  for ua_a in "$@"; do
-    ua_n="${ua_a%?}"; ua_unit="${ua_a#"$ua_n"}"
-    case "$ua_unit" in
-    H) ua_unit=hours ;; M) ua_unit=minutes ;; S) ua_unit=seconds ;;
-    *) echo "utc_at: '$ua_a' is not <+|-><n><H|M|S>" >&2; return 1 ;;
-    esac
-    ua_gnu="${ua_gnu:+$ua_gnu }$ua_n $ua_unit"
-    ua_bsd+=("-v$ua_a")
-  done
-  date -u -d "$ua_gnu" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null ||
-    date -u "${ua_bsd[@]}" +%Y-%m-%dT%H:%M:%SZ
-}
-
-# ---------------------------------------------------------------- the fakes
-
-cat > "$SANDBOX/fakebin/tmux" <<'FAKE'
-#!/usr/bin/env bash
-# AMENDMENT 11 — THIS FAKE NOW ANSWERS A TARGETED READ, because clause (h)'s
-# `window-lane` is built on one: `tmux display-message -p -t <ref> '#{window_id}'`
-# is the LIVENESS FENCE itself — a record whose window is gone names a window
-# somebody else's `:0` may since have been given, and matching a dead ref is how
-# a lane binds to a stranger's pane. A fake that answered every ref would make
-# every one of those cases vacuous.
-#
-#   $FAKE_TMUX_WINDOWS   the workstation's live windows, one per line,
-#                        `<session>:<index><TAB><@id><TAB><name>`. A ref that is
-#                        in no line RESOLVES NOTHING and the fake exits 1,
-#                        exactly as tmux does for a window that is gone.
-#
-# The untargeted reads keep their old seams and DERIVE the two new formats from
-# `$FAKE_TMUX_WINDOW`, so every case written before Amendment 11 goes on
-# describing one window rather than three variables that could disagree.
-#
-# AMENDMENT 12 ADDS TWO COLUMNS AND TWO FORMATS, both optional and both inert
-# for every line written before it. The columns are `<TAB><%pane><TAB><pane's
-# current command>`; a targeted read now matches a `%pane` as well as a ref and
-# an `@id`, because the lock types into a PANE. The formats are:
-#
-#   '#{session_name}'          Amendment 11(h)'s agreement rule, asked of an
-#                              `@id`: tmux REUSES window ids, so a record's id
-#                              resolving is not the record's window unless the
-#                              session it resolves in is the one the record
-#                              wrote down.
-#   '#{pane_current_command}'  M1's condition on typing at all — `/rename` typed
-#                              at a shell is a command that does not exist. It
-#                              answers `claude` for a line that carries no fifth
-#                              column, so every case written before this one
-#                              describes a pane running claude, which is what
-#                              they all were.
-#
-# AND `send-keys` IS LOGGED, exactly as `rename-window` always was: the lock and
-# the offer's `no` are acts on a pane and this is how a case sees them.
-#
-# AND A RENAME CAN BE REFUSED (opensoft/openRepoTools#80 item 11). Under
-# `$FAKE_TMUX_RENAME_FAIL=1` the `rename-window` is still LOGGED — a case reads
-# that it was attempted — and then refused the way tmux refuses one, on stderr
-# with a nonzero exit, and the name does not stick. Unset, nothing changes for
-# any case written before it.
-#
-# openRepoTools#73 ADDS A SILENT SERVER AND ONE UNTARGETED FORMAT. Under
-# `$FAKE_TMUX_SILENT=1` every call answers as tmux does with no server to reach
-# — nothing on stdout, `no server running on …` on stderr, exit 1 — which is the
-# state a dead WINDOW must not be read out of. And the untargeted
-# `'#{session_name}'` is `record_window_state`'s second question, "does a server
-# answer here at all", so it answers the session of `$FAKE_TMUX_WINDOW`, as tmux
-# answers for the client a shell is in.
-if [ "${FAKE_TMUX_SILENT:-0}" = 1 ]; then
-  printf 'no server running on %s\n' "${TMUX%%,*}" >&2
-  exit 1
-fi
-case "${1-}" in
-  list-windows)
-    if [ -n "${FAKE_TMUX_WINDOWS:-}" ]; then
-      printf '%s\n' "$FAKE_TMUX_WINDOWS" | awk -F'\t' 'NF >= 3 { print $2 "\t" $3 }'
-    else
-      printf '%s\t%s\n' "${FAKE_TMUX_WINDOW_ID:-${FAKE_TMUX_WINDOW##*:}}" "${FAKE_TMUX_WINDOW_NAME:-claude}"
-    fi ;;
-  display-message)
-    shift
-    fake_t=""; fake_f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -p) shift ;;
-        -t) fake_t="${2-}"; shift 2 ;;
-        *)  fake_f="$1"; shift ;;
-      esac
-    done
-    if [ -n "$fake_t" ]; then
-      fake_l="$(printf '%s\n' "${FAKE_TMUX_WINDOWS:-}" | awk -F'\t' -v t="$fake_t" '$1 == t || $2 == t || ($4 != "" && $4 == t) { print; exit }')"
-      [ -n "$fake_l" ] || exit 1
-      fake_sess="$(printf '%s' "$fake_l" | cut -f1)"
-      fake_cmd="$(printf '%s' "$fake_l" | cut -f5)"
-      case "$fake_f" in
-        '#{window_id}')            printf '%s\n' "$(printf '%s' "$fake_l" | cut -f2)" ;;
-        '#{window_name}')          printf '%s\n' "$(printf '%s' "$fake_l" | cut -f3)" ;;
-        '#{session_name}')         printf '%s\n' "${fake_sess%%:*}" ;;
-        '#{pane_current_command}') printf '%s\n' "${fake_cmd:-claude}" ;;
-        *)                         printf '\n' ;;
-      esac
-      exit 0
-    fi
-    fake_w="${FAKE_TMUX_WINDOW:-testsess:@1}"
-    case "$fake_f" in
-      '#{session_name}:#{window_id}')    printf '%s\n' "$fake_w" ;;
-      '#{session_name}')                 printf '%s\n' "${fake_w%%:*}" ;;
-      '#{session_name}:#{window_index}') printf '%s\n' "${fake_w%%:*}:${FAKE_TMUX_WINDOW_INDEX:-0}" ;;
-      '#S:#I')                           printf '%s\n' "${fake_w%%:*}:${FAKE_TMUX_WINDOW_INDEX:-0}" ;;
-      '#{window_id}')                    case "${fake_w#*:}" in @*) printf '%s\n' "${fake_w#*:}" ;; *) printf '%s\n' "${FAKE_TMUX_WINDOW_ID:-@1}" ;; esac ;;
-      '#W'|'#{window_name}')
-        # AMENDMENT 12 — AN OPT-IN STICKY RENAME, and it is opt-in because the
-        # fake's `#W` has been a CONSTANT for every case written before it: a
-        # `rename-window` that started changing the answer would rewrite the
-        # premise of every case that renames and then reads it again. Under
-        # `$FAKE_TMUX_RENAME_STICKS=1` the rename lands, which is what real tmux
-        # does and what Amendment 12(h)'s offer needs: `lane-start`'s veto 2
-        # reads `#W`, and after a `yes` this window really has been renamed.
-        fake_n="${FAKE_TMUX_WINDOW_NAME:-claude}"
-        if [ "${FAKE_TMUX_RENAME_STICKS:-0}" = 1 ] && [ -s "${FAKE_TMUX_NAME_FILE:-/nonexistent}" ]; then
-          fake_n="$(cat "$FAKE_TMUX_NAME_FILE")"
-        fi
-        printf '%s\n' "$fake_n" ;;
-      '#{pane_id}')                      printf '%s\n' "${FAKE_TMUX_PANE_ID:-}" ;;
-      '#{pane_pid}')                     printf '%s\n' "${FAKE_TMUX_PANE_PID:-}" ;;
-      *)                                 printf '\n' ;;
-    esac ;;
-  rename-window)
-    printf 'rename-window %s\n' "${2-}" >> "${FAKE_TMUX_LOG:-/dev/null}"
-    if [ "${FAKE_TMUX_RENAME_FAIL:-0}" = 1 ]; then
-      printf 'no current client\n' >&2
-      exit 1
-    fi
-    if [ "${FAKE_TMUX_RENAME_STICKS:-0}" = 1 ] && [ -n "${FAKE_TMUX_NAME_FILE:-}" ]; then
-      printf '%s\n' "${2-}" > "$FAKE_TMUX_NAME_FILE"
-    fi ;;
-  send-keys)
-    shift
-    fake_st=""; fake_sk=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -t) fake_st="${2-}"; shift 2 ;;
-        *)  fake_sk="${fake_sk}${fake_sk:+ }$1"; shift ;;
-      esac
-    done
-    printf 'send-keys -t %s %s\n' "$fake_st" "$fake_sk" >> "${FAKE_TMUX_LOG:-/dev/null}" ;;
-  *) : ;;
-esac
-FAKE
-
-cat > "$SANDBOX/fakebin/claude" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_CLAUDE_LOG:-/dev/null}"
-FAKE
-
-# issue #39 — `duplicate_holder_pids` is the only caller of either, and it
-# reaches no real process table: `ps` and `pgrep` are faked here for the
-# WHOLE suite (this bin is prepended to PATH for every case, not only the
-# ones below), so a pre-existing test that never sets a `FAKE_PS_*`/
-# `FAKE_PGREP_*` variable gets the honest "nothing found" answer — `pgrep -f`
-# exits 1, `ps -p` exits 1 — rather than a peek at whatever is really running
-# on the runner.
-cat > "$SANDBOX/fakebin/pgrep" <<'FAKE'
-#!/usr/bin/env bash
-case "${1-}" in
-  -f)
-    out="$(printf '%s\n' "${FAKE_PGREP_F_PIDS:-}" | awk 'NF')"
-    [ -n "$out" ] || exit 1
-    printf '%s\n' "$out" ;;
-  -P)
-    out="$(printf '%s\n' "${FAKE_PGREP_CHILDREN:-}" | awk -F'\t' -v pp="${2-}" '$2 == pp { print $1 }')"
-    [ -n "$out" ] || exit 1
-    printf '%s\n' "$out" ;;
-  *) exit 1 ;;
-esac
-FAKE
-
-cat > "$SANDBOX/fakebin/ps" <<'FAKE'
-#!/usr/bin/env bash
-# The supervised child is a real sandbox process. Its stat read must report
-# real zombie/active state; the older signature fixtures still use records.
-case "$*" in *"-o stat="*) exec /bin/ps "$@" ;; esac
-target=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    -p) target="${2-}"; shift 2 ;;
-    *)  shift ;;
-  esac
-done
-[ -n "$target" ] || exit 1
-line="$(printf '%s\n' "${FAKE_PS_RECORDS:-}" | awk -F'\t' -v p="$target" '$1 == p { print; exit }')"
-[ -n "$line" ] || exit 1
-printf '%s\n' "$line" | awk -F'\t' '{printf "%s %s %s\n", $1, $2, $3}'
-FAKE
-
-# A FAKE `gh`, AND IT MAKES THIS SUITE SAFER RATHER THAN LOOSER (Copilot round 7
-# on openRepoTools#81). `LANES_NO_GITHUB=1` below stops every `gh` call this
-# helper would make, which is why there was no fake at all — and why Amendment
-# 16(g)'s POST-COMMIT COMMENT, the one act of `rename-lane` that happens after
-# the push, had no test: every case here switches it off. The fake is the way to
-# test it without reaching anything, and note what it changes for the rest of the
-# file: the fakebin is PREPENDED to `$PATH`, so until now a call that slipped
-# past `LANES_NO_GITHUB` would have found the WORKSTATION'S OWN `gh`. It cannot
-# now. Anything but the two comment forms `gh_comment` makes is a loud refusal.
-cat > "$SANDBOX/fakebin/gh" <<'FAKE'
-#!/usr/bin/env bash
-# `gh issue comment <n> --repo <owner/repo> --body-file -` and its `pr` twin are
-# the only calls this fake answers; the body arrives on stdin.
-fake_gh_kind="${1-}"; fake_gh_verb="${2-}"; shift 2 2>/dev/null || :
-case "$fake_gh_kind/$fake_gh_verb" in
-  issue/comment | pr/comment) : ;;
-  *)
-    printf 'FAKE gh REFUSED: %s %s — this suite reaches no GitHub surface
-'       "$fake_gh_kind" "$fake_gh_verb" >&2
-    exit 90 ;;
-esac
-fake_gh_n="${1-}"; fake_gh_repo=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --repo) fake_gh_repo="${2-}"; shift 2 ;;
-    *) shift ;;
-  esac
-done
-[ "${FAKE_GH_FAIL:-0}" = 1 ] && { printf 'FAKE gh: refusing on purpose
-' >&2; exit 1; }
-{ printf '=== %s %s %s %s
-' "$fake_gh_kind" "$fake_gh_verb" "$fake_gh_repo" "$fake_gh_n"
-  cat
-  printf '
-'
-} >> "${FAKE_GH_LOG:-/dev/null}"
-printf 'https://github.com/%s/issues/%s#issuecomment-%s
-'   "${fake_gh_repo:-owner/repo}" "${fake_gh_n:-0}" "$$"
-FAKE
-
-chmod +x "$SANDBOX/fakebin/tmux" "$SANDBOX/fakebin/claude" "$SANDBOX/fakebin/pgrep" "$SANDBOX/fakebin/ps" "$SANDBOX/fakebin/gh"
-export FAKE_TMUX_LOG="$SANDBOX/tmux.log" FAKE_CLAUDE_LOG="$SANDBOX/claude.log"
-export FAKE_GH_LOG="$SANDBOX/gh.log"
-: > "$FAKE_TMUX_LOG"; : > "$FAKE_CLAUDE_LOG"; : > "$FAKE_GH_LOG"
-export TMUX="$SANDBOX/fake-tmux-socket,0,0"
-
-# Amendment 7: no test may reach GitHub, whatever a case forgets to pass. The
-# fake above is the second lock on the same door: this variable stops the call
-# being made, and the fake stops the workstation's own `gh` being what answers
-# it if a case switches the variable off on purpose — which exactly one does.
-export LANES_NO_GITHUB=1
-
-# AMENDMENT 14 — NO CASE HERE NUDGES AN INDEXER BY ACCIDENT. Every write in this
-# file that pushes would start a detached `lanes-index sync` wherever one is on
-# PATH, and the PATH above is the workstation's own with the sandbox's in front
-# of it: the day a person installs `lanes-index`, a thousand writes would start
-# a thousand of them. Off for the file, and the one section that is about the
-# index turns it back on for its own cases.
-export LANES_INDEX=off
-
-# opensoft/openRepoTools#162 — AND NO CASE STARTS THE ESTATE REPORT EITHER.
-# `lane-start` runs `lane-worktrees sweep --all --report` detached, once a day,
-# and the state directory it stamps may be the workstation's own. Off for the
-# file; the section about the report turns it on for its own cases.
-export LANE_WORKTREES_REPORT=off
-
-# Amendment 8, ruling (g): the harness exports `CLAUDE_CODE_SESSION_ID` into
-# every shell a session runs, INCLUDING the one running this suite. It is a
-# holder test now, so a case that does not set it deliberately must not inherit
-# the real session's id and answer differently inside a session than outside one.
-unset CLAUDE_CODE_SESSION_ID
-STALE_H=4                      # lanes-edit.sh's default, Rule 1's four hours
-
-# ------------------------------------------------------------- the register
-
-# THE BIN DIRECTORY — the post-move world, where `--install` places the lane
-# commands and the shipped alias table as regular files at 755. The workspace
-# repository below gets NONE of them: Amendment 9(a), data only.
-export OPENREPOTOOLS_BIN_DIR="$SANDBOX/bin"
-mkdir -p "$OPENREPOTOOLS_BIN_DIR"
-cp -p "$SRC_DIR/lane-start" "$SRC_DIR/lane-end" "$SRC_DIR/lanes-edit.sh" \
-      "$SRC_DIR/link-estates" "$SRC_DIR/lane" "$SRC_DIR/lanes" \
-      "$SRC_DIR/lane-rename" "$SRC_DIR/repos.tsv" "$SRC_DIR/lane-worktrees" \
-      "$OPENREPOTOOLS_BIN_DIR/"
-chmod 755 "$OPENREPOTOOLS_BIN_DIR"/lane-start "$OPENREPOTOOLS_BIN_DIR"/lane-end \
-          "$OPENREPOTOOLS_BIN_DIR"/lanes-edit.sh "$OPENREPOTOOLS_BIN_DIR"/link-estates \
-          "$OPENREPOTOOLS_BIN_DIR"/lane "$OPENREPOTOOLS_BIN_DIR"/lanes \
-          "$OPENREPOTOOLS_BIN_DIR"/lane-rename "$OPENREPOTOOLS_BIN_DIR"/repos.tsv \
-          "$OPENREPOTOOLS_BIN_DIR"/lane-worktrees
-# AFTER the fake bin, which must still win for `tmux` and `claude`.
-export PATH="$SANDBOX/fakebin:$OPENREPOTOOLS_BIN_DIR:$PATH"
-
-ORIGIN="$SANDBOX/origin.git"
-WIP="$HOME/projects/brett-wip"
-git init -q --bare -b main "$ORIGIN"
-git clone -q "$ORIGIN" "$WIP" 2>/dev/null
-git -C "$WIP" config user.email "test@example.invalid"
-git -C "$WIP" config user.name  "lane helper tests"
-mkdir -p "$WIP/lanes" "$WIP/handoffs"
-printf '# handoffs — one directory per estate\n' > "$WIP/handoffs/README.md"
-
-# THE POINTER FILE, which is the whole of the new resolution (Amendment 9(a)).
-# `repository:` is the sandbox's own bare origin rather than a GitHub slug, and
-# the helpers' checkout test compares the two after the same normalisation, so
-# a non-GitHub origin is checked exactly as a GitHub one is.
-{
-  printf 'repository: %s\n' "$ORIGIN"
-  printf 'path: %s\n' "$WIP"
-} > "$AGENT_PROTOCOL_ROOT/workspace.yaml"
-
-LANES="$WIP/lanes/LANES.md"
-{
-  printf '# LANES.md — the sandbox register\n\n'
-  printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-  printf '|---|---|---|---|---|---|---|\n'
-} > "$LANES"
-
-add_seed_row() { printf '%s\n' "$1" >> "$LANES"; }
-
-# repoA-1  a lane whose session has ENDED — free, and resumable
-# repoA-2  the same, with no transcript of its own
-# repoB-1  a lane a LIVE session holds, in another window
-# repoC-1  a row whose live session has been RENAMED to another lane
-# repoD-1  a row with an open LANDING       (lane-end refuses)
-# repoD-2  a row that says NOTHING CLAIMED  (lane-end must NOT refuse)
-# repoD-3  LANDING then LANDED              (lane-end must NOT refuse)
-DEAD_ID="00000000-dead-4000-8000-0000000dead0"
-LIVE_ID="11111111-11ee-4000-8000-1111111111ee"
-GONE_ID="22222222-c0de-4000-8000-2222222222ff"
-# repoA-2 proves the NO-HISTORY path, so its recorded id must be one this
-# directory has no transcript for (under Amendment 6 a resolvable id wins).
-GHOST4_ID="88888888-9057-4000-8000-8888888888ff"
-add_seed_row "| \`repoA-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoA-2\` | harness \`$GHOST4_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoB-1\` | harness \`$LIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoB/x.md | ACTIVE |"
-add_seed_row "| \`repoC-1\` | harness \`$GONE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoC/x.md | ACTIVE |"
-add_seed_row "| \`repoD-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoD/x.md | ACTIVE · LANDING #7 into repoD main |"
-add_seed_row "| \`repoD-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoD/x.md | IDLE, NOTHING CLAIMED · no LANDING open |"
-add_seed_row "| \`browser-ui-repair\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoD/x.md | ACTIVE |"
-add_seed_row "| \`repoD-3\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoD/x.md | ACTIVE · LANDING #7 · LANDED — PR #7 → abc1234 |"
-
-# Amendment 6 (resume the row's RECORDED SESSION, not its title).
-# repoA-11  the row's id has NO transcript here, but a titled one exists  -> title fallback
-# repoA-12  the cell is a HISTORY of two ids, both with transcripts       -> the LAST one wins
-# repoA-13  the cell records only `session_…` footer ids (no uuid at all) -> new session + a hint
-# repoA-14  one unique uuid, no transcript, no title                      -> new session + the cell is stamped
-# repoA-15  the same as 14, with LANE_START_SESSION_ID=0                  -> new session, nothing minted
-GHOST_ID="33333333-9057-4000-8000-3333333333aa"
-OLD12_ID="44444444-01d0-4000-8000-4444444444bb"
-NEW12_ID="55555555-0e00-4000-8000-5555555555cc"
-GHOST2_ID="66666666-9057-4000-8000-6666666666dd"
-GHOST3_ID="77777777-9057-4000-8000-7777777777ee"
-GHOST5_ID="99999999-9057-4000-8000-99999999aabb"
-add_seed_row "| \`repoA-11\` | harness \`$GHOST_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoA-12\` | harness \`$OLD12_ID\` → after /clear \`$NEW12_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoA-13\` | \`session_015byFrZSopmRbUWNMYt1zEA\` (profile team-02c); earlier \`session_01EdVCYtG7YQ4s347uCrHVLY\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoA-14\` | harness \`$GHOST2_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-add_seed_row "| \`repoA-15\` | harness \`$GHOST3_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-# repoA-16  the only transcript here carries the DEDUPE-SUFFIXED title
-add_seed_row "| \`repoA-16\` | harness \`$GHOST5_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA/x.md | ACTIVE |"
-
-# Amendment 7 rows.
-# repoF-1  a LIVE session whose record name is auto-DERIVED and does not match
-#          the lane — the 2026-09-11 hole: it is still the holder.
-# repoG-3  a LIVE session EXPLICITLY named for another lane — not a holder.
-# repoG-1  holds a stale claim, a claim that is NOT stale because a PR names
-#          it, and an open LANDING; repoG-2 is the lane that takes over.
-# repoH-1 / repoH-2  the two sides of a race decided by which claim LANDS.
-# repoP-1 / repoP-2  PRE-CUTOVER: no object log, ever.
-# repoR-1  a row whose workstation column is another machine.
-# repoK-1  RETIRED, no live session — its OPENED PR and a FRESH CLAIMED issue
-#          are both takeable whatever the verb (issue #30); repoK-2 takes over.
-# repoK-3  RETIRED too, but a LIVE session still backs the id up — refused
-#          exactly as a live holder is (issue #30's own liveness confirmation).
-F_ID="aaaa0001-f1f1-4000-8000-aaaa0001f1f1"
-G_ID="aaaa0002-6363-4000-8000-aaaa00026363"
-R_ID="aaaa0003-4a4e-4000-8000-aaaa00034a4e"
-H_ID="aaaa0004-8e8e-4000-8000-aaaa00048e8e"
-KLIVE_ID="aaaa0005-1234-4000-8000-aaaa00051234"
-# repoM-1 — issue #39: a `--fork-session` DUPLICATE HOLDER of its own
-# transcript, found in the (faked) process table, alongside its own real
-# live session under the SAME id. `--retire` must take the duplicate and
-# refuse the lane's own live pid.
-MLIVE_ID="aaaa0006-3939-4000-8000-aaaa00063939"
-add_seed_row "| \`repoF-1\` | harness \`$F_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoF/x.md | ACTIVE |"
-add_seed_row "| \`repoG-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoG/x.md | ACTIVE |"
-add_seed_row "| \`repoG-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoG/x.md | ACTIVE |"
-add_seed_row "| \`repoG-3\` | harness \`$G_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoG/x.md | ACTIVE |"
-add_seed_row "| \`repoK-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-add_seed_row "| \`repoK-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-add_seed_row "| \`repoK-3\` | harness \`$KLIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-add_seed_row "| \`repoK-4\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-# repoK-5 — Copilot round 13, PR #61: the SAME live-but-RETIRED shape as
-# repoK-3, but its held object is a stale CLAIMED rather than an OPENED PR —
-# the one combination `holder_is_dead` returning false could still fall
-# through into the ordinary stale-claim branch for. repoK-6 is the taker.
-K5LIVE_ID="aaaa0007-4b35-4000-8000-aaaa00074b35"
-add_seed_row "| \`repoK-5\` | harness \`$K5LIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-add_seed_row "| \`repoK-6\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoK/x.md | ACTIVE |"
-# repoL-1/3/5 — Copilot round 8, PR #61: issue #30's dead-lane takeover,
-# regression-tested for OPENED and CLAIMED (repoK-1/2 above) but not for
-# LANDING, WITHDRAWN or an earlier TAKEOVER — the same broadened
-# `superseded_by`/`lane_states_on` open-verb set this round's fix touches.
-# repoL-2/4/6 are the takers.
-add_seed_row "| \`repoL-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-add_seed_row "| \`repoL-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-add_seed_row "| \`repoL-3\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-add_seed_row "| \`repoL-4\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-add_seed_row "| \`repoL-5\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-add_seed_row "| \`repoL-6\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoL/x.md | ACTIVE |"
-# repoChain-1/2/3 — opensoft/openRepoTools#74: CHAINS of takeovers, every link
-# naming the lane it displaced as `← lane:<x>` (the payload issue #30's
-# dead-lane takeover writes), all three lanes dead (RETIRED, no live session).
-# repoChain-4 is the taker that makes the third link of the chain below.
-add_seed_row "| \`repoChain-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoChain/x.md | ACTIVE |"
-add_seed_row "| \`repoChain-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoChain/x.md | ACTIVE |"
-add_seed_row "| \`repoChain-3\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoChain/x.md | ACTIVE |"
-add_seed_row "| \`repoChain-4\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoChain/x.md | ACTIVE |"
-add_seed_row "| \`repoM-1\` | harness \`$MLIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoM/x.md | ACTIVE |"
-# repoN-1 / repoN-2 — issue #30's OTHER terminal verb: a plain `lane-end`
-# (no --retire) writes ENDED, never RETIRED, and `holder_is_dead` names both
-# in its case; repoK-1/3 above exercise RETIRED only.
-add_seed_row "| \`repoN-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoN/x.md | ACTIVE |"
-add_seed_row "| \`repoN-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoN/x.md | ACTIVE |"
-# repoT-1 — Copilot round 12, PR #61 (the open thread on eea55a7, issue #30's
-# own race): RETIRED and no live session, exactly like repoL-1, so a takeover
-# is granted on the same stale, pre-fetch terms; repoT-2 is the taker, and the
-# peer resumes repoT-1 between that grant and the takeover's own push landing.
-add_seed_row "| \`repoT-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoT/x.md | ACTIVE |"
-add_seed_row "| \`repoT-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoT/x.md | ACTIVE |"
-# repoTx-1 — Copilot on 05d7889, PR #61: dead exactly as repoT-1, and the same
-# stale-pre-fetch race, but what the takeover's own recheck meets is a log it
-# CANNOT READ at all, never a RESUMED line; repoTx-2 is the taker.
-add_seed_row "| \`repoTx-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoTx/x.md | ACTIVE |"
-add_seed_row "| \`repoTx-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoTx/x.md | ACTIVE |"
-# repoKr-1 — Copilot on 8ce6c9d, PR #61 (Amendment 18(b)): RETIRED, no live
-# session here, but its last STARTED carries a MODERN binding on another host,
-# so this workstation's empty read proves nothing; repoKr-2 is the taker.
-add_seed_row "| \`repoKr-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoKr/x.md | ACTIVE |"
-add_seed_row "| \`repoKr-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoKr/x.md | ACTIVE |"
-# repoKg-1 — Copilot on a52abc6, PR #61: RETIRED, last bound in ANOTHER
-# container on a host this run shares a tmux server with, and its window gone
-# from it — Amendment 18(b)'s one exception — while a session record on THIS
-# workstation still carries its id for part of the case. repoKg-2 is the taker.
-KGLIVE_ID="aaaa0009-6b67-4000-8000-aaaa00096b67"
-add_seed_row "| \`repoKg-1\` | harness \`$KGLIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoKg/x.md | ACTIVE |"
-add_seed_row "| \`repoKg-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoKg/x.md | ACTIVE |"
-add_seed_row "| \`repoH-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoH/x.md | ACTIVE |"
-add_seed_row "| \`repoH-2\` | harness \`$DEAD_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoH/y.md | ACTIVE |"
-add_seed_row "| \`repoP-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoP/x.md | ACTIVE · LANDING #7 into repoP main |"
-add_seed_row "| \`repoP-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoP/x.md | IDLE, NOTHING CLAIMED · no LANDING open |"
-add_seed_row "| \`repoR-1\` | harness \`$R_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoR/x.md | ACTIVE |"
-add_seed_row "| \`repoH-3\` | harness \`$H_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoH/z.md | ACTIVE |"
-# repoS-1 / repoS-2: rows whose LATER cells contain a literal `|`, so they
-# split into 10 fields rather than 9. The live register has two such rows.
-# For repoS-1, NF-2 is ` still open ` and the handoff path is field 7; for
-# repoS-2, NF-1 is ` all good ` and the state cell is fields 8..NF-1 rejoined.
-add_seed_row "| \`repoS-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoS/session-handoff-2026-09-11-lane-repoS-1.md | ACTIVE · re-cut | still open |"
-add_seed_row "| \`repoS-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoS/x.md | ACTIVE · LANDING #7 into repoS main| all good |"
-
-# Rule 6 lines in LANES.md itself: `who --landing` reads THESE, so a lane with
-# no object log is still seen, and a retry that re-posts LANDING for one PR is
-# one landing and not two.
-printf 'LANDING — lane repoP-1, session %s@Eagle, 2026-09-11T01:00:00Z, PR #77 into workBenches main\n' "$DEAD_ID" >> "$LANES"
-printf 'LANDING — lane repoP-1, session %s@Eagle, 2026-09-11T01:40:00Z, PR #77 into workBenches main\n' "$DEAD_ID" >> "$LANES"
-# One lane, ONE PR number, TWO repositories — the shape this estate lands in
-# every day. The LANDED closes the hold on Omni-B and must not touch Omni-A.
-printf 'LANDING — lane repoP-1, session %s@Eagle, 2026-09-11T01:00:00Z, PR #5 into opensoft/Omni-A main\n' "$DEAD_ID" >> "$LANES"
-printf 'LANDING — lane repoP-1, session %s@Eagle, 2026-09-11T01:10:00Z, PR #5 into opensoft/Omni-B main\n' "$DEAD_ID" >> "$LANES"
-printf 'LANDED — lane repoP-1, session %s@Eagle, 2026-09-11T01:20:00Z, PR #5 into opensoft/Omni-B main → abc1234\n' "$DEAD_ID" >> "$LANES"
-# A LANDING inside Rule 6'"'"'s thirty minutes, for the other half of the test.
-printf 'LANDING — lane repoP-1, session %s@Eagle, %s, PR #91 into opensoft/repoFresh main\n' "$DEAD_ID" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$LANES"
-git -C "$WIP" add -- lanes/LANES.md handoffs/README.md
-git -C "$WIP" commit -q -m "seed the sandbox register"
-git -C "$WIP" push -q origin main
-
-START="$OPENREPOTOOLS_BIN_DIR/lane-start"
-END="$OPENREPOTOOLS_BIN_DIR/lane-end"
-
-for r in repoA repoB repoC repoD repoE repoF repoG repoH; do mkdir -p "$HOME/projects/$r"; done
-git init -q -b main "$HOME/projects/repoA"
-# The lane's HOME repo is read from `git remote get-url origin` of its own
-# directory. repoB has no remote on purpose: a lane whose home cannot be
-# resolved must still start, and say so rather than guess.
-git -C "$HOME/projects/repoA" remote add origin git@github.com:opensoft/repoA.git
-for r in repoE repoF repoG; do
-  git init -q -b main "$HOME/projects/$r"
-  git -C "$HOME/projects/$r" remote add origin "https://github.com/opensoft/$r.git"
-done
-
-# openRepoShape's assembly-root shape: repoE with a spec and a code leg. Only
-# `legs[].repository` is ever read from it.
-cat > "$HOME/projects/repoE/project.yaml" <<'YAML'
-schema_version: 1
-kind: project-manifest
-id: repoe
-shape:
-  repository: opensoft/openRepoShape
-legs:
-  - role: assembly
-    repository: opensoft/repoE
-    path: "."
-  - role: spec
-    repository: opensoft/repoE-spec
-    path: spec
-  - role: code
-    repository: opensoft/repoE-code
-    path: code
-YAML
-
-# Two levels down — `~/projects/InkRouter/IRRS/project.yaml` is the shape real
-# register traffic uses today.
-mkdir -p "$HOME/projects/nested/deepP"
-cat > "$HOME/projects/nested/deepP/project.yaml" <<'YAML'
-schema_version: 1
-kind: project-manifest
-legs:
-  - role: assembly
-    repository: opensoft/repoE
-    path: "."
-  - role: spec
-    repository: opensoft/repoE-deep
-    path: spec
-YAML
-
-# A manifest that still spells a leg the way the org was spelled before the
-# move. `opensoft/codexFactory` and `codeXfactory/codexFactory` are ONE
-# repository, and the alias table is what says so.
-mkdir -p "$HOME/projects/legacyP"
-cat > "$HOME/projects/legacyP/project.yaml" <<'YAML'
-schema_version: 1
-kind: project-manifest
-legs:
-  - role: assembly
-    repository: opensoft/codexFactory
-    path: "."
-  - role: spec
-    repository: opensoft/repoE
-    path: spec
-YAML
-
-# A family is BROADER than a project: its members are separate projects with
-# separate lanes, so `members:` must never read as "not a crossing".
-mkdir -p "$HOME/projects/famR/famR"
-cat > "$HOME/projects/famR/famR/family.yaml" <<'YAML'
-schema_version: 1
-kind: family-manifest
-members:
-  - project: repoE
-    repository: opensoft/repoE
-    path: members/repoE
-  - project: repoFam
-    repository: opensoft/repoFam
-    path: members/repoFam
-YAML
-
-# ---------------------------------------------------------- session records
-
-sessions_dir="$HOME/.claude-profiles/profiles/opensoft/team/t1/sessions"
-mkdir -p "$sessions_dir" "$HOME/.claude/sessions"
-
-# TIMEOUT_SECONDS PLUS TEN MINUTES, AND THE NUMBER IS TIED TO THE RUNNER'S OWN
-# BOUND (A9 Addendum 4, R-A9-11). This process IS the liveness fixture: every
-# "a live holder …" case from here to the foot of the file asks whether it is
-# still running, and
-# `lane-start`'s own refusals name its pid. On macOS it is the ONLY thing they
-# ask — there is no `/proc` there, so `live_start` below is empty and
-# `lanes-edit.sh:1719`'s `procStart` half never runs, leaving `kill -0` on this
-# pid as the whole of the answer.
-#
-# At `sleep 300` this fixture outlived the suite on Linux (136 s here, 229 s
-# under pytest) and ran out of seconds INSIDE it on anything slower. The macOS
-# job took ~900 s for this file alone then, so the fixture died a third of the way
-# in and every liveness case after that point got a quiet, plausible-looking
-# wrong answer. Measured, by starting it already reaped: 196 of 998. (It was
-# not the largest cause of the 438 at `d3d59b5` — `lanes-edit.sh`'s padded `wc`
-# was, and the two overlap — but it is the one that would have been left
-# standing after that fix, which is the whole reason a suite fixes both at
-# once.)
-#
-# The number must exceed `TIMEOUT_SECONDS` or the suite can outlive its own
-# evidence on a runner slow enough to hit the bound; `cleanup` kills it on every
-# exit path, and the last assertion in this file checks it was still running
-# when the run ended.
-#
-# AND IT IS DERIVED FROM THAT BOUND RATHER THAN WRITTEN BESIDE IT, because two
-# numbers about one thing is how they came to disagree. The comment above said
-# "(2400)" while `test_lane_helpers_suite.py` had long since raised
-# `TIMEOUT_SECONDS` to 3600, and the fixture stayed at a `sleep 3000` — under
-# the wrapper's own bound, so a run the wrapper was willing to wait for could
-# outlive it. MEASURED on the macOS job at `6950eaa`: 2615 passed, 27 failed,
-# and every one of the 27 downstream of this fixture — the guard's records, the
-# LIVE rows, the attach line, the pick's numbering — with the last assertion in
-# the file reporting it `gone`. The Amendment 18 section's ~180 cases are what
-# pushed that job past fifty minutes; the fixture is what should have followed
-# the bound and did not.
-#
-# Read out of the wrapper, with the wrapper's own default where it cannot be
-# read, and ten minutes of margin on top: the fixture now outlives any run the
-# wrapper is prepared to let finish, whatever either number becomes next.
-# (At TIMEOUT_SECONDS = 5400, raised on 2026-10-03 when tests-macos crossed
-# 3600 on #93 — the wrapper says why — that is a `sleep 6000`.)
-LIVE_BOUND="$(sed -n -e 's/^TIMEOUT_SECONDS = \([0-9][0-9]*\).*/\1/p' \
-  "$TESTS_DIR/test_lane_helpers_suite.py" 2>/dev/null | head -n 1)"
-case "${LIVE_BOUND:-}" in ''|*[!0-9]*) LIVE_BOUND=3600 ;; esac
-LIVE_SLEEP=$(( LIVE_BOUND + 600 ))
-sleep "$LIVE_SLEEP" & LIVE_PID=$!
-live_start="$(cut -d' ' -f22 "/proc/$LIVE_PID/stat" 2>/dev/null || printf '')"
-sleep 0.05 & DEAD_PID=$!
-wait "$DEAD_PID" 2>/dev/null
-
-write_record() { # <file> <sessionId> <pid> <procStart> <tmux> <name> <status>
-  printf '{"pid":%s,"sessionId":"%s","cwd":"x","procStart":"%s","tmux":"%s","name":"%s","status":"%s"}\n' \
-    "$3" "$2" "$4" "$5" "$6" "$7" > "$1"
-}
-write_record "$sessions_dir/$DEAD_PID.json" "$DEAD_ID" "$DEAD_PID" ""            "testsess:@9.%9"  "repoA-1" "idle"
-write_record "$sessions_dir/$LIVE_PID.json" "$LIVE_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "repoB-1" "idle"
-# repoK-3: its object log ends RETIRED, but this real process is still live
-# under its id — issue #30's own confirmation must refuse the takeover anyway.
-write_record "$sessions_dir/$LIVE_PID-repoK3.json" "$KLIVE_ID" "$LIVE_PID" "$live_start" "k3sess:@9.%9" "repoK-3" "idle"
-# repoK-5: same real live process, a second id, Copilot round 13's own case.
-write_record "$sessions_dir/$LIVE_PID-repoK5.json" "$K5LIVE_ID" "$LIVE_PID" "$live_start" "k5sess:@9.%9" "repoK-5" "idle"
-# repoM-1: its OWN live session (issue #39) — `duplicate_holder_pids` must
-# exclude this pid even when the (faked) process table also names it.
-write_record "$sessions_dir/$LIVE_PID-repoM1.json" "$MLIVE_ID" "$LIVE_PID" "$live_start" "msess:@9.%9" "repoM-1" "idle"
-write_record_ns() { # <file> <sessionId> <pid> <procStart> <tmux> <name> <nameSource> <status>
-  printf '{"pid":%s,"sessionId":"%s","cwd":"x","procStart":"%s","tmux":"%s","name":"%s","nameSource":"%s","status":"%s"}\n' \
-    "$3" "$2" "$4" "$5" "$6" "$7" "$8" > "$1"
-}
-# repoC-1's session was RENAMED to another lane by a person, so its name IS
-# evidence: `nameSource: user` is explicit and the record is not a holder.
-write_record_ns "$HOME/.claude/sessions/$LIVE_PID.json" "$GONE_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "somewhere-else-4" "user" "idle"
-# repoF-1: live, and named `repof-99` because the harness DERIVED that from the
-# working directory. It IS the holder — the name says nothing either way.
-write_record_ns "$sessions_dir/live-derived.json" "$F_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "repof-99" "derived" "busy"
-# repoG-3: live, and a person renamed it to another lane. NOT the holder.
-write_record_ns "$sessions_dir/live-explicit.json" "$G_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "somewhere-else-7" "user" "idle"
-
-# ----------------------------------------------------------- the transcript
-
-sanitize() { printf '%s' "$1" | tr -c 'A-Za-z0-9' '-'; }
-tdir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoA")"
-mkdir -p "$tdir"
-printf '{"type":"custom-title","customTitle":"repoA-1","sessionId":"%s"}\n' "$DEAD_ID" > "$tdir/$DEAD_ID.jsonl"
-# A session that was renamed AWAY from repoA-2: the last title wins, so this
-# must not be resumed as repoA-2.
-{ printf '{"type":"custom-title","customTitle":"repoA-2","sessionId":"x"}\n'
-  printf '{"type":"custom-title","customTitle":"something-else","sessionId":"x"}\n'; } > "$tdir/x.jsonl"
-
-# repoA-11: a TITLED transcript whose id the row does not name — the fallback.
-printf '{"type":"custom-title","customTitle":"repoA-11","sessionId":"titled-11"}\n' > "$tdir/titled-11.jsonl"
-# repoA-12: both ids in the cell have a transcript; only the LAST may be resumed.
-printf '{"type":"user"}\n' > "$tdir/$OLD12_ID.jsonl"
-printf '{"type":"user"}\n' > "$tdir/$NEW12_ID.jsonl"
-# repoA-16: the title a collided rename mints. `<lane> (2)` is the same lane.
-printf '{"type":"custom-title","customTitle":"repoA-16 (2)","sessionId":"titled-16"}\n' > "$tdir/titled-16.jsonl"
-# $GHOST_ID, $GHOST2_ID, $GHOST3_ID and $GHOST5_ID have no transcript at all.
-
-# Seeded object logs, committed so the sandbox worktree stays clean. These are
-# fixtures, not writes: everything else below goes through lanes-edit.sh.
-OLD_UTC="$(utc_at -5H)"
-MID_UTC="$(utc_at -4H -30M)"
-mkdir -p "$WIP/lanes/log"
-{ printf '# lane repoF-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoF-1, session %s@Eagle, %s, lane:repoF-1 → home opensoft/repoF; estate repoF\n' "$F_ID" "$OLD_UTC"
-} > "$WIP/lanes/log/repoF-1.md"
-{ printf '# lane repoG-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoG-1, session %s@Eagle, %s, lane:repoG-1 → home opensoft/repoG; estate repoG\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoG-1, session %s@Eagle, %s, opensoft/repoG#8\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoG-1, session %s@Eagle, %s, opensoft/repoG#11\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoG-1, session %s@Eagle, %s, opensoft/repoG#12 ← opensoft/repoG#11\n' "$DEAD_ID" "$MID_UTC"
-  printf 'LANDING — lane repoG-1, session %s@Eagle, %s, opensoft/repoG#9\n' "$DEAD_ID" "$OLD_UTC"
-} > "$WIP/lanes/log/repoG-1.md"
-# issue #30 — a DEAD lane (its log ends RETIRED, and no live session backs it
-# up): an OPENED PR and a FRESH CLAIMED issue, neither of them stale by
-# Rule 1's own time-and-verb tests, both takeable anyway because the lane
-# itself is gone.
-NOW_UTC="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-{ printf '# lane repoK-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoK-1, session %s@Eagle, %s, lane:repoK-1 → home opensoft/repoK; estate repoK\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoK-1, session %s@Eagle, %s, opensoft/repoK#5 ← opensoft/repoK#4\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoK-1, session %s@Eagle, %s, opensoft/repoK#6\n' "$DEAD_ID" "$NOW_UTC"
-  printf 'RETIRED — lane repoK-1, session %s@Eagle, %s, lane:repoK-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoK-1.md"
-# repoK-3 — the SAME shape (RETIRED, an OPENED PR left behind) but a real live
-# process ($LIVE_PID) still answers for its id: the takeover must be refused
-# exactly as it would be for a lane that never retired at all.
-{ printf '# lane repoK-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoK-3, session %s@Eagle, %s, lane:repoK-3 → home opensoft/repoK; estate repoK\n' "$KLIVE_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoK-3, session %s@Eagle, %s, opensoft/repoK#15 ← opensoft/repoK#14\n' "$KLIVE_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoK-3, session %s@Eagle, %s, lane:repoK-3\n' "$KLIVE_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoK-3.md"
-# repoK-5 — Copilot round 13, PR #61: RETIRED, a real live session still
-# backs it up (exactly as repoK-3), but the object it holds is a CLAIMED
-# posted $OLD_UTC (5h old — stale by Rule 1's own ${STALE_HOURS:-4}h test)
-# rather than an OPENED PR, reaching the stale-claim branch `holder_is_dead`
-# alone was never enough to keep it out of.
-{ printf '# lane repoK-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoK-5, session %s@Eagle, %s, lane:repoK-5 → home opensoft/repoK; estate repoK\n' "$K5LIVE_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoK-5, session %s@Eagle, %s, opensoft/repoK#99\n' "$K5LIVE_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoK-5, session %s@Eagle, %s, lane:repoK-5\n' "$K5LIVE_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoK-5.md"
-# repoL-1/3/5 — Copilot round 8, PR #61: the three open verbs repoK-1/2 never
-# exercised for issue #30's dead-lane takeover. Each ends RETIRED, no live
-# session backs $DEAD_ID up (as repoK-1/G-1/N-1/H-1/P-1 above already lean
-# on), and repoL-2/4/6 take over below.
-{ printf '# lane repoL-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoL-1, session %s@Eagle, %s, lane:repoL-1 → home opensoft/repoL; estate repoL\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoL-1, session %s@Eagle, %s, opensoft/repoL#20 ← opensoft/repoL#19\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'LANDING — lane repoL-1, session %s@Eagle, %s, opensoft/repoL#20\n' "$DEAD_ID" "$NOW_UTC"
-  printf 'RETIRED — lane repoL-1, session %s@Eagle, %s, lane:repoL-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoL-1.md"
-{ printf '# lane repoL-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoL-3, session %s@Eagle, %s, lane:repoL-3 → home opensoft/repoL; estate repoL\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoL-3, session %s@Eagle, %s, opensoft/repoL#30 ← opensoft/repoL#29\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'WITHDRAWN — lane repoL-3, session %s@Eagle, %s, opensoft/repoL#30\n' "$DEAD_ID" "$NOW_UTC"
-  printf 'RETIRED — lane repoL-3, session %s@Eagle, %s, lane:repoL-3\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoL-3.md"
-# repoL-5's OWN last line on the object is a TAKEOVER (it had earlier taken
-# opensoft/repoL#40 over from some dispossessed lane of its own, named only in
-# the free ← text, exactly as any TAKEOVER's payload is) — proving the
-# broadened set supersedes a dead lane's earlier TAKEOVER too, not only its
-# CLAIMED/OPENED/LANDING/WITHDRAWN.
-{ printf '# lane repoL-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoL-5, session %s@Eagle, %s, lane:repoL-5 → home opensoft/repoL; estate repoL\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoL-5, session %s@Eagle, %s, opensoft/repoL#40 ← lane:repoL-0\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoL-5, session %s@Eagle, %s, lane:repoL-5\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoL-5.md"
-# repoChain-1/2/3 — opensoft/openRepoTools#74, three objects:
-#   #1  a chain: repoChain-1 claims, repoChain-2 takes it over from repoChain-1,
-#       repoChain-3 from repoChain-2; repoChain-4 makes the third link below.
-#   #2  the race README-lanes.md calls "Known, deliberate": repoChain-2 AND
-#       repoChain-3 each took over repoChain-1's claim, neither naming the other.
-#   #3  two TAKEOVERs naming EACH OTHER, which no file order can put in order.
-{ printf '# lane repoChain-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoChain-1, session %s@Eagle, %s, lane:repoChain-1 → home opensoft/repoChain; estate repoChain\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoChain-1, session %s@Eagle, %s, opensoft/repoChain#1\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoChain-1, session %s@Eagle, %s, opensoft/repoChain#2\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoChain-1, session %s@Eagle, %s, lane:repoChain-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoChain-1.md"
-{ printf '# lane repoChain-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoChain-2, session %s@Eagle, %s, lane:repoChain-2 → home opensoft/repoChain; estate repoChain\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-2, session %s@Eagle, %s, opensoft/repoChain#1 ← lane:repoChain-1\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-2, session %s@Eagle, %s, opensoft/repoChain#2 ← lane:repoChain-1\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-2, session %s@Eagle, %s, opensoft/repoChain#3 ← lane:repoChain-3\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoChain-2, session %s@Eagle, %s, lane:repoChain-2\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoChain-2.md"
-{ printf '# lane repoChain-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoChain-3, session %s@Eagle, %s, lane:repoChain-3 → home opensoft/repoChain; estate repoChain\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-3, session %s@Eagle, %s, opensoft/repoChain#1 ← lane:repoChain-2\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-3, session %s@Eagle, %s, opensoft/repoChain#2 ← lane:repoChain-1\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'TAKEOVER — lane repoChain-3, session %s@Eagle, %s, opensoft/repoChain#3 ← lane:repoChain-2\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoChain-3, session %s@Eagle, %s, lane:repoChain-3\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoChain-3.md"
-# repoN-1 — issue #30's OTHER dead verdict: ENDED (a plain `lane-end`, no
-# `--retire`), no live session, one CLAIMED issue left open.
-{ printf '# lane repoN-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoN-1, session %s@Eagle, %s, lane:repoN-1 → home opensoft/repoN; estate repoN\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoN-1, session %s@Eagle, %s, opensoft/repoN#7\n' "$DEAD_ID" "$NOW_UTC"
-  printf 'ENDED — lane repoN-1, session %s@Eagle, %s, lane:repoN-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoN-1.md"
-# repoT-1 — Copilot round 12, PR #61: dead exactly as repoL-1 (RETIRED, no live
-# session, one OPENED PR left behind). The CLAIM-LOST section below has a peer
-# clone RESUME it mid-race, after this baseline is what both clones start from.
-{ printf '# lane repoT-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoT-1, session %s@Eagle, %s, lane:repoT-1 → home opensoft/repoT; estate repoT\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoT-1, session %s@Eagle, %s, opensoft/repoT#1 ← opensoft/repoT#0\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoT-1, session %s@Eagle, %s, lane:repoT-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoT-1.md"
-{ printf '# lane repoTx-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoTx-1, session %s@Eagle, %s, lane:repoTx-1 → home opensoft/repoTx; estate repoTx\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoTx-1, session %s@Eagle, %s, opensoft/repoTx#1 ← opensoft/repoTx#0\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoTx-1, session %s@Eagle, %s, lane:repoTx-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoTx-1.md"
-{ printf '# lane repoKr-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoKr-1, session %s@Eagle, %s, lane:repoKr-1 → home opensoft/repoKr; estate repoKr; host elsewhere-host; container none; os linux\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoKr-1, session %s@Eagle, %s, opensoft/repoKr#1 ← opensoft/repoKr#0\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoKr-1, session %s@Eagle, %s, lane:repoKr-1\n' "$DEAD_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoKr-1.md"
-{ printf '# lane repoKg-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoKg-1, session %s@Eagle, %s, lane:repoKg-1 → home opensoft/repoKg; estate repoKg; host elsewhere-host; container other-bench; os linux; window kgsess:0 @77\n' "$KGLIVE_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoKg-1, session %s@Eagle, %s, opensoft/repoKg#1 ← opensoft/repoKg#0\n' "$KGLIVE_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repoKg-1, session %s@Eagle, %s, lane:repoKg-1\n' "$KGLIVE_ID" "$NOW_UTC"
-} > "$WIP/lanes/log/repoKg-1.md"
-git -C "$WIP" add -- lanes/log
-git -C "$WIP" commit -q -m "seed two object logs"
-git -C "$WIP" push -q origin main
-
-section "== lane-start =="
-
-run "$START" --help
-is   "lane-start --help exits 0" "$rc" 0
-has  "lane-start --help prints the usage" "$out" "lane-start [options] <repo> <n>"
-
-( unset TMUX; "$START" repoA 9 ) >/dev/null 2>"$SANDBOX/stderr"; rc=$?; err="$(cat "$SANDBOX/stderr")"
-is   "outside tmux: exit 1 (environment)" "$rc" 1
-has  "outside tmux: the refusal names the fix" "$err" "run this inside the tmux window that will carry the lane"
-
-# EVIDENCE 7 MOVED THIS FROM 1 TO 2. A lane with no recorded checkout and none
-# that can be PROVED is a refusal a person fixes with one flag, not an
-# environment that failed — and as a `1` behind the launcher's `exec` it was a
-# pane that said `[exited]` with the message scrolled past it. `restart` already
-# spends 2 on the same fact (clause (i), `R-A11-20`).
-run "$START" repoZZ 1 --no-launch
-is   "a lane with no provable checkout REFUSES with 2, not the 1 that printed [exited]" "$rc" 2
-has  "no such directory: names --dir" "$err" "--dir"
-has  "…filled in as the act that RECORDS it" "$err" "lane-start --dir <path> repoZZ 1"
-has  "…and says nothing was started" "$err" "nothing was started"
-
-run "$START" repoA "" --no-launch
-is   "a non-position is refused with exit 2" "$rc" 2
-
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-before_sum="$(cksum < "$LANES")"
-run "$START" --dry-run repoA 7
-is   "--dry-run exits 0" "$rc" 0
-is   "--dry-run writes no register commit" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-is   "--dry-run leaves LANES.md byte-identical" "$(cksum < "$LANES")" "$before_sum"
-is   "--dry-run renames no window" "$(grep -c 'repoA-7' "$FAKE_TMUX_LOG")" 0
-has  "--dry-run says what it would add" "$err" "PLAN lanes-edit.sh add-row"
-
-cat > "$SANDBOX/retired-before-rename" <<'WRAP'
-#!/usr/bin/env bash
-if [ "${1-}" = retired-identity ] && [ "${2-}" = repoA-7 ]; then
-  printf 'repoA-7\n'
-  exit 0
-fi
-exec "${REAL_LANES_EDIT:?}" "$@"
-WRAP
-chmod +x "$SANDBOX/retired-before-rename"
-run env LANES_EDIT="$SANDBOX/retired-before-rename" REAL_LANES_EDIT="$OPENREPOTOOLS_BIN_DIR/lanes-edit.sh" \
-    "$START" --dry-run repoA 7
-is   "a newly retired position refuses before tmux rename" "$rc" 2
-has  "…naming the retired identity" "$err" "repoA-7 is RETIRED"
-is   "…without changing the window" "$(grep -c 'repoA-7' "$FAKE_TMUX_LOG")" 0
-
-run env FAKE_TMUX_WINDOWS="$(printf 'othersess:0\t@99\tREPOA-8\n')" \
-    "$START" --dry-run repoA 8
-is   "an AVAILABLE launch refuses a duplicate lane window name" "$rc" 2
-has  "…naming the other window" "$err" "another tmux window (@99)"
-is   "…without creating a lane row" "$(grep -c '^| `repoA-8`' "$LANES" || :)" 0
-
-run "$START" repoA 7 --no-launch
-REPOA7_SID="$(minted_of "$out")"
-is   "a new lane exits 0" "$rc" 0
-is   "a new lane launches with --name" "$(launch_of "$out")" "claude --name repoA-7"
-has  "a new lane mints a session id for itself" "$out" "--session-id "
-has  "a new lane renames the window" "$(cat "$FAKE_TMUX_LOG")" "rename-window repoA-7"
-is   "a new lane gets exactly one row" "$(grep -c '^| `repoA-7`' "$LANES")" 1
-# AMENDMENT 13(a) — A NEW ROW IS BORN IN THE PHRASE, not with the bare word
-# `STARTING` the cell used to open with: `<STATE> · <UTC> · <one line>`, so that
-# no row ever exists outside the shape `set-row-state` is the only writer of.
-a13_new="$(grep '^| `repoA-7`' "$LANES")"
-has  "the new row's state cell is Amendment 13's phrase" "$a13_new" "| LIVE · 20"
-has  "…whose line names the act that created it" "$a13_new" "lane-start on Eagle: row created |"
-hasnt "…and never the bare word the cell used to open with" "$a13_new" "| STARTING |"
-has  "the new row's session cell names the minted session" "$(grep '^| `repoA-7`' "$LANES")" "(minted by lane-start,"
-hasnt "…so it no longer says 'pending'" "$(grep '^| `repoA-7`' "$LANES")" "pending — set by the session's first act"
-has  "…and it is the very id claude was given" "$(grep '^| `repoA-7`' "$LANES")" "$REPOA7_SID"
-has  "the new row names its workstation" "$(grep '^| `repoA-7`' "$LANES")" "$LANES_WORKSTATION / "
-has  "the new row points at a handoff" "$(grep '^| `repoA-7`' "$LANES")" "handoffs/repoA/session-handoff-"
-has  "the row write is its own commit" "$(git -C "$WIP" log --oneline -1 -- lanes/LANES.md)" "add row"
-is   "the row write was pushed" "$(git -C "$WIP" rev-parse HEAD)" "$(git -C "$WIP" rev-parse origin/main)"
-
-run "$START" --estate xFactory --dir "$HOME/projects/repoB" repoA 8 --no-launch
-has  "--estate names the handoff directory" "$(grep '^| `repoA-8`' "$LANES")" "handoffs/xFactory/session-handoff-"
-
-run "$START" repoA 1 --no-launch
-is    "a free lane resumes THE ROW'S RECORDED SESSION, by id" "$out" "claude --name repoA-1 --resume $DEAD_ID"
-hasnt "…and never by the ambiguous title" "$out" "--resume repoA-1"
-has   "…saying it is the row's own transcript" "$err" "the row's current session is $DEAD_ID and its transcript is here"
-has   "…having taken live-holder's 8 as the ANSWER it is: this lane is parked" "$err" "no live session holds repoA-1"
-has  "a free lane appends a status, not a row" "$(git -C "$WIP" log --oneline -1 -- lanes/LANES.md)" "lane-start on"
-# AMENDMENT 11 CLAUSE (c) — THE ROW STAMP'S TAIL STATES THE DIRECTORY AND THE
-# WINDOW BESIDE WHAT IT DID. Its HEAD is unchanged (Amendment 8(d): the verb,
-# the uuid and the lane), and the tail still says what actually happened, so a
-# `--no-launch` run still ends `no launch` and never claims to have launched
-# anything.
-has  "the appended status says what it did — and a --no-launch run never says it launched (F-B5)" "$(grep '^| `repoA-1`' "$LANES")" ", no launch"
-has  "…with clause (c)'s directory and window in the tail, for the person reading the row" "$(grep '^| `repoA-1`' "$LANES")" "; dir $HOME/projects/repoA; window "
-hasnt "…so the stamp of a run that launched nothing claims no launch" "$(grep '^| `repoA-1`' "$LANES")" "no launch, launching"
-
-run "$START" repoA 2 --no-launch
-is   "a free lane with no title of its own starts new" "$(launch_of "$out")" "claude --name repoA-2"
-
-run "$START" repoB 1 --no-launch
-is   "a lane live in another window: exit 2" "$rc" 2
-has  "…and the refusal names the session" "$err" "is live in session $LIVE_ID"
-has  "…and the refusal names the next position" "$err" "take repoB-2"
-is   "…and it renames nothing" "$(grep -c 'repoB-1' "$FAKE_TMUX_LOG")" 0
-
-export FAKE_TMUX_WINDOW="othersess:@9"
-run "$START" repoB 1 --no-launch
-is   "the same lane live in THIS window is not a collision" "$rc" 0
-unset FAKE_TMUX_WINDOW
-
-run "$START" repoC 1 --no-launch
-is   "a live session RENAMED to another lane does not hold the row" "$rc" 0
-
-: > "$FAKE_CLAUDE_LOG"
-run "$START" repoA 3
-is   "without --no-launch it exec's claude" "$rc" 0
-has  "…with --name for a lane that is new" "$(cat "$FAKE_CLAUDE_LOG")" "--name repoA-3"
-
-( cd "$HOME/projects/repoA" && "$START" 4 --no-launch ) >"$SANDBOX/o" 2>/dev/null; rc=$?
-is   "<n> alone takes the repo from the cwd's git root" "$(launch_of "$(cat "$SANDBOX/o")")" "claude --name repoA-4"
-
-run "$START" repoA-5 --no-launch
-is   "the full lane name works as one argument" "$(launch_of "$out")" "claude --name repoA-5"
-
-run "$START" repoA 6 --no-launch -- --dangerously-skip-permissions
-is   "arguments after -- reach claude" "$(launch_of "$out")" "claude --name repoA-6 --dangerously-skip-permissions"
-has  "…alongside the minted --session-id" "$out" "--session-id "
-
-section "== lane-start: Amendment 6 — resume the row's recorded session =="
-
-# The fallback, unchanged in shape: the row names an id this directory has no
-# transcript for, so the title is all that is left — and lane-start says so.
-run "$START" repoA 11 --no-launch
-is   "a recorded id with no transcript here falls back to the title" "$out" "claude --name repoA-11 --resume repoA-11"
-has  "…naming the id it could not resolve" "$err" "$GHOST_ID has no transcript for this directory"
-has  "…and warning that a title only filters the picker" "$err" "FILTERS THE PICKER"
-
-# The cell is a history, oldest first, so the LAST id is the lane's current one.
-run "$START" repoA 12 --no-launch
-is    "the LAST id in the session cell is the one resumed" "$out" "claude --name repoA-12 --resume $NEW12_ID"
-hasnt "…never an earlier id in the same cell" "$out" "$OLD12_ID"
-
-# The codeXfactory-1 shape of 2026-09-11: a cell of `session_…` footer ids and
-# no transcript id at all. Nothing to resume and nothing to append to — so it
-# prints the act instead of guessing at the cell's text.
-run "$START" repoA 13 --no-launch
-is   "a cell with no transcript id at all starts a new session" "$(launch_of "$out")" "claude --name repoA-13"
-has  "…telling the session to stamp the cell itself" "$err" "STAMP IT AS THIS SESSION'S FIRST ACT"
-has  "…and naming the exact command, which is the cell-scoped one (R-A8-4)" "$err" "append-session-id repoA-13"
-is   "…and the row is never rewritten by guesswork" "$(grep -c 'session_015byFrZSopmRbUWNMYt1zEA' "$LANES")" 1
-has  "…and it names the footer ids as the reason it has no target" "$err" "the cell records only PR-footer ids (session_015byFrZSopmRbUWNMYt1zEA"
-
-# A dedupe-suffixed title is the SAME lane — live_holder() already reads it
-# that way, and a matcher that disagreed would hide a lane from itself.
-run "$START" repoA 16 --no-launch
-is   "a transcript titled '<lane> (2)' is still the lane's" "$out" "claude --name repoA-16 --resume repoA-16"
-has  "…and the suffix is reported, not silently accepted" "$err" "that title carries a dedupe suffix"
-has  "…with the retire act named" "$err" "retire the stale holders"
-
-# An existing row with one readable id and a new session: the cell is made
-# current automatically, so the NEXT start resumes by id.
-run "$START" repoA 14 --no-launch
-REPOA14_SID="$(minted_of "$out")"
-is   "an existing row with a stale id starts a new session" "$(launch_of "$out")" "claude --name repoA-14"
-has  "…and the session cell is stamped with the minted id, AFTER the old id's code span" "$(grep '^| `repoA-14`' "$LANES")" "harness \`$GHOST2_ID\` → harness \`$REPOA14_SID\`"
-hasnt "…never inside it, which a replace at a bare-uuid anchor would do (F-B1)" "$(grep '^| `repoA-14`' "$LANES")" "\`$GHOST2_ID → "
-# ITS OWN REGISTER COMMIT, AND THE ONE BEFORE THE STAMP (Copilot round 5 on
-# openRepoTools#82): Amendment 8's rule is THE CELL FIRST, THEN THE STAMP — the
-# stamp names a uuid, so the cell that carries it is written first — and this
-# path used to do the opposite. Both commits are asserted, in that order.
-has  "…in its own register commit" "$(git -C "$WIP" log --format=%s -- lanes/LANES.md | head -n2 | tail -n1)" "session cell: lane-start minted $REPOA14_SID"
-has  "…with the state stamp committed after it, naming the same id" "$(git -C "$WIP" log --format=%s -n1 -- lanes/LANES.md)" "state · LIVE · STARTED by $REPOA14_SID"
-
-# And the loop closes: run it again, and the id just written is resumed by id.
-printf '{"type":"user"}\n' > "$tdir/$REPOA14_SID.jsonl"
-run "$START" repoA 14 --no-launch
-is   "the next start resumes exactly what the previous one recorded" "$out" "claude --name repoA-14 --resume $REPOA14_SID"
-
-# The minting is switchable, and switching it off restores the old row text.
-LANE_START_SESSION_ID=0 run "$START" repoA 15 --no-launch
-is    "LANE_START_SESSION_ID=0 mints nothing" "$out" "claude --name repoA-15"
-hasnt "…and passes no --session-id" "$out" "--session-id"
-has   "…leaving the old 'stamp it yourself' contract" "$(grep '^| `repoA-15`' "$LANES")" "$GHOST3_ID"
-
-# --dry-run still writes nothing, on the resume path too.
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-before_sum="$(cksum < "$LANES")"
-run "$START" --dry-run repoA 12
-is   "--dry-run on a resume-by-id lane exits 0" "$rc" 0
-is   "--dry-run writes no register commit" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-is   "--dry-run leaves LANES.md byte-identical" "$(cksum < "$LANES")" "$before_sum"
-has  "--dry-run plans the exact resume" "$err" "PLAN exec claude --name repoA-12 --resume $NEW12_ID"
-
-section "== lane-end =="
-
-run "$END" --help
-is   "lane-end --help exits 0" "$rc" 0
-
-run "$END" repoD-1
-is   "an open LANDING is refused" "$rc" 2
-has  "…naming what it found" "$err" "the last LANDING in its state cell"
-has  "…and the fix" "$err" "set-row-state repoD-1"
-hasnt "…and nothing is written" "$(grep '^| `repoD-1`' "$LANES")" "lane-end on"
-
-run "$END" repoD-2
-is   "NOTHING CLAIMED / no LANDING open is not something in flight" "$rc" 0
-has  "…and the closing line is written" "$(grep '^| `repoD-2`' "$LANES")" "window closing; NOTHING IN FLIGHT"
-
-run "$END" repoD-3
-is   "LANDING followed by LANDED is closed" "$rc" 0
-
-run "$END" repoD-1 --force
-is   "--force ends it anyway" "$rc" 0
-has  "…and says so in the register" "$(grep '^| `repoD-1`' "$LANES")" "ENDED WITH --force"
-
-run "$END" repoA-7 --retire
-is   "--retire exits 0" "$rc" 0
-has  "…and the state cell now reads RETIRED, in Amendment 13(a)'s phrase" "$(grep '^| `repoA-7`' "$LANES")" "| RETIRED · 20"
-has  "…while the history it had is still there" "$(grep '^| `repoA-7`' "$LANES")" "window closing; NOTHING IN FLIGHT"
-is   "…and the window is never renamed" "$(grep -c 'rename-window repoA-7$' "$FAKE_TMUX_LOG")" 1
-
-run "$END" no-such-lane-4
-is   "a lane with no row is refused" "$rc" 2
-has  "…naming the fix" "$err" "add-row"
-
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-run "$END" --dry-run repoA-2
-is   "lane-end --dry-run exits 0" "$rc" 0
-is   "lane-end --dry-run writes nothing" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-
-run "$END" browser-ui-repair --retire
-is   "a lane named before the <repo>-<n> rule can still be ended" "$rc" 0
-has  "…verbatim, and retired" "$(grep '^| `browser-ui-repair`' "$LANES")" "| RETIRED · 20"
-
-
-section "== Amendment 7: the per-lane object log =="
-
-E="$OPENREPOTOOLS_BIN_DIR/lanes-edit.sh"
-WS_S="${LANES_WORKSTATION:-$(hostname -s)}"
-LOGD="$WIP/lanes/log"
-
-# ------------------------------------------ lane-start writes the STARTED line
-
-run "$START" repoE 1 --no-launch
-is   "lane-start on a lane with an origin exits 0" "$rc" 0
-is   "…and creates the lane's own log file" "$( [ -f "$LOGD/repoE-1.md" ] && echo yes )" "yes"
-is   "…whose line 1 is the header" "$(head -n1 "$LOGD/repoE-1.md")" "# lane repoE-1 — object log (lane-collision-protocol Amendment 7)"
-E1_STARTED="$(grep '^STARTED' "$LOGD/repoE-1.md" | tail -n1)"
-has  "…and whose STARTED line uses lane:<name> as its object" "$E1_STARTED" ", lane:repoE-1 → home opensoft/repoE; estate repoE"
-has  "…with the home taken from git remote get-url origin" "$E1_STARTED" "home opensoft/repoE"
-has  "…and the payload sub-fields separated by '; '" "$E1_STARTED" "; estate repoE"
-has  "…written as its own LOG commit" "$(git -C "$WIP" log --oneline -1)" "LOG(repoE-1@$WS_S): STARTED lane:repoE-1"
-is   "…and pushed" "$(git -C "$WIP" rev-parse HEAD)" "$(git -C "$WIP" rev-parse origin/main)"
-is   "…while LANES.md keeps its own last commit" "$(git -C "$WIP" log --oneline -1 -- lanes/LANES.md | grep -c 'LOG(')" 0
-
-run "$START" --dir "$HOME/projects/repoB" --estate repoB repoQ-1 --no-launch
-has  "a lane whose checkout has no origin still starts, and says the home is unknown" "$err" "has no 'origin' remote"
-has  "…recording it as unknown rather than guessing" "$(cat "$LOGD/repoQ-1.md")" "lane:repoQ-1 → home unknown; estate repoB"
-
-run "$START" repoA 1 --no-launch
-is   "a resumed lane still resumes by id" "$out" "claude --name repoA-1 --resume $DEAD_ID"
-has  "…and its log line is a RESUMED, not a STARTED" "$(cat "$LOGD/repoA-1.md")" "RESUMED — lane repoA-1, session "
-has  "…carrying the same lane: object" "$(cat "$LOGD/repoA-1.md")" ", lane:repoA-1 → home opensoft/repoA; estate repoA"
-
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-run "$START" --dry-run repoE 1
-is   "--dry-run writes no log commit either" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-has  "…and says what it would log" "$err" "PLAN lanes-edit.sh log STARTED lane:repoE-1"
-
-# ------------------------------------------------------------------ log
-
-run env LANES_LANE=repoE-1 "$E" log OPENED "opensoft/repoE#12" "←" "opensoft/repoE#11"
-is   "log OPENED exits 0" "$rc" 0
-has  "…appending the event in the grammar's shape" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#12 ← opensoft/repoE#11"
-has  "…in a LOG(<lane>@<ws>) commit naming the verb and the object" "$(git -C "$WIP" log --oneline -1)" "LOG(repoE-1@$WS_S): OPENED opensoft/repoE#12"
-
-run env LANES_LANE=repoE-1 "$E" log MERGED "opensoft/repoE#12"
-is   "MERGED is not a verb any more — LANDED is the post-merge line" "$rc" 2
-has  "…and the refusal lists the verbs" "$err" "is not one of the Amendment 7 verbs"
-
-run env LANES_LANE=repoE-1 "$E" log PAUSED
-is   "a lane verb still needs its lane: object" "$rc" 2
-run env LANES_LANE=repoE-1 "$E" log PAUSED "lane:repoE-1"
-is   "…and takes it" "$rc" 0
-has  "…writing a line whose object is the lane and which has no payload" "$(grep '^PAUSED' "$LOGD/repoE-1.md")" ", lane:repoE-1"
-
-run env LANES_LANE=repoE-1 "$E" log OPENED "lane:repoE-1"
-is   "an object verb refuses a lane: object" "$rc" 2
-run env LANES_LANE=repoE-1 "$E" log STARTED "opensoft/repoE#1"
-is   "…and a lane verb refuses an object key" "$rc" 2
-
-run env LANES_LANE=repoE-1 "$E" log NOPE "opensoft/repoE#12"
-is   "an unknown verb is refused" "$rc" 2
-run env LANES_LANE=repoE-1 "$E" log OPENED "not-an-object"
-is   "a malformed object key is refused" "$rc" 2
-run env LANES_LANE=repoE-1 "$E" log OPENED "nosuchrepo#3"
-is   "an unknown alias is refused" "$rc" 2
-has  "…with the hint to spell owner/repo" "$err" "spell it owner/repo"
-
-run env LANES_LANE=repoE-1 "$E" log CLOSED "opensoft/codexFactory#9" "→" "opensoft/openxFactory#4"
-is   "a legacy spelling is accepted" "$rc" 0
-has  "…and is written as the canonical nameWithOwner" "$(cat "$LOGD/repoE-1.md")" ", codeXfactory/codexFactory#9 → opensoft/openxFactory#4"
-run env LANES_LANE=repoE-1 "$E" log CLOSED "Hermes-Install#3" "→" "opensoft/openxFactory#4"
-has  "…as is an alias with no owner at all" "$(cat "$LOGD/repoE-1.md")" ", opensoft/Hermes-Install#3 → opensoft/openxFactory#4"
-
-run env LANES_LANE=repoE-1 "$E" log OPENED "oxF#3"
-is   "a spelling the register uses but nothing resolved is refused, not guessed" "$rc" 2
-
-run env LANES_LANE=repoE-1 "$E" claim "#7" --no-github
-is   "#<n> expands to the lane's own home repo" "$rc" 0
-has  "…spelled out in the line" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#7"
-run env LANES_LANE=repoQ-1 "$E" claim "#7" --no-github
-is   "…and is refused for a lane whose home is unknown" "$rc" 2
-has  "…naming --home as the way out" "$err" "--home owner/repo"
-run env LANES_LANE=repoQ-1 "$E" claim "#7" --home opensoft/repoQ --no-github
-is   "…which --home supplies for a pre-cutover lane" "$rc" 0
-has  "…resolving the shorthand against it" "$(cat "$LOGD/repoQ-1.md")" ", opensoft/repoQ#7"
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE:openspec/changes/add-thing" --no-github
-is   "an OpenSpec change directory is an object key too" "$rc" 0
-
-# The four verbs that have a guarded subcommand of their own are not written by
-# hand: `log CLAIMED` skipped the pre-check, the race and the rescan, and `who`
-# reported the result identically to a real claim.
-run env LANES_LANE=repoE-1 "$E" log CLAIMED "opensoft/repoE#33"
-is   "log CLAIMED is refused — a claim is not a hand-written line" "$rc" 2
-has  "…pointing at the subcommand that runs the race" "$err" "lanes-edit.sh claim opensoft/repoE#33"
-run env LANES_LANE=repoE-1 "$E" log TAKEOVER "opensoft/repoE#33"
-is   "log TAKEOVER is refused — only a STALE claim may be taken over" "$rc" 2
-has  "…pointing at --force" "$err" "claim opensoft/repoE#33 --force"
-run env LANES_LANE=repoE-1 "$E" log RELEASED "opensoft/repoE#33"
-is   "log RELEASED is refused" "$rc" 2
-has  "…pointing at release, which also posts the comment" "$err" "lanes-edit.sh release opensoft/repoE#33"
-run env LANES_LANE=repoE-1 "$E" log CLAIM-LOST "opensoft/repoE#33"
-is   "log CLAIM-LOST is refused — losing a race has no hand-written form" "$rc" 2
-hasnt "…and not one of the four wrote a line" "$(cat "$LOGD/repoE-1.md")" "opensoft/repoE#33"
-run env LANES_LANE=repoE-1 "$E" log WITHDRAWN "opensoft/repoE#34"
-is   "…while a verb with no subcommand of its own is still accepted" "$rc" 0
-
-# --home is validated, and refused where the lane's own log answers the question.
-run env LANES_LANE=repoQ-1 "$E" log OPENED "#7" --home 'not a repo'
-is   "an invalid --home is refused, never written into an object key" "$rc" 2
-has  "…saying what a home is" "$err" "--home takes owner/repo"
-hasnt "…and no unreadable line is written" "$(cat "$LOGD/repoQ-1.md")" "not a repo#7"
-run env LANES_LANE=repoQ-1 "$E" log OPENED "#8" --home workBenches
-is   "…while a known alias is accepted" "$rc" 0
-has  "…and canonicalised to owner/repo" "$(cat "$LOGD/repoQ-1.md")" ", opensoft/workBenches#8"
-run env LANES_LANE=repoE-1 "$E" log OPENED "#9" --home opensoft/SOMEWHEREELSE
-is   "--home is REFUSED where the lane's STARTED line already answers it" "$rc" 2
-has  "…naming the home the log records" "$err" "already records its home: opensoft/repoE"
-hasnt "…and the flag never overrides the log" "$(cat "$LOGD/repoE-1.md")" "SOMEWHEREELSE"
-
-# ------------------------------------------------------------ claim / who
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE#21" --no-github
-is   "claim on a free object exits 0" "$rc" 0
-has  "…printing Rule 1's three reads" "$out" "3. git ls-remote --heads"
-has  "…which --no-github skips rather than performs" "$out" "not read (--no-github)"
-has  "…and marking the line as not yet a Rule 1 claim" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#21 — no-github"
-
-run "$E" who "opensoft/repoE#21"
-is   "who finds it" "$rc" 0
-has  "…naming the lane that holds it" "$out" "HOLDS    lane repoE-1"
-has  "…and calling the object held" "$out" "state    HELD"
-has  "…saying the line is local only until the comment exists" "$out" "local only — no GitHub claim comment"
-has  "…and not stale" "$out" "stale    no"
-has  "…the lane's home" "$out" "home     opensoft/repoE"
-has  "…that the holder is parked, not live" "$out" "NOT LIVE (parked"
-has  "…the address and the resume command" "$out" "address  @repoE-1 · claude --resume"
-has  "…the handoff the row points at" "$out" "handoff  handoffs/repoE/session-handoff-"
-has  "…and where the line itself lives" "$out" "log      lanes/log/repoE-1.md"
-
-run "$E" who "opensoft/repoE#9999"
-is   "who on an object no lane has touched exits 8" "$rc" 8
-has  "…saying so" "$out" "no record of opensoft/repoE#9999"
-
-# STATE IS PER LANE: one lane's RELEASED closes only its own hold.
-run env LANES_LANE=repoG-3 "$E" release "opensoft/repoE#21" --no-github
-run "$E" who "opensoft/repoE#21"
-is   "another lane's RELEASED does not close this lane's hold" "$rc" 0
-has  "…the holder is still the lane that claimed it" "$out" "HOLDS    lane repoE-1"
-has  "…and the other lane's line is shown as closed" "$out" "closed   lane repoG-3"
-has  "…with the object still HELD" "$out" "state    HELD"
-
-run "$E" who --lane repoE-1
-is   "who --lane lists the lane's open objects" "$rc" 0
-has  "…including the claim" "$out" "opensoft/repoE#21"
-hasnt "…and never the lane's own lane: lines" "$out" "lane:repoE-1"
-
-run "$E" who --lane repoG-3
-is   "who --lane on a lane that holds nothing is an ANSWER, exit 0" "$rc" 0
-has  "…in words" "$out" "none open — lane repoG-3 holds nothing open"
-
-run "$E" who --lane repoNOSUCH-4
-is   "who --lane on a pre-cutover lane exits 8" "$rc" 8
-has  "…with the pre-cutover sentence" "$out" "no log for repoNOSUCH-4; see its row's state cell"
-
-run env LANES_LANE=repoF-1 "$E" claim "opensoft/repoE#21" --no-github
-is   "claim on an object another lane holds exits 2" "$rc" 2
-has  "…printing who holds it" "$out" "HOLDS    lane repoE-1"
-has  "…and refusing in Rule 1's words" "$err" "stops and reports"
-hasnt "…and writing nothing to the taker's log" "$(cat "$LOGD/repoF-1.md")" "opensoft/repoE#21"
-
-# A claim is decided by which CLAIMED LANDS first, and a rebase is what makes
-# that decidable — so a checkout that cannot be rebased is refused outright.
-printf '# a peer left this here mid-write\n' >> "$WIP/handoffs/README.md"
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE#30" --no-github
-is   "claim refuses on a checkout that cannot be rebased" "$rc" 2
-has  "…naming the offending file" "$err" "handoffs/README.md"
-has  "…and why it matters" "$err" "the race cannot be run safely here"
-git -C "$WIP" checkout -q -- handoffs/README.md
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE#30" --no-github
-is   "…and takes the claim once the tree is clean again" "$rc" 0
-
-# R11 (Addendum 3) — the guard TOLERATES a peer's uncommitted REGISTER edit.
-# `lanes/LANES.md` is dirty in this shared checkout for much of the day: the
-# register takes ~500 commits a day and a half-written row is what one of them
-# looks like a second before it lands, so refusing every claim on it would push
-# lanes to stop using the tool. `claim`, `release` and `log` take the helper's
-# existing pre-existing capture for the register FIRST — its own attributed
-# commit, with the same warning every register write already prints — and only
-# then re-test the checkout. What F1 fixed is untouched: the register never
-# reaches commit_push dirty, so Amendment 5(d)'s skip-the-pull branch — the one
-# that disables the rescan deciding the race — is still unreachable from all
-# three.
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-printf 'a peer left this register line uncommitted\n' >> "$LANES"
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE#31" --no-github
-is   "a dirty lanes/LANES.md no longer refuses a claim: it is CAPTURED first" "$rc" 0
-has  "…warning that the content is not this invocation's" "$err" "not this invocation's"
-has  "…and capturing it as its own attributed commit" "$err" "captured pre-existing edit"
-has  "…while the claim itself is written to the lane's own log" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#31"
-is   "…leaving the register clean behind it" "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c .)" 0
-is   "…as TWO commits, never one" "$(git -C "$WIP" rev-list --count "$before_rev..HEAD")" 2
-has  "…the capture the older of the two" "$(git -C "$WIP" log --format=%s "$before_rev..HEAD" | tail -n1)" "LANES(pre-existing@"
-is   "…carrying the register and nothing else" "$(git -C "$WIP" show --name-only --format= 'HEAD~1')" "lanes/LANES.md"
-has  "…and the peer's own line, attributed to nobody else" "$(git -C "$WIP" show 'HEAD~1')" "+a peer left this register line uncommitted"
-has  "…the claim the newer" "$(git -C "$WIP" log --format=%s -n1 HEAD)" "LOG(repoE-1@"
-is   "…carrying the lane's log and nothing else" "$(git -C "$WIP" show --name-only --format= HEAD)" "lanes/log/repoE-1.md"
-
-printf 'and a second peer line, still uncommitted\n' >> "$LANES"
-run env LANES_LANE=repoE-1 "$E" log OPENED "opensoft/repoE#32" --no-github
-is   "log takes the same capture and proceeds" "$rc" 0
-has  "…capturing the peer's line first" "$err" "captured pre-existing edit"
-has  "…and writing its own line" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#32"
-printf 'and a third peer line, still uncommitted\n' >> "$LANES"
-run env LANES_LANE=repoE-1 "$E" release "opensoft/repoE#31" "capture then release" --no-github
-is   "release does too" "$rc" 0
-has  "…capturing first" "$err" "captured pre-existing edit"
-has  "…and writing the RELEASED line" "$(cat "$LOGD/repoE-1.md")" ", opensoft/repoE#31 — capture then release"
-
-# …and ANYTHING ELSE is still a refusal, exit 2. That refusal is taken BEFORE
-# the lock and before the capture, so a write that refuses never leaves a
-# commit of somebody else's register line behind either.
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-printf '# a peer left this here mid-write\n' >> "$WIP/handoffs/README.md"
-printf 'and a register line at the same moment\n' >> "$LANES"
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE#35" --no-github
-is   "a dirty file that is NOT the register still refuses a claim" "$rc" 2
-has  "…naming it" "$err" "handoffs/README.md"
-has  "…and why it matters" "$err" "the race cannot be run safely here"
-has  "…with the recovery its own author runs" "$err" "handoff(<lane>@<workstation>)"
-hasnt "…writing nothing to the lane's log" "$(cat "$LOGD/repoE-1.md")" "opensoft/repoE#35"
-is   "…and making no commit at all" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-hasnt "…not even the pre-existing capture: the refusal comes first" "$err" "captured pre-existing edit"
-is   "…so the peer's register edit is left exactly as it was found" "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | awk '{print $1}')" "M"
-run env LANES_LANE=repoE-1 "$E" log OPENED "opensoft/repoE#36" --no-github
-is   "log refuses on the same checkout" "$rc" 2
-run env LANES_LANE=repoE-1 "$E" release "opensoft/repoE#32" "refused, never written" --no-github
-is   "release refuses on it as well" "$rc" 2
-hasnt "…so the release was not written either" "$(cat "$LOGD/repoE-1.md")" "refused, never written"
-git -C "$WIP" checkout -q -- handoffs/README.md
-
-# A LANDING reaches the same place by the other road: the register is one of
-# ITS OWN pathspecs, so the ordinary handle_preexisting call captures it and
-# R11's capture stands aside. One behaviour, two routes, and the register is
-# never left dirty for commit_push either way.
-run env LANES_LANE=repoE-1 "$E" log LANDING "opensoft/repoE#41" --no-github
-is   "a LANDING still writes with a dirty register: that file is one of ITS pathspecs" "$rc" 0
-has  "…capturing the peer's line as its own commit first" "$err" "captured pre-existing edit"
-run env LANES_LANE=repoE-1 "$E" log LANDED "opensoft/repoE#41" "→" "def5678"
-is   "…and its LANDED closes it again" "$rc" 0
-printf '# a peer left this here mid-write\n' >> "$WIP/handoffs/README.md"
-run env LANES_LANE=repoE-1 "$E" log LANDING "opensoft/repoE#42" --no-github
-is   "…while an UNRELATED dirty file refuses a LANDING too: the exemption is those two paths and no others" "$rc" 2
-has  "…naming it" "$err" "handoffs/README.md"
-git -C "$WIP" checkout -q -- handoffs/README.md
-
-# --------------------------------------------------- the cross-repo warning
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/workBenches#3" --no-github
-is   "a cross-repo claim still succeeds — it warns, it never refuses" "$rc" 0
-has  "…with the warning" "$err" "CROSS-REPO — opensoft/workBenches is not lane repoE-1's home (opensoft/repoE)"
-has  "…saying explicitly that it proceeds" "$err" "it never refuses"
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE-spec#2" --no-github
-is   "a claim on a leg of the same project.yaml exits 0" "$rc" 0
-has  "…and is reported as not a crossing" "$err" "are legs of one project.yaml — not a crossing"
-has  "…naming the manifest it read" "$err" "$HOME/projects/repoE/project.yaml"
-hasnt "…so no cross-repo warning is printed" "$err" "CROSS-REPO"
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoE-deep#2" --no-github
-is   "a manifest two levels under PROJECTS_ROOT is found too" "$rc" 0
-has  "…and named" "$err" "$HOME/projects/nested/deepP/project.yaml"
-
-run env LANES_LANE=repoE-1 "$E" claim "codeXfactory/codexFactory#3" --no-github
-is   "a manifest that spells a leg the pre-move way is still ONE project" "$rc" 0
-has  "…both values resolved through repos.tsv before comparing" "$err" "are legs of one project.yaml — not a crossing"
-hasnt "…so no crossing is reported" "$err" "CROSS-REPO — codeXfactory/codexFactory"
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoFam#2" --no-github
-is   "a claim on a family member is still a claim" "$rc" 0
-has  "…and family membership does NOT suppress the crossing warning" "$err" "CROSS-REPO — opensoft/repoFam is not lane repoE-1's home"
-
-run env LANES_LANE=repoE-1 "$E" claim "opensoft/repoF#5" --no-github
-has  "a crossing names the LIVE lane homed on the target repo" "$err" "LIVE lane homed on opensoft/repoF: @repoF-1"
-has  "…with its last transcript uuid" "$err" "last transcript uuid $F_ID"
-has  "…and the command that reaches it" "$err" "claude --resume $F_ID"
-
-# -------------------------------------------------------- stale and takeover
-
-run env LANES_LANE=repoG-1 "$E" claim "opensoft/repoG#10" --no-github
-is   "a fresh claim by another lane is made" "$rc" 0
-run env LANES_LANE=repoG-2 "$E" claim "opensoft/repoG#10" --no-github --force
-is   "--force on a claim that is NOT stale is refused" "$rc" 2
-has  "…naming the threshold" "$err" "threshold ${STALE_H}h"
-hasnt "…and no takeover is written" "$(cat "$LOGD/repoG-2.md" 2>/dev/null)" "opensoft/repoG#10"
-
-run "$E" who "opensoft/repoG#8"
-has  "who reports a four-hour-old claim with no PR as stale" "$out" "stale    YES"
-has  "…and says a takeover is allowed" "$out" "a takeover is allowed (claim --force)"
-
-# Rule 1's own definition: a claim followed by a PR that names it is not stale.
-run "$E" who "opensoft/repoG#11"
-has  "an equally old claim whose lane has since OPENED a PR naming it is NOT stale" "$out" "stale    no"
-
-run env LANES_LANE=repoG-2 "$E" claim "opensoft/repoG#9" --no-github --force
-is   "--force takes over a stale CLAIMED and nothing else" "$rc" 2
-has  "…refusing on an open LANDING" "$err" "is not a stale claim"
-
-run env LANES_LANE=repoG-2 "$E" claim "opensoft/repoG#8" --no-github --force
-is   "--force on a stale claim takes it over" "$rc" 0
-G2="$(cat "$LOGD/repoG-2.md")"
-has  "…writing a TAKEOVER line" "$G2" "TAKEOVER — lane repoG-2, session "
-has  "…referencing the claim it supersedes with ←" "$G2" "opensoft/repoG#8 ← lane:repoG-1"
-# A REAL PATTERN, NOT `hasnt`'S FIXED STRING (issue #66): `hasnt` is a `case`
-# containment test, so the `.*` this line used to carry to skip the session uuid
-# was the two literal characters, never a wildcard — and a log that DID hold a
-# separate CLAIMED line for repoG#8 passed it all the same. `grep -cE` over the
-# log is the real thing, and it counts the lines, so it can be 1.
-is   "…and no separate CLAIMED line: TAKEOVER is itself an open verb" \
-     "$(printf '%s\n' "$G2" | grep -cE '^CLAIMED — lane repoG-2,.*opensoft/repoG#8')" 0
-
-run "$E" who "opensoft/repoG#8"
-has  "…so the taker now holds it" "$out" "HOLDS    lane repoG-2"
-has  "…by TAKEOVER, which is itself an open verb" "$out" "TAKEOVER  "
-has  "…and the dispossessed lane's CLAIMED reads as superseded, not as a hold" "$out" "superseded by TAKEOVER (lane:repoG-2)"
-has  "…naming the release that closes its own line" "$out" "lanes-edit.sh release opensoft/repoG#8"
-is   "…and exactly one lane holds it" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-
-run "$END" repoG-1
-is   "the dispossessed lane's lane-end refuses" "$rc" 2
-has  "…and names the takeover rather than leaving it stuck" "$err" "taken over by lane:repoG-2 at"
-has  "…with the exact release that frees it" "$err" "run: lanes-edit.sh release opensoft/repoG#8"
-run env LANES_LANE=repoG-1 "$E" release "opensoft/repoG#8" "taken over by repoG-2" --no-github
-is   "…and release closes its own line" "$rc" 0
-run "$E" who "opensoft/repoG#8"
-hasnt "…so it is no longer listed as superseded" "$out" "superseded by TAKEOVER"
-
-# --------------------------------------- issue #30: a DEAD lane's hold
-
-run env LANES_LANE=repoK-2 "$E" claim "opensoft/repoK#5" --no-github --force
-is   "--force takes over a DEAD lane's OPENED PR whatever its verb" "$rc" 0
-K2="$(cat "$LOGD/repoK-2.md")"
-has  "…writing a TAKEOVER line" "$K2" "TAKEOVER — lane repoK-2, session "
-has  "…referencing the dead lane with ←" "$K2" "opensoft/repoK#5 ← lane:repoK-1"
-has  "…and the free text says why" "$K2" "lane repoK-1 is dead (log ends RETIRED"
-# A REAL PATTERN, NOT `hasnt`'S FIXED STRING (Copilot round 2, PR #61): `has`
-# and `hasnt` test literal substrings (`tests/test_lane_helpers.sh:193-194`),
-# so a `.*` meant to skip the session uuid was never a wildcard here and this
-# check passed no matter what the log held. `grep -E` is the real thing.
-is   "…and no separate CLAIMED line: TAKEOVER is itself an open verb" \
-     "$(printf '%s\n' "$K2" | grep -cE '^CLAIMED — lane repoK-2,.*opensoft/repoK#5')" 0
-
-run env LANES_LANE=repoK-2 "$E" claim "opensoft/repoK#6" --no-github --force
-is   "…and a FRESH CLAIMED issue too — Rule 1's four-hour clock never enters it" "$rc" 0
-has  "…also a TAKEOVER, over the same dead lane" "$(cat "$LOGD/repoK-2.md")" "opensoft/repoK#6 ← lane:repoK-1"
-
-run "$E" who "opensoft/repoK#5"
-has  "…so the taker now holds the PR" "$out" "HOLDS    lane repoK-2"
-# EXACTLY ONE HOLDER (Copilot round 7, PR #61, the issue #30 case itself):
-# a dead lane's OPENED is an open verb, not a CLAIMED, and superseded_by's
-# early exit used to answer "not superseded" for every verb but CLAIMED —
-# so holders_of never dropped repoK-1's own OPENED line and who reported
-# BOTH lanes holding one object, the exact collision #30 was filed to end.
-is   "…and exactly ONE lane holds it, not two" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-hasnt "…repoK-1's own dead OPENED is not also reported as a live hold" "$out" "HOLDS    lane repoK-1"
-
-run env LANES_LANE=repoK-4 "$E" claim "opensoft/repoK#15" --no-github --force
-is   "--force still refuses a lane whose log ends RETIRED when a live session backs it up" "$rc" 2
-has  "…the verb-mismatch refusal fires exactly as it does for a live lane" "$err" "is not a stale claim"
-hasnt "…and nothing is written" "$(cat "$LOGD/repoK-4.md" 2>/dev/null)" "opensoft/repoK#15"
-
-# Copilot round 13, PR #61: the SAME live-but-RETIRED shape, but the held
-# object is a stale CLAIMED — the one case that used to reach `claim_is_stale`
-# rather than an explicit liveness refusal, because `holder_is_dead` returning
-# false was read as "not terminal" instead of "terminal, but confirmed live".
-run env LANES_LANE=repoK-6 "$E" claim "opensoft/repoK#99" --no-github --force
-is   "--force refuses a live lane's stale CLAIMED too, not only its OPENED/other verbs" "$rc" 2
-has  "…naming what its own log says" "$err" "lane repoK-5's own log ends RETIRED"
-has  "…and that a live session is why, not the claim's age" "$err" "a live session on this workstation still backs it up"
-hasnt "…never reaching the ordinary stale-claim wording" "$err" "old (threshold"
-hasnt "…and nothing is written" "$(cat "$LOGD/repoK-6.md" 2>/dev/null)" "opensoft/repoK#99"
-run "$E" who "opensoft/repoK#99"
-is   "…the object is still repoK-5's, untaken" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…held by the live lane itself" "$out" "HOLDS    lane repoK-5"
-
-# --------- Copilot round 8, PR #61: the three open verbs repoK-1/2 left
-# untested for issue #30's dead-lane takeover — LANDING, WITHDRAWN and an
-# earlier TAKEOVER, the same broadened `superseded_by`/`lane_states_on`
-# open-verb set (CLAIMED|TAKEOVER|OPENED|LANDING|WITHDRAWN) as OPENED/CLAIMED
-# above, never separately regression-tested before this round.
-
-run env LANES_LANE=repoL-2 "$E" claim "opensoft/repoL#20" --no-github --force
-is   "--force takes over a DEAD lane's LANDING too, not only its OPENED/CLAIMED" "$rc" 0
-L2="$(cat "$LOGD/repoL-2.md")"
-has  "…writing a TAKEOVER line" "$L2" "TAKEOVER — lane repoL-2, session "
-has  "…referencing the dead lane with ←" "$L2" "opensoft/repoL#20 ← lane:repoL-1"
-run "$E" who "opensoft/repoL#20"
-is   "…and exactly ONE lane holds it, not two" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-hasnt "…repoL-1's own dead LANDING is not also reported as a live hold" "$out" "HOLDS    lane repoL-1"
-
-run env LANES_LANE=repoL-4 "$E" claim "opensoft/repoL#30" --no-github --force
-is   "--force takes over a DEAD lane's WITHDRAWN too" "$rc" 0
-L4="$(cat "$LOGD/repoL-4.md")"
-has  "…writing a TAKEOVER line" "$L4" "TAKEOVER — lane repoL-4, session "
-has  "…referencing the dead lane with ←" "$L4" "opensoft/repoL#30 ← lane:repoL-3"
-run "$E" who "opensoft/repoL#30"
-is   "…and exactly ONE lane holds it, not two" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-hasnt "…repoL-3's own dead WITHDRAWN is not also reported as a live hold" "$out" "HOLDS    lane repoL-3"
-
-run env LANES_LANE=repoL-6 "$E" claim "opensoft/repoL#40" --no-github --force
-is   "--force takes over a DEAD lane's own earlier TAKEOVER too" "$rc" 0
-L6="$(cat "$LOGD/repoL-6.md")"
-has  "…writing a TAKEOVER line" "$L6" "TAKEOVER — lane repoL-6, session "
-has  "…referencing the dead lane with ←, not the lane it had itself taken over from" "$L6" "opensoft/repoL#40 ← lane:repoL-5"
-hasnt "…never the earlier dispossessed lane repoL-5 never held directly" "$L6" "← lane:repoL-0"
-# THE WRITE IS RIGHT, AND SINCE opensoft/openRepoTools#74 SO IS THE READ: a
-# chain of takeovers resolves to its LAST LINK. repoL-5's own TAKEOVER (over
-# repoL-0) is displaced by repoL-6's, which names it; repoL-6's is displaced by
-# nothing, because no standing TAKEOVER names repoL-6. Until #74 this block
-# pinned ZERO holders as the known gap: `superseded_by` asked only "does some
-# OTHER lane's last line here read TAKEOVER", read repoL-5's stale TAKEOVER as
-# proof that repoL-6 was superseded too, and `holders_of` dropped BOTH ends of
-# the chain — reachable from one ordinary `--force` since PR #61 (issue #30)
-# let a dead lane's own TAKEOVER be taken over.
-run "$E" who "opensoft/repoL#40"
-is   "…and who reports exactly ONE holder of the chain, not zero (#74)" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…the chain's last link, repoL-6" "$out" "HOLDS    lane repoL-6"
-hasnt "…repoL-5's own dead TAKEOVER is not reported as a live hold" "$out" "HOLDS    lane repoL-5"
-has  "…repoL-5 reads as superseded by repoL-6, the TAKEOVER that names it" \
-     "$(printf '%s\n' "$out" | grep '^super\.   lane repoL-5 ')" "superseded by TAKEOVER (lane:repoL-6)"
-run "$E" who --lane repoL-6
-is   "who --lane on the chain's last link exits 0" "$rc" 0
-has  "…lists its TAKEOVER" "$out" "opensoft/repoL#40"
-hasnt "…and never tells the holder it was taken over by the lane it took the object from" "$out" "taken over by"
-
-# --------- opensoft/openRepoTools#74: a THREE-link chain, its third link made
-# here by `claim --force`. Read one-hop, repoChain-2 and repoChain-3 displaced
-# EACH OTHER, the object read FREE, and this claim was granted as a plain
-# CLAIMED over a held object — the one outcome Rule 1 exists to prevent.
-# Followed to its last link, repoChain-3 is the one holder, and, dead, it is
-# taken over like any dead lane's hold.
-run env LANES_LANE=repoChain-4 "$E" claim "opensoft/repoChain#1" --no-github --force
-is   "--force takes over the LAST link of a chain of two TAKEOVERs (#74)" "$rc" 0
-LC4="$(cat "$LOGD/repoChain-4.md" 2>/dev/null)"
-has  "…writing a TAKEOVER, not a CLAIMED as if the object were free" "$LC4" "TAKEOVER — lane repoChain-4, session "
-has  "…naming the chain's last link, never an earlier one" "$LC4" "opensoft/repoChain#1 ← lane:repoChain-3"
-run "$E" who "opensoft/repoChain#1"
-is   "…and who reports exactly ONE holder of the three-link chain" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…the third link, repoChain-4" "$out" "HOLDS    lane repoChain-4"
-has  "…the second link superseded by the third, which names it" \
-     "$(printf '%s\n' "$out" | grep '^super\.   lane repoChain-3 ')" "superseded by TAKEOVER (lane:repoChain-4)"
-has  "…the first link superseded by the second, which names it" \
-     "$(printf '%s\n' "$out" | grep '^super\.   lane repoChain-2 ')" "superseded by TAKEOVER (lane:repoChain-3)"
-has  "…and the CLAIMED the chain began with names the lane that holds it NOW" \
-     "$(printf '%s\n' "$out" | grep '^super\.   lane repoChain-1 ')" "superseded by TAKEOVER (lane:repoChain-4)"
-
-# Two TAKEOVERs of one stale claim, NEITHER naming the other: README-lanes.md's
-# "Known, deliberate" race, BOTH holders and the conflict visible. A TAKEOVER is
-# displaced only by one that names its lane (#74); the one-hop test had each
-# displace the other since PR #61 (issue #30) widened its gate, and `who` called
-# the object FREE — so `claim` granted a third lane a plain CLAIMED over it.
-run "$E" who "opensoft/repoChain#2"
-is   "two takers of one claim, neither naming the other, are BOTH holders" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 2
-has  "…the state is HELD, never FREE" "$out" "state    HELD"
-run env LANES_LANE=repoChain-4 "$E" claim "opensoft/repoChain#2" --no-github --force
-is   "…and --force refuses an object two lanes hold" "$rc" 2
-has  "…saying so" "$err" "is held by 2 lanes"
-hasnt "…writing nothing" "$(cat "$LOGD/repoChain-4.md" 2>/dev/null)" "opensoft/repoChain#2"
-# And two TAKEOVERs that name EACH OTHER: nothing in two files says which was
-# written last, so both hold, visibly, rather than displacing each other.
-run "$E" who "opensoft/repoChain#3"
-is   "two TAKEOVERs naming EACH OTHER are both holders, never zero" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 2
-
-# repoN-1's OWN terminal verb is ENDED, not RETIRED (Copilot round 3, PR #61:
-# `holder_is_dead`'s case accepts both, but only RETIRED was ever seeded).
-run env LANES_LANE=repoN-2 "$E" claim "opensoft/repoN#7" --no-github --force
-is   "--force also takes over a lane whose log ends ENDED (a plain lane-end)" "$rc" 0
-has  "…writing a TAKEOVER line" "$(cat "$LOGD/repoN-2.md")" "opensoft/repoN#7 ← lane:repoN-1"
-has  "…naming ENDED, not RETIRED, as the verdict" "$(cat "$LOGD/repoN-2.md")" "log ends ENDED"
-
-# AMENDMENT 18(b): LIVENESS IS PRONOUNCED ONLY FROM INSIDE THE BINDING (Copilot
-# on 8ce6c9d, PR #61). repoKr-1's log ends RETIRED and no record here holds it,
-# exactly like repoL-1 — but its last STARTED was written on `elsewhere-host`,
-# and from here that binding is UNKNOWN, never dead. Refused, naming it.
-run env LANES_LANE=repoKr-2 "$E" claim "opensoft/repoKr#1" --no-github --force
-is    "--force REFUSES a terminal lane whose last binding is on another host" "$rc" 2
-has   "…naming the binding it cannot pronounce on" "$err" "its last binding is on elsewhere-host/none"
-has   "…in Amendment 18(b)'s own words" "$err" "UNKNOWN, never dead (Amendment 18(b))"
-hasnt "…and no takeover is written" "$(cat "$LOGD/repoKr-2.md" 2>/dev/null)" "opensoft/repoKr#1"
-# …while from INSIDE that host and container the same verdict is confirmed.
-run env LANES_LANE=repoKr-2 LANES_HOST=elsewhere-host LANES_CONTAINER=none "$E" claim "opensoft/repoKr#1" --no-github --force
-is    "…and the same takeover from inside that binding's host and container is granted" "$rc" 0
-has   "…writing a TAKEOVER over the dead lane" "$(cat "$LOGD/repoKr-2.md")" "opensoft/repoKr#1 ← lane:repoKr-1"
-
-# THE WINDOW-GONE EXCEPTION ADMITS THE BINDING TO THE LOCAL READ, IT DOES NOT
-# REPLACE IT (Copilot on a52abc6, PR #61). repoKg-1 was bound in container
-# `other-bench` on this run's host, and its window `@77` resolves nowhere on the
-# shared tmux server — a dead binding by Amendment 18(b)'s own exception. But a
-# session record on THIS workstation still carries its id: a dead pane is not
-# proof that nothing here holds the lane, so the takeover is refused.
-write_record "$sessions_dir/$LIVE_PID-repoKg1.json" "$KGLIVE_ID" "$LIVE_PID" "$live_start" "kgsess:@9.%9" "repoKg-1" "idle"
-run env LANES_LANE=repoKg-2 LANES_HOST=elsewhere-host LANES_CONTAINER=this-bench "$E" claim "opensoft/repoKg#1" --no-github --force
-is    "a window-gone binding with a LIVE local record for the lane is still refused" "$rc" 2
-hasnt "…never as a dead lane's hold" "$err" "takeover of a dead lane's hold"
-hasnt "…and no takeover is written" "$(cat "$LOGD/repoKg-2.md" 2>/dev/null)" "opensoft/repoKg#1"
-rm -f "$sessions_dir/$LIVE_PID-repoKg1.json"
-# …and with no such record, the exception confirms it and the takeover lands.
-run env LANES_LANE=repoKg-2 LANES_HOST=elsewhere-host LANES_CONTAINER=this-bench "$E" claim "opensoft/repoKg#1" --no-github --force
-is    "…while the same window-gone binding with nothing live here is taken over" "$rc" 0
-has   "…writing a TAKEOVER that says why" "$(cat "$LOGD/repoKg-2.md")" "its binding's window is gone from this host's tmux"
-
-# ---- opensoft/openRepoTools#67: A REGISTER NOBODY COULD READ IS NOT A LANE WITH NO IDS
-#
-# `session_ids_of_lane` and `session_ids_local_of_lane` answered the same EMPTY
-# set for "this lane has no row" and "the register could not be read", and the
-# two callers that read an empty set as a VERDICT were fail-open on it:
-# `holder_is_dead` handed it to `live_holder`, whose 8 then confirmed dead a
-# lane nobody had checked, and `duplicate_holder_pids` answered "no duplicate"
-# without asking the process table anything.
-#
-# ITS OWN WORKSPACE, because the empty set needs BOTH halves of the union to
-# come back empty: the published register unreadable — a `git` that fails the
-# one `show` of it, as the archive's case below does; `chmod 000` is no fixture
-# under root, and a dangling link fails the dispatcher's `[ -f ]` guard before
-# any of this runs — and THIS checkout's own copy without the row, because a
-# peer published it and this clone has not pulled (R19's ordinary case). In the
-# main sandbox every row is in the working tree too, so the local half answers
-# for the published one and the hole never opens there.
-R67_ORIGIN="$SANDBOX/r67-origin.git"; R67_WIP="$SANDBOX/r67wip"; R67_PEER="$SANDBOX/r67peer"
-R67_ID="aaaa0067-6767-4000-8000-aaaa00676767"
-git init -q --bare -b main "$R67_ORIGIN"
-git clone -q "$R67_ORIGIN" "$R67_PEER" 2>/dev/null
-git -C "$R67_PEER" config user.email "test@example.invalid"
-git -C "$R67_PEER" config user.name  "lane helper tests"
-mkdir -p "$R67_PEER/lanes/log"
-{ printf '# LANES.md — the issue #67 sandbox\n\n'
-  printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-  printf '|---|---|---|---|---|---|---|\n'
-  printf '| `repo67-2` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repo67/2.md | ACTIVE |\n' "$DEAD_ID"
-} > "$R67_PEER/lanes/LANES.md"
-git -C "$R67_PEER" add -A >/dev/null 2>&1
-git -C "$R67_PEER" commit -q -m "seed the #67 register" >/dev/null 2>&1
-git -C "$R67_PEER" push -q origin main 2>/dev/null
-git clone -q "$R67_ORIGIN" "$R67_WIP" 2>/dev/null
-git -C "$R67_WIP" config user.email "test@example.invalid"
-git -C "$R67_WIP" config user.name  "lane helper tests"
-# THE PEER PUBLISHES repo67-1 AFTER THAT CLONE: repoK-3's shape — its log ends
-# RETIRED with an OPENED PR left behind, and a live session on this workstation
-# still carries its id — so the one right answer to `--force` is a refusal.
-printf '| `repo67-1` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repo67/1.md | ACTIVE |\n' "$R67_ID" >> "$R67_PEER/lanes/LANES.md"
-{ printf '# lane repo67-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repo67-1, session %s@Eagle, %s, lane:repo67-1 → home opensoft/repo67; estate repo67\n' "$R67_ID" "$OLD_UTC"
-  printf 'OPENED — lane repo67-1, session %s@Eagle, %s, opensoft/repo67#5 ← opensoft/repo67#4\n' "$R67_ID" "$OLD_UTC"
-  printf 'RETIRED — lane repo67-1, session %s@Eagle, %s, lane:repo67-1\n' "$R67_ID" "$NOW_UTC"
-} > "$R67_PEER/lanes/log/repo67-1.md"
-git -C "$R67_PEER" add -A >/dev/null 2>&1
-git -C "$R67_PEER" commit -q -m "the peer publishes repo67-1" >/dev/null 2>&1
-git -C "$R67_PEER" push -q origin main 2>/dev/null
-write_record "$sessions_dir/$LIVE_PID-repo671.json" "$R67_ID" "$LIVE_PID" "$live_start" "r67sess:@9.%9" "repo67-1" "idle"
-is    "the #67 fixture: this checkout's own register has no row for repo67-1" \
-      "$(command grep -c '^| `repo67-1`' "$R67_WIP/lanes/LANES.md" || :)" 0
-mkdir -p "$SANDBOX/r67-gitfail"
-cat > "$SANDBOX/r67-gitfail/git" <<'FAKE'
-#!/usr/bin/env bash
-case " $* " in
-  *" show origin/main:lanes/LANES.md "*) exit 128 ;;
-esac
-exec "${REAL_GIT:?}" "$@"
-FAKE
-chmod +x "$SANDBOX/r67-gitfail/git"
-r67()  { env LANES_WORKSPACE_ROOT="$R67_WIP" LANES_LANE=repo67-2 LANES_SESSION="$DEAD_ID" "$@"; }
-r67x() { r67 env PATH="$SANDBOX/r67-gitfail:$PATH" REAL_GIT="$(command -v git)" "$@"; }
-R67_PS="$(printf '%s\t%s\t%s' 900671 1 "claude --session-id $R67_ID --fork-session --resume /nonexistent/projects/$R67_ID.jsonl")"
-
-# `duplicate-holder` FIRST, because it writes nothing. With the register
-# readable and no `--fork-session` process at all, 8 is the honest none — the
-# process table's own answer, read.
-run r67 "$E" duplicate-holder repo67-1
-is    "duplicate-holder over a readable register with no fork-session process: 8, none" "$rc" 8
-# …and over the register nobody could read, with a stray in the table, it is NOT
-# that 8: the ids are the whole search, and none of them was read.
-run r67x env FAKE_PGREP_F_PIDS=900671 FAKE_PS_RECORDS="$R67_PS" "$E" duplicate-holder repo67-1
-is    "duplicate-holder over an UNREADABLE register is 1, never the 8 that means none is live" "$rc" 1
-has   "…naming the read that failed" "$err" "the register (origin/main:lanes/LANES.md"
-has   "…in the words that stop a reader believing there is none" "$err" "That is NOT 'no duplicate holder is live'"
-is    "…and listing nothing" "$out" ""
-
-r67_head="$(git -C "$R67_ORIGIN" rev-parse main)"
-run r67 "$E" claim "opensoft/repo67#5" --no-github --force
-is    "--force over a readable register refuses repo67-1: RETIRED, and a live session still backs it" "$rc" 2
-hasnt "…never as a dead lane's hold" "$err" "takeover of a dead lane's hold"
-run r67x "$E" claim "opensoft/repo67#5" --no-github --force
-is    "--force over an UNREADABLE register refuses too: it never confirms the lane dead" "$rc" 2
-has   "…naming the read that failed" "$err" "the register (origin/main:lanes/LANES.md"
-has   "…and saying what that is not" "$err" "That is NOT 'it has no session ids'"
-hasnt "…never as a dead lane's hold" "$err" "takeover of a dead lane's hold"
-hasnt "…never blaming a live session nobody looked for" "$err" "is not a stale claim"
-is    "…and nothing is written: no TAKEOVER line" \
-      "$(cat "$R67_WIP/lanes/log/repo67-2.md" 2>/dev/null | command grep -c 'opensoft/repo67#5' || :)" 0
-is    "…and no push" "$(git -C "$R67_ORIGIN" rev-parse main)" "$r67_head"
-rm -f "$sessions_dir/$LIVE_PID-repo671.json"
-
-# ------------------------------------------- LANDING, LANDED, who --landing
-
-before_lanes="$(grep -c . "$LANES")"
-run env LANES_LANE=repoE-1 "$E" log LANDING "opensoft/repoE#21"
-is   "log LANDING exits 0" "$rc" 0
-is   "…and appends exactly one line to LANES.md as well" "$(grep -c . "$LANES")" "$((before_lanes + 1))"
-has  "…in Rule 6's own words, so other lanes read it as the merge hold" "$(tail -n1 "$LANES")" "LANDING — lane repoE-1, session "
-has  "…naming the PR and the repo" "$(tail -n1 "$LANES")" "PR #21 into opensoft/repoE main"
-is   "…and both files land in ONE commit, with two pathspecs" "$(git -C "$WIP" show --name-only --format= HEAD | grep -c .)" 2
-has  "…the register" "$(git -C "$WIP" show --name-only --format= HEAD)" "lanes/LANES.md"
-has  "…and the lane's log" "$(git -C "$WIP" show --name-only --format= HEAD)" "lanes/log/repoE-1.md"
-
-run "$E" who --landing opensoft/repoE
-is   "who --landing lists the open LANDING for a repo" "$rc" 0
-has  "…naming the object and the lane" "$out" "LANDING  opensoft/repoE#21  lane repoE-1"
-
-# R5: the merge hold is read from LANES.md, so a PRE-CUTOVER lane with no log
-# of its own is still seen — and a retry that re-posts LANDING for the same PR
-# is one landing, not two.
-run "$E" who --landing opensoft/workBenches
-is   "who --landing reads LANES.md, so a lane with no log is still seen" "$rc" 0
-has  "…naming it" "$out" "LANDING  opensoft/workBenches#77  lane repoP-1"
-is   "…and a re-posted LANDING for the same PR counts once" "$(printf '%s\n' "$out" | grep -c 'workBenches#77')" 1
-has  "…and marks it past Rule 6's thirty minutes rather than reporting it as live" "$out" "STALE (Rule 6: >30 min)"
-
-run "$E" who --landing opensoft/repoFresh
-has  "…while a LANDING inside the window is listed unmarked" "$out" "LANDING  opensoft/repoFresh#91"
-hasnt "…with no STALE against it" "$out" "STALE"
-
-# The key is (lane, repo, PR). On (lane, PR) alone, this lane's LANDED on
-# Omni-B closed its own still-open LANDING on Omni-A and the hold vanished.
-run "$E" who --landing opensoft/Omni-A
-is   "who --landing keys on (lane, repo, PR)" "$rc" 0
-has  "…so a LANDED on ANOTHER repo does not close this hold" "$out" "LANDING  opensoft/Omni-A#5  lane repoP-1"
-run "$E" who --landing opensoft/Omni-B
-is   "…while the repo that really landed reports an answer, not an absence" "$rc" 0
-has  "…in words" "$out" "none open"
-hasnt "…and does not list it" "$out" "LANDING  opensoft/Omni-B#5"
-
-run env LANES_LANE=repoE-1 "$E" log LANDED "opensoft/repoE#21" "→" "abc1234"
-has  "LANDED closes the window in LANES.md as well" "$(tail -n1 "$LANES")" "PR #21 into opensoft/repoE main → abc1234"
-run "$E" who --landing opensoft/repoE
-is   "…so who --landing no longer lists it — and an empty answer is exit 0" "$rc" 0
-has  "…saying none is open" "$out" "none open"
-has  "…with the lane logs reported after it, as secondary" "$out" "from lane logs (secondary):"
-has  "…naming this lane's own last line on the PR" "$out" "LANDED   opensoft/repoE#21"
-run "$E" who "opensoft/repoE#21"
-has  "…and the lane's own hold on it is closed" "$out" "closed   lane repoE-1"
-has  "…by the LANDED that carries the merge sha" "$out" "LANDED    "
-has  "…leaving the object free" "$out" "state    FREE"
-
-# ------------------------------------------------------------ release
-
-run env LANES_LANE=repoE-1 "$E" release "opensoft/workBenches#3" "not ours after all" --no-github
-is   "release exits 0" "$rc" 0
-has  "…writing a RELEASED line carrying the reason" "$(cat "$LOGD/repoE-1.md")" ", opensoft/workBenches#3 — not ours after all"
-
-# ---------------------------------------------------------- CLAIM-LOST
-#
-# The race is decided by which CLAIMED LANDS on main first. The peer commits
-# and pushes; this lane's fetch is deferred, so its pre-check sees a main that
-# does not yet carry the peer's line — and the peer's claim arrives exactly
-# where it arrives in life: in the rebase inside its own push.
-CLONE2="$SANDBOX/clone2"
-git clone -q "$ORIGIN" "$CLONE2" 2>/dev/null
-git -C "$CLONE2" config user.email "peer@example.invalid"
-git -C "$CLONE2" config user.name  "the other workstation"
-mkdir -p "$CLONE2/lanes/log"
-{ printf '# lane repoH-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED — lane repoH-2, session %s@Raven, %s, opensoft/repoH#4\n' "$DEAD_ID" "$(utc_at -2M)"
-} > "$CLONE2/lanes/log/repoH-2.md"
-git -C "$CLONE2" add -- lanes/log/repoH-2.md
-git -C "$CLONE2" commit -q -m "LOG(repoH-2@Raven): CLAIMED opensoft/repoH#4"
-git -C "$CLONE2" push -q origin main
-
-run env LANES_LANE=repoH-1 LANES_NO_FETCH=1 "$E" claim "opensoft/repoH#4" --no-github
-is   "a claim whose rival landed first exits 7" "$rc" 7
-has  "…naming the lane that landed first" "$err" "another lane's claim landed on main before this one: @repoH-2"
-has  "…and citing Rule 1 rather than queueing" "$err" "stop and report"
-has  "…writing a CLAIM-LOST line in this lane's own log" "$(cat "$LOGD/repoH-1.md")" "CLAIM-LOST — lane repoH-1, session "
-has  "…that points at the winner with the lane: form" "$(cat "$LOGD/repoH-1.md")" "opensoft/repoH#4 → lane:repoH-2"
-run "$E" who "opensoft/repoH#4"
-has  "…and the object is the winner's" "$out" "HOLDS    lane repoH-2"
-is   "…and the loser holds nothing" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-
-# The winner is whichever rival is ALREADY on the rebased history — the one
-# that LANDED first — and never the earliest timestamp. Two rivals land during
-# one rebase window: repoH-2 lands FIRST carrying the LATER UTC.
-LATE_UTC="$(utc_at +10M)"
-EARLY_UTC="$(utc_at +5M)"
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-printf 'CLAIMED — lane repoH-2, session %s@Raven, %s, opensoft/repoH#60\n' "$DEAD_ID" "$LATE_UTC" >> "$CLONE2/lanes/log/repoH-2.md"
-git -C "$CLONE2" add -- lanes/log/repoH-2.md
-git -C "$CLONE2" commit -q -m "LOG(repoH-2@Raven): CLAIMED opensoft/repoH#60"
-git -C "$CLONE2" push -q origin main
-{ printf '# lane repoH-4 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED — lane repoH-4, session %s@Raven, %s, opensoft/repoH#60\n' "$DEAD_ID" "$EARLY_UTC"
-} > "$CLONE2/lanes/log/repoH-4.md"
-git -C "$CLONE2" add -- lanes/log/repoH-4.md
-git -C "$CLONE2" commit -q -m "LOG(repoH-4@Raven): CLAIMED opensoft/repoH#60"
-git -C "$CLONE2" push -q origin main
-
-run env LANES_LANE=repoH-1 LANES_NO_FETCH=1 "$E" claim "opensoft/repoH#60" --no-github
-is   "a claim that two rivals beat to main exits 7" "$rc" 7
-has  "…naming the one that LANDED first" "$err" "@repoH-2"
-hasnt "…never the one whose timestamp is earlier" "$err" "@repoH-4"
-has  "…and the CLAIM-LOST line points at that winner" "$(cat "$LOGD/repoH-1.md")" "opensoft/repoH#60 → lane:repoH-2"
-
-# ---------------------------------------------- every read is of origin/main
-#
-# A read must see what LANDED, not what this checkout happens to have pulled.
-# The peer lands a claim from the other clone; this one never pulls it.
-peer_log_line() { git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-  printf '%s\n' "$1" >> "$CLONE2/lanes/log/repoH-2.md"
-  git -C "$CLONE2" add -- lanes/log/repoH-2.md
-  git -C "$CLONE2" commit -q -m "LOG(repoH-2@Raven): $2"
-  git -C "$CLONE2" push -q origin main; }
-
-peer_log_line "CLAIMED — lane repoH-2, session $DEAD_ID@Raven, $(date -u +%Y-%m-%dT%H:%M:%SZ), opensoft/repoH#50" "CLAIMED opensoft/repoH#50"
-is   "the peer's claim is on origin/main and NOT in this checkout's working tree" "$(grep -c 'repoH#50' "$LOGD/repoH-2.md" 2>/dev/null || :)" 0
-run "$E" who "opensoft/repoH#50"
-is   "who reads origin/main, so it sees a claim this checkout has not pulled" "$rc" 0
-has  "…naming the lane that holds it" "$out" "HOLDS    lane repoH-2"
-run env LANES_LANE=repoH-1 "$E" claim "opensoft/repoH#50" --no-github
-is   "…and a claim on it is refused rather than raced" "$rc" 2
-hasnt "…nothing written to the would-be taker's log" "$(cat "$LOGD/repoH-1.md")" "opensoft/repoH#50"
-
-# Staleness comes from the same place. Rule 1: a claim its lane has since
-# discharged with a PR that names the issue is NOT stale — and that OPENED
-# line can only be seen by reading what landed.
-peer_log_line "CLAIMED — lane repoH-2, session $DEAD_ID@Raven, $OLD_UTC, opensoft/repoH#51" "CLAIMED opensoft/repoH#51"
-peer_log_line "OPENED — lane repoH-2, session $DEAD_ID@Raven, $MID_UTC, opensoft/repoH#52 ← opensoft/repoH#51" "OPENED opensoft/repoH#52"
-is   "the peer's claim AND the PR that discharges it are on origin/main only" "$(grep -c 'repoH#51' "$LOGD/repoH-2.md" 2>/dev/null || :)" 0
-run env LANES_LANE=repoH-1 "$E" claim "opensoft/repoH#51" --force --no-github
-is   "--force reads staleness from origin/main too, so a four-hour-old claim with a PR is refused" "$rc" 2
-has  "…in Rule 1's own words" "$err" "has since OPENED a PR naming it"
-hasnt "…and no TAKEOVER is written on a claim that is not stale" "$(cat "$LOGD/repoH-1.md")" "opensoft/repoH#51"
-
-# ------------------------- R11 and the race, in the same run (F1's own repro)
-#
-# The two halves together: a rival's CLAIMED is already on `main`, and THIS
-# checkout carries a peer's half-written register line. Before F1 this sequence
-# left an unpushed local CLAIMED and two lanes holding one object; after F1 and
-# before R11 it was an exit-2 refusal on the one file this checkout is dirty in
-# most of the day. Now the capture clears the way, `pull --rebase` runs, the
-# rescan sees the rival, and the loser abandons the claim: one holder, exit 7.
-peer_log_line "CLAIMED — lane repoH-2, session $DEAD_ID@Raven, $(date -u +%Y-%m-%dT%H:%M:%SZ), opensoft/repoH#70" "CLAIMED opensoft/repoH#70"
-printf 'a peer left this register line uncommitted\n' >> "$LANES"
-run env LANES_LANE=repoH-1 LANES_NO_FETCH=1 "$E" claim "opensoft/repoH#70" --no-github
-is   "a claim raced from a checkout with a dirty register still LOSES, exit 7" "$rc" 7
-has  "…having captured the peer's register line on the way" "$err" "captured pre-existing edit"
-has  "…and naming the lane whose claim landed on main first" "$err" "another lane's claim landed on main before this one: @repoH-2"
-has  "…writing CLAIM-LOST in this lane's own log" "$(cat "$LOGD/repoH-1.md")" "opensoft/repoH#70 → lane:repoH-2"
-is   "…with the register left clean" "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c .)" 0
-run "$E" who "opensoft/repoH#70"
-is   "…and exactly one lane holds the object" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…the one that landed first" "$out" "HOLDS    lane repoH-2"
-
-# --------------------- issue #30's OWN race (Copilot round 12, PR #61): the
-# open thread on eea55a7, lanes-edit.sh:7440. The dead-lane verdict is read
-# ONCE, before the claim's first pull — and nothing about the OBJECT has to
-# change for that verdict to go stale, because a RESUMED line is the LANE's
-# own log, never an event `claim_rescan_hook`'s rival scan reads. repoT-1 is
-# dead exactly as repoL-1 (seeded above); the peer resumes it on the SAME
-# stale-pre-fetch trick the CLAIM-LOST races above use — pushed to origin
-# before this claim runs, but invisible to its own pre-check under
-# LANES_NO_FETCH=1, so the takeover is granted on knowledge that is already
-# out of date by the time its own push loop rebases onto what really landed.
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-printf 'RESUMED — lane repoT-1, session %s@Eagle, %s, lane:repoT-1\n' "$DEAD_ID" "$(utc_at +1M)" >> "$CLONE2/lanes/log/repoT-1.md"
-git -C "$CLONE2" add -- lanes/log/repoT-1.md
-git -C "$CLONE2" commit -q -m "LOG(repoT-1@Eagle): RESUMED"
-git -C "$CLONE2" push -q origin main
-
-run env LANES_LANE=repoT-2 LANES_NO_FETCH=1 "$E" claim "opensoft/repoT#1" --no-github --force
-is   "a dead-lane takeover whose source RESUMES before the push lands aborts, exit 9 (never 7, a RIVAL's own code)" "$rc" 9
-has  "…naming the lane that is alive again" "$err" "lane repoT-1 is no longer confirmed dead"
-has  "…and citing Rule 1 rather than completing the takeover" "$err" "stop and report; do not author a successor"
-has  "…writing CLAIM-LOST in the taker's own log" "$(cat "$LOGD/repoT-2.md" 2>/dev/null)" "CLAIM-LOST — lane repoT-2, session "
-has  "…pointing at the revived lane with the lane: form" "$(cat "$LOGD/repoT-2.md")" "opensoft/repoT#1 → lane:repoT-1"
-has  "…the abandon note says WHY, never that a rival claim landed first" "$(cat "$LOGD/repoT-2.md")" "abandoned: repoT-1 is no longer dead, takeover withdrawn before landing"
-run "$E" who "opensoft/repoT#1"
-is   "…and the object is still repoT-1's own — the taker never wrote a TAKEOVER" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…held by the revived lane itself" "$out" "HOLDS    lane repoT-1"
-
-# AND A RECHECK THAT CANNOT READ THE SOURCE LANE'S LOG AT ALL (Copilot on
-# 05d7889, PR #61). `holder_is_dead` used to read the log in one pipeline whose
-# status was `awk`'s, so an unreadable log came back as an empty verdict with
-# no marker set, and the abort told the operator the log had "moved past the
-# terminal line" — which nothing had read. The peer removes repoTx-1's log
-# from origin on the same stale-pre-fetch trick, so the grant is made on the
-# old ref and the recheck after the rebase finds no log to read. It still
-# aborts with 9, in words that say only what was established. The log is put
-# back afterwards so no later section meets a row with no log.
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-git -C "$CLONE2" rm -q -- lanes/log/repoTx-1.md
-git -C "$CLONE2" commit -q -m "fixture: repoTx-1's log is unreadable on the takeover's recheck"
-git -C "$CLONE2" push -q origin main
-TX_GONE_AT="$(git -C "$CLONE2" rev-parse HEAD)"
-
-run env LANES_LANE=repoTx-2 LANES_NO_FETCH=1 "$E" claim "opensoft/repoTx#1" --no-github --force
-is    "a dead-lane takeover whose source log CANNOT BE READ on the recheck aborts, exit 9" "$rc" 9
-has   "…saying the dead verdict could not be reconfirmed because the log was not read" "$err" "its own object log could not be read, or yielded no lane-kind line at all"
-hasnt "…never that the log moved past its terminal line, which nobody read" "$err" "has moved past the terminal line"
-hasnt "…nor that the lane is alive again, which nobody saw" "$err" "is alive again"
-has   "…and the CLAIM-LOST line says the same, never 'no longer dead'" "$(cat "$LOGD/repoTx-2.md" 2>/dev/null)" "abandoned: the dead verdict on repoTx-1 could not be reconfirmed"
-hasnt "…in either half of it" "$(cat "$LOGD/repoTx-2.md" 2>/dev/null)" "repoTx-1 is no longer dead"
-
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-git -C "$CLONE2" checkout -q "$TX_GONE_AT^" -- lanes/log/repoTx-1.md
-git -C "$CLONE2" commit -q -m "fixture: repoTx-1's log restored"
-git -C "$CLONE2" push -q origin main
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null
-
-# ------------------------------------- the row's cells, by header position
-
-run env LANES_LANE=repoS-1 "$E" claim "opensoft/repoS#1" --no-github
-is   "a row whose later cells contain a literal | splits into 10 fields" "$(grep '^| `repoS-1`' "$LANES" | awk -F'|' '{print NF}')" 10
-run "$E" who "opensoft/repoS#1"
-has  "…and its handoff path is found by header position, not by counting back from NF" "$out" "handoff  handoffs/repoS/session-handoff-2026-09-11-lane-repoS-1.md"
-hasnt "…never the fragment NF-2 lands on" "$out" "handoff  still open"
-has  "…while the workstation column is read from the left as before" "$out" "NOT LIVE (parked"
-
-run "$END" repoS-2
-is   "lane-end's pre-cutover scan reads the WHOLE state cell, pipes and all" "$rc" 2
-has  "…finding the LANDING that the last fragment alone would have missed" "$err" "the last LANDING in its state cell"
-
-# ------------------------------------------------------------- liveness
-
-run "$E" live-holder repoF-1
-is   "a live holder whose record name is DERIVED is still a holder" "$rc" 0
-has  "…and it is the right session" "$out" "$F_ID"
-run "$START" repoF 1 --no-launch
-is   "…so a second window is refused the lane" "$rc" 2
-has  "…naming the session that holds it" "$err" "is live in session $F_ID"
-
-write_record_ns "$sessions_dir/live-renamed.json" "$H_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "repoH-3" "user" "busy"
-run "$E" live-holder repoH-3
-is   "a record a person RENAMED to the lane is a holder" "$rc" 0
-has  "…and it is the right session" "$out" "$H_ID"
-
-run "$E" live-holder repoG-3
-is   "a live record EXPLICITLY named for another lane is not a holder" "$rc" 8
-run "$E" live-holder repoA-1
-is   "…as is a lane whose every recorded session has ended" "$rc" 8
-
-# ONLY 0 AND 8 ARE ANSWERS. A helper that fails is not a helper that said "no".
-cat > "$SANDBOX/failedit" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  live-holder|lane-objects) printf '%s: simulated failure\n' "$1" >&2; exit 3 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/failedit"
-
-before_renames="$(grep -c 'rename-window repoB-1' "$FAKE_TMUX_LOG" || :)"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/failedit" "$START" repoB 1 --no-launch
-is   "lane-start REFUSES when live-holder fails, rather than taking the name" "$rc" 1
-has  "…naming the helper and its exit code" "$err" "live-holder repoB-1 failed (exit 3)"
-has  "…passing the helper's own stderr through instead of swallowing it" "$err" "live-holder: simulated failure"
-hasnt "…and never saying the lane is free" "$err" "this is a resume of a lane whose sessions have all ended"
-is   "…and renaming no window on an answer it did not get" "$(grep -c 'rename-window repoB-1' "$FAKE_TMUX_LOG" || :)" "$before_renames"
-
-run "$E" lane-objects repoP-2
-is   "lane-objects on a lane with no log exits 8 — the same 8 who uses for no record" "$rc" 8
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/failedit" "$END" repoG-2
-is   "lane-end REFUSES when lane-objects fails, rather than calling the lane pre-cutover" "$rc" 1
-has  "…naming the helper and its exit code" "$err" "lane-objects repoG-2 failed (exit 3)"
-has  "…passing the helper's own stderr through" "$err" "lane-objects: simulated failure"
-hasnt "…and never asserting the lane is pre-cutover" "$err" "pre-cutover"
-hasnt "…while writing no closing line to its row" "$(grep '^| `repoG-2`' "$LANES")" "window closing"
-run "$START" repoG 3 --no-launch
-is   "…so that lane is free to start" "$rc" 0
-
-# A lane recorded on ANOTHER workstation cannot be liveness-checked from here:
-# session records are local files, so the answer is UNKNOWN, never NOT LIVE.
-run env LANES_LANE=repoR-1 "$E" claim "opensoft/repoR#1" --no-github
-run "$E" who "opensoft/repoR#1"
-has  "a holder on another workstation reads UNKNOWN, never NOT LIVE" "$out" "UNKNOWN (records are local to Raven"
-hasnt "…and is never called parked" "$out" "NOT LIVE (parked"
-has  "…telling the reader how to reach it" "$out" "ask @repoR-1 or read its handoff"
-
-# ------------------------------------------------ the parser drops nothing
-
-# An append-only log is never rewritten, so a line no parser can read is a hold
-# no tool will mention again. Line 2 below uses a hyphen where the grammar wants
-# an em dash; line 3 carries a UTC with no seconds, which the register has
-# written since before this helper existed and which must still be READ.
-{ printf '# lane repoBAD-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED - lane repoBAD-1, session %s@Eagle, 2026-09-11T19:15:00Z, opensoft/repoBAD#10\n' "$DEAD_ID"
-  printf 'OPENED — lane repoBAD-1, session %s@Eagle, 2026-09-11T19:15Z, opensoft/repoBAD#11\n' "$DEAD_ID"
-} > "$LOGD/repoBAD-1.md"
-git -C "$WIP" add -- lanes/log/repoBAD-1.md
-git -C "$WIP" commit -q -m "a hand-written log, one line of it unreadable"
-git -C "$WIP" push -q origin main
-
-run "$E" who --lane repoBAD-1
-is   "a log with one unreadable line is still read" "$rc" 0
-has  "…the unreadable line named with its file and line number" "$err" "unreadable: lanes/log/repoBAD-1.md:2"
-has  "…and counted" "$err" "unreadable line(s) above"
-has  "…while a UTC without seconds is READ rather than dropped" "$out" "opensoft/repoBAD#11"
-run "$E" who "opensoft/repoBAD#10"
-is   "…and the object on the unreadable line is NOT reported as free" "$rc" 8
-has  "…it is reported as no record at all, with the unreadable line named" "$err" "unreadable: lanes/log/repoBAD-1.md:2"
-git -C "$WIP" rm -q -- lanes/log/repoBAD-1.md
-git -C "$WIP" commit -q -m "drop the unreadable-line fixture"
-git -C "$WIP" push -q origin main
-
-# ------------------------------- R14: state is read in FILE ORDER, not by UTC
-#
-# A lane's log is append-only and single-writer, so the ORDER OF ITS LINES is
-# the order of that lane's writes. A clock is not. On 2026-09-11 this
-# workstation's realtime clock was jumping ±25s in bursts and a log commit
-# landed whose content carried a UTC 26s AFTER its own committer date; two
-# workstations never share a clock either. So every fixture below writes its
-# NEWEST line with an OLDER UTC than the line above it, and every read must
-# still take the newest LINE. Two of these are the exact shapes that made the
-# suite fail intermittently at 08e8b05: a LANDED invisible behind the LANDING
-# it closed, and a RELEASED still reported as superseded by a TAKEOVER.
-JUMP_LATE="$(utc_at -3H)"
-JUMP_BACK="$(utc_at -3H -26S)"
-JUMP_OLD="$(utc_at -5H)"
-JUMP_OLDER="$(utc_at -5H -26S)"
-{ printf '# lane repoJ-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoJ-1, session %s@Eagle, %s, lane:repoJ-1 → home opensoft/repoJ; estate repoJ\n' "$DEAD_ID" "$JUMP_LATE"
-  # #5 — a RELEASED that closes a CLAIMED, stamped 26s in the claim's past.
-  printf 'CLAIMED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#5\n' "$DEAD_ID" "$JUMP_LATE"
-  printf 'RELEASED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#5 — not ours after all\n' "$DEAD_ID" "$JUMP_BACK"
-  # #6 — the first failure shape: a LANDED behind the LANDING it closes.
-  printf 'LANDING — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#6\n' "$DEAD_ID" "$JUMP_LATE"
-  printf 'LANDED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#6 → abc1234\n' "$DEAD_ID" "$JUMP_BACK"
-  # #7 — two OPEN verbs, so the state is the newest LINE and not the larger UTC.
-  printf 'LANDING — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#7\n' "$DEAD_ID" "$JUMP_LATE"
-  printf 'WITHDRAWN — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#7 — pulled back out of the queue\n' "$DEAD_ID" "$JUMP_BACK"
-  # #8 — the second failure shape: this lane has already closed its own line
-  # after the takeover, and the TAKEOVER in repoJ-2's log carries a stamp 26s
-  # LATER than that RELEASED. "Is their takeover later than our line" then
-  # reported a RELEASED as superseded, and the lane could never end.
-  printf 'CLAIMED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#8\n' "$DEAD_ID" "$JUMP_OLD"
-  printf 'RELEASED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#8 — taken over by repoJ-2\n' "$DEAD_ID" "$JUMP_BACK"
-  # #9 — the same pair the other way round: the TAKEOVER that displaced this
-  # CLAIMED carries an OLDER UTC than the claim it took.
-  printf 'CLAIMED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#9\n' "$DEAD_ID" "$JUMP_LATE"
-  # #10 — Rule 1 staleness: the four hours are a DURATION and stay on the
-  # clock, but "has this lane OPENED a PR since" is an ORDER — and the OPENED
-  # that discharges this claim is below it in the file with an older stamp.
-  printf 'CLAIMED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#10\n' "$DEAD_ID" "$JUMP_OLD"
-  printf 'OPENED — lane repoJ-1, session %s@Eagle, %s, opensoft/repoJ#11 ← opensoft/repoJ#10\n' "$DEAD_ID" "$JUMP_OLDER"
-} > "$LOGD/repoJ-1.md"
-{ printf '# lane repoJ-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoJ-2, session %s@Eagle, %s, lane:repoJ-2 → home opensoft/repoJ; estate repoJ\n' "$DEAD_ID" "$JUMP_LATE"
-  printf 'TAKEOVER — lane repoJ-2, session %s@Eagle, %s, opensoft/repoJ#8 ← lane:repoJ-1\n' "$DEAD_ID" "$JUMP_LATE"
-  printf 'TAKEOVER — lane repoJ-2, session %s@Eagle, %s, opensoft/repoJ#9 ← lane:repoJ-1\n' "$DEAD_ID" "$JUMP_BACK"
-} > "$LOGD/repoJ-2.md"
-git -C "$WIP" add -- lanes/log/repoJ-1.md lanes/log/repoJ-2.md
-git -C "$WIP" commit -q -m "two logs whose newest lines carry older UTCs than the lines above them"
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoJ-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoJ/x.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoJ-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoJ/y.md | ACTIVE |" >/dev/null 2>&1
-is   "the two clock-jump fixture lanes have rows" "$(grep -c '^| `repoJ-[12]`' "$LANES")" 2
-
-run "$E" who "opensoft/repoJ#6"
-is   "who reads a LANDED written 26s 'before' the LANDING it closes" "$rc" 0
-is   "…as the lane's last LINE, the closed state" "$(printf '%s\n' "$out" | grep -cE '^closed   lane repoJ-1 +LANDED ')" 1
-hasnt "…and not as the LANDING the larger UTC would have won" "$out" "HOLDS"
-has  "…leaving the object free" "$out" "state    FREE"
-
-run "$E" who --lane repoJ-1
-is   "who --lane drops an object whose newest line closed it" "$(printf '%s\n' "$out" | grep -c 'opensoft/repoJ#6')" 0
-is   "…and lists the newest of two OPEN lines, not the one stamped later" "$(printf '%s\n' "$out" | grep -cE '^WITHDRAWN opensoft/repoJ#7')" 1
-
-run "$E" who "opensoft/repoJ#7"
-has  "who reports that newest line as the hold" "$out" "WITHDRAWN"
-hasnt "…never the LANDING above it in the file" "$out" "LANDING"
-
-run "$E" lane-objects repoJ-1
-is   "lane-objects — what lane-end and the handoff fragment read — is file-ordered too" "$rc" 0
-has  "…LANDED for the object whose LANDED came last" "$out" "$(printf '\037LANDED\037opensoft/repoJ#6\037')"
-hasnt "…and never the LANDING it closed" "$out" "$(printf '\037LANDING\037opensoft/repoJ#6\037')"
-has  "…WITHDRAWN for the object whose WITHDRAWN came last" "$out" "$(printf '\037WITHDRAWN\037opensoft/repoJ#7\037')"
-
-run "$E" who --landing opensoft/repoJ
-has  "the secondary lane-log listing under who --landing reads the last line too" "$out" "LANDED   opensoft/repoJ#6"
-hasnt "…so a landed PR is not re-reported as an open merge hold" "$out" "LANDING  opensoft/repoJ#6"
-
-run "$E" who "opensoft/repoJ#8"
-is   "a lane's own RELEASED closes its line whatever a peer's TAKEOVER is stamped" "$rc" 0
-is   "…reported as closed" "$(printf '%s\n' "$out" | grep -cE '^closed   lane repoJ-1 +RELEASED ')" 1
-hasnt "…never 'superseded', which a TAKEOVER with a later stamp used to print over it" "$out" "super.   lane repoJ-1"
-has  "…while the lane that took it over holds it" "$out" "HOLDS    lane repoJ-2"
-
-run "$E" who "opensoft/repoJ#9"
-has  "a TAKEOVER supersedes the CLAIMED it displaced even when stamped EARLIER" "$out" "superseded by TAKEOVER (lane:repoJ-2)"
-is   "…so exactly one lane holds the object" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-has  "…the taker" "$out" "HOLDS    lane repoJ-2"
-
-run "$E" who "opensoft/repoJ#10"
-has  "a five-hour-old claim discharged by an OPENED BELOW it is not stale" "$out" "stale    no"
-hasnt "…though that OPENED carries the older UTC" "$out" "stale    YES"
-run env LANES_LANE=repoJ-2 "$E" claim "opensoft/repoJ#10" --force --no-github
-is   "…so --force is refused on it" "$rc" 2
-has  "…in Rule 1's own words" "$err" "has since OPENED a PR naming it"
-hasnt "…and no TAKEOVER is written" "$(cat "$LOGD/repoJ-2.md")" "opensoft/repoJ#10"
-
-run "$END" repoJ-1
-is   "lane-end refuses on the objects whose NEWEST line is open" "$rc" 2
-has  "…naming the WITHDRAWN and not the LANDING above it" "$err" "WITHDRAWN opensoft/repoJ#7"
-hasnt "…and never an object whose newest line is a LANDED" "$err" "opensoft/repoJ#6"
-has  "…while the claim taken over by an earlier-stamped TAKEOVER names its own way out" "$err" "taken over by lane:repoJ-2 at"
-
-run "$END" repoJ-1 --force
-is   "…and --force ends it" "$rc" 0
-has  "the handoff fragment lists the LANDED under Done" "$out" "- LANDED — opensoft/repoJ#6 → abc1234"
-hasnt "…and not the LANDING it closed" "$out" "- LANDING — opensoft/repoJ#6"
-has  "…the RELEASED whose UTC is older than the CLAIMED it closes" "$out" "- RELEASED — opensoft/repoJ#5"
-has  "…and the WITHDRAWN under Open" "$out" "- WITHDRAWN — opensoft/repoJ#7"
-hasnt "…never the LANDING above it" "$out" "- LANDING — opensoft/repoJ#7"
-
-# ---------------------------------------------------------------- lane-end
-
-run "$END" repoE-1
-is   "lane-end refuses while the lane's own log still shows an open object" "$rc" 2
-has  "…reading it from the log, exactly, not from the state cell" "$err" "in-flight read from lanes/log/repoE-1.md (exact)"
-has  "…and naming the object" "$err" "CLAIMED opensoft/repoE#7"
-has  "…and the OpenSpec change it also holds" "$err" "CLAIMED opensoft/repoE:openspec/changes/add-thing"
-hasnt "…while a LANDED object is not listed as open" "$err" "LANDING opensoft/repoE#21"
-
-run "$END" repoE-1 --force
-is   "--force ends it anyway" "$rc" 0
-has  "…and the lane's log says it was forced, in the grammar's own shape" "$(cat "$LOGD/repoE-1.md")" "lane:repoE-1 — forced; open: "
-has  "…as an ENDED line whose object is the lane" "$(grep '^ENDED' "$LOGD/repoE-1.md")" ", lane:repoE-1"
-has  "…and the handoff fragment is on STDOUT" "$out" "## Done"
-has  "…whose header names the CLOSED set it partitioned by" "$out" "## Done (RELEASED, CLAIM-LOST, CLOSED, LANDED)"
-has  "…and the OPEN one" "$out" "## Open (CLAIMED, TAKEOVER, OPENED, LANDING, WITHDRAWN)"
-has  "…listing what landed" "$out" "- LANDED — opensoft/repoE#21 → abc1234"
-has  "…and what is still open" "$out" "## Open"
-has  "…naming each open object" "$out" "- CLAIMED — opensoft/repoE#7"
-
-run "$END" repoQ-1 --retire
-is   "--retire is refused too while the lane still holds something" "$rc" 2
-run "$END" repoQ-1 --retire --force
-is   "…and writes a RETIRED line instead of an ENDED one once forced" "$rc" 0
-has  "…in the lane's log" "$(cat "$LOGD/repoQ-1.md")" "RETIRED — lane repoQ-1, session "
-
-run "$END" repoP-2
-is   "a lane with NO log file still ends, on the state cell's substring scan" "$rc" 0
-has  "…and its fragment says why it has no objects to list" "$out" "no object log for repoP-2 (pre-cutover lane)"
-run "$END" repoP-1
-is   "…and that fallback still refuses an open LANDING" "$rc" 2
-has  "…saying it is the pre-cutover scan" "$err" "has no object log yet (pre-cutover)"
-
-
-section "== Addendum 5: R17–R23 =="
-
-# ------------------- R17: a LANDED closes the LANDING it answers, by (lane, PR)
-#
-# 284 of the live register's 308 LANDED lines carry no `into <repo> main` clause
-# at all. Keyed on the repository they NAME, those 284 key on the empty string
-# and can never close the repository-qualified LANDING they belong to: measured
-# over the real register, `who --landing` reported 232 phantom merge holds where
-# the genuinely open count was ONE. So the PAIRING is by (lane, PR) in file
-# order — a LANDED closes the most recent still-unmatched LANDING of that lane
-# and PR — while the RESULT still keys on (lane, repository, PR), which is what
-# keeps a LANDED on one repository from closing a LANDING on another.
-{ printf 'LANDING — lane repoT-1, session %s@Eagle, 2026-09-11T02:00:00Z, PR #31 into opensoft/repoT main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoT-1, session %s@Eagle, 2026-09-11T02:05:00Z, PR #31 → 1111111\n' "$DEAD_ID"
-  printf 'LANDING — lane repoT-1, session %s@Eagle, 2026-09-11T02:10:00Z, PR #32 into opensoft/repoT main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoT-1, session %s@Eagle, 2026-09-11T02:15:00Z, PR #32 into opensoft/repoOTHER main → 2222222\n' "$DEAD_ID"
-  printf 'LANDING — lane repoT-2, session %s@Eagle, 2026-09-11T03:00:00Z, PR #40 into opensoft/repoT-A main\n' "$DEAD_ID"
-  printf 'LANDING — lane repoT-2, session %s@Eagle, 2026-09-11T03:05:00Z, PR #40 into opensoft/repoT-B main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoT-2, session %s@Eagle, 2026-09-11T03:10:00Z, PR #40 → 3333333\n' "$DEAD_ID"
-} >> "$LANES"
-git -C "$WIP" add -- lanes/LANES.md
-git -C "$WIP" commit -q -m "Rule 6 lines in the shapes the live register really uses"
-git -C "$WIP" push -q origin main
-
-run "$E" who --landing opensoft/repoT
-is    "who --landing over the register's own shapes exits 0" "$rc" 0
-hasnt "a LANDED with NO 'into <repo> main' still closes its own LANDING" "$out" "LANDING  opensoft/repoT#31"
-has   "…while a LANDED naming a DIFFERENT repository closes nothing" "$out" "LANDING  opensoft/repoT#32"
-run "$E" who --landing opensoft/repoOTHER
-is    "…and that unpaired LANDED opens no hold of its own" "$rc" 0
-has   "…it is reported against the repository it names, never dropped" "$out" "unpaired LANDED  opensoft/repoOTHER#32"
-has   "…saying where the LANDING it would have closed actually is" "$out" "is on opensoft/repoT"
-
-run "$E" who --landing opensoft/repoT-B
-has   "a repo-less LANDED pairs with the MOST RECENT unmatched LANDING, in file order" "$out" "none open"
-run "$E" who --landing opensoft/repoT-A
-has   "…leaving the earlier one on another repository still open" "$out" "LANDING  opensoft/repoT-A#40  lane repoT-2"
-
-# ------------------ R18: a TAKEOVER supersedes only while it is its lane's last
-#
-# The whole sequence through the HELPERS, with no hand-written line. A TAKEOVER
-# is never removed from an append-only log, so matching one anywhere in the
-# taker's file kept superseding the dispossessed lane's claims for ever: after
-# the taker released the object and that lane legitimately re-claimed it, `who`
-# called a held object FREE and `claim` did not refuse the next lane — the one
-# outcome Rule 1 exists to prevent.
-for l in repoU-1 repoU-2 repoU-3; do
-  "$E" add-row "| \`$l\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoU/$l.md | ACTIVE |" >/dev/null 2>&1
-done
-run env LANES_LANE=repoU-1 "$E" claim "opensoft/repoU#40" --no-github
-is   "repoU-1 claims the object" "$rc" 0
-# R35 — THE MARGIN IS AN HOUR, AND THERE IS NO `sleep`. `STALE_HOURS` is only
-# ever used as `$((STALE_HOURS * 3600))`, so `-1` asks `now - claimed > -3600`:
-# the takeover path is taken exactly as before, a real `TAKEOVER` line is still
-# written, and a claim stamped up to an hour in the FUTURE is still stale.
-# `sleep 1` + `LANES_STALE_HOURS=0` asked `now - claimed > 0` with both sides
-# from `date -u`, and this workstation's realtime clock jumps ±25s in bursts
-# (R14's note above) — one backwards burst between the claim and the check took
-# this assertion and the ten that read the result of it out at once. The one cosmetic cost is the free text reading `no PR after -1h`, in a
-# sandbox. The suite gets the second back.
-run env LANES_LANE=repoU-2 LANES_STALE_HOURS=-1 "$E" claim "opensoft/repoU#40" --no-github --force
-is   "repoU-2 takes the now-stale claim over" "$rc" 0
-run "$E" who "opensoft/repoU#40"
-has  "…so the taker holds it while its TAKEOVER is its own last line" "$out" "HOLDS    lane repoU-2"
-has  "…and the dispossessed CLAIMED reads as superseded" "$out" "superseded by TAKEOVER (lane:repoU-2)"
-run "$E" who --lane repoU-1
-has   "who --lane reads all FIVE of lane-objects' fields" "$out" "CLAIMED   opensoft/repoU#40"
-has   "…so the superseded cell is reported as what it is" "$out" "(taken over by lane:repoU-2 at"
-hasnt "…never printed bare, where a payload goes" "$out" "ago) repoU-2@"
-
-run env LANES_LANE=repoU-2 "$E" release "opensoft/repoU#40" "finished with it" --no-github
-is   "the taker releases it" "$rc" 0
-run env LANES_LANE=repoU-1 "$E" release "opensoft/repoU#40" "taken over by repoU-2" --no-github
-is   "the dispossessed lane closes its own line" "$rc" 0
-run env LANES_LANE=repoU-1 "$E" claim "opensoft/repoU#40" --no-github
-is   "…and re-claims the object, which is now free" "$rc" 0
-run "$E" who "opensoft/repoU#40"
-has   "a TAKEOVER that is no longer its lane's last line supersedes nothing" "$out" "HOLDS    lane repoU-1"
-hasnt "…so the clean re-claim is not reported as superseded" "$out" "super.   lane repoU-1"
-has   "…and the object is HELD, not FREE" "$out" "state    HELD"
-is    "…by exactly one lane" "$(printf '%s\n' "$out" | grep -c '^HOLDS')" 1
-run env LANES_LANE=repoU-3 "$E" claim "opensoft/repoU#40" --no-github
-is   "…so a third lane is REFUSED, which is the whole of Rule 1" "$rc" 2
-has  "…naming the lane that holds it" "$err" "lane repoU-1 holds opensoft/repoU#40"
-
-# ------------------------- R19: the ROW is read from origin/main, like the logs
-#
-# `who`'s register-derived half — the session cell, the handoff path, the
-# workstation column — was the last thing reading the working tree, and
-# print_holder_detail is built entirely out of it. A row that existed only on
-# `origin/main` lost the resume uuid and the handoff path, which are the two
-# things `who` exists to hand over; and a peer's UNCOMMITTED edit to column 3
-# turned a Raven lane into `NOT LIVE`, which is the confident false report that
-# sends a reader to `claim --force` against a live lane.
-V_ID="aaaa0005-1111-4000-8000-aaaa00051111"
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-printf '| `repoV-1` | harness `%s` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoV/session-handoff-2026-09-11-lane-repoV-1.md | ACTIVE |\n' "$V_ID" >> "$CLONE2/lanes/LANES.md"
-printf '# lane repoV-1 — object log (lane-collision-protocol Amendment 7)\nCLAIMED — lane repoV-1, session %s@Raven, %s, opensoft/repoV#1\n' \
-  "$V_ID" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" > "$CLONE2/lanes/log/repoV-1.md"
-git -C "$CLONE2" add -- lanes/LANES.md lanes/log/repoV-1.md
-git -C "$CLONE2" commit -q -m "LANES(repoV-1@Raven): the peer's row and its claim"
-git -C "$CLONE2" push -q origin main
-
-is   "the peer's ROW is on origin/main and NOT in this checkout's working tree" "$(grep -c '^| `repoV-1`' "$LANES" || :)" 0
-run "$E" who "opensoft/repoV#1"
-has  "who reads the row from origin/main, so the resume uuid is the one that landed" "$out" "address  @repoV-1 · claude --resume $V_ID"
-has  "…and so is the handoff path" "$out" "handoff  handoffs/repoV/session-handoff-2026-09-11-lane-repoV-1.md"
-has  "…and the workstation column, so a Raven lane reads UNKNOWN" "$out" "UNKNOWN (records are local to Raven"
-
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null
-# A peer's UNCOMMITTED edit, made the way the register's own writer makes one
-# (`cat tmp > file` follows the symlink; `sed -i` would replace it — AGENTS.md
-# rule 2).
-awk '{ if ($0 ~ /^\| `repoV-1`/) { sub(/\| Raven \//, "| Eagle /") } print }' "$LANES" > "$SANDBOX/lanes.tmp"
-cat -- "$SANDBOX/lanes.tmp" > "$LANES"
-is   "a peer leaves that row edited and uncommitted" "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c .)" 1
-run "$E" who "opensoft/repoV#1"
-has   "…and who's answer does not change: nothing in it reads the working tree" "$out" "UNKNOWN (records are local to Raven"
-hasnt "…never turning a lane on the other workstation into NOT LIVE" "$out" "NOT LIVE (parked"
-git -C "$WIP" checkout -q -- lanes/LANES.md
-
-# ---------------------------------------------- R20: a lane's HOME is canonical
-#
-# `lanes/repos.tsv` maps `opensoft/codexFactory` to `codeXfactory/codexFactory`
-# — the move the table exists for. A checkout whose origin still spells the old
-# org recorded that spelling in STARTED, and every `#n` that lane wrote then
-# keyed against a repository nothing could reconcile: two lanes held one GitHub
-# issue under two keys and no collision was detected.
-mkdir -p "$HOME/projects/legacyorg"
-git init -q -b main "$HOME/projects/legacyorg"
-git -C "$HOME/projects/legacyorg" remote add origin git@github.com:opensoft/codexFactory.git
-run "$START" --dir "$HOME/projects/legacyorg" --estate cx repoW-1 --no-launch
-is   "lane-start on a checkout spelling the pre-move org exits 0" "$rc" 0
-has  "…resolving the home through repos.tsv BEFORE the STARTED line is written" "$err" "resolves through lanes/repos.tsv to codeXfactory/codexFactory"
-has  "…so the STARTED line records the canonical spelling" "$(cat "$LOGD/repoW-1.md")" "lane:repoW-1 → home codeXfactory/codexFactory"
-run env LANES_LANE=repoW-1 "$E" claim "#5" --no-github
-is   "…and '#5' expands against it" "$rc" 0
-has  "…to the canonical key" "$(cat "$LOGD/repoW-1.md")" ", codeXfactory/codexFactory#5"
-run env LANES_LANE=repoW-2 "$E" claim "codeXfactory/codexFactory#5" --no-github
-is   "…so the other spelling of the SAME issue is refused, not given a second key" "$rc" 2
-has  "…naming the lane that holds it" "$err" "lane repoW-1 holds codeXfactory/codexFactory#5"
-
-# …and a STARTED line written BEFORE this fix is resolved when it is READ.
-{ printf '# lane repoW-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoW-3, session %s@Eagle, %s, lane:repoW-3 → home opensoft/codexFactory; estate cx\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoW-3.md"
-git -C "$WIP" add -- lanes/log/repoW-3.md
-git -C "$WIP" commit -q -m "a STARTED line carrying the pre-move spelling"
-git -C "$WIP" push -q origin main
-# `LANES_SESSION` because repoW-3 has a LOG and no register ROW, so nothing else
-# can answer what its transcript uuid is — and under R-A11 (e) a write with no
-# uuid is refused rather than stamped `unknown`. Before that rule this scenario
-# passed while appending `session unknown@Eagle` to an append-only log, which is
-# the defect, uncaught, inside the suite that was meant to catch it.
-run env LANES_LANE=repoW-3 LANES_SESSION="$DEAD_ID" "$E" claim "#6" --no-github
-is   "a legacy home already on record is resolved when it is read" "$rc" 0
-has  "…so its shorthand keys canonically too" "$(cat "$LOGD/repoW-3.md")" ", codeXfactory/codexFactory#6"
-hasnt "…and the line it wrote carries a real uuid, never \`unknown\`" "$(cat "$LOGD/repoW-3.md")" "session unknown@"
-
-# ------------------------- R21: lane-end's recovery text and its --force line
-"$E" add-row "| \`repoX-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoX/x.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoX-1 "$E" claim "opensoft/repoX#11" --no-github
-run env LANES_LANE=repoX-1 "$E" log LANDING "opensoft/repoX#12" --no-github
-run "$END" repoX-1
-is    "lane-end refuses while its log still shows open objects" "$rc" 2
-has   "…printing the LANDED recovery in the helper's real CLI grammar" "$err" "lanes-edit.sh log LANDED <object> → <merge sha>"
-has   "…release as the subcommand it is" "$err" "lanes-edit.sh release <object> \"<why>\""
-has   "…and CLOSED for a PR that never merged" "$err" "lanes-edit.sh log CLOSED <object>"
-hasnt "…never MERGED, which is not a verb at all" "$err" "MERGED"
-hasnt "…and never 'log RELEASED', which log refuses outright" "$err" "log RELEASED"
-
-before_lanes="$(grep -c . "$LANES")"
-run env LANES_LANE=repoX-1 "$E" log LANDED "opensoft/repoX#12" "→" "abc9999"
-is   "…and the LANDED form it prints is the one that actually works" "$rc" 0
-has  "…carrying the merge sha as PAYLOAD in the lane's log" "$(cat "$LOGD/repoX-1.md")" ", opensoft/repoX#12 → abc9999"
-has  "…and in the register's Rule 6 line, which the quoted form silently dropped" "$(tail -n1 "$LANES")" "PR #12 into opensoft/repoX main → abc9999"
-
-run "$END" repoX-1 --force
-is   "--force ends it" "$rc" 0
-LX_LINE="$(grep '^ENDED' "$LOGD/repoX-1.md")"
-has   "…writing an ENDED whose free text is 'forced; open: <object list>'" "$LX_LINE" ", lane:repoX-1 — forced; open: "
-has   "…naming the object that was open" "$LX_LINE" "opensoft/repoX#11"
-is    "…with ' — ' occurring exactly twice, which is the clause (b) guarantee" "$(printf '%s' "$LX_LINE" | grep -o ' — ' | grep -c .)" 2
-hasnt "…and never an empty verb where a verb belongs" "$LX_LINE" "while  was"
-# AMENDMENT 13(a) — THE COUNT AND THE PATH, NOT THE LIST. The line is one line
-# and capped at 240 characters (ratified decision O1); a lane forced closed over
-# eleven open objects named them in 300. The objects are in the ENDED line of
-# the lane's own log, which is where this line now points.
-has   "…while the register's line names the log it read, not the state cell" "$(grep '^| `repoX-1`' "$LANES")" "own object log still showed"
-has   "…and names the log the objects are in, since the line itself is capped" "$(grep '^| `repoX-1`' "$LANES")" "they are in lanes/log/repoX-1.md"
-
-# The writer ENFORCES the grammar rather than hoping for it.
-run env LANES_LANE=repoX-1 "$E" release "opensoft/repoX#11" "one — two" --no-github
-is    "the writer REFUSES free text carrying ' — '" "$rc" 2
-has   "…saying why" "$err" "may not contain ' — '"
-hasnt "…and writes nothing" "$(cat "$LOGD/repoX-1.md")" "one — two"
-run env LANES_LANE=repoX-1 "$E" release "opensoft/repoX#11" "$(printf 'one\ntwo')" --no-github
-is    "…and free text carrying a newline, before it is appended rather than after" "$rc" 2
-hasnt "…so no half-written line is left in an append-only log" "$(cat "$LOGD/repoX-1.md")" "two"
-
-# ------------------------------- R22: live-holder fails closed AT THE SOURCE
-#
-# 8 means "the records were read and nothing live holds this lane"; lane-start
-# renames a window on 8. Mapping a failed READ to 8 as well is exactly how a
-# running lane loses its address: the rename mints `<lane> (2)` (AGENTS.md
-# rule 7). Hardening the caller left the source with no way to say "I could not".
-# The tree itself, not a path THROUGH it: with the tree at 000 a `$dir/..`
-# spelling cannot be resolved, and even the chmod that restores it fails.
-profiles_root="$HOME/.claude-profiles/profiles"
-chmod 000 "$profiles_root"
-run "$E" live-holder repoF-1
-is   "an unreadable records tree exits 1, never the 8 that means 'nothing holds it'" "$rc" 1
-has  "…and says what it could not read" "$err" "could not read this workstation's session records"
-has  "…in the words that stop a reader believing the lane is free" "$err" "That is NOT 'no live session holds it'"
-before_renames="$(grep -c 'rename-window repoF-1' "$FAKE_TMUX_LOG" || :)"
-run "$START" repoF 1 --no-launch
-is   "…so lane-start REFUSES rather than taking a name that may be held" "$rc" 1
-is   "…and renames no window" "$(grep -c 'rename-window repoF-1' "$FAKE_TMUX_LOG" || :)" "$before_renames"
-# CLAIM --FORCE'S OWN LIVENESS READ FAILS CLOSED THE SAME WAY (Copilot's own
-# "closer look" on c82577e, PR #61): repoK-5's CLAIMED hold on
-# opensoft/repoK#99 is still untaken from the issue #30 section above, and
-# with the records tree still at 000 here, `holder_is_dead` cannot tell
-# repoK-5's terminal log apart from a live one — exactly the gap between
-# "confirmed live" (`HOLDER_LIVE_TERMINAL` alone) and "the read itself
-# failed" that fell through to the ordinary stale-claim test before this.
-run env LANES_LANE=repoK-6 "$E" claim "opensoft/repoK#99" --no-github --force
-is    "--force refuses a terminal-logged holder when liveness could not be read at all" "$rc" 2
-has   "…naming what its own log says" "$err" "lane repoK-5's own log ends RETIRED"
-has   "…and that this workstation could not read whether a live session backs it up" "$err" "could not read whether a live session still backs it up"
-has   "…in the words that stop a reader believing it is an ordinary stale claim" "$err" "That is NOT 'no live session holds it'"
-hasnt "…never reaching the ordinary stale-claim wording" "$err" "old (threshold"
-hasnt "…and nothing is written" "$(cat "$LOGD/repoK-6.md" 2>/dev/null)" "opensoft/repoK#99"
-chmod 755 "$profiles_root"
-run "$E" live-holder repoF-1
-is   "…while a readable tree still finds the live holder" "$rc" 0
-has  "…and it is the right session" "$out" "$F_ID"
-
-# --------------------------------------------- R23: the small alignments
-"$E" add-row "| \`repoY-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoY/x.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoY-1 "$E" claim "#1" --home opensoft/repoY --no-github
-is   "--home is accepted by claim" "$rc" 0
-run env LANES_LANE=repoY-1 "$E" log OPENED "#2" --home opensoft/repoY
-is   "…by log" "$rc" 0
-run env LANES_LANE=repoY-1 "$E" release "#1" "done" --home opensoft/repoY --no-github
-is   "…by release, which both documents now say too" "$rc" 0
-run "$E" who "#1" --home opensoft/repoY
-is   "…by who" "$rc" 0
-run "$END" repoY-1 --home opensoft/repoY --force
-is   "…and by lane-end: five subcommands, and the docs list five" "$rc" 0
-
-run env LANES_LANE=repoY-1 "$E" claim "opensoft/repoY#9" --nope
-is    "an unknown option is refused" "$rc" 2
-has   "…naming it" "$err" "unknown option '--nope' for claim"
-hasnt "…and the refusal no longer ends with its own exit code" "$err" "for claim 2"
-run env LANES_DEBUG=1 LANES_LANE=repoY-1 "$E" claim "opensoft/repoY#9" --nope
-has   "…which LANES_DEBUG still prints, for whoever is debugging the codes" "$err" "(exit 2)"
-
-run "$E" who "opensoft/repoG#11"
-has   "a claim past the threshold says WHICH of Rule 1's discharges left it not stale" "$out" "has since written an OPENED naming it"
-hasnt "…rather than two true halves that read as a contradiction" "$out" "old, threshold ${STALE_H}h"
-
-section "== Addendum 6: R24–R26, and the lifecycle reads =="
-
-# ------- R24: a LANDED that NAMES a repository prefers a LANDING on that one
-#
-# Two LANDINGs open on ONE PR number in two repositories, and the lane lands the
-# EARLIER one, naming its repository. R17's literal rule paired by (lane, PR)
-# alone, took the most recent unmatched LANDING — the one on the OTHER
-# repository — and reported the LANDED as `unpaired`: both holds stayed open
-# until the second landed. It over-reported a merge hold, which is the direction
-# that stalls other lanes' merges.
-{ printf 'LANDING — lane repoZ-1, session %s@Eagle, 2026-09-11T04:00:00Z, PR #50 into opensoft/repoZ-A main\n' "$DEAD_ID"
-  printf 'LANDING — lane repoZ-1, session %s@Eagle, 2026-09-11T04:05:00Z, PR #50 into opensoft/repoZ-B main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZ-1, session %s@Eagle, 2026-09-11T04:10:00Z, PR #50 into opensoft/repoZ-A main → 4444444\n' "$DEAD_ID"
-} >> "$LANES"
-git -C "$WIP" add -- lanes/LANES.md
-git -C "$WIP" commit -q -m "two LANDINGs on one PR number, and the EARLIER one lands"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-run   "$E" who --landing opensoft/repoZ-A
-is    "a LANDED naming a repository closes the LANDING on THAT repository" "$rc" 0
-has   "…so the hold it answers is closed" "$out" "none open"
-hasnt "…and it is not reported as unpaired any more" "$out" "unpaired LANDED"
-run   "$E" who --landing opensoft/repoZ-B
-has   "…while the other repository's LANDING on the same PR number stays open" "$out" "LANDING  opensoft/repoZ-B#50  lane repoZ-1"
-
-# The rest of R17 is unchanged, and the two cases that prove it are the ones
-# above in the R17 block: a repo-less LANDED still takes the most recent
-# unmatched LANDING, and a LANDED naming a repository with NO LANDING of its own
-# is still reported as unpaired rather than dropped.
-
-# ------------------- R26: free text may not begin with an arrow (finding 5)
-#
-# `→` and `←` introduce the PAYLOAD, and the payload is its own argument.
-# Quoted into the free-text slot it lands after the ` — `, where the parser
-# reads it as prose: the LANDED carries no payload and the register's Rule 6
-# line loses the merge sha, in two files nothing ever rewrites.
-"$E" add-row "| \`repoZA-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZA/x.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoZA-1 "$E" log LANDING "opensoft/repoZA#13" --no-github
-is    "a LANDING is written" "$rc" 0
-run env LANES_LANE=repoZA-1 "$E" log LANDED "opensoft/repoZA#13" "→ dead999" --no-github
-is    "free text that BEGINS with '→' is refused" "$rc" 2
-has   "…printing the positional form" "$err" "log LANDED <object> → <sha>"
-has   "…and the form this very call should have taken" "$err" "log LANDED opensoft/repoZA#13 → <payload>"
-hasnt "…writing nothing to the lane's log" "$(cat "$LOGD/repoZA-1.md")" "dead999"
-hasnt "…and nothing to the register" "$(cat "$LANES")" "dead999"
-run env LANES_LANE=repoZA-1 "$E" log OPENED "opensoft/repoZA#14" "← opensoft/repoZA#2" --no-github
-is    "…and so is free text that begins with '←'" "$rc" 2
-hasnt "…with nothing written for that one either" "$(cat "$LOGD/repoZA-1.md")" "opensoft/repoZA#14"
-run env LANES_LANE=repoZA-1 "$E" log LANDED "opensoft/repoZA#13" "→" "dead999" --no-github
-is    "…while the positional form it prints is the one that works" "$rc" 0
-has   "…carrying the merge sha as a payload" "$(cat "$LOGD/repoZA-1.md")" ", opensoft/repoZA#13 → dead999"
-
-# -------- the lifecycle reads: a row is read from origin/main, like the logs
-#
-# Copilot's two leads on `2590b53`, and the three suppressed ones on lane-start.
-# All of them are the same fault in five places: a boundary act deciding
-# something from `$LANES_FILE`, which is the WORKING TREE — and a `git fetch`
-# does not move a working tree.
-
-# live-holder: the id set is the published row's, and a read fetches first.
-ZL_ID="aaaa0006-2222-4000-8000-aaaa00062222"
-write_record_ns "$sessions_dir/live-zl.json" "$ZL_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "repozl-99" "derived" "busy"
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-( LANES_WORKSPACE_ROOT="$CLONE2" LANES_LANE=repoZL-1 "$E" add-row \
-    "| \`repoZL-1\` | harness \`$ZL_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZL/x.md | ACTIVE |" ) >/dev/null 2>&1
-is    "the peer's row is on origin/main and not in this checkout" "$(grep -c '^| `repoZL-1`' "$LANES" || :)" 0
-run env LANES_NO_FETCH=1 "$E" live-holder repoZL-1
-is    "without the fetch, a session id only origin/main carries is invisible" "$rc" 8
-run   "$E" live-holder repoZL-1
-is    "…and live-holder fetches first, like every other read, so it is found" "$rc" 0
-has   "…and it is the right session" "$out" "$ZL_ID"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-
-# lane-start: the liveness check is asked UNCONDITIONALLY, not only when this
-# checkout's row already names an id.
-ZS_ID="aaaa0007-3333-4000-8000-aaaa00073333"
-write_record_ns "$sessions_dir/live-zs.json" "$ZS_ID" "$LIVE_PID" "$live_start" "othersess:@9.%9" "repozs-99" "derived" "busy"
-"$E" add-row "| \`repoZS-1\` | pending — set by the session's first act | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZS/x.md | ACTIVE |" >/dev/null 2>&1
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-( LANES_WORKSPACE_ROOT="$CLONE2" LANES_LANE=repoZS-1 "$E" replace-in-row repoZS-1 \
-    "pending — set by the session's first act" "harness \`$ZS_ID\`" "the session stamps its own row" ) >/dev/null 2>&1
-is    "this checkout's row still records no session id" "$(grep '^| `repoZS-1`' "$LANES" | grep -c 'pending' || :)" 1
-zs_before="$(grep -c 'rename-window repoZS-1' "$FAKE_TMUX_LOG" || :)"
-run   "$START" --dir "$HOME/projects/repoA" repoZS-1 --no-launch
-is    "lane-start refuses a lane whose LIVE session id only the published row carries" "$rc" 2
-has   "…naming the session that holds it" "$err" "is live in session $ZS_ID"
-is    "…and renames no window, which is what mints '<lane> (2)'" "$(grep -c 'rename-window repoZS-1' "$FAKE_TMUX_LOG" || :)" "$zs_before"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-
-# lane-start: "this lane is new" is decided against what has LANDED, so a
-# second row is refused rather than written.
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-( LANES_WORKSPACE_ROOT="$CLONE2" LANES_LANE=repoZD-1 "$E" add-row \
-    "| \`repoZD-1\` | harness \`$DEAD_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZD/x.md | ACTIVE |" ) >/dev/null 2>&1
-is    "the peer's row for repoZD-1 is on origin/main and not here" "$(grep -c '^| `repoZD-1`' "$LANES" || :)" 0
-zd_before="$(grep -c 'rename-window repoZD-1' "$FAKE_TMUX_LOG" || :)"
-run   "$START" --dir "$HOME/projects/repoA" repoZD-1 --no-launch
-is    "lane-start refuses to add a row origin/main already has" "$rc" 2
-has   "…saying which register it read" "$err" "ALREADY has a row for repoZD-1"
-is    "…and adds no second row, which no helper could then edit" "$(grep -c '^| `repoZD-1`' "$LANES" || :)" 0
-is    "…and renames no window" "$(grep -c 'rename-window repoZD-1' "$FAKE_TMUX_LOG" || :)" "$zd_before"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-
-# lane-start: a new session is never attributed to the session that ended.
-"$E" add-row "| \`repoZN-1\` | harness \`$GHOST2_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZN/x.md | ACTIVE |" >/dev/null 2>&1
-run env LANE_START_SESSION_ID=0 "$START" --dir "$HOME/projects/repoA" repoZN-1 --no-launch
-is    "with nothing minted, a new session still starts" "$(launch_of "$out")" "claude --name repoZN-1"
-# R-A8-2 — AND IT WRITES NO OBJECT-LOG LINE AT ALL. Amendment 7(b) makes the
-# `session` field a transcript uuid and only that; `unknown` is not one, and the
-# log is append-only, so the grammar's own writer does not write a line it
-# cannot fill in. THE RULE IS THE CONDITION, NOT THE PATH: this is the
-# new-session sub-case (nothing minted), and the title fallback below is the
-# other. Both defer, and the same act writes both deferred records.
-is    "…and no object-log line is written for it at all" "$([ -f "$LOGD/repoZN-1.md" ] && printf present || printf absent)" absent
-has   "…the run saying which act will write it, its arguments filled in" "$err" "--no-launch repoZN 1"
-has   "…and why it did not write one" "$err" "no transcript uuid is knowable at this instant"
-has   "…the row's stamp still carrying the placeholder, where a reader can see it" "$(grep '^| `repoZN-1`' "$LANES")" "STARTED by unknown (lane repoZN-1)"
-hasnt "…never the uuid of the session that has ended" "$(grep '^| `repoZN-1`' "$LANES")" "$GHOST2_ID (lane"
-
-# lane-start: the title fallback cannot know which transcript the picker will
-# choose, so its RESUMED says so instead of naming the row's last id.
-printf '{"type":"custom-title","customTitle":"repoZT-1","sessionId":"titled-zt"}\n' > "$tdir/titled-zt.jsonl"
-"$E" add-row "| \`repoZT-1\` | harness \`$GHOST_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZT/x.md | ACTIVE |" >/dev/null 2>&1
-run   "$START" --dir "$HOME/projects/repoA" repoZT-1 --no-launch
-is    "the title fallback resumes by title" "$out" "claude --name repoZT-1 --resume repoZT-1"
-is    "…and writes NO object-log line, because \`unknown\` is not a transcript uuid (R-A8-2)" "$([ -f "$LOGD/repoZT-1.md" ] && printf present || printf absent)" absent
-has   "…nor Rule 3's handoff stamp, which is the other deferred record" "$err" "Nor is the handoff's Rule 3 stamp"
-has   "…naming the one act that writes both, at the first instant either can be right" "$err" "--no-launch repoZT 1"
-has   "…while the ROW's stamp does carry the placeholder — the one place it is written on purpose" "$(grep '^| `repoZT-1`' "$LANES")" "RESUMED by unknown (lane repoZT-1)"
-hasnt "…never the row's last id, whose transcript this directory does not have" "$(grep '^| `repoZT-1`' "$LANES")" "RESUMED by $GHOST_ID"
-
-# lane-end: --home is checked BEFORE the row is closed.
-"$E" add-row "| \`repoZH-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZH/x.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoZH-1 "$E" log STARTED "lane:repoZH-1" "→" "home opensoft/repoZH; estate repoZH"
-is    "the lane's log records its home" "$rc" 0
-zh_row="$(grep '^| `repoZH-1`' "$LANES")"
-run   "$END" repoZH-1 --home opensoft/somewhere-else
-is    "lane-end refuses --home for a lane whose log already records a home" "$rc" 2
-has   "…with the writer's own reason, not a second copy of the rule" "$err" "--home is for a pre-cutover lane"
-has   "…saying the row is untouched" "$err" "Nothing has been written"
-is    "…and the row really is untouched, not closed and then complained about" "$(grep '^| `repoZH-1`' "$LANES")" "$zh_row"
-hasnt "…so no ENDED line is missing from a closed lane" "$(cat "$LOGD/repoZH-1.md")" "ENDED"
-
-# lane-end: the pre-cutover fallback reads the PUBLISHED row too. This is the
-# one path that still decides a merge hold from prose, and it was reading a
-# working tree that a fetch does not move.
-"$E" add-row "| \`repoZZ-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZZ/x.md | IDLE, NOTHING CLAIMED |" >/dev/null 2>&1
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-( LANES_WORKSPACE_ROOT="$CLONE2" LANES_LANE=repoZZ-1 "$E" set-row-state repoZZ-1 \
-    "LANDING #8 · into repoZZ main, posted by the peer" ) >/dev/null 2>&1
-is    "the peer's LANDING is on origin/main and not in this checkout's row" "$(grep '^| `repoZZ-1`' "$LANES" | grep -c 'LANDING #8' || :)" 0
-run   "$END" repoZZ-1
-is    "lane-end refuses a merge hold that only the PUBLISHED row shows" "$rc" 2
-has   "…naming the row it read it from" "$err" "the published row on origin/main"
-has   "…and it is Rule 6's word that stopped it" "$err" "the last LANDING in its state cell"
-
-section "== Addendum 7: R29–R30 =="
-
-# ---------------- R29: the Rule 6 pairing resolves spellings through repos.tsv
-#
-# The register spells one repository several ways in the same week —
-# `OpsxFactory` and `opensoft/OpsxFactory` (23 Rule 6 lines against 70 at
-# `8f9c04d`), `codexFactory`, `codeXfactory/codexFactory` and
-# `opensoft/codexFactory`. Compared literally, a LANDED spelled one way does
-# not close the LANDING spelled the other: it reads as an `unpaired LANDED`,
-# the hold stays open, and over-reporting a merge hold is the direction that
-# stalls other lanes' merges. Both sides now go through `lanes/repos.tsv`
-# before they are compared, and the result key's repository is the canonical
-# spelling. The live register's verdict does not move at `6fa966b` — the same
-# 1 open / 0 unpaired before and after, no (lane, PR) pair there mixing its
-# spellings yet — so these fixtures are where the mechanism is held to
-# account.
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-{ printf 'LANDING — lane repoZQ-1, session %s@Eagle, 2026-09-12T01:00:00Z, PR #60 into OpsxFactory main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZQ-1, session %s@Eagle, 2026-09-12T01:20:00Z, PR #60 into opensoft/OpsxFactory main → 5555555\n' "$DEAD_ID"
-  # R24's two-repo edge, with the two LANDINGs spelled two ways: the LANDED
-  # names one repository and must still prefer ITS LANDING — the EARLIER one —
-  # over the more recent one on the other repository.
-  printf 'LANDING — lane repoZQ-2, session %s@Eagle, 2026-09-12T02:00:00Z, PR #61 into codexFactory main\n' "$DEAD_ID"
-  printf 'LANDING — lane repoZQ-2, session %s@Eagle, 2026-09-12T02:05:00Z, PR #61 into opensoft/openRepoTools main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZQ-2, session %s@Eagle, 2026-09-12T02:10:00Z, PR #61 into codeXfactory/codexFactory main → 6666666\n' "$DEAD_ID"
-  # An alias the table does not know keeps its own spelling, and is compared
-  # case-blind like every other.
-  printf 'LANDING — lane repoZQ-3, session %s@Eagle, 2026-09-12T03:00:00Z, PR #62 into opensoft/repoUnknown main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZQ-3, session %s@Eagle, 2026-09-12T03:10:00Z, PR #62 into opensoft/REPOUNKNOWN main → 7777777\n' "$DEAD_ID"
-  # And the (lane, repository, PR) key carries the CANONICAL spelling: this
-  # LANDED closes nothing, and the unpaired report names the LANDING's
-  # repository as repos.tsv spells it, not as the register typed it.
-  printf 'LANDING — lane repoZQ-4, session %s@Eagle, 2026-09-12T04:00:00Z, PR #63 into Omnigent-Install main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZQ-4, session %s@Eagle, 2026-09-12T04:10:00Z, PR #63 into opensoft/openRepoShape main → 8888888\n' "$DEAD_ID"
-  # A RETRY re-posts LANDING for the same PR — the register holds far more
-  # LANDING lines than landings — and a retry can spell the repository the
-  # other way. Keyed literally those are TWO triples, and the LANDED closes
-  # only the one it names: a hold left open on a PR that has merged.
-  printf 'LANDING — lane repoZQ-5, session %s@Eagle, 2026-09-12T05:00:00Z, PR #64 into OpsxFactory main\n' "$DEAD_ID"
-  printf 'LANDING — lane repoZQ-5, session %s@Eagle, 2026-09-12T05:05:00Z, PR #64 into opensoft/OpsxFactory main\n' "$DEAD_ID"
-  printf 'LANDED — lane repoZQ-5, session %s@Eagle, 2026-09-12T05:10:00Z, PR #64 into opensoft/OpsxFactory main → 9999999\n' "$DEAD_ID"
-} >> "$LANES"
-git -C "$WIP" add -- lanes/LANES.md
-git -C "$WIP" commit -q -m "Rule 6 lines in the spellings the live register mixes"
-git -C "$WIP" push -q origin main
-# `none open` is also what an ABSENT line answers, so the fixture proves it
-# landed before anything reads it — twelve lines, PR #60 to #64.
-is    "the mixed-spelling Rule 6 fixture is on origin/main" \
-      "$(git -C "$WIP" show origin/main:lanes/LANES.md | grep -c 'PR #6[0-4] into' || :)" 12
-
-run   "$E" who --landing opensoft/OpsxFactory
-is    "a LANDED into opensoft/OpsxFactory closes a LANDING into OpsxFactory" "$rc" 0
-has   "…so the hold it answers is closed" "$out" "none open"
-hasnt "…and it is not reported as unpaired, holding a merge that landed" "$out" "unpaired LANDED"
-run   "$E" who --landing OpsxFactory
-has   "…and the alias form of the question answers the same" "$out" "none open"
-
-run   "$E" who --landing codeXfactory/codexFactory
-has   "R24's preference is made between canonical spellings too" "$out" "none open"
-hasnt "…so the LANDED that named the EARLIER LANDING's repository is not unpaired" "$out" "unpaired LANDED"
-run   "$E" who --landing opensoft/openRepoTools
-has   "…while the other repository's LANDING on the same PR number stays open" "$out" "LANDING  opensoft/openRepoTools#61  lane repoZQ-2"
-
-run   "$E" who --landing opensoft/repoUnknown
-has   "an alias the table does not know keeps its own spelling, case-blind" "$out" "none open"
-run   "$E" who --landing opensoft/REPOUNKNOWN
-has   "…however the question spells it" "$out" "none open"
-
-run   "$E" who --landing opensoft/openRepoShape
-has   "a LANDED on another repository still closes nothing" "$out" "unpaired LANDED  opensoft/openRepoShape#63"
-has   "…and the LANDING it names is reported by its CANONICAL spelling" "$out" "is on opensoft/Omnigent-Install"
-run   "$E" who --landing Omnigent-Install
-has   "…which is where the hold really is, still open" "$out" "LANDING  opensoft/Omnigent-Install#63  lane repoZQ-4"
-
-run   "$E" who --landing opensoft/OpsxFactory
-has   "a retry that spelled the repository the other way is ONE triple" "$out" "none open"
-hasnt "…so its LANDED closes it, and PR #64 leaves no hold behind" "$out" "#64"
-
-# --- the alias table must not enter awk through `-v` (A9 Addendum 4, R-A9-11)
-#
-# `awk -v name=value` processes the value AS A STRING LITERAL, and a string
-# literal cannot span lines. macOS's awk — one-true-awk, `awk version
-# 20200816` on the runner — refuses one outright: `awk: newline in string … at
-# source line 1`, exit 2, nothing on stdout. gawk and mawk accept it without a
-# word. `who_landing` handed it the WHOLE repos.tsv alias table that way, one
-# `<alias>\037<owner/repo>` per line, so on macOS the register half of `who
-# --landing` produced nothing at all and every open LANDING in the estate read
-# as `none open` — fourteen of that job's failures, the last group standing
-# after four rounds, and, off CI, the estate's merge holds invisible on a
-# workstation that runs macOS. Every `who --landing` that PASSED there was
-# being answered by the lane's own object log, which is the secondary source.
-#
-# THIS IS THE ONE macOS DEFECT OF THIS ACT A LINUX BOX CAN PROVE FOR ITSELF,
-# so it is proved here rather than bought for another twenty-minute round. The
-# proxy refuses exactly what that awk refuses and hands everything else to the
-# real awk, so it cannot make a case pass that would not pass on the platform;
-# it is written into the sandbox, it is never on PATH for any other case, and
-# it is never shipped. On a host whose awk already refuses (macOS itself) it
-# changes nothing — the refusal simply happens one process earlier.
-#
-# The three behaviour cases below are the register's own mixed-spelling
-# fixture, read back through the proxy: the first two were red on the macOS
-# job by these exact names, and the third is the empty answer that made the
-# other twelve red.
-BSDAWK="$SANDBOX/awk-of-bsd"
-mkdir -p "$BSDAWK"
-LANES_TEST_REAL_AWK="$(command -v awk)"; export LANES_TEST_REAL_AWK
-cat > "$BSDAWK/awk" <<'BSDAWKSHIM'
-#!/usr/bin/env bash
-# A LOCAL PROXY FOR one-true-awk's `-v`, NEVER SHIPPED. Its `setclvar` runs the
-# value through `qstring`, which stops at a literal newline. Nothing else about
-# this awk is imitated: every other call goes straight through.
-awk_nl='
-'
-awk_next=0
-for awk_arg in "$@"; do
-  awk_val=""
-  if [ "$awk_next" = 1 ]; then awk_val="$awk_arg"; awk_next=0
-  else
-    case "$awk_arg" in
-      -v)   awk_next=1 ;;
-      -v?*) awk_val="${awk_arg#-v}" ;;
-    esac
-  fi
-  case "$awk_val" in
-    *=*) case "${awk_val#*=}" in
-           *"$awk_nl"*)
-             printf 'awk: newline in string %s... at source line 1\n' \
-               "${awk_val#*=}" >&2
-             exit 2 ;;
-         esac ;;
-  esac
-done
-exec "${LANES_TEST_REAL_AWK:?no real awk recorded}" "$@"
-BSDAWKSHIM
-chmod +x "$BSDAWK/awk"
-
-is    "the awk proxy refuses a many-line -v, as one-true-awk does" \
-      "$(PATH="$BSDAWK:$PATH" awk -v t="$(printf 'x\ny')" \
-         'BEGIN { print "TAKEN" }' 2>/dev/null; printf 'rc=%s' "$?")" "rc=2"
-is    "…and hands a one-line -v to the real awk, unchanged" \
-      "$(PATH="$BSDAWK:$PATH" awk -v t=kept 'BEGIN { print t }')" "kept"
-
-run   env PATH="$BSDAWK:$PATH" "$E" who --landing Omnigent-Install
-is    "who --landing exits 0 under an awk that refuses a many-line -v" "$rc" 0
-has   "…and the register half still answers, so the hold is still reported" \
-      "$out" "LANDING  opensoft/Omnigent-Install#63  lane repoZQ-4"
-run   env PATH="$BSDAWK:$PATH" "$E" who --landing opensoft/openRepoShape
-has   "…and the alias table still reached awk, so the LANDED is still placed" \
-      "$out" "is on opensoft/Omnigent-Install"
-
-# ------------------- R30: `--home` is resolved AFTER the fetch, in all of them
-#
-# The STARTED line that REFUSES `--home` is read from `origin/<branch>`, so a
-# home a peer recorded is invisible here until `log_sync` has run. `claim` and
-# `release` resolved it BEFORE their own fetch and `log` never fetched at all:
-# the flag was accepted on a lane whose own log answers the question, and the
-# key the write then built was a second spelling of an object that lane already
-# has a home for — measured on the old code, `claim '#3' --home
-# opensoft/elsewhere` committed `CLAIMED … opensoft/elsewhere#3` and only the
-# rebase stopped it. `lane-end` has asked through `resolve-home`, which fetches,
-# since Addendum 6; these three now agree with it.
-ZR_ID="aaaa0008-4444-4000-8000-aaaa00084444"
-peer_started() {   # <lane> <home> — the peer records a home on origin/main only
-  git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$1"
-    printf 'STARTED — lane %s, session %s@Raven, %s, lane:%s → home %s; estate repoZR\n' \
-      "$1" "$ZR_ID" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2"
-  } > "$CLONE2/lanes/log/$1.md"
-  git -C "$CLONE2" add -- "lanes/log/$1.md"
-  git -C "$CLONE2" commit -q -m "LOG($1@Raven): STARTED"
-  git -C "$CLONE2" push -q origin main
-}
-
-peer_started repoZR-1 opensoft/repoZR
-is    "the peer's STARTED line is on origin/main and not in this checkout" "$([ -f "$LOGD/repoZR-1.md" ] && echo yes || echo no)" "no"
-run env LANES_NO_FETCH=1 "$E" resolve-home repoZR-1 opensoft/elsewhere
-is    "without the fetch, a home only origin/main records is invisible" "$rc" 0
-is    "…and --home is taken at its word" "$out" "opensoft/elsewhere"
-run env LANES_LANE=repoZR-1 "$E" log OPENED "#4" --home opensoft/elsewhere
-is    "log fetches before it resolves --home, so the refusal fires" "$rc" 2
-has   "…naming the home the peer recorded" "$err" "already records its home: opensoft/repoZR"
-is    "…and nothing is written, here or anywhere" "$([ -f "$LOGD/repoZR-1.md" ] && echo yes || echo no)" "no"
-
-peer_started repoZR-2 opensoft/repoZR
-run env LANES_LANE=repoZR-2 "$E" claim "#3" --home opensoft/elsewhere --no-github
-is    "claim resolves --home after its fetch, not before it" "$rc" 2
-has   "…with the same refusal" "$err" "already records its home: opensoft/repoZR"
-hasnt "…and writes no claim under a home the lane does not have" "$(git -C "$WIP" show origin/main:lanes/log/repoZR-2.md 2>/dev/null || :)" "opensoft/elsewhere"
-
-peer_started repoZR-3 opensoft/repoZR
-run env LANES_LANE=repoZR-3 "$E" release "#3" "never mine" --home opensoft/elsewhere --no-github
-is    "…and so does release" "$rc" 2
-has   "…with the same refusal" "$err" "already records its home: opensoft/repoZR"
-
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-# `LANES_SESSION` for the same reason as repoW-3 above: a peer lane has a log on
-# origin/main and no row here, so R-A11 (e) refuses a write that cannot name a
-# transcript uuid instead of writing `unknown` into a file nothing rewrites.
-run env LANES_LANE=repoZR-1 LANES_SESSION="$ZR_ID" "$E" claim "#3" --no-github
-is    "…while the claim itself uses the home the peer recorded" "$rc" 0
-has   "…expanding '#3' against it" "$(cat "$LOGD/repoZR-1.md")" ", opensoft/repoZR#3"
-
-section "== Addendum 8: R33–R35 =="
-
-# ---------- R33: the resume target and the RESUMED uuid are the PUBLISHED cell's
-#
-# The last working-tree read in either boundary act, and the one that puts a
-# wrong fact into a file nothing rewrites. A peer stamps the lane's new session
-# id from another clone and pushes; this checkout's copy of the row still ends
-# on the OLD id. Read from there, `lane-start` resumes the lane's PREVIOUS
-# conversation, appends a status naming that id, and writes a `RESUMED` line
-# into `lanes/log/<lane>.md` carrying a session uuid that is not the lane's
-# current one.
-ZC1="aaaa0009-1111-4000-8000-aaaa00091111"
-ZC2="aaaa0009-2222-4000-8000-aaaa00092222"
-printf '{"type":"user"}\n' > "$tdir/$ZC1.jsonl"
-printf '{"type":"user"}\n' > "$tdir/$ZC2.jsonl"
-"$E" add-row "| \`repoZC-1\` | harness \`$ZC1\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZC/x.md | ACTIVE |" >/dev/null 2>&1
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-( LANES_WORKSPACE_ROOT="$CLONE2" LANES_LANE=repoZC-1 "$E" replace-in-row repoZC-1 \
-    "harness \`$ZC1\`" "harness \`$ZC1\` → harness \`$ZC2\`" "the session stamps its own row" ) >/dev/null 2>&1
-
-# First, the reviewer's own sequence: this checkout is BEHIND and has not pulled.
-# `--dry-run`, because a checkout that is behind cannot write its row at all —
-# `commit_push` rebases the status on to the peer's line, conflicts, and aborts,
-# which is a different refusal and already the right one.
-is    "the peer's new session id is on origin/main and not in this checkout" \
-      "$(grep '^| `repoZC-1`' "$LANES" | grep -c "$ZC2" || :)" 0
-before_rev="$(git -C "$WIP" rev-parse HEAD)"
-run   "$START" --dry-run --dir "$HOME/projects/repoA" repoZC-1
-is    "lane-start on a stale copy of the row exits 0" "$rc" 0
-has   "…reading the session cell from origin/main, which names BOTH ids" "$err" "its session cell on origin/main names 2 session id(s)"
-has   "…so the row's current session is the one that LANDED" "$err" "the row's current session is $ZC2"
-has   "…and that is what it plans to resume" "$err" "PLAN exec claude --name repoZC-1 --resume $ZC2"
-hasnt "…never the id this checkout's copy ends on" "$err" "$ZC1"
-has   "…and the status it plans to append names the same id" "$err" "launching claude --name repoZC-1 --resume $ZC2"
-is    "…while --dry-run still writes nothing" "$(git -C "$WIP" rev-parse HEAD)" "$before_rev"
-
-# And the durable half: the same divergence with HEAD already current, so the
-# row write lands and the `RESUMED` line is really written. This checkout's COPY
-# of the row is the older one — the shape R19's second reproduction uses, and
-# the shape this register is in for much of the day (R11).
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null
-awk -v drop=" → harness \`$ZC2\`" '{ if ($0 ~ /^\| `repoZC-1`/) { i = index($0, drop); if (i) $0 = substr($0, 1, i - 1) substr($0, i + length(drop)) } print }' \
-  "$LANES" > "$SANDBOX/lanes.tmp"
-cat -- "$SANDBOX/lanes.tmp" > "$LANES"
-is    "this checkout's copy of the row is older than the one on origin/main" \
-      "$(grep '^| `repoZC-1`' "$LANES" | grep -c "$ZC2" || :)" 0
-is    "…while origin/main still names both ids" \
-      "$(git -C "$WIP" show origin/main:lanes/LANES.md | grep '^| `repoZC-1`' | grep -c "$ZC2" || :)" 1
-run   "$START" --no-launch --dir "$HOME/projects/repoA" repoZC-1
-is    "lane-start exits 0" "$rc" 0
-is    "…resuming the id the PUBLISHED cell ends on" "$out" "claude --name repoZC-1 --resume $ZC2"
-has   "…and the RESUMED line carries THAT uuid, in a file nothing rewrites" \
-      "$(cat "$LOGD/repoZC-1.md")" "RESUMED — lane repoZC-1, session $ZC2@"
-hasnt "…never the stale one, which no later line could correct" "$(cat "$LOGD/repoZC-1.md")" "$ZC1"
-
-# A row HERE and none on origin/main is the one case with no published cell to
-# read: it is an unpushed commit, and the answer is to say so, not to fall back
-# to the working tree — falling back is the fault. The id this copy carries has
-# a transcript, so nothing but the rule stops it being resumed.
-ZF1="aaaa0009-3333-4000-8000-aaaa00093333"
-printf '{"type":"user"}\n' > "$tdir/$ZF1.jsonl"
-is    "the register is clean before the unpublished row is added" \
-      "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c .)" 0
-printf '| `repoZF-1` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZF/x.md | ACTIVE |\n' "$ZF1" >> "$LANES"
-run   "$START" --dry-run --dir "$HOME/projects/repoA" repoZF-1
-is    "a row this checkout has and origin/main does not still exits 0" "$rc" 0
-has   "…and says there is no published cell to read" "$err" "the register on origin/main has none"
-has   "…naming the id nothing outside this checkout can see" "$err" "which nothing else can see: $ZF1"
-has   "…and the act that publishes it" "$err" "push the register from here"
-has   "…taking a NEW session rather than resuming an unpublished id" "$err" "PLAN exec claude --name repoZF-1"
-hasnt "…which is the whole of the rule: no decision comes off the working tree" "$err" "--resume $ZF1"
-git -C "$WIP" checkout -q -- lanes/LANES.md
-is    "…and the fixture leaves the register as it found it" \
-      "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c .)" 0
-
-# ---------- R34: the handoff fragment honours lane_objects' fifth field
-#
-# The refusal reads it and says so; the fragment read it into a variable and
-# never used it. The fragment is the surface that becomes a DURABLE document —
-# it is pasted into the next session's handoff — so an object `who` gives to
-# another lane was handed on as work this lane still had.
-for l in repoZG-1 repoZG-2; do
-  "$E" add-row "| \`$l\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoZG/$l.md | ACTIVE |" >/dev/null 2>&1
-done
-run env LANES_LANE=repoZG-1 "$E" claim "opensoft/repoZG#40" --no-github
-is   "repoZG-1 claims an object" "$rc" 0
-run env LANES_LANE=repoZG-1 "$E" log LANDING "opensoft/repoZG#77" --no-github
-is   "…and opens a landing nobody contests" "$rc" 0
-run env LANES_LANE=repoZG-2 LANES_STALE_HOURS=-1 "$E" claim "opensoft/repoZG#40" --no-github --force
-is   "repoZG-2 takes the claim over" "$rc" 0
-
-run   "$END" repoZG-1
-is    "lane-end still refuses while the taken-over line is open" "$rc" 2
-has   "…naming the release that closes it" "$err" "taken over by lane:repoZG-2 at"
-run   "$END" repoZG-1 --force
-is    "--force ends it and prints the fragment" "$rc" 0
-has   "…whose ## Open marks the superseded claim as what it is" "$out" "superseded by TAKEOVER (lane:repoZG-2) — release it"
-is    "…once, on the line that carries the object" \
-      "$(printf '%s\n' "$out" | grep -c 'superseded by TAKEOVER')" 1
-has   "…on the CLAIMED bullet itself" "$out" "- CLAIMED — opensoft/repoZG#40 ("
-has   "…while an object no other lane touched is listed plain" "$out" "- LANDING — opensoft/repoZG#77 ("
-hasnt "…and that one carries no takeover of its own" "$(printf '%s\n' "$out" | grep 'repoZG#77')" "superseded"
-is    "…the fragment still lists both under ## Open" \
-      "$(printf '%s\n' "$out" | sed -n '/^## Open/,$p' | grep -c '^- ')" 2
-
-
-section "== Amendment 8: swap and restart =="
-
-# ------------------------------------------------------------------ swapped
-#
-# The RECORD a swap leaves is the lane's own PAUSED line, payload
-# `swap; window <s>:<i>; workstation <ws>`, and a lane is SWAPPED on a
-# workstation when that PAUSED is its LAST lane-kind line. `swapped` is what a
-# restart asks once the new tmux session has lost the window name.
-
-run "$E" swapped "$WS_S"
-is    "swapped with nothing swapped exits 8, the same 8 every other absence uses" "$rc" 8
-has   "…saying what it looked for" "$err" "no lane on $WS_S is swapped"
-is    "…and prints no row a launcher could mistake for one" "$out" ""
-
-SW_ID="aaaa000a-5555-4000-8000-aaaa000a5555"
-SW_OLD_UTC="2026-09-12T10:00:00Z"
-SW_NEW_UTC="2026-09-12T11:00:00Z"
-sw_seed() {   # <lane> <utc> <workstation> <window> [<extra line>...]
-  sw_l="$1"; sw_u="$2"; sw_w="$3"; sw_win="$4"; shift 4
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$sw_l"
-    printf 'STARTED — lane %s, session %s@%s, 2026-09-12T09:00:00Z, lane:%s → home opensoft/%s; estate sw\n' "$sw_l" "$SW_ID" "$sw_w" "$sw_l" "$sw_l"
-    printf 'PAUSED — lane %s, session %s@%s, %s, lane:%s → swap; window %s; workstation %s — on Brett Heap'"'"'s word\n' \
-      "$sw_l" "$SW_ID" "$sw_w" "$sw_u" "$sw_l" "$sw_win" "$sw_w"
-    for sw_x in "$@"; do printf '%s\n' "$sw_x"; done
-  } > "$LOGD/$sw_l.md"
-  git -C "$WIP" add -- "lanes/log/$sw_l.md"
-  git -C "$WIP" commit -q -m "LOG($sw_l@$sw_w): PAUSED lane:$sw_l"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  return 0
-}
-
-# LANDING ORDER, NOT THE CLOCK. repoSW-5 carries the LATER UTC and lands FIRST;
-# repoSW-1 carries the EARLIER one and lands SECOND, so it is listed first. Two
-# lanes' files share no clock — Amendment 7's file-order rule does not reach
-# across files, and this workstation's own clock was observed stepping ±25s —
-# so the order is the order the two PAUSED lines reached `main`.
-sw_seed repoSW-5 "$SW_NEW_UTC" "$WS_S" "sess-five:5"
-sw_seed repoSW-1 "$SW_OLD_UTC" "$WS_S" "claude-team-05b-20260912102132-2699:0"
-
-run "$E" swapped "$WS_S"
-is    "swapped exits 0 once a lane is swapped" "$rc" 0
-is    "…one row per swapped lane" "$(printf '%s\n' "$out" | grep -c .)" 2
-# AMENDMENT 11 CLAUSE (h) — `swapped` GAINS A FOURTH FIELD `<dir>` AND A FIFTH
-# `<profile>`, and the tab-is-the-contract rule is what makes that safe: both
-# readers of this output take the FIRST FIELD BEFORE THE FIRST TAB (the launcher
-# at `claude-profile:548-554` and the `/lane-swap` skill at its step 1, each with
-# the same comment saying so), so a fourth and a fifth break neither. These rows
-# were written before clause (c), so both new fields are EMPTY — which is what
-# every record on the estate looks like until adoption act 7 cuts each lane over
-# at its own next start, and a reader that finds none says so rather than
-# assuming one (Amendment 7(i)).
-# AMENDMENT 17(b) ADDS A SIXTH AND A SEVENTH, `<agent>` and `<transcript>`, on
-# the same argument the fourth and fifth were added on: the FIRST FIELD BEFORE
-# THE FIRST TAB is the contract every reader takes, and a record written before
-# an amendment carries its fields EMPTY rather than guessed. These rows were
-# written before both amendments, so four of the seven are empty.
-is    "…lane first, tab-separated, <lane><TAB><UTC><TAB><window><TAB><dir><TAB><profile><TAB><agent><TAB><transcript>" \
-      "$(printf '%s\n' "$out" | head -n1)" "$(printf 'repoSW-1\t%s\tclaude-team-05b-20260912102132-2699:0\t\t\t\t' "$SW_OLD_UTC")"
-is    "…MOST RECENTLY LANDED first, though its UTC is the older of the two" \
-      "$(printf '%s\n' "$out" | head -n1 | cut -f1)" "repoSW-1"
-is    "…and the lane whose UTC is later, having landed first, comes second" \
-      "$(printf '%s\n' "$out" | sed -n 2p | cut -f1)" "repoSW-5"
-is    "…every row carries exactly seven tab-separated fields" \
-      "$(printf '%s\n' "$out" | awk -F'\t' 'NF != 7' | grep -c .)" 0
-is    "…and the FIRST field before the first tab is still the lane, which is the contract both its readers take" \
-      "$(printf '%s\n' "$out" | head -n1 | cut -f1)" "repoSW-1"
-hasnt "…and nothing is written by a read" "$(git -C "$WIP" log --format=%s -n1)" "swapped"
-
-# A lane that has since RESUMED is not swapped: its last lane-kind line is the
-# RESUMED, and this lane's own real log carries exactly that shape.
-sw_seed repoSW-2 "$SW_NEW_UTC" "$WS_S" "sess-two:2" \
-  "RESUMED — lane repoSW-2, session $SW_ID@$WS_S, 2026-09-12T12:00:00Z, lane:repoSW-2 → home opensoft/repoSW-2; estate sw"
-run   "$E" swapped "$WS_S"
-hasnt "a lane whose PAUSED was followed by a RESUMED is not swapped" "$out" "repoSW-2"
-is    "…and the swapped count is unchanged" "$(printf '%s\n' "$out" | grep -c .)" 2
-
-# The workstation is part of the record, and the default is this one.
-sw_seed repoSW-3 "$SW_NEW_UTC" Raven "raven-sess:3"
-run   "$E" swapped "$WS_S"
-hasnt "a lane swapped on ANOTHER workstation is not listed here" "$out" "repoSW-3"
-run   "$E" swapped Raven
-is    "…and is listed when that workstation is asked for" "$rc" 0
-has   "…by name" "$out" "repoSW-3"
-has   "…with the window its /swap recorded" "$out" "raven-sess:3"
-run   "$E" swapped
-is    "swapped with no argument answers for this workstation" "$rc" 0
-hasnt "…which is not the other one" "$out" "repoSW-3"
-
-# A PAUSED that is not a swap is not a record. The lane paused for some other
-# reason, and nothing may restart into it.
-{ printf '# lane repoSW-4 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane repoSW-4, session %s@%s, %s, lane:repoSW-4\n' "$SW_ID" "$WS_S" "$SW_NEW_UTC"
-} > "$LOGD/repoSW-4.md"
-git -C "$WIP" add -- lanes/log/repoSW-4.md
-git -C "$WIP" commit -q -m "LOG(repoSW-4@$WS_S): PAUSED with no swap payload"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run   "$E" swapped "$WS_S"
-hasnt "a PAUSED whose payload is not 'swap; …' is not a swap record" "$out" "repoSW-4"
-
-# The launcher calls it with LANES_NO_FETCH=1: a record this workstation wrote
-# is in its own clone, and a restart must not wait on the network.
-run env LANES_NO_FETCH=1 "$E" swapped "$WS_S"
-is    "swapped honours LANES_NO_FETCH and still reads origin/main" "$rc" 0
-has   "…answering the same" "$out" "repoSW-1"
-has   "…saying it did not fetch" "$err" "LANES_NO_FETCH=1"
-run env LANES_NO_FETCH=1 "$E" register-row repoA-1
-is    "register-row honours it too — the launcher's other probe" "$rc" 0
-run   "$E" swapped --nope
-is    "swapped's OWN usage error is 64, never the dispatcher's 2 (F-B8, F-W4)" "$rc" 64
-has   "…naming the option" "$err" "unknown option '--nope' for swapped"
-run   "$E" swapped Eagle extra
-is    "…a second workstation argument is the same 64" "$rc" 64
-run   "$E" no-such-subcommand-at-all
-is    "…while 2 is left to mean ONE thing: no such subcommand, which is the launcher's whole degrade gate" "$rc" 2
-has   "…and the list it prints names swapped" "$err" "swapped"
-run   "$E" register-row 'not a lane name'
-is    "register-row exits 2 for a name that is not lane-shaped, never 8" "$rc" 2
-run   "$E" register-row no-such-lane-9
-is    "…and 8 for a lane-shaped name the published register has no row for" "$rc" 8
-
-# --------------------------------------------------------- window-session
-#
-# `live-holder` asks whether any session a ROW names is alive; this asks what is
-# alive in a WINDOW, and the gap between the two is the whole of the case below.
-HW_OLD="aaaa000b-1111-4000-8000-aaaa000b1111"
-HW_NEW="aaaa000b-2222-4000-8000-aaaa000b2222"
-printf '{"type":"user"}\n' > "$tdir/$HW_OLD.jsonl"
-printf '{"type":"user"}\n' > "$tdir/$HW_NEW.jsonl"
-write_record_ns "$sessions_dir/live-harness.json" "$HW_NEW" "$LIVE_PID" "$live_start" "hwsess:@7.%7" "openrepoproject-7e" "derived" "busy"
-
-run "$E" window-session "hwsess:@7"
-is   "window-session finds the live record in a window" "$rc" 0
-has  "…naming the session" "$out" "$HW_NEW"
-has  "…the window it reported itself in" "$out" "hwsess:@7.%7"
-has  "…the name the harness derived, which decides nothing and is reported" "$out" "openrepoproject-7e"
-has  "…and the PROFILE, read off the record's own path" "$out" "t1"
-run "$E" window-session "nosuch:@99"
-is   "…and exits 8 for a window no live record names" "$rc" 8
-
-# A session that outlives the window it started in keeps the `tmux` value it was
-# born with, so a backgrounded predecessor whose pid is still alive matches the
-# same target as the session at the keyboard. The most recently updated record
-# wins, and the answer does not depend on which the filesystem listed first.
-HW_STALE="aaaa000b-3333-4000-8000-aaaa000b3333"
-printf '{"pid":%s,"sessionId":"%s","cwd":"x","procStart":"%s","tmux":"hwsess:@7.%%7","name":"old-one","nameSource":"derived","status":"idle","updatedAt":1000}\n' \
-  "$LIVE_PID" "$HW_STALE" "$live_start" > "$sessions_dir/aaa-live-stale.json"
-printf '{"pid":%s,"sessionId":"%s","cwd":"x","procStart":"%s","tmux":"hwsess:@7.%%7","name":"openrepoproject-7e","nameSource":"derived","status":"busy","updatedAt":2000}\n' \
-  "$LIVE_PID" "$HW_NEW" "$live_start" > "$sessions_dir/zzz-live-current.json"
-run  "$E" window-session "hwsess:@7"
-is   "with two live records in one window, the most recently updated one wins" "$rc" 0
-has  "…which is the session at the keyboard" "$out" "$HW_NEW"
-hasnt "…never the backgrounded predecessor that still names the window" "$out" "$HW_STALE"
-rm -f "$sessions_dir/aaa-live-stale.json" "$sessions_dir/zzz-live-current.json"
-write_record_ns "$sessions_dir/live-harness.json" "$HW_NEW" "$LIVE_PID" "$live_start" "hwsess:@7.%7" "openrepoproject-7e" "derived" "busy"
-
-# ------------------- lane-start: the harness's new transcript uuid (Amendment 8)
-#
-# THE CASE THIS AMENDMENT IS FOR, and the one this lane lived at 2026-09-12T16:5xZ:
-# the usage reset carried the conversation into a NEW transcript uuid while the
-# row's session cell still ended on the old one. That id is in no row, so
-# `live-holder` cannot look it up and answers 8 — "this lane is parked" — about
-# the conversation sitting in the very window it was asked about. Without the
-# window read, lane-start resumes the lane's PREVIOUS conversation and writes
-# that uuid on to an append-only line.
-"$E" add-row "| \`repoHU-1\` | harness \`$HW_OLD\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoHU/x.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW="hwsess:@7"
-run   "$START" --dir "$HOME/projects/repoA" repoHU-1 --no-launch
-is    "lane-start exits 0" "$rc" 0
-has   "…having read the live session out of THIS window" "$err" "this window's live session is $HW_NEW"
-has   "…and said the published cell does not name it" "$err" "the PUBLISHED session cell does not name it"
-has   "…the cell is EXTENDED with it, after the id it already ended on" \
-      "$(grep '^| `repoHU-1`' "$LANES")" "harness \`$HW_OLD\` → harness $HW_NEW (transcript uuid; profile t1)"
-has   "…in its own register commit that says why" "$(git -C "$WIP" log --format=%s -- lanes/LANES.md | head -n2 | tail -n1)" "the harness minted $HW_NEW for this window"
-is    "…and the launch resumes the NEW id, not the one the cell used to end on" "$out" "claude --name repoHU-1 --resume $HW_NEW"
-has   "…while the row's status is Amendment 6(c)'s stamp, naming that uuid" \
-      "$(grep '^| `repoHU-1`' "$LANES")" "RESUMED by $HW_NEW (lane repoHU-1) — lane-start on"
-has   "…and the object log's RESUMED carries it too" "$(cat "$LOGD/repoHU-1.md")" "RESUMED — lane repoHU-1, session $HW_NEW@"
-hasnt "…never the stale id, which no later line could correct" "$(grep '^RESUMED' "$LOGD/repoHU-1.md")" "$HW_OLD"
-
-# Run it again: the cell now names that uuid, so there is nothing to append and
-# nothing is written to the cell — only the stamp.
-hu_before="$(git -C "$WIP" rev-parse HEAD)"
-run   "$START" --dir "$HOME/projects/repoA" repoHU-1 --no-launch
-is    "a second run exits 0" "$rc" 0
-has   "…saying step 3 already found that session holding the lane here" "$err" "already holds repoHU-1"
-has   "…so there is nothing for the window read to add" "$err" "the cell is current"
-is    "…so the cell is not extended twice" "$(grep -o "harness $HW_NEW" "$LANES" | grep -c .)" 1
-is    "…and the only register commit is the stamp" "$(git -C "$WIP" rev-list --count "$hu_before..HEAD" -- lanes/LANES.md)" 1
-has   "…which still names the uuid it resumed" "$(git -C "$WIP" log --format=%s -n1 -- lanes/LANES.md)" "RESUMED by $HW_NEW"
-unset FAKE_TMUX_WINDOW
-
-# ---- R-A8-4: THE UUID APPEND IS CELL-SCOPED, AND THIS IS WHY -------------
-#
-# The row above has now been stamped TWICE, and it carries `$HW_NEW` more than
-# once: in its session cell, and in the Amendment 6(c) stamp the cell holds
-# (`RESUMED by <uuid> …`). It used to be THREE times — one per stamp, because
-# every stamp was APPENDED — which is the shape `openRepoProject-1`'s own row
-# had on `origin/main`, measured 2026-09-12: three occurrences of the current
-# uuid and three of the previous one. Amendment 13(a) REPLACES the cell on every
-# write, so the stamps no longer accumulate and the count is two.
-#
-# TWO IS STILL NOT ONE, which is the whole of what this case is for: the
-# whole-row anchor refuses on it exactly as it refused on three, and the act
-# that can extend the session cell is therefore still the cell-scoped one.
-hu_row="$(grep '^| `repoHU-1`' "$LANES")"
-is    "two stamps later, the row carries that uuid twice — the cell and the one stamp it keeps" \
-      "$(printf '%s' "$hu_row" | grep -o "$HW_NEW" | grep -c .)" 2
-run   env LANES_LANE=repoHU-1 "$E" replace-in-row repoHU-1 "$HW_NEW" "$HW_NEW → harness nope"
-is    "replace-in-row REFUSES it, and its whole-row rule is unchanged" "$rc" 2
-has   "…counting the occurrences it found" "$err" "occurs 2 times"
-is    "…and writing nothing" "$(grep '^| `repoHU-1`' "$LANES")" "$hu_row"
-
-# The harness mints a THIRD transcript in the same window — a second usage
-# reset, which is what this lane lives through twice a day.
-HW_NEW2="aaaa000b-4444-4000-8000-aaaa000b4444"
-printf '{"type":"user"}\n' > "$tdir/$HW_NEW2.jsonl"
-rm -f "$sessions_dir/live-harness.json"
-write_record_ns "$sessions_dir/live-harness2.json" "$HW_NEW2" "$LIVE_PID" "$live_start" "hwsess:@7.%7" "openrepoproject-7e" "derived" "busy"
-export FAKE_TMUX_WINDOW="hwsess:@7"
-run   "$START" --dir "$HOME/projects/repoA" repoHU-1 --no-launch
-is    "lane-start appends the new transcript anyway, because the act is cell-scoped" "$rc" 0
-has   "…the session cell now ends on the third transcript" \
-      "$(grep '^| `repoHU-1`' "$LANES")" "→ harness $HW_NEW2 (transcript uuid; profile t1)"
-# THE SESSION CELL IS A HISTORY AND THE STATE CELL IS NOT (Amendment 13(c) and
-# (a)): the previous uuid stays exactly where Amendment 6(b) put it, in the
-# session cell, while the stamp that named it has been REPLACED by this one. It
-# used to be three occurrences — the cell plus two appended stamps.
-is    "…the previous uuid stays in the session cell, which Amendment 13 leaves alone" \
-      "$(grep '^| `repoHU-1`' "$LANES" | grep -o "$HW_NEW" | grep -c .)" 1
-is    "…the row is still one line" "$(grep -c '^| `repoHU-1`' "$LANES")" 1
-is    "…and the launch resumes the id the cell now ends on" "$out" "claude --name repoHU-1 --resume $HW_NEW2"
-unset FAKE_TMUX_WINDOW
-rm -f "$sessions_dir/live-harness2.json"
-
-section "== Amendment 11 hotfix: R-A11-1, --name on every branch, unknown refused =="
-
-# ---- R-A11-1: A LIVE SESSION THAT BELONGS TO ANOTHER ROW IS NEVER TAKEN ----
-#
-# Evidence 2(b) on `brettheap/new-workstation#20`: `lane-start openXfactory-5`
-# typed in lane `openRepoProject-1`'s window planned to resume openRepoProject-1's
-# transcript AS openXfactory-5, and to put openRepoProject-1's uuid into
-# openXfactory-5's session cell — the cell Amendment 6(b) resumes from, in a row
-# every later reader trusts, through an append nothing rewrites. Step 3b fired on
-# ANY live session in the typing window; WHOSE it was was never asked. Ratified
-# as R-A11-1 (corrected, ownership alone) by Brett Heap 2026-09-13T18:05:29Z,
-# verbatim "Ratify all four".
-#
-# THE FENCE IS THE REGISTER, NOT THE WINDOW'S NAME, and that is the correction's
-# whole point. The three cases step 3b exists for — a `/clear`, a usage reset, a
-# profile switch — all happen in a window the launcher has just made and still
-# calls `claude` (step 4 renames it AFTERWARDS), carrying a uuid the harness has
-# just minted, which no row names at all. Fencing on the name would refuse
-# exactly those three and leave the cell-stamping dead, which is `RV-T1`'s
-# finding against the withdrawn "and the row carries no transcript yet" conjunct.
-# An id that some OTHER row already names is the one thing provably not this
-# lane's, and that is what is refused.
-XL_X="aaaa0011-1111-4000-8000-aaaa00111111"     # lane X's own recorded session
-XL_Y="aaaa0011-2222-4000-8000-aaaa00112222"     # lane Y's session, live in the window
-XL_FREE="aaaa0011-3333-4000-8000-aaaa00113333"  # a harness mint, in no row at all
-printf '{"type":"user"}\n' > "$tdir/$XL_X.jsonl"
-"$E" add-row "| \`repoXL-1\` | harness \`$XL_X\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoXL/x.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoXL-2\` | harness \`$XL_Y\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoXL/y.md | ACTIVE |" >/dev/null 2>&1
-write_record_ns "$sessions_dir/live-xl.json" "$XL_Y" "$LIVE_PID" "$live_start" "xlsess:@11.%11" "repoXL-2" "user" "busy"
-xl_y_row_before="$(grep '^| `repoXL-2`' "$LANES")"
-export FAKE_TMUX_WINDOW="xlsess:@11"
-run   "$START" --dir "$HOME/projects/repoA" repoXL-1 --no-launch
-is    "lane-start X typed in lane Y's window exits 0" "$rc" 0
-has   "…having read Y's live session out of the window it was typed in" "$err" "this window's live session is $XL_Y"
-has   "…and answering WHOSE it is from the register, not from the window's name" "$err" "the register says it is lane repoXL-2's, not repoXL-1's"
-hasnt "…so Y's uuid reaches no cell of X's row at all" "$(grep '^| `repoXL-1`' "$LANES")" "$XL_Y"
-is    "…the resume target stays X's OWN row uuid, never Y's transcript" "$out" "claude --name repoXL-1 --resume $XL_X"
-is    "…and Y's row is left exactly as it was" "$(grep '^| `repoXL-2`' "$LANES")" "$xl_y_row_before"
-hasnt "…with no line of X's log naming Y's session either" "$(cat "$LOGD/repoXL-1.md")" "$XL_Y"
-
-# The POSITIVE case, and the one the correction rescued: the same window, the
-# same script, but the live session's uuid is in NO row — the harness minted it
-# at a /clear, a usage reset or a profile switch. Nothing contradicts ownership,
-# so it IS taken and the cell is extended (Amendment 6(c)'s stamp).
-rm -f "$sessions_dir/live-xl.json"
-printf '{"type":"user"}\n' > "$tdir/$XL_FREE.jsonl"
-write_record_ns "$sessions_dir/live-xl2.json" "$XL_FREE" "$LIVE_PID" "$live_start" "xlsess:@11.%11" "repoxl-42" "derived" "busy"
-run   "$START" --dir "$HOME/projects/repoA" repoXL-1 --no-launch
-is    "a live session NO row names is the harness's own mint, and is taken" "$rc" 0
-has   "…the cell extended from the id it ended on, not replaced" \
-      "$(grep '^| `repoXL-1`' "$LANES")" "harness \`$XL_X\` → harness $XL_FREE (transcript uuid; profile t1)"
-is    "…and the launch resumes it, not the id the cell used to end on" "$out" "claude --name repoXL-1 --resume $XL_FREE"
-unset FAKE_TMUX_WINDOW
-rm -f "$sessions_dir/live-xl2.json"
-
-# `session-lane` is the read that answers it — the hook's own `lane_of_session`,
-# exposed for a second caller rather than implemented twice (R-A11-7).
-run "$E" session-lane "$XL_Y"
-is   "session-lane names the lane whose row's session cell carries the uuid" "$out" "repoXL-2"
-is   "…exiting 0" "$rc" 0
-run "$E" session-lane "aaaa0011-4444-4000-8000-aaaa00114444"
-is   "…and 8 when no row's session cell names it, so a caller can tell none from could-not-read" "$rc" 8
-run "$E" session-lane
-is   "…64 on a usage error, like every other read in clause (h) (ruling 1)" "$rc" 64
-is   "…and it writes nothing: no commit is made by a read" "$(git -C "$WIP" status --porcelain | wc -l | tr -d ' ')" 0
-
-# ---- EVIDENCE 4: `--name <lane>` IS ON EVERY LAUNCH BRANCH, NOT ONE ---------
-#
-# The session NAME is the lane's messaging address (Amendment 2): `ListAgents`,
-# `SendMessage`, `@<lane>` and the statusline all read the harness record's
-# name. Measured on lane openRepoProject-1 2026-09-13 — the transcript carried
-# `customTitle: openRepoProject-1`, set once by `/rename`, while every process
-# that resumed it that day carried a DERIVED name (`openrepoproject-b9`, `-1e`,
-# `-27`, `-45`), because only the new-session branch passed the flag. There are
-# three launch branches and the rule is one: a launch names its session after
-# the lane, or the lane has no address for the life of that session, and there
-# is no API to rename a running one from inside.
-NM_ID="aaaa0013-1111-4000-8000-aaaa00131111"
-NM_GONE="aaaa0013-2222-4000-8000-aaaa00132222"
-printf '{"type":"user"}\n' > "$tdir/$NM_ID.jsonl"
-printf '{"type":"custom-title","customTitle":"repoNM-2","sessionId":"titled-nm"}\n' > "$tdir/titled-nm.jsonl"
-"$E" add-row "| \`repoNM-1\` | harness \`$NM_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoNM/x.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoNM-2\` | harness \`$NM_GONE\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoNM/y.md | ACTIVE |" >/dev/null 2>&1
-run   "$START" --dir "$HOME/projects/repoA" repoNM-1 --no-launch
-has   "branch 1, resume by id: the launch carries --name <lane>" "$(launch_of "$out")" "--name repoNM-1"
-is    "…and it is the whole command, in the order lane-start builds it" "$(launch_of "$out")" "claude --name repoNM-1 --resume $NM_ID"
-run   "$START" --dir "$HOME/projects/repoA" repoNM-2 --no-launch
-has   "branch 2, the title fallback: it carries --name <lane> too" "$(launch_of "$out")" "--name repoNM-2"
-is    "…beside the title that filters the picker" "$(launch_of "$out")" "claude --name repoNM-2 --resume repoNM-2"
-run   "$START" --dir "$HOME/projects/repoA" repoNM-3 --no-launch
-has   "branch 3, a new session: it always did, and still does" "$(launch_of "$out")" "--name repoNM-3"
-is    "…which is the branch the other two were measured against" "$(launch_of "$out")" "claude --name repoNM-3"
-
-# ---- R-A11 (e): `unknown` IS REFUSED BY THE WRITER, FROM ANY CALLER --------
-#
-# Amendment 7(b) makes an event's `session` field the transcript uuid and only
-# that. Nothing checked it, and the literal is on `origin/main` in the
-# append-only log four times, in two lanes — `lanes/log/codeXfactory-1.md` ×3 and
-# `lanes/log/openxfactory-4-opendox-extraction.md` ×1. Three came from
-# `log PAUSED` (a swap skill holding the uuid and not passing it) and ONE FROM
-# `release`, which is why the gate is in `write_event` — the writer every one of
-# `log`, `claim` and `release` goes through — and not in the `log` arm alone. It
-# is the first test in that function, before the lock and before the log file is
-# created, so a refusal leaves the checkout as it found it. The four lines
-# already written are not rewritten and not deleted (Amendment 7(b), 7(i)).
-UK_ID="aaaa0012-1111-4000-8000-aaaa00121111"
-"$E" add-row "| \`repoUK-1\` | harness \`$UK_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoUK/x.md | ACTIVE |" >/dev/null 2>&1
-env LANES_LANE=repoUK-1 LANES_SESSION="$UK_ID" "$E" log STARTED "lane:repoUK-1" '→' "home opensoft/repoUK; estate repoUK" >/dev/null 2>&1
-un_before="$(cat "$LOGD/repoUK-1.md")"
-un_head="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_LANE=repoUK-1 LANES_SESSION=unknown "$E" log OPENED "opensoft/repoUK#9"
-is   "log refuses the literal \`unknown\` as a session" "$rc" 2
-has  "…naming the field and the rule it answers to" "$err" "session field is the TRANSCRIPT UUID and only that (Amendment 7(b))"
-has  "…saying why this value in particular" "$err" "no later line can correct any of them"
-has  "…and naming the act that supplies a uuid" "$err" "lane-start --no-launch"
-is   "…while writing nothing to the log" "$(cat "$LOGD/repoUK-1.md")" "$un_before"
-is   "…and making no commit" "$(git -C "$WIP" rev-parse HEAD)" "$un_head"
-run env LANES_LANE=repoUK-1 LANES_SESSION="session_015byFrZSopmRbUWNMYt1zEA" "$E" log OPENED "opensoft/repoUK#9"
-is   "a PR-footer id is refused too: neither resumable nor liveness-checkable" "$rc" 2
-has  "…and the refusal says which kind of id it was handed" "$err" "PR-footer id"
-run env LANES_LANE=repoUK-1 LANES_SESSION="$UK_ID" "$E" log OPENED "opensoft/repoUK#9"
-is   "…while a real transcript uuid writes the line" "$rc" 0
-has  "…carrying that uuid in the session field" "$(cat "$LOGD/repoUK-1.md")" "session $UK_ID@"
-hasnt "…and the lane's log carries no \`session unknown@\` anywhere" "$(cat "$LOGD/repoUK-1.md")" "session unknown@"
-
-# `release` is the other half of the same defect, and one of the four lines on
-# origin/main is a RELEASED. The gate is the writer, so it answers here too.
-run env LANES_LANE=repoUK-1 LANES_SESSION=unknown "$E" release "opensoft/repoUK#9" "not mine after all"
-is   "release refuses it as well — the gate is the writer, not the subcommand" "$rc" 2
-hasnt "…leaving no RELEASED line behind" "$(cat "$LOGD/repoUK-1.md")" "RELEASED"
-
-# And the second rung: with no LANES_SESSION at all, `session_for` no longer
-# substitutes the literal — a row that records no uuid yields none, and the
-# write is refused rather than stamped `unknown` for ever.
-"$E" add-row "| \`repoUK-2\` | pending — set by the session's first act | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoUK/y.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoUK-2 "$E" log STARTED "lane:repoUK-2" '→' "home opensoft/repoUK; estate repoUK"
-is   "a lane whose cell records no uuid is refused too, with no LANES_SESSION to save it" "$rc" 2
-is   "…and no log file is created for it: the guard runs before the file does" \
-     "$([ -f "$LOGD/repoUK-2.md" ] && printf present || printf absent)" absent
-
-# ---- append-session-id, held to account directly --------------------------
-AS_ID="aaaa000d-1111-4000-8000-aaaa000d1111"
-AS_NEW="aaaa000d-2222-4000-8000-aaaa000d2222"
-"$E" add-row "| \`repoAS-1\` | harness \`$AS_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoAS/x.md | ACTIVE · 2026-09-12T10:00:00Z RESUMED by $AS_ID (lane repoAS-1) — lane-start on Eagle: window renamed, launching claude --resume $AS_ID |" >/dev/null 2>&1
-is    "the fixture carries its uuid three times across the row" \
-      "$(grep '^| `repoAS-1`' "$LANES" | grep -o "$AS_ID" | grep -c .)" 3
-as_before="$(git -C "$WIP" rev-parse HEAD)"
-run   env LANES_LANE=repoAS-1 "$E" append-session-id repoAS-1 "$AS_ID" "→ harness $AS_NEW (transcript uuid; profile t1)" "session cell: the harness minted $AS_NEW"
-is    "append-session-id appends where replace-in-row refuses" "$rc" 0
-has   "…the cell carrying both, oldest first, which is what makes it a history" \
-      "$(grep '^| `repoAS-1`' "$LANES")" "harness \`$AS_ID\` → harness $AS_NEW (transcript uuid; profile t1) |"
-is    "…the state cell's two copies untouched, so the stamp still reads as written" \
-      "$(grep '^| `repoAS-1`' "$LANES" | grep -o "$AS_ID" | grep -c .)" 3
-is    "…in exactly one commit" "$(git -C "$WIP" rev-list --count "$as_before..HEAD" -- lanes/LANES.md)" 1
-has   "…that says why" "$(git -C "$WIP" log --format=%s -n1 -- lanes/LANES.md)" "the harness minted $AS_NEW"
-is    "…and it was pushed" "$(git -C "$WIP" rev-parse HEAD)" "$(git -C "$WIP" rev-parse origin/main)"
-hasnt "…and the new id landed AFTER the old one's code span, never inside it" \
-      "$(grep '^| `repoAS-1`' "$LANES")" "\`$AS_ID → harness"
-
-as_row="$(grep '^| `repoAS-1`' "$LANES")"
-run   env LANES_LANE=repoAS-1 "$E" append-session-id repoAS-1 "lane-start on Eagle" "lane-start on Eagle → x"
-is    "an anchor that is only in the STATE cell is not in the session cell: refused" "$rc" 2
-has   "…naming both counts, so the refusal explains itself" "$err" "occurs 0 time(s) in lane repoAS-1's SESSION CELL"
-has   "…and why this act is not replace-in-row" "$err" "The row as a whole carries it 1 time(s)"
-run   env LANES_LANE=repoAS-1 "$E" append-session-id repoAS-1 "harness" "harness → x"
-is    "an anchor that occurs twice INSIDE the cell is refused too" "$rc" 2
-has   "…counting them there" "$err" "occurs 2 time(s) in lane repoAS-1's SESSION CELL"
-run   env LANES_LANE=repoAS-1 "$E" append-session-id repoAS-1 "$AS_NEW" "→ harness x | Raven / test"
-is    "appended text carrying a '|' would forge a cell boundary: refused" "$rc" 2
-has   "…saying exactly that" "$err" "may not contain '|'"
-run   env LANES_LANE=repoAS-1 "$E" append-session-id repoAS-1 "$AS_NEW"
-is    "…and three arguments are required" "$rc" 2
-is    "…none of which wrote anything" "$(grep '^| `repoAS-1`' "$LANES")" "$as_row"
-
-# The stamp follows the LAUNCH decision, exactly as the object-log verb does: a
-# new session is STARTED and a resume is RESUMED, and the uuid is the one this
-# run really resumes or mints.
-"$E" add-row "| \`repoHU-2\` | harness \`$GHOST2_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoHU/y.md | ACTIVE |" >/dev/null 2>&1
-run   "$START" --dir "$HOME/projects/repoA" repoHU-2 --no-launch
-HU2_SID="$(minted_of "$out")"
-is    "a lane that takes a NEW session still exits 0" "$rc" 0
-has   "…and its stamp reads STARTED, not RESUMED" "$(grep '^| `repoHU-2`' "$LANES")" "STARTED by $HU2_SID (lane repoHU-2) — lane-start on"
-run   "$START" repoA 1 --no-launch
-has   "…while a resume-by-id lane's stamp reads RESUMED by that id" "$(grep '^| `repoA-1`' "$LANES")" "RESUMED by $DEAD_ID (lane repoA-1) — lane-start on"
-has   "…and the --no-launch tail behind it states what really happened" "$(grep '^| `repoA-1`' "$LANES")" "RESUMED by $DEAD_ID (lane repoA-1) — lane-start on $LANES_WORKSTATION: window renamed, no launch; dir "
-
-# ---- R-A8-2: ONE record written, TWO deferred, and the act that settles them
-#
-# The title fallback is a person choosing at a picker, and no writer knows which
-# transcript they took at the instant the stamps would be written. So the row's
-# stamp carries the literal `unknown` — the state cell is a history of ACTS and
-# the act happened — and BOTH the object-log line (Amendment 7(b): that field is
-# a transcript uuid and only that, in an append-only file) and Rule 3's handoff
-# stamp are deferred to the first act that knows the uuid. This is the pair: the
-# run that defers, and the `--no-launch` run that settles it.
-DW_OLD="aaaa000e-1111-4000-8000-aaaa000e1111"
-DW_NEW="aaaa000e-2222-4000-8000-aaaa000e2222"
-mkdir -p "$WIP/handoffs/repoDW"
-printf 'Lane: repoDW-1 — single-use resume prompt\n\n# state\n' > "$WIP/handoffs/repoDW/x.md"
-git -C "$WIP" add -- handoffs/repoDW/x.md
-git -C "$WIP" commit -q -m 'handoff fixture for repoDW-1'
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoDW-1\` | harness \`$DW_OLD\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoDW/x.md | ACTIVE |" >/dev/null 2>&1
-printf '{"type":"custom-title","customTitle":"repoDW-1","sessionId":"titled-dw"}\n' > "$tdir/titled-dw.jsonl"
-
-run   "$START" --dir "$HOME/projects/repoA" repoDW-1 --no-launch
-is    "the title fallback resumes by title, the picker not yet run" "$out" "claude --name repoDW-1 --resume repoDW-1"
-is    "…and writes NO object-log line: \`unknown\` is not a transcript uuid (A7(b))" \
-      "$([ -f "$LOGD/repoDW-1.md" ] && printf present || printf absent)" absent
-hasnt "…nor Rule 3's stamp on the handoff the row names" "$(cat "$WIP/handoffs/repoDW/x.md")" "RESUMED by"
-has   "…the ROW's stamp carrying the placeholder, the one place it is written on purpose" \
-      "$(grep '^| `repoDW-1`' "$LANES")" "RESUMED by unknown (lane repoDW-1) — lane-start on"
-is    "…and \`unknown\` never entering the SESSION cell, which Amendment 6(b) resumes from" \
-      "$(grep '^| `repoDW-1`' "$LANES" | awk -F'|' '{print $3}' | grep -c unknown || :)" 0
-has   "…while the run names the one act that writes both deferred records" "$err" "--no-launch repoDW 1"
-
-# The operator's pick is now the live session in this window, so the act the
-# hook prints can read it: no flag, no id, and it learns the uuid itself.
-printf '{"type":"user"}\n' > "$tdir/$DW_NEW.jsonl"
-write_record_ns "$sessions_dir/live-dw.json" "$DW_NEW" "$LIVE_PID" "$live_start" "dwsess:@8.%8" "repodw-1" "derived" "busy"
-export FAKE_TMUX_WINDOW="dwsess:@8"
-run   "$START" --dir "$HOME/projects/repoA" repoDW-1 --no-launch
-is    "the deferred run exits 0" "$rc" 0
-has   "…APPENDING the real uuid to the session cell — nothing is replaced there" \
-      "$(grep '^| `repoDW-1`' "$LANES")" "harness \`$DW_OLD\` → harness $DW_NEW (transcript uuid; profile t1)"
-is    "…so the cell now ends on the transcript a reader could finally name" \
-      "$(printf '%s' "$(grep '^| `repoDW-1`' "$LANES" | awk -F'|' '{print $3}')" | grep -o '[0-9a-f]\{8\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{4\}-[0-9a-f]\{12\}' | tail -n1)" "$DW_NEW"
-has   "…and NOW the lane's RESUMED log line, carrying that uuid" \
-      "$(cat "$LOGD/repoDW-1.md")" "RESUMED — lane repoDW-1, session $DW_NEW@"
-hasnt "…never \`session unknown@\`, which is the line Amendment 7(b) forbids" "$(cat "$LOGD/repoDW-1.md")" "session unknown@"
-has   "…and NOW Rule 3's handoff stamp, the same uuid again" \
-      "$(cat "$WIP/handoffs/repoDW/x.md")" "RESUMED by $DW_NEW (lane repoDW-1) at "
-is    "…spliced under the header block, one line added and none changed" \
-      "$(sed -n 3p "$WIP/handoffs/repoDW/x.md" | cut -c1-19)" "RESUMED by aaaa000e"
-has   "…in its own commit, with the handoff subject Amendment 8(d) gives it" \
-      "$(git -C "$WIP" log --format=%s -n5 | grep -m1 'handoff(' || :)" "handoff(repoDW-1@"
-is    "…and one set of records that agree: the row's newest stamp names it too" \
-      "$(grep '^| `repoDW-1`' "$LANES" | grep -o 'RESUMED by [^ ]*' | tail -n1)" "RESUMED by $DW_NEW"
-unset FAKE_TMUX_WINDOW
-rm -f "$sessions_dir/live-dw.json"
-
-# ---- RV-B2: the handoff stamp's DEGRADED pushes, and which recovery each is
-#
-# F-B7's whole deliverable is a SENTENCE — `hs_carry_note` telling the reader
-# whether anything on this workstation will ever push the commit `lane-start`
-# just made — and at `77a2f49` not one assertion in this suite read either
-# branch of it (`grep -c "register's own checkout" test_lane_helpers.sh` -> 0).
-# An untested sentence is what drifts, and this one is the difference between a
-# stamp that lands by itself and a stamp nobody will ever see again.
-#
-# THE REJECTION IS SCOPED BY THE COMMIT, NOT BY THE DIRECTORY. In the first case
-# the handoff repo IS the register's checkout, so a blanket refusal of `push -C
-# $WIP` would fail `set-row-state` instead — and `lane-start` runs under
-# `set -e`, so it would never reach the handoff block the case is about.
-# Amendment 8(d) gives the stamp commit the subject `handoff(<lane>@<ws>): …`,
-# which no register write carries, and the push follows its own commit
-# immediately: HEAD is therefore an exact discriminator. `commit_push` commits
-# before it pulls or pushes for the same reason, so the register's own calls are
-# always looking at a register commit when this fake reads HEAD.
-cat > "$SANDBOX/rejectgit" <<'FAKE'
-#!/usr/bin/env bash
-# Refuses $RJ_VERB (`push` or `pull`) for the handoff stamp's commit ONLY;
-# everything else, the register's own writes included, goes to the real git.
-rj_dir="."; rj_hit=0; rj_prev=""
-for a in "$@"; do
-  [ "$rj_prev" = "-C" ] && rj_dir="$a"
-  [ "$a" = "${RJ_VERB:-push}" ] && rj_hit=1
-  rj_prev="$a"
-done
-if [ "$rj_hit" = 1 ]; then
-  case "$(git -C "$rj_dir" log --format=%s -n1 2>/dev/null)" in
-    handoff\(*) printf 'fake git: %s refused\n' "${RJ_VERB:-push}" >&2; exit 1 ;;
-  esac
-fi
-exec git "$@"
-FAKE
-chmod +x "$SANDBOX/rejectgit"
-
-# The paths as GIT spells them, which is what `lane-start` prints: `hs_repo` is
-# `rev-parse --show-toplevel` of the handoff's real path, so comparing against
-# the shell's own `$WIP`/`$WS2` would compare two spellings of one directory.
-WIP_REAL="$(git -C "$WIP" rev-parse --show-toplevel)"
-
-# (a) THE HANDOFF IS IN THE REGISTER'S OWN CHECKOUT. The next `lanes-edit.sh`
-#     write out of it pushes the branch, and the orphaned commit rides out with
-#     it — so the note may promise the carry, and does.
-CN_A="cccc0001-1111-4000-8000-cccc00011111"
-printf '{"type":"custom-title","customTitle":"repoCN-1","sessionId":"%s"}\n' "$CN_A" > "$tdir/$CN_A.jsonl"
-mkdir -p "$WIP/handoffs/repoCN"
-printf 'Lane: repoCN-1 — single-use resume prompt\n\n# state\n' > "$WIP/handoffs/repoCN/a.md"
-git -C "$WIP" add -- handoffs/repoCN/a.md
-git -C "$WIP" commit -q -m 'handoff fixture for repoCN-1'
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoCN-1\` | harness \`$CN_A\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCN/a.md | ACTIVE |" >/dev/null 2>&1
-
-run env LANES_GIT="$SANDBOX/rejectgit" RJ_VERB=push "$START" --dir "$HOME/projects/repoA" repoCN-1 --no-launch
-is   "a handoff stamp whose PUSH is rejected still exits 0 — the record is not the licence" "$rc" 0
-has  "…the stamp really written and committed all the same" "$(cat "$WIP/handoffs/repoCN/a.md")" "RESUMED by $CN_A (lane repoCN-1) at "
-has  "…in its own commit, which is the one nothing pushed" "$(git -C "$WIP" log --format=%s -n1)" "handoff(repoCN-1@"
-has  "…and the reader told what state that leaves, in the branch's own words" "$err" "the push was rejected — the stamp is a local commit here and other workstations cannot see it yet."
-has  "…told to LOOK before pushing again, never to push blind" "$err" "git -C $WIP_REAL fetch origin main && git -C $WIP_REAL log --oneline origin/main -3"
-has  "…the re-push conditional on what that look finds" "$err" "git -C $WIP_REAL push origin main      # only if it is not there"
-has  "…and F-B7's sentence for a handoff INSIDE the register's checkout, verbatim" "$err" "(this handoff is in the register's own checkout, so the next lanes-edit.sh write out of it pushes the branch and carries this commit with it.)"
-hasnt "…never the other branch's, which would be the wrong promise here" "$err" "no lanes-edit.sh write will ever push it"
-
-# (b) THE HANDOFF IS RESOLVED THROUGH `LANES_WORKSPACE_ROOT`, into a checkout no
-#     `lanes-edit.sh` write ever goes out of. Nothing will carry this commit,
-#     and promising a carry that will not happen is worse than printing the
-#     command — so the note names the checkout and says the command is the whole
-#     of the recovery. Its own bare origin, because the point is that this is a
-#     SECOND repository: `hs_resolve`'s case (b) must miss before case (c) hits,
-#     which is why the cell names a file `$WIP` does not have.
-WS2_ORIGIN="$SANDBOX/ws2-origin.git"; WS2="$SANDBOX/ws2"
-git init -q --bare -b main "$WS2_ORIGIN"
-git clone -q "$WS2_ORIGIN" "$WS2" 2>/dev/null
-git -C "$WS2" config user.email "test@example.invalid"
-git -C "$WS2" config user.name  "lane helper tests"
-mkdir -p "$WS2/handoffs/repoCN"
-printf 'Lane: repoCN-2 — single-use resume prompt\n\n# state\n' > "$WS2/handoffs/repoCN/b.md"
-git -C "$WS2" add -- handoffs/repoCN/b.md
-git -C "$WS2" commit -q -m 'handoff fixture for repoCN-2'
-git -C "$WS2" push -q origin main
-WS2_REAL="$(git -C "$WS2" rev-parse --show-toplevel)"
-CN_B="cccc0002-2222-4000-8000-cccc00022222"
-printf '{"type":"custom-title","customTitle":"repoCN-2","sessionId":"%s"}\n' "$CN_B" > "$tdir/$CN_B.jsonl"
-"$E" add-row "| \`repoCN-2\` | harness \`$CN_B\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCN/b.md | ACTIVE |" >/dev/null 2>&1
-is   "the cell names a handoff the register's checkout does NOT hold" "$([ -e "$WIP/handoffs/repoCN/b.md" ] && printf present || printf absent)" absent
-
-run env LANES_GIT="$SANDBOX/rejectgit" RJ_VERB=push LANES_FILE="$LANES" LANES_REPO="$WIP" \
-        LANES_WORKSPACE_ROOT="$WS2" "$START" --dir "$HOME/projects/repoA" repoCN-2 --no-launch
-is   "…and a rejected push on THAT checkout exits 0 too" "$rc" 0
-has  "…the stamp written into the second checkout, not the register's" "$(cat "$WS2/handoffs/repoCN/b.md")" "RESUMED by $CN_B (lane repoCN-2) at "
-is   "…which the register's checkout never gained a copy of" "$([ -e "$WIP/handoffs/repoCN/b.md" ] && printf present || printf absent)" absent
-has  "…and F-B7's OTHER sentence, naming the checkout nothing will ever push" "$err" "(this handoff is NOT in the register's checkout ($WS2_REAL), so no lanes-edit.sh write will ever push it: the command above is the whole of the recovery.)"
-hasnt "…never promising a carry that no write will perform" "$err" "carries this commit with it"
-
-# ---- RV-B3: an ABORTED PULL is not proof the commit stayed here
-#
-# The case, live on 2026-09-12T23:04Z: this lane's handoff commit hit a
-# `pull --rebase` abort on a peer lane's untracked log file, and the peer's own
-# helper then rebased and pushed — carrying this lane's local commit `59a2576`
-# out to origin UNDERNEATH its own `f053245`. The branch's recovery was a bare
-# re-push, so a reader who ran it at that moment would have landed the same Rule
-# 3 stamp twice, in the one document this protocol never rewrites. The
-# push-rejected branch has always told the reader to look first; this one now
-# does too, and the test pins the ORDER as well as the text, because a look
-# printed after the push it is meant to gate is not a look.
-CN_C="cccc0003-3333-4000-8000-cccc00033333"
-printf '{"type":"custom-title","customTitle":"repoCN-3","sessionId":"%s"}\n' "$CN_C" > "$tdir/$CN_C.jsonl"
-printf 'Lane: repoCN-3 — single-use resume prompt\n\n# state\n' > "$WIP/handoffs/repoCN/c.md"
-git -C "$WIP" add -- handoffs/repoCN/c.md
-git -C "$WIP" commit -q -m 'handoff fixture for repoCN-3'
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoCN-3\` | harness \`$CN_C\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCN/c.md | ACTIVE |" >/dev/null 2>&1
-
-run env LANES_GIT="$SANDBOX/rejectgit" RJ_VERB=pull "$START" --dir "$HOME/projects/repoA" repoCN-3 --no-launch
-is   "a handoff stamp whose PULL aborts still exits 0" "$rc" 0
-has  "…the stamp written and committed here all the same" "$(git -C "$WIP" log --format=%s -n1)" "handoff(repoCN-3@"
-has  "…the branch saying what happened, not the timeout's words" "$err" "the pull before the push did not apply (a conflict, or no reachable origin) — the rebase is aborted, the checkout is clean, and the stamp is a local commit here that was not pushed."
-hasnt "…and never ruling (h)'s line, which is a different failure" "$err" "the pull before the push TIMED OUT"
-has  "…then the LOOK, because a peer's push may already carry this very commit" "$err" "git -C $WIP_REAL fetch origin main && git -C $WIP_REAL log --oneline origin/main -3   # a peer's push may already carry it"
-has  "…and the re-push conditional on what it finds" "$err" "git -C $WIP_REAL pull --rebase origin main && git -C $WIP_REAL push origin main      # only if it is not there"
-cn_look="$(printf '%s\n' "$err" | grep -n -- 'log --oneline origin/main -3' | head -n1 | cut -d: -f1)"
-cn_push="$(printf '%s\n' "$err" | grep -n -- 'pull --rebase origin main && ' | head -n1 | cut -d: -f1)"
-is   "…the look printed BEFORE the re-push it gates, which is the whole of RV-B3" \
-     "$([ -n "$cn_look" ] && [ -n "$cn_push" ] && [ "$cn_look" -lt "$cn_push" ] && printf 'look first' || printf "look $cn_look, push $cn_push")" "look first"
-has  "…and F-B7's carry note under it, the same two branches as the push case" "$err" "(this handoff is in the register's own checkout, so the next lanes-edit.sh write out of it pushes the branch and carries this commit with it.)"
-
-# ------------------------------------------------- lane-start --confirm / --yes
-#
-# A window whose name is not the lane is a window whose lane came from somewhere
-# else — the swap record, or a flag. Taking it renames the window and writes the
-# register, so `--confirm` puts the three facts that disagree in front of a
-# person first.
-"$E" add-row "| \`repoCF-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCF/x.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoCF-2\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCF/y.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoCF-3\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCF/z.md | ACTIVE |" >/dev/null 2>&1
-
-# R-A8-3 — A LAUNCHER NEVER REFUSES TO START CLAUDE, and `claude-profile` EXECS
-# this script, so a refusal here is an exited pane with no Claude in it. `N`
-# means NOT THIS LANE, not NOT AT ALL: both answers fall through to Claude bare,
-# with the pass-through arguments, exit 0, one notice, nothing renamed and
-# nothing written. Under `--no-launch` the bare command is what stdout carries,
-# which is the contract the launcher execs.
-cf_before="$(git -C "$WIP" rev-parse HEAD)"
-cf_renames="$(grep -c 'rename-window repoCF-2' "$FAKE_TMUX_LOG" || :)"
-out="$("$START" --confirm --dir "$HOME/projects/repoA" repoCF-2 --no-launch </dev/null 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is    "--confirm with no terminal and no --yes launches Claude BARE, exit 0" "$rc" 0
-is    "…and the command it prints is the bare one, with no lane in it" "$(launch_of "$out")" "claude"
-has   "…saying a question nobody can answer is not a yes" "$err" "there is no terminal to ask on"
-has   "…and that nothing was done" "$err" "Nothing has been renamed and nothing has been written"
-has   "…naming the act that takes the lane later, its arguments filled in" "$err" "to take it later, run: lane-start repoCF 2"
-is    "…renaming no window" "$(grep -c 'rename-window repoCF-2' "$FAKE_TMUX_LOG" || :)" "$cf_renames"
-is    "…and writing nothing at all" "$(git -C "$WIP" rev-parse HEAD)" "$cf_before"
-
-run env LANE_START_ANSWER=n "$START" --confirm --dir "$HOME/projects/repoA" repoCF-2 --no-launch
-is    "--confirm answered N launches Claude bare too, exit 0 — never exit 2" "$rc" 0
-is    "…the bare command, with no --resume and no --name" "$(launch_of "$out")" "claude"
-has   "…quoting the answer it got" "$err" "the answer was 'n'"
-has   "…in ONE notice" "$err" "Starting Claude with no lane"
-is    "…and still writes nothing" "$(git -C "$WIP" rev-parse HEAD)" "$cf_before"
-run env LANE_START_ANSWER= "$START" --confirm --dir "$HOME/projects/repoA" repoCF-2 --no-launch
-is    "…as does an empty answer, which is the [y/N] default" "$rc" 0
-has   "…and says so" "$err" "<empty, which is N>"
-: > "$FAKE_CLAUDE_LOG"
-run env LANE_START_ANSWER=n "$START" --confirm --dir "$HOME/projects/repoA" repoCF-2 -- --dangerously-skip-permissions
-is    "…and a real launch execs it, carrying the pass-through arguments" "$rc" 0
-is    "…bare, which is what the operator asked for by saying N" "$(cat "$FAKE_CLAUDE_LOG")" "--dangerously-skip-permissions"
-is    "…with the register still untouched by any of it" "$(git -C "$WIP" rev-parse HEAD)" "$cf_before"
-
-run env LANE_START_ANSWER=y "$START" --confirm --dir "$HOME/projects/repoA" repoCF-1 --no-launch
-is    "--confirm answered y takes the lane" "$rc" 0
-has   "…having printed the WINDOW" "$err" "window   testsess:@1 'claude'"
-has   "…the SESSION live in it, when there is one to name" "$err" "session  none — no live session record names this window"
-has   "…the ROW" "$err" "row      | \`repoCF-1\`"
-has   "…and named the auto-named window as what it is" "$err" "auto-named 'claude'"
-has   "…then renamed the window" "$(cat "$FAKE_TMUX_LOG")" "rename-window repoCF-1"
-
-run "$START" --confirm --yes --dir "$HOME/projects/repoA" repoCF-3 --no-launch -- --dangerously-skip-permissions
-is    "--yes answers it without a terminal and without the seam" "$rc" 0
-has   "…saying which of the two answered" "$err" "(--yes)"
-is    "…with the flags BEFORE the lane and -- passing through to claude" \
-      "$(launch_of "$out")" "claude --name repoCF-3 --resume $DEAD_ID --dangerously-skip-permissions"
-
-export FAKE_TMUX_WINDOW_NAME=repoCF-1
-run env LANE_START_ANSWER=n "$START" --confirm --dir "$HOME/projects/repoA" repoCF-1 --no-launch
-is    "--confirm asks nothing when the window is ALREADY named for the lane" "$rc" 0
-has   "…and says so" "$err" "already named repoCF-1 — nothing to confirm"
-unset FAKE_TMUX_WINDOW_NAME
-
-run "$START" --dir "$HOME/projects/repoA" repoCF-1 --no-launch
-is    "without --confirm nothing is asked, which is today's behaviour" "$rc" 0
-hasnt "…and no triple is printed" "$err" "Take lane repoCF-1 in this window?"
-has   "lane-start --help LISTS --confirm, which is what the launcher greps for" "$("$START" --help)" "  --confirm  "
-has   "…and --yes beside it" "$("$START" --help)" "  --yes  "
-
-# ------------------------------------------------------------- session-start
-#
-# The SessionStart hook's whole output. It NEVER writes and it ALWAYS exits 0:
-# a hook that fails is a hook that breaks the session it was meant to orient.
-SS_OLD="aaaa000c-1111-4000-8000-aaaa000c1111"
-SS_CUR="aaaa000c-2222-4000-8000-aaaa000c2222"
-SS_NEW="aaaa000c-3333-4000-8000-aaaa000c3333"
-"$E" add-row "| \`repoSS-1\` | harness \`$SS_OLD\` → after /clear \`$SS_CUR\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoSS/session-handoff-2026-09-12-lane-repoSS-1.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoSS-1 "$E" claim "opensoft/repoSS#5" --home opensoft/repoSS --no-github
-is   "the hook's lane holds an object to report" "$rc" 0
-
-ss_hook='{"session_id":"%s","source":"%s","cwd":"/sandbox/projects/repoSS","hook_event_name":"SessionStart"}'
-ss_run() {   # <session id> <source>
-  ssr_id="$1"; ssr_src="$2"
-  out="$(printf "$ss_hook" "$ssr_id" "$ssr_src" | "$E" session-start 2>"$SANDBOX/stderr")"; rc=$?
-  err="$(cat "$SANDBOX/stderr")"
-  return 0
-}
-ss_before="$(git -C "$WIP" rev-parse HEAD)"
-export FAKE_TMUX_WINDOW_NAME=repoSS-1
-
-ss_run "$SS_CUR" resume
-is   "session-start exits 0" "$rc" 0
-is   "…printing exactly four lines" "$(printf '%s\n' "$out" | grep -c .)" 4
-has  "…the lane, its handoff and the session its row records" "$out" "LANE repoSS-1 — handoff handoffs/repoSS/session-handoff-2026-09-12-lane-repoSS-1.md — row session $SS_CUR"
-has  "…what Rule 3 owes" "$out" "stamp the handoff RESUMED (Rule 3) and follow its top block"
-has  "…and the lane's open objects, on one line" "$out" "open: CLAIMED opensoft/repoSS#5"
-has  "…and how old the answer is, because it never fetches to get it (R-A8-1)" "$out" "as of "
-has  "…saying in the same breath that it did not fetch to get it — clause (e)'s own last line" "$out" "(no fetch)"
-is   "…which is the LAST line of the block, on every branch" "$(printf '%s\n' "$out" | tail -n1 | sed 's/as of .*(no fetch)/TAIL/')" "TAIL"
-
-ss_run "$SS_OLD" resume
-is   "an EARLIER session of the same lane exits 0 too" "$rc" 0
-is   "…and prints the warning and the age of the read, and nothing else" "$(printf '%s\n' "$out" | grep -c .)" 2
-is   "…the SUPERSEDED-TRANSCRIPT warning, with <repo> <n> FILLED IN" "$(printf '%s\n' "$out" | head -n1)" \
-     "WARNING: this is a superseded transcript of lane repoSS-1; the live one is $SS_CUR; you resumed $SS_OLD — exit this session and run: lane-start repoSS 1"
-hasnt "…which never names /resume or the picker, neither being a lane surface (clause (f))" "$out" "resume the"
-hasnt "…so no reader has to translate repoSS-1 into repoSS 1 by hand, ever again" "$out" "<repo> <n>"
-
-ss_run "$SS_NEW" startup
-is   "a session id NO row carries is the OTHER mismatch" "$rc" 0
-has  "…and the block says which of the two it is" "$out" "this session $SS_NEW is in no row — the harness minted a new transcript"
-has  "…sending it at the act that fixes it, which is not a plain lane-start" "$out" "run: lane-start --no-launch repoSS 1"
-hasnt "…so it is not confused with resuming an earlier lineage" "$out" "you resumed"
-
-ss_run "$SS_CUR" fork
-is   "a FORK is an attachment to the lane, so it gets the block" "$rc" 0
-has  "…in full" "$out" "LANE repoSS-1 — handoff"
-ss_run "$SS_CUR" compact
-is   "a COMPACT exits 0" "$rc" 0
-is   "…and prints NOTHING: the same session carries on in the same window" "$out" ""
-ss_run "$SS_CUR" clear
-has  "a CLEAR gets the block" "$out" "LANE repoSS-1"
-out="$(printf '{"session_id":"%s","cwd":"/sandbox"}' "$SS_CUR" | "$E" session-start 2>/dev/null)"; rc=$?
-is   "a payload with NO source at all exits 0" "$rc" 0
-has  "…and is treated as a startup rather than dropped" "$out" "LANE repoSS-1"
-out="$(printf '{"session_id":"%s","source":"teleport"}' "$SS_CUR" | "$E" session-start 2>/dev/null)"; rc=$?
-has  "…as is a source no harness has invented yet" "$out" "LANE repoSS-1"
-
-export FAKE_TMUX_WINDOW_NAME=claude
-ss_run "$SS_CUR" resume
-is   "a window that names no lane falls back to the session id" "$rc" 0
-has  "…and resolves the lane out of the register's session cells" "$out" "LANE repoSS-1"
-ss_run "$SS_NEW" startup
-is   "…and when neither answers, it says so" "$rc" 0
-is   "…in ONE notice — the launcher's own is the second of two, and Amendment 8 drops it" "$(printf '%s\n' "$out" | head -n1)" "no lane bound to this window — run: lane-start <repo> <n>"
-has  "…and the age of the read it answered from" "$out" "(no fetch)"
-
-export FAKE_TMUX_WINDOW_NAME=REPOSS-1
-ss_run "$SS_CUR" resume
-has  "the window name is matched case-blind: Rule 10's wire form is lowercase" "$out" "LANE repoSS-1"
-unset FAKE_TMUX_WINDOW_NAME
-
-out="$(printf 'not json at all' | "$E" session-start 2>/dev/null)"; rc=$?
-is   "garbage on stdin exits 0 — a hook must never break the session" "$rc" 0
-out="$(printf '' | LANES_FILE="$SANDBOX/no-such-register.md" "$E" session-start 2>/dev/null)"; rc=$?
-is   "…and so does no register at all, which every other subcommand refuses" "$rc" 0
-is   "session-start wrote nothing, through all of that" "$(git -C "$WIP" rev-parse HEAD)" "$ss_before"
-is   "…and left the checkout clean" "$(git -C "$WIP" status --porcelain | grep -c .)" 0
-
-# NO CURE SENDS A READER BACK THROUGH THE PICKER (clause (f); clause (e)'s "the
-# first cure carries one condition"). A real `lane-start` is the superseded-
-# transcript remedy BECAUSE the cell's last id names a transcript the lane's
-# directory has. Where the last launch took the title fallback, it does not —
-# and the row says so in its own words, `RESUMED by unknown` — so a relaunch
-# would put the reader in front of the same picker, and the recording act is the
-# cure there too. The hook reads the row, never a directory it was not handed.
-SU_OLD="aaaa0010-1111-4000-8000-aaaa00101111"
-SU_CUR="aaaa0010-2222-4000-8000-aaaa00102222"
-"$E" add-row "| \`repoSU-1\` | harness \`$SU_OLD\` → harness $SU_CUR (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoSU/x.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW_NAME=repoSU-1
-ss_run "$SU_OLD" resume
-is   "a superseded transcript of a normally-resumable lane is cured by a real lane-start" "$(printf '%s\n' "$out" | head -n1)" \
-     "WARNING: this is a superseded transcript of lane repoSU-1; the live one is $SU_CUR; you resumed $SU_OLD — exit this session and run: lane-start repoSU 1"
-"$E" set-row-state repoSU-1 "LIVE · RESUMED by unknown (lane repoSU-1) — lane-start on Eagle: window renamed, no launch" >/dev/null 2>&1
-ss_run "$SU_OLD" resume
-has  "…but one whose NEWEST row stamp says unknown is cured by the RECORDING act" "$out" "run: lane-start --no-launch repoSU 1"
-has  "…saying why, in the row's own word" "$out" "which the row records as \`unknown\`"
-hasnt "…never by a relaunch that would take the same title fallback again" "$out" "exit this session and run"
-hasnt "…and no branch of this block ever names the picker" "$out" "/resume"
-unset FAKE_TMUX_WINDOW_NAME
-
-
-# R-A8-1 — SESSION-START NEVER FETCHES AND NEVER WRITES, and this is the test
-# that was missing: the four-way review removed `log_sync` from the branch as a
-# mutation and the suite stayed at 760/0, so nothing pinned whether the hook in
-# front of EVERY session start on this workstation opened the network. The fake
-# `git` aborts on the four verbs that do — fetch, ls-remote, pull, push — and
-# records the attempt, so a re-added fetch is not merely slow here, it is
-# CAUGHT. The tree, the refs, HEAD and FETCH_HEAD's own mtime are compared
-# either side of the call, because "never writes" is about the .git directory
-# as much as the working tree.
-NONET="$SANDBOX/nonet"; mkdir -p "$NONET"
-REAL_GIT="$(command -v git)"
-cat > "$NONET/git" <<FAKE
-#!/usr/bin/env bash
-for a in "\$@"; do
-  case "\$a" in
-    fetch|ls-remote|pull|push) printf 'git %s\n' "\$*" >> "$SANDBOX/gitnet.log"; exit 99 ;;
-  esac
-done
-exec "$REAL_GIT" "\$@"
-FAKE
-chmod +x "$NONET/git"
-: > "$SANDBOX/gitnet.log"
-# RV-B1 — THE DIGEST IS sha256, and that is not a detail. Comparing a directory
-# with itself needs no cryptographic strength at all, so `sha1sum` was the
-# obvious reach; but `sha1sum` in a shell script is `shell:S4790` ("weak hash
-# algorithm"), CRITICAL, and ONE such issue on a PR's new lines is a Security
-# rating of D, which fails the `new_security_rating` gate condition on its own —
-# issue `AaCXxOSfi2WmFx-_lncg`, this file, this line, 2026-09-12T22:37Z. A test
-# file is not the place to argue an exception, and a `# NOSONAR` marker would
-# hide the finding rather than answer it. `sha256sum` costs nothing here.
-#
-# AND IT IS SPELLED TWO WAYS, because neither spelling is everywhere (A9
-# Addendum 4, R-A9-11). A stock macOS has `shasum -a 256` and no `sha256sum` at
-# all; this runner image happens to carry both, which is exactly the kind of
-# fact a test must not depend on — with the digest missing, this function
-# prints NOTHING and the two comparisons below compare the empty string with
-# itself: green, and asserting no fact. `sort -z`'s `-z` is GNU-only and goes
-# the same way — sorting the DIGEST LINES needs no NUL and is as deterministic.
-# `xargs -r` goes because it is GNU-only and this `find` always names a file.
-if command -v sha256sum >/dev/null 2>&1; then SHA256=(sha256sum); else SHA256=(shasum -a 256); fi
-tree_of() {   # <checkout>
-  local to_dir="$1"
-  ( cd "$to_dir" && find . -path ./.git -prune -o -type f -print0 \
-      | xargs -0 "${SHA256[@]}" | LC_ALL=C sort | "${SHA256[@]}" )
-  return 0
-}
-# `stat -c` is GNU and `stat -f` is BSD, the same two-spelling rule, and
-# `lanes-edit.sh:2969` already reads FETCH_HEAD's mtime both ways. Spelled `-c`
-# only, this answered `none` on BOTH sides of the call on macOS and the
-# assertion compared `none` with `none`.
-mtime_of() { stat -c %Y -- "$1" 2>/dev/null || stat -f %m -- "$1" 2>/dev/null || printf 'none'; }
-ss_tree_before="$(tree_of "$WIP")"
-ss_refs_before="$(git -C "$WIP" for-each-ref --format='%(refname) %(objectname)')"
-ss_head2_before="$(git -C "$WIP" rev-parse HEAD)"
-ss_fh_before="$(mtime_of "$WIP/.git/FETCH_HEAD")"
-export FAKE_TMUX_WINDOW_NAME=repoSS-1
-out="$(printf "$ss_hook" "$SS_CUR" resume | PATH="$NONET:$PATH" "$E" session-start 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is   "session-start exits 0 with a git that refuses every network call" "$rc" 0
-is   "…having made NONE of them: no fetch, no ls-remote, no pull, no push" "$(cat "$SANDBOX/gitnet.log")" ""
-has  "…and still printing the whole block, from the checkout as it last stood" "$out" "LANE repoSS-1 — handoff"
-is   "…the working tree byte-identical either side of it" "$(tree_of "$WIP")" "$ss_tree_before"
-is   "…every ref where it was, origin/main included" "$(git -C "$WIP" for-each-ref --format='%(refname) %(objectname)')" "$ss_refs_before"
-is   "…HEAD where it was" "$(git -C "$WIP" rev-parse HEAD)" "$ss_head2_before"
-is   "…and .git/FETCH_HEAD not even touched, which is what a fetch would move" "$(mtime_of "$WIP/.git/FETCH_HEAD")" "$ss_fh_before"
-unset FAKE_TMUX_WINDOW_NAME
-
-# R-A8-7 — the block stops asking for a stamp `lane-start` has already written.
-# Derived, not assumed: the handoff the ROW names is read, and the line is the
-# one THIS session would owe. A window started by a bare `claude` has no stamp
-# and is still told to write one.
-mkdir -p "$WIP/handoffs/repoSS"
-SS_HO="$WIP/handoffs/repoSS/session-handoff-2026-09-12-lane-repoSS-1.md"
-printf 'Lane: repoSS-1 — single-use resume prompt\n\n# state\n' > "$SS_HO"
-export FAKE_TMUX_WINDOW_NAME=repoSS-1
-ss_run "$SS_CUR" resume
-has  "an UNSTAMPED handoff is still asked for Rule 3's stamp" "$out" "stamp the handoff RESUMED (Rule 3)"
-printf 'Lane: repoSS-1 — single-use resume prompt\nRESUMED by %s (lane repoSS-1) at 2026-09-12T20:00:00Z — lane-start on Eagle\n\n# state\n' "$SS_CUR" > "$SS_HO"
-ss_run "$SS_CUR" resume
-is   "…and one lane-start has already stamped says so instead, in clause (e)'s words" "$(printf '%s\n' "$out" | sed -n 2p)" "handoff already stamped by lane-start — follow its top block"
-hasnt "…so the block never manufactures a decision the launch already took" "$out" "stamp the handoff RESUMED (Rule 3) and follow"
-rm -rf -- "$WIP/handoffs"
-unset FAKE_TMUX_WINDOW_NAME
-
-# The row that carries only `session_…` FOOTER ids — 15 of the live register's
-# 42 — has no transcript uuid to mismatch AGAINST, so it is not one of clause
-# (e)'s two mismatches and must not be reported as one: the block says what the
-# row records, which is nothing this hook can check.
-export FAKE_TMUX_WINDOW_NAME=repoA-13
-ss_run "$SS_NEW" startup
-is    "a footer-only row's session start exits 0" "$rc" 0
-has   "…and gets the bound block, because there are exactly TWO mismatches (F-T2)" "$out" "LANE repoA-13 — handoff"
-has   "…saying honestly that the row records no session it can read" "$out" "row session none recorded"
-hasnt "…and never a WARNING, which would be a third mismatch the amendment does not define" "$out" "WARNING:"
-
-# A lane named before the `<repo>-<n>` rule cannot be split on its last `-`.
-export FAKE_TMUX_WINDOW_NAME=browser-ui-repair
-ss_run "$SS_NEW" startup
-has  "a lane whose name is not <repo>-<n> is started through --dir, not by a bad split" "$out" "run: lane-start --no-launch --dir <path> browser-ui-repair"
-hasnt "…never 'browser-ui repair', which is a command that does the wrong thing" "$out" "browser-ui repair"
-unset FAKE_TMUX_WINDOW_NAME
-
-# A lane with no log of its own says so rather than reporting nothing open.
-"$E" add-row "| \`repoSS-2\` | harness \`$SS_CUR\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoSS/y.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW_NAME=repoSS-2
-ss_run "$SS_CUR" startup
-has  "a pre-cutover lane's block says where to look instead" "$out" "open: no log for repoSS-2 (pre-cutover lane)"
-unset FAKE_TMUX_WINDOW_NAME
-
-# RV-B4 — THE README QUOTES THE HOOK, and these are what keep it quoting it.
-# `README-lanes.md`'s `session-start` section had drifted to lines the code does
-# not print — a `— run: lane-start <repo> <n>` where the hook says `— exit this
-# session and run: lane-start repoSS 1`, no `unknown`-stamp sub-branch at all,
-# and not one example block carrying the `as of … (no fetch)` line Amendment
-# 8(e) requires on EVERY block — and nothing noticed, because no assertion in
-# this suite had ever read the document. A quoted line nobody reads is the same
-# defect as an untested sentence (RV-B2), one file over. Read from
-# `$LANE_MANUAL`, the run's own copy, which is the one a person opens.
-if [ -n "$LANE_MANUAL" ]; then
-# A MANUAL THAT IS NOT THERE IS A FAILURE NAMING IT, never an empty string the
-# assertions below then misread as a manual that says nothing (#186, T009).
-if [ -r "$LANE_MANUAL" ]; then ok "the lane manual is where the run's roots put it"
-else bad "the lane manual is where the run's roots put it" "no readable file at $LANE_MANUAL"; fi
-ss_doc="$(cat "$LANE_MANUAL" 2>/dev/null || :)"
-has  "the README states the subcommand's THIRD safety property, not just two" "$ss_doc" "It never writes, it never touches the network, and it always exits 0"
-has  "…and carries the line every block ends with" "$ss_doc" "as of 4m ago (no fetch)"
-has  "…quoting the superseded-transcript branch as the hook really prints it" "$ss_doc" "WARNING: this is a superseded transcript of lane repoSS-1; the live one is <U>; you resumed <V> — exit this session and run: lane-start repoSS 1"
-has  "…its \`unknown\`-stamp sub-branch, which sends the reader to the RECORDING act" "$ss_doc" "which the row records as \`unknown\` — a relaunch would record nothing either, so run: lane-start --no-launch repoSS 1"
-has  "…the in-no-row branch, its command filled in too" "$ss_doc" "this session <V> is in no row — the harness minted a new transcript — run: lane-start --no-launch repoSS 1"
-has  "…and the third bound-branch line, the one Rule 3's stamp is owed on" "$ss_doc" "stamp the handoff RESUMED (Rule 3) and follow its top block"
-hasnt "…never the drifted spelling, which no branch of the hook has ever printed" "$ss_doc" "whose current session is <U>; you resumed <V> — run: lane-start <repo> <n>"
-else
-  skip "the manual quotes the session-start hook (seven assertions)" "no spec root in this run: docs/README-lanes.md is the spec leg's (#186, T009)"
-fi
-
-# ------------------------------------------------- Rule 1's sibling reads
-#
-# Measured live on 2026-09-12 against the governing repository: `gh pr list
-# --search 15` answered with PR #16 and PR #10 — GitHub had matched the digits
-# inside "**15 of the register's 41 rows**" — and `ls-remote | grep 15` answered
-# with a branch whose SHA merely contains them. TWO READS, TWO TESTS, because
-# the two inputs are not the same kind of text.
-
-# `gh pr list`'s rows are PROSE, so a reference is `#<n>` and a bare number is
-# not one. The `#`'s LEFT side is unbounded on purpose: the canonical spelling
-# is `owner/repo#15` and the character before the `#` is a letter — the reason
-# the columns-only filter dropped the real PR for this very issue.
-SIB_PR="$(printf '15\tthe amendment 8 work\tlanes/a8\tOPEN\tthis body says nothing\n10\tbump the pin to 1150\tchore/pin\tMERGED\t15 of the register rows carry no uuid\n7\tsomething else\tfix/x\tOPEN\tGoverning issue: opensoft/repoE#15. three pieces in parallel\n8\tanother\tfix/y\tOPEN\tcloses #150 and nothing else\n')"
-out="$(printf '%s\n' "$SIB_PR" | "$E" sibling-filter "opensoft/repoE#15" 2>/dev/null)"; rc=$?
-is    "sibling-filter exits 0" "$rc" 0
-has   "…keeping the row whose own number IS the object" "$out" "15	the amendment 8 work"
-has   "…and the row whose BODY names owner/repo#15, where a LETTER precedes the #" "$out" "7	something else"
-hasnt "…dropping the row that merely says 15 in prose, which is what the old read returned" "$out" "1150"
-hasnt "…and the one that names a longer number" "$out" "8	another"
-
-# `ls-remote`'s refs are NAMES: `issue-15-fix` names the object and carries no
-# hash, so the bare number as a whole token is the test — after the sha, which
-# is 40 characters of digits nobody meant, has been taken off the front.
-SIB_BR="$(printf '0000000000000000000000000000000000000015\trefs/heads/unrelated\nabc123def4560000000000000000000000000000\trefs/heads/issue-15-fix\n1111111111111111111111111111111111111111\trefs/heads/topic-150\n')"
-out="$(printf '%s\n' "$SIB_BR" | "$E" sibling-filter --branch "opensoft/repoE#15" 2>/dev/null)"
-has   "a branch NAMED for the object is kept, by the bare number" "$out" "refs/heads/issue-15-fix"
-hasnt "…with the sha stripped, so a branch is matched by its name and never by its commit" "$out" "abc123def456"
-hasnt "…and a branch whose SHA merely contains the digits is dropped" "$out" "refs/heads/unrelated"
-hasnt "…as is one whose name carries a longer number" "$out" "topic-150"
-out="$(printf '%s\n' "$SIB_BR" | "$E" sibling-filter "opensoft/repoE#15" 2>/dev/null)"
-hasnt "…and the pr test would have dropped that branch, which is why there are two" "$out" "issue-15-fix"
-
-# An OpenSpec change directory has a word for a slug and takes the whole-token
-# test in either mode, with the slug's own regex characters quoted.
-out="$(printf 'x add.thing y\nx addXthing y\n' | "$E" sibling-filter "opensoft/repoE:openspec/changes/add.thing" 2>/dev/null)"
-has   "an OpenSpec change is matched by its own slug" "$out" "x add.thing y"
-hasnt "…and not by a name that merely matches it with '.' read as any character" "$out" "addXthing"
-run   "$E" sibling-filter --nope "opensoft/repoE#1"
-is    "an unknown option is refused" "$rc" 2
-
-
-# =========================================================================
-# AMENDMENT 8, RULING (g) — WHOSE SESSION IS THIS?
-#
-# Live, on 2026-09-12: `lane-start --no-launch openRepoProject 1` REFUSED in the
-# very window whose own session was running it. Two records carried one
-# `sessionId` — the pane's `kind: interactive` process, and a `kind: bg`
-# companion with no `tmux` and no `nameSource` — and `live_holder` returned the
-# COMPANION, whose target read `none`, which is not this window, so the lane was
-# refused to itself:
-#
-#   lane openRepoProject-1 is live in session c5701b54… (tmux none);
-#   take openRepoProject-2 or resume that window
-#
-# The companion also carried the LATER `updatedAt` of the two (…975177 against
-# …958137), so recency picks exactly the wrong record. Identity decides:
-# `$CLAUDE_CODE_SESSION_ID`, then the window, then this pane's process tree.
-# -------------------------------------------------------------------------
-
-# Two live processes: one stands in for the pane's own, the other is alive and
-# under no pane at all. Both are children of this shell, so neither is under the
-# OTHER — which is exactly the distinction the ruling turns on.
-sleep "$LIVE_SLEEP" & G_PANE=$!
-g_pane_start="$(cut -d' ' -f22 "/proc/$G_PANE/stat" 2>/dev/null || printf '')"
-sleep "$LIVE_SLEEP" & G_OUT=$!
-g_out_start="$(cut -d' ' -f22 "/proc/$G_OUT/stat" 2>/dev/null || printf '')"
-
-# The fields the older helpers never write: `kind`, an ABSENT `tmux` (which is
-# what the harness really writes for a companion — not the string "null"), and
-# `updatedAt`. `-` means "omit this key entirely".
-write_record_g() { # <file> <sessionId> <pid> <procStart> <kind> <tmux|-> <name> <nameSource|-> <updatedAt>
-  g_f="$1"; g_sid="$2"; g_pid="$3"; g_start="$4"; g_kind="$5"
-  g_tgt="$6"; g_name="$7"; g_src="$8"; g_upd="$9"
-  g_t=""; [ "$g_tgt" = "-" ] || g_t="$(printf ',"tmux":"%s"' "$g_tgt")"
-  g_ns=""; [ "$g_src" = "-" ] || g_ns="$(printf ',"nameSource":"%s"' "$g_src")"
-  printf '{"pid":%s,"sessionId":"%s","cwd":"x","procStart":"%s","kind":"%s"%s,"name":"%s"%s,"status":"busy","updatedAt":%s}\n' \
-    "$g_pid" "$g_sid" "$g_start" "$g_kind" "$g_t" "$g_name" "$g_ns" "$g_upd" > "$g_f"
-  return 0
-}
-g_clear() { rm -f "$sessions_dir"/g-*.json; return 0; }
-
-# ---- R-A8-6: THE ORPHANED HOLDERS ARE NAMED, AND NOTHING IS EVER KILLED ----
-#
-# A row's session cell is a history and its EARLIER ids are history, not
-# alternatives — but a live process can still be holding one, which is Amendment
-# 6(d)'s orphan and the whole reason this lane's `/resume` picker offered two
-# transcripts of which neither was the lane. `idle-holders` answers about ALL of
-# them; `lane-start` prints each with the exact act, `kill <pid>`; and clause
-# (f) rules the running of it the operator's, because an idle background session
-# is exactly the shape of thing that turns out to be somebody's long-running job.
-IH_OLD="aaaa000f-1111-4000-8000-aaaa000f1111"
-IH_CUR="aaaa000f-2222-4000-8000-aaaa000f2222"
-printf '{"type":"user"}\n' > "$tdir/$IH_CUR.jsonl"
-"$E" add-row "| \`repoIH-1\` | harness \`$IH_OLD\` → harness $IH_CUR (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoIH/x.md | ACTIVE |" >/dev/null 2>&1
-
-run   "$E" idle-holders repoIH-1
-is    "with no record at all, idle-holders answers 8 — none, not a failed read" "$rc" 8
-
-write_record_g "$sessions_dir/g-ih-orphan.json" "$IH_OLD" "$LIVE_PID" "$live_start" "bg" "-" "repoih-1" "-" 3000
-run   "$E" idle-holders repoIH-1
-is    "a live \`kind: bg\` record holding an EARLIER id is an orphan" "$rc" 0
-is    "…named with its session, pid, kind and profile, one per line" "$out" "$(printf '%s\t%s\tbg\tt1' "$IH_OLD" "$LIVE_PID")"
-
-run   "$START" --dir "$HOME/projects/repoA" repoIH-1 --no-launch
-is    "…and lane-start reports it without refusing the launch" "$rc" 0
-has   "…with the exact retire act, which is the real one" "$err" "retire it: kill $LIVE_PID"
-has   "…and the profile beside it, so a person can check before running it" "$err" "kind bg, profile t1"
-has   "…saying what the earlier ids are" "$err" "history, not alternatives"
-is    "…having killed nothing: the record is where it was" \
-      "$([ -f "$sessions_dir/g-ih-orphan.json" ] && printf present || printf absent)" present
-is    "…and the process it names is still alive" "$(kill -0 "$LIVE_PID" 2>/dev/null && printf alive || printf gone)" alive
-
-# `who` IS THE SECOND READER (R-A8-6): the SAME orphan, named to everyone else
-# who asks who holds this lane's object — not only the operator about to take
-# it. The log line is written directly (as the repoJ-1/repoJ-2 fixtures above
-# do), never through `claim`: the earlier `rm -rf -- "$WIP/handoffs"` fixture
-# cleanup left the checkout with an unstaged deletion outside this test's
-# control, and `claim` would refuse to write against any dirty checkout,
-# whoever dirtied it. Writing the log line and pushing it directly proves the
-# same thing `print_holder_detail` proves for any other reader: `who` is
-# reading a real committed line, not a local artifact of this process.
-{ printf '# lane repoIH-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED — lane repoIH-1, session %s@Eagle, 2026-09-12T00:00:00Z, opensoft/repoIH#1\n' "$IH_CUR"
-} > "$LOGD/repoIH-1.md"
-git -C "$WIP" add -- lanes/log/repoIH-1.md
-git -C "$WIP" commit -q -m "fixture: repoIH-1 holds an object, for who's second-reader test"
-git -C "$WIP" push -q origin main
-
-run   "$E" who "opensoft/repoIH#1"
-is    "who finds it" "$rc" 0
-has   "…and the SECOND reader names the very same orphan" "$out" "idle     lane repoIH-1 — an EARLIER session id of this row is still held"
-has   "…with its session, pid, kind and profile" "$out" "session $IH_OLD, pid $LIVE_PID (kind bg, profile t1)"
-has   "…and the exact retire act, which is the real one" "$out" "History, not an alternative — retire it: kill $LIVE_PID"
-hasnt "…and never an \`end pid\` subcommand, because there is none" "$out" "end pid"
-is    "…still having killed nothing" \
-      "$([ -f "$sessions_dir/g-ih-orphan.json" ] && printf present || printf absent)" present
-is    "…and the process it names is still alive" "$(kill -0 "$LIVE_PID" 2>/dev/null && printf alive || printf gone)" alive
-
-# The cell's LAST id is the lane, and a lane is never an orphan of itself.
-g_clear
-write_record_g "$sessions_dir/g-ih-cur.json" "$IH_CUR" "$LIVE_PID" "$live_start" "bg" "-" "repoih-1" "-" 3000
-run   "$E" idle-holders repoIH-1
-is    "the cell's LAST id is the lane, never one of its own orphans" "$rc" 8
-
-# A live INTERACTIVE record IN a window is a rival, which is live-holder's
-# question, not this one's.
-g_clear
-write_record_g "$sessions_dir/g-ih-rival.json" "$IH_OLD" "$LIVE_PID" "$live_start" "interactive" "ihsess:@4.%4" "repoih-1" "derived" 3000
-run   "$E" idle-holders repoIH-1
-is    "a live session IN a window is a rival, not an orphan" "$rc" 8
-g_clear
-
-GH_ID="cccc000c-1111-4000-8000-cccc000c1111"
-printf '{"type":"user"}\n' > "$tdir/$GH_ID.jsonl"
-"$E" add-row "| \`repoGH-1\` | s \`$GH_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoGH/x.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW="gwsess:@3" FAKE_TMUX_PANE_PID="$G_PANE"
-US_SEP="$(printf '\037')"
-
-# -- (g)(2)(3) the incident itself: one session, two records ------------------
-g_clear
-write_record_g "$sessions_dir/g-interactive.json" "$GH_ID" "$G_PANE" "$g_pane_start" \
-  interactive "gwsess:@3.%3" "openrepoproject-45" derived 1789235958137
-write_record_g "$sessions_dir/g-companion.json"  "$GH_ID" "$G_OUT"  "$g_out_start" \
-  bg - "repoGH-1" - 1789235975177
-run "$E" live-holder repoGH-1
-is    "one session's two records: live-holder still answers 0" "$rc" 0
-has   "…and the verdict is 'here', not a refusal" "$out" "${US_SEP}here"
-has   "…reporting the INTERACTIVE record, which is the one in the window" "$out" "gwsess:@3.%3"
-hasnt "…never the companion, whose updatedAt is the NEWER of the two" "$out" "${US_SEP}none${US_SEP}"
-has   "…and the companion is named on stderr as what it is" "$err" "companion records, which are never holders"
-has   "…by its kind" "$err" "kind bg"
-
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "lane-start does NOT refuse the window its own session is running in" "$rc" 0
-has   "…it recognises the session as this window's own" "$err" "already holds repoGH-1"
-hasnt "…and never prints the refusal that fired on 2026-09-12" "$err" "take repoGH-2"
-
-# -- (g) addendum: a bg record is never a holder, even alone ------------------
-g_clear
-write_record_g "$sessions_dir/g-companion.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  bg - "repoGH-1" - 1789235975177
-run "$E" live-holder repoGH-1
-is    "a bg record ALONE is not a holder at all" "$rc" 8
-# AMENDMENT 18(h) MOVED THIS ONE'S EXIT CODE AND NOTHING ELSE IT SAYS, and the
-# two rules meeting here are both still true of it. A `bg` record is still NOT A
-# HOLDER — `live-holder` answers 8 one case above, nothing says the lane is live,
-# and the rival refusal is still absent (Amendment 8, ruling (g)) — and that is
-# a fact about the LANE. 18(h) is about the TRANSCRIPT: this run's next act is
-# `claude --resume <the row's id>`, a live process already carries that file,
-# and the clause says *"it never appends such an id to the row and never
-# launches a second resume of it"* (ratified 2026-09-14T13:15:18Z as revision 4;
-# opensoft/openRepoTools#39's own incident IS a resume of a transcript a live
-# process held). Amendment 8(f)'s orphan sentence is not overturned by this and
-# does not reach it either: it rules on *"a row's EARLIER session ids … still
-# held by live but idle sessions"*, which nothing resumes; this is the id the
-# row ENDS on, which is the one the next `lane-start` opens. The cure is 6(d)'s
-# act through the tooling — `lane-end <lane> --retire <pid>`, which proves the
-# process is this lane's duplicate and kills nothing — where 8(f) printed a bare
-# `kill`, and #39 is the issue that asked for the difference.
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "…so it cannot refuse the LANE either — but its transcript is not resumed under one (18(h))" "$rc" 1
-hasnt "…and nothing claims the lane is live" "$err" "is live in session"
-has   "…the refusal being about the file two processes would write" "$err" "another live process already carries transcript $GH_ID"
-has   "…and naming the retire act, never a kill" "$err" "lane-end repoGH-1 --retire <pid>"
-
-# -- (g)(1) the env var the harness exports beats every other test ------------
-g_clear
-write_record_g "$sessions_dir/g-envonly.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  interactive - "somewhere-else" - 1000
-run env CLAUDE_CODE_SESSION_ID="$GH_ID" "$E" live-holder repoGH-1
-is    "CLAUDE_CODE_SESSION_ID names this session: exit 0" "$rc" 0
-has   "…and the verdict is 'here' though it has no tmux and no pane-tree pid" "$out" "${US_SEP}here"
-run   "$E" live-holder repoGH-1
-has   "…while without it the very same record is an ORPHAN, not a rival" "$out" "${US_SEP}orphan"
-
-# -- (g)(3) tmux absent + pid under this pane = this window's session ---------
-g_clear
-write_record_g "$sessions_dir/g-nulltmux.json" "$GH_ID" "$G_PANE" "$g_pane_start" \
-  interactive - "openrepoproject-45" derived 1000
-run "$E" live-holder repoGH-1
-is    "a record with NO tmux whose pid is in this pane's tree: exit 0" "$rc" 0
-has   "…is this window's own session" "$out" "${US_SEP}here"
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "…and lane-start carries on in it" "$rc" 0
-has   "…naming it as this window's" "$err" "already holds repoGH-1"
-
-# -- (g)(3) tmux absent + pid under NO pane = an orphan, reported not refused --
-g_clear
-write_record_g "$sessions_dir/g-orphan.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  interactive - "repoGH-1" - 1000
-run "$E" live-holder repoGH-1
-is    "a live record in no window and no pane tree: still exit 0" "$rc" 0
-has   "…but the verdict is 'orphan'" "$out" "${US_SEP}orphan"
-# THE SAME LINE MOVED BY THE SAME CLAUSE, and Amendment 8(f)'s whole reading is
-# still asserted below it: the orphan is REPORTED, named as "not a rival", given
-# 6(d)'s act, and the rival refusal ("take repoGH-2") is still absent — the lane
-# is NOT taken by it. What 18(h) stops is the line after that report, where this
-# run used to go on and `--resume` the very transcript the orphan is holding.
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "lane-start does not refuse a LANE over an orphan — and does not resume the transcript it holds (18(h))" "$rc" 1
-has   "…it reports it with Amendment 6(d)'s act, which is the real one" "$err" "retire it: kill $G_OUT"
-hasnt "…and never an \`end pid\` subcommand, because there is none" "$err" "end pid"
-has   "…saying what it is" "$err" "orphaned holder, not a rival"
-hasnt "…and never the rival refusal" "$err" "take repoGH-2"
-has   "…while the refusal it DOES make names the transcript, not the lane" "$err" "another live process already carries transcript $GH_ID"
-has   "…and the retire act, which is 6(d)'s through the tooling" "$err" "lane-end repoGH-1 --retire <pid>"
-
-# -- (g)(4) a REAL rival in another window is still a refusal -----------------
-g_clear
-write_record_g "$sessions_dir/g-rival.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  interactive "othersess:@9.%9" "repoGH-1" derived 1000
-run "$E" live-holder repoGH-1
-has   "a live record in ANOTHER window is 'elsewhere'" "$out" "${US_SEP}elsewhere"
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "…and that is the one case that still refuses" "$rc" 2
-has   "…naming the window that holds it" "$err" "is live in session"
-
-# -- 18(h) AND THE HARNESS'S OWN FENCE ON THE SAME FILE -----------------------
-#
-# MEASURED ON EAGLE 2026-09-15 against `claude` 2.1.270, in a scratch
-# configuration directory with a hand-made transcript and one fake record: a
-# `claude --resume <id>` whose id is carried by a live record whose `kind` is
-# anything but `interactive` prints
-#
-#   Error: Session <id> is running as a background session. Run `claude agents`
-#   to find its id, then `claude attach <id>` to open it, or `claude stop <id>`
-#   first to resume it here. Add --fork-session to branch off a copy instead.
-#
-# and exits 1 WITHOUT STARTING. The same probe with `"kind":"interactive"` got
-# past that check and failed later, on authentication — so a second INTERACTIVE
-# process on one transcript is a state the harness permits and only this tooling
-# refuses (18(h)), and a BACKGROUND one is a launch that cannot happen at all.
-#
-# THE COST OF NOT ASKING IT IS A FALSE `RESUMED`: the row, the object log and
-# the handoff stamp are written BEFORE the `exec`, so the lane is recorded as
-# resumed by a session that never started, and in a launcher-made window tmux
-# prints `[exited]` over the message and closes it — which is the defect this
-# lane was handed on 2026-09-15 ("pclaude --lane … exits and destroys the
-# window, AFTER lane-start records the lane").
-
-# IT IS A FENCE ON AN `exec`, SO IT IS ASKED WHERE ONE HAPPENS. Every case
-# below LAUNCHES — the fake `claude` logs its argv — because `--no-launch` and
-# `--dry-run` hand the harness nothing and must go on behaving exactly as
-# Amendment 8 ruling (g) has them behave (the two cases above this one).
-
-# (a) NOBODY HOLDS IT: the exact id is resumed, which is the control for the two
-#     refusals below.
-g_clear
-: > "$FAKE_CLAUDE_LOG"
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1
-is    "with no live record at all the row's id is resumed" "$rc" 0
-is    "…by id, never by title" "$(launch_of "$(cat "$FAKE_CLAUDE_LOG")")" "--name repoGH-1 --resume $GH_ID"
-
-# (b) A LIVE BACKGROUND SESSION ON THE ID, IN ANOTHER TMUX SESSION: refused
-#     BEFORE the launch, with where it is and how to open it.
-g_clear
-: > "$FAKE_CLAUDE_LOG"
-write_record_g "$sessions_dir/g-bgjob.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  bg "othersess:@9.%9" "repoGH-1" - 1000
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1
-is    "a live BACKGROUND session on that id refuses before the launch" "$rc" 1
-has   "…naming it" "$err" "a live BACKGROUND session already carries transcript $GH_ID"
-has   "…and what the harness itself would do with the launch" "$err" "would REFUSE to start against it"
-has   "…in the harness's own words" "$err" "is running as a background session"
-has   "…with the harness's own remedy" "$err" "claude attach <id>"
-has   "…and the window it is in, as a command to type" "$err" "tmux switch-client -t othersess:@9"
-has   "…beside this estate's retire act" "$err" "lane-end repoGH-1 --retire <pid>"
-is    "…and nothing is launched" "$(cat "$FAKE_CLAUDE_LOG")" ""
-
-# …and `--no-launch` in that same state opens no transcript, so it is 18(h)'s
-# count alone that answers there, exactly as it did before this fence.
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "…while --no-launch is still 18(h)'s own refusal and not the harness's" "$rc" 1
-has   "…naming the second process" "$err" "another live process already carries transcript $GH_ID"
-hasnt "…and not a launch nobody was making" "$err" "would REFUSE to start against it"
-
-# (c) THE SAME WINDOW, AND NOTHING ELSE: today's behaviour, unchanged. A lane
-#     whose own interactive session is in this window is resumed by id, and
-#     `--resume` attaches to the same conversation.
-g_clear
-: > "$FAKE_CLAUDE_LOG"
-write_record_g "$sessions_dir/g-here.json" "$GH_ID" "$G_PANE" "$g_pane_start" \
-  interactive "gwsess:@3.%3" "repoGH-1" user 1000
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1
-is    "the lane live in THIS window is still not a collision" "$rc" 0
-is    "…and is resumed by its own id" "$(launch_of "$(cat "$FAKE_CLAUDE_LOG")")" "--name repoGH-1 --resume $GH_ID"
-
-# (d) …AND ITS `bg` COMPANION IS THE ONE THING THAT STOPS THAT LAUNCH, because
-#     the harness reads the KIND and not this tooling's verdict: a companion is
-#     `one session seen twice` here (Amendment 8 ruling (g), and it is still not
-#     a rival) and a background holder there.
-: > "$FAKE_CLAUDE_LOG"
-write_record_g "$sessions_dir/g-companion2.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  bg - "repoGH-1" - 1000
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1
-is    "…but its bg COMPANION is a launch the harness would refuse, so this one does" "$rc" 1
-has   "…naming the kind that decides it" "$err" "kind bg"
-hasnt "…and never as a rival for the LANE, which it is not" "$err" "is live in session"
-is    "…nothing launched" "$(cat "$FAKE_CLAUDE_LOG")" ""
-run   "$START" --dir "$HOME/projects/repoA" repoGH-1 --no-launch
-is    "…and the binding act in that very window is untouched by it (ruling (g))" "$rc" 0
-has   "…it is still this window's own session" "$err" "already holds repoGH-1"
-g_clear
-
-# -- (g) window-session: the pane tree beats the newer record ----------------
-#
-# THE SIXTH COMMIT'S RULE, CORRECTED. `updatedAt` is a liveness HEARTBEAT, so
-# the record that beats on last is not the record at the keyboard — in the real
-# 2026-09-12 pair it was the idle companion. Identity decides; recency only
-# separates two records of the same tier.
-g_clear
-write_record_g "$sessions_dir/g-ws-newer.json" "aaaa000c-9999-4000-8000-aaaa000c9999" "$G_OUT" "$g_out_start" \
-  interactive "gwsess:@3.%3" "stale-but-chatty" derived 9999999999
-write_record_g "$sessions_dir/g-ws-here.json"  "$GH_ID" "$G_PANE" "$g_pane_start" \
-  interactive - "openrepoproject-45" derived 1000
-run "$E" window-session "gwsess:@3"
-is    "window-session: exit 0" "$rc" 0
-has   "…the record in THIS pane's process tree wins" "$out" "$GH_ID"
-hasnt "…even though the other names the window and updated far later" "$out" "aaaa000c-9999"
-
-# …and asked about SOMEBODY ELSE'S window, neither the env var nor this pane's
-# tree may answer: those two tests are about this window and nothing else.
-run env CLAUDE_CODE_SESSION_ID="$GH_ID" "$E" window-session "farsess:@42"
-is    "window-session about another window ignores this pane entirely" "$rc" 8
-
-# -- (g) window-session skips a companion even if one names a window ---------
-g_clear
-write_record_g "$sessions_dir/g-ws-bg.json" "$GH_ID" "$G_OUT" "$g_out_start" \
-  bg "gwsess:@3.%3" "repoGH-1" - 5000
-run "$E" window-session "gwsess:@3"
-is    "a bg record that names a window is still not what is IN it" "$rc" 8
-
-g_clear
-unset FAKE_TMUX_WINDOW FAKE_TMUX_PANE_PID
-kill "$G_PANE" "$G_OUT" 2>/dev/null || :
-
-# =========================================================================
-# AMENDMENT 8, RULING (h) — THE WRITER NEVER BLOCKS THE ESTATE
-#
-# On 2026-09-12 at ~01:44Z an ssh `git-receive-pack` hung for five minutes AFTER
-# its push had landed, with a `lanes-edit.sh` row write inside it holding
-# the mutex the whole time. Every lane on Eagle was blocked until the ssh was
-# killed by hand.
-# -------------------------------------------------------------------------
-
-H_LOCK="$WIP/lanes/.lanes-edit.lock"
-# Handed to `LANES_GIT`, so it bounds ONLY the network calls — shadowing `git`
-# on PATH would change every other call this suite makes.
-cat > "$SANDBOX/hanggit" <<'FAKE'
-#!/usr/bin/env bash
-for a in "$@"; do
-  if [ "$a" = push ]; then sleep 30; exit 0; fi
-done
-exec git "$@"
-FAKE
-cat > "$SANDBOX/peekgit" <<'FAKE'
-#!/usr/bin/env bash
-for a in "$@"; do
-  if [ "$a" = push ]; then cat "$PEEK_LOCK/pid" > "$PEEK_OUT" 2>/dev/null || :; fi
-done
-exec git "$@"
-FAKE
-chmod +x "$SANDBOX/hanggit" "$SANDBOX/peekgit"
-
-run env LANES_GIT="$SANDBOX/hanggit" LANES_GIT_TIMEOUT=2 "$E" set-row-state repoGH-1 "LIVE · HUNGPUSH"
-if [ "$HAVE_TIMEOUT" = 1 ]; then
-  is    "a push that hangs past the timeout exits 3" "$rc" 3
-  has   "…saying so, with the budget it was given" "$err" "TIMED OUT after 2s"
-  has   "…and that the mutex is not held through it" "$err" "the mutex is released"
-  has   "…telling the writer a hung push may have LANDED before it looks again" "$err" "often means it LANDED"
-else
-  skip  "a push that hangs past the timeout exits 3" "$NO_TIMEOUT_WHY"
-  skip  "…saying so, with the budget it was given" "$NO_TIMEOUT_WHY"
-  skip  "…and that the mutex is not held through it" "$NO_TIMEOUT_WHY"
-  skip  "…telling the writer a hung push may have LANDED before it looks again" "$NO_TIMEOUT_WHY"
-fi
-is    "…the lock is released, not left for the next lane to age out" "$([ -d "$H_LOCK" ] && printf held || printf free)" "free"
-has   "…and the edit is safe as a local commit" "$(git -C "$WIP" log --oneline -n1)" "HUNGPUSH"
-has   "…which is the row, really written" "$(grep '^| `repoGH-1`' "$LANES")" "HUNGPUSH"
-
-# The lock names its holder, and a lock whose holder is DEAD is stale at once —
-# not ten minutes later, which is how long every other writer used to wait.
-sleep 0.05 & H_DEAD=$!
-wait "$H_DEAD" 2>/dev/null || :
-mkdir -p "$H_LOCK"; printf '%s\n' "$H_DEAD" > "$H_LOCK/pid"
-run "$E" set-row-state repoGH-1 "LIVE · AFTERDEADLOCK"
-is    "a lock whose holder is dead is taken over" "$rc" 0
-has   "…with one line saying whose it was" "$err" "taking over"
-has   "…and naming the pid that is gone" "$err" "(pid $H_DEAD) is gone"
-has   "…the write then happens" "$(grep '^| `repoGH-1`' "$LANES")" "AFTERDEADLOCK"
-
-# A lock whose holder is ALIVE is not stealable, and the writer records its own
-# pid in it — proved from inside the critical section, by a `git` that reads the
-# lock while the push is running.
-PEEK_LOCK="$H_LOCK" PEEK_OUT="$SANDBOX/peek.pid" \
-  env PEEK_LOCK="$H_LOCK" PEEK_OUT="$SANDBOX/peek.pid" LANES_GIT="$SANDBOX/peekgit" \
-  "$E" set-row-state repoGH-1 "LIVE · PEEK" >/dev/null 2>&1 || :
-h_peek="$(cat "$SANDBOX/peek.pid" 2>/dev/null || printf '')"
-# THE `case` IS HOISTED OUT OF THE `$( )`, and it has to be (A9 Addendum 4,
-# R-A9-11). Bash 3.2's parser reads the `)` that closes a case PATTERN as the
-# one that closes the command substitution, so this exact expression is a
-# syntax error on macOS and nowhere else: the job answered `command
-# substitution: line 3284: syntax error near unexpected token 'newline'` and
-# the assertion then compared a fragment of THIS FILE'S OWN SOURCE against
-# `yes`. Same test, one variable earlier.
-case "$h_peek" in ''|*[!0-9]*) h_peek_ok=no ;; *) h_peek_ok=yes ;; esac
-is    "the lock carries the holder's pid while the holder is inside it" \
-      "$h_peek_ok" "yes"
-
-mkdir -p "$H_LOCK"; printf '%s\n' "$LIVE_PID" > "$H_LOCK/pid"
-h_t0=$SECONDS
-# BOTH OF THESE ARE THE SUITE'S OWN USE OF `timeout`, and where there is none
-# they were not merely red — they were GREEN AND MEANINGLESS. `timeout 3 …`
-# failed as `command not found`, so `$SANDBOX/h.err` was empty, `grep -c`
-# answered 0, the elapsed time was zero, and both assertions passed having
-# tested nothing at all. The writer WAITS on a live lock by design, so with no
-# bound available this case cannot be run at all rather than run unbounded and
-# hang the suite behind its own fixture.
-if [ "$HAVE_TIMEOUT" = 1 ]; then
-  timeout 3 "$E" set-row-state repoGH-1 "LIVE · NEVER" >/dev/null 2>"$SANDBOX/h.err" || :
-  is    "a lock whose holder is ALIVE is not taken over" "$(grep -c 'taking over' "$SANDBOX/h.err" || :)" "0"
-  # …and a signal STOPS the writer. `trap cleanup EXIT INT TERM` ran the handler
-  # and then resumed the wait: measured, SIGTERM at 8s and the process still going
-  # at 56s, with the lock already released under it.
-  is    "…and a SIGTERM ends it there and then, instead of resuming the wait" \
-        "$(( SECONDS - h_t0 < 15 ))" "1"
-else
-  skip  "a lock whose holder is ALIVE is not taken over" "$NO_TIMEOUT_WHY"
-  skip  "…and a SIGTERM ends it there and then, instead of resuming the wait" "$NO_TIMEOUT_WHY"
-fi
-rm -rf "$H_LOCK"
-
-# =========================================================================
-# #32 — `commit_push` NAMES THE ATTEMPT THAT ACTUALLY LANDED, NEVER AN
-# EARLIER ONE ORIGIN HAS SINCE OVERTAKEN.
-#
-# Observed on Eagle, three to four times in one hour on 2026-09-13/14 while
-# several lanes wrote the register concurrently: `set-row-state` /
-# `append-line` printed "rebase conflict on origin/main — nothing was
-# pushed" for a commit that WAS on origin by the time anyone read the line —
-# carried out by the very next lanes-edit.sh write through this same shared
-# checkout, which pulls this dangling local commit onto its own and pushes
-# both together. A caller who trusted "nothing was pushed" and redid the
-# write wrote a duplicate line (issue #32). The second clone plays the peer
-# that moves origin between this invocation's own commit and its push,
-# exactly as it does for the lost-claim race above.
-#
-# THIS SANDBOX'S OWN CHECKOUT IS ALREADY DIRTY, from the rejectgit cases
-# above (a stamp whose push or pull was faked to fail leaves its commit
-# local, and the fixture files those cases wrote are still uncommitted
-# where their own act never got to commit them) — real content, and none of
-# it this section's. `dirty_elsewhere` would read it as "someone else's
-# uncommitted file" and route every case below through Amendment 5(d)'s
-# skip-the-pull branch instead of the rebase this section means to exercise,
-# so it is committed first, exactly as its own author would.
-# -------------------------------------------------------------------------
-if [ -n "$(git -C "$WIP" diff --name-only 2>/dev/null)" ]; then
-  git -C "$WIP" add -u -- .
-  git -C "$WIP" commit -q -m "fixture cleanup: commit content earlier cases left uncommitted, before the #32 race/conflict cases"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-fi
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-RC_ID="aaaa0005-c0c0-4000-8000-aaaa0005c0c0"
-"$E" add-row "| \`repoRC-1\` | harness \`$RC_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRC/x.md | ACTIVE |" >/dev/null 2>&1
-
-# -- a race a LATER attempt wins: not a conflict, and the message must name
-#    the attempt that actually pushed, never attempt 1's rejection — and the
-#    retry must not write the row's own text twice.
-RACE_FLAG="$SANDBOX/race-peer-landed"
-rm -f -- "$RACE_FLAG"
-cat > "$SANDBOX/racegit" <<FAKE
-#!/usr/bin/env bash
-# Plays the second workstation, landing its own commit in the exact window
-# the retry loop exists for: after this attempt's own pull --rebase has
-# already succeeded and just before its push, so the push is rejected and
-# the NEXT attempt's own pull --rebase is what actually meets the peer.
-for a in "\$@"; do
-  if [ "\$a" = push ] && [ ! -e "$RACE_FLAG" ]; then
-    touch "$RACE_FLAG"
-    git -C "$CLONE2" pull -q --rebase origin main >/dev/null 2>&1
-    printf 'CLAIMED — lane repoH-2, session %s@Raven, %s, opensoft/repoH#92\n' \
-      "$DEAD_ID" "\$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "$CLONE2/lanes/log/repoH-2.md"
-    git -C "$CLONE2" add -- lanes/log/repoH-2.md
-    git -C "$CLONE2" commit -q -m "LOG(repoH-2@Raven): lands between this attempt's pull and its push"
-    git -C "$CLONE2" push -q origin main >/dev/null 2>&1
-  fi
-done
-exec git "\$@"
-FAKE
-chmod +x "$SANDBOX/racegit"
-
-run env LANES_GIT="$SANDBOX/racegit" "$E" set-row-state repoRC-1 "LIVE · RACE-RETRY-WINS"
-is    "a peer landing between this attempt's pull and its push still exits 0" "$rc" 0
-has   "…the message names attempt 2, the one that actually pushed" "$err" "pushed origin/main (attempt 2)"
-hasnt "…never claiming attempt 1 pushed it" "$err" "pushed origin/main (attempt 1)"
-is    "…and the retry writes the row's text once, never twice" "$(grep -c 'RACE-RETRY-WINS' "$LANES")" 1
-
-# -- a race the rebase truly cannot resolve: the peer rewrote the SAME row.
-#    `rebase --abort` must leave the tree clean, the message must say so
-#    truthfully, and — because a write that runs after this one carries the
-#    dangling commit out regardless of what conflicted here — it must say to
-#    LOOK before resetting or redoing anything, the same rule RV-B3 took for
-#    the handoff stamp's own push in `lane-start`.
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-PC_LINE="$(grep -n '^| `repoRC-1`' "$CLONE2/lanes/LANES.md" | head -n1 | cut -d: -f1)"
-PC_ROW="$(sed -n -e "${PC_LINE}p" "$CLONE2/lanes/LANES.md")"
-PC_TMP="$(mktemp -d)/pre"
-cat -- "$CLONE2/lanes/LANES.md" > "$PC_TMP"
-{ [ "$PC_LINE" -gt 1 ] && head -n "$((PC_LINE - 1))" -- "$PC_TMP"
-  printf '%s\n' "${PC_ROW%|}· PEER-CONFLICT |"
-  tail -n "+$((PC_LINE + 1))" -- "$PC_TMP"
-} > "$CLONE2/lanes/LANES.md"
-git -C "$CLONE2" add -- lanes/LANES.md
-git -C "$CLONE2" commit -q -m "LANES(repoRC-1@Raven): peer rewrites the same row"
-git -C "$CLONE2" push -q origin main
-
-run "$E" set-row-state repoRC-1 "LIVE · OURS-CONFLICT"
-is    "a peer's rewrite of the SAME row is a real conflict: exit 3" "$rc" 3
-has   "…REBASE CONFLICT is still named" "$err" "REBASE CONFLICT on origin/main"
-has   "…the abort runs and says the tree is clean" "$err" "rebase ABORTED — the worktree is clean and NOT mid-rebase"
-is    "…and it really is clean" "$(git -C "$WIP" status --porcelain | grep -c .)" 0
-has   "…told to fetch before resetting or redoing anything" "$err" \
-      "fetch origin main || echo FETCH-FAILED"
-has   "…and STOP named for a FAILED fetch too, never treated as leave to redo" "$err" \
-      "if that printed FETCH-FAILED, STOP and retry — a stale or unreachable origin proves nothing either way"
-
-# Copilot's round-4 review of #50 (5203455553): the very peer write this
-# recovery exists for carries a dangling commit by REBASING it onto a newer
-# base — which the branch just above this one takes — and a rebase changes
-# the commit's sha without changing its patch. `merge-base --is-ancestor
-# $cp_sha …` (round 2's own fix) checks the OLD sha, so it can still answer
-# "not-there" once the change is published under a new one. `git cherry`
-# compares by PATCH, so it finds it either way; verified against a real bare
-# repo for a peer-rebased commit (0, correctly ALREADY THERE — where
-# `merge-base --is-ancestor` on the same sha answered "not-there"), a
-# genuinely local-only one (1, correctly not-there), and a fetch against a
-# bad remote (FETCH-FAILED, cherry never run against a stale ref).
-has   "…checked by CONTENT (git cherry), never by a sha a peer's rebase can change" "$err" \
-      "cherry origin/main"
-cp_sha_printed="$(printf '%s\n' "$err" | grep -oE 'cherry origin/main [0-9a-f]{7,40}' | head -n1 | awk '{print $3}')"
-is    "…naming a real local commit to check, not a placeholder" \
-      "$([ -n "$cp_sha_printed" ] && printf 'has-sha' || printf 'MISSING')" "has-sha"
-has   "…counting only the patches git cherry could not find upstream" "$err" \
-      "grep -c '^+'"
-has   "…the reset is now conditional on that look, not unconditional" "$err" \
-      "only if it is not there: read back exactly what you wrote"
-has   "…and the die itself is scoped to this attempt, never a permanent claim" "$err" \
-      "not pushed by this attempt; a later write from this checkout may already carry it"
-hasnt "…never the old unconditional claim an aborted pull cannot prove" "$err" \
-      "rebase conflict on origin/main — nothing was pushed."
-pc_fetch="$(printf '%s\n' "$err" | grep -n -- 'fetch origin main || echo FETCH-FAILED' | head -n1 | cut -d: -f1)"
-pc_look="$(printf '%s\n' "$err" | grep -n -- 'cherry origin/main' | head -n1 | cut -d: -f1)"
-pc_reset="$(printf '%s\n' "$err" | grep -n -- 'reset --hard origin/main' | head -n1 | cut -d: -f1)"
-is    "…fetched, THEN checked by content, THEN reset — the same order RV-B3 pins" \
-      "$([ -n "$pc_fetch" ] && [ -n "$pc_look" ] && [ -n "$pc_reset" ] && [ "$pc_fetch" -lt "$pc_look" ] && [ "$pc_look" -lt "$pc_reset" ] && printf 'ordered' || printf "fetch $pc_fetch, look $pc_look, reset $pc_reset")" "ordered"
-
-# Copilot's review of #50 (5202640056), suppressed comment on lanes-edit.sh:1180:
-# the gate above was attached only to the diagnostic `diff` line — a caller
-# whose fetch/look just showed the commit already on origin was still told, by
-# the next two unconditional lines, to reset and redo, which is the exact
-# duplicate this PR exists to prevent. A single STOP between the look and the
-# reset gates all three lines below it (diff, reset, redo) at once, the same
-# job the existing "only if it is not there" qualifier does for the diff line
-# alone.
-has   "…and told to STOP there instead of resetting or redoing a landed commit" "$err" \
-      "if that printed 0, STOP — reset or redo now would write it a second time."
-pc_stop="$(printf '%s\n' "$err" | grep -n -- 'STOP — reset or redo now' | head -n1 | cut -d: -f1)"
-is    "…the STOP sits between the look and the reset, gating both reset and redo" \
-      "$([ -n "$pc_look" ] && [ -n "$pc_stop" ] && [ -n "$pc_reset" ] && [ "$pc_look" -lt "$pc_stop" ] && [ "$pc_stop" -lt "$pc_reset" ] && printf 'ordered' || printf "look $pc_look, stop $pc_stop, reset $pc_reset")" "ordered"
-
-# Suite housekeeping: this conflict is real and stays real (the peer's row
-# rewrite is still on origin), so nothing later inherits this section's own
-# dangling commit — and nothing later finds $WIP behind the peer's push
-# either, which every case below this one assumes it never is. Fully synced
-# to the CURRENT origin/main (the abort's own fetch already has it), not
-# merely one commit back from wherever HEAD happened to be.
-git -C "$WIP" fetch -q origin main 2>/dev/null || :
-git -C "$WIP" reset --hard origin/main >/dev/null 2>&1
-
-# --------------------------------------- the pointer file, when it does NOT answer
-#
-# AMENDMENT 9(a): "Failing to find it is a refusal, never a guess." Six ways it
-# can fail, each with its own sentence, and every one of them is exit 1 — the
-# code `lanes-edit.sh` has always used for `registry not found` and the code the
-# amendment quotes. Until these cases existed, six diagnoses were computed and
-# every one was thrown away in a subshell: what a person actually saw was "no
-# reason recorded", for all six, in all four helpers.
-#
-# THE YAML IS SAVED AND RESTORED around this block. Every case above it depends
-# on the sandbox's own valid pointer file, and a test that broke it and walked
-# away would take the rest of the suite with it.
-WS_YAML="$AGENT_PROTOCOL_ROOT/workspace.yaml"
-WS_YAML_SAVED="$SANDBOX/workspace.yaml.saved"
-cp -- "$WS_YAML" "$WS_YAML_SAVED"
-
-# SETS TWO VARIABLES; IT DOES NOT PRINT. A function's assignments survive into
-# its caller, but a command substitution's do not — `msg="$(ws_refusal …)"`
-# would run this in a SUBSHELL and take `$WS_RC` down with it, which is the
-# exact defect these cases exist to pin in the helpers themselves.
-WS_MSG=""; WS_RC=0
-ws_run() {
-  WS_MSG="$("$@" 2>&1 >/dev/null)"
-  WS_RC=$?
-}
-
-FOREIGN="$SANDBOX/foreign"
-git init -q -b main "$FOREIGN"
-git -C "$FOREIGN" remote add origin "https://github.com/opensoft/not-your-wip.git"
-
-for helper in lanes-edit.sh lane-start lane-end link-estates; do
-  case "$helper" in
-  lanes-edit.sh) args=(who --lane repoA-1) ;;
-  lane-start)    args=(repoA 9) ;;
-  lane-end)      args=(repoA-1) ;;
-  # `--dry-run` rather than no argument at all: the refusal is reached before
-  # anything is linked either way, and an EMPTY array under `set -u` is an
-  # unbound-variable error on the bash 3.2 this repository still ships for.
-  link-estates)  args=(--dry-run) ;;
-  esac
-
-  rm -f -- "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses with exit 1 when there is no workspace.yaml" "$WS_RC" 1
-  has  "…and names the file that is missing" "$WS_MSG" "there is no $WS_YAML"
-  has  "…and names the one command that writes it" "$WS_MSG" "openRepoTools wip init"
-
-  printf 'path: %s\n' "$WIP" > "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses a workspace.yaml with no repository:" "$WS_RC" 1
-  has  "…saying which key is missing" "$WS_MSG" "names no \`repository:\`"
-
-  printf 'repository: %s\n' "$ORIGIN" > "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses a workspace.yaml with no path:" "$WS_RC" 1
-  has  "…saying which key is missing" "$WS_MSG" "names no \`path:\`"
-
-  { printf 'repository: %s\n' "$ORIGIN"; printf 'path: %s/nowhere\n' "$SANDBOX"; } > "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses a path: that is not a git checkout" "$WS_RC" 1
-  has  "…saying so in those words" "$WS_MSG" "which is not a git checkout"
-
-  { printf 'repository: %s\n' "$ORIGIN"; printf 'path: %s\n' "$FOREIGN"; } > "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses a path: that is a checkout of something ELSE" "$WS_RC" 1
-  has  "…naming both repositories" "$WS_MSG" "is a checkout of"
-
-  { printf 'repository: %s\n' "$ORIGIN"; printf 'path: %s/lanes\n' "$WIP"; } > "$WS_YAML"
-  ws_run "$helper" "${args[@]}"
-  is   "$helper refuses a path: that is a SUBDIRECTORY, not the root" "$WS_RC" 1
-  has  "…naming the root it should have been" "$WS_MSG" "not the ROOT of that checkout"
-
-  hasnt "$helper never prints \`no reason recorded\`" "$WS_MSG" "no reason recorded"
-done
-
-# AND IT NEVER GUESSES. With no pointer file at all, no helper falls back to a
-# path derived from its own location — which is what Amendment 9(a) retired,
-# and what an installed command in ~/.local/bin could not do anyway.
-rm -f -- "$WS_YAML"
-ws_run lanes-edit.sh who --lane repoA-1
-hasnt "the refusal names no path derived from the command's own location" \
-      "$WS_MSG" "$OPENREPOTOOLS_BIN_DIR/lanes"
-
-cp -- "$WS_YAML_SAVED" "$WS_YAML"
-is   "the sandbox's own pointer file is restored for the guards below" \
-     "$(sed -n 's/^path:[[:space:]]*//p' "$WS_YAML" | head -n1)" "$WIP"
-
-section "== Amendment 11: the record's fields, and clause (h)'s reads =="
-
-# THE SHAPE EVERY CASE BELOW IS ABOUT, in one place: a lane whose log carries
-# clause (c)'s three sub-fields, and a live window table for the reads that
-# fence on a window still existing.
-A11_ID="bbbb0001-1111-4000-8000-bbbb00011111"
-A11_ID2="bbbb0002-2222-4000-8000-bbbb00022222"
-A11_DIR="$HOME/projects/repoA11"
-mkdir -p "$A11_DIR"
-# AND THE SPELLING `pwd -P` GIVES IT, which on macOS is not the same string:
-# `$TMPDIR` there is under `/var`, a symlink to `/private/var`, so every case
-# that asserts a path a command RESOLVED must assert the resolved one. `lane`
-# resolves `--dir` ONCE, where the operator typed it, because it `cd`s and then
-# hands the same string to a launcher that would resolve it a second time from
-# somewhere else — so a `--dir` case compares against this and a case reading
-# the RECORD's own path compares against `$A11_DIR`, which is never resolved.
-# Asserting the sandbox's own spelling for a resolved path is asserting that
-# the resolution did not happen, which is the one thing it must do; caught by
-# `tests-macos` on #45, where the two `--dir` assertions were the only red.
-# AFTER THE `mkdir`, because `cd` into a directory that does not exist yet
-# falls back to the unresolved spelling and is the same defect written twice.
-A11_DIR_R="$(cd -- "$A11_DIR" 2>/dev/null && pwd -P || printf '%s' "$A11_DIR")"
-git init -q -b main "$A11_DIR"
-git -C "$A11_DIR" remote add origin "https://github.com/opensoft/repoA11.git"
-add_seed_row "| \`repoA11-1\` | harness \`$A11_ID\` → after /clear \`$A11_ID2\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/x.md | ACTIVE |"
-add_seed_row "| \`repoA11-2\` | pending — set by the session's first act | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/y.md | ACTIVE |"
-add_seed_row "| \`repoA11-3\` | harness \`$A11_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/z.md | ACTIVE |"
-{ printf '# lane repoA11-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11-1 → home opensoft/repoA11; estate repoA11; dir %s; profile team-05a; window a11sess:0 @71\n' "$A11_ID" "$A11_DIR"
-  printf 'PAUSED — lane repoA11-1, session %s@Eagle, 2026-09-12T10:00:00Z, lane:repoA11-1 → swap; window a11sess:0 @71; dir %s; profile team-05a; workstation Eagle\n' "$A11_ID2" "$A11_DIR"
-} > "$LOGD/repoA11-1.md"
-# A lane whose record was written before clause (c): no dir, no profile, no id.
-{ printf '# lane repoA11-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11-2, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11-2 → home opensoft/repoA11; estate repoA11\n' "$A11_ID"
-  printf 'PAUSED — lane repoA11-2, session %s@Eagle, 2026-09-12T10:30:00Z, lane:repoA11-2 → swap; window a11old:0; workstation Eagle\n' "$A11_ID"
-} > "$LOGD/repoA11-2.md"
-# The same window ref, recorded on ANOTHER workstation.
-{ printf '# lane repoA11-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane repoA11-3, session %s@Raven, 2026-09-12T10:00:00Z, lane:repoA11-3 → swap; window a11sess:0 @71; dir /elsewhere/repoA11; profile team-09z; workstation Raven\n' "$A11_ID"
-} > "$LOGD/repoA11-3.md"
-# A directory containing a SPACE, written quoted — clause (c)'s one rule rather
-# than its refusal.
-{ printf '# lane repoA11-4 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11-4, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11-4 → home opensoft/repoA11; estate repoA11; dir "%s/my projects/x"; profile team-05a; window a11sess:0 @71\n' "$A11_ID" "$HOME"
-} > "$LOGD/repoA11-4.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed Amendment 11 records"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# The workstation's live windows, for every read that fences on one existing.
-#   a11sess:0  is LIVE and still reports @71  — the record agrees with it
-#   a11live:0  is LIVE and reports @200       — a ref reused since the record
-#   a11gone:0  is in no line at all           — the window is gone
-export FAKE_TMUX_WINDOWS="$(printf 'a11sess:0\t@71\trepoA11-1\na11live:0\t@200\tclaude\na11named:0\t@88\trepoA11-2\n')"
-# A launcher dry run from the suite's separate `testsess` window must not
-# borrow a lane name already owned by @71. Tests of unrelated precedence and
-# workstation refusals use the same live refs with that other name generic.
-A11_WINDOWS_NO_LANE="$(printf 'a11sess:0\t@71\tclaude\na11live:0\t@200\tclaude\na11named:0\t@88\trepoA11-2\n')"
-
-# ---------------------------------------------------------------- lane-dir
-run "$E" lane-dir repoA11-1
-is   "lane-dir exits 0 for a lane whose log records one" "$rc" 0
-is   "…and prints the path the LAST lane-kind line carrying one names" "$out" "$A11_DIR"
-run "$E" lane-dir repoA11-2
-is   "lane-dir exits 8 for a lane started before clause (c) — no answer, not a failure" "$rc" 8
-is   "…and prints no path a caller could mistake for one" "$out" ""
-run "$E" lane-dir repoA11-4
-is   "lane-dir exits 0 for a path written QUOTED because it contains a space" "$rc" 0
-is   "…and hands it back whole, quotes stripped, rather than truncated at the space" "$out" "$HOME/my projects/x"
-# `lane-profile` IS `lane-dir` ONE SUB-FIELD ALONG, and it exists so that
-# `lane <name>` can learn a profile with ONE `git show` rather than through
-# the listing, which must read every log on the workstation for its held-objects
-# column — seventeen seconds on the live register, to answer one question about
-# one lane, on the path a person types to get back to work.
-run "$E" lane-profile repoA11-1
-is   "lane-profile exits 0 for a lane whose log records one" "$rc" 0
-is   "…and prints it" "$out" "team-05a"
-run "$E" lane-profile repoA11-2
-is   "lane-profile exits 8 for a lane started before clause (c)" "$rc" 8
-is   "…printing nothing a caller could launch with" "$out" ""
-run "$E" lane-profile
-is   "lane-profile with no lane exits 64, like its sibling" "$rc" 64
-
-run "$E" lane-dir
-is   "lane-dir with no lane exits 64, its own usage code and never the dispatcher's 2" "$rc" 64
-run "$E" lane-dir repoA11-1 repoA11-2
-is   "…and 64 for a second argument, for the same reason" "$rc" 64
-
-# A LOG THAT COULD NOT BE READ IS **1** AND NOT THE PRE-CUTOVER **8** (#26, the
-# review of `c3ebcfe`, `lanes-edit.sh:3525`). `lane_payload_field` read the
-# events inside the HERE-DOCUMENT that feeds its loop, where a command
-# substitution's status is discarded outright, so an unreadable log arrived as no
-# lines and left through `return 8` — the one code `restart`, `lane-start` and
-# both skills are entitled to read as "this lane has not started under Amendment
-# 11 yet" and to fall past. These two arms carry their siblings' `case` now.
-#
-# THE LOG IS MADE UNREADABLE FOR REAL rather than stubbed, because the defect is
-# INSIDE this file and a stub of `$E` would not exercise it. `LANES_NO_GIT=1`
-# forces the local branch of `lane_log_events` — with a remote ref present it
-# reads `git show`'s stdout, where a file mode cannot fail — and `awk` then
-# exits non-zero on the file it cannot open. Skipped for a root that can read it
-# anyway.
-if [ "$(id -u)" = 0 ]; then
-  skip "a log that cannot be read is a refusal and not 'no record'" "running as root, which can read a mode-000 file"
-else
-  chmod 000 "$LOGD/repoA11-1.md"
-  run env LANES_NO_GIT=1 "$E" lane-dir repoA11-1
-  is   "a lane-dir whose log could not be READ exits 1, never the pre-cutover 8" "$rc" 1
-  has  "…saying what that is NOT, in Amendment 7(d)'s words" "$err" "is NOT 'this lane has no recorded directory'"
-  run env LANES_NO_GIT=1 "$E" lane-profile repoA11-1
-  is   "…and its sibling the same, because a wrong profile is another account" "$rc" 1
-  has  "…naming the read and the code it came back with" "$err" "lane-profile could not read lane repoA11-1's log"
-  chmod 644 "$LOGD/repoA11-1.md"
-  # …AND THE PRE-CUTOVER 8 IS UNTOUCHED, so nothing that used to fall through
-  # refuses now: `repoA11-2` is the lane with no `dir` sub-field at all.
-  run env LANES_NO_GIT=1 "$E" lane-dir repoA11-2
-  is   "a readable log with no dir sub-field is still the contract's 8" "$rc" 8
-  run env LANES_NO_GIT=1 "$E" lane-dir repoA11-1
-  is   "…and a readable one still answers 0" "$rc" 0
-  is   "…with the same path it always gave" "$out" "$A11_DIR"
-fi
-
-# ------------------------------------------------------------ session-lane
-run "$E" session-lane "$A11_ID2"
-is   "session-lane exits 0 for a uuid the register's session cell names" "$rc" 0
-is   "…and prints that lane — the read Amendment 8(e)'s hook already made, exposed" "$out" "repoA11-1"
-run "$E" session-lane "$A11_ID"
-is   "…and answers for an EARLIER id in the same cell, which is a history and not an alternative" "$rc" 0
-run "$E" session-lane "cccc0000-9999-4000-8000-cccc00009999"
-is   "session-lane exits 8 for a uuid no row names" "$rc" 8
-is   "…printing nothing" "$out" ""
-# 64 AND NOT ADOPTION ACT 0'S 2 (A11 Addendum 4 ruling 1). `2` here is already
-# spoken for: it is what a helper with no `session-lane` exits from the `*)`
-# arm, which is every workstation until act 3's install arrives — and both of
-# this read's callers fail CLOSED on anything but 0 or 8, so telling "install
-# the helper" from "fix your call" is the whole of what they can report.
-run "$E" session-lane
-is   "session-lane with no uuid exits 64, like every other read in clause (h)" "$rc" 64
-has  "…naming what it takes" "$err" "usage: session-lane <transcript-uuid>"
-run "$E" session-lane "$A11_ID2" "$A11_ID"
-is   "…and 64 for a second argument it does not take" "$rc" 64
-has  "…saying it takes one" "$err" "takes one transcript uuid"
-# AND THE OTHER `2` IS STILL THE OTHER `2`: an unknown subcommand, which is how
-# a caller detects a helper predating the read it asked for.
-run "$E" session-lane-that-does-not-exist "$A11_ID2"
-is   "…while an unknown subcommand still exits 2, which is the OLD HELPER code" "$rc" 2
-has  "…and says so in its own words rather than in its status" "$err" "unknown subcommand"
-run "$E" session-lane "repoA11-1"
-is   "…and a name that is not a uuid is simply no answer: no row's session cell can contain it" "$rc" 8
-
-# ------------------------------------------------------------- window-lane
-run "$E" window-lane "a11named:0"
-is   "window-lane exits 0 where the WINDOW'S OWN NAME is a lane the register has a row for" "$rc" 0
-is   "…which is clause (b)'s precedence 2 read through the same door" "$out" "repoA11-2"
-run "$E" window-lane "@71"
-is   "window-lane exits 0 for an <@id> a live record names" "$rc" 0
-is   "…and prints the lane that record belongs to" "$out" "repoA11-1"
-run "$E" window-lane "Eagle" "a11sess:0"
-is   "…and 0 for the <session>:<index> where the window now holding it reports the recorded @id" "$rc" 0
-is   "…the same lane" "$out" "repoA11-1"
-# THE AGREEMENT RULE (A11 Addendum 2, `R-A11-8`/RV-T6). `a11live:0` exists NOW
-# and reports @200; nothing recorded it. Existing-now is not enough on its own:
-# a record naming `x:0 @97`, met from the window that has since taken `x:0` as
-# @200, passes the existing-now test on its ref and would bind the lane to a
-# STRANGER'S PANE with no question.
-{ printf '# lane repoA11-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane repoA11-5, session %s@Eagle, 2026-09-12T10:00:00Z, lane:repoA11-5 → swap; window a11live:0 @97; dir %s; profile team-05a; workstation Eagle\n' "$A11_ID" "$A11_DIR"
-} > "$LOGD/repoA11-5.md"
-add_seed_row "| \`repoA11-5\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/w.md | ACTIVE |"
-{ printf '# lane repoA11-6 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane repoA11-6, session %s@Eagle, 2026-09-12T10:00:00Z, lane:repoA11-6 → swap; window a11gone:0 @5; dir %s; profile team-05a; workstation Eagle\n' "$A11_ID" "$A11_DIR"
-} > "$LOGD/repoA11-6.md"
-add_seed_row "| \`repoA11-6\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/v.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed Amendment 11 disagreement and dead-window records"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$E" window-lane "a11live:0"
-is   "window-lane REFUSES a record whose @id disagrees with the window now holding its ref" "$rc" 8
-is   "…binding nothing, which is the whole of the fence" "$out" ""
-run "$E" window-lane "a11gone:0"
-is   "window-lane exits 8 for a ref that resolves to no window at all" "$rc" 8
-run "$E" window-lane "@5"
-is   "…and 8 for an <@id> tmux does not resolve, however plainly a record names it" "$rc" 8
-# THE WORKSTATION SCOPING (`R-A11-8`/RV-T7): a `<session>:<index>` is a local
-# fact about one machine, and repoA11-3's record spells exactly the same ref on
-# Raven.
-run "$E" window-lane "Raven" "a11sess:0"
-is   "window-lane asked about Raven answers from Raven's records" "$rc" 0
-is   "…and names Raven's lane, not this workstation's, for the very same ref" "$out" "repoA11-3"
-run "$E" window-lane
-is   "window-lane with no ref exits 64" "$rc" 64
-run "$E" window-lane "Eagle"
-is   "…and 64 where the one argument is neither an @id nor a <session>:<index>" "$rc" 64
-has  "…saying which shapes it takes and that the workstation comes first" "$err" "window-lane [<workstation>] <ref>"
-
-# ------------------------------------------------------------ last-session
-run "$E" last-session repoA11-1
-is   "last-session exits 0 for a lane whose cell names uuids" "$rc" 0
-is   "…and prints the LAST one, which is what Amendment 6(b) resumes" "$out" "$A11_ID2"
-run "$E" last-session repoA-13
-is   "last-session reads a cell of ANY shape — this one holds only PR-footer ids" "$rc" 8
-run "$E" last-session repoA11-2
-is   "last-session falls to the LANE'S OWN LOG where the cell names no uuid" "$rc" 0
-is   "…taking the session field of its last PAUSED or RESUMED line" "$out" "$A11_ID"
-run "$E" last-session
-is   "last-session with no lane exits 64" "$rc" 64
-
-# -------------------------------------- swapped's fourth and fifth fields
-run "$E" swapped Eagle
-is   "swapped exits 0 with Amendment 11's records in the log" "$rc" 0
-A11_ROW="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "repoA11-1" { print; exit }')"
-is   "…and the row's FOURTH field is the recorded directory" "$(printf '%s' "$A11_ROW" | cut -f4)" "$A11_DIR"
-is   "…its FIFTH the recorded profile" "$(printf '%s' "$A11_ROW" | cut -f5)" "team-05a"
-is   "…and its THIRD carries the window's two refs, <session>:<index> and <@id>" \
-     "$(printf '%s' "$A11_ROW" | cut -f3)" "a11sess:0 @71"
-A11_ROW2="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "repoA11-2" { print; exit }')"
-is   "a record written before clause (c) has an EMPTY fourth field rather than a guessed one" \
-     "$(printf '%s' "$A11_ROW2" | cut -f4)" ""
-
-# ----------------------------------------------------- the workstation name
-#
-# DECISION 8(d) AS CORRECTED BY `R-A11-14`. Evidence 6: `opensoft/brett-wip`
-# `origin/main` carries SIX log lines whose workstation is a container id, in an
-# append-only file, written by every writer inside that container. The VALUE is
-# the workBenches launcher's to export (`LANES_WORKSTATION`); these helpers READ
-# it; outside a container `hostname -s` stays the default; and INSIDE one with
-# no value every WRITER refuses rather than substituting a placeholder.
-A11_HOST="$(hostname -s 2>/dev/null || hostname)"
-run "$E" workstation
-is   "workstation exits 0" "$rc" 0
-is   "…and the seam wins, printing the name this suite pinned" "$(printf '%s' "$out" | cut -f1)" "Eagle"
-is   "…naming the rung that answered, so a reader can tell a configured name from a hostname" \
-     "$(printf '%s' "$out" | cut -f2)" "seam"
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=0 "$E" workstation
-is   "outside a container with no value, the host answers — which is what the seam has defaulted to since Amendment 6" \
-     "$(printf '%s' "$out" | cut -f1)" "$A11_HOST"
-is   "…and says so" "$(printf '%s' "$out" | cut -f2)" "hostname"
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 "$E" workstation
-is   "inside a container with no value the READ still answers, because a read in front of every launch may not refuse" "$rc" 0
-is   "…and names the case rather than the rung" "$(printf '%s' "$out" | cut -f2)" "container-unset"
-has  "…saying on stderr which variable is missing and who sets it" "$err" "LANES_WORKSTATION"
-# AND EVERY WRITER REFUSES THERE. One guard at the dispatcher, because `WS` is
-# built into every event line and every commit subject this file writes.
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 env LANES_LANE=repoA11-1 "$E" log RESUMED "lane:repoA11-1"
-is   "a WRITER inside a container with no configured workstation REFUSES" "$rc" 2
-has  "…naming the variable" "$err" "LANES_WORKSTATION"
-has  "…and saying why a container id is not a workstation" "$err" "is the CONTAINER"
-hasnt "…and writes nothing" "$(git -C "$WIP" log --format=%s -n1)" "RESUMED lane:repoA11-1"
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 "$E" register-row repoA11-1
-is   "…while a READ in the same container is untouched" "$rc" 0
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 FAKE_TMUX_WINDOWS="$A11_WINDOWS_NO_LANE" "$START" --dry-run repoA11 1
-is   "lane-start refuses there too, BEFORE the row and before the log" "$rc" 2
-has  "…in the same words, from the one place they are written" "$err" "LANES_WORKSTATION"
-run "$E" workstation Eagle
-is   "workstation takes no arguments, and says so with its own 64" "$rc" 64
-
-# ------------------------------- clause (c): the writer's OWN `, ` backstop
-#
-# THE SECOND SEPARATOR, WHICH WAS IN NO WRITER AT ALL (F-X12). `write_event`
-# refused a third ` — ` and a newline; `, ` divides the four FIELDS from each
-# other, and the payload is the tail of the fourth, so a `, ` inside it reads
-# back as fields no reader knows — in a file nothing ever rewrites. Measured
-# against every line this estate has before the guard was written: of 111
-# payloads in the 15 live lane logs, 0 carry `, ` and 0 carry `"`, while 76
-# carry `; `.
-# ON A LANE OF THEIR OWN, because two of these cases WRITE and what they write
-# is read by the `lane-start` directory cases far below: pointed at
-# `repoA11-1`, the quoted-path case left `dir "/a b/c"` as that lane's last
-# recorded directory and three later assertions failed with `no such directory:
-# /a b/c`. A fixture that changes what a later case reads is a fixture that has
-# to be its own.
-add_seed_row "| \`repoA11w-1\` | harness \`$A11_ID2\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/w.md | ACTIVE |"
-{ printf '# lane repoA11w-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11w-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11w-1 → home opensoft/repoA11; estate repoA11\n' "$A11_ID2"
-} > "$LOGD/repoA11w-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the clause (c) write cases their own lane"
-git -C "$WIP" push -q origin main
-run env LANES_LANE=repoA11w-1 "$E" log RESUMED "lane:repoA11w-1" '→' "swap; dir /a, b; workstation Eagle"
-is   "the writer refuses a ', ' in the payload — clause (c)'s other separator" "$rc" 2
-has  "…naming the four fields it would break" "$err" "session <uuid>@<ws>"
-has  "…and the separator that is legitimate there" "$err" "Use a semicolon"
-hasnt "…while writing nothing at all" "$(git -C "$WIP" log --format=%s -n1)" "RESUMED lane:repoA11w-1"
-# AND IT IS THE PAYLOAD ONLY. The free text is everything after the SECOND
-# ` — `, where the fields are already split, so prose commas are ordinary there
-# — the estate's own log is full of them, and refusing them would refuse lines
-# it legitimately writes.
-#
-# THE TWO CASES BELOW ARE THE FIRST IN THIS SUITE THAT MUST ACTUALLY WRITE AT
-# THIS POINT, and the sandbox checkout is not clean here: the handoff cases far
-# above leave four tracked DELETIONS behind, so `refuse_dirty_checkout` refused
-# both with exit 2 and the guard under test was never reached. Committed first,
-# exactly as the Amendment 11 `lane-start` cases below already do for the same
-# reason — a fixture step, not a fix to anything under test.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit pending handoff edits before the clause (c) write cases" >/dev/null 2>&1 || :
-run env LANES_LANE=repoA11w-1 "$E" log RESUMED "lane:repoA11w-1" '→' "swap; workstation Eagle" "tick 8.4 landed, and 5.7a, 5.9a stay unheld"
-is   "…while a comma in the FREE TEXT is ordinary prose and is written" "$rc" 0
-has  "…exactly as it was given" "$(tail -n1 "$LOGD/repoA11w-1.md")" "landed, and 5.7a, 5.9a stay unheld"
-# AND NOT THE `"`, BECAUSE CLAUSE (c) WRITES ONE. A path with a space is written
-# QUOTED — that is what makes it one ref under 7(b) — so a `"` refusal in the
-# whole-payload guard would refuse the shape the clause mandates.
-run env LANES_LANE=repoA11w-1 "$E" log RESUMED "lane:repoA11w-1" '→' 'swap; dir "/a b/c"; workstation Eagle'
-is   "…and a quoted path, which clause (c) requires for a space, still goes through" "$rc" 0
-has  "…with both quotes intact" "$(tail -n1 "$LOGD/repoA11w-1.md")" 'dir "/a b/c"'
-
-
-# ------------------ the `/restart` skill's own lines, RUN (F-X9, F-X10, F-X11)
-#
-# A SKILL IS PROSE NOTHING EXECUTES, which is the review's own F-X22: the rungs
-# are each tested as reads and the LADDER is held only by its own text. So the
-# one part of it that is arithmetic — rung 4's `<repo>` — is extracted FROM THE
-# FILE and run here, against the names this estate really has. Not a copy: a
-# copy is what would go on passing after the file drifted.
-RSKILL="$SRC_DIR/skills/restart/SKILL.md"
-skill_repo_of() {   # <lane> — evaluates the SKILL's own `tail=`/`case` block
-  local sro_lane="$1" sro_snip sro_out
-  sro_snip="$(awk '/^  tail="/,/^  esac$/' "$RSKILL")"
-  [ -n "$sro_snip" ] || { printf 'NO SNIPPET IN %s\n' "$RSKILL"; return 1; }
-  sro_out="$(lane="$sro_lane"; repo=""; eval "$sro_snip"; printf '%s' "$repo")"
-  printf '%s' "$sro_out"
-}
-# THE LANE THE OLD LINE GOT WRONG, and it is in this register today: SPEC rev 2
-# §0.8 lists `openxfactory-4-opendox-extraction`, for which `${lane%-*}` answered
-# `openxfactory-4-opendox` — a directory `$PROJECTS_ROOT` does not have, so rung
-# 4 handed `/restart` a `cd` target that cannot exist and the refusal below it
-# fired for the wrong reason.
-is "rung 4's <repo> leaves a lane with no position alone (F-X11)" \
-   "$(skill_repo_of openxfactory-4-opendox-extraction)" "openxfactory-4-opendox-extraction"
-is "…and still strips a real position" "$(skill_repo_of openRepoProject-1)" "openRepoProject"
-is "…including a lettered one, which is a position too" "$(skill_repo_of repoX-5a)" "repoX"
-is "…and a pre-rule name is its own repo" "$(skill_repo_of browser-ui-repair)" "browser-ui-repair"
-# IT IS `lane-start`'S RULE AND NOT A SECOND ONE. `lane-start:565-578` is the
-# WRITER of these names — `<repo>-<position>` with the position `[0-9]+[A-Za-z]?`,
-# and `:577`'s `repo="${repo:-$LANE}"` for a name that has none — so a reader
-# deriving a different `<repo>` from the same name would send `/restart` to a
-# directory the writer never used.
-hasnt "the skill no longer derives the directory with a bare \${lane%-*}" \
-      "$(cat "$RSKILL")" 'dir="$PROJECTS_ROOT/${lane%-*}"'
-# F-X10 — THE LITERAL THE WRITER REFUSES TO INVENT. `lane-start:1546-1560`:
-# "inventing `unknown` for it would be the same defect clause (e) refuses in the
-# session field", and it omits the sub-field instead. The skill wrote it into the
-# one cell Amendment 6(b) resumes from.
-hasnt "the skill invents no \`unknown\` profile (F-X10)" "$(cat "$RSKILL")" 'profile ${CLAUDE_PROFILE_NAME:-unknown}'
-has   "…it appends the sub-field only where there is a value" "$(cat "$RSKILL")" 'CLAUDE_PROFILE_NAME:-}" ] && cell='
-# F-X9 — THE WITHDRAWN RULING. `R-A11-12`: "Neither the window's name being the
-# lane nor `live-holder` answering `here` is a condition for taking." The skill
-# restated its twice-corrected predecessor two sections above the place it has
-# it right.
-hasnt "the skill no longer restates the withdrawn permission form (F-X9)" \
-      "$(cat "$RSKILL")" "proves ownership by the window's"
-has   "…and says what the vetoes actually do on the 4(c) path" \
-      "$(cat "$RSKILL")" "takes the window's live session **unless a veto fires**"
-
-# THE SKILL'S OWN FAIL-CLOSED FENCE, EXTRACTED AND RUN (#26's fail-closed
-# family; Brett Heap, "Take it first, then land"). Six reads in this file
-# collapsed every code into the ordinary case: `|| lane=""`, `|| dir=""`,
-# `&& lane="$win_name"`, and one that ignored the status altogether. Amendment
-# 7(d) gives `8` and `2` to the fall-through — no answer, and a helper predating
-# the read — and everything else to a read that FAILED, which may not bind a
-# window or write a stamp. `lread` is that rule, once, and these four cases run
-# THE FILE'S OWN COPY of it against a helper in each state.
-#
-# IT SETS A VARIABLE RATHER THAN PRINTING, and that is load-bearing: a refusal
-# inside `$( )` would kill only the substitution's subshell and the skill would
-# carry on with an empty answer — the same trap `lanes-edit.sh:673-676` names
-# for `row_line`.
-rskill_fence="$(awk '/^lread\(\) \{/,/^\}$/' "$RSKILL")"
-is   "the skill carries the fence its reads go through" \
-     "$( [ -n "$rskill_fence" ] && printf yes || printf no )" "yes"
-fence_probe() {   # <helper exit code> — runs the SKILL's own fence against it
-  printf '#!/usr/bin/env bash\nprintf "ANSWER\\n"\nexit %s\n' "$1" > "$SANDBOX/fencehelper"
-  chmod +x "$SANDBOX/fencehelper"
-  ( L="$SANDBOX/fencehelper"; eval "$rskill_fence"
-    v=unset; lread v "'a thing it is not'" some-verb 2>"$SANDBOX/fence.err"
-    printf 'rc=%s v=[%s]' "$?" "$v" )
-}
-is   "an answer reaches the variable" "$(fence_probe 0)" "rc=0 v=[ANSWER]"
-is   "…8 is NO ANSWER and falls to the next rung" "$(fence_probe 8)" "rc=0 v=[]"
-is   "…2 is a helper predating the read and falls through too" "$(fence_probe 2)" "rc=0 v=[]"
-is   "…and a read that FAILED stops the skill where it stands" "$(fence_probe 6)" ""
-has  "…naming the read and the code it came back with" "$(cat "$SANDBOX/fence.err")" "some-verb\` failed (exit 6)"
-has  "…and saying what that is NOT, in Amendment 7(d)'s words" "$(cat "$SANDBOX/fence.err")" "a read that failed is never an answer"
-
-# #34 — THE FENCE'S OWN STDERR IS KEPT, MINUS THE ONE SENTENCE THIS READ ASKS
-# FOR (Copilot's final round on #26, review 5194970614; the third site of the
-# shape `lanes` and `restart` took at `29d3417`). `2>/dev/null` was written
-# when the only thing on that stream was `LANES_NO_FETCH=1 — not fetching …`,
-# on every local read — which is why the whole stream was silenced. Anything
-# else there, on a read that still ANSWERED, used to be thrown away with it.
-printf '#!/usr/bin/env bash\nprintf "LANES_NO_FETCH=1 — not fetching; reading origin/main as the ref already stands here\\n" >&2\nprintf "ANSWER\\n"\nexit 0\n' > "$SANDBOX/fencehelper"
-chmod +x "$SANDBOX/fencehelper"
-( L="$SANDBOX/fencehelper"; eval "$rskill_fence"
-  v=unset; lread v "'a thing it is not'" some-verb 2>"$SANDBOX/fence2.err"
-  printf 'rc=%s v=[%s]' "$?" "$v" ) > "$SANDBOX/fence2.out"
-is   "the known no-fetch notice still reaches the variable, not the person" \
-     "$(cat "$SANDBOX/fence2.out")" "rc=0 v=[ANSWER]"
-is   "…the notice itself is dropped from stderr" "$(grep -c 'not fetching' "$SANDBOX/fence2.err")" 0
-
-printf '#!/usr/bin/env bash\nprintf "session records for this workstation could not be read: permission denied\\n" >&2\nprintf "ANSWER\\n"\nexit 0\n' > "$SANDBOX/fencehelper"
-chmod +x "$SANDBOX/fencehelper"
-( L="$SANDBOX/fencehelper"; eval "$rskill_fence"
-  v=unset; lread v "'a thing it is not'" some-verb 2>"$SANDBOX/fence3.err"
-  printf 'rc=%s v=[%s]' "$?" "$v" ) > "$SANDBOX/fence3.out"
-is   "a read that still ANSWERS is unaffected by its own other stderr" \
-     "$(cat "$SANDBOX/fence3.out")" "rc=0 v=[ANSWER]"
-has  "…and that other line reaches the person now, never dropped with the notice" \
-     "$(cat "$SANDBOX/fence3.err")" "session records for this workstation could not be read"
-
-# Copilot's round-1 review of #53 (5202775204): the fence's OWN `grep -v
-# 'pattern' -- "$file"` puts the PATTERN before `--`, so a NON-PERMUTING
-# getopt — BSD's, and every macOS shell — reads the pattern as the first
-# OPERAND and then reads `--` itself as a second one, a FILENAME (the exact
-# anti-pattern tests/test_repo_hygiene.py names for `sed` and `grep` alike,
-# just on a file that hygiene test does not walk: SKILL.md is not in
-# ALL_BASH). GNU grep hides this by PERMUTING; `POSIXLY_CORRECT=1` turns that
-# off and reproduces the same failure right here, no macOS runner needed —
-# measured against the unfixed line, this exact case printed `grep: --: No
-# such file or directory` to stderr and prefixed the real line with the temp
-# file's own name, because grep then believed there were two files.
-( L="$SANDBOX/fencehelper"; eval "$rskill_fence"
-  export POSIXLY_CORRECT=1
-  v=unset; lread v "'a thing it is not'" some-verb 2>"$SANDBOX/fence3b.err"
-  printf 'rc=%s v=[%s]' "$?" "$v" ) > "$SANDBOX/fence3b.out"
-is   "…and under a NON-PERMUTING getopt (BSD's shape) the read still answers" \
-     "$(cat "$SANDBOX/fence3b.out")" "rc=0 v=[ANSWER]"
-is   "…the other line reaches the person UNPREFIXED, exactly as the helper wrote it" \
-     "$(cat "$SANDBOX/fence3b.err")" "session records for this workstation could not be read: permission denied"
-hasnt "…and grep itself never errors on \`--\` as though it were a missing file" \
-     "$(cat "$SANDBOX/fence3b.err")" "No such file or directory"
-
-# #54 part a — `lanes`' OWN LOCAL READ HAD THE SAME LINE (#53 fixed the one in
-# the file above, and `lane`'s copy already carries the `-e`; this was the last
-# one without it). Its stderr is kept minus the one no-fetch sentence, through
-# `grep -v 'pattern' -- file`, and with the pattern a bare operand a
-# non-permuting getopt reads `--` as a second FILE. The stub says the notice
-# AND another line, the way the helper does when this workstation's session
-# records are unreadable, and exits 8 — "no lane" — which is the shortest way
-# through the command that still reaches the filter. `POSIXLY_CORRECT=1` is the
-# same stand-in for BSD's `grep` the case above uses: measured against the
-# unfixed line, this case printed `grep: --: No such file or directory` and put
-# the temp file's own name in front of the real line.
-cat > "$SANDBOX/lanesfence" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes)
-    printf 'LANES_NO_FETCH=1 — not fetching; reading origin/main as the ref already stands here\n' >&2
-    printf 'session records for this workstation could not be read: permission denied\n' >&2
-    exit 8 ;;
-esac
-exit 0
-WRAP
-chmod +x "$SANDBOX/lanesfence"
-lanes_fence_rc=0
-( cd -- "$SANDBOX" && POSIXLY_CORRECT=1 LANES_EDIT="$SANDBOX/lanesfence" \
-    "$OPENREPOTOOLS_BIN_DIR/lanes" </dev/null >/dev/null 2>"$SANDBOX/lanesfence.err" ) || lanes_fence_rc=$?
-is    "lanes under a NON-PERMUTING getopt (BSD's shape) still answers, \"no lane\" being its 8" "$lanes_fence_rc" 8
-is    "…and the other stderr line reaches the person UNPREFIXED, exactly as the helper wrote it" \
-      "$(cat "$SANDBOX/lanesfence.err")" "session records for this workstation could not be read: permission denied"
-hasnt "…grep itself never errors on \`--\` as though it were a missing file" \
-      "$(cat "$SANDBOX/lanesfence.err")" "grep: --:"
-hasnt "…and the known no-fetch notice is still dropped from it" \
-      "$(cat "$SANDBOX/lanesfence.err")" "not fetching"
-
-# AND WITH NO CAPTURE FILE AT ALL, NOTHING IS FILTERED — silence in place of a
-# stream this fence could not open would be the same defect the notice fix
-# exists to correct, only quieter.
-( L="$SANDBOX/fencehelper"; eval "$rskill_fence"
-  mktemp() { return 1; }
-  v=unset; lread v "'a thing it is not'" some-verb 2>"$SANDBOX/fence4.err"
-  printf 'rc=%s v=[%s]' "$?" "$v" ) > "$SANDBOX/fence4.out"
-is   "with no capture file, the read still answers" "$(cat "$SANDBOX/fence4.out")" "rc=0 v=[ANSWER]"
-has  "…and everything on stderr reaches the person, filtered or not" \
-     "$(cat "$SANDBOX/fence4.err")" "session records for this workstation could not be read"
-
-# AND EVERY READ IN THE FILE GOES THROUGH IT: none of the four old shapes is left.
-hasnt "no read is left on \`|| lane=\"\"\`" "$(cat "$RSKILL")" '2>/dev/null)" || lane=""'
-hasnt "…nor on \`|| dir=\"\"\`" "$(cat "$RSKILL")" '2>/dev/null)" || dir=""'
-hasnt "…nor on \`|| cell_last=\"\"\`" "$(cat "$RSKILL")" '2>/dev/null)" || cell_last=""'
-hasnt "…nor on a bare && that cannot tell 8 from 1" "$(cat "$RSKILL")" '>/dev/null 2>&1 && lane="$win_name"'
-has   "…and step 4 refuses a lane the register does not carry, before anything is written" \
-      "$(cat "$RSKILL")" "this skill binds an existing lane and never creates one"
-
-# AND THE DERIVED DEFAULT IS NOT A REFUSAL WHERE IT IS NOT THERE (#26, the
-# review of `c3ebcfe`, `skills/restart/SKILL.md:152`). Step 3's fallback is a
-# SECOND COPY of `lane-start`'s rung 4 and of nothing else; `708395e` gave that
-# ladder rungs 5 and 6 for EVIDENCE 7 — the estate's `project.yaml` legs and a
-# checkout named for the lane's recorded home, each proved by that directory's
-# own `origin` — and the paragraph below the step has said since then that
-# "step 5 resolves it and this step never fires". It fired first: the step
-# refused for the very lane those rungs can prove. The block is EXTRACTED AND
-# RUN, against a `$PROJECTS_ROOT` that has one of the two repositories.
-rskill_dirblk="$(awk '/^if \[ -z "\$dir" \]; then/,/^fi$/' "$RSKILL")"
-is   "the skill carries step 3's fallback block" \
-     "$( [ -n "$rskill_dirblk" ] && printf yes || printf no )" "yes"
-mkdir -p "$SANDBOX/proots/repoA11"
-skill_dir_of() {   # <lane> — evaluates the SKILL's own step 3 fallback
-  ( lane="$1"; PROJECTS_ROOT="$SANDBOX/proots"; dir=""
-    eval "$rskill_dirblk"; printf '%s' "$dir" )
-}
-is   "step 3 derives \$PROJECTS_ROOT/<repo> where that checkout is there" \
-     "$(skill_dir_of repoA11-1)" "$SANDBOX/proots/repoA11"
-is   "…and derives NOTHING where it is not, so lane-start's rungs 5 and 6 are reached" \
-     "$(skill_dir_of opsXfactory-5)" ""
-has  "…which is why step 5 passes --dir only where step 3 has one" \
-     "$(cat "$RSKILL")" 'lane-start --no-launch ${dir:+--dir "$dir"} "$lane"'
-hasnt "…and never the unconditional flag, which put a GUESS at rung 1" \
-      "$(cat "$RSKILL")" 'lane-start --no-launch --dir "$dir" "$lane"'
-
-
-# ------------------------------------------- decision 8(e): a FORK is a DEFECT
-#
-# Evidence 6: an abandoned launch left a `--fork-session` daemon orchestrating
-# the same plan, relaunching writers on the same branches and writing the lane's
-# log under an id no row carries, while telling the interactive session it was
-# the holder. A fork copies the parent's `custom-title` record, so its
-# transcript says the lane's name while its id says something the row has never
-# heard of — and that pair is the defect.
-FORK_ID="dddd0001-f0f0-4000-8000-dddd0001f0f0"
-fork_tdir="$HOME/.claude/projects/$(sanitize "/workspace")"
-mkdir -p "$fork_tdir"
-printf '{"type":"custom-title","customTitle":"repoA-1","sessionId":"%s"}\n' "$FORK_ID" > "$fork_tdir/$FORK_ID.jsonl"
-printf '{"pid":%s,"sessionId":"%s","cwd":"/workspace","procStart":"%s","kind":"bg","name":"openrepoproject-b9","status":"busy"}\n' \
-  "$LIVE_PID" "$FORK_ID" "$live_start" > "$sessions_dir/live-fork.json"
-run "$E" forks repoA-1
-is   "forks exits 0 where a live fork of the lane's transcript is running" "$rc" 0
-has  "…naming the fork's own id, which is in no row" "$out" "$FORK_ID"
-has  "…and the directory it is running in, which is not the lane's" "$out" "/workspace"
-run "$E" who --lane repoA-1
-has  "who --lane calls it a DEFECT rather than a holder" "$out" "DEFECT"
-# F-X8 — THE ONE ACT, AND IT IS THE TEXT'S OWN. Clause (k) rule (e): *"both
-# print the one act: retire it … Neither kills a process … and `lane-end`'s
-# `--retire` is the door."* Every surface printed something else: a READ, a
-# "Name them", or `kill <pid>` — which is the one act the ruling says neither
-# prints.
-has   "…and prints clause (k) rule (e)'s one act, filled in" "$out" "lane-end repoA-1 --retire $LIVE_PID"
-hasnt "…and never \`kill <pid>\`, which the ruling refuses by name" "$out" "kill $LIVE_PID"
-run "$E" live-holder repoA-1
-hasnt "live-holder never returns a fork as the holder" "$out" "$FORK_ID"
-has   "…and says on stderr that one is live, because a read that cannot return it could otherwise hide it" "$err" "live FORK"
-has   "…printing the same one act as every other surface" "$err" "lane-end repoA-1 --retire $LIVE_PID"
-hasnt "…and not the kill" "$err" "kill $LIVE_PID"
-# THE TWO LISTINGS, WITH THE FORK STILL LIVE — the surfaces F-X8 names besides
-# the reads. `$LANES_CMD` and `$LANE` are bound further down; the bin
-# directory is where `--install` puts them and is what those bindings use.
-run env LANES_NO_FETCH=1 "$OPENREPOTOOLS_BIN_DIR/lanes" --all
-has   "the estate listing prints the act rather than only naming the forks" "$out" "retire each: lane-end repoA-1 --retire <pid>"
-has   "…and its footer names the act too, saying the process is not killed" "$out" "lane-end <lane> --retire <pid|uuid>"
-hasnt "…with no \`kill\` anywhere in it" "$out" "kill <pid>"
-# `lane`'s own pick renders the same rows and is held by the hygiene
-# test that walks every fork line in every shipped surface at once
-# (`test_every_fork_surface_prints_the_one_act`), because it reads the CHECKOUT
-# the shell is in and this suite does not move.
-run "$E" forks repoA11-1
-is   "forks exits 8 for a lane with no fork of its transcript running" "$rc" 8
-
-# ---- ruling 12: THE TWO WAYS INTO `lane_forks` MUST NOT DIVERGE ------------
-#
-# `lanes` now hands `lane_forks` the row's ids and the retired set out of the
-# pass it has already made, instead of having it render the published register
-# twice and this checkout's once PER LANE. That is a second entrance to one
-# read, and two entrances is how two answers begin — so the suite asks the same
-# question both ways and compares.
-run "$E" forks repoA-1
-FK_DIRECT="$rc:$out"
-run "$E" lanes --lane repoA-1
-FK_VIA_LISTING="$(printf '%s' "$out" | awk -F'\t' '{print $12}')"
-is "the fork column of the listing agrees with the \`forks\` read beside it" \
-   "$FK_VIA_LISTING" "$(printf '%s' "${FK_DIRECT#*:}" | grep -c . || printf 0)"
-# ---- ruling 7: THE READ CARRIES ALL TEN OF CLAUSE (j)'s COLUMNS, IN ORDER ---
-#
-# *"`lanes` and `restart` each render the subset of clause (j)'s ten columns
-# their surface needs while the read carries all ten."* It carried NINE: column
-# 10, the line that binds the lane, was computed by `lanes` and computed
-# DIFFERENTLY by `restart`, which is two implementations of one column. The word
-# that column names is `lane <name>` since Amendment 18 Addendum 2 retired
-# `restart` from the PATH — one change, in the read, and both surfaces took it.
-run "$E" lanes --lane repoA11-1
-is "the read's row has SEVENTEEN fields: clause (j)'s ten, then home, forks and — since Amendment 18(b) — whether this place may pronounce on the binding, then Amendment 19's four" \
-   "$(printf '%s' "$out" | awk -F'\t' '{print NF}')" 17
-is "…and column 10 is the line that binds the lane, which both surfaces print" \
-   "$(printf '%s' "$out" | awk -F'\t' '{print $10}')" "lane repoA11-1"
-run "$E" lanes --lane repoA11-2
-is "…which for a PAUSED lane with no profile is the form that works today" \
-   "$(printf '%s' "$out" | awk -F'\t' '{print $10}')" "pclaude --lane repoA11-2 <profile>"
-run "$E" lanes --lane repoA11-4
-is "…and for a lane that is not PAUSED it is \`none\`, because column 10 is a PAUSED lane's" \
-   "$(printf '%s' "$out" | awk -F'\t' '{print $10}')" "none"
-
-# AND THE ONE-LANE PATH AND THE ESTATE PATH AGREE ON A ROW. `--lane` reads one
-# log where the listing reads them all; they are the same parser over the same
-# grammar, and this is the assertion that keeps it true.
-run "$E" lanes --lane repoA11-1
-ONE_ROW="$out"
-run "$E" lanes --all
-ALL_ROW="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "repoA11-1" { print; exit }')"
-# Column 9 is a relative time. Two consecutive reads can cross a minute
-# boundary; compare the parser's stable fields rather than the clock tick.
-stable_lane_row() { printf '%s\n' "$1" | awk -F'\t' -v OFS='\t' '{$9="<time>"; print}'; }
-is "one lane read alone is the same row the estate listing gives it" \
-   "$(stable_lane_row "$ONE_ROW")" "$(stable_lane_row "$ALL_ROW")"
-
-# ------------------- ruling 8: `lane-end --retire <pid|uuid>` IS THE ONE ACT
-#
-# Clause (k) rule (e): *"both print the one act: **retire it**, under Amendment
-# 6(d) … **Neither kills a process** … and `lane-end`'s `--retire` is the
-# door."* The door did not exist — three surfaces printed three other things —
-# so A11 Addendum 4 ruling 8 (ratified "a11 addendum 4 yes") has it built here.
-#
-# AND IT IS A DOOR, NOT A RECORD. This round's first build of the act appended
-# `RETIRED … → fork <sid>; pid <n>; kind <k>` to the lane's own log. That line
-# cannot be written: Amendment 7(b) says `PAUSED`, `RESUMED`, `ENDED` and
-# `RETIRED` *"take no payload"* and A11 clause (c) — which narrows that sentence
-# for `RESUMED` and counts the narrowing as edit 1 of six — says `ENDED` and
-# `RETIRED` *"stay payload-free"*. So the assertions below hold the opposite of
-# what they first held: the act PROVES the fork and PRINTS Amendment 6(d) for
-# it, and the log is untouched.
-#
-# THE FIXTURE IS EVIDENCE 6's OWN SHAPE — `kind: bg`, cwd `/workspace`, a
-# transcript titled for the lane under an id no row carries — so the branch it
-# takes is 6(d)'s second half, the one a `/rename` cannot reach.
-
-# REFUSED ON ANYTHING THAT IS NOT A LIVE FORK OF THIS LANE, because naming an
-# act against a stranger is how the wrong process gets stopped.
-run "$END" repoA-1 --retire 999999
-is   "--retire refuses a pid that is not a live fork of this lane" "$rc" 2
-has  "…naming what IS live, so the operator can pick one" "$err" "$FORK_ID"
-has  "…and saying nothing was named" "$err" "nothing is named"
-# AND ON A LANE WITH NO FORK AT ALL — 8, which is "no record", not a refusal.
-run "$END" repoA11-1 --retire "$FORK_ID"
-is   "…and exits 8 for a lane no fork of which is live" "$rc" 8
-# A `forks` READ THAT FAILED IS NEVER "IT IS NOT A FORK" (Amendment 7(d)).
-cat > "$SANDBOX/forkbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  forks) printf 'lanes-edit: simulated failure\n' >&2; exit 1 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/forkbroke"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/forkbroke" "$END" repoA-1 --retire "$FORK_ID"
-is   "…and 1, never 8, where the forks read BROKE" "$rc" 1
-has  "…saying so in Amendment 7(d)'s words" "$err" "NOT 'no fork of it is live'"
-# THE AMBIGUOUS SPELLING IS REFUSED RATHER THAN GUESSED AT: a bare number is
-# both a lane POSITION and a pid, and the two are different acts.
-run "$END" --retire 3
-is   'a bare `--retire <number>` with no lane named is refused as ambiguous' "$rc" 2
-has  "…printing both acts it could have been" "$err" "is both a lane POSITION"
-# THE ACT ITSELF — AND IT WRITES NOTHING ANYWHERE.
-A11F_BEFORE="$(cat "$LOGD/repoA-1.md" 2>/dev/null || :)"
-A11F_ROW_BEFORE="$(grep '^| `repoA-1`' "$LANES")"
-run "$END" repoA-1 --retire "$FORK_ID"
-is   "lane-end --retire <uuid> exits 0 on a proved live fork" "$rc" 0
-has  "…saying it proved the fork and wrote nothing" "$err" "NOTHING has been written or stopped"
-has  "…printing the pid a person needs to find the process" "$err" "pid $LIVE_PID"
-has  "…and the cwd that is not the lane's" "$err" "/workspace"
-# AMENDMENT 6(d), FILLED IN, FOR THE KIND OF SESSION THIS ACTUALLY IS.
-has  "…naming Amendment 6(d)'s act for a BACKGROUND holder" "$err" "an idle background session still holding a lane name is ended"
-has  "…and saying whose act it is" "$err" "YOUR act and no tool's"
-hasnt "…and never \`kill <pid>\`, which R-A11-24 says is printed by nothing" "$err" "kill $LIVE_PID"
-is   "…the log is BYTE-IDENTICAL: a RETIRED with a payload is a seventh edit to in-force text" \
-     "$(cat "$LOGD/repoA-1.md" 2>/dev/null || :)" "$A11F_BEFORE"
-is   "…and the row is untouched too: this ends nothing" "$(grep '^| `repoA-1`' "$LANES")" "$A11F_ROW_BEFORE"
-is   "…and the process really is still running: the door never kills" "$(kill -0 "$LIVE_PID" 2>/dev/null && echo live)" "live"
-# THE READ GOES ON SAYING WHAT IS TRUE. The fork is still a fork until the
-# operator takes 6(d), so `forks` still names it — which is the honest answer
-# and is what the first build's filter would have hidden.
-run "$E" forks repoA-1
-is   "forks still names a fork nobody has retired yet, because it is still one" "$rc" 0
-has  "…by its own id" "$out" "$FORK_ID"
-# --dry-run IS THE SAME RUN, AND SAYS SO RATHER THAN PRETENDING.
-run "$END" repoA-1 --retire "$FORK_ID" --dry-run
-is    "--dry-run exits 0" "$rc" 0
-has   "…and says it changes nothing here, because the act writes nothing on any path" "$err" "--dry-run changes nothing here"
-# AN INTERACTIVE FORK GETS 6(d)'s OTHER HALF: the retitle, which is the one a
-# session with a prompt can take and a `kind: bg` one cannot.
-printf '{"pid":%s,"sessionId":"%s","cwd":"/workspace","procStart":"%s","kind":"user","name":"openrepoproject-b9","status":"busy"}\n' \
-  "$LIVE_PID" "$FORK_ID" "$live_start" > "$sessions_dir/live-fork.json"
-run "$END" repoA-1 --retire "$FORK_ID"
-is   "an INTERACTIVE fork is proved the same way" "$rc" 0
-has  "…and gets Amendment 6(d)'s retitle, typed in that session" "$err" "/rename repoA-1 · retired "
-has  "…said to be typed there, because no API renames one from outside" "$err" "there is no API to rename one from outside"
-hasnt "…and still never a kill" "$err" "kill $LIVE_PID"
-
-rm -f "$sessions_dir/live-fork.json" "$fork_tdir/$FORK_ID.jsonl"
-
-# ------------------------- issue #39: a DUPLICATE HOLDER is TERMED, not named
-#
-# repoM-1's own live session is $LIVE_PID under $MLIVE_ID (seeded above,
-# `$sessions_dir/$LIVE_PID-repoM1.json`). The (faked) process table ALSO
-# shows $LIVE_PID as a `--fork-session --resume … $MLIVE_ID.jsonl` process —
-# on purpose, so the exclusion is proved rather than merely untested — beside
-# a genuine STRAY duplicate, $DUP_PARENT, with its child $DUP_CHILD.
-#
-# REAL PROCESSES, NOT ARBITRARY NUMBERS (Copilot round 2, PR #61): `ps` and
-# `pgrep` are faked, but `kill -TERM` is not and never should be — it is the
-# one thing this act actually does outside the sandbox's own bookkeeping —
-# so an arbitrary pid let the report claim delivery `kill` never attempted
-# against anything real. These two are killed for real below and checked
-# with `kill -0` afterward, exactly as the fork fixture already proves a
-# retire it refuses to make left `$LIVE_PID` running.
-sleep 3000 & DUP_PARENT=$!
-sleep 3000 & DUP_CHILD=$!
-# $DUP_CHILD's OWN argv ALSO matches (Copilot round 2, PR #61): a
-# `--fork-session` invocation's argv is inherited by the child `claude`
-# process as often as the bg-pty-host wrapper that starts it, so `pgrep -f`
-# routinely returns BOTH — and this fixture now says so, to prove the
-# ppid fence keeps the child from being read as a second, headless parent
-# of its own rather than merely never exercising the question.
-FAKE_PS_M="$(printf '%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s' \
-  "$LIVE_PID"   1            "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$DUP_PARENT" 1            "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$DUP_CHILD"  "$DUP_PARENT" "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl")"
-FAKE_PGREP_F_M="$(printf '%s\n%s\n%s' "$LIVE_PID" "$DUP_PARENT" "$DUP_CHILD")"
-FAKE_PGREP_CHILDREN_M="$(printf '%s\t%s' "$DUP_CHILD" "$DUP_PARENT")"
-
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$E" duplicate-holder repoM-1
-is   "duplicate-holder finds the STRAY fork-session pid" "$rc" 0
-has  "…naming its parent" "$out" "$DUP_PARENT"
-has  "…and its child, found via pgrep -P" "$out" "$DUP_CHILD"
-hasnt "…but never repoM-1's OWN live pid, excluded over live_holder" "$out" "$(printf '%s\037' "$LIVE_PID")"
-# ONE ROW, NOT TWO (Copilot round 2, PR #61): $DUP_CHILD's own argv ALSO
-# matches `--fork-session`, so without the ppid fence it would be read again
-# on its own turn as a second, headless "parent" of nothing.
-is   "…and exactly one row: the child is never read as a second parent" "$(printf '%s\n' "$out" | grep -c .)" 1
-
-# AMENDMENT 8 RULING (g)'s COMPANION IS NEVER A DUPLICATE (Copilot on 05d7889,
-# PR #61). The SAME process pair, but now the harness has written a `kind: bg`
-# record for $DUP_PARENT carrying repoM-1's own id in the SAME profile as the
-# lane's interactive record of it — the shape ruling (g) calls one session,
-# not a rival holder. `live_holder` passes over a `bg` record by design, so
-# before this fix the process-table read named the companion as a duplicate
-# and `lane-end --retire` TERMed one half of the live session that IS the lane.
-dup_parent_start="$(cut -d' ' -f22 "/proc/$DUP_PARENT/stat" 2>/dev/null || printf '')"
-printf '{"pid":%s,"sessionId":"%s","cwd":"/workspace","procStart":"%s","kind":"bg","status":"busy"}\n' \
-  "$DUP_PARENT" "$MLIVE_ID" "$dup_parent_start" > "$sessions_dir/$DUP_PARENT-repoM1-companion.json"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$E" duplicate-holder repoM-1
-is    "a fork-session pid that is the lane's own same-profile bg COMPANION is no duplicate: 8" "$rc" 8
-hasnt "…never naming the companion" "$out" "$DUP_PARENT"
-hasnt "…nor the child it wraps" "$out" "$DUP_CHILD"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$END" repoM-1 --retire "$DUP_PARENT"
-is    "…and lane-end --retire REFUSES the companion rather than terming it" "$rc" 2
-has   "…naming it as the harness's own companion of the lane's live session" "$err" "HARNESS'S OWN COMPANION"
-hasnt "…never reporting a retirement" "$err" "RETIRED lane repoM-1's duplicate holder"
-is    "…and the companion and its child are both still running" \
-      "$(kill -0 "$DUP_PARENT" 2>/dev/null && kill -0 "$DUP_CHILD" 2>/dev/null && echo both-alive)" "both-alive"
-# The COMPANION'S record on the CHILD instead — the harness may record the
-# `claude` leaf rather than its wrapper — drops the pair just the same.
-rm -f "$sessions_dir/$DUP_PARENT-repoM1-companion.json"
-dup_child_start="$(cut -d' ' -f22 "/proc/$DUP_CHILD/stat" 2>/dev/null || printf '')"
-printf '{"pid":%s,"sessionId":"%s","cwd":"/workspace","procStart":"%s","kind":"bg","status":"busy"}\n' \
-  "$DUP_CHILD" "$MLIVE_ID" "$dup_child_start" > "$sessions_dir/$DUP_CHILD-repoM1-companion.json"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$E" duplicate-holder repoM-1
-is    "a wrapper whose CHILD is the lane's bg companion is the companion's host, never a duplicate: 8" "$rc" 8
-hasnt "…never naming the wrapper" "$out" "$DUP_PARENT"
-rm -f "$sessions_dir/$DUP_CHILD-repoM1-companion.json"
-
-# Copilot round 8, PR #61: being IN the global fork-session fence only proves
-# a child is SOME `--fork-session` process, not THIS parent's transcript's —
-# a wrapper with TWO such children (an unusual process tree, never assumed
-# absent) must not have the wrong one attached to this parent's row. Pure
-# discovery, no kill: fixed numbers are fine here, `lane-end --retire` is
-# never called against them.
-#
-# AND A SECOND RIGHT CHILD (opensoft/openRepoTools#86): the scan used to stop
-# at the first child that verified, and the record had one child slot, so
-# $AMBIG_CHILD_RIGHT2, listed by pgrep -P after $AMBIG_CHILD_RIGHT, was left
-# out of the report `lane-end --retire` acts on. The slot is a space-separated
-# list of every verified child now, in pgrep -P's order.
-AMBIG_PARENT=900101
-AMBIG_CHILD_RIGHT=900102
-AMBIG_CHILD_WRONG=900103
-AMBIG_CHILD_RIGHT2=900104
-WRONG_ID="aaaa0007-7777-4000-8000-aaaa00077777"
-FAKE_PS_AMBIG="$(printf '%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s' \
-  "$AMBIG_PARENT"       1               "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$AMBIG_CHILD_RIGHT"  "$AMBIG_PARENT" "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$AMBIG_CHILD_WRONG"  "$AMBIG_PARENT" "claude --session-id $WRONG_ID --fork-session --resume /nonexistent/other-projects/$WRONG_ID.jsonl" \
-  "$AMBIG_CHILD_RIGHT2" "$AMBIG_PARENT" "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl")"
-FAKE_PGREP_F_AMBIG="$(printf '%s\n%s\n%s\n%s\n%s' "$LIVE_PID" "$AMBIG_PARENT" "$AMBIG_CHILD_WRONG" "$AMBIG_CHILD_RIGHT" "$AMBIG_CHILD_RIGHT2")"
-# THE WRONG CHILD LISTED FIRST (Copilot round 8), so a fix that merely kept
-# "whichever `pgrep -P` lists first" would still pass every OTHER assertion
-# here and only this ordering would catch it.
-FAKE_PGREP_CHILDREN_AMBIG="$(printf '%s\t%s\n%s\t%s\n%s\t%s' "$AMBIG_CHILD_WRONG" "$AMBIG_PARENT" "$AMBIG_CHILD_RIGHT" "$AMBIG_PARENT" "$AMBIG_CHILD_RIGHT2" "$AMBIG_PARENT")"
-
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_AMBIG" FAKE_PS_RECORDS="$FAKE_PS_AMBIG" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_AMBIG" \
-  "$E" duplicate-holder repoM-1
-is   "three fork-session children of one wrapper: still one row, and no crash" "$rc" 0
-has  "…names the parent" "$out" "$AMBIG_PARENT"
-has  "…and the child that actually resumes THIS transcript" "$out" "$AMBIG_CHILD_RIGHT"
-has  "…and the SECOND child that resumes it too, not only the first (#86)" "$out" "$AMBIG_CHILD_RIGHT2"
-is   "…the child slot is both, space-separated, in pgrep -P's order" \
-     "$(printf '%s\n' "$out" | cut -d "$(printf '\037')" -f2)" "$AMBIG_CHILD_RIGHT $AMBIG_CHILD_RIGHT2"
-hasnt "…never the sibling resuming a DIFFERENT transcript, though pgrep -P lists it first" "$out" "$AMBIG_CHILD_WRONG"
-is   "…exactly one row" "$(printf '%s\n' "$out" | grep -c .)" 1
-
-# BOTH ALIVE BEFORE THE ACT, so a kill that did nothing cannot pass by luck.
-is   "…both fixture processes are alive before the act" \
-     "$(kill -0 "$DUP_PARENT" 2>/dev/null && kill -0 "$DUP_CHILD" 2>/dev/null && echo both-alive)" "both-alive"
-
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$END" repoM-1 --retire "$DUP_PARENT"
-is   "lane-end --retire TERMS a duplicate holder's pid pair" "$rc" 0
-has  "…and reports RETIRED naming both pids" "$err" "RETIRED lane repoM-1's duplicate holder"
-has  "…the parent" "$err" "pid $DUP_PARENT (bg-pty-host)"
-has  "…and the child" "$err" "pid $DUP_CHILD (child)"
-# "gone", not "delivered" (Copilot round 4, PR #61): the verdict is now
-# kill -0 after a settle, never kill's own exit status, so a caller cannot
-# read exit 0 for a duplicate that is still running.
-has  "…each pid's own verified state reported, not merely asserted" "$err" "pid $DUP_PARENT (bg-pty-host): gone"
-has  "…the child's too" "$err" "pid $DUP_CHILD (child): gone"
-has  "…the lane's own row and session are said to be untouched" "$err" "lane itself is untouched"
-# `kill -TERM` IS REAL, so a `sleep 3000` genuinely dies — proof the act did
-# not merely print a report `kill`'s own exit status was never checked against.
-sleep 0.2
-is   "…and the parent really is gone" "$(kill -0 "$DUP_PARENT" 2>/dev/null && echo alive || echo gone)" "gone"
-is   "…and the child really is gone" "$(kill -0 "$DUP_CHILD" 2>/dev/null && echo alive || echo gone)" "gone"
-# CLEARED, NOT LEFT FOR THE TRAP (Copilot round 13, PR #61): `cleanup` fires
-# only at this file's very end, thousands of subprocesses after this point,
-# and a pid the two lines above have ALREADY verified gone is free for the OS
-# to hand to something unrelated before then — a stale $DUP_PARENT or
-# $DUP_CHILD in the trap would signal whatever that turned out to be. Cleared
-# here, now that both are independently confirmed gone; never before, and
-# never for a pid still alive.
-DUP_PARENT=""; DUP_CHILD=""
-
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_M" FAKE_PS_RECORDS="$FAKE_PS_M" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_M" \
-  "$END" repoM-1 --retire "$LIVE_PID"
-is   "…but --retire refuses repoM-1's OWN live pid — Amendment 18(h)'s window pid" "$rc" 2
-has  "…naming it as the lane's own live session, whatever else was found" "$err" "is lane repoM-1's own live session"
-has  "…and saying it is not a fork or a duplicate holder" "$err" "it is not a fork and not a duplicate holder, it is the lane"
-is   "…and the still-live \$LIVE_PID is of course untouched" "$(kill -0 "$LIVE_PID" 2>/dev/null && echo alive)" "alive"
-
-# Copilot round 8, PR #61 follow-up (caught by this suite, not by review):
-# repoM-1 has a perfectly ordinary LIVE session ($LIVE_PID) throughout this
-# block, and `transcript-holders` — asked, as `lane-end` always asks it, from
-# OUTSIDE any bound claude session — verdicts that session `unrelated` rather
-# than recognising it as the lane's own. Reading raw `dup_rows` for "is
-# anything live here" answered yes for a lane with nothing wrong at all, and
-# 777777 (which matches nothing anywhere) was refused 2 ("neither ... nor a
-# duplicate") instead of the honest 8 ("nothing of any kind is live") this
-# case is for.
-run "$END" repoM-1 --retire 777777
-is   "…and a pid that is neither a fork nor a duplicate holder is refused, exit 8" "$rc" 8
-has  "…naming the process-table read" "$err" "no live DUPLICATE HOLDER of the id it does in the process table"
-has  "…and the session-record read" "$err" "no live DUPLICATE of it by session record either"
-has  "…never reading repoM-1's own live \$LIVE_PID session as a reason to refuse 2 instead" "$err" "nothing of any kind is live for lane repoM-1"
-
-# ------------------- issue #39 continued, Copilot round 7: a pid that exited
-# in the race between discovery and the pre-kill signal must not abort the
-# script under set -euo pipefail — `x=$(ps ...) || x=''` is the fix; a bare
-# assignment aborted on the pipeline's own (pipefail) failure before kill -0's
-# verification and the per-pid report ever ran. `duplicate-holder`'s own
-# discovery finds the CHILD from `pgrep -f` (the candidate fence) and
-# `pgrep -P` alone and never calls `ps -p` on it — so `$RACE_CHILD` is in BOTH
-# fakes discovery reads (`FAKE_PGREP_F_RACE`, so it passes the "is this child
-# itself a fork-session candidate" fence; `FAKE_PGREP_CHILDREN_RACE`, so
-# `pgrep -P $RACE_PARENT` names it) — and omitted ONLY from `FAKE_PS_RACE`,
-# the table `lane-end`'s own PRE-KILL recheck reads a few lines later, which
-# is exactly "gone by the time the pre-kill recheck asks", without needing a
-# stateful fake.
-#
-# CAUGHT BY CI ON e4f9054, NOT BY THIS SUITE: the ORIGINAL fixture omitted
-# `$RACE_CHILD` from `FAKE_PGREP_F_RACE` too, so discovery's own fence never
-# matched it and `duplicate-holder` answered a child slot that was — correctly
-# for THAT fixture — empty, never reaching the pre-kill-recheck path this case
-# exists to prove at all. The empty slot then found the SEPARATE, real defect
-# this same round fixed (`lanes-edit.sh`'s `dhp_out` and `lane-end`'s own
-# read of it, both `$US`-separated now): a bare TAB is IFS whitespace to
-# `read`, so `"<parent>\t\t<uuid>"`'s two adjacent tabs collapsed into one
-# delimiter and shifted the uuid into the child field. Both fixed; this
-# fixture now exercises the case its own comment always claimed to.
-sleep 3000 & RACE_PARENT=$!
-sleep 3000 & RACE_CHILD=$!
-FAKE_PS_RACE="$(printf '%s\t%s\t%s' \
-  "$RACE_PARENT" 1 "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl")"
-FAKE_PGREP_F_RACE="$(printf '%s\n%s\n%s' "$LIVE_PID" "$RACE_PARENT" "$RACE_CHILD")"
-FAKE_PGREP_CHILDREN_RACE="$(printf '%s\t%s' "$RACE_CHILD" "$RACE_PARENT")"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_RACE" FAKE_PS_RECORDS="$FAKE_PS_RACE" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_RACE" \
-  "$END" repoM-1 --retire "$RACE_PARENT"
-is   "a ps -p miss on the pre-kill recheck does not abort the script (exit 1, partial, not a crash)" "$rc" 1
-has  "…the parent, present throughout, is still TERMed, verified and reported" "$err" "pid $RACE_PARENT (bg-pty-host): gone"
-has  "…and the child a ps -p miss could not find is reported honestly" "$err" "pid $RACE_CHILD (child): STILL ALIVE"
-is   "…and that child, never having matched, is of course still running" "$(kill -0 "$RACE_CHILD" 2>/dev/null && echo alive)" "alive"
-kill "$RACE_PARENT" "$RACE_CHILD" 2>/dev/null || :
-# VERIFIED, THEN CLEARED, THE SAME RULE $DUP_PARENT/$DUP_CHILD JUST TOOK
-# (Copilot round 13, PR #61): this `kill` is this fixture's OWN teardown and
-# not the tool under test, but a variable the trap still owns is exactly the
-# same pid-reuse hazard — settled and confirmed gone before either is
-# cleared, never assumed from the `kill` above alone.
-sleep 0.2
-is   "…and the fixture pair really is gone before its pids are freed" \
-     "$(kill -0 "$RACE_PARENT" 2>/dev/null && echo alive || echo gone),$(kill -0 "$RACE_CHILD" 2>/dev/null && echo alive || echo gone)" \
-     "gone,gone"
-RACE_PARENT=""; RACE_CHILD=""
-
-# ------------- opensoft/openRepoTools#76: a --resume path with a SPACE in it
-#
-# `ps -o args=` joins the argv with spaces and quotes nothing, so a duplicate
-# resumed from a directory with a space in it reads back as `--resume
-# /nonexistent/projects with a space/<id>.jsonl`, and the cut both reads made
-# at the first space (`${v%% *}`) took `/nonexistent/projects` from that and
-# matched nothing: `duplicate-holder` answered 8 over a duplicate that was
-# there, and `lane-end --retire`'s pre-kill recheck, the same cut, could only
-# have withheld its TERM. Trailing options after the path, as a harness passes
-# them, prove the value ends at its `.jsonl` and not at the end of the line.
-# Real processes, for the reason $DUP_PARENT's comment gives.
-sleep 3000 & SP_PARENT=$!
-sleep 3000 & SP_CHILD=$!
-SP_ARGS="claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects with a space/$MLIVE_ID.jsonl --output-format stream-json"
-FAKE_PS_SP="$(printf '%s\t%s\t%s\n%s\t%s\t%s' \
-  "$SP_PARENT" 1            "$SP_ARGS" \
-  "$SP_CHILD"  "$SP_PARENT" "$SP_ARGS")"
-FAKE_PGREP_F_SP="$(printf '%s\n%s\n%s' "$LIVE_PID" "$SP_PARENT" "$SP_CHILD")"
-FAKE_PGREP_CHILDREN_SP="$(printf '%s\t%s' "$SP_CHILD" "$SP_PARENT")"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_SP" FAKE_PS_RECORDS="$FAKE_PS_SP" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_SP" \
-  "$E" duplicate-holder repoM-1
-is   "a duplicate resumed from a directory with a SPACE in it is found (#76)" "$rc" 0
-has  "…naming its parent" "$out" "$SP_PARENT"
-has  "…and its child, whose own --resume value is read whole too" "$out" "$SP_CHILD"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_SP" FAKE_PS_RECORDS="$FAKE_PS_SP" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_SP" \
-  "$END" repoM-1 --retire "$SP_PARENT"
-is   "…and lane-end --retire's pre-kill recheck reads it whole as well: retired, 0" "$rc" 0
-has  "…reporting RETIRED" "$err" "RETIRED lane repoM-1's duplicate holder"
-has  "…the parent TERMed, not withheld as an argv that no longer matched" "$err" "pid $SP_PARENT (bg-pty-host): gone"
-has  "…and the child" "$err" "pid $SP_CHILD (child): gone"
-sleep 0.2
-is   "…and both really are gone" \
-     "$(kill -0 "$SP_PARENT" 2>/dev/null && echo alive || echo gone),$(kill -0 "$SP_CHILD" 2>/dev/null && echo alive || echo gone)" \
-     "gone,gone"
-# CLEARED ONLY ONCE GONE, the rule $DUP_PARENT's own clearing gives: a pid
-# still alive here (a failed case above) stays the trap's to end.
-kill -0 "$SP_PARENT" 2>/dev/null || SP_PARENT=""
-kill -0 "$SP_CHILD" 2>/dev/null || SP_CHILD=""
-
-# …AND READING THE VALUE WHOLE REOPENS NEITHER CUT PR #61 ALREADY MADE.
-# Copilot round 5's own shape, `--resume /other.jsonl --label /<id>.jsonl`,
-# still reads `/other.jsonl`: the value ends at the first `.jsonl` that ends
-# an argument. And a `--resume` given a bare session id, with this
-# transcript's path in a LATER option, has no `.jsonl` of its own to stop at,
-# so the value would run across that option; a value holding a word that
-# opens with `--` is refused rather than read across it. Discovery only, so
-# fixed numbers, as the AMBIG case above says.
-#
-# …NOR ACROSS A LATER PLAIN WORD THAT NAMES THIS TRANSCRIPT (Brett Heap's
-# ruling of 2026-10-18 on PR #205, "Add the condition first (Recommended)").
-# A bare session id followed by a prompt, and a `<id>.jsonl.bak` followed by
-# a word naming the transcript, hold no `--` to refuse, so the value ran on to
-# the later `/<id>.jsonl` and matched, where the cut at the first space never
-# had. A value with a space in it must be one absolute path, starting with `/`
-# and holding no ` /`, and each half needs a row that only IT refuses:
-# $SPAN_PARENT_C's starts with the id AND reaches its path through ` /`,
-# $SPAN_PARENT_D's starts with `/` and reaches the later path through ` /`
-# alone, and $SPAN_PARENT_E's starts with the id and holds no ` /` at all, so
-# only the start-with-`/` half refuses it (deleting that line from
-# `dhp_resume_value` left every row above passing, measured on de0809c, since
-# C and D are both refused by the ` /` half). The SP case above is the spaced
-# path that must still match, and does.
-SPAN_PARENT_A=900201
-SPAN_PARENT_B=900202
-SPAN_PARENT_C=900203
-SPAN_PARENT_D=900204
-SPAN_PARENT_E=900205
-FAKE_PS_SPAN="$(printf '%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s' \
-  "$SPAN_PARENT_A" 1 "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/other.jsonl --label /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$SPAN_PARENT_B" 1 "claude --session-id $MLIVE_ID --fork-session --resume $WRONG_ID --append-system-prompt-file /nonexistent/projects/$MLIVE_ID.jsonl" \
-  "$SPAN_PARENT_C" 1 "claude --session-id $MLIVE_ID --fork-session --resume $WRONG_ID read /nonexistent/projects/$MLIVE_ID.jsonl and summarise" \
-  "$SPAN_PARENT_D" 1 "claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl.bak note /nonexistent/other-projects/$MLIVE_ID.jsonl" \
-  "$SPAN_PARENT_E" 1 "claude --session-id $MLIVE_ID --fork-session --resume $WRONG_ID summarise nonexistent/projects/$MLIVE_ID.jsonl")"
-FAKE_PGREP_F_SPAN="$(printf '%s\n%s\n%s\n%s\n%s\n%s' "$LIVE_PID" "$SPAN_PARENT_A" "$SPAN_PARENT_B" "$SPAN_PARENT_C" "$SPAN_PARENT_D" "$SPAN_PARENT_E")"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_SPAN" FAKE_PS_RECORDS="$FAKE_PS_SPAN" FAKE_PGREP_CHILDREN="" \
-  "$E" duplicate-holder repoM-1
-is    "…and a --resume value is never read across into a LATER argument: 8" "$rc" 8
-hasnt "…not round 5's --label shape, which still reads /other.jsonl" "$out" "$SPAN_PARENT_A"
-hasnt "…nor a bare session id followed by an option naming this transcript" "$out" "$SPAN_PARENT_B"
-hasnt "…nor a bare session id followed by a PROMPT naming it, with no -- to refuse (#205 ruling)" "$out" "$SPAN_PARENT_C"
-hasnt "…nor a <id>.jsonl.bak followed by a later word naming it (#205 ruling)" "$out" "$SPAN_PARENT_D"
-hasnt "…nor a bare session id followed by a RELATIVE path naming it, which only the start-with-/ half refuses (#205 ruling)" "$out" "$SPAN_PARENT_E"
-
-# …AND THE TWO COPIES OF THAT READ ARE ONE TEXT. The rows above drive
-# discovery only, so `lane-end`'s own copy, `dh_resume_value` (its pre-kill
-# recheck), could lose its condition and every case here would still pass
-# (measured on de0809c: removing that copy alone left 75 passed). Its comment
-# says the two "must stay the same rule", and a rule held by two copies is held
-# by nothing until a case compares them. Each body is EXTRACTED FROM ITS FILE,
-# like `/restart`'s rung 4 and `cut_to_line` beside it, and not copied here: a
-# copy is what would go on passing after the file drifted. Only the name prefix
-# (`dhp_` in `lanes-edit.sh`, `dh_` in `lane-end`) may differ, and `lane-end`'s
-# copy sits inside a function, so its four-space indent is taken off. The
-# address is awk's own match on the function's line and its closing brace, not
-# `sed -n '/…/,/^}/p'`: `lane-end`'s closing brace is indented, and an
-# unescaped `{` in a BSD `sed` BRE is undefined (the `cut_to_line` note).
-resume_body() {   # <file> <function> <its indent> — the function's own lines, indent off
-  awk -v name="$2" -v ind="$3" '
-    !on && index($0, ind name "() {") == 1 { on = 1 }
-    on { print substr($0, length(ind) + 1) }
-    on && $0 == ind "}" { exit }' "$1"
-}
-resume_body "$E" dhp_resume_value "" | sed 's/dhp_/dh_/g' > "$SANDBOX/resume_body.lanes-edit"
-resume_body "$END" dh_resume_value "    " > "$SANDBOX/resume_body.lane-end"
-resume_body_whole() {   # <extracted file> — "whole" when it opens at the function and ends at its brace
-  local rbw_t
-  rbw_t="$(cat "$1")"
-  case "$rbw_t" in
-    "dh_resume_value() {"*$'\n'"}") printf 'whole' ;;
-    *) printf 'EMPTY-OR-CUT' ;;
-  esac
-}
-is "both copies of the --resume read were found in their files, opening at the function and ending at its closing brace" \
-   "$(resume_body_whole "$SANDBOX/resume_body.lanes-edit") $(resume_body_whole "$SANDBOX/resume_body.lane-end")" "whole whole"
-is "lane-end's dh_resume_value is lanes-edit.sh's dhp_resume_value, word for word, name prefix aside (#205 review)" \
-   "$(diff "$SANDBOX/resume_body.lane-end" "$SANDBOX/resume_body.lanes-edit" 2>&1)" ""
-
-# ------- opensoft/openRepoTools#86: --retire acts on EVERY verified child
-#
-# A wrapper with TWO children, both resuming this transcript. Before #86 the
-# discovery named only the first, `lane-end --retire` TERMed the parent and
-# that one child, said RETIRED, and the second went on holding the
-# transcript: Amendment 18(h)'s double holder, surviving a retirement
-# reported clean. Real processes, so the TERM is proved, not asserted.
-sleep 3000 & TWO_PARENT=$!
-sleep 3000 & TWO_CHILD_A=$!
-sleep 3000 & TWO_CHILD_B=$!
-TWO_ARGS="claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl"
-FAKE_PS_TWO="$(printf '%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s' \
-  "$TWO_PARENT"  1             "$TWO_ARGS" \
-  "$TWO_CHILD_A" "$TWO_PARENT" "$TWO_ARGS" \
-  "$TWO_CHILD_B" "$TWO_PARENT" "$TWO_ARGS")"
-FAKE_PGREP_F_TWO="$(printf '%s\n%s\n%s\n%s' "$LIVE_PID" "$TWO_PARENT" "$TWO_CHILD_A" "$TWO_CHILD_B")"
-FAKE_PGREP_CHILDREN_TWO="$(printf '%s\t%s\n%s\t%s' "$TWO_CHILD_A" "$TWO_PARENT" "$TWO_CHILD_B" "$TWO_PARENT")"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_TWO" FAKE_PS_RECORDS="$FAKE_PS_TWO" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_TWO" \
-  "$END" repoM-1 --retire 777777
-is   "a pid that is none of them is still refused 2 beside a two-child duplicate" "$rc" 2
-has  "…and the listing it prints names BOTH children of the wrapper (#86)" "$err" "pid $TWO_PARENT (bg-pty-host), pid $TWO_CHILD_A (child), pid $TWO_CHILD_B (child)"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_TWO" FAKE_PS_RECORDS="$FAKE_PS_TWO" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_TWO" \
-  "$END" repoM-1 --retire "$TWO_PARENT" --dry-run
-is   "--retire --dry-run on a wrapper with two verified children exits 0" "$rc" 0
-has  "…naming BOTH children it would TERM (#86)" "$err" "and pid $TWO_CHILD_A (child) and pid $TWO_CHILD_B (child)"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_TWO" FAKE_PS_RECORDS="$FAKE_PS_TWO" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_TWO" \
-  "$END" repoM-1 --retire "$TWO_PARENT"
-is   "lane-end --retire TERMs EVERY verified child of a duplicate holder, not the first (#86)" "$rc" 0
-has  "…reporting RETIRED" "$err" "RETIRED lane repoM-1's duplicate holder"
-has  "…the parent gone" "$err" "pid $TWO_PARENT (bg-pty-host): gone"
-has  "…the first child gone" "$err" "pid $TWO_CHILD_A (child): gone"
-has  "…and the SECOND child gone, which it used to leave running" "$err" "pid $TWO_CHILD_B (child): gone"
-sleep 0.2
-is   "…and all three really are gone" \
-     "$(kill -0 "$TWO_PARENT" 2>/dev/null && echo alive || echo gone),$(kill -0 "$TWO_CHILD_A" 2>/dev/null && echo alive || echo gone),$(kill -0 "$TWO_CHILD_B" 2>/dev/null && echo alive || echo gone)" \
-     "gone,gone,gone"
-kill -0 "$TWO_PARENT" 2>/dev/null || TWO_PARENT=""
-kill -0 "$TWO_CHILD_A" 2>/dev/null || TWO_CHILD_A=""
-kill -0 "$TWO_CHILD_B" 2>/dev/null || TWO_CHILD_B=""
-
-# …AND ONE CHILD STILL ALIVE, WHICHEVER IT IS, IS A PARTIAL RETIREMENT AND
-# NEVER RETIRED. The SECOND child ignores TERM (an ignored signal survives
-# `exec`), and it is named as the target itself, which before #86 matched
-# nothing at all, because the child slot held only the first. Its `exec` is
-# waited for before the act, so the TERM cannot reach the shell before the
-# shell has set the trap; the real `ps` (`command -p`), because the suite's
-# fake knows nothing of this process.
-sleep 3000 & PART_PARENT=$!
-sleep 3000 & PART_CHILD_A=$!
-bash -c 'trap "" TERM; exec sleep 3000' & PART_CHILD_B=$!
-part_tries=0
-while [ "$part_tries" -lt 50 ]; do
-  case "$(command -p ps -o comm= -p "$PART_CHILD_B" 2>/dev/null)" in *sleep*) break ;; esac
-  part_tries=$((part_tries + 1)); sleep 0.1
-done
-PART_ARGS="claude --session-id $MLIVE_ID --fork-session --resume /nonexistent/projects/$MLIVE_ID.jsonl"
-FAKE_PS_PART="$(printf '%s\t%s\t%s\n%s\t%s\t%s\n%s\t%s\t%s' \
-  "$PART_PARENT"  1              "$PART_ARGS" \
-  "$PART_CHILD_A" "$PART_PARENT" "$PART_ARGS" \
-  "$PART_CHILD_B" "$PART_PARENT" "$PART_ARGS")"
-FAKE_PGREP_F_PART="$(printf '%s\n%s\n%s\n%s' "$LIVE_PID" "$PART_PARENT" "$PART_CHILD_A" "$PART_CHILD_B")"
-FAKE_PGREP_CHILDREN_PART="$(printf '%s\t%s\n%s\t%s' "$PART_CHILD_A" "$PART_PARENT" "$PART_CHILD_B" "$PART_PARENT")"
-run env FAKE_PGREP_F_PIDS="$FAKE_PGREP_F_PART" FAKE_PS_RECORDS="$FAKE_PS_PART" FAKE_PGREP_CHILDREN="$FAKE_PGREP_CHILDREN_PART" \
-  "$END" repoM-1 --retire "$PART_CHILD_B"
-is    "the SECOND child's pid is a --retire target too, and one survivor makes it partial: 1" "$rc" 1
-has   "…naming the survivor as alive despite the TERM it was sent" "$err" "pid $PART_CHILD_B (child): STILL ALIVE despite TERM delivered"
-has   "…and the child that did go" "$err" "pid $PART_CHILD_A (child): gone"
-has   "…and the parent" "$err" "pid $PART_PARENT (bg-pty-host): gone"
-has   "…refusing as only partly retired" "$err" "was only partly retired"
-hasnt "…never RETIRED over a child still holding the transcript" "$err" "RETIRED lane repoM-1's duplicate holder"
-is    "…and the survivor really is still running" "$(kill -0 "$PART_CHILD_B" 2>/dev/null && echo alive || echo gone)" "alive"
-kill -KILL "$PART_CHILD_B" 2>/dev/null || :
-sleep 0.2
-is    "…and the fixture trio really is gone before its pids are freed" \
-      "$(kill -0 "$PART_PARENT" 2>/dev/null && echo alive || echo gone),$(kill -0 "$PART_CHILD_A" 2>/dev/null && echo alive || echo gone),$(kill -0 "$PART_CHILD_B" 2>/dev/null && echo alive || echo gone)" \
-      "gone,gone,gone"
-kill -0 "$PART_PARENT" 2>/dev/null || PART_PARENT=""
-kill -0 "$PART_CHILD_A" 2>/dev/null || PART_CHILD_A=""
-kill -0 "$PART_CHILD_B" 2>/dev/null || PART_CHILD_B=""
-
-# --------------------------- clause (c): lane-start RECORDS dir and profile
-mkdir -p "$HOME/projects/repoA11b"
-git init -q -b main "$HOME/projects/repoA11b"
-git -C "$HOME/projects/repoA11b" remote add origin "https://github.com/opensoft/repoA11b.git"
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit pending handoffs before the Amendment 11 lane-start cases" >/dev/null 2>&1 || :
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=claude \
-  CLAUDE_PROFILE_NAME=team-05a run "$START" repoA11b 1 --no-launch
-is   "lane-start exits 0 for a new lane under Amendment 11" "$rc" 0
-A11B_LOG="$(cat "$LOGD/repoA11b-1.md" 2>/dev/null || :)"
-has  "…and its STARTED line records the lane's DIRECTORY" "$A11B_LOG" "dir $HOME/projects/repoA11b"
-has  "…its PROFILE, from the launcher's own CLAUDE_PROFILE_NAME" "$A11B_LOG" "profile team-05a"
-has  "…and its WINDOW as two refs, <session>:<index> and <@id>" "$A11B_LOG" "window a11start:3 @42"
-has  "…keeping the home and estate the line already carried" "$A11B_LOG" "home opensoft/repoA11b; estate repoA11b"
-# THE ROW'S STAMP IS AMENDMENT 6(c)'s AND IS WRITTEN ON A RESUME, never on the
-# row's own creation: a brand-new row is created with the uuid already in its
-# session cell, so there is nothing for a stamp to say that the row does not.
-# The second start of the same lane is the one that stamps, and its TAIL is what
-# clause (c) extends — the head (verb, uuid, lane) is Amendment 8(d)'s and is
-# untouched.
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=repoA11b-1 \
-  CLAUDE_PROFILE_NAME=team-05a run "$START" repoA11b 1 --no-launch
-is   "lane-start exits 0 on a second start of the same lane" "$rc" 0
-has  "…and its stamp says what actually happened, so --no-launch never claims a launch" \
-     "$(grep '^| `repoA11b-1`' "$LANES")" ", no launch"
-has  "…while its HEAD is Amendment 8(d)'s and is untouched" \
-     "$(grep '^| `repoA11b-1`' "$LANES")" "(lane repoA11b-1) — lane-start on Eagle: window renamed, no launch; dir "
-# THE TAIL IS READ ON A CHECKOUT AT A SHORT PATH (opensoft/openRepoTools#180).
-# The stamp is ONE line under ratified decision O1's cap (Amendment 13(a)), and
-# `cut_to_line` takes `dir` and `window` first by design — both are this same
-# act's log sub-fields, asserted in full above — so the tail fits only when the
-# CHECKOUT PATH does. Read on `$HOME/projects/repoA11b`, this case's answer was
-# the run root's length: green under plain pytest's `/tmp`, red under
-# `tests/run.sh`'s per-run root (`… no launch; dir ...`, the path cut whole), at
-# the edge on macOS. The checkout goes in this sandbox's own `$TMPDIR` where
-# that is at most 40 characters, as under plain pytest on Linux, and in `/tmp`
-# where it is not, so `$A11T_DIR` is never over 65 characters and the line never
-# over about 210, inside the 230 the cut keeps wherever the root is. `cleanup`
-# removes it; only a SIGKILLed run under a long root leaves one in `/tmp`.
-# `tests/test_lane_start_row_stamp.py` drives the same stamp at three checkout
-# lengths, the two that are cut included.
-a11t_base="$TMPDIR"
-[ "${#a11t_base}" -le 40 ] || a11t_base=/tmp
-A11T_ROOT="$(mktemp -d "$a11t_base/ort-a11t.XXXXXX" 2>/dev/null || :)"
-A11T_DIR="${A11T_ROOT:-$SANDBOX/a11t-no-short-root}/repoA11t"
-is   "the TAIL case has a checkout of at most 65 characters, wherever the run root is" \
-     "$( [ -n "$A11T_ROOT" ] && [ -d "$A11T_ROOT" ] && [ "${#A11T_DIR}" -le 65 ] && echo yes || echo no )" "yes"
-git init -q -b main "$A11T_DIR"
-git -C "$A11T_DIR" remote add origin "https://github.com/opensoft/repoA11t.git"
-FAKE_TMUX_WINDOW="a11tail:@43" FAKE_TMUX_WINDOW_INDEX=5 FAKE_TMUX_WINDOW_NAME=claude \
-  run "$START" --dir "$A11T_DIR" repoA11t 1 --no-launch
-is   "lane-start exits 0 for a lane whose checkout is at that short path" "$rc" 0
-FAKE_TMUX_WINDOW="a11tail:@43" FAKE_TMUX_WINDOW_INDEX=5 FAKE_TMUX_WINDOW_NAME=repoA11t-1 \
-  run "$START" repoA11t 1 --no-launch
-is   "…and on its second start, which reads the checkout back from the lane's log" "$rc" 0
-has  "the row's stamp states clause (c)'s two facts for a person, in its TAIL" \
-     "$(grep '^| `repoA11t-1`' "$LANES")" "dir $A11T_DIR; window a11tail:5 @43"
-# NO PROFILE IS NO SUB-FIELD, never a guessed one (Amendment 7(i)).
-mkdir -p "$HOME/projects/repoA11c"
-git init -q -b main "$HOME/projects/repoA11c"
-git -C "$HOME/projects/repoA11c" remote add origin "https://github.com/opensoft/repoA11c.git"
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=claude \
-  run env -u CLAUDE_PROFILE_NAME "$START" repoA11c 1 --no-launch
-is    "lane-start exits 0 for a lane started outside the launcher" "$rc" 0
-hasnt "…and writes NO profile sub-field rather than inventing one" "$(cat "$LOGD/repoA11c-1.md")" "profile "
-has   "…while still recording the directory, which it does know" "$(cat "$LOGD/repoA11c-1.md")" "dir $HOME/projects/repoA11c"
-
-# CLAUSE (c)'s SEPARATOR FENCE, ON THE WRITER THAT DID NOT HAVE IT. SPEC rev 6
-# §5 adds `; ` to `, ` and ` — ` for `dir` and `profile` — *"A value containing
-# `, `, ` — ` or `; ` is refused, exit 2, naming it — not truncated, not escaped,
-# and not appended"* — and the `/lane-swap` skill, the other writer the clause
-# names, has refused all three since `68614bf` (the `skill_subfield` cases
-# below prove it). THIS writer refused two of them.
-#
-# THE QUOTING DOES NOT COVER THE GAP, which is why this is a refusal and not a
-# shrug: `payload_subfield` splits the payload on `; ` BEFORE it honours a
-# quote, so `dir "/p/a; b"` — quoted, because a path with a space is written
-# quoted — splits into `dir "/p/a` and `b"`, and `lane-dir` answers `"/p/a`: a
-# path that is wrong, carries a quote mark, and nobody ever wrote. A restart
-# then lands in the right transcript and the wrong directory, silently, which is
-# Evidence 3 exactly.
-A11F="$HOME/projects/repoA11f"
-mkdir -p "$A11F/a; b"
-git init -q -b main "$A11F/a; b"
-git -C "$A11F/a; b" remote add origin "https://github.com/opensoft/repoA11f.git"
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=claude \
-  CLAUDE_PROFILE_NAME=team-05a run "$START" --dir "$A11F/a; b" repoA11f 1 --no-launch
-is    "lane-start REFUSES a directory carrying the payload's sub-field separator" "$rc" 2
-has   "…naming the path, rather than truncating or escaping it" "$err" "$A11F/a; b"
-has   "…and the separator, beside the two this fence always had" "$err" "'; '"
-is    "…having written no log for the lane at all" \
-      "$( [ -f "$LOGD/repoA11f-1.md" ] && printf wrote || printf none )" "none"
-# THE COMMA IS STILL REFUSED, so the widening added a separator and removed none.
-mkdir -p "$A11F/c, d"
-git init -q -b main "$A11F/c, d"
-git -C "$A11F/c, d" remote add origin "https://github.com/opensoft/repoA11f.git"
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=claude \
-  CLAUDE_PROFILE_NAME=team-05a run "$START" --dir "$A11F/c, d" repoA11f 1 --no-launch
-is    "…and a ', ' is refused exactly as it was" "$rc" 2
-# A PROFILE CARRYING IT IS DROPPED AND NEVER REFUSED, because a profile is not
-# the thing the run needs to be correct — the same asymmetry this file already
-# holds for `, ` and `"`.
-mkdir -p "$HOME/projects/repoA11g"
-git init -q -b main "$HOME/projects/repoA11g"
-git -C "$HOME/projects/repoA11g" remote add origin "https://github.com/opensoft/repoA11g.git"
-FAKE_TMUX_WINDOW="a11start:@42" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_NAME=claude \
-  CLAUDE_PROFILE_NAME='team; 05a' run "$START" repoA11g 1 --no-launch
-is    "a PROFILE carrying the separator does not stop the start" "$rc" 0
-hasnt "…and no profile sub-field is written rather than an unreadable one" \
-      "$(cat "$LOGD/repoA11g-1.md" 2>/dev/null || :)" "profile "
-has   "…while the run says which separator took it out" "$err" "'; '"
-
-# AN `<@id>` IS `@<digits>` AND NOTHING ELSE (F-X13(a), A11 Addendum 4 ruling 10).
-# `case … in @*)` accepted anything that merely STARTED with an at-sign. Two
-# things that are not ids do: a `tmux` too old to know `#{window_id}` prints the
-# FORMAT back, and a shim on PATH may print anything at all — a pane ref beside
-# the window's, say. Either recorded here is a lie in an append-only log, and
-# worse than an absence: the sub-field would then name a window `window-lane`
-# can never resolve while looking complete. `claude-profile` makes exactly this
-# check on exactly this value, so two writers of one field had two standards.
-mkdir -p "$HOME/projects/repoA11d"
-git init -q -b main "$HOME/projects/repoA11d"
-git -C "$HOME/projects/repoA11d" remote add origin "https://github.com/opensoft/repoA11d.git"
-FAKE_TMUX_WINDOW="a11start:0" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_ID='@42 %7' \
-  FAKE_TMUX_WINDOW_NAME=claude CLAUDE_PROFILE_NAME=team-05a \
-  run "$START" repoA11d 1 --no-launch
-is    "lane-start exits 0 when tmux answers something that is not an <@id>" "$rc" 0
-A11D_LOG="$(cat "$LOGD/repoA11d-1.md" 2>/dev/null || :)"
-hasnt "…and records NO id rather than a string that is not one" "$A11D_LOG" "%7"
-hasnt "…not even the part of it that looked like one" "$A11D_LOG" "@42"
-has   "…while the <session>:<index> IS recorded, because a record with no id is COMPLETE" \
-      "$A11D_LOG" "window a11start:3"
-# THE OTHER SHAPE THE COMMENT NAMES, held so it stays held: an old `tmux` prints
-# the format back, which does not begin with `@` at all and was already refused.
-mkdir -p "$HOME/projects/repoA11e"
-git init -q -b main "$HOME/projects/repoA11e"
-git -C "$HOME/projects/repoA11e" remote add origin "https://github.com/opensoft/repoA11e.git"
-FAKE_TMUX_WINDOW="a11start:0" FAKE_TMUX_WINDOW_INDEX=3 FAKE_TMUX_WINDOW_ID='#{window_id}' \
-  FAKE_TMUX_WINDOW_NAME=claude CLAUDE_PROFILE_NAME=team-05a \
-  run "$START" repoA11e 1 --no-launch
-is    "lane-start exits 0 when a tmux too old prints the format back" "$rc" 0
-hasnt "…and records the format string nowhere" "$(cat "$LOGD/repoA11e-1.md" 2>/dev/null || :)" "#{window_id}"
-
-# ----------- rulings 10 and 11: the `/lane-swap` skill absorbs #71's six
-#
-# `opensoft/workBenches#74` @`0b7f6bc` DELETES the launcher's copy of this skill,
-# so after it lands `openRepoTools --install` is the only writer of it on every
-# host and this copy must be the superset (F-X13). Ruling 10 names the six
-# things #71 had and this did not; ruling 11 moves the container case. Six of
-# the seven are prose a test can only read; the SUB-FIELD RULE is arithmetic and
-# is extracted from the file and run, like `/restart`'s rung 4 beside it.
-# THE FILE MOVED WITH THE ACT (Amendment 17(a), ratified 2026-09-14): the steps
-# these cases read are `skills/handoff/SKILL.md`'s now, and `skills/lane-swap/`
-# holds the ALIAS that names it. Every assertion below is the same assertion
-# against the file that carries the act.
-SWSK="$SRC_DIR/skills/handoff/SKILL.md"
-SWSK_TEXT="$(cat "$SWSK")"
-skill_subfield() {   # <win> <dir> — runs the skill's own two `case` lines
-  local ss_win="$1" ss_dir="$2" ss_a ss_b ss_c
-  # MATCHED ON WHAT EACH LINE DOES, with `grep -F`, because the patterns
-  # themselves are full of the characters a regex would eat.
-  ss_a="$(grep -F 'refused="$refused window=$win"' "$SWSK" | head -n1)"
-  ss_b="$(grep -F 'refused="$refused dir=$dir"' "$SWSK" | head -n1)"
-  ss_c="$(grep -F "in *' '*) dir=" "$SWSK" | head -n1)"
-  [ -n "$ss_a" ] && [ -n "$ss_b" ] && [ -n "$ss_c" ] || { printf 'NO LINES\n'; return 1; }
-  ( win="$ss_win"; dir="$ss_dir"; refused=""
-    eval "$ss_a"; eval "$ss_b"; eval "$ss_c"
-    printf 'win=[%s] dir=[%s] refused=[%s]' "$win" "$dir" "$refused" )
-}
-is "a clean window and directory go through untouched" \
-   "$(skill_subfield 'sess:0 @71' '/checkouts/b/x')" 'win=[sess:0 @71] dir=[/checkouts/b/x] refused=[]'
-is "a space in the path is QUOTED, which is what makes it one ref under 7(b)" \
-   "$(skill_subfield 'sess:0' '/checkouts/b/my projects/x')" 'win=[sess:0] dir=["/checkouts/b/my projects/x"] refused=[]'
-is "a ', ' in the path DROPS the sub-field, keeps the line, and says what went" \
-   "$(skill_subfield 'sess:0' '/checkouts/b/a, b')" 'win=[sess:0] dir=[] refused=[ dir=/checkouts/b/a, b]'
-is "…and a '; ', which SPEC rev 6 §5 adds for dir and profile" \
-   "$(skill_subfield 'sess:0' '/checkouts/b/a; b')" 'win=[sess:0] dir=[] refused=[ dir=/checkouts/b/a; b]'
-is "…and a '\"', which clause (c) writes itself and so may not be in the value" \
-   "$(skill_subfield 'sess:0' '/checkouts/b/a"b')" 'win=[sess:0] dir=[] refused=[ dir=/checkouts/b/a"b]'
-is "a ', ' in the WINDOW drops that sub-field, on A8(b)'s list and not widened" \
-   "$(skill_subfield 'sess:0, x' '/checkouts/b/x')" 'win=[] dir=[/checkouts/b/x] refused=[ window=sess:0, x]'
-is "…and a '; ' in the window is NOT refused, because A8(b)'s list is not widened (R-A11-15)" \
-   "$(skill_subfield 'sess:0; x' '/checkouts/b/x')" 'win=[sess:0; x] dir=[/checkouts/b/x] refused=[]'
-# (b) THE NO-WORKTREE `dir` RUNGS — `R-A11-11`, and the rung the launcher round
-# was ORDERED to drop, kept by the copy that survives.
-hasnt "the skill no longer falls to this shell's git toplevel for the lane's dir" \
-      "$SWSK_TEXT" 'dir="$(git rev-parse --show-toplevel'
-has   "…it asks the lane's own recorded checkout first" "$SWSK_TEXT" '"$L" lane-dir "$lane"'
-has   "…then the launcher's own word" "$SWSK_TEXT" 'WORKBENCHES_CLAUDE_LANE_DIR'
-has   "…then the live session's own record, which is what clause (c) names" "$SWSK_TEXT" 'CLAUDE_CONFIG_DIR"/sessions/*.json'
-has   "…and an absolute path or nothing at all" "$SWSK_TEXT" '[[ "$dir" == /* ]] || dir=""'
-# (d) A MISSING `dir` IS SAID, NOT GUESSED AT.
-has   "a missing dir is SAID rather than omitted in silence" "$SWSK_TEXT" "NO dir sub-field"
-# (e) THE CLOSING `/rename` ACT, with the premise that is true today.
-has   "the skill ends with the /rename act (R-A11-16)" "$SWSK_TEXT" "type /rename <lane>"
-has   "…on act 0's MERGED sha, which is the premise that moved" "$SWSK_TEXT" "3719d97"
-# (f) THE ALIAS IS IN THE DESCRIPTION — clause (g).
-has   "the description names the aliases" "$SWSK_TEXT" "aliases /swap, /lane-swap"
-has   "…and the word a context clear uses" "$SWSK_TEXT" "/ctx is /handoff --restart"
-has   "…and the amendments that amended it" "$SWSK_TEXT" "amended by Amendments 11, 17 and 18(d)"
-# RULING 11 — the container case stops the WRITES, not the swap.
-hasnt "a container with no workstation no longer exits at step 1" "$SWSK_TEXT" 'export LANES_WORKSTATION=<this host name>"
-  exit 2'
-has   "…it records the gap and carries on" "$SWSK_TEXT" "ws_missing=1"
-has   "…the handoff of step 2 is where the gap is named (clause (e))" "$SWSK_TEXT" "THE HANDOFF IS WHERE THE GAP IS NAMED"
-has   "…and step 4's two log writes are the ones that stop" "$SWSK_TEXT" 'if [[ -z "$ws_missing" ]]; then'
-
-# THE SWAP SKILL'S OWN FAIL-CLOSED FENCE, EXTRACTED AND RUN (#26, the review of
-# `c3ebcfe`, this file's `:28`, `:72` and `:236`; the same family `73caa5d` took
-# in `/restart`). Step 1's three reads collapsed every code into the ordinary
-# case, and beneath them is not a refusal but THE NEXT RUNG — the last of which
-# is the workstation's NEWEST SWAP, a different lane. A register that could not
-# be read is not "this window is not a lane", and step 4 would then write a
-# PAUSED record and a restart command for a lane this window is not.
-swsk_fence="$(awk '/^sread\(\) \{/,/^\}$/' "$SWSK")"
-is   "the swap skill carries the fence its step 1 reads go through" \
-     "$( [ -n "$swsk_fence" ] && printf yes || printf no )" "yes"
-sfence_probe() {   # <helper exit code> — runs the SKILL's own fence against it
-  printf '#!/usr/bin/env bash\nprintf "ANSWER\\n"\nexit %s\n' "$1" > "$SANDBOX/sfencehelper"
-  chmod +x "$SANDBOX/sfencehelper"
-  ( L="$SANDBOX/sfencehelper"; eval "$swsk_fence"
-    v=unset; sread v "'a thing it is not'" some-verb 2>"$SANDBOX/sfence.err"
-    printf 'rc=%s v=[%s]' "$?" "$v" )
-}
-is   "an answer reaches the variable" "$(sfence_probe 0)" "rc=0 v=[ANSWER]"
-is   "…8 is NO ANSWER and falls to the next rung" "$(sfence_probe 8)" "rc=0 v=[]"
-is   "…2 is a helper predating the read and falls through too" "$(sfence_probe 2)" "rc=0 v=[]"
-is   "…and a read that FAILED stops the skill where it stands" "$(sfence_probe 6)" ""
-has  "…naming the read and the code it came back with" "$(cat "$SANDBOX/sfence.err")" "some-verb\` failed (exit 6)"
-has  "…and what it will not do on one" "$(cat "$SANDBOX/sfence.err")" "will not bind a lane, write a PAUSED record"
-hasnt "no step 1 read is left on the shape that cannot tell 8 from 1" \
-      "$SWSK_TEXT" 'register-row "$lane" >/dev/null 2>&1 || lane=""'
-hasnt "…nor the swap record's on \`|| rows=\"\"\`" "$SWSK_TEXT" '2>/dev/null)" || rows=""'
-hasnt "…nor the window read's bare \`&&\`, which reads every failure as no candidate" \
-      "$SWSK_TEXT" 'window-lane "$ws" "$wl_ref" 2>/dev/null)" &&'
-
-# AND THE `dir` READ, WHICH MAY NOT STOP — `R-A11-11`, *a swap is never left
-# unwritten* — SO IT DROPS THE SUB-FIELD AND NAMES THE READ. Its two lower
-# sources are not rungs beneath a failed read: the third is THIS SESSION'S own
-# `cwd`, and a swap typed in one checkout for a lane that lives in another would
-# record this session's directory as that lane's, in a log nothing rewrites.
-# Extracted from the file and run against a helper in each state.
-swap_dir_blk="$(awk '/^dir=""; dir_read_failed=/,/^fi$/' "$SWSK")"
-is   "the swap skill carries the dir read as its own step" \
-     "$( [ -n "$swap_dir_blk" ] && printf yes || printf no )" "yes"
-cat > "$SANDBOX/dirhelper" <<'WRAP'
-#!/usr/bin/env bash
-[ -n "${STUB_OUT:-}" ] && printf '%s\n' "$STUB_OUT"
-exit "${STUB_RC:-0}"
-WRAP
-chmod +x "$SANDBOX/dirhelper"
-swap_dir_probe() {   # <helper exit code> <what it prints> <what the launcher exported>
-  ( L="$SANDBOX/dirhelper"; lane=repoA11-1
-    STUB_RC="$1"; STUB_OUT="$2"; export STUB_RC STUB_OUT
-    WORKBENCHES_CLAUDE_LANE_DIR="$3"
-    CLAUDE_CODE_SESSION_ID=""; CLAUDE_CONFIG_DIR=""
-    eval "$swap_dir_blk"
-    printf 'dir=[%s] failed=[%s]' "$dir" "${dir_read_failed:+named}" )
-}
-is   "the lane's own recorded checkout is taken where the read answered" \
-     "$(swap_dir_probe 0 /checkouts/lane /launcher/export)" "dir=[/checkouts/lane] failed=[]"
-is   "…8 is a record naming none, and the launcher's word is the next source" \
-     "$(swap_dir_probe 8 '' /launcher/export)" "dir=[/launcher/export] failed=[]"
-is   "…as is a helper predating the read" \
-     "$(swap_dir_probe 2 '' /launcher/export)" "dir=[/launcher/export] failed=[]"
-is   "…while a read that FAILED takes NO substitute and names itself" \
-     "$(swap_dir_probe 6 '' /launcher/export)" "dir=[] failed=[named]"
-has  "…and the record still says which fact it does not carry" "$SWSK_TEXT" "NO dir sub-field: %s"
-
-# THE `/lane-swap` SKILL MAKES THE SAME TEST, and it is run FROM THE FILE rather
-# than restated — the same reason `/restart`'s rung 4 is: a copy is what would
-# go on passing after the file drifted.
-SWSKILL="$SRC_DIR/skills/handoff/SKILL.md"
-# THE WHOLE `window` BLOCK IS EXTRACTED AND RUN, not one line of it: the block
-# is now four reads and two shape checks (F-X13 row (h) put the launcher's own
-# exports behind the live reads, under `R-A11-26`'s superset rule), and a test
-# that eval'd one line would go green over a broken neighbour. `tmux` is a
-# FUNCTION here, so the block's own `tmux display-message` calls are answered
-# by the case rather than by whatever is on PATH.
-skill_win_of() {   # <what tmux answers for #S:#I> <…for #{window_id}> [<REF env>] [<ID env>]
-  local swo_win="$1" swo_wid="$2" swo_ref="${3-}" swo_id="${4-}" swo_blk
-  swo_blk="$(awk '/^win="\$\(tmux display-message -p .#S:#I/,/^\[\[ "\$wid" =~ \^@\[0-9\]\+\$ \]\] && win=/' "$SWSKILL")"
-  case "$swo_blk" in *'&& win='*) : ;; *) printf 'NO BLOCK IN %s\n' "$SWSKILL"; return 1 ;; esac
-  (
-    tmux() { case "$*" in *'#S:#I'*) printf '%s\n' "$swo_win" ;; *window_id*) printf '%s\n' "$swo_wid" ;; esac; }
-    WORKBENCHES_CLAUDE_WINDOW_REF="$swo_ref" WORKBENCHES_CLAUDE_WINDOW_ID="$swo_id"
-    export WORKBENCHES_CLAUDE_WINDOW_REF WORKBENCHES_CLAUDE_WINDOW_ID
-    eval "$swo_blk"; printf '%s' "$win"
-  )
-}
-is "the skill records an <@id> that is one" "$(skill_win_of 'a11sess:0' '@71')" "a11sess:0 @71"
-is "…and records none where tmux answered a pane beside it" "$(skill_win_of 'a11sess:0' '@71 %7')" "a11sess:0"
-is "…nor where a tmux too old printed the format back" "$(skill_win_of 'a11sess:0' '#{window_id}')" "a11sess:0"
-is "…nor for a bare at-sign" "$(skill_win_of 'a11sess:0' '@')" "a11sess:0"
-# F-X13 ROW (h) — THE LAUNCHER'S OWN EXPORTS ARE READ WHERE THE LIVE ONES
-# ANSWER NOTHING. `#71`'s copy read `WORKBENCHES_CLAUDE_WINDOW_REF` and
-# `_WINDOW_ID`; `#26`'s ignored all of them, and `R-A11-26` makes the surviving
-# copy the SUPERSET, so a seventh divergence is absorbed on the same ground. On
-# the normal path the launcher started this session and threaded the window it
-# captured across its re-exec, so a `tmux` that has gone costs the record a
-# sub-field the process already had in hand.
-is "…and falls back to what the launcher exported when tmux answers nothing" \
-   "$(skill_win_of '' '' 'a11sess:4' '@88')" "a11sess:4 @88"
-is "…taking the exported id beside a live ref" \
-   "$(skill_win_of 'a11sess:0' '' '' '@88')" "a11sess:0 @88"
-# AND AN EXPORT IS NO MORE TRUSTED THAN A SHIM: both are shape-checked.
-is "…while an exported ref that is not one is dropped, like a live one" \
-   "$(skill_win_of '' '' 'not-a-window-ref' '@88')" "@88"
-is "…and an exported id that is not one is dropped too" \
-   "$(skill_win_of 'a11sess:0' '' '' 'window-id-please')" "a11sess:0"
-is "…and with nothing anywhere the sub-field is simply absent" \
-   "$(skill_win_of '' '' '' '')" ""
-
-# ---------------------------- clause (c): the DIRECTORY PRECEDENCE, four rungs
-run env FAKE_TMUX_WINDOWS="$A11_WINDOWS_NO_LANE" "$START" --dry-run repoA11 1
-is   "lane-start finds the lane's directory without --dir, from its own record" "$rc" 0
-has  "…naming the rung that answered" "$err" "from the swap record"
-has  "…and planning the cd into it, which Evidence 3 makes load-bearing for CLAUDE.md and the lane's memory" "$err" "cd $A11_DIR"
-# RUNG 1 BEATS THE RECORD: the operator's word is first.
-run env FAKE_TMUX_WINDOWS="$A11_WINDOWS_NO_LANE" "$START" --dry-run --dir "$HOME/projects/repoA" repoA11 1
-has  "--dir beats the record, because rung 1 is the operator's own word" "$err" "cd $HOME/projects/repoA"
-# RUNG 3: a lane with a STARTED that carries a dir and no swap record at all.
-{ printf '# lane repoA11-7 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11-7, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11-7 → home opensoft/repoA11; estate repoA11; dir %s; profile team-05a; window a11sess:0 @71\n' "$A11_ID" "$A11_DIR"
-} > "$LOGD/repoA11-7.md"
-add_seed_row "| \`repoA11-7\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/u.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose only record of its directory is its STARTED line"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$START" --dry-run repoA11 7
-has  "…and failing a swap record, the lane's LOG answers" "$err" "from the lane's log"
-has  "…with the same directory" "$err" "cd $A11_DIR"
-# RUNG 4: the default, and ONLY for a lane that has never been started under
-# this amendment.
-run "$START" --dry-run repoA11b 1
-has  "a lane with no recorded directory falls to \$PROJECTS_ROOT/<repo>, which is what it always did" \
-     "$err" "cd $HOME/projects/repoA11b"
-# AND THERE IS NO FIFTH RUNG: a lane whose recorded directory is GONE is a
-# refusal naming --dir, never a silent re-home from the cwd.
-{ printf '# lane repoA11-8 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoA11-8, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoA11-8 → home opensoft/repoA11; estate repoA11; dir %s/a-directory-that-is-gone; profile team-05a; window a11sess:0 @71\n' "$A11_ID" "$HOME"
-} > "$LOGD/repoA11-8.md"
-add_seed_row "| \`repoA11-8\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/t.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose recorded directory no longer exists"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$START" --dry-run repoA11 8
-is   "a recorded directory that is gone is a REFUSAL" "$rc" 1
-has  "…naming the path" "$err" "a-directory-that-is-gone"
-has  "…the rung it came from" "$err" "from the lane's log"
-has  "…and the one flag that fixes it" "$err" "--dir"
-
-# ------------------------------- EVIDENCE 7: THE LANE WHOSE CHECKOUT IS NESTED
-#
-# Reported by Brett Heap 2026-09-13T23:01:02Z
-# (brettheap/new-workstation#20, comment 5656793094). `pclaude team03m`
-# auto-selected the saved lane `opsXfactory-5`, `lane-start` derived
-# `~/projects/opsXfactory` — which does not exist — and EXITED 1 BEFORE CLAUDE
-# STARTED, leaving a pane that said `[exited]`. The real checkout is
-# `~/projects/xFactory/xFactories/OpsxFactory`.
-#
-# THE RECORD SHAPE IS COPIED FROM THE LIVE LOG (read only): that lane's last
-# RESUMED and PAUSED lines carry `home opensoft/OpsxFactory; estate xFactory`
-# and `window …; workstation docker-desktop` — and NO `dir`, the field this
-# amendment adds and that nothing backfills (Amendment 7(i)). The lane label
-# and the repository are not even the same string: `opsXfactory` against
-# `OpsxFactory`.
-E7_ID="e7e70001-0007-4000-8000-e7e700010007"
-mkdir -p "$HOME/projects/xFactory/xFactories/OpsxFactory"
-git init -q -b main "$HOME/projects/xFactory/xFactories/OpsxFactory"
-git -C "$HOME/projects/xFactory/xFactories/OpsxFactory" remote add origin "git@github.com:opensoft/OpsxFactory.git"
-add_seed_row "| \`opsXfactory-5\` | harness \`$E7_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/xFactory/o.md | ACTIVE |"
-{ printf '# lane opsXfactory-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'RESUMED — lane opsXfactory-5, session %s@Eagle, 2026-09-13T03:30:02Z, lane:opsXfactory-5 → home opensoft/OpsxFactory; estate xFactory\n' "$E7_ID"
-  printf 'PAUSED — lane opsXfactory-5, session %s@docker-desktop, 2026-09-13T22:41:57Z, lane:opsXfactory-5 → swap; window claude-team-03l-20260913220714-66271:0; workstation docker-desktop — on Brett Heap'"'"'s word: nothing in flight\n' "$E7_ID"
-} > "$LOGD/opsXfactory-5.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed Evidence 7's record shape: home and estate, and no dir"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-# THE DEFAULT IS NOT THERE, AND THAT USED TO BE THE WHOLE STORY.
-is   "Evidence 7's default checkout really is absent, which is the fixture" \
-     "$([ -d "$HOME/projects/opsXfactory" ] && printf present || printf absent)" "absent"
-# RUNG 6 ANSWERS: a checkout of the lane's RECORDED HOME, two levels under
-# $PROJECTS_ROOT, proved by its own `origin` — not by its name.
-run "$START" --dry-run opsXfactory 5
-is   "lane-start no longer dies on a lane whose checkout is nested (Evidence 7)" "$rc" 0
-has  "…finding the checkout of the home its own record names" "$err" "cd $HOME/projects/xFactory/xFactories/OpsxFactory"
-has  "…and naming the rung that answered" "$err" "Evidence 7"
-# AND IT IS PROVED BY `origin`, NEVER BY THE NAME. A directory with the right
-# name and somebody else's origin is not this lane's checkout, and taking it
-# would re-home the lane for every `#n` it writes afterwards.
-mkdir -p "$HOME/projects/imposter/OpsxFactory"
-git init -q -b main "$HOME/projects/imposter/OpsxFactory"
-git -C "$HOME/projects/imposter/OpsxFactory" remote add origin "git@github.com:someone/else.git"
-run "$START" --dry-run opsXfactory 5
-has  "…and a same-named checkout with another origin is never taken" "$err" "cd $HOME/projects/xFactory/xFactories/OpsxFactory"
-# NOW THE REFUSAL: the same record shape with no provable checkout anywhere.
-mv "$HOME/projects/xFactory/xFactories/OpsxFactory" "$HOME/projects/xFactory/xFactories/OpsxFactory-moved-away"
-run "$START" --dry-run opsXfactory 5
-is   "…and with nothing provable it REFUSES with 2, not the 1 that printed [exited]" "$rc" 2
-has  "…saying nothing was started" "$err" "nothing was started"
-has  "…naming the one act that RECORDS the directory, filled in" "$err" "lane-start --dir <path> opsXfactory 5"
-has  "…and what it tried, so the refusal is readable" "$err" "project.yaml legs of opensoft/OpsxFactory"
-hasnt "…and it never guesses the same-named checkout with the wrong origin" "$err" "cd $HOME/projects/imposter"
-# RUNG 5 — THE ESTATE'S `project.yaml` LEGS, which are a DECLARATION rather
-# than a search: the leg's `path` is resolved against the manifest's own
-# directory, and the candidate is still proved by its `origin`.
-mkdir -p "$HOME/projects/xFactory/legged/inner"
-git init -q -b main "$HOME/projects/xFactory/legged/inner"
-git -C "$HOME/projects/xFactory/legged/inner" remote add origin "git@github.com:opensoft/OpsxFactory.git"
-{ printf 'schema_version: 1\nkind: project-manifest\nid: xf\nname: "xFactory"\nlegs:\n'
-  printf '  - role: assembly\n    repository: opensoft/Something-Else\n    path: "."\n'
-  printf '  - role: code\n    repository: opensoft/OpsxFactory\n    path: inner\n'
-} > "$HOME/projects/xFactory/legged/project.yaml"
-run "$START" --dry-run opsXfactory 5
-is   "the estate's project.yaml legs answer before the refusal" "$rc" 0
-has  "…taking the leg's own path, resolved against the manifest" "$err" "cd $HOME/projects/xFactory/legged/inner"
-has  "…and saying which manifest declared it" "$err" "legs of"
-rm -rf "$HOME/projects/xFactory/legged" "$HOME/projects/imposter"
-mv "$HOME/projects/xFactory/xFactories/OpsxFactory-moved-away" "$HOME/projects/xFactory/xFactories/OpsxFactory"
-# AND ONE `--dir` CLOSES IT FOR EVER: the field is written, and every later
-# read — `lane-dir`, and `restart`'s `cd` — takes it from the lane's own log
-# rather than from a rung at all.
-FAKE_TMUX_WINDOW="e7sess:@51" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME=claude \
-  CLAUDE_PROFILE_NAME=team-03l \
-  run "$START" --dir "$HOME/projects/xFactory/xFactories/OpsxFactory" opsXfactory 5 --no-launch
-is   "one lane-start --dir records the field Evidence 7's record was missing" "$rc" 0
-has  "…in the lane's own log" "$(cat "$LOGD/opsXfactory-5.md")" "dir $HOME/projects/xFactory/xFactories/OpsxFactory"
-run "$E" lane-dir opsXfactory-5
-is   "…so lane-dir answers for it now" "$rc" 0
-is   "…with the path that was named once" "$out" "$HOME/projects/xFactory/xFactories/OpsxFactory"
-run "$START" --dry-run opsXfactory 5
-has  "…and the next start takes it from the LOG rather than from any rung" "$err" "from the lane's log"
-
-section "== Amendment 11: the cross-lane write clause (d) rule 1 forbids =="
-#
-# THE TEST THAT WOULD HAVE CAUGHT EVIDENCE 2(b), written here and owed to the
-# `opensoft/brett-wip` hotfix that `openRepoTools#24` — act 3, merged as
-# `d4b5710` — ports into this tree.
-# `lane-start:630-640` — step 3b — overwrites the resume target with the uuid of
-# whatever session is live in the window the command was typed in, whenever that
-# uuid is not in the lane's published cell. Typed from ANOTHER lane's window
-# that is a cross-lane write: lane X is resumed as lane Y's transcript, and X's
-# row is stamped with Y's uuid, in the one cell Amendment 6(b) makes the resume
-# target. The fence is OWNERSHIP ALONE (`R-A11-1` corrected): the window's name
-# is the lane, or `live-holder` answered `here`.
-VT_ID="eeee0001-1111-4000-8000-eeee00011111"
-add_seed_row "| \`repoVT-1\` | harness \`$VT_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoVT/x.md | ACTIVE |"
-add_seed_row "| \`repoVT-2\` | pending — set by the session's first act | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoVT/y.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the cross-lane window case"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-mkdir -p "$HOME/projects/repoVT"
-git init -q -b main "$HOME/projects/repoVT"
-git -C "$HOME/projects/repoVT" remote add origin "https://github.com/opensoft/repoVT.git"
-# lane Y's window: named for repoVT-1, and repoVT-1's own live session is in it.
-write_record_ns "$sessions_dir/live-vt.json" "$VT_ID" "$LIVE_PID" "$live_start" "vtsess:@31.%31" "repoVT-1" "user" "busy"
-FAKE_TMUX_WINDOW="vtsess:@31" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME="repoVT-1" \
-  run "$START" --dry-run --dir "$HOME/projects/repoVT" repoVT-2
-# THE TWO `case`s ARE HOISTED OUT OF THE `$( )`, and they have to be (A9
-# Addendum 4, R-A9-11, and `test_no_shipped_bash_opens_a_case_inside_a_command_substitution`
-# is what holds the rule now). Bash 3.2 reads the `)` that closes a case PATTERN
-# as the one that closes the command substitution, so both of these were a
-# syntax error on macOS and nowhere else: at `708395e` the assertion compared a
-# fragment of THIS FILE'S OWN SOURCE — `printf 'resumed Y' ;; *) printf 'did
-# not' ;; esac)` — against `did not`, and `tests-macos` was two cases redder
-# than every GNU runner for a defect in the test rather than in `lane-start`.
-# Same two tests, two variables earlier.
-case "$err" in *"--resume $VT_ID"*) vt_resumed="resumed Y" ;; *) vt_resumed="did not" ;; esac
-case "$err" in *"append-session-id repoVT-2"*"$VT_ID"*) vt_stamped="stamped Y" ;; *) vt_stamped="did not" ;; esac
-is  "lane-start X typed from lane Y's window never resumes X as Y's transcript" \
-    "$vt_resumed" "did not"
-is  "…and never plans X's row to be stamped with Y's uuid" \
-    "$vt_stamped" "did not"
-has "…saying which window vetoed it and why" "$err" "which is another lane the register has a row for"
-is  "…and the run itself still exits 0, because a veto is not a refusal" "$rc" 0
-# A NAME IS A VETO AND NEVER A PERMISSION (`R-A11-12`). A window still called
-# `claude` vetoes nothing, and the taking goes ahead — which is the case the
-# first correction was made to preserve and the second broke: 8 of this
-# workstation's 16 windows were named `claude`, and this lane was in one three
-# times in a day. The uuid here is in NO row at all, which is what a `/clear`, a
-# usage reset and a profile switch leave behind — so neither veto has anything
-# to fire on and step 3b does exactly what it exists for.
-VT_FRESH="eeee0002-2222-4000-8000-eeee00022222"
-rm -f "$sessions_dir/live-vt.json"
-write_record_ns "$sessions_dir/live-vt2.json" "$VT_FRESH" "$LIVE_PID" "$live_start" "vtsess:@31.%31" "openrepoproject-b9" "derived" "busy"
-FAKE_TMUX_WINDOW="vtsess:@31" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME="claude" \
-  run "$START" --dry-run --dir "$HOME/projects/repoVT" repoVT-2
-has "a window named claude vetoes nothing, so step 3b still stamps the cell" "$err" "the harness minted a new transcript"
-# AND THE SAME UUID IS STILL REFUSED FROM A WINDOW NAMED FOR ANOTHER LANE. The
-# register veto cannot reach it — no row names it — so this is the case veto 2
-# exists for, and the one Evidence 2(b) actually was.
-FAKE_TMUX_WINDOW="vtsess:@31" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME="repoVT-1" \
-  run "$START" --dry-run --dir "$HOME/projects/repoVT" repoVT-2
-has "…while the very same uuid IS vetoed from a window named for another lane" "$err" "which is another lane the register has a row for"
-# THE ASSERTION IS ON THE PAYLOAD, NOT ON THE VERB. A vetoed run still prints
-# `lane-start`'s own "stamp it as this session's first act" hint for the FRESH
-# session it is about to mint, and that hint names `append-session-id` — which
-# is the legitimate act, not the cross-lane write. What must never appear is the
-# OTHER lane's uuid inside that cell edit, which is step 3b's own `→ harness
-# <uuid>` payload.
-hasnt "…so the other session's uuid reaches no cell edit of repoVT-2's row" "$err" "→ harness $VT_FRESH"
-
-# AND VETO 2 FAILS CLOSED, WHICH UNTIL THIS ROUND IT DID NOT (`R-A11-12`, clause
-# (d) rule 1 verbatim: *"Both reads fail closed: any answer but 0 naming another
-# lane or 8 leaves the cell and the resume target alone, because here an empty
-# answer is what PERMITS the take"*). The arm was `0) veto ;; *) : ;;`, so EVERY
-# code but 0 permitted the take and a `register-row` that could not answer was
-# read as "the session is free" — the one reading the ruling forbids. The
-# register veto beside it (adoption act 0's, `3719d97`) has always been written
-# this way and says so; this is the second layer catching up with it.
-#
-# The window is named for another lane and the live uuid is in NO row, so veto 1
-# has nothing to fire on: this layer is the only thing between that session and
-# repoVT-2's append-only cell.
-cat > "$SANDBOX/vetoedit" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}:${2-}" in
-  register-row:repoVT-1) printf 'register-row: simulated failure\n' >&2; exit "${VETO_RC:-1}" ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/vetoedit"
-# 1 an environment failure · 2 the code an older helper and a name that is not
-# lane-shaped both give · 6 a code no read of this window's name can legitimately
-# answer with. None of the three is 0-naming-another-lane and none is 8.
-for vrc in 1 2 6; do
-	FAKE_TMUX_WINDOW="vtsess:@31" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME="repoVT-1" \
-	  run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/vetoedit" VETO_RC="$vrc" \
-	    "$START" --dry-run --dir "$HOME/projects/repoVT" repoVT-2
-	has   "a window-name read exiting $vrc VETOES the take rather than permitting it" \
-	      "$err" "is NOT taken as repoVT-2's"
-	has   "…naming the code it came back with, so a failed read reads differently from a real row" \
-	      "$err" "exited $vrc"
-	hasnt "…so that session's uuid reaches no cell edit of repoVT-2's row" "$err" "→ harness $VT_FRESH"
-	hasnt "…and it is not made repoVT-2's resume target either" "$err" "--resume $VT_FRESH"
-	is    "…while the run itself still exits 0, because a veto is not a refusal" "$rc" 0
-done
-# AND 8 IS STILL PERMISSION, which is the half that keeps step 3b alive: a window
-# whose lane-shaped name no row knows does not veto, and the take goes ahead.
-cat > "$SANDBOX/vetoedit8" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}:${2-}" in
-  register-row:repoVT-1) exit 8 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/vetoedit8"
-FAKE_TMUX_WINDOW="vtsess:@31" FAKE_TMUX_WINDOW_INDEX=0 FAKE_TMUX_WINDOW_NAME="repoVT-1" \
-  run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/vetoedit8" \
-    "$START" --dry-run --dir "$HOME/projects/repoVT" repoVT-2
-has "…while an 8 from that same read still PERMITS it — fail-closed is not refuse-always" \
-    "$err" "the harness minted a new transcript"
-
-rm -f "$sessions_dir/live-vt2.json"
-rm -f "$sessions_dir/live-vt.json"
-unset FAKE_TMUX_WINDOWS
-
-section "== Amendment 11 decision 7, as Amendment 18 Addendum 2 leaves it: \`lane <name>\` =="
-#
-# THE TWO SURFACES BRETT HEAP'S DIRECTION NAMES, and the count they met before
-# this word existed. Measured on Eagle on 2026-09-13, after the tmux server was
-# replaced: EACH MET 1 PROMPT OFFERING 2 CHOICES AND WAS OFFERED THE WRONG
-# LANE — every `@id` on the workstation had been reissued from `@0`, four of
-# five windows were named `claude`, and all five swap records named sessions
-# from the old server, so the launcher's precedences 2 and 3 answered nothing
-# and precedence 4 offered the workstation's newest swap, `openXfactory-5`, to a
-# session that was `openRepoProject-1`. Declining was the only correct answer,
-# and declining left the operator where they started.
-#
-# `lane <name>` needs no window, no record of a window and no guess: only the
-# lane's name, its `dir` and its `profile`. Both cases below run it FOR REAL
-# with stdin closed, so a command that asked anything would die rather than
-# quietly pass.
-#
-# THE WORD IS `lane <name>` AND THE CASES ARE `restart <lane>`'s (AMENDMENT 18
-# ADDENDUM 2, ratified 2026-09-14T16:50:32Z verbatim "ratify", on Brett Heap's
-# ruling *"i think we can drop restart as a cli command … lane does all the
-# things a user wants"*). The act is the same act — the launcher's path, the
-# lane's own recorded directory and profile, asking nothing — so every case
-# below is the case decision 7 was proved with, re-pointed at the word that is
-# now on the person's PATH.
-#
-# TWO OF `restart`'s CASES ARE NOT HERE, AND BOTH BECAME SOMETHING ELSE: the
-# bare word that restarted THIS WINDOW's lane, and the bare word that printed
-# the per-repo listing and stopped. Bare `lane` is the numbered PICK (Addendum
-# 1) and has its own section below, where the listing, the one question, each
-# answer and the no-terminal case are run. Nothing that was asserted about the
-# act is dropped; what moved is which word performs it.
-LANE="$OPENREPOTOOLS_BIN_DIR/lane"
-LANES_CMD="$OPENREPOTOOLS_BIN_DIR/lanes"
-cat > "$SANDBOX/fakebin/pclaude" <<'FAKE'
-#!/usr/bin/env bash
-printf 'cwd=%s argv=%s\n' "$PWD" "$*" >> "${FAKE_PCLAUDE_LOG:-/dev/null}"
-FAKE
-chmod +x "$SANDBOX/fakebin/pclaude"
-export FAKE_PCLAUDE_LOG="$SANDBOX/pclaude.log"
-# The host may have a real `lclaude` on PATH. The picker deliberately prefers
-# it in production, so pin its documented $PCLAUDE seam to this suite's fake
-# when asserting the exact argv handed to a launcher.
-export PCLAUDE="$SANDBOX/fakebin/pclaude"
-: > "$FAKE_PCLAUDE_LOG"
-
-# THE LANE-NAME FENCE IS THE HELPER'S OWN, and it was a first-character test
-# (#26 review of `3d06a2b`, `restart:268`). `[A-Za-z0-9]*)` pins one character,
-# so a string that is not a lane name reached `register-row` and the person was
-# told "the register has no row for lane repoA11-1/extra" — sent looking for a
-# missing row instead of being told what they typed. The pattern moved to `lane`
-# with the act, and `test_lane_fences_a_lane_name_the_way_the_helper_does` holds
-# the two spellings to one rule.
-run env -u TMUX "$LANE" "repoA11-1/extra" </dev/null
-is   "lane refuses a lane name that is not one, whole-string" "$rc" 2
-has  "…saying what a lane name is, in lanes-edit.sh's own words" "$err" "not opening with . or -"
-hasnt "…and never reporting it as a missing row" "$err" "has no row for lane"
-run env -u TMUX "$LANE" "repoA11-1 x" </dev/null
-is   "…a space is refused too" "$rc" 2
-# A `-`-LED WORD IS AN OPTION BEFORE `--` AND A LANE NAME AFTER IT, and both
-# refusals are asked for: the parser's 64 for the word it cannot be, and the
-# FENCE's own 2 for the name it is not. `restart` had only the second, because
-# its parser spent 2 on an unknown option too.
-run env -u TMUX "$LANE" "-repoA11-1" </dev/null
-is   "…a leading dash is refused as the option it looks like" "$rc" 64
-has  "…naming it as one" "$err" "unknown option '-repoA11-1'"
-run env -u TMUX "$LANE" -- "-repoA11-1" </dev/null
-is   "…and past \`--\`, where it can only be a name, the helper's own fence refuses it" "$rc" 2
-has  "…in lanes-edit.sh's words again" "$err" "not opening with . or -"
-# A FLAG WHERE A VALUE BELONGS IS A FLAG (opensoft/openRepoTools#80 item 1,
-# Copilot's review of workBenches#91 at `lane:215`). `lane --dir --all` took
-# `--all` as the checkout, so the listing of every repository a person asked
-# for never ran; `--force --dry-run` was a REAL takeover whose why was the word
-# `--dry-run`. Each spaced value arm refuses a `-`-led value with 64 and names
-# the `=` spelling, which is how a value that really begins with `-` is given.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" --dir --all </dev/null
-is   "lane --dir --all is refused as a usage error, not run with a checkout called --all" "$rc" 64
-has  "…naming the flag that would have swallowed another" "$err" "--dir needs a value and '--all' is a flag"
-has  "…and the = spelling that gives a dash-led value back" "$err" "--dir=--all"
-run env -u TMUX "$LANE" repoA11-1 --force --dry-run </dev/null
-is   "…and so is --force taking a flag as its WHY" "$rc" 64
-has  "…in the same words" "$err" "--force needs a value and '--dry-run' is a flag"
-run env -u TMUX "$LANE" repoA11-1 --wait --switch </dev/null
-is   "…and --wait taking one as its seconds" "$rc" 64
-has  "…named as the flag it is, not as a number it is not" "$err" "--wait needs a value and '--switch' is a flag"
-is   "…and none of the three launched anything" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# CASE 1 — A FRESH TERMINAL OUTSIDE TMUX. No window, no record of one, nothing
-# to guess from.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" repoA11-1 </dev/null
-is   "lane <name> from a fresh terminal outside tmux exits 0" "$rc" 0
-has  "…launching through the launcher, never \`claude\` itself (Evidence 4)" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoA11-1 team-05a"
-has  "…after cd-ing into the lane's own recorded directory (Evidence 3)" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "cwd=$A11_DIR"
-has  "…saying which profile it took and where from" "$out" "from the lane record"
-hasnt "…and NOTHING is asked: no confirmation" "$out$err" "[y/N]"
-hasnt "…and no question of any kind" "$out$err" "which?"
-
-# THE LATE SWAP — `lane <name> <profile>` NAMES THE ACCOUNT (Brett Heap's
-# refinement of 2026-09-14T14:1xZ, from his question "when do i use lane vs
-# restart … they seem almost the same to me"): the recorded profile is what a
-# person gets by typing nothing, and the second argument is how they switch,
-# exactly as `pclaude --lane <lane> <profile>` already takes it.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" repoA11-1 team-09z </dev/null
-is   "lane <name> <profile> exits 0" "$rc" 0
-has  "…handing the launcher the profile that was NAMED, not the one recorded" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoA11-1 team-09z"
-has  "…in the same recorded directory" "$(cat "$FAKE_PCLAUDE_LOG")" "cwd=$A11_DIR"
-has  "…and saying the profile came from the command line" "$out" "named on the command line"
-
-# EVIDENCE 7's LANE, AFTER THE ONE `--dir`: `lane` cd's into the checkout the
-# record now names, which is the whole point of naming it once. Before the
-# `lane-start --dir` above, this lane's record carried `home` and `estate` and
-# no `dir` at all and the launcher's own derivation was
-# `$PROJECTS_ROOT/opsXfactory`, which does not exist.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" opsXfactory-5 </dev/null
-is   "lane exits 0 for Evidence 7's lane once its directory is recorded" "$rc" 0
-has  "…cd-ing into the nested checkout and not into \$PROJECTS_ROOT/<repo>" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "cwd=$HOME/projects/xFactory/xFactories/OpsxFactory"
-has  "…with the profile that one start recorded" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane opsXfactory-5 team-03l"
-# AND THE REFUSAL A LANE WITH NO RECORDED DIRECTORY STILL GETS is ONE LINE
-# naming the act that RECORDS it — never an exit 1 with nothing on screen,
-# which is what Evidence 7 actually met.
-# A PROFILE AND NO DIRECTORY, because the profile is refused first and this case
-# is about the OTHER refusal.
-add_seed_row "| \`repoE7x-1\` | harness \`$E7_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/e7.md | ACTIVE |"
-{ printf '# lane repoE7x-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoE7x-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoE7x-1 → home opensoft/repoE7x; estate repoE7x; profile team-05a\n' "$E7_ID"
-} > "$LOGD/repoE7x-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane with a profile and no recorded directory"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" repoE7x-1 </dev/null
-is   "lane refuses with 2 for a lane whose record names no directory" "$rc" 2
-has  "…naming the act that RECORDS it, filled in" "$err" "lane-start --dir <the lane's checkout> repoE7x 1"
-has  "…saying that later runs then read it back" "$err" "reads it back"
-is   "…and launching nothing at all" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# CASE 2 — THE SAME, TYPED IN A WINDOW NAMED `claude`. 8 of this workstation's
-# 16 windows were in that state; the launcher's precedence 2 cannot fire in any
-# of them, and precedence 3 cannot either, because a window `lane-start` never
-# renamed had no swap written from it.
-: > "$FAKE_PCLAUDE_LOG"
-FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="a11sess:@71" FAKE_TMUX_WINDOW_INDEX=0 \
-  run "$LANE" repoA11-1 </dev/null
-is   "lane <name> in a window named 'claude' exits 0" "$rc" 0
-has  "…launching the same lane with the same profile, from the record" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoA11-1 team-05a"
-hasnt "…asking nothing here either" "$out$err" "[y/N]"
-
-# THE LAUNCHER'S PRECEDENCE — `$PCLAUDE`, else `lclaude`, else `pclaude`, else
-# `claude-profile` — IS PROVED HERE AND NOT BY THE HOST (opensoft/openRepoTools#143).
-# Every case above runs under the `$PCLAUDE` export at the head of this section,
-# so none of them reaches the rule that picks a launcher when that seam is unset.
-# Before the export (`c1bac0d`) the rule was exercised by whatever the host had
-# installed: a workstation with workBenches' `lclaude` found the real one first,
-# which is `exec pclaude --with-lane "$@"`, and read eight false reds, while a CI
-# runner has no `lclaude` and could not tell the rule from its absence. Each case
-# below names its own PATH, so the host's launcher is never a candidate.
-#
-# THE TWO FAKES ARE IN TWO DIRECTORIES AND THE `pclaude` ONE COMES FIRST on the
-# PATH of the case that wants `lclaude`, because `command -v lclaude ||
-# command -v pclaude` prefers a NAME, and a case with both in one directory
-# would go green for a rule that took whichever was first on PATH. The cases
-# further down take every directory that holds one of the words out of PATH —
-# the a17 section's own way of making a word absent, which on a workstation is
-# the directory the real ones are in. The suite's own `pclaude` is in `fakebin`
-# with the fake `tmux`, `ps` and `pgrep`, so for the last two cases that
-# directory is replaced by links to everything in it but the `pclaude`.
-LP_LOG="$SANDBOX/launcher-precedence.log"
-mkdir -p "$SANDBOX/lpref-l" "$SANDBOX/lpref-p" "$SANDBOX/lpref-c" "$SANDBOX/lpref-bare"
-cat > "$SANDBOX/lpref-l/lclaude" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s cwd=%s argv=%s\n' "${0##*/}" "$PWD" "$*" >> "${LP_LOG:-/dev/null}"
-FAKE
-cp -p "$SANDBOX/lpref-l/lclaude" "$SANDBOX/lpref-p/pclaude"
-cp -p "$SANDBOX/lpref-l/lclaude" "$SANDBOX/lpref-c/claude-profile"
-chmod +x "$SANDBOX/lpref-l/lclaude" "$SANDBOX/lpref-p/pclaude" "$SANDBOX/lpref-c/claude-profile"
-for lp_f in "$SANDBOX/fakebin"/*; do
-  [ "${lp_f##*/}" = pclaude ] || ln -s "$lp_f" "$SANDBOX/lpref-bare/${lp_f##*/}"
-done
-lp_path_without() {   # <word>… — PATH with every directory that holds one of them taken out
-  local lp_dir lp_word lp_hit
-  printf '%s' "$PATH" | tr ':' '\n' | while IFS= read -r lp_dir; do
-    [ -n "$lp_dir" ] || continue
-    lp_hit=0
-    for lp_word in "$@"; do
-      if [ -x "$lp_dir/$lp_word" ]; then lp_hit=1; fi
-    done
-    if [ "$lp_hit" = 0 ]; then printf '%s:' "$lp_dir"; fi
-  done | sed 's/:$//'
-}
-lp_path_no_lclaude="$(lp_path_without lclaude)"
-lp_path_no_launcher="$SANDBOX/lpref-bare:$(lp_path_without lclaude pclaude claude-profile)"
-
-: > "$LP_LOG"
-run env -u TMUX -u PCLAUDE PATH="$SANDBOX/lpref-p:$SANDBOX/lpref-l:$PATH" LP_LOG="$LP_LOG" \
-  "$LANE" repoA11-1 </dev/null
-is   "with \$PCLAUDE unset, lane <name> exits 0 with both launchers on PATH" "$rc" 0
-is   "…and runs lclaude, once and not pclaude, though pclaude's directory is first" \
-     "$(cat "$LP_LOG")" "lclaude cwd=$A11_DIR argv=--lane repoA11-1 team-05a"
-
-: > "$LP_LOG"
-run env -u TMUX -u PCLAUDE PATH="$SANDBOX/lpref-p:$lp_path_no_lclaude" LP_LOG="$LP_LOG" \
-  "$LANE" repoA11-1 </dev/null
-is   "…and with no lclaude on PATH it falls back to pclaude, exiting 0" "$rc" 0
-is   "…running pclaude with the same argv, from the lane's directory" \
-     "$(cat "$LP_LOG")" "pclaude cwd=$A11_DIR argv=--lane repoA11-1 team-05a"
-
-: > "$LP_LOG"
-run env -u TMUX -u PCLAUDE PATH="$SANDBOX/lpref-c:$lp_path_no_launcher" LP_LOG="$LP_LOG" \
-  "$LANE" repoA11-1 </dev/null
-is   "…and with neither of those on PATH claude-profile is the last launcher, exiting 0" "$rc" 0
-is   "…run with the same argv, from the lane's directory" \
-     "$(cat "$LP_LOG")" "claude-profile cwd=$A11_DIR argv=--lane repoA11-1 team-05a"
-
-: > "$LP_LOG"
-run env -u TMUX -u PCLAUDE PATH="$lp_path_no_launcher" LP_LOG="$LP_LOG" \
-  "$LANE" repoA11-1 </dev/null
-is   "…and with none of the three it refuses with 2" "$rc" 2
-has  "…saying there is no launcher on PATH, and never running claude itself" \
-     "$err" "there is no launcher on PATH"
-is   "…launching nothing" "$(cat "$LP_LOG")" ""
-
-: > "$LP_LOG"
-run env -u TMUX PCLAUDE="$SANDBOX/lpref-p/pclaude" PATH="$SANDBOX/lpref-l:$PATH" LP_LOG="$LP_LOG" \
-  "$LANE" repoA11-1 </dev/null
-is   "…while \$PCLAUDE, where it is set, beats an lclaude on PATH, which is the seam this suite pins" "$rc" 0
-is   "…and it is that launcher that runs" \
-     "$(cat "$LP_LOG")" "pclaude cwd=$A11_DIR argv=--lane repoA11-1 team-05a"
-
-# A LANE WITH NO RECORDED PROFILE IS A REFUSAL AND NEVER A GUESS: a wrong
-# profile is a launch into another account, and nothing here may invent one.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" repoA11-2 </dev/null
-is   "lane refuses a lane whose record names no profile" "$rc" 2
-has  "…saying it will not guess, because a wrong profile is another account" "$err" "will not guess"
-has  "…naming the form this word itself takes" "$err" "lane repoA11-2 <profile>"
-has  "…and printing the launcher form that works in the interval" "$err" "pclaude --lane repoA11-2 <profile>"
-is   "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# …AND THE SECOND ARGUMENT IS WHAT THAT REFUSAL NAMES, so it is run. This lane's
-# record carries no `dir` either — it is the pre-clause-(c) shape — so `--dir`
-# is named here too, which is the one run that proves the flag reaches the
-# launcher rather than being resolved and dropped.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" --dir "$A11_DIR" repoA11-2 team-05a </dev/null
-is   "…while the profile named on the command line is enough for that same lane" "$rc" 0
-has  "…launching it under the profile that was typed, with the directory named" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoA11-2 --dir $A11_DIR_R team-05a"
-has  "…from that directory, in the spelling the resolution gave it" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "cwd=$A11_DIR_R"
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" repoNoSuch-9 </dev/null
-is   "lane refuses a lane the register and the logs do not carry" "$rc" 2
-has  "…saying so about the name that was typed" "$err" "no lane called 'repoNoSuch-9'"
-has  "…and names the command that opens one" "$err" "lane-start <repo> <n>"
-is   "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# A LANE NAME IS ONE NAME UNDER ANY CASE (Amendment 15). The one-lane read is
-# asked for the spelling that was TYPED — one log rather than the estate's —
-# and only where that answers nothing of the lane's own is the estate-wide read
-# made and matched case-insensitively. Either way the act runs on the ROW'S OWN
-# spelling, which is what `canon_lane` writes into every line below it.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" REPOa11-1 </dev/null
-is   "lane <name> resolves a name typed in another case" "$rc" 0
-has  "…and launches the lane under the spelling the register carries" \
-     "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoA11-1 team-05a"
-hasnt "…never the spelling that was typed" "$(cat "$FAKE_PCLAUDE_LOG")" "REPOa11-1"
-
-# THE FAIL-CLOSED FAMILY, ON THE READS THIS SURFACE MAKES (#26; Brett Heap,
-# "Take it first, then land"). Amendment 7(d) gives each answer its own code —
-# `0` an answer · `8` NO ANSWER · `2` a helper predating the amendment that
-# added the read · anything else a read that FAILED — and `restart` collapsed
-# every one of them into the ordinary case at three sites. `lane` makes TWO
-# reads in front of a launch, the rows and their grouping, and both are held to
-# the same rule: a register that cannot be read is not "there are no lanes", and
-# a grouping that failed is not "no lane is available".
-: > "$FAKE_PCLAUDE_LOG"
-cat > "$SANDBOX/rowbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf 'lanes-edit: simulated failure\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/rowbroke"
-run env -u TMUX REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/rowbroke" "$LANE" repoA11-1 </dev/null
-is    "a row read that FAILED refuses rather than falling through" "$rc" 1
-has   "…saying what it is not, in Amendment 7(d)'s terms" "$err" "is NOT 'there are no lanes'"
-is    "…and launches nothing at all" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# …while the code that means AN OLDER WORKSTATION is named as one.
-cat > "$SANDBOX/rowold" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf "lanes-edit: unknown subcommand 'lanes'\n" >&2; exit 2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/rowold"
-run env -u TMUX REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/rowold" "$LANE" repoA11-1 </dev/null
-is    "a helper predating Amendment 11 is the contract's 2, not a read that failed" "$rc" 2
-has   "…saying it is an un-upgraded workstation rather than a fault" "$err" "predates lane-collision-protocol Amendment 11"
-has   "…and naming the one act that fixes it" "$err" "openRepoTools --install"
-# THE GROUPING, which is the read Addendum 1 adds and the one that decides
-# WHICH BRANCH a lane takes. A failure there is not "no lane is available".
-: > "$FAKE_PCLAUDE_LOG"
-cat > "$SANDBOX/grpbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lane-groups) printf 'lanes-edit: simulated failure\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/grpbroke"
-run env -u TMUX REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/grpbroke" "$LANE" repoA11-1 </dev/null
-is    "a grouping read that FAILED refuses rather than guessing a branch" "$rc" 1
-has   "…saying what THAT is not" "$err" "is NOT 'no lane is"
-is    "…and launches nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-cat > "$SANDBOX/grpold" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lane-groups) printf "lanes-edit: unknown subcommand 'lane-groups'\n" >&2; exit 2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/grpold"
-run env -u TMUX REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/grpold" "$LANE" repoA11-1 </dev/null
-is    "…and a helper predating Addendum 1 is the contract's 2 as well" "$rc" 2
-has   "…naming the read that is missing" "$err" "lane-groups"
-has   "…and the act that upgrades the workstation" "$err" "openRepoTools --install"
-has   "…while still naming the read that answers today" "$err" "lanes"
-
-# THE PLAN IS A THING A PERSON TYPES (#26, the review of `c3ebcfe`,
-# `restart:472`). Clause (c) admits a directory with a SPACE in it — `lane-start`
-# writes it quoted, which is what makes it one ref under 7(b), and `lane-dir`
-# hands it back unquoted — so `cd /p/spaced dir` was a line that cd's into
-# `/p/spaced`. `lane-start:550`'s one-line `quoted` has printed its own plan that
-# way since it had one; the sibling command printed `${cmd[*]}`.
-SPACE_ID="aaaa0007-5555-4000-8000-aaaa00075555"
-mkdir -p "$HOME/projects/spaced dir"
-add_seed_row "| \`repoSpace-1\` | harness \`$SPACE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoA11/s.md | ACTIVE |"
-{ printf '# lane repoSpace-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoSpace-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoSpace-1 → home opensoft/repoSpace; estate repoSpace; dir "%s"; profile team-05a\n' "$SPACE_ID" "$HOME/projects/spaced dir"
-} > "$LOGD/repoSpace-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose recorded directory carries a space"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX "$LANE" --dry-run repoSpace-1 </dev/null
-is    "lane --dry-run exits 0 for a lane whose directory has a space" "$rc" 0
-has   "…printing a cd line that can be typed" "$out" "cd $HOME/projects/spaced\\ dir"
-hasnt "…and never the one that cd's into half the path" "$out" "cd $HOME/projects/spaced dir"
-has   "…and an exec line quoted the same way" "$out" "exec "
-is    "…launching nothing, which is what --dry-run means" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# AND THE ORDINARY PLAN IS UNCHANGED: a path with no space is printed as itself.
-run env -u TMUX "$LANE" --dry-run repoA11-7 </dev/null
-has   "a directory with nothing to quote is printed as itself" "$out" "cd $A11_DIR"
-has   "…and the lane's own log answers for a lane with no swap record" "$out" "profile team-05a"
-section "== Amendment 11 decision 6: \`lanes\` =="
-# ------- ruling 6: EVERY LANE BY DEFAULT, NARROWED INSIDE A CHECKOUT ---------
-#
-# A11 Addendum 4 ruling 6 was answered NO — clause (j)'s estate-wide default
-# STANDS — over Brett Heap's settlement of 2026-09-13T20:38:11Z, verbatim
-# "Narrow inside a checkout (Recommended)". So: the bare word outside any
-# checkout is every lane the register and the logs know, whatever workstation
-# they are on; inside a lane checkout it is THAT REPOSITORY's lanes and ends
-# with the next free position; `--all` forces the first from anywhere; `--here`
-# is the old workstation-scoped default, kept as an option.
-#
-# THE SUITE RUNS FROM A CHECKOUT — this repository's — so every bare `lanes`
-# below would narrow to it. `--all` is what asks the estate-wide question, and
-# the `--dir` cases are what ask the narrowed one.
-run "$LANES_CMD" --all </dev/null
-is   "lanes --all exits 0 with rows" "$rc" 0
-has  "…and a lane of ANOTHER workstation is in it, which is clause (j)'s default" "$out" "repoA11-3"
-run "$LANES_CMD" --here </dev/null
-is   "lanes --here exits 0" "$rc" 0
-hasnt "…and scopes to this workstation, which is what the old default did" "$out" "repoA11-3"
-has   "…while this workstation's lanes are all there" "$out" "repoA11-1"
-# THE NARROWING, AND THE HALF OF THE SETTLEMENT THAT IS NOT A FILTER.
-run "$LANES_CMD" --prefix repoA11 </dev/null
-is   "a narrowed listing exits 0" "$rc" 0
-has  "…carrying the lanes named for that repository" "$out" "repoA11-1"
-hasnt "…and nothing that is not" "$out" "repoA-1"
-has   "…ending with the NEXT FREE POSITION" "$out" "next free position:"
-has   "…and the exact line that takes it, filled in" "$out" "lane-start repoA11 "
-has   "…with the way back to every lane" "$out" "lanes --all"
-# THE LOWEST FREE ONE, not the highest plus one: repoA11-1..-8 exist in this
-# fixture with gaps, and a register that hands out 12 while 9 is free grows a
-# column nobody reads.
-NEXTFREE="$(printf '%s\n' "$out" | sed -n 's/^ *next free position: *//p' | head -n1)"
-is   "…which is the lowest position no lane of that repository holds" "$NEXTFREE" "9"
-# THE NARROWING NAMES THE REPOSITORY `origin` NAMES, AND NOT THE DIRECTORY THIS
-# SHELL IS STANDING IN. `basename $(git rev-parse --show-toplevel)` is a
-# WORKTREE's own name inside one, so a bare `lanes` run in a worktree of
-# `openRepoTools` called `ort-a11` narrowed to a repository called `ort-a11` and
-# offered `lane-start ort-a11 1` — a lane whose `$PROJECTS_ROOT/<repo>` cannot
-# exist. Every lane on this estate is named for the repository, which is what
-# `origin` says. Proved in a worktree, because a plain clone cannot tell the two
-# apart.
-A11WT="$SANDBOX/a-worktree-named-nothing-like-its-repo"
-git -C "$HOME/projects/repoA11" worktree add -q -b lanes-prefix-probe "$A11WT" 2>/dev/null \
-  || git -C "$HOME/projects/repoA11" worktree add -q "$A11WT" 2>/dev/null || :
-if [ -d "$A11WT" ]; then
-  run env LANES_CWD_PROBE=1 sh -c 'cd "$1" && exec "$2" ' _ "$A11WT" "$LANES_CMD" </dev/null
-  has   "the checkout narrowing names the repository origin names" "$out$err" "repoA11"
-  hasnt "…and never the worktree directory it happens to be standing in" "$out$err" "a-worktree-named-nothing-like-its-repo"
-  git -C "$HOME/projects/repoA11" worktree remove --force "$A11WT" 2>/dev/null || :
-else
-  skip "the checkout narrowing names the repository origin names" "git worktree add refused in this sandbox"
-fi
-# AN EMPTY REPOSITORY STILL GETS THE ANSWER A PERSON CAME FOR.
-run "$LANES_CMD" --prefix repoNoLanesAtAll </dev/null
-is   "a repository with no lanes exits 8" "$rc" 8
-has  "…saying so in its own name" "$out" "no lane of repoNoLanesAtAll is recorded"
-has  "…and still giving the next free position, which is 1" "$out" "next free position:  1"
-has  "…and the line that takes it" "$out" "lane-start repoNoLanesAtAll 1"
-# `lane-start <repo>` WITH NO POSITION LISTS AND SUGGESTS, and launches nothing.
-: > "$FAKE_CLAUDE_LOG"
-run "$START" repoA11
-is    "lane-start <repo> with no position still exits 2" "$rc" 2
-has   "…saying what it is" "$err" "is a repository and not a lane"
-has   "…printing that repository's lanes" "$err" "repoA11-1"
-has   "…and the next free position, filled in" "$err" "lane-start repoA11 "
-has   "…while the refusal names the position it now has a listing for" "$err" "with a position from the listing above"
-is    "…and launches nothing" "$(cat "$FAKE_CLAUDE_LOG")" ""
-# AND THE REFUSAL PROMISES A LISTING ONLY WHERE ONE WAS MADE (#26, the review of
-# `c3ebcfe`, `lane-start:602`). `|| :` made every code of that read the same
-# code, so a `lanes` that FAILED still ended "with a position from the listing
-# above" — pointing a person at its refusal. `0` and `8` both print one (8 is the
-# empty repository, whose listing IS the next free position), `2` says in its own
-# words that the workstation has not taken act 3's install, and anything else is
-# a read that failed. Nothing of the listing is re-rendered here on any of them.
-cat > "$SANDBOX/lsbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf 'lanes-edit: simulated failure\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/lsbroke"
-: > "$FAKE_CLAUDE_LOG"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/lsbroke" "$START" repoA11
-is    "lane-start <repo> still refuses with 2 when the listing read fails" "$rc" 2
-has   "…naming the read that failed rather than being silent about it" "$err" "that listing FAILED (exit 1)"
-hasnt "…and never pointing at a listing nobody got" "$err" "from the listing above"
-has   "…while the form that works is still there" "$err" "is not a lane: a lane is <repo>-<position>"
-is    "…and launches nothing" "$(cat "$FAKE_CLAUDE_LOG")" ""
-
-# THE TWO SPELLINGS OF ONE FLAG GIVE ONE ANSWER (#26, the review of `c3ebcfe`,
-# `lane-start:707`). `--dir ""` refuses; `--dir=` set the variable to nothing and
-# fell through as if no directory had been named at all, so the rungs below it
-# ran — one of which is `$PROJECTS_ROOT/<repo>` — and `lane-start --dir= <repo>
-# <n>` started in a checkout the operator never asked for. `restart:151`, the
-# same flag on the sibling command, has carried the guard on both spellings all
-# along, which is what makes this a divergence rather than a decision.
-: > "$FAKE_CLAUDE_LOG"
-run "$START" --dir= repoA11 9
-is    "lane-start --dir= refuses, exactly as --dir \"\" already did" "$rc" 2
-has   "…in that arm's own words" "$err" "--dir needs a path"
-is    "…and launches nothing" "$(cat "$FAKE_CLAUDE_LOG")" ""
-run "$START" --estate= repoA11 9
-is    "…and its neighbour --estate= the same" "$rc" 2
-has   "…in ITS arm's own words" "$err" "--estate needs a name"
-
-# AND THE MANUAL SAYS SO, which is RV-B4 one settlement on: the code took the
-# narrowing in the round that documented the OPPOSITE, and `README-lanes.md`
-# went on calling `lanes` "every lane on this workstation, newest write first"
-# — the pre-settlement default, wrong twice over, because the scope is the
-# ESTATE now and inside a checkout it is one repository. Nothing was red for it:
-# no assertion had ever read that sentence. Read from `$LANE_MANUAL`, the run's
-# own copy, which is the one a person opens.
-if [ -n "$LANE_MANUAL" ]; then
-if [ -r "$LANE_MANUAL" ]; then ok "…and still there for the bare-lanes quotes"
-else bad "…and still there for the bare-lanes quotes" "no readable file at $LANE_MANUAL"; fi
-ln_doc="$(cat "$LANE_MANUAL" 2>/dev/null || :)"
-has   "the manual quotes the settlement that narrowed the bare word" "$ln_doc" \
-      "Narrow inside a checkout (Recommended)"
-has   "…and the one that made \`lane-start <repo>\` list and suggest" "$ln_doc" \
-      "Yes, list and suggest (Recommended)"
-has   "…saying what a bare \`lanes\` lists inside a checkout" "$ln_doc" \
-      "A bare \`lanes\` INSIDE a lane checkout lists **that repository's lanes**"
-has   "…that it ends with the next free position and the line that takes it" "$ln_doc" \
-      "free position** and the exact \`lane-start <repo> <n>\` that takes it, filled in."
-has   "…that the position is the LOWEST free one, which is what this suite proves above" "$ln_doc" \
-      "The position offered is the **lowest** one no lane of that repository holds,"
-has   "…and the way back to every lane, which is the word the stale sentence lacked" "$ln_doc" \
-      "\`lanes --all\`, and a bare \`lanes\` outside every checkout, are clause (j)'s"
-hasnt "…never the pre-settlement default it documented while building the narrowing" "$ln_doc" \
-      "every lane on this workstation"
-else
-  skip "the manual says what a bare lanes lists (seven assertions)" "no spec root in this run: docs/README-lanes.md is the spec leg's (#186, T009)"
-fi
-
-run "$LANES_CMD" --all </dev/null
-is   "lanes exits 0 with rows" "$rc" 0
-has  "…naming this workstation's lanes" "$out" "repoA11-1"
-has  "…with the recorded profile" "$out" "team-05a"
-has  "…the recorded directory" "$out" "$A11_DIR"
-has  "…and the exact line that binds a PAUSED lane, which is what column 10 is" "$out" "bind it: lane repoA11-1"
-has  "…saying it read locally and how old that answer is" "$out" "read locally"
-# F-X20 — COLUMN 10 IS *"for a **paused** lane"*, AND THE LISTING PRINTED ONE
-# FOR EVERY STATE BUT `LIVE`. A lane whose last act was its last is not a lane
-# a person restarts, and offering `lane <name>` for an `ENDED` or a `RETIRED`
-# one is the listing telling them to reopen something that was closed on
-# purpose. Two fixtures, because the two closing verbs are two words.
-add_seed_row "| \`repoFX20-1\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoFX20/a.md | ENDED |"
-add_seed_row "| \`repoFX20-2\` | harness \`$A11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoFX20/b.md | RETIRED |"
-{ printf '# lane repoFX20-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoFX20-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoFX20-1 → home opensoft/repoA11; estate repoA11; dir %s; profile team-05a\n' "$A11_ID" "$A11_DIR"
-  printf 'ENDED — lane repoFX20-1, session %s@Eagle, 2026-09-12T11:00:00Z, lane:repoFX20-1 — window closing; NOTHING IN FLIGHT\n' "$A11_ID"
-} > "$LOGD/repoFX20-1.md"
-{ printf '# lane repoFX20-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoFX20-2, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoFX20-2 → home opensoft/repoA11; estate repoA11; dir %s; profile team-05a\n' "$A11_ID" "$A11_DIR"
-  printf 'RETIRED — lane repoFX20-2, session %s@Eagle, 2026-09-12T11:00:00Z, lane:repoFX20-2 — not coming back\n' "$A11_ID"
-} > "$LOGD/repoFX20-2.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed an ENDED and a RETIRED lane for column 10"
-git -C "$WIP" push -q origin main
-# `--all`, FOR THE REASON THIS SECTION'S OWN HEADER GIVES: the suite runs from a
-# checkout, so a bare word here asks the NARROWED question and these four
-# assertions are about the estate-wide listing. They were bare and were the four
-# red ones at `0303baa` — the listing they read was "no lane of <this checkout>
-# is recorded", which is the right answer to a question they were not asking.
-# AMENDMENT 19(b) AMENDS THIS PAIR. Until 2026-09-14 an ENDED or RETIRED lane
-# was still a ROW in the listing and only lost column 10; the amendment takes it
-# out of the listing altogether — *"`lanes` lists neither CLOSED nor DORMANT
-# lanes by default"* — and `--closed` is what puts it back. The column-10 half is
-# unchanged and is asserted where the row now is.
-run "$LANES_CMD" --all </dev/null
-hasnt "an ENDED lane LEAVES the listing (Amendment 19(b) amends clause (j))" "$out" "repoFX20-1"
-hasnt "…and so does a RETIRED one" "$out" "repoFX20-2"
-has   "…while a PAUSED lane is still in it" "$out" "repoA11-1"
-has   "…with the line that binds it, so the column still means something" "$out" "bind it: lane repoA11-1"
-run "$LANES_CMD" --all --closed </dev/null
-has   "…and --closed puts the ENDED lane back" "$out" "repoFX20-1"
-hasnt "…with no line that binds it, because column 10 is a PAUSED lane's" "$out" "lane repoFX20-1"
-has   "…and the RETIRED one too" "$out" "repoFX20-2"
-hasnt "…and gets no line that binds it either" "$out" "lane repoFX20-2"
-has   "…each under a line saying which verb closed it" "$out" "closed: its object log ends with"
-run "$LANES_CMD" --here </dev/null
-hasnt "a lane of ANOTHER workstation is not in the --here listing" "$out" "repoA11-3"
-run "$LANES_CMD" --all </dev/null
-has  "…and the default estate-wide listing has it" "$out" "repoA11-3"
-run "$LANES_CMD" --repo opensoft/repoA11 </dev/null
-is   "lanes --repo narrows to one repository's lanes" "$rc" 0
-has  "…which is decision 7's per-repo listing, read through the same helper" "$out" "repoA11-1"
-# THE CONTRACT'S FOUR CODES, WHICH ARE NOT THE ONES THIS COMMAND USED (F-X4).
-# SPEC §15 and clause (h)'s row for the read behind it: `0` rows · `8` none ·
-# `64` usage · `2` a helper predating Amendment 11. A typo exited 2, where the
-# contract gives 64; and a workstation whose helper predates this amendment —
-# every workstation until adoption act 3's install reaches it — exited 1, the
-# code for a read that broke.
-# `--all` CLEARS THE LABEL AS WELL AS THE FILTERS, IN EITHER ORDER. The helper's
-# `--all` drops `--repo`, `--dir` and `--prefix`, so the ROWS were always right;
-# `here_repo` is the wrapper's own, and `lanes --all --prefix repoA11` listed
-# every lane in the estate under a footer that said "of repoA11" and offered a
-# next free position computed from one repository's rows (#26 review of
-# `3d06a2b`, `lanes:143`).
-run "$LANES_CMD" --all --prefix repoA11 </dev/null
-is    "lanes --all --prefix exits 0" "$rc" 0
-has   "…listing every lane, which is what --all asks for" "$out" "repoA11-3"
-hasnt "…and labelling the count for no repository" "$out" "of repoA11,"
-hasnt "…nor offering a next free position it did not narrow to" "$out" "next free position"
-run "$LANES_CMD" --prefix repoA11 --all </dev/null
-is    "…and the other order is the same command" "$rc" 0
-has   "…with the same every-lane listing" "$out" "repoA11-3"
-hasnt "…and the same absent label" "$out" "of repoA11,"
-# …while `--prefix` ALONE still narrows and still offers the position.
-run "$LANES_CMD" --prefix repoA11 </dev/null
-has   "a --prefix on its own still names the repository in its count" "$out" "of repoA11,"
-has   "…and still ends with the next free position" "$out" "next free position"
-# AND `--all` IS ABSOLUTE OVER `--lane` TOO, which the helper's own reset left
-# standing (#26, the review of `c3ebcfe`, `lanes-edit.sh:3999`). `--lane` is the
-# narrowest selector there is and it clears the other four for itself, so
-# `--all --lane X` answered about ONE lane under the flag whose comment has said
-# "LAST AND ABSOLUTE" since it was written. The wrapper takes no `--lane`, so
-# this is asked of the helper, which is where the selector lives.
-run "$E" lanes --all --lane repoA11-1
-is    "lanes --all --lane exits 0" "$rc" 0
-has   "…listing every lane, which is what --all asks for" "$out" "repoA11-3"
-run "$E" lanes --lane repoA11-1
-is    "…while --lane on its own is still the one-lane read restart makes" "$rc" 0
-hasnt "…and still reads one log rather than the estate's" "$out" "repoA11-3"
-
-run "$LANES_CMD" repoA11-1 </dev/null
-is   "lanes takes no positional argument, and spends the contract's 64 on it" "$rc" 64
-has  "…and points at the command that does" "$err" "lane repoA11-1"
-run "$LANES_CMD" --repo </dev/null
-is   "…and a flag with no value is refused rather than guessed, with the same 64" "$rc" 64
-run "$LANES_CMD" --nosuchflag </dev/null
-is   "…as is an option it has never heard of" "$rc" 64
-# AND `2` IS KEPT FOR THE ONE THING THE CONTRACT GIVES IT. A helper with no
-# `lanes` subcommand exits 2 (`lanes-edit.sh:4818-4826`), which is expected and
-# silent rather than broken, and the command must not report it as a read that
-# failed.
-cat > "$SANDBOX/oldedit" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf "lanes-edit: unknown subcommand 'lanes'\n" >&2; exit 2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/oldedit"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/oldedit" "$LANES_CMD" </dev/null
-is   "a lanes-edit.sh predating Amendment 11 is the contract's 2, not a read that failed" "$rc" 2
-has  "…saying it is an un-upgraded workstation rather than a fault" "$err" "predates lane-collision-protocol Amendment 11"
-has  "…and naming the one act that fixes it" "$err" "openRepoTools --install"
-# A read that genuinely broke is still 1, so the two are told apart.
-cat > "$SANDBOX/brokeedit" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf 'lanes-edit: simulated failure\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/brokeedit"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/brokeedit" "$LANES_CMD" </dev/null
-is   "…while a read that actually failed stays 1, and is never read as 'no lanes'" "$rc" 1
-has  "…saying so in Amendment 7(d)'s words" "$err" "NOT 'there are no lanes'"
-# A FETCH THAT DID NOT ANSWER IS NOT A FETCH, AND THE FOOTER MAY NOT SAY IT WAS
-# (#26's fail-closed family, `lanes:236`; Brett Heap, "Take it first, then
-# land"). A read in front of a launch MAY NOT REFUSE, so `log_sync` falls back
-# to the local refs, says so on stderr — *"fetch failed — reading the logs as
-# they stand locally"* (`lanes-edit.sh:2902`) — and answers 0. This command
-# threw that sentence away and printed "as of a fetch just now" over it: the one
-# line a person reads to decide whether the answer is CURRENT, asserting the
-# opposite of what the run had already been told.
-#
-# THE STUB IS THE HELPER IN THAT STATE, not a broken one: it prints the same
-# sentence on stderr and still answers from the local refs, exit 0.
-cat > "$SANDBOX/fetchfallback" <<'WRAP'
-#!/usr/bin/env bash
-if [ "${1-}" = lanes ]; then
-  printf 'lanes-edit: fetch failed — reading the logs as they stand locally\n' >&2
-  shift
-  ff_args=()
-  for ff_a in "$@"; do [ "$ff_a" = --fetch ] || ff_args+=("$ff_a"); done
-  exec "$REAL_LANES_EDIT" lanes ${ff_args[@]+"${ff_args[@]}"}
-fi
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/fetchfallback"
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/fetchfallback" "$LANES_CMD" --fetch --all </dev/null
-is    "lanes --fetch still exits 0 when the fetch did not answer" "$rc" 0
-has   "…and the rows are there, because a read in front of a launch may not refuse" "$out" "repoA11-1"
-has   "…while the footer says the answer is LOCAL" "$out" "read LOCALLY: the fetch did not answer"
-has   "…quoting the helper's own sentence rather than a copy of it" "$out" "reading the logs as they stand locally"
-hasnt "…and never claims a fetch it did not get" "$out" "as of a fetch just now"
-# AND THE EMPTY LISTING IS THE CASE THAT MATTERS MOST: "no lane is recorded",
-# read off a stale checkout, is the answer a person is likeliest to act on.
-run env REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/fetchfallback" "$LANES_CMD" --fetch --prefix repoNoLanesAtAll </dev/null
-is    "an empty listing after a fetch that fell back still exits 8" "$rc" 8
-has   "…saying so in its own name" "$out" "no lane of repoNoLanesAtAll is recorded"
-has   "…and that the fetch did not answer, which is why it may be stale" "$out" "the fetch did not answer"
-# …while a fetch that DID answer says so, so the sentence keeps its meaning.
-run "$LANES_CMD" --fetch --all </dev/null
-is    "a fetch that answered exits 0" "$rc" 0
-has   "…and says it is as of a fetch just now" "$out" "as of a fetch just now"
-hasnt "…with no fallback notice anywhere in it" "$out" "the fetch did not answer"
-
-# THE QUIET HALF OF THE SAME DEFECT (#26, the review of `c3ebcfe`, `lanes:411`).
-# `43b6320` closed the LOUD path — the fetch was attempted, failed, and the
-# helper said so. FOUR ways out of `log_sync` never reach the fetch at all and
-# said NOTHING: `LANES_NO_GIT=1`, a `LANES_NO_FETCH=1` already in the
-# environment, a `$LANES_REPO` that is not a checkout, and an
-# `origin/$LANES_BRANCH` `ls-remote` could not confirm — the TIMEOUT among them.
-# On every one of them `--fetch` printed "as of a fetch just now" over a fetch
-# that never ran. The helper records WHY and the `lanes` arm says it in the one
-# phrase the wrapper already reads.
-run env LANES_NO_FETCH=1 "$LANES_CMD" --fetch --all </dev/null
-is    "lanes --fetch with LANES_NO_FETCH=1 already set still exits 0" "$rc" 0
-has   "…with the rows, because a listing may not refuse over a freshness note" "$out" "repoA11-1"
-hasnt "…and never claims the fetch it was told not to make" "$out" "as of a fetch just now"
-has   "…saying instead that the answer is LOCAL" "$out" "read LOCALLY: the fetch did not answer"
-has   "…and naming which of the four reasons this run had" "$out" "LANES_NO_FETCH=1 is set in this environment"
-run env LANES_NO_GIT=1 "$LANES_CMD" --fetch --all </dev/null
-is    "…and the same for a run in which nothing touches git" "$rc" 0
-hasnt "…which also never says 'just now'" "$out" "as of a fetch just now"
-has   "…and names ITS reason rather than the other one" "$out" "LANES_NO_GIT=1 is set"
-# THE HELPER SAYS IT ONLY UNDER `--fetch`, because without it the local read is
-# the documented default (SPEC rev 4 §15) and the notice would be a line saying
-# the command did what it was asked.
-run "$LANES_CMD" --all </dev/null
-hasnt "a listing with no --fetch carries no no-fetch notice of its own" "$out" "NO FETCH WAS MADE"
-hasnt "…on stderr either" "$err" "NO FETCH WAS MADE"
-
-# AND THE CAPTURE FILE THAT COULD NOT BE MADE THREW THE SAME NOTICE AWAY (#26,
-# the review of `c3ebcfe`, `lanes:280`). `mktemp` under a `$TMPDIR` that does not
-# exist fails, and this command's fallback ran the read with `2>/dev/null` — the
-# exact line the fix above replaced — so the footer went back to asserting a
-# fetch it could not check. The notes go to the terminal now and the footer says
-# it does not know.
-run env TMPDIR="$SANDBOX/no-such-tmpdir" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/fetchfallback" "$LANES_CMD" --fetch --all </dev/null
-is    "lanes --fetch with no usable TMPDIR still exits 0" "$rc" 0
-has   "…with the rows" "$out" "repoA11-1"
-hasnt "…and never claims a fetch it could not check on" "$out" "as of a fetch just now"
-has   "…saying in terms that it does not know" "$out" "whether the fetch answered is UNKNOWN"
-has   "…while the helper's own notes reach the person instead of /dev/null" "$err" "reading the logs as they stand locally"
-
-# A RECORDS TREE THAT COULD NOT BE READ IS NOT A LANE WITH NO FORK (#26, the
-# review of `37632b1`). `session_files` returns 1 and sets its own message for
-# exactly that case — `live-holder` has refused on it since `R-A8-3`, which this
-# suite proves a thousand lines above — but `session_records` read it through
-# `|| :` inside a `$( )`, which discards the status with the subshell, and
-# `fork_map`, `live_session_ids` and `lane_forks` each read THEIR source inside a
-# HERE-DOCUMENT, where a substitution's status is discarded outright. The empty
-# answer was then CACHED for the life of the process. So `forks` answered 8 —
-# "no fork of it is live" — and the refusal its own arm has carried since it was
-# written was UNREACHABLE.
-#
-# THE SAME FIXTURE THE `live-holder` CASES USE, and the same reason: the tree
-# itself, not a path through it.
-if [ "$(id -u)" = 0 ]; then
-  skip "an unreadable records tree is a refusal and not 'no fork of it is live'" "running as root, which can read a mode-000 tree"
-else
-  # THE FORK FIXTURE, RE-MADE: the retire cases removed it above, and these two
-  # answers are about a fork that IS live. Removed again below, so nothing after
-  # this block sees a world this block made.
-  printf '{"type":"custom-title","customTitle":"repoA-1","sessionId":"%s"}\n' "$FORK_ID" > "$fork_tdir/$FORK_ID.jsonl"
-  printf '{"pid":%s,"sessionId":"%s","cwd":"/workspace","procStart":"%s","kind":"bg","name":"openrepoproject-b9","status":"busy"}\n' \
-    "$LIVE_PID" "$FORK_ID" "$live_start" > "$sessions_dir/live-fork.json"
-  chmod 000 "$profiles_root"
-  run "$E" forks repoA-1
-  is    "forks exits 1 where this workstation's session records could not be read" "$rc" 1
-  has   "…saying what that is NOT, in its own arm's words" "$err" "That is NOT 'no fork of it is live'"
-  run "$E" who --lane repoA-1
-  hasnt "…and who names no DEFECT it could not establish" "$out" "DEFECT"
-  has   "…saying instead, in terms, that it could not look" "$out" "is NOT established"
-  # THE LISTING ANSWERS AND SAYS WHAT IT COULD NOT ESTABLISH, which is
-  # `43b6320`'s rule for the fetch: this is the read a person makes in FRONT of
-  # a launch, and the collision itself is refused one surface along, by
-  # `lane-start`'s own direct read of the same records.
-  run "$LANES_CMD" --all </dev/null
-  is    "a listing still ANSWERS where the records could not be read" "$rc" 0
-  has   "…with the rows" "$out" "repoA11-1"
-  has   "…and the notice, which reaches the person now the local read's stderr is kept" "$err" "session records could not be read"
-  has   "…saying what that costs the STATE column" "$err" "may show as IDLE or PAUSED"
-  chmod 755 "$profiles_root"
-  run "$E" forks repoA-1
-  is    "…while a readable tree still finds the fork" "$rc" 0
-  has   "…naming the fork's own id" "$out" "$FORK_ID"
-  rm -f "$sessions_dir/live-fork.json" "$fork_tdir/$FORK_ID.jsonl"
-  run "$LANES_CMD" --all </dev/null
-  hasnt "…and a listing off a readable tree carries no notice at all" "$err" "session records could not be read"
-fi
-
-# A RELATIVE `--dir` NAMED TWO DIRECTORIES (#26, the review of `37632b1`,
-# `restart:505`). `restart` cd's into the directory and then execs the launcher
-# WITH THE SAME STRING, which `lane-start` resolves a second time — from the new
-# working directory — so `--dir ../x` meant one checkout to the test here and
-# another to the launch. Asked with `--dry-run`, which prints the exact argv.
-# THE EXPECTATION IS COMPUTED THE WAY THE CODE COMPUTES IT, and that is not
-# pedantry: `pwd -P` is the estate's own idiom for this (`lanes_rows` resolves
-# `--dir` with it), and on macOS `/var` is a symlink to `/private/var`, so the
-# resolved path of this sandbox is the physical one and the sandbox's own
-# spelling is not. Asserting the sandbox's spelling would be asserting that the
-# path was NOT resolved on the one runner where the two differ. `$A11_DIR_R` is
-# that spelling, computed once beside `$A11_DIR` itself.
-run env -u TMUX -C "$A11_DIR" "$LANE" --dry-run --dir . repoA11-1 </dev/null
-is    "lane --dry-run with a relative --dir exits 0" "$rc" 0
-has   "…and the launcher is handed the directory RESOLVED, not the relative spelling" "$out" "--dir $A11_DIR_R"
-hasnt "…never the '.' that means something else after the cd" "$out" "--dir ."
-has   "…and the cd goes to the same resolved path" "$out" "cd $A11_DIR_R"
-
-# THE INSTALLER'S STAGING COMMENT COUNTED FOUR FILES OF ELEVEN (#26, the review
-# of `37632b1`, `openRepoTools:226`) — the same defect as the stale artifact
-# counts `2f44da0` corrected, and the fix is to spell NO number where the code
-# below already derives every one it prints.
-ort_text="$(cat "$SRC_DIR/openRepoTools")"
-hasnt "the installer's staging block no longer counts four of eleven files" "$ort_text" "ALL FOUR IN HAND"
-hasnt "…nor says each of the four is fetched at this ref" "$ort_text" "each of the four is fetched"
-has   "…and says it in the words that cannot go stale" "$ort_text" "ALL OF THEM IN HAND"
-has   "…while the counts it PRINTS stay derived from the list itself" "$ort_text" '${#INSTALLABLES[@]} files or none'
-
-# A HELPER PREDATING THE READ IS NOT A CONTAINER (#26, the review of `29d3417`,
-# `skills/lane-swap/SKILL.md:70`). `workstation` is one of Amendment 11's reads,
-# so a `lanes-edit.sh` that has not taken act 3's install exits 2 and prints
-# nothing — and `-z "$ws"` alone then told the operator of an ordinary host that
-# they were in a container with `$LANES_WORKSTATION` unset, a sentence they
-# cannot act on. Until the install reaches every workstation, 2 is the answer
-# every one of them gives (`R-A11-8`), which makes this the common case. The
-# block is EXTRACTED FROM THE FILE and run against a helper in each state.
-swsk_ws_blk="$(awk '/^ws_pair=""; ws_rc=0$/,/^fi$/' "$SWSK")"
-is   "the swap skill carries its workstation read as a fenced step" \
-     "$( [ -n "$swsk_ws_blk" ] && printf yes || printf no )" "yes"
-swap_ws_probe() {   # <helper exit code> <what it prints>
-  ( L="$SANDBOX/dirhelper"; STUB_RC="$1"; STUB_OUT="$2"; export STUB_RC STUB_OUT
-    eval "$swsk_ws_blk"
-    printf ' ws=[%s] missing=[%s]' "$ws" "${ws_missing:-}" )
-}
-has  "a workstation the helper named is taken, and nothing is said" \
-     "$(swap_ws_probe 0 "$(printf 'Eagle\tseam')")" "ws=[Eagle] missing=[]"
-has  "…a helper predating the read names the INSTALL, not a container" \
-     "$(swap_ws_probe 2 '')" "NO WORKSTATION READ"
-has  "…saying which code it came back with" "$(swap_ws_probe 2 '')" "exited 2 and named none"
-has  "…and still stopping the writes, because a record filed under nothing is the placeholder R-A11-14 refuses" \
-     "$(swap_ws_probe 2 '')" "missing=[1]"
-hasnt "…while never calling that host a container" "$(swap_ws_probe 2 '')" "this is a container"
-has  "…and a container with no value still gets ITS own sentence" \
-     "$(swap_ws_probe 0 "$(printf 'abc123\tcontainer-unset')")" "NO WORKSTATION: this is a container"
-has  "…with the writes stopped there too" \
-     "$(swap_ws_probe 0 "$(printf 'abc123\tcontainer-unset')")" "missing=[1]"
-
-# STEP 2(d) IS TERMINAL, WHICH THE BLOCK SAID EVERYWHERE BUT IN ITS CODE (#26,
-# the review of `29d3417`, `skills/restart/SKILL.md:134`).
-rskill_text="$(cat "$RSKILL")"
-has   "the skill's listing rung stops where the outcome table ends it" "$rskill_text" "NO LANE FOR THIS WINDOW [8] —"
-has   "…on the code the table gives it" "$rskill_text" "exit 8"
-# AND THE READ IT ENDS ON GOES THROUGH THE FENCE (#26, the review of `90cef58`).
-# It was the last read in the file that ignored its own status, and once the rung
-# ENDS in an outcome a `lanes` that exited 1 or 64 would print as [8] — a refusal
-# turned into a no-answer, at the rung whose next act CREATES a row.
-has   "…and its listing read goes through the same fence as every other" \
-      "$rskill_text" 'lread listing "'"'"'no lane of this checkout is in the register'"'"'" lanes'
-hasnt "…with no read left outside it" "$rskill_text" 'LANES_NO_FETCH=1 "$L" lanes ${origin'
-
-# AND `--retire` WRITES NOTHING, WHICH THREE SURFACES STILL SAID IT DID (#26,
-# the review of `29d3417`). The act is the DOOR to Amendment 6(d) and performs
-# none of it: a `RETIRED` carrying a payload is a seventh edit to in-force text
-# and Amendment 7(b) gives that verb none. `lanes`'s own FOOTER has said so
-# since it was written; its header comment, the helper's parser comment and the
-# manual's paragraph had not caught up.
-lanes_text="$(cat "$SRC_DIR/lanes")"
-le_text="$(cat "$SRC_DIR/lanes-edit.sh")"
-hasnt "the listing no longer says the retire act writes a record" "$lanes_text" "which writes the record that"
-has   "…it says what the act does, which is prove and print" "$lanes_text" "which PROVES the pid or uuid is"
-hasnt "the helper's parser comment no longer says one writer still writes that line" "$le_text" '`<pid|uuid>` writes `RETIRED'
-has   "…it names the line as the legacy an append-only log still carries" "$le_text" "NOTHING WRITES ONE ANY MORE"
-# The manual's half is guarded like the two sections that read it: `ln_doc` is
-# bound only when the run has a spec root, and this suite runs under `set -u`,
-# so an unguarded read ABORTS a code leg's run instead of skipping (the #190
-# review by lane openRepoTools-3).
-if [ -n "$LANE_MANUAL" ]; then
-hasnt "the manual no longer promises an Amendment 6(d) record" "$ln_doc" "which writes the Amendment 6(d) record"
-has   "…and says in terms that it writes nothing" "$ln_doc" "**It writes nothing**"
-else
-  skip "the manual says --retire writes nothing (two assertions)" "no spec root in this run: docs/README-lanes.md is the spec leg's (#186, T009)"
-fi
-# A PAUSED LANE WITH NO RECORDED PROFILE GETS NO `restart` LINE — it gets the
-# form that works, with the profile named as the one token to supply.
-has  "a lane with no recorded profile is offered the launcher form, not a line it cannot type" \
-     "$(run "$LANES_CMD" --all </dev/null; printf '%s' "$out")" "pclaude --lane repoA11-2 <profile>"
-
-# THE CONTAINER NOTICE PRINTS, AND IT NAMES THE VARIABLE RATHER THAN THE KEY
-# `R-A11-14` REJECTED (F-X1). The branch it hung on was `hostname-in-container`,
-# a source `lanes_workstation_pair` has never emitted, so the notice was DEAD;
-# and the act it named — a top-level `workstation:` line in `workspace.yaml` — is
-# the alternative this toolset refuses by name (`lanes-edit.sh:337-339`), from a
-# command that could not execute to name it.
-#
-# THE EMPTY LISTING IS THE CASE THAT MATTERS. With no `LANES_WORKSTATION` inside
-# a container the workstation column is the CONTAINER'S id, so no row matches and
-# the read exits 8 — the reader whose lanes have just vanished is exactly the one
-# owed the sentence, and a notice printed only after rows would never reach them.
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 "$LANES_CMD" </dev/null
-has  "lanes inside a container with no configured workstation says so" "$out" "LANES_WORKSTATION"
-has  "…in the one sentence its own writers refuse with" "$out" "is the CONTAINER"
-has  "…naming the launcher whose job the value is" "$out" "launcher"
-hasnt "…and never the \`workstation:\` key R-A11-14 rejected by name" "$out" "workstation: "
-hasnt "…nor the source token nothing in the estate emits" "$out" "hostname-in-container"
-# AND IT IS SILENT ON EVERY ORDINARY RUN, so the notice means what it says.
-run "$LANES_CMD" </dev/null
-hasnt "…while a run whose seam answered prints no container notice at all" "$out" "LANES_WORKSTATION"
-
-section "== Amendment 12: the name guard and the lock =="
-
-# THE THREE NAMES, AND WHAT HAPPENS WHEN THEY ARE NOT ONE. Every case below
-# feeds the guard a `UserPromptSubmit` payload on stdin and reads its exit code
-# and its stderr, which is what the harness shows a person: 2 BLOCKS the prompt,
-# 0 lets it through silently. The sandbox's fake tmux logs the `send-keys`, so
-# the LOCK's one act on a pane is watched rather than assumed.
-#
-# THE FIXTURE THIS SECTION BORROWS IS CAPTURED AND PUT BACK, and that is not
-# tidiness either: this section sits BETWEEN two others in one long file, it
-# needs a `$FAKE_TMUX_WINDOWS` of its own for the targeted reads the lock makes,
-# and a section that left the sandbox's window table unset would be changing the
-# premise of every case after it from a distance. Captured here, restored at the
-# end, so the Amendment 15 section below reads exactly what it read when it was
-# written against `main`.
-# A LIVE PROCESS OF THIS SECTION'S OWN, AND IT HAS TO BE ITS OWN. `$G_OUT` —
-# the liveness section's second process — is KILLED at the end of that section,
-# hundreds of cases above this one, so a record naming it is a record
-# `record_is_live` correctly judges dead, and a duplicate that is not live is no
-# duplicate at all: the guard exits 0, `lane-start` binds, and `lane-end
-# --retire` answers 8. Every Amendment 18(h) case here rests on this pid being
-# alive, so it is started here and killed at the end of the section.
-sleep "$LIVE_SLEEP" & GD_DUP=$!
-gd_dup_start="$(cut -d' ' -f22 "/proc/$GD_DUP/stat" 2>/dev/null || printf '')"
-GD_SAVE_WINDOWS="${FAKE_TMUX_WINDOWS-}"
-GD_SAVE_WINDOW="${FAKE_TMUX_WINDOW-}"
-GD_SAVE_NAME="${FAKE_TMUX_WINDOW_NAME-}"
-GD_OLD_ID="aaaa0012-0000-4000-8000-aaaa00120000"
-GD_LANE_ID="aaaa0012-1111-4000-8000-aaaa00121111"
-GD_FREE_ID="aaaa0012-2222-4000-8000-aaaa00122222"
-"$E" add-row "| \`repoGD-1\` | harness \`$GD_OLD_ID\` → harness $GD_LANE_ID (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/x.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoGD-2\` | none recorded | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/y.md | ACTIVE |" >/dev/null 2>&1
-mkdir -p "$HOME/projects/repoGD"
-git init -q -b main "$HOME/projects/repoGD"
-git -C "$HOME/projects/repoGD" remote add origin "https://github.com/opensoft/repoGD.git"
-# THE BINDING (Amendment 18(b)) — the lane's last STARTED, which clause (h)
-# rule 2 compares a person's `nameSince` against.
-run env LANES_LANE=repoGD-1 LANES_SESSION="$GD_LANE_ID" "$E" log STARTED "lane:repoGD-1" --home opensoft/repoGD
-is   "the guard lane has a STARTED line, which is its binding" "$rc" 0
-
-# ANOTHER PROFILE'S `sessions/` DIRECTORY, MADE ONCE AT THE TOP OF THE SECTION:
-# Amendment 18(h)'s duplicate sat in one when it was measured, and three blocks
-# below need it — the offer's answer, the duplicate refusals and clause (f)'s
-# line. It is a variable this file reads under `set -u`, so it is defined before
-# the first case rather than beside the first one that happened to need it.
-gd_t2="$HOME/.claude-profiles/profiles/opensoft/team/t2/sessions"
-mkdir -p "$gd_t2"
-
-# The sandbox's window: `gdsess:@12`, pane `%12`, running claude.
-export FAKE_TMUX_WINDOW="gdsess:@12"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# The fields the older writers never wrote: `nameSince`, which is an epoch in
-# MILLISECONDS on this estate's real records (measured 2026-09-14), and `kind`.
-write_record_a12() { # <file> <sessionId> <pid> <procStart> <kind> <tmux|-> <name> <nameSource|-> <nameSince|->
-  a_f="$1"; a_sid="$2"; a_pid="$3"; a_start="$4"; a_kind="$5"
-  a_tgt="$6"; a_name="$7"; a_src="$8"; a_since="$9"
-  a_t=""; [ "$a_tgt" = "-" ] || a_t="$(printf ',"tmux":"%s"' "$a_tgt")"
-  a_ns=""; [ "$a_src" = "-" ] || a_ns="$(printf ',"nameSource":"%s"' "$a_src")"
-  a_si=""; [ "$a_since" = "-" ] || a_si="$(printf ',"nameSince":%s' "$a_since")"
-  printf '{"pid":%s,"sessionId":"%s","cwd":"%s/projects/repoGD","procStart":"%s","kind":"%s"%s,"name":"%s"%s%s,"status":"busy","updatedAt":9000}\n' \
-    "$a_pid" "$a_sid" "$HOME" "$a_start" "$a_kind" "$a_t" "$a_name" "$a_ns" "$a_si" > "$a_f"
-  return 0
-}
-gd_rec() {   # <sessionId> <name> <nameSource|-> <nameSince|->
-  write_record_a12 "$sessions_dir/gd.json" "$1" "$LIVE_PID" "$live_start" interactive "gdsess:@12.%12" "$2" "$3" "$4"
-}
-gd_hook='{"session_id":"%s","cwd":"%s","prompt":"%s","hook_event_name":"UserPromptSubmit"}'
-# `${3-…}` AND NOT `${3:-…}`: an EMPTY cwd is a case of its own — a payload
-# that names none is an indeterminate read, not "outside the projects root" —
-# and `:-` would substitute the default for it and test nothing.
-gd_run() {   # <session id> [<prompt>] [<cwd>]
-  out="$(printf "$gd_hook" "$1" "${3-$HOME/projects/repoGD}" "${2-do the work}" | "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-  err="$(cat "$SANDBOX/stderr")"
-  return 0
-}
-gd_keys() { grep -c 'send-keys' "$FAKE_TMUX_LOG" || :; }
-# THE PENDING OFFER'S FILE, NAMED WITH THE FIXTURES AND NOT WITH THE FIRST CASE
-# THAT ANSWERS ONE. Every mismatch below leaves a question pending, and a
-# question pending is the NEXT prompt consumed as its answer — so the cases that
-# are about something else clear it, and they can only do that if they can spell
-# it before the offer section defines it.
-GD_OFFER="$CLAUDE_CONFIG_DIR/lanes/offers/$GD_LANE_ID"
-# A rename a person made an hour ago is OLDER than the binding written a moment
-# ago; one an hour from now is newer. The clock is read once, in milliseconds.
-gd_now_ms="$(( $(date -u +%s) * 1000 ))"
-GD_OLD_MS="$(( gd_now_ms - 3600000 ))"
-GD_NEW_MS="$(( gd_now_ms + 3600000 ))"
-
-# ---- THE AGREEING CASE IS SILENT, AND THAT IS THE PROPERTY THAT MAKES A HOOK
-# AT EVERY PROMPT BEARABLE AT ALL.
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "the three names agreeing exits 0" "$rc" 0
-is    "…silently: a guard that speaks when nothing is wrong is a guard people turn off" "$err" ""
-is    "…and types nothing into the pane" "$(gd_keys)" "$gd_before"
-
-# ---- CLAUSE (e)'s TWO EXEMPTIONS.
-gd_run "$GD_LANE_ID" "do the work" "$SANDBOX/elsewhere"
-is    "a cwd outside the projects root exits 0 — a name there is a title and nothing more (D1)" "$rc" 0
-is    "…silently" "$err" ""
-out="$(printf '{"session_id":"%s","cwd":"%s/projects/repoGD","agent_id":"agent-7","prompt":"x"}' "$GD_LANE_ID" "$HOME" | "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is    "a SUBAGENT's prompt exits 0 — subagents do not submit prompts and the lane that runs them has passed" "$rc" 0
-is    "…silently" "$err" ""
-
-# ---- (b) ROW 3: A NAME THAT IS NO LANE NAME IS THE THREE-CHOICE OFFER.
-#
-# THE LOCK USED TO RENAME THIS ONE WITHOUT ASKING, and it no longer does: every
-# readable mismatch that is more than a difference of CASE is now an explicit
-# choice, and the rename is choice 3 — typed when a person picks it and not
-# before. The triple is still printed, and the prompt is still refused.
-gd_rec "$GD_LANE_ID" repogd-7e derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-rm -f "$GD_OFFER"
-gd_run "$GD_LANE_ID"
-is    "a session named something that is no lane BLOCKS the prompt" "$rc" 2
-has   "…printing the triple as it stands" "$err" "THE NAME GUARD REFUSES THIS PROMPT"
-has   "…the window" "$err" "window   gdsess:@12 'repoGD-1'"
-has   "…the session, with the nameSource it carries" "$err" "session  $GD_LANE_ID 'repogd-7e' (nameSource derived)"
-has   "…and the row it is measured against" "$err" "row      \`repoGD-1\` — last session $GD_LANE_ID"
-has   "…and it is the OFFER, not a rename nobody asked for" "$err" "the lane and Claude session names disagree"
-has   "…whose choice 3 is that rename, named and not made" "$err" "3) adjust the session to lane repoGD-1"
-is    "…so NOTHING is typed into the pane until a person picks it" "$(gd_keys)" "$gd_before"
-rm -f "$GD_OFFER"
-
-# ---- D4: `<lane> (N)` IS A MISMATCH, AND THE SUFFIX IS EVIDENCE — which the
-# offer carries now, because that is where this state arrives.
-gd_rec "$GD_LANE_ID" "repoGD-1 (2)" user "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a \`<lane> (N)\` title is a mismatch, not the lane (ratified decision D4)" "$rc" 2
-has   "…and the offer names the rename as the repair" "$err" "3) adjust the session to lane repoGD-1"
-has   "…with the note that a stale holder of the title was live when it was minted" "$err" "another holder of 'repoGD-1' was live"
-has   "…naming the retire act and never a kill (A11 clause (k) rule (e))" "$err" "lane-end repoGD-1 --retire <pid>"
-hasnt "…so no surface offers to kill a process" "$err" "kill $LIVE_PID"
-rm -f "$GD_OFFER"
-
-# ---- AMENDMENT 15: A LOWERCASE WINDOW IS THE SAME LANE, AND THE ROW'S
-# SPELLING IS WHAT EVERY MESSAGE AND EVERY TYPED COMMAND CARRIES.
-export FAKE_TMUX_WINDOW_NAME=repogd-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repogd-1	%12	claude"
-gd_rec "$GD_LANE_ID" repogd-7e derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-rm -f "$GD_OFFER"
-gd_run "$GD_LANE_ID"
-is    "a window spelled in another case resolves to the same row (Amendment 15)" "$rc" 2
-has   "…and every message prints the REGISTER's spelling" "$err" "row      \`repoGD-1\` — last session"
-has   "…including the lane the offer's own choices name" "$err" "3) adjust the session to lane repoGD-1"
-rm -f "$GD_OFFER"
-gd_rec "$GD_LANE_ID" repogd-1 user "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a session name that differs from the row ONLY by case is still renamed to the row's spelling" "$rc" 2
-has   "…saying why, in Amendment 15's own terms" "$err" "a lane name is ONE name under any case"
-has   "…and typing it, because THE LOCK is what a case difference still meets" "$(tail -n1 "$FAKE_TMUX_LOG")" "/rename repoGD-1"
-hasnt "…never the offer, which is for the mismatches a person has to decide" "$err" "Reply \`1\`, \`2\` or \`3\`"
-rm -f "$GD_OFFER"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- (b) ROWS 1 AND 2: THE WINDOW IS NOT A LANE.
-export FAKE_TMUX_WINDOW_NAME=claude
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	claude	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a window named \`claude\` holding a session named for a lane BLOCKS the prompt" "$rc" 2
-has   "…and names the one command, filled in (F-B6)" "$err" "run: lane-start --no-launch repoGD 1"
-has   "…saying that this is the case that ran for three days unrecorded" "$err" "THAT IS THE 2026-09-10 CASE"
-is    "…and types nothing: a window that is not a lane is not renamed without a person" "$(gd_keys)" "$gd_before"
-gd_rec "$GD_LANE_ID" zsh derived "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "neither name being a lane BLOCKS the prompt too" "$rc" 2
-has   "…and the guard refuses to name the lane, because it cannot" "$err" "the guard cannot name one either"
-has   "…printing the form a person fills in themselves" "$err" "run: lane-start <repo> <n>"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- (b) ROWS 5 AND 6: WHERE THE UUID SITS IN THE CELL.
-gd_rec "$GD_OLD_ID" repoGD-1 user "$GD_OLD_MS"
-gd_run "$GD_OLD_ID"
-is    "an id IN the cell but not LAST is a superseded transcript and is blocked" "$rc" 2
-has   "…named as one" "$err" "this is a SUPERSEDED transcript of lane repoGD-1"
-has   "…and cured by a real lane-start, which resumes the id the row ends on" "$err" "run: lane-start repoGD 1"
-hasnt "…never by the recording act, which would record the WRONG conversation" "$err" "--no-launch"
-gd_rec "$GD_FREE_ID" repoGD-1 user "$GD_OLD_MS"
-gd_run "$GD_FREE_ID"
-is    "an id in NO row is the OTHER mismatch and is blocked" "$rc" 2
-has   "…named as the harness minting a transcript with nobody acting" "$err" "the harness minted a new transcript"
-has   "…and cured by the recording act, with no relaunch" "$err" "run: lane-start --no-launch repoGD 1"
-
-# ---- (b) ROW 7: TWO ROWS FOR ONE NAME, AND A REGISTER THAT CANNOT BE READ.
-# SEEDED AND NOT ADDED, because `add-row` is one of the writers Amendment 15(b)
-# has REFUSED this very state since #41 landed — which is the point of the
-# guard's own row for it: the pair can no longer be created by the tooling, only
-# met, exactly as `openXfactory-2`'s was met on 2026-09-13. So it is written the
-# way that state actually arrives, straight into the register and pushed, the
-# same `add_seed_row` + commit the Amendment 15 section below uses.
-add_seed_row "| \`repoGC-1\` | harness \`$GD_FREE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGC/x.md | ACTIVE |"
-add_seed_row "| \`repogc-1\` | harness \`$GD_LANE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGC/y.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed Amendment 12's case pair: two rows for one lane name, which add-row refuses"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-export FAKE_TMUX_WINDOW_NAME=repoGC-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGC-1	%12	claude"
-gd_rec "$GD_LANE_ID" repoGC-1 user "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a window whose name matches TWO rows that differ only by case is blocked" "$rc" 2
-has   "…naming both spellings" "$err" "repoGC-1 repogc-1"
-has   "…and the merge that is a person's act, never a tool's (Amendment 15(d))" "$err" "merge them into one row"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-chmod 000 "$profiles_root"
-gd_run "$GD_LANE_ID"
-chmod 755 "$profiles_root"
-is    "session records that cannot be READ block the prompt — fail CLOSED (clause (d))" "$rc" 2
-has   "…naming the read that failed" "$err" "session records could not be read"
-has   "…and safe-mode recovery for a session subject to the guard" "$err" "claude --safe-mode"
-# AND THE `SessionStart` HOOK MEETS THE SAME UNREADABLE RECORDS AND STILL EXITS
-# 0. The two hooks read the same directories through the same function and are
-# held to OPPOSITE contracts — one refuses on a read it could not make (clause
-# (d)), the other may never fail at all (R-A8-1) — so the one fixture is asked
-# of both. This is the case that was RED while `transcript_holders` left
-# `th_here_prof` unset: an unbound variable under `set -u` exits the shell where
-# it stands, so `|| :` at the call site caught nothing and `session-start`
-# exited 1 with no block at all — the hook breaking the session it exists to
-# orient. The read now happens in a subshell, which is what bounds it.
-chmod 000 "$profiles_root"
-out="$(printf '{"session_id":"%s","source":"resume","cwd":"%s/projects/repoGD"}' "$GD_LANE_ID" "$HOME" | "$E" session-start 2>/dev/null)"; rc=$?
-chmod 755 "$profiles_root"
-is    "…while the SessionStart hook, on the very same unreadable records, still exits 0 (R-A8-1)" "$rc" 0
-# THE TAIL AND NOT THE HEAD: `ssb_tail` prints UNCONDITIONALLY as the last line
-# of every block, whichever branch wrote the rest (Amendment 8(e)) — so it is
-# the one assertion that says "a WHOLE block came out" without pinning which
-# branch this fixture happens to take.
-has   "…having printed its block down to the tail every branch ends with, because a hook that dies breaks the session it orients" "$out" "(no fetch)"
-
-# ---- THE WORKSPACE THAT CANNOT BE READ, AND THE ONE NUMBER THAT DECIDES.
-#
-# EVERY OTHER SUBCOMMAND DIES 1 HERE — the dispatcher's own guard — and `guard`
-# is exempt from it and refuses for itself with a 2. That is not a preference:
-# only a 2 blocks a `UserPromptSubmit`, so a 1 would print the workspace refusal
-# and let the prompt THROUGH, which is the silence Amendment 12 exists to end.
-# AGENTS.md's lane paragraph carries the exception for the same reason.
-out="$(printf "$gd_hook" "$GD_LANE_ID" "$HOME/projects/repoGD" "do the work" | LANES_FILE="$SANDBOX/no-such-register.md" "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is    "a register this workstation cannot read blocks the prompt with 2, never the dispatcher's 1" "$rc" 2
-has   "…saying it is the ROW half of the triple that could not be read" "$err" "the ROW cannot be read"
-has   "…and safe-mode recovery" "$err" "claude --safe-mode"
-out="$(printf '' | LANES_FILE="$SANDBOX/no-such-register.md" "$E" session-start 2>/dev/null)"; rc=$?
-is    "…while session-start on the same missing register still exits 0, as it always has" "$rc" 0
-gd_run "$GD_LANE_ID" "do the work" ""
-is    "a payload naming no cwd at all is an indeterminate read, not 'outside the root'" "$rc" 2
-has   "…and says which read did not happen" "$err" "carried no \`cwd\`"
-
-# ---- A REGISTER THAT IS THERE AND WHOSE TEXT COULD NOT BE READ (#60).
-#
-# The file passes the test above, so the guard went on to the table with NO
-# ROWS and refused by its LAST arm — "the harness minted a new transcript",
-# cured by a `lane-start --no-launch` that cannot mend a read. `LANES_DIR` keeps
-# the logs and the alias table where they are, and the file's own name is on no
-# published tree, so `register_text` falls through to the working file.
-# EMPTY IS THE FIXTURE THAT HOLDS ON EVERY HOST AND UID: it renders exactly what
-# a file this checkout cannot open renders. A mode-000 file is the issue's own
-# case, and root reads one, so that case runs only where it means something. A
-# dangling link is no fixture here: `[ -f ]` is false for it, which the refusal
-# above already answers.
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-gd_unread_run() {
-  out="$(printf "$gd_hook" "$GD_LANE_ID" "$HOME/projects/repoGD" "do the work" \
-    | LANES_DIR="$WIP/lanes" LANES_FILE="$SANDBOX/register-60.md" "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-  err="$(cat "$SANDBOX/stderr")"
-}
-: > "$SANDBOX/register-60.md"
-gd_unread_run
-is    "a register whose TEXT comes back empty blocks the prompt with 2" "$rc" 2
-has   "…naming the read, not a row" "$err" "the register's TEXT could not be read"
-has   "…with the window it did read in the triple" "$err" "window   gdsess:@12 'repoGD-1'"
-has   "…and the row as the one half nobody read" "$err" "row      not read"
-hasnt "…and never the table's last arm, whose cure cannot mend a read" "$err" "the harness minted a new transcript"
-has   "…with safe-mode recovery" "$err" "claude --safe-mode"
-if [ "$(id -u)" = 0 ]; then
-  skip "a register file this checkout cannot open is the same refusal" "running as root, which can read a mode-000 file"
-else
-  cp -- "$LANES" "$SANDBOX/register-60.md"; chmod 000 "$SANDBOX/register-60.md"
-  gd_unread_run
-  chmod 644 "$SANDBOX/register-60.md"
-  is    "a register file this checkout cannot open is the same refusal" "$rc" 2
-  has   "…naming the same read" "$err" "the register's TEXT could not be read"
-fi
-rm -f "$SANDBOX/register-60.md"
-
-# ---- (b)'s LAST ROW: NOT INSIDE TMUX AT ALL (ratified decision D2, "Refuse"),
-# AND THE READ THAT DID NOT HAPPEN IS NOT THE SAME STATE.
-#
-# A lane RUNS in a tmux window named for it (Rule 4, Amendment 2), so a session
-# with no window has no WINDOW half to compare — and this is the one row of the
-# table whose command cannot be filled in, because which lane a windowless
-# session is is exactly what nothing here knows. `$TMUX` unset is that row; the
-# same guard with `$TMUX` set and tmux answering NOTHING is clause (d)'s
-# indeterminate read instead, and the two say different things because a person
-# who is not in tmux and a person whose tmux is broken have different work to do.
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-out="$(printf "$gd_hook" "$GD_LANE_ID" "$HOME/projects/repoGD" "do the work" | TMUX= "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is    "a session in no tmux window at all is refused (ratified decision D2)" "$rc" 2
-has   "…saying a lane RUNS in a window named for it" "$err" "not in a tmux window at all"
-has   "…printing the triple with nothing in its window half" "$err" "window   not in tmux 'none'"
-has   "…and naming the act, the one cure in this table that cannot be filled in" "$err" "run: lane-start <repo> <n>   (in a tmux window)"
-is    "…and typing nothing, because there is no pane to type into" "$(gd_keys)" "$gd_before"
-# A `tmux` ON PATH THAT ANSWERS NOTHING, which is what a dead server looks like
-# from inside a pane whose session has gone: the WINDOW half was not read, so
-# nothing is judged against it (clause (d)) and the bypass is printed.
-mkdir -p "$SANDBOX/deadtmux"
-printf '#!/usr/bin/env bash\nexit 1\n' > "$SANDBOX/deadtmux/tmux"
-chmod +x "$SANDBOX/deadtmux/tmux"
-out="$(printf "$gd_hook" "$GD_LANE_ID" "$HOME/projects/repoGD" "do the work" | PATH="$SANDBOX/deadtmux:$PATH" "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is    "…while a tmux that answers nothing is an indeterminate read and not 'no window'" "$rc" 2
-has   "…naming the read that did not happen" "$err" "tmux did not answer"
-has   "…and safe-mode recovery" "$err" "claude --safe-mode"
-
-# ---- CLAUSE (h) RULE 2: THE OFFER, AND ITS THREE ANSWERS.
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a PERSON's rename to another lane's name is offered, not silently obeyed" "$rc" 2
-has   "…with the warning" "$err" "the lane and Claude session names disagree"
-has   "…with explicit allow" "$err" "1) explicitly allow this lane"
-has   "…with lane-to-session repair" "$err" "2) adjust the lane to session repoGD-2"
-has   "…with session-to-lane repair" "$err" "3) adjust the session to lane repoGD-1"
-is    "…and the offer is written under the harness's own config directory, per session" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-is    "…and NOTHING is typed into the pane until a person answers" "$(gd_keys)" "$gd_before"
-gd_run "$GD_LANE_ID" "what does that mean?"
-is    "anything that is not an answer is refused, and the offer is asked again" "$rc" 2
-has   "…with the same numbered choices" "$err" "Reply \`1\`, \`2\` or \`3\`"
-is    "…and the offer is still pending" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-
-gd_run "$GD_LANE_ID" "1"
-is    "choice 1 explicitly allows this lane and consumes the answer" "$rc" 2
-has   "…and warns that the allowance is scoped" "$err" "explicitly allowed for this transcript"
-has   "…naming the exact pair it is scoped to" "$err" "while the lane remains repoGD-1 and the session remains 'repoGD-2'"
-is    "…the pending QUESTION having become a standing ANSWER in the same file" \
-      "$(sed -n 's/^mode=//p' "$GD_OFFER" 2>/dev/null)" allow
-
-gd_run "$GD_LANE_ID" "continue working"
-is    "the scoped allowance lets later prompts through" "$rc" 0
-has   "…while still warning, every prompt, that the two names disagree" "$err" "explicitly allowed for this transcript"
-has   "…and saying what ends the allowance" "$err" "only while the lane and session names stay unchanged"
-hasnt "…and never claiming to have REFUSED the prompt it has just let through" "$err" "REFUSES THIS PROMPT"
-
-# THE ALLOWANCE IS THE PAIR'S, NOT THE TRANSCRIPT'S. "If either name changes,
-# the allowance MUST no longer apply" — so a second rename is a second
-# question, and the standing answer is dropped rather than carried onto a
-# state nobody was asked about.
-gd_rec "$GD_LANE_ID" repoGD-4 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID" "carry on"
-is    "a CHANGED session name invalidates the allowance" "$rc" 2
-has   "…and the three choices are asked again" "$err" "Reply \`1\`, \`2\` or \`3\`"
-has   "…about the new name" "$err" "2) adjust the lane to session repoGD-4"
-is    "…the standing answer having gone back to a pending question" \
-      "$(sed -n 's/^mode=//p' "$GD_OFFER" 2>/dev/null)" name-drift
-
-# AND THE SAME PAIR AGREEING AGAIN ENDS IT TOO, without a prompt being spent:
-# the guard drops the file when the three names meet, so a rename BACK to the
-# allowed spelling is a fresh question and not a silent pass on an old answer.
-rm -f "$GD_OFFER"
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-gd_run "$GD_LANE_ID" "1"
-is    "choice 1 again, so there is an allowance to lose" "$rc" 2
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "the three names agreeing again exits 0" "$rc" 0
-is    "…and the allowance is gone with the mismatch it allowed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-
-# ---- AN ALLOWANCE IS NOT A BYPASS, AND THE UNSAFE STATES STILL REFUSE THROUGH
-# IT. The requirement keeps unreadable, ambiguous, duplicate and SUPERSEDED
-# identity blocking, so the allowance is honoured at the one row of the table it
-# was given for — a readable lane whose uuid is the row's LAST id — and not in
-# front of the table, where it would silence the two refusals below as well.
-GD_SUP_ID="aaaa0012-5555-4000-8000-aaaa00125555"
-"$E" add-row "| \`repoGD-5\` | harness \`$GD_LANE_ID\` → harness \`$GD_SUP_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/v.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW_NAME=repoGD-5
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-5	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-mkdir -p "${GD_OFFER%/*}"
-{ printf 'mode=allow\n'; printf 'from=repoGD-5\n'; printf 'to=repoGD-2\n'
-  printf 'session=repoGD-2\n'; printf 'uuid=%s\n' "$GD_LANE_ID"; } > "$GD_OFFER"
-gd_run "$GD_LANE_ID"
-is    "an explicitly allowed mismatch does NOT allow a SUPERSEDED transcript" "$rc" 2
-has   "…which is what the refusal names" "$err" "SUPERSEDED transcript of lane repoGD-5"
-hasnt "…and nothing is let through on the allowance" "$err" "ALLOWS THIS PROMPT"
-rm -f "$GD_OFFER"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-GD_FREE_OFFER="$CLAUDE_CONFIG_DIR/lanes/offers/$GD_FREE_ID"
-gd_rec "$GD_FREE_ID" repoGD-2 user "$GD_NEW_MS"
-{ printf 'mode=allow\n'; printf 'from=repoGD-1\n'; printf 'to=repoGD-2\n'
-  printf 'session=repoGD-2\n'; printf 'uuid=%s\n' "$GD_FREE_ID"; } > "$GD_FREE_OFFER"
-gd_run "$GD_FREE_ID"
-is    "…nor a transcript the row does not name at all" "$rc" 2
-has   "…which is what that refusal names" "$err" "does not name $GD_FREE_ID at all"
-hasnt "…and nothing is let through on the allowance" "$err" "ALLOWS THIS PROMPT"
-rm -f "$GD_FREE_OFFER"
-
-# THE QUESTION IS PENDING AGAIN FOR THE CASES BELOW, which answer it.
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "the offer is pending again" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-
-# AN ANSWER IS A PROMPT, AND A PROMPT IN A DUPLICATED PROCESS IS REFUSED.
-# Clause (h) refuses "every prompt in a process that shares its session id with
-# another live one", and consuming a `yes` here would run `lane-start` — a
-# register write — out of a process that may not be writing at all, on an offer
-# file the OTHER process could equally have answered. So 18(h)'s count is asked
-# in front of the answer, and the offer is KEPT for the prompt after the
-# duplicate is retired (Copilot round 1 on this PR).
-write_record_a12 "$gd_t2/dup-answer.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-1" - "$GD_OLD_MS"
-gd_run "$GD_LANE_ID" "2"
-is    "a pending offer is NOT answered while a second live process holds this transcript" "$rc" 2
-has   "…the duplicate being what the refusal names" "$err" "ANOTHER LIVE PROCESS CARRIES THIS SESSION ID"
-hasnt "…so nothing moved" "$err" "MOVED: this window is now lane"
-is    "…and the offer is kept, to be answered when the other process is retired" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-rm -f "$gd_t2/dup-answer.json"
-
-gd_run "$GD_LANE_ID" "3"
-is    "choice 3 is consumed and blocks that prompt too — an answer is not work" "$rc" 2
-has   "…adjusting the session to the lane" "$err" "ADJUSTED SESSION TO LANE repoGD-1"
-has   "…by typing it into the pane" "$(tail -n1 "$FAKE_TMUX_LOG")" "send-keys -t %12 /rename repoGD-1 Enter"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "the offer is made again at the next prompt, because the rename still stands" "$rc" 2
-# THE RENAME HAS TO LAND FOR THIS ONE, so the fake's opt-in sticky rename is on:
-# `lane-start`'s step 3b veto 2 reads `#W`, and the whole point of the guard
-# renaming the window BEFORE it runs lane-start is that the veto then does not
-# fire and this session reaches the new lane's session cell.
-export FAKE_TMUX_RENAME_STICKS=1 FAKE_TMUX_NAME_FILE="$SANDBOX/tmux-window-name"
-rm -f "$FAKE_TMUX_NAME_FILE"
-gd_run "$GD_LANE_ID" "2"
-is    "choice 2 is consumed and blocks that prompt" "$rc" 2
-has   "…and this window is the other lane now" "$err" "MOVED: this window is now lane repoGD-2"
-has   "…the window renamed by lane-start's own act" "$(grep 'rename-window' "$FAKE_TMUX_LOG" | tail -n1)" "rename-window repoGD-2"
-has   "…this session appended to that lane's cell, which is what the next resume follows" \
-      "$("$E" register-row repoGD-2 2>/dev/null || :)" "$GD_LANE_ID"
-# AND `lane-start` MADE THAT WRITE, IN ITS BINDING MODE (openRepoTools#70). Its
-# step 3b veto 1 never takes a uuid another row records, and after the rename
-# this one is repoGD-1's: without a write that answers it the new row would carry
-# a FRESH id, the next prompt would find a lane whose row does not name this
-# transcript, and the guard would refuse for ever on a state it created by
-# obeying the person. The guard used to make that write itself; `--bind` is the
-# person's choice 2 handed to `lane-start`, so the guard now only reads it back.
-has   "…lane-start having made that one write, on the person's choice 2" "$err" "session cell now ends on $GD_LANE_ID"
-has   "…in a commit of its own that says which act it was" \
-      "$(git -C "$WIP" log -n 12 --format=%s)" "session cell: bound $GD_LANE_ID on the person's choice 2 at the name guard"
-hasnt "…and with no register write of the guard's own" \
-      "$(git -C "$WIP" log -n 12 --format=%s)" "the name guard moved this window from repoGD-1"
-has   "…and the lane it LEFT marked PAUSED, so the register says where the work went" \
-      "$("$E" register-row repoGD-1 2>/dev/null || :)" "PAUSED · "
-has   "…naming the lane this window moved to (Amendment 13(a): the cell is SET, never appended to)" \
-      "$("$E" register-row repoGD-1 2>/dev/null || :)" "this window moved to lane repoGD-2"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-unset FAKE_TMUX_RENAME_STICKS FAKE_TMUX_NAME_FILE
-
-# ---- THE DESTINATION ALREADY RECORDS A TRANSCRIPT (openRepoTools#70).
-#
-# The case the binding mode exists for. The lane a person renamed their session
-# to has a row whose cell names a transcript this directory has, so before
-# `--bind` the guard's `yes` ran `lane-start --no-launch`, which took that row's
-# ordinary RESUME path and wrote `RESUMED` naming the id THE ROW ALREADY HAD —
-# into the row's stamp and into the lane's append-only log — about a
-# conversation nobody was in, launched by nothing. The guard then appended this
-# session to the cell, so the row ended right and the log said something else.
-GD_ROW6_ID="aaaa0012-6666-4000-8000-aaaa00126666"
-"$E" add-row "| \`repoGD-6\` | harness $GD_ROW6_ID (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/t.md | ACTIVE |" >/dev/null 2>&1
-gd6_tdir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoGD")"
-mkdir -p "$gd6_tdir"
-printf '{"type":"user"}\n' > "$gd6_tdir/$GD_ROW6_ID.jsonl"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-6 user "$GD_NEW_MS"
-
-# THE FLAG FIRST, DRIVEN DIRECTLY, AND EVERY REFUSAL BEFORE ANYTHING IS WRITTEN.
-# It is the guard's alone, so what it may be combined with is narrow: a uuid,
-# `--no-launch`, never `--fresh`, and only the session live in THIS window, in
-# a window not named for another lane.
-gd6_row="$("$E" register-row repoGD-6 2>/dev/null || :)"
-run   "$START" repoGD 6 --no-launch --bind not-a-uuid
-is    "lane-start --bind refuses a value that is not a transcript uuid" "$rc" 2
-has   "…saying what it takes" "$err" "--bind takes the transcript uuid of the session live in this window"
-run   "$START" repoGD 6 --no-launch --bind=
-is    "…and an empty value, in the \`=\` spelling as in the other" "$rc" 2
-has   "…saying what it needs" "$err" "--bind needs the transcript uuid of the session being bound"
-run   "$START" repoGD 6 --bind "$GD_LANE_ID"
-is    "…and refuses without --no-launch: the session it binds is already running" "$rc" 2
-has   "…saying so" "$err" "it is given only with --no-launch"
-run   "$START" repoGD 6 --no-launch --fresh --bind "$GD_LANE_ID"
-is    "…and beside --fresh, which is a second answer to which session this lane is" "$rc" 2
-has   "…naming both" "$err" "--bind binds the session live in this window and --fresh starts a new one"
-run   "$START" repoGD 6 --no-launch --agent codex --bind "$GD_LANE_ID"
-is    "…and beside --agent, since the session it binds is the Claude one in this window" "$rc" 2
-has   "…saying a run that launches nothing has no agent to name" "$err" "a run that launches nothing has no agent to name"
-run   "$START" repoGD 6 --no-launch --bind "$GD_FREE_ID"
-is    "…and a uuid that is not the session live in this window" "$rc" 2
-has   "…naming the one that is" "$err" "the session live in this window is $GD_LANE_ID"
-run   "$START" repoGD 6 --no-launch --bind "$GD_LANE_ID"
-is    "…and a window still named for ANOTHER lane, because --bind answers veto 1 and never veto 2" "$rc" 2
-has   "…saying which veto" "$err" "veto 2, which --bind does not lift"
-is    "…every one of them before anything was written" "$("$E" register-row repoGD-6 2>/dev/null || :)" "$gd6_row"
-is    "…and nothing launched" "$(cat "$FAKE_CLAUDE_LOG" 2>/dev/null | grep -c "repoGD-6" || :)" "0"
-
-# THEN THE GUARD'S `yes`, which renames the window first and so reaches the bind.
-export FAKE_TMUX_RENAME_STICKS=1 FAKE_TMUX_NAME_FILE="$SANDBOX/tmux-window-name"
-printf 'repoGD-1\n' > "$FAKE_TMUX_NAME_FILE"
-gd_run "$GD_LANE_ID"
-is    "a rename to a lane that already records a transcript is the offer" "$rc" 2
-has   "…naming that lane's own last session" "$err" "2) adjust the lane to session repoGD-6 (existing lane; last session $GD_ROW6_ID)"
-gd_run "$GD_LANE_ID" "2"
-is    "…and \`yes\` moves the window" "$rc" 2
-has   "…saying so" "$err" "MOVED: this window is now lane repoGD-6"
-gd6_log="$(cat "$LOGD/repoGD-6.md" 2>/dev/null || :)"
-has   "…and the destination's log records a RESUMED by the transcript BOUND" \
-      "$(printf '%s\n' "$gd6_log" | grep '^RESUMED')" "session $GD_LANE_ID@"
-hasnt "…never by the transcript its row already had, which nobody is in" "$gd6_log" "$GD_ROW6_ID"
-is    "…and that RESUMED is the log's one lane-kind line, so nothing stamped it twice" \
-      "$(printf '%s\n' "$gd6_log" | grep -cE '^(STARTED|RESUMED) ' || :)" 1
-gd6_row="$("$E" register-row repoGD-6 2>/dev/null || :)"
-has   "…the row's stamp names the bound transcript too" "$gd6_row" "RESUMED by $GD_LANE_ID"
-hasnt "…and not the old one" "$gd6_row" "RESUMED by $GD_ROW6_ID"
-hasnt "…nor does any stamp lane-start wrote or owed on the way through" "$err" "RESUMED by $GD_ROW6_ID"
-is    "…and the session cell ENDS on it, which is what the next resume follows" \
-      "$(printf '%s\n' "$gd6_row" | awk -F'|' '{print $3}' | grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | tail -n1)" \
-      "$GD_LANE_ID"
-has   "…keeping the id it had, in front of it, as the cell's history" "$gd6_row" "$GD_ROW6_ID"
-has   "…which the guard reads back and says" "$err" "repoGD-6's session cell now ends on $GD_LANE_ID"
-hasnt "…and the guard-only flag is in no command printed for a person to type" "$err" "--bind $GD_LANE_ID"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-unset FAKE_TMUX_RENAME_STICKS FAKE_TMUX_NAME_FILE
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- CHOICE 2 INTO A LANE WITH NO ROW (openRepoTools#70).
-#
-# The binding mode's other door. A person who renames their session to a lane
-# the register does not have is offered to CREATE it, so the guard's `yes` runs
-# `lane-start --no-launch --bind` for a lane with no row at all, and the row that
-# run creates is the only record the lane has. Before `--bind`, step 3b's veto 1
-# refused this session's uuid — the row being LEFT still records it — so the new
-# row was born naming an id `lane-start` MINTED for a session nobody would ever
-# launch: its session cell began with that id, its `STARTED by` stamp and the
-# lane's first log line named it, and the guard then appended this session to
-# the cell behind it. In the binding mode the row is created with THIS uuid as
-# the one transcript its cell names, stamped STARTED by it (a lane with no row
-# has nothing to resume, so the verb is STARTED and not RESUMED), and the lane's
-# log opens with one lane-kind line, naming it.
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-8 user "$GD_NEW_MS"
-export FAKE_TMUX_RENAME_STICKS=1 FAKE_TMUX_NAME_FILE="$SANDBOX/tmux-window-name"
-printf 'repoGD-1\n' > "$FAKE_TMUX_NAME_FILE"
-gd_run "$GD_LANE_ID"
-is    "a rename to a lane with no row is the offer" "$rc" 2
-has   "…offering to create it" "$err" "2) adjust the lane to session repoGD-8 (create or move to this lane)"
-gd_run "$GD_LANE_ID" "2"
-is    "…and \`yes\` moves the window" "$rc" 2
-has   "…saying so" "$err" "MOVED: this window is now lane repoGD-8"
-gd8_row="$("$E" register-row repoGD-8 2>/dev/null || :)"
-has   "…into a row created with the bound transcript in its session cell" \
-      "$(printf '%s\n' "$gd8_row" | awk -F'|' '{print $3}')" "harness $GD_LANE_ID"
-is    "…as the one transcript uuid that cell names, with no id minted for a session nobody runs" \
-      "$(printf '%s\n' "$gd8_row" | awk -F'|' '{print $3}' | grep -oiE '[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}' | grep -c . || :)" 1
-has   "…stamped STARTED by the bound transcript, a lane with no row having nothing to resume" "$gd8_row" "STARTED by $GD_LANE_ID"
-gd8_log="$(cat "$LOGD/repoGD-8.md" 2>/dev/null || :)"
-has   "…and the new lane's log records a STARTED by the transcript BOUND" \
-      "$(printf '%s\n' "$gd8_log" | grep '^STARTED')" "session $GD_LANE_ID@"
-is    "…as that log's one lane-kind line" "$(printf '%s\n' "$gd8_log" | grep -cE '^(STARTED|RESUMED) ' || :)" 1
-has   "…which the guard reads back as lane-start's own write" "$err" "repoGD-8's session cell now ends on $GD_LANE_ID, written by lane-start's binding mode"
-hasnt "…and nothing minted an id on the way through" "$err" "minted session id"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-unset FAKE_TMUX_RENAME_STICKS FAKE_TMUX_NAME_FILE
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- CHOICE 3 IS A TYPED ACT, AND A PANE THAT WILL NOT TAKE IT LEAVES THE
-# QUESTION STANDING. M1's condition is the pane's current command: `/rename
-# <lane>` typed at a shell is a command that does not exist, so the guard types
-# NOTHING there — and because nothing was repaired and nothing was written, the
-# offer is KEPT and the line is printed for the person to type.
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "the offer is pending for the pane that will refuse the keys" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	bash"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID" "3"
-is    "choice 3 into a pane that is not running claude types nothing" "$(gd_keys)" "$gd_before"
-is    "…and blocks that prompt" "$rc" 2
-has   "…naming the command to type by hand" "$err" "Type it yourself: /rename repoGD-1"
-hasnt "…never reporting a rename it did not make" "$err" "ADJUSTED SESSION TO LANE"
-is    "…with the offer KEPT, because nothing was repaired" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-rm -f "$GD_OFFER"
-
-# ---- THE UNTITLED SESSION, which is the (b) table's own row for a name that
-# is no lane name at all — and the one the offer must be answerable in, because
-# choice 3 is its whole cure. A record with an EMPTY `name` reaches the offer
-# with nothing to put in `session=`, and an offer whose answer is dropped as
-# unreadable is a question that can never be answered: the guard would ask it,
-# refuse the reply, ask it again, for ever.
-write_record_a12 "$sessions_dir/gd.json" "$GD_LANE_ID" "$LIVE_PID" "$live_start" \
-  interactive "gdsess:@12.%12" "" - -
-gd_run "$GD_LANE_ID"
-is    "a session with NO name of its own is the offer too" "$rc" 2
-has   "…with choice 2 unavailable, because 'none' is no lane to move to" "$err" "2) adjust the lane to session — unavailable"
-has   "…and choice 3 filled in with the lane" "$err" "3) adjust the session to lane repoGD-1"
-gd_run "$GD_LANE_ID" "3"
-is    "…and choice 3 ANSWERS it rather than dropping the offer as unreadable" "$rc" 2
-has   "…typing the rename into the pane" "$err" "ADJUSTED SESSION TO LANE repoGD-1"
-hasnt "…never reading its own offer as corrupt" "$err" "could not be read"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-
-# ---- THE QUESTION ANSWERED MUST BE THE QUESTION ASKED (Copilot round 1 on
-# openRepoTools#87). The offer is held per TRANSCRIPT and the answer is a later
-# prompt, so the window and the session can both move under it — and every one
-# of the three choices would then act on a state nobody was shown. A stale offer
-# is DROPPED, this prompt is not consumed by it, and the table judges it afresh.
-rm -f "$GD_OFFER"
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "the offer is pending against lane repoGD-1 and session repoGD-2" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-gd_rec "$GD_LANE_ID" repoGD-3 user "$GD_NEW_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID" "3"
-is    "an answer to a question the state has moved past is refused" "$rc" 2
-has   "…naming both, so a person can see what moved" "$err" "the pending question was about lane repoGD-1 and session 'repoGD-2'"
-has   "…and what it is now" "$err" "session 'repoGD-3'"
-is    "…typing nothing, because /rename would have named the wrong lane" "$(gd_keys)" "$gd_before"
-has   "…and the prompt is JUDGED rather than consumed: the question is asked again" "$err" "the lane and Claude session names disagree"
-has   "…about the state as it stands now" "$err" "2) adjust the lane to session repoGD-3"
-is    "…so a fresh question is pending" "$(sed -n 's/^to=//p' "$GD_OFFER" 2>/dev/null)" repoGD-3
-rm -f "$GD_OFFER"
-
-# ---- AMENDMENT 18(h): ONE LIVE PROCESS PER TRANSCRIPT.
-#
-# THE SHAPE MEASURED FOUR TIMES ON 2026-09-14, the last at 18:14Z: a `bg` record
-# in ONE profile's `sessions/` beside the interactive record in ANOTHER's, both
-# live, both carrying one session id. The second profile is the point — the
-# sweep is of every profile's directory, not of the asking session's.
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-write_record_a12 "$gd_t2/fork.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-1" - "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a second LIVE process on one transcript blocks every prompt (Amendment 18(h))" "$rc" 2
-has   "…naming it" "$err" "ANOTHER LIVE PROCESS CARRIES THIS SESSION ID"
-has   "…by pid, and as the \`bg\` it is" "$err" "pid $GD_DUP (bg, kind bg"
-has   "…in the profile whose sessions/ directory it sits in — the sweep is of every one" "$err" "profile t2"
-has   "…and names the retire act, filled in" "$err" "run: lane-end repoGD-1 --retire <pid>"
-is    "…and the read that finds them is a subcommand two other surfaces share" \
-      "$("$E" transcript-holders "$GD_LANE_ID" >/dev/null 2>&1; echo $?)" 0
-
-run   "$START" repoGD 1 --no-launch
-is    "…and lane-start REFUSES to bind a transcript two processes hold" "$rc" 1
-has   "…naming the pid and where it is" "$err" "another live process already carries transcript $GD_LANE_ID"
-has   "…and the same one act" "$err" "lane-end repoGD-1 --retire <pid>"
-hasnt "…having launched nothing" "$err" "exec: "
-
-run   "$END" repoGD-1 --retire "$GD_DUP"
-is    "lane-end --retire <the duplicate's pid> retires it, where the row records its id (#39)" "$rc" 0
-has   "…proving it first, and writing nothing" "$err" "IS a live DUPLICATE of lane repoGD-1's own transcript"
-has   "…and naming Amendment 6(d)'s act for a background holder, which has no prompt to type into" "$err" "an idle background session still holding a lane name is ended"
-has   "…the lane itself untouched" "$err" "ended nothing, wrote nothing and killed nothing"
-run   "$END" repoGD-1 --retire "$LIVE_PID"
-is    "…while the WINDOW's own session is refused: retiring the session that IS the lane is not an act" "$rc" 2
-# THE process-table AND live-holder READS (PR #61) ANSWER THIS BEFORE THE
-# session-record ONE (PR #52) EVER RUNS: `$LIVE_PID` is proved to be lane
-# repoGD-1's own live session by `lanes-edit.sh live-holder` first (no fork,
-# no process-table duplicate found for it), so this refusal is the OWN-PID
-# check's wording and not `transcript-holders`' — both say the same thing;
-# only one of them gets to say it first, and it does.
-has   "…saying so" "$err" "is lane repoGD-1's own live session"
-has   "…and naming the act that DOES end a lane" "$err" "End the lane instead"
-rm -f "$gd_t2/fork.json"
-
-# AND THE SECOND PROCESS IS NOT ALWAYS IN ANOTHER PROFILE. One profile can
-# resume one transcript twice — no move, no swap, one command — and the record
-# that makes is an INTERACTIVE one beside this window's own. Amendment 8 ruling
-# (g)'s companion, which this read passes over in silence, is the harness's
-# `kind: bg` record and only that; a second interactive holder in the same
-# directory is 18(h)'s own case (Copilot round 1 on this PR: the profile alone
-# read the cheapest duplicate there is as benign).
-write_record_a12 "$sessions_dir/twin.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" interactive "gdsess:@77.%77" "repoGD-1" - "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a second INTERACTIVE process on one transcript in the SAME profile is a duplicate too" "$rc" 2
-has   "…named as one" "$err" "ANOTHER LIVE PROCESS CARRIES THIS SESSION ID"
-has   "…by pid, and as the interactive record it is" "$err" "pid $GD_DUP (window gdsess:@77"
-has   "…in this window's own profile, which is no longer a reason to pass it over" "$err" "profile t1"
-rm -f "$sessions_dir/twin.json"
-# AND THE COMPANION IS THE `bg` RECORD AND NOTHING ELSE IS READ AS ONE: this
-# suite's own interactive fork carries `kind: user` (Amendment 11 clause (k)'s
-# section above), and "not a session record" — the first spelling of this test
-# — would have taken that, and every kind a later harness invents, as the
-# harness's benign companion (Copilot round 2 on this PR).
-write_record_a12 "$sessions_dir/usertwin.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" user "-" "repoGD-1" - "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "a kind this file has no rule for is a duplicate and not the companion" "$rc" 2
-has   "…named with the kind as found" "$err" "kind user"
-rm -f "$sessions_dir/usertwin.json"
-# THE HARNESS'S OWN COMPANION IS STILL SILENT, and this is the case that says
-# the verdict turns on the record's KIND and not on the profile: the same
-# profile, the same id, live — and `kind: bg` (Amendment 8 ruling (g), "records
-# that share a sessionId are one session, not a queue of rival holders").
-write_record_a12 "$sessions_dir/bgtwin.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-1" - "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "…while the harness's own \`bg\` companion beside it is no duplicate at all" "$rc" 0
-is    "…and says nothing" "$err" ""
-# AND `--retire` MAY NOT NAME IT EITHER, which is the same rule one surface
-# over: the pid a person could reach for here is the OTHER HALF of the session
-# that IS the lane, so ending it is not Amendment 6(d)'s act on anything
-# (Copilot round 2 on this PR — the target was selected by pid alone and the
-# verdict was not read).
-run   "$END" repoGD-1 --retire "$GD_DUP"
-is    "lane-end refuses to retire the harness's own companion of this lane's live session" "$rc" 2
-has   "…naming what the pid actually is" "$err" "is the HARNESS'S OWN COMPANION"
-has   "…in ruling (g)'s own words" "$err" "not a queue of rival holders"
-has   "…and naming the read that says which process is which" "$err" "transcript-holders $GD_LANE_ID"
-hasnt "…never 6(d)'s ending for it" "$err" "an idle background session still holding a lane"
-rm -f "$sessions_dir/bgtwin.json"
-
-# ---- A SILENT TMUX IS NOT A DEAD WINDOW (openRepoTools#73, item 1).
-#
-# `record_window_state` answered 1 — "refuted" — both for a window this server
-# does not have AND for a server that never answered, and `transcript_holders`
-# writes every 1 as `(gone)`, which `lane-end --retire` reads as "not the lane's
-# own session". MEASURED ON f87fd5a WITH THIS VERY FIXTURE: with tmux installed
-# and its server silent, `--retire <the lane's own pid>` was "proved" a live
-# DUPLICATE and handed Amendment 6(d)'s retitle — `/rename repoGD-1 · retired
-# <date>` — for the conversation that IS the lane, exit 0. The session here is
-# named for ANOTHER lane by a person (the offer's state), so `live-holder`
-# passes over it and the record read is what answers, exactly as it does
-# wherever `live-holder` picks some other holder first.
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-run   env FAKE_TMUX_SILENT=1 "$E" transcript-holders "$GD_LANE_ID"
-is    "transcript-holders still answers while tmux is silent" "$rc" 0
-is    "…and a window tmux did not answer about is NO ANSWER, never gone" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$LIVE_PID" '$1 == p { print $5; exit }')" "window gdsess:@12 (no answer)"
-run   env FAKE_TMUX_WINDOWS="" "$E" transcript-holders "$GD_LANE_ID"
-is    "…while a window a server that DOES answer does not have is still gone" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$LIVE_PID" '$1 == p { print $5; exit }')" "window gdsess:@12 (gone)"
-run   env FAKE_TMUX_SILENT=1 "$END" repoGD-1 --retire "$LIVE_PID"
-is    "lane-end --retire REFUSES the lane's own pid while tmux is silent" "$rc" 2
-has   "…naming the silence, not a dead window" "$err" "tmux did not answer at all"
-has   "…and the act that does end a lane" "$err" "to end the lane, run: lane-end repoGD-1"
-hasnt "…never proving it a duplicate" "$err" "IS a live DUPLICATE"
-hasnt "…nor handing 6(d)'s retitle to the conversation that IS the lane" "$err" "/rename repoGD-1 · retired"
-gd_rec "$GD_LANE_ID" repoGD-1 user "$GD_OLD_MS"
-
-# ---- THE COMPANION IS THE HARNESS'S RELATION, NOT THE ASKER'S (openRepoTools#73,
-# item 2).
-#
-# `transcript_holders` read it relative to the ASKING window, so asked from a
-# bare shell or another lane's window it found nothing `here` and called every
-# holder `unrelated`, the companion included — and the refusal just above names
-# that read as the one that "says which is which". The companion is now read off
-# the LANE's live window record: the interactive record in a window this server
-# resolves and agrees with. `othersess:@55` is a window with no record of this
-# transcript at all.
-write_record_a12 "$sessions_dir/bgtwin.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-1" - "$GD_OLD_MS"
-run   env FAKE_TMUX_WINDOW="othersess:@55" "$E" transcript-holders "$GD_LANE_ID"
-is    "transcript-holders asked from ANOTHER window answers" "$rc" 0
-is    "…calling the harness's bg record beside the lane's live window its companion" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$GD_DUP" '$1 == p { print $6; exit }')" companion
-is    "…while the lane's own session, which is not that window's, stays unrelated" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$LIVE_PID" '$1 == p { print $6; exit }')" unrelated
-run   "$E" transcript-holders "$GD_LANE_ID"
-is    "…which is the verdict the lane's own window has always read" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$GD_DUP" '$1 == p { print $6; exit }')" companion
-run   env FAKE_TMUX_WINDOW="othersess:@55" "$END" repoGD-1 --retire "$GD_DUP"
-is    "…and lane-end --retire from that other window refuses it" "$rc" 2
-has   "…by name" "$err" "is the HARNESS'S OWN COMPANION"
-# A `bg` RECORD IN ANOTHER PROFILE IS NOBODY'S PROVEN COMPANION of the lane's
-# window, and stays `unrelated` from outside it.
-mv -f "$sessions_dir/bgtwin.json" "$gd_t2/bgtwin.json"
-run   env FAKE_TMUX_WINDOW="othersess:@55" "$E" transcript-holders "$GD_LANE_ID"
-is    "a bg record in ANOTHER profile is no companion of the lane's live window" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$GD_DUP" '$1 == p { print $6; exit }')" unrelated
-mv -f "$gd_t2/bgtwin.json" "$sessions_dir/bgtwin.json"
-# AND ONLY ONE PROFILE MAY ANSWER: two live windows in two profiles on one
-# transcript is 18(h)'s own case, with no way to tell from here which of them
-# is the lane's, so nothing is read off either.
-sleep "$LIVE_SLEEP" & TH73_PID=$!
-th73_start="$(cut -d' ' -f22 "/proc/$TH73_PID/stat" 2>/dev/null || printf '')"
-write_record_a12 "$gd_t2/wintwin.json" "$GD_LANE_ID" "$TH73_PID" "$th73_start" interactive "gdsess:@77.%77" "repoGD-1" - "$GD_OLD_MS"
-run   env FAKE_TMUX_WINDOW="othersess:@55" FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude
-gdsess:1	@77	repoGD-1	%77	claude" "$E" transcript-holders "$GD_LANE_ID"
-is    "two live windows in two profiles leave no ONE window to read the companion off" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v p="$GD_DUP" '$1 == p { print $6; exit }')" unrelated
-rm -f "$gd_t2/wintwin.json" "$sessions_dir/bgtwin.json"
-kill "$TH73_PID" 2>/dev/null; wait "$TH73_PID" 2>/dev/null; TH73_PID=""
-
-# ---- AMENDMENT 18(h) IN THE LAUNCH BRANCH: THE ID A RUN IS ABOUT TO RESUME.
-# The clause counts the holders of "the id it is about to resume or bind", and
-# the two are different ids: the binding step asks about THIS WINDOW's session,
-# the row-resume branch about the id the ROW records. This window carries no
-# record of that second one — the branch is reached only when they differ — so
-# every live holder of it is `unrelated` to this window, which is exactly the
-# process that must stop the resume (Copilot round 1 on this PR: counting only
-# `duplicate` made this branch's check one that could never fire).
-GD_ROW3_ID="aaaa0012-3333-4000-8000-aaaa00123333"
-"$E" add-row "| \`repoGD-3\` | harness $GD_ROW3_ID (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/z.md | ACTIVE |" >/dev/null 2>&1
-gd_tdir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoGD")"
-mkdir -p "$gd_tdir"
-printf '{"type":"user"}\n' > "$gd_tdir/$GD_ROW3_ID.jsonl"
-write_record_a12 "$gd_t2/fork3.json" "$GD_ROW3_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-3" - "$GD_OLD_MS"
-export FAKE_TMUX_WINDOW_NAME=repoGD-3
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-3	%12	claude"
-run   "$START" repoGD 3 --no-launch
-is    "lane-start REFUSES to RESUME an id another live process carries (the launch branch)" "$rc" 1
-has   "…naming the transcript and the pid" "$err" "another live process already carries transcript $GD_ROW3_ID"
-has   "…and the retire act for the lane it was starting" "$err" "lane-end repoGD-3 --retire <pid>"
-hasnt "…having launched nothing" "$out" "--resume $GD_ROW3_ID"
-rm -f "$gd_t2/fork3.json"
-run   "$START" repoGD 3 --no-launch
-is    "…and resumes it once the other process is gone" "$out" "claude --name repoGD-3 --resume $GD_ROW3_ID"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- THE ONE COMMAND THE OFFER CANNOT FILL IN (F-B6).
-#
-# A lane named before Rule 4's `<repo>-<n>` form — the register carries 22 of
-# them — has no `<repo> <n>` to pass, and `lane_start_args` answers `--dir
-# <path> <lane>` for it: a PLACEHOLDER, because nothing in the register, the
-# window or this session says where that lane's checkout is. Printing it in a
-# diagnostic is honest; RUNNING it would refuse on a directory that does not
-# exist and ask the same question at every prompt afterwards (Copilot round 1
-# on this PR).
-"$E" add-row "| \`legacy-ui\` | none recorded | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/legacy/z.md | ACTIVE |" >/dev/null 2>&1
-gd_rec "$GD_LANE_ID" legacy-ui user "$GD_NEW_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a rename to a lane named before the \`<repo>-<n>\` rule is the offer too" "$rc" 2
-has   "…saying that lane exists, and that choice 2 is the move to it" "$err" "2) adjust the lane to session legacy-ui (existing lane; last session"
-has   "…and the rename beside it, which is the repair that needs nothing filled in" "$err" "3) adjust the session to lane repoGD-1"
-gd_run "$GD_LANE_ID" "2"
-is    "choice 2 refuses rather than running a command with a \`<path>\` in it" "$rc" 2
-has   "…naming the act with the one word left to the person" "$err" "run: lane-start --no-launch --dir <that lane's checkout> legacy-ui"
-has   "…having moved and written nothing" "$err" "NOTHING has been renamed, moved or written"
-is    "…and typing nothing into the pane" "$(gd_keys)" "$gd_before"
-is    "…with the offer KEPT, because the other two choices still answer it" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" yes
-gd_run "$GD_LANE_ID" "3"
-is    "…which it does" "$rc" 2
-has   "…adjusting the session to the lane" "$err" "ADJUSTED SESSION TO LANE repoGD-1"
-is    "…and the offer is consumed" "$( [ -f "$GD_OFFER" ] && echo yes || echo no )" no
-
-# ---- AND THE TABLE'S OWN CURES SAY THE SAME (openRepoTools#73, item 3).
-#
-# The offer above was fixed and the diagnostic beside it was not: rows 1, 5 and
-# 6 of the (b) table printed `lane_start_args` straight, so a lane named before
-# Rule 4 was told `run: lane-start --no-launch --dir <path> legacy-ui` — a
-# placeholder in the one line a person is told to type, where F-B6 says every
-# command is printed filled in. Where it cannot be, the row now says why in the
-# offer's words and prints the offer's own line.
-rm -f "$GD_OFFER"
-export FAKE_TMUX_WINDOW_NAME=claude
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	claude	%12	claude"
-gd_rec "$GD_LANE_ID" legacy-ui user "$GD_OLD_MS"
-gd_run "$GD_LANE_ID"
-is    "row 1, a session named for a lane from before Rule 4, still BLOCKS the prompt" "$rc" 2
-has   "…as the case that ran for three days" "$err" "THAT IS THE 2026-09-10 CASE"
-has   "…saying in the offer's words why its command cannot be filled in" "$err" "Lane legacy-ui is named before Rule 4's \`<repo>-<n>\` form"
-has   "…and whose the checkout is to supply" "$err" "the checkout is yours to supply"
-has   "…printing the offer's own line" "$err" "run: lane-start --no-launch --dir <that lane's checkout> legacy-ui"
-hasnt "…and never the bare placeholder" "$err" "--dir <path>"
-L73_OLD="aaaa0073-0000-4000-8000-aaaa00730000"
-L73_LAST="aaaa0073-1111-4000-8000-aaaa00731111"
-L73_FREE="aaaa0073-2222-4000-8000-aaaa00732222"
-"$E" add-row "| \`legacy-gd\` | harness $L73_OLD → harness $L73_LAST (transcript uuid; profile t1) | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/legacy/w.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_WINDOW_NAME=legacy-gd
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	legacy-gd	%12	claude"
-gd_rec "$L73_OLD" legacy-gd user "$GD_OLD_MS"
-gd_run "$L73_OLD"
-is    "row 5, a superseded transcript of such a lane, BLOCKS the prompt" "$rc" 2
-has   "…named as one" "$err" "this is a SUPERSEDED transcript of lane legacy-gd"
-has   "…cured by the real launch, its checkout left to the person" "$err" "run: lane-start --dir <that lane's checkout> legacy-gd"
-hasnt "…never the bare placeholder" "$err" "--dir <path>"
-gd_rec "$L73_FREE" legacy-gd user "$GD_OLD_MS"
-gd_run "$L73_FREE"
-is    "row 6, an id in no row of such a lane, BLOCKS the prompt" "$rc" 2
-has   "…named as the harness minting a transcript with nobody acting" "$err" "does not name $L73_FREE at all"
-has   "…cured by the recording act, its checkout left to the person" "$err" "run: lane-start --no-launch --dir <that lane's checkout> legacy-gd"
-hasnt "…never the bare placeholder" "$err" "--dir <path>"
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- THE OTHER TEXT A SESSION CELL CAN CARRY INSTEAD OF A UUID.
-#
-# `lane-start` writes `pending — set by the session's first act` into a row it
-# creates with neither a minted uuid nor one it was allowed to take
-# (`lane-start:1914`), and after a `yes` that is exactly the shape the
-# destination can be in: veto 1 refuses this window's uuid because the row being
-# LEFT still records it. Anchored only on `none recorded`, the guard's own last
-# write could not be made there and the next prompt refused for ever on a state
-# it had created by obeying the person (Copilot round 3 on this PR). That write
-# is `lane-start --bind`'s now (openRepoTools#70), and the anchor rule went with
-# it.
-"$E" add-row "| \`repoGD-4\` | pending — set by the session's first act | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGD/w.md | ACTIVE |" >/dev/null 2>&1
-export FAKE_TMUX_RENAME_STICKS=1 FAKE_TMUX_NAME_FILE="$SANDBOX/tmux-window-name"
-printf 'repoGD-1\n' > "$SANDBOX/tmux-window-name"
-gd_rec "$GD_LANE_ID" repoGD-4 user "$GD_NEW_MS"
-gd_run "$GD_LANE_ID"
-is    "a rename to a lane whose cell carries no uuid at all is the offer" "$rc" 2
-has   "…naming the lane it would move to" "$err" "2) adjust the lane to session repoGD-4"
-gd_run "$GD_LANE_ID" "2"
-is    "…and \`yes\` moves the window" "$rc" 2
-has   "…saying so" "$err" "MOVED: this window is now lane repoGD-4"
-has   "…with lane-start's binding mode anchored on the cell's \`pending\` text" "$err" "session cell now ends on $GD_LANE_ID"
-has   "…which the register carries" "$("$E" register-row repoGD-4 2>/dev/null || :)" "$GD_LANE_ID"
-unset FAKE_TMUX_RENAME_STICKS FAKE_TMUX_NAME_FILE
-export FAKE_TMUX_WINDOW_NAME=repoGD-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# ---- M1's TWO CONDITIONS ON TYPING AT ALL, AND THE PANE IT TYPES INTO.
-#
-# (a) THE PANE IS THE RECORD'S, ELSE THIS ONE. The harness has been seen to
-# write no `tmux` at all for a process plainly in a window (Amendment 8, ruling
-# (g)'s third fact), and `record_is_here`'s tier 3 still places such a record
-# HERE by the pane's own process tree — so the lock had a session to rename and
-# no pane to type into, and printed "tmux would not take the keys" for a name it
-# could have fixed (Copilot round 2 on this PR). Both hooks run INSIDE the
-# session's own pane, so `#{pane_id}` with no `-t` is that pane, asked of tmux
-# rather than guessed. The fake answers it only for a case that opts in, so
-# every case written before this one still describes a record with a target.
-# THE PANE THE FALLBACK FINDS IS A REAL ONE AND NOT THE RECORD'S: a second
-# window in the fake's table, so that the pane typed into can only have come
-# from tmux's own `#{pane_id}`. M1's gate is asked of it like any other, which
-# is why it has to be a pane the table knows: a `%99` in no window at all is
-# read as "the pane's current command could not be read" and nothing is typed,
-# which is the case below this one and not this one.
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude
-gdsess:9	@99	repoGD-1	%99	claude"
-# THE PANE PID IS THE RECORD'S OWN, AND THAT IS A PORTABILITY FACT AND NOT A
-# convenience: `pid_under` answers 0 at its FIRST step when the pid IS the
-# ancestor, and walks `/proc` only to climb. macOS has no `/proc`, so a
-# record whose pid is a CHILD of this pane is "here" on Linux and nowhere on
-# the macOS job — which is what `tests-macos` said at `6cf5359`, three red
-# lines under a green Linux run. A record whose pid IS the pane's needs no
-# walk at all and is this window's on both.
-export FAKE_TMUX_PANE_PID="$LIVE_PID" FAKE_TMUX_PANE_ID="%99"
-write_record_a12 "$sessions_dir/gd.json" "$GD_LANE_ID" "$LIVE_PID" "$live_start" interactive "-" repogd-1 derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a live record with NO tmux target is still this window's, and the lock still renames it" "$rc" 2
-has   "…saying it did" "$err" "SO IT HAS BEEN RENAMED FOR YOU"
-is    "…typing once" "$(( $(gd_keys) - gd_before ))" 1
-has   "…into the pane tmux itself names, the record having named none" "$(tail -n1 "$FAKE_TMUX_LOG")" "send-keys -t %99 /rename repoGD-1 Enter"
-# AND A TARGET THAT NAMES ANOTHER WINDOW IS NOT A PANE THIS HOOK MAY TYPE INTO.
-# `here` is true by the record's target OR by the pane's process tree, and tmux
-# REUSES window ids — so a record that is here BY ANCESTRY can carry a target
-# some other window now answers to, and M1's gate cannot catch that one: the
-# other pane is running `claude` too (Copilot round 3 on this PR).
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude
-othersess:0	@5	repoGD-1	%5	claude
-gdsess:9	@99	repoGD-1	%99	claude"
-export FAKE_TMUX_PANE_PID="$LIVE_PID" FAKE_TMUX_PANE_ID="%99"
-write_record_a12 "$sessions_dir/gd.json" "$GD_LANE_ID" "$LIVE_PID" "$live_start" interactive "othersess:@5.%5" repogd-1 derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a stale target naming another window is not the pane the lock types into" "$(( $(gd_keys) - gd_before ))" 1
-has   "…which is the one tmux names for THIS window" "$(tail -n1 "$FAKE_TMUX_LOG")" "send-keys -t %99 /rename repoGD-1 Enter"
-hasnt "…and never the pane the record named, which another session is sitting in" "$(tail -n1 "$FAKE_TMUX_LOG")" "-t %5 "
-unset FAKE_TMUX_PANE_ID FAKE_TMUX_PANE_PID
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-
-# (b) AND NOTHING ELSE IS TYPED INTO. M1 ratified the mechanism with its
-# condition: the keys go in *"only while the pane's current command is
-# `claude`"* — a `/rename` typed at a shell is a command that does not exist and
-# typed into an editor is text nobody wrote. Neither half of that gate had a
-# case, and it is the only barrier between this hook and somebody else's process
-# (Copilot round 2 on this PR).
-#
-# THE NAME IN THESE CASES DIFFERS FROM THE ROW'S BY CASE ALONE, and that is what
-# reaches the LOCK now: every wider mismatch is the three-choice offer, which
-# types nothing until a person picks choice 3. The mechanism under test is the
-# PANE — which one, and whether it may be typed into at all — so the case-only
-# name is how these cases go on asking about it.
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	bash"
-gd_rec "$GD_LANE_ID" repogd-1 derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a pane running something other than claude is NOT typed into" "$(gd_keys)" "$gd_before"
-is    "…and the prompt is still refused" "$rc" 2
-has   "…saying why nothing was typed" "$err" "this pane is not running claude, so NOTHING was typed"
-has   "…with the line for the person to type in the lane's own pane" "$err" "/rename repoGD-1"
-# AND `node` IS NOT `claude` EITHER, which is M1's own word: *"only while the
-# pane's current command is `claude`"*. This gate read `claude|node` for one
-# round, on the reasoning that the harness is a node program — measured on Eagle
-# 2026-09-14T23:4xZ across the twelve panes tmux had, eleven lane panes report
-# `claude`, two `bash` and one `zsh`, and none reports `node`. So the second
-# word bought nothing and would have let a stray Node REPL take `/rename <lane>`
-# as input (Copilot round 4 on this PR).
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	node"
-gd_rec "$GD_LANE_ID" repogd-1 derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a pane running \`node\` is not typed into either" "$(gd_keys)" "$gd_before"
-has   "…for the reason M1 gives, in one word" "$err" "this pane is not running claude"
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoGD-1	%12	claude"
-# A PANE THAT COULD NOT BE ASKED IS THE OTHER HALF, and it fails the same way:
-# the record names a pane this window does not have, so the targeted read
-# resolves nothing and the gate has no answer to test.
-write_record_a12 "$sessions_dir/gd.json" "$GD_LANE_ID" "$LIVE_PID" "$live_start" interactive "gdsess:@12.%77" repogd-1 derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-gd_run "$GD_LANE_ID"
-is    "a pane whose current command could not be read is not typed into either" "$(gd_keys)" "$gd_before"
-is    "…and that prompt is refused too" "$rc" 2
-has   "…fail closed, and saying what a stray \`/rename\` would have landed in" "$err" "the pane's current command could not be read"
-
-# ---- CLAUSE (f): THE `SessionStart` BLOCK'S OWN LINE, WHICH REFUSES NOTHING.
-gd_rec "$GD_LANE_ID" repogd-7e derived "$GD_OLD_MS"
-gd_before="$(gd_keys)"
-out="$(printf '{"session_id":"%s","source":"resume","cwd":"%s/projects/repoGD"}' "$GD_LANE_ID" "$HOME" | "$E" session-start 2>/dev/null)"; rc=$?
-is    "the SessionStart hook still exits 0 with the name wrong — it never refuses (R-A8-1)" "$rc" 0
-has   "…and says the name was not the lane's, in clause (f)'s own words" "$out" "session name 'repogd-7e' was not the lane 'repoGD-1' — renamed"
-is    "…having typed the rename itself ((h)1: its ONE act on the pane)" "$(( $(gd_keys) - gd_before ))" 1
-write_record_a12 "$gd_t2/fork.json" "$GD_LANE_ID" "$GD_DUP" "$gd_dup_start" bg "-" "repoGD-1" - "$GD_OLD_MS"
-out="$(printf '{"session_id":"%s","source":"resume","cwd":"%s/projects/repoGD"}' "$GD_LANE_ID" "$HOME" | "$E" session-start 2>/dev/null)"; rc=$?
-is    "…and a duplicate process is SAID and not acted on there" "$rc" 0
-has   "…named as the defect it is, with the retire act" "$out" "another live process carries this session id"
-has   "…and never a kill" "$out" "lane-end repoGD-1 --retire <pid>"
-rm -f "$gd_t2/fork.json"
-# AND IT LEAVES A PERSON'S OWN RENAME TO ANOTHER LANE ALONE. Clause (f) types
-# the rename for (h)1's case — DRIFT, a name that is no lane's — while (h) rule
-# 2 makes a `nameSource: user` rename to another lane's name an INSTRUCTION,
-# answered at the next prompt. This hook runs on every startup, resume, clear
-# and fork, so typing over such a name would erase the person's choice before
-# the guard could put the question: a rename, then a `/clear`, and the offer
-# never happens (Copilot round 4 on this PR).
-gd_rec "$GD_LANE_ID" repoGD-2 user "$GD_NEW_MS"
-gd_before="$(gd_keys)"
-out="$(printf '{"session_id":"%s","source":"resume","cwd":"%s/projects/repoGD"}' "$GD_LANE_ID" "$HOME" | "$E" session-start 2>/dev/null)"; rc=$?
-is    "the SessionStart hook does not type over a rename a PERSON made to another lane" "$(gd_keys)" "$gd_before"
-is    "…still exiting 0, as it always does" "$rc" 0
-has   "…and saying the guard will put the question at the next prompt" "$out" "the name guard offers the move at your next prompt"
-rm -f "$sessions_dir/gd.json"
-kill "$GD_DUP" 2>/dev/null || :
-# THE FIXTURE PUT BACK EXACTLY AS IT WAS FOUND — an empty capture means the
-# variable was unset here and is unset again, which `${x:+…}` alone could not
-# express.
-if [ -n "$GD_SAVE_WINDOWS" ]; then export FAKE_TMUX_WINDOWS="$GD_SAVE_WINDOWS"; else unset FAKE_TMUX_WINDOWS; fi
-if [ -n "$GD_SAVE_WINDOW" ]; then export FAKE_TMUX_WINDOW="$GD_SAVE_WINDOW"; else unset FAKE_TMUX_WINDOW; fi
-if [ -n "$GD_SAVE_NAME" ]; then export FAKE_TMUX_WINDOW_NAME="$GD_SAVE_NAME"; else unset FAKE_TMUX_WINDOW_NAME; fi
-
-section "== Amendment 15: a lane name is one name under any case =="
-
-# RATIFIED BY BRETT HEAP 2026-09-14T00:07:18Z, verbatim *"Ratify as drafted
-# (Recommended)"*, on his question of the day before, verbatim *"can we make
-# lane names case insenstive?"*. **A lane name is compared CASE-INSENSITIVELY
-# wherever a name is looked up, and the spelling the register row carries is
-# canonical.**
-#
-# WHAT IT COST TO LEARN, five minutes before it was asked about. At
-# 2026-09-13T23:51:56Z a `lane-start openxfactory 2`, typed in lowercase for the
-# lane `openXfactory-2` that had run since 2026-09-02, found NO row — the row
-# key was the one exact comparison left in the tooling, while `repos.tsv`,
-# `lane_named_ci`, Rule 6 attribution and home matching already lowercased —
-# minted a new session, named the window `openxfactory-2` and appended a SECOND
-# row, while its object log went on into `lanes/log/openxfactory-2.md`, the one
-# file both spellings had always shared. Two rows, one lane, one log.
-#
-# THE CHECKOUT IS COMMITTED FIRST, for the reason the section below this one
-# gives in the same words: the cases above leave the sandbox workspace dirty on
-# purpose, and `lanes-edit.sh` REFUSES an object-log write on a checkout it
-# cannot rebase — which is those cases' subject and not this one's.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending edits before the Amendment 15 cases" >/dev/null 2>&1 || :
-
-# THE FIXTURE IS THE INCIDENT'S OWN SHAPE: a MIXED-CASE row, a checkout whose
-# directory is spelled that way too, and a log file already written under the
-# LOWERCASE name — which is the state `openXfactory-2` was actually in.
-mkdir -p "$HOME/projects/repoCase"
-git init -q -b main "$HOME/projects/repoCase"
-git -C "$HOME/projects/repoCase" remote add origin "https://github.com/opensoft/repoCase.git"
-casedir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoCase")"
-mkdir -p "$casedir"
-printf '{"type":"custom-title","customTitle":"repoCase-1","sessionId":"%s"}\n' "$DEAD_ID" > "$casedir/$DEAD_ID.jsonl"
-add_seed_row "| \`repoCase-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCase/x.md | ACTIVE |"
-{ printf '# lane repocase-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoCase-1, session %s@Eagle, %s, lane:repoCase-1 → home opensoft/repoCase; estate repoCase\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repocase-1.md"
-# A LOG THAT SPELLS ITS OWN LANE BOTH WAYS, which is not a contrivance: an
-# object log is APPEND-ONLY and its lane field carries whatever was typed on the
-# day, so `lanes/log/openxfactory-2.md` holds `lane openXfactory-2` lines from
-# 2026-09-02 beside the `lane openxfactory-2` lines of the 23:51:56Z incident,
-# in one file, about one lane. The CLAIMED here is written in the OTHER case
-# from the row and it is a REAL HOLD. Matched byte for byte it would belong to
-# no lane at all: `who --lane` would say this one holds nothing and `lane-end`
-# would end it without a word.
-add_seed_row "| \`repoHold-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoHold/x.md | ACTIVE |"
-{ printf '# lane repoHold-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoHold-1, session %s@Eagle, %s, lane:repoHold-1 → home opensoft/repoHold; estate repoHold\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repohold-1, session %s@Eagle, %s, opensoft/repoHold#9\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoHold-1.md"
-# THE ROW'S SPELLING IS NOT THE DIRECTORY'S, AND THE ROW STILL WINS. `repoMix`
-# is the checkout on disk and `repoMIX-1` is the register's row: the `<repo>`
-# half resolves to the directory (15(a)) and the LANE resolves to the row, and
-# a run that took one answer for both would get one of the two wrong.
-mkdir -p "$HOME/projects/repoMix"
-git init -q -b main "$HOME/projects/repoMix"
-git -C "$HOME/projects/repoMix" remote add origin "https://github.com/opensoft/repoMix.git"
-mixdir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoMix")"
-mkdir -p "$mixdir"
-printf '{"type":"custom-title","customTitle":"repoMIX-1","sessionId":"%s"}\n' "$DEAD_ID" > "$mixdir/$DEAD_ID.jsonl"
-add_seed_row "| \`repoMIX-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoMix/x.md | ACTIVE |"
-# A LANE WHOSE OWN LOG SPELLS IT BOTH WAYS, AND WHOSE FACTS ARE IN BOTH LINES:
-# the directory and the profile are on the STARTED the row's way, the state and
-# the swap record are on the PAUSED the other way. One lane, one set of facts.
-add_seed_row "| \`repoWin-1\` | harness \`$DEAD_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoWin/x.md | ACTIVE |"
-{ printf '# lane repoWin-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoWin-1, session %s@Raven, %s, lane:repoWin-1 → home opensoft/repoWin; dir /elsewhere/repoWin; profile team-09z\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'PAUSED — lane repowin-1, session %s@Raven, 2026-09-12T09:00:00Z, lane:repowin-1 → swap; window casewin:3; workstation Raven\n' "$DEAD_ID"
-} > "$LOGD/repoWin-1.md"
-# A TRANSCRIPT TITLED IN THE OTHER CASE, which is `openXfactory-2`'s own state:
-# the launcher named its session `openxfactory-2` on 2026-09-13 and the row has
-# said `openXfactory-2` since the 15(d) merge. The row's recorded id has NO
-# transcript in this directory, so the TITLE is all that is left — and a matcher
-# that compares it byte for byte finds nothing and mints a second conversation
-# on a lane that already has one.
-TITLE_ID="00000000-7171-4000-8000-000000007171"
-mkdir -p "$HOME/projects/repoTitle"
-git init -q -b main "$HOME/projects/repoTitle"
-git -C "$HOME/projects/repoTitle" remote add origin "https://github.com/opensoft/repoTitle.git"
-titledir="$HOME/.claude/projects/$(sanitize "$HOME/projects/repoTitle")"
-mkdir -p "$titledir"
-printf '{"type":"custom-title","customTitle":"repotitle-1","sessionId":"titled-15"}\n' > "$titledir/titled-15.jsonl"
-add_seed_row "| \`repoTitle-1\` | harness \`$TITLE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoTitle/x.md | ACTIVE |"
-# A SECOND MIXED-CASE ROW WITH A LOWERCASE LOG, kept for the case-INSENSITIVE
-# INDEX below — which needs a rename that has not happened yet.
-add_seed_row "| \`repoIgn-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoIgn/x.md | ACTIVE |"
-{ printf '# lane repoign-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoIgn-1, session %s@Eagle, %s, lane:repoIgn-1 → home opensoft/repoIgn; estate repoIgn\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoign-1.md"
-# PAUSED UNDER ONE SPELLING, RESUMED UNDER THE OTHER — which is what decides
-# whether a lane is SWAPPED at all. Keyed on the spelling each line used, the
-# PAUSED survives as a swap candidate for ever and `restart` relaunches a lane
-# that is running.
-add_seed_row "| \`repoSwap-1\` | harness \`$DEAD_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoSwap/x.md | ACTIVE |"
-{ printf '# lane repoSwap-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane reposwap-1, session %s@Raven, 2026-09-12T09:00:00Z, lane:reposwap-1 → swap; window swapwin:4; workstation Raven\n' "$DEAD_ID"
-  printf 'RESUMED — lane repoSwap-1, session %s@Raven, 2026-09-12T10:00:00Z, lane:repoSwap-1 → home opensoft/repoSwap\n' "$DEAD_ID"
-} > "$LOGD/repoSwap-1.md"
-# A SWAPPED LANE WHOSE ONLY LOG FILE IS LOWERCASE, which is every lane that
-# predates Amendment 15: `lanes/log/openxfactory-4.md` beside the row
-# `openXfactory-4`. `swapped` read the lane under the file's name and printed it.
-add_seed_row "| \`repoSwLow-1\` | harness \`$DEAD_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoSwLow/x.md | ACTIVE |"
-{ printf '# lane reposwlow-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'PAUSED — lane reposwlow-1, session %s@Raven, 2026-09-12T09:30:00Z, lane:reposwlow-1 → swap; window lowwin:5; workstation Raven\n' "$DEAD_ID"
-} > "$LOGD/reposwlow-1.md"
-# THE PAIR THE AMENDMENT MAKES IMPOSSIBLE, seeded as it existed: two rows whose
-# lane names differ only by case. Every writer refuses on it until 15(d)'s merge.
-add_seed_row "| \`repoPair-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPair/x.md | ACTIVE |"
-PAIR_ID="abcdef01-15c5-4000-8000-abcdef0115c5"
-add_seed_row "| \`repopair-1\` | harness \`$PAIR_ID\` | Eagle / test / brett | 2026-09-13T23:51Z | none | handoffs/repoPair/x.md | STARTING |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the Amendment 15 fixtures: a mixed-case row with a lowercase log, a hold spelled the other way, a row spelled unlike its checkout, a log that spells its own lane twice, and the case pair 15(d) merges"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# ---------------------------------------------- act 2: lane-start, both halves
-
-: > "$FAKE_TMUX_LOG"
-run env FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-    "$START" repocase 1 --no-launch
-is    "a lowercase <repo> <n> resolves to the mixed-case row and exits 0" "$rc" 0
-is    "…resuming the row's recorded session, --name'd with the ROW's spelling" \
-      "$(launch_of "$out")" "claude --name repoCase-1 --resume $DEAD_ID"
-has   "…renaming the window to the row's spelling" "$(cat "$FAKE_TMUX_LOG")" "rename-window repoCase-1"
-hasnt "…and never to the spelling that was typed" "$(cat "$FAKE_TMUX_LOG")" "rename-window repocase-1"
-# WHICH HALF SPOKE, AND IN WHICH ORDER. `<repo>` is resolved to the directory
-# BEFORE `$LANE` is built out of it, so for a lane whose row and whose checkout
-# are spelled the same the repo half has already produced the canonical name and
-# the lane half has nothing left to change. That is the right order and not an
-# accident: the directory is a fact on this workstation and the row may not
-# exist yet. The pure LANE resolution — a row spelled unlike its directory — is
-# asserted on `repoMIX-1` below, where only the register can settle it.
-has   "…saying which spelling of <repo> it resolved to, and why" "$err" "repo repocase → repoCase"
-has   "…naming the rule that settles it" "$err" "Amendment 15(a)"
-is    "…the register still has exactly ONE row for the lane" "$(grep -c '^| `repoCase-1`' "$LANES")" 1
-is    "…and no second row under the typed spelling — the 23:51:56Z defect" \
-      "$(grep -c '^| `repocase-1`' "$LANES")" 0
-has   "…it APPENDED a status rather than adding a row" \
-      "$(git -C "$WIP" log --oneline -1 -- lanes/LANES.md)" "lane-start on"
-has   "…and the stamp it appended carries the canonical spelling" \
-      "$(grep '^| `repoCase-1`' "$LANES")" "(lane repoCase-1)"
-has   "…having found the checkout by its real directory name, not the typed one" \
-      "$(grep '^| `repoCase-1`' "$LANES")" "dir $HOME/projects/repoCase;"
-
-# THE LOG FILE IS THE ROW'S SPELLING, AND THE RENAME IS PART OF THE WRITE.
-is    "the lane's log is now named for the row" \
-      "$(ls "$LOGD" | grep -c '^repoCase-1\.md$' || :)" 1
-is    "…and the lowercase name it was written under is gone from the directory" \
-      "$(ls "$LOGD" | grep -c '^repocase-1\.md$' || :)" 0
-is    "…so there is exactly ONE log for this lane, whatever the case" \
-      "$(ls "$LOGD" | grep -ci '^repocase-1\.md$' || :)" 1
-has   "…and the line lane-start wrote is in it, under the canonical lane" \
-      "$(cat "$LOGD/repoCase-1.md")" "RESUMED — lane repoCase-1,"
-has   "…with the lane OBJECT canonical too, so the log's own key does not fork" \
-      "$(cat "$LOGD/repoCase-1.md")" "lane:repoCase-1 →"
-case_sha="$(git -C "$WIP" log -1 --format=%H -- lanes/log/repoCase-1.md)"
-has   "the rename landed in the WRITE's own commit, not a commit of its own" \
-      "$(git -C "$WIP" log -1 --format=%s "$case_sha")" "LOG(repoCase-1@Eagle): RESUMED"
-has   "…which names the old path" \
-      "$(git -C "$WIP" show --name-status --format= "$case_sha")" "lanes/log/repocase-1.md"
-has   "…and the new one, in the one commit" \
-      "$(git -C "$WIP" show --name-status --format= "$case_sha")" "lanes/log/repoCase-1.md"
-# AND THE TREE HOLDS ONE PATH, WHICH IS THE ASSERTION THE TWO ABOVE CANNOT
-# MAKE: both of them pass on a commit that MODIFIED the old path and ADDED the
-# new one, which is what a case-insensitive index produces and what leaves a
-# lane TWO committed logs — the state Amendment 15 exists to make impossible.
-# Counted case-INSENSITIVELY on purpose, so a second path under any spelling is
-# a second path. (Measured red on the macOS job of this PR at `928908a`; this
-# line is what names it on any filesystem.)
-is    "…and HEAD holds ONE path for that log, not the two a case-insensitive index leaves" \
-      "$(git -C "$WIP" ls-tree -r --name-only HEAD -- lanes/log | grep -ci '^lanes/log/repocase-1\.md$' || :)" 1
-# ONCE. The file is already the row's spelling now, so there is nothing left to
-# rename and the next write must not say there was.
-run env LANES_LANE=repocase-1 LANES_SESSION="$DEAD_ID" "$E" log PAUSED lane:repocase-1 --no-github
-is    "a second write to the same lane exits 0" "$rc" 0
-hasnt "…and renames nothing, because the rename happened once" "$err" "the row's spelling names its log"
-is    "…the directory still holds one log for the lane" \
-      "$(ls "$LOGD" | grep -ci '^repocase-1\.md$' || :)" 1
-has   "…and the line it wrote is under the row's spelling, from a lowercase LANES_LANE" \
-      "$(tail -n1 "$LOGD/repoCase-1.md")" "PAUSED — lane repoCase-1,"
-
-# AND THE RENAME REACHES THE COMMIT ON A CASE-INSENSITIVE INDEX TOO, which is
-# the filesystem this repository's macOS job runs on and the one where the two
-# names are ONE name to git. `core.ignorecase` is the config git SETS from that
-# probe, so setting it by hand on a case-sensitive filesystem reproduces the
-# index half of it exactly: `git add` then matches the pathspec to the entry it
-# already has, stages the appended content under the OLD name, and the commit
-# records a modification where a rename belongs. Measured that way on the macOS
-# job of this PR at `48f2111`: `git log -- <the canonical path>` came back
-# EMPTY and fifteen assertions went red behind it.
-# SAVED AND RESTORED, NEVER UNSET. `core.ignorecase` is the value `git init`
-# WRITES from its own probe of the filesystem, so on a case-insensitive one it
-# is already `true` and setting it here is a no-op there — this case reproduces
-# the INDEX half on a case-sensitive filesystem, and only that half. The other
-# half is the operating system resolving both spellings to one file, which no
-# config reproduces; what covers it is the tree count below, asserted on every
-# platform.
-ign_was="$(git -C "$WIP" config --local core.ignorecase 2>/dev/null || printf '')"
-git -C "$WIP" config core.ignorecase true
-run env LANES_LANE=repoign-1 LANES_SESSION="$DEAD_ID" "$E" log PAUSED lane:repoign-1 --no-github
-if [ -n "$ign_was" ]; then git -C "$WIP" config core.ignorecase "$ign_was"
-else                      git -C "$WIP" config --unset core.ignorecase || :
-fi
-is    "a write under a case-INSENSITIVE index exits 0" "$rc" 0
-is    "…and the lane's log is the row's spelling on disk" \
-      "$(ls "$LOGD" | grep -c '^repoIgn-1\.md$' || :)" 1
-ign_sha="$(git -C "$WIP" log -1 --format=%H -- lanes/log/repoIgn-1.md)"
-has   "…the rename reaching the WRITE's own commit, not an index that never saw it" \
-      "$(git -C "$WIP" log -1 --format=%s "$ign_sha" 2>/dev/null)" "LOG(repoIgn-1@Eagle): PAUSED"
-has   "…which names the old path" \
-      "$(git -C "$WIP" show --name-status --format= "$ign_sha" 2>/dev/null)" "lanes/log/repoign-1.md"
-has   "…and the new one, in the one commit" \
-      "$(git -C "$WIP" show --name-status --format= "$ign_sha" 2>/dev/null)" "lanes/log/repoIgn-1.md"
-is    "…and HEAD holds ONE path for this lane's log as well" \
-      "$(git -C "$WIP" ls-tree -r --name-only HEAD -- lanes/log | grep -ci '^lanes/log/repoign-1\.md$' || :)" 1
-is    "…leaving the checkout clean, so the next write is not refused for it" \
-      "$(git -C "$WIP" status --porcelain -- lanes | grep -c . || :)" 0
-
-# THE ROW WINS OVER THE DIRECTORY, AND THE DIRECTORY IS STILL ITS OWN SPELLING.
-# `repoMix` on disk, `repoMIX-1` in the register: the `<repo>` half answers from
-# the checkout and the LANE half answers from the row, and this is the run where
-# the two answers differ, so neither can be standing in for the other.
-: > "$FAKE_TMUX_LOG"
-run env FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-    "$START" repomix 1 --no-launch
-is    "a lane whose row is spelled unlike its checkout exits 0" "$rc" 0
-has   "…the repo half answering from the directory" "$err" "repo repomix → repoMix"
-has   "…and the LANE half answering from the register row, over it" "$err" "lane repoMix-1 → repoMIX-1"
-is    "…so the launch is --name'd with the ROW's spelling" \
-      "$(launch_of "$out")" "claude --name repoMIX-1 --resume $DEAD_ID"
-has   "…and the window is renamed to it" "$(cat "$FAKE_TMUX_LOG")" "rename-window repoMIX-1"
-hasnt "…never to the spelling the directory would give" "$(cat "$FAKE_TMUX_LOG")" "rename-window repoMix-1"
-is    "…with no second row added under either spelling" \
-      "$(grep -c '^| `repoMix-1`' "$LANES")" 0
-has   "…and the lane's directory is still the CHECKOUT's own spelling, which the row does not carry" \
-      "$(grep '^| `repoMIX-1`' "$LANES")" "dir $HOME/projects/repoMix"
-
-# A TRANSCRIPT TITLED IN THE OTHER CASE IS STILL THIS LANE'S, AND IS RESUMED.
-# The row's id has no transcript here, so this is the TITLE fallback — the
-# branch that decides resume versus mint — and the amendment names the session
-# name among the lookups that compare case-insensitively.
-: > "$FAKE_TMUX_LOG"
-run env FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-    "$START" repotitle 1 --no-launch
-is    "a transcript titled in ANOTHER case is found, and resume beats a new session" \
-      "$(launch_of "$out")" "claude --name repoTitle-1 --resume repoTitle-1"
-has   "…saying which title it actually found" "$err" "carries the title 'repotitle-1'"
-has   "…and that the two spellings are one lane" "$err" "spells this lane in another case"
-hasnt "…never calling it a dedupe suffix, which is a different fact with a different cure" \
-      "$err" "dedupe suffix"
-hasnt "…and minting no new session id for a lane that already has a conversation" \
-      "$out" "--session-id"
-
-# AND `--confirm` DOES NOT TELL A PERSON THEIR OWN LANE'S WINDOW IS NOT THE LANE.
-# The window here is named `repotitle-1` and the row says `repoTitle-1`: the
-# rename still happens, to the row's spelling, but the sentence the operator is
-# asked to answer decides whether they say y — and "which is not the lane" about
-# their own window earns an N that abandons a legitimate resume.
-: > "$FAKE_TMUX_LOG"
-run env FAKE_TMUX_WINDOW_NAME=repotitle-1 FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-    "$START" repotitle 1 --no-launch --confirm --yes
-is    "--confirm in a window named for this lane in ANOTHER case exits 0" "$rc" 0
-has   "…telling the operator it is THIS LANE under another case" "$err" "THIS LANE under another case"
-hasnt "…and never that their own lane's window is not the lane" "$err" "which is not the lane"
-has   "…while still renaming it to the register row's spelling" \
-      "$(cat "$FAKE_TMUX_LOG")" "rename-window repoTitle-1"
-
-# add-row REFUSES THE CASE-DUPLICATE, AND NAMES THE ROW THAT IS THERE. This is
-# the act the incident got past: `row_line`'s exactly-one test failing for the
-# OTHER reason used to read as "no row, go ahead".
-run "$E" add-row "| \`repocase-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoCase/x.md | ACTIVE |"
-is    "add-row refuses a row whose lane differs from an existing one only by case" "$rc" 2
-has   "…naming the row that is already there, in its own spelling" "$err" "spelled repoCase-1"
-has   "…and citing the clause that makes the two one lane" "$err" "Amendment 15(a)"
-is    "…adding nothing" "$(grep -c '^| `repocase-1`' "$LANES")" 0
-
-# A REPO DIRECTORY TYPED IN THE WRONG CASE IS FOUND — asserted above through the
-# recorded `dir` — AND TWO THAT DIFFER ONLY BY CASE ARE A REFUSAL NAMING BOTH.
-# On a case-INSENSITIVE filesystem the pair cannot exist and the case is skipped
-# rather than asserted vacuously.
-mkdir -p "$HOME/projects/repoTwin" "$HOME/projects/repotwin" 2>/dev/null || :
-twin_n="$(ls "$HOME/projects" | grep -ci '^repotwin$' || :)"
-if [ "$twin_n" = 2 ]; then
-  run "$START" repotwin 1 --no-launch
-  is    "two \$PROJECTS_ROOT directories differing only by case refuse with 2" "$rc" 2
-  has   "…saying how many there are" "$err" "holds 2 directories whose names differ only by case"
-  has   "…naming the one that is not what was typed" "$err" "repoTwin"
-  has   "…citing the clause" "$err" "Amendment 15(a)"
-  has   "…and naming the flag that settles it" "$err" "--dir <path>"
-  is    "…and renaming nothing" "$(grep -c 'repotwin-1' "$FAKE_TMUX_LOG")" 0
-  # AND `--dir` IS THE ANSWER THAT REFUSAL ITSELF PRINTS, so a run that already
-  # carries one is not ambiguous about where the lane is and must not be
-  # refused by the remedy it was given.
-  git init -q -b main "$HOME/projects/repoTwin"
-  : > "$FAKE_TMUX_LOG"
-  run env FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-      "$START" --dir "$HOME/projects/repoTwin" repotwin 1 --no-launch
-  is    "…while a run that HAS named the checkout with --dir is not refused" "$rc" 0
-  has   "…saying which ambiguity is left and which is not" "$err" "--dir has named the checkout"
-  has   "…and taking the directory it was given" "$err" "$HOME/projects/repoTwin"
-else
-  skip "two \$PROJECTS_ROOT directories differing only by case refuse with 2" \
-       "this filesystem is case-insensitive, so the pair cannot exist on it"
-fi
-
-# ------------------------------- act 1: every writer refuses the pair, by name
-
-for a15_cmd in "log" "claim" "append-session-id"; do
-  case "$a15_cmd" in
-    log)               run env LANES_LANE=repopair-1 LANES_SESSION="$DEAD_ID" "$E" log PAUSED lane:repopair-1 --no-github ;;
-    claim)             run env LANES_LANE=repopair-1 LANES_SESSION="$DEAD_ID" "$E" claim "opensoft/repoPair#1" --no-github ;;
-    append-session-id) run "$E" append-session-id repopair-1 "$DEAD_ID" "→ harness \`$PAIR_ID\`" ;;
-  esac
-  is   "$a15_cmd refuses a register holding two rows that differ only by case" "$rc" 2
-  has  "…naming the older spelling" "$err" "repoPair-1"
-  has  "…naming the newer one beside it" "$err" "repopair-1"
-  has  "…and citing the merge that is a person's act" "$err" "Amendment 15(d)"
-done
-is   "…and none of the three wrote a log for the lane" \
-     "$(ls "$LOGD" | grep -ci '^repopair-1\.md$' || :)" 0
-
-# AND `lane-end` REFUSES THE PAIR. Two reads can see it and BOTH are asserted:
-# `canon-lane`'s refusal, which this command now relays by its own words rather
-# than spending a generic 1 on (Copilot round 4, the stale-checkout case below),
-# and `lane-end`'s OWN row scan, which is the whole of the refusal where the
-# helper predates the amendment — asserted with exactly such a helper below.
-# Compared byte for byte that scan found exactly ONE row and went on to end a
-# lane whose register is ambiguous.
-run "$END" repopair-1
-is   "lane-end refuses the 15(d) pair, naming both rows" "$rc" 2
-has  "…naming the spelling that was typed" "$err" "repopair-1"
-has  "…and the one beside it" "$err" "repoPair-1"
-has  "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-
-# ------------------------------------------- act 1: Rule 6 attribution, Rule 10
-#
-# Rule 10's wire form is LOWERCASE — `Lane: openxfactory-2 (openXfactory-2)` —
-# while the row's token is camel, which is why `append-line` has matched the
-# name case-insensitively since `5219569`. Under this amendment it must still
-# match, and the commit it makes must carry the ROW's spelling.
-run "$E" append-line "LANDING — lane repocase-1, session $DEAD_ID@Eagle, 2026-09-11T01:00:00Z, PR #3 into opensoft/repoCase main"
-is   "append-line with a lowercase lane name in its text exits 0" "$rc" 0
-has  "…attributing the commit to the ROW's spelling, not the line's" \
-     "$(git -C "$WIP" log --oneline -1 -- lanes/LANES.md)" "LANES(repoCase-1@Eagle)"
-has  "…and the line itself lands verbatim, because a Rule 6 line is never rewritten" \
-     "$(tail -n5 "$LANES")" "LANDING — lane repocase-1,"
-# AND A LINE NAMING THE 15(d) PAIR IS A REFUSAL, not a commit attributed to
-# nobody: two rows answer the attribution read exactly as no rows do.
-run "$E" append-line "LANDING — lane repopair-1, session $DEAD_ID@Eagle, 2026-09-11T01:00:00Z, PR #4 into opensoft/repoPair main"
-is   "append-line refuses a line whose lane the register spells two ways" "$rc" 2
-has  "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-hasnt "…and writing no line for it" "$(tail -n3 "$LANES")" "PR #4 into opensoft/repoPair"
-
-# ------------------------------------- acts 1 and 3: the reads take either case
-
-run "$E" who --lane repocase-1 --no-fetch
-has  "who --lane takes the lowercase spelling and answers about the mixed-case row" \
-     "$out$err" "repoCase-1"
-# AND THE OBJECT LOG IS ONE LANE'S WHATEVER CASE ITS LINES SPELL THE LANE IN.
-# `repoHold-1`'s CLAIMED says `lane repohold-1`; matched byte for byte it is
-# another lane's line and that lane reads as holding nothing. The amendment's
-# own sentence names the object log among the places a name is looked up.
-run  "$E" who --lane repoHold-1 --no-fetch
-has  "who --lane names a hold its log recorded in the OTHER case" \
-     "$out" "opensoft/repoHold#9"
-run  "$END" repoHold-1
-is   "…and lane-end REFUSES to end that lane, which is the hold's whole point" "$rc" 2
-has  "…naming the object it still holds" "$err" "opensoft/repoHold#9"
-has  "…and the one word that ends it anyway" "$err" "--force"
-# AND THE LANE DOES NOT MEET ITS OWN HOLD AS A RIVAL. `claim` removes THIS
-# lane's row from the holders of the object it is claiming; byte for byte, a
-# hold its log recorded in the other case is a stranger's and the lane is
-# refused its own object.
-run env LANES_LANE=repoHold-1 LANES_SESSION="$DEAD_ID" "$E" claim "opensoft/repoHold#9" --no-github
-is    "claim does not meet this lane's own hold, spelled otherwise, as a rival" "$rc" 0
-# THE REFUSAL'S OWN WORDS AND THE RACE'S OWN WORDS, not the word "holds" — the
-# line this claim SUCCEEDS with says *"lane repoHold-1 now holds …"*, and an
-# assertion that cannot tell that from *"lane repohold-1 holds …"* is asserting
-# the wrong half. The two failures this case exists for are the pre-check
-# meeting the lane's own row as a rival, and `claim_rescan_hook` meeting it
-# again after the rebase and calling the lane the winner against itself.
-hasnt "…never stopping and reporting against itself, which is the pre-check" \
-      "$err" "Rule 1: the lane stops and reports"
-hasnt "…and never losing the race to itself, which is the read after the rebase" \
-      "$err" "CLAIM LOST"
-run "$E" lanes --lane repocase-1
-is   "lanes --lane takes the lowercase spelling" "$rc" 0
-is   "…and column 1 is the row's own spelling, never the typed one" \
-     "$(printf '%s' "$out" | cut -f1)" "repoCase-1"
-# ONE LANE, TWO SPELLINGS IN ITS OWN LOG, ONE SET OF FACTS. `repoWin-1`'s
-# STARTED carries its directory and profile the row's way and its PAUSED carries
-# the state the other way. Keyed on the spelling each LINE used, the listing
-# emitted two rows under one lower-cased key and took the first: the state of
-# one and the fields of the other, and column 10 could not be a restart line at
-# all, because that needs the PAUSED and the profile together.
-run "$E" lanes --lane repowin-1
-is   "lanes --lane reads a log that spells its lane two ways as ONE lane" "$rc" 0
-is   "…taking the state from the LAST line, which spells it lowercase" \
-     "$(printf '%s' "$out" | awk -F'\t' '{print $2}')" "PAUSED"
-is   "…and the profile from the STARTED, which spells it the row's way" \
-     "$(printf '%s' "$out" | awk -F'\t' '{print $4}')" "team-09z"
-is   "…and the directory from that same line" \
-     "$(printf '%s' "$out" | awk -F'\t' '{print $7}')" "/elsewhere/repoWin"
-is   "…so column 10 is the line that binds it, which needs both halves at once" \
-     "$(printf '%s' "$out" | awk -F'\t' '{print $10}')" "lane repoWin-1"
-
-# THE WINDOW-TO-LANE READ ANSWERS WITH THE ROW'S SPELLING FROM EITHER RUNG. Its
-# second rung reads the swap RECORD, which spells the lane however it was paused
-# — and what this read prints is handed to `tmux rename-window`, to `--name` and
-# to `lane <name>` by its three callers (`restart <lane>` until Amendment 18
-# Addendum 2 retired that word from the PATH; the act and this read are the
-# same, and only the word a person types moved).
-run "$E" window-lane Raven casewin:3
-is   "window-lane finds the lane from a record that spells it in another case" "$rc" 0
-is   "…and answers with the register row's spelling" "$out" "repoWin-1"
-# `swapped` READS THE SAME RECORD AND HAS TO ANSWER WITH THE SAME SPELLING (#55).
-# Its first field is what a caller hands to `tmux rename-window`, to `--name` and
-# to a read of the register, so it is the ROW's spelling. The raw name the record
-# is read under is the log FILE's base name (Amendment 16(c)), and a log written
-# before Amendment 15 is lowercase beside a mixed-case row: `repoSwLow-1`, whose
-# only log is `reposwlow-1.md`. Each lane is picked by its window, because Raven
-# holds other swapped lanes too.
-run "$E" swapped Raven
-is   "swapped lists the lanes a swap paused on that workstation" "$rc" 0
-is   "…naming a lane whose log FILE is lowercase by the register row's spelling" \
-     "$(printf '%s\n' "$out" | awk -F'\t' '$3 == "lowwin:5" { print $1 }')" "repoSwLow-1"
-# THE `repoWin-1` ROW PASSES WITH OR WITHOUT THE FIX: its log file already
-# carries the row's spelling, only its PAUSED line is lowercase, and every line
-# is keyed to its file. It stays as the other shape of the same two spellings.
-is   "…and a lane whose log file carries the row's spelling by that spelling" \
-     "$(printf '%s\n' "$out" | awk -F'\t' '$3 == "casewin:3" { print $1 }')" "repoWin-1"
-
-# `--all` CLEARS `--lane`, SO IT MUST NOT REFUSE FOR ONE EITHER. The register
-# here holds the 15(d) pair; `--all` is the every-lane listing and a `--lane`
-# it is about to throw away is not a question anybody asked.
-run "$E" lanes --all --lane repopair-1
-is   "lanes --all --lane <the pair> lists every lane rather than refusing" "$rc" 0
-has  "…including a lane the selector never named" "$out" "repoCase-1"
-
-# THE SWAP CANDIDATE IS THE LANE'S LAST LANE-KIND LINE, whatever case each of
-# them spells the lane in. `repoSwap-1` was PAUSED as `reposwap-1` and RESUMED
-# as `repoSwap-1`: it is NOT swapped, and a read that keyed those two lines
-# apart kept the PAUSED alive for ever.
-run "$E" window-lane Raven swapwin:4
-is   "a lane RESUMED under the other spelling is no longer a swap candidate" "$rc" 8
-is   "…and names no lane at all" "$out" ""
-
-run "$E" register-row repocase-1
-is   "register-row takes it too" "$rc" 0
-has  "…answering with the mixed-case row" "$out" "| \`repoCase-1\` |"
-run "$E" canon-lane REPOCASE-1
-is   "canon-lane answers 0 for a name the register spells differently" "$rc" 0
-is   "…with the row's own spelling" "$out" "repoCase-1"
-run "$E" canon-lane repoNoRow-9
-is   "…and 0 with the TYPED spelling for a lane no row carries, so add-row can create it" "$rc" 0
-is   "…unchanged" "$out" "repoNoRow-9"
-run "$E" canon-lane repopair-1
-is   "…and 2 for the pair, which is a refusal and not an absence" "$rc" 2
-has  "…naming both spellings" "$err" "repoPair-1"
-
-run env -u TMUX "$LANE" repocase-1 </dev/null
-hasnt "lane <name> takes the lowercase spelling and never reports a missing row" "$err" "has no row for lane"
-has   "…speaking of the lane by the row's own spelling" "$out$err" "repoCase-1"
-
-run "$END" repocase-1 --force
-is   "lane-end takes the lowercase spelling" "$rc" 0
-has  "…and the status it appends names the row's own spelling" \
-     "$(grep '^| `repoCase-1`' "$LANES")" "lane-end on Eagle: window closing"
-has  "…as does the ENDED line in the lane's log" \
-     "$(tail -n1 "$LOGD/repoCase-1.md")" "ENDED — lane repoCase-1,"
-
-# ------------------------------------------ Copilot round 4: names and paths
-#
-# Round 4 of the review on openRepoTools#41 is six defects with one shape: a
-# name or a path that means TWO things, read as though it meant one. Five of
-# them can only be seen from a checkout that is BEHIND — `origin/<branch>` is
-# the register (R19) and `$LANES_FILE` is one workstation's copy of it — so the
-# peer below publishes what this checkout never pulls, exactly as the
-# `origin/main` cases above this section do.
-#
-# EVERY LOCAL SEED FIRST, THE PEER'S AFTER IT, and the order is not tidiness:
-# both ends append to the register at EOF, so a local commit rebased over the
-# peer's is a textual conflict in `lanes/LANES.md` — a rebase left in progress
-# and every case after it red for a reason that is not about this amendment.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending edits before the round-4 cases" >/dev/null 2>&1 || :
-add_seed_row "| \`repoTwo-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoTwo/x.md | ACTIVE |"
-add_seed_row "| \`repoLate-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoLate/x.md | ACTIVE |"
-add_seed_row "| \`repoDrop-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoDrop/x.md | ACTIVE |"
-add_seed_row "| \`repoLocal-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoLocal/x.md | ACTIVE |"
-add_seed_row "| \`repo.x-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoDot/x.md | ACTIVE |"
-add_seed_row "| \`repoXx-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoDot/y.md | ACTIVE |"
-add_seed_row "| \`repoRace-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRace/x.md | ACTIVE |"
-# A LANE NAME THAT IS ALSO A PATTERN, AND THE RIVAL IT MATCHES. `check_lane_name`
-# admits `.`, and `^repo.x-1` as a regular expression matches `repoXx-1`.
-{ printf '# lane repo.x-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repo.x-1, session %s@Eagle, %s, lane:repo.x-1 → home opensoft/repoDot; estate repoDot\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repo.x-1.md"
-{ printf '# lane repoXx-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoXx-1, session %s@Eagle, %s, lane:repoXx-1 → home opensoft/repoDot; estate repoDot\n' "$DEAD_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoXx-1, session %s@Eagle, %s, opensoft/repoDot#1\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoXx-1.md"
-{ printf '# lane repoRace-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRace-1, session %s@Eagle, %s, lane:repoRace-1 → home opensoft/repoRace; estate repoRace\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoRace-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the round-4 fixtures: a lane with two published logs, a pair this checkout has half of, a rename whose commit did not land, a log on no origin, a lane name that is a pattern, and a race with two rivals"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# A BARE PEER, AND PLUMBING RATHER THAN A WORKING TREE. One of these cases needs
-# TWO PATHS DIFFERING ONLY BY CASE in one published tree, and no working tree on
-# a case-INSENSITIVE filesystem can hold both — which is the filesystem this
-# repository's macOS job runs on. `hash-object`, `update-index --cacheinfo`,
-# `write-tree` and `commit-tree` never touch one, so the case runs everywhere
-# rather than skipping where it matters most.
-A15_PEER="$SANDBOX/a15-peer"
-git clone -q "$ORIGIN" "$A15_PEER" 2>/dev/null
-git -C "$A15_PEER" config user.email "peer@example.invalid"
-git -C "$A15_PEER" config user.name  "the other workstation"
-# <path> <content> … — publishes files at exactly these paths, in one commit,
-# and fetches it into this checkout's `origin/main` WITHOUT pulling it.
-a15_publish() {
-  git -C "$A15_PEER" fetch -q origin 2>/dev/null || :
-  git -C "$A15_PEER" read-tree origin/main
-  while [ "$#" -gt 1 ]; do
-    ap_b="$(printf '%s\n' "$2" | git -C "$A15_PEER" hash-object -w --stdin)"
-    git -C "$A15_PEER" update-index --add --cacheinfo "100644,$ap_b,$1"
-    shift 2
-  done
-  ap_t="$(git -C "$A15_PEER" write-tree)"
-  ap_c="$(git -C "$A15_PEER" commit-tree "$ap_t" -p origin/main -m "the peer publishes what this checkout has not pulled")"
-  git -C "$A15_PEER" push -q origin "$ap_c:main"
-  git -C "$WIP" fetch -q origin 2>/dev/null || :
-}
-# … and takes them off again, which one case has to do: every later
-# `pull --rebase` in this suite would otherwise try to materialise two paths a
-# case-INSENSITIVE filesystem cannot hold at once, and leave the checkout dirty
-# for cases that are not about this at all.
-a15_unpublish() {
-  git -C "$A15_PEER" fetch -q origin 2>/dev/null || :
-  git -C "$A15_PEER" read-tree origin/main
-  for au_p in "$@"; do git -C "$A15_PEER" update-index --force-remove "$au_p"; done
-  au_t="$(git -C "$A15_PEER" write-tree)"
-  au_c="$(git -C "$A15_PEER" commit-tree "$au_t" -p origin/main -m "the peer takes the pair off main again")"
-  git -C "$A15_PEER" push -q origin "$au_c:main"
-  git -C "$WIP" fetch -q origin 2>/dev/null || :
-}
-# The register as the peer leaves it, with <row> appended.
-a15_publish_row() {
-  git -C "$A15_PEER" fetch -q origin 2>/dev/null || :
-  a15_publish "lanes/LANES.md" "$(git -C "$A15_PEER" show origin/main:lanes/LANES.md)
-$1"
-}
-
-# ---- TWO PUBLISHED LOGS FOR ONE LANE ARE A REFUSAL, NOT A COIN TOSS ----------
-#
-# `log_path_ci` took the FIRST case-insensitive match and `lane_log_events` took
-# `head -n1` of the local scan, so a tree holding both `lanes/log/repoTwo-1.md`
-# and `lanes/log/repotwo-1.md` read as a tree holding one: every reader behind
-# them — the resume target, the profile, the directory, `lanes --lane` — decided
-# out of HALF an append-only history and said nothing, while the writer treats
-# the same state as ambiguous and refuses.
-a15_publish \
-  "lanes/log/repoTwo-1.md" "# lane repoTwo-1 — object log (lane-collision-protocol Amendment 7)
-STARTED — lane repoTwo-1, session $DEAD_ID@Eagle, $OLD_UTC, lane:repoTwo-1 → home opensoft/repoTwo; estate repoTwo" \
-  "lanes/log/repotwo-1.md" "# lane repotwo-1 — object log (lane-collision-protocol Amendment 7)
-CLAIMED — lane repotwo-1, session $DEAD_ID@Eagle, $OLD_UTC, opensoft/repoTwo#3"
-is   "the peer published two logs for one lane, differing only by case" \
-     "$(git -C "$WIP" ls-tree -r --name-only origin/main -- lanes/log | grep -ci '^lanes/log/repotwo-1\.md$' || :)" 2
-run "$E" lane-objects repotwo-1
-is   "a lane with two published logs is a REFUSAL and not an answer" "$rc" 2
-has  "…saying how many there are" "$err" "has 2 object logs on origin/main"
-has  "…naming the one spelled the row's way" "$err" "lanes/log/repoTwo-1.md"
-has  "…and the one spelled the other way, beside it" "$err" "lanes/log/repotwo-1.md"
-has  "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-run env LANES_LANE=repotwo-1 LANES_SESSION="$DEAD_ID" "$E" log PAUSED lane:repotwo-1 --no-github
-is   "…and a WRITE under that name is refused before it appends anything" "$rc" 2
-has  "…naming both files it will not choose between" "$err" "differ only by case"
-is   "…writing no log here" "$(ls "$LOGD" | grep -ci '^repotwo-1\.md$' || :)" 0
-# AND THE `SessionStart` HOOK, WHOSE RENAME TEST READS THIS LOG FOR THE BINDING
-# (#60). The read that failed was folded into "no binding", so a person's
-# rename to another lane — here made a day ago, BEFORE the STARTED the row's own
-# log carries — was called "newer than this window's binding". It names the
-# read now, and still types nothing over the person's own name.
-a15_hook_id="aaaa0060-0000-4000-8000-aaaa00600000"
-a15_save_win="${FAKE_TMUX_WINDOW-}"; a15_save_name="${FAKE_TMUX_WINDOW_NAME-}"; a15_save_wins="${FAKE_TMUX_WINDOWS-}"
-export FAKE_TMUX_WINDOW="gdsess:@12" FAKE_TMUX_WINDOW_NAME=repoTwo-1
-export FAKE_TMUX_WINDOWS="gdsess:0	@12	repoTwo-1	%12	claude"
-write_record_a12 "$sessions_dir/two.json" "$a15_hook_id" "$LIVE_PID" "$live_start" interactive "gdsess:@12.%12" \
-  repoLate-1 user "$(( gd_now_ms - 86400000 ))"
-gd_before="$(gd_keys)"
-out="$(printf '{"session_id":"%s","source":"resume","cwd":"%s/projects/repoGD"}' "$a15_hook_id" "$HOME" | "$E" session-start 2>/dev/null)"; rc=$?
-is    "the SessionStart hook still exits 0 on a lane whose log cannot be read" "$rc" 0
-has   "…naming that read" "$out" "lane repoTwo-1's object log could not be read"
-hasnt "…never calling a person's rename newer than a binding nobody read" "$out" "newer than this window's binding"
-is    "…and typing nothing over that name" "$(gd_keys)" "$gd_before"
-rm -f "$sessions_dir/two.json"
-if [ -n "$a15_save_wins" ]; then export FAKE_TMUX_WINDOWS="$a15_save_wins"; else unset FAKE_TMUX_WINDOWS; fi
-if [ -n "$a15_save_win" ]; then export FAKE_TMUX_WINDOW="$a15_save_win"; else unset FAKE_TMUX_WINDOW; fi
-if [ -n "$a15_save_name" ]; then export FAKE_TMUX_WINDOW_NAME="$a15_save_name"; else unset FAKE_TMUX_WINDOW_NAME; fi
-a15_unpublish "lanes/log/repoTwo-1.md" "lanes/log/repotwo-1.md"
-
-# ---- THE PAIR IS PUBLISHED AND THIS CHECKOUT HAS ONE ROW ---------------------
-#
-# `canon-lane` spends 2 on 15(d)'s pair AND on the unknown subcommand of a
-# helper predating this amendment, so all three commands carried on with the
-# name as typed — on the reading that each makes the refusal again out of its
-# own read of the register. That read is `$LANES_FILE`, THE WORKING TREE, and a
-# fetch does not move it: with the pair on `origin/main` and one row here, the
-# local scan passes and what was left was a `register-row` call with its stderr
-# suppressed, whose own 2 became a generic exit 1 naming neither spelling.
-LATE_ID="abcdef01-15dd-4000-8000-abcdef0115dd"
-a15_publish_row "| \`repolate-1\` | harness \`$LATE_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoLate/x.md | STARTING |"
-is   "the pair is on origin/main" \
-     "$(git -C "$WIP" show origin/main:lanes/LANES.md | grep -ci '^| `repolate-1` ' || :)" 2
-is   "…and this checkout's own copy still has exactly one of them" \
-     "$(grep -ci '^| `repolate-1` ' "$LANES" || :)" 1
-run "$E" canon-lane repolate-1
-is   "canon-lane refuses the PUBLISHED pair from a checkout that has one row" "$rc" 2
-: > "$FAKE_TMUX_LOG"
-run env FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="testsess:@1" FAKE_TMUX_WINDOW_INDEX=0 \
-    "$START" repolate 1 --no-launch
-is   "lane-start relays that refusal rather than spending a generic 1 on it" "$rc" 2
-has  "…naming the spelling that was typed" "$err" "repolate-1"
-has  "…and the one beside it" "$err" "repoLate-1"
-has  "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-hasnt "…never reporting the helper as broken, which it is not" "$err" "register-row repolate-1 failed"
-is   "…and renaming no window on the way" "$(grep -c 'repolate' "$FAKE_TMUX_LOG" || :)" 0
-run "$END" repolate-1
-is   "lane-end relays it too" "$rc" 2
-has  "…naming both spellings" "$err" "repoLate-1"
-has  "…and citing the merge" "$err" "Amendment 15(d)"
-run env -u TMUX "$LANE" repolate-1 </dev/null
-is   "and lane <name> relays it, instead of reporting the read as a failure" "$rc" 2
-has  "…naming both spellings" "$err" "repoLate-1"
-has  "…and citing the merge" "$err" "Amendment 15(d)"
-hasnt "…never calling that a helper failure" "$err" "register-row repolate-1 failed"
-
-# AND THE LOCAL SCAN IS STILL WHAT ANSWERS WHERE THE HELPER CANNOT. A helper
-# predating this amendment spends 2 on `canon-lane` as an unknown subcommand and
-# says nothing about any amendment, so the relay above must not fire for it —
-# and `lane-end`'s own row scan is then the whole of the refusal, which is what
-# it was written to be.
-A15_OLD="$SANDBOX/old-lanes-edit.sh"
-{ printf '#!/bin/sh\n'
-  printf 'printf "lanes-edit.sh: unknown subcommand '\''%%s'\''\\n" "$1" >&2\n'
-  printf 'exit 2\n'
-} > "$A15_OLD"
-chmod +x "$A15_OLD"
-run env LANES_EDIT="$A15_OLD" "$END" repopair-1
-is   "lane-end with a helper that predates canon-lane still refuses the pair" "$rc" 2
-has  "…out of its own read of the register, naming the typed spelling" "$err" "repopair-1"
-has  "…and the one beside it" "$err" "repoPair-1"
-has  "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-
-# ---- add-row ASKS THE PUBLISHED REGISTER, NOT ONLY THIS COPY OF IT -----------
-#
-# The case-duplicate refusal scanned `$LANES_FILE` alone, so a row `origin`
-# already carries is invisible on a checkout that is behind: `add-row` appends
-# the second spelling, `commit_push` rebases the first in underneath it, and the
-# pair 15(a) makes this command refuse is published by the command that refuses
-# it.
-a15_publish_row "| \`repoPush-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoPush/x.md | ACTIVE |"
-is   "the row is on origin/main and not in this checkout" \
-     "$(grep -ci '^| `repopush-1` ' "$LANES" || :)" 0
-run "$E" add-row "| \`repopush-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoPush/y.md | ACTIVE |"
-is   "add-row refuses a row the PUBLISHED register already carries under another case" "$rc" 2
-has  "…naming the row that is there, in its own spelling" "$err" "spelled repoPush-1"
-has  "…citing the clause that makes the two one lane" "$err" "Amendment 15(a)"
-has  "…and naming the one command that makes this checkout current" "$err" "pull --rebase"
-is   "…adding nothing" "$(grep -ci '^| `repopush-1` ' "$LANES" || :)" 0
-# AND IT STILL REFUSES A ROW ONLY THIS CHECKOUT HAS, which is the half the local
-# scan is there for: a row added here and not yet pushed is on no origin at all.
-run "$E" add-row "| \`REPOTWO-1\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoTwo/y.md | ACTIVE |"
-is   "…and a row this checkout has is still a row" "$rc" 2
-has  "…named in its own spelling" "$err" "spelled repoTwo-1"
-
-# ---- A RENAME WHOSE COMMIT NEVER LANDED IS STILL TWO LOGS -------------------
-#
-# `ensure_log`'s published-path guard ran only where this checkout had NO file
-# at all, so the state a failed rename leaves — the canonical file here, the
-# old-cased path still in the remote tree — walked past it, and the next write
-# staged the canonical path alone and left the published one where it was.
-a15_publish "lanes/log/repodrop-1.md" "# lane repodrop-1 — object log (lane-collision-protocol Amendment 7)
-STARTED — lane repoDrop-1, session $DEAD_ID@Eagle, $OLD_UTC, lane:repoDrop-1 → home opensoft/repoDrop; estate repoDrop"
-{ printf '# lane repoDrop-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoDrop-1, session %s@Eagle, %s, lane:repoDrop-1 → home opensoft/repoDrop; estate repoDrop\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repoDrop-1.md"
-run env LANES_LANE=repodrop-1 LANES_SESSION="$DEAD_ID" "$E" log PAUSED lane:repodrop-1 --no-github
-is   "a canonical file beside an old-cased PUBLISHED path is refused" "$rc" 2
-has  "…naming the path that is published" "$err" "published as lanes/log/repodrop-1.md"
-has  "…and saying which half of the rename landed" "$err" "rename whose commit never landed"
-has  "…with the one command that settles it" "$err" "pull --rebase"
-is   "…appending nothing to the file it would have split the lane across" \
-     "$(grep -c '^PAUSED' "$LOGD/repoDrop-1.md" || :)" 0
-rm -f -- "$LOGD/repoDrop-1.md"
-
-# ---- A LOG THIS CHECKOUT HAS AND ORIGIN DOES NOT IS STILL THIS LANE'S --------
-#
-# `claim` exempts its own log from the dirty-checkout refusal, and computes that
-# path with `log_path_ci` — whose fallback was the canonical path outright, a
-# path that need not exist. A lane whose log is still spelled the old way and
-# has never been pushed therefore had its OWN uncommitted log read as an
-# unrelated dirty file, and the claim was refused for it.
-{ printf '# lane repolocal-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoLocal-1, session %s@Eagle, %s, lane:repoLocal-1 → home opensoft/repoLocal; estate repoLocal\n' "$DEAD_ID" "$OLD_UTC"
-} > "$LOGD/repolocal-1.md"
-git -C "$WIP" add -- lanes/log/repolocal-1.md >/dev/null 2>&1
-git -C "$WIP" commit -q -m "LOG(repoLocal-1@Eagle): STARTED — committed here and pushed nowhere"
-printf 'RESUMED — lane repoLocal-1, session %s@Eagle, %s, lane:repoLocal-1 → home opensoft/repoLocal\n' "$DEAD_ID" "$OLD_UTC" >> "$LOGD/repolocal-1.md"
-is   "the lane's own log is dirty here and on no origin" \
-     "$(git -C "$WIP" status --porcelain -- lanes/log/repolocal-1.md | grep -c . || :)" 1
-run env LANES_LANE=repolocal-1 LANES_SESSION="$DEAD_ID" "$E" claim "opensoft/repoLocal#1" --no-github
-is   "a claim is not refused for its own log, written under the other case" "$rc" 0
-hasnt "…never reading that log as somebody else's uncommitted work" \
-      "$err" "refusing to claim on a checkout that cannot be rebased"
-is   "…and the log is the row's spelling afterwards" \
-     "$(ls "$LOGD" | grep -c '^repoLocal-1\.md$' || :)" 1
-
-# ---- A LANE NAME IS NOT A REGULAR EXPRESSION --------------------------------
-#
-# Every filter of these US-delimited holder rows handed the name straight to
-# `grep`: excluding THIS lane `repo.x-1` also excluded the real rival
-# `repoXx-1`, so the pre-check found the object free and the claim was taken
-# over a hold that is open.
-run env LANES_LANE=repo.x-1 LANES_SESSION="$DEAD_ID" "$E" claim "opensoft/repoDot#1" --no-github
-is   "a lane whose name contains '.' does not filter away the rival it matches" "$rc" 2
-has  "…naming the lane that actually holds the object" "$err" "lane repoXx-1 holds opensoft/repoDot#1"
-has  "…and citing Rule 1 rather than taking it" "$err" "the lane stops and reports"
-is   "…writing nothing to the would-be taker's log" \
-     "$(grep -c 'repoDot#1' "$LOGD/repo.x-1.md" || :)" 0
-
-# ---- AND `--dir` WITH A SPACE IN IT IS ONE ARGUMENT -------------------------
-#
-# Round 4 read the four `${lns_args[@]+"${lns_args[@]}"}` expansions in the
-# `lanes` block as unquoted and called a path with a space in it split. They are
-# the bash 3.2 idiom for an array that may be EMPTY under `set -u`, and the
-# quotes inside the `+word` half are honoured: the elements survive whole.
-# Asserted rather than argued — a split would reach `lanes_rows` as three
-# arguments and come back 64 with the usage line.
-run "$E" lanes --dir "$HOME/projects/a lane dir with spaces"
-hasnt "lanes --dir with a space in the path is not a usage error" "$err" "usage: lanes"
-hasnt "…and no word of it arrives as an argument of its own" "$err" "unknown argument"
-is    "…it is simply a directory no lane is in" "$rc" 8
-
-# ---- AND `--` IS NOT A DEFECT IN `ls` ON ANY PLATFORM THIS SHIPS TO ---------
-#
-# Round 3 read `ls -- "$LANES_LOG_DIR"` (`log_files_named_ci`) and its twin
-# `ls -- "$PROJECTS_ROOT"` (`lane-start`-s `projects_dir_matches`) as a macOS
-# failure — *"BSD `ls` rejects `--`, and the suppressed error makes every
-# case-insensitive log scan empty"* — under which no first write renames a log
-# on the one platform the rename exists for, and `<repo>` never resolves to the
-# checkout's real directory. It does not: BSD `ls` ends its options at `--`
-# through `getopt(3)` like every other POSIX utility, and the macOS job has been
-# green throughout on the two assertions that can only pass if both scans answer
-# there — the rename inside the write's own commit, and the `repo repocase →
-# repoCase` step line. Asserted here as well, directly and on every platform,
-# because a decline that is argued rather than measured is one the next round
-# makes again.
-is   "this platform's ls accepts the -- that both case-insensitive scans pass it" \
-     "$(ls -- "$LOGD" >/dev/null 2>&1; echo $?)" 0
-is   "…and lists exactly what the bare form lists, neither more nor fewer" \
-     "$(ls -- "$LOGD" 2>/dev/null | grep -c . || :)" "$(ls "$LOGD" 2>/dev/null | grep -c . || :)"
-has  "…including the log a lane's own scan has to find in it" \
-     "$(ls -- "$LOGD" 2>/dev/null)" "repoCase-1.md"
-
-# ---- THE RACE'S WINNER IS JOINED ON A FILE NAME, AND THE LINE SPELLS IT FREELY
-#
-# LAST IN THIS SECTION, because it is decided by an `origin/main` this checkout
-# must not have fetched yet. `first_landed_of` reads the pickaxe's oldest commit
-# that touched a rival's LOG FILE and joins that file's name against the holder
-# rows. The file carries the row's canonical spelling from the moment the first
-# write renames it (Amendment 15); the holder row carries whatever the winning
-# LINE was typed with, which an append-only log never rewrites. Byte for byte
-# the join missed the winner and the rescan fell back to the sorted-first
-# holder — a CLAIM-LOST naming the wrong lane, in the one read whose whole job
-# is to say who won.
-#
-# repoRace-2 LANDS FIRST and its CLAIMED spells the lane lowercase; repoRace-3
-# lands second and spells it the row's way. `LC_ALL=C` sorts `repoRace-3` above
-# `reporace-2`, so the fallback this defect reaches for names the wrong one.
-git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null || :
-{ printf '# lane repoRace-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED — lane reporace-2, session %s@Raven, %s, opensoft/repoRace#7\n' "$DEAD_ID" "$(utc_at -2M)"
-} > "$CLONE2/lanes/log/repoRace-2.md"
-git -C "$CLONE2" add -- lanes/log/repoRace-2.md
-git -C "$CLONE2" commit -q -m "LOG(repoRace-2@Raven): CLAIMED opensoft/repoRace#7"
-git -C "$CLONE2" push -q origin main
-{ printf '# lane repoRace-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'CLAIMED — lane repoRace-3, session %s@Raven, %s, opensoft/repoRace#7\n' "$DEAD_ID" "$(utc_at -1M)"
-} > "$CLONE2/lanes/log/repoRace-3.md"
-git -C "$CLONE2" add -- lanes/log/repoRace-3.md
-git -C "$CLONE2" commit -q -m "LOG(repoRace-3@Raven): CLAIMED opensoft/repoRace#7"
-git -C "$CLONE2" push -q origin main
-run env LANES_LANE=repoRace-1 LANES_NO_FETCH=1 LANES_SESSION="$DEAD_ID" "$E" claim "opensoft/repoRace#7" --no-github
-is   "a claim two rivals beat to main exits 7" "$rc" 7
-has  "…naming the one that LANDED first, whose own line spells it in another case" \
-     "$err" "@repoRace-2"
-hasnt "…and never the one that merely sorts first" "$err" "@repoRace-3"
-has  "…with the CLAIM-LOST line pointing at that winner" \
-     "$(cat "$LOGD/repoRace-1.md")" "opensoft/repoRace#7 → lane:repoRace-2"
-
-section "== Amendment 16: a lane is renamed by one word, in one commit =="
-
-# RATIFIED BY BRETT HEAP 2026-09-14T09:24:35Z, verbatim *"Ratify as drafted
-# (Recommended)"*, on his request of the same day, verbatim: *"we need the
-# ability to rename a lane. maybe lanes --rename <current lane name> <new lane
-# name>."* **A LANE IS RENAMED BY ONE WORD, IN ONE COMMIT, AND ITS OLD NAME
-# KEEPS RESOLVING FOR EVER.**
-#
-# WHAT IT COST TO LEARN: on 2026-09-14 two lanes renamed themselves BY HAND,
-# each as one `RENAMED` line appended to `LANES.md` with `append-line`. The
-# lines are honest and they are all there is — the rows still carried the old
-# keys, the logs and the handoffs the old names, and a reader of either lane's
-# history had to know the rename to follow it.
-#
-# THE CHECKOUT IS COMMITTED FIRST, for the reason the section above this one
-# gives in the same words: the cases before it leave the sandbox workspace dirty
-# on purpose, and a write that has to `pull --rebase` refuses on a checkout it
-# cannot rebase — which is those cases' subject and not this one's.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending edits before the Amendment 16 cases" >/dev/null 2>&1 || :
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main 2>/dev/null || :
-
-# THE FIXTURE IS A WHOLE LANE: a row, a log with a HELD object in it, and a
-# handoff named for the lane — because the act under test moves all three in one
-# commit, and a fixture missing any of them would leave a move untested.
-REN_ID="12ab34cd-16a1-4000-8000-12ab34cd16a1"
-RENH="$WIP/handoffs/repoRen"
-mkdir -p "$RENH"
-add_seed_row "| \`repoRen-1\` | harness \`$REN_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRen/session-handoff-2026-09-11-lane-repoRen-1.md | ACTIVE |"
-{ printf '# lane repoRen-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRen-1, session %s@Eagle, %s, lane:repoRen-1 → home opensoft/repoRen; estate repoRen\n' "$REN_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoRen-1, session %s@Eagle, %s, opensoft/repoRen#4\n' "$REN_ID" "$OLD_UTC"
-} > "$LOGD/repoRen-1.md"
-{ printf 'Lane: repoRen-1 (opensoft/team-05b, session %s) — single-use resume prompt\n' "$REN_ID"
-  printf '\n'
-  printf '## RESUME PROMPT — written %s\n' "$OLD_UTC"
-} > "$RENH/session-handoff-2026-09-11-lane-repoRen-1.md"
-# The row a rename INTO that name would collide with.
-add_seed_row "| \`repoRen-9\` | harness \`$DEAD_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRen/x.md | ACTIVE |"
-# A LANE A LIVE SESSION HOLDS, for clause (a)'s live-holder refusal and for the
-# one window that is exempt from it. Its recorded id is the suite's live one, so
-# `live_holder` finds a real record of a real process.
-add_seed_row "| \`repoRenL-1\` | harness \`$LIVE_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRen/live.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the Amendment 16 fixtures: a lane with a row, a held object, a handoff named for it, a collision row and a live-held lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# ------------------------------------------- clause (a): every refusal, FIRST
-#
-# EVERY ONE OF THEM MUST LEAVE THE CHECKOUT EXACTLY AS IT FOUND IT, and that is
-# the assertion under all of them: this command moves four files, and a
-# half-done rename is not something a second run can finish.
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoNope-1 repoNope-2 --no-github
-is   "a rename of a lane with no row is refused" "$rc" 2
-has  "…naming the absence, and the read that lists the rows there are" "$err" "no row for lane 'repoNope-1'"
-has  "…and saying nothing was written" "$err" "Nothing was written."
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-1 repoRen-9 --no-github
-is   "a rename into a name that already has a row is refused" "$rc" 2
-has  "…naming the row that is there" "$err" "lane 'repoRen-9' already has a row"
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-1 REPOREN-1 --no-github
-is   "a CASE-ONLY rename is refused: that is the row's own spelling" "$rc" 2
-has  "…and it names 15(d), which is the act that changes one" "$err" "Amendment 15(d)"
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-1 renamed_lane --no-github
-is   "a <new> that is not <repo>-<n> is refused" "$rc" 2
-has  "…naming what that form is computed for" "$err" "lane-start <repo> <n>"
-has  "…and the flag that means it" "$err" "--verbatim"
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRenL-1 repoRenL-2 --no-github
-is   "a rename while a LIVE session holds the lane in another window is refused" "$rc" 2
-has  "…naming that session" "$err" "$LIVE_ID"
-has  "…and the two ways out: its own window, or a handoff first" "$err" "lane-handoff"
-
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoPair-1 repoPairX-1 --no-github
-is   "two rows differing only by case refuse the rename" "$rc" 2
-has  "…with Amendment 15(d)'s merge, not a coin toss" "$err" "Amendment 15(d)"
-
-run env LANES_SESSION=not-a-uuid "$E" rename-lane repoRen-1 repoRen-4 --no-github
-is   "a session field that is not a transcript uuid is refused" "$rc" 2
-has  "…by the rule that owns it" "$err" "TRANSCRIPT UUID and only that"
-
-is   "…and NOT ONE of those refusals committed anything" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…nor moved the lane's log" "$( [ -f "$LOGD/repoRen-1.md" ] && echo yes )" "yes"
-is   "…nor its handoff" "$( [ -f "$RENH/session-handoff-2026-09-11-lane-repoRen-1.md" ] && echo yes )" "yes"
-is   "…nor created an alias table" "$( [ -e "$WIP/lanes/aliases.tsv" ] && echo yes || echo no )" "no"
-
-# ---- THE WINDOW THE COMMAND RUNS IN IS THE ONE EXEMPTION (clause (f)): a lane
-# renames ITSELF, and `live_holder`'s `here` verdict is what tells that apart.
-run env LANES_SESSION="$LIVE_ID" CLAUDE_CODE_SESSION_ID="$LIVE_ID" "$E" rename-lane repoRenL-1 repoRenL-2 --no-github
-is   "the same rename from the lane's OWN session is allowed" "$rc" 0
-is   "…and the row moved" "$(command grep -c '^| `repoRenL-2`' "$LANES")" 1
-
-# ------------------------------- clauses (b)–(e): the four moves, ONE commit
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-1 repoRen-4 "Brett Heap's word: shorten it" --no-github
-is   "the rename exits 0" "$rc" 0
-is   "…(b) the row's key cell is the new name" "$(command grep -c '^| `repoRen-4`' "$LANES")" 1
-# THE ROW ITSELF, TAKEN ONCE. A `\`` inside the SINGLE-QUOTED pattern of a
-# `$( )` is a literal BACKSLASH to grep — the quotes have already made the
-# backtick literal — and the pattern then matches nothing at all, which reads in
-# a failure as "the cell is empty" rather than as "this test asked the wrong
-# question".
-ren_row="$(command grep '^| `repoRen-4`' "$LANES")"
-has  "…with the ex-name and the instant beside it, the form the register already uses" \
-     "$ren_row" "*(ex \`repoRen-1\`, renamed 20"
-is   "…and no row is left under the old name" "$(command grep -c '^| `repoRen-1`' "$LANES")" 0
-has  "…the session cell keeping its whole history (Amendment 6(b))" \
-     "$ren_row" "harness \`$REN_ID\`"
-is   "…(c) the object log moved to the new name" \
-     "$( [ -f "$LOGD/repoRen-4.md" ] && [ ! -e "$LOGD/repoRen-1.md" ] && echo yes )" "yes"
-has  "…and gained a RENAMED line under the new name" "$(tail -n1 "$LOGD/repoRen-4.md")" "RENAMED — lane repoRen-4, session $REN_ID@$WS_S,"
-has  "…whose payload is lane:<new> ← lane:<old>, with the why the person gave" \
-     "$(tail -n1 "$LOGD/repoRen-4.md")" ", lane:repoRen-4 ← lane:repoRen-1 — Brett Heap's word: shorten it"
-has  "…while the lines ABOVE it are never rewritten and still say the old name" \
-     "$(cat "$LOGD/repoRen-4.md")" "CLAIMED — lane repoRen-1,"
-is   "…(d) the handoff moved to the same date with lane-<new>" \
-     "$( [ -f "$RENH/session-handoff-2026-09-11-lane-repoRen-4.md" ] && [ ! -e "$RENH/session-handoff-2026-09-11-lane-repoRen-1.md" ] && echo yes )" "yes"
-has  "…and gained its Rule 3 stamp under the header block" \
-     "$(cat "$RENH/session-handoff-2026-09-11-lane-repoRen-4.md")" "RENAMED from repoRen-1 by $REN_ID (lane repoRen-4) at 20"
-is   "…with the stamp SPLICED in: the file's own first line is untouched" \
-     "$(head -n1 "$RENH/session-handoff-2026-09-11-lane-repoRen-4.md")" \
-     "Lane: repoRen-1 (opensoft/team-05b, session $REN_ID) — single-use resume prompt"
-has  "…and the row's handoff column following the file" \
-     "$ren_row" "handoffs/repoRen/session-handoff-2026-09-11-lane-repoRen-4.md"
-has  "…(e) lanes/aliases.tsv gained <old> <new> <UTC>" \
-     "$(cat "$WIP/lanes/aliases.tsv")" "$(printf 'repoRen-1\trepoRen-4\t20')"
-
-ren_show="$(git -C "$WIP" show --name-only --format=%s HEAD)"
-has  "…and all four are in ONE commit, whose subject names the act" "$ren_show" "RENAMED lane repoRen-1 → repoRen-4"
-has  "…carrying the register" "$ren_show" "lanes/LANES.md"
-has  "…the log at its new name" "$ren_show" "lanes/log/repoRen-4.md"
-has  "…the handoff at its new name" "$ren_show" "handoffs/repoRen/session-handoff-2026-09-11-lane-repoRen-4.md"
-has  "…and the alias table" "$ren_show" "lanes/aliases.tsv"
-is   "…ONE commit and not four" "$(git -C "$WIP" rev-list --count "$ren_before..HEAD")" 1
-is   "…and it is pushed" "$(git -C "$WIP" rev-parse HEAD)" "$(git -C "$WIP" rev-parse origin/main)"
-hasnt "…--no-github reached no GitHub surface at all" "$err" "comment posted"
-
-# ------------------ clause (e): the old name resolves, in every reader at once
-run "$E" canon-lane repoRen-1
-is   "canon-lane answers the NEW name for the old one" "$out" "repoRen-4"
-has  "…and SAYS it resolved a former name" "$err" "is a FORMER name of lane repoRen-4"
-
-run "$E" who --lane repoRen-1
-is   "who --lane <old> answers for the lane it is now" "$rc" 0
-has  "…reporting the hold whose own log line still spells the old name" "$out" "opensoft/repoRen#4"
-
-run "$E" lane-objects repoRen-1
-has  "lane-objects <old> reads the renamed log" "$out" "opensoft/repoRen#4"
-
-run "$E" register-row repoRen-1
-has  "register-row <old> answers with the row that is there now" "$out" "\`repoRen-4\`"
-
-run "$E" who "opensoft/repoRen#4"
-has  "the object's holder is reported under the lane's CURRENT name" "$out" "repoRen-4"
-hasnt "…and never under the name its own line was written with" "$out" "lane repoRen-1 "
-
-run "$E" live-holder repoRen-1
-is   "live-holder <old> reads the new row and answers 8, not 'no such lane'" "$rc" 8
-
-# THE SessionStart BLOCK IS NAMED IN CLAUSE (e)'s OWN LIST, and it is the read
-# that orients a session which has just come up in a window nobody renamed.
-ss_save_name="${FAKE_TMUX_WINDOW_NAME-}"
-export FAKE_TMUX_WINDOW_NAME=repoRen-1
-ss_run "$REN_ID" resume
-is    "the SessionStart block exits 0 for a window carrying the lane's FORMER name" "$rc" 0
-has   "…orienting the session to the lane it is now" "$out" "LANE repoRen-4"
-hasnt "…and never telling a bound lane that nothing binds its window" "$out" "no lane bound to this window"
-has   "…with the hold it still has, under the object's own key" "$out" "open: CLAIMED opensoft/repoRen#4"
-export FAKE_TMUX_WINDOW_NAME="$ss_save_name"
-
-run "$E" lanes --all
-has  "the listing carries the lane under its new name" "$out" "repoRen-4"
-is   "…exactly once, and not as two lanes" "$(printf '%s\n' "$out" | command grep -c 'repoRen-4')" 1
-
-run env LANES_SESSION="$REN_ID" "$E" append-line "LANDING — lane repoRen-1, session $REN_ID@$WS_S, $(utc_at -1M), PR #4 into opensoft/repoRen main"
-is   "a Rule 6 line naming the OLD lane is appended" "$rc" 0
-has  "…and ATTRIBUTED to the lane it is now" "$(git -C "$WIP" log --oneline -1)" "LANES(repoRen-4@$WS_S): append line"
-
-# ---------------------------------------------- a chain resolves to its end
-# AND THE LANE'S LIFECYCLE SNAPSHOT GOES WITH IT (openRepoTools#91): the control
-# root is keyed by the lane's name, so a rename that left it behind would leave
-# the renamed lane reading `no-state` — the answer a launcher goes past.
-run env LANES_NO_FETCH=1 "$E" set-lane-state repoRen-4 RUNNING --expect none --owner "$REN_ID"
-is   "a lane about to be renamed records a lifecycle snapshot" "$rc" 0
-ren_snap_old="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "operation" { print $2 }')"
-run "$E" lane-state repoRen-4
-ren_snap_file="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "file" { print $2 }')"
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-4 repoRen-7 "again" --no-github
-is   "a second rename of the same lane exits 0" "$rc" 0
-has  "…saying the lifecycle snapshot moved with it" "$err" "moved with the rename"
-run "$E" lane-state repoRen-7
-is   "…and the NEW name reads the same snapshot" \
-     "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "operation" { print $2 }')" "$ren_snap_old"
-has  "…from a control root under the new name" \
-     "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "file" { print $2 }')" "/repoRen-7/lane-state.yaml"
-is   "…and nothing is left under the old one" \
-     "$( [ -e "$ren_snap_file" ] && echo left || echo moved )" "moved"
-run "$E" canon-lane repoRen-1
-is   "…and the FIRST name resolves through the chain to its end" "$out" "repoRen-7"
-run "$E" canon-lane repoRen-4
-is   "…as does the middle one" "$out" "repoRen-7"
-run "$E" who --lane repoRen-1
-has  "…and the hold is still found under the oldest name of all" "$out" "opensoft/repoRen#4"
-
-# ---------------------------- renaming BACK into its own chain is refused, and
-# a cycle in the table is refused at write time
-#
-# THE TWO REFUSALS OVERLAP ON PURPOSE. Every name on a chain is an alias KEY, so
-# the key refusal (Copilot round 1) is the one a rename back meets first — and
-# it is the broader rule: a row under a former name would end that name
-# resolving whether or not the chain closes. The cycle test behind it is what
-# still answers for a table somebody edited by hand, which is the only other way
-# one can arrive.
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN_ID" "$E" rename-lane repoRen-7 repoRen-1 --no-github
-is   "renaming back to a name in its own chain is refused" "$rc" 2
-has  "…because a row under a former name would end that name resolving" "$err" "already a FORMER name"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-
-# ---- A CYCLE PUT THERE BY HAND IS READ AS NO ANSWER, NOT AS A LANE.
-ren_cyc="$SANDBOX/aliases-cycle.tsv"
-{ printf '# a table somebody edited by hand\n'
-  printf 'cycA-1\tcycB-1\t2026-09-15T00:00:00Z\n'
-  printf 'cycB-1\tcycA-1\t2026-09-15T00:00:01Z\n'
-} > "$ren_cyc"
-run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_cyc" LANES_ALIASES_PATH=lanes/aliases-cycle.tsv "$E" canon-lane cycA-1
-is   "a hand-written CYCLE answers the name exactly as typed" "$out" "cycA-1"
-has  "…and says the table names no lane at all" "$err" "CYCLE"
-
-# --------------------------------- the verb: a lane kind that changes no state
-run env LANES_LANE=repoRen-7 LANES_SESSION="$REN_ID" "$E" log RENAMED "lane:repoRen-7" --no-github
-is   "a RENAMED written by hand is refused" "$rc" 2
-has  "…naming the one word that writes it" "$err" "lane-rename"
-run env LANES_LANE=repoRen-7 LANES_SESSION="$REN_ID" "$E" log PAUSED "lane:repoRen-7" → "swap; window rensess:0; workstation Eagle" --no-github
-is   "the lane's own PAUSED still writes" "$rc" 0
-run "$E" lane-last repoRen-7
-has  "…and the RENAMED above it is skipped by the last-lane-kind-line read" "$out" "PAUSED"
-run "$E" swapped Eagle
-has  "…so a renamed lane that has since PAUSED still reads as swapped" "$out" "repoRen-7"
-
-# --------------------------------------- clause (h): `lanes` stays read-only
-run "$OPENREPOTOOLS_BIN_DIR/lanes" --rename repoRen-7 repoRen-8
-is   "lanes --rename is refused" "$rc" 64
-has  "…naming the one word to type, filled in" "$err" "lane-rename repoRen-7 repoRen-8"
-has  "…and saying why it is not an option of this command" "$err" "writes nothing"
-
-# ------------- clause (f): the guard finishes a window that carries the old name
-#
-# THE FIXTURE IS CAPTURED AND PUT BACK, exactly as the Amendment 12 section
-# above does and for its reason: this section sits between two others in one
-# long file, and a section that left the sandbox's window table changed would be
-# changing the premise of every case after it from a distance.
-A16_SAVE_WINDOWS="${FAKE_TMUX_WINDOWS-}"
-A16_SAVE_WINDOW="${FAKE_TMUX_WINDOW-}"
-A16_SAVE_NAME="${FAKE_TMUX_WINDOW_NAME-}"
-export FAKE_TMUX_WINDOW="rensess:@16"
-export FAKE_TMUX_WINDOW_NAME=repoRen-1
-export FAKE_TMUX_WINDOWS="$(printf 'rensess:0\t@16\trepoRen-1\t%%16\tclaude')"
-write_record_a12 "$sessions_dir/a16.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@16.%16" "repoRen-1" user "$GD_OLD_MS"
-a16_keys="$(command grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-a16_ren="$(command grep -c 'rename-window' "$FAKE_TMUX_LOG" || :)"
-out="$(printf '{"session_id":"%s","cwd":"%s/projects/repoRen","prompt":"do the work","hook_event_name":"UserPromptSubmit"}' "$REN_ID" "$HOME" | "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is   "a window still carrying the lane's FORMER name does not read as 'no lane'" "$rc" 2
-hasnt "…so the guard never sends a running lane to bind a row it already has" "$err" "lane-start --no-launch"
-has  "…the triple naming the window as a former name of the lane" "$err" "a former name of repoRen-7"
-has  "…and the guard renames the WINDOW itself, which needs nobody" "$err" "it has been renamed to repoRen-7 for you"
-is   "…as one tmux call" "$(command grep -c 'rename-window repoRen-7' "$FAKE_TMUX_LOG" || :)" 1
-has  "…while the SESSION's name is typed, which is the only path it has" "$(cat "$FAKE_TMUX_LOG")" "send-keys -t %16 /rename repoRen-7"
-# ---- AND IT IS THE LOCK, NOT THE THREE-CHOICE OFFER (openRepoTools#87, merged
-# here). #87 made every mismatch wider than CASE a question for a person; a
-# FORMER name of THIS lane is not one, because clause (e) has already made it
-# this lane — and of the three answers, `1` would make the old name permanent
-# and `2` would move the lane back to the name it was renamed away from.
-hasnt "…and it is never put to the person as a choice" "$err" "explicitly allow this lane"
-hasnt "…nor offered as a lane to move to" "$err" "adjust the lane to session"
-has   "…because clause (e) already settled it" "$err" "FORMER name of lane repoRen-7"
-rm -f "$sessions_dir/a16.json"
-
-# ---------------------------------- the word: `lane-rename` on PATH (clause (f))
-REN2_ID="12ab34cd-16a2-4000-8000-12ab34cd16a2"
-add_seed_row "| \`repoRenW-1\` | harness \`$REN2_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoRen/w.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the lane-rename word's own lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-RENAME="$OPENREPOTOOLS_BIN_DIR/lane-rename"
-
-export FAKE_TMUX_WINDOW_NAME=some-other-window
-run env LANES_SESSION="$REN2_ID" "$RENAME" repoRenW-1 repoRenW-2 --no-github
-is   "lane-rename from another window still renames the lane" "$rc" 0
-has  "…and says the window and the session are the lane's own to fix" "$out" "tmux rename-window repoRenW-2"
-has  "…naming the guard as what does it at the lane's next prompt" "$out" "/rename repoRenW-2"
-
-export FAKE_TMUX_WINDOW="rensess:@17"
-export FAKE_TMUX_WINDOW_NAME=repoRenW-2
-export FAKE_TMUX_WINDOWS="$(printf 'rensess:0\t@17\trepoRenW-2\t%%17\tclaude')"
-write_record_a12 "$sessions_dir/a16w.json" "$REN2_ID" "$LIVE_PID" "$live_start" interactive "rensess:@17.%17" "repoRenW-2" user "$GD_OLD_MS"
-: > "$FAKE_TMUX_LOG"
-run env LANES_SESSION="$REN2_ID" CLAUDE_CODE_SESSION_ID="$REN2_ID" "$RENAME" repoRenW-2 repoRenW-3 --no-github
-is   "lane-rename in the lane's OWN window exits 0" "$rc" 0
-is   "…renaming the window in the same breath" "$(command grep -c 'rename-window repoRenW-3' "$FAKE_TMUX_LOG" || :)" 1
-has  "…and typing the one line a running session's name can only take that way" \
-     "$(cat "$FAKE_TMUX_LOG")" "send-keys -t %17 /rename repoRenW-3"
-rm -f "$sessions_dir/a16w.json"
-
-run env LANES_SESSION="$REN2_ID" "$RENAME" repoRenW-3
-is   "lane-rename with one argument is a usage refusal" "$rc" 2
-run env LANES_SESSION="$REN2_ID" "$RENAME" repoRenW-3 repoRenW-9 --nonsense
-is   "…as is an option it does not know" "$rc" 2
-
-
-# ============ Copilot round 1 on openRepoTools#81: the states it found ========
-
-# ---- A `<new>` THAT IS ALREADY AN ALIAS KEY IS REFUSED.
-#
-# A row wins over an alias at every hop, so minting a row under a name some
-# other lane was renamed AWAY from would END that lane's old name resolving —
-# the one thing clause (e) promises never happens.
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN2_ID" "$E" rename-lane repoRenW-3 repoRen-1 --no-github
-is   "renaming INTO a name that is already an alias key is refused" "$rc" 2
-has  "…because a row under it would end that lane's old name resolving" "$err" "already a FORMER name"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-
-# ---- A ROW WINS OVER AN ALIAS AT EVERY HOP, NOT ONLY AT THE START.
-#
-# `repoRen-1` was renamed away, so the NAME is free and a lane may legitimately
-# be created under it again — which `lane_next_free` will hand out. Read through
-# the chain's END that lane's own log lines would be remapped on to repoRen-7,
-# whose holds are somebody else's.
-REN3_ID="12ab34cd-16a3-4000-8000-12ab34cd16a3"
-add_seed_row "| \`repoRen-1\` | harness \`$REN3_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoRen/again.md | ACTIVE |"
-{ printf '# lane repoRen-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRen-1, session %s@Eagle, %s, lane:repoRen-1 → home opensoft/repoRen; estate repoRen\n' "$REN3_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoRen-1, session %s@Eagle, %s, opensoft/repoRen#12\n' "$REN3_ID" "$OLD_UTC"
-} > "$LOGD/repoRen-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a NEW lane under a name that is already an alias key"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-run "$E" canon-lane repoRen-1
-is    "a name that is an alias key AND a row again answers the ROW" "$out" "repoRen-1"
-hasnt "…without claiming it resolved a former name" "$err" "FORMER name"
-run "$E" who --lane repoRen-1
-has   "…and that lane's own holds are its own" "$out" "opensoft/repoRen#12"
-hasnt "…never the holds of the lane that used to have the name" "$out" "opensoft/repoRen#4"
-run "$E" who --lane repoRen-7
-has   "…while the renamed lane keeps its own, read under its current name" "$out" "opensoft/repoRen#4"
-hasnt "…and does not collect the new lane's" "$out" "opensoft/repoRen#12"
-
-# ---- A CASE-VARIANT LOG FOR `<new>` IS FOUND AND REFUSED.
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-printf '# lane REPOREN-20 — object log\n' > "$LOGD/REPOREN-20.md"
-run env LANES_SESSION="$REN3_ID" "$E" rename-lane repoRen-1 repoRen-20 --no-github
-is   "a rename into a name whose log exists under ANOTHER CASE is refused" "$rc" 2
-has  "…naming the file that is there" "$err" "REPOREN-20.md"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-rm -f "$LOGD/REPOREN-20.md"
-
-# ---- A HANDOFF OUTSIDE THE WORKSPACE REPOSITORY IS REFUSED, NOT NOTED.
-#
-# Four moves in ONE commit cannot carry a file outside the checkout the commit
-# is made in, so a row naming one is refused before anything is written.
-REN4_ID="12ab34cd-16a4-4000-8000-12ab34cd16a4"
-mkdir -p "$SANDBOX/outside"
-printf 'Lane: repoOut-1 — single-use resume prompt\n\n## RESUME\n' > "$SANDBOX/outside/h.md"
-add_seed_row "| \`repoOut-1\` | harness \`$REN4_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | $SANDBOX/outside/h.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose handoff is outside the workspace repository"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN4_ID" "$E" rename-lane repoOut-1 repoOut-2 --no-github
-is   "a handoff outside the workspace repository is refused" "$rc" 2
-has  "…saying a commit cannot carry it" "$err" "outside the workspace repository"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…the row still under its own name" "$(command grep -c '^| `repoOut-1`' "$LANES")" 1
-
-# ---- A WRITE THAT FAILS PART-WAY IS ROLLED BACK, NOT LEFT HALF-RENAMED.
-#
-# The handoff is made UNWRITABLE, so Rule 3's stamp cannot land — the failure
-# that used to leave the log moved, its RENAMED line appended and the rename
-# committed anyway.
-REN5_ID="12ab34cd-16a5-4000-8000-12ab34cd16a5"
-mkdir -p "$WIP/handoffs/repoRoll"
-printf 'Lane: repoRoll-1 — single-use resume prompt\n\n## RESUME\n' > "$WIP/handoffs/repoRoll/session-handoff-2026-09-12-lane-repoRoll-1.md"
-add_seed_row "| \`repoRoll-1\` | harness \`$REN5_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoRoll/session-handoff-2026-09-12-lane-repoRoll-1.md | ACTIVE |"
-{ printf '# lane repoRoll-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRoll-1, session %s@Eagle, %s, lane:repoRoll-1 → home opensoft/repoRoll; estate repoRoll\n' "$REN5_ID" "$OLD_UTC"
-} > "$LOGD/repoRoll-1.md"
-git -C "$WIP" add -A -- lanes handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the rollback lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-roll_log_before="$(cat "$LOGD/repoRoll-1.md")"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-chmod 0444 "$WIP/handoffs/repoRoll/session-handoff-2026-09-12-lane-repoRoll-1.md"
-chmod 0555 "$WIP/handoffs/repoRoll"
-run env LANES_SESSION="$REN5_ID" "$E" rename-lane repoRoll-1 repoRoll-2 --no-github
-chmod 0755 "$WIP/handoffs/repoRoll"
-chmod 0644 "$WIP/handoffs/repoRoll"/*.md 2>/dev/null || :
-if [ "$rc" = 0 ]; then
-  skip "a handoff that cannot take its stamp refuses and rolls back" "this filesystem let the write through (running as a user that ignores the mode)"
-else
-  is   "a handoff that cannot take its Rule 3 stamp refuses" "$rc" 5
-  is   "…rolling the object log back to where it was" "$(cat "$LOGD/repoRoll-1.md" 2>/dev/null)" "$roll_log_before"
-  is   "…leaving no log under the new name" "$( [ -e "$LOGD/repoRoll-2.md" ] && echo yes || echo no )" "no"
-  is   "…the handoff still at its own path" "$( [ -f "$WIP/handoffs/repoRoll/session-handoff-2026-09-12-lane-repoRoll-1.md" ] && echo yes )" "yes"
-  is   "…and nothing committed" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-  is   "…with the row untouched" "$(command grep -c '^| `repoRoll-1`' "$LANES")" 1
-  has  "…and it says the rename was rolled back" "$err" "rolled back"
-fi
-git -C "$WIP" checkout -- lanes handoffs 2>/dev/null || :
-
-# ---- AN UNREADABLE ALIAS TABLE FAILS CLOSED RATHER THAN READING AS EMPTY.
-#
-# POINTED AT A PATH `origin` DOES NOT CARRY, because the published copy is a git
-# OBJECT and no mode on the working tree can stop `git show` reading it — which
-# is the right answer for a checkout whose file is merely unreadable, and the
-# wrong fixture for the question asked here.
-ren_unread="$WIP/lanes/aliases-unreadable.tsv"
-printf 'someLane-1\tsomeLane-2\t2026-09-15T00:00:00Z\n' > "$ren_unread"
-chmod 0000 "$ren_unread"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_NO_FETCH=1 LANES_SESSION="$REN3_ID" \
-    LANES_ALIASES_TSV="$ren_unread" LANES_ALIASES_PATH=lanes/aliases-unreadable.tsv \
-    "$E" rename-lane repoRen-1 repoRen-21 --no-github
-if [ "$rc" = 0 ]; then
-  skip "an unreadable alias table refuses the write" "this filesystem let the read through (running as a user that ignores the mode)"
-else
-  is    "an alias table that cannot be READ refuses the write" "$rc" 1
-  has   "…rather than reading as an estate with no renames" "$err" "could not be read"
-  has   "…naming the table and the read that failed" \
-        "$err" "aliases-unreadable.tsv is there and could not be read"
-  hasnt "…and never 'unknown error', which is what a reason lost to a subshell said" \
-        "$err" "unknown error"
-  is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-fi
-chmod 0644 "$ren_unread"; rm -f "$ren_unread"
-
-# ---- THE WORD'S REPAIR RUN: the write has landed, the window has not.
-export FAKE_TMUX_WINDOW="rensess:@18"
-export FAKE_TMUX_WINDOW_NAME=repoRenW-2
-export FAKE_TMUX_WINDOWS="$(printf 'rensess:0\t@18\trepoRenW-2\t%%18\tclaude')"
-: > "$FAKE_TMUX_LOG"
-run env LANES_SESSION="$REN2_ID" "$RENAME" repoRenW-2 repoRenW-3 --no-github
-is   "re-running the word after the write has landed exits 0" "$rc" 0
-has  "…saying the rename itself is already done" "$err" "already landed"
-is   "…and doing the half that is left: the window" "$(command grep -c 'rename-window repoRenW-3' "$FAKE_TMUX_LOG" || :)" 1
-
-
-# ============ Copilot round 3 on openRepoTools#81 ============================
-
-# ---- AN UNREADABLE ALIAS TABLE REFUSES THE READERS TOO, not only the writes.
-#
-# `canon_lane`'s answer is what `lane-start` decides "is this lane new" by, so
-# carrying on with the typed spelling is not a read-only shrug: a renamed lane
-# would read as new and get a SECOND row.
-ren_unread2="$WIP/lanes/aliases-unread2.tsv"
-printf 'someLane-1\tsomeLane-2\t2026-09-15T00:00:00Z\n' > "$ren_unread2"
-chmod 0000 "$ren_unread2"
-run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_unread2" LANES_ALIASES_PATH=lanes/aliases-unread2.tsv \
-    "$E" canon-lane repoRen-4
-if [ "$rc" = 0 ]; then
-  skip "canon-lane refuses on an alias table it cannot read" "this filesystem let the read through"
-else
-  is    "canon-lane REFUSES on an alias table it cannot read" "$rc" 66
-  has   "…rather than answering the typed spelling" "$err" "NOT established"
-  hasnt "…and answers nothing at all" "$out" "repoRen"
-fi
-
-# ---- AND THE NAME GUARD REFUSES THE PROMPT ON IT (clause (d) is fail closed).
-gd_save_w="${FAKE_TMUX_WINDOW-}"; gd_save_n="${FAKE_TMUX_WINDOW_NAME-}"; gd_save_ws="${FAKE_TMUX_WINDOWS-}"
-# THE WINDOW CARRIES A NAME WITH NO ROW, which is what makes the guard ASK the
-# alias table at all: `repoRen-4` is a middle name of this lane's chain, so a
-# name that does have a row would be answered by the register alone and this
-# case would prove nothing.
-export FAKE_TMUX_WINDOW="rensess:@19"
-export FAKE_TMUX_WINDOW_NAME=repoRen-4
-export FAKE_TMUX_WINDOWS="$(printf 'rensess:0\t@19\trepoRen-4\t%%19\tclaude')"
-write_record_a12 "$sessions_dir/a16g.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@19.%19" "repoRen-4" user "$GD_OLD_MS"
-out="$(printf '{"session_id":"%s","cwd":"%s/projects/repoRen","prompt":"do the work","hook_event_name":"UserPromptSubmit"}' "$REN_ID" "$HOME" \
-      | env LANES_ALIASES_TSV="$ren_unread2" LANES_ALIASES_PATH=lanes/aliases-unread2.tsv "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-if [ "$rc" = 0 ]; then
-  skip "the guard refuses a prompt on an alias table it cannot read" "this filesystem let the read through"
-else
-  is    "the guard REFUSES the prompt on an alias table it cannot read" "$rc" 2
-  has   "…because a triple that cannot be verified is not a triple that agrees" "$err" "could not be read"
-  hasnt "…and never sends a running lane to bind a row it already has" "$err" "lane-start --no-launch"
-fi
-rm -f "$sessions_dir/a16g.json"
-export FAKE_TMUX_WINDOW="$gd_save_w"; export FAKE_TMUX_WINDOW_NAME="$gd_save_n"; export FAKE_TMUX_WINDOWS="$gd_save_ws"
-chmod 0644 "$ren_unread2"; rm -f "$ren_unread2"
-
-# ---- A HANDOFF PATH THAT EXISTS AND IS NOT A REGULAR FILE IS REFUSED.
-REN6_ID="12ab34cd-16a6-4000-8000-12ab34cd16a6"
-mkdir -p "$WIP/handoffs/repoKind/session-handoff-2026-09-12-lane-repoKind-1.md"
-add_seed_row "| \`repoKind-1\` | harness \`$REN6_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoKind/session-handoff-2026-09-12-lane-repoKind-1.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose handoff path is a directory"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN6_ID" "$E" rename-lane repoKind-1 repoKind-2 --no-github
-is   "a handoff path that is a DIRECTORY is refused, not read as absent" "$rc" 2
-has  "…saying what it found there" "$err" "is not a regular file"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-rmdir "$WIP/handoffs/repoKind/session-handoff-2026-09-12-lane-repoKind-1.md"
-
-# ---- AN ALIAS TABLE PUBLISHED AND NOT PULLED IS REFUSED, NOT OVERWRITTEN.
-rm -f "$WIP/lanes/aliases.tsv"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN6_ID" "$E" rename-lane repoKind-1 repoKind-2 --no-github
-is   "an alias table origin carries and this checkout does not is refused" "$rc" 2
-has  "…because appending here would drop every alias already published" "$err" "drop every alias already published"
-has  "…and it names the pull" "$err" "pull --rebase"
-is   "…with nothing written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-git -C "$WIP" checkout -- lanes/aliases.tsv
-
-# ---- THE LANE'S OWN SESSION KEEPS ITS FORMER NAME UNTIL ITS NEXT PROMPT,
-# AND IS STILL ITS HOLDER (Amendment 16(e) meeting Amendment 8's explicit-name
-# rule). Without this the rename's own window loses the `/rename` clause (f)
-# gives it, and `who` calls a running lane NOT LIVE.
-# `repoRen-4`, NOT `repoRen-1`: the first name of this chain is a row again —
-# a different lane — so a session named for it IS another lane's, which is the
-# case below. `repoRen-4` is the middle name and belongs to nobody else.
-write_record_a12 "$sessions_dir/a16h.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@20.%20" "repoRen-4" user "$GD_OLD_MS"
-run "$E" live-holder repoRen-7
-is   "a live session still named for the lane's FORMER name is its holder" "$rc" 0
-has  "…named as the session it is" "$out" "$REN_ID"
-rm -f "$sessions_dir/a16h.json"
-
-# ---- AND A FORMER NAME THAT IS A ROW AGAIN IS ANOTHER LANE (the row wins).
-write_record_a12 "$sessions_dir/a16j.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@20.%20" "repoRen-1" user "$GD_OLD_MS"
-run "$E" live-holder repoRen-7
-is   "…while a former name somebody has since taken as a LANE is not this one" "$rc" 8
-rm -f "$sessions_dir/a16j.json"
-
-# ---- AND A SESSION A PERSON NAMED FOR ANOTHER LANE IS STILL NOT (Amendment 8).
-write_record_a12 "$sessions_dir/a16i.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@20.%20" "repoD-2" user "$GD_OLD_MS"
-run "$E" live-holder repoRen-7
-is   "…while a session named for a DIFFERENT lane is not a holder, as before" "$rc" 8
-rm -f "$sessions_dir/a16i.json"
-
-
-# ============ Copilot round 4 on openRepoTools#81 ============================
-
-# ---- THE ALIAS-READ REFUSAL HAS ITS OWN EXIT CODE, because 2 already carries
-# two meanings to the commands that read `canon-lane`.
-ren_unread3="$WIP/lanes/aliases-unread3.tsv"
-printf 'someLane-1\tsomeLane-2\t2026-09-15T00:00:00Z\n' > "$ren_unread3"
-chmod 0000 "$ren_unread3"
-run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_unread3" LANES_ALIASES_PATH=lanes/aliases-unread3.tsv \
-    "$E" canon-lane repoRen-4
-if [ "$rc" = 0 ]; then
-  skip "canon-lane spends EX_NOINPUT on a table it cannot read" "this filesystem let the read through"
-else
-  is   "canon-lane spends 66 (EX_NOINPUT) on a table it cannot read, never 2" "$rc" 66
-  # ---- AND live-holder FAILS CLOSED ON IT rather than answering 'no holder'.
-  write_record_a12 "$sessions_dir/a16k.json" "$REN_ID" "$LIVE_PID" "$live_start" interactive "rensess:@21.%21" "repoRen-4" user "$GD_OLD_MS"
-  run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_unread3" LANES_ALIASES_PATH=lanes/aliases-unread3.tsv \
-      "$E" live-holder repoRen-7
-  is   "live-holder fails CLOSED on a table it cannot read" "$rc" 1
-  hasnt "…rather than answering 8, which reads as 'no live session holds it'" "$rc" 8
-  has  "…naming the read that could not be made" "$err" "could not be read"
-  rm -f "$sessions_dir/a16k.json"
-  # ---- AND lane-start REFUSES rather than adding a second row.
-  mkdir -p "$HOME/projects/repoRen"
-  run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_unread3" LANES_ALIASES_PATH=lanes/aliases-unread3.tsv \
-      "$START" --no-launch --dir "$HOME/projects/repoRen" repoRen-4
-  is   "lane-start REFUSES a name it cannot resolve through the alias table" "$rc" 2
-  has  "…saying it would add a second row for a lane that is running" "$err" "second row"
-fi
-chmod 0644 "$ren_unread3"; rm -f "$ren_unread3"
-
-# ---- A SYMLINKED OBJECT LOG, HANDOFF OR ALIAS TABLE IS REFUSED.
-#
-# All three are written IN PLACE with a redirect or an append, which follows a
-# link: the bytes would land at the far end while the commit recorded the link.
-REN7_ID="12ab34cd-16a7-4000-8000-12ab34cd16a7"
-mkdir -p "$SANDBOX/faraway" "$WIP/handoffs/repoLink"
-printf '# lane repoLink-1 — object log (lane-collision-protocol Amendment 7)\n' > "$SANDBOX/faraway/log.md"
-printf 'Lane: repoLink-1 — single-use resume prompt\n\n## RESUME\n' > "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md"
-add_seed_row "| \`repoLink-1\` | harness \`$REN7_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the symlink-refusal lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-ln -s "$SANDBOX/faraway/log.md" "$LOGD/repoLink-1.md"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-is   "a SYMLINKED object log is refused" "$rc" 2
-has  "…because an append-only log is written in place" "$err" "is a SYMLINK"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…and the far end is untouched" "$(wc -l < "$SANDBOX/faraway/log.md" | tr -d ' ')" 1
-rm -f "$LOGD/repoLink-1.md"
-printf '# lane repoLink-1 — object log (lane-collision-protocol Amendment 7)\n' > "$LOGD/repoLink-1.md"
-# AND COMMITTED, because an UNTRACKED source log is its own refusal now (round
-# 6) and would answer every case below this one instead of the one it asks.
-git -C "$WIP" add -- lanes/log/repoLink-1.md >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the symlink-refusal lane's own log"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-mv "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md" "$SANDBOX/faraway/h.md"
-ln -s "$SANDBOX/faraway/h.md" "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md"
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-is   "a SYMLINKED handoff is refused" "$rc" 2
-has  "…because Rule 3's stamp is written in place" "$err" "is a SYMLINK"
-hasnt "…and the far end took no stamp" "$(cat "$SANDBOX/faraway/h.md")" "RENAMED from"
-rm -f "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md"
-mv "$SANDBOX/faraway/h.md" "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md"
-
-ren_alias_real="$WIP/lanes/aliases.tsv"
-mv "$ren_alias_real" "$SANDBOX/faraway/aliases.tsv"
-ln -s "$SANDBOX/faraway/aliases.tsv" "$ren_alias_real"
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-is   "a SYMLINKED alias table is refused" "$rc" 2
-has  "…because the alias row is appended in place" "$err" "is a SYMLINK"
-rm -f "$ren_alias_real"
-mv "$SANDBOX/faraway/aliases.tsv" "$ren_alias_real"
-
-# ---- AN UNCOMMITTED ALIAS TABLE IS SOMEBODY ELSE'S HALF-FINISHED RENAME.
-printf 'peerLane-1\tpeerLane-2\t2026-09-15T00:00:00Z\n' >> "$ren_alias_real"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-is   "a DIRTY alias table refuses the rename rather than being swept into it" "$rc" 2
-has  "…naming the file that is not this write's" "$err" "aliases.tsv"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-git -C "$WIP" checkout -- lanes/aliases.tsv
-
-# ---- THE REGISTER IS IN THE ROLLBACK TOO.
-#
-# `commit_push` can die on `git add` or `git commit` BEFORE any commit exists,
-# and the row is written before it. A `pre-commit` hook that refuses is the
-# smallest honest way to reach that branch: no commit is made, so all FOUR must
-# come back — the register with them, or the checkout is left in a split rename.
-ren_reg_before="$(cat "$LANES")"
-ren_log_before="$(cat "$LOGD/repoLink-1.md")"
-ren_alias_before="$(cat "$ren_alias_real")"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-mkdir -p "$WIP/.git/hooks"
-printf '#!/bin/sh\nexit 1\n' > "$WIP/.git/hooks/pre-commit"
-chmod 755 "$WIP/.git/hooks/pre-commit"
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-rm -f "$WIP/.git/hooks/pre-commit"
-is   "a commit that never happens leaves NOTHING renamed" "$rc" 6
-is   "…the register back, row and all" "$(cat "$LANES")" "$ren_reg_before"
-is   "…the object log back under its own name" "$(cat "$LOGD/repoLink-1.md" 2>/dev/null)" "$ren_log_before"
-is   "…and no log under the new one" "$( [ -e "$LOGD/repoLink-2.md" ] && echo yes || echo no )" "no"
-is   "…the alias table back" "$(cat "$ren_alias_real")" "$ren_alias_before"
-is   "…the handoff back under its own name" \
-     "$( [ -f "$WIP/handoffs/repoLink/session-handoff-2026-09-12-lane-repoLink-1.md" ] && echo yes )" "yes"
-is   "…and nothing committed" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…with nothing left staged for the next writer to commit by accident" \
-     "$(git -C "$WIP" diff --cached --name-only | grep -c . || :)" 0
-has  "…and it says the rename was rolled back" "$err" "rolled back"
-
-# ---- AND THE SAME RENAME THEN GOES THROUGH, which is what "refused or whole"
-# is worth: a refusal leaves a checkout a re-run can use.
-run env LANES_SESSION="$REN7_ID" "$E" rename-lane repoLink-1 repoLink-2 --no-github
-is   "the same rename then goes through" "$rc" 0
-is   "…and the row moved" "$(command grep -c '^| `repoLink-2`' "$LANES")" 1
-is   "…with the log at its new name" "$( [ -f "$LOGD/repoLink-2.md" ] && echo yes )" "yes"
-
-
-# ============ Copilot round 5 on openRepoTools#81 ============================
-
-REN8_ID="12ab34cd-16a8-4000-8000-12ab34cd16a8"
-mkdir -p "$WIP/handoffs/repoEdge" "$HOME/projects/outside"
-printf 'Lane: repoEdge-1 — single-use resume prompt\n\n## RESUME\n' > "$HOME/projects/outside/h.md"
-add_seed_row "| \`repoEdge-1\` | harness \`$REN8_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/../../outside/h.md | ACTIVE |"
-{ printf '# lane repoEdge-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoEdge-1, session %s@Eagle, %s, lane:repoEdge-1 → home opensoft/repoEdge; estate repoEdge\n' "$REN8_ID" "$OLD_UTC"
-} > "$LOGD/repoEdge-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the round-5 edge lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# ---- A HANDOFF THAT LEAVES THE WORKSPACE THROUGH `..` IS STILL OUTSIDE IT.
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-is   "a handoff that leaves the workspace through '..' is refused" "$rc" 2
-has  "…by the physical path, not by a string prefix" "$err" "outside the workspace repository"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…the far end untouched" "$(command grep -c 'RENAMED from' "$HOME/projects/outside/h.md" || :)" 0
-
-# ---- A DANGLING SYMLINK AT THE DESTINATION IS OCCUPIED, NOT ABSENT.
-"$E" replace-in-row repoEdge-1 "handoffs/../../outside/h.md" "handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-1.md" "point it inside the workspace" >/dev/null 2>&1
-printf 'Lane: repoEdge-1 — single-use resume prompt\n\n## RESUME\n' > "$WIP/handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-1.md"
-ln -s "$HOME/projects/outside/gone.md" "$WIP/handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-2.md"
-git -C "$WIP" add -A -- handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the dangling destination" >/dev/null 2>&1
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-is   "a DANGLING symlink at the handoff's destination is occupied" "$rc" 2
-has  "…and says something is already there" "$err" "already there"
-is   "…with nothing written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-git -C "$WIP" rm -q --cached -- handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-2.md >/dev/null 2>&1 || :
-rm -f "$WIP/handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-2.md"
-git -C "$WIP" commit -q -m "remove the dangling destination" >/dev/null 2>&1 || :
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main 2>/dev/null || :
-
-# ---- A FIFO AT THE OLD LOG PATH IS REFUSED RATHER THAN READ.
-#
-# `cat` of one BLOCKS, for ever, holding this lane's mutex.
-if command -v mkfifo >/dev/null 2>&1; then
-  ren_log_keep="$(cat "$LOGD/repoEdge-1.md")"
-  rm -f "$LOGD/repoEdge-1.md"
-  mkfifo "$LOGD/repoEdge-1.md"
-  ren_before="$(git -C "$WIP" rev-parse HEAD)"
-  run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-  is   "a FIFO at the old log path is refused rather than read" "$rc" 2
-  has  "…saying a read of one would block this write and its lock" "$err" "not a regular file"
-  is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-  rm -f "$LOGD/repoEdge-1.md"
-  printf '%s\n' "$ren_log_keep" > "$LOGD/repoEdge-1.md"
-else
-  skip "a FIFO at the old log path is refused rather than read" "no mkfifo on this host"
-fi
-
-# ---- AN ALIAS TABLE WITH NO TRAILING NEWLINE IS REFUSED.
-#
-# `>>` would put this record on the END of the previous line, and
-# `append_text_line`'s own proof passes because it concatenates the same way —
-# so the parser would never see the alias and the old name would stop resolving.
-ren_alias_keep="$(cat "$WIP/lanes/aliases.tsv")"
-printf '%s' "$ren_alias_keep" > "$WIP/lanes/aliases.tsv"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-is   "an alias table with no trailing newline is refused" "$rc" 2
-has  "…because the record would join the line before it" "$err" "does not end with a newline"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-git -C "$WIP" checkout -- lanes/aliases.tsv
-
-# ---- AN EXISTING UNTRACKED ALIAS TABLE IS SOMEBODY'S HAND EDIT.
-#
-# `tracked_dirty` deliberately omits untracked files, so the dirty-checkout
-# refusal never sees one.
-ren_alias_tracked="$(cat "$WIP/lanes/aliases.tsv")"
-git -C "$WIP" rm -q --cached -- lanes/aliases.tsv >/dev/null 2>&1
-git -C "$WIP" commit -q -m "make the alias table untracked for one case" >/dev/null 2>&1
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main 2>/dev/null || :
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-is   "an existing UNTRACKED alias table is refused" "$rc" 2
-has  "…because git does not track it and this command commits what it writes" "$err" "git does not track it"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-git -C "$WIP" add -- lanes/aliases.tsv >/dev/null 2>&1
-git -C "$WIP" commit -q -m "track the alias table again" >/dev/null 2>&1
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main 2>/dev/null || :
-
-# ---- AND WITH EVERY EDGE CLEARED, THE RENAME GOES THROUGH.
-run env LANES_SESSION="$REN8_ID" "$E" rename-lane repoEdge-1 repoEdge-2 --no-github
-is   "with every edge cleared the rename goes through" "$rc" 0
-is   "…the row moved" "$(command grep -c '^| `repoEdge-2`' "$LANES")" 1
-is   "…the log at its new name" "$( [ -f "$LOGD/repoEdge-2.md" ] && echo yes )" "yes"
-is   "…the handoff at its new name" \
-     "$( [ -f "$WIP/handoffs/repoEdge/session-handoff-2026-09-12-lane-repoEdge-2.md" ] && echo yes )" "yes"
-has  "…and the alias table carries the pair" "$(cat "$WIP/lanes/aliases.tsv")" "$(printf 'repoEdge-1\trepoEdge-2\t20')"
-
-
-# ============ Copilot round 6 on openRepoTools#81 ============================
-
-# ---- A RENAMED IS SKIPPED BY THE ONE READER THAT TAKES THE LAST LANE-KIND
-# LINE WHATEVER IT IS. `swapped_candidates` names the verbs it skips, so a lane
-# whose LAST line is its rename must still read as PAUSED — otherwise `swapped`
-# loses it and `restart` cannot bring it back.
-REN9_ID="12ab34cd-16a9-4000-8000-12ab34cd16a9"
-add_seed_row "| \`repoRSw-1\` | harness \`$REN9_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoRSw/x.md | ACTIVE |"
-{ printf '# lane repoRSw-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRSw-1, session %s@Eagle, %s, lane:repoRSw-1 → home opensoft/repoRSw; estate repoRSw\n' "$REN9_ID" "$OLD_UTC"
-  printf 'PAUSED — lane repoRSw-1, session %s@Eagle, 2026-09-14T09:00:00Z, lane:repoRSw-1 → swap; window swsess:2; workstation Eagle\n' "$REN9_ID"
-} > "$LOGD/repoRSw-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a swapped lane about to be renamed"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$E" swapped Eagle
-has  "a PAUSED lane reads as swapped before the rename" "$out" "repoRSw-1"
-# ITS ROW NAMES A HANDOFF DIRECTORY NOTHING HAS CREATED, which is the ordinary
-# state of every lane before its first swap — `lane-start` puts the path in the
-# row and `lane-handoff` writes the file later — so this case also holds the
-# containment test to the nearest ancestor that EXISTS.
-run env LANES_SESSION="$REN9_ID" "$E" rename-lane repoRSw-1 repoRSw-2 --no-github
-is   "…and the rename goes through" "$rc" 0
-run "$E" swapped Eagle
-has  "…and it STILL reads as swapped, under its new name, with RENAMED as its last line" "$out" "repoRSw-2"
-hasnt "…and not under the old one" "$out" "repoRSw-1	"
-run "$E" lane-last repoRSw-2
-has  "…while the last LANE-kind line a state read takes is still the PAUSED" "$out" "PAUSED"
-
-# ---- AN UNTRACKED OBJECT LOG OR HANDOFF IS SOMEBODY'S UNCOMMITTED WORK.
-#
-# `tracked_dirty` reports no untracked file, so the dirty-checkout refusal never
-# sees one — and this rename would MOVE it to a path it always stages.
-REN10_ID="12ab34cd-16b0-4000-8000-12ab34cd16b0"
-add_seed_row "| \`repoUnt-1\` | harness \`$REN10_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoUnt/session-handoff-2026-09-12-lane-repoUnt-1.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the untracked-source lane"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-{ printf '# lane repoUnt-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoUnt-1, session %s@Eagle, %s, lane:repoUnt-1 → home opensoft/repoUnt; estate repoUnt\n' "$REN10_ID" "$OLD_UTC"
-} > "$LOGD/repoUnt-1.md"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN10_ID" "$E" rename-lane repoUnt-1 repoUnt-2 --no-github
-is   "an UNTRACKED object log is refused, not moved into this commit" "$rc" 2
-has  "…because its lines have never been committed by anyone" "$err" "git does not track it"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…the log still under its own name" "$( [ -f "$LOGD/repoUnt-1.md" ] && echo yes )" "yes"
-git -C "$WIP" add -- "lanes/log/repoUnt-1.md" >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the lane's own log, as the refusal asks"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-mkdir -p "$WIP/handoffs/repoUnt"
-printf 'Lane: repoUnt-1 — single-use resume prompt\n\n## RESUME\n' > "$WIP/handoffs/repoUnt/session-handoff-2026-09-12-lane-repoUnt-1.md"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_SESSION="$REN10_ID" "$E" rename-lane repoUnt-1 repoUnt-2 --no-github
-is   "an UNTRACKED handoff is refused, not stamped into this commit" "$rc" 2
-has  "…for the same reason" "$err" "git does not track it"
-is   "…and nothing was written" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-hasnt "…the handoff took no stamp" "$(cat "$WIP/handoffs/repoUnt/session-handoff-2026-09-12-lane-repoUnt-1.md")" "RENAMED from"
-git -C "$WIP" add -- handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the lane's own handoff, as the refusal asks"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-run env LANES_SESSION="$REN10_ID" "$E" rename-lane repoUnt-1 repoUnt-2 --no-github
-is   "…and with both committed the rename goes through" "$rc" 0
-is   "…the log at its new name" "$( [ -f "$LOGD/repoUnt-2.md" ] && echo yes )" "yes"
-is   "…the handoff at its new name" \
-     "$( [ -f "$WIP/handoffs/repoUnt/session-handoff-2026-09-12-lane-repoUnt-2.md" ] && echo yes )" "yes"
-
-
-# ---- CLAUSE (g): ONE COMMENT PER OBJECT THE LANE HOLDS, AFTER THE COMMIT.
-#
-# The one act of this command that happens AFTER the push, and the one every
-# case above switches off — so it is exercised here against the fake `gh` the
-# head of this file puts first on `$PATH`, with `LANES_NO_GITHUB=0` for this
-# case alone. Nothing reaches GitHub: the fake answers the two comment forms
-# `gh_comment` makes and REFUSES every other call loudly.
-REN11_ID="12ab34cd-16b1-4000-8000-12ab34cd16b1"
-add_seed_row "| \`repoCmt-1\` | harness \`$REN11_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoCmt/x.md | ACTIVE |"
-{ printf '# lane repoCmt-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoCmt-1, session %s@Eagle, %s, lane:repoCmt-1 → home opensoft/repoCmt; estate repoCmt\n' "$REN11_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoCmt-1, session %s@Eagle, %s, opensoft/repoCmt#11\n' "$REN11_ID" "$OLD_UTC"
-  printf 'OPENED — lane repoCmt-1, session %s@Eagle, %s, opensoft/repoCmt#12\n' "$REN11_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoCmt-1, session %s@Eagle, %s, opensoft/repoCmt#13\n' "$REN11_ID" "$OLD_UTC"
-  printf 'RELEASED — lane repoCmt-1, session %s@Eagle, %s, opensoft/repoCmt#13\n' "$REN11_ID" "$OLD_UTC"
-} > "$LOGD/repoCmt-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the comment lane: two objects open, one released"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-: > "$FAKE_GH_LOG"
-run env LANES_NO_GITHUB=0 LANES_SESSION="$REN11_ID" "$E" rename-lane repoCmt-1 repoCmt-2
-is   "a rename with GitHub ON exits 0" "$rc" 0
-ren_sha="$(git -C "$WIP" rev-parse HEAD)"
-is   "…posting ONE comment per object the lane HOLDS, and no more" \
-     "$(command grep -c '^=== issue comment' "$FAKE_GH_LOG" || :)" 2
-has  "…on the first of them" "$(cat "$FAKE_GH_LOG")" "=== issue comment opensoft/repoCmt 11"
-has  "…and the second" "$(cat "$FAKE_GH_LOG")" "=== issue comment opensoft/repoCmt 12"
-hasnt "…never on the one it released, which it does not hold" "$(cat "$FAKE_GH_LOG")" "opensoft/repoCmt 13"
-has  "…the body in the amendment's own words" "$(cat "$FAKE_GH_LOG")" \
-     "Lane repoCmt-1 renamed repoCmt-2 at 20"
-has  "…with Rule 10's wire form, lower-case and canonical" "$(cat "$FAKE_GH_LOG")" \
-     "Lane: repocmt-2 (repoCmt-2)"
-has  "…citing the commit that carries the rename" "$(cat "$FAKE_GH_LOG")" "$ren_sha"
-has  "…and naming the table that keeps the old name resolving" "$(cat "$FAKE_GH_LOG")" \
-     "lanes/aliases.tsv\` resolves \`repoCmt-1\` to \`repoCmt-2\`"
-has  "…reporting each comment's URL" "$err" "comment posted on opensoft/repoCmt#11"
-
-# ---- AND A COMMENT THAT CANNOT BE POSTED LEAVES THE RENAME WHERE IT LANDED.
-#
-# The commit IS the rename (clause (g): the comment is posted AFTER it), so a
-# `gh` that refuses must warn and never undo anything.
-REN12_ID="12ab34cd-16b2-4000-8000-12ab34cd16b2"
-add_seed_row "| \`repoCmt-5\` | harness \`$REN12_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | handoffs/repoCmt/y.md | ACTIVE |"
-{ printf '# lane repoCmt-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoCmt-5, session %s@Eagle, %s, lane:repoCmt-5 → home opensoft/repoCmt; estate repoCmt\n' "$REN12_ID" "$OLD_UTC"
-  printf 'CLAIMED — lane repoCmt-5, session %s@Eagle, %s, opensoft/repoCmt#21\n' "$REN12_ID" "$OLD_UTC"
-} > "$LOGD/repoCmt-5.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the lane whose comment will fail"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_GH_LOG"
-run env LANES_NO_GITHUB=0 FAKE_GH_FAIL=1 LANES_SESSION="$REN12_ID" "$E" rename-lane repoCmt-5 repoCmt-6
-is   "a rename whose comment cannot be posted still exits 0" "$rc" 0
-has  "…warning, and naming the object it could not reach" "$err" "could not be posted on: opensoft/repoCmt#21"
-has  "…saying the commit IS the rename and it has landed" "$err" "it has landed"
-is   "…with the row moved all the same" "$(command grep -c '^| `repoCmt-6`' "$LANES")" 1
-is   "…the log at its new name" "$( [ -f "$LOGD/repoCmt-6.md" ] && echo yes )" "yes"
-is   "…and the commit still on origin" \
-     "$(git -C "$WIP" rev-parse HEAD)" "$(git -C "$WIP" rev-parse origin/main)"
-is   "…and nothing was posted" "$(command grep -c '^=== ' "$FAKE_GH_LOG" || :)" 0
-
-# ---- AND THE FAKE REFUSES ANY OTHER GITHUB CALL, LOUDLY.
-run env FAKE_GH_LOG="$SANDBOX/gh-probe.log" gh repo view opensoft/openRepoTools
-is   "the fake gh refuses every call but the two comment forms" "$rc" 90
-has  "…saying this suite reaches no GitHub surface" "$err" "reaches no GitHub surface"
-
-
-# ============ Copilot round 8 on openRepoTools#81 ============================
-
-# ---- THE READER'S FALLBACK REFUSES A PATH THAT IS NOT A TABLE, and the reason
-# it is worth a round of its own is that the old behaviour failed OPEN.
-#
-# With no alias blob on `origin`, `-f` is false for a directory, a FIFO and a
-# dangling link alike, so the branch was simply SKIPPED: `# no lane aliases` was
-# cached and handed back with status 0, and a FORMER lane name then read as NEW.
-# Each shape is put to both readers that matter — `canon-lane`, which is clause
-# (e)'s one seat, and `lane-start`, which is what would append the second row.
-# `repoRen-4` is the MIDDLE name of this section's chain and belongs to nobody,
-# so the table is the only thing that can answer for it.
-mkdir -p "$HOME/projects/repoRen"
-ren_kind_tsv="$WIP/lanes/aliases-kind.tsv"
-ren_kind() {   # <what is at the path>
-  run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_kind_tsv" \
-      LANES_ALIASES_PATH=lanes/aliases-kind.tsv "$E" canon-lane repoRen-4
-  is    "an alias table that is $1 refuses the read" "$rc" 66
-  has   "…saying what is at the path instead" "$err" "not a regular file"
-  hasnt "…and never 'unknown error', which is what a reason lost to a subshell said" \
-        "$err" "unknown error"
-  hasnt "…and answers no lane name at all" "$out" "repoRen"
-  run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_kind_tsv" \
-      LANES_ALIASES_PATH=lanes/aliases-kind.tsv \
-      "$START" --no-launch --dir "$HOME/projects/repoRen" repoRen-4
-  is    "…and lane-start refuses over $1 rather than adding a row" "$rc" 2
-  has   "…saying it would be a second row for a lane that is running" "$err" "second row"
-}
-mkdir -p "$ren_kind_tsv"
-ren_kind "a DIRECTORY"
-rmdir "$ren_kind_tsv"
-ln -s "$WIP/lanes/no-table-is-here.tsv" "$ren_kind_tsv"
-ren_kind "a DANGLING SYMLINK"
-rm -f "$ren_kind_tsv"
-if command -v mkfifo >/dev/null 2>&1; then
-  mkfifo "$ren_kind_tsv"
-  ren_kind "a FIFO"
-  rm -f "$ren_kind_tsv"
-else
-  skip "an alias table that is a FIFO refuses the read" "no mkfifo on this host"
-fi
-
-# ---- AND A LIVE LINK TO A REAL TABLE IS STILL READ, because the reader's rule
-# is narrower than the writer's on purpose: the writer refuses a symlink because
-# it APPENDS in place and a redirect follows one, while a reader that follows
-# the same link gets the table's own bytes and is right to.
-printf 'farLane-1\tfarLane-2\t2026-09-15T00:00:00Z\n' > "$WIP/lanes/aliases-far.tsv"
-ln -s "$WIP/lanes/aliases-far.tsv" "$ren_kind_tsv"
-run env LANES_NO_FETCH=1 LANES_ALIASES_TSV="$ren_kind_tsv" \
-    LANES_ALIASES_PATH=lanes/aliases-kind.tsv "$E" canon-lane farLane-1
-is   "a symlink to a table that IS one is read, not refused" "$rc" 0
-is   "…answering the name that table names" "$out" "farLane-2"
-rm -f "$ren_kind_tsv" "$WIP/lanes/aliases-far.tsv"
-
-# ---- THE UNDO'S PATHSPECS SURVIVE A SPACE IN A PATH.
-#
-# Flattened into one string and expanded unquoted, `handoffs/team notes/…` was
-# TWO pathspecs that match nothing — and `git reset` is SILENT about a pathspec
-# it cannot match, so the reset did not happen for that file and the rename
-# stayed STAGED for the next writer to commit by accident: half a transaction,
-# left behind by the mechanism that exists to leave none.
-REN13_ID="12ab34cd-16b3-4000-8000-12ab34cd16b3"
-REN13_H="handoffs/team notes/session-handoff-2026-09-12-lane-repoSpc-1.md"
-REN13_H_NEW="handoffs/team notes/session-handoff-2026-09-12-lane-repoSpc-2.md"
-mkdir -p "$WIP/handoffs/team notes"
-printf 'Lane: repoSpc-1 — single-use resume prompt\n\n## RESUME\n' > "$WIP/$REN13_H"
-add_seed_row "| \`repoSpc-1\` | harness \`$REN13_ID\` | Eagle / test / brett | 2026-09-12T00:00Z | none | $REN13_H | ACTIVE |"
-{ printf '# lane repoSpc-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoSpc-1, session %s@Eagle, %s, lane:repoSpc-1 → home opensoft/repoSpc; estate repoSpc\n' "$REN13_ID" "$OLD_UTC"
-} > "$LOGD/repoSpc-1.md"
-git -C "$WIP" add -A -- lanes handoffs >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose handoff lives under a directory with a space"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-ren_reg_before="$(cat "$LANES")"
-ren_log_before="$(cat "$LOGD/repoSpc-1.md")"
-ren_alias_before="$(cat "$WIP/lanes/aliases.tsv" 2>/dev/null || :)"
-ren_before="$(git -C "$WIP" rev-parse HEAD)"
-mkdir -p "$WIP/.git/hooks"
-printf '#!/bin/sh\nexit 1\n' > "$WIP/.git/hooks/pre-commit"
-chmod 755 "$WIP/.git/hooks/pre-commit"
-run env LANES_SESSION="$REN13_ID" "$E" rename-lane repoSpc-1 repoSpc-2 --no-github
-rm -f "$WIP/.git/hooks/pre-commit"
-is   "a rename rolled back over a path with a SPACE commits nothing" "$rc" 6
-is   "…the register back" "$(cat "$LANES")" "$ren_reg_before"
-is   "…the object log back under its own name" "$(cat "$LOGD/repoSpc-1.md" 2>/dev/null)" "$ren_log_before"
-is   "…the alias table back" "$(cat "$WIP/lanes/aliases.tsv" 2>/dev/null || :)" "$ren_alias_before"
-is   "…the handoff back under its own name, space and all" \
-     "$( [ -f "$WIP/$REN13_H" ] && [ ! -e "$WIP/$REN13_H_NEW" ] && echo yes )" "yes"
-is   "…HEAD unmoved" "$(git -C "$WIP" rev-parse HEAD)" "$ren_before"
-is   "…and NOTHING left staged, which is what a split pathspec leaves behind" \
-     "$(git -C "$WIP" diff --cached --name-only | command grep -c . || :)" 0
-
-# ---- AND THE SAME RENAME THEN GOES THROUGH, spaces and all.
-run env LANES_SESSION="$REN13_ID" "$E" rename-lane repoSpc-1 repoSpc-2 --no-github
-is   "the same rename then goes through" "$rc" 0
-is   "…moving the handoff under the spaced directory" \
-     "$( [ -f "$WIP/$REN13_H_NEW" ] && [ ! -e "$WIP/$REN13_H" ] && echo yes )" "yes"
-is   "…and the row names it there" "$(command grep -c "$REN13_H_NEW" "$LANES")" 1
-has  "…in ONE commit that carries the spaced path" \
-     "$(git -C "$WIP" show --name-only --format= HEAD)" "$REN13_H_NEW"
-
-
-export FAKE_TMUX_WINDOWS="$A16_SAVE_WINDOWS"
-export FAKE_TMUX_WINDOW="$A16_SAVE_WINDOW"
-export FAKE_TMUX_WINDOW_NAME="$A16_SAVE_NAME"
-
-section "== Amendment 17: the handoff is the swap =="
-
-# THE ACT UNDER ITS THREE NAMES, AND THE TWO SUB-FIELDS THAT MAKE A LANE
-# RESUMABLE BY ANY AGENT. lane-collision-protocol Amendment 17, ratified
-# 2026-09-14T09:45:33Z (clause (f), `/ctx`, included); Amendment 18(d)'s
-# `--exit` and Addendum 2's respawn line; adoption acts 6 (the transcript
-# follows the lane) and 7 (`--late`).
-#
-# EVERYTHING THIS SECTION ADDS IS ITS OWN — its own bin copy of `lane-handoff`,
-# its own fakes in their own directory, its own lanes, its own profiles — so
-# that it can be read, moved or merged in one piece. The shared fakes at the
-# head of this file are not edited; `$SANDBOX/a17bin/tmux` DELEGATES to the
-# shared one for every read, and adds the two writes tmux makes here.
-
-HANDOFF_CMD="$OPENREPOTOOLS_BIN_DIR/lane-handoff"
-# `cp -p` AND NO `chmod` AFTER IT, deliberately: the mode this case reads back
-# is the one the REPOSITORY carries, so a `lane-handoff` that is not 100755 in
-# the index is a failure here rather than a file the fixture quietly made
-# runnable. The first Amendment 17(a) commit landed it 100644 and a `chmod 755`
-# on this line saw nothing; `e25b54c` made it 100755 and this fixture is what
-# holds it there. (`git ls-files -s lane-handoff` is the answer to any claim
-# that it is not.)
-cp -p "$SRC_DIR/lane-handoff" "$OPENREPOTOOLS_BIN_DIR/" 2>/dev/null
-is   "lane-handoff is installed beside the helper it reads through, executable as the repository ships it" \
-     "$( [ -x "$HANDOFF_CMD" ] && echo yes || echo no )" yes
-
-mkdir -p "$SANDBOX/a17bin"
-# A FAKE `codex`, LOGGING ITS ARGV — the whole of what a launcher table can be
-# tested against. It also records, at the instant it is launched, how many
-# `RESUMED by codex` stamps the handoff carries: that is how "the stamp is
-# written BEFORE the launch" is proved rather than assumed.
-cat > "$SANDBOX/a17bin/codex" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_CODEX_LOG:-/dev/null}"
-if [ -n "${FAKE_CODEX_WATCH:-}" ]; then
-  printf 'stamps-at-launch=%s\n' \
-    "$(grep -c 'RESUMED by codex' "$FAKE_CODEX_WATCH" 2>/dev/null || printf 0)" \
-    >> "${FAKE_CODEX_LOG:-/dev/null}"
-fi
-exit 0
-FAKE
-# THE TWO WRITES TMUX MAKES IN THIS SECTION, and the same trick: each records
-# how many PAUSED lines the lane's log carried at the instant it ran. Amendment
-# 17(f) is an ORDER — *"a pane is never respawned over an unrecorded lane"* —
-# and an order is proved by what the second act could see of the first.
-cat > "$SANDBOX/a17bin/tmux" <<'FAKE'
-#!/usr/bin/env bash
-case "${1-}" in
-  send-keys|respawn-pane)
-    printf '%s' "$*" >> "${FAKE_TMUX_A17_LOG:-/dev/null}"
-    printf ' | paused-lines=%s\n' \
-      "$(grep -c '^PAUSED' "${FAKE_TMUX_A17_WATCH:-/dev/null}" 2>/dev/null || printf 0)" \
-      >> "${FAKE_TMUX_A17_LOG:-/dev/null}"
-    exit 0 ;;
-esac
-exec "${FAKE_TMUX_REAL:?}" "$@"
-FAKE
-cat > "$SANDBOX/a17bin/pclaude" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_PCLAUDE_LOG:-/dev/null}"
-FAKE
-chmod +x "$SANDBOX/a17bin/codex" "$SANDBOX/a17bin/tmux" "$SANDBOX/a17bin/pclaude"
-export FAKE_TMUX_REAL="$SANDBOX/fakebin/tmux"
-export FAKE_CODEX_LOG="$SANDBOX/codex.log" FAKE_TMUX_A17_LOG="$SANDBOX/tmux-a17.log"
-export FAKE_PCLAUDE_LOG="$SANDBOX/pclaude.log"
-: > "$FAKE_CODEX_LOG"; : > "$FAKE_TMUX_A17_LOG"; : > "$FAKE_PCLAUDE_LOG"
-A17PATH="$SANDBOX/a17bin:$PATH"
-
-# ------------------------------------------------------------- the fixtures
-
-HF_ID="a17a0001-1111-4000-8000-a17a00011111"
-HF2_ID="a17a0002-2222-4000-8000-a17a00022222"
-HF3_ID="a17a0003-3333-4000-8000-a17a00033333"
-HF4_ID="a17a0004-4444-4000-8000-a17a00044444"
-CODEX_ID="01JCODEXSESSION0000000001"
-
-mkdir -p "$HOME/projects/repoHF"
-git init -q -b main "$HOME/projects/repoHF"
-git -C "$HOME/projects/repoHF" remote add origin "https://github.com/opensoft/repoHF.git"
-HF_DIR="$HOME/projects/repoHF"
-
-# ONE RUNNING WRITER, on disk, exactly as a lane keeps them: a worktree under
-# the lane's own checkout with work in it that is neither committed nor pushed.
-mkdir -p "$HF_DIR/.claude/worktrees/w1"
-git init -q -b feat/w1 "$HF_DIR/.claude/worktrees/w1"
-git -C "$HF_DIR/.claude/worktrees/w1" config user.email "test@example.invalid"
-git -C "$HF_DIR/.claude/worktrees/w1" config user.name "lane helper tests"
-printf 'first\n' > "$HF_DIR/.claude/worktrees/w1/a.txt"
-git -C "$HF_DIR/.claude/worktrees/w1" add -A >/dev/null 2>&1
-git -C "$HF_DIR/.claude/worktrees/w1" commit -q -m "the writer's last commit"
-printf 'uncommitted\n' > "$HF_DIR/.claude/worktrees/w1/b.txt"
-
-mkdir -p "$WIP/handoffs/repoHF"
-hf_seed_handoff() {   # <file> <lane>
-  { printf 'Lane: %s (team-05a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$2" "$HF_ID"
-    printf '\n'
-    printf 'Written before Amendment 17, by hand.\n'
-  } > "$1"
-}
-for hf_l in repoHF-1 repoHF-2 repoHF-3 repoHF-4 repoHF-5 repoHF-6 repoHF-7 repoHF-8 repoHF-9 repoHF-10; do
-  hf_seed_handoff "$WIP/handoffs/repoHF/$hf_l.md" "$hf_l"
-done
-git -C "$WIP" add -- handoffs/repoHF >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the Amendment 17 handoffs"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-hf_row() {   # <lane> <session cell>
-  "$E" add-row "| \`$1\` | $2 | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoHF/$1.md | ACTIVE |" >/dev/null 2>&1
-}
-hf_row repoHF-1 "harness \`$HF_ID\`"
-hf_row repoHF-2 "\`session_01A17NOUUIDATALL000000\` (profile team-05a)"
-hf_row repoHF-3 "harness \`$HF2_ID\`"
-hf_row repoHF-4 "harness \`$HF3_ID\`"
-hf_row repoHF-5 "harness \`$HF_ID\`"
-hf_row repoHF-6 "harness \`$HF_ID\`"
-hf_row repoHF-7 "harness \`$HF4_ID\`"
-# The two lanes Amendment 18 Addendum 2 (i-8) is asked on: one respawned where
-# `lane` IS on PATH, one where the `lane` on PATH is somebody else's word.
-hf_row repoHF-8 "harness \`$HF_ID\`"
-hf_row repoHF-9 "harness \`$HF_ID\`"
-# The lane the IN-PROCESS clear is recorded on: its writers live through it.
-hf_row repoHF-10 "harness \`$HF_ID\`"
-
-# The lane's own log, with the STARTED a running lane has.
-hf_seed_log() {   # <lane> <utc> [<extra line>…]
-  hf_l="$1"; hf_u="$2"; shift 2
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$hf_l"
-    printf 'STARTED — lane %s, session %s@Eagle, %s, lane:%s → home opensoft/repoHF; estate repoHF; dir %s\n' \
-      "$hf_l" "$HF_ID" "$hf_u" "$hf_l" "$HF_DIR"
-    for hf_x in "$@"; do printf '%s\n' "$hf_x"; done
-  } > "$LOGD/$hf_l.md"
-  git -C "$WIP" add -- "lanes/log/$hf_l.md"
-  git -C "$WIP" commit -q -m "LOG($hf_l@Eagle): seed"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  return 0
-}
-for hf_l in repoHF-1 repoHF-2 repoHF-3 repoHF-5 repoHF-6 repoHF-7 repoHF-8 repoHF-9 repoHF-10; do
-  hf_seed_log "$hf_l" "2026-09-14T09:00:00Z"
-done
-
-# The live record of the window this lane is in, so the pane `--exit` and
-# `--restart` type into is the one the harness itself recorded.
-write_record_ns "$sessions_dir/live-a17.json" "$HF_ID" "$LIVE_PID" "$live_start" "hfsess:@21.%21" "repoHF-1" "user" "busy"
-
-# ------------------------------------- 1. the record, and its two sub-fields
-
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-1.md"
-cat > "$SANDBOX/a17bin/lclaude" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_PCLAUDE_LOG:-/dev/null}"
-FAKE
-chmod +x "$SANDBOX/a17bin/lclaude"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-1 clear
-is    "lane-handoff exits 0" "$rc" 0
-# ITS OWN STDOUT, KEPT: `$out` is whatever the LAST `run` left, and there is a
-# `swapped` read between this run and the assertions at the foot of this block.
-hf1_out="$out"
-rm "$SANDBOX/a17bin/lclaude"
-hf1_log="$(cat "$LOGD/repoHF-1.md")"
-has   "…writing the lane's PAUSED line" "$hf1_log" "PAUSED — lane repoHF-1, session $HF_ID@Eagle"
-has   "…whose payload opens 'swap;', which is what \`swapped\` matches on" "$hf1_log" "lane:repoHF-1 → swap;"
-has   "…carrying Amendment 11(c)'s window" "$hf1_log" "window hfsess:0 @21"
-has   "…its dir" "$hf1_log" "dir $HF_DIR"
-has   "…its profile" "$hf1_log" "profile team-05a"
-has   "…and Amendment 17(b)'s two: the agent" "$hf1_log" "agent claude"
-has   "…and the transcript" "$hf1_log" "transcript $HF_ID"
-has   "…with the why as the line's free text" "$hf1_log" " — clear"
-has   "the lane-aware restart line is printed when lclaude is installed" "$hf1_out" "READY — restart with: lclaude team-05a"
-has   "…naming the agent the next start will use" "$hf1_out" "lane-start --agent claude resumes it"
-
-run   "$E" swapped Eagle
-has   "swapped lists the lane" "$out" "repoHF-1"
-is    "…with the agent as its sixth field and the transcript as its seventh" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "repoHF-1" { print $6 "/" $7 }')" "claude/$HF_ID"
-is    "…and a record written before Amendment 17 carries both EMPTY, never a guess" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "repoSW-1" { print $6 "/" $7 }')" "/"
-run   "$E" lane-agent repoHF-1
-is    "lane-agent reads the record's agent" "$out" "claude"
-run   "$E" lane-transcript repoHF-1
-is    "lane-transcript reads its transcript" "$out" "$HF_ID"
-run   "$E" lane-agent repoSW-1
-is    "…and an older record with neither is 8, the estate's 'no record' (Amendment 7(i))" "$rc" 8
-
-# THE HANDOFF FILE — a fresh Rule 3 top block, the WRITERS section filled from
-# the disk, and everything that was there kept below as history.
-hf1_file="$(cat "$WIP/handoffs/repoHF/repoHF-1.md")"
-is    "the handoff's line 1 is still the Rule 3 header lane-start splices under" \
-      "$(head -n1 "$WIP/handoffs/repoHF/repoHF-1.md" | cut -c1-20)" "Lane: repoHF-1 (team"
-is    "…with the blank line after it that puts the stamps at line 3" \
-      "$(sed -n 2p "$WIP/handoffs/repoHF/repoHF-1.md")" ""
-has   "…a fresh RESUME PROMPT block naming the agent and the transcript" "$hf1_file" "agent claude, transcript $HF_ID"
-has   "…whose headline is what to EXPECT and never what to do (Addendum 1 (j))" "$hf1_file" "the count decides: this handoff cannot know"
-has   "…a WRITERS section" "$hf1_file" "**WRITERS at"
-has   "…naming the running writer's worktree" "$hf1_file" "$HF_DIR/.claude/worktrees/w1"
-has   "…its branch" "$hf1_file" "branch \`feat/w1\`"
-has   "…what it had committed" "$hf1_file" "the writer's last commit"
-has   "…and what it is holding" "$hf1_file" "1 dirty"
-has   "…the section for the brief where the caller passed none" "$hf1_file" "brief: (fill in"
-# THE WRITERS OF AN IN-PROCESS CLEAR SURVIVE IT, AND THE BLOCK IS WHAT TELLS THE
-# NEXT SESSION WHICH CASE IT IS IN (measured in this lane on 2026-09-14: a
-# harness `/clear` mints a new transcript id in the SAME process, so every
-# subagent lives through it and only its in-flight tool calls die). `ListAgents`
-# comes first in BOTH kinds, because relaunching a writer that is still listed
-# is two writers on one worktree.
-has   "the top block's act (3) COUNTS the live writers first (Addendum 1 (i))" "$hf1_file" "COUNT THE LIVE WRITERS"
-has   "…with clause (k) beside it, which is why the count comes first" "$hf1_file" "ONE WORKTREE, ONE WRITER"
-has   "…and the reads that say where a writer that is NOT live stood" "$hf1_file" "git log @{u}.."
-has   "…the WRITERS section opening with clause (i)'s own words" "$hf1_file" "FIRST count the live writers"
-has   "…a live writer OWNING its worktree, messaged rather than relaunched" "$hf1_file" "A writer still live OWNS its worktree"
-has   "…and the count beating the list where the two disagree" "$hf1_file" "THE COUNT WINS"
-has   "…while a PLAIN handoff cannot know which kind followed it (Addendum 1 (h))" "$hf1_file" "kind unknown"
-has   "the record carries the kind too, after the agent and the transcript" "$hf1_log" "; kind unknown"
-has   "…and the free text names it after the why, in the addendum's own spelling" "$hf1_log" " — clear kind unknown"
-has   "…and the file it was, below, as history" "$hf1_file" "Written before Amendment 17, by hand."
-has   "the writers are polled on stdout too, with git's own words" "$hf1_out" "git status --short"
-has   "…and the unpushed read beside it" "$hf1_out" "git log @{u}.."
-is    "the handoff refresh is its own commit in the workspace repository" \
-      "$(git -C "$WIP" log --format=%s -n1 -- handoffs/repoHF/repoHF-1.md)" "handoff(repoHF-1@Eagle): PAUSED, clear"
-has   "…with the Rule 5 trailer" "$(git -C "$WIP" log --format=%b -n1 -- handoffs/repoHF/repoHF-1.md)" "Lane: repoHF-1"
-has   "the row is flipped to PAUSED" "$(grep '^| `repoHF-1`' "$LANES")" "| PAUSED "
-
-# The brief a caller DOES pass reaches the section.
-printf '%s\t%s\n' "$HF_DIR/.claude/worktrees/w1" "take round 4 of #41" > "$SANDBOX/a17-writers.tsv"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-3 --writers-file "$SANDBOX/a17-writers.tsv" --dir "$HF_DIR" clear
-is    "a second handoff exits 0" "$rc" 0
-has   "…and the WRITERS section carries the brief the caller passed" \
-      "$(cat "$WIP/handoffs/repoHF/repoHF-3.md")" "brief: take round 4 of #41"
-
-# THE SUB-FIELDS ARE VALIDATED BY THE WRITER, because this log is append-only.
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log PAUSED lane:repoHF-7 '→' "swap; agent not a key" "x"
-is    "an \`agent\` that is not a manifest key is refused by the writer" "$rc" 2
-has   "…naming the rule rather than the caller" "$err" "manifest key"
-hasnt "…and nothing was written" "$(cat "$LOGD/repoHF-7.md")" "not a key"
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log PAUSED lane:repoHF-7 '→' "swap; transcript two words" "x"
-is    "…and so is a \`transcript\` that is neither an id nor 'none'" "$rc" 2
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF4_ID" "$HANDOFF_CMD" --lane repoHF-7 --agent 'not a key' x
-is    "lane-handoff refuses the same value at the flag" "$rc" 2
-has   "…naming the flag the caller used" "$err" "--agent takes a manifest key"
-
-# THE TWO SUB-FIELDS ARE WRITTEN TOGETHER OR NOT AT ALL, AND AN EMPTY ONE IS NOT
-# AN ABSENT ONE (Copilot rounds 1 and 2 on openRepoTools#47). A half record is
-# read by `lane-start` as one field plus a DEFAULT for the other: Claude over a
-# codex id, or codex over none. And a sub-field written blank parses exactly
-# like one that was never there, so a malformed line would be indexed as a
-# pre-amendment one for ever, in a log nothing rewrites.
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log PAUSED lane:repoHF-7 '→' "swap; agent codex" "x"
-is    "an \`agent\` with no \`transcript\` beside it is refused by the writer" "$rc" 2
-has   "…naming the pair rather than the caller" "$err" "written TOGETHER or not at all"
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log PAUSED lane:repoHF-7 '→' "swap; transcript none" "x"
-is    "…and a \`transcript\` with no \`agent\` is refused the same way" "$rc" 2
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log PAUSED lane:repoHF-7 '→' "swap; agent ; transcript none" "x"
-is    "…and a sub-field that is THERE and EMPTY is neither valid nor 'absent'" "$rc" 2
-has   "…saying no reader can tell it from a pre-amendment record" "$err" "THERE and EMPTY"
-is    "…and nothing was written by any of the three" "$(grep -c '^PAUSED' "$LOGD/repoHF-7.md")" 0
-# (the PAIR TOGETHER is what every `lane-handoff` above writes, and repoHF-1's
-# record is the case that reads it back — this lane's log is left EMPTY of
-# `PAUSED` lines on purpose: section 3 below is the `--late` rule, and its whole
-# question is what a lane with no paused record does.)
-
-# A ONE-LINE RECORD CANNOT TAKE A NEWLINE, AND IT IS REFUSED BEFORE ANYTHING IS
-# WRITTEN (opensoft/openRepoTools#85, #72 item 6). `append-line` used to append
-# its text and only THEN prove it was one line, so a text carrying a newline
-# left two lines in the register, the checkout dirty, and a refusal (exit 5)
-# that came after the write. And `lane-handoff` put its `why` into four places
-# with only two of them sanitized: a `why` carrying a newline refreshed and
-# committed the handoff, had its PAUSED refused by `write_event`, handed
-# `append-line` two lines — which the row flip after it then committed as a
-# peer's `pre-existing` edit — and exited 0. Every case here is asked on
-# repoHF-7, whose log is kept EMPTY of `PAUSED` lines for section 3: a refusal
-# writes nothing, and that is exactly what these assert.
-a17_nl_head="$(git -C "$WIP" rev-parse HEAD)"
-a17_nl_status="$(git -C "$WIP" status --porcelain)"
-cp -- "$LANES" "$SANDBOX/a17-nl-lanes.md"
-cp -- "$WIP/handoffs/repoHF/repoHF-7.md" "$SANDBOX/a17-nl-handoff.md"
-cp -- "$LOGD/repoHF-7.md" "$SANDBOX/a17-nl-log.md"
-a17_nl_same() {   # <file> <its copy> — `same` where not one byte moved
-  if cmp -s -- "$1" "$2"; then printf same; else printf changed; fi
-}
-run env LANES_LANE=repoHF-7 "$E" append-line \
-    "$(printf 'PAUSED — lane repoHF-7, session %s@Eagle, 2026-09-14T09:30:00Z, clear\nsecond line; handoff refreshed' "$HF4_ID")"
-is    "append-line refuses a text carrying a newline" "$rc" 2
-has   "…saying it appends ONE line" "$err" "append-line appends ONE line"
-is    "…before it writes: the register is byte for byte as it was" \
-      "$(a17_nl_same "$LANES" "$SANDBOX/a17-nl-lanes.md")" same
-is    "…and the checkout is as it was, so the next writer in it is not refused for a dirty register" \
-      "$(git -C "$WIP" status --porcelain)" "$a17_nl_status"
-run env LANES_LANE=repoHF-7 "$E" append-line "$(printf 'LANDING — lane repoHF-7, a carriage\rreturn')"
-is    "…and a carriage return the same way, which the line count after the write never saw" "$rc" 2
-is    "…with nothing written for it either" "$(a17_nl_same "$LANES" "$SANDBOX/a17-nl-lanes.md")" same
-
-# AND THE GATE IS IN `append_text_line` ITSELF, so every caller has it — `add-row`,
-# `log`'s Rule 6 line, a rename's lines — and not only the verb that met it.
-# Lifted out of the helper the way the `cut_to_line` cases below lift theirs,
-# and asked against a file of its own.
-printf 'line one\n' > "$SANDBOX/a17-nl-atl.txt"
-run bash -c 'eval "$(sed -n -e "/^die()/,/^}/p" -e "/^note()/p" -e "/^append_text_line()/,/^}/p" "$1")"; append_text_line "$2" "$3"' \
-    _ "$E" "$(printf 'two\nthree')" "$SANDBOX/a17-nl-atl.txt"
-is    "append_text_line refuses a newline itself, whichever verb called it" "$rc" 2
-is    "…before its copy and its \`>>\`: the file is still its one line" "$(cat "$SANDBOX/a17-nl-atl.txt")" "line one"
-
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF4_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-7 "$(printf 'clear\nsecond line')"
-is    "lane-handoff refuses a why carrying a newline" "$rc" 2
-has   "…at the door, saying the why is one line" "$err" "the why is ONE line"
-is    "…the handoff not refreshed" \
-      "$(a17_nl_same "$WIP/handoffs/repoHF/repoHF-7.md" "$SANDBOX/a17-nl-handoff.md")" same
-is    "…the object log not written" "$(a17_nl_same "$LOGD/repoHF-7.md" "$SANDBOX/a17-nl-log.md")" same
-is    "…the register byte for byte as it was" "$(a17_nl_same "$LANES" "$SANDBOX/a17-nl-lanes.md")" same
-is    "…nothing committed" "$(git -C "$WIP" rev-parse HEAD)" "$a17_nl_head"
-is    "…and the checkout as it was" "$(git -C "$WIP" status --porcelain)" "$a17_nl_status"
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF4_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-7 "$(printf 'clear\r')"
-is    "…and a carriage return is refused the same way" "$rc" 2
-
-# `sanitize` IS THE SECOND LINE OF DEFENCE: a break that reaches it is spelled
-# `; `, one per break whatever its spelling, so the act still happens on one
-# line. Lifted out of `lane-handoff` in a shell of its own, because this file
-# has a `sanitize` of its own (the transcript directory's).
-run bash -c 'eval "$(sed -n "/^sanitize()/,/^}/p" "$1")"; sanitize "$2"' \
-    _ "$HANDOFF_CMD" "$(printf 'a\r\nb\rc\nd — e')"
-is    "lane-handoff's sanitize spells every line break '; ', as it does ' — '" "$out" "a; b; c; d; e"
-
-# `--utc` IS THE LATE `PAUSED`'s SEAM AND HAS NO OTHER CALLER (Amendment 17,
-# adoption act 7). This log is append-only and FILE ORDER is what every state
-# read means by "last", so a STARTED or a RESUMED dated by hand changes what
-# every reader reports about a lane that is running.
-run env LANES_LANE=repoHF-7 LANES_SESSION="$HF4_ID" "$E" log RESUMED lane:repoHF-7 --utc "2026-09-13T01:02:03Z"
-is    "--utc on a verb that is not PAUSED is refused" "$rc" 2
-has   "…naming the one line that carries its own date" "$err" "dates the LATE PAUSED"
-is    "…and nothing was written" "$(grep -c '^RESUMED' "$LOGD/repoHF-7.md")" 0
-
-# ------------------------------------------ 2. /ctx — the record, then the pane
-
-# WHAT TMUX IS ASKED TO START CHANGED WITH `openRepoTools#94`, and these three
-# cases are where that is held. It used to be THE LAUNCH: `lane <name>` where
-# that word was on PATH, `pclaude --lane <lane> <profile>` where it was not,
-# with `LANE_START_FRESH=1` in front of it — so this command had to decide
-# which of Amendment 18 Addendum 2 (i-8)'s two doors it could SEE, and had to
-# read a `lane` on PATH to find out whether it was even this estate's word.
-#
-# NONE OF THAT IS HERE ANY MORE. What tmux starts is this command's own
-# `--supervise` mode, BY ABSOLUTE PATH, and the supervisor takes (i-8)'s second
-# door one level down. So the three cases below run THE SAME ACT on three
-# different PATHs — no `lane`, this estate's `lane`, somebody else's `lane` —
-# and the assertion is that the respawn line is the same every time. That is a
-# stronger property than the one they held before: a respawn is the one act no
-# later refusal can undo, and what it starts now depends on nothing a person's
-# shell profile can change.
-#
-# Each still runs on a PATH THIS FILE BUILT rather than on whatever the
-# workstation happens to carry: `openRepoTools#43` places `lane` in
-# `~/.local/bin`, and a case that asked "what happens where there is no `lane`"
-# against a workstation that has one would go green on a different question.
-a17_path_without() {   # <word> — this section's PATH with every directory that holds <word> taken out
-  a17p_want="$1"
-  printf '%s' "$A17PATH" | tr ':' '\n' | while IFS= read -r a17p_d; do
-    [ -n "$a17p_d" ] || continue
-    if [ -x "$a17p_d/$a17p_want" ]; then continue; fi
-    printf '%s:' "$a17p_d"
-  done | sed 's/:$//'
-}
-a17_path_without_lane() { a17_path_without lane; }
-A17PATH_NOLANE="$(a17_path_without_lane)"
-
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-5.md"
-cat > "$SANDBOX/a17bin/lclaude" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_PCLAUDE_LOG:-/dev/null}"
-FAKE
-chmod +x "$SANDBOX/a17bin/lclaude"
-# A prior section exports PCLAUDE as an explicit override. This case asks
-# about PATH fallback, so remove that override for this invocation only.
-run env -u PCLAUDE PATH="$A17PATH_NOLANE" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-5 --restart clear
-is    "lane-handoff --restart exits 0" "$rc" 0
-a17_tmux="$(cat "$FAKE_TMUX_A17_LOG")"
-has   "…respawning the lane's own pane" "$a17_tmux" "respawn-pane -k -t hfsess:@21.%21"
-# WITH NO `lane` ON PATH — which is this sandbox — the respawn is the
-# supervisor, and it is spelled as an ABSOLUTE PATH because a respawned pane's
-# `PATH` is whatever the person's shell profile makes of it.
-has   "…into this command's own supervisor, for one named operation" \
-      "$a17_tmux" "lane-handoff --supervise --lane repoHF-5 --operation"
-is    "…by ABSOLUTE path, never a word a respawned pane's PATH resolves" \
-      "$(printf '%s\n' "$a17_tmux" | awk '{ for (i = 1; i <= NF; i++) if ($i == "--supervise") { t = $(i - 1); print (substr(t, 1, 1) == "/") ? "abs" : t; exit } }')" "abs"
-has   "…with the workstation written INTO the command string, because tmux hands the server's environment" \
-      "$a17_tmux" "LANES_WORKSTATION=Eagle"
-hasnt "…and never the launch itself, which is what took the pane with it (openRepoTools#94)" \
-      "$a17_tmux" "pclaude --lane repoHF-5 team-05a"
-hasnt "…nor the environment seam that was measured not arriving" "$a17_tmux" "LANE_START_FRESH=1"
-run   "$E" restart-intent repoHF-5
-is    "…and the restart intent the supervisor launches from reads back" "$rc" 0
-has   "…as pending, for the operation the respawn line names" "$out" "$(printf 'state\tpending')"
-has   "…in the mode that authorises a fresh session" "$out" "$(printf 'mode\tfresh-from-handoff')"
-rm "$SANDBOX/a17bin/lclaude"
-hasnt "…never \`restart <lane>\`, which Addendum 2 takes off the person's PATH" "$a17_tmux" "restart repoHF-5"
-is    "THE RECORD WAS WRITTEN BEFORE THE RESPAWN, which is what the fake could see" \
-      "$(printf '%s\n' "$a17_tmux" | grep -o 'paused-lines=[0-9]*' | head -n1)" "paused-lines=1"
-has   "…and the record is the lane's own PAUSED" "$(cat "$LOGD/repoHF-5.md")" "lane:repoHF-5 → swap;"
-
-# THIS ESTATE'S OWN `lane` ON PATH, AND IT CHANGES NOTHING (openRepoTools#94).
-# Amendment 18 Addendum 2 (i-8)'s adoption line — *"opensoft/openRepoTools#36
-# (`/ctx`) respawns with `lane <name>`"* — is the door this command used to
-# take, and #94 is what it cost: `lane` is the HUMAN DISPATCHER, whose valid
-# outcomes include attaching to a live session without launching anything, and
-# the fresh-session requirement it was handed was an environment variable the
-# launcher's own `tmux new-session` dropped on the way through. The clause's
-# two doors are kept ONE LEVEL DOWN — the supervisor takes the second, the
-# launcher directly — and its ground (*"no word is kept on `PATH` for it
-# alone"*) is honoured exactly, because the supervisor is a MODE of a command
-# that is already installed.
-#
-# THE FAKE IS STILL PLACED, because the property under test is that it makes NO
-# DIFFERENCE: the word is on PATH, executable, and named exactly as the estate
-# names it, and the respawn line is the same line as the case above. The
-# bounded 8 KB read that used to classify this file — and the padding that
-# proved its SIGPIPE corner (Copilot round 3 on openRepoTools#47) — are gone
-# with the probe that needed them: nothing reads `lane` any more.
-mkdir -p "$SANDBOX/a17lane"
-cat > "$SANDBOX/a17lane/lane" <<'FAKE'
-#!/usr/bin/env bash
-# lane — the word, as lane-collision-protocol Amendment 18 Addendum 1 names it
-printf '%s\n' "$*" >> "${FAKE_LANE_LOG:-/dev/null}"
-FAKE
-chmod +x "$SANDBOX/a17lane/lane"
-: > "${FAKE_LANE_LOG:-/dev/null}"
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-8.md"
-run env PATH="$SANDBOX/a17lane:$A17PATH_NOLANE" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-8 --restart clear
-is    "with \`lane\` on PATH, lane-handoff --restart exits 0" "$rc" 0
-a17_lane_tmux="$(cat "$FAKE_TMUX_A17_LOG")"
-has   "…and the respawn line is the SAME supervisor, with this estate's own \`lane\` sitting on PATH" \
-      "$a17_lane_tmux" "lane-handoff --supervise --lane repoHF-8 --operation"
-hasnt "…never the human dispatcher, whose valid outcomes include attaching to a live session" \
-      "$a17_lane_tmux" "a17lane/lane repoHF-8"
-hasnt "…nor the environment seam the launcher's tmux new-session drops" "$a17_lane_tmux" "LANE_START_FRESH=1"
-hasnt "…never the launcher at this level either — that is the supervisor's door, one down" \
-      "$a17_lane_tmux" "pclaude --lane repoHF-8"
-hasnt "…and never \`restart <lane>\`" "$a17_lane_tmux" "restart repoHF-8"
-is    "…the record still written BEFORE the respawn" \
-      "$(printf '%s\n' "$a17_lane_tmux" | grep -o 'paused-lines=[0-9]*' | head -n1)" "paused-lines=1"
-
-# SOMEBODY ELSE'S `lane` ON PATH, AND IT CHANGES NOTHING EITHER. This case used
-# to be the dangerous one: `lane` is an ordinary English word, a pane respawned
-# over a stranger's `lane` is a pane the person cannot get back, and the command
-# read the file's first 8 KB for this toolset's own marker to tell the two
-# apart. That read is gone because the choice it fed is gone — the respawn line
-# names this command's own absolute path — so a foreign `lane` is not passed
-# over, not classified, and not mentioned. It is simply never consulted.
-mkdir -p "$SANDBOX/a17foreign"
-cat > "$SANDBOX/a17foreign/lane" <<'FAKE'
-#!/usr/bin/env bash
-# somebody else's `lane`: a swimming-lane plotter, say. It names no protocol.
-exit 0
-FAKE
-chmod +x "$SANDBOX/a17foreign/lane"
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-9.md"
-run env PATH="$SANDBOX/a17foreign:$A17PATH_NOLANE" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-9 --restart clear
-is    "a \`lane\` that is not this estate's word still exits 0" "$rc" 0
-a17_foreign_tmux="$(cat "$FAKE_TMUX_A17_LOG")"
-has   "…respawning into the same supervisor as the other two PATHs" \
-      "$a17_foreign_tmux" "lane-handoff --supervise --lane repoHF-9 --operation"
-hasnt "…and never through the word it does not read" "$a17_foreign_tmux" "a17foreign/lane repoHF-9"
-hasnt "…nor through the launcher at this level" "$a17_foreign_tmux" "pclaude --lane repoHF-9"
-hasnt "…and with nothing to SAY about a stranger's word, because nothing consulted it" \
-      "$err" "is not this estate's word"
-
-# A RECORD THAT CANNOT BE WRITTEN REFUSES BEFORE ANYTHING IS KILLED. repoHF-2's
-# row carries only `session_…` footer ids, so no transcript uuid is knowable and
-# `write_event` refuses the line (Amendment 11 clause (e)).
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-2.md"
-# THE WINDOW IS ONE NO LIVE RECORD NAMES, and that is the point: repoHF-2's row
-# carries only `session_…` footer ids, so with no session in the window either
-# there is no transcript uuid anywhere and `write_event` refuses the line
-# (Amendment 11 clause (e)). Asked from the window `live-a17.json` names, the
-# window read would hand it a uuid and there would be no unwritable record to
-# test with.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@22" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-2 --restart clear
-is    "a /ctx whose record could not be written REFUSES" "$rc" 2
-has   "…saying the pane is exactly as it was" "$err" "this pane is left exactly as it is"
-is    "…and the pane was never respawned" "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-hasnt "…nor is there a PAUSED line for that lane" "$(cat "$LOGD/repoHF-2.md")" "PAUSED"
-
-# THE RECORD IS THREE WRITES, AND A PANE IS NEVER RESPAWNED OVER A PARTIAL ONE
-# (Copilot rounds 1 and 2 on openRepoTools#47). The object-log line is the
-# first; the ROW is what every other lane and every launcher reads this lane's
-# state from, and the HANDOFF's top block is literally the new session's first
-# prompt. Each of the two below writes the PAUSED line and then fails at one of
-# the others, and neither may kill the only process that could put it right.
-# Both supply the sandbox checkout so the earlier restart-directory preflight
-# passes and each case reaches the partial preservation failure it exercises.
-hf_seed_handoff "$WIP/handoffs/repoHF/repoHF-11.md" repoHF-11
-git -C "$WIP" add -- handoffs/repoHF/repoHF-11.md >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed repoHF-11's handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-# A ROW WHOSE CELLS ARE NOT UNAMBIGUOUS, which since Amendment 13(a) is what a
-# refused row write looks like. It used to be a state cell no anchor matched —
-# `replace-in-row` was given a state word derived from the row itself and a
-# lower-case `running` derived nothing — and that refusal is gone with the act:
-# `set-row-state` REPLACES the cell whatever it says. What it will not do is
-# write over a row carrying a seventh ` | `, because which text is the state
-# cell is then not knowable from the row. SEEDED and not added, because the
-# writer refuses to create this state (the line it would need carries a `|`).
-add_seed_row "| \`repoHF-11\` | harness \`$HF_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoHF/repoHF-11.md | running · a | b |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a row whose state cell holds a literal ' | ', which no row write can take"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-11.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-11 --dir "$HF_DIR" --restart clear
-is    "a /ctx whose ROW could not be flipped REFUSES" "$rc" 2
-has   "…saying the register would read RUNNING for a session that was just replaced" "$err" "the ROW WAS NOT FLIPPED"
-has   "…and that the pane is exactly as it was" "$err" "this pane is left exactly as it is"
-is    "…and the pane was never respawned" "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-has   "…while the record itself IS written, because a swap is never left unwritten" \
-      "$(cat "$LOGD/repoHF-11.md")" "lane:repoHF-11 → swap;"
-
-# A HANDOFF THE ROW NAMES AND NOTHING CAN FIND: the top block cannot be
-# refreshed, so a respawn would hand the new session the block of the handoff
-# this act has replaced — the writers of another act, the why of another act.
-"$E" add-row "| \`repoHF-12\` | harness \`$HF_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoHF/repoHF-12-nowhere.md | ACTIVE |" >/dev/null 2>&1
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-12.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-12 --dir "$HF_DIR" --restart clear
-is    "a /ctx whose HANDOFF could not be refreshed REFUSES" "$rc" 2
-has   "…saying the top block is what the new session is started with" "$err" "the HANDOFF WAS NOT REFRESHED"
-is    "…and the pane was never respawned" "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-has   "…with the block printed, so the act it could not make is still recoverable" "$err" "## RESUME PROMPT — PAUSED"
-
-# --exit types /exit into the lane's own pane (Amendment 18(d)).
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-6.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-6 --exit "requested by $HF2_ID@Eagle/py-bench"
-is    "lane-handoff --exit exits 0" "$rc" 0
-has   "…typing /exit into the lane's own pane" "$(cat "$FAKE_TMUX_A17_LOG")" "send-keys -t hfsess:@21.%21 /exit Enter"
-is    "…after the record, which is the same order /ctx takes" \
-      "$(grep -o 'paused-lines=[0-9]*' "$FAKE_TMUX_A17_LOG" | head -n1)" "paused-lines=1"
-has   "…and the why the requester gave is the record's free text" \
-      "$(cat "$LOGD/repoHF-6.md")" "requested by $HF2_ID@Eagle/py-bench"
-is    "…and the pane is not respawned as well: one act at a time" \
-      "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-run env PATH="$A17PATH" "$HANDOFF_CMD" --lane repoHF-4 --restart --exit x
-is    "--restart and --exit together are refused" "$rc" 2
-has   "…naming the two ends they are" "$err" "two different ends for one act"
-
-# ------------------------- 2b. --in-process: the writers live through a clear
-#
-# MEASURED IN THIS LANE ON 2026-09-14, and it is why the kind is recorded at
-# all: a harness `/clear` mints a NEW TRANSCRIPT ID IN THE SAME PROCESS, so
-# every subagent the lane has running SURVIVES it — only the tool calls they had
-# in flight die. A top block that then said *relaunch every writer below* would
-# put a SECOND writer on a worktree the first one still holds. The `--restart`
-# above is the other kind and its block is right to say relaunch: that one
-# replaces the process.
-: > "$FAKE_TMUX_A17_LOG"
-export FAKE_TMUX_A17_WATCH="$LOGD/repoHF-10.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-10 --in-process clear
-is    "lane-handoff --in-process exits 0" "$rc" 0
-hf10_log="$(cat "$LOGD/repoHF-10.md")"
-hf10_file="$(cat "$WIP/handoffs/repoHF/repoHF-10.md")"
-has   "…and the record says which kind of clear this was" "$hf10_log" "; kind in-process"
-has   "…the top block says to EXPECT every writer below live" "$hf10_file" "expect every writer below live"
-hasnt "…and never tells the next session to relaunch them all" "$hf10_file" "relaunch every writer below from where it stands"
-hasnt "…nor to relaunch NONE of them: a kind says what to expect, never what to do (Addendum 1 (j))" "$hf10_file" "relaunch NONE of them"
-has   "…with clause (i)'s count, which is the same first line in every kind" "$hf10_file" "FIRST count the live writers"
-has   "…and the one message a live writer is owed in place of a relaunch" "$hf10_file" "its in-flight call died"
-has   "…and the free text carries the kind after the why (Addendum 1 (h))" "$hf10_log" " — clear in-process"
-is    "…and the pane is untouched: --in-process respawns nothing" \
-      "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-run env PATH="$A17PATH" "$HANDOFF_CMD" --lane repoHF-4 --in-process --restart x
-is    "--in-process with --restart is refused" "$rc" 2
-has   "…because each of those replaces the process the writers are children of" "$err" "THIS PROCESS KEEPS RUNNING"
-run env PATH="$A17PATH" "$HANDOFF_CMD" --lane repoHF-4 --in-process --exit x
-is    "…and so is --in-process with --exit" "$rc" 2
-run env PATH="$A17PATH" "$HANDOFF_CMD" --lane repoHF-4 --in-process --late --at "2026-09-14T12:02:27Z"
-is    "…and --in-process with --late, which is a contradiction in its own terms" "$rc" 2
-has   "…because a late record is written for a session that has ALREADY ended" "$err" "ALREADY ENDED"
-
-# ----------------------------------------------- 3. --late, and its one rule
-
-# The lane's last lane-kind line is a STARTED at 09:00Z; the session died at
-# 12:02:27Z with no swap. The late record is written from a SHELL, before the
-# relaunch, dated by the moment the old session ended.
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-4 --late
-is    "--late with no --at is refused" "$rc" 2
-has   "…naming the flag and why a late line is dated by its own field" "$err" "a late record is dated by the moment the OLD SESSION ENDED"
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-4 --late --at "not-a-utc"
-is    "…and so is an --at that is not a UTC instant" "$rc" 2
-
-hf_seed_log repoHF-4 "2026-09-14T09:00:00Z"
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-4 --late --at "2026-09-14T12:02:27Z"
-is    "--late writes the record a swap never left" "$rc" 0
-hf4_log="$(cat "$LOGD/repoHF-4.md")"
-has   "…as the lane's own PAUSED" "$hf4_log" "PAUSED — lane repoHF-4, session $HF_ID@Eagle, 2026-09-14T12:02:27Z"
-has   "…dated by the moment the old session ended, not by this shell's clock" "$hf4_log" "; late 2026-09-14T12:02:27Z"
-has   "…with the why the act is for" "$hf4_log" "usage limit hit before the swap"
-has   "…and the handoff refreshed by the session that now holds the knowledge" \
-      "$(cat "$WIP/handoffs/repoHF/repoHF-4.md")" "expect none of the writers below live"
-has   "…the late record being the RESPAWN kind: the session it is written for has already ended" \
-      "$hf4_log" "; kind respawn"
-has   "…and it says the relaunch comes next" "$out" "Now start the lane"
-
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-4 --late --at "2026-09-14T12:05:00Z"
-is    "…and a second late record on an already-paused lane is refused" "$rc" 2
-has   "…saying the record is already there" "$err" "already a PAUSED"
-is    "…and the log is unchanged" "$(grep -c '^PAUSED' "$LOGD/repoHF-4.md")" 1
-
-# THE ORDER IS THE RULE. A lane whose relaunch is already recorded may not take
-# a late PAUSED: file order is what every state read means by "last", the log is
-# append-only, and a PAUSED after that RESUMED would make a RUNNING lane read as
-# paused.
-hf_seed_log repoHF-7 "2026-09-14T09:00:00Z" \
-  "RESUMED — lane repoHF-7, session $HF4_ID@Eagle, 2026-09-14T13:00:00Z, lane:repoHF-7 → home opensoft/repoHF; estate repoHF"
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF4_ID" CLAUDE_PROFILE_NAME=team-05a \
-    "$HANDOFF_CMD" --lane repoHF-7 --late --at "2026-09-14T12:02:27Z"
-is    "--late is refused once the relaunch is recorded" "$rc" 2
-has   "…naming the line that is already last" "$err" "RESUMED at 2026-09-14T13:00:00Z"
-has   "…and what the log would otherwise say about a lane that is running" "$err" "would make a lane that is RUNNING read as paused"
-has   "…with the act that was owed, in order" "$err" "from a SHELL, and only then start the lane"
-is    "…and nothing was written" "$(grep -c '^PAUSED' "$LOGD/repoHF-7.md")" 0
-
-# ------------- 3b. a flag's value: an empty one, and a flag where one belongs
-#
-# opensoft/openRepoTools#80 items 6 and 8 (Copilot's review of workBenches#91 at
-# `lane-handoff:242` and `:248`), and the gap under them. Every `=` spelling
-# took an EMPTY value as no flag at all — `--lane=` handed off the window's own
-# lane in place of the one being named — and the spaced spelling's refusal ran
-# inside `$( )`, so it printed REFUSED and the run then carried on with the
-# value empty. Each is refused with 2 at the parser, once, and writes nothing.
-hfv_fp() { { cat "$LOGD"/*.md; cat "$LANES"; git -C "$WIP" rev-parse HEAD; } 2>/dev/null | cksum; }
-hfv_before="$(hfv_fp)"
-for hfv_f in --operation= --at= --lane= --agent= --transcript= --writers-file= --dir=; do
-  run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-      CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-4 "$hfv_f" clear
-  is    "lane-handoff $hfv_f, with nothing after the =, is refused" "$rc" 2
-  has   "…as a flag given an empty value" "$err" "${hfv_f%=} needs a value, and '$hfv_f' gives it an empty one"
-done
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane --restart clear
-is    "lane-handoff --lane --restart is refused" "$rc" 2
-has   "…as a flag where the lane belongs" "$err" "--lane needs a value and '--restart' is a flag"
-is    "…and it STOPS there: one refusal, nothing after it" \
-      "$(printf '%s\n' "$err" | command grep -c 'REFUSED')" 1
-hasnt "…so no lane was resolved from the window in its place" "$err" "lane-handoff: lane="
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-4 --writers-file "" clear
-is    "…and so is a spaced --writers-file given the empty string" "$rc" 2
-has   "…in flag_value's own words" "$err" "--writers-file needs a value"
-hasnt "…which no longer run on into the poll" "$err" "writers polled"
-is    "none of those refusals wrote a byte: the logs, the register, its commit" "$(hfv_fp)" "$hfv_before"
-# AND THE `=` SPELLING STILL TAKES A VALUE THAT BEGINS WITH `-`, which is what
-# it is for: such a value reaches the validation it would always have met.
-run env PATH="$A17PATH" CLAUDE_CODE_SESSION_ID="$HF_ID" "$HANDOFF_CMD" --lane=-repoHF-4 clear
-is    "--lane=<a dash-led value> is still taken, and refused by the lane-name fence" "$rc" 2
-has   "…as the lane name it is not" "$err" "'-repoHF-4' is not a lane name"
-hasnt "…never as a value that was not given" "$err" "needs a value"
-
-# ------------------ 3c. the window: renamed only once nothing can refuse
-#
-# opensoft/openRepoTools#80 items 2, 3, 10 and 11 (Copilot's review of
-# workBenches#91 at `lane-handoff:519`, `:434` and `:351`). Four lanes of their
-# own, so that each case reads one record.
-for hfw_l in repoHF-80 repoHF-81 repoHF-82 repoHF-83; do
-  hf_seed_handoff "$WIP/handoffs/repoHF/$hfw_l.md" "$hfw_l"
-done
-git -C "$WIP" add -- handoffs/repoHF >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the #80 window cases' handoffs"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-for hfw_l in repoHF-80 repoHF-81 repoHF-82 repoHF-83; do
-  hf_row "$hfw_l" "harness \`$HF_ID\`"
-  hf_seed_log "$hfw_l" "2026-09-14T09:00:00Z"
-done
-
-# A REFUSED HANDOFF RENAMES NOTHING (item 2). repoHF-7's relaunch is recorded
-# above, so a late record on it is refused — by a gate that ran AFTER the rename
-# until this fix, and in a window named `claude` (the fake's `#W`).
-hfw_before="$(command grep -c 'rename-window repoHF-7' "$FAKE_TMUX_LOG" || :)"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF4_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-7 --late --at "2026-09-14T12:02:27Z"
-is    "a refused --late is still refused" "$rc" 2
-is    "…and leaves the window as it found it, never named for a lane it did not hand off" \
-      "$(command grep -c 'rename-window repoHF-7' "$FAKE_TMUX_LOG" || :)" "$hfw_before"
-
-# A RENAME TMUX REFUSES IS A REFUSAL, BEFORE THE RECORD (item 11). It was
-# swallowed: the PAUSED record and the row went on as if the window were the
-# lane's.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="hfsess:@21" FAKE_TMUX_RENAME_FAIL=1 \
-    CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-80 clear
-is    "a rename tmux refuses is a refusal" "$rc" 2
-has   "…naming the rename, with tmux's own words" "$err" "tmux would not rename this window 'claude' → 'repoHF-80' (tmux: no current client)"
-has   "…and the act that clears it" "$err" "tmux rename-window repoHF-80"
-is    "…having tried the rename once" "$(command grep -c 'rename-window repoHF-80$' "$FAKE_TMUX_LOG" || :)" 1
-is    "…and written no PAUSED record beside it" "$(command grep -c '^PAUSED' "$LOGD/repoHF-80.md")" 0
-hasnt "…nor flipped the row" "$(grep '^| `repoHF-80`' "$LANES")" "| PAUSED "
-has   "…while saying what HAD landed: the handoff's new top block" "$err" "new top block IS written"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-80 clear
-is    "…and the same command, once tmux will rename, is the whole act" "$rc" 0
-has   "…renaming the window" "$err" "window renamed 'claude' → 'repoHF-80'"
-is    "…writing the one PAUSED record" "$(command grep -c '^PAUSED' "$LOGD/repoHF-80.md")" 1
-has   "…and flipping the row" "$(grep '^| `repoHF-80`' "$LANES")" "| PAUSED "
-
-# TMUX IS TOUCHED ONLY FROM INSIDE IT (item 10). The suite exports `$TMUX` for
-# every case; here it is unset, the shape of an ordinary shell on a host where
-# some tmux server runs, and the fake on PATH would answer for that server.
-hfw_before="$(command grep -c 'rename-window repoHF-81' "$FAKE_TMUX_LOG" || :)"
-run env -u TMUX -u WORKBENCHES_CLAUDE_WINDOW_REF -u WORKBENCHES_CLAUDE_WINDOW_ID \
-    PATH="$A17PATH" FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-81 clear
-is    "a handoff from a shell outside tmux exits 0" "$rc" 0
-is    "…renaming no window: a tmux on PATH is not this shell's client" \
-      "$(command grep -c 'rename-window repoHF-81' "$FAKE_TMUX_LOG" || :)" "$hfw_before"
-hasnt "…and recording no window it read from somebody else's" "$(command grep '^PAUSED' "$LOGD/repoHF-81.md")" "; window "
-has   "…while the record itself is written" "$(cat "$LOGD/repoHF-81.md")" "PAUSED — lane repoHF-81"
-
-# THE WINDOW REFS ARE WHOLE STRINGS (item 3): `<session>:<digits>` and
-# `@<digits>`, from tmux and from the launcher's environment alike.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW_NAME=claude FAKE_TMUX_WINDOW="hfsess:@21junk" FAKE_TMUX_WINDOW_INDEX="1junk" \
-    WORKBENCHES_CLAUDE_WINDOW_REF="hfsess:7" WORKBENCHES_CLAUDE_WINDOW_ID="@77" \
-    CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-82 clear
-is    "a handoff whose tmux answers malformed refs exits 0" "$rc" 0
-hfw_log="$(command grep '^PAUSED' "$LOGD/repoHF-82.md")"
-hasnt "…recording no index with a tail" "$hfw_log" "1junk"
-hasnt "…and no @id with one" "$hfw_log" "@21junk"
-has   "…the launcher's well-formed refs standing in for both" "$hfw_log" "; window hfsess:7 @77;"
-run env PATH="$A17PATH" LANE_HANDOFF_NO_TMUX=1 \
-    WORKBENCHES_CLAUDE_WINDOW_REF="hfsess:7junk" WORKBENCHES_CLAUDE_WINDOW_ID="@77junk" \
-    CLAUDE_CODE_SESSION_ID="$HF_ID" CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-83 clear
-is    "a handoff whose launcher refs are malformed exits 0" "$rc" 0
-hfw_log="$(command grep '^PAUSED' "$LOGD/repoHF-83.md")"
-hasnt "…recording neither of them" "$hfw_log" "7junk"
-hasnt "…so the record carries no window at all rather than one nothing resolves" "$hfw_log" "; window "
-
-# ------------------------------------- 4. lane-start --agent: the launcher table
-
-mkdir -p "$WIP/handoffs/repoAG"
-AG_DIR="$HOME/projects/repoAG"
-mkdir -p "$AG_DIR"
-git init -q -b main "$AG_DIR"
-git -C "$AG_DIR" remote add origin "https://github.com/opensoft/repoAG.git"
-ag_seed_handoff() {   # <lane>
-  { printf 'Lane: %s (team-05a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$1" "$HF_ID"
-    printf '\n'
-    printf '## RESUME PROMPT — PAUSED 2026-09-14T12:00:00Z (clear), agent codex, transcript %s — relaunch every writer below from where it stands\n\n' "$CODEX_ID"
-    printf '**FIRST ACTS, in order.** (1) You are lane `%s`. THE TOP BLOCK OF %s.\n\n' "$1" "$1"
-    printf -- '---\n\n'
-    printf 'Everything below the rule is history and is NOT the first prompt.\n'
-  } > "$WIP/handoffs/repoAG/$1.md"
-}
-ag_row() {   # <lane> <cell>
-  "$E" add-row "| \`$1\` | $2 | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoAG/$1.md | ACTIVE |" >/dev/null 2>&1
-}
-ag_seed_log() {   # <lane> <payload tail>
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$1"
-    printf 'STARTED — lane %s, session %s@Eagle, 2026-09-14T09:00:00Z, lane:%s → home opensoft/repoAG; estate repoAG; dir %s\n' \
-      "$1" "$HF_ID" "$1" "$AG_DIR"
-    printf 'PAUSED — lane %s, session %s@Eagle, 2026-09-14T12:00:00Z, lane:%s → swap; dir %s; workstation Eagle; %s — clear\n' \
-      "$1" "$HF_ID" "$1" "$AG_DIR" "$2"
-  } > "$LOGD/$1.md"
-  git -C "$WIP" add -- "lanes/log/$1.md"
-  git -C "$WIP" commit -q -m "LOG($1@Eagle): seed a paused lane"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  return 0
-}
-for ag_l in repoAG-1 repoAG-2 repoAG-3 repoAG-4 repoAG-5 repoAG-6; do ag_seed_handoff "$ag_l"; done
-git -C "$WIP" add -- handoffs/repoAG >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoAG handoffs"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-ag_row repoAG-1 "harness \`$HF2_ID\`"
-ag_row repoAG-2 "harness \`$HF2_ID\`"
-ag_row repoAG-3 "harness \`$HF2_ID\`"
-ag_row repoAG-4 "harness \`$HF2_ID\`"
-AG_STALE_ID="a17a0007-7777-4000-8000-a17a00077777"
-ag_row repoAG-5 "harness \`$HF2_ID\` → harness \`$AG_STALE_ID\`"
-ag_row repoAG-6 "harness \`$HF2_ID\` → harness \`$AG_STALE_ID\`"
-ag_seed_log repoAG-1 "agent codex; transcript $CODEX_ID"
-ag_seed_log repoAG-2 "agent codex; transcript $CODEX_ID"
-ag_seed_log repoAG-3 "agent claude; transcript $HF2_ID"
-ag_seed_log repoAG-4 "agent claude; transcript $HF2_ID"
-ag_seed_log repoAG-5 "agent claude; transcript $HF2_ID"
-ag_seed_log repoAG-6 "agent claude; transcript $HF2_ID"
-
-# The row can end in a harness/process id whose transcript was never minted
-# while the last PAUSED record still names the exact Claude transcript the
-# process continued. That is the live shape behind a `pclaude --lane …` pane
-# immediately printing `[exited]`: title fallback passed `--resume <lane>` to
-# Claude instead of the existing transcript UUID.
-ag_tdir="$HOME/.claude/projects/$(sanitize "$AG_DIR")"
-mkdir -p "$ag_tdir"
-printf '{"type":"user"}\n' > "$ag_tdir/$HF2_ID.jsonl"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" repoAG-5 --no-launch
-is    "a missing row-last transcript falls back to the same agent's PAUSED transcript" "$rc" 0
-is    "…resuming the exact transcript id, never the title picker" "$(launch_of "$out")" \
-      "claude --name repoAG-5 --resume $HF2_ID"
-has   "…saying why the PAUSED transcript superseded the dead row-last id" "$err" \
-      "last session id $AG_STALE_ID has no transcript here"
-has   "…and restoring that exact id to the end of the session cell for the next launch" \
-      "$(grep '^| `repoAG-5`' "$LANES")" \
-      "→ harness \`$HF2_ID\` (transcript uuid; restored from the lane's last PAUSED record)"
-# …AND THE LANE LIVE IN THIS WINDOW IS NEVER REPLACED BY IT (Copilot round 2 on
-# openRepoTools#87). `$harness_sid` is empty in TWO states and only one of them
-# is "no live session is being bound here": where the window's own session IS
-# the row's, step 3 says so with `holder_here` and step 3b takes nothing, so
-# that test alone let this fallback fire on the very shape it was written to
-# stand off — the lane live in THIS window, its transcript not under this
-# directory, an older PAUSED record beside it — and would have opened the older
-# conversation over the person's own.
-write_record_a12 "$sessions_dir/ag-live.json" "$AG_STALE_ID" "$LIVE_PID" "$live_start" \
-  interactive "agsess:@41.%41" "repoAG-6" user "$GD_OLD_MS"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" repoAG-6 --no-launch
-is    "the lane live in THIS window is not replaced by an older PAUSED transcript" "$rc" 0
-has   "…step 3 having found that session holding the lane here" "$err" "already holds repoAG-6"
-hasnt "…so the PAUSED id is NOT resumed over it" "$out" "--resume $HF2_ID"
-hasnt "…and the recovery does not even speak" "$err" "has no transcript here"
-has   "…the launch being a new session named for the lane, as it is without a transcript" "$out" "--name repoAG-6"
-rm -f "$sessions_dir/ag-live.json"
-
-# AND THE FIXTURE IS TAKEN BACK OUT. Every repoAG row records this same id, so a
-# transcript left lying in this directory would make `--agent claude with no
-# transcript here` a resume by id — which is the case below, and it is about a
-# lane that has none.
-rm -f "$ag_tdir/$HF2_ID.jsonl"
-
-: > "$FAKE_CODEX_LOG"
-export FAKE_CODEX_WATCH="$WIP/handoffs/repoAG/repoAG-1.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" --agent codex repoAG-1
-is    "lane-start --agent codex exits 0" "$rc" 0
-ag_codex="$(cat "$FAKE_CODEX_LOG")"
-has   "…launching codex with the handoff's TOP BLOCK as its first prompt" "$ag_codex" "THE TOP BLOCK OF repoAG-1."
-hasnt "…and only the top block: what is below the rule is history, not a prompt" "$ag_codex" "Everything below the rule is history"
-is    "…with the Rule 3 stamp already in the file when codex was launched" \
-      "$(grep -o 'stamps-at-launch=[0-9]*' "$FAKE_CODEX_LOG" | head -n1)" "stamps-at-launch=1"
-has   "…the stamp naming the agent and its own id" \
-      "$(cat "$WIP/handoffs/repoAG/repoAG-1.md")" "RESUMED by codex $CODEX_ID (lane repoAG-1) at"
-has   "…the row's session cell appended in the agent's own spelling" \
-      "$(grep '^| `repoAG-1`' "$LANES")" "→ Codex \`$CODEX_ID\`"
-has   "…and the row's stamp says who resumed it" "$(grep '^| `repoAG-1`' "$LANES")" "RESUMED by codex $CODEX_ID (lane repoAG-1)"
-# THE FIRST ACT IT DEFERS KEEPS THE AGENT (opensoft/openRepoTools#72 item 5).
-# `codex` keeps no id this command can pass, so a codex launch ALWAYS defers its
-# log line and its Rule 3 stamp to the session's own `--no-launch` — and the
-# command printed for that act dropped `--agent`, leaving `lane-agent` to choose:
-# the agent of the lane's last PAUSED, not the one now running it.
-ag_deferred() {   # <stderr> — the one command lane-start prints for the deferred records
-  printf '%s\n' "$1" | awk 'f { print; exit } /which is this session.s own:$/ { f = 1 }'
-}
-has   "…and the first act it defers to the session carries --agent codex" "$(ag_deferred "$err")" " --agent codex"
-
-: > "$FAKE_CODEX_LOG"
-export FAKE_CODEX_WATCH="$WIP/handoffs/repoAG/repoAG-2.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" repoAG-2
-is    "with no --agent at all, the default is the agent of the last PAUSED" "$rc" 0
-has   "…which is codex here, launched with the top block" "$(cat "$FAKE_CODEX_LOG")" "THE TOP BLOCK OF repoAG-2."
-
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" --agent claude repoAG-3
-is    "--agent claude with no transcript here exits 0" "$rc" 0
-ag_claude="$(cat "$FAKE_CLAUDE_LOG")"
-has   "…taking a NEW session named for the lane" "$ag_claude" "--name repoAG-3 --session-id"
-has   "…with the handoff's top block as its first prompt" "$ag_claude" "THE TOP BLOCK OF repoAG-3."
-hasnt "…and never the title fallback, which filters a picker" "$ag_claude" "--resume repoAG-3"
-
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" --agent gpt-5-cli repoAG-4 --no-launch
-is    "an agent the table does not carry is a refusal" "$rc" 2
-has   "…naming the ones it knows" "$err" "It knows: claude"
-has   "…and codex beside it" "$err" "codex"
-hasnt "…and nothing was launched" "$(cat "$FAKE_CODEX_LOG")" "repoAG-4"
-
-# A LAUNCHER THE TABLE KNOWS AND THIS WORKSTATION DOES NOT HAVE IS REFUSED
-# BEFORE ANY WRITE (Copilot round 3 on openRepoTools#47, `lane-start:2132`).
-# The row, the object log and the Rule 3 stamp are all written before the
-# `exec`, so a `codex` that is not installed recorded the lane as RESUMED and
-# then exited 127 — a false transition in two append-only files. The code now
-# refuses in 5a, which is before every one of those writes.
-#
-# THERE IS NO CASE HERE, AND THE REASON IS THE FIXTURE AND NOT THE RULE. Asking
-# it needs a PATH with no `codex` on it, and the estate's workstations install
-# that launcher GLOBALLY: on the one this was written on it is `/usr/bin/codex`,
-# `/bin/codex` and `~/.npm-global/bin/codex`, so `a17_path_without codex` —
-# which is how the three `lane` cases below build their PATHs — returns the
-# EMPTY string and takes `bash`, `git`, `awk` and `sed` with it, and every run
-# on it dies at the shebang with `/usr/bin/env: bash: No such file`. A case that
-# can only be asked on a machine without a launcher every lane workstation has
-# is a case that is green on CI and red at the desk, which is the failure mode
-# the `a17_path_without_lane` comment below exists to prevent. The rule is held
-# by the code and stated here; a fixture that can express "no codex" without
-# expressing "no shell" would be the way to ask it.
-
-# A RECORDED TRANSCRIPT BELONGS TO THE AGENT THAT RECORDED IT (Copilot round 2
-# on openRepoTools#47). `lane-transcript` answers for the LANE — its last
-# `PAUSED`, whichever agent wrote it — so a lane paused by `claude` and resumed
-# with `--agent codex` would take the CLAUDE uuid and append it to the row's
-# session cell spelled `Codex <uuid>`: an id no `codex` can resume, attributing
-# this lane's history to a conversation that is not it, in a cell nothing
-# rewrites. repoAG-4's record says `agent claude; transcript $HF2_ID`.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" --agent codex repoAG-4 --no-launch
-is    "--agent codex over a record that names claude exits 0" "$rc" 0
-has   "…saying whose the recorded transcript is, and that this launch does not take it" \
-      "$err" "names agent claude and this launch is codex"
-hasnt "…and the session cell is NOT appended with a Claude uuid in Codex's spelling" \
-      "$(grep '^| `repoAG-4`' "$LANES")" "Codex \`$HF2_ID\`"
-# THE CASE #72 ITEM 5 IS ABOUT: the record names claude and the person named
-# codex, so a deferred act without the flag would be settled by claude.
-is    "…and its deferred first act names codex, which this lane's record would not" \
-      "$(ag_deferred "$err")" "lane-start:   lane-start --no-launch repoAG 4 --agent codex"
-# AND A RUN THAT NAMED NO AGENT, OVER A RECORD THAT NAMES NONE, PRINTS NONE:
-# the flag is written down where this run's agent was explicit and only there,
-# so the deferred act chooses its agent exactly as this run did. repoAG-10 has
-# no row and no log, and with nothing minted its records are deferred too.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a LANE_START_SESSION_ID=0 \
-    "$START" --dir "$AG_DIR" repoAG-10 --no-launch
-is    "a default-agent start with no uuid to name exits 0" "$rc" 0
-has   "…deferring its records to the session's own first act" "$(ag_deferred "$err")" "--no-launch repoAG 10"
-hasnt "…and naming no agent in it" "$(ag_deferred "$err")" "--agent"
-
-# A LANE WITH NO ROW IS A `STARTED`, WHATEVER BRANCH LAUNCHED IT. `--agent` and
-# the `/ctx` seam both set the verb to RESUMED because they resume a lane that
-# PAUSED; a lane the register has never carried has paused nothing, and a
-# RESUMED opening its object log is a line no reader can pair with a start.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="agsess:@41" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$AG_DIR" --agent claude repoAG-9 --no-launch
-is    "--agent claude on a lane with NO row exits 0" "$rc" 0
-has   "…saying there is nothing to have resumed" "$err" "no row yet"
-has   "…and the object log opens with a STARTED" "$(cat "$LOGD/repoAG-9.md")" "STARTED — lane repoAG-9"
-hasnt "…never a RESUMED for a lane that has paused nothing" "$(cat "$LOGD/repoAG-9.md")" "RESUMED"
-
-# `LANE_START_FRESH=1` — the seam /ctx respawns through: a NEW session of this
-# lane's agent, primed by the top block, even though the transcript is here.
-FRESH_DIR="$HOME/projects/repoFR"
-mkdir -p "$FRESH_DIR"
-git init -q -b main "$FRESH_DIR"
-git -C "$FRESH_DIR" remote add origin "https://github.com/opensoft/repoFR.git"
-fr_tdir="$HOME/.claude/projects/$(sanitize "$FRESH_DIR")"
-mkdir -p "$fr_tdir"
-printf '{"type":"user"}\n' > "$fr_tdir/$HF3_ID.jsonl"
-mkdir -p "$WIP/handoffs/repoFR"
-{ printf 'Lane: repoFR-1 (team-05a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$HF3_ID"
-  printf '\n'
-  printf '## RESUME PROMPT — the top block of repoFR-1\n'
-} > "$WIP/handoffs/repoFR/repoFR-1.md"
-git -C "$WIP" add -- handoffs/repoFR >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoFR handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoFR-1\` | harness \`$HF3_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoFR/repoFR-1.md | ACTIVE |" >/dev/null 2>&1
-
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="frsess:@51" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$FRESH_DIR" repoFR-1 --no-launch
-is    "without the seam, a lane whose transcript is here resumes it by id" "$rc" 0
-has   "…exactly as Amendment 6 has always done" "$out" "--resume $HF3_ID"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="frsess:@51" CLAUDE_PROFILE_NAME=team-05a \
-    LANE_START_FRESH=1 "$START" --dir "$FRESH_DIR" repoFR-1 --no-launch
-is    "with LANE_START_FRESH=1 the same lane takes a NEW session" "$rc" 0
-hasnt "…never a resume of the transcript the /ctx just paused" "$out" "--resume $HF3_ID"
-has   "…named for the lane" "$out" "--name repoFR-1 --session-id"
-has   "…and primed by the handoff's top block" "$out" "the top block of repoFR-1"
-
-# ------------------------- 5. act 6: the transcript follows the lane
-
-# A SHARED `projects/` NEEDS NO MOVE, and that is the measured fact this act
-# shrank to (2026-09-14T12:35Z): on a launcher-configured workstation every
-# profile's `projects/` resolves to ONE directory.
-#
-# ITS OWN LANE, because the case is about the row's LAST id having a transcript
-# here: `repoFR-1`'s cell has since gained the uuid the `LANE_START_FRESH=1` run
-# minted, and that one has no transcript at all — which is the OTHER branch.
-mkdir -p "$HOME/.claude-profiles/profiles/opensoft/team/t3"
-ln -sfn "$HOME/.claude/projects" "$HOME/.claude-profiles/profiles/opensoft/team/t3/projects"
-SH_DIR="$HOME/projects/repoSH"
-SH_ID="a17a0007-7777-4000-8000-a17a00077777"
-mkdir -p "$SH_DIR"
-git init -q -b main "$SH_DIR"
-git -C "$SH_DIR" remote add origin "https://github.com/opensoft/repoSH.git"
-sh_tdir="$HOME/.claude/projects/$(sanitize "$SH_DIR")"
-mkdir -p "$sh_tdir"
-printf '{"type":"user"}\n' > "$sh_tdir/$SH_ID.jsonl"
-mkdir -p "$WIP/handoffs/repoSH"
-printf 'Lane: repoSH-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoSH/repoSH-1.md"
-git -C "$WIP" add -- handoffs/repoSH >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoSH handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoSH-1\` | harness \`$SH_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoSH/repoSH-1.md | ACTIVE |" >/dev/null 2>&1
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="shsess:@81" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SH_DIR" repoSH-1 --no-launch
-is    "lane-start says WHERE it found the transcript" "$rc" 0
-has   "…naming this profile's projects directory" "$err" "found in this profile's projects directory"
-has   "…and saying that directory is SHARED, so a profile switch moves nothing" "$err" "which IS the directory profile(s) t3 read too"
-has   "…and it resumes the lane by id, moving nothing" "$out" "--resume $SH_ID"
-
-# A PROFILE WHOSE `projects/` IS REALLY ANOTHER DIRECTORY: the transcript is
-# MOVED, a pointer is left, and the lane resumes by id.
-MV_DIR="$HOME/projects/repoMV"
-mkdir -p "$MV_DIR"
-git init -q -b main "$MV_DIR"
-git -C "$MV_DIR" remote add origin "https://github.com/opensoft/repoMV.git"
-MV_ID="a17a0005-5555-4000-8000-a17a00055555"
-t2_projects="$HOME/.claude-profiles/profiles/opensoft/team/t2/projects"
-mv_slug="$(sanitize "$MV_DIR")"
-mkdir -p "$t2_projects/$mv_slug"
-printf '{"type":"user"}\n' > "$t2_projects/$mv_slug/$MV_ID.jsonl"
-mkdir -p "$t2_projects/$mv_slug/$MV_ID"
-printf 'a sidecar file\n' > "$t2_projects/$mv_slug/$MV_ID/sidecar.txt"
-mkdir -p "$WIP/handoffs/repoMV"
-printf 'Lane: repoMV-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoMV/repoMV-1.md"
-git -C "$WIP" add -- handoffs/repoMV >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoMV handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoMV-1\` | harness \`$MV_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoMV/repoMV-1.md | ACTIVE |" >/dev/null 2>&1
-
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="mvsess:@61" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$MV_DIR" repoMV-1 --no-launch
-is    "a transcript in ANOTHER profile's own projects directory is followed" "$rc" 0
-has   "…and the move is said, with both directories" "$err" "moved into $HOME/.claude/projects/$mv_slug"
-is    "…the transcript is HERE now" \
-      "$( [ -f "$HOME/.claude/projects/$mv_slug/$MV_ID.jsonl" ] && echo yes || echo no )" yes
-is    "…its sibling directory came with it" \
-      "$( [ -f "$HOME/.claude/projects/$mv_slug/$MV_ID/sidecar.txt" ] && echo yes || echo no )" yes
-is    "…it is a MOVE and not a copy, because two live transcripts of one uuid diverge" \
-      "$( [ -f "$t2_projects/$mv_slug/$MV_ID.jsonl" ] && echo no || echo yes )" yes
-is    "…with a pointer left where it was" \
-      "$(ls "$t2_projects/$mv_slug" | grep -c "^$MV_ID.jsonl.moved-to-team-05a-")" 1
-has   "…and the lane resumes it by id" "$out" "--resume $MV_ID"
-
-# A UUID WHOSE HOLDER IS LIVE IN THE OTHER PROFILE IS A REFUSAL, NEVER A MOVE
-# (Amendment 18(h): one live process per transcript).
-LV_DIR="$HOME/projects/repoLV"
-mkdir -p "$LV_DIR"
-git init -q -b main "$LV_DIR"
-git -C "$LV_DIR" remote add origin "https://github.com/opensoft/repoLV.git"
-LV_ID="a17a0006-6666-4000-8000-a17a00066666"
-lv_slug="$(sanitize "$LV_DIR")"
-mkdir -p "$t2_projects/$lv_slug"
-printf '{"type":"user"}\n' > "$t2_projects/$lv_slug/$LV_ID.jsonl"
-mkdir -p "$HOME/.claude-profiles/profiles/opensoft/team/t2/sessions"
-# NAMED FOR ANOTHER LANE, BY A PERSON — so `live_holder`'s fifth test skips it
-# and this lane does not read as live at step 3. That is exactly the shape
-# Amendment 18(h) is written about: a SECOND PROCESS on one transcript that the
-# lane's own liveness read does not see, which is how three of them came to hold
-# this lane's id on 2026-09-14.
-write_record_ns "$HOME/.claude-profiles/profiles/opensoft/team/t2/sessions/live-lv.json" \
-  "$LV_ID" "$LIVE_PID" "$live_start" "othersess:@99.%99" "somewhere-else-9" "user" "idle"
-mkdir -p "$WIP/handoffs/repoLV"
-printf 'Lane: repoLV-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoLV/repoLV-1.md"
-git -C "$WIP" add -- handoffs/repoLV >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoLV handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoLV-1\` | harness \`$LV_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoLV/repoLV-1.md | ACTIVE |" >/dev/null 2>&1
-
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="lvsess:@71" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$LV_DIR" repoLV-1 --no-launch
-is    "a transcript a LIVE process holds in another profile is refused" "$rc" 2
-has   "…naming the pid" "$err" "pid $LIVE_PID"
-has   "…and where that process is" "$err" "othersess:@99.%99"
-has   "…and the rule it would have broken" "$err" "held by ONE live process"
-has   "…with the retire act" "$err" "lane-end repoLV-1 --retire"
-is    "…and the transcript was NOT moved" \
-      "$( [ -f "$t2_projects/$lv_slug/$LV_ID.jsonl" ] && echo yes || echo no )" yes
-
-# A HOLDER IS COUNTED BY THE ESTATE'S ONE LIVENESS CONTRACT, NOT BY `kill -0`
-# (opensoft/openRepoTools#56). `follow_transcript` used to test the pid alone, so
-# a record that had ENDED, or whose pid had been RECYCLED onto some other
-# process, read as a live holder and refused a lane that nothing held. It now
-# asks `lanes-edit.sh transcript-holders`, which is `record_is_live` — status not
-# ended, pid answers `kill -0`, `procStart` still the one the record wrote — and
-# every case below is a lane whose transcript sits in another profile and whose
-# one record the old scan counted.
-seed_follow_lane() {   # <repo> <id>: the repository, its transcript in t2's projects, its row
-  SFL_DIR="$HOME/projects/$1"
-  mkdir -p "$SFL_DIR"
-  git init -q -b main "$SFL_DIR"
-  git -C "$SFL_DIR" remote add origin "https://github.com/opensoft/$1.git"
-  SFL_SLUG="$(sanitize "$SFL_DIR")"
-  mkdir -p "$t2_projects/$SFL_SLUG"
-  printf '{"type":"user"}\n' > "$t2_projects/$SFL_SLUG/$2.jsonl"
-  mkdir -p "$WIP/handoffs/$1"
-  printf 'Lane: %s-1 — resume prompt\n\nx\n' "$1" > "$WIP/handoffs/$1/$1-1.md"
-  git -C "$WIP" add -- "handoffs/$1" >/dev/null 2>&1
-  git -C "$WIP" commit -q -m "seed the $1 handoff"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  "$E" add-row "| \`$1-1\` | harness \`$2\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/$1/$1-1.md | ACTIVE |" >/dev/null 2>&1
-}
-
-# STATUS `ended`, AND A PID THAT STILL ANSWERS. Named for another lane by a
-# person, as the live fixture above is, so the lane's own liveness read skips it.
-EN_ID="a17a0056-5656-4000-8000-a17a00565656"
-seed_follow_lane repoEN "$EN_ID"; EN_DIR="$SFL_DIR"; en_slug="$SFL_SLUG"
-write_record_ns "$HOME/.claude-profiles/profiles/opensoft/team/t2/sessions/ended-en.json" \
-  "$EN_ID" "$LIVE_PID" "$live_start" "othersess:@98.%98" "somewhere-else-9" "user" "ended"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="ensess:@72" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$EN_DIR" repoEN-1 --no-launch
-is    "a record whose status is ENDED is not a holder, whatever its pid answers" "$rc" 0
-has   "…and the transcript is followed" "$err" "moved into $HOME/.claude/projects/$en_slug"
-hasnt "…without a refusal naming a live process" "$err" "a LIVE process there holds it"
-is    "…it is HERE now" \
-      "$( [ -f "$HOME/.claude/projects/$en_slug/$EN_ID.jsonl" ] && echo yes || echo no )" yes
-
-# A `procStart` THAT IS NOT THE PID'S OWN: the pid was recycled onto another
-# process, which is the case the contract's third test exists for. That test
-# reads `/proc/<pid>/stat`, and `pid_alive` skips it where that file cannot be
-# read (macOS), so the case can only be set up where it can.
-PS_ID="a17a0057-5757-4000-8000-a17a00575757"
-if [ -r "/proc/$LIVE_PID/stat" ]; then
-  seed_follow_lane repoPS "$PS_ID"; PS_DIR="$SFL_DIR"; ps_slug="$SFL_SLUG"
-  write_record_ns "$HOME/.claude-profiles/profiles/opensoft/team/t2/sessions/recycled-ps.json" \
-    "$PS_ID" "$LIVE_PID" "999999999999" "othersess:@97.%97" "somewhere-else-9" "user" "idle"
-  run env PATH="$A17PATH" FAKE_TMUX_WINDOW="pssess:@73" CLAUDE_PROFILE_NAME=team-05a \
-      "$START" --dir "$PS_DIR" repoPS-1 --no-launch
-  is    "a record whose procStart is not the pid's own (a recycled pid) is not a holder" "$rc" 0
-  has   "…and the transcript is followed" "$err" "moved into $HOME/.claude/projects/$ps_slug"
-  hasnt "…without a refusal naming a live process" "$err" "a LIVE process there holds it"
-  is    "…it is HERE now" \
-        "$( [ -f "$HOME/.claude/projects/$ps_slug/$PS_ID.jsonl" ] && echo yes || echo no )" yes
-else
-  skip "a record whose procStart is not the pid's own is not a holder" "no readable /proc/<pid>/stat on this host: the contract's third test cannot run here, so no recycled pid can be told apart"
-fi
-
-# THE HELPER'S OWN EXITS, as `dup_check` reads them: 0 and 8 are answers, 2 is a
-# helper that predates the read, and anything else is a read that FAILED —
-# which is not "nothing holds it", and must not move a transcript out from under
-# a process that might.
-cat > "$SANDBOX/thfail" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  transcript-holders) printf 'lanes-edit: simulated failure\n' >&2; exit "${TH_RC:-3}" ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/thfail"
-TF_ID="a17a0058-5858-4000-8000-a17a00585858"
-seed_follow_lane repoTF "$TF_ID"; TF_DIR="$SFL_DIR"; tf_slug="$SFL_SLUG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="tfsess:@74" CLAUDE_PROFILE_NAME=team-05a \
-    REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/thfail" TH_RC=3 \
-    "$START" --dir "$TF_DIR" repoTF-1 --no-launch
-is    "a transcript-holders that FAILS refuses the follow, rather than reading as no holder" "$rc" 2
-has   "…naming the helper and its exit code" "$err" "transcript-holders $TF_ID exited 3"
-has   "…passing the helper's own stderr through" "$err" "lanes-edit: simulated failure"
-has   "…saying nothing was moved" "$err" "nothing was moved"
-is    "…and the transcript was NOT moved" \
-      "$( [ -f "$t2_projects/$tf_slug/$TF_ID.jsonl" ] && echo yes || echo no )" yes
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="tfsess:@74" CLAUDE_PROFILE_NAME=team-05a \
-    REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/thfail" TH_RC=2 \
-    "$START" --dir "$TF_DIR" repoTF-1 --no-launch
-is    "a helper that predates transcript-holders (exit 2) carries on, as dup_check does" "$rc" 0
-has   "…saying the read is not known here" "$err" "has no \`transcript-holders\` (exit 2)"
-has   "…and the transcript is followed" "$err" "moved into $HOME/.claude/projects/$tf_slug"
-
-# `--dry-run` MOVES NOTHING (Copilot round 1 on openRepoTools#47). This search
-# runs long before the dry-run exit at the foot of the command, and a run whose
-# last line is *nothing was renamed, written or launched* must not have moved a
-# person's transcript out of another profile to get there.
-DR_DIR="$HOME/projects/repoDR"
-DR_ID="a17a0008-8888-4000-8000-a17a00088888"
-mkdir -p "$DR_DIR"
-git init -q -b main "$DR_DIR"
-git -C "$DR_DIR" remote add origin "https://github.com/opensoft/repoDR.git"
-dr_slug="$(sanitize "$DR_DIR")"
-mkdir -p "$t2_projects/$dr_slug"
-printf '{"type":"user"}\n' > "$t2_projects/$dr_slug/$DR_ID.jsonl"
-mkdir -p "$WIP/handoffs/repoDR"
-printf 'Lane: repoDR-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoDR/repoDR-1.md"
-git -C "$WIP" add -- handoffs/repoDR >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoDR handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoDR-1\` | harness \`$DR_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoDR/repoDR-1.md | ACTIVE |" >/dev/null 2>&1
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="drsess:@91" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$DR_DIR" repoDR-1 --dry-run
-is    "a --dry-run that finds a transcript in another profile exits 0" "$rc" 0
-has   "…printing the move it WOULD make, with both paths" "$err" "PLAN mv $t2_projects/$dr_slug/$DR_ID.jsonl"
-has   "…and saying nothing was moved" "$err" "Nothing was moved"
-is    "…the transcript is exactly where it was" \
-      "$( [ -f "$t2_projects/$dr_slug/$DR_ID.jsonl" ] && echo yes || echo no )" yes
-is    "…and this profile has no copy of it" \
-      "$( [ -f "$HOME/.claude/projects/$dr_slug/$DR_ID.jsonl" ] && echo no || echo yes )" yes
-
-# THE MOVE IS ONE TRANSACTION. The `.jsonl`, its sibling `<uuid>/` state
-# directory and the pointer left behind are one act: a sibling orphaned in the
-# other profile is state the resumed session silently loses, so a step that
-# cannot complete PUTS BACK what the steps before it moved and refuses. A file
-# already sitting where the sibling directory must go is how that is asked.
-RB_DIR="$HOME/projects/repoRB"
-RB_ID="a17a0009-9999-4000-8000-a17a00099999"
-mkdir -p "$RB_DIR"
-git init -q -b main "$RB_DIR"
-git -C "$RB_DIR" remote add origin "https://github.com/opensoft/repoRB.git"
-rb_slug="$(sanitize "$RB_DIR")"
-mkdir -p "$t2_projects/$rb_slug/$RB_ID"
-printf '{"type":"user"}\n' > "$t2_projects/$rb_slug/$RB_ID.jsonl"
-printf 'a sidecar file\n' > "$t2_projects/$rb_slug/$RB_ID/sidecar.txt"
-mkdir -p "$HOME/.claude/projects/$rb_slug"
-printf 'not a directory\n' > "$HOME/.claude/projects/$rb_slug/$RB_ID"
-mkdir -p "$WIP/handoffs/repoRB"
-printf 'Lane: repoRB-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoRB/repoRB-1.md"
-git -C "$WIP" add -- handoffs/repoRB >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoRB handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoRB-1\` | harness \`$RB_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoRB/repoRB-1.md | ACTIVE |" >/dev/null 2>&1
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="rbsess:@92" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$RB_DIR" repoRB-1 --no-launch
-is    "a move whose SIBLING cannot follow is refused, not half made" "$rc" 2
-has   "…naming the sibling that could not follow" "$err" "sibling state directory"
-has   "…and saying the move was put back" "$err" "the move was put back"
-is    "…the transcript IS back where it was" \
-      "$( [ -f "$t2_projects/$rb_slug/$RB_ID.jsonl" ] && echo yes || echo no )" yes
-is    "…its sibling never left either" \
-      "$( [ -f "$t2_projects/$rb_slug/$RB_ID/sidecar.txt" ] && echo yes || echo no )" yes
-is    "…and this profile holds no half-moved transcript" \
-      "$( [ -f "$HOME/.claude/projects/$rb_slug/$RB_ID.jsonl" ] && echo no || echo yes )" yes
-is    "…and no pointer was left for a move that did not happen" \
-      "$(ls "$t2_projects/$rb_slug" | grep -c "moved-to-")" 0
-
-# AND AN OCCUPIED DESTINATION IS REFUSED BEFORE ANYTHING MOVES AT ALL (Copilot
-# round 3 on openRepoTools#47). `mv <dir> <existing dir>` does NOT fail — it
-# moves the source INSIDE it — so a `<uuid>/` already sitting here would take
-# the other profile's sidecar as `<uuid>/<uuid>/`, mark the sibling moved, and
-# resume with the transcript's state split from the transcript. Which of two
-# `<uuid>` directories is this lane's is not a thing to guess at.
-OC_DIR="$HOME/projects/repoOC"
-OC_ID="a17a0010-1010-4000-8000-a17a00101010"
-mkdir -p "$OC_DIR"
-git init -q -b main "$OC_DIR"
-git -C "$OC_DIR" remote add origin "https://github.com/opensoft/repoOC.git"
-oc_slug="$(sanitize "$OC_DIR")"
-mkdir -p "$t2_projects/$oc_slug/$OC_ID"
-printf '{"type":"user"}\n' > "$t2_projects/$oc_slug/$OC_ID.jsonl"
-printf 'the other profile.s sidecar\n' > "$t2_projects/$oc_slug/$OC_ID/sidecar.txt"
-mkdir -p "$HOME/.claude/projects/$oc_slug/$OC_ID"
-printf 'a sidecar that is ALREADY here\n' > "$HOME/.claude/projects/$oc_slug/$OC_ID/sidecar.txt"
-mkdir -p "$WIP/handoffs/repoOC"
-printf 'Lane: repoOC-1 — resume prompt\n\nx\n' > "$WIP/handoffs/repoOC/repoOC-1.md"
-git -C "$WIP" add -- handoffs/repoOC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoOC handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-"$E" add-row "| \`repoOC-1\` | harness \`$OC_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoOC/repoOC-1.md | ACTIVE |" >/dev/null 2>&1
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="ocsess:@93" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$OC_DIR" repoOC-1 --no-launch
-is    "a destination that already holds that uuid is refused before anything moves" "$rc" 2
-has   "…naming what already sits there" "$err" "ALREADY SITS where it would go"
-is    "…the transcript never left the other profile" \
-      "$( [ -f "$t2_projects/$oc_slug/$OC_ID.jsonl" ] && echo yes || echo no )" yes
-is    "…and nothing was nested inside the directory that was already here" \
-      "$( [ -e "$HOME/.claude/projects/$oc_slug/$OC_ID/$OC_ID" ] && echo no || echo yes )" yes
-is    "…which still holds exactly what it held" \
-      "$(cat "$HOME/.claude/projects/$oc_slug/$OC_ID/sidecar.txt")" "a sidecar that is ALREADY here"
-
-# ------------------------------------------- 6. the three names are one act
-
-hfsk="$(cat "$SRC_DIR/skills/handoff/SKILL.md")"
-lssk="$(cat "$SRC_DIR/skills/lane-swap/SKILL.md")"
-swcmd="$(cat "$SRC_DIR/commands/swap.md")"
-hfcmd="$(cat "$SRC_DIR/commands/handoff.md")"
-ctxcmd="$(cat "$SRC_DIR/commands/ctx.md")"
-has   "the handoff skill is the act itself" "$hfsk" "# \`/handoff\` — hand this lane off"
-has   "…and names the shell form as the same steps" "$hfsk" "\`lane-handoff\` is these same steps as one command"
-has   "the lane-swap skill is an ALIAS of it" "$lssk" "Invoke the \`handoff\` skill now"
-hasnt "…restating none of its steps" "$lssk" "## 4. Write the swap record"
-has   "the /swap command names the same skill" "$swcmd" "Invoke the \`handoff\` skill now"
-has   "the /handoff command names it too" "$hfcmd" "Invoke the \`handoff\` skill now"
-has   "and /ctx is that skill with --restart" "$ctxcmd" "with \`--restart\`"
-has   "…which is what the amendment calls it" "$ctxcmd" "/ctx\` is \`/handoff --restart\`"
-has   "the skill carries Amendment 17(b)'s two sub-fields where the record is written" "$hfsk" "agent \$agent_name; transcript \$transcript_id"
-has   "…and the WRITERS section in its top block" "$hfsk" "**WRITERS at <UTC>**"
-has   "the skill's top block carries Addendum 1 (i)'s count, in the same words the command writes" \
-      "$hfsk" "FIRST count the live writers"
-has   "…a live writer owning its worktree, messaged rather than relaunched" \
-      "$hfsk" "A writer still live OWNS its worktree"
-has   "…and the count beating the list where the two disagree" "$hfsk" "THE COUNT WINS"
-has   "…with clause (k) in the first acts" "$hfsk" "ONE WORKTREE, ONE WRITER"
-has   "…and the THREE kinds, with what each tells the next session to EXPECT" \
-      "$hfsk" "kind <in-process|respawn|unknown>"
-has   "…the in-process one expecting every writer live" "$hfsk" "expect every writer below live"
-has   "…and the unknown one, which a plain handoff cannot know (Addendum 1 (h))" \
-      "$hfsk" "THIS HANDOFF CANNOT KNOW WHICH KIND FOLLOWED IT"
-has   "the skill's own record writer carries the kind sub-field too" "$hfsk" 'payload="$payload; kind $kind"'
-has   "…and the free text after the why, in the addendum's spelling" "$hfsk" "kind unknown"
-has   "…and its row write SETS the whole cell, as the command does (Amendment 13(a))" \
-      "$hfsk" 'set-row-state "$lane" "PAUSED · $hs_line"'
-has   "…with the line cut where a cut cannot land inside a character" "$hfsk" 'hs_line="${hs_line% *} ..."'
-hasnt "…and never the anchor the two writes it replaced had to guess at" "$hfsk" '"$state" "$state_new" "swap"'
-has   "…and the measured fact that is the whole reason for the distinction" \
-      "$hfsk" "mints a NEW TRANSCRIPT ID IN THE SAME PROCESS"
-# openRepoTools#94 — THE SKILL'S `/ctx` STEP IS ONE COMMAND, AND CARRIES NO
-# RECIPE OF ITS OWN. It used to spell out the destructive tail in shell —
-# `tmux respawn-pane -k -t "$pane" "LANE_START_FRESH=1 lane $lane"`, chosen by
-# `if command -v lane` — for a session to run against its own pane. On
-# 2026-09-15T20:59Z that is what ran, with two environment assignments the model
-# added on the spot, and the pane came back RESUMING the transcript the handoff
-# had just paused. Two copies of one procedure that must stay byte-equal is the
-# rejected alternative everywhere else in this file, and the one place it was
-# allowed is the one place a session kills its own pane.
-#
-# THE ASSERTIONS ARE THEREFORE ABOUT ABSENCE AS MUCH AS PRESENCE, and the
-# absent ones are `hasnt` on the EXECUTABLE forms: the file still QUOTES the old
-# line, in the paragraph that explains why it is gone, so a `has` on the string
-# alone would go green on the obituary.
-has   "the skill's /ctx step is the one command that owns the act" "$hfsk" 'lane-handoff --restart "$why"'
-has   "…and where the old recipe appears at all, it is as the thing that was REMOVED" \
-      "$hfsk" "THE TMUX RECIPE THAT USED TO BE HERE IS GONE"
-hasnt "…with no \`command -v lane\` choosing between two doors in prose" \
-      "$hfsk" 'if command -v lane >/dev/null 2>&1; then'
-hasnt "…and no window read of its own left to feed one" "$hfsk" "#{session_name}:#{window_id}"
-has   "…naming what tmux is asked to start instead, by absolute path" \
-      "$hfsk" "lane-handoff --supervise --lane <lane> --operation <id>"
-has   "…and saying why an environment seam could not carry the fresh session" \
-      "$hfsk" "tmux SERVER's environment"
-has   "…with the restart intent as the fourth gate before the kill" "$hfsk" "RESTART INTENT written to"
-has   "…and \`lane <name>\` kept as the PERSON's door and not as this one" \
-      "$hfsk" "IS STILL A PERSON'S DOOR AND IS NO LONGER THIS ONE"
-hasnt "…which is never \`restart <lane>\`" "$hfsk" 'respawn-pane -k -t "$pane" "restart'
-
-section "== Amendment 18 Addendum 1: the word \`lane\`, the numbered pick, the three branches =="
-#
-# AMENDMENT 18 ADDENDUM 1, RATIFIED 2026-09-14T14:05:54Z verbatim "ratify the
-# addendum", out of Brett Heap's two messages that morning — *"i dont understand
-# in another window i want to attach to that lane. what command do i use to do
-# that?"* and *"this is too hard for users. we need simple way to list the lanes
-# and then pick one to bind."* — and his answer to what the word should be,
-# verbatim "lane (Recommended)".
-#
-# FIVE STATES IN ONE REGISTER, because the pick is a PARTITION and a partition
-# is only proved by the rows it puts on each side:
-#
-#   repoPick-1  PAUSED, dir and profile recorded        AVAILABLE
-#   repoPick-7  a binding THIS host proves dead         AVAILABLE
-#   repoPick-2  LIVE, in the session this shell is in   LIVE HERE (select only)
-#   repoPick-3  LIVE, in a DETACHED session             LIVE HERE (move + select)
-#   repoPick-4  a binding on ANOTHER workstation        BOUND ELSEWHERE
-#   repoPick-5  ENDED                                   HIDDEN (Amendment 19)
-#
-# THE NUMBERS ARE THE READ'S ORDER AND THE STAMPS DECIDE THEM: rows come back
-# newest activity first, and the pick renders available, then live here, then
-# bound elsewhere, numbering as it goes. So the six stamps above descend in the
-# order the list is read in — 10:00, 09:50, 09:40, 09:30, 09:20 — and the
-# answers below are 1 repoPick-1 · 2 repoPick-7 · 3 repoPick-2 · 4 repoPick-3 ·
-# 5 repoPick-4. A case that hard-codes a number without pinning the stamp is a
-# case that passes for the wrong reason.
-#
-# THE FAKE TMUX IS THIS SECTION'S OWN, in a directory of its own put FIRST on
-# PATH for these cases only. The suite's shared fake answers the reads
-# `lane-start`, `lane-end` and `window-lane` make; this one answers the four
-# `lane` makes (`#S`, `#{session_name}`, `#{window_index}`, `#{session_attached}`)
-# and LOGS the three acts — `move-window`, `select-window`, `switch-client` and
-# the `attach` — so the attach can be watched without a tmux server. Its window
-# table is `<@id><TAB><session><TAB><index><TAB><attached><TAB><name>`.
-mkdir -p "$SANDBOX/lanebin"
-cat > "$SANDBOX/lanebin/tmux" <<'FAKE'
-#!/usr/bin/env bash
-lt_by_id()   { printf '%s\n' "${LANE_TMUX_WINDOWS:-}" | awk -F'\t' -v t="${1##*:}" '$1 == t { print; exit }'; }
-lt_by_sess() { printf '%s\n' "${LANE_TMUX_WINDOWS:-}" | awk -F'\t' -v s="$1" '$2 == s { print; exit }'; }
-case "${1-}" in
-  list-windows)
-    printf '%s\n' "${LANE_TMUX_WINDOWS:-}" | awk -F'\t' 'NF >= 5 { print $1 "\t" $5 }' ;;
-  display-message)
-    shift
-    lt_t=""; lt_f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -p) shift ;;
-        -t) lt_t="${2-}"; shift 2 ;;
-        *)  lt_f="$1"; shift ;;
-      esac
-    done
-    if [ -z "$lt_t" ]; then
-      case "$lt_f" in
-        '#S') printf '%s\n' "${LANE_TMUX_THIS:-}" ;;
-        *)    printf '\n' ;;
-      esac
-      exit 0
-    fi
-    lt_l="$(lt_by_id "$lt_t")"
-    [ -n "$lt_l" ] || lt_l="$(lt_by_sess "$lt_t")"
-    [ -n "$lt_l" ] || exit 1
-    case "$lt_f" in
-      '#{session_name}')     printf '%s\n' "$(printf '%s' "$lt_l" | cut -f2)" ;;
-      '#{window_index}')     printf '%s\n' "$(printf '%s' "$lt_l" | cut -f3)" ;;
-      '#{session_attached}') printf '%s\n' "$(printf '%s' "$lt_l" | cut -f4)" ;;
-      '#{window_id}')        printf '%s\n' "$(printf '%s' "$lt_l" | cut -f1)" ;;
-      '#{window_name}')      if [ -n "${LANE_TMUX_NAME_FILE:-}" ] && [ -s "$LANE_TMUX_NAME_FILE" ] &&
-                                [ "$(cut -f1 "$LANE_TMUX_NAME_FILE")" = "$(printf '%s' "$lt_l" | cut -f1)" ]; then
-                               cut -f2- "$LANE_TMUX_NAME_FILE"
-                             else
-                               printf '%s\n' "$(printf '%s' "$lt_l" | cut -f5)"
-                             fi ;;
-      *)                     printf '\n' ;;
-    esac ;;
-  rename-window)
-    [ "${2-}" = -t ] || exit 1
-    lt_id="${3##*:}"
-    printf '%s\t%s\n' "$lt_id" "${4-}" > "${LANE_TMUX_NAME_FILE:?}"
-    printf '%s\n' "$*" >> "${LANE_TMUX_LOG:-/dev/null}" ;;
-  select-window)
-    # THE ONE ACT THAT CAN FAIL AFTER THE FENCE HAS PASSED: the window resolved
-    # a moment ago and is gone by the time it is selected. `$LANE_TMUX_SELECT_FAIL`
-    # is that window, and nothing is logged — because nothing happened.
-    [ -z "${LANE_TMUX_SELECT_FAIL:-}" ] || exit 1
-    printf '%s\n' "$*" >> "${LANE_TMUX_LOG:-/dev/null}" ;;
-  move-window)
-    # THE MOVE CAN LOSE THE SAME RACE, and tmux refuses a `<session>:<@id>`
-    # whose window has left that session between the check and the act —
-    # measured on tmux 3.4, `can't find window: @2`, exit 1. Nothing is
-    # logged, because nothing happened.
-    [ -z "${LANE_TMUX_MOVE_FAIL:-}" ] || exit 1
-    printf '%s\n' "$*" >> "${LANE_TMUX_LOG:-/dev/null}" ;;
-  switch-client)
-    [ -z "${LANE_TMUX_SWITCH_FAIL:-}" ] || exit 1
-    printf '%s\n' "$*" >> "${LANE_TMUX_LOG:-/dev/null}" ;;
-  attach|attach-session)
-    printf '%s\n' "$*" >> "${LANE_TMUX_LOG:-/dev/null}" ;;
-  *) : ;;
-esac
-FAKE
-chmod +x "$SANDBOX/lanebin/tmux"
-export LANE_TMUX_LOG="$SANDBOX/lane-tmux.log"
-: > "$LANE_TMUX_LOG"
-export LANE_TMUX_THIS="picksess"
-export LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\trepoPick-2\n@32\tdetsess\t7\t0\trepoPick-3\n@33\tothersess\t1\t1\tother\n')"
-export LANE_TMUX_NAME_FILE="$SANDBOX/lane-tmux-name"
-LANEBIN_PATH="$SANDBOX/lanebin:$PATH"
-
-# THE ONE ANSWER, READ FROM A REAL TERMINAL. `[ -t 0 ]` is the whole of what
-# decides whether the question is asked, so a case that faked the test rather
-# than the terminal would prove nothing about the branch a person meets. This
-# runs the word under a pty, writes ONE line into it and collects everything the
-# terminal saw — stdout and stderr together, which is what a terminal is.
-#
-# THE DRIVER HAS A BOUND OF ITS OWN, AND IT IS NOBODY ELSE'S NUMBER
-# (opensoft/openRepoTools#107). It was 60 — the same 60 as `lanes-edit.sh`'s
-# `acquire_lock` and its `LANES_GIT_TIMEOUT` — and it was SIGKILLing the child
-# and handing back `128 + 9`, so a pick case reported `expected [2], got [137]`:
-# a wrong exit code that was really this driver's clock, and a helper that had
-# waited its own 60 s out and was about to say so could not be told from it.
-# Six CI runs are named in #107 alone — five on darwin, then one on Linux:
-# #61's `ready` run, both of whose Linux jobs went red with fourteen pick cases
-# at once — the killed case moving between runs, and not one of them was a
-# defect in `lane`.
-#
-# WHY IT WAS CROSSED: `lane` prints nothing until its listing is rendered,
-# because every read in front of the listing is a command substitution. Measured
-# on 2026-10-03, that silence was 32.6–33.4 s per call against main's fixture
-# register (75 rows) and 42.8–45.5 s against #61's (98) — and the slow Linux
-# runner that turned #61's `ready` run red took 62 minutes for a job that takes
-# 33–36, while darwin runs ~2.2x Linux (58 min against 26 on run 35043370287).
-# A 45 s silence is a ~100 s silence exactly where nobody is watching. The
-# silence itself was a QUADRATIC lookup in `lanes-edit.sh`'s `lanes_rows`, and
-# #107 fixed that too (one scoped read on this fixture, measured: 48.4 s → 2.9 s)
-# — but a bound has to stay true when the next register outgrows a fix, which
-# is why the number below is not tightened to match.
-#
-# WHY 240: more than twice that worst observed silence, and NONE of the numbers
-# this driver drives — not 60 (`acquire_lock`, `LANES_GIT_TIMEOUT`), not 300
-# (`lane --wait`'s handoff default) — so a helper's own refusal always arrives
-# first. It is a SILENCE bound: the clock restarts with every byte, so a long
-# case that keeps talking is never cut off. `LANE_PTY_SILENCE` overrides it for
-# the one case below that proves the timeout itself, which would otherwise wait
-# four minutes to do it.
-#
-# A TIMEOUT REPORTS AS A TIMEOUT. The child is a session leader (`pty.fork`
-# runs `setsid`), so its PROCESS GROUP is everything it started — `lane` and the
-# `lanes-edit.sh` reads under it, which a kill of the one pid left running. The
-# group gets SIGTERM, up to five seconds — until nothing in it is running — to
-# run its traps (a writer releases its lock in one), and then SIGKILL. A process
-# that does not also trap HUP loses that grace when the leader exits first: the
-# leader is the terminal's controlling process, and its exit hangs the terminal
-# up on the group, which is the kernel's act and not the driver's (a dead
-# holder's lock is `acquire_lock`'s to take over). The driver then says, on its
-# own stderr, that the child wrote nothing for that long and was killed, prints
-# the partial transcript after it, and exits 124 — `timeout(1)`'s code, never a
-# `128 + n` that reads as the child's. `lane_pick` below turns that report into
-# a FAIL of its own and sets `$rc` to the word `TIMEOUT`, so no case can read a
-# kill as the command's exit code again.
-LANE_PTY="$SANDBOX/pty-run.py"
-LANE_PTY_SILENCE=240
-LANE_PTY_TIMEOUT_MARK="pty-run: TIMEOUT"
-cat > "$LANE_PTY" <<'PY'
-import os, pty, select, signal, subprocess, sys, time
-
-answer, argv = sys.argv[1], sys.argv[2:]
-
-
-# THE REAL `ps`, BY ITS PATH: this suite puts a FAKE `ps` first on PATH (it
-# answers `-p <pid>` out of `$FAKE_PS_RECORDS` and nothing else), and asked
-# through PATH this read came back empty and ended the grace at once.
-PS = next((p for p in ("/bin/ps", "/usr/bin/ps") if os.access(p, os.X_OK)), "ps")
-
-
-def group_running(pgid):
-    """Is anything in the child's process group still RUNNING? A group whose
-    every member is a zombie runs nothing -- and in a container whose pid 1
-    never reaps (this workstation's is `sleep infinity`) its zombies are never
-    collected, so `killpg(0)` alone would keep answering for them."""
-    try:
-        os.killpg(pgid, 0)
-    except ProcessLookupError:
-        return False
-    except PermissionError:
-        return True
-    try:
-        listing = subprocess.run([PS, "-A", "-o", "pgid=,stat="],
-                                 stdout=subprocess.PIPE, stderr=subprocess.DEVNULL,
-                                 universal_newlines=True, timeout=5).stdout
-    except Exception:
-        return True
-    for line in listing.splitlines():
-        fields = line.split()
-        if len(fields) >= 2 and fields[0] == str(pgid) and "Z" not in fields[1]:
-            return True
-    return False
-
-
-silence = int(os.environ.get("LANE_PTY_SILENCE") or "240")
-pid, fd = pty.fork()
-if pid == 0:
-    try:
-        os.execvp(argv[0], argv)
-    finally:
-        os._exit(127)
-os.write(fd, (answer + "\n").encode())
-seen = b""
-timed_out = False
-while True:
-    try:
-        ready, _, _ = select.select([fd], [], [], silence)
-    except OSError:
-        break
-    if not ready:
-        timed_out = True
-        break
-    try:
-        chunk = os.read(fd, 65536)
-    except OSError:
-        break
-    if not chunk:
-        break
-    seen += chunk
-status = None
-if timed_out:
-    try:
-        os.killpg(pid, signal.SIGTERM)
-    except OSError:
-        pass
-    # THE GRACE IS THE GROUP'S, NOT THE LEADER'S (Copilot and Codex, round 1
-    # on #146). `lane` can die on the SIGTERM at once while a writer under it is
-    # still in its trap releasing a lock; ending the grace when the LEADER is
-    # reaped would SIGKILL that writer a tenth of a second later. So the leader
-    # is reaped as it goes, and the five seconds run until nothing in the group
-    # is running.
-    deadline = time.time() + 5
-    while time.time() < deadline:
-        if status is None:
-            done, st = os.waitpid(pid, os.WNOHANG)
-            if done:
-                status = st
-        if status is not None and not group_running(pid):
-            break
-        time.sleep(0.1)
-    try:
-        os.killpg(pid, signal.SIGKILL)
-    except OSError:
-        pass
-    # Whatever the group said on its way out — a trap's last line — is part of
-    # the transcript, so it is drained rather than dropped.
-    while True:
-        try:
-            ready, _, _ = select.select([fd], [], [], 0)
-            chunk = os.read(fd, 65536) if ready else b""
-        except OSError:
-            break
-        if not chunk:
-            break
-        seen += chunk
-if status is None:
-    _, status = os.waitpid(pid, 0)
-text = seen.decode("utf-8", "replace")
-sys.stdout.write(text)
-if timed_out:
-    sys.stdout.flush()
-    sys.stderr.write(
-        "pty-run: TIMEOUT: the child wrote nothing for %ds and was killed "
-        "(its whole process group: SIGTERM, then SIGKILL). That is this "
-        "driver's bound, not the command's exit code. Partial transcript "
-        "follows:\n%s\n" % (silence, text))
-    sys.exit(124)
-sys.exit(os.WEXITSTATUS(status) if os.WIFEXITED(status) else 128 + os.WTERMSIG(status))
-PY
-HAVE_PTY=0
-python3 -c 'import pty' >/dev/null 2>&1 && HAVE_PTY=1
-NO_PTY_WHY="no python3 with pty on this host, so no terminal can be faked and the one question cannot be asked"
-# Did the last `run` of the driver end in its TIMEOUT? Its own stderr says so,
-# and nothing else writes there: the child's two streams are the terminal.
-pty_timed_out() { case "$err" in *"$LANE_PTY_TIMEOUT_MARK"*) return 0 ;; esac; return 1; }
-lane_pick() {   # <answer> <args to lane…>
-  run env PATH="$LANEBIN_PATH" LANE_PTY_SILENCE="$LANE_PTY_SILENCE" python3 "$LANE_PTY" "$@"
-  if pty_timed_out; then
-    bad "lane_pick $1: the pty driver's TIMEOUT, not the command's exit code" \
-        "the child wrote nothing for ${LANE_PTY_SILENCE}s and was killed; the driver's report and the partial transcript follow"
-    while IFS= read -r lp_line; do printf '       | %s\n' "$lp_line"; done <<EOF
-$err
-EOF
-    rc=TIMEOUT
-  fi
-}
-
-# AND THE DRIVER'S TIMEOUT IS ITSELF UNDER TEST, because the property is the
-# point: a silent child must come back as the driver's report and never as a
-# `137`. One second of silence instead of 240, and a grandchild in the group, so
-# the case also proves that nothing the child started runs on after its case.
-if [ "$HAVE_PTY" = 0 ]; then
-  skip "the pty driver reports a silent child as its own TIMEOUT, never as a 137" "$NO_PTY_WHY"
-else
-  pty_orphan="$SANDBOX/pty-orphan.pid"; rm -f -- "$pty_orphan"
-  run env LANE_PTY_SILENCE=1 python3 "$LANE_PTY" x \
-      sh -c 'printf "partial\n"; sleep 30 & printf "%s\n" "$!" > "$0"; wait' "$pty_orphan"
-  is    "a child silent past the driver's bound exits the driver's 124, never a SIGKILL read as its own code (137)" "$rc" 124
-  has   "…saying in terms that it timed out, with the bound it waited" "$err" "the child wrote nothing for 1s and was killed"
-  has   "…printing the partial transcript after its report" "$err" "partial"
-  has   "…and the same transcript on stdout, where every case reads it" "$out" "partial"
-  pty_timed_out; is "…which is the report lane_pick turns into a FAIL of its own" "$?" 0
-  # RUNNING, AS OPPOSED TO GONE OR DEAD AND UNREAPED. `kill -0` answers for a
-  # zombie, and a killed grandchild is reparented to pid 1 — which in a
-  # container may be `sleep infinity` and reap nothing, ever (measured on this
-  # workstation: state `Z`, parent 1). A zombie runs nothing, so it is gone.
-  # The REAL `ps`, by its path, for the driver's reason: the fake one first on
-  # PATH answers nothing for this pid, and an empty answer read as "gone" made
-  # this case pass without asking anything.
-  pty_ps=/bin/ps; [ -x "$pty_ps" ] || pty_ps=/usr/bin/ps
-  pty_running() {   # <pid>
-    [ -n "${1-}" ] && kill -0 "$1" 2>/dev/null || return 1
-    case "$("$pty_ps" -o stat= -p "$1" 2>/dev/null)" in '' | *Z*) return 1 ;; esac
-    return 0
-  }
-  pty_gc="$(cat "$pty_orphan" 2>/dev/null || :)"
-  pty_n=0
-  while pty_running "$pty_gc" && [ "$pty_n" -lt 50 ]; do
-    sleep 0.1; pty_n=$((pty_n + 1))
-  done
-  is    "…and the child's whole process group went with it, so no helper runs on after its case" \
-        "$([ -n "$pty_gc" ] && ! pty_running "$pty_gc" && printf gone || printf 'still running: %s' "${pty_gc:-no pid recorded}")" "gone"
-  # AND THE SIGTERM'S GRACE IS THE GROUP'S, NOT THE LEADER'S (Copilot and Codex,
-  # round 1 on #146): the leader here dies on the SIGTERM at once, and the
-  # grandchild under it takes a second in its trap — a writer releasing its
-  # lock, in miniature. Its cleanup must finish before the SIGKILL comes.
-  # IT TRAPS HUP AS WELL, AND THAT IS THE KERNEL'S PART, NOT THE DRIVER'S. The
-  # leader is the terminal's controlling process, so when it exits the kernel
-  # hangs the terminal up on the whole foreground group — measured: without the
-  # HUP in this trap the grandchild dies mid-cleanup under either driver loop.
-  # No driver can stop that; what this proves is that the DRIVER no longer cuts
-  # the grace short, which the old loop did a tenth of a second after the
-  # leader was reaped.
-  pty_clean="$SANDBOX/pty-cleaned"; rm -f -- "$pty_clean"
-  cat > "$SANDBOX/pty-trap-child.sh" <<'SH'
-trap 'sleep 1; printf "cleaned\n" > "$1"; exit 0' TERM HUP
-while :; do sleep 0.1; done
-SH
-  run env LANE_PTY_SILENCE=1 python3 "$LANE_PTY" x \
-      sh -c 'printf "partial\n"; sh "$0" "$1" & wait' "$SANDBOX/pty-trap-child.sh" "$pty_clean"
-  is    "…and a descendant still in its SIGTERM trap when the leader has gone is given its grace" \
-        "$(cat "$pty_clean" 2>/dev/null || printf 'killed before its trap finished')" "cleaned"
-  is    "…which is still the driver's timeout" "$rc" 124
-  run env LANE_PTY_SILENCE=5 python3 "$LANE_PTY" x sh -c 'printf "answered\n"; exit 7'
-  is    "…while a child that answers keeps its OWN exit code" "$rc" 7
-  pty_timed_out; is "…and is not reported as a timeout" "$?" 1
-fi
-
-# ------------------------------------------------------------- the fixtures
-PICK_DIR="$HOME/projects/repoPick"
-mkdir -p "$PICK_DIR"
-git init -q -b main "$PICK_DIR"
-git -C "$PICK_DIR" remote add origin "https://github.com/opensoft/repoPick.git"
-PICK1_ID="dddd0001-1111-4000-8000-dddd00011111"
-PICK2_ID="dddd0002-2222-4000-8000-dddd00022222"
-PICK3_ID="dddd0003-3333-4000-8000-dddd00033333"
-PICK4_ID="dddd0004-4444-4000-8000-dddd00044444"
-PICK5_ID="dddd0005-5555-4000-8000-dddd00055555"
-PICK7_ID="dddd0007-7777-4000-8000-dddd00077777"
-# The two LIVE ones are live because a real process is: the same `sleep` every
-# liveness case in this file leans on, under two session ids of their own.
-write_record "$sessions_dir/pick-here.json" "$PICK2_ID" "$LIVE_PID" "$live_start" "picksess:@31.%31" "repoPick-2" "busy"
-write_record "$sessions_dir/pick-det.json"  "$PICK3_ID" "$LIVE_PID" "$live_start" "detsess:@32.%32"  "repoPick-3" "idle"
-add_seed_row "| \`repoPick-1\` | harness \`$PICK1_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/1.md | ACTIVE |"
-add_seed_row "| \`repoPick-2\` | harness \`$PICK2_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/2.md | ACTIVE |"
-add_seed_row "| \`repoPick-3\` | harness \`$PICK3_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/3.md | ACTIVE |"
-add_seed_row "| \`repoPick-4\` | harness \`$PICK4_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/4.md | ACTIVE |"
-add_seed_row "| \`repoPick-5\` | harness \`$PICK5_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/5.md | ACTIVE |"
-add_seed_row "| \`repoPick-7\` | harness \`$PICK7_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoPick/7.md | ACTIVE |"
-{ printf '# lane repoPick-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoPick-1, session %s@Eagle, 2026-09-12T09:00:00Z, lane:repoPick-1 → home opensoft/repoPick; estate repoPick; dir %s; profile team-05a\n' "$PICK1_ID" "$PICK_DIR"
-  printf 'PAUSED — lane repoPick-1, session %s@Eagle, 2026-09-12T10:00:00Z, lane:repoPick-1 → swap; dir %s; profile team-05a; workstation Eagle\n' "$PICK1_ID" "$PICK_DIR"
-} > "$LOGD/repoPick-1.md"
-{ printf '# lane repoPick-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoPick-2, session %s@Eagle, 2026-09-12T09:40:00Z, lane:repoPick-2 → home opensoft/repoPick; estate repoPick; dir %s; profile team-05a; window picksess:3 @31\n' "$PICK2_ID" "$PICK_DIR"
-} > "$LOGD/repoPick-2.md"
-{ printf '# lane repoPick-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoPick-3, session %s@Eagle, 2026-09-12T09:30:00Z, lane:repoPick-3 → home opensoft/repoPick; estate repoPick; dir %s; profile team-05a; window detsess:7 @32\n' "$PICK3_ID" "$PICK_DIR"
-} > "$LOGD/repoPick-3.md"
-# BOUND ELSEWHERE is a STARTED that never paused, on a workstation this host
-# cannot see the session records of: `lanes_rows` cannot prove it dead and this
-# machine has no way to say NOT LIVE about Raven.
-{ printf '# lane repoPick-4 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'RESUMED — lane repoPick-4, session %s@Raven, 2026-09-12T09:20:00Z, lane:repoPick-4 → home opensoft/repoPick; estate repoPick; dir /elsewhere/repoPick; profile team-09z; window ravensess:2 @44\n' "$PICK4_ID"
-} > "$LOGD/repoPick-4.md"
-{ printf '# lane repoPick-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoPick-5, session %s@Eagle, 2026-09-12T09:40:00Z, lane:repoPick-5 → home opensoft/repoPick; estate repoPick; dir %s; profile team-05a\n' "$PICK5_ID" "$PICK_DIR"
-  printf 'ENDED — lane repoPick-5, session %s@Eagle, 2026-09-12T11:40:00Z, lane:repoPick-5 — window closing; NOTHING IN FLIGHT\n' "$PICK5_ID"
-} > "$LOGD/repoPick-5.md"
-# A BINDING THIS HOST PROVES DEAD: a STARTED on THIS workstation with no live
-# session record naming its id. That is the second half of "available", and the
-# half a person is likeliest to meet — a lane whose window was closed without a
-# swap.
-{ printf '# lane repoPick-7 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoPick-7, session %s@Eagle, 2026-09-12T09:50:00Z, lane:repoPick-7 → home opensoft/repoPick; estate repoPick; dir %s; profile team-05a\n' "$PICK7_ID" "$PICK_DIR"
-} > "$LOGD/repoPick-7.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the five states the pick partitions"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# THE TWO `next-free` WRAPPERS BOTH SURFACES NEED, made once here: `lane`'s
-# pick and `lanes`'s footer read the same helper and answer for it the same
-# way, so the cases that prove it read the same two fakes. `nfold` is the
-# un-upgraded workstation (2, the contract's own silent code); `nfbroke` is a
-# read that FAILED, which is never the same thing (Amendment 7(d)).
-cat > "$SANDBOX/nfold" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  next-free) printf "lanes-edit: unknown subcommand 'next-free'\n" >&2; exit 2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/nfold"
-cat > "$SANDBOX/nfbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  next-free) printf 'lanes-edit: simulated failure\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/nfbroke"
-
-# ------------------------------------- the partition, asked of the helper
-#
-# THE GROUPING IS A READ AND IS HELD AS ONE. `lane` renders it; `lanes-edit.sh
-# lane-groups` decides it, over the rows both words already have, so the two
-# surfaces cannot come to disagree about which lanes are free — the rule that
-# put column 10 in the read (A11 Addendum 4 ruling 7).
-# `--closed`, SINCE AMENDMENT 19(b): the listing no longer carries a CLOSED
-# lane at all, and the two assertions below are about what `lane-groups` and
-# `next-free` do WITH one — the partition dropping it, and its position staying
-# reserved. Read without it, both would be asserting over rows that no longer
-# hold an ENDED lane, and would pass while proving nothing.
-run env LANES_NO_FETCH=1 "$E" lanes --closed --prefix repoPick
-is   "the rows of the seeded repository read" "$rc" 0
-PICK_ROWS="$out"
-# THE TWO NARROWING FILTERS ARE CASE-BLIND ON BOTH SIDES, and since #107 the
-# lane's side is lower-cased without a process (`lower_into`) and the asked-for
-# side once, with `lc` (Copilot round 1 on #146). Asked in a spelling no row
-# carries, so a lowering that stopped happening on EITHER side drops every row
-# and the comparison says so; the row's own spelling has `P` in it, so the
-# lane's side is never already lower-case.
-# Each mixed-case read is also asked for a seeded lane BY NAME, because two
-# empty lists are equal: measured, with `lower_into` broken to return its input,
-# both `--prefix` reads came back empty and the comparison alone still passed.
-pick_names() { printf '%s\n' "$1" | awk -F'\t' 'NF >= 2 { print $1 }' | LC_ALL=C sort; }
-run env LANES_NO_FETCH=1 "$E" lanes --closed --prefix REPOPICK
-has  "--prefix in another case still finds the seeded lanes" "$out" "repoPick-1"
-is   "…exactly the lanes of the row's own spelling" \
-     "$(pick_names "$out")" "$(pick_names "$PICK_ROWS")"
-run env LANES_NO_FETCH=1 "$E" lanes --closed --repo opensoft/repoPick
-pick_repo_rows="$out"
-run env LANES_NO_FETCH=1 "$E" lanes --closed --repo OpenSoft/REPOPICK
-has  "--repo in another case finds them too" "$out" "repoPick-1"
-is   "…exactly the lanes --repo in the home's own spelling lists" \
-     "$(pick_names "$out")" "$(pick_names "$pick_repo_rows")"
-pick_group_of() { printf '%s\n' "$PICK_GROUPS" | awk -F'\t' -v l="$1" '$2 == l { print $1; exit }'; }
-PICK_GROUPS="$(printf '%s\n' "$PICK_ROWS" | "$E" lane-groups Eagle)"
-is   "a PAUSED lane is AVAILABLE" "$(pick_group_of repoPick-1)" "available"
-is   "a lane a live session here holds is LIVE" "$(pick_group_of repoPick-2)" "live"
-is   "…and so is one in a detached session of this workstation" "$(pick_group_of repoPick-3)" "live"
-is   "a binding on ANOTHER workstation is BOUND ELSEWHERE" "$(pick_group_of repoPick-4)" "elsewhere"
-is   "a binding THIS host proves dead is AVAILABLE" "$(pick_group_of repoPick-7)" "available"
-is   "an ENDED lane is in no group at all (Amendment 19)" "$(pick_group_of repoPick-5)" ""
-# AND A `PAUSED` ROW OF ANOTHER WORKSTATION IS AVAILABLE HERE, which is the act
-# this whole word exists for and is asserted so that no reordering of that awk
-# can take it away quietly (Copilot round 10 on #45, `lanes-edit.sh:4870`, which
-# asked for exactly this case for exactly that reason — and round 9 and round 10
-# both read the same branch as a defect). `go_elsewhere`'s own refusal is the
-# contract, in the words a person reads: *"the exit is a person on <workstation>
-# parking it — `/lane-swap` in that session — after which it is PARKED and `lane
-# <lane>` takes it here"*. Fed straight to the helper, because the seeded rows of
-# this section are a partition of THIS workstation's and adding a sixth row to
-# them would renumber every pick below.
-is   "a PAUSED row of ANOTHER workstation is AVAILABLE, because parking IS the handoff" \
-     "$(printf 'someRepo-9\tPAUSED\tRaven\n' | "$E" lane-groups Eagle | cut -f1)" "available"
-is   "…while a BINDING of that same workstation is bound elsewhere, as it always was" \
-     "$(printf 'someRepo-9\tIDLE\tRaven\n' | "$E" lane-groups Eagle | cut -f1)" "elsewhere"
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoFX20-2
-is   "…and a RETIRED one is not either" "$(printf '%s\n' "$out" | "$E" lane-groups Eagle)" ""
-# THE NEXT FREE POSITION IS THE SAME READ'S, over the same rows, so `lane`'s `f`
-# and `lanes`'s footer cannot offer two different positions.
-is   "next-free is the LOWEST position no lane of that repository holds" \
-     "$(printf '%s\n' "$PICK_ROWS" | "$E" next-free repoPick)" "6"
-run env LANES_NO_FETCH=1 "$E" next-free
-is   "…and it refuses with the contract's 64 when no repository is named" "$rc" 64
-# A POSITION A LANE HAS HELD IS RESERVED, `ENDED` AND `RETIRED` INCLUDED, and a
-# NEIGHBOUR REPOSITORY'S LANES ARE NOT THIS ONE'S (Copilot round 7 on #45,
-# `lanes-edit.sh:4839` and `:4853`). The first is why `repoPick-5`, which ended
-# two fixtures ago, does not hand 5 back: a lane's identity is its name and its
-# object log is append-only, so a second lane at that position would write its
-# life into the first one's file. The second is a prefix test that read
-# `repo-foo-1` as a lane of `repo` and took a position out of its neighbour.
-is   "an ENDED lane's position is RESERVED and never handed out again" \
-     "$(printf '%s\n' "$PICK_ROWS" | "$E" next-free repoPick)" "6"
-is   "…and a neighbour repository's lanes take none of this one's positions" \
-     "$(printf 'repoNb-foo-1\nrepoNb-foo-2\n' | "$E" next-free repoNb)" "1"
-is   "…while its own, under the same names, are taken as they always were" \
-     "$(printf 'repoNb-1\nrepoNb-foo-2\nrepoNb-3a\n' | "$E" next-free repoNb)" "2"
-
-# ------------------------------------------------- the listing, and no question
-#
-# CLAUSE (i-3): with no terminal on stdin the word LISTS, SUGGESTS and ASKS
-# NOTHING. An agent's stdin is not a terminal, and every agent on this estate
-# reads this output rather than answering it — so this is the form the estate
-# itself meets, and it is run first.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" </dev/null
-is    "a bare lane inside a checkout exits 0" "$rc" 0
-has   "…heading its available lanes" "$out" "AVAILABLE"
-has   "…with the parked one numbered" "$out" "1  repoPick-1"
-has   "…naming its recorded profile and directory" "$out" "team-05a"
-has   "…heading the lanes that are LIVE HERE" "$out" "LIVE HERE"
-has   "…saying where the one in this session is, in clause (i-1)'s words" "$out" "window 3 of this session"
-has   "…and that the other is in a detached session" "$out" "detached session detsess"
-has   "…heading the lanes bound elsewhere" "$out" "BOUND ELSEWHERE"
-has   "…naming the workstation that holds it" "$out" "Raven"
-hasnt "…while a CLOSED lane is hidden from the pick entirely (Amendment 19)" "$out" "repoPick-5"
-hasnt "…and no question was asked" "$out$err" "which?"
-has   "…saying in terms why nothing was asked" "$out" "stdin is not a terminal"
-has   "…and offering the acts filled in, which is what an agent reads" "$out" "lane-start repoPick 6"
-# THE SAME ROWS AS A READ NO LONGER SHOW IT EITHER, since Amendment 19(b). The
-# pick hid a closed lane before the read did — a lane whose last act was its
-# last is not a lane a person picks — and now the read leaves it out too, and
-# puts it back under `--closed`, which the pick has no answer for. What has not
-# moved is the POSITION: closed or not, listed or not, `repoPick-5` holds 5.
-run env LANES_NO_FETCH=1 "$LANES_CMD" --prefix repoPick </dev/null
-hasnt "…and the listing no longer carries the closed lane either (Amendment 19(b))" "$out" "repoPick-5"
-has   "…and its footer offers the same next free position the pick does" "$out" "next free position:  6"
-has   "…and points at the word that binds one" "$out" "pick one:            lane"
-run env LANES_NO_FETCH=1 "$LANES_CMD" --closed --prefix repoPick </dev/null
-has   "…while --closed puts it back, because that is the READ" "$out" "repoPick-5"
-has   "…under a line saying which verb closed it" "$out" "closed: its object log ends with ENDED"
-
-# ------------------------------------------------------- one question, one answer
-if [ "$HAVE_PTY" = 0 ]; then
-  skip "the numbered pick asks one question on a terminal" "$NO_PTY_WHY"
-else
-  : > "$FAKE_PCLAUDE_LOG"
-  lane_pick 1 env -C "$PICK_DIR" "$LANE"
-  is    "answering with the number of an AVAILABLE lane exits 0" "$rc" 0
-  has   "…having asked exactly one question" "$out" "which? [1-"
-  has   "…which offers the new-lane answer with the position filled in" "$out" "f = a new lane at the next free position (repoPick-6)"
-  has   "…and the launch goes through the LAUNCHER, in the lane's own directory and profile" \
-        "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoPick-1 team-05a"
-  has   "…cd-ing there first (Evidence 3)" "$(cat "$FAKE_PCLAUDE_LOG")" "cwd=$PICK_DIR"
-  # A LANE LIVE IN THIS SESSION IS SELECTED AND NEVER STARTED AGAIN (clause (h)).
-  : > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-  lane_pick 3 env -C "$PICK_DIR" "$LANE"
-  is    "answering with a lane LIVE in this very session exits 0" "$rc" 0
-  has   "…selecting its window, the target SESSION-QUALIFIED so tmux picks nothing" \
-        "$(cat "$LANE_TMUX_LOG")" "select-window -t picksess:@31"
-  hasnt "…and moving nothing, because the window is already here" "$(cat "$LANE_TMUX_LOG")" "move-window"
-  is    "…launching NOTHING: an attach is never a second process" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-  # AND ONE IN A DETACHED SESSION IS MOVED HERE AND SELECTED — the two acts
-  # measured by hand on 2026-09-14.
-  : > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-  lane_pick 4 env -C "$PICK_DIR" "$LANE"
-  is    "answering with a lane live in a DETACHED session exits 0" "$rc" 0
-  has   "…moving its window into this session by its @id, never by an index" \
-        "$(cat "$LANE_TMUX_LOG")" "move-window -a -s detsess:@32"
-  has   "…and selecting it in THIS session, which is where the move put it" \
-        "$(cat "$LANE_TMUX_LOG")" "select-window -t picksess:@32"
-  is    "…and launching nothing here either" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-  # BOUND ELSEWHERE IS CLAUSE (c)'s QUESTION, WHICH EXISTS NOW (Amendment 18,
-  # opensoft/openRepoTools#38). The pick's one question leads to it — clause
-  # (i-2) routes this branch there by name — so the terminal is answered TWICE
-  # here: the number, then the handoff question. Answered N it is the refusal
-  # this branch has always been, in the words clause (c) gives it.
-  : > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-  lane_pick "$(printf '5\nn')" env -C "$PICK_DIR" "$LANE"
-  is    "answering with a lane bound ELSEWHERE asks clause (c)'s question, and N refuses with 2" "$rc" 2
-  has   "…naming the binding: the window, the container and the host" "$out" "in container none on host Raven"
-  has   "…and asking whether to ask that place for the handoff" "$out" "ask it to hand off, then bind here?"
-  has   "…the refusal naming the act that asks" "$out" "--request-handoff"
-  has   "…and the one word that overrides, which is a SECOND invocation" "$out" "--force"
-  is    "…launching nothing at all" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-  is    "…and touching no tmux either" "$(cat "$LANE_TMUX_LOG")" ""
-  # `f` IS A NEW LANE AT THE NEXT FREE POSITION, which is `lane-start`'s act and
-  # is printed here rather than run, so the register is left as this section
-  # found it.
-  : > "$FAKE_PCLAUDE_LOG"
-  lane_pick f env -C "$PICK_DIR" "$LANE" --dry-run
-  is    "answering \`f\` exits 0" "$rc" 0
-  has   "…naming the lane it would open" "$out" "a new lane at repoPick-6"
-  has   "…and the act, which is lane-start at that position" "$out" "lane-start repoPick 6"
-  is    "…launching nothing under --dry-run" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-  # …AND `--dir` GOES WITH IT (Copilot round 1 on #45, `lane:710`). The flag is
-  # in this word's own parser and `lane-start` takes the same one, so dropping
-  # it here would open the new lane in a checkout nobody named — Evidence 3's
-  # silent loss, at the one moment a lane is being created.
-  : > "$FAKE_PCLAUDE_LOG"
-  PICK_DIR_R="$(cd -- "$PICK_DIR" 2>/dev/null && pwd -P || printf '%s' "$PICK_DIR")"
-  lane_pick f env -C "$PICK_DIR" "$LANE" --dry-run --dir "$PICK_DIR"
-  is    "answering \`f\` with a --dir exits 0" "$rc" 0
-  has   "…handing that directory to lane-start, resolved" "$out" "--dir $PICK_DIR_R"
-  has   "…and still at the next free position" "$out" "repoPick 6"
-  # …AND `f` READS THE POSITION'S OWN STATUS (Copilot round 3 on #45,
-  # `lane:751`). `|| :` discarded it, so a read that FAILED after printing
-  # digits handed those digits to the validation below and opened a lane at a
-  # position this estate may well have taken.
-  : > "$FAKE_CLAUDE_LOG"
-  lane_pick f env -C "$PICK_DIR" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfbroke" "$LANE" --dry-run
-  is    "answering \`f\` where the position read FAILED refuses with 1" "$rc" 1
-  has   "…naming the code it got" "$out" "exited 6"
-  has   "…saying it will not open a lane at a position it did not get" "$out" "did not get"
-  is    "…and starting nothing" "$(cat "$FAKE_CLAUDE_LOG")" ""
-  # `q` PICKS NONE, AND THAT IS NOT A FAILURE.
-  : > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-  lane_pick q env -C "$PICK_DIR" "$LANE"
-  is    "answering \`q\` exits 0" "$rc" 0
-  has   "…saying nothing was picked" "$out" "nothing picked"
-  is    "…and doing nothing" "$(cat "$FAKE_PCLAUDE_LOG")$(cat "$LANE_TMUX_LOG")" ""
-  # AN ANSWER THAT IS NOT ONE OF THE CHOICES IS A REFUSAL AND NEVER A RE-ASK: one
-  # answer is read, and a process that holds the terminal for a second is the
-  # thing ratified decision 3 refused.
-  : > "$FAKE_PCLAUDE_LOG"
-  lane_pick 99 env -C "$PICK_DIR" "$LANE"
-  is    "a number outside the list refuses with 2" "$rc" 2
-  has   "…saying what the range was" "$out" "is not in 1-"
-  has   "…and that nothing is waiting now" "$out" "nothing is waiting"
-  is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-  lane_pick zzz env -C "$PICK_DIR" "$LANE"
-  is    "…and an answer that is not a number at all refuses the same way" "$rc" 2
-  has   "…naming what was typed" "$out" "'zzz' is not one of the choices"
-  # --switch IS THE OTHER ATTACH, for a person who wants the client moved rather
-  # than the window.
-  : > "$LANE_TMUX_LOG"
-  lane_pick 4 env -C "$PICK_DIR" "$LANE" --switch
-  is    "--switch exits 0 on a lane in another session" "$rc" 0
-  has   "…switching the client to that session" "$(cat "$LANE_TMUX_LOG")" "switch-client -t detsess"
-  has   "…naming the WINDOW in the switch itself, so no client can move it in between" \
-        "$(cat "$LANE_TMUX_LOG")" "switch-client -t detsess:@32"
-  hasnt "…and moving no window" "$(cat "$LANE_TMUX_LOG")" "move-window"
-fi
-
-# ------------------------------------------------- `lane <name>` on each branch
-#
-# The same three branches, reached by NAME rather than by number: one dispatch,
-# so a lane picked and a lane named cannot take different paths.
-: > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-run env PATH="$LANEBIN_PATH" "$LANE" repoPick-2 </dev/null
-is    "lane <name> on a lane LIVE in this session exits 0" "$rc" 0
-has   "…selecting its window and nothing else" "$(cat "$LANE_TMUX_LOG")" "select-window -t picksess:@31"
-is    "…and launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# A resumed session can still be live in the row's window while tmux calls the
-# window `claude`. The picker repairs that name before selecting the window.
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n@32\tdetsess\t7\t0\trepoPick-3\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a live lane in a claude-named window is repaired before attach" "$rc" 0
-has   "…renaming the exact window, not the caller's current one" "$(cat "$LANE_TMUX_LOG")" "rename-window -t picksess:@31 repoPick-2"
-has   "…then selecting that window" "$(cat "$LANE_TMUX_LOG")" "select-window -t picksess:@31"
-# Attaching to a LIVE HERE row is a local read. Both register-row probes must
-# keep the picker's no-fetch seam, including the probe of the old generic name.
-cat > "$SANDBOX/lane-no-fetch" <<'FAKE'
-#!/usr/bin/env bash
-if [ "${1-}" = register-row ] && [ "${LANES_NO_FETCH:-0}" != 1 ]; then
-  printf 'unexpected fetch-capable register-row\n' >&2
-  exit 7
-fi
-exec "${REAL_LANES_EDIT:?}" "$@"
-FAKE
-chmod +x "$SANDBOX/lane-no-fetch"
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANES_EDIT="$SANDBOX/lane-no-fetch" REAL_LANES_EDIT="$E" \
-    LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n@32\tdetsess\t7\t0\trepoPick-3\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "LIVE attachment keeps both register-row probes local" "$rc" 0
-has   "…and still repairs the generic name" "$(cat "$LANE_TMUX_LOG")" "rename-window -t picksess:@31 repoPick-2"
-# The live session may have been stamped only in this checkout: origin still
-# names the old UUID, while the local row and session record agree on the new.
-PICK2_NEW="dddd0002-2222-4000-8000-dddd00029999"
-cp "$LANES" "$SANDBOX/pick-before-local-stamp"
-awk -v old="$PICK2_ID" -v newer="$PICK2_NEW" '
-  index($0, "`repoPick-2`") { sub(old, old "`, resumed `" newer) }
-  { print }
-' "$SANDBOX/pick-before-local-stamp" > "$LANES"
-write_record "$sessions_dir/pick-here.json" "$PICK2_NEW" "$LIVE_PID" "$live_start" "picksess:@31.%31" "repoPick-2" "busy"
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n@32\tdetsess\t7\t0\trepoPick-3\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a local-only successor UUID still permits verified live attach" "$rc" 0
-has   "…and repairs its generic window" "$(cat "$LANE_TMUX_LOG")" "rename-window -t picksess:@31 repoPick-2"
-# The local successor must extend the published history, not merely end in
-# the live UUID. A divergent first UUID cannot justify renaming the window.
-PICK2_OTHER="dddd0002-2222-4000-8000-dddd00028888"
-sed "s/$PICK2_ID/$PICK2_OTHER/" "$LANES" > "$SANDBOX/pick-divergent"
-cp "$SANDBOX/pick-divergent" "$LANES"
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n@32\tdetsess\t7\t0\trepoPick-3\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a divergent local UUID history refuses live attach" "$rc" 2
-is    "…without renaming the window" "$(cat "$LANE_TMUX_LOG")" ""
-cp "$SANDBOX/pick-before-local-stamp" "$LANES"
-write_record "$sessions_dir/pick-here.json" "$PICK2_ID" "$LIVE_PID" "$live_start" "picksess:@31.%31" "repoPick-2" "busy"
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tClaude Code\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a non-lane-shaped generic window name is also repaired" "$rc" 0
-has   "…without treating that name as a failed register lookup" "$(cat "$LANE_TMUX_LOG")" "rename-window -t picksess:@31 repoPick-2"
-: > "$LANE_TMUX_LOG"; : > "$LANE_TMUX_NAME_FILE"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n@99\tothersess\t9\t1\tREPOPICK-2\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a second window already named for the lane refuses" "$rc" 2
-has   "…naming the conflicting window" "$err" "@99"
-is    "…without renaming or selecting" "$(cat "$LANE_TMUX_LOG")" ""
-: > "$LANE_TMUX_NAME_FILE"
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\trepoPick-3\n@32\tdetsess\t7\t0\tother\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a window named for another recorded lane cannot be taken over" "$rc" 2
-has   "…naming the other row" "$err" "repoPick-3, which has its own lane row"
-is    "…without renaming or attaching" "$(cat "$LANE_TMUX_LOG")" ""
-: > "$LANE_TMUX_NAME_FILE"
-# A /clear can mint a new transcript in the same window without updating the
-# register. A live picker must refuse rather than make its generic window name
-# look like a synchronized lane; lane-start --no-launch is the recording act.
-cat > "$SANDBOX/lane-stale-record" <<'FAKE'
-#!/usr/bin/env bash
-if [ "${1-}" = window-session ]; then
-  printf '%s\037%s\037%s\037%s\037%s\n' "${STALE_ID:?}" "$2.%31" repoPick-2 999 team-05a
-  exit 0
-fi
-exec "${REAL_LANES_EDIT:?}" "$@"
-FAKE
-chmod +x "$SANDBOX/lane-stale-record"
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANES_EDIT="$SANDBOX/lane-stale-record" \
-    REAL_LANES_EDIT="$E" STALE_ID="$PICK7_ID" \
-    LANE_TMUX_WINDOWS="$(printf '@31\tpicksess\t3\t1\tclaude\n')" \
-    "$LANE" repoPick-2 </dev/null
-is    "a live transcript newer than the row refuses automatic rename" "$rc" 2
-has   "…naming the same-window recording act" "$err" "lane-start --no-launch repoPick-2"
-is    "…without renaming or attaching" "$(cat "$LANE_TMUX_LOG")" ""
-: > "$LANE_TMUX_NAME_FILE"
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" "$LANE" repoPick-4 </dev/null
-is    "lane <name> on a lane bound elsewhere refuses with 2" "$rc" 2
-has   "…naming where it is bound, in clause (a)'s three facts" "$err" "in container none on host Raven"
-has   "…and, with no terminal to ask on, naming the flag that asks" "$err" "--request-handoff"
-is    "…and touching nothing" "$(cat "$LANE_TMUX_LOG")" ""
-# AND THE CONTAINER NOTICE REACHES THIS BRANCH, WHICH IS THE ONE THAT NEEDS IT
-# MOST. With no `$LANES_WORKSTATION` inside a container the workstation is the
-# CONTAINER'S id, so NO row is this workstation's — and the partition then files
-# a person's OWN lane under BOUND ELSEWHERE and refuses it by naming a machine
-# they are sitting at. The listing has carried the sentence since it was
-# written; `lane <name>` reaches this same refusal WITHOUT passing through the
-# listing, so a notice printed only beneath the rows never reaches the person
-# who typed the name. `repoPick-7` is a binding of THIS host, which is exactly
-# the row the unset seam turns into somebody else's.
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=1 PATH="$LANEBIN_PATH" "$LANE" repoPick-7 </dev/null
-is    "a lane of THIS host refuses as bound elsewhere once the seam is unset" "$rc" 2
-has   "…naming the workstation its row carries, which is its binding's host" "$err" "on host Eagle"
-has   "…and saying WHY this host is not that workstation" "$err" "LANES_WORKSTATION"
-has   "…in the one sentence its own writers refuse with" "$err" "is the CONTAINER"
-has   "…naming the launcher whose job the value is" "$err" "launcher"
-hasnt "…and never the workstation: key R-A11-14 rejected by name" "$err" "workstation: "
-# SAID ONCE PER RUN AND NEVER ONCE PER SURFACE: one run can reach both the
-# listing and this branch, and a person who picked a number out of a listing
-# that had already explained itself does not need the paragraph twice.
-is    "…and the sentence is said once, not once for every surface that wants it" \
-      "$(printf '%s' "$out$err" | tr -d '\r\n' | grep -o 'is the CONTAINER' | wc -l | tr -d ' ')" "1"
-# AND IT IS SILENT WHERE THE SEAM ANSWERED, so the notice means what it says.
-run env PATH="$LANEBIN_PATH" "$LANE" repoPick-4 </dev/null
-hasnt "an ordinary elsewhere refusal carries no container notice at all" "$err" "LANES_WORKSTATION"
-
-# AND A READ THIS COMMAND COULD NOT CAPTURE IS NOT A PROOF EITHER (Copilot round
-# 3 on #45, `lane:322`). With no writable `$TMPDIR` the helper's notes go
-# straight to the terminal and cannot be read back, so whether the liveness
-# records answered is UNKNOWN from here — and unknown is not "the proof was
-# made". Three states, not two.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX TMPDIR="$SANDBOX/no-such-tmpdir" PATH="$LANEBIN_PATH" "$LANE" repoPick-7 </dev/null
-is    "a binding refuses where this command could not read whether the proof was made" "$rc" 2
-has   "…saying the notes could not be read back" "$err" "no temporary file could be made"
-has   "…and that the answer is UNKNOWN rather than absent" "$err" "UNKNOWN from here"
-is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# …AND A `PAUSED` LANE IS NO EXCEPTION TO IT (Copilot round 4, `lane:560`): its
-# own last line is a LINE, and the proof is the read that did not happen.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX TMPDIR="$SANDBOX/no-such-tmpdir" PATH="$LANEBIN_PATH" "$LANE" repoPick-1 </dev/null
-is    "…and a PAUSED lane refuses on the unread state as well" "$rc" 2
-has   "…in that state's own words" "$err" "no temporary file could be made"
-is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# THE PICK SAYS WHY `f` IS NOT OFFERED (Copilot round 3 on #45, `lane:960`).
-# `|| :` collapsed every status of the next-free read and the answer simply
-# vanished from the question, which is a listing with an action missing and
-# nothing on screen about it — the defect `lanes`'s footer had one file over.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfold" "$LANE" </dev/null
-is    "the pick still lists where the next-free read is MISSING" "$rc" 0
-has   "…with the rows" "$out" "repoPick-1"
-has   "…saying in terms that \`f\` is not offered" "$out" "is not offered"
-has   "…and naming the act that brings it back" "$out" "openRepoTools --install"
-hasnt "…never offering a position it did not get" "$out" "lane-start repoPick"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfbroke" "$LANE" </dev/null
-is    "…and where that read FAILED it still lists" "$rc" 0
-has   "…saying so with the code it got" "$out" "exited 6"
-hasnt "…and never calls a failed read an un-upgraded workstation" "$out" "predates lane-collision-protocol Amendment 18"
-# A PROFILE CANNOT BE HANDED TO AN ATTACH, because an attach starts nothing.
-run env PATH="$LANEBIN_PATH" "$LANE" repoPick-2 team-09z </dev/null
-is    "lane <name> <profile> on a LIVE lane refuses rather than attaching under another name" "$rc" 2
-has   "…saying an attach starts nothing" "$err" "an attach starts nothing"
-has   "…and naming the act that does change a live lane's account" "$err" "/lane-swap"
-# A CLOSED LANE IS NO ANSWER (8) AND NEVER A LAUNCH.
-: > "$FAKE_PCLAUDE_LOG"
-run env PATH="$LANEBIN_PATH" "$LANE" repoPick-5 </dev/null
-is    "lane <name> on an ENDED lane exits 8" "$rc" 8
-has   "…saying its last act was its last" "$err" "last act was its last"
-is    "…and launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# THE WINDOW IS MATCHED BY ITS ID *AND* ITS SESSION NAME, which is the fence
-# clause (b) states for `window-lane` and the reason it exists: tmux reissues
-# `@` ids from `@0` when its server is replaced — measured on Eagle on
-# 2026-09-13, 0 of 5 recorded windows resolving — so attaching on the id alone
-# puts a person in whatever pane has since been given it.
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="$(printf '@31\tsomebody-elses-session\t0\t1\n')" "$LANE" repoPick-2 </dev/null
-is    "a recorded window whose id now names ANOTHER session is a refusal" "$rc" 2
-has   "…naming the session the id is in now and the one the record names" "$err" "is in session somebody-elses-session and the record says picksess"
-has   "…and the act that is still safe to type" "$err" "tmux attach -t picksess"
-is    "…having attached to nothing" "$(cat "$LANE_TMUX_LOG")" ""
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_WINDOWS="" "$LANE" repoPick-2 </dev/null
-is    "…and an id that names no window at all is the same refusal" "$rc" 2
-has   "…saying so" "$err" "names no window on this tmux server at all"
-is    "…and attaches to nothing" "$(cat "$LANE_TMUX_LOG")" ""
-
-# OUTSIDE TMUX THE ATTACH IS `tmux attach -t <session>:<@id>`, with the lane's
-# own window selected FIRST so the terminal lands on the lane rather than on
-# whichever window that session left current — and the WINDOW named in the
-# attach itself (Copilot round 6 on #45, `lane:708`), because a select and an
-# attach are two acts and a window that closes between them would leave the
-# second one on another lane. Measured on tmux 3.4: `attach -t <session>:<@id>`
-# attaches AND makes that window current in one act, and refuses outright for a
-# window that is not in that session.
-: > "$LANE_TMUX_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" "$LANE" repoPick-3 </dev/null
-is    "lane <name> outside tmux exits 0 on a live lane" "$rc" 0
-has   "…selecting the lane's own window first, in the session the record names" \
-      "$(cat "$LANE_TMUX_LOG")" "select-window -t detsess:@32"
-has   "…and then attaching to its session" "$(cat "$LANE_TMUX_LOG")" "attach -t detsess"
-has   "…naming the WINDOW in that attach too, so no act between the two can land elsewhere" \
-      "$(cat "$LANE_TMUX_LOG")" "attach -t detsess:@32"
-
-# A SELECT THAT FAILED IS PART OF THE FENCE AND NOT A COURTESY (Copilot round 1
-# on #45, `lane:610`). The id resolved at the check above and is gone by the
-# time it is selected — a window closed in the half-second between — and going
-# on would attach to whatever window that session left CURRENT, which is
-# another lane. That is the one thing the id-AND-session fence exists to stop,
-# so the swallowed failure is a refusal.
-: > "$LANE_TMUX_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" LANE_TMUX_SELECT_FAIL=1 "$LANE" repoPick-3 </dev/null
-is    "a select-window that FAILED refuses instead of attaching to the current window" "$rc" 2
-has   "…saying the window could not be selected" "$err" "could not be selected"
-has   "…and why going on would be wrong" "$err" "another lane"
-is    "…having attached to nothing at all" "$(cat "$LANE_TMUX_LOG")" ""
-# THE SAME FENCE ON THE MOVE, where the window has already been brought here:
-# the move is logged and the select still refuses rather than leaving the
-# terminal on a window nobody asked for.
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_SELECT_FAIL=1 "$LANE" repoPick-3 </dev/null
-is    "…and so does the one after a move-window" "$rc" 2
-has   "…saying what had already been done" "$err" "moved here out of detsess"
-has   "…and naming the session the window is in NOW, not the one it came from" \
-      "$err" "could not be selected in session picksess"
-hasnt "…so it never sends a person back to a source that may have closed" "$err" "tmux attach -t detsess"
-has   "…and the move itself is still in the log, because it happened" "$(cat "$LANE_TMUX_LOG")" "move-window"
-
-# A BINDING IS AVAILABLE BECAUSE THIS HOST PROVED IT DEAD, AND AN UNREAD
-# SESSION RECORD IS NOT THAT PROOF (Copilot round 1 on #45, `lane:777`).
-# `lanes_rows` says on STDERR — and goes on answering — that this workstation's
-# session records could not be read, in which case the STATE column is the
-# LOG'S VERB ALONE and a lane that is LIVE shows as IDLE. Launching one is a
-# second process on a running lane, which is the collision clause (h) is about.
-cat > "$SANDBOX/livewarn" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  lanes) printf "lanes-edit: this workstation's session records could not be read, so the STATE column below is the LOG's verb alone\n" >&2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/livewarn"
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/livewarn" "$LANE" repoPick-7 </dev/null
-is    "a BINDING refuses where the liveness read did not answer" "$rc" 2
-has   "…saying nothing proved that lane dead" "$err" "PROVED that lane dead"
-has   "…and naming the read that says what is actually running" "$err" "live-holder"
-is    "…launching nothing at all" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# …AND SO DOES A `PAUSED` ROW, WHICH IS THE ONE MOST LIKELY TO BE RUNNING
-# (Copilot round 4 on #45, `lane:560`). Round 1 passed `PAUSED` through on the
-# reading that a lane parked by its own last line needs no proof — but the
-# sentence this very refusal is reacting to says *"a lane that is live may show
-# as IDLE OR PAUSED here"* (`lanes-edit.sh:4628`), because a live record beats
-# the log's last verb and the verb is all that is left when the read fails
-# (`lanes-edit.sh:4700`). `/lane-swap` writes the PAUSED line while its session
-# is still on screen. The exception was a hole in the fence at its widest point.
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/livewarn" "$LANE" repoPick-1 </dev/null
-is    "…and a PAUSED lane refuses too, on the same unread proof" "$rc" 2
-has   "…saying a live lane shows as IDLE or PAUSED when the proof is missing" "$err" "IDLE or PAUSED"
-has   "…naming /lane-swap, which writes that line while its session is still up" "$err" "/lane-swap"
-is    "…launching nothing either" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# ---------------------------------------------------------- `--all`, grouped
-run env PATH="$LANEBIN_PATH" "$LANE" --all </dev/null
-is    "lane --all exits 0" "$rc" 0
-has   "…carrying this repository's lanes" "$out" "repoPick-1"
-has   "…and another repository's, which is what --all asks for" "$out" "repoA11-1"
-has   "…grouped by repository under each heading" "$out" "$(printf '\n  repoPick\n')"
-hasnt "…and no next-free position, because no one repository is in scope" "$out" "lane-start repoPick"
-run env PATH="$LANEBIN_PATH" "$LANE" --all repoPick-1 </dev/null
-is    "--all and a lane name are two questions, and saying so is the 64" "$rc" 64
-
-# ------------------------------------------------ clause (i-4): the alias
-#
-# *"Bare `lane-start` — no repository, no position — is an alias of `lane`, so
-# clause (i) as ruled still holds and there is one implementation."* It renders
-# nothing of its own: it `exec`s the word, because the launcher `exec`s IT.
-: > "$FAKE_CLAUDE_LOG"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$START" </dev/null
-is    "a bare lane-start exits 0, where it used to refuse with 2" "$rc" 0
-has   "…saying in one line that this is \`lane\`" "$err" "this is \`lane\`"
-has   "…and printing that word's listing rather than one of its own" "$out" "AVAILABLE"
-has   "…numbered, which is the pick" "$out" "1  repoPick-1"
-is    "…and launching no session at all" "$(cat "$FAKE_CLAUDE_LOG")" ""
-
-# AND THE OPTIONS IT WAS HANDED ARE NOT DROPPED ON THE FLOOR (Copilot round 1 on
-# #45, `lane-start:661`). This command's parser has already taken them, and an
-# `exec` carrying none of them turned `--no-launch` — a flag whose whole promise
-# is that nothing starts — into an interactive pick that launches.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$START" --no-launch </dev/null
-is    "bare lane-start REFUSES a flag it would otherwise drop" "$rc" 2
-has   "…naming the flag" "$err" "--no-launch"
-has   "…and saying what the bare word is" "$err" "is \`lane\`"
-has   "…with the form that does take it, filled in" "$err" "<repo> <n> --no-launch"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$START" --estate x --yes </dev/null
-is    "…and names every one of them, not the first" "$rc" 2
-has   "…the one" "$err" "--yes"
-has   "…and the other" "$err" "--estate"
-# …AND THE VALUE GOES WITH THE FLAG THAT TOOK ONE (Copilot round 4 on #45,
-# `lane-start:690`). `--estate x --yes` printed `--estate --yes`, whose
-# `--estate` swallows the `--yes` and names an estate `--yes`: a suggested
-# command that cannot be run is not a suggestion, it is a second refusal
-# waiting.
-has   "…with the VALUE the flag was given, so the line can actually be typed" "$err" "--estate x"
-hasnt "…and never the flag with the next flag as its value" "$err" "--estate --yes"
-# …AND QUOTED THE WAY THE SHELL WILL READ IT BACK (Copilot round 7 on #45,
-# `lane-start:698`): a value with a space printed bare is two words when it is
-# typed again, which is a suggested command that does something else.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$START" --estate 'team blue' </dev/null
-is    "…and a value with a space in it is still one value" "$rc" 2
-# THE ASSERTION IS THE CONTRACT AND NOT ONE SPELLING OF IT. A shell has several
-# correct quotings of `team blue` — `'team blue'` and `team\ blue` are both one
-# word when they are read back — and `lane-start`'s own `quoted` has been each
-# of them: `printf '%q '` until Amendment 17's #47, a POSIX single-quote loop
-# since. What must hold is that the value is quoted AT ALL, in a form this shell
-# reads as one word, and never bare.
-est_q=""
-case "$err" in
-  *"--estate 'team blue'"*) est_q=quoted ;;
-  *'--estate team\ blue'*) est_q=quoted ;;
-esac
-is    "…quoted the way the shell reads it back, in whichever spelling this file's quoter uses" "$est_q" "quoted"
-hasnt "…never bare, which would be two words on the next line someone types" "$err" "--estate team blue"
-is    "…and each of those two spellings IS one word when a shell reads it back" \
-      "$( (eval "set -- 'team blue'"; printf '%s' "$#"); (eval 'set -- team\ blue'; printf '%s' "$#") )" "11"
-if [ "$HAVE_PTY" = 0 ]; then
-  skip "bare lane-start forwards the flags lane has" "$NO_PTY_WHY"
-else
-  # …WHILE THE TWO `lane` ALSO HAS ARE FORWARDED. `--dry-run` is proved by what
-  # the AVAILABLE branch does with it: the act printed instead of performed.
-  : > "$FAKE_PCLAUDE_LOG"
-  lane_pick 1 env -C "$PICK_DIR" "$START" --dry-run
-  is    "bare lane-start --dry-run exits 0" "$rc" 0
-  has   "…having reached lane's own pick" "$out" "which? [1-"
-  has   "…and carried the flag, so the act is printed and not performed" "$out" "--dry-run: nothing was launched"
-  is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-fi
-
-# -------------------------------------- the footer when the helper is older
-#
-# A `lanes-edit.sh` WITH NO `next-free` IS NOT A NEXT FREE POSITION OF 1
-# (Amendment 7(d)). `lanes` offered `lane-start <repo> 1` out of a read that
-# never answered, which is a position this estate may well have taken.
-run env LANES_NO_FETCH=1 REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfold" "$LANES_CMD" --prefix repoPick </dev/null
-is    "lanes still lists where the next-free read is missing" "$rc" 0
-has   "…with the rows" "$out" "repoPick-1"
-hasnt "…and never offers a position it did not get" "$out" "next free position:"
-has   "…saying which act brings it back" "$out" "openRepoTools --install"
-
-# AND A READ THAT *FAILED* IS NOT AN UN-UPGRADED WORKSTATION (Copilot round 1 on
-# #45, `lanes:432`). `|| :` made every status of that read the same status, and
-# the footer then told a person to take the install for a read that had broken:
-# the fail-closed family's own defect, one rung down.
-run env LANES_NO_FETCH=1 REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfbroke" "$LANES_CMD" --prefix repoPick </dev/null
-is    "lanes still lists where the next-free read FAILED" "$rc" 0
-has   "…with the rows" "$out" "repoPick-1"
-hasnt "…offering no position it did not get, here either" "$out" "next free position:"
-has   "…naming the code the read actually gave" "$out" "exited"
-hasnt "…and never calling a failed read an un-upgraded workstation" "$out" "predates lane-collision-protocol Amendment 18"
-
-# ---- THE TWO ACTS THAT CAN FAIL *AFTER* THE FENCE HAS PASSED ---------------
-#
-# THE MOVE IS SPELLED WITH THE `@id` AND THE SOURCE IS FENCED WITH IT (Copilot
-# round 4 on #45, `lane:715`). The index was read one command before it was
-# used, and a window that closes in between gives its index to the next one.
-# MEASURED, tmux 3.4 on a private socket, 2026-09-14: with `w3` at `src:2`,
-# killing it and opening another window at that index and then `move-window -a
-# -s src:2` moved the INTRUDER and exited 0 — the wrong window, in this
-# session, silently — while `move-window -a -s src:@2` refused with `can't find
-# window: @2` and exit 1. So the failure is tmux's own fence doing its work, and
-# this word refuses on it rather than selecting into whatever came back.
-: > "$LANE_TMUX_LOG"; : > "$FAKE_PCLAUDE_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_MOVE_FAIL=1 "$LANE" repoPick-3 </dev/null
-is    "a move-window that FAILED is a refusal and never a select afterwards" "$rc" 2
-has   "…naming the session the window could not be moved out of" "$err" "could not be moved out of session detsess"
-has   "…saying nothing was moved and this terminal is where it was" "$err" "NOTHING was moved"
-is    "…having touched nothing at all, the select included" "$(cat "$LANE_TMUX_LOG")" ""
-is    "…and launching nothing either" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# AND UNDER `--switch` THE SELECT COMES FIRST (Copilot round 3 on #45,
-# `lane:687`). `switch-client` then `select-window` leaves a client that lost
-# the race sitting in the target session's current window — another lane, and
-# this terminal already in it. `select-window` names the session it acts on and
-# needs no client there, so the lane's own window is made current BEFORE the
-# client moves, and a select that fails costs nothing.
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_SELECT_FAIL=1 "$LANE" --switch repoPick-3 </dev/null
-is    "--switch with a select that FAILED refuses with 2" "$rc" 2
-has   "…saying the window could not be selected" "$err" "could not be selected in session detsess"
-hasnt "…and the client was never switched, because the select is the first act" \
-      "$(cat "$LANE_TMUX_LOG")" "switch-client"
-# …AND A SWITCH THAT FAILED AFTER A SELECT THAT WORKED IS ALSO A REFUSAL, in
-# the words of the half that did happen: that session is on the lane now, and
-# this client simply did not move.
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_SWITCH_FAIL=1 "$LANE" --switch repoPick-3 </dev/null
-is    "…and a switch-client that FAILED refuses with 2 as well" "$rc" 2
-has   "…naming the act that failed, window and all" "$err" "switch-client -t detsess:@32\` then failed"
-has   "…and the half that worked, which is the lane's own window selected there" \
-      "$(cat "$LANE_TMUX_LOG")" "select-window -t detsess:@32"
-
-# ---- A LANE WHOSE NAME IS NOT `<repo>-<n>` IS STARTED BY ONE ARGUMENT -------
-#
-# Copilot round 4 on #45, `lane:595`. The no-directory refusal built its remedy
-# as `<repo> <position>`, and a `--verbatim` lane has neither: `nav-rail-audit`
-# is a row like any other (`lane-start:601` takes it as ONE argument beside a
-# `--dir`), and `lane-start --dir <path> nav-rail-audit <n>` would open
-# `nav-rail-audit-<n>` — A DIFFERENT LANE. A refusal whose remedy records the
-# directory of another lane is worse than one that says nothing.
-VERB_ID="dddd0008-8888-4000-8000-dddd00088888"
-add_seed_row "| \`nav-rail-audit\` | harness \`$VERB_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/browser/ui.md | ACTIVE |"
-{ printf '# lane nav-rail-audit — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane nav-rail-audit, session %s@Eagle, 2026-09-12T08:00:00Z, lane:nav-rail-audit → home opensoft/browser; estate browser; profile team-05a\n' "$VERB_ID"
-} > "$LOGD/nav-rail-audit.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a --verbatim lane with a profile and no recorded directory"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" "$LANE" nav-rail-audit </dev/null
-is    "a --verbatim lane with no recorded directory refuses with 2" "$rc" 2
-has   "…naming the ONE-ARGUMENT form that records it for THIS lane" \
-      "$err" "lane-start --dir <the lane's checkout> nav-rail-audit"
-hasnt "…and never a position appended to a name that has none" "$err" "nav-rail-audit <n>"
-is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# ---- AND `env -C` IS NOT A GNU-ONLY OPTION THIS SUITE CANNOT USE -----------
-#
-# Round 4 read this section's `env -C <dir>` invocations as a macOS failure —
-# *"`env -C` is a GNU `env` option, not available in macOS's /usr/bin/env … the
-# macOS Bash 3.2 job will fail before exercising these lane cases"*. It does
-# not. The macOS job has run these very cases GREEN — job 104128188482 on
-# `fce18d5`: `ok a bare lane inside a checkout exits 0` and `ok answering with
-# the number of an AVAILABLE lane exits 0`, both of them `env -C` forms, neither
-# of which can exit 0 and carry a listing if `env` had refused the flag — and
-# `main` has carried four more of them since Amendment 11. Asserted here as
-# well, directly and on every platform, because a decline that is argued rather
-# than measured is one the next round makes again.
-is   "this platform's env takes the -C that every pick case in this section passes it" \
-     "$(env -C "$LOGD" /bin/pwd -P 2>/dev/null)" "$(cd -- "$LOGD" && pwd -P)"
-is   "…and exits 0 doing it, so a case that used it ran the command and not the usage" \
-     "$(env -C "$LOGD" true >/dev/null 2>&1; echo $?)" 0
-
-# ---- A READ THAT PRINTED DIGITS AND THEN FAILED IS STILL A READ THAT FAILED --
-#
-# Copilot round 5 on #45, `lane:1000` and `lanes:441`. Round 3 closed this in
-# the `f` ANSWER (`go_new`, `lane:751`) and left it open in the two surfaces that
-# OFFER `f`: both captured the status and then decided on the TEXT, and text
-# from a failed read passes a shape test on its own output. `nfbroke` prints
-# nothing, so neither surface had ever met the case. `nfpartial` prints a
-# position and exits 6 — the position of a read that did not answer.
-cat > "$SANDBOX/nfpartial" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  next-free) printf '3\n'; printf 'lanes-edit: died after printing\n' >&2; exit 6 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/nfpartial"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfpartial" "$LANE" </dev/null
-is    "the pick lists where next-free printed a position and THEN failed" "$rc" 0
-has   "…with the rows" "$out" "repoPick-1"
-has   "…saying \`f\` is not offered" "$out" "is not offered"
-has   "…naming the code that read actually gave" "$out" "exited 6"
-hasnt "…and never offering the position it printed before it died" "$out" "lane-start repoPick 3"
-hasnt "…which is not in the question either" "$out$err" "f = a new lane"
-run env LANES_NO_FETCH=1 REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfpartial" "$LANES_CMD" --prefix repoPick </dev/null
-is    "…and the lanes footer answers the same way about the same read" "$rc" 0
-hasnt "…offering no next free position out of it" "$out" "next free position:"
-has   "…and naming the code instead" "$out" "exited 6"
-hasnt "…never the digits that read printed before it failed" "$out" "lane-start repoPick 3"
-
-# ---- THE ACTS A NO-TERMINAL RUN PRINTS CARRY THE `--dir` IT WAS GIVEN -------
-#
-# Copilot round 5 on #45, `lane:1030`. The `f` ANSWER has carried `--dir` since
-# round 1 (`lane:710`); the line PRINTED for an agent to type dropped it, which
-# opens the new lane in whatever checkout the reader happens to be standing in.
-# One surface performed the act and the other printed it.
-PICK_DIR_P="$(cd -- "$PICK_DIR" && pwd -P)"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" --dir "$PICK_DIR" </dev/null
-is    "a no-terminal listing with --dir exits 0" "$rc" 0
-has   "…printing the new-lane act WITH that directory, resolved" "$out" "lane-start --dir $PICK_DIR_P repoPick"
-has   "…and the named-lane act with it too, because the flag means the same there" "$out" "lane --dir $PICK_DIR_P <name>"
-
-# ---- AND THE `AVAILABLE` HEADING SAYS WHAT AN UNREAD PROOF COSTS ------------
-#
-# Copilot round 5 on #45, `lanes-edit.sh:4829`. `lane-groups` groups a local row
-# that is not LIVE as available — out of the STATE column, which is the log's
-# verb alone when the session records could not be read. Every row under that
-# heading is then unproven and `go_available` refuses each of them, so a listing
-# that numbered them without a word would be asking a person to pick an answer
-# this command has already decided to refuse.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/livewarn" "$LANE" </dev/null
-is    "the pick still lists where the liveness read did not answer" "$rc" 0
-has   "…with the available rows on screen, because a person still needs to see them" "$out" "repoPick-1"
-has   "…and says in terms that none of them can be launched from here" "$out" "NOTHING above can be launched"
-has   "…naming the read that says what is actually running" "$out" "live-holder"
-has   "…and that an attach is unaffected, because it starts nothing" "$out" "an attach starts"
-# …AND IT IS SILENT WHERE THE PROOF *WAS* MADE, so the paragraph means what it says.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" </dev/null
-hasnt "…while an ordinary listing carries no such paragraph at all" "$out" "NOTHING above can be launched"
-
-# ---- AN EMPTY LISTING STILL NEEDS THE HELPER'S POSITION ANSWER --------------
-# Amendment 19 hides closed/dormant rows and stores retired rows in an archive,
-# so no displayed row does not establish that position 1 is unowned.
-run env LANES_NO_FETCH=1 "$LANES_CMD" --prefix repoNoSuchAtAll </dev/null
-is   "an empty listing exits 8, which is \`no lane of this repository\`" "$rc" 8
-has  "…offering the position that follows from no lanes at all" "$out" "next free position:  1"
-is   "…which is the helper's own answer over the rows that listing did not find" \
-     "$(printf '' | "$E" next-free repoNoSuchAtAll)" "1"
-is   "…and the helper says the same when it is handed the empty set explicitly" \
-     "$(printf '\n' | "$E" next-free repoNoSuchAtAll)" "1"
-run env LANES_NO_FETCH=1 REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfold" \
-    "$LANES_CMD" --prefix repoNoSuchAtAll </dev/null
-hasnt "an empty listing with an older helper never offers an unproven position" "$out" "next free position:"
-has   "…and reports the missing read" "$out" "next-free"
-
-# ---- AND EVERY PRINTED ACT IS A LINE THAT CAN BE TYPED BACK ----------------
-#
-# Copilot round 8 on #45: `lane:612`, `lane:1123`, `lane-start:706`. Three
-# surfaces print a command for a person or an agent to run, and each dropped
-# something the run it describes would need — a directory with a space in it,
-# the `--switch` that makes the attach a switch rather than a move, and the
-# `--dir` a bare `lane-start` was handed beside the flag it refused.
-#
-# THE `cd` IN THE NO-PROFILE REFUSAL, quoted where it is a path. `repoGap-1`
-# records a directory with a space, which is a path a person may well have.
-GAP_DIR="$HOME/projects/my gap repo"
-mkdir -p "$GAP_DIR"
-GAP_ID="dddd0010-1010-4000-8000-dddd00101010"
-add_seed_row "| \`repoGap-1\` | harness \`$GAP_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoGap/1.md | ACTIVE |"
-{ printf '# lane repoGap-1 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoGap-1, session %s@Eagle, 2026-09-12T08:30:00Z, lane:repoGap-1 → home opensoft/repoGap; estate repoGap; dir "%s"\n' "$GAP_ID" "$GAP_DIR"
-} > "$LOGD/repoGap-1.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a lane whose recorded directory has a space in it"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" "$LANE" repoGap-1 </dev/null
-is    "a lane with no recorded profile still refuses with 2" "$rc" 2
-has   "…and the one line it hands over is QUOTED, so it can be pasted" \
-      "$err" "cd $(printf '%q' "$GAP_DIR")"
-hasnt "…never bare, which would be two arguments to cd" "$err" "cd $GAP_DIR "
-is    "…launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# `--switch` IS A DIFFERENT ATTACH AND THE PRINTED ACT KEEPS IT.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" --switch </dev/null
-is    "a no-terminal listing with --switch exits 0" "$rc" 0
-has   "…printing the named-lane act WITH the flag that makes it a switch" "$out" "lane --switch <name>"
-hasnt "…and never the new-lane act with it, because lane-start has no such flag" "$out" "lane-start --switch"
-
-# AND THE BARE `lane-start` REMEDY CARRIES WHAT IT KEPT, not only what it refused.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$START" --dir "$PICK_DIR" --estate x </dev/null
-is    "bare lane-start with one kept flag and one refused still refuses with 2" "$rc" 2
-has   "…naming the refused one" "$err" "--estate x"
-has   "…and carrying the kept one into the line it tells a person to type" "$err" "--dir"
-has   "…with the checkout they actually named" "$err" "$PICK_DIR"
-
-# ---- AND THE FENCE'S OWN REFUSALS OFFER THE WINDOW, NOT ONLY THE SESSION ----
-#
-# Copilot round 11 on #45, `lane:499` and `lane:804`. Both refusals ended with
-# `tmux attach -t <session>` — the bare session, which lands on whatever that
-# session has since made current. That is the outcome the id-AND-session fence
-# exists to stop, offered inside the refusal that exists to stop it. The
-# qualified form attaches AND selects in one act, or refuses; the bare session
-# stays under it, said as what it is.
-: > "$LANE_TMUX_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" LANE_TMUX_SELECT_FAIL=1 "$LANE" repoPick-3 </dev/null
-is    "a select that FAILED outside tmux still refuses with 2" "$rc" 2
-has   "…offering the WINDOW first, which is either the lane or a refusal" "$err" "tmux attach -t detsess:@32"
-has   "…and the bare session under it, said as whatever it now holds" "$err" "whatever it now holds"
-: > "$LANE_TMUX_LOG"
-run env PATH="$LANEBIN_PATH" LANE_TMUX_MOVE_FAIL=1 "$LANE" repoPick-3 </dev/null
-is    "…and the move refusal answers the same way" "$rc" 2
-has   "…with the window in the line it offers" "$err" "tmux attach -t detsess:@32"
-
-# ---- A RESOLVER THAT *FAILED* IS NOT "THE TYPED SPELLING WILL DO" -----------
-#
-# Copilot round 11 on #45, `lane:956`. Two statuses are answers: `0`, the row's
-# own spelling, and the unknown-subcommand `2` of a helper predating Amendment
-# 15, which is the documented fall-through to the estate-wide read. Anything
-# else is a read that did not answer, and a lane bound under a spelling nothing
-# established is the defect Amendment 15 exists to prevent — taken here in the
-# same words the row read, the grouping read and the position read already use.
-cat > "$SANDBOX/canonbroke" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  canon-lane) printf 'lanes-edit: simulated failure\n' >&2; exit 5 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/canonbroke"
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/canonbroke" "$LANE" repoPick-1 </dev/null
-is    "a canon-lane read that FAILED refuses with 1" "$rc" 1
-has   "…naming the code it got" "$err" "exited 5"
-has   "…saying a lane name is one name under any case" "$err" "Amendment 15"
-has   "…and that nothing was launched or attached" "$err" "Nothing was launched"
-is    "…launching nothing, which is the point" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-# …WHILE THE HELPER THAT PREDATES THE AMENDMENT IS STILL THE FALL-THROUGH IT
-# WAS: `2` with no 15(d) words is an un-upgraded workstation, and the lane binds.
-cat > "$SANDBOX/canonold" <<'WRAP'
-#!/usr/bin/env bash
-case "${1-}" in
-  canon-lane) printf "lanes-edit: unknown subcommand 'canon-lane'\n" >&2; exit 2 ;;
-esac
-exec "$REAL_LANES_EDIT" "$@"
-WRAP
-chmod +x "$SANDBOX/canonold"
-: > "$FAKE_PCLAUDE_LOG"
-run env -u TMUX PATH="$LANEBIN_PATH" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/canonold" "$LANE" repoPick-1 </dev/null
-is    "…and a helper with no canon-lane at all still binds the lane" "$rc" 0
-has   "…through the launcher, as it always did" "$(cat "$FAKE_PCLAUDE_LOG")" "argv=--lane repoPick-1 team-05a"
-
-# ---- THE LAST THREE OF THE SAME THREE FAMILIES ------------------------------
-#
-# Copilot round 12 on #45: `lane:873`, `lane:1215`, `lane:234`.
-#
-# `f`'s OWN READ TELLS THE TWO STATUSES APART, as the listing has since round 3:
-# an un-upgraded workstation is named as one and sent to the install; a read
-# that FAILED is named by its code. Both were "run it by hand" here.
-if [ "$HAVE_PTY" = 0 ]; then
-  skip "the f answer names an un-upgraded workstation as one" "$NO_PTY_WHY"
-else
-  : > "$FAKE_PCLAUDE_LOG"
-  lane_pick f env -C "$PICK_DIR" REAL_LANES_EDIT="$E" LANES_EDIT="$SANDBOX/nfold" "$LANE" --dry-run
-  is    "answering \`f\` where next-free is MISSING refuses with the contract's 2" "$rc" 2
-  has   "…saying the workstation predates the addendum rather than that a read broke" "$out" "predates lane-collision-protocol Amendment 18"
-  has   "…and naming the one act that fixes it" "$out" "openRepoTools --install"
-  is    "…starting nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-fi
-
-# AN ANSWER TOO LONG TO BE A POSITION IS NOT ONE, and the length is compared
-# BEFORE `$(( 10# ))` gets it: that conversion WRAPS at the shell's integer
-# width, so `18446744073709551617` arrives at the range check as `1` and binds a
-# lane nobody picked — the wrong-lane outcome every fence in this file stops.
-if [ "$HAVE_PTY" = 0 ]; then
-  skip "an answer that wraps the shell's integer width is refused" "$NO_PTY_WHY"
-else
-  : > "$FAKE_PCLAUDE_LOG"; : > "$LANE_TMUX_LOG"
-  lane_pick 18446744073709551617 env -C "$PICK_DIR" "$LANE"
-  is    "an answer wider than the shell's integers refuses with 2" "$rc" 2
-  has   "…saying it is not in the range the question offered" "$out" "is not in 1-"
-  is    "…and binding nothing, which is what wrapping would have done" \
-        "$(cat "$FAKE_PCLAUDE_LOG")$(cat "$LANE_TMUX_LOG")" ""
-fi
-
-# AND AN ARGUMENT THAT WAS GIVEN AND IS EMPTY IS NOT "NO ARGUMENT": `lane ""`
-# fell through every `[ -n "$name" ]` below it and became the LISTING — a
-# malformed named invocation silently answering a different question.
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" "" </dev/null
-is    "an empty lane name is the contract's 64 and never the listing" "$rc" 64
-has   "…saying which argument was empty" "$err" "EMPTY argument"
-hasnt "…and never rendering the listing instead" "$out" "AVAILABLE"
-run env -C "$PICK_DIR" PATH="$LANEBIN_PATH" "$LANE" --all "" </dev/null
-is    "…and the same beside --all" "$rc" 64
-
-section "== Amendment 13: the row is current state, the log is history =="
-
-# THE CHECKOUT IS COMMITTED FIRST, for the reason the workstation-seam section
-# below gives: the cases above leave handoff files uncommitted in the sandbox
-# workspace on purpose, and `lanes-edit.sh` REFUSES an object-log write on a
-# checkout it cannot rebase. These cases are about the row and the log, so the
-# refusal is put out of the way rather than met.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending handoffs before the Amendment 13 cases" >/dev/null 2>&1 || :
-git -C "$WIP" pull -q --rebase origin main >/dev/null 2>&1 || :
-git -C "$WIP" push -q origin main >/dev/null 2>&1 || :
-
-A13_ID="aaaa0013-1313-4000-8000-aaaa00131313"
-"$E" add-row "| \`repoA13-1\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/x.md | LIVE · 2026-09-14T00:00:00Z · the row is born in the phrase |" >/dev/null 2>&1
-
-# ---- (a) `set-row-state` REPLACES the cell, and stamps the UTC itself.
-run env LANES_LANE=repoA13-1 "$E" set-row-state repoA13-1 "LANDING #29 · CI green; waiting on review"
-is    "set-row-state writes the cell" "$rc" 0
-a13_row="$(grep '^| `repoA13-1`' "$LANES")"
-has   "…the STATE opens it" "$a13_row" "| LANDING #29 · "
-has   "…UTC-stamped by the WRITER, never passed in" "$a13_row" "| LANDING #29 · $(date -u +%Y-)"
-has   "…and the one line closes it" "$a13_row" " · CI green; waiting on review |"
-hasnt "…and what the cell said before is REPLACED, not appended to" "$a13_row" "the row is born in the phrase"
-is    "…so the cell is three parts and stays three parts" \
-      "$(printf '%s' "$a13_row" | awk -F' \\| ' '{ c = $NF; sub(/ \|$/, "", c); n = split(c, p, / · /); print n }')" 3
-is    "…and it is BOUNDED: 240 for the line, plus the state and the instant" \
-      "$(printf '%s' "$a13_row" | awk -F' \\| ' '{ c = $NF; sub(/ \|$/, "", c); print (length(c) <= 280 ? "yes" : "no " length(c)) }')" "yes"
-
-# ---- (a2) A WRITE WHOSE RESULT IS THE LINE ALREADY THERE IS DONE, NOT REFUSED.
-#
-# MEASURED 2026-09-16, and it is why the Amendment 15 `--confirm` case above
-# went red about one run in two with `expected [0], got [5]`. `replace_line`
-# proves it touched exactly one line by demanding `1 1` from
-# `git diff --no-index --numstat`; an edit that changes NOTHING produces no
-# output at all, the comparison was against an empty string, and the act died 5
-# with `numstat: none` — the guard reading "nothing changed" as "more than one
-# line changed", which are opposite facts.
-#
-# IT IS REACHED BY ORDINARY USE. `set-row-state` writes
-# `<STATE> · $(utc_now) · <line>` and `utc_now` is SECONDS, so two stamps of one
-# state phrase inside a second are byte-identical — which is two
-# `lane-start --no-launch` runs of one lane in one window, the pair the
-# `--confirm` case makes. Eight such writes in a loop against the shipped
-# `lanes-edit.sh` gave five exit 5 and three exit 0, decided by nothing but
-# where the second boundary fell.
-#
-# THIS CASE DOES NOT RACE THE CLOCK TO SAY SO. `replace-in-row` with the same
-# text on both sides is byte-identical BY CONSTRUCTION, whatever the second is,
-# so what is asserted is the property and not a coincidence.
-a13_noop_before="$(grep '^| `repoA13-1`' "$LANES")"
-run env LANES_LANE=repoA13-1 "$E" replace-in-row repoA13-1 \
-    "CI green; waiting on review" "CI green; waiting on review"
-is    "a write whose result is the line already there exits 0" "$rc" 0
-has   "…saying the line already reads exactly that" "$err" "already exactly what this write asked for"
-has   "…and that there is nothing to commit" "$err" "nothing staged"
-is    "…leaving the row byte for byte as it was" "$(grep '^| `repoA13-1`' "$LANES")" "$a13_noop_before"
-is    "…and the checkout clean, so the next write is not refused for it" \
-      "$(git -C "$WIP" status --porcelain -- lanes/LANES.md | grep -c . || :)" 0
-
-run "$E" set-row-state repoA13-1 "BUSY · doing things"
-is    "an unknown STATE is refused" "$rc" 2
-has   "…naming the seven there are" "$err" "LIVE, PAUSED, LANDING #<n>, LANDED, ENDED, RETIRED, HANDED OFF"
-run "$E" set-row-state repoA13-1 "LANDING # · no number"
-is    "a LANDING with no PR number is refused — Rule 6 reads this cell" "$rc" 2
-a13_long="$(awk 'BEGIN { s = ""; while (length(s) < 241) s = s "x"; print s }')"
-run "$E" set-row-state repoA13-1 "LIVE · $a13_long"
-is    "a line over the cap is refused" "$rc" 2
-has   "…naming the cap ratified decision O1 set" "$err" "the cap is 240"
-has   "…and where the rest of it goes" "$err" "log NOTED"
-run "$E" set-row-state repoA13-1 "LIVE · a | b"
-is    "a line carrying a cell boundary is refused" "$rc" 2
-run "$E" set-row-state repoA13-1 "LIVE · one · two"
-is    "a line carrying the phrase's own separator is refused" "$rc" 2
-run "$E" set-row-state repoA13-1 "LIVE"
-is    "a phrase with no line at all is refused" "$rc" 2
-is    "…and none of those five refusals touched the row" "$(grep '^| `repoA13-1`' "$LANES")" "$a13_row"
-
-# A ROW WHOSE CELLS ARE NOT UNAMBIGUOUS IS REFUSED, NOT WRITTEN OVER. Seeded as
-# it exists in the live register — a literal ` | ` inside a cell — because no
-# writer here can create one: `set-row-state` refuses the very line that would.
-add_seed_row "| \`repoA13-2\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/y.md | LIVE · a | b inside the cell |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed a row whose state cell holds a literal ' | '" >/dev/null 2>&1
-git -C "$WIP" pull -q --rebase origin main >/dev/null 2>&1 || :
-git -C "$WIP" push -q origin main >/dev/null 2>&1
-a13_amb="$(grep '^| `repoA13-2`' "$LANES")"
-run "$E" set-row-state repoA13-2 "LIVE · this must not be written"
-is    "a row with more than six ' | ' separators is refused" "$rc" 2
-has   "…counting what it found against what a seven-column row has" "$err" "separators where a seven-column row carries 6"
-has   "…saying which cell the other reading would have overwritten" "$err" "handoff path"
-has   "…and naming the escape a Markdown table wants" "$err" '\|'
-is    "…and the row is untouched" "$(grep '^| `repoA13-2`' "$LANES")" "$a13_amb"
-
-# THE SHARED CUT THE THREE ROW WRITERS CARRY, as a unit. The address is
-# `/^cut_to_line()/` and NOT `/^cut_to_line() {/`: an unescaped `{` in a BRE is
-# undefined by POSIX, and BSD `sed` — the macOS job's — answers nothing at all
-# for it, so all three of these cases came back EMPTY there while two of them
-# passed vacuously against an empty string (measured on `4df80b6`'s
-# `tests-macos`). The function's own line is unique without the brace. It is what keeps a
-# `dir` or a launch flag holding a `|` from reaching `set-row-state`, whose
-# contract refuses every pipe — a normal start would then rename the window and
-# fail to stamp the row (Copilot round 1 on openRepoTools#82).
-a13_cut="$(bash -c 'eval "$(sed -n "/^cut_to_line()/,/^}/p" "$1")"; cut_to_line "$2"' _ "$OPENREPOTOOLS_BIN_DIR/lane-start" "launching claude --flag a|b; dir /x · y")"
-is    "the shared cut spells a cell boundary as the broken bar" "$a13_cut" "launching claude --flag a¦b; dir /x; y"
-a13_long="$(awk 'BEGIN { s = ""; while (length(s) < 400) s = s "word "; print s }')"
-a13_cut2="$(bash -c 'eval "$(sed -n "/^cut_to_line()/,/^}/p" "$1")"; cut_to_line "$2"' _ "$OPENREPOTOOLS_BIN_DIR/lane-start" "$a13_long")"
-is    "…and cuts a long line at a word boundary, inside the cap" \
-      "$( [ "${#a13_cut2}" -le 240 ] && echo yes || echo "no ${#a13_cut2}" )" "yes"
-has   "…saying it was cut" "$a13_cut2" " ..."
-a13_cut3="$(bash -c 'eval "$(sed -n "/^cut_to_line()/,/^}/p" "$1")"; cut_to_line "$2"' _ "$OPENREPOTOOLS_BIN_DIR/lane-start" "$(printf 'one\ntwo')")"
-is    "…and a newline, because a row is ONE line of a table (Copilot round 2)" "$a13_cut3" "one; two"
-hasnt "…never leaving half a character where the cut landed" "$a13_cut2" "wor ..."
-
-# ---- (b) `append-row-status` is RETIRED, and the refusal names both acts.
-run "$E" append-row-status repoA13-1 "anything at all"
-is    "append-row-status refuses" "$rc" 2
-has   "…naming the amendment that retired it" "$err" "Amendment 13(a)"
-has   "…naming set-row-state for the STATE" "$err" "set-row-state repoA13-1"
-has   "…naming log NOTED for the narrative" "$err" "log NOTED lane:repoA13-1"
-has   "…naming log RULED for a ruling" "$err" "log RULED lane:repoA13-1"
-has   "…and history for reading it back" "$err" "history repoA13-1"
-has   "…and saying plainly that nothing was written" "$err" "Nothing was written"
-
-# ---- (c) NOTED and RULED are written, and NEITHER IS A TRANSITION.
-LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log STARTED "lane:repoA13-1" "→" "home opensoft/repoA13" >/dev/null 2>&1
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log NOTED "lane:repoA13-1" "rebased on main; the flake is the fixture's clock"
-is    "a NOTED is written" "$rc" 0
-has   "…as a lane-kind line whose object is the lane itself" "$(cat "$LOGD/repoA13-1.md")" \
-      "NOTED — lane repoA13-1, session $A13_ID@Eagle"
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log RULED "lane:repoA13-1" "→" "openrepotools#29" "Ratify as drafted (Recommended)"
-is    "a RULED is written" "$rc" 0
-has   "…with the object it bears on as its payload, CANONICALISED through repos.tsv" "$(cat "$LOGD/repoA13-1.md")" \
-      "lane:repoA13-1 → opensoft/openRepoTools#29 — Ratify as drafted (Recommended)"
-
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log NOTED "opensoft/openRepoTools#29" "a note about an issue"
-is    "a NOTED whose object is not the lane is refused" "$rc" 2
-has   "…pointing at the payload where an object belongs" "$err" "log RULED lane:repoA13-1 → opensoft/openRepoTools#29"
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log NOTED "lane:repoA13-1" "→" "opensoft/openRepoTools#29" "x"
-is    "a NOTED with a payload is refused" "$rc" 2
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log NOTED "lane:repoB-1" "a note about somebody else's lane"
-is    "a NOTED whose object is ANOTHER lane is refused (Copilot round 5)" "$rc" 2
-has   "…because a note is written into the log of the lane it names" "$err" "lane:repoA13-1, not lane:repoB-1"
-is    "…and nothing was written to that lane's log" "$(cat "$LOGD/repoB-1.md" 2>/dev/null | grep -c 'somebody else' || :)" 0
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log RULED "lane:repoA13-1"
-is    "a RULED with no words is refused" "$rc" 2
-has   "…because the words ARE the ruling" "$err" "verbatim"
-run env LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log RULED "lane:repoA13-1" "←" "opensoft/openRepoTools#29" "x"
-is    "a RULED pointed the other way is refused" "$rc" 2
-
-run "$E" who --lane repoA13-1
-has   "who --lane is unmoved by two narrative lines in the log" "$out" "none open"
-run "$E" lanes
-is    "…and the listing's state column is still the lane's last LANE verb" \
-      "$(printf '%s\n' "$out" | grep '^repoA13-1' | head -n1 | cut -f2)" "IDLE"
-
-LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log PAUSED "lane:repoA13-1" "→" "swap; window a13sess:0; workstation Eagle; dir /x; profile team-a13" >/dev/null 2>&1
-run "$E" swapped Eagle
-has   "a swapped lane is listed" "$out" "repoA13-1"
-LANES_LANE=repoA13-1 LANES_SESSION="$A13_ID" "$E" log NOTED "lane:repoA13-1" "a note taken after the swap, which is not a transition" >/dev/null 2>&1
-run "$E" swapped Eagle
-has   "…and a NOTED written AFTER the swap does not un-swap it (Amendment 13(b))" "$out" "repoA13-1"
-run "$E" lane-last repoA13-1
-has   "…nor does it become the lane's last lane-kind line" "$out" "PAUSED"
-
-# THE PHRASE'S LINE IS PROSE, AND `lane-end` READS THE STATE (Copilot round 1
-# on openRepoTools#82). The one path that still decides a merge hold from words
-# — a lane with no object log — scanned the WHOLE cell, so an Amendment 13
-# phrase whose line legitimately says "waiting for LANDING #7" was a false hold
-# that refused to close the lane. A LEGACY DIARY CELL IS UNCHANGED.
-"$E" add-row "| \`repoA13-3\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/p.md | LIVE · 2026-09-14T00:00:00Z · waiting for LANDING #7 to go green |" >/dev/null 2>&1
-run "$END" repoA13-3
-is    "a phrase whose LINE mentions a landing is not a hold" "$rc" 0
-has   "…and the lane is closed" "$(grep '^| `repoA13-3`' "$LANES")" "| ENDED · "
-"$E" add-row "| \`repoA13-4\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/q.md | LANDING #9 · 2026-09-14T00:00:00Z · CI green; waiting on review |" >/dev/null 2>&1
-run "$END" repoA13-4
-is    "…while a phrase whose STATE is LANDING still is one (Rule 6, unchanged)" "$rc" 2
-has   "…named as what it read" "$err" "the last LANDING in its state cell"
-"$E" add-row "| \`repoA13-5\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/r.md | ACTIVE · 2026-09-12T10:00Z LANDING #7 into repoA13 main |" >/dev/null 2>&1
-run "$END" repoA13-5
-is    "…and a LEGACY diary cell is still scanned whole" "$rc" 2
-# THE SECOND FIELD BEING AN INSTANT IS NOT ENOUGH (Copilot round 4 on
-# openRepoTools#82). A legacy diary whose second entry is nothing but a
-# timestamp has the phrase's SHAPE and none of its meaning: narrowing the scan
-# to `ACTIVE` there would close a pre-cutover lane over an open landing, and
-# narrowing is the fail-OPEN direction. The first field must be one of the
-# amendment's own states too.
-"$E" add-row "| \`repoA13-6\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/s.md | ACTIVE · 2026-09-12T10:00:00Z · LANDING #7 into repoA13 main |" >/dev/null 2>&1
-run "$END" repoA13-6
-is    "a diary whose second entry is only an instant is not the phrase" "$rc" 2
-has   "…so its landing still holds the lane" "$err" "the last LANDING in its state cell"
-# AND EXACTLY THREE PARTS, WITH THE THIRD NOT EMPTY (Copilot round 5): a FOURTH
-# ` · ` is a history after the phrase's first two fields, and narrowing to the
-# state there would close a lane over the landing in that history.
-"$E" add-row "| \`repoA13-7\` | harness \`$A13_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoA13/t.md | LIVE · 2026-09-14T00:00:00Z · a note · 2026-09-14T01:00:00Z LANDING #7 into repoA13 main |" >/dev/null 2>&1
-run "$END" repoA13-7
-is    "a cell with a FOURTH part is a diary, not the phrase" "$rc" 2
-has   "…so the landing in its history still holds the lane" "$err" "the last LANDING in its state cell"
-
-# ---- (d) `history` — the diary the cell used to be.
-run "$E" history repoA13-1
-is    "history exits 0 for a lane that has written a narrative" "$rc" 0
-is    "…printing it in FILE order, oldest first" \
-      "$(printf '%s\n' "$out" | head -n1 | awk '{ print $2 }')" "NOTED"
-has   "…the ruling with the object it bears on" "$out" "RULED  opensoft/openRepoTools#29 — Ratify as drafted (Recommended)"
-hasnt "…and never a lane-kind transition, which is not narrative" "$out" "STARTED"
-hasnt "…and never the swap record either" "$out" "swap; window"
-run "$E" history repoB-1
-is    "a lane that has written no narrative is 8, not a failure" "$rc" 8
-run "$E" history repoA13-1 --since yesterday
-is    "a --since that is not an instant is a usage refusal (64)" "$rc" 64
-run "$E" history
-is    "…and so is history with no lane" "$rc" 64
-
-# ---- (e) `migrate-state-cells` — clause (e)'s ONE act, on its own register.
-#
-# ITS OWN WORKSPACE, and that is not tidiness: this act rewrites EVERY row of
-# the register it is pointed at and appends to every lane's log. Run against the
-# suite's own sandbox register it would rewrite the fixtures of every case above
-# and below it, and what it is being tested for — that it takes a whole register
-# at once — is exactly what makes that unsafe. `LANES_WORKSPACE_ROOT` is the
-# seam Amendment 9(a) left for pointing a helper at another sandbox.
-MIG_ORIGIN="$SANDBOX/a13-origin.git"; MIG_WIP="$SANDBOX/a13wip"
-git init -q --bare -b main "$MIG_ORIGIN"
-git clone -q "$MIG_ORIGIN" "$MIG_WIP" 2>/dev/null
-git -C "$MIG_WIP" config user.email "test@example.invalid"
-git -C "$MIG_WIP" config user.name  "lane helper tests"
-mkdir -p "$MIG_WIP/lanes/log"
-MIG_ID1="aaaa0014-1414-4000-8000-aaaa00141414"
-MIG_ID2="aaaa0015-1515-4000-8000-aaaa00151515"
-{
-  printf '# LANES.md — the migration sandbox\n\n'
-  printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-  printf '|---|---|---|---|---|---|---|\n'
-  # THREE ROWS, MIXED ENTRIES: one whose FIRST entry carries no UTC of its own
-  # (it takes the row's `started`), one RULING, and a last entry whose leading
-  # verb is one of clause (a)'s so the new cell is derived rather than MIGRATED.
-  printf '| `repoMig-1` | harness `%s` → harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoMig/x.md | ACTIVE · 2026-09-12T10:00:00Z opened the PR and it went green · 2026-09-12T11:00:00Z RULING: "land it as drafted" · 2026-09-12T12:00:00Z PAUSED for the night |\n' "$MIG_ID1" "$MIG_ID2"
-  printf '| `repoMig-2` | harness `%s` | Eagle / test / brett | 2026-09-11 | none | handoffs/repoMig/y.md | LIVE |\n' "$MIG_ID1"
-  printf '| `repoMig-3` | harness `%s` | Raven / test / brett | 2026-09-11 | none | handoffs/repoMig/z.md | ACTIVE · RATIFIED "as drafted" · 2026-09-13T08:00:00Z LANDED — PR #7 → abc1234 |\n' "$MIG_ID1"
-  # A FOURTH, whose last entry's leading word is no state at all: its cell
-  # becomes `MIGRATED`, which is clause (e)'s own word for "the state is in the
-  # log now" and is not one of clause (a)'s seven.
-  printf '| `repoMig-4` | harness `%s` | Eagle / test / brett | 2026-09-12 | none | handoffs/repoMig/w.md | ACTIVE · 2026-09-13T09:00:00Z rebased and re-ran the suite |\n' "$MIG_ID1"
-  # A FIFTH, already in clause (a)'s shape: this act leaves it alone, and the
-  # report counts it apart from the one-word cells, which are NOT in the shape
-  # (Copilot round 1 on openRepoTools#82).
-  printf '| `repoMig-5` | harness `%s` | Eagle / test / brett | 2026-09-12 | none | handoffs/repoMig/v.md | LIVE \302\267 2026-09-14T00:00:00Z \302\267 already the phrase |\n' "$MIG_ID1"
-  # A SIXTH, whose last entry opens `LANDING #123abc`: the number ends where the
-  # word ends, so that is NO landing and the cell becomes `MIGRATED` rather than
-  # a merge hold Rule 6 would read (Copilot round 1 on openRepoTools#82).
-  printf '| `repoMig-6` | harness `%s` | Eagle / test / brett | 2026-09-12 | none | handoffs/repoMig/u.md | ACTIVE \302\267 2026-09-13T10:00:00Z LANDING #123abc is not a number |\n' "$MIG_ID1"
-} > "$MIG_WIP/lanes/LANES.md"
-git -C "$MIG_WIP" add -A >/dev/null 2>&1
-git -C "$MIG_WIP" commit -q -m "seed the migration sandbox"
-git -C "$MIG_WIP" push -q -u origin main
-MIG_HEAD0="$(git -C "$MIG_WIP" rev-parse HEAD)"
-
-a13_tmp_before="$(ls -d "$TMPDIR"/tmp.* 2>/dev/null | grep -c . || :)"
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells
-is    "the migration is a DRY RUN by default" "$rc" 0
-has   "…saying so" "$out" "DRY RUN, nothing is written"
-has   "…naming the archive it would write" "$out" "lanes/archive/LANES-pre-amendment-13-"
-has   "…counting the rows it would take" "$out" "6 read · 4 to migrate · 1 already the phrase · 1 one word, no history · 0 skipped"
-has   "…and saying what a one-word cell still owes, since it is NOT the phrase" "$out" "the next set-row-state on each writes it"
-has   "…and the lines it would write" "$out" "log lines: 11 (9 NOTED, 2 RULED)"
-has   "…with the phrase each cell becomes" "$out" "→ PAUSED · "
-is    "…and it wrote NOTHING" "$(git -C "$MIG_WIP" status --porcelain | grep -c . || :)" 0
-is    "…and left no staging directory behind either (Copilot round 1)" \
-      "$(ls -d "$TMPDIR"/tmp.* 2>/dev/null | grep -c . || :)" "$a13_tmp_before"
-is    "…not even a commit" "$(git -C "$MIG_WIP" rev-parse HEAD)" "$MIG_HEAD0"
-
-# AN UNTRACKED TARGET LOG IS SOMEBODY'S UNCOMMITTED WORK (Copilot round 2 on
-# openRepoTools#82): a TRACKED one that is dirty is already refused for the whole
-# run by `refuse_dirty_checkout`, which reads staged and unstaged alike, but an
-# untracked file is in neither list and this act would commit its first lines
-# inside the migration's own commit, under the migration's message.
-printf '# lane repoMig-4 — object log (seeded by a peer, uncommitted)\n' > "$MIG_WIP/lanes/log/repoMig-4.md"
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells
-is    "…a row whose object log is untracked is SKIPPED, not committed for its author" "$rc" 0
-has   "…naming the file and whose it is" "$out" "exists here but is NOT TRACKED"
-has   "…and counting it among the skipped" "$out" "1 skipped"
-git -C "$MIG_WIP" add -- lanes/log/repoMig-4.md >/dev/null 2>&1
-git -C "$MIG_WIP" commit -q -m "the peer commits its own log, as the refusal asks"
-git -C "$MIG_WIP" push -q origin main 2>/dev/null || :
-# THE BASELINE MOVES WITH IT: the peer's commit is a commit, and the "one commit"
-# this act makes is counted from where the act starts, not from the seed.
-MIG_HEAD1="$(git -C "$MIG_WIP" rev-parse HEAD)"
-
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells --yes
-is    "the act exits 0" "$rc" 0
-is    "…and it is ONE commit (Rule 9), not one per row" \
-      "$(git -C "$MIG_WIP" rev-list --count "$MIG_HEAD1"..HEAD)" 1
-has   "…whose subject says what it did" "$(git -C "$MIG_WIP" log -1 --format=%s)" "Amendment 13(e)"
-is    "…carrying the archive, all four logs and the register, and nothing else" \
-      "$(git -C "$MIG_WIP" show --name-only --format= HEAD | grep -c .)" 6
-is    "the pre-migration register is archived" \
-      "$(ls "$MIG_WIP/lanes/archive" | grep -c '^LANES-pre-amendment-13-.*\.md$' || :)" 1
-is    "…byte for byte as it was" \
-      "$(git -C "$MIG_WIP" show "$MIG_HEAD0:lanes/LANES.md" | cmp -s - "$MIG_WIP/lanes/archive/$(ls "$MIG_WIP/lanes/archive" | head -n1)" && echo same || echo different)" "same"
-mig_log1="$(cat "$MIG_WIP/lanes/log/repoMig-1.md")"
-has   "an entry with no UTC of its own takes the row's started (clause (e))" "$mig_log1" \
-      "NOTED — lane repoMig-1, session $MIG_ID2@Eagle, 2026-09-11T00:00Z, lane:repoMig-1 — ACTIVE"
-has   "…an entry with one keeps it, and its text is verbatim" "$mig_log1" \
-      "2026-09-12T10:00:00Z, lane:repoMig-1 — opened the PR and it went green"
-has   "…an entry beginning RULING is a RULED, under its OWN leading UTC" "$mig_log1" \
-      'RULED — lane repoMig-1, session '"$MIG_ID2"'@Eagle, 2026-09-12T11:00:00Z, lane:repoMig-1 — RULING: "land it as drafted"'
-is    "…the session is the LAST uuid of the row's session cell" \
-      "$(printf '%s\n' "$mig_log1" | grep -c "session $MIG_ID1@" || :)" 0
-mig_log3="$(cat "$MIG_WIP/lanes/log/repoMig-3.md")"
-has   "…and the workstation is the row's OWN column, not the one running the act" "$mig_log3" "@Raven,"
-has   "…an entry beginning RATIFIED is a RULED too" "$mig_log3" 'RULED — lane repoMig-3'
-has   "…and an entry with no timestamp of its own takes the row's started" "$mig_log3" \
-      'RULED — lane repoMig-3, session '"$MIG_ID1"'@Raven, 2026-09-11T00:00Z, lane:repoMig-3 — RATIFIED "as drafted"'
-has   "…and a text carrying its own \" — \" survives verbatim" "$mig_log3" "LANDED — PR #7 → abc1234"
-
-mig_reg="$(cat "$MIG_WIP/lanes/LANES.md")"
-has   "the cell is REPLACED by the state its last entry names" "$mig_reg" "| PAUSED · "
-has   "…LANDED where the last entry says LANDED" "$mig_reg" "| LANDED · "
-has   "…and by MIGRATED where the last entry's leading word is no state at all" "$mig_reg" "| MIGRATED · "
-is    "…and \`LANDING #123abc\` derives no landing, because the number ends where the word does" \
-      "$(grep '^| `repoMig-6`' "$MIG_WIP/lanes/LANES.md" | grep -c '| MIGRATED · ' || :)" 1
-has   "…every migrated cell pointing at the log that now holds its history" "$mig_reg" "history in lanes/log/repoMig-1.md |"
-hasnt "…with the diary gone from the row" "$mig_reg" "opened the PR and it went green"
-has   "…and a cell that was already one phrase is untouched" "$mig_reg" "| LIVE |"
-
-# THE MIGRATED LINE IS BOUNDED BY THE SAME CAP THE WRITER ENFORCES (Copilot
-# round 5): this cell is built directly, not through `set-row-state`, and it
-# carries a PATH whose length is the lane's name — which `check_lane_name`
-# bounds in characters and not in length.
-MIG_LONG="repoMig-$(awk 'BEGIN { s = ""; while (length(s) < 230) s = s "x"; print s }')"
-printf '| `%s` | harness `%s` | Eagle / test / brett | 2026-09-12 | none | h | ACTIVE · 2026-09-13T10:00:00Z a long-named lane |\n' "$MIG_LONG" "$MIG_ID1" >> "$MIG_WIP/lanes/LANES.md"
-git -C "$MIG_WIP" add -A >/dev/null 2>&1
-git -C "$MIG_WIP" commit -q -m "seed a lane whose name alone is longer than the cap"
-git -C "$MIG_WIP" push -q origin main 2>/dev/null || :
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells --yes
-is    "a lane whose name alone overruns the cap still migrates" "$rc" 0
-# TWO LINES, AND THE SPLIT IS NOT A STYLE CHOICE: `grep` and the awk program's
-# `\|` on ONE line is what `test_no_shipped_bash_reaches_for_gnu_only_utilities_unaccompanied`
-# reads as a BRE alternation handed to `grep`, which is a GNU extension BSD
-# matches literally without saying so. The `\|` here is awk's own escape inside
-# an ERE and never reaches `grep` — so the row is taken first, and the awk that
-# splits it runs on its own line.
-mig_long_row="$(grep "^| \`$MIG_LONG\`" "$MIG_WIP/lanes/LANES.md")"
-mig_long_cell="$(printf '%s' "$mig_long_row" | awk -F' \\| ' '{ c = $NF; sub(/ \|$/, "", c); n = split(c, p, / · /); print (length(p[3]) <= 240 ? "yes" : "no " length(p[3])) }')"
-is    "…with its line inside ratified decision O1's 240 characters" "$mig_long_cell" "yes"
-has   "…and the line says it was cut" "$(grep "^| \`$MIG_LONG\`" "$MIG_WIP/lanes/LANES.md")" " ..."
-MIG_HEAD2="$(git -C "$MIG_WIP" rev-parse HEAD)"
-
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" history repoMig-1 --since 2026-09-12T11:00:00Z
-is    "history reads the migrated narrative" "$rc" 0
-hasnt "…--since drops every entry older than the instant" "$out" "opened the PR"
-has   "…and keeps the instant itself" "$out" "land it as drafted"
-has   "…and what came after it" "$out" "PAUSED for the night"
-
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells --yes
-is    "a SECOND run refuses: the migration is ONE act" "$rc" 2
-has   "…saying the register is already in the shape" "$err" "already in Amendment 13(a)'s shape"
-is    "…and changed nothing" "$(git -C "$MIG_WIP" rev-list --count "$MIG_HEAD2"..HEAD)" 0
-run env LANES_WORKSPACE_ROOT="$MIG_WIP" "$E" migrate-state-cells --no-such-flag
-is    "an unknown flag is a refusal, not a silent dry run" "$rc" 2
-
-section "== Amendment 19: a closed or dormant lane leaves the listing =="
-
-# ITS OWN WORKSPACE, for `migrate-state-cells`'s reason one section up: this
-# section RETIRES a whole repository's dormant rows and creates their logs, and
-# pointed at the suite's own register it would close fixtures the cases above
-# and below it are built on. `LANES_WORKSPACE_ROOT` is the seam Amendment 9(a)
-# left for pointing a helper at another sandbox.
-#
-# THE SEED IS THE AMENDMENT'S OWN: a live lane, a parked one, an ended one and
-# THREE ROWS WITH NO LOG — the population measured on openxFactory on
-# 2026-09-14, where `lanes` listed nineteen rows for five lanes and fourteen of
-# them said `NO LOG`. Two of the three carry their own last words about work
-# that never left the workstation; the third still says `LIVE` and is not.
-A19_ORIGIN="$SANDBOX/a19-origin.git"; A19_WIP="$SANDBOX/a19wip"
-git init -q --bare -b main "$A19_ORIGIN"
-git clone -q "$A19_ORIGIN" "$A19_WIP" 2>/dev/null
-git -C "$A19_WIP" config user.email "test@example.invalid"
-git -C "$A19_WIP" config user.name  "lane helper tests"
-mkdir -p "$A19_WIP/lanes/log"
-A19_ID="aaaa0019-1919-4000-8000-aaaa00191919"
-A19_OLD="aaaa0020-2020-4000-8000-aaaa00202020"
-{
-  printf '# LANES.md — the Amendment 19 sandbox\n\n'
-  printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-  printf '|---|---|---|---|---|---|---|\n'
-  # LIVE: the row names the transcript this suite's own live process carries, so
-  # it is live ON THIS WORKSTATION — which is what makes it not dormant however
-  # little else it has, and what the sweep refuses by name.
-  printf '| `repo19-1` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repo19/1.md | LIVE \302\267 2026-09-11T00:00:00Z \302\267 running |\n' "$LIVE_ID"
-  # PARKED: its own log says PAUSED, which is the "a parked lane is not dormant"
-  # refusal clause (c) names.
-  printf '| `repo19-2` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repo19/2.md | PAUSED \302\267 2026-09-11T00:00:00Z \302\267 swapped for the night |\n' "$A19_ID"
-  # ENDED: its log has finished, which is CLOSED.
-  # ITS CELL CARRIES TWO OF THE FLAG WORDS ON PURPOSE: a row that has a log is a
-  # row whose LOG speaks for it, and the pair of free-text fields below must not
-  # be read — or paid for — on its account.
-  printf '| `repo19-3` | harness `%s` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repo19/3.md | ENDED \302\267 2026-09-11T00:00:00Z \302\267 window closing; the scratch branch was unpushed and is lost |\n' "$A19_OLD"
-  # THREE ROWS WITH NO LOG AT ALL — DORMANT, and each carrying its own last
-  # words: unpushed work, an owed handoff, and one that still says LIVE.
-  printf '| `repo19-4` | harness `%s` | Eagle / test / brett | 2026-08-27 | none | none | ENDED WITHOUT PUSHING — loss risk; work unpushed on branch feat/x |\n' "$A19_OLD"
-  printf '| `repo19-5` | harness `%s` | Raven / test / brett | 2026-08-28 | none | none | dormant since 2026-09-02; owes a handoff |\n' "$A19_OLD"
-  printf '| `repo19-7` | harness `%s` | Eagle / test / brett | 2026-08-29 | none | none | LIVE |\n' "$A19_OLD"
-  # A SEVENTH ROW, IN ANOTHER REPOSITORY, WITH NO LOG AND A 13(a) PHRASE THAT
-  # SAYS `PAUSED`: the register says where that lane IS (Amendment 13(a)), so it
-  # is NOT dormant and the listing keeps it. Without this rule the migration's
-  # own output — which writes a row's state into the cell and its diary into a
-  # log of NOTED lines — would hide every migrated row that is merely parked.
-  printf '| `repo19b-1` | harness `%s` | Eagle / test / brett | 2026-09-01 | none | none | PAUSED \302\267 2026-09-13T00:00:00Z \302\267 migrated; history in lanes/log/repo19b-1.md |\n' "$A19_OLD"
-} > "$A19_WIP/lanes/LANES.md"
-{ printf '# lane repo19-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repo19-2, session %s@Eagle, 2026-09-11T00:00:00Z, lane:repo19-2 → home opensoft/repo19\n' "$A19_ID"
-  printf 'PAUSED — lane repo19-2, session %s@Eagle, 2026-09-11T01:00:00Z, lane:repo19-2\n' "$A19_ID"
-} > "$A19_WIP/lanes/log/repo19-2.md"
-{ printf '# lane repo19-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repo19-3, session %s@Eagle, 2026-09-11T00:00:00Z, lane:repo19-3\n' "$A19_OLD"
-  printf 'ENDED — lane repo19-3, session %s@Eagle, 2026-09-11T02:00:00Z, lane:repo19-3 — window closing; NOTHING IN FLIGHT\n' "$A19_OLD"
-} > "$A19_WIP/lanes/log/repo19-3.md"
-git -C "$A19_WIP" add -A >/dev/null 2>&1
-git -C "$A19_WIP" commit -q -m "seed the Amendment 19 sandbox"
-git -C "$A19_WIP" push -q -u origin main
-A19_HEAD0="$(git -C "$A19_WIP" rev-parse HEAD)"
-
-a19() { env LANES_WORKSPACE_ROOT="$A19_WIP" "$@"; }
-a19_field() {   # <rows> <lane> <field number>
-  printf '%s\n' "$1" | awk -F'\t' -v l="$2" -v f="$3" '$1 == l { print $f; exit }'
-}
-
-# ---- (a) and (b): the two states below PARKED, and who is in the listing.
-run a19 "$E" lanes --prefix repo19
-is    "the default listing exits 0" "$rc" 0
-A19_DEF="$out"
-is    "…and holds the two rows that are neither closed nor dormant" \
-      "$(printf '%s\n' "$A19_DEF" | grep -c . || :)" 2
-has   "…the live one" "$A19_DEF" "repo19-1"
-has   "…and the parked one" "$A19_DEF" "repo19-2"
-hasnt "a CLOSED lane is not in the default listing (Amendment 19(b))" "$A19_DEF" "repo19-3"
-hasnt "…nor is a DORMANT row" "$A19_DEF" "repo19-4"
-hasnt "…nor the one that owes a handoff" "$A19_DEF" "repo19-5"
-hasnt "…nor the one whose cell still says LIVE" "$A19_DEF" "repo19-7"
-
-run a19 "$E" lanes --closed --prefix repo19
-is    "--closed exits 0" "$rc" 0
-A19_ALL="$out"
-is    "…and lists six: the two the default had, plus the four it left out" \
-      "$(printf '%s\n' "$A19_ALL" | grep -c . || :)" 6
-is    "a lane whose log's last lane-kind line is ENDED is CLOSED" "$(a19_field "$A19_ALL" repo19-3 14)" "closed"
-is    "a row with no object log and no live session is DORMANT" "$(a19_field "$A19_ALL" repo19-4 14)" "dormant"
-is    "…and its state word is still NO LOG, which is what the amendment shows it as" \
-      "$(a19_field "$A19_ALL" repo19-4 2)" "NO LOG"
-is    "…and the row carries its own start date for the sweep to print" \
-      "$(a19_field "$A19_ALL" repo19-4 15)" "2026-08-27"
-has   "…and its state cell's head, verbatim" "$(a19_field "$A19_ALL" repo19-4 16)" "work unpushed on branch feat/x"
-is    "…and the flag words found in that cell" "$(a19_field "$A19_ALL" repo19-4 17)" "unpushed,loss"
-is    "…an owed handoff is a flag too" "$(a19_field "$A19_ALL" repo19-5 17)" "owes"
-is    "…and a cell that still says LIVE" "$(a19_field "$A19_ALL" repo19-7 17)" "LIVE"
-is    "a LIVE lane is in neither class, whatever else the row lacks" "$(a19_field "$A19_ALL" repo19-1 14)" "none"
-# COLUMN 10 OF A LIVE ROW IS AMENDMENT 18(i)'S ATTACH since #83 — `tmux
-# switch-client` or `tmux attach`, filled in, and asserted in that section —
-# so what this section asks of it is only that it is never a launch.
-hasnt "…and its line never offers a launch on a lane already running" \
-      "$(a19_field "$A19_ALL" repo19-1 10)" "lane-start"
-is    "a PAUSED lane is in neither class either" "$(a19_field "$A19_ALL" repo19-2 14)" "none"
-
-# THE TWO FREE-TEXT FIELDS ARE NOT READ FOR A ROW THAT HAS A LOG, and that is
-# what makes this listing affordable. `table_lookup` walks the WHOLE table for
-# EVERY lane in the estate, so a field of up to 280 characters per row is paid
-# for N times over: with the state cell's head and its flag words in that table,
-# one `lanes --prefix <repo>` over a register of 132 rows took 42 s where this
-# branch's parent took 14 — and `lane`'s pick, which prints nothing until that
-# read returns, then sat past the 60-second terminal case in CI. Fifty
-# assertions failed on it, the first three of them the pick's own, on every
-# platform: no output, no question, killed.
-#
-# They are a table of their own now (`lanes_register_index --cells`), built on
-# first use and asked for BELOW the narrowing filter, and only for a row with NO
-# OBJECT LOG — the only row whose cell is all the listing has to show. THESE
-# FOUR ARE THE CASE THAT CATCHES IT, and they are the structure rather than a
-# stopwatch: a clock assertion on a shared runner is a flake, while a row that
-# has a log carrying its cell's text is the defect itself, in one field.
-is    "a row whose lane HAS an object log carries no state-cell head" \
-      "$(a19_field "$A19_ALL" repo19-2 16)" "none"
-is    "…and the CLOSED row the same, whose own cell says unpushed and lost" \
-      "$(a19_field "$A19_ALL" repo19-3 16)" "none"
-is    "…nor the flag words those two say, however alarming they are" \
-      "$(a19_field "$A19_ALL" repo19-3 17)" "none"
-is    "…while its started date IS carried, because the closed line prints it" \
-      "$(a19_field "$A19_ALL" repo19-3 15)" "2026-09-11T00:00Z"
-
-# A ROW WITH NO LOG WHOSE CELL IS THE PHRASE AND SAYS `PAUSED` IS NOT DORMANT:
-# Amendment 13(a) makes that cell the lane's current state, and a listing that
-# hid it would hide a lane a person can still pick up.
-run a19 "$E" lanes --prefix repo19b
-is    "a no-log row whose 13(a) cell says PAUSED is still listed" "$rc" 0
-has   "…by name" "$out" "repo19b-1"
-is    "…and it is in neither class" "$(a19_field "$out" repo19b-1 14)" "none"
-# AND ITS STATE IS THAT CELL'S WORD, NOT `NO LOG` (#89, out of the suppressed
-# comments of Copilot's review of #82). The cell is the one column Amendment 13
-# exists to make authoritative, and the STATE column was the one read that never
-# consulted it: a row `migrate-state-cells` left parked listed as `NO LOG`, with
-# its `PAUSED` one field along in column 16. The word carries ` (row)`, because
-# it is SHOWN and never bound — with no lane-kind line there is no directory,
-# profile or binding to resume — so column 10 has no act for it and the pick
-# files it in a group of its own, which `lane` never numbers.
-is    "…and its STATE is the cell's own word, marked as the row's (#89)" \
-      "$(a19_field "$out" repo19b-1 2)" "PAUSED (row)"
-is    "…with no act in column 10, because there is no log to resume it from" \
-      "$(a19_field "$out" repo19b-1 10)" "none"
-is    "…and the pick files it rowonly, in none of the three groups it numbers" \
-      "$(printf '%s\n' "$out" | a19 "$E" lane-groups Eagle | cut -f1)" "rowonly"
-run a19 "$LANES_CMD" --prefix repo19b </dev/null
-has   "…and the listing a person reads says PAUSED" "$out" "PAUSED (row)"
-hasnt "…and no longer NO LOG" "$out" "NO LOG"
-# THE CONSERVATIVE CALL, AND `lane` IS WHERE IT IS MADE: a state read out of a
-# cell is DISPLAYED and is never picked or resumed. Before #89 this row was `NO
-# LOG` on this workstation, which the pick files AVAILABLE on the workstation
-# column alone — so it was numbered, and `lane <name>` handed a directory and a
-# profile LAUNCHED it, on a lane whose log records no binding at all.
-A19B_DIR="$SANDBOX/a19b-checkout"
-git init -q -b main "$A19B_DIR"
-git -C "$A19B_DIR" remote add origin git@github.com:opensoft/repo19b.git
-run a19 env -u TMUX -C "$A19B_DIR" "$LANE" </dev/null
-is    "a bare lane in that repository's checkout has nothing to pick" "$rc" 8
-hasnt "…and never numbers the row whose state is its cell" "$out" "repo19b-1"
-: > "$FAKE_PCLAUDE_LOG"
-run a19 env -u TMUX "$LANE" --dir "$A19B_DIR" repo19b-1 team-05a </dev/null
-is    "lane <name> refuses it, whatever directory and profile it is handed" "$rc" 2
-has   "…saying its log has no lane-kind line to give a state" "$err" "no lane-kind line"
-has   "…and naming the read of the row" "$err" "lanes-edit.sh register-row repo19b-1"
-is    "…and launching nothing" "$(cat "$FAKE_PCLAUDE_LOG")" ""
-
-# `--lane <name>` IS NEVER FILTERED: its caller has named the lane, and an empty
-# answer would read as "there is no such lane".
-run a19 "$E" lanes --lane repo19-4
-is    "--lane answers about a DORMANT row without --closed" "$rc" 0
-is    "…and says it is dormant" "$(a19_field "$out" repo19-4 14)" "dormant"
-# AND THE PICK DROPS IT ON THE CLASS, NOT ON THE STATE WORD (Copilot round 2 on
-# #93): a dormant row's state is `NO LOG`, which is in none of `lane_groups`'s
-# lists, so a row arriving from a read that does not hide it — this one, or
-# `--closed` — was grouped as available and `lane <name>` would have offered to
-# bind it.
-is    "…and the pick drops it on the class, whatever its state word is" \
-      "$(printf '%s\n' "$out" | a19 "$E" lane-groups Eagle)" ""
-
-# THE NEXT FREE POSITION IS COMPUTED OVER EVERY ROW, hidden ones included: 1, 2,
-# 3, 4, 5 and 7 are held, so the lowest free one is 6 — read from the DEFAULT
-# listing, which is where a person's `lanes` footer reads it from.
-is    "the next free position counts the rows the listing hides" \
-      "$(printf '%s\n' "$A19_DEF" | a19 "$E" next-free repo19)" "6"
-
-# ---- (c) the sweep: the DRY RUN first, and it writes nothing.
-run a19 "$END" --retire-dormant repo19
-is    "the sweep is a DRY RUN by default" "$rc" 0
-has   "…saying so" "$out" "DRY RUN, nothing is written"
-has   "…counting the dormant rows" "$out" "dormant  : 3 row(s)"
-has   "…naming each of them" "$out" "repo19-4"
-has   "…with the start its row records" "$out" "2026-08-27"
-has   "…and the workstation it ran on" "$out" "Raven"
-has   "…and the row on the other workstation" "$out" "repo19-5"
-has   "…FLAGGING the cell that says the work was unpushed" "$out" "FLAG repo19-4"
-has   "…with the words that earned the flag" "$out" "unpushed,loss"
-has   "…and the row's own last words under it" "$out" "was: ENDED WITHOUT PUSHING — loss risk"
-hasnt "a LIVE lane is not in the sweep" "$out" "repo19-1"
-hasnt "…and neither is a parked one" "$out" "repo19-2"
-hasnt "…nor one that has already ended" "$out" "repo19-3"
-has   "…and it prints the one line that makes it the act" "$out" "--retire-dormant repo19"
-is    "…and it wrote NOTHING" "$(git -C "$A19_WIP" status --porcelain | grep -c . || :)" 0
-is    "…not even a commit" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD0"
-
-# THE WRITER IS A LANE AND IT IS NOT GUESSED (Amendment 7(b)): every line the
-# sweep appends carries the SWEEPING lane's transcript uuid.
-run a19 env LANES_LANE= "$END" --retire-dormant repo19 --yes
-is    "--yes with no lane to write as is refused" "$rc" 2
-has   "…naming the session field that needs it" "$err" "Amendment 7(b)"
-is    "…and it wrote nothing either" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD0"
-
-# ---- (c) the act: ONE commit, three logs, three cells.
-run a19 env LANES_LANE=repo19-2 "$END" --retire-dormant repo19 \
-      --reason "pre-Amendment-7 row; no log and no session" --yes
-is    "--yes exits 0" "$rc" 0
-has   "…saying it is the act" "$out" "THE ACT"
-has   "…and reporting the cell each row becomes" "$out" "RETIRED · "
-is    "…in ONE commit" "$(git -C "$A19_WIP" rev-list --count "$A19_HEAD0"..HEAD)" 1
-has   "…whose subject names the amendment and the count" \
-      "$(git -C "$A19_WIP" log -1 --format=%s)" "Amendment 19(c) — 3 dormant row(s) RETIRED"
-is    "…and NO file outside lanes/ is in it (clause (c))" \
-      "$(git -C "$A19_WIP" show --name-only --format= HEAD | grep -c -v '^lanes/' || :)" 0
-is    "…which is the register and the three logs, and nothing else" \
-      "$(git -C "$A19_WIP" show --name-only --format= HEAD | grep -c . || :)" 4
-is    "the log a dormant row never had is created" "$([ -f "$A19_WIP/lanes/log/repo19-4.md" ] && printf yes)" "yes"
-A19_LINE="$(grep '^RETIRED' "$A19_WIP/lanes/log/repo19-4.md" || :)"
-has   "…with ONE RETIRED line naming the lane" "$A19_LINE" "RETIRED — lane repo19-4,"
-has   "…whose session field is the WRITER's transcript uuid (Amendment 7(b))" "$A19_LINE" "session $A19_ID@Eagle"
-has   "…and whose payload says who swept it" "$A19_LINE" "→ retired-dormant by lane repo19-2"
-has   "…with the reason" "$A19_LINE" "reason pre-Amendment-7 row; no log and no session"
-has   "…and the row's own last words, carried in verbatim" "$A19_LINE" "was: ENDED WITHOUT PUSHING — loss risk; work unpushed on branch feat/x"
-is    "…and it is ONE line, because a log is append-only and this row had none" \
-      "$(grep -c '^RETIRED' "$A19_WIP/lanes/log/repo19-4.md" || :)" 1
-A19_ROW="$(grep '^| `repo19-4`' "$A19_WIP/lanes/LANES.md" || :)"
-has   "the row's state cell becomes the RETIRED phrase" "$A19_ROW" "| RETIRED · 2"
-has   "…carrying the reason" "$A19_ROW" "pre-Amendment-7 row; no log and no session; was:"
-has   "…and the words the cell had" "$A19_ROW" "was: ENDED WITHOUT PUSHING"
-is    "…and the three rows are all of them" \
-      "$(grep -c '| RETIRED · ' "$A19_WIP/lanes/LANES.md" || :)" 3
-is    "the parked lane's row is untouched" \
-      "$(grep -c 'PAUSED · 2026-09-11T00:00:00Z · swapped for the night' "$A19_WIP/lanes/LANES.md" || :)" 1
-# THE SWEEP'S RETIRED LINES MOVE THE LIFECYCLE TOO (openRepoTools#91). They are
-# appended by `retire_rows` and not by `write_event`, so until this round the
-# follow-up that takes every other RETIRED lane to CLOSED never ran for them.
-run a19 "$E" lane-state repo19-4
-is    "a swept lane's lifecycle snapshot is CLOSED" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" "CLOSED"
-is    "…owned by the sweeping lane's transcript, the session the RETIRED line names" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "owner" { print $2 }')" "$A19_ID"
-run a19 "$E" lane-state repo19-2
-is    "…and the parked lane that did the sweeping has no snapshot made for it" "$rc" 8
-
-# A SECOND RUN IS A NO-OP THAT SAYS SO — nothing to do is said, not done.
-A19_HEAD1="$(git -C "$A19_WIP" rev-parse HEAD)"
-run a19 env LANES_LANE=repo19-2 "$END" --retire-dormant repo19 --yes
-is    "a second sweep finds nothing dormant" "$rc" 8
-has   "…and says so rather than doing something" "$err" "no row of repo19 is DORMANT"
-is    "…having written nothing" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD1"
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19-4
-is    "the direct writer cannot retire an already retired lane twice" "$rc" 2
-has   "…naming the terminal event" "$err" "RETIRED line"
-is    "…and its append-only log still has one retirement" \
-      "$(grep -c '^RETIRED' "$A19_WIP/lanes/log/repo19-4.md" || :)" 1
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19-3
-is    "the direct writer cannot retire an already ended lane" "$rc" 2
-has   "…naming that terminal event" "$err" "ENDED line"
-is    "…without moving HEAD" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD1"
-
-# THE TWO REFUSALS, ASKED OF THE WRITER ITSELF — it re-proves them rather than
-# trusting the list `lane-end` handed it.
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19-1
-is    "a lane a live session holds here is refused" "$rc" 2
-has   "…naming the transcript that is live" "$err" "LIVE session on this workstation"
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19-2
-is    "a PARKED lane is refused: a parked lane is not dormant" "$rc" 2
-has   "…naming the line in its log that says so" "$err" "carries a PAUSED line"
-# AND THE ROW'S OWN CLAIM IS RE-PROVED BY THE WRITER, not trusted from the list
-# `lane-end` handed it: the listing does not hide a no-log row whose 13(a) cell
-# says the lane is somewhere, and the two must not disagree about which rows are
-# dormant (Copilot round 1 on #93).
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19b-1
-is    "a no-log row whose 13(a) cell says PAUSED is refused too" "$rc" 2
-has   "…naming the cell that says it" "$err" "Amendment 13(a)'s phrase"
-has   "…and the act that does end such a lane" "$err" "lane-end repo19b-1"
-# A FLAG IS NOT A VALUE: `--reason --yes` took the word that makes it the act as
-# the reason, fell back to the dry run and exited 0 (Copilot round 1 on #93).
-run a19 "$END" --retire-dormant repo19 --reason --yes
-is    "a --reason whose value is a flag is refused" "$rc" 2
-has   "…saying the reason was left out" "$err" "is a flag"
-has   "…and naming the spelling for a reason that begins with a dash" "$err" "--reason=<why>"
-is    "…and neither refusal wrote anything" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD1"
-
-# THE LISTING AFTER THE SWEEP: the three are CLOSED now, by their own logs.
-run a19 "$E" lanes --prefix repo19
-is    "the default listing is the same two lanes" "$(printf '%s\n' "$out" | grep -c . || :)" 2
-run a19 "$E" lanes --closed --prefix repo19
-is    "…and --closed still has all six" "$(printf '%s\n' "$out" | grep -c . || :)" 6
-is    "a swept row is CLOSED now, out of its own log" "$(a19_field "$out" repo19-4 14)" "closed"
-is    "…and its state is the log's own verb" "$(a19_field "$out" repo19-4 2)" "RETIRED"
-
-# ---- (d) the archive: a second act on a second word.
-run a19 "$E" archive-rows repo19
-is    "archive-rows is a DRY RUN by default" "$rc" 0
-has   "…saying so" "$out" "DRY RUN, nothing is written"
-has   "…counting the RETIRED rows it would move" "$out" "3 RETIRED row(s) of repo19"
-is    "…and writing nothing" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD1"
-# The archive is written before the register is shortened. If the register
-# target is read-only, the failed redirection must stop the act before a commit
-# can publish archive rows beside their still-present register rows.
-A19_REGISTER="$A19_WIP/lanes/LANES.md"
-A19_ARCHIVE="$A19_WIP/lanes/archive/LANES-retired.md"
-chmod a-w "$A19_REGISTER"
-if [ -w "$A19_REGISTER" ]; then
-  skip "read-only register write refusal" "this runner can still write a-w files"
-else
-  run a19 env LANES_LANE=repo19-2 "$E" archive-rows repo19 --yes
-  is    "a failed register rewrite stops archive-rows" "$rc" 5
-  has   "…naming the register write failure" "$err" "could not write the rewritten register"
-  is    "…without committing the partial archive move" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD1"
-  is    "…and without removing the original register rows" \
-        "$(command grep -c '^| `repo19-[457]`' "$A19_REGISTER" || :)" 3
-fi
-chmod u+w "$A19_REGISTER"
-rm -f -- "$A19_ARCHIVE"
-is    "the fixture is clean before the successful archive act" "$(git -C "$A19_WIP" status --porcelain)" ""
-run a19 env LANES_LANE=repo19-2 "$E" archive-rows repo19 --yes
-is    "archive-rows --yes exits 0" "$rc" 0
-is    "…in ONE commit" "$(git -C "$A19_WIP" rev-list --count "$A19_HEAD1"..HEAD)" 1
-has   "…whose message names each lane moved" \
-      "$(git -C "$A19_WIP" log -1 --format=%s)" "repo19-4 repo19-5 repo19-7"
-is    "…and the rows are out of the register" \
-      "$(grep -c '^| `repo19-[457]`' "$A19_WIP/lanes/LANES.md" || :)" 0
-is    "…and into the archive" \
-      "$(grep -c '^| `repo19-[457]`' "$A19_WIP/lanes/archive/LANES-retired.md" || :)" 3
-is    "…with every other row left where it was" \
-      "$(grep -c '^| `' "$A19_WIP/lanes/LANES.md" || :)" 4
-run a19 "$E" lanes --closed --prefix repo19
-is    "the --closed listing reads the archive too (Amendment 19(d))" \
-      "$(printf '%s\n' "$out" | grep -c . || :)" 6
-is    "…and an archived row is still CLOSED" "$(a19_field "$out" repo19-7 14)" "closed"
-run a19 "$E" lanes --prefix repo19
-is    "…while the default listing is still the two" "$(printf '%s\n' "$out" | grep -c . || :)" 2
-is    "the next free position STILL skips the archived numbers" \
-      "$(printf '%s\n' "$out" | a19 "$E" next-free repo19)" "6"
-# If the published archive exists but cannot be rendered, the local copy may
-# be older. A fallback to it would offer a retired position again.
-mkdir -p "$SANDBOX/a19-gitfail"
-cat > "$SANDBOX/a19-gitfail/git" <<'FAKE'
-#!/usr/bin/env bash
-case " $* " in
-  *" show origin/main:lanes/archive/LANES-retired.md "*) exit 1 ;;
-esac
-exec "${REAL_GIT:?}" "$@"
-FAKE
-chmod +x "$SANDBOX/a19-gitfail/git"
-run a19 env PATH="$SANDBOX/a19-gitfail:$PATH" REAL_GIT="$(command -v git)" \
-    "$E" next-free repo19
-is    "an unreadable published archive refuses to offer a position" "$rc" 1
-has   "…explaining why no position is known" "$err" "archive of retired rows exists and could not be read"
-run a19 "$E" archive-rows repo19
-is    "a second archive-rows finds nothing to move" "$rc" 2
-has   "…and says so" "$err" "no row of repo19 has the state RETIRED"
-run a19 env LANES_NO_FETCH=1 LANES_LANE=repo19-2 "$E" archive-rows repo19 --yes
-is    "an archive act without a fresh fetch refuses before writing" "$rc" 1
-has   "…naming the freshness proof it lacks" "$err" "requires a successful fresh fetch"
-
-# THE WRAPPER RENDERS WHAT THE READ DECIDED, and nothing of its own.
-# A RETIRED POSITION IS NEVER REISSUED, and that is a REFUSAL and not only a
-# suggestion: `next-free` skips the archived numbers above, and `add-row` — the
-# act `lane-start <repo> <n>` makes — refuses a name the archive holds, because
-# that lane's object log is still there and is append-only.
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19-4\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-09-15 | none | none | LIVE |"
-is    "a lane name the archive holds is refused a second row" "$rc" 2
-has   "…naming the archive it is in" "$err" "lanes/archive/LANES-retired.md"
-has   "…and the log that makes it one lane" "$err" "lanes/log/repo19-4.md"
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19-6\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-09-15 | none | none | LIVE |"
-is    "…while the free position beside it is still added" "$rc" 0
-
-run a19 "$LANES_CMD" --prefix repo19 </dev/null
-has   "the listing says the closed and dormant rows are not in it" "$out" "closed and dormant lanes are not listed"
-hasnt "…and they are not" "$out" "repo19-7"
-hasnt "a LIVE lane's line never offers to bind it a second time" "$out" "bind it: lane repo19-1"
-run a19 "$LANES_CMD" --closed --prefix repo19 </dev/null
-has   "--closed puts them back" "$out" "repo19-7"
-has   "…a closed one saying which line closed it" "$out" "closed: its object log ends with RETIRED"
-
-# AN UNTRACKED LOG IS SOMEBODY'S UNCOMMITTED WORK, and this sweep is ONE commit:
-# appending to it would put a peer's first lines into that commit under this
-# act's message (the finding `migrate-state-cells` took in round 2 of
-# openRepoTools#82, in the act with the same shape). A TRACKED file that is
-# dirty is already refused for the whole run; an untracked one is in neither of
-# `refuse_dirty_checkout`-s lists. `repo19-6` is the row the `add-row` case
-# above left behind: dormant, with no log — until this puts one beside it.
-A19_HEAD3="$(git -C "$A19_WIP" rev-parse HEAD)"
-printf '# lane repo19-6 — object log (seeded by a peer, uncommitted)\n' > "$A19_WIP/lanes/log/repo19-6.md"
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19-6
-is    "a dormant row whose object log is UNTRACKED is refused" "$rc" 2
-has   "…saying what that file is" "$err" "is NOT TRACKED"
-has   "…and naming the commit that settles it" "$err" "git -C"
-is    "…and nothing was written" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_HEAD3"
-rm -f "$A19_WIP/lanes/log/repo19-6.md"
-
-# A ROW OF THIS REPOSITORY THAT CANNOT BE TAKEN APART IS A REFUSAL AND NOT A
-# SKIP (Copilot round 1 on #93): `archive-rows` says it moves EVERY `RETIRED`
-# row of a repository, and a row whose ` | ` count hides which text is the state
-# cell may BE one — so moving the others and saying nothing about it would
-# report a partial act as a whole one. Its own repository, so nothing above is
-# disturbed.
-printf '| `repo19c-1` | harness `%s` | Eagle / test / brett | 2026-09-01 | none | a | b | RETIRED \302\267 2026-09-14T00:00:00Z \302\267 finished |\n' "$A19_OLD" >> "$A19_WIP/lanes/LANES.md"
-git -C "$A19_WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$A19_WIP" commit -q -m "a row whose state cell hides behind an extra separator"
-git -C "$A19_WIP" push -q origin main
-run a19 env LANES_LANE=repo19-2 "$E" archive-rows repo19c
-is    "a row of the repository that cannot be taken apart refuses the whole move" "$rc" 2
-has   "…counting the separators it found" "$err" "' | ' separators where a seven-column row carries 6"
-has   "…and naming the hand edit that settles it" "$err" "Escape the literal pipe"
-
-# `awk -v` CARRIES ONE LINE, AND `delete_lines` HANDS IT MANY — the defect
-# `who_landing` took in round 5 of A9 Addendum 4 (R-A9-11) and this amendment's
-# one row-REMOVING write made again. A `-v name=value` is processed as if it
-# were a string literal and a string literal cannot span lines: one-true-awk,
-# which is macOS's `/usr/bin/awk`, refuses it outright — `awk: newline in
-# string … at source line 1`, exit 2, NO OUTPUT AT ALL — while gawk and mawk
-# accept it silently. So at `758a536` `archive-rows --yes` wrote the archive,
-# read an EMPTY rewrite of the register, failed its own line-count proof and
-# died 5, and six of tests-macos' ten red lines were that one line of awk,
-# invisible on Linux and on every workstation this is written on.
-#
-# THE SHIM IS THAT RULE AND NOTHING ELSE: a `-v` whose value carries a newline
-# is refused exactly as one-true-awk refuses it, and everything else `exec`s
-# the real awk. On PATH for the act below, it asserts on EVERY platform what
-# only tests-macos could see — and it is asserted itself two cases down, so a
-# shim that had stopped biting could not make this pass vacuously.
-A19_BWK="$SANDBOX/bwkawk"
-mkdir -p "$A19_BWK"
-{ printf '#!/usr/bin/env bash\n'
-  printf 'REAL=%s\n' "$(command -v awk)"
-  cat <<'FAKE'
-prev=""
-for a in "$@"; do
-  case "$a" in
-    -v?*) v="${a#-v}" ;;
-    *) if [ "$prev" = "-v" ]; then v="$a"; else prev="$a"; continue; fi ;;
-  esac
-  case "$v" in
-    *"
-"*) printf 'awk: newline in string %s... at source line 1\n' "${v%%=*}" >&2; exit 2 ;;
-  esac
-  prev="$a"
-done
-exec "$REAL" "$@"
-FAKE
-} > "$A19_BWK/awk"
-chmod +x "$A19_BWK/awk"
-
-run env PATH="$A19_BWK:$PATH" awk -v x="$(printf 'a\nb')" 'BEGIN { print "ran" }' </dev/null
-is    "the one-true-awk shim refuses a -v value that spans lines" "$rc" 2
-has   "…in one-true-awk's own words" "$err" "newline in string"
-hasnt "…and the program never ran" "$out" "ran"
-run env PATH="$A19_BWK:$PATH" awk -v x=one 'BEGIN { print x }' </dev/null
-is    "…while a one-line -v goes straight through to the real awk" "$out" "one"
-
-# Its own repository again, so nothing above is disturbed, and TWO rows so the
-# removal is a set and not a single line.
-printf '| `repo19d-1` | harness `%s` | Eagle / test / brett | 2026-09-01 | none | none | RETIRED \302\267 2026-09-14T00:00:00Z \302\267 finished |\n' "$A19_OLD" >> "$A19_WIP/lanes/LANES.md"
-printf '| `repo19d-2` | harness `%s` | Eagle / test / brett | 2026-09-02 | none | none | RETIRED \302\267 2026-09-14T00:00:00Z \302\267 finished |\n' "$A19_OLD" >> "$A19_WIP/lanes/LANES.md"
-git -C "$A19_WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$A19_WIP" commit -q -m "two retired rows, for the awk that refuses a multi-line -v"
-git -C "$A19_WIP" push -q origin main
-A19_HEAD4="$(git -C "$A19_WIP" rev-parse HEAD)"
-A19_ROWS4="$(grep -c '^| `' "$A19_WIP/lanes/LANES.md" || :)"
-run a19 env PATH="$A19_BWK:$PATH" LANES_LANE=repo19-2 "$E" archive-rows repo19d --yes
-is    "archive-rows --yes exits 0 under an awk that refuses a multi-line -v" "$rc" 0
-is    "…in ONE commit" "$(git -C "$A19_WIP" rev-list --count "$A19_HEAD4"..HEAD)" 1
-is    "…and the rows are out of the register" \
-      "$(grep -c '^| `repo19d-' "$A19_WIP/lanes/LANES.md" || :)" 0
-is    "…and into the archive" \
-      "$(grep -c '^| `repo19d-' "$A19_WIP/lanes/archive/LANES-retired.md" || :)" 2
-is    "…with every other row left where it was" \
-      "$(grep -c '^| `' "$A19_WIP/lanes/LANES.md" || :)" "$((A19_ROWS4 - 2))"
-
-# AN EMPTY LISTING IS NOT AN EMPTY REGISTER (Copilot round 2 on #93). A
-# repository whose every row is hidden lists nothing, and a footer that then
-# offered position 1 would hand out a number a dormant row holds — the one thing
-# 19(b) exists to prevent. `repo19e` is such a repository: one row, no log, a
-# cell that is not the phrase.
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19e-1\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-08-20 | none | none | dormant; nothing pushed |"
-is    "the seeded dormant-only repository takes its row" "$rc" 0
-run a19 env LANES_NO_FETCH=1 LANES_LANE=repo19-2 "$E" retire-rows repo19e-1
-is    "a retirement act without a fresh fetch refuses before writing" "$rc" 1
-has   "…naming the freshness proof it lacks" "$err" "requires a successful fresh fetch"
-run a19 "$LANES_CMD" --prefix repo19e </dev/null
-is    "a repository whose every row is hidden still exits 8" "$rc" 8
-has   "…saying the difference between LISTED and recorded" "$out" "is LISTED — and that is not the same as none being recorded"
-has   "…pointing at the flag that shows them" "$out" "--closed --prefix repo19e"
-has   "…and offering the position the hidden row does NOT hold" "$out" "next free position:  2"
-hasnt "…never the one it does" "$out" "next free position:  1"
-
-# THE DRY RUN IS A PREVIEW OF THE ACT, so the reason is checked before it prints
-# (Copilot round 2 on #93) — and the `=` spelling, which is the documented way
-# to give a reason that begins with a dash, survives to the writer as ONE
-# argument instead of arriving there as two and being refused.
-run a19 "$END" --retire-dormant repo19e --reason "a | pipe"
-is    "a reason that would forge a cell is refused BEFORE the dry run prints" "$rc" 2
-has   "…naming the character" "$err" "may not contain '|'"
-hasnt "…and no preview was printed over it" "$out" "DRY RUN, nothing is written"
-run a19 "$END" --retire-dormant repo19e --reason="$(printf 'before\037after')"
-is    "a reason containing the sweep plan delimiter is refused before a write" "$rc" 2
-has   "…naming the internal field separator" "$err" "internal field separator"
-run a19 "$END" --retire-dormant repo19e --reason=--why
-is    "the --reason=<why> spelling is accepted" "$rc" 0
-has   "…and the dry run carries it" "$out" "reason   : --why"
-# AND THE LINE IT OFFERS IS ONE THE PARSER TAKES (#93, the review of `44b77c3`):
-# `--reason "--why"` is the dash-led value refused above, and a reason holding
-# shell syntax comes back quoted, so following the preview cannot change it.
-has   "…and the line it offers carries it as the same ONE word" "$out" "--reason=--why --yes"
-hasnt "…never as a dash-led value the parser refuses" "$out" '--reason "--why"'
-a19_q='say "hi" $(id)'
-run a19 "$END" --retire-dormant repo19e --reason "$a19_q"
-is    "a reason carrying shell syntax is accepted" "$rc" 0
-has   "…and offered back SHELL-QUOTED, so following the line cannot run it" "$out" "--reason=$(printf '%q' "$a19_q") --yes"
-
-# THE SWEEP'S OWN FLAGS BELONG TO THE SWEEP (Copilot round 3 on #93): parsed for
-# every invocation, `lane-end <lane> --yes` ran the ORDINARY ending — a line
-# that reads like a confirmed sweep doing something else — and `--reason` was
-# dropped on the floor.
-run a19 "$END" repo19-2 --yes
-is    "--yes without --retire-dormant is refused, not an ordinary ending" "$rc" 2
-has   "…saying which act the word belongs to" "$err" "belongs to --retire-dormant"
-run a19 "$END" repo19-2 --reason "because"
-is    "--reason without --retire-dormant is refused rather than dropped" "$rc" 2
-has   "…and offering the line that would have taken it" "$err" "--retire-dormant <repo> --reason"
-
-# A LOG THIS CHECKOUT HAS AND `origin` HAS NOT IS STILL AN OBJECT LOG (Copilot
-# round 4 on #93). `state_events` reads the PUBLISHED logs, so a log committed
-# here and not yet pushed is in no fact this listing has — and the sweep reads
-# the local log since round 3, so the read and the writer would have disagreed
-# about the amendment's own "no object log" on a checkout that is ahead.
-printf '# lane repo19e-1 — object log (written here, not yet pushed)\n' > "$A19_WIP/lanes/log/repo19e-1.md"
-run a19 "$E" lanes --closed --prefix repo19e
-is    "a row whose object log exists only in this checkout is NOT dormant" "$(a19_field "$out" repo19e-1 14)" "none"
-run a19 "$E" lanes --prefix repo19e
-is    "…so the default listing carries it" "$rc" 0
-has   "…by name" "$out" "repo19e-1"
-rm -f "$A19_WIP/lanes/log/repo19e-1.md"
-run a19 "$E" lanes --prefix repo19e
-is    "…and with the file gone it is dormant again, which is the same rule reading the other way" "$rc" 8
-
-# A prior interrupted archive move can leave a row both in the archive and in
-# the register. Even if that partial state was committed during recovery, a
-# retry must not append a duplicate archived identity.
-grep '^| `repo19-4`' "$A19_WIP/lanes/archive/LANES-retired.md" >> "$A19_WIP/lanes/LANES.md"
-git -C "$A19_WIP" add -- lanes/LANES.md
-git -C "$A19_WIP" commit -q -m "seed a partially recovered archive move"
-git -C "$A19_WIP" push -q origin main
-A19_PARTIAL_HEAD="$(git -C "$A19_WIP" rev-parse HEAD)"
-# The workstation exports a grep wrapper whose status differs when a caller
-# uses -q. Only `command grep` is the predicate the archive writer can trust.
-grep() {
-  if [ "${1-}" = -qixF ]; then return 1; fi
-  command grep "$@"
-}
-export -f grep
-run a19 env LANES_LANE=repo19-2 "$E" archive-rows repo19 --yes
-unset -f grep
-is    "a retry refuses a lane already in the archive" "$rc" 2
-has   "…naming the partial move" "$err" "already in lanes/archive/LANES-retired.md"
-is    "…without appending a duplicate archived row" \
-      "$(grep -c '^| `repo19-4`' "$A19_WIP/lanes/archive/LANES-retired.md" || :)" 1
-is    "…or moving HEAD" "$(git -C "$A19_WIP" rev-parse HEAD)" "$A19_PARTIAL_HEAD"
-
-# A row whose extra separator makes the state cell unparseable must not be
-# hidden as DORMANT; the operator needs to see and repair the malformed row.
-printf '| `repo19bad-1` | harness `%s` | Eagle / test / brett | 2026-09-29 | none | none | PAUSED | extra |\n' "$A19_OLD" >> "$A19_WIP/lanes/LANES.md"
-git -C "$A19_WIP" add -- lanes/LANES.md
-git -C "$A19_WIP" commit -q -m "seed malformed state-cell row"
-git -C "$A19_WIP" push -q origin main
-run a19 "$LANES_CMD" --prefix repo19bad </dev/null
-has   "an unparseable state cell remains visible for repair" "$out" "repo19bad-1"
-
-# Publish an archive-only peer commit just as add-row reaches its rebase. The
-# preflight saw no retired repo19race-1; the post-rebase fence must stop push.
-A19_PEER="$SANDBOX/a19-peer"
-git clone -q "$A19_ORIGIN" "$A19_PEER" 2>/dev/null
-git -C "$A19_PEER" config user.email "test@example.invalid"
-git -C "$A19_PEER" config user.name "lane helper tests"
-cat > "$SANDBOX/git-archive-race" <<'WRAP'
-#!/usr/bin/env bash
-if [ "${1-}" = -C ] && [ "${2-}" = "$A19_WIP" ] && [ "${3-}" = pull ] &&
-   [ ! -e "$A19_RACE_MARKER" ]; then
-  : > "$A19_RACE_MARKER"
-  printf '| `repo19race-1` | peer | Eagle | 2026-09-29 | none | none | RETIRED |\n' >> "$A19_PEER/lanes/archive/LANES-retired.md"
-  "$REAL_GIT" -C "$A19_PEER" add -- lanes/archive/LANES-retired.md || exit 1
-  "$REAL_GIT" -C "$A19_PEER" commit -q -m 'peer retires repo19race-1' || exit 1
-  "$REAL_GIT" -C "$A19_PEER" push -q origin main || exit 1
-fi
-exec "$REAL_GIT" "$@"
-WRAP
-chmod +x "$SANDBOX/git-archive-race"
-mkdir -p "$SANDBOX/racebin"
-cp "$SANDBOX/git-archive-race" "$SANDBOX/racebin/git"
-run a19 env PATH="$SANDBOX/racebin:$PATH" A19_WIP="$A19_WIP" A19_PEER="$A19_PEER" \
-    A19_RACE_MARKER="$SANDBOX/a19-raced" REAL_GIT="$(command -v git)" \
-    LANES_LANE=repo19-2 "$E" add-row "| \`repo19race-1\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-09-29 | none | none | LIVE |"
-is    "an add-row losing to a peer retirement refuses to push" "$rc" 2
-has   "…naming the peer retirement" "$err" "was retired by a peer"
-is    "…and the rejected local HEAD no longer has its row" \
-      "$(grep -c '^| `repo19race-1`' "$A19_WIP/lanes/LANES.md" || :)" 0
-is    "…and the remote has no resurrected active row" \
-      "$(git -C "$A19_PEER" show origin/main:lanes/LANES.md | grep -c '^| `repo19race-1`' || :)" 0
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19race-2\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-09-29 | none | none | LIVE |"
-is    "a later unrelated add-row can still push" "$rc" 0
-is    "…without carrying the retired row into the published register" \
-      "$(git -C "$A19_WIP" show origin/main:lanes/LANES.md | grep -c '^| `repo19race-1`' || :)" 0
-is    "…while publishing the unrelated row" \
-      "$(git -C "$A19_WIP" show origin/main:lanes/LANES.md | grep -c '^| `repo19race-2`' || :)" 1
-
-# A NO-LOG ROW WHOSE 13(a) CELL ALREADY SAYS `RETIRED` IS DORMANT TO THE
-# LISTING — the exception keeps only states other than ENDED, RETIRED and
-# MIGRATED — so it is the sweep's to retire (Copilot round 20 on #93). The
-# writer refused it as "already retired": the preview named a row the act could
-# not take, and one refusal stops the whole all-or-nothing sweep. A migrated
-# legacy row is the one that reaches it: the phrase in the cell, no lane-kind
-# line in the log.
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19ret-1\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-08-21 | none | none | RETIRED · 2026-08-22T00:00:00Z · superseded by repo19-2 |"
-is    "a no-log row whose cell already says RETIRED takes its row" "$rc" 0
-run a19 "$E" lanes --closed --prefix repo19ret
-is    "…and the listing classes it DORMANT" "$(a19_field "$out" repo19ret-1 14)" "dormant"
-run a19 env LANES_LANE=repo19-2 "$E" retire-rows repo19ret-1
-is    "…so the writer retires it rather than refusing the row the listing offered" "$rc" 0
-is    "…writing the first and only RETIRED line of its log" \
-      "$(grep -c '^RETIRED — lane repo19ret-1' "$A19_WIP/lanes/log/repo19ret-1.md" 2>/dev/null || :)" 1
-
-# AND `LIVE` IS THE ONE CELL WORD THE STATE COLUMN DOES NOT TAKE (#89). The rung
-# that shows `PAUSED (row)` above is not symmetric: a cell cannot prove a
-# session is running, only a live record can, and this row has none — so its
-# STATE stays `NO LOG`, and column 17 flags the cell for still saying `LIVE`.
-run a19 env LANES_LANE=repo19-2 "$E" add-row "| \`repo19live-1\` | harness \`$A19_OLD\` | Eagle / test / brett | 2026-08-21 | none | none | LIVE · 2026-08-22T00:00:00Z · said to be running |"
-is    "a no-log row whose 13(a) cell says LIVE takes its row" "$rc" 0
-run a19 "$E" lanes --prefix repo19live
-is    "…and its STATE stays NO LOG, never LIVE, with no live record behind it" \
-      "$(a19_field "$out" repo19live-1 2)" "NO LOG"
-is    "…while column 17 flags the cell for still saying it" "$(a19_field "$out" repo19live-1 17)" "LIVE"
-
-section "== Amendment 18: ONE BINDING PER LANE — host/os/container, the ask, the wait, the force =="
-
-# **A LANE HAS ONE BINDING. THE RECORD SAYS WHERE IT IS — HOST, OS, CONTAINER,
-# WINDOW — AND A SECOND PLACE ASKS THE FIRST TO HAND OFF BEFORE IT BINDS.**
-# Ratified 2026-09-14T13:15:18Z as revision 4, verbatim "merge 37 and 78, ratify
-# revision 4"; brettheap/new-workstation#34/#35, opensoft/openRepoTools#38.
-#
-# THE DEFECT THESE CASES EXIST FOR is that a pid does not cross a pid namespace
-# and the tooling pretended it did: two bench containers on one host share the
-# profile directory, so pyBench reads a session record cloudBench wrote and
-# `kill -0`s a pid in cloudBench's namespace. Every case below that sets
-# `LANES_CONTAINER` is standing in the second bench.
-#
-# THE SEAMS ARE THE AMENDMENT'S OWN VARIABLES — `LANES_HOST`, `LANES_OS`,
-# `LANES_CONTAINER`, the three the launcher exports beside `LANES_WORKSTATION`
-# (opensoft/workBenches#77) — plus `LANES_IN_CONTAINER`, which this suite has
-# used to force the container probe since Amendment 11. Nothing here fakes a
-# container: it fakes the ONE bit that says whether this is one.
-# TWO OF THE THREE ARE PINNED FOR THIS SECTION, FOR THE REASON `LANES_WORKSTATION`
-# IS PINNED FOR THE WHOLE FILE (A9 Addendum 4, R-A9-13). Every seeded record
-# below spells a host and a container, and what is under test is THE REGISTER'S
-# READING of them — which binding is this place's, which is another container's,
-# which is another machine's. The host this suite actually runs on is not under
-# test in any of them, and taking the values from it made the section green in a
-# container called `cb999b9fd177` and red on a bare workstation. The FALLBACKS
-# are asserted directly, with `env -u`, three cases down — so pinning here
-# cannot hide a probe that stopped reading the host at all.
-export LANES_HOST=Eagle
-export LANES_CONTAINER=none
-BIND_SAVE_WINDOWS="${FAKE_TMUX_WINDOWS-}"
-BIND_SAVE_WINDOW="${FAKE_TMUX_WINDOW-}"
-BIND_SAVE_NAME="${FAKE_TMUX_WINDOW_NAME-}"
-BIND_SAVE_INDEX="${FAKE_TMUX_WINDOW_INDEX-}"
-BIND1_ID="bb180001-1111-4000-8000-bb1800011111"
-BIND2_ID="bb180002-2222-4000-8000-bb1800022222"
-BIND3_ID="bb180003-3333-4000-8000-bb1800033333"
-BIND4_ID="bb180004-4444-4000-8000-bb1800044444"
-BIND5_ID="bb180005-5555-4000-8000-bb1800055555"
-BIND6_ID="bb180006-6666-4000-8000-bb1800066666"
-BIND8_ID="bb180008-8888-4000-8000-bb1800088888"
-BIND9_ID="bb180009-9999-4000-8000-bb1800099999"
-BIND10_ID="bb180010-1010-4000-8000-bb1800101010"
-BIND11_ID="bb180011-1111-4000-8000-bb1800111111"
-BIND12_ID="bb180012-1212-4000-8000-bb1800121212"
-BIND13_ID="bb180013-1313-4000-8000-bb1800131313"
-BIND14_ID="bb180014-1414-4000-8000-bb1800141414"
-BIND15_ID="bb180015-1515-4000-8000-bb1800151515"
-BIND16_ID="bb180016-1616-4000-8000-bb1800161616"
-BIND17_ID="bb180017-1717-4000-8000-bb1800171717"
-BIND18_ID="bb180018-1818-4000-8000-bb1800181818"
-BIND_REQ_ID="bb1800aa-aaaa-4000-8000-bb1800aaaaaa"
-BIND_DIR="$HOME/projects/repoBind"
-mkdir -p "$BIND_DIR"
-git init -q -b main "$BIND_DIR"
-git -C "$BIND_DIR" remote add origin "https://github.com/opensoft/repoBind.git"
-# THIS SECTION'S WINDOWS. `bindsess:0 @61` is the bound pane of the lane that is
-# HERE; `cloudsess:4 @62` is a window of the OTHER CONTAINER on this same host,
-# which resolves on this tmux server because one host's launcher mounts ONE
-# socket into every container it starts — that shared server is the whole reason
-# clause (b) has a window exception at all. `@63` is in NO table: it is the
-# binding whose window is GONE.
-export FAKE_TMUX_WINDOW="mysess:@60"
-export FAKE_TMUX_WINDOW_NAME=claude
-export FAKE_TMUX_WINDOW_INDEX=9
-export FAKE_TMUX_WINDOWS="mysess:9	@60	claude	%60	claude
-bindsess:0	@61	repoBind-1	%61	claude
-cloudsess:4	@62	repoBind-3	%62	claude"
-
-echo "-- clause (a): the three facts, and where each one came from"
-
-run "$E" workstation
-is   "workstation answers 0" "$rc" 0
-is   "…with EIGHT tab-separated fields: the workstation, the host, the os and the container, each with its source" \
-     "$(printf '%s' "$out" | awk -F'\t' '{print NF}')" 8
-is   "…the first two unchanged, which is the contract three commands already read with cut -f1/-f2" \
-     "$(printf '%s' "$out" | cut -f1,2)" "$(printf 'Eagle\tseam')"
-run env LANES_HOST=raven LANES_OS=macos LANES_CONTAINER=py-bench "$E" workstation
-is   "the launcher's three exports are read as the SEAM they are" \
-     "$(printf '%s' "$out" | cut -f3,4,5,6,7,8)" "$(printf 'raven\tseam\tmacos\tseam\tpy-bench\tseam')"
-# THE FALLBACKS, EACH ON ITS OWN, and the container bit is what selects between
-# them. OUTSIDE a container the host is `hostname -s` and the container is the
-# word `none`; INSIDE one with no export the host is THE RULE 10 WORKSTATION
-# NAME — because in this estate a workstation is one host and a container's own
-# `hostname` is its id — and the container is that hostname, which for Docker's
-# default is the id and is the one thing that tells two unnamed containers apart.
-run env -u LANES_HOST -u LANES_OS -u LANES_CONTAINER LANES_IN_CONTAINER=0 "$E" workstation
-is   "outside a container the host is \`hostname -s\`" \
-     "$(printf '%s' "$out" | cut -f3,4)" "$(printf '%s\thostname' "$(hostname -s 2>/dev/null || hostname)")"
-is   "…and the container is the word \`none\`, which is an answer and not a gap" \
-     "$(printf '%s' "$out" | cut -f7,8)" "$(printf 'none\toutside')"
-run env -u LANES_HOST -u LANES_OS -u LANES_CONTAINER LANES_IN_CONTAINER=1 "$E" workstation
-is   "INSIDE a container with no export the host is the Rule 10 workstation name, never this container's id" \
-     "$(printf '%s' "$out" | cut -f3,4)" "$(printf 'Eagle\tworkstation')"
-is   "…and the container is its OWN hostname, which is what tells two unnamed containers apart" \
-     "$(printf '%s' "$out" | cut -f7,8)" "$(printf '%s\thostname' "$(hostname -s 2>/dev/null || hostname)")"
-# THE OS PROBE ANSWERS ONE OF FOUR WORDS AND THIS RUNS ON THREE PLATFORMS, so
-# the assertion is the SET and not a value: the macOS job answers `macos`, a WSL
-# workstation `wsl`, a Linux container `linux`. What is pinned is that the probe
-# never invents a fifth word and never says `windows`, which clause (a) reserves
-# for a launcher on the Windows host itself — this toolset is bash and runs in
-# WSL2 there.
-run env -u LANES_OS "$E" workstation
-bind_os="$(printf '%s' "$out" | cut -f5)"
-case "$bind_os" in
-  linux|macos|wsl) ok "the kernel probe answers one of linux, macos, wsl (got $bind_os)" ;;
-  windows) bad "the kernel probe answers one of linux, macos, wsl" "it said 'windows', which only a launcher on the Windows host itself may write (clause (a))" ;;
-  *) bad "the kernel probe answers one of linux, macos, wsl" "got '$bind_os'" ;;
-esac
-is   "…and it says the answer was PROBED rather than exported" "$(printf '%s' "$out" | cut -f6)" kernel
-
-echo "-- clause (a): the sub-fields, written by the writer and read back"
-
-"$E" add-row "| \`repoBind-1\` | harness \`$BIND1_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/1.md | ACTIVE |" >/dev/null 2>&1
-run env LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log STARTED "lane:repoBind-1" \
-    '→' "home opensoft/repoBind; estate repoBind; dir $BIND_DIR; profile team-05a; window bindsess:0 @61"
-is   "a STARTED is written" "$rc" 0
-bind_line="$(git -C "$WIP" show "origin/main:lanes/log/repoBind-1.md" | tail -n1)"
-has  "…carrying the host, which the WRITER appended and no boundary script computed" "$bind_line" "; host Eagle"
-has  "…the os" "$bind_line" "; os $bind_os"
-has  "…and the container" "$bind_line" "; container "
-has  "…after Amendment 11(c)'s three, which are untouched" "$bind_line" "; profile team-05a; window bindsess:0 @61; host "
-run env LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log ENDED "lane:repoBind-1" --text "window closing"
-is   "an ENDED is written" "$rc" 0
-hasnt "…and carries NONE of the three: Amendment 11(c) keeps ENDED and RETIRED payload-free (edit 1 of six, R-A11-15), and a verb that RELEASES a binding has none to describe" \
-     "$(git -C "$WIP" show "origin/main:lanes/log/repoBind-1.md" | tail -n1)" "host "
-# AND THE WRITER IS THE GATE FOR A VALUE A CALLER WROTE ITSELF, for the reason
-# Amendment 17(b)'s two sub-fields are checked there: a payload is free text to
-# `write_event`, this log is append-only, and `binding` refuses launches on what
-# it reads back.
-run env LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log RESUMED "lane:repoBind-1" '→' "dir /x; os plan9"
-is   "an \`os\` that is none of the four words is REFUSED" "$rc" 2
-has  "…naming the four" "$err" "one of linux, macos, wsl, windows"
-run env LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log RESUMED "lane:repoBind-1" '→' "dir /x; host ; os linux"
-is   "a sub-field that is THERE and EMPTY is refused, because no reader can tell it from a pre-amendment line" "$rc" 2
-run env LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log RESUMED "lane:repoBind-1" '→' "dir /x; host two words; os linux"
-is   "a host carrying a SPACE is refused: a space is Amendment 7(b)'s separator between two refs of one sub-field" "$rc" 2
-# AND THE LAUNCHER'S EXPORT IS HELD TO THE SAME FOUR WORDS (Copilot round 5).
-# `binding_subfields_check` refuses a caller-written `os` that is none of them;
-# the value this writer APPENDS comes from `$LANES_OS`, which is nobody's to
-# validate but this writer's — and it would otherwise persist on every binding
-# line a value the same file refuses when a caller supplies it. Dropped rather
-# than refused, because `host` and `container` are what clause (b) reads and a
-# lane-kind line is never lost over a field no reader decides anything by.
-run env LANES_OS=plan9 LANES_LANE=repoBind-1 LANES_SESSION="$BIND1_ID" "$E" log RESUMED "lane:repoBind-1" '→' "dir /x"
-is   "a launcher exporting an \`os\` that is none of the four words still writes the line" "$rc" 0
-bind_os_line="$(git -C "$WIP" show origin/main:lanes/log/repoBind-1.md | tail -n1)"
-hasnt "…without that value in it" "$bind_os_line" "os plan9"
-has   "…keeping the two fields clause (b) actually reads" "$bind_os_line" "; host Eagle"
-has   "…and saying which sub-field was dropped, and why" "$err" "DROPPED binding sub-field"
-
-echo "-- clause (b): the binding, read"
-
-"$E" add-row "| \`repoBind-2\` | harness \`$BIND2_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/2.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-3\` | harness \`$BIND3_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/3.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-4\` | harness \`$BIND4_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/4.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-5\` | harness \`$BIND5_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/5.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-6\` | harness \`$BIND6_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/6.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-8\` | harness \`$BIND8_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/8.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-9\` | harness \`$BIND9_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/9.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-10\` | harness \`$BIND10_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/10.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-11\` | harness \`$BIND11_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/11.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-12\` | harness \`$BIND12_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/12.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-13\` | harness \`$BIND13_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/13.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-14\` | harness \`$BIND14_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/14.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-15\` | harness \`$BIND16_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/15.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-17\` | harness \`$BIND17_ID\` | Eagle / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/17.md | ACTIVE |" >/dev/null 2>&1
-"$E" add-row "| \`repoBind-18\` | harness \`$BIND18_ID\` | Raven / test / brett | 2026-09-11T00:00Z | none | handoffs/repoBind/18.md | ACTIVE |" >/dev/null 2>&1
-# repoBind-2 — BOUND ON ANOTHER HOST. `raven` is a machine this workstation has
-# no session records of and no tmux server of, so its binding is UNKNOWN here
-# and never dead, whatever a `kill -0` of the pid it names would say.
-{ printf '# lane repoBind-2 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-2, session %s@Raven, 2026-09-12T09:00:00Z, lane:repoBind-2 → home opensoft/repoBind; estate repoBind; dir %s; profile team-09z; window ravensess:2 @44; host raven; os macos; container none\n' "$BIND2_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-2.md"
-# repoBind-3 — ANOTHER CONTAINER ON THIS HOST, its window LIVE on the shared
-# tmux server. This is the measured case: two bench containers on Eagle share
-# the profile directory, so this workstation CAN read that record and must still
-# not pronounce on it.
-{ printf '# lane repoBind-3 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-3, session %s@Eagle, 2026-09-12T09:10:00Z, lane:repoBind-3 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:4 @62; host Eagle; os linux; container cloud-bench\n' "$BIND3_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-3.md"
-# repoBind-4 — ANOTHER CONTAINER ON THIS HOST whose window is GONE from the
-# shared server (`@63` is in no window table). Clause (b)'s ONE exception: the
-# pane a session must live in does not exist, so the binding is DEAD and
-# openRepoTools#30's takeover path applies as it stands.
-{ printf '# lane repoBind-4 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-4, session %s@Eagle, 2026-09-12T09:20:00Z, lane:repoBind-4 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:9 @63; host Eagle; os linux; container cloud-bench\n' "$BIND4_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-4.md"
-# repoBind-5 — A LINE WRITTEN BEFORE THIS AMENDMENT, carrying none of the three.
-# Clause (a): *"A line written before this amendment carries none of the three
-# and stays valid; readers treat its binding as the window on the row's
-# workstation, which is what they read today."*
-{ printf '# lane repoBind-5 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-5, session %s@Eagle, 2026-09-12T09:30:00Z, lane:repoBind-5 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61\n' "$BIND5_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-5.md"
-# repoBind-6 — the lane that is LIVE HERE, for the attach line and the guard.
-{ printf '# lane repoBind-6 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-6, session %s@Eagle, 2026-09-12T09:35:00Z, lane:repoBind-6 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61; host Eagle; os linux; container none\n' "$BIND6_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-6.md"
-# repoBind-8 — the binding that is THIS place's own, and a lane of its own for
-# it: `lane-start` on it REBINDS it, which is exactly what that case asserts,
-# and repoBind-6 has the guard and the attach cases after it which read the
-# binding seeded here. One lane per act, so no case rewrites another's premise.
-{ printf '# lane repoBind-8 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-8, session %s@Eagle, 2026-09-12T09:36:00Z, lane:repoBind-8 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61; host Eagle; os linux; container none\n' "$BIND8_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-8.md"
-# repoBind-9 — THE PICKER-S OWN CASE, and it is the measured defect one surface
-# along: another container on THIS host, no live session record visible here, so
-# `lanes_rows` calls it IDLE — and an IDLE row filed by the workstation column
-# alone was offered as AVAILABLE and launched, making a second process on a lane
-# that is running. Left untouched by every other case here, because what it is
-# for is the partition.
-{ printf '# lane repoBind-9 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-9, session %s@Eagle, 2026-09-12T09:37:00Z, lane:repoBind-9 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:5 @64; host Eagle; os linux; container cloud-bench\n' "$BIND9_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-9.md"
-# repoBind-10 — a binding on ANOTHER HOST that no case releases, for the two
-# round-1 assertions that need one still standing after repoBind-2 has been
-# handed off and repoBind-3 forced: the window-id collision across tmux servers,
-# and the wait that must not overrun the bound it was given.
-{ printf '# lane repoBind-10 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-10, session %s@Raven, 2026-09-12T09:38:00Z, lane:repoBind-10 → home opensoft/repoBind; estate repoBind; dir %s; profile team-09z; window ravensess:2 @44; host raven; os macos; container none\n' "$BIND10_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-10.md"
-# repoBind-11 — A MODERN LINE WHOSE `host` IS THE WORKSTATION-S NAME and not
-# this machine-s. The `$WS` fallback is clause (a)-s CUTOVER affordance and
-# belongs to a line that carries none of the three; allowed for a modern one it
-# would call another machine-s binding `here` wherever the two names coincide.
-{ printf '# lane repoBind-11 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-11, session %s@Eagle, 2026-09-12T09:39:00Z, lane:repoBind-11 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61; host Eagle; os linux; container none\n' "$BIND11_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-11.md"
-# repoBind-12 — A MODERN LINE MISSING ONLY ITS `host`, which the writer drops on
-# its own when a value would make the line unreadable. Read as pre-amendment it
-# would be matched on the host alone and the container it DOES carry ignored.
-{ printf '# lane repoBind-12 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-12, session %s@Eagle, 2026-09-12T09:40:00Z, lane:repoBind-12 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:6 @65; os linux; container cloud-bench\n' "$BIND12_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-12.md"
-# repoBind-13 — LIVE by a session record this place can READ and whose pid it
-# cannot judge: the binding is another container of this same host, and the
-# records are shared. `kill -0` there answers about some other process.
-{ printf '# lane repoBind-13 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-13, session %s@Eagle, 2026-09-12T09:41:00Z, lane:repoBind-13 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:4 @62; host Eagle; os linux; container cloud-bench\n' "$BIND13_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-13.md"
-write_record "$sessions_dir/bind13.json" "$BIND13_ID" "$LIVE_PID" "$live_start" "cloudsess:@62.%62" "repoBind-13" "busy"
-# repoBind-14 — a PRE-AMENDMENT line that NO case releases. repoBind-5 is the
-# other one and it is PAUSED half way through this section, which is what the
-# cutover assertion needs not to be.
-{ printf '# lane repoBind-14 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-14, session %s@Eagle, 2026-09-12T09:42:00Z, lane:repoBind-14 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61\n' "$BIND14_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-14.md"
-# repoBind-15 — A BINDING IN ANOTHER CONTAINER WHOSE WINDOW ID IS THIS WINDOW-S.
-# tmux `@` ids are per-server and are reissued from `@0`, so two places can
-# carry the same one; the guard-s window disjunct compared it alone and would
-# have made a session here the answerer for somebody else-s request.
-{ printf '# lane repoBind-15 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-15, session %s@Eagle, 2026-09-12T09:43:00Z, lane:repoBind-15 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window bindsess:0 @61; host Eagle; os linux; container cloud-bench\n' "$BIND15_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-15.md"
-# repoBind-17 — A MODERN BINDING WHOSE WINDOW RESOLVES NOWHERE, and which no
-# other case rebinds: repoBind-4 is the takeover-path case and `lane-start`
-# takes it, which is what that case asserts and what makes its window resolve
-# again afterwards.
-{ printf '# lane repoBind-17 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-17, session %s@Eagle, 2026-09-12T09:44:00Z, lane:repoBind-17 → home opensoft/repoBind; estate repoBind; dir %s; profile team-05a; window cloudsess:9 @66; host Eagle; os linux; container cloud-bench\n' "$BIND17_ID" "$BIND_DIR"
-} > "$LOGD/repoBind-17.md"
-# repoBind-18 — the rebind-within-one-second case: its UTC is FIXED so the peer
-# can reuse it, and its session is reused too, so only the WINDOW tells the new
-# binding from the old.
-{ printf '# lane repoBind-18 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoBind-18, session %s@Raven, 2026-09-12T09:45:00Z, lane:repoBind-18 → home opensoft/repoBind; estate repoBind; dir /elsewhere; profile team-09z; window ravensess:3 @45; host raven; os macos; container none\n' "$BIND18_ID"
-} > "$LOGD/repoBind-18.md"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the bindings Amendment 18 partitions"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-run "$E" binding repoBind-2
-is   "a lane whose last lane-kind line is a STARTED is BOUND" "$rc" 0
-is   "…and the read is host, container, window, utc, session, os, where, window state" \
-     "$(printf '%s' "$out" | cut -f1,2,3,4)" "$(printf 'raven\tnone\travensess:2 @44\t2026-09-12T09:00:00Z')"
-is   "…naming the bound session, which is who a --force releases on behalf of" "$(printf '%s' "$out" | cut -f5)" "$BIND2_ID"
-is   "…and ANOTHER HOST is elsewhere: liveness is pronounced only from inside the binding's own host and container" \
-     "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-is   "…with its window UNKNOWN and never dead, because this machine has no tmux server of Raven's" \
-     "$(printf '%s' "$out" | cut -f8)" "unknown"
-run "$E" binding repoBind-3
-is   "another CONTAINER on this host is elsewhere too — the pid namespace is not shared" \
-     "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-is   "…while its window is LIVE, because one host's launcher mounts ONE tmux socket into every container it starts" \
-     "$(printf '%s' "$out" | cut -f8)" "live"
-run "$E" binding repoBind-4
-is   "…and a binding whose window is GONE from that shared server reads DEAD, which is clause (b)'s one exception" \
-     "$(printf '%s' "$out" | cut -f8)" "gone"
-run env LANES_CONTAINER=cloud-bench "$E" binding repoBind-3
-is   "from INSIDE that container the same binding is HERE, which is the only place liveness may be pronounced from" \
-     "$(printf '%s' "$out" | cut -f7)" "here"
-run "$E" binding repoBind-5
-is   "a line written before this amendment is still read" "$rc" 0
-is   "…its host taken from the row's own workstation, which is what every reader read before clause (a)" \
-     "$(printf '%s' "$out" | cut -f1)" "Eagle"
-is   "…its container the word \`none\`, never a guess" "$(printf '%s' "$out" | cut -f2)" "none"
-is   "…and its window the one the record names" "$(printf '%s' "$out" | cut -f3)" "bindsess:0 @61"
-is   "…so it reads HERE on the workstation whose row it is" "$(printf '%s' "$out" | cut -f7)" "here"
-# AND IT READS HERE FROM INSIDE A CONTAINER TOO, which is the other half of the
-# same cutover sentence and is the case that decides whether this amendment can
-# land at all. *"Readers treat its binding as the window on the row's
-# workstation, which is what they read today"* — and today's reading has no
-# container in it. Matched on a container it never carried, EVERY lane of this
-# estate would read as another container's the moment the asker was in one, and
-# every bench session on a launcher-configured workstation would be refused its
-# own lane on the day this lands.
-run env LANES_CONTAINER=py-bench "$E" binding repoBind-5
-is   "a PRE-AMENDMENT binding is matched on its HOST alone, so a bench session is not refused its own lane" \
-     "$(printf '%s' "$out" | cut -f7)" "here"
-run env LANES_CONTAINER=py-bench "$E" binding repoBind-6
-is   "…while a binding that DOES name a container is matched on it, which is the rule itself" \
-     "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-run env -C "$BIND_DIR" LANES_CONTAINER=py-bench "$START" --no-launch repoBind 5 </dev/null
-is   "…and lane-start takes a pre-amendment lane from inside a container, exactly as it did before this clause" "$rc" 0
-run env LANES_LANE=repoBind-5 LANES_SESSION="$BIND5_ID" "$E" log PAUSED "lane:repoBind-5" '→' "swap; window bindsess:0 @61; agent claude; transcript $BIND5_ID"
-is   "a PAUSED is written" "$rc" 0
-run "$E" binding repoBind-5
-is   "…and the lane is then FREE: exit 8, which is an ANSWER and not a failure" "$rc" 8
-is   "…printing nothing, because there is no binding to print" "$out" ""
-run "$E" binding repoBindNoSuch-1
-is   "a lane with no log at all is free too, by the same 8" "$rc" 8
-
-echo "-- clause (c): a bound lane is started nowhere else"
-
-# THE REFUSAL, FROM A SECOND HOST'S POINT OF VIEW — and with no terminal on
-# stdin, which is every agent on this estate. Clause (c) names the flag there.
-run env -C "$BIND_DIR" "$START" --no-launch repoBind 2 </dev/null
-is   "a lane bound on ANOTHER HOST refuses, and 2 is a refusal and not an environment failure" "$rc" 2
-has  "…naming the binding: the window, the container, the host and the line's own UTC" "$err" "bound to window ravensess:2 @44 in container none on host raven"
-has  "…saying why this place may not pronounce it dead" "$err" "UNKNOWN and never dead"
-has  "…and naming the flag, because an agent's stdin is not a terminal to ask on" "$err" "--request-handoff"
-has  "…and the one word that overrides, which is a SECOND invocation" "$err" "--force"
-is   "…having renamed nothing" "$(grep -c 'rename-window repoBind-2' "$FAKE_TMUX_LOG" || :)" 0
-is   "…and written nothing to that lane's log" \
-     "$(git -C "$WIP" show origin/main:lanes/log/repoBind-2.md | grep -c 'HANDOFF-REQUESTED' || :)" 0
-run env -C "$BIND_DIR" "$START" --no-launch repoBind 3 </dev/null
-is   "a lane bound in ANOTHER CONTAINER on this same host refuses exactly the same way — this is the measured defect" "$rc" 2
-has  "…naming the container" "$err" "in container cloud-bench on host Eagle"
-# THE ONE EXCEPTION, AND IT IS NOT A WEAKENING: a window that is gone from the
-# shared server is a pane no session can be in.
-run env -C "$BIND_DIR" "$START" --no-launch repoBind 4 </dev/null
-is   "a binding whose window is GONE from this shared tmux server does NOT refuse: it is today's takeover path" "$rc" 0
-has  "…and it says so rather than passing in silence" "$err" "that window is GONE from this tmux server"
-# THE BINDING THAT IS THIS PLACE'S OWN IS NOT A SECOND BINDING.
-run env -C "$BIND_DIR" "$START" --no-launch repoBind 8 </dev/null
-is   "a lane whose binding is THIS host and container is not refused: liveness here is this place's to pronounce" "$rc" 0
-has  "…and the step says which read decided it" "$err" "liveness here is this place's to pronounce"
-
-echo "-- clause (c): the question, the request, the pane and the wait"
-
-# THE QUESTION IS ASKED WHERE THERE IS A TERMINAL, and its ANSWER decides. The
-# seam is this question's own variable and not `--confirm`'s: one run can reach
-# both, and a single seam would answer whichever came first.
-run env -C "$BIND_DIR" LANE_START_HANDOFF_ANSWER=n "$START" --no-launch repoBind 2 </dev/null
-is   "the question answered N refuses, exactly as no answer does" "$rc" 2
-has  "…and the question was actually asked, with the binding named in it" "$err" "ask it to hand off, then bind here? [y/N] n"
-is   "…and nothing was written to the lane's log" \
-     "$(git -C "$WIP" show origin/main:lanes/log/repoBind-2.md | grep -c 'HANDOFF-REQUESTED' || :)" 0
-
-# THE REQUEST IS WRITTEN FIRST, AND THAT ORDER IS THE CLAUSE'S: the line is
-# committed and PUSHED so that the bound session can read it FROM ANYWHERE, and
-# only then is a pane typed into — which is an optimisation of the same-host case
-# and never the request itself.
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-run env -C "$BIND_DIR" LANES_SESSION="$BIND_REQ_ID" "$START" --no-launch --request-handoff --wait 0 repoBind 2 </dev/null
-is   "the flag is the \`y\` for a caller with no terminal, and an empty wait still refuses" "$rc" 2
-bind_req_line="$(git -C "$WIP" show origin/main:lanes/log/repoBind-2.md | grep 'HANDOFF-REQUESTED' | tail -n1)"
-has  "…having written the request line FIRST, to the PUBLISHED log, before anything else was tried" "$bind_req_line" "HANDOFF-REQUESTED — lane repoBind-2"
-has  "…in the REQUESTER's own session field, which is whose act it is" "$bind_req_line" "session $BIND_REQ_ID@"
-has  "…carrying clause (c)'s payload: the asking host" "$bind_req_line" "→ by host Eagle"
-has  "…the asking container" "$bind_req_line" "; container none"
-has  "…the asking window" "$bind_req_line" "; window mysess:9 @60"
-has  "…and the wait it named" "$bind_req_line" "; wait 0s"
-is   "…and NOTHING was typed into a pane, because that binding's window is on a tmux server this one is not" \
-     "$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)" "$bind_keys_before"
-has  "…the refusal saying so, and saying the request travelled through the pushed log instead" "$err" "no pane was typed into"
-has  "…and naming the two ways forward" "$err" "--force"
-
-# THE PANE IS TYPED INTO WHEN — AND ONLY WHEN — THE WINDOW ID RESOLVES ON THIS
-# SERVER, under Amendment 11(h)'s agreement rule. repoBind-3 is the other
-# container on this host, and its `@62` is in this tmux's window table.
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --no-wait
-is   "a request against a binding whose pane IS on this tmux server still refuses on an empty wait" "$rc" 2
-is   "…and types ONE line into that pane (Amendment 12's M1, the one mechanism a running session has)" \
-     "$(( $(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :) - bind_keys_before ))" 1
-has  "…and the line is the handoff under --exit, naming who asked and from where" \
-     "$(tail -n1 "$FAKE_TMUX_LOG")" "send-keys -t @62 /handoff --exit requested by $BIND_REQ_ID@Eagle/none Enter"
-# AND A PANE RUNNING SOMETHING ELSE IS NOT TYPED INTO, which is M1's own
-# condition: `/handoff --exit` typed at a shell is a command that does not exist.
-export FAKE_TMUX_WINDOWS="mysess:9	@60	claude	%60	claude
-bindsess:0	@61	repoBind-1	%61	claude
-cloudsess:4	@62	repoBind-3	%62	bash
-cloudsess:6	@65	repoBind-12	%65	claude"
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --no-wait
-is   "…while a pane running something OTHER than claude is left alone" \
-     "$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)" "$bind_keys_before"
-has  "…and the request says so rather than passing in silence" "$err" "running something other than \`claude\`"
-export FAKE_TMUX_WINDOWS="mysess:9	@60	claude	%60	claude
-bindsess:0	@61	repoBind-1	%61	claude
-cloudsess:4	@62	repoBind-3	%62	claude
-cloudsess:6	@65	repoBind-12	%65	claude"
-
-# THE WAIT ENDS WHEN THE RELEASE LANDS, and it lands FROM THE OTHER CLONE —
-# which is the only way this suite can prove the requester is reading
-# `origin/<branch>` and not its own working tree. The poll interval is the one
-# seam: a case that must watch a wait end cannot spend fifteen seconds a poll.
-bind_release() {   # <lane> <session>
-  git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-  printf 'PAUSED — lane %s, session %s@Raven, %s, lane:%s → swap; agent claude; transcript %s; host raven; os macos; container none\n' \
-    "$1" "$2" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$1" "$2" >> "$CLONE2/lanes/log/$1.md"
-  git -C "$CLONE2" add -- "lanes/log/$1.md"
-  git -C "$CLONE2" commit -q -m "LOG($1@Raven): PAUSED"
-  git -C "$CLONE2" push -q origin main
-}
-( sleep 3; bind_release repoBind-2 "$BIND2_ID" ) &
-BIND_RELEASER=$!
-run env LANES_SESSION="$BIND_REQ_ID" LANES_POLL_SECONDS=1 "$E" request-handoff repoBind-2 --wait 40
-wait "$BIND_RELEASER" 2>/dev/null
-is   "a wait ended by a PAUSED the OTHER clone pushed exits 0: the lane is free and the requester may bind" "$rc" 0
-has  "…saying which fact ended it" "$err" "is FREE"
-run "$E" binding repoBind-2
-is   "…and the binding read agrees, because it is the same read" "$rc" 8
-
-echo "-- clause (e): the empty wait refuses, and only a word forces"
-
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --no-wait
-is   "an empty wait is a REFUSAL and not a bind" "$rc" 2
-has  "…printing the binding" "$err" "bound to window cloudsess:4 @62 in container cloud-bench on host Eagle"
-has  "…the request and its UTC" "$err" "the request: 20"
-has  "…whether the pane was reachable and typed into" "$err" "the pane:    yes"
-has  "…and the one word that overrides" "$err" "--force \"<why you are taking it>\""
-run "$E" binding repoBind-3
-is   "…and it has NOT released the binding it could not obtain" "$rc" 0
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --force
-is   "--force with no WHY is refused: the why is written into an append-only log and is what the bound session reads" "$rc" 2
-has  "…saying so" "$err" "--force takes a WHY"
-# AND A WHY WITHOUT `--force` IS REFUSED RATHER THAN IGNORED. Clause (c)'s
-# request line says WHO is asking and from WHERE and carries no sentence, so
-# words given to it are words a person believes they wrote into an append-only
-# log and nobody did.
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 taking this one
-is   "a WHY with no --force is refused rather than silently dropped" "$rc" 64
-has  "…saying the request line carries no sentence" "$err" "carries no sentence"
-has  "…and naming the act that does write one, with the words already in it" "$err" '--force "taking this one"'
-# THE WHOLE PLAN, PRINTED AND NOT PERFORMED (act 4's own line). A `--dry-run`
-# writes no line, types into no pane and waits for nothing.
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-bind_lines_before="$(git -C "$WIP" show origin/main:lanes/log/repoBind-3.md | grep -c . || :)"
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --dry-run --wait 45
-is   "--dry-run exits 0" "$rc" 0
-has  "…printing the binding it would ask" "$err" "PLAN: lane repoBind-3 is bound to window"
-has  "…the line it would write, and that it goes FIRST" "$err" "log HANDOFF-REQUESTED lane:repoBind-3"
-has  "…the pane it would type into" "$err" "PLAN: tmux send-keys into @62"
-has  "…and the wait that follows, with the word that ends an empty one" "$err" "an empty wait REFUSES and names --force"
-is   "…having written NOTHING" "$(git -C "$WIP" show origin/main:lanes/log/repoBind-3.md | grep -c . || :)" "$bind_lines_before"
-is   "…and typed nothing into any pane" "$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)" "$bind_keys_before"
-# AND THE WRITER GUARD REACHES IT, because `request-handoff` WRITES — it goes to
-# `write_event` directly rather than through `log`, so the dispatcher's own
-# refusal is the only thing between it and a line filed under a container id.
-# One field further along than the `session <uuid>@<ws>` that guard has always
-# protected: clause (a)'s `host` falls back to the Rule 10 workstation name,
-# which in this state IS that container id (Amendment 11 decision 8(d),
-# `R-A11-14`).
-run env -u LANES_WORKSTATION -u LANES_HOST LANES_IN_CONTAINER=1 LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --no-wait
-is   "a container with no configured workstation cannot write the request at all" "$rc" 2
-has  "…in the one sentence every writer here refuses with" "$err" "is the CONTAINER'S id"
-run env -u LANES_WORKSTATION -u LANES_HOST LANES_IN_CONTAINER=1 LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --force "why not"
-is   "…and neither can it force a release" "$rc" 2
-# A BINDING IS FIVE FIELDS AND NOT TWO (Copilot round 7). The forced release
-# names the session it acts for, out of a scan made before the uuid was resolved
-# and the why checked; compared on the UTC and the session alone, a lane
-# released and REBOUND within the same second by a process carrying the same
-# transcript id reads as unchanged, and the `PAUSED` lands on the holder that
-# arrived after the read. The log's UTC is one second wide and this estate
-# resumes one transcript from several places, so neither field distinguishes on
-# its own.
-bind_rebind() {   # <lane> <session> <the UTC to reuse> <the new window>
-  # ONE PUSH, BOTH LINES: a poll that caught the release alone would answer
-  # "the lane is FREE" and this case would never reach the comparison it is for.
-  git -C "$CLONE2" pull -q --rebase origin main 2>/dev/null
-  { printf 'PAUSED — lane %s, session %s@Raven, %s, lane:%s → swap; agent claude; transcript %s; host raven; os macos; container none\n' \
-      "$1" "$2" "$3" "$1" "$2"
-    printf 'RESUMED — lane %s, session %s@Raven, %s, lane:%s → home opensoft/repoBind; estate repoBind; dir /elsewhere; window %s; host raven; os macos; container none\n' \
-      "$1" "$2" "$3" "$1" "$4"
-  } >> "$CLONE2/lanes/log/$1.md"
-  git -C "$CLONE2" add -- "lanes/log/$1.md"
-  git -C "$CLONE2" commit -q -m "LOG($1@Raven): PAUSED then RESUMED"
-  git -C "$CLONE2" push -q origin main
-}
-( sleep 3; bind_rebind repoBind-18 "$BIND18_ID" "2026-09-12T09:45:00Z" "ravensess:4 @46" ) &
-BIND_REBINDER=$!
-run env LANES_SESSION="$BIND_REQ_ID" LANES_POLL_SECONDS=1 "$E" request-handoff repoBind-18 --wait 40
-wait "$BIND_REBINDER" 2>/dev/null
-is   "a lane released and REBOUND under the same session and the same UTC is still a rebind" "$rc" 2
-has  "…named as one" "$err" "released and BOUND AGAIN while this request waited"
-has  "…and it is the WINDOW that says so, which the UTC and the session could not" \
-     "$err" "window ravensess:4 @46"
-run env LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-3 --force "cloud-bench is not answering"
-is   "--force is a SECOND invocation and it releases the binding" "$rc" 0
-bind_forced="$(git -C "$WIP" show origin/main:lanes/log/repoBind-3.md | tail -n1)"
-has  "…writing a PAUSED in the REQUESTER'S OWN session field, which is what makes it a release and not an impersonation" \
-     "$bind_forced" "PAUSED — lane repoBind-3, session $BIND_REQ_ID@"
-has  "…on behalf of the session that held it" "$bind_forced" "on behalf of $BIND3_ID"
-has  "…naming who forced it, and from which host and container" "$bind_forced" "forced by $BIND_REQ_ID@Eagle/none"
-has  "…and the why the person gave" "$bind_forced" "cloud-bench is not answering"
-run "$E" binding repoBind-3
-is   "…so the lane is FREE and the second place may bind" "$rc" 8
-run env -C "$BIND_DIR" "$START" --no-launch repoBind 3 </dev/null
-is   "…which it now does, with nothing refused" "$rc" 0
-
-echo "-- clause (g): one more lane-kind verb, and every state reader skips it"
-
-run env LANES_LANE=repoBind-4 LANES_SESSION="$BIND_REQ_ID" "$E" log HANDOFF-REQUESTED "lane:repoBind-4" '→' "by host x; container none; window y; wait 5s"
-is   "a HANDOFF-REQUESTED is not written by hand" "$rc" 2
-has  "…and the refusal names the act that writes it" "$err" "request-handoff repoBind-4"
-run env FAKE_TMUX_WINDOW="bindsess:@61" LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-6 --no-wait
-is   "a request against a lane bound in THIS window is refused: a request is what a SECOND place makes of the first" "$rc" 2
-has  "…saying so" "$err" "binding IS this window"
-
-echo "-- Copilot round 1: the picker, the bound window's identity, the wait's bound, the forced release and the refusal that persists"
-
-# THE PARTITION IS THE MEASURED DEFECT ONE SURFACE ALONG. `lanes_rows` calls a
-# binding with no live record here IDLE, and `lane-groups` filed an IDLE row as
-# AVAILABLE on the workstation column alone — so another container's LIVE lane
-# on this same host was offered to be launched again, which is the collision
-# this whole amendment exists for, reached through the pick instead of through
-# `kill -0`.
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoBind-9
-is   "a binding in another container of THIS host reads IDLE, because no live record here names it" \
-     "$(printf '%s' "$out" | cut -f2)" "IDLE"
-is   "…and the read says in its own column that this place may NOT pronounce on it" \
-     "$(printf '%s' "$out" | cut -f13)" "elsewhere"
-is   "…so the pick files it under BOUND ELSEWHERE and never offers to launch it" \
-     "$(printf '%s' "$out" | "$E" lane-groups Eagle | cut -f1)" "elsewhere"
-run env LANES_CONTAINER=cloud-bench LANES_NO_FETCH=1 "$E" lanes --lane repoBind-9
-is   "…while from INSIDE that container the same row is this place's to pronounce" \
-     "$(printf '%s' "$out" | cut -f13)" "here"
-is   "…and the pick offers it, because there the liveness read is the record's own namespace" \
-     "$(printf '%s' "$out" | "$E" lane-groups Eagle | cut -f1)" "available"
-# AND A ROW WITH NO COLUMN 13 IS FILED EXACTLY AS IT WAS BEFORE THE COLUMN
-# EXISTED — a lane with a row and no log, or a helper predating the read.
-# Amendment 7(i)'s cutover rule, for a field a reader may simply not have.
-is   "a row carrying no locality column at all is filed as it always was" \
-     "$(printf 'someRepo-9\tIDLE\tEagle\n' | "$E" lane-groups Eagle | cut -f1)" "available"
-is   "…and one that carries \`here\` is too" \
-     "$(printf 'someRepo-9\tIDLE\tEagle\t-\t-\t-\t-\t-\t-\t-\t-\t0\there\n' | "$E" lane-groups Eagle | cut -f1)" "available"
-is   "…while \`elsewhere\` moves it, whatever its workstation column says" \
-     "$(printf 'someRepo-9\tIDLE\tEagle\t-\t-\t-\t-\t-\t-\t-\t-\t0\telsewhere\n' | "$E" lane-groups Eagle | cut -f1)" "elsewhere"
-
-# THE SELF-WINDOW FENCE IS A LOCAL TEST AND IS ASKED ONLY WHERE THE BINDING IS
-# LOCAL. A tmux `@id` names a window on ONE server and tmux reissues them from
-# `@0`, so `@44` here and `@44` on Raven are not one window — and refusing the
-# request would leave that lane unaskable from the one place that needs to ask.
-run env FAKE_TMUX_WINDOW="mysess:@44" FAKE_TMUX_WINDOW_INDEX=2 LANES_SESSION="$BIND_REQ_ID" \
-    "$E" request-handoff repoBind-10 --no-wait
-hasnt "a window whose id matches ANOTHER HOST's binding is not mistaken for it" "$err" "binding IS this window"
-has   "…the request is made, as the second place's request always is" "$err" "REQUESTED: lane repoBind-10"
-
-# `--wait <s>` IS AN UPPER BOUND A PERSON NAMED, and the poll interval decides
-# only how often the log is asked. A fixed fifteen-second poll overran it.
-bind_t0="$(date -u +%s)"
-run env LANES_SESSION="$BIND_REQ_ID" LANES_POLL_SECONDS=30 "$E" request-handoff repoBind-10 --wait 2
-bind_t1="$(date -u +%s)"
-is   "a wait that ends empty refuses" "$rc" 2
-if [ "$(( bind_t1 - bind_t0 ))" -le 20 ]; then
-  ok "…within the bound it was given, not the poll interval it was not"
-else
-  bad "…within the bound it was given, not the poll interval it was not" "took $(( bind_t1 - bind_t0 ))s for --wait 2 with a 30s poll"
-fi
-
-# `lane-start --force` IS THE OTHER DOOR TO THE SAME ACT, and the fence takes it
-# through the one mechanism: no second implementation of the write, and the
-# binding is READ AGAIN before the first act with an effect, because a handoff
-# that landed is an observation and not a reservation (openRepoTools#84).
-run env -C "$BIND_DIR" LANES_SESSION="$BIND_REQ_ID" "$START" --no-launch --force "raven is offline" repoBind 10 </dev/null
-is   "lane-start --force takes a lane bound on another host, through request-handoff" "$rc" 0
-has  "…saying which act it took" "$err" "request-handoff repoBind-10 --force"
-has  "…and reading the binding AGAIN before the rename, which is the first act with an effect" "$err" "binding: still free after the handoff"
-bind_forced10="$(git -C "$WIP" show origin/main:lanes/log/repoBind-10.md | grep 'on behalf of' | tail -n1)"
-has  "…having written the on-behalf release" "$bind_forced10" "on behalf of $BIND10_ID"
-has  "…with the why the person gave" "$bind_forced10" "why raven is offline"
-
-echo "-- clauses (d) and (e): the bound session answers, at its own prompt"
-
-# THE GUARD IS THE OTHER HALF OF THE ACT. Clause (c) is the asking; this is the
-# answering, and it happens at a PROMPT BOUNDARY — *"a working session is never
-# interrupted"* (clause (f)): no Escape, no signal, no respawn from a requester.
-bind_guard_prof="$HOME/.claude-profiles/profiles/opensoft/team/t1/sessions"
-write_record "$bind_guard_prof/bind6.json" "$BIND6_ID" "$LIVE_PID" "$live_start" "bindsess:@61.%61" "repoBind-6" "busy"
-bind_hook='{"session_id":"%s","cwd":"%s","prompt":"do the work","hook_event_name":"UserPromptSubmit"}'
-bind_guard() {   # <session id>
-  out="$(printf "$bind_hook" "$1" "$BIND_DIR" | env FAKE_TMUX_WINDOW="bindsess:@61" FAKE_TMUX_WINDOW_NAME=repoBind-6 "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-  err="$(cat "$SANDBOX/stderr")"
-  return 0
-}
-bind_guard "$BIND6_ID"
-is   "with nothing pending the guard is SILENT and exits 0 — the property that makes a hook at every prompt bearable" "$rc" 0
-is   "…silently" "$err" ""
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-run env FAKE_TMUX_WINDOW="mysess:@60" LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-6 --no-wait
-is   "a second place asks for the lane that session is in" "$rc" 2
-bind_guard "$BIND6_ID"
-is   "…and the BOUND session's next prompt is refused, which is clause (d)" "$rc" 2
-has  "…naming the request, who asked, and from where" "$err" "A HANDOFF WAS REQUESTED for lane repoBind-6"
-has  "…naming the requester" "$err" "by $BIND_REQ_ID from container none on host Eagle"
-has  "…and saying that the handoff ENDS this session, because a handoff to another place is not a restart" "$err" "ENDS this session"
-is   "…having typed the handoff into its OWN pane, once (M1, the one mechanism a running session has)" \
-     "$(( $(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :) - bind_keys_before ))" 2
-has  "…under --exit, with the why the clause spells" "$(tail -n1 "$FAKE_TMUX_LOG")" "send-keys -t %61 /handoff --exit requested by $BIND_REQ_ID@Eagle/none Enter"
-has  "…and it says nothing the person typed is lost" "$err" "type it again in the new place"
-# A REQUEST CHANGES NO STATE, which is clause (g)'s own sentence about the verb
-# it adds: every last-line reader skips it.
-run "$E" lane-last repoBind-6
-is   "…and the lane's LAST lane-kind line is still its STARTED: a request is not a state transition" \
-     "$(printf '%s' "$out" | cut -f1)" "STARTED"
-run "$E" binding repoBind-6
-is   "…so the lane is still BOUND, to the same window it was" "$(printf '%s' "$out" | cut -f3)" "bindsess:0 @61"
-
-# CLAUSE (e)'s OTHER HALF: a `PAUSED` this session did not write refuses EVERY
-# prompt from then on. *"Two places never both write a lane in silence; the
-# worst a `--force` can do is make the old place stop, loudly."*
-run env FAKE_TMUX_WINDOW="mysess:@60" LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-6 --force "the bench it was in is gone"
-is   "the second place forces the release" "$rc" 0
-bind_guard "$BIND6_ID"
-is   "…and the session it was taken from refuses its next prompt" "$rc" 2
-has  "…naming the line" "$err" "RELEASED BY SOMEBODY ELSE"
-has  "…who wrote it" "$err" "written by session $BIND_REQ_ID"
-has  "…the why they gave" "$err" "the bench it was in is gone"
-has  "…and that it is EVERY prompt from now on, not this one" "$err" "every prompt in this session is refused from here on"
-has  "…naming the exit, which is a handoff this session takes itself" "$err" "lane-handoff --exit"
-bind_guard "$BIND6_ID"
-is   "…and the prompt after it is refused too, which is what \"from then on\" means" "$rc" 2
-# AND IT PERSISTS PAST A THIRD PLACE BINDING THE LANE (Copilot round 1 on #83).
-# Read off the LATEST binding, the refusal stopped the moment somebody took the
-# lane the force had freed — the scan's release fields move on to the new line —
-# while clause (e) says every prompt from then on, until the person here hands
-# off or ends the session. The rule is asked of THIS session's own track: the
-# release another session wrote after this one's last line, wherever the lane
-# has been since.
-run env LANES_LANE=repoBind-6 LANES_SESSION="$BIND_REQ_ID" LANES_HOST=Eagle LANES_CONTAINER=py-bench \
-    "$E" log RESUMED "lane:repoBind-6" '→' "home opensoft/repoBind; estate repoBind; dir $BIND_DIR; profile team-05a; window mysess:9 @60"
-is   "a third place binds the lane the force freed" "$rc" 0
-run "$E" binding repoBind-6
-is   "…so the lane is BOUND again, to that place" "$(printf '%s' "$out" | cut -f5)" "$BIND_REQ_ID"
-bind_guard "$BIND6_ID"
-is   "…and the session it was taken from is STILL refused, which is what clause (e) says" "$rc" 2
-has  "…naming the release it was taken by" "$err" "RELEASED BY SOMEBODY ELSE"
-has  "…and the why that release carried" "$err" "the bench it was in is gone"
-rm -f "$bind_guard_prof/bind6.json"
-
-echo "-- Copilot round 2: what makes a record LEGACY, whose host is whose, and a LIVE row this place may not pronounce on"
-
-# THE `$WS` FALLBACK IS CLAUSE (a)'s CUTOVER AFFORDANCE, not a second name for
-# this machine. A line that carries the three is matched on what it says: the
-# machine's own hostname AND the container.
-run env LANES_HOST=raven "$E" binding repoBind-11
-is   "a MODERN line whose host is another machine is elsewhere, even where \$LANES_WORKSTATION would have matched it" \
-     "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-run env LANES_HOST=Eagle "$E" binding repoBind-11
-is   "…and here where the host it names IS this machine" "$(printf '%s' "$out" | cut -f7)" "here"
-# AND THE SAME LINE WITHOUT THE THREE IS MATCHED ON THE HOST ALONE, which is the
-# cutover rule and is what keeps a pre-amendment estate working.
-run env LANES_HOST=raven "$E" binding repoBind-14
-is   "a PRE-AMENDMENT line is matched on the row's workstation, which is all such a line has" \
-     "$(printf '%s' "$out" | cut -f7)" "here"
-
-# LEGACY IS ALL THREE ABSENT. The writer drops an offending sub-field on its own
-# and keeps the line, so a modern line missing only its host is modern — and the
-# container it DOES carry is what decides.
-run "$E" binding repoBind-12
-is   "a line carrying a container and an os but no host is NOT read as pre-amendment" \
-     "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-is   "…and it is the container it carries that says so" "$(printf '%s' "$out" | cut -f2)" "cloud-bench"
-run env LANES_CONTAINER=cloud-bench "$E" binding repoBind-12
-is   "…so from inside that container the same line is this place's" "$(printf '%s' "$out" | cut -f7)" "here"
-
-# A `LIVE` ROW IS NOT THIS PLACE'S TO PRONOUNCE ON EITHER. `LIVE` is a live
-# session record HERE naming one of the row's ids — and a record written in
-# another container is readable here while the pid it names is in another
-# namespace, so a `kill -0` that answers is answering about some other process.
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoBind-13
-is   "a live record of ANOTHER container still reads LIVE, because the records are shared" \
-     "$(printf '%s' "$out" | cut -f2)" "LIVE"
-is   "…and the read says this place may not pronounce on that binding" "$(printf '%s' "$out" | cut -f13)" "elsewhere"
-is   "…so the pick files it under BOUND ELSEWHERE and asks for the handoff, never LIVE HERE" \
-     "$(printf '%s' "$out" | "$E" lane-groups Eagle | cut -f1)" "elsewhere"
-run env LANES_CONTAINER=cloud-bench LANES_NO_FETCH=1 "$E" lanes --lane repoBind-13
-is   "…while from inside that container it is LIVE HERE, where the attach belongs" \
-     "$(printf '%s' "$out" | "$E" lane-groups Eagle | cut -f1)" "live"
-# AND A PARKED LANE OF ANOTHER CONTAINER IS UNTOUCHED BY ALL OF IT, because
-# parking IS the handoff: column 13 is the locality of a binding that STANDS.
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoBind-5
-is   "a lane whose binding was released carries no locality at all" "$(printf '%s' "$out" | cut -f13)" "none"
-is   "…and is AVAILABLE, wherever it was last run" \
-     "$(printf '%s' "$out" | "$E" lane-groups Eagle | cut -f1)" "available"
-# AND THE PERSON LOSES NOTHING: watching a lane and taking it are two acts, and
-# only the second is the collision. The elsewhere branch names the attach where
-# that window is live on this tmux server.
-bind_save_lanewins="${LANE_TMUX_WINDOWS-}"
-export LANE_TMUX_WINDOWS="$LANE_TMUX_WINDOWS
-$(printf '@62\tcloudsess\t4\t0')"
-run env -C "$BIND_DIR" PATH="$LANEBIN_PATH" "$LANE" repoBind-13 </dev/null
-is   "\`lane <name>\` on a lane bound in another container refuses rather than attaching blind" "$rc" 2
-has  "…naming the container it is bound in" "$err" "in container cloud-bench on host Eagle"
-has  "…and offering the WATCH, which starts nothing and takes nothing" "$err" "or WATCH it where it is"
-# THE WATCH TARGETS THE WINDOW'S ID AND NEVER ITS INDEX (Copilot round 11). The
-# binding's window is the log's `<session>:<index> <@id>`, and the index is the
-# half tmux reissues: `cloudsess:4` can be another lane by the time it is typed.
-has  "…at the window's id, session-qualified" "$err" "-t cloudsess:@62"
-hasnt "…and never at its index, which another window can be given" "$err" "-t cloudsess:4"
-export LANE_TMUX_WINDOWS="$bind_save_lanewins"
-
-# A DRY RUN PRINTS THE PLAN AND DOES NOTHING, INCLUDING THE RE-READ (Copilot
-# round 3). `request-handoff --dry-run` answers 0 without releasing anything, so
-# an unconditional re-read saw the binding still standing and refused — and the
-# one run whose whole job is to print the plan could never print one.
-run env -C "$BIND_DIR" LANES_SESSION="$BIND_REQ_ID" "$START" --dry-run --request-handoff --wait 5 repoBind-12 </dev/null
-is   "\`lane-start --dry-run --request-handoff\` prints a plan instead of refusing on a release it did not make" "$rc" 0
-has  "…the request it would make" "$err" "PLAN: "
-has  "…and the re-read it would make before the rename" "$err" "read the binding again before the rename"
-is   "…having written nothing to that lane's log" \
-     "$(git -C "$WIP" show origin/main:lanes/log/repoBind-12.md | grep -c 'HANDOFF-REQUESTED' || :)" 0
-
-echo "-- Copilot round 4: the window exception is a LOCAL test, and so is the guard's window disjunct"
-
-# `gone` IS THE ONE ANSWER THAT MAKES A BINDING ELSEWHERE READ DEAD, and it hands
-# `lane-start` and `lane` the takeover path. Judged on a host test that accepted
-# the Rule 10 workstation name for EVERY record, a MODERN line naming another
-# machine could be taken over here wherever the two names coincided.
-run env LANES_HOST=raven "$E" binding repoBind-17
-is   "a MODERN binding of another machine is elsewhere" "$(printf '%s' "$out" | cut -f7)" "elsewhere"
-is   "…and its window is UNKNOWN, never gone: this host has no tmux server of that machine's" \
-     "$(printf '%s' "$out" | cut -f8)" "unknown"
-run "$E" binding repoBind-17
-is   "…while from the machine it names, the same absent window IS the dead binding" \
-     "$(printf '%s' "$out" | cut -f8)" "gone"
-run env LANES_HOST=raven LANES_CONTAINER=py-bench "$E" binding repoBind-14
-is   "…and a PRE-AMENDMENT line is still matched on the row's workstation, which is all it has" \
-     "$(printf '%s' "$out" | cut -f7)" "here"
-# AND `gone` IS THE ID RESOLVING NOWHERE, NOT AN ID IN ANOTHER SESSION (Copilot
-# round 6). `lane <name>` MOVES a live lane's window into the asking session,
-# which leaves the record naming the session it came from while the very same
-# window, under the very same id, is alive one session along — and `gone` is the
-# one answer that hands `lane-start` and `lane` the takeover path. A running
-# lane read as a dead binding is a second process on it.
-bind_save_wins2="$FAKE_TMUX_WINDOWS"
-export FAKE_TMUX_WINDOWS="$FAKE_TMUX_WINDOWS
-movedsess:1	@66	repoBind-17	%66	claude"
-run "$E" binding repoBind-17
-is   "an id that resolves in ANOTHER session is UNKNOWN, never gone: a moved window is not a dead one" \
-     "$(printf '%s' "$out" | cut -f8)" "unknown"
-export FAKE_TMUX_WINDOWS="$bind_save_wins2"
-run "$E" binding repoBind-17
-is   "…while an id that resolves NOWHERE is the dead binding it always was" \
-     "$(printf '%s' "$out" | cut -f8)" "gone"
-# AND A TMUX THAT CANNOT BE ASKED IS NOT A DEAD WINDOW EITHER (Copilot round 9).
-# The read comes back EMPTY BOTH where the id resolves nowhere and where there is
-# no server to ask — a container the host's socket was never mounted into, a
-# server not started yet, a `$TMUX_TMPDIR` that differs — and the STATUS tells
-# them apart no better: measured on tmux 3.4, an id resolving nowhere on a server
-# that IS there answers `0` and an empty stdout, no server at all answers 1 and
-# an empty stdout. `command -v tmux` catches only the machine with no BINARY,
-# which is why this fixture has a tmux that IS there and answers nothing. Read as
-# `gone`, the second one makes every binding of every other container on this
-# host read DEAD, which is the one answer that hands `lane-start` and `lane` the
-# takeover path — this clause's own collision, through its own exception.
-mkdir -p "$SANDBOX/deadtmux"
-printf '#!/usr/bin/env bash\nexit 1\n' > "$SANDBOX/deadtmux/tmux"
-chmod +x "$SANDBOX/deadtmux/tmux"
-run env PATH="$SANDBOX/deadtmux:$PATH" "$E" binding repoBind-17
-is   "a tmux that answers NOTHING is no server to ask, which is unknown and never dead" \
-     "$(printf '%s' "$out" | cut -f8)" "unknown"
-is   "…and the binding it could not pronounce on still reads BOUND, to the place it names" \
-     "$(printf '%s' "$out" | cut -f3)" "cloudsess:9 @66"
-run env PATH="$SANDBOX/deadtmux:$PATH" "$E" binding repoBind-15
-is   "…and a LIVE window of this server reads unknown there too, rather than live" \
-     "$(printf '%s' "$out" | cut -f8)" "unknown"
-
-# AND THE GUARD'S WINDOW DISJUNCT IS THREE TESTS AND NOT ONE. It exists for the
-# `/clear`, where the harness minted a new id and the binding's window is still
-# this one — but an `@id` compared alone would make THIS session the answerer
-# for a binding in another container that happens to carry the same number, and
-# the guard would type `/handoff --exit` into this pane for a request nobody
-# made of it.
-write_record "$bind_guard_prof/bind15.json" "$BIND16_ID" "$LIVE_PID" "$live_start" "bindsess:@61.%61" "repoBind-15" "busy"
-run env FAKE_TMUX_WINDOW="mysess:@60" LANES_SESSION="$BIND_REQ_ID" "$E" request-handoff repoBind-15 --no-wait
-is   "a third place asks for a lane bound in another container, whose window id is this window's" "$rc" 2
-bind_keys_before="$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)"
-out="$(printf "$bind_hook" "$BIND16_ID" "$BIND_DIR" | env FAKE_TMUX_WINDOW="bindsess:@61" FAKE_TMUX_WINDOW_NAME=repoBind-15 "$E" guard 2>"$SANDBOX/stderr")"; rc=$?
-err="$(cat "$SANDBOX/stderr")"
-is   "…and a session here whose window merely SHARES that id does not answer it" "$rc" 0
-hasnt "…so it is not told to hand off" "$err" "A HANDOFF WAS REQUESTED"
-is   "…and nothing is typed into its pane" "$(grep -c 'send-keys' "$FAKE_TMUX_LOG" || :)" "$bind_keys_before"
-rm -f "$bind_guard_prof/bind15.json"
-
-echo "-- clause (i): a LIVE lane's one act is the ATTACH, printed filled in"
-
-# From the question Brett Heap asked 2026-09-14T13:47Z, verbatim *"how do i
-# start claude with that profile and that lane? do i use lane command?"*, about
-# a lane LIVE in a detached tmux session — where the listing named the session
-# and no act. A live lane is never started a second time: clause (h) is one live
-# process per transcript, and a `lane-start` on a running lane is exactly the
-# second one.
-write_record "$bind_guard_prof/bind6.json" "$BIND6_ID" "$LIVE_PID" "$live_start" "bindsess:@61.%61" "repoBind-6" "busy"
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoBind-6
-is   "the lane reads LIVE" "$(printf '%s' "$out" | cut -f2)" "LIVE"
-is   "…and column 10 — the one act — is the ATTACH, with the session and window filled in, because this read runs inside tmux" \
-     "$(printf '%s' "$out" | cut -f10)" "tmux switch-client -t bindsess:@61"
-run env -u TMUX LANES_NO_FETCH=1 "$E" lanes --lane repoBind-6
-is   "…and OUTSIDE tmux the same act is the attach, which is the other of the two commands there are" \
-     "$(printf '%s' "$out" | cut -f10)" "tmux attach -t bindsess:@61"
-run env LANES_NO_FETCH=1 "$LANES_CMD" --prefix repoBind
-is   "the listing renders it" "$rc" 0
-has  "…as an ATTACH and never a bind, because the session is already running" "$out" "attach: tmux switch-client -t bindsess:@61"
-has  "…saying why in the same breath" "$out" "never a second lane-start on a running lane"
-hasnt "…and it never offers to start one" "$out" "bind it: lane-start"
-rm -f "$bind_guard_prof/bind6.json"
-
-# THE SECTION'S FIXTURES ARE PUT BACK, for the reason the Amendment 12 section
-# gives: this sits BETWEEN two others in one long file, and a section that left
-# the sandbox's window table and its two seams changed would be rewriting the
-# premise of every case after it from a distance.
-export FAKE_TMUX_WINDOWS="$BIND_SAVE_WINDOWS"
-export FAKE_TMUX_WINDOW="$BIND_SAVE_WINDOW"
-export FAKE_TMUX_WINDOW_NAME="$BIND_SAVE_NAME"
-export FAKE_TMUX_WINDOW_INDEX="$BIND_SAVE_INDEX"
-unset LANES_HOST LANES_CONTAINER
-
-section "== openRepoTools#91: the crash-consistent lifecycle and the worktree inventory =="
-
-# A LANE IS `RUNNING`, `SWAPPING`, `SWAPPED` OR `CLOSED`, AND WHICH OF THOSE IT
-# IS WITH NO LIVE HOLDER IS WHAT SAYS WHERE ITS SESSION STOPPED. Governed by
-# `openspec/changes/add-crash-consistent-lane-worktree-recovery/` and tracked on
-# opensoft/openRepoTools#91.
-#
-# EVERYTHING THIS SECTION ADDS IS ITS OWN — its own repository, its own
-# worktrees, its own lanes and its own handoffs — so that it can be read, moved
-# or merged in one piece. It reuses `$HANDOFF_CMD` from the Amendment 17
-# section above (the same installed copy) and nothing else of it.
-
-RC_ID="91aa0001-1111-4000-8000-91aa00011111"
-RC_ID2="91aa0002-2222-4000-8000-91aa00022222"
-RC_LIVE="91aa0003-3333-4000-8000-91aa00033333"
-
-RC_DIR="$HOME/projects/repoRC"
-mkdir -p "$RC_DIR"
-git init -q -b main "$RC_DIR"
-git -C "$RC_DIR" config user.email "test@example.invalid"
-git -C "$RC_DIR" config user.name "lane helper tests"
-git -C "$RC_DIR" remote add origin "https://github.com/opensoft/repoRC.git"
-printf 'seed\n' > "$RC_DIR/a.txt"
-git -C "$RC_DIR" add -A >/dev/null 2>&1
-git -C "$RC_DIR" commit -q -m "the lane's own first commit"
-
-# ONE WRITER WORKTREE, A REAL ONE — `git worktree add` in the lane's own
-# checkout, which is what the reconciliation reads back out of
-# `git worktree list --porcelain`.
-mkdir -p "$RC_DIR/.claude/worktrees"
-git -C "$RC_DIR" worktree add -q -b feat/rc1 "$RC_DIR/.claude/worktrees/w1" >/dev/null 2>&1
-printf 'uncommitted\n' > "$RC_DIR/.claude/worktrees/w1/b.txt"
-
-mkdir -p "$WIP/handoffs/repoRC"
-rc_seed_handoff() {   # <lane>
-  { printf 'Lane: %s (team-01a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$1" "$RC_ID"
-    printf '\n'
-    printf 'Seeded for the openRepoTools#91 cases.\n'
-  } > "$WIP/handoffs/repoRC/$1.md"
-}
-rc_row() {   # <lane> <session cell> [<handoff cell>]
-  "$E" add-row "| \`$1\` | $2 | Eagle / test / brett | 2026-09-15T00:00Z | none | ${3:-handoffs/repoRC/$1.md} | ACTIVE |" >/dev/null 2>&1
-}
-rc_seed_log() {   # <lane> [<extra line>…]
-  rc_l="$1"; shift
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$rc_l"
-    printf 'STARTED — lane %s, session %s@Eagle, 2026-09-15T00:00:00Z, lane:%s → home opensoft/repoRC; dir %s; profile team-01a\n' \
-      "$rc_l" "$RC_ID" "$rc_l" "$RC_DIR"
-    for rc_x in "$@"; do printf '%s\n' "$rc_x"; done
-  } > "$LOGD/$rc_l.md"
-  git -C "$WIP" add -- "lanes/log/$rc_l.md"
-  git -C "$WIP" commit -q -m "LOG($rc_l@Eagle): seed"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  return 0
-}
-for rc_l in repoRC-1 repoRC-2 repoRC-3 repoRC-4 repoRC-5 repoRC-6; do
-  rc_seed_handoff "$rc_l"
-done
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the openRepoTools#91 handoffs"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-rc_row repoRC-1 "harness \`$RC_ID\`"
-rc_row repoRC-2 "harness \`$RC_ID\`"
-rc_row repoRC-3 "harness \`$RC_ID\`"
-rc_row repoRC-4 "harness \`$RC_LIVE\`"
-rc_row repoRC-5 "harness \`$RC_ID\`"
-# THE LANE WHOSE HANDOFF CANNOT BE FOUND — its row names a path that is not
-# there, which is how the "one mandatory write did not land" case is made
-# without breaking anything else.
-rc_row repoRC-6 "harness \`$RC_ID\`" "handoffs/repoRC/nowhere-at-all.md"
-for rc_l in repoRC-1 repoRC-2 repoRC-3 repoRC-4 repoRC-5 repoRC-6; do
-  rc_seed_log "$rc_l"
-done
-
-RC_STATE_ROOT="$HOME/projects/.lane-state"
-
-# ------------------------------------- 1. nothing is backfilled, and 8 says so
-
-run "$E" lane-state repoRC-1
-is    "a lane that has never transitioned has no snapshot, and that is 8 and not a failure" "$rc" 8
-run "$E" lane-trees repoRC-1
-is    "…and no inventory either" "$rc" 8
-run "$E" lane-reconcile repoRC-1
-is    "lane-reconcile still answers for it" "$rc" 0
-is    "…with the verdict that names the cutover rule rather than guessing a crash" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "no-state"
-is    "…and nothing was created on disk by a read" \
-      "$( [ -e "$RC_STATE_ROOT/repoRC-1" ] && echo made || echo none )" none
-
-# ---------------------- 2. the confirming act writes RUNNING, and the hook never does
-
-run env LANES_LANE=repoRC-1 LANES_SESSION="$RC_ID" "$E" log RESUMED lane:repoRC-1 '→' "dir $RC_DIR; profile team-01a" "relaunched"
-is    "a RESUMED is written" "$rc" 0
-run "$E" lane-state repoRC-1
-is    "…and the lane is RUNNING: the confirming act writes it, not the SessionStart hook (Amendment 8, R-A8-1)" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" RUNNING
-is    "…at generation 1, because a new owner advances the fence" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" 1
-is    "…owned by the session the line names" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "owner" { print $2 }')" "$RC_ID"
-is    "…and the profile the payload carried" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "profile" { print $2 }')" team-01a
-
-rc_snap_sum="$(cksum < "$RC_STATE_ROOT/repoRC-1/lane-state.yaml")"
-printf '{"session_id":"%s","source":"startup","cwd":"%s"}' "$RC_ID" "$RC_DIR" | "$E" session-start >/dev/null 2>&1
-is    "the SessionStart hook writes NO lifecycle state — it never writes at all (R-A8-1)" \
-      "$(cksum < "$RC_STATE_ROOT/repoRC-1/lane-state.yaml")" "$rc_snap_sum"
-
-run env LANES_LANE=repoRC-1 LANES_SESSION="$RC_ID" "$E" log ENDED lane:repoRC-1 "finished"
-run "$E" lane-state repoRC-1
-is    "an ENDED closes the lifecycle too" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" CLOSED
-
-# --------------------------------------------------- 3. the two crash kinds
-
-run "$E" set-lane-state repoRC-2 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-is    "set-lane-state writes the first snapshot for a lane that has none" "$rc" 0
-run "$E" lane-reconcile repoRC-2
-is    "RUNNING with no live holder is an UNGRACEFUL STOP — the session died before any handoff began" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "ungraceful-stop"
-has   "…and the report says so in the words a resumed session acts on" "$out" "before any handoff began"
-run "$E" set-lane-state repoRC-2 SWAPPING --expect RUNNING
-is    "…the lane moves to SWAPPING" "$rc" 0
-rc_gen="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')"
-rc_op="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "operation" { print $2 }')"
-run "$E" lane-reconcile repoRC-2
-is    "SWAPPING with no live holder is an INTERRUPTED SWAP — the handoff began and did not finish" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "interrupted-swap"
-has   "…naming the operation that never finished" "$out" "$rc_op"
-has   "…and saying the three writes may each be half done" "$out" "may each be half done"
-
-# THE HOLDER IS THE OTHER HALF OF EVERY VERDICT, and a record this workstation
-# really has is what makes one live.
-write_record_ns "$sessions_dir/live-rc91.json" "$RC_LIVE" "$LIVE_PID" "$live_start" "rcsess:@31.%31" "repoRC-4" "user" "busy"
-run "$E" set-lane-state repoRC-4 RUNNING --owner "$RC_LIVE" --agent claude
-run "$E" lane-reconcile repoRC-4
-is    "RUNNING with a live holder is a lane that is RUNNING, and not a crash" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "running"
-hasnt "…and never an ungraceful stop" "$out" "ungraceful-stop"
-run "$E" set-lane-state repoRC-4 SWAPPING --expect RUNNING
-run "$E" lane-reconcile repoRC-4
-is    "SWAPPING with a live holder is a swap in flight, not an interrupted one" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "swap-in-progress"
-hasnt "…and is never reported as interrupted" "$out" "interrupted-swap"
-
-# ------------------------------------------------------------- 4. the fence
-
-run "$E" set-lane-state repoRC-2 SWAPPING --expect none
-is    "a transition whose --expect no longer matches is refused with 7, the estate's 'another act got there first'" "$rc" 7
-has   "…naming what it found against what was expected" "$err" "state is SWAPPING and --expect named none"
-run "$E" lane-state repoRC-2
-is    "…and nothing was written: the generation is where it was" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" "$rc_gen"
-
-run "$E" set-lane-state repoRC-2 SWAPPED --expect SWAPPING --expect-generation "$rc_gen" --expect-operation "op-no-such-operation"
-is    "a STALE FINALIZER — the right state and generation, another operation — is refused" "$rc" 7
-has   "…and says a stale finalizer must never overwrite a newer owner" "$err" "must never overwrite a newer owner"
-run "$E" set-lane-state repoRC-2 SWAPPED --expect SWAPPING --expect-generation "$rc_gen" --expect-operation "$rc_op"
-is    "the operation that owns the transition finishes it" "$rc" 0
-is    "…and SWAPPED keeps the generation, because it is the same operation reaching its commit point" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" "$rc_gen"
-run "$E" lane-state repoRC-2
-is    "…and a transition that named no owner KEPT the one that was there" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "owner" { print $2 }')" "$RC_ID"
-run "$E" lane-reconcile repoRC-2
-is    "a swapped lane with no holder is resumable" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "resumable"
-
-# A COMPETING RESUME ADVANCES THE GENERATION, and that is what refuses the old
-# swap's finalizer if it ever wakes — the whole point of the fence.
-run "$E" set-lane-state repoRC-3 RUNNING --owner "$RC_ID"
-run "$E" set-lane-state repoRC-3 SWAPPING --expect RUNNING
-rc3_gen="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')"
-rc3_op="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "operation" { print $2 }')"
-run env LANES_LANE=repoRC-3 LANES_SESSION="$RC_ID2" "$E" log RESUMED lane:repoRC-3 '→' "dir $RC_DIR; profile team-01b" "somebody recovered it"
-is    "a recovery resumes the lane while a swap is still recorded in flight" "$rc" 0
-run "$E" lane-state repoRC-3
-is    "…taking it RUNNING under a NEW generation" \
-      "$( [ "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" -gt "$rc3_gen" ] && echo advanced || echo stuck )" advanced
-run "$E" set-lane-state repoRC-3 SWAPPED --expect SWAPPING --expect-generation "$rc3_gen" --expect-operation "$rc3_op"
-is    "…so the interrupted swap's own finalizer is refused when it returns" "$rc" 7
-run "$E" lane-state repoRC-3
-is    "…and the lane it would have marked SWAPPED is still RUNNING" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" RUNNING
-
-# ------------------- 5. the handoff: SWAPPING before the poll, SWAPPED after
-
-run "$E" set-lane-state repoRC-5 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$RC_ID" \
-    CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane repoRC-5 clear
-is    "lane-handoff exits 0" "$rc" 0
-rc5_err="$err"
-has   "…taking the lane RUNNING -> SWAPPING" "$rc5_err" "lifecycle: RUNNING -> SWAPPING"
-has   "…and SWAPPING -> SWAPPED once every mandatory write has landed" "$rc5_err" "lifecycle: SWAPPING -> SWAPPED"
-is    "…in that order, and SWAPPING BEFORE the writers are polled: a session that dies during the poll must not read as an ungraceful stop" \
-      "$(printf '%s\n' "$rc5_err" | awk '/lifecycle: RUNNING -> SWAPPING/ { s = NR } /writers polled:/ { p = NR } END { print (s > 0 && p > 0 && s < p) ? "before" : "not-before" }')" "before"
-run "$E" lane-state repoRC-5
-is    "the lane is SWAPPED" "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" SWAPPED
-is    "…and the record's kind is on the snapshot too" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "kind" { print $2 }')" unknown
-
-run "$E" lane-trees repoRC-5
-is    "the handoff took a machine-readable inventory" "$rc" 0
-rc5_tree="$(printf '%s\n' "$out" | head -n 1)"
-is    "…naming the writer's worktree" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $2}')" "$RC_DIR/.claude/worktrees/w1"
-is    "…its branch" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $3}')" "feat/rc1"
-is    "…its FULL head, which an abbreviated %h is not (it lengthens as a repository grows)" \
-      "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $4}')" \
-      "$(git -C "$RC_DIR/.claude/worktrees/w1" rev-parse HEAD)"
-is    "…its upstream, without which 0 unpushed cannot be told from 'tracks nothing'" \
-      "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $5}')" none
-is    "…its dirty count" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $6}')" 1
-is    "…its unpushed count" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $7}')" 0
-is    "…the writer that held it" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $8}')" "$RC_ID"
-is    "…and the checkout it belongs to" "$(printf '%s' "$rc5_tree" | awk -F'\037' '{print $10}')" "$RC_DIR"
-is    "the sidecar is BESIDE the lane and never inside the worktree it describes" \
-      "$( [ -e "$RC_DIR/.claude/worktrees/w1/lane-state.yaml" ] || [ -e "$RC_DIR/.claude/worktrees/w1/.lane-state" ] && echo inside || echo beside )" beside
-is    "…so the worktree it describes is no dirtier for having been recorded" \
-      "$(git -C "$RC_DIR/.claude/worktrees/w1" status --short | grep -c .)" 1
-
-# THE FOURTH WINDOW: the replacement has not started yet, so the lane stays
-# SWAPPED and nothing has written RUNNING on a launcher's behalf.
-run "$E" lane-reconcile repoRC-5
-is    "between the handoff and the next session the lane is resumable, not running" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "resumable"
-is    "…and the dirty writer worktree is reported as dirty" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/w1$/ { print $3 }')" "dirty"
-run env LANES_LANE=repoRC-5 LANES_SESSION="$RC_ID2" "$E" log RESUMED lane:repoRC-5 '→' "dir $RC_DIR; profile team-09z" "the next session"
-run "$E" lane-state repoRC-5
-is    "…and only the confirming act takes it back to RUNNING" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" RUNNING
-is    "PROFILE ROTATION IS NOT LANE IDENTITY: the new profile is recorded" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "profile" { print $2 }')" team-09z
-run "$E" lane-trees repoRC-5
-is    "…and the same worktree inventory comes back under it, at the same control root" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '{print $2}' | head -n 1)" "$RC_DIR/.claude/worktrees/w1"
-
-# ---------- 6. one mandatory write missing leaves the lane SWAPPING, honestly
-
-run "$E" set-lane-state repoRC-6 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$RC_ID" \
-    CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane repoRC-6 clear
-is    "a handoff whose handoff file cannot be found still completes (R-A11-11: a swap is never left unwritten)" "$rc" 0
-has   "…and still prints the restart line" "$out" "READY — restart with:"
-run "$E" lane-state repoRC-6
-is    "…but the lane stays SWAPPING, because one of the three mandatory writes did not land" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" SWAPPING
-run "$E" lane-reconcile repoRC-6
-is    "…which a later session reads as an interrupted swap and not as a clean handoff" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "interrupted-swap"
-
-# ------------------------------------ 7. what the reconciliation classifies
-
-# A tree that is GONE and was last seen holding work is POSSIBLE LOSS, and a
-# tree that is gone and was clean and published is MISSING: no metadata
-# reconstructs a file's contents, and the two must never read the same.
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/lost" --checkout "$RC_DIR" \
-    --branch feat/lost --head 0123456789abcdef0123456789abcdef01234567 --upstream origin/feat/lost --dirty 4 --unpushed 2
-is    "set-lane-tree records a tree from the caller's own observation" "$rc" 0
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/tidy" --checkout "$RC_DIR" \
-    --branch feat/tidy --head 89abcdef0123456789abcdef0123456789abcdef --upstream origin/feat/tidy --dirty 0 --unpushed 0
-# An UNMANAGED tree: git registers it and no sidecar of this lane names it.
-git -C "$RC_DIR" worktree add -q -b feat/rc-unmanaged "$RC_DIR/.claude/worktrees/unmanaged" >/dev/null 2>&1
-# A STALE REGISTRATION: git still holds the path and the directory is gone.
-git -C "$RC_DIR" worktree add -q -b feat/rc-stale "$RC_DIR/.claude/worktrees/stale" >/dev/null 2>&1
-rm -rf "$RC_DIR/.claude/worktrees/stale"
-# A DETACHED HEAD, which a branch name cannot describe.
-git -C "$RC_DIR" worktree add -q --detach "$RC_DIR/.claude/worktrees/detached" >/dev/null 2>&1
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/detached" --checkout "$RC_DIR"
-
-run "$E" lane-reconcile repoRC-5
-rc5_rep="$out"
-is    "a missing tree that last held dirty or unpushed work is POSSIBLE LOSS" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/lost$/ { print $3 }')" "possible-loss"
-has   "…and says plainly that nothing here reconstructs uncommitted files" "$rc5_rep" "NOTHING here can reconstruct uncommitted files"
-is    "a missing tree that was clean and published is MISSING, and not a possible loss" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/tidy$/ { print $3 }')" "missing"
-has   "…naming the estate's own resume as the only rebuild, rather than running it" \
-      "$rc5_rep" "the estate parked record and \`resume <Name>\` are the only rebuild"
-is    "a tree git registers that no sidecar names is UNMANAGED" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/unmanaged$/ { print $3 }')" "unmanaged"
-has   "…and is left exactly as it is" "$rc5_rep" "it is left exactly as it is"
-is    "a registration whose directory is gone is a STALE REGISTRATION" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/stale$/ { print $3 }')" "stale-registration"
-has   "…naming the prune that clears it, which is a person's act" "$rc5_rep" "worktree prune"
-is    "a detached HEAD is recorded and reported as detached, not as a branch" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/detached$/ { print $5 }' | awk '{print $2}')" "detached"
-has   "the stored observation is a COMPARISON POINT and the report says what git says NOW" "$rc5_rep" "observed"
-is    "every discovered tree is named ONCE, whichever of the two sweeps found it" \
-      "$(printf '%s\n' "$rc5_rep" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/unmanaged$/' | grep -c .)" 1
-
-# AND IT RESET NOTHING. This is the claim the whole read exists under:
-# `park` CREATES NOTHING and `resume` RESETS NOTHING (AGENTS.md rule 1).
-is    "the dirty writer's uncommitted file survived the reconciliation" \
-      "$( [ -f "$RC_DIR/.claude/worktrees/w1/b.txt" ] && echo kept || echo gone )" kept
-is    "…the unmanaged worktree was not deleted" \
-      "$( [ -d "$RC_DIR/.claude/worktrees/unmanaged" ] && echo kept || echo gone )" kept
-is    "…the stale registration was not pruned" \
-      "$(git -C "$RC_DIR" worktree list --porcelain | grep -c 'worktrees/stale$')" 1
-is    "…and no missing path was recreated" \
-      "$( [ -e "$RC_DIR/.claude/worktrees/lost" ] && echo made || echo none )" none
-
-# ------------------------------- 8. a schema this reader does not know is closed
-
-printf 'schema: 999\nstate: WONDERLAND\n' > "$RC_STATE_ROOT/repoRC-3/lane-state.yaml"
-run "$E" lane-state repoRC-3
-has   "a snapshot written by a newer tooling is UNKNOWN-SCHEMA and never a state this reader acts on" "$out" "UNKNOWN-SCHEMA"
-run "$E" lane-reconcile repoRC-3
-is    "…and the verdict says nothing is assumed about it" "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "unknown-state"
-
-# ------------------------------------------ 9. the usage contract of the five
-
-run "$E" lane-state
-is    "lane-state with no lane is 64, the code every read in front of a launch spends" "$rc" 64
-run "$E" set-lane-state repoRC-5 NOWHERE
-is    "a fifth state word is refused" "$rc" 64
-has   "…naming the four there are" "$err" "RUNNING, SWAPPING, SWAPPED and CLOSED are the four"
-run "$E" set-lane-tree repoRC-5 relative/path
-is    "a relative worktree path is refused: no later reader shares this process's directory" "$rc" 64
-run "$E" lane-reconcile repoRC-5 extra-argument
-is    "lane-reconcile takes one lane" "$rc" 64
-
-# ------------- 10. lane-start prints the recovery report before it writes anything
-
-run "$E" set-lane-state repoRC-2 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-run "$START" repoRC 2 --no-launch
-is    "lane-start on a lane whose last session stopped ungracefully still starts it" "$rc" 0
-has   "…and says so first: the report is printed BEFORE the row and the log are written" "$err" "LANE RECOVERY"
-has   "…with the crash kind" "$err" "ungraceful-stop"
-has   "…and the line that says nothing was touched" "$err" "Nothing here was reset, recreated or deleted"
-run "$E" lane-state repoRC-2
-is    "…and the lane it just bound is RUNNING under the act that confirmed it" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" RUNNING
-
-
-# ---- 11. the six fences of the review round (Copilot round 5 on #97)
-#
-# EACH OF THESE IS ONE OF THE FENCES THIS CAPABILITY EXISTS FOR, and every one
-# of them was a hole in the first implementation: a follow-up that read the
-# generation and replaced the snapshot outside the mutex and outside any fence
-# of its own; two writers that walked straight past the fail-closed schema check
-# the reader beside them keeps; an inventory whose generation and operation were
-# written into every sidecar and compared with nothing; a handoff that made a
-# second observation of its own, with its own error handling; an inventory
-# reader that read every `*.yaml` under `trees/` whatever it claimed to be; and
-# an observation that turned a git read which FAILED into `unknown`, `none` or a
-# `0` that reads as *everything here is published*.
-#
-# The cases below write object-log lines, and `lanes-edit.sh` refuses a write on
-# a checkout it cannot rebase. The sections above leave refreshed handoffs
-# uncommitted on purpose, because those cases are about them; this one is about
-# the fences, so the checkout is committed first and that refusal is out of the
-# way — the same thing the workstation-seam section below does, for the same
-# reason.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending handoffs before the fence cases" >/dev/null 2>&1 || :
-
-# (a) A SNAPSHOT THIS HELPER CANNOT READ IS NEVER REPLACED BY ONE IT CAN.
-# `repoRC-3` carries the `schema: 999` file section 8 wrote. A reader that fails
-# closed beside a writer that reads the raw fields and renames its own file over
-# the top protects nothing: the record an older helper could not read is exactly
-# the record it would destroy, and no later reader can undo that.
-rc3_sum="$(cksum < "$RC_STATE_ROOT/repoRC-3/lane-state.yaml")"
-run "$E" set-lane-state repoRC-3 RUNNING --owner "$RC_ID"
-is    "a writer meeting a snapshot whose schema it does not write REFUSES" "$rc" 1
-has   "…naming what it found" "$err" "records schema 999"
-is    "…and the file it would have replaced is byte for byte what it was" \
-      "$(cksum < "$RC_STATE_ROOT/repoRC-3/lane-state.yaml")" "$rc3_sum"
-run env LANES_LANE=repoRC-3 LANES_SESSION="$RC_ID" "$E" log RESUMED lane:repoRC-3 '→' "dir $RC_DIR; profile team-01a" "a resume that meets a snapshot it cannot read"
-is    "…the event line itself still lands, because the lifecycle never fails the event" "$rc" 0
-has   "…and the follow-up says why it wrote nothing" "$err" "schema this helper does not write"
-is    "…having left that snapshot alone too" \
-      "$(cksum < "$RC_STATE_ROOT/repoRC-3/lane-state.yaml")" "$rc3_sum"
-
-# (b) A FOLLOW-UP WHOSE LANE MOVED UNDER IT WRITES NOTHING. The window is real
-# and it is not small: `write_event` appends the line, commits it and pushes it
-# BEFORE the snapshot is moved, and a lane can be recovered by somebody else
-# inside it. The `post-commit` hook below is that somebody — it moves the
-# snapshot by hand, with no helper and no mutex, in the middle of the write — so
-# this case is a SCHEDULE and not a race.
-rc_seed_handoff repoRC-7
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed repoRC-7's handoff" >/dev/null 2>&1 || :
-rc_row repoRC-7 "harness \`$RC_ID\`"
-rc_seed_log repoRC-7
-run "$E" set-lane-state repoRC-7 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-is    "the lane a delayed write will be about is RUNNING" "$rc" 0
-mkdir -p "$WIP/.git/hooks"
-cat > "$WIP/.git/hooks/post-commit" <<HOOK
-#!/bin/sh
-[ -f "$SANDBOX/rc7-interleave" ] || exit 0
-rm -f "$SANDBOX/rc7-interleave"
-printf 'schema: 1\nlane: repoRC-7\nstate: SWAPPING\ngeneration: 9\noperation: op-somebody-elses-recovery\nowner: $RC_ID2\nagent: claude\nprofile: team-09z\nworkstation: Eagle\nkind: clear\nupdated: 2026-09-15T12:00:00Z\n' > "$RC_STATE_ROOT/repoRC-7/lane-state.yaml"
-exit 0
-HOOK
-chmod +x "$WIP/.git/hooks/post-commit"
-: > "$SANDBOX/rc7-interleave"
-run env LANES_LANE=repoRC-7 LANES_SESSION="$RC_ID2" "$E" log RESUMED lane:repoRC-7 '→' "dir $RC_DIR; profile team-09z" "a resume overtaken while it was being written"
-rc7_err="$err"
-is    "the delayed RESUMED's own line still lands" "$rc" 0
-has   "…and the follow-up says the lane moved under it" "$rc7_err" "the lane lifecycle moved under this RESUMED"
-run "$E" lane-state repoRC-7
-is    "…the lane another act took to SWAPPING mid-write is STILL SWAPPING" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" SWAPPING
-is    "…at the generation that act gave it, never overwritten by a write that began before it" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" 9
-rm -f "$WIP/.git/hooks/post-commit"
-
-# (c) AN OBSERVATION FILED UNDER AN OPERATION THE LANE HAS MOVED PAST IS
-# REFUSED. The pair was written into every sidecar from the first commit of this
-# capability and read by nothing, so a handoff that stalled while a recovery
-# advanced the lane filed its superseded poll straight over the current one.
-run "$E" lane-state repoRC-5
-rc5_gen="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')"
-rc5_op="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "operation" { print $2 }')"
-rc5_w1head="$(git -C "$RC_DIR/.claude/worktrees/w1" rev-parse HEAD)"
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/w1" --checkout "$RC_DIR" \
-    --branch feat/rc1 --head 0000000000000000000000000000000000000000 --upstream none \
-    --dirty 0 --unpushed 0 --generation "$rc5_gen" --operation op-a-superseded-handoff
-is    "an inventory write whose operation is not the lane's is refused with 7" "$rc" 7
-has   "…saying a superseded reading is not filed where the current one belongs" "$err" "superseded reading"
-run "$E" lane-trees repoRC-5
-is    "…and the reading that was there is the one that is there" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/w1$/ { print $4 }')" "$rc5_w1head"
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/w1" --checkout "$RC_DIR" \
-    --branch feat/rc1 --head "$rc5_w1head" --upstream none --dirty 1 --unpushed 0 \
-    --generation "$rc5_gen" --operation "$rc5_op"
-is    "…while the operation the lane IS on records its observation" "$rc" 0
-
-# (d) ONE IMPLEMENTATION OF THE OBSERVATION, and the proof is a value only that
-# one produces. A branch whose upstream is CONFIGURED and whose remote-tracking
-# ref is not in this checkout — the ordinary state of a branch whose remote was
-# deleted after its merge — has `unknown` unpushed, never the `0` that a
-# `git log @{u}.. | grep -c .` of the caller's own answers and that reads as
-# *everything here is published*.
-git -C "$RC_DIR/.claude/worktrees/w1" config branch.feat/rc1.remote origin
-git -C "$RC_DIR/.claude/worktrees/w1" config branch.feat/rc1.merge refs/heads/feat/rc1
-run "$E" lane-tree-now "$RC_DIR/.claude/worktrees/w1"
-is    "lane-tree-now answers for a real checkout" "$rc" 0
-is    "…naming the upstream that IS configured rather than 'none'" \
-      "$(printf '%s' "$out" | awk -F'\037' '{print $3}')" "origin/feat/rc1"
-is    "…and 'unknown' for a count against a ref this checkout does not have" \
-      "$(printf '%s' "$out" | awk -F'\037' '{print $5}')" "unknown"
-run "$E" lane-tree-now "$RC_DIR/.claude/worktrees/there-is-nothing-here"
-is    "…8 where there is no checkout at the path" "$rc" 8
-run "$E" lane-tree-now relative/path
-is    "…and 64 for a relative path, which names whatever directory the caller happens to be in" "$rc" 64
-# A BRANCH WITH NO COMMIT YET IS A STATE, NOT A BROKEN REPOSITORY — and it is
-# the one `rev-parse --abbrev-ref HEAD` refuses exactly as it refuses a corrupt
-# HEAD, so `symbolic-ref` is what tells the two apart. Outside both lane roots,
-# so it joins nobody's sweep.
-mkdir -p "$HOME/projects/rc-unborn"
-git init -q -b main "$HOME/projects/rc-unborn"
-run "$E" lane-tree-now "$HOME/projects/rc-unborn"
-is    "a branch with no commit yet is answered, not refused" "$rc" 0
-is    "…with 'unborn' for the head no commit has given it" \
-      "$(printf '%s' "$out" | awk -F'\037' '{print $2}')" "unborn"
-is    "…and the branch it is on all the same" \
-      "$(printf '%s' "$out" | awk -F'\037' '{print $1}')" "main"
-
-run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$RC_ID2" \
-    CLAUDE_PROFILE_NAME=team-09z "$HANDOFF_CMD" --lane repoRC-7 clear
-is    "a handoff over a lane another act left SWAPPING still completes" "$rc" 0
-has   "…and its WRITERS section carries the helper's own reading of that writer" "$out" "unknown unpushed"
-run "$E" lane-trees repoRC-7
-is    "…which is the reading its sidecar carries too, because the two are ONE observation" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/w1$/ { print $7 }')" "unknown"
-run env LANES_LANE=repoRC-7 LANES_SESSION="$RC_ID" "$E" log RESUMED lane:repoRC-7 '→' "dir $RC_DIR; profile team-01a" "the next session"
-run "$E" lane-reconcile repoRC-7
-has   "…and an inventory taken under an earlier generation SAYS so, rather than reading as current" \
-      "$out" "observed under generation"
-is    "…while the tree whose unpushed count cannot be made is classed by that, never as published" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/w1$/ { print $3 }')" \
-      "dirty+unpushed-unknown"
-
-# (e) A TREE SIDECAR THIS READER DOES NOT KNOW IS SAID AND NEVER PARSED. Until
-# this round every `*.yaml` under `trees/` was read field by field whatever it
-# claimed to be — so a record written by a newer tooling was reported as an
-# ordinary observation, in fields this reader was guessing at.
-run "$E" lane-trees repoRC-5
-rc5_w1_id="$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/w1$/ { print $1 }')"
-is    "the writer's sidecar has an id derived from its path" \
-      "$( [ -n "$rc5_w1_id" ] && echo yes || echo no )" "yes"
-printf 'schema: 999\ntree: %s\npath: %s\nbranch: feat/wonderland\ndirty: 0\nunpushed: 0\n' \
-  "$rc5_w1_id" "$RC_DIR/.claude/worktrees/w1" > "$RC_STATE_ROOT/repoRC-5/trees/$rc5_w1_id.yaml"
-run "$E" lane-reconcile repoRC-5
-is    "a tree sidecar written by a newer tooling is UNKNOWN-SCHEMA, not an observation" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v id="$rc5_w1_id" '$1 == "TREE" && $2 == id { print $3 }')" "unknown-schema"
-hasnt "…and none of its fields is read, so nothing is compared against them" "$out" "feat/wonderland"
-rc5w1_sum="$(cksum < "$RC_STATE_ROOT/repoRC-5/trees/$rc5_w1_id.yaml")"
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/w1" --checkout "$RC_DIR" \
-    --branch feat/rc1 --head "$rc5_w1head" --upstream none --dirty 1 --unpushed 0
-is    "…and the writer refuses to replace a record it cannot read" "$rc" 1
-is    "…so that file is byte for byte what it was" \
-      "$(cksum < "$RC_STATE_ROOT/repoRC-5/trees/$rc5_w1_id.yaml")" "$rc5w1_sum"
-
-# (f) A GIT READ THAT FAILED IS NEVER COMPLETED WITH A CLEAN-LOOKING VALUE. The
-# fixture is a real worktree whose HEAD git can no longer resolve: `rev-parse
-# --git-dir` still answers there — which is all the first implementation asked —
-# and every read after it fails, which used to produce `branch unknown, head
-# unknown, upstream none, 0 dirty, 0 unpushed`: a record a later reconciliation
-# reads as clean and published.
-git -C "$RC_DIR" worktree add -q -b feat/rc-broken "$RC_DIR/.claude/worktrees/broken" >/dev/null 2>&1
-printf 'ref: refs/heads/\n' > "$RC_DIR/.git/worktrees/broken/HEAD"
-run "$E" lane-tree-now "$RC_DIR/.claude/worktrees/broken"
-is    "an observation git could not complete is 1" "$rc" 1
-is    "…and prints NOTHING, rather than a branch and two zero counts" "$out" ""
-has   "…naming the act a person takes" "$err" "git -C $RC_DIR/.claude/worktrees/broken status"
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/broken" --checkout "$RC_DIR"
-is    "…and nothing is recorded for a tree this process could not read" "$rc" 1
-run "$E" lane-trees repoRC-5
-is    "…so the inventory gained no row for it" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/broken$/' | grep -c .)" 0
-run "$E" set-lane-tree repoRC-5 "$RC_DIR/.claude/worktrees/broken" --checkout "$RC_DIR" \
-    --branch feat/rc-broken --head 2222222222222222222222222222222222222222 \
-    --upstream none --dirty 3 --unpushed 1
-is    "a caller's OWN observation of it is still recorded: the refusal is about INVENTING one" "$rc" 0
-run "$E" lane-reconcile repoRC-5
-is    "…and the reconciliation reports it UNREADABLE, neither clean nor missing" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/broken$/ { print $3 }')" "unreadable"
-has   "…assuming nothing about what it holds" "$out" "NOTHING is assumed about it"
-is    "…and it was left exactly as it is, like every other tree this read names" \
-      "$( [ -d "$RC_DIR/.claude/worktrees/broken" ] && echo kept || echo gone )" "kept"
-
-# (g) ONE TREE, ONE ROW, THROUGH HOWEVER MANY SPELLINGS OF ITS PATH. The report
-# reads three sources that do not agree about spelling: a sidecar holds the path
-# its poll was given, `git worktree list --porcelain` answers with the PHYSICAL
-# path, and the on-disk sweep walks the recorded `dir`. Every estate with a
-# `projects` symlink reaches its checkouts through it — and on macOS `$TMPDIR`
-# and `$HOME` live under `/var`, which IS a symlink to `/private/var`, which is
-# how the four cases of section 7 above went red on that runner alone at
-# `612ba5c`: every tree was reported TWICE, once as the tree it is and once as a
-# tree nobody manages. `612ba5c` resolved the lane's OWN checkout for this exact
-# reason and left the trees under it unresolved. The lane below reaches the same
-# checkout through a link, so the defect is reproducible on every platform.
-RC_LINK="$HOME/projects/repoRCL"
-ln -s "$RC_DIR" "$RC_LINK"
-rc_seed_handoff repoRC-8
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed repoRC-8's handoff" >/dev/null 2>&1 || :
-rc_row repoRC-8 "harness \`$RC_ID\`"
-{ printf '# lane repoRC-8 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRC-8, session %s@Eagle, 2026-09-15T00:00:00Z, lane:repoRC-8 → home opensoft/repoRC; dir %s; profile team-01a\n' \
-    "$RC_ID" "$RC_LINK"
-} > "$LOGD/repoRC-8.md"
-git -C "$WIP" add -- "lanes/log/repoRC-8.md" >/dev/null 2>&1
-git -C "$WIP" commit -q -m "LOG(repoRC-8@Eagle): seed"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$E" set-lane-state repoRC-8 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-is    "a lane whose recorded directory reaches its checkout through a link is RUNNING" "$rc" 0
-run "$E" set-lane-tree repoRC-8 "$RC_LINK/.claude/worktrees/w1" --checkout "$RC_LINK" \
-    --branch feat/rc1 --head "$rc5_w1head" --upstream none --dirty 1 --unpushed 0
-is    "…and its writer is recorded under the spelling the poll was given" "$rc" 0
-run "$E" lane-reconcile repoRC-8
-is    "a tree recorded through a linked path is named ONCE, not once as itself and once as unmanaged" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/w1$/' | grep -c .)" 1
-is    "…as the tree it is, and never as one nobody manages" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $4 ~ /worktrees\/w1$/ && $3 == "unmanaged"' | grep -c .)" 0
-is    "…and the lane's own checkout is still not a tree either, whichever spelling names it" \
-      "$(printf '%s\n' "$out" | awk -F'\037' -v d="$RC_DIR" '$1 == "TREE" && $4 == d' | grep -c .)" 0
-
-# ---- 12. the two safety holes of the sixth round (Copilot round 6 on #97)
-#
-# BOTH OF THESE ARE THE SAME RULE READ IN TWO PLACES. A snapshot that IS THERE
-# and cannot be read was answered as *this lane has no snapshot*, which is the
-# verdict a launcher goes straight past; and an inventory write that named no
-# fence took no mutex at all, so the file every other writer of it is serialized
-# on was the one file two writers could race. The rest of that round's findings
-# are filed as issues and named in the change's `tasks.md` section 7: rounds are
-# capped at two per pull request, and these two are what could not wait.
-
-rc_seed_handoff repoRC-9
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed repoRC-9's handoff" >/dev/null 2>&1 || :
-rc_row repoRC-9 "harness \`$RC_ID\`"
-rc_seed_log repoRC-9
-
-# (a) A SNAPSHOT THAT IS THERE AND CANNOT BE READ IS NOT A LANE THAT HAS NONE.
-# THE FIXTURE IS A DANGLING SYMLINK and not a `chmod 000`, deliberately: a suite
-# run as root reads a mode-000 file and the case would go red on the one host
-# shape it was written to be harmless on. A broken link is *the name is there
-# and the bytes are not* on every host and every uid — and it is `[ -e ]` FALSE,
-# which is the exact corner the reader now asks `[ -L ]` about.
-mkdir -p "$RC_STATE_ROOT/repoRC-9"
-ln -s "$SANDBOX/no-such-snapshot-91" "$RC_STATE_ROOT/repoRC-9/lane-state.yaml"
-run "$E" lane-state repoRC-9
-is    "a lifecycle snapshot that exists and cannot be read is 10, never the 8 that means there is none" "$rc" 10
-has   "…saying which of the two it is" "$err" "it could not be read"
-has   "…and citing the rule a failed read answers to" "$err" "R22"
-run "$E" lane-reconcile repoRC-9
-is    "…the reconciliation still answers for it" "$rc" 0
-is    "…with the state word that says nobody read it" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "STATE" { print $2 }')" "UNREADABLE"
-is    "…and the verdict is INDETERMINATE: no crash is pronounced on a read nobody got" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "indeterminate"
-hasnt "…and never 'no-state', which is the answer a launcher goes straight past" "$out" "no-state"
-is    "…and the file nobody could read was not replaced, moved or deleted by a read" \
-      "$( [ -L "$RC_STATE_ROOT/repoRC-9/lane-state.yaml" ] && echo kept || echo gone )" kept
-# AND NOT BY A WRITE EITHER (Copilot on 64dfd97): the writers' schema guard took
-# a dangling link for an absent file and renamed a fresh snapshot over it.
-run "$E" set-lane-state repoRC-9 RUNNING --owner "$RC_ID"
-is    "a WRITER meeting that dangling snapshot refuses rather than replacing it" "$rc" 1
-is    "…and the link is exactly where it was" \
-      "$( [ -L "$RC_STATE_ROOT/repoRC-9/lane-state.yaml" ] && echo kept || echo gone )" kept
-# THE HELPER'S TREE-ID RULE, RESTATED for the cases that must name a sidecar
-# before any write has made one: a `cksum` of the whole path, then the path
-# folded to the manifest-key set (Codex on ec9847e: the fold alone collides).
-rc_tree_id() {   # <absolute path>
-  rti_f="$(printf '%s' "$1" | tr -c 'A-Za-z0-9._-' '-' | tr -s '-' | sed -e 's/^-*//' -e 's/-*$//')"
-  printf 'c%s-%s\n' "$(printf '%s' "$1" | cksum | awk '{print $1}')" "$rti_f"
-}
-rc9_tp="$RC_DIR/.claude/worktrees/dangling-91"
-rc9_tid="$(rc_tree_id "$rc9_tp")"
-mkdir -p "$RC_STATE_ROOT/repoRC-9/trees"
-ln -s "$SANDBOX/no-such-sidecar-91" "$RC_STATE_ROOT/repoRC-9/trees/$rc9_tid.yaml"
-run "$E" set-lane-tree repoRC-9 "$rc9_tp" --checkout "$RC_DIR" --branch b --head h --upstream none --dirty 0 --unpushed 0
-is    "…and a tree sidecar that is a dangling link is refused the same way" "$rc" 1
-is    "…and left where it was" \
-      "$( [ -L "$RC_STATE_ROOT/repoRC-9/trees/$rc9_tid.yaml" ] && echo kept || echo gone )" kept
-rm -f "$RC_STATE_ROOT/repoRC-9/trees/$rc9_tid.yaml"
-
-# AND THE OTHER HALF OF THE PAIR, on the same lane and the same control root, so
-# that the two answers differ in nothing but whether the file is there: a lane
-# that really has NO snapshot is still 8 and still `no-state` (Amendment 7(i)'s
-# cutover rule — nothing is backfilled).
-rm -f "$RC_STATE_ROOT/repoRC-9/lane-state.yaml"
-run "$E" lane-state repoRC-9
-is    "a lane that has no snapshot at all is 8, exactly as before" "$rc" 8
-run "$E" lane-reconcile repoRC-9
-is    "…and its verdict is the cutover one" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "no-state"
-
-# (b) EVERY INVENTORY WRITE IS SERIALIZED, FENCE OR NO FENCE. `set-lane-tree`
-# took the mutex only when a caller named `--generation`/`--operation`; the
-# atomic rename underneath it stops a reader seeing half a file and stops
-# nothing else, so an UNFENCED observation could land after a newer fenced one
-# and replace it. The lock is held here by a pid that is alive — `$LIVE_PID`,
-# the fixture the last case of this file asserts is still running — so it cannot
-# be stolen as a dead holder's, and `timeout`'s own 124 is the proof the writer
-# was still WAITING for it rather than exiting early on something else.
-if [ "$HAVE_TIMEOUT" = 1 ]; then
-  mkdir -p "$H_LOCK"; printf '%s\n' "$LIVE_PID" > "$H_LOCK/pid"
-  LANES_NO_FETCH=1 timeout 3 "$E" set-lane-tree repoRC-9 "$RC_DIR/.claude/worktrees/w1" \
-    --checkout "$RC_DIR" --branch feat/rc1 --head "$rc5_w1head" --upstream none \
-    --dirty 1 --unpushed 0 >/dev/null 2>&1
-  rc9_lk=$?
-  is    "an UNFENCED inventory write WAITS on the lane mutex another run holds" "$rc9_lk" 124
-  run "$E" lane-trees repoRC-9
-  is    "…so nothing of it was written while that run held the lock" "$rc" 8
-  rm -rf "$H_LOCK"
-  run env LANES_NO_FETCH=1 "$E" set-lane-tree repoRC-9 "$RC_DIR/.claude/worktrees/w1" \
-    --checkout "$RC_DIR" --branch feat/rc1 --head "$rc5_w1head" --upstream none \
-    --dirty 1 --unpushed 0
-  is    "…and the same write lands the moment the mutex is free" "$rc" 0
-  run "$E" lane-trees repoRC-9
-  is    "…which is the inventory this lane then holds" \
-        "$(printf '%s\n' "$out" | awk -F'\037' '{print $2}' | head -n 1)" "$RC_DIR/.claude/worktrees/w1"
-else
-  skip  "an UNFENCED inventory write WAITS on the lane mutex another run holds" "$NO_TIMEOUT_WHY"
-  skip  "…so nothing of it was written while that run held the lock" "$NO_TIMEOUT_WHY"
-  skip  "…and the same write lands the moment the mutex is free" "$NO_TIMEOUT_WHY"
-  skip  "…which is the inventory this lane then holds" "$NO_TIMEOUT_WHY"
-fi
-
-# ---------------- A LANE BOUND ELSEWHERE IS NEVER PRONOUNCED ON FROM HERE
-#
-# Amendment 18(b): liveness is pronounced only from inside the binding's own
-# host and container, and from anywhere else a binding is UNKNOWN, never dead.
-# This workstation's holder read finds nobody for a lane whose last STARTED was
-# written on another host, and its snapshot is this workstation's alone, so a
-# RUNNING snapshot here plus an empty holder read is not an ungraceful stop.
-rc_row repoRC-10 "harness \`$RC_ID\`"
-{ printf '# lane repoRC-10 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'STARTED — lane repoRC-10, session %s@Eagle, 2026-09-15T00:00:00Z, lane:repoRC-10 → home opensoft/repoRC; dir %s; profile team-01a; host elsewhere-host; container none; os linux\n' \
-    "$RC_ID" "$RC_DIR"
-} > "$LOGD/repoRC-10.md"
-git -C "$WIP" add -- lanes/log/repoRC-10.md
-git -C "$WIP" commit -q -m "LOG(repoRC-10@Eagle): seed a binding on another host"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run env LANES_NO_FETCH=1 "$E" set-lane-state repoRC-10 RUNNING --expect none --owner "$RC_ID"
-is    "a lane bound on another host can still be recorded RUNNING here" "$rc" 0
-run "$E" lane-reconcile repoRC-10
-is    "lane-reconcile answers for it" "$rc" 0
-is    "…naming the binding as ELSEWHERE" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "BINDING" { print $2 }')" "elsewhere"
-is    "…and where it is" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "BINDING" { print $3 }')" "elsewhere-host/none"
-is    "…and the verdict is INDETERMINATE, never a crash pronounced from outside the binding" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "indeterminate"
-has   "…citing the rule" "$out" "Amendment 18(b)"
-hasnt "…and never ungraceful-stop" "$out" "ungraceful-stop"
-rc_row repoRC-11 "harness \`$RC_ID\`"
-rc_seed_log repoRC-11
-run env LANES_NO_FETCH=1 "$E" set-lane-state repoRC-11 RUNNING --expect none --owner "$RC_ID"
-run "$E" lane-reconcile repoRC-11
-is    "a lane whose STARTED predates Amendment 18(a) is bound HERE, on the line's own workstation" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "BINDING" { print $2 }')" "here"
-is    "…so the same RUNNING snapshot with no holder IS an ungraceful stop" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "ungraceful-stop"
-
-# AND THE SNAPSHOT NEVER LEAKS INTO THE LISTING'S BINDING COLUMN (Amendment
-# 18's column 13): a lane with a lifecycle snapshot and no binding line is
-# still `none` there, because the binding is the published log's and the
-# snapshot is this workstation's alone.
-rc_row repoRC-12 "harness \`$RC_ID\`"
-{ printf '# lane repoRC-12 — object log (lane-collision-protocol Amendment 7)\n'
-  printf 'NOTED — lane repoRC-12, session %s@Eagle, 2026-09-15T00:00:00Z, lane:repoRC-12 — a log with no binding line\n' "$RC_ID"
-} > "$LOGD/repoRC-12.md"
-git -C "$WIP" add -- lanes/log/repoRC-12.md
-git -C "$WIP" commit -q -m "LOG(repoRC-12@Eagle): a log with no binding line"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$E" set-lane-state repoRC-12 RUNNING --expect none --owner "$RC_ID"
-is    "a lane with no binding line can still carry a lifecycle snapshot" "$rc" 0
-run env LANES_NO_FETCH=1 "$E" lanes --lane repoRC-12
-is    "…and the listing's binding column says none for it, whatever the snapshot says" \
-      "$(printf '%s' "$out" | cut -f13)" "none"
-
-# ---------- AN UNREADABLE LOG IS NEVER A CLEARANCE (Copilot on 64dfd97)
-#
-# A log published twice under names that differ only by case cannot be read as
-# ONE log (Amendment 15), so the lane's coordinator directory is not established
-# and neither of the reconciliation's sweeps can run. A SWAPPED lane with no
-# holder must not read as resumable over paths nobody inspected. Published
-# through Amendment 15's own plumbing, which never touches a working tree, so
-# the case runs on a case-insensitive file system too.
-rc_row repoRC-13 "harness \`$RC_ID\`"
-rc_seed_log repoRC-13
-run "$E" set-lane-state repoRC-13 SWAPPED --owner "$RC_ID"
-is    "a lane can be recorded SWAPPED" "$rc" 0
-run "$E" lane-reconcile repoRC-13
-is    "…and with its log readable and no holder it is resumable" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "resumable"
-a15_publish lanes/log/reporc-13.md "# lane reporc-13 — a second spelling of the same log"
-run "$E" lane-reconcile repoRC-13
-is    "…but with its log published twice it is indeterminate" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "indeterminate"
-hasnt "…and never resumable over paths nobody read" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT"')" "resumable"
-a15_unpublish lanes/log/reporc-13.md
-
-# ------- A REFUSED INVENTORY WRITE KEEPS THE LANE SWAPPING (Copilot on 64dfd97)
-#
-# `SWAPPED` is the operation's commit point, and an inventory missing a polled
-# writer is not what a recovery may read as a finished swap. The refusal is the
-# writer's own schema guard, met through a sidecar a newer tooling wrote.
-rc_row repoRC-14 "harness \`$RC_ID\`"
-rc_seed_log repoRC-14
-rc_seed_handoff repoRC-14
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoRC-14 handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-git -C "$RC_DIR" worktree add -q -b feat/rc14 "$RC_DIR/.claude/worktrees/w14" >/dev/null 2>&1
-rc14_tid="$(rc_tree_id "$RC_DIR/.claude/worktrees/w14")"
-mkdir -p "$RC_STATE_ROOT/repoRC-14/trees"
-printf 'schema: 999\nlane: repoRC-14\n' > "$RC_STATE_ROOT/repoRC-14/trees/$rc14_tid.yaml"
-run "$E" set-lane-state repoRC-14 RUNNING --owner "$RC_ID" --agent claude --profile team-01a
-run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$RC_ID" \
-    CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane repoRC-14 clear
-is    "a handoff whose inventory write is refused still completes the swap's records" "$rc" 0
-has   "…naming the tree whose entry was not recorded" "$err" "the worktree inventory was not recorded for $RC_DIR/.claude/worktrees/w14"
-run "$E" lane-state repoRC-14
-is    "…and the lane stays SWAPPING, never SWAPPED over an incomplete inventory" \
-      "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "state" { print $2 }')" SWAPPING
-
-# ------------------------------------- the inventory's own reads (Codex on ec9847e)
-rc_row repoRC-15 "harness \`$RC_ID\`"
-rc_seed_log repoRC-15
-run "$E" set-lane-state repoRC-15 SWAPPED --owner "$RC_ID"
-is    "a lane is recorded SWAPPED for the inventory cases" "$rc" 0
-
-# (a) A CALLER'S OBSERVATION IS WHOLE OR ABSENT: one flag alone used to file the
-# other four as `unknown`, `none`, `dirty 0` and `unpushed 0`, nobody's reading.
-run "$E" set-lane-tree repoRC-15 "$RC_DIR/.claude/worktrees/half-15" --checkout "$RC_DIR" --branch feat/half
-is    "set-lane-tree refuses a partial observation as a usage error" "$rc" 64
-has   "…saying it takes the observation whole" "$err" "WHOLE"
-run "$E" lane-trees repoRC-15
-is    "…and nothing was filed" "$rc" 8
-
-# (b) TWO PATHS ARE TWO RECORDS, even where folding to the file-name alphabet
-# makes them one: `a+b` and `a-b` fold to the same name.
-run "$E" set-lane-tree repoRC-15 "$RC_DIR/.claude/worktrees/a+b" --checkout "$RC_DIR" \
-    --branch feat/aplusb --head 1111111111111111111111111111111111111111 --upstream none --dirty 0 --unpushed 0
-is    "a tree whose name folds onto a sibling's is recorded" "$rc" 0
-run "$E" set-lane-tree repoRC-15 "$RC_DIR/.claude/worktrees/a-b" --checkout "$RC_DIR" \
-    --branch feat/aminusb --head 2222222222222222222222222222222222222222 --upstream none --dirty 3 --unpushed 1
-is    "…and so is the sibling" "$rc" 0
-run "$E" lane-trees repoRC-15
-is    "…as two records, neither replacing the other" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/a[-+]b$/' | grep -c .)" 2
-is    "…each keeping its own observation" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$2 ~ /worktrees\/a\+b$/ { print $3 }')" "feat/aplusb"
-
-# (c) A SIDECAR THAT IS THERE AND CANNOT BE READ IS SAID, NEVER SKIPPED.
-ln -s "$SANDBOX/no-such-sidecar-15" "$RC_STATE_ROOT/repoRC-15/trees/c0-orphan-15.yaml"
-run "$E" lane-trees repoRC-15
-is    "lane-trees names an unreadable sidecar as a row of its own" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "c0-orphan-15" { print $13 }')" "<unreadable>"
-run "$E" lane-reconcile repoRC-15
-is    "…which the reconciliation reports as unreadable-sidecar" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "TREE" && $2 == "c0-orphan-15" { print $3 }')" "unreadable-sidecar"
-is    "…while the lane itself is still resumable" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "resumable"
-
-# (d) AND A RESUMABLE LANE WHOSE TREES NEED READING IS NOT LAUNCHED IN SILENCE.
-rc_seed_handoff repoRC-15
-git -C "$WIP" add -- handoffs/repoRC >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoRC-15 handoff"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-run "$START" repoRC 15 --no-launch
-is    "lane-start still starts a resumable lane" "$rc" 0
-has   "…but says so first when its trees need reading" "$err" "LANE RECOVERY: resumable"
-has   "…saying why" "$err" "need reading before a writer is relaunched"
-has   "…and naming the trees" "$err" "unreadable-sidecar"
-
-section "== the managed-owner seam: managed ledger owns enrolled lanes; this tooling owns legacy =="
-
-# Brett Heap's ruling of 2026-10-04, verbatim: "managed ledger owns enrolled
-# lanes; #97 owns legacy — rework both". A lane the managed ledger has enrolled
-# carries a managed-owner marker in its register row's state cell; every legacy
-# act refuses it before a byte is written — 2 for a valid marker, naming the
-# owner, and 1 where the vocabulary is there and does not parse.
-#
-# THE FIXTURES ARE WRITTEN STRAIGHT INTO THE REGISTER AND PUSHED, as the managed
-# ledger's own writer would land them: no legacy writer here may write that
-# vocabulary into a row at all, which is one of the things this section proves.
-#
-#   repoMG-1  VALID-LONG    LIVE · <UTC> · managed-owner mode=managed daemon=ledger-1 generation=3 bound-lane=repoMG-1
-#   repoMG-2  VALID-SHORT   MANAGED OWNER · ledger-2
-#   repoMG-3  LEGACY        PAUSED · <UTC> · swapped for the night
-#   repoMG-4  MALFORMED     generation=0
-#   repoMG-5  MALFORMED     an empty daemon
-#   repoMG-6  MALFORMED     bound-lane names another lane
-#   repoMG-7  MALFORMED     the shorthand with an empty token
-#   repoMG-8  MALFORMED     `managed: x` in the OBJECTS cell, a legacy state cell
-#   repoMG-9  LEGACY, dormant (no object log), for the sweep
-
-MG_ID="3a9e0001-1111-4000-8000-3a9e00011111"
-MG_DIR="$HOME/projects/repoMG"
-mkdir -p "$MG_DIR"
-git init -q -b main "$MG_DIR"
-git -C "$MG_DIR" config user.email "test@example.invalid"
-git -C "$MG_DIR" config user.name "lane helper tests"
-git -C "$MG_DIR" remote add origin "https://github.com/opensoft/repoMG.git"
-printf 'seed\n' > "$MG_DIR/a.txt"
-git -C "$MG_DIR" add -A >/dev/null 2>&1
-git -C "$MG_DIR" commit -q -m seed
-
-MG_UTC="2026-10-04T00:00:00Z"
-mg_row() {   # <lane> <objects cell> <state cell>
-  printf '| `%s` | harness `%s` | Eagle / test / brett | 2026-10-04T00:00Z | %s | handoffs/repoMG/%s.md | %s |\n' \
-    "$1" "$MG_ID" "$2" "$1" "$3"
-}
-{ mg_row repoMG-1 none "LIVE · $MG_UTC · managed-owner mode=managed daemon=ledger-1 generation=3 bound-lane=repoMG-1"
-  mg_row repoMG-2 none "MANAGED OWNER · ledger-2"
-  mg_row repoMG-3 none "PAUSED · $MG_UTC · swapped for the night"
-  mg_row repoMG-4 none "LIVE · $MG_UTC · managed-owner mode=managed daemon=ledger-1 generation=0 bound-lane=repoMG-4"
-  mg_row repoMG-5 none "LIVE · $MG_UTC · managed-owner mode=managed daemon= generation=3 bound-lane=repoMG-5"
-  mg_row repoMG-6 none "LIVE · $MG_UTC · managed-owner mode=managed daemon=ledger-1 generation=3 bound-lane=repoMG-99"
-  mg_row repoMG-7 none "MANAGED OWNER · "
-  mg_row repoMG-8 "managed: x" "PAUSED · $MG_UTC · swapped for the night"
-  mg_row repoMG-9 none "ENDED · $MG_UTC · a pre-Amendment-7 row with no log"
-} > "$SANDBOX/mg-rows"
-# AFTER THE REGISTER'S LAST ROW, through `cat >` and never `sed -i`, which would
-# replace a symlinked register with a file (THE ONE HAZARD in the manual).
-mg_last="$(awk 'substr($0,1,3) == "| `" { n = NR } END { print n + 0 }' "$WIP/lanes/LANES.md")"
-awk -v n="$mg_last" -v f="$SANDBOX/mg-rows" '
-  { print }
-  NR == n { while ((getline l < f) > 0) print l }' "$WIP/lanes/LANES.md" > "$SANDBOX/mg-register"
-cat "$SANDBOX/mg-register" > "$WIP/lanes/LANES.md"
-for mg_l in repoMG-1 repoMG-2 repoMG-3 repoMG-4 repoMG-5 repoMG-6 repoMG-7 repoMG-8; do
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$mg_l"
-    printf 'STARTED — lane %s, session %s@Eagle, %s, lane:%s → home opensoft/repoMG; dir %s; profile team-01a\n' \
-      "$mg_l" "$MG_ID" "$MG_UTC" "$mg_l" "$MG_DIR"
-  } > "$LOGD/$mg_l.md"
-done
-git -C "$WIP" add -- lanes/LANES.md lanes/log >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the managed-owner seam's fixtures, as the ledger's own writer would land them"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-# THE WHOLE STATE A REFUSED ACT MAY NOT CHANGE, in one string: the register's
-# commit here and on origin, this checkout's status, the register's bytes, every
-# fixture log's bytes, the lifecycle control roots (names and contents), and the
-# tmux, claude and pclaude logs the fakes keep.
-mg_fp() {
-  { git -C "$WIP" rev-parse HEAD
-    git --git-dir="$ORIGIN" rev-parse main
-    git -C "$WIP" status --porcelain
-    cksum < "$WIP/lanes/LANES.md"
-    cat "$LOGD"/repoMG-*.md 2>/dev/null | cksum
-    ls "$LOGD" | cksum
-    find "$HOME/projects/.lane-state" 2>/dev/null | LC_ALL=C sort
-    find "$HOME/projects/.lane-state" -type f -exec cksum {} + 2>/dev/null | LC_ALL=C sort
-    cksum < "$FAKE_TMUX_LOG"
-    cksum < "$FAKE_TMUX_A17_LOG"
-    cksum < "$FAKE_CLAUDE_LOG"
-    cksum < "$FAKE_PCLAUDE_LOG"
-  } | cksum
-}
-mg_refused() {   # <what> <expected exit> <owner, for a 2> <fingerprint before>
-  is   "$1 is refused with $2" "$rc" "$2"
-  if [ "$2" = 2 ]; then
-    has  "…naming the owner" "$err" "owner $3"
-  else
-    has  "…as ownership UNKNOWN" "$err" "UNKNOWN"
-  fi
-  is   "…and changed nothing: register, origin, logs, control roots, tmux and launch logs" "$(mg_fp)" "$4"
-}
-
-# ---------------------------------------------------------- 1. the read itself
-run "$E" managed-projection repoMG-1
-is    "managed-projection: a valid long marker is 0" "$rc" 0
-is    "…printing the owner, its daemon" "$out" "ledger-1"
-run "$E" managed-projection repoMG-2
-is    "managed-projection: the valid shorthand is 0" "$rc" 0
-is    "…printing its token" "$out" "ledger-2"
-run "$E" managed-projection repoMG-3
-is    "managed-projection: a legacy row is 8" "$rc" 8
-run "$E" managed-projection repoMG-9
-is    "managed-projection: a legacy row with no log is 8 too" "$rc" 8
-for mg_l in repoMG-4 repoMG-5 repoMG-6 repoMG-7 repoMG-8; do
-  run "$E" managed-projection "$mg_l"
-  is    "managed-projection: the malformed $mg_l is 1, never 8" "$rc" 1
-  has   "…saying ownership is UNKNOWN" "$err" "UNKNOWN"
-done
-run "$E" managed-projection
-is    "managed-projection with no lane is a usage error" "$rc" 64
-run "$E" managed-projection repoMG-1 repoMG-2
-is    "…and so is two lanes" "$rc" 64
-run "$E" managed-projection repomg-1
-is    "…and the lane is resolved under any case (Amendment 15)" "$out" "ledger-1"
-
-# ------------------------------- 2. every act on every managed or unknown row
-for mg_case in "repoMG-1 2 ledger-1" "repoMG-2 2 ledger-2" "repoMG-4 1 -" "repoMG-5 1 -" \
-               "repoMG-6 1 -" "repoMG-7 1 -" "repoMG-8 1 -"; do
-  read -r mg_l mg_x mg_o <<MG_CASE
-$mg_case
-MG_CASE
-  mg_n="${mg_l#repoMG-}"
-  for mg_v in STARTED RESUMED; do
-    mg_b="$(mg_fp)"
-    run env LANES_LANE="$mg_l" LANES_SESSION="$MG_ID" "$E" log "$mg_v" "lane:$mg_l" '→' "home opensoft/repoMG; dir $MG_DIR; profile team-01a"
-    mg_refused "$mg_l: log $mg_v" "$mg_x" "$mg_o" "$mg_b"
-  done
-  for mg_v in ENDED RETIRED; do
-    mg_b="$(mg_fp)"
-    run env LANES_LANE="$mg_l" LANES_SESSION="$MG_ID" "$E" log "$mg_v" "lane:$mg_l"
-    mg_refused "$mg_l: log $mg_v" "$mg_x" "$mg_o" "$mg_b"
-  done
-  # EVERY LANE-KIND LINE, and not only the four that move a lifecycle (Copilot
-  # round 3 on #97): a swap's PAUSED, and Amendment 18(g)'s HANDOFF-REQUESTED,
-  # which only `request-handoff` writes — refused before the binding is read,
-  # so its --dry-run plans nothing either.
-  mg_b="$(mg_fp)"
-  run env LANES_LANE="$mg_l" LANES_SESSION="$MG_ID" "$E" log PAUSED "lane:$mg_l"
-  mg_refused "$mg_l: log PAUSED" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANES_SESSION="$MG_ID" "$E" request-handoff "$mg_l" --no-wait
-  mg_refused "$mg_l: request-handoff" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANES_SESSION="$MG_ID" "$E" request-handoff "$mg_l" --dry-run
-  mg_refused "$mg_l: request-handoff --dry-run" "$mg_x" "$mg_o" "$mg_b"
-  hasnt "…which plans nothing" "$err" "PLAN:"
-  # AND THE TWO ROW WRITERS THE FIRST PASS LEFT: the session cell, and a
-  # second row for a lane that has one, refused naming the owner rather than
-  # only as a duplicate.
-  mg_b="$(mg_fp)"
-  run env LANES_SESSION="$MG_ID" "$E" append-session-id "$mg_l" "$MG_ID" "→ 3a9e0002-2222-4000-8000-3a9e00022222"
-  mg_refused "$mg_l: append-session-id" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" add-row "| \`$mg_l\` | harness \`$MG_ID\` | Eagle / test / brett | 2026-10-04T00:00Z | none | handoffs/repoMG/$mg_l.md | PAUSED · a second row for one lane |"
-  mg_refused "$mg_l: add-row for a lane that has a row" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" set-lane-state "$mg_l" RUNNING --expect none --owner "$MG_ID"
-  mg_refused "$mg_l: set-lane-state" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" set-lane-tree "$mg_l" "$MG_DIR/.claude/worktrees/w1" --checkout "$MG_DIR" \
-      --branch feat/mg --head 0000000000000000000000000000000000000000 --upstream none --dirty 0 --unpushed 0
-  mg_refused "$mg_l: set-lane-tree" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANES_LANE=repoMG-3 "$E" retire-rows "$mg_l"
-  mg_refused "$mg_l: retire-rows" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" set-row-state "$mg_l" "PAUSED · a legacy writer's phrase"
-  mg_refused "$mg_l: set-row-state" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" replace-in-row "$mg_l" "Eagle / test / brett" "Raven / test / brett"
-  mg_refused "$mg_l: replace-in-row" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANES_SESSION="$MG_ID" "$E" rename-lane "$mg_l" "repoMGX-$mg_n" --no-github
-  mg_refused "$mg_l: rename-lane" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$MG_ID" \
-      CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane "$mg_l" clear
-  mg_refused "$mg_l: lane-handoff" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env LANE_HANDOFF_NO_TMUX=1 LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$MG_ID" \
-      CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane "$mg_l" --late --at "$MG_UTC"
-  mg_refused "$mg_l: lane-handoff --late" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run env PATH="$A17PATH" LANES_EDIT="$E" CLAUDE_CODE_SESSION_ID="$MG_ID" \
-      CLAUDE_PROFILE_NAME=team-01a "$HANDOFF_CMD" --lane "$mg_l" --restart clear
-  mg_refused "$mg_l: lane-handoff --restart" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$START" repoMG "$mg_n" --no-launch
-  mg_refused "$mg_l: lane-start --no-launch" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$START" repoMG "$mg_n"
-  mg_refused "$mg_l: lane-start (a launch)" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$END" "$mg_l"
-  mg_refused "$mg_l: lane-end" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$END" "$mg_l" --retire
-  mg_refused "$mg_l: lane-end --retire" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$END" "$mg_l" --retire 999999
-  mg_refused "$mg_l: lane-end --retire <pid>" "$mg_x" "$mg_o" "$mg_b"
-  mg_b="$(mg_fp)"
-  run "$E" lane-reconcile "$mg_l"
-  is    "$mg_l: lane-reconcile still answers" "$rc" 0
-  if [ "$mg_x" = 2 ]; then
-    is    "…with the verdict managed-owned" \
-          "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "managed-owned"
-    is    "…naming the owner" \
-          "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "MANAGED" { print $2 }')" "$mg_o"
-  else
-    is    "…with the verdict indeterminate" \
-          "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "VERDICT" { print $2 }')" "indeterminate"
-    is    "…and ownership unknown" \
-          "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "MANAGED" { print $2 }')" "unknown"
-  fi
-  hasnt "…and pronouncing no crash" "$out" "ungraceful-stop"
-  is    "…having read and written nothing" "$(mg_fp)" "$mg_b"
-done
-
-# ------------------- 3. ONE managed lane in a sweep refuses the whole sweep
-mg_b="$(mg_fp)"
-run env LANES_LANE=repoMG-3 "$E" retire-rows repoMG-9 repoMG-1
-mg_refused "a sweep of a dormant legacy row and a managed one" 2 ledger-1 "$mg_b"
-is    "…so the dormant legacy row was not retired either" \
-      "$(grep -c '^| `repoMG-9`.*| ENDED · ' "$WIP/lanes/LANES.md" || :)" 1
-
-# ---------------------------------- 4. no legacy writer forges a marker
-mg_b="$(mg_fp)"
-run "$E" set-row-state repoMG-3 "LIVE · managed-owner mode=managed daemon=forged generation=1 bound-lane=repoMG-3"
-is    "set-row-state refuses a phrase in the marker's vocabulary" "$rc" 2
-has   "…saying why" "$err" "managed-owner vocabulary"
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-run "$E" set-row-state repoMG-3 "PAUSED · notes are in the managed: file"
-is    "…and any of its three patterns, not only the whole marker" "$rc" 2
-is    "…changing nothing" "$(mg_fp)" "$mg_b"
-run "$E" add-row "| \`repoMG-10\` | harness \`$MG_ID\` | Eagle / test / brett | 2026-10-04T00:00Z | none | handoffs/repoMG/repoMG-10.md | MANAGED OWNER · forged |"
-is    "add-row refuses a row in the marker's vocabulary" "$rc" 2
-has   "…saying why" "$err" "managed-owner vocabulary"
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-run "$E" replace-in-row repoMG-3 "swapped for the night" "managed owner ledger-9"
-is    "replace-in-row refuses replacement text in the marker's vocabulary" "$rc" 2
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-# AND THE BACK DOORS (Copilot round 3 on #97): any line appended to the register,
-# a session cell's new text, and a lane's new name.
-run "$E" append-line "| \`repoMG-10\` | harness \`$MG_ID\` | Eagle / test / brett | 2026-10-04T00:00Z | none | handoffs/repoMG/repoMG-10.md | MANAGED OWNER · forged |"
-is    "append-line refuses a line in the marker's vocabulary, the row-shaped one included" "$rc" 2
-has   "…saying why" "$err" "managed-owner vocabulary"
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-run env LANES_SESSION="$MG_ID" "$E" append-session-id repoMG-3 "$MG_ID" "managed owner ledger-9"
-is    "append-session-id refuses appended text in the marker's vocabulary" "$rc" 2
-has   "…saying why" "$err" "managed-owner vocabulary"
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-run env LANES_SESSION="$MG_ID" "$E" rename-lane repoMG-3 managed-owner-3 --no-github
-is    "rename-lane refuses a new name in the marker's vocabulary" "$rc" 2
-has   "…saying why" "$err" "managed-owner vocabulary"
-is    "…and changed nothing" "$(mg_fp)" "$mg_b"
-
-# ------------------------------- 5. a LEGACY lane is exactly what it was
-run "$E" set-lane-state repoMG-3 RUNNING --expect none --owner "$MG_ID"
-is    "a legacy lane still takes a lifecycle transition" "$rc" 0
-mg_gen="$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')"
-run env LANES_LANE=repoMG-3 LANES_SESSION="$MG_ID" "$E" log RESUMED "lane:repoMG-3" '→' "home opensoft/repoMG; dir $MG_DIR; profile team-01a"
-is    "…and a RESUMED line" "$rc" 0
-run "$E" lane-state repoMG-3
-is    "…which moves its snapshot on the legacy verdict, under a new generation" \
-      "$( [ "$(printf '%s\n' "$out" | awk -F'\t' '$1 == "generation" { print $2 }')" -gt "$mg_gen" ] && echo advanced || echo stuck )" advanced
-run "$E" lane-reconcile repoMG-3
-hasnt "…and its reconciliation is not managed-owned" "$out" "managed-owned"
-is    "…and carries no MANAGED line at all" \
-      "$(printf '%s\n' "$out" | awk -F'\037' '$1 == "MANAGED"' | grep -c . || :)" 0
-run env LANES_LANE=repoMG-3 "$E" retire-rows repoMG-9
-is    "…and the sweep of a dormant legacy row alone still lands" "$rc" 0
-run env LANES_LANE=repoMG-3 LANES_SESSION="$MG_ID" "$E" log PAUSED "lane:repoMG-3"
-is    "…and so does a legacy lane's PAUSED line" "$rc" 0
-run env LANES_SESSION="$MG_ID" "$E" append-session-id repoMG-3 "$MG_ID" "→ 3a9e0002-2222-4000-8000-3a9e00022222"
-is    "…and a legacy row's session cell still takes an id" "$rc" 0
-
-# ------ 6. ONE managed row refuses Amendment 13(e)'s WHOLE migration
-#
-# Copilot round 2 on #97: `migrate-state-cells` rewrites state cells and appends
-# to logs, and the shorthand `MANAGED OWNER · <token>` holds ONE ` · `, so it is
-# not the phrase the migration leaves alone, and `--yes` rewrote it to
-# `MIGRATED · …`. ITS OWN WORKSPACE, for the reason Amendment 13's own section
-# gives: this act takes a whole register, and pointed at the suite's it would
-# rewrite every fixture above and below this line the day the refusal stopped
-# refusing. A LEGACY diary row comes FIRST, so a refusal that skipped only the
-# managed row would still have migrated it: that row is the proof the abort is
-# whole.
-MGM_ORIGIN="$SANDBOX/mg-mig-origin.git"; MGM_WIP="$SANDBOX/mg-migwip"
-git init -q --bare -b main "$MGM_ORIGIN"
-git clone -q "$MGM_ORIGIN" "$MGM_WIP" 2>/dev/null
-git -C "$MGM_WIP" config user.email "test@example.invalid"
-git -C "$MGM_WIP" config user.name  "lane helper tests"
-mkdir -p "$MGM_WIP/lanes/log"
-MGM_DIARY="ACTIVE · 2026-10-04T01:00:00Z opened the PR and it went green"
-mgm_register() {   # <repoMG-2's state cell> — the whole register, rewritten as the ledger's writer would land it
-  { printf '# LANES.md — the managed seam, migration sandbox\n\n'
-    printf '| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |\n'
-    printf '|---|---|---|---|---|---|---|\n'
-    mg_row repoMG-3 none "$MGM_DIARY"
-    mg_row repoMG-2 none "$1"
-  } > "$MGM_WIP/lanes/LANES.md"
-}
-mgm_fp() {   # what a refused migration may not change: commits, status, register, logs, archive
-  { git -C "$MGM_WIP" rev-parse HEAD
-    git --git-dir="$MGM_ORIGIN" rev-parse main
-    git -C "$MGM_WIP" status --porcelain
-    cksum < "$MGM_WIP/lanes/LANES.md"
-    cat "$MGM_WIP"/lanes/log/*.md | cksum
-    ls "$MGM_WIP/lanes/log" | cksum
-    ls "$MGM_WIP/lanes" | cksum
-  } | cksum
-}
-mgm_refused() {   # <what> <expected exit> <owner, for a 2> <fingerprint before>
-  is   "$1 is refused with $2" "$rc" "$2"
-  if [ "$2" = 2 ]; then
-    has  "…naming the owner" "$err" "owner $3"
-  else
-    has  "…as ownership UNKNOWN" "$err" "UNKNOWN"
-  fi
-  has  "…refusing the WHOLE migration" "$err" "WHOLE migration"
-  is   "…and changed nothing: register HEAD here and on origin, status, the register's bytes, every log's bytes, no archive" "$(mgm_fp)" "$4"
-  is   "…so the legacy row read BEFORE the refused one still holds its diary" \
-       "$(grep -c "^| \`repoMG-3\` .*| $MGM_DIARY |\$" "$MGM_WIP/lanes/LANES.md" || :)" 1
-}
-mgm_register "MANAGED OWNER · ledger-2"
-for mg_l in repoMG-3 repoMG-2; do
-  printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$mg_l" > "$MGM_WIP/lanes/log/$mg_l.md"
-done
-git -C "$MGM_WIP" add -A >/dev/null 2>&1
-git -C "$MGM_WIP" commit -q -m "seed the seam's migration sandbox: a legacy diary row, then the valid shorthand"
-git -C "$MGM_WIP" push -q -u origin main
-
-# (a) THE VALID SHORTHAND: 2, naming the owner, in both modes.
-mg_b="$(mgm_fp)"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" migrate-state-cells
-mgm_refused "the migration's dry run over the valid shorthand" 2 ledger-2 "$mg_b"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" migrate-state-cells --yes
-mgm_refused "migrate-state-cells --yes over the valid shorthand" 2 ledger-2 "$mg_b"
-hasnt "…and never rewrites the marker to the migration's own word" "$(cat "$MGM_WIP/lanes/LANES.md")" "MIGRATED"
-
-# (b) A MALFORMED SHORTHAND — a token with a space in it — is UNKNOWN: 1.
-mgm_register "MANAGED OWNER · ledger 2"
-git -C "$MGM_WIP" commit -q -am "the ledger lands a shorthand whose token does not parse"
-git -C "$MGM_WIP" push -q origin main
-mg_b="$(mgm_fp)"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" managed-projection repoMG-2
-is    "the malformed shorthand reads as unknown (1) before the migration asks" "$rc" 1
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" migrate-state-cells --yes
-mgm_refused "migrate-state-cells --yes over a malformed shorthand" 1 - "$mg_b"
-
-# (c) THE ROW REWRITTEN IS THIS CHECKOUT'S. Published as a legacy one-word row,
-# and this checkout one unpushed commit ahead with the shorthand in it: the
-# published read alone says legacy, and the row the act would rewrite is not.
-# `managed-projection` reads both copies since #157 item 4a, as the act does.
-mgm_register "PAUSED"
-git -C "$MGM_WIP" commit -q -am "the row goes back to a legacy one-word state"
-git -C "$MGM_WIP" push -q origin main
-mgm_register "MANAGED OWNER · ledger-3"
-git -C "$MGM_WIP" commit -q -am "an unpushed marker, in this checkout only"
-mg_b="$(mgm_fp)"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" managed-projection repoMG-2
-is    "the two copies' disagreement reads as unknown (1), never the published row's legacy 8" "$rc" 1
-has   "…naming the register file it read" "$err" "register file, $MGM_WIP/lanes/LANES.md, carries"
-has   "…and both ways the copies can disagree" "$err" "AHEAD of origin"
-has   "…a fast-forward being the other remedy" "$err" "fast-forward it"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" migrate-state-cells --yes
-mgm_refused "migrate-state-cells --yes over a marker only this checkout carries" 1 - "$mg_b"
-has   "…saying the two copies disagree" "$err" "the two copies disagree on"
-
-# (d) AND THE SAME REGISTER WITH NO MARKER IN EITHER COPY MIGRATES, so each
-# refusal above was the seam's and not the fixture's.
-git -C "$MGM_WIP" reset -q --hard origin/main
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" migrate-state-cells --yes
-is    "the legacy register itself migrates" "$rc" 0
-has   "…taking the diary row" "$out" "1 to migrate"
-has   "…into its log" "$(cat "$MGM_WIP/lanes/log/repoMG-3.md")" "NOTED — lane repoMG-3"
-
-# ------ 7. ONE managed RETIRED row refuses Amendment 19(d)'s WHOLE move
-#
-# Copilot round 3 on #97: `archive-rows <repo> --yes` takes every RETIRED row of
-# a repository out of the register, and a RETIRED row may carry the managed
-# ledger's marker. In the same workspace as case 6, for the same reason: this
-# act takes a whole repository's rows. A LEGACY retired row comes FIRST, so a
-# refusal that skipped only the managed row would still have moved it.
-mga_row() {   # <lane> <state cell> — appended through `cat >>`, as the ledger's writer would land it
-  mg_row "$1" none "$2" >> "$MGM_WIP/lanes/LANES.md"
-}
-mga_fp() {
-  { mgm_fp
-    cat "$MGM_WIP"/lanes/archive/LANES-retired.md 2>/dev/null | cksum
-  } | cksum
-}
-mga_refused() {   # <what> <expected exit> <owner, for a 2> <fingerprint before>
-  is   "$1 is refused with $2" "$rc" "$2"
-  if [ "$2" = 2 ]; then
-    has  "…naming the owner" "$err" "owner $3"
-  else
-    has  "…as ownership UNKNOWN" "$err" "UNKNOWN"
-  fi
-  has  "…refusing the WHOLE move" "$err" "WHOLE move"
-  is   "…and changed nothing: register HEAD here and on origin, status, the register's and the archive's bytes, every log" "$(mga_fp)" "$4"
-  is   "…so the legacy RETIRED row read BEFORE the refused one is still in the register" \
-       "$(grep -c '^| `repoMG-12` ' "$MGM_WIP/lanes/LANES.md" || :)" 1
-}
-mga_row repoMG-12 "RETIRED · $MG_UTC · retired by hand"
-mga_row repoMG-11 "RETIRED · $MG_UTC · managed-owner mode=managed daemon=ledger-1 generation=4 bound-lane=repoMG-11"
-git -C "$MGM_WIP" commit -q -am "a legacy retired row, then a retired row the managed ledger owns"
-git -C "$MGM_WIP" push -q origin main
-
-# (a) THE VALID MARKER: 2, naming the owner, in both modes.
-mg_b="$(mga_fp)"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" archive-rows repoMG
-mga_refused "archive-rows' dry run over a retired managed row" 2 ledger-1 "$mg_b"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" archive-rows repoMG --yes
-mga_refused "archive-rows --yes over a retired managed row" 2 ledger-1 "$mg_b"
-
-# (b) A MALFORMED ONE — generation=0 — is UNKNOWN: 1.
-awk '{ if (index($0, "| `repoMG-11` ") == 1) sub(/generation=4/, "generation=0"); print }' \
-  "$MGM_WIP/lanes/LANES.md" > "$SANDBOX/mga-register"
-cat "$SANDBOX/mga-register" > "$MGM_WIP/lanes/LANES.md"
-git -C "$MGM_WIP" commit -q -am "the ledger lands a retired marker whose generation does not parse"
-git -C "$MGM_WIP" push -q origin main
-mg_b="$(mga_fp)"
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" archive-rows repoMG --yes
-mga_refused "archive-rows --yes over a malformed retired marker" 1 - "$mg_b"
-
-# (c) AND WITH THAT ROW GONE THE SAME MOVE LANDS, so each refusal above was the
-# seam's and not the fixture's.
-grep -v '^| `repoMG-11` ' "$MGM_WIP/lanes/LANES.md" > "$SANDBOX/mga-register"
-cat "$SANDBOX/mga-register" > "$MGM_WIP/lanes/LANES.md"
-git -C "$MGM_WIP" commit -q -am "the managed ledger takes its row back"
-git -C "$MGM_WIP" push -q origin main
-run env LANES_WORKSPACE_ROOT="$MGM_WIP" "$E" archive-rows repoMG --yes
-is    "the legacy retired row alone is archived" "$rc" 0
-is    "…out of the register" "$(grep -c '^| `repoMG-12` ' "$MGM_WIP/lanes/LANES.md" || :)" 0
-is    "…and into the archive" "$(grep -c '^| `repoMG-12` ' "$MGM_WIP/lanes/archive/LANES-retired.md" || :)" 1
-
-section "== the workstation seam: unset, every writer reads the host =="
-
-# THE OTHER HALF OF R-A9-13. Every case above this line runs with
-# `LANES_WORKSTATION=Eagle` exported at the top of this file, which is what
-# makes the 55 seed rows and the three writers agree on any machine. That pin
-# would also hide the opposite defect — a writer that stopped reading the host
-# at all, or that read it with a different command than its siblings, which is
-# exactly what `lane-start` and `lane-end` did with their bare `hostname` until
-# this round. So the seam is UNSET for these three cases and the DEFAULT is
-# asserted directly, against `hostname -s` computed here: one spelling, shared
-# by `lanes-edit.sh:438`, `lane-start` and `lane-end`.
-WS_HOST="$(hostname -s)"
-is   "this host has a short name to fall back to" \
-     "$( [ -n "$WS_HOST" ] && echo yes || echo no )" "yes"
-
-mkdir -p "$HOME/projects/repoWS"
-git init -q -b main "$HOME/projects/repoWS"
-git -C "$HOME/projects/repoWS" remote add origin "https://github.com/opensoft/repoWS.git"
-# The cases above leave handoff files uncommitted in the sandbox workspace on
-# purpose, and `lanes-edit.sh` REFUSES an object-log write on a checkout it
-# cannot rebase — which is the behaviour those cases are about. This one is
-# about the workstation name, so the checkout is committed first and the
-# refusal is out of the way.
-git -C "$WIP" add -A >/dev/null 2>&1
-git -C "$WIP" commit -q -m "commit the sandbox's pending handoffs before the workstation-seam cases" >/dev/null 2>&1 || :
-
-# `LANES_IN_CONTAINER=0` THROUGHOUT THIS SECTION, and the reason is the rule
-# itself (`R-A11-14`): with the seam unset, the DEFAULT is `hostname -s` OUTSIDE
-# a container and a REFUSAL INSIDE one — and the host this suite runs on is a
-# container exactly when it is. The half this section is about is the default,
-# so the probe is pinned; the refusal has its own cases in the Amendment 11
-# section above, pinned the other way.
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=0 "$START" repoWS 1 --no-launch
-is   "lane-start with the seam unset exits 0" "$rc" 0
-has  "…and its new row names the HOST in the workstation column" \
-     "$(grep '^| `repoWS-1`' "$LANES")" "$WS_HOST / "
-
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=0 env LANES_LANE=repoWS-1 "$E" claim "opensoft/repoWS#1" --no-github
-is   "lanes-edit.sh claim with the seam unset exits 0" "$rc" 0
-has  "…and stamps the same host on the CLAIMED line it writes" \
-     "$(grep '^CLAIMED' "$LOGD/repoWS-1.md" | tail -n1)" "@$WS_HOST,"
-
-# `--inventory-only` BESIDE `--force` (#163): this case is about the workstation
-# name, and since the close-out gate a lane-end asks #162's sweep first — which
-# refuses while ANY lane's inventory under the same control root cannot be read,
-# and the #91 section above leaves dangling sidecars there on purpose. The door
-# takes a gate that is not this case's subject out of it, and says so in the row.
-run env -u LANES_WORKSTATION LANES_IN_CONTAINER=0 "$END" repoWS-1 --force --inventory-only
-is   "lane-end with the seam unset exits 0" "$rc" 0
-has  "…and its row status names the same host" \
-     "$(grep '^| `repoWS-1`' "$LANES")" "lane-end on $WS_HOST:"
-
-# ------------- 7. the resolver's 2 is a REFUSAL here too (Amendment 15(d))
-#
-# `2` IS TWO ANSWERS AND THE REFUSAL IS THE ONE THAT MATTERS. It is what a
-# helper predating a subcommand spends on an unknown one — the rung this
-# command's read fence falls through for — and it is ALSO `canon_lane`'s
-# refusal of a register holding two rows that differ only by case, which every
-# read through `check_lane_name` now carries. Falling through THAT is binding
-# this window to whichever lane the next rung answers with, and then renaming
-# the window, writing a PAUSED record and respawning a pane for it. So the
-# refusal is asked for by its own WORDS, exactly as `lane-start`, `lane-end` and
-# `restart` ask for it, and relayed — and it is asked BEFORE the rename, so a
-# refusal leaves the window exactly as it found it.
-#
-# This pair is made LAST, after every other case in this section has run: two
-# rows differing only by case are a register no read of that lane is unambiguous
-# in, which is the point.
-#
-# SEEDED AS IT EXISTED, with `add_seed_row` and one commit — NOT with `add-row`,
-# which is one of the writers Amendment 15 makes refuse this very shape. A
-# fixture built through the writer would be a fixture with one row in it, and
-# the case below would go green on a register that is not ambiguous at all.
-add_seed_row "| \`repoHF-13\` | harness \`$HF_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoHF/repoHF-13.md | ACTIVE |"
-add_seed_row "| \`repohf-13\` | harness \`$HF2_ID\` | Eagle / test / brett | 2026-09-14T00:00Z | none | handoffs/repoHF/repohf-13.md | ACTIVE |"
-git -C "$WIP" add -A -- lanes >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the 15(d) pair lane-handoff is asked about"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-: > "$FAKE_TMUX_A17_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="hfsess:@21" CLAUDE_CODE_SESSION_ID="$HF_ID" \
-    CLAUDE_PROFILE_NAME=team-05a "$HANDOFF_CMD" --lane repoHF-13 --restart clear
-is    "lane-handoff refuses a register holding two rows that differ only by case" "$rc" 2
-has   "…citing the merge that is a person's act" "$err" "Amendment 15(d)"
-has   "…saying nothing was written and nothing renamed" "$err" "Nothing was written and nothing was renamed"
-is    "…and no pane was respawned for a lane no read of it is unambiguous about" \
-      "$(grep -c 'respawn-pane' "$FAKE_TMUX_A17_LOG")" 0
-is    "…and no log was written for either spelling" \
-      "$(ls "$LOGD" | grep -ci '^repohf-13\.md$' || :)" 0
-
-section "== Amendment 14: the derived index is never read by an act =="
-
-# lane-collision-protocol Amendment 14, ratified by Brett Heap 2026-10-05,
-# verbatim "ratify 48" (opensoft/openRepoTools#160). The register's truth stays
-# where it is and `lanes-index` keeps a DERIVED copy that NO ACT READS OR WAITS
-# ON (clause (b)). `tests/test_lanes_index.py` holds the indexer to that over
-# its own small estate; this section holds the ACTS that only this suite can
-# drive — `lane-start --dry-run` and the name guard, beside a write and the
-# reads every act makes — to it over THIS estate, three ways from one snapshot:
-#
-#   control      exactly as every case above ran: `LANES_INDEX=off` and no
-#                indexer on PATH;
-#   unreachable  OFFLINE NO-READ — an indexer installed on PATH and configured
-#                at a Postgres nobody can reach (a fake `psql` that logs and
-#                refuses), so every write's nudge DOES reach for it;
-#   poisoned     POISONED INDEX — a real sync of this register into SQLite,
-#                then WRONG rows: a forged hold, forged owners, forged states,
-#                forged narrative. Unreachability cannot prove an act does not
-#                read the index; wrong rows nothing repeats can.
-#
-# Each act's exit, stdout and stderr must be the same three ways, once the
-# CLOCK is taken out (a stamp, a commit id, an age): the snapshot is restored
-# between runs, so the register, the logs, origin and the guard's pending
-# offers are where they were.
-A14_BIN="$SANDBOX/a14bin"; A14_FAKE="$SANDBOX/a14fake"; A14_CONF="$SANDBOX/a14conf"
-mkdir -p "$A14_BIN" "$A14_FAKE" "$A14_CONF"
-cp -p "$SRC_DIR/lanes-index" "$A14_BIN/lanes-index"
-chmod 755 "$A14_BIN/lanes-index"
-A14_PSQL_LOG="$SANDBOX/a14-psql.log"
-: > "$A14_PSQL_LOG"
-cat > "$A14_FAKE/psql" <<FAKE
-#!/bin/sh
-printf '%s\n' "\$*" >> "$A14_PSQL_LOG"
-echo 'psql: error: connection to server at "lanes-index.invalid" failed' >&2
-exit 2
-FAKE
-chmod 755 "$A14_FAKE/psql"
-printf '*:*:*:*:never-read\n' > "$A14_CONF/pgpass"
-chmod 600 "$A14_CONF/pgpass"
-printf 'url=postgresql://lanes_writer@lanes-index.invalid/qa\npassfile=%s\n' "$A14_CONF/pgpass" > "$A14_CONF/unreachable.conf"
-chmod 600 "$A14_CONF/unreachable.conf"
-A14_DB="$SANDBOX/a14state/lanes-index.sqlite"
-printf 'sqlite=%s\n' "$A14_DB" > "$A14_CONF/poisoned.conf"
-chmod 600 "$A14_CONF/poisoned.conf"
-
-# THE POISONED STORE BEGINS AS A TRUE ONE: a note the index will carry, a sync
-# of this whole register, and then the rows are made wrong.
-run env LANES_LANE=repoA-1 "$E" log NOTED lane:repoA-1 "a14: the note the index carries"
-is   "a note for the derived index to carry is written" "$rc" 0
-run env -u LANES_INDEX LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" LANES_EDIT="$E" "$A14_BIN/lanes-index" sync
-is   "lanes-index syncs this suite's whole register into SQLite" "$rc" 0
-has  "…and says what it wrote" "$out" "upserted"
-python3 - "$A14_DB" <<'PY'
-import sqlite3, sys
-c = sqlite3.connect(sys.argv[1])
-c.execute("UPDATE lanes SET owner = 'managed a14-poison', state_phrase = 'LIVE · A14 POISON', "
-          "session_ids = '[\"99999999-9999-4999-8999-999999999999\"]', "
-          "last_session = '99999999-9999-4999-8999-999999999999'")
-c.execute("UPDATE log_lines SET free_text = 'A14 POISON' WHERE verb IN ('NOTED', 'RULED')")
-c.execute("UPDATE log_lines SET verb = 'CLAIMED', object = 'opensoft/repoA#1414' "
-          "WHERE rowid IN (SELECT rowid FROM log_lines WHERE verb = 'STARTED' LIMIT 5)")
-c.execute("UPDATE register_lines SET kind = 'LANDING', raw = 'LANDING — A14 POISON'")
-c.commit()
-PY
-run env -u LANES_INDEX PATH="$A14_BIN:$PATH" LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" "$E" history repoA-1 --index
-has  "the poison is REAL: \`history --index\` reads it, so the sameness below is not vacuous" "$out" "A14 POISON"
-has  "…and says it read the index" "$err" "read: index (sqlite)"
-
-# AND THE INVENTORY'S TABLE (opensoft/openRepoTools#161), true first and then
-# wrong: every lane's #97 sidecars on this workstation, synced into the same
-# store, then a forged tree, forged lifecycles, forged counts and a forged
-# owner. The acts below that write or read the inventory must not move.
-run env -u LANES_INDEX LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" LANES_EDIT="$E" "$A14_BIN/lanes-index" sync --source inventory
-is   "lanes-index syncs this workstation's worktree inventory into the same store" "$rc" 0
-has  "…and writes its rows" "$out" "inventory:Eagle (sqlite)"
-python3 - "$A14_DB" <<'PY'
-import sqlite3, sys
-c = sqlite3.connect(sys.argv[1])
-n = c.execute("SELECT COUNT(*) FROM worktrees").fetchone()[0]
-assert n > 0, "the inventory sync wrote no worktrees row: the poison below would be vacuous"
-c.execute("UPDATE worktrees SET lifecycle = 'SWAPPED', dirty_count = 99, unpushed_count = 99, "
-          "owner = 'managed a14-poison', writer_live = 1")
-c.execute("INSERT INTO worktrees (source, record_id, workstation, lane, owner, path, branch, "
-          "lifecycle, digest, provenance, indexed_utc, schema_version) VALUES ('inventory:Eagle', "
-          "'repoRC-5:/a14/forged', 'Eagle', 'repoRC-5', 'legacy', '/a14/forged', 'feat/a14-poison', "
-          "'RUNNING', 'x', '0', 'now', 1)")
-c.commit()
-PY
-run env -u LANES_INDEX PATH="$A14_BIN:$PATH" LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" "$E" worktrees repoRC-5 --index
-has  "the inventory's poison is REAL: \`worktrees --index\` reads the forged tree" "$out" "/a14/forged"
-has  "…and the forged owner" "$out" "managed a14-poison"
-has  "…and says it read the index's table" "$err" "read: index (sqlite) at inventory:Eagle synced"
-run env -u LANES_INDEX PATH="$A14_BIN:$PATH" LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" "$E" worktrees repoRC-5
-is   "…while the same read WITHOUT the flag is the sidecars', and carries no poison" "$(printf '%s' "$out" | grep -c 'a14-poison' || :)" 0
-
-a14_norm() {
-  printf '%s' "$1" | sed -E \
-    -e 's/[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}(:[0-9]{2})?Z/<UTC>/g' \
-    -e 's/[0-9]+h [0-9]{2}m/<AGE>/g' -e 's/[0-9]+[smhd] ago/<AGO>/g' \
-    -e 's/[0-9a-f]{7,}/<HEX>/g'
-}
-A14_SNAP="$SANDBOX/a14snap"
-# THE LANES' CONTROL ROOT TOO (#161): the inventory writers below change it,
-# and a snapshot that put the register back and left the lifecycle advanced
-# would compare a generation-3 run with a generation-4 one.
-A14_LSR="$HOME/projects/.lane-state"
-# NO GIT GC RUNS UNDER THE SNAPSHOT (CI on #164, `tests-no-submodule` at
-# 50594dc: "rm: cannot remove '…/origin.git': Directory not empty"). By this
-# point the suite has pushed thousands of commits, so a push or a commit can
-# start `git gc --auto`, which DETACHES and keeps writing into the repository
-# while `a14_restore` removes it. A removal that fails leaves the directory
-# behind, `cp -a` then copies the snapshot INSIDE it, and the next write finds
-# no repository at origin. So automatic gc is switched off in both repositories
-# BEFORE the first snapshot (the snapshot carries that setting forward), any gc
-# already running is waited out, and a tree that will not go away is reported
-# rather than copied into.
-git -C "$ORIGIN" config gc.auto 0
-git -C "$ORIGIN" config receive.autogc false
-git -C "$WIP" config gc.auto 0
-a14_gc_quiet() {
-  a14_q=0
-  while [ "$a14_q" -lt 300 ] && { [ -e "$ORIGIN/gc.pid" ] || [ -e "$WIP/.git/gc.pid" ]; }; do
-    sleep 0.1; a14_q=$((a14_q + 1))
-  done
-  return 0
-}
-a14_rmtree() {   # <dir> — removed, retrying while a straggler still writes
-  a14_r=0
-  rm -rf -- "$1" 2>/dev/null
-  while [ -e "$1" ] && [ "$a14_r" -lt 50 ]; do
-    sleep 0.1; rm -rf -- "$1" 2>/dev/null; a14_r=$((a14_r + 1))
-  done
-  if [ -e "$1" ]; then
-    printf 'a14_restore: %s would not go away; the snapshot is NOT restored over it\n' "$1" >&2
-    return 1
-  fi
-  return 0
-}
-a14_snap() {
-  a14_gc_quiet
-  rm -rf "$A14_SNAP"; mkdir -p "$A14_SNAP"
-  cp -a "$WIP" "$A14_SNAP/wip"
-  cp -a "$ORIGIN" "$A14_SNAP/origin"
-  if [ -d "$CLAUDE_CONFIG_DIR/lanes" ]; then cp -a "$CLAUDE_CONFIG_DIR/lanes" "$A14_SNAP/cclanes"; fi
-  if [ -d "$A14_LSR" ]; then cp -a "$A14_LSR" "$A14_SNAP/lsr"; fi
-}
-a14_restore() {
-  a14_gc_quiet
-  a14_rmtree "$WIP" && cp -a "$A14_SNAP/wip" "$WIP"
-  a14_rmtree "$ORIGIN" && cp -a "$A14_SNAP/origin" "$ORIGIN"
-  if a14_rmtree "$CLAUDE_CONFIG_DIR/lanes" && [ -d "$A14_SNAP/cclanes" ]; then
-    cp -a "$A14_SNAP/cclanes" "$CLAUDE_CONFIG_DIR/lanes"
-  fi
-  if a14_rmtree "$A14_LSR" && [ -d "$A14_SNAP/lsr" ]; then
-    cp -a "$A14_SNAP/lsr" "$A14_LSR"
-  fi
-}
-# A WRITE'S NUDGE RUNS DETACHED and may still be reading this checkout when the
-# snapshot goes back: wait for its one line in the fake `psql`'s log (bounded),
-# which is also the proof that it reached for the store at all.
-a14_wait_psql() {   # <lines before>
-  a14_w=0
-  while [ "$a14_w" -lt 150 ]; do
-    [ "$(awk 'END { print NR + 0 }' "$A14_PSQL_LOG")" -gt "$1" ] && return 0
-    sleep 0.1; a14_w=$((a14_w + 1))
-  done
-  return 1
-}
-a14_three() {   # <label> <write: 0|1> <command…>
-  a14_label="$1"; a14_write="$2"; shift 2
-  a14_snap
-  run "$@"
-  a14_c_rc="$rc"; a14_c_out="$(a14_norm "$out")"; a14_c_err="$(a14_norm "$err")"
-  a14_restore
-  a14_before="$(awk 'END { print NR + 0 }' "$A14_PSQL_LOG")"
-  run env -u LANES_INDEX PATH="$A14_BIN:$A14_FAKE:$PATH" LANES_INDEX_CONFIG="$A14_CONF/unreachable.conf" "$@"
-  is   "$a14_label: the same exit with an indexer configured at a store nobody can reach" "$rc" "$a14_c_rc"
-  is   "…the same stdout" "$(a14_norm "$out")" "$a14_c_out"
-  is   "…the same stderr" "$(a14_norm "$err")" "$a14_c_err"
-  if [ "$a14_write" = 1 ]; then
-    a14_wait_psql "$a14_before"
-    is "…and its nudge DID reach for that store, after the write had answered" "$?" 0
-  else
-    is "…and, being no write, it reached for no store at all" \
-       "$(awk 'END { print NR + 0 }' "$A14_PSQL_LOG")" "$a14_before"
-  fi
-  a14_restore
-  run env -u LANES_INDEX LANES_INDEX_CONFIG="$A14_CONF/poisoned.conf" "$@"
-  is   "$a14_label: the same exit over a POISONED index" "$rc" "$a14_c_rc"
-  is   "…the same stdout" "$(a14_norm "$out")" "$a14_c_out"
-  is   "…the same stderr" "$(a14_norm "$err")" "$a14_c_err"
-  a14_restore
-}
-
-a14_three "a NOTED line (a write)" 1 env LANES_LANE=repoA-1 "$E" log NOTED lane:repoA-1 "a14: written three ways"
-is   "…and the control write itself landed, so the comparison is of a real write" "$a14_c_rc" 0
-a14_three "a claim on the object the poison forged a hold on" 1 env LANES_LANE=repoA-1 "$E" claim --no-github opensoft/repoA#1414
-is   "…which the control run TOOK, so a forged hold that was read would have shown" "$a14_c_rc" 0
-a14_three "set-row-state (a row writer)" 1 "$E" set-row-state repoA-2 "PAUSED · a14 three ways"
-a14_three "lane-start --dry-run on a resume-by-id lane" 0 "$START" --dry-run repoA 12
-has  "…which planned the exact resume" "$a14_c_err" "PLAN exec claude --name repoA-12 --resume"
-printf "$gd_hook" "$GD_LANE_ID" "$HOME/projects/repoGD" "do the work" > "$SANDBOX/a14-guard.json"
-a14_three "the name guard" 0 bash -c '"$1" guard < "$2"' a14-guard "$E" "$SANDBOX/a14-guard.json"
-a14_three "who (a read an act makes for itself)" 0 "$E" who opensoft/repoA#1414
-a14_three "managed-projection (#97's seam)" 0 "$E" managed-projection repoMG-1
-a14_three "history without the flag" 0 "$E" history repoA-1
-# THE INVENTORY'S ACTS (opensoft/openRepoTools#161): its two writers, whose
-# nudge is `lanes-index sync --source inventory`, and the reads an act makes of
-# the inventory for itself — `lane-reconcile` above all, which reads the
-# sidecars and the disk and never the table.
-# repoRC-2, and not repoRC-5: (e) above left repoRC-5's record of w1 at a
-# schema this helper refuses to replace, which is a refusal and not a write.
-a14_three "set-lane-tree (an inventory writer)" 1 "$E" set-lane-tree repoRC-2 "$RC_DIR/.claude/worktrees/w1" --checkout "$RC_DIR"
-is   "…which the control run recorded, so the comparison is of a real write" "$a14_c_rc" 0
-a14_three "set-lane-state (the lifecycle writer)" 1 "$E" set-lane-state repoRC-2 SWAPPING --operation a14-inventory-op
-is   "…which the control run moved" "$a14_c_rc" 0
-a14_three "lane-reconcile (the act's own read of the inventory)" 0 "$E" lane-reconcile repoRC-5
-a14_three "lane-reconcile of a lane mid-swap" 0 "$E" lane-reconcile repoRC-2
-a14_three "lane-trees" 0 "$E" lane-trees repoRC-5
-a14_three "lane-state" 0 "$E" lane-state repoRC-2
-
-
-# =====================================================================
-# openRepoTools#94 — THE SUPERVISED CONTEXT RESTART
-#
-# WHAT WAS MEASURED, AND WHAT THESE CASES HOLD. On 2026-09-15T20:59Z `/ctx`
-# wrote its record, respawned its own pane with `LANE_START_FRESH=1 … lane
-# <lane>` — and the pane came up `claude --name <lane> --resume <the uuid it
-# had just paused>`. The seam was an ENVIRONMENT variable and the launcher
-# re-creates its child through `tmux new-session`, which hands a command the
-# SERVER's environment and not the client's. Nothing noticed, because what tmux
-# had started WAS the launch: a launch that ends takes the pane with it.
-#
-# So the cases below are about three things and not one:
-#   * the FRESH SESSION is decided by a FILE and not by an environment — the
-#     row's last uuid may have a transcript, the lane's last PAUSED may name
-#     another that also has one, and neither is resumed;
-#   * the intent is written BEFORE the pane is killed, and a pane is never
-#     respawned without one;
-#   * TMUX ACCEPTING A COMMAND IS NOT A STARTED SESSION — the thing tmux starts
-#     is a supervisor, it runs the launch as a child, and a child that dies
-#     leaves a process in the pane saying so.
-#
-# EVERYTHING HERE IS ITS OWN — its own bin, its own fakes, its own lanes, its
-# own control root — so it can be read, moved or merged in one piece.
-
-SV_BIN="$SANDBOX/svbin"
-mkdir -p "$SV_BIN"
-SV_STATE="$SANDBOX/lane-state"
-mkdir -p "$SV_STATE"
-export LANES_LANE_STATE_ROOT="$SV_STATE"
-
-SV_DIR="$HOME/projects/repoSV"
-mkdir -p "$SV_DIR"
-git init -q -b main "$SV_DIR"
-git -C "$SV_DIR" remote add origin "https://github.com/opensoft/repoSV.git"
-
-SV_OLD="5f000001-1111-4000-8000-5f0000011111"
-SV_PAUSED="5f000002-2222-4000-8000-5f0000022222"
-SV_NEW="5f000003-3333-4000-8000-5f0000033333"
-
-# BOTH RESUME SOURCES EXIST ON DISK, which is the whole point of the #94 case:
-# the row's last uuid has a transcript here, AND the lane's last PAUSED names a
-# second one that also has a transcript here (PR #87's recovery source). A
-# fresh launch must take neither.
-sv_tdir="$HOME/.claude/projects/$(sanitize "$SV_DIR")"
-mkdir -p "$sv_tdir"
-printf '{"type":"user"}\n' > "$sv_tdir/$SV_OLD.jsonl"
-printf '{"type":"user"}\n' > "$sv_tdir/$SV_PAUSED.jsonl"
-
-mkdir -p "$WIP/handoffs/repoSV"
-SV_HANDOFF="$WIP/handoffs/repoSV/repoSV-1.md"
-{ printf 'Lane: repoSV-1 (team-05a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$SV_OLD"
-  printf '\n'
-  printf '## RESUME PROMPT — the top block of repoSV-1\n'
-} > "$SV_HANDOFF"
-for sv_n in 2 3 4; do
-  { printf 'Lane: repoSV-%s (team-05a, session %s) — single-use resume prompt: stamp RESUMED-by before acting (lane-collision-protocol rule 3)\n' "$sv_n" "$SV_OLD"
-    printf '\n'
-    printf '## RESUME PROMPT — the top block of repoSV-%s\n' "$sv_n"
-  } > "$WIP/handoffs/repoSV/repoSV-$sv_n.md"
-done
-git -C "$WIP" add -- handoffs/repoSV >/dev/null 2>&1
-git -C "$WIP" commit -q -m "seed the repoSV handoffs"
-git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-git -C "$WIP" push -q origin main
-
-for sv_l in repoSV-1 repoSV-2 repoSV-3 repoSV-4; do
-  "$E" add-row "| \`$sv_l\` | harness \`$SV_OLD\` | Eagle / test / brett | 2026-09-15T00:00Z | none | handoffs/repoSV/$sv_l.md | ACTIVE |" >/dev/null 2>&1
-done
-# Row 2 and 3 name the handoff of lane 1, which is fine: only lane 1's launch
-# reads a top block here.
-sv_seed_log() {   # <lane>
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$1"
-    printf 'STARTED — lane %s, session %s@Eagle, 2026-09-15T09:00:00Z, lane:%s → home opensoft/repoSV; estate repoSV; dir %s\n' \
-      "$1" "$SV_OLD" "$1" "$SV_DIR"
-    printf 'PAUSED — lane %s, session %s@Eagle, 2026-09-15T10:00:00Z, lane:%s → swap; dir %s; profile team-05a; workstation Eagle; agent claude; transcript %s; kind respawn\n' \
-      "$1" "$SV_OLD" "$1" "$SV_DIR" "$SV_PAUSED"
-  } > "$LOGD/$1.md"
-  git -C "$WIP" add -- "lanes/log/$1.md"
-  git -C "$WIP" commit -q -m "LOG($1@Eagle): seed"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main
-  return 0
-}
-for sv_l in repoSV-1 repoSV-2 repoSV-3; do sv_seed_log "$sv_l"; done
-
-# ---------------------------------------- 1. the intent store, on its own
-
-run "$E" restart-intent repoSV-1
-is   "a lane with no /ctx in flight has no restart intent" "$rc" 8
-
-run "$E" set-restart-intent repoSV-1 flying
-is   "an unknown state word is refused" "$rc" 64
-has  "…naming the supported states" "$err" "pending, starting, failed and ready"
-
-run "$E" set-restart-intent repoSV-1 pending --dir relative/path
-is   "a relative --dir is refused" "$rc" 64
-has  "…because the reader of this record stands somewhere else" "$err" "ABSOLUTE path"
-
-run "$E" set-restart-intent repoSV-1 pending --operation 'op one; two'
-is   "an operation id that is not a manifest key is refused" "$rc" 64
-has  "…because a later reader compares it for equality" "$err" "manifest key"
-run "$E" set-restart-intent repoSV-1 pending --profile "$(printf 'a\nb')"
-is   "…and so is a profile carrying a newline, in a file of one line per field" "$rc" 64
-
-run "$E" set-restart-intent repoSV-1 pending --expect 'none|ready|failed' \
-    --operation op-test-1 --generation 3 --mode fresh-from-handoff \
-    --agent claude --profile team-05a --dir "$SV_DIR" --pane 'svsess:@31.%31' \
-    --handoff "$SV_HANDOFF" --old-transcript "$SV_OLD"
-is   "a pending restart intent is written over 'none'" "$rc" 0
-has  "…and reports the operation it minted" "$out" "op-test-1"
-run "$E" restart-intent repoSV-1
-is   "…and reads back" "$rc" 0
-has  "…as pending" "$out" "$(printf 'state\tpending')"
-has  "…carrying the generation it was fenced on" "$out" "$(printf 'generation\t3')"
-has  "…and the launch mode that authorises a fresh session" "$out" "$(printf 'mode\tfresh-from-handoff')"
-is   "…with a digest of the handoff, computed by the writer" \
-     "$( [ "$(printf '%s\n' "$out" | awk -F'\t' '$1=="digest"{print length($2)}')" -gt 16 ] && echo yes || echo no )" yes
-is   "…and no field that could carry a credential" \
-     "$(printf '%s\n' "$out" | grep -Eci 'token|secret|password|key' || :)" 0
-
-run "$E" set-restart-intent repoSV-1 pending --expect 'none|ready|failed' --operation op-test-2
-is   "a second /ctx does not supersede an operation in flight" "$rc" 7
-has  "…saying which state refused it" "$err" "the intent is pending and --expect named"
-run "$E" restart-intent repoSV-1
-has  "…and the first operation still owns the lane" "$out" "op-test-1"
-
-run "$E" set-restart-intent repoSV-1 starting --expect starting --expect-operation op-test-1
-is   "a compare-and-swap whose expected state is wrong writes nothing" "$rc" 7
-run "$E" set-restart-intent repoSV-1 starting --expect pending --expect-operation op-elsewhere
-is   "…and so does one whose expected OPERATION is wrong" "$rc" 7
-has  "…naming the operation that really holds it" "$err" "operation is op-test-1"
-
-run "$E" set-restart-intent repoSV-1 starting --expect pending --expect-operation op-test-1 --expect-generation 3 --attempt 1
-is   "the supervisor's claim takes pending -> starting under the fence" "$rc" 0
-run "$E" restart-intent repoSV-1
-has  "…and the fields it did not name are KEPT, not blanked" "$out" "$(printf 'handoff\t%s' "$SV_HANDOFF")"
-has  "…including the transcript the /ctx paused" "$out" "$(printf 'old_transcript\t%s' "$SV_OLD")"
-
-run "$E" set-restart-intent repoSV-1 failed --expect starting --expect-operation op-test-1 --reason "the launcher exited 127"
-is   "a failed launch is recorded against the same operation" "$rc" 0
-run "$E" set-restart-intent repoSV-1 starting --expect failed --expect-operation op-test-1 --bump-attempt
-is   "…and the retry increments the attempt count rather than minting a new operation" "$rc" 0
-has  "…still the same operation" "$out" "op-test-1"
-has  "…attempt 2" "$out" "$(printf 'attempt\t2')"
-
-# A SCHEMA THIS READER DOES NOT KNOW FAILS CLOSED. A newer tooling's intent read
-# by an older reader must not be reported as a launch this reader knows how to
-# make — the same rule `lane-state` takes, for the same reason.
-sed -i.bak 's/^schema: .*/schema: 99/' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || \
-  sed -i '' 's/^schema: .*/schema: 99/' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || :
-rm -f "$SV_STATE/repoSV-1/restart-intent.yaml.bak"
-run "$E" restart-intent repoSV-1
-is   "an intent whose schema this reader does not know still reads" "$rc" 0
-has  "…and says so rather than reporting a state it does not understand" "$out" "UNKNOWN-SCHEMA"
-# AND NO LAUNCH GOES AHEAD AT ALL (Copilot round 1 on openRepoTools#121). An
-# intent this reader cannot understand used to fall through to the ordinary
-# resume-source resolution, which is the SAFE half of the decision sitting on
-# top of the unsafe one: it authorises no FRESH session, and the resume source
-# waiting for a lane whose /ctx just killed its pane is the transcript that /ctx
-# PAUSED. That is openRepoTools#94 reached down a second road, so it refuses —
-# a read that could not be made is never an answer (Amendment 7(d)).
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-1 --no-launch
-is   "…and a launch of that lane REFUSES rather than resolving a resume source" "$rc" 2
-has  "…saying a read that could not be made is not 'no restart in flight'" "$err" "Amendment 7(d)"
-has  "…and naming what resuming anyway would have opened" "$err" "the transcript that /ctx PAUSED"
-hasnt "…and resolving no resume source at all" "$out" "--resume"
-has  "…while naming both ways out of it" "$err" "Update this workstation's openRepoTools"
-
-# AND THE WRITER WILL NOT REPLACE IT EITHER. The read side failing closed while
-# the write side copied its known fields forward and stamped `schema: 1` over
-# the rest is the read-side protection undone by the other half of one command.
-run "$E" set-restart-intent repoSV-1 failed --expect starting --reason "over a schema this writer does not know"
-is   "a transition over an unknown schema is refused" "$rc" 2
-has  "…naming the schema it found and the one it writes" "$err" "is schema '99'"
-has  "…and what it would have cost" "$err" "quietly replaced by an older one"
-is   "…leaving the record untouched" \
-     "$(grep -c '^schema: 99' "$SV_STATE/repoSV-1/restart-intent.yaml" || :)" 1
-# PUT IT BACK, because the supervisor cases below are asked on this same lane:
-# a `starting` intent is what proves a second supervisor refuses rather than
-# launching a second session of one lane.
-sed -i.bak 's/^schema: .*/schema: 1/' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || \
-  sed -i '' 's/^schema: .*/schema: 1/' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || :
-rm -f "$SV_STATE/repoSV-1/restart-intent.yaml.bak"
-
-# AN ACTIVE INTENT MISSING A FACT A LAUNCH IS FENCED ON IS NOT READABLE EITHER
-# (Copilot round 2 on openRepoTools#121). The schema check was the whole of what
-# the read verified, so a `pending` record carrying an operation and a mode and
-# nothing else came back with EMPTY values — and empty is what every comparison
-# downstream treats as *cannot compare*: the pane agrees, the digest check
-# skips, and the launch goes ahead with none of the three checks those fields
-# exist for. `none` is still an answer; what is required is that the KEY IS
-# THERE, which is true of everything this tooling writes.
-sed -i.bak '/^digest: /d' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || \
-  sed -i '' '/^digest: /d' "$SV_STATE/repoSV-1/restart-intent.yaml" 2>/dev/null || :
-rm -f "$SV_STATE/repoSV-1/restart-intent.yaml.bak"
-run "$E" restart-intent repoSV-1
-is   "an active intent missing a fenced field still reads" "$rc" 0
-has  "…and says INCOMPLETE rather than handing back an empty one" "$out" "$(printf 'state\tINCOMPLETE')"
-has  "…naming the field that is gone" "$out" "$(printf 'missing\tdigest')"
-has  "…and the state it was trying to be" "$out" "$(printf 'intended_state\tstarting')"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-1 --no-launch
-is   "…and a launch of that lane refuses" "$rc" 2
-has  "…saying which checks an absent value would have skipped" "$err" "cannot compare"
-hasnt "…resolving no resume source" "$out" "--resume"
-# PUT IT BACK for the supervisor cases below, which need this lane `starting`.
-printf 'digest: none\n' >> "$SV_STATE/repoSV-1/restart-intent.yaml"
-run "$E" restart-intent repoSV-1
-has  "…and the record is whole again" "$out" "$(printf 'state\tstarting')"
-
-# A LANE WITH NO CONTROL ROOT IS A READ THAT COULD NOT BE MADE, and never
-# 'this lane has no restart in flight' (Amendment 7(d)).
-run env LANES_LANE_STATE_ROOT= PROJECTS_ROOT=/nonexistent-projects-root "$E" restart-intent repoSV-4
-is   "a lane with no control root is a failed read and not an empty answer" "$rc" 1
-has  "…saying which two rungs answered nothing" "$err" "names no directory"
-run env LANES_LANE_STATE_ROOT= PROJECTS_ROOT=/nonexistent-projects-root \
-    "$E" set-restart-intent repoSV-4 pending --expect none
-is   "…and there is nowhere to write one either" "$rc" 1
-has  "…naming the seam that gives it one" "$err" "LANES_LANE_STATE_ROOT"
-# AND A LAUNCH THAT CANNOT DERIVE THE ROOT REFUSES RATHER THAN FALLING THROUGH
-# (Copilot round 2 on openRepoTools#121). Exit 1 used to sit in the same arm as
-# 8 and 2 and be SILENT — but 8 is *this lane has no restart in flight* and 2 is
-# *this helper predates the feature*, both answers, while 1 is *the read could
-# not be made*. The pane a supervised launch runs in is a NEW one whose
-# environment is not the one that wrote the sidecar, so a root that resolved for
-# the `/ctx` and does not resolve here leaves this command reading nothing and
-# calling it nothing-in-flight — and what it does next is resolve an ordinary
-# resume source, which for a lane whose pane a `/ctx` has just replaced is the
-# transcript that `/ctx` PAUSED. openRepoTools#94, recreated by the command
-# written to prevent it.
-: > "$FAKE_CLAUDE_LOG"
-# The resolved checkout now supplies a root for a new lane. An existing
-# nonregular intent at that root must still refuse as an unreadable record.
-SV_UNREADABLE="${SV_DIR%/*}/.lane-state/repoSV-4/restart-intent.yaml"
-mkdir -p "$SV_UNREADABLE"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    LANES_LANE_STATE_ROOT= PROJECTS_ROOT=/nonexistent-projects-root \
-    "$START" --dir "$SV_DIR" repoSV-4 --no-launch
-is   "a launch whose restart intent could not be read at all refuses" "$rc" 2
-has  "…saying that is NOT 'no restart is in flight'" "$err" "NOT 'no restart is in flight'"
-has  "…naming what an ordinary resume would have opened" "$err" "the transcript that /ctx PAUSED"
-has  "…and how to give this run the root" "$err" "LANES_LANE_STATE_ROOT"
-hasnt "…resolving no resume source" "$out" "--resume"
-rmdir "$SV_UNREADABLE"
-
-# A NEW OPERATION INHERITS NOTHING OF THE LAST ONE'S.
-#
-# A TRANSITION KEEPS THE FIELDS IT DOES NOT NAME — that is what lets the
-# supervisor write `starting` without blanking the handoff digest every later
-# launch is fenced on. But five of the fields belong to ONE OPERATION and not
-# to the lane, and a second `/ctx` that inherited them would read `attempt 3`
-# and `reason "the launcher exited 127"` about a restart that is over. Two of
-# them are worse than untidy, because the readiness predicate is built on the
-# pair: an inherited `new_transcript` is a uuid the new launch will never mint,
-# so readiness can only run to its deadline; an inherited `old_transcript` is
-# the wrong uuid to be DISTINCT FROM, and being distinct from it is the check
-# that catches openRepoTools#94 — a replacement that came up resuming the very
-# transcript the /ctx paused.
-run "$E" set-restart-intent repoSV-4 pending --expect none \
-    --operation op-first --generation 1 --mode fresh-from-handoff \
-    --agent claude --dir "$SV_DIR" --handoff "$SV_HANDOFF" --old-transcript "$SV_OLD"
-is   "a lane's first restart operation is written" "$rc" 0
-run "$E" set-restart-intent repoSV-4 failed --expect pending --expect-operation op-first \
-    --bump-attempt --new-transcript "$SV_NEW" --reason "the launcher exited 127"
-is   "…it fails, with an attempt, an expected transcript and a bounded reason" "$rc" 0
-run "$E" set-restart-intent repoSV-4 pending --expect 'none|ready|failed' \
-    --operation op-second --generation 2 --mode fresh-from-handoff \
-    --agent claude --dir "$SV_DIR" --handoff "$SV_HANDOFF" --old-transcript "$SV_PAUSED"
-is   "a second /ctx over a FAILED restart mints a second operation" "$rc" 0
-run "$E" restart-intent repoSV-4
-has  "…and its attempt count is its own" "$out" "$(printf 'attempt\t0')"
-hasnt "…carrying no failure reason from the operation before it" "$out" "exited 127"
-hasnt "…and not the transcript that operation's launch was preparing" "$out" "$SV_NEW"
-has  "…while the facts it NAMED are written" "$out" "$(printf 'old_transcript\t%s' "$SV_PAUSED")"
-has  "…and the ones it did not name, but which belong to the LANE, are kept" \
-     "$out" "$(printf 'handoff\t%s' "$SV_HANDOFF")"
-run "$E" set-restart-intent repoSV-4 pending --expect pending --operation op-third
-is   "a third operation, naming nothing but itself" "$rc" 0
-run "$E" restart-intent repoSV-4
-has  "…records no transcript of the restart before it, because 'none' is an answer and another operation's uuid is a lie" \
-     "$out" "$(printf 'old_transcript\tnone')"
-has  "…and still the lane's own handoff" "$out" "$(printf 'handoff\t%s' "$SV_HANDOFF")"
-
-# ------------------------- 2. openRepoTools#94: the fresh launch, from the FILE
-
-SV_LANE_HANDOFF="$OPENREPOTOOLS_BIN_DIR/lane-handoff"
-# THE PANE EVERY SUPERVISOR CASE BELOW STANDS IN, PINNED RATHER THAN INHERITED.
-# `$TMUX_PANE` is set by tmux in every pane, and this suite is very often run
-# INSIDE one — so without this the supervisor reads the pane of whatever window
-# the person or the harness happens to be in, disagrees with the pane the
-# intent names, and every case after the pane check refuses for a reason the
-# case was not written to test. A suite that is green on a workstation outside
-# tmux and red inside one is a suite that tests the workstation.
-#
-# `%33` IS THE BARE FORM tmux itself exports, and the intent's pane is the live
-# record's `svsess:@33.%33`: the two agree component-wise, which is the
-# comparison `pane_agrees` makes, and asserting it here is the positive half of
-# the `%3`-is-not-`%33` case further down. A case that wants to DISAGREE names
-# its OWN `TMUX_PANE` in place of this one rather than a second assignment to
-# the same name after it: `env A=1 A=2` keeping the later is true of every
-# `env` this runs under and is written down nowhere, and a case whose meaning
-# rests on that is a case nobody can read.
-SV_PANE='%33'
-# AND THE INTENT FILE THE TWO LONG-LIVED FAKES BELOW WAIT ON, which is where
-# the supervisor's observer writes its verdict. `LANES_LANE_STATE_ROOT` is
-# `$SV_STATE` for this whole section, so `lane_restart_control_root` resolves on its
-# first rung and the path is knowable from here.
-export SV_INTENT="$SV_STATE/repoSV-3/restart-intent.yaml"
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-2 --no-launch
-is   "without a restart intent, a lane whose row uuid has a transcript resumes it" "$rc" 0
-has  "…exactly as Amendment 6 has always done" "$out" "--resume $SV_OLD"
-
-# THE CASE openRepoTools#94 ASKS FOR, and it is stronger than the issue's own
-# wording: the environment carries NOTHING — no LANE_START_FRESH — the row's
-# last uuid has a transcript here, and the lane's last PAUSED names a SECOND
-# transcript that also has one (PR #87's recovery source, so this case holds
-# when that lands too). The only thing saying "fresh" is the file.
-run "$E" set-restart-intent repoSV-2 pending --expect 'none|ready|failed' \
-    --operation op-94 --generation 1 --mode fresh-from-handoff \
-    --agent claude --profile team-05a --dir "$SV_DIR" \
-    --handoff "$WIP/handoffs/repoSV/repoSV-2.md" --old-transcript "$SV_OLD"
-is   "a /ctx writes its intent before anything is killed" "$rc" 0
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-2 --operation op-94 --no-launch
-is   "with a pending restart intent and NO LANE_START_FRESH, the launch is a new session" "$rc" 0
-hasnt "…never a resume of the transcript the /ctx paused" "$out" "--resume $SV_OLD"
-hasnt "…never a resume of the transcript its last PAUSED names either" "$out" "--resume $SV_PAUSED"
-hasnt "…never a resume of anything at all" "$out" "--resume"
-has  "…named for the lane" "$out" "--name repoSV-2"
-has  "…and primed by the handoff's top block" "$out" "the top block of repoSV-2"
-has  "…saying which authority decided it" "$err" "restart intent op-94"
-
-# AND THE INTENT OUTRANKS A CONFLICT RATHER THAN SUBSTITUTING FOR IT.
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" --operation op-not-this-one repoSV-2 --no-launch
-is   "a launch naming another operation is refused" "$rc" 2
-has  "…naming the one that really holds the lane" "$err" "op-94"
-
-SV_OTHER="$HOME/projects/repoSVX"
-mkdir -p "$SV_OTHER"
-git init -q -b main "$SV_OTHER"
-git -C "$SV_OTHER" remote add origin "https://github.com/opensoft/repoSV.git"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_OTHER" repoSV-2 --operation op-94 --no-launch
-is   "a launch in a checkout the intent does not name is refused" "$rc" 2
-has  "…citing the silent loss a wrong directory is" "$err" "Evidence 3"
-
-# A CHANGED HANDOFF BLOCKS THE LAUNCH, because its top block IS the first prompt.
-printf 'appended after the intent was written\n' >> "$WIP/handoffs/repoSV/repoSV-2.md"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-2 --operation op-94 --no-launch
-is   "a handoff that changed since the intent was written blocks the launch" "$rc" 2
-has  "…saying the top block is the first prompt" "$err" "FIRST PROMPT"
-git -C "$WIP" checkout -- handoffs/repoSV/repoSV-2.md 2>/dev/null || :
-
-# ONE DIGEST, THREE COMMANDS, AND IT HAD BETTER BE ONE FUNCTION. `lanes-edit.sh`
-# RECORDS the handoff's digest into the intent, `lane-start` VERIFIES it before
-# it launches, and `lane-handoff` verifies it again before a supervisor claims
-# the operation — three installed files with no library between them, which is
-# this estate's shape. Restart control-root helpers now have a private namespace
-# beside PR #97's diagnostic helpers; the digest contract remains identical.
-#
-# THE TWO CASES ABOVE ALREADY PROVE TWO OF THEM AGREE BY BEHAVIOUR — the launch
-# went through while the file was untouched and refused the moment a line was
-# appended — so what is left to pin is that the third is the same act, and that
-# "the same" means the BODY and not the name. A copy that drifted would not fail
-# loudly: it would RECORD one digest and VERIFY another, and every launch after
-# it would refuse a handoff nobody had changed.
-sv_fn_body() {   # <file> <function name> — its body, indentation normalised
-  awk -v f="$2" 'index($0, f "()") == 1 { on = 1 } on { sub(/^[ \t]+/, ""); print } on && $0 == "}" { exit }' "$1" | tail -n +2
-}
-sv_dig_canon="$(sv_fn_body "$SRC_DIR/lanes-edit.sh" lane_handoff_digest)"
-is   "the digest lanes-edit.sh records with is a function with a body" \
-     "$( [ "$(printf '%s' "$sv_dig_canon" | grep -c 'sha256sum' || :)" -ge 1 ] && echo yes || echo no )" yes
-is   "…and the one lane-start verifies a launch with is that same body" \
-     "$(sv_fn_body "$SRC_DIR/lane-start" handoff_digest_of)" "$sv_dig_canon"
-is   "…and the one lane-handoff refuses a stale operation with is too" \
-     "$(sv_fn_body "$SRC_DIR/lane-handoff" handoff_digest)" "$sv_dig_canon"
-
-# A `ready` INTENT IS HISTORY AND AUTHORISES NOTHING.
-run "$E" set-restart-intent repoSV-2 ready --expect pending --expect-operation op-94
-is   "readiness is recorded against the operation" "$rc" 0
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" repoSV-2 --no-launch
-is   "a confirmed restart authorises no further fresh launch" "$rc" 0
-has  "…so the next lane <name> is an ordinary resume" "$out" "--resume"
-
-# `--fresh` IS THE ARGUMENT BESIDE THE VARIABLE, for a caller with no launcher
-# between it and here.
-: > "$FAKE_CLAUDE_LOG"
-run env PATH="$A17PATH" FAKE_TMUX_WINDOW="svsess:@31" CLAUDE_PROFILE_NAME=team-05a \
-    "$START" --dir "$SV_DIR" --fresh repoSV-2 --no-launch
-is   "--fresh takes a new session with no environment and no intent" "$rc" 0
-hasnt "…resuming nothing" "$out" "--resume"
-has  "…and saying which of the three said so" "$err" "(--fresh)"
-
-# --------------- 3. the transaction: the intent is written BEFORE the kill
-
-# ITS OWN FAKE TMUX, logging the respawn and recording how many restart intents
-# the lane's control root held at the instant tmux was asked. Amendment 17(f) is
-# an ORDER, and an order is proved by what the second act could see of the first.
-cat > "$SV_BIN/tmux" <<'FAKE'
-#!/usr/bin/env bash
-case "${1-}" in
-  send-keys|respawn-pane)
-    printf '%s' "$*" >> "${FAKE_TMUX_SV_LOG:-/dev/null}"
-    printf ' | intents=%s\n' \
-      "$(ls "${FAKE_TMUX_SV_WATCH:-/nonexistent}" 2>/dev/null | grep -c '^restart-intent.yaml$' || printf 0)" \
-      >> "${FAKE_TMUX_SV_LOG:-/dev/null}"
-    exit "${FAKE_TMUX_SV_RC:-0}" ;;
-esac
-exec "${FAKE_TMUX_REAL:?}" "$@"
-FAKE
-chmod +x "$SV_BIN/tmux"
-export FAKE_TMUX_SV_LOG="$SANDBOX/tmux-sv.log"
-export FAKE_TMUX_SV_WATCH="$SV_STATE/repoSV-3"
-: > "$FAKE_TMUX_SV_LOG"
-SVPATH="$SV_BIN:$A17PATH"
-
-write_record_ns "$sessions_dir/live-sv.json" "$SV_OLD" "$LIVE_PID" "$live_start" "svsess:@33.%33" "repoSV-3" "user" "busy"
-run env PATH="$SVPATH" FAKE_TMUX_WINDOW="svsess:@33" CLAUDE_CODE_SESSION_ID="$SV_OLD" \
-    CLAUDE_PROFILE_NAME=team-05a "$SV_LANE_HANDOFF" --lane repoSV-3 --restart clear
-is   "lane-handoff --restart exits 0" "$rc" 0
-sv_tmux="$(cat "$FAKE_TMUX_SV_LOG")"
-has  "…respawning the lane's own pane" "$sv_tmux" "respawn-pane -k -t svsess:@33.%33"
-has  "…into this command's own supervisor, by absolute path" "$sv_tmux" "lane-handoff --supervise --lane repoSV-3 --operation"
-hasnt "…and never into the human dispatcher, whose valid outcomes include attaching" "$sv_tmux" " lane repoSV-3"
-has  "…threading the workstation into the command string, because tmux hands the SERVER's environment" "$sv_tmux" "LANES_WORKSTATION=Eagle"
-is   "…and the restart intent was on disk BEFORE tmux was asked to kill anything" \
-     "$(printf '%s' "$sv_tmux" | sed -n 's/.*intents=\([0-9]*\).*/\1/p' | head -n 1)" 1
-run "$E" restart-intent repoSV-3
-is   "…the intent reads back" "$rc" 0
-has  "…as pending, claimed by nobody yet" "$out" "$(printf 'state\tpending')"
-has  "…naming the pane the /ctx respawned" "$out" "$(printf 'pane\tsvsess:@33.%%33')"
-has  "…the transcript it paused" "$out" "$(printf 'old_transcript\t%s' "$SV_OLD")"
-has  "…and the launch mode that authorises a fresh session" "$out" "$(printf 'mode\tfresh-from-handoff')"
-SV_OP3="$(printf '%s\n' "$out" | awk -F'\t' '$1=="operation"{print $2}')"
-is   "…with an operation of its own" "$( [ -n "$SV_OP3" ] && echo yes || echo no )" yes
-
-# A SECOND /ctx OVER AN OPERATION IN FLIGHT REFUSES, AND KILLS NOTHING.
-: > "$FAKE_TMUX_SV_LOG"
-run env PATH="$SVPATH" FAKE_TMUX_WINDOW="svsess:@33" CLAUDE_CODE_SESSION_ID="$SV_OLD" \
-    CLAUDE_PROFILE_NAME=team-05a "$SV_LANE_HANDOFF" --lane repoSV-3 --restart clear
-is   "a second /ctx over an operation in flight is refused" "$rc" 2
-has  "…saying an ordinary context clear never supersedes one" "$err" "never supersedes an operation"
-is   "…and the pane was NOT respawned" "$(grep -c 'respawn-pane' "$FAKE_TMUX_SV_LOG")" 0
-
-# A TMUX THAT REFUSES LEAVES THE OLD PROCESS ALIVE AND THE INTENT PENDING.
-"$E" set-restart-intent repoSV-3 ready --expect pending >/dev/null 2>&1
-: > "$FAKE_TMUX_SV_LOG"
-run env PATH="$SVPATH" FAKE_TMUX_SV_RC=1 FAKE_TMUX_WINDOW="svsess:@33" \
-    CLAUDE_CODE_SESSION_ID="$SV_OLD" CLAUDE_PROFILE_NAME=team-05a \
-    "$SV_LANE_HANDOFF" --lane repoSV-3 --restart clear
-is   "a tmux that refuses the respawn is a refusal and not a silent success" "$rc" 2
-has  "…saying nothing was killed" "$err" "Nothing was killed"
-has  "…and naming the line that hands the pane over once tmux will take it" "$err" "--supervise --lane repoSV-3"
-run "$E" restart-intent repoSV-3
-has  "…with the intent left pending for the supervisor that never arrived" "$out" "$(printf 'state\tpending')"
-
-# --------------------------------- 4. the supervisor: refusals before a launch
-
-SV_OP="$(printf '%s\n' "$out" | awk -F'\t' '$1=="operation"{print $2}')"
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation op-stale
-is   "a supervisor started for a stale operation refuses" "$rc" 2
-has  "…naming the operation that really holds the lane" "$err" "$SV_OP"
-hasnt "…and launches nothing" "$err" "restarting (operation"
-
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-1 --operation op-test-1
-is   "a supervisor whose intent is already \`starting\` refuses rather than starting a second session" "$rc" 2
-has  "…citing the one-transcript-one-process rule" "$err" "Amendment 18(h)"
-
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE='%99' "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a supervisor in a pane the intent does not name refuses" "$rc" 2
-has  "…naming both panes" "$err" "svsess:@33.%33"
-# AND THE COMPARISON IS COMPONENT-WISE, NOT A SUFFIX. `%3` is a SUFFIX of
-# `%33`, so a `case ... in *"$TMUX_PANE")` accepted a supervisor in pane 3 for
-# an intent written for pane 33 — the wrong window, decided by string tail.
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE='%3' "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "…and a pane whose id is a SUFFIX of the intent's is still another pane" "$rc" 2
-has  "…named as the disagreement it is" "$err" "and this supervisor is in %3"
-
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a supervisor that finds a live holder refuses to make a second one" "$rc" 2
-has  "…naming the retire act and never a kill" "$err" "lane-end repoSV-3 --retire"
-
-rm -f "$sessions_dir/live-sv.json"
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3
-is   "a supervisor with no operation refuses" "$rc" 2
-has  "…because one that took whatever it found would launch into somebody else's act" "$err" "--operation <id>"
-
-# AND AN AGENT THE LANE'S OWN RECORD DOES NOT NAME IS A REFUSAL BEFORE ANY
-# LAUNCH (Copilot round 2 on openRepoTools#121). Design decision 15 says agent,
-# profile and directory are fenced EARLIER — *"where a conflict refuses the
-# launch before it is made, rather than re-checked after"* — and for the agent
-# that was true of no line: the intent recorded it and nothing read it back.
-# It is the CANONICAL agent that is compared and not the child's, because what a
-# live process IS cannot be read from this estate's records: `live-holder`
-# answers a transcript, a pane, a name, a pid and a verdict, and no agent word.
-"$E" set-restart-intent repoSV-3 pending --expect pending --agent codex >/dev/null 2>&1
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a supervisor whose intent names an agent the lane's record does not refuses" "$rc" 2
-has  "…naming the one the restart was written for" "$err" "written for agent 'codex'"
-has  "…and the one the lane's record now names" "$err" "now names 'claude'"
-hasnt "…and launches nothing" "$err" "restarting (operation"
-"$E" set-restart-intent repoSV-3 pending --expect pending --agent claude >/dev/null 2>&1
-
-# ------------------------------- 5. the supervisor: a launch that FAILS
-
-cat > "$SV_BIN/pclaude-fail" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_SVLAUNCH_LOG:-/dev/null}"
-exit 127
-FAKE
-chmod +x "$SV_BIN/pclaude-fail"
-export FAKE_SVLAUNCH_LOG="$SANDBOX/svlaunch.log"
-: > "$FAKE_SVLAUNCH_LOG"
-run env PATH="$SVPATH" PCLAUDE="$SV_BIN/pclaude-fail" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    LANE_SUPERVISOR_READY_SECONDS=4 "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a launcher that exits nonzero is a FAILED restart and not a started one" "$rc" 3
-has  "…and the supervisor was still there to say so" "$out" "RESTART FAILED"
-has  "…naming the status the launch ended with" "$out" "status 127"
-has  "…offering the retry, in one line" "$out" "--supervise --lane repoSV-3 --operation $SV_OP"
-has  "…and saying the handoff is intact" "$out" "handoff it wrote is intact"
-is   "…the launch really was attempted" "$(grep -c -- "--lane repoSV-3" "$FAKE_SVLAUNCH_LOG")" 1
-run "$E" restart-intent repoSV-3
-has  "…the intent is failed" "$out" "$(printf 'state\tfailed')"
-has  "…still the same operation" "$out" "$SV_OP"
-has  "…the attempt counted" "$out" "$(printf 'attempt\t1')"
-has  "…and the reason bounded and recorded" "$out" "before readiness was confirmed"
-
-# THE RETRY IS THE SAME OPERATION, NOT A NEW ONE.
-run env PATH="$SVPATH" PCLAUDE="$SV_BIN/pclaude-fail" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    LANE_SUPERVISOR_READY_SECONDS=4 "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a retry of a failed restart runs" "$rc" 3
-run "$E" restart-intent repoSV-3
-has  "…under the same operation" "$out" "$SV_OP"
-has  "…with the attempt incremented" "$out" "$(printf 'attempt\t2')"
-
-# Stale-generation/attempt behavior is exercised through the actual supervisor
-# in test_supervised_restart_regressions.py. Counting flag spellings here cannot
-# prove fencing: a new-operation reservation needs a generation expectation
-# without expecting the prior operation, and array fences span separate lines.
-
-# ------------------------- 6. the supervisor: a launch that BECOMES READY
-
-SV_READY_SRC="$SANDBOX/sv-ready-record.json"
-write_record_ns "$SV_READY_SRC" "$SV_NEW" "$LIVE_PID" "$live_start" "svsess:@33.%33" "repoSV-3" "user" "busy"
-"$E" append-session-id repoSV-3 "$SV_OLD" "→ harness \`$SV_NEW\`" >/dev/null 2>&1
-cat > "$SV_BIN/pclaude-ok" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_SVLAUNCH_LOG:-/dev/null}"
-"$FAKE_SV_EDITOR" set-restart-intent repoSV-3 starting --expect starting \
-    --expect-operation "$SV_OP" --new-transcript "$SV_NEW" >/dev/null 2>&1 || exit 2
-cp "$SV_READY_SRC" "$SV_READY_DST"
-# THE CHILD OUTLIVES THE OBSERVER'S VERDICT, AND WAITS FOR THE VERDICT RATHER
-# THAN FOR A NUMBER OF SECONDS. The case is about an ORDER — the observer
-# confirms readiness, and the session exits LATER — and `sleep 8` asserted that
-# order with a stopwatch. The observer's poll is a `lanes-edit.sh live-holder`,
-# which resolves the lane, reads the published row and scans every session
-# record this workstation has; two of those while another lane runs this same
-# suite cost more than the eight seconds the child was given, and the case went
-# red on a machine that was merely busy. Waiting on the file the observer
-# writes makes the ORDER the assertion, and is faster in the ordinary case.
-i=0
-while [ "$i" -lt "${FAKE_SVLAUNCH_CAP:-60}" ]; do
-  grep -q '^state: ready' "${SV_INTENT:-/nonexistent}" 2>/dev/null && break
-  i=$((i + 1)); sleep 1
-done
-exit 0
-FAKE
-chmod +x "$SV_BIN/pclaude-ok"
-export SV_READY_SRC SV_READY_DST="$sessions_dir/live-sv-new.json" FAKE_SV_EDITOR="$E" SV_OP SV_NEW
-"$E" set-restart-intent repoSV-3 pending --expect failed --new-transcript "$SV_NEW" >/dev/null 2>&1
-: > "$FAKE_SVLAUNCH_LOG"
-run env PATH="$SVPATH" PCLAUDE="$SV_BIN/pclaude-ok" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    LANE_SUPERVISOR_READY_SECONDS=20 "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a launch that comes up and is CONFIRMED exits 0 when its session later ends" "$rc" 0
-has  "…saying the replacement was confirmed" "$out" "was CONFIRMED"
-has  "…and refusing to relaunch a session that exited on purpose" "$out" "is not relaunched here"
-run "$E" restart-intent repoSV-3
-has  "…the intent is ready" "$out" "$(printf 'state\tready')"
-has  "…naming the transcript readiness was proved on" "$out" "$SV_NEW"
-has  "…which is NOT the one the /ctx paused" "$out" "$(printf 'old_transcript\t%s' "$SV_OLD")"
-rm -f "$SV_READY_DST"
-
-# A `ready` OPERATION IS HISTORY: a supervisor started for it again refuses.
-run env PATH="$SVPATH" PCLAUDE="$SV_BIN/pclaude-ok" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    "$SV_LANE_HANDOFF" --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a confirmed restart is not launched a second time" "$rc" 2
-has  "…and the door to the lane is the one word a person has" "$err" "lane repoSV-3"
-
-# ------------------------------------------- 7. the status surface
-
-run env PATH="$SVPATH" "$SV_LANE_HANDOFF" --restart-status --lane repoSV-3
-is   "the status surface reads" "$rc" 0
-has  "…the lane" "$out" "lane        repoSV-3"
-has  "…the intent and its attempt" "$out" "intent      ready"
-has  "…the operation and generation" "$out" "operation   $SV_OP"
-has  "…the handoff" "$out" "handoff     "
-has  "…both transcripts" "$out" "transcript  old $SV_OLD"
-has  "…and what is open on it" "$out" "DONE: this restart was confirmed"
-run env PATH="$SVPATH" "$SV_LANE_HANDOFF" --restart-status --lane repoSV-2
-has  "…and a lane whose lanes-edit.sh has no lifecycle says so rather than leaving it blank" \
-     "$out" "lifecycle   "
-
-run env PATH="$SVPATH" "$SV_LANE_HANDOFF" --restart-status --lane repoSV-3 --restart
-is   "--restart-status and --restart together are refused" "$rc" 2
-has  "…because one reads and the other writes the record" "$err" "Ask for one."
-run env PATH="$SVPATH" "$SV_LANE_HANDOFF" --supervise --restart-status --lane repoSV-3
-is   "--supervise and --restart-status together are refused" "$rc" 2
-run env PATH="$SVPATH" "$SV_LANE_HANDOFF" --restart --lane repoSV-3 --operation "$SV_OP" clear
-is   "--operation outside --supervise is refused rather than silently discarded" "$rc" 2
-has  "…because --restart mints its own" "$err" "MINTS its own operation"
-
-# ------------------- 6a. the third answer: INDETERMINATE, and nothing is killed
-#
-# A CHILD THAT IS ALIVE AND UNCONFIRMED IS NOT A FAILURE AND NOT A SUCCESS. The
-# deadline expires, the observer writes what it could not prove, and nothing is
-# killed — Amendment 8(f): ending somebody's process is not a boundary script's
-# act. Here the child then exits on its own, which is the only way a supervisor
-# blocked on it ever gets to report.
-cat > "$SV_BIN/pclaude-quiet" <<'FAKE'
-#!/usr/bin/env bash
-printf '%s\n' "$*" >> "${FAKE_SVLAUNCH_LOG:-/dev/null}"
-# ALIVE UNTIL THE DEADLINE HAS BEEN DECLARED, and not for a fixed count of
-# seconds, for the reason `pclaude-ok` above gives. This child must still be
-# running when the observer's deadline expires — that is what INDETERMINATE
-# MEANS — and must then exit, because a supervisor blocked on its child is only
-# able to report once the child is gone.
-i=0
-while [ "$i" -lt "${FAKE_SVLAUNCH_CAP:-60}" ]; do
-  grep -q 'INDETERMINATE' "${SV_INTENT:-/nonexistent}" 2>/dev/null && break
-  i=$((i + 1)); sleep 1
-done
-exit 0
-FAKE
-chmod +x "$SV_BIN/pclaude-quiet"
-"$E" set-restart-intent repoSV-3 pending --expect ready >/dev/null 2>&1
-: > "$FAKE_SVLAUNCH_LOG"
-run env PATH="$SVPATH" PCLAUDE="$SV_BIN/pclaude-quiet" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    LANE_SUPERVISOR_READY_SECONDS=4 "$SV_LANE_HANDOFF" \
-    --supervise --lane repoSV-3 --operation "$SV_OP"
-is   "a child that stays alive without readiness evidence is INDETERMINATE, not running" "$rc" 4
-has  "…and the supervisor says which it was" "$out" "INDETERMINATE"
-# 4 AND NOT 3, WHICH IS THE DISTINCTION THE USAGE BLOCK PROMISES AND NO PATH
-# USED TO RETURN (Copilot round 1 on openRepoTools#121). The observer's own
-# `return 4` is read by nothing — it runs in the background and the record is
-# what decides — so the record decides this too. The `failed` TRANSITION stays:
-# INDETERMINATE is the answer for a child that is ALIVE at the deadline, and
-# this branch is reached only once that child has exited, which is a launch that
-# ended having never been confirmed and is retryable. Leaving it `starting`
-# would wedge the lane in the one state neither a retry nor the next /ctx can
-# move.
-has  "…as a launch that ran PAST the deadline and only then ended" "$out" "ran past the readiness deadline still alive"
-run env PATH="$SVPATH" LANE_SUPERVISOR_NO_PROMPT=1 TMUX_PANE="$SV_PANE" \
-    "$SV_LANE_HANDOFF" --restart-status --lane repoSV-3
-is   "…and the retry surface is open on it" "$rc" 0
-has  "…as a failed restart with one line to retry" "$out" "RETRY:"
-run "$E" restart-intent repoSV-3
-hasnt "…the lane was never marked ready on a launch nothing proved" "$out" "$(printf 'state\tready')"
-has  "…the deadline is in the record for a reader in another window" "$out" "INDETERMINATE"
-
-# =========================================================================
-section "== opensoft/openRepoTools#162: bytecode never rides a workspace commit =="
-#
-# A handoff's attachments were committed with a whole virtualenv's
-# `__pycache__` inside them (cause 19). `pathspec-check` is the question a
-# hand commit asks first, and `commit_push` asks it of every write this file
-# makes: what `git add` WOULD stage that is bytecode, a cache or an
-# environment. The `.gitignore` lines are OFFERED where the workspace lacks
-# them, and once they are there the same pathspec stages nothing of the kind.
-B162_REL="handoffs/sandbox/attachments/b162"
-B162="$WIP/$B162_REL"
-mkdir -p "$B162/r1/__pycache__" "$B162/r1/venv/lib/python3.12/site-packages" \
-  "$B162/r1/env-x/lib/python3.12/site-packages"
-printf 'findings\n' > "$B162/r1/notes.md"
-printf 'bytecode\n' > "$B162/r1/__pycache__/m.cpython-312.pyc"
-printf 'pkg\n' > "$B162/r1/venv/lib/python3.12/site-packages/pkg.py"
-printf 'pkg\n' > "$B162/r1/env-x/lib/python3.12/site-packages/other.py"
-B162_IGN=""
-[ -f "$WIP/.gitignore" ] && B162_IGN="$(cat "$WIP/.gitignore")"
-run "$E" pathspec-check "$B162_REL"
-is   "pathspec-check refuses an attachment that carries bytecode" "$rc" 2
-has  "…naming the bytecode" "$out" "$B162_REL/r1/__pycache__/m.cpython-312.pyc"
-has  "…and the virtual environment" "$out" "$B162_REL/r1/venv/lib/python3.12/site-packages/pkg.py"
-hasnt "…and not the attachment's own notes" "$out" "notes.md"
-has  "…and offers the ignore lines the workspace lacks" "$err" "'__pycache__/'"
-has  "…a venv under any name included, by its site-packages" "$out" "$B162_REL/r1/env-x/lib/python3.12/site-packages/other.py"
-has  "…and the line that covers it is among those offered" "$err" "'site-packages/'"
-run "$E" pathspec-check "$B162_REL/r1/notes.md"
-is   "a pathspec with nothing of the kind passes" "$rc" 0
-# A READ THAT FAILED IS NO "CLEAN" (#170 G13): a malformed magic pathspec makes
-# both git reads exit 128, and the check printed nothing and passed.
-run "$E" pathspec-check ':(bogus)x'
-is   "a pathspec git cannot read is refused, never reported clean" "$rc" 2
-has  "…saying the read failed" "$err" "could not read what that pathspec would stage"
-b162_head="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_LANE=repoA-1 LANES_PATH=':(bogus)x' "$E" commit "attach nothing"
-is   "…and the commit path refuses it before the add" "$rc" 2
-has  "…saying so" "$err" "could not read what this commit would stage"
-is   "…committing nothing" "$(git -C "$WIP" rev-parse HEAD)" "$b162_head"
-b162_head="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_LANE=repoA-1 LANES_PATH="$B162_REL" "$E" commit "attach r1"
-is   "the commit path refuses the same pathspec" "$rc" 2
-has  "…saying what it is" "$err" "none of them is ever a workspace repository's"
-is   "…and commits nothing" "$(git -C "$WIP" rev-parse HEAD)" "$b162_head"
-is   "…and stages nothing" "$(git -C "$WIP" diff --cached --name-only | grep -c . || :)" 0
-printf '%s\n' '__pycache__/' '*.pyc' 'venv/' >> "$WIP/.gitignore"
-run "$E" pathspec-check "$B162_REL"
-is   "without the site-packages line a venv under another name is still refused" "$rc" 2
-printf '%s\n' 'site-packages/' >> "$WIP/.gitignore"
-run "$E" pathspec-check "$B162_REL"
-is   "with the offered lines in place it stages nothing of the kind" "$rc" 0
-# ALREADY STAGED (Copilot round 2 on #169): `add --dry-run` is silent about a
-# path the index already holds, and the commit would carry it regardless.
-git -C "$WIP" add -f -- "$B162_REL/r1/__pycache__/m.cpython-312.pyc"
-run "$E" pathspec-check "$B162_REL"
-is   "bytecode already staged is refused too" "$rc" 2
-has  "…and named" "$out" "$B162_REL/r1/__pycache__/m.cpython-312.pyc"
-b162_head="$(git -C "$WIP" rev-parse HEAD)"
-run env LANES_LANE=repoA-1 LANES_PATH="$B162_REL" "$E" commit "attach r1"
-is   "…by the commit path as well" "$rc" 2
-is   "…which commits nothing" "$(git -C "$WIP" rev-parse HEAD)" "$b162_head"
-git -C "$WIP" reset -q -- "$B162_REL"
-rm -rf "$WIP/handoffs/sandbox"
-if [ -n "$B162_IGN" ]; then printf '%s\n' "$B162_IGN" > "$WIP/.gitignore"; else rm -f "$WIP/.gitignore"; fi
-git -C "$WIP" checkout -q -- .gitignore 2>/dev/null || :
-
-# =========================================================================
-section "== opensoft/openRepoTools#163: lane-end's close-out gate, and lane-worktrees add =="
-#
-# WORKSPACE CREATION OUTPACES WORKSPACE CLOSEOUT, and #163 is both ends of it.
-# `lane-worktrees add` makes a lane's worktree AND records it in the lane's #97
-# inventory in one act, so no tree the tooling makes is ever unrecorded; and
-# `lane-end` asks #162's sweep, as a dry run, before it ends a lane, and refuses
-# while anything of the lane's is still on disk — naming it, and the sweep that
-# retires it — unless `--inventory-only` is the word, which ends the lane and
-# writes down why. EVERYTHING THIS SECTION USES IS ITS OWN: its own repository
-# and bare origin, its own lanes (`repoCG-*`), its own `.lane-worktrees` roots
-# and its own lifecycle control root, all under the suite's sandbox and BESIDE
-# `$HOME/projects` rather than in it. That is not tidiness: the sweep reads
-# every OTHER lane's inventory under the same control root before it judges a
-# tree, and refuses where one cannot be read (#162) — and the #91 section above
-# leaves dangling sidecars there on purpose. A gate asked under that root would
-# answer for those fixtures, not for these lanes. The control root this section
-# exports is put back at its end.
-CG_E="$OPENREPOTOOLS_BIN_DIR/lanes-edit.sh"
-CG_LW="$OPENREPOTOOLS_BIN_DIR/lane-worktrees"
-CG_ID="16300001-1111-4000-8000-163000011111"
-CG_EST="$SANDBOX/cgp"
-CG_DIR="$CG_EST/repoCG"
-CG_ORIGIN="$SANDBOX/repoCG-origin.git"
-CG_ROOT="$CG_EST/.lane-worktrees"
-CG_STATE="$SANDBOX/cg-state"
-CG_LOGD="$WIP/lanes/log"
-cg_had_lsr="${LANES_LANE_STATE_ROOT+set}"; cg_lsr="${LANES_LANE_STATE_ROOT-}"
-export LANES_LANE_STATE_ROOT="$CG_STATE"
-mkdir -p "$CG_LOGD" "$CG_EST" "$CG_STATE"
-git init -q --bare -b main "$CG_ORIGIN"
-git init -q -b main "$CG_DIR"
-git -C "$CG_DIR" config user.email "test@example.invalid"
-git -C "$CG_DIR" config user.name "lane helper tests"
-git -C "$CG_DIR" remote add origin "$CG_ORIGIN"
-printf '.env\nnode_modules/\n' > "$CG_DIR/.gitignore"
-printf 'seed\n' > "$CG_DIR/a.txt"
-git -C "$CG_DIR" add -A >/dev/null 2>&1
-git -C "$CG_DIR" commit -q -m "the close-out estate's first commit"
-git -C "$CG_DIR" push -q origin main 2>/dev/null
-
-cg_lane() {   # <lane> [<dir>] — a row, and a log whose STARTED line records the lane's directory
-  "$CG_E" add-row "| \`$1\` | harness \`$CG_ID\` | Eagle / test / brett | 2026-10-06T00:00Z | none | handoffs/repoCG/$1.md | ACTIVE |" >/dev/null 2>&1
-  { printf '# lane %s — object log (lane-collision-protocol Amendment 7)\n' "$1"
-    printf 'STARTED — lane %s, session %s@Eagle, 2026-10-06T00:00:00Z, lane:%s → home opensoft/repoCG; dir %s; profile team-01a\n' \
-      "$1" "$CG_ID" "$1" "${2:-$CG_DIR}"
-  } > "$CG_LOGD/$1.md"
-  git -C "$WIP" add -- "lanes/log/$1.md"
-  git -C "$WIP" commit -q -m "LOG($1@Eagle): seed"
-  git -C "$WIP" pull -q --rebase origin main 2>/dev/null || :
-  git -C "$WIP" push -q origin main 2>/dev/null
-  return 0
-}
-for cg_l in repoCG-1 repoCG-2 repoCG-3 repoCG-4 repoCG-5 repoCG-6 repoCG-7 repoCG-8 repoCG-11 repoCG-12 repoCG-13; do cg_lane "$cg_l"; done
-# repoCG-10 was started in a directory that is NO repository: it has no branches,
-# which is an absence and not a read that failed.
-mkdir -p "$CG_EST/plain"
-cg_lane repoCG-10 "$CG_EST/plain"
-cg_row() { grep "^| \`$1\`" "$LANES"; }
-cg_last() { tail -n 1 "$CG_LOGD/$1.md"; }
-
-# ------------------------------------- lane-worktrees add: made AND recorded
-
-CG_W1="$CG_ROOT/repoCG-2/w1"
-run "$CG_LW" add repoCG-2 w1 --dry-run
-is    "lane-worktrees add --dry-run exits 0" "$rc" 0
-is    "…printing the path the tree WOULD have, under the lane's own root" "$out" "$CG_W1"
-is    "…and makes nothing" "$( [ -e "$CG_W1" ] && echo made || echo none )" none
-
-run "$CG_LW" add repoCG-2 w1
-is    "lane-worktrees add makes the lane's worktree" "$rc" 0
-is    "…printing its path on stdout" "$out" "$CG_W1"
-is    "…as a git worktree of the lane's checkout" "$(git -C "$CG_DIR" worktree list --porcelain | grep -c '/repoCG-2/w1$' || :)" 1
-is    "…on a branch named for the slice" "$(git -C "$CG_W1" symbolic-ref -q --short HEAD)" w1
-run "$CG_E" lane-trees repoCG-2
-is    "…and RECORDS it in the lane's #97 inventory in the same act" "$rc" 0
-is    "…by its path" "$(printf '%s\n' "$out" | awk -F'\037' 'NR == 1 { print $2 }')" "$CG_W1"
-is    "…its branch" "$(printf '%s\n' "$out" | awk -F'\037' 'NR == 1 { print $3 }')" w1
-is    "…and its checkout" "$(printf '%s\n' "$out" | awk -F'\037' 'NR == 1 { print $10 }')" "$CG_DIR"
-
-CG_W2="$CG_ROOT/repoCG-2/w2"
-run "$CG_LW" add repoCG-2 w2 --branch feat/cg-w2 --from origin/main
-is    "add --branch --from makes a new branch from that start" "$rc" 0
-is    "…named as asked" "$(git -C "$CG_W2" symbolic-ref -q --short HEAD)" feat/cg-w2
-is    "…and TRACKING NOTHING, so a bare git push never aims a writer's commits at main" \
-      "$(git -C "$CG_W2" rev-parse --abbrev-ref '@{u}' >/dev/null 2>&1 && echo tracks || echo none)" none
-is    "…and recorded too" "$("$CG_E" lane-trees repoCG-2 2>/dev/null | awk -F'\037' -v p="$CG_W2" '$2 == p { n++ } END { print n + 0 }')" 1
-
-run "$CG_LW" add repoCG-2 w1
-is    "add refuses a path that is already there" "$rc" 2
-has   "…naming the record a tree already there takes instead" "$err" "set-lane-tree repoCG-2"
-run "$CG_LW" add repoCG-9 w1
-is    "add refuses a lane that records no directory" "$rc" 2
-is    "…and makes nothing" "$( [ -e "$CG_ROOT/repoCG-9" ] && echo made || echo none )" none
-run "$CG_LW" add repoCG-2 'not/one'
-is    "a slice that is not one path component is usage" "$rc" 64
-has   "…naming what a slice is" "$err" "is not a slice name"
-run "$CG_LW" add repoCG-2 w3 --porcelain
-is    "…and so is a word that is the sweep's" "$rc" 64
-has   "…saying whose word it is" "$err" "belong to sweep, not to add"
-run "$CG_LW" add repoCG-2 w3 --push-untracked
-is    "…--push-untracked, #174's word for the sweep, included" "$rc" 64
-has   "…named as the sweep's" "$err" "--push-untracked belong to sweep, not to add"
-
-if [ "$(id -u)" = 0 ]; then
-  skip "a record that fails takes the fresh tree back out" "root writes through a read-only directory, so the record cannot be made to fail here"
-else
-  mkdir -p "$CG_STATE/repoCG-4/trees"
-  chmod 555 "$CG_STATE/repoCG-4/trees"
-  run "$CG_LW" add repoCG-4 w9
-  chmod 755 "$CG_STATE/repoCG-4/trees"
-  is    "a record that fails after the tree is made refuses" "$rc" 2
-  has   "…saying the fresh tree was taken back out" "$err" "removed again"
-  is    "…so no unrecorded tree is left" "$( [ -e "$CG_ROOT/repoCG-4/w9" ] && echo left || echo none )" none
-  is    "…and no branch the act made" "$(git -C "$CG_DIR" rev-parse -q --verify refs/heads/w9 >/dev/null 2>&1 && echo left || echo none)" none
-fi
-
-# A `worktree add` THAT FAILS AFTER MAKING THE TREE (Copilot round 1 on #175): a
-# failing `post-checkout` hook runs after the checkout, and git returns its
-# status with the tree registered and the branch made. Both are taken back.
-printf '#!/bin/sh\nexit 1\n' > "$CG_DIR/.git/hooks/post-checkout"
-chmod +x "$CG_DIR/.git/hooks/post-checkout"
-run "$CG_LW" add repoCG-12 w8
-rm -f "$CG_DIR/.git/hooks/post-checkout"
-is    "a worktree add that fails after making the tree refuses" "$rc" 2
-has   "…saying what failed" "$err" "git worktree add failed"
-has   "…and that the fresh tree was taken back out" "$err" "removed again"
-is    "…so no unrecorded tree is left on disk" "$( [ -e "$CG_ROOT/repoCG-12/w8" ] && echo left || echo none )" none
-is    "…or registered" "$(git -C "$CG_DIR" worktree list --porcelain | grep -c '/repoCG-12/w8$' || :)" 0
-is    "…and no branch the act made" "$(git -C "$CG_DIR" rev-parse -q --verify refs/heads/w8 >/dev/null 2>&1 && echo left || echo none)" none
-
-# AND A COMMIT MADE ON THE NEW BRANCH MEANWHILE IS NEVER MADE UNREACHABLE
-# (Copilot round 2 on #175): the hook commits, then fails; the take-back removes
-# the clean tree and KEEPS the branch, which now holds that commit.
-printf '#!/bin/sh\ngit commit -q --allow-empty -m "made by the hook"\nexit 1\n' > "$CG_DIR/.git/hooks/post-checkout"
-chmod +x "$CG_DIR/.git/hooks/post-checkout"
-run "$CG_LW" add repoCG-12 w7
-rm -f "$CG_DIR/.git/hooks/post-checkout"
-is    "a worktree add whose hook committed and failed leaves something, so it is exit 1" "$rc" 1
-has   "…naming the branch it kept" "$err" "branch w7, which this act made at"
-is    "…which still holds the hook's commit" "$(git -C "$CG_DIR" log -1 --format=%s refs/heads/w7 2>/dev/null)" "made by the hook"
-is    "…while the clean tree itself was taken back out" "$( [ -e "$CG_ROOT/repoCG-12/w7" ] && echo left || echo none )" none
-git -C "$CG_DIR" branch -q -D w7 2>/dev/null || :
-
-# ---------------------------------------------- lane-end: the gate passes
-
-# OTHER LANES' TREES IN THE SAME CHECKOUT ARE NOT THIS LANE'S: repoCG-2's two
-# are registered in repoCG's checkout, and repoCG-1 ends past them.
-run "$END" repoCG-1
-is    "a lane with nothing of its own on disk ends as it always has" "$rc" 0
-has   "…saying the gate asked" "$err" "close-out gate: nothing of lane repoCG-1's is left on disk"
-has   "…and the closing phrase is the ordinary one" "$(cg_row repoCG-1)" "window closing; NOTHING IN FLIGHT"
-hasnt "…with no door taken" "$(cg_row repoCG-1)" "inventory-only"
-
-run "$END" repoCG-10
-is    "a lane started outside any repository ends: no repository is no branch, not a read that failed" "$rc" 0
-hasnt "…and its gate names no branch it could not read" "$err" "the branches could not be read"
-
-# A RECORDED DIRECTORY GIT CANNOT READ IS NOT ONE THAT HOLDS NO REPOSITORY (lane
-# 2's and lane 3's reviews of #175 at 49bfa40). git answers "not a git
-# repository" for a `.git` it cannot use as well as for none, so only a
-# directory with NO `.git` entry of its own is an absence; any other is #170
-# G5's failed read, and the gate refuses it.
-if [ "$(id -u)" = 0 ]; then
-  skip "a lane checkout whose .git is mode 000 refuses" "root reads a mode-000 directory"
-else
-  git clone -q "$CG_ORIGIN" "$CG_EST/cg14" >/dev/null 2>&1
-  git -C "$CG_EST/cg14" config user.email "test@example.invalid"
-  git -C "$CG_EST/cg14" config user.name "lane helper tests"
-  git -C "$CG_EST/cg14" checkout -q -b cg14-work
-  git -C "$CG_EST/cg14" commit -q --allow-empty -m "lane fourteen's own work
-
-Lane: repoCG-14"
-  cg_lane repoCG-14 "$CG_EST/cg14"
-  chmod 000 "$CG_EST/cg14/.git"
-  run "$CG_LW" sweep repoCG-14 --branches --include-scratch --include-caches --dry-run --porcelain
-  cg14_rc="$rc"; cg14_out="$out"
-  run "$END" repoCG-14 --dry-run
-  chmod 755 "$CG_EST/cg14/.git"
-  is    "a lane checkout whose .git is mode 000, an unpublished branch of the lane's in it, is a read that failed: the sweep refuses (2)" "$cg14_rc" 2
-  has   "…naming the registrations it could not read" "$cg14_out" "the worktree registrations of $CG_EST/cg14 could not be read"
-  is    "…and lane-end --dry-run refuses on it" "$rc" 2
-  has   "…relaying that reason" "$err" "the worktree registrations of $CG_EST/cg14 could not be read"
-fi
-mkdir -p "$CG_EST/cg15"
-printf 'gitdir: %s\n' "$SANDBOX/cg15-nowhere/.git" > "$CG_EST/cg15/.git"
-printf 'notes\n' > "$CG_EST/cg15/notes.txt"
-cg_lane repoCG-15 "$CG_EST/cg15"
-run "$CG_LW" sweep repoCG-15 --branches --include-scratch --include-caches --dry-run --porcelain
-is    "a lane directory whose .git file points nowhere refuses as well (2)" "$rc" 2
-has   "…for the same reason" "$out" "the worktree registrations of $CG_EST/cg15 could not be read"
-mkdir -p "$CG_EST/cg16"
-printf 'notes\n' > "$CG_EST/cg16/notes.txt"
-cg_lane repoCG-16 "$CG_EST/cg16"
-run "$CG_LW" sweep repoCG-16 --branches --include-scratch --include-caches --dry-run --porcelain
-is    "while a directory with no .git entry at all holds no repository: the sweep answers 0" "$rc" 0
-hasnt "…and says no registration read failed" "$out" "could not be read"
-
-# ----------------------------------- lane-end: the gate refuses, and names it
-
-printf 'SECRET=1\n' > "$CG_W1/.env"
-printf 'work\n' > "$CG_W2/scratch.txt"
-mkdir -p "$CG_ROOT/repoCG-2/notes-scratch"
-printf 'notes\n' > "$CG_ROOT/repoCG-2/notes-scratch/n.md"
-cg2_row="$(cg_row repoCG-2)"; cg2_log="$(cksum < "$CG_LOGD/repoCG-2.md")"
-run "$END" repoCG-2
-is    "lane-end REFUSES a lane whose trees are still on disk (the sweep answers 3)" "$rc" 2
-has   "…saying it is not ended" "$err" "lane repoCG-2 is NOT ended"
-has   "…naming the first tree" "$err" "$CG_W1"
-has   "…and the second" "$err" "$CG_W2"
-has   "…reading each with git status --ignored, so an ignored .env is named and the tree is not called clean" "$err" "1 ignored (.env)"
-has   "…and untracked work" "$err" "1 untracked"
-has   "…naming the lane's scratch" "$err" "$CG_ROOT/repoCG-2/notes-scratch"
-has   "…the exact table that lists them" "$err" "lane-worktrees sweep repoCG-2 --branches --include-scratch --include-caches"
-has   "…the act that retires them" "$err" "--include-caches --yes"
-has   "…and what that act removes, now that --yes is on" "$err" "removes only what is on origin or in a bundle"
-has   "…and the one door past it" "$err" "lane-end repoCG-2 --inventory-only"
-is    "…and writes NOTHING: the row is as it was" "$(cg_row repoCG-2)" "$cg2_row"
-is    "…and the lane's log is as it was" "$(cksum < "$CG_LOGD/repoCG-2.md")" "$cg2_log"
-
-run "$END" repoCG-2 --dry-run
-is    "the gate is asked on a dry run too" "$rc" 2
-
-run "$END" repoCG-2 --sweep
-is    "--sweep is refused" "$rc" 2
-has   "…by name, as an act that is not built" "$err" "--sweep is not built"
-
-run "$END" repoCG-2 --inventory-only
-is    "--inventory-only ends the lane past the gate" "$rc" 0
-has   "…and the row says the door was taken" "$(cg_row repoCG-2)" "ENDED WITH --inventory-only"
-has   "…and what the gate found" "$(cg_row repoCG-2)" "sweep exit 3"
-has   "…while the lane's own ENDED line LOGS the reason it was let past" "$(cg_last repoCG-2)" "inventory-only: the close-out gate (sweep exit 3) found 2 tree(s) and 1 scratch dir(s) left"
-is    "…it touches nothing on disk: the tree is still there" "$( [ -f "$CG_W1/.env" ] && echo there || echo gone )" there
-is    "…and still in the lane's inventory" "$("$CG_E" lane-trees repoCG-2 2>/dev/null | awk -F'\037' -v p="$CG_W1" '$2 == p { n++ } END { print n + 0 }')" 1
-
-# --------------------------------------- the sweep refusing is a refusal too
-
-git -C "$CG_DIR" worktree add -q -b cg3 "$CG_ROOT/repoCG-3/hand" >/dev/null 2>&1
-run "$END" repoCG-3
-is    "a lane the SWEEP refuses (2: trees and no #97 snapshot) is not ended" "$rc" 2
-has   "…relaying the sweep's own reason" "$err" "no #97 snapshot"
-has   "…naming the tree it would not judge" "$err" "$CG_ROOT/repoCG-3/hand"
-hasnt "…and offering no --yes the sweep would refuse in the same words" "$err" "--yes"
-
-# ------------------------- residue: what the sweep's rows never reach, counted
-
-mkdir -p "$CG_ROOT/repoCG-5/leftover"
-printf 'kept by nobody\n' > "$CG_ROOT/repoCG-5/leftover/notes.txt"
-run "$END" repoCG-5
-is    "residue under the lane's own root refuses although the sweep answered 0" "$rc" 2
-has   "…named as residue" "$err" "residue  $CG_ROOT/repoCG-5/leftover"
-has   "…with the place such things go instead" "$err" "openRepoTools/lanes/repoCG-5/scratch/"
-rm -rf "$CG_ROOT/repoCG-5"
-run "$END" repoCG-5
-is    "…and once it is gone the lane ends" "$rc" 0
-
-mkdir -p "$CG_ROOT/repoCG-8/node_modules/pkg"
-printf 'x\n' > "$CG_ROOT/repoCG-8/node_modules/pkg/i.js"
-run "$END" repoCG-8
-is    "a cache under the lane's own root refuses too" "$rc" 2
-has   "…named as a cache" "$err" "cache    remove  $CG_ROOT/repoCG-8/node_modules"
-
-# A ROOT NOBODY MAY LIST IS NOT AN EMPTY ONE (Copilot round 1 on #175).
-if [ "$(id -u)" = 0 ]; then
-  skip "a lane root that cannot be listed is the gate unread" "root lists a directory whatever its mode"
-else
-  mkdir -p "$CG_ROOT/repoCG-11/kept"
-  chmod 000 "$CG_ROOT/repoCG-11"
-  cg11_row="$(cg_row repoCG-11)"
-  run "$END" repoCG-11
-  is    "a lane root that cannot be listed is the gate unread (1), never an empty root" "$rc" 1
-  has   "…saying so" "$err" "could not be listed"
-  is    "…and nothing is written" "$(cg_row repoCG-11)" "$cg11_row"
-  # …AND IT IS 1 WHATEVER THE SWEEP ANSWERED (Copilot round 2 on #175): here the
-  # sweep answers 3, for an unpublished branch of the lane's own.
-  git -C "$CG_DIR" branch -q cg11-old main
-  git -C "$CG_DIR" worktree add -q "$SANDBOX/cg11-tmp" cg11-old >/dev/null 2>&1
-  git -C "$SANDBOX/cg11-tmp" commit -q --allow-empty -m "lane eleven's own work
-
-Lane: repoCG-11"
-  git -C "$CG_DIR" worktree remove "$SANDBOX/cg11-tmp" >/dev/null 2>&1
-  run "$END" repoCG-11
-  chmod 755 "$CG_ROOT/repoCG-11"
-  is    "…and still 1 where the sweep answered 3: an unread root is the environment on every answer" "$rc" 1
-  has   "…naming the branch the sweep did find as well" "$err" "cg11-old"
-  git -C "$CG_DIR" branch -q -D cg11-old 2>/dev/null || :
-fi
-
-# A STANDALONE CLONE UNDER THE LANE'S OWN ROOT IS NOT "NOTHING LEFT" (S1 of the
-# review of #175). The sweep keeps it FOREIGN — a lane creates worktrees, never
-# clones — and a FOREIGN row is counted for nobody, so it names nothing for the
-# residue read either: the clone, unpushed commit and all, is residue.
-git clone -q "$CG_ORIGIN" "$CG_ROOT/repoCG-13/clone" >/dev/null 2>&1
-git -C "$CG_ROOT/repoCG-13/clone" config user.email "test@example.invalid"
-git -C "$CG_ROOT/repoCG-13/clone" config user.name "lane helper tests"
-printf 'thirteen\n' > "$CG_ROOT/repoCG-13/clone/thirteen.txt"
-git -C "$CG_ROOT/repoCG-13/clone" add thirteen.txt
-git -C "$CG_ROOT/repoCG-13/clone" commit -q -m "work in a clone, never pushed"
-cg13_row="$(cg_row repoCG-13)"
-run "$END" repoCG-13
-is    "a standalone clone with an unpushed commit under the lane's own root refuses although the sweep answered 0" "$rc" 2
-has   "…named as residue, because its FOREIGN row names nothing" "$err" "residue  $CG_ROOT/repoCG-13/clone"
-hasnt "…and never passed as nothing left on disk" "$err" "nothing of lane repoCG-13's is left on disk"
-is    "…and nothing is written: the row is as it was" "$(cg_row repoCG-13)" "$cg13_row"
-hasnt "…so it never says NOTHING IN FLIGHT" "$(cg_row repoCG-13)" "NOTHING IN FLIGHT"
-
-# --------------------------------- a branch of the lane's own, with no tree
-
-git -C "$CG_DIR" branch -q cg6-old main
-git -C "$CG_DIR" worktree add -q "$SANDBOX/cg6-tmp" cg6-old >/dev/null 2>&1
-printf 'six\n' > "$SANDBOX/cg6-tmp/six.txt"
-git -C "$SANDBOX/cg6-tmp" add six.txt
-git -C "$SANDBOX/cg6-tmp" commit -q -m "lane six's own work
-
-Lane: repoCG-6"
-git -C "$CG_DIR" worktree remove "$SANDBOX/cg6-tmp" >/dev/null 2>&1
-run "$END" repoCG-6
-is    "a local branch the lane made, unpublished and held by no tree, refuses" "$rc" 2
-has   "…naming the branch" "$err" "cg6-old"
-has   "…and saying --yes leaves a listed branch to a person as well" "$err" "left by --yes as well"
-
-# ------------------------------- a gate nobody could read is never a pass
-
-printf '#!/usr/bin/env bash\nexit 7\n' > "$SANDBOX/cg-broken-sweep"
-chmod +x "$SANDBOX/cg-broken-sweep"
-cg7_row="$(cg_row repoCG-7)"
-run env LANE_WORKTREES="$SANDBOX/cg-broken-sweep" "$END" repoCG-7
-is    "a sweep exit that is none of 0, 3 and 2 refuses as the environment (1)" "$rc" 1
-has   "…saying the gate could not be read" "$err" "could not be read"
-is    "…and writes nothing" "$(cg_row repoCG-7)" "$cg7_row"
-run env LANE_WORKTREES="$SANDBOX/cg-no-such-sweep" "$END" repoCG-7
-is    "no lane-worktrees at all is the same refusal" "$rc" 1
-run env LANE_WORKTREES="$SANDBOX/cg-broken-sweep" "$END" repoCG-7 --inventory-only
-is    "--inventory-only ends it past a gate nobody read" "$rc" 0
-has   "…and says so in the row" "$(cg_row repoCG-7)" "could not be read"
-
-# --------------------------------- the door belongs to a lane's ending only
-
-run "$END" repoCG-1 --retire 999999 --inventory-only
-is    "--inventory-only with a fork's --retire is refused" "$rc" 2
-has   "…by name" "$err" "--inventory-only is the door past a lane's close-out gate"
-run "$END" --retire-dormant repoCG --inventory-only
-is    "…and with the dormant sweep" "$rc" 2
-has   "…by name" "$err" "--inventory-only is the door past ONE lane's close-out gate"
-
-if [ -n "$cg_had_lsr" ]; then export LANES_LANE_STATE_ROOT="$cg_lsr"; else unset LANES_LANE_STATE_ROOT; fi
-
-# ------------------------------------------------------- nothing real touched
-#
-# The check is that the suite CREATED nothing here, which is not the same as
-# this directory being empty: a real `lanes/log/` carries real lanes' logs, and
-# asserting a count of zero would fail on the operator's own committed records
-# rather than on anything the suite did. So it counts only names the SUITE
-# could have written — the `repo[A-Z]…` fixtures every case uses — in the
-# operator's real workspace, read at $REAL_WS before $HOME was redirected. (An
-# earlier draft of this comment described a before/after list under a variable
-# `SRC_LOG_BEFORE`; no such variable was ever written, and the fixture-name
-# filter is what actually does the work.)
-is   "the suite never created a log outside the sandbox" \
-     "$(ls "$REAL_WS/lanes/log" 2>/dev/null | grep -c '^repo[A-Z]' || :)" 0
-is   "the suite never wrote the real register" \
-     "$(cat "$REAL_WS/lanes/LANES.md" 2>/dev/null | grep -c '^| `repo[A-Z]' || :)" 0
-# BOTH OF THEM READ A PIPE, and the second one did not until A9 Addendum 4
-# (R-A9-13, F3). `grep -c PATTERN FILE` on a file that is not there prints
-# NOTHING and exits 2, so with no `~/.agents/workspace.yaml` on the host
-# `$REAL_WS` is empty, the comparison was `""` against `0`, and this assertion
-# FAILED on every CI runner and every new person's machine — the one host
-# shape it was written to be harmless on. `grep -c` reading a PIPE always
-# prints a number, so `cat 2>/dev/null | grep -c` degrades to `0` where the
-# sibling above already did.
-#
-# NEVER VACUOUS, whatever this host has. The two above compare the operator's
-# own workspace with itself and degrade to a true statement about nothing on a
-# CI runner that has no workspace at all; this one asserts the positive — the
-# logs the suite DID create are inside the sandbox, under the workspace the
-# sandbox's own workspace.yaml names, and there is at least one of them.
-is   "…and every log it did create is inside the sandbox workspace" \
-     "$( [ "$(ls "$WIP/lanes/log" 2>/dev/null | grep -c .)" -gt 0 ] && echo yes || echo no )" "yes"
-
-# THE FIXTURE EVERY LIVENESS CASE ABOVE DEPENDS ON, ASSERTED LAST (A9 Addendum
-# 4, R-A9-11). A `sleep` that runs out of seconds before the suite runs out of
-# cases does not announce itself: it turns "a live holder …" into "no live
-# holder …" one case at a time, and 196 red lines say nothing about why. This
-# one line does. Red here and nowhere else means the bound at `$LIVE_SLEEP` is
-# what needs raising; red here beside two hundred others means it is why.
-is   "the liveness fixture was still running when the run ended" \
-     "$(kill -0 "$LIVE_PID" 2>/dev/null && printf alive || printf gone)" alive
-
-# THE SECTION CLOCK READS EVERY HEADING, asserted HERE, at the foot, and not
-# above the guards: it must run after the last section has opened, or a section
-# added where the next one naturally goes (just above `nothing real touched`)
-# would be counted in the file and not yet in the clock, and turn this red for
-# nothing. It is two readings, and it reads this file and its clock, not a
-# fixture, so the liveness assertion above is still the last one about the RUN.
-# opensoft/openRepoTools#77, step 1a. A heading printed with a bare `echo`
-# prints exactly as it always did and is NOT clocked, so its seconds would
-# silently join the section before it and the table below would blame the
-# wrong one. First, no heading is spelled with `echo` any more, at any indent
-# and in either quote. Second, by the last heading's start the clock holds one
-# row for each `section` heading in the file — the preamble's, plus every
-# heading's but the open one's — which also proves none of them sits in a
-# branch this run skipped. `grep -c` reads a FILE here, which always exists: it
-# prints `0` and exits 1 on no match, so the `|| :` only keeps the status quiet.
-sc_bare_re="^[[:space:]]*echo[[:space:]]+[\"']== "
-is    "every == heading in this suite goes through section, so each is clocked" \
-      "$(grep -cE "$sc_bare_re" "$SELF" || :)" 0
-is    "…and the clock holds one row per heading by the last heading's start" \
-      "$(printf '%s' "$SECTION_ROWS" | awk 'END { print NR + 0 }')" \
-      "$(grep -c '^section "== ' "$SELF" || :)"
-
-# THE TABLE OF opensoft/openRepoTools#77, step 1a: every section's wall time,
-# longest first, and the same table in the job's step summary. It is printed
-# HERE, above the rule, because the footer below must stay the LAST line on
-# stdout — the pytest wrapper looks for ` passed, 0 failed` in the transcript
-# and its failure message quotes the last line — and the teardown, which
-# happens after the footer by nature, is said on stderr by `cleanup`.
-section_report
-echo "----"
-if [ "$pending_n" != 0 ]; then
-  printf '%s PENDING — owed to a commit landing in another repository, not a failure:\n' "$pending_n"
-  printf '%s' "$pending_list"
-fi
-printf '%s passed, %s failed, %s skipped, %s pending\n' "$pass" "$fail" "$skipped" "$pending_n"
-[ "$fail" = 0 ] || exit 1
-exit 0
diff --git a/tests/test_lane_helpers_suite.py b/tests/test_lane_helpers_suite.py
deleted file mode 100644
index ad98b0e5..00000000
--- a/tests/test_lane_helpers_suite.py
+++ /dev/null
@@ -1,720 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The runner for `tests/test_lane_helpers.sh`, so that suite runs at all.
-
-A SUITE NOTHING RUNS IS NOT A SUITE. This repository's CI is pytest-only
-(`.github/workflows/tests.yml` runs `python3 -m pytest tests -q`, and
-`test_repo_hygiene.py` globs `tests/*.py`), so the 196 KB of bash that arrived
-at `tests/test_lane_helpers.sh` under lane-collision-protocol Amendment 9's
-move would otherwise run in NO job — which is act 3's obligation 6 in its own
-words. This file is the wrapper that obligation names.
-
-IT IS ONE TEST, NOT NINE HUNDRED, and the asymmetry is deliberate. The bash
-suite owns its own assertion vocabulary — `ok` / `FAIL` lines and a
-`N passed, M failed` footer — and re-expressing 897 of them as pytest cases
-would mean parsing that output into parametrized ids, which is a second
-implementation of the suite's own reporting and a second thing to keep right.
-What pytest needs to know is one bit: did every assertion pass? So this runs
-the file, and on failure prints the WHOLE transcript into the assertion
-message, which is what a person reading a red CI job actually needs. A PASS
-prints only the suite's own account of where its time went (`show_timings`,
-opensoft/openRepoTools#77), because a green job is where nobody reads the
-transcript and where that one account is wanted.
-
-IT TOUCHES NOTHING REAL. The suite redirects `$HOME`, `$TMPDIR`,
-`$AGENT_PROTOCOL_ROOT` and `$OPENREPOTOOLS_BIN_DIR` into a `mktemp -d` sandbox
-of its own, seeds a bare repository plus two clones there, fakes `tmux` and
-`claude` on `PATH`, and exports `LANES_NO_GITHUB=1` so no case can reach
-GitHub. Its own last assertions are the ones that check that — see the foot of
-that file.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import re
-import shutil
-import signal
-import subprocess
-import sys
-import threading
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, ROOTS, WINDOWS_SKIP
-
-SUITE = REPO / "tests" / "test_lane_helpers.sh"
-
-#: Generous, and not a performance claim: the suite runs real `git` against
-#: real repositories several hundred times and spawns a real `sleep` for the
-#: liveness cases. A CI runner under load is slower than a workstation, and a
-#: timeout that fires there reads as a broken suite rather than a slow one.
-#:
-#: 900 -> 2400 on 2026-09-13 (A9 Addendum 4, R-A9-11). This is the round that
-#: made the suite RUN on macOS rather than fail in its first hundred
-#: assertions, and running is slower than failing: at `9000e86` the job took
-#: 1033 s to reach 507 passed / 447 failed, and at `c405eb4`, with those 447
-#: now doing real work, 900 s was not enough to finish — the run died as a
-#: TimeoutExpired rather than a red assertion, which is the least readable
-#: failure this file can produce. Measured for comparison: 229 s under pytest
-#: on the Linux container this was written on. The bound still exists for the
-#: thing it was written for — a helper that hangs on a lock or a network call
-#: must not hold a runner for six hours — it is just no longer tighter than
-#: the slowest platform this suite is required to pass on.
-#:
-#: 2400 -> 3600 on 2026-09-15, AND FOR THE SAME REASON ONE ROUND LATER: the
-#: suite crossed it. Measured, `b9018c1` (#45 with Amendment 18 Addendum 1's
-#: section merged beside Amendment 17's, 2102 cases -> 2345):
-#:
-#:     tests-macos   03:18:03 -> 04:03:37, `1 failed, 654 passed in 2722.13s`
-#:                   and the one failure is this wrapper —
-#:                   `subprocess.TimeoutExpired: … timed out after 2400 seconds`
-#:     tests         16 min 47 s, green, the same 655 cases
-#:
-#: EVERY OTHER CASE IN THAT macOS JOB PASSED. What the bound caught was the
-#: suite being long on the slowest platform it must pass on, not a helper
-#: hanging — and a TimeoutExpired says nothing about which assertion was in
-#: flight, which is exactly the unreadable failure the paragraph above warns
-#: against. It is one number rather than a per-platform pair because a bound
-#: that is different where a person is not looking is a bound nobody can
-#: reason about: a loaded WORKSTATION is slow too, and a legitimate run of this
-#: same tree took 2129 s here with six sibling suites building beside it.
-#:
-#: 3600 -> 5400 on 2026-10-03, AND FOR THE SAME REASON A THIRD TIME: #93
-#: (Amendment 19, ~3016 cases against main's ~2795) crossed it on darwin.
-#: Measured, both on that PR's head, both the same single failure —
-#: `subprocess.TimeoutExpired: … timed out after 3600 seconds` — so neither
-#: run says which assertion was in flight:
-#:
-#:     tests-macos   `08dad90`  `1 failed, 680 passed in 3961.39s`
-#:     tests-macos   `968ab5e`  `1 failed, 693 passed in 3927.56s`
-#:     tests         `968ab5e`  green, `694 passed in 2466.84s`
-#:
-#: and on main at `69bf48d`, where the suite still FINISHED, the job's pytest
-#: took 3741.66 s in all: it was already within minutes of this bound. Since
-#: #119 `tests-macos` is the landing gate on the `ready` label, so a bound the
-#: suite cannot finish inside is a gate nothing can pass and nobody can read.
-#:
-#: THE HONEST FIX IS THE SUITE'S DURATION AND NOT THIS NUMBER — one bash file
-#: that runs real `git` several thousand times, serially, for 45 minutes — and
-#: it is opensoft/openRepoTools#77. This is the cap moving out of that work's
-#: way, not a decision that 45 minutes is fine.
-#:
-#: The job itself has no `timeout-minutes` in `.github/workflows/tests.yml`, so
-#: nothing under it bites before this does; GitHub's own default is 360 min.
-TIMEOUT_SECONDS = 5400
-
-
-#: THE SUITE'S LIVENESS FIXTURE MUST OUTLIVE THE BOUND ABOVE, and at `758a536`
-#: it did not. `tests/test_lane_helpers.sh` starts one `sleep <n> & LIVE_PID=$!`
-#: and every "a live holder …" case in that file — on macOS, where there is no
-#: `/proc`, ALL of them — is `kill -0` on that pid. At `sleep 3000` against a
-#: 3600 s timeout the wrapper was still waiting on a run whose evidence had
-#: already expired 600 s earlier, and the suite answered "no live holder" for
-#: cases that had a live holder: four of tests-macos' ten red lines at that
-#: commit, in the last 5% of the file, with nothing in the output saying why.
-#:
-#: A comment in each file saying "keep these two in step" is what was there
-#: before, and it did not survive TIMEOUT_SECONDS being raised from 2400. This
-#: reads the bash line and REFUSES the pair, so raising one without the other
-#: is red in seconds on every platform rather than red in an hour on one.
-#:
-#: AND SINCE #83 THE FIXTURE MAY BE DERIVED RATHER THAN WRITTEN: `sleep
-#: "$LIVE_SLEEP"`, where `LIVE_SLEEP` is this file's own `TIMEOUT_SECONDS`
-#: read back out of it by `sed`, plus a margin. That form is accepted only where
-#: the same pattern, applied to THIS file, finds the number this module runs
-#: with — so the pair is still proved, now by the read the suite makes.
-_SED_READ = r"s/^TIMEOUT_SECONDS = \([0-9][0-9]*\).*/\1/p"
-
-
-def test_the_liveness_fixture_outlives_the_suite_timeout():
-    text = SUITE.read_text(encoding="utf-8")
-    hit = [ln for ln in text.splitlines() if "LIVE_PID=$!" in ln]
-    assert len(hit) == 1, (
-        "expected exactly one liveness fixture in tests/test_lane_helpers.sh, "
-        f"found {len(hit)}: {hit}")
-    literal = re.search(r"\bsleep\s+(\d+)\s*&\s*LIVE_PID=\$!", hit[0])
-    if literal:
-        bound = int(literal.group(1))
-    else:
-        assert re.search(r'\bsleep\s+"\$LIVE_SLEEP"\s*&\s*LIVE_PID=\$!', hit[0]), (
-            f"the liveness fixture is neither a bounded sleep nor the derived one: {hit[0]!r}")
-        margin = re.search(r"^LIVE_SLEEP=\$\(\(\s*LIVE_BOUND\s*\+\s*(\d+)\s*\)\)", text, re.M)
-        assert margin, "LIVE_SLEEP is no longer LIVE_BOUND plus a fixed margin"
-        assert _SED_READ in text and "test_lane_helpers_suite.py" in text, (
-            "LIVE_BOUND is no longer read out of this file's TIMEOUT_SECONDS")
-        own = re.search(r"^TIMEOUT_SECONDS = ([0-9][0-9]*)",
-                        Path(__file__).read_text(encoding="utf-8"), re.M)
-        assert own and int(own.group(1)) == TIMEOUT_SECONDS, (
-            "the suite's sed read of TIMEOUT_SECONDS would not find the number "
-            "this module runs with, so its fixture would fall back to a default")
-        bound = TIMEOUT_SECONDS + int(margin.group(1))
-    assert bound > TIMEOUT_SECONDS, (
-        f"the liveness fixture is bounded at {bound}s while this wrapper lets "
-        f"the suite run for TIMEOUT_SECONDS={TIMEOUT_SECONDS}s, so the suite is "
-        "licensed to outlive its own evidence: every liveness case after "
-        f"{bound}s would read 'no live holder' and say nothing about why. "
-        "Raise the sleep in tests/test_lane_helpers.sh above this bound.")
-
-
-#: How long the suite's process group gets to answer a TERM - its own trap
-#: removes the sandbox it made - before it is KILLed.
-#:
-#: FIVE, AND NOT THE TEN `tests/run.sh` GIVES ITS OWN GROUP. run.sh's
-#: `stop_group` polls fifty times at 0.2 s and each poll runs `ps`, so it waits
-#: about 10.7 s before it KILLs pytest. This stop is TERM, this wait, KILL and a
-#: reap, and all of it has to finish well inside that: a stop that takes as long
-#: as run.sh's gets pytest killed in the middle of it, with the suite's group
-#: left running - which is the orphan this exists to prevent.
-GROUP_TERM_GRACE = 5
-
-#: How often `run_in_own_group` looks up from waiting on the suite to see
-#: whether a TERM or a hangup has arrived.
-_SIGNAL_POLL = 0.5
-
-
-def stop_group(child) -> None:
-    """Stop the process group `child` leads: TERM, up to GROUP_TERM_GRACE
-    seconds for its leader to answer it, then KILL for whatever is left, and
-    reap the leader. A group that is already gone is not an error.
-
-    THE KILL IS IN A `finally`, AND CTRL-C IS IGNORED UNTIL IT HAS BEEN SENT.
-    A second Ctrl-C during the grace used to leave the wait with a
-    KeyboardInterrupt, skip the KILL, and orphan a suite that was ignoring
-    TERM. The stop is bounded, so ignoring a person's Ctrl-C for it costs at
-    most GROUP_TERM_GRACE seconds."""
-    on_main = threading.current_thread() is threading.main_thread()
-    held = signal.signal(signal.SIGINT, signal.SIG_IGN) if on_main else None
-    try:
-        with contextlib.suppress(ProcessLookupError, PermissionError):
-            os.killpg(child.pid, signal.SIGTERM)
-        with contextlib.suppress(subprocess.TimeoutExpired):
-            child.wait(timeout=GROUP_TERM_GRACE)
-    finally:
-        with contextlib.suppress(ProcessLookupError, PermissionError):
-            os.killpg(child.pid, signal.SIGKILL)
-        child.wait()
-        if held is not None:
-            signal.signal(signal.SIGINT, held)
-
-
-def run_in_own_group(argv, *, timeout, **popen_kwargs):
-    """`subprocess.run(argv, capture_output=True, timeout=timeout)` with the
-    command in a session of its own, which is stopped whenever this does not
-    return normally.
-
-    THE SUITE RUNS IN A SESSION OF ITS OWN (opensoft/openRepoTools#142, item
-    3). `subprocess.run(timeout=)` kills only the bash it started, and the
-    suite's `EXIT` trap does not run on that SIGKILL, so the liveness
-    fixture's `sleep` - longer than TIMEOUT_SECONDS on purpose - and every
-    later fixture's were orphaned for up to 70 minutes. The child leads its
-    session, so its pid is its group's id, and the group is what `stop_group`
-    stops: TERM first, so the suite's own TERM trap removes its sandbox.
-
-    A SESSION OF ITS OWN IS NOT THE GROUP `tests/run.sh` STOPS, NOR THE
-    TERMINAL'S. A TERM to that group, a hangup and a Ctrl-C now reach THIS
-    process and no longer reach the suite. pytest has no handler for the first
-    two, so one is installed here for as long as this waits - only where the
-    disposition is still the default, so a `nohup`'d run goes on ignoring a
-    hangup. The handler only NOTES the signal, and the wait is made in slices
-    of _SIGNAL_POLL that look for it: a handler that raised would raise inside
-    `Popen()` as well, after the fork and before `child` is bound, and leave
-    the suite with nobody to stop it. A noted signal stops the group, and then
-    the signal is sent to this process again with its default action restored,
-    so it ends as it would have had nothing been handling it. The timeout and
-    a KeyboardInterrupt stop the group too.
-
-    WHAT THIS DOES NOT REACH: the pty driver's children (`LANE_PTY` in the
-    suite) are session leaders of their own (`pty.fork` runs `setsid`), so they
-    are outside the group; each is bounded by that driver's own silence limit.
-
-    `errors="replace"`, because the thing the wrapper below exists to print is
-    the TRANSCRIPT, and a decode that raises loses all of it. The suite renders
-    its own failures with bash substrings for that reason (R-A9-11), so a
-    stray byte here should be impossible - and if one ever gets through, a
-    `\\ufffd` in one line is a readable result where `UnicodeDecodeError` is
-    none at all. Measured: at `dcf1027` one truncated em dash cost the whole
-    998-line transcript on the macOS job.
-    """
-    pending = []   # the TERM or HUP numbers that arrived, oldest first
-    handled = []
-
-    def note(signum, _frame):
-        pending.append(signum)
-
-    try:
-        if threading.current_thread() is threading.main_thread():
-            for signum in (signal.SIGTERM, signal.SIGHUP):
-                if signal.getsignal(signum) == signal.SIG_DFL:
-                    signal.signal(signum, note)
-                    handled.append(signum)
-        with subprocess.Popen(argv, stdout=subprocess.PIPE,
-                              stderr=subprocess.PIPE, encoding="utf-8",
-                              errors="replace", start_new_session=True,
-                              **popen_kwargs) as child:
-            try:
-                deadline = time.monotonic() + timeout
-                while not pending:
-                    left = deadline - time.monotonic()
-                    try:
-                        stdout, stderr = child.communicate(
-                            timeout=max(min(_SIGNAL_POLL, left), 0))
-                    except subprocess.TimeoutExpired as expired:
-                        if left > _SIGNAL_POLL:
-                            continue
-                        # The bound that was passed, not the last slice's: a
-                        # CI log reads "timed out after 5400 seconds".
-                        raise subprocess.TimeoutExpired(
-                            child.args, timeout, output=expired.output,
-                            stderr=expired.stderr) from None
-                    break
-            except BaseException:
-                stop_group(child)
-                raise
-            if pending:   # also a signal that came as the suite finished
-                stop_group(child)
-        if pending:
-            raise SystemExit(128 + pending[0])   # the `finally` sends the signal itself
-        return subprocess.CompletedProcess(child.args, child.returncode,
-                                           stdout, stderr)
-    finally:
-        for signum in handled:
-            signal.signal(signum, signal.SIG_DFL)
-        if pending:
-            os.kill(os.getpid(), pending[0])
-
-
-#: WHAT THE SUITE SAYS ABOUT ITS OWN CLOCK (opensoft/openRepoTools#77, step 1a
-#: put it in the suite; step 1b is this file carrying it out). The two strings
-#: are the ones `tests/test_lane_helpers.sh` prints, and
-#: `test_the_wrapper_looks_for_what_the_suite_prints` reads that file to hold
-#: them to it: the table's first line on STDOUT, whose rows follow it up to the
-#: rule that precedes the footer, and the teardown line on STDERR, said by the
-#: exit trap after the footer by nature.
-TIMING_HEADER = "wall time per section, longest first"
-TEARDOWN_PREFIX = "teardown: rm -rf of the sandbox"
-
-#: A row of that table: `%6s s  %3s%%  <heading>`. The seconds may be NEGATIVE:
-#: they are differences of bash's `SECONDS`, which a clock step can send
-#: backwards, and a row the pattern did not know would end the table there and
-#: lose every row after it, the whole-run row among them.
-_TIMING_ROW = re.compile(r"^\s*-?\d+ s\s")
-
-
-def suite_timings(stdout: str, stderr: str) -> tuple[list[str], list[str]]:
-    """The suite's timing table and its teardown line, each as lines, or as an
-    empty list where the suite printed none. Reads text only and cannot fail:
-    what to do about a missing one is `show_timings`' to say."""
-    table: list[str] = []
-    lines = stdout.splitlines()
-    for at, line in enumerate(lines):
-        if line.startswith(TIMING_HEADER):
-            table = [line]
-            for row in lines[at + 1:]:
-                if not _TIMING_ROW.match(row):
-                    break
-                table.append(row)
-            break
-    teardown = [ln for ln in stderr.splitlines() if ln.startswith(TEARDOWN_PREFIX)]
-    return table, teardown
-
-
-#: HOW `show_timings` SPEAKS PAST PYTEST'S CAPTURE: a context manager that
-#: suspends it. It is `capsys.disabled` while one of THIS module's tests runs,
-#: put there by the fixture below, and a no-op anywhere else.
-_past_capture = contextlib.nullcontext
-
-
-@pytest.fixture(autouse=True)
-def _speak_past_capture(request, monkeypatch):
-    """Give `show_timings` the one fixture it needs WITHOUT A PARAMETER ON THE
-    TEST. `tests/test_lane_helpers_suite_timeout.py` calls
-    `test_the_lane_helper_suite_passes()` itself, with no arguments, at six call
-    sites, so that the call site and not a copy of it is what it proves; a
-    `capsys` parameter would make every one a TypeError. Called from there the
-    fixture is not in play (it is this module's, and autouse only reaches this
-    module's tests), `_past_capture` stays a no-op, and the block goes into the
-    capture a passing test discards: nothing there reads it.
-
-    `capsys` IS ASKED FOR, NOT REQUIRED. Under `-p no:capture` the fixture does
-    not exist, and a parameter named `capsys` on an AUTOUSE fixture would make
-    every test in this file, the liveness test among them, an ERROR for it.
-    Nothing captures there, so nothing needs suspending, and the no-op serves.
-    Only pytest's own `FixtureLookupError` is let go: a wider clause would read
-    a fault of some other kind as "no capture plugin" and hide it."""
-    try:
-        capsys = request.getfixturevalue("capsys")
-    except pytest.FixtureLookupError:   # the capture plugin is off
-        return
-    monkeypatch.setitem(globals(), "_past_capture", capsys.disabled)
-
-
-def show_timings(proc) -> None:
-    """Print a PASSING suite's timings to pytest's real output.
-
-    WHY THIS EXISTS (opensoft/openRepoTools#77). A passing run's stdout and
-    stderr were both captured here and dropped, so the numbers step 1a added
-    reached no log `gh run view --log` returns, and a step summary only a
-    person signed in to the web UI can open.
-
-    `capsys.disabled()` AND NOT A PRINT: pytest captures at the file
-    descriptor, so `print` and even `sys.__stdout__` land in the capture
-    buffer, which a passing test throws away. The fixture is the supported way
-    to speak past it, and it keeps the data inside this file. A
-    `pytest_terminal_summary` hook in `conftest.py` (there is one, for the test
-    roots) would print at the foot of the log instead, but it needs this test to
-    leave the numbers somewhere for the hook to find, in a file every other
-    test shares. What the fixture costs is the block's place: it lands in
-    `-q`'s row of dots, at the moment the test passes, so it opens and closes
-    with a newline.
-
-    A MISSING TABLE OR TEARDOWN LINE IS SAID, AND NEVER FAILS THE RUN: a suite
-    that stopped printing its clock is a regression `gh run view` would
-    otherwise hide for ever, and a timing table is not a reason to turn a green
-    run red. THE CALLER PRINTS ONLY AFTER ITS ASSERTIONS HAVE PASSED, so a
-    failing run says its transcript once, in the assertion message, and not
-    again here.
-
-    THE SAME RULE MAKES THE WRITE ITSELF SAFE. The suite's headings carry em
-    dashes, and a stdout that cannot spell one (`PYTHONIOENCODING=ascii`, a
-    stray `LANG`) would raise `UnicodeEncodeError` from a plain `print`, in a
-    test that had already passed. So the block is cut down to what the stream's
-    own encoding can say, with `\\uXXXX` for the rest, and a stream that cannot
-    be written to at all (an `OSError`) is let go: the numbers are lost and the
-    run is not."""
-    table, teardown = suite_timings(proc.stdout, proc.stderr)
-    block = [f"{SUITE.name} passed; its own clock, which a pass would otherwise "
-             "discard (opensoft/openRepoTools#77):"]
-    block += table or [f"(no timing table: no line of its stdout starts "
-                       f"{TIMING_HEADER!r})"]
-    block += teardown or [f"(no teardown line: no line of its stderr starts "
-                          f"{TEARDOWN_PREFIX!r})"]
-    text = "\n" + "\n".join(block) + "\n"
-    with _past_capture():
-        encoding = getattr(sys.stdout, "encoding", None) or "ascii"
-        text = text.encode(encoding, "backslashreplace").decode(encoding)
-        with contextlib.suppress(OSError):
-            print(text, flush=True)
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-def test_the_lane_helper_suite_passes():
-    env = dict(os.environ)
-    # The suite asserts on git's own output and on commit authorship in its
-    # sandbox; a runner with no identity configured would fail inside it for a
-    # reason that is not about the helpers.
-    env.setdefault("GIT_AUTHOR_NAME", "openRepoTools CI")
-    env.setdefault("GIT_AUTHOR_EMAIL", "ci@openrepotools.invalid")
-    env.setdefault("GIT_COMMITTER_NAME", "openRepoTools CI")
-    env.setdefault("GIT_COMMITTER_EMAIL", "ci@openrepotools.invalid")
-    # Not inherited: every one of these is a seam the suite unsets or sets for
-    # itself, and a developer's own shell must not change what it proves.
-    for name in ("LANES_FILE", "LANES_EDIT", "LANES_REPO", "LANES_PATH",
-                 "LANES_LANE", "LANES_WORKSPACE_ROOT", "LANES_REPOS_TSV",
-                 "LANES_REPOS_TSV_SHIPPED", "AGENT_PROTOCOL_ROOT",
-                 "OPENREPOTOOLS_BIN_DIR", "PROJECTS_ROOT", "CLAUDE_NO_LANE"):
-        env.pop(name, None)
-    # THE LANE MANUAL IS THE SPEC LEG'S (opensoft/openRepoTools#186, T009):
-    # the suite quotes `docs/README-lanes.md` back against the code, and in the
-    # triad that file is not beside the code. Named from this run's roots - the
-    # code root itself on today's layout - and EMPTY where the run has no spec
-    # root (a standalone code leg), which the suite reads as "skip the quotes,
-    # naming why". A composed run without one never gets here: conftest
-    # refuses it before the first test.
-    spec = ROOTS.root_of("spec")
-    env["OPENREPOTOOLS_LANE_MANUAL"] = (
-        "" if spec is None else str(spec / "docs" / "README-lanes.md"))
-
-    proc = run_in_own_group(["bash", str(SUITE)], timeout=TIMEOUT_SECONDS,
-                            cwd=str(REPO), env=env)
-    tail = proc.stdout.strip().splitlines()[-1:] or ["(no output)"]
-    assert proc.returncode == 0, (
-        f"tests/test_lane_helpers.sh failed ({tail[0]}):\n"
-        f"{proc.stdout}\n{proc.stderr}")
-    # The footer, read rather than assumed: a suite that exited 0 having run
-    # nothing at all would otherwise pass this.
-    assert " passed, 0 failed" in proc.stdout, proc.stdout[-2000:]
-    show_timings(proc)
-
-
-# --- the timings a pass prints (opensoft/openRepoTools#77, step 1b) ---------
-
-#: A STAND-IN FOR THE SUITE, in the shape step 1a gave its output: a heading,
-#: a case, the table of its sections with its rule, the footer, and the
-#: teardown line on stderr after it. `table=False` is a suite that prints no
-#: clock; `failing` is one whose footer counts a failure and which exits 1.
-_STAND_IN = """#!/usr/bin/env bash
-echo "== a heading =="
-echo "ok   a case"
-{table}echo "----"
-echo "{footer}"
-echo "teardown: rm -rf of the sandbox took 3 s" >&2
-exit {status}
-"""
-#: The third row carries an em dash, as the real suite's headings do.
-_STAND_IN_TABLE = """echo 'wall time per section, longest first (whole seconds; opensoft/openRepoTools#77):'
-echo '    12 s   60%  the slow section'
-echo '     8 s   40%  the quick section'
-echo '     0 s    0%  a row with a dash \u2014 in it'
-echo '    20 s  100%  the whole run, from the top of this file to this table'
-"""
-
-#: THE REAL TEST, RUN BY A CHILD PYTEST over this very file, with its own
-#: fixtures and signature, and with the suite it runs swapped for a stand-in by
-#: this plugin. A copy of its body here would prove the copy; and a child and
-#: not this process, because what is under test is what pytest's REAL output
-#: holds, which `capsys` and `capfd` in a test that is itself captured cannot
-#: say.
-_CHILD_PLUGIN = """\
-import os
-from pathlib import Path
-
-import pytest
-
-
-@pytest.fixture(autouse=True)
-def stand_in_suite(monkeypatch):
-    import test_lane_helpers_suite as wrapper
-    monkeypatch.setattr(wrapper, "SUITE", Path(os.environ["STAND_IN_SUITE"]))
-"""
-
-#: WHAT THE CHILD IS NOT TO INHERIT. Each of these changes how pytest WRITES,
-#: not what it says, and a test that reads its output line by line must not
-#: depend on which of them the runner set. `CI` and `BUILD_NUMBER` make pytest
-#: print a whole failure message in its short summary where it prints the first
-#: line elsewhere; `NO_COLOR` and `FORCE_COLOR` are two of the four things that
-#: decide whether it colours. The fourth is the terminal, which a pipe is not,
-#: and the first, `PY_COLORS`, is read before the rest, so it is SET to "0"
-#: below rather than only removed: a runner that exports `FORCE_COLOR=1` and a
-#: `PY_COLORS=1` ends every `E` line in an escape sequence, and `lines_ending`
-#: then counts nothing.
-_CHILD_NOT_INHERITED = ("PYTEST_ADDOPTS", "PYTEST_PLUGINS", "PYTEST_CURRENT_TEST",
-                        "CI", "BUILD_NUMBER", "NO_COLOR", "FORCE_COLOR")
-
-_REAL_TEST = "test_the_lane_helper_suite_passes"
-
-
-def run_wrapper_over(tmp_path, *, table=True, failing=False, inherited=None,
-                     env_extra=None, args=(), tests=(_REAL_TEST,)):
-    """Run the wrapper's own test, as `pytest tests -q` runs it, over a
-    stand-in suite. Returns the child's process and its output as lines.
-
-    `inherited` is what the CHILD'S PARENT is imagined to have set, which the
-    child must not see; `env_extra` is what it IS to see; `args` are more
-    pytest options and `tests` the names, in this file, it is to run."""
-    stand_in = tmp_path / "stand-in-suite.sh"
-    stand_in.write_text(_STAND_IN.format(
-        table=_STAND_IN_TABLE if table else "",
-        footer="1 passed, 1 failed, 0 skipped, 0 pending" if failing
-        else "2 passed, 0 failed, 0 skipped, 0 pending",
-        status=1 if failing else 0), encoding="utf-8")
-    (tmp_path / "stand_in_plugin.py").write_text(_CHILD_PLUGIN, encoding="utf-8")
-    env = dict(os.environ, **(inherited or {}))
-    # THE COLOUR TESTS PIN `PY_COLORS="0"`, set below, and the escape-sequence
-    # assertion; these pops only keep a runner's own settings out of the child.
-    for name in _CHILD_NOT_INHERITED:
-        env.pop(name, None)
-    env.update(
-        STAND_IN_SUITE=str(stand_in), PY_COLORS="0", PYTHONDONTWRITEBYTECODE="1",
-        PYTHONPATH=os.pathsep.join(
-            [str(tmp_path), *filter(None, [os.environ.get("PYTHONPATH")])]),
-        **(env_extra or {}))
-    proc = run_in_own_group(
-        [sys.executable, "-m", "pytest", "-q", "-p", "no:cacheprovider",
-         "-p", "stand_in_plugin", *args,
-         *(f"{Path(__file__).resolve()}::{name}" for name in tests)],
-        timeout=600, cwd=str(tmp_path), env=env)
-    return proc, (proc.stdout + proc.stderr).splitlines()
-
-
-def lines_ending(lines, text):
-    """How many lines of the output end in `text`: a row of the stand-in's
-    table, whether bare (a pass) or after pytest's `E   ` (a failure's message).
-    A failure's assertion explanation holds the whole `CompletedProcess` as one
-    escaped line, which ends in something else and so is not counted."""
-    return sum(1 for ln in lines if ln.rstrip().endswith(text))
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-def test_a_passing_suite_shows_its_timings_in_pytests_own_output(tmp_path):
-    proc, lines = run_wrapper_over(tmp_path)
-    assert proc.returncode == 0, "\n".join(lines)
-    assert lines_ending(lines, "the slow section") == 1, "\n".join(lines)
-    assert lines_ending(lines, "the quick section") == 1, "\n".join(lines)
-    assert lines_ending(lines, "to this table") == 1, "\n".join(lines)
-    assert lines_ending(lines, "teardown: rm -rf of the sandbox took 3 s") == 1, (
-        "\n".join(lines))
-    assert lines_ending(lines, "opensoft/openRepoTools#77):") == 2, (
-        "the table's own header and the lead line over it, once each:\n"
-        + "\n".join(lines))
-    # What the suite printed that is NOT its clock stays out of a green log.
-    assert lines_ending(lines, "ok   a case") == 0, "\n".join(lines)
-
-
-#: What a runner may have set that the child is not to see: the colour
-#: variables and `CI`, alone and together.
-_RUNNER_SETS = [
-    pytest.param({"FORCE_COLOR": "1"}, id="FORCE_COLOR=1"),
-    pytest.param({"PY_COLORS": "1"}, id="PY_COLORS=1"),
-    pytest.param({"CI": "true"}, id="CI=true"),
-    pytest.param({"CI": "true", "FORCE_COLOR": "1"}, id="CI=true+FORCE_COLOR=1"),
-    pytest.param({"BUILD_NUMBER": "7"}, id="BUILD_NUMBER=7"),
-    pytest.param({}, id="nothing"),
-]
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-@pytest.mark.parametrize("inherited", _RUNNER_SETS)
-def test_a_failing_suite_prints_no_timings_block_beside_its_transcript(
-        tmp_path, inherited):
-    proc, lines = run_wrapper_over(tmp_path, failing=True, inherited=inherited)
-    assert proc.returncode != 0, "\n".join(lines)
-    # The child's output is the same whatever the runner set: no escape
-    # sequence ends a row (the lines below are counted by how they END), and
-    # the same message is printed the same number of times.
-    assert not any("\x1b[" in ln for ln in lines), (
-        "the child coloured its output:\n" + "\n".join(lines))
-    # The transcript is in the assertion message, and that it is THERE is all
-    # that is counted: how many times pytest repeats the message is not this
-    # file's to pin.
-    assert lines_ending(lines, "the slow section") >= 1, "\n".join(lines)
-    assert lines_ending(lines, "teardown: rm -rf of the sandbox took 3 s") >= 1, (
-        "\n".join(lines))
-    # What is pinned is that the wrapper said nothing of its own: every block
-    # `show_timings` prints opens with its lead line, which names the run a
-    # PASS.
-    assert not any("its own clock" in ln for ln in lines), (
-        "a failing run printed the passing run's lead line:\n" + "\n".join(lines))
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-def test_a_passing_suite_that_printed_no_clock_is_said_to_have_none(tmp_path):
-    proc, lines = run_wrapper_over(tmp_path, table=False)
-    assert proc.returncode == 0, "\n".join(lines)
-    assert any(ln.startswith("(no timing table: ") for ln in lines), "\n".join(lines)
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-def test_a_stdout_that_cannot_spell_the_table_does_not_fail_a_pass(tmp_path):
-    """The real suite's headings carry em dashes. On an ASCII stdout the block
-    is written with `\\uXXXX` in their place, and the run stays green."""
-    proc, lines = run_wrapper_over(tmp_path, env_extra={"PYTHONIOENCODING": "ascii"})
-    assert proc.returncode == 0, "\n".join(lines)
-    assert any(ln.endswith("a row with a dash \\u2014 in it") for ln in lines), (
-        "\n".join(lines))
-    assert not any("UnicodeEncodeError" in ln for ln in lines), "\n".join(lines)
-
-
-def test_a_stream_that_cannot_be_written_to_does_not_fail_a_pass(monkeypatch):
-    """`show_timings` lets an `OSError` from its write go (a full disk, a pipe
-    nobody reads): the numbers are lost and the run is not. NOTHING ELSE IN THIS
-    FILE REACHES THAT `suppress`, and with it removed every other test here
-    still passes, so this one writes into a stream that raises ENOSPC and asks
-    that the write was ATTEMPTED and that the call RETURNED.
-
-    The stream is put where `sys.stdout` is by a stand-in for `capsys.disabled()`
-    (the autouse fixture's own would hand the real stdout back), and only for the
-    write, so nothing is left behind for the fixtures that tear down after this
-    test."""
-    class Unwritable:
-        encoding = "utf-8"
-        attempts = 0
-
-        def write(self, text):
-            Unwritable.attempts += 1
-            raise OSError(28, "No space left on device")
-
-        def flush(self):
-            raise OSError(28, "No space left on device")
-
-    @contextlib.contextmanager
-    def unwritable_stdout():
-        with contextlib.redirect_stdout(Unwritable()):
-            yield
-
-    monkeypatch.setitem(globals(), "_past_capture", unwritable_stdout)
-    show_timings(subprocess.CompletedProcess(
-        ["bash", "suite.sh"], 0,
-        stdout=f"{TIMING_HEADER} (whole seconds):\n     3 s  100%  the whole run\n",
-        stderr="teardown: rm -rf of the sandbox took 0 s\n"))
-    assert Unwritable.attempts >= 1, (
-        "the block was never written to the stream, so nothing was tested")
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None,
-                    reason="the lane helpers and their suite are bash")
-def test_a_run_without_pytests_capture_plugin_still_runs_and_shows_the_block(tmp_path):
-    """`-p no:capture` removes the `capsys` fixture. The fixture that asks for
-    it must not turn every test in this file into an ERROR (here the real test
-    and a pure one, both of them this file's), and with nothing capturing, the
-    block is on the output as it is."""
-    proc, lines = run_wrapper_over(
-        tmp_path, args=("-p", "no:capture"),
-        tests=(_REAL_TEST,
-               "test_the_timings_are_the_table_and_the_teardown_line_and_nothing_else"))
-    assert proc.returncode == 0, "\n".join(lines)
-    assert not any("capsys" in ln for ln in lines), "\n".join(lines)
-    assert any("2 passed" in ln for ln in lines), "\n".join(lines)
-    assert lines_ending(lines, "the slow section") == 1, "\n".join(lines)
-
-
-def test_the_timings_are_the_table_and_the_teardown_line_and_nothing_else():
-    stdout = ("== a heading ==\nok   a case\n"
-              "wall time per section, longest first (whole seconds; x):\n"
-              "    12 s   60%  the slow section\n"
-              "    20 s  100%  the whole run\n"
-              "----\n"
-              "2 passed, 0 failed, 0 skipped, 0 pending\n")
-    stderr = ("a note\nteardown: rm -rf of the sandbox took 3 s\n"
-              "teardown: rm -rf of the sandbox FAILED after 4 s, so part of it is left\n")
-    table, teardown = suite_timings(stdout, stderr)
-    assert table == [
-        "wall time per section, longest first (whole seconds; x):",
-        "    12 s   60%  the slow section",
-        "    20 s  100%  the whole run"]
-    assert teardown == [
-        "teardown: rm -rf of the sandbox took 3 s",
-        "teardown: rm -rf of the sandbox FAILED after 4 s, so part of it is left"]
-    assert suite_timings("no table here\n", "") == ([], [])
-
-
-def test_a_row_of_negative_seconds_does_not_end_the_table():
-    """bash's `SECONDS` can step backwards, and the suite prints the difference
-    as it is: `    -9 s  -300%  <heading>`."""
-    stdout = ("wall time per section, longest first (whole seconds; x):\n"
-              "    12 s  400%  the slow section\n"
-              "    -9 s -300%  a section the clock stepped back over\n"
-              "     0 s    0%  (preamble, before the first heading)\n"
-              "     3 s  100%  the whole run, from the top of this file to this table\n"
-              "----\n"
-              "2 passed, 0 failed, 0 skipped, 0 pending\n")
-    table, _ = suite_timings(stdout, "")
-    assert len(table) == 5, table
-    assert table[-1].endswith("to this table"), table
-
-
-def test_the_wrapper_looks_for_what_the_suite_prints():
-    """The strings above are copies, and a copy nobody holds to its original
-    reads as a pass that silently prints nothing. Hold them to the suite's
-    own `printf`s: BOTH teardown wordings, because the wrapper takes either by
-    its prefix and rewording only one of them would otherwise go unseen."""
-    text = SUITE.read_text(encoding="utf-8")
-    assert f"printf '{TIMING_HEADER}" in text, "the table's header moved"
-    assert f"printf '{TEARDOWN_PREFIX} took " in text, (
-        "the teardown line's `took` wording moved")
-    assert f"printf '{TEARDOWN_PREFIX} FAILED after " in text, (
-        "the teardown line's `FAILED after` wording moved")
-    assert "'%6s s  %3s%%  %s'" in text, "a row of the table changed shape"
diff --git a/tests/test_lane_helpers_suite_timeout.py b/tests/test_lane_helpers_suite_timeout.py
deleted file mode 100644
index 7eaf382d..00000000
--- a/tests/test_lane_helpers_suite_timeout.py
+++ /dev/null
@@ -1,373 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""What `tests/test_lane_helpers_suite.py` leaves behind when it gives up on the
-shell suite, or is told to stop (opensoft/openRepoTools#142, item 3).
-
-`subprocess.run(..., timeout=)` kills the child it started and nothing under
-it. The suite's `EXIT` trap does not run on that SIGKILL, so the `sleep` that is
-its liveness fixture - made longer than the wrapper's own bound on purpose - and
-every later fixture's were orphaned for up to 70 minutes. The wrapper now runs
-the suite in a session of its own and stops the whole group: on the timeout, on
-a Ctrl-C, and on the TERM and hangup that a session of its own no longer
-receives by itself from `tests/run.sh`'s group or from a terminal.
-
-THE SUITE ITSELF IS NOT RUN HERE: it is the 45 minutes `test_lane_helpers_suite`
-already spends. Each test points that module's `SUITE` at a stand-in script that
-starts a `sleep` of its own, the way the suite does, with the bound cut to
-seconds, and asks whether the `sleep` is still there afterwards. Most call the
-module's own test function, so the call site is the one under test and not a
-copy of it; the signal tests run `run_in_own_group` in a process of their own,
-in a group of its own, as `tests/run.sh` runs pytest, and signal that group.
-"""
-
-from __future__ import annotations
-
-import os
-import shlex
-import shutil
-import signal
-import subprocess
-import sys
-import threading
-import time
-from pathlib import Path
-from typing import NamedTuple
-
-import pytest
-
-import test_lane_helpers_suite as wrapper
-from conftest import WINDOWS_SKIP
-
-
-
-def ps_reports_state() -> bool:
-    """`ps -o stat= -p <pid>` is how these tests tell a running process from a
-    zombie, so a `ps` that cannot answer it (busybox's can't) would make every
-    "is gone" assertion check nothing, and the module is skipped instead."""
-    try:
-        reply = subprocess.run(["ps", "-o", "stat=", "-p", str(os.getpid())],
-                               capture_output=True, text=True, check=False)
-    except OSError:
-        return False
-    return bool(reply.stdout.strip())
-
-
-pytestmark = [
-    WINDOWS_SKIP,
-    pytest.mark.skipif(shutil.which("bash") is None, reason="the suite is bash"),
-    pytest.mark.skipif(not ps_reports_state(),
-                       reason="the stand-in's `sleep` is looked for with "
-                              "`ps -o stat= -p`, which this ps does not answer"),
-]
-
-TESTS = Path(__file__).resolve().parent
-
-#: Windows has no SIGHUP, and everything here is skipped there - but a test
-#: module has to import on Windows to be skipped, and this one names it in a
-#: decorator.
-SIGHUP = getattr(signal, "SIGHUP", None)
-
-#: The stand-in answers TERM the way the suite does (`trap 'cleanup; exit 143'
-#: TERM`), leaving a marker where the suite would remove its sandbox. Its
-#: `sleep` outlives every bound below by a wide margin, so it is only ever gone
-#: because the wrapper stopped it.
-STANDIN = '''\
-trap 'echo trapped > {marker}; exit 143' TERM
-sleep 600 &
-echo $! > {pidfile}
-wait
-'''
-
-#: The same, but TERM is ignored by the script and, since an ignored signal is
-#: inherited, by its `sleep`: only a KILL ends either.
-STANDIN_DEAF = '''\
-trap '' TERM
-sleep 600 &
-echo $! > {pidfile}
-wait
-'''
-
-
-#: The same, but its TERM trap takes a second to finish its cleanup.
-STANDIN_SLOW = '''\
-trap 'sleep 1; echo cleaned > {marker}; exit 143' TERM
-sleep 600 &
-echo $! > {pidfile}
-wait
-'''
-
-
-class Standin(NamedTuple):
-    script: Path
-    pidfile: Path     # where the stand-in's `sleep` writes its pid
-    marker: Path      # written by the stand-in's TERM trap
-
-
-def running(pid: int) -> bool:
-    """Whether `pid` is a live process. A zombie that nothing has reaped is not
-    one, and where the machine's init never reaps (a container whose pid 1 is
-    not an init) a killed orphan stays one for good."""
-    try:
-        os.kill(pid, 0)
-    except (ProcessLookupError, PermissionError):
-        return False
-    stat = subprocess.run(["ps", "-o", "stat=", "-p", str(pid)],
-                          capture_output=True, text=True, check=False).stdout.strip()
-    return bool(stat) and not stat.startswith("Z")
-
-
-def sleep_pid(pidfile: Path) -> int:
-    assert pidfile.is_file(), (
-        "the stand-in never started its sleep, so nothing below would prove "
-        "anything")
-    return int(pidfile.read_text(encoding="utf-8"))
-
-
-def assert_gone_within(pid: int, seconds: float = 5.0) -> None:
-    """The group is killed, so this is a matter of the kernel reaping and not
-    of the sleep's own timing; the poll is for a slow runner."""
-    deadline = time.monotonic() + seconds
-    while running(pid):
-        assert time.monotonic() < deadline, (
-            f"pid {pid}, a `sleep 600` the stand-in suite started, is still "
-            f"running {seconds}s after the wrapper gave up: what it stopped "
-            "was the suite's bash and nothing under it")
-        time.sleep(0.05)
-
-
-@pytest.fixture
-def standin(tmp_path):
-    """`make(body)`: a stand-in suite with `{pidfile}` and `{marker}` filled in.
-    Whatever it leaves running is killed on the way out, so a wrapper that
-    stopped stopping the group costs one red test and not a `sleep 600`."""
-    pidfiles = []
-
-    def make(body: str) -> Standin:
-        pidfile, marker = tmp_path / "sleep.pid", tmp_path / "trapped"
-        script = tmp_path / "suite.sh"
-        script.write_text(body.format(pidfile=shlex.quote(str(pidfile)),
-                                      marker=shlex.quote(str(marker))),
-                          encoding="utf-8")
-        pidfiles.append(pidfile)
-        return Standin(script, pidfile, marker)
-
-    yield make
-    for pidfile in pidfiles:
-        try:
-            pid = int(pidfile.read_text(encoding="utf-8"))
-        except (OSError, ValueError):
-            continue
-        if running(pid):
-            os.kill(pid, signal.SIGKILL)
-
-
-def wire(monkeypatch, stand: Standin, *, timeout: float) -> None:
-    """The wrapper's own test function, run against `stand` and a short bound."""
-    monkeypatch.setattr(wrapper, "SUITE", stand.script)
-    monkeypatch.setattr(wrapper, "TIMEOUT_SECONDS", timeout)
-
-
-def test_a_suite_that_times_out_leaves_no_process_behind(standin, monkeypatch):
-    stand = standin(STANDIN)
-    wire(monkeypatch, stand, timeout=5)
-    with pytest.raises(subprocess.TimeoutExpired):
-        wrapper.test_the_lane_helper_suite_passes()
-    assert_gone_within(sleep_pid(stand.pidfile))
-    assert stand.marker.is_file(), (
-        "the group was KILLed with no TERM first, so the suite's own trap, "
-        "which removes its sandbox, would never have run")
-
-
-def test_a_timeout_reports_the_bound_it_was_given(standin, monkeypatch):
-    """The wait is made in half-second slices, and the last of them is not the
-    bound: a CI log has to say "timed out after 5400 seconds", and what the suite
-    had printed by then has to come with it."""
-    stand = standin("echo partial-transcript\n" + STANDIN)
-    wire(monkeypatch, stand, timeout=1.3)
-    with pytest.raises(subprocess.TimeoutExpired) as expired:
-        wrapper.test_the_lane_helper_suite_passes()
-    assert expired.value.timeout == 1.3
-    assert "timed out after 1.3 seconds" in str(expired.value)
-    printed = expired.value.stdout
-    printed = printed.decode() if isinstance(printed, bytes) else printed
-    assert "partial-transcript" in (printed or "")
-
-
-def test_a_group_that_ignores_term_is_killed_after_the_grace(standin, monkeypatch):
-    stand = standin(STANDIN_DEAF)
-    wire(monkeypatch, stand, timeout=3)
-    monkeypatch.setattr(wrapper, "GROUP_TERM_GRACE", 1)
-    with pytest.raises(subprocess.TimeoutExpired):
-        wrapper.test_the_lane_helper_suite_passes()
-    assert_gone_within(sleep_pid(stand.pidfile))
-
-
-def test_a_suite_that_is_interrupted_leaves_no_process_behind(standin, monkeypatch):
-    """A session of its own is not the terminal's foreground group, so a Ctrl-C
-    reaches pytest and no longer reaches the suite by itself. The SIGINT is sent
-    to this process alone, once the stand-in's `sleep` exists, and never after
-    the wrapper has returned: a late one would abort the whole pytest session."""
-    stand = standin(STANDIN)
-    wire(monkeypatch, stand, timeout=120)
-    done = threading.Event()
-
-    def interrupt_once_started():
-        deadline = time.monotonic() + 30
-        while not stand.pidfile.is_file() and time.monotonic() < deadline:
-            if done.wait(0.05):
-                return
-        if not done.is_set():
-            os.kill(os.getpid(), signal.SIGINT)
-
-    # A run started with SIGINT ignored (a background job's) has no handler to
-    # raise KeyboardInterrupt; this puts Python's own back for the one test.
-    previous = signal.signal(signal.SIGINT, signal.default_int_handler)
-    sender = threading.Thread(target=interrupt_once_started, daemon=True)
-    try:
-        sender.start()
-        with pytest.raises(KeyboardInterrupt):
-            wrapper.test_the_lane_helper_suite_passes()
-    finally:
-        done.set()
-        sender.join(timeout=5)
-        signal.signal(signal.SIGINT, previous)
-    assert_gone_within(sleep_pid(stand.pidfile))
-    assert stand.marker.is_file()
-
-
-# A SIGNAL TO THE GROUP THE WAY `tests/run.sh` SENDS IT. run.sh starts
-# `python3 -m pytest` in a process group of its own and stops that group with
-# `kill -TERM -- -<pgid>`; a terminal's hangup reaches the same process. The
-# suite is no longer in that group, so what stops it is `run_in_own_group`'s
-# handler. The runner below is that pytest: a process of its own, leading a
-# group of its own, running the wrapper's helper against the stand-in.
-RUNNER = '''\
-import signal, sys
-sys.path.insert(0, {tests!r})
-{prelude}
-import test_lane_helpers_suite as w
-w.GROUP_TERM_GRACE = 3
-w.run_in_own_group(["bash", {script!r}], timeout=120)
-'''
-
-
-@pytest.fixture
-def runner(tmp_path):
-    """`start(stand, prelude="")`: the runner, in a group of its own. Its group
-    is killed on the way out if a test left it running."""
-    started = []
-
-    def start(stand: Standin, prelude: str = "") -> subprocess.Popen:
-        code = RUNNER.format(tests=str(TESTS), script=str(stand.script), prelude=prelude)
-        errors = tmp_path / "runner.err"
-        with open(errors, "w", encoding="utf-8") as sink:
-            proc = subprocess.Popen([sys.executable, "-c", code], cwd=str(tmp_path),
-                                    stdout=subprocess.DEVNULL, stderr=sink,
-                                    start_new_session=True)
-        proc.errors = errors
-        started.append(proc)
-        deadline = time.monotonic() + 30
-        while not stand.pidfile.is_file():
-            assert proc.poll() is None and time.monotonic() < deadline, (
-                "the runner never started the stand-in's sleep:\n"
-                + errors.read_text(encoding="utf-8"))
-            time.sleep(0.05)
-        return proc
-
-    yield start
-    for proc in started:
-        try:
-            os.killpg(proc.pid, signal.SIGKILL)
-        except (ProcessLookupError, PermissionError):
-            pass
-        proc.wait()
-
-
-@pytest.mark.parametrize("signum", [signal.SIGTERM, SIGHUP],
-                         ids=["TERM", "HUP"])
-def test_a_signal_to_the_runners_group_leaves_no_process_behind(
-        signum, standin, runner):
-    stand = standin(STANDIN)
-    proc = runner(stand)
-    os.killpg(proc.pid, signum)
-    assert proc.wait(timeout=30) == -signum, (
-        "the runner should end by the signal it was sent, as it would have "
-        "had nothing been handling it:\n" + proc.errors.read_text(encoding="utf-8"))
-    assert_gone_within(sleep_pid(stand.pidfile))
-    assert stand.marker.is_file()
-
-
-def test_a_hangup_that_was_ignored_stays_ignored(standin, runner):
-    """A `nohup`'d run has SIGHUP ignored, and goes on after the terminal is
-    gone: the handler is installed only where the disposition is the default."""
-    stand = standin(STANDIN)
-    proc = runner(stand, prelude="signal.signal(signal.SIGHUP, signal.SIG_IGN)")
-    pid = sleep_pid(stand.pidfile)
-    os.killpg(proc.pid, SIGHUP)
-    time.sleep(1)
-    assert proc.poll() is None and running(pid), (
-        "a hangup the run was ignoring ended it:\n"
-        + proc.errors.read_text(encoding="utf-8"))
-    os.killpg(proc.pid, signal.SIGTERM)
-    assert proc.wait(timeout=30) == -signal.SIGTERM
-    assert_gone_within(pid)
-
-
-@pytest.mark.parametrize("first", [signal.SIGTERM, signal.SIGINT],
-                         ids=["TERM-then-INT", "INT-twice"])
-def test_a_ctrl_c_during_the_term_grace_does_not_orphan_a_deaf_suite(
-        first, standin, runner):
-    """The stop waits out a grace for a suite that ignores TERM, and a Ctrl-C
-    in that wait used to leave it with a KeyboardInterrupt before the KILL: the
-    runner ended with the suite's `sleep` still running. The runner is left with
-    Python's own SIGINT handler, as a terminal's run has."""
-    stand = standin(STANDIN_DEAF)
-    proc = runner(stand, prelude="signal.signal(signal.SIGINT, signal.default_int_handler)")
-    pid = sleep_pid(stand.pidfile)
-    os.killpg(proc.pid, first)
-    time.sleep(1)   # inside the runner's three-second grace
-    assert proc.poll() is None, (
-        "the runner left before the grace ran out, so the Ctrl-C below would "
-        "not be inside it:\n" + proc.errors.read_text(encoding="utf-8"))
-    os.killpg(proc.pid, signal.SIGINT)
-    code = proc.wait(timeout=30)
-    if first == signal.SIGTERM:
-        assert code == -signal.SIGTERM, (
-            f"the runner should still end by the TERM it was sent, not {code}:\n"
-            + proc.errors.read_text(encoding="utf-8"))
-    else:
-        assert code != 0
-    assert_gone_within(pid)
-
-
-def test_a_ctrl_c_during_the_term_grace_lets_a_slow_trap_finish(standin, runner):
-    """The KILL in a `finally` keeps a Ctrl-C from orphaning anything, but it
-    would cut short the cleanup of a suite that DOES answer TERM, only slowly:
-    stop_group ignores Ctrl-C so that the trap, which removes the suite's
-    sandbox, gets its grace."""
-    stand = standin(STANDIN_SLOW)
-    proc = runner(stand, prelude="signal.signal(signal.SIGINT, signal.default_int_handler)")
-    pid = sleep_pid(stand.pidfile)
-    os.killpg(proc.pid, signal.SIGTERM)
-    time.sleep(0.5)   # the Ctrl-C lands about half a second into the trap's second of cleanup
-    os.killpg(proc.pid, signal.SIGINT)
-    assert proc.wait(timeout=30) == -signal.SIGTERM, proc.errors.read_text(encoding="utf-8")
-    assert stand.marker.is_file(), (
-        "the Ctrl-C ended the stop before the suite's TERM trap had finished")
-    assert_gone_within(pid)
-
-
-def test_a_suite_that_passes_is_still_read_by_its_footer(standin, monkeypatch):
-    wire(monkeypatch, standin('echo "ok   a case"\necho "1 passed, 0 failed"\n'),
-         timeout=60)
-    wrapper.test_the_lane_helper_suite_passes()
-
-
-def test_a_suite_that_fails_still_prints_its_whole_transcript(standin, monkeypatch):
-    wire(monkeypatch,
-         standin('echo "FAIL a case"\necho "0 passed, 1 failed"\n'
-                 'echo "on stderr" >&2\nexit 1\n'),
-         timeout=60)
-    with pytest.raises(AssertionError) as red:
-        wrapper.test_the_lane_helper_suite_passes()
-    for wanted in ("0 passed, 1 failed", "FAIL a case", "on stderr"):
-        assert wanted in str(red.value)
diff --git a/tests/test_lane_start_claude_current.py b/tests/test_lane_start_claude_current.py
deleted file mode 100644
index 2283b137..00000000
--- a/tests/test_lane_start_claude_current.py
+++ /dev/null
@@ -1,607 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-start` and `claude-current`: which Claude Code a lane launches
-(opensoft/workBenches#119, Brett Heap 2026-09-29, verbatim "for 2, we can run
-update on every start, this ensures we have the latest models").
-
-EVERY RUN HERE IS A REAL `lane-start` IN A SANDBOX, and the resolver is a
-STUB. The sandbox is the lane suite's, cut down to one new lane: a bare origin
-and a workspace clone whose register is a header, `workspace.yaml` pointing at
-it, a fake `tmux` that answers the reads a launch makes, a fake `gh` that
-refuses, and `$HOME`, `$TMPDIR` and `$OPENREPOTOOLS_BIN_DIR` all under
-`tmp_path`. `claude-current` itself is `tests/test_claude_current.py`'s; the
-stub here answers what a case needs and logs how it was called, so nothing
-reaches npm or runs a real Claude Code.
-
-The contract under test is docs/README-claude-current.md's:
-  * CLAUDE_BIN unset: `claude-current --porcelain`, found beside `lane-start`
-    or in $OPENREPOTOOLS_BIN_DIR and NEVER on PATH, names the launch by an
-    absolute path; its exit 2 refuses the launch with 2 and its 1 with 1,
-    before the register is written;
-  * CLAUDE_BIN equal to CLAUDE_RESOLVED_BIN with no CLAUDE_VERIFIED_VERSION is
-    inherited, not pinned, and is resolved again;
-  * any other CLAUDE_BIN is a pin, launched as it is; with
-    CLAUDE_VERIFIED_VERSION beside an equal CLAUDE_RESOLVED_BIN its version is
-    recorded;
-  * the log line carries `claude <version>`, and CLAUDE_VERIFIED_VERSION never
-    reaches the session.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="lane-start is a bash script"),
-              pytest.mark.skipif(shutil.which("git") is None,
-                                 reason="the register is a git repository"),
-              WINDOWS_SKIP]
-
-LANE = "repoZ-1"
-VERSION = "2.1.284"
-
-#: The environment a case must not inherit from the host that runs it: every
-#: seam `lane-start`, `lanes-edit.sh` and `claude-current` read.
-SCRUBBED_PREFIXES = ("LANES_", "LANE_START_", "CLAUDE_", "OPENREPOTOOLS_",
-                     "FAKE_", "GIT_", "NPM_CONFIG_", "npm_config_", "TMUX")
-SCRUBBED = {"AGENT_PROTOCOL_ROOT", "PROJECTS_ROOT", "XDG_CONFIG_HOME",
-            "XDG_CACHE_HOME", "PCLAUDE"}
-
-FAKE_TMUX = r"""#!/usr/bin/env bash
-# The lane suite's fake tmux, cut down: this window is testsess:@1, index 0,
-# named `claude`, and every other ref resolves nothing. rename-window and
-# send-keys are logged; everything else answers nothing and succeeds.
-case "${1-}" in
-  display-message)
-    shift
-    t=""; f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -p) shift ;;
-        -t) t="${2-}"; shift 2 ;;
-        *)  f="$1"; shift ;;
-      esac
-    done
-    if [ -n "$t" ]; then
-      case "$t" in
-        testsess:0|testsess:@1|@1) : ;;
-        *) exit 1 ;;
-      esac
-      case "$f" in
-        '#{window_id}')            echo '@1' ;;
-        '#{window_name}')          echo 'claude' ;;
-        '#{session_name}')         echo 'testsess' ;;
-        '#{pane_current_command}') echo 'claude' ;;
-        *)                         echo ;;
-      esac
-      exit 0
-    fi
-    case "$f" in
-      '#{session_name}:#{window_id}')    echo 'testsess:@1' ;;
-      '#{session_name}:#{window_index}') echo 'testsess:0' ;;
-      '#S:#I')                           echo 'testsess:0' ;;
-      '#{window_id}')                    echo '@1' ;;
-      '#W'|'#{window_name}')             echo 'claude' ;;
-      *)                                 echo ;;
-    esac ;;
-  rename-window)
-    printf 'rename-window %s\n' "${2-}" >> "$FAKE_TMUX_LOG" ;;
-  send-keys)
-    shift
-    printf 'send-keys %s\n' "$*" >> "$FAKE_TMUX_LOG" ;;
-  *) : ;;
-esac
-"""
-
-FAKE_GH = """#!/usr/bin/env bash
-printf 'FAKE gh REFUSED: %s -- this suite reaches no GitHub surface\\n' "$*" >&2
-exit 90
-"""
-
-#: A Claude Code that records how it was started and what it inherited. One
-#: script, copied to every path a case launches, so the log says which one ran.
-FAKE_CLAUDE = """#!/usr/bin/env bash
-{
-  printf 'ran %s: %s\\n' "$0" "$*"
-  printf 'env CLAUDE_BIN=%s\\n' "${CLAUDE_BIN-<unset>}"
-  printf 'env CLAUDE_RESOLVED_BIN=%s\\n' "${CLAUDE_RESOLVED_BIN-<unset>}"
-  printf 'env CLAUDE_VERIFIED_VERSION=%s\\n' "${CLAUDE_VERIFIED_VERSION-<unset>}"
-} >> "$FAKE_CLAUDE_LOG"
-"""
-
-#: The resolver stub: logs its arguments, then answers from FAKE_CC_* the way
-#: `claude-current --porcelain` does.
-FAKE_CLAUDE_CURRENT = """#!/usr/bin/env bash
-printf '%s %s\\n' "$0" "$*" >> "$FAKE_CC_LOG"
-if [ -n "${FAKE_CC_STDERR:-}" ]; then printf '%s\\n' "$FAKE_CC_STDERR" >&2; fi
-if [ -n "${FAKE_CC_RAW:-}" ]; then printf '%s\\n' "$FAKE_CC_RAW"; exit "${FAKE_CC_RC:-0}"; fi
-if [ "${FAKE_CC_RC:-0}" = 0 ]; then
-  printf 'path=%s\\nversion=%s\\npublished=%s\\nstatus=%s\\n' \\
-    "$FAKE_CC_PATH" "${FAKE_CC_VERSION-2.1.284}" "${FAKE_CC_PUBLISHED-2.1.284}" \\
-    "${FAKE_CC_STATUS:-verified}"
-fi
-exit "${FAKE_CC_RC:-0}"
-"""
-
-
-def _write(path: Path, text: str, mode: int = 0o755) -> Path:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(text, encoding="utf-8")
-    path.chmod(mode)
-    return path
-
-
-class Sandbox:
-    """One workstation with one register and one lane directory, repoZ."""
-
-    def __init__(self, root: Path) -> None:
-        self.root = root
-        self.home = root / "home"
-        self.bin = root / "bin"
-        self.fakebin = root / "fakebin"
-        self.origin = root / "origin.git"
-        self.wip = self.home / "projects" / "wip"
-        self.lane_dir = self.home / "projects" / "repoZ"
-        self.claude_log = root / "claude.log"
-        self.cc_log = root / "claude-current.log"
-        self.tmux_log = root / "tmux.log"
-        for d in (self.home / "projects", root / "tmp", self.fakebin, self.bin,
-                  self.home / ".claude" / "sessions", self.home / ".agents"):
-            d.mkdir(parents=True, exist_ok=True)
-        for f in (self.claude_log, self.cc_log, self.tmux_log):
-            f.write_text("", encoding="utf-8")
-
-        base = {k: v for k, v in os.environ.items()
-                if k not in SCRUBBED and not k.startswith(SCRUBBED_PREFIXES)}
-        base.update({
-            "HOME": str(self.home),
-            "TMPDIR": str(root / "tmp"),
-            "XDG_CONFIG_HOME": str(self.home / ".config"),
-            "XDG_CACHE_HOME": str(self.home / ".cache"),
-            "PATH": f"{self.fakebin}{os.pathsep}{self.bin}{os.pathsep}{base.get('PATH', '')}",
-            "TMUX": f"{root}/fake-tmux-socket,0,0",
-            "AGENT_PROTOCOL_ROOT": str(self.home / ".agents"),
-            "OPENREPOTOOLS_BIN_DIR": str(self.bin),
-            "CLAUDE_CONFIG_DIR": str(self.home / ".claude"),
-            "LANES_WORKSTATION": "Eagle",
-            "LANES_NO_GITHUB": "1",
-            "LANES_INDEX": "off",  # test pushes never nudge an installed indexer
-            "FAKE_TMUX_LOG": str(self.tmux_log),
-            "FAKE_CLAUDE_LOG": str(self.claude_log),
-            "FAKE_CC_LOG": str(self.cc_log),
-            "GIT_AUTHOR_NAME": "lane-start claude-current tests",
-            "GIT_AUTHOR_EMAIL": "test@example.invalid",
-            "GIT_COMMITTER_NAME": "lane-start claude-current tests",
-            "GIT_COMMITTER_EMAIL": "test@example.invalid",
-        })
-        self.env = base
-
-        for name in ("lane-start", "lanes-edit.sh", "repos.tsv"):
-            shutil.copy2(REPO / name, self.bin / name)
-            (self.bin / name).chmod(0o755)
-        _write(self.fakebin / "tmux", FAKE_TMUX)
-        _write(self.fakebin / "gh", FAKE_GH)
-        self.path_claude = _write(self.fakebin / "claude", FAKE_CLAUDE)
-        # A resolver on PATH that no case may ever reach.
-        _write(self.fakebin / "claude-current",
-               '#!/usr/bin/env bash\nprintf "PATH-DECOY %s\\n" "$*" >> "$FAKE_CC_LOG"\nexit 3\n')
-        self.resolved = _write(root / "resolved" / "bin" / "claude", FAKE_CLAUDE)
-
-        self.git("init", "-q", "--bare", "-b", "main", str(self.origin))
-        self.git("clone", "-q", str(self.origin), str(self.wip))
-        (self.wip / "lanes").mkdir()
-        (self.wip / "handoffs").mkdir()
-        (self.wip / "handoffs" / "README.md").write_text(
-            "# handoffs\n", encoding="utf-8")
-        (self.wip / "lanes" / "LANES.md").write_text(
-            "# LANES.md -- the sandbox register\n\n"
-            "| lane | session id | workstation / env / user | started (UTC) "
-            "| objects owned | handoff path | state |\n"
-            "|---|---|---|---|---|---|---|\n", encoding="utf-8")
-        self.git("-C", str(self.wip), "add", "--", "lanes/LANES.md",
-                 "handoffs/README.md")
-        self.git("-C", str(self.wip), "commit", "-q", "-m", "seed")
-        self.git("-C", str(self.wip), "push", "-q", "origin", "main")
-        (self.home / ".agents" / "workspace.yaml").write_text(
-            f"repository: {self.origin}\npath: {self.wip}\n", encoding="utf-8")
-
-        self.git("init", "-q", "-b", "main", str(self.lane_dir))
-        self.git("-C", str(self.lane_dir), "remote", "add", "origin",
-                 "https://github.com/opensoft/repoZ.git")
-
-    def git(self, *args: str) -> str:
-        return subprocess.run(["git", *args], env=self.env, check=True,
-                              capture_output=True, text=True).stdout
-
-    def resolver(self, where: Path | None = None) -> Path:
-        return _write((where or self.bin) / "claude-current", FAKE_CLAUDE_CURRENT)
-
-    def start(self, *args: str, **env: str) -> subprocess.CompletedProcess:
-        full = dict(self.env)
-        full.setdefault("FAKE_CC_PATH", str(self.resolved))
-        full.update(env)
-        return subprocess.run([str(self.bin / "lane-start"), "repoZ", "1", *args],
-                              env=full, cwd=str(self.lane_dir),
-                              capture_output=True, text=True, timeout=120,
-                              check=False)
-
-    def claude_runs(self) -> str:
-        return self.claude_log.read_text(encoding="utf-8")
-
-    def resolver_calls(self) -> str:
-        return self.cc_log.read_text(encoding="utf-8")
-
-    def lane_log(self) -> str:
-        path = self.wip / "lanes" / "log" / f"{LANE}.md"
-        return path.read_text(encoding="utf-8") if path.exists() else ""
-
-    def commits(self) -> int:
-        return int(self.git("-C", str(self.wip), "rev-list", "--count",
-                            "HEAD").strip())
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    return Sandbox(tmp_path)
-
-
-def _started_line(box: Sandbox) -> str:
-    lines = [ln for ln in box.lane_log().splitlines() if ln.startswith("STARTED")]
-    assert len(lines) == 1, box.lane_log()
-    return lines[0]
-
-
-def _claude_fields(box: Sandbox) -> list[str]:
-    """The `claude <version>` sub-fields of the lane's STARTED payload. Asked
-    by name and never by position: other amendments append sub-fields of their
-    own (Amendment 18's `host`, `os` and `container` follow this one)."""
-    payload = _started_line(box).split(" → ", 1)[1]
-    return [f for f in payload.split("; ") if f.startswith("claude ")]
-
-
-def test_an_unset_claude_bin_launches_what_claude_current_names(box):
-    stub = box.resolver()
-    result = box.start()
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == f"{stub} --porcelain\n"
-    runs = box.claude_runs()
-    assert runs.startswith(f"ran {box.resolved}: --name {LANE} --session-id "), runs
-    assert f"ran {box.path_claude}" not in runs
-    assert f"env CLAUDE_BIN={box.resolved}\n" in runs
-    assert f"env CLAUDE_RESOLVED_BIN={box.resolved}\n" in runs
-    assert "env CLAUDE_VERIFIED_VERSION=<unset>\n" in runs
-    assert f"launching claude {VERSION} (verified) at {box.resolved}" in result.stderr
-
-
-def test_the_log_line_records_the_version_claude_current_read(box):
-    box.resolver()
-    result = box.start()
-    assert result.returncode == 0, result.stderr
-    assert _claude_fields(box) == [f"claude {VERSION}"], _started_line(box)
-    assert "lane:repoZ-1 → home opensoft/repoZ; " in _started_line(box)
-
-
-def test_a_refusal_ends_the_run_with_2_before_anything_is_written(box):
-    box.resolver()
-    before = box.commits()
-    refused = ("claude-current: REFUSED: npm publishes claude 2.1.284 and the "
-               "newest installed is 2.1.283")
-    result = box.start(FAKE_CC_RC="2", FAKE_CC_STDERR=refused)
-    assert result.returncode == 2, result.stderr
-    assert refused in result.stderr
-    assert "claude-current refused the launch (exit 2" in result.stderr
-    assert "Nothing was written" in result.stderr
-    assert box.claude_runs() == ""
-    assert box.commits() == before
-    assert box.lane_log() == ""
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert "repoZ-1" not in (box.wip / "lanes" / "LANES.md").read_text(encoding="utf-8")
-
-
-@pytest.mark.parametrize("fake", [
-    {"FAKE_CC_RC": "1"},
-    {"FAKE_CC_RC": "64"},
-    {"FAKE_CC_RAW": "not porcelain"},
-    {"FAKE_CC_PATH": "relative/claude"},
-    {"FAKE_CC_PATH": "/nonexistent/claude-current-test/claude"},
-    {"FAKE_CC_PATH": "/"},
-])
-def test_a_resolver_that_names_nothing_runnable_ends_the_run_with_1(box, fake):
-    box.resolver()
-    before = box.commits()
-    result = box.start(**fake)
-    assert result.returncode == 1, result.stderr
-    assert "Nothing was written" in result.stderr
-    assert box.claude_runs() == ""
-    assert box.commits() == before
-
-
-def _bound_elsewhere(box):
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    handoffs = box.root / "handoffs.log"
-    _write(box.bin / "lanes-edit.sh", '''#!/usr/bin/env bash
-case "$1" in
-  binding)
-    [ ! -e "$FAKE_HANDOFF_LOG" ] || exit 8
-    printf 'OtherHost\\tother-container\\t@90\\t2026-10-04T00:00:00Z\\told-session\\tlinux\\telsewhere\\tpresent\\n'; exit 0 ;;
-  request-handoff) printf '%s\\n' "$*" >> "$FAKE_HANDOFF_LOG"; exit "${FAKE_HANDOFF_RC:-2}" ;;
-  lane-agent)
-    if [ -e "$FAKE_HANDOFF_LOG" ] && [ -n "${FAKE_HANDOFF_AGENT:-}" ]; then
-      printf '%s\\n' "$FAKE_HANDOFF_AGENT"; exit 0
-    fi ;;
-esac
-exec "$FAKE_LANES_EDIT" "$@"
-''')
-    box.env.update(FAKE_LANES_EDIT=str(real), FAKE_HANDOFF_LOG=str(handoffs))
-    return handoffs
-
-
-@pytest.mark.parametrize("rc", ["1", "2"])
-@pytest.mark.parametrize("take", [["--request-handoff"], ["--force", "test takeover"]])
-def test_a_resolver_refusal_precedes_a_binding_handoff(box, rc, take):
-    box.resolver()
-    handoffs = _bound_elsewhere(box)
-    before = box.commits()
-    result = box.start(*take, FAKE_CC_RC=rc)
-    assert result.returncode == int(rc), result.stderr
-    assert "claude-current" in result.stderr
-    assert box.resolver_calls()
-    assert not handoffs.exists(), "resolver refusal released or requested the holder"
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-    assert box.lane_log() == ""
-    assert box.claude_runs() == ""
-
-
-def test_a_declined_handoff_resolves_and_updates_nothing(box):
-    box.resolver()
-    handoffs = _bound_elsewhere(box)
-    before = box.commits()
-    result = box.start(LANE_START_HANDOFF_ANSWER="n")
-    assert result.returncode == 2, result.stderr
-    assert "ONE binding" in result.stderr
-    assert box.resolver_calls() == ""
-    assert not handoffs.exists()
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-
-
-@pytest.mark.parametrize("handoff", [False, True])
-def test_a_retired_lane_refuses_before_resolution_or_handoff(box, handoff):
-    box.resolver()
-    handoffs = _bound_elsewhere(box) if handoff else box.root / "handoffs.log"
-    real = box.bin / "lanes-edit-delegate.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", '''#!/usr/bin/env bash
-if [ "$1" = retired-identity ]; then echo 'archived repoZ-1'; exit 0; fi
-exec "$FAKE_RETIRED_DELEGATE" "$@"
-''')
-    before = box.commits()
-    result = box.start(*(["--request-handoff"] if handoff else []),
-                       FAKE_RETIRED_DELEGATE=str(real))
-    assert result.returncode == 2, result.stderr
-    assert "RETIRED" in result.stderr
-    assert box.resolver_calls() == ""
-    assert not handoffs.exists()
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-    assert box.claude_runs() == ""
-
-
-def test_a_new_lane_window_collision_refuses_before_resolution(box):
-    box.resolver()
-    tmux = box.fakebin / "tmux"
-    tmux.write_text(tmux.read_text().replace(
-        '  rename-window)',
-        "  list-windows) printf '@90\\trepoZ-1\\n' ;;\n  rename-window)"))
-    before = box.commits()
-    result = box.start()
-    assert result.returncode == 2, result.stderr
-    assert "another tmux window" in result.stderr
-    assert box.resolver_calls() == ""
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-    assert box.claude_runs() == ""
-
-
-@pytest.mark.parametrize("conflict", ["retired", "window"])
-def test_a_local_conflict_created_during_resolution_still_refuses(box, conflict):
-    box.resolver()
-    if conflict == "retired":
-        real = box.bin / "lanes-edit-delegate.sh"
-        (box.bin / "lanes-edit.sh").rename(real)
-        _write(box.bin / "lanes-edit.sh", '''#!/usr/bin/env bash
-if [ "$1" = retired-identity ] && [ -s "$FAKE_CC_LOG" ]; then
-  echo 'archived repoZ-1'; exit 0
-fi
-exec "$FAKE_LATE_DELEGATE" "$@"
-''')
-        box.env["FAKE_LATE_DELEGATE"] = str(real)
-    else:
-        tmux = box.fakebin / "tmux"
-        tmux.write_text(tmux.read_text().replace(
-            '  rename-window)',
-            "  list-windows) [ ! -s \"$FAKE_CC_LOG\" ] || "
-            "printf '@90\\trepoZ-1\\n' ;;\n  rename-window)"))
-    before = box.commits()
-    result = box.start()
-    assert result.returncode == 2, result.stderr
-    assert box.resolver_calls()
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-    assert box.claude_runs() == ""
-
-
-def test_the_agent_is_read_from_the_completed_handoff(box):
-    box.resolver()
-    _bound_elsewhere(box)
-    _write(box.fakebin / "codex", FAKE_CLAUDE)
-    result = box.start("--request-handoff", FAKE_HANDOFF_RC="0",
-                       FAKE_HANDOFF_AGENT="codex")
-    assert result.returncode == 0, result.stderr
-    assert box.claude_runs().startswith(f"ran {box.fakebin / 'codex'}: ")
-
-
-@pytest.mark.parametrize("place", ["here", "elsewhere"])
-def test_a_lane_bound_during_resolution_is_not_taken(box, place):
-    box.resolver()
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", '''#!/usr/bin/env bash
-if [ "$1" = binding ]; then
-  [ -s "$FAKE_CC_LOG" ] || exit 8
-  printf 'Eagle\\tpy-bench\\t@90\\t2026-10-04T00:00:00Z\\tother-session\\tlinux\\t%s\\tpresent\\n' "$FAKE_BINDING_PLACE"
-  exit 0
-fi
-exec "$FAKE_LANES_EDIT" "$@"
-''')
-    before = box.commits()
-    result = box.start(FAKE_LANES_EDIT=str(real), FAKE_BINDING_PLACE=place)
-    assert result.returncode == 2, result.stderr
-    assert "BOUND AGAIN or changed" in result.stderr
-    assert box.resolver_calls()
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.commits() == before
-    assert box.lane_log() == ""
-    assert box.claude_runs() == ""
-
-
-def test_a_launchers_verified_version_is_trusted_recorded_and_removed(box):
-    """claude-profile ran its own claude-current and hands on all three."""
-    box.resolver()
-    result = box.start(CLAUDE_BIN=str(box.resolved),
-                       CLAUDE_RESOLVED_BIN=str(box.resolved),
-                       CLAUDE_VERIFIED_VERSION="2.1.290")
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == ""
-    runs = box.claude_runs()
-    assert runs.startswith(f"ran {box.resolved}: --name {LANE}"), runs
-    assert "env CLAUDE_VERIFIED_VERSION=<unset>\n" in runs
-    assert _claude_fields(box) == ["claude 2.1.290"], _started_line(box)
-
-
-def test_an_operator_pin_is_launched_as_it_is_and_records_no_version(box):
-    box.resolver()
-    pinned = _write(box.root / "pinned" / "claude", FAKE_CLAUDE)
-    result = box.start(CLAUDE_BIN=str(pinned))
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == ""
-    assert box.claude_runs().startswith(f"ran {pinned}: --name {LANE}")
-    assert _claude_fields(box) == [], _started_line(box)
-
-
-def test_a_version_beside_a_different_resolved_path_is_not_the_pins(box):
-    """CLAUDE_VERIFIED_VERSION describes CLAUDE_RESOLVED_BIN. A CLAUDE_BIN
-    that is some other path is a pin, and that version is not its version."""
-    box.resolver()
-    pinned = _write(box.root / "pinned" / "claude", FAKE_CLAUDE)
-    result = box.start(CLAUDE_BIN=str(pinned),
-                       CLAUDE_RESOLVED_BIN=str(box.resolved),
-                       CLAUDE_VERIFIED_VERSION="2.1.290")
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == ""
-    assert "env CLAUDE_VERIFIED_VERSION=<unset>\n" in box.claude_runs()
-    assert _claude_fields(box) == [], _started_line(box)
-
-
-def test_an_inherited_resolution_is_resolved_again(box):
-    """A session's own environment carries CLAUDE_BIN and CLAUDE_RESOLVED_BIN
-    from the launch that started it. A launch from inside it is not pinned."""
-    stub = box.resolver()
-    old = _write(box.root / "old" / "claude", FAKE_CLAUDE)
-    result = box.start(CLAUDE_BIN=str(old), CLAUDE_RESOLVED_BIN=str(old))
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == f"{stub} --porcelain\n"
-    assert box.claude_runs().startswith(f"ran {box.resolved}: --name {LANE}")
-    assert _claude_fields(box) == [f"claude {VERSION}"], _started_line(box)
-
-
-def test_dry_run_plans_the_resolution_and_runs_nothing(box):
-    stub = box.resolver()
-    before = box.commits()
-    result = box.start("--dry-run")
-    assert result.returncode == 0, result.stderr
-    assert f"lane-start: PLAN {stub} --porcelain" in result.stderr
-    assert box.resolver_calls() == ""
-    assert box.claude_runs() == ""
-    assert box.commits() == before
-
-
-def test_no_launch_resolves_nothing(box):
-    """The first act inside a running session: nothing is launched, so there
-    is nothing to choose, and nothing may be updated under the session."""
-    box.resolver()
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    assert result.stdout.startswith(f"claude --name {LANE}"), result.stdout
-    assert box.resolver_calls() == ""
-    assert box.claude_runs() == ""
-
-
-def test_no_resolver_beside_it_launches_the_path_claude_and_says_so(box):
-    """The lane suite's shape: `lane-start` copied without claude-current.
-    The decoy on PATH proves the resolver is never looked for there."""
-    result = box.start()
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == ""
-    assert box.claude_runs().startswith(f"ran {box.path_claude}: --name {LANE}")
-    assert "no claude-current beside this command" in result.stderr
-    assert _claude_fields(box) == [], _started_line(box)
-
-
-def test_the_resolver_is_found_in_the_bin_dir_when_not_beside_it(box):
-    elsewhere = box.root / "installed"
-    stub = box.resolver(elsewhere)
-    result = box.start(OPENREPOTOOLS_BIN_DIR=str(elsewhere))
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == f"{stub} --porcelain\n"
-    assert box.claude_runs().startswith(f"ran {box.resolved}: --name {LANE}")
-
-
-def test_a_version_that_is_not_one_is_left_off_the_log_line(box):
-    box.resolver()
-    result = box.start(FAKE_CC_VERSION="2.1; rm")
-    assert result.returncode == 0, result.stderr
-    assert "is not x.y.z" in result.stderr
-    assert _claude_fields(box) == [], _started_line(box)
-
-
-def test_another_agent_never_asks_claude_current(box):
-    box.resolver()
-    _write(box.fakebin / "codex", FAKE_CLAUDE)
-    result = box.start("--agent", "codex")
-    assert result.returncode == 0, result.stderr
-    assert box.resolver_calls() == ""
-    assert box.claude_runs().startswith(f"ran {box.fakebin / 'codex'}: ")
-
-
-def test_a_confirm_answered_no_launches_the_resolved_claude_bare(box):
-    """Copilot on #134: the bare launch a `--confirm` answered No takes came
-    before the resolution and started `claude` from PATH. It resolves too."""
-    stub = box.resolver()
-    before = box.commits()
-    result = box.start("--confirm", LANE_START_ANSWER="n")
-    assert result.returncode == 0, result.stderr
-    assert "is NOT taken" in result.stderr
-    assert box.resolver_calls() == f"{stub} --porcelain\n"
-    runs = box.claude_runs()
-    assert runs.startswith(f"ran {box.resolved}: \n"), runs
-    assert f"env CLAUDE_RESOLVED_BIN={box.resolved}\n" in runs
-    assert box.commits() == before
-
-
-def test_a_confirm_answered_no_is_refused_when_stale(box):
-    box.resolver()
-    before = box.commits()
-    result = box.start("--confirm", LANE_START_ANSWER="n", FAKE_CC_RC="2")
-    assert result.returncode == 2, result.stderr
-    assert "claude-current refused the launch (exit 2" in result.stderr
-    assert box.claude_runs() == ""
-    assert box.commits() == before
diff --git a/tests/test_lane_start_hardening_138.py b/tests/test_lane_start_hardening_138.py
deleted file mode 100644
index 17a3ae25..00000000
--- a/tests/test_lane_start_hardening_138.py
+++ /dev/null
@@ -1,358 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-start`'s three fail-open fences from opensoft/openRepoTools#138
-(items 3, 14 and 16), each proved through a real `lane-start` in the sandbox
-`tests/test_lane_start_claude_current.py` builds: a bare origin, a workspace
-clone holding the register, and a fake `tmux` on PATH. Nothing here reaches a
-real tmux server, a real Claude Code or the network.
-
-The fake `tmux` is STATEFUL, because two of the three items are about what the
-server's window names are at a given moment: `$FAKE_TMUX_STATE` holds one
-`<@id><TAB><name>` line per window, this window is `@1`, `list-windows` prints
-the file and `rename-window` edits it.
-
-  item 3   the window-name uniqueness check and the rename ran under no shared
-           reservation, so two concurrent starts could both take a name. The
-           rename is now read back: a name another window also carries after it
-           is refused, and this window's own rename undone.
-  item 14  the retired-identity fence asked only the ARCHIVE, so a row RETIRED
-           in `lanes/LANES.md`, or a log ending on RETIRED, passed. ENDED is
-           not terminal (Amendment 18(b): it releases the binding) and an
-           ENDED lane is still resumed.
-  item 16  the new-lane window-name fence skipped THIS window, so a new lane
-           started from a window still named for another registered lane took
-           that lane's tmux address.
-"""
-
-from __future__ import annotations
-
-import re
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, _write, pytestmark  # noqa: F401
-
-SID = "aaaa0138-1111-4000-8000-aaaa01381111"
-
-FAKE_TMUX = r"""#!/usr/bin/env bash
-# The sandbox's tmux server, as a file: one `<@id><TAB><name>` line per window,
-# and this window is @1. `$FAKE_TMUX_RIVAL` names a window whose own lane-start
-# renames it to the same name the instant before this run's rename lands (once).
-st="$FAKE_TMUX_STATE"
-name_of() { awk -F'\t' -v w="$1" '$1 == w { print $2; exit }' "$st"; }
-set_name() {
-  awk -F'\t' -v OFS='\t' -v w="$1" -v n="$2" '$1 == w { $2 = n } { print }' "$st" > "$st.new" &&
-    mv -f "$st.new" "$st"
-}
-case "${1-}" in
-  list-windows)
-    if [ -n "${FAKE_TMUX_LIST_FAILS_AFTER_RENAME:-}" ] &&
-       command grep -q '^rename-window' "$FAKE_TMUX_LOG"; then
-      exit 1
-    fi
-    cat "$st" ;;
-  display-message)
-    shift
-    t=""; f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -p) shift ;;
-        -t) t="${2-}"; shift 2 ;;
-        *)  f="$1"; shift ;;
-      esac
-    done
-    if [ -n "$t" ]; then
-      case "$t" in
-        testsess:0|testsess:@1|@1) : ;;
-        *) exit 1 ;;
-      esac
-    fi
-    case "$f" in
-      '#{session_name}:#{window_id}')    echo 'testsess:@1' ;;
-      '#{session_name}:#{window_index}') echo 'testsess:0' ;;
-      '#S:#I')                           echo 'testsess:0' ;;
-      '#{session_name}')                 echo 'testsess' ;;
-      '#{window_id}')                    echo '@1' ;;
-      '#W'|'#{window_name}')             name_of @1 ;;
-      '#{pane_current_command}')         echo 'claude' ;;
-      *)                                 echo ;;
-    esac ;;
-  rename-window)
-    shift
-    [ "${1-}" != -t ] || shift 2
-    printf 'rename-window %s\n' "${1-}" >> "$FAKE_TMUX_LOG"
-    if [ -n "${FAKE_TMUX_RIVAL:-}" ] && [ ! -e "$st.raced" ]; then
-      : > "$st.raced"
-      set_name "$FAKE_TMUX_RIVAL" "${1-}"
-    fi
-    set_name @1 "${1-}" ;;
-  show-options)
-    printf '%s\n' "${FAKE_TMUX_AUTO_RENAME-}" ;;
-  set-option|set-window-option)
-    printf '%s\n' "$*" >> "$FAKE_TMUX_LOG" ;;
-  *) : ;;
-esac
-"""
-
-
-class Box(Sandbox):
-    """The claude-current sandbox, with the stateful tmux above."""
-
-    def __init__(self, root: Path) -> None:
-        super().__init__(root)
-        self.tmux_state = root / "tmux-windows"
-        _write(self.fakebin / "tmux", FAKE_TMUX)
-        self.windows({"@1": "claude"})
-        self.env["FAKE_TMUX_STATE"] = str(self.tmux_state)
-
-    def windows(self, names: dict[str, str] | None = None) -> dict[str, str]:
-        if names is not None:
-            self.tmux_state.write_text(
-                "".join(f"{w}\t{n}\n" for w, n in names.items()), encoding="utf-8")
-        return dict(line.split("\t", 1) for line in
-                    self.tmux_state.read_text(encoding="utf-8").splitlines())
-
-    def tmux_calls(self) -> str:
-        return self.tmux_log.read_text(encoding="utf-8")
-
-    def register(self) -> Path:
-        return self.wip / "lanes" / "LANES.md"
-
-    def row_state(self, lane: str) -> str:
-        line = next(ln for ln in self.register().read_text(encoding="utf-8").splitlines()
-                    if ln.startswith(f"| `{lane}`"))
-        return line.split("|")[-2].strip()
-
-    def transcript(self, sid: str = SID) -> None:
-        """The row's session as a transcript here, so a start resumes it by id."""
-        key = re.sub(r"[^A-Za-z0-9]", "-", str(self.lane_dir))
-        _write(self.home / ".claude" / "projects" / key / f"{sid}.jsonl",
-               '{"type":"user"}\n', 0o644)
-
-    def seed(self, rows=(), logs=None, push=True) -> None:
-        """Append rows to the register and write object logs, in one commit."""
-        reg = self.register()
-        reg.write_text(reg.read_text(encoding="utf-8")
-                       + "".join(r + "\n" for r in rows), encoding="utf-8")
-        paths = ["lanes/LANES.md"]
-        for lane, verbs in (logs or {}).items():
-            _write(self.wip / "lanes" / "log" / f"{lane}.md",
-                   log_text(lane, verbs, self.lane_dir), 0o644)
-            paths.append(f"lanes/log/{lane}.md")
-        self.git("-C", str(self.wip), "add", "--", *paths)
-        self.git("-C", str(self.wip), "commit", "-q", "-m", "seed #138 rows")
-        if push:
-            self.git("-C", str(self.wip), "push", "-q", "origin", "main")
-
-    def wrap_helper(self, case_arms: str) -> None:
-        """Put a `lanes-edit.sh` in front of the real one, answering the given
-        `case "$1:${2-}"` arms itself and delegating everything else."""
-        real = self.bin / "lanes-edit-real.sh"
-        (self.bin / "lanes-edit.sh").rename(real)
-        _write(self.bin / "lanes-edit.sh", f'''#!/usr/bin/env bash
-case "$1:${{2-}}" in
-{case_arms}
-esac
-exec "{real}" "$@"
-''')
-
-
-def row(lane: str, state: str) -> str:
-    return (f"| `{lane}` | harness `{SID}` | Eagle / test / brett | 2026-09-11T00:00Z "
-            f"| none | handoffs/repoZ/x.md | {state} |")
-
-
-def log_text(lane: str, verbs, lane_dir: Path) -> str:
-    lines = [f"# lane {lane} — object log (lane-collision-protocol Amendment 7)"]
-    for i, verb in enumerate(verbs):
-        head = f"{verb} — lane {lane}, session {SID}@Eagle, 2026-09-12T{9 + i:02d}:00:00Z, lane:{lane}"
-        if verb in ("STARTED", "RESUMED"):
-            lines.append(f"{head} → home opensoft/repoZ; estate repoZ; dir {lane_dir}")
-        elif verb == "PAUSED":
-            lines.append(f"{head} → swap; dir {lane_dir}; workstation Eagle")
-        else:
-            lines.append(f"{head} — closed in the #138 sandbox")
-    return "\n".join(lines) + "\n"
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Box:
-    return Box(tmp_path)
-
-
-def nothing_done(box: Box, before: int, result: subprocess.CompletedProcess) -> None:
-    assert box.commits() == before, result.stderr
-    assert box.claude_runs() == ""
-    assert result.stdout == ""
-
-
-# ------------------------------------------------------------------- item 3
-
-def test_item3_a_name_another_window_took_during_the_rename_is_given_back(box):
-    """Two starts of one new lane in two windows: the rival's rename lands
-    between this run's last check and its own rename. Read back, the name is
-    on two windows, so this run refuses and undoes ITS rename."""
-    box.windows({"@1": "claude", "@2": "zsh"})
-    before = box.commits()
-    result = box.start("--no-launch", FAKE_TMUX_RIVAL="@2")
-    assert result.returncode == 2, result.stderr
-    assert box.windows() == {"@1": "claude", "@2": LANE}, box.tmux_calls()
-    assert "rename-window claude" in box.tmux_calls()
-    assert "@2" in result.stderr
-    nothing_done(box, before, result)
-    assert LANE not in box.register().read_text(encoding="utf-8")
-    assert box.lane_log() == ""
-
-
-def test_item3_the_undo_restores_automatic_rename_when_the_window_had_it(box):
-    box.windows({"@1": "claude", "@2": "zsh"})
-    result = box.start("--no-launch", FAKE_TMUX_RIVAL="@2", FAKE_TMUX_AUTO_RENAME="")
-    assert result.returncode == 2, result.stderr
-    assert "set-option -w -u automatic-rename" in box.tmux_calls()
-
-
-def test_item3_a_window_with_no_name_to_go_back_to_says_the_undo_was_not_made(box):
-    box.windows({"@1": "", "@2": "zsh"})
-    before = box.commits()
-    result = box.start("--no-launch", FAKE_TMUX_RIVAL="@2")
-    assert result.returncode == 2, result.stderr
-    assert "could NOT be undone" in result.stderr
-    assert "rename is undone" not in result.stderr
-    assert box.tmux_calls().count("rename-window") == 1, box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-def test_item3_a_read_back_that_fails_is_not_a_name_that_is_free(box):
-    before = box.commits()
-    result = box.start("--no-launch", FAKE_TMUX_LIST_FAILS_AFTER_RENAME="1")
-    assert result.returncode == 2, result.stderr
-    assert box.windows() == {"@1": "claude"}, box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-def test_item3_an_uncontested_rename_is_kept(box):
-    box.windows({"@1": "claude", "@2": "zsh"})
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    assert box.windows() == {"@1": LANE, "@2": "zsh"}
-    assert "set-option" not in box.tmux_calls()
-
-
-# ------------------------------------------------------------------ item 14
-
-RETIRED_CELL = "RETIRED · 2026-10-01T00:00:00Z · swept as dormant"
-ENDED_CELL = "ENDED · 2026-10-01T00:00:00Z · lane-end on Eagle: window closing"
-PAUSED_CELL = "PAUSED · 2026-10-01T00:00:00Z · swapped"
-
-
-@pytest.mark.parametrize("cell, verbs", [
-    (RETIRED_CELL, ("STARTED", "RETIRED")),
-    (RETIRED_CELL, ()),
-    (PAUSED_CELL, ("STARTED", "RETIRED")),
-])
-def test_item14_a_retired_lane_still_in_the_register_is_not_started(box, cell, verbs):
-    """No archive row exists, so `retired-identity` answers 8: only the row's
-    state cell or its log's last lane-kind line says the lane is retired."""
-    box.seed([row(LANE, cell)], {LANE: verbs} if verbs else None)
-    box.transcript()
-    before = box.commits()
-    result = box.start("--no-launch")
-    assert result.returncode == 2, result.stderr
-    assert "RETIRED" in result.stderr
-    assert "rename-window" not in box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-@pytest.mark.parametrize("cell, verbs", [
-    (ENDED_CELL, ()),
-    (PAUSED_CELL, ("STARTED", "PAUSED", "ENDED")),
-    (PAUSED_CELL, ("STARTED", "PAUSED")),
-])
-def test_item14_an_ended_or_paused_lane_is_still_resumed(box, cell, verbs):
-    """ENDED is "the window is closing", not "the lane is not coming back": it
-    releases the binding as a PAUSED does (Amendment 18(b)), and the lane is
-    resumed by its recorded session."""
-    box.seed([row(LANE, cell)], {LANE: verbs} if verbs else None)
-    box.transcript()
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    assert f"--resume {SID}" in result.stdout
-    assert box.windows() == {"@1": LANE}
-    assert box.row_state(LANE).startswith("LIVE · "), box.row_state(LANE)
-    assert box.lane_log().splitlines()[-1].startswith(f"RESUMED — lane {LANE}, session {SID}@")
-
-
-def test_item14_a_retirement_this_checkout_has_not_pushed_is_still_one(box):
-    box.seed([row(LANE, "PAUSED · 2026-10-01T00:00:00Z · swapped")],
-             {LANE: ("STARTED", "PAUSED")})
-    reg = box.register()
-    reg.write_text(reg.read_text(encoding="utf-8").replace(
-        "PAUSED · 2026-10-01T00:00:00Z · swapped",
-        "RETIRED · 2026-10-02T00:00:00Z · retired here, not pushed"), encoding="utf-8")
-    box.git("-C", str(box.wip), "commit", "-q", "-am", "unpushed retirement")
-    before = box.commits()
-    result = box.start("--no-launch")
-    assert result.returncode == 2, result.stderr
-    assert "RETIRED" in result.stderr
-    assert "rename-window" not in box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-def test_item14_a_log_that_cannot_be_read_is_not_a_lane_that_is_open(box):
-    box.seed([row(LANE, "PAUSED · 2026-10-01T00:00:00Z · swapped")],
-             {LANE: ("STARTED", "PAUSED")})
-    box.wrap_helper("  lane-last:*) exit 1 ;;")
-    before = box.commits()
-    result = box.start("--no-launch")
-    assert result.returncode == 1, result.stderr
-    assert "lane-last" in result.stderr
-    assert "rename-window" not in box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-# ------------------------------------------------------------------ item 16
-
-OTHER = "repoY-1"
-
-
-def test_item16_a_new_lane_does_not_take_another_lanes_window(box):
-    box.seed([row(OTHER, "PAUSED · 2026-10-01T00:00:00Z · swapped")])
-    box.windows({"@1": OTHER})
-    before = box.commits()
-    result = box.start("--no-launch")
-    assert result.returncode == 2, result.stderr
-    assert OTHER in result.stderr
-    assert box.windows() == {"@1": OTHER}
-    assert "rename-window" not in box.tmux_calls()
-    nothing_done(box, before, result)
-    assert f"`{LANE}`" not in box.register().read_text(encoding="utf-8")
-
-
-def test_item16_a_row_only_this_checkout_has_still_names_the_window(box):
-    box.seed([row(OTHER, "LIVE · 2026-10-01T00:00:00Z · started")], push=False)
-    box.windows({"@1": OTHER})
-    result = box.start("--no-launch")
-    assert result.returncode == 2, result.stderr
-    assert OTHER in result.stderr
-    assert "rename-window" not in box.tmux_calls()
-
-
-@pytest.mark.parametrize("which", ["register-row", "register-row-local"])
-def test_item16_a_window_name_read_that_fails_refuses(box, which):
-    box.windows({"@1": OTHER})
-    box.wrap_helper(f"  {which}:{OTHER}) exit 1 ;;")
-    before = box.commits()
-    result = box.start("--no-launch")
-    assert result.returncode == 1, result.stderr
-    assert which in result.stderr
-    assert "rename-window" not in box.tmux_calls()
-    nothing_done(box, before, result)
-
-
-@pytest.mark.parametrize("name", ["zsh", "my notes", LANE.upper()])
-def test_item16_a_generic_or_unregistered_window_name_is_reused(box, name):
-    box.windows({"@1": name})
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    assert box.windows() == {"@1": LANE}
diff --git a/tests/test_lane_start_row_stamp.py b/tests/test_lane_start_row_stamp.py
deleted file mode 100644
index ee451e9e..00000000
--- a/tests/test_lane_start_row_stamp.py
+++ /dev/null
@@ -1,273 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-start`'s row stamp under a long checkout path (opensoft/openRepoTools#180).
-
-THE STAMP'S TAIL IS THE PART A CUT TAKES, AND THAT IS THE DESIGN. Amendment
-11(c) puts the lane's `dir` and `window` in the tail of the stamp a resume
-writes; Amendment 13(a) makes the cell ONE line under ratified decision O1's
-240 characters; and `lane-start` orders that line so `cut_to_line` takes `dir`
-and `window` first, because both are this same act's sub-fields in the lane's
-own log and columns of Amendment 11's listing — a cut loses what a reader can
-look up, never the head `row_stamp_is_unknown` reads.
-
-So the tail's length is the CHECKOUT PATH's length, and #180 was a shell-suite
-case that put its checkout under `$HOME/projects` inside the run root: green
-under plain pytest's short `/tmp`, red under `tests/run.sh`'s per-run root
-(`TMPDIR` about 71 characters, so a `$HOME` about 91). These cases drive a real
-`lane-start` twice, `--no-launch`, in that shape — a `$HOME` at least as long
-as `run.sh`'s — with the checkout at three EXACT lengths, so the answer does not
-depend on where pytest itself was run:
-
-  * a short checkout keeps the whole tail, however long `$HOME` is — which is
-    what `tests/test_lane_helpers.sh`'s clause (c) TAIL case now uses, on a
-    checkout of at most 65 characters;
-  * a checkout whose path still fits loses only the `window` ref;
-  * a longer one loses the path WHOLE, never a truncated path that reads as a
-    real one. That is what #180's case read under `run.sh`'s root:
-    `… window renamed, no launch; dir ...`, its cut landing on the `;` that
-    follows the path, so the path went with it;
-
-and in every one the head is intact, the line is inside the cap, and the
-lane's log carries both facts in full.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-import tempfile
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP, rmtree
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="lane-start is a bash script"),
-              pytest.mark.skipif(shutil.which("git") is None,
-                                 reason="the register is a git repository"),
-              WINDOWS_SKIP]
-
-LANE = "repoZ-1"
-WINDOW = "testsess:0 @1"
-
-#: `tests/run.sh`'s `$HOME` for the shell suite, as #180 measured it: a run
-#: root `TMPDIR` of about 71 characters, the suite's `mktemp -d` beneath it
-#: (`/tmp.XXXXXXXXXX`, 15) and `/home` (5).
-RUN_SH_HOME = 91
-
-SCRUBBED_PREFIXES = ("LANES_", "LANE_START_", "CLAUDE_", "OPENREPOTOOLS_",
-                     "FAKE_", "GIT_", "TMUX")
-SCRUBBED = {"AGENT_PROTOCOL_ROOT", "PROJECTS_ROOT", "XDG_CONFIG_HOME",
-            "XDG_CACHE_HOME"}
-
-#: The lane suite's fake tmux, cut down to one window, `testsess:0 @1`, whose
-#: name is `$FAKE_TMUX_WINDOW_NAME` — `claude` on a first start and the lane
-#: on the second, as a window lane-start renamed would answer.
-FAKE_TMUX = r"""#!/usr/bin/env bash
-case "${1-}" in
-  display-message)
-    shift
-    t=""; f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in
-        -p) shift ;;
-        -t) t="${2-}"; shift 2 ;;
-        *)  f="$1"; shift ;;
-      esac
-    done
-    if [ -n "$t" ]; then
-      case "$t" in
-        testsess:0|testsess:@1|@1) : ;;
-        *) exit 1 ;;
-      esac
-      case "$f" in
-        '#{window_id}')            echo '@1' ;;
-        '#{window_name}')          echo "${FAKE_TMUX_WINDOW_NAME:-claude}" ;;
-        '#{session_name}')         echo 'testsess' ;;
-        '#{pane_current_command}') echo 'claude' ;;
-        *)                         echo ;;
-      esac
-      exit 0
-    fi
-    case "$f" in
-      '#{session_name}:#{window_id}')    echo 'testsess:@1' ;;
-      '#{session_name}:#{window_index}') echo 'testsess:0' ;;
-      '#S:#I')                           echo 'testsess:0' ;;
-      '#{window_id}')                    echo '@1' ;;
-      '#W'|'#{window_name}')             echo "${FAKE_TMUX_WINDOW_NAME:-claude}" ;;
-      *)                                 echo ;;
-    esac ;;
-  rename-window)
-    printf 'rename-window %s\n' "${2-}" >> "$FAKE_TMUX_LOG" ;;
-  *) : ;;
-esac
-"""
-
-#: The workspace repository's first commit: a register with its header and no
-#: rows, and the handoffs directory a row's handoff path points into.
-WORKSPACE_SEED = {
-    "lanes/LANES.md": "\n".join((
-        "# LANES.md -- the sandbox register", "",
-        "| lane | session id | workstation / env / user | started (UTC) | "
-        "objects owned | handoff path | state |",
-        "|---|---|---|---|---|---|---|", "")),
-    "handoffs/README.md": "# handoffs\n",
-}
-
-FAKE_GH = """#!/usr/bin/env bash
-printf 'FAKE gh REFUSED: %s -- this suite reaches no GitHub surface\\n' "$*" >&2
-exit 90
-"""
-
-
-def _write(path: Path, text: str) -> None:
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(text, encoding="utf-8")
-    path.chmod(0o755)
-
-
-class Sandbox:
-    """One workstation, one register, and a `$HOME` at least `run.sh`'s length."""
-
-    def __init__(self, tmp_path: Path) -> None:
-        pad = max(0, RUN_SH_HOME - len(str(tmp_path / "r" / "home")))
-        self.root = tmp_path / ("r" * (pad + 1))
-        self.home = self.root / "home"
-        assert len(str(self.home)) >= RUN_SH_HOME
-        self.bin = self.root / "bin"
-        fakebin = self.root / "fakebin"
-        origin = self.root / "origin.git"
-        self.wip = self.home / "projects" / "wip"
-        for d in (self.home / "projects", self.root / "tmp", fakebin, self.bin,
-                  self.home / ".claude" / "sessions", self.home / ".agents"):
-            d.mkdir(parents=True, exist_ok=True)
-
-        env = {k: v for k, v in os.environ.items()
-               if k not in SCRUBBED and not k.startswith(SCRUBBED_PREFIXES)}
-        env.update({
-            "HOME": str(self.home),
-            "TMPDIR": str(self.root / "tmp"),
-            "XDG_CONFIG_HOME": str(self.home / ".config"),
-            "XDG_CACHE_HOME": str(self.home / ".cache"),
-            "PATH": f"{fakebin}{os.pathsep}{self.bin}{os.pathsep}{env.get('PATH', '')}",
-            "TMUX": f"{self.root}/fake-tmux-socket,0,0",
-            "AGENT_PROTOCOL_ROOT": str(self.home / ".agents"),
-            "OPENREPOTOOLS_BIN_DIR": str(self.bin),
-            "CLAUDE_CONFIG_DIR": str(self.home / ".claude"),
-            "LANES_WORKSTATION": "Eagle",
-            "LANES_NO_GITHUB": "1",
-            "LANES_INDEX": "off",
-            "FAKE_TMUX_LOG": str(self.root / "tmux.log"),
-            "GIT_AUTHOR_NAME": "lane-start row stamp tests",
-            "GIT_AUTHOR_EMAIL": "test@example.invalid",
-            "GIT_COMMITTER_NAME": "lane-start row stamp tests",
-            "GIT_COMMITTER_EMAIL": "test@example.invalid",
-        })
-        self.env = env
-
-        for name in ("lane-start", "lanes-edit.sh", "repos.tsv"):
-            shutil.copy2(REPO / name, self.bin / name)
-            (self.bin / name).chmod(0o755)
-        _write(fakebin / "tmux", FAKE_TMUX)
-        _write(fakebin / "gh", FAKE_GH)
-        _write(fakebin / "claude", "#!/usr/bin/env bash\nexit 0\n")
-
-        self.git("init", "-q", "--bare", "-b", "main", str(origin))
-        self.git("clone", "-q", str(origin), str(self.wip))
-        for rel, text in WORKSPACE_SEED.items():
-            (self.wip / rel).parent.mkdir(parents=True, exist_ok=True)
-            (self.wip / rel).write_text(text, encoding="utf-8")
-        for step in (("add", "--", *WORKSPACE_SEED), ("commit", "-q", "-m", "seed"),
-                     ("push", "-q", "origin", "main")):
-            self.git("-C", str(self.wip), *step)
-        (self.home / ".agents" / "workspace.yaml").write_text(
-            f"repository: {origin}\npath: {self.wip}\n", encoding="utf-8")
-
-    def git(self, *args: str) -> str:
-        return subprocess.run(["git", *args], env=self.env, check=True,
-                              capture_output=True, text=True).stdout
-
-    def checkout(self, path: Path) -> None:
-        self.git("init", "-q", "-b", "main", str(path))
-        self.git("-C", str(path), "remote", "add", "origin",
-                 "https://github.com/opensoft/repoZ.git")
-
-    def start(self, *args: str, window_name: str) -> subprocess.CompletedProcess:
-        return subprocess.run([str(self.bin / "lane-start"), "repoZ", "1",
-                               "--no-launch", *args],
-                              env=dict(self.env, FAKE_TMUX_WINDOW_NAME=window_name),
-                              capture_output=True, text=True, timeout=120,
-                              check=False)
-
-    def stamp_line(self) -> str:
-        """The `<one line>` of the row's `<STATE> · <UTC> · <one line>` cell."""
-        rows = [r for r in (self.wip / "lanes" / "LANES.md")
-                .read_text(encoding="utf-8").splitlines()
-                if r.startswith(f"| `{LANE}`")]
-        assert len(rows) == 1, rows
-        cell = rows[0].rstrip().rstrip("|").rstrip().rsplit(" | ", 1)[1]
-        state, _utc, line = cell.split(" · ", 2)
-        assert state == "LIVE", cell
-        return line
-
-    def last_log_line(self) -> str:
-        return (self.wip / "lanes" / "log" / f"{LANE}.md").read_text(
-            encoding="utf-8").splitlines()[-1]
-
-
-@pytest.fixture
-def short_root():
-    """A short, FIXED-length directory outside the run root: `/tmp/` and
-    `mkdtemp`'s name, whatever `TMPDIR` or pytest's basetemp say."""
-    root = Path(tempfile.mkdtemp(prefix="ort-tail.", dir="/tmp"))
-    try:
-        yield root
-    finally:
-        rmtree(root)
-
-
-def _checkout_of_length(root: Path, length: int | None) -> Path:
-    """`<root>/repoZ`, padded between the two to exactly `length` characters."""
-    if length is None:
-        return root / "repoZ"
-    pad = length - len(str(root)) - len("/repoZ") - 1
-    assert pad > 0, (root, length)
-    path = root / ("p" * pad) / "repoZ"
-    assert len(str(path)) == length
-    return path
-
-
-@pytest.mark.parametrize("length, keeps", [
-    pytest.param(None, "dir and window", id="short-fixed-checkout"),
-    pytest.param(100, "dir", id="window-cut-dir-kept"),
-    pytest.param(160, "nothing", id="path-dropped-whole-as-in-180"),
-])
-def test_the_stamp_tail_is_cut_by_the_checkout_path_and_never_the_head(
-        tmp_path, short_root, length, keeps):
-    box = Sandbox(tmp_path)
-    lane_dir = _checkout_of_length(short_root, length)
-    box.checkout(lane_dir)
-
-    first = box.start("--dir", str(lane_dir), window_name="claude")
-    assert first.returncode == 0, first.stderr
-    # THE SECOND START STAMPS (Amendment 6(c)), and it finds the checkout in
-    # the lane's own log, exactly as the shell suite's case does.
-    second = box.start(window_name=LANE)
-    assert second.returncode == 0, second.stderr
-    line = box.stamp_line()
-
-    assert len(line) <= 240, line
-    assert (f"(lane {LANE}) — lane-start on Eagle: window renamed, "
-            f"no launch; dir ") in line, line
-    if keeps == "dir and window":
-        assert line.endswith(f"; dir {lane_dir}; window {WINDOW}"), line
-    elif keeps == "dir":
-        assert f"; dir {lane_dir};" in line and line.endswith(" ..."), line
-        assert WINDOW not in line, line
-    else:
-        assert line.endswith("no launch; dir ..."), line
-        assert str(short_root) not in line, line
-
-    # NOTHING IS LOST: what the cut took is this act's own log line.
-    assert f"; dir {lane_dir}; window {WINDOW}; " in box.last_log_line()
diff --git a/tests/test_lane_worktrees.py b/tests/test_lane_worktrees.py
deleted file mode 100644
index 910c1c80..00000000
--- a/tests/test_lane_worktrees.py
+++ /dev/null
@@ -1,2815 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-worktrees sweep` - one act that archives, rescues and removes a lane's
-abandoned worktrees (opensoft/openRepoTools#162).
-
-What these tests hold it to, row for row with the issue's disposition table:
-
-  * a tree a LIVE writer stands in is never touched;
-  * clean and MERGED (by the register's LANDED line or `gh`, never by
-    ancestry alone) is removed with its branches;
-  * clean and pushed is removed and its branch stays;
-  * unpushed commits are pushed as is - or, where origin diverged, to a
-    rescue branch - and only then removed;
-  * dirty or untracked work becomes a WIP commit on a rescue branch, pushed,
-    then removed; detached with commits of its own is rescued the same way;
-  * a registration whose directory is gone is pruned;
-  * a FOREIGN tree is reported and left;
-  * the rescue is ON ORIGIN before anything is removed - a refused push leaves
-    the tree exactly as it was;
-  * the dry run changes nothing at all;
-  * `--yes` is refused for a lane bound elsewhere (Amendment 18(b));
-  * `--branches`, `--links`, alternates, `--expire` and the porcelain exit
-    codes `lane-end`'s gate (#163) reads.
-
-NOTHING REAL IS SWEPT. Every estate is built under `tmp_path`: bare
-repositories stand in for origin (reached through a `url.<path>.insteadOf` for
-a GitHub-shaped URL, so the code under test reads a real `owner/repo` slug),
-`gh`, `tmux` and `lanes-edit.sh` are fakes on `PATH`, and the sandbox sweep is
-pointed at a root of its own. One case runs the REAL `lanes-edit.sh` against a
-fixture workspace, so the inventory, the reconciliation and the register line
-are the helper's own.
-"""
-
-from __future__ import annotations
-
-import datetime as _dt
-import getpass
-import hashlib
-import json
-import os
-import shlex
-import shutil
-import signal
-import subprocess
-import sys
-import tarfile
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("git") is None or shutil.which("bash") is None,
-    reason="the sweep drives git, and the lane helper is bash")]
-
-LW = REPO / "lane-worktrees"
-LANES_EDIT = REPO / "lanes-edit.sh"
-LANE = "repoA-1"
-ME = "11111111-1111-4111-8111-111111111111"
-OTHER = "22222222-2222-4222-8222-222222222222"
-#: The session that recorded the inventory: an EARLIER one, which the fake
-#: `transcript-holders` answers is not live. A tree THIS session (ME) recorded
-#: wants the coordinator's writer count under `--yes` (#170 B5).
-WRITER = "44444444-4444-4444-8444-444444444444"
-SLUG = "opensoft/repoA"
-GH_URL = f"git@github.com:{SLUG}.git"
-US = "\x1f"
-
-FAKE_HELPER = r'''#!/usr/bin/env python3
-import json, os, sys
-spec = json.load(open(os.environ["FAKE_HELPER_SPEC"]))
-args = sys.argv[1:]
-with open(os.environ["FAKE_HELPER_LOG"], "a") as fh:
-    fh.write(json.dumps({"argv": args, "lane": os.environ.get("LANES_LANE", ""),
-                         "no_fetch": os.environ.get("LANES_NO_FETCH", ""),
-                         "session": os.environ.get("LANES_SESSION", "")}) + "\n")
-ans = spec.get(args[0] if args else "", {"rc": 2, "err": "unknown subcommand\n"})
-sys.stdout.write(ans.get("out", ""))
-sys.stderr.write(ans.get("err", ""))
-sys.exit(ans.get("rc", 0))
-'''
-
-FAKE_GH = r'''#!/usr/bin/env python3
-# `gh pr list` as GitHub answers it: `--head` filters by head branch, and
-# `--limit` keeps the newest that many (#170 E5).
-import json, os, sys
-if sys.argv[1:3] == ["pr", "list"]:
-    path = os.environ.get("FAKE_GH_PRS", "")
-    rows = json.load(open(path)) if path and os.path.exists(path) else []
-    args = sys.argv[3:]
-    if "--head" in args:
-        rows = [r for r in rows if r.get("headRefName") == args[args.index("--head") + 1]]
-    if "--limit" in args:
-        rows = sorted(rows, key=lambda r: -r["number"])[:int(args[args.index("--limit") + 1])]
-    sys.stdout.write(json.dumps(rows))
-    sys.exit(0)
-sys.exit(1)
-'''
-
-FAKE_TMUX = """#!/bin/sh
-if [ -n "${FAKE_TMUX_PANES:-}" ] && [ -f "$FAKE_TMUX_PANES" ]; then cat "$FAKE_TMUX_PANES"; exit 0; fi
-exit 1
-"""
-
-
-def _clean_path() -> str:
-    """PATH without any directory holding an installed lane command."""
-    keep = []
-    for part in os.environ.get("PATH", "").split(os.pathsep):
-        if part and not any(os.path.exists(os.path.join(part, n))
-                            for n in ("lanes-edit.sh", "lane-worktrees", "lanes-index")):
-            keep.append(part)
-    return os.pathsep.join(keep)
-
-
-class Estate:
-    """One lane's estate under `tmp_path`: a bare origin, the lane's
-    checkout, its two worktree roots, the fakes, and the environment the
-    sweep is run in."""
-
-    def __init__(self, root: Path):
-        self.root = root
-        self.home = root / "home"
-        self.projects = root / "projects"
-        self.remotes = root / "remotes"
-        self.fakebin = root / "fakebin"
-        self.state = root / "state"
-        self.config = root / "config"
-        self.sandboxes = root / "sandboxes"
-        for d in (self.home, self.projects, self.remotes, self.fakebin, self.state,
-                  self.config, self.sandboxes, root / "tmp"):
-            d.mkdir(parents=True, exist_ok=True)
-        self.origin = self.remotes / "repoA.git"
-        self.checkout = self.projects / "repoA"
-        self.claude_root = self.checkout / ".claude" / "worktrees"
-        self.lane_root = self.projects / ".lane-worktrees" / LANE
-        self.spec_file = root / "helper-spec.json"
-        self.helper_log = root / "helper.log"
-        self.prs_file = root / "prs.json"
-        for name, text in (("lanes-edit.sh", FAKE_HELPER), ("gh", FAKE_GH), ("tmux", FAKE_TMUX)):
-            (self.fakebin / name).write_text(text)
-            (self.fakebin / name).chmod(0o755)
-        (self.home / ".gitconfig").write_text(
-            f'[url "{self.origin}"]\n\tinsteadOf = {GH_URL}\n'
-            "[user]\n\tname = sweep tests\n\temail = sweep@example.invalid\n"
-            "[init]\n\tdefaultBranch = main\n"
-            '[protocol "file"]\n\tallow = always\n'
-            "[advice]\n\tdetachedHead = false\n")
-        env = {k: v for k, v in os.environ.items()
-               if not k.startswith(("LANES_", "CLAUDE_", "WORKBENCHES_", "TMUX", "XDG_",
-                                    "PROJECTS_", "GH_", "GIT_", "FAKE_", "LANE_WORKTREES_",
-                                    "AGENT_PROTOCOL_ROOT"))}
-        env.update(
-            HOME=str(self.home), TMPDIR=str(root / "tmp"),
-            XDG_STATE_HOME=str(self.state), XDG_CONFIG_HOME=str(self.config),
-            PROJECTS_ROOT=str(self.projects), LANES_EDIT=str(self.fakebin / "lanes-edit.sh"),
-            FAKE_HELPER_SPEC=str(self.spec_file), FAKE_HELPER_LOG=str(self.helper_log),
-            FAKE_GH_PRS=str(self.prs_file), CLAUDE_CODE_SESSION_ID=ME,
-            LANE_WORKTREES_SANDBOX_ROOTS=str(self.sandboxes), LANES_WORKSTATION="Eagle",
-            GIT_CONFIG_NOSYSTEM="1",
-            PATH=str(self.fakebin) + os.pathsep + _clean_path())
-        self.env = env
-        self.inventory: list = []
-        self.prs: list = []
-        self.holder = "none"
-        self.binding = ("here", "Eagle/none")
-        self.state_word = "RUNNING"
-        self.verdict = "ungraceful-stop"
-        self.workspace = ""
-        self.log_rc = 0
-        self.extra_spec: dict = {}
-        self._seed()
-
-    # ------------------------------------------------------------ git
-    def git(self, *args, cwd=None, check=True, env=None) -> str:
-        child = dict(self.env)
-        child.update(env or {})
-        proc = subprocess.run(["git", *[str(a) for a in args]], cwd=str(cwd or self.checkout),
-                              capture_output=True, text=True, env=child, check=False)
-        if check:
-            assert proc.returncode == 0, f"git {' '.join(map(str, args))}: {proc.stderr}"
-        return proc.stdout.strip()
-
-    def _seed(self) -> None:
-        self.git("init", "-q", "--bare", "-b", "main", self.origin, cwd=self.root)
-        self.git("clone", "-q", GH_URL, self.checkout, cwd=self.root)
-        (self.checkout / "README.md").write_text("repoA\n")
-        (self.checkout / ".gitignore").write_text(".env\n__pycache__/\n*.pyc\n")
-        self.git("add", "-A")
-        self.commit(self.checkout, "seed")
-        self.git("push", "-q", "origin", "main")
-        # THE WORKSPACE REPOSITORY, which `--yes` fetches before it reads a
-        # binding (#170 A1) and whose lane logs name every lane's directory
-        # (#170 G6). Outside `projects/`, so it is no repository of the estate.
-        ws_origin = self.root / "workspace.git"
-        ws = self.root / "workspace"
-        self.git("init", "-q", "--bare", "-b", "main", ws_origin, cwd=self.root)
-        self.git("clone", "-q", ws_origin, ws, cwd=self.root)
-        (ws / "lanes" / "log").mkdir(parents=True)
-        (ws / "lanes" / "LANES.md").write_text("# register\n")
-        self.git("add", "-A", cwd=ws)
-        self.git("commit", "-q", "-m", "seed", cwd=ws)
-        self.git("push", "-q", "origin", "main", cwd=ws)
-        self.workspace = str(ws)
-
-    def register_line(self, lane: str, line: str) -> None:
-        """One line appended to `lane`'s log in the workspace, pushed."""
-        ws = Path(self.workspace)
-        log = ws / "lanes" / "log" / f"{lane}.md"
-        log.write_text((log.read_text() if log.exists() else "") + line + "\n")
-        self.git("add", "-A", cwd=ws)
-        self.git("commit", "-q", "-m", f"log {lane}", cwd=ws)
-        self.git("push", "-q", "origin", "main", cwd=ws)
-
-    def commit(self, cwd: Path, message: str, files: dict | None = None,
-               lane: str | None = LANE) -> str:
-        for rel, text in (files or {}).items():
-            path = Path(cwd) / rel
-            path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(text)
-        self.git("add", "-A", cwd=cwd)
-        body = f"{message}\n\nLane: {lane}\n" if lane else message
-        self.git("commit", "-q", "--allow-empty", "-m", body, cwd=cwd)
-        return self.git("rev-parse", "HEAD", cwd=cwd)
-
-    def worktree(self, name: str, branch: str | None = None, where: str = "lane",
-                 start: str = "origin/main", record: bool = True) -> Path:
-        root = self.lane_root if where == "lane" else self.claude_root
-        root.mkdir(parents=True, exist_ok=True)
-        path = root / name
-        if branch:
-            self.git("worktree", "add", "-q", "-b", branch, path, start)
-        else:
-            self.git("worktree", "add", "-q", "--detach", path, start)
-        if record:
-            self.record(path)
-        return path
-
-    def record(self, path: Path, branch: str = "", head: str = "",
-               writer: str = WRITER) -> None:
-        """An inventory row, as `lanes-edit.sh lane-trees` prints one."""
-        if path.is_dir():
-            branch = self.git("symbolic-ref", "-q", "--short", "HEAD", cwd=path, check=False) or "detached"
-            head = self.git("rev-parse", "HEAD", cwd=path)
-        row = [f"c{len(self.inventory)}-{path.name}", str(path), branch or "unknown",
-               head or "unknown", "none", "0", "0", writer, "2026-10-05T00:00:00Z",
-               str(self.checkout), "1", "op-1", "1"]
-        self.inventory.append(US.join(row))
-
-    # ------------------------------------------------------------ the fakes
-    def write_spec(self) -> None:
-        holder = {"none": "HOLDER" + US + "none",
-                  "me": f"HOLDER{US}live{US}{ME} sess:1.0 {LANE} 4242 here",
-                  "other": f"HOLDER{US}live{US}{OTHER} sess:2.0 {LANE} 4343 here",
-                  "unknown": f"HOLDER{US}unknown{US}the records could not be read"}[self.holder]
-        reconcile = "\n".join([
-            f"ROOT{US}{self.root}/lane-state/{LANE}",
-            f"STATE{US}{self.state_word}{US}generation 1{US}operation op-1{US}owner {ME}{US}updated now",
-            holder,
-            f"BINDING{US}{self.binding[0]}{US}{self.binding[1]}",
-            f"TREES{US}{len(self.inventory)} inventoried",
-            f"VERDICT{US}{self.verdict}{US}the fixture says so", ""])
-        spec = {
-            "lane-reconcile": {"rc": 0, "out": reconcile},
-            "lane-dir": {"rc": 0, "out": f"{self.checkout}\n"},
-            "lane-trees": ({"rc": 0, "out": "\n".join(self.inventory) + "\n"}
-                           if self.inventory else {"rc": 8}),
-            "managed-projection": {"rc": 8},
-            "workspace-root": ({"rc": 0, "out": self.workspace + "\n"} if self.workspace
-                               else {"rc": 1, "err": "no workspace\n"}),
-            "transcript-holders": {"rc": 8},
-            "log": {"rc": self.log_rc, "err": "" if self.log_rc == 0 else "refused\n"},
-        }
-        spec.update(self.extra_spec)
-        self.spec_file.write_text(json.dumps(spec))
-        self.prs_file.write_text(json.dumps(self.prs))
-
-    def pr(self, number: int, branch: str, state: str, head: str, base: str = "main") -> None:
-        self.prs.append({"number": number, "headRefName": branch, "state": state,
-                         "headRefOid": head, "baseRefName": base, "isCrossRepository": False,
-                         "mergedAt": "2026-10-01T00:00:00Z" if state == "MERGED" else None})
-
-    # ------------------------------------------------------------ running
-    def sweep(self, *args, env: dict | None = None, timeout: int = 180,
-              cwd: Path | None = None) -> subprocess.CompletedProcess:
-        self.write_spec()
-        child = dict(self.env)
-        for key, value in (env or {}).items():
-            if value is None:
-                child.pop(key, None)
-            else:
-                child[key] = value
-        return subprocess.run([sys.executable, str(LW), "sweep", *[str(a) for a in args]],
-                              capture_output=True, text=True, env=child, timeout=timeout,
-                              cwd=str(cwd or self.root), stdin=subprocess.DEVNULL)
-
-    def notes(self) -> list:
-        if not self.helper_log.exists():
-            return []
-        rows = [json.loads(line) for line in self.helper_log.read_text().splitlines() if line]
-        return [r for r in rows if r["argv"][:1] == ["log"]]
-
-    def remote_heads(self) -> dict:
-        out = self.git("ls-remote", "--heads", self.origin, cwd=self.root)
-        heads = {}
-        for line in out.splitlines():
-            sha, ref = line.split("\t")
-            heads[ref[len("refs/heads/"):]] = sha
-        return heads
-
-    def archives(self) -> list:
-        base = self.state / "openRepoTools" / "sweeps" / LANE
-        return sorted(base.iterdir()) if base.is_dir() else []
-
-
-def _dead_pid() -> int:
-    """A pid PROVED dead (#170 C6): one this test started, reaped, and that
-    `kill -0` no longer finds. A constant such as 999999 is a live pid on a
-    host whose pid_max is 4194304."""
-    for _ in range(20):
-        child = subprocess.Popen(["true"])
-        child.wait()
-        try:
-            os.kill(child.pid, 0)
-        except ProcessLookupError:
-            return child.pid
-    raise AssertionError("no pid could be proved dead")
-
-
-def rows_of(out: str) -> dict:
-    """The porcelain's tree rows, by path: (disposition, retire, reason)."""
-    rows = {}
-    for line in out.splitlines():
-        cols = line.split("\t")
-        if cols[0] == "tree":
-            rows[cols[3]] = (cols[1], cols[2], cols[6] if len(cols) > 6 else "")
-    return rows
-
-
-def items_of(out: str, kind: str) -> dict:
-    rows = {}
-    for line in out.splitlines():
-        cols = line.split("\t")
-        if cols[0] == kind:
-            rows[cols[3]] = (cols[1], cols[2], cols[4], cols[6] if len(cols) > 6 else "")
-    return rows
-
-
-def snapshot(root: Path, skip: tuple = ()) -> dict:
-    """Every path under `root` with its kind, size, mode, mtime and content
-    digest - what a run that CHANGES NOTHING leaves exactly as it found."""
-    out = {}
-    for base, dirs, files in os.walk(root):
-        for name in dirs + files:
-            full = os.path.join(base, name)
-            rel = os.path.relpath(full, root)
-            if any(rel == s or rel.startswith(s + os.sep) for s in skip):
-                continue
-            st = os.lstat(full)
-            digest = ""
-            if os.path.islink(full):
-                digest = "->" + os.readlink(full)
-            elif os.path.isfile(full):
-                with open(full, "rb") as fh:
-                    digest = hashlib.sha256(fh.read()).hexdigest()
-            out[rel] = (st.st_mode, st.st_size if not os.path.isdir(full) else 0,
-                        st.st_mtime_ns if not os.path.isdir(full) else 0, digest)
-    return out
-
-
-@pytest.fixture
-def estate(tmp_path):
-    return Estate(tmp_path)
-
-
-def build_table(e: Estate) -> dict:
-    """A lane whose inventory holds a tree in every state of the table."""
-    t = {}
-    # clean, squash-MERGED: gh says MERGED and its head is this tip; the
-    # squash commit on main is NOT a descendant of it.
-    t["merged"] = e.worktree("merged", "feat/merged")
-    tip = e.commit(t["merged"], "merged work", {"m.txt": "m\n"})
-    e.git("push", "-q", "-u", "origin", "feat/merged", cwd=t["merged"])
-    e.git("checkout", "-q", "main")
-    e.git("merge", "-q", "--squash", "feat/merged")
-    e.commit(e.checkout, "squash of feat/merged (#11)")
-    e.git("push", "-q", "origin", "main")
-    e.pr(11, "feat/merged", "MERGED", tip)
-    # clean, pushed, unmerged (an open PR)
-    t["pushed"] = e.worktree("pushed", "feat/pushed")
-    tip = e.commit(t["pushed"], "pushed work", {"p.txt": "p\n"})
-    e.git("push", "-q", "-u", "origin", "feat/pushed", cwd=t["pushed"])
-    e.pr(12, "feat/pushed", "OPEN", tip)
-    # clean, one commit beyond its pushed upstream
-    t["unpushed"] = e.worktree("unpushed", "feat/unpushed")
-    e.commit(t["unpushed"], "first", {"u.txt": "1\n"})
-    e.git("push", "-q", "-u", "origin", "feat/unpushed", cwd=t["unpushed"])
-    e.commit(t["unpushed"], "second", {"u.txt": "2\n"})
-    # clean, never pushed at all
-    t["fresh"] = e.worktree("fresh", "feat/fresh", where="claude")
-    e.commit(t["fresh"], "fresh work", {"f.txt": "f\n"})
-    # clean, DIVERGED from its remote branch
-    t["diverged"] = e.worktree("diverged", "feat/diverged")
-    e.commit(t["diverged"], "d1", {"d.txt": "1\n"})
-    e.commit(t["diverged"], "d2", {"d.txt": "2\n"})
-    e.git("push", "-q", "-u", "origin", "feat/diverged", cwd=t["diverged"])
-    e.git("reset", "-q", "--hard", "HEAD~1", cwd=t["diverged"])
-    e.commit(t["diverged"], "d3", {"d.txt": "3\n"})
-    # dirty: a modified file, an untracked one, an ignored secret, a cache
-    t["dirty"] = e.worktree("dirty", "feat/dirty")
-    e.commit(t["dirty"], "base", {"w.txt": "base\n"})
-    e.git("push", "-q", "-u", "origin", "feat/dirty", cwd=t["dirty"])
-    (t["dirty"] / "w.txt").write_text("changed\n")
-    (t["dirty"] / "new.txt").write_text("untracked\n")
-    (t["dirty"] / ".env").write_text("SECRET=1\n")
-    (t["dirty"] / "__pycache__").mkdir()
-    (t["dirty"] / "__pycache__" / "x.cpython-312.pyc").write_bytes(b"\0bytecode")
-    # detached at a commit origin holds
-    t["det-on"] = e.worktree("det-on")
-    # detached with a commit of its own
-    t["det-own"] = e.worktree("det-own")
-    e.commit(t["det-own"], "orphaned work", {"o.txt": "o\n"})
-    # a registration whose directory is gone
-    t["stale"] = e.worktree("stale", "feat/stale")
-    shutil.rmtree(t["stale"])
-    # a FOREIGN tree: git registers it, no inventory names it
-    t["foreign"] = e.worktree("foreign", "feat/foreign", where="claude", record=False)
-    # an inventory record whose path never existed
-    t["gone"] = e.lane_root / "gone"
-    e.record(t["gone"], "feat/gone", "0" * 40)
-    # a locked registration
-    t["locked"] = e.worktree("locked", "feat/locked")
-    e.git("worktree", "lock", t["locked"])
-    # a clone nested inside a tree: its work is no commit of the tree's
-    t["nested"] = e.worktree("nested", "feat/nested")
-    e.git("push", "-q", "-u", "origin", "feat/nested", cwd=t["nested"])
-    e.git("init", "-q", t["nested"] / "inner", cwd=e.root)
-    return t
-
-
-# =================================================================== the table
-
-def test_every_disposition_row_in_the_dry_run_and_it_changes_nothing(estate):
-    t = build_table(estate)
-    before = snapshot(estate.root, skip=("helper.log", "helper-spec.json", "prs.json"))
-    proc = estate.sweep(LANE, "--porcelain")
-    after = snapshot(estate.root, skip=("helper.log", "helper-spec.json", "prs.json"))
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    want = {
-        "merged": "remove+delete-branch", "pushed": "remove", "unpushed": "push+remove",
-        "fresh": "push+remove", "diverged": "rescue+remove", "dirty": "wip-rescue+remove",
-        "det-on": "remove", "det-own": "rescue+remove", "stale": "prune",
-        "foreign": "foreign", "gone": "gone", "locked": "keep", "nested": "keep",
-    }
-    for name, disposition in want.items():
-        assert str(t[name]) in rows, f"{name} is not in the table:\n{proc.stdout}"
-        assert rows[str(t[name])][0] == disposition, (name, rows[str(t[name])])
-    assert rows[str(t["foreign"])][1] == "-", "a FOREIGN tree is not the lane's to retire"
-    assert rows[str(t["gone"])][1] == "-"
-    assert rows[str(t["merged"])][1] == "retire"
-    assert "PR #11 is merged (gh MERGED)" in rows[str(t["merged"])][2]
-    assert "LOCKED" in rows[str(t["locked"])][2]
-    assert "nested" in rows[str(t["nested"])][2]
-    # ZERO CHANGE: not a ref, not an index, not a file, not a sweeps directory.
-    assert before == after, sorted(set(before.items()) ^ set(after.items()))[:10]
-    assert not (estate.state / "openRepoTools").exists()
-    assert estate.notes() == [], "a dry run writes no register line"
-
-
-def test_yes_performs_the_table_and_records_every_act(estate):
-    t = build_table(estate)
-    heads_before = estate.remote_heads()
-    tips = {n: estate.git("rev-parse", "HEAD", cwd=p) for n, p in t.items()
-            if n not in ("stale", "gone") and p.is_dir()}
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    heads = estate.remote_heads()
-    for name in ("merged", "pushed", "unpushed", "fresh", "diverged", "dirty", "det-on", "det-own"):
-        assert not t[name].exists(), f"{name} was not removed:\n{proc.stdout}"
-    # MERGED: both branches gone (its Lane: trailer is this lane's).
-    assert "feat/merged" not in heads
-    assert estate.git("branch", "--list", "feat/merged") == ""
-    # PUSHED: the branch stays, here and on origin.
-    assert heads["feat/pushed"] == heads_before["feat/pushed"]
-    assert estate.git("branch", "--list", "feat/pushed").strip() == "feat/pushed"
-    # UNPUSHED and FRESH: pushed as is.
-    assert heads["feat/unpushed"] == tips["unpushed"]
-    assert heads["feat/fresh"] == tips["fresh"]
-    rescues = {b: s for b, s in heads.items() if b.startswith(f"rescue/{LANE}/")}
-    # DIVERGED: its tip went to a rescue branch; the remote branch is untouched.
-    assert heads["feat/diverged"] == heads_before["feat/diverged"]
-    assert [b for b, s in rescues.items() if b.startswith(f"rescue/{LANE}/diverged-")
-            and s == tips["diverged"]], rescues
-    # DETACHED with its own commit: rescued too.
-    assert [b for b, s in rescues.items() if b.startswith(f"rescue/{LANE}/det-own-")
-            and s == tips["det-own"]], rescues
-    # DIRTY: a WIP commit on a rescue branch, carrying the work, named for it.
-    wip = [b for b in rescues if b.startswith(f"rescue/{LANE}/dirty-")]
-    assert len(wip) == 1, rescues
-    subject = estate.git("log", "-1", "--format=%s", rescues[wip[0]], cwd=estate.origin)
-    assert LANE in subject and "dirty" in subject and "swept, not reviewed" in subject
-    stamp = wip[0].rsplit("-", 1)[1]
-    assert stamp in subject
-    assert estate.git("show", f"{rescues[wip[0]]}:w.txt", cwd=estate.origin) == "changed"
-    # AN UNTRACKED FILE IS NEVER PUSHED (#170 A9): it is in the bundle only.
-    assert "new.txt" not in estate.git("ls-tree", "--name-only", rescues[wip[0]],
-                                       cwd=estate.origin).split()
-    parent = estate.git("rev-parse", f"{rescues[wip[0]]}^", cwd=estate.origin)
-    assert parent == tips["dirty"], "the WIP commit sits on the tree's own head"
-    # STALE: pruned.
-    assert str(t["stale"]) not in estate.git("worktree", "list", "--porcelain")
-    # LEFT ALONE: foreign, locked, nested.
-    for name in ("foreign", "locked", "nested"):
-        assert t[name].is_dir(), f"{name} was touched"
-    # THE ARCHIVE: one directory, a manifest that verifies, the disposition,
-    # the rescues, a bundle per rescue, the ignored secret and no bytecode.
-    (archive,) = estate.archives()
-    files = {p.name for p in archive.iterdir()}
-    assert {"MANIFEST.sha256", "DISPOSITION.md", "rescues.tsv"} <= files
-    for line in (archive / "MANIFEST.sha256").read_text().splitlines():
-        digest, name = line.split("  ", 1)
-        assert hashlib.sha256((archive / name).read_bytes()).hexdigest() == digest, name
-    assert any(n.startswith("dirty") and n.endswith(".bundle") for n in files), files
-    held = [r for r in _ledger(archive) if r[0] == "-" and r[1].startswith("bundle:dirty")]
-    assert len(held) == 1 and estate.git("show", f"{held[0][2]}:new.txt") == "untracked"
-    assert any(n.startswith("diverged") and n.endswith(".bundle") for n in files), files
-    with tarfile.open(archive / "dirty-ignored.tar.gz") as tf:
-        names = tf.getnames()
-    assert ".env" in names and not any("__pycache__" in n for n in names), names
-    disposition = (archive / "DISPOSITION.md").read_text()
-    for name in ("merged", "pushed", "dirty", "stale"):
-        assert str(t[name]) in disposition
-    # ONE REGISTER LINE PER TREE ACTED ON, and no line breaks the grammar.
-    notes = estate.notes()
-    acted = ("merged", "pushed", "unpushed", "fresh", "diverged", "dirty", "det-on",
-             "det-own", "stale")
-    assert len(notes) == len(acted), [n["argv"] for n in notes]
-    for n in notes:
-        assert n["argv"][:3] == ["log", "NOTED", f"lane:{LANE}"] and n["lane"] == LANE
-        text = n["argv"][3]
-        assert " — " not in text and ", " not in text and "managed" not in text.lower()
-    for name in acted:
-        assert any(str(t[name]) in n["argv"][3] for n in notes), name
-
-
-def test_the_rescue_is_on_origin_before_the_tree_is_removed(estate):
-    """A refused push leaves the tree EXACTLY as it was: same branch, same
-    index, same files - the WIP commit is made beside it, never into it."""
-    tree = estate.worktree("dirty", "feat/dirty")
-    estate.commit(tree, "base", {"w.txt": "base\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/dirty", cwd=tree)
-    (tree / "w.txt").write_text("precious\n")
-    (tree / "new.txt").write_text("also precious\n")
-    hook = estate.origin / "hooks" / "pre-receive"
-    hook.write_text("#!/bin/sh\nwhile read old new ref; do case $ref in "
-                    "refs/heads/rescue/*) echo 'no rescues here' >&2; exit 1;; esac; done\n")
-    hook.chmod(0o755)
-    before = snapshot(tree)
-    status_before = estate.git("status", "--porcelain", cwd=tree)
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 1, proc.stdout + proc.stderr
-    assert rows_of(proc.stdout)[str(tree)][2].count("FAILED") == 1
-    assert tree.is_dir() and (tree / "w.txt").read_text() == "precious\n"
-    assert estate.git("status", "--porcelain", cwd=tree) == status_before
-    assert estate.git("symbolic-ref", "--short", "HEAD", cwd=tree) == "feat/dirty"
-    assert snapshot(tree) == before
-    assert not [b for b in estate.remote_heads() if b.startswith("rescue/")]
-    assert estate.notes() == [], "no register line names a removal that did not happen"
-
-
-def test_a_live_writer_is_never_touched(estate):
-    tree = estate.worktree("live", "feat/live")
-    estate.commit(tree, "w", {"l.txt": "l\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/live", cwd=tree)
-    pane_tree = estate.worktree("pane", "feat/pane")
-    estate.git("push", "-q", "-u", "origin", "feat/pane", cwd=pane_tree)
-    panes = estate.root / "panes"
-    panes.write_text(f"0\tsess:1.0\t{pane_tree}\n")
-    sleeper = subprocess.Popen(["sleep", "300"], cwd=str(tree))
-    try:
-        proc = estate.sweep(LANE, "--yes", "--porcelain",
-                            env={"FAKE_TMUX_PANES": str(panes)})
-    finally:
-        sleeper.kill()
-        sleeper.wait()
-    rows = rows_of(proc.stdout)
-    assert rows[str(tree)][0] == "live", rows
-    assert f"process {sleeper.pid}" in rows[str(tree)][2]
-    assert rows[str(pane_tree)][0] == "live" and "tmux pane" in rows[str(pane_tree)][2]
-    assert tree.is_dir() and pane_tree.is_dir()
-
-
-def test_the_coordinator_states_its_writer_count_before_yes(estate):
-    """THIS session holds the lane: only its ListAgents count says which
-    writers are live, so `--yes` wants it (`--live <path>` or `--live none`)."""
-    tree = estate.worktree("w1", "feat/w1")
-    estate.git("push", "-q", "-u", "origin", "feat/w1", cwd=tree)
-    busy = estate.worktree("w2", "feat/w2")
-    estate.git("push", "-q", "-u", "origin", "feat/w2", cwd=busy)
-    estate.holder = "me"
-    estate.state_word, estate.verdict = "RUNNING", "running"
-    refused = estate.sweep(LANE, "--yes")
-    assert refused.returncode == 2 and "--live" in refused.stdout, refused.stdout
-    assert tree.is_dir() and busy.is_dir()
-    proc = estate.sweep(LANE, "--yes", "--live", busy, "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    assert rows[str(busy)][0] == "live" and "--live" in rows[str(busy)][2]
-    assert busy.is_dir() and not tree.exists()
-
-
-@pytest.mark.parametrize("holder,binding,word", [
-    ("none", ("elsewhere", "raven/none"), "bound on raven/none"),
-    ("none", ("unknown", ""), "could not be read"),
-    ("other", ("here", "Eagle/none"), f"held by live session {OTHER}"),
-    ("unknown", ("here", "Eagle/none"), "could not be read"),
-])
-def test_yes_is_refused_for_a_lane_live_elsewhere_or_unread(estate, holder, binding, word):
-    """Amendment 18(b): from outside the binding a lane is UNKNOWN, never
-    dead - so nothing is acted on, and the porcelain's answer is 2."""
-    tree = estate.worktree("w", "feat/w")
-    estate.commit(tree, "w", {"w.txt": "w\n"})
-    estate.holder, estate.binding = holder, binding
-    # THE REGISTER'S FETCH (#170 A1) is the one write a refused --yes makes,
-    # in the workspace repository: the estate is snapshotted without it.
-    skip = ("helper.log", "helper-spec.json", "prs.json", "workspace")
-    before = snapshot(estate.root, skip=skip)
-    dry = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert dry.returncode == 2, dry.stdout + dry.stderr
-    assert dry.stdout.splitlines()[1].startswith("refused\t") and word in dry.stdout
-    yes = estate.sweep(LANE, "--yes", "--live", "none")
-    assert yes.returncode == 2 and word in yes.stdout
-    assert tree.is_dir()
-    assert snapshot(estate.root, skip=skip) == before
-    assert estate.notes() == []
-
-
-def test_a_managed_lane_is_the_ledgers_and_is_refused(estate):
-    estate.worktree("w", "feat/w")
-    estate.extra_spec = {"lane-reconcile": {"rc": 0, "out": (
-        f"MANAGED{US}ledger-1\nVERDICT{US}managed-owned{US}the ledger's\n")}}
-    proc = estate.sweep(LANE, "--porcelain")
-    assert proc.returncode == 2 and "managed ledger" in proc.stdout
-
-
-def test_merged_is_the_register_or_gh_never_ancestry(estate, tmp_path):
-    """SQUASH MERGES HIDE COMPLETION BY ANCESTRY (cause 13): a squash-merged
-    branch is merged by its PR, and a branch whose tip IS on main but which no
-    PR names is NOT merged - its worktree goes, its branch stays."""
-    # the register says #21 LANDED while gh still reads it OPEN (a stale read)
-    wip_origin = tmp_path / "wip.git"
-    wip = tmp_path / "wip"
-    estate.git("init", "-q", "--bare", "-b", "main", wip_origin, cwd=tmp_path)
-    estate.git("clone", "-q", wip_origin, wip, cwd=tmp_path)
-    (wip / "lanes" / "log").mkdir(parents=True)
-    (wip / "lanes" / "log" / f"{LANE}.md").write_text(
-        f"LANDED — lane {LANE}, session {ME}@Eagle, 2026-10-05T00:00:00Z, {SLUG}#21 → main abc1234\n")
-    (wip / "lanes" / "LANES.md").write_text("# register\n")
-    estate.git("add", "-A", cwd=wip)
-    estate.git("commit", "-q", "-m", "seed", cwd=wip)
-    estate.git("push", "-q", "origin", "main", cwd=wip)
-    estate.workspace = str(wip)
-    by_register = estate.worktree("by-register", "feat/reg")
-    tip = estate.commit(by_register, "r", {"r.txt": "r\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/reg", cwd=by_register)
-    estate.pr(21, "feat/reg", "OPEN", tip)
-    # on main by ancestry, and no PR at all
-    ancestor = estate.worktree("ancestor", "feat/ancestor")
-    estate.commit(ancestor, "a", {"a.txt": "a\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/ancestor", cwd=ancestor)
-    estate.git("merge", "-q", "--ff-only", "feat/ancestor")
-    estate.git("push", "-q", "origin", "main")
-    assert "feat/ancestor" in estate.git("branch", "--merged", "main")
-    proc = estate.sweep(LANE, "--porcelain")
-    rows = rows_of(proc.stdout)
-    assert rows[str(by_register)][0] == "remove+delete-branch"
-    assert "register LANDED" in rows[str(by_register)][2]
-    assert rows[str(ancestor)][0] == "remove", rows[str(ancestor)]
-    yes = estate.sweep(LANE, "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert estate.git("branch", "--list", "feat/ancestor").strip() == "feat/ancestor"
-    assert estate.git("branch", "--list", "feat/reg") == ""
-    # ... AND THE REMOTE BRANCH'S FATE (#170 C1): gh still answers #21 OPEN, so
-    # however the register reads, origin's branch stays - deleting it would
-    # close the pull request (#170 A8).
-    assert estate.remote_heads().get("feat/reg") == tip, estate.remote_heads()
-
-
-def test_a_merge_into_another_base_is_no_landing_and_an_open_pr_comes_first(estate):
-    """Copilot on #168: a PR merged into a release branch is no landing on
-    main, and an OPEN PR protects its branch however an older PR of the same
-    branch was merged."""
-    elsewhere = estate.worktree("elsewhere", "feat/rel")
-    tip = estate.commit(elsewhere, "e", {"e.txt": "e\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/rel", cwd=elsewhere)
-    estate.pr(41, "feat/rel", "MERGED", tip, base="release/1")
-    reopened = estate.worktree("reopened", "feat/again")
-    old = estate.commit(reopened, "o", {"o.txt": "o\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/again", cwd=reopened)
-    estate.pr(42, "feat/again", "MERGED", old)
-    estate.pr(43, "feat/again", "OPEN", old)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(elsewhere)][0] == "remove", rows[str(elsewhere)]
-    assert "merged into release/1" in rows[str(elsewhere)][2]
-    assert rows[str(reopened)][0] == "remove" and "PR #43 is open" in rows[str(reopened)][2]
-    yes = estate.sweep(LANE, "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    local = estate.git("branch", "--format=%(refname:short)").splitlines()
-    assert "feat/rel" in local and "feat/again" in local, "neither branch is merged"
-    assert {"feat/rel", "feat/again"} <= set(estate.remote_heads())
-
-
-def test_without_gh_nothing_is_called_merged(estate):
-    tree = estate.worktree("m", "feat/m")
-    tip = estate.commit(tree, "m", {"m.txt": "m\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/m", cwd=tree)
-    estate.pr(5, "feat/m", "MERGED", tip)
-    proc = estate.sweep(LANE, "--porcelain", env={"LANES_NO_GITHUB": "1"})
-    assert rows_of(proc.stdout)[str(tree)][0] == "remove"
-    assert "LANES_NO_GITHUB=1" in estate.sweep(LANE, env={"LANES_NO_GITHUB": "1"}).stdout
-
-
-def test_a_tree_another_lanes_inventory_also_names_is_kept(estate):
-    """Copilot on #168: inventory records are history and a path can be
-    reused, so a tree BOTH lanes' inventories name is neither's to sweep."""
-    tree = estate.worktree("shared", "feat/shared")
-    estate.git("push", "-q", "-u", "origin", "feat/shared", cwd=tree)
-    other = estate.root / "lane-state" / "repoA-7" / "trees"
-    other.mkdir(parents=True)
-    (other / "c1.yaml").write_text(f"schema: 1\npath: {tree}\n")
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep" and "repoA-7's inventory names it too" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert tree.is_dir()
-
-
-def test_an_unreadable_claim_of_another_lane_refuses_before_any_write(estate):
-    """Copilot round 2 on #168: a sibling inventory record that cannot be
-    read is an unknown claim, never "no claim" - refused, and refused before
-    the fetch."""
-    estate.worktree("w", "feat/w")
-    other = estate.root / "lane-state" / "repoA-7" / "trees"
-    other.mkdir(parents=True)
-    (other / "c1.yaml").write_text("schema: 1\n")
-    # (the register's fetch under --yes, #170 A1, is in the workspace only)
-    skip = ("helper.log", "helper-spec.json", "prs.json", "workspace")
-    before = snapshot(estate.root, skip=skip)
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert "lane repoA-7's inventory record c1.yaml (it names no path)" in proc.stdout
-    assert snapshot(estate.root, skip=skip) == before
-
-
-def test_a_submodules_ignored_files_keep_its_tree(estate):
-    """Copilot round 2 on #168: an `.env` in a submodule is in no archive -
-    the tree's ignored-file archive lists the superproject's only."""
-    sub_origin = estate.remotes / "sub.git"
-    estate.git("init", "-q", "--bare", "-b", "main", sub_origin, cwd=estate.root)
-    seed = estate.root / "sub-seed"
-    estate.git("clone", "-q", sub_origin, seed, cwd=estate.root)
-    estate.commit(seed, "sub", {".gitignore": ".env\n", "s.txt": "s\n"})
-    estate.git("push", "-q", "origin", "main", cwd=seed)
-    tree = estate.worktree("withsub", "feat/withsub", record=False)
-    estate.git("submodule", "add", "-q", str(sub_origin), "sub", cwd=tree)
-    estate.commit(tree, "add sub")
-    estate.git("push", "-q", "-u", "origin", "feat/withsub", cwd=tree)
-    (tree / "sub" / ".env").write_text("SECRET=1\n")
-    estate.record(tree)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "submodule sub holds ignored files no commit carries (.env)" in rows[str(tree)][2]
-
-
-def test_a_cache_whose_tracking_cannot_be_read_is_left(estate):
-    """Copilot round 2 on #168: an index git cannot read is no proof a cache
-    is untracked."""
-    tree = estate.worktree("badindex", "feat/badindex")
-    estate.git("push", "-q", "-u", "origin", "feat/badindex", cwd=tree)
-    (tree / "__pycache__").mkdir()
-    (tree / "__pycache__" / "b.pyc").write_bytes(b"\0")
-    index = Path(estate.git("rev-parse", "--git-path", "index", cwd=tree))
-    index = index if index.is_absolute() else tree / index
-    index.write_bytes(b"not an index")
-    proc = estate.sweep(LANE, "--include-caches", "--porcelain")
-    assert str(tree / "__pycache__") not in items_of(proc.stdout, "cache"), proc.stdout
-
-
-def test_a_clone_its_linked_worktrees_share_is_kept(estate):
-    """Copilot on #168: removing a clone takes the git directory every
-    worktree linked to it shares, a live writer's included."""
-    clone = estate.lane_root / "cl"
-    estate.git("clone", "-q", GH_URL, clone, cwd=estate.root)
-    linked = estate.root / "elsewhere-wt"
-    estate.git("worktree", "add", "-q", "-b", "feat/linked", linked, "origin/main", cwd=clone)
-    estate.record(clone)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(clone)][0] == "keep", rows[str(clone)]
-    assert "linked worktree(s) share" in rows[str(clone)][2]
-
-
-def test_an_unreadable_inventory_record_refuses_the_sweep(estate):
-    """Copilot on #168: a record that cannot be read is a tree whose owner is
-    unknown, so the sweep refuses rather than report nothing to retire."""
-    estate.worktree("fine", "feat/fine")
-    estate.inventory.append(US.join(["c9-odd", str(estate.lane_root / "odd"), "x", "y", "none",
-                                     "0", "0", WRITER, "2026-10-05T00:00:00Z",
-                                     str(estate.checkout), "1", "op-1", "9"]))
-    skip = ("helper.log", "helper-spec.json", "prs.json", "workspace")
-    before = snapshot(estate.root, skip=skip)
-    for args in (("--dry-run", "--porcelain"), ("--yes",)):
-        proc = estate.sweep(LANE, *args)
-        assert proc.returncode == 2, (args, proc.stdout, proc.stderr)
-        assert "c9-odd is unreadable or of schema 9" in proc.stdout
-    assert snapshot(estate.root, skip=skip) == before
-
-
-def test_the_lane_name_is_resolved_before_anything_is_derived_from_it(estate):
-    """Copilot on #168: Amendment 15's resolver first, as lane-start and
-    lane-end read it; an alias table that cannot be read refuses."""
-    estate.worktree("w", "feat/w")
-    estate.extra_spec = {"canon-lane": {"rc": 0, "out": f"{LANE}\n"}}
-    proc = estate.sweep(LANE.upper(), "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    assert proc.stdout.splitlines()[0].split("\t")[:2] == ["lane", LANE]
-    reconcile = [r for r in (json.loads(x) for x in estate.helper_log.read_text().splitlines())
-                 if r["argv"][:1] == ["lane-reconcile"]]
-    assert reconcile[-1]["argv"] == ["lane-reconcile", LANE]
-    estate.extra_spec = {"canon-lane": {"rc": 66, "err": "the alias table could not be read\n"}}
-    refused = estate.sweep(LANE, "--porcelain")
-    assert refused.returncode == 2 and "alias table could not be read" in refused.stdout
-
-
-def test_include_foreign_takes_a_word_and_another_lanes_tree_is_never_taken(estate):
-    mine = estate.worktree("foreign-a", "feat/fa", where="claude", record=False)
-    estate.git("push", "-q", "-u", "origin", "feat/fa", cwd=mine)
-    theirs = estate.worktree("foreign-b", "feat/fb", where="claude", record=False)
-    estate.git("push", "-q", "-u", "origin", "feat/fb", cwd=theirs)
-    other_trees = estate.root / "lane-state" / "repoB-2" / "trees"
-    other_trees.mkdir(parents=True)
-    (other_trees / "x.yaml").write_text(f"schema: 1\npath: {theirs}\n")
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    env = {"LANE_WORKTREES_CONF": str(conf)}
-    refused = estate.sweep(LANE, "--yes", "--include-foreign", env=env)
-    assert refused.returncode == 2 and "--word" in refused.stdout
-    proc = estate.sweep(LANE, "--yes", "--include-foreign", "--word", "sweep them", "--porcelain",
-                        env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    assert not mine.exists()
-    assert rows[str(theirs)][0] == "foreign" and "repoB-2" in rows[str(theirs)][2]
-    assert theirs.is_dir()
-    assert any("sweep them" in n["argv"][3] for n in estate.notes())
-
-
-# ================================================================ --branches
-
-def test_branches_deletes_the_merged_lists_the_unpublished_and_spares_an_open_pr(estate):
-    def branch(name, push=True, lane=LANE):
-        estate.git("checkout", "-q", "-b", name, "origin/main")
-        tip = estate.commit(estate.checkout, name, {name.replace("/", "_"): "x\n"}, lane=lane)
-        if push:
-            estate.git("push", "-q", "-u", "origin", name)
-        estate.git("checkout", "-q", "main")
-        return tip
-
-    merged = branch("feat/b-merged")
-    estate.pr(31, "feat/b-merged", "MERGED", merged)
-    theirs = branch("feat/b-theirs", lane="repoB-2")
-    estate.pr(32, "feat/b-theirs", "MERGED", theirs)
-    opened = branch("feat/b-open", push=False)
-    estate.pr(33, "feat/b-open", "OPEN", opened)
-    unpublished = branch("feat/b-local", push=False)
-    estate.git("checkout", "-q", "-b", "rescue/repoA-1/old-20260101T000000Z", "origin/main")
-    estate.git("checkout", "-q", "main")
-    proc = estate.sweep(LANE, "--branches", "--porcelain")
-    items = items_of(proc.stdout, "branch")
-    assert items["feat/b-merged"][0] == "delete+remote", items
-    assert items["feat/b-theirs"][0] == "delete" and items["feat/b-theirs"][1] == "-"
-    assert items["feat/b-open"][0] == "keep" and "open" in items["feat/b-open"][3]
-    assert items["feat/b-local"][0] == "list"
-    detail = items["feat/b-local"][2]
-    assert unpublished[:12] in detail and "1 ahead/0 behind" in detail and "owner repoA-1" in detail
-    assert not any(k.startswith("rescue/") for k in items)
-    yes = estate.sweep(LANE, "--branches", "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    heads = estate.remote_heads()
-    local = estate.git("branch", "--format=%(refname:short)").splitlines()
-    assert "feat/b-merged" not in local and "feat/b-merged" not in heads
-    assert "feat/b-theirs" not in local and "feat/b-theirs" in heads, "not ours: remote kept"
-    assert "feat/b-open" in local and "feat/b-local" in local
-    assert "rescue/repoA-1/old-20260101T000000Z" in local
-    assert any("branches merged by PR" in n["argv"][3] for n in estate.notes())
-
-
-# ========================================== scratch, caches, sandboxes, links
-
-def test_scratch_is_archived_then_removed_and_caches_are_removed(estate):
-    scratch = estate.lane_root / "x-scratch"
-    (scratch / "notes").mkdir(parents=True)
-    (scratch / "notes" / "a.md").write_text("findings\n")
-    (scratch / "__pycache__").mkdir()
-    (scratch / "__pycache__" / "z.pyc").write_bytes(b"\0")
-    briefs = estate.lane_root / "briefs"
-    briefs.mkdir(parents=True)
-    (briefs / "b.md").write_text("brief\n")
-    # a tree the sweep KEEPS (its registration is locked), with caches in it
-    kept = estate.worktree("kept", "feat/kept")
-    estate.commit(kept, "k", {"k.txt": "k\n", ".gitignore": "__pycache__/\nenv/\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/kept", cwd=kept)
-    (kept / "__pycache__").mkdir()
-    (kept / "__pycache__" / "y.pyc").write_bytes(b"\0")
-    venv = kept / "env"
-    (venv / "bin").mkdir(parents=True)
-    (venv / "pyvenv.cfg").write_text("home = /usr\n")
-    estate.git("worktree", "lock", kept)
-    # a tree a LIVE writer stands in: its caches are its writer's
-    busy = estate.worktree("busy", "feat/busy")
-    estate.git("push", "-q", "-u", "origin", "feat/busy", cwd=busy)
-    (busy / "__pycache__").mkdir()
-    sleeper = subprocess.Popen(["sleep", "300"], cwd=str(busy))
-    try:
-        proc = estate.sweep(LANE, "--include-scratch", "--include-caches", "--yes", "--porcelain")
-    finally:
-        sleeper.kill()
-        sleeper.wait()
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    scratch_rows = items_of(proc.stdout, "scratch")
-    assert scratch_rows[str(scratch)][0] == "archive+remove"
-    assert not scratch.exists() and not briefs.exists()
-    (archive,) = estate.archives()
-    with tarfile.open(archive / "scratch-x-scratch.tar.gz") as tf:
-        names = tf.getnames()
-    assert "x-scratch/notes/a.md" in names and not any("__pycache__" in n for n in names)
-    caches = items_of(proc.stdout, "cache")
-    assert str(kept / "__pycache__") in caches and str(venv) in caches
-    assert not (kept / "__pycache__").exists() and not venv.exists()
-    assert (kept / "k.txt").exists(), "a cache sweep removes caches and nothing else"
-    assert (busy / "__pycache__").is_dir(), "a live writer's caches are left"
-    assert str(scratch / "__pycache__") not in caches, "it went with its scratch"
-
-
-def test_caches_are_never_taken_from_a_foreign_tree(estate):
-    """Copilot on #168: a FOREIGN tree under the lane's root is somebody's,
-    live or not, and so are its caches."""
-    foreign = estate.worktree("theirs", "feat/theirs", where="claude", record=False)
-    (foreign / "__pycache__").mkdir()
-    (foreign / "__pycache__" / "t.pyc").write_bytes(b"\0")
-    proc = estate.sweep(LANE, "--include-caches", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert str(foreign / "__pycache__") not in items_of(proc.stdout, "cache")
-    assert (foreign / "__pycache__" / "t.pyc").exists()
-
-
-def test_branch_deletes_wait_for_a_fetch_that_worked(estate):
-    """Copilot on #168: --yes deletes a merged branch only once origin was
-    read NOW - the lane's own checkout is fetched too, and a fetch that
-    failed deletes nothing."""
-    estate.git("checkout", "-q", "-b", "feat/gone-merged", "origin/main")
-    tip = estate.commit(estate.checkout, "g", {"g.txt": "g\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/gone-merged")
-    estate.git("checkout", "-q", "main")
-    estate.pr(51, "feat/gone-merged", "MERGED", tip)
-    estate.origin.rename(estate.origin.with_name("moved.git"))
-    try:
-        proc = estate.sweep(LANE, "--branches", "--yes", "--porcelain")
-    finally:
-        estate.origin.with_name("moved.git").rename(estate.origin)
-    items = items_of(proc.stdout, "branch")
-    assert items["feat/gone-merged"][0] == "keep", items
-    assert "origin could not be fetched" in items["feat/gone-merged"][3]
-    assert "feat/gone-merged" in estate.git("branch", "--format=%(refname:short)").splitlines()
-
-
-def test_a_clean_tree_without_origin_is_bundled_and_removed_under_bundle_yes(estate):
-    """Copilot on #168: `--yes` fetches, and a repository with no origin is
-    no failed fetch - the dry run's `bundle+remove` is what `--yes` does."""
-    solo = estate.projects / "solo"
-    estate.git("init", "-q", "-b", "main", solo, cwd=estate.root)
-    estate.commit(solo, "solo", {"s.txt": "s\n"})
-    lone = estate.lane_root / "lone"
-    estate.lane_root.mkdir(parents=True, exist_ok=True)
-    estate.git("worktree", "add", "-q", "-b", "feat/lone", lone, "main", cwd=solo)
-    estate.commit(lone, "lone", {"l.txt": "l\n"})
-    estate.record(lone)
-    dry = rows_of(estate.sweep(LANE, "--bundle", "--porcelain").stdout)
-    assert dry[str(lone)][0] == "bundle+remove", dry
-    yes = estate.sweep(LANE, "--bundle", "--yes", "--porcelain")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert not lone.exists()
-    (archive,) = estate.archives()
-    assert (archive / "lone.bundle").is_file()
-
-
-def test_a_distance_to_origin_that_cannot_be_read_keeps_the_tree(estate):
-    """Copilot on #168: a failed `rev-list` is a read error, never "0 ahead"
-    - which is what lets a tree go without a rescue."""
-    tree = estate.worktree("broken", "feat/broken", record=False)
-    pushed = estate.commit(tree, "c", {"c.txt": "c\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/broken", cwd=tree)
-    estate.commit(tree, "d", {"d.txt": "d\n"})
-    estate.record(tree)
-    # origin's tip goes missing from the clone's object store: the distance
-    # from it to HEAD can no longer be walked
-    obj = estate.checkout / ".git" / "objects" / pushed[:2] / pushed[2:]
-    assert obj.is_file()
-    obj.unlink()
-    proc = estate.sweep(LANE, "--porcelain")
-    rows = rows_of(proc.stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "could not be read" in rows[str(tree)][2]
-
-
-def test_killed_suite_sandboxes_whose_owner_is_gone_are_removed(estate):
-    user = os.environ.get("USER") or __import__("getpass").getuser()
-    base = estate.sandboxes
-    old = time.time() - 7200
-    dead = base / "tmp.deadbeef01"
-    young = base / "tmp.youngone02"
-    held = base / "tmp.heldopen03"
-    for d in (dead, young, held):
-        d.mkdir()
-        (d / "f").write_text("x")
-    # A SUITE'S MARK IN A `tmp.*` IS NO PROOF (#170 item 1, option (b)):
-    # pytest's `.lock`, naming a pid that is gone - listed, never removed.
-    (dead / ".lock").write_text(f"{_dead_pid()}\n")
-    for d in (dead, held):
-        for p in (d / "f", d / ".lock", d):
-            if p.exists():
-                os.utime(p, (old, old))
-    pyroot = base / f"pytest-of-{user}"
-    gone_run = pyroot / "pytest-7"
-    live_run = pyroot / "pytest-8"
-    for d in (gone_run, live_run):
-        d.mkdir(parents=True)
-    (gone_run / ".lock").write_text(f"{_dead_pid()}\n")
-    (live_run / ".lock").write_text(f"{os.getpid()}\n")
-    sleeper = subprocess.Popen(["sleep", "300"], cwd=str(held))
-    try:
-        proc = estate.sweep(LANE, "--include-sandboxes", "--yes", "--porcelain")
-    finally:
-        sleeper.kill()
-        sleeper.wait()
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not gone_run.exists()
-    assert dead.is_dir() and items_of(proc.stdout, "sandbox")[str(dead)][0] == "list"
-    assert young.is_dir(), "younger than the minimum age"
-    assert held.is_dir(), "a live process stands in it"
-    assert live_run.is_dir(), "its .lock names a live pid"
-
-
-def test_links_lists_every_broken_symlink_and_gitdir_pointer(estate):
-    estate.git("push", "-q", "origin", "main")
-    (estate.projects / "dangling").symlink_to(estate.projects / "nowhere")
-    (estate.projects / "fine").symlink_to(estate.checkout)
-    tree = estate.worktree("moved", "feat/moved")
-    shutil.move(str(estate.checkout / ".git" / "worktrees" / "moved"),
-                str(estate.root / "elsewhere"))
-    proc = estate.sweep(LANE, "--links", "--porcelain")
-    links = items_of(proc.stdout, "link")
-    assert str(estate.projects / "dangling") in links
-    assert "nowhere" in links[str(estate.projects / "dangling")][3]
-    assert str(tree / ".git") in links and "gitdir pointer" in links[str(tree / ".git")][3]
-    assert str(estate.projects / "fine") not in links
-
-
-def test_a_clone_something_leans_on_is_load_bearing_and_never_removed(estate):
-    """CLONES AS SHARED GIT STORES (cause 14): a clone another repository
-    reads objects from, or names as a remote, is never removed."""
-    store = estate.lane_root / "store"
-    estate.git("clone", "-q", GH_URL, store, cwd=estate.root)
-    dependent = estate.projects / "dependent"
-    estate.git("clone", "-q", "--shared", store, dependent, cwd=estate.root)
-    assert (dependent / ".git" / "objects" / "info" / "alternates").exists()
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env={"LANE_WORKTREES_CONF": str(conf)})
-    rows = rows_of(proc.stdout)
-    assert rows[str(store)][0] == "load-bearing", rows
-    assert str(dependent) in rows[str(store)][2] and "repack" in rows[str(store)][2]
-    assert store.is_dir()
-    again = estate.sweep(LANE, "--porcelain", env={"LANE_WORKTREES_CONF": str(conf)})
-    assert "LOAD-BEARING" in rows_of(again.stdout)[str(store)][2]
-
-
-# =================================================================== --expire
-
-def _archive(estate, days: int, branch: str | None, sha: str = "0" * 40,
-             manifest: bool = True) -> Path:
-    """A sweep archive `days` old, as `--yes` leaves one: DISPOSITION.md,
-    rescues.tsv naming `branch` at `sha`, and a MANIFEST.sha256 of both."""
-    when = _dt.datetime.now(_dt.timezone.utc) - _dt.timedelta(days=days, hours=1)
-    d = estate.state / "openRepoTools" / "sweeps" / LANE / when.strftime("%Y%m%dT%H%M%SZ")
-    d.mkdir(parents=True)
-    (d / "DISPOSITION.md").write_text("# x\n")
-    rows = "# origin\tbranch\tsha\tcheckout\ttree\n"
-    if branch:
-        rows += f"{GH_URL}\t{branch}\t{sha}\t-\t-\n"
-    (d / "rescues.tsv").write_text(rows)
-    if manifest:
-        (d / "MANIFEST.sha256").write_text("".join(
-            f"{hashlib.sha256((d / n).read_bytes()).hexdigest()}  {n}\n"
-            for n in ("DISPOSITION.md", "rescues.tsv")))
-    return d
-
-
-def test_expire_keeps_young_archives_and_any_whose_rescue_left_origin(estate):
-    estate.git("push", "-q", "origin", "main:refs/heads/rescue/repoA-1/kept-1")
-    sha = estate.git("rev-parse", "main")
-    young = _archive(estate, 89, "rescue/repoA-1/kept-1", sha)
-    due = _archive(estate, 90, "rescue/repoA-1/kept-1", sha)
-    orphan = _archive(estate, 120, "rescue/repoA-1/gone-1", sha)
-    plain = _archive(estate, 91, None)
-    # THE RESCUED COMMIT, NOT THE NAME: the branch is on origin at another sha.
-    moved = _archive(estate, 92, "rescue/repoA-1/kept-1", "1" * 40)
-    # AN ARCHIVE A SWEEP NEVER FINISHED (no manifest), and one holding a file
-    # its manifest does not list (a bundle the ledger never recorded).
-    unfinished = _archive(estate, 93, None, manifest=False)
-    stray = _archive(estate, 94, None)
-    (stray / "x.bundle").write_bytes(b"bundle")
-    # ... and one whose manifest lists a file that is gone (round 2)
-    lost = _archive(estate, 95, None)
-    with open(lost / "MANIFEST.sha256", "a") as fh:
-        fh.write(f"{'0' * 64}  lost.bundle\n")
-    dry = estate.sweep("--expire", "--porcelain")
-    assert dry.returncode == 3, dry.stdout + dry.stderr
-    rows = {line.split("\t")[2]: line.split("\t")[1] for line in dry.stdout.splitlines()}
-    why = {line.split("\t")[2]: line.split("\t")[4] for line in dry.stdout.splitlines()}
-    assert rows[str(young)] == "keep" and rows[str(due)] == "expire"
-    assert rows[str(orphan)] == "keep" and rows[str(plain)] == "expire"
-    assert rows[str(moved)] == "keep" and "not the rescued 1111111" in why[str(moved)]
-    assert rows[str(unfinished)] == "keep" and "MANIFEST" in why[str(unfinished)]
-    assert rows[str(stray)] == "keep" and "x.bundle" in why[str(stray)]
-    assert rows[str(lost)] == "keep" and "lost.bundle" in why[str(lost)]
-    assert young.is_dir() and due.is_dir()
-    yes = estate.sweep("--expire", "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert young.is_dir() and orphan.is_dir()
-    assert moved.is_dir() and unfinished.is_dir() and stray.is_dir() and lost.is_dir()
-    assert not due.exists() and not plain.exists()
-    log = (estate.state / "openRepoTools" / "sweeps" / "EXPIRED.log").read_text()
-    assert str(due) in log and str(orphan) not in log
-    conf = estate.root / "sweep.conf"
-    conf.write_text("retention_days=200\n")
-    later = estate.sweep("--expire", "--porcelain", env={"LANE_WORKTREES_CONF": str(conf)})
-    assert later.returncode == 0 and "\texpire\t" not in later.stdout
-
-
-# ======================================================= the porcelain contract
-
-def test_the_porcelain_exit_codes_lane_end_reads(estate):
-    """#163's gate: 0 nothing to retire, 3 something to retire, 2 refused."""
-    nothing = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert nothing.returncode == 0, nothing.stdout + nothing.stderr
-    last = nothing.stdout.splitlines()[-1].split("\t")
-    assert last[:2] == ["summary", "0"]
-    estate.worktree("w", "feat/w")
-    something = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert something.returncode == 3
-    assert something.stdout.splitlines()[0].split("\t")[:2] == ["lane", LANE]
-    assert something.stdout.splitlines()[-1].split("\t")[:2] == ["summary", "1"]
-    estate.extra_spec = {"lane-reconcile": {"rc": 1, "err": "the log could not be read\n"}}
-    refused = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert refused.returncode == 2 and "refused\t" in refused.stdout
-
-
-def test_yes_needs_no_enabling_variable(estate):
-    """#170 landed: `--yes` and `--expire --yes` act with no switch in the
-    environment (LANE_WORKTREES_ENABLE_YES is gone)."""
-    tree = estate.worktree("w", "feat/w")
-    estate.git("push", "-q", "-u", "origin", "feat/w", cwd=tree)
-    old = _archive(estate, 120, None)
-    assert "LANE_WORKTREES_ENABLE_YES" not in estate.env
-    yes = estate.sweep(LANE, "--yes", "--porcelain")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert not tree.exists()
-    expire = estate.sweep("--expire", "--yes")
-    assert expire.returncode == 0, expire.stdout + expire.stderr
-    assert not old.exists()
-
-
-def test_trees_under_the_lanes_root_or_carrying_its_trailer_are_its_own(estate):
-    """B1: a tree #97's inventory does not name is the lane's when it stands
-    under `.lane-worktrees/<lane>/`, or sits in `.claude/worktrees` on a branch
-    whose own commits carry this lane's trailer - so the gate does not pass a
-    lane whose trees were never recorded."""
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    estate.env["LANE_WORKTREES_CONF"] = str(conf)
-    rooted = estate.worktree("rooted", "feat/rooted", record=False)
-    trailed = estate.worktree("trailed", "feat/trailed", where="claude", record=False)
-    estate.commit(trailed, "mine", {"m.txt": "m\n"})
-    other = estate.worktree("other", "feat/other", where="claude", record=False)
-    estate.commit(other, "theirs", {"o.txt": "o\n"}, lane="repoB-2")
-    # A CLONE under the lane's root is never adopted: a lane makes worktrees.
-    clone = estate.lane_root / "cloned"
-    estate.git("clone", "-q", GH_URL, clone, cwd=estate.root)
-    proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    assert rows[str(rooted)][:2] == ("remove", "retire") and "the lane's by its root" in rows[str(rooted)][2]
-    assert rows[str(trailed)][1] == "retire" and "Lane: trailer" in rows[str(trailed)][2]
-    assert rows[str(other)][0] == "foreign"
-    assert rows[str(clone)][:2] == ("foreign", "-"), rows[str(clone)]
-    # NO SNAPSHOT AT ALL, and trees of its own: the gate does not pass.
-    estate.extra_spec = {"lane-reconcile": {"rc": 8},
-                         "binding": {"rc": 0, "out": "x\tx\tx\tx\tx\tx\there\tnone\n"},
-                         "live-holder": {"rc": 8}}
-    none = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert none.returncode == 2, none.stdout + none.stderr
-    assert "has no #97 snapshot (state NONE)" in none.stdout
-    assert str(rooted) in rows_of(none.stdout), "the table is still printed"
-
-
-def test_a_tree_another_lane_stacked_on_this_lanes_commit_is_not_adopted(estate):
-    """#174 review R1: a tree in `.claude/worktrees` was adopted when ANY of
-    its own commits carried this lane's trailer, so one another lane STACKED
-    on this lane's commit - base by repoA-1, tip and an edit in progress by
-    repoB-2 - was repoA-1's: `--yes` removed it and pushed repoB-2's edit to
-    `rescue/repoA-1/...`. HEAD's own trailer decides: it is repoB-2's tree."""
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    env = {"LANE_WORKTREES_CONF": str(conf)}
-    stacked = estate.worktree("stacked", "feat/stacked", where="claude", record=False)
-    estate.commit(stacked, "the base", {"base.txt": "b\n"})
-    estate.commit(stacked, "stacked on it", {"s.txt": "s\n"}, lane="repoB-2")
-    (stacked / "s.txt").write_text("repoB-2's edit in progress\n")
-    before = estate.remote_heads()
-    dry = estate.sweep(LANE, "--dry-run", "--porcelain", env=env)
-    assert dry.returncode == 0, dry.stdout + dry.stderr
-    assert rows_of(dry.stdout)[str(stacked)][:2] == ("foreign", "-"), dry.stdout
-    yes = estate.sweep(LANE, "--yes", "--porcelain", env=env)
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert (stacked / "s.txt").read_text() == "repoB-2's edit in progress\n"
-    assert estate.remote_heads() == before, "repoB-2's work was pushed by repoA-1's sweep"
-    assert estate.notes() == []
-    # ... and it is still the lane's whose commit HEAD is.
-    theirs = estate.sweep("repoB-2", "--dry-run", "--porcelain", env=env)
-    row = rows_of(theirs.stdout)[str(stacked)]
-    assert row[1] == "retire" and "Lane: trailer" in row[2], theirs.stdout + theirs.stderr
-
-
-def test_porcelain_escapes_a_tab_and_a_newline_in_a_path(estate):
-    """B3: a TAB or a newline in a tree's name is still one field of one row."""
-    estate.lane_root.mkdir(parents=True, exist_ok=True)
-    tab = estate.lane_root / "tab\tname"
-    nl = estate.lane_root / "nl\nname"
-    for i, path in enumerate((tab, nl)):
-        estate.git("worktree", "add", "-q", "-b", f"feat/odd{i}", path, "origin/main")
-    proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    lines = proc.stdout.splitlines()
-    assert all(ln.split("\t")[0] in ("lane", "tree", "summary") for ln in lines), lines
-    trees = [ln for ln in lines if ln.startswith("tree\t")]
-    assert all(len(ln.split("\t")) == 7 for ln in trees), lines
-    paths = [ln.split("\t")[3] for ln in trees]
-    assert str(tab).replace("\t", "\\t") in paths and str(nl).replace("\n", "\\n") in paths
-    if subprocess.run(["git", "worktree", "list", "--porcelain", "-z"], cwd=str(estate.checkout),
-                      capture_output=True).returncode == 0:
-        assert len(trees) == 2, "a newline in a registered path is one registration, not two"
-
-
-def test_a_path_that_is_not_utf8_is_a_row_not_a_traceback(estate):
-    """B2: a worktree named in Latin-1 is reported - exit inside 0/3/2."""
-    estate.lane_root.mkdir(parents=True, exist_ok=True)
-    bad = os.fsencode(str(estate.lane_root)) + b"/caf\xe9"
-    # A FILESYSTEM THAT REFUSES THE NAME HAS NO SUCH WORKTREE TO REPORT (#177).
-    # APFS, the macOS runner's, answers a non-UTF-8 name with EILSEQ ("Illegal
-    # byte sequence"), and git's own `.git/worktrees/caf\xe9` meets the same
-    # refusal. The directory is made first so the refusal is the filesystem's
-    # and not a fixture traceback; where it is made, the case stays live.
-    try:
-        os.mkdir(bad)
-    except OSError as exc:
-        pytest.skip(f"filesystem refuses non-UTF-8 names: {exc}")
-    add = subprocess.run(["git", "-C", str(estate.checkout), "worktree", "add", "-q", "-b",
-                          "feat/latin1", bad, "origin/main"], env=estate.env, capture_output=True)
-    if add.returncode != 0:
-        pytest.skip("filesystem refuses non-UTF-8 names: git worktree add exited "
-                    f"{add.returncode}: {add.stderr.decode('utf-8', 'replace').strip()}")
-    estate.write_spec()
-    for args in (("--dry-run", "--porcelain"), ("--dry-run",)):
-        proc = subprocess.run([sys.executable, str(LW), "sweep", LANE, *args], capture_output=True,
-                              env=estate.env, timeout=180, cwd=str(estate.root),
-                              stdin=subprocess.DEVNULL)
-        assert proc.returncode in (0, 3), (args, proc.stdout[-500:], proc.stderr[-800:])
-        assert b"Traceback" not in proc.stderr
-        assert bad in proc.stdout, "the path is reported as the bytes it is"
-
-
-def test_an_unreadable_pytest_sandbox_root_is_a_row_not_a_traceback(estate):
-    """B2: an unreadable `pytest-of-$USER` is listed as kept, exit 0."""
-    root = estate.sandboxes / f"pytest-of-{getpass.getuser()}"
-    root.mkdir()
-    root.chmod(0)
-    try:
-        proc = estate.sweep(LANE, "--include-sandboxes", "--dry-run", "--porcelain")
-    finally:
-        root.chmod(0o755)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "Traceback" not in proc.stderr
-    if os.geteuid() != 0:
-        rows = items_of(proc.stdout, "sandbox")
-        assert rows[str(root)][0] == "keep" and "could not be listed" in rows[str(root)][3]
-
-
-@pytest.mark.parametrize("breakage", ["head-removed", "gitfile-to-missing-gitdir", "objects-removed", "mode-000"])
-def test_a_lane_dir_whose_repository_git_cannot_read_still_refuses(estate, breakage):
-    """#170 G5 against a REAL failure, which the shim of
-    test_registrations_that_cannot_be_read_refuse_the_dry_run never makes: the
-    lane's recorded checkout IS a repository and `git worktree list` fails in
-    it. `rev-parse` then says "not a git repository" too, so a guard that reads
-    that answer alone as an absence would let the gate pass over it."""
-    import shutil as _sh
-    gitdir = estate.checkout / ".git"
-    if breakage == "head-removed":
-        (gitdir / "HEAD").unlink()
-    elif breakage == "gitfile-to-missing-gitdir":
-        _sh.rmtree(gitdir)
-        gitdir.write_text(f"gitdir: {estate.root / 'gone' / '.git'}\n")
-    elif breakage == "objects-removed":
-        _sh.rmtree(gitdir / "objects")
-    else:
-        if os.geteuid() == 0:
-            pytest.skip("root reads a mode-000 directory")
-        gitdir.chmod(0)
-    try:
-        proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    finally:
-        if breakage == "mode-000":
-            gitdir.chmod(0o755)
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert f"the worktree registrations of {estate.checkout} could not be read" in proc.stdout
-
-
-def test_a_lane_dir_that_holds_no_repository_is_an_absence(estate):
-    """The repoQ-1 shape (#163): a recorded `dir` with no `.git` at all has no
-    registrations to read, so it is never G5's refusal."""
-    import shutil as _sh
-    _sh.rmtree(estate.checkout / ".git")
-    proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert "could not be read (git worktree list failed)" not in proc.stdout, proc.stdout + proc.stderr
-    assert proc.returncode in (0, 3), proc.stdout + proc.stderr
-
-
-def test_usage_errors_are_64(estate):
-    for argv in (["--bogus"], [], ["--word", "x"]):
-        proc = estate.sweep(*argv) if argv != [] else estate.sweep()
-        assert proc.returncode == 64, (argv, proc.stdout, proc.stderr)
-    proc = subprocess.run([sys.executable, str(LW), "--help"], capture_output=True, text=True)
-    assert proc.returncode == 0 and "sweep <lane>" in proc.stdout
-
-
-# ========================================== the real helper, end to end (#97)
-
-UUID_R = "33333333-3333-4333-8333-333333333333"
-
-
-def _real_estate(tmp_path: Path, host: str) -> tuple:
-    """The fake estate, with the REAL `lanes-edit.sh` and a workspace."""
-    e = Estate(tmp_path)
-    wip_origin = tmp_path / "wip.git"
-    wip = e.projects / "wip"
-    e.git("init", "-q", "--bare", "-b", "main", wip_origin, cwd=tmp_path)
-    e.git("clone", "-q", wip_origin, wip, cwd=tmp_path)
-    (wip / "lanes" / "log").mkdir(parents=True)
-    (wip / "lanes" / "LANES.md").write_text("\n".join([
-        "# LANES.md", "",
-        "| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |",
-        "|---|---|---|---|---|---|---|",
-        f"| `{LANE}` | harness `{UUID_R}` | Eagle / test / brett | 2026-10-05T00:00Z | none | handoffs/{LANE}.md | LIVE · 2026-10-05T00:00:00Z · working |",
-        ""]))
-    (wip / "lanes" / "log" / f"{LANE}.md").write_text(
-        f"STARTED — lane {LANE}, session {UUID_R}@Eagle, 2026-10-05T00:00:00Z, "
-        f"lane:{LANE} → home {SLUG}; dir {e.checkout}; host {host}; container none; os linux\n")
-    e.git("add", "-A", cwd=wip)
-    e.git("commit", "-q", "-m", "seed", cwd=wip)
-    e.git("push", "-q", "origin", "main", cwd=wip)
-    agents = e.home / ".agents"
-    agents.mkdir()
-    (agents / "workspace.yaml").write_text(f"repository: {wip_origin}\npath: {wip}\n")
-    e.env.update(AGENT_PROTOCOL_ROOT=str(agents), LANES_EDIT=str(LANES_EDIT),
-                 LANES_HOST="eagle", LANES_OS="linux", LANES_CONTAINER="none",
-                 LANES_IN_CONTAINER="0", LANES_NO_GITHUB="1", LANES_INDEX="off",
-                 LANES_LANE_STATE_ROOT=str(tmp_path / "lane-state"),
-                 CLAUDE_CONFIG_DIR=str(e.home / ".claude"), LANES_SESSION=UUID_R)
-    e.env.pop("CLAUDE_CODE_SESSION_ID", None)
-    return e, wip
-
-
-def _real_tree(e: Estate, name: str) -> Path:
-    path = e.worktree(name, f"feat/{name}", record=False)
-    e.commit(path, name, {f"{name}.txt": "x\n"})
-    e.git("push", "-q", "-u", "origin", f"feat/{name}", cwd=path)
-    proc = subprocess.run(["bash", str(LANES_EDIT), "set-lane-tree", LANE, str(path),
-                           "--checkout", str(e.checkout)], capture_output=True, text=True,
-                          env=e.env, check=False)
-    assert proc.returncode == 0, proc.stderr
-    return path
-
-
-def test_the_real_helper_inventory_and_register_line(tmp_path):
-    """The inventory is #97's own (`set-lane-tree`), the reconciliation is
-    the helper's own, and the register line lands in the lane's own log."""
-    e, wip = _real_estate(tmp_path, host="eagle")
-    mine = _real_tree(e, "mine")
-    foreign = e.worktree("other", "feat/other", where="claude", record=False)
-    dry = e.sweep(LANE, "--porcelain")
-    rows = rows_of(dry.stdout)
-    assert rows[str(mine)][0] == "remove", dry.stdout + dry.stderr
-    assert rows[str(foreign)][0] == "foreign"
-    yes = e.sweep(LANE, "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert not mine.exists() and foreign.is_dir()
-    e.git("pull", "-q", "origin", "main", cwd=wip)
-    log = (wip / "lanes" / "log" / f"{LANE}.md").read_text()
-    noted = [ln for ln in log.splitlines() if ln.startswith("NOTED")]
-    assert len(noted) == 1 and str(mine) in noted[0] and "remove" in noted[0], log
-
-
-def test_the_real_helper_refuses_a_lane_bound_on_another_host(tmp_path):
-    e, _wip = _real_estate(tmp_path, host="raven")
-    mine = _real_tree(e, "mine")
-    dry = e.sweep(LANE, "--porcelain")
-    assert dry.returncode == 2, dry.stdout + dry.stderr
-    yes = e.sweep(LANE, "--yes", "--live", "none")
-    assert yes.returncode == 2 and "raven" in yes.stdout
-    assert mine.is_dir()
-
-
-# ============================================= #170: the --yes data-loss paths
-
-def _rebind_elsewhere(e: Estate, tmp_path: Path) -> None:
-    """ANOTHER PLACE binds the lane after this workstation last fetched the
-    register: its STARTED line is on origin and not in this clone's ref."""
-    other = tmp_path / "other-wip"
-    e.git("clone", "-q", tmp_path / "wip.git", other, cwd=tmp_path)
-    log = other / "lanes" / "log" / f"{LANE}.md"
-    log.write_text(log.read_text() +
-                   f"STARTED — lane {LANE}, session {UUID_R}@Raven, 2026-10-05T09:00:00Z, "
-                   f"lane:{LANE} → home {SLUG}; dir {e.checkout}; host raven; container none; "
-                   "os linux\n")
-    e.git("commit", "-q", "-am", "raven binds the lane", cwd=other)
-    e.git("push", "-q", "origin", "main", cwd=other)
-
-
-@pytest.mark.parametrize("case", ["origin-unreachable", "LANES_NO_FETCH-inherited"])
-def test_yes_reads_the_register_now_or_refuses(tmp_path, case):
-    """#170 A1: `log_sync` answers 0 when it cannot fetch, and an inherited
-    LANES_NO_FETCH skips the fetch, so a lane rebound on another host read as
-    bound HERE and its tree was removed. --yes fetches the register itself:
-    a fetch that fails refuses, and the inherited variable is not obeyed."""
-    e, _wip = _real_estate(tmp_path, host="eagle")
-    mine = _real_tree(e, "mine")
-    _rebind_elsewhere(e, tmp_path)
-    env = {}
-    if case == "origin-unreachable":
-        (tmp_path / "wip.git").rename(tmp_path / "wip-offline.git")
-    else:
-        env = {"LANES_NO_FETCH": "1"}
-    proc = e.sweep(LANE, "--yes", "--live", "none", "--porcelain", env=env)
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert mine.is_dir() and (mine / "mine.txt").is_file()
-    refused = [ln for ln in proc.stdout.splitlines() if ln.startswith("refused\t")]
-    assert refused, proc.stdout
-    if case == "origin-unreachable":
-        assert "could not be fetched" in refused[0]
-    else:
-        assert "raven" in refused[0]
-
-
-def test_a_mirror_style_fetch_refspec_prunes_no_local_branch(estate):
-    """#170 item 6: with `remote.origin.fetch = +refs/heads/*:refs/heads/*`,
-    `git fetch --prune origin` deletes every local branch origin lacks - before
-    anything was classified or rescued. The sweep's fetch pins its refspec."""
-    estate.git("config", "--replace-all", "remote.origin.fetch", "+refs/heads/*:refs/heads/*")
-    estate.git("checkout", "-q", "-b", "feat/local-only")
-    local_only = estate.commit(estate.checkout, "local only", {"lo.txt": "lo\n"})
-    # NOTHING CHECKED OUT THAT ORIGIN HAS: git refuses to fetch into a checked
-    # out branch, which would have hidden the prune.
-    estate.git("checkout", "-q", "--detach", "origin/main")
-    estate.git("tag", "local-tag", local_only)
-    tree = estate.worktree("det")
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert estate.git("rev-parse", "-q", "--verify", "refs/heads/feat/local-only",
-                      check=False) == local_only, "a local-only branch was pruned"
-    assert estate.git("rev-parse", "-q", "--verify", "refs/tags/local-tag",
-                      check=False) == local_only
-    assert not tree.exists()
-
-
-def test_a_lane_root_that_cannot_be_listed_refuses_the_dry_run(estate):
-    """#170 G1: a lane worktree root that cannot be listed was read as an
-    absent one, so with an empty inventory the dry run exited 0 and cleared
-    #163's gate over trees nobody could see."""
-    if os.geteuid() == 0:
-        pytest.skip("root lists a mode-000 directory")
-    estate.lane_root.mkdir(parents=True)
-    (estate.lane_root / "hidden").mkdir()
-    estate.lane_root.chmod(0)
-    try:
-        proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    finally:
-        estate.lane_root.chmod(0o755)
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert f"the lane's worktree root {estate.lane_root} could not be listed" in proc.stdout
-
-
-def _git_shim(estate, refuse: str) -> dict:
-    """A PATH whose `git` fails `git ... worktree list`, as a repository git
-    cannot read would, and runs every other git as itself."""
-    shim = estate.root / "shim"
-    shim.mkdir(exist_ok=True)
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\nw=0\nfor a in \"$@\"; do\n"
-        f"  case \"$a\" in worktree) w=1 ;; {refuse}) [ \"$w\" = 1 ] && "
-        "{ echo 'fatal: the shim refuses' >&2; exit 128; } ;; esac\n"
-        f"done\nexec \"{real_git}\" \"$@\"\n")
-    (shim / "git").chmod(0o755)
-    return {"PATH": f"{shim}{os.pathsep}{estate.env['PATH']}"}
-
-
-def test_registrations_that_cannot_be_read_refuse_the_dry_run(estate):
-    """#170 G5: when both `git worktree list` calls failed, the answer was an
-    empty list - the same as a repository with no worktrees - so discovery
-    could report nothing to retire."""
-    tree = estate.worktree("w", "feat/w")
-    proc = estate.sweep(LANE, "--dry-run", "--porcelain", env=_git_shim(estate, "list"))
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert f"the worktree registrations of {estate.checkout} could not be read" in proc.stdout
-    assert tree.is_dir()
-
-
-def test_a_dependent_anywhere_in_the_estate_makes_a_clone_load_bearing(estate):
-    """#170 A11: the estate walk never entered a plain directory inside a
-    repository, so a clone there that borrows a lane clone's objects was
-    unseen and the clone was deleted from under it."""
-    store = estate.lane_root / "store"
-    estate.git("clone", "-q", GH_URL, store, cwd=estate.root)
-    host = estate.projects / "host"
-    estate.git("init", "-q", "-b", "main", host, cwd=estate.root)
-    dependent = host / "vendor" / "dep"
-    estate.git("clone", "-q", "--shared", store, dependent, cwd=estate.root)
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env={"LANE_WORKTREES_CONF": str(conf)})
-    rows = rows_of(proc.stdout)
-    assert rows[str(store)][0] == "load-bearing", rows
-    assert str(dependent) in rows[str(store)][2]
-    assert store.is_dir()
-    assert estate.git("log", "-1", "--format=%s", cwd=dependent) == "seed"
-
-
-def test_a_partial_dependents_scan_removes_no_clone(estate):
-    """#170 A11: a dependent in a directory the walk could not read is as
-    unseen as one it never looked for; a partial scan deletes no clone."""
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 directory")
-    store = estate.lane_root / "store"
-    estate.git("clone", "-q", GH_URL, store, cwd=estate.root)
-    sealed = estate.projects / "sealed"
-    (sealed / "inner").mkdir(parents=True)
-    sealed.chmod(0)
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    try:
-        proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                            env={"LANE_WORKTREES_CONF": str(conf)})
-    finally:
-        sealed.chmod(0o755)
-    rows = rows_of(proc.stdout)
-    assert rows[str(store)][0] == "keep", rows
-    assert "was partial" in rows[str(store)][2] and str(sealed) in rows[str(store)][2]
-    assert store.is_dir()
-
-
-@pytest.mark.parametrize("where", ["nested-in-the-estate", "recorded-in-the-register"])
-def test_another_lanes_claim_is_read_wherever_its_control_root_is(estate, where):
-    """#170 G6: other lanes' claims were read only beside THIS lane's control
-    root. A lane whose checkout is nested keeps its `.lane-state` beside that
-    checkout, so its claim was missed and the tree was not contested."""
-    tree = estate.worktree("shared", "feat/shared")
-    estate.git("push", "-q", "-u", "origin", "feat/shared", cwd=tree)
-    if where == "nested-in-the-estate":
-        group = estate.projects / "group"
-        other = "repoB-3"
-    else:
-        # IN A PLAIN DIRECTORY OF A REPOSITORY, where the shape walk never
-        # goes, so only the register's recorded `dir` finds it - and in this
-        # sweep's estate, the only one whose claims are read (#174 review R3).
-        host = estate.projects / "host"
-        estate.git("init", "-q", "-b", "main", host, cwd=estate.root)
-        group = host / "vendor" / "group"
-        other = "repoC-4"
-        estate.register_line(other, (
-            f"STARTED — lane {other}, session {OTHER}@Eagle, 2026-10-05T00:00:00Z, "
-            f"lane:{other} → home opensoft/repoC; dir {group / 'repoC'}; host eagle; "
-            "container none; os linux"))
-    # THE OTHER LANE'S CHECKOUT, nested one level down in a plain directory.
-    estate.git("init", "-q", "-b", "main", group / "repoC", cwd=estate.root)
-    claims = group / ".lane-state" / other / "trees"
-    claims.mkdir(parents=True)
-    (claims / "c1.yaml").write_text(f"schema: 1\npath: {tree}\n")
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert f"lane {other}'s inventory names it too" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert tree.is_dir()
-
-
-@pytest.mark.parametrize("where", ["another-estate", "this-estate"])
-def test_an_unreadable_claim_never_refuses_a_lane_with_no_tree(estate, where):
-    """#174 review R3: every lane's control root the register names, in ANY
-    estate, was read, so one pathless sidecar anywhere on the workstation
-    made the sweep exit 2 for a lane with nothing on disk - and lane-end's
-    gate with it. Another estate's claims are not read; in this one, with no
-    tree for a claim to take, an unreadable one is a note. With a tree, this
-    estate's still refuses."""
-    group = (estate.root / "away" if where == "another-estate" else estate.projects) / "group"
-    other = "repoE-6"
-    estate.register_line(other, (
-        f"STARTED — lane {other}, session {OTHER}@Eagle, 2026-10-05T00:00:00Z, "
-        f"lane:{other} → home opensoft/repoE; dir {group / 'repoE'}; host eagle; "
-        "container none; os linux"))
-    claims = group / ".lane-state" / other / "trees"
-    claims.mkdir(parents=True)
-    (claims / "c1.yaml").write_text("schema: 1\n")
-    said = f"lane {other}'s inventory record c1.yaml (it names no path) could not be read"
-    gate = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert gate.returncode == 0, gate.stdout + gate.stderr
-    assert "refused\t" not in gate.stdout
-    shown = estate.sweep(LANE, "--dry-run")
-    assert shown.returncode == 0 and "REFUSED" not in shown.stdout, shown.stdout + shown.stderr
-    if where == "this-estate":
-        assert f"note: {said}" in shown.stdout, shown.stdout
-    else:
-        assert said not in shown.stdout, "a claim in another estate was read"
-    estate.worktree("w", "feat/w")
-    again = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert again.returncode == (2 if where == "this-estate" else 3), again.stdout + again.stderr
-    assert (said in again.stdout) == (where == "this-estate")
-
-
-@pytest.mark.parametrize("flag", ["--skip-worktree", "--assume-unchanged"])
-def test_an_edit_git_status_hides_keeps_the_tree(estate, flag):
-    """#170 A2: a file flagged skip-worktree or assume-unchanged reads as
-    clean in `git status` and `git add -A` skips it, so its edit was in no
-    rescue and the tree was removed with it."""
-    tree = estate.worktree("hidden", "feat/hidden")
-    estate.commit(tree, "cfg", {"config.yml": "shared: 1\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/hidden", cwd=tree)
-    estate.git("update-index", flag, "config.yml", cwd=tree)
-    (tree / "config.yml").write_text("shared: 1\nlocal_secret: PRECIOUS\n")
-    assert estate.git("status", "--porcelain", cwd=tree) == ""
-    dry = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert dry[str(tree)][0] == "keep", dry[str(tree)]
-    assert "skip-worktree or assume-unchanged differ" in dry[str(tree)][2]
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert (tree / "config.yml").read_text().endswith("PRECIOUS\n")
-
-
-def test_a_sparse_checkouts_absent_files_are_no_edit(estate):
-    """A skip-worktree file that is NOT in the tree (a sparse checkout's) is
-    no edit: the tree is still removed."""
-    tree = estate.worktree("sparse", "feat/sparse")
-    estate.commit(tree, "two", {"keep/a.txt": "a\n", "drop/b.txt": "b\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/sparse", cwd=tree)
-    estate.git("update-index", "--skip-worktree", "drop/b.txt", cwd=tree)
-    (tree / "drop" / "b.txt").unlink()
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-
-
-def test_a_clone_inside_a_venv_keeps_its_tree(estate):
-    """#170 A3: `pip install -e git+...` clones into `<venv>/src/<pkg>`, and
-    the nested-repository walk passed over venvs before it looked for a
-    `.git` - so the dependency's unpushed fix was deleted with the tree."""
-    tree = estate.worktree("venvsrc", "feat/venvsrc")
-    estate.commit(tree, "ignore venv", {".gitignore": ".env\n__pycache__/\n*.pyc\n.venv/\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/venvsrc", cwd=tree)
-    venv = tree / ".venv"
-    (venv / "bin").mkdir(parents=True)
-    (venv / "pyvenv.cfg").write_text("home = /usr\n")
-    dep = venv / "src" / "somedep"
-    estate.git("init", "-q", "-b", "main", dep, cwd=estate.root)
-    estate.commit(dep, "my unpushed fix", {"fix.py": "FIX = 1\n"})
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert f"nested inside it at {dep}" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert (dep / "fix.py").is_file()
-    # ... AND ITS VENV IS NO CACHE TO TAKE (#174, Copilot round 1): the tree
-    # kept for the clone still gave up its `.venv` to `--include-caches`, and
-    # the clone and its unpushed fix went with it.
-    caches = estate.sweep(LANE, "--include-caches", "--yes", "--porcelain")
-    assert caches.returncode == 0, caches.stdout + caches.stderr
-    row = items_of(caches.stdout, "cache")[str(venv)]
-    assert row[0] == "keep" and f"a repository lies inside it ({dep})" in row[3], row
-    assert (dep / "fix.py").is_file()
-    assert estate.git("log", "-1", "--format=%s", cwd=dep) == "my unpushed fix"
-
-
-def test_a_clones_tag_only_commits_keep_it(estate):
-    """#170 item 4: a clone can hold unpublished commits reachable only
-    from a local tag; the clone check read branches and the stash only."""
-    clone = estate.lane_root / "tagged"
-    estate.git("clone", "-q", GH_URL, clone, cwd=estate.root)
-    estate.commit(clone, "released locally", {"r.txt": "r\n"})
-    estate.git("tag", "-a", "-m", "v1", "v1.0", cwd=clone)
-    estate.git("reset", "-q", "--hard", "origin/main", cwd=clone)
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    env = {"LANE_WORKTREES_CONF": str(conf)}
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain", env=env)
-    rows = rows_of(proc.stdout)
-    assert rows[str(clone)][0] == "keep", rows[str(clone)]
-    assert "its tag v1.0 holds commits origin lacks" in rows[str(clone)][2]
-    assert estate.git("cat-file", "-t", "v1.0", cwd=clone) == "tag"
-
-
-def _with_submodule(estate, name: str) -> tuple:
-    sub_origin = estate.remotes / "sub.git"
-    estate.git("init", "-q", "--bare", "-b", "main", sub_origin, cwd=estate.root)
-    seed = estate.root / "sub-seed"
-    estate.git("clone", "-q", sub_origin, seed, cwd=estate.root)
-    estate.commit(seed, "sub", {"s.txt": "s\n"})
-    estate.git("push", "-q", "origin", "main", cwd=seed)
-    tree = estate.worktree(name, f"feat/{name}", record=False)
-    estate.git("submodule", "add", "-q", str(sub_origin), "sub", cwd=tree)
-    estate.commit(tree, "add sub")
-    estate.git("push", "-q", "-u", "origin", f"feat/{name}", cwd=tree)
-    estate.record(tree)
-    return tree, tree / "sub"
-
-
-@pytest.mark.parametrize("what", ["branch", "stash"])
-def test_a_submodules_unpublished_branch_or_stash_keeps_its_tree(estate, what):
-    """#170 item 5: only a submodule's HEAD was checked, while a worktree's
-    submodule keeps its whole repository under `.git/worktrees/<id>/modules/`
-    - its branches and stash went with the tree."""
-    tree, sub = _with_submodule(estate, "withsub")
-    if what == "branch":
-        estate.git("checkout", "-q", "-b", "side", cwd=sub)
-        estate.commit(sub, "side work", {"side.txt": "x\n"})
-        estate.git("checkout", "-q", "--detach", "origin/main", cwd=sub)
-    else:
-        (sub / "s.txt").write_text("stashed\n")
-        estate.git("stash", "-q", cwd=sub)
-    assert estate.git("status", "--porcelain", cwd=tree) == ""
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    want = "its branch side holds commits" if what == "branch" else "has a stash"
-    assert f"submodule sub" in rows[str(tree)][2] and want in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert tree.is_dir()
-
-
-def test_an_ignored_file_beneath_a_build_named_directory_is_archived(estate):
-    """#170 A6: an ignored file was dropped unarchived when ANY ancestor was
-    named like build output - `docker/build/prod.env` went, `top.env` beside
-    it was archived."""
-    tree = estate.worktree("deploy", "feat/deploy")
-    estate.commit(tree, "compose", {".gitignore": ".env\n*.env\n__pycache__/\n",
-                                    "docker/build/Dockerfile": "FROM x\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/deploy", cwd=tree)
-    (tree / "docker" / "build" / "prod.env").write_text("DB_PASSWORD=PRECIOUS\n")
-    (tree / "top.env").write_text("TOKEN=kept\n")
-    (tree / "build").mkdir()
-    (tree / "build" / "out.bin").write_bytes(b"\0" * 16)
-    (tree / ".gitignore").write_text(".env\n*.env\n__pycache__/\n/build/\n")
-    estate.git("add", ".gitignore", cwd=tree)
-    estate.commit(tree, "ignore build output")
-    estate.git("push", "-q", "origin", "feat/deploy", cwd=tree)
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    (archive,) = estate.archives()
-    with tarfile.open(archive / "deploy-ignored.tar.gz") as tf:
-        names = tf.getnames()
-    assert "docker/build/prod.env" in names and "top.env" in names, names
-    assert not any(n.startswith("build") for n in names), "build output is not archived"
-
-
-@pytest.mark.parametrize("why", ["open-pr", "another-lanes-trailer", "gh-unreadable"])
-def test_unreviewed_commits_never_go_onto_somebody_elses_branch(estate, why):
-    """#170 A7: push+remove pushed the lane's local commit onto a teammate's
-    OPEN pull request's branch. Where an open PR names the branch, its tip
-    carries another lane's trailer, or whether a PR names it cannot be read,
-    the commits go to a rescue branch and origin's branch is left alone."""
-    tree = estate.worktree("review", "feat/teammate")
-    tip = estate.commit(tree, "teammate's work", {"t.txt": "t\n"},
-                        lane="repoB-9" if why != "gh-unreadable" else LANE)
-    estate.git("push", "-q", "-u", "origin", "feat/teammate", cwd=tree)
-    if why == "open-pr":
-        estate.pr(77, "feat/teammate", "OPEN", tip)
-    mine = estate.commit(tree, "the lane's experiment while reviewing", {"t.txt": "x\n"})
-    env = {"LANES_NO_GITHUB": "1"} if why == "gh-unreadable" else {}
-    before = estate.remote_heads()["feat/teammate"]
-    dry = rows_of(estate.sweep(LANE, "--porcelain", env=env).stdout)
-    assert dry[str(tree)][0] == "rescue+remove", dry[str(tree)]
-    want = {"open-pr": "PR #77 is open", "another-lanes-trailer": "carries lane repoB-9's work",
-            "gh-unreadable": "whether an open pull request names"}[why]
-    assert want in dry[str(tree)][2]
-    proc = estate.sweep(LANE, "--yes", "--porcelain", env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    heads = estate.remote_heads()
-    assert heads["feat/teammate"] == before, "origin's branch moved"
-    assert [b for b, s in heads.items() if b.startswith(f"rescue/{LANE}/review-") and s == mine]
-    assert not tree.exists()
-
-
-def test_a_landed_line_never_deletes_a_branch_gh_answers_open(estate):
-    """#170 A8: a register LANDED line naming the wrong number (#21 for #20)
-    beat gh's live OPEN for #21, and --yes deleted the open PR's remote
-    branch - which closes the PR."""
-    estate.register_line(LANE, f"LANDED — lane {LANE}, session {ME}@Eagle, "
-                               f"2026-10-05T00:00:00Z, {SLUG}#21 → main abc1234")
-    tree = estate.worktree("openpr", "feat/open")
-    tip = estate.commit(tree, "work under review", {"r.txt": "r\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/open", cwd=tree)
-    estate.pr(21, "feat/open", "OPEN", tip)
-    dry = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert dry[str(tree)][0] == "remove+delete-branch", dry[str(tree)]
-    assert "gh still answers PR #21 OPEN" in dry[str(tree)][2]
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert estate.remote_heads().get("feat/open") == tip, "the open PR's branch was deleted"
-    assert "remote branch kept (gh still answers PR #21 OPEN)" in rows_of(proc.stdout)[str(tree)][2]
-
-
-def _bundle_holds(estate, bundle: Path, sha: str) -> bool:
-    """`sha` is reachable from a head of `bundle` (fetched into the lane's
-    checkout under refs/restored/, where the bundle's prerequisites are)."""
-    estate.git("fetch", "-q", str(bundle), "+refs/*:refs/restored/*")
-    heads = estate.git("for-each-ref", "--format=%(objectname)", "refs/restored/").split()
-    found = bool(heads) and sha in estate.git("rev-list", *heads).split()
-    for ref in estate.git("for-each-ref", "--format=%(refname)", "refs/restored/").split():
-        estate.git("update-ref", "-d", ref)
-    return found
-
-
-def _ledger(archive: Path) -> list:
-    return [ln.split("\t") for ln in (archive / "rescues.tsv").read_text().splitlines()
-            if ln and not ln.startswith("#")]
-
-
-def test_a_pruned_registrations_detached_commit_is_rescued_first(estate):
-    """#170 A4: `prune` dropped the only pointer to a detached commit - the
-    directory is gone and its registration's HEAD names a commit no branch
-    or origin has."""
-    tree = estate.worktree("ext", None)
-    own = estate.commit(tree, "work on a disk that is offline now", {"x.txt": "PRECIOUS\n"})
-    shutil.rmtree(tree)
-    dry = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert dry[str(tree)][0] == "rescue+prune", dry[str(tree)]
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert str(tree) not in estate.git("worktree", "list", "--porcelain")
-    rescued = [b for b, s in estate.remote_heads().items()
-               if b.startswith(f"rescue/{LANE}/ext-") and s == own]
-    assert rescued, estate.remote_heads()
-    (archive,) = estate.archives()
-    assert _bundle_holds(estate, next(archive.glob("ext*.bundle")), own)
-
-
-def test_a_commit_only_the_reflog_names_is_bundled_before_removal(estate):
-    """#170 A5: a commit made in a detached tree and then checked out away
-    from is in no ref - only the tree's HEAD reflog names it - so the
-    removal (which deletes that reflog) lost it. It is bundled first, and
-    the ledger records the bundle as its only copy (#170 item 8)."""
-    tree = estate.worktree("det", None)
-    own = estate.commit(tree, "an experiment", {"exp.txt": "PRECIOUS\n"})
-    estate.git("checkout", "-q", "--detach", "origin/main", cwd=tree)
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    (archive,) = estate.archives()
-    bundles = sorted(archive.glob("det*.bundle"))
-    assert bundles and _bundle_holds(estate, bundles[0], own)
-    assert [r for r in _ledger(archive) if r[0] == "-" and r[1].startswith("bundle:")
-            and r[2] == own], _ledger(archive)
-
-
-def test_the_self_check_refuses_a_removal_that_would_lose_a_commit(estate):
-    """The invariant - nothing deleted that is not first on origin or in a
-    bundle - is asked of git once more right before each removal. With the
-    reflog bundle switched off (the suite's seam), the commit only the
-    reflog names would be lost: the removal is refused, exit 2, a
-    DISPOSITION.md line says so, and nothing after it is acted on."""
-    first = estate.worktree("a-det", None)
-    own = estate.commit(first, "an experiment", {"exp.txt": "PRECIOUS\n"})
-    estate.git("checkout", "-q", "--detach", "origin/main", cwd=first)
-    second = estate.worktree("b-clean", "feat/b")
-    estate.git("push", "-q", "-u", "origin", "feat/b", cwd=second)
-    proc = estate.sweep(LANE, "--yes", "--porcelain",
-                        env={"LANE_WORKTREES_SEAM_NO_LOSS_BUNDLE": "1"})
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    assert "REFUSED by the self-check" in rows[str(first)][2]
-    assert first.is_dir() and second.is_dir(), "nothing is acted on after the refusal"
-    assert own in estate.git("rev-list", "--reflog")
-    (archive,) = estate.archives()
-    assert "REFUSED by the self-check" in (archive / "DISPOSITION.md").read_text()
-
-
-@pytest.mark.parametrize("tracked", [True, False])
-def test_untracked_files_go_to_the_bundle_never_to_origin(estate, tracked):
-    """#170 A9: the WIP rescue committed and PUSHED every untracked,
-    un-ignored file - a `gcp-service-account.json` included. Untracked
-    files now go to the bundle only (the ledger says it is their only
-    copy); tracked changes are still pushed."""
-    tree = estate.worktree("svc", "feat/svc")
-    estate.commit(tree, "w", {"w.txt": "base\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/svc", cwd=tree)
-    (tree / "gcp-service-account.json").write_text('{"private_key": "PRECIOUS"}\n')
-    if tracked:
-        (tree / "w.txt").write_text("changed\n")
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    for branch, sha in estate.remote_heads().items():
-        files = estate.git("ls-tree", "-r", "--name-only", sha, cwd=estate.origin)
-        assert "gcp-service-account.json" not in files.split(), branch
-    rescues = [b for b in estate.remote_heads() if b.startswith(f"rescue/{LANE}/svc-")]
-    if tracked:
-        assert len(rescues) == 1
-        assert estate.git("show", f"{rescues[0]}:w.txt", cwd=estate.origin) == "changed"
-    else:
-        assert rescues == [], "nothing tracked changed and the head is on origin"
-    (archive,) = estate.archives()
-    held = [r for r in _ledger(archive) if r[0] == "-" and r[1].startswith("bundle:")]
-    assert len(held) == 1, _ledger(archive)
-    assert _bundle_holds(estate, archive / held[0][1][len("bundle:"):], held[0][2])
-    assert estate.git("show", f"{held[0][2]}:gcp-service-account.json") == \
-        '{"private_key": "PRECIOUS"}'
-    assert "refs/lane-worktrees/" not in estate.git("for-each-ref", "--format=%(refname)")
-
-
-def test_push_untracked_pushes_them(estate):
-    tree = estate.worktree("svc", "feat/svc")
-    estate.git("push", "-q", "-u", "origin", "feat/svc", cwd=tree)
-    (tree / "notes.md").write_text("meant to be pushed\n")
-    proc = estate.sweep(LANE, "--yes", "--push-untracked", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    (rescue,) = [b for b in estate.remote_heads() if b.startswith(f"rescue/{LANE}/svc-")]
-    assert estate.git("show", f"{rescue}:notes.md", cwd=estate.origin) == "meant to be pushed"
-
-
-@pytest.mark.parametrize("lfs", [True, False])
-def test_a_push_runs_the_hooks_where_git_lfs_is_configured(estate, lfs):
-    """#170 A10: `push --no-verify` skips git-lfs's pre-push upload, so a
-    rescued branch reached origin as pointers only - and then the tree, the
-    one copy of the objects, was removed. With git-lfs configured the
-    hooks run; without it `--no-verify` stays."""
-    marker = estate.root / "pre-push.ran"
-    hook = estate.checkout / ".git" / "hooks" / "pre-push"
-    hook.write_text(f"#!/bin/sh\necho ran >> '{marker}'\nexit 0\n")
-    hook.chmod(0o755)
-    if lfs:
-        for key, value in (("filter.lfs.clean", "cat"), ("filter.lfs.smudge", "cat"),
-                           ("filter.lfs.required", "true")):
-            estate.git("config", key, value)
-    tree = estate.worktree("big", "feat/big")
-    estate.commit(tree, "assets", {"a.bin": "binary\n"})
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "feat/big" in estate.remote_heads()
-    assert marker.exists() == lfs
-
-
-def test_an_archive_whose_bundle_is_the_only_copy_never_expires(estate):
-    """#170 item 8: an origin-less tree removed through `bundle+remove`
-    left no row in rescues.tsv, so `--expire --yes` read the archive as
-    holding no rescue and could delete the only copy."""
-    solo = estate.projects / "solo"
-    estate.git("init", "-q", "-b", "main", solo, cwd=estate.root)
-    estate.commit(solo, "solo", {"s.txt": "s\n"})
-    lone = estate.lane_root / "lone"
-    estate.lane_root.mkdir(parents=True, exist_ok=True)
-    estate.git("worktree", "add", "-q", "-b", "feat/lone", lone, "main", cwd=solo)
-    tip = estate.commit(lone, "lone", {"l.txt": "l\n"})
-    estate.record(lone)
-    yes = estate.sweep(LANE, "--bundle", "--yes", "--porcelain")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    (archive,) = estate.archives()
-    assert [r for r in _ledger(archive) if r[:2] == ["-", "bundle:lone.bundle"] and r[2] == tip]
-    conf = estate.root / "sweep.conf"
-    conf.write_text("retention_days=0\n")
-    env = {"LANE_WORKTREES_CONF": str(conf)}
-    dry = estate.sweep("--expire", "--porcelain", env=env)
-    row = [ln.split("\t") for ln in dry.stdout.splitlines() if ln.startswith("archive\t")]
-    assert row and row[0][1] == "keep" and "only copy" in row[0][4], dry.stdout
-    assert estate.sweep("--expire", "--yes", env=env).returncode == 0
-    assert archive.is_dir()
-
-
-def test_scratch_holding_a_repository_is_kept(estate):
-    """#170 item 7: scratch was archived and removed when it had no `.git`
-    of its own, so a repository nested in it - a clone with an unpushed
-    commit, which no table row names - went with the rmtree."""
-    scratch = estate.lane_root / "x-scratch"
-    scratch.mkdir(parents=True)
-    (scratch / "notes.md").write_text("findings\n")
-    inner = scratch / "deps" / "lib"
-    estate.git("clone", "-q", GH_URL, inner, cwd=estate.root)
-    own = estate.commit(inner, "unpushed", {"i.txt": "i\n"})
-    proc = estate.sweep(LANE, "--include-scratch", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    items = items_of(proc.stdout, "scratch")
-    assert items[str(scratch)][0] == "keep", items
-    assert f"a repository lies under it ({inner})" in items[str(scratch)][3]
-    assert estate.git("rev-parse", "HEAD", cwd=inner) == own
-    assert (scratch / "notes.md").is_file()
-
-
-def test_a_live_path_that_names_no_tree_is_a_usage_error(estate):
-    """#170 B4: a misspelt `--live` path was accepted in silence, so the
-    writer it was meant to protect was not protected."""
-    tree = estate.worktree("w1", "feat/w1")
-    estate.git("push", "-q", "-u", "origin", "feat/w1", cwd=tree)
-    for live in ((str(estate.lane_root / "w1-typo"),), ("none", str(tree))):
-        args = []
-        for value in live:
-            args += ["--live", value]
-        proc = estate.sweep(LANE, "--yes", *args)
-        assert proc.returncode == 64, (live, proc.stdout, proc.stderr)
-        assert tree.is_dir()
-    assert estate.sweep(LANE, "--yes", "--live", str(tree)).returncode == 0
-    assert tree.is_dir(), "the tree --live names is a live writer's"
-
-
-def test_trees_this_session_recorded_want_the_writer_count(estate):
-    """#170 B5: a tree this session recorded skips the transcript check (it
-    is this session's), and --live was demanded only when the holder read
-    as this session - so with the holder read as none, --yes removed the
-    trees this session's own writers could be standing in."""
-    tree = estate.worktree("mine", "feat/mine", record=False)
-    estate.git("push", "-q", "-u", "origin", "feat/mine", cwd=tree)
-    estate.record(tree, writer=ME)
-    assert estate.holder == "none"
-    refused = estate.sweep(LANE, "--yes", "--porcelain")
-    assert refused.returncode == 2, refused.stdout + refused.stderr
-    assert "this session recorded 1 of lane" in refused.stdout
-    assert tree.is_dir()
-    assert estate.sweep(LANE, "--yes", "--live", "none").returncode == 0
-    assert not tree.exists()
-
-
-def test_the_first_register_line_refused_stops_the_sweep(estate):
-    """#170 B6: removals went on after a NOTED line failed, so acts piled
-    up that the register never recorded."""
-    first = estate.worktree("a-one", "feat/one")
-    estate.git("push", "-q", "-u", "origin", "feat/one", cwd=first)
-    second = estate.worktree("b-two", "feat/two")
-    estate.git("push", "-q", "-u", "origin", "feat/two", cwd=second)
-    estate.log_rc = 1
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 1, proc.stdout + proc.stderr
-    rows = rows_of(proc.stdout)
-    assert not first.exists() and second.is_dir()
-    assert "the register refused a line" in rows[str(second)][2]
-    assert len(estate.notes()) == 1
-
-
-def test_a_lane_owned_open_pr_branch_origin_lacks_is_still_counted(estate):
-    """#170 G2: every OPEN PR's branch was left out of the retire count, so
-    a lane-owned branch holding commits origin lacks let `--branches
-    --dry-run --porcelain` exit 0 and clear #163's gate. The delete
-    protection stays; the count does not hide it."""
-    estate.git("checkout", "-q", "-b", "feat/g2", "origin/main")
-    tip = estate.commit(estate.checkout, "unpushed", {"g2.txt": "g\n"})
-    estate.git("checkout", "-q", "main")
-    estate.pr(61, "feat/g2", "OPEN", tip)
-    proc = estate.sweep(LANE, "--branches", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    items = items_of(proc.stdout, "branch")
-    assert items["feat/g2"][:2] == ("keep", "retire"), items
-    yes = estate.sweep(LANE, "--branches", "--yes")
-    assert yes.returncode == 0, yes.stdout + yes.stderr
-    assert estate.git("rev-parse", "feat/g2") == tip, "an open PR's branch is never touched"
-
-
-def test_a_branch_published_under_its_own_name_is_not_unfinished(estate):
-    """#170 G7: a branch made from origin/main tracks main, so its upstream
-    read 'ahead' and `--branches` exited 3 although origin held every
-    commit under the branch's own name."""
-    estate.git("checkout", "-q", "-b", "feat/g7", "origin/main")
-    estate.commit(estate.checkout, "published", {"g7.txt": "g\n"})
-    estate.git("push", "-q", "origin", "feat/g7")
-    assert estate.git("rev-parse", "--abbrev-ref", "feat/g7@{u}") == "origin/main"
-    estate.git("checkout", "-q", "main")
-    proc = estate.sweep(LANE, "--branches", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "feat/g7" not in items_of(proc.stdout, "branch")
-
-
-def _age(path: Path, seconds: float) -> None:
-    when = time.time() - seconds
-    for p in sorted(path.rglob("*"), reverse=True) + [path]:
-        os.utime(p, (when, when), follow_symlinks=False)
-
-
-def test_a_tmp_dir_is_listed_and_never_removed_marked_or_old(estate):
-    """#170 item 1, option (b): an hour-old `tmp.*` with nobody in it was
-    removed with no proof a suite made it - a person's `mktemp -d` checkout
-    or saved scratch included. `mktemp -d` records no owner, so neither a
-    suite's mark in it nor aging_days (14) untouched is proof (#174 review
-    R2): every one is listed and left, with its mark where it has one."""
-    base = estate.sandboxes
-    unmarked, ancient, marked, layout = (base / n for n in (
-        "tmp.person01", "tmp.ancient02", "tmp.suite03", "tmp.layout04"))
-    for d in (unmarked, ancient, marked, layout):
-        d.mkdir()
-        (d / "f").write_text("x")
-    dead_pid = _dead_pid()
-    (marked / ".lock").write_text(f"{dead_pid}\n")
-    (layout / "basetemp").mkdir()
-    (layout / "tmp").mkdir()
-    for d in (unmarked, marked, layout):
-        _age(d, 7200)
-    _age(ancient, 20 * 86400)
-    proc = estate.sweep(LANE, "--include-sandboxes", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    rows = items_of(proc.stdout, "sandbox")
-    for d in (unmarked, ancient, marked, layout):
-        assert rows[str(d)][0] == "list" and (d / "f").is_file(), rows[str(d)]
-        assert "never removed" in rows[str(d)][3], rows[str(d)]
-    for d in (unmarked, ancient):
-        assert "no mark of a test suite" in rows[str(d)][3], rows[str(d)]
-    assert f"a pytest .lock (pid {dead_pid}, gone)" in rows[str(marked)][3]
-    assert "run-root layout" in rows[str(layout)][3]
-
-
-def _lane_worktrees_module():
-    """`lane-worktrees` as a module, its bytecode written nowhere."""
-    import importlib.util
-    from importlib.machinery import SourceFileLoader
-    loader = SourceFileLoader("lane_worktrees_module", str(LW))
-    spec = importlib.util.spec_from_loader("lane_worktrees_module", loader)
-    module = importlib.util.module_from_spec(spec)
-    was = sys.dont_write_bytecode
-    sys.dont_write_bytecode = True
-    try:
-        loader.exec_module(module)
-    finally:
-        sys.dont_write_bytecode = was
-    return module
-
-
-def test_a_tmp_dir_holding_a_bare_repository_or_notes_is_never_removed(estate):
-    """#174 review R2: with `--include-sandboxes --yes` an unmarked `tmp.*`
-    untouched for aging_days (14) was removed with no archive - one holding
-    a BARE repository with the only copy of a commit (`repository_within`
-    looked for a `.git` alone, which a bare repository has not), and one
-    holding notes.txt. Both are listed and left, and a bare repository is a
-    repository wherever it lies."""
-    vault = estate.sandboxes / "tmp.vault07"
-    notes = estate.sandboxes / "tmp.notes08"
-    work = estate.root / "work-gone"
-    estate.git("init", "-q", "-b", "main", work, cwd=estate.root)
-    own = estate.commit(work, "the only copy", {"w.txt": "PRECIOUS\n"})
-    estate.git("init", "-q", "--bare", vault / "vault.git", cwd=estate.root)
-    estate.git("push", "-q", vault / "vault.git", "main", cwd=work)
-    shutil.rmtree(work)
-    notes.mkdir()
-    (notes / "notes.txt").write_text("PRECIOUS notes\n")
-    for d in (vault, notes):
-        _age(d, 20 * 86400)
-    proc = estate.sweep(LANE, "--include-sandboxes", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    rows = items_of(proc.stdout, "sandbox")
-    for d in (vault, notes):
-        assert rows[str(d)][0] == "list" and "never removed" in rows[str(d)][3], rows[str(d)]
-    assert f"a repository lies inside it ({vault / 'vault.git'})" in rows[str(vault)][3]
-    assert (notes / "notes.txt").read_text() == "PRECIOUS notes\n"
-    assert estate.git("cat-file", "-t", own, cwd=vault / "vault.git") == "commit"
-    lw = _lane_worktrees_module()
-    assert lw.repository_within(str(vault)) == f"a repository lies inside it ({vault / 'vault.git'})"
-    assert lw.repository_within(str(vault / "vault.git")).startswith("it is a repository")
-    assert lw.repository_within(str(notes)) == ""
-
-
-def test_an_unreadable_process_of_this_account_keeps_the_tree_it_names(estate):
-    """#170 item 2 (the coordinator's default): a same-account process whose
-    `/proc` entries cannot be read (not dumpable) was read as absent, and
-    its tree was removed under it. It is placed by its command line and its
-    parent's directory; a tree it is placed in is kept."""
-    if not os.path.isdir("/proc/self/fd") or os.geteuid() == 0:
-        pytest.skip("needs /proc, and an account that cannot read a non-dumpable process")
-    tree = estate.worktree("held", "feat/held")
-    estate.git("push", "-q", "-u", "origin", "feat/held", cwd=tree)
-    ready = estate.root / "ready"
-    code = ("import ctypes, sys, time; ctypes.CDLL(None).prctl(4, 0, 0, 0, 0); "
-            "open(sys.argv[1], 'w').close(); time.sleep(300)")
-    child = subprocess.Popen([sys.executable, "-c", code, str(ready), str(tree)], cwd=str(tree))
-    try:
-        deadline = time.time() + 20
-        while not ready.exists() and time.time() < deadline:
-            time.sleep(0.05)
-        try:
-            os.readlink(f"/proc/{child.pid}/cwd")
-            pytest.skip("this kernel lets the owner read a non-dumpable process")
-        except PermissionError:
-            pass
-        proc = estate.sweep(LANE, "--yes", "--porcelain")
-    finally:
-        child.kill()
-        child.wait()
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert tree.is_dir(), "the tree an unreadable process stands in was removed"
-    row = rows_of(proc.stdout)[str(tree)]
-    assert row[0] == "keep" and f"process {child.pid}" in row[2] and "could not be read" in row[2]
-
-
-def test_an_inventory_row_with_no_id_refuses_the_dry_run(estate):
-    """#170 G9: a `lane-trees` row with no id was skipped in silence, so a
-    tree it named outside the scanned roots went unseen and the dry run
-    exited 0, clearing #163's gate."""
-    elsewhere = estate.root / "elsewhere" / "tree"
-    estate.inventory.append(US.join(["", str(elsewhere), "feat/x", "0" * 40, "none", "0", "0",
-                                     WRITER, "2026-10-05T00:00:00Z", str(estate.checkout),
-                                     "1", "op-1", "1"]))
-    proc = estate.sweep(LANE, "--dry-run", "--porcelain")
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert "inventory record ? is unreadable" in proc.stdout
-
-
-def test_a_dot_git_file_that_is_no_pointer_leaves_the_scan_whole(estate):
-    """uv keeps an EMPTY `.git` file in its cache to stop git looking upward.
-    It is no repository, and no reason to call the dependents scan partial
-    (measured on Eagle: two of them kept every clone and scratch)."""
-    marker = estate.projects / "tool-cache" / "uv" / "sdists-v9"
-    marker.mkdir(parents=True)
-    (marker / ".git").write_text("")
-    store = estate.lane_root / "store"
-    estate.git("clone", "-q", GH_URL, store, cwd=estate.root)
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env={"LANE_WORKTREES_CONF": str(conf)})
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not store.exists(), rows_of(proc.stdout)[str(store)]
-
-
-# ===================================================== #174, Copilot round 1
-
-def _foreign_clone(estate, name: str) -> tuple:
-    """A standalone clone under the lane's root, published, and the
-    environment that lets `--include-foreign --word go` act on it at once."""
-    clone = estate.lane_root / name
-    estate.lane_root.mkdir(parents=True, exist_ok=True)
-    estate.git("clone", "-q", GH_URL, clone, cwd=estate.root)
-    conf = estate.root / "sweep.conf"
-    conf.write_text("foreign_quiet_hours=0\n")
-    return clone, {"LANE_WORKTREES_CONF": str(conf)}
-
-
-def test_a_clones_reflogs_that_cannot_be_listed_remove_nothing(estate):
-    """#174 Copilot round 1: the clone's loss plan walked `.git/logs` with
-    `os.walk`, which passes over a directory it cannot list in silence - so
-    a commit only `logs/refs/heads/<b>` named was in no plan, no bundle took
-    it, the self-check asked the same blind question, and the clone was
-    deleted with it. A reflog directory that cannot be listed is unknown."""
-    if os.geteuid() == 0:
-        pytest.skip("root lists a mode-000 directory")
-    clone, env = _foreign_clone(estate, "blind")
-    main = estate.git("rev-parse", "HEAD", cwd=clone)
-    tree = estate.git("rev-parse", "HEAD^{tree}", cwd=clone)
-    own = estate.git("commit-tree", tree, "-p", main, "-m", "an experiment", cwd=clone)
-    estate.git("update-ref", "-m", "experiment", "refs/heads/exp", own, cwd=clone)
-    estate.git("update-ref", "-m", "back", "refs/heads/exp", main, cwd=clone)
-    assert own in estate.git("rev-list", "--reflog", cwd=clone).split()
-    sealed = clone / ".git" / "logs" / "refs" / "heads"
-    sealed.chmod(0)
-    try:
-        proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                            env=env)
-    finally:
-        sealed.chmod(0o755)
-    assert clone.is_dir(), "a clone whose reflogs could not be read was removed"
-    assert estate.git("cat-file", "-t", own, cwd=clone) == "commit"
-    row = rows_of(proc.stdout)[str(clone)]
-    assert "could not be listed" in row[2] and "left in place" in row[2], row
-    assert proc.returncode == 1, proc.stdout + proc.stderr
-
-
-def test_a_submodule_commit_only_its_reflog_names_keeps_the_tree(estate):
-    """#174 Copilot round 1: a submodule's experiment, made detached and
-    checked out away from, is in no branch, tag or stash of it - only its
-    reflog names it - so every guard passed, and the tree's removal took
-    the submodule's repository (under the tree's own git directory) and
-    the experiment with it."""
-    tree, sub = _with_submodule(estate, "subexp")
-    estate.git("checkout", "-q", "--detach", cwd=sub)
-    own = estate.commit(sub, "an experiment", {"exp.txt": "PRECIOUS\n"})
-    estate.git("checkout", "-q", "--detach", "origin/main", cwd=sub)
-    assert estate.git("status", "--porcelain", cwd=tree) == ""
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "submodule sub: its reflog names 1 commit(s)" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert tree.is_dir()
-    assert estate.git("cat-file", "-t", own, cwd=sub) == "commit"
-
-
-@pytest.mark.parametrize("ancestor", ["node_modules", ".venv"])
-def test_an_ignored_file_beneath_a_cache_or_venv_named_directory_is_archived(estate, ancestor):
-    """#174 Copilot round 1: #170 A6 selects an ignored entry by its own
-    name, so `docker/<ancestor>/prod.env` - an ignored file in a TRACKED
-    directory - was selected; but the archive's member filter dropped any
-    path with a cache- or venv-named part, `top.env` beside it kept the
-    archive non-empty, it verified, and the tree went without prod.env."""
-    tree = estate.worktree("deploy", "feat/deploy")
-    estate.commit(tree, "compose", {".gitignore": ".env\n*.env\n__pycache__/\n",
-                                    f"docker/{ancestor}/README": "vendored\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/deploy", cwd=tree)
-    (tree / "docker" / ancestor / "prod.env").write_text("DB_PASSWORD=PRECIOUS\n")
-    (tree / "top.env").write_text("TOKEN=kept\n")
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    (archive,) = estate.archives()
-    with tarfile.open(archive / "deploy-ignored.tar.gz") as tf:
-        names = tf.getnames()
-        prod = tf.extractfile(f"docker/{ancestor}/prod.env")
-        assert prod is not None and prod.read() == b"DB_PASSWORD=PRECIOUS\n"
-    assert "top.env" in names, names
-
-
-def test_an_old_unmarked_tmp_dir_holding_a_repository_is_listed_never_removed(estate):
-    """#174: an unmarked `tmp.*` untouched for aging_days was removed on
-    age alone - a person's `mktemp -d` checkout with an unpushed commit
-    included. No suite's mark says its repositories are fixtures, so one
-    holding a repository is listed and left."""
-    checkout = estate.sandboxes / "tmp.person05"
-    estate.git("init", "-q", "-b", "main", checkout / "work", cwd=estate.root)
-    own = estate.commit(checkout / "work", "unpushed work", {"w.txt": "PRECIOUS\n"})
-    _age(checkout, 20 * 86400)
-    proc = estate.sweep(LANE, "--include-sandboxes", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = items_of(proc.stdout, "sandbox")[str(checkout)]
-    assert row[0] == "list" and f"a repository lies inside it ({checkout / 'work'})" in row[3], row
-    assert estate.git("rev-parse", "HEAD", cwd=checkout / "work") == own
-
-
-def _merged_branch_with_an_experiment(estate) -> tuple:
-    """`feat/old`, merged by PR #61 and held by no worktree, whose reflog
-    alone names an experiment: committed, reset away from, and the worktree
-    it was made in removed (taking its HEAD reflog)."""
-    tree = estate.worktree("old", "feat/old", record=False)
-    own = estate.commit(tree, "an experiment", {"exp.txt": "PRECIOUS\n"})
-    estate.git("reset", "-q", "--hard", "HEAD~1", cwd=tree)
-    tip = estate.commit(tree, "the work", {"w.txt": "w\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/old", cwd=tree)
-    estate.git("worktree", "remove", tree)
-    estate.pr(61, "feat/old", "MERGED", tip)
-    assert own in estate.git("rev-list", "--reflog").split()
-    return own, tip
-
-
-def test_a_branch_deletes_reflog_only_commit_is_bundled_first(estate):
-    """#174 Copilot round 1: `--branches --yes` deleted a merged branch with
-    `update-ref -d`, which takes its reflog - the last pointer to an
-    experiment committed on it and reset away from - with no loss plan, no
-    bundle and no self-check. It is bundled first now, as a tree's is, and
-    the ledger records the bundle as the only copy."""
-    own, _tip = _merged_branch_with_an_experiment(estate)
-    proc = estate.sweep(LANE, "--branches", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    item = items_of(proc.stdout, "branch")["feat/old"]
-    assert "local branch deleted" in item[3] and "commits only its reflog named" in item[3], item
-    assert "feat/old" not in estate.git("branch", "--format=%(refname:short)").splitlines()
-    (archive,) = estate.archives()
-    bundles = sorted(archive.glob("branch-feat-old*.bundle"))
-    assert bundles and _bundle_holds(estate, bundles[0], own)
-    assert [r for r in _ledger(archive) if r[0] == "-" and r[2] == own], _ledger(archive)
-
-
-def test_the_self_check_refuses_a_branch_delete_that_would_lose_a_commit(estate):
-    """... and with that bundle switched off (the suite's seam), the
-    self-check is what stands between the delete and the experiment: it
-    refuses, exit 2, DISPOSITION.md says so, and the branch stays."""
-    own, tip = _merged_branch_with_an_experiment(estate)
-    proc = estate.sweep(LANE, "--branches", "--yes", "--porcelain",
-                        env={"LANE_WORKTREES_SEAM_NO_LOSS_BUNDLE": "1"})
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    item = items_of(proc.stdout, "branch")["feat/old"]
-    assert item[3].endswith(f"REFUSED by the self-check: 1 commit(s) its delete would take are "
-                            f"neither on origin nor in a bundle (e.g. {own[:12]})"), item
-    assert estate.git("rev-parse", "refs/heads/feat/old") == tip
-    assert "feat/old" in estate.remote_heads()
-    (archive,) = estate.archives()
-    assert "REFUSED by the self-check" in (archive / "DISPOSITION.md").read_text()
-
-
-def _arrival_shim(estate, target: Path, text: str) -> dict:
-    """A PATH whose `git` writes `target` the SECOND time the sweep asks
-    `ls-files -v` (the hidden-edit guard): once when the table is built,
-    once more at the act - so the file arrives after the table was read and
-    before the rescue is taken, which is the window a writer has."""
-    shim = estate.root / "arrival-shim"
-    shim.mkdir(exist_ok=True)
-    count = estate.root / "arrival-count"
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\n"
-        'case " $* " in\n'
-        '  *" ls-files -v -s -z "*)\n'
-        f"    n=$(cat '{count}' 2>/dev/null || echo 0); n=$((n + 1)); echo \"$n\" > '{count}'\n"
-        f"    if [ \"$n\" = 2 ]; then printf '%s\\n' '{text}' > '{target}'; fi ;;\n"
-        "esac\n"
-        f'exec "{real_git}" "$@"\n')
-    (shim / "git").chmod(0o755)
-    return {"PATH": f"{shim}{os.pathsep}{estate.env['PATH']}"}
-
-
-def test_an_untracked_file_that_arrives_after_the_table_is_never_pushed(estate):
-    """#174 Copilot round 1: whether untracked files were held back was read
-    from the table's status. A tree with only a tracked change when it was
-    read, and an untracked key file by the time of the rescue, had the full
-    snapshot - key included - pushed to origin. What is untracked is read
-    from the snapshots at the act now: the key goes to the bundle alone."""
-    tree = estate.worktree("late", "feat/late")
-    estate.commit(tree, "w", {"w.txt": "base\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/late", cwd=tree)
-    (tree / "w.txt").write_text("changed\n")
-    key = tree / "gcp-service-account.json"
-    env = _arrival_shim(estate, key, '{"private_key": "PRECIOUS"}')
-    proc = estate.sweep(LANE, "--yes", "--porcelain", env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    for branch, sha in estate.remote_heads().items():
-        files = estate.git("ls-tree", "-r", "--name-only", sha, cwd=estate.origin)
-        assert "gcp-service-account.json" not in files.split(), branch
-    (rescue,) = [b for b in estate.remote_heads() if b.startswith(f"rescue/{LANE}/late-")]
-    assert estate.git("show", f"{rescue}:w.txt", cwd=estate.origin) == "changed"
-    (archive,) = estate.archives()
-    held = [r for r in _ledger(archive) if r[0] == "-" and r[1].startswith("bundle:")]
-    assert len(held) == 1, _ledger(archive)
-    assert _bundle_holds(estate, archive / held[0][1][len("bundle:"):], held[0][2])
-    assert estate.git("show", f"{held[0][2]}:gcp-service-account.json") == \
-        '{"private_key": "PRECIOUS"}'
-
-
-@pytest.mark.parametrize("when", ["seen-by-the-table", "arrived-after-it"])
-def test_untracked_git_lfs_content_keeps_the_tree(estate, when):
-    """#174 Copilot round 1: an untracked file git-lfs filters was
-    snapshotted as a POINTER for the bundle-only commit (#170 A9); a bundle
-    carries no LFS payload, and the tree went with the only copy of the
-    bytes. Such a tree is kept - in the table, and again at the act, before
-    anything is pushed."""
-    tree = estate.worktree("models", "feat/models")
-    estate.commit(tree, "weights go through git-lfs",
-                  {".gitattributes": "*.bin filter=lfs diff=lfs merge=lfs -text\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/models", cwd=tree)
-    for k, v in (("filter.lfs.clean",
-                  "sh -c 'cat >/dev/null; echo version https://git-lfs.github.com/spec/v1'"),
-                 ("filter.lfs.smudge", "cat"), ("filter.lfs.required", "true")):
-        estate.git("config", k, v)
-    weights = tree / "weights.bin"
-    env = None
-    if when == "seen-by-the-table":
-        weights.write_text("PRECIOUS weights\n")
-        dry = rows_of(estate.sweep(LANE, "--porcelain").stdout)[str(tree)]
-        assert dry[0] == "keep" and "git-lfs content (e.g. weights.bin)" in dry[2], dry
-    else:
-        (tree / "notes.txt").write_text("tracked? no - but a tracked change is below\n")
-        estate.git("add", "notes.txt", cwd=tree)
-        estate.commit(tree, "notes")
-        estate.git("push", "-q", "origin", "feat/models", cwd=tree)
-        (tree / "notes.txt").write_text("changed\n")
-        env = _arrival_shim(estate, weights, "PRECIOUS weights")
-    before = estate.remote_heads()
-    proc = estate.sweep(LANE, "--yes", "--porcelain", env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert weights.read_text() == "PRECIOUS weights\n", "the only copy of the bytes went"
-    row = rows_of(proc.stdout)[str(tree)]
-    assert row[0] == "keep" and "git-lfs content" in row[2], row
-    assert estate.remote_heads() == before, "nothing is pushed for a tree that is kept"
-
-
-@pytest.mark.parametrize("where", ["only-in-the-clone", "on-origin-too"])
-def test_a_clones_annotated_tag_neither_halts_the_sweep_nor_is_lost(estate, where):
-    """#174 Copilot round 1: a clone's annotated tag reached the loss plan
-    as its TAG OBJECT, which was reported lost however it was kept - so the
-    self-check refused, and halted the sweep on, every clone with one. A tag
-    object origin holds as it is is kept; one only the clone holds goes to
-    the bundle, its message with it; either way the clone is removed."""
-    clone, env = _foreign_clone(estate, "released")
-    estate.git("tag", "-a", "-m", "release notes nobody else has", "v1.0", cwd=clone)
-    tag = estate.git("rev-parse", "refs/tags/v1.0", cwd=clone)
-    if where == "on-origin-too":
-        estate.git("push", "-q", "origin", "v1.0", cwd=clone)
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not clone.exists(), rows_of(proc.stdout)[str(clone)]
-    (archive,) = estate.archives()
-    only = [r for r in _ledger(archive) if r[0] == "-" and r[1].startswith("bundle:")]
-    if where == "on-origin-too":
-        assert only == [], "origin holds that very tag object: no bundle is its only copy"
-    else:
-        assert [r[2] for r in only] == [tag], _ledger(archive)
-        heads = estate.git("bundle", "list-heads", archive / only[0][1][len("bundle:"):])
-        assert tag in heads.split(), heads
-
-
-# ===================================================== #174, Copilot round 2
-
-def test_a_deinitialized_submodules_kept_repository_keeps_the_tree(estate):
-    """#174 Copilot round 2: `git submodule status` shows a deinitialized
-    submodule `-`, and the guards passed over it - while its repository,
-    with a branch no remote holds, stays under the tree's git directory and
-    went with the tree."""
-    tree, sub = _with_submodule(estate, "deinit")
-    estate.git("checkout", "-q", "-b", "local", cwd=sub)
-    own = estate.commit(sub, "local only", {"l.txt": "PRECIOUS\n"})
-    estate.git("checkout", "-q", "--detach", "origin/main", cwd=sub)
-    estate.git("submodule", "deinit", "-q", "-f", "sub", cwd=tree)
-    assert estate.git("submodule", "status", cwd=tree).startswith("-")
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "its branch local holds commits every remote of it lacks" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    module = Path(estate.git("rev-parse", "--absolute-git-dir", cwd=tree)) / "modules" / "sub"
-    assert estate.git("cat-file", "-t", own, cwd=module) == "commit"
-
-
-def test_a_submodules_hidden_edit_keeps_the_tree(estate):
-    """#174 Copilot round 2: #170 A2's hidden-edit guard read the
-    superproject only, so a file flagged skip-worktree in a submodule and
-    edited there read as clean and went with the tree."""
-    tree, sub = _with_submodule(estate, "subhidden")
-    estate.git("update-index", "--skip-worktree", "s.txt", cwd=sub)
-    (sub / "s.txt").write_text("PRECIOUS local edit\n")
-    assert estate.git("status", "--porcelain", cwd=sub) == ""
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "submodule sub: 1 file(s) flagged skip-worktree" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert (sub / "s.txt").read_text() == "PRECIOUS local edit\n"
-
-
-def test_a_repository_under_a_cache_named_directory_keeps_the_scratch(estate):
-    """#174 Copilot round 2: the nested-repository walk - the proof that a
-    removal takes no repository - passed over directories named like
-    caches, so a checkout under `__pycache__` was archived without its git
-    history (the archive leaves caches out) and removed."""
-    scratch = estate.lane_root / "y-scratch"
-    work = scratch / "__pycache__" / "work"
-    estate.git("init", "-q", "-b", "main", work, cwd=estate.root)
-    own = estate.commit(work, "unpushed", {"w.txt": "PRECIOUS\n"})
-    proc = estate.sweep(LANE, "--include-scratch", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = items_of(proc.stdout, "scratch")[str(scratch)]
-    assert row[0] == "keep" and f"a repository lies under it ({work})" in row[3], row
-    assert estate.git("rev-parse", "HEAD", cwd=work) == own
-
-
-def test_another_lanes_claim_inside_a_repository_is_read_before_a_clone_goes(estate):
-    """#174 Copilot round 2: the whole-estate walk found `.lane-state` under a
-    plain directory inside a repository - `host/vendor/.lane-state` - and the
-    sweep threw it away; with no log naming that place, another lane's claim
-    on a clone was missed and the clone removed."""
-    clone, env = _foreign_clone(estate, "theirs")
-    host = estate.projects / "host"
-    estate.git("init", "-q", "-b", "main", host, cwd=estate.root)
-    claims = host / "vendor" / ".lane-state" / "repoD-5" / "trees"
-    claims.mkdir(parents=True)
-    (claims / "c1.yaml").write_text(f"schema: 1\npath: {clone}\n")
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = rows_of(proc.stdout)[str(clone)]
-    assert row[0] == "foreign" and "lane repoD-5's inventory names it" in row[2], row
-    assert clone.is_dir()
-
-
-def test_a_landed_line_never_lets_commits_onto_a_branch_gh_answers_open(estate, tmp_path):
-    """#174 Copilot round 2: the register says #21 LANDED while gh still
-    answers #21 OPEN, and the local tip is AHEAD of the PR head - the
-    verdict was "moved", which dropped gh's OPEN, and push+remove put the
-    lane's unreviewed commit onto the open pull request's branch. It goes to
-    a rescue branch, and origin's branch is left as it is."""
-    tree = estate.worktree("reg", "feat/reg")
-    head = estate.commit(tree, "r", {"r.txt": "r\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/reg", cwd=tree)
-    estate.pr(21, "feat/reg", "OPEN", head)
-    estate.register_line(LANE, f"LANDED — lane {LANE}, session {ME}@Eagle, "
-                               f"2026-10-05T00:00:00Z, {SLUG}#21 → main abc1234")
-    ahead = estate.commit(tree, "unreviewed", {"u.txt": "u\n"})
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "rescue+remove", rows[str(tree)]
-    assert "gh still answers PR #21 OPEN" in rows[str(tree)][2]
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    heads = estate.remote_heads()
-    assert heads["feat/reg"] == head, "the open pull request's branch was pushed onto"
-    assert [b for b, s in heads.items() if b.startswith(f"rescue/{LANE}/reg-") and s == ahead]
-
-
-def test_a_gone_worktrees_kept_submodule_repository_is_never_pruned(estate):
-    """#174 Copilot round 2: a registration whose directory is gone keeps
-    its submodules' repositories under `<admin>/modules/`, and the prune -
-    which reads only the superproject's HEAD and reflog - took them, a
-    branch no remote holds with them."""
-    tree, sub = _with_submodule(estate, "gonesub")
-    estate.git("checkout", "-q", "-b", "local", cwd=sub)
-    own = estate.commit(sub, "local only", {"l.txt": "PRECIOUS\n"})
-    estate.git("checkout", "-q", "--detach", "origin/main", cwd=sub)
-    module = Path(estate.git("rev-parse", "--absolute-git-dir", cwd=tree)) / "modules" / "sub"
-    shutil.rmtree(tree)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "keep", rows[str(tree)]
-    assert "its branch local holds commits every remote of it lacks" in rows[str(tree)][2]
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    assert str(tree) in estate.git("worktree", "list", "--porcelain")
-    # Its `core.worktree` is gone, so it is read as a git directory alone -
-    # with a working tree of its own `objects/`, as the sweep reads it.
-    assert estate.git("--work-tree", str(module / "objects"), "cat-file", "-t", own,
-                      cwd=module) == "commit"
-
-
-def test_a_clones_local_lfs_store_keeps_it_when_a_bundle_would_be_the_only_copy(estate):
-    """#174 Copilot round 2: a clean clone with an experiment only its
-    reflog names had that commit bundled - its LFS pointers with it - and was
-    removed with `.git/lfs/objects`, the only copy of the bytes behind them."""
-    clone, env = _foreign_clone(estate, "assets")
-    main = estate.git("rev-parse", "HEAD", cwd=clone)
-    own = estate.git("commit-tree", estate.git("rev-parse", "HEAD^{tree}", cwd=clone),
-                     "-p", main, "-m", "an experiment", cwd=clone)
-    estate.git("update-ref", "-m", "experiment", "refs/heads/exp", own, cwd=clone)
-    estate.git("update-ref", "-m", "back", "refs/heads/exp", main, cwd=clone)
-    oid = "ab" * 32
-    store = clone / ".git" / "lfs" / "objects" / oid[:2] / oid[2:4]
-    store.mkdir(parents=True)
-    (store / oid).write_bytes(b"PRECIOUS weights\n")
-    proc = estate.sweep(LANE, "--include-foreign", "--word", "go", "--yes", "--porcelain",
-                        env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = rows_of(proc.stdout)[str(clone)]
-    assert row[0] == "keep" and "local git-lfs store" in row[2], row
-    assert (store / oid).read_bytes() == b"PRECIOUS weights\n"
-
-
-@pytest.mark.parametrize("marker", [".lock", ".openrepotools-run"])
-def test_a_suite_mark_that_names_no_pid_is_no_proof(estate, marker):
-    """#174 Copilot round 2: an EMPTY `.lock` (or run.sh marker) counted as
-    a suite's mark though it names no pid, so a two-hour-old `tmp.*` with a
-    checkout in it was removed - past the 14-day rule and the repository
-    guard both."""
-    saved = estate.sandboxes / "tmp.saved06"
-    estate.git("init", "-q", "-b", "main", saved / "work", cwd=estate.root)
-    own = estate.commit(saved / "work", "unpushed", {"w.txt": "PRECIOUS\n"})
-    (saved / marker).write_text("")
-    _age(saved, 7200)
-    proc = estate.sweep(LANE, "--include-sandboxes", "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = items_of(proc.stdout, "sandbox")[str(saved)]
-    assert row[0] == "list" and "no mark of a test suite" in row[3], row
-    assert estate.git("rev-parse", "HEAD", cwd=saved / "work") == own
-
-
-@pytest.mark.parametrize("where", ["only-in-the-submodule", "on-its-remote-too"])
-def test_a_submodules_annotated_tag_object_is_never_lost_with_its_tree(estate, where):
-    """#174 Copilot round 2: a submodule's guards ask whether an annotated
-    tag's COMMIT is published, never its tag object, so a local tag on a
-    published commit passed every one - and its message, which nothing else
-    held, went with the tree. At the act each remote of that repository is
-    asked for that very tag object: absent, the tree is kept; present, it
-    goes. The dry run asks no remote, so it reads `remove` either way."""
-    tree, sub = _with_submodule(estate, "subtag")
-    estate.git("tag", "-a", "-m", "release notes nobody else has", "v9", cwd=sub)
-    tag = estate.git("rev-parse", "refs/tags/v9", cwd=sub)
-    if where == "on-its-remote-too":
-        estate.git("push", "-q", "origin", "v9", cwd=sub)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "remove", rows[str(tree)]
-    module = Path(estate.git("rev-parse", "--absolute-git-dir", cwd=sub))
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    row = rows_of(proc.stdout)[str(tree)]
-    if where == "on-its-remote-too":
-        assert not tree.exists(), row
-    else:
-        assert row[0] == "keep" and "its annotated tag v9 is a tag object no remote" in row[2], row
-        assert estate.git("cat-file", "-t", tag, cwd=module) == "tag"
-
-
-# ================================ #170: test honesty, portability and nits
-
-def test_a_failed_removal_never_chmods_what_a_symlink_points_at(estate):
-    """#170 E4: `rmtree`'s retry chmod-ed the entry that would not go, and
-    `os.chmod` follows a link - so a symlink inside scratch that could not be
-    unlinked had its TARGET, a directory elsewhere, made 0700."""
-    if os.geteuid() == 0:
-        pytest.skip("root unlinks inside a read-only directory")
-    elsewhere = estate.root / "elsewhere"
-    elsewhere.mkdir()
-    elsewhere.chmod(0o755)
-    scratch = estate.lane_root / "x-scratch"
-    ro = scratch / "ro"
-    ro.mkdir(parents=True)
-    (scratch / "notes.md").write_text("findings\n")
-    (ro / "link").symlink_to(elsewhere)
-    ro.chmod(0o555)
-    try:
-        proc = estate.sweep(LANE, "--include-scratch", "--yes", "--porcelain")
-    finally:
-        ro.chmod(0o755)
-    assert proc.returncode == 1, proc.stdout + proc.stderr
-    assert "FAILED" in items_of(proc.stdout, "scratch")[str(scratch)][3]
-    assert stat_mode(elsewhere) == 0o755, oct(stat_mode(elsewhere))
-
-
-def stat_mode(path: Path) -> int:
-    return os.stat(path).st_mode & 0o777
-
-
-def test_a_branchs_pull_request_is_found_however_many_the_repository_has(estate):
-    """#170 E5: one `gh pr list --limit 1000` of the whole repository missed
-    the PR of a branch older than the newest thousand, and a MERGED branch
-    read as having none. The PR is asked by its branch now."""
-    tree = estate.worktree("old", "feat/old")
-    tip = estate.commit(tree, "o", {"o.txt": "o\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/old", cwd=tree)
-    estate.pr(1, "feat/old", "MERGED", tip)
-    for n in range(2, 1003):
-        estate.pr(n, f"feat/other-{n}", "CLOSED", "0" * 40)
-    rows = rows_of(estate.sweep(LANE, "--porcelain").stdout)
-    assert rows[str(tree)][0] == "remove+delete-branch", rows[str(tree)]
-    assert "PR #1 is merged" in rows[str(tree)][2]
-
-
-def test_the_hand_written_register_line_is_quoted_for_the_shell(estate):
-    """#170 E6: the NOT WRITTEN fallback printed the line to paste with the
-    tree's path unescaped, so a path with a quote or a `$` in it broke the
-    command a person was told to run. #179 Copilot round 1: it also dropped
-    `LANES_SESSION`, which the line it stands for passes (#170 E7), so a
-    pasted line named whatever session the helper found on its own."""
-    tree = estate.worktree('say "hi" $HOME', "feat/quoted")
-    estate.git("push", "-q", "-u", "origin", "feat/quoted", cwd=tree)
-    estate.log_rc = 1
-    proc = estate.sweep(LANE, "--yes", "--porcelain")
-    assert proc.returncode == 1, proc.stdout + proc.stderr
-    line = [ln for ln in proc.stderr.splitlines() if "write it by hand: " in ln]
-    assert line, proc.stderr
-    words = shlex.split(line[0].split("write it by hand: ", 1)[1])
-    assert words[:6] == [f"LANES_LANE={LANE}", f"LANES_SESSION={ME}", "lanes-edit.sh", "log",
-                         "NOTED", f"lane:{LANE}"], words
-    assert len(words) == 7 and str(tree) in words[6], words
-
-
-def test_the_register_line_is_written_as_this_session(estate):
-    """#170 E7: `note_line` did not pass `LANES_SESSION`, so the NOTED line
-    named whatever session the helper found on its own."""
-    tree = estate.worktree("w", "feat/w")
-    estate.git("push", "-q", "-u", "origin", "feat/w", cwd=tree)
-    assert estate.sweep(LANE, "--yes").returncode == 0
-    notes = estate.notes()
-    assert notes and all(n["session"] == ME for n in notes), notes
-
-
-def test_the_rescue_is_on_origin_at_the_moment_of_removal(estate):
-    """#170 C4: rescue-before-removal was proved only NEGATIVELY (a refused
-    push leaves the tree). This proves the order itself: a `git` that, at
-    the `worktree remove` of the tree, asks origin what it holds - and the
-    rescue branch is there, with the tree still on disk."""
-    tree = estate.worktree("dirty", "feat/dirty")
-    estate.commit(tree, "base", {"w.txt": "base\n"})
-    estate.git("push", "-q", "-u", "origin", "feat/dirty", cwd=tree)
-    (tree / "w.txt").write_text("precious\n")
-    seen = estate.root / "at-removal"
-    shim = estate.root / "order-shim"
-    shim.mkdir()
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\n"
-        'case " $* " in *" worktree remove --force "*)\n'
-        f"  \"{real_git}\" ls-remote '{estate.origin}' 'refs/heads/rescue/*' > '{seen}'\n"
-        f"  [ -d '{tree}' ] && echo TREE-PRESENT >> '{seen}' ;;\n"
-        "esac\n"
-        f'exec "{real_git}" "$@"\n')
-    (shim / "git").chmod(0o755)
-    proc = estate.sweep(LANE, "--yes", "--porcelain",
-                        env={"PATH": f"{shim}{os.pathsep}{estate.env['PATH']}"})
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert not tree.exists()
-    at_removal = seen.read_text().splitlines()
-    rescue = [ln.split("\t") for ln in at_removal if "\trefs/heads/rescue/" in ln]
-    assert rescue and rescue[0][1].startswith(f"refs/heads/rescue/{LANE}/dirty-"), at_removal
-    assert estate.git("show", f"{rescue[0][0]}:w.txt", cwd=estate.origin) == "precious"
-    assert at_removal[-1] == "TREE-PRESENT", at_removal
-
-
-def test_a_process_scan_that_cannot_be_made_keeps_every_tree(estate):
-    """#170 C5: a host where no process scan can be made (no `/proc`, no
-    `lsof`) had no case. Liveness is then unknown, never "nobody is there":
-    the table keeps the tree, and `--yes` leaves it."""
-    tree = estate.worktree("w", "feat/w")
-    estate.git("push", "-q", "-u", "origin", "feat/w", cwd=tree)
-    env = {"LANE_WORKTREES_SEAM_NO_PROCSCAN": "1"}
-    row = rows_of(estate.sweep(LANE, "--porcelain", env=env).stdout)[str(tree)]
-    assert row[0] == "keep" and "liveness could not be read" in row[2], row
-    proc = estate.sweep(LANE, "--yes", "--porcelain", env=env)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert tree.is_dir()
diff --git a/tests/test_lane_worktrees_report.py b/tests/test_lane_worktrees_report.py
deleted file mode 100644
index 5e5ac19e..00000000
--- a/tests/test_lane_worktrees_report.py
+++ /dev/null
@@ -1,694 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-worktrees sweep --all --dry-run --report` and the start that runs it
-once a day (opensoft/openRepoTools#162, the "nightly report" fold).
-
-The report is the net under every actor that never runs `lane-end`. Held here:
-
-  * every section the issue names finds what it is for, in an estate built
-    under `tmp_path`: a FOREIGN clone (inside a worktree container, and a
-    second clone of one origin), an orphaned tree of an ENDED lane, unmerged
-    branches with a missing or diverged upstream, root-`main` divergence that
-    is handoff and register paths only, a rescue branch and a dirty inventory
-    tree past the aging threshold, caches and a killed suite's sandbox,
-    ignored directories over the threshold, evidence-shaped paths, archives
-    past retention, the workspace's `.gitignore` and its bytecode history,
-    and `status --all`'s findings;
-  * it changes nothing - the estate is snapshotted around it;
-  * `--post <file>` writes it, `--post owner/repo#n` comments it through `gh`;
-  * `lane-start` runs it detached, once a day per workstation, and a report
-    that is slow, failing or switched off neither delays nor fails a start.
-
-The `lane-start` cases reuse `tests/test_lane_start_claude_current.py`'s
-sandbox: a real `lane-start` against a register in `tmp_path`.
-"""
-
-from __future__ import annotations
-
-import datetime as _dt
-import os
-import re
-import shutil
-import subprocess
-import sys
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-import test_lane_worktrees as LW
-import test_lane_start_claude_current as LS
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("git") is None or shutil.which("bash") is None,
-    reason="the report reads git, and lane-start is bash")]
-
-FAKE_STATUS = """#!/bin/sh
-cat <<'OUT'
-status --all: reading every estate:
-
-=== status repoA ===
-  root   main   /x/repoA
-    - shape pin 71cf5de is 1 commit(s) behind opensoft/openRepoShape main
-OUT
-printf '    - estate read at %s\n' "${PROJECTS_DIR:-unset}"
-exit 1
-"""
-
-
-def _commit_files(e, cwd, message, when, files):
-    """A commit whose author and committer dates are `when`."""
-    for rel, text in files.items():
-        path = Path(cwd) / rel
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text)
-    e.git("add", "-A", cwd=cwd)
-    e.git("commit", "-q", "-m", message, cwd=cwd,
-          env={"GIT_COMMITTER_DATE": when, "GIT_AUTHOR_DATE": when})
-    return e.git("rev-parse", "HEAD", cwd=cwd)
-
-
-def build_estate(e) -> dict:
-    """An estate with one finding of every kind the report lists."""
-    f = {}
-    # FOREIGN: a clone inside the lane's worktree root, and a second clone of
-    # repoA's origin beside the repositories.
-    f["clone"] = e.lane_root / "cloned"
-    e.git("clone", "-q", LW.GH_URL, f["clone"], cwd=e.root)
-    f["dup"] = e.projects / "repoA-copy"
-    e.git("clone", "-q", LW.GH_URL, f["dup"], cwd=e.root)
-    # ... and two clones of one origin NEITHER of which is named for it: one
-    # is still the checkout, the other still a finding.
-    c_origin = e.root / "remotes" / "repoC.git"
-    e.git("init", "-q", "--bare", "-b", "main", c_origin, cwd=e.root)
-    for name in ("c-one", "c-two"):
-        e.git("clone", "-q", c_origin, e.projects / name, cwd=e.root)
-    f["c-two"] = e.projects / "c-two"
-    # ORPHANED: a tree in the inventory of a lane whose snapshot is CLOSED.
-    f["orphan"] = e.projects / ".lane-worktrees" / "repoA-9" / "left"
-    e.git("worktree", "add", "-q", "-b", "feat/left", f["orphan"], "origin/main")
-    closed = e.projects / ".lane-state" / "repoA-9"
-    (closed / "trees").mkdir(parents=True)
-    (closed / "lane-state.yaml").write_text("schema: 1\nstate: CLOSED\n")
-    (closed / "trees" / "c1.yaml").write_text(f"schema: 1\npath: {f['orphan']}\n")
-    # ... and one of a lane whose checkout is NESTED: #97 keeps its control
-    # root, and lane-start its worktree root, beside the checkout's own
-    # parent, never at the estate's top. THE SHAPE IS THE REAL ONE (#170 C2):
-    # the checkout sits in a PLAIN directory inside a REPOSITORY, as
-    # `xFactory/xFactories/<x>` does on Eagle - which the estate's shape walk
-    # never enters, so its `.lane-state` was never read (#170 B8).
-    e.git("init", "-q", "-b", "main", e.projects / "group", cwd=e.root)
-    nested_origin = e.root / "remotes" / "repoB.git"
-    e.git("init", "-q", "--bare", "-b", "main", nested_origin, cwd=e.root)
-    e.git("clone", "-q", nested_origin, e.projects / "group" / "plain" / "repoB", cwd=e.root)
-    group_closed = e.projects / "group" / "plain" / ".lane-state" / "repoB-2"
-    group_closed.mkdir(parents=True)
-    (group_closed / "lane-state.yaml").write_text("schema: 1\nstate: CLOSED\n")
-    f["nested-orphan"] = (e.projects / "group" / "plain" / ".lane-worktrees" / "repoB-2"
-                          / "leftover")
-    f["nested-orphan"].mkdir(parents=True)
-    # UNMERGED: no upstream at all, and an upstream that diverged.
-    e.git("branch", "--no-track", "feat/nowhere", "origin/main")
-    e.git("checkout", "-q", "-b", "feat/diverged", "origin/main")
-    e.commit(e.checkout, "d1", {"d.txt": "1\n"})
-    e.git("push", "-q", "-u", "origin", "feat/diverged")
-    e.git("reset", "-q", "--hard", "HEAD~1")
-    e.commit(e.checkout, "d2", {"d.txt": "2\n"})
-    e.git("checkout", "-q", "main")
-    # ROOT MAIN DIVERGENCE: local main ahead by a handoff only.
-    e.commit(e.checkout, "handoff(repoA-1@Eagle): x", {"handoffs/repoA/h.md": "h\n"})
-    # AGING: a rescue branch 30 days old, and a dirty inventory tree of a live
-    # lane whose git directory has been still for 30 days.
-    e.git("checkout", "-q", "-b", "rescue/repoA-1/old-20260101T000000Z", "origin/main")
-    _commit_files(e, e.checkout, "old rescue", (_dt.datetime.now(_dt.timezone.utc)
-                  - _dt.timedelta(days=30)).strftime("%Y-%m-%dT%H:%M:%SZ"), {"r.txt": "r\n"})
-    e.git("checkout", "-q", "main")
-    f["stale-dirty"] = e.lane_root / "stale"
-    e.git("worktree", "add", "-q", "-b", "feat/stale", f["stale-dirty"], "origin/main")
-    (f["stale-dirty"] / "wip.txt").write_text("unsaved\n")
-    live = e.projects / ".lane-state" / LW.LANE / "trees"
-    live.mkdir(parents=True)
-    (live / "s.yaml").write_text(f"schema: 1\npath: {f['stale-dirty']}\n")
-    old = time.time() - 30 * 86400
-    gitdir = Path(e.git("rev-parse", "--absolute-git-dir", cwd=f["stale-dirty"]))
-    for name in ("index", "HEAD", "logs/HEAD"):
-        if (gitdir / name).exists():
-            os.utime(gitdir / name, (old, old))
-    # CACHES and a killed suite's SANDBOX.
-    (e.lane_root / "x-scratch" / "__pycache__").mkdir(parents=True)
-    (e.lane_root / "x-scratch" / "__pycache__" / "a.pyc").write_bytes(b"\0" * 2048)
-    f["sandbox"] = e.sandboxes / "tmp.killedrun1"
-    f["sandbox"].mkdir()
-    (f["sandbox"] / "f").write_text("x")
-    os.utime(f["sandbox"] / "f", (old, old))
-    os.utime(f["sandbox"], (old, old))
-    # IGNORED over the threshold (0 MB in this estate's sweep.conf), and
-    # EVIDENCE: an untracked JUnit file, and a directory of reports.
-    (e.checkout / "build").mkdir()
-    (e.checkout / "build" / "out.bin").write_bytes(b"\0" * 4096)
-    (e.checkout / ".gitignore").write_text((e.checkout / ".gitignore").read_text() + "build/\n")
-    (e.checkout / "junit-results.xml").write_text("<testsuite/>\n")
-    f["reports"] = e.projects / "cleanup-20261005"
-    f["reports"].mkdir()
-    (f["reports"] / "FINAL-REPORT.md").write_text("# report\n")
-    # PAST RETENTION: an archive 120 days old that would expire, and one 150
-    # days old kept because the rescue branch it records left origin.
-    f["archive"] = LW._archive(e, 120, None)
-    f["kept"] = LW._archive(e, 150, "rescue/repoA-1/gone-1")
-    # THE WORKSPACE: a .gitignore without the bytecode lines, and a .pyc in
-    # its history.
-    wip_origin = e.root / "wip.git"
-    wip = e.projects / "wip"
-    e.git("init", "-q", "--bare", "-b", "main", wip_origin, cwd=e.root)
-    e.git("clone", "-q", wip_origin, wip, cwd=e.root)
-    (wip / "lanes" / "log").mkdir(parents=True)
-    (wip / "lanes" / "LANES.md").write_text("# register\n")
-    (wip / "lanes" / "log" / "repoA-9.md").write_text(
-        f"STARTED — lane repoA-9, session {LW.ME}@Eagle, 2026-09-01T00:00:00Z, lane:repoA-9\n"
-        f"ENDED — lane repoA-9, session {LW.ME}@Eagle, 2026-09-02T00:00:00Z, lane:repoA-9\n")
-    (wip / ".gitignore").write_text("*.swp\n")
-    (wip / "handoffs" / "a" / "__pycache__").mkdir(parents=True)
-    (wip / "handoffs" / "a" / "__pycache__" / "m.cpython-312.pyc").write_bytes(b"\0")
-    e.git("add", "-A", cwd=wip)
-    e.git("commit", "-q", "-m", "seed", cwd=wip)
-    e.git("push", "-q", "origin", "main", cwd=wip)
-    e.workspace = str(wip)
-    f["wip"] = wip
-    (e.fakebin / "status").write_text(FAKE_STATUS)
-    (e.fakebin / "status").chmod(0o755)
-    e.env["LANE_WORKTREES_STATUS"] = str(e.fakebin / "status")
-    conf = e.root / "sweep.conf"
-    conf.write_text("ignored_report_mb=0\n")
-    e.env["LANE_WORKTREES_CONF"] = str(conf)
-    return f
-
-
-def report(e, *args, env=None, estate=True):
-    e.write_spec()
-    child = dict(e.env)
-    child.update(env or {})
-    where = ["--estate", str(e.projects)] if estate else []
-    return subprocess.run([sys.executable, str(LW.LW), "sweep", "--all", "--dry-run", "--report",
-                           *where, *args],
-                          capture_output=True, text=True, env=child, timeout=300,
-                          cwd=str(e.root), stdin=subprocess.DEVNULL)
-
-
-def section(text: str, title: str) -> str:
-    start = text.index(f"## {title}")
-    end = text.find("\n## ", start + 3)
-    return text[start:end if end != -1 else len(text)]
-
-
-def test_the_report_finds_every_kind_of_leftover_and_changes_nothing(tmp_path):
-    e = LW.Estate(tmp_path)
-    f = build_estate(e)
-    before = LW.snapshot(e.root, skip=("helper.log", "helper-spec.json", "prs.json"))
-    proc = report(e)
-    after = LW.snapshot(e.root, skip=("helper.log", "helper-spec.json", "prs.json"))
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    out = proc.stdout
-    assert out.startswith("# Estate report")
-    foreign = section(out, "FOREIGN repositories")
-    assert str(f["clone"]) in foreign and "a CLONE inside" in foreign
-    assert str(f["dup"]) in foreign and "a second clone of" in foreign
-    assert f"{e.checkout} ·" not in foreign, "the estate's own checkout is not foreign"
-    assert f"{f['c-two']} · a second clone of {e.projects / 'c-one'}'s origin (no single" \
-        in foreign
-    assert f"{e.projects / 'c-one'} ·" not in foreign
-    orphans = section(out, "Orphaned worktrees of ENDED lanes")
-    assert str(f["orphan"]) in orphans and "repoA-9" in orphans
-    assert f"{f['nested-orphan']} \u00b7 repoB-2 \u00b7 its snapshot is CLOSED" in orphans
-    branches = section(out, "Unmerged branches")
-    assert "feat/nowhere" in branches and "no upstream" in branches
-    assert "feat/diverged" in branches and "diverged from origin/feat/diverged" in branches
-    assert "rescue/repoA-1/old" not in branches
-    root_main = section(out, "Root main divergence")
-    assert "ahead of origin by 1" in root_main and "only handoff/register paths" in root_main
-    aging = section(out, "Awaiting disposition")
-    assert "rescue/repoA-1/old-20260101T000000Z \u00b7 rescue branch, 30 d \u00b7 repoA-1" in aging
-    assert str(f["stale-dirty"]) in aging and "dirty inventory tree" in aging
-    caches = section(out, "Caches and sandboxes")
-    assert "x-scratch/__pycache__" in caches and str(f["sandbox"]) in caches
-    ignored = section(out, "Ignored directories over")
-    assert str(e.checkout / "build") in ignored
-    evidence = section(out, "Evidence-shaped paths")
-    assert "junit-results.xml" in evidence and str(f["reports"]) in evidence
-    archives = section(out, "Sweep archives past retention")
-    assert f"{f['archive']} \u00b7 120 d \u00b7 would expire" in archives
-    assert f"{f['kept']} \u00b7 150 d \u00b7 kept past retention" in archives
-    assert "gone from origin" in archives
-    hygiene = section(out, "Workspace repository hygiene")
-    assert "lacks __pycache__/" in hygiene and "bytecode path(s) in history" in hygiene
-    status = section(out, "`status --all` findings")
-    assert "shape pin 71cf5de is 1 commit(s) behind" in status
-    assert f"estate read at {e.projects}" in status
-    assert "| rescue branches (all ages) | 1 |" in out
-    assert before == after, sorted(set(before.items()) ^ set(after.items()))[:10]
-
-
-def _old_git(e) -> dict:
-    """A PATH whose `git` answers `--format=%cs` as git before 2.21 does:
-    with the placeholder itself, where the date belongs."""
-    shim = e.root / "oldgit"
-    shim.mkdir(exist_ok=True)
-    (shim / "git").write_text(
-        "#!/bin/sh\nfor a in \"$@\"; do\n  case \"$a\" in --format=%cs) echo '%cs'; exit 0 ;; "
-        f"esac\ndone\nexec \"{shutil.which('git')}\" \"$@\"\n")
-    (shim / "git").chmod(0o755)
-    return {"PATH": f"{shim}{os.pathsep}{e.env['PATH']}"}
-
-
-def test_a_foreign_clones_date_needs_no_git_2_21(tmp_path):
-    """#170 (d): the FOREIGN section dated a clone's last commit with
-    `--format=%cs`, which git learned in 2.21; an older git prints `%cs`."""
-    e = LW.Estate(tmp_path)
-    f = build_estate(e)
-    proc = report(e, env=_old_git(e))
-    assert proc.returncode == 0, proc.stderr
-    foreign = section(proc.stdout, "FOREIGN repositories")
-    row = [ln for ln in foreign.splitlines() if ln.startswith(f"- {f['clone']} ")]
-    assert row and re.search(r" \u00b7 \d{4}-\d\d-\d\d \u00b7 ", row[0]), row
-    assert "%cs" not in foreign
-
-
-def test_status_reads_the_estate_the_report_resolved(tmp_path):
-    """Copilot on #169: with no `--estate` - lane-start's daily run - the
-    report resolves `$PROJECTS_ROOT`, and `status --all` is pointed at that
-    same estate, never at its own default."""
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    proc = report(e, estate=False)
-    assert proc.returncode == 0, proc.stderr
-    assert f"over `{e.projects}`" in proc.stdout
-    assert f"estate read at {e.projects}" in section(proc.stdout, "`status --all` findings")
-
-
-def test_a_record_the_report_cannot_read_is_a_finding_never_absence(tmp_path):
-    """Copilot round 2 on #169: an inventory or snapshot the report could not
-    read would otherwise make it clean."""
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    trees = e.projects / ".lane-state" / "repoA-5" / "trees"
-    trees.mkdir(parents=True)
-    (trees / "c1.yaml").write_text("schema: 1\n")
-    locked = e.projects / ".lane-state" / "repoA-6"
-    locked.mkdir()
-    (locked / "lane-state.yaml").write_text("schema: 1\nstate: CLOSED\n")
-    (locked / "lane-state.yaml").chmod(0)
-    try:
-        proc = report(e)
-    finally:
-        (locked / "lane-state.yaml").chmod(0o644)
-    assert proc.returncode == 0, proc.stderr
-    found = section(proc.stdout, "Records the report could not read")
-    assert f"{trees / 'c1.yaml'} \u00b7 an inventory record that names no path" in found
-    if os.geteuid() != 0:
-        assert f"{locked / 'lane-state.yaml'} \u00b7 could not be read" in found
-    assert "| Records the report could not read | " in proc.stdout
-
-
-def test_an_empty_section_says_what_could_not_be_read_never_none(tmp_path):
-    """#170 B8: the orphan and aging sections are read from the lanes'
-    records, and where the estate walk could not list a directory a lane's
-    records may be in it - so an empty section says so, never "none"."""
-    if os.geteuid() == 0:
-        pytest.skip("root lists a mode-000 directory")
-    e = LW.Estate(tmp_path)
-    (e.fakebin / "status").write_text(FAKE_STATUS)
-    (e.fakebin / "status").chmod(0o755)
-    e.env["LANE_WORKTREES_STATUS"] = str(e.fakebin / "status")
-    sealed = e.projects / "sealed"
-    (sealed / ".lane-state" / "repoZ-1").mkdir(parents=True)
-    sealed.chmod(0)
-    try:
-        proc = report(e)
-    finally:
-        sealed.chmod(0o755)
-    assert proc.returncode == 0, proc.stderr
-    unread = section(proc.stdout, "Records the report could not read")
-    assert f"{sealed} (" in unread and "a lane's records under it are not read" in unread
-    for title in ("Orphaned worktrees of ENDED lanes", "Awaiting disposition"):
-        found = section(proc.stdout, title)
-        assert "_none found in what could be read;" in found and "_none_" not in found, found
-
-
-def test_a_register_grep_that_failed_is_a_finding_never_no_events(tmp_path):
-    """#170 G3: the ENDED/RETIRED lines are read with one `git grep` of the
-    register, and a grep that FAILED (exit 128: the branch is not there)
-    read as "no events" - every log-only ENDED lane dropped out and the
-    orphan section read clean."""
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    proc = report(e, env={"LANES_BRANCH": "no-such-branch"})
-    assert proc.returncode == 0, proc.stderr
-    unread = section(proc.stdout, "Records the report could not read")
-    assert "the register's ENDED and RETIRED lines (origin/no-such-branch) \u00b7 git grep " \
-        "exited 128" in unread, unread
-
-
-def _latin1_clone(e) -> Path:
-    """A FOREIGN clone at a path that is not UTF-8 (`caf\\xe9`), so a report
-    row holds a surrogate-escaped path."""
-    clone = e.lane_root / os.fsdecode(b"caf\xe9")
-    # A FILESYSTEM THAT REFUSES THE NAME HAS NO SUCH CLONE TO REPORT (#177).
-    # APFS, the macOS runner's, answers a non-UTF-8 name with EILSEQ ("Illegal
-    # byte sequence"). The directory is made first so the refusal is the
-    # filesystem's and not a fixture traceback; where it is made, the case
-    # stays live, and git clones into an existing empty directory.
-    e.lane_root.mkdir(parents=True, exist_ok=True)
-    try:
-        os.mkdir(clone)
-    except OSError as exc:
-        pytest.skip(f"filesystem refuses non-UTF-8 names: {exc}")
-    e.git("clone", "-q", LW.GH_URL, clone, cwd=e.root)
-    return clone
-
-
-def test_bytes_that_are_not_utf8_never_abort_the_report(tmp_path):
-    """#170 G10, G11, G12: the workspace `.gitignore` was read, and the
-    report written to `--post <file>` and to `--post owner/repo#n`'s body
-    file, as STRICT UTF-8 - one Latin-1 byte, in the `.gitignore` or in a
-    row's path, aborted the daily report with an internal error."""
-    e = LW.Estate(tmp_path)
-    f = build_estate(e)
-    (f["wip"] / ".gitignore").write_bytes(b"*.swp\n# caf\xe9\n")
-    clone = _latin1_clone(e)
-    target = e.state / "openRepoTools" / "reports" / "latin1.md"
-    proc = report(e, "--post", str(target))
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    body = target.read_bytes()
-    assert os.fsencode(str(clone)) in body and b"lacks __pycache__/" in body
-    log = e.root / "gh.log"
-    (e.fakebin / "gh").write_text(
-        "#!/bin/sh\n[ \"$1 $2\" = 'issue comment' ] && { cat \"$7\" >> \"$FAKE_GH_LOG\"; "
-        "echo https://github.com/opensoft/repoA/issues/9#c1; exit 0; }\nexit 1\n")
-    proc = report(e, "--post", "opensoft/repoA#9", env={"FAKE_GH_LOG": str(log)})
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert os.fsencode(str(clone)) in log.read_bytes()
-
-
-def test_an_estate_root_that_cannot_be_listed_is_a_finding(tmp_path):
-    """#170 E10: the evidence scan listed the estate root with a bare
-    `os.listdir`, so a root that could not be listed aborted the report."""
-    if os.geteuid() == 0:
-        pytest.skip("root lists a mode-000 directory")
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    e.projects.chmod(0o300)
-    try:
-        proc = report(e)
-    finally:
-        e.projects.chmod(0o755)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"{e.projects} \u00b7 could not be listed" in section(
-        proc.stdout, "Records the report could not read")
-
-
-def test_an_ignored_evidence_file_is_found(tmp_path):
-    """#170 item 9: the evidence match read only ignored DIRECTORIES (the
-    list `du` sizes), so an ignored `junit-ci.xml` was never considered."""
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    (e.checkout / ".gitignore").write_text((e.checkout / ".gitignore").read_text()
-                                           + "junit-ci.xml\n")
-    (e.checkout / "junit-ci.xml").write_text("<testsuite/>\n")
-    proc = report(e)
-    assert proc.returncode == 0, proc.stderr
-    assert str(e.checkout / "junit-ci.xml") in section(proc.stdout, "Evidence-shaped paths")
-
-
-def test_the_gitignore_repair_command_survives_a_space_in_the_path(tmp_path):
-    """#170 item 10: the hygiene row offers a command to paste, and the
-    workspace path in its redirect was unquoted - one space split it."""
-    e = LW.Estate(tmp_path)
-    f = build_estate(e)
-    spaced = e.projects / "my wip"
-    shutil.move(str(f["wip"]), str(spaced))
-    e.workspace = str(spaced)
-    proc = report(e)
-    assert proc.returncode == 0, proc.stderr
-    row = [ln for ln in section(proc.stdout, "Workspace repository hygiene").splitlines()
-           if "lacks __pycache__/" in ln]
-    assert row, proc.stdout
-    command = row[0].split(" \u00b7 ")[-1]
-    ran = subprocess.run(["bash", "-c", command], cwd=str(e.root), capture_output=True,
-                         text=True)
-    assert ran.returncode == 0, (command, ran.stderr)
-    assert "__pycache__/" in (spaced / ".gitignore").read_text().splitlines(), command
-
-
-def test_post_writes_a_file_or_comments_on_an_issue(tmp_path):
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    target = e.state / "openRepoTools" / "reports" / "today.md"
-    proc = report(e, "--post", str(target))
-    assert proc.returncode == 0, proc.stderr
-    assert target.read_text().startswith("# Estate report")
-    log = e.root / "gh.log"
-    (e.fakebin / "gh").write_text(
-        "#!/bin/sh\nprintf '%s\\n' \"$*\" >> \"$FAKE_GH_LOG\"\n"
-        "[ \"$1 $2\" = 'issue comment' ] && { cat \"$7\" >> \"$FAKE_GH_LOG\"; "
-        "echo https://github.com/opensoft/repoA/issues/9#c1; exit 0; }\nexit 1\n")
-    proc = report(e, "--post", "opensoft/repoA#9", env={"FAKE_GH_LOG": str(log)})
-    assert proc.returncode == 0, proc.stderr
-    text = log.read_text()
-    assert "issue comment 9 --repo opensoft/repoA --body-file" in text
-    assert "# Estate report" in text
-
-
-def test_the_report_is_only_a_report(tmp_path):
-    e = LW.Estate(tmp_path)
-    for argv in (["--all", "--report", "--yes"], ["--all"], ["--report"],
-                 [LW.LANE, "--all", "--report"]):
-        e.write_spec()
-        proc = subprocess.run([sys.executable, str(LW.LW), "sweep", *argv], capture_output=True,
-                              text=True, env=e.env, timeout=60)
-        assert proc.returncode == 64, (argv, proc.stdout, proc.stderr)
-
-
-# ================================================== lane-start runs it daily
-
-FAKE_REPORTER = """#!/bin/sh
-printf '%s\\n' "$*" >> "$FAKE_REPORT_LOG"
-# What it was started under (#170 item 11, E8): its umask, and whether the
-# hangup a killed pane sends would reach it.
-umask > "$FAKE_REPORT_LOG.umask"
-"${FAKE_REPORT_PY:-python3}" -c 'import signal; print("ignored" if signal.getsignal(signal.SIGHUP) == signal.SIG_IGN else "default")' > "$FAKE_REPORT_LOG.hup"
-if [ -n "${FAKE_REPORT_SLEEP:-}" ]; then
-  sleep "$FAKE_REPORT_SLEEP" &
-  echo "$!" > "$FAKE_REPORT_LOG.sleeper"
-  wait
-  echo finished >> "$FAKE_REPORT_LOG"
-fi
-exit "${FAKE_REPORT_RC:-0}"
-"""
-
-
-def _reporter(box, state: Path) -> Path:
-    log = box.root / "report.log"
-    LS._write(box.bin / "lane-worktrees", FAKE_REPORTER)
-    box.env.update(LANE_WORKTREES_REPORT="on", XDG_STATE_HOME=str(state),
-                   FAKE_REPORT_LOG=str(log), FAKE_REPORT_PY=sys.executable)
-    return log
-
-
-def _no_report_state(state: Path) -> bool:
-    """No stamp and no reports directory: the report's own state only - the
-    start writes other state of its own there (#164's index nudge)."""
-    base = state / "openRepoTools"
-    return not list(base.glob("report-*.stamp")) and not (base / "reports").exists()
-
-
-def _wait_for(path: Path, timeout: float = 15) -> str:
-    deadline = time.time() + timeout
-    while time.time() < deadline:
-        if path.exists() and path.read_text():
-            return path.read_text()
-        time.sleep(0.1)
-    return ""
-
-
-def test_lane_start_runs_the_report_detached_once_a_day(tmp_path):
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    try:
-        result = box.start("--no-launch", FAKE_REPORT_SLEEP="90")
-        assert result.returncode == 0, result.stderr
-        calls = _wait_for(log)
-        # The report sleeps 90 s and then writes `finished`: a start that
-        # waited on it would have returned after that line.
-        assert "finished" not in calls, "the start waited on the report"
-    finally:
-        sleeper = Path(str(log) + ".sleeper")
-        if _wait_for(sleeper, 5).strip().isdigit():
-            try:
-                os.kill(int(sleeper.read_text()), 15)
-            except OSError:
-                pass
-    assert calls.startswith("sweep --all --dry-run --report --post "), calls
-    assert f"{state}/openRepoTools/reports/" in calls
-    assert calls.rstrip().endswith(f"--estate {box.home / 'projects'}"), calls
-    day = _dt.datetime.now(_dt.timezone.utc).strftime("%Y%m%d")
-    assert (state / "openRepoTools" / f"report-{day}.stamp").exists()
-    assert "the estate's daily report is running, detached" in result.stderr
-
-
-def test_a_stamp_from_today_runs_no_second_report_and_yesterdays_is_replaced(tmp_path):
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    day = _dt.datetime.now(_dt.timezone.utc).strftime("%Y%m%d")
-    (state / "openRepoTools").mkdir(parents=True)
-    (state / "openRepoTools" / f"report-{day}.stamp").write_text("")
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    # A POSITIVE SIGNAL, NOT A SLEEP (#170 C3): the start went past its report
-    # step - it printed its last line - and said nothing of starting one.
-    assert "--no-launch: the command above was printed" in result.stderr, result.stderr
-    assert "the estate's daily report is running" not in result.stderr, "a second report ran today"
-    assert not log.exists() or log.read_text() == "", "a second report ran today"
-    (state / "openRepoTools" / f"report-{day}.stamp").unlink()
-    (state / "openRepoTools" / "report-20200101.stamp").write_text("")
-    box2 = LS.Sandbox(tmp_path / "second")
-    log2 = _reporter(box2, state)
-    assert box2.start("--no-launch").returncode == 0
-    assert _wait_for(log2)
-    assert not (state / "openRepoTools" / "report-20200101.stamp").exists()
-
-
-def test_a_failing_or_switched_off_report_never_fails_a_start(tmp_path):
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    result = box.start("--no-launch", FAKE_REPORT_RC="1")
-    assert result.returncode == 0, result.stderr
-    assert _wait_for(log), "the failing reporter was never run"
-    off = LS.Sandbox(tmp_path / "off")
-    off_log = _reporter(off, tmp_path / "off-state")
-    result = off.start("--no-launch", LANE_WORKTREES_REPORT="off")
-    assert result.returncode == 0, result.stderr
-    assert "--no-launch: the command above was printed" in result.stderr, result.stderr
-    assert "the estate's daily report is running" not in result.stderr
-    assert not off_log.exists()
-    assert _no_report_state(tmp_path / "off-state")
-
-
-def test_a_dry_run_start_runs_no_report(tmp_path):
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    result = box.start("--dry-run")
-    assert result.returncode == 0, result.stderr
-    assert "--dry-run: nothing was renamed, written or launched" in result.stderr, result.stderr
-    assert "the estate's daily report is running" not in result.stderr
-    assert not log.exists()
-    assert _no_report_state(state)
-
-
-def test_the_daily_report_is_private_and_survives_its_panes_hangup(tmp_path):
-    """#170 item 11: the report names every path, branch and lane of the
-    estate, and its directory inherited the start's umask - readable by every
-    local account. #170 E8: it was not detached from the pane's hangup, so a
-    pane killed after the stamp was taken killed the report, and today's
-    stamp named a report that never finished."""
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    old = os.umask(0o022)
-    try:
-        result = box.start("--no-launch")
-    finally:
-        os.umask(old)
-    assert result.returncode == 0, result.stderr
-    umask = _wait_for(Path(str(log) + ".umask")).strip()
-    hup = _wait_for(Path(str(log) + ".hup")).strip()
-    assert umask in ("0077", "077"), umask
-    assert hup == "ignored", hup
-    for d in (state / "openRepoTools", state / "openRepoTools" / "reports"):
-        assert d.stat().st_mode & 0o777 == 0o700, (d, oct(d.stat().st_mode))
-
-
-# ===================================================== #179, Copilot round 1
-
-def test_a_failure_that_is_no_record_leaves_an_empty_section_none(tmp_path):
-    """#179 Copilot round 1: the orphan and aging sections said "none found in
-    what could be read; N record(s) could not be read" whenever ANYTHING
-    could not be read - an ignored-file listing that failed included, which
-    bears on no lane's records - so an honest "none" read as unknown. Such a
-    failure is still a row of "Records the report could not read"."""
-    e = LW.Estate(tmp_path)
-    (e.fakebin / "status").write_text(FAKE_STATUS)
-    (e.fakebin / "status").chmod(0o755)
-    e.env["LANE_WORKTREES_STATUS"] = str(e.fakebin / "status")
-    shim = tmp_path / "ignored-shim"
-    shim.mkdir()
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\n"
-        'case " $* " in *" ls-files --others --ignored "*)\n'
-        "  echo 'fatal: the shim refuses' >&2; exit 128 ;;\n"
-        "esac\n"
-        f'exec "{real_git}" "$@"\n')
-    (shim / "git").chmod(0o755)
-    proc = report(e, env={"PATH": f"{shim}{os.pathsep}{e.env['PATH']}"})
-    assert proc.returncode == 0, proc.stderr
-    unread = section(proc.stdout, "Records the report could not read")
-    assert "its ignored files could not be listed" in unread, unread
-    for title in ("Orphaned worktrees of ENDED lanes", "Awaiting disposition"):
-        found = section(proc.stdout, title)
-        assert "_none_" in found and "none found in what could be read" not in found, found
-
-
-def test_a_report_directory_that_cannot_be_made_private_runs_no_report(tmp_path):
-    """#179 Copilot round 1: the 0700 `chmod` of the report's directories
-    was allowed to fail - a state directory that already existed 0755 kept
-    that mode - and the report still started, written where every local
-    account could read it. It is not started, and no stamp is taken, so
-    tomorrow's start tries again."""
-    box = LS.Sandbox(tmp_path)
-    state = tmp_path / "state"
-    log = _reporter(box, state)
-    (state / "openRepoTools" / "reports").mkdir(parents=True)
-    for d in (state / "openRepoTools", state / "openRepoTools" / "reports"):
-        d.chmod(0o755)
-    real_chmod = shutil.which("chmod")
-    LS._write(box.fakebin / "chmod",
-              "#!/bin/sh\n"
-              '[ "$1" = 700 ] && { echo "chmod: refused" >&2; exit 1; }\n'
-              f'exec "{real_chmod}" "$@"\n')
-    result = box.start("--no-launch")
-    assert result.returncode == 0, result.stderr
-    # A POSITIVE SIGNAL (#170 C3): the start went past its report step.
-    assert "--no-launch: the command above was printed" in result.stderr, result.stderr
-    assert "the estate's daily report is running" not in result.stderr, result.stderr
-    assert not list((state / "openRepoTools").glob("report-*.stamp"))
-    assert not log.exists() or log.read_text() == ""
-
-
-# ===================================================== #179, Copilot round 2
-
-def test_an_untracked_listing_that_failed_is_a_finding_never_evidence(tmp_path):
-    """#179 Copilot round 2: the evidence scan's untracked listing was taken
-    whatever its exit, so a `git ls-files` that failed silently dropped the
-    untracked evidence - or offered its partial output as the repository's
-    files - while the ignored listing beside it recorded its failure."""
-    e = LW.Estate(tmp_path)
-    build_estate(e)
-    shim = tmp_path / "untracked-shim"
-    shim.mkdir()
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\n"
-        'case " $* " in *" ls-files --others --exclude-standard "*)\n'
-        "  printf 'junit-partial.xml\\0'; echo 'fatal: the shim refuses' >&2; exit 128 ;;\n"
-        "esac\n"
-        f'exec "{real_git}" "$@"\n')
-    (shim / "git").chmod(0o755)
-    proc = report(e, env={"PATH": f"{shim}{os.pathsep}{e.env['PATH']}"})
-    assert proc.returncode == 0, proc.stderr
-    unread = section(proc.stdout, "Records the report could not read")
-    assert "its untracked files could not be listed" in unread, unread
-    assert "junit-partial.xml" not in section(proc.stdout, "Evidence-shaped paths")
-
diff --git a/tests/test_lanes_index.py b/tests/test_lanes_index.py
deleted file mode 100644
index ee373bd1..00000000
--- a/tests/test_lanes_index.py
+++ /dev/null
@@ -1,3049 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""lane-collision-protocol Amendment 14 — THE DERIVED INDEX, and the eight tests
-its adoption act 2 names (opensoft/openRepoTools#160).
-
-The register's truth stays where it is: `lanes/LANES.md`, `lanes/log/*.md`,
-`lanes/aliases.tsv` and `lanes/archive/` in the workspace repository, written
-only by `lanes-edit.sh`. `lanes-index` keeps a DERIVED copy, written behind the
-sources by itself alone, read only by tooling that decides nothing, and never a
-gate. What these tests hold it to:
-
-  * OFFLINE NO-READ — every act's answer is byte-identical with the index
-    configured at a store nobody can reach;
-  * POISONED INDEX — an index with WRONG rows changes no act's answer, which is
-    the proof that acts do not read it (unreachability alone cannot give it);
-  * WIPED-INDEX RECONCILE — the rebuild equals a synced index, row for row;
-  * REPLAY — a second sync changes nothing;
-  * MONOTONIC PROVENANCE — a sync from a commit that does not descend from the
-    indexed one writes nothing;
-  * A HUNG INDEXER delays no writer beyond the fork;
-  * THE MANAGED SEAM — valid, malformed and plain rows index as `managed
-    <owner>`, `unknown` and `legacy`, every one of them through #97's own
-    `managed-projection`;
-  * FALLBACK — each way the index can fail to answer says `read: sources` and
-    returns the source read's own answer.
-
-NO REAL DATABASE AND NO NETWORK. Every store is a SQLite file under `tmp_path`;
-the Postgres path is a fake `psql` that records what it was asked; every remote
-is a bare repository in a temporary directory and every `$HOME` is temporary.
-The real `~/.local/bin` is taken OFF `PATH` wherever it carries a `lanes-index`,
-so an installed indexer is never what a case runs.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import json
-import os
-import re
-import shlex
-import shutil
-import sqlite3
-import stat
-import subprocess
-import sys
-import textwrap
-import time
-from importlib.machinery import SourceFileLoader
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None or shutil.which("git") is None,
-    reason="the lane tooling is bash over git")]
-
-LANES_EDIT = REPO / "lanes-edit.sh"
-LANES = REPO / "lanes"
-INDEXER = REPO / "lanes-index"
-
-UUID_A1 = "aaaaaaaa-0001-4000-8000-00000000a001"
-UUID_A1B = "aaaaaaaa-0002-4000-8000-00000000a002"
-UUID_A2 = "aaaaaaaa-0003-4000-8000-00000000a003"
-UUID_B1 = "bbbbbbbb-0001-4000-8000-00000000b001"
-UUID_M1 = "cccccccc-0001-4000-8000-00000000c001"
-UUID_M2 = "cccccccc-0002-4000-8000-00000000c002"
-UUID_C1 = "dddddddd-0001-4000-8000-00000000d001"
-UUID_Z1 = "eeeeeeee-0001-4000-8000-00000000e001"
-UUID_T1 = "ffffffff-0001-4000-8000-00000000f001"
-
-#: Lines the grammar has to agree with `LOG_AWK` on, the awkward ones included:
-#: a payload behind `←`, free text with no payload, a text-only `— `, a second
-#: ` — ` inside the text, a tab, a minutes-only stamp, and every way a line can
-#: be UNREADABLE — each of which `LOG_AWK` names in its own words.
-NASTY_LOG = "\n".join([
-    "# lane repoA-1 — object log (lane-collision-protocol Amendment 7)",
-    f"STARTED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:00:00Z, lane:repoA-1 → home opensoft/repoA; dir /work/repoA; profile team-01a; window sess:1 @3",
-    f"CLAIMED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:01:00Z, opensoft/repoA#12 — no-github",
-    f"NOTED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:02:00Z, lane:repoA-1 — found the bug — and a second dash",
-    f"RULED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:03Z, lane:repoA-1 → opensoft/repoA#12 — Brett Heap, verbatim \"take it\"",
-    f"OPENED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:04:00Z, opensoft/repoA#13 ← opensoft/repoA#12",
-    f"NOTED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:05:00Z, lane:repoA-1\tTAB — a tab in the object",
-    "",
-    "this line is not the grammar at all",
-    f"NOTED—lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:06:00Z, lane:repoA-1 — no spaces round the dash",
-    f"TWO WORDS — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:07:00Z, lane:repoA-1 — verb",
-    f"NOTED — lane repoA-1 session {UUID_A1}@Eagle, 2026-10-01T00:08:00Z, lane:repoA-1 — no comma",
-    f"NOTED — lane repoA-1, {UUID_A1}@Eagle, 2026-10-01T00:09:00Z, lane:repoA-1 — no session word",
-    f"NOTED — lane repoA-1, session {UUID_A1}@Eagle 2026-10-01T00:10:00Z, lane:repoA-1 — no comma after the session",
-    f"NOTED — lane repoA-1, session {UUID_A1}@Eagle, yesterday, lane:repoA-1 — no stamp",
-    f"NOTED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:11:00Z lane:repoA-1 — no comma after the stamp",
-    f"NOTED — banana repoA-1, session {UUID_A1}@Eagle, 2026-10-01T00:12:00Z, lane:repoA-1 — no lane word",
-    f"PAUSED — lane repoA-1, session {UUID_A1B}@Eagle, 2026-10-01T01:00:00Z, lane:repoA-1 → dir /work/repoA; profile team-01a; agent claude; transcript {UUID_A1B}",
-    "",
-])
-
-
-def _sanitized_path() -> str:
-    """The caller's PATH without any directory that holds a `lanes-index`:
-    an INSTALLED indexer must never be what a case runs or is nudged."""
-    keep = []
-    for part in os.environ.get("PATH", "").split(os.pathsep):
-        if part and not os.path.exists(os.path.join(part, "lanes-index")):
-            keep.append(part)
-    return os.pathsep.join(keep)
-
-
-def _row(lane: str, ids: str, state: str, started: str = "2026-10-01T00:00Z",
-         ws: str = "Eagle / test / brett", objects: str = "none") -> str:
-    return f"| `{lane}` | harness {ids} | {ws} | {started} | {objects} | handoffs/{lane}.md | {state} |"
-
-
-class Estate:
-    """A whole workspace in `tmp_path`: a bare origin, its clone, the pointer
-    file that joins them, fake `tmux`/`psql`, and the environment every
-    command here is run in."""
-
-    def __init__(self, root: Path):
-        self.root = root
-        self.home = root / "home"
-        self.agents = self.home / ".agents"
-        self.origin = root / "origin.git"
-        self.wip = self.home / "projects" / "wip"
-        self.fakebin = root / "fakebin"
-        self.indexbin = root / "indexbin"
-        self.state = root / "state"
-        self.config = root / "config"
-        for d in (self.home, self.agents, self.fakebin, self.indexbin, self.state, self.config,
-                  root / "tmp"):
-            d.mkdir(parents=True, exist_ok=True)
-        (self.fakebin / "tmux").write_text("#!/bin/sh\nexit 1\n")
-        (self.fakebin / "tmux").chmod(0o755)
-        env = {k: v for k, v in os.environ.items()
-               if not k.startswith(("LANES_", "CLAUDE_", "WORKBENCHES_", "TMUX", "XDG_", "PG",
-                                    "AGENT_PROTOCOL_ROOT", "PROJECTS_"))}
-        env.update(
-            HOME=str(self.home), AGENT_PROTOCOL_ROOT=str(self.agents), TMPDIR=str(root / "tmp"),
-            XDG_STATE_HOME=str(self.state), XDG_CONFIG_HOME=str(self.config),
-            CLAUDE_CONFIG_DIR=str(self.home / ".claude"), LANES_WORKSTATION="Eagle",
-            LANES_HOST="eagle", LANES_OS="linux", LANES_CONTAINER="none",
-            LANES_IN_CONTAINER="0", LANES_NO_GITHUB="1", LANES_EDIT=str(LANES_EDIT),
-            GIT_AUTHOR_NAME="lanes-index tests", GIT_AUTHOR_EMAIL="test@example.invalid",
-            GIT_COMMITTER_NAME="lanes-index tests", GIT_COMMITTER_EMAIL="test@example.invalid",
-            PATH=str(self.fakebin) + os.pathsep + _sanitized_path())
-        self.env = env
-        self._seed()
-
-    # ------------------------------------------------------------ the seed
-    def _git(self, *args: str, cwd: Path | None = None) -> str:
-        proc = subprocess.run(["git", *args], cwd=str(cwd or self.wip), capture_output=True,
-                              text=True, env=self.env, check=False)
-        assert proc.returncode == 0, f"git {' '.join(args)}: {proc.stderr}"
-        return proc.stdout
-
-    def _seed(self) -> None:
-        subprocess.run(["git", "init", "-q", "--bare", "-b", "main", str(self.origin)],
-                       check=True, env=self.env)
-        subprocess.run(["git", "clone", "-q", str(self.origin), str(self.wip)],
-                       check=True, env=self.env, capture_output=True)
-        lanes = self.wip / "lanes"
-        (lanes / "log").mkdir(parents=True)
-        (lanes / "archive").mkdir()
-        register = [
-            "# LANES.md — the test register",
-            "",
-            "| lane | session id | workstation / env / user | started (UTC) | objects owned | handoff path | state |",
-            "|---|---|---|---|---|---|---|",
-            _row("repoA-1", f"`{UUID_A1}` → `{UUID_A1B}`", "PAUSED · 2026-10-01T01:00:00Z · parked for the night"),
-            _row("repoA-2", f"`{UUID_A2}`", "LIVE · 2026-10-01T02:00:00Z · working"),
-            _row("repoM-1", f"`{UUID_M1}`", "LIVE · 2026-10-04T00:00:00Z · managed-owner mode=managed daemon=ledger-1 generation=3 bound-lane=repoM-1"),
-            _row("repoM-2", f"`{UUID_M2}`", "LIVE · 2026-10-04T00:00:00Z · managed-owner mode=managed daemon=ledger-1 generation=0 bound-lane=repoM-2"),
-            _row("repoC-1", f"`{UUID_C1}`", "ENDED · 2026-09-01T00:00:00Z · a row with no log", started="2026-09-01"),
-            "",
-            f"LANDING — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T02:00:00Z, PR #7 into opensoft/repoA main",
-            f"LANDED — lane repoA-1, session {UUID_A1}@Eagle, 2026-10-01T02:05:00Z, PR #7 into opensoft/repoA main → abc1234",
-            "HOLD — lane repoA-2 (Eagle), window w, 2026-10-01T03:00:00Z: opensoft/repoA main 0123456789abcdef0123456789abcdef01234567 for a frozen window",
-            "HOLD RELEASED — lane repoA-2 (Eagle), 2026-10-01T03:30:00Z: opensoft/repoA main 0123456789abcdef0123456789abcdef01234567",
-            "",
-        ]
-        (lanes / "LANES.md").write_text("\n".join(register), encoding="utf-8")
-        (lanes / "log" / "README.md").write_text("# the object logs\n", encoding="utf-8")
-        (lanes / "log" / "repoA-1.md").write_text(NASTY_LOG, encoding="utf-8")
-        (lanes / "log" / "repoA-2.md").write_text("\n".join([
-            "# lane repoA-2 — object log (lane-collision-protocol Amendment 7)",
-            f"STARTED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-01T02:00:00Z, lane:repoA-2 → home opensoft/repoA; dir /work/repoA2; profile team-01b",
-            f"NOTED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-01T02:10:00Z, lane:repoA-2 — second lane's note",
-            ""]), encoding="utf-8")
-        (lanes / "log" / "repoB-1.md").write_text("\n".join([
-            "# lane repoB-1 — object log (lane-collision-protocol Amendment 7)",
-            f"STARTED — lane repoB-1, session {UUID_B1}@Eagle, 2026-10-01T00:30:00Z, lane:repoB-1 → home opensoft/repoB; dir /work/repoB; profile team-02a",
-            f"OPENED — lane repoB-1, session {UUID_B1}@Eagle, 2026-10-01T00:31:00Z, opensoft/repoB#3",
-            f"NOTED — lane repoB-1, session {UUID_B1}@Eagle, 2026-10-01T00:32:00Z, lane:repoB-1 — a log with no row",
-            ""]), encoding="utf-8")
-        for lane, uid in (("repoM-1", UUID_M1), ("repoM-2", UUID_M2)):
-            (lanes / "log" / f"{lane}.md").write_text(
-                f"STARTED — lane {lane}, session {uid}@Eagle, 2026-10-04T00:00:00Z, lane:{lane} → home opensoft/repoM; dir /work/repoM\n",
-                encoding="utf-8")
-        (lanes / "aliases.tsv").write_text("# old\tnew\tutc\nrepoOld-1\trepoA-2\t2026-09-30T00:00:00Z\n",
-                                           encoding="utf-8")
-        (lanes / "archive" / "LANES-retired.md").write_text("\n".join([
-            "# retired rows (Amendment 19(d))", "",
-            _row("repoZ-1", f"`{UUID_Z1}`", "RETIRED · 2026-09-02T00:00:00Z · retired"),
-            ""]), encoding="utf-8")
-        self._git("add", "-A")
-        self._git("commit", "-q", "-m", "seed the test register")
-        self._git("push", "-q", "origin", "main")
-        (self.agents / "workspace.yaml").write_text(
-            f"repository: {self.origin}\npath: {self.wip}\n", encoding="utf-8")
-
-    # ------------------------------------------------------------ running
-    def run(self, *argv, env: dict | None = None, timeout: float = 120,
-            input_text: str | None = None) -> subprocess.CompletedProcess:
-        child = dict(self.env)
-        for key, value in (env or {}).items():
-            if value is None:
-                child.pop(key, None)
-            else:
-                child[key] = value
-        return subprocess.run([str(a) for a in argv], capture_output=True, text=True,
-                              env=child, timeout=timeout, cwd=str(self.root),
-                              input=input_text, stdin=None if input_text is not None else subprocess.DEVNULL)
-
-    def edit(self, *args, env: dict | None = None, **kw) -> subprocess.CompletedProcess:
-        return self.run("bash", LANES_EDIT, *args, env=env, **kw)
-
-    def note(self, lane: str, text: str, env: dict | None = None,
-             **kw) -> subprocess.CompletedProcess:
-        """`log NOTED` as that lane — one write, one commit, one push."""
-        merged = {"LANES_LANE": lane}
-        merged.update(env or {})
-        return self.edit("log", "NOTED", f"lane:{lane}", text, env=merged, **kw)
-
-    def index(self, *args, env: dict | None = None, **kw) -> subprocess.CompletedProcess:
-        merged = {"LANES_EDIT": str(LANES_EDIT)}
-        merged.update(env or {})
-        return self.run(sys.executable, INDEXER, *args, env=merged, **kw)
-
-    @property
-    def sqlite(self) -> Path:
-        return self.state / "openRepoTools" / "lanes-index.sqlite"
-
-    def tip(self) -> str:
-        return self._git("rev-parse", "origin/main").strip()
-
-    def head_text(self, path: str) -> str:
-        """`path` as HEAD holds it, read out of git and not off the disk."""
-        return self._git("show", f"HEAD:{path}")
-
-    def commit_paths(self, files: dict, message: str) -> None:
-        """Commit and push `files` ({repository path: whole content}) THROUGH
-        GIT ALONE - `hash-object` and `update-index --cacheinfo` - and never
-        through the working tree. Two paths one case apart are two files to
-        git on every platform, and ONE file on a case-insensitive filesystem
-        (macOS's default): a fixture written to disk there merges the two logs
-        it was built to keep apart (#164's gate, darwin). The indexer and
-        `who` both read what was PUSHED, so the working tree does not enter."""
-        for path, text in files.items():
-            sha = subprocess.run(["git", "hash-object", "-w", "--stdin"], cwd=str(self.wip),
-                                 input=text, capture_output=True, text=True, env=self.env,
-                                 check=True).stdout.strip()
-            # `core.ignorecase` is what a clone on a case-insensitive disk
-            # turns on; off here, the index keeps the path as it was spelled.
-            self._git("-c", "core.ignorecase=false", "update-index", "--add", "--cacheinfo",
-                      f"100644,{sha},{path}")
-        self._git("-c", "core.ignorecase=false", "commit", "-q", "-m", message)
-        self._git("push", "-q", "origin", "main")
-
-    def write_config(self, text: str, name: str = "lanes-index.conf", mode: int = 0o600) -> Path:
-        path = self.config / "openRepoTools" / name
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text, encoding="utf-8")
-        path.chmod(mode)
-        return path
-
-    def install_indexer(self) -> Path:
-        """A copy of `lanes-index` ON PATH, as `--install` would place it, for
-        the cases that need the nudge to find one."""
-        target = self.indexbin / "lanes-index"
-        shutil.copy2(INDEXER, target)
-        target.chmod(0o755)
-        return target
-
-    def path_with(self, *dirs: Path) -> str:
-        return os.pathsep.join([str(d) for d in dirs] + [self.env["PATH"]])
-
-
-@pytest.fixture
-def estate(tmp_path):
-    return Estate(tmp_path / "e")
-
-
-def dump(db: Path, *, with_utc: bool = False) -> dict:
-    """Every row of every table, ordered, for a row-for-row comparison."""
-    conn = sqlite3.connect(str(db))
-    out = {}
-    tables = [r[0] for r in conn.execute(
-        "SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name")]
-    for table in tables:
-        cols = [r[1] for r in conn.execute(f"PRAGMA table_info({table})")]
-        keep = [c for c in cols if with_utc or c not in ("indexed_utc", "applied_utc")]
-        out[table] = conn.execute(
-            f"SELECT {', '.join(keep)} FROM {table} ORDER BY {', '.join(keep)}").fetchall()
-    conn.close()
-    return out
-
-
-HEX = re.compile(r"[0-9a-f]{7,}")
-UTC = re.compile(r"[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}(:[0-9]{2})?Z")
-#: THE CLOCK'S, NOT THE READ'S: the listing's AGE column and its footer's "last
-#: heard from origin <n>s ago". Both are computed by the same code, at the
-#: moment of the read, out of the same stamps, so two reads a second apart can
-#: differ there and nowhere else.
-AGE = re.compile(r"\b[0-9]+h [0-9]{2}m\b|\b[0-9]+[smhd] ago\b")
-
-
-def normal(text: str, *roots: Path) -> str:
-    """The parts of an answer that are the CLOCK's or the TEMPORARY DIRECTORY's
-    and not the act's: a stamp, a commit id, an age, and the sandbox's paths."""
-    for root in roots:
-        text = text.replace(str(root), "<ROOT>")
-    text = UTC.sub("<UTC>", text)
-    text = AGE.sub("<AGE>", text)
-    return HEX.sub("<HEX>", text)
-
-
-def load_indexer():
-    """`lanes-index` as a module, for the one case that drives a store directly."""
-    import importlib.util
-    loader = SourceFileLoader("lanes_index_module", str(INDEXER))
-    spec = importlib.util.spec_from_loader("lanes_index_module", loader)
-    module = importlib.util.module_from_spec(spec)
-    loader.exec_module(module)
-    return module
-
-
-def _log_awk() -> str:
-    text = LANES_EDIT.read_text(encoding="utf-8")
-    # A single-quoted shell string carries no `'` of its own, so the program
-    # ends at the first quote that closes a line.
-    m = re.search(r"^LOG_AWK='\n(.*?)'\n", text, re.S | re.M)
-    assert m, "lanes-edit.sh no longer declares LOG_AWK='…' the way this test reads it"
-    return m.group(1)
-
-
-# ====================================================== the parser's parity
-
-def test_the_log_parser_is_log_awk_line_for_line(estate):
-    """THE ONE GRAMMAR. `history --index` may print only what `history` prints,
-    so the indexer's parse of a log must be `LOG_AWK`'s, field for field and
-    warning for warning — over a log written to be awkward. `LOG_AWK` is read
-    out of `lanes-edit.sh` itself and run over the same bytes."""
-    assert estate.index("sync").returncode == 0
-    out = estate.root / "exp"
-    out.mkdir()
-    res = estate.index("export", "--out", out)
-    assert res.returncode == 0, res.stderr
-    logs = (out / "logs").read_text().splitlines()
-    assert logs == ["lanes/log/repoA-1.md", "lanes/log/repoA-2.md", "lanes/log/repoB-1.md",
-                    "lanes/log/repoM-1.md", "lanes/log/repoM-2.md"]
-    program = _log_awk()
-    want_events, want_warn = [], []
-    for rel in logs:
-        proc = subprocess.run(["awk", "-v", f"FN={rel}", program],
-                              input=(estate.wip / rel).read_text(encoding="utf-8"),
-                              capture_output=True, text=True, check=True)
-        want_events.append(proc.stdout)
-        want_warn.append(proc.stderr)
-    assert (out / "events").read_text(encoding="utf-8") == "".join(want_events)
-    assert (out / "warn").read_text(encoding="utf-8") == "".join(want_warn)
-    assert "unreadable: lanes/log/repoA-1.md:9 (no \" — \" after the verb)" in \
-        (out / "warn").read_text(encoding="utf-8")
-
-
-# ============================================================ replay, digests
-
-def test_replay_a_second_sync_changes_nothing(estate):
-    """REPLAY (14(d)): an upsert bearing the stored digest changes nothing, so a
-    second sync of the same commit writes not one byte — `indexed_utc`
-    included — and a sync after ONE more write upserts only what that write
-    moved, leaving every other row's provenance where it was."""
-    first = estate.index("sync")
-    assert first.returncode == 0, first.stderr
-    assert "upserted" in first.stdout
-    before = dump(estate.sqlite, with_utc=True)
-    time.sleep(1.1)
-    second = estate.index("sync")
-    assert second.returncode == 0, second.stderr
-    assert "nothing to write" in second.stdout
-    assert dump(estate.sqlite, with_utc=True) == before
-
-    write = estate.note("repoA-2", "one more note")
-    assert write.returncode == 0, write.stderr
-    third = estate.index("sync")
-    assert third.returncode == 0, third.stderr
-    m = re.search(r"(\d+) upserted, (\d+) removed", third.stdout)
-    assert m, third.stdout
-    # one log line, and the file record whose blob moved — nothing else
-    assert (int(m.group(1)), int(m.group(2))) == (2, 0), third.stdout
-    conn = sqlite3.connect(str(estate.sqlite))
-    tip = estate.tip()
-    moved = conn.execute("SELECT COUNT(*) FROM log_lines WHERE provenance = ?", (tip,)).fetchone()[0]
-    assert moved == 1
-    assert conn.execute("SELECT commit_sha FROM provenance").fetchone()[0] == tip
-
-
-def test_reconcile_finds_and_rights_a_row_changed_by_hand(estate):
-    """RECONCILE READS THE CONTENT. A row somebody edited in the store still
-    carries its old digest, so a digest compare passes over it; `reconcile`
-    recomputes the digest from what the row SAYS, and puts it right."""
-    assert estate.index("sync").returncode == 0
-    clean = dump(estate.sqlite)
-    conn = sqlite3.connect(str(estate.sqlite))
-    conn.execute("UPDATE lanes SET state_phrase = 'LIVE · forged' WHERE lane = 'repoA-1'")
-    conn.commit()
-    conn.close()
-    assert estate.index("sync").stdout.count("nothing to write") == 1
-    dry = estate.index("reconcile", "--dry-run")
-    assert dry.returncode == 0, dry.stderr
-    assert re.search(r"lanes\s+\d+ kept\s+1 upserted", dry.stdout), dry.stdout
-    assert "nothing written (--dry-run)" in dry.stdout
-    res = estate.index("reconcile")
-    assert res.returncode == 0, res.stderr
-    assert dump(estate.sqlite) == clean
-
-
-# ===================================================== wiped-index reconcile
-
-def test_wiped_index_reconcile_equals_a_synced_index_row_for_row(estate):
-    """WIPED-INDEX RECONCILE (14(d)): on a wiped index, the rebuild — and it is
-    the same index a sync made, row for row and digest for digest."""
-    assert estate.index("sync").returncode == 0
-    synced = dump(estate.sqlite)
-    estate.sqlite.unlink()
-    dry = estate.index("reconcile", "--dry-run")
-    assert dry.returncode == 0, dry.stderr
-    assert not estate.sqlite.exists(), "a dry run created the store"
-    res = estate.index("reconcile")
-    assert res.returncode == 0, res.stderr
-    assert dump(estate.sqlite) == synced
-    # AND A WIPE THAT LEFT THE TABLES: the provenance row alone gone
-    conn = sqlite3.connect(str(estate.sqlite))
-    conn.execute("DELETE FROM provenance")
-    conn.execute("DELETE FROM log_lines")
-    conn.commit()
-    conn.close()
-    assert estate.index("reconcile").returncode == 0
-    assert dump(estate.sqlite) == synced
-
-
-# ====================================================== monotonic provenance
-
-def test_a_sync_from_a_commit_that_does_not_descend_writes_nothing(estate):
-    """MONOTONIC PROVENANCE (14(d)): the indexed commit only moves forward. A
-    checkout BEHIND the index, one that has DIVERGED from it, and one that has
-    never fetched the indexed commit each write nothing."""
-    t1 = estate.tip()
-    assert estate.note("repoA-2", "the second commit").returncode == 0
-    t2 = estate.tip()
-    assert estate.index("sync").returncode == 0
-    synced = dump(estate.sqlite, with_utc=True)
-
-    estate._git("update-ref", "refs/remotes/origin/main", t1)
-    behind = estate.index("sync")
-    assert behind.returncode == 0, behind.stderr
-    assert "does not descend from the indexed" in behind.stdout
-    assert "BEHIND" in behind.stdout
-    assert dump(estate.sqlite, with_utc=True) == synced
-
-    estate._git("checkout", "-q", "-b", "side", t1)
-    (estate.wip / "lanes" / "log" / "repoB-1.md").write_text("rewritten\n", encoding="utf-8")
-    estate._git("commit", "-q", "-am", "a history the index never saw")
-    side = estate._git("rev-parse", "HEAD").strip()
-    estate._git("update-ref", "refs/remotes/origin/main", side)
-    diverged = estate.index("sync")
-    assert diverged.returncode == 1, diverged.stdout
-    assert "diverged" in diverged.stdout
-    assert dump(estate.sqlite, with_utc=True) == synced
-    recon = estate.index("reconcile")
-    assert recon.returncode == 1 and "nothing written" in recon.stdout
-    assert dump(estate.sqlite, with_utc=True) == synced
-
-    conn = sqlite3.connect(str(estate.sqlite))
-    conn.execute("UPDATE provenance SET commit_sha = ?", ("f" * 40,))
-    conn.commit()
-    conn.close()
-    estate._git("update-ref", "refs/remotes/origin/main", t2)
-    ahead = estate.index("sync")
-    assert ahead.returncode == 0
-    assert "another workstation is ahead" in ahead.stdout
-    conn = sqlite3.connect(str(estate.sqlite))
-    assert conn.execute("SELECT commit_sha FROM provenance").fetchone()[0] == "f" * 40
-
-
-def test_the_compare_and_swap_refuses_a_provenance_that_moved(estate):
-    """THE CAS IS IN THE TRANSACTION: a writer that read one provenance and
-    finds another at commit time writes NOTHING — rows included."""
-    assert estate.index("sync").returncode == 0
-    mod = load_indexer()
-    cfg = {"sqlite": str(estate.sqlite), "store": "sqlite"}
-    store = mod.SqliteStore(cfg)
-    store.open_write()
-    source = [p["source"] for p in store.all_provenance()][0]
-    before = dump(estate.sqlite, with_utc=True)
-    stale = {"commit_sha": "0" * 40}
-    upserts = {"lane_aliases": {"999": {"old_name": "x", "new_name": "y", "utc": None,
-                                        "ordinal": 999, "raw": "x\ty", "digest": "d"}}}
-    with pytest.raises(mod.CasLost):
-        store.apply(source, stale, "1" * 40, upserts, {})
-    assert dump(estate.sqlite, with_utc=True) == before
-
-
-def _export_image(out: Path) -> dict:
-    return {p.name: p.read_text(encoding="utf-8") for p in sorted(out.iterdir())}
-
-
-@pytest.mark.parametrize("journal,wait", [("wal", 60.0), ("delete", 5.0)])
-def test_an_export_is_one_commits_image_when_a_sync_lands_mid_read(estate, monkeypatch,
-                                                                     journal, wait):
-    """ONE READ SNAPSHOT (opensoft/openRepoTools#166 item 1): `export` read the
-    provenance and each table as statements of their own, so a sync landing
-    between two of them wrote rows of two commits under a `meta` naming the
-    first. A sync is landed after the export's FIRST table - in WAL mode it
-    commits at once, and the export keeps its snapshot; in the rollback
-    journal it waits for the export's read lock (`wait` bounds how long this
-    case waits for it to finish first) and lands after - and the export is the
-    old commit's image or the new one, never a mix of the two."""
-    assert estate.index("sync").returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    assert conn.execute(f"PRAGMA journal_mode={journal}").fetchone()[0] == journal
-    conn.close()
-    old = estate.root / "old"
-    old.mkdir()
-    assert estate.index("export", "--out", old).returncode == 0
-    assert estate.note("repoA-2", "a note a sync lands mid-export").returncode == 0
-    _as_estate(monkeypatch, estate)
-    mod = load_indexer()
-    real_rows = mod.SqliteStore.rows
-    syncs: list = []
-
-    def rows_then_a_sync(self, table, source, columns):
-        got = real_rows(self, table, source, columns)
-        if not syncs:
-            syncs.append(subprocess.Popen(
-                [sys.executable, str(INDEXER), "sync"], cwd=str(estate.root),
-                env=dict(estate.env, LANES_EDIT=str(LANES_EDIT)), stdin=subprocess.DEVNULL,
-                stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True))
-            try:
-                syncs[0].wait(timeout=wait)
-            except subprocess.TimeoutExpired:
-                pass  # its commit is waiting on this export's read lock
-        return got
-
-    monkeypatch.setattr(mod.SqliteStore, "rows", rows_then_a_sync)
-    got = estate.root / "got"
-    got.mkdir()
-    assert mod.cmd_export(str(got), None) == 0
-    out, err = syncs[0].communicate(timeout=60)
-    assert syncs[0].returncode == 0 and "upserted" in out, (out, err)
-    new = estate.root / "new"
-    new.mkdir()
-    assert estate.index("export", "--out", new).returncode == 0
-    images = {"old": _export_image(old), "new": _export_image(new)}
-    assert images["old"] != images["new"], "the sync landed nothing: vacuous"
-    assert _export_image(got) in images.values(), "the export mixed two commits' rows"
-
-
-# ============================================================ the hung indexer
-
-STUB = """#!/bin/sh
-# A HUNG INDEXER: it says it started, says what its stdin was, and sleeps.
-printf '%s\\n' "$$" > "$LANES_INDEX_STUB_MARK.pid"
-if IFS= read -r line; then echo data > "$LANES_INDEX_STUB_MARK.stdin"; else echo eof > "$LANES_INDEX_STUB_MARK.stdin"; fi
-printf '%s\\n' "$*" > "$LANES_INDEX_STUB_MARK.argv"
-sleep 30
-"""
-
-
-def _wait_for(path: Path, seconds: float) -> bool:
-    deadline = time.monotonic() + seconds
-    while time.monotonic() < deadline:
-        if path.exists() and path.read_text().strip():
-            return True
-        time.sleep(0.05)
-    return False
-
-
-def test_a_hung_indexer_delays_no_writer_beyond_the_fork(estate):
-    """A HUNG INDEXER (14(d)): the nudge is DETACHED — stdin closed, its output
-    on /dev/null, never waited — so a `lanes-index` that sleeps thirty seconds
-    costs a write no more than the fork. Measured against the same write with
-    the nudge switched off, and proved non-vacuous: the stub DID start, with an
-    empty stdin, asked to `sync`, and was still running when the writer had
-    already returned."""
-    stubdir = estate.root / "stub"
-    stubdir.mkdir()
-    (stubdir / "lanes-index").write_text(STUB)
-    (stubdir / "lanes-index").chmod(0o755)
-    mark = estate.root / "stubmark"
-    path = estate.path_with(stubdir)
-
-    t0 = time.monotonic()
-    control = estate.note("repoA-2", "control write",
-                          env={"PATH": path, "LANES_INDEX": "off",
-                               "LANES_INDEX_STUB_MARK": str(mark)})
-    control_s = time.monotonic() - t0
-    assert control.returncode == 0, control.stderr
-    assert not _wait_for(Path(str(mark) + ".pid"), 1.0), "LANES_INDEX=off still nudged"
-
-    t0 = time.monotonic()
-    nudged = estate.note("repoA-2", "nudged write",
-                         env={"PATH": path, "LANES_INDEX": None,
-                              "LANES_INDEX_STUB_MARK": str(mark)}, timeout=25)
-    nudged_s = time.monotonic() - t0
-    assert nudged.returncode == 0, nudged.stderr
-    pid_file = Path(str(mark) + ".pid")
-    assert _wait_for(pid_file, 10.0), "the nudge never started the indexer"
-    pid = int(pid_file.read_text().strip())
-    try:
-        os.kill(pid, 0)
-        alive = True
-    except OSError:
-        alive = False
-    try:
-        assert alive, "the stub was not running when the writer returned — was it waited?"
-        assert nudged_s < control_s + 3.0, (
-            f"the nudged write took {nudged_s:.2f}s against {control_s:.2f}s without "
-            f"the nudge: a thirty-second indexer is delaying the writer")
-        assert _wait_for(Path(str(mark) + ".stdin"), 5.0)
-        assert Path(str(mark) + ".stdin").read_text().strip() == "eof"
-        # THE STUB WRITES `.stdin` BEFORE `.argv` (the review of #289): seen
-        # the instant `.stdin` is, `.argv` may not be there yet.
-        assert _wait_for(Path(str(mark) + ".argv"), 5.0)
-        assert Path(str(mark) + ".argv").read_text().strip() == "sync"
-        assert "lanes-index" not in nudged.stdout + nudged.stderr
-    finally:
-        try:
-            os.kill(pid, 15)
-        except OSError:
-            pass
-    print(f"\nmeasured: write with LANES_INDEX=off {control_s:.3f}s; with a 30 s "
-          f"indexer on PATH {nudged_s:.3f}s")
-
-
-def test_a_read_never_nudges_and_no_indexer_costs_nothing(estate):
-    """ONLY A PUSH THAT LANDED NUDGES. A read with an indexer on PATH starts
-    none; and a write with NO indexer on PATH prints exactly what it prints
-    with the nudge switched off — the absent case costs nothing and says
-    nothing."""
-    stubdir = estate.root / "stub"
-    stubdir.mkdir()
-    (stubdir / "lanes-index").write_text(STUB)
-    (stubdir / "lanes-index").chmod(0o755)
-    mark = estate.root / "stubmark"
-    res = estate.edit("who", "opensoft/repoA#12",
-                      env={"PATH": estate.path_with(stubdir), "LANES_INDEX": None,
-                           "LANES_INDEX_STUB_MARK": str(mark)})
-    assert res.returncode == 0, res.stderr
-    assert not _wait_for(Path(str(mark) + ".pid"), 1.0), "a read nudged the indexer"
-    off = estate.note("repoA-2", "the same note", env={"LANES_INDEX": "off"})
-    absent = estate.note("repoA-2", "the same note")
-    assert (off.returncode, normal(off.stdout), normal(off.stderr)) == \
-        (absent.returncode, normal(absent.stdout), normal(absent.stderr))
-
-
-# ============================================================ the managed seam
-
-def test_the_owner_column_is_managed_projections_answer(estate):
-    """THE MANAGED SEAM (14(e)): a valid marker indexes as `managed <owner>`, a
-    malformed one as `unknown` — never downgraded to `legacy` — and a plain
-    row as `legacy`; and every one of the three was ASKED of #97's own
-    `managed-projection`, which the indexer carries no copy of."""
-    calls = estate.root / "mp-calls"
-    wrapper = estate.root / "lanes-edit-wrapper"
-    wrapper.write_text(f"#!/bin/sh\nprintf '%s\\n' \"$*\" >> {calls}\nexec bash {LANES_EDIT} \"$@\"\n")
-    wrapper.chmod(0o755)
-    res = estate.index("sync", env={"LANES_EDIT": str(wrapper)})
-    assert res.returncode == 0, res.stderr
-    conn = sqlite3.connect(str(estate.sqlite))
-    owners = dict(conn.execute("SELECT lane, owner FROM lanes"))
-    assert owners["repoM-1"] == "managed ledger-1"
-    assert owners["repoM-2"] == "unknown"
-    assert owners["repoA-1"] == "legacy"
-    assert owners["repoB-1"] == "legacy"
-    asked = calls.read_text().splitlines()
-    for lane in ("repoM-1", "repoM-2", "repoA-1"):
-        assert f"managed-projection {lane}" in asked, asked
-    source = INDEXER.read_text(encoding="utf-8")
-    for vocabulary in ("mode=managed", "managed-owner", "bound-lane"):
-        assert vocabulary not in source, (
-            f"lanes-index carries `{vocabulary}`: a parser of the marker of its own, "
-            f"which clause (e) forbids")
-    # and the ledger half's tables exist EMPTY, with T058's columns
-    cols = [r[1] for r in conn.execute("PRAGMA table_info(swap_states)")]
-    assert {"lane", "parent_uuid", "generation", "state"} <= set(cols)
-    assert conn.execute("SELECT COUNT(*) FROM swap_states").fetchone()[0] == 0
-    assert conn.execute("SELECT COUNT(*) FROM job_summaries").fetchone()[0] == 0
-    # and #161's worktree inventory table, RESERVED: its columns, no rows
-    cols = [r[1] for r in conn.execute("PRAGMA table_info(worktrees)")]
-    assert {"workstation", "lane", "owner", "path", "branch", "base", "lifecycle",
-            "generation", "operation", "writer_live", "last_seen_utc", "last_commit",
-            "dirty_count", "unpushed_count", "pr_number", "pr_state"} <= set(cols)
-    assert conn.execute("SELECT COUNT(*) FROM worktrees").fetchone()[0] == 0
-
-
-def test_the_schema_holds_what_clause_e_names(estate):
-    """What is indexed: every lane (a log with no row, and an archived row,
-    included), every log line with the unreadable ones kept by file and line,
-    the register's four kinds of line, the transcript pointers, and holds as a
-    VIEW in file order."""
-    assert estate.index("sync").returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    lanes = {r[0]: r for r in conn.execute(
-        "SELECT lane, aliases, home, last_session, archived, session_ids, state_phrase FROM lanes")}
-    assert set(lanes) >= {"repoA-1", "repoA-2", "repoB-1", "repoM-1", "repoM-2", "repoC-1", "repoZ-1"}
-    assert json.loads(lanes["repoA-2"][1]) == ["repoOld-1"]
-    assert lanes["repoA-1"][2] == "opensoft/repoA"
-    assert lanes["repoA-1"][3] == UUID_A1B
-    assert json.loads(lanes["repoA-1"][5]) == [UUID_A1, UUID_A1B]
-    assert lanes["repoZ-1"][4] == 1
-    assert lanes["repoA-1"][6] == "PAUSED · 2026-10-01T01:00:00Z · parked for the night"
-    bad = conn.execute("SELECT file, ordinal, unreadable_why FROM log_lines WHERE unreadable = 1 "
-                       "ORDER BY ordinal").fetchall()
-    assert len(bad) == 9 and bad[0][:2] == ("lanes/log/repoA-1.md", 9)
-    kinds = dict(conn.execute("SELECT kind, COUNT(*) FROM register_lines GROUP BY kind"))
-    assert kinds == {"LANDING": 1, "LANDED": 1, "HOLD": 1, "HOLD RELEASED": 1}
-    landed = conn.execute("SELECT pr, repo, tip FROM register_lines WHERE kind = 'LANDED'").fetchone()
-    assert landed == ("7", "opensoft/repoA", "abc1234")
-    holds = conn.execute("SELECT lane, object, verb FROM holds ORDER BY lane, object").fetchall()
-    assert holds == [("repoA-1", "opensoft/repoA#12", "CLAIMED"),
-                     ("repoA-1", "opensoft/repoA#13", "OPENED"),
-                     ("repoB-1", "opensoft/repoB#3", "OPENED")]
-    paused = conn.execute("SELECT transcript_id, agent FROM transcript_pointers "
-                          "WHERE kind = 'paused'").fetchall()
-    assert paused == [(UUID_A1B, "claude")]
-    fields = json.loads(conn.execute(
-        "SELECT payload_fields FROM log_lines WHERE verb = 'STARTED' AND lane = 'repoA-1'").fetchone()[0])
-    assert fields["home"] == "opensoft/repoA" and fields["window"] == "sess:1 @3"
-    assert conn.execute("SELECT version FROM schema_version").fetchall() == [(1,)]
-
-
-# ================================================== the read flag, and its fallback
-
-def _pair(estate, argv, *, env=None):
-    src = estate.run(*argv, env=env)
-    idx = estate.run(*argv, "--index", env=env)
-    return src, idx
-
-
-READS = [
-    ("bash", LANES_EDIT, "history", "repoA-1"),
-    ("bash", LANES_EDIT, "history", "--all"),
-    ("bash", LANES_EDIT, "history", "--repo", "opensoft/repoA"),
-    ("bash", LANES_EDIT, "history", "repoOld-1"),
-    ("bash", LANES_EDIT, "lanes", "--all", "--closed"),
-    ("bash", LANES, "--all"),
-    ("bash", LANES, "--all", "--closed"),
-]
-
-
-def test_the_index_read_is_byte_identical_to_the_source_read(estate):
-    """`--index` ANSWERS EXACTLY WHAT THE SOURCES ANSWER where the index is
-    current — the listing's AGE column, which is the clock's, the one
-    permitted difference — and says so on stderr. Then a write the index has
-    not followed: the lag is SAID, never refused.
-
-    STDERR TOO (opensoft/openRepoTools#166 item 3): `history repoA-1` prints
-    LOG_AWK's warnings for its log's nine unreadable lines AND the count that
-    closes them, and `history repoA-1 --index` said the nine without the
-    count. Two lines are the flag's own and are set aside on both sides: the
-    `read:` line, and `history`'s no-fetch note where the index answered - the
-    read is the index's, so that arm fetches nothing in front of it."""
-    assert estate.index("sync").returncode == 0
-    sha12 = estate.tip()[:12]
-
-    def told(stderr: str) -> str:
-        return "".join(line for line in stderr.splitlines(keepends=True)
-                       if not line.startswith("read: ")
-                       and "not fetching; reading origin/" not in line)
-
-    for argv in READS:
-        src, idx = _pair(estate, argv)
-        assert idx.returncode == src.returncode, (argv, idx.stderr)
-        assert AGE.sub("<AGE>", idx.stdout) == AGE.sub("<AGE>", src.stdout), argv
-        assert f"read: index (sqlite) at register@{sha12}; 0 commits behind" in idx.stderr, (argv, idx.stderr)
-        assert "read: " not in src.stderr
-        assert told(idx.stderr) == told(src.stderr), (argv, idx.stderr, src.stderr)
-    src, _idx = _pair(estate, ("bash", LANES_EDIT, "history", "repoA-1"))
-    assert "9 unreadable line(s) above" in src.stderr, "the fixture lost its unreadable lines: vacuous"
-    assert estate.note("repoA-1", "a note the index has not seen").returncode == 0
-    src, idx = _pair(estate, ("bash", LANES_EDIT, "history", "repoA-1"))
-    assert idx.returncode == 0
-    assert "1 commits behind" in idx.stderr
-    assert "a note the index has not seen" in src.stdout
-    assert "a note the index has not seen" not in idx.stdout
-
-
-def _fallback_setups():
-    def missing(e):
-        return {}
-
-    def unreachable(e):
-        fake = e.root / "pgfake"
-        fake.mkdir(exist_ok=True)
-        (fake / "psql").write_text("#!/bin/sh\necho 'psql: error: connection to server at \"db.invalid\" failed' >&2\nexit 2\n")
-        (fake / "psql").chmod(0o755)
-        pw = e.config / "pgpass"
-        pw.write_text("*:*:*:*:never-read\n")
-        pw.chmod(0o600)
-        e.write_config(f"url=postgresql://lanes_writer@db.invalid/qa\npassfile={pw}\n"
-                       f"reader_url=postgresql://lanes_reader@db.invalid/qa\n")
-        return {"PATH": e.path_with(fake)}
-
-    def wiped(e):
-        assert e.index("sync").returncode == 0
-        conn = sqlite3.connect(str(e.sqlite))
-        conn.execute("DELETE FROM provenance")
-        conn.commit()
-        return {}
-
-    def unknown_schema(e):
-        assert e.index("sync").returncode == 0
-        conn = sqlite3.connect(str(e.sqlite))
-        conn.execute("UPDATE schema_version SET version = 99")
-        conn.commit()
-        return {}
-
-    def refused(e):
-        e.write_config("store=sqlite\n", mode=0o644)
-        return {}
-
-    def off(e):
-        assert e.index("sync").returncode == 0
-        return {"LANES_INDEX": "off"}
-
-    return [("missing", missing), ("unreachable", unreachable), ("wiped", wiped),
-            ("unknown-schema", unknown_schema), ("refused", refused), ("off", off)]
-
-
-@pytest.mark.parametrize("kind,setup", _fallback_setups(), ids=[k for k, _ in _fallback_setups()])
-def test_each_failure_falls_back_to_the_sources_and_says_so(estate, kind, setup):
-    """FALLBACK (14(b)): missing, unreachable, wiped, of an unknown schema,
-    refused, or switched off — each says `read: sources (index <why>)` and
-    returns the source read's own answer and exit."""
-    env = setup(estate)
-    for argv in READS:
-        src = estate.run(*argv, env=env)
-        idx = estate.run(*argv, "--index", env=env)
-        assert idx.returncode == src.returncode, (kind, argv, idx.stderr)
-        assert AGE.sub("<AGE>", idx.stdout) == AGE.sub("<AGE>", src.stdout), (kind, argv)
-        assert f"read: sources (index {kind}" in idx.stderr, (kind, argv, idx.stderr)
-
-
-def test_the_flag_is_never_taken_from_the_environment(estate):
-    """`--index` IS TYPED, never inherited: a variable of the seam's own name in
-    the environment changes nothing, and neither does a configured store."""
-    assert estate.index("sync").returncode == 0
-    forged = estate.root / "forged"
-    forged.mkdir()
-    (forged / "register").write_text("| `forged-1` | x | y | z | none | h | LIVE |\n")
-    res = estate.edit("lanes", "--all", env={"LANES_IDX_DIR": str(forged), "LANES_INDEX": None})
-    assert res.returncode == 0
-    assert "forged-1" not in res.stdout
-    assert "read: " not in res.stderr
-
-
-# ======================================================= offline no-read, poison
-
-#: The acts and the reads an act makes for itself, each one run against two
-#: fresh copies of the same estate. A WRITE is followed by its nudge where an
-#: indexer is on PATH — which is the point: it runs, it fails against the
-#: configured store, and the act's answer does not move.
-ACTS = [
-    ("claim", "opensoft/repoA#40"),
-    ("log", "NOTED", "lane:repoA-2", "an offline note"),
-    ("set-row-state", "repoA-2", "PAUSED · parked offline"),
-    ("release", "opensoft/repoA#12", "done with it"),
-    ("who", "--landing", "opensoft/repoA"),
-    ("who", "opensoft/repoA#12"),
-    ("who", "--lane", "repoA-1"),
-    ("lane-objects", "repoA-1"),
-    ("managed-projection", "repoA-1"),
-    ("managed-projection", "repoM-1"),
-    ("managed-projection", "repoM-2"),
-    ("binding", "repoA-1"),
-    ("live-holder", "repoA-2"),
-    ("register-row", "repoA-1"),
-    ("canon-lane", "repoOld-1"),
-    ("history", "repoA-1"),
-    ("lanes", "--all", "--closed"),
-]
-
-
-def _act_env(e: Estate, act: tuple) -> dict:
-    env = {}
-    if act[0] in ("claim", "log", "set-row-state", "release"):
-        env["LANES_LANE"] = "repoA-2" if act[0] != "release" else "repoA-1"
-        env["LANES_SESSION"] = UUID_A2 if act[0] != "release" else UUID_A1B
-    return env
-
-
-def _run_act(e: Estate, act: tuple, extra: dict) -> tuple:
-    env = _act_env(e, act)
-    env.update(extra)
-    res = e.edit(*act, env=env)
-    return (res.returncode, normal(res.stdout, e.root), normal(res.stderr, e.root))
-
-
-def test_offline_no_read_every_act_is_byte_identical_against_an_unreachable_index(tmp_path):
-    """OFFLINE NO-READ (14(b), (f)): with an indexer installed and configured at
-    a Postgres nobody can reach, every act answers byte for byte as it does
-    with no index at all — and the writes' nudges DID reach for that store,
-    which is what makes the sameness a finding rather than an absence."""
-    control_root = tmp_path / "control"
-    index_root = tmp_path / "index"
-    control = Estate(control_root)
-    indexed = Estate(index_root)
-    indexed.install_indexer()
-    fake = indexed.root / "pgfake"
-    fake.mkdir()
-    psql_log = indexed.root / "psql.log"
-    (fake / "psql").write_text(
-        f"#!/bin/sh\nprintf '%s\\n' \"$*\" >> {psql_log}\n"
-        "echo 'psql: error: connection to server at \"lanes-index.invalid\" failed' >&2\nexit 2\n")
-    (fake / "psql").chmod(0o755)
-    pw = indexed.config / "pgpass"
-    pw.write_text("*:*:*:*:never-read\n")
-    pw.chmod(0o600)
-    indexed.write_config(f"url=postgresql://lanes_writer@lanes-index.invalid/qa\npassfile={pw}\n")
-    extra = {"PATH": indexed.path_with(indexed.indexbin, fake), "LANES_INDEX": None}
-    for act in ACTS:
-        a = _run_act(control, act, {})
-        b = _run_act(indexed, act, extra)
-        assert normal(a[1], control_root) == normal(b[1], index_root), act
-        assert (a[0], normal(a[2], control_root)) == (b[0], normal(b[2], index_root)), (act, b[2])
-    assert _wait_for(psql_log, 15.0), "no nudge ever reached for the configured store"
-    assert "lanes_writer" in psql_log.read_text()
-
-
-def test_a_poisoned_index_changes_no_acts_answer(tmp_path):
-    """POISONED INDEX (14(b)): an index carrying WRONG rows — a forged hold, a
-    forged owner, a forged state, forged narrative — changes no act's answer.
-    Unreachability cannot prove that acts do not read the index; wrong rows
-    that nothing repeats can. And the poison is REAL: `--index` reads it."""
-    control = Estate(tmp_path / "control")
-    poisoned = Estate(tmp_path / "poisoned")
-    res = poisoned.index("sync")
-    assert res.returncode == 0, res.stderr
-    conn = sqlite3.connect(str(poisoned.sqlite))
-    conn.execute("UPDATE lanes SET owner = 'managed evil', state_phrase = 'LIVE · poisoned', "
-                 "session_ids = '[\"99999999-9999-4999-8999-999999999999\"]', "
-                 "last_session = '99999999-9999-4999-8999-999999999999'")
-    conn.execute("UPDATE log_lines SET free_text = 'POISONED' WHERE verb = 'NOTED'")
-    conn.execute("UPDATE log_lines SET verb = 'CLAIMED', object = 'opensoft/repoA#40' "
-                 "WHERE verb = 'NOTED' AND lane = 'repoB-1'")
-    conn.execute("UPDATE register_lines SET kind = 'LANDING', raw = 'LANDING — poisoned'")
-    conn.commit()
-    conn.close()
-    extra = {"LANES_INDEX": None}
-    for act in ACTS:
-        a = _run_act(control, act, {})
-        b = _run_act(poisoned, act, extra)
-        assert normal(a[1], control.root) == normal(b[1], poisoned.root), act
-        assert (a[0], normal(a[2], control.root)) == (b[0], normal(b[2], poisoned.root)), (act, b[2])
-    seen = poisoned.edit("history", "repoB-1", "--index", env=extra)
-    assert "read: index (sqlite)" in seen.stderr
-    assert "POISONED" in seen.stdout or seen.returncode == 8, seen.stdout
-    told = poisoned.edit("history", "repoA-1", "--index", env=extra)
-    assert "POISONED" in told.stdout, "the poison never reached the index read: vacuous"
-
-
-# ============================================================ history across lanes
-
-def test_history_across_lanes_reads_the_sources_on_one_timeline(estate):
-    """`history --all` and `history --repo <r>` (14(g) act 2): every lane's
-    `NOTED`/`RULED` on ONE timeline, by UTC and then file order, with the lane
-    named — from the SOURCES, no flag needed; and the selectors refuse to be
-    combined."""
-    res = estate.edit("history", "--all")
-    assert res.returncode == 0, res.stderr
-    lines = res.stdout.splitlines()
-    stamps = [line.split()[0] for line in lines]
-    padded = [s if len(s) == 20 else s[:16] + ":00Z" for s in stamps]
-    assert padded == sorted(padded)
-    assert any(" repoB-1 " in line for line in lines)
-    assert any(" repoA-2 " in line for line in lines)
-    repo = estate.edit("history", "--repo", "opensoft/repoB")
-    assert repo.returncode == 0, repo.stderr
-    assert repo.stdout.splitlines() and all(" repoB-1 " in l for l in repo.stdout.splitlines())
-    none = estate.edit("history", "--repo", "opensoft/nowhere")
-    assert none.returncode == 8 and none.stdout == ""
-    since = estate.edit("history", "--all", "--since", "2026-10-01T00:30Z")
-    assert all(l.split()[0] >= "2026-10-01T00:30" for l in since.stdout.splitlines())
-    for bad in (("history", "repoA-1", "--all"), ("history", "--all", "--repo", "x/y"),
-                ("history",)):
-        refused = estate.edit(*bad)
-        assert refused.returncode == 64, (bad, refused.stderr)
-
-
-# ================================================================ the store's rules
-
-@pytest.mark.parametrize("text,mode,where,why", [
-    ("store=sqlite\n", 0o644, "config", "mode 644"),
-    ("url=postgresql://w:secret@db.invalid/qa\n", 0o600, "config", "carries a password"),
-    ("url=postgresql://w@db.invalid/qa?password=secret\n", 0o600, "config", "carries a password"),
-    ("url=host=db.invalid user=w password=secret\n", 0o600, "config", "carries a password"),
-    ("store=oracle\n", 0o600, "config", "the store is"),
-    ("colour=blue\n", 0o600, "config", "does not know"),
-    ("store=postgres\n", 0o600, "config", "names no `url=`"),
-    ("store=sqlite\n", 0o600, "worktree", "inside the git work tree"),
-    ("store=sqlite\n", 0o600, "agents", "which on a"),
-])
-def test_the_configuration_is_refused_on_clause_c_grounds(estate, text, mode, where, why):
-    """THE CONFIGURATION (14(c)): per workstation, 0600, never committed and
-    never under `~/.agents/`, and no password in a URL. Each refusal is exit 2
-    and writes nothing."""
-    if where == "config":
-        path = estate.write_config(text, mode=mode)
-        env = {}
-    elif where == "worktree":
-        path = estate.wip / "lanes-index.conf"
-        path.write_text(text)
-        path.chmod(mode)
-        env = {"LANES_INDEX_CONFIG": str(path)}
-    else:
-        path = estate.agents / "lanes-index.conf"
-        path.write_text(text)
-        path.chmod(mode)
-        env = {"LANES_INDEX_CONFIG": str(path)}
-    res = estate.index("sync", env=env)
-    assert res.returncode == 2, (res.stdout, res.stderr)
-    assert why in res.stderr, res.stderr
-    assert not estate.sqlite.exists()
-
-
-def test_a_named_configuration_that_is_not_there_and_a_store_in_a_work_tree_refuse(estate):
-    missing = estate.index("sync", env={"LANES_INDEX_CONFIG": str(estate.root / "nope.conf")})
-    assert missing.returncode == 2 and "does not exist" in missing.stderr
-    estate.write_config(f"sqlite={estate.wip / 'lanes-index.sqlite'}\n")
-    inside = estate.index("sync")
-    assert inside.returncode == 2 and "never inside a work tree" in inside.stderr
-    pw = estate.config / "loose-pgpass"
-    pw.write_text("*:*:*:*:x\n")
-    pw.chmod(0o644)
-    estate.write_config(f"url=postgresql://w@db.invalid/qa\npassfile={pw}\n")
-    loose = estate.index("sync")
-    assert loose.returncode == 2 and "password file" in loose.stderr
-
-
-FAKE_PSQL = r"""#!/usr/bin/env python3
-# A FAKE psql: it records what it was asked and answers the few queries
-# lanes-index makes as an EMPTY schema-1 store would. No database exists.
-import json, os, sys
-# The schema version it answers is "1" unless FAKE_PSQL_VERSION_FILE names a
-# file holding another (empty: no row, a wiped store); the bootstrap DDL
-# writes "1" into that file, as a real one would create the row.
-log = os.environ["FAKE_PSQL_LOG"]
-vfile = os.environ.get("FAKE_PSQL_VERSION_FILE", "")
-version = open(vfile).read().strip() if vfile else "1"
-args = sys.argv[1:]
-url = args[args.index("-d") + 1] if "-d" in args else ""
-stdin = sys.stdin.read()
-with open(log, "a") as handle:
-    handle.write(json.dumps({"url": url, "passfile": os.environ.get("PGPASSFILE", ""),
-                             "pgpassword": "PGPASSWORD" in os.environ, "stdin": stdin}) + "\n")
-if vfile and "CREATE TABLE IF NOT EXISTS" in stdin:
-    with open(vfile, "w") as handle:
-        handle.write("1\n")
-
-
-def echo(text):
-    # `\echo` AS psql's OWN LEXER READS IT (opensoft/openRepoTools#166 item 4;
-    # psqlscanslash.l's `xslashquote`): words split on blanks, a quoted run
-    # taken whole, and inside the quotes `''`, `\n \t \b \r \f`, octal
-    # `\ooo` and hex `\xhh` decoded - so the marker the indexer sends is the
-    # marker its parser reads back, and a wrong escape is wrong here too.
-    words, word, quoted, i = [], "", False, 0
-    while i < len(text):
-        ch = text[i]
-        if not quoted and ch in " \t":
-            if word:
-                words.append(word)
-                word = ""
-            i += 1
-        elif ch == "'" and quoted and text[i + 1:i + 2] == "'":
-            word, i = word + "'", i + 2
-        elif ch == "'":
-            quoted, i = not quoted, i + 1
-        elif quoted and ch == "\\" and i + 1 < len(text):
-            nxt = text[i + 1]
-            octal = len(text[i + 1:i + 4]) - len(text[i + 1:i + 4].lstrip("01234567"))
-            hexes = len(text[i + 2:i + 4]) - len(text[i + 2:i + 4].lstrip("0123456789abcdefABCDEF"))
-            if nxt in "ntbrf":
-                word, i = word + {"n": "\n", "t": "\t", "b": "\b", "r": "\r", "f": "\f"}[nxt], i + 2
-            elif octal:
-                word, i = word + chr(int(text[i + 1:i + 1 + octal], 8)), i + 1 + octal
-            elif nxt == "x" and hexes:
-                word, i = word + chr(int(text[i + 2:i + 2 + hexes], 16)), i + 2 + hexes
-            else:
-                word, i = word + nxt, i + 2
-        else:
-            word, i = word + ch, i + 1
-    if word:
-        words.append(word)
-    return " ".join(words)
-
-
-for line in stdin.splitlines():
-    if line.startswith("COPY (SELECT version"):
-        if version:
-            print(version)
-    elif line.startswith("\\echo"):
-        print(echo(line[len("\\echo"):]))
-sys.exit(0)
-"""
-
-
-def test_the_fake_psql_decodes_echo_as_psql_does(tmp_path):
-    """THE FAKE DOES NOT HARD-CODE THE MARKER (opensoft/openRepoTools#166 item
-    4): it prints what psql would for each `\\echo`, so `\\036` arrives as byte
-    0x1E only because psql's escapes say so - and an argument that is not the
-    marker is not the marker."""
-    fake = tmp_path / "psql"
-    fake.write_text(FAKE_PSQL)
-    fake.chmod(0o755)
-    script = "\n".join([
-        "\\echo '\\036LANES-INDEX-NEXT'",
-        "\\echo 'it''s' two   words",
-        "\\echo 'a\\tb\\x41\\101\\q'",
-        "\\echo plain",
-        ""])
-    res = subprocess.run([sys.executable, str(fake), "-d", "postgresql://x@db.invalid/qa"],
-                         input=script, capture_output=True, text=True, check=False,
-                         env=dict(os.environ, FAKE_PSQL_LOG=str(tmp_path / "log")))
-    assert res.returncode == 0, res.stderr
-    assert res.stdout.split("\n") == ["\x1eLANES-INDEX-NEXT", "it's two words", "a\tbAAq",
-                                      "plain", ""], res.stdout
-
-
-def test_postgres_takes_the_writer_to_write_and_the_reader_to_read(estate):
-    """TWO ROLES (14(c)): `sync` connects as the `url=` WRITER and `export`
-    and `status` as the `reader_url=` READER, each with its own 0600 password
-    file and never a `PGPASSWORD`; and the sync's writes are ONE transaction
-    whose first act is the provenance compare-and-swap."""
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text(FAKE_PSQL)
-    (fake / "psql").chmod(0o755)
-    log = estate.root / "psql.jsonl"
-    wpw = estate.config / "writer.pgpass"
-    rpw = estate.config / "reader.pgpass"
-    for p in (wpw, rpw):
-        p.write_text("*:*:*:*:x\n")
-        p.chmod(0o600)
-    estate.write_config(
-        f"url=postgresql://lanes_writer@db.invalid/qa\npassfile={wpw}\n"
-        f"reader_url=postgresql://lanes_reader@db.invalid/qa\nreader_passfile={rpw}\n")
-    env = {"PATH": estate.path_with(fake), "FAKE_PSQL_LOG": str(log),
-           "PGPASSWORD": "inherited-and-never-used"}
-    res = estate.index("sync", env=env)
-    assert res.returncode == 0, res.stderr
-    calls = [json.loads(l) for l in log.read_text().splitlines()]
-    assert calls and all(c["url"] == "postgresql://lanes_writer@db.invalid/qa" for c in calls)
-    assert all(c["passfile"] == str(wpw) and not c["pgpassword"] for c in calls)
-    writes = [c["stdin"] for c in calls if "INSERT INTO lanes" in c["stdin"]]
-    assert len(writes) == 1, "the rows went in more than one transaction"
-    script = writes[0]
-    assert script.index("BEGIN;") < script.index("lanes_index_cas") < script.index("INSERT INTO lanes")
-    assert script.rstrip().endswith("COMMIT;")
-    assert "IS NOT DISTINCT FROM NULL" in script
-    log.unlink()
-    out = estate.root / "exp"
-    out.mkdir()
-    exp = estate.index("export", "--out", out, env=env)
-    assert exp.returncode == 3 and (out / "why").read_text().startswith("wiped")
-    st = estate.index("status", env=env)
-    calls = [json.loads(l) for l in log.read_text().splitlines()]
-    assert calls and all(c["url"] == "postgresql://lanes_reader@db.invalid/qa" for c in calls)
-    assert all(c["passfile"] == str(rpw) for c in calls)
-    assert not any("INSERT" in c["stdin"] or "CREATE" in c["stdin"] for c in calls)
-    assert "postgres" in st.stdout
-
-
-def test_a_postgres_export_is_one_repeatable_read_transaction(estate):
-    """ONE READ SNAPSHOT ON POSTGRES TOO (opensoft/openRepoTools#166 item 1):
-    each `rows()` was a `psql` session of its own. The export's provenance and
-    its five tables now go in ONE `psql` call, inside `BEGIN ISOLATION LEVEL
-    REPEATABLE READ READ ONLY` ... `COMMIT`, which is one snapshot."""
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text(FAKE_PSQL)
-    (fake / "psql").chmod(0o755)
-    log = estate.root / "psql.jsonl"
-    estate.write_config("url=postgresql://lanes_writer@db.invalid/qa\n"
-                        "reader_url=postgresql://lanes_reader@db.invalid/qa\n")
-    out = estate.root / "exp"
-    out.mkdir()
-    exp = estate.index("export", "--out", out,
-                       env={"PATH": estate.path_with(fake), "FAKE_PSQL_LOG": str(log)})
-    # the fake holds no provenance, so the answer is `wiped` - read in the batch
-    assert exp.returncode == 3 and (out / "why").read_text().startswith("wiped"), exp.stderr
-    calls = [json.loads(l)["stdin"] for l in log.read_text().splitlines()]
-    reads = [c for c in calls if "FROM provenance" in c]
-    assert len(reads) == 1, calls
-    script = reads[0]
-    assert "BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY;" in script, script
-    begin = script.index("BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY;")
-    end = script.rindex("COMMIT;")
-    assert begin < script.index("FROM provenance WHERE") < end, script
-    for table in ("source_files", "lanes", "register_lines", "lane_aliases", "log_lines"):
-        assert begin < script.index(f"FROM {table} WHERE") < end, (table, script)
-
-
-def test_a_read_never_connects_with_the_writers_credential(estate):
-    """THE READER OR NOTHING (14(c); Copilot round 1 on #164): a Postgres
-    configuration with a writer `url=` and no `reader_url=` REFUSES the reads
-    — `export` says `refused` and the read flags answer from the sources,
-    `status` exits 2 — and not one of them reaches `psql` at all, so the
-    writer's credential is never presented by a session typing `--index`."""
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text(FAKE_PSQL)
-    (fake / "psql").chmod(0o755)
-    log = estate.root / "psql.jsonl"
-    wpw = estate.config / "writer.pgpass"
-    wpw.write_text("*:*:*:*:x\n")
-    wpw.chmod(0o600)
-    estate.write_config(f"url=postgresql://lanes_writer@db.invalid/qa\npassfile={wpw}\n")
-    env = {"PATH": estate.path_with(fake), "FAKE_PSQL_LOG": str(log)}
-    out = estate.root / "exp"
-    out.mkdir()
-    exp = estate.index("export", "--out", out, env=env)
-    assert exp.returncode == 2, exp.stderr
-    assert (out / "why").read_text().startswith("refused:")
-    assert "reader_url" in (out / "why").read_text()
-    for argv in (("bash", LANES_EDIT, "history", "repoA-1"), (LANES, "--all")):
-        src = estate.run(*argv, env=env)
-        idx = estate.run(*argv, "--index", env=env)
-        assert "read: sources (index refused" in idx.stderr, (argv, idx.stderr)
-        assert idx.returncode == src.returncode, (argv, idx.stderr)
-        assert AGE.sub("<AGE>", idx.stdout) == AGE.sub("<AGE>", src.stdout), argv
-    st = estate.index("status", env=env)
-    assert st.returncode == 2 and "reader_url" in st.stderr, st.stderr
-    assert not log.exists(), "a read reached psql: " + log.read_text()
-    # the WRITER is still the indexer's, untouched by the rule
-    assert estate.index("sync", env=env).returncode == 0
-    assert all(json.loads(l)["url"] == "postgresql://lanes_writer@db.invalid/qa"
-               for l in log.read_text().splitlines())
-
-
-def test_a_symlink_is_judged_where_it_points(estate):
-    """RESOLVED BEFORE IT IS JUDGED (14(c); Copilot round 1 on #164): a 0600
-    configuration reached through a symlink that lives outside every
-    repository but points INTO a work tree is a file in that work tree, and is
-    refused; so is a SQLite store whose directory is a link into one."""
-    inside = estate.wip / "lanes-index.conf"
-    inside.write_text("store=sqlite\n", encoding="utf-8")
-    inside.chmod(0o600)
-    link = estate.config / "openRepoTools" / "lanes-index.conf"
-    link.parent.mkdir(parents=True, exist_ok=True)
-    link.symlink_to(inside)
-    res = estate.index("sync")
-    assert res.returncode == 2 and "inside the git work tree" in res.stderr, res.stderr
-    assert not estate.sqlite.exists()
-    link.unlink()
-    door = estate.root / "door"
-    door.symlink_to(estate.wip)
-    estate.write_config(f"sqlite={door / 'lanes-index.sqlite'}\n")
-    res = estate.index("sync")
-    assert res.returncode == 2 and "never inside a work tree" in res.stderr, res.stderr
-    assert not (estate.wip / "lanes-index.sqlite").exists()
-
-
-def test_two_logs_one_case_apart_keep_two_transcript_pointers(estate):
-    """KEYED AS THE LOG LINES ARE (Copilot round 1 on #164): two logs whose
-    names differ only by case, each with a PAUSED carrying a transcript at
-    the SAME line, are two pointers — the second keyed by its file — never one
-    overwritten by the other."""
-    tid = "ffffffff-0002-4000-8000-00000000f002"
-    paused = (f"PAUSED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-01T04:00:00Z, "
-              f"lane:repoA-2 → dir /work/repoA2; agent claude; transcript {{}}")
-    lower = "lanes/log/repoA-2.md"
-    estate.commit_paths({
-        "lanes/log/REPOA-2.md": "\n".join([
-            "# lane repoA-2 — object log, the other spelling",
-            f"STARTED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-01T02:00:00Z, lane:repoA-2 → home opensoft/repoA",
-            f"NOTED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-01T02:10:00Z, lane:repoA-2 — padding",
-            paused.format(UUID_T1), ""]),
-        lower: estate.head_text(lower) + paused.format(tid) + "\n",
-    }, "two spellings of one log")
-    tree = estate._git("ls-tree", "--name-only", "origin/main", "lanes/log/").split()
-    assert {"lanes/log/REPOA-2.md", lower} <= set(tree), tree
-    res = estate.index("sync")
-    assert res.returncode == 0, res.stderr
-    conn = sqlite3.connect(str(estate.sqlite))
-    rows = conn.execute("SELECT record_id, transcript_id FROM transcript_pointers "
-                        "WHERE kind = 'paused' AND transcript_id IN (?, ?)",
-                        (UUID_T1, tid)).fetchall()
-    assert {t for _, t in rows} == {UUID_T1, tid}, rows
-    assert len({r for r, _ in rows}) == 2, rows
-    # NOT VACUOUS: the two PAUSED lines sit at the SAME line of their files,
-    # so the first-choice id collides and the second is keyed by its file.
-    where = conn.execute("SELECT lane, ordinal FROM log_lines WHERE verb = 'PAUSED' "
-                         "AND file IN ('lanes/log/REPOA-2.md', ?)", (lower,)).fetchall()
-    assert len(where) == 2 and where[0][1] == where[1][1], where
-
-
-def _as_estate(monkeypatch, estate) -> None:
-    """This process's environment made the estate's, for the cases that drive
-    `lanes-index` as a module; `monkeypatch` puts it back."""
-    for key in list(os.environ):
-        if key.startswith(("LANES_", "CLAUDE_", "WORKBENCHES_", "TMUX", "XDG_", "PG",
-                           "AGENT_PROTOCOL_ROOT", "PROJECTS_")):
-            monkeypatch.delenv(key, raising=False)
-    for key, value in estate.env.items():
-        monkeypatch.setenv(key, value)
-
-
-def test_a_source_that_moves_while_the_owners_are_asked_writes_nothing(estate, monkeypatch,
-                                                                         capsys):
-    """ONE COMMIT'S ROWS, ONE COMMIT'S OWNERS (14(d); Copilot round 1 on
-    #164): `managed-projection` reads `origin/<branch>` as it stands, so the
-    indexer asks the ref again once the owners are in; a ref that moved
-    meanwhile writes NOTHING, and `sync` reads the new tip whole."""
-    _as_estate(monkeypatch, estate)
-    mod = load_indexer()
-    real_tip = mod.tip_of
-    asked = []
-
-    def moving(root):
-        asked.append(root)
-        return "f" * 40 if len(asked) == 2 else real_tip(root)
-
-    monkeypatch.setattr(mod, "tip_of", moving)
-    with pytest.raises(mod.SourceMoved):
-        mod.run_index("sync", None, False)
-    conn = sqlite3.connect(str(estate.sqlite))
-    assert conn.execute("SELECT COUNT(*) FROM provenance").fetchone()[0] == 0
-    assert conn.execute("SELECT COUNT(*) FROM lanes").fetchone()[0] == 0
-    conn.close()
-    asked.clear()
-    assert mod.cmd_sync(None) == 0
-    captured = capsys.readouterr()
-    assert "moved from" in captured.err, captured.err
-    assert len(asked) == 4, asked
-    conn = sqlite3.connect(str(estate.sqlite))
-    assert conn.execute("SELECT commit_sha FROM provenance").fetchone()[0] == estate.tip()
-    assert conn.execute("SELECT COUNT(*) FROM lanes").fetchone()[0] > 0
-
-
-def test_a_rerun_marked_as_the_holder_lets_go_is_never_lost(estate, monkeypatch):
-    """THE HANDSHAKE (14(d); Codex on #164): a mark written after the holder's
-    last look but before it released is found by the holder's look AFTER the
-    release, and synced; and a sync that finds the lock held, marks, and then
-    finds it free takes it itself — no mark is left with nobody to read it."""
-    _as_estate(monkeypatch, estate)
-    mod = load_indexer()
-    runs = []
-    monkeypatch.setattr(mod, "run_index", lambda *a: runs.append(a) or 0)
-    real_release = mod.SyncLock.release
-    released = []
-
-    def release_late_marked(self):
-        if not released and self.handle is not None:
-            self.mark_rerun()  # the contender's mark, after the holder last looked
-        released.append(1)
-        real_release(self)
-
-    monkeypatch.setattr(mod.SyncLock, "release", release_late_marked)
-    assert mod.cmd_sync(None) == 0
-    assert len(runs) == 2, runs
-    lock = mod.SyncLock()
-    assert not os.path.exists(lock.rerun)
-    monkeypatch.setattr(mod.SyncLock, "release", real_release)
-
-    runs.clear()
-    answers = iter([False, True])  # held at the first look, free at the second
-
-    def acquire_second_time(self, wait_seconds):
-        return next(answers, True)
-
-    monkeypatch.setattr(mod.SyncLock, "acquire", acquire_second_time)
-    assert mod.cmd_sync(None) == 0
-    assert len(runs) == 1, "the contender found the lock free on its second look and did not sync"
-    assert not os.path.exists(lock.rerun)
-
-
-def test_an_unknown_owner_is_asked_again_at_the_same_commit(estate):
-    """`unknown` IS NOT AN ANSWER TO KEEP (14(e); Codex on #164): an owner
-    that read as `unknown` because `managed-projection` failed is asked again
-    by the next sync even when the index is already at the tip, and only the
-    row it clears is written."""
-    wrapper = estate.root / "lanes-edit-failing"
-    wrapper.write_text("#!/bin/sh\n"
-                       "if [ \"$1\" = managed-projection ] && [ \"$2\" = repoA-1 ]; then\n"
-                       "  echo 'managed-projection: could not read origin' >&2; exit 1\nfi\n"
-                       f"exec bash {LANES_EDIT} \"$@\"\n")
-    wrapper.chmod(0o755)
-    assert estate.index("sync", env={"LANES_EDIT": str(wrapper)}).returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    assert dict(conn.execute("SELECT lane, owner FROM lanes"))["repoA-1"] == "unknown"
-    conn.close()
-    again = estate.index("sync")
-    assert again.returncode == 0, again.stderr
-    assert "1 upserted, 0 removed" in again.stdout, again.stdout
-    conn = sqlite3.connect(str(estate.sqlite))
-    owners = dict(conn.execute("SELECT lane, owner FROM lanes"))
-    assert owners["repoA-1"] == "legacy"
-    assert owners["repoM-2"] == "unknown"  # a malformed marker stays what it is
-    conn.close()
-    before = dump(estate.sqlite, with_utc=True)
-    third = estate.index("sync")
-    assert third.returncode == 0 and "nothing to write" in third.stdout, third.stdout
-    assert dump(estate.sqlite, with_utc=True) == before
-
-
-def test_the_holds_view_answers_as_who_does(estate):
-    """THE VIEW IS `holders_of` (14(e); Copilot round 2 on #164): a lane's own
-    last line on an object — the lane compared case-insensitively, "last" in
-    file order — holds while its verb is open, and NOT while another lane's own
-    last line there is a TAKEOVER. Checked object by object against `who`."""
-    lines = {
-        "repoA-1.md": [
-            f"CLAIMED — lane repoA-1, session {UUID_A1B}@Eagle, 2026-10-02T00:00:00Z, opensoft/repoA#20 — mine",
-            f"CLAIMED — lane repoA-1, session {UUID_A1B}@Eagle, 2026-10-02T00:30:00Z, opensoft/repoA#21 — mine again, after it came back"],
-        "repoA-2.md": [
-            f"TAKEOVER — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-02T00:05:00Z, opensoft/repoA#20 — a stale claim",
-            f"TAKEOVER — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-02T00:10:00Z, opensoft/repoA#21 — taken",
-            f"RELEASED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-02T00:20:00Z, opensoft/repoA#21 — handed back",
-            f"RELEASED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-02T00:40:00Z, opensoft/repoA#22 — done with it"],
-        # the same lane under another spelling: byte order puts this file
-        # FIRST, so its CLAIMED is not the lane's last line on #22
-        "REPOA-2.md": [
-            "# lane repoA-2 — object log, the other spelling",
-            f"CLAIMED — lane repoA-2, session {UUID_A2}@Eagle, 2026-10-02T00:35:00Z, opensoft/repoA#22 — under the other spelling"],
-    }
-    files = {}
-    for name, add in lines.items():
-        path = f"lanes/log/{name}"
-        old = estate.head_text(path) if name != "REPOA-2.md" else ""
-        files[path] = old + "\n".join(add) + "\n"
-    estate.commit_paths(files, "a takeover, a hand-back and two spellings")
-    tree = estate._git("ls-tree", "--name-only", "origin/main", "lanes/log/").split()
-    assert {"lanes/log/REPOA-2.md", "lanes/log/repoA-2.md"} <= set(tree), tree
-    assert estate.index("sync").returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    view: dict = {}
-    for lane, obj in conn.execute("SELECT lane, object FROM holds"):
-        view.setdefault(obj, set()).add(lane.lower())
-    objects = [r[0] for r in conn.execute(
-        "SELECT DISTINCT object FROM log_lines WHERE unreadable = 0 "
-        "AND object NOT LIKE 'lane:%' ORDER BY object")]
-    conn.close()
-    assert {"opensoft/repoA#20", "opensoft/repoA#21", "opensoft/repoA#22"} <= set(objects)
-    for obj in objects:
-        res = estate.edit("who", obj)
-        assert res.returncode == 0, (obj, res.stderr)
-        who = {m.lower() for m in re.findall(r"^HOLDS +lane (\S+)", res.stdout, re.M)}
-        assert view.get(obj, set()) == who, (obj, view.get(obj), res.stdout)
-    assert view["opensoft/repoA#20"] == {"repoa-2"}
-    assert view["opensoft/repoA#21"] == {"repoa-1"}
-    assert "opensoft/repoA#22" not in view
-
-
-def test_the_holds_view_follows_file_order_not_the_clock(estate):
-    """"LAST" IS THE LAST LINE IN THE FILE (R14; the macOS gate on #164): two
-    lines of one lane on one object, written OUT OF UTC ORDER, are ordered by
-    their position in the log - and line 10 comes after line 9, compared as
-    numbers. A view that ordered by the UTC field, or by the line as text,
-    answers both objects the other way round; `who` is asked as well."""
-    path = "lanes/log/repoA-2.md"
-    head = estate.head_text(path)
-    assert len(head.split("\n")) == 4  # header, STARTED, NOTED, and the final newline
-    say = lambda verb, utc, obj, text: (
-        f"{verb} — lane repoA-2, session {UUID_A2}@Eagle, {utc}, {obj} — {text}")
-    add = [
-        say("CLAIMED", "2026-10-03T09:00:00Z", "opensoft/repoA#30", "line 4, the LATEST stamp"),
-        say("RELEASED", "2026-10-03T23:00:00Z", "opensoft/repoA#31", "line 5, the LATEST stamp"),
-    ] + [say("NOTED", f"2026-10-03T1{n}:00:00Z", "lane:repoA-2", f"padding {n}") for n in range(4)] + [
-        say("RELEASED", "2026-10-03T01:00:00Z", "opensoft/repoA#30", "line 10, an EARLIER stamp"),
-        say("CLAIMED", "2026-10-03T00:30:00Z", "opensoft/repoA#31", "line 11, an EARLIER stamp"),
-    ]
-    estate.commit_paths({path: head + "\n".join(add) + "\n"}, "two objects out of UTC order")
-    assert estate.index("sync").returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    placed = dict(conn.execute(
-        "SELECT object || ' ' || verb, ordinal FROM log_lines WHERE file = ? "
-        "AND object IN ('opensoft/repoA#30', 'opensoft/repoA#31')", (path,)).fetchall())
-    assert placed == {"opensoft/repoA#30 CLAIMED": 4, "opensoft/repoA#31 RELEASED": 5,
-                      "opensoft/repoA#30 RELEASED": 10, "opensoft/repoA#31 CLAIMED": 11}, placed
-    held = dict(conn.execute("SELECT object, verb FROM holds "
-                             "WHERE object IN ('opensoft/repoA#30', 'opensoft/repoA#31')"))
-    assert held == {"opensoft/repoA#31": "CLAIMED"}, held
-    for obj, state in (("opensoft/repoA#30", "FREE"), ("opensoft/repoA#31", "HELD")):
-        res = estate.edit("who", obj)
-        assert res.returncode == 0, res.stderr
-        assert re.search(rf"^state +{state}\b", res.stdout, re.M), (obj, res.stdout)
-
-
-def test_the_store_is_made_private_on_every_write(estate):
-    """0600 EVERY TIME (14(c); Copilot round 2 on #164): a SQLite store whose
-    mode drifted is made private again by the next sync, not only at birth."""
-    assert estate.index("sync").returncode == 0
-    estate.sqlite.chmod(0o644)
-    assert estate.index("sync").returncode == 0
-    assert stat.S_IMODE(estate.sqlite.stat().st_mode) == 0o600
-
-
-def test_a_postgres_store_of_another_schema_is_not_touched(estate):
-    """NEVER WRITTEN, NOT EVEN BY THE BOOTSTRAP (14(d); Copilot round 2 on
-    #164): the version is read before any DDL, so a schema-2 store is refused
-    with no CREATE sent at all; and an absent schema is still bootstrapped."""
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text(FAKE_PSQL)
-    (fake / "psql").chmod(0o755)
-    log = estate.root / "psql.jsonl"
-    wpw = estate.config / "writer.pgpass"
-    wpw.write_text("*:*:*:*:x\n")
-    wpw.chmod(0o600)
-    estate.write_config(f"url=postgresql://lanes_writer@db.invalid/qa\npassfile={wpw}\n"
-                        f"reader_url=postgresql://lanes_reader@db.invalid/qa\n")
-    vfile = estate.root / "pg-version"
-    env = {"PATH": estate.path_with(fake), "FAKE_PSQL_LOG": str(log),
-           "FAKE_PSQL_VERSION_FILE": str(vfile)}
-    vfile.write_text("2\n")
-    res = estate.index("sync", env=env)
-    assert res.returncode == 1 and "unknown-schema" in res.stderr, res.stderr
-    calls = [json.loads(l)["stdin"] for l in log.read_text().splitlines()]
-    assert calls and not any("CREATE" in c or "INSERT" in c for c in calls), calls
-    log.unlink()
-    vfile.write_text("")
-    res = estate.index("sync", env=env)
-    assert res.returncode == 0, res.stderr
-    calls = [json.loads(l)["stdin"] for l in log.read_text().splitlines()]
-    assert sum("CREATE TABLE IF NOT EXISTS" in c for c in calls) == 1
-    assert sum("INSERT INTO lanes" in c for c in calls) == 1
-
-
-def test_out_belongs_to_export_alone(estate):
-    """`--out` is `export`'s, as `--dry-run` is `reconcile`'s (Copilot round 2
-    on #164): `sync --out <dir>` is a usage error, not a silent write."""
-    out = estate.root / "exp"
-    out.mkdir()
-    for verb in ("sync", "reconcile", "status"):
-        res = estate.index(verb, "--out", out)
-        assert res.returncode == 64 and "unknown argument" in res.stderr, (verb, res.stderr)
-    assert not estate.sqlite.exists()
-
-
-def test_a_fetch_that_falls_back_keeps_the_read_line_off_stdout(estate):
-    """`lanes --fetch --index` WHERE THE FETCH FALLS BACK (14(b); Copilot round
-    3 on #164): the wrapper prints the helper's notes on stdout under that
-    footer, and the `read:` line is not one of them - it is said once, on
-    stderr, and the listing is the source read's."""
-    assert estate.index("sync").returncode == 0
-    # THE HELPER IN THAT STATE, as the shell suite builds it: it says the fetch
-    # fell back, on stderr, and answers from the local refs, exit 0.
-    stub = estate.root / "fetchfallback"
-    stub.write_text("#!/usr/bin/env bash\n"
-                    "if [ \"${1-}\" = lanes ]; then\n"
-                    "  printf 'lanes-edit: fetch failed — reading the logs as they stand locally\\n' >&2\n"
-                    "  shift; ff=()\n"
-                    "  for a in \"$@\"; do [ \"$a\" = --fetch ] || ff+=(\"$a\"); done\n"
-                    f"  exec bash {LANES_EDIT} lanes ${{ff[@]+\"${{ff[@]}}\"}}\n"
-                    "fi\n"
-                    f"exec bash {LANES_EDIT} \"$@\"\n", encoding="utf-8")
-    stub.chmod(0o755)
-    env = {"LANES_EDIT": str(stub)}
-    src = estate.run("bash", LANES, "--all", "--fetch", env=env)
-    idx = estate.run("bash", LANES, "--all", "--fetch", "--index", env=env)
-    assert "reading the logs as they stand locally" in src.stdout, src.stdout
-    assert idx.stderr.count("read: index (sqlite)") == 1, idx.stderr
-    assert "read: " not in idx.stdout, idx.stdout
-    assert idx.returncode == src.returncode
-    assert normal(idx.stdout, estate.root) == normal(src.stdout, estate.root)
-
-
-def test_no_inherited_password_file_reaches_psql(estate):
-    """THE CONFIGURED PASSWORD FILE OR NONE (14(c); Copilot on #164): an
-    inherited `PGPASSFILE` is never handed on. With `passfile=` set, libpq is
-    given that file; without one, an EMPTY 0600 file of the indexer's own -
-    never the inherited file, and never `~/.pgpass` by default."""
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text(FAKE_PSQL)
-    (fake / "psql").chmod(0o755)
-    log = estate.root / "psql.jsonl"
-    ambient = estate.root / "ambient.pgpass"
-    ambient.write_text("*:*:*:*:the-wrong-secret\n")
-    ambient.chmod(0o600)
-    estate.write_config("url=postgresql://lanes_writer@db.invalid/qa\n"
-                        "reader_url=postgresql://lanes_reader@db.invalid/qa\n")
-    env = {"PATH": estate.path_with(fake), "FAKE_PSQL_LOG": str(log),
-           "PGPASSFILE": str(ambient), "PGPASSWORD": "inherited"}
-    assert estate.index("sync", env=env).returncode == 0
-    assert estate.index("status", env=env).returncode == 0
-    calls = [json.loads(l) for l in log.read_text().splitlines()]
-    assert calls and not any(c["pgpassword"] for c in calls)
-    used = {c["passfile"] for c in calls}
-    assert len(used) == 1 and str(ambient) not in used, used
-    empty = Path(used.pop())
-    assert empty.parent == estate.state / "openRepoTools", empty
-    assert empty.read_text() == "" and stat.S_IMODE(empty.stat().st_mode) == 0o600
-
-
-def test_an_unreachable_store_writes_nothing_waits_on_nothing_and_says_so(estate):
-    fake = estate.root / "pgfake"
-    fake.mkdir()
-    (fake / "psql").write_text("#!/bin/sh\necho 'psql: error: could not connect' >&2\nexit 2\n")
-    (fake / "psql").chmod(0o755)
-    pw = estate.config / "pgpass"
-    pw.write_text("*:*:*:*:x\n")
-    pw.chmod(0o600)
-    estate.write_config(f"url=postgresql://lanes_writer@db.invalid/qa\npassfile={pw}\n"
-                        f"reader_url=postgresql://lanes_reader@db.invalid/qa\n")
-    env = {"PATH": estate.path_with(fake)}
-    t0 = time.monotonic()
-    res = estate.index("sync", env=env)
-    assert res.returncode == 1 and "unreachable" in res.stderr
-    assert time.monotonic() - t0 < 30
-    st = estate.index("status", env=env)
-    assert st.returncode == 1
-    assert "unreachable" in st.stdout
-    assert "could not connect" in st.stdout
-
-
-def test_status_says_the_lag_and_a_second_sync_waits_for_nobody(estate):
-    assert estate.index("sync").returncode == 0
-    assert estate.note("repoA-1", "unindexed").returncode == 0
-    st = estate.index("status")
-    assert st.returncode == 0, st.stderr
-    assert "lag:         1 commit(s)" in st.stdout
-    assert "last error:  none" in st.stdout
-    # ONE SYNC AT A TIME: a sync that finds the lock held returns at once and
-    # leaves the holder a mark to sync again.
-    import fcntl
-    lock = estate.state / "openRepoTools" / "lanes-index.lock"
-    with open(lock, "a+") as handle:
-        fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-        t0 = time.monotonic()
-        busy = estate.index("sync")
-        assert time.monotonic() - t0 < 10
-    assert busy.returncode == 0 and "another sync holds" in busy.stdout
-    assert (estate.state / "openRepoTools" / "lanes-index.rerun").exists()
-    assert estate.index("sync").returncode == 0
-    assert not (estate.state / "openRepoTools" / "lanes-index.rerun").exists()
-
-
-def test_export_never_creates_a_store_and_the_store_is_private(estate):
-    out = estate.root / "exp"
-    out.mkdir()
-    res = estate.index("export", "--out", out)
-    assert res.returncode == 3
-    assert (out / "why").read_text().startswith("missing:")
-    assert not estate.sqlite.exists()
-    assert estate.index("sync").returncode == 0
-    assert stat.S_IMODE(estate.sqlite.stat().st_mode) & 0o077 == 0
-    assert estate.index("sync", "--source", "ledger:Eagle").returncode == 2
-    assert estate.index("sync", "--source", "register:someone/else").returncode == 2
-    assert estate.index("bogus").returncode == 64
-
-
-# =================================== the inventory source (opensoft/openRepoTools#161)
-#
-# THIS WORKSTATION'S #97 WORKTREE INVENTORY, AS THE INDEX'S SECOND SOURCE. Each
-# lane's sidecars are written here by the REAL writers (`set-lane-state`,
-# `set-lane-tree`) over REAL worktrees of a repository whose origin is a bare
-# repository in `tmp_path`; the two managed lanes' sidecars are written by hand,
-# because every legacy writer refuses a managed lane — which is exactly how a
-# managed lane comes to have leftovers from before its enrolment.
-
-WT_COLS = ["workstation", "lane", "owner", "path", "branch", "base", "lifecycle", "generation",
-           "operation", "writer_live", "last_seen_utc", "last_commit", "dirty_count",
-           "unpushed_count", "pr_number", "pr_state"]
-
-
-#: `tree_id_for`'s shape: a `cksum` of the path, then the path folded.
-TREE_ID = re.compile(r"\bc[0-9]+-[A-Za-z0-9._-]+")
-
-
-class Inventory:
-    """An Estate with an inventory: repoA-1 RUNNING with one clean tree and one
-    dirty, unpushed one; repoA-2 SWAPPING with one tree and a LIVE session;
-    repoM-1 (a valid marker) and repoM-2 (a malformed one) each with a sidecar
-    left over from before enrolment."""
-
-    def __init__(self, root: Path):
-        self.e = Estate(root)
-        self.root = root
-        self.lsr = root / "lane-state"
-        self.e.env["LANES_LANE_STATE_ROOT"] = str(self.lsr)
-        self.repo = root / "repos" / "repoA"
-        self.origin = root / "repos" / "repoA.git"
-        self.trees = self.repo / ".claude" / "worktrees"
-        g = self._g
-        subprocess.run(["git", "init", "-q", "--bare", "-b", "main", str(self.origin)],
-                       check=True, env=self.e.env)
-        subprocess.run(["git", "clone", "-q", str(self.origin), str(self.repo)],
-                       check=True, env=self.e.env, capture_output=True)
-        (self.repo / "a.txt").write_text("seed\n")
-        g(self.repo, "add", "-A")
-        g(self.repo, "commit", "-q", "-m", "the lane's first commit")
-        g(self.repo, "push", "-q", "origin", "main")
-        self.trees.mkdir(parents=True)
-        self.run_tree = self.trees / "w-run"
-        g(self.repo, "worktree", "add", "-q", "-b", "feat/run", str(self.run_tree))
-        g(self.run_tree, "push", "-q", "-u", "origin", "feat/run")
-        self.dirty_tree = self.trees / "w-dirty"
-        g(self.repo, "worktree", "add", "-q", "-b", "feat/dirty", str(self.dirty_tree))
-        g(self.dirty_tree, "push", "-q", "-u", "origin", "feat/dirty")
-        (self.dirty_tree / "b.txt").write_text("committed, not pushed\n")
-        g(self.dirty_tree, "add", "b.txt")
-        g(self.dirty_tree, "commit", "-q", "-m", "work not yet pushed")
-        (self.dirty_tree / "c.txt").write_text("not even committed\n")
-        self.a2_tree = self.trees / "w-a2"
-        g(self.repo, "worktree", "add", "-q", "-b", "feat/a2", str(self.a2_tree))
-        self.ok("set-lane-state", "repoA-1", "RUNNING", "--operation", "op-test-a1")
-        self.ok("set-lane-tree", "repoA-1", str(self.run_tree), "--checkout", str(self.repo))
-        self.ok("set-lane-tree", "repoA-1", str(self.dirty_tree), "--checkout", str(self.repo))
-        self.ok("set-lane-state", "repoA-2", "RUNNING", "--operation", "op-test-a2")
-        self.ok("set-lane-state", "repoA-2", "SWAPPING", "--operation", "op-test-a2s")
-        self.ok("set-lane-tree", "repoA-2", str(self.a2_tree), "--checkout", str(self.repo),
-                "--generation", "2", "--operation", "op-test-a2s")
-        for lane, head in (("repoM-1", "1" * 40), ("repoM-2", "2" * 40)):
-            trees = self.lsr / lane / "trees"
-            trees.mkdir(parents=True)
-            (trees / f"c0-{lane}.yaml").write_text("\n".join([
-                "schema: 1", f"lane: {lane}", f"tree: c0-{lane}",
-                f"path: /nowhere/{lane}/w", "checkout: unknown", f"branch: feat/{lane}",
-                f"head: {head}", "upstream: none", "dirty: 0", "unpushed: 0",
-                "writer: none", "generation: 0", "operation: none",
-                "observed: 2026-10-04T00:00:00Z", ""]))
-        # repoA-2's session is LIVE on this workstation: the listing's own read.
-        self.sleeper = subprocess.Popen(["sleep", "600"])
-        sessions = self.e.home / ".claude" / "sessions"
-        sessions.mkdir(parents=True, exist_ok=True)
-        (sessions / "live.json").write_text(
-            '{"pid":%d,"sessionId":"%s","kind":"interactive","status":"busy"}\n'
-            % (self.sleeper.pid, UUID_A2))
-
-    def _g(self, cwd: Path, *args: str) -> str:
-        proc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True, text=True,
-                              env=self.e.env, check=False)
-        assert proc.returncode == 0, f"git {' '.join(args)}: {proc.stderr}"
-        return proc.stdout.strip()
-
-    def ok(self, *args: str) -> subprocess.CompletedProcess:
-        res = self.e.edit(*args)
-        assert res.returncode == 0, (args, res.stdout, res.stderr)
-        return res
-
-    def sync(self, *extra: str, env: dict | None = None) -> subprocess.CompletedProcess:
-        return self.e.index("sync", "--source", "inventory", *extra, env=env)
-
-    def rows(self) -> dict:
-        conn = sqlite3.connect(str(self.e.sqlite))
-        conn.row_factory = sqlite3.Row
-        out = {r["record_id"]: dict(r) for r in conn.execute(
-            "SELECT * FROM worktrees WHERE source = 'inventory:Eagle'")}
-        conn.close()
-        return out
-
-    def norm(self, text: str) -> str:
-        """An answer with what is the SANDBOX's taken out: its paths (as given
-        and resolved), a tree id - `c<cksum>-<the folded path>`, whose tail
-        alone survives a path longer than 180 bytes - and the live session's
-        pid."""
-        text = TREE_ID.sub("<TREE>", text)
-        text = text.replace(os.path.realpath(self.root), str(self.root))
-        text = re.sub(rf"\b{self.sleeper.pid}\b", "<PID>", text)
-        return normal(text, self.root)
-
-    def close(self) -> None:
-        self.sleeper.kill()
-        self.sleeper.wait()
-
-
-@pytest.fixture
-def inv(tmp_path):
-    made = Inventory(tmp_path / "i")
-    yield made
-    made.close()
-
-
-def test_the_inventory_source_mirrors_every_lanes_sidecars(inv):
-    """THE TABLE IS THE INVENTORY (#161): one row per tree each lane's sidecars
-    name, every column from the helper that wrote it - the owner from
-    `managed-projection`'s read, the lifecycle from the snapshot, the liveness
-    from the listing's own session read, the counts and the stamp from the
-    observation, the base and the last commit read of the RECORDED head - and
-    nothing of the register's touched."""
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    assert "inventory:Eagle (sqlite) - 5 upserted, 0 removed" in res.stdout, res.stdout
-    rows = inv.rows()
-    run = rows[f"repoA-1:{inv.run_tree}"]
-    dirty = rows[f"repoA-1:{inv.dirty_tree}"]
-    a2 = rows[f"repoA-2:{inv.a2_tree}"]
-    main = inv._g(inv.repo, "rev-parse", "origin/main")
-    assert (run["workstation"], run["owner"], run["branch"], run["lifecycle"]) == \
-        ("Eagle", "legacy", "feat/run", "RUNNING")
-    assert (run["dirty_count"], run["unpushed_count"], run["writer_live"]) == (0, 0, 0)
-    assert run["base"] == main
-    assert run["last_commit"] == f"{main} the lane's first commit"
-    assert (run["generation"], run["operation"], run["provenance"]) == (1, "op-test-a1", "0")
-    assert UTC.fullmatch(run["last_seen_utc"]), run["last_seen_utc"]
-    head = inv._g(inv.dirty_tree, "rev-parse", "HEAD")
-    assert (dirty["dirty_count"], dirty["unpushed_count"]) == (1, 1)
-    assert dirty["last_commit"] == f"{head} work not yet pushed"
-    assert dirty["base"] == main
-    assert (a2["lifecycle"], a2["generation"], a2["writer_live"], a2["provenance"]) == \
-        ("SWAPPING", 2, 1, "2")
-    assert (a2["pr_number"], a2["pr_state"]) == (None, None)
-    m1 = rows["repoM-1:/nowhere/repoM-1/w"]
-    m2 = rows["repoM-2:/nowhere/repoM-2/w"]
-    assert (m1["owner"], m1["lifecycle"]) == ("managed ledger-1", "INDETERMINATE")
-    assert (m2["owner"], m2["lifecycle"]) == ("unknown", "INDETERMINATE")
-    assert m1["last_commit"] == "1" * 40 and m1["base"] is None
-    conn = sqlite3.connect(str(inv.e.sqlite))
-    sources = [r[0] for r in conn.execute("SELECT source FROM provenance")]
-    assert sources == ["inventory:Eagle"], sources
-    for table in REGISTER_TABLES_FOR_TESTS:
-        assert conn.execute(f"SELECT COUNT(*) FROM {table}").fetchone()[0] == 0, table
-    prov = conn.execute("SELECT commit_sha, generation FROM provenance").fetchone()
-    assert re.fullmatch(r"[0-9a-f]{64}", prov[0]) and prov[1] == 1
-
-
-REGISTER_TABLES_FOR_TESTS = ("source_files", "lanes", "log_lines", "register_lines",
-                             "lane_aliases", "transcript_pointers")
-
-
-def test_an_inventory_replay_changes_nothing_and_one_write_moves_one_row(inv):
-    """REPLAY (14(d)): a second sync of an unchanged inventory writes not one
-    byte - `indexed_utc` included - and one `set-lane-tree` afterwards upserts
-    the one row it moved."""
-    assert inv.sync().returncode == 0
-    before = dump(inv.e.sqlite, with_utc=True)
-    time.sleep(1.1)
-    again = inv.sync()
-    assert again.returncode == 0, again.stderr
-    assert "nothing to write" in again.stdout, again.stdout
-    assert dump(inv.e.sqlite, with_utc=True) == before
-    (inv.run_tree / "new.txt").write_text("a fresh change\n")
-    inv.ok("set-lane-tree", "repoA-1", str(inv.run_tree), "--checkout", str(inv.repo))
-    third = inv.sync()
-    assert "1 upserted, 0 removed" in third.stdout, third.stdout
-    assert inv.rows()[f"repoA-1:{inv.run_tree}"]["dirty_count"] == 1
-
-
-def test_a_tree_the_inventory_no_longer_names_leaves_the_table(inv):
-    """ROWS LEAVE WITH THEIR RECORD (#161): a tree removed from the inventory -
-    at landing, or by a sweep's disposition - leaves the table in the next
-    sync, and nothing else moves."""
-    assert inv.sync().returncode == 0
-    sidecar = [f for f in (inv.lsr / "repoA-1" / "trees").iterdir()
-               if "w-dirty" in f.name]
-    assert len(sidecar) == 1
-    sidecar[0].unlink()
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    assert "0 upserted, 1 removed" in res.stdout, res.stdout
-    assert f"repoA-1:{inv.dirty_tree}" not in inv.rows()
-    assert f"repoA-1:{inv.run_tree}" in inv.rows()
-
-
-def test_a_wiped_inventory_reconciles_row_for_row(inv):
-    """WIPED-INDEX RECONCILE (14(d)): the rebuild equals a synced table, row for
-    row; and a row changed by hand in the store is found by what it SAYS and
-    put right."""
-    assert inv.sync().returncode == 0
-    synced = dump(inv.e.sqlite)
-    inv.e.sqlite.unlink()
-    dry = inv.e.index("reconcile", "--source", "inventory", "--dry-run")
-    assert dry.returncode == 0, dry.stderr
-    assert not inv.e.sqlite.exists(), "a dry run created the store"
-    res = inv.e.index("reconcile", "--source", "inventory")
-    assert res.returncode == 0, res.stderr
-    assert re.search(r"worktrees\s+0 kept\s+5 upserted", res.stdout), res.stdout
-    assert dump(inv.e.sqlite) == synced
-    conn = sqlite3.connect(str(inv.e.sqlite))
-    conn.execute("UPDATE worktrees SET dirty_count = 0, lifecycle = 'SWAPPED' "
-                 "WHERE path = ?", (str(inv.dirty_tree),))
-    conn.commit()
-    conn.close()
-    assert "nothing to write" in inv.sync().stdout
-    fixed = inv.e.index("reconcile", "--source", "inventory")
-    assert re.search(r"worktrees\s+4 kept\s+1 upserted", fixed.stdout), fixed.stdout
-    righted = dump(inv.e.sqlite)
-    assert righted["worktrees"] == synced["worktrees"]
-    # A FINGERPRINT CHANGED BY HAND, every row right, is put right by the next
-    # sync rather than left naming a table that is not there (Copilot round 1
-    # on #171).
-    conn = sqlite3.connect(str(inv.e.sqlite))
-    conn.execute("UPDATE provenance SET commit_sha = ? WHERE source = 'inventory:Eagle'", ("f" * 64,))
-    conn.commit()
-    conn.close()
-    healed = inv.sync()
-    assert healed.returncode == 0 and "0 upserted, 0 removed" in healed.stdout, healed.stdout
-    assert [r[:2] for r in dump(inv.e.sqlite)["provenance"]] == \
-        [r[:2] for r in synced["provenance"]]
-    # the same table, so the same fingerprint - and a sync count that went UP
-    assert [r[:2] for r in righted["provenance"]] == [r[:2] for r in synced["provenance"]]
-    assert righted["provenance"][0][2] == synced["provenance"][0][2] + 1
-
-
-def test_an_inventorys_provenance_only_moves_forward_per_lane(inv):
-    """MONOTONIC PROVENANCE (14(d)), PER LANE: a lane whose lifecycle snapshot
-    reads BELOW the generation its rows were written at - one moved aside and
-    begun again - is written nothing by `sync`, which says why; the other
-    lanes sync; and `reconcile` takes the lane as it now stands."""
-    assert inv.sync().returncode == 0
-    snap = inv.lsr / "repoA-2" / "lane-state.yaml"
-    snap.rename(snap.with_suffix(".aside"))
-    inv.ok("set-lane-state", "repoA-2", "RUNNING", "--operation", "op-test-again")
-    (inv.run_tree / "moved.txt").write_text("repoA-1 moves on\n")
-    inv.ok("set-lane-tree", "repoA-1", str(inv.run_tree), "--checkout", str(inv.repo))
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    assert "lane repoA-2: its rows are kept as they are" in res.stdout, res.stdout
-    assert "only moves forward" in res.stdout
-    assert "1 upserted, 0 removed" in res.stdout, res.stdout
-    rows = inv.rows()
-    assert rows[f"repoA-2:{inv.a2_tree}"]["generation"] == 2
-    assert rows[f"repoA-2:{inv.a2_tree}"]["lifecycle"] == "SWAPPING"
-    assert rows[f"repoA-1:{inv.run_tree}"]["dirty_count"] == 1
-    rec = inv.e.index("reconcile", "--source", "inventory")
-    assert rec.returncode == 0, rec.stderr
-    assert "generation went back from 2 to 1" in rec.stdout, rec.stdout
-    rows = inv.rows()
-    assert (rows[f"repoA-2:{inv.a2_tree}"]["generation"],
-            rows[f"repoA-2:{inv.a2_tree}"]["lifecycle"]) == (1, "RUNNING")
-
-
-def test_the_inventory_owner_column_is_the_seams_answer(inv):
-    """THE SEAM (14(e), ruling 2026-10-04): a valid marker's leftovers index as
-    `managed <owner>`, a malformed one's as `unknown` - never `legacy` - and a
-    plain row's as `legacy`; and only a legacy lane's lifecycle is pronounced,
-    the others' being `INDETERMINATE`, as `lane-reconcile` pronounces nothing
-    on them either. The indexer carries no parser of the marker."""
-    assert inv.sync().returncode == 0
-    owners = {(r["lane"], r["owner"], r["lifecycle"]) for r in inv.rows().values()}
-    assert ("repoM-1", "managed ledger-1", "INDETERMINATE") in owners
-    assert ("repoM-2", "unknown", "INDETERMINATE") in owners
-    assert ("repoA-1", "legacy", "RUNNING") in owners
-    assert ("repoA-2", "legacy", "SWAPPING") in owners
-    rec = inv.e.edit("lane-reconcile", "repoM-1")
-    assert "managed-owned" in rec.stdout
-    source = INDEXER.read_text(encoding="utf-8")
-    for vocabulary in ("mode=managed", "managed-owner", "bound-lane"):
-        assert vocabulary not in source
-
-
-def _wt(inv: Inventory, *args: str, env: dict | None = None) -> subprocess.CompletedProcess:
-    return inv.e.run("bash", LANES, "--worktrees", *args, env=env)
-
-
-def test_lanes_worktrees_shows_one_running_tree_and_one_dirty_one(inv):
-    """`lanes --worktrees <lane>` (#161): every open worktree of the lane with
-    its owner, branch, lifecycle, dirty and unpushed counts, when it was last
-    seen and whether the writer is live - and a footer that sends a person to
-    the act that reads the disk."""
-    res = _wt(inv, "repoA-1")
-    assert res.returncode == 0, res.stderr
-    lines = res.stdout.splitlines()
-    assert lines[0].split()[:6] == ["WORKSTATION", "LANE", "OWNER", "LIFECYCLE", "WRITER", "BRANCH"]
-    run = next(l for l in lines if l.endswith(str(inv.run_tree)))
-    dirty = next(l for l in lines if l.endswith(str(inv.dirty_tree)))
-    assert run.split()[:8] == ["Eagle", "repoA-1", "legacy", "RUNNING", "none", "feat/run", "0", "0"]
-    assert dirty.split()[:8] == ["Eagle", "repoA-1", "legacy", "RUNNING", "none", "feat/dirty", "1", "1"]
-    assert UTC.search(run)
-    assert "2 worktree(s) in 1 lane(s) on 1 workstation(s)" in res.stdout
-    assert "lanes-edit.sh lane-reconcile <lane>" in res.stdout
-    every = _wt(inv)
-    assert every.returncode == 0
-    assert "5 worktree(s) in 4 lane(s)" in every.stdout
-    live = next(l for l in every.stdout.splitlines() if l.endswith(str(inv.a2_tree)))
-    assert live.split()[3:5] == ["SWAPPING", "live"], live
-    none = _wt(inv, "repoB-1")
-    assert none.returncode == 8 and "no worktree is inventoried for lane repoB-1" in none.stdout
-    for bad in (("repoA-1", "--all"), ("repoA-1", "repoA-2"), ("--here",), ("--closed",)):
-        refused = _wt(inv, *bad)
-        assert refused.returncode == 64, (bad, refused.stderr)
-
-
-def test_the_index_read_of_the_worktrees_is_the_source_read(inv):
-    """`lanes --index --worktrees` ANSWERS WHAT THE SIDECARS ANSWER where the
-    table is current, byte for byte, and says so on stderr; a write the index
-    has not followed is the index's lag, said by the time it was synced."""
-    assert inv.sync().returncode == 0
-    for args in ((), ("repoA-1",), ("--all",)):
-        src = _wt(inv, *args)
-        idx = _wt(inv, *args, "--index")
-        assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), args
-        assert re.search(r"read: index \(sqlite\) at inventory:Eagle synced " + UTC.pattern,
-                         idx.stderr), idx.stderr
-        assert "read: " not in src.stderr
-        # THE FOOTER NAMES WHERE ITS ACT RUNS (opensoft/openRepoTools#173,
-        # Copilot's fourth review of #171): an index read lists other
-        # workstations' rows, and `lane-reconcile` reads only the disk and
-        # the sidecars of the workstation it runs on.
-        assert "lanes-edit.sh lane-reconcile <lane>, run ON THE WORKSTATION its rows name" \
-            in idx.stdout, idx.stdout
-    (inv.run_tree / "unseen.txt").write_text("the index has not followed this\n")
-    inv.ok("set-lane-tree", "repoA-1", str(inv.run_tree), "--checkout", str(inv.repo))
-    src = _wt(inv, "repoA-1")
-    idx = _wt(inv, "repoA-1", "--index")
-    assert src.stdout != idx.stdout
-
-
-@pytest.mark.parametrize("kind,setup", _fallback_setups(), ids=[k for k, _ in _fallback_setups()])
-def test_each_worktrees_index_failure_falls_back_to_the_sidecars(inv, kind, setup):
-    """FALLBACK (14(b)) for the table too: missing, unreachable, wiped (no
-    inventory source), of an unknown schema, refused, or switched off - each
-    says `read: sources (index <why>)` and returns the sidecars' own answer."""
-    env = setup(inv.e)
-    if kind == "wiped":
-        assert inv.sync().returncode == 0
-        conn = sqlite3.connect(str(inv.e.sqlite))
-        conn.execute("DELETE FROM provenance")
-        conn.commit()
-        conn.close()
-    for args in ((), ("repoA-1",)):
-        src = _wt(inv, *args, env=env)
-        idx = _wt(inv, *args, "--index", env=env)
-        assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), (kind, args)
-        assert f"read: sources (index {kind}" in idx.stderr, (kind, idx.stderr)
-
-
-#: THE INVENTORY'S ACTS AND THE READS THEY MAKE (#161): its two writers, which
-#: nudge the indexer, and the reads an act makes of the inventory for itself.
-INVENTORY_ACTS = [
-    ("set-lane-tree", "repoA-1", "<RUN>", "--checkout", "<REPO>"),
-    ("set-lane-state", "repoA-1", "SWAPPING", "--expect", "RUNNING", "--operation", "op-acts"),
-    ("lane-trees", "repoA-1"),
-    ("lane-state", "repoA-2"),
-    ("lane-reconcile", "repoA-1"),
-    ("lane-reconcile", "repoA-2"),
-    ("lane-reconcile", "repoM-1"),
-    ("lane-tree-now", "<DIRTY>"),
-]
-
-
-def _inv_act(inv: Inventory, act: tuple, extra: dict) -> tuple:
-    argv = [a.replace("<RUN>", str(inv.run_tree)).replace("<REPO>", str(inv.repo))
-             .replace("<DIRTY>", str(inv.dirty_tree)) for a in act]
-    res = inv.e.edit(*argv, env=extra)
-    # A LANE'S TREES ARE LISTED IN THE ORDER THEIR RECORDS' NAMES SORT, and a
-    # record's name begins with a `cksum` of its path - which differs between
-    # two sandboxes by construction. So the lines are compared as a set of
-    # lines, each of them whole.
-    out = "\n".join(sorted(inv.norm(res.stdout).split("\n")))
-    return (res.returncode, out, inv.norm(res.stderr))
-
-
-def test_offline_no_read_the_inventory_acts_are_byte_identical_against_an_unreachable_index(tmp_path):
-    """OFFLINE NO-READ (14(b), #161): with an indexer installed and configured
-    at a Postgres nobody can reach, the inventory writers and `lane-reconcile`
-    answer byte for byte as with no index at all - and the writers' nudges DID
-    reach for that store, `sync --source inventory`, after they had answered."""
-    control = Inventory(tmp_path / "control")
-    indexed = Inventory(tmp_path / "indexed")
-    try:
-        indexed.e.install_indexer()
-        fake = indexed.root / "pgfake"
-        fake.mkdir()
-        psql_log = indexed.root / "psql.log"
-        (fake / "psql").write_text(
-            f"#!/bin/sh\nprintf '%s\\n' \"$*\" >> {psql_log}\n"
-            "echo 'psql: error: connection to server at \"lanes-index.invalid\" failed' >&2\nexit 2\n")
-        (fake / "psql").chmod(0o755)
-        pw = indexed.e.config / "pgpass"
-        pw.write_text("*:*:*:*:never-read\n")
-        pw.chmod(0o600)
-        indexed.e.write_config(f"url=postgresql://lanes_writer@lanes-index.invalid/qa\npassfile={pw}\n")
-        extra = {"PATH": indexed.e.path_with(indexed.e.indexbin, fake), "LANES_INDEX": None}
-        for act in INVENTORY_ACTS:
-            a = _inv_act(control, act, {})
-            b = _inv_act(indexed, act, extra)
-            assert a == b, (act, a, b)
-        assert _wait_for(psql_log, 15.0), "no inventory nudge ever reached for the configured store"
-        assert "lanes_writer" in psql_log.read_text()
-    finally:
-        control.close()
-        indexed.close()
-
-
-def test_a_poisoned_worktrees_table_changes_no_inventory_acts_answer(tmp_path):
-    """POISONED INDEX (14(b), #161): wrong `worktrees` rows - a forged tree, a
-    forged lifecycle, forged counts and a forged owner - change no inventory
-    act's answer, `lane-reconcile` included; and the poison is REAL: `lanes
-    --index --worktrees` reads it."""
-    control = Inventory(tmp_path / "control")
-    poisoned = Inventory(tmp_path / "poisoned")
-    try:
-        assert poisoned.sync().returncode == 0
-        conn = sqlite3.connect(str(poisoned.e.sqlite))
-        conn.execute("UPDATE worktrees SET lifecycle = 'SWAPPED', dirty_count = 99, "
-                     "unpushed_count = 99, owner = 'managed evil', writer_live = 1")
-        conn.execute("INSERT INTO worktrees (source, record_id, workstation, lane, owner, path, "
-                     "branch, lifecycle, digest, provenance, indexed_utc, schema_version) VALUES "
-                     "('inventory:Eagle', 'repoA-1:/forged', 'Eagle', 'repoA-1', 'legacy', "
-                     "'/forged', 'feat/forged', 'RUNNING', 'x', '0', 'now', 1)")
-        conn.commit()
-        conn.close()
-        for act in INVENTORY_ACTS:
-            a = _inv_act(control, act, {})
-            b = _inv_act(poisoned, act, {"LANES_INDEX": None})
-            assert a == b, (act, a, b)
-        seen = _wt(poisoned, "--index", env={"LANES_INDEX": None})
-        assert "read: index (sqlite)" in seen.stderr
-        assert "/forged" in seen.stdout and "managed evil" in seen.stdout, \
-            "the poison never reached the index read: vacuous"
-    finally:
-        control.close()
-        poisoned.close()
-
-
-def test_an_inventory_write_nudges_and_a_read_never_does(inv):
-    """THE NUDGE (#161): `set-lane-tree` and `set-lane-state` start the same
-    detached `lanes-index sync` a landed push does, asked for the inventory -
-    stdin closed, never waited, the writer not delayed - while the reads an act
-    makes of the inventory start none, and `LANES_INDEX=off` stops it."""
-    stubdir = inv.root / "stub"
-    stubdir.mkdir()
-    (stubdir / "lanes-index").write_text(STUB)
-    (stubdir / "lanes-index").chmod(0o755)
-    mark = inv.root / "stubmark"
-    path = inv.e.path_with(stubdir)
-    pid_file = Path(str(mark) + ".pid")
-    for read in (("lane-trees", "repoA-1"), ("lane-reconcile", "repoA-1"), ("lane-state", "repoA-1"),
-                 ("worktrees", "--all")):
-        res = inv.e.edit(*read, env={"PATH": path, "LANES_INDEX": None,
-                                     "LANES_INDEX_STUB_MARK": str(mark)})
-        assert res.returncode == 0, (read, res.stderr)
-    assert not _wait_for(pid_file, 1.0), "a read nudged the indexer"
-    off = inv.e.edit("set-lane-tree", "repoA-1", str(inv.run_tree), "--checkout", str(inv.repo),
-                     env={"PATH": path, "LANES_INDEX": "off", "LANES_INDEX_STUB_MARK": str(mark)})
-    assert off.returncode == 0, off.stderr
-    assert not _wait_for(pid_file, 1.0), "LANES_INDEX=off still nudged"
-    for write in (("set-lane-tree", "repoA-1", str(inv.run_tree), "--checkout", str(inv.repo)),
-                  ("set-lane-state", "repoA-1", "SWAPPING", "--operation", "op-nudge")):
-        for leftover in stubdir.parent.glob("stubmark.*"):
-            leftover.unlink()
-        t0 = time.monotonic()
-        res = inv.e.edit(*write, env={"PATH": path, "LANES_INDEX": None,
-                                      "LANES_INDEX_STUB_MARK": str(mark)}, timeout=25)
-        took = time.monotonic() - t0
-        assert res.returncode == 0, (write, res.stderr)
-        assert _wait_for(pid_file, 10.0), f"{write[0]} never nudged the indexer"
-        pid = int(pid_file.read_text().strip())
-        try:
-            os.kill(pid, 0)
-            assert took < 20, f"{write[0]} waited on its nudge ({took:.1f}s)"
-            assert _wait_for(Path(str(mark) + ".argv"), 5.0)
-            assert Path(str(mark) + ".argv").read_text().strip() == "sync --source inventory"
-            assert _wait_for(Path(str(mark) + ".stdin"), 5.0)
-            assert Path(str(mark) + ".stdin").read_text().strip() == "eof"
-        finally:
-            try:
-                os.kill(pid, 15)
-            except OSError:
-                pass
-
-
-def test_a_pull_request_is_asked_of_gh_best_effort(inv):
-    """`pr` (#161): the newest pull request whose head is the tree's branch,
-    asked of `gh` at sync where GitHub may be asked - a fake `gh` here - and
-    NULL wherever it is not, or does not answer."""
-    inv._g(inv.repo, "remote", "set-url", "origin", "https://github.com/opensoft/repoA.git")
-    fake = inv.root / "ghfake"
-    fake.mkdir()
-    calls = inv.root / "gh.calls"
-    (fake / "gh").write_text(
-        f"#!/bin/sh\nprintf '%s\\n' \"$*\" >> {calls}\n"
-        "case \"$*\" in *feat/dirty*) echo '[{\"number\":42,\"state\":\"OPEN\"}]' ;; "
-        "*feat/run*) echo '[{\"number\":7,\"state\":\"MERGED\"}]' ;; *) echo '[]' ;; esac\n")
-    (fake / "gh").chmod(0o755)
-    env = {"PATH": inv.e.path_with(fake), "LANES_NO_GITHUB": None}
-    res = inv.sync(env=env)
-    assert res.returncode == 0, res.stderr
-    rows = inv.rows()
-    assert (rows[f"repoA-1:{inv.dirty_tree}"]["pr_number"],
-            rows[f"repoA-1:{inv.dirty_tree}"]["pr_state"]) == (42, "OPEN")
-    assert (rows[f"repoA-1:{inv.run_tree}"]["pr_number"],
-            rows[f"repoA-1:{inv.run_tree}"]["pr_state"]) == (7, "MERGED")
-    assert rows[f"repoA-2:{inv.a2_tree}"]["pr_number"] is None
-    assert "--repo opensoft/repoA --head feat/dirty" in calls.read_text()
-    # A MERGED answer is final and is not asked again; an OPEN one is.
-    calls.unlink()
-    assert inv.sync(env=env).returncode == 0
-    asked = calls.read_text()
-    assert "feat/dirty" in asked and "feat/run" not in asked, asked
-
-
-def test_status_names_the_inventory_and_a_mark_names_its_source(inv, monkeypatch):
-    """`status` prints this workstation's inventory beside the register; and a
-    register sync holding the lock when an inventory nudge arrives syncs the
-    INVENTORY before it lets go - the mark names its source."""
-    st = inv.e.index("status")
-    assert "source inventory:Eagle" in st.stdout
-    assert "--source inventory` builds it" in st.stdout
-    assert inv.sync().returncode == 0
-    st = inv.e.index("status")
-    assert re.search(r"provenance:  inventory@[0-9a-f]{12} \(sync 1,", st.stdout), st.stdout
-    assert "rows:        5 worktree(s)" in st.stdout
-    _as_estate(monkeypatch, inv.e)
-    mod = load_indexer()
-    runs = []
-    monkeypatch.setattr(mod, "run_index", lambda *a: runs.append(("register",) + a) or 0)
-    monkeypatch.setattr(mod, "run_inventory", lambda *a: runs.append(("inventory",) + a) or 0)
-    real_release = mod.SyncLock.release
-    released = []
-
-    def release_after_an_inventory_mark(self):
-        if not released and self.handle is not None:
-            self.mark_rerun("inventory")
-        released.append(1)
-        real_release(self)
-
-    monkeypatch.setattr(mod.SyncLock, "release", release_after_an_inventory_mark)
-    assert mod.cmd_sync(None) == 0
-    assert [r[0] for r in runs] == ["register", "inventory"], runs
-    lock = mod.SyncLock()
-    assert not lock.has_rerun()
-    # A FAILED SOURCE DOES NOT DROP A MARK ALREADY TAKEN (Copilot round 1 on
-    # #171): the register's round fails, the inventory's mark - taken off the
-    # disk in the same look - is still synced, and the exit is the failure.
-    runs.clear()
-    released.clear()
-    lock.mark_rerun("inventory")
-    monkeypatch.setattr(mod, "run_index", lambda *a: runs.append(("register",) + a) or 1)
-    monkeypatch.setattr(mod.SyncLock, "release", real_release)
-    assert mod.cmd_sync(None) == 1
-    assert [r[0] for r in runs] == ["register", "inventory"], runs
-    assert not lock.has_rerun()
-
-
-def test_the_inventory_source_is_this_workstations_alone(inv):
-    """Another workstation's inventory is on its own disk and is refused; and a
-    container with no LANES_WORKSTATION files nothing under its own id
-    (Amendment 11, R-A11-14)."""
-    other = inv.e.index("sync", "--source", "inventory:Raven")
-    assert other.returncode == 2 and "this workstation's inventory is inventory:Eagle" in other.stderr
-    assert not inv.e.sqlite.exists()
-    nameless = inv.e.index("sync", "--source", "inventory",
-                           env={"LANES_WORKSTATION": None, "LANES_IN_CONTAINER": "1"})
-    assert nameless.returncode == 2, (nameless.stdout, nameless.stderr)
-    assert "LANES_WORKSTATION" in nameless.stderr
-    assert not inv.e.sqlite.exists()
-    reg = inv.e.index("export", "--out", inv.root, "--source", "inventory")
-    assert reg.returncode == 2
-    both = inv.e.index("export", "--out", inv.root, "--worktrees", "--source", "inventory")
-    assert both.returncode == 64
-
-
-def test_a_source_is_refused_before_the_lock_is_asked_for(estate):
-    """REFUSED WITH THE LOCK HELD TOO (opensoft/openRepoTools#173, Copilot's
-    fourth review of #171): a sync that finds the lock held leaves a mark for
-    its source and exits 0, and the holder then syncs THIS workstation's
-    source for it. So another workstation's inventory, an inventory in a
-    container with no name, and another register are refused before the lock
-    is asked for - exit 2, and no mark."""
-    import fcntl
-    state = estate.state / "openRepoTools"
-    state.mkdir(parents=True, exist_ok=True)
-    with open(state / "lanes-index.lock", "a+") as handle:
-        fcntl.flock(handle.fileno(), fcntl.LOCK_EX)
-        other = estate.index("sync", "--source", "inventory:Raven")
-        nameless = estate.index("sync", "--source", "inventory",
-                                env={"LANES_WORKSTATION": None, "LANES_IN_CONTAINER": "1"})
-        register = estate.index("sync", "--source", "register:someone/else")
-        assert not list(state.glob("lanes-index.rerun*")), "a refused source left a mark"
-        own = estate.index("sync", "--source", "inventory")
-    assert other.returncode == 2, (other.stdout, other.stderr)
-    assert "this workstation's inventory is inventory:Eagle, not inventory:Raven" in other.stderr
-    assert nameless.returncode == 2 and "LANES_WORKSTATION" in nameless.stderr, nameless.stderr
-    assert register.returncode == 2, (register.stdout, register.stderr)
-    assert "not register:someone/else" in register.stderr
-    # NOT VACUOUS: this workstation's own source, the lock still held, marks
-    assert own.returncode == 0 and "another sync holds" in own.stdout, own.stdout
-    assert [p.name for p in state.glob("lanes-index.rerun*")] == ["lanes-index.rerun-inventory"]
-
-
-def test_a_damaged_table_under_valid_provenance_is_unusable_not_a_traceback(estate):
-    """`rows()` SPEAKS `StoreUnusable` (opensoft/openRepoTools#173, Copilot's
-    fourth review of #171): with the inventory's provenance valid and its
-    `worktrees` table gone, `status` says `rows: unread` rather than printing a
-    traceback, and `export --worktrees` leaves by the unusable path - `why`,
-    exit 3 - so the read flag says why it read the sources."""
-    assert estate.index("sync").returncode == 0
-    conn = sqlite3.connect(str(estate.sqlite))
-    conn.execute("INSERT INTO provenance (source, commit_sha, generation, indexed_utc, "
-                 "schema_version) VALUES ('inventory:Eagle', ?, 1, '2026-10-13T00:00:00Z', 1)",
-                 ("a" * 64,))
-    conn.execute("DROP TABLE worktrees")
-    conn.commit()
-    conn.close()
-    st = estate.index("status")
-    assert "Traceback" not in st.stderr, st.stderr
-    assert st.returncode == 1, (st.stdout, st.stderr)
-    assert re.search(r"rows: +unread - wiped: .*no such table: worktrees", st.stdout), st.stdout
-    out = estate.root / "exp"
-    out.mkdir()
-    exp = estate.index("export", "--out", out, "--worktrees")
-    assert "Traceback" not in exp.stderr, exp.stderr
-    assert exp.returncode == 3, (exp.returncode, exp.stderr)
-    assert (out / "why").read_text().startswith("wiped: ")
-    assert "no such table: worktrees" in (out / "why").read_text()
-    listed = estate.run("bash", LANES, "--worktrees", "--index")
-    assert "read: sources (index wiped: " in listed.stderr, listed.stderr
-
-
-def test_a_lane_bound_elsewhere_has_no_liveness_pronounced_here(inv):
-    """AMENDMENT 18(b) FOR `writer_live`: a lane whose last STARTED/RESUMED bound
-    it on another host cannot be pronounced not-live from here - its session
-    records are that host's - so the field is NULL, `unknown` in the listing,
-    and never the `0` that reads as *nobody is writing there*."""
-    log = inv.e.wip / "lanes" / "log" / "repoA-1.md"
-    log.write_text(log.read_text(encoding="utf-8") +
-                   f"RESUMED — lane repoA-1, session {UUID_A1B}@Raven, 2026-10-05T00:00:00Z, "
-                   f"lane:repoA-1 → host raven; container none; window rsess:1 @9; os macos\n",
-                   encoding="utf-8")
-    inv.e._git("add", "-A")
-    inv.e._git("commit", "-q", "-m", "repoA-1 is bound on Raven now")
-    inv.e._git("push", "-q", "origin", "main")
-    assert inv.sync().returncode == 0
-    rows = inv.rows()
-    assert rows[f"repoA-1:{inv.run_tree}"]["writer_live"] is None
-    assert rows[f"repoA-2:{inv.a2_tree}"]["writer_live"] == 1
-    listed = _wt(inv, "repoA-1")
-    run = next(l for l in listed.stdout.splitlines() if l.endswith(str(inv.run_tree)))
-    assert run.split()[4] == "unknown", run
-    # AND LOCALITY WINS OVER A LOCAL LIVE RECORD (Copilot round 1 on #171):
-    # repoA-2's session is still running HERE, under an id its row carries,
-    # and its latest binding is now on Raven - which is where its writer is
-    # pronounced on, not here.
-    log = inv.e.wip / "lanes" / "log" / "repoA-2.md"
-    log.write_text(log.read_text(encoding="utf-8") +
-                   f"RESUMED — lane repoA-2, session {UUID_A2}@Raven, 2026-10-05T00:00:00Z, "
-                   f"lane:repoA-2 → host raven; container none; window rsess:2 @9; os macos\n",
-                   encoding="utf-8")
-    inv.e._git("add", "-A")
-    inv.e._git("commit", "-q", "-m", "repoA-2 is bound on Raven too")
-    inv.e._git("push", "-q", "origin", "main")
-    assert inv.sync().returncode == 0
-    assert inv.rows()[f"repoA-2:{inv.a2_tree}"]["writer_live"] is None
-
-
-def test_an_inventory_that_cannot_be_read_keeps_its_rows(inv):
-    """A READ THAT DID NOT HAPPEN IS NOT AN EMPTY INVENTORY (Amendment 7(d);
-    Copilot round 2 on #171): a lane whose `trees` directory is there and
-    cannot be listed is `UNREAD` - named in the listing, and its rows KEPT by a
-    sync rather than removed as trees it no longer has."""
-    assert inv.sync().returncode == 0
-    trees = inv.lsr / "repoA-1" / "trees"
-    trees.chmod(0)
-    try:
-        if os.access(trees, os.R_OK):
-            pytest.skip("this account reads a mode-000 directory (root): nothing to prove here")
-        res = inv.sync()
-        assert res.returncode == 0, res.stderr
-        assert "lane repoA-1: its rows are kept as they are" in res.stdout, res.stdout
-        assert "0 removed" in res.stdout or "nothing to write" in res.stdout, res.stdout
-        assert f"repoA-1:{inv.dirty_tree}" in inv.rows()
-        listed = _wt(inv)
-        assert "inventory NOT READ" in listed.stdout, listed.stdout
-        assert "could not be read: that is NOT a lane with no worktrees" in listed.stdout
-        # AND THE INDEX SAYS THE ROWS ARE HELD (opensoft/openRepoTools#173): the
-        # two it kept are listed beside the NOT READ line the sidecars give,
-        # which says they are an earlier sync's - not rows freshly read.
-        idx = _wt(inv, "repoA-1", "--index")
-        assert idx.returncode == 0 and "read: index (sqlite)" in idx.stderr, idx.stderr
-        assert str(inv.run_tree) in idx.stdout and str(inv.dirty_tree) in idx.stdout, idx.stdout
-        assert re.search(r"inventory NOT READ: its trees directory \S+ is there and could not be "
-                         r"listed - the 2 row\(s\) listed for it are kept from the last sync that "
-                         r"read it", idx.stdout), idx.stdout
-    finally:
-        trees.chmod(0o755)
-    # READ AGAIN, THE MARK LEAVES: the index read is the source read once more.
-    healed = inv.sync()
-    assert healed.returncode == 0 and "0 upserted, 1 removed" in healed.stdout, healed.stdout
-    src, idx = _wt(inv, "repoA-1"), _wt(inv, "repoA-1", "--index")
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-    assert "NOT READ" not in idx.stdout
-
-
-def test_a_tree_with_no_path_is_a_tree_and_not_an_unread_marker(inv):
-    """A TREE'S PATH CAN BE EMPTY (the review of #219 at ab853b1): a
-    current-schema sidecar with a `tree:` and no `path:` is a `TREE` line
-    whose path is empty, and a marker read from the empty path alone exported
-    it as `UNREAD` and counted its lane as not read. The marker is a row with
-    no path AND the branch `unreadable inventory (...)`, which no git ref can
-    be; it has a key of its own, so holding the lane never writes it over such
-    a tree; and two trees of one lane with one path are two rows, as they are
-    two lines of the source read.
-
-    SINCE #115 (PR #252) A CURRENT-SCHEMA SIDECAR WITH NO `path:` IS NOT WHOLE:
-    `lanes-edit.sh worktrees` reads no field of it and lists its row under the
-    branch `malformed sidecar`, keeping the path it records and naming it by its
-    file where it records none. So the source no longer gives a tree an empty
-    path, and this test's branches are never read. The row is still a tree and
-    never the marker: counted, held over, and exported as its `TREE` line. Two
-    rows with one path now come from a record that is not whole but keeps a
-    path: `c2-samepath-y` lacks only its `upstream:` and records the path of
-    this lane's whole tree."""
-    trees = inv.lsr / "repoM-1" / "trees"
-    for tid, extra in (("c1-nopath-x", []),
-                       ("c2-samepath-y", ["path: /nowhere/repoM-1/w"])):
-        (trees / f"{tid}.yaml").write_text("\n".join([
-            "schema: 1", "lane: repoM-1", f"tree: {tid}", *extra, "checkout: unknown",
-            "branch: feat/" + tid[-1], "head: " + "3" * 40,
-            *([] if extra else ["upstream: none"]), "dirty: 0",
-            "unpushed: 0", "writer: none", "generation: 0", "operation: none",
-            "observed: 2026-10-04T00:00:00Z", ""]))
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    src, idx = _wt(inv, "repoM-1"), _wt(inv, "repoM-1", "--index")
-    assert "read: index (sqlite)" in idx.stderr, idx.stderr
-    assert "c1-nopath-x" in src.stdout, src.stdout
-    assert src.stdout.count("malformed sidecar") == 2, src.stdout
-    assert src.stdout.count("/nowhere/repoM-1/w") == 2, src.stdout
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-    assert "NOT READ" not in idx.stdout
-    st = inv.e.index("status")
-    assert "rows:        7 worktree(s)\n" in st.stdout, st.stdout
-    # HELD OVER, ALL THREE STAY, the two with no path among them.
-    trees.chmod(0)
-    try:
-        if os.access(trees, os.R_OK):
-            pytest.skip("this account reads a mode-000 directory (root): nothing to prove here")
-        assert inv.sync().returncode == 0
-        idx = _wt(inv, "repoM-1", "--index")
-        assert "c1-nopath-x" in idx.stdout, idx.stdout
-        assert idx.stdout.count("/nowhere/repoM-1/w") == 2, idx.stdout
-        assert "the 3 row(s) listed for it are kept from the last sync" in idx.stdout, idx.stdout
-    finally:
-        trees.chmod(0o755)
-    healed = inv.sync()
-    assert healed.returncode == 0 and "0 upserted, 1 removed" in healed.stdout, healed.stdout
-    src, idx = _wt(inv, "repoM-1"), _wt(inv, "repoM-1", "--index")
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-
-
-def test_a_tree_whose_branch_reads_like_a_marker_is_a_tree(inv):
-    """THE MARKER IS ITS KEY (the delta check of #219 at 5bf29d9): a hand-made
-    sidecar with no `path:` and a branch that begins `unreadable inventory (`
-    is a tree no git ref names, and still a tree - exported as its `TREE`
-    line and counted as a worktree - because a marker is the row keyed
-    `unread_key(<lane>)`, which no tree's key can be.
-
-    SINCE #115 (PR #252) a sidecar with no `path:` is not whole and its branch
-    is never read, so the forged branch is carried by a WHOLE record: a tree
-    with a path whose branch alone reads like the marker's."""
-    tid = "c3-forged-branch"
-    (inv.lsr / "repoM-1" / "trees" / f"{tid}.yaml").write_text("\n".join([
-        "schema: 1", "lane: repoM-1", f"tree: {tid}", "path: /nowhere/repoM-1/forged",
-        "checkout: unknown",
-        "branch: unreadable inventory (forged by hand)", "head: " + "4" * 40,
-        "upstream: none", "dirty: 0", "unpushed: 0", "writer: none", "generation: 0",
-        "operation: none", "observed: 2026-10-04T00:00:00Z", ""]))
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    src, idx = _wt(inv, "repoM-1"), _wt(inv, "repoM-1", "--index")
-    assert "read: index (sqlite)" in idx.stderr, idx.stderr
-    assert "unreadable inventory (forged by hand)" in src.stdout, src.stdout
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-    assert "NOT READ" not in idx.stdout
-    st = inv.e.index("status")
-    assert "rows:        6 worktree(s)\n" in st.stdout, st.stdout
-
-
-#: The field separator of `lanes-edit.sh worktrees`' lines.
-US = "\x1f"
-
-
-def test_an_older_helpers_tree_with_no_path_and_a_markers_branch_is_a_tree(inv):
-    """THE MARKER IS ITS KEY, FOR THE RIGHT REASON (#252's delta review 2, under
-    #173's unread marker). A helper older than #252 printed a current-schema
-    sidecar with no `path:` as a `TREE` line with an EMPTY path, and its branch
-    is the record's own word, so it can read exactly like a marker's. #219 at
-    5bf29d9 took a marker to be such a row - no path and a branch beginning
-    `unreadable inventory (` - and the delta check made the key the only rule.
-    Since #252 the helper here prints no such line, so nothing fed the reader
-    one and that rule would pass again. A wrapped `LANES_EDIT` stands in for the
-    older helper and prints one: it is a tree - exported as its own `TREE`
-    line, counted as a worktree, and kept as one of its lane's rows when the
-    lane is held - and never the lane's marker."""
-    forged = US.join([
-        "TREE", "Eagle", "repoM-1", "unknown", "", "unreadable inventory (forged by an older helper)",
-        "", "INDETERMINATE", "", "", "0", "2026-10-04T00:00:00Z", "8" * 40, "0", "0", "0"])
-    extra = inv.root / "older-helper-adds"
-    extra.write_text(forged + "\n")
-    wrapper = inv.root / "lanes-edit-older"
-    real = shlex.quote(str(LANES_EDIT))
-    # Its `worktrees` READ adds the line, sorted in as the helper sorts; an
-    # `--index` read and every other subcommand are the helper's own.
-    wrapper.write_text(textwrap.dedent(f"""\
-        #!/bin/sh
-        case " $* " in *" --index "*) exec bash {real} "$@" ;; esac
-        [ "${{1-}}" = worktrees ] || exec bash {real} "$@"
-        out="$(bash {real} "$@")"; rc=$?
-        case "$rc" in 0|8) : ;; *) exit "$rc" ;; esac
-        {{ [ -z "$out" ] || printf '%s\\n' "$out"; cat {shlex.quote(str(extra))}; }} | LC_ALL=C sort
-        """))
-    wrapper.chmod(0o755)
-    older = {"LANES_EDIT": str(wrapper)}
-    res = inv.sync(env=older)
-    assert res.returncode == 0, (res.stdout, res.stderr)
-    assert inv.rows()["repoM-1:"]["branch"] == "unreadable inventory (forged by an older helper)"
-    src, idx = _wt(inv, env=older), _wt(inv, "--index", env=older)
-    assert "read: index (sqlite)" in idx.stderr, idx.stderr
-    assert "unreadable inventory (forged by an older helper)" in src.stdout, src.stdout
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-    assert "NOT READ" not in idx.stdout
-    st = inv.e.index("status")
-    assert "rows:        6 worktree(s)\n" in st.stdout, st.stdout
-    # HELD OVER, IT IS ONE OF THE LANE'S KEPT ROWS: the older helper no longer
-    # names it, and the lane's `trees` directory cannot be listed.
-    extra.write_text("")
-    trees = inv.lsr / "repoM-1" / "trees"
-    trees.chmod(0)
-    try:
-        if os.access(trees, os.R_OK):
-            pytest.skip("this account reads a mode-000 directory (root): nothing to prove here")
-        held = inv.sync(env=older)
-        assert held.returncode == 0, (held.stdout, held.stderr)
-        assert "lane repoM-1: its rows are kept as they are" in held.stdout, held.stdout
-        assert "repoM-1:" in inv.rows(), sorted(inv.rows())
-        idx = _wt(inv, "repoM-1", "--index", env=older)
-        assert "the 2 row(s) listed for it are kept from the last sync" in idx.stdout, idx.stdout
-    finally:
-        trees.chmod(0o755)
-
-
-def test_an_inventory_sync_asks_for_the_workstation_once(estate):
-    """ONE `workstation` READ A SYNC (the review of #219 at ab853b1): the
-    refusal before the lock asks `lanes-edit.sh workstation`, and a sync that
-    then takes the lock asked a second time for the same answer. It is the
-    process's own and is asked once."""
-    calls = estate.root / "helper-calls"
-    wrapper = estate.root / "lanes-edit-counting"
-    wrapper.write_text(f"#!/bin/sh\nprintf '%s\\n' \"$1\" >> {calls}\n"
-                       f"exec bash {LANES_EDIT} \"$@\"\n")
-    wrapper.chmod(0o755)
-    res = estate.index("sync", "--source", "inventory", env={"LANES_EDIT": str(wrapper)})
-    assert res.returncode == 0, (res.stdout, res.stderr)
-    asked = calls.read_text().splitlines()
-    assert "worktrees" in asked, asked  # not vacuous: the sync took the lock and read
-    assert asked.count("workstation") == 1, asked
-
-
-def test_a_first_sync_that_cannot_read_a_lane_says_not_read_in_the_index(inv):
-    """A FIRST SYNC IS NOT AN EMPTY ANSWER (opensoft/openRepoTools#173): a lane
-    whose `trees` directory is there and cannot be listed at the FIRST sync has
-    no rows to keep, and the sync committed usable provenance with nothing for
-    it - so `lanes --index --worktrees <lane>` answered "no worktree is
-    inventoried" where the sidecars say NOT READ. The lane's marker row is
-    exported as the source's own `UNREAD` line, so the two reads are the same
-    bytes; and a replay of the same read writes nothing."""
-    trees = inv.lsr / "repoA-1" / "trees"
-    trees.chmod(0)
-    try:
-        if os.access(trees, os.R_OK):
-            pytest.skip("this account reads a mode-000 directory (root): nothing to prove here")
-        res = inv.sync()
-        assert res.returncode == 0, res.stderr
-        for args in (("repoA-1",), ()):
-            src = _wt(inv, *args)
-            idx = _wt(inv, *args, "--index")
-            assert "read: index (sqlite)" in idx.stderr, (args, idx.stderr)
-            assert "no worktree is inventoried" not in idx.stdout, (args, idx.stdout)
-            assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), (args, idx.stdout)
-            assert "inventory NOT READ" in idx.stdout, (args, idx.stdout)
-        st = inv.e.index("status")
-        assert "rows:        3 worktree(s), and 1 lane(s) whose inventory could not be read " \
-            "at the last sync" in st.stdout, st.stdout
-        again = inv.sync()
-        assert again.returncode == 0 and "nothing to write" in again.stdout, again.stdout
-    finally:
-        trees.chmod(0o755)
-
-
-def test_a_lane_that_went_back_with_no_trees_is_held_too(inv):
-    """THE FENCE FOR A LANE WHOSE ROWS WOULD ALL LEAVE (Copilot round 2 on
-    #171): its snapshot moved aside and begun again, and no tree recorded since
-    - a `sync` asks `lane-state` for its generation, finds it went back, and
-    keeps its rows; `reconcile` takes the lane as it now stands."""
-    assert inv.sync().returncode == 0
-    snap = inv.lsr / "repoA-2" / "lane-state.yaml"
-    snap.rename(snap.with_suffix(".aside"))
-    for sidecar in (inv.lsr / "repoA-2" / "trees").iterdir():
-        sidecar.unlink()
-    inv.ok("set-lane-state", "repoA-2", "RUNNING", "--operation", "op-test-empty")
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    assert "lane repoA-2: its rows are kept as they are" in res.stdout, res.stdout
-    assert f"repoA-2:{inv.a2_tree}" in inv.rows()
-    rec = inv.e.index("reconcile", "--source", "inventory")
-    assert rec.returncode == 0, rec.stderr
-    assert "generation went back from 2 to 1" in rec.stdout, rec.stdout
-    assert f"repoA-2:{inv.a2_tree}" not in inv.rows()
-
-
-@contextlib.contextmanager
-def _unreadable(e: Estate, *revs: str):
-    """THE PUBLISHED OBJECTS `revs` NAME, UNREADABLE FOR THE BLOCK: each one's
-    loose object in the workspace clone is moved aside, so a `git show` or a
-    `git ls-tree` that needs it fails - as on a clone whose object is damaged,
-    or a partial clone that cannot fetch it - while every other object reads;
-    and it is put back on the way out. The clone wrote these objects itself,
-    so they are loose and in no pack."""
-    moved = []
-    try:
-        for rev in revs:
-            sha = e._git("rev-parse", rev).strip()
-            obj = e.wip / ".git" / "objects" / sha[:2] / sha[2:]
-            assert obj.is_file(), f"{rev} ({sha}) is not a loose object of the clone"
-            aside = obj.with_name(obj.name + ".aside")
-            obj.rename(aside)
-            moved.append((obj, aside))
-        yield
-    finally:
-        for obj, aside in reversed(moved):
-            aside.rename(obj)
-
-
-def _git_shim(inv: Inventory, match: str, first: int,
-              last: int | None = None) -> tuple[dict, Path]:
-    """A `git` FOR ONE CALL'S ENVIRONMENT THAT FAILS SOME CALLS AND ONLY THOSE:
-    each call whose arguments contain `match` is counted and logged, the
-    `first`th to the `last`th of them (every later one where `last` is None)
-    exit 128 as git does on an object it could not read, and every call -
-    those among them - is otherwise the real git. A failure `_unreadable`
-    cannot make: one that comes and goes between two reads of the same object.
-    Returns the environment to run with and the log of the counted calls."""
-    real = shutil.which("git", path=inv.e.env["PATH"])
-    assert real, "no git on PATH"
-    shim = inv.root / "git-shim"
-    shim.mkdir(exist_ok=True)
-    (shim / "git").write_text(textwrap.dedent("""\
-        #!/bin/sh
-        case " $* " in
-          *"$SHIM_MATCH"*)
-            n=0
-            [ -f "$SHIM_LOG" ] && n=$(wc -l < "$SHIM_LOG" | tr -d ' ')
-            n=$((n + 1))
-            printf '%s %s\\n' "$n" "$*" >> "$SHIM_LOG"
-            if [ "$n" -ge "$SHIM_FIRST" ] && [ "$n" -le "$SHIM_LAST" ]; then
-              echo "fatal: the test's git shim fails call $n" >&2
-              exit 128
-            fi ;;
-        esac
-        exec @REAL@ "$@"
-        """).replace("@REAL@", shlex.quote(real)))
-    (shim / "git").chmod(0o755)
-    log = inv.root / "git-shim.log"
-    if log.exists():
-        log.unlink()
-    return {"PATH": inv.e.path_with(shim), "SHIM_MATCH": match, "SHIM_LOG": str(log),
-            "SHIM_FIRST": str(first), "SHIM_LAST": str(last or 999999)}, log
-
-
-def _shim_calls(log: Path) -> list[str]:
-    return log.read_text().splitlines() if log.exists() else []
-
-
-def _sidecar(lsr: Path, lane: str, head: str) -> Path:
-    """A whole current-schema record of one tree of `lane`, at
-    `/nowhere/<lane>/w`, under the control root `lsr` - the shape the
-    fixture's repoM records take."""
-    trees = lsr / lane / "trees"
-    trees.mkdir(parents=True, exist_ok=True)
-    path = trees / f"c0-{lane}.yaml"
-    path.write_text("\n".join([
-        "schema: 1", f"lane: {lane}", f"tree: c0-{lane}", f"path: /nowhere/{lane}/w",
-        "checkout: unknown", f"branch: feat/{lane}", f"head: {head}", "upstream: none",
-        "dirty: 0", "unpushed: 0", "writer: none", "generation: 0", "operation: none",
-        "observed: 2026-10-04T00:00:00Z", ""]))
-    return path
-
-
-#: THE READS A LANE LISTING RESTS ON (opensoft/openRepoTools#173 item c1), each
-#: made to fail, beside the lanes of the seed it is the ONE source of: repoZ-1's
-#: row is in the archive alone, repoC-1's in the register alone, and repoB-1 is
-#: a log with no row. The last case fails all three, which left the listing
-#: EMPTY - and the helper saying "none".
-PARTIAL_LISTINGS = [
-    ("archive", ("origin/main:lanes/archive/LANES-retired.md",), ("repoZ-1",),
-     ("the archive lanes/archive/LANES-retired.md could not be read",)),
-    ("register", ("origin/main:lanes/LANES.md",), ("repoC-1",),
-     ("the register lanes/LANES.md could not be read",)),
-    ("log-listing", ("origin/main:lanes/log",), ("repoB-1",),
-     ("the object logs under origin/main:lanes/log/ could not be listed",)),
-    ("all-three", ("origin/main:lanes/archive/LANES-retired.md", "origin/main:lanes/LANES.md",
-                   "origin/main:lanes/log"), ("repoZ-1", "repoC-1", "repoB-1"),
-     ("the register lanes/LANES.md could not be read",
-      "the archive lanes/archive/LANES-retired.md could not be read",
-      "the object logs under origin/main:lanes/log/ could not be listed")),
-]
-HEADS = {"repoZ-1": "5" * 40, "repoC-1": "6" * 40, "repoB-1": "7" * 40}
-
-
-@pytest.mark.parametrize("kind,revs,only,whys", PARTIAL_LISTINGS,
-                         ids=[case[0] for case in PARTIAL_LISTINGS])
-def test_a_lane_listing_that_is_not_whole_removes_no_row(inv, kind, revs, only, whys):
-    """A PARTIAL LANE LISTING IS NO ANSWER (opensoft/openRepoTools#173 item c1,
-    Copilot's fourth review of #171). The inventory is read through the lane
-    listing, whose lanes are the names the register's rows, the archive's rows
-    and the object logs give. Where one of those reads failed the listing said
-    so on stderr - the log listing not even that - and listed what the others
-    gave, and the sync took it for whole: a lane with a tree and its only row
-    in an archive that could not be read was a lane with no trees, and its rows
-    were removed. With all three unread the listing was empty, the helper said
-    "none", and the sync removed every row.
-
-    The read now says so in ONE `PARTIAL` line, `lanes --worktrees` prints it
-    as the lane listing NOT WHOLE, and a sync or a reconcile over it writes
-    NOTHING - not a lane it did list either - and says why, so the index stays
-    the last whole read. A lane asked for by name is read by its name, which no
-    listing gives, and is not partial. The next sync over a whole listing
-    writes what moved meanwhile."""
-    for lane in only:
-        _sidecar(inv.lsr, lane, HEADS[lane])
-    assert inv.sync().returncode == 0
-    for lane in only:
-        assert f"{lane}:/nowhere/{lane}/w" in inv.rows(), lane  # not vacuous
-    before = dump(inv.e.sqlite, with_utc=True)
-    # A LANE THE LISTING DOES NAME MOVES MEANWHILE.
-    moved = inv.lsr / "repoM-1" / "trees" / "c0-repoM-1.yaml"
-    moved.write_text(moved.read_text().replace("dirty: 0", "dirty: 4"))
-    with _unreadable(inv.e, *revs):
-        res = inv.sync()
-        rows = inv.rows()
-        for lane in only:
-            assert f"{lane}:/nowhere/{lane}/w" in rows, (lane, res.stdout, res.stderr)
-        assert dump(inv.e.sqlite, with_utc=True) == before, res.stdout
-        assert res.returncode == 1, (res.stdout, res.stderr)
-        assert "the lane listing `lanes-edit.sh worktrees --all` reads the inventory " \
-            f"through was not whole - {'; '.join(whys)} - so a lane it could not name " \
-            "would read as a lane with no worktrees" in res.stderr, res.stderr
-        assert "- nothing written" in res.stderr, res.stderr
-        assert "was not whole" in inv.e.index("status").stdout
-        rec = inv.e.index("reconcile", "--source", "inventory")
-        assert rec.returncode == 1 and "was not whole" in rec.stderr, (rec.stdout, rec.stderr)
-        assert dump(inv.e.sqlite, with_utc=True) == before, rec.stdout
-        # A DRY RUN IS REFUSED THE SAME WAY, rather than show as removals the
-        # rows of the lanes the read could not name (N4 of the review of #289).
-        dry = inv.e.index("reconcile", "--source", "inventory", "--dry-run")
-        assert dry.returncode == 1, (dry.stdout, dry.stderr)
-        assert f"was not whole - {'; '.join(whys)} - " in dry.stderr, dry.stderr
-        assert "removed" not in dry.stdout, dry.stdout
-        listed = _wt(inv)
-        assert listed.returncode == 0, listed.stderr
-        said = [line for line in listed.stdout.splitlines() if "lane listing NOT WHOLE: " in line]
-        assert len(said) == 1 and said[0].split()[:3] == ["Eagle", "(every", "lane)"], \
-            listed.stdout
-        assert said[0].split("lane listing NOT WHOLE: ", 1)[1] == "; ".join(whys), said[0]
-        assert "the lane listing above is NOT WHOLE: a lane it could not name is missing " \
-            "from it, and that is NOT a lane with no worktrees." in listed.stdout, listed.stdout
-        for lane in only:
-            assert f" {lane} " not in listed.stdout, listed.stdout
-        named = _wt(inv, "repoA-1")
-        assert named.returncode == 0, (named.stdout, named.stderr)
-        assert "2 worktree(s) in 1 lane(s)" in named.stdout, named.stdout
-        assert "NOT WHOLE" not in named.stdout, named.stdout
-    healed = inv.sync()
-    assert healed.returncode == 0, healed.stderr
-    assert "1 upserted, 0 removed" in healed.stdout, healed.stdout
-    assert inv.rows()["repoM-1:/nowhere/repoM-1/w"]["dirty_count"] == 4
-    src, idx = _wt(inv), _wt(inv, "--index")
-    assert (idx.returncode, idx.stdout) == (src.returncode, src.stdout), idx.stdout
-    assert "NOT WHOLE" not in src.stdout
-
-
-def _a_lane_found_through_its_log(inv: Inventory) -> tuple[dict, str]:
-    """repoB-1 RESUMED in a checkout of its own, whose `dir` only its log
-    records, with one tree under `<parent of that dir>/.lane-state` - synced
-    with no override naming a control root, so the tree is found through the
-    log's `dir` alone. Returns that environment and the tree's row key."""
-    away = inv.root / "elsewhere"
-    (away / "repoB").mkdir(parents=True)
-    log = inv.e.wip / "lanes" / "log" / "repoB-1.md"
-    log.write_text(log.read_text(encoding="utf-8") +
-                   f"RESUMED — lane repoB-1, session {UUID_B1}@Eagle, 2026-10-05T00:00:00Z, "
-                   f"lane:repoB-1 → dir {away / 'repoB'}; profile team-02a\n", encoding="utf-8")
-    inv.e._git("add", "-A")
-    inv.e._git("commit", "-q", "-m", "repoB-1 resumed in a checkout of its own")
-    inv.e._git("push", "-q", "origin", "main")
-    _sidecar(away / ".lane-state", "repoB-1", HEADS["repoB-1"])
-    by_dir = {"LANES_LANE_STATE_ROOT": None}
-    assert inv.sync(env=by_dir).returncode == 0
-    key = "repoB-1:/nowhere/repoB-1/w"
-    assert key in inv.rows(), sorted(inv.rows())  # found through its log's `dir` alone
-    return by_dir, key
-
-
-def test_a_lane_whose_log_could_not_be_read_keeps_its_rows(inv):
-    """A LOG THE LISTING COULD NOT READ IS NOT A LANE WITH NO TREES
-    (opensoft/openRepoTools#173 item c1). Where no override names a control
-    root, a lane's trees are under `<parent of its dir>/.lane-state/<lane>`, and
-    `dir` is its log's. A published log git could not read gave the listing no
-    `dir`, the root fell through to `$PROJECTS_ROOT/.lane-state/<lane>`, where
-    no tree is, and the sync removed the lane's rows. That log is a read the
-    listing rests on like the other three: the read is `PARTIAL`, naming it,
-    and nothing is written."""
-    by_dir, key = _a_lane_found_through_its_log(inv)
-    with _unreadable(inv.e, "origin/main:lanes/log/repoB-1.md"):
-        res = inv.sync(env=by_dir)
-        assert key in inv.rows(), (res.stdout, res.stderr)
-        assert res.returncode == 1, (res.stdout, res.stderr)
-        assert "was not whole - these object logs could not be read: lanes/log/repoB-1.md - " \
-            "so a lane it could not name" in res.stderr, res.stderr
-    healed = inv.sync(env=by_dir)
-    assert healed.returncode == 0 and "nothing to write" in healed.stdout, healed.stdout
-
-
-def test_a_listing_whose_log_warnings_could_not_be_kept_is_not_whole(inv):
-    """WHETHER A LOG FAILED IS A READ TOO (opensoft/openRepoTools#173 item c1).
-    The listing learns which published logs git could not read from the
-    warnings their read leaves in a temporary file. Where no temporary file can
-    be made those warnings go to stderr and nowhere else, so whether any log
-    failed is NOT KNOWN - the listing says so and classes no row DORMANT on it -
-    and the inventory's read says so too, in its `PARTIAL` line, rather than
-    answer as though every log had been read."""
-    res = inv.e.edit("worktrees", "--all", env={"TMPDIR": str(inv.root / "not-there")})
-    assert res.returncode == 0, res.stderr
-    partial = [line.split(US) for line in res.stdout.splitlines()
-               if line.startswith("PARTIAL" + US)]
-    assert partial == [["PARTIAL", "Eagle", "whether every object log could be read is not "
-                        "known, because the warnings of their read could not be kept"]], \
-        res.stdout
-    assert res.stdout.count("TREE" + US) == 5, res.stdout
-
-
-@pytest.mark.parametrize("mode", [0o000, 0o400], ids=["mode-000", "mode-400"])
-def test_an_unlistable_log_directory_with_no_origin_is_a_partial_listing(inv, mode):
-    """THE SAME READ WITH NO `origin` (opensoft/openRepoTools#173 item c1): under
-    `LANES_NO_GIT=1`, or in a checkout with no `origin/<branch>`, the lanes with
-    a log are named by listing this checkout's log directory - and one that is
-    there and cannot be listed named none of them. NOR CAN ONE THAT CANNOT BE
-    SEARCHED (N1 of the review of #289): `ls` lists an `r--` directory, and
-    then not one of its files could be opened."""
-    no_git = {"LANES_NO_GIT": "1"}
-    _sidecar(inv.lsr, "repoB-1", HEADS["repoB-1"])
-    assert inv.sync(env=no_git).returncode == 0
-    key = "repoB-1:/nowhere/repoB-1/w"
-    assert key in inv.rows(), sorted(inv.rows())
-    logdir = inv.e.wip / "lanes" / "log"
-    logdir.chmod(mode)
-    try:
-        if os.access(logdir, os.R_OK) and os.access(logdir, os.X_OK):
-            pytest.skip(f"this account lists and searches a mode-{mode:03o} directory (root): "
-                        f"nothing to prove here")
-        res = inv.sync(env=no_git)
-        assert key in inv.rows(), (res.stdout, res.stderr)
-        assert res.returncode == 1, (res.stdout, res.stderr)
-        assert "the log directory " in res.stderr, res.stderr
-        assert "lanes/log is there and could not be listed" in res.stderr, res.stderr
-    finally:
-        logdir.chmod(0o755)
-    healed = inv.sync(env=no_git)
-    assert healed.returncode == 0 and "nothing to write" in healed.stdout, healed.stdout
-
-
-#: The calls the listing's reads make, as the shim sees them (`" $* "`).
-SHOW_ARCHIVE = "show origin/main:lanes/archive/LANES-retired.md "
-SHOW_REGISTER = "show origin/main:lanes/LANES.md "
-LIST_LOGS = "ls-tree --name-only origin/main -- lanes/log/ "
-SHOW_LOG_B1 = "show origin/main:lanes/log/repoB-1.md "
-
-
-def test_the_listing_names_lanes_from_the_archive_it_checked(inv):
-    """THE ARCHIVE THE LISTING READS IS THE ONE IT CHECKED (the review of #289,
-    SHOULD-1(b), its probe P2). The read asked whether the archive could be
-    read and the listing then read it again, four times, for its rows: an
-    archive that read for the check and failed after it left out every lane
-    whose only row it holds, from a listing taken as whole, and the sync
-    removed their rows. The check's read is now the listing's: a failure after
-    it is never read at all."""
-    _sidecar(inv.lsr, "repoZ-1", HEADS["repoZ-1"])
-    assert inv.sync().returncode == 0
-    key = "repoZ-1:/nowhere/repoZ-1/w"
-    assert key in inv.rows(), sorted(inv.rows())
-    env, log = _git_shim(inv, SHOW_ARCHIVE, first=2)
-    res = inv.sync(env=env)
-    calls = _shim_calls(log)
-    assert calls and calls[0].startswith("1 "), calls  # the shim saw the read: not vacuous
-    assert key in inv.rows(), (res.stdout, res.stderr, calls)
-    assert res.returncode == 0 and "nothing to write" in res.stdout, (res.stdout, res.stderr)
-
-
-@pytest.mark.parametrize("last", [2, None], ids=["the-next-read", "every-later-read"])
-def test_a_log_list_that_fails_after_the_check_removes_no_row(inv, last):
-    """THE LIST OF THE LOGS, TOO (the review of #289, SHOULD-1, its probe P11).
-    It was listed for the check, again for the listing's names and again for
-    the events, out of which every lane's `dir` comes - and where no override
-    names a control root, a lane's trees are found under its `dir`. A later
-    list that failed was a listing with no lane named by a log alone, or with
-    no `dir` for any lane - the read even said "none" - and the sync removed
-    the rows. The names now come from the list the check made, and the
-    events' own list, where it fails, says so: the read is `PARTIAL` and
-    nothing is written."""
-    by_dir, key = _a_lane_found_through_its_log(inv)
-    before = dump(inv.e.sqlite, with_utc=True)
-    env, shim_log = _git_shim(inv, LIST_LOGS, first=2, last=last)
-    res = inv.sync(env={**by_dir, **env})
-    calls = _shim_calls(shim_log)
-    assert len(calls) >= 2 and calls[0].startswith("1 "), calls  # a later list failed
-    assert key in inv.rows(), (res.stdout, res.stderr, calls)
-    assert dump(inv.e.sqlite, with_utc=True) == before, res.stdout
-    assert res.returncode == 1, (res.stdout, res.stderr, calls)
-    assert "was not whole - the object logs under origin/main:lanes/log/ could not be " \
-        "listed - so a lane it could not name" in res.stderr, res.stderr
-    healed = inv.sync(env=by_dir)
-    assert healed.returncode == 0 and "nothing to write" in healed.stdout, healed.stdout
-
-
-def test_a_lanes_log_that_fails_after_the_listing_removes_no_row(inv):
-    """A LANE'S `dir` IS READ ONCE, BY THE LISTING (review r2 of #289,
-    SHOULD-A, its probe C1). Where no override names a control root, a lane's
-    trees are under the root its log's `dir` places, and the listing reads
-    that `dir` out of the events. The list of the lane's trees and its
-    lifecycle snapshot then worked the root out again, each reading the lane's
-    log a second time, and a `git show` that failed there was thrown away: the
-    root fell to `$PROJECTS_ROOT/.lane-state`, where nothing is, the lane read
-    as one with no trees, and the sync removed its rows. Both now take the
-    listing's `dir`, so the read that could fail is not made. The lane has a
-    snapshot here because, with none, a snapshot asked under the wrong root
-    answers what the right one would."""
-    by_dir, key = _a_lane_found_through_its_log(inv)
-    put = inv.e.edit("set-lane-state", "repoB-1", "RUNNING", "--operation", "op-test-b1",
-                     env=by_dir)
-    assert put.returncode == 0, put.stderr
-    assert inv.sync(env=by_dir).returncode == 0
-    assert inv.rows()[key]["lifecycle"] == "RUNNING", inv.rows()[key]  # read through `dir` too
-    before = dump(inv.e.sqlite, with_utc=True)
-    shim, log = _git_shim(inv, SHOW_LOG_B1, first=2, last=2)
-    res = inv.sync(env={**by_dir, **shim})
-    calls = _shim_calls(log)
-    assert calls and calls[0].startswith("1 "), calls  # the listing's own read: not vacuous
-    assert key in inv.rows(), (res.stdout, res.stderr, calls)
-    assert dump(inv.e.sqlite, with_utc=True) == before, (res.stdout, res.stderr, calls)
-    assert "kept as they are" not in res.stdout, (res.stdout, calls)  # and no lane held over it
-    if res.returncode == 1:  # refused over the read that failed, saying why
-        assert "was not whole - " in res.stderr, res.stderr
-    else:
-        assert res.returncode == 0 and "nothing to write" in res.stdout, (res.stdout, res.stderr)
-
-
-def test_the_listing_names_the_lane_whose_log_sorts_last(inv):
-    """THE LAST NAME IN THE LIST OF THE LOGS IS A LANE TOO (review r2 of #289,
-    NIT-2, its mutant mNoSentinel). The list the check made is handed to the
-    listing with its last newline kept, because `while read` drops a last line
-    that has none - and a lane whose log sorts last, with no row in the
-    register or the archive, would go unnamed from a listing taken as whole.
-    The seed's last log, repoM-2's, has a row; repoY-1 has a log alone."""
-    uid = "99999999-0001-4000-8000-000000009001"
-    inv.e.commit_paths({"lanes/log/repoY-1.md":
-                        f"STARTED — lane repoY-1, session {uid}@Eagle, 2026-10-04T00:00:00Z, "
-                        f"lane:repoY-1 → home opensoft/repoY; dir /work/repoY\n"},
-                       "repoY-1 has a log alone, and it sorts last")
-    names = inv.e._git("ls-tree", "--name-only", "origin/main", "--", "lanes/log/").split()
-    assert names[-1] == "lanes/log/repoY-1.md", names  # the LAST name: not vacuous
-    _sidecar(inv.lsr, "repoY-1", "8" * 40)
-    res = inv.sync()
-    assert res.returncode == 0, res.stderr
-    assert "repoY-1:/nowhere/repoY-1/w" in inv.rows(), (res.stdout, sorted(inv.rows()))
-
-
-def test_the_register_is_asked_before_the_listing(inv):
-    """THE REGISTER IS ASKED BEFORE THE LISTING READS IT (the review of #289,
-    SHOULD-2, its probe P3). A register read that succeeds is cached, and the
-    listing reads the cache; asked after the listing, the check would make a
-    read of its own - and a register that failed for the listing and read for
-    the check was a listing taken as whole without every lane whose only row
-    is the register's. Here the FIRST read fails and every later one reads:
-    that first read is the check's, so the read is `PARTIAL` - conservatively,
-    as the listing's own read would have been whole - and nothing is
-    written."""
-    _sidecar(inv.lsr, "repoC-1", HEADS["repoC-1"])
-    assert inv.sync().returncode == 0
-    key = "repoC-1:/nowhere/repoC-1/w"
-    assert key in inv.rows(), sorted(inv.rows())
-    before = dump(inv.e.sqlite, with_utc=True)
-    env, log = _git_shim(inv, SHOW_REGISTER, first=1, last=1)
-    res = inv.sync(env=env)
-    calls = _shim_calls(log)
-    assert len(calls) >= 2, calls  # the first read failed and a later one read
-    assert key in inv.rows(), (res.stdout, res.stderr, calls)
-    assert dump(inv.e.sqlite, with_utc=True) == before, res.stdout
-    assert res.returncode == 1, (res.stdout, res.stderr, calls)
-    assert "was not whole - the register lanes/LANES.md could not be read - so a lane it " \
-        "could not name" in res.stderr, res.stderr
-
-
-def test_the_index_read_says_its_last_sync_failed(inv):
-    """A SYNC THAT WROTE NOTHING IS SAID BY THE INDEX READ TOO (N2 of the
-    review of #289). A sync that refuses a listing that is not whole leaves the
-    table and its `synced` time as they were, and `lanes --index --worktrees`
-    said only that time: a table no later sync could write read as a current
-    one. The read's line now carries this workstation's last error beside its
-    source, as `status` does and under the name `status` gives it - a refused
-    `reconcile --dry-run` records one too (review r2's NIT-1) - until a sync
-    succeeds again."""
-    _sidecar(inv.lsr, "repoZ-1", HEADS["repoZ-1"])
-    assert inv.sync().returncode == 0
-    with _unreadable(inv.e, "origin/main:lanes/archive/LANES-retired.md"):
-        assert inv.sync().returncode == 1
-    idx = _wt(inv, "--all", "--index")
-    assert idx.returncode == 0, idx.stderr
-    assert re.search(r"read: index \(sqlite\) at inventory:Eagle synced " + UTC.pattern +
-                     r" \(last error: " + UTC.pattern + r" unread: the lane listing "
-                     r"`lanes-edit\.sh worktrees --all` reads the inventory through was not "
-                     r"whole - the archive lanes/archive/LANES-retired\.md could not be read - ",
-                     idx.stderr), idx.stderr
-    assert inv.sync().returncode == 0
-    again = _wt(inv, "--all", "--index")
-    assert re.search(r"read: index \(sqlite\) at inventory:Eagle synced " + UTC.pattern + r"\n",
-                     again.stderr), again.stderr
-    assert "(last error: " not in again.stderr, again.stderr
-
-
-def test_the_round_cap_hands_back_a_mark_it_took(estate, monkeypatch):
-    """THE CAP LOSES NO MARK (Copilot round 2 on #171): a holder that stops at
-    its eighth round with a source still due - its mark taken off the disk and
-    not yet synced - marks it again for the next sync."""
-    _as_estate(monkeypatch, estate)
-    mod = load_indexer()
-    lock = mod.SyncLock()
-    os.makedirs(mod.state_dir(), exist_ok=True)
-    runs = []
-
-    def busy(kind):
-        def run(*a):
-            runs.append(kind)
-            lock.mark_rerun(kind)  # every round, a write lands behind it
-            return 0
-        return run
-
-    monkeypatch.setattr(mod, "run_index", busy("register"))
-    monkeypatch.setattr(mod, "run_inventory", busy("inventory"))
-    lock.mark_rerun("inventory")
-    assert mod.cmd_sync(None) == 0
-    assert len(runs) == 8, runs
-    assert runs[-1] == "inventory", runs
-    assert os.path.exists(lock.rerun_path("register")), \
-        "the register's mark was taken at the cap and never handed back"
-    assert os.path.exists(lock.rerun_path("inventory"))
diff --git a/tests/test_lifecycle_fail_open_113_114_115.py b/tests/test_lifecycle_fail_open_113_114_115.py
deleted file mode 100644
index 268444b6..00000000
--- a/tests/test_lifecycle_fail_open_113_114_115.py
+++ /dev/null
@@ -1,474 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""opensoft/openRepoTools#113, #114 and #115: the crash-consistent lifecycle's
-remaining fail-open reads, `set-lane-tree`'s fence, and a sidecar's validation.
-Each case runs the real `lane-start` and `lanes-edit.sh` in the lane-start
-sandbox (a bare origin, a register clone, a fake tmux and a fake gh; nothing
-reaches the network). A read that FAILED is injected by a `git` on PATH that
-passes every call through to the real one except the one a case names.
-
-  * #113 item 1. `lane_reconcile`'s holder ids ended in `|| :`, so this
-    checkout's register copy that could not be read came out as an id set with
-    nothing of its own in it, and a crash was pronounced on liveness nobody
-    established. (The published half is caught one step earlier by the managed
-    seam, which already reads an empty register as unknown.)
-  * #113 item 2's remainder. An unreadable sidecar became a row of its own in
-    8.12, but `lane_reconcile` still swallowed `lane-trees`' 10 for a `trees`
-    directory that cannot be listed (#157 item 4e), so the whole inventory
-    vanished and the verdict could read `resumable`.
-  * #113 item 3. `git config --get branch.<b>.remote` was unguarded, so a read
-    that failed became the fabricated local upstream `./<merge>`.
-  * #113 item 4. `git worktree list --porcelain` was swallowed, so a checkout
-    whose registrations could not be read was one with none; a lane root that
-    cannot be listed was the same silence on disk.
-  * #114 item 1. `set-lane-tree`'s fence compared the generation and the
-    operation only, and `SWAPPED` keeps both, so a poll from a FINISHED
-    operation was filed over the inventory its commit point closed. (Item 2,
-    the partial observation, is refused with 64 since 8.12.)
-  * #115. A sidecar passed validation on its `schema:` line alone, so a
-    truncated `schema: 1` record was read as empty fields AND replaced.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, pytestmark  # noqa: F401
-
-US = "\x1f"
-
-#: A `git` that is the real one, except for the one call FAKE_GIT_FAIL names,
-#: which fails the way a read git cannot complete does. The suite's own `git`
-#: calls never set it.
-FAKE_GIT = """#!/usr/bin/env bash
-# FAKE_GIT_TRANSLATED: a git whose messages are translated, which only the C
-# locale turns back into git's English words.
-if [ -n "${FAKE_GIT_TRANSLATED:-}" ] && [ "${LC_ALL-}" != C ]; then
-  case " $* " in
-    *" rev-parse --git-dir "*)
-      err="$("%(real)s" "$@" 2>&1 >/dev/null </dev/null)" && exec "%(real)s" "$@"
-      case "$err" in
-        *"not a git repository"*)
-          printf 'fatal: kein Git-Repository (oder irgendeines der Elternverzeichnisse): .git\\n' >&2 ;;
-        *) printf '%%s\\n' "$err" >&2 ;;
-      esac
-      exit 128 ;;
-  esac
-fi
-if [ -n "${FAKE_GIT_FAIL:-}" ]; then
-  case " $* " in
-    *" $FAKE_GIT_FAIL "*)
-      printf 'fatal: injected failure of: git %s\\n' "$*" >&2
-      exit 128 ;;
-  esac
-fi
-exec "%(real)s" "$@"
-"""
-
-
-def make_box(tmp_path: Path, state_root: Path) -> Sandbox:
-    real_git = shutil.which("git")
-    assert real_git
-    box = Sandbox(tmp_path)
-    shim = box.fakebin / "git"
-    shim.write_text(FAKE_GIT.replace("%(real)s", real_git).replace("%%s", "%s"),
-                    encoding="utf-8")
-    shim.chmod(0o755)
-    box.env["LANES_LANE_STATE_ROOT"] = str(state_root)
-    box.resolver()
-    seeded = box.start("--no-launch")
-    assert seeded.returncode == 0, seeded.stderr
-    return box
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Sandbox:
-    return make_box(tmp_path, tmp_path / "state")
-
-
-def helper(box: Sandbox, *args: str, **env: str) -> subprocess.CompletedProcess:
-    full = dict(box.env, LANES_NO_FETCH="1")
-    full.update(env)
-    return subprocess.run([str(box.bin / "lanes-edit.sh"), *args],
-                          cwd=box.lane_dir, env=full, text=True,
-                          capture_output=True, timeout=120, check=False)
-
-
-def ok(box: Sandbox, *args: str, **env: str) -> str:
-    result = helper(box, *args, **env)
-    assert result.returncode == 0, (args, result.stdout, result.stderr)
-    return result.stdout
-
-
-def control_root(box: Sandbox) -> Path:
-    return Path(box.env["LANES_LANE_STATE_ROOT"]) / LANE
-
-
-def snapshot(box: Sandbox) -> Path:
-    return control_root(box) / "lane-state.yaml"
-
-
-def tabbed(out: str) -> dict:
-    return dict(line.split("\t", 1) for line in out.splitlines() if "\t" in line)
-
-
-def rows(out: str, tag: str) -> list:
-    return [line.split(US) for line in out.splitlines() if line.split(US)[0] == tag]
-
-
-def verdict(out: str) -> str:
-    found = rows(out, "VERDICT")
-    assert len(found) == 1, out
-    return found[0][1]
-
-
-def reconcile(box: Sandbox, **env: str) -> str:
-    return ok(box, "lane-reconcile", LANE, **env)
-
-
-def unprivileged() -> None:
-    if os.geteuid() == 0:
-        pytest.skip("a permission fixture needs an unprivileged runner")
-
-
-def swapped(box: Sandbox) -> tuple:
-    """Take the lane RUNNING -> SWAPPING -> SWAPPED as a handoff does, and
-    return the generation and operation the swap ran under."""
-    took = tabbed(ok(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING"))
-    gen, op = took["generation"], took["operation"]
-    ok(box, "set-lane-state", LANE, "SWAPPED", "--expect", "SWAPPING",
-       "--expect-generation", gen, "--expect-operation", op)
-    return gen, op
-
-
-def first_commit(box: Sandbox) -> None:
-    box.git("-C", str(box.lane_dir), "commit", "-q", "--allow-empty", "-m", "first")
-
-
-# --------------------------------------------------------------- #113 item 1
-
-def test_113_1_an_unreadable_register_copy_is_no_holder_nobody_established(box):
-    # A permission, and not a dangling link: the dispatcher refuses a register
-    # file that is not there ("registry not found") before any read is made.
-    unprivileged()
-    assert tabbed(ok(box, "lane-state", LANE))["state"] == "RUNNING"
-    before = reconcile(box)
-    assert rows(before, "HOLDER")[0][1] == "none", before
-    assert verdict(before) == "ungraceful-stop", before
-    register = box.wip / "lanes" / "LANES.md"
-    register.chmod(0)
-    try:
-        out = reconcile(box)
-    finally:
-        register.chmod(0o644)
-    holder = rows(out, "HOLDER")[0]
-    assert holder[1] == "unknown", out
-    assert "register row could not be read" in holder[2], out
-    assert verdict(out) == "indeterminate", out
-    assert "ungraceful-stop" not in out
-
-
-# ------------------------------------------------ #113 item 2 (the remainder)
-
-@pytest.mark.parametrize("mode", [0o000, 0o300, 0o600],
-                         ids=["no-access", "no-read", "no-search"])
-def test_113_2_an_inventory_nobody_could_list_is_never_a_clearance(box, mode):
-    unprivileged()
-    tree = str(box.lane_dir / ".claude" / "worktrees" / "gone")
-    ok(box, "set-lane-tree", LANE, tree, "--checkout", str(box.lane_dir),
-       "--branch", "feat/gone", "--head", "1" * 40, "--upstream", "none",
-       "--dirty", "2", "--unpushed", "1")
-    swapped(box)
-    trees = control_root(box) / "trees"
-    trees.chmod(mode)
-    try:
-        out = reconcile(box)
-    finally:
-        trees.chmod(0o700)
-    assert verdict(out) == "indeterminate", out
-    assert f"{trees} is there and could not be listed" in rows(out, "VERDICT")[0][2]
-    assert "resumable" not in rows(out, "VERDICT")[0][1]
-
-
-# --------------------------------------------------------------- #113 item 3
-
-def test_113_3_a_failed_remote_read_is_never_a_fabricated_local_upstream(box):
-    first_commit(box)
-    box.git("-C", str(box.lane_dir), "config", "branch.main.remote", "origin")
-    box.git("-C", str(box.lane_dir), "config", "branch.main.merge", "refs/heads/main")
-    fail = {"FAKE_GIT_FAIL": "config --get branch.main.remote"}
-    # The configured spelling, with no remote-tracking ref here, is an ANSWER.
-    now = ok(box, "lane-tree-now", str(box.lane_dir)).rstrip("\n").split(US)
-    assert (now[2], now[4]) == ("origin/main", "unknown"), now
-    # A remote read that FAILED is a 1 and prints nothing.
-    result = helper(box, "lane-tree-now", str(box.lane_dir), **fail)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert result.stdout == ""
-    assert "./main" not in result.stdout
-    # And nothing is filed for a tree this process could not read.
-    result = helper(box, "set-lane-tree", LANE, str(box.lane_dir), **fail)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert not (control_root(box) / "trees").exists() or \
-        not any((control_root(box) / "trees").iterdir())
-
-
-# --------------------------------------------------------------- #113 item 4
-
-def test_113_4_registrations_nobody_could_list_are_never_a_clearance(box):
-    first_commit(box)
-    stale = box.lane_dir / ".claude" / "worktrees" / "stale"
-    box.git("-C", str(box.lane_dir), "worktree", "add", "-q", "-b", "feat/stale", str(stale))
-    shutil.rmtree(stale)
-    swapped(box)
-    readable = reconcile(box)
-    assert [r[2] for r in rows(readable, "TREE")] == ["stale-registration"], readable
-    out = reconcile(box, FAKE_GIT_FAIL="worktree list --porcelain")
-    assert verdict(out) == "indeterminate", out
-    why = rows(out, "VERDICT")[0][2]
-    assert f"the worktree registrations of {box.lane_dir} could not be read" in why, why
-    assert "git worktree list exited 128" in why
-    # A recorded directory that is NO repository registers nothing, and that
-    # alone is an absence: the lane is resumable over it, as `lane-worktrees`
-    # reads it (#170 G5).
-    shutil.rmtree(box.lane_dir / ".git")
-    out = reconcile(box, FAKE_GIT_FAIL="worktree list --porcelain")
-    assert verdict(out) == "resumable", out
-
-
-def test_113_4_no_repository_is_read_in_the_c_locale(box):
-    """`lane_no_repository` matches git's English "not a git repository", so it
-    asks git in the C locale, as `lane-worktrees`' `git_env` does (review r1 of
-    #252). Under a translated git the words were never found, the absence read
-    as a failed read, and the two readers of one checkout disagreed."""
-    swapped(box)
-    shutil.rmtree(box.lane_dir / ".git")
-    out = reconcile(box, FAKE_GIT_FAIL="worktree list --porcelain",
-                    FAKE_GIT_TRANSLATED="1", LC_ALL="de_DE.UTF-8")
-    assert verdict(out) == "resumable", out
-    assert "could not be read" not in rows(out, "VERDICT")[0][2]
-
-
-@pytest.mark.parametrize("mode", [0o000, 0o300, 0o600],
-                         ids=["no-access", "no-read", "no-search"])
-def test_113_4_a_lane_root_nobody_could_list_is_never_a_clearance(box, mode):
-    unprivileged()
-    swapped(box)
-    # A checkout git registers nowhere, which only the on-disk sweep finds.
-    root = box.lane_dir / ".claude" / "worktrees"
-    box.git("init", "-q", "-b", "main", str(root / "hidden"))
-    readable = reconcile(box)
-    assert [(r[2], r[3]) for r in rows(readable, "TREE")] == \
-        [("unmanaged", str(root / "hidden"))], readable
-    root.chmod(mode)
-    try:
-        out = reconcile(box)
-    finally:
-        root.chmod(0o755)
-    assert verdict(out) == "indeterminate", out
-    assert f"the lane's worktree root {root} could not be listed" in rows(out, "VERDICT")[0][2]
-
-
-# --------------------------------------------------------------- #114 item 1
-
-@pytest.mark.parametrize("fence", ["generation-and-operation", "generation-only"])
-def test_114_1_a_poll_from_a_finished_operation_is_refused(box, fence):
-    took = tabbed(ok(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING"))
-    gen, op = took["generation"], took["operation"]
-    named = ["--generation", gen] + (["--operation", op] if fence != "generation-only" else [])
-    tree = str(box.lane_dir / ".claude" / "worktrees" / "w1")
-    observed = ["--checkout", str(box.lane_dir), "--branch", "feat/w1", "--head", "a" * 40,
-                "--upstream", "origin/feat/w1"]
-    # The operation in flight records its poll.
-    ok(box, "set-lane-tree", LANE, tree, *observed, "--dirty", "3", "--unpushed", "2", *named)
-    ok(box, "set-lane-state", LANE, "SWAPPED", "--expect", "SWAPPING",
-       "--expect-generation", gen, "--expect-operation", op)
-    sidecar = next((control_root(box) / "trees").iterdir())
-    finished = sidecar.read_bytes()
-    # A poll of the same operation, delayed past its own finalizer.
-    result = helper(box, "set-lane-tree", LANE, tree, *observed, "--dirty", "0",
-                    "--unpushed", "0", *named)
-    assert result.returncode == 7, (result.stdout, result.stderr)
-    assert "the lane is SWAPPED" in result.stderr
-    assert "superseded reading" in result.stderr
-    assert sidecar.read_bytes() == finished
-    # An observation filed under no transition is still the person's to make.
-    ok(box, "set-lane-tree", LANE, tree, *observed, "--dirty", "0", "--unpushed", "0")
-
-
-# ----------------------------- #114/#115: the shapes a record is read back in
-
-@pytest.mark.parametrize("flag,value", [("--dirty", "yes"), ("--dirty", "-1"),
-                                        ("--unpushed", "some"), ("--unpushed", "2x")])
-def test_114_115_a_count_that_is_not_one_is_refused_before_anything_is_written(box, flag, value):
-    counts = {"--dirty": "0", "--unpushed": "0", flag: value}
-    result = helper(box, "set-lane-tree", LANE, str(box.lane_dir / "w"),
-                    "--checkout", str(box.lane_dir), "--branch", "b", "--head", "h",
-                    "--upstream", "none", "--dirty", counts["--dirty"],
-                    "--unpushed", counts["--unpushed"])
-    assert result.returncode == 64, (result.stdout, result.stderr)
-    assert f"'{value}'" in result.stderr
-    assert helper(box, "lane-trees", LANE).returncode == 8
-
-
-@pytest.mark.parametrize("flag", ["--branch", "--head", "--upstream", "--checkout", "--writer"])
-def test_115_a_field_that_is_only_blanks_is_refused_before_anything_is_written(box, flag):
-    """A reader trims a value, so a blank one files a record with no such field
-    — refused only at the rename, after the lock, with exit 1. It is a usage
-    error and is said as one, 64, before anything is taken (review r1 of #252)."""
-    given = {"--checkout": str(box.lane_dir), "--branch": "b", "--head": "h",
-             "--upstream": "none", "--dirty": "0", "--unpushed": "0", "--writer": "none"}
-    given[flag] = "  "
-    result = helper(box, "set-lane-tree", LANE, str(box.lane_dir / "w"),
-                    *[x for pair in given.items() for x in pair])
-    assert result.returncode == 64, (result.stdout, result.stderr)
-    assert f"{flag} is only blanks" in result.stderr
-    assert helper(box, "lane-trees", LANE).returncode == 8
-    trees = control_root(box) / "trees"
-    assert not trees.exists() or not list(trees.iterdir())
-
-
-def test_115_a_control_root_under_a_directory_named_trees_keeps_its_snapshot(tmp_path):
-    """The validator tells a snapshot from a tree record by where it is filed,
-    and a `case` pattern's `*` matches `/`: `*/trees/*.yaml` matched a snapshot
-    under any directory named `trees`, so it was asked a tree's keys and refused
-    — `lane-start` wrote none, `set-lane-state` exited 1 and the reconciliation
-    said `no-state`, the answer a launcher goes past (review r1 of #252)."""
-    box = make_box(tmp_path, tmp_path / "trees" / "state")
-    assert snapshot(box).is_file(), "lane-start wrote no snapshot"
-    assert tabbed(ok(box, "lane-state", LANE))["state"] == "RUNNING"
-    took = tabbed(ok(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING"))
-    assert took["state"] == "SWAPPING", took
-    out = reconcile(box)
-    assert rows(out, "STATE")[0][1] == "SWAPPING", out
-    assert verdict(out) != "no-state", out
-
-
-# --------------------------------------------------------------------- #115
-
-WHOLE_SNAPSHOT = ("schema: 1\nlane: {lane}\nstate: SWAPPING\ngeneration: 4\n"
-                  "operation: op-x\nowner: none\nagent: claude\nprofile: none\n"
-                  "workstation: Eagle\nkind: clear\nupdated: 2026-10-18T00:00:00Z\n")
-
-SNAPSHOTS = {
-    "schema-only": "schema: 1\n",
-    "cut-after-state": "schema: 1\nlane: {lane}\nstate: SWAPPING\n",
-    "cut-mid-line": WHOLE_SNAPSHOT.split("generation: 4")[0] + "generation: ",
-    "no-updated": WHOLE_SNAPSHOT.rsplit("updated:", 1)[0],
-    "unknown-state-word": WHOLE_SNAPSHOT.replace("SWAPPING", "WONDERLAND"),
-    "generation-not-a-number": WHOLE_SNAPSHOT.replace("generation: 4", "generation: four"),
-}
-
-
-def plant_snapshot(box: Sandbox, body: str) -> bytes:
-    snapshot(box).write_text(body.replace("{lane}", LANE), encoding="utf-8")
-    return snapshot(box).read_bytes()
-
-
-@pytest.mark.parametrize("shape", sorted(SNAPSHOTS))
-def test_115_a_snapshot_that_is_not_whole_is_read_as_none_and_replaced_by_none(box, shape):
-    planted = plant_snapshot(box, SNAPSHOTS[shape])
-    # THE READERS: 10, never fields that came out empty.
-    result = helper(box, "lane-state", LANE)
-    assert result.returncode == 10, (shape, result.stdout, result.stderr)
-    assert result.stdout == ""
-    assert "nothing can be read out of it as a snapshot" in result.stderr
-    out = reconcile(box)
-    assert rows(out, "STATE")[0][1] == "MALFORMED", out
-    assert verdict(out) == "indeterminate", out
-    assert "#115" in rows(out, "VERDICT")[0][2]
-    # THE WRITERS: refused, exactly as an unknown schema is, byte for byte.
-    result = helper(box, "set-lane-state", LANE, "RUNNING")
-    assert result.returncode == 1, (shape, result.stdout, result.stderr)
-    assert "is not a record this helper can read" in result.stderr
-    result = helper(box, "set-lane-tree", LANE, str(box.lane_dir / "w"),
-                    "--checkout", str(box.lane_dir), "--branch", "b", "--head", "h",
-                    "--upstream", "none", "--dirty", "0", "--unpushed", "0",
-                    "--generation", "0")
-    assert result.returncode == 1, (shape, result.stdout, result.stderr)
-    assert snapshot(box).read_bytes() == planted
-
-
-def test_115_the_confirming_act_does_not_replace_a_snapshot_that_is_not_whole(box):
-    planted = plant_snapshot(box, SNAPSHOTS["cut-after-state"])
-    resumed = box.start("--no-launch")
-    assert resumed.returncode == 0, resumed.stderr
-    assert "is not a record this helper can read" in resumed.stderr
-    assert "it is not a whole record" in resumed.stderr
-    assert snapshot(box).read_bytes() == planted
-
-
-def plant_tree(box: Sandbox, how: str) -> tuple:
-    """Record a vanished tree that held work, then spoil its sidecar `how`."""
-    path = str(box.lane_dir / ".claude" / "worktrees" / "lost")
-    tid = ok(box, "set-lane-tree", LANE, path, "--checkout", str(box.lane_dir),
-             "--branch", "feat/lost", "--head", "b" * 40, "--upstream", "origin/feat/lost",
-             "--dirty", "4", "--unpushed", "2").strip()
-    sidecar = control_root(box) / "trees" / f"{tid}.yaml"
-    whole = sidecar.read_text(encoding="utf-8")
-    if how == "cut-after-path":
-        body = whole.split("checkout:")[0]
-    elif how == "schema-only":
-        body = "schema: 1\n"
-    elif how == "cut-mid-line":
-        body = whole.split("dirty: 4")[0] + "dirty: "
-    elif how == "claims-another-id":
-        body = whole.replace(f"tree: {tid}", "tree: c1-someone-else")
-    elif how == "dirty-not-a-count":
-        body = whole.replace("dirty: 4", "dirty: four")
-    elif how == "unpushed-not-a-count":
-        body = whole.replace("unpushed: 2", "unpushed: two")
-    elif how == "path-not-absolute":
-        body = whole.replace(f"path: {path}", "path: relative/lost")
-    else:
-        raise AssertionError(how)
-    sidecar.write_text(body, encoding="utf-8")
-    return path, tid, sidecar
-
-
-TREE_SHAPES = ["cut-after-path", "schema-only", "cut-mid-line", "claims-another-id",
-               "dirty-not-a-count", "unpushed-not-a-count", "path-not-absolute"]
-
-
-@pytest.mark.parametrize("how", TREE_SHAPES)
-def test_115_a_tree_record_that_is_not_whole_is_said_and_never_read(box, how):
-    path, tid, sidecar = plant_tree(box, how)
-    listed = [line.split(US) for line in ok(box, "lane-trees", LANE).splitlines()]
-    assert len(listed) == 1, listed
-    assert listed[0][0] == tid and listed[0][12] == "<malformed>", listed
-    assert listed[0][2:12] == [""] * 10, listed
-    out = reconcile(box)
-    trees = rows(out, "TREE")
-    assert [(t[1], t[2]) for t in trees] == [(tid, "malformed-sidecar")], out
-    assert f"{sidecar}" in trees[0][4]
-    # Never `missing`, the clean-and-published word, for a tree that held work.
-    assert "missing" not in [t[2] for t in trees]
-    assert rows(out, "TREES")[0][3] == "1 require recovery", out
-
-
-@pytest.mark.parametrize("how", TREE_SHAPES)
-def test_115_a_tree_record_that_is_not_whole_is_never_replaced(box, how):
-    path, tid, sidecar = plant_tree(box, how)
-    planted = sidecar.read_bytes()
-    result = helper(box, "set-lane-tree", LANE, path, "--checkout", str(box.lane_dir),
-                    "--branch", "feat/lost", "--head", "c" * 40, "--upstream", "none",
-                    "--dirty", "0", "--unpushed", "0")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "is not a record this helper can read" in result.stderr
-    assert sidecar.read_bytes() == planted
-
-
-def test_115_a_record_that_is_not_whole_is_never_renamed_into_place(box):
-    """`lane_sidecar_put` asks the temporary file the same question before the
-    rename. A blank value is the one a writer can be handed: the reader trims
-    it to nothing, so the record it would make is not whole."""
-    before = snapshot(box).read_bytes()
-    result = helper(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING",
-                    "--kind", "  ")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "it carries no kind" in result.stderr
-    assert snapshot(box).read_bytes() == before
-    assert not list(control_root(box).glob("*.tmp.*"))
diff --git a/tests/test_openrepotools_command.py b/tests/test_openrepotools_command.py
deleted file mode 100644
index fcdcbafa..00000000
--- a/tests/test_openrepotools_command.py
+++ /dev/null
@@ -1,2452 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`openRepoTools` — the installer, and the whole of what it does.
-
-OFFLINE, LIKE THE REST OF THIS SUITE. Run from a file, `--install` copies the
-bytes beside it and reaches nothing at all; the tests that exercise the
-FETCHING path put a fake `gh` first on `$PATH` — `fetch_from_repo` tries the
-API before the raw URL, so answering that one call is the whole of the server
-they need — and shadow `curl` with a script that refuses, so a run cannot fall
-through to the network even if the fake `gh` stops matching. `INSTALLED`
-below is what this suite answers for, because `--install` places every name
-in it, or none.
-
-What a fake `gh` cannot show is which way round the real two are tried, so THAT
-rule — the authenticated call first, because an organisation can block
-raw.githubusercontent.com and still have a working `gh` — stays asserted
-against the script's text, the way this suite guards other things it cannot
-run.
-
-ADAPTED FROM openRepoShape's `tests/test_openreposhape_command.py`, whose shim
-these install semantics are a deliberate copy of (openRepoShape #82, F10 of the
-review on its #83). Nothing about a scaffold comes over: this command has no
-verb, no `--doctor` and no `setup.sh`.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import os
-import re
-import shlex
-import shutil
-import signal
-import stat
-import subprocess
-import time
-
-from datetime import datetime
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, ROOTS, WINDOWS_SKIP
-
-COMMAND = REPO / "openRepoTools"
-
-#: EVERY FILE `--install` PLACES INTO THE BIN DIRECTORY. One install line for
-#: the whole toolset: a second engineer gets the estate verbs AND the lane
-#: helpers from the README's one line and nothing depends on anyone's dotfiles.
-#: `openRepoTools` is first because it is the one a person types to get the
-#: others; the last five came here from `opensoft/brett-wip` with their history
-#: under lane-collision-protocol Amendment 9(b), and `repos.tsv` is data placed
-#: at 755 with the commands because `--install` has one list, one destination
-#: and one mode.
-#:
-#: `lane` TAKES `restart`'s PLACE AND THE COUNT DOES NOT MOVE (Amendment 18
-#: Addendum 1, the word, and Addendum 2, the retirement — ratified
-#: 2026-09-14T14:05:54Z and 16:50:32Z). `lane <name>` is `restart <lane>`'s act
-#: — the launcher's path, the lane's own recorded directory and profile, asking
-#: nothing — plus the numbered pick, the attach and the handoff branch, so what
-#: a person is given is one word instead of two. `lane-handoff` joined beside it
-#: under Amendment 17(a), which made the list TWELVE; `lane-rename` joined it
-#: under Amendment 16 (ratified 2026-09-14T09:24:35Z), whose clause (h) is why
-#: it is a word rather than a `lanes` option — `lanes` writes nothing and a
-#: rename is four files in one commit — which made the list THIRTEEN.
-#: `claude-current` and `claude-restart-check` joined it for
-#: opensoft/workBenches#119 (Brett Heap's home ruling of 2026-09-29), at the END
-#: so every index taken below still names the file it did, which made the list
-#: FIFTEEN. `lanes-index` joined it for opensoft/openRepoTools#160
-#: (lane-collision-protocol Amendment 14, ratified 2026-10-05), at the END for
-#: the same reason, and it is the one command in the list that is Python rather
-#: than bash, which made the list SIXTEEN. `lane-worktrees` joined it for
-#: opensoft/openRepoTools#162 (Brett Heap's word of 2026-10-05, "build 162"),
-#: at the END for the same reason, and Python like `lanes-index`: the list is
-#: SEVENTEEN.
-INSTALLED = ("openRepoTools", "park", "resume", "status", "lane", "lanes",
-             "lane-handoff", "lane-rename", "lanes-edit.sh", "lane-start",
-             "lane-end", "link-estates", "repos.tsv", "claude-current",
-             "claude-restart-check", "lanes-index", "lane-worktrees")
-
-#: The skills `--install` also places, at two paths each, and the paths they are
-#: fetched from when there is no checkout to copy them out of (Amendment 9(b),
-#: inheriting A8 Addendum 2 R-A8-5; `restart` joins under Amendment 11 clause
-#: (f) and ratified decision 7; `handoff` under Amendment 17(a), which renames
-#: the act `lane-swap` performed and keeps `lane-swap` as an ALIAS FILE naming
-#: it — one skill is the source of the act and the aliases add nothing).
-SKILL_NAMES = ("handoff", "lane-swap", "restart")
-SKILL_PATHS = tuple(f"skills/{n}/SKILL.md" for n in SKILL_NAMES)
-SKILL_PATH = SKILL_PATHS[0]
-
-#: The COMMAND FILES `--install` also places, at the matching pair of paths
-#: (A11 Addendum 4 ruling 9, ratified "a11 addendum 4 yes"). `/swap` is clause
-#: (g)'s alias of `/lane-swap`; `opensoft/workBenches#74` deletes the launcher's
-#: copy, and adoption act 6 — which would have the launcher keep vendoring
-#: command files — lands after act 3, so without this it would be installed by
-#: nobody (F-X28). `/handoff` is the act's own word and `/ctx` is
-#: `/handoff --restart`, both under Amendment 17 (clauses (a) and (f)).
-COMMAND_NAMES = ("handoff", "ctx", "swap")
-COMMAND_PATHS = tuple(f"commands/{n}.md" for n in COMMAND_NAMES)
-
-#: Everything a stdin install has to fetch: the seventeen files, the three skills
-#: and the three command files.
-FETCHED = INSTALLED + SKILL_PATHS + COMMAND_PATHS
-
-#: THIRTY-ONE ARTIFACTS, AND THE COUNT IS THE INVARIANT: seventeen files in the
-#: bin directory, three skills in the shared skills directory, their three
-#: bare-run copies, three command files at that same pair of destinations, and
-#: TWO merged entries in `~/.claude/settings.json`. Derived from the three
-#: lists rather than restated, so adding a skill or a command moves it.
-#:
-#: THE `HOOK_ENTRIES` IS THE ONE TERM THAT IS NOT A LIST, and it moved from 1
-#: to 2 on 2026-09-14 for lane-collision-protocol Amendment 12 adoption act 3:
-#: the `UserPromptSubmit` NAME GUARD entry is placed beside the `SessionStart`
-#: one, in the same file, under the same all-or-nothing merge. There is no list
-#: of hook entries to derive it from — the two are different events with
-#: different shapes, one with a matcher and one without, and one carrying
-#: `|| true` where the other must not — so this is the number that is
-#: hand-kept, and the assertions below are what notice when it stops being true.
-#:
-#: AND SINCE opensoft/openRepoTools#237 THE TWO ARE CONDITIONAL: `--install`
-#: merges them only once `~/projects/xFactory/lanes-edit.sh` — the path both
-#: call — exists, is executable and answers `guard`, which is the
-#: `claude-profile` launcher's own rule. So the count is `ALWAYS` (twenty-nine)
-#: on every run, plus `HOOK_ENTRIES` once that path answers; a test that means
-#: the thirty-one links it first, with `link_xfactory` below.
-HOOK_ENTRIES = 2
-ALWAYS = len(INSTALLED) + 2 * len(SKILL_NAMES) + 2 * len(COMMAND_NAMES)
-ARTIFACTS = ALWAYS + HOOK_ENTRIES
-
-USAGE_LINES = (
-    "openRepoTools --install            install (or update) the seventeen estate and",
-    "openRepoTools wip init             create your workspace repository, clone it,",
-    "openRepoTools --help | --version",
-)
-
-#: The command is bash, and Windows has no shebang execution for the fake `gh`
-#: either. There is no Windows twin to run instead: on Windows the way in is
-#: WSL2, exactly as it is for openRepoShape's `setup.sh`.
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP]
-
-#: `--install` HARD-REQUIRES `jq` SINCE lane-collision-protocol AMENDMENT 9(b):
-#: two of its thirty-one artifacts are merged entries inside a JSON file somebody
-#: else owns, and the clause has it refuse naming `jq` rather than rewriting
-#: that file by hand. So a run of `--install` on a host without `jq` is a
-#: REFUSAL BY DESIGN, and a test that asserts a successful placement there is
-#: asserting against the contract. Marked rather than left to fail, because a
-#: red suite on a minimal image is how a fork stops being finished — the same
-#: reason `AGENTS.md` gives for the submodule SKIP.
-#:
-#: The tests NOT marked are the ones that never reach the merge: the refusals,
-#: `--help`, `--version`, and `test_install_places_all_or_none`, which is
-#: refused at `collect_commands` before `plan_hook_merge` is called at all.
-#: `test_without_jq_it_refuses_and_places_nothing` is the positive case for the
-#: same fact and is deliberately unmarked.
-NEEDS_JQ = pytest.mark.skipif(
-    shutil.which("jq") is None,
-    reason="`--install` merges two hook entries with jq (Amendment 9(b), Amendment 12 act 3)")
-
-
-#: A MODE-000 FILE IS ONLY UNREADABLE TO SOMEBODY WHO IS NOT ROOT. The same
-#: idiom `tests/test_install_skill_and_hook.py` carries for the destinations it
-#: makes unwritable: a root `--install` opens whatever it likes, so the cases
-#: that need a receipt it CANNOT open are skipped there, not made to pass.
-NOT_ROOT = pytest.mark.skipif(
-    hasattr(os, "geteuid") and os.geteuid() == 0,
-    reason="root can read a file whose mode says otherwise")
-
-
-def command_env(home: Path | None = None, env: dict | None = None) -> dict:
-    """The environment this suite controls, for a run of the command.
-
-    Every `$OPENREPOTOOLS_*` variable the command reads is cleared first, so a
-    developer's own shell cannot change what these tests assert.
-
-    AND SO ARE THE TWO THAT SAY WHERE `~/.claude` IS. Since Amendment 9(b),
-    `--install` writes a skill into `$CLAUDE_PROFILES_HOME/shared/skills/` and
-    merges a hook entry into `$CLAUDE_USER_DIR/settings.json` — real
-    directories on the machine running this suite. Redirecting `HOME` is what
-    keeps those writes inside `tmp_path`, and it only works while neither
-    variable is inherited from the developer's own shell. A suite that
-    installed a skill into a person's live profile set would be a suite nobody
-    could run twice.
-
-    AND `$XDG_DATA_HOME` IS CLEARED FOR THAT SAME REASON (#57). Since
-    `--install` writes its receipt to
-    `${OPENREPOTOOLS_DATA_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/openRepoTools}`,
-    a developer who exports `$XDG_DATA_HOME` — and on a Linux desktop that is
-    a normal thing to have exported — would have this suite writing into their
-    real data directory however carefully `$HOME` was redirected. Cleared, the
-    default applies, the default hangs off `$HOME`, and every byte lands in
-    `tmp_path`. `$OPENREPOTOOLS_DATA_DIR` is cleared with the rest of the
-    `$OPENREPOTOOLS_*` family, so a developer's own shell cannot move what
-    these tests assert about.
-    """
-    environ = dict(os.environ)
-    for name in ("OPENREPOTOOLS_REF", "OPENREPOTOOLS_REPO",
-                 "OPENREPOTOOLS_BIN_DIR", "OPENREPOTOOLS_DATA_DIR",
-                 "XDG_DATA_HOME", "CLAUDE_PROFILES_HOME",
-                 "CLAUDE_USER_DIR", "AGENT_PROTOCOL_ROOT", "PROJECTS_DIR"):
-        environ.pop(name, None)
-    if home is not None:
-        environ["HOME"] = str(home)
-        environ["CLAUDE_PROFILES_HOME"] = str(home / ".claude-profiles")
-        environ["CLAUDE_USER_DIR"] = str(home / ".claude")
-        environ["AGENT_PROTOCOL_ROOT"] = str(home / ".agents")
-    environ.update(env or {})
-    return environ
-
-
-def run_cmd(*args: str, home: Path | None = None,
-            env: dict | None = None,
-            cwd: Path | None = None) -> subprocess.CompletedProcess:
-    """The command, run from its file, with that environment.
-
-    `input=""` means stdin is a pipe rather than a terminal, which is what
-    every run in this file wants: nothing here may ask a question.
-
-    `cwd` is for the tests that name a RELATIVE path — a `$OPENREPOTOOLS_BIN_DIR`
-    spelled `bin` means a different directory from every working directory it
-    is run in, and that is exactly what they are about (#57, Copilot on #103).
-    """
-    return subprocess.run(["bash", str(COMMAND), *args], capture_output=True,
-                          text=True, check=False, input="",
-                          env=command_env(home, env), cwd=cwd)
-
-
-def link_xfactory(home: Path, target: Path | None = None) -> Path:
-    """`~/projects/xFactory/lanes-edit.sh` the way `link-estates` leaves it: a
-    symlink to the bin directory's `lanes-edit.sh` (#237).
-
-    The hook pair is merged only once that path answers `guard`, so a test
-    that asserts the pair is placed links it first. Made BEFORE the install it
-    is for, it dangles until that install's bin loop places the far end — which
-    is the order the gate asks in, after that loop. `target` names another far
-    end, for a test whose bin directory is not `~/.local/bin`.
-    """
-    link = home / "projects" / "xFactory" / "lanes-edit.sh"
-    link.parent.mkdir(parents=True, exist_ok=True)
-    link.symlink_to(target if target is not None
-                    else home / ".local" / "bin" / "lanes-edit.sh")
-    return link
-
-
-# --- what it says about itself ---------------------------------------------
-
-def test_help_prints_every_usage_line():
-    """Every line `--help` promises: a usage line nobody asserts on is a usage
-    line that can go stale without anything noticing."""
-    result = run_cmd("--help")
-    assert result.returncode == 0, result.stderr
-    lines = result.stdout.splitlines()
-    for line in USAGE_LINES:
-        assert line in lines, f"--help never printed:\n    {line}"
-
-
-def test_help_names_every_command_it_places_and_the_standards_front_door():
-    """`--install` places seventeen files, and sixteen of them are commands this one
-    knows nothing about — so `--help` has to say what they are and where the
-    rest is written down. A command a person has on PATH and cannot find
-    written down is a command they will not use.
-
-    It also has to say what this command is NOT: `openRepoShape` is the
-    standard's front door, and somebody who typed `openRepoTools Atlas`
-    expecting a scaffold needs that sentence rather than a usage dump. What it
-    no longer says is "and does nothing else" — Brett Heap ruled `wip init`
-    (Amendment 9, ruling 4), so that line, the `*)` arm and the test that
-    pinned them are what changed (R-A9-1).
-    """
-    result = run_cmd("--help")
-    assert result.returncode == 0, result.stderr
-    for line in ("park [<Name>]", "resume [<Name>]", "status [<Name>]",
-                 "lane-start <repo> <n>", "lane-end <lane>",
-                 "lanes-edit.sh <verb>", "link-estates", "repos.tsv",
-                 "claude-current [--porcelain]", "claude-restart-check",
-                 "lanes-index sync|reconcile|status",
-                 "lane-worktrees sweep <lane>"):
-        assert line in result.stdout, line
-    assert "`openRepoShape` is the standard's front door" in result.stdout
-    assert "this command scaffolds none" in result.stdout
-
-
-def test_help_documents_the_verb_pair_the_setup_step_probes_for():
-    """opensoft/workBenches#68's `setup-workspace-repo.sh` decides whether this
-    openRepoTools can create a workspace by grepping `--help` for the VERB
-    PAIR, never by running the verb and reading an exit code — because `die`'s
-    default exit is 2 and so is a genuine refusal's, and a probe that read the
-    code would report the administrator's `gh repo create` block as "no such
-    subcommand" and print a degradation recipe over the top of the one thing
-    the person needed (Amendment 9(c)).
-
-    This test IS that probe, byte for byte, so the contract cannot drift on
-    this side of the seam without a red test here.
-    """
-    result = run_cmd("--help")
-    assert result.returncode == 0, result.stderr
-    probe = re.compile(r"(^|\s)wip\s+init(\s|$)", re.MULTILINE)
-    assert probe.search(result.stdout), (
-        "workBenches' setup step greps --help for `wip init` and would report "
-        "this openRepoTools as having no workspace verb")
-
-
-def test_help_names_every_variable_it_reads():
-    """Every variable the script honours, named in the usage: one it reads and
-    the usage does not name is a variable nobody finds."""
-    result = run_cmd("--help")
-    for name in ("$OPENREPOTOOLS_REPO", "$OPENREPOTOOLS_REF",
-                 "$OPENREPOTOOLS_BIN_DIR", "$OPENREPOTOOLS_DATA_DIR",
-                 "$XDG_DATA_HOME", "$AGENT_PROTOCOL_ROOT",
-                 "$CLAUDE_PROFILES_HOME", "$PROJECTS_DIR"):
-        assert name in result.stdout, name
-
-
-def test_no_argument_at_all_prints_the_usage_and_exits_zero():
-    """A person who typed the name to see what it is has asked a question, not
-    made a mistake — so this is stdout and 0, not the refusal."""
-    result = run_cmd()
-    assert result.returncode == 0, result.stderr
-    assert USAGE_LINES[0] in result.stdout
-    assert "REFUSED" not in result.stderr
-
-
-def test_version_names_the_repository_and_the_ref():
-    """A checkout and the one-line install name the repository and the ref
-    they fetch from: the honest answer to `--version` there is WHICH BYTES it
-    will fetch. A package names its release instead, from its own stamp, and
-    no `OPENREPOTOOLS_PACKAGE_*` variable changes what a checkout prints."""
-    result = run_cmd("--version")
-    assert result.returncode == 0, result.stderr
-    assert result.stdout.strip() == "openRepoTools (opensoft/openRepoTools @ main)"
-
-
-def test_version_follows_the_ref_it_would_fetch():
-    result = run_cmd("--version", env={"OPENREPOTOOLS_REF": "v1.2.3"})
-    assert result.returncode == 0, result.stderr
-    assert "@ v1.2.3" in result.stdout
-
-
-def test_version_follows_the_repository_it_would_fetch():
-    """A fork or a mirror is named once and both fetch forms follow it, so
-    `--version` has to say which one answered."""
-    result = run_cmd("--version", env={"OPENREPOTOOLS_REPO": "someone/fork"})
-    assert result.returncode == 0, result.stderr
-    assert "openRepoTools (someone/fork @ main)" in result.stdout.strip()
-
-
-# --- the refusal ------------------------------------------------------------
-
-#: Everything a person might reasonably type at this command that it does not
-#: take: a verb (which is a separate file on their PATH), a project name (which
-#: is `openRepoShape`'s), a flag from either, and a second argument to
-#: `--install`.
-NOT_ITS_ARGUMENTS = ["park", "resume", "status", "Atlas", "--doctor", "--org",
-                     "--dry-run", "-x", "lane-start", "lanes-edit.sh"]
-
-
-@pytest.mark.parametrize("argument", NOT_ITS_ARGUMENTS)
-def test_anything_else_is_refused_and_names_the_verbs(argument):
-    """ONE VERB PAIR AND THREE FLAGS, and nothing else. The refusal names
-    `park --help` and `resume --help` rather than reprinting the usage:
-    somebody typing `openRepoTools park` wants `park`, and the shortest true
-    answer is where it is.
-
-    `--org` and `--dry-run` stay in this list although `wip init` takes both:
-    they are ITS options, reached through the verb, and at the top level they
-    are still not this command's arguments. So is a lane helper's own name —
-    `lane-start` is a command `--install` places, not a word this one answers
-    to.
-    """
-    result = run_cmd(argument)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "installs the estate commands and creates the workspace they read" \
-        in result.stderr
-    assert "--install," in result.stderr
-    assert "`wip init`" in result.stderr
-    assert "--help or --version" in result.stderr
-    assert "`park --help`" in result.stderr
-    assert "`resume --help`" in result.stderr
-    assert "`status --help`" in result.stderr
-
-
-def test_wip_alone_names_its_one_verb():
-    """`wip` is a noun and takes exactly one verb. The refusal prints the whole
-    line rather than a list, because there is only one thing to say."""
-    result = run_cmd("wip")
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "openRepoTools wip init" in result.stderr
-
-
-def test_wip_with_an_unknown_verb_is_refused():
-    result = run_cmd("wip", "destroy")
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "`wip destroy` is not a thing this command does" in result.stderr
-    assert "openRepoTools wip init" in result.stderr
-
-
-@pytest.mark.parametrize("flag", ["--nope", "--repo"])
-def test_wip_init_refuses_an_option_it_does_not_take(flag):
-    result = run_cmd("wip", "init", flag)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "--org, --login, --team and --dry-run" in result.stderr
-
-
-def test_install_refuses_a_second_argument_and_installs_nothing(tmp_path):
-    """`--install` takes no other arguments, and the refusal comes BEFORE
-    anything is placed: a run that half-understood its own command line must
-    not leave a file behind."""
-    bin_dir = tmp_path / "bin"
-    result = run_cmd("--install", "Atlas", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "creates the workspace they read" in result.stderr
-    assert not bin_dir.exists(), "the refusal placed a file anyway"
-
-
-# --- --install --------------------------------------------------------------
-
-@NEEDS_JQ
-def test_install_writes_an_executable_copy(tmp_path):
-    """Every `INSTALLED` file, each 755 and byte-identical to this checkout's.
-
-    A `park` that is not executable is not a command, and a `park` that is a
-    near-copy is a command whose refusals nobody reviewed — so the bytes are
-    compared rather than the presence of a file.
-    """
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    for name in INSTALLED:
-        target = tmp_path / ".local" / "bin" / name
-        assert target.is_file(), result.stdout + f" (missing {name})"
-        assert stat.S_IMODE(target.stat().st_mode) == 0o755, name
-        assert target.read_bytes() == (REPO / name).read_bytes(), name
-        assert f"{name}: installed at" in result.stdout
-    assert f"openRepoTools: {len(INSTALLED)} of {len(INSTALLED)} placed" \
-        in result.stdout, (
-        "a person reading eight lines cannot tell whether a ninth was meant "
-        "to be there; the count says so")
-
-
-@NEEDS_JQ
-def test_installing_twice_changes_nothing(tmp_path):
-    """Idempotent BY CONTENT, per file: the second run must not rewrite one
-    that already holds these bytes, and must say so rather than claim an
-    install."""
-    link_xfactory(tmp_path)
-    first = run_cmd("--install", home=tmp_path)
-    assert first.returncode == 0, first.stderr
-    second = run_cmd("--install", home=tmp_path)
-    assert second.returncode == 0, second.stderr
-    for name in INSTALLED:
-        assert f"{name}: already installed at" in second.stdout, name
-    # THIRTY-ONE, not seventeen: the six skill copies, the six command-file copies
-    # and BOTH hook entries each report `unchanged` too, and the count is the
-    # invariant Amendment 9(b) names — derived from the three lists, never
-    # restated, so a new skill or command moves it. It was eighteen until
-    # Amendment 12 adoption act 3 put the name guard beside the SessionStart
-    # entry, which is the `HOOK_ENTRIES` term above — and the two count only
-    # because `link_xfactory` gave them a target that answers `guard` (#237);
-    # without it the count is `ALWAYS` (`tests/test_install_hook_gate.py`).
-    assert second.stdout.count("unchanged") == ARTIFACTS
-
-
-@pytest.mark.parametrize("name", INSTALLED)
-@NEEDS_JQ
-def test_install_replaces_a_copy_that_has_drifted(tmp_path, name):
-    """Per file, and only the one that drifted: an install that rewrote all
-    seventeen every time would have nothing to say about which one was stale."""
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    target = tmp_path / ".local" / "bin" / name
-    target.write_text(target.read_text(encoding="utf-8") + "# drift\n",
-                      encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert f"{name}: updated at" in result.stdout
-    assert target.read_bytes() == (REPO / name).read_bytes()
-    for other in INSTALLED:
-        if other != name:
-            assert f"{other}: already installed at" in result.stdout, other
-
-
-# --- every placement is a RENAME, never a rewrite in place (#167) ----------
-#
-# `cp` onto an installed file keeps its inode and rewrites its bytes, and bash
-# reads a script from its file WHILE it runs it: after every command that forks
-# it seeks back to where it had got to and reads on from there. So a lane tool
-# that was running when an install replaced it went on reading the NEW text
-# from the OLD offset — measured on 2026-09-30 as `A.sh: line 4: ript,: command
-# not found`, then the new text's commands run from its middle. A rename puts a
-# new inode at the path and leaves the old one to whoever has it open.
-
-#: THE TEXT A LANE TOOL IS RUNNING WHEN THE INSTALL REPLACES IT. It announces
-#: itself, then waits — `sleep` forks, which is what makes bash seek back and
-#: read on from its file — until `$GO` exists, then finishes. Bounded, so a
-#: test that fails before it says go leaves no process behind for long.
-OLD_RUNNING = ("#!/usr/bin/env bash\n"
-               "printf 'old: started\\n'\n"
-               'i=0; until [ -e "$GO" ] || [ "$i" -ge 1200 ]; do '
-               'sleep 0.05; i=$((i + 1)); done\n')
-OLD_TAIL = "printf 'old: finished\\n'\nexit 0\n"
-
-
-def new_text_read_from(offset: int) -> str:
-    """NEW bytes with a line of their own starting at exactly `offset`.
-
-    That is the byte the running OLD text resumes reading at once its wait is
-    over. In place, the process reads THIS line instead of its own next one,
-    says so and exits 7. By rename it never sees these bytes at all. Built to
-    the offset rather than left to chance, so the failure a regression prints
-    is one line that says what happened.
-    """
-    head = "#!/usr/bin/env bash\n# "
-    assert offset > len(head), "the old text is shorter than the new header"
-    return (head + "x" * (offset - len(head) - 1) + "\n"
-            + "printf 'new: read from the old offset\\n'; exit 7\n")
-
-
-def source_tree(root: Path) -> Path:
-    """A copy of everything `--install` reads beside itself, for a test that
-    needs the NEW bytes to be its own. Run from a file, the command copies
-    what is beside it and fetches nothing, so the copy is complete or the run
-    would try the network, which this suite never reaches."""
-    src = root / "src"
-    for rel in ("openRepoTools",) + FETCHED:
-        (src / rel).parent.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(REPO / rel, src / rel)
-    return src
-
-
-def install_from(src: Path, home: Path) -> subprocess.CompletedProcess:
-    return subprocess.run(["bash", str(src / "openRepoTools"), "--install"],
-                          capture_output=True, text=True, check=False,
-                          input="", env=command_env(home))
-
-
-def placement_temporaries(home: Path) -> list[str]:
-    """Every `.<name>.openrepotools.*` left in a directory `--install` writes:
-    a temporary a placement made and never renamed or removed."""
-    dirs = [home / ".local" / "bin", home / ".claude",
-            home / ".claude" / "commands",
-            home / ".claude-profiles" / "shared" / "commands"]
-    for name in SKILL_NAMES:
-        dirs += [home / ".claude" / "skills" / name,
-                 home / ".claude-profiles" / "shared" / "skills" / name]
-    return sorted(str(p) for d in dirs if d.is_dir() for p in d.iterdir()
-                  if ".openrepotools." in p.name)
-
-
-def one_of_each_kind(home: Path) -> list[tuple[Path, Path, int]]:
-    """`(target, source, mode)` for a command, a skill and a command file, at
-    every destination each one has."""
-    skill, command = SKILL_NAMES[0], COMMAND_NAMES[0]
-    return [
-        (home / ".local" / "bin" / "lanes-edit.sh", REPO / "lanes-edit.sh",
-         0o755),
-        (home / ".claude-profiles" / "shared" / "skills" / skill / "SKILL.md",
-         REPO / SKILL_PATHS[0], 0o644),
-        (home / ".claude" / "skills" / skill / "SKILL.md",
-         REPO / SKILL_PATHS[0], 0o644),
-        (home / ".claude-profiles" / "shared" / "commands" / f"{command}.md",
-         REPO / COMMAND_PATHS[0], 0o644),
-        (home / ".claude" / "commands" / f"{command}.md",
-         REPO / COMMAND_PATHS[0], 0o644),
-    ]
-
-
-@NEEDS_JQ
-def test_a_running_lane_tool_finishes_on_its_own_text_when_an_install_replaces_it(
-        tmp_path):
-    """THE DEFECT ITSELF, END TO END (#167).
-
-    A lane tool is running from its installed path — `lanes-edit.sh` here,
-    the one whose register writes run longest — when `--install` replaces
-    it with newer bytes. The process must finish on the text it started with,
-    and the path must hold the new text afterwards. Written in place, the
-    process reads the new text from the old offset instead: it prints
-    `new: read from the old offset` and exits 7.
-    """
-    src = source_tree(tmp_path)
-    home = tmp_path / "home"
-    first = install_from(src, home)
-    assert first.returncode == 0, first.stdout + first.stderr
-    name = "lanes-edit.sh"
-    target = home / ".local" / "bin" / name
-    target.write_text(OLD_RUNNING + OLD_TAIL, encoding="utf-8")
-    new = new_text_read_from(len(OLD_RUNNING))
-    (src / name).write_text(new, encoding="utf-8")
-
-    go = tmp_path / "go"
-    running = subprocess.Popen(["bash", str(target)], stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE, text=True,
-                               env={**os.environ, "GO": str(go)})
-    try:
-        assert running.stdout.readline() == "old: started\n"
-        second = install_from(src, home)
-        assert second.returncode == 0, second.stdout + second.stderr
-        assert f"{name}: updated at {target}" in second.stdout, second.stdout
-        go.touch()
-        out, err = running.communicate(timeout=120)
-    finally:
-        if running.poll() is None:
-            running.kill()
-            running.communicate()
-    assert (out, err, running.returncode) == ("old: finished\n", "", 0), (
-        "the running copy did not finish on its own text — the install "
-        f"rewrote the file under it:\nstdout {out!r}\nstderr {err!r}\n"
-        f"exit {running.returncode}")
-    assert target.read_text(encoding="utf-8") == new
-    assert stat.S_IMODE(target.stat().st_mode) == 0o755
-    assert placement_temporaries(home) == []
-
-
-@NEEDS_JQ
-def test_every_placement_replaces_its_target_rather_than_rewriting_it(tmp_path):
-    """A NEW INODE AT EVERY PATH THAT CHANGED, AND THE OLD ONE LEFT WHOLE.
-
-    One of each kind `--install` writes — a command, a skill and a command
-    file — at every destination each one has. Each is drifted, and held OPEN
-    the way a running process holds its script, before the install that
-    repairs it. Afterwards the path holds the right bytes at the right mode
-    under a different inode, and the handle still reads the drifted bytes
-    whole. In place, the inode is the same one and the handle reads the new
-    bytes. A `SKILL.md` executes nothing, but one way to place a file is one
-    rule to read, and a session that opens it mid-install sees the old text or
-    the new, never a truncated one.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    held = []
-    try:
-        for target, source, mode in one_of_each_kind(tmp_path):
-            drifted = target.read_bytes() + b"# drift\n"
-            target.write_bytes(drifted)
-            handle = target.open("rb")
-            held.append((target, source, mode, drifted,
-                         os.fstat(handle.fileno()).st_ino, handle))
-        result = run_cmd("--install", home=tmp_path)
-        assert result.returncode == 0, result.stdout + result.stderr
-        for target, source, mode, drifted, inode, handle in held:
-            assert f"updated at {target}" in result.stdout, target
-            assert target.stat().st_ino != inode, (
-                f"{target} was rewritten in place: same inode {inode}")
-            assert handle.read() == drifted, (
-                f"a reader holding the old {target} saw the new bytes")
-            assert target.read_bytes() == source.read_bytes(), target
-            assert stat.S_IMODE(target.stat().st_mode) == mode, target
-    finally:
-        for *_, handle in held:
-            handle.close()
-    assert placement_temporaries(tmp_path) == []
-
-
-@NEEDS_JQ
-def test_an_install_that_changes_no_byte_renames_nothing(tmp_path):
-    """THE `cmp -s` SKIP STAYS (#167). A path whose bytes are already right
-    keeps its inode on a second run: renaming every file on every run would
-    turn an install that changed nothing into thirty-odd new inodes."""
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    targets = [tmp_path / ".local" / "bin" / n for n in INSTALLED]
-    targets += [t for t, _, _ in one_of_each_kind(tmp_path)]
-    before = {t: t.stat().st_ino for t in targets}
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert {t: t.stat().st_ino for t in targets} == before
-
-
-@pytest.mark.parametrize("tool, says", [
-    ("cp", "could not write"),
-    ("chmod", "could not set mode 755 on"),
-    ("mv", "could not move the new"),
-])
-@NEEDS_JQ
-def test_a_placement_that_fails_leaves_the_old_copy_and_no_temporary(
-        tmp_path, tool, says):
-    """EACH STEP OF THE RENAME CAN FAIL, AND NONE OF THEM COSTS THE OLD COPY.
-
-    A `cp` into the temporary, the mode stamp on it, or the `mv` over the
-    target is refused for ONE command by a fake first on `$PATH` that defers to
-    the real tool for everything else. The run refuses (2) naming the target,
-    the command already installed there keeps its bytes and its inode, no
-    temporary is left beside it, and the loop goes no further.
-    """
-    real = shutil.which(tool)
-    if real is None:
-        pytest.skip(f"no real `{tool}` on PATH for the fake to defer to")
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    bin_dir = tmp_path / ".local" / "bin"
-    name = INSTALLED[1]
-    target = bin_dir / name
-    old = target.read_bytes() + b"# an older copy\n"
-    target.write_bytes(old)
-    inode = target.stat().st_ino
-    shim = tmp_path / f"fake-{tool}"
-    shim.mkdir()
-    (shim / tool).write_text(
-        "#!/bin/sh\n"
-        'for arg in "$@"; do\n'
-        '\tcase "$arg" in\n'
-        f'\t"{bin_dir}/.{name}.openrepotools."*)\n'
-        f"\t\tprintf 'fake {tool}: refused\\n' >&2\n"
-        "\t\texit 1 ;;\n"
-        "\tesac\n"
-        "done\n"
-        f'exec {real} "$@"\n', encoding="utf-8")
-    (shim / tool).chmod(0o755)
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED:" in result.stderr, result.stderr
-    assert f"{says} {target}" in result.stderr, result.stderr
-    assert target.read_bytes() == old, "the old copy was not left as it was"
-    assert target.stat().st_ino == inode, "the old copy was replaced"
-    assert placement_temporaries(tmp_path) == []
-    assert f"{INSTALLED[2]}: " not in result.stdout, (
-        "the loop carried on past a placement it could not make")
-
-
-def fake_owner_ls(root: Path, target: Path, uid: int, gid: int) -> Path:
-    """A `ls` first on `$PATH` that says `target` belongs to `uid:gid`, and is
-    the real one for every other path. OWNERSHIP IS WHAT THIS STANDS IN FOR,
-    as the fake `chmod` above stands in for it: no fixture here can make a file
-    another account owns, and `owner_of` asks `ls -lnd` and nothing else."""
-    real = shutil.which("ls")
-    if real is None:
-        pytest.skip("no real `ls` on PATH for the fake to defer to")
-    shim = root / "fake-ls"
-    shim.mkdir()
-    (shim / "ls").write_text(
-        "#!/bin/sh\n"
-        'last=""\n'
-        'for arg in "$@"; do last="$arg"; done\n'
-        f'if [ "$last" = "{target}" ]; then\n'
-        f"\tprintf '%s\\n' '-rwxr-xr-x 1 {uid} {gid} 1 Jan  1 00:00 {target}'\n"
-        "\texit 0\n"
-        "fi\n"
-        f'exec {real} "$@"\n', encoding="utf-8")
-    (shim / "ls").chmod(0o755)
-    return shim
-
-
-@NEEDS_JQ
-def test_a_replaced_copy_is_handed_back_to_the_account_that_owned_it(tmp_path):
-    """THE OWNER STAYS WHO IT WAS (Copilot on #172).
-
-    A rename puts the temporary's inode at the path, and the temporary belongs
-    to whoever ran the install — so a root `--install` into another user's
-    home would leave that user root-owned copies their own next `--install`
-    refuses as unwritable. `cp` kept the owner by keeping the inode. So where
-    the owner differs, the temporary is given the target's uid AND gid before
-    the rename: the `chown` is asked for exactly once, on the temporary, with
-    the old owner. A fake records it, because only root could make it.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    bin_dir = tmp_path / ".local" / "bin"
-    name = INSTALLED[1]
-    target = bin_dir / name
-    target.write_bytes(target.read_bytes() + b"# drift\n")
-    uid, gid = os.getuid() + 4242, os.getgid() + 4243
-    ls_shim = fake_owner_ls(tmp_path, target, uid, gid)
-    log = tmp_path / "chown.log"
-    chown_shim = tmp_path / "fake-chown"
-    chown_shim.mkdir()
-    (chown_shim / "chown").write_text(
-        "#!/bin/sh\n"
-        f"printf '%s\\n' \"$*\" >> '{log}'\n"
-        "exit 0\n", encoding="utf-8")
-    (chown_shim / "chown").chmod(0o755)
-
-    result = run_cmd("--install", home=tmp_path, env={
-        "PATH": os.pathsep.join([str(ls_shim), str(chown_shim),
-                                 os.environ["PATH"]])})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"{name}: updated at {target}" in result.stdout, result.stdout
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 1, calls
-    assert re.fullmatch(
-        rf"-- {uid}:{gid} {re.escape(str(bin_dir))}/\.{re.escape(name)}"
-        r"\.openrepotools\.\S+", calls[0]), calls
-    assert target.read_bytes() == (REPO / name).read_bytes()
-    assert placement_temporaries(tmp_path) == []
-
-
-@NOT_ROOT
-@NEEDS_JQ
-def test_a_copy_another_account_owns_is_refused_and_left_as_it_was(tmp_path):
-    """AND WHERE THE OWNER CANNOT BE KEPT, NOTHING IS TAKEN OVER (Copilot on
-    #172). An account that is not root may not give a file away, so the real
-    `chown` refuses, and a rename would leave the other account's file this
-    account's. The run refuses (2) naming the owner, the old copy keeps its
-    bytes and its inode, and no temporary is left beside it.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    bin_dir = tmp_path / ".local" / "bin"
-    name = INSTALLED[1]
-    target = bin_dir / name
-    old = target.read_bytes() + b"# another account's copy\n"
-    target.write_bytes(old)
-    inode = target.stat().st_ino
-    uid = os.getuid() + 4242
-    ls_shim = fake_owner_ls(tmp_path, target, uid, os.getgid() + 4243)
-
-    result = run_cmd("--install", home=tmp_path, env={
-        "PATH": f"{ls_shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED:" in result.stderr, result.stderr
-    assert f"{target} belongs to uid {uid}" in result.stderr, result.stderr
-    assert target.read_bytes() == old
-    assert target.stat().st_ino == inode
-    assert placement_temporaries(tmp_path) == []
-    assert f"{INSTALLED[2]}: " not in result.stdout, (
-        "the loop carried on past a placement it refused")
-
-
-@NEEDS_JQ
-def test_a_copy_whose_owner_cannot_be_read_is_refused_and_left_as_it_was(
-        tmp_path):
-    """AN OWNER NOBODY COULD READ IS NOT "NOTHING TO KEEP" (Copilot on #172 at
-    bef4b85). `owner_of` answers nothing where `ls` cannot say, and an empty
-    answer is what an ABSENT target gives — so a target that EXISTS and whose
-    owner could not be read was renamed over with this run's own temporary, and
-    a root `--install` took the file over after all. A `ls` first on `$PATH`
-    that fails for that one path stands in for the unreadable owner: the run
-    refuses (2) naming the target, the old copy keeps its bytes and its inode,
-    and no temporary is left beside it.
-    """
-    real = shutil.which("ls")
-    if real is None:
-        pytest.skip("no real `ls` on PATH for the fake to defer to")
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    bin_dir = tmp_path / ".local" / "bin"
-    name = INSTALLED[1]
-    target = bin_dir / name
-    old = target.read_bytes() + b"# a copy whose owner cannot be read\n"
-    target.write_bytes(old)
-    inode = target.stat().st_ino
-    shim = tmp_path / "failing-ls"
-    shim.mkdir()
-    (shim / "ls").write_text(
-        "#!/bin/sh\n"
-        'last=""\n'
-        'for arg in "$@"; do last="$arg"; done\n'
-        f'if [ "$last" = "{target}" ]; then\n'
-        "\tprintf 'ls: cannot read %s\\n' \"$last\" >&2\n"
-        "\texit 2\n"
-        "fi\n"
-        f'exec {real} "$@"\n', encoding="utf-8")
-    (shim / "ls").chmod(0o755)
-
-    result = run_cmd("--install", home=tmp_path, env={
-        "PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED:" in result.stderr, result.stderr
-    assert f"could not read who owns {target}" in result.stderr, result.stderr
-    assert target.read_bytes() == old
-    assert target.stat().st_ino == inode
-    assert placement_temporaries(tmp_path) == []
-    assert f"{INSTALLED[2]}: " not in result.stdout, (
-        "the loop carried on past a placement it refused")
-
-
-@NEEDS_JQ
-def test_a_group_that_cannot_be_kept_does_not_stop_the_placement(tmp_path):
-    """THE GROUP IS KEPT WHERE IT CAN BE, AND IS NO REASON TO REFUSE (Copilot
-    round 2 on #172). The owner is this account and the group is one it is not
-    in, so the real `chown` to that group is refused. At 755 and 644 the
-    group's bits are the other bits, so nobody gains or loses a permission by
-    it: the copy is placed, as `cp` placed it.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    bin_dir = tmp_path / ".local" / "bin"
-    name = INSTALLED[1]
-    target = bin_dir / name
-    target.write_bytes(target.read_bytes() + b"# drift\n")
-    ls_shim = fake_owner_ls(tmp_path, target, os.getuid(), os.getgid() + 4243)
-
-    result = run_cmd("--install", home=tmp_path, env={
-        "PATH": f"{ls_shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"{name}: updated at {target}" in result.stdout, result.stdout
-    assert target.read_bytes() == (REPO / name).read_bytes()
-    assert placement_temporaries(tmp_path) == []
-
-
-#: THE TWO PLACES A SIGNAL CAN FIND A TEMPORARY. A slow `cp` holds the run
-#: between `mktemp` and `mv`. A slow `mktemp` holds it AFTER the file is made
-#: and BEFORE its name comes back — the window Copilot's round 2 on #172 named,
-#: which a name learnt from `mktemp`'s answer could not cover. Each defers to
-#: the real tool and is slow only for a temporary.
-SLOW_TOOLS = {
-    "cp": ('for arg in "$@"; do\n'
-           '\tcase "$arg" in *.openrepotools.*) sleep 3 ;; esac\n'
-           'done\n'
-           'exec {real} "$@"\n'),
-    "mktemp": ('made=$({real} "$@") || exit $?\n'
-               'case "$made" in *.openrepotools.*) sleep 3 ;; esac\n'
-               "printf '%s\\n' \"$made\"\n"),
-}
-
-
-@pytest.mark.parametrize("slow", sorted(SLOW_TOOLS))
-@pytest.mark.parametrize("signame, to_group", [
-    ("SIGTERM", False),   # a `kill` from another shell
-    ("SIGINT", True),     # Ctrl-C: the whole foreground process group
-])
-@NEEDS_JQ
-def test_a_run_killed_mid_placement_leaves_no_temporary(tmp_path, signame,
-                                                         to_group, slow):
-    """THE `EXIT` TRAP REMOVES WHAT A PLACEMENT HAS NOT YET RENAMED (#167).
-
-    `place_by_rename` removes its temporary on every failure it sees; a signal
-    is one it cannot see, which is what `$PLACING` and the trap `workdir`
-    sets are for. A tool first on `$PATH` that is SLOW for a temporary holds
-    the run where one exists; the signal lands there. The run dies of it, and
-    nothing named `.<name>.openrepotools.*` is left beside a target. Without
-    the trap's clause every one of these leaves it behind, and with a trap that
-    knew only `mktemp`'s answer the Ctrl-C into a slow `mktemp` still did.
-
-    THE CHILD STARTS WITH BOTH SIGNALS AT THEIR DEFAULT, as a foreground job at
-    a terminal has them. A runner started in the background by a
-    non-interactive shell (`nohup pytest … &`) has SIGINT IGNORED, an ignored
-    signal survives `exec`, and a shell may not un-ignore one it was started
-    with — so without this the case would measure the runner, not the trap.
-    """
-    real = shutil.which(slow)
-    if real is None:
-        pytest.skip(f"no real `{slow}` on PATH for the slow one to defer to")
-    shim = tmp_path / f"slow-{slow}"
-    shim.mkdir()
-    (shim / slow).write_text(
-        "#!/bin/sh\n" + SLOW_TOOLS[slow].format(real=real), encoding="utf-8")
-    (shim / slow).chmod(0o755)
-    sig = getattr(signal, signame)
-
-    def default_signals() -> None:
-        signal.signal(signal.SIGINT, signal.SIG_DFL)
-        signal.signal(signal.SIGTERM, signal.SIG_DFL)
-
-    run = subprocess.Popen(
-        ["bash", str(COMMAND), "--install"], stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-        env=command_env(tmp_path, {
-            "PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"}),
-        start_new_session=True, preexec_fn=default_signals)
-    try:
-        deadline = time.monotonic() + 60
-        while time.monotonic() < deadline and not placement_temporaries(tmp_path):
-            time.sleep(0.05)
-        assert placement_temporaries(tmp_path), (
-            "no placement ever made a temporary for the signal to land beside")
-        if to_group:
-            os.killpg(run.pid, sig)
-        else:
-            run.send_signal(sig)
-        out, err = run.communicate(timeout=60)
-    finally:
-        if run.poll() is None:
-            os.killpg(run.pid, signal.SIGKILL)
-            run.communicate()
-    assert run.returncode in (-sig, 128 + sig), (
-        f"the run did not die of {signame}: exit {run.returncode}\n{out}{err}")
-    assert placement_temporaries(tmp_path) == []
-
-
-#: THE WORDS THIS INSTALLER USED TO PLACE AND DOES NOT ANY MORE. `restart` left
-#: under lane-collision-protocol Amendment 18 Addendum 2 (ratified
-#: 2026-09-14T16:50:32Z, verbatim "ratify"): `lane <name>` is that act, and the
-#: addendum's words are *"`restart` is no longer a command a person is given"*.
-RETIRED = ("restart",)
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_install_removes_a_word_it_used_to_place(tmp_path, name):
-    """DROPPING IT FROM THE LIST ONLY STOPS THE NEXT COPY.
-
-    The install loop places `INSTALLABLES` and removes nothing, so a
-    workstation that took the install while `restart` was in that list keeps
-    `restart` on its PATH for ever — and the addendum that retired it says the
-    opposite. The retirement is therefore an ACT of `--install` and not an
-    absence from a list, which is what this holds.
-
-    Pre-seeded with a copy carrying this installer's own header, which is what
-    marks a file as one it wrote.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    stale = bin_dir / name
-    stale.write_text(
-        "#!/usr/bin/env bash\n"
-        "# SPDX-License-Identifier: Apache-2.0\n"
-        "#\n"
-        f"# {name} — the word this installer used to place.\n"
-        "#\n"
-        "# Installed on PATH by `openRepoTools --install`, which is where it came from.\n"
-        "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert not stale.exists(), (
-        f"`{name}` is still on PATH after an install that retired it:\n"
-        + result.stdout)
-    assert f"{name}: RETIRED" in result.stdout, (
-        "the removal is said out loud, because a file that vanishes without a "
-        f"line is a file nobody can ask about:\n{result.stdout}")
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_install_never_removes_a_file_it_did_not_write(tmp_path, name):
-    """AND IT DELETES ONLY WHAT IT WROTE.
-
-    A person's own script that happens to carry a retired name is theirs. It
-    is NAMED, the line that removes it is printed, and the file is left exactly
-    where it is — because an installer that deletes a stranger's script to
-    tidy its own list has done something no list can justify.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    mine = bin_dir / name
-    mine.write_text("#!/usr/bin/env bash\n# my own script\necho mine\n",
-                    encoding="utf-8")
-    mine.chmod(0o755)
-    before = mine.read_bytes()
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert mine.is_file(), "a file this installer did not write was deleted"
-    assert mine.read_bytes() == before
-    assert f"{name}: RETIRED" in result.stdout
-    assert f'rm -f -- "{mine}"' in result.stdout, (
-        "the one line that removes it is printed, filled in, because the act "
-        f"is the person's:\n{result.stdout}")
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_install_never_unlinks_a_symlink_of_a_retired_name(tmp_path, name):
-    """`-f` FOLLOWS THE LINK, AND A LINK IS SOMEBODY'S DECISION.
-
-    A person's own `restart` symlink pointing at a file that happens to carry
-    this installer's header would be unlinked by an ownership test written as
-    `[ -f "$target" ]` alone — and `plan_install_targets` refuses a `-L`
-    target for exactly that reason, naming the link rather than writing
-    through it. The retirement holds to the same rule: the link is NAMED and
-    left, and both it and what it points at are still there afterwards.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    real = tmp_path / "elsewhere.sh"
-    real.write_text(
-        "#!/usr/bin/env bash\n"
-        "# Installed on PATH by `openRepoTools --install`, once upon a time.\n"
-        "echo linked\n", encoding="utf-8")
-    real.chmod(0o755)
-    link = bin_dir / name
-    link.symlink_to(real)
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert link.is_symlink(), (
-        f"a symlink named `{name}` was unlinked by the retirement:\n"
-        + result.stdout)
-    assert real.is_file(), "and what it pointed at is still there"
-    assert f"{name}: RETIRED" in result.stdout
-    assert f'rm -f -- "{link}"' in result.stdout
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_install_names_a_dangling_symlink_of_a_retired_name(tmp_path, name):
-    """AND `-e` IS FALSE FOR A LINK WHOSE TARGET IS GONE.
-
-    Copilot round 4 on #45, `openRepoTools:261`. `[ -e "$target" ] || continue`
-    follows the link, so a `restart` symlink pointing at a file that has since
-    been removed was skipped outright: still on PATH, still the first `restart`
-    a shell finds, and not one word about it in the run that was supposed to
-    retire that name. The pre-move `link-estates` put exactly these links in a
-    workstation's `~/.local/bin`. It is NAMED like any other link — and left,
-    because a link is somebody's decision about their own PATH.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    link = bin_dir / name
-    link.symlink_to(tmp_path / "gone-with-the-checkout.sh")
-    assert not link.exists() and link.is_symlink(), "the fixture is a dangling link"
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert link.is_symlink(), (
-        f"a dangling symlink named `{name}` was removed by the retirement:\n"
-        + result.stdout)
-    assert f"{name}: RETIRED" in result.stdout, (
-        "a retired name still on PATH is named, whatever kind of file it is:\n"
-        + result.stdout)
-    assert f'rm -f -- "{link}"' in result.stdout
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_install_retires_only_after_the_placement_it_migrates_to(tmp_path, name):
-    """THE ONE DESTRUCTIVE STEP IS THE LAST ONE.
-
-    Copilot round 7 on #45, `openRepoTools:369`. `retire_commands` ran BEFORE
-    `place_skill_and_hook`, so a skills directory this run could not write left
-    a workstation with the old word already deleted and the adoption it was
-    migrating to unfinished — while every other refusal in that file places
-    NOTHING rather than half of it. Here `~/.claude/skills` is a regular file,
-    which is a `mkdir -p` that cannot succeed.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    stale = bin_dir / name
-    stale.write_text(
-        "#!/usr/bin/env bash\n"
-        f"# {name} — the word this installer used to place.\n"
-        "# Installed on PATH by `openRepoTools --install`, which is where it came from.\n"
-        "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    claude = tmp_path / ".claude"
-    claude.mkdir()
-    (claude / "skills").write_text("a file where the skills directory goes\n",
-                                   encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode != 0, (
-        "the placement could not finish and the run said it did:\n"
-        + result.stdout)
-    assert stale.is_file(), (
-        f"`{name}` was retired by a run whose placement then failed:\n"
-        + result.stdout + result.stderr)
-    assert f"{name}: RETIRED" not in result.stdout, (
-        "and it never said it had been:\n" + result.stdout)
-
-
-@NEEDS_JQ
-def test_a_copy_whose_bytes_are_right_and_whose_mode_is_not_says_so(tmp_path):
-    """THE ELEVEN HAVE ALWAYS BEEN STAMPED EVERY TIME, AND THE LINE DID NOT SAY
-    SO (#40, finding 2).
-
-    `chmod 755` sits outside the bytes comparison here — a copy that is not
-    executable is not a command — so this half was never the defect the skills
-    and the command files had. What it did was report `unchanged` over a mode
-    it had just repaired, which is a line a person reads as "nothing to look
-    at" about the one thing that run actually did to that file.
-
-    The bytes are asserted untouched as well: a mode is fixed with `chmod`, not
-    by rewriting a file.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    target = tmp_path / ".local" / "bin" / "park"
-    before = target.read_bytes()
-    os.chmod(target, 0o644)
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert stat.S_IMODE(target.stat().st_mode) == 0o755
-    assert target.read_bytes() == before
-    assert f"park: already installed at {target} (mode restored to 755)" \
-        in result.stdout, result.stdout
-    for other in INSTALLED:
-        if other != "park":
-            assert f"{other}: already installed at " \
-                   f"{tmp_path / '.local' / 'bin' / other} (unchanged)" \
-                in result.stdout, other
-
-
-@NEEDS_JQ
-def test_a_mode_stamp_the_bin_loop_cannot_make_reads_as_a_refusal(tmp_path):
-    """THE ONE MODE STAMP IN THIS COMMAND THAT HAD NO `die` BESIDE IT (#48).
-
-    `--install`'s codes are this toolset's — 0 done, 1 findings printed, 2 a
-    refusal — and an unguarded `chmod` under `set -e` exits with the shell's own
-    1 from a run that is refusing, with the commands before it already placed.
-    Every other stamp in the file already died; this loop's did not.
-
-    WHY IT CAN FAIL AT ALL, AND WHY NOTHING PREFLIGHTS IT. `-w` proves this euid
-    may write a file's CONTENTS and `chmod` wants its OWNER, so a group- or
-    ACL-writable file owned by another account passes every planning check and
-    refuses the stamp. The question that would catch it first is `[ -O ]`, and
-    it is declined for the reason written beside `unplaceable_kind` (search
-    "WHAT `-w` DOES NOT PROVE") and ruled in R-A9-15: no fixture here can make a
-    second account to own the target, and it would refuse a root `--install`
-    into another user's home, where the stamp does in fact succeed.
-
-    SO THE FAILURE ITSELF IS WHAT IS TESTED, through a `chmod` first on `$PATH`
-    that refuses ONE path and is the real one for every other — the same way
-    this suite answers a `gh` it cannot call and a `jq` it must do without.
-    Ownership is what this stands in for; a fixture cannot make the ownership,
-    and the stamp's own failure is the same failure either way.
-
-    THE FAKE REFUSES THE ONE FILE BY EITHER NAME (#167): a copy that is being
-    WRITTEN is stamped on its temporary beside the target, before the rename,
-    so the target is never at the wrong mode — and a stamp that fails there
-    leaves no temporary behind.
-    """
-    real = shutil.which("chmod")
-    if real is None:
-        pytest.skip("no real `chmod` on PATH for the fake to defer to")
-    bin_dir = tmp_path / ".local" / "bin"
-    refused = bin_dir / INSTALLED[1]
-    shim = tmp_path / "fake-chmod"
-    shim.mkdir()
-    (shim / "chmod").write_text(
-        "#!/bin/sh\n"
-        'for arg in "$@"; do\n'
-        '\tcase "$arg" in\n'
-        f'\t"{refused}"|"{bin_dir}/.{refused.name}.openrepotools."*)\n'
-        "\t\tprintf 'fake chmod: this one is not ours to mode\\n' >&2\n"
-        "\t\texit 1 ;;\n"
-        "\tesac\n"
-        "done\n"
-        f'exec {real} "$@"\n', encoding="utf-8")
-    (shim / "chmod").chmod(0o755)
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED:" in result.stderr, result.stderr
-    assert f"could not set mode 755 on {refused}" in result.stderr, result.stderr
-    assert (bin_dir / INSTALLED[0]).is_file(), (
-        "the run refused before it reached the file whose stamp fails")
-    assert not (bin_dir / INSTALLED[2]).exists(), (
-        "the loop carried on past a mode stamp it could not make")
-    assert not refused.exists(), "a copy whose mode failed was placed anyway"
-    assert placement_temporaries(tmp_path) == []
-    assert not (tmp_path / ".claude").exists(), (
-        "the skills, the command files or the hook entries were placed by a "
-        "run that refused")
-
-
-def unguarded_mode_stamps(lines: list[str]) -> list[str]:
-    """Every `chmod` line in `lines` whose failure does not reach `die`.
-
-    THE HANDLER IS WHAT IS READ, AND NOT THE BARE `||` (Copilot round 1 on
-    #102). A stamp written `chmod 755 "$x" || true` carries a `||` and is the
-    exact defect this rule exists to stop — a mode-stamp failure that is not a
-    refusal — so the text after the `||` has to name `die`, on that line or, for
-    the two-line spelling this file uses, on the one below it.
-
-    AND `die` HAS TO BE THE COMMAND THE HANDLER RUNS (round 2), not a word
-    inside it: `|| echo die` names it and refuses nothing. So it is matched at a
-    command position — the start of the handler, or after the `;`, `&&`, `||` or
-    `{` that begins one — which is what makes `{ rm -f -- …; die …; }`, the
-    spelling the settings file's temporary needs, a handler this accepts.
-    """
-    out = []
-    for number, line in enumerate(lines, 1):
-        if not line.strip().startswith("chmod "):
-            continue
-        handler = line.split("||", 1)[1] if "||" in line else ""
-        if line.rstrip().endswith("||"):
-            handler = lines[number] if number < len(lines) else ""
-        if not re.search(r"(?:^|[;&|{(])\s*die\b", handler.strip()):
-            out.append(f"{number}: {line.strip()}")
-    return out
-
-
-def test_every_mode_stamp_in_this_command_fails_through_die():
-    """AND THE RULE IS ASKED OF EVERY SITE, NOT ONLY THE ONE ABOVE (#48).
-
-    The bin loop's was the stamp nobody guarded, and a test that proves only
-    that stamp is a test the NEXT unguarded one walks straight past — the same
-    reason `test_repo_hygiene.py` asks its questions per name rather than of a
-    list somebody keeps. Read out of the script's text, because a `chmod` that
-    cannot fail in this suite is a `chmod` no run here reaches.
-
-    AND THE RULE IS PROVED TO HAVE TEETH in the same breath, against lines
-    written here: a check that accepted any `||` would accept `|| true`, which
-    is a handler and not a refusal.
-    """
-    lines = COMMAND.read_text(encoding="utf-8").splitlines()
-    stamps = [line for line in lines if line.strip().startswith("chmod ")]
-    assert len(stamps) >= 5, (
-        f"this command performs {len(stamps)} mode stamps; the shape this test "
-        "reads has moved and it is now proving less than it says")
-    unguarded = unguarded_mode_stamps(lines)
-    assert not unguarded, (
-        "every `chmod` this command performs must fail through `die` — exit 2 "
-        "and a REFUSED line naming the target — never the shell's own 1 under "
-        "`set -e`, which this toolset spends on \"findings were printed\":\n  "
-        + "\n  ".join(unguarded))
-    assert unguarded_mode_stamps(['\tchmod 755 "$target"']) == [
-        '1: chmod 755 "$target"'], "an unguarded stamp is not caught"
-    assert unguarded_mode_stamps(['\tchmod 755 "$target" || true']) == [
-        '1: chmod 755 "$target" || true'], "`|| true` is a handler, not a refusal"
-    assert unguarded_mode_stamps(['\tchmod 755 "$target" || echo die']) == [
-        '1: chmod 755 "$target" || echo die'], (
-        "`die` has to be the command the handler RUNS, not a word inside it")
-    assert unguarded_mode_stamps(['\tchmod 644 "$t" || die "no."']) == []
-    assert unguarded_mode_stamps(['\tchmod 600 "$t" ||',
-                                  '\t\t{ rm -f -- "$t"; die "no."; }']) == [], (
-        "the two-line spelling this file uses must read as guarded")
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_the_retirement_prints_a_removal_that_can_be_pasted(tmp_path, name):
-    """A PRINTED COMMAND IS A LINE SOMEBODY TYPES BACK.
-
-    Copilot round 9 on #45, `openRepoTools:281`. `OPENREPOTOOLS_BIN_DIR` is a
-    path a person chooses, and the retirement printed `rm <path>` bare — so a
-    directory with a space in it produced a line that removes nothing (or, with
-    the wrong path, something else). Both planners in this file already print
-    `rm -f -- "<path>"` out of a `paths` they build with the quotes in; this is
-    the same spelling.
-    """
-    bin_dir = tmp_path / "my bin dir"
-    bin_dir.mkdir(parents=True)
-    mine = bin_dir / name
-    mine.write_text("#!/usr/bin/env bash\n# my own script\necho mine\n",
-                    encoding="utf-8")
-    mine.chmod(0o755)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 0, result.stderr
-    assert mine.is_file(), "a file this installer did not write was deleted"
-    assert f'rm -f -- "{mine}"' in result.stdout, (
-        "the removal is printed quoted, because the path has a space in it:\n"
-        + result.stdout)
-    assert f"rm {mine}\n" not in result.stdout
-
-
-# --- the receipt of what it placed ------------------------------------------
-
-#: THE RECEIPT'S PATH UNDER A REDIRECTED `$HOME`. `command_env` clears
-#: `$XDG_DATA_HOME` as well as `$OPENREPOTOOLS_DATA_DIR`, so what these tests
-#: exercise is the DEFAULT — `~/.local/share/openRepoTools/installed.tsv` — and
-#: it lands inside `tmp_path` because `$HOME` does.
-def receipt_path(home: Path) -> Path:
-    return home / ".local" / "share" / "openRepoTools" / "installed.tsv"
-
-
-def receipt_rows(home: Path) -> list:
-    """The receipt as a list of `(name, destination, sha256, utc)` tuples."""
-    return [tuple(line.split("\t"))
-            for line in receipt_path(home).read_text(
-                encoding="utf-8").splitlines() if line]
-
-
-def receipt_rows_at(receipt: Path) -> list:
-    """`receipt_rows`, for a receipt that is not at the default path."""
-    return [tuple(line.split("\t"))
-            for line in receipt.read_text(encoding="utf-8").splitlines()
-            if line]
-
-
-def placed_files(home: Path) -> dict:
-    """Every REGULAR FILE an `--install` into `home` places, by destination.
-
-    Derived from the same three lists the artifact count is, and it comes to
-    `ARTIFACTS - HOOK_ENTRIES`: the two hook entries are entries inside
-    somebody else's JSON file rather than files this command placed, so they
-    get no row. The NAME beside each is the word `--install` prints on the line
-    that places it — `park`, `handoff`, `/ctx` — because one name is a skill
-    AND a command file at four different paths, which is why the row's subject
-    is its destination.
-    """
-    files = {str(home / ".local" / "bin" / name): name for name in INSTALLED}
-    for name in SKILL_NAMES:
-        for root in (home / ".claude-profiles" / "shared", home / ".claude"):
-            files[str(root / "skills" / name / "SKILL.md")] = name
-    for name in COMMAND_NAMES:
-        for root in (home / ".claude-profiles" / "shared", home / ".claude"):
-            files[str(root / "commands" / f"{name}.md")] = f"/{name}"
-    return files
-
-
-@NEEDS_JQ
-def test_install_writes_a_receipt_of_every_file_it_placed(tmp_path):
-    """ONE ROW PER PLACED FILE, WITH THE DIGEST OF THE BYTES THAT ARE THERE
-    (#57).
-
-    The only evidence `retire_commands` had that a file on a PATH was one this
-    installer wrote is the `Installed on PATH by ` header — a content
-    substring, which Copilot's round-3 review of #45 named at
-    `openRepoTools:263` and which a person's own script can carry by having
-    been copied from an old installation. A receipt is the evidence that
-    substring is not: the digest of what this run actually placed, at the path
-    it placed it.
-
-    ONE ROW PER PLACED REGULAR FILE, which is `ARTIFACTS - HOOK_ENTRIES` and
-    is derived rather than stated: the `INSTALLED` files plus the skill and
-    command files at both of their destinations. The two hook entries are
-    entries inside `~/.claude/settings.json` and not files this command
-    placed, and the receipt carries no row for itself either. Today that is
-    31 artifacts and 29 rows (17 + 6 + 6, since opensoft/openRepoTools#162 put
-    `lane-worktrees` in the list); the number moves with those three lists and
-    with nothing else, which is why no assertion below spells it.
-    """
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    receipt = receipt_path(tmp_path)
-    assert receipt.is_file(), result.stdout
-    assert stat.S_IMODE(receipt.stat().st_mode) == 0o600, (
-        "the receipt is born at mktemp's 0600 and no chmod touches it: every "
-        "chmod this command performs must fail through die (#48), and a "
-        "receipt that cannot be written is a note and never a refusal (#57), "
-        "so the one mode both rules allow is the one mktemp gives")
-    rows = receipt_rows(tmp_path)
-    expected = placed_files(tmp_path)
-    assert len(rows) == ARTIFACTS - HOOK_ENTRIES == len(expected), (
-        f"{len(rows)} rows for {len(expected)} placed files:\n" + receipt.read_text(encoding="utf-8"))
-    for name, destination, digest, utc in rows:
-        assert destination in expected, f"a row for a file nothing placed: {destination}"
-        assert name == expected[destination], destination
-        assert digest == hashlib.sha256(
-            Path(destination).read_bytes()).hexdigest(), (
-            f"the row for {destination} carries a digest of other bytes")
-        datetime.strptime(utc, "%Y-%m-%dT%H:%M:%SZ")
-    assert {row[1] for row in rows} == set(expected)
-    assert f"receipt: {len(rows)} placed files recorded in {receipt}" \
-        in result.stdout, (
-        "a file written without a line is a file nobody can ask about:\n"
-        + result.stdout)
-
-
-def test_the_help_and_the_readme_say_the_mode_the_receipt_is_born_at():
-    """THE CONTRACT IS ONE NUMBER IN FOUR PLACES, AND THE TEST ABOVE ONLY HOLDS
-    ONE OF THEM (Copilot on #103, `openRepoTools:503`).
-
-    The pull request's description said the receipt is 0644 while the code, the
-    test and the README said 0600 — deliberately: #48's "every `chmod` this
-    command performs fails through `die`" meets #57's "a receipt it cannot write
-    is a note", and a stamp that may neither die nor fall silent is a stamp that
-    must not exist, so `mktemp`'s 0600 stands. A description can be edited and a
-    usage line cannot be reviewed away, so the two documents a person reads
-    from the install say it and this reads them: each says 0600 in its receipt
-    paragraph and neither carries a 0644 there.
-    """
-    help_text = run_cmd("--help").stdout
-    # The README is the ASSEMBLY root's in the triad (#186, T009): read from
-    # the root that owns it - a skip in a standalone code leg, and in the
-    # composed run a failure, never a skip, if that root is absent.
-    readme = ROOTS.path_for("README.md").read_text(encoding="utf-8")
-    for where, text, start in (("--help", help_text, "It then writes a RECEIPT"),
-                               ("README.md", readme, "**And it writes down what it placed.**")):
-        assert start in text, f"{where} no longer has the receipt paragraph"
-        paragraph = text.split(start, 1)[1].split("\n\n", 1)[0]
-        assert "mode 0600" in paragraph, (
-            f"{where} does not say the mode the receipt is born at:\n{paragraph}")
-        assert "0644" not in paragraph and "644" not in paragraph, (
-            f"{where} says a mode the receipt is not:\n{paragraph}")
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_a_retirement_reads_the_receipt_before_the_header(tmp_path, name):
-    """AND THE RECEIPT IS STRONGER THAN THE HEADER, WHICH IS THE WHOLE POINT.
-
-    The file here carries NO marker at all — nothing a `grep` could find — and
-    it is still removed, because a row of this installer's own receipt says
-    those exact bytes were placed at that exact path. That is ownership
-    evidence rather than a searchable substring (#57, on Copilot round 3 of
-    #45 at `openRepoTools:263`).
-
-    And the row goes with the file: a receipt that still named the path would
-    answer `edited` about whatever somebody puts there next.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    stale = bin_dir / name
-    stale.write_text("#!/usr/bin/env bash\n"
-                     f"# {name}, with no banner of any kind in it\n"
-                     "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    receipt.write_text(
-        f"{name}\t{stale}\t{hashlib.sha256(stale.read_bytes()).hexdigest()}"
-        "\t2026-09-15T04:04:16Z\n", encoding="utf-8")
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert not stale.exists(), (
-        f"the receipt names `{name}` and its digest still matches, and it is "
-        "still on PATH:\n" + result.stdout)
-    assert f"{name}: RETIRED" in result.stdout, result.stdout
-    assert "receipt carries its digest" in result.stdout, (
-        "the line says which evidence removed it, because the two kinds are "
-        f"not the same claim:\n{result.stdout}")
-    assert not [row for row in receipt_rows(tmp_path) if row[1] == str(stale)], (
-        "the row of a file that is no longer there was kept:\n"
-        + receipt.read_text(encoding="utf-8"))
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_a_file_the_receipt_no_longer_recognises_is_named_and_left(tmp_path, name):
-    """A DIGEST THAT HAS MOVED IS SOMEBODY'S EDIT, AND IT OUTRANKS THE MARKER.
-
-    This file carries the header — `grep` finds it, and today's fallback would
-    delete it — and the receipt says the bytes at that path are NOT the ones it
-    placed. So it is a person's edit of an installed command, or their own file
-    at a path one used to be at, and either way not this installer's to remove:
-    named, left exactly as it is, with the one line that removes it printed for
-    them, like every other file this installer did not write.
-
-    Its row is KEPT, because the file is: a receipt drops a row when the file
-    goes, not when it stops matching.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    mine = bin_dir / name
-    mine.write_text(
-        "#!/usr/bin/env bash\n"
-        "# Installed on PATH by `openRepoTools --install`, and then edited.\n"
-        "echo my own edit\n", encoding="utf-8")
-    mine.chmod(0o755)
-    before = mine.read_bytes()
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    receipt.write_text(
-        f"{name}\t{mine}\t{hashlib.sha256(b'the bytes it placed').hexdigest()}"
-        "\t2026-09-15T04:04:16Z\n", encoding="utf-8")
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert mine.is_file() and mine.read_bytes() == before, (
-        "a file whose digest the receipt does not recognise was deleted on the "
-        "strength of the header substring the receipt exists to replace:\n"
-        + result.stdout)
-    assert f"{name}: RETIRED" in result.stdout
-    assert "no longer holds the bytes this installer's receipt recorded" \
-        in result.stdout, result.stdout
-    assert f'rm -f -- "{mine}"' in result.stdout, (
-        "the act is the person's, so the line is printed filled in:\n"
-        + result.stdout)
-    assert [row for row in receipt_rows(tmp_path) if row[1] == str(mine)], (
-        "the row of a file that is still there was dropped:\n"
-        + receipt.read_text(encoding="utf-8"))
-
-
-def path_without(tmp_path: Path, *names: str) -> str:
-    """A `$PATH` on which none of `names` EXISTS, not one where they fail.
-
-    A directory of symlinks to every executable the real `$PATH` carries
-    except those names, in the real `$PATH`'s own order. A shim that exits 1
-    (see `test_a_digest_it_cannot_take_is_a_note_too`) is a tool that FAILS;
-    this is a machine that has none, which is the other thing a reviewer
-    means by "a missing digest tool", and the two reach `sha256_of` through
-    different arms. `bash`, `cp`, `jq` and the rest are all still found, so
-    the install itself runs exactly as it does everywhere else.
-    """
-    farm = tmp_path / "path-without"
-    farm.mkdir()
-    for directory in os.environ["PATH"].split(os.pathsep):
-        try:
-            entries = sorted(os.listdir(directory))
-        except OSError:
-            continue
-        for entry in entries:
-            source = os.path.join(directory, entry)
-            link = farm / entry
-            if (entry in names or link.is_symlink()
-                    or not (os.path.isfile(source)
-                            and os.access(source, os.X_OK))):
-                continue
-            link.symlink_to(source)
-    found = {name: shutil.which(name, path=str(farm)) for name in names}
-    assert not any(found.values()), f"the farm still answers for {found}"
-    return str(farm)
-
-
-@pytest.mark.parametrize("how", ["absent", "failing"])
-@pytest.mark.parametrize("name", RETIRED)
-@NEEDS_JQ
-def test_a_row_it_cannot_verify_is_named_and_left_never_removed(tmp_path, name, how):
-    """A ROW THAT CANNOT BE CHECKED IS NOT "NO ROW" (Copilot on #103,
-    `openRepoTools:711`).
-
-    `receipt_verdict` answered `unknown` when the digest could not be taken,
-    which is also what it answers when there is no row at all — so the header
-    fallback ran and REMOVED the file. On a host with a missing or failing
-    digest tool that is an edited, receipt-tracked command that still carries
-    the header being deleted, which is the ownership mistake the receipt
-    exists to prevent. The header is for "no matching row", and nothing else.
-
-    The file carries the header, and its row names bytes it does not have —
-    the exact case where the header would have been the only thing standing
-    between the file and `rm`. It is left byte for byte and named with the
-    `rm` printed, whether the tool is ABSENT from `$PATH` or merely FAILING,
-    and the receipt is not touched: the row is about a file that is still
-    there.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    mine = bin_dir / name
-    mine.write_text(
-        "#!/usr/bin/env bash\n"
-        "# Installed on PATH by `openRepoTools --install`, and then edited.\n"
-        "echo my own edit\n", encoding="utf-8")
-    mine.chmod(0o755)
-    before = mine.read_bytes()
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    seeded = (f"{name}\t{mine}\t{hashlib.sha256(b'the bytes it placed').hexdigest()}"
-              "\t2026-09-15T04:04:16Z\n")
-    receipt.write_text(seeded, encoding="utf-8")
-    if how == "absent":
-        path = path_without(tmp_path, "sha256sum", "shasum")
-    else:
-        shim = tmp_path / "shims"
-        shim.mkdir()
-        for tool in ("sha256sum", "shasum"):
-            (shim / tool).write_text("#!/bin/sh\nexit 1\n", encoding="utf-8")
-            (shim / tool).chmod(0o755)
-        path = f"{shim}{os.pathsep}{os.environ['PATH']}"
-
-    result = run_cmd("--install", home=tmp_path, env={"PATH": path})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert mine.is_file() and mine.read_bytes() == before, (
-        "a file with a receipt row that could not be checked was deleted on "
-        "the strength of the header the receipt exists to replace:\n"
-        + result.stdout)
-    retired = [line for line in result.stdout.splitlines()
-               if line.startswith(f"{name}: RETIRED")]
-    assert len(retired) == 1, result.stdout
-    assert str(mine) in retired[0], "the line names the destination"
-    assert "could not be checked" in retired[0], retired[0]
-    assert "no digest tool" in retired[0], retired[0]
-    assert f'rm -f -- "{mine}"' in retired[0], (
-        "the act is the person's, so the line is printed filled in:\n"
-        + retired[0])
-    assert "removed from" not in result.stdout
-    assert receipt.read_text(encoding="utf-8") == seeded, (
-        "the receipt was rewritten by a run that could digest nothing")
-
-
-@NEEDS_JQ
-def test_a_receipt_it_cannot_write_is_a_note_and_never_a_refusal(tmp_path):
-    """FAIL CLOSED, OUT LOUD, IN ONE LINE, AND CARRY ON (#57).
-
-    The commands, the skills and the hook entries are what a person asked for.
-    A record of them this installer could not write is its problem and not
-    theirs — and the header marker is still there for a later retirement to
-    fall back to, which is exactly the population that fallback exists for. So
-    the install SUCCEEDS and says where it could not write, why, and what that
-    costs.
-
-    A regular file where the data directory goes, because that is a `mkdir -p`
-    that cannot succeed for any user, root included.
-    """
-    blocked = tmp_path / "blocked"
-    blocked.write_text("a file where the data directory goes\n",
-                       encoding="utf-8")
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_DATA_DIR": str(blocked / "data")})
-    assert result.returncode == 0, result.stdout + result.stderr
-    for name in INSTALLED:
-        assert (tmp_path / ".local" / "bin" / name).is_file(), name
-    assert f"openRepoTools: {len(INSTALLED)} of {len(INSTALLED)} placed" \
-        in result.stdout
-    assert f"receipt: NOT written to {blocked / 'data' / 'installed.tsv'}" \
-        in result.stdout, result.stdout
-    assert f"{blocked} is not a directory" in result.stdout, (
-        "the note says WHY, because a person who cannot see the reason cannot "
-        f"fix it:\n{result.stdout}")
-    assert "falls back to the `Installed on PATH by` header" in result.stdout
-    assert "$OPENREPOTOOLS_DATA_DIR" in result.stdout, (
-        "and names the way out")
-    assert "REFUSED" not in result.stderr
-
-
-@NEEDS_JQ
-def test_a_receipt_that_is_a_symlink_is_not_written_through(tmp_path):
-    """THE SAME RULE EVERY OTHER PATH IN THIS FILE IS HELD TO.
-
-    `mv -f` replaces the LINK rather than what it points at, so a receipt
-    written over one silently swaps a person's link for a regular file — which
-    is what `cp` through a link does, in the other direction. It is named and
-    left, like every other path this installer did not make, and the install is
-    untouched.
-    """
-    data = tmp_path / "data"
-    data.mkdir()
-    elsewhere = tmp_path / "somewhere-else.tsv"
-    elsewhere.write_text("mine\n", encoding="utf-8")
-    (data / "installed.tsv").symlink_to(elsewhere)
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_DATA_DIR": str(data)})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert (data / "installed.tsv").is_symlink(), (
-        "the link was replaced by a regular file:\n" + result.stdout)
-    assert elsewhere.read_text(encoding="utf-8") == "mine\n", (
-        "and the bytes were written through it")
-    assert f"receipt: NOT written to {data / 'installed.tsv'}" in result.stdout
-    assert f"it is a symlink to {elsewhere}" in result.stdout, result.stdout
-    for name in INSTALLED:
-        assert (tmp_path / ".local" / "bin" / name).is_file(), name
-
-
-@NOT_ROOT
-@NEEDS_JQ
-def test_a_receipt_it_cannot_read_is_left_whole_and_its_rows_are_not_lost(tmp_path):
-    """A RECEIPT THAT EXISTS AND CANNOT BE OPENED IS NOT AN EMPTY ONE (Copilot
-    round 4 on #103, `openRepoTools:575`).
-
-    `receipt_rows_except` ended in an unconditional `return 0`, so a receipt
-    whose `done <"$1"` redirection failed reported a clean scan of no rows —
-    and `receipt_record` then REPLACED it with this run's rows alone, losing
-    every row about a copy this run did not place. The read failure now
-    propagates: the caller prints its "could not be read" note and the old
-    receipt is not touched.
-
-    The receipt is made mode 000 and seeded with a row about a file this run
-    does not place, so that row's survival is the proof. The install itself is
-    whole — a receipt that cannot be maintained is a note and never a refusal
-    (#57) — and the receipt is read back after the mode is restored.
-    """
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    elsewhere = tmp_path / "bin-elsewhere" / "park"
-    elsewhere.parent.mkdir(parents=True)
-    elsewhere.write_text("#!/usr/bin/env bash\necho an older copy\n",
-                         encoding="utf-8")
-    seeded = (f"park\t{elsewhere}"
-              f"\t{hashlib.sha256(elsewhere.read_bytes()).hexdigest()}"
-              "\t2026-09-15T04:04:16Z\n")
-    receipt.write_text(seeded, encoding="utf-8")
-    receipt.chmod(0o000)
-    try:
-        result = run_cmd("--install", home=tmp_path)
-    finally:
-        receipt.chmod(0o600)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "REFUSED" not in result.stderr
-    for name in INSTALLED:
-        assert (tmp_path / ".local" / "bin" / name).is_file(), name
-    assert f"receipt: NOT written to {receipt}" in result.stdout, result.stdout
-    assert "the rows already there could not be read" in result.stdout, (
-        "the note says WHY:\n" + result.stdout)
-    assert receipt.read_text(encoding="utf-8") == seeded, (
-        "an unreadable receipt was replaced, and the rows in it are gone")
-    assert [p.name for p in receipt.parent.iterdir()] == ["installed.tsv"], (
-        "a temporary was left in the data directory")
-
-
-@pytest.mark.parametrize("name", RETIRED)
-@NOT_ROOT
-@NEEDS_JQ
-def test_a_receipt_it_cannot_read_never_lets_the_header_remove_a_file(tmp_path, name):
-    """UNREADABLE IS NOT "NO ROW" (Copilot round 4 on #103,
-    `openRepoTools:716`).
-
-    `receipt_verdict` scanned the receipt through a `done <"$file"` whose
-    failure nothing read, so a receipt that exists and cannot be opened looked
-    exactly like one that was scanned and has nothing to say about this path —
-    `unknown`, and the header fallback removed an edited file. `unknown` is now
-    for a scan that RAN and found no row; a receipt that cannot be opened
-    answers `unreadable`, and the retirement names the receipt, names and
-    leaves the file, and prints the `rm`, as it does for a row it cannot
-    digest.
-
-    The file carries the header and its row names other bytes, so the header
-    is the only thing between it and `rm`.
-    """
-    bin_dir = tmp_path / ".local" / "bin"
-    bin_dir.mkdir(parents=True)
-    mine = bin_dir / name
-    mine.write_text(
-        "#!/usr/bin/env bash\n"
-        "# Installed on PATH by `openRepoTools --install`, and then edited.\n"
-        "echo my own edit\n", encoding="utf-8")
-    mine.chmod(0o755)
-    before = mine.read_bytes()
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    seeded = (f"{name}\t{mine}\t{hashlib.sha256(b'the bytes it placed').hexdigest()}"
-              "\t2026-09-15T04:04:16Z\n")
-    receipt.write_text(seeded, encoding="utf-8")
-    receipt.chmod(0o000)
-    try:
-        result = run_cmd("--install", home=tmp_path)
-    finally:
-        receipt.chmod(0o600)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert mine.is_file() and mine.read_bytes() == before, (
-        "a receipt that could not be opened was read as having no row, and the "
-        "header removed an edited file:\n" + result.stdout)
-    retired = [line for line in result.stdout.splitlines()
-               if line.startswith(f"{name}: RETIRED")]
-    assert len(retired) == 1, result.stdout
-    assert str(receipt) in retired[0], "the line names the receipt"
-    assert "could not be read" in retired[0], retired[0]
-    assert str(mine) in retired[0], "and the destination"
-    assert f'rm -f -- "{mine}"' in retired[0], (
-        "the act is the person's, so the line is printed filled in:\n"
-        + retired[0])
-    assert "removed from" not in result.stdout
-    assert receipt.read_text(encoding="utf-8") == seeded
-
-
-@NEEDS_JQ
-def test_a_digest_it_cannot_take_is_a_note_too(tmp_path):
-    """AND NEITHER DIGEST TOOL IS A HARD DEPENDENCY.
-
-    `sha256sum` is GNU and a stock macOS ships none; `shasum -a 256` is the
-    spelling that is there instead. A machine that can answer with NEITHER — or
-    one where the call fails, which is what the shims here are — still gets its
-    commands, its skills and its hook entries, and the note says why the record
-    of them is missing. An installer that refused to install because it could
-    not write its own bookkeeping would have the priorities backwards.
-    """
-    shim = tmp_path / "shims"
-    shim.mkdir()
-    for name in ("sha256sum", "shasum"):
-        (shim / name).write_text("#!/bin/sh\nexit 1\n", encoding="utf-8")
-        (shim / name).chmod(0o755)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"})
-    assert result.returncode == 0, result.stdout + result.stderr
-    for name in INSTALLED:
-        assert (tmp_path / ".local" / "bin" / name).is_file(), name
-    assert not receipt_path(tmp_path).exists(), (
-        "a receipt was written out of digests nothing could take:\n"
-        + result.stdout)
-    assert f"receipt: NOT written to {receipt_path(tmp_path)}" in result.stdout
-    assert "could not be digested" in result.stdout, result.stdout
-    assert "REFUSED" not in result.stderr
-
-
-@pytest.mark.parametrize("character", ["\t", "\n"], ids=["tab", "newline"])
-@NEEDS_JQ
-def test_a_bin_dir_with_a_tab_or_newline_gets_no_receipt_and_a_whole_install(tmp_path, character):
-    """THE FAIL-CLOSED HALF OF THE TSV GUARD (Copilot on #103,
-    `openRepoTools:425`, which asked for the test this is).
-
-    A receipt is a tab-separated file with no escape, and
-    `$OPENREPOTOOLS_BIN_DIR` is a path a person chooses. A destination
-    carrying a TAB would be silently one column too many and one carrying a
-    NEWLINE silently two rows — and a receipt that quietly lacks exactly the
-    file a retirement will ask about is worse than none. So the whole receipt
-    is not written, out loud, in one line naming the reason; and since a
-    receipt that cannot be written is a note and never a refusal (#57), the
-    install itself is complete.
-
-    Both characters are accepted by the planner (nothing before the receipt
-    refuses a directory over what is in its name), so both are driven here.
-    The receipt that is already there is seeded with a row for a file that
-    does not exist, which any rewrite would DROP — so byte-for-byte equality
-    afterwards is the proof it was not replaced — and nothing but it may be
-    in the data directory, so no temporary was left behind either.
-    """
-    bin_dir = tmp_path / f"bin{character}dir"
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    seeded = ("# a receipt that somebody else's run wrote\n"
-              f"a-word-that-left\t{tmp_path / 'nowhere'}"
-              f"\t{hashlib.sha256(b'the bytes it placed').hexdigest()}"
-              "\t2026-09-15T04:04:16Z\n")
-    receipt.write_text(seeded, encoding="utf-8")
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(bin_dir)})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "REFUSED" not in result.stderr
-    for name in INSTALLED:
-        assert (bin_dir / name).is_file(), f"{name} was not placed"
-    assert f"openRepoTools: {len(INSTALLED)} of {len(INSTALLED)} placed" \
-        in result.stdout
-    assert receipt.read_text(encoding="utf-8") == seeded, (
-        "the receipt was replaced by a run whose destinations cannot be "
-        "written as a tab-separated row")
-    assert [p.name for p in receipt.parent.iterdir()] == ["installed.tsv"], (
-        "a temporary was left in the data directory")
-    assert f"receipt: NOT written to {receipt}" in result.stdout, result.stdout
-    assert "has a tab or a newline in it and this file is tab-separated" \
-        in result.stdout, (
-        "the note says WHY, because a person who cannot see the reason "
-        f"cannot fix it:\n{result.stdout}")
-    assert "placed files recorded" not in result.stdout
-
-
-@NEEDS_JQ
-def test_installing_twice_leaves_no_duplicate_rows(tmp_path):
-    """A ROW'S SUBJECT IS ITS DESTINATION, AND A RUN REPLACES THE ROW OF EVERY
-    DESTINATION IT PLACED.
-
-    An installer that APPENDED would grow a file by one row per placed file
-    every run and would answer a retirement out of whichever one it read first.
-
-    WHAT DOES CHANGE ON THE SECOND RUN IS THE UTC, and that is deliberate: the
-    stamp says when the run RECORDED the row, not when those bytes were first
-    placed, which is the honest reading of a column written by a run that
-    verified a file it did not rewrite. `test_installing_twice_changes_nothing`
-    is about the bin directory and the artifacts — the lines each placement
-    prints — and the receipt is not one of them.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    first = receipt_rows(tmp_path)
-    second_run = run_cmd("--install", home=tmp_path)
-    assert second_run.returncode == 0, second_run.stderr
-    second = receipt_rows(tmp_path)
-    assert len(second) == len(first) == ARTIFACTS - HOOK_ENTRIES
-    assert len({row[1] for row in second}) == len(second), (
-        "a destination has two rows:\n"
-        + receipt_path(tmp_path).read_text(encoding="utf-8"))
-    assert {row[:3] for row in second} == {row[:3] for row in first}, (
-        "the second run changed a name or a digest")
-
-
-@NEEDS_JQ
-def test_a_row_whose_file_is_gone_is_not_kept(tmp_path):
-    """THE WINDOW CLOSES BY ITSELF (Copilot round 1 on #103).
-
-    `receipt_forget` runs AFTER the `rm` it accompanies, so a write that fails
-    in the instant between them would leave the receipt naming a path this
-    installer's copy has left — and a row nothing ever clears is a row that
-    answers a question about whatever somebody puts there next. The merge drops
-    a row whose file is gone, so the next `--install` repairs it whatever
-    happened, and the receipt does not grow for ever with the bin directories
-    and profile roots people delete.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    receipt = receipt_path(tmp_path)
-    ghost = tmp_path / ".local" / "bin" / "a-word-that-left"
-    with receipt.open("a", encoding="utf-8") as handle:
-        handle.write(f"a-word-that-left\t{ghost}"
-                     f"\t{hashlib.sha256(b'the bytes it placed').hexdigest()}"
-                     "\t2026-09-15T04:04:16Z\n")
-    assert len(receipt_rows(tmp_path)) == ARTIFACTS - HOOK_ENTRIES + 1
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert not [row for row in receipt_rows(tmp_path) if row[1] == str(ghost)], (
-        "a row for a path with nothing at it survived an install:\n"
-        + receipt.read_text(encoding="utf-8"))
-    assert len(receipt_rows(tmp_path)) == ARTIFACTS - HOOK_ENTRIES, (
-        "and the rows of the files that ARE there were kept")
-
-
-@pytest.mark.parametrize("kind", ["directory", "symlink"])
-@NEEDS_JQ
-def test_a_row_whose_path_is_no_longer_a_regular_file_is_not_kept(tmp_path, kind):
-    """AND WHAT IS KEPT IS WHAT COULD HAVE BEEN WRITTEN (Copilot round 2 on
-    #103).
-
-    A row is evidence about a REGULAR FILE this installer placed — that is
-    `receipt_add`'s own test — so a destination that has become a directory or
-    a symlink is a path the file the row is about is not at. The first shape of
-    the rule above asked only "is there anything at all at that path", which
-    kept those rows; the two halves now spell one test.
-    """
-    assert run_cmd("--install", home=tmp_path).returncode == 0
-    gone = tmp_path / "bin-elsewhere" / "park"
-    gone.parent.mkdir(parents=True)
-    gone.write_text("#!/usr/bin/env bash\necho an older copy\n", encoding="utf-8")
-    receipt = receipt_path(tmp_path)
-    with receipt.open("a", encoding="utf-8") as handle:
-        handle.write(f"park\t{gone}"
-                     f"\t{hashlib.sha256(gone.read_bytes()).hexdigest()}"
-                     "\t2026-09-15T04:04:16Z\n")
-    gone.unlink()
-    if kind == "directory":
-        gone.mkdir()
-    else:
-        gone.symlink_to(tmp_path / ".local" / "bin" / "park")
-
-    result = run_cmd("--install", home=tmp_path)
-    assert result.returncode == 0, result.stderr
-    assert not [row for row in receipt_rows(tmp_path) if row[1] == str(gone)], (
-        f"a row was kept for a path that is now a {kind}:\n"
-        + receipt.read_text(encoding="utf-8"))
-    assert len(receipt_rows(tmp_path)) == ARTIFACTS - HOOK_ENTRIES
-
-
-@NEEDS_JQ
-def test_the_receipt_keeps_the_rows_of_a_directory_it_no_longer_writes(tmp_path):
-    """OTHER ROWS ARE KEPT, and the reason is the retirement.
-
-    A person who moves `$OPENREPOTOOLS_BIN_DIR` still has the copies in the old
-    one, and a later retirement that walks that directory is exactly the run
-    that needs this evidence. A receipt keyed on the NAME would have dropped
-    those rows the moment the same name was placed somewhere else.
-    """
-    first_dir = tmp_path / "bin-one"
-    second_dir = tmp_path / "bin-two"
-    assert run_cmd("--install", home=tmp_path,
-                   env={"OPENREPOTOOLS_BIN_DIR": str(first_dir)}).returncode == 0
-    assert run_cmd("--install", home=tmp_path,
-                   env={"OPENREPOTOOLS_BIN_DIR": str(second_dir)}).returncode == 0
-    destinations = {row[1] for row in receipt_rows(tmp_path)}
-    for name in INSTALLED:
-        assert str(first_dir / name) in destinations, (
-            f"the row for the copy still in {first_dir} was dropped")
-        assert str(second_dir / name) in destinations, name
-    # The skill and command files are at the same paths both times, so they are
-    # REPLACED rather than added; what the second directory adds is one more
-    # row per file in `INSTALLED`, on top of everything the first run recorded.
-    assert len(receipt_rows(tmp_path)) == ARTIFACTS - HOOK_ENTRIES + len(INSTALLED)
-
-
-@NEEDS_JQ
-def test_a_relative_bin_dir_is_recorded_absolute_and_asked_about_from_anywhere(tmp_path):
-    """THE RECEIPT NAMES A FILE, NOT A SPELLING OF ONE (Copilot on #103,
-    `openRepoTools:524`).
-
-    `$OPENREPOTOOLS_BIN_DIR=bin` is a directory the planner accepts, and it is
-    a different directory from every working directory it is run in. The first
-    shape recorded `bin/park` exactly as supplied, so a later run from another
-    directory compared the same string against ITS `bin/` — hashing, and
-    removing, a file that was never the one the row was written for. Every
-    destination is now recorded as a CANONICAL ABSOLUTE path, and every read
-    resolves the target the same way before it compares.
-
-    Here: an install from `here` with the relative `bin` leaves only absolute
-    rows (and drops the old-shape relative row seeded in front of it, which is
-    a row no working directory can honestly answer). Then a run from `there`
-    that names the SAME directory a different way, `../here/bin`, retires the
-    `restart` in `here/bin` on the strength of its absolute row — and leaves
-    the user's own `restart` in `there/bin`, which has no row and no marker.
-    """
-    here = tmp_path / "here"
-    there = tmp_path / "there"
-    here.mkdir()
-    (there / "bin").mkdir(parents=True)
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    receipt.write_text(
-        f"park\tbin/park\t{hashlib.sha256(b'an older park').hexdigest()}"
-        "\t2026-09-15T04:04:16Z\n", encoding="utf-8")
-
-    first = run_cmd("--install", home=tmp_path,
-                    env={"OPENREPOTOOLS_BIN_DIR": "bin"}, cwd=here)
-    assert first.returncode == 0, first.stdout + first.stderr
-    rows = receipt_rows(tmp_path)
-    assert all(row[1].startswith("/") for row in rows), (
-        "a destination was recorded as supplied:\n"
-        + receipt.read_text(encoding="utf-8"))
-    assert str(here / "bin" / "park") in {row[1] for row in rows}
-    assert len(rows) == ARTIFACTS - HOOK_ENTRIES, (
-        "the old-shape relative row was kept beside the absolute ones")
-
-    stale = here / "bin" / "restart"
-    stale.write_text("#!/usr/bin/env bash\n# restart, with no banner of any kind\n"
-                     "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    decoy = there / "bin" / "restart"
-    decoy.write_text("#!/usr/bin/env bash\n# my own restart, nothing to do with "
-                     "that installer\necho mine\n", encoding="utf-8")
-    decoy.chmod(0o755)
-    before = decoy.read_bytes()
-    with receipt.open("a", encoding="utf-8") as handle:
-        handle.write(f"restart\t{stale}"
-                     f"\t{hashlib.sha256(stale.read_bytes()).hexdigest()}"
-                     "\t2026-09-15T04:04:16Z\n")
-
-    second = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": "../here/bin"}, cwd=there)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert not stale.exists(), (
-        "the row names this file by its absolute path and its digest matches, "
-        "and a run from another directory did not recognise it:\n"
-        + second.stdout)
-    assert "receipt carries its digest" in second.stdout, second.stdout
-    assert decoy.is_file() and decoy.read_bytes() == before, (
-        "the file in the OTHER directory's bin was removed")
-    assert not [row for row in receipt_rows(tmp_path) if row[1] == str(stale)]
-
-
-@NEEDS_JQ
-def test_a_relative_row_never_names_another_directorys_file(tmp_path):
-    """THE OTHER HALF OF THE SAME FINDING: A ROW WRITTEN AS `bin/restart` IS
-    NOT EVIDENCE ABOUT ANY `bin/restart`.
-
-    This is the deletion Copilot described, set up directly — the row's
-    digest is the digest of THIS directory's file, because that is what a
-    row recorded from the other directory's `bin/` would also say about a
-    same-named file here. The old comparison was string against string, so it
-    matched and removed a file the row was never about. A relative row is
-    never matched now, and `receipt_rows_except` does not keep one, so it
-    cannot linger and answer the next run either.
-    """
-    there = tmp_path / "there"
-    (there / "bin").mkdir(parents=True)
-    mine = there / "bin" / "restart"
-    mine.write_text("#!/usr/bin/env bash\n# my own restart, nothing to do with "
-                    "that installer\necho mine\n", encoding="utf-8")
-    mine.chmod(0o755)
-    before = mine.read_bytes()
-    receipt = receipt_path(tmp_path)
-    receipt.parent.mkdir(parents=True)
-    receipt.write_text(
-        f"restart\tbin/restart\t{hashlib.sha256(before).hexdigest()}"
-        "\t2026-09-15T04:04:16Z\n", encoding="utf-8")
-
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": "bin"}, cwd=there)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert mine.is_file() and mine.read_bytes() == before, (
-        "a file was removed on the strength of a row that named a RELATIVE "
-        "path, which is a row about whichever directory the run happened to "
-        "be in:\n" + result.stdout)
-    assert "is NOT this installer's copy" in result.stdout, result.stdout
-    assert all(row[1].startswith("/") for row in receipt_rows(tmp_path)), (
-        "a relative row outlived the run:\n"
-        + receipt.read_text(encoding="utf-8"))
-
-
-@NEEDS_JQ
-def test_a_relative_data_dir_is_resolved_and_one_receipt_is_read_from_anywhere(tmp_path):
-    """THE RECEIPT'S OWN DIRECTORY IS CANONICAL TOO (Copilot round 4 on #103,
-    `openRepoTools:365`).
-
-    `$OPENREPOTOOLS_DATA_DIR=data` is accepted, and `receipt_file` handed that
-    string straight to every reader and writer, so the one printed path was
-    `data/installed.tsv` — a spelling that means a different file from every
-    working directory. The directory is now resolved (`mkdir -p` first, where
-    this run is the one making it) and every read, write and line goes through
-    the resolved path.
-
-    WHAT RESOLVING CANNOT DO is make `data` mean the same directory from two
-    working directories — a relative value names a different one from each, and
-    that is inherent in being relative. So the run SAYS so, beside the line
-    that names where the receipt went: the absolute path it resolved to and the
-    way out. Here: an install from `here` with `data` writes
-    `here/data/installed.tsv` and prints it absolute, with that note; a run from
-    `there` that names the same directory another way, `../here/data`, reads
-    the SAME receipt — the row for `restart` is found and the file removed —
-    and no second receipt appears anywhere.
-    """
-    here = tmp_path / "here"
-    there = tmp_path / "there"
-    here.mkdir()
-    there.mkdir()
-    first = run_cmd("--install", home=tmp_path,
-                    env={"OPENREPOTOOLS_DATA_DIR": "data"}, cwd=here)
-    assert first.returncode == 0, first.stdout + first.stderr
-    receipt = here / "data" / "installed.tsv"
-    assert receipt.is_file(), first.stdout
-    assert (f"receipt: {len(receipt_rows_at(receipt))} placed files recorded "
-            f"in {receipt}") in first.stdout, (
-        "the line names the receipt as a canonical absolute path:\n"
-        + first.stdout)
-    assert "a RELATIVE path" in first.stdout and f"resolved it to {receipt.parent}" \
-        in first.stdout, (
-        "a relative data directory is said out loud, with where it went:\n"
-        + first.stdout)
-
-    stale = tmp_path / ".local" / "bin" / "restart"
-    stale.write_text("#!/usr/bin/env bash\n# restart, with no banner of any kind\n"
-                     "echo stale\n", encoding="utf-8")
-    stale.chmod(0o755)
-    with receipt.open("a", encoding="utf-8") as handle:
-        handle.write(f"restart\t{stale}"
-                     f"\t{hashlib.sha256(stale.read_bytes()).hexdigest()}"
-                     "\t2026-09-15T04:04:16Z\n")
-    second = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_DATA_DIR": "../here/data"}, cwd=there)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert not stale.exists(), (
-        "the row is in the receipt the first run wrote and the second did not "
-        "read it:\n" + second.stdout)
-    assert "receipt carries its digest" in second.stdout, second.stdout
-    assert sorted(tmp_path.rglob("installed.tsv")) == [receipt], (
-        "a second receipt appeared:\n"
-        + "\n".join(str(p) for p in tmp_path.rglob("installed.tsv")))
-    assert not (there / "data").exists()
-
-
-@NEEDS_JQ
-def test_bin_dir_overrides_where_it_lands(tmp_path):
-    result = run_cmd("--install", home=tmp_path,
-                     env={"OPENREPOTOOLS_BIN_DIR": str(tmp_path / "elsewhere")})
-    assert result.returncode == 0, result.stderr
-    for name in INSTALLED:
-        assert (tmp_path / "elsewhere" / name).is_file(), name
-        assert not (tmp_path / ".local" / "bin" / name).exists(), name
-
-
-@NEEDS_JQ
-def test_install_says_how_to_put_it_on_path(tmp_path):
-    """ONE path note for everything `--install` places: the directory is the
-    same one, and the same `export` line once per file reads as a problem for
-    each of them."""
-    result = run_cmd("--install", home=tmp_path)
-    assert f'export PATH="{tmp_path}/.local/bin:$PATH"' in result.stdout
-    assert result.stdout.count("export PATH=") == 1
-
-
-@NEEDS_JQ
-def test_install_from_a_file_never_calls_gh(tmp_path):
-    """`--install` run from a file copies THOSE bytes. A machine with no `gh`
-    — or no network — must still be able to install the commands, so a `gh` on
-    $PATH that fails loudly may not be reached at all."""
-    shim = tmp_path / "bin"
-    shim.mkdir()
-    marker = tmp_path / "gh-was-called"
-    (shim / "gh").write_text(f"#!/bin/sh\ntouch {marker}\nexit 1\n",
-                             encoding="utf-8")
-    (shim / "gh").chmod(0o755)
-    result = run_cmd("--install", home=tmp_path,
-                     env={"PATH": f"{shim}:{os.environ['PATH']}"})
-    assert result.returncode == 0, result.stderr
-    assert not marker.exists(), "--install from a file must not call gh"
-    # `park` and `resume` sit BESIDE this file, so a run from a file copies
-    # the siblings it finds rather than fetching them.
-    for name in INSTALLED:
-        assert (tmp_path / ".local" / "bin" / name).is_file(), name
-
-
-# --- the fetch order, asserted against the text -----------------------------
-
-def test_the_api_is_tried_before_the_raw_url():
-    """ORDER IS THE RULE. `gh api` is authenticated and works inside an
-    organisation whose policy blocks raw.githubusercontent.com; the raw URL is
-    the fallback for a machine with no `gh` on it. Fetching cannot be tested
-    offline, so the order is read out of the script itself."""
-    text = COMMAND.read_text(encoding="utf-8")
-    body = text.split("fetch_from_repo() {", 1)[1].split("\n}", 1)[0]
-    assert "gh api" in body and "curl -fsSL" in body
-    assert body.index("gh api") < body.index("curl -fsSL"), (
-        "the raw URL is fetched before the API in fetch_from_repo(); the "
-        "authenticated call must be tried first")
-    assert "raw.githubusercontent.com" in body
-
-
-def test_the_duplicated_fetch_logic_says_so_out_loud():
-    """The forty lines this command shares with openRepoShape's shim are a
-    DELIBERATE copy, and the reason has to be in the file: a shared library
-    would be a fifth file for `--install` to place. A duplication nobody wrote
-    down is a duplication the next person removes."""
-    text = COMMAND.read_text(encoding="utf-8")
-    assert "DELIBERATE COPY" in text
-    assert "FIFTH FILE" in text
-
-
-# --- the fetch path, offline, through a fake `gh` ---------------------------
-
-def fake_github(tmp_path, served_names) -> dict:
-    """A fake `gh` serving exactly `served_names`, and a `curl` that refuses.
-
-    Factored out of the fixture so one test can WITHHOLD a file: `--install`
-    places all of them or none, and the only way to prove "or none" is a server
-    that cannot answer for one of them.
-    """
-    served = tmp_path / "served"
-    served.mkdir(exist_ok=True)
-    for name in served_names:
-        target = served / name
-        # NESTED, because one of the things `--install` fetches is not at the
-        # root: `skills/handoff/SKILL.md`. The route below matches on the
-        # whole path after `contents/`, so the file has to sit under the same
-        # shape here.
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_bytes((REPO / name).read_bytes())
-
-    fake = tmp_path / "fake-path"
-    fake.mkdir(exist_ok=True)
-    routes = "".join(
-        f"*/contents/{name}\\?*) exec cat '{served / name}' ;;\n"
-        for name in served_names)
-    # THE ONE FILE A REAL GITHUB IS ASKED FOR BEFORE ANY OF THOSE (#186,
-    # T007), answered the way it answers for a single repository: a 404 for
-    # the code pin, which `gh` reports on stderr with the status in it. Every
-    # assertion below is unchanged; the server just answers the one question
-    # the installer now asks first.
-    routes += (
-        "*/contents/contracts/code-pin.yaml\\?*) "
-        "printf 'gh: Not Found (HTTP 404)\\n' >&2; exit 1 ;;\n")
-    (fake / "gh").write_text(
-        "#!/bin/sh\n"
-        'case "$*" in\n'
-        + routes +
-        "esac\n"
-        'printf \'fake gh: unexpected call: %s\\n\' "$*" >&2\n'
-        "exit 1\n", encoding="utf-8")
-    (fake / "gh").chmod(0o755)
-    (fake / "curl").write_text(
-        "#!/bin/sh\n"
-        "printf 'fake curl: no test here may reach the network\\n' >&2\n"
-        "exit 1\n", encoding="utf-8")
-    (fake / "curl").chmod(0o755)
-    return {"PATH": f"{fake}{os.pathsep}{os.environ['PATH']}"}
-
-
-@pytest.fixture
-def offline_github(tmp_path):
-    """A fake `gh` first on `$PATH`, and a `curl` that refuses.
-
-    `fetch_from_repo` tries `gh api` before the raw URL, so a `gh` that
-    answers the calls the command makes is the whole of the server these tests
-    need: `contents/<command>` comes back as this checkout's own bytes for each
-    of the files `--install` places. `curl` is shadowed by a script that
-    exits 1 — belt and braces, so that a fake `gh` which stopped matching could
-    never quietly become a real request to raw.githubusercontent.com.
-    """
-    return fake_github(tmp_path, FETCHED)
-
-
-def test_install_places_all_or_none(tmp_path):
-    """ALL IN HAND BEFORE ANY IS PLACED (openRepoShape #82, F10 of the review
-    on its #83). One file at a time, dying on the first fetch that failed,
-    leaves a person with a NEW `openRepoTools` and no `park` — a half-install
-    that prints `installed at` and is not one — with nothing on screen to say
-    which of them were missing.
-
-    Run from stdin with `park` withheld: NOTHING is placed, nothing already
-    there is replaced, and the refusal names the file it could not fetch.
-    """
-    bin_dir = tmp_path / "bin"
-    bin_dir.mkdir()
-    # TWO older copies, so "nothing was replaced" is a claim with witnesses
-    # rather than an empty directory: the file the fetch COULD have served
-    # (`openRepoTools`) and the WORKING COMMAND whose absence upstream is what
-    # aborted the run (`park`). A person whose `park` still works must have it
-    # afterwards.
-    (bin_dir / "openRepoTools").write_text("# an older copy\n",
-                                           encoding="utf-8")
-    (bin_dir / "park").write_text("# an older park that still works\n",
-                                  encoding="utf-8")
-    withheld = fake_github(tmp_path, [n for n in FETCHED if n != "park"])
-    result = subprocess.run(
-        ["bash", "-s", "--", "--install"], capture_output=True, text=True,
-        check=False, input=COMMAND.read_text(encoding="utf-8"),
-        cwd=str(tmp_path),
-        env=command_env(home=tmp_path,
-                        env={**withheld,
-                             "OPENREPOTOOLS_BIN_DIR": str(bin_dir)}))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "could not fetch park" in result.stderr
-    assert "NOTHING was installed" in result.stderr
-    assert "nothing already installed was replaced" in result.stderr
-    assert (bin_dir / "openRepoTools").read_text(encoding="utf-8") == \
-        "# an older copy\n", "the older copy was replaced by a half-install"
-    assert (bin_dir / "park").read_text(encoding="utf-8") == \
-        "# an older park that still works\n", (
-        "a working `park` was overwritten by a run that could not fetch one")
-    assert not (bin_dir / "resume").exists()
-    assert not (bin_dir / "status").exists()
-    assert "placed" not in result.stdout
-
-
-def test_a_withheld_command_file_places_nothing_either(tmp_path):
-    """THE ALL-OR-NOTHING RULE REACHES THE COMMAND FILE (A11 Addendum 4 ruling
-    9). A `/swap` that could not be fetched beside a `/lane-swap` that could is
-    a half-install of an ALIAS PAIR — the skill installed, the alias the text
-    ratifies not, and nothing on screen saying which. `collect_skills` fetches
-    both lists before anything is placed, so this refuses with the bin
-    directory untouched.
-    """
-    bin_dir = tmp_path / "bin"
-    bin_dir.mkdir()
-    (bin_dir / "park").write_text("# an older park that still works\n",
-                                  encoding="utf-8")
-    withheld = fake_github(tmp_path,
-                           [n for n in FETCHED if n not in COMMAND_PATHS])
-    result = subprocess.run(
-        ["bash", "-s", "--", "--install"], capture_output=True, text=True,
-        check=False, input=COMMAND.read_text(encoding="utf-8"),
-        cwd=str(tmp_path),
-        env=command_env(home=tmp_path,
-                        env={**withheld,
-                             "OPENREPOTOOLS_BIN_DIR": str(bin_dir)}))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "NOTHING was installed" in result.stderr, result.stderr
-    assert (bin_dir / "park").read_text(encoding="utf-8") == \
-        "# an older park that still works\n"
-    assert not (bin_dir / "resume").exists()
-    assert not (tmp_path / ".claude").exists(), (
-        "a skill or the hook was placed by a run that could not fetch /swap")
-
-
-@NEEDS_JQ
-def test_install_from_stdin_fetches_itself_into_a_live_workdir(offline_github,
-                                                               tmp_path):
-    """The documented install line: `gh api …/contents/openRepoTools … |
-    bash -s -- --install`.
-
-    Run from stdin there is no file to copy from — not for this command, not
-    for its siblings and not for the lane helpers, the alias table or the
-    skill — so `install_commands` fetches each of them at this ref into a
-    temporary directory. THAT DIRECTORY HAS TO STILL BE THERE:
-    `workdir()` sets its EXIT trap in the main shell rather than inside a
-    `$(...)` subshell, whose trap would fire the instant the substitution
-    closed and take the directory away before a single fetched byte had landed
-    (openRepoShape #74, which made the one-line install impossible on every
-    machine).
-    """
-    bin_dir = tmp_path / "bin"
-    result = subprocess.run(
-        ["bash", "-s", "--", "--install"], capture_output=True, text=True,
-        check=False, input=COMMAND.read_text(encoding="utf-8"),
-        # cwd: `bash -s` leaves $BASH_SOURCE unset, so the command's $SELF is
-        # the literal `bash`, and `[ -f "$SELF" ]` must be false for the
-        # fetching branch to be the one under test. A directory holding
-        # nothing of that name is what guarantees it.
-        cwd=str(tmp_path),
-        env=command_env(home=tmp_path,
-                        env={**offline_github,
-                             "OPENREPOTOOLS_BIN_DIR": str(bin_dir)}))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "No such file or directory" not in result.stdout + result.stderr
-    assert "could not fetch" not in result.stderr
-    for name in INSTALLED:
-        target = bin_dir / name
-        assert target.is_file(), result.stdout + result.stderr + f" ({name})"
-        assert stat.S_IMODE(target.stat().st_mode) == 0o755, name
-        assert target.read_bytes() == (REPO / name).read_bytes(), name
-        assert f"{name}: installed at" in result.stdout
-
-
-@NEEDS_JQ
-def test_a_fetching_install_follows_the_ref_it_was_given(offline_github,
-                                                         tmp_path):
-    """`$OPENREPOTOOLS_REF` reaches the API path, so a person installing from a
-    tag or a branch gets THOSE bytes. The fake `gh` matches on
-    `*/contents/<name>?*`, so what this proves is that the run still succeeds
-    with the ref set — and the ref is in the query string the route matched."""
-    bin_dir = tmp_path / "bin"
-    result = subprocess.run(
-        ["bash", "-s", "--", "--install"], capture_output=True, text=True,
-        check=False, input=COMMAND.read_text(encoding="utf-8"),
-        cwd=str(tmp_path),
-        env=command_env(home=tmp_path,
-                        env={**offline_github,
-                             "OPENREPOTOOLS_REF": "some-branch",
-                             "OPENREPOTOOLS_BIN_DIR": str(bin_dir)}))
-    assert result.returncode == 0, result.stderr + result.stdout
-    for name in INSTALLED:
-        assert (bin_dir / name).is_file(), name
-
-
-def test_install_names_the_repository_venv_and_whether_it_is_there(tmp_path):
-    """One virtual environment per repository, outside the estate (#162):
-    `--install` names this repository's, says whether it is there, and - when
-    it is not - prints the two commands that make it. It never makes one: that
-    needs pip and the network, and an install from a checkout needs neither."""
-    cache = tmp_path / "cache"
-    venv = cache / "openRepoTools" / "venvs" / "openRepoTools"
-    first = run_cmd("--install", home=tmp_path, env={"XDG_CACHE_HOME": str(cache)})
-    assert first.returncode == 0, first.stderr
-    assert (f"openRepoTools: this repository's virtual environment is {venv} "
-            "(not created; one per repository, outside the estate):") in first.stdout
-    assert f"python3 -m venv {venv} && {venv}/bin/python3 -m pip install pytest" in first.stdout
-    assert not venv.exists(), "the install made a venv"
-    (venv / "bin").mkdir(parents=True)
-    (venv / "bin" / "python3").write_text("#!/bin/sh\nexit 0\n")
-    (venv / "bin" / "python3").chmod(0o755)
-    second = run_cmd("--install", home=tmp_path, env={"XDG_CACHE_HOME": str(cache)})
-    assert second.returncode == 0, second.stderr
-    assert f"virtual environment is {venv} (present;" in second.stdout
-
-
-def test_the_printed_venv_command_survives_a_path_with_a_space(tmp_path):
-    """Copilot round 2 on #169: the command is pasted into a shell, and the
-    cache directory is the person's to choose."""
-    cache = tmp_path / "my cache"
-    venv = cache / "openRepoTools" / "venvs" / "openRepoTools"
-    result = run_cmd("--install", home=tmp_path, env={"XDG_CACHE_HOME": str(cache)})
-    assert result.returncode == 0, result.stderr
-    (line,) = [ln.strip() for ln in result.stdout.splitlines()
-               if ln.strip().startswith("python3 -m venv ")]
-    words = shlex.split(line)
-    assert words[:4] == ["python3", "-m", "venv", str(venv)], words
-    assert words[5] == str(venv / "bin" / "python3"), words
diff --git a/tests/test_package.py b/tests/test_package.py
deleted file mode 100644
index cdd2a56b..00000000
--- a/tests/test_package.py
+++ /dev/null
@@ -1,1077 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The `openrepotools` package (#228): what `pyproject.toml` declares, the
-wheel's payload map against the installer's own list, a built wheel, and the
-console script that runs the payload.
-
-FOUR GROUPS, ONE PREFIX EACH (plan.md, "The test layout"), so that a task's
-`verify:` selects exactly its own with `-k`:
-
-- `test_metadata_*` holds contracts/wheel.md's `pyproject.toml` rules. The
-  file is read with `tomllib`, or with `tomli` where `tomllib` is missing
-  (Python 3.9 and 3.10, as in the `package` job, which installs `tomli` by
-  hash), and these tests skip, naming `tomli`, where neither imports.
-- `test_payload_map_*` holds the force-include map to the installer's
-  `payload_names`, RUN FROM THE BASH FILE and never restated here, plus the
-  openRepoShape pin, both ways round and naming every difference. The bash
-  list stays the only list (design.md Decision 2, FR-007).
-- `test_wheel_*` checks a BUILT wheel, and this suite builds none: a build
-  fetches hatchling, and the suite reaches no network (research R8). They
-  read the wheel from `OPENREPOTOOLS_TEST_WHEEL`, and skip, naming it, when
-  it is unset; the `package` job sets it and fails on any skip. They run
-  contracts/wheel.md's checks 2, 3, 5 and 6, and its member comparison,
-  against this checkout's `HEAD`.
-- `test_entry_*` runs pip's console script for `openrepotools.cli:main` in a
-  real virtual environment (`venv --without-pip`: the standard library, and
-  no network) that holds a `package_tree`. The entry module must replace its
-  own process with the first `bash` on PATH, running the packaged
-  `openRepoTools` with the person's arguments unchanged and with neither
-  signal Python ignores at start-up still ignored, and must refuse, running
-  nothing, where there is no `bash`, a `PATH` whose last entry is a file
-  included (design.md Decision 3 as amended on 2026-10-18, FR-003, FR-004).
-
-THE HELPERS ARE THE SUITE'S OWN. `command_env`, `placement_temporaries`,
-`path_without`, `SLOW_TOOLS` and `NEEDS_JQ` come from
-`tests/test_openrepotools_command.py`, `installer_function` from
-`tests/test_install_by_rename.py`, and the layouts from
-`tests/package_layout.py`.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shlex
-import shutil
-import signal
-import stat
-import subprocess
-import sys
-import time
-import zipfile
-from pathlib import Path
-from typing import NamedTuple
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-from package_layout import PAYLOAD_PREFIX, console_script, package_tree
-from test_install_by_rename import installer_function
-from test_openrepotools_command import (NEEDS_JQ, SLOW_TOOLS, command_env,
-                                        path_without, placement_temporaries)
-
-try:
-    import tomllib as TOML
-except ImportError:   # Python 3.9 and 3.10
-    try:
-        import tomli as TOML
-    except ImportError:
-        TOML = None
-
-COMMAND = REPO / "openRepoTools"
-PYPROJECT = REPO / "pyproject.toml"
-BUILD_LOCK = REPO / ".github" / "release-build-requirements.txt"
-
-#: THE ONE PAYLOAD FILE THAT IS NOT ON THE INSTALLER'S LIST. `wip init` reads
-#: the openRepoShape pin from beside the installer (`wip_shape_ref`), so the
-#: wheel carries it as the force-include map's 24th entry, after the
-#: installer's own 23.
-PIN = "contracts/openreposhape-pin.yaml"
-
-#: contracts/wheel.md's `pyproject.toml`, as the tests below hold it.
-HATCHLING = "hatchling==1.27.0"
-SCRIPTS = {"openRepoTools": "openrepotools.cli:main"}
-STAMP = "src/openrepotools/_release.py"
-PACKAGES = ["src/openrepotools"]
-
-#: `[project]`'s keys: the ones the contract declares, and the four it allows
-#: "as the model has them". Any other, such as `readme`, a static `version`,
-#: `optional-dependencies`, `gui-scripts` or `entry-points`, changes what the
-#: wheel holds or what its metadata says.
-PROJECT_KEYS = ("name", "dynamic", "requires-python", "license",
-                "license-files", "dependencies", "scripts")
-PROJECT_KEYS_ALLOWED = ("description", "authors", "classifiers", "urls")
-
-#: THE WHEEL'S MEMBERS beside the payload (contracts/wheel.md): the three
-#: modules, and the five names in `openrepotools-<version>.dist-info/`.
-MODULES = ("__init__.py", "cli.py", "_release.py")
-DIST_INFO = ("METADATA", "WHEEL", "RECORD", "entry_points.txt",
-             "licenses/LICENSE")
-
-WHEEL_VARIABLE = "OPENREPOTOOLS_TEST_WHEEL"
-
-#: contracts/cli-output.md's one refusal that does not go through `die`: the
-#: entry module's own, so it has no blank line before it.
-NO_BASH = ("REFUSED: openRepoTools needs bash, and there is no bash on this "
-           "PATH. Nothing ran.")
-
-NEEDS_BASH = pytest.mark.skipif(shutil.which("bash") is None,
-                                reason="openRepoTools is a bash script")
-
-
-def listed(problems: list) -> str:
-    return "\n  " + "\n  ".join(problems)
-
-
-# --- pyproject.toml ----------------------------------------------------------
-
-@pytest.fixture(scope="module")
-def pyproject() -> dict:
-    """`pyproject.toml` as a TOML parser reads it, or a skip naming `tomli`."""
-    if TOML is None:
-        pytest.skip("pyproject.toml is read with tomllib (Python 3.11 and up) "
-                    "or with tomli, and neither imports here: install tomli, "
-                    "as the package job does (tomli==2.4.1, by hash)")
-    with PYPROJECT.open("rb") as handle:
-        return TOML.load(handle)
-
-
-def project_table(pyproject: dict) -> dict:
-    table = pyproject.get("project")
-    assert isinstance(table, dict), "pyproject.toml has no [project] table"
-    return table
-
-
-def table_problems(where: str, table, keys) -> list:
-    """What `table` lacks of `keys`, and what it holds beyond them."""
-    if not isinstance(table, dict):
-        return [f"[{where}] is missing, or is not a table"]
-    return ([f"[{where}] has no `{key}`" for key in keys if key not in table]
-            + [f"[{where}] has `{key}`, which contracts/wheel.md does not "
-               "declare" for key in table if key not in keys])
-
-
-def test_metadata_builds_with_hatchling_at_its_one_pin(pyproject):
-    """`[build-system]` is hatchling at exactly 1.27.0, and nothing else.
-
-    1.27.0 is the newest hatchling that still runs on Python 3.9, the oldest
-    this package supports, and hatchling's `force-include` is what puts the
-    payload in the wheel with no build hook (design.md Decision 2). A range
-    would make the wheel's bytes depend on the day it was built.
-    """
-    assert pyproject.get("build-system") == {
-        "requires": [HATCHLING], "build-backend": "hatchling.build"}, (
-        f"[build-system] is {pyproject.get('build-system')!r}")
-
-
-def test_metadata_the_build_lock_names_the_same_hatchling(pyproject):
-    """`requires` IS THE BUILD LOCK'S HATCHLING (contracts/wheel.md).
-
-    The release build installs its tools from the lock and builds with
-    `--no-isolation`, so a lock naming another hatchling would build the
-    release with a backend this file does not name. The lock is
-    `tests/test_release_workflow.py`'s to hold in full; this holds the one
-    line the two files share, from this file's side.
-    """
-    if not BUILD_LOCK.is_file():
-        pytest.skip(f"{BUILD_LOCK.relative_to(REPO)} is not in this checkout, "
-                    f"so there is no build lock to hold to {HATCHLING}")
-    requires = pyproject.get("build-system", {}).get("requires", [])
-    wanted = {r.split("==", 1)[1] for r in requires
-              if isinstance(r, str) and r.startswith("hatchling==")}
-    pins = re.findall(r"(?m)^hatchling==([^\s;\\]+)",
-                      BUILD_LOCK.read_text(encoding="utf-8"))
-    assert pins and wanted and set(pins) == wanted, (
-        f"{BUILD_LOCK.relative_to(REPO)} pins hatchling at {pins or 'nothing'}, "
-        f"and pyproject.toml requires {requires}")
-
-
-def test_metadata_names_the_package_and_reads_its_version_from_the_stamp(
-        pyproject):
-    """`openrepotools`, with a DYNAMIC version read from the stamp alone.
-
-    The tag is the one source of a version (FR-009): the release build writes
-    it into `src/openrepotools/_release.py`, and `[tool.hatch.version]` reads
-    it from there. A static `version` here would be a second number in a
-    second file.
-    """
-    table = project_table(pyproject)
-    assert table.get("name") == "openrepotools", table.get("name")
-    assert table.get("dynamic") == ["version"], table.get("dynamic")
-    assert "version" not in table, (
-        f"[project] carries a static version, {table['version']!r}")
-    version = pyproject.get("tool", {}).get("hatch", {}).get("version")
-    assert version == {"path": STAMP}, f"[tool.hatch.version] is {version!r}"
-
-
-def test_metadata_requires_python_3_9_or_later(pyproject):
-    """3.9 is the `package` job's Python and the install check's oldest leg."""
-    assert project_table(pyproject).get("requires-python") == ">=3.9", (
-        project_table(pyproject).get("requires-python"))
-
-
-def test_metadata_declares_no_dependencies(pyproject):
-    """NONE (FR-001): the payload is bash, the entry module is the standard
-    library, and what the payload runs it finds on PATH, as a checkout's
-    does. A dependency would also be a fetch the offline install cannot
-    make."""
-    assert project_table(pyproject).get("dependencies") == [], (
-        project_table(pyproject).get("dependencies"))
-
-
-def test_metadata_declares_exactly_one_console_script(pyproject):
-    """`openRepoTools`, the name a checkout's `--install` places, and no
-    other (FR-001; a second console script is a non-goal)."""
-    assert project_table(pyproject).get("scripts") == SCRIPTS, (
-        project_table(pyproject).get("scripts"))
-
-
-def test_metadata_declares_no_readme(pyproject):
-    """README.md goes to the assembly root at the triad cutover, while this
-    file goes to the code leg: a `readme` would name a file the release's
-    own tree does not hold (FR-001)."""
-    table = project_table(pyproject)
-    assert "readme" not in table, f"[project] has readme = {table['readme']!r}"
-
-
-def test_metadata_is_apache_2_0_with_the_license_file(pyproject):
-    table = project_table(pyproject)
-    assert table.get("license") == "Apache-2.0", table.get("license")
-    assert table.get("license-files") == ["LICENSE"], table.get("license-files")
-
-
-def test_metadata_project_declares_nothing_the_contract_does_not(pyproject):
-    """`[project]` holds the contract's keys, and only the four it allows
-    beside them: `description`, `authors`, `classifiers` and `urls`."""
-    table = project_table(pyproject)
-    problems = [f"[project] has no `{key}`" for key in PROJECT_KEYS
-                if key not in table]
-    problems += [f"[project] has `{key}`, which contracts/wheel.md neither "
-                 "declares nor allows" for key in table
-                 if key not in PROJECT_KEYS and key not in PROJECT_KEYS_ALLOWED]
-    assert not problems, "pyproject.toml's [project] is not the contract's:" \
-        + listed(problems)
-
-
-def test_metadata_no_other_hatch_table_changes_what_the_wheel_holds(pyproject):
-    """`[tool.hatch]` IS THE CONTRACT'S THREE DECLARATIONS AND NOTHING ELSE:
-    the version's path, the wheel's `packages`, and the force-include map.
-
-    Any other hatch key (a build hook, `include`, `exclude`, `only-include`,
-    `sources`, `artifacts`, `reproducible`, another target) can change what
-    the wheel holds or how its bytes come out, so a new one is a change to
-    contracts/wheel.md first, and to this test with it.
-    """
-    hatch = pyproject.get("tool", {}).get("hatch")
-    problems = table_problems("tool.hatch", hatch, ("version", "build"))
-    if isinstance(hatch, dict):
-        problems += table_problems("tool.hatch.version", hatch.get("version"),
-                                   ("path",))
-        build = hatch.get("build")
-        problems += table_problems("tool.hatch.build", build, ("targets",))
-        targets = build.get("targets") if isinstance(build, dict) else None
-        problems += table_problems("tool.hatch.build.targets", targets,
-                                   ("wheel",))
-        wheel = targets.get("wheel") if isinstance(targets, dict) else None
-        problems += table_problems("tool.hatch.build.targets.wheel", wheel,
-                                   ("packages", "force-include"))
-        if isinstance(wheel, dict) and "packages" in wheel \
-                and wheel["packages"] != PACKAGES:
-            problems.append(f"[tool.hatch.build.targets.wheel] packages is "
-                            f"{wheel['packages']!r}, not {PACKAGES!r}")
-    assert not problems, "pyproject.toml's hatch tables are not the contract's:" \
-        + listed(problems)
-
-
-# --- the force-include map against `payload_names` ---------------------------
-
-#: Where the installer's argument loop begins. Every line above it defines a
-#: list, a value or a function; the loop is where the command starts acting.
-ARGUMENT_LOOP = re.compile(r"^while \[ \$# -gt 0 \]; do$", re.MULTILINE)
-
-
-@pytest.fixture(scope="module")
-def payload_list(tmp_path_factory) -> list:
-    """`payload_names`, as the installer runs it.
-
-    RUN FROM THE BASH FILE, NEVER RESTATED: the harness is every line of
-    `openRepoTools` above its argument loop, which defines the lists and the
-    functions, and then one call of `payload_names`. So whatever that
-    function derives its list from, this reads the list it derives. The
-    harness is a file, and not `bash -c`, because the installer is longer
-    than Linux lets one argument be (128 KiB).
-    """
-    text = COMMAND.read_text(encoding="utf-8")
-    loops = [match.start() for match in ARGUMENT_LOOP.finditer(text)]
-    assert len(loops) == 1, (
-        f"{COMMAND} has {len(loops)} argument loops at column 0, not one, so "
-        "the harness cannot tell where its definitions end")
-    where = tmp_path_factory.mktemp("payload-names")
-    harness = where / "payload-names.sh"
-    harness.write_text(text[:loops[0]] + "payload_names\n", encoding="utf-8")
-    result = subprocess.run(["bash", str(harness)], capture_output=True,
-                            text=True, check=False, stdin=subprocess.DEVNULL,
-                            env=command_env(where), cwd=str(where))
-    assert result.returncode == 0, (
-        f"`payload_names`, run from {COMMAND}, exited {result.returncode}:\n"
-        f"{result.stdout}{result.stderr}")
-    names = result.stdout.splitlines()
-    assert names, f"`payload_names`, run from {COMMAND}, printed nothing"
-    return names
-
-
-@pytest.fixture(scope="module")
-def force_include(pyproject) -> dict:
-    table = (pyproject.get("tool", {}).get("hatch", {}).get("build", {})
-             .get("targets", {}).get("wheel", {}).get("force-include"))
-    assert isinstance(table, dict) and table, (
-        "pyproject.toml has no [tool.hatch.build.targets.wheel.force-include] "
-        "table, or an empty one")
-    return table
-
-
-@NEEDS_BASH
-def test_payload_map_keys_are_payload_names_and_the_pin_both_ways(
-        force_include, payload_list):
-    """ONE LIST (design.md Decision 2, FR-007). Every path the installer's
-    `payload_names` prints, and the openRepoShape pin, is a key of the
-    force-include map, and every key is one of them. Each difference is
-    named, either way round: a payload file joins both lists in one commit.
-    """
-    expected = payload_list + [PIN]
-    problems = [f"{name}: payload_names prints it, and the map has no key for it"
-                for name in payload_list if name not in force_include]
-    if PIN not in force_include:
-        problems.append(f"{PIN}: the openRepoShape pin `wip init` reads, and "
-                        "the map has no key for it")
-    problems += [f"{key}: a key of the map, and neither in payload_names nor "
-                 "the pin" for key in force_include if key not in expected]
-    problems += [f"{name}: payload_names and the pin name it "
-                 f"{expected.count(name)} times"
-                 for name in sorted(set(expected)) if expected.count(name) > 1]
-    assert not problems, (
-        "pyproject.toml's force-include map is not the installer's "
-        "payload_names plus the pin:" + listed(problems))
-
-
-def test_payload_map_puts_each_path_at_openrepotools_payload(force_include):
-    """Each entry is `"<P>" = "openrepotools/payload/<P>"`: the payload keeps
-    its own relative paths inside the package, so the packaged
-    `openRepoTools` finds its siblings, its skills and the pin beside itself
-    exactly as a checkout's does."""
-    wrong = [f'"{key}" = "{value}", not "{PAYLOAD_PREFIX}{key}"'
-             for key, value in force_include.items()
-             if value != PAYLOAD_PREFIX + key]
-    assert not wrong, "force-include entries placed elsewhere:" + listed(wrong)
-
-
-@NEEDS_BASH
-def test_payload_map_lists_payload_names_in_its_own_order_then_the_pin(
-        force_include, payload_list):
-    """The map is written in `payload_names`' own order, then the pin, as
-    `pyproject.toml`'s comment says and `package_layout` reads it, so the two
-    lists can be read against each other line by line."""
-    assert list(force_include) == payload_list + [PIN], (
-        "the force-include keys are not payload_names' order then the pin:\n"
-        f"  map:      {list(force_include)}\n"
-        f"  expected: {payload_list + [PIN]}")
-
-
-# --- a built wheel -----------------------------------------------------------
-
-@pytest.fixture(scope="module")
-def built_wheel():
-    """The wheel `OPENREPOTOOLS_TEST_WHEEL` names, open, or a skip naming it."""
-    value = os.environ.get(WHEEL_VARIABLE, "")
-    if not value:
-        pytest.skip(f"{WHEEL_VARIABLE} is unset: these tests check a built "
-                    "wheel, and the suite builds none (a build fetches "
-                    "hatchling). Set it to a wheel built from this checkout's "
-                    "HEAD, as the package job does")
-    path = Path(value)
-    if not path.is_file():
-        pytest.fail(f"{WHEEL_VARIABLE}={value} names no file (read from "
-                    f"{Path.cwd()})", pytrace=False)
-    try:
-        archive = zipfile.ZipFile(path)
-    except zipfile.BadZipFile as error:
-        pytest.fail(f"{WHEEL_VARIABLE}={value} is not a wheel: {error}",
-                    pytrace=False)
-    with archive:
-        yield archive
-
-
-@pytest.fixture(scope="module")
-def head_tree() -> dict:
-    """Every path at this checkout's HEAD, as `(mode, type, object)`: the
-    commit a built wheel is held to."""
-    result = subprocess.run(["git", "ls-tree", "-r", "-z", "HEAD"],
-                            cwd=str(REPO), capture_output=True, check=False)
-    assert result.returncode == 0, (
-        f"`git ls-tree -r HEAD` failed in {REPO}:\n"
-        + result.stderr.decode("utf-8", "replace"))
-    tree = {}
-    for record in result.stdout.split(b"\0"):
-        if record:
-            meta, _, path = record.partition(b"\t")
-            mode, kind, sha = meta.decode("ascii").split(" ")
-            tree[path.decode("utf-8")] = (mode, kind, sha)
-    return tree
-
-
-def blob(sha: str) -> bytes:
-    result = subprocess.run(["git", "cat-file", "blob", sha], cwd=str(REPO),
-                            capture_output=True, check=False)
-    assert result.returncode == 0, f"`git cat-file blob {sha}` failed in {REPO}"
-    return result.stdout
-
-
-def dist_info_dirs(archive: zipfile.ZipFile) -> list:
-    return sorted({name.split("/", 1)[0] for name in archive.namelist()
-                   if name.split("/", 1)[0].endswith(".dist-info")})
-
-
-def test_wheel_payload_is_the_commits_blobs_byte_for_byte_and_mode_for_mode(
-        built_wheel, head_tree):
-    """contracts/wheel.md's CHECK 2 (FR-006).
-
-    Each `openrepotools/payload/<P>` is `git show HEAD:<P>` byte for byte,
-    and its mode is the one hatchling 1.27.0's reproducible build gives the
-    commit's: 0755 for `100755` and 0644 for `100644` (clarifications N4). A
-    `.gitattributes` filter that changed a byte is caught here, before
-    anything ships.
-    """
-    members = [info for info in built_wheel.infolist()
-               if info.filename.startswith(PAYLOAD_PREFIX)
-               and not info.filename.endswith("/")]
-    problems = [] if members else [f"the wheel holds nothing under "
-                                   f"{PAYLOAD_PREFIX}"]
-    for info in members:
-        rel = info.filename[len(PAYLOAD_PREFIX):]
-        mode, kind, sha = head_tree.get(rel, ("", "", ""))
-        if kind != "blob" or mode not in ("100644", "100755"):
-            problems.append(f"{info.filename}: HEAD holds no regular file {rel}"
-                            + (f" (it holds a {kind} at {mode})" if kind else ""))
-            continue
-        if built_wheel.read(info) != blob(sha):
-            problems.append(f"{info.filename}: its bytes are not HEAD's blob "
-                            f"{sha[:12]} of {rel}")
-        want = 0o755 if mode == "100755" else 0o644
-        got = stat.S_IMODE(info.external_attr >> 16)
-        if got != want:
-            problems.append(f"{info.filename}: mode {got:04o}, and HEAD's "
-                            f"{mode} gives {want:04o}")
-    assert not problems, "the wheel's payload is not HEAD's:" + listed(problems)
-
-
-def test_wheel_modules_are_the_commits_own(built_wheel, head_tree):
-    """contracts/wheel.md's CHECK 3: each `openrepotools/<name>.py` other
-    than the stamp is `src/openrepotools/<name>.py` at HEAD, byte for byte.
-    The stamp is check 4's: the `package` job's wheel holds the committed one
-    and a release's holds its own, and each workflow holds that itself."""
-    problems = []
-    for info in built_wheel.infolist():
-        match = re.fullmatch(r"openrepotools/([^/]+\.py)", info.filename)
-        if not match or match.group(1) == "_release.py":
-            continue
-        source = f"src/openrepotools/{match.group(1)}"
-        mode, kind, sha = head_tree.get(source, ("", "", ""))
-        if kind != "blob":
-            problems.append(f"{info.filename}: HEAD holds no {source}")
-        elif built_wheel.read(info) != blob(sha):
-            problems.append(f"{info.filename}: its bytes are not HEAD's {source}")
-    assert not problems, "the wheel's modules are not HEAD's:" + listed(problems)
-
-
-def test_wheel_dist_info_is_the_five_names_with_the_commits_license(
-        built_wheel, head_tree):
-    """contracts/wheel.md's CHECK 5 (FR-002).
-
-    One `openrepotools-<version>.dist-info/`, holding exactly `METADATA`,
-    `WHEEL`, `RECORD`, `entry_points.txt` and `licenses/LICENSE`, and that
-    `LICENSE` is HEAD's. THIS check, not hatchling, makes a missing `LICENSE`
-    fatal: hatchling 1.27.0's `license-files` glob raises nothing for a
-    pattern that matches no file.
-    """
-    dirs = dist_info_dirs(built_wheel)
-    assert len(dirs) == 1 and re.fullmatch(r"openrepotools-[^/-]+\.dist-info",
-                                           dirs[0]), (
-        f"the wheel's .dist-info directories are {dirs}, not one "
-        "openrepotools-<version>.dist-info")
-    prefix = dirs[0] + "/"
-    held = [name[len(prefix):] for name in built_wheel.namelist()
-            if name.startswith(prefix)]
-    problems = [f"{prefix}{name}: missing" for name in DIST_INFO
-                if name not in held]
-    problems += [f"{prefix}{name}: not one of the five names" for name in held
-                 if name not in DIST_INFO]
-    mode, kind, sha = head_tree.get("LICENSE", ("", "", ""))
-    if kind != "blob":
-        problems.append("HEAD holds no LICENSE, and a wheel of it must not ship")
-    elif "licenses/LICENSE" in held \
-            and built_wheel.read(prefix + "licenses/LICENSE") != blob(sha):
-        problems.append(f"{prefix}licenses/LICENSE: its bytes are not HEAD's "
-                        "LICENSE")
-    assert not problems, "the wheel's .dist-info is not FR-002's:" \
-        + listed(problems)
-
-
-@NEEDS_BASH
-def test_wheel_holds_its_member_list_and_nothing_else(built_wheel,
-                                                      payload_list):
-    """contracts/wheel.md's CHECK 6, AND ITS LIST HELD THE OTHER WAY TOO.
-
-    The members are the three modules, the 24 payload files and the five
-    `.dist-info` names, and "the wheel holds nothing else": a member outside
-    the list is named, and so is one the list has and the wheel lacks, which
-    checks 2, 3 and 5 alone would pass over. A wheel without `cli.py` has no
-    console script to run. A name the archive holds twice is named too.
-    """
-    names = built_wheel.namelist()
-    dirs = dist_info_dirs(built_wheel)
-    expected = ([f"openrepotools/{module}" for module in MODULES]
-                + [PAYLOAD_PREFIX + rel for rel in payload_list + [PIN]]
-                + [f"{d}/{name}" for d in dirs[:1] for name in DIST_INFO])
-    problems = [] if len(dirs) == 1 else [f"the wheel has {len(dirs)} "
-                                          f".dist-info directories: {dirs}"]
-    problems += [f"{name}: in the wheel {names.count(name)} times"
-                 for name in sorted(set(names)) if names.count(name) > 1]
-    problems += [f"{name}: in the wheel, and not on its member list"
-                 for name in sorted(set(names)) if name not in expected]
-    problems += [f"{name}: on the member list, and not in the wheel"
-                 for name in expected if name not in names]
-    assert not problems, "the wheel's members are not contracts/wheel.md's:" \
-        + listed(problems)
-
-
-@NEEDS_BASH
-def test_wheel_payload_members_are_payload_names_and_the_pin_both_ways(
-        built_wheel, payload_list):
-    """THE MEMBER COMPARISON (FR-007): the wheel's payload members against
-    the installer's `payload_names` plus the pin, both ways round, each
-    difference named. An `export-ignore` on a payload path, or a map entry
-    that hatchling dropped, fails here."""
-    expected = payload_list + [PIN]
-    held = [name[len(PAYLOAD_PREFIX):] for name in built_wheel.namelist()
-            if name.startswith(PAYLOAD_PREFIX)]
-    problems = [f"{rel}: payload_names or the pin names it, and the wheel has "
-                f"no {PAYLOAD_PREFIX}{rel}" for rel in expected if rel not in held]
-    problems += [f"{PAYLOAD_PREFIX}{rel}: in the wheel, and neither in "
-                 "payload_names nor the pin" for rel in held if rel not in expected]
-    assert not problems, ("the wheel's payload is not payload_names plus the "
-                          "pin:" + listed(problems))
-
-
-# --- the console script ------------------------------------------------------
-
-class Installed(NamedTuple):
-    """A `package_tree` in a real virtual environment, and pip's console
-    script for it."""
-    prefix: Path
-    python: Path
-    payload: Path
-    script: Path
-
-
-@pytest.fixture(scope="module")
-def installed(tmp_path_factory) -> Installed:
-    """THE PACKAGE AS pip INSTALLS IT, WITHOUT pip AND WITHOUT A WHEEL.
-
-    `python -m venv --without-pip` makes a real environment from the standard
-    library alone, so its own `bin/python` imports from its own
-    `site-packages`. `package_tree` builds the package there from this
-    checkout, and `console_script` writes pip's script for the entry point at
-    `bin/openRepoTools`, naming that `python`, in the form pip itself would
-    choose for the path. Nothing is fetched.
-
-    The fixture proves that the environment imports the package before any
-    test runs. So a test that fails on `openrepotools.cli` fails on the
-    entry module, never on the layout.
-    """
-    prefix = tmp_path_factory.mktemp("entry") / "prefix"
-    made = subprocess.run([sys.executable, "-m", "venv", "--without-pip",
-                           str(prefix)], capture_output=True, text=True,
-                          check=False)
-    assert made.returncode == 0, (
-        f"the fixture could not make a virtual environment at {prefix}:\n"
-        f"{made.stdout}{made.stderr}")
-    python = prefix / "bin" / "python"
-    asked = subprocess.run(
-        [str(python), "-I", "-c",
-         "import sysconfig; print(sysconfig.get_paths()['purelib'])"],
-        capture_output=True, text=True, check=False)
-    assert asked.returncode == 0, f"{python} would not run:\n{asked.stderr}"
-    purelib = Path(asked.stdout.strip())
-    try:
-        parts = purelib.resolve().relative_to(prefix.resolve()).parts
-    except ValueError:
-        parts = ()
-    assert (len(parts) == 3 and parts[0] == "lib"
-            and parts[2] == "site-packages"), (
-        f"the environment's site-packages is {purelib}, not "
-        f"{prefix}/lib/<python>/site-packages, the layout package_tree builds")
-    payload = package_tree(prefix, parts[1])
-    imported = subprocess.run(
-        [str(python), "-I", "-c",
-         "import openrepotools; print(openrepotools.__file__)"],
-        capture_output=True, text=True, check=False)
-    assert (imported.returncode == 0
-            and Path(imported.stdout.strip()).resolve()
-            == (payload.parent / "__init__.py").resolve()), (
-        f"{python} does not import the package_tree at {payload.parent}:\n"
-        f"{imported.stdout}{imported.stderr}")
-    script = console_script(prefix / "bin" / "openRepoTools", str(python))
-    return Installed(prefix, python, payload, script)
-
-
-def said(result) -> str:
-    return (f"exit {result.returncode}\n--- stdout\n{result.stdout}"
-            f"--- stderr\n{result.stderr}")
-
-
-def run_entry(script: Path, *args: str, home: Path, env: dict | None = None,
-              cwd: Path | None = None) -> subprocess.CompletedProcess:
-    """The console script, run as a person runs it: by its path, so the
-    kernel reads its first line. Stdin is a pipe, never a terminal."""
-    return subprocess.run([str(script), *args], capture_output=True,
-                          text=True, check=False, input="",
-                          env=command_env(home, env),
-                          cwd=None if cwd is None else str(cwd))
-
-
-def recording_bash(directory: Path, record: Path) -> Path:
-    """A `bash` that writes down what it was given and runs nothing.
-
-    It writes its own pid, then each argument in brackets on a line of its
-    own, and exits 0. First on PATH, it is the `bash` the entry module's
-    `execvp` finds; the pid says whether that `bash` runs in the console
-    script's own process. No argument a test passes holds a newline.
-    """
-    directory.mkdir(parents=True, exist_ok=True)
-    shim = directory / "bash"
-    shim.write_text("#!/bin/sh\n"
-                    "{\n"
-                    "\tprintf '%s\\n' \"$$\"\n"
-                    "\tfor arg in \"$@\"; do printf '[%s]\\n' \"$arg\"; done\n"
-                    "} > " + shlex.quote(str(record)) + "\n"
-                    "exit 0\n", encoding="utf-8")
-    shim.chmod(0o755)
-    return shim
-
-
-def read_record(record: Path) -> tuple:
-    """`(pid, [argument, ...])`, as `recording_bash` wrote them."""
-    lines = record.read_text(encoding="utf-8").split("\n")
-    assert len(lines) >= 2 and lines[-1] == "", f"a torn record: {lines!r}"
-    arguments = []
-    for line in lines[1:-1]:
-        assert line.startswith("[") and line.endswith("]"), (
-            f"a record line that is not one argument: {line!r}")
-        arguments.append(line[1:-1])
-    return int(lines[0]), arguments
-
-
-#: Arguments a shell would split, glob or expand, and an empty one: each must
-#: reach `bash` exactly as given.
-EXEC_ARGUMENTS = ("wip", "init", "two words", "*", "$HOME", "", "--version")
-
-
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_entry_execs_the_first_bash_on_path_with_the_payload_and_the_arguments(
-        installed, tmp_path):
-    """DESIGN.MD DECISION 3, WORD FOR WORD (FR-003).
-
-    The console script runs `os.execvp("bash", ["bash", <payload>/openRepoTools,
-    *sys.argv[1:]])`: the FIRST `bash` on PATH, in the console script's OWN
-    PROCESS, given the packaged `openRepoTools` by its absolute path and then
-    the person's arguments unchanged, and nothing beyond them. The pid is
-    what tells an exec from a child: a child's signals and exit status would
-    come back through Python, and its `EXIT` trap would run in a process the
-    person's terminal does not own.
-    """
-    record = tmp_path / "bash-was-given"
-    shim = recording_bash(tmp_path / "first-on-path", record)
-    home = tmp_path / "home"
-    home.mkdir()
-    run = subprocess.Popen(
-        [str(installed.script), *EXEC_ARGUMENTS], stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-        env=command_env(home, {
-            "PATH": f"{shim.parent}{os.pathsep}{os.environ['PATH']}"}),
-        cwd=str(tmp_path))
-    out, err = run.communicate(timeout=60)
-    assert run.returncode == 0 and record.is_file(), (
-        "the console script never ran the first bash on PATH:\n"
-        f"exit {run.returncode}\n--- stdout\n{out}--- stderr\n{err}")
-    pid, given = read_record(record)
-    assert pid == run.pid, (
-        f"bash ran as pid {pid}, and the console script was pid {run.pid}: "
-        "the entry module ran bash as a child instead of replacing itself")
-    assert given[:1] and os.path.isabs(given[0]) and (
-        Path(given[0]).resolve() == (installed.payload / "openRepoTools").resolve()), (
-        f"bash was given {given[:1]} as its script, not the packaged "
-        f"{installed.payload / 'openRepoTools'}")
-    assert given[1:] == list(EXEC_ARGUMENTS), (
-        f"the arguments reached bash as {given[1:]!r}, not as given: "
-        f"{list(EXEC_ARGUMENTS)!r}")
-
-
-#: `(arguments, what the payload's refusal says)`: the top-level parser's
-#: refusal, `--install`'s refusal of a second argument, `wip`'s two, and one
-#: whose argument the refusal repeats back, spaces, glob and `$` included.
-REFUSED_ARGUMENTS = [
-    (("Atlas",), "installs the estate commands and creates the workspace they read"),
-    (("--install", "Atlas"), "creates the workspace they read"),
-    (("wip", "destroy"), "`wip destroy` is not a thing this command does"),
-    (("wip", "init", "--org"), "--org needs a value"),
-    (("wip", "init", "two words * $HOME"), "It got 'two words * $HOME'."),
-]
-
-
-@pytest.mark.parametrize("form", ["shebang", "trampoline"])
-@pytest.mark.parametrize(
-    "arguments, says", REFUSED_ARGUMENTS,
-    ids=["unknown", "install-and-more", "wip-verb", "wip-option-value",
-         "argument-repeated"])
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_entry_a_refused_argument_is_the_payloads_own_refusal(
-        installed, tmp_path, form, arguments, says):
-    """US1 SCENARIO 6: WHEN THE PAYLOAD REFUSES, THE CONSOLE SCRIPT ADDS
-    NOTHING. Its exit status, its stdout and its stderr are exactly what
-    `bash <payload>/openRepoTools` gives for the same arguments, in both
-    forms pip writes a console script in (a `#!` line, and the `/bin/sh`
-    trampoline for a long or spaced interpreter path). Nothing is placed.
-    """
-    script = console_script(tmp_path / "bin" / "openRepoTools",
-                            str(installed.python), form=form)
-    home = tmp_path / "home"
-    home.mkdir()
-    direct = subprocess.run(
-        ["bash", str(installed.payload / "openRepoTools"), *arguments],
-        capture_output=True, text=True, check=False, input="",
-        env=command_env(home), cwd=str(tmp_path))
-    assert direct.returncode == 2 and says in direct.stderr, (
-        "the case is wrong: the payload itself does not refuse it that way:\n"
-        + said(direct))
-    through = run_entry(script, *arguments, home=home, cwd=tmp_path)
-    assert (through.returncode, through.stdout, through.stderr) == (
-        direct.returncode, direct.stdout, direct.stderr), (
-        "the console script's answer is not the payload's own.\n"
-        f"=== the console script\n{said(through)}\n"
-        f"=== bash <payload>/openRepoTools\n{said(direct)}")
-    assert list(home.iterdir()) == [], "a refused run placed something"
-
-
-def kill_group(run: subprocess.Popen) -> None:
-    """SIGKILL to the session a run was started in, if any of it is left."""
-    if run.poll() is None:
-        try:
-            os.killpg(run.pid, signal.SIGKILL)
-        except ProcessLookupError:
-            pass
-
-
-@pytest.mark.parametrize("slow", sorted(SLOW_TOOLS))
-@NEEDS_BASH
-@WINDOWS_SKIP
-@NEEDS_JQ
-def test_entry_a_sigterm_mid_placement_leaves_no_placement_temporary(
-        installed, tmp_path, slow):
-    """US1 SCENARIO 7, THROUGH THE CONSOLE SCRIPT (FR-003).
-
-    A package-mode `--install` started by the console script is holding a
-    placement temporary, made slow by a `cp` or a `mktemp` first on PATH, as
-    `tests/test_openrepotools_command.py`'s own case makes it. A SIGTERM
-    goes to the pid the person started, and only to it. Because the entry
-    module replaced itself with bash, that pid IS the payload's bash: its
-    `EXIT` trap removes the temporary, and the run dies of the signal with
-    the install unfinished. Run as a child instead, Python would die, and
-    the payload's bash would go on placing files nobody asked it to.
-    """
-    real = shutil.which(slow)
-    if real is None:
-        pytest.skip(f"no real `{slow}` on PATH for the slow one to defer to")
-    shim = tmp_path / f"slow-{slow}"
-    shim.mkdir()
-    (shim / slow).write_text(
-        "#!/bin/sh\n" + SLOW_TOOLS[slow].format(real=real), encoding="utf-8")
-    (shim / slow).chmod(0o755)
-    home = tmp_path / "home"
-    home.mkdir()
-
-    def default_signals() -> None:
-        signal.signal(signal.SIGINT, signal.SIG_DFL)
-        signal.signal(signal.SIGTERM, signal.SIG_DFL)
-
-    run = subprocess.Popen(
-        [str(installed.script), "--install"], stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-        env=command_env(home, {
-            "PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"}),
-        cwd=str(tmp_path), start_new_session=True, preexec_fn=default_signals)
-    try:
-        deadline = time.monotonic() + 60
-        while (time.monotonic() < deadline and run.poll() is None
-               and not placement_temporaries(home)):
-            time.sleep(0.05)
-        if not placement_temporaries(home):
-            kill_group(run)
-            out, err = run.communicate(timeout=60)
-            pytest.fail("no placement ever made a temporary for the signal to "
-                        f"land beside:\nexit {run.returncode}\n--- stdout\n"
-                        f"{out}--- stderr\n{err}", pytrace=False)
-        run.send_signal(signal.SIGTERM)
-        try:
-            out, err = run.communicate(timeout=60)
-        except subprocess.TimeoutExpired:
-            pytest.fail("the install outlived its SIGTERM by a minute: the "
-                        "signal did not reach the payload's bash, so the entry "
-                        "module runs bash as a child instead of replacing "
-                        "itself", pytrace=False)
-    finally:
-        if run.poll() is None:
-            kill_group(run)
-            run.communicate()
-    assert run.returncode in (-signal.SIGTERM, 128 + signal.SIGTERM), (
-        f"the run did not die of SIGTERM: exit {run.returncode}\n{out}{err}")
-    assert placement_temporaries(home) == [], (
-        "a placement temporary outlived the signal")
-    assert "placed in" not in out, (
-        "the install went on after the signal, so the pid that took it was "
-        f"not the payload's bash:\n{out}")
-
-
-#: THE SIGNALS PYTHON IGNORES AT START-UP, which the entry module must set
-#: back to `SIG_DFL` before its exec (design.md Decision 3 as amended on
-#: 2026-10-18, FR-003). By name, so a platform without one checks the other.
-PYTHON_IGNORES = tuple((name, getattr(signal, name))
-                       for name in ("SIGPIPE", "SIGXFSZ")
-                       if hasattr(signal, name))
-
-
-def signal_reading_bash(directory: Path, record: Path, real: str) -> Path:
-    """A `bash` that writes down the signals it started with ignored, and
-    runs nothing else.
-
-    It IS a bash: its `#!` line names the real one, so the process the
-    console script's exec becomes is a bash, as the payload's is. It writes
-    its own pid; then, where `/proc/$$/status` can be read (Linux), that
-    file's `SigIgn:` line, read by the shell itself with no child between, so
-    the mask is the one this process started with; then the status a
-    `yes | head -n 1` pipeline ends in under `pipefail`. That is 141,
-    128 + SIGPIPE, when SIGPIPE kills `yes`, and 1, with a "Broken pipe" line
-    on stderr, when `yes` inherited it ignored.
-    """
-    directory.mkdir(parents=True, exist_ok=True)
-    shim = directory / "bash"
-    shim.write_text("#!" + real + "\n"
-                    "{\n"
-                    "\tprintf 'pid %s\\n' \"$$\"\n"
-                    "\tif [ -r \"/proc/$$/status\" ]; then\n"
-                    "\t\twhile IFS= read -r line; do\n"
-                    "\t\t\tcase $line in\n"
-                    "\t\t\t\tSigIgn:*) printf '%s\\n' \"$line\" ;;\n"
-                    "\t\t\tesac\n"
-                    "\t\tdone < \"/proc/$$/status\"\n"
-                    "\tfi\n"
-                    "\tset -o pipefail\n"
-                    "\tyes | head -n 1 > /dev/null\n"
-                    "\tprintf 'pipeline %s\\n' \"$?\"\n"
-                    "} > " + shlex.quote(str(record)) + "\n"
-                    "exit 0\n", encoding="utf-8")
-    shim.chmod(0o755)
-    return shim
-
-
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_entry_the_bash_it_execs_has_neither_sigpipe_nor_sigxfsz_ignored(
-        installed, tmp_path):
-    """FR-003: SIGNALS PASS THROUGH AS IF THE PERSON HAD RUN THE PAYLOAD WITH
-    BASH DIRECTLY, so the bash the console script becomes starts with
-    neither signal Python ignores at start-up still ignored.
-
-    An exec keeps an ignored disposition, and a non-interactive bash cannot
-    reset one it was started with, so a SIGPIPE Python left ignored would
-    turn every `yes | head` inside the payload into a "Broken pipe" and a
-    status of 1. This reads the state AFTER THE EXEC, in the bash process
-    itself (`signal_reading_bash`, first on PATH), so it proves what bash
-    inherited and not what Python set. The pid proves that the process read
-    is the one the console script became. On Linux the `SigIgn` mask must
-    hold neither signal; on every platform the pipeline must end in 141.
-
-    The console script's Python is started with `restore_signals=True`, so
-    it starts with both at `SIG_DFL`: whatever bash finds ignored, the
-    console script's own Python left it so.
-    """
-    real = shutil.which("bash")
-    record = tmp_path / "bash-started-with"
-    shim = signal_reading_bash(tmp_path / "first-on-path", record,
-                               str(Path(real).resolve()))
-    home = tmp_path / "home"
-    home.mkdir()
-    run = subprocess.Popen(
-        [str(installed.script), "--version"], stdin=subprocess.DEVNULL,
-        stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-        env=command_env(home, {
-            "PATH": f"{shim.parent}{os.pathsep}{os.environ['PATH']}"}),
-        cwd=str(tmp_path), restore_signals=True)
-    out, err = run.communicate(timeout=60)
-    assert run.returncode == 0 and record.is_file(), (
-        "the console script never ran the first bash on PATH:\n"
-        f"exit {run.returncode}\n--- stdout\n{out}--- stderr\n{err}")
-    lines = record.read_text(encoding="utf-8").splitlines()
-    pids = [line[len("pid "):] for line in lines if line.startswith("pid ")]
-    masks = [line[len("SigIgn:"):].strip() for line in lines
-             if line.startswith("SigIgn:")]
-    statuses = [line[len("pipeline "):] for line in lines
-                if line.startswith("pipeline ")]
-    assert pids == [str(run.pid)], (
-        f"bash recorded pid {pids}, and the console script was pid {run.pid}: "
-        "what was read is not the process the console script became")
-    problems = []
-    if sys.platform.startswith("linux"):
-        if len(masks) != 1 or not re.fullmatch(r"[0-9a-fA-F]+", masks[0]):
-            problems.append(f"bash read no one SigIgn mask from "
-                            f"/proc/<pid>/status: {masks!r}")
-        else:
-            mask = int(masks[0], 16)
-            for name, number in PYTHON_IGNORES:
-                if (mask >> (number - 1)) & 1:
-                    problems.append(f"{name} is ignored in the bash the "
-                                    f"console script became (SigIgn "
-                                    f"{masks[0]}, bit {number - 1})")
-    wanted = str(128 + signal.SIGPIPE)
-    if statuses != [wanted]:
-        problems.append(f"`yes | head -n 1` under pipefail ended in "
-                        f"{statuses}, not [{wanted!r}], the status SIGPIPE "
-                        "kills `yes` with")
-    assert not problems, (
-        "the bash the console script became started with a signal Python "
-        "ignores still ignored:" + listed(problems)
-        + "\n--- the record\n" + "\n".join(lines) + f"\n--- stderr\n{err}")
-
-
-@WINDOWS_SKIP
-def test_entry_with_no_bash_on_path_refuses_exactly_and_runs_nothing(
-        installed, tmp_path):
-    """FR-004: NO `bash` ON PATH IS A REFUSAL, AND NOTHING ELSE HAPPENS.
-
-    PATH is every executable the real one carries but `bash`. The console
-    script's interpreter is named by its absolute path, so it starts, and
-    the entry module finds no `bash`. It prints contracts/cli-output.md's
-    line exactly, on stderr, and exits 2, the status `die` refuses with. It
-    falls back on no other shell and no fixed path: the `--install` asked
-    for places nothing and prints nothing, because nothing ran.
-    """
-    path = path_without(tmp_path, "bash")
-    home = tmp_path / "home"
-    home.mkdir()
-    result = run_entry(installed.script, "--install", home=home,
-                       env={"PATH": path}, cwd=tmp_path)
-    assert (result.returncode, result.stdout, result.stderr) == (
-        2, "", NO_BASH + "\n"), (
-        f"not the exact no-bash refusal:\n{said(result)}")
-    assert list(home.iterdir()) == [], (
-        "something ran, and placed files, with no bash on PATH")
-
-
-@WINDOWS_SKIP
-def test_entry_with_no_bash_and_path_ending_in_a_file_refuses_exactly(
-        installed, tmp_path):
-    """FR-004, WHERE `PATH`'S LAST ENTRY IS A FILE: the same refusal.
-
-    `os.execvp` raises the error of the last entry it tried, so with no
-    `bash` anywhere and a regular file as `PATH`'s last entry it raises
-    `NotADirectoryError`, not `FileNotFoundError`. The case is checked
-    first, in the console script's own interpreter, so this cannot pass by
-    reaching the other arm. Then the console script must print
-    contracts/cli-output.md's line exactly, on stderr, and exit 2, as with
-    no `bash` on any `PATH`: not a traceback and exit 1. The `--install`
-    asked for places nothing and prints nothing, because nothing ran.
-    """
-    last = tmp_path / "a-file-not-a-directory"
-    last.write_text("PATH's last entry, and not a directory\n",
-                    encoding="utf-8")
-    path = f"{path_without(tmp_path, 'bash')}{os.pathsep}{last}"
-    probe = subprocess.run(
-        [str(installed.python), "-I", "-c",
-         "import os\n"
-         "try:\n"
-         "    os.execvp('bash', ['bash', '-c', 'exit 97'])\n"
-         "except OSError as error:\n"
-         "    print(type(error).__name__)\n"],
-        capture_output=True, text=True, check=False,
-        stdin=subprocess.DEVNULL, env={"PATH": path})
-    assert (probe.returncode, probe.stdout) == (0, "NotADirectoryError\n"), (
-        "the case is wrong: on this PATH execvp does not raise "
-        f"NotADirectoryError:\n{said(probe)}")
-    home = tmp_path / "home"
-    home.mkdir()
-    result = run_entry(installed.script, "--install", home=home,
-                       env={"PATH": path}, cwd=tmp_path)
-    assert (result.returncode, result.stdout, result.stderr) == (
-        2, "", NO_BASH + "\n"), (
-        f"not the exact no-bash refusal:\n{said(result)}")
-    assert list(home.iterdir()) == [], (
-        "something ran, and placed files, with no bash on PATH")
-
-
-#: What `wip_shape_ref` reaches only when there is no pin beside the
-#: installer: the fetch path. Each stands in as a refusal naming itself, so a
-#: run that went past the packaged pin says so instead of fetching.
-FETCH_PATH = ("workdir", "payload_probe", "payload_resolve_remote",
-              "fetch_from_repo")
-
-
-def pin_commit(pin: Path) -> str:
-    """The pin's `commit:`, read as YAML spells it here: 40 lower-case hex
-    digits, quoted or not."""
-    found = re.findall(r'(?m)^commit:[ \t]*"?([0-9a-f]{40})"?[ \t]*$',
-                       pin.read_text(encoding="utf-8"))
-    assert len(found) == 1, f"{pin} has {len(found)} `commit:` lines, not one"
-    return found[0]
-
-
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_entry_wip_shape_ref_reads_the_pin_packaged_beside_the_payload(
-        installed, tmp_path):
-    """US1 SCENARIO 9 (FR-008): `wip init` FROM THE PACKAGE READS THE
-    RELEASE'S OWN openRepoShape PIN, and never the network's.
-
-    The path the console script hands bash is read back, with
-    `recording_bash`, from a working directory far from any checkout. Then
-    the installer's own `wip_shape_ref`, cut out with `installer_function`,
-    runs with `$SELF` set to that path, as the packaged `openRepoTools` sets
-    it from `BASH_SOURCE`. It prints the commit of the pin packaged beside
-    the payload, the force-include map's 24th entry, and reaches nothing on
-    the fetch path to get it.
-    """
-    record = tmp_path / "bash-was-given"
-    shim = recording_bash(tmp_path / "first-on-path", record)
-    elsewhere = tmp_path / "elsewhere"
-    elsewhere.mkdir()
-    home = tmp_path / "home"
-    home.mkdir()
-    started = run_entry(installed.script, "wip", "init", home=home, env={
-        "PATH": f"{shim.parent}{os.pathsep}{os.environ['PATH']}"},
-        cwd=elsewhere)
-    assert started.returncode == 0 and record.is_file(), (
-        "the console script never ran the first bash on PATH:\n"
-        + said(started))
-    _, given = read_record(record)
-    assert given, "bash was given no script"
-    stubs = "".join(
-        f"{name}() {{ printf 'wip_shape_ref passed the pin beside %s and "
-        f"reached {name}\\n' \"$SELF\" >&2; exit 97; }}\n"
-        for name in FETCH_PATH)
-    harness = tmp_path / "wip-shape-ref.sh"
-    harness.write_text("set -euo pipefail\n"
-                       'SELF="$1"\n'
-                       "die() { printf '\\nREFUSED: %s\\n' \"$1\" >&2; exit 2; }\n"
-                       + stubs + installer_function("wip_shape_ref")
-                       + "wip_shape_ref\n", encoding="utf-8")
-    result = subprocess.run(["bash", str(harness), given[0]],
-                            capture_output=True, text=True, check=False,
-                            stdin=subprocess.DEVNULL, env=command_env(home),
-                            cwd=str(elsewhere))
-    packaged = installed.payload / PIN
-    assert packaged.read_bytes() == (REPO / PIN).read_bytes(), (
-        "the package does not carry this checkout's pin")
-    expected = pin_commit(packaged)
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, expected + "\n", ""), (
-        f"wip_shape_ref, run from {given[0]}, did not read the packaged "
-        f"pin's commit {expected}:\n{said(result)}")
diff --git a/tests/test_package_stamp.py b/tests/test_package_stamp.py
deleted file mode 100644
index 5c25ff44..00000000
--- a/tests/test_package_stamp.py
+++ /dev/null
@@ -1,1262 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The release stamp, and what the command says about its release
-(opensoft/openRepoTools#228, User Story 2).
-
-A package's `openrepotools/_release.py` names the release it was built as.
-BASH IS ITS ONE READER AT RUN TIME (design.md Decision 5): `stamp_read` reads
-it by contracts/stamp.md's fixed grammar, and never sources, imports or runs
-it. Hatchling reads its `VERSION` at build time with a pattern of its own, and
-the two must never disagree. contracts/cli-output.md holds every line the
-command prints about it. Six groups, one prefix each (plan.md, "The test
-layout"):
-
-- `test_stamp_reader_*` runs the installer's OWN `stamp_read`, cut out of the
-  script with `installer_function`, on the committed stamp, on stamped ones,
-  and on one fixture per row of contracts/stamp.md's refusal table. Every
-  installer function it calls is cut out with it, and so is every `ORT_*` and
-  `STAMP_*` constant the installer sets at the top level, so the harness is
-  the installer's text and never a restatement of it;
-- `test_stamp_hatch_*` runs hatch's version pattern, copied below with its
-  citation, and `stamp_read` on the same files, and asks Python's `re` which
-  letters beyond ASCII that pattern's `(?i)` folds onto `version`'s;
-- `test_package_version_*` holds `--version`'s five lines, stamped and
-  unstamped, from `package_tree` layouts;
-- `test_package_broken_stamp_*` holds the one refusal a broken stamp gets: for
-  every invocation, `--help` included, before any argument is acted on, with
-  nothing placed and no version printed;
-- `test_package_no_env_channel_*` sets every `OPENREPOTOOLS_PACKAGE_*`
-  variable research R4 names, and requires that none of them changes a word.
-  A checkout and the one-line install still print `openRepoTools (<repo> @
-  <ref>)`, and a package still prints its own stamp or its own refusal;
-- `test_package_parser_*` holds `--help`, no argument, `--install --version`
-  and the parser's refusals, in a package whose stamp is sound, to what a
-  checkout does.
-
-EVERY PACKAGE RUN IS `bash <payload>/openRepoTools`, as the entry module's
-exec runs it. `test_entry_*` in `tests/test_package.py` holds the console
-script itself. A run's `gh` and `curl` are fakes that write down that they
-were asked and refuse, so a package run that went further than it should
-reaches no network and says so.
-
-A REASON'S TEXT IS THE IMPLEMENTER'S, APART FROM ITS CAUSE (contracts/stamp.md,
-"Refusal reasons"). So a refusal is held to its cause, `cannot be read (…)`,
-`is partial: …` or `is malformed: …`; to the field, the line (`line N`) or the
-docstring its row of the table names; to one line; and, across the rows, to
-being distinct. The words around them are free.
-
-Nothing here reads `specs/`: that tree goes to the spec leg at the triad
-cutover, and this module goes to the code leg.
-"""
-
-from __future__ import annotations
-
-import functools
-import os
-import re
-import shlex
-import shutil
-import subprocess
-from pathlib import Path
-from typing import NamedTuple
-
-import pytest
-
-import package_layout as layout
-from conftest import WINDOWS_SKIP
-from test_install_by_rename import installer_function
-from test_openrepotools_command import COMMAND, NOT_ROOT, command_env
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="openRepoTools is a bash script"),
-              WINDOWS_SKIP]
-
-# --- the exact lines (contracts/cli-output.md) ------------------------------
-
-#: `--version` from a stamped package: five lines, two spaces meaning two.
-STAMPED_VERSION = ("openRepoTools {VERSION} ({REPOSITORY} @ {COMMIT})\n"
-                   "  version   {VERSION}\n"
-                   "  tag       {TAG}\n"
-                   "  commit    {COMMIT}\n"
-                   "  digest    {DIGEST} (sorted-ls-tree-r-v1)\n")
-
-#: `--version` from an unstamped package, as the `package` job builds one.
-UNSTAMPED_VERSION = ("openRepoTools 0.0.0 (an unstamped package)\n"
-                     "  version   0.0.0, unstamped: a package built from a "
-                     "checkout, not a release\n"
-                     "  tag       none\n"
-                     "  commit    none\n"
-                     "  digest    none\n")
-
-#: `--version` from a checkout or the one-line install, unchanged.
-CHECKOUT_VERSION = "openRepoTools ({repo} @ {ref})\n"
-
-#: The broken-stamp refusal, which `die` prints after a blank line, on stderr,
-#: with exit 2. `{why}` is `stamp_read`'s `STAMP_WHY`.
-BROKEN_STAMP = ("REFUSED: this package's stamp (openrepotools/_release.py) "
-                "{why}, so this build is broken and nothing ran. A package's "
-                "stamp is a release's whole stamp or the unstamped one. "
-                "Reinstall it: pipx reinstall openrepotools")
-_BEFORE_WHY, _AFTER_WHY = BROKEN_STAMP.split("{why}")
-BROKEN_STAMP_STDERR = re.compile("\n" + re.escape(_BEFORE_WHY)
-                                 + r"(?P<why>[^\n]+)"
-                                 + re.escape(_AFTER_WHY) + "\n")
-
-#: THE THREE CAUSES a reason begins with, each in the form
-#: contracts/cli-output.md gives it, so that the refusal reads as a sentence.
-CAUSES = {
-    "cannot be read": re.compile(r"cannot be read \([^\n]+\)"),
-    "is partial:": re.compile(r"is partial: [^\n]+"),
-    "is malformed:": re.compile(r"is malformed: [^\n]+"),
-}
-
-# --- the stamps -------------------------------------------------------------
-
-#: Stamps a release build could write. The first is v1.1.0 as the code leg
-#: will build it; the second a TestPyPI rehearsal from this repository.
-RELEASE = {"VERSION": "1.1.0", "TAG": "v1.1.0",
-           "COMMIT": "0123456789abcdef0123456789abcdef01234567",
-           "DIGEST": "89abcdef01234567" * 4,
-           "REPOSITORY": "opensoft/openRepoTools-code"}
-PRE_RELEASE = {"VERSION": "1.1.0rc1", "TAG": "v1.1.0rc1",
-               "COMMIT": "fedcba9876543210fedcba9876543210fedcba98",
-               "DIGEST": "0f1e2d3c4b5a6978" * 4,
-               "REPOSITORY": "opensoft/openRepoTools"}
-PATCH = {"VERSION": "2.10.30", "TAG": "v2.10.30",
-         "COMMIT": "a1" * 20, "DIGEST": "b2" * 32,
-         "REPOSITORY": "some-org/some.repo_name"}
-STAMPS = {"final": RELEASE, "pre-release": PRE_RELEASE, "patch": PATCH}
-
-#: Research R4's variables: the names a future change might reach for to hand
-#: bash a stamp. Together they make a whole stamp that passes every rule, so a
-#: command that trusted any one of them would print something else.
-PACKAGE_VARIABLES = {
-    "OPENREPOTOOLS_PACKAGE_VERSION": "9.9.9",
-    "OPENREPOTOOLS_PACKAGE_TAG": "v9.9.9",
-    "OPENREPOTOOLS_PACKAGE_COMMIT": "abcdef0123456789abcdef0123456789abcdef01",
-    "OPENREPOTOOLS_PACKAGE_DIGEST": "9876543210fedcba" * 4,
-    "OPENREPOTOOLS_PACKAGE_REPOSITORY": "someone/elsewhere",
-}
-
-#: `<repo>` and `<ref>` when nothing names them, and a pair that does.
-DEFAULT_SOURCE = {"repo": "opensoft/openRepoTools", "ref": "main"}
-NAMED_SOURCE = {"repo": "someone/fork", "ref": "v1.2.3"}
-
-
-def stamp(**fields: str) -> str:
-    """The committed stamp's text with `fields` in place of its values."""
-    return layout.stamp_text(**fields)
-
-
-def release_at(version: str) -> dict:
-    """RELEASE with another `VERSION`, and the `TAG` that names it."""
-    return {**RELEASE, "VERSION": version, "TAG": "v" + version}
-
-
-def assignment(name: str, value: str) -> str:
-    return f'{name} = "{value}"'
-
-
-def lines_of(text: str) -> list:
-    return text.split("\n")
-
-
-def text_of(lines: list) -> str:
-    return "\n".join(lines)
-
-
-def line_number(text: str, line: str) -> int:
-    """The 1-based number of the one line of `text` that is `line`."""
-    where = [i for i, held in enumerate(lines_of(text)) if held == line]
-    assert len(where) == 1, (f"the fixture is wrong: {line!r} is "
-                             f"{len(where)} lines of the stamp, not one")
-    return where[0] + 1
-
-
-def docstring_span(text: str) -> tuple:
-    """The 1-based numbers of the lines that open and close the docstring."""
-    lines = lines_of(text)
-    opening = next(i for i, line in enumerate(lines) if line.startswith('"""'))
-    closing = next(i for i in range(opening + 1, len(lines))
-                   if '"""' in lines[i])
-    return opening + 1, closing + 1
-
-
-def replaced(text: str, line: str, new: str) -> tuple:
-    """`text` with its one `line` replaced by `new`, and that line's number."""
-    number = line_number(text, line)
-    lines = lines_of(text)
-    lines[number - 1] = new
-    return text_of(lines), number
-
-
-def inserted(text: str, after: int, new: str) -> tuple:
-    """`text` with `new` as a line after line `after`, and its number."""
-    lines = lines_of(text)
-    lines.insert(after, new)
-    return text_of(lines), after + 1
-
-
-def appended(text: str, new: str) -> tuple:
-    """`text` with `new` as its last line, before the final newline."""
-    lines = lines_of(text)
-    assert lines[-1] == "", "the fixture is wrong: the stamp has no final newline"
-    lines.insert(len(lines) - 1, new)
-    return text_of(lines), len(lines) - 1
-
-
-def removed(text: str, line: str) -> str:
-    lines = lines_of(text)
-    del lines[line_number(text, line) - 1]
-    return text_of(lines)
-
-
-def write_stamp(directory: Path, text: str) -> Path:
-    """`text` as `<directory>/_release.py`, byte for byte: written as bytes,
-    so a carriage return in it is the file's own."""
-    directory.mkdir(parents=True, exist_ok=True)
-    path = directory / "_release.py"
-    path.write_bytes(text.encode("utf-8"))
-    return path
-
-
-# --- the reader, cut out of the installer -----------------------------------
-
-#: A function the installer defines over several lines, by its header line.
-FUNCTION_HEADER = re.compile(
-    r"^([A-Za-z_][A-Za-z0-9_]*)\(\) \{[ \t]*(?:#[^\n]*)?$", re.MULTILINE)
-#: ...and one it defines on one line, `name() { …; }`.
-ONE_LINE_FUNCTION = re.compile(
-    r"^([A-Za-z_][A-Za-z0-9_]*)\(\) \{ [^\n]*; \}$", re.MULTILINE)
-#: The top-level constants a reader may lean on: the installer's shared
-#: character sets (`ORT_ALNUM`, `ORT_TAB`, `ORT_CR`) and anything of its own.
-READER_CONSTANT = re.compile(r"^(?:ORT|STAMP)_[A-Za-z0-9_]*=[^\n]*$",
-                             re.MULTILINE)
-#: A `#` that begins a comment: at the start of a line, or after a blank.
-COMMENT = re.compile(r"(?:^|(?<=[ \t]))#.*$")
-
-STAMP_VARIABLES = ("STAMP_STATE", "STAMP_VERSION", "STAMP_TAG",
-                   "STAMP_COMMIT", "STAMP_DIGEST", "STAMP_REPOSITORY",
-                   "STAMP_WHY")
-
-#: What the harness does once the definitions are in: one `stamp_read` of the
-#: file it is given, as the installer calls a reader (`|| …`, so its status is
-#: read and `set -e` does not end the harness), then its status and every
-#: `STAMP_*` value, each ended by a NUL, because a reason may quote a line.
-REPORT = ("status=0\n"
-          'stamp_read "$1" || status=$?\n'
-          "printf 'status=%s\\0' \"$status\"\n"
-          + "".join(f"printf '{name}=%s\\0' \"${{{name}-}}\"\n"
-                    for name in STAMP_VARIABLES))
-
-
-def _calls(body: str, names) -> list:
-    """The installer functions `body` names outside its comments."""
-    code = "\n".join(COMMENT.sub("", line) for line in body.split("\n"))
-    return [name for name in names
-            if re.search(rf"(?<![A-Za-z0-9_]){re.escape(name)}(?![A-Za-z0-9_])",
-                         code)]
-
-
-@functools.lru_cache(maxsize=4)
-def _harness_text(installer: str) -> str:
-    multi = {m.group(1) for m in FUNCTION_HEADER.finditer(installer)}
-    single = {m.group(1): m.group(0) + "\n"
-              for m in ONE_LINE_FUNCTION.finditer(installer)
-              if m.group(1) not in multi}
-    names = sorted(multi | set(single))
-    wanted: list = []
-    queue = ["stamp_read"]
-    while queue:
-        name = queue.pop(0)
-        if name in wanted:
-            continue
-        wanted.append(name)
-        text = single[name] if name in single else installer_function(name)
-        body = text.split("{", 1)[1]
-        queue += [called for called in _calls(body, names)
-                  if called not in wanted]
-    definitions = "".join(single[name] if name in single
-                          else installer_function(name) for name in wanted)
-    constants = "".join(line + "\n"
-                        for line in READER_CONSTANT.findall(installer))
-    return "set -euo pipefail\n" + constants + definitions + REPORT
-
-
-def reader_harness() -> str:
-    """`stamp_read` AS THE INSTALLER CARRIES IT, with what it needs.
-
-    `installer_function` cuts it out of `openRepoTools`, and with it every
-    installer function its body calls, and every one those call: whatever
-    helpers `stamp_read` leans on (`is_lower_hex`, `is_slug`, or its own),
-    the harness carries the installer's text of them. Then the top-level
-    `ORT_*` and `STAMP_*` lines, and the `REPORT`. Read afresh at each call,
-    so an edit to the installer is what the next test runs.
-    """
-    installer = COMMAND.read_text(encoding="utf-8")
-    assert re.search(r"^stamp_read\(\) \{", installer, re.MULTILINE), (
-        "openRepoTools defines no `stamp_read() {`: contracts/stamp.md's "
-        "reader, the one reader of a package's stamp, is not there")
-    return _harness_text(installer)
-
-
-class Read(NamedTuple):
-    """What one `stamp_read <file>` answered."""
-    status: int
-    state: str
-    version: str
-    tag: str
-    commit: str
-    digest: str
-    repository: str
-    why: str
-
-    def values(self) -> dict:
-        return {"VERSION": self.version, "TAG": self.tag,
-                "COMMIT": self.commit, "DIGEST": self.digest,
-                "REPOSITORY": self.repository}
-
-
-def read_stamp(work: Path, path: Path) -> Read:
-    """Run the installer's `stamp_read` on `path`, under the installer's own
-    `set -euo pipefail`, and return what it answered.
-
-    The reader is a function that sets variables and returns: it prints
-    nothing, on either stream. A message from bash itself, such as a
-    redirection that failed, would land in the middle of the broken-stamp
-    refusal, so stderr must be empty here too.
-    """
-    work.mkdir(parents=True, exist_ok=True)
-    harness = work / "stamp-read.sh"
-    harness.write_text(reader_harness(), encoding="utf-8")
-    result = subprocess.run(["bash", str(harness), str(path)],
-                            capture_output=True, check=False,
-                            stdin=subprocess.DEVNULL, cwd=str(work),
-                            env=command_env(work / "home"))
-    said = (f"exit {result.returncode}\n--- stdout\n{result.stdout!r}\n"
-            f"--- stderr\n{result.stderr.decode('utf-8', 'replace')}")
-    assert result.returncode == 0, (
-        f"the harness around stamp_read did not finish:\n{said}")
-    fields = {}
-    for record in result.stdout.split(b"\0")[:-1]:
-        name, _, value = record.decode("utf-8", "surrogateescape").partition("=")
-        fields[name] = value
-    assert set(fields) == {"status", *STAMP_VARIABLES}, (
-        f"the harness reported {sorted(fields)}:\n{said}")
-    assert result.stderr == b"", f"stamp_read printed on stderr:\n{said}"
-    return Read(int(fields["status"]), *(fields[n] for n in STAMP_VARIABLES))
-
-
-def assert_accepted(read: Read, state: str, values: dict) -> None:
-    assert read.status == 0, (
-        f"stamp_read refused a {state} stamp: status {read.status}, "
-        f"STAMP_WHY {read.why!r}")
-    assert read.state == state, f"STAMP_STATE is {read.state!r}, not {state!r}"
-    assert read.values() == values, (
-        f"stamp_read read {read.values()}, and the file holds {values}")
-
-
-def names_word(text: str, word: str) -> bool:
-    return re.search(rf"(?<![A-Za-z0-9_]){re.escape(word)}(?![A-Za-z0-9_])",
-                     text) is not None
-
-
-def assert_refused(read: Read, cause: str, fields=(), lines=(),
-                   words=()) -> None:
-    """`stamp_read` returned 1, with a one-line `STAMP_WHY` that begins with
-    `cause` in its contract form and names each of `fields` (case and all),
-    each `line N` of `lines` and each of `words` (in any case)."""
-    why = read.why
-    assert read.status == 1, (
-        f"stamp_read did not refuse: status {read.status}, STAMP_STATE "
-        f"{read.state!r}, values {read.values()}, STAMP_WHY {why!r}")
-    assert CAUSES[cause].fullmatch(why), (
-        f"STAMP_WHY does not begin with {cause!r} in the form "
-        f"contracts/cli-output.md gives it, on one line: {why!r}")
-    for field in fields:
-        assert names_word(why, field), f"STAMP_WHY does not name {field}: {why!r}"
-    for number in lines:
-        assert re.search(rf"\bline {number}\b", why), (
-            f"STAMP_WHY does not name line {number}: {why!r}")
-    for word in words:
-        assert word.lower() in why.lower(), (
-            f"STAMP_WHY does not name the {word}: {why!r}")
-
-
-# --- test_stamp_reader_*: what it accepts -----------------------------------
-
-def test_stamp_reader_reads_the_committed_file_as_unstamped(tmp_path):
-    """THE COMMITTED FILE, BYTE FOR BYTE: the SPDX line, which rule 2 skips as
-    a `#` line, the docstring, which rule 3 skips, and the five lines,
-    `0.0.0` and four empty values."""
-    read = read_stamp(tmp_path, layout.STAMP_SOURCE)
-    assert_accepted(read, "unstamped", dict(layout.UNSTAMPED))
-
-
-@pytest.mark.parametrize("which", STAMPS)
-def test_stamp_reader_reads_a_stamped_file_as_its_five_values(tmp_path, which):
-    """A STAMP THE RELEASE BUILD COULD WRITE: the committed file with its five
-    lines replaced once each, every other byte kept. A final, a pre-release
-    and a patch with more than one digit in a component."""
-    path = write_stamp(tmp_path / "stamp", stamp(**STAMPS[which]))
-    assert_accepted(read_stamp(tmp_path, path), "stamped", STAMPS[which])
-
-
-def grammar_variant(which: str) -> str:
-    """A stamped file in a shape the grammar allows and the committed file
-    does not use (contracts/stamp.md, rules 2 and 3)."""
-    text = stamp(**RELEASE)
-    opening, closing = docstring_span(text)
-    lines = lines_of(text)
-    if which == "blank-lines-and-comments-everywhere":
-        digest = line_number(text, assignment("DIGEST", RELEASE["DIGEST"]))
-        version = line_number(text, assignment("VERSION", RELEASE["VERSION"]))
-        lines[digest - 1:digest - 1] = ["# a comment between two", ""]
-        lines[version - 1:version - 1] = ["", "# a comment after it", ""]
-        lines[1:1] = ["", "# a comment before the docstring", ""]
-        return text_of(lines)
-    if which == "a-one-line-docstring":
-        lines[opening - 1:closing] = ['"""The release stamp, on one line."""']
-        return text_of(lines)
-    if which == "a-docstring-line-that-only-begins-with-the-word":
-        return inserted(text, opening, "Version numbers come only from the "
-                                       "tag; this line names no value.")[0]
-    raise ValueError(which)
-
-
-@pytest.mark.parametrize("which", [
-    "blank-lines-and-comments-everywhere", "a-one-line-docstring",
-    "a-docstring-line-that-only-begins-with-the-word"])
-def test_stamp_reader_reads_every_shape_the_grammar_allows(tmp_path, which):
-    """RULES 2 AND 3, AS WRITTEN. A blank line or a `#` line is skipped before
-    the docstring as well as after it; a docstring closes on its own line when
-    a second `\"\"\"` follows the opening one; and the guard refuses a
-    docstring line only where `version` or `__version__` is followed by
-    optional spaces and `=`, never one that merely begins with the word."""
-    path = write_stamp(tmp_path / "stamp", grammar_variant(which))
-    assert_accepted(read_stamp(tmp_path, path), "stamped", RELEASE)
-
-
-def test_stamp_reader_never_runs_the_file(tmp_path):
-    """IT NEVER SOURCES, IMPORTS OR RUNS THE FILE (contracts/stamp.md).
-
-    The docstring is free text, so a line of it holds a `$(…)` and a
-    backtick command, each of which would make a marker file if bash ever
-    ran the stamp: sourced, the docstring is one double-quoted word, and
-    both substitutions expand. Read by the grammar it is an unstamped stamp,
-    and no marker appears.
-    """
-    markers = [tmp_path / "ran-a-command-substitution",
-               tmp_path / "ran-a-backtick-command"]
-    text = stamp()
-    opening, _ = docstring_span(text)
-    text, _ = inserted(text, opening,
-                       f"A command, $(touch {shlex.quote(str(markers[0]))}), and "
-                       f"another, `touch {shlex.quote(str(markers[1]))}`.")
-    path = write_stamp(tmp_path / "stamp", text)
-    read = read_stamp(tmp_path, path)
-    ran = [str(marker) for marker in markers if marker.exists()]
-    assert not ran, f"stamp_read ran a line of the stamp it was reading: {ran}"
-    assert_accepted(read, "unstamped", dict(layout.UNSTAMPED))
-
-
-# --- test_stamp_reader_*: one fixture per row of the refusal table ----------
-
-@pytest.mark.parametrize("how", [
-    "a-directory",
-    pytest.param("no-read-permission", marks=NOT_ROOT)])
-def test_stamp_reader_refuses_an_unreadable_file(tmp_path, how):
-    """ROW: the file is unreadable, `cannot be read (<detail>)`.
-
-    contracts/cli-output.md's own example is `cannot be read (it is a
-    directory)`: the file the reason is about is the one the refusal's line
-    names around it, so what is held here is the cause and its form. A
-    directory refuses for root too; a mode-000 file does not, because root
-    reads whatever it likes."""
-    if how == "a-directory":
-        path = tmp_path / "stamp" / "_release.py"
-        path.mkdir(parents=True)
-        result = read_stamp(tmp_path, path)
-    else:
-        path = write_stamp(tmp_path / "stamp", stamp())
-        os.chmod(path, 0)
-        try:
-            result = read_stamp(tmp_path, path)
-        finally:
-            os.chmod(path, 0o644)
-    assert_refused(result, "cannot be read")
-
-
-def with_a_carriage_return(where: str) -> tuple:
-    """The committed stamp with a carriage return, and the line it is on."""
-    text = stamp()
-    opening, closing = docstring_span(text)
-    lines = lines_of(text)
-    if where == "every-line-crlf":
-        return text.replace("\n", "\r\n"), 1
-    if where == "the-spdx-line":
-        number = 1
-    elif where == "a-docstring-line":
-        number = 4
-        assert opening < number < closing and lines[number - 1], (
-            "the fixture is wrong: line 4 is not a docstring line with text")
-    elif where == "the-version-line":
-        number = line_number(text, assignment("VERSION", "0.0.0"))
-    elif where == "inside-a-docstring-line":
-        number = opening + 3
-        line = lines[number - 1]
-        lines[number - 1] = line[:5] + "\r" + line[5:]
-        return text_of(lines), number
-    else:
-        raise ValueError(where)
-    lines[number - 1] += "\r"
-    return text_of(lines), number
-
-
-@pytest.mark.parametrize("where", [
-    "the-spdx-line", "a-docstring-line", "inside-a-docstring-line",
-    "the-version-line", "every-line-crlf"])
-def test_stamp_reader_refuses_a_carriage_return_naming_its_line(tmp_path,
-                                                                where):
-    """ROW: a carriage return on line N, `is malformed:` naming line N.
-
-    Rule 1 comes before the others, so it holds on a `#` line and inside the
-    docstring as well as on an assignment, and a file checked out with CRLF
-    endings is refused at its first line."""
-    text, number = with_a_carriage_return(where)
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", lines=(number,))
-
-
-@pytest.mark.parametrize("name", layout.STAMP_FIELDS)
-def test_stamp_reader_refuses_a_missing_name(tmp_path, name):
-    """ROW: a name missing, each of the five in turn, `is malformed:`
-    naming it (rule 5)."""
-    text = removed(stamp(), assignment(name, layout.UNSTAMPED[name]))
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", fields=(name,))
-
-
-@pytest.mark.parametrize("name, value", [
-    *[(name, layout.UNSTAMPED[name]) for name in layout.STAMP_FIELDS],
-    ("VERSION", "2.0.0")],
-    ids=[*layout.STAMP_FIELDS, "VERSION-with-another-value"])
-def test_stamp_reader_refuses_a_repeated_name(tmp_path, name, value):
-    """ROW: a name repeated, `is malformed:` naming it (rule 5), whether the
-    second line says the same as the first or something else."""
-    base = stamp()
-    text, _ = inserted(base, line_number(base, assignment(
-        name, layout.UNSTAMPED[name])), assignment(name, value))
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", fields=(name,))
-
-
-@pytest.mark.parametrize("name", ["Version", "version", "BUILD"])
-def test_stamp_reader_refuses_an_unknown_name(tmp_path, name):
-    """ROW: an unknown name, such as `Version` or `BUILD`, `is malformed:`
-    naming it (rule 4): a name is one of the five, spelled as the five are."""
-    text, _ = appended(stamp(), assignment(name, "0.0.0"))
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", fields=(name,))
-
-
-#: Lines that are not `NAME = "VALUE"` from column 0 with one space either
-#: side of `=`, or whose value holds a `"`, `\` or `$` (rule 4): the line
-#: each replaces, and what is written in its place.
-NOT_AN_ASSIGNMENT = {
-    "no-spaces": ('VERSION = "0.0.0"', 'VERSION="0.0.0"'),
-    "two-spaces-before": ('VERSION = "0.0.0"', 'VERSION  = "0.0.0"'),
-    "two-spaces-after": ('VERSION = "0.0.0"', 'VERSION =  "0.0.0"'),
-    "tabs": ('VERSION = "0.0.0"', 'VERSION\t=\t"0.0.0"'),
-    "single-quotes": ('VERSION = "0.0.0"', "VERSION = '0.0.0'"),
-    "unquoted": ('VERSION = "0.0.0"', "VERSION = 0.0.0"),
-    "a-quote-that-does-not-close": ('VERSION = "0.0.0"', 'VERSION = "0.0.0'),
-    "not-at-column-0": ('VERSION = "0.0.0"', ' VERSION = "0.0.0"'),
-    "a-trailing-comment": ('VERSION = "0.0.0"',
-                           'VERSION = "0.0.0"  # the release'),
-    "a-quote-in-the-value": ('TAG = ""', 'TAG = "v1"1"'),
-    "a-backslash-in-the-value": ('REPOSITORY = ""',
-                                 'REPOSITORY = "opensoft\\x"'),
-    "a-dollar-in-the-value": ('REPOSITORY = ""',
-                              'REPOSITORY = "opensoft/$HOME"'),
-    "a-statement": (None, "print(VERSION)"),
-}
-
-
-@pytest.mark.parametrize("which", NOT_AN_ASSIGNMENT)
-def test_stamp_reader_refuses_a_line_that_is_not_name_equals_value(tmp_path,
-                                                                  which):
-    """ROW: a line that is not `NAME = "VALUE"`, `is malformed:` naming its
-    line number (rule 4)."""
-    old, new = NOT_AN_ASSIGNMENT[which]
-    text, number = (appended(stamp(), new) if old is None
-                    else replaced(stamp(), old, new))
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", lines=(number,))
-
-
-def test_stamp_reader_refuses_an_unclosed_docstring(tmp_path):
-    """ROW: an unclosed docstring, `is malformed:` naming the docstring.
-    With its closing line gone, the five assignments are docstring lines, and
-    the file ends inside it (rule 3)."""
-    text = stamp(**RELEASE)
-    _, closing = docstring_span(text)
-    lines = lines_of(text)
-    assert lines[closing - 1] == '"""', "the fixture is wrong: no closing line"
-    del lines[closing - 1]
-    path = write_stamp(tmp_path / "stamp", text_of(lines))
-    assert_refused(read_stamp(tmp_path, path), "is malformed:",
-                   words=("docstring",))
-
-
-#: Docstring lines that begin, in any case, with `version` or `__version__`
-#: followed by optional spaces and `=` (rule 3). Hatch would take the first
-#: seven as the version; the guard is the rule, and holds for the rest too.
-#: "Any case" is hatch's `(?i)`, so three of the seven spell the word with one
-#: of the letters beyond ASCII that it folds onto one of the word's (`FOLDED`).
-GUARDED_LINES = {
-    "version": 'version = "9.9.9"',
-    "VERSION": 'VERSION = "9.9.9"',
-    "__version__": "__version__ = '9.9.9'",
-    "__Version__-without-spaces": '__Version__="9.9.9"',
-    "long-s-U017F": 'ver\u017fion = "9.9.9"',
-    "capital-i-with-a-dot-U0130": 'VERS\u0130ON = "9.9.9"',
-    "dotless-i-U0131": '__vers\u0131on__ = "9.9.9"',
-    "unquoted": "Version=9.9.9",
-    "spaces-then-nothing": "version   =",
-}
-
-#: THE THREE LETTERS BEYOND ASCII THAT HATCH'S `(?i)` FOLDS onto a letter of
-#: `version`: U+017F `ſ` onto `s`, and U+0130 `İ` and U+0131 `ı` onto `i`.
-#: The installer's `STAMP_FOLD_*` are the same three. Each is keyed by the
-#: `GUARDED_LINES` row that spells the word with it.
-FOLDED = {
-    "long-s-U017F": "\u017f",
-    "capital-i-with-a-dot-U0130": "\u0130",
-    "dotless-i-U0131": "\u0131",
-}
-
-
-@pytest.mark.parametrize("which", GUARDED_LINES)
-def test_stamp_reader_refuses_a_docstring_line_hatch_could_read_as_the_version(
-        tmp_path, which):
-    """ROW: a docstring line hatch could read as the version, `is malformed:`
-    naming that line. Hatch takes the first line anywhere in the file that
-    its pattern matches, docstring or not, so such a line would make the
-    build and the command read two different versions."""
-    base = stamp(**RELEASE)
-    opening, _ = docstring_span(base)
-    text, number = inserted(base, opening, GUARDED_LINES[which])
-    path = write_stamp(tmp_path / "stamp", text)
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", lines=(number,))
-
-
-#: contracts/stamp.md's three partial rows: the stamp, and the fields that are
-#: empty in it, which the reason names. In the second, `TAG` is the one of
-#: `TAG`, `COMMIT` and `DIGEST` that is set, and `REPOSITORY` is set too, so
-#: the empty fields are exactly the two.
-PARTIAL = {
-    "a-commit-and-no-digest": ({**RELEASE, "DIGEST": ""}, ("DIGEST",)),
-    "a-tag-alone": ({**RELEASE, "COMMIT": "", "DIGEST": ""},
-                    ("COMMIT", "DIGEST")),
-    "unstamped-looking-with-a-repository": (
-        {"REPOSITORY": "opensoft/openRepoTools"}, ("REPOSITORY",)),
-}
-
-
-@pytest.mark.parametrize("which", PARTIAL)
-def test_stamp_reader_refuses_a_partial_stamp_naming_its_empty_fields(tmp_path,
-                                                                     which):
-    """ROWS: a partial stamp, `is partial:` naming what is empty, or, for an
-    unstamped-looking stamp, the `REPOSITORY` that names nothing. All or
-    nothing (FR-010): a partial stamp is never read as the part it holds."""
-    fields, named = PARTIAL[which]
-    path = write_stamp(tmp_path / "stamp", stamp(**fields))
-    assert_refused(read_stamp(tmp_path, path), "is partial:", fields=named)
-
-
-#: contracts/stamp.md's malformed-field rows: every field is set, and one is
-#: not the shape its rule gives it. Each stamp is wrong in that one field
-#: alone, the field the reason names.
-MALFORMED = {
-    "version-0.0.0-with-a-tag-commit-and-digest": (
-        {**RELEASE, "VERSION": "0.0.0", "TAG": "v0.0.0"}, "VERSION"),
-    **{f"version-{v}": (release_at(v), "VERSION")
-       for v in ("1.1", "01.1.0", "1.1.0-rc1", "1.01.0", "1.1.0.0", "v1.1.0",
-                 "1.1.0rc", "1.1.0rc01", "1.1.0RC1")},
-    "tag-v1.2.0": ({**RELEASE, "TAG": "v1.2.0"}, "TAG"),
-    "tag-without-its-v": ({**RELEASE, "TAG": "1.1.0"}, "TAG"),
-    "tag-with-a-capital-v": ({**RELEASE, "TAG": "V1.1.0"}, "TAG"),
-    "commit-of-39-digits": ({**RELEASE, "COMMIT": RELEASE["COMMIT"][:39]},
-                            "COMMIT"),
-    "commit-of-41-digits": ({**RELEASE, "COMMIT": RELEASE["COMMIT"] + "8"},
-                            "COMMIT"),
-    "commit-in-upper-case": ({**RELEASE, "COMMIT": RELEASE["COMMIT"].upper()},
-                             "COMMIT"),
-    "digest-of-63-digits": ({**RELEASE, "DIGEST": RELEASE["DIGEST"][:63]},
-                            "DIGEST"),
-    "digest-in-upper-case": ({**RELEASE, "DIGEST": RELEASE["DIGEST"].upper()},
-                             "DIGEST"),
-    "repository-without-an-owner": ({**RELEASE, "REPOSITORY": "openRepoTools"},
-                                    "REPOSITORY"),
-    "repository-a-b-c": ({**RELEASE, "REPOSITORY": "a/b/c"}, "REPOSITORY"),
-    "repository-without-a-name": ({**RELEASE, "REPOSITORY": "opensoft/"},
-                                  "REPOSITORY"),
-}
-
-
-@pytest.mark.parametrize("which", MALFORMED)
-def test_stamp_reader_refuses_a_malformed_field(tmp_path, which):
-    """ROWS: a malformed field, `is malformed:` naming it. `VERSION` is
-    `X.Y.Z` or `X.Y.ZrcN` with no leading zero and is not `0.0.0`; `TAG` is
-    exactly `v$VERSION`; `COMMIT` is 40 lowercase hex digits and `DIGEST`
-    64; `REPOSITORY` is an owner/name slug (contracts/stamp.md, "The checks
-    after the read")."""
-    fields, named = MALFORMED[which]
-    path = write_stamp(tmp_path / "stamp", stamp(**fields))
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", fields=(named,))
-
-
-def one_fixture_per_row(work: Path) -> dict:
-    """A path for one fixture of each row of the refusal table, with the
-    missing-name row taken for each of the five names, as the table says."""
-    paths = {}
-    unreadable = work / "a-directory" / "_release.py"
-    unreadable.mkdir(parents=True)
-    paths["unreadable"] = unreadable
-
-    def put(row: str, text: str) -> None:
-        paths[row] = write_stamp(work / row, text)
-
-    put("carriage-return", with_a_carriage_return("a-docstring-line")[0])
-    for name in layout.STAMP_FIELDS:
-        put(f"missing-{name}",
-            removed(stamp(), assignment(name, layout.UNSTAMPED[name])))
-    base = stamp()
-    put("repeated", inserted(base, line_number(base, 'COMMIT = ""'),
-                             'COMMIT = ""')[0])
-    put("unknown", appended(stamp(), 'BUILD = "1"')[0])
-    put("not-name-equals-value",
-        replaced(stamp(), 'VERSION = "0.0.0"', "VERSION = '0.0.0'")[0])
-    lines = lines_of(stamp())
-    del lines[docstring_span(stamp())[1] - 1]
-    put("unclosed-docstring", text_of(lines))
-    released = stamp(**RELEASE)
-    put("guarded-docstring-line", inserted(released, docstring_span(released)[0],
-                                           GUARDED_LINES["version"])[0])
-    for row, (fields, _) in PARTIAL.items():
-        put(row, stamp(**fields))
-    for row in ("version-0.0.0-with-a-tag-commit-and-digest", "version-1.1",
-                "tag-v1.2.0", "commit-of-39-digits", "digest-of-63-digits",
-                "repository-without-an-owner"):
-        put(row, stamp(**MALFORMED[row][0]))
-    return paths
-
-
-def test_stamp_reader_gives_each_row_its_own_reason(tmp_path):
-    """EACH REASON MUST BE DISTINCT (contracts/stamp.md): one fixture of
-    every row of the refusal table, each of the five missing names among
-    them, and no two give the same `STAMP_WHY`."""
-    reasons = {}
-    for row, path in one_fixture_per_row(tmp_path / "rows").items():
-        read = read_stamp(tmp_path / "work" / row, path)
-        assert read.status == 1, f"{row}: stamp_read did not refuse it"
-        reasons[row] = read.why
-    same = {why: sorted(r for r in reasons if reasons[r] == why)
-            for why in reasons.values()}
-    shared = {why: rows for why, rows in same.items() if len(rows) > 1}
-    assert not shared, f"rows that share a reason: {shared}"
-
-
-# --- test_stamp_hatch_*: hatch and bash read one VERSION --------------------
-#
-# HATCH'S VERSION SOURCE, copied from hatchling 1.27.0, the backend
-# `pyproject.toml` pins. The two copied lines are `hatchling/version/core.py:6`,
-# the pattern, and `:32`, the search, read on 2026-10-18 from the published
-# wheel `hatchling-1.27.0-py3-none-any.whl` (sha256
-# d3a2f3567c4f926ea39849cdf924c7e99e6686c9c8e288ae1037c8fa2a5d937b), whose
-# RECORD carries that file's own digest. contracts/stamp.md cites the same
-# two lines; the `:31` it cited before is the blank line above the search.
-
-#: hatchling/version/core.py:6 in hatchling 1.27.0, exactly:
-DEFAULT_PATTERN = r'(?i)^(__version__|VERSION) *= *([\'"])v?(?P<version>.+?)\2'
-
-
-def hatch_version(path: Path):
-    """What hatch's regex version source reads from `path`: `(version, the
-    number of the line it found it on)`, or None where nothing matches.
-
-    `VersionFile.read`, down to the steps that decide the answer: the file
-    is read as text, as `:26-27` read it (so universal newlines apply, as in
-    the build); the pattern is the default one, as `:29-30` choose it; and
-    the first match under `re.MULTILINE` is taken, with `:32` exactly.
-    """
-    with open(path, encoding='utf-8') as f:
-        contents = f.read()
-    pattern = DEFAULT_PATTERN
-    match = re.search(pattern, contents, flags=re.MULTILINE)
-    if not match:
-        return None
-    return (match.groupdict()["version"],
-            contents.count("\n", 0, match.start()) + 1)
-
-
-@pytest.mark.parametrize("which", ["committed", *STAMPS])
-def test_stamp_hatch_and_stamp_read_read_the_same_version(tmp_path, which):
-    """FR-013: THE BUILD BACKEND AND THE COMMAND READ ONE `VERSION`, from the
-    committed file and from stamped ones. Hatch's first match is the
-    `VERSION` line itself: a `#` line, such as the SPDX line, can never match
-    its pattern, and the docstring holds no line it could take."""
-    fields = dict(layout.UNSTAMPED) if which == "committed" else STAMPS[which]
-    text = stamp() if which == "committed" else stamp(**fields)
-    path = write_stamp(tmp_path / "stamp", text)
-    version_line = line_number(text, assignment("VERSION", fields["VERSION"]))
-    assert hatch_version(path) == (fields["VERSION"], version_line), (
-        f"hatch's pattern reads {hatch_version(path)} from the {which} stamp, "
-        f"not {fields['VERSION']!r} on line {version_line}")
-    read = read_stamp(tmp_path, path)
-    assert_accepted(read, "unstamped" if which == "committed" else "stamped",
-                    fields)
-    assert read.version == hatch_version(path)[0]
-
-
-def test_stamp_hatch_would_misread_a_guarded_docstring_line_and_stamp_read_refuses_it(
-        tmp_path):
-    """THE FIXTURE THE GUARD EXISTS FOR. A docstring line `version = "9.9.9"`
-    above the real `VERSION = "1.1.0"` is the first line hatch's pattern
-    matches, so a wheel built from it would carry 9.9.9 while its stamp says
-    1.1.0. No `VERSION` can come from both here, so the agreement is that
-    no run ever reads one: `stamp_read` refuses the file, naming the line,
-    and a package carrying it refuses every invocation."""
-    base = stamp(**RELEASE)
-    text, number = inserted(base, docstring_span(base)[0],
-                            GUARDED_LINES["version"])
-    path = write_stamp(tmp_path / "stamp", text)
-    assert hatch_version(path) == ("9.9.9", number), (
-        f"the fixture is wrong: hatch's pattern reads {hatch_version(path)}, "
-        f"not the docstring's line {number}")
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", lines=(number,))
-
-
-@pytest.mark.parametrize("which", FOLDED)
-def test_stamp_hatch_reads_a_letter_it_folds_as_the_version_and_stamp_read_refuses_it(
-        tmp_path, which):
-    """HATCH'S "ANY CASE" IS PYTHON'S, AND SO IS THE GUARD'S. Under `(?i)`,
-    `re` matches U+017F `ſ` to `s`, and U+0130 `İ` and U+0131 `ı` to `i`. So
-    a docstring line that spells `version` or `__version__` with one of them,
-    above the real `VERSION = "1.1.0"`, is the first line hatch's pattern
-    matches, and a wheel built from it would carry 9.9.9. `stamp_read` must
-    refuse the file, naming that line, as it refuses the ASCII spelling. The
-    installer folds the three letters before its `case`, whose `[Ss]` and
-    `[Ii]` match none of them."""
-    line = GUARDED_LINES[which]
-    assert [c for c in line if ord(c) > 0x7F] == [FOLDED[which]], (
-        f"the fixture is wrong: {line!r} does not spell the word with "
-        f"U+{ord(FOLDED[which]):04X} and only that")
-    base = stamp(**RELEASE)
-    text, number = inserted(base, docstring_span(base)[0], line)
-    path = write_stamp(tmp_path / "stamp", text)
-    assert hatch_version(path) == ("9.9.9", number), (
-        f"the fixture is wrong: hatch's pattern reads {hatch_version(path)}, "
-        f"not the docstring's line {number}")
-    assert_refused(read_stamp(tmp_path, path), "is malformed:", lines=(number,))
-
-
-def test_stamp_hatch_folds_exactly_three_letters_beyond_ascii_onto_the_word():
-    """WHY THREE ROWS ARE ENOUGH. Every code point beyond ASCII is put to
-    Python's `re` under `(?i)`, as hatch's pattern is, against the letters of
-    `version` (`_` has no case). Exactly `FOLDED`'s three match, so the three
-    rows the guard must refuse are every spelling hatch reads that ASCII's
-    capitals do not give. A Python whose case table took a fourth would fail
-    here, and the guard would need a fourth fold."""
-    letter = re.compile(r"(?i)[eionrsv]")
-    beyond = {chr(c) for c in range(0x80, 0x110000)
-              if letter.fullmatch(chr(c))}
-    assert beyond == set(FOLDED.values()), (
-        "beyond ASCII, `(?i)` takes "
-        + ", ".join(f"U+{ord(c):04X}" for c in sorted(beyond))
-        + " for a letter of `version`, not FOLDED's three")
-
-
-# --- running the command ----------------------------------------------------
-
-def environment(home: Path, network_log: Path | None = None,
-                extra: dict | None = None) -> dict:
-    """`command_env`, with every `OPENREPOTOOLS_PACKAGE_*` and `PIPX_*`
-    variable of the caller's own shell taken out, so that a test sets the
-    ones it is about. With `network_log`, a `gh` and a `curl` that write down
-    that they were asked, and refuse, come first on PATH."""
-    env = command_env(home)
-    for name in [n for n in env
-                 if n.startswith(("OPENREPOTOOLS_PACKAGE_", "PIPX_"))]:
-        del env[name]
-    if network_log is not None:
-        shims = network_log.parent / "refusing-network"
-        shims.mkdir(parents=True, exist_ok=True)
-        for tool in ("gh", "curl"):
-            (shims / tool).write_text(
-                "#!/bin/sh\n"
-                f"printf '%s %s\\n' {tool} \"$*\" >> "
-                f"{shlex.quote(str(network_log))}\n"
-                "exit 1\n", encoding="utf-8")
-            (shims / tool).chmod(0o755)
-        env["PATH"] = f"{shims}{os.pathsep}{env['PATH']}"
-    env.update(extra or {})
-    return env
-
-
-def run(argv: list, home: Path, cwd: Path, *, network_log: Path | None = None,
-        extra: dict | None = None,
-        stdin: str = "") -> subprocess.CompletedProcess:
-    """One run, with stdin a pipe and never a terminal, and `home` as HOME."""
-    home.mkdir(parents=True, exist_ok=True)
-    cwd.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(argv, capture_output=True, text=True, check=False,
-                          input=stdin, cwd=str(cwd),
-                          env=environment(home, network_log, extra))
-
-
-def transcript(result: subprocess.CompletedProcess) -> str:
-    return (f"exit {result.returncode}\n--- stdout\n{result.stdout}"
-            f"--- stderr\n{result.stderr}")
-
-
-#: Where a fake installed package goes: a plain prefix, as pip's user base
-#: is, and a pipx venv under macOS's default pipx home, whose path holds a
-#: space.
-PLACES = ("a-prefix", "a-pipx-venv-in-a-home-with-a-space")
-
-
-def package(work: Path, text: str | None = None,
-            where: str = "a-prefix") -> Path:
-    """A `package_tree` whose stamp is `text` (the committed one when None),
-    built under `work`, which is canonical. Returns its `payload/`."""
-    if where == "a-prefix":
-        return layout.package_tree(work / "prefix", stamp=text)
-    if where == "a-pipx-venv-in-a-home-with-a-space":
-        venv = layout.pipx_venv(work / "Library" / "Application Support" / "pipx",
-                                "1.17.8", stamp=text)
-        found = sorted(venv.glob("lib/python*/site-packages/openrepotools/payload"))
-        assert len(found) == 1, f"{venv} holds {len(found)} payloads"
-        return found[0]
-    raise ValueError(where)
-
-
-def run_payload(work: Path, payload: Path, *args: str,
-                **how) -> subprocess.CompletedProcess:
-    """`bash <payload>/openRepoTools <args>`, as the entry module's exec runs
-    it, with `<work>/home` as HOME."""
-    return run(["bash", str(payload / "openRepoTools"), *args],
-               work / "home", work / "cwd", **how)
-
-
-def run_checkout(work: Path, *args: str, **how) -> subprocess.CompletedProcess:
-    """This checkout's `openRepoTools <args>`, with `<work>/home` as HOME."""
-    return run(["bash", str(COMMAND), *args], work / "home", work / "cwd",
-               **how)
-
-
-def placed(home: Path) -> list:
-    """Everything a run left in its HOME, which starts empty."""
-    return sorted(str(p.relative_to(home)) for p in home.rglob("*"))
-
-
-# --- test_package_version_* -------------------------------------------------
-
-@pytest.mark.parametrize("where", PLACES)
-@pytest.mark.parametrize("which", STAMPS)
-def test_package_version_prints_the_stamped_five_lines_exactly(tmp_path, which,
-                                                               where):
-    """US2 SCENARIO 1 (FR-014): A STAMPED PACKAGE NAMES ITS RELEASE, in
-    exactly five lines on stdout, exit 0: the version, the repository and the
-    commit, then the version, the tag, the commit and the digest with its
-    definition's label. For v1.1.0 the first line is `openRepoTools 1.1.0
-    (opensoft/openRepoTools-code @ <commit>)`."""
-    work = tmp_path.resolve()
-    payload = package(work, stamp(**STAMPS[which]), where)
-    result = run_payload(work, payload, "--version")
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, STAMPED_VERSION.format(**STAMPS[which]), ""), transcript(result)
-
-
-@pytest.mark.parametrize("where", PLACES)
-def test_package_version_prints_the_unstamped_five_lines_exactly(tmp_path,
-                                                                 where):
-    """US2 SCENARIO 2 (FR-014): A PACKAGE BUILT FROM A CHECKOUT SAYS SO, with
-    the committed stamp, as the `package` job builds it."""
-    work = tmp_path.resolve()
-    payload = package(work, None, where)
-    result = run_payload(work, payload, "--version")
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, UNSTAMPED_VERSION, ""), transcript(result)
-
-
-@pytest.mark.parametrize("which", ["unstamped", "final"])
-def test_package_version_names_the_stamp_whatever_repo_and_ref_say(tmp_path,
-                                                                   which):
-    """A package's `--version` names the bytes it is, from its stamp, and not
-    the source a fetch would read: `$OPENREPOTOOLS_REPO` and
-    `$OPENREPOTOOLS_REF` change no line of it."""
-    work = tmp_path.resolve()
-    text = None if which == "unstamped" else stamp(**RELEASE)
-    expected = (UNSTAMPED_VERSION if which == "unstamped"
-                else STAMPED_VERSION.format(**RELEASE))
-    result = run_payload(work, package(work, text), "--version", extra={
-        "OPENREPOTOOLS_REPO": NAMED_SOURCE["repo"],
-        "OPENREPOTOOLS_REF": NAMED_SOURCE["ref"]})
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, expected, ""), transcript(result)
-
-
-# --- test_package_broken_stamp_* --------------------------------------------
-
-#: One fixture for each of contracts/cli-output.md's three causes. Each is a
-#: regular `_release.py`, so the run is in package mode (design.md Decision
-#: 4), and broken: mode 000 (which root can read, so that case skips for
-#: root); a `COMMIT` with no `DIGEST`; a `TAG` that is not `v$VERSION`.
-BROKEN = {
-    "cannot-be-read": "cannot be read",
-    "is-partial": "is partial:",
-    "is-malformed": "is malformed:",
-}
-BROKEN_CASES = [pytest.param("cannot-be-read", marks=NOT_ROOT,
-                             id="cannot-be-read"),
-                "is-partial", "is-malformed"]
-
-
-def broken_package(work: Path, kind: str) -> Path:
-    """A package whose stamp is broken by `kind`. Returns its `payload/`."""
-    if kind == "cannot-be-read":
-        payload = package(work)
-        os.chmod(payload.parent / "_release.py", 0)
-        return payload
-    if kind == "is-partial":
-        return package(work, stamp(**{**RELEASE, "DIGEST": ""}))
-    if kind == "is-malformed":
-        return package(work, stamp(**{**RELEASE, "TAG": "v1.2.0"}))
-    raise ValueError(kind)
-
-
-def mend(payload: Path) -> None:
-    """Give a mode-000 stamp its mode back, so the tree can be read and
-    removed after the test."""
-    path = payload.parent / "_release.py"
-    if path.is_file():
-        os.chmod(path, 0o644)
-
-
-def refusal_reason(result: subprocess.CompletedProcess, cause: str) -> str:
-    """The `<why>` of an exact broken-stamp refusal, which begins with
-    `cause`: exit 2, nothing on stdout (no version, no usage, no placement
-    line), and on stderr the blank line `die` prints, then the one line."""
-    assert result.returncode == 2, (
-        "a broken stamp did not refuse with exit 2:\n" + transcript(result))
-    assert result.stdout == "", (
-        "a run with a broken stamp printed on stdout:\n" + transcript(result))
-    match = BROKEN_STAMP_STDERR.fullmatch(result.stderr)
-    assert match, ("stderr is not exactly contracts/cli-output.md's broken-stamp "
-                   "refusal:\n" + transcript(result))
-    why = match.group("why")
-    assert CAUSES[cause].fullmatch(why), (
-        f"the refusal's <why> does not begin with {cause!r} in its contract "
-        f"form: {why!r}")
-    return why
-
-
-def same_file_spellings(why: str, payload: Path) -> str:
-    """`why` with the stamp's path, however a run spells it, as `<stamp>`."""
-    stamp_path = payload.parent / "_release.py"
-    for spelling in sorted({str(stamp_path), str(stamp_path.resolve()),
-                            f"{payload}/../_release.py",
-                            f"{payload.resolve()}/../_release.py"},
-                           key=len, reverse=True):
-        why = why.replace(spelling, "<stamp>")
-    return why
-
-
-@pytest.mark.parametrize("args", [("--help",), ("--version",), ("--install",)],
-                         ids=["help", "version", "install"])
-@pytest.mark.parametrize("kind", BROKEN_CASES)
-def test_package_broken_stamp_refuses_before_any_argument_and_places_nothing(
-        tmp_path, kind, args):
-    """US2 SCENARIO 4 (FR-012): A BROKEN STAMP REFUSES EVERY INVOCATION,
-    `--help` included, with exit 2, before any argument is acted on.
-
-    The refusal is contracts/cli-output.md's line, filled with `stamp_read`'s
-    own `STAMP_WHY` for that file. It names the stamp file and the fix,
-    `pipx reinstall openrepotools`, prints no version, places nothing in
-    HOME, and asks no `gh` or `curl` anything.
-    """
-    work = tmp_path.resolve()
-    payload = broken_package(work, kind)
-    asked = work / "network-was-asked"
-    try:
-        result = run_payload(work, payload, *args, network_log=asked)
-        why = refusal_reason(result, BROKEN[kind])
-        assert placed(work / "home") == [], (
-            f"a refused run left files in HOME: {placed(work / 'home')}")
-        assert not asked.exists(), (
-            "a refused run asked the network:\n"
-            + asked.read_text(encoding="utf-8"))
-        own = read_stamp(work / "reader", payload.parent / "_release.py")
-        assert own.status == 1, "stamp_read accepts the stamp the run refused"
-        assert same_file_spellings(why, payload) == same_file_spellings(
-            own.why, payload), (
-            f"the refusal's <why> is not stamp_read's STAMP_WHY for the same "
-            f"file:\n  refusal:    {why!r}\n  STAMP_WHY:  {own.why!r}")
-    finally:
-        mend(payload)
-
-
-@pytest.mark.parametrize("args", [
-    (), ("--install", "--version"), ("--version", "--install"), ("Atlas",),
-    ("wip",), ("wip", "init", "--dry-run")],
-    ids=["no-argument", "install-then-version", "version-then-install",
-         "an-unknown-argument", "wip-alone", "wip-init"])
-def test_package_broken_stamp_refuses_every_other_invocation_first(tmp_path,
-                                                                   args):
-    """EVERY INVOCATION, NOT ONLY THE THREE NAMED (FR-012, FR-014): no
-    argument at all, either order of `--install` and `--version`, an
-    argument the parser refuses, and `wip`, whose `init` would otherwise ask
-    `gh` for a login. Each gets the broken-stamp refusal and nothing else."""
-    work = tmp_path.resolve()
-    payload = broken_package(work, "is-partial")
-    asked = work / "network-was-asked"
-    result = run_payload(work, payload, *args, network_log=asked)
-    refusal_reason(result, BROKEN["is-partial"])
-    assert placed(work / "home") == [], placed(work / "home")
-    assert not asked.exists(), asked.read_text(encoding="utf-8")
-
-
-# --- test_package_no_env_channel_* ------------------------------------------
-
-def run_unpackaged(work: Path, how: str, *args: str,
-                   extra: dict) -> subprocess.CompletedProcess:
-    """`openRepoTools <args>` run as a checkout or the one-line install runs:
-    from this checkout; piped into `bash -s` as the install line pipes it,
-    from a directory holding nothing named `bash`, so its `$SELF` is no file;
-    or as the one-line install leaves it, a regular file in `<dir>`."""
-    home, cwd = work / "home", work / "cwd"
-    if how == "a-checkout":
-        return run(["bash", str(COMMAND), *args], home, cwd, extra=extra)
-    if how == "a-piped-one-line-install":
-        return run(["bash", "-s", "--", *args], home, cwd, extra=extra,
-                   stdin=COMMAND.read_text(encoding="utf-8"))
-    if how == "the-file-a-one-line-install-placed":
-        bin_dir = work / "placed" / ".local" / "bin"
-        bin_dir.mkdir(parents=True)
-        copy = bin_dir / "openRepoTools"
-        copy.write_bytes(COMMAND.read_bytes())
-        copy.chmod(0o755)
-        return run(["bash", str(copy), *args], home, cwd, extra=extra)
-    raise ValueError(how)
-
-
-@pytest.mark.parametrize("source", ["default-source", "named-source"])
-@pytest.mark.parametrize("how", ["a-checkout", "a-piped-one-line-install",
-                                 "the-file-a-one-line-install-placed"])
-def test_package_no_env_channel_a_checkout_and_the_one_line_install_print_their_source(
-        tmp_path, how, source):
-    """US2 SCENARIO 3, SC-002: WITH EVERY `OPENREPOTOOLS_PACKAGE_*` VARIABLE
-    SET, A CHECKOUT AND THE ONE-LINE INSTALL PRINT EXACTLY
-    `openRepoTools (<repo> @ <ref>)`, and no version number: `<repo>` and
-    `<ref>` as `$OPENREPOTOOLS_REPO` and `$OPENREPOTOOLS_REF` name them, or
-    `opensoft/openRepoTools @ main` where nothing does (research R4)."""
-    work = tmp_path.resolve()
-    names = DEFAULT_SOURCE if source == "default-source" else NAMED_SOURCE
-    extra = dict(PACKAGE_VARIABLES)
-    if source == "named-source":
-        extra.update(OPENREPOTOOLS_REPO=names["repo"],
-                     OPENREPOTOOLS_REF=names["ref"])
-    result = run_unpackaged(work, how, "--version", extra=extra)
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, CHECKOUT_VERSION.format(**names), ""), transcript(result)
-
-
-@pytest.mark.parametrize("which", ["unstamped", "final"])
-def test_package_no_env_channel_a_package_prints_its_own_stamp(tmp_path, which):
-    """THE STAMP COMES FROM THE FILE BESIDE THE PAYLOAD AND NOWHERE ELSE
-    (FR-011): with research R4's variables naming a whole other release, an
-    unstamped package still says it is unstamped, and a stamped one still
-    names its own release."""
-    work = tmp_path.resolve()
-    text = None if which == "unstamped" else stamp(**RELEASE)
-    expected = (UNSTAMPED_VERSION if which == "unstamped"
-                else STAMPED_VERSION.format(**RELEASE))
-    result = run_payload(work, package(work, text), "--version",
-                         extra=dict(PACKAGE_VARIABLES))
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, expected, ""), transcript(result)
-
-
-def test_package_no_env_channel_cannot_mend_a_broken_stamp(tmp_path):
-    """AND NO VARIABLE MENDS A BROKEN ONE: a stamp with a `COMMIT` and no
-    `DIGEST`, beside research R4's variables naming a whole stamp, is still
-    refused, and no version is printed."""
-    work = tmp_path.resolve()
-    payload = broken_package(work, "is-partial")
-    result = run_payload(work, payload, "--version",
-                         extra=dict(PACKAGE_VARIABLES))
-    refusal_reason(result, BROKEN["is-partial"])
-
-
-# --- test_package_parser_* --------------------------------------------------
-
-#: Arguments whose answer does not depend on where the command runs from:
-#: the usage, and each refusal the parser makes before anything is read.
-PARSER_ARGUMENTS = {
-    "help": ("--help",),
-    "h": ("-h",),
-    "no-argument": (),
-    "an-unknown-argument": ("Atlas",),
-    "another-command-s-flag": ("--doctor",),
-    "install-and-more": ("--install", "Atlas"),
-    "wip-alone": ("wip",),
-    "wip-an-unknown-verb": ("wip", "destroy"),
-    "wip-init-an-option-with-no-value": ("wip", "init", "--org"),
-}
-
-
-@pytest.mark.parametrize("args", list(PARSER_ARGUMENTS.values()),
-                         ids=list(PARSER_ARGUMENTS))
-@pytest.mark.parametrize("which", ["final", "unstamped"])
-def test_package_parser_answers_as_a_checkout_does(tmp_path, which, args):
-    """US2 SCENARIO 5 (FR-014): IN A PACKAGE WHOSE STAMP IS SOUND, the usage
-    and the parser's refusals are a checkout's: the same exit status, the
-    same stdout and the same stderr, byte for byte, and nothing placed."""
-    work = tmp_path.resolve()
-    text = None if which == "unstamped" else stamp(**RELEASE)
-    payload = package(work, text)
-    checkout = run_checkout(work, *args)
-    assert placed(work / "home") == [], placed(work / "home")
-    packaged = run_payload(work, payload, *args)
-    assert (packaged.returncode, packaged.stdout, packaged.stderr) == (
-        checkout.returncode, checkout.stdout, checkout.stderr), (
-        "the package does not answer as a checkout does.\n"
-        f"=== the package\n{transcript(packaged)}\n"
-        f"=== the checkout\n{transcript(checkout)}")
-    assert placed(work / "home") == [], placed(work / "home")
-
-
-@pytest.mark.parametrize("which", ["final", "unstamped"])
-def test_package_parser_install_then_version_prints_the_release_and_installs_nothing(
-        tmp_path, which):
-    """`--install --version`, AS A CHECKOUT TAKES IT: the parser reaches
-    `--version` before the install starts, so a checkout prints its
-    `--version` and installs nothing. A package does the same with its own
-    `--version`, the five lines of its stamp, and places nothing."""
-    work = tmp_path.resolve()
-    checkout_both = run_checkout(work, "--install", "--version")
-    checkout_version = run_checkout(work, "--version")
-    assert (checkout_both.returncode, checkout_both.stdout,
-            checkout_both.stderr) == (0, checkout_version.stdout, ""), (
-        "the case is wrong: a checkout's `--install --version` is not its "
-        f"`--version`:\n{transcript(checkout_both)}")
-    assert placed(work / "home") == [], placed(work / "home")
-    text = None if which == "unstamped" else stamp(**RELEASE)
-    expected = (UNSTAMPED_VERSION if which == "unstamped"
-                else STAMPED_VERSION.format(**RELEASE))
-    result = run_payload(work, package(work, text), "--install", "--version")
-    assert (result.returncode, result.stdout, result.stderr) == (
-        0, expected, ""), transcript(result)
-    assert placed(work / "home") == [], (
-        f"`--install --version` placed files: {placed(work / 'home')}")
diff --git a/tests/test_park_resume_commands.py b/tests/test_park_resume_commands.py
deleted file mode 100644
index 57ea4921..00000000
--- a/tests/test_park_resume_commands.py
+++ /dev/null
@@ -1,3139 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`park` and `resume` — the two installed USER COMMANDS (#82).
-
-They ADD NO MECHANICS, so this file asserts exactly what they do add: finding
-the estate, driving the estate's own `make park` / `make resume`, rebuilding or
-fast-forwarding the estate before the verb runs, and every refusal. The WIP
-commit, the push, the `git worktree add` and the soft reset belong to the
-Speckit git extension and are tested in its own suite; `make park` / `make
-resume` themselves are tested in `test_park_resume_targets.py`.
-
-OFFLINE, LIKE THE REST OF THIS SUITE, and offline in three ways at once. The
-extension script is a STUB that echoes its arguments (the same stub #80's tests
-use). Every remote is a BARE REPOSITORY IN A TEMPORARY DIRECTORY, reached
-through `$OPENREPOTOOLS_REMOTE_BASE` — `resume`'s documented test path, the
-same concession `setup-project.py --local-remote-dir` and `family.py
---local-remote-dir` make. And `$HOME` is a temporary directory too, so the
-`~/projects` / `~/Projects` spellings and `~/.agents/workspace.yaml` are the
-test's own and never the developer's. Nothing here may create a real
-repository, and nothing here reaches the network.
-
-THE WORKSPACE MANIFEST IS WRITTEN BY HAND, at `schema_version: 1` — the schema
-`opensoft/workBenches`'s `park.sh` writes as of its S1 (merged 2026-09-09).
-Written out rather than generated, because a test that needed a workBenches
-checkout beside this one would skip on every machine that has only this
-repository, which is every fork.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-from conftest import NEEDS_UPSTREAM, REPO, UPSTREAM, WINDOWS_SKIP, git, rmtree
-
-PARK = REPO / "park"
-RESUME = REPO / "resume"
-STATUS = REPO / "status"
-MAKE = shutil.which("make")
-
-#: Both reasons this whole file needs a POSIX machine: the commands are bash,
-#: and they run `make` in a root that execs a `#!`-shebang script.
-pytestmark = [
-    NEEDS_UPSTREAM,
-    WINDOWS_SKIP,
-    pytest.mark.skipif(shutil.which("bash") is None,
-                       reason="park and resume are bash scripts"),
-    pytest.mark.skipif(MAKE is None, reason="needs `make` on PATH"),
-]
-
-#: Where `setup-openspeckit` installs the extension's bash scripts, and so
-#: where a stub has to live to be found by the `park` / `resume` targets.
-OVERLAY = Path(".specify/extensions/git/scripts/bash")
-
-#: `git` reads one-off configuration out of the environment, which is how a
-#: test gives a plain `git clone`/`git submodule update` permission to clone a
-#: local path without the tool under test knowing anything about it. `resume`
-#: deliberately grants no such permission of its own. Copied from
-#: `test_family.py`, for its reasons.
-ALLOW_FILE_PROTOCOL = {"GIT_CONFIG_COUNT": "1",
-                       "GIT_CONFIG_KEY_0": "protocol.file.allow",
-                       "GIT_CONFIG_VALUE_0": "always"}
-
-ORG = "testorg"
-FAMILY = "TestFam"
-MEMBERS = ("Alpha", "Bravo")
-WORKSPACE_SLUG = "tester/wip"
-
-#: A `parked_commit` has to be a 40-hex sha to be the schema's own shape. It
-#: never has to RESOLVE here: nothing in this repository reads it — the
-#: extension's `resume.sh` does, and it is stubbed.
-FAKE_SHA = "a1b2c3d4e5f60718293a4b5c6d7e8f9012345678"
-
-#: A Makefile whose two verbs only SAY WHERE THEY RAN. Estate resolution is
-#: what most of this file is about, and a probe that names its own directory
-#: proves the answer in one line — where a real root would prove it through
-#: three layers of somebody else's code.
-PROBE_MAKEFILE = """\
-.PHONY: park resume bootstrap siblings
-park:
-\t@echo "PROBE park in $(CURDIR) ARGS=[$(ARGS)]"
-resume:
-\t@echo "PROBE resume in $(CURDIR) ARGS=[$(ARGS)]"
-bootstrap:
-\t@echo "PROBE bootstrap in $(CURDIR)"
-siblings:
-\t@echo "PROBE siblings in $(CURDIR)"
-"""
-
-#: The same probe, except `park` exits 3 after printing — #91's
-#: park-everything has to be shown continuing past ONE estate's refusal
-#: while still parking the rest, and this is the cheapest way to make one
-#: estate's own `make park` fail without a real extension stub.
-FAILING_PARK_PROBE_MAKEFILE = """\
-.PHONY: park resume bootstrap siblings
-park:
-\t@echo "PROBE park in $(CURDIR) ARGS=[$(ARGS)]"
-\t@exit 3
-resume:
-\t@echo "PROBE resume in $(CURDIR) ARGS=[$(ARGS)]"
-bootstrap:
-\t@echo "PROBE bootstrap in $(CURDIR)"
-siblings:
-\t@echo "PROBE siblings in $(CURDIR)"
-"""
-
-FAMILY_YAML = """\
-schema_version: 1
-kind: family-manifest
-id: {id}
-name: "{name}"
-org: {org}
-repository: {org}/{name}
-tracking_branch: main
-members_dir: members
-members:{members}
-"""
-
-PROJECT_YAML = """\
-schema_version: 1
-kind: project-manifest
-id: {id}
-name: "{name}"
-tracking_branch: main
-legs:
-  - role: assembly
-    repository: {org}/{name}
-    path: "."
-"""
-
-#: A FAMILY WHOSE DISPLAY `name:` IS NOT ITS REPOSITORY'S NAME (#236).
-#: `family.py init --family Quill --name QuillWorks` writes exactly this:
-#: `name: "QuillWorks"` beside `repository: testorg/Quill`. `FAMILY_YAML`
-#: above always writes `repository: {org}/{name}`, so no test built on it can
-#: tell the two names apart. The holder is NAMED AFTER THE REPOSITORY under
-#: openRepoShape v1.1.0 (opensoft/openRepoShape#629) and `make siblings` stops
-#: before cloning when it is not (opensoft/openRepoShape#543).
-FAMILY_TWO_NAMES_YAML = """\
-schema_version: 1
-kind: family-manifest
-id: {id}
-name: "{name}"
-org: {org}
-repository: {repository}
-tracking_branch: main
-members_dir: members
-members:{members}
-"""
-
-#: The two names of that one family: the folder v1.1.0 prescribes, which is
-#: its repository's last part, and the display name the commands used to
-#: require instead.
-QUILL = "Quill"
-QUILL_DISPLAY = "QuillWorks"
-
-
-# --- the environment every run gets ----------------------------------------
-
-def command_env(home: Path, env: dict | None = None) -> dict:
-    """A fake `$HOME`, every variable these commands read cleared first.
-
-    Cleared rather than merely defaulted, so a developer's own `$PROJECTS_DIR`
-    or `$AGENT_PROTOCOL_ROOT` cannot change what these tests assert.
-    `PYTHON=<this interpreter>` because the Makefiles say `PYTHON ?= python3`
-    and `?=` honours the environment: the suite must exercise the interpreter
-    it is running under, not whichever `python3` is first on PATH.
-    """
-    environ = dict(os.environ)
-    for name in ("PROJECTS_DIR", "AGENT_PROTOCOL_ROOT",
-                 "OPENREPOTOOLS_REMOTE_BASE", "MAKEFLAGS", "MAKELEVEL",
-                 "SPECKIT_WORKSPACE_PATH", "SPECKIT_WORKSPACE_REPOSITORY",
-                 "SPECKIT_GIT_WORKTREE_ROOT"):
-        environ.pop(name, None)
-    environ["HOME"] = str(home)
-    environ["PYTHON"] = sys.executable
-    environ.setdefault("GIT_AUTHOR_NAME", "openRepoShape tests")
-    environ.setdefault("GIT_AUTHOR_EMAIL", "tests@openreposhape.invalid")
-    environ.setdefault("GIT_COMMITTER_NAME", "openRepoShape tests")
-    environ.setdefault("GIT_COMMITTER_EMAIL", "tests@openreposhape.invalid")
-    environ.update(env or {})
-    return environ
-
-
-def run(command: Path, *args: str, home: Path, cwd: Path | None = None,
-        env: dict | None = None) -> subprocess.CompletedProcess:
-    return subprocess.run(["bash", str(command), *args], capture_output=True,
-                          text=True, check=False, input="",
-                          cwd=str(cwd) if cwd else str(home),
-                          env=command_env(home, env))
-
-
-@pytest.fixture
-def home(tmp_path) -> Path:
-    """A fake home with `projects/` in it — the common spelling."""
-    target = tmp_path / "home"
-    (target / "projects").mkdir(parents=True)
-    return target
-
-
-# --- estates on disk, with no remote at all ---------------------------------
-
-def write_stub(root: Path, verb: str, code: int = 0, label: str = "") -> Path:
-    """An executable stand-in for the extension's `<verb>.sh` (#80's stub)."""
-    script = root / OVERLAY / f"{verb}.sh"
-    script.parent.mkdir(parents=True, exist_ok=True)
-    script.write_text(
-        f'#!/bin/sh\necho "{label or verb}.sh ran with: $*"\nexit {code}\n',
-        encoding="utf-8")
-    script.chmod(0o755)
-    return script
-
-
-def probe_family(projects: Path, name: str) -> Path:
-    """A family FOLDER with a holder in it and a probe Makefile. Returns the
-    holder, which is where both verbs must run."""
-    holder = projects / name / name
-    holder.mkdir(parents=True)
-    (holder / "family.yaml").write_text(
-        FAMILY_YAML.format(id=name.lower(), name=name, org=ORG,
-                           members=" []"), encoding="utf-8")
-    (holder / "Makefile").write_text(PROBE_MAKEFILE, encoding="utf-8")
-    return holder
-
-
-def probe_family_two_names(projects: Path, folder: str, *, name: str,
-                           repository: str | None,
-                           member_repository: str | None = None) -> Path:
-    """A family folder like `probe_family`'s, but `family.yaml` carries a
-    display `name:` and a `repository:` of their own (#236), so the folder can
-    equal one, the other, neither. `repository=None` leaves the key out, and
-    `member_repository` adds one member whose own, INDENTED `repository:` is
-    that: a key that is never the holder's."""
-    holder = projects / folder / folder
-    holder.mkdir(parents=True)
-    rows = " []"
-    if member_repository is not None:
-        rows = (f"\n  - project: Alpha\n    id: alpha\n"
-                f"    repository: {member_repository}\n"
-                f"    path: members/Alpha\n")
-    text = FAMILY_TWO_NAMES_YAML.format(
-        id=folder.lower(), name=name, org=ORG, repository=repository,
-        members=rows)
-    if repository is None:
-        text = "".join(line for line in text.splitlines(keepends=True)
-                       if not line.startswith("repository:"))
-    (holder / "family.yaml").write_text(text, encoding="utf-8")
-    (holder / "Makefile").write_text(PROBE_MAKEFILE, encoding="utf-8")
-    return holder
-
-
-def probe_project(projects: Path, name: str, *, at: Path | None = None) -> Path:
-    """A standalone project root with a probe Makefile."""
-    root = at if at is not None else projects / name
-    root.mkdir(parents=True, exist_ok=True)
-    (root / "project.yaml").write_text(
-        PROJECT_YAML.format(id=name.lower(), name=name, org=ORG),
-        encoding="utf-8")
-    (root / "Makefile").write_text(PROBE_MAKEFILE, encoding="utf-8")
-    return root
-
-
-def sweepable_project(projects: Path, name: str, *, at: Path | None = None) -> Path:
-    """A standalone root THE SWEEP WILL RUN: a probe root plus the overlay.
-
-    Since #6 the no-estate sweep asks a standalone root for the Speckit git
-    overlay before running anything in it, the way
-    `templates/assembly-root/Makefile` asks — `test -x
-    .specify/extensions/git/scripts/bash/park.sh`. The stub is never
-    EXECUTED by these tests, because the probe Makefile echoes instead of
-    running it; its presence is the whole point, and a `probe_project`
-    without it is now a root the sweep skips, which is what
-    `probe_project` is left meaning.
-    """
-    root = probe_project(projects, name, at=at)
-    write_stub(root, "park")
-    return root
-
-
-# --- the offline remotes, built once ---------------------------------------
-
-def commit_all(path: Path, message: str) -> None:
-    git("add", "-A", cwd=path)
-    git("-c", "user.name=t", "-c", "user.email=t@t", "commit", "-qm", message,
-        cwd=path)
-
-
-def seed_member(base: Path, name: str) -> Path:
-    """A bare repository holding one member of the family.
-
-    Everything the flow reads and nothing else: an `origin` to identify it by,
-    its own `project.yaml` id and tracking branch, the REAL assembly-root
-    Makefile (so `make park` / `make resume` / `make bootstrap` are the shipped
-    recipes), a `scripts/bootstrap.py` STUB, and the two overlay stubs. TWO
-    commits, so a clone can be reset one back and be genuinely behind.
-    """
-    seed = base / "seed" / name
-    (seed / "scripts").mkdir(parents=True)
-    (seed / "project.yaml").write_text(
-        PROJECT_YAML.format(id=name.lower(), name=name, org=ORG),
-        encoding="utf-8")
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / "Makefile",
-                 seed / "Makefile")
-    # THE TEMPLATE'S OWN `.gitignore`, because a root that did not ignore
-    # `__pycache__/` would read as a DIRTY ROOT the moment anything ran a
-    # script in it - which is a fiction about the project, not about park.
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / ".gitignore",
-                 seed / ".gitignore")
-    (seed / "scripts" / "bootstrap.py").write_text(
-        "#!/usr/bin/env python3\n"
-        f'print("BOOTSTRAP-{name} ran")\n', encoding="utf-8")
-    for verb in ("park", "resume"):
-        write_stub(seed, verb, label=name)
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "seed")
-    (seed / "NOTES.md").write_text("the member moved on\n", encoding="utf-8")
-    commit_all(seed, "a second commit, so a clone can be behind")
-    bare = base / "remotes" / f"{name}.git"
-    bare.parent.mkdir(exist_ok=True)
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return bare
-
-
-def seed_holder(base: Path, members: dict) -> Path:
-    """A bare repository holding the family HOLDER, with real submodules.
-
-    Built from the template bytes, the way `test_park_resume_targets.py`'s
-    fixture is, but with `git submodule add` so a `git clone
-    --recurse-submodules` of it produces the pinned `members/<Project>` copies
-    the holder's own `make bootstrap` and `make validate` read.
-    """
-    seed = base / "seed" / FAMILY
-    (seed / "scripts").mkdir(parents=True)
-    template = UPSTREAM / "templates" / "family-root"
-    shutil.copy2(template / "Makefile", seed / "Makefile")
-    shutil.copy2(template / ".gitignore", seed / ".gitignore")
-    for rel in ("scripts/bootstrap.py", "scripts/siblings.py"):
-        shutil.copy2(template / rel, seed / rel)
-    shutil.copy2(UPSTREAM / "scripts" / "repo_shape.py",
-                 seed / "scripts" / "repo_shape.py")
-    rows = ""
-    for name in MEMBERS:
-        rows += (f"\n  - project: {name}\n"
-                 f"    id: {name.lower()}\n"
-                 f"    repository: {ORG}/{name}\n"
-                 f"    path: members/{name}\n")
-    (seed / "family.yaml").write_text(
-        FAMILY_YAML.format(id=FAMILY.lower(), name=FAMILY, org=ORG,
-                           members=rows), encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "seed")
-    for name in MEMBERS:
-        git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-            str(members[name]), f"members/{name}", cwd=seed)
-    commit_all(seed, "the members, pinned")
-    (seed / "NOTES.md").write_text("the holder moved on\n", encoding="utf-8")
-    commit_all(seed, "a second commit, so a clone can be behind")
-    bare = base / "remotes" / f"{FAMILY}.git"
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return bare
-
-
-def family_manifest(family: str = FAMILY) -> str:
-    """One workspace manifest as `park.sh` WRITES ONE, by hand.
-
-    THE CASING IS THE POINT, and it is why this is written out rather than
-    invented (F2 of the review on #83). `park.sh` takes the header's `family:`
-    from `family.yaml`'s **`id:`** — `workspace_family_name` reads that key —
-    and an id is LOWERCASE by construction (`family.py`: `--id … or
-    family.lower()`, checked against `PROJECT_ID_RE = ^[a-z0-9][a-z0-9-]*$`).
-    The manifest FILE is named for the same id. The family FOLDER, and the
-    holder repository, are the family's CamelCase `name:` — and the only place
-    in the file that carries it is each member's
-    `root: <family folder>/<project folder>`, which
-    `workspace_manifest_root_value` writes with the real casing.
-
-    So: `family: testfam`, `workspaces/<org>/testfam.yaml`, `root:
-    TestFam/Alpha`. A resume that read the folder out of `family:` clones
-    `<org>/testfam` into `~/projects/testfam/testfam`, and this fixture is
-    what makes that fail here instead of on somebody's workstation.
-    """
-    blocks = ""
-    for name in MEMBERS:
-        blocks += f"""\
-  - id: {name.lower()}
-    repository: {ORG}/{name}
-    shape: three-leg
-    root: {family}/{name}
-    tracking_branch: main
-    worktree_root: worktrees
-    parked_at: 2026-09-09T18:42:11Z
-    parked_on: Eagle
-    parked_by_lane: xfactory-2
-    active_feature: 001-{name.lower()}-thing
-    active_feature_source: state_file
-    features:
-      - branch: 001-{name.lower()}-thing
-        feature_directory: worktrees/001-{name.lower()}-thing/spec/specs/001-{name.lower()}-thing
-        legs:
-          - role: spec
-            remote: origin
-            parked_commit: {FAKE_SHA}
-            wip: true
-            wip_depth: 1
-            pushed: true
-"""
-    return (f"schema_version: 1\nkind: workspace-manifest\n"
-            f"family: {family.lower()}\nwritten_by: speckit park\nprojects:\n"
-            + blocks)
-
-
-def standalone_manifest(project: str) -> str:
-    """A STANDALONE project's manifest: no `family:` key, so the root
-    repository is `projects[0].repository` and the folder is its `root:`.
-
-    Named for the project's `project.yaml` id (`alpha`), which is what the
-    extension names it — and not for the folder a person types (`Alpha`),
-    which is why the file is matched case-insensitively.
-    """
-    return f"""schema_version: 1
-kind: workspace-manifest
-written_by: speckit park
-projects:
-  - id: {project.lower()}
-    repository: {ORG}/{project}
-    shape: three-leg
-    root: {project}
-    tracking_branch: main
-    worktree_root: worktrees
-    parked_at: 2026-09-09T18:42:11Z
-    parked_on: Eagle
-    parked_by_lane: xfactory-2
-    active_feature: 001-{project.lower()}-thing
-    active_feature_source: state_file
-    features:
-      - branch: 001-{project.lower()}-thing
-        legs:
-          - role: repo
-            remote: origin
-            parked_commit: {FAKE_SHA}
-            wip: false
-            wip_depth: 0
-            pushed: true
-"""
-
-
-#: The member for the leg guard: the REAL assembly-root bootstrap, and a real
-#: submodule leg. `Charlie` rather than one of MEMBERS because the family
-#: fixtures are session-scoped and this one is the only place that wants a leg.
-LEG_MEMBER = "Charlie"
-
-
-def seed_leg_member(base: Path, member: str = LEG_MEMBER,
-                    leg_branch: str | None = None, code_leg: bool = False,
-                    spec_path: str = "spec") -> tuple[Path, Path]:
-    """A bare project WITH A LEG, carrying the REAL `scripts/bootstrap.py`.
-
-    THE GUARD MUST GUARD THE REAL THING (F3 of the review on #83). The other
-    seeded members ship a bootstrap STUB that only echoes, which would let a
-    leg-guard test pass against a script that could not have moved anything.
-    This one ships `templates/assembly-root/scripts/bootstrap.py` itself — the
-    file whose `checkout_tracking_branch` runs `git checkout <tracking>` in a
-    leg whose branch tip equals the pin — so the test is about that code.
-
-    `leg_branch` makes the spec leg's row declare `branch: <leg_branch>`, the
-    leg's OWN branch (#235), which `bootstrap.py` places the leg on instead of
-    the root's `tracking_branch`. The leg's remote then has that branch too,
-    at the pin, so a leg can sit on it and `bootstrap.py` can check it out.
-    `code_leg` adds a second leg, `code`, whose row declares no branch of its
-    own, so one root holds a leg that does and one that does not. `spec_path`
-    is the TEXT of the spec row's `path:`, for a manifest that spells it
-    `"./spec"` or `spec/` over a `.gitmodules` that says `spec`.
-    """
-    leg_seed = base / "seed" / f"{member}-spec"
-    leg_seed.mkdir(parents=True)
-    (leg_seed / "spec.md").write_text("# the spec leg\n", encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=leg_seed)
-    commit_all(leg_seed, "the leg")
-    if leg_branch is not None:
-        git("branch", leg_branch, cwd=leg_seed)
-    leg_bare = base / "remotes" / f"{member}-spec.git"
-    leg_bare.parent.mkdir(exist_ok=True)
-    git("clone", "-q", "--bare", str(leg_seed), str(leg_bare), cwd=base)
-    code_bare = base / "remotes" / f"{member}-code.git"
-    code_row = ""
-    if code_leg:
-        code_seed = base / "seed" / f"{member}-code"
-        code_seed.mkdir(parents=True)
-        (code_seed / "code.md").write_text("# the code leg\n", encoding="utf-8")
-        git("init", "-q", "-b", "main", ".", cwd=code_seed)
-        commit_all(code_seed, "the code leg")
-        git("clone", "-q", "--bare", str(code_seed), str(code_bare), cwd=base)
-        code_row = (f"  - role: code\n    repository: {ORG}/{member}-code\n"
-                    "    path: code\n")
-
-    seed = base / "seed" / member
-    (seed / "scripts").mkdir(parents=True)
-    own_branch = "" if leg_branch is None else f"    branch: {leg_branch}\n"
-    (seed / "project.yaml").write_text(
-        "schema_version: 1\nkind: project-manifest\n"
-        f"id: {member.lower()}\nname: \"{member}\"\n"
-        "tracking_branch: main\nlegs:\n"
-        f"  - role: assembly\n    repository: {ORG}/{member}\n"
-        '    path: "."\n'
-        f"  - role: spec\n    repository: {ORG}/{member}-spec\n"
-        f"    path: {spec_path}\n{own_branch}{code_row}", encoding="utf-8")
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / "Makefile",
-                 seed / "Makefile")
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / ".gitignore",
-                 seed / ".gitignore")
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / "scripts" / "bootstrap.py",
-                 seed / "scripts" / "bootstrap.py")
-    shutil.copy2(UPSTREAM / "scripts" / "repo_shape.py",
-                 seed / "scripts" / "repo_shape.py")
-    for verb in ("park", "resume"):
-        write_stub(seed, verb, label=member)
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "seed")
-    git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-        str(leg_bare), "spec", cwd=seed)
-    if code_leg:
-        git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-            str(code_bare), "code", cwd=seed)
-    commit_all(seed, "the leg, pinned")
-    bare = base / "remotes" / f"{member}.git"
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return bare, leg_bare
-
-
-def seed_workspace(base: Path, name: str, files: dict) -> Path:
-    """A bare repository standing in for the person's private `<user>-wip`."""
-    seed = base / "seed" / f"ws-{name}"
-    seed.mkdir(parents=True)
-    for rel, body in files.items():
-        target = seed / rel
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text(body, encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "the record")
-    bare = base / "remotes" / f"{name}.git"
-    bare.parent.mkdir(exist_ok=True)
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return bare
-
-
-@pytest.fixture(scope="session")
-def remotes(tmp_path_factory) -> dict:
-    """Every bare repository this file clones from, built once."""
-    base = tmp_path_factory.mktemp("parkresume")
-    members = {name: seed_member(base, name) for name in MEMBERS}
-    holder = seed_holder(base, members)
-    workspace = seed_workspace(
-        base, "wip",
-        {f"workspaces/{ORG}/{FAMILY.lower()}.yaml": family_manifest()})
-    two_orgs = seed_workspace(
-        base, "twoorgs",
-        {f"workspaces/orga/{FAMILY.lower()}.yaml": family_manifest(),
-         f"workspaces/orgb/{FAMILY.lower()}.yaml": family_manifest()})
-    solo = seed_workspace(
-        base, "solo",
-        {f"workspaces/{ORG}/alpha.yaml": standalone_manifest("Alpha")})
-    leg_member, leg_bare = seed_leg_member(base)
-    legged = seed_workspace(
-        base, "legged",
-        {f"workspaces/{ORG}/{LEG_MEMBER.lower()}.yaml":
-            standalone_manifest(LEG_MEMBER)})
-    # A `root:` that walks OUT of the projects directory, which the schema's
-    # own invariant forbids and a hand-edited file can still carry (F7).
-    escaping = seed_workspace(
-        base, "escaping",
-        {f"workspaces/{ORG}/runaway.yaml":
-            standalone_manifest("Alpha").replace(
-                "root: Alpha", "root: ../../elsewhere/Alpha").replace(
-                "id: alpha", "id: runaway")})
-    return {"base": base, "dir": base / "remotes", "members": members,
-            "holder": holder, "workspace": workspace, "two_orgs": two_orgs,
-            "solo": solo, "leg_member": leg_member, "leg_bare": leg_bare,
-            "legged": legged, "escaping": escaping}
-
-
-def offline(remotes: dict, extra: dict | None = None) -> dict:
-    return {"OPENREPOTOOLS_REMOTE_BASE": str(remotes["dir"]),
-            **ALLOW_FILE_PROTOCOL, **(extra or {})}
-
-
-@pytest.fixture
-def estate(remotes, home) -> dict:
-    """The family estate ALREADY on this machine: holder plus both siblings.
-
-    Cloned rather than resumed, so the tests about `park` and about a REFRESH
-    do not depend on the fresh-machine path working first.
-    """
-    projects = home / "projects"
-    folder = projects / FAMILY
-    folder.mkdir(parents=True, exist_ok=True)
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(remotes["holder"]), str(folder / FAMILY),
-        cwd=projects)
-    siblings = {}
-    for name in MEMBERS:
-        git("clone", "-q", str(remotes["members"][name]),
-            str(folder / name), cwd=projects)
-        siblings[name] = folder / name
-    return {"projects": projects, "folder": folder, "holder": folder / FAMILY,
-            "siblings": siblings}
-
-
-@pytest.fixture(scope="session")
-def named_apart(tmp_path_factory, remotes) -> dict:
-    """The family of #236, whose display name is not its repository's name,
-    as bare repositories: the holder `Quill.git` and a workspace `wip.git`.
-
-    The holder is `remotes["holder"]` with ONLY `family.yaml` rewritten — `id:
-    quill`, `name: "QuillWorks"`, `repository: testorg/Quill` — so it still
-    carries the template bytes and the pinned members every other holder here
-    does. The bare is called `Quill.git` because that is what `resume` asks
-    for: `clone_url_for testorg/Quill`.
-
-    The workspace carries ONE record of it, as `park.sh` files one: named for
-    the family's id (`quill.yaml`, `family: quill`), parked from v1.1.0's
-    layout so each `root:` is `Quill/<member>`. It is `family_manifest`'s own,
-    so the record says nothing about the holder's repository: `family:` is
-    the id, and the org is the directory it is filed under. A second record
-    named for the display name (`quillworks.yaml`) is a file park never writes
-    for `id: quill` (#243), so there is none.
-    """
-    base = tmp_path_factory.mktemp("namedapart")
-    seed = base / "seed" / QUILL
-    seed.parent.mkdir(parents=True)
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(remotes["holder"]), str(seed), cwd=base)
-    family_yaml = seed / "family.yaml"
-    text = family_yaml.read_text(encoding="utf-8")
-    rewritten = (text
-                 .replace(f"id: {FAMILY.lower()}\n", f"id: {QUILL.lower()}\n")
-                 .replace(f'name: "{FAMILY}"\n', f'name: "{QUILL_DISPLAY}"\n')
-                 .replace(f"repository: {ORG}/{FAMILY}\n",
-                          f"repository: {ORG}/{QUILL}\n"))
-    # A rewrite that matched nothing would leave `TestFam` in a fixture that
-    # claims not to be it, and every test below would be about the wrong file.
-    assert FAMILY not in rewritten, rewritten
-    assert (f'name: "{QUILL_DISPLAY}"\n' in rewritten
-            and f"repository: {ORG}/{QUILL}\n" in rewritten), rewritten
-    family_yaml.write_text(rewritten, encoding="utf-8")
-    commit_all(seed, "the family's display name is not its repository's")
-    holder = base / "remotes" / f"{QUILL}.git"
-    holder.parent.mkdir(exist_ok=True)
-    git("clone", "-q", "--bare", str(seed), str(holder), cwd=base)
-    workspace = seed_workspace(
-        base, "wip",
-        {f"workspaces/{ORG}/{QUILL.lower()}.yaml": family_manifest(QUILL)})
-    return {"dir": base / "remotes", "holder": holder, "workspace": workspace}
-
-
-def clone_quill_estate(named_apart: dict, remotes: dict, home: Path,
-                       folder: str) -> dict:
-    """`estate`'s own shape, for the family of #236 laid out in `folder`:
-    the holder at `<folder>/<folder>` and each member's working clone beside
-    it. `folder` is `QUILL` (v1.1.0's rule) or `QUILL_DISPLAY` (the rule
-    before it); the holder's own `family.yaml` is the same in both."""
-    projects = home / "projects"
-    where = projects / folder
-    where.mkdir(parents=True, exist_ok=True)
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(named_apart["holder"]),
-        str(where / folder), cwd=projects)
-    siblings = {}
-    for name in MEMBERS:
-        git("clone", "-q", str(remotes["members"][name]),
-            str(where / name), cwd=projects)
-        siblings[name] = where / name
-    return {"projects": projects, "folder": where, "holder": where / folder,
-            "siblings": siblings}
-
-
-def place_quill_workspace(named_apart: dict, home: Path,
-                          bare: Path | None = None) -> None:
-    """The configured workspace, already cloned: what `resume` reads a record
-    out of on a machine that has resumed before (`behind`'s own setup).
-    `bare` is another workspace than `named_apart`'s own."""
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    git("clone", "-q", str(bare or named_apart["workspace"]),
-        str(home / "projects" / "wip"), cwd=home)
-
-
-# ===========================================================================
-# estate resolution — the half both commands share
-# ===========================================================================
-
-@pytest.mark.parametrize("spelling", ["projects", "Projects"])
-def test_a_named_estate_is_found_under_either_spelling(tmp_path, spelling):
-    """People spell it both ways, which is the issue's own words."""
-    fake_home = tmp_path / "home"
-    projects = fake_home / spelling
-    projects.mkdir(parents=True)
-    holder = probe_family(projects, "InkRouter")
-    result = run(PARK, "InkRouter", home=fake_home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout
-
-
-def test_projects_dir_overrides_both_spellings(tmp_path):
-    fake_home = tmp_path / "home"
-    fake_home.mkdir()
-    elsewhere = tmp_path / "code"
-    elsewhere.mkdir()
-    root = probe_project(elsewhere, "Atlas")
-    result = run(PARK, "Atlas", home=fake_home,
-                 env={"PROJECTS_DIR": str(elsewhere)})
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {root} ARGS=[]" in result.stdout
-
-
-def test_a_family_folder_wins_over_a_standalone_root_of_the_same_name(home):
-    """The holder is what drives the members. A family answered as one of its
-    own members would park one project and report the estate parked."""
-    projects = home / "projects"
-    holder = probe_family(projects, "Dual")
-    probe_project(projects, "Dual", at=projects / "Dual")
-    result = run(PARK, "Dual", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {holder}" in result.stdout
-    assert f"PROBE park in {projects / 'Dual'} " not in result.stdout
-
-
-# --- a family folder is named for its repository OR its display name (#236) --
-#
-# `is_family_folder` required `family.yaml`'s display `name:` to equal the
-# folder, and openRepoShape v1.1.0 names the folder after the holder's
-# REPOSITORY instead (opensoft/openRepoShape#629), stopping `make siblings`
-# before it clones when it is not (opensoft/openRepoShape#543). A family whose
-# two names differ had no layout both could use. Either name now finds it.
-
-@pytest.mark.parametrize("command", [PARK, RESUME], ids=["park", "resume"])
-@pytest.mark.parametrize("folder", [QUILL, QUILL_DISPLAY],
-                         ids=["repository", "name"])
-def test_a_family_folder_is_found_by_its_repository_name_or_its_display_name(
-        named_apart, remotes, home, command, folder):
-    """`Quill/Quill` is v1.1.0's layout and `QuillWorks/QuillWorks` the one the
-    commands required before it; one `family.yaml` (`name: "QuillWorks"`,
-    `repository: testorg/Quill`) is found in both, by the folder's own name."""
-    quill = clone_quill_estate(named_apart, remotes, home, folder)
-    place_quill_workspace(named_apart, home)
-    result = run(command, folder, "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "no estate named" not in result.stderr
-    assert f"{quill['holder']}" in result.stdout
-    if command == PARK:
-        assert (f"park: {folder} - the family holder at {quill['holder']}"
-                in result.stdout)
-        for name in MEMBERS:
-            assert f"--- {name}: make park ---" in result.stdout
-    else:
-        assert f"present         {quill['folder']} (family)" in result.stdout
-
-
-@pytest.mark.parametrize("command", [PARK, RESUME], ids=["park", "resume"])
-@pytest.mark.parametrize("shape", [
-    ("Elsewhere", "Other", f"{ORG}/Other", None),
-    (ORG, "Other", f"{ORG}/Quill/Other", None),
-    ("Quill", "Other", None, None),
-    ("Quill", "Other", None, f"{ORG}/Quill"),
-], ids=["neither-name-nor-repository",
-        "an-earlier-part-of-the-repository", "no-repository-and-another-name",
-        "only-a-members-repository-ends-in-the-folder"])
-def test_a_family_folder_that_is_neither_name_still_refuses(
-        remotes, home, command, shape):
-    """What the second arm must NOT widen into. The folder has to equal the
-    LAST part of `repository:` — not any part, not the org, not whatever a
-    missing key reads as, and not a MEMBER's own `repository:` (indented, so
-    never the holder's) — or `name:`; anything else is a directory called
-    that, as it always was."""
-    folder, name, repository, member_repository = shape
-    projects = home / "projects"
-    probe_family_two_names(projects, folder, name=name, repository=repository,
-                           member_repository=member_repository)
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    result = run(command, folder, home=home, env=offline(remotes))
-    assert result.returncode == 2, result.stdout + result.stderr
-    if command == PARK:
-        assert f"no estate named '{folder}'" in result.stderr
-        assert f"PROBE park in {projects / folder / folder}" not in result.stdout
-    else:
-        assert f"no workspace manifest records '{folder}'" in result.stderr
-        assert f"present         {projects / folder}" not in result.stdout
-
-
-#: `family.yaml`'s `repository:` line as openRepoShape v1.1.0's `parse_yaml`
-#: and `repo_basename` read it (#243): the folder, the value, and whether the
-#: folder is that family's. The first three are the issue's own table, where
-#: the commands read the comment into the value and `null` as text. The last
-#: two are the quoting rules that go with them: a ` #` INSIDE quotes is text,
-#: not a comment, and only an UNQUOTED `null` is YAML's null.
-REPOSITORY_VALUE_SHAPES = [
-    ("a-trailing-comment", QUILL, f"{ORG}/{QUILL}   # the holder", True),
-    ("a-trailing-comment-after-quotes", QUILL,
-     f'"{ORG}/{QUILL}"   # the holder', True),
-    ("an-unquoted-null-is-no-repository", "null", "null", False),
-    ("a-quoted-null-is-the-text-null", "null", '"null"', True),
-    ("a-hash-inside-quotes-is-text", QUILL, f'"{ORG}/{QUILL} #2"', False),
-]
-
-
-@pytest.mark.parametrize("folder, repository, found",
-                         [case[1:] for case in REPOSITORY_VALUE_SHAPES],
-                         ids=[case[0] for case in REPOSITORY_VALUE_SHAPES])
-def test_a_family_yamls_repository_is_read_the_way_yaml_reads_it(
-        home, folder, repository, found):
-    """The display `name:` is never the folder here, so the repository arm
-    alone decides. `testorg/Quill   # the holder` is `Quill` to v1.1.0 and was
-    `Quill   # the holder` here; `null` is no repository to v1.1.0, which then
-    falls back to `name:`, and was a folder called `null` here. The fix is in
-    the shared `trim_unquote` and nowhere narrower, because a cut inside
-    `is_family_folder` alone would have left the quotes on the second row and
-    cut the last one short."""
-    projects = home / "projects"
-    holder = probe_family_two_names(projects, folder, name="Other",
-                                    repository=repository)
-    result = run(PARK, folder, home=home)
-    if found:
-        assert result.returncode == 0, result.stderr + result.stdout
-        assert (f"park: {folder} - the family holder at {holder}"
-                in result.stdout)
-        assert f"PROBE park in {holder}" in result.stdout
-    else:
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"no estate named '{folder}'" in result.stderr
-        assert "PROBE park" not in result.stdout
-
-
-def test_a_family_folder_named_for_its_repository_wins_over_a_standalone_root(
-        home):
-    """The same rule as above, for a family whose `name:` differs: the holder
-    drives the members, so it is still the answer where a standalone
-    `project.yaml` sits in the same folder."""
-    projects = home / "projects"
-    holder = probe_family_two_names(projects, QUILL, name=QUILL_DISPLAY,
-                                    repository=f"{ORG}/{QUILL}")
-    probe_project(projects, QUILL, at=projects / QUILL)
-    result = run(PARK, QUILL, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"park: {QUILL} - the family holder at {holder}" in result.stdout
-    assert f"PROBE park in {holder}" in result.stdout
-    assert f"PROBE park in {projects / QUILL} " not in result.stdout
-
-
-def test_with_no_name_the_estate_around_the_cwd_is_used(home):
-    """`park` from a subdirectory, which is how a person actually types it."""
-    projects = home / "projects"
-    holder = probe_family(projects, "InkRouter")
-    deep = holder / "scripts" / "inner"
-    deep.mkdir(parents=True)
-    result = run(PARK, home=home, cwd=deep)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {holder}" in result.stdout
-
-
-def test_nearest_wins_so_a_member_parks_itself(home):
-    """Standing inside a member of a family, the member is the estate. Nearest
-    wins: it is where the person is."""
-    projects = home / "projects"
-    probe_family(projects, "InkRouter")
-    member = probe_project(projects, "IRRS", at=projects / "InkRouter" / "IRRS")
-    result = run(PARK, home=home, cwd=member)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {member}" in result.stdout
-
-
-@pytest.mark.parametrize("where", [f"{QUILL}/{QUILL}/scripts",
-                                   f"{QUILL}/{QUILL}", QUILL,
-                                   f"{QUILL}/Alpha"],
-                         ids=["inside-the-holder", "the-holder",
-                              "the-family-folder", "inside-a-member"])
-def test_the_walk_up_finds_a_family_named_for_its_repository_and_nearest_wins(
-        home, where):
-    """The two tests above, for a family whose folder is named for its
-    REPOSITORY (#236) and not its display `name:` (#243, the review of #240's
-    note 3). Every case before resolved by `<Name>`; this is the walk-up.
-    From inside the holder, the holder itself, or the family folder, `park`
-    answers the holder; from inside the member beside it, the member, because
-    the nearest estate wins."""
-    projects = home / "projects"
-    holder = probe_family_two_names(projects, QUILL, name=QUILL_DISPLAY,
-                                    repository=f"{ORG}/{QUILL}")
-    (holder / "scripts").mkdir()
-    member = probe_project(projects, "Alpha", at=projects / QUILL / "Alpha")
-    result = run(PARK, "--dry-run", home=home, cwd=projects / where)
-    assert result.returncode == 0, result.stderr + result.stdout
-    if where.endswith("/Alpha"):
-        assert (f"park: Alpha - the assembly root at {member}"
-                in result.stdout)
-        assert f"PROBE park in {member} ARGS=[--dry-run]" in result.stdout
-        assert f"PROBE park in {holder}" not in result.stdout
-    else:
-        assert (f"park: {QUILL} - the family holder at {holder}"
-                in result.stdout)
-        assert f"PROBE park in {holder} ARGS=[--dry-run]" in result.stdout
-
-
-# --- the bare form outside every estate ASKS; `--all` / `-a` is the sweep ----
-#
-# THIS IS WHERE `park` AND `resume` STOP SHARING THE ANSWER. Ruling 3 of #82
-# ("no <Name> and no estate around the cwd REFUSES and lists what it found")
-# was superseded for `park`'s bare form by Brett Heap's RULING of 2026-09-10
-# on openRepoShape #91 (the bare form PARKED EVERY ESTATE, unasked), and that
-# was superseded the same day by his RULING in this repository, verbatim:
-# "lets change that so it parks the current repo. if not in a repo, then asks
-# if want to park all. and park all should be park -a or park --all." The
-# sweep itself is #91's; HOW IT IS REACHED is what these tests hold: the
-# walk-up first, then a question at a terminal, a refusal naming `--all`
-# without one, and `--all` / `-a` as the sweep with no question, from
-# anywhere. `resume`'s own bare form keeps ruling 3, and
-# `test_resume_with_no_name_and_no_estate_refuses`, at the end of this file,
-# is what holds that half still.
-
-#: The one line `park` asks with. On STDERR, where a prompt belongs, so a
-#: `park > log` still shows it; the tests read it there and nowhere else.
-QUESTION = "park every estate above? [y/N]"
-
-
-def run_at_a_terminal(command: Path, *args: str, answer: str, home: Path,
-                      cwd: Path | None = None) -> subprocess.CompletedProcess:
-    """`run`, except stdin is a PSEUDO-TERMINAL and `answer` is what the
-    person types at it.
-
-    `[ -t 0 ]` is how `park` decides whether it may ask, and the pipe `run`
-    hands it is the honest way to reach the OTHER branch — so the question
-    path needs a real tty on stdin, which `pty.openpty` is. stdout and stderr
-    stay pipes: the question (stderr) and the report (stdout) are captured
-    apart, exactly as a person's `park > log` would split them. `pty` is
-    imported here and not at the top because the module does not exist on
-    Windows, and this file has to IMPORT there in order to skip.
-    """
-    import pty
-    master, slave = pty.openpty()
-    try:
-        proc = subprocess.Popen(
-            ["bash", str(command), *args], stdin=slave,
-            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True,
-            cwd=str(cwd) if cwd else str(home), env=command_env(home))
-        os.close(slave)
-        slave = -1
-        # Typed before `park` reads it: the line discipline holds the line,
-        # exactly as a terminal holds one typed ahead of the prompt.
-        os.write(master, (answer + "\n").encode())
-        out, err = proc.communicate(timeout=120)
-    finally:
-        if slave != -1:
-            os.close(slave)
-        os.close(master)
-    return subprocess.CompletedProcess(proc.args, proc.returncode, out, err)
-
-
-@pytest.mark.parametrize("answer", ["y", "Y", "yes", "YES"])
-def test_bare_park_outside_every_estate_asks_and_a_yes_parks_them_all(home,
-                                                                     answer):
-    """The question, then #91's sweep: the list first, every estate in NAME
-    order, one summary — reached by an answer, not by default."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = sweepable_project(projects, "Atlas")
-    result = run_at_a_terminal(PARK, answer=answer, home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert QUESTION in result.stderr, "the question, on stderr"
-    assert "no estate around" in result.stdout
-    assert "family   TestFam" in result.stdout
-    assert "project  Atlas" in result.stdout
-
-    list_at = result.stdout.index("Every estate under")
-    atlas_at = result.stdout.index("=== park Atlas ===")
-    testfam_at = result.stdout.index("=== park TestFam ===")
-    assert list_at < atlas_at < testfam_at, (
-        "the list must print first, and the estates must run in NAME order")
-
-    assert f"PROBE park in {root} ARGS=[]" in result.stdout
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout
-    assert "  parked     Atlas" in result.stdout
-    assert "  parked     TestFam" in result.stdout
-    assert "park: 2 estate(s) parked, 0 refused or with findings" \
-        in result.stdout
-
-
-@pytest.mark.parametrize("answer", ["", "n", "no", "yep"],
-                         ids=["enter", "n", "no", "yep"])
-def test_bare_park_outside_every_estate_parks_nothing_unless_the_answer_is_yes(
-        home, answer):
-    """Enter is a no. So is anything that is not `y` or `yes`: parking every
-    estate on a workstation is an answer a person has to GIVE."""
-    projects = home / "projects"
-    probe_family(projects, "TestFam")
-    sweepable_project(projects, "Atlas")
-    result = run_at_a_terminal(PARK, answer=answer, home=home, cwd=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert QUESTION in result.stderr
-    assert "family   TestFam" in result.stdout, "the list comes before the question"
-    assert "project  Atlas" in result.stdout
-    assert "nothing was parked" in result.stderr
-    assert "park --all" in result.stderr, "the refusal names the unasked form"
-    assert "PROBE park in" not in result.stdout, "nothing ran"
-    assert "=== park" not in result.stdout
-
-
-def test_bare_park_outside_every_estate_with_no_terminal_refuses_and_names_all(
-        home):
-    """`run` hands `park` a PIPE for stdin — what a script, a cron job or an
-    assistant's tool call hands it. Nothing can be asked, so nothing is
-    parked, and the refusal says how a script asks for the sweep: `--all`."""
-    projects = home / "projects"
-    probe_family(projects, "TestFam")
-    sweepable_project(projects, "Atlas")
-    result = run(PARK, home=home, cwd=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no estate around" in result.stderr
-    assert "not a terminal" in result.stderr
-    assert "park --all" in result.stderr
-    assert "family   TestFam" in result.stderr, (
-        "ruling 3's list, so the person can name one")
-    assert "project  Atlas" in result.stderr
-    assert QUESTION not in result.stderr, "nothing was asked"
-    assert "PROBE park in" not in result.stdout
-
-
-def test_bare_park_inside_an_estate_still_parks_only_that_one(home):
-    """THE WALK-UP WINS FIRST — "it parks the current repo": standing inside
-    an estate parks that estate, asks nothing, and never parks the
-    workstation."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = probe_project(projects, "Atlas")
-    result = run(PARK, home=home, cwd=holder)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"the family holder at {holder}" in result.stdout
-    assert "parking every estate" not in result.stdout
-    assert QUESTION not in result.stderr
-    assert f"PROBE park in {root}" not in result.stdout, (
-        "the OTHER estate must not have been parked")
-
-
-@pytest.mark.parametrize("flag", ["--all", "-a"])
-def test_park_all_parks_every_estate_in_name_order_and_asks_nothing(home,
-                                                                    flag):
-    """#91's sweep, asked for by name: the list under its own heading, every
-    estate in NAME order, one summary, and no question — at a pipe, which is
-    what `run` gives it, exactly as at a terminal."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = sweepable_project(projects, "Atlas")
-    result = run(PARK, flag, home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "park --all: parking every estate under" in result.stdout
-    assert "family   TestFam" in result.stdout
-    assert "project  Atlas" in result.stdout
-    assert QUESTION not in result.stderr
-    assert "no estate around" not in result.stdout + result.stderr, (
-        "--all is not a fallback; it is the ask")
-
-    list_at = result.stdout.index("parking every estate under")
-    atlas_at = result.stdout.index("=== park Atlas ===")
-    testfam_at = result.stdout.index("=== park TestFam ===")
-    assert list_at < atlas_at < testfam_at, (
-        "the list must print first, and the estates must run in NAME order")
-
-    assert f"PROBE park in {root} ARGS=[]" in result.stdout
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout
-    assert "  parked     Atlas" in result.stdout
-    assert "  parked     TestFam" in result.stdout
-    assert "park: 2 estate(s) parked, 0 refused or with findings" \
-        in result.stdout
-
-
-def test_park_all_from_inside_an_estate_still_parks_every_estate(home):
-    """A flag that says every one is not narrowed by where you stand."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = sweepable_project(projects, "Atlas")
-    result = run(PARK, "--all", home=home, cwd=holder)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "park --all: parking every estate under" in result.stdout
-    assert f"PROBE park in {root} ARGS=[]" in result.stdout
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout
-    assert "park: 2 estate(s) parked, 0 refused or with findings" \
-        in result.stdout
-
-
-def test_park_all_continues_past_a_refused_estate_and_still_parks_the_rest(
-        home):
-    """A skip is not a pass (#80's rule): one estate's own `make park`
-    exiting non-zero must not stop the others, and the overall run must not
-    read as clean either."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = sweepable_project(projects, "Atlas")
-    (root / "Makefile").write_text(FAILING_PARK_PROBE_MAKEFILE,
-                                   encoding="utf-8")
-
-    result = run(PARK, "--all", home=home, cwd=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"PROBE park in {root} ARGS=[]" in result.stdout, (
-        "the refused estate still ran; it is refused by its OWN exit code")
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout, (
-        "the estate after the refused one must still be parked")
-    assert "park: Atlas - `make park` exited 2" in result.stdout, (
-        "make wraps the recipe's exit 3 in its own exit 2")
-    assert "  refused    Atlas (exit 2)" in result.stdout
-    assert "  parked     TestFam" in result.stdout
-    assert "park: 1 estate(s) parked, 1 refused or with findings" \
-        in result.stdout
-
-
-def test_park_all_dry_run_lane_and_passthrough_args_reach_every_estate(home):
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    root = sweepable_project(projects, "Atlas")
-    result = run(PARK, "--all", "--dry-run", "--lane", "xfactory-2", "--",
-                 "--feature", "001-a", home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    expected = "ARGS=[--dry-run --lane xfactory-2 --feature 001-a]"
-    assert f"PROBE park in {root} {expected}" in result.stdout
-    assert f"PROBE park in {holder} {expected}" in result.stdout
-    assert result.stdout.count(
-        "--dry-run: nothing was committed, pushed or recorded.") == 2
-
-
-def test_park_all_with_a_name_or_a_repo_refuses(home):
-    """One estate or every estate, never both spelled at once."""
-    projects = home / "projects"
-    root = sweepable_project(projects, "Atlas")
-    named = run(PARK, "Atlas", "--all", home=home)
-    assert named.returncode == 2, named.stdout + named.stderr
-    assert "both <Name> ('Atlas') and --all" in named.stderr
-    by_repo = run(PARK, "--all", "--repo", "TestOrg/Atlas", home=home)
-    assert by_repo.returncode == 2, by_repo.stdout + by_repo.stderr
-    assert "both --repo 'TestOrg/Atlas' and --all" in by_repo.stderr
-    for result in (named, by_repo):
-        assert f"PROBE park in {root}" not in result.stdout, "nothing ran"
-
-
-def test_park_all_with_no_estate_anywhere_refuses(home):
-    result = run(PARK, "--all", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "--all found no estate under" in result.stderr
-    assert "resume <Name>" in result.stderr
-    assert "PROBE park in" not in result.stdout
-
-
-# --- #6: the sweep SKIPS a root that has no Speckit overlay ----------------
-#
-# Brett Heap's RULING of 2026-09-10 on openRepoShape #92, verbatim: "rule on
-# the #92 open item: skip roots without the overlay." A root whose
-# `.specify/extensions/git/scripts/bash/park.sh` is not there is one whose
-# own `make park` can only refuse (exit 2), so counting it as a refusal made
-# a real workstation's sweep exit 1 for ever. THE SWEEP skips it; the person
-# who NAMES it still gets the refusal, which is the pair of tests below. The
-# sweep is driven with `--all` here, which is the form that asks nothing;
-# the bare form's YES runs the identical `park_every_estate`, and the tests
-# above hold that.
-
-def test_the_sweep_skips_a_root_without_the_overlay_and_parks_the_rest(home):
-    """Both answers in one run: the roots that CAN park do, the ones that
-    cannot are named and counted apart, and the run is clean."""
-    projects = home / "projects"
-    parkable = {name: sweepable_project(projects, name)
-                for name in ("Atlas", "Borealis")}
-    bare = {name: probe_project(projects, name)
-            for name in ("MedxEHR", "openDox")}
-
-    result = run(PARK, "--all", home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    for name, root in parkable.items():
-        assert f"PROBE park in {root} ARGS=[]" in result.stdout
-        assert f"  parked     {name}" in result.stdout
-    for name, root in bare.items():
-        assert f"=== park {name} ===" in result.stdout, (
-            "a root left out of the run silently is one a person has to go "
-            "and look for; the heading is how they see it was considered")
-        assert f"PROBE park in {root}" not in result.stdout, (
-            f"nothing may run in {name}: it was skipped, not parked")
-        assert f"  skipped    {name} (no Speckit overlay)" in result.stdout
-    assert result.stdout.count(
-        "SKIPPED (no Speckit overlay; install it with: setup-openspeckit)") \
-        == 2, "one line per skipped root, and it names the installer"
-    assert ("park: 2 estate(s) parked, 0 refused or with findings, "
-            "2 skipped (no overlay)") in result.stdout
-
-
-def test_every_estate_skipped_is_exit_zero_and_says_so(home):
-    """Nothing ran, so nothing failed. A workstation whose roots have never
-    been given the overlay must not be told its park failed — it must be
-    told what to install."""
-    projects = home / "projects"
-    for name in ("MedxEHR", "openDox"):
-        probe_project(projects, name)
-
-    result = run(PARK, "--all", home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "PROBE park in" not in result.stdout
-    assert ("park: 0 estate(s) parked, 0 refused or with findings, "
-            "2 skipped (no overlay)") in result.stdout
-    assert "nothing here was park-able" in result.stdout
-    assert "setup-openspeckit" in result.stdout
-
-
-def test_a_skipped_root_never_hides_a_real_refusal(home):
-    """The exit code is computed over the estates that RAN. One that refused
-    still fails the run, and both lines are on screen — which is the whole
-    reason the skipped ones are counted apart rather than not printed."""
-    projects = home / "projects"
-    refuser = sweepable_project(projects, "Atlas")
-    (refuser / "Makefile").write_text(FAILING_PARK_PROBE_MAKEFILE,
-                                      encoding="utf-8")
-    probe_project(projects, "MedxEHR")
-    holder = probe_family(projects, "TestFam")
-
-    result = run(PARK, "--all", home=home, cwd=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "  refused    Atlas (exit 2)" in result.stdout
-    assert "  skipped    MedxEHR (no Speckit overlay)" in result.stdout
-    assert "  parked     TestFam" in result.stdout
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout, (
-        "the estate after the skipped one must still be parked")
-    assert ("park: 1 estate(s) parked, 1 refused or with findings, "
-            "1 skipped (no overlay)") in result.stdout
-
-
-def test_the_sweep_dry_run_says_it_would_skip_and_creates_nothing(home):
-    projects = home / "projects"
-    root = probe_project(projects, "MedxEHR")
-    before = sorted(p.name for p in root.iterdir())
-
-    result = run(PARK, "--all", "--dry-run", home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert ("would skip (no Speckit overlay; install it with: "
-            "setup-openspeckit)") in result.stdout
-    assert "SKIPPED (" not in result.stdout, (
-        "a rehearsal reports what it WOULD do; only a real run skips")
-    assert sorted(p.name for p in root.iterdir()) == before
-    assert not (root / OVERLAY).exists(), "park installs nothing, ever"
-
-
-def test_naming_an_overlay_less_root_still_relays_the_makefiles_refusal(home):
-    """ONLY THE SWEEP SKIPS. `park <Name>` named a root, and a person who
-    named one gets its own `make park` refusal — the Makefile's, verbatim,
-    naming the installer.
-
-    Against the REAL `templates/assembly-root/Makefile`, because the refusal
-    under test is that file's `test -x $(PARK) || … exit 2` and a probe
-    Makefile could only fake it. The same root is swept first, to show the
-    two answers coming apart on one directory: skipped when nobody named it,
-    refused when somebody did.
-    """
-    projects = home / "projects"
-    root = projects / "MedxEHR"
-    root.mkdir(parents=True)
-    (root / "project.yaml").write_text(
-        PROJECT_YAML.format(id="medxehr", name="MedxEHR", org=ORG),
-        encoding="utf-8")
-    shutil.copy2(UPSTREAM / "templates" / "assembly-root" / "Makefile",
-                 root / "Makefile")
-
-    swept = run(PARK, "--all", home=home, cwd=home)
-    assert swept.returncode == 0, swept.stdout + swept.stderr
-    assert "  skipped    MedxEHR (no Speckit overlay)" in swept.stdout
-
-    named = run(PARK, "MedxEHR", home=home)
-    assert named.returncode == 2, named.stdout + named.stderr
-    assert ("make park needs the Speckit worktree overlay; install it with: "
-            "setup-openspeckit") in named.stderr, (
-        "the Makefile's own refusal, relayed rather than replaced")
-    assert "`make park` exited 2" in named.stdout
-    assert "SKIPPED" not in named.stdout + named.stderr, (
-        "naming a root must never skip it")
-
-
-def test_a_family_holder_in_the_sweep_is_never_pre_checked(home):
-    """A holder's Makefile makes no overlay test: it fans out with
-    `siblings.py --make park`, and a member's own refusal is the holder's to
-    report. Pre-checking the holder would skip a whole family for want of a
-    file its Makefile never reads."""
-    projects = home / "projects"
-    holder = probe_family(projects, "TestFam")
-    assert not (holder / OVERLAY / "park.sh").exists(), (
-        "the fixture must NOT carry the overlay, or this proves nothing")
-
-    result = run(PARK, "--all", home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"PROBE park in {holder} ARGS=[]" in result.stdout
-    assert "  parked     TestFam" in result.stdout
-    assert "skipped (no overlay)" not in result.stdout, (
-        "with nothing skipped the summary is #91's line, unchanged")
-    assert "park: 1 estate(s) parked, 0 refused or with findings" \
-        in result.stdout
-
-
-def test_no_name_and_no_estate_anywhere_refuses_without_asking(home):
-    """Nothing to list and nothing to ask about: not the question, and not
-    the no-terminal refusal either — there is no sweep here to say yes to.
-    At a pipe and at a terminal alike."""
-    piped = run(PARK, home=home)
-    typed = run_at_a_terminal(PARK, answer="y", home=home)
-    for result in (piped, typed):
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert "no estate around" in result.stderr
-        assert "nothing to park" in result.stderr
-        assert "resume <Name>" in result.stderr
-        assert QUESTION not in result.stderr
-        assert "--all" not in result.stderr, "--all would find nothing either"
-
-
-def test_a_name_that_is_not_an_estate_refuses_and_names_resume(home):
-    projects = home / "projects"
-    probe_project(projects, "Atlas")
-    result = run(PARK, "Nope", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no estate named 'Nope'" in result.stderr
-    assert "resume Nope" in result.stderr
-    assert "project  Atlas" in result.stderr
-
-
-#: The three spellings of one repository a clone's `origin` can carry. All
-#: three must answer `--repo testorg/atlas` — and the case difference is in the
-#: flag on purpose: GitHub owners and names are case-insensitive.
-ORIGIN_SPELLINGS = [
-    "https://github.com/TestOrg/Atlas.git",
-    "git@github.com:TestOrg/Atlas.git",
-    "ssh://git@github.com/TestOrg/Atlas.git",
-]
-
-
-@pytest.mark.parametrize("origin", ORIGIN_SPELLINGS)
-def test_repo_matches_a_local_clone_by_its_origin(home, origin):
-    """RULING 1: `--repo` matches a clone you already have."""
-    projects = home / "projects"
-    root = probe_project(projects, "Atlas")
-    git("init", "-q", "-b", "main", ".", cwd=root)
-    git("remote", "add", "origin", origin, cwd=root)
-    result = run(PARK, "--repo", "testorg/atlas", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {root}" in result.stdout
-
-
-def test_repo_finds_a_member_two_levels_down(home):
-    """The estates this standard places are `<projects>/<Project>` and
-    `<projects>/<Family>/<Project>`, so the search is two deep."""
-    projects = home / "projects"
-    probe_family(projects, "InkRouter")
-    member = probe_project(projects, "IRRS", at=projects / "InkRouter" / "IRRS")
-    git("init", "-q", "-b", "main", ".", cwd=member)
-    git("remote", "add", "origin", "https://github.com/TestOrg/IRRS.git",
-        cwd=member)
-    result = run(PARK, "--repo", "TestOrg/IRRS", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {member}" in result.stdout
-
-
-def test_repo_with_no_match_refuses_and_names_git_clone(home):
-    """RULING 1's other half: only `resume` clones, so this refusal names the
-    clone command rather than running one."""
-    projects = home / "projects"
-    probe_project(projects, "Atlas")
-    result = run(PARK, "--repo", "TestOrg/Nothing", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no clone under your projects directory has origin TestOrg/Nothing" \
-        in result.stderr
-    assert "git clone --recurse-submodules https://github.com/TestOrg/Nothing.git" \
-        in result.stderr
-    assert "it never clones one" in result.stderr
-
-
-def test_repo_that_is_not_owner_slash_name_is_refused(home):
-    result = run(PARK, "--repo", "Atlas", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "'Atlas' is not a repository" in result.stderr
-
-
-def test_a_name_and_repo_together_are_refused(home):
-    result = run(PARK, "Atlas", "--repo", "TestOrg/Atlas", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "One estate per run" in result.stderr
-
-
-@pytest.mark.parametrize("command", [PARK, RESUME], ids=["park", "resume"])
-def test_an_unknown_flag_is_refused_and_names_the_double_dash(home, command):
-    """The extension has flags these commands have no opinion about, and a
-    command that ate them would be a command people stop using the moment the
-    extension grows one."""
-    result = run(command, "--feature", "001-a", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "does not know --feature" in result.stderr
-    assert "-- --feature" in result.stderr
-
-
-@pytest.mark.parametrize("command", [PARK, RESUME], ids=["park", "resume"])
-def test_help_prints_the_first_usage_line(command):
-    result = subprocess.run(["bash", str(command), "--help"],
-                            capture_output=True, text=True, check=False)
-    assert result.returncode == 0, result.stderr
-    assert result.stdout.splitlines()[0].startswith(f"{command.name} [<Name>]")
-
-
-# ===========================================================================
-# park
-# ===========================================================================
-
-def test_park_drives_the_holders_make_park_and_args_arrive(estate, home):
-    """The whole interface: the holder's `make park` fans out to each member's
-    working clone, and `ARGS` reaches the extension in every one of them."""
-    result = run(PARK, FAMILY, "--dry-run", "--lane", "xfactory-2", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"park: {FAMILY} - the family holder at {estate['holder']}" \
-        in result.stdout
-    assert "make park ARGS='--dry-run --lane xfactory-2'" in result.stdout
-    for name in MEMBERS:
-        assert f"--- {name}: make park ---" in result.stdout
-        assert f"{name}.sh ran with: --dry-run --lane xfactory-2" \
-            in result.stdout
-
-
-def test_park_passes_extension_flags_after_a_double_dash(estate, home):
-    result = run(PARK, FAMILY, "--", "--feature", "001-a", "--no-push",
-                 home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    for name in MEMBERS:
-        assert f"{name}.sh ran with: --feature 001-a --no-push" in result.stdout
-
-
-def test_park_reports_an_unpushed_main_commit_and_a_dirty_root(estate, home):
-    """What park does NOT carry. Neither is park's to touch: a root is PR-only
-    and a pin bump in progress is somebody's unfinished edit."""
-    alpha = estate["siblings"]["Alpha"]
-    (alpha / "LOCAL.md").write_text("never pushed\n", encoding="utf-8")
-    commit_all(alpha, "a commit on main that origin has not seen")
-    (estate["holder"] / "PINBUMP.md").write_text("half a bump\n",
-                                                 encoding="utf-8")
-
-    result = run(PARK, FAMILY, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "what park does NOT carry" in result.stdout
-    assert f"unpushed main   root    {alpha}" in result.stdout
-    assert "1 commit(s) on main that origin has not seen" in result.stdout
-    assert "land them as a pull request" in result.stdout
-    assert f"uncommitted    holder  {estate['holder']}" in result.stdout
-    assert "A pin bump in progress is not" in result.stdout
-    assert "ignored files  never travel" in result.stdout
-    assert "2 thing(s) above are not park's to carry" in result.stdout
-
-
-def test_park_says_when_it_left_nothing_behind(estate, home):
-    result = run(PARK, FAMILY, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "nothing else was left behind" in result.stdout
-    assert "0 thing(s) above are not park's to carry" in result.stdout
-
-
-def clone_leg_member(dest: Path, base: Path, member: str,
-                     **seed) -> dict[str, Path]:
-    """`seed_leg_member`'s root, cloned into `dest` with its legs mounted.
-
-    Built per test under `base` rather than into the session's `remotes`, so a
-    leg has a `develop` to sit on only where a test asks for one (`seed` goes
-    to `seed_leg_member`). The legs arrive DETACHED at their pins, as every
-    fresh clone's do.
-    """
-    base.mkdir()
-    bare, _ = seed_leg_member(base, member, **seed)
-    root = dest / member
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(bare), str(root), cwd=dest)
-    return {"root": root, "spec": root / "spec", "code": root / "code"}
-
-
-def commits_on(leg: Path, branch: str, count: int) -> None:
-    """`count` commits on `leg`'s local `branch` that origin has not seen."""
-    git("checkout", "-q", "-B", branch, f"origin/{branch}", cwd=leg)
-    for number in range(count):
-        (leg / f"{branch}-{number}.md").write_text("never pushed\n",
-                                                   encoding="utf-8")
-        commit_all(leg, f"commit {number} on {branch}, not pushed")
-
-
-def family_folder_naming_delta(home: Path) -> Path:
-    """A family folder whose holder (a probe Makefile) names ONE member,
-    `Delta`, and whose working clone `clone_leg_member` puts beside it."""
-    folder = home / "projects" / FAMILY
-    holder = folder / FAMILY
-    holder.mkdir(parents=True)
-    (holder / "family.yaml").write_text(
-        FAMILY_YAML.format(
-            id=FAMILY.lower(), name=FAMILY, org=ORG,
-            members=(f"\n  - project: Delta\n    id: delta\n"
-                     f"    repository: {ORG}/Delta\n"
-                     f"    path: members/Delta\n")), encoding="utf-8")
-    (holder / "Makefile").write_text(PROBE_MAKEFILE, encoding="utf-8")
-    return folder
-
-
-def test_park_reports_a_leg_on_the_branch_its_own_row_declares(home, tmp_path):
-    """#242. `scripts/bootstrap.py` places a leg on `str(leg.get("branch") or
-    branch)`, so a leg whose row in `project.yaml` declares `branch: develop`
-    keeps its work on `develop`. The report asked about the ROOT's
-    `tracking_branch` for every leg, found nothing ahead on `main`, and ended
-    without naming the leg: work `park` did not carry, missed silently."""
-    root = clone_leg_member(home / "projects", tmp_path / "remotes",
-                            "Delta", leg_branch="develop")
-    commits_on(root["spec"], "develop", 3)
-
-    result = run(PARK, "Delta", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"unpushed develop leg     {root['spec']}" in result.stdout, (
-        "a leg's unpushed commits on its own `branch:` were not reported:\n"
-        + result.stdout)
-    assert "3 commit(s) on develop that origin has not seen" in result.stdout
-    assert "A leg goes up as a pull request too" in result.stdout
-    assert f"unpushed main   leg     {root['spec']}" not in result.stdout, (
-        "the leg was asked about the root's branch")
-
-
-def test_park_reports_a_family_members_leg_on_its_own_declared_branch(
-        home, tmp_path):
-    """#242, in a family: the holder's report reads the member's working clone
-    beside it, and that member's legs, which are built by a second loop. Its
-    leg rows carried the member's `tracking_branch` too."""
-    folder = family_folder_naming_delta(home)
-    member = clone_leg_member(folder, tmp_path / "remotes", "Delta",
-                              leg_branch="develop", code_leg=True)
-    commits_on(member["spec"], "develop", 2)
-    commits_on(member["code"], "main", 1)
-
-    result = run(PARK, FAMILY, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"unpushed develop leg     {member['spec']}" in result.stdout, (
-        "a member's leg on its own `branch:` was not reported:\n"
-        + result.stdout)
-    assert "2 commit(s) on develop that origin has not seen" in result.stdout
-    assert f"unpushed main   leg     {member['spec']}" not in result.stdout
-    # The leg that declares none is the member's `tracking_branch`'s: the
-    # family loop's fallback, which nothing else here reaches.
-    assert f"unpushed main   leg     {member['code']}" in result.stdout, (
-        result.stdout)
-    assert "1 commit(s) on main that origin has not seen" in result.stdout
-
-
-@pytest.mark.skipif(hasattr(os, "geteuid") and os.geteuid() == 0,
-                    reason="mode 000 does not bind root, so the manifest "
-                           "stays readable and there is nothing to survive")
-def test_park_reports_a_leg_when_its_members_manifest_cannot_be_read(
-        home, tmp_path):
-    """#242, the review of #249: `leg_branch_of` fails when `project.yaml`
-    exists and cannot be read, and `report_repos` runs under `set -e`, so an
-    unguarded `legbranch="$(leg_branch_of ...)"` ended the report's subshell:
-    that leg's row and every row after it were dropped, `make park`'s exit
-    code was untouched and `park` said nothing. The leg is reported against
-    the member's own branch instead (main's `park` did, because it never read
-    the file for a leg)."""
-    folder = family_folder_naming_delta(home)
-    member = clone_leg_member(folder, tmp_path / "remotes", "Delta")
-    commits_on(member["spec"], "main", 2)
-    manifest = member["root"] / "project.yaml"
-    manifest.chmod(0o000)
-    try:
-        result = run(PARK, FAMILY, home=home)
-    finally:
-        manifest.chmod(0o644)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"unpushed main   leg     {member['spec']}" in result.stdout, (
-        "an unreadable manifest dropped the leg's row from the report:\n"
-        + result.stdout)
-    assert "2 commit(s) on main that origin has not seen" in result.stdout
-
-
-def test_park_still_reports_a_leg_with_no_branch_of_its_own_on_the_roots(
-        home, tmp_path):
-    """UNCHANGED for a row with no `branch:`: bootstrap places that leg on the
-    root's `tracking_branch`, so that is the branch its unpushed commits are
-    counted on. Green before the fix of #242 and after it."""
-    root = clone_leg_member(home / "projects", tmp_path / "remotes", "Echo")
-    commits_on(root["spec"], "main", 1)
-
-    result = run(PARK, "Echo", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"unpushed main   leg     {root['spec']}" in result.stdout
-    assert "1 commit(s) on main that origin has not seen" in result.stdout
-
-
-def test_park_asks_each_leg_of_one_root_about_its_own_branch(home, tmp_path):
-    """One root, two legs: `spec` declares `branch: develop` and `code`
-    declares none. Each is read against the branch bootstrap puts it on, so
-    the report names `spec` on `develop` and `code` on `main`, with their own
-    counts and neither leg's branch lent to the other."""
-    root = clone_leg_member(home / "projects", tmp_path / "remotes", "Foxtrot",
-                            leg_branch="develop", code_leg=True)
-    commits_on(root["spec"], "develop", 3)
-    commits_on(root["code"], "main", 1)
-
-    result = run(PARK, "Foxtrot", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"unpushed develop leg     {root['spec']}" in result.stdout, (
-        result.stdout)
-    assert f"unpushed main   leg     {root['code']}" in result.stdout, (
-        result.stdout)
-    assert "3 commit(s) on develop that origin has not seen" in result.stdout
-    assert "1 commit(s) on main that origin has not seen" in result.stdout
-    assert f"unpushed main   leg     {root['spec']}" not in result.stdout
-    assert f"unpushed develop leg     {root['code']}" not in result.stdout
-
-
-def test_park_never_reads_the_pinned_copy(estate, home):
-    """`members/<Project>` is pinned and DETACHED; nobody's work is there, and
-    a report that named it would be reporting on the wrong copy."""
-    result = run(PARK, FAMILY, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "members/" not in result.stdout.split("what park does NOT carry")[1]
-
-
-def test_park_dry_run_creates_and_commits_nothing(estate, home):
-    heads = {name: git("rev-parse", "HEAD", cwd=path).stdout
-             for name, path in estate["siblings"].items()}
-    holder_head = git("rev-parse", "HEAD", cwd=estate["holder"]).stdout
-    before = sorted(p.name for p in estate["folder"].iterdir())
-
-    result = run(PARK, FAMILY, "--dry-run", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "--dry-run: nothing was committed, pushed or recorded." \
-        in result.stdout
-    for name, path in estate["siblings"].items():
-        assert git("rev-parse", "HEAD", cwd=path).stdout == heads[name]
-    assert git("rev-parse", "HEAD",
-               cwd=estate["holder"]).stdout == holder_head
-    assert sorted(p.name for p in estate["folder"].iterdir()) == before
-
-
-def test_park_in_a_standalone_root_runs_that_roots_verb(estate, home):
-    """A member of a family IS a standalone estate when you name it: `park
-    --repo <owner>/Alpha` is the member's own root, not the holder's.
-
-    The origin is re-spelled as the url a real member carries, because a clone
-    whose origin is a bare repository ON DISK answers `<Name>` and the
-    walk-up but never `--repo`: a filesystem path has a name and no owner, and
-    inventing one is what `repo_slug_of` refuses to do.
-    """
-    git("remote", "set-url", "origin",
-        f"https://github.com/{ORG}/Alpha.git", cwd=estate["siblings"]["Alpha"])
-    result = run(PARK, "--repo", f"{ORG}/Alpha", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "the assembly root at" in result.stdout
-    assert "Alpha.sh ran with:" in result.stdout
-    assert "Bravo.sh ran with:" not in result.stdout
-
-
-def test_park_passes_the_scripts_exit_code_through(estate, home):
-    """A refusal must never read as success. Make flattens the extension's 3
-    to its own 2 (#80's Makefile says so at the target); what matters is that
-    the run is non-zero and the code is still on screen."""
-    write_stub(estate["siblings"]["Alpha"], "park", code=3, label="Alpha")
-    result = run(PARK, FAMILY, home=home)
-    assert result.returncode != 0, result.stdout + result.stderr
-    assert "3" in result.stdout + result.stderr
-    assert "`make park` exited" in result.stdout
-
-
-def test_park_refuses_a_root_with_no_makefile(home):
-    projects = home / "projects"
-    root = projects / "Atlas"
-    root.mkdir(parents=True)
-    (root / "project.yaml").write_text(
-        PROJECT_YAML.format(id="atlas", name="Atlas", org=ORG),
-        encoding="utf-8")
-    result = run(PARK, "Atlas", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "has no Makefile" in result.stderr
-    assert "update-shape.py" in result.stderr
-
-
-# ===========================================================================
-# resume — the fresh machine
-# ===========================================================================
-
-def test_resume_on_a_fresh_machine_builds_the_whole_estate(remotes, home):
-    """The issue's own sentence, end to end and offline: `resume InkRouter` on
-    a machine that has none of it — clone the workspace record, write the
-    config, clone the holder into `<Family>/<Family>`, bootstrap it, place
-    every member beside it, and recreate their features."""
-    result = run(RESUME, FAMILY, "--workspace", WORKSPACE_SLUG, home=home,
-                 env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-
-    config = home / ".agents" / "workspace.yaml"
-    assert config.is_file(), result.stdout + result.stderr
-    assert config.read_text(encoding="utf-8") == (
-        f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n")
-    assert (home / "projects" / "wip" / "workspaces" / ORG
-            / f"{FAMILY.lower()}.yaml").is_file(), (
-        "park.sh names the manifest for the family's lowercase id")
-
-    folder = home / "projects" / FAMILY
-    holder = folder / FAMILY
-    assert (holder / "family.yaml").is_file(), "the holder was not cloned"
-    assert (holder / "members" / "Alpha" / ".git").exists(), (
-        "the pinned copies came with --recurse-submodules")
-    for name in MEMBERS:
-        assert (folder / name / ".git").is_dir(), f"{name} is not beside it"
-        assert git("rev-parse", "--abbrev-ref", "HEAD",
-                   cwd=folder / name).stdout.strip() == "main"
-        assert f"{name}.sh ran with:" in result.stdout, (
-            "each member's own make resume must have run")
-    assert "(b) the layout" in result.stdout
-    assert f"holder    {FAMILY}" in result.stdout
-    assert "`make resume` exited 0" in result.stdout
-    assert "0 refusal(s)" in result.stdout
-
-
-def test_resume_clones_the_holder_under_its_repositorys_name_when_the_display_name_differs(
-        named_apart, remotes, home):
-    """#236, the fresh machine. The record says `family: quill` and each
-    member's `root: Quill/Alpha`, and it is filed under `workspaces/testorg/`:
-    it NEVER carries the holder's repository, so `resume` derives it from the
-    org and the family folder — and under v1.1.0 the folder IS the
-    repository's last part (opensoft/openRepoShape#629). The clone then has to
-    be recognised as an estate although its `name:` is "QuillWorks"; before,
-    `resume` cloned the right repository and refused it as 'not an estate'."""
-    result = run(RESUME, QUILL, "--workspace", WORKSPACE_SLUG, home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    folder = home / "projects" / QUILL
-    holder = folder / QUILL
-    assert f"root repository {ORG}/{QUILL}" in result.stdout
-    assert f"absent          cloning {ORG}/{QUILL} -> {holder}" in result.stdout
-    assert f"{ORG}/{QUILL_DISPLAY}" not in result.stdout
-    assert 'name: "QuillWorks"' in (holder / "family.yaml").read_text(
-        encoding="utf-8"), "the holder is the one whose display name differs"
-    assert not (home / "projects" / QUILL_DISPLAY).exists()
-    for name in MEMBERS:
-        assert (folder / name / ".git").is_dir(), f"{name} is not beside it"
-        assert f"{name}.sh ran with:" in result.stdout
-    assert f"holder    {QUILL}" in result.stdout
-    assert "0 refusal(s)" in result.stdout
-
-
-@pytest.mark.parametrize(
-    "on_disk, asked", [(QUILL, QUILL), (QUILL_DISPLAY, "quill")],
-    ids=["the-holder-was-moved-to-the-repositorys-name",
-         "the-holder-is-still-in-the-display-names-folder"])
-def test_resume_names_the_repository_of_the_holder_it_resolved_not_the_records_folder(
-        named_apart, remotes, home, tmp_path, on_disk, asked):
-    """The review of #240 (5561239588), finding 1. The record is filed as park
-    files it: ONE per family, named for the id (`quill.yaml`, `family: quill`),
-    parked from the layout before v1.1.0 so its `root:` is `QuillWorks/Alpha`.
-    Then `make siblings`' own advice is followed, `mv QuillWorks/QuillWorks
-    Quill/Quill`, and the record is stale until the next park. The holder IS
-    on disk, found by the name typed; asking for the repository by the
-    record's folder missed it and printed `testorg/QuillWorks`, which is no
-    repository. The second case is the same record against the holder still
-    where the record says, typed as the id."""
-    clone_quill_estate(named_apart, remotes, home, on_disk)
-    record = family_manifest(QUILL_DISPLAY).replace(
-        f"family: {QUILL_DISPLAY.lower()}\n", f"family: {QUILL.lower()}\n")
-    assert "root: QuillWorks/Alpha" in record and "family: quill\n" in record
-    place_quill_workspace(named_apart, home, seed_workspace(
-        tmp_path / "stale", "wip",
-        {f"workspaces/{ORG}/{QUILL.lower()}.yaml": record}))
-    result = run(RESUME, asked, "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert (f"records         a family estate, root repository "
-            f"{ORG}/{QUILL}") in result.stdout
-    assert f"{ORG}/{QUILL_DISPLAY}" not in result.stdout
-    assert f"present         {home / 'projects' / on_disk} (family)" \
-        in result.stdout
-
-
-def test_resume_names_the_repository_the_holders_family_yaml_gives(
-        named_apart, remotes, home):
-    """#236, the estate already here, laid out before v1.1.0: the folder is the
-    display name, so it is NOT the repository's name. The holder's own
-    `family.yaml` says which repository it is, and it can be read.
-
-    Asked for the way park files it (#243): `resume quill` against the ONE
-    record, `quill.yaml`, parked from v1.1.0's layout elsewhere, so its
-    `root:` is `Quill/Alpha` while this machine has `QuillWorks/QuillWorks`.
-    Neither the id nor the record's folder is an estate here, so the holder
-    is found by its `family.yaml` `id:`; before, `resume` planned a clone of
-    `testorg/Quill` into `Quill/Quill`, BESIDE the holder that was here,
-    which is how a person ends up with one family laid out twice. (Where the
-    repository derived from the record's folder is wrong as well, the stale
-    record above is the case.)"""
-    quill = clone_quill_estate(named_apart, remotes, home, QUILL_DISPLAY)
-    place_quill_workspace(named_apart, home)
-    result = run(RESUME, QUILL.lower(), "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert (f"records         a family estate, root repository "
-            f"{ORG}/{QUILL}") in result.stdout
-    assert f"{ORG}/{QUILL_DISPLAY}" not in result.stdout
-    assert f"present         {quill['folder']} (family)" in result.stdout
-    assert "found by its family.yaml id 'quill'" in result.stdout
-    assert "absent          cloning" not in result.stdout
-    assert "would clone      git clone" not in result.stdout
-    assert not (home / "projects" / QUILL).exists()
-
-
-def stale_quill_workspace(tmp_path: Path) -> Path:
-    """The ONE record park files for the family of #236, parked from the
-    layout before v1.1.0: `workspaces/testorg/quill.yaml`, `family: quill`,
-    each `root:` `QuillWorks/<member>`. Stale wherever the holder is not in
-    `QuillWorks/QuillWorks`."""
-    record = family_manifest(QUILL_DISPLAY).replace(
-        f"family: {QUILL_DISPLAY.lower()}\n", f"family: {QUILL.lower()}\n")
-    assert "root: QuillWorks/Alpha" in record and "family: quill\n" in record
-    return seed_workspace(tmp_path / "stale", "wip",
-                          {f"workspaces/{ORG}/{QUILL.lower()}.yaml": record})
-
-
-def second_projects_spelling(home: Path) -> Path:
-    """`~/Projects` as a directory of its own beside the fixture's
-    `~/projects`, which is what a person who spells it both ways has, and the
-    second place `PROJECTS_DIRS` looks. On a filesystem that folds case — a
-    stock Mac — the two names are ONE directory, so there is no second
-    spelling to make: the test is SKIPPED there, saying why, instead of
-    failing on a `mkdir` that finds the directory already there."""
-    other = home / "Projects"
-    if other.exists() and other.samefile(home / "projects"):
-        pytest.skip("case-insensitive filesystem: ~/Projects is ~/projects "
-                    "here, so there is no second spelling of the projects "
-                    "directory to put a holder in")
-    other.mkdir()
-    return other
-
-
-def test_resume_finds_the_holder_by_its_id_when_the_record_names_another_folder(
-        named_apart, remotes, home, tmp_path):
-    """#243, item 3, the issue's own case. `make siblings`' advice was
-    followed, `mv QuillWorks/QuillWorks Quill/Quill`, and the record still
-    says `root: QuillWorks/Alpha`. `resume quill` (the id, which is how park
-    files the record) missed it twice — `quill` is no folder here, and
-    neither is `QuillWorks` — and planned a clone of `testorg/QuillWorks`
-    although the family was on disk. The holder whose `family.yaml` says
-    `id: quill` is that estate: no clone, and the repository and the root
-    are the ones on disk."""
-    quill = clone_quill_estate(named_apart, remotes, home, QUILL)
-    place_quill_workspace(named_apart, home, stale_quill_workspace(tmp_path))
-    result = run(RESUME, QUILL.lower(), "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"present         {quill['folder']} (family)" in result.stdout
-    assert ("found by its family.yaml id 'quill': the record's "
-            "`root: QuillWorks/Alpha` names another folder") in result.stdout
-    assert (f"records         a family estate, root repository "
-            f"{ORG}/{QUILL}") in result.stdout
-    assert f"would run: make siblings   ({quill['holder']})" in result.stdout
-    assert "absent          cloning" not in result.stdout
-    assert "would clone      git clone" not in result.stdout
-    assert f"{ORG}/{QUILL_DISPLAY}" not in result.stdout
-    assert not (home / "projects" / QUILL_DISPLAY).exists()
-
-
-@pytest.mark.parametrize("second", ["Projects", "QuillCopy"],
-                         ids=["under-the-other-spelling",
-                              "a-folder-of-another-name"])
-def test_resume_refuses_two_holders_of_one_id_and_clones_over_neither(
-        named_apart, home, tmp_path, second):
-    """#243, item 3, consistent with item 2: one family laid out twice is ONE
-    record, so with the record's folder nowhere and two holders of its id on
-    disk there is no estate to pick. Refused by name, naming both, and
-    NOTHING cloned — a real run, not a dry one. The second holder is the
-    same family under `~/Projects` (people spell it both ways), or a copy
-    under a folder named for its own display `name:`, which leaves exactly
-    one named for the repository: the one to keep."""
-    projects = home / "projects"
-    first = probe_family_two_names(projects, QUILL, name=QUILL_DISPLAY,
-                                   repository=f"{ORG}/{QUILL}")
-    if second == "Projects":
-        other = probe_family_two_names(second_projects_spelling(home), QUILL,
-                                       name=QUILL_DISPLAY,
-                                       repository=f"{ORG}/{QUILL}")
-    else:
-        other = probe_family_two_names(projects, second, name=second,
-                                       repository=f"{ORG}/{QUILL}")
-        manifest = other / "family.yaml"
-        manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-            f"id: {second.lower()}\n", f"id: {QUILL.lower()}\n"),
-            encoding="utf-8")
-    place_quill_workspace(named_apart, home, stale_quill_workspace(tmp_path))
-    result = run(RESUME, QUILL.lower(), home=home, env=offline(named_apart))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "2 family folders under your projects" in result.stderr
-    assert f"      {first.parent}\n" in result.stderr
-    assert f"      {other.parent}\n" in result.stderr
-    assert "nothing was cloned over either" in result.stderr
-    if second == "QuillCopy":
-        assert (f"Keep {first.parent}, the folder named for its repository"
-                in result.stderr)
-    assert "PROBE" not in result.stdout, "a holder's make ran"
-    assert not (projects / QUILL_DISPLAY).exists(), "the record's folder"
-    assert not (home / "Projects" / QUILL_DISPLAY).exists()
-
-
-def test_one_holder_reached_under_both_spellings_is_one_holder_not_two(
-        named_apart, remotes, home, tmp_path):
-    """The review of #251, finding 1. `~/Projects` is a real directory whose
-    `Quill` is a LINK to `~/projects/Quill`: one folder, reached under both
-    spellings of the projects directory. `PROJECTS_DIRS` dedupes the two
-    directories by inode, but nothing compared the folders INSIDE them, so
-    `family_folders_with_id` listed one holder twice: `resume quill` refused
-    "2 family folders" with nothing to choose between, and `status` reported
-    one family "laid out 2 times" — and its remedy, "move the rest aside",
-    would have taken the link away. A folder that is `-ef` one already
-    listed is the same holder, so it is listed once: `resume` resumes it and
-    `status` has no finding to make. Two REAL holders still refuse (above)."""
-    quill = clone_quill_estate(named_apart, remotes, home, QUILL)
-    (second_projects_spelling(home) / QUILL).symlink_to(quill["folder"])
-
-    status = run(STATUS, QUILL, home=home)
-    assert status.returncode == 0, status.stdout + status.stderr
-    assert "laid out" not in status.stdout, status.stdout
-    assert "0 finding(s) in 3 repositories" in status.stdout
-
-    place_quill_workspace(named_apart, home, stale_quill_workspace(tmp_path))
-    result = run(RESUME, QUILL.lower(), "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "family folders under your projects" not in result.stderr
-    assert f"present         {quill['folder']} (family)" in result.stdout
-    assert "found by its family.yaml id 'quill'" in result.stdout
-    assert "absent          cloning" not in result.stdout
-    assert not (home / "projects" / QUILL_DISPLAY).exists()
-
-
-def test_resume_holds_a_holder_found_by_its_id_to_an_estate_folders_name(
-        named_apart, home, tmp_path):
-    """Every folder `resume` builds a path from is held to
-    `is_safe_folder_name` first: `<Name>` and the record's `root:`, and now
-    the holder found by its id (#243), which comes off the disk rather than
-    out of anybody's typing. A family folder whose name carries a space is a
-    family folder all the same — its `name:` says so — and it is refused by
-    name, with nothing cloned beside it."""
-    folder = "Quill Old"
-    holder = probe_family_two_names(home / "projects", folder, name=folder,
-                                    repository=f"{ORG}/{QUILL}")
-    manifest = holder / "family.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        f"id: {folder.lower()}\n", f"id: {QUILL.lower()}\n"), encoding="utf-8")
-    place_quill_workspace(named_apart, home, stale_quill_workspace(tmp_path))
-    result = run(RESUME, QUILL.lower(), home=home, env=offline(named_apart))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert (f"the holder of family 'quill' is at {holder.parent}"
-            in result.stderr)
-    assert "is not a name an estate folder may have" in result.stderr
-    assert "PROBE" not in result.stdout
-    assert not (home / "projects" / QUILL_DISPLAY).exists()
-
-
-def test_resume_still_clones_a_family_no_holder_here_carries_the_id_of(
-        named_apart, home, tmp_path):
-    """#243, item 3's third arm: no holder of `id: quill` is here — a family
-    of another id is, and it is not this one — so the family is genuinely
-    absent and the plan is today's, the clone of the record's folder."""
-    probe_family(home / "projects", "Other")
-    place_quill_workspace(named_apart, home, stale_quill_workspace(tmp_path))
-    result = run(RESUME, QUILL.lower(), "--dry-run", home=home,
-                 env=offline(named_apart))
-    assert result.returncode == 0, result.stderr + result.stdout
-    target = home / "projects" / QUILL_DISPLAY / QUILL_DISPLAY
-    assert (f"absent          cloning {ORG}/{QUILL_DISPLAY} -> {target}"
-            in result.stdout)
-    assert "would clone      git clone --recurse-submodules" in result.stdout
-    assert "found by its family.yaml id" not in result.stdout
-
-
-def test_resume_writes_the_config_only_when_asked_by_name(remotes, home):
-    """One of the two files this standard ever writes outside a repository —
-    and it is the SAME file as the other, `~/.agents/workspace.yaml`, written
-    here only because `--workspace` asked for it.
-
-    `openRepoTools wip init` is the second writer (Amendment 9(c) step 9), for
-    the same reason and under the same condition: only on a machine that has
-    none, and only because the person asked for the repository by running it.
-    The invariant that retired was "the ONLY file", and it retired on purpose
-    rather than by being found with a red test."""
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no workspace record is configured" in result.stderr
-    assert "--workspace <owner>/<repo>" in result.stderr
-    assert not (home / ".agents" / "workspace.yaml").exists()
-    assert not (home / "projects" / FAMILY).exists(), "nothing was created"
-
-
-def test_resume_refuses_to_overwrite_a_config_that_names_another_repository(
-        remotes, home):
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text("repository: tester/other\npath: ~/projects/other\n",
-                      encoding="utf-8")
-    result = run(RESUME, FAMILY, "--workspace", WORKSPACE_SLUG, home=home,
-                 env=offline(remotes))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "already names" in result.stderr
-    assert "never overwrites one" in result.stderr
-    assert config.read_text(encoding="utf-8").startswith(
-        "repository: tester/other")
-
-
-def test_resume_clones_the_workspace_the_config_names(remotes, home):
-    """A config that is there and a checkout that is not: the repository comes
-    from the config, and no flag is needed."""
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert (home / "projects" / "wip" / "workspaces").is_dir()
-    assert (home / "projects" / FAMILY / FAMILY / "family.yaml").is_file()
-
-
-def test_resume_refuses_when_two_orgs_record_the_same_name(remotes, home):
-    """Two projects in two organisations may share a name, so nothing here
-    picks one — and `--org` is how the question gets answered."""
-    refused = run(RESUME, FAMILY, "--workspace", "tester/twoorgs", home=home,
-                  env=offline(remotes))
-    assert refused.returncode == 2, refused.stdout + refused.stderr
-    assert "workspace manifests record 'TestFam'" in refused.stderr
-    assert "orga/testfam.yaml" in refused.stderr
-    assert "orgb/testfam.yaml" in refused.stderr
-    assert f"resume {FAMILY} --org <org>" in refused.stderr
-    assert not (home / "projects" / FAMILY).exists()
-
-    # The config was written by the run above, so this one needs no flag.
-    answered = run(RESUME, FAMILY, "--org", "orgb", home=home,
-                   env=offline(remotes))
-    assert answered.returncode == 0, answered.stderr + answered.stdout
-    assert "org             orgb" in answered.stdout
-    assert (home / "projects" / FAMILY / FAMILY / "family.yaml").is_file()
-
-
-def test_resume_refuses_a_name_no_manifest_records(remotes, home):
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    result = run(RESUME, "Nowhere", home=home, env=offline(remotes))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no workspace manifest records 'Nowhere'" in result.stderr
-    assert "grep -rn 'id: '" in result.stderr
-
-
-def test_resume_dry_run_clones_nothing(remotes, home):
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    result = run(RESUME, FAMILY, "--dry-run", home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "would clone" in result.stdout
-    assert "nothing was cloned, pulled, bootstrapped or recreated" \
-        in result.stdout
-    assert not (home / "projects" / "wip").exists()
-    assert not (home / "projects" / FAMILY).exists()
-
-
-def test_resume_rebuilds_a_standalone_project(remotes, home):
-    """One root and no holder: the repository comes from `projects[0]`, the
-    folder from its `root:`, and there is no `make siblings` in it at all.
-
-    `resume Alpha` also proves the file lookup: the manifest is `alpha.yaml`,
-    named for the project id, while `Alpha` is the folder a person types.
-    """
-    result = run(RESUME, "Alpha", "--workspace", "tester/solo", home=home,
-                 env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    root = home / "projects" / "Alpha"
-    assert (root / "project.yaml").is_file(), result.stdout + result.stderr
-    assert "records         a standalone estate, root repository testorg/Alpha" \
-        in result.stdout
-    assert "BOOTSTRAP-Alpha ran" in result.stdout
-    assert "Alpha.sh ran with:" in result.stdout
-    assert "make siblings" not in result.stdout
-    assert "root      Alpha" in result.stdout, "the layout table names the root"
-    assert not (home / "projects" / FAMILY).exists(), (
-        "a standalone resume must not touch the family of the same members")
-
-
-# ===========================================================================
-# the review on #83 — every finding, reproduced then held
-# ===========================================================================
-
-def test_the_three_commands_carry_the_same_resolver_byte_for_byte():
-    """The duplication is deliberate and the claim has to stay true.
-
-    `park`, `resume` and `status` are each ONE file a person has on PATH, so
-    the estate resolver is copied rather than sourced. A copy that has drifted
-    is two answers to "which estate is this", which is the one thing the block
-    exists to prevent — so the three are compared here rather than asserted in
-    a PR body nobody re-reads.
-    """
-    def block(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("# --- BEGIN shared estate resolver")
-        end = text.index("# --- END shared estate resolver")
-        return text[start:end]
-
-    assert block(PARK) == block(RESUME), (
-        "park and resume have drifted apart in the shared estate resolver")
-    assert block(PARK) == block(STATUS), (
-        "park and status have drifted apart in the shared estate resolver")
-    assert len(block(PARK).splitlines()) > 100, "the marker moved, not the block"
-
-
-@pytest.mark.parametrize("command", [PARK, RESUME], ids=["park", "resume"])
-@pytest.mark.parametrize("bad", ["../elsewhere", "/abs/where", "a/b", ".hidden"])
-def test_a_name_that_is_a_path_is_refused_by_name(home, command, bad):
-    """<Name> is joined to the projects directory, so a path in it would land
-    the run somewhere nobody named."""
-    result = run(command, bad, home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "is not an estate name" in result.stderr
-    assert bad in result.stderr
-
-
-#: EVERY VALUE-TAKING FLAG THE TWO COMMANDS HAVE, and nothing else is one.
-#: The two tests below are the two halves of ONE rule — a flag given no value
-#: and a flag given an empty one are the same refusal, in the command's own
-#: words — so they read one list rather than two that can drift apart the next
-#: time a flag is added.
-VALUE_TAKING_FLAGS = [
-    (PARK, "--lane"), (PARK, "--repo"), (PARK, "--name"), (PARK, "--project"),
-    (RESUME, "--repo"), (RESUME, "--workspace"), (RESUME, "--org"),
-    (RESUME, "--name"), (RESUME, "--project"),
-]
-
-
-def flag_id(value):
-    """`park---lane` in the test id, rather than `command0-flag0`."""
-    return value.name if isinstance(value, Path) else value
-
-
-@pytest.mark.parametrize("command, flag", VALUE_TAKING_FLAGS, ids=flag_id)
-def test_a_flag_without_its_value_is_refused_in_the_commands_own_words(
-        home, command, flag):
-    """`${2:?…}` was bash's message and bash's exit 1 — a status neither verb
-    means anything by, and one a wrapper reads as `make`'s. Now the refusal
-    is the command's own, exit 2, and it says what the value is; and nothing
-    ran, cloned or was placed before it was raised."""
-    probe_project(home / "projects", "Atlas")
-    result = run(command, flag, home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"REFUSED: {flag} needs a value:" in result.stderr
-    assert "line " not in result.stderr, "bash's own message leaked"
-    assert "PROBE" not in result.stdout, "the estate must not have been touched"
-    assert not (home / ".agents").exists(), "nothing may be written before a refusal"
-
-
-@pytest.mark.parametrize("command, flag", VALUE_TAKING_FLAGS, ids=flag_id)
-def test_a_flag_given_an_empty_value_is_refused_the_same_way(
-        home, command, flag):
-    """AN EMPTY VALUE IS NOT A VALUE, and it never was: `${2:?…}` rejected
-    unset AND null, and the `[ $# -ge 2 ]` that replaced it rejects only the
-    unset half (Copilot's review of #14, posted a minute after it merged).
-    Every one of these values is read further down as "was this given at
-    all?", so the half that was let through was the silent one — `--lane ""`
-    parks with the lane dropped from the WIP commit subject, and `--repo ""`
-    resolves the estate from the current directory, which is the one thing
-    naming a clone's origin was there to prevent.
-
-    RUN FROM INSIDE AN ESTATE, which is what makes this bite. The walk-up
-    finds `Atlas` from there, so before the fix every one of these carried on
-    — `park` all the way into `make park`, `resume` as far as the workspace
-    record — and only the flag a person typed went missing. NOTHING IS
-    PRINTED AT ALL now: the refusal is raised in the argument loop, before the
-    estate is resolved and before the first `say`, so an empty stdout is the
-    proof that neither the fallback nor the verb was reached.
-    """
-    root = probe_project(home / "projects", "Atlas")
-    result = run(command, flag, "", home=home, cwd=root)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"REFUSED: {flag} needs a value:" in result.stderr
-    # BASH'S OWN MESSAGE, in either of the shapes it takes: `${2:?…}` prints
-    # the file and line and "parameter null or not set", and exits 1.
-    assert "${2:?" not in result.stderr
-    assert "parameter null or not set" not in result.stderr
-    assert "line " not in result.stderr, "bash's own message leaked"
-    assert result.stdout == "", (
-        "nothing may be resolved, said or run before an empty value is "
-        f"refused; stdout was {result.stdout!r}")
-    assert not (home / ".agents").exists(), "nothing may be written before a refusal"
-
-
-@pytest.mark.parametrize("command, flag", VALUE_TAKING_FLAGS, ids=flag_id)
-def test_a_flag_given_a_flag_for_its_value_is_refused_and_nothing_runs(
-        home, command, flag):
-    """A FLAG IS NOT A VALUE, and it was read as one until now.
-
-    `${2:?…}` and the arity check that replaced it both asked only whether
-    there was a next argument; `park Atlas --lane --dry-run` therefore ran a
-    REAL park with its lane set to `--dry-run` — the flag a person typed,
-    swallowed, with `--dry-run` itself never taking effect and nothing but
-    the WIP commit subject to say so. That is the same silence as `--lane ""`,
-    one argument further along, and this is the same refusal: exit 2, in the
-    arm's own words, in the argument loop before anything is resolved or run.
-
-    THE REFUSAL NAMES THE WAY BACK, which is the whole reason `-*` can be
-    refused at all: `--lane=--dry-run` says the same thing and is not
-    ambiguous, so nothing a person could legitimately mean has been taken
-    away. Asserted here per flag, because a hint that named the wrong flag
-    would be worse than none.
-
-    RUN FROM INSIDE AN ESTATE, which is what makes this bite: the walk-up
-    finds `Atlas` from there, so before the fix `park` went all the way into
-    `make park` and `resume` as far as the workspace record. An empty stdout
-    is the proof that neither the verb nor the fallback was reached.
-    """
-    root = probe_project(home / "projects", "Atlas")
-    result = run(command, flag, "--dry-run", home=home, cwd=root)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"REFUSED: {flag} needs a value:" in result.stderr
-    assert "`--dry-run` begins with a `-`" in result.stderr
-    assert f"{flag}=--dry-run" in result.stderr, (
-        "the refusal must name the spelling that does take this value")
-    assert result.stdout == "", (
-        "nothing may be resolved, said or run before a flag given a flag is "
-        f"refused; stdout was {result.stdout!r}")
-    assert "PROBE" not in result.stdout + result.stderr, (
-        "the estate's own make target ran: nothing was parked, and nothing "
-        "may have been")
-    assert not (home / ".agents").exists(), "nothing may be written before a refusal"
-
-
-@pytest.mark.parametrize("command, flag", VALUE_TAKING_FLAGS, ids=flag_id)
-def test_a_flag_takes_its_value_after_an_equals_sign_too(home, command, flag):
-    """`--flag=value` IS `--flag value`, and it is the only way to pass a
-    value that begins with `-`.
-
-    Refusing a `-`-led value in the spaced spelling would otherwise foreclose
-    such a value entirely, because these arms had no `=` form at all: before
-    this, `--lane=x` fell through to the catch-all and came back as "park does
-    not know --lane=x". So the two halves are asserted together — the same
-    command, spelled both ways, has to produce the same bytes and the same
-    exit; and `--flag=--dry-run` has to be ACCEPTED, which is what makes the
-    refusal above a spelling rule rather than a value this toolset can no
-    longer express.
-
-    AN `=` WITH NOTHING AFTER IT IS AN EMPTY VALUE, refused exactly as `""`
-    is: `${1#*=}` cannot tell the two apart and must not, or `--repo=` would
-    be the walk-up again under a new spelling.
-    """
-    root = probe_project(home / "projects", "Atlas")
-    spaced = run(command, flag, "zz-value", home=home, cwd=root)
-    equals = run(command, f"{flag}=zz-value", home=home, cwd=root)
-    assert (equals.returncode, equals.stdout, equals.stderr) == \
-        (spaced.returncode, spaced.stdout, spaced.stderr), (
-            f"{flag}=zz-value and {flag} zz-value are not the same run:\n"
-            f"  = : {equals.returncode} {equals.stdout!r} {equals.stderr!r}\n"
-            f"  ' ': {spaced.returncode} {spaced.stdout!r} {spaced.stderr!r}")
-    assert "does not know" not in equals.stderr
-
-    weird = run(command, f"{flag}=--dry-run", home=home, cwd=root)
-    assert f"{flag} needs a value" not in weird.stderr, (
-        f"{flag}=--dry-run is the spelling the refusal names; it must take "
-        f"the value, not repeat the refusal")
-    assert "does not know" not in weird.stderr, (
-        f"{flag}=--dry-run reached the catch-all: the `=` arm is missing")
-
-    nothing = run(command, f"{flag}=", home=home, cwd=root)
-    assert nothing.returncode == 2, nothing.stdout + nothing.stderr
-    assert f"REFUSED: {flag} needs a value:" in nothing.stderr
-    assert "begins with a `-`" not in nothing.stderr, (
-        "an empty value is empty, not flag-shaped")
-    assert nothing.stdout == "", (
-        f"nothing may be run before `{flag}=` is refused; stdout was "
-        f"{nothing.stdout!r}")
-
-
-def test_park_takes_a_lane_beginning_with_a_dash_through_the_equals_form(home):
-    """THE CASE #17 NAMED, both halves, end to end.
-
-    `park Atlas --lane --dry-run` is the accident: two flags typed, one
-    swallowed as the other's value, a REAL park where a rehearsal was meant.
-    It is now a refusal that runs nothing — the probe Makefile would say so if
-    it had.
-
-    And said with an `=` it is a lane again: `--lane=--dry-run --dry-run` puts
-    BOTH through, so `ARGS` carries the rehearsal flag once from `--dry-run`
-    and once as the lane's value. That second `--dry-run` is what proves the
-    value reached `LANE` and went out in `ARGS` — which is as far as this
-    command can carry it: the recipe word-splits `$(ARGS)`, so the extension
-    receives the same two words from `--lane=--dry-run` as it did from the
-    accident, and the `=` form buys `park`'s own parsing, not the extension's
-    (the independent review of this branch, 2026-09-11). For `--repo`,
-    `--name` and `--project`, which never leave the command, it buys the value.
-    """
-    root = probe_project(home / "projects", "Atlas")
-    refused = run(PARK, "Atlas", "--lane", "--dry-run", home=home)
-    assert refused.returncode == 2, refused.stdout + refused.stderr
-    assert "REFUSED: --lane needs a value:" in refused.stderr
-    assert "--lane=--dry-run" in refused.stderr
-    assert refused.stdout == "", f"a refusal parked: {refused.stdout!r}"
-    assert "PROBE park" not in refused.stdout + refused.stderr
-
-    result = run(PARK, "Atlas", "--lane=--dry-run", "--dry-run", home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "make park ARGS='--dry-run --lane --dry-run'" in result.stdout
-    assert f"PROBE park in {root} ARGS=[--dry-run --lane --dry-run]" \
-        in result.stdout
-
-
-def test_resume_takes_the_workspace_and_the_org_after_an_equals_sign(remotes,
-                                                                     home):
-    """The `=` spelling is not a second parser: the value does the same work.
-
-    Both of these flags CHANGE WHAT HAPPENS rather than merely being echoed —
-    `--workspace` names the private repository to clone, `--org` picks between
-    two manifests that record one name — so a spelling that arrived but was
-    read as something else would show here and nowhere in the parametrized
-    pair above. The two calls are the same two `test_resume_refuses_when_two_
-    orgs_record_the_same_name` makes, spelled with an `=`.
-    """
-    refused = run(RESUME, FAMILY, "--workspace=tester/twoorgs", home=home,
-                  env=offline(remotes))
-    assert refused.returncode == 2, refused.stdout + refused.stderr
-    assert "workspace manifests record 'TestFam'" in refused.stderr
-    assert f"resume {FAMILY} --org <org>" in refused.stderr
-    assert (home / ".agents" / "workspace.yaml").is_file(), (
-        "the workspace slug arrived: the config it writes is the proof")
-
-    answered = run(RESUME, FAMILY, "--org=orgb", home=home,
-                   env=offline(remotes))
-    assert answered.returncode == 0, answered.stderr + answered.stdout
-    assert "org             orgb" in answered.stdout
-    assert (home / "projects" / FAMILY / FAMILY / "family.yaml").is_file()
-
-
-def test_a_leg_whose_submodule_name_carries_a_space_is_still_reported(home,
-                                                                       tmp_path):
-    """`.gitmodules` is read with `git config -z`: a submodule NAME with a
-    space (`[submodule "sp ace"]`) prints as `submodule.sp ace.path spec` in
-    the plain form, and splitting that at its first space handed back
-    `ace.path spec` — a path that does not exist — so the leg was silently
-    left out of the not-carried report. A valueless key beside it prints
-    bare and is not a path either."""
-    projects = home / "projects"
-    root = probe_project(projects, "Atlas")
-    git("init", "-q", "-b", "main", ".", cwd=root)
-    leg_seed = tmp_path / "leg-seed"
-    leg_seed.mkdir()
-    (leg_seed / "spec.md").write_text("# spec\n", encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=leg_seed)
-    commit_all(leg_seed, "the leg")
-    leg_bare = tmp_path / "leg.git"
-    git("clone", "-q", "--bare", str(leg_seed), str(leg_bare), cwd=tmp_path)
-    git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-        "--name", "sp ace", str(leg_bare), "spec", cwd=root)
-    with (root / ".gitmodules").open("a", encoding="utf-8") as handle:
-        handle.write('[submodule "empty"]\n\tpath\n')
-    commit_all(root, "the leg, pinned, under a spaced name")
-    (root / "spec" / "more.md").write_text("unpushed\n", encoding="utf-8")
-    commit_all(root / "spec", "an unpushed leg commit")
-
-    result = run(PARK, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"unpushed main   leg     {root / 'spec'}" in result.stdout, (
-        "the leg under the spaced submodule name was left out of the report")
-    assert "ace.path" not in result.stdout
-    assert "submodule.empty.path" not in result.stdout
-
-
-# --- F5: --repo takes any spelling -----------------------------------------
-
-REPO_FLAG_SPELLINGS = [
-    "TestOrg/Atlas",
-    "TestOrg/Atlas.git",
-    "TestOrg/Atlas/",
-    "https://github.com/TestOrg/Atlas.git",
-    "git@github.com:TestOrg/Atlas.git",
-]
-
-
-@pytest.mark.parametrize("spelling", REPO_FLAG_SPELLINGS)
-def test_repo_accepts_any_spelling_of_the_repository(home, spelling):
-    """A person pastes what they have: the slug, the slug with `.git`, or the
-    whole url out of the browser. All of them are the same repository, and the
-    flag goes through the same parser that reads a clone's `origin`."""
-    projects = home / "projects"
-    root = probe_project(projects, "Atlas")
-    git("init", "-q", "-b", "main", ".", cwd=root)
-    git("remote", "add", "origin", "https://github.com/TestOrg/Atlas.git",
-        cwd=root)
-    result = run(PARK, "--repo", spelling, home=home)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {root}" in result.stdout
-
-
-@pytest.mark.parametrize("spelling", REPO_FLAG_SPELLINGS)
-def test_the_no_match_refusal_prints_one_clone_url_not_two(home, spelling):
-    """The refusal used to wrap `https://github.com/` around whatever it was
-    handed, so a url spelling produced
-    `git clone https://github.com/https://github.com/…git.git`."""
-    result = run(PARK, "--repo", spelling, home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert ("git clone --recurse-submodules "
-            "https://github.com/TestOrg/Atlas.git") in result.stderr
-    assert "github.com/https://" not in result.stderr
-
-
-# --- F6: the walk-up skips a pinned copy and a linked worktree -------------
-
-def test_the_walk_up_skips_the_holders_pinned_member_copy(estate, home):
-    """`members/<Project>` is a whole `project.yaml` root, and it is DETACHED
-    and pinned: running a write verb there acts on the wrong copy of the
-    member, on a HEAD nobody is working from. The walk-up passes it and
-    reaches the family folder, which is what the person is in."""
-    pinned = estate["holder"] / "members" / "Alpha"
-    assert (pinned / "project.yaml").is_file(), "fixture: the pinned copy is a root"
-    result = run(PARK, home=home, cwd=pinned)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"the family holder at {estate['holder']}" in result.stdout
-    assert f"the assembly root at {pinned}" not in result.stdout
-
-
-def test_the_walk_up_skips_a_linked_worktree(home):
-    """A single-repository project's FEATURE worktree is a full checkout with
-    the whole `project.yaml` in it, so the walk-up used to answer
-    `<worktree_root>/001-a-feature` as an estate named after the branch — and
-    `park` ran the write verb inside the very worktree the extension parks."""
-    projects = home / "projects"
-    root = probe_project(projects, "Atlas")
-    git("init", "-q", "-b", "main", ".", cwd=root)
-    commit_all(root, "the project")
-    worktree = root / "worktrees" / "001-a-feature"
-    git("worktree", "add", "-q", "-b", "001-a-feature", str(worktree), cwd=root)
-    assert (worktree / "project.yaml").is_file(), "fixture: a full checkout"
-
-    result = run(PARK, home=home, cwd=worktree)
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"PROBE park in {root} " in result.stdout
-    assert str(worktree) not in result.stdout
-
-
-def test_a_pinned_copy_is_not_listed_as_an_estate(estate, home):
-    """The same rule in the refusal's own list: `members/<Project>` is not
-    somewhere anybody can park."""
-    result = run(PARK, "Nope", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"family   {FAMILY}" in result.stderr
-    assert "members/" not in result.stderr
-
-
-# --- F1: a refused holder is never bootstrapped ----------------------------
-
-def test_a_dirty_holder_is_refused_and_its_bootstrap_never_runs(behind, home,
-                                                                remotes):
-    """THE ONE THAT LOSES WORK. The holder's `make bootstrap` is `git
-    submodule update --init --recursive`, which snaps every `members/<X>` back
-    to the recorded gitlink. Running it after a refusal printed "nothing was
-    reset" discarded exactly the pin bump the refusal was protecting: a
-    half-finished `family.py bump` lives as a MOVED GITLINK in the holder's
-    index, and that is what the submodule update throws away.
-    """
-    holder = behind["holder"]
-    pinned = holder / "members" / "Alpha"
-    # A pin bump in progress: the member's pinned copy moved to a new commit
-    # and the gitlink staged, exactly as `family.py bump` leaves it mid-flight.
-    (pinned / "BUMPED.md").write_text("the member moved on\n", encoding="utf-8")
-    commit_all(pinned, "a commit the family is about to pin")
-    bumped = git("rev-parse", "HEAD", cwd=pinned).stdout.strip()
-    git("add", "--", "members/Alpha", cwd=holder)
-    (holder / "SCRATCH.md").write_text("half a bump\n", encoding="utf-8")
-    staged = git("rev-parse", ":members/Alpha", cwd=holder).stdout.strip()
-    assert staged == bumped, "fixture: the gitlink is staged at the new commit"
-
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"REFUSED holder {FAMILY}: uncommitted changes in {holder}" \
-        in result.stdout
-    assert "bootstrap skipped: refused above" in result.stdout
-    assert "Nothing here was fetched, moved or reset." in result.stdout
-    assert git("rev-parse", ":members/Alpha",
-               cwd=holder).stdout.strip() == bumped, (
-        "the staged gitlink was reset — the pin bump is gone")
-    assert git("rev-parse", "HEAD", cwd=pinned).stdout.strip() == bumped, (
-        "the pinned copy was snapped back to the old gitlink")
-
-
-def test_a_holder_on_a_feature_branch_is_refused_and_not_bootstrapped(behind,
-                                                                      home,
-                                                                      remotes):
-    holder = behind["holder"]
-    git("checkout", "-q", "-b", "pin-bump/alpha", cwd=holder)
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"REFUSED holder {FAMILY}: HEAD is 'pin-bump/alpha'" in result.stdout
-    assert "bootstrap skipped: refused above" in result.stdout
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=holder).stdout.strip() == "pin-bump/alpha"
-
-
-# --- F3: a leg off its tracking branch refuses the root --------------------
-
-@pytest.fixture
-def legged(remotes, home) -> dict:
-    """The leg-bearing project, cloned, with a config that names its record."""
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text("repository: tester/legged\npath: ~/projects/legged\n",
-                      encoding="utf-8")
-    git("clone", "-q", str(remotes["legged"]),
-        str(home / "projects" / "legged"), cwd=home)
-    root = home / "projects" / LEG_MEMBER
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(remotes["leg_member"]), str(root),
-        cwd=home / "projects")
-    return {"root": root, "leg": root / "spec"}
-
-
-def test_a_leg_on_a_feature_branch_refuses_the_root_and_is_not_moved(legged,
-                                                                     home,
-                                                                     remotes):
-    """The superproject is CLEAN when a leg sits on a clean feature branch at
-    the pin, so the dirty and off-branch guards see nothing — and the root's
-    own `make bootstrap` then walks that leg back onto `main`, because
-    `checkout_tracking_branch` runs `git checkout <tracking>` whenever the
-    leg's branch tip equals the pin. The leg is asked FIRST now.
-    """
-    leg = legged["leg"]
-    git("checkout", "-q", "-b", "001-my-feature", cwd=leg)
-    head = git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-    assert git("status", "--porcelain", cwd=legged["root"]).stdout == "", (
-        "fixture: the superproject is clean, which is the whole point")
-
-    result = run(RESUME, LEG_MEMBER, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"REFUSED root {LEG_MEMBER}: leg spec is on '001-my-feature', "
-            "not its tracking branch 'main'") in result.stdout
-    assert "`make bootstrap` would move it - nothing was touched." \
-        in result.stdout
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "001-my-feature", (
-        "the leg was walked off its feature branch")
-    assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-    assert f"{LEG_MEMBER}.sh ran with:" not in result.stdout, (
-        "a refused root does not get the verb either")
-
-
-def test_the_real_bootstrap_would_have_moved_that_leg(legged):
-    """THE GUARD IS NOT THEATRE. The same fixture, with the guard bypassed:
-    the member's OWN `scripts/bootstrap.py` — the real one, shipped in
-    `templates/assembly-root/` and copied into this seed — moves the leg off
-    its feature branch. That is what `resume` refuses to cause.
-    """
-    leg = legged["leg"]
-    git("checkout", "-q", "-b", "001-my-feature", cwd=leg)
-    proc = subprocess.run([sys.executable, "scripts/bootstrap.py"],
-                          cwd=str(legged["root"]), capture_output=True,
-                          text=True, check=False)
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "main", (
-        "the premise of the guard is gone: bootstrap no longer moves a leg\n"
-        + proc.stdout + proc.stderr)
-
-
-def test_a_leg_detached_at_the_pin_is_not_a_refusal(legged, home, remotes):
-    """The state a fresh clone arrives in, and precisely what bootstrap
-    exists to fix. Refusing it would refuse every first run."""
-    leg = legged["leg"]
-    git("checkout", "-q", "--detach", cwd=leg)
-    result = run(RESUME, LEG_MEMBER, home=home, env=offline(remotes))
-    assert "not its tracking branch" not in result.stdout, (
-        result.stdout + result.stderr)
-    assert f"{LEG_MEMBER}.sh ran with:" in result.stdout
-
-
-# --- F3, again (#235): the branch a leg is held to is the LEG's own --------
-
-#: A member like `Charlie`, except that its spec leg's row declares
-#: `branch: develop`.
-OWN_BRANCH_MEMBER = "Delta"
-
-
-def clone_own_branch_member(home, tmp_path, **seed) -> dict:
-    """`legged`, for a root whose spec leg declares `branch: develop`.
-
-    Built per test under `tmp_path` rather than into the session's `remotes`,
-    so the leg has a `develop` to sit on only where a test asks for one. The
-    leg arrives DETACHED at the pin, as every fresh clone's does, and `main`
-    and `develop` are both the pin. `seed` goes to `seed_leg_member`.
-    """
-    base = tmp_path / "own-branch-remotes"
-    base.mkdir()
-    seed.setdefault("leg_branch", "develop")
-    bare, leg_bare = seed_leg_member(base, OWN_BRANCH_MEMBER, **seed)
-    workspace = seed_workspace(
-        base, "legged",
-        {f"workspaces/{ORG}/{OWN_BRANCH_MEMBER.lower()}.yaml":
-            standalone_manifest(OWN_BRANCH_MEMBER)})
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text("repository: tester/legged\npath: ~/projects/legged\n",
-                      encoding="utf-8")
-    git("clone", "-q", str(workspace), str(home / "projects" / "legged"),
-        cwd=home)
-    root = home / "projects" / OWN_BRANCH_MEMBER
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(bare), str(root), cwd=home / "projects")
-    return {"root": root, "leg": root / "spec", "code": root / "code",
-            "dir": base / "remotes", "bare": bare, "leg_bare": leg_bare}
-
-
-@pytest.fixture
-def legged_own_branch(home, tmp_path) -> dict:
-    return clone_own_branch_member(home, tmp_path)
-
-
-def test_a_leg_on_its_own_declared_branch_is_not_refused(legged_own_branch,
-                                                         home):
-    """The guard compared every leg with the ROOT's `tracking_branch`, so a
-    leg sitting on the `branch:` its own row declares was refused as "not its
-    tracking branch 'main'" — where it belongs, and where `make bootstrap`
-    leaves it.
-    """
-    leg = legged_own_branch["leg"]
-    git("checkout", "-q", "-b", "develop", cwd=leg)
-    head = git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-    assert git("status", "--porcelain", cwd=legged_own_branch["root"]
-               ).stdout == "", "fixture: the superproject is clean"
-
-    result = run(RESUME, OWN_BRANCH_MEMBER, home=home,
-                 env=offline(legged_own_branch))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "REFUSED" not in result.stdout, result.stdout
-    assert "not its tracking branch" not in result.stdout
-    assert f"{OWN_BRANCH_MEMBER}.sh ran with:" in result.stdout, (
-        "a root whose leg is where it belongs is given the verb")
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "develop"
-    assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-
-
-def test_a_leg_off_its_own_declared_branch_refuses_the_root_and_is_not_moved(
-        legged_own_branch, home):
-    """THE MOVE THE GUARD EXISTS TO REFUSE, for a leg the old guard let
-    through. The leg sits on `main`, the ROOT's `tracking_branch`, while its
-    row declares `branch: develop` and a local `develop` is AT the pin — so
-    the root's own `make bootstrap` checks `develop` out, and `resume` used to
-    report that as success (exit 0) with the leg's HEAD moved.
-    """
-    root, leg = legged_own_branch["root"], legged_own_branch["leg"]
-    git("branch", "-q", "develop", cwd=leg)
-    git("checkout", "-q", "main", cwd=leg)
-    head = git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-    assert git("status", "--porcelain", cwd=root).stdout == "", (
-        "fixture: the superproject is clean, which is the whole point")
-
-    result = run(RESUME, OWN_BRANCH_MEMBER, home=home,
-                 env=offline(legged_own_branch))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"REFUSED root {OWN_BRANCH_MEMBER}: leg spec is on 'main', "
-            "not its own branch 'develop' "
-            "(the `branch:` of its row in project.yaml);") in result.stdout
-    assert "`make bootstrap` would move it - nothing was touched." \
-        in result.stdout
-    assert "put it back on develop, and re-run." in result.stdout
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "main", (
-        "the leg was walked onto its own branch")
-    assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-    assert f"{OWN_BRANCH_MEMBER}.sh ran with:" not in result.stdout, (
-        "a refused root does not get the verb either")
-
-    # The premise, so the refusal is not theatre: the root's REAL bootstrap,
-    # run by hand over what `resume` refused, is what moves the leg.
-    proc = subprocess.run([sys.executable, "scripts/bootstrap.py"],
-                          cwd=str(root), capture_output=True, text=True,
-                          check=False)
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "develop", (
-        "the premise of the guard is gone: bootstrap no longer places a leg "
-        "on its own branch\n" + proc.stdout + proc.stderr)
-
-
-def test_a_leg_with_no_branch_of_its_own_is_held_to_the_roots_and_says_so(
-        legged, home, remotes):
-    """UNCHANGED for a row with no `branch:`: the root's `tracking_branch` is
-    where bootstrap puts that leg, so a leg off it is refused exactly as
-    before — and the refusal now says WHICH branch the one it names is.
-    """
-    leg = legged["leg"]
-    git("checkout", "-q", "-b", "001-my-feature", cwd=leg)
-    head = git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-
-    result = run(RESUME, LEG_MEMBER, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"REFUSED root {LEG_MEMBER}: leg spec is on '001-my-feature', "
-            "not its tracking branch 'main' "
-            "(the root's `tracking_branch`);") in result.stdout
-    assert "put it back on main, and re-run." in result.stdout
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=leg).stdout.strip() == "001-my-feature"
-    assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-    assert f"{LEG_MEMBER}.sh ran with:" not in result.stdout
-
-
-#: `leg_branch_of`'s own ground, which the tests above only meet at
-#: `branch: develop` on the line after `path: spec` (the review of #238, 1).
-#: The rows after `legs:` of a manifest, the leg asked about, and the branch
-#: `bootstrap.py`'s `leg.get("branch") or branch` would find in that row.
-LEG_ASSEMBLY_ROW = ('  - role: assembly\n    repository: o/R\n'
-                    '    path: "."\n')
-LEG_BRANCH_CASES = [
-    ("after-path",
-     "  - role: spec\n    path: spec\n    branch: develop\n", "spec", "develop"),
-    ("before-path",
-     "  - role: spec\n    branch: develop\n    path: spec\n", "spec", "develop"),
-    ("double-quoted",
-     '  - role: spec\n    path: spec\n    branch: "develop"\n', "spec", "develop"),
-    ("single-quoted",
-     "  - role: spec\n    path: spec\n    branch: 'develop'\n", "spec", "develop"),
-    ("a-trailing-comment-is-cut",
-     "  - role: spec\n    path: spec\n    branch: develop # own\n", "spec",
-     "develop"),
-    ("a-trailing-comment-after-quotes-is-cut",
-     '  - role: spec\n    path: spec\n    branch: "develop"   # own\n', "spec",
-     "develop"),
-    ("an-empty-value-is-no-branch",
-     "  - role: spec\n    path: spec\n    branch:\n", "spec", ""),
-    ("only-a-comment-is-no-branch",
-     "  - role: spec\n    path: spec\n    branch:   # none\n", "spec", ""),
-    ("null-is-no-branch",
-     "  - role: spec\n    path: spec\n    branch: null\n", "spec", ""),
-    ("Null-is-no-branch",
-     "  - role: spec\n    path: spec\n    branch: Null\n", "spec", ""),
-    ("tilde-is-no-branch",
-     "  - role: spec\n    path: spec\n    branch: ~\n", "spec", ""),
-    ("a-row-with-none-of-its-own",
-     "  - role: spec\n    path: spec\n  - role: code\n    path: code\n"
-     "    branch: elsewhere\n", "spec", ""),
-    ("another-rows-branch-is-not-this-rows",
-     "  - role: spec\n    path: spec\n  - role: code\n    path: code\n"
-     "    branch: elsewhere\n", "code", "elsewhere"),
-    ("a-branch-before-the-next-row-is-not-the-next-rows",
-     "  - role: spec\n    branch: develop\n    path: spec\n"
-     "  - role: code\n    path: code\n", "code", ""),
-    ("the-assembly-row-has-no-leg-branch",
-     LEG_ASSEMBLY_ROW + "    branch: leak\n"
-     "  - role: spec\n    path: spec\n", "spec", ""),
-    ("paths-sharing-a-prefix-ask-the-exact-row",
-     "  - role: spec\n    path: spec\n    branch: a\n"
-     "  - role: other\n    path: spec-extra\n    branch: b\n", "spec", "a"),
-    ("paths-sharing-a-prefix-ask-the-exact-row-the-other-way",
-     "  - role: other\n    path: spec-extra\n    branch: b\n"
-     "  - role: spec\n    path: spec\n    branch: a\n", "spec", "a"),
-    ("a-longer-path-declaring-one-is-not-the-shorter",
-     "  - role: spec\n    path: spec\n"
-     "  - role: other\n    path: spec-extra\n    branch: b\n", "spec", ""),
-    ("a-dot-slash-path-is-the-same-leg",
-     '  - role: spec\n    path: "./spec"\n    branch: develop\n', "spec",
-     "develop"),
-    ("a-trailing-slash-path-is-the-same-leg",
-     "  - role: spec\n    path: spec/\n    branch: develop\n", "spec", "develop"),
-    ("a-dot-slash-leg-asked-for-is-the-same-leg",
-     "  - role: spec\n    path: spec\n    branch: develop\n", "./spec",
-     "develop"),
-    ("a-row-that-does-not-open-with-a-role-leaks-nothing",
-     "  - role: spec\n    path: spec\n  - path: other\n    branch: leak\n",
-     "spec", ""),
-]
-
-
-def shared_function(script: Path, name: str) -> str:
-    """One top-level function of the shared resolver, as written in `script`."""
-    text = script.read_text(encoding="utf-8")
-    start = text.index(f"\n{name}() {{\n") + 1
-    return text[start:text.index("\n}\n", start) + 3]
-
-
-@pytest.mark.parametrize("rows,want,expected",
-                         [case[1:] for case in LEG_BRANCH_CASES],
-                         ids=[case[0] for case in LEG_BRANCH_CASES])
-def test_leg_branch_of_reads_a_rows_own_branch_the_way_bootstrap_does(
-        tmp_path, rows, want, expected):
-    """`leg_branch_of` is what `resume` and `status` ask where a leg belongs,
-    and `scripts/bootstrap.py` is what it has to agree with: a leg goes on
-    `str(leg.get("branch") or branch)`, so the answer is the row's own
-    `branch:` or NOTHING. The code is the real one, `trim_unquote` and
-    `leg_branch_of` cut out of `resume` and run in `bash`; the byte-for-byte
-    tests keep the other two copies the same."""
-    root = tmp_path / "root"
-    root.mkdir()
-    (root / "project.yaml").write_text(
-        "schema_version: 1\nkind: project-manifest\ntracking_branch: main\n"
-        "legs:\n" + (rows if LEG_ASSEMBLY_ROW in rows else LEG_ASSEMBLY_ROW + rows),
-        encoding="utf-8")
-    functions = tmp_path / "functions.sh"
-    functions.write_text(shared_function(RESUME, "trim_unquote")
-                         + shared_function(RESUME, "leg_branch_of"),
-                         encoding="utf-8")
-    proc = subprocess.run(
-        ["bash", "-c", 'source "$1"; leg_branch_of "$2" "$3"', "_",
-         str(functions), str(root), want],
-        capture_output=True, text=True, check=False, input="")
-    assert proc.returncode == 0, proc.stderr
-    assert proc.stdout == (f"{expected}\n" if expected else ""), (
-        f"asked for {want!r}, answered {proc.stdout!r}")
-
-
-#: `trim_unquote`, the one reader of a VALUE in the shared block: the text
-#: after `key:` as the three commands hand it over, and the text openRepoShape
-#: v1.1.0's `parse_yaml` reads out of the same line (#243) — its
-#: `_strip_comment`, `_quote_end` and `_quoted_scalar`. A quoted value is the
-#: text up to its closing quote, a `\` or a `''` not closing it, and nothing
-#: after the close is the value; an unquoted one is cut at a `#` that opens
-#: it or follows whitespace. The escapes are honoured to find the close and
-#: never unescaped, as before, and `null` is text here: what is null is the
-#: caller's to say.
-TRIM_UNQUOTE_CASES = [
-    ("plain", " testorg/Quill", "testorg/Quill"),
-    ("crlf", " testorg/Quill\r", "testorg/Quill"),
-    ("double-quoted", ' "testorg/Quill"', "testorg/Quill"),
-    ("single-quoted", " 'testorg/Quill'", "testorg/Quill"),
-    ("a-trailing-comment", " testorg/Quill   # the holder", "testorg/Quill"),
-    ("a-tab-before-the-comment", " testorg/Quill\t# the holder",
-     "testorg/Quill"),
-    ("a-trailing-comment-after-double-quotes",
-     ' "testorg/Quill"   # the holder', "testorg/Quill"),
-    ("a-trailing-comment-after-single-quotes",
-     " 'testorg/Quill' # the holder", "testorg/Quill"),
-    ("a-comment-and-crlf", " main # x\r", "main"),
-    ("only-a-comment-is-empty", "   # nothing", ""),
-    ("a-comment-with-no-space-after-the-colon-is-empty", "# nothing", ""),
-    ("empty", "", ""),
-    ("empty-double-quotes", ' ""', ""),
-    ("a-hash-inside-double-quotes-is-text", ' "testorg/Quill #2"',
-     "testorg/Quill #2"),
-    ("a-hash-inside-single-quotes-is-text", " 'a # b' # c", "a # b"),
-    ("a-hash-with-no-space-before-it-is-text", " a#b", "a#b"),
-    ("spaces-inside-quotes-are-kept", ' "  a  " ', "  a  "),
-    ("an-escaped-quote-does-not-close", ' "a\\"b" # c', 'a\\"b'),
-    ("a-doubled-single-quote-does-not-close", " 'it''s' # c", "it''s"),
-    ("a-quote-in-a-plain-value-is-text", " it's # c", "it's"),
-    ("a-quote-nothing-closes-is-kept-whole", ' "abc # x', '"abc # x'),
-    ("null-is-text-here", " null", "null"),
-]
-
-
-@pytest.mark.parametrize("raw,expected",
-                         [case[1:] for case in TRIM_UNQUOTE_CASES],
-                         ids=[case[0] for case in TRIM_UNQUOTE_CASES])
-def test_trim_unquote_reads_a_value_the_way_openreposhapes_parse_yaml_does(
-        tmp_path, raw, expected):
-    """Every scalar the three commands read goes through here — `kind:`,
-    `name:`, `id:`, `repository:`, `tracking_branch:`, a leg's `role:` and
-    `path:`, a member's `- project:` — so a comment v1.1.0 drops was part of
-    the value, and a folder or a branch named with it was never found. The
-    code is the real one, cut out of `resume`; the byte-for-byte tests keep
-    the other two copies the same."""
-    functions = tmp_path / "functions.sh"
-    functions.write_text(shared_function(RESUME, "trim_unquote"),
-                         encoding="utf-8")
-    proc = subprocess.run(
-        ["bash", "-c", 'source "$1"; trim_unquote "$2"', "_",
-         str(functions), raw],
-        capture_output=True, text=True, check=False, input="")
-    assert proc.returncode == 0, proc.stderr
-    assert proc.stdout == expected, (
-        f"read {raw!r} as {proc.stdout!r}, not {expected!r}")
-
-
-def test_each_leg_of_one_root_is_held_to_its_own_branch(home, tmp_path):
-    """A root with a leg that declares `branch: develop` and one that does
-    not: the first is where it belongs on `develop` and the second on the
-    ROOT's `main`, and `resume` refuses neither. Put the second on `develop`
-    and it is the one refused, by name, while the first is left alone."""
-    estate = clone_own_branch_member(home, tmp_path, code_leg=True)
-    root, spec, code = estate["root"], estate["leg"], estate["code"]
-    git("checkout", "-q", "-b", "develop", cwd=spec)
-
-    result = run(RESUME, OWN_BRANCH_MEMBER, home=home, env=offline(estate))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "REFUSED" not in result.stdout, result.stdout
-    assert f"{OWN_BRANCH_MEMBER}.sh ran with:" in result.stdout
-    assert git("rev-parse", "--abbrev-ref", "HEAD",
-               cwd=spec).stdout.strip() == "develop"
-    assert git("rev-parse", "--abbrev-ref", "HEAD",
-               cwd=code).stdout.strip() == "main", "bootstrap placed it"
-
-    git("checkout", "-q", "-b", "develop", cwd=code)
-    heads = {leg: git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-             for leg in (spec, code)}
-    assert git("status", "--porcelain", cwd=root).stdout == ""
-    result = run(RESUME, OWN_BRANCH_MEMBER, home=home, env=offline(estate))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"REFUSED root {OWN_BRANCH_MEMBER}: leg code is on 'develop', "
-            "not its tracking branch 'main' "
-            "(the root's `tracking_branch`);") in result.stdout
-    assert "leg spec is on" not in result.stdout, (
-        "the leg on its own declared branch was refused too")
-    for leg, head in heads.items():
-        assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-        assert git("rev-parse", "--abbrev-ref", "HEAD",
-                   cwd=leg).stdout.strip() == "develop"
-
-
-@pytest.mark.parametrize("spelled", ['"./spec"', "spec/"],
-                         ids=["dot-slash", "trailing-slash"])
-def test_a_leg_spelled_dot_slash_or_with_a_slash_is_one_leg_to_status_and_resume(
-        home, tmp_path, spelled):
-    """`status` finds a leg by `.gitmodules`' path and `resume` by the
-    manifest's own text, and `./spec` and `spec/` are `spec` to validate-
-    manifest. A leg on `main` whose row declares `branch: develop` is the one
-    both must name, whichever way the row spells its path (the review of
-    #238, 2) — `status` read it as a leg on its tracking branch."""
-    estate = clone_own_branch_member(home, tmp_path, spec_path=spelled)
-    leg = estate["leg"]
-    git("checkout", "-q", "main", cwd=leg)
-    head = git("rev-parse", "HEAD", cwd=leg).stdout.strip()
-
-    status = run(STATUS, OWN_BRANCH_MEMBER, home=home)
-    assert status.returncode == 1, status.stdout + status.stderr
-    assert f"  leg    develop {leg}" in status.stdout, status.stdout
-    assert ("    - on branch main, not develop, the `branch:` this leg's own "
-            "row declares in project.yaml") in status.stdout
-
-    resume = run(RESUME, OWN_BRANCH_MEMBER, home=home, env=offline(estate))
-    assert resume.returncode == 1, resume.stdout + resume.stderr
-    assert (f"REFUSED root {OWN_BRANCH_MEMBER}: leg {spelled.strip(chr(34))} "
-            "is on 'main', not its own branch 'develop'") in resume.stdout
-    assert git("rev-parse", "HEAD", cwd=leg).stdout.strip() == head
-    assert git("rev-parse", "--abbrev-ref", "HEAD",
-               cwd=leg).stdout.strip() == "main"
-
-
-# --- F4: two checkouts of one workspace are not two orgs -------------------
-
-def test_two_checkouts_of_one_workspace_are_not_two_orgs(remotes, home):
-    """`FOUND` counted FILES. An `orgs:` override pointing at a second clone of
-    the same private repository — or just a second checkout of it — produced
-    "2 workspace manifests record 'TestFam'", and `--org` could not answer it
-    because both rows named the same org."""
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(
-        f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n"
-        "orgs:\n"
-        f"  {ORG}:\n"
-        f"    repository: {WORKSPACE_SLUG}\n"
-        "    path: ~/projects/wip-again\n", encoding="utf-8")
-    for name in ("wip", "wip-again"):
-        git("clone", "-q", str(remotes["workspace"]),
-            str(home / "projects" / name), cwd=home)
-
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "workspace manifests record" not in result.stderr
-    assert (home / "projects" / FAMILY / FAMILY / "family.yaml").is_file()
-
-
-def test_two_checkouts_that_spell_the_manifest_differently_are_one_record(
-        remotes, home):
-    """`manifest_candidates` compares the basename CASE-INSENSITIVELY, so the
-    key that decides whether two rows are two records has to fold it too:
-    `testfam.yaml` in one checkout and `TestFam.yaml` in another are one
-    record of one org. Keyed on the raw basename they were two, and `resume`
-    refused with `--org` for an answer — naming the same org twice."""
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(
-        f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n"
-        "orgs:\n"
-        f"  {ORG}:\n"
-        f"    repository: {WORKSPACE_SLUG}\n"
-        "    path: ~/projects/wip-again\n", encoding="utf-8")
-    for name in ("wip", "wip-again"):
-        git("clone", "-q", str(remotes["workspace"]),
-            str(home / "projects" / name), cwd=home)
-    spelt = (home / "projects" / "wip-again" / "workspaces" / ORG
-             / f"{FAMILY.lower()}.yaml")
-    spelt.rename(spelt.with_name(f"{FAMILY}.yaml"))
-
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert "workspace manifests record" not in result.stderr
-    assert (home / "projects" / FAMILY / FAMILY / "family.yaml").is_file()
-
-
-# --- F7: a `root:` that walks out of the projects directory ----------------
-
-def test_a_manifest_root_that_escapes_the_projects_directory_is_refused(
-        remotes, home):
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text("repository: tester/escaping\npath: ~/projects/escaping\n",
-                      encoding="utf-8")
-    result = run(RESUME, "runaway", home=home, env=offline(remotes))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "root: ../../elsewhere/Alpha" in result.stderr
-    assert "is not one" in result.stderr
-    assert "Nothing was cloned." in result.stderr
-    assert not (home.parent / "elsewhere").exists()
-    assert not (home / "projects" / ".." ).joinpath("elsewhere").exists()
-
-
-# --- F9: a refused member does not get the verb either ---------------------
-
-def test_a_refused_member_does_not_get_the_verb(behind, home, remotes):
-    """The holder's `make resume` is `siblings.py --make resume`, which has no
-    exclusion flag — so a member this run said it would not touch was getting
-    the verb run in it anyway. With a refusal on the board the verb runs per
-    non-refused sibling instead."""
-    alpha = behind["siblings"]["Alpha"]
-    (alpha / "MINE.md").write_text("half a thought\n", encoding="utf-8")
-
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "the holder's dispatch is NOT used" in result.stdout
-    assert "[Alpha] refused above; `make resume` NOT run." in result.stdout
-    assert "Alpha.sh ran with:" not in result.stdout, (
-        "the verb ran in a clone this run refused to touch")
-    assert "Bravo.sh ran with:" in result.stdout, (
-        "one refusal must not stop the members after it")
-
-
-# ===========================================================================
-# resume — the estate that is already here
-# ===========================================================================
-
-@pytest.fixture
-def behind(estate, home, remotes) -> dict:
-    """The estate, one commit behind on the holder and on every sibling.
-
-    `reset --hard HEAD~1` rather than a push to the shared bare remotes: the
-    remotes are built once per session, and a test that moved one would decide
-    what the next test sees.
-    """
-    config = home / ".agents" / "workspace.yaml"
-    config.parent.mkdir(parents=True)
-    config.write_text(f"repository: {WORKSPACE_SLUG}\npath: ~/projects/wip\n",
-                      encoding="utf-8")
-    git("clone", "-q", str(remotes["workspace"]),
-        str(home / "projects" / "wip"), cwd=home)
-    for path in (estate["holder"], *estate["siblings"].values()):
-        git("reset", "--hard", "-q", "HEAD~1", cwd=path)
-    return estate
-
-
-def test_resume_fast_forwards_the_holder_and_every_sibling(behind, home,
-                                                           remotes):
-    """RULING 2: a person running `resume` is asking for the estate to be
-    current, so each working clone's tracking branch is fast-forwarded — and
-    each one's own `make bootstrap` puts its legs at the new pins."""
-    heads = {name: git("rev-parse", "HEAD", cwd=path).stdout.strip()
-             for name, path in behind["siblings"].items()}
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    for name, path in behind["siblings"].items():
-        assert git("rev-parse", "HEAD", cwd=path).stdout.strip() != heads[name], (
-            f"{name} was not fast-forwarded")
-        assert git("rev-parse", "HEAD", cwd=path).stdout.strip() == git(
-            "rev-parse", "origin/main", cwd=path).stdout.strip()
-        assert f"BOOTSTRAP-{name} ran" in result.stdout
-    assert "present         " in result.stdout
-    assert "0 refusal(s)" in result.stdout
-
-
-def test_resume_refuses_a_dirty_sibling_by_name_and_resumes_the_rest(
-        behind, home, remotes):
-    """RULING 2's other half. Never reset, never stashed, and named — and the
-    rest of the estate still comes back."""
-    alpha = behind["siblings"]["Alpha"]
-    (alpha / "MINE.md").write_text("half a thought\n", encoding="utf-8")
-    head = git("rev-parse", "HEAD", cwd=alpha).stdout.strip()
-
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"REFUSED Alpha: uncommitted changes in {alpha}" in result.stdout
-    assert "nothing was reset" in result.stdout
-    assert git("rev-parse", "HEAD", cwd=alpha).stdout.strip() == head, (
-        "a refused sibling must be exactly where it was")
-    assert (alpha / "MINE.md").is_file(), "nothing may be discarded"
-    bravo = behind["siblings"]["Bravo"]
-    assert git("rev-parse", "HEAD", cwd=bravo).stdout.strip() == git(
-        "rev-parse", "origin/main", cwd=bravo).stdout.strip()
-    assert "Bravo.sh ran with:" in result.stdout, (
-        "one refusal must not stop the members after it")
-    assert "1 refusal(s)" in result.stdout
-
-
-def test_resume_refuses_a_sibling_on_a_feature_branch_by_name(behind, home,
-                                                              remotes):
-    bravo = behind["siblings"]["Bravo"]
-    git("checkout", "-q", "-b", "001-a-feature", cwd=bravo)
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "REFUSED Bravo: HEAD is '001-a-feature', not its tracking branch " \
-        "'main'" in result.stdout
-    assert git("rev-parse", "--abbrev-ref",
-               "HEAD", cwd=bravo).stdout.strip() == "001-a-feature"
-    assert "Alpha.sh ran with:" in result.stdout
-
-
-def test_resume_skips_a_member_with_no_working_clone_by_name(behind, home,
-                                                            remotes):
-    """A skip is not a pass — and `make siblings` is what places one, which is
-    exactly what this run does before it reports."""
-    rmtree(behind["siblings"]["Alpha"])
-    result = run(RESUME, FAMILY, home=home, env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert (behind["folder"] / "Alpha" / ".git").is_dir(), (
-        "`make siblings` must have placed the member back")
-    assert "Alpha.sh ran with:" in result.stdout
-
-
-def test_resume_with_no_name_refreshes_the_estate_around_the_cwd(behind, home,
-                                                                 remotes):
-    result = run(RESUME, home=home, cwd=behind["holder"], env=offline(remotes))
-    assert result.returncode == 0, result.stderr + result.stdout
-    assert f"resume: {FAMILY}" in result.stdout
-    for name, path in behind["siblings"].items():
-        assert git("rev-parse", "HEAD", cwd=path).stdout.strip() == git(
-            "rev-parse", "origin/main", cwd=path).stdout.strip(), name
-
-
-def test_resume_with_no_name_and_no_estate_refuses(home):
-    result = run(RESUME, home=home, cwd=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no estate around" in result.stderr
-    assert "resume <Name>" in result.stderr
-
-
-def test_resume_refuses_a_repo_it_cannot_match(home):
-    result = run(RESUME, "--repo", "TestOrg/Nothing", home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "no clone under your projects directory has origin" in result.stderr
-    assert "resume <Name>" in result.stderr
diff --git a/tests/test_pathspec_check.py b/tests/test_pathspec_check.py
deleted file mode 100644
index 2ad49638..00000000
--- a/tests/test_pathspec_check.py
+++ /dev/null
@@ -1,102 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lanes-edit.sh pathspec-check` - what a workspace commit would stage that
-is bytecode, a cache or an environment (opensoft/openRepoTools#162) - held
-to three of #170's findings, against the REAL helper and a fixture
-workspace (`test_lane_worktrees._real_estate`), in seconds rather than the
-shell suite's hour:
-
-  * G4: the `.gitignore` repair command it offers names the workspace path
-    quoted for the shell, so a path with a space in it still works pasted;
-  * E1: a STAGED bytecode file whose name is not ASCII is refused - `git
-    diff --name-only` C-quotes such a path, and the closing quote hid the
-    `.pyc`;
-  * E2: the `add '<path>'` lines it parses are read in the C locale, never
-    in whatever language the workstation's git speaks.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import WINDOWS_SKIP
-import test_lane_worktrees as LW
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("git") is None or shutil.which("bash") is None,
-    reason="the helper is bash, and it reads git")]
-
-
-def _workspace(tmp_path: Path, name: str = "wip") -> tuple:
-    """The fixture estate's workspace, moved to `projects/<name>` and named
-    there in `workspace.yaml`."""
-    e, wip = LW._real_estate(tmp_path, "eagle")
-    if name != "wip":
-        moved = e.projects / name
-        shutil.move(str(wip), str(moved))
-        yaml = Path(e.env["AGENT_PROTOCOL_ROOT"]) / "workspace.yaml"
-        yaml.write_text(yaml.read_text().replace(f"path: {wip}\n", f"path: {moved}\n"))
-        wip = moved
-    return e, wip
-
-
-def _check(e, *paths, env: dict | None = None) -> subprocess.CompletedProcess:
-    child = dict(e.env)
-    child.update(env or {})
-    return subprocess.run(["bash", str(LW.LANES_EDIT), "pathspec-check", *paths],
-                          capture_output=True, env=child, check=False)
-
-
-def test_the_offered_gitignore_command_survives_a_space_in_the_path(tmp_path):
-    e, wip = _workspace(tmp_path, "my wip")
-    (wip / "handoffs" / "x" / "__pycache__").mkdir(parents=True)
-    (wip / "handoffs" / "x" / "__pycache__" / "m.cpython-312.pyc").write_bytes(b"\0")
-    proc = _check(e, "handoffs/x")
-    err = proc.stderr.decode()
-    assert proc.returncode == 2, err
-    offered = [ln.strip() for ln in err.splitlines() if ln.strip().startswith("printf '%s\\n'")]
-    assert offered, err
-    ran = subprocess.run(["bash", "-c", offered[0]], cwd=str(tmp_path), capture_output=True,
-                         text=True)
-    assert ran.returncode == 0, (offered[0], ran.stderr)
-    assert "__pycache__/" in (wip / ".gitignore").read_text().splitlines(), offered[0]
-
-
-def test_a_staged_bytecode_file_whose_name_is_not_ascii_is_refused(tmp_path):
-    e, wip = _workspace(tmp_path)
-    name = "café.cpython-312.pyc"
-    (wip / "handoffs" / "x").mkdir(parents=True)
-    (wip / "handoffs" / "x" / name).write_bytes(b"\0")
-    e.git("add", "-f", "--", f"handoffs/x/{name}", cwd=wip)
-    proc = _check(e, "handoffs/x")
-    assert proc.returncode == 2, proc.stderr.decode()
-    assert f"handoffs/x/{name}".encode() in proc.stdout, proc.stdout
-
-
-def test_the_add_lines_are_read_in_the_c_locale(tmp_path):
-    """A `git` that answers as a translated one does whenever the locale is
-    not C: `add --dry-run` says `hinzufügen '<path>'`."""
-    e, wip = _workspace(tmp_path)
-    (wip / "handoffs" / "x" / "__pycache__").mkdir(parents=True)
-    (wip / "handoffs" / "x" / "__pycache__" / "m.cpython-312.pyc").write_bytes(b"\0")
-    shim = tmp_path / "de-git"
-    shim.mkdir()
-    real_git = shutil.which("git")
-    (shim / "git").write_text(
-        "#!/bin/sh\n"
-        'case "${LC_ALL:-${LC_MESSAGES:-${LANG:-C}}}" in C|POSIX) exec "' + real_git + '" "$@" ;; esac\n'
-        'case " $* " in *" add --dry-run "*)\n'
-        '  out="$("' + real_git + '" "$@")"; rc=$?\n'
-        "  printf '%s\\n' \"$out\" | sed \"s/^add '/hinzufuegen '/\"; exit \"$rc\" ;;\n"
-        "esac\n"
-        'exec "' + real_git + '" "$@"\n')
-    (shim / "git").chmod(0o755)
-    env = {"PATH": f"{shim}{os.pathsep}{e.env['PATH']}", "LC_ALL": "de_DE.UTF-8",
-           "LANGUAGE": "de"}
-    proc = _check(e, "handoffs/x", env=env)
-    assert proc.returncode == 2, (proc.stdout, proc.stderr.decode())
-    assert b"handoffs/x/__pycache__/m.cpython-312.pyc" in proc.stdout
diff --git a/tests/test_precision_90a_96.py b/tests/test_precision_90a_96.py
deleted file mode 100644
index 32258b76..00000000
--- a/tests/test_precision_90a_96.py
+++ /dev/null
@@ -1,286 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`lane-end`'s two precision defects: its synopsis says a DUPLICATE HOLDER
-retire "ends nothing" (opensoft/openRepoTools#96), and its narrowed state-cell
-scan skips ratified decision O1's cap and its `|` and CR/LF rules, so a cell
-that is not the phrase can hide an open LANDING (#90, part (a)).
-
-EVERY RUN HERE IS A REAL `lane-end` IN A SANDBOX: `test_lane_start_claude_current`'s
-workstation (a bare origin, a workspace clone whose register is a header,
-`workspace.yaml` pointing at it) with the lane's row written into it and
-pushed, so the published row `register-row` reads is the same row. The lane
-has NO object log, which is the one path that still decides a merge hold from
-prose, and the close-out gate's `lane-worktrees` is a stub that finds nothing,
-so a cell that wrongly reads clear is a lane that ENDS rather than one that
-trips over the gate.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, _write, pytestmark
-from conftest import REPO
-
-UTC = "2026-10-11T10:00:00Z"
-UUID = "aaaa0090-9090-4000-8000-aaaa00909090"
-
-
-# ------------------------------------------------------------------- #96
-
-def _synopsis(help_text: str) -> list[str]:
-    """The USAGE block of `--help`, one string per synopsis entry: a line that
-    opens `  lane-end` and the `#` continuation lines under it."""
-    block = help_text.split("\nUSAGE\n", 1)[1].split("\n\n", 1)[0]
-    entries: list[str] = []
-    for line in block.splitlines():
-        if line.startswith("  lane-end"):
-            entries.append(line)
-        else:
-            entries[-1] += " " + line
-    return [" ".join(entry.split()) for entry in entries]
-
-
-@pytest.fixture
-def synopsis(tmp_path: Path) -> list[str]:
-    result = subprocess.run(["bash", str(REPO / "lane-end"), "--help"],
-                            env={"HOME": str(tmp_path), "PATH": "/usr/bin:/bin"},
-                            capture_output=True, text=True, timeout=30, check=False)
-    assert result.returncode == 0, result.stderr
-    return _synopsis(result.stdout)
-
-
-def test_the_synopsis_says_what_a_duplicate_holder_retire_does(synopsis):
-    """`--retire <pid>` on a DUPLICATE HOLDER TERMs the bg-pty-host pair, and
-    the one-line summary said `ends nothing`: true of a FORK, the opposite of
-    the act on a duplicate holder (#96)."""
-    duplicate = [e for e in synopsis if "--retire <" in e and "DUPLICATE" in e]
-    assert len(duplicate) == 1, synopsis
-    assert "TERM" in duplicate[0], duplicate[0]
-    assert "ends nothing" not in duplicate[0], duplicate[0]
-
-
-def test_the_synopsis_keeps_the_fork_and_the_duplicate_on_their_own_lines(synopsis):
-    """The split is the fix: the FORK entry still says it writes and kills
-    nothing, and names no DUPLICATE, whose words differ."""
-    fork = [e for e in synopsis if "--retire <" in e and "FORK" in e]
-    assert len(fork) == 1, synopsis
-    assert "kills nothing" in fork[0], fork[0]
-    assert "DUPLICATE" not in fork[0], fork[0]
-
-
-# ------------------------------------------------------------------ #90 (a)
-
-def _line(length: int, tail: str) -> str:
-    """A phrase line of exactly `length` characters ending in `tail`."""
-    filler = length - len(tail)
-    assert filler > 0
-    return "x" * filler + tail
-
-
-def _wide_line(length: int, tail: str) -> str:
-    """The same, but the filler is `—` and `→`: three bytes a character, so a
-    line inside the cap by characters is far past it by bytes."""
-    line = ("—→" * length)[:length - len(tail)] + tail
-    assert len(line) == length and len(line.encode()) > 2 * length
-    return line
-
-
-def _utf8_locale() -> str | None:
-    """A UTF-8 locale this host has, or None. `locale -a` spells them
-    `C.utf8` or `en_US.UTF-8` by platform."""
-    try:
-        out = subprocess.run(["locale", "-a"], capture_output=True, text=True,
-                             timeout=10, check=False).stdout
-    except OSError:
-        return None
-    names = [n for n in out.split() if n.lower().replace("-", "").endswith(".utf8")]
-    return names[0] if names else None
-
-
-UTF8 = _utf8_locale()
-
-#: `${#x}` counts CHARACTERS in a UTF-8 locale and BYTES in `C`, and the cap is
-#: O1's 240 CHARACTERS in both: every `lane-end` case runs under each.
-LOCALES = ["C", pytest.param(UTF8, id="UTF-8", marks=pytest.mark.skipif(
-    UTF8 is None, reason="this host has no UTF-8 locale"))]
-
-
-@pytest.fixture(params=LOCALES)
-def ended(tmp_path: Path, request):
-    """`ended(cell)` runs `lane-end` on a lane whose register row carries
-    `cell` as its state, in this checkout's row and in the published one, and
-    returns the process and the row as the register has it afterwards."""
-    box = Sandbox(tmp_path)
-    shutil.copy2(REPO / "lane-end", box.bin / "lane-end")
-    (box.bin / "lane-end").chmod(0o755)
-    stub = _write(box.bin / "lane-worktrees", "#!/usr/bin/env bash\nexit 0\n")
-    register = box.wip / "lanes" / "LANES.md"
-    seed = register.read_bytes()
-
-    def row(cell: str | bytes) -> bytes:
-        """A register row; a `bytes` cell is how a hand-edited row that is not
-        UTF-8 gets in."""
-        cell = cell.encode("utf-8") if isinstance(cell, str) else cell
-        return (f"| `{LANE}` | harness `{UUID}` | Eagle / test / brett | "
-                f"2026-10-11T00:00Z | none | handoffs/repoZ/x.md | ".encode()
-                + cell + b" |\n")
-
-    def run(cell: str | bytes, published: str | bytes | None = None,
-            env: dict[str, str] | None = None):
-        """`published` is the cell origin/main carries when it is not this
-        checkout's own: pushed first, then this checkout's row put back.
-        `env` is added to the environment `lane-end` runs in."""
-        if published is not None:
-            register.write_bytes(seed + row(published))
-            box.git("-C", str(box.wip), "commit", "-q", "-am", "the published row")
-            box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-        register.write_bytes(seed + row(cell))
-        if published is None:
-            box.git("-C", str(box.wip), "commit", "-q", "-am", "the row")
-            box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-        full = dict(box.env, LANE_WORKTREES=str(stub), LC_ALL=request.param,
-                    **(env or {}))
-        result = subprocess.run([str(box.bin / "lane-end"), LANE], env=full,
-                                cwd=str(box.lane_dir), capture_output=True,
-                                encoding="utf-8", errors="replace",
-                                timeout=120, check=False)
-        after = next(l for l in register.read_bytes().decode(
-            "utf-8", errors="replace").splitlines()
-            if l.startswith(f"| `{LANE}`"))
-        return result, after
-
-    run.box, run.locale = box, request.param
-    return run
-
-
-HOLD = "LANDING #7 into repoZ main"
-READ = "the last LANDING in its state cell"
-
-
-def test_a_line_over_the_cap_cannot_hide_an_open_landing(ended):
-    """THE DEFECT: `LIVE · <UTC> · <241 characters ending in LANDING #7>` had
-    its scan narrowed to `LIVE`, so the lane ENDED over a hold other lanes'
-    merges wait on. O1's cap is on the line; a cell past it is not the phrase
-    and is read whole (#90, part (a))."""
-    line = _line(241, " " + HOLD)
-    assert len(line) == 241
-    result, after = ended(f"LIVE · {UTC} · {line}")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert READ in result.stderr, result.stderr
-    assert "lane-end on" not in after, after
-
-
-@pytest.mark.parametrize("line", [
-    pytest.param(f"held up | {HOLD}", id="a pipe"),
-    pytest.param(f"held up\r{HOLD}", id="a carriage return"),
-])
-def test_a_line_with_a_pipe_or_a_carriage_return_cannot_hide_an_open_landing(ended, line):
-    """O1's other two rules: the line holds no `|` and no CR/LF. A cell that
-    breaks either is not the phrase, and its words are all read."""
-    result, after = ended(f"LIVE · {UTC} · {line}")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert READ in result.stderr, result.stderr
-    assert "lane-end on" not in after, after
-
-
-def test_the_published_row_is_read_whole_when_it_is_not_the_phrase(ended):
-    """The fallback reads TWO cells and either one showing a hold refuses: this
-    checkout's row says nothing, the one on origin/main is past the cap."""
-    published = f"LIVE · {UTC} · {_line(241, ' ' + HOLD)}"
-    result, after = ended(f"LIVE · {UTC} · all quiet", published=published)
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "the published row on origin/main" in result.stderr, result.stderr
-    assert "lane-end on" not in after, after
-
-
-def test_a_line_exactly_at_the_cap_is_still_prose(ended):
-    """THE BOUNDARY IS INCLUSIVE and the phrase is unchanged: a valid line that
-    says `LANDING #7` is a lane waiting for one, not a hold (Amendment 13(a)),
-    and 240 characters is the longest line `set-row-state` accepts."""
-    line = _line(240, " waiting for " + HOLD)
-    assert len(line) == 240
-    result, after = ended(f"LIVE · {UTC} · {line}")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert "| ENDED · " in after, after
-
-
-def test_a_wide_line_exactly_at_the_cap_is_still_prose(ended):
-    """THE CAP IS COUNTED IN CHARACTERS IN EVERY LOCALE. A valid 240-character
-    line of `—` and `→` is some 680 bytes: counted as bytes under `C` it read as
-    past the cap, the cell was scanned whole, and the lane waiting for a
-    LANDING was held by it (the false hold Amendment 13(a)'s narrowing exists
-    to prevent)."""
-    line = _wide_line(240, " waiting for " + HOLD)
-    result, after = ended(f"LIVE · {UTC} · {line}")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert "| ENDED · " in after, after
-
-
-def test_a_wide_line_one_past_the_cap_cannot_hide_an_open_landing(ended):
-    """...and one character more is past it in every locale, wide or not."""
-    line = _wide_line(241, " " + HOLD)
-    result, after = ended(f"LIVE · {UTC} · {line}")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert READ in result.stderr, result.stderr
-    assert "lane-end on" not in after, after
-
-
-def _lines_that_are_not_utf8() -> list:
-    """Three lines past the cap by BYTES whose characters cannot be counted,
-    each naming a LANDING: a stray continuation byte is no character, and
-    taking continuation bytes out undercounts them."""
-    hold = b" " + HOLD.encode()
-    return [
-        pytest.param(b"\x80" * 241 + hold, id="241 stray continuation bytes"),
-        pytest.param(b"x" * (240 - len(hold)) + "°".encode("latin-1") + hold,
-                     id="Latin-1 with one degree sign"),
-        pytest.param(_wide_line(240, hold.decode()).encode() + b"\x80",
-                     id="a valid 240-character line and one stray byte"),
-    ]
-
-
-@pytest.mark.parametrize("line", _lines_that_are_not_utf8())
-def test_a_line_that_is_not_utf8_cannot_hide_an_open_landing(ended, line):
-    """THE COUNT IS ONLY EXACT FOR VALID UTF-8. Past 240 bytes the characters
-    are counted by taking the continuation bytes out, and text that is not
-    UTF-8 has continuation bytes that follow nothing: a hand-edited cell of
-    them was counted short, narrowed, and its LANDING closed the lane. It
-    falls back to the byte count, which can only over-count (#90, part (a))."""
-    assert len(line) > 240
-    result, after = ended(f"LIVE · {UTC} · ".encode() + line)
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert READ in result.stderr, result.stderr
-    assert "lane-end on" not in after, after
-
-
-def test_a_count_that_cannot_be_made_is_a_line_over_the_cap(ended):
-    """A `wc` that fails (the one place the count is read from) leaves the
-    cell scanned whole: a valid 240-character line of `—` and `→`, which
-    narrows when its count is made, is read for its LANDING instead. It is the
-    `|| cfs_len=241` that does it: without it the count comes back empty, the
-    cell is still read whole, but only because `[ "" -le 240 ]` is an error,
-    which `lane-end` prints. (A UTF-8 locale counts a line of 240 characters as
-    240 and never reaches `wc`.)"""
-    if ended.locale != "C":
-        pytest.skip("only a byte count past 240 reaches the `wc` recount")
-    stub = ended.box.root / "failing-wc"
-    _write(stub / "wc", f'#!/bin/sh\n[ "$*" = -c ] && exit 1\nexec {shutil.which("wc")} "$@"\n')
-    line = _wide_line(240, " waiting for " + HOLD)
-    result, after = ended(f"LIVE · {UTC} · {line}",
-                          env={"PATH": f"{stub}{os.pathsep}{ended.box.env['PATH']}"})
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert READ in result.stderr, result.stderr
-    assert "integer expression" not in result.stderr, result.stderr
-
-
-def test_a_line_over_the_cap_that_holds_nothing_still_ends(ended):
-    """Reading the whole cell is a refusal only where the cell holds
-    something: a malformed one with no LANDING or CLAIMED in it closes."""
-    result, after = ended(f"LIVE · {UTC} · {_line(300, ' and all of it quiet')}")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert "| ENDED · " in after, after
diff --git a/tests/test_register_hardening_120_122.py b/tests/test_register_hardening_120_122.py
deleted file mode 100644
index 3d98b5db..00000000
--- a/tests/test_register_hardening_120_122.py
+++ /dev/null
@@ -1,778 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The register's two rewrites prove what they copied and what landed, the
-sweep's preflight asks `ensure_log`'s own question, a lane whose log already
-closes it is told so, and add-row's archive scan refuses a line it cannot take
-apart: opensoft/openRepoTools#120 (Copilot round 5 on #93) and #122 (round 6).
-
-Each case builds the throwaway register `test_register_scan_hardening_138.py`
-builds — a bare repository and a clone of it in a temporary directory, with a
-temporary `$HOME` — and runs the real `lanes-edit.sh` against it. A write that
-has to come out short is cut by a `cat` first on `PATH` that cuts ONE exact
-copy and hands every other call to the real one; a scan that has to fail, by
-an `awk` that refuses ONE exact program. Nothing here reaches a network or the
-operator's own register.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import stat
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_register_scan_hardening_138 import (  # noqa: F401  (pytestmark is this module's too)
-    HEADER, OLD_ID, UNPRIVILEGED_ONLY, Register as SweepRegister, lane_line, log_text, pytestmark, row)
-
-NEW_ID = "cccc0122-0003-4000-8000-000000000003"
-#: The archive exactly as `archive_rows` creates it: a title, a paragraph, then
-#: the header (line 7) and its rule (line 8). Rows follow from line 9.
-ARCHIVE_HEAD = ("# LANES-retired.md — rows RETIRED out of `lanes/LANES.md`\n\n"
-                "lane-collision-protocol Amendment 19(d). These lanes are finished. Their\n"
-                "positions are NEVER REISSUED: every reader of the next free position and\n"
-                "`lanes --closed` read this file beside the register.\n\n" + HEADER)
-#: The copy seam reads where a `cat`'s output is going, which only Linux says.
-PROC_FD = pytest.mark.skipif(not Path("/proc/self/fd/1").exists(),
-                             reason="the copy seam reads /proc/<pid>/fd/1")
-
-
-class Register(SweepRegister):
-    """`test_register_scan_hardening_138`'s register, with thirty rows of another
-    repository below repoX's — so a copy cut at half its lines still holds every
-    row a case edits — and the seams these cases need."""
-
-    def __init__(self, tmp: Path):
-        super().__init__(tmp)
-        self.write("lanes/LANES.md", self.read("lanes/LANES.md") + "".join(
-            row(f"repoZ-{n}", OLD_ID, f"another repository's row {n}") for n in range(1, 31)))
-        self.publish("another repository's rows")
-
-    def published(self, rel: str) -> str:
-        return self.raw_git("-C", str(self.origin), "show", f"main:{rel}")
-
-    def shim(self, name: str, body: str) -> None:
-        """A `<name>` first on PATH: `body`, then the real one."""
-        real = shutil.which(name, path=os.environ.get("PATH"))
-        path = self.fakebin / name
-        path.write_text(f'#!/usr/bin/env bash\n{body}\nexec "{real}" "$@"\n')
-        path.chmod(0o755)
-
-    def cut_cat(self, cut: str) -> None:
-        """A `cat` that cuts a copy at half its lines. `copy…`: the
-        register's copy into a file named `pre`, the copy every proof of a
-        rewrite is made against. `write…`: the rewrite itself, `cat -- <tmp>/out`
-        into the register — and with `…and restore fail`, the copy's bytes put
-        back into the register as well. `…fail(s)` exits 1 after the half, as a
-        full disk does; `…says done` exits 0, a short write nothing reported."""
-        rc = 0 if cut.endswith("says done") else 1
-        goes_to = 'case "$(readlink "/proc/$$/fd/1" 2>/dev/null)" in {} ) true ;; *) false ;; esac'
-        if cut.startswith("copy"):
-            when = ('[ "${1-}" = -- ] && case "${2-}" in */lanes/LANES.md) true ;; *) false ;; esac && '
-                    + goes_to.format("*/pre"))
-        elif cut == "write and restore fail":
-            when = ('[ "${1-}" = -- ] && case "${2-}" in */out) true ;; '
-                    '*/pre) ' + goes_to.format("*/lanes/LANES.md") + ' ;; *) false ;; esac')
-        else:
-            when = '[ "${1-}" = -- ] && case "${2-}" in */out) true ;; *) false ;; esac'
-        self.shim("cat", f'if {when}; then\n'
-                         f'  n=$(wc -l < "$2"); head -n $((n / 2)) -- "$2"; exit {rc}\nfi')
-
-
-@pytest.fixture
-def reg(tmp_path: Path) -> Register:
-    return Register(tmp_path)
-
-
-# ------------------------------------------- #120 item 1: the two rewrites
-
-def retire_repo_x_3(reg: Register) -> None:
-    reg.write("lanes/LANES.md", reg.read("lanes/LANES.md").replace(
-        "| more old words |", "| RETIRED · 2026-09-01T00:00:00Z · swept |"))
-    reg.publish("repoX-3 retired")
-
-
-#: The one act per rewrite: `set-row-state` ends in `replace_line`, and
-#: `archive-rows --yes` in `delete_lines`.
-ACTS = {
-    "replace_line": ("set-row-state", "repoX-2", "PAUSED · cut short"),
-    "delete_lines": ("archive-rows", "repoX", "--yes"),
-}
-CUTS = ["copy fails", "copy says done", "write fails", "write says done",
-        "write and restore fail"]
-
-
-@PROC_FD
-@pytest.mark.parametrize("cut", CUTS)
-@pytest.mark.parametrize("act", sorted(ACTS))
-def test_120_item_1_a_rewrite_cut_short_leaves_the_register_whole(reg, act, cut):
-    """#120 item 1: `cat -- <out> > LANES.md` had its status read, but not
-    its result, and `>` truncates before `cat` writes. A write that failed
-    part-way left a HALF register behind a refusal that called it UNCHANGED;
-    one that was short and said nothing was a half register committed (exit
-    0). And the COPY every proof is made against was read with no status at
-    all, so a short copy made a short register look like a one-line edit of
-    itself: rewritten, committed and pushed. Each refuses (5) now, and the
-    register on disk and on origin is byte for byte what it was — or, where
-    the bytes could not be put back either, the refusal says the register MAY
-    NOW BE TRUNCATED, keeps the exact copy it was made from and names where,
-    and nothing is committed (the review of #263, NIT 6). The copy is kept in
-    the checkout's own git directory, mode 0600, under a name of its own, where
-    a restart that empties the temporary directory leaves it (the delta
-    review's NIT). The copy refusal says THIS ACT has committed nothing and
-    names what the act had already written here, never "Nothing was written"
-    (S2)."""
-    if act == "delete_lines":
-        retire_repo_x_3(reg)
-    register = reg.read("lanes/LANES.md")
-    before = reg.head()
-    reg.cut_cat(cut)
-    result = reg.run(*ACTS[act], LANES_LANE="repoX-1")
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    assert reg.head() == before
-    assert reg.published("lanes/LANES.md") == register
-    if cut == "write and restore fail":
-        assert "IT MAY NOW BE TRUNCATED" in result.stderr
-        assert "UNCHANGED" not in result.stderr
-        found = re.search(r"are kept in (\S+) \(", result.stderr)
-        assert found, result.stderr
-        kept = Path(found.group(1))
-        assert kept.read_text(encoding="utf-8") == register
-        assert kept.parent.resolve() == Path(reg.git("rev-parse", "--absolute-git-dir").strip()).resolve()
-        assert re.fullmatch(r"lanes-edit-register-before-edit\.\d{8}T\d{6}Z\.\d+", kept.name), kept.name
-        assert stat.S_IMODE(kept.stat().st_mode) == 0o600
-        return
-    assert reg.read("lanes/LANES.md") == register
-    if cut.startswith("copy"):
-        assert "could not be copied whole" in result.stderr
-        assert "this act has committed nothing" in result.stderr
-        assert "Nothing was written" not in result.stderr
-        if act == "delete_lines":
-            assert "NOT committed: lanes/archive/LANES-retired.md (created)" in result.stderr
-    else:
-        assert "have been put back and proved" in result.stderr
-        assert "UNCHANGED" not in result.stderr
-
-
-@PROC_FD
-def test_120_item_1_a_refusal_after_a_captured_peer_edit_says_this_act_committed_nothing(reg):
-    """The delta review of #263: a peer's uncommitted register edit found
-    before the act is captured as a commit of its own (`handle_preexisting`),
-    so a refusal after it that said "nothing has been committed" was false. It
-    says what holds: this act has committed nothing."""
-    before = reg.head()
-    reg.write("lanes/LANES.md", reg.read("lanes/LANES.md").replace(
-        "another repository's row 30 |", "another repository's row 30, edited by a peer |"))
-    edited = reg.read("lanes/LANES.md")
-    reg.cut_cat("copy fails")
-    result = reg.run(*ACTS["replace_line"], LANES_LANE="repoX-1")
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    assert "captured pre-existing edit" in result.stderr
-    assert reg.git("log", "--format=%s", f"{before}..HEAD").startswith("LANES(pre-existing@")
-    assert reg.git("rev-list", "--count", f"{before}..HEAD").strip() == "1"
-    assert "this act has committed nothing" in result.stderr
-    assert "nothing has been committed" not in result.stderr
-    assert reg.read("lanes/LANES.md") == edited
-
-
-@UNPRIVILEGED_ONLY
-@pytest.mark.parametrize("act", sorted(ACTS))
-def test_120_item_1_a_write_that_never_reached_the_register_says_it_is_as_it_was(reg, act):
-    """The review of #263, NIT 3 (its X4): a register the write could not even
-    open is byte for byte what it was, and the refusal says so in words of its
-    own, apart from the put-back's and the truncation's. archive-rows has
-    appended the archive by then, and the refusal names it (S2)."""
-    if act == "delete_lines":
-        retire_repo_x_3(reg)
-    register = reg.read("lanes/LANES.md")
-    before = reg.head()
-    path = reg.wip / "lanes/LANES.md"
-    path.chmod(0o444)
-    try:
-        result = reg.run(*ACTS[act], LANES_LANE="repoX-1")
-    finally:
-        path.chmod(0o644)
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    assert "the write did not reach it, and it is byte for byte as it was before this edit" in result.stderr
-    assert "put back" not in result.stderr
-    assert "MAY NOW BE TRUNCATED" not in result.stderr
-    assert reg.read("lanes/LANES.md") == register
-    assert reg.head() == before
-    assert reg.published("lanes/LANES.md") == register
-    if act == "delete_lines":
-        assert "NOT committed: lanes/archive/LANES-retired.md (created)" in result.stderr
-
-
-@PROC_FD
-def test_120_item_1_a_sweep_refused_part_way_names_what_it_wrote_and_is_not_called_closed(reg):
-    """The review of #263, S2: retire-rows appends a lane's RETIRED line before
-    it rewrites the row, so a copy refusal that said "Nothing was written" left
-    `?? lanes/log/repoX-2.md` behind it. And a re-run then read that
-    uncommitted line and called the lane "already CLOSED … nothing more is
-    owed", about a row never retired and a line never published. The refusal
-    names the log, and the re-run refuses the line as this checkout's alone."""
-    reg.cut_cat("copy fails")
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    assert "this act has committed nothing" in result.stderr
-    assert "NOT committed: lanes/log/repoX-2.md (its RETIRED line)" in result.stderr
-    assert "Nothing was written" not in result.stderr
-    (reg.fakebin / "cat").unlink()
-    rerun = reg.sweep("repoX-2")
-    assert rerun.returncode == 2, (rerun.stdout, rerun.stderr)
-    assert "in THIS CHECKOUT ends on a RETIRED line, and origin/main's copy does not" in rerun.stderr
-    assert "already CLOSED" not in rerun.stderr
-    assert "`repoX-2`" in reg.published("lanes/LANES.md")
-    assert "RETIRED" not in reg.published("lanes/LANES.md").split("`repoX-2`")[1].splitlines()[0]
-
-
-# ------------------------------- #120 item 2: the sweep's published-path scan
-
-def case_sensitive(path: Path) -> bool:
-    probe = path / "case-probe"
-    probe.write_text("")
-    try:
-        return not (path / "CASE-PROBE").exists()
-    finally:
-        probe.unlink()
-
-
-def test_120_item_2_a_rename_whose_commit_never_landed_refuses_in_the_scan(reg):
-    """#120 item 2: the sweep's preflight asked whether origin publishes the
-    log under another case only where this checkout had NO log, and compared a
-    basename with a path besides. So the state a case-only rename leaves when
-    its commit is not pushed — the row's spelling here, committed; the old
-    spelling still on origin; a checkout merely AHEAD — passed the scan, and
-    `ensure_log` refused it inside the write loop, after the lane before it had
-    had its log created and appended. The scan refuses it now, with
-    `ensure_log`'s own words, and nothing is written."""
-    if not case_sensitive(reg.tmp):
-        pytest.skip("two log names that differ only by case need a case-sensitive filesystem")
-    reg.write("lanes/log/repox-3.md", log_text("repox-3", lane_line(
-        "NOTED", "repoX-3", OLD_ID, "2026-09-13T00:00:00Z") + " — migrated; history kept here"))
-    reg.publish("repoX-3's log, under the spelling it had before Amendment 15")
-    reg.git("mv", "lanes/log/repox-3.md", "lanes/log/repoX-3.md")
-    reg.git("commit", "-q", "-m", "repoX-3's log takes the row's spelling (not pushed)")
-    before = reg.head()
-    result = reg.sweep("repoX-2", "repoX-3")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "published as lanes/log/repox-3.md" in result.stderr
-    assert "a case-only rename whose commit never landed" in result.stderr
-    assert reg.head() == before
-    assert not (reg.wip / "lanes/log/repoX-2.md").exists()
-    assert reg.dirty() == ""
-
-
-# ------------------------------- #120 item 3: a log that already closes the lane
-
-@pytest.mark.parametrize("last", ["ENDED", "RETIRED"])
-def test_120_item_3_a_lane_whose_log_closes_it_is_told_it_is_closed(reg, last):
-    """#120 item 3: the refusal for a lane whose log's LAST lane-kind line is
-    ENDED or RETIRED read the same as the one for a running lane, and named no
-    way out. It says the lane is already CLOSED and hidden (19(b)) — never
-    `lane-end`, which is not the exit for a lane that has ended. For RETIRED it
-    names `archive-rows <repo>` (19(d)) exactly; for ENDED it says archive-rows
-    is not the row's exit, and never that the lane "is not retired a second
-    time" (the review of #263, NITs 3 and 5)."""
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", lane_line("STARTED", "repoX-2", OLD_ID, "2026-09-11T00:00:00Z"),
-        lane_line(last, "repoX-2", OLD_ID, "2026-09-11T02:00:00Z")))
-    reg.publish(f"repoX-2 started and {last.lower()}")
-    before = reg.head()
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert f"{last} line" in result.stderr
-    assert "already CLOSED" in result.stderr
-    assert "lane-end" not in result.stderr
-    if last == "RETIRED":
-        assert "`lanes-edit.sh archive-rows repoX`" in result.stderr
-    else:
-        assert "`archive-rows` is not its exit" in result.stderr
-        assert "lanes-edit.sh archive-rows" not in result.stderr
-        assert "retired a second time" not in result.stderr
-    assert reg.head() == before
-
-
-@pytest.mark.parametrize("last", ["ENDED", "RETIRED"])
-def test_120_item_3_a_closing_line_only_this_checkout_has_is_not_called_closed(reg, last):
-    """The review of #263, S2, from a commit rather than a cut sweep: a closing
-    line committed here and never pushed is refused as this checkout's alone,
-    never called CLOSED, and with its article right: "an ENDED line" (the
-    delta review's NIT)."""
-    started = lane_line("STARTED", "repoX-2", OLD_ID, "2026-09-11T00:00:00Z")
-    reg.write("lanes/log/repoX-2.md", log_text("repoX-2", started))
-    reg.publish("repoX-2 started")
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", started, lane_line(last, "repoX-2", OLD_ID, "2026-09-12T00:00:00Z")))
-    reg.commit(f"repoX-2 {last.lower()}, not pushed")
-    before = reg.head()
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    article = "an" if last == "ENDED" else "a"
-    assert (f"in THIS CHECKOUT ends on {article} {last} line, and origin/main's copy does not"
-            in result.stderr)
-    assert "already CLOSED" not in result.stderr
-    assert reg.head() == before
-
-
-def test_120_item_3_a_lane_whose_log_says_it_is_parked_is_sent_to_lane_end(reg):
-    """…and the other branch: a log whose last lane-kind line is STARTED,
-    PAUSED or RESUMED is a lane a person can still pick up, so the refusal
-    sends it to `lane-end <lane>` and not to the archive."""
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", lane_line("STARTED", "repoX-2", OLD_ID, "2026-09-11T00:00:00Z"),
-        lane_line("PAUSED", "repoX-2", OLD_ID, "2026-09-11T01:00:00Z")))
-    reg.publish("repoX-2 is parked")
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "carries a PAUSED line" in result.stderr
-    assert "lane-end repoX-2" in result.stderr
-    assert "archive-rows" not in result.stderr
-
-
-# --------------------------------------------- #122: add-row's archive scan
-
-RETIRED_CELL = "RETIRED · 2026-08-02T00:00:00Z · moved"
-#: Three ways a hand edit or a bad merge leaves a row of repoX-4 that the scan
-#: cannot take apart, each with what it does to the first cell.
-MANGLED = {
-    "the lane lost its backticks": f"| repoX-4 | harness `{OLD_ID}` | Eagle / test / brett | 2026-08-01 | none | none | {RETIRED_CELL} |",
-    "no backtick at all": f"| repoX-4 | harness {OLD_ID} | Eagle / test / brett | 2026-08-01 | none | none | {RETIRED_CELL} |",
-    "one backtick lost": f"| `repoX-4 | harness {OLD_ID} | Eagle / test / brett | 2026-08-01 | none | none | {RETIRED_CELL} |",
-}
-
-
-#: The row `add_repo_x_4` adds, with its newline: a peer that publishes it
-#: first publishes the very line add-row appends.
-NEW_ROW = row("repoX-4", NEW_ID, "new here", "2026-10-19")
-ARCHIVE = "lanes/archive/LANES-retired.md"
-
-
-def add_repo_x_4(reg: Register) -> subprocess.CompletedProcess:
-    return reg.run("add-row", NEW_ROW.rstrip("\n"), LANES_LANE="repoX-4")
-
-
-def peer_pushes_during_pull(reg: Register, tmp_path: Path, changes: dict[str, str], *,
-                            diff_log: Path | None = None, diff_context: int | None = None,
-                            extra_shell: str = "") -> Path:
-    """The shell suite's `repo19race` shape. A peer clone commits `changes`
-    (a path and its whole new text each, one commit each, in order) now, and a
-    `git` first on PATH pushes them the moment the writer's own checkout runs
-    its first `pull`: after add-row has committed its row, before it pushes.
-    Returns the mark the shim leaves; the caller removes the shim.
-
-    The same shim sees add-row's take-back diff (the register's `-U0` diff
-    against origin's). `diff_log` records how each was called, the
-    `GIT_DIFF_OPTS` it saw and its arguments; `diff_context` runs it with that
-    much context instead, as any source of context the take-back cannot turn
-    off would. `extra_shell` runs in the shim before it hands each call to the
-    real `git`, with `@MARK@` standing for the mark's path."""
-    peer = tmp_path / "peer"
-    reg.raw_git("clone", "-q", str(reg.origin), str(peer))
-    for rel, text in changes.items():
-        (peer / rel).parent.mkdir(parents=True, exist_ok=True)
-        (peer / rel).write_text(text, encoding="utf-8")
-        reg.raw_git("-C", str(peer), "add", "--", rel)
-        reg.raw_git("-C", str(peer), "commit", "-q", "-m", f"peer: {rel}")
-    real = shutil.which("git", path=os.environ.get("PATH"))
-    mark = tmp_path / "raced"
-    shim = reg.fakebin / "git"
-    take_back = ""
-    if diff_log is not None:
-        take_back += f"""  printf '%s\\t%s\\n' "${{GIT_DIFF_OPTS-<unset>}}" "$*" >> '{diff_log}'\n"""
-    if diff_context is not None:
-        take_back += (f'  a=(); for x in "$@"; do if [ "$x" = -U0 ]; then a+=(-U{diff_context}); '
-                      'else a+=("$x"); fi; done; set -- "${a[@]}"\n')
-    if take_back:
-        take_back = ('case " $* " in *" -U0 refs/remotes/origin/main -- "*)\n'
-                     + take_back + "  ;;\nesac\n")
-    if extra_shell:
-        take_back += extra_shell.replace("@MARK@", str(mark)) + "\n"
-    shim.write_text(f"""#!/usr/bin/env bash
-if [ "${{1-}}" = -C ] && [ "${{3-}}" = pull ] && [ ! -e '{mark}' ]; then
-  case "${{2-}}" in */wip)
-    : > '{mark}'
-    '{real}' -C '{peer}' push -q origin main || exit 1 ;;
-  esac
-fi
-{take_back}exec '{real}' "$@"
-""")
-    shim.chmod(0o755)
-    return mark
-
-
-def a_good_archive(reg: Register) -> str:
-    reg.write(ARCHIVE, ARCHIVE_HEAD + row("repoX-9", OLD_ID, RETIRED_CELL, "2026-08-01"))
-    reg.publish("a good archive")
-    return reg.read(ARCHIVE)
-
-
-@pytest.mark.parametrize("where", ["published", "committed here, not pushed"])
-@pytest.mark.parametrize("mangle", sorted(MANGLED))
-def test_122_an_archive_row_the_scan_cannot_take_apart_reissues_no_position(reg, mangle, where):
-    """#122: the scan skipped any archive table line with no backticked lane
-    token — and read a first backtick in ANOTHER cell as the lane — so a
-    retired row whose lane cell a hand edit had mangled disappeared from the
-    answer, and add-row reissued its position (exit 0). Such a line is refused
-    by its line number and its copy now (1), in add-row's own words. The
-    archive's own header and its rule are `|` lines with no backtick on every
-    archive `archive_rows` writes, and they are not named."""
-    mangled = MANGLED[mangle]
-    reg.write("lanes/archive/LANES-retired.md", ARCHIVE_HEAD
-              + row("repoX-9", OLD_ID, RETIRED_CELL, "2026-08-01") + mangled + "\n")
-    if where == "published":
-        reg.publish("the archive, with a hand-mangled row 10")
-    else:
-        reg.commit("the archive, with a hand-mangled row 10 (not pushed)")
-    before = reg.head()
-    result = add_repo_x_4(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    copies = "origin/main and this checkout" if where == "published" else "this checkout"
-    assert f"line 10 ({copies}): {mangled}" in result.stderr
-    assert "carries a line this scan cannot take apart (above)" in result.stderr
-    assert "line 7 (" not in result.stderr
-    assert "line 8 (" not in result.stderr
-    assert reg.head() == before
-    assert "`repoX-4`" not in reg.published("lanes/LANES.md")
-
-
-def test_122_an_archive_scan_that_failed_is_not_an_archive_with_no_match(reg):
-    """#122, the `|| :` half: the scan's status was the `sort -u` behind it,
-    so an awk that FAILED read as "no archived row matched" and the archived
-    repoX-4 was added again (exit 0). It is a refusal (1) now."""
-    reg.write("lanes/archive/LANES-retired.md", ARCHIVE_HEAD
-              + row("repoX-4", OLD_ID, RETIRED_CELL, "2026-08-01"))
-    reg.publish("the archive holds repoX-4")
-    reg.shim("awk", 'case "$*" in *"function key("*) echo "test shim: awk refused" >&2; exit 2 ;; esac')
-    before = reg.head()
-    result = add_repo_x_4(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert reg.head() == before
-    assert "`repoX-4`" not in reg.published("lanes/LANES.md")
-
-
-def test_122_a_line_number_says_which_copy_it_is_in(reg):
-    """The review of #263, NIT 4: with the published archive and this
-    checkout's apart, one bad line was listed as "line 10" and "line 12" with
-    no word on which file either number belongs to."""
-    mangled = MANGLED["the lane lost its backticks"]
-    reg.write("lanes/archive/LANES-retired.md", ARCHIVE_HEAD
-              + row("repoX-9", OLD_ID, RETIRED_CELL, "2026-08-01") + mangled + "\n")
-    reg.publish("the archive, with a hand-mangled row 10")
-    reg.write("lanes/archive/LANES-retired.md", ARCHIVE_HEAD
-              + row("repoX-7", OLD_ID, RETIRED_CELL, "2026-08-01")
-              + row("repoX-8", OLD_ID, RETIRED_CELL, "2026-08-01")
-              + row("repoX-9", OLD_ID, RETIRED_CELL, "2026-08-01") + mangled + "\n")
-    reg.commit("two more rows above it, not pushed")
-    result = add_repo_x_4(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert f"line 10 (origin/main): {mangled}" in result.stderr
-    assert f"line 12 (this checkout): {mangled}" in result.stderr
-
-
-def test_122_a_refusal_after_the_rebase_takes_its_row_back(reg, tmp_path):
-    """The review of #263, M1, the shell suite's `repo19race` shape: a peer
-    publishes an archive line this scan cannot take apart while add-row is in
-    its `pull --rebase`. The after-rebase rescan refused (1), but only the
-    retired-match branch took the committed row back, so the next unrelated
-    write from this checkout published the row add-row had refused. Every
-    refusal there now removes it in a compensating local commit."""
-    archive = a_good_archive(reg)
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        ARCHIVE: archive + MANGLED["the lane lost its backticks"] + "\n"})
-    result = add_repo_x_4(reg)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "removed in a compensating LOCAL commit" in result.stderr
-    assert "`repoX-4`" not in reg.read("lanes/LANES.md")
-    assert "`repoX-4`" not in reg.git("diff", "origin/main", "HEAD", "--", "lanes/LANES.md")
-    assert "`repoX-4`" not in reg.published("lanes/LANES.md")
-    after = reg.run("set-row-state", "repoX-2", "PAUSED · the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert "PAUSED · " in reg.published("lanes/LANES.md").split("`repoX-2`")[1].splitlines()[0]
-    assert "`repoX-4`" not in reg.published("lanes/LANES.md")
-
-
-#: What the rescan after the rebase refuses, each with add-row's exit: a peer's
-#: archive line it cannot take apart (another lane's), or a peer's retirement
-#: of repoX-4 itself.
-RESCAN_REFUSALS = {
-    "a line the scan cannot take apart": (
-        MANGLED["the lane lost its backticks"].replace("repoX-4", "repoQ-7") + "\n", 1),
-    "a retirement": (row("repoX-4", OLD_ID, RETIRED_CELL, "2026-08-01"), 2),
-}
-
-
-@pytest.mark.parametrize("why", sorted(RESCAN_REFUSALS))
-def test_122_a_refusal_after_the_rebase_leaves_a_peers_identical_row_alone(reg, tmp_path, why):
-    """The delta review of #263, D1: a peer publishes the byte-identical
-    repoX-4 row while add-row is in its `pull --rebase`, so the rebase drops
-    add-row's commit as already upstream and the one copy left is the PEER's.
-    The take-back found it by its exact text and deleted it in a local commit,
-    and the next write published that deletion: the peer's row gone from
-    origin. Only a copy this checkout adds over origin's is taken back now, so
-    here none is, for either refusal of the rescan."""
-    archive = a_good_archive(reg)
-    refusal, code = RESCAN_REFUSALS[why]
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        "lanes/LANES.md": reg.read("lanes/LANES.md") + NEW_ROW, ARCHIVE: archive + refusal})
-    result = add_repo_x_4(reg)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == code, (result.stdout, result.stderr)
-    ahead = reg.git("log", "--oneline", "origin/main..HEAD")
-    diff = reg.git("diff", "origin/main", "HEAD")
-    after = reg.run("set-row-state", "repoX-2", "PAUSED · the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert reg.published("lanes/LANES.md").count("`repoX-4`") == 1, (ahead, result.stderr)
-    assert ahead == "" and diff == ""
-    assert "origin/main already carries this exact row" in result.stderr
-    assert "compensating LOCAL commit" not in result.stderr
-
-
-def test_122_a_refusal_after_the_rebase_takes_back_its_own_row_beside_a_peers_copy(reg, tmp_path):
-    """…and the other direction. Where the peer put the identical row in
-    another place, the rebase KEEPS add-row's commit and the register holds
-    two copies. The one this checkout adds is taken back: not the peer's, and
-    not neither. "origin already has the row" would have kept add-row's
-    commit, and the next write would have published a second copy."""
-    archive = a_good_archive(reg)
-    seeded = row("repoX-3", OLD_ID, "more old words")
-    peer_register = reg.read("lanes/LANES.md").replace(seeded, seeded + NEW_ROW)
-    assert peer_register != reg.read("lanes/LANES.md")
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        "lanes/LANES.md": peer_register,
-        ARCHIVE: archive + RESCAN_REFUSALS["a line the scan cannot take apart"][0]})
-    result = add_repo_x_4(reg)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    register = reg.read("lanes/LANES.md")
-    diff = reg.git("diff", "origin/main", "HEAD", "--", "lanes/LANES.md")
-    after = reg.run("set-row-state", "repoX-2", "PAUSED · the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert reg.published("lanes/LANES.md").count("`repoX-4`") == 1, result.stderr
-    assert register == peer_register
-    assert diff == ""
-    assert "removed in a compensating LOCAL commit" in result.stderr
-
-
-#: The ways the take-back cannot remove its row once it has found it: its copy
-#: of the register cut short, its write cut short (put back), the pass that
-#: removes the line refused, a pass that dropped a line too many, and a
-#: `numstat` proof that reads the copies as binary (an attribute on every
-#: path, which no `core.bigFileThreshold` changes).
-TAKE_BACK_CUTS = [pytest.param("copy", marks=PROC_FD), pytest.param("write", marks=PROC_FD),
-                  "awk pass", "line count", "numstat"]
-
-
-@pytest.mark.parametrize("cut", TAKE_BACK_CUTS)
-def test_122_a_take_back_that_cannot_rewrite_says_add_row_has_committed(reg, tmp_path, cut):
-    """The delta review of #263, on the wording: where the take-back itself
-    cannot rewrite the register, add-row HAS committed its row (locally, not
-    pushed), and the refusal says so and how to remove it, never that this
-    act has committed nothing. And in add-row's own words (delta review 3's
-    NIT): `delete_lines`' sentences are archive-rows' ("the rows are in" the
-    archive, "the archive may have been appended"), and false here. And on
-    every refusal `delete_lines` makes after its copy (delta review 4, N1 and
-    S4's N2): the pass, the line count and `numstat` named no row and no
-    commit, so "the removal added or rewrote lines" was all add-row said."""
-    archive = a_good_archive(reg)
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        ARCHIVE: archive + RESCAN_REFUSALS["a line the scan cannot take apart"][0]})
-    real_awk = shutil.which("awk", path=os.environ.get("PATH"))
-    if cut == "awk pass":
-        reg.shim("awk", 'case "$*" in *LANES_DROP_LINES*) echo "test shim: the removal pass refused" >&2; exit 2 ;; esac')
-    elif cut == "line count":
-        reg.shim("awk", f'case "$*" in *LANES_DROP_LINES*) "{real_awk}" "$@" | sed 1d; exit 0 ;; esac')
-    elif cut == "numstat":
-        (reg.home / "attributes").write_text("* -diff\n", encoding="utf-8")
-        (reg.home / ".gitconfig").write_text(f"[core]\n\tattributesFile = {reg.home / 'attributes'}\n",
-                                             encoding="utf-8")
-    elif cut == "copy":
-        copies = tmp_path / "copies"
-        # The register's SECOND copy into a `pre` is cut: add-row's own append
-        # makes the first, the take-back's `delete_lines` the second.
-        reg.shim("cat", 'if [ "${1-}" = -- ] && case "${2-}" in */lanes/LANES.md) true ;; *) false ;; esac && '
-                        'case "$(readlink "/proc/$$/fd/1" 2>/dev/null)" in */pre) true ;; *) false ;; esac; then\n'
-                        f"  echo copy >> '{copies}'\n"
-                        f"  if [ \"$(grep -c . '{copies}')\" -ge 2 ]; then n=$(wc -l < \"$2\"); head -n $((n / 2)) -- \"$2\"; exit 1; fi\n"
-                        "fi")
-    else:
-        # The take-back's rewrite is the one write from an `out` add-row makes.
-        reg.cut_cat("write fails")
-    result = add_repo_x_4(reg)
-    for shim in ("git", "cat", "awk"):
-        if (reg.fakebin / shim).exists():
-            (reg.fakebin / shim).unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    if cut == "write":
-        assert "have been put back and proved" in result.stderr
-        assert "Its row for lane repoX-4 was not taken back, and this act HAS committed it" in result.stderr
-    else:
-        assert ("The register is as it was and this act HAS committed its row for lane repoX-4, locally and "
-                "unpushed: no row was removed, so that row is still in it and in that commit.") in result.stderr
-        assert {"copy": "could not be copied whole",
-                "awk pass": "the pass that removes 1 row(s)",
-                "line count": "removing 1 row(s) changed the line count by 2; refusing. The register",
-                "numstat": "the removal added or rewrote lines (numstat: -\t-); refusing. The register",
-                }[cut] in result.stderr
-    assert "from lanes/LANES.md and commit that before any other write in " in result.stderr
-    for archive_rows_words in ("the rows are in", "The archive may have been appended", "resolve that partial move"):
-        assert archive_rows_words not in result.stderr
-    assert "this act has committed nothing" not in result.stderr
-    assert "add row" in reg.git("log", "--format=%s", "origin/main..HEAD")
-    assert "`repoX-4`" not in reg.published("lanes/LANES.md")
-
-
-#: What is set up before add-row runs (the delta review of #263, S3): each is a
-#: way context reaches the take-back's diff, or a hunk where the row is not the
-#: first line of it.
-CONTEXT_CASES = [
-    "GIT_DIFF_OPTS=-u3 in add-row's environment",
-    "diff.interHunkContext=3 beside an unpushed edit one row above the end",
-    "context the diff carries anyway, beside that edit",
-    "another lane's unpushed row just above",
-]
-
-
-@pytest.mark.parametrize("case", CONTEXT_CASES)
-def test_122_a_take_back_finds_its_row_whatever_context_the_diff_carries(reg, tmp_path, case):
-    """The delta review of #263, S3: `-U0` alone does not keep context out of
-    the take-back's diff. A `GIT_DIFF_OPTS=-u3` overrides it, and a user's
-    `diff.interHunkContext` fuses a nearby change's hunk with the row's, the
-    lines between them as context. The parse counted only `+` lines, so the
-    row was put at the wrong line, the line check refused, nothing was taken
-    back, and the next ordinary write published the row add-row had refused (M1
-    again). The diff now runs with neither, and the parse counts every line of
-    a hunk but a removed one, so context that arrives anyway (a shim, here) is
-    counted where it stands, and so is a second added row in the same hunk."""
-    archive = a_good_archive(reg)
-    extra = {"LANES_LANE": "repoX-4"}
-    diff_log = tmp_path / "take-back-diff"
-    context = None
-    if case.startswith("GIT_DIFF_OPTS"):
-        extra["GIT_DIFF_OPTS"] = "-u3"
-    elif case.startswith("another lane"):
-        reg.write("lanes/LANES.md", reg.read("lanes/LANES.md")
-                  + row("repoX-5", OLD_ID, "another lane's row, not pushed", "2026-10-19"))
-        reg.commit("another lane's row, not pushed")
-    else:
-        if case.startswith("diff.interHunkContext"):
-            (reg.home / ".gitconfig").write_text("[diff]\n\tinterHunkContext = 3\n", encoding="utf-8")
-        else:
-            context = 3
-        reg.write("lanes/LANES.md", reg.read("lanes/LANES.md").replace(
-            "another repository's row 29 |", "another repository's row 29, edited here |"))
-        reg.commit("an edit one row above the end, not pushed")
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        ARCHIVE: archive + RESCAN_REFUSALS["a line the scan cannot take apart"][0]},
-        diff_log=diff_log, diff_context=context)
-    result = reg.run("add-row", NEW_ROW.rstrip("\n"), **extra)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    after = reg.run("set-row-state", "repoX-2", "PAUSED · the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert reg.published("lanes/LANES.md").count("`repoX-4`") == 0, result.stderr
-    assert "removed in a compensating LOCAL commit" in result.stderr
-    # How the one take-back diff was asked for: with no GIT_DIFF_OPTS and no
-    # inter-hunk context, whatever add-row's environment and config held.
-    calls = diff_log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 1, calls
-    seen_opts, args = calls[0].split("\t", 1)
-    assert seen_opts == "<unset>", calls
-    assert " -c diff.interHunkContext=0 diff " in f" {args} ", calls
-
-
-#: The ways git classes the register as binary (delta review 4 of #263, S4),
-#: each set up before add-row runs.
-BINARY_CASES = [
-    "`lanes/LANES.md -diff` in .git/info/attributes",
-    "a published .gitattributes marking it binary",
-    "core.bigFileThreshold below the register's size",
-]
-
-
-@pytest.mark.parametrize("case", BINARY_CASES)
-def test_122_a_take_back_reads_its_diff_as_text_whatever_classes_the_register_binary(reg, tmp_path, case):
-    """Delta review 4 of #263, S4: where git classes the register as binary,
-    the take-back's diff is the one line "Binary files … differ", with no hunk
-    to read. add-row said this checkout added no copy of the row, kept its
-    commit, and the next write published the row add-row had refused (M1
-    again). The diff is now read as text, and under a `core.bigFileThreshold`
-    the removal's `numstat` proof counts lines as well, so each takes its row
-    back. The next write is an `append-line`: a `set-row-state` refuses under
-    such a threshold on its own `numstat` proof, as it does on main."""
-    archive = a_good_archive(reg)
-    if case.startswith("`lanes/LANES.md -diff`"):
-        (reg.wip / ".git" / "info").mkdir(parents=True, exist_ok=True)
-        (reg.wip / ".git" / "info" / "attributes").write_text("lanes/LANES.md -diff\n", encoding="utf-8")
-    elif case.startswith("a published .gitattributes"):
-        reg.write(".gitattributes", "lanes/LANES.md binary\n")
-        reg.publish("every clone reads the register as binary")
-    else:
-        (reg.home / ".gitconfig").write_text("[core]\n\tbigFileThreshold = 200\n", encoding="utf-8")
-        assert (reg.wip / "lanes/LANES.md").stat().st_size > 200
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        ARCHIVE: archive + RESCAN_REFUSALS["a line the scan cannot take apart"][0]})
-    result = add_repo_x_4(reg)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    after = reg.run("append-line", "a plain line, the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert reg.published("lanes/LANES.md").count("`repoX-4`") == 0, result.stderr
-    assert "removed in a compensating LOCAL commit" in result.stderr
-
-
-#: Where the take-back's removal is written but cannot be committed (delta
-#: review 4 of #263, N3), each with what `git status` then shows.
-COMPENSATION_FAILS = {
-    "staging": ('if [ -e \'@MARK@\' ]; then case " $* " in *" add -- lanes/LANES.md "*)\n'
-                '  echo "test shim: add refused" >&2; exit 1 ;; esac; fi', " M lanes/LANES.md",
-                "but staging that removal failed, so it is only in the working tree, and add-row's "
-                "commit still holds the row."),
-    "commit": ('case " $* " in *" commit "*"cancel add-row"*)\n'
-               '  echo "test shim: commit refused" >&2; exit 1 ;; esac', "M  lanes/LANES.md",
-               "and that removal is staged, but its compensating commit failed, so add-row's commit "
-               "still holds the row."),
-}
-
-
-@pytest.mark.parametrize("step", sorted(COMPENSATION_FAILS))
-def test_122_a_removal_that_cannot_be_committed_says_so(reg, tmp_path, step):
-    """Delta review 4 of #263, N3: where the take-back's `git add` or `git
-    commit` failed, add-row returned with nothing of its own said. The removal
-    was left in the working tree or staged under add-row's commit, and the next
-    write's commit carried it under that write's caption. It now says what is
-    staged, that add-row's commit still holds the row, and the command that
-    commits the removal, which is run here: then the next write publishes no
-    repoX-4, and origin's history has the removal under its own caption."""
-    archive = a_good_archive(reg)
-    shell, status, said = COMPENSATION_FAILS[step]
-    mark = peer_pushes_during_pull(reg, tmp_path, {
-        ARCHIVE: archive + RESCAN_REFUSALS["a line the scan cannot take apart"][0]}, extra_shell=shell)
-    result = add_repo_x_4(reg)
-    (reg.fakebin / "git").unlink()
-    assert mark.exists(), "the peer never raced the pull"
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert reg.dirty().splitlines() == [status]
-    assert "add row" in reg.git("log", "--format=%s", "origin/main..HEAD")
-    assert said in result.stderr
-    caption = "LANES(repoX-4@Eagle): cancel add-row whose retirement could not be checked after rebase"
-    fix = re.search(r"Commit the removal before any other write in (\S+), so that write does not carry it "
-                    r"under its own caption: `(git -C (\S+) commit -m '([^']+)' -- lanes/LANES\.md)`", result.stderr)
-    assert fix, result.stderr
-    assert fix.group(1) == fix.group(3) and os.path.samefile(fix.group(1), reg.wip), fix.group(0)
-    assert fix.group(4) == caption, fix.group(0)
-    done = subprocess.run(["bash", "-c", fix.group(2)], env=reg.env, text=True, capture_output=True, check=False)
-    assert done.returncode == 0, (done.stdout, done.stderr)
-    after = reg.run("set-row-state", "repoX-2", "PAUSED · the next unrelated write", LANES_LANE="repoX-1")
-    assert after.returncode == 0, (after.stdout, after.stderr)
-    assert reg.published("lanes/LANES.md").count("`repoX-4`") == 0
-    assert caption in reg.raw_git("-C", str(reg.origin), "log", "--format=%s", "main")
diff --git a/tests/test_register_scan_hardening_138.py b/tests/test_register_scan_hardening_138.py
deleted file mode 100644
index d145aab9..00000000
--- a/tests/test_register_scan_hardening_138.py
+++ /dev/null
@@ -1,605 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The register sweeps and their reads fail closed: opensoft/openRepoTools#138
-(the `lanes-edit.sh` items) and #157 item 4b.
-
-Each case builds a throwaway register — a bare repository and a clone of it in
-a temporary directory, with a temporary `$HOME` — and runs the real
-`lanes-edit.sh` against it. A read that has to FAIL is made to fail by a `git`
-on `PATH` that refuses one exact argument and hands every other call to the
-real one, or by a permission or a file type the case puts on disk. Nothing here
-reaches a network or the operator's own register.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="lanes-edit.sh is a bash command")]
-
-#: The sweeping lane's transcript, and the old one the dormant rows carry.
-WRITER_ID = "aaaa0138-0001-4000-8000-000000000001"
-OLD_ID = "bbbb0138-0002-4000-8000-000000000002"
-HEADER = ("| lane | session id | workstation / env / user | started (UTC) "
-          "| objects owned | handoff path | state |\n|---|---|---|---|---|---|---|\n")
-UNPRIVILEGED_ONLY = pytest.mark.skipif(
-    hasattr(os, "geteuid") and os.geteuid() == 0,
-    reason="a permission case needs an unprivileged runner")
-
-
-def row(lane: str, sid: str, state: str, started: str = "2026-08-27") -> str:
-    return (f"| `{lane}` | harness `{sid}` | Eagle / test / brett | {started} "
-            f"| none | none | {state} |\n")
-
-
-def log_text(lane: str, *lines: str) -> str:
-    head = f"# lane {lane} — object log (lane-collision-protocol Amendment 7)\n"
-    return head + "".join(line + "\n" for line in lines)
-
-
-def lane_line(verb: str, lane: str, sid: str, utc: str) -> str:
-    return f"{verb} — lane {lane}, session {sid}@Eagle, {utc}, lane:{lane}"
-
-
-class Register:
-    """One workspace repository: `origin` bare, `wip` its clone."""
-
-    def __init__(self, tmp: Path):
-        self.tmp = tmp
-        self.origin = tmp / "origin.git"
-        self.wip = tmp / "wip"
-        self.home = tmp / "home"
-        self.fakebin = tmp / "fakebin"
-        for d in (self.home / ".agents", self.home / ".claude" / "sessions",
-                  self.home / "projects", tmp / "tmp", self.fakebin):
-            d.mkdir(parents=True, exist_ok=True)
-        env = {k: v for k, v in os.environ.items()
-               if not k.startswith(("LANES_", "CLAUDE_", "TMUX"))}
-        env.update(HOME=str(self.home), TMPDIR=str(tmp / "tmp"),
-                   AGENT_PROTOCOL_ROOT=str(self.home / ".agents"),
-                   PROJECTS_ROOT=str(self.home / "projects"),
-                   LANES_WORKSPACE_ROOT=str(self.wip), LANES_WORKSTATION="Eagle",
-                   LANES_HOST="Eagle", LANES_CONTAINER="none", LANES_IN_CONTAINER="0",
-                   LANES_OS="linux", LANES_NO_GITHUB="1", LANES_INDEX="off",
-                   GIT_AUTHOR_NAME="register tests", GIT_AUTHOR_EMAIL="t@example.invalid",
-                   GIT_COMMITTER_NAME="register tests", GIT_COMMITTER_EMAIL="t@example.invalid",
-                   PATH=str(self.fakebin) + os.pathsep + os.environ.get("PATH", ""))
-        self.env = env
-        self.raw_git("init", "-q", "--bare", "-b", "main", str(self.origin))
-        self.raw_git("clone", "-q", str(self.origin), str(self.wip))
-        (self.wip / "lanes" / "log").mkdir(parents=True)
-        self.write("lanes/LANES.md", "# LANES.md\n\n" + HEADER
-                   + row("repoX-1", WRITER_ID, "PAUSED · 2026-09-11T00:00:00Z · the sweeper", "2026-09-11")
-                   + row("repoX-2", OLD_ID, "old words")
-                   + row("repoX-3", OLD_ID, "more old words"))
-        self.write("lanes/log/repoX-1.md", log_text(
-            "repoX-1", lane_line("STARTED", "repoX-1", WRITER_ID, "2026-09-11T00:00:00Z"),
-            lane_line("PAUSED", "repoX-1", WRITER_ID, "2026-09-11T01:00:00Z")))
-        self.publish("seed the register")
-
-    def raw_git(self, *args: str) -> str:
-        return subprocess.run(["git", *args], capture_output=True, text=True,
-                              check=True, env=self.env).stdout
-
-    def git(self, *args: str) -> str:
-        return self.raw_git("-C", str(self.wip), *args)
-
-    def write(self, rel: str, text: str) -> Path:
-        path = self.wip / rel
-        path.parent.mkdir(parents=True, exist_ok=True)
-        path.write_text(text, encoding="utf-8")
-        return path
-
-    def read(self, rel: str) -> str:
-        return (self.wip / rel).read_text(encoding="utf-8")
-
-    def commit(self, message: str) -> None:
-        self.git("add", "-A")
-        self.git("commit", "-q", "-m", message)
-
-    def publish(self, message: str) -> None:
-        self.commit(message)
-        self.git("push", "-q", "-u", "origin", "main")
-
-    def head(self) -> str:
-        return self.git("rev-parse", "HEAD").strip()
-
-    def dirty(self) -> str:
-        return self.git("status", "--porcelain")
-
-    def refuse_git(self, *needles: str) -> None:
-        """A `git` first on PATH that exits 128 when its arguments contain any
-        of `needles`, and runs the real one otherwise."""
-        real = shutil.which("git", path=os.environ.get("PATH"))
-        cases = "\n".join(f'  *"{n}"*) echo "test shim: git $* refused" >&2; exit 128 ;;'
-                          for n in needles)
-        shim = self.fakebin / "git"
-        shim.write_text(f'#!/usr/bin/env bash\ncase " $* " in\n{cases}\nesac\nexec "{real}" "$@"\n')
-        shim.chmod(0o755)
-
-    def live(self, sid: str) -> None:
-        """A session record this workstation reads as LIVE: this test's own pid."""
-        (self.home / ".claude" / "sessions" / f"{sid}.json").write_text(
-            f'{{"pid":{os.getpid()},"sessionId":"{sid}","cwd":"x","procStart":"",'
-            f'"tmux":"","name":"n","status":"idle"}}\n')
-
-    def run(self, *args: str, **extra: str) -> subprocess.CompletedProcess:
-        env = dict(self.env)
-        env.update(extra)
-        return subprocess.run(["bash", str(REPO / "lanes-edit.sh"), *args],
-                              cwd=str(self.wip), env=env, text=True,
-                              capture_output=True, timeout=120, check=False)
-
-    def sweep(self, *lanes: str, **extra: str) -> subprocess.CompletedProcess:
-        extra.setdefault("LANES_LANE", "repoX-1")
-        return self.run("retire-rows", *lanes, "--reason", "test sweep", **extra)
-
-
-@pytest.fixture
-def reg(tmp_path: Path) -> Register:
-    return Register(tmp_path)
-
-
-def peer_edit(reg: Register) -> str:
-    """A peer's uncommitted edit to the register, which a capture would commit."""
-    text = reg.read("lanes/LANES.md").replace("more old words", "a peer's half-written cell")
-    reg.write("lanes/LANES.md", text)
-    return text
-
-
-# ---------------------------------------------------------------- #157 item 4b
-
-@pytest.mark.parametrize("act", [
-    ("retire-rows", "repoX-2", "repoX-2", "--reason", "test sweep"),
-    ("archive-rows", "repoX", "--yes"),
-    ("migrate-state-cells", "--yes"),
-], ids=["retire-rows", "archive-rows", "migrate-state-cells"])
-def test_a_refusal_in_the_scan_commits_no_peer_edit(reg, act):
-    """#157 4b: each sweep captured a peer's register edit as its own commit
-    BEFORE its scan, so a refusal in the scan left HEAD moved. The refusal now
-    comes first, and the peer's edit is still uncommitted after it."""
-    edited = peer_edit(reg)
-    before = reg.head()
-    result = reg.run(*act, LANES_LANE="repoX-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "captured pre-existing edit" not in result.stderr
-    assert reg.head() == before
-    assert reg.read("lanes/LANES.md") == edited
-    assert reg.dirty().strip() == "M lanes/LANES.md"
-
-
-def test_a_sweep_that_writes_still_captures_the_peer_edit_as_its_own_commit(reg):
-    """The capture moved; it did not go: the peer's edit still lands in its own
-    `LANES(pre-existing@…)` commit and never inside the sweep's."""
-    peer_edit(reg)
-    before = reg.head()
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    subjects = reg.git("log", "--format=%s", f"{before}..HEAD").splitlines()
-    assert len(subjects) == 2, subjects
-    assert subjects[1].startswith("LANES(pre-existing@Eagle)")
-    assert "retire-dormant" in subjects[0]
-    swept = reg.git("show", "--format=", "-U0", "HEAD", "--", "lanes/LANES.md")
-    assert "a peer's half-written cell" not in swept
-
-
-# ------------------------------------------------- #138: retire_rows' scan
-
-def test_item_17_a_published_log_git_cannot_read_refuses_the_sweep(reg):
-    """#138 item 17: the probe was `cat-file -e`, which fails for an unreadable
-    blob exactly as for a missing path, so a log the tree names and git cannot
-    read was "no published log" and the row was retired. The tree answers now.
-    The local copy is out of the sparse checkout, so only origin speaks."""
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", lane_line("STARTED", "repoX-2", OLD_ID, "2026-09-11T00:00:00Z"),
-        lane_line("PAUSED", "repoX-2", OLD_ID, "2026-09-11T01:00:00Z")))
-    reg.publish("repoX-2 is parked")
-    reg.git("update-index", "--skip-worktree", "lanes/log/repoX-2.md")
-    (reg.wip / "lanes/log/repoX-2.md").unlink()
-    reg.refuse_git("origin/main:lanes/log/repoX-2.md")
-    before = reg.head()
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "exists on origin/main and could not be read" in result.stderr
-    assert reg.head() == before
-    assert not (reg.wip / "lanes/log/repoX-2.md").exists()
-
-
-@UNPRIVILEGED_ONLY
-def test_item_9_a_log_directory_that_cannot_be_listed_refuses_in_the_scan(reg):
-    """#138 item 9: `log_files_named_ci` was `ls 2>/dev/null | awk`, so an
-    unreadable log directory passed the scan as "no log" and the sweep failed
-    on it later, inside its write loop (exit 5). It refuses in the scan now."""
-    logs = reg.wip / "lanes" / "log"
-    before = reg.head()
-    logs.chmod(0)
-    try:
-        result = reg.sweep("repoX-2")
-    finally:
-        logs.chmod(0o755)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "exists and could not be listed" in result.stderr
-    assert reg.head() == before
-    assert reg.dirty() == ""
-
-
-def test_item_12_a_symlinked_log_path_refuses_and_writes_nothing_through_it(reg):
-    """#138 item 12: a tracked symlink at a lane's log path passed the scan, and
-    the sweep's `>>` put the RETIRED line in the file it named — outside the
-    repository — while the commit published only the link."""
-    outside = reg.tmp / "outside.md"
-    outside.write_text("# not the register's\n")
-    (reg.wip / "lanes/log/repoX-2.md").symlink_to(os.path.join("..", "..", "..", "outside.md"))
-    reg.publish("a link where a log belongs")
-    before = reg.head()
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "is a symlink" in result.stderr
-    assert outside.read_text() == "# not the register's\n"
-    assert reg.head() == before
-
-
-def test_item_8_the_retired_line_carries_the_writers_unpushed_newest_transcript(reg):
-    """#138 item 8: the writer's uuid came from the PUBLISHED row alone, so a
-    sweeping lane whose newest transcript is stamped in this checkout and not
-    yet pushed signed its append-only RETIRED lines with the older one."""
-    newest = "dddd0138-0004-4000-8000-000000000004"
-    text = reg.read("lanes/LANES.md").replace(
-        f"| harness `{WRITER_ID}` |", f"| harness `{WRITER_ID}` `{newest}` |")
-    reg.write("lanes/LANES.md", text)
-    reg.commit("repoX-1 resumed in a new transcript, not yet pushed")
-    result = reg.sweep("repoX-2")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    retired = [line for line in reg.read("lanes/log/repoX-2.md").splitlines()
-               if line.startswith("RETIRED")]
-    assert len(retired) == 1
-    assert f"session {newest}@Eagle" in retired[0]
-
-
-# ------------------------------------------------ #138: archive_rows' preflight
-
-def retire_repo_x_2(reg: Register) -> None:
-    text = reg.read("lanes/LANES.md").replace(
-        "| old words |", "| RETIRED · 2026-09-01T00:00:00Z · swept |")
-    reg.write("lanes/LANES.md", text)
-
-
-def test_item_10_a_symlinked_archive_refuses_and_the_row_stays_in_the_register(reg):
-    """#138 item 10: a tracked symlink at the archive path passed every check,
-    the rows were appended through it to a file outside the repository, and the
-    commit published their removal from the register: the rows left the
-    repository altogether."""
-    retire_repo_x_2(reg)
-    outside = reg.tmp / "outside.md"
-    outside.write_text("# not the archive\n")
-    (reg.wip / "lanes/archive").mkdir()
-    (reg.wip / "lanes/archive/LANES-retired.md").symlink_to(
-        os.path.join("..", "..", "..", "outside.md"))
-    reg.publish("repoX-2 retired, and a link where the archive belongs")
-    before = reg.head()
-    result = reg.run("archive-rows", "repoX", "--yes", LANES_LANE="repoX-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "is a symlink" in result.stderr
-    assert outside.read_text() == "# not the archive\n"
-    assert reg.head() == before
-    assert "`repoX-2`" in reg.git("show", "origin/main:lanes/LANES.md")
-
-
-def test_item_2_a_published_archive_this_checkout_lacks_refuses_the_move(reg):
-    """#138 item 2: with the published archive outside this checkout (skip-
-    worktree, as a sparse checkout leaves it), the move created a NEW archive of
-    its own rows and removed them from the register before git refused to stage
-    the path (exit 6). It refuses before writing now."""
-    reg.write("lanes/archive/LANES-retired.md", "# archive\n\n" + HEADER + row(
-        "repoX-9", OLD_ID, "RETIRED · 2026-08-02T00:00:00Z · an earlier move", "2026-08-01"))
-    retire_repo_x_2(reg)
-    reg.publish("an archive with repoX-9, and repoX-2 retired")
-    reg.git("update-index", "--skip-worktree", "lanes/archive/LANES-retired.md")
-    (reg.wip / "lanes/archive/LANES-retired.md").unlink()
-    before, register = reg.head(), reg.read("lanes/LANES.md")
-    result = reg.run("archive-rows", "repoX", "--yes", LANES_LANE="repoX-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "is published on origin/main and this checkout does not have it" in result.stderr
-    assert reg.head() == before
-    assert reg.read("lanes/LANES.md") == register
-    assert not (reg.wip / "lanes/archive/LANES-retired.md").exists()
-    assert reg.dirty() == ""
-
-
-# ---------------------------------- #138: the reads that hand out a position
-
-def next_free(reg: Register, repo: str = "repoX") -> subprocess.CompletedProcess:
-    env = dict(reg.env)
-    return subprocess.run(["bash", str(REPO / "lanes-edit.sh"), "next-free", repo],
-                          input="repoX-1\trow\n", cwd=str(reg.wip), env=env, text=True,
-                          capture_output=True, timeout=60, check=False)
-
-
-@pytest.mark.parametrize("kind", ["directory", "broken symlink", "fifo"])
-def test_item_7_a_local_archive_that_is_not_a_regular_file_offers_no_position(reg, kind):
-    """#138 item 7: `archive_text`'s local rung asked `-f` alone, so an archive
-    path that is there and not a regular file read as no archive, and the
-    positions it should reserve were offered again."""
-    path = reg.wip / "lanes/archive/LANES-retired.md"
-    path.parent.mkdir()
-    if kind == "directory":
-        path.mkdir()
-    elif kind == "broken symlink":
-        path.symlink_to("gone.md")
-    else:
-        os.mkfifo(path)
-    result = next_free(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert result.stdout == ""
-    assert "could not be read" in result.stderr
-
-
-@pytest.mark.parametrize("kind", ["zero bytes", "broken symlink"])
-def test_item_5_a_register_path_that_renders_empty_offers_no_position(reg, kind):
-    """#138 item 5: where origin has no register, the working-tree register
-    counted as a source only under `[ -s ]`, so a zero-byte one — what a failed
-    rewrite leaves — or a broken symlink was skipped and `next-free` answered
-    from its stdin rows alone."""
-    reg.git("rm", "-q", "-r", "--cached", "lanes")
-    reg.write("README", "a workspace whose register is not published yet\n")
-    reg.git("add", "README")
-    reg.git("commit", "-q", "-m", "publish no register")
-    reg.git("push", "-q", "origin", "main")
-    register = reg.wip / "lanes/LANES.md"
-    register.unlink()
-    if kind == "zero bytes":
-        register.write_text("")
-    else:
-        register.symlink_to("gone.md")
-    result = next_free(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert result.stdout == ""
-
-
-# ------------------------------------------- #138: the listing's DORMANT class
-
-def classes(reg: Register) -> tuple:
-    result = reg.run("lanes", "--closed", "--prefix", "repoX")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    return {f[0]: f[13] for f in (line.split("\t") for line in result.stdout.splitlines()) if len(f) > 13}, result.stderr
-
-
-@UNPRIVILEGED_ONLY
-def test_item_4_a_log_directory_that_cannot_be_listed_classes_no_row_dormant(reg):
-    """#138 item 4: the listing's fence of this checkout's logs was
-    `ls 2>/dev/null`, so an unreadable directory hid a log committed here and
-    not yet pushed, and its lane was classed DORMANT — hidden, and offered to
-    the sweep."""
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", lane_line("STARTED", "repoX-2", OLD_ID, "2026-10-13T00:00:00Z")))
-    reg.commit("repoX-2 started here, not yet pushed")
-    readable, _ = classes(reg)
-    assert readable["repoX-2"] == "none" and readable["repoX-3"] == "dormant"
-    logs = reg.wip / "lanes" / "log"
-    logs.chmod(0)
-    try:
-        unreadable, err = classes(reg)
-    finally:
-        logs.chmod(0o755)
-    assert unreadable["repoX-2"] == "none"
-    assert "could not be listed" in err
-
-
-@UNPRIVILEGED_ONLY
-def test_item_4_the_sweep_refuses_rather_than_finding_nothing_to_do(reg):
-    """The review of #230: with the class withheld, `lane-end --retire-dormant`
-    counted zero dormant rows and exited 8, "there is nothing to do", about rows
-    nobody could class. It turns the listing's sentence into a refusal (1)."""
-    logs = reg.wip / "lanes" / "log"
-    logs.chmod(0)
-    try:
-        result = retire_dormant(reg)
-    finally:
-        logs.chmod(0o755)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "classed none of them DORMANT" in result.stderr
-
-
-def retire_dormant(reg: Register) -> subprocess.CompletedProcess:
-    """`lane-end --retire-dormant repoX`, the dry run, with this checkout's helper."""
-    env = dict(reg.env, LANES_EDIT=str(REPO / "lanes-edit.sh"))
-    return subprocess.run(["bash", str(REPO / "lane-end"), "--retire-dormant", "repoX"],
-                          cwd=str(reg.wip), env=env, text=True, capture_output=True,
-                          timeout=120, check=False)
-
-
-def test_item_11_a_published_log_git_cannot_read_is_never_classed_dormant(reg):
-    """#138 item 11: DORMANT is read from a lane's absence from the facts pass,
-    and a published log whose `git show` failed gave that pass no lines, so an
-    IDLE lane read as NO LOG, was hidden, and was offered to the sweep. Its
-    local copy is out of the sparse checkout, so only origin speaks for it."""
-    reg.write("lanes/log/repoX-2.md", log_text(
-        "repoX-2", lane_line("STARTED", "repoX-2", OLD_ID, "2026-10-13T00:00:00Z")))
-    reg.publish("repoX-2 started")
-    reg.git("update-index", "--skip-worktree", "lanes/log/repoX-2.md")
-    (reg.wip / "lanes/log/repoX-2.md").unlink()
-    readable, _ = classes(reg)
-    assert readable["repoX-2"] == "none" and readable["repoX-3"] == "dormant"
-    reg.refuse_git("origin/main:lanes/log/repoX-2.md")
-    unreadable, err = classes(reg)
-    assert unreadable["repoX-2"] == "none"
-    assert unreadable["repoX-3"] == "dormant"
-    assert "lanes/log/repoX-2.md" in err
-
-
-# ----------------------------------------------- #138: add-row's published scan
-
-def peer_publishes_repo_x_5(reg: Register) -> None:
-    """A peer publishes a row for repoX-5 above the others, so this checkout's
-    append of a second one would rebase cleanly over it."""
-    peer = reg.tmp / "peer"
-    reg.raw_git("clone", "-q", str(reg.origin), str(peer))
-    lines = (peer / "lanes/LANES.md").read_text(encoding="utf-8").splitlines(True)
-    rule = next(n for n, line in enumerate(lines) if line.startswith("|---"))
-    lines.insert(rule + 1, row("repoX-5", "eeee0138-0005-4000-8000-000000000005", "started on the peer", "2026-10-13"))
-    (peer / "lanes/LANES.md").write_text("".join(lines), encoding="utf-8")
-    reg.raw_git("-C", str(peer), "commit", "-q", "-am", "the peer adds repoX-5")
-    reg.raw_git("-C", str(peer), "push", "-q", "origin", "main")
-
-
-def delete_published_register_blob(reg: Register, *, pull: bool) -> None:
-    """Fetch (or pull) the peer's register, then delete its blob from this
-    clone's object store: the tree still names the path, and git cannot read it."""
-    reg.git("config", "fetch.unpackLimit", "100000")
-    reg.git(*(("pull", "-q", "--rebase") if pull else ("fetch", "-q")))
-    blob = reg.git("rev-parse", "origin/main:lanes/LANES.md").strip()
-    loose = reg.wip / ".git" / "objects" / blob[:2] / blob[2:]
-    assert loose.is_file(), "the register blob is not a loose object here"
-    loose.unlink()
-
-
-def add_repo_x_5(reg: Register) -> subprocess.CompletedProcess:
-    return reg.run("add-row", row("repoX-5", "ffff0138-0006-4000-8000-000000000006", "new here",
-                                  "2026-10-13").rstrip("\n"), LANES_LANE="repoX-5")
-
-
-def published_repo_x_5_rows(reg: Register) -> int:
-    return reg.raw_git("-C", str(reg.origin), "show", "main:lanes/LANES.md").count("| `repoX-5` |")
-
-
-@pytest.mark.parametrize("mode", ["git refuses cat-file and show", "the blob is gone"])
-def test_item_18_a_published_register_git_cannot_read_is_not_this_checkouts_copy(reg, mode):
-    """#138 item 18, the review of #230: `register_text` asked `cat-file -e`
-    whether the register is published, which fails for an unreadable blob as for
-    an absent path, so it read THIS checkout's copy instead and add-row's check
-    passed — a duplicate landed (exit 0), or was committed here and stopped only
-    by the rebase (exit 3). The tree answers now, and the read refuses."""
-    peer_publishes_repo_x_5(reg)
-    if mode == "the blob is gone":
-        delete_published_register_blob(reg, pull=False)
-    else:
-        reg.refuse_git("origin/main:lanes/LANES.md")
-    before = reg.head()
-    result = add_repo_x_5(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "published register on origin/main could not be read" in result.stderr
-    assert reg.head() == before
-    assert published_repo_x_5_rows(reg) == 1
-
-
-def test_item_18_next_free_refuses_a_published_register_git_cannot_read(reg):
-    """The same probe in `lane_position_rows`: with the published register's
-    blob gone, `next-free` answered from this checkout's copy."""
-    peer_publishes_repo_x_5(reg)
-    delete_published_register_blob(reg, pull=False)
-    result = next_free(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert result.stdout == ""
-
-
-def test_item_18_the_seam_refuses_a_sweep_over_a_published_register_git_cannot_read(reg):
-    """And the seam: with the published register unreadable and this checkout
-    current, `register_text` handed it this checkout's copy, called every lane
-    legacy, and the sweep was published."""
-    peer_publishes_repo_x_5(reg)
-    delete_published_register_blob(reg, pull=True)
-    before = reg.head()
-    result = reg.sweep("repoX-3", LANES_SESSION=WRITER_ID)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "is UNKNOWN" in result.stderr
-    assert reg.head() == before
-
-
-def test_item_18_an_unreadable_register_withholds_the_class_and_the_sweep_refuses(reg):
-    """The re-review of #230: the listing built its rows from `register_text`
-    with its status thrown away, so with the published register's blob gone
-    repoX-2 and repoX-3 vanished, and `lane-end --retire-dormant` said "nothing
-    to do" (exit 8). The listing says so and withholds the class; the sweep
-    refuses (1)."""
-    peer_publishes_repo_x_5(reg)
-    delete_published_register_blob(reg, pull=False)
-    listing = reg.run("lanes", "--closed", "--prefix", "repoX")
-    assert "no row is classed DORMANT here" in listing.stderr
-    result = retire_dormant(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "classed none of them DORMANT" in result.stderr
-
-
-def peer_archives_repo_x_4(reg: Register, mode: str) -> None:
-    """A peer publishes the archive, retiring repoX-4; this checkout fetches it
-    and does not pull. Then git cannot read the archive's blob: refused by a
-    `git` on PATH, or deleted from this clone's object store."""
-    peer = reg.tmp / "peer"
-    reg.raw_git("clone", "-q", str(reg.origin), str(peer))
-    (peer / "lanes/archive").mkdir()
-    (peer / "lanes/archive/LANES-retired.md").write_text("# archive\n\n" + HEADER + row(
-        "repoX-4", OLD_ID, "RETIRED \u00b7 2026-08-02T00:00:00Z \u00b7 moved", "2026-08-01"), encoding="utf-8")
-    reg.raw_git("-C", str(peer), "add", "-A")
-    reg.raw_git("-C", str(peer), "commit", "-q", "-m", "the peer archives repoX-4")
-    reg.raw_git("-C", str(peer), "push", "-q", "origin", "main")
-    reg.git("config", "fetch.unpackLimit", "100000")
-    reg.git("fetch", "-q")
-    if mode == "the blob is gone":
-        blob = reg.git("rev-parse", "origin/main:lanes/archive/LANES-retired.md").strip()
-        loose = reg.wip / ".git" / "objects" / blob[:2] / blob[2:]
-        assert loose.is_file(), "the archive blob is not a loose object here"
-        loose.unlink()
-    else:
-        reg.refuse_git("origin/main:lanes/archive/LANES-retired.md")
-
-
-@pytest.mark.parametrize("mode", ["git refuses cat-file and show", "the blob is gone"])
-def test_item_18_a_published_archive_git_cannot_read_reissues_no_position(reg, mode):
-    """The re-review of #230: `archive_text` asked `cat-file -e` too, so a
-    published archive git could not read was "not published", this checkout's
-    (absent) copy answered, `next-free` offered retired repoX-4 and add-row
-    committed it. The tree answers now, and both refuse (1) before writing."""
-    peer_archives_repo_x_4(reg, mode)
-    offered = next_free(reg)
-    assert offered.returncode == 1, (offered.stdout, offered.stderr)
-    assert offered.stdout == ""
-    before = reg.head()
-    result = reg.run("add-row", row("repoX-4", "ffff0138-0006-4000-8000-000000000006", "new here",
-                                    "2026-10-18").rstrip("\n"), LANES_LANE="repoX-4")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert reg.head() == before
-    assert "`repoX-4`" not in reg.raw_git("-C", str(reg.origin), "show", "main:lanes/LANES.md")
-
-
-def test_item_18_an_unreadable_published_register_refuses_add_row(reg):
-    """#138 item 18: `rows_named_ci` ended in an awk over `register_text`, which
-    answered 0 with an empty text where `git show` of the published register
-    failed, and `|| :` took what was left — so a row a peer had published and
-    this checkout had not pulled was added a second time, and landed."""
-    peer_publishes_repo_x_5(reg)
-    reg.refuse_git("show origin/main:lanes/LANES.md")
-    before = reg.head()
-    result = add_repo_x_5(reg)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "published register on origin/main could not be read" in result.stderr
-    assert reg.head() == before
-    assert published_repo_x_5_rows(reg) == 1
-
-
-def test_item_1_an_unreadable_published_register_refuses_the_sweep(reg):
-    """#138 item 1, ALREADY FIXED on main: refusal 1 reads both rows' ids
-    through `|| :`, but the seam asked just before it (`managed_seam_refuse`,
-    from #97) reads the published register and this checkout's row with their
-    status and refuses UNKNOWN (1) on either failing. Pinned here, because
-    the fence for a live session whose id is only in the published row rests
-    on that refusal: here this checkout's uncommitted edit dropped the id."""
-    live = "cccc0138-0003-4000-8000-000000000003"
-    text = reg.read("lanes/LANES.md").replace(f"| `repoX-2` | harness `{OLD_ID}`", f"| `repoX-2` | harness `{live}`")
-    reg.write("lanes/LANES.md", text)
-    reg.publish("repoX-2 is live in a session here")
-    reg.write("lanes/LANES.md", text.replace(live, OLD_ID))
-    reg.live(live)
-    reg.refuse_git("show origin/main:lanes/LANES.md")
-    before = reg.head()
-    result = reg.sweep("repoX-2", LANES_SESSION=WRITER_ID)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "is UNKNOWN" in result.stderr
-    assert reg.head() == before
-    assert not (reg.wip / "lanes/log/repoX-2.md").exists()
diff --git a/tests/test_release_workflow.py b/tests/test_release_workflow.py
deleted file mode 100644
index 34ae79af..00000000
--- a/tests/test_release_workflow.py
+++ /dev/null
@@ -1,4197 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`.github/workflows/release.yml`, its two hash locks and its stamp writer
-(opensoft/openRepoTools#228, User Story 5).
-
-THE RELEASE IS HELD OFFLINE. The workflow builds the wheel, uploads it to
-TestPyPI, checks the install on three legs and uploads it to PyPI, and
-nothing here runs it. What can be held with no network is the file itself,
-read with the PINNED standard's `repo_shape.load_yaml` (research R9), and the
-scripts it carries. Most of the scripts whose outcome decides what is built,
-uploaded or installed are RUN here, as GitHub runs a step, under fakes that
-answer as the forge, the index, `curl`, the build and pipx do:
-
-- in the build job, the version check and the repository guard, the ref,
-  branch, clean-checkout, environments, gate and digest steps, the stamp
-  writer, the build step's byte-for-byte compare, and the wheel check;
-- in each upload job, the guard again, the dist step, the approval and tag
-  re-checks, and both index checks;
-- in the install check, the fetch from TestPyPI, the digest step, pipx's
-  install and its one link, `--version`, and the 3.9 leg's compile.
-
-SIX ARE STILL READ ONLY AS TEXT. Five are held by their commands: the
-build's tool install from its hash lock and its two `git archive`
-extractions, and the install check's install of pipx from its hash lock,
-its offline `--install`, and the macOS rerun, which is held to the offline
-`--install` line for line but for the lines it names. The sixth, the
-build's record of the wheel, is held by its place and by its id, which the
-build job's outputs read.
-Every job's whole step list is pinned in order (`STEP_ORDER`).
-
-contracts/workflows.md's `release.yml` list is the specification, one prefix
-per part of it (plan.md, "The test layout"):
-
-- `test_release_trigger_*`: a dispatch with `version` is the only trigger, no
-  permission is granted at the top, one release runs at a time, and the input
-  reaches every script through the environment alone;
-- `test_release_lock_*`: both hash locks, one version per entry by sha256,
-  hatchling at `pyproject.toml`'s pin, and pipx 1.11.1 below Python 3.10 and
-  1.17.8 from 3.10;
-- `test_release_build_*`: the build job's checkout, pins, steps and order;
-  the ref step, run on a branch and on tags a forge and a `file://` origin
-  hold, and the branch step, held to the rehearsal rule; the clean step run
-  on a checkout moved or dirtied, the environments step under a forge, the
-  gate on `tests.yml`'s four jobs and the digest step, each run under a
-  forge, the digest step also in a copy of the checkout whose standard or
-  pin names another definition; the build step run with a fake build;
-  step 13's wheel check run on synthetic wheels made from HEAD's blobs; and
-  the digest label, one literal in the installer, the pin and the standard;
-- `test_release_stamp_writer_*`: the build's own stamp writer, run on a copy
-  of the committed stamp and read back by `--version` from a `package_tree`;
-- `test_release_guard_build_*` and `test_release_guard_upload_*` (FR-048):
-  the repository guard, run under each row of contracts/workflows.md's table,
-  and each upload job's own first step;
-- `test_release_upload_*`: the four jobs' permissions and step lists, the
-  two environments, the two conditions, and each upload job's checks around
-  the pinned action, the dist step run over the files a case puts in
-  `dist/`, the approval and tag re-checks run under a forge and the index
-  checks under a fake index;
-- `test_release_install_check_*`: the three legs and what each runs, its
-  fetch, digest, pipx, `--version` and 3.9 steps run;
-- `test_release_reads_*`: no step reads what the code leg will not hold;
-- `test_release_header_*`: the RELEASING header's six sections, in order.
-
-WRITTEN BEFORE THE WORKFLOW (tasks.md T018, ahead of T019 to T021). Until
-`release.yml` exists, every test that reads it FAILS, naming the file and the
-tasks that write it: never a skip, and never an error at collection, because
-nothing is read from it until a test runs. The lock tests and the digest
-label's test read nothing of it, and pass on their own.
-
-HOW A STEP IS FOUND, which is this file's half of the contract with the
-workflow (T019 to T021 write the other half):
-
-- the repository guard is the step whose outputs the build job records as
-  `to-testpypi` and `to-pypi` (contracts/workflows.md, step 14);
-- the steps adapted from openRepoShape v1.1.0 are found by THE MODEL'S OWN
-  NAMES, as prefixes (`BUILD_STEPS` below): step for step, as FR-028 has the
-  workflow taken over;
-- each upload job's guard is its first step ("Its first step runs the
-  repository guard again, on its own");
-- the install legs' own steps are found by their `if:`.
-
-`STEP_ORDER`, which pins every job's whole step list in order, follows these
-rules, and finds every other step by a prefix of its label: an action by the
-action it uses, and this workflow's own steps, the install check's
-`--version` among them, by their own names. So a step found by its role can
-be renamed and still hold its place.
-
-HOW A STEP IS RUN, as GitHub runs a `shell: bash` step: its `run:` text in a
-file, `bash --noprofile --norc -eo pipefail <file>`, with the workflow's, the
-job's and the step's literal `env:` values (one that holds an expression is
-GitHub's to fill, and the case sets what it stands for), `GITHUB_OUTPUT` and
-the other file commands under `tmp_path`, and NOTHING INHERITED that a runner,
-a lane or a developer's shell set: every `GITHUB_*`, `RUNNER_*`, `LANES_*`
-and `TMUX*` variable is removed first, and `gh` and `curl` are fakes that
-write down that they were asked and refuse, unless a case puts a forge of its
-own ahead of them. A heredoc is cut out as the model's `heredoc()` cuts one,
-and run with this Python under `-I`: the stamp writer with the two copies as
-its arguments, and the wheel check with the wheel as its one argument. Both
-read the release's values from `VERSION`, `TAG`, `COMMIT`, `DIGEST` and
-`REPOSITORY` (contracts/stamp.md), and the wheel check reads the run's own
-commit and repository from `GITHUB_SHA` and `GITHUB_REPOSITORY` as well,
-which carry the same values (the model's reads `GITHUB_SHA`).
-
-WITHOUT THE SUBMODULE every test that reads YAML or the standard SKIPS, as the
-command tests do (`NEEDS_UPSTREAM`), and a composed run fails instead. Nothing
-here reads `specs/`, which goes to the spec leg at the cutover.
-"""
-
-from __future__ import annotations
-
-import base64
-import difflib
-import functools
-import hashlib
-import http.server
-import json
-import os
-import re
-import shlex
-import shutil
-import stat
-import subprocess
-import sys
-import threading
-import zipfile
-from pathlib import Path
-from typing import Callable, Dict, List, Optional, Tuple
-
-import pytest
-
-import package_layout as layout
-from conftest import (GUIDANCE_DOCUMENTS, NEEDS_UPSTREAM, REPO, SPEC_TREES,
-                      UPSTREAM, WINDOWS_SKIP)
-from test_openrepotools_command import command_env
-
-WORKFLOWS = REPO / ".github" / "workflows"
-WORKFLOW = WORKFLOWS / "release.yml"
-TESTS_WORKFLOW = WORKFLOWS / "tests.yml"
-BUILD_LOCK = REPO / ".github" / "release-build-requirements.txt"
-PIPX_LOCK = REPO / ".github" / "release-pipx-requirements.txt"
-PYPROJECT = REPO / "pyproject.toml"
-PIN = REPO / "contracts" / "openreposhape-pin.yaml"
-STAMP = layout.STAMP_SOURCE
-
-#: THE MODEL: openRepoShape v1.1.0's own workflow, in the pinned submodule
-#: (`190133d`). Its artifact actions' pins are this workflow's.
-MODEL = UPSTREAM / ".github" / "workflows" / "release.yml"
-STANDARD_SCRIPTS = UPSTREAM / "scripts"
-
-NEEDS_BASH = pytest.mark.skipif(shutil.which("bash") is None,
-                                reason="the workflow's steps are bash")
-
-#: A step that runs longer than this is waiting on something it must not.
-STEP_TIMEOUT = 120
-
-# --- what contracts/workflows.md fixes -----------------------------------------
-
-JOBS = ("build", "testpypi", "install", "pypi")
-UPLOADS = {"testpypi": "testpypi", "pypi": "pypi"}
-
-#: Each job's permissions, EXACTLY (contracts/workflows.md; data-model.md's
-#: "A release run").
-PERMISSIONS = {
-    "build": {"contents": "read", "actions": "read"},
-    "testpypi": {"id-token": "write", "actions": "read", "contents": "read"},
-    "install": {"contents": "read"},
-    "pypi": {"id-token": "write", "actions": "read", "contents": "read"},
-}
-
-#: The release gate's four job ids (FR-029, FR-046): `tests.yml` keeps them as
-#: job ids with no `name:`, so a job's name in a run IS its id.
-GATE = ("guard-launch-mode", "tests", "tests-no-submodule", "package")
-
-#: The two repositories the guard knows, spelled as GitHub spells them in
-#: `$GITHUB_REPOSITORY` (FR-048).
-CODE_LEG = "opensoft/openRepoTools-code"
-THIS_REPOSITORY = "opensoft/openRepoTools"
-
-PUBLISH = "pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33"
-PUBLISH_TAG = "# v1.14.2"
-TESTPYPI_LEGACY = "https://test.pypi.org/legacy/"
-PIP_INDEX_URL = "https://pypi.org/simple/"
-
-#: The digest's definition, one literal for the installer's `--version`
-#: label, the pin's `digest_definition` and the standard's
-#: `TREE_DIGEST_DEFINITION` (FR-029, design.md Decision 10).
-DIGEST_LABEL = "sorted-ls-tree-r-v1"
-
-#: The install check's condition, the model's own (`release.yml:855-858` at
-#: v1.1.0): on a tag after TestPyPI succeeded, on a branch after the build
-#: alone.
-INSTALL_IF = ("${{ !cancelled() && needs.build.result == 'success' && "
-              "(needs.testpypi.result == 'success' || "
-              "(needs.testpypi.result == 'skipped' && "
-              "!startsWith(github.ref, 'refs/tags/'))) }}")
-
-#: The two ubuntu legs are pinned to 24.04, and macOS is not: `ubuntu-latest`
-#: became Ubuntu 26.04 on 2026-10-21, where setup-python has no Python 3.9.
-INSTALL_LEGS = [("ubuntu-24.04", "3.x"), ("macos-latest", "3.x"),
-                ("ubuntu-24.04", "3.9")]
-
-#: THE BUILD'S STEPS ADAPTED FROM THE MODEL, BY THE MODEL'S OWN NAMES, each
-#: a prefix the step's `name:` begins with (contracts/workflows.md's build
-#: steps 2 to 13; the model's are at `release.yml:206-665` at v1.1.0). Step 1,
-#: the version and the repository guard, is found by the outputs it records.
-REF_STEP = "the dispatched ref is the annotated tag v<version> at this commit"
-ON_BRANCH_STEP = "the commit is on main or on the version's release branch"
-CLEAN_STEP = "the checkout is this commit, and clean"
-ENVIRONMENTS_STEP = "both environments ask a reviewer"
-GATE_STEP = "the commit carries"
-DIGEST_STEP = "the commit's tree digest is the forge's"
-TOOLS_STEP = "install the release tools from their hash lock"
-EXTRACT_STEP = "extract the commit twice"
-STAMP_STEP = "write the stamp into both extractions"
-BUILD_STEP = "build the wheel from each extraction"
-WHEEL_CHECK_STEP = "the wheel holds the commit's own files"
-RECORD_STEP = "record the wheel"
-BUILD_STEPS = (REF_STEP, ON_BRANCH_STEP, CLEAN_STEP, ENVIRONMENTS_STEP,
-               GATE_STEP, DIGEST_STEP, TOOLS_STEP, EXTRACT_STEP, STAMP_STEP,
-               BUILD_STEP, WHEEL_CHECK_STEP, RECORD_STEP)
-
-#: `owner/repository[/path]@<40 hex>`: an action pinned by a full commit, and
-#: a `uses:` line as it is written, with its release tag as a comment (the
-#: model's `COMMIT_PIN` and `USES_LINE`, `tests/test_release_workflow.py:62-66`
-#: at v1.1.0).
-COMMIT_PIN = re.compile(r"[A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+@[0-9a-f]{40}")
-USES_LINE = re.compile(r"^\s*(?:- )?uses:\s*(\S+)(.*)$")
-
-#: `${{ steps.<id>.outputs.<name> }}`, the one form a job output takes here.
-STEP_OUTPUT = re.compile(r"\$\{\{\s*steps\.([A-Za-z_][A-Za-z0-9_-]*)"
-                         r"\.outputs\.([A-Za-z_][A-Za-z0-9_-]*)\s*\}\}")
-
-#: `--version` from a stamped package (contracts/cli-output.md), two spaces
-#: meaning two.
-STAMPED_VERSION = ("openRepoTools {VERSION} ({REPOSITORY} @ {COMMIT})\n"
-                   "  version   {VERSION}\n"
-                   "  tag       {TAG}\n"
-                   "  commit    {COMMIT}\n"
-                   "  digest    {DIGEST} (" + DIGEST_LABEL + ")\n")
-
-#: hatchling 1.27.0's version pattern, `hatchling/version/core.py:6`, as
-#: `tests/test_package_stamp.py` copies it with its citation.
-HATCH_PATTERN = r'(?i)^(__version__|VERSION) *= *([\'"])v?(?P<version>.+?)\2'
-
-FILE_COMMANDS = ("GITHUB_OUTPUT", "GITHUB_ENV", "GITHUB_STEP_SUMMARY",
-                 "GITHUB_PATH")
-
-#: WHAT A STEP RUN INHERITS FROM THIS PROCESS: nothing a runner, a lane
-#: session, a forge login or a developer's shell set that a step could read.
-FOREIGN_PREFIXES = ("LANES_", "TMUX", "GITHUB_", "RUNNER_", "ACTIONS_", "GH_",
-                    "PIP_", "PIPX_", "OPENREPOTOOLS_", "CLAUDE_", "FORGE_")
-FOREIGN_NAMES = frozenset({
-    "VERSION", "TAG", "COMMIT", "DIGEST", "REPOSITORY", "WHEEL",
-    "WHEEL_SHA256", "CI", "PYTHONPATH", "PYTHONHOME", "PYTHONUTF8",
-    "PYTHONSTARTUP", "SOURCE_DATE_EPOCH", "ENVIRONMENT", "INDEX", "JSON_BASE",
-    "TREE_A", "TREE_B"})
-
-
-# --- reading the workflow ------------------------------------------------------
-
-@functools.lru_cache(maxsize=1)
-def standard():
-    """The PINNED `scripts/repo_shape.py`, imported from the submodule and
-    never copied (G2, R9). Every caller is a test marked `NEEDS_UPSTREAM`."""
-    scripts = str(STANDARD_SCRIPTS)
-    sys.path.insert(0, scripts)
-    try:
-        import repo_shape
-    finally:
-        sys.path.remove(scripts)
-    return repo_shape
-
-
-_READ: Dict[tuple, dict] = {}
-
-
-def release() -> dict:
-    """`release.yml` as the pinned `load_yaml` reads it, or THIS TEST'S
-    FAILURE, naming the file and the tasks that write it. Called in the test's
-    own body, so an absent file is a failure of the test that needed it, and
-    never a setup error or a collection error."""
-    if not (STANDARD_SCRIPTS / "repo_shape.py").is_file():
-        pytest.skip("the pinned openRepoShape is not checked out; run "
-                    "`git submodule update --init upstream/openRepoShape`")
-    rel = os.path.relpath(WORKFLOW, REPO)
-    if not WORKFLOW.is_file():
-        pytest.fail(f"{rel} does not exist: contracts/workflows.md's release "
-                    "workflow is written by tasks T019 (its shape and the "
-                    "build job), T020 (testpypi, install and pypi) and T021 "
-                    "(the RELEASING header), and this test holds what it must "
-                    "say", pytrace=False)
-    st = WORKFLOW.stat()
-    key = (str(WORKFLOW), st.st_mtime_ns, st.st_size)
-    if key not in _READ:
-        try:
-            _READ[key] = standard().load_yaml(WORKFLOW)
-        except Exception as error:   # repo_shape.Refusal, and only it
-            pytest.fail(f"the pinned load_yaml refuses {rel}: {error}",
-                        pytrace=False)
-    workflow = _READ[key]
-    if not isinstance(workflow, dict) or not isinstance(
-            workflow.get("jobs"), dict):
-        pytest.fail(f"{rel} is not a workflow with `jobs:`", pytrace=False)
-    return workflow
-
-
-def job(workflow: dict, name: str) -> dict:
-    jobs = workflow["jobs"]
-    if not isinstance(jobs.get(name), dict):
-        pytest.fail(f"release.yml has no `{name}` job; it has "
-                    f"{sorted(jobs)}", pytrace=False)
-    return jobs[name]
-
-
-def steps_of(workflow: dict, name: str) -> list:
-    found = job(workflow, name).get("steps")
-    if not isinstance(found, list) or not found:
-        pytest.fail(f"release.yml's `{name}` job has no steps", pytrace=False)
-    return found
-
-
-def label(step: dict) -> str:
-    return (step.get("name") or str(step.get("uses", "")).split("@")[0]
-            or "<an unnamed run step>")
-
-
-def named(workflow: dict, name: str, prefix: str) -> dict:
-    """The one step of job `name` whose name begins with `prefix`."""
-    steps = steps_of(workflow, name)
-    found = [s for s in steps if str(s.get("name", "")).startswith(prefix)]
-    if len(found) != 1:
-        pytest.fail(f"the `{name}` job has {len(found)} steps whose name "
-                    f"begins {prefix!r}, not one (the model's own name). Its "
-                    f"steps: {[label(s) for s in steps]}", pytrace=False)
-    return found[0]
-
-
-def where(workflow: dict, name: str, step: dict) -> int:
-    return next(i for i, s in enumerate(steps_of(workflow, name)) if s is step)
-
-
-def run_text(step: dict) -> str:
-    value = step.get("run", "")
-    return value if isinstance(value, str) else ""
-
-
-def build_outputs(workflow: dict) -> dict:
-    outputs = job(workflow, "build").get("outputs")
-    if not isinstance(outputs, dict) or not outputs:
-        pytest.fail("the build job records no `outputs:`", pytrace=False)
-    return outputs
-
-
-def guard_step(workflow: dict) -> dict:
-    """STEP 1, BY WHAT IT RECORDS: the build step whose `to-testpypi` and
-    `to-pypi` the build job carries as outputs of its own (contracts/
-    workflows.md, steps 1 and 14)."""
-    outputs = build_outputs(workflow)
-    ids = set()
-    for name in ("to-testpypi", "to-pypi"):
-        value = str(outputs.get(name, "")).strip()
-        found = STEP_OUTPUT.fullmatch(value)
-        if not found or found.group(2) != name:
-            pytest.fail(f"the build job's output `{name}` is {value!r}, not "
-                        f"`${{{{ steps.<the guard's id>.outputs.{name} }}}}`: "
-                        "step 14 records step 1's to-testpypi and to-pypi",
-                        pytrace=False)
-        ids.add(found.group(1))
-    if len(ids) != 1:
-        pytest.fail(f"to-testpypi and to-pypi come from {sorted(ids)}, not "
-                    "from one guard step", pytrace=False)
-    (step_id,) = ids
-    found = [s for s in steps_of(workflow, "build") if s.get("id") == step_id]
-    if len(found) != 1 or not run_text(found[0]):
-        pytest.fail(f"the build job has {len(found)} `run:` steps with id "
-                    f"{step_id!r}, not one: the guard is a bash `run:` block "
-                    "the suite runs", pytrace=False)
-    return found[0]
-
-
-def heredoc(script: str) -> str:
-    """The Python a `run:` script hands to `python3 ... <<'PY'`: the model's
-    own `heredoc()`, `tests/test_release_workflow.py:89-94` at v1.1.0."""
-    lines = script.splitlines()
-    [start] = [at for at, line in enumerate(lines)
-               if line.rstrip().endswith("<<'PY'")]
-    return "\n".join(lines[start + 1:lines.index("PY", start)]) + "\n"
-
-
-def heredoc_line(script: str) -> str:
-    """The command line that opens a step's heredoc."""
-    [line] = [line for line in script.splitlines()
-              if line.rstrip().endswith("<<'PY'")]
-    return line
-
-
-def commands(script: str) -> list:
-    """A `run:` script's command lines as the shell reads them: each
-    continuation joined to the line it continues, comment lines dropped (the
-    model's `commands()`, `tests/test_release_workflow.py:97-102`)."""
-    joined = re.sub(r"\s*\\\n\s*", " ", script)
-    return [line.strip() for line in joined.splitlines()
-            if line.strip() and not line.strip().startswith("#")]
-
-
-def normal(expression) -> str:
-    """An expression with its `${{ }}` taken off and its spaces collapsed."""
-    text = " ".join(str(expression or "").split())
-    if text.startswith("${{") and text.endswith("}}"):
-        text = text[3:-2].strip()
-    return text
-
-
-def as_list(value) -> list:
-    if value is None:
-        return []
-    return [value] if isinstance(value, str) else list(value)
-
-
-def uses_lines(path: Path) -> Dict[str, str]:
-    """Every `uses:` reference written in `path`, with the comment beside it."""
-    found = {}
-    for line in path.read_text(encoding="utf-8").splitlines():
-        match = USES_LINE.match(line)
-        if match:
-            found[match.group(1)] = match.group(2).strip()
-    return found
-
-
-def every_step(workflow: dict):
-    for name, body in workflow["jobs"].items():
-        for step in (body.get("steps") or []):
-            yield name, step
-
-
-def transcript(done: subprocess.CompletedProcess) -> str:
-    return (f"exit {done.returncode}\n--- stdout\n{done.stdout}"
-            f"--- stderr\n{done.stderr}")
-
-
-# --- running a step ------------------------------------------------------------
-
-def clean_environ(home: Path) -> dict:
-    """This process's environment with everything foreign taken out, and
-    `home` as HOME."""
-    env = {name: value for name, value in os.environ.items()
-           if not name.startswith(FOREIGN_PREFIXES) and name not in FOREIGN_NAMES}
-    home.mkdir(parents=True, exist_ok=True)
-    env["HOME"] = str(home)
-    return env
-
-
-def literal_env(scope) -> dict:
-    """A `env:` mapping's values that hold no expression, as GitHub passes
-    them: `true` and `false` as words."""
-    out = {}
-    for name, value in (scope or {}).items():
-        if isinstance(value, bool):
-            out[name] = "true" if value else "false"
-        elif "${{" not in str(value):
-            out[name] = str(value)
-    return out
-
-
-def refusing_network(directory: Path, log: Path) -> Path:
-    """A `gh` and a `curl` that write down that they were asked, and fail."""
-    directory.mkdir(parents=True, exist_ok=True)
-    for tool in ("gh", "curl"):
-        (directory / tool).write_text(
-            "#!/bin/sh\n"
-            f"printf '%s %s\\n' {tool} \"$*\" >> {shlex.quote(str(log))}\n"
-            f"printf 'fake {tool}: nothing here may reach a network\\n' >&2\n"
-            "exit 1\n", encoding="utf-8")
-        (directory / tool).chmod(0o755)
-    return directory
-
-
-def python_tool(directory: Path, name: str, code: str) -> Path:
-    """`name`, a Python program run by this interpreter, in `directory`."""
-    directory.mkdir(parents=True, exist_ok=True)
-    path = directory / name
-    path.write_text(f"#!{sys.executable}\n" + code, encoding="utf-8")
-    path.chmod(0o755)
-    return directory
-
-
-class Runner:
-    """ONE JOB'S STEPS, RUN AS GITHUB RUNS THEM, under `work`.
-
-    The steps share one set of file commands, so what one step records in
-    `GITHUB_OUTPUT` the next sees, as on a runner. `values` are what GitHub
-    would set for the case, and they win over every literal `env:` value.
-    `forge` is a directory of fakes put ahead of the refusing `gh` and `curl`.
-    """
-
-    def __init__(self, work: Path, workflow: dict, job_name: str, values: dict,
-                 forge: Optional[Path] = None) -> None:
-        work.mkdir(parents=True, exist_ok=True)
-        self.work = work
-        self.values = dict(values)
-        self.log = work / "network-was-asked.log"
-        refusing = refusing_network(work / "refusing-network", self.log)
-        env = clean_environ(work / "home")
-        env["PATH"] = os.pathsep.join(
-            [str(p) for p in (forge, refusing) if p is not None]
-            + [env.get("PATH", os.defpath)])
-        files = work / "runner-files"
-        files.mkdir(exist_ok=True)
-        for name in FILE_COMMANDS:
-            path = files / name.lower()
-            path.touch()
-            env[name] = str(path)
-        temp = work / "runner-temp"
-        temp.mkdir(exist_ok=True)
-        env["RUNNER_TEMP"] = str(temp)
-        env.update(literal_env(workflow.get("env")))
-        env.update(literal_env(workflow["jobs"].get(job_name, {}).get("env")))
-        self.env = env
-        self.output = Path(env["GITHUB_OUTPUT"])
-        self.count = 0
-
-    def run(self, step: dict, cwd: Optional[Path] = None
-            ) -> subprocess.CompletedProcess:
-        self.count += 1
-        script = self.work / f"step-{self.count}.sh"
-        script.write_text(run_text(step), encoding="utf-8")
-        env = dict(self.env)
-        env.update(literal_env(step.get("env")))
-        env.update(self.values)
-        return subprocess.run(
-            ["bash", "--noprofile", "--norc", "-eo", "pipefail", str(script)],
-            capture_output=True, text=True, check=False,
-            stdin=subprocess.DEVNULL, env=env,
-            cwd=str(cwd or self.work), timeout=STEP_TIMEOUT)
-
-    def recorded(self) -> List[Tuple[str, str]]:
-        """`GITHUB_OUTPUT` as GitHub reads it: `name=value` lines, and
-        `name<<DELIMITER` blocks."""
-        lines = self.output.read_text(encoding="utf-8").split("\n")
-        out: List[Tuple[str, str]] = []
-        at = 0
-        while at < len(lines):
-            line = lines[at]
-            at += 1
-            if not line:
-                continue
-            eq, block = line.find("="), line.find("<<")
-            if block != -1 and (eq == -1 or block < eq):
-                name, delimiter, value = line[:block], line[block + 2:], []
-                while at < len(lines) and lines[at] != delimiter:
-                    value.append(lines[at])
-                    at += 1
-                at += 1
-                out.append((name, "\n".join(value)))
-            else:
-                out.append((line[:eq], line[eq + 1:]) if eq != -1
-                           else (line, ""))
-        return out
-
-    def decision(self) -> Dict[str, List[str]]:
-        found: Dict[str, List[str]] = {}
-        for name, value in self.recorded():
-            if name in ("to-testpypi", "to-pypi"):
-                found.setdefault(name, []).append(value)
-        return found
-
-    def asked(self) -> str:
-        return (self.log.read_text(encoding="utf-8") if self.log.exists()
-                else "")
-
-
-def run_heredoc(step: dict, work: Path, arguments: list, values: dict,
-                cwd: Path) -> subprocess.CompletedProcess:
-    """A step's heredoc, cut out as the model cuts one and run by this Python,
-    `-I`, with `arguments` and `values`."""
-    code = heredoc(run_text(step))
-    if "tomllib" in code and sys.version_info < (3, 11):
-        pytest.skip("the step's script reads TOML with tomllib, which is "
-                    "Python 3.11's and up, as the build job's Python is")
-    work.mkdir(parents=True, exist_ok=True)
-    script = work / "heredoc.py"
-    script.write_text(code, encoding="utf-8")
-    env = clean_environ(work / "home")
-    env["PYTHONUTF8"] = "1"
-    env.update(values)
-    return subprocess.run([sys.executable, "-I", str(script),
-                           *(str(a) for a in arguments)],
-                          capture_output=True, text=True, check=False,
-                          stdin=subprocess.DEVNULL, env=env, cwd=str(cwd),
-                          timeout=STEP_TIMEOUT)
-
-
-def ref_name(ref: str) -> str:
-    for prefix in ("refs/heads/", "refs/tags/"):
-        if ref.startswith(prefix):
-            return ref[len(prefix):]
-    return ref.split("/", 2)[-1] if ref.startswith("refs/") else ref
-
-
-def release_values(release: dict) -> dict:
-    """The five stamp values, under contracts/stamp.md's names and under the
-    runner's, which carry the same ones."""
-    values = dict(release)
-    values["GITHUB_SHA"] = release["COMMIT"]
-    values["GITHUB_REPOSITORY"] = release["REPOSITORY"]
-    return values
-
-
-def version_env(home: Path) -> dict:
-    env = command_env(home)
-    for name in [n for n in env if n.startswith(
-            ("LANES_", "TMUX", "OPENREPOTOOLS_PACKAGE_", "PIPX_", "GITHUB_",
-             "RUNNER_"))]:
-        del env[name]
-    return env
-
-
-def run_version(payload: Path, home: Path) -> subprocess.CompletedProcess:
-    """`bash <payload>/openRepoTools --version`, as the entry module runs it."""
-    home.mkdir(parents=True, exist_ok=True)
-    return subprocess.run(["bash", str(payload / "openRepoTools"), "--version"],
-                          capture_output=True, text=True, check=False,
-                          stdin=subprocess.DEVNULL, env=version_env(home),
-                          cwd=str(home), timeout=STEP_TIMEOUT)
-
-
-#: A `gh` THAT ANSWERS THE FORGE'S REST READS from `FORGE_DATA`, a JSON map of
-#: path (its query left off) to the object the API returns, writes down every
-#: call in `FORGE_LOG`, and answers any other path as a 404. It evaluates the
-#: three `--jq` forms the release's steps use, and refuses any other, so a step
-#: that starts asking something new fails here rather than reading nothing.
-API_FORGE = r'''
-import json, os, re, sys
-args = sys.argv[1:]
-with open(os.environ["FORGE_LOG"], "a", encoding="utf-8") as log:
-    log.write(json.dumps(args) + "\n")
-paths = [a for a in args[1:] if a.lstrip("/").startswith("repos/")]
-if args[:1] != ["api"] or len(paths) != 1:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-path = paths[0].lstrip("/").partition("?")[0]
-with open(os.environ["FORGE_DATA"], encoding="utf-8") as handle:
-    answers = json.load(handle)
-if path not in answers:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-answer = answers[path]
-jq = None
-for flag in ("--jq", "-q"):
-    if flag in args:
-        jq = args[args.index(flag) + 1].strip()
-if jq is None:
-    print(json.dumps(answer))
-    sys.exit(0)
-kind = re.fullmatch(r'select\(\.object\.type == "([a-z]+)"\) \| \.object\.sha', jq)
-if kind:
-    if answer.get("object", {}).get("type") == kind.group(1):
-        print(answer["object"]["sha"])
-elif jq == "[.tag, .object.type, .object.sha] | @tsv":
-    print("\t".join([answer["tag"], answer["object"]["type"], answer["object"]["sha"]]))
-else:
-    sys.stderr.write(f"fake forge: it answers no --jq {jq!r}\n")
-    sys.exit(1)
-'''
-
-
-def api_forge(tmp_path: Path, answers: dict) -> Tuple[Path, dict]:
-    """`API_FORGE` in `tmp_path/forge`, answering `answers`, and the values
-    a run gives it."""
-    data = tmp_path / "forge.json"
-    data.write_text(json.dumps(answers), encoding="utf-8")
-    forge = python_tool(tmp_path / "forge", "gh", API_FORGE)
-    return forge, {"FORGE_DATA": str(data), "FORGE_LOG": str(tmp_path / "forge.log")}
-
-
-def forge_asked(tmp_path: Path) -> List[list]:
-    log = tmp_path / "forge.log"
-    return ([json.loads(line) for line in log.read_text(encoding="utf-8").splitlines()]
-            if log.exists() else [])
-
-
-def annotated_tag(repository: str, tag: str, object_: str, commit: str,
-                  **lie) -> dict:
-    """The forge's two answers for the annotated tag `tag`, its ref and its
-    tag object, `object_` naming `commit`; `lie` changes the tag object's
-    `name`, the `type` it names or the commit it `names`, or makes it
-    `lightweight`."""
-    if lie.get("lightweight"):
-        return {f"repos/{repository}/git/ref/tags/{tag}": {
-            "ref": f"refs/tags/{tag}", "object": {"type": "commit", "sha": commit}}}
-    return {f"repos/{repository}/git/ref/tags/{tag}": {
-                "ref": f"refs/tags/{tag}", "object": {"type": "tag", "sha": object_}},
-            f"repos/{repository}/git/tags/{object_}": {
-                "tag": lie.get("name", tag), "sha": object_,
-                "object": {"type": lie.get("type", "commit"),
-                           "sha": lie.get("names", commit)}}}
-
-
-#: The identity and the clock of the git fixtures' commits and tags.
-FIXTURE_GIT = {"GIT_AUTHOR_NAME": "release fixture",
-               "GIT_AUTHOR_EMAIL": "fixture@openrepotools.invalid",
-               "GIT_COMMITTER_NAME": "release fixture",
-               "GIT_COMMITTER_EMAIL": "fixture@openrepotools.invalid",
-               "GIT_AUTHOR_DATE": "2026-10-19T00:00:00Z",
-               "GIT_COMMITTER_DATE": "2026-10-19T00:00:00Z",
-               "GIT_CONFIG_NOSYSTEM": "1"}
-
-
-def fixture_git(home: Path, cwd: Path, *args: str, data: Optional[str] = None) -> str:
-    env = clean_environ(home)
-    env.update(FIXTURE_GIT)
-    done = subprocess.run(["git", *args], cwd=str(cwd), env=env, input=data,
-                          capture_output=True, text=True, check=False,
-                          timeout=STEP_TIMEOUT)
-    assert done.returncode == 0, transcript(done)
-    return done.stdout.strip()
-
-
-def tagged_origin(where: Path, tags: Tuple[str, ...]) -> Tuple[Path, str, Dict[str, str]]:
-    """A bare repository on this filesystem holding one commit and an
-    annotated tag at it for each of `tags`, and an empty repository whose
-    `origin` is it, by a `file://` URL: what the ref step fetches from.
-    Returns that repository, the commit, and each tag's object."""
-    home, origin, checkout = where / "home", where / "origin.git", where / "checkout"
-    for directory in (origin, checkout):
-        directory.mkdir(parents=True)
-    fixture_git(home, origin, "init", "--quiet", "--bare")
-    tree = fixture_git(home, origin, "mktree", data="")
-    commit = fixture_git(home, origin, "commit-tree", tree, "-m", "the release commit")
-    objects = {}
-    for tag in tags:
-        fixture_git(home, origin, "tag", "-a", tag, "-m", f"openRepoTools {tag}", commit)
-        objects[tag] = fixture_git(home, origin, "rev-parse", f"refs/tags/{tag}")
-    fixture_git(home, checkout, "init", "--quiet")
-    fixture_git(home, checkout, "remote", "add", "origin", origin.as_uri())
-    return checkout, commit, objects
-
-
-def a_checkout(where: Path) -> Tuple[Path, str]:
-    """A repository on this filesystem with one commit, a tracked file and a
-    `.gitignore` that ignores `*.log`: a checkout as a build step finds it.
-    Returns it and its commit."""
-    home, checkout = where / "home", where / "checkout"
-    checkout.mkdir(parents=True)
-    fixture_git(home, checkout, "init", "--quiet")
-    (checkout / "tracked.txt").write_text("the commit's own\n", encoding="utf-8")
-    (checkout / ".gitignore").write_text("*.log\n", encoding="utf-8")
-    fixture_git(home, checkout, "add", "tracked.txt", ".gitignore")
-    fixture_git(home, checkout, "commit", "--quiet", "-m", "the release commit")
-    return checkout, fixture_git(home, checkout, "rev-parse", "HEAD")
-
-
-# --- HEAD, as git holds it -------------------------------------------------------
-
-@functools.lru_cache(maxsize=1)
-def head() -> Tuple[str, Dict[str, Tuple[str, str, str]]]:
-    """HEAD's commit, and every path in its tree as `(mode, type, object)`."""
-    sha = subprocess.run(["git", "rev-parse", "HEAD"], cwd=str(REPO),
-                         capture_output=True, text=True,
-                         check=True).stdout.strip()
-    raw = subprocess.run(["git", "ls-tree", "-r", "-z", sha], cwd=str(REPO),
-                         capture_output=True, check=True).stdout
-    tree = {}
-    for record in raw.split(b"\0"):
-        if record:
-            meta, _, path = record.partition(b"\t")
-            mode, kind, oid = meta.decode("ascii").split(" ")
-            tree[path.decode("utf-8")] = (mode, kind, oid)
-    return sha, tree
-
-
-@functools.lru_cache(maxsize=None)
-def blob(oid: str) -> bytes:
-    return subprocess.run(["git", "cat-file", "blob", oid], cwd=str(REPO),
-                          capture_output=True, check=True).stdout
-
-
-def head_blob(path: str) -> bytes:
-    mode, kind, oid = head()[1][path]
-    assert kind == "blob", f"HEAD's {path} is a {kind}, not a file"
-    return blob(oid)
-
-
-def stamped(text: str, release: dict) -> str:
-    """`text`, the committed stamp, with each of its five assignment lines
-    replaced by the release's, as the writer replaces them."""
-    lines = text.split("\n")
-    for name in layout.STAMP_FIELDS:
-        committed = f'{name} = "{layout.UNSTAMPED[name]}"'
-        at = [i for i, line in enumerate(lines) if line == committed]
-        assert len(at) == 1, f"the committed stamp holds {committed!r} {len(at)} times"
-        lines[at[0]] = f'{name} = "{release[name]}"'
-    return "\n".join(lines)
-
-
-# --- trigger -------------------------------------------------------------------
-
-@NEEDS_UPSTREAM
-def test_release_trigger_a_dispatch_with_a_version_is_the_only_trigger():
-    """NOTHING RUNS ON A PUSH, A TAG OR A PULL REQUEST (FR-028): an upload is
-    an act Brett Heap approves, so a dispatch with a required `version`
-    string is the workflow's one trigger."""
-    workflow = release()
-    on = workflow.get("on")
-    assert isinstance(on, dict) and list(on) == ["workflow_dispatch"], (
-        f"release.yml's triggers are {on!r}, not a dispatch alone")
-    inputs = (on["workflow_dispatch"] or {}).get("inputs") or {}
-    assert list(inputs) == ["version"], f"the dispatch's inputs are {list(inputs)}"
-    version = inputs["version"]
-    assert version.get("required") is True, version
-    assert version.get("type") == "string", version
-    assert version.get("description"), "the version input has no description"
-
-
-@NEEDS_UPSTREAM
-def test_release_trigger_grants_nothing_at_the_top_and_runs_one_release_at_a_time():
-    """contracts/workflows.md's shape: `permissions: {}`, so each job grants
-    its own; the `release` concurrency group, never cancelling a release
-    halfway; `bash` by default; and `VERSION` and `PYTHONUTF8` in `env`."""
-    workflow = release()
-    assert workflow.get("permissions") == {}, (
-        f"release.yml grants {workflow.get('permissions')!r} at the top")
-    assert workflow.get("concurrency") == {"group": "release",
-                                           "cancel-in-progress": False}, (
-        workflow.get("concurrency"))
-    assert workflow.get("defaults") == {"run": {"shell": "bash"}}, (
-        workflow.get("defaults"))
-    assert workflow.get("env") == {"VERSION": "${{ inputs.version }}",
-                                   "PYTHONUTF8": "1"}, workflow.get("env")
-
-
-@NEEDS_UPSTREAM
-def test_release_trigger_the_input_reaches_every_script_through_the_environment():
-    """NO EXPRESSION IS PASTED INTO A SCRIPT (contracts/workflows.md's shape):
-    the input is `$VERSION`, which no script can be made to run, and no
-    `run:` block holds a `${{`."""
-    workflow = release()
-    pasted = [f"{name}: {label(step)}" for name, step in every_step(workflow)
-              if "${{" in run_text(step)]
-    assert not pasted, f"steps with an expression in their script: {pasted}"
-
-
-# --- the hash locks ------------------------------------------------------------
-
-def lock_entries(path: Path) -> Dict[str, List[str]]:
-    """`name==version ; marker` -> its sha256 digests, from a hash lock;
-    continuation lines joined, comment lines dropped (the model's
-    `lock_entries()`, `tests/test_release_workflow.py:105-115`). A requirement
-    the lock writes twice is named here, not folded into one entry."""
-    text = "\n".join(line for line in path.read_text(encoding="utf-8")
-                     .splitlines() if not line.lstrip().startswith("#"))
-    entries: Dict[str, List[str]] = {}
-    for entry in re.sub(r"\\\n", " ", text).splitlines():
-        if entry.strip():
-            requirement = entry.split("--hash=")[0].strip()
-            assert requirement not in entries, (
-                f"{path.name} writes {requirement!r} twice")
-            entries[requirement] = re.findall(r"--hash=sha256:(\S+)", entry)
-    return entries
-
-
-@pytest.mark.parametrize("lock", [BUILD_LOCK, PIPX_LOCK], ids=["build", "pipx"])
-def test_release_lock_every_entry_is_one_version_named_by_its_sha256(lock):
-    """A LOCK IS ONE VERSION PER ENTRY, BY DIGEST: every requirement pinned
-    `==` one version, with a marker or none, and every `--hash` a sha256 of
-    64 hex digits, so `--require-hashes` installs exactly the files named."""
-    entries = lock_entries(lock)
-    assert entries, f"{lock.name} names nothing"
-    for requirement, digests in entries.items():
-        assert re.fullmatch(r"[a-z0-9-]+==[0-9][0-9A-Za-z.]*( ; .+)?",
-                            requirement), requirement
-        assert digests, f"{requirement} carries no sha256"
-        for digest in digests:
-            assert re.fullmatch(r"[0-9a-f]{64}", digest), (requirement, digest)
-    algorithms = set(re.findall(r"--hash=([A-Za-z0-9]+):",
-                                lock.read_text(encoding="utf-8")))
-    assert algorithms == {"sha256"}, f"{lock.name} names digests by {algorithms}"
-
-
-def build_system_requires() -> list:
-    """`[build-system] requires`, by TOML where a parser imports, and by its
-    line otherwise (Python 3.9 has no `tomllib`)."""
-    text = PYPROJECT.read_text(encoding="utf-8")
-    try:
-        import tomllib as toml
-    except ImportError:
-        try:
-            import tomli as toml
-        except ImportError:
-            toml = None
-    if toml is not None:
-        return toml.loads(text)["build-system"]["requires"]
-    section = text.split("[build-system]", 1)[1].split("\n[", 1)[0]
-    [line] = [line for line in section.splitlines()
-              if line.strip().startswith("requires")]
-    return re.findall(r'"([^"]+)"', line)
-
-
-def test_release_lock_the_build_lock_s_hatchling_is_pyproject_s_pin():
-    """`hatchling==1.27.0` TWICE, AND THE SAME (FR-030, research R11): with
-    `--no-isolation`, `build` refuses a backend that does not satisfy
-    `[build-system] requires`, so the lock's one hatchling entry is
-    `pyproject.toml`'s pin, and the lock carries hatchling's own requirements
-    and the `build` frontend beside it."""
-    [backend] = build_system_requires()
-    entries = lock_entries(BUILD_LOCK)
-    hatchling = [r.split(" ;")[0] for r in entries if r.startswith("hatchling==")]
-    assert hatchling == [backend], (
-        f"the build lock pins {hatchling}, and pyproject.toml requires {backend}")
-    names = {r.split("==")[0] for r in entries}
-    for name in ("build", "packaging", "pathspec", "pluggy", "trove-classifiers",
-                 "tomli"):
-        assert name in names, f"the build lock does not carry {name}"
-
-
-def marker_holds(marker: str, python: Tuple[int, ...]) -> bool:
-    """A lock marker made of `python_full_version` comparisons joined by
-    `and`, evaluated for `python`. Any other marker is not one this test
-    reads, and fails it."""
-    operators = {"<": lambda a, b: a < b, "<=": lambda a, b: a <= b,
-                 ">": lambda a, b: a > b, ">=": lambda a, b: a >= b,
-                 "==": lambda a, b: a == b, "!=": lambda a, b: a != b}
-    verdict = True
-    for clause in marker.split(" and "):
-        found = re.fullmatch(r"\s*python_full_version (<=|>=|==|!=|<|>) "
-                             r"'([0-9.]+)'\s*", clause)
-        assert found, f"a pipx entry's marker holds {clause!r}"
-        bound = tuple(int(part) for part in found.group(2).split("."))
-        bound = bound + (0,) * (3 - len(bound))
-        verdict = verdict and operators[found.group(1)](python, bound)
-    return verdict
-
-
-def test_release_lock_pipx_is_1_11_1_below_python_3_10_and_1_17_8_from_3_10():
-    """THE INSTALL CHECK'S pipx (research R11): 1.11.1, the newest that
-    installs on 3.9, below 3.10, and 1.17.8 from 3.10. Each Python a leg can
-    run is given exactly one pipx entry, read from the markers as pip reads
-    them."""
-    pipx = {}
-    for requirement in lock_entries(PIPX_LOCK):
-        name_version, _, marker = requirement.partition(" ; ")
-        if name_version.startswith("pipx=="):
-            pipx[name_version.split("==")[1]] = marker
-    assert set(pipx) == {"1.11.1", "1.17.8"}, f"the pipx lock pins pipx {sorted(pipx)}"
-    for python in ((3, 9, 0), (3, 9, 25), (3, 10, 0), (3, 10, 2), (3, 11, 9),
-                   (3, 12, 3), (3, 13, 1), (3, 14, 0)):
-        given = [v for v, marker in pipx.items() if marker_holds(marker, python)]
-        wanted = ["1.11.1"] if python < (3, 10) else ["1.17.8"]
-        assert given == wanted, (
-            f"on Python {'.'.join(map(str, python))} the lock gives pipx "
-            f"{given}, not {wanted}")
-
-
-def test_release_lock_the_fixtures_mirror_the_pipx_the_lock_installs():
-    """THE LOCK'S pipx RELEASES ARE THE FIXTURES' (the lock's own header):
-    `tests/package_layout.py` lays venvs out as each pipx the install check
-    runs, so a resolution that moves pipx must move the fixtures too."""
-    locked = {r.split(" ;")[0].split("==")[1] for r in lock_entries(PIPX_LOCK)
-              if r.startswith("pipx==")}
-    assert locked <= set(layout.PIPX_RELEASES), (
-        f"the lock installs pipx {sorted(locked)}, and the fixtures mirror "
-        f"{sorted(layout.PIPX_RELEASES)}")
-
-
-# --- the build job: what it is --------------------------------------------------
-
-@NEEDS_UPSTREAM
-def test_release_build_checks_out_the_commit_with_its_submodule_its_history_and_no_credentials():
-    """THE BUILD'S CHECKOUT (contracts/workflows.md): `submodules: true`,
-    because the digest code exists here only in the submodule; full history,
-    for the main and release-branch check; and `persist-credentials: false`,
-    so no code the build runs can read the token from git's config."""
-    workflow = release()
-    steps = steps_of(workflow, "build")
-    checkouts = [s for s in steps
-                 if str(s.get("uses", "")).startswith("actions/checkout@")]
-    assert len(checkouts) == 1 and steps[0] is checkouts[0], (
-        f"the build's first step is not its one checkout: {[label(s) for s in steps]}")
-    options = checkouts[0].get("with") or {}
-    assert options.get("submodules") is True, options
-    assert str(options.get("fetch-depth")) == "0", options
-    assert options.get("persist-credentials") is False, options
-
-
-@NEEDS_UPSTREAM
-def test_release_build_every_action_is_pinned_by_a_full_commit_with_its_release_tag():
-    """EVERY `uses:` IS A FULL COMMIT, its release tag beside it as a comment,
-    and each is one contracts/workflows.md names: checkout and setup-python at
-    `tests.yml`'s own commits and comments, the artifact actions at the
-    model's, and the publish action at v1.14.2's. The parsed references and
-    the written lines are the same list, so no `uses:` hides from either."""
-    workflow = release()
-    parsed = [str(step["uses"]) for _, step in every_step(workflow)
-              if "uses" in step]
-    assert parsed, "release.yml uses no action at all"
-    written = uses_lines(WORKFLOW)
-    lines = [m for m in (USES_LINE.match(line) for line in
-                         WORKFLOW.read_text(encoding="utf-8").splitlines()) if m]
-    assert sorted(m.group(1) for m in lines) == sorted(parsed)
-    tests_pins, model_pins = uses_lines(TESTS_WORKFLOW), uses_lines(MODEL)
-    problems = []
-    for ref in sorted(set(parsed)):
-        action, comment = ref.split("@")[0], written.get(ref, "")
-        if not COMMIT_PIN.fullmatch(ref):
-            problems.append(f"{ref}: not pinned by 40 hex digits")
-        if not re.fullmatch(r"# v\S+", comment):
-            problems.append(f"{ref}: its release tag is not written beside it")
-        if action in ("actions/checkout", "actions/setup-python"):
-            known = tests_pins
-        elif action in ("actions/upload-artifact", "actions/download-artifact"):
-            known = model_pins
-        elif action == "pypa/gh-action-pypi-publish":
-            known = {PUBLISH: PUBLISH_TAG}
-        else:
-            problems.append(f"{ref}: an action contracts/workflows.md does not name")
-            continue
-        if known.get(ref) != comment:
-            problems.append(f"{ref} {comment}: not the pin "
-                            f"{[k + ' ' + v for k, v in known.items() if k.startswith(action + '@')]}")
-    assert not problems, "release.yml's actions:\n  " + "\n  ".join(problems)
-
-
-@NEEDS_UPSTREAM
-def test_release_build_its_steps_are_the_model_s_in_the_model_s_order():
-    """THE MODEL'S STEPS, IN ITS ORDER (contracts/workflows.md, steps 1 to
-    14): the guard first; the ref and the branch-membership checks together;
-    the clean checkout before anything from it runs; the environments and the
-    gate; the digest; the tools; two extractions, stamped and built; the
-    wheel check right after the build and right before the record; and the
-    wheel kept as an artifact after it."""
-    workflow = release()
-    found = [guard_step(workflow)] + [named(workflow, "build", prefix)
-                                      for prefix in BUILD_STEPS]
-    at = [where(workflow, "build", step) for step in found]
-    names = [label(step) for step in found]
-    assert at == sorted(at) and len(set(at)) == len(at), (
-        "the build's steps are not in contracts/workflows.md's order:\n  "
-        + "\n  ".join(f"{i}: {n}" for i, n in sorted(zip(at, names))))
-    position = dict(zip((None,) + BUILD_STEPS, at))
-    assert position[ON_BRANCH_STEP] == position[REF_STEP] + 1
-    assert position[WHEEL_CHECK_STEP] == position[BUILD_STEP] + 1
-    assert position[RECORD_STEP] == position[WHEEL_CHECK_STEP] + 1
-    later = steps_of(workflow, "build")[position[RECORD_STEP] + 1:]
-    assert [s for s in later
-            if str(s.get("uses", "")).startswith("actions/upload-artifact@")], (
-        "the wheel is not kept as an artifact after it is recorded")
-
-
-@NEEDS_UPSTREAM
-def test_release_build_no_step_is_conditional_and_none_carries_on_past_a_failure():
-    """EACH STEP IS A REFUSAL ON FAILURE (contracts/workflows.md): the build
-    runs on every dispatch, so neither it nor any of its steps carries an
-    `if:` that could skip a check, and nothing continues past a failed step."""
-    workflow = release()
-    build = job(workflow, "build")
-    assert "if" not in build, f"the build job runs only if {build['if']!r}"
-    assert "continue-on-error" not in build
-    for step in steps_of(workflow, "build"):
-        assert "if" not in step, f"{label(step)} runs only if {step['if']!r}"
-        assert "continue-on-error" not in step, label(step)
-
-
-PIP_INSTALL = re.compile(r"\bpip3? install\b")
-
-
-def pip_installs(workflow: dict, name: str) -> List[str]:
-    return [command for step in steps_of(workflow, name)
-            for command in commands(run_text(step)) if PIP_INSTALL.search(command)]
-
-
-def hashed_from(command: str, lock: Path) -> List[str]:
-    """What is wrong with `command` as an install from `lock` by hash."""
-    problems = []
-    if "--require-hashes" not in command:
-        problems.append("no --require-hashes")
-    if not re.search(r"--only-binary(?:\s+|=):all:", command):
-        problems.append("not wheels only (--only-binary :all:)")
-    named_locks = [m.group(2) for m in re.finditer(
-        r"(?:^|\s)(?:-r|--requirement)(?:\s+|=)(\"?)([^\s\"]+)\1", command)]
-    want = lock.relative_to(REPO).as_posix()
-    if len(named_locks) != 1 or not named_locks[0].endswith(want):
-        problems.append(f"reads {named_locks}, not {want} alone")
-    return problems
-
-
-@NEEDS_UPSTREAM
-def test_release_build_installs_its_tools_from_the_build_lock_by_hash():
-    """EVERY `pip install` THE BUILD RUNS (FR-030, FR-035), read as the shell
-    reads it, is `--require-hashes`, wheels only, from
-    `.github/release-build-requirements.txt` and nothing else."""
-    workflow = release()
-    installs = pip_installs(workflow, "build")
-    assert installs, "the build installs nothing from its lock"
-    problems = {command: hashed_from(command, BUILD_LOCK) for command in installs}
-    assert not any(problems.values()), problems
-
-
-@NEEDS_UPSTREAM
-def test_release_build_builds_twice_from_two_git_archive_extractions_and_compares():
-    """FR-030: `git archive` of the commit into two directories, a wheel only
-    from each with `python -m build --wheel --no-isolation` at
-    `SOURCE_DATE_EPOCH` the commit's own time, and the two compared with
-    `cmp` before anything else reads them."""
-    workflow = release()
-    extract = run_text(named(workflow, "build", EXTRACT_STEP))
-    assert "git archive" in extract and "GITHUB_SHA" in extract, extract
-    build = run_text(named(workflow, "build", BUILD_STEP))
-    assert "SOURCE_DATE_EPOCH" in build and "%ct" in build, build
-    assert "-m build --wheel --no-isolation" in " ".join(commands(build)), build
-    assert "--sdist" not in build
-    assert re.search(r"(?<![\w-])cmp\s", build), "the two wheels are not compared"
-
-
-@NEEDS_UPSTREAM
-def test_release_build_records_the_wheel_its_sha256_the_digest_and_the_guard_s_answers():
-    """STEP 14: the build's outputs are the wheel's name, its sha256, the
-    digest and step 1's `to-testpypi` and `to-pypi`, each read from a step of
-    the build that exists. The record step and the digest step each feed
-    one."""
-    workflow = release()
-    outputs = build_outputs(workflow)
-    ids = {s.get("id") for s in steps_of(workflow, "build") if s.get("id")}
-    sources = {}
-    for name, value in outputs.items():
-        found = STEP_OUTPUT.fullmatch(str(value).strip())
-        assert found and found.group(1) in ids, (
-            f"the build's output {name} is {value!r}, no build step's output")
-        sources[name] = found.group(1)
-    assert {"to-testpypi", "to-pypi"} <= set(outputs) and len(outputs) >= 5, (
-        f"the build records {sorted(outputs)}")
-    for prefix in (RECORD_STEP, DIGEST_STEP):
-        step = named(workflow, "build", prefix)
-        assert step.get("id") in sources.values(), (
-            f"no output of the build job comes from {label(step)!r}")
-
-
-@NEEDS_UPSTREAM
-def test_release_build_the_checkout_and_both_environments_are_read_before_the_build():
-    """STEPS 4 AND 5: the checkout is `$GITHUB_SHA` and clean before anything
-    from it runs, and each environment names a required reviewer and admits
-    the one deployment rule, the tags `v*`, as the model reads them."""
-    workflow = release()
-    clean = run_text(named(workflow, "build", CLEAN_STEP))
-    assert "GITHUB_SHA" in clean and "status --porcelain" in clean, clean
-    environments = run_text(named(workflow, "build", ENVIRONMENTS_STEP))
-    for word in ("testpypi", "pypi", "required_reviewers", "custom_branch_policies",
-                 "deployment-branch-policies", "v*"):
-        assert word in environments, f"the environments step never reads {word}"
-
-
-#: STEP 4, RUN: `(what is done to the checkout, whether HEAD is the run's
-#: commit, whether the step passes)`.
-CLEAN_CASES = {
-    "this-commit-and-clean": (None, True, True),
-    "another-commit-checked-out": (None, False, False),
-    "a-tracked-file-changed": (("tracked.txt", "changed\n"), True, False),
-    "a-file-added": (("added.txt", "new\n"), True, False),
-    "an-ignored-file-added": (("build.log", "ignored\n"), True, False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", CLEAN_CASES)
-def test_release_build_the_clean_step_refuses_a_moved_or_dirty_checkout(tmp_path, which):
-    """STEP 4, RUN, in a repository on this filesystem (FR-029: "the checkout
-    is that commit, and it is clean"): it passes the run's commit with
-    nothing changed, and refuses another commit, a tracked file changed, a
-    file added, and an ignored file added."""
-    change, at_the_run_s_commit, passes = CLEAN_CASES[which]
-    checkout, commit = a_checkout(tmp_path / "git")
-    if change is not None:
-        (checkout / change[0]).write_text(change[1], encoding="utf-8")
-    values = {"GITHUB_SHA": commit if at_the_run_s_commit else "e" * 40}
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "build", values)
-    done = runner.run(named(workflow, "build", CLEAN_STEP), cwd=checkout)
-    assert (done.returncode == 0) == passes, transcript(done)
-    if not passes:
-        assert "::error::" in done.stdout, transcript(done)
-        if change is not None:
-            assert change[0] in done.stdout, transcript(done)
-
-
-def an_environment(reviewers: Tuple[str, ...] = ("brettheap",),
-                   custom: bool = True) -> dict:
-    """An environment as `GET repos/<r>/environments/<name>` returns it."""
-    rules = ([{"type": "required_reviewers",
-               "reviewers": [{"type": "User", "reviewer": {"login": login}}
-                             for login in reviewers]}] if reviewers else [])
-    return {"protection_rules": rules + [{"type": "branch_policy"}],
-            "deployment_branch_policy": {"protected_branches": not custom,
-                                         "custom_branch_policies": custom}}
-
-
-def environment_answers(repository: str, changes: dict) -> dict:
-    """Both environments as Brett Heap sets them up, a required reviewer and
-    the one deployment rule `('tag', 'v*')` each, with `changes` by
-    environment: `reviewers`, `custom`, `rules`, or `missing`."""
-    answers = {}
-    for name in ("testpypi", "pypi"):
-        change = changes.get(name, {})
-        if change.get("missing"):
-            continue
-        rules = change.get("rules", [("tag", "v*")])
-        answers[f"repos/{repository}/environments/{name}"] = an_environment(
-            change.get("reviewers", ("brettheap",)), change.get("custom", True))
-        answers[f"repos/{repository}/environments/{name}/deployment-branch-policies"] = {
-            "total_count": len(rules),
-            "branch_policies": [{"type": kind, "name": pattern} for kind, pattern in rules]}
-    return answers
-
-
-#: STEP 5, RUN: `(the changes to both environments, the environment a
-#: refusal names, or None where the step passes)`.
-ENVIRONMENT_CASES = {
-    "both-as-set-up": ({}, None),
-    "testpypi-not-created-yet": ({"testpypi": {"missing": True}}, "testpypi"),
-    "pypi-names-no-reviewer": ({"pypi": {"reviewers": ()}}, "pypi"),
-    "a-branch-rule-beside-the-tags": (
-        {"testpypi": {"rules": [("tag", "v*"), ("branch", "main")]}}, "testpypi"),
-    "a-branch-rule-alone": ({"pypi": {"rules": [("branch", "v*")]}}, "pypi"),
-    "another-tag-pattern": ({"pypi": {"rules": [("tag", "v1.*")]}}, "pypi"),
-    "protected-branches-not-custom-rules": ({"testpypi": {"custom": False}}, "testpypi"),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", ENVIRONMENT_CASES)
-def test_release_build_the_environments_step_refuses_an_environment_without_its_rules(
-        tmp_path, which):
-    """STEP 5, RUN under a forge (FR-029): both environments as set up pass;
-    an environment not created yet, one with no required reviewer, one
-    whose deployment limit holds a branch rule or another pattern, and one
-    limited to protected branches are each refused, naming it."""
-    changes, refused = ENVIRONMENT_CASES[which]
-    forge, values = api_forge(tmp_path, environment_answers(CODE_LEG, changes))
-    values["GITHUB_REPOSITORY"] = CODE_LEG
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "build", values, forge)
-    done = runner.run(named(workflow, "build", ENVIRONMENTS_STEP))
-    assert (done.returncode == 0) == (refused is None), transcript(done)
-    if refused is not None:
-        assert [line for line in done.stdout.splitlines() if line.startswith(
-            f"::error::the {refused} environment")], transcript(done)
-
-
-#: The build step's two builds, faked: `$RUNNER_TEMP/tools/bin/python -m build
-#: ... --outdir <dir> .` writes each name in its tree's `build-names` into
-#: `<dir>`, with its tree's `build-output` bytes, and writes down where it ran
-#: and with which SOURCE_DATE_EPOCH.
-FAKE_BUILD = r'''
-import os, sys
-args = sys.argv[1:]
-with open(os.environ["FAKE_BUILD_LOG"], "a", encoding="utf-8") as log:
-    log.write("\t".join([os.getcwd(), os.environ.get("SOURCE_DATE_EPOCH", "<unset>"),
-                         " ".join(args)]) + "\n")
-out = args[args.index("--outdir") + 1]
-os.makedirs(out, exist_ok=True)
-with open("build-output", "rb") as handle:
-    data = handle.read()
-with open("build-names", encoding="utf-8") as handle:
-    names = handle.read().split()
-for name in names:
-    with open(os.path.join(out, name), "wb") as handle:
-        handle.write(data)
-'''
-
-BUILT = "openrepotools-1.1.0-py3-none-any.whl"
-
-#: THE BUILD STEP, RUN: `(the first build's bytes and names, the second's,
-#: whether the step passes)`.
-BUILD_CASES = {
-    "two-builds-one-file": ((b"the wheel", [BUILT]), (b"the wheel", [BUILT]), True),
-    "two-builds-two-files": ((b"the wheel", [BUILT]), (b"another wheel", [BUILT]), False),
-    "a-build-of-another-name": (
-        (b"the wheel", [BUILT]), (b"the wheel", ["openrepotools-1.1.0-py3-none-any.zip"]),
-        False),
-    "a-build-of-two-files": (
-        (b"the wheel", [BUILT]), (b"the wheel", [BUILT, "openrepotools-1.1.0.tar.gz"]),
-        False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("sha256sum") is None or shutil.which("cmp") is None,
-                    reason="the build step runs GNU's sha256sum and cmp")
-@pytest.mark.parametrize("which", BUILD_CASES)
-def test_release_build_the_build_step_compares_the_two_builds_byte_for_byte(tmp_path, which):
-    """THE BUILD STEP, RUN, with the backend faked (FR-030): it builds once in
-    each extraction, at the commit's own time, and passes two builds that
-    are one file; two builds of different bytes (its `cmp`), a build of
-    another name, and a build that leaves two files are each refused."""
-    first, second, passes = BUILD_CASES[which]
-    checkout, commit = a_checkout(tmp_path / "git")
-    trees = [tmp_path / "a" / "openRepoTools", tmp_path / "b" / "elsewhere" / "v1.1.0-src"]
-    for tree, (data, names) in zip(trees, (first, second)):
-        tree.mkdir(parents=True)
-        (tree / "build-output").write_bytes(data)
-        (tree / "build-names").write_text("\n".join(names) + "\n", encoding="utf-8")
-    log = tmp_path / "build.log"
-    values = {"VERSION": "1.1.0", "GITHUB_SHA": commit, "TREE_A": str(trees[0]),
-              "TREE_B": str(trees[1]), "FAKE_BUILD_LOG": str(log)}
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "build", values)
-    python_tool(Path(runner.env["RUNNER_TEMP"]) / "tools" / "bin", "python", FAKE_BUILD)
-    done = runner.run(named(workflow, "build", BUILD_STEP), cwd=checkout)
-    assert (done.returncode == 0) == passes, transcript(done)
-    when = fixture_git(tmp_path / "git" / "home", checkout, "log", "-1", "--format=%ct", commit)
-    builds = [line.split("\t") for line in log.read_text(encoding="utf-8").splitlines()]
-    temp = runner.env["RUNNER_TEMP"]
-    assert builds[0] == [str(trees[0]), when,
-                         f"-m build --wheel --no-isolation --outdir {temp}/dist-a ."], builds
-    if passes or which == "two-builds-two-files":
-        assert [b[:2] for b in builds] == [[str(trees[0]), when], [str(trees[1]), when]], builds
-    if not passes:
-        assert "::error::" in done.stdout, transcript(done)
-
-
-# --- the ref step and the branch step: the rehearsal rule ------------------------
-
-REHEARSAL_BRANCHES = ["refs/heads/l3-rehearsal-v1.1.0", "refs/heads/main",
-                      "refs/heads/release/v1.1", "refs/heads/feature/a-b"]
-
-
-def ref_values(ref: str, version: str) -> dict:
-    return {"GITHUB_REF": ref, "GITHUB_REF_NAME": ref_name(ref),
-            "GITHUB_SHA": "c" * 40, "GITHUB_REPOSITORY": CODE_LEG,
-            "VERSION": version}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("ref", REHEARSAL_BRANCHES)
-def test_release_build_the_ref_step_passes_a_branch_as_the_rehearsal(tmp_path, ref):
-    """STEP 2 ON A BRANCH (FR-029, the model's `release.yml:206-241`): a
-    branch dispatch is the rehearsal, so the tag checks stand down and the
-    step passes without asking the forge for a tag that does not exist."""
-    workflow = release()
-    runner = Runner(tmp_path, workflow, "build", ref_values(ref, "1.1.0rc1"))
-    done = runner.run(named(workflow, "build", REF_STEP))
-    assert done.returncode == 0, transcript(done)
-    assert runner.asked() == "", f"a rehearsal asked:\n{runner.asked()}"
-
-
-OTHER_REFS = {
-    "a-pull-request": ("refs/pull/7/merge", "1.1.0"),
-    "a-remote-branch": ("refs/remotes/origin/main", "1.1.0"),
-    "a-note": ("refs/notes/commits", "1.1.0"),
-    "no-ref-at-all": ("", "1.1.0"),
-    "another-version-s-tag": ("refs/tags/v1.0.0", "1.1.0"),
-    "a-tag-without-its-v": ("refs/tags/1.1.0", "1.1.0"),
-    "an-rc-tag-for-the-final": ("refs/tags/v1.1.0rc1", "1.1.0"),
-    "the-tag-the-forge-does-not-hold": ("refs/tags/v1.1.0", "1.1.0"),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", OTHER_REFS)
-def test_release_build_the_ref_step_refuses_any_other_ref(tmp_path, which):
-    """STEP 2 ON EVERYTHING ELSE (FR-029): a ref that is neither a branch nor
-    the tag `v$VERSION` is refused, and so is that tag where the forge holds
-    no annotated tag of that name (its `gh` refuses every question here)."""
-    ref, version = OTHER_REFS[which]
-    workflow = release()
-    runner = Runner(tmp_path, workflow, "build", ref_values(ref, version))
-    done = runner.run(named(workflow, "build", REF_STEP))
-    assert done.returncode != 0, transcript(done)
-
-
-@NEEDS_UPSTREAM
-def test_release_build_the_ref_step_reads_the_tag_from_the_forge_and_from_git():
-    """ON A TAG, BOTH READINGS (contracts/workflows.md, step 2): the annotated
-    tag object `v$VERSION` as the forge's API answers for it and as git's own
-    `refs/tags/` holds it, each held to `$GITHUB_SHA`."""
-    script = run_text(named(release(), "build", REF_STEP))
-    assert re.search(r"/git/(?:refs?/tags/|tags/)", script), (
-        "the ref step reads no tag from the forge")
-    assert [line for line in commands(script)
-            if re.search(r"\bgit\s", line) and "refs/tags/" in line], (
-        "the ref step reads no tag from git")
-    assert "$GITHUB_SHA" in script
-
-
-#: STEP 2 ON A TAG, where the forge and `origin` both hold the annotated tag
-#: `v1.1.0` at the run's commit (and `v1.1.0-again`, another tag object at
-#: it): `(the dispatched ref, the version, what the forge says otherwise,
-#: whether the step passes)`. So what refuses is the step's own comparison:
-#: the ref against `refs/tags/v$VERSION`, the forge's tag object against the
-#: tag and the commit, and git's copy against the forge's.
-REF_TAG_CASES = {
-    "the-version-s-own-tag": ("refs/tags/v1.1.0", "1.1.0", {}, True),
-    "another-version-s-tag": ("refs/tags/v1.0.0", "1.1.0", {}, False),
-    "the-tag-without-its-v": ("refs/tags/1.1.0", "1.1.0", {}, False),
-    "the-rc-tag-for-the-final": ("refs/tags/v1.1.0rc1", "1.1.0", {}, False),
-    "the-forge-s-tag-names-another-commit": (
-        "refs/tags/v1.1.0", "1.1.0", {"names": "d" * 40}, False),
-    "the-forge-s-tag-object-has-another-name": (
-        "refs/tags/v1.1.0", "1.1.0", {"name": "v1.1.1"}, False),
-    "the-forge-s-tag-names-a-tag": ("refs/tags/v1.1.0", "1.1.0", {"type": "tag"}, False),
-    "a-lightweight-tag-on-the-forge": (
-        "refs/tags/v1.1.0", "1.1.0", {"lightweight": True}, False),
-    "the-forge-s-tag-object-is-not-git-s": (
-        "refs/tags/v1.1.0", "1.1.0", {"object": "v1.1.0-again"}, False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", REF_TAG_CASES)
-def test_release_build_the_ref_step_holds_the_ref_the_forge_and_git_to_v_version_at_this_commit(
-        tmp_path, which):
-    """STEP 2 ON A TAG, RUN (FR-029), with `origin` a bare repository on
-    this filesystem: on `refs/tags/v1.1.0`, the annotated tag the forge and
-    git both hold at the run's commit, it passes, fetching that tag. A ref
-    that is another version's tag, the tag without its `v` or an rc's tag is
-    refused before the forge is asked. A forge whose tag object names
-    another commit, has another name, names a tag, or is a lightweight tag,
-    and a git copy that is not the forge's object, are each refused."""
-    ref, version, lie, passes = REF_TAG_CASES[which]
-    checkout, commit, objects = tagged_origin(tmp_path / "git", ("v1.1.0", "v1.1.0-again"))
-    lie = dict(lie)
-    object_ = objects[lie.pop("object", "v1.1.0")]
-    forge, values = api_forge(tmp_path, annotated_tag(CODE_LEG, "v1.1.0", object_,
-                                                      commit, **lie))
-    values.update(GITHUB_REF=ref, GITHUB_REF_NAME=ref_name(ref), GITHUB_SHA=commit,
-                  GITHUB_REPOSITORY=CODE_LEG, VERSION=version)
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "build", values, forge)
-    done = runner.run(named(workflow, "build", REF_STEP), cwd=checkout)
-    assert (done.returncode == 0) == passes, transcript(done)
-    if passes:
-        assert done.stdout.strip().endswith(
-            f"v1.1.0: annotated, tag object {objects['v1.1.0']}, at {commit}"), transcript(done)
-        assert fixture_git(tmp_path / "git" / "home", checkout, "rev-parse",
-                           "refs/tags/v1.1.0") == objects["v1.1.0"]
-    else:
-        assert "::error::" in done.stdout, transcript(done)
-    if ref != f"refs/tags/v{version}":
-        assert forge_asked(tmp_path) == [], (
-            f"the step asked the forge about a ref it must refuse: {forge_asked(tmp_path)}")
-
-
-#: A `gh` that answers `compare` as the forge does (`FORGE_COMPARE`, a JSON map
-#: of branch to status as `compare/<commit>...<branch>` reads, flipped where a
-#: script asks the other way round), writes down each branch it was asked
-#: about, and answers anything else, or a branch with no status, as a 404.
-COMPARE_FORGE = r'''
-import json, os, sys
-args = sys.argv[1:]
-paths = [a for a in args[1:] if "/compare/" in a]
-if args[:1] != ["api"] or len(paths) != 1:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-base, _, head = paths[0].split("/compare/", 1)[1].partition("...")
-sha = os.environ["FORGE_COMMIT"]
-flip = base != sha
-branch = (base if flip else head)
-for prefix in ("refs/heads/", "heads/"):
-    if branch.startswith(prefix):
-        branch = branch[len(prefix):]
-with open(os.environ["FORGE_LOG"], "a", encoding="utf-8") as log:
-    log.write(branch + "\n")
-status = json.loads(os.environ["FORGE_COMPARE"]).get(branch)
-if status is None:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-if flip:
-    status = {"ahead": "behind", "behind": "ahead"}.get(status, status)
-jq = None
-for flag in ("--jq", "-q"):
-    if flag in args:
-        jq = args[args.index(flag) + 1]
-if jq is None:
-    print(json.dumps({"status": status}))
-elif jq.strip() == ".status":
-    print(status)
-else:
-    sys.stderr.write("fake forge: compare answers --jq .status alone\n")
-    sys.exit(1)
-'''
-
-#: `(ref, version, the forge's compare by branch, passes, branches it may ask)`.
-ON_BRANCH_CASES = {
-    "on-main-identical": ("refs/tags/v1.1.0", "1.1.0", {"main": "identical"},
-                          True),
-    "on-main-ahead": ("refs/tags/v1.1.0", "1.1.0", {"main": "ahead"}, True),
-    "a-patch-on-its-release-branch": (
-        "refs/tags/v1.0.1", "1.0.1",
-        {"main": "diverged", "release/v1.0": "identical"}, True),
-    "an-rc-on-its-release-branch": (
-        "refs/tags/v1.1.0rc1", "1.1.0rc1",
-        {"main": "diverged", "release/v1.1": "ahead"}, True),
-    "on-neither-with-no-release-branch": (
-        "refs/tags/v1.1.0", "1.1.0", {"main": "diverged"}, False),
-    "behind-main-and-diverged-from-the-release-branch": (
-        "refs/tags/v1.1.0", "1.1.0",
-        {"main": "behind", "release/v1.1": "diverged"}, False),
-    "on-another-line-s-release-branch": (
-        "refs/tags/v1.1.0", "1.1.0",
-        {"main": "diverged", "release/v1.0": "identical"}, False),
-    "a-pull-request-ref-the-forge-knows-nothing-of": (
-        "refs/pull/7/merge", "1.1.0", {}, False),
-    "a-branch-rehearsal": ("refs/heads/l3-rehearsal-v1.1.0", "1.1.0rc1", {},
-                           True),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", ON_BRANCH_CASES)
-def test_release_build_the_branch_step_answers_from_the_forge_s_compare(tmp_path,
-                                                                     which):
-    """STEP 3 (FR-029, the model's `release.yml:243-276`): on a tag, the
-    forge's compare must call `main` or `release/v<X.Y>` identical to the
-    commit or ahead of it, `X.Y` the version's own (`1.1` for `1.1.0rc1`),
-    and it asks about no other branch. On a branch the rehearsal has no
-    release branch to be on: the step says so, passes, and asks nothing."""
-    ref, version, statuses, passes = ON_BRANCH_CASES[which]
-    workflow = release()
-    forge = python_tool(tmp_path / "forge", "gh", COMPARE_FORGE)
-    log = tmp_path / "compare.log"
-    values = ref_values(ref, version)
-    values.update(FORGE_COMPARE=json.dumps(statuses), FORGE_LOG=str(log),
-                  FORGE_COMMIT=values["GITHUB_SHA"])
-    runner = Runner(tmp_path / "work", workflow, "build", values, forge)
-    done = runner.run(named(workflow, "build", ON_BRANCH_STEP))
-    asked = set(log.read_text(encoding="utf-8").split()) if log.exists() else set()
-    assert (done.returncode == 0) == passes, transcript(done)
-    line = "release/v" + ".".join(version.split(".")[:2])
-    if ref.startswith("refs/heads/"):
-        assert asked == set(), f"a rehearsal asked the forge about {asked}"
-        assert done.stdout.strip(), "the rehearsal does not say why it passes"
-    elif ref.startswith("refs/tags/"):
-        assert asked <= {"main", line}, (
-            f"the step asked about {sorted(asked)}; the version's branches "
-            f"are main and {line}")
-        if not passes:
-            assert asked == {"main", line}, f"refused after asking {sorted(asked)}"
-
-
-# --- the gate: tests.yml's four jobs on this commit ------------------------------
-
-#: A `gh` that answers the gate's reads as the forge does, from `FORGE_DATA`:
-#: a commit's `tests.yml` runs (`actions/runs`, or `actions/workflows/<file>/
-#: runs`, honouring `head_sha` and `event` where the query names them, as the
-#: API does, unless `FORGE_IGNORES` names one) and a run's jobs
-#: (`actions/runs/<id>/jobs`). `--jq '.<key>[]'` answers one object per line,
-#: as gh does; no `--jq` answers the page.
-RUNS_FORGE = r'''
-import json, os, re, sys, urllib.parse
-args = sys.argv[1:]
-with open(os.environ["FORGE_LOG"], "a", encoding="utf-8") as log:
-    log.write(json.dumps(args) + "\n")
-paths = [a for a in args[1:] if a.lstrip("/").startswith("repos/")]
-if args[:1] != ["api"] or len(paths) != 1:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-path, _, query = paths[0].lstrip("/").partition("?")
-params = dict(urllib.parse.parse_qsl(query))
-with open(os.environ["FORGE_DATA"], encoding="utf-8") as handle:
-    data = json.load(handle)
-repo = re.escape(os.environ["FORGE_REPOSITORY"])
-jobs = re.fullmatch(rf"repos/{repo}/actions/runs/([0-9]+)/jobs", path)
-runs = re.fullmatch(rf"repos/{repo}/actions/(?:workflows/([^/]+)/)?runs", path)
-if jobs:
-    key, rows = "jobs", data["jobs"].get(jobs.group(1), [])
-elif runs:
-    key, rows = "workflow_runs", data["runs"]
-    if runs.group(1):
-        rows = [r for r in rows if r["path"].rsplit("/", 1)[-1] == runs.group(1)]
-    ignored = os.environ.get("FORGE_IGNORES", "").split(",")
-    for name in ("head_sha", "event"):
-        if name in params and name not in ignored:
-            rows = [r for r in rows if r[name] == params[name]]
-else:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-jq = None
-for flag in ("--jq", "-q"):
-    if flag in args:
-        jq = args[args.index(flag) + 1]
-if jq is None:
-    print(json.dumps({"total_count": len(rows), key: rows}))
-elif jq.strip() == f".{key}[]":
-    for row in rows:
-        print(json.dumps(row))
-else:
-    sys.stderr.write(f"fake forge: this route answers --jq .{key}[] alone\n")
-    sys.exit(1)
-'''
-
-#: The commit every gate case is about, and a run of `tests.yml` on it.
-GATE_SHA = "c" * 40
-
-
-def a_run(number: int, event: str = "push", head_sha: str = GATE_SHA,
-          path: str = ".github/workflows/tests.yml") -> dict:
-    return {"id": number, "event": event, "head_sha": head_sha, "path": path,
-            "name": "tests", "html_url": f"https://github.invalid/run/{number}"}
-
-
-def a_job(name: str, when: str = "2026-10-18T17:00:00Z",
-          conclusion: Optional[str] = "success",
-          status: str = "completed") -> dict:
-    return {"name": name, "status": status,
-            "conclusion": conclusion if status == "completed" else None,
-            "started_at": "2026-10-18T16:30:00Z",
-            "completed_at": when if status == "completed" else None,
-            "html_url": f"https://github.invalid/job/{name}/{when}"}
-
-
-def the_four(when: str = "2026-10-18T17:00:00Z", leave_out: str = "",
-             **changes) -> list:
-    """The four gate jobs of one run, `changes` naming a job's own fields."""
-    return [a_job(name, when, **changes.get(name.replace("-", "_"), {}))
-            for name in GATE if name != leave_out]
-
-
-GATE_CASES = {
-    "a-push-run-passed": ([a_run(1)], {1: the_four()}, True, ""),
-    "a-dispatch-run-passed": ([a_run(1, "workflow_dispatch")], {1: the_four()},
-                              True, ""),
-    "a-pull-request-run-alone": ([a_run(1, "pull_request")], {1: the_four()},
-                                 False, ""),
-    "a-run-of-another-commit": ([a_run(1, head_sha="d" * 40)], {1: the_four()},
-                                False, ""),
-    "a-run-of-another-workflow": (
-        [a_run(1, path=".github/workflows/release.yml")], {1: the_four()},
-        False, ""),
-    **{f"no-{name}-job": ([a_run(1)], {1: the_four(leave_out=name)}, False,
-                          name) for name in GATE},
-    "package-still-in-progress": (
-        [a_run(1)], {1: the_four(package={"status": "in_progress"})}, False,
-        "package"),
-    "package-skipped": (
-        [a_run(1)], {1: the_four(package={"conclusion": "skipped"})}, False,
-        "package"),
-    "package-older-success-newer-failure": (
-        [a_run(1), a_run(2, "workflow_dispatch")],
-        {1: the_four("2026-10-18T17:00:00Z"),
-         2: the_four("2026-10-18T18:00:00Z", package={"conclusion": "failure"})},
-        False, "package"),
-    "package-older-failure-newer-success": (
-        [a_run(1), a_run(2, "workflow_dispatch")],
-        {1: the_four("2026-10-18T17:00:00Z", package={"conclusion": "failure"}),
-         2: the_four("2026-10-18T18:00:00Z")},
-        True, ""),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", GATE_CASES)
-def test_release_build_the_gate_decides_from_the_runs_jobs(tmp_path, which):
-    """STEP 6 (FR-029, FR-046) under a forge: each of `guard-launch-mode`,
-    `tests`, `tests-no-submodule` and `package` ran in a push or dispatch run
-    of `tests.yml` on the commit, none is still running, and the newest of
-    each to finish succeeded. A pull request's run, another commit's and
-    another workflow's do not count, and a job missing, skipped, running or
-    newest-failed refuses, naming that job."""
-    runs, jobs, passes, names = GATE_CASES[which]
-    done = run_gate(tmp_path, runs, jobs)
-    assert (done.returncode == 0) == passes, transcript(done)
-    if names:
-        assert names in done.stdout + done.stderr, (
-            f"the refusal does not name {names}:\n{transcript(done)}")
-
-
-def run_gate(tmp_path: Path, runs: list, jobs: dict,
-             ignores: str = "") -> subprocess.CompletedProcess:
-    """Step 6 under `RUNS_FORGE`, holding `runs` and their `jobs`, and
-    ignoring the query parameters `ignores` names."""
-    workflow = release()
-    data = tmp_path / "forge.json"
-    data.write_text(json.dumps({"runs": runs, "jobs": {str(k): v for k, v
-                                                       in jobs.items()}}),
-                    encoding="utf-8")
-    forge = python_tool(tmp_path / "forge", "gh", RUNS_FORGE)
-    values = {"GITHUB_REPOSITORY": CODE_LEG, "GITHUB_SHA": GATE_SHA,
-              "VERSION": "1.1.0", "FORGE_DATA": str(data),
-              "FORGE_LOG": str(tmp_path / "forge.log"),
-              "FORGE_REPOSITORY": CODE_LEG, "FORGE_IGNORES": ignores}
-    runner = Runner(tmp_path / "work", workflow, "build", values, forge)
-    return runner.run(named(workflow, "build", GATE_STEP))
-
-
-#: STEP 6 UNDER A FORGE THAT RETURNS EVERY COMMIT'S RUNS, whatever the query
-#: asks: `(the runs and their jobs, whether the step passes)`. So the step's
-#: own `head_sha` filter is what keeps another commit's runs out.
-GATE_UNFILTERED_CASES = {
-    "another-commit-s-green-run-alone": (
-        [a_run(1, head_sha="d" * 40)], {1: the_four()}, False),
-    "this-commit-s-green-run-and-another-s-red-one": (
-        [a_run(1), a_run(2, head_sha="d" * 40)],
-        {1: the_four("2026-10-18T17:00:00Z"),
-         2: the_four("2026-10-18T18:00:00Z", package={"conclusion": "failure"})}, True),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", GATE_UNFILTERED_CASES)
-def test_release_build_the_gate_counts_this_commit_s_runs_whatever_the_forge_returns(
-        tmp_path, which):
-    """STEP 6 KEEPS TO THE COMMIT ITSELF (FR-029): under a forge that answers
-    `head_sha=` with every commit's runs, another commit's green run does
-    not pass this one, and another commit's newer red run does not refuse
-    it."""
-    runs, jobs, passes = GATE_UNFILTERED_CASES[which]
-    done = run_gate(tmp_path, runs, jobs, ignores="head_sha")
-    assert (done.returncode == 0) == passes, transcript(done)
-
-
-@NEEDS_UPSTREAM
-def test_release_build_the_gate_reads_tests_yml_s_own_runs_and_never_check_runs():
-    """THE GATE'S SOURCE (the model's RV599, MUST 1): the jobs of `tests.yml`'s
-    push and dispatch runs, never the commit's check runs, which anything
-    holding an Actions token can create."""
-    script = run_text(named(release(), "build", GATE_STEP))
-    assert ".github/workflows/tests.yml" in script, "the gate names no workflow"
-    for word in ("push", "workflow_dispatch", "/jobs", *GATE):
-        assert word in script, f"the gate never reads {word!r}"
-    assert "check-runs" not in script and "check_suite" not in script
-
-
-# --- the digest and its label ---------------------------------------------------
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_release_build_the_digest_label_is_one_literal_in_the_installer_the_pin_and_the_standard(
-        tmp_path):
-    """ONE LITERAL, THREE PLACES (FR-029, design.md Decision 10): the label
-    `--version` prints beside a stamped digest, the pin's `digest_definition`
-    and the pinned standard's `TREE_DIGEST_DEFINITION` are all
-    `sorted-ls-tree-r-v1`. The label is read from what `--version` prints in a
-    `package_tree`, not from the script's text."""
-    release_ = {"VERSION": "1.1.0", "TAG": "v1.1.0", "COMMIT": "a" * 40,
-                "DIGEST": "b" * 64, "REPOSITORY": CODE_LEG}
-    payload = layout.package_tree(tmp_path / "prefix",
-                                  stamp=layout.stamp_text(**release_))
-    done = run_version(payload, tmp_path / "home")
-    lines = done.stdout.splitlines()
-    assert done.returncode == 0 and len(lines) == 5, transcript(done)
-    found = re.fullmatch(r"  digest    [0-9a-f]{64} \((.+)\)", lines[4])
-    assert found, f"--version's digest line is {lines[4]!r}"
-    pin = standard().load_yaml(PIN).get("digest_definition")
-    assert (found.group(1), pin, standard().TREE_DIGEST_DEFINITION) == (
-        DIGEST_LABEL, DIGEST_LABEL, DIGEST_LABEL)
-
-
-@NEEDS_UPSTREAM
-def test_release_build_the_digest_step_compares_the_definition_with_the_literal_and_the_pin():
-    """STEP 7 (FR-029, FR-030): `tree_digest` on the checkout against
-    `tree_digest_from_gh` on the forge, both from the PINNED submodule's
-    `scripts/repo_shape.py`, and its `TREE_DIGEST_DEFINITION` held to the
-    literal and to the pin's `digest_definition`. No copy of the digest code
-    is added anywhere outside the submodule."""
-    script = run_text(named(release(), "build", DIGEST_STEP))
-    for word in ("tree_digest(", "tree_digest_from_gh(", "TREE_DIGEST_DEFINITION",
-                 DIGEST_LABEL, "digest_definition", "openreposhape-pin.yaml",
-                 "upstream", "openRepoShape", "scripts"):
-        assert word in script, f"the digest step never names {word!r}"
-    tracked = subprocess.run(["git", "ls-files", "-z"], cwd=str(REPO),
-                             capture_output=True, check=True).stdout.split(b"\0")
-    copies = [p.decode() for p in tracked if p.endswith(b"repo_shape.py")]
-    assert copies == [], f"a copy of the standard's digest code: {copies}"
-
-
-#: A `gh` that answers one question, the forge's recursive tree listing of
-#: `FORGE_COMMIT` in `FORGE_REPOSITORY`, with `FORGE_DATA`; anything else is a 404.
-TREE_FORGE = r'''
-import json, os, sys
-args = sys.argv[1:]
-with open(os.environ["FORGE_LOG"], "a", encoding="utf-8") as log:
-    log.write(json.dumps(args) + "\n")
-want = ("repos/" + os.environ["FORGE_REPOSITORY"] + "/git/trees/"
-        + os.environ["FORGE_COMMIT"] + "?recursive=1")
-if args[:1] != ["api"] or want not in [a.lstrip("/") for a in args[1:]]:
-    sys.stderr.write("gh: Not Found (HTTP 404)\n")
-    sys.exit(1)
-with open(os.environ["FORGE_DATA"], encoding="utf-8") as handle:
-    sys.stdout.write(handle.read())
-'''
-
-
-def run_digest_step(tmp_path: Path, lie: bool, here: Path = REPO
-                    ) -> Tuple[subprocess.CompletedProcess, Runner, str]:
-    """The digest step, run in this checkout (or in `here`, laid out as it
-    is), under a forge whose tree listing is HEAD's own, or HEAD's with one
-    object changed."""
-    workflow = release()
-    sha, tree = head()
-    rows = [{"path": p, "mode": m, "type": k, "sha": o}
-            for p, (m, k, o) in sorted(tree.items())]
-    if lie:
-        rows[0] = dict(rows[0], sha="0" * 40)
-    data = tmp_path / "tree.json"
-    data.write_text(json.dumps({"sha": sha, "tree": rows, "truncated": False}),
-                    encoding="utf-8")
-    forge = python_tool(tmp_path / "forge", "gh", TREE_FORGE)
-    values = {"GITHUB_SHA": sha, "GITHUB_REPOSITORY": CODE_LEG,
-              "GITHUB_WORKSPACE": str(here), "VERSION": "1.1.0",
-              "FORGE_DATA": str(data), "FORGE_LOG": str(tmp_path / "forge.log"),
-              "FORGE_REPOSITORY": CODE_LEG, "FORGE_COMMIT": sha}
-    if here != REPO:
-        values["GIT_DIR"] = subprocess.run(
-            ["git", "rev-parse", "--absolute-git-dir"], cwd=str(REPO),
-            capture_output=True, text=True, check=True).stdout.strip()
-    runner = Runner(tmp_path / "work", workflow, "build", values, forge)
-    cache = STANDARD_SCRIPTS / "__pycache__"
-    existed = cache.exists()
-    try:
-        done = runner.run(named(workflow, "build", DIGEST_STEP), cwd=here)
-    finally:
-        if not existed and cache.is_dir():
-            shutil.rmtree(cache)
-    return done, runner, standard().tree_digest(REPO, sha)
-
-
-#: A definition no standard here digests by.
-OTHER_LABEL = "sorted-ls-tree-r-v0"
-
-
-def digest_checkout(tmp_path: Path, standard_label: str, pin_label: str) -> Path:
-    """A place laid out as this checkout is for the digest step: a copy of
-    the pinned standard's scripts and of the pin, each where the checkout
-    has it, saying the definition it is given. git reads this checkout's own
-    objects there, through `GIT_DIR`."""
-    here = tmp_path / "checkout"
-    scripts = here / STANDARD_SCRIPTS.relative_to(REPO)
-    shutil.copytree(str(STANDARD_SCRIPTS), str(scripts),
-                    ignore=shutil.ignore_patterns("__pycache__"))
-    pin = here / PIN.relative_to(REPO)
-    pin.parent.mkdir(parents=True, exist_ok=True)
-    shutil.copyfile(str(PIN), str(pin))
-    for path, line, said in ((scripts / "repo_shape.py",
-                              'TREE_DIGEST_DEFINITION = "{}"\n', standard_label),
-                             (pin, "digest_definition: {}\n", pin_label)):
-        text = path.read_text(encoding="utf-8")
-        assert text.count(line.format(DIGEST_LABEL)) == 1, (
-            f"{path.name} does not say {line.format(DIGEST_LABEL)!r} once")
-        path.write_text(text.replace(line.format(DIGEST_LABEL), line.format(said)),
-                        encoding="utf-8")
-    return here
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which, standard_label, pin_label", [
-    ("as committed", DIGEST_LABEL, DIGEST_LABEL),
-    ("the pin names another", DIGEST_LABEL, OTHER_LABEL),
-    ("the standard names another", OTHER_LABEL, DIGEST_LABEL),
-    ("both name another, alike", OTHER_LABEL, OTHER_LABEL),
-])
-def test_release_build_the_digest_step_holds_the_definition_to_the_literal_and_the_pin(
-        tmp_path, which, standard_label, pin_label):
-    """STEP 7, RUN, IN A COPY (FR-029): the digest step, run where a copy of
-    the pinned standard and of the pin sit as they do in this checkout, and
-    git reads this checkout's objects. As committed it passes and records
-    HEAD's digest. Where the pin, the standard, or both alike name a
-    definition other than the literal `--version` prints, the step refuses
-    and records no digest: it compares `TREE_DIGEST_DEFINITION` with the
-    literal and with the pin, and does not only name them."""
-    here = digest_checkout(tmp_path, standard_label, pin_label)
-    done, runner, digest = run_digest_step(tmp_path, lie=False, here=here)
-    if which == "as committed":
-        assert done.returncode == 0, transcript(done)
-        assert [v for _, v in runner.recorded() if v == digest], (
-            f"the step records {runner.recorded()}, not {digest}")
-    else:
-        assert done.returncode != 0, f"{which}, and the step passed:\n{transcript(done)}"
-        assert not [v for _, v in runner.recorded() if v == digest], (
-            f"{which}, and the step records the digest anyway")
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_release_build_the_digest_step_records_the_commit_s_digest_where_the_forge_agrees(
-        tmp_path):
-    """STEP 7, RUN: in this checkout, under a forge whose listing is HEAD's
-    own, the step passes and records HEAD's `sorted-ls-tree-r-v1` digest as
-    the pinned standard computes it."""
-    done, runner, digest = run_digest_step(tmp_path, lie=False)
-    assert done.returncode == 0, transcript(done)
-    assert [v for _, v in runner.recorded() if v == digest], (
-        f"the step records {runner.recorded()}, not {digest}")
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-def test_release_build_the_digest_step_refuses_a_forge_that_disagrees(tmp_path):
-    """STEP 7, RUN: a forge whose listing names one object differently is a
-    release that would not be the forge's commit, and the step refuses."""
-    done, runner, digest = run_digest_step(tmp_path, lie=True)
-    assert done.returncode != 0, transcript(done)
-    assert not [v for _, v in runner.recorded() if v == digest]
-
-
-# --- step 13: the wheel check, on synthetic wheels ---------------------------------
-
-WHEEL_TIME = (2026, 10, 18, 0, 0, 0)
-ENTRY_POINTS = "[console_scripts]\nopenRepoTools = openrepotools.cli:main\n"
-
-
-def wheel_release(version: str) -> dict:
-    return {"VERSION": version, "TAG": f"v{version}", "COMMIT": head()[0],
-            "DIGEST": "d" * 64, "REPOSITORY": CODE_LEG}
-
-
-def wheel_members(release_: dict) -> Tuple[Dict[str, Tuple[bytes, int]], str]:
-    """THE WHEEL THE RELEASE BUILD WRITES FOR HEAD, laid out as hatchling
-    1.27.0 lays it out, from git's own blobs: the package's modules, the
-    stamp with the release's five values, the 24 payload files at the modes
-    hatchling gives HEAD's (0755 or 0644), and the five `.dist-info` names.
-    Returns `{member: (bytes, mode)}` and the `.dist-info/` prefix."""
-    sha, tree = head()
-    members: Dict[str, Tuple[bytes, int]] = {}
-    for path in sorted(tree):
-        found = re.fullmatch(r"src/openrepotools/([^/]+\.py)", path)
-        if found:
-            data = head_blob(path)
-            if found.group(1) == "_release.py":
-                data = stamped(data.decode("utf-8"), release_).encode("utf-8")
-            members[f"openrepotools/{found.group(1)}"] = (data, 0o644)
-    for rel in layout.payload_paths():
-        mode = tree[rel][0]
-        members[layout.PAYLOAD_PREFIX + rel] = (
-            head_blob(rel), 0o755 if mode == "100755" else 0o644)
-    info = f"openrepotools-{release_['VERSION']}.dist-info/"
-    members[info + "METADATA"] = ((
-        "Metadata-Version: 2.4\nName: openrepotools\n"
-        f"Version: {release_['VERSION']}\nLicense-Expression: Apache-2.0\n"
-        "License-File: LICENSE\nRequires-Python: >=3.9\n").encode(), 0o644)
-    members[info + "WHEEL"] = (b"Wheel-Version: 1.0\nGenerator: hatchling "
-                               b"1.27.0\nRoot-Is-Purelib: true\nTag: "
-                               b"py3-none-any\n", 0o644)
-    members[info + "entry_points.txt"] = (ENTRY_POINTS.encode(), 0o644)
-    members[info + "licenses/LICENSE"] = (head_blob("LICENSE"), 0o644)
-    return members, info
-
-
-def write_wheel(path: Path, members: Dict[str, Tuple[bytes, int]],
-                info: str) -> Path:
-    """`members` as a wheel, with the `RECORD` hatchling would write for
-    them, at `path`."""
-    rows = []
-    for name, (data, _) in members.items():
-        digest = base64.urlsafe_b64encode(hashlib.sha256(data).digest())
-        rows.append(f"{name},sha256={digest.decode().rstrip('=')},{len(data)}")
-    rows.append(f"{info}RECORD,,")
-    every = dict(members)
-    every[info + "RECORD"] = (("\n".join(rows) + "\n").encode(), 0o644)
-    path.parent.mkdir(parents=True, exist_ok=True)
-    with zipfile.ZipFile(path, "w", zipfile.ZIP_DEFLATED) as wheel:
-        for name, (data, mode) in every.items():
-            entry = zipfile.ZipInfo(name, date_time=WHEEL_TIME)
-            entry.external_attr = (stat.S_IFREG | mode) << 16
-            entry.create_system = 3
-            entry.compress_type = zipfile.ZIP_DEFLATED
-            wheel.writestr(entry, data)
-    return path
-
-
-def no_license(members: dict, info: str) -> None:
-    """A tree with no `LICENSE`: no `licenses/LICENSE`, and no
-    `License-File` line, as hatchling builds one."""
-    del members[info + "licenses/LICENSE"]
-    data, mode = members[info + "METADATA"]
-    members[info + "METADATA"] = (data.replace(b"License-File: LICENSE\n", b""),
-                                  mode)
-
-
-def a_changed_member(member: str) -> Callable[[dict, str], None]:
-    """`member`, where `{info}` is the `.dist-info/` prefix, with its middle
-    byte changed."""
-    def change(members: dict, info: str) -> None:
-        name = member.format(info=info)
-        data, mode = members[name]
-        middle = len(data) // 2
-        members[name] = (
-            data[:middle] + bytes([data[middle] ^ 0x20]) + data[middle + 1:], mode)
-    return change
-
-
-def a_changed_byte(rel: str) -> Callable[[dict, str], None]:
-    return a_changed_member(layout.PAYLOAD_PREFIX + rel)
-
-
-def a_changed_mode(rel: str, mode: int) -> Callable[[dict, str], None]:
-    def change(members: dict, info: str) -> None:
-        data, _ = members[layout.PAYLOAD_PREFIX + rel]
-        members[layout.PAYLOAD_PREFIX + rel] = (data, mode)
-    return change
-
-
-def a_missing_member(member: str) -> Callable[[dict, str], None]:
-    def change(members: dict, info: str) -> None:
-        del members[member]
-    return change
-
-
-def an_extra_member(member: str, data: bytes) -> Callable[[dict, str], None]:
-    """`member`, where `{info}` is the `.dist-info/` prefix, added."""
-    def change(members: dict, info: str) -> None:
-        name = member.format(info=info)
-        assert name not in members, f"the case is wrong: {name} is HEAD's"
-        members[name] = (data, 0o644)
-    return change
-
-
-def a_dist_info_file_with(name: str, more: bytes) -> Callable[[dict, str], None]:
-    """The `.dist-info/` file `name` with `more` after its last line."""
-    def change(members: dict, info: str) -> None:
-        data, mode = members[info + name]
-        members[info + name] = (data + more, mode)
-    return change
-
-
-def a_line_more_in_the_stamp(members: dict, info: str) -> None:
-    """The stamp with a comment line after its last: its five assignments are
-    still the release's, and its bytes are not the committed file stamped."""
-    data, mode = members["openrepotools/_release.py"]
-    members["openrepotools/_release.py"] = (
-        data + b"# a line the committed stamp does not have\n", mode)
-
-
-#: THE SYNTHETIC WHEELS THAT ARE NOT THE COMMIT'S: contracts/workflows.md's
-#: four, then one for each other check the step makes (contracts/wheel.md's
-#: checks 2 to 5, the metadata, the entry points, and the run's values).
-#: Each is `(what its refusal's ::error:: line must name, the change to the
-#: wheel as built, the mode HEAD gives the file changed, the run's values
-#: where they are not the release's)`.
-NOT_THE_COMMITS = {
-    "no-licenses-LICENSE": ("licenses/LICENSE, so the commit's LICENSE is not in it",
-                            no_license, None, None),
-    "a-payload-byte-changed": ("lanes-edit.sh", a_changed_byte("lanes-edit.sh"),
-                               None, None),
-    "a-payload-mode-0755-made-0644": (
-        "link-estates", a_changed_mode("link-estates", 0o644), "100755", None),
-    "a-payload-mode-0644-made-0755": (
-        "repos.tsv", a_changed_mode("repos.tsv", 0o755), "100644", None),
-    "a-licenses-LICENSE-of-other-bytes": (
-        "licenses/LICENSE", a_changed_member("{info}licenses/LICENSE"), None,
-        None),
-    "a-module-byte-changed": ("openrepotools/cli.py",
-                              a_changed_member("openrepotools/cli.py"), None,
-                              None),
-    "a-payload-file-missing": (
-        "openrepotools/payload/lanes-index",
-        a_missing_member(layout.PAYLOAD_PREFIX + "lanes-index"), None, None),
-    "a-member-nothing-puts-there": (
-        "extra.pth", an_extra_member("extra.pth", b"import os\n"), None, None),
-    "the-stamp-with-a-line-more": ("_release.py", a_line_more_in_the_stamp,
-                                   None, None),
-    "a-run-of-another-repository": (
-        f"'REPOSITORY': '{THIS_REPOSITORY}'", None, None,
-        {"GITHUB_REPOSITORY": THIS_REPOSITORY}),
-    "metadata-naming-a-dependency": (
-        "'Requires-Dist': ['requests']",
-        a_dist_info_file_with("METADATA", b"Requires-Dist: requests\n"), None, None),
-    "a-second-console-script": (
-        "'lane': 'openrepotools.cli:main'",
-        a_dist_info_file_with("entry_points.txt", b"lane = openrepotools.cli:main\n"),
-        None, None),
-    "a-sixth-dist-info-file": (
-        "INSTALLER", an_extra_member("{info}INSTALLER", b"pip\n"), None, None),
-}
-
-
-def run_wheel_check(workflow: dict, work: Path, release_: dict,
-                    change: Optional[Callable[[dict, str], None]],
-                    run: Optional[dict] = None) -> subprocess.CompletedProcess:
-    """The wheel check's heredoc on the wheel as built for `release_`, with
-    `change` made to it, under the run's values: the release's, or `run`'s
-    where it names any."""
-    members, info = wheel_members(release_)
-    if change is not None:
-        change(members, info)
-    wheel = write_wheel(work / "dist" / f"openrepotools-{release_['VERSION']}"
-                        "-py3-none-any.whl", members, info)
-    values = release_values(release_)
-    values.update(run or {})
-    return run_heredoc(named(workflow, "build", WHEEL_CHECK_STEP), work, [wheel],
-                       values, cwd=REPO)
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("version", ["1.1.0", "1.1.0rc1"])
-def test_release_build_the_wheel_check_passes_the_wheel_as_built(tmp_path,
-                                                                 version):
-    """STEP 13 ON THE WHEEL AS BUILT (contracts/wheel.md, checks 2 to 6): every
-    payload file is HEAD's blob in bytes and mode, each module is HEAD's, the
-    stamp is HEAD's with its five lines the release's, and the `.dist-info`
-    is the five names with HEAD's `LICENSE`. A final and a pre-release pass
-    alike (design.md Decision 10)."""
-    done = run_wheel_check(release(), tmp_path / "as-built",
-                           wheel_release(version), None)
-    assert done.returncode == 0, transcript(done)
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", NOT_THE_COMMITS)
-def test_release_build_the_wheel_check_refuses_a_wheel_that_is_not_the_commit_s(
-        tmp_path, which):
-    """STEP 13 ON EACH WHEEL THAT IS NOT THE COMMIT'S (FR-002, FR-006): no
-    `licenses/LICENSE`, a payload file with a byte changed, and a payload file
-    with its mode changed either way; then a `licenses/LICENSE` that is not
-    the commit's, a module with a byte changed, a payload file missing, a
-    member nothing puts in the wheel, a stamp whose bytes are not the
-    committed file stamped though its five values are the release's, the
-    wheel as built checked in a run of another repository, metadata that
-    names a dependency, a second console script, and a sixth `.dist-info/`
-    file. Each fails, and among the lines it prints beyond the wheel as
-    built's is an `::error::` line naming what is wrong. Only that line is
-    the refusal: the step's own `print`s show some of the same values (the
-    metadata, for one) whether or not it refuses them."""
-    names, change, head_mode, run = NOT_THE_COMMITS[which]
-    if head_mode is not None:
-        assert head()[1][names][0] == head_mode, (
-            f"the case is wrong: HEAD's {names} is not {head_mode}")
-    workflow = release()
-    release_ = wheel_release("1.1.0")
-    good = run_wheel_check(workflow, tmp_path / "w" / "a", release_, None)
-    bad = run_wheel_check(workflow, tmp_path / "w" / "b", release_, change, run)
-    assert good.returncode == 0, transcript(good)
-    assert bad.returncode != 0, transcript(bad)
-    assert "Traceback (most recent call last)" not in bad.stdout + bad.stderr, (
-        f"the check crashed rather than name the problem:\n{transcript(bad)}")
-
-    def lines(done: subprocess.CompletedProcess, side: str) -> List[str]:
-        text = (done.stdout + done.stderr).replace(str(tmp_path / "w" / side),
-                                                   "<work>")
-        return text.splitlines()
-
-    known = set(lines(good, "a"))
-    new = [line for line in lines(bad, "b") if line not in known]
-    assert [line for line in new if line.startswith("::error::") and names in line], (
-        f"no ::error:: line of the refusal names {names}:\n{transcript(bad)}")
-
-
-# --- the stamp writer --------------------------------------------------------------
-
-RELEASES = {
-    "the-code-leg-s-v1.1.0": {
-        "VERSION": "1.1.0", "TAG": "v1.1.0",
-        "COMMIT": "0123456789abcdef0123456789abcdef01234567",
-        "DIGEST": "89abcdef01234567" * 4, "REPOSITORY": CODE_LEG},
-    "an-rc-rehearsal-here": {
-        "VERSION": "1.1.0rc1", "TAG": "v1.1.0rc1", "COMMIT": "fedcba98" * 5,
-        "DIGEST": "0f1e2d3c4b5a6978" * 4, "REPOSITORY": THIS_REPOSITORY},
-    "a-patch-with-long-numbers": {
-        "VERSION": "2.10.30", "TAG": "v2.10.30", "COMMIT": "a1" * 20,
-        "DIGEST": "b2" * 32, "REPOSITORY": "someone/openRepoTools-code"},
-}
-
-#: Values no release carries (contracts/stamp.md, the writer's checks): each
-#: changes the first release under every name that carries it.
-NO_RELEASE_CARRIES = {
-    **{f"version-{v or 'empty'}": {"VERSION": v, "TAG": f"v{v}"}
-       for v in ("0.0.0", "1.1", "01.1.0", "1.1.0-rc1", "1.1.0rc01", "1.1.0rc",
-                 "1.1.0.0", "")},
-    "commit-in-upper-case": {"COMMIT": "A" * 40},
-    "commit-of-39-digits": {"COMMIT": "a" * 39},
-    "commit-empty": {"COMMIT": ""},
-    "digest-of-63-digits": {"DIGEST": "b" * 63},
-    "digest-empty": {"DIGEST": ""},
-    "repository-without-an-owner": {"REPOSITORY": "openRepoTools"},
-    "repository-a-b-c": {"REPOSITORY": "a/b/c"},
-    "repository-with-a-quote": {"REPOSITORY": 'opensoft/open"RepoTools'},
-    "repository-empty": {"REPOSITORY": ""},
-    "a-tag-of-another-version": {"TAG": "v1.1.1"},
-}
-
-
-def write_stamp(workflow: dict, work: Path, release_: dict,
-                texts: Optional[List[bytes]] = None
-                ) -> Tuple[subprocess.CompletedProcess, List[Path]]:
-    """The stamp step's own heredoc, run as the workflow runs it over the two
-    extractions' `src/openrepotools/_release.py`: copies of the committed
-    stamp, or `texts`."""
-    copies = [work / side / "src" / "openrepotools" / "_release.py"
-              for side in ("a", "b")]
-    for copy, text in zip(copies, texts or [STAMP.read_bytes()] * 2):
-        copy.parent.mkdir(parents=True, exist_ok=True)
-        copy.write_bytes(text)
-    done = run_heredoc(named(workflow, "build", STAMP_STEP), work / "run",
-                       copies, release_values(release_), cwd=work)
-    return done, copies
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", RELEASES)
-def test_release_stamp_writer_writes_a_stamp_version_reads_back(tmp_path, which):
-    """THE WRITER AND THE READER AGREE (FR-013, contracts/stamp.md). The
-    build's own writer, run on two copies of the committed stamp, writes the
-    same file into both: every line the committed file's but its five
-    assignments, each now the release's value, and the last newline kept.
-    Hatchling's pattern reads its `VERSION`, and `--version` from a
-    `package_tree` carrying it prints the stamped five lines exactly. A final
-    and a pre-release alike (design.md Decision 10)."""
-    release_ = RELEASES[which]
-    done, copies = write_stamp(release(), tmp_path, release_)
-    assert done.returncode == 0, transcript(done)
-    first, second = (copy.read_bytes() for copy in copies)
-    assert first == second, "the two extractions carry different stamps"
-    committed = STAMP.read_text(encoding="utf-8").split("\n")
-    lines = first.decode("utf-8").split("\n")
-    assert len(lines) == len(committed) and lines[-1] == "", (
-        "the stamp is not the committed file line for line")
-    changed = sorted(new for old, new in zip(committed, lines) if old != new)
-    assert changed == sorted(f'{name} = "{value}"'
-                             for name, value in release_.items()), changed
-    found = re.search(HATCH_PATTERN, first.decode("utf-8"), re.MULTILINE)
-    assert found and found.group("version") == release_["VERSION"]
-    payload = layout.package_tree(tmp_path / "prefix", stamp=first)
-    shown = run_version(payload, tmp_path / "home")
-    assert (shown.returncode, shown.stdout, shown.stderr) == (
-        0, STAMPED_VERSION.format(**release_), ""), transcript(shown)
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", NO_RELEASE_CARRIES)
-def test_release_stamp_writer_refuses_a_value_no_release_carries(tmp_path, which):
-    """A VALUE NO RELEASE CARRIES IS REFUSED, AND NOTHING IS WRITTEN: the
-    unstamped `0.0.0`, a version that is neither `X.Y.Z` nor `X.Y.ZrcN`, and a
-    commit, a digest or a repository of the wrong shape or none."""
-    release_ = dict(RELEASES["the-code-leg-s-v1.1.0"])
-    release_.update(NO_RELEASE_CARRIES[which])
-    done, copies = write_stamp(release(), tmp_path, release_)
-    assert done.returncode != 0, transcript(done)
-    for copy in copies:
-        assert copy.read_bytes() == STAMP.read_bytes(), f"{copy} was written"
-
-
-@NEEDS_UPSTREAM
-def test_release_stamp_writer_refuses_a_file_already_stamped(tmp_path):
-    """IT STAMPS THE COMMITTED, UNSTAMPED FILE AND NOTHING ELSE: run again on
-    its own output, it finds no `VERSION = "0.0.0"` to replace, refuses, and
-    leaves the file as it was."""
-    workflow = release()
-    done, copies = write_stamp(workflow, tmp_path / "first",
-                               RELEASES["the-code-leg-s-v1.1.0"])
-    assert done.returncode == 0, transcript(done)
-    stamped_text = copies[0].read_bytes()
-    again, more = write_stamp(workflow, tmp_path / "again",
-                              dict(RELEASES["the-code-leg-s-v1.1.0"],
-                                   VERSION="1.1.1", TAG="v1.1.1"),
-                              [stamped_text, stamped_text])
-    assert again.returncode != 0, transcript(again)
-    assert [copy.read_bytes() for copy in more] == [stamped_text] * 2
-
-
-def a_stamp_the_writer_refuses(which: str) -> bytes:
-    """The committed stamp made into one the writer must refuse: already
-    stamped, with a `TAG = ""` written twice, or with no `DIGEST = ""`."""
-    text = STAMP.read_text(encoding="utf-8")
-    if which == "already-stamped":
-        return stamped(text, RELEASES["the-code-leg-s-v1.1.0"]).encode("utf-8")
-    lines = text.split("\n")
-    if which == "a-line-twice":
-        lines.insert(lines.index('TAG = ""'), 'TAG = ""')
-    else:
-        lines.remove('DIGEST = ""')
-    return "\n".join(lines).encode("utf-8")
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", ["a-line-twice", "a-line-missing"])
-def test_release_stamp_writer_refuses_a_file_that_is_not_the_committed_stamp(
-        tmp_path, which):
-    """EACH COMMITTED LINE EXACTLY ONCE (contracts/stamp.md, "A count other
-    than one refuses"): a `TAG = ""` written twice, or a `DIGEST = ""` that
-    is not there, is refused, and neither file is written."""
-    text = a_stamp_the_writer_refuses(which)
-    done, copies = write_stamp(release(), tmp_path,
-                               RELEASES["the-code-leg-s-v1.1.0"], [text, text])
-    assert done.returncode != 0, transcript(done)
-    assert [copy.read_bytes() for copy in copies] == [text, text]
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", ["already-stamped", "a-line-twice",
-                                   "a-line-missing"])
-def test_release_stamp_writer_writes_neither_copy_until_both_are_checked(
-        tmp_path, which):
-    """BOTH ARE STAMPED AND CHECKED BEFORE EITHER IS WRITTEN (release.yml's
-    step 10, after contracts/stamp.md's "Checks before writing"): the
-    committed stamp as the first copy and one the writer refuses as the
-    second, and the writer refuses with both copies as they were. A writer
-    that wrote each copy as it checked it would leave the first extraction
-    stamped and the second not."""
-    texts = [STAMP.read_bytes(), a_stamp_the_writer_refuses(which)]
-    done, copies = write_stamp(release(), tmp_path,
-                               RELEASES["the-code-leg-s-v1.1.0"], texts)
-    assert done.returncode != 0, transcript(done)
-    assert [copy.read_bytes() for copy in copies] == texts, (
-        "the writer refused the second copy and wrote the first anyway")
-
-
-#: A FILESYSTEM THAT DOES NOT KEEP WHAT WAS WRITTEN: the heredoc at `argv[1]`
-#: runs as `python3 -` runs it, with the rest of argv as its own, except that
-#: a file read again after this run wrote it comes back one character short.
-LOSSY_READ_BACK = r'''
-import builtins, io, sys
-code, sys.argv = sys.argv[1], ["-", *sys.argv[2:]]
-real_open, written = builtins.open, set()
-
-
-def lossy_open(path, mode="r", *args, **kwargs):
-    if "w" in mode:
-        written.add(str(path))
-        return real_open(path, mode, *args, **kwargs)
-    handle = real_open(path, mode, *args, **kwargs)
-    if str(path) not in written:
-        return handle
-    with handle:
-        return io.StringIO(handle.read()[:-1])
-
-
-builtins.open = lossy_open
-with real_open(code, encoding="utf-8") as handle:
-    source = handle.read()
-exec(compile(source, "<stdin>", "exec"), {"__name__": "__main__"})
-'''
-
-
-@NEEDS_UPSTREAM
-def test_release_stamp_writer_reads_each_copy_back_and_refuses_one_that_is_not_what_it_wrote(
-        tmp_path):
-    """AFTER WRITING, EACH COPY IS READ AGAIN (contracts/stamp.md, "After
-    writing"): on a filesystem that comes back one character short of what
-    was written, the writer refuses, naming the copy, rather than build from
-    a stamp it cannot vouch for."""
-    copies = [tmp_path / side / "src" / "openrepotools" / "_release.py" for side in "ab"]
-    for copy in copies:
-        copy.parent.mkdir(parents=True)
-        copy.write_bytes(STAMP.read_bytes())
-    work = tmp_path / "run"
-    work.mkdir()
-    (work / "heredoc.py").write_text(
-        heredoc(run_text(named(release(), "build", STAMP_STEP))), encoding="utf-8")
-    (work / "lossy.py").write_text(LOSSY_READ_BACK, encoding="utf-8")
-    env = clean_environ(work / "home")
-    env["PYTHONUTF8"] = "1"
-    env.update(release_values(RELEASES["the-code-leg-s-v1.1.0"]))
-    done = subprocess.run([sys.executable, "-I", str(work / "lossy.py"),
-                           str(work / "heredoc.py"), *map(str, copies)],
-                          capture_output=True, text=True, check=False,
-                          stdin=subprocess.DEVNULL, env=env, cwd=str(work),
-                          timeout=STEP_TIMEOUT)
-    assert done.returncode != 0, transcript(done)
-    assert f"::error::{copies[0]} reads back as" in done.stderr, transcript(done)
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", RELEASES)
-def test_release_stamp_writer_step_as_github_runs_it_stamps_the_run_s_repository(
-        tmp_path, which):
-    """STEP 10, THE WHOLE STEP, RUN AS GITHUB RUNS IT (contracts/stamp.md,
-    "Input"): its bash sets `TAG`, `COMMIT` and `REPOSITORY` from `$VERSION`,
-    `$GITHUB_SHA` and `$GITHUB_REPOSITORY`, and its heredoc writes them, so
-    both extractions' stamps name the run's own repository, in this
-    repository, in the code leg and in a fork alike, and nothing the script
-    sets after its `export` replaces it."""
-    release_ = RELEASES[which]
-    workflow = release()
-    trees = [tmp_path / "a" / "openRepoTools",
-             tmp_path / "b" / "elsewhere" / f"v{release_['VERSION']}-src"]
-    copies = [tree / "src" / "openrepotools" / "_release.py" for tree in trees]
-    for copy in copies:
-        copy.parent.mkdir(parents=True, exist_ok=True)
-        copy.write_bytes(STAMP.read_bytes())
-    values = {"VERSION": release_["VERSION"], "GITHUB_SHA": release_["COMMIT"],
-              "GITHUB_REPOSITORY": release_["REPOSITORY"],
-              "DIGEST": release_["DIGEST"], "TREE_A": str(trees[0]),
-              "TREE_B": str(trees[1])}
-    runner = Runner(tmp_path / "work", workflow, "build", values)
-    done = runner.run(named(workflow, "build", STAMP_STEP))
-    assert done.returncode == 0, transcript(done)
-    want = stamped(STAMP.read_text(encoding="utf-8"), release_).encode("utf-8")
-    for copy in copies:
-        assert copy.read_bytes() == want, (
-            f"{copy} is not the committed stamp with {release_}:\n"
-            f"{copy.read_text(encoding='utf-8')}")
-
-
-#: THE DISPATCHED REF, AS GITHUB SETS `GITHUB_REF` AND `GITHUB_REF_NAME`: a
-#: rehearsal on the version's release branch, and the version's own tag.
-STAMP_REFS = {
-    "a-branch": ("refs/heads/release/v1.1", "release/v1.1"),
-    "the-version-s-tag": ("refs/tags/v1.1.0", "v1.1.0"),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", STAMP_REFS)
-def test_release_stamp_writer_step_stamps_v_version_on_a_branch_and_on_the_tag(
-        tmp_path, which):
-    """THE WHOLE STEP, RUN WITH THE REF GITHUB SETS (contracts/stamp.md: a
-    stamped `TAG` is `v$VERSION`): on a branch and on the version's tag
-    alike, both extractions' stamps are the committed file with `TAG`
-    `v1.1.0`, which comes from `$VERSION` and never from the ref's name."""
-    ref, name = STAMP_REFS[which]
-    release_ = RELEASES["the-code-leg-s-v1.1.0"]
-    workflow = release()
-    trees = [tmp_path / "a" / "openRepoTools", tmp_path / "b" / "elsewhere" / "v1.1.0-src"]
-    copies = [tree / "src" / "openrepotools" / "_release.py" for tree in trees]
-    for copy in copies:
-        copy.parent.mkdir(parents=True)
-        copy.write_bytes(STAMP.read_bytes())
-    values = {"VERSION": release_["VERSION"], "GITHUB_SHA": release_["COMMIT"],
-              "GITHUB_REPOSITORY": release_["REPOSITORY"],
-              "DIGEST": release_["DIGEST"], "GITHUB_REF": ref,
-              "GITHUB_REF_NAME": name, "TREE_A": str(trees[0]),
-              "TREE_B": str(trees[1])}
-    runner = Runner(tmp_path / "work", workflow, "build", values)
-    done = runner.run(named(workflow, "build", STAMP_STEP))
-    assert done.returncode == 0, transcript(done)
-    want = stamped(STAMP.read_text(encoding="utf-8"), release_).encode("utf-8")
-    for copy in copies:
-        assert copy.read_bytes() == want, (
-            f"on {ref}, {copy} is not the committed stamp with TAG "
-            f"{release_['TAG']}:\n{copy.read_text(encoding='utf-8')}")
-
-
-@NEEDS_UPSTREAM
-def test_release_stamp_writer_step_stamps_both_extractions_with_the_run_s_repository():
-    """STEP 10 (contracts/stamp.md, "Input"): the heredoc is handed the two
-    extractions' `src/openrepotools/_release.py`, and `REPOSITORY` is the
-    run's `$GITHUB_REPOSITORY`, taken from the environment and never pasted
-    in by an expression."""
-    step = named(release(), "build", STAMP_STEP)
-    script = run_text(step)
-    assert heredoc_line(script).count("src/openrepotools/_release.py") == 2, (
-        heredoc_line(script))
-    env = step.get("env") or {}
-    assert ('REPOSITORY="$GITHUB_REPOSITORY"' in script
-            or normal(env.get("REPOSITORY")) == "github.repository"), (
-        "the stamp's REPOSITORY is not the run's GITHUB_REPOSITORY")
-
-
-# --- the repository guard (FR-048) --------------------------------------------------
-
-FINALS = ("1.1.0", "1.0.1", "2.10.30")
-PRE_RELEASES = ("1.1.0rc1", "1.2.0rc0", "1.1.0rc12")
-
-#: "Any other" repository, spelled every way GitHub never spells one of the
-#: two: the guard compares exactly, so each fails closed.
-OTHER_REPOSITORIES = {
-    "lower-case": "opensoft/openrepotools",
-    "lower-case-code-leg": "opensoft/openrepotools-code",
-    "a-capital-owner": "Opensoft/openRepoTools-code",
-    "a-capital-suffix": "opensoft/openRepoTools-Code",
-    "a-fork-of-the-code-leg": "someone/openRepoTools-code",
-    "a-fork-of-this-one": "someone/openRepoTools",
-    "a-longer-name": "opensoft/openRepoTools-code-fork",
-    "the-spec-leg": "opensoft/openRepoTools-spec",
-    "the-model": "opensoft/openRepoShape",
-    "dot-git": "opensoft/openRepoTools-code.git",
-    "a-leading-space": " opensoft/openRepoTools-code",
-    "a-trailing-space": "opensoft/openRepoTools-code ",
-    "none": "",
-}
-
-
-def tag_of(version: str) -> str:
-    return f"refs/tags/v{version}"
-
-
-#: contracts/workflows.md's table, row by row: `(repository, ref, version,
-#: (to-testpypi, to-pypi))`, and `None` where the build refuses. The last row
-#: is a ref that is neither a tag nor a branch, which the guard refuses too.
-GUARD_ROWS = (
-    [pytest.param(CODE_LEG, tag_of(v), v, ("true", "true"),
-                  id=f"code-leg-a-tag-final-{v}") for v in FINALS]
-    + [pytest.param(CODE_LEG, tag_of(v), v, ("true", "false"),
-                    id=f"code-leg-a-tag-rc-{v}") for v in PRE_RELEASES]
-    + [pytest.param(THIS_REPOSITORY, tag_of(v), v, ("true", "false"),
-                    id=f"this-repository-a-tag-rc-{v}") for v in PRE_RELEASES]
-    + [pytest.param(THIS_REPOSITORY, tag_of(v), v, None,
-                    id=f"this-repository-a-tag-final-{v}") for v in FINALS]
-    + [pytest.param(repository, tag_of(v), v, None,
-                    id=f"other-{name}-a-tag-{v}")
-       for name, repository in OTHER_REPOSITORIES.items()
-       for v in ("1.1.0", "1.1.0rc1")]
-    + [pytest.param(repository, "refs/heads/l3-rehearsal-v1.1.0", v,
-                    ("false", "false"), id=f"{name}-a-branch-{v}")
-       for name, repository in (("code-leg", CODE_LEG),
-                                ("this-repository", THIS_REPOSITORY),
-                                ("a-fork", "someone/openRepoTools-code"),
-                                ("lower-case", "opensoft/openrepotools"),
-                                ("none", ""))
-       for v in ("1.1.0rc1", "1.2.0")]
-    + [pytest.param(CODE_LEG, ref, "1.1.0rc1", ("false", "false"),
-                    id=f"code-leg-{ref_name(ref).replace('/', '-')}")
-       for ref in ("refs/heads/main", "refs/heads/release/v1.1",
-                   "refs/heads/feature/a-b")]
-    + [pytest.param(CODE_LEG, "refs/pull/1/merge", "1.1.0", None,
-                    id="code-leg-a-pull-request-ref")]
-)
-
-
-def guard_values(repository: str, ref: str, version: str) -> dict:
-    """What contracts/workflows.md runs the guard with, and nothing else:
-    `GITHUB_REPOSITORY`, `GITHUB_REF` and `VERSION` (and `GITHUB_OUTPUT`,
-    which every run has)."""
-    return {"GITHUB_REPOSITORY": repository, "GITHUB_REF": ref,
-            "VERSION": version}
-
-
-def assert_decided(done: subprocess.CompletedProcess, runner: Runner,
-                   decision: Optional[Tuple[str, str]]) -> None:
-    if decision is None:
-        assert done.returncode != 0, f"the guard passed:\n{transcript(done)}"
-        assert runner.decision() == {}, (
-            f"a refused run recorded {runner.decision()}")
-    else:
-        assert done.returncode == 0, f"the guard refused:\n{transcript(done)}"
-        assert runner.decision() == {"to-testpypi": [decision[0]],
-                                     "to-pypi": [decision[1]]}, (
-            f"recorded {runner.recorded()}")
-
-
-@NEEDS_UPSTREAM
-def test_release_guard_build_is_step_one_and_the_build_job_records_its_answer():
-    """STEPS 1 AND 14: the guard is a `run:` block of the build, before the ref
-    step and so before anything asks the forge, with no `if:`, and the build
-    job's `to-testpypi` and `to-pypi` are that one step's outputs."""
-    workflow = release()
-    guard = guard_step(workflow)
-    assert where(workflow, "build", guard) < where(
-        workflow, "build", named(workflow, "build", REF_STEP))
-    assert "if" not in guard
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("repository, ref, version, decision", GUARD_ROWS)
-def test_release_guard_build_decides_by_the_table(tmp_path, repository, ref,
-                                                  version, decision):
-    """FR-048, ROW BY ROW: the code leg sends a final to both indexes and a
-    pre-release to TestPyPI; this repository a pre-release to TestPyPI and a
-    final nowhere, refused; any other repository is refused on a tag; a
-    branch is the rehearsal everywhere, passing with nothing to upload; and a
-    ref that is neither, a pull request's, is refused. The guard decides from
-    those three variables alone and asks no forge."""
-    workflow = release()
-    runner = Runner(tmp_path, workflow, "build",
-                    guard_values(repository, ref, version))
-    done = runner.run(guard_step(workflow))
-    assert_decided(done, runner, decision)
-    assert runner.asked() == "", f"the guard asked:\n{runner.asked()}"
-
-
-#: Versions no release carries, on a tag and on a branch alike: "the version
-#: must still parse" (contracts/workflows.md, step 2). `<marker>` is a file
-#: the version would make if any script ran it.
-BAD_VERSIONS = {
-    "empty": "", "two-numbers": "1.1", "four-numbers": "1.1.0.0",
-    "a-leading-zero": "01.1.0", "a-leading-zero-minor": "1.01.0",
-    "a-leading-zero-patch": "1.1.00", "a-v": "v1.1.0",
-    "a-dash-rc": "1.1.0-rc1", "rc-without-a-number": "1.1.0rc",
-    "rc-with-a-leading-zero": "1.1.0rc01", "upper-case-rc": "1.1.0RC1",
-    "an-alpha": "1.1.0a1", "a-dev-release": "1.1.0rc1.dev0",
-    "a-local-label": "1.1.0+local", "a-trailing-space": "1.1.0 ",
-    "a-second-line": "1.1.0\n1.2.0", "the-unstamped-0.0.0": "0.0.0",
-    "a-command-substitution": "1.1.0$(touch <marker>)",
-    "a-backtick-command": "1.1.0`touch <marker>`",
-}
-GOOD_VERSIONS = ("1.1.0rc1", "1.1.0rc0", "0.1.0", "1.0.1", "10.20.30", "1.2.0",
-                 "2.0.0rc3")
-
-
-def run_through_the_guard(workflow: dict, runner: Runner
-                          ) -> subprocess.CompletedProcess:
-    """Every `run:` step of the build from the first through the guard, in
-    order, stopping at the first that fails: the version check, wherever in
-    step 1 it is, and the guard."""
-    steps = steps_of(workflow, "build")
-    done = None
-    for step in steps[:where(workflow, "build", guard_step(workflow)) + 1]:
-        if run_text(step):
-            done = runner.run(step)
-            if done.returncode != 0:
-                break
-    assert done is not None
-    return done
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("ref_kind", ["a-tag", "a-branch"])
-@pytest.mark.parametrize("which", BAD_VERSIONS)
-def test_release_guard_build_refuses_a_version_no_release_carries(tmp_path, which,
-                                                                  ref_kind):
-    """STEP 1'S VERSION (FR-029): `X.Y.Z` with no leading zero and not
-    `0.0.0`, or `X.Y.ZrcN`, and nothing else, on a tag and on a branch. Each
-    other input is refused before anything is recorded, and none is run."""
-    marker = tmp_path / "the-version-ran"
-    version = BAD_VERSIONS[which].replace("<marker>", str(marker))
-    ref = (tag_of(version) if ref_kind == "a-tag"
-           else "refs/heads/l3-rehearsal-v1.1.0")
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "build",
-                    guard_values(CODE_LEG, ref, version))
-    done = run_through_the_guard(workflow, runner)
-    assert done.returncode != 0, transcript(done)
-    assert runner.decision() == {}, runner.recorded()
-    assert not marker.exists(), "a step ran the version input"
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("version", GOOD_VERSIONS)
-def test_release_guard_build_passes_every_version_a_release_carries_on_a_branch(
-        tmp_path, version):
-    """THE OTHER HALF: each version a release can carry passes step 1 on a
-    branch of the code leg, recording the rehearsal's two `false`s."""
-    workflow = release()
-    runner = Runner(tmp_path, workflow, "build",
-                    guard_values(CODE_LEG, "refs/heads/l3-rehearsal-v1.1.0",
-                                 version))
-    done = run_through_the_guard(workflow, runner)
-    assert_decided(done, runner, ("false", "false"))
-
-
-#: Each upload job's own guard (FR-048): `(repository, version, passes)`.
-UPLOAD_GUARD_CASES = {
-    "testpypi": (
-        [(CODE_LEG, v, True) for v in FINALS + PRE_RELEASES]
-        + [(THIS_REPOSITORY, v, True) for v in PRE_RELEASES]
-        + [(THIS_REPOSITORY, v, False) for v in FINALS + ("1.1.0-rc1",)]
-        + [(r, v, False) for r in OTHER_REPOSITORIES.values()
-           for v in ("1.1.0", "1.1.0rc1")]),
-    "pypi": (
-        [(CODE_LEG, v, True) for v in FINALS]
-        + [(CODE_LEG, v, False) for v in PRE_RELEASES + (
-            "1.1", "1.1.0-rc1", "1.1.0.0", "v1.1.0", "1.1.0rc1.dev0", "")]
-        + [(THIS_REPOSITORY, v, False) for v in FINALS + PRE_RELEASES]
-        + [(r, v, False) for r in OTHER_REPOSITORIES.values()
-           for v in ("1.1.0", "1.1.0rc1")]),
-}
-
-
-def upload_guard_params(name: str) -> list:
-    return [pytest.param(repository, version, passes,
-                         id=f"{repository or 'none'}-{version or 'empty'}-"
-                            f"{'passes' if passes else 'refused'}")
-            for repository, version, passes in UPLOAD_GUARD_CASES[name]]
-
-
-def run_upload_guard(tmp_path: Path, name: str, repository: str,
-                     version: str, ref: Optional[str] = None
-                     ) -> subprocess.CompletedProcess:
-    """Job `name`'s first step, its guard, on `ref`: the version's own tag
-    `refs/tags/v<version>` unless the case names another."""
-    workflow = release()
-    first = steps_of(workflow, name)[0]
-    assert run_text(first) and "uses" not in first, (
-        f"the {name} job's first step is {label(first)!r}, not its guard")
-    runner = Runner(tmp_path, workflow, name,
-                    guard_values(repository,
-                                 tag_of(version) if ref is None else ref,
-                                 version))
-    return runner.run(first)
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("repository, version, passes",
-                         upload_guard_params("testpypi"))
-def test_release_guard_upload_testpypi_s_first_step(tmp_path, repository,
-                                                     version, passes):
-    """`testpypi`'s FIRST STEP, ON ITS OWN (FR-048): it passes any version in
-    the code leg and a pre-release in this repository, and refuses a final
-    here and every version in any other repository."""
-    done = run_upload_guard(tmp_path, "testpypi", repository, version)
-    assert (done.returncode == 0) == passes, transcript(done)
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("repository, version, passes",
-                         upload_guard_params("pypi"))
-def test_release_guard_upload_pypi_s_first_step(tmp_path, repository, version,
-                                                passes):
-    """`pypi`'s FIRST STEP (FR-031, FR-048): it refuses everything but a final
-    `X.Y.Z` in `opensoft/openRepoTools-code`, so in this repository it
-    refuses outright, in case its condition is ever loosened."""
-    done = run_upload_guard(tmp_path, "pypi", repository, version)
-    assert (done.returncode == 0) == passes, transcript(done)
-
-
-#: What each upload job's guard passes on the version's own tag:
-#: `(job, repository, version)`.
-UPLOAD_GUARD_PASSES = [("testpypi", CODE_LEG, "1.1.0"),
-                       ("testpypi", CODE_LEG, "1.1.0rc1"),
-                       ("testpypi", THIS_REPOSITORY, "1.1.0rc1"),
-                       ("pypi", CODE_LEG, "1.1.0")]
-
-#: Every ref but `refs/tags/v<version>`, `<version>` the case's own: an
-#: upload is made from that tag alone.
-NOT_THE_VERSION_S_TAG = {
-    "a-branch": "refs/heads/main",
-    "the-rehearsal-branch": "refs/heads/l3-rehearsal-v1.1.0",
-    "a-branch-named-as-the-tag": "refs/heads/v<version>",
-    "another-version-s-tag": "refs/tags/v1.0.1",
-    "the-tag-without-its-v": "refs/tags/<version>",
-    "a-pull-request": "refs/pull/7/merge",
-    "no-ref-at-all": "",
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", NOT_THE_VERSION_S_TAG)
-@pytest.mark.parametrize("name, repository, version", [
-    pytest.param(*case, id=f"{case[0]}-{case[1]}-{case[2]}")
-    for case in UPLOAD_GUARD_PASSES])
-def test_release_guard_upload_refuses_every_ref_but_the_version_s_own_tag(
-        tmp_path, name, repository, version, which):
-    """EACH UPLOAD JOB'S GUARD READS THE REF (FR-048: "each from its own tag
-    v<version>"), in case the job's `if:` is ever loosened. A repository and
-    a version the guard passes on `refs/tags/v<version>` are refused on a
-    branch, on a branch named as the tag, on another version's tag, on the
-    tag without its `v`, on a pull request's ref and on no ref at all."""
-    ref = NOT_THE_VERSION_S_TAG[which].replace("<version>", version)
-    own = run_upload_guard(tmp_path / "own", name, repository, version)
-    assert own.returncode == 0, transcript(own)
-    done = run_upload_guard(tmp_path / "other", name, repository, version, ref)
-    assert done.returncode != 0, f"{name}'s guard passed on {ref!r}:\n{transcript(done)}"
-
-
-# --- the jobs, their grants and their conditions ---------------------------------------
-
-@NEEDS_UPSTREAM
-def test_release_upload_the_jobs_are_build_testpypi_install_and_pypi():
-    assert sorted(release()["jobs"]) == sorted(JOBS)
-
-
-@NEEDS_UPSTREAM
-def test_release_upload_each_job_grants_exactly_its_own_permissions():
-    """ONLY THE TWO UPLOAD JOBS MINT AN IDENTITY TOKEN (FR-031): `testpypi` and
-    `pypi` hold exactly `id-token: write`, `actions: read` and `contents:
-    read`; `build` exactly `contents: read` and `actions: read`; `install`
-    exactly `contents: read`."""
-    workflow = release()
-    granted = {name: job(workflow, name).get("permissions") for name in JOBS}
-    assert granted == PERMISSIONS, granted
-
-
-@NEEDS_UPSTREAM
-def test_release_upload_each_upload_runs_in_its_own_environment_and_no_other_job_does():
-    workflow = release()
-    for name in JOBS:
-        environment = job(workflow, name).get("environment")
-        if name in UPLOADS:
-            environment_name = (environment.get("name")
-                                if isinstance(environment, dict) else environment)
-            assert environment_name == UPLOADS[name], (name, environment)
-        else:
-            assert environment is None, (name, environment)
-
-
-#: The parts a condition may hold beside the two contracts/workflows.md names.
-STATUS_ATOMS = ("success()", "!cancelled()")
-ATOM_REF = re.compile(r"startsWith\(github\.ref, '([^']*)'\)")
-ATOM_OUTPUT = re.compile(r"needs\.build\.outputs(?:\.([A-Za-z0-9_-]+)|"
-                         r"\['([A-Za-z0-9_-]+)'\]) == '([^']*)'")
-ATOM_RESULT = re.compile(r"needs\.([A-Za-z0-9_-]+)\.result == 'success'")
-
-
-def conjuncts(expression, name: str) -> List[str]:
-    """`expression`'s `&&` parts, each with its outer parentheses off. A
-    condition with an `||` can run where one of its parts says no, so it is
-    not read."""
-    text = normal(expression)
-    if not text:
-        pytest.fail(f"the {name} job has no `if:`", pytrace=False)
-    if "||" in text:
-        pytest.fail(f"the {name} job's `if:` holds `||`: {text}", pytrace=False)
-    parts = []
-    for part in text.split("&&"):
-        part = part.strip()
-        while (part.startswith("(") and part.endswith(")")
-               and part[1:-1].count("(") == part[1:-1].count(")")):
-            part = part[1:-1].strip()
-        parts.append(part)
-    return parts
-
-
-def runs_when(workflow: dict, name: str, ref: str, outputs: dict) -> bool:
-    """Whether job `name` runs on `ref` with the build's `outputs`, every job
-    it needs having succeeded."""
-    verdict = True
-    for atom in conjuncts(job(workflow, name).get("if"), name):
-        by_ref, by_output = ATOM_REF.fullmatch(atom), ATOM_OUTPUT.fullmatch(atom)
-        if by_ref:
-            verdict = verdict and ref.startswith(by_ref.group(1))
-        elif by_output:
-            key = by_output.group(1) or by_output.group(2)
-            verdict = verdict and outputs.get(key, "") == by_output.group(3)
-        elif not (ATOM_RESULT.fullmatch(atom) or atom in STATUS_ATOMS):
-            pytest.fail(f"the {name} job's `if:` holds {atom!r}, which can run "
-                        "it without the build's success or the guard's record",
-                        pytrace=False)
-    return verdict
-
-
-#: `(ref, the build's record, testpypi runs, pypi runs)`.
-UPLOAD_SCENARIOS = {
-    "a-final-from-the-code-leg": ("refs/tags/v1.1.0",
-                                  {"to-testpypi": "true", "to-pypi": "true"},
-                                  True, True),
-    "an-rc-rehearsal": ("refs/tags/v1.1.0rc1",
-                        {"to-testpypi": "true", "to-pypi": "false"}, True, False),
-    "a-branch-rehearsal": ("refs/heads/l3-rehearsal-v1.1.0",
-                           {"to-testpypi": "false", "to-pypi": "false"},
-                           False, False),
-    "a-branch-whatever-the-record-says": ("refs/heads/l3-rehearsal-v1.1.0",
-                                          {"to-testpypi": "true",
-                                           "to-pypi": "true"}, False, False),
-    "a-tag-the-record-sends-nowhere": ("refs/tags/v1.1.0",
-                                       {"to-testpypi": "false",
-                                        "to-pypi": "false"}, False, False),
-    "a-tag-with-no-record": ("refs/tags/v1.1.0", {}, False, False),
-    "a-tag-that-is-no-v-tag": ("refs/tags/1.1.0",
-                               {"to-testpypi": "true", "to-pypi": "true"},
-                               False, False),
-}
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", UPLOAD_SCENARIOS)
-def test_release_upload_testpypi_reads_to_testpypi_and_pypi_reads_to_pypi(which):
-    """THE TWO CONDITIONS (FR-031, FR-048): each upload job runs only on a
-    `refs/tags/v*` tag, after the jobs it needs succeeded, and only where the
-    build's record says so: `testpypi` on `to-testpypi`, `pypi` on `to-pypi`.
-    So in an rc rehearsal `pypi` is skipped and never asks for its approval,
-    and a branch uploads nothing whatever the record says."""
-    ref, outputs, testpypi, pypi = UPLOAD_SCENARIOS[which]
-    workflow = release()
-    assert runs_when(workflow, "testpypi", ref, outputs) is testpypi
-    assert runs_when(workflow, "pypi", ref, outputs) is pypi
-
-
-@NEEDS_UPSTREAM
-def test_release_upload_pypi_waits_for_testpypi_and_every_install_leg():
-    """The order is TestPyPI, the install check, then PyPI (FR-031)."""
-    workflow = release()
-    assert set(as_list(job(workflow, "testpypi").get("needs"))) == {"build"}
-    assert set(as_list(job(workflow, "pypi").get("needs"))) == {
-        "build", "testpypi", "install"}
-
-
-#: EACH UPLOAD JOB'S CHECK OF THE ARTIFACT AGAINST THE BUILD'S RECORD, the
-#: model's own step: found by its name, and holding the one command that
-#: compares the file's sha256 with the recorded one. No bare "sha256" will
-#: do, because the index steps read `["sha256"]` from the JSON too.
-DIST_STEP = "dist holds the wheel the build job verified, and nothing else"
-DIST_SHA256 = 'echo "$WHEEL_SHA256  dist/$WHEEL" | sha256sum --strict -c -'
-
-
-def before_publish_checks() -> list:
-    """What each upload job reads before the upload, by what its script
-    asks: the artifact, its sha256 (the dist step, by its name and its
-    command), the environment's rules and this run's approval again, the tag
-    again, and the index's JSON for the version."""
-    return [
-        ("the build's artifact",
-         lambda s: str(s.get("uses", "")).startswith("actions/download-artifact@")),
-        ("the wheel's sha256 against the build's",
-         lambda s: (str(s.get("name", "")) == DIST_STEP
-                    and DIST_SHA256 in commands(run_text(s)))),
-        ("the environment's rules, again",
-         lambda s: "deployment-branch-policies" in run_text(s)),
-        ("this run's approval", lambda s: "approvals" in run_text(s)),
-        ("the tag, again", lambda s: re.search(r"git/refs?/tags/", run_text(s))),
-        ("the index's JSON for the version", lambda s: "/json" in run_text(s)),
-    ]
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_each_upload_job_checks_publishes_and_checks_again(name):
-    """EACH UPLOAD JOB, IN ITS ORDER (contracts/workflows.md): its guard
-    first; then the artifact and its sha256, the environment's rules, this
-    run's approval and the tag read again, and an index that lists no file of
-    the version; then the one upload with the pinned action, TestPyPI's to
-    its legacy URL and PyPI's to the default index; then the index read again
-    for exactly the recorded wheel. No step is conditional, none carries on
-    past a failure, and nothing is installed by pip."""
-    workflow = release()
-    steps = steps_of(workflow, name)
-    publishes = [i for i, s in enumerate(steps)
-                 if str(s.get("uses", "")).startswith("pypa/gh-action-pypi-publish@")]
-    assert len(publishes) == 1, f"{name} uploads {len(publishes)} times"
-    at = publishes[0]
-    publish = steps[at]
-    assert publish["uses"] == PUBLISH, publish["uses"]
-    options = publish.get("with") or {}
-    if name == "testpypi":
-        assert options.get("repository-url") == TESTPYPI_LEGACY, options
-    else:
-        assert "repository-url" not in options, options
-    before = steps[1:at]
-    for what, asks in before_publish_checks():
-        assert [s for s in before if asks(s)], (
-            f"{name} uploads without reading {what} first: "
-            f"{[label(s) for s in steps]}")
-    assert [s for s in steps[at + 1:] if "/json" in run_text(s)], (
-        f"{name} does not read the index again after the upload")
-    for step in steps:
-        assert "if" not in step and "continue-on-error" not in step, label(step)
-    assert "continue-on-error" not in job(workflow, name)
-    assert pip_installs(workflow, name) == []
-
-
-@NEEDS_UPSTREAM
-def test_release_upload_both_jobs_run_the_same_checks_after_their_guards():
-    """"THE SAME DOWNLOAD, SHA256 CHECK, RE-READS AND EMPTY-INDEX CHECK"
-    (contracts/workflows.md): after each job's own guard, the two jobs' steps
-    are one list, script for script, and the index each reads comes from its
-    own settings. Nothing in `pypi` names TestPyPI."""
-    workflow = release()
-    mine, theirs = steps_of(workflow, "testpypi")[1:], steps_of(workflow, "pypi")[1:]
-    assert [label(s) for s in mine] == [label(s) for s in theirs]
-    for a, b in zip(mine, theirs):
-        assert a.get("run") == b.get("run"), label(a)
-    assert "test.pypi.org" not in json.dumps(job(workflow, "pypi"))
-
-
-# --- the dist step, run ---------------------------------------------------------------
-
-#: The bytes the build recorded, and other bytes under the same name.
-RECORDED_WHEEL = b"PK\x03\x04 the wheel the build job verified\n"
-OTHER_WHEEL = b"PK\x03\x04 another file under the wheel's name\n"
-
-#: WHERE A JOB TAKES THE BUILD'S WHEEL, each upload job's `dist/` and the
-#: install check's wheel directory: `(the files there, whether the step that
-#: checks them passes)`.
-WHEEL_DIGEST_CASES = {
-    "the-recorded-wheel": ({"<wheel>": RECORDED_WHEEL}, True),
-    "other-bytes-under-its-name": ({"<wheel>": OTHER_WHEEL}, False),
-    "the-recorded-wheel-and-another-file": (
-        {"<wheel>": RECORDED_WHEEL, "openrepotools-1.0.0-py3-none-any.whl":
-         RECORDED_WHEEL}, False),
-    "another-name-at-the-recorded-digest": (
-        {"openrepotools-1.0.0-py3-none-any.whl": RECORDED_WHEEL}, False),
-    "nothing": ({}, False),
-}
-
-
-def a_wheel_directory(directory: Path, files: dict, wheel: str) -> None:
-    """`directory`, holding `files`, `<wheel>` standing for `wheel`."""
-    directory.mkdir(parents=True)
-    for name, data in files.items():
-        (directory / name.replace("<wheel>", wheel)).write_bytes(data)
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("sha256sum") is None,
-                    reason="the dist step runs GNU's sha256sum")
-@pytest.mark.parametrize("which", WHEEL_DIGEST_CASES)
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_the_dist_step_passes_the_verified_wheel_alone(tmp_path, name, which):
-    """THE WHOLE DIST STEP, RUN in each upload job (FR-031: the bytes the
-    build verified, and nothing else): `dist/` holding the one file named
-    `$WHEEL`, whose sha256 is `$WHEEL_SHA256`, passes; other bytes under
-    that name, another file beside it, another name, and an empty `dist/`
-    are each refused."""
-    files, passes = WHEEL_DIGEST_CASES[which]
-    wheel = "openrepotools-1.1.0-py3-none-any.whl"
-    workspace = tmp_path / "workspace"
-    a_wheel_directory(workspace / "dist", files, wheel)
-    values = {"WHEEL": wheel, "WHEEL_SHA256": hashlib.sha256(RECORDED_WHEEL).hexdigest()}
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, name, values)
-    done = runner.run(named(workflow, name, DIST_STEP), cwd=workspace)
-    assert (done.returncode == 0) == passes, transcript(done)
-    if passes:
-        assert done.stdout.strip() == f"dist/{wheel}: OK", transcript(done)
-
-
-# --- the re-checks at use time, run against a forge ------------------------------------
-
-#: The upload jobs' two re-checks, by their names.
-APPROVAL_STEP = "this environment still asks a reviewer and admits only the tags v*"
-TAG_AGAIN_STEP = "the tag v<version> still names this commit"
-RUN_ID = "4242"
-
-
-def approvals(*given: Tuple[str, str]) -> list:
-    """`GET repos/<r>/actions/runs/<id>/approvals`: one review per
-    `(environment, state)`, by brettheap."""
-    return [{"state": state, "comment": "", "user": {"login": "brettheap"},
-             "environments": [{"name": environment}]} for environment, state in given]
-
-
-#: THE APPROVAL RE-CHECK, RUN: `(the changes to the job's own environment,
-#: this run's approvals, with "<own>" and "<other>" for the two
-#: environments, or None where they cannot be read; whether the step
-#: passes)`.
-APPROVAL_CASES = {
-    "approved-by-its-reviewer": ({}, [("<own>", "approved")], True),
-    "no-approval": ({}, [], False),
-    "approved-for-the-other-environment-alone": ({}, [("<other>", "approved")], False),
-    "rejected": ({}, [("<own>", "rejected")], False),
-    "the-approvals-cannot-be-read": ({}, None, False),
-    "no-reviewer-now": ({"reviewers": ()}, [("<own>", "approved")], False),
-    "a-branch-rule-now": ({"rules": [("tag", "v*"), ("branch", "main")]},
-                          [("<own>", "approved")], False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", APPROVAL_CASES)
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_the_approval_recheck_refuses_a_run_its_environment_did_not_approve(
-        tmp_path, name, which):
-    """AT USE TIME, RUN under a forge, in each upload job: its environment
-    still names a reviewer and admits the tags `v*` alone, and this run's
-    deployment to it was approved, so it passes; no approval, an approval
-    of the other environment alone, a rejection, approvals that cannot be
-    read, and an environment that lost its reviewer or gained a branch rule
-    while the run waited are each refused."""
-    changes, given, passes = APPROVAL_CASES[which]
-    own, other = UPLOADS[name], ("pypi" if name == "testpypi" else "testpypi")
-    answers = environment_answers(THIS_REPOSITORY, {own: changes})
-    if given is not None:
-        answers[f"repos/{THIS_REPOSITORY}/actions/runs/{RUN_ID}/approvals"] = approvals(
-            *[(own if env == "<own>" else other, state) for env, state in given])
-    forge, values = api_forge(tmp_path, answers)
-    values.update(GITHUB_REPOSITORY=THIS_REPOSITORY, GITHUB_RUN_ID=RUN_ID)
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, name, values, forge)
-    done = runner.run(named(workflow, name, APPROVAL_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    if passes:
-        assert done.stdout.strip() == (f"{own}: a reviewer, the tags v* alone, and "
-                                       "approved by brettheap"), transcript(done)
-    else:
-        assert "::error::" in done.stderr, transcript(done)
-
-
-#: THE TAG RE-CHECK, RUN: `(what the forge says of v1.1.0's tag object,
-#: whether the step passes)`, the run's commit being `c` * 40.
-TAG_AGAIN_CASES = {
-    "it-still-names-this-commit": ({}, True),
-    "it-was-moved-to-another-commit": ({"names": "d" * 40}, False),
-    "it-was-deleted": (None, False),
-    "it-is-a-lightweight-tag-now": ({"lightweight": True}, False),
-    "its-object-names-a-tag": ({"type": "tag"}, False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", TAG_AGAIN_CASES)
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_the_tag_recheck_refuses_a_tag_moved_while_the_run_waited(
-        tmp_path, name, which):
-    """RIGHT BEFORE THE UPLOAD, RUN under a forge, in each upload job: the
-    annotated tag `v$VERSION` still names the run's commit, so it passes; a
-    tag moved to another commit, deleted, made lightweight, or whose object
-    names a tag is refused, since an upload cannot be taken back."""
-    lie, passes = TAG_AGAIN_CASES[which]
-    commit = "c" * 40
-    answers = ({} if lie is None
-               else annotated_tag(CODE_LEG, "v1.1.0", "7a" * 20, commit, **lie))
-    forge, values = api_forge(tmp_path, answers)
-    values.update(GITHUB_REPOSITORY=CODE_LEG, GITHUB_SHA=commit, VERSION="1.1.0")
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, name, values, forge)
-    done = runner.run(named(workflow, name, TAG_AGAIN_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    if passes:
-        assert done.stdout.strip() == f"v1.1.0 still names {commit}", transcript(done)
-    else:
-        assert "::error::" in done.stdout, transcript(done)
-
-
-# --- the index checks, run against a fake index ----------------------------------------
-
-#: The two index checks around each upload, by their names, and the JSON API
-#: each upload job reads.
-EMPTY_INDEX_STEP = "the index holds no file of this version but the verified wheel"
-SERVED_STEP = "the index serves exactly the verified wheel"
-JSON_BASES = {"testpypi": "https://test.pypi.org/pypi/openrepotools/",
-              "pypi": "https://pypi.org/pypi/openrepotools/"}
-
-#: The verified wheel, its digest, and what else an index can hold.
-INDEX_VERSION = "1.1.0"
-INDEX_WHEEL = f"openrepotools-{INDEX_VERSION}-py3-none-any.whl"
-INDEX_SDIST = f"openrepotools-{INDEX_VERSION}.tar.gz"
-VERIFIED = "5e" * 32
-ANOTHER_DIGEST = "a7" * 32
-SERVED = (200, [(INDEX_WHEEL, VERIFIED, False)])
-NOT_YET = (404, [])
-DROPPED = (None, [])
-
-#: THE CLOCK, the one other thing faked: `time.sleep` writes down what it was
-#: asked and returns at once, so 20 reads 15 seconds apart take no time. It is
-#: a `sitecustomize` on the step's PYTHONPATH, so the step's script runs as
-#: it is written.
-CLOCK = '''import os, time
-
-
-def sleep(seconds, _log=os.environ["FAKE_CLOCK_LOG"]):
-    with open(_log, "a", encoding="utf-8") as log:
-        log.write(f"{seconds}\\n")
-
-
-time.sleep = sleep
-'''
-
-
-class FakeIndex:
-    """AN INDEX'S JSON API ON 127.0.0.1: the `n`th read gets `answers[n]`,
-    and every read after the last answer gets the last again. Each answer is
-    `(status, files)`, a file `(filename, sha256, yanked)`; the status `None`
-    closes the connection with no response at all, a connection error with
-    no HTTP status. Every read's path is written down in `reads`."""
-
-    def __init__(self, answers: list) -> None:
-        self.answers, self.reads = list(answers), []
-        index = self
-
-        class Handler(http.server.BaseHTTPRequestHandler):
-            def do_GET(self) -> None:
-                status, files = index.answers[min(len(index.reads),
-                                                  len(index.answers) - 1)]
-                index.reads.append(self.path)
-                if status is None:
-                    self.close_connection = True
-                    return
-                body = json.dumps(
-                    {"info": {"name": "openrepotools"},
-                     "urls": [{"filename": name, "digests": {"sha256": digest},
-                               "yanked": yanked}
-                              for name, digest, yanked in files]}
-                    if status == 200 else {"message": f"HTTP {status}"}).encode()
-                self.send_response(status)
-                self.send_header("Content-Type", "application/json")
-                self.send_header("Content-Length", str(len(body)))
-                self.end_headers()
-                self.wfile.write(body)
-
-            def log_message(self, *args) -> None:
-                pass
-
-        self.server = http.server.HTTPServer(("127.0.0.1", 0), Handler)
-        self.base = (f"http://127.0.0.1:{self.server.server_address[1]}"
-                     "/pypi/openrepotools/")
-        # a short poll, so that `shutdown` returns at once
-        self.thread = threading.Thread(target=self.server.serve_forever,
-                                       kwargs={"poll_interval": 0.01}, daemon=True)
-
-    def __enter__(self) -> "FakeIndex":
-        self.thread.start()
-        return self
-
-    def __exit__(self, *exc) -> None:
-        self.server.shutdown()
-        self.server.server_close()
-        self.thread.join()
-
-
-def run_index_step(tmp_path: Path, name: str, prefix: str, answers: list
-                   ) -> Tuple[subprocess.CompletedProcess, List[str], List[str]]:
-    """Job `name`'s step `prefix`, run under the Runner with the job's own
-    `INDEX`, the build's record and `JSON_BASE` the fake index's. Returns the
-    run, the paths read, and the sleeps asked for."""
-    workflow = release()
-    assert (job(workflow, name).get("env") or {}).get("JSON_BASE") == JSON_BASES[name], (
-        f"the {name} job reads {job(workflow, name).get('env')}")
-    clock = tmp_path / "clock"
-    clock.mkdir()
-    (clock / "sitecustomize.py").write_text(CLOCK, encoding="utf-8")
-    log = tmp_path / "clock.log"
-    with FakeIndex(answers) as index:
-        values = {"VERSION": INDEX_VERSION, "WHEEL": INDEX_WHEEL,
-                  "WHEEL_SHA256": VERIFIED, "JSON_BASE": index.base,
-                  "no_proxy": "*", "NO_PROXY": "*", "PYTHONPATH": str(clock),
-                  "PYTHONDONTWRITEBYTECODE": "1", "FAKE_CLOCK_LOG": str(log)}
-        runner = Runner(tmp_path / "work", workflow, name, values)
-        done = runner.run(named(workflow, name, prefix))
-        reads = list(index.reads)
-    sleeps = log.read_text(encoding="utf-8").split() if log.exists() else []
-    return done, reads, sleeps
-
-
-#: BEFORE THE UPLOAD (FR-031, the lead's ruling, design.md Open Questions
-#: item 15): `(what the index answers, whether the step passes)`. A 404 is a
-#: version with no file yet, and a version listed with no file holds no file
-#: either; the verified wheel at its digest, not yanked, is a re-run after an
-#: upload that went through. Every other file refuses, and so does an index
-#: that answers with an error.
-EMPTY_INDEX_CASES = {
-    "no-file-of-the-version-yet": (NOT_YET, True),
-    "the-verified-wheel-at-its-digest": (SERVED, True),
-    "the-version-listed-with-no-file": ((200, []), True),
-    "the-verified-wheel-yanked": ((200, [(INDEX_WHEEL, VERIFIED, True)]), False),
-    "the-wheel-s-name-at-another-digest": (
-        (200, [(INDEX_WHEEL, ANOTHER_DIGEST, False)]), False),
-    "another-file-beside-the-verified-wheel": (
-        (200, [(INDEX_WHEEL, VERIFIED, False),
-               (INDEX_SDIST, ANOTHER_DIGEST, False)]), False),
-    "another-file-alone": ((200, [(INDEX_SDIST, ANOTHER_DIGEST, False)]), False),
-    "an-index-error": ((503, []), False),
-    "a-refusal-other-than-404": ((403, []), False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", EMPTY_INDEX_CASES)
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_the_empty_index_check_passes_no_file_or_the_verified_wheel_alone(
-        tmp_path, name, which):
-    """THE EMPTY-INDEX CHECK, RUN against a fake index, in each upload job:
-    it reads the version's JSON once, passes a 404, a version with no file
-    and the verified wheel already there at its digest, not yanked, and
-    refuses the wheel yanked, the wheel's name at another digest, any other
-    file, and an index that answers with an error."""
-    answer, passes = EMPTY_INDEX_CASES[which]
-    done, reads, _ = run_index_step(tmp_path, name, EMPTY_INDEX_STEP, [answer])
-    assert (done.returncode == 0) == passes, transcript(done)
-    assert reads == [f"/pypi/openrepotools/{INDEX_VERSION}/json"], reads
-    if not passes and answer[0] == 200:
-        assert "::error::" in done.stdout + done.stderr, transcript(done)
-
-
-#: AFTER THE UPLOAD: `(what the index answers, read by read, whether the step
-#: passes, how many reads it makes)`. It reads until the index serves exactly
-#: the verified wheel, through a 404, an empty listing, a server error or a
-#: connection closed with no response, up to 20 reads, and refuses the wheel
-#: yanked, any other file and a client error at once.
-SERVED_CASES = {
-    "served-at-the-first-read": ([SERVED], True, 1),
-    "not-yet-then-served": ([NOT_YET, SERVED], True, 2),
-    "an-empty-listing-then-served": ([(200, []), SERVED], True, 2),
-    "a-server-error-then-served": ([(503, []), SERVED], True, 2),
-    "a-connection-error-then-served": ([DROPPED, SERVED], True, 2),
-    "served-at-the-twentieth-read": ([NOT_YET] * 19 + [SERVED], True, 20),
-    "served-only-after-twenty-reads": ([NOT_YET] * 20 + [SERVED], False, 20),
-    "another-file-beside-it-every-time": (
-        [(200, [(INDEX_WHEEL, VERIFIED, False),
-                (INDEX_SDIST, ANOTHER_DIGEST, False)])], False, 20),
-    "another-digest-every-time": (
-        [(200, [(INDEX_WHEEL, ANOTHER_DIGEST, False)])], False, 20),
-    "served-yanked": ([(200, [(INDEX_WHEEL, VERIFIED, True)])], False, 1),
-    "a-refusal-other-than-404": ([(403, [])], False, 1),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", SERVED_CASES)
-@pytest.mark.parametrize("name", sorted(UPLOADS))
-def test_release_upload_the_served_check_reads_until_the_verified_wheel_is_served(
-        tmp_path, name, which):
-    """THE SERVED-DIGEST CHECK, RUN against a fake index, in each upload job:
-    it keeps reading, 15 seconds apart, up to 20 reads, through a read that
-    fails with no HTTP status, until the index serves exactly the verified
-    wheel, and passes then; it refuses an index that never does, the wheel
-    yanked, and a client error."""
-    answers, passes, count = SERVED_CASES[which]
-    done, reads, sleeps = run_index_step(tmp_path, name, SERVED_STEP, answers)
-    assert (done.returncode == 0) == passes, transcript(done)
-    assert reads == [f"/pypi/openrepotools/{INDEX_VERSION}/json"] * count, (
-        f"{len(reads)} reads, not {count}: {reads}")
-    assert set(sleeps) <= {"15"}, sleeps
-    if passes:
-        assert len(sleeps) == count - 1, sleeps
-
-
-# --- the install check ---------------------------------------------------------------
-
-def install_steps(workflow: dict) -> list:
-    return steps_of(workflow, "install")
-
-
-def condition_kind(condition) -> Optional[str]:
-    text = normal(condition)
-    if re.fullmatch(r"startsWith\(github\.ref, 'refs/tags/v?'\)", text):
-        return "a-tag"
-    if re.fullmatch(r"!\s*startsWith\(github\.ref, 'refs/tags/v?'\)", text):
-        return "a-branch"
-    if re.fullmatch(r"runner\.os == 'macOS'|matrix\.os == 'macos-latest'", text):
-        return "macos"
-    if re.fullmatch(r"matrix\.python == '3\.9'", text):
-        return "python-3.9"
-    return None
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_runs_after_testpypi_on_a_tag_and_after_the_build_on_a_branch():
-    """THE MODEL'S CONDITION (contracts/workflows.md): on a tag after
-    `testpypi` succeeded, on a branch when it was skipped, never after a
-    failure; and the job reads nothing but its checkout."""
-    install = job(release(), "install")
-    assert set(as_list(install.get("needs"))) == {"build", "testpypi"}
-    assert normal(install.get("if")) == normal(INSTALL_IF), install.get("if")
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_runs_three_legs_and_no_windows_leg():
-    """ubuntu and macOS on Python 3.x, and ubuntu on 3.9, the package's
-    oldest (FR-032): the legs are the matrix's only rows, each runs on its
-    own `os` with its own Python, and none is Windows."""
-    install = job(release(), "install")
-    matrix = (install.get("strategy") or {}).get("matrix") or {}
-    assert list(matrix) == ["include"], matrix
-    legs = matrix["include"]
-    assert all(set(leg) == {"os", "python"} for leg in legs), legs
-    assert sorted((leg["os"], str(leg["python"])) for leg in legs) == sorted(
-        INSTALL_LEGS), legs
-    assert normal(install.get("runs-on")) == "matrix.os", install.get("runs-on")
-    setups = [s for s in install_steps(release())
-              if str(s.get("uses", "")).startswith("actions/setup-python@")]
-    assert len(setups) == 1 and normal(
-        (setups[0].get("with") or {}).get("python-version")) == "matrix.python"
-    for step in install_steps(release()):
-        assert step.get("shell") not in ("pwsh", "powershell", "cmd"), label(step)
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_reads_pypi_alone_and_installs_pipx_from_its_lock():
-    """`PIP_INDEX_URL` is PyPI's, as the model has it, no script names
-    another index, and every `pip install` is pipx from
-    `.github/release-pipx-requirements.txt`, by hash, wheels only (FR-035)."""
-    workflow = release()
-    install = job(workflow, "install")
-    assert (install.get("env") or {}).get("PIP_INDEX_URL") == PIP_INDEX_URL
-    for step in install_steps(workflow):
-        assert "--index-url" not in run_text(step), label(step)
-        assert "--extra-index-url" not in run_text(step), label(step)
-    installs = pip_installs(workflow, "install")
-    assert installs, "the install check installs no pipx from its lock"
-    problems = {command: hashed_from(command, PIPX_LOCK) for command in installs}
-    assert not any(problems.values()), problems
-
-
-#: THE INSTALL CHECK'S OWN CHECK OF THE WHEEL IT TOOK, by its name: on a tag
-#: and on a branch alike, the one file it holds must have the sha256 the build
-#: job recorded before anything from it runs.
-WHEEL_DIGEST_STEP = "the wheel is the one the build job verified"
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_takes_the_wheel_by_its_digest_on_a_tag_and_a_branch():
-    """STEP 1: on a tag the wheel comes from TestPyPI, on a branch it is the
-    build's artifact, and in both cases its sha256 is checked before
-    anything from it runs: `WHEEL_DIGEST_STEP`, with no `if:`, comes after
-    both and before pipx installs the wheel, and the test after this one
-    runs it. Only the intended steps are conditional: those two, and the
-    macOS and Python 3.9 legs' own; and the checkout keeps no credentials."""
-    workflow = release()
-    steps = install_steps(workflow)
-    kinds = {}
-    for at, step in enumerate(steps):
-        if "if" in step:
-            kind = condition_kind(step["if"])
-            assert kind, f"{label(step)} runs only if {step['if']!r}"
-            kinds.setdefault(kind, []).append(at)
-        assert "continue-on-error" not in step, label(step)
-    assert len(kinds.get("a-tag", [])) == 1 and len(kinds.get("a-branch", [])) == 1, kinds
-    fetch, take = steps[kinds["a-tag"][0]], steps[kinds["a-branch"][0]]
-    assert "test.pypi.org" in run_text(fetch), label(fetch)
-    assert str(take.get("uses", "")).startswith("actions/download-artifact@")
-    after = max(kinds["a-tag"][0], kinds["a-branch"][0])
-    check = named(workflow, "install", WHEEL_DIGEST_STEP)
-    at = where(workflow, "install", check)
-    assert at > after and "if" not in check, (
-        f"{label(check)!r} is step {at}, conditional or before the wheel is "
-        f"taken (step {after})")
-    installs = [i for i, s in enumerate(steps)
-                if re.search(r"\bpipx install\b", run_text(s))]
-    assert installs and at < min(installs), (
-        f"pipx installs the wheel (steps {installs}) before {label(check)!r} "
-        f"(step {at}) checks its sha256")
-    for step in steps:
-        if str(step.get("uses", "")).startswith("actions/checkout@"):
-            assert (step.get("with") or {}).get("persist-credentials") is False
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", WHEEL_DIGEST_CASES)
-def test_release_install_check_the_digest_step_passes_the_recorded_wheel_alone(
-        tmp_path, which):
-    """THE WHOLE STEP, RUN (contracts/workflows.md's install step 1), its
-    bash line and its heredoc, with `python` this interpreter: over the job's
-    wheel directory it passes the one file named `$WHEEL` whose sha256 is
-    `$WHEEL_SHA256`, and refuses other bytes under that name, another file
-    beside it, another name, and nothing at all, so the install check never
-    runs a file the build did not verify."""
-    files, passes = WHEEL_DIGEST_CASES[which]
-    wheel = "openrepotools-1.1.0rc1-py3-none-any.whl"
-    digest = hashlib.sha256(RECORDED_WHEEL).hexdigest()
-    workflow = release()
-    fakes = python_tool(tmp_path / "fakes", "python", AS_PYTHON)
-    runner = Runner(tmp_path / "work", workflow, "install",
-                    {"WHEEL": wheel, "WHEEL_SHA256": digest}, fakes)
-    a_wheel_directory(Path(runner.env["RUNNER_TEMP"]) / "wheel", files, wheel)
-    done = runner.run(named(workflow, "install", WHEEL_DIGEST_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    out = done.stdout + done.stderr
-    assert "Traceback" not in out, transcript(done)
-    if passes:
-        assert done.stdout.strip() == f"{wheel}: sha256 {digest}, the recorded digest", (
-            transcript(done))
-    else:
-        assert "::error::" in out, transcript(done)
-
-
-#: The install check's two steps that fetch and install, by their names.
-FETCH_STEP = "fetch the wheel from TestPyPI"
-PIPX_STEP = "pipx installs the wheel into a fresh environment"
-
-#: `python`, as setup-python puts it on PATH: this interpreter.
-AS_PYTHON = "import os, sys\nos.execv(sys.executable, [sys.executable, *sys.argv[1:]])\n"
-
-#: A `curl` that writes down each call, refuses one that is not https-only,
-#: and answers a JSON URL with `FAKE_INDEX_JSON` and any other with bytes
-#: naming the URL.
-FAKE_CURL = r'''
-import os, shutil, sys
-args = sys.argv[1:]
-with open(os.environ["FAKE_CURL_LOG"], "a", encoding="utf-8") as log:
-    log.write(" ".join(args) + "\n")
-if "--proto" not in args or args[args.index("--proto") + 1] != "=https":
-    sys.stderr.write("fake curl: a fetch that is not https-only\n")
-    sys.exit(1)
-out, url = args[args.index("-o") + 1], args[-1]
-if url.endswith("/json"):
-    shutil.copyfile(os.environ["FAKE_INDEX_JSON"], out)
-else:
-    with open(out, "wb") as handle:
-        handle.write(b"the file at " + url.encode())
-'''
-
-FETCHED_WHEEL = "openrepotools-1.1.0rc1-py3-none-any.whl"
-FILE_HOST = "https://test-files.pythonhosted.org/packages/5e/1f/" + FETCHED_WHEEL
-
-
-def listed(filename: str, digest: str, url: str) -> dict:
-    return {"filename": filename, "digests": {"sha256": digest}, "url": url}
-
-
-#: THE FETCH, RUN: `(what TestPyPI's JSON lists for the version, whether the
-#: step passes)`. It must take the one file of the wheel's name at the
-#: recorded digest, from TestPyPI's own file host, over https.
-FETCH_CASES = {
-    "listed-once-on-its-file-host": ([listed(FETCHED_WHEEL, VERIFIED, FILE_HOST)], True),
-    "listed-on-another-host": (
-        [listed(FETCHED_WHEEL, VERIFIED, "https://files.example.invalid/" + FETCHED_WHEEL)],
-        False),
-    "listed-over-plain-http": (
-        [listed(FETCHED_WHEEL, VERIFIED, FILE_HOST.replace("https:", "http:"))], False),
-    "listed-twice-at-the-digest": ([listed(FETCHED_WHEEL, VERIFIED, FILE_HOST)] * 2, False),
-    "listed-at-another-digest": (
-        [listed(FETCHED_WHEEL, ANOTHER_DIGEST, FILE_HOST)], False),
-    "another-file-at-the-digest": (
-        [listed("openrepotools-1.1.0rc1.tar.gz", VERIFIED, FILE_HOST)], False),
-    "nothing-listed": ([], False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", FETCH_CASES)
-def test_release_install_check_the_fetch_takes_the_recorded_wheel_from_testpypi_s_file_host(
-        tmp_path, which):
-    """THE FETCH ON A TAG, RUN with `curl` faked (contracts/workflows.md's
-    install step 1): it reads TestPyPI's JSON for the version, then fetches
-    the one file listed under the wheel's name at the recorded digest, from
-    test-files.pythonhosted.org over https. Another host, plain http, the
-    file listed twice, another digest, another file, and nothing listed are
-    each refused before anything is fetched."""
-    entries, passes = FETCH_CASES[which]
-    index = tmp_path / "testpypi.json"
-    index.write_text(json.dumps({"info": {"name": "openrepotools"}, "urls": entries}),
-                     encoding="utf-8")
-    fakes = python_tool(tmp_path / "fakes", "curl", FAKE_CURL)
-    python_tool(fakes, "python", AS_PYTHON)
-    log = tmp_path / "curl.log"
-    values = {"VERSION": "1.1.0rc1", "WHEEL": FETCHED_WHEEL, "WHEEL_SHA256": VERIFIED,
-              "FAKE_CURL_LOG": str(log), "FAKE_INDEX_JSON": str(index)}
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "install", values, fakes)
-    done = runner.run(named(workflow, "install", FETCH_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    urls = [line.split()[-1] for line in log.read_text(encoding="utf-8").splitlines()]
-    wheel = Path(runner.env["RUNNER_TEMP"]) / "wheel" / FETCHED_WHEEL
-    if passes:
-        assert urls == ["https://test.pypi.org/pypi/openrepotools/1.1.0rc1/json",
-                        FILE_HOST], urls
-        assert wheel.read_bytes() == b"the file at " + FILE_HOST.encode()
-        assert done.stdout.strip() == f"fetched {FILE_HOST}", transcript(done)
-    else:
-        assert urls == ["https://test.pypi.org/pypi/openrepotools/1.1.0rc1/json"], (
-            f"the step fetched after refusing: {urls}")
-        assert not wheel.exists()
-
-
-#: `python -m pipx install ...`, faked: it writes down its arguments and
-#: places in `$PIPX_BIN_DIR` what `FAKE_PIPX_PLACES` names, each `link:<name>`
-#: (a link into its venv) or `file:<name>`; anything else runs this Python.
-FAKE_PIPX_PYTHON = r'''
-import os, sys
-args = sys.argv[1:]
-if args[:3] != ["-m", "pipx", "install"]:
-    os.execv(sys.executable, [sys.executable, *args])
-with open(os.environ["FAKE_PIPX_LOG"], "a", encoding="utf-8") as log:
-    log.write("\t".join(args) + "\n")
-bin_dir = os.environ["PIPX_BIN_DIR"]
-os.makedirs(bin_dir, exist_ok=True)
-for place in os.environ["FAKE_PIPX_PLACES"].split():
-    kind, _, name = place.partition(":")
-    if kind == "link":
-        os.symlink(os.environ["FAKE_PIPX_TARGET"], os.path.join(bin_dir, name))
-    else:
-        with open(os.path.join(bin_dir, name), "w", encoding="utf-8") as handle:
-            handle.write("#!/bin/sh\n")
-'''
-
-#: THE PIPX INSTALL, RUN: `(what pipx places in its bin directory, whether
-#: the step passes)`. One command, so one link.
-PIPX_CASES = {
-    "the-one-link": (["link:openRepoTools"], True),
-    "a-file-not-a-link": (["file:openRepoTools"], False),
-    "a-second-command": (["link:openRepoTools", "link:lane"], False),
-    "nothing-placed": ([], False),
-    "another-name": (["link:openrepotools"], False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", PIPX_CASES)
-def test_release_install_check_pipx_places_the_one_link_openrepotools_and_nothing_else(
-        tmp_path, which):
-    """THE PIPX INSTALL, RUN with pipx faked (contracts/workflows.md's
-    install step 3): pipx installs the fetched wheel, wheels only, and the
-    step passes only where its bin directory holds the link `openRepoTools`
-    and nothing else. A regular file, a second command, nothing, and a link
-    of another name are each refused."""
-    places, passes = PIPX_CASES[which]
-    target = tmp_path / "venv" / "bin" / "openRepoTools"
-    target.parent.mkdir(parents=True)
-    target.write_text("#!/bin/sh\n", encoding="utf-8")
-    fakes = python_tool(tmp_path / "fakes", "python", FAKE_PIPX_PYTHON)
-    log, bin_dir = tmp_path / "pipx.log", tmp_path / "pipx-bin"
-    values = {"WHEEL": FETCHED_WHEEL, "PIPX_BIN_DIR": str(bin_dir),
-              "FAKE_PIPX_PLACES": " ".join(places), "FAKE_PIPX_LOG": str(log),
-              "FAKE_PIPX_TARGET": str(target)}
-    workflow = release()
-    runner = Runner(tmp_path / "work", workflow, "install", values, fakes)
-    done = runner.run(named(workflow, "install", PIPX_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    wheel = f"{runner.env['RUNNER_TEMP']}/wheel/{FETCHED_WHEEL}"
-    assert log.read_text(encoding="utf-8").splitlines() == [
-        "\t".join(["-m", "pipx", "install", "--pip-args=--only-binary=:all:", wheel])]
-    if not passes:
-        assert "::error::" in done.stdout, transcript(done)
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_installs_with_pipx_and_runs_version_and_the_offline_install():
-    """STEPS 2 TO 5: pipx places the wheel's one command; `--version` names
-    the run's repository and commit; and an offline `--install` into a fresh
-    `HOME`, with the sentinel repository, checks the skip line and the count
-    line of contracts/cli-output.md."""
-    steps = install_steps(release())
-    texts = [run_text(s) for s in steps]
-    assert [t for t in texts if "pipx" in t and "install" in t
-            and "PIPX_BIN_DIR" in t], "no step installs the wheel with pipx"
-    assert [t for t in texts if "--version" in t and "GITHUB_SHA" in t
-            and "GITHUB_REPOSITORY" in t], "no step checks --version"
-    assert [t for t in texts if "--install" in t
-            and "offline.invalid/sentinel" in t
-            and "(a link into pipx's openrepotools environment)" in t
-            and "and 1 left to pipx" in t], "no step checks the offline install"
-
-
-#: THE OFFLINE `--install` IS `tests.yml`'s OWN (the comment above the
-#: release's step): the install check's script and the `package` job's are
-#: one script, line for line, but for the two places that fingerprint pipx's
-#: link. `tests.yml` takes the fingerprint with GNU's `stat -c` and
-#: `sha256sum`, and the release, whose macOS leg has neither, with the leg's
-#: Python. Each difference allowed, in order: `(tests.yml's lines,
-#: release.yml's lines)`.
-FINGERPRINT_LINES = (
-    (['before="$(stat -c %i "$link") $(readlink "$link") $(sha256sum < "$link")"'],
-     ["fingerprint='import hashlib, os, sys; p = sys.argv[1]; "
-      "print(os.lstat(p).st_ino, os.readlink(p), "
-      "hashlib.sha256(open(p, \"rb\").read()).hexdigest())'",
-      'before="$(python3 -I -c "$fingerprint" "$link")"']),
-    (['if [ ! -L "$link" ] ||',
-      '    [ "$(stat -c %i "$link") $(readlink "$link") $(sha256sum < "$link")"'
-      ' != "$before" ]; then'],
-     ['if [ ! -L "$link" ] || [ "$(python3 -I -c "$fingerprint" "$link")"'
-      ' != "$before" ]; then']),
-)
-
-#: THE macOS RERUN IS THE SAME SCRIPT AGAIN (FR-032): the release's offline
-#: `--install`, run a second time under Apple's `/bin/bash` 3.2, and different
-#: only where it must be. Each difference allowed, in order: `(the offline
-#: --install's lines, the macOS rerun's lines)`. Its own home and offline
-#: directory; the bash it runs under, which must print a `BASH_VERSION` of
-#: 3.2; `/bin` first on the `--install`'s PATH; its own output files; and
-#: refusals that name that bash. The skip line, the count line, the receipt's
-#: 28 rows and the link's fingerprint are the offline --install's own.
-MACOS_RERUN_LINES = (
-    (['home="$RUNNER_TEMP/install-home"',
-      'offline="$RUNNER_TEMP/offline-bin"'],
-     ['home="$RUNNER_TEMP/install-home-bin-bash"',
-      'offline="$RUNNER_TEMP/offline-bin-bin-bash"']),
-    ([],
-     ['# shellcheck disable=SC2016',
-      'version="$(env -i PATH="/bin:$offline:$PIPX_BIN_DIR:$PATH" bash -c '
-      '\'printf "%s\\n" "$BASH_VERSION"\')"',
-      'echo "BASH_VERSION $version, from the bash first on PATH=/bin:..."',
-      'case "$version" in',
-      '  3.2.*) ;;',
-      '  *)',
-      '    echo "::error::the bash first on a PATH that begins with /bin is '
-      '$version, not Apple\'s 3.2"',
-      '    exit 1',
-      '    ;;',
-      'esac']),
-    (['env -i HOME="$home" PATH="$offline:$PIPX_BIN_DIR:$PATH" \\'],
-     ['env -i HOME="$home" PATH="/bin:$offline:$PIPX_BIN_DIR:$PATH" \\']),
-    (['    "$link" --install > "$RUNNER_TEMP/install.out" 2> '
-      '"$RUNNER_TEMP/install.err" ||',
-      '    status=$?',
-      'cat "$RUNNER_TEMP/install.out"',
-      'cat "$RUNNER_TEMP/install.err" >&2'],
-     ['    "$PIPX_BIN_DIR/openRepoTools" --install > '
-      '"$RUNNER_TEMP/install-bin-bash.out" \\',
-      '    2> "$RUNNER_TEMP/install-bin-bash.err" || status=$?',
-      'cat "$RUNNER_TEMP/install-bin-bash.out"',
-      'cat "$RUNNER_TEMP/install-bin-bash.err" >&2']),
-    (['  echo "::error::the offline --install exited $status"'],
-     ['  echo "::error::the offline --install under /bin/bash $version exited '
-      '$status"']),
-    (['  seen="$(grep -cFx -e "$line" "$RUNNER_TEMP/install.out" || true)"'],
-     ['  seen="$(grep -cFx -e "$line" "$RUNNER_TEMP/install-bin-bash.out" || '
-      'true)"']),
-    (['    echo "::error::--install printed this line $seen times, not once: '
-      '$line"'],
-     ['    echo "::error::--install under /bin/bash $version printed this line '
-      '$seen times, not once: $line"']),
-    (['  echo "::error::--install wrote no receipt at $receipt"'],
-     ['  echo "::error::--install under /bin/bash $version wrote no receipt at '
-      '$receipt"']),
-    (['  echo "::error::the receipt has $lines lines and $rows rows, not 28: a '
-      'full install\'s 29 less pipx\'s link"'],
-     ['  echo "::error::under /bin/bash $version the receipt has $lines lines '
-      'and $rows rows, not 28"']),
-    (['  echo "::error::--install changed pipx\'s link at $link"'],
-     ['  echo "::error::--install under /bin/bash $version changed pipx\'s link '
-      'at $link"']),
-)
-
-#: The offline `--install` step, in either file: the one step of its job, with
-#: no `if:`, that runs `--install` against the sentinel repository.
-SENTINEL = re.compile(r"\bOPENREPOTOOLS_REPO=[\"']?offline\.invalid/sentinel")
-
-
-def offline_install_step(steps: list, whose: str) -> dict:
-    found = [s for s in steps if SENTINEL.search(run_text(s)) and "if" not in s]
-    if len(found) != 1:
-        pytest.fail(f"{whose} has {len(found)} unconditional steps that run "
-                    "--install against offline.invalid/sentinel, not one: "
-                    f"{[label(s) for s in found]}", pytrace=False)
-    return found[0]
-
-
-def assert_one_script_but(theirs: dict, ours: dict, allowed: tuple,
-                          names: Tuple[str, str], beside: tuple) -> None:
-    """`ours` is `theirs` with the same keys but `beside`, and its script is
-    `theirs`'s, line for line, but for `allowed`'s pairs, in order."""
-    keys = {k: v for k, v in ours.items() if k not in beside}
-    assert keys == {k: v for k, v in theirs.items() if k not in beside}, (
-        f"{names[1]}'s step and {names[0]}'s differ beside their scripts: "
-        f"{ours} against {theirs}")
-    mine, its = run_text(ours).split("\n"), run_text(theirs).split("\n")
-    matcher = difflib.SequenceMatcher(a=its, b=mine, autojunk=False)
-    found = [(its[i1:i2], mine[j1:j2])
-             for tag, i1, i2, j1, j2 in matcher.get_opcodes() if tag != "equal"]
-    assert found == [(list(a), list(b)) for a, b in allowed], (
-        f"{names[1]} is not {names[0]} but for the lines this test names:\n"
-        + "\n".join(difflib.unified_diff(its, mine, names[0], names[1],
-                                         lineterm="", n=0)))
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_the_offline_installs_are_one_script_but_for_named_lines():
-    """THE THREE COPIES CANNOT DRIFT (FR-016, FR-032). The install check's
-    offline `--install` is `tests.yml`'s `package` job's, line for line, with
-    the same keys beside its script, but for `FINGERPRINT_LINES`. Its macOS
-    rerun under `/bin/bash` 3.2 is that offline `--install` again, with the
-    same keys but its `if:`, but for `MACOS_RERUN_LINES`. Each difference is
-    named there. So a count line, a skip line or a receipt count changed in
-    one copy alone fails here, before a release tests what `tests.yml` never
-    did and burns the version on TestPyPI, and so does a rerun that no
-    longer requires 3.2."""
-    steps = install_steps(release())
-    ours = offline_install_step(steps, "release.yml's install job")
-    package = (standard().load_yaml(TESTS_WORKFLOW).get("jobs") or {}).get("package")
-    if not isinstance(package, dict) or not isinstance(package.get("steps"), list):
-        pytest.fail("tests.yml has no `package` job with steps", pytrace=False)
-    theirs = offline_install_step(package["steps"], "tests.yml's package job")
-    assert_one_script_but(theirs, ours, FINGERPRINT_LINES,
-                          ("tests.yml", "release.yml"), ("name", "run"))
-    reruns = [s for s in steps if condition_kind(s.get("if")) == "macos"
-              and SENTINEL.search(run_text(s))]
-    assert len(reruns) == 1, [label(s) for s in reruns]
-    assert_one_script_but(ours, reruns[0], MACOS_RERUN_LINES,
-                          ("the offline --install", "the macOS rerun"),
-                          ("name", "run", "if"))
-
-
-#: `/bin` put first on `PATH`: for one command (`PATH="/bin:..." command`),
-#: or, as a command of its own, for every command after it.
-BIN_FIRST = re.compile(r"""(?<!\w)PATH=["']?/bin:""")
-BIN_FIRST_FROM_HERE = re.compile(r"""(?:export\s+)?PATH=["']?/bin:[^\s;&|]*["']?""")
-
-
-def under_bin_first(script: str, pattern: str) -> bool:
-    """Whether a command of `script` that matches `pattern` runs with `/bin`
-    first on its `PATH`."""
-    lines = commands(script)
-    return any(re.search(pattern, line) and (
-        BIN_FIRST.search(line)
-        or any(BIN_FIRST_FROM_HERE.fullmatch(before) for before in lines[:at]))
-        for at, line in enumerate(lines))
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_the_macos_leg_reruns_under_bin_bash_3_2():
-    """FR-032, SC-008: on macOS only, the offline `--install` again with
-    `PATH="/bin:$PATH"`, so Apple's `/bin/bash` 3.2 runs it, printing a
-    `BASH_VERSION` that must begin with 3.2. The `--install` command itself
-    has `/bin` first on its `PATH`, and so does the bash that prints
-    `BASH_VERSION`, unless that bash is `/bin/bash` by name."""
-    steps = [s for s in install_steps(release())
-             if condition_kind(s.get("if")) == "macos"]
-
-    def reruns(text: str) -> bool:
-        prints = (under_bin_first(text, r"\bBASH_VERSION\b")
-                  or any("BASH_VERSION" in line and "/bin/bash" in line
-                         for line in commands(text)))
-        return (under_bin_first(text, r"\bopenRepoTools\b.*\s--install\b")
-                and prints and "3.2" in text)
-
-    assert [s for s in steps if reruns(run_text(s))], [label(s) for s in steps]
-
-
-@NEEDS_UPSTREAM
-def test_release_install_check_the_3_9_leg_compiles_the_two_python_commands():
-    """FR-032: on Python 3.9 only, the installed package's own
-    `payload/lanes-index` and `payload/lane-worktrees` are compiled: the
-    shipped bytes are what must compile on 3.9."""
-    steps = [s for s in install_steps(release())
-             if condition_kind(s.get("if")) == "python-3.9"]
-    assert [s for s in steps if "compile(" in run_text(s)
-            and "lanes-index" in run_text(s) and "lane-worktrees" in run_text(s)
-            and "payload" in run_text(s)], [label(s) for s in steps]
-
-
-#: The install check's `--version` step, by its name.
-VERSION_STEP = "openRepoTools --version names this release, line for line"
-
-#: The release the run is (contracts/stamp.md's names), and each stamp the
-#: installed package may carry instead, with whether the step passes it.
-VERSION_RUN = dict(RELEASES["an-rc-rehearsal-here"])
-VERSION_CASES = {
-    "this-release": ({}, True),
-    "another-digest": ({"DIGEST": "1" * 64}, False),
-    "another-commit": ({"COMMIT": "a" * 40}, False),
-    "another-repository": ({"REPOSITORY": CODE_LEG}, False),
-    "another-version": ({"VERSION": "1.1.0rc2", "TAG": "v1.1.0rc2"}, False),
-    "unstamped": (None, False),
-}
-
-
-@NEEDS_UPSTREAM
-@NEEDS_BASH
-@WINDOWS_SKIP
-@pytest.mark.parametrize("which", VERSION_CASES)
-def test_release_install_check_the_version_step_passes_this_release_s_five_lines_alone(
-        tmp_path, which):
-    """THE `--version` STEP, RUN (contracts/workflows.md's install step 4):
-    `$PIPX_BIN_DIR/openRepoTools` is the installed package's own entry,
-    which execs bash on its payload as pipx's console script does, and its
-    `--version` must be this run's five lines, the digest's among them. A
-    package stamped with another digest, commit, repository or version, or
-    unstamped, is refused."""
-    changes, passes = VERSION_CASES[which]
-    stamp = (layout.stamp_text() if changes is None
-             else layout.stamp_text(**dict(VERSION_RUN, **changes)))
-    payload = layout.package_tree(tmp_path / "venv", stamp=stamp)
-    bin_dir = tmp_path / "bin"
-    bin_dir.mkdir()
-    entry = bin_dir / "openRepoTools"
-    entry.write_text("#!/bin/sh\nexec bash "
-                     f"{shlex.quote(str(payload / 'openRepoTools'))} \"$@\"\n",
-                     encoding="utf-8")
-    entry.chmod(0o755)
-    workflow = release()
-    values = {"VERSION": VERSION_RUN["VERSION"],
-              "GITHUB_REPOSITORY": VERSION_RUN["REPOSITORY"],
-              "GITHUB_SHA": VERSION_RUN["COMMIT"],
-              "DIGEST": VERSION_RUN["DIGEST"], "PIPX_BIN_DIR": str(bin_dir)}
-    runner = Runner(tmp_path / "work", workflow, "install", values)
-    done = runner.run(named(workflow, "install", VERSION_STEP))
-    assert (done.returncode == 0) == passes, transcript(done)
-    if passes:
-        assert done.stdout == STAMPED_VERSION.format(**VERSION_RUN), transcript(done)
-    else:
-        assert "::error::" in done.stdout, transcript(done)
-
-
-#: A heredoc run by this Python as if it were another release of Python:
-#: `sys.version_info` and `sys.version` say `<version>`, `sys.argv` is
-#: `["-"]`, as under `python3 -`, and nothing else is changed. The 3.9 leg's
-#: step refuses any Python but 3.9, and the suite runs on a current one.
-AS_ANOTHER_PYTHON = r'''
-import sys
-code, version = sys.argv[1], sys.argv[2]
-sys.version = f"{version} (the suite's {sys.version.split()[0]}, read as {version})"
-sys.version_info = tuple(int(part) for part in version.split(".")) + ("final", 0)
-sys.argv = ["-"]
-with open(code, encoding="utf-8") as handle:
-    source = handle.read()
-exec(compile(source, "<stdin>", "exec"), {"__name__": "__main__"})
-'''
-
-
-def with_two_pythons(home: Path) -> None:
-    layout.pipx_venv(home, "1.11.1")
-    layout.package_tree(home / "venvs" / "openrepotools", "python3.10")
-
-
-def with_lanes_index_broken(home: Path) -> None:
-    layout.pipx_venv(home, "1.11.1")
-    payload = home / "venvs/openrepotools/lib/python3.9/site-packages/openrepotools/payload"
-    (payload / "lanes-index").write_bytes(b"def broken(:\n")
-
-
-def with_lane_worktrees_missing(home: Path) -> None:
-    layout.pipx_venv(home, "1.11.1")
-    payload = home / "venvs/openrepotools/lib/python3.9/site-packages/openrepotools/payload"
-    (payload / "lane-worktrees").unlink()
-
-
-#: `(the Python the step is run as, the pipx home it reads, whether it
-#: passes, what its refusal names)`.
-COMPILE_CASES = {
-    "the-payload-as-built": ("3.9.25", lambda home: layout.pipx_venv(home, "1.11.1"),
-                             True, None),
-    "lanes-index-does-not-compile": ("3.9.25", with_lanes_index_broken, False,
-                                     "lanes-index"),
-    "lane-worktrees-missing": ("3.9.25", with_lane_worktrees_missing, False,
-                               "lane-worktrees"),
-    "no-payload-directory": ("3.9.25", lambda home: home.mkdir(parents=True),
-                             False, "not one payload directory"),
-    "two-payload-directories": ("3.9.25", with_two_pythons, False,
-                                "not one payload directory"),
-    "not-python-3.9": ("3.12.3", lambda home: layout.pipx_venv(home, "1.11.1"),
-                       False, "not 3.9"),
-}
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("which", COMPILE_CASES)
-def test_release_install_check_the_3_9_step_refuses_a_payload_command_that_does_not_compile(
-        tmp_path, which):
-    """THE 3.9 LEG'S STEP, RUN (FR-032), on a pipx home laid out as pipx
-    1.11.1 leaves it: it passes the payload as built, and refuses, naming
-    why, a `lanes-index` that does not compile, a `lane-worktrees` that is
-    missing, no payload directory or two, and any Python but 3.9. The step
-    is run by this Python, reading as the Python the case names."""
-    version, lay_out, passes, names = COMPILE_CASES[which]
-    steps = [s for s in install_steps(release())
-             if condition_kind(s.get("if")) == "python-3.9"]
-    assert len(steps) == 1, [label(s) for s in steps]
-    home = tmp_path / "pipx-home"
-    lay_out(home)
-    work = tmp_path / "run"
-    work.mkdir()
-    (work / "heredoc.py").write_text(heredoc(run_text(steps[0])), encoding="utf-8")
-    (work / "as-another-python.py").write_text(AS_ANOTHER_PYTHON, encoding="utf-8")
-    env = clean_environ(work / "home")
-    env.update(PYTHONUTF8="1", PIPX_HOME=str(home))
-    done = subprocess.run([sys.executable, "-I", str(work / "as-another-python.py"),
-                           str(work / "heredoc.py"), version],
-                          capture_output=True, text=True, check=False,
-                          stdin=subprocess.DEVNULL, env=env, cwd=str(work),
-                          timeout=STEP_TIMEOUT)
-    assert (done.returncode == 0) == passes, transcript(done)
-    out = done.stdout + done.stderr
-    assert "Traceback" not in out, transcript(done)
-    if names:
-        assert [line for line in out.splitlines()
-                if line.startswith("::error::") and names in line], transcript(done)
-
-
-# --- every job's steps, in order -----------------------------------------------------
-
-#: THE STEPS `STEP_ORDER` FINDS BY THEIR ROLE, as HOW A STEP IS FOUND (the
-#: header) has them found, never by their names: the build's guard by the
-#: outputs it records (`guard_step`), each upload job's guard as its first
-#: step, and the macOS and 3.9 legs' own steps by their `if:`
-#: (`condition_kind`). Each is written as the failure message prints it.
-BUILD_GUARD = "<the repository guard: the step whose outputs the build job records>"
-UPLOAD_GUARD = "<the repository guard again: the job's first step>"
-MACOS_LEG = "<the macOS leg's own step: its if: is the macOS condition>"
-PYTHON_3_9_LEG = "<the Python 3.9 leg's own step: its if: is the 3.9 condition>"
-
-#: EACH JOB'S WHOLE STEP LIST, IN ORDER, each step by its role where the list
-#: names one, and every other step by a prefix of its label (its name, or the
-#: action it uses): so a step inserted anywhere, named or not, fails here, as
-#: does one moved or dropped, and a step found by its role can be renamed. An
-#: inserted step could undo a check before it (a step after the stamp writer
-#: that rewrote the stamp, say) while every check still passes on its own.
-STEP_ORDER = {
-    "build": ["actions/checkout", "actions/setup-python", BUILD_GUARD, *BUILD_STEPS,
-              "actions/upload-artifact"],
-    "testpypi": [UPLOAD_GUARD, "actions/download-artifact",
-                 DIST_STEP, APPROVAL_STEP, TAG_AGAIN_STEP, EMPTY_INDEX_STEP,
-                 "pypa/gh-action-pypi-publish", SERVED_STEP],
-    "install": ["actions/checkout", "actions/setup-python", FETCH_STEP,
-                "take the build's own wheel", WHEEL_DIGEST_STEP,
-                "pipx from its hash lock", PIPX_STEP, VERSION_STEP,
-                "an offline --install beside pipx's link", MACOS_LEG,
-                PYTHON_3_9_LEG],
-    "pypi": [UPLOAD_GUARD, "actions/download-artifact",
-             DIST_STEP, APPROVAL_STEP, TAG_AGAIN_STEP, EMPTY_INDEX_STEP,
-             "pypa/gh-action-pypi-publish", SERVED_STEP],
-}
-
-
-def in_its_place(workflow: dict, at: int, step: dict, wanted: str) -> bool:
-    """Whether `step`, at index `at` of its job, is the one `STEP_ORDER`
-    puts there: the step of the role `wanted` names, or one whose label
-    begins with `wanted`."""
-    if wanted == BUILD_GUARD:
-        return step is guard_step(workflow)
-    if wanted == UPLOAD_GUARD:
-        return at == 0
-    if wanted == MACOS_LEG:
-        return condition_kind(step.get("if")) == "macos"
-    if wanted == PYTHON_3_9_LEG:
-        return condition_kind(step.get("if")) == "python-3.9"
-    return label(step).startswith(wanted)
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("name", JOBS)
-def test_release_upload_each_job_runs_exactly_its_steps_in_order(name):
-    """EVERY STEP OF EVERY JOB, IN ORDER, AND NO OTHER (contracts/workflows.md):
-    the job's steps are `STEP_ORDER`'s, one for one, each found as the rest
-    of this file finds it."""
-    workflow = release()
-    steps = steps_of(workflow, name)
-    wanted = STEP_ORDER[name]
-    assert len(steps) == len(wanted) and all(
-        in_its_place(workflow, at, step, entry)
-        for at, (step, entry) in enumerate(zip(steps, wanted))), (
-        f"the {name} job's steps are:\n  " + "\n  ".join(label(s) for s in steps)
-        + "\nand `STEP_ORDER` holds:\n  " + "\n  ".join(wanted))
-
-
-# --- what the workflow reads ----------------------------------------------------------
-
-#: What the code leg will not hold (FR-046): the spec trees and the front-door
-#: documents, by `tests/conftest.py`'s own placement table; and the release
-#: notes, which no release step reads (FR-034, design.md Decision 11).
-OUTSIDE_THE_CODE_LEG = re.compile(
-    r"(?<![\w.-])(?:" + "|".join(map(re.escape, SPEC_TREES)) + r")/"
-    r"|(?<![\w.-])(?:" + "|".join(map(re.escape, GUIDANCE_DOCUMENTS))
-    + r")(?![\w.-])|release-notes")
-
-
-def step_texts(step: dict) -> List[str]:
-    texts = commands(run_text(step))
-    for scope in ("with", "env"):
-        texts += [str(value) for value in (step.get(scope) or {}).values()]
-    if step.get("working-directory"):
-        texts.append(str(step["working-directory"]))
-    return texts
-
-
-@NEEDS_UPSTREAM
-def test_release_reads_nothing_the_code_leg_will_not_hold():
-    """FR-046: no step names `docs/`, `openspec/`, `specs/`, `ideation/`,
-    `README.md`, `AGENTS.md` or `CLAUDE.md`, nor the release notes, in a
-    command, an input or a setting: after the cutover the workflow runs in the
-    code leg, which holds none of them."""
-    workflow = release()
-    found = [f"{name}: {label(step)}: {text[:120]}"
-             for name, step in every_step(workflow) for text in step_texts(step)
-             if OUTSIDE_THE_CODE_LEG.search(text)]
-    found += [f"{name}: env: {value}" for name, body in workflow["jobs"].items()
-              for value in (body.get("env") or {}).values()
-              if OUTSIDE_THE_CODE_LEG.search(str(value))]
-    assert not found, "steps that read outside the code leg:\n  " + "\n  ".join(found)
-
-
-# --- the header ------------------------------------------------------------------------
-
-def header() -> str:
-    """The comment block above `on:`, its lines joined into one text, with
-    each line's `#` and a shell continuation's `\\` taken off."""
-    release()
-    lines = []
-    for line in WORKFLOW.read_text(encoding="utf-8").splitlines():
-        if re.match(r"^on\s*:", line):
-            break
-        text = line.strip()
-        if text.startswith("#"):
-            text = text[1:].strip()
-            if text.endswith("\\"):
-                text = text[:-1].rstrip()
-            lines.append(text)
-    else:
-        pytest.fail("release.yml has no `on:` line", pytrace=False)
-    return " ".join(" ".join(lines).split())
-
-
-#: contracts/workflows.md's six sections, each by one phrase it must carry,
-#: in this order: what the workflow is and its model; the procedure, with the
-#: tag message's form (FR-036); #850's policy; the two rehearsals, with the
-#: first one's dispatch; where releases come from, by the guard (FR-048); and
-#: what the workflow never reads (FR-046).
-HEADER_SECTIONS = ("190133d", "Tagged on Brett Heap's word", "#850",
-                   "gh workflow run release.yml --ref <branch> -f version=1.1.0rc1",
-                   "FR-048", "FR-046")
-
-#: What else the header must say, wherever it says it.
-HEADER_CARRIES = (
-    "RELEASING", "openRepoShape v1.1.0", "Decision 10", "openRepoTools-3",
-    "Brett Heap", "Lane: <lane>",
-    "gh release create v<version> --repo <repository> --verify-tag "
-    "--notes-file <spec>/docs/release-notes/v<version>.md",
-    "release/vX.Y", "annotated", "cherry-pick -x", "HOLD", "LANDED",
-    "l3-rehearsal-v1.1.0", "tests.yml", "opensoft/openRepoTools-code",
-    "opensoft/openRepoTools", "pypi.org publisher", "testpypi", "pypi",
-    # the procedure's approvals, and the branch cut at the tag's commit: a
-    # push of the tag itself is rejected ("trying to write non-commit object")
-    "4. APPROVE `testpypi`, Brett Heap's act. The install check then runs on "
-    "its three legs; approve `pypi` once it has passed.",
-    "git push origin 'vX.Y.0^{commit}:refs/heads/release/vX.Y'",
-    # the ref step's fetch needs the code leg public
-    "opensoft/openRepoTools-code STAYS PUBLIC: the ref step fetches the tag "
-    "from it with no credentials, as the model does, and the migration "
-    "creates it public.")
-
-
-@NEEDS_UPSTREAM
-def test_release_header_carries_the_six_releasing_sections_in_order():
-    """THE RELEASING HEADER (FR-034, contracts/workflows.md "The header"): six
-    sections, in order, each found after the one before it."""
-    text = header()
-    at = 0
-    for phrase in HEADER_SECTIONS:
-        found = text.find(phrase, at)
-        assert found != -1, (
-            f"the header carries no {phrase!r} after its earlier sections")
-        at = found + len(phrase)
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("phrase", HEADER_CARRIES)
-def test_release_header_says_what_releasing_needs(phrase):
-    """The procedure's commands verbatim, its approval step, the branch and
-    tag policy's terms, the rehearsal branch, both repositories and both
-    environments, and the missing pypi.org publisher, the second line of
-    defence."""
-    assert phrase in header(), f"the RELEASING header never says {phrase!r}"
-
-
-#: A row of the guard's table as release.yml writes it, in the header and
-#: above step 1: who, on which ref, which version, and what is uploaded.
-TABLE_ROW = re.compile(
-    r"(opensoft/openRepoTools-code|opensoft/openRepoTools|any other repository"
-    r"|any repository)\s+(a tag|a branch)\s+(X\.Y\.ZrcN|X\.Y\.Z|any)\s+(\S.*)")
-TABLE_OUTCOMES = {"TestPyPI, then PyPI": ("true", "true"),
-                  "TestPyPI alone": ("true", "false"), "refused": None,
-                  "nothing: the rehearsal": ("false", "false")}
-
-
-def guard_tables() -> List[Tuple[int, Dict[Tuple[str, str, str], Optional[Tuple[str, str]]]]]:
-    """Each run of comment lines in release.yml that are rows of the guard's
-    table: its first line's number, and `{(who, ref, version): (to-testpypi,
-    to-pypi)}`, `None` where the row says refused."""
-    tables: list = []
-    rows: Optional[dict] = None
-    for number, line in enumerate(WORKFLOW.read_text(encoding="utf-8").splitlines(), 1):
-        text = line.strip()
-        found = TABLE_ROW.fullmatch(text[1:].strip()) if text.startswith("#") else None
-        if not found:
-            rows = None
-            continue
-        if rows is None:
-            rows = {}
-            tables.append((number, rows))
-        key, outcome = found.group(1, 2, 3), found.group(4)
-        assert key not in rows, f"line {number} writes the row {key} again"
-        assert outcome in TABLE_OUTCOMES, f"line {number}: {outcome!r}"
-        rows[key] = TABLE_OUTCOMES[outcome]
-    return tables
-
-
-def table_key(repository: str, ref: str, version: str) -> Optional[Tuple[str, str, str]]:
-    """The table row a guard case falls under, or None for a ref that is
-    neither a tag nor a branch, which the table does not list."""
-    if ref.startswith("refs/heads/"):
-        return ("any repository", "a branch", "any")
-    if not ref.startswith("refs/tags/"):
-        return None
-    if repository in (CODE_LEG, THIS_REPOSITORY):
-        return (repository, "a tag", "X.Y.ZrcN" if "rc" in version else "X.Y.Z")
-    return ("any other repository", "a tag", "any")
-
-
-@NEEDS_UPSTREAM
-def test_release_header_s_guard_table_is_the_guard_s_own_decisions():
-    """THE TABLE IS THE GUARD (FR-048): release.yml writes the guard's table
-    twice, in the header's WHERE RELEASES COME FROM and above step 1, and each
-    row says what `GUARD_ROWS`, which the guard is run under, decides for
-    every case that falls under it. Every row has a case, and every case on
-    a tag or a branch has its row."""
-    release()
-    lines = WORKFLOW.read_text(encoding="utf-8").splitlines()
-    start = next(n for n, line in enumerate(lines, 1) if re.match(r"^on\s*:", line))
-    tables = guard_tables()
-    assert [number < start for number, _ in tables] == [True, False], (
-        f"the guard's table is written at lines {[n for n, _ in tables]}, not "
-        f"once in the header (before line {start}) and once above step 1")
-    for number, rows in tables:
-        reached = set()
-        for case in GUARD_ROWS:
-            repository, ref, version, decision = case.values
-            key = table_key(repository, ref, version)
-            if key is None:
-                continue
-            assert key in rows, f"the table at line {number} has no row {key}"
-            assert rows[key] == decision, (
-                f"the table at line {number} says {key} gives {rows[key]}, and "
-                f"the guard decides {decision} for {case.id}")
-            reached.add(key)
-        assert reached == set(rows), (
-            f"rows at line {number} no guard case reaches: {set(rows) - reached}")
diff --git a/tests/test_rename_publication_atomic_158.py b/tests/test_rename_publication_atomic_158.py
deleted file mode 100644
index afc56f6d..00000000
--- a/tests/test_rename_publication_atomic_158.py
+++ /dev/null
@@ -1,269 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`rename-lane`'s Rule 3 stamp is published whole or not at all
-(opensoft/openRepoTools#158).
-
-The stamp was written with `cat <stamped copy> > <handoff>`. The redirect
-TRUNCATES the handoff before the first stamped byte is written, so a writer
-killed inside that `cat` — or a machine that lost power there — left a handoff
-cut short, and nothing undid it: `rename_undo` is an EXIT trap, and a process
-that dies by SIGKILL runs no trap at all. Every later read takes a short
-handoff for the real one, and a handoff is the document the next session reads
-first.
-
-EVERY RUN HERE IS A REAL `rename-lane` IN `test_lane_start_claude_current`'s
-SANDBOX: a bare origin, a workspace clone, a row and a log made by a real
-`lane-start --no-launch`, and a handoff seeded at the path that row names. The
-faults are two stubs first on `PATH`, both passing every other call to the real
-utility:
-
-  * `cat` — the one call whose single operand already carries the stamp writes
-    two lines of it to wherever its stdout was opened, then kills the writer
-    with SIGKILL: a crash INSIDE the write;
-  * `mv` — the one call whose destination already IS the published handoff
-    (the handoff's own rename moves onto a path that does not exist yet, so it
-    never matches) kills the writer, signals it, or fails: a fault BETWEEN the
-    write and the replace.
-
-Two shapes of handoff, because the stamp is published in both: one named
-`…-lane-<old>.md`, which the rename moves and then stamps, and one named
-otherwise, which is stamped where it is (Amendment 16(d)).
-
-What is claimed, and only this: the HANDOFF's bytes survive whole. A crash
-between two of the rename's four moves still leaves them apart — the issue
-scopes that recovery separately, and nothing here says otherwise.
-"""
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import signal
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, _write, pytestmark
-
-NEW = "repoZ-2"
-RENAMER = "10101010-1111-4111-8111-111111111111"
-
-#: A handoff with a header block, so the stamp goes under it (line 5) and
-#: there are lines on both sides of it to lose.
-HANDOFF = (
-    "# Session handoff — lane repoZ-1\n"
-    "Lane: repoZ-1\n"
-    "Updated: 2026-10-11T00:00:00Z\n"
-    "\n"
-    "## Top block\n"
-    "Preserved task: the next session reads this first.\n"
-    "---\n"
-    "History.\n"
-).encode("utf-8")
-STAMP_AT = 4  # the first blank line after line 1; the stamp is line 5
-
-CAT_STUB = r"""#!/usr/bin/env bash
-# opensoft/openRepoTools#158: a crash INSIDE the stamp's write.
-if [ "${FAULT_158-}" = crash-mid-write ] && [ "$PPID" != "$FAULT_158_GUARD" ]; then
-  ops=()
-  for a in "$@"; do [ "$a" = -- ] || ops+=("$a"); done
-  if [ "${#ops[@]}" = 1 ] && [ -f "${ops[0]}" ] &&
-     __GREP__ -q "^RENAMED from $FAULT_158_OLD by " "${ops[0]}"; then
-    __HEAD__ -n 2 "${ops[0]}"
-    : > "$FAULT_158_MARK"
-    kill -KILL "$PPID"
-    exit 137
-  fi
-fi
-exec __CAT__ "$@"
-"""
-
-MV_STUB = r"""#!/usr/bin/env bash
-# opensoft/openRepoTools#158: a fault BETWEEN the write and the replace.
-if [ -n "${FAULT_158-}" ] && [ "$#" -ge 2 ] && [ "$PPID" != "$FAULT_158_GUARD" ]; then
-  dest="${@: -1}"
-  if [ "$dest" -ef "$FAULT_158_TARGET" ]; then
-    case "$FAULT_158" in
-      kill-before-replace) : > "$FAULT_158_MARK"; kill -KILL "$PPID"; exit 137 ;;
-      term-before-replace) : > "$FAULT_158_MARK"; kill -TERM "$PPID"; exit 1 ;;
-      fail-replace)        : > "$FAULT_158_MARK"; exit 1 ;;
-    esac
-  fi
-fi
-exec __MV__ "$@"
-"""
-
-
-class RenameBox:
-    """One sandbox, one lane with a row, a log and a committed handoff."""
-
-    def __init__(self, root: Path, shape: str) -> None:
-        self.box = box = Sandbox(root)
-        box.env["LANES_LANE_STATE_ROOT"] = str(root / "state")
-        box.env["LANES_NO_FETCH"] = "1"
-        box.resolver()
-        started = box.start("--no-launch")
-        assert started.returncode == 0, (started.stdout, started.stderr)
-        register = box.wip / "lanes" / "LANES.md"
-        text = register.read_text(encoding="utf-8")
-        row = next(line for line in text.splitlines() if line.startswith(f"| `{LANE}`"))
-        named = row.split("|")[6].strip()
-        assert named.endswith(f"-lane-{LANE}.md"), row
-        if shape == "moved":
-            rel = named
-            published = named[: -len(f"{LANE}.md")] + f"{NEW}.md"
-        else:
-            rel = published = str(Path(named).parent / "notes.md")
-            register.write_text(text.replace(row, row.replace(named, rel)), encoding="utf-8")
-        self.handoff = box.wip / rel
-        self.published = box.wip / published
-        self.handoff.parent.mkdir(parents=True, exist_ok=True)
-        self.handoff.write_bytes(HANDOFF)
-        self.handoff.chmod(0o640)
-        box.git("-C", str(box.wip), "add", "--", "lanes/LANES.md", rel)
-        box.git("-C", str(box.wip), "commit", "-qm", "seed the handoff")
-        box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-        self.mark = root / "fault-fired"
-        self.faults = root / "faults"
-        real = {name: shutil.which(name) for name in ("cat", "mv", "grep", "head")}
-        assert all(real.values()), real
-        for name, stub in (("cat", CAT_STUB), ("mv", MV_STUB)):
-            for tool, path in real.items():
-                stub = stub.replace(f"__{tool.upper()}__", path)
-            _write(self.faults / name, stub)
-
-    def tree(self) -> dict[str, bytes]:
-        return {str(p.relative_to(self.box.wip)): p.read_bytes()
-                for p in self.box.wip.rglob("*")
-                if p.is_file() and ".git" not in p.relative_to(self.box.wip).parts}
-
-    def head(self) -> str:
-        return self.box.git("-C", str(self.box.wip), "rev-parse", "HEAD").strip()
-
-    def rename(self, fault: str | None = None) -> subprocess.CompletedProcess:
-        env = dict(self.box.env, LANES_SESSION=RENAMER)
-        if fault:
-            env.update(FAULT_158=fault, FAULT_158_OLD=LANE, FAULT_158_MARK=str(self.mark),
-                       FAULT_158_TARGET=str(self.published),
-                       FAULT_158_GUARD=str(os.getpid()),
-                       PATH=f"{self.faults}{os.pathsep}{env['PATH']}")
-        return subprocess.run([str(self.box.bin / "lanes-edit.sh"), "rename-lane", LANE, NEW,
-                               "--no-github"], cwd=self.box.lane_dir, env=env, text=True,
-                              capture_output=True, timeout=120, check=False)
-
-    def handoffs(self) -> list[Path]:
-        """Every file in the handoff's directory a reader would take for a
-        handoff: what a crash may leave beside it must not end in `.md`."""
-        return sorted(p for p in self.handoff.parent.iterdir() if p.name.endswith(".md"))
-
-
-@pytest.fixture(params=["moved", "in-place"])
-def rbox(request, tmp_path: Path) -> RenameBox:
-    return RenameBox(tmp_path, request.param)
-
-
-def test_rename_stamp_is_the_same_splice_and_keeps_the_handoffs_mode(rbox):
-    result = rbox.rename()
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    published = rbox.published.read_bytes()
-    lines = published.splitlines(keepends=True)
-    assert re.fullmatch(rf"RENAMED from {LANE} by {RENAMER} \(lane {NEW}\) at \S+\n",
-                        lines[STAMP_AT].decode("utf-8")), lines
-    # Take the one line back out and the file is the handoff byte for byte.
-    assert b"".join(lines[:STAMP_AT] + lines[STAMP_AT + 1:]) == HANDOFF
-    assert rbox.handoffs() == [rbox.published]
-    assert rbox.published.stat().st_mode & 0o777 == 0o640
-    committed = subprocess.run(["git", "-C", str(rbox.box.wip), "show",
-                                f"HEAD:{rbox.published.relative_to(rbox.box.wip)}"],
-                               env=rbox.box.env, capture_output=True, check=True).stdout
-    assert committed == published
-
-
-@pytest.mark.parametrize("fault", ["crash-mid-write", "kill-before-replace"])
-def test_rename_writer_killed_around_the_stamp_leaves_the_handoff_whole(rbox, fault):
-    result = rbox.rename(fault)
-    assert rbox.mark.exists(), ("the fault never fired", result.stdout, result.stderr)
-    assert result.returncode == -signal.SIGKILL, (result.stdout, result.stderr)
-    # No trap ran, so this is what a crash leaves. The handoff is the old one,
-    # whole — never a truncated or half-written one in its place.
-    assert rbox.handoffs() == [rbox.published]
-    assert rbox.published.read_bytes() == HANDOFF
-
-
-@pytest.mark.parametrize("fault", ["fail-replace", "term-before-replace"])
-def test_rename_replace_refused_or_interrupted_rolls_back_and_leaves_no_temporary(rbox, fault):
-    before, head = rbox.tree(), rbox.head()
-    result = rbox.rename(fault)
-    assert rbox.mark.exists(), ("the fault never fired", result.stdout, result.stderr)
-    expected = 5 if fault == "fail-replace" else -signal.SIGTERM
-    assert result.returncode == expected, (result.stdout, result.stderr)
-    assert "the rename was rolled back" in result.stderr
-    # The existing rollback, unchanged: every file as it was, nothing committed,
-    # and the temporary copy gone with the lock — on the signal path that is
-    # `cleanup`'s doing, because the trap runs before the refusal's own branch.
-    assert rbox.tree() == before
-    assert rbox.head() == head
-    assert sorted(p.name for p in rbox.handoff.parent.iterdir()) == [rbox.handoff.name]
-
-
-def test_rename_in_place_handoff_in_a_read_only_directory_refuses_and_rolls_back(tmp_path):
-    """The one behaviour #158 changes on purpose. A handoff stamped where it is
-    needed only the FILE writable; a temporary beside it needs the directory
-    too. f87fd5a stamped this case in place and exited 0."""
-    if os.geteuid() == 0:
-        pytest.skip("a read-only directory binds an unprivileged writer only")
-    rbox = RenameBox(tmp_path, "in-place")
-    before, head = rbox.tree(), rbox.head()
-    rbox.handoff.parent.chmod(0o555)
-    try:
-        result = rbox.rename()
-    finally:
-        rbox.handoff.parent.chmod(0o755)
-    assert result.returncode == 5, (result.stdout, result.stderr)
-    assert "no temporary file could be made beside" in result.stderr
-    assert "the rename was rolled back" in result.stderr
-    assert rbox.tree() == before
-    assert rbox.head() == head
-    assert sorted(p.name for p in rbox.handoff.parent.iterdir()) == [rbox.handoff.name]
-
-
-#: EVERY NAME THE EXIT AND SIGNAL TRAPS REMOVE A PATH THROUGH — `cleanup`
-#: itself, `rename_undo` and `release_lock` — with what an exported variable of
-#: that name must carry to point at the victim. The undo and the lock are each
-#: armed by a flag of their own, so the flag is exported beside the paths.
-#: `rl_htmp`, `pbh_tmp` and `TMPD` deleted the victim before the fix; the rest
-#: were already set at top level (`SE_CACHE_FILE` before any normal exit, its
-#: gap being a signal before its assignment), and are held here so they stay so.
-INHERITED = {
-    "rl_htmp": {"rl_htmp": "{file}"},
-    "pbh_tmp": {"pbh_tmp": "{file}"},
-    "TMPD": {"TMPD": "{dir}"},
-    "SE_CACHE_FILE": {"SE_CACHE_FILE": "{file}"},
-    "RL_SNAP": {"RL_SNAP": "{dir}"},
-    "LANES_IDX_DIR": {"LANES_IDX_DIR": "{dir}"},
-    "LANES_WT_IDX_DIR": {"LANES_WT_IDX_DIR": "{dir}"},
-    "rename_undo": {"RL_ACTIVE": "1", "RL_ALIAS_EXISTED": "0", "RL_LOG_NEW": "{file}",
-                    "RL_H_NEW": "{file}", "RL_ALIAS": "{file}"},
-    "release_lock": {"LOCK_HELD": "1", "LOCK": "{dir}"},
-}
-
-
-@pytest.mark.parametrize("name", sorted(INHERITED))
-def test_cleanup_removes_no_path_a_variable_inherits_from_the_environment(tmp_path, name):
-    """`cleanup` runs on every exit and removes its temporaries BY NAME, so a
-    name that arrived already set removed the caller's path: with `rl_htmp`
-    exported, a read-only `canon-lane` deleted that file (the review of #212),
-    and `pbh_tmp` and `TMPD` — the second under `rm -rf` — had the same hole
-    before it (the reviews of #212 and #213)."""
-    box = Sandbox(tmp_path)
-    box.env["LANES_NO_FETCH"] = "1"
-    victim = tmp_path / "victim"
-    victim.mkdir()
-    kept = {victim / "keep.md": HANDOFF, victim / "pid": b"1\n"}
-    for path, data in kept.items():
-        path.write_bytes(data)
-    inherited = {k: v.format(dir=victim, file=victim / "keep.md") for k, v in INHERITED[name].items()}
-    result = subprocess.run([str(box.bin / "lanes-edit.sh"), "canon-lane", LANE],
-                            cwd=box.lane_dir, env=dict(box.env, **inherited),
-                            text=True, capture_output=True, timeout=60, check=False)
-    assert {p: p.read_bytes() for p in kept if p.exists()} == kept, (result.returncode, result.stderr)
diff --git a/tests/test_repo_hygiene.py b/tests/test_repo_hygiene.py
deleted file mode 100644
index 1addfd59..00000000
--- a/tests/test_repo_hygiene.py
+++ /dev/null
@@ -1,4463 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Properties of THIS repository that a fork depends on and nobody re-checks.
-
-Adapted from openRepoShape's `tests/test_repo_hygiene.py` — the rules travel
-with the files. NOTHING HERE NEEDS THE SUBMODULE, on purpose: these are facts
-about the bash files this repository ships (`SHIPPED_BASH` and `LANE_BASH`
-below) and the documents beside them, so they run in a clone made without
-`--recurse-submodules` and they run on Windows, which is what the Windows job
-is for.
-
-EACH FILE IS READ FROM THE ROOT THAT OWNS IT (opensoft/openRepoTools#186,
-T009). A command, a test or a pin is the CODE root's (`REPO`); `README.md`,
-`AGENTS.md` and `CLAUDE.md` are the ASSEMBLY root's and `docs/` the SPEC
-leg's, read through `doc()` below. On today's layout the three are one tree,
-so nothing here changes; in a standalone code leg a document test skips naming
-the root it needs, and in the composed run it fails rather than skip.
-"""
-
-from __future__ import annotations
-
-import ast
-import os
-import re
-import shutil
-import subprocess
-import sys
-from collections import namedtuple
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, ROOTS, WINDOWS_SKIP
-
-
-def doc(rel: str) -> Path:
-    """`rel` from the root that owns it: `ROOTS.path_for`, which skips a
-    standalone code leg's test (fails a composed one) where that root is
-    absent. A command passed here is simply the code root's file."""
-    return ROOTS.path_for(rel)
-
-
-def code_first(*names: str) -> list:
-    """`names`, the code root's own files first: where a test reads a command
-    AND the documents about it, a standalone code leg still asserts the
-    command's half before the first document's root ends the test."""
-    return sorted(names, key=lambda name: ROOTS.owner_of(name) != "code")
-
-
-def tracked_files():
-    """(label, path) for every file `git ls-files` tracks in every repository
-    this run can read — the code root alone on today's layout, and in the
-    composed run the assembly and the spec leg too, so a claim about every
-    COMMITTED file still covers every file the single repository had."""
-    for role, root in ROOTS.tracked_roots():
-        listed = subprocess.run(["git", "ls-files"], cwd=str(root),
-                                capture_output=True, text=True,
-                                check=True).stdout.splitlines()
-        for rel in listed:
-            yield (rel if role == "code" else f"{role} root: {rel}"), root / rel
-
-#: EVERY BASH FILE THIS REPOSITORY SHIPS, and nothing else is one. Each is a
-#: file a person has on their PATH — the installer, the two estate verbs, the
-#: read-only `status` and the two lane words below — so each is held to the
-#: same shebang, mode bit and `set -euo pipefail` rule. The macOS job parses
-#: these same SIX with `/bin/bash -n`, one command per file, which is what
-#: keeps the bash-3.2 claim true. (It said "four" while the list held six,
-#: which is a description contradicting the inventory it explains; Copilot
-#: round 3 on #45.)
-#: `lane` and `lanes` join under lane-collision-protocol Amendment 18 Addendum 1
-#: and Amendment 11's ratified decision 6: each is one word a person has on
-#: PATH, placed by `--install`, so each is held to the same shebang, the same
-#: executable bit, the same LF index, the same bash-3.2 parse AND the same
-#: `set -euo pipefail`. (`restart` was the third until Addendum 2 retired it —
-#: `lane <name>` is that act, and one word a person is given rather than two.)
-#: They are NOT in `LANE_BASH`, and the reason is the resolver test below: they
-#: carry no copy of Amendment 9(a)'s workspace resolver because they resolve no
-#: workspace — every fact either one needs comes from `lanes-edit.sh`, through
-#: the reads clause (h) adds, which is the same "one implementation, several
-#: callers" rule those reads exist for. A third copy of that block in a file
-#: that never uses it would be a third way for it to drift.
-SHIPPED_BASH = ["openRepoTools", "park", "resume", "status", "lane", "lanes"]
-
-#: THE LANE HELPERS, which arrived here from `opensoft/brett-wip` with their
-#: history under lane-collision-protocol Amendment 9(b). They are shipped bash
-#: and `--install` places them, so they are held to the same shebang, the same
-#: executable bit, the same LF index and the same bash-3.2 parse — but NOT to
-#: `set -euo pipefail`, and the exception is deliberate rather than an
-#: oversight. `lanes-edit.sh` runs `set -u` alone, because it is the register's
-#: only writer and a failing command inside a lock-holding write must reach its
-#: own refusal and release the lock rather than exiting where it stands.
-LANE_BASH = ["lanes-edit.sh", "lane-start", "lane-end", "link-estates"]
-
-#: `lane-handoff`, under lane-collision-protocol Amendment 17(a) — *"the act
-#: Amendment 8(a) calls the swap is the HANDOFF: `lane-handoff` on `PATH`
-#: (placed by `openRepoTools --install`) from a shell"*. It is shipped bash and
-#: `--install` places it, so it takes the shebang, the executable bit, the LF
-#: index, the bash-3.2 parse and the flag-spelling rule with the lane helpers.
-#:
-#: IT IS IN NEITHER LIST ABOVE, and each of them states its own reason. Not
-#: `SHIPPED_BASH`, because it does not `set -e`: `R-A11-11` is that a swap is
-#: never left unwritten, so a read that fails part-way through must reach this
-#: command's own refusal — or drop one sub-field and carry on — rather than
-#: exiting where it stands, which is `lanes-edit.sh`'s exception one file over.
-#: Not `LANE_BASH`, because it carries no copy of Amendment 9(a)'s workspace
-#: resolver: it resolves no workspace, and the one path it needs comes back
-#: from `lanes-edit.sh workspace-root`. That is the same "one implementation,
-#: several callers" rule `restart` and `lanes` are out of `LANE_BASH` for.
-#:
-#: `lane-rename` joins it under Amendment 16, ratified 2026-09-14T09:24:35Z, for
-#: BOTH of those reasons unchanged. It does not `set -e`: clause (f)'s two acts
-#: — the tmux window and the typed `/rename` — follow a write that has already
-#: landed, and a command that exited where it stood would leave the register
-#: renamed and the window carrying a name the register no longer has, which is
-#: the one state Amendment 12's guard refuses every prompt over. And it carries
-#: no workspace resolver either: its whole write is `lanes-edit.sh rename-lane`.
-HELPER_BASH = ["lane-handoff", "lane-rename"]
-
-#: Every bash file this repository ships, for the claims that are about BASH
-#: and not about a command's failure discipline: the parse gate and the LF
-#: index. The moved suite is 196 KB of it and is in this list for the reason
-#: Amendment 9's act-3 obligation 4 gives — the macOS job parses it with bash
-#: 3.2, where a `${x,,}` that nobody ran is still a syntax error.
-#:
-#: `tests/run.sh` (opensoft/openRepoTools#51) is bash for the same reason and
-#: is held to the same parse: it is the wrapper that takes the suite's lock,
-#: its `mkdir` fallback is there BECAUSE macOS has no `flock`, and a wrapper
-#: that does not parse on the platform its fallback exists for is no wrapper.
-#: It is in no list above — `--install` does not place it and nobody has it on
-#: PATH — so the mode and discipline rules those lists carry are not asked of
-#: it; this one is.
-ALL_BASH = (SHIPPED_BASH + LANE_BASH + HELPER_BASH
-            + ["tests/test_lane_helpers.sh", "tests/run.sh"])
-
-#: THE COMMANDS THAT CARRY THE SHARED ESTATE RESOLVER, byte for byte. Every
-#: estate command is one; the installer is not, it finds no estate.
-ESTATE_COMMANDS = ["park", "resume", "status"]
-
-#: The install line this repository documents, and openRepoShape's `--install`
-#: PRINTS as its pointer. Byte-identical in both places or a person following
-#: the pointer lands somewhere else, so it is spelled here once and asserted
-#: against the README.
-RAW_INSTALL_LINE = (
-    "curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/"
-    "openRepoTools | bash -s -- --install")
-
-
-@pytest.mark.parametrize("name", SHIPPED_BASH)
-def test_shipped_bash_is_executable_and_fails_loudly(name):
-    script = REPO / name
-    assert script.is_file()
-    assert os.access(script, os.X_OK), f"{name} must be executable: chmod +x"
-    text = script.read_text(encoding="utf-8")
-    assert text.startswith("#!/usr/bin/env bash\n")
-    assert "set -euo pipefail" in text, (
-        "a command a person has on PATH must stop on the first failure, not "
-        "carry on with an unset variable")
-
-
-@pytest.mark.parametrize("name", LANE_BASH + HELPER_BASH)
-def test_the_lane_helpers_are_executable_and_declare_their_discipline(name):
-    """The lane helpers, held to what they are rather than to what the estate
-    commands are (Amendment 9(b)).
-
-    Same shebang and same executable bit — `--install` stamps 755 on everything
-    it places, and a copy that is not executable is not a command. `set -u` is
-    the floor all five share; `set -e` is NOT required of `lanes-edit.sh`,
-    whose whole job is to hold a lock, reach its own refusal and release it,
-    nor of `lane-handoff`, whose whole job is to leave no swap unwritten.
-    """
-    script = REPO / name
-    assert script.is_file()
-    assert os.access(script, os.X_OK), f"{name} must be executable: chmod +x"
-    text = script.read_text(encoding="utf-8")
-    assert text.startswith("#!/usr/bin/env bash\n")
-    assert ("set -u" in text or "set -euo pipefail" in text), (
-        f"{name} must at least `set -u`: an installed command that reads an "
-        "unset variable as the empty string writes somewhere nobody named")
-
-
-@WINDOWS_SKIP
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_shipped_bash_parses_under_bash(name):
-    """`bash -n` on every bash file this repository ships, everywhere there is
-    a bash.
-
-    SKIPPED ON WINDOWS, AND `shutil.which` IS NOT ENOUGH TO SEE WHY. The
-    `bash` a stock Windows install puts on PATH is
-    `C:\\Windows\\System32\\bash.exe`, the WSL launcher — `which` finds it, it
-    exits 1 with "no installed distributions" in UTF-16, and the failure reads
-    as a syntax error in the file. The bash that IS a bash there, Git Bash, is
-    handed `D:\\a\\...\\park` by this test and converts the path on its way in.
-    Neither one answers the question this test asks, and the question is
-    answered on every other platform in CI — including by the macOS job's
-    `/bin/bash -n`, which asks it of the bash a Mac actually ships.
-    """
-    if shutil.which("bash") is None:
-        pytest.skip("bash is not installed")
-    proc = subprocess.run(["bash", "-n", str(REPO / name)],
-                          capture_output=True, text=True, check=False)
-    assert proc.returncode == 0, proc.stderr
-
-
-#: THE FILES `--install` PLACES, READ OUT OF THE INSTALLER'S OWN LIST rather
-#: than restated here. `openRepoTools` declares them once — *"One list, so the
-#: installer, the fetch and the report cannot disagree"* — and deriving from it
-#: is what makes the rule below hold for the NEXT file this repository ships
-#: without anyone remembering to come here.
-def _installables() -> list[str]:
-    text = (REPO / "openRepoTools").read_text(encoding="utf-8")
-    match = re.search(r"^INSTALLABLES=\(([^)]*)\)$", text, re.MULTILINE)
-    assert match, "openRepoTools no longer declares `INSTALLABLES=( … )`"
-    names = match.group(1).split()
-    assert len(names) > 1, "INSTALLABLES parsed as one entry; the shape moved"
-    return names
-
-
-def test_every_placed_file_carries_in_the_index_the_mode_it_is_placed_with():
-    """A COMMAND THAT IS NOT EXECUTABLE IS NOT A COMMAND, AND THE INDEX IS
-    WHERE A FRESH CLONE READS THAT FROM.
-
-    `--install` stamps 755 on everything it places, so an installed copy runs
-    whatever the checkout says. What does NOT is the checkout itself: `./park`
-    from a clone, and the `cp -p` the lane suite copies `lane-handoff` with,
-    both take the mode git recorded.
-
-    WHAT THIS TEST IS DERIVED FROM, AND WHY IT IS ASKED OF THE INDEX. The first
-    `lane-handoff` commit under Amendment 17(a) landed 100644 and the lane
-    suite's own `chmod` hid it; `e25b54c` made it 100755 and added this row, so
-    the mode is now git's and the fixture reads it back rather than making it.
-    The two tests above are PER-NAME, and a name nobody added to either of them
-    is a name neither one asks about — which is the whole reason this one reads
-    the installer's own `INSTALLABLES` list instead of a list restated here.
-    (Any finding that says `lane-handoff` is 100644 is reading this paragraph
-    and not the index: `git ls-files -s lane-handoff` is the answer.)
-
-    The data file is the exception and is named as one: `repos.tsv` is read,
-    never run.
-    """
-    names = _installables()
-    proc = subprocess.run(["git", "ls-files", "-s", "--", *names],
-                          cwd=str(REPO), capture_output=True, text=True,
-                          check=True)
-    modes = {row.split("\t", 1)[1]: row.split(" ", 1)[0]
-             for row in proc.stdout.splitlines()}
-    assert sorted(modes) == sorted(names), (
-        f"`--install` names a file git does not track: {sorted(set(names) - set(modes))}")
-    for name in names:
-        want = "100644" if name.endswith(".tsv") else "100755"
-        assert modes[name] == want, (
-            f"{name} is {modes[name]} in the index and `--install` places it "
-            f"as {want}. For a command that is `git update-index --chmod=+x "
-            f"{name}`; a file that is DATA rather than a command wants the "
-            f"rule above it widened, not this one loosened")
-
-
-def test_the_estate_commands_carry_the_same_estate_resolver_byte_for_byte():
-    """THE DUPLICATION IS DELIBERATE AND THE CLAIM HAS TO STAY TRUE.
-
-    `park`, `resume` and `status` are each ONE file a person has on PATH, so
-    the estate resolver is copied rather than sourced: a shared `orp-estate.sh`
-    would be a fifth file for `--install` to place and a broken command the
-    first time somebody copied only one of them. A copy that has drifted is two
-    answers to "which estate is this", which is the one thing the block exists
-    to prevent. Three copies since `status` (Brett Heap's RULING of 2026-09-10,
-    "lets go with a fourth file"): the cost that ruling accepted, held here.
-
-    ASSERTED HERE AS WELL AS IN `test_park_resume_commands.py`, on purpose.
-    That file carries `NEEDS_UPSTREAM` and a `bash` guard, so in a clone made
-    without `--recurse-submodules` — or on Windows — its copy of this check
-    SKIPS. This invariant is about three files in this repository and needs
-    neither the submodule nor a shell, so it also lives where it always runs.
-    """
-    def block(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("# --- BEGIN shared estate resolver")
-        end = text.index("# --- END shared estate resolver")
-        return text[start:end]
-
-    blocks = {name: block(REPO / name) for name in ESTATE_COMMANDS}
-    reference = blocks["park"]
-    for name, text in blocks.items():
-        assert text == reference, (
-            f"park and {name} have drifted apart in the shared estate resolver")
-    assert len(reference.splitlines()) > 100, "the marker moved, not the block"
-
-
-def test_the_three_row_writers_carry_the_same_one_line_cut_byte_for_byte():
-    """THE SAME DISCIPLINE ONE BLOCK DOWN, on Amendment 13(a)'s cut.
-
-    `lane-start`, `lane-end` and `lane-handoff` each write a row's `state` cell,
-    and the cell's line is capped at 240 characters (ratified decision O1). Each
-    is ONE file a person has on PATH, so the cut is copied rather than sourced,
-    exactly as the workspace resolver above is — and a copy that has drifted is
-    two answers to "how long may this line be, and where may it be cut".
-
-    The question is not cosmetic. `${s:0:n}` counts BYTES wherever the locale is
-    not a UTF-8 one, and these lines are full of `—`, `·` and `→`: a copy that
-    cut at a bare offset would put half a character in the register, and a copy
-    that cut at 239 and appended a three-byte `…` would write 242 bytes into a
-    240-byte cap and be REFUSED — which is how this block came to exist, from a
-    `lane-end --force` that could not close its own row (measured 2026-09-15).
-    """
-    def block(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("# --- BEGIN shared one-line cut")
-        end = text.index("# --- END shared one-line cut")
-        return text[start:end]
-
-    writers = ("lane-start", "lane-end", "lane-handoff")
-    blocks = {name: block(REPO / name) for name in writers}
-    reference = blocks["lane-start"]
-    for name, text in blocks.items():
-        assert text == reference, (
-            f"lane-start and {name} have drifted apart in the shared one-line "
-            f"cut (Amendment 13(a))")
-    assert "ctl=\"${ctl:0:230}\"" in reference, (
-        "the cut no longer bounds the line at 230, which is what leaves room "
-        "for the marker inside ratified decision O1's cap of 240")
-    assert "ctl=\"${ctl% *}\"" in reference, (
-        "the cut no longer drops the last partial word, which is the whole of "
-        "what keeps a byte offset from landing inside a character")
-    assert 'ctl="${ctl// \u00b7 /; }"' in reference, (
-        "the cut no longer replaces the phrase's own separator, which "
-        "`set-row-state` refuses inside the line")
-    assert "ctl=\"${ctl//$'\\n'/; }\"" in reference, (
-        "the cut no longer flattens a newline, and a row is ONE line of a "
-        "table: one in this text splits the row in two and every row after it "
-        "is read as a lane")
-    # AND THE SKILL'S OWN COPY CARRIES THE SAME FOUR. `/handoff` is the same act
-    # as `lane-handoff` under one name (Amendment 17(a)), so it writes the state
-    # cell too — and a copy that dropped one of the four would be REFUSED by the
-    # writer exactly where the command is not (Copilot round 4 on #82). It is
-    # prose in a skill rather than a shell function, so the substitutions are
-    # asserted rather than compared byte for byte.
-    skill = (REPO / "skills/handoff/SKILL.md").read_text(encoding="utf-8")
-    for spelling in ("hs_line=\"${payload//$'\\r'/ }\"",
-                     "hs_line=\"${hs_line//$'\\n'/; }\"",
-                     'hs_line="${hs_line// \u00b7 /; }"',
-                     'hs_line="${hs_line//|/\u00a6}"'):
-        assert spelling in skill, (
-            f"the /handoff skill's row write no longer carries {spelling}, so "
-            f"it can hand `set-row-state` a line that writer refuses")
-    assert 'ctl="${ctl//|/\u00a6}"' in reference, (
-        "the cut no longer replaces a `|`, which `set-row-state` refuses "
-        "because it would forge a cell boundary in the row — and a launch "
-        "flag or a directory may legitimately carry one")
-
-
-def test_the_lane_helpers_carry_the_same_workspace_resolver_byte_for_byte():
-    """THE SAME DISCIPLINE AS THE ESTATE RESOLVER ABOVE, for the same reason,
-    on the block lane-collision-protocol AMENDMENT 9(a) is made of.
-
-    `lanes-edit.sh`, `lane-start`, `lane-end` and `link-estates` are each ONE
-    file a person has on PATH, placed by `--install`, so the resolver that
-    answers "where is this person's workspace repository" is copied into all
-    four rather than sourced — a shared `orp-workspace.sh` would be a tenth
-    file to place and a broken helper the first time somebody copied only one.
-
-    A drifted copy is TWO ANSWERS to that question, and one answer is the whole
-    of what clause (a) buys: it retired deriving the register from a script's
-    own real path precisely because "a second way to find it is a second
-    answer". Four copies that disagree would put that defect straight back, one
-    helper at a time, and the person would meet it as a register that one
-    command can write and another cannot find.
-
-    The block carries its own markers so this test names the drift rather than
-    a line number, exactly as the estate resolver's does.
-    """
-    def block(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("# --- BEGIN shared workspace resolver")
-        end = text.index("# --- END shared workspace resolver")
-        return text[start:end]
-
-    blocks = {name: block(REPO / name) for name in LANE_BASH}
-    reference = blocks["lanes-edit.sh"]
-    for name, text in blocks.items():
-        assert text == reference, (
-            f"lanes-edit.sh and {name} have drifted apart in the shared "
-            f"workspace resolver (Amendment 9(a))")
-    assert len(reference.splitlines()) > 100, "the marker moved, not the block"
-    # THE PIECES THAT MAKE IT THE AMENDMENT'S RESOLVER AND NOT SOME OTHER ONE.
-    # A block that kept the markers and lost the checkout test would pass the
-    # comparison above four times over.
-    assert '"${AGENT_PROTOCOL_ROOT:-$HOME/.agents}/workspace.yaml"' in reference, (
-        "the resolver no longer reads the one pointer file clause (a) names")
-    for field in ("repository", "path"):
-        assert f'lanes_ws_field {field} "$yaml"' in reference, (
-            f"the resolver no longer reads `{field}:`")
-    assert "rev-parse --show-toplevel" in reference, (
-        "the resolver no longer checks that `path:` is the ROOT of the "
-        "checkout, which clause (a) added as new behaviour")
-    assert "openRepoTools wip init" in reference, (
-        "the refusal no longer names the one command that fixes it")
-
-
-def test_the_workspace_refusal_carries_the_reason_it_computed():
-    """SIX DIAGNOSES ARE COMPUTED AND ALL SIX USED TO BE THROWN AWAY.
-
-    `lanes_workspace_root` sets `$LANES_WS_WHY` to the one sentence that says
-    WHICH of clause (a)'s ways it failed — no file, no `repository:`, no
-    `path:`, a `path:` that is not a checkout, a checkout of something else, or
-    a subdirectory rather than the root. Every caller reaches the resolver
-    through `LANES_WS_ROOT="$(lanes_workspace_root || :)"`, a COMMAND
-    SUBSTITUTION, so that assignment happened in a subshell and died with it:
-    the parent printed "no reason recorded" for all six.
-
-    Clause (a) makes failing to find the workspace "a refusal, never a guess",
-    and the estate's own convention (`status:3076-3078`) is that a refusal must
-    not be readable as something else. A refusal that names none of the six is
-    one a person cannot act on — the fix line `openRepoTools wip init` is
-    right for three of them and wrong for the other three, which want a
-    `workspace.yaml` edited rather than a repository created.
-
-    `lanes_workspace_why` therefore re-derives the reason in the PARENT shell
-    before printing. This test holds that line, because nothing else would
-    notice its loss: the refusal still exits 1 and still names the command.
-    """
-    for name in LANE_BASH:
-        text = (REPO / name).read_text(encoding="utf-8")
-        assert '[ -n "$LANES_WS_WHY" ] || lanes_workspace_root >/dev/null 2>&1 || :' \
-            in text, (
-            f"{name}'s `lanes_workspace_why` does not re-derive the reason in "
-            f"the parent shell, so every refusal reads `no reason recorded`")
-
-
-def test_status_carries_resumes_expand_home_byte_for_byte():
-    """`expand_home` reads the `~` a person writes in `~/.agents/workspace.yaml`
-    the same way in both commands that read that file. It sits OUTSIDE the
-    shared resolver block — `park` has no use for it — so the resolver test
-    does not hold the two copies together; this does."""
-    def function(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("expand_home() {")
-        return text[start:text.index("\n}\n", start)]
-    assert function(REPO / "status") == function(REPO / "resume"), (
-        "status and resume have drifted apart in expand_home")
-
-
-def test_the_estate_commands_carry_the_same_flag_value_byte_for_byte():
-    """`flag_value` reads `--flag value` and `--flag=value` the same way in
-    all three, and the comment above it is held too.
-
-    It sits OUTSIDE the shared estate resolver on purpose: that block answers
-    "which estate is this", and this answers "did this flag get a value" —
-    naming one the other would make the resolver's own header a lie. So it is
-    held here, the way `expand_home` is, and for the same reason: three files
-    a person has on PATH, and one answer.
-
-    THE QUESTIONS IT ASKS ARE ASSERTED TOO, because byte-identity alone is
-    satisfied by three copies of a function that asks none of them. Each is
-    the whole of one refusal: the arity check #14 wrote (`park --lane` at the
-    end of the line), the emptiness check `${2:?…}` used to make and #17 put
-    back (`--lane ""`), and the `-*` check (`--lane --dry-run`, which parked
-    with the lane set to the flag a person typed). The `=` split is the
-    fourth, and it is what keeps a value that really does begin with `-`
-    sayable at all.
-    """
-    def block(path: Path) -> str:
-        text = path.read_text(encoding="utf-8")
-        start = text.index("# THE VALUE OF A VALUE-TAKING FLAG")
-        return text[start:text.index("\n}\n", start)]
-
-    blocks = {name: block(REPO / name) for name in ESTATE_COMMANDS}
-    reference = blocks["park"]
-    for name, text in blocks.items():
-        assert text == reference, (
-            f"park and {name} have drifted apart in flag_value")
-    for asked in ('[ $# -ge 2 ] && [ -n "$2" ] || return 1',
-                  '[ -n "$FLAG_VALUE" ] || return 1',
-                  'FLAG_VALUE="${1#*=}"'):
-        assert asked in reference, f"flag_value no longer asks: {asked}"
-    dash = reference.split('case "$2" in', 1)[1]
-    assert dash.lstrip().startswith("-*)"), (
-        "flag_value no longer refuses a value that begins with `-`")
-
-
-def code_lines(path: Path) -> str:
-    """The file with its whole-line comments dropped.
-
-    Every rule below is about what these files DO, and the sentences in them
-    that name openRepoShape are about the standard, about a ruling, or about
-    where the code came from. Matching on the word alone would make a comment
-    into a finding, which teaches the next person to delete the comment.
-    """
-    return "\n".join(line for line in path.read_text(encoding="utf-8").splitlines()
-                     if not line.lstrip().startswith("#"))
-
-
-def test_the_estate_commands_name_no_runtime_dependency_on_the_standard():
-    """`park`, `resume` and `status` depend on the ESTATE, never on openRepoShape.
-
-    They run the estate's own `make park` / `make resume`; nothing in either
-    reaches for a checkout of the standard, fetches from it, or reads an
-    `$OPENREPOSHAPE_*` variable at run time. That is the whole dependency
-    direction this repository exists inside: tools depend on the shape, the
-    shape depends on nothing, and neither reaches for the other at run time.
-
-    The `$OPENREPOSHAPE_REMOTE_BASE` these two used to read is
-    `$OPENREPOTOOLS_REMOTE_BASE` here — a prefixed variable in a shipped file
-    names the tool that ships it (openRepoShape #92, decision 2). The ONE
-    mention of the old prefix that survives is a comment in `resume` naming
-    `$OPENREPOSHAPE_SETUP_SH`, which is openRepoShape's own shim's documented
-    offline path and still exists there; that is a cross-reference, not a call,
-    which is why this test reads code and not comments.
-
-    THE ONE `gh api` IN THESE THREE FILES is inside `status`'s `gh_api_line`,
-    which every question `status` puts to GitHub goes through — the fork
-    check (Brett Heap's RULING of 2026-09-11, "next layer: fork against
-    upstream") and the shape pin against the standard's main (his RULING of
-    the same day, "next layer: shape-pin drift") — under `--fetch` only,
-    read-only, host pinned. The only other `gh` in `status` is `gh_ready`'s
-    `command -v gh`. The verbs run no `gh` at all. A second call site would
-    be a second place the network is reached and a second place the failure
-    policy would have to be right, which is what this rule is for.
-    """
-    for name in ESTATE_COMMANDS:
-        code = code_lines(REPO / name)
-        assert "OPENREPOSHAPE" not in code, (
-            f"{name} reads an $OPENREPOSHAPE_* variable; the estate commands "
-            f"take no environment from the standard")
-        assert "raw.githubusercontent.com" not in code, (
-            f"{name} names a raw URL; the estate commands fetch nothing")
-        if name == "status":
-            # The usage text NAMES `gh api` to say when it is asked; that is
-            # prose in a heredoc, not a call, and is set aside here.
-            head, rest = code.split("cat <<'USAGE'", 1)
-            calls = head + rest.split("\nUSAGE\n", 1)[1]
-            api = calls.split("gh_api_line() {", 1)[1].split("\n}", 1)[0]
-            ready = calls.split("gh_ready() {", 1)[1].split("\n}", 1)[0]
-            assert "gh api" in api, "status's gh_api_line no longer asks gh"
-            assert "--hostname github.com" in api, (
-                "the one gh call no longer pins the host it asks")
-            elsewhere = calls.replace(api, "").replace(ready, "")
-            assert not re.search(r"(?<![\w-])gh\s", elsewhere), (
-                "status runs gh outside gh_api_line / gh_ready")
-        else:
-            assert "gh api" not in code, (
-                f"{name} calls the API; the verbs fetch nothing")
-
-
-#: THE VALUE-TAKING ARMS ACROSS THE THREE COMMANDS: `park`'s three (--lane,
-#: --repo, --name | --project), `resume`'s four (--repo, --workspace, --org,
-#: --name | --project) and `status`'s two (--repo, --name | --project). Kept
-#: by hand so that a TENTH is read through `flag_value` rather than straight
-#: from `$2` — the test names one that is not, and counts one that is.
-VALUE_TAKING_ARMS = 9
-
-
-def test_every_value_taking_arm_reads_its_value_through_flag_value():
-    """A FLAG GIVEN NO VALUE, AN EMPTY ONE, OR A FLAG is refused, in all three
-    commands, and every arm can also be given its value after an `=`.
-
-    `[ $# -ge 2 ]` checks only that an argument slot exists; the `${2:?…}` it
-    replaced rejected an unset OR NULL one; and neither ever asked what the
-    slot HELD. The difference is silent every time, because every one of these
-    values is read further down as "was this given at all?": `park --lane ""`
-    parked with the lane dropped out of the WIP commit subject, `--repo ""` in
-    any of the three fell past the `--repo` branch of the resolver into the
-    walk-up and acted on the estate around the current directory, and `park
-    Atlas --lane --dry-run` ran a REAL park whose lane was `--dry-run` — the
-    flag a person typed, swallowed as a value, with nothing but the commit
-    subject to say so.
-
-    THE EMPTY HALF SHIPPED TWICE, AND AN OUTSIDE REVIEWER CAUGHT IT BOTH
-    TIMES. Into `park` and `resume` at 83a1601, which swapped `${2:?…}` for
-    the arity check; and into `status` at fbf6f11, its first commit, where the
-    arm was written that way from the start and so was never in front of the
-    review that caught the other two. Nothing in this suite could see either
-    one, because each command's own tests ask what a REFUSAL says, and an arm
-    that does not refuse says nothing for them to read. So it is asked here,
-    of the text.
-
-    ONE QUESTION PER ARM NOW, not three: `flag_value` (held byte-identical
-    above) asks all of them, and each arm supplies its own words and its own
-    `die`. So what this reads is that every line taking a value into a
-    variable goes through it, within the three lines above; that the arm's
-    refusal carries both its own sentence and `$FLAG_HINT`, which is where the
-    `-`-led value's own line comes from; and that the case label above it
-    carries BOTH spellings of every flag it names — `--lane` and `--lane=*` —
-    because the `=` form is the only way left to pass a value beginning with
-    `-`, and an arm that had only the spaced spelling would have taken one
-    away without giving it back.
-
-    THE COUNT IS ASSERTED TOO, and it is hand-kept on purpose. That the guard
-    is right on nine arms is what the loop proves; the number is what makes a
-    TENTH — a value-taking flag somebody adds next year — arrive as a failure
-    to be read rather than as a silent pass. Move it in the same commit that
-    adds the arm.
-
-    Whole-line comments are dropped first, by `code_lines`, so a comment that
-    QUOTES an arm in order to explain it cannot stand in for the arm.
-
-    THE EXEMPTION IS A LINE RANGE, NOT A STRING (Copilot's review of #37,
-    2026-09-14). The one legitimate read of `$2` in each file is the one
-    INSIDE `flag_value`, and exempting the text `FLAG_VALUE="$2"` wherever it
-    appeared was not the same claim: an arm that wrote that very line and then
-    read the value back as `${FLAG_VALUE}` was exempted here AND invisible to
-    the counter below, so it left nine and PASSED — the same silent pass the
-    2026-09-11 review caught in the version before this one, reached by a
-    different door. Proved on a scratch copy of `park` before it was changed.
-    So the helper's own body is located by line number and the exemption is
-    "inside it", and the assignment this reads is any shell variable in either
-    spelling of `$2` — `value2="$2"` and `X="${2}"` are the same arm written
-    in a different case and in braces, and neither was matched before. The
-    counter reads `${FLAG_VALUE}` as well as `$FLAG_VALUE` for the same
-    reason. The match stays ANCHORED at the start of the statement, because a
-    `local file="$1" key="$2" line` is a function reading its own parameters
-    and not an arm at all — thirty-five of those lines across the three files
-    is what an unanchored search would have called a finding.
-    """
-    #: An assignment that takes `$2` straight, in either spelling and whatever
-    #: the variable is called, ANCHORED at the start of the statement so that
-    #: a function reading its own parameters (`local file="$1" key="$2" line`)
-    #: is not one.
-    takes_dollar_two = re.compile(r'\s*[A-Za-z_][A-Za-z0-9_]*="\$\{?2\}?"')
-    #: An arm reading the value the helper answered with, in either spelling.
-    reads_flag_value = re.compile(
-        r'\s*[A-Za-z_][A-Za-z0-9_]*="\$\{?FLAG_VALUE\}?"')
-
-    found = 0
-    for name in ESTATE_COMMANDS:
-        lines = code_lines(REPO / name).splitlines()
-        # THE HELPER'S OWN BODY, by line number: `flag_value() {` to the `}`
-        # in column 0 that closes it. This is the whole of the exemption
-        # below, and it is a RANGE rather than a string for the reason the
-        # docstring gives.
-        opens = [i for i, l in enumerate(lines)
-                 if l.startswith("flag_value() {")]
-        assert len(opens) == 1, (
-            f"{name}: {len(opens)} definitions of flag_value, expected one")
-        start = opens[0]
-        closes = [i for i in range(start + 1, len(lines)) if lines[i] == "}"]
-        assert closes, f"{name}: flag_value is never closed in column 0"
-        end = closes[0]
-        for i, line in enumerate(lines):
-            # A TENTH ARM WRITTEN THE OLD WAY — `X="$2"` — must be caught, not
-            # missed: the count below sees only arms that read `$FLAG_VALUE`,
-            # so an arm that bypasses `flag_value` would leave it at nine and
-            # pass (the independent review of this branch, 2026-09-11, and
-            # Copilot's of #37). The one legitimate read of `$2` in each file
-            # is the one inside `flag_value` itself, and INSIDE is asked of
-            # the line number, not of the text.
-            if takes_dollar_two.match(line):
-                assert start < i < end, (
-                    f"{name}: {line.strip()} takes $2 straight from the "
-                    f"command line, outside flag_value; every value-taking "
-                    f"arm reads its value through flag_value")
-                continue
-            if not reads_flag_value.match(line):
-                continue
-            found += 1
-            where = f"{name}: {line.strip()}"
-            guard = "\n".join(lines[max(0, i - 3):i])
-            assert 'flag_value "$@" ||' in guard, (
-                f"{where} takes a value without asking flag_value for it")
-            assert "needs a value:" in guard and "$FLAG_HINT" in guard, (
-                f"{where} refuses in words that are not this arm's, or drops "
-                f"the line that names the `=` spelling")
-            head = i - 1
-            while head >= 0 and not re.match(r"\s*-.*\)$", lines[head]):
-                head -= 1
-            assert head >= 0, f"{where} is not inside a case arm at all"
-            spellings = [s.strip()
-                         for s in lines[head].strip()[:-1].split("|")]
-            spaced = [s for s in spellings if not s.endswith("=*")]
-            assert sorted(spellings) == sorted(
-                spaced + [s + "=*" for s in spaced]), (
-                f"{where}: the arm matches {spellings}, which is not every "
-                f"flag it names in both spellings")
-    assert found == VALUE_TAKING_ARMS, (
-        f"{found} lines take a flag's value, not {VALUE_TAKING_ARMS}: a "
-        f"value-taking flag was added or removed. Read the new arm, then move "
-        f"the number.")
-
-
-#: `--flag <value>` and `--flag=<value>` are two spellings of ONE flag. The
-#: pattern half of a `case` arm, up to its `)`, with grouped patterns kept whole.
-CASE_ARM_HEAD = re.compile(r"^\s*(--[A-Za-z0-9=*|_ -]+?)\)(\s|$)")
-#: The guard the two-token arms of this estate are written with.
-EMPTY_VALUE_GUARD = re.compile(r'\[ -n "\$\{?[A-Za-z_][A-Za-z0-9_]*\}?" \]')
-
-
-def _value_flag_arms(text: str) -> dict:
-    """{flag: {"plain": arm text, "equals": arm text}} for every option arm.
-
-    An arm runs from its pattern line to the line carrying its `;;`, so a
-    multi-line arm (`lane-end`'s `--retire=*`) is read whole and not by its
-    first line. Grouped patterns (`--repo | --dir | --ws | --prefix)`) count
-    for every flag they name.
-    """
-    lines = text.splitlines()
-    arms: dict = {}
-    for i, line in enumerate(lines):
-        head = CASE_ARM_HEAD.match(line)
-        if not head or line.lstrip().startswith("#"):
-            continue
-        body, j = [line], i
-        while ";;" not in lines[j] and j + 1 < len(lines) and j - i < 15:
-            j += 1
-            body.append(lines[j])
-        whole = "\n".join(body)
-        for token in head.group(1).split("|"):
-            token = token.strip()
-            if not token.startswith("--"):
-                continue
-            equals = token.endswith("=*")
-            flag = token[2:-2] if equals else token[2:]
-            if not flag:
-                continue
-            arms.setdefault(flag, {})["equals" if equals else "plain"] = whole
-    return arms
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_the_two_spellings_of_a_flag_refuse_the_same_empty_value(name):
-    """ONE FLAG, TWO SPELLINGS, ONE ANSWER (#26, the review of `c3ebcfe`,
-    `lane-start:707`).
-
-    `lane-start --dir ""` refuses; `lane-start --dir=` set the variable to
-    nothing and FELL THROUGH as if no directory had been named at all, so the
-    rungs below it ran — one of which is `$PROJECTS_ROOT/<repo>` — and the
-    command started in a checkout the operator never asked for instead of
-    refusing a path they never gave. `restart:151`, the same flag on the
-    sibling command, has carried the guard on both spellings all along, which
-    is what makes this a DIVERGENCE and not a decision: eight arms across three
-    files had the guard on the two-token spelling and none on the `=` one, and
-    not one of them was reachable by any test in this suite, because an arm
-    that does not refuse says nothing for a test to read. That is the same
-    reasoning `test_every_value_taking_arm_refuses_an_empty_value` was written
-    from, one command over, after an outside reviewer caught the same class
-    twice.
-
-    Derived from the arms themselves and never from a list: where a flag's
-    two-token arm carries the estate's own `[ -n "$var" ]` guard, its `=` arm
-    must carry one too. A flag guarded in NEITHER spelling is not this rule's
-    business — `--text` is deliberately one — and a flag with only one spelling
-    has nothing to disagree with.
-    """
-    arms = _value_flag_arms((REPO / name).read_text(encoding="utf-8"))
-    offenders = [
-        flag for flag, spelling in sorted(arms.items())
-        if "plain" in spelling and "equals" in spelling
-        and EMPTY_VALUE_GUARD.search(spelling["plain"])
-        and not EMPTY_VALUE_GUARD.search(spelling["equals"])]
-    assert not offenders, (
-        f"{name}: `--{'`, `--'.join(offenders)}` refuses an empty value when "
-        f"it is spelled `--flag \"\"` and takes one when it is spelled "
-        f"`--flag=`. The second spelling then reads as ABSENT, and every rung "
-        f"below the flag runs on a value the operator did give.")
-
-
-#: The four helpers every assertion in the shell suite is written with, and the
-#: DESCRIPTION each takes first — the string a person reads in the output.
-SUITE_ASSERT_DESC = re.compile(r'^\s*(?:is|has|hasnt|skip)\s+"((?:[^"\\]|\\.)*)"')
-
-
-def test_the_suite_descriptions_run_no_command_of_their_own():
-    """A BACKTICK IN A DOUBLE-QUOTED STRING IS A COMMAND SUBSTITUTION, and this
-    estate writes prose full of them.
-
-    Found in the `tests-macos` log of `29d3417`, which prints the suite's own
-    stderr when it fails: *"command substitution: line 4016: syntax error near
-    unexpected token `newline'"*, twice. The lines are descriptions —
-    `hasnt "…and never `kill <pid>`, which the ruling refuses by name"` — where
-    bash read the backticks as a substitution, tried to run `kill <pid>`, and
-    handed the assertion a description with a hole in it. A third,
-    `the `forks` read beside it`, RAN `forks`. None of them can fail a test,
-    which is why all three sat there: the description is not compared to
-    anything. What they cost is the output a person reads when something else
-    fails, and on one of them the words that went missing name the act the
-    ruling refuses.
-
-    So: in the description of every `is`, `has`, `hasnt` and `skip`, a backtick
-    is escaped. The other arguments are untouched — they are `$(…)`
-    substitutions by design.
-    """
-    bad = []
-    for number, line in enumerate(
-            (REPO / "tests/test_lane_helpers.sh").read_text(
-                encoding="utf-8").splitlines(), 1):
-        hit = SUITE_ASSERT_DESC.match(line)
-        if hit and re.search(r"(?<!\\)`", hit.group(1)):
-            bad.append(f"{number}: {line.strip()[:120]}")
-    assert not bad, (
-        "these assertion descriptions carry an UNESCAPED backtick, so bash "
-        "runs what is between them and the description a person reads has a "
-        "hole where those words were. Write ``\\` ``:\n  " + "\n  ".join(bad))
-
-
-#: A line that actually FETCHES, as opposed to a line of the usage heredoc
-#: that says the word: a `gh api "…"`, a raw-content URL, or an
-#: `api.github.com/repos/…` URL (a `curl` of the REST API, which the first
-#: reading did not scan; lane openRepoTools-3's review of #191, delta 5). Each
-#: takes a quoted or variable argument, which the prose never does.
-def fetching_lines_of(code: str) -> list[str]:
-    return [line for line in code.splitlines()
-            if 'gh api "' in line or 'raw.githubusercontent.com/$' in line
-            or 'api.github.com/repos/' in line]
-
-
-def fetching_lines(path: Path) -> list[str]:
-    return fetching_lines_of(code_lines(path))
-
-
-#: The REPOSITORY a fetching line names: what follows `repos/` or the raw
-#: host, read as one shell expansion (`$X`, or `${…}` whole).
-FETCH_REPOSITORY = re.compile(
-    r"(?:repos/|raw\.githubusercontent\.com/)(\$\{[^}]*\}|\$[A-Za-z_][A-Za-z0-9_]*)")
-#: `$P`, `${P}`, or `${P:-$REPO}`: a variable standing for the repository.
-PAYLOAD_SLOT = re.compile(r"\$\{?([A-Za-z_][A-Za-z0-9_]*)(?::-\$REPO)?\}?")
-
-
-def assigned_values(code: str, name: str) -> list[tuple[str, str]]:
-    """Every `name=<value>` in `code`, as (value with its quotes off, the
-    line it is on)."""
-    found = []
-    pattern = re.compile(r"(?:^|[\s;(])" + re.escape(name)
-                         + r"""=("[^"]*"|'[^']*'|[^\s;)]*)""")
-    for line in code.splitlines():
-        for match in pattern.finditer(line):
-            found.append((match.group(1).strip("\"'"), line.strip()))
-    return found
-
-
-#: The variable a pin reader binds each parsed value to, and the function
-#: that alone may set it (#191's `pin_scalar`).
-PIN_SCALAR_VALUES = ("$PIN_SCALAR", "${PIN_SCALAR}")
-
-
-def scalar_set_only_by_the_pin_reader(code: str) -> bool:
-    """`code` has a `pin_scalar() {` … `}` reader that sets `PIN_SCALAR` to a
-    parsed value, and nothing else sets it to anything but empty. Without the
-    reader, or with a reader that never sets it, `$PIN_SCALAR` would be
-    whatever the environment held (Copilot round 2 on #195)."""
-    inside = reader = False
-    parsed = 0
-    for line in code.splitlines():
-        stripped = line.strip()
-        if re.match(r"pin_scalar\(\)", stripped):
-            inside = reader = True
-            continue
-        if inside and stripped == "}":
-            inside = False
-            continue
-        for value, _ in assigned_values(line, "PIN_SCALAR"):
-            if not value:
-                continue
-            if not inside:
-                return False
-            parsed += 1
-    return reader and parsed > 0
-
-
-def installer_source_violations(code: str) -> list[str]:
-    """What `test_the_installer_reaches_only_this_repository` refuses in
-    `code` (comment lines already dropped): each fetching line whose
-    REPOSITORY is not `$REPO`, the pinned standard, or a payload variable
-    that only ever holds `$REPO` or a pin's `source_repository:` value."""
-    def pin_named(var: str) -> bool:
-        # Set only in a `source_repository)` arm, and only to the value the
-        # pin reader parsed: an arm that assigned anything else would make
-        # the payload repository come from elsewhere (Copilot on #195).
-        values = assigned_values(code, var)
-        return bool(values) and all(
-            value == "" or ("source_repository)" in line
-                            and value in PIN_SCALAR_VALUES
-                            and scalar_set_only_by_the_pin_reader(code))
-            for value, line in values)
-
-    def honest(var: str) -> bool:
-        values = assigned_values(code, var)
-        if not values:
-            return False
-        for value, _line in values:
-            if value in ("", "$REPO", "${REPO}"):
-                continue
-            inner = PAYLOAD_SLOT.fullmatch(value)
-            if inner and inner.group(0) == value and pin_named(inner.group(1)):
-                continue
-            return False
-        return True
-
-    bad = []
-    for line in fetching_lines_of(code):
-        slots = FETCH_REPOSITORY.findall(line)
-        if not slots:
-            bad.append(f"names no repository this test can read: {line.strip()}")
-        for slot in slots:
-            if slot in ("$REPO", "${REPO}", "$SHAPE_REPOSITORY", "${SHAPE_REPOSITORY}"):
-                continue
-            var = PAYLOAD_SLOT.fullmatch(slot)
-            if var and honest(var.group(1)):
-                continue
-            bad.append(f"fetches from {slot}, which is not $REPO, the pinned "
-                       f"standard, or a variable holding only those or a pin's "
-                       f"source_repository: {line.strip()}")
-    return bad
-
-
-def test_the_installer_reaches_only_this_repository():
-    """`--install` fetches from `$OPENREPOTOOLS_REPO`, or from the code
-    repository the assembly it installs from PINS, and from nowhere else.
-
-    RESTATED for the adopted layout (#191's payload source; lane
-    openRepoTools-3's review of #191, delta 5, T009's to restate). The first
-    reading asked only that a fetching line CONTAIN `$REPO`, so a line fetching
-    from `${PAYLOAD_REPO:-$REPO}` passed by spelling whatever `PAYLOAD_REPO`
-    held, and a `curl` of `api.github.com` was never read at all. Now the
-    REPOSITORY each fetching line names is read out of it, and it must be one
-    of three things: `$REPO`; the pinned standard (`wip init`, below); or a
-    variable whose every assignment is empty, `$REPO`, or a variable that only
-    a pin's `source_repository:` sets — the code repository an adopted
-    assembly's `contracts/code-pin.yaml` names, which is this repository's own
-    code, moved.
-
-    An `--install` that reached into openRepoShape to complete itself would
-    make this repository's installer depend on the standard at run time, which
-    is the direction the pin's own header spends a paragraph refusing — and it
-    is the mirror of the rule openRepoShape's own `--install` follows by
-    printing a POINTER at this repository rather than fetching from it.
-
-    `wip init` IS THE ONE EXCEPTION, and it is not `--install`'s (lane protocol
-    Amendment 9(c) step 7). It materializes openRepoShape's
-    `templates/workspace-root/` — nine files this repository deliberately does
-    not carry a copy of, because a copy is a second answer to what the template
-    is — and it does it AT THE PINNED COMMIT, not at that repository's `main`.
-    The test below is the one that holds it to the pin.
-    """
-    bad = installer_source_violations(code_lines(REPO / "openRepoTools"))
-    assert not bad, ("the command fetches from a repository it may not:\n    "
-                     + "\n    ".join(bad))
-
-
-@pytest.mark.parametrize("code, refused", [
-    pytest.param('OTHER="someone/else"\n'
-                 'gh api "repos/${OTHER:-$REPO}/contents/park?ref=$REF"\n',
-                 True, id="passes-by-spelling"),
-    pytest.param('curl -fsSL "https://api.github.com/repos/$OTHER/commits/$REF"\n',
-                 True, id="an-api-curl-the-first-reading-never-read"),
-    pytest.param('PAYLOAD_REPO="$FROM_THE_ENVIRONMENT"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/park"\n',
-                 True, id="a-payload-variable-set-from-elsewhere"),
-    pytest.param('PIN_SOURCE_REPOSITORY=""\n'
-                 'case "$key" in\n'
-                 '  source_repository) PIN_SOURCE_REPOSITORY="$FROM_THE_ENVIRONMENT" ;;\n'
-                 'esac\n'
-                 'PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/park"\n',
-                 True, id="a-pin-arm-that-assigns-something-else"),
-    pytest.param('pin_scalar() {\n'
-                 '\tPIN_SCALAR="${v%% #*}"\n'
-                 '}\n'
-                 'PIN_SCALAR="$FROM_THE_ENVIRONMENT"\n'
-                 'case "$key" in\n'
-                 '  source_repository) PIN_SOURCE_REPOSITORY="$PIN_SCALAR" ;;\n'
-                 'esac\n'
-                 'PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/park"\n',
-                 True, id="a-scalar-set-outside-the-pin-reader"),
-    pytest.param('case "$key" in\n'
-                 '  source_repository) PIN_SOURCE_REPOSITORY="$PIN_SCALAR" ;;\n'
-                 'esac\n'
-                 'PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/park"\n',
-                 True, id="no-pin-reader-so-the-scalar-is-the-environments"),
-    pytest.param('pin_scalar() {\n'
-                 '\tPIN_SCALAR=""\n'
-                 '}\n'
-                 'case "$key" in\n'
-                 '  source_repository) PIN_SOURCE_REPOSITORY="$PIN_SCALAR" ;;\n'
-                 'esac\n'
-                 'PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/park"\n',
-                 True, id="a-pin-reader-that-never-sets-the-scalar"),
-    pytest.param('PIN_SCALAR=""\n'
-                 'pin_scalar() {\n'
-                 '\tPIN_SCALAR="${rest%%"$q"*}"\n'
-                 '\tPIN_SCALAR="${v%% #*}"\n'
-                 '}\n'
-                 'PIN_SOURCE_REPOSITORY=""\n'
-                 'case "$key" in\n'
-                 '  source_repository) PIN_SOURCE_REPOSITORY="$PIN_SCALAR" ;;\n'
-                 'esac\n'
-                 'PAYLOAD_REPO=""\n'
-                 'PAYLOAD_REPO="$REPO" PAYLOAD_REV=""\n'
-                 'PAYLOAD_REPO="$PIN_SOURCE_REPOSITORY" PAYLOAD_REV="$PIN_COMMIT"\n'
-                 'gh api "repos/${PAYLOAD_REPO:-$REPO}/contents/$path"\n'
-                 'curl -fsSL "https://raw.githubusercontent.com/${PAYLOAD_REPO:-$REPO}/$rev/$path"\n'
-                 'curl -fsSL "https://api.github.com/repos/${PAYLOAD_REPO:-$REPO}/git/trees/$1"\n',
-                 False, id="the-adopted-source-honestly"),
-    pytest.param('gh api "repos/$REPO/contents/park?ref=$REF"\n'
-                 'gh api "repos/$SHAPE_REPOSITORY/contents/$f?ref=$ref"\n',
-                 False, id="todays-two-sources"),
-])
-def test_the_installer_source_rule_is_not_met_by_spelling(code, refused):
-    """The restated rule against planted lines: the two shapes the first
-    reading let through, a payload variable fed from anywhere else, and the
-    two shapes it must keep accepting."""
-    assert bool(installer_source_violations(code)) is refused, (
-        installer_source_violations(code))
-
-
-def test_the_template_is_fetched_from_the_pinned_standard_and_at_the_pin():
-    """`wip init` seeds a person's workspace repository from bytes it fetches,
-    and WHICH bytes is a pin question, not a `main` question.
-
-    openRepoShape squash-merges, so a commit on a branch there is orphaned by
-    the merge and a raw fetch of it 404s for the next person — the reason
-    `contracts/openreposhape-pin.yaml` refuses a commit that is not on that
-    repository's default branch. This test is why `wip_shape_ref` reads the pin
-    rather than spelling `main`: a template that drifted under a person's feet
-    would seed two workstations differently from one command.
-    """
-    text = (REPO / "openRepoTools").read_text(encoding="utf-8")
-    assert 'SHAPE_REPOSITORY="opensoft/openRepoShape"' in text, (
-        "the template's source repository is a constant in this file, by "
-        "Amendment 9(c) step 7's substitution table")
-    for line in fetching_lines(REPO / "openRepoTools"):
-        if "$SHAPE_REPOSITORY" in line:
-            assert "$ref" in line, (
-                "a template fetch that does not carry the pinned ref would "
-                f"take whatever openRepoShape's main holds today:\n    {line.strip()}")
-    # `-e`, and not a bare script followed by `--`: BSD's `getopt` stops at the
-    # first operand, so `sed -n 'script' -- "$file"` reads `--` as a FILENAME
-    # there (A9 Addendum 4, R-A9-11, and the two tests at the foot of this
-    # file).
-    assert 'sed -n -e \'s/^commit:[[:space:]]*//p\'' in text, (
-        "wip_shape_ref must read `commit:` out of "
-        "contracts/openreposhape-pin.yaml rather than spelling a ref")
-
-
-def test_the_readme_prints_the_install_line_the_pointer_prints():
-    """openRepoShape's `--install` prints one `curl` line pointing here, and a
-    reader who follows it must land on the same bytes this README documents.
-    Two spellings of one install line is one of them being wrong."""
-    readme = doc("README.md").read_text(encoding="utf-8")
-    assert RAW_INSTALL_LINE in readme, (
-        "README.md does not carry the install line openRepoShape's --install "
-        f"points at, byte for byte:\n    {RAW_INSTALL_LINE}")
-
-
-def test_the_readme_also_carries_the_gh_api_form():
-    """BOTH FORMS, because an organisation whose policy blocks
-    raw.githubusercontent.com still has a working `gh` — the same reason the
-    installer tries the API first. The shim's own pointer has room for one
-    line; the READMEs are where the twin lives."""
-    readme = doc("README.md").read_text(encoding="utf-8")
-    assert "gh api repos/opensoft/openRepoTools/contents/openRepoTools" in readme
-    assert "-H 'Accept: application/vnd.github.raw'" in readme
-    assert "bash -s -- --install" in readme
-
-
-def test_the_readme_carries_the_two_line_onboarding_chain():
-    """lane-collision-protocol AMENDMENT 9(e), "The chain": a new person, from
-    nothing to a lane, in TWO LINES — and neither of them is a command in this
-    repository.
-
-    `./setup.sh` runs `openRepoTools --install` and then `openRepoTools wip
-    init` for the person, each best-effort, so neither is a line anybody has to
-    know to type. Brett Heap's direction of 2026-09-12, verbatim "we need to
-    also keep that clean so there is the least choices possible to not confuse
-    the user", is the measure that clause is written to, and an earlier draft
-    of it failed the measure with twelve steps.
-
-    Held here for the reason every other document test in this file is held:
-    the chain is the one part of this repository's story that is TRUE ONLY
-    ELSEWHERE — in workBenches' `setup.sh` — so nothing in this repository's
-    own behaviour goes red when it rots. The two preconditions are held with
-    it, because a chain that omits them is a chain that fails on line 1 for a
-    reason the person cannot see: `gh auth login`, since `wip init` derives the
-    login from `gh api user`, and `~/.local/bin` on `PATH`, which needs a
-    restarted terminal before anything `--install` placed can be typed.
-    """
-    readme = doc("README.md").read_text(encoding="utf-8")
-    assert "gh repo clone opensoft/workBenches && cd workBenches && ./setup.sh" \
-        in readme, (
-        "README.md does not carry Amendment 9(e)'s first line, byte for byte")
-    assert "lclaude --lane <repo>-<n> <profile>" in readme, (
-        "README.md does not carry Amendment 9(e)'s second line")
-    assert "gh auth login" in readme, (
-        "README.md names neither of the chain's two preconditions: `wip init` "
-        "derives the login from `gh api user`, so an unauthenticated `gh` "
-        "meets a refusal on line 1")
-    assert "restarted terminal" in readme, (
-        "README.md does not say ~/.local/bin needs a restarted terminal "
-        "before the commands --install placed are on PATH")
-    assert "openRepoTools wip init" in readme, (
-        "README.md does not name the act that creates the workspace, which is "
-        "the by-hand half of the chain for a host with no workBenches")
-
-
-def test_no_document_offers_a_windows_powershell_twin():
-    """NATIVE WINDOWS PARKS NOTHING, and saying otherwise is worse than saying
-    nothing. No command here has a PowerShell twin, and there is no
-    `Invoke-WebRequest` two-liner to point at, so on Windows the way in is
-    WSL2 — which both documents say, once each."""
-    for name in ("README.md", "AGENTS.md"):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "Invoke-WebRequest" not in text, (
-            f"{name} offers a Windows download line for a bash-only toolset")
-        assert "WSL2" in text, f"{name} must say what a Windows reader does"
-
-
-def test_claude_md_points_at_agents_md():
-    assert "AGENTS.md" in doc("CLAUDE.md").read_text()
-
-
-def test_the_documents_say_what_bare_park_does_now():
-    """Brett Heap's RULING of 2026-09-10 in this repository, verbatim: "lets
-    change that so it parks the current repo. if not in a repo, then asks if
-    want to park all. and park all should be park -a or park --all." It
-    supersedes his openRepoShape #91 ruling of the same day (its #93), under
-    which the bare form with no estate around the cwd PARKED EVERY ESTATE
-    unasked — which had itself superseded ruling 3 of its #82, REFUSE and
-    list. So, now: the estate around the cwd; outside every estate, list and
-    ASK; `--all` / `-a` as the sweep without the question; and `resume`
-    keeping the refusal for its own bare form, with no `--all` of its own.
-
-    All of it, in both documents and the command's own header. This is the
-    sentence most likely to go stale here, because these two files are the
-    only place the installed commands are written down, and because every
-    text this sentence has had reads perfectly well — a document that says
-    `park` refuses, or that it sweeps unasked, is not obviously broken, it is
-    just wrong, and an assistant reading it either tells somebody to name an
-    estate the bare form does not need or, worse, treats a bare `park` in the
-    wrong folder as a one-keystroke sweep of the workstation.
-    """
-    # THE COMMAND'S OWN HALF FIRST (#186, T009): in a standalone code leg the
-    # documents are another root's, and the first one read ends the test.
-    park = (REPO / "park").read_text(encoding="utf-8")
-    assert "PARKED EVERY ESTATE unasked" in park, (
-        "the `park` header no longer says what #91's bare form did and that "
-        "it is superseded; a reader of the ruling trail needs both")
-    for name in code_first("README.md", "AGENTS.md", "park"):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "--all" in text, f"{name} does not name the sweep's flag"
-        assert re.search(r"(?<![\w-])-a(?![\w-])", text), (
-            f"{name} does not name the short form, -a")
-        assert "ASKS" in text, (
-            f"{name} does not say the bare form ASKS outside every estate")
-        assert "#91" in text, (
-            f"{name} does not cite the ruling this one supersedes")
-        assert "in name order" in text, (
-            f"{name} does not say the order, which is the whole of what a "
-            f"person watching a sweep sees")
-    assert "keeps that old refusal for its own bare form" in \
-        doc("README.md").read_text(encoding="utf-8"), (
-        "README.md does not say resume's own bare form still refuses")
-    assert "`resume`'s OWN bare form still refuses" in \
-        doc("AGENTS.md").read_text(encoding="utf-8"), (
-        "AGENTS.md does not say resume's own bare form still refuses")
-
-
-def test_the_documents_say_what_status_is_and_is_not():
-    """Brett Heap's RULING of 2026-09-10 in this repository, verbatim: "lets go
-    with a fourth file. start with the local status layer." `status` is the
-    read-only view of an estate — what is in and out of sync — and the LOCAL
-    layer: it fetches nothing unless told to, so every answer is as of the
-    last fetch. His RULING of 2026-09-11, verbatim: "next layer: --fetch" —
-    the flag asks origin first, the one write the command makes, to
-    remote-tracking refs and nothing else.
-
-    All of it in both documents and in the command's own header, for the
-    reason the other document tests give: the wrong reading is the one an
-    assistant reaches for unaided. A `status` that "checks the remote" is one
-    somebody runs `git fetch` on behalf of to make current — when the flag
-    is what they should reach for — and a report of findings with exit 1 is
-    one somebody calls a failure. The install count is held too, because the
-    install story is the sentence a first-time reader trusts — and it is NINE
-    from lane-collision-protocol Amendment 9(b), not four: the four estate
-    commands plus `lanes-edit.sh`, `lane-start`, `lane-end`, `link-estates`
-    and the shipped `repos.tsv`. The number is asserted rather than the word
-    "four" precisely so that a document which grows the install and forgets
-    to say so is a red test.
-    """
-    status = (REPO / "status").read_text(encoding="utf-8")
-    assert "--no-optional-locks" in status, (
-        "status takes locks: a read-only command beside an editor must not be "
-        "the thing that says index.lock exists")
-    for name in code_first("README.md", "AGENTS.md", "status"):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "fetches nothing" in text, (
-            f"{name} does not say status fetches nothing without the flag")
-        assert "--fetch" in text, f"{name} does not name the flag"
-        assert "remote-tracking refs" in text, (
-            f"{name} does not bound the one write --fetch makes")
-        assert "`upstream`" in text, (
-            f"{name} does not say how a fork is read: a remote named upstream")
-        assert "shape-pin.yaml" in text, (
-            f"{name} does not say the shape pin is read")
-        assert "update-shape.py" in text, (
-            f"{name} does not name the exit for a shape pin that is behind")
-        assert "workspace.yaml" in text, (
-            f"{name} does not say the parked record is read against disk")
-        assert "gh api" in text, (
-            f"{name} does not say the fork check may ask gh, and only under "
-            f"--fetch")
-        assert "as of the last fetch" in text.lower(), (
-            f"{name} does not say every answer is as of the last fetch")
-        assert "local layer" in text.lower(), (
-            f"{name} does not say this is the local layer, with more to come")
-    for name in ("README.md", "AGENTS.md"):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "`status`" in text, f"{name} never names the fourth command"
-    readme = doc("README.md").read_text(encoding="utf-8")
-    assert "THIRTEEN files" in readme, (
-        "README.md does not count the thirteen files")
-    assert "13 of 13 placed" in readme, (
-        "README.md does not show the count line `--install` actually prints")
-
-
-def test_the_documents_say_the_sweep_skips_a_root_without_the_overlay():
-    """#6, under Brett Heap's RULING of 2026-09-10 on openRepoShape #92
-    ("skip roots without the overlay"): in the SWEEP, a root with no Speckit
-    git overlay is SKIPPED and named, counted apart, and left out of the exit
-    code — while `park <Name>` on that same root still relays the Makefile's
-    refusal.
-
-    Held in both documents and in the command's own header for the reason the
-    test above is: the wrong half of this is the half that reads fine. A
-    document that says only "continuing past a refusal" is not obviously
-    stale, and an assistant reading it tells somebody a clean sweep failed —
-    or, worse, treats four never-installed roots as four things to fix before
-    the park can be trusted.
-    """
-    for name in code_first("README.md", "AGENTS.md", "park"):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "SKIPPED" in text, (
-            f"{name} does not say the sweep SKIPS a root without the overlay")
-        assert "Speckit git overlay" in text, (
-            f"{name} does not name WHAT is missing from such a root")
-        assert "#92" in text, f"{name} does not cite the ruling"
-        assert "setup-openspeckit" in text, (
-            f"{name} does not name the installer, which is the whole of what "
-            f"the person reading a skipped line has to do next")
-    for name in ("README.md", "AGENTS.md"):
-        assert "skipped (no overlay)" in doc(name).read_text(
-            encoding="utf-8"), (
-            f"{name} does not show the summary clause a person actually sees")
-
-
-def _parser_long_options(text):
-    """Every long option the file's argument loop has an arm for, taken from
-    the arms themselves rather than from a list beside them."""
-    loop = re.search(r"^while \[ \$# -gt 0 \]; do$(.*?)^done$", text,
-                     re.S | re.M)
-    assert loop, "no `while [ $# -gt 0 ]` argument loop found"
-    found = set()
-    for line in loop.group(1).splitlines():
-        stripped = line.strip()
-        if not stripped.startswith("-"):
-            continue
-        found.update(re.findall(r"--[a-z][a-z0-9-]+", stripped.split(")", 1)[0]))
-    return found
-
-
-@pytest.mark.parametrize("name", ["lanes", "lane"])
-def test_every_option_the_parser_accepts_is_in_the_usage(name):
-    """AN OPTION NOT IN THE SYNOPSIS IS AN OPTION NOBODY FINDS.
-
-    `lanes --prefix <repo>` was parsed, documented in the BODY of `--help` and
-    used by `lane-start <repo>` with no position - and missing from the SYNOPSIS
-    LINE, which is the line a person reads first and often the only one they
-    read. So the one way to ask for a repository's lanes by name was invisible
-    to everybody who did not read to the bottom. The defect is the same one
-    `test_the_unknown_subcommand_refusal_names_every_subcommand_there_is`
-    exists for, one file over, and the fix is the same: DERIVE the list from
-    the arms rather than restate it beside them.
-
-    The SYNOPSIS is what is asserted, not the whole of `--help`: the body had
-    `--prefix` all along, so a rule that accepted the body would have passed
-    over the defect it was written for. `--help` itself is exempt, because a
-    synopsis that lists it says nothing a reader typing `--help` does not
-    already know.
-
-    Held for the two words a person is given — `lanes`, which Amendment 11
-    added, and `lane`, which Amendment 18 Addendum 1 added and Addendum 2 made
-    the only door — and not yet for the eight files beside them: their parsers
-    are older, larger and not all of this shape, and widening the rule to them
-    is an act with its own evidence rather than a line in this one.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    usage = re.search(r"^usage\(\) \{\n\tcat <<'USAGE'\n(.*?)^USAGE$", text,
-                      re.S | re.M)
-    assert usage, f"{name} has no `usage()` heredoc"
-    synopsis = usage.group(1).split("\n\n", 1)[0]
-    missing = sorted(opt for opt in _parser_long_options(text)
-                     if opt != "--help" and opt not in synopsis)
-    assert not missing, (
-        f"{name} parses {', '.join(missing)} and its usage line never names "
-        f"them: an option a person cannot find is an option they do not use")
-
-
-def test_lane_fences_a_lane_name_the_way_the_helper_does():
-    """ONE RULE FOR WHAT A LANE NAME IS, AND `restart` HAD A WEAKER ONE.
-
-    `lanes-edit.sh`'s `check_lane_name` refuses `"" | *[!A-Za-z0-9._-]* | .* |
-    -*` - the WHOLE string, and the two leading characters a path or an option
-    would start with. `restart` tested `[A-Za-z0-9]*)`, which in a `case`
-    pattern pins the FIRST CHARACTER and nothing else: `repoA11-1/extra`,
-    `repoA11-1 x` and `repoA11-1*` all passed it and went on to `register-row`,
-    which then answered "the register has no row for lane X" about a string
-    that is not a lane name at all. The refusal a person needs ("that is not a
-    lane name") was replaced by one that sends them looking for a missing row.
-
-    Held by comparing the two patterns rather than by restating either: a
-    second spelling of one rule is how the two files come to disagree.
-
-    ASKED OF `lane` NOW, because that is the file that takes a `<name>` from a
-    person: Amendment 18 Addendum 2 retired `restart` from the PATH and `lane
-    <name>` is its act. The fence moved with it, and this rule moved with the
-    fence rather than being retired beside the file it was written for.
-    """
-    helper = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    wanted = re.search(r"check_lane_name\(\) \{\s*case \S+ in\s*\n\s*(\S.*?)\)",
-                       helper)
-    assert wanted, "lanes-edit.sh has no `check_lane_name` case pattern"
-    pattern = wanted.group(1).strip()
-    text = (REPO / "lane").read_text(encoding="utf-8")
-    assert pattern in text, (
-        "`lane` does not fence a lane name with `lanes-edit.sh`'s own "
-        f"pattern.\n  the helper refuses: {pattern}\n  and `lane` must "
-        f"refuse the same string, not merely a first character")
-
-
-#: The words clause (c)'s ladder is counted in, in `lane-start` and in the
-#: manual. Both spell the number out; neither writes a digit.
-RUNG_WORDS = {"two": 2, "three": 3, "four": 4, "five": 5, "six": 6,
-              "seven": 7, "eight": 8, "nine": 9}
-
-
-def test_the_directory_precedence_states_every_rung_it_implements():
-    """THE CONTRACT THE CODE CARRIES SAID *"THERE IS NO FIFTH RUNG"* WHILE THE
-    CODE A HUNDRED LINES BELOW IT HAD SIX (#26, the review of `c3ebcfe`,
-    `lane-start:780`).
-
-    `708395e` added rungs 5 and 6 for Evidence 7 - the estate's `project.yaml`
-    legs and a checkout named for the home's repository, each proved by that
-    directory's own `origin` - and `2f44da0` corrected the MANUAL's count to
-    six. The block at the top of `lane-start` that clause (c) states the ladder
-    in was corrected in neither. A contract that contradicts the code beneath
-    it makes that code look unreachable, and the one act that reading invites
-    is deleting it.
-
-    Derived from the two files rather than restated: the count the block
-    DECLARES, the rungs it LISTS, the rungs the implementation MARKS with its
-    own `# Rung <n>` comments, and the count the manual's heading states must
-    be one number. Any of the four moving alone is the drift this catches.
-    """
-    code = (REPO / "lane-start").read_text(encoding="utf-8")
-    head = re.search(r"^# ([A-Z]+) RUNGS, FIRST ANSWER WINS", code, re.M)
-    assert head, "`lane-start` no longer declares clause (c)'s rung count"
-    declared = RUNG_WORDS[head.group(1).lower()]
-    # FROM THE LINE AFTER THE DECLARATION TO THE FIRST LINE OF CODE: the block
-    # is one run of comment lines, and the numbered items are the ladder.
-    lines = code.splitlines()
-    first = next(i for i, l in enumerate(lines)
-                 if l.startswith(f"# {head.group(1)} RUNGS, FIRST ANSWER WINS"))
-    listed = set()
-    for line in lines[first + 1:]:
-        if not line.startswith("#"):
-            break
-        item = re.match(r"#\s{3}(\d+)\. ", line)
-        if item:
-            listed.add(int(item.group(1)))
-    implemented = {int(n) for n in re.findall(r"^# Rung (\d+) ", code, re.M)}
-    assert implemented <= listed, (
-        f"`lane-start` implements rungs {sorted(implemented - listed)} that "
-        f"clause (c)'s own block does not list: {sorted(listed)}")
-    assert listed == set(range(1, declared + 1)), (
-        f"the block says {declared} rungs and lists {sorted(listed)}")
-    manual = doc("docs/README-lanes.md").read_text(encoding="utf-8")
-    stated = re.search(r"The lane's directory, in (\w+) rungs", manual)
-    assert stated, "the manual has no directory-precedence heading to count"
-    assert RUNG_WORDS[stated.group(1).lower()] == declared, (
-        f"the manual counts {stated.group(1)} rungs and `lane-start` counts "
-        f"{head.group(1).lower()}")
-
-
-def test_the_documents_say_what_a_bare_lanes_lists():
-    """THE SETTLED DEFAULT, AND THE FOUR PLACES THAT STATED THE OLD ONE.
-
-    Brett Heap settled clause (j) on 2026-09-13T20:38:11Z, verbatim "Narrow
-    inside a checkout (Recommended)": a bare `lanes` INSIDE a lane checkout
-    lists THAT REPOSITORY's lanes and ends with the next free position and the
-    `lane-start <repo> <n>` that takes it; `lanes --all`, and a bare `lanes`
-    outside every checkout, are the every-lane listing.
-
-    The code took it in the same round that documented the OPPOSITE. `lanes`'s
-    own header line, README.md's code block, the manual's "two words" block and
-    `--help`'s entry all still read "every lane on this workstation" - the
-    pre-settlement default, and wrong twice over, because the scope is the
-    ESTATE now and inside a checkout it is one repository. Nothing was red for
-    it: no assertion in this repository had ever read those four sentences,
-    which is RV-B2's rule one file over - an untested sentence is a sentence
-    that drifts.
-
-    The ABSENCE half is the half that bites. A reader promised every lane who
-    gets one repository's does not read a narrowing, they read a broken
-    command, and the one word that would have answered them - `--all` - is the
-    word the stale sentence does not carry.
-    """
-    surfaces = ("README.md", "docs/README-lanes.md", "lanes", "lane",
-                "openRepoTools")
-    usage = (REPO / "openRepoTools").read_text(encoding="utf-8")
-    assert "lanes [--all] [--fetch]" in usage, (
-        "`openRepoTools --help` does not offer --all, so a person narrowed "
-        "into a checkout cannot find the way back to every lane")
-    for name in code_first(*surfaces):
-        text = doc(name).read_text(encoding="utf-8")
-        assert "every lane on this workstation" not in text, (
-            f"{name} still calls `lanes` the listing of every lane on this "
-            f"workstation, which is the pre-settlement default")
-    readme = doc("README.md").read_text(encoding="utf-8")
-    assert "Narrow inside a checkout" in readme, (
-        "README.md does not quote the settlement that narrowed the bare word")
-    assert "lanes --all" in readme, (
-        "README.md never shows the word that asks for every lane")
-    assert "next free position" in readme, (
-        "README.md does not say the narrowed listing ends with the next free "
-        "position, which is the half of the settlement that is not a filter")
-    manual = doc("docs/README-lanes.md").read_text(encoding="utf-8")
-    assert "Narrow inside a checkout (Recommended)" in manual, (
-        "the manual does not quote the settlement verbatim")
-    assert "Yes, list and suggest (Recommended)" in manual, (
-        "the manual does not quote the settlement for `lane-start <repo>` "
-        "with no position, which was ratified in the same breath")
-
-
-def test_agents_md_names_the_pin_rules():
-    """The three rules an agent touching the submodule has to have read, and
-    the reason they are in AGENTS.md rather than only in the pin's header: an
-    assistant is told to read this file, and a procedure that lives outside it
-    is a procedure performed from memory.
-
-    THE PATHS ARE THE ONES THAT WORK FROM WHERE THE FILE IS READ (#193 item
-    14; the coordinator's decision of 2026-10-11). On today's single tree that
-    is `upstream/openRepoShape` and `git submodule update --init …`. At an
-    assembly root the submodule is the code leg's, so T006's `assembly-0001`
-    writes `code/upstream/openRepoShape` and `git -C code submodule update
-    --init …`: the unprefixed command fails there ("pathspec
-    'upstream/openRepoShape' did not match any file(s) known to git", measured
-    in the composed candidate). The prefix is the assembly's code mount, read
-    from its code pin, so either spelling in the wrong place fails."""
-    text = doc("AGENTS.md").read_text(encoding="utf-8")
-    mount = ROOTS.code_mount()
-    where = f"{mount}/" if mount else ""
-    init = (f"git -C {mount} submodule update --init upstream/openRepoShape"
-            if mount else "git submodule update --init upstream/openRepoShape")
-    assert f"Never edit anything under `{where}upstream/openRepoShape` in place" in text
-    assert "Never pin a commit that is not on that repository's `main`" in text
-    assert "RECOMPUTED, never adjusted" in text
-    assert init in text, f"AGENTS.md does not give the command that works here: {init}"
-
-
-def test_agents_md_is_short_enough_to_be_read():
-    """THE CAP IS TODAY'S COUNT, deliberately, and it starts here.
-
-    This repository was created on 2026-09-10 by openRepoShape's #92, and its
-    AGENTS.md is the two paragraphs and two rule blocks that moved out of that
-    repository's own "Parking and resuming" section plus the rules for the
-    pinned submodule. A cap set at the day's count is a cap that bites from the
-    first line added: the exit is to raise it and say here, in a dated entry in
-    this docstring, which RULE the new lines bought — never for prose. That is
-    the form openRepoShape's own two caps are kept in, and it is the form that
-    makes a cap worth having.
-
-    84 -> 90 the same day, for park-everything (openRepoShape #91, RULING
-    2026-09-10, landed there as its #93). Rule 1's opening sentence is the
-    part an assistant gets wrong if it is inferred rather than read: bare
-    `park` with no `<Name>` and no estate around the cwd no longer REFUSES —
-    it parks every estate in name order, continuing past a refusal — so
-    telling somebody to name one estate is now stale advice, not a courtesy.
-    The six lines are both halves of that, because `resume`'s own bare form
-    deliberately keeps the refusal and an assistant is never to name one
-    estate on the person's behalf to route around it.
-
-    90 -> 95 on 2026-09-10, for #6 (Brett Heap's RULING of that day on
-    openRepoShape #92, "skip roots without the overlay"). Rule 1 now says
-    that a sweep ending `…, 4 skipped (no overlay)` and exiting 0 is a CLEAN
-    run and that what those four want is `setup-openspeckit`, because the
-    reading an assistant reaches for unaided is the opposite one — four
-    estates that "did not park" look like four things to chase, and chasing
-    them means rerunning a park that was never going to run there. The fifth
-    line is the other half: naming such a root still refuses, and relaying
-    that refusal is the answer.
-
-    95 -> 99 on 2026-09-10, for the `--all` ruling (Brett Heap, that day, in
-    this repository: "lets change that so it parks the current repo. if not
-    in a repo, then asks if want to park all. and park all should be park -a
-    or park --all"). Rule 1's opening now says the three things an assistant
-    gets wrong unaided: the bare form parks the estate around the cwd;
-    outside every estate it ASKS, and the assistant's stdin is not a
-    terminal, so in its hands that is a refusal naming `--all`; and `--all`
-    is for when the person wants everything, never a way past naming the one
-    estate they meant. The fourth line says `resume` has no `--all`, so
-    nobody invents one.
-
-    99 -> 111 on 2026-09-10, for `status` (Brett Heap's RULING of that day,
-    "lets go with a fourth file. start with the local status layer"). One
-    line in the opening for the third command, and rule 4 — the one an
-    assistant gets wrong unaided in both directions: `status` fetches
-    nothing, so a stale answer is not a bug to fetch around but the local
-    layer doing what it says; and exit 1 is findings printed, not a failure,
-    so relay the lines. The rule also says the bare form outside every
-    estate reads them all WITHOUT asking, so nobody waits for a question
-    `status` never asks.
-
-    111 -> 117 on 2026-09-11, for `--fetch` (Brett Heap's RULING of that day,
-    "next layer: --fetch"). Rule 4 now says the flag is the ONE way `status`
-    reaches the network and the one write it makes, bounded to
-    remote-tracking refs — so an assistant asked for a current answer runs
-    `status --fetch` rather than fetching by hand, and knows a failed fetch
-    is a finding on that row, not a reason to retry the whole report.
-
-    117 -> 122 on 2026-09-11, for the fork layer (Brett Heap's RULING of that
-    day, "next layer: fork against upstream"). Five lines in rule 4 say how a
-    fork is read — a remote named `upstream`, or `gh api` once under `--fetch`
-    — and the two things an assistant gets wrong unaided: that this is the
-    ONE use of `gh` in these commands and it is read-only, and that the
-    `git remote add upstream …` a finding names is the person's to run.
-
-    122 -> 133 on 2026-09-11, for the shape-pin layer (Brett Heap's RULING of
-    that day, "next layer: shape-pin drift"). Rule 4 says what an assistant
-    must never do about a drift finding — re-digest the copy or edit the pin
-    — and what it must not read into "currency not read": that the pin is
-    current. Both are the readings reached for unaided.
-
-    133 -> 140 on 2026-09-11, for the parked-record layer (Brett Heap's RULING
-    of that day, "next layer: parked record against disk"). Eight lines in
-    rule 4 say the three things an assistant reaches for and must not: a
-    `git worktree add` for a feature the record has and disk does not
-    (`resume <Name>` is the exit), a reset for a worktree behind a newer
-    record (rule 1 stands), and a hand-edit of the record for a worktree it
-    does not know (`park` is the exit).
-
-    140 -> 142 on 2026-09-11, for the record layer's review (Copilot on #13).
-    Rule 4 now carries the one exception to "`resume <Name>` is the exit": a
-    record parked with `--no-push` never sent the WIP commit anywhere, so
-    `resume` refuses it and reaching for it is the advice the rule's own next
-    clause rules out — the exit is the workstation that has the commit. Two
-    lines, because an assistant handed that finding otherwise reaches for the
-    one command the finding beside it has just refused.
-
-    142 -> 145 on 2026-09-11, for the review of #18: a STALE WORKTREE
-    REGISTRATION — the block `worktree list` keeps for a directory that is
-    gone — is `git worktree prune`'s to clear, and `resume` cannot work
-    around it, because the extension matches a leg on the registered path
-    alone. Three lines, for the two reaches an assistant makes when `resume`
-    says "already registered" or `git` says "already used by worktree at":
-    `worktree add --force`, which builds the pair git refused to build, and a
-    delete under `.git/worktrees/`, which is the record of the registration
-    and not a scratch directory.
-
-    145 -> 147 on 2026-09-11, for the same review's next round: `git worktree
-    prune` SKIPS a LOCKED registration, so the rule above was an exit that
-    does not work for that one. Two lines put `git worktree unlock <path>` in
-    front of it and say the finding names which kind it is — without them an
-    assistant follows the prune, watches nothing change, and reaches for the
-    two deletes the same sentence forbids.
-
-    147 -> 149 on 2026-09-11, for the round after that: a registration git
-    calls prunable can have its DIRECTORY still on disk, and the prune clears
-    the registration without touching it, so `git worktree add` then refuses
-    the path in its own words, "already exists". Two lines say that directory
-    is moved aside and not deleted — it holds whatever the worktree held, and
-    an assistant that deletes it to make `resume` run has thrown away the one
-    copy of somebody's work.
-
-    149 -> 150 on 2026-09-11, for note (d) of the second independent review of
-    #18: a record whose `pushed:` is neither `true` nor `false` is one
-    `resume` refuses exactly as it refuses `--no-push` — `resume.sh`'s RR6 is
-    `[ "$pushed" != true ]` — and rule 4 gave `resume <Name>` as the exit for
-    it. One line puts it in the same exception, because an assistant that
-    reads the rule rather than the finding beside it reaches for the one
-    command that cannot answer that record.
-
-    150 -> 152 on 2026-09-11, for note 7 of the independent review of #20: a
-    record that names NO PARKED COMMIT for a leg is a THIRD record `resume`
-    refuses, and rule 4 gave `resume <Name>` as the exit for it. It is not
-    the `pushed:` exception in other words — `resume.sh` refuses this one at
-    RR1, comparing origin's tip with a parked commit that is absent and so
-    never matches, not at RR6 — so the two lines are its own clause and its
-    own reason, with the same re-park as the exit. An assistant that reads
-    the rule and not the finding beside it reaches for `resume <Name>`
-    again, and this is the record that answers it with "has moved since it
-    was parked".
-
-    152 -> 153 on 2026-09-11, for note 8 of the same review: a record that
-    gives a leg NO ROLE, which `resume` refuses the WHOLE feature for — its
-    `collect_legs` maps each role onto the checkout and its `*) return 1`
-    takes every other leg of that feature with it — in words about the
-    project's SHAPE that say nothing about the role. One line, in the same
-    exception and with the same re-park, because "`resume <Name>` brings it
-    back" is the sentence it falsifies too.
-
-    153 -> 155 on 2026-09-11, for the independent review of #21 and its note
-    on a ROLE THIS CHECKOUT'S SHAPE DOES NOT MOUNT: the same `collect_legs`
-    refusal of the WHOLE feature as a leg with no role, reached by a
-    different line of it, and the two lines the clause buys are the two
-    exits, which are not one. A misspelt role is a record to write afresh
-    from the workstation that has the feature; a role that is really another
-    shape's is a record that is RIGHT, and the feature comes back in a
-    checkout of that shape — an assistant told only "re-park" would send
-    somebody round that loop for ever.
-
-    155 -> 159 on 2026-09-12, for the same review's note on a BRANCH GONE
-    FROM ORIGIN: `resume` refuses that record at RR2 — "<branch> is no longer
-    on origin in the <role> leg" — before it compares any commit, and rule 4
-    gave `resume <Name>` as the exit for it. The four lines are the two exits
-    RR2 actually gives and the flag that reaches them. NEITHER IS A RE-PARK,
-    which is why this is not one more clause on the exception above it: a
-    feature that LANDED wants its record entry deleted, and a branch deleted
-    by mistake wants pushing again from the workstation that parked it, and
-    an assistant that reaches for the re-park it has read four times by now
-    writes a record `resume` refuses again for the same reason. The
-    `--fetch` half is the other thing it would get wrong unaided: without
-    that flag a missing `origin/<branch>` here is USUALLY a branch parked
-    elsewhere since this clone last fetched, which `resume` fetches and
-    brings back, so the finding still names `resume` and the flag is what
-    settles the two apart.
-
-    159 -> 162 on 2026-09-12, for the follow-up's own note on A ROLE THIS
-    CHECKOUT'S SHAPE HAS NO PLACE FOR, which the rule had as "a ROLE THIS
-    SHAPE DOES NOT MOUNT". Mounting is not the test `resume` makes:
-    `collect_legs` maps `spec` and `code` only onto a three-leg checkout and
-    `repo` only onto a single one, so a role this root mounts perfectly well
-    — `assembly`, which the three-leg shape HAS, or the other shape's role in
-    a root that happens to have the directory — is refused with the rest. The
-    three lines buy the widened rule and A THIRD EXIT: an assistant told
-    "re-park, or a checkout of that shape" has nowhere to send a record whose
-    role belongs to NEITHER shape, and would send somebody round the re-park
-    loop for ever, which is the loop the entry above this one bought its two
-    lines to stop.
-
-    162 -> 169 on 2026-09-12, for the independent reviewer's note that
-    `worktree_on_branch` matches ANY path while RR4 matches only the COMPUTED
-    one. Seven lines, and every one buys a thing an assistant gets wrong
-    unaided. That the path is computed HERE — `<worktree_root>/<branch>` out
-    of this checkout's `git-config.yml`, the leg's own mount under it — and
-    not read out of the record, which carries a `worktree_root:` of its own
-    that `resume.sh` loads and never uses. That a worktree on the branch
-    somewhere else is not merely unseen but a WHOLE-FEATURE refusal, because
-    `git worktree add` cannot take a branch another worktree holds. That
-    `park` is blind to it too, which is what rules out the "park it again"
-    every other exception in this rule ends in. And that the exit is a `git
-    worktree move`, the PERSON'S to run, with no such command for a leg's own
-    checkout. Without them "a recorded feature with no worktree here" reads as
-    "a worktree on the branch is a worktree here", which is the reading this
-    layer had.
-
-    169 -> 177 on 2026-09-12, for that reviewer's second and third notes —
-    RR3, a path that merely EXISTS at the computed path, and RR4's second
-    arm, a worktree REGISTERED there on another branch. Eight lines, and the
-    entry above is why they are not free: it taught the rule that the
-    computed path is the only one either verb reads, and an assistant that
-    knows only that reads "nothing of ours is there" as "`resume` will make
-    it". What these buy is that the refusal comes BEFORE origin is read — so
-    neither RR2's exits nor the re-park below them is what answers it — and
-    that the exit turns on one thing only, WHAT GIT HOLDS at that path: a
-    `git worktree move` where it holds a worktree, because `mv` on a
-    registered one leaves git holding the path it was at, and a plain `mv`
-    where it holds none, because `git worktree move` is no command for a
-    directory git never made. The `unlock` and the `prune` ride in one
-    clause rather than a sentence each, because they are the pair this rule
-    already names above it, and both are exits that were RUN: `worktree
-    move` refuses a locked worktree and `worktree add` refuses a path a dead
-    registration still names, so neither command clears the path alone.
-    177 -> 181 on 2026-09-12, for the independent review's should-fixes on
-    this same paragraph. Four lines, and every one of them a sentence the
-    rule had wrong rather than one it was missing. That the root is read out
-    of `$SPECKIT_GIT_WORKTREE_ROOT` FIRST — the variable both verbs read
-    before any file, which "out of THIS checkout's `git-config.yml`, and
-    read no other" actively denied, sending an agent that has it set to the
-    wrong path with the rule's own authority behind it. That the refusal is
-    made at whichever check the leg reaches first, the `git worktree add`
-    being only the one it reaches with the branch still AT the parked
-    commit: moved on it is the divergence, behind it the behind-ness, gone
-    from origin the gone-ness, all four run against the extension that day,
-    and a rule that quotes the wrong mechanism teaches an assistant to
-    disbelieve the refusal when the words do not match. And that a `worktree
-    prune` goes in front of the move where git still holds the destination
-    registered with nothing on disk, because `worktree move` refuses such a
-    destination in the same sentence `worktree add` does — an exit that was
-    run and did not work is worse than no exit at all.
-
-    181 -> 182 on 2026-09-13, for Copilot's first round on #27 (suppressed),
-    verbatim: "This contract documents only the environment override and
-    `git-config.yml`, but the implementation also falls back to the shape
-    default (`worktrees` for a three-leg root or `../<root>-worktrees` for a
-    single root). For an estate without either override, readers cannot derive
-    the path that `resume` and the recovery guidance use; include that third
-    source in this statement and its mirrored help/README wording." ONE line,
-    and it buys the case an estate usually IS: the entry above spent four
-    lines making the rule name `$SPECKIT_GIT_WORKTREE_ROOT` because "read no
-    other" denied a source, and this list denied the one almost every estate
-    actually uses. A rule that reads as exhaustive and is not sends an agent
-    to look for a `git-config.yml` that was never written, and then to guess.
-
-    182 -> 187 on 2026-09-13, for Copilot's fourth round on #27 (suppressed),
-    verbatim: "This contract says every off-path worktree's exit is `git
-    worktree move`, but the implementation deliberately suppresses that command
-    for `path: \".\"` and for a symlink-spelled worktree root because the move
-    cannot produce a path `resume` registers. Please document those exceptions
-    here so the operational guidance does not direct users to a non-working
-    recovery." IT IS DRIFT THIS BRANCH MADE, in the two rounds that suppressed
-    those commands, and it is the drift these caps exist to catch: a rule that
-    promises a command the command itself refuses to print. Five lines — the
-    `worktree unlock` a locked source wants, and the three states that get no
-    move at all, with the reason for the one a reader cannot guess (git
-    registers the path a link resolves to and `resume` compares the one you
-    wrote, so the move runs and changes nothing).
-
-    155 -> 179 on 2026-09-13, for lane-collision-protocol AMENDMENT 9, ratified
-    that day, and its adoption act 3 — the one change to this repository that
-    is not a change to the estate verbs at all. Four executables, a shipped
-    data file, a suite and a manual arrived here from a person's workspace
-    repository, and `openRepoTools` grew the verb that creates such a
-    repository. The lines buy four things an assistant cannot infer from the
-    files:
-
-    (a) the opening count, which said THREE INSTALLED COMMANDS and now says
-    what `--install` actually places, because the install story is the
-    sentence a first-time reader trusts and this is the release that moved it;
-
-    (b) the one paragraph that says the lane tooling answers to a DIFFERENT
-    document — the lane collision protocol, not openRepoShape — that the code
-    is here and the data is not, that all four resolve the register through
-    `$AGENT_PROTOCOL_ROOT/workspace.yaml` and never from their own location,
-    and that their exit codes are the protocol's: 1 is *registry not found*
-    there and *findings were printed* here. Two toolsets now ship under one
-    installer, so one number means two things across that seam, and an
-    assistant that reads a 1 without knowing which command produced it reports
-    a refusal as a report or a report as a refusal (Amendment 9(a), (c));
-
-    (c) rule 2, which was "the ONLY writer of `~/.agents/workspace.yaml`" and
-    is now the two, because clause (c) step 9 makes `wip init` the second. The
-    invariant retired ON PURPOSE and is rewritten here rather than found by a
-    red test (Amendment 9, act 3 obligation 3) — and the rule it still carries
-    is the one that matters, that the assistant is neither writer and passes
-    neither `--workspace` nor `wip init` on its own initiative;
-
-    (d) the bash-3.2 line in the testing section. The four arriving
-    executables are parsed under macOS bash 3.2 in CI, where `${x,,}` is a
-    syntax error — that gate found `lanes-edit.sh`'s `${base,,}` on arrival —
-    and an assistant that edits 380 KB of newly arrived bash without knowing
-    the dialect writes the same defect back in. It names the runner for the
-    moved suite in the same breath, because a 122 KB bash suite that no job
-    runs is not a suite (act 3 obligations 4 and 6).
-
-    162 AND 179 MEET AT 186 on 2026-09-13, where act 3's branch merged `main`.
-    Both raises start from the same 155 and neither touches the other's lines:
-    `main` bought 7 for `resume`'s two refusals, this branch bought 24 for
-    Amendment 9's arrival, and the merged file is 186. The cap is the count of
-    what merged, not either side's number — and both entries stay, because each
-    still names the rule its own lines bought.
-    211 -> 214 on 2026-09-13, for Copilot's eighth round on #27 (suppressed):
-    the round before it widened the symlink QUESTION from the worktree root to
-    every parent of the computed path and left this rule naming the root, which
-    for a link at the feature directory or a mount's parent is the wrong
-    setting to send a person to. Three lines, and they are the difference
-    between a remedy that works and one that does not: a link AT or ABOVE the
-    worktree root is a `worktree_root` to respell, and a link BELOW it is a
-    component that has to BE a directory rather than point at one.
-
-    187 AND 186 MEET AT 211 on 2026-09-13, where this branch merged `main`
-    after Amendment 9's act 3 landed there. Both raises start from 162 — the
-    count after the commit below this branch — and neither touches the other's
-    lines: `main` bought 24 for the lane tooling's arrival, this branch bought
-    25 for the path `resume` computes and the four rounds of review on it, and
-    the merged file is 211. The cap is the count of what merged, not either
-    side's number, and every entry above stays, because each still names the
-    rule its own lines bought.
-    214 -> 224 on 2026-09-14, for THE RECORD'S OWN KEY ORDER, which rule 4
-    had nothing about at all. `workspace_load_project` reads a record by
-    INDENT and shuts the `features:` list at the next key at project indent
-    and a feature's `legs:` list at the next key at feature indent, so a
-    project key a bad merge left between two features — or between a
-    feature and its `legs:` — costs the second feature, or every leg of
-    the first: `resume` makes no feature and collects no leg out of what
-    sits under a shut list.
-    The ten lines buy that reading and, more than it, THE ORDER OF ITS TWO
-    EXITS. The key is put back BY HAND, which is the one hand-edit of the
-    record these rules ask for and reads as a contradiction of the sentence
-    below it that sends a worktree the record does not know to `park` rather
-    than to a hand-edit; and the re-park settles it ONLY from the workstation
-    that has the feature, because `workspace_write_manifest` rewrites a
-    project's whole block and `emit_recorded_feature` carries forward only
-    the features that loader made. An assistant told "re-park" unaided parks
-    from wherever it is standing, and that park is what deletes the lines for
-    good. They are the ten this branch wrote as 162 -> 172, REBASED onto the
-    214 `main` reached while it waited: the same ten lines, in the same rule 4
-    sentence, touching none of the lines the entries above bought — so the
-    count is the one measured after the rebase and the cap is that count.
-
-    224 AND 214 MEET AT 224 on 2026-09-14, where this branch merged `main`
-    at `63a74af` — Amendment 11's tooling, #26. The cap does not move, and
-    that is the reading, not an omission: #26 changed ONE WORD of this file
-    — the opening count of what `--install` places, nine to eleven — and a
-    word is not a line. So the 224 below is still the number MEASURED after
-    the merge rather than the branch's own carried forward, which is the
-    only way either of them is ever allowed to be right, and the entry
-    above stays because its ten lines are still the ten in rule 4.
-
-    224 -> 243 on 2026-09-14, for ONE SUITE AT A TIME WHERE LANES SHARE A
-    WORKSTATION, and every one of the nineteen is a thing an agent MEETS on
-    this repository rather than prose about it. Measured that day: six lanes
-    build in sibling worktrees of this checkout, and FOUR SUITES RAN AT ONCE
-    under the guard they had all been given — `pgrep -af 'python3 -m pytest' |
-    grep -v pgrep >/dev/null`, which never waits where `grep` is the harness's
-    own shell function whose status is 1 when its stdout is `/dev/null`, and
-    whose unanchored pattern also matches the guard's own command line. The
-    lines are the working form (an anchored `pgrep -fc`, its pattern split so
-    it cannot match itself, and a `flock` so the waiters cannot all start
-    together), the two defects it exists for, and the sentence that makes it
-    usable at all — every lane on the workstation must name the SAME lock
-    file. An assistant told only "run pytest" starts the fifth suite, and this
-    run is minutes of bash and hundreds of `git` processes.
-
-    243 -> 255 the same day, when those nineteen lines gained a COMMAND to
-    point at (opensoft/openRepoTools#51). Prose that shows a guard is prose
-    somebody retypes, and the four suites that ran at once had each retyped
-    it; `tests/run.sh` is the guard written ONCE, and the twelve lines are the
-    shape of naming it: the wrapper as the first thing the testing section
-    says to run, what it does (waits, takes
-    `${TMPDIR:-/tmp}/openrepotools-pytest.lock`, `flock` or a `mkdir` lock on
-    macOS, waits again inside it), the sentence that makes a lock a lock at
-    all -- every lane on one workstation names the SAME file -- and the broken
-    guard kept as the thing being corrected, because an assistant that has
-    seen the working one still meets the old one in older briefs. The runnable
-    form stays beneath it for a person with no checkout of this repository in
-    front of them.
-
-    224 -> 228 on 2026-09-14, for THE ONE EXIT CODE THIS FILE NOW STATES
-    WRONG (lane-collision-protocol Amendment 12, opensoft/openRepoTools#25).
-    Four lines, and every one of them is behaviour rather than prose about
-    it. The paragraph promised, without qualification, that each of the four
-    "refuses with exit 1 naming `openRepoTools wip init` where that file does
-    not answer" — and `lanes-edit.sh guard` deliberately does not: it is a
-    `UserPromptSubmit` hook, only a 2 blocks a prompt
-    (code.claude.com/docs/en/hooks), and a 1 there would print the workspace
-    refusal and let the prompt THROUGH, which is the one failure clause (d)
-    forbids by name. An assistant reading the old sentence and getting a 2
-    back has no way to tell a blocked prompt from the "the object is held"
-    that 2 has meant here since Amendment 5, which is exactly what the
-    sentence beneath it — "never read a number without knowing which command
-    produced it" — exists to prevent, and it could not do that while the
-    clause above it named the wrong number for one of them.
-
-    228 + 255 MEET AT 259 on 2026-09-15, where this branch merged `main` at
-    `2faa883`. Four of the merged file's lines are Amendment 12's exit-code
-    correction and twelve are #51's `tests/run.sh` paragraph; neither is over
-    a line the other bought, and the cap is the count of what merged rather
-    than either side's number — the rule the 224 entry states.
-
-    265 -> 278 on 2026-09-15, for ONE BINDING PER LANE — lane-collision-protocol
-    AMENDMENT 18, ratified 2026-09-14T13:15:18Z, opensoft/openRepoTools#38. The
-    thirteen lines are a RULE and not prose, and they are the rule an assistant
-    gets WRONG if it is inferred rather than read: this tooling has always said
-    a lane whose recorded session is not live is a lane to take, and the one
-    thing that sentence never said is WHERE it may be said from. A pid does not
-    cross a pid namespace, so from another bench container on the same machine
-    the liveness read is meaningless and the honest answer is UNKNOWN — measured
-    on 2026-09-14, when pyBench read cloudBench's record, called a running lane
-    dead and started writing it from a second place. The paragraph names the
-    read that answers (`binding`), the one exception that makes a binding
-    elsewhere provably dead (a window gone from a shared tmux server), the act a
-    second place takes instead of taking (`--request-handoff`, and the wait),
-    the one word that overrides it and the fact that it is never automatic, and
-    the three variables the launcher owns. Every one of those is a thing an
-    assistant would otherwise do the opposite of.
-
-    259 -> 265 the same day, for SIX LINES that stop this file prescribing a
-    guard its own wrapper refuses to use (Copilot rounds 7 and 8 on #47). The
-    snippet counted with `pgrep -fc`, which `tests/run.sh` deliberately does
-    not: `-c` is not in every `pgrep` this repository runs under, and the count
-    — never `pgrep`'s exit status — is what decides. A document that shows a
-    person a non-portable form of the very guard the wrapper exists to make
-    portable is worse than one that shows none, and the six lines are the
-    correction plus the sentence naming the wrapper as the canonical
-    implementation, which is what an assistant reading either should reach for.
-
-    265 -> 276 on 2026-09-16, for ELEVEN LINES that name the one portability
-    rule this repository keeps paying for twice (opensoft/openRepoTools#93).
-    `awk -v name=value` carries ONE LINE: the value is processed as a string
-    literal, and macOS's one-true-awk refuses a newline in one outright — exit
-    2, no output — while `gawk` and `mawk` take it silently. `who_landing` paid
-    for it once (R-A9-11) and left the finding in a code comment where only a
-    reader of that function meets it; `delete_lines` re-made it in #93 and
-    tests-macos answered with six red lines whose message was about a line
-    count. The bash-3.2 paragraph above it is the same kind of rule and is
-    already here for the same reason — a constraint only one job can see
-    belongs where it is read BEFORE the code is written, not after CI is red —
-    and the eleven lines are that rule, the two rounds as evidence, the two
-    spellings that are correct (`ENVIRON`, or a second file with `NR == FNR`),
-    and the suite case that now makes a third round red on every platform.
-
-    265 -> 292 on 2026-09-16, for THE CYCLE'S THREE RULINGS (Brett Heap's
-    RULING of that day, "do all three", on the coordinator's three proposals
-    — measured: `tests-macos` running 49-54 minutes per push against Linux's
-    17-22, pull requests drawing 6-12 Copilot review rounds, and this suite
-    queuing up to 1h20 behind the workstation lock the paragraph below still
-    describes). The paragraph these lines replace told an assistant that
-    `tests/run.sh` IS how this suite is run and that `pytest` by hand is the
-    thing it exists to stop — true of the mechanism and now wrong about the
-    standard, which is what made it the one to remove rather than a
-    paragraph to add beside. Numbered so each stays citable on its own:
-    `tests-macos` leaves the per-push `pull_request` gate for the `ready`
-    label, with its own `parse-macos` split off so the bash-3.2 syntax parse
-    does not leave with it; Copilot review is capped at two rounds; and
-    CI's own `tests` job, not the local wrapper, is the suite of record —
-    the wrapper stays exactly the tool it always was, for a person who wants
-    the whole answer locally rather than one a push now waits on. 26 of the
-    27 lines came in that one commit; the last, the same day, is Copilot
-    round 2 on this PR taken rather than chased past its cap: `parse-macos`
-    runs on `pull_request` and on push to main, the same two triggers as the
-    three jobs beside it, and the sentence saying so now names both rather
-    than the "every push" a reader could take for every branch.
-
-    276 + 292 MEET AT 303 on 2026-10-03, where #93 merged `main` at `92bd21f`.
-    Eleven of the merged file's lines are #93's one-line `awk -v` rule and
-    twenty-seven are #119's three rulings; neither is over a line the other
-    bought, and the cap is the count of what merged rather than either side's
-    number — the rule the 224 entry states.
-
-    278 + 292 MEET AT 305 on 2026-10-03, where #83 merged `main` at `92bd21f`
-    (#119). Both raised the same 265: thirteen lines are Amendment 18's ONE
-    BINDING rule and twenty-seven are the cycle's three rulings, and neither is
-    over a line the other bought. The cap is the count of what merged, 265 + 13
-    + 27, rather than either side's number — the rule the 224 entry states.
-
-    303 + 305 MEET AT 316 on 2026-10-03, where #93 merged `main` at `6faed35`
-    (#83). Each side had already counted #119's twenty-seven over the shared
-    265, so the merged file is 265 + 27 + #93's eleven (the one-line `awk -v`
-    rule) + #83's thirteen (the ONE BINDING rule): the count of what merged,
-    rather than either side's number — the rule the 224 entry states.
-
-    316 HERE AND 340 AT AN ASSEMBLY ROOT, on 2026-10-08 (opensoft/openRepoTools
-    #186, T009). In the triad this test reads the ASSEMBLY's AGENTS.md, and
-    the root guidance of T006 (`specs/004-migrate-to-triad/
-    root-guidance-2026-10-08.md`, patch `assembly-0001`) adds twenty-four lines
-    to it: the shape's first-line pointer and the triad map the bootstrap
-    protocol requires a root to carry. The assembly's cap is this count plus
-    those lines and nothing else; today's single repository keeps 316, so no
-    line of prose is bought on `main` by a file that is not here yet.
-
-    316 -> 323 HERE AND 340 -> 347 AT AN ASSEMBLY ROOT, on 2026-10-09, for the
-    same work (#186, T009; the #190 review). Seven lines at the foot of
-    "Testing your changes" — a blank and six — say what an agent running the
-    suite now has to know and would get wrong unaided: the suite reads each
-    file from the root that owns it, the three variables that name those roots
-    (`OPENREPOTOOLS_CODE_ROOT`, `OPENREPOTOOLS_ASSEMBLY_ROOT`,
-    `OPENREPOTOOLS_SPEC_ROOT`), and that a root a standalone checkout lacks
-    SKIPS by name while `OPENREPOTOOLS_COMPOSED=1` REFUSES instead. The
-    assembly's AGENTS.md is this file with T006's `assembly-0001` applied, so
-    it carries the same seven and its cap moves with them. They sit below the
-    last line that patch rewrites, so it still applies here and gives 347
-    lines; placed under the test block, which the patch rewrites, they made it
-    fail at `AGENTS.md:224` (lane openRepoTools-3's candidate review; #193
-    item 2).
-
-    323 -> 330 HERE, on 2026-10-18, for #243's decision on item 2 (Brett
-    Heap's word, "fix #242 and #243"): one family laid out twice is NOT
-    de-duplicated, and AGENTS.md says so instead. Seven lines, a blank and six,
-    under the opening paragraph of "Driving `park <Name>`, ...": a family's
-    folder named for its repository and one named for its display `name:` are
-    both found, as two estates; parking both writes ONE record key, the
-    family's `id:`, so the later park replaces the first one's member blocks;
-    keep only the folder named for the repository, where `make siblings` moves
-    a holder. An agent that does not know it parks both and loses one layout's
-    members from the record.
-    THE ASSEMBLY'S 347 DOES NOT MOVE HERE, although the 316 entry makes it this
-    count plus T006's twenty-four. Its file does not exist yet, and
-    `assembly-0001` no longer applies to today's AGENTS.md: hunks 6 and 8 fail
-    on `main` without these lines, and with them the same hunks apply and fail,
-    at offsets seven lines further on. The re-cut that makes the assembly's
-    file again sets its cap, and `tests/test_test_roots.py` holds 347 until
-    then.
-    """
-    lines = doc("AGENTS.md").read_text().splitlines()
-    cap = 330 if ROOTS.assembly is None else 347
-    assert len(lines) <= cap, f"AGENTS.md is {len(lines)} lines; the cap is {cap}"
-
-
-def test_readme_is_short_enough_to_be_read():
-    """THE CAP IS TODAY'S COUNT, for the reason above and set the same day.
-
-    The README says what the two commands are, that they add no mechanics, both
-    install forms, the environment, the dependency direction, how to bump the
-    pin and how to run the tests. That is the whole of what this repository
-    has to explain — the estate verbs' own behaviour is `park --help`,
-    `resume --help` and openRepoShape's README, which this one links rather
-    than restates. A cap raised for prose is not a cap; a cap raised in a dated
-    entry naming the rule it bought is.
-
-    160 -> 165 the same day, for park-everything (openRepoShape #91, RULING
-    2026-09-10, landed there as its #93). Five lines rewrite the "How the
-    estate is found" sentence that used to say bare `park` REFUSES with no
-    estate around the cwd: it now parks every estate it finds, in name order,
-    continuing past a refusal, and the same sentence says `resume`
-    deliberately keeps the old refusal — so a reader of one paragraph gets
-    both halves rather than one turning stale next to the other. It tracks
-    openRepoShape's own README, which moved 1219 -> 1225 for the same rule.
-
-    165 -> 172 the same day, for the pin-bump procedure's ORDER. The fenced
-    block staged `contracts/openreposhape-pin.yaml` on the line ABOVE the
-    sentence telling the reader to edit it, so run literally it committed the
-    moved gitlink with the old pin — and that is invisible where you are
-    standing, because this suite reads the pin out of the working tree and the
-    gitlink out of `git ls-tree HEAD`. Green locally, red in CI. Seven lines
-    put the edit inside the block and say why the order is the order; a
-    procedure that is wrong in the one document a first-time bumper reads is
-    worth more than seven lines.
-
-    172 -> 178 the same day, for #6 (Brett Heap's RULING of 2026-09-10 on
-    openRepoShape #92, "skip roots without the overlay"). Six lines finish
-    the "How the estate is found" paragraph #91 rewrote: the sweep SKIPS a
-    root with no Speckit git overlay rather than failing on it, shows the
-    `…, 4 skipped (no overlay)` clause a person actually sees, names
-    `setup-openspeckit` as what such a root wants, and says that naming that
-    same root still relays its refusal. Both halves in one paragraph, for the
-    reason the #91 lines are: a reader who gets one of them and not the other
-    reads a clean sweep as a failed one.
-
-    178 -> 182 on 2026-09-10, for the `--all` ruling (Brett Heap, that day,
-    in this repository). One line in the code block for `park --all`, and
-    three in the "How the estate is found" paragraph, which now says what the
-    bare form does outside every estate — list, ASK, and refuse naming
-    `--all` where there is no terminal — and that `--all` / `-a` is the sweep
-    without the question, from anywhere. The #91 sentence it replaces said
-    the bare form swept unasked, which is the reading this paragraph now
-    exists to correct.
-
-    182 -> 203 on 2026-09-10, for `status` (Brett Heap's RULING of that day,
-    "lets go with a fourth file. start with the local status layer"). The
-    install story moves from three files to four in every sentence that
-    counted them; one paragraph says what `status` reads and that it fetches
-    nothing; two lines in the "Using them" block show its two forms; and one
-    paragraph gives the exit codes and the bare-form rule — read them all,
-    without asking — because a read-only report that "checks the remote" is
-    the reading a first-time user brings, and this is where it is corrected.
-
-    203 -> 214 on 2026-09-11, for `--fetch` (Brett Heap's RULING of that day,
-    "next layer: --fetch"). Four lines in the `status` paragraph name the
-    flag, what it runs and the one write it makes; one line in the "Using
-    them" block shows it; one sentence in the exit-code paragraph says a
-    failed fetch is a finding on its row. The sentence that said `--fetch`
-    refuses by name is gone, because it no longer does.
-
-    214 -> 221 on 2026-09-11, for the fork layer (Brett Heap's RULING of that
-    day, "next layer: fork against upstream"). Seven lines in the `status`
-    paragraph say how a fork is read — a remote named `upstream` from local
-    refs, or `gh api` once under `--fetch` for an origin on github.com — that
-    a fork is a finding naming the parent and the remote to add, and that
-    this is the one use of `gh` in these commands; the list of layers still
-    to come loses one.
-
-    221 -> 232 on 2026-09-11, for the shape-pin layer (Brett Heap's RULING of
-    that day, "next layer: shape-pin drift"). Seven lines in the `status`
-    paragraph say what the pin is, the three things read against it, where
-    currency comes from and the exit named; the list of layers still to come
-    loses another.
-
-    232 -> 241 on 2026-09-11, for the parked-record layer (Brett Heap's RULING
-    of that day, "next layer: parked record against disk"). Seven lines in
-    the `status` paragraph say what the record is, where it is found, the
-    four ways record and disk drift apart, and that no config or no record
-    is a note; the list of layers still to come is gone, because none is.
-
-    241 -> 242 on 2026-09-11, for the record layer's review (Copilot on #13).
-    One line in the `status` paragraph gives the exception to "`resume
-    <Name>` brings it back": where the record says `--no-push`, only the
-    workstation that parked it can. It was left to be inferred from the
-    `--no-push` finding two clauses later, and `status` itself now says the
-    two states in one line rather than in two that contradicted each other.
-
-    242 -> 244 on 2026-09-11, for the review of #18: the STALE REGISTRATION
-    state, which the paragraph did not have. Two lines say that a worktree
-    which is gone while `git worktree list` still holds its registration is a
-    prune — after an unlock if it is locked — BEFORE `resume <Name>` can do
-    anything, because the paragraph otherwise promises a recovery the
-    command's own finding contradicts.
-
-    244 -> 245 on 2026-09-11, for the round after that: the registration can
-    be stale with its DIRECTORY still on disk, which the prune leaves behind
-    and `git worktree add` then refuses. One line says that directory is
-    moved aside, so the recovery the README describes is the whole of the one
-    `status` prints.
-
-    245 -> 246 on 2026-09-11, for note (d) of the second independent review of
-    #18: the same exception in this paragraph's own words — a `pushed:` that
-    is neither true nor false is a record `resume` refuses just as flatly as a
-    `--no-push` one, and the paragraph otherwise promises a recovery the
-    command's own finding rules out. One line, and the finding list beside it
-    names that record too.
-
-    246 -> 248 on 2026-09-11, for note 7 of the independent review of #20: a
-    record that names no parked commit for a leg. One line puts it in the
-    paragraph's own exception — with it, only the workstation that parked it
-    can park it again, because `resume` refuses such a leg as moved-on — and
-    one puts it in the finding list beside "a worktree whose tip is not the
-    parked commit", which is the arm that CANNOT RUN when the record names
-    none to compare the tip with. Both halves for the reason the note (d)
-    line was written: the paragraph otherwise promises a recovery the
-    command's own finding rules out.
-
-    248 -> 249 on 2026-09-11, for note 8 of the same review: a leg the record
-    gives no role. The same two places — the exception, because `resume`
-    refuses the whole feature for such a leg and only a re-park writes the
-    roles back, and the finding list, because this is a finding on the root's
-    row and not on any leg's.
-
-    249 -> 250 on 2026-09-11, for the review of #21's note on a role this
-    shape does not mount: the same two places again — the exception, because
-    `resume` refuses the whole feature for it, and the finding list — and
-    one line, because the paragraph repacked as it took the words. The
-    second exit is in it for the reason the AGENTS.md entry gives.
-
-    250 -> 251 on 2026-09-12, for note 1 of that review: a FEATURE the record
-    lists no leg for, which `collect_legs` refuses whole at its closing
-    `[ "${#LEG_ROLES[@]}" -gt 0 ]`. One line, and it buys the one word that
-    keeps the list honest — "feature", where every other entry beside it is a
-    leg. AGENTS.md takes the same state in the words it already had and
-    repacks, so its cap does not move.
-
-    363 -> 382 on 2026-09-13, for lane-collision-protocol AMENDMENT 11's
-    ratified decisions 6 and 7: two new words on PATH, `restart` and `lanes`,
-    which a person reading this file has to be told exist and told what they
-    do, plus the `$LANES_WORKSTATION` row that decision 8(d) makes
-    load-bearing. The cap moves with the toolset and never with prose, and it
-    is raised from the 363 the merge of `main` left rather than from the 358
-    this branch started at — both histories below, newest first.
-
-    251 -> 255 on 2026-09-12, for the same review's note on a BRANCH GONE
-    FROM ORIGIN. The same two places once more: three lines put it in the
-    exception, because the exits are the record's own entry and a push from
-    the workstation that parked it rather than the re-park every other
-    exception ends in, and one puts it in the finding list, because a
-    recorded branch this repository has no `origin/<branch>` for is a state
-    of the RECORD against origin that no other entry in that list covers.
-    The `--fetch` clause is in the exception for the reason the AGENTS.md
-    entry gives: without it the two readings of a missing ref are not one
-    the command may choose between.
-
-    255 -> 256 on 2026-09-12, for the same widening: "a role this shape does
-    not mount" becomes "a role this shape has no place for", with what that
-    covers and the third exit, in the exception and in the finding list. One
-    line, because the paragraph repacked as it took the words — and it is a
-    line about the RULE and not about the wording: a reader who takes
-    "mount" literally reads `assembly`, which this repository's own fixtures
-    mount at `.`, as a role that is fine.
-
-    256 -> 261 on 2026-09-12, for the same reviewer's note on the PATH a
-    worktree is at. Five lines, and all five in the finding list rather than
-    in the exception above it, because this is not an exception to `resume
-    <Name>`: nothing is being brought back — the work is already here, and
-    neither verb can see it. What they buy is the path itself, said to be
-    computed in THIS checkout and not carried by the record, and the exit,
-    which is a `git worktree move` and not the re-park every other entry
-    beside it ends in: `park` collects the features under that root and no
-    others, so a re-park writes nothing about this one.
-
-    261 -> 267 on 2026-09-12, for the same reviewer's second and third notes
-    on WHAT IS AT that path. Six lines, and all six in the EXCEPTION
-    above the finding list rather than in the list itself, which is where the
-    entry above put its own: this IS a record `resume <Name>` brings back —
-    the work is not here, and nothing of the person's is at that path — and
-    all that stands between the two is a directory, a file or somebody else's
-    worktree. So it is an exception to the promise, and the promise is what
-    it falsifies; and the exit is neither the re-park every other exception
-    ends in nor the prune the one above it names, but a move whose command
-    depends on what git holds at that path — two of the six lines, because
-    a `worktree move` that names no `unlock` in front of a locked worktree,
-    or an `mv` that leaves a dead registration standing, is an exit that was
-    run and did not work.
-
-    267 -> 268 on 2026-09-13, for the same round's suppressed comment read
-    against this text: the finding list said the path is "read out of
-    `$SPECKIT_GIT_WORKTREE_ROOT` or this checkout's `git-config.yml`" and left
-    out the SHAPE's own default, which is where every estate with neither
-    override gets it — which is most of them. One line, and the same one
-    AGENTS.md rule 4 and `status --help` take, because the three texts say the
-    same things or one of them is wrong.
-
-    268 -> 270 on 2026-09-13, for the same round read against this text: the
-    finding list promised a `git worktree move` as the off-path exit without
-    the three states where `status` deliberately prints none. Two lines, and
-    the same two AGENTS.md rule 4 and `status --help` take, because a reader
-    sent to a command the command will not print is worse off than one told
-    nothing.
-
-    251 -> 353 on 2026-09-13, for lane-collision-protocol AMENDMENT 9, ratified
-    that day, and its adoption act 3. This is the largest single raise this
-    file has taken and the reason is not prose: the repository grew a second
-    toolset and a verb. The docstring above says the cap is today's count
-    because "the README says what the two commands are … that is the whole of
-    what this repository has to explain" — and after this release it is not
-    the whole, so the sentence that set the cap is what changed. Four
-    sections, and each is the answer to a question a reader of the old README
-    could not answer at all:
-
-    § "The lane tooling" — that `lane-start`, `lane-end`, `lanes-edit.sh` and
-    `link-estates` are here now, with their history; that what moved is the
-    CODE and the register, the logs and the handoffs stay in the person's own
-    workspace repository where Amendments 4 and 5 put them; and that every one
-    of them finds that data through `$AGENT_PROTOCOL_ROOT/workspace.yaml` and
-    never from its own location, refusing rather than guessing. A reader who
-    finds four unexplained executables at this repository's root otherwise
-    reaches the opposite conclusion — that the data moved too — which is the
-    one thing Amendment 9 does not do.
-
-    § "`openRepoTools wip init`" — the verb. `openRepoTools:13` said "IT
-    INSTALLS AND IT DOES NOTHING ELSE. There is no verb here", and Brett
-    Heap's ruling 4 of 2026-09-12 ("openRepoTools wip init") retired that
-    line. A command that creates a repository, seeds it from a pinned
-    template, pushes, writes a file outside every repository and runs a linker
-    cannot be documented in a sentence, and the paragraph that costs the most
-    lines is the one that earns them: the push to `main` IS the ruleset probe,
-    so a person meets the organisation's PR-only gate here rather than at
-    their first `lane-start`, which is the worst place to meet it. Two of
-    these lines are the OTHER half of that probe, and they were added after
-    an adversarial read found the command could not keep the promise the
-    first half makes: a refused push is exit 2 with the clone and the seed
-    commit left where they are, so the re-run after an administrator acts has
-    only to push. A reader who is not told that reaches for `--dry-run`, a
-    second `--install`, or a hand-made repository.
-
-    the two-line onboarding chain at the head of § "Install" (Amendment 9(e))
-    — `gh repo clone opensoft/workBenches && cd workBenches && ./setup.sh`,
-    then `pclaude run <profile> --lane <repo>-<n>` — with its two
-    preconditions named, `gh auth login` and `~/.local/bin` on `PATH`, and the
-    by-hand pair for a host that has this toolset without workBenches. Brett
-    Heap's direction of 2026-09-12, "we need to also keep that clean so there
-    is the least choices possible to not confuse the user", is the measure
-    that section is written to, and a chain a person cannot find is the same
-    as no chain.
-
-    and the rewrite of § "Install" itself — FOUR files became NINE and four
-    artifacts became TWELVE, since `--install` now also places the
-    `/lane-swap` skill in the shared skills directory and in `~/.claude`, and
-    merges one `SessionStart` entry into `~/.claude/settings.json`. The
-    all-or-nothing rule is the thing being restated, not decorated: the merge
-    is computed with the nine files in hand before any is placed, so a
-    settings file it cannot understand costs a whole install rather than half
-    of one. Three environment variables join the table for the same reason
-    they exist — `$AGENT_PROTOCOL_ROOT`, `$CLAUDE_PROFILES_HOME`,
-    `$PROJECTS_DIR`.
-
-    And the retired invariant, in the same release and named here because it
-    is a DELETION that cost lines rather than saved them: "the only thing in
-    this toolset that writes a file outside a repository" is now two things
-    writing one file, `resume --workspace` and `wip init`, both only on a
-    machine that has none (Amendment 9(c) step 9, act 3 obligation 3).
-
-    353 -> 358 on 2026-09-13, for A9 Addendum 4's R-A9-12 and R-A9-14, ratified
-    the same day on the adversarial review of act 3's PR. Five lines, all in
-    § "Install", and every one of them behaviour a person MEETS rather than
-    prose about it: that `--install` refuses a target that is not a regular
-    file, naming each one and the `rm` that clears it, because `cp` follows a
-    symlink and the thing on the other end of the two this estate actually has
-    is the workspace checkout every lane writes — the review measured
-    `9 of 9 placed` and exit 0 while the two commands stayed uninstalled and
-    `brett-wip`'s worktree went dirty. The other two words are corrections
-    rather than additions: the conflict arm keys on `session-start` and not on
-    `lanes-edit.sh` (R-A9-14), and the merge WRITES the file back at mode 600
-    where this said it preserved a mode it in fact sets.
-
-    256 AND 358 MEET AT 363, the same merge and the same arithmetic: `main`'s
-    5 lines for a branch gone from origin and a role with no place, this
-    branch's 107 for the install story Amendment 9 rewrote, both from 251, and
-    363 in the file that merged.
-
-    363 AND 372 MEET AT 382, and that is TWO raises read back in one place
-    rather than a number nobody can reconstruct. Amendment 11's branch raised
-    its own cap twice from the 353 it inherited — 372 for ratified decisions 6
-    and 7 (two new words on PATH, `restart` and `lanes`, and the
-    `$LANES_WORKSTATION` row decision 8(d) makes load-bearing) and 382 for the
-    round that followed — while `main` went 353 -> 358 -> 363 for A9 Addendum
-    4. Merging `main` at `d4b5710` brings both sets of lines into one file, and
-    the cap is the branch's own 382 because it is the higher of the two and the
-    merged README measures 382 exactly. The cap moves with the TOOLSET and
-    never with prose, which is why the four lines A11 Addendum 4 ruling 9 adds
-    — `--install`'s command-file list, and `commands/swap.md` in it — fit
-    inside it rather than raising it again.
-
-    382 -> 389 on 2026-09-13, for TWO rules, and the second is a correction.
-
-    The first is the SETTLED DEFAULT of clause (j)'s listing
-    (Brett Heap, 2026-09-13T20:38:11Z, verbatim "Narrow inside a checkout
-    (Recommended)"). Five lines, and every one of them is behaviour a person
-    MEETS: the code block said `lanes  # every lane on this workstation`, which
-    was the pre-settlement default and is now wrong twice over - a bare `lanes`
-    inside a checkout lists THAT REPOSITORY's lanes and ends with the next free
-    position and the `lane-start <repo> <n>` that takes it, and outside one it
-    lists every lane the estate knows rather than one workstation's. A reader
-    who types the word from a checkout and is told the listing is broken,
-    because the document promised them every lane, is the cost of leaving it.
-    The second line of the block is `lanes --all`, which is the sentence's
-    other half and the thing to type when the narrowing is not what you meant.
-
-    The second is the COMMAND FILE the install paragraph never named. A11
-    Addendum 4 ruling 9 gave `--install` `commands/swap.md` at the same pair of
-    paths a skill takes, and the count below that paragraph was raised to
-    eighteen - but the paragraph itself still said "five things that are not
-    files in that directory" and listed four skill copies and the hook. Two
-    lines name the command file and its two destinations, which is the half of
-    the install contract a person cannot verify from the count alone: they can
-    count to eighteen and still not know where `/swap` lands.
-    270 AND 363 MEET AT 377, the same merge and the same arithmetic: this
-    branch's 14 lines for the computed path, its three sources and the states
-    that get no move, and `main`'s 107 for the install story Amendment 9
-    rewrote, both from 256, and 377 in the file that merged.
-    377 -> 383 on 2026-09-14, for THE RECORD'S OWN KEY ORDER, the reading
-    the AGENTS.md entry above describes. Six lines in the exception, and the
-    two exits are why they are here rather than only there: this is the
-    paragraph somebody meets the record layer in WITHOUT rule 4 beside it,
-    and a finding whose exit reads "park that feature again" is one they run
-    from the machine they happen to be sitting at — which is the park that
-    rewrites the block out of its own loader's reading and takes the
-    unread lines with it. The six are the six this branch wrote as
-    256 -> 262, rebased onto the 377 `main` reached while it waited, in the
-    same sentence of the same exception and over none of the lines the
-    entries above bought.
-
-    389 AND 377 MEET AT 403, the same merge and the same arithmetic, and both
-    halves of it are above: this branch's 26 lines from 363 - 372 for ratified
-    decisions 6 and 7, 382 for the round after them, 389 for the settled
-    narrowing and the command file - and `main`'s 14 for the computed worktree
-    path (#27, `7efc850`), both from 363, and 403 in the file that merged.
-    Neither dated entry is dropped, because a cap is only worth having while
-    the reason for every line of it can still be read back.
-
-    383 AND 403 MEET AT 409 on 2026-09-14, where this branch merged `main`
-    at `63a74af` — Amendment 11's tooling, #26 — after waiting on review.
-    Both raises start from the 377 the entry three above records, and
-    neither touches the other's lines: this branch bought 6 for the
-    record's own key order, `main` bought 26 for `restart`, `lanes`, the
-    `$LANES_WORKSTATION` row and the settled narrowing, and the merged
-    README measures 409. The cap is the count of what merged, not either
-    side's number — 383 and 403 are each a half of this file and neither
-    is this file — and both dated entries above stay, because each still
-    names the lines it bought.
-
-    409 -> 417 on 2026-09-14, for lane-collision-protocol AMENDMENT 12's
-    SECOND HOOK ENTRY (ratified 2026-09-13T18:20:44Z, "Ratify revision 2";
-    adoption act 3, opensoft/openRepoTools#25). Eight lines, and the cap moves
-    with the TOOLSET as every entry above it does: `--install` now merges TWO
-    entries into `~/.claude/settings.json` rather than one, so the install
-    paragraph's "seven things that are not files in that directory" is eight,
-    the sentence that named one merged entry names two and says what the second
-    one DOES — at every prompt it checks that the tmux window, the session's own
-    name and the register row are one lane, and refuses the prompt when they are
-    not — the conflict sentence gains the `guard` arm, and one line says that a
-    person's own `UserPromptSubmit` hooks are left where they are, which is the
-    half of the contract the count cannot show. That last line is not prose
-    about the install: it is the reason the arm keys on the VERB and not on the
-    word anywhere in a path, and a reader whose settings already carry
-    `~/projects/xFactory/guard.sh` — this estate's usage guard, in every
-    profile — needs it before they run the command. The count below the
-    paragraph moves 18 -> 19 with them, in the one place it is stated here and
-    derived in `test_openrepotools_command.py`.
-    409 -> 422 on 2026-09-14, for the FOUR FINDINGS of #40 — Copilot's review
-    of the re-vendor at `8a36eb3`, filed here rather than taken there because
-    they predate the pin move. Thirteen lines, and every one of them is
-    BEHAVIOUR A PERSON MEETS rather than prose about it, which is the only
-    kind this cap moves for. Four in the install paragraph: `--install` stamps
-    the documented mode on every artifact whether or not the bytes moved, so a
-    second run prints `(mode restored to 755)` where it used to print
-    `(unchanged)` over a mode it had just repaired; and a target this user
-    CANNOT WRITE — not only one that is not a regular file — is refused in the
-    same planning phase, with the `rm -f` that clears it and the reason that
-    `rm` takes a read-only file at all. Two more say the mode of the artifacts
-    that are NOT files in the bin directory, where it was the defect and not
-    only the line: a `SKILL.md` whose bytes were right kept a wrong mode for
-    ever, and `~/.claude/settings.json` kept a widened one on the one path
-    that never rewrote it. Six for `wip init`'s seed, which staged
-    `git add -A -- .` and pushed whatever an ADOPTED checkout carried into the
-    one repository that holds a person's unfinished work — the refusal, what
-    it names, and that it is asked before a byte is written into that
-    checkout. Every dated entry above stays, and none of these thirteen is
-    over one of their lines.
-
-    422 -> 428 on 2026-09-14, for THE SIX LINES #44's first review round buys,
-    each of them a refusal a person meets rather than prose about one. THREE
-    SAY WHAT A DIRECTORY HAS TO BE: the question is put to the nearest ancestor
-    that exists, so a `$OPENREPOTOOLS_BIN_DIR` that is not there YET is refused
-    for the parent that would not take it rather than dying at an unguarded
-    `mkdir -p` with the shell's own 1; a create takes a directory's search bit
-    as well as its write bit, so one at 0600 is refused where `-w` alone passed
-    it and the `cp` failed with eleven artifacts placed; and a refusal creates
-    none of those directories, where planning used to prove each writable by
-    MAKING it and so left seven behind on a machine that had none. THREE SAY
-    THAT `~/.claude/settings.json` MUST ITSELF BE A REGULAR FILE — the one
-    artifact no walk asked about, which mattered the moment the round before
-    this one gave the `present` arm a `chmod`: `chmod` follows a symlink, so a
-    settings file linked into a dotfiles checkout had the 600 stamped on the
-    file at the FAR END, and the merge arms replace such a link with the file
-    they wrote. Every dated entry above stays, and none of these six is over a
-    line one of them bought.
-
-    428 -> 434 on 2026-09-14, for lane-collision-protocol AMENDMENT 17,
-    ratified that day, and its tooling (#36) — SIX LINES on top of the
-    twenty-six above, measured after this branch merged `main` at `b5244e2`
-    rather than either side's own number, which is the rule the 409 entry
-    states. All six are in § "Install" and every one is a fact a person MEETS:
-    the file count moved 11 -> 12 because `lane-handoff` is a word the
-    amendment puts on PATH (clause (a): *"`lane-handoff` on `PATH` (placed by
-    `openRepoTools --install`) from a shell"*), so the sentences carrying that
-    number and the `12 of 12 placed` line a person reads back off their own
-    terminal all move with it; the skill list is three rather than two and the
-    command-file list three rather than one, because the act was renamed
-    `handoff` with `lane-swap` kept as an alias naming it, and because `/ctx` is
-    `/handoff --restart`; and the artifact count is 25. The lines that earn
-    their place are the last four: a reader who types `/ctx` needs to know it
-    writes the record BEFORE it respawns the pane, and that the new session
-    comes up with the handoff's top block as its first prompt — which is the
-    whole of why the word exists. Every dated entry above stays.
-
-    417 and 428 -> 436 on 2026-09-14, at the merge of this branch with `main`
-    @ `b5244e2`. Each side raised this cap for its own lines and every dated
-    entry above stays: Amendment 12's second hook entry bought 8 on this
-    branch, and #40's four findings and #44's first round bought 13 and 6 on
-    `main`. They meet in ONE paragraph, the install one, which both sides
-    rewrote — so the merged sentence carries both facts, the TWO merged
-    entries with the name guard's own sentence AND the regular-file rule with
-    the modes `--install` stamps — and a paragraph that says both is longer
-    than either half of it. The cap is the count of WHAT MERGED and not
-    either side's number, which is the rule the 2026-09-13 entry above states
-    in its own words.
-
-    436 + 434 MEET AT 472 on 2026-09-15, where this branch merged `main` at
-    `2faa883` (Amendment 12's `UserPromptSubmit` name guard, its artifact
-    accounting, and #44/#53 beneath it) on top of Amendment 17's six. The
-    artifact count is TWENTY-SIX, which is what the two sides' lists come to
-    together — twelve files, three skills at two paths, three command files at
-    two paths, and the two hook entries — and it is derived in
-    `tests/test_openrepotools_command.py` rather than believed here. The cap is
-    the count of what merged, not either side's number, and every dated entry
-    on both sides stays because each still names the lines it bought.
-
-    THE CAP DOES NOT MOVE FOR AMENDMENT 16 (2026-09-15), and that is worth one
-    sentence rather than none: `lane-rename` is a THIRTEENTH file on PATH and a
-    TWENTY-SEVENTH artifact — every count above moves with it, derived in
-    `tests/test_openrepotools_command.py` as this entry says — and the fifteen
-    lines it buys in § "The lane tooling" and § "Install" fit inside 472. A cap
-    is a budget and not a target: an entry that raised it by fifteen because
-    fifteen lines were written would make the number mean nothing.
-
-    472 -> 484 on 2026-10-02, for #57 (the install receipt). Twelve lines: the
-    ten of the receipt paragraph in § "Install", the blank line after it, and
-    one row in the environment table for `$OPENREPOTOOLS_DATA_DIR`. They are
-    behaviour a person MEETS rather than prose about it. The receipt is the
-    only place a retirement's evidence is explained - what a row is, that a
-    digest which still matches is this installer's copy and is removed, that
-    one which has MOVED is the person's edit and is named and left with the
-    `rm` printed, and that rows are keyed by DESTINATION, so moving
-    `$OPENREPOTOOLS_BIN_DIR` keeps the old directory's evidence. 0600 and the
-    fallback are the two facts a person meeting a refused retirement needs:
-    the mode the file is born at, and that a path with no row is read by the
-    `Installed on PATH by` header as before. The paragraph was written at
-    eighteen lines and cut to ten before this entry; the cap is raised for the
-    facts above and for no arithmetic - the artifact count stays where
-    `tests/test_openrepotools_command.py` derives it, and not here. Every dated
-    entry above stays, and none of these twelve is over a line one of them
-    bought.
-
-    484 -> 486 on 2026-10-02, for #64 (Brett Heap's RULING of that day,
-    verbatim "go with option 1 on #64"). Two lines in `wip init`'s seed
-    paragraph, and both are a refusal a person MEETS rather than prose about
-    one: a checkout ADOPTED clean but ahead of its workspace repository's
-    `main` by any commit other than an earlier run's own unpushed seed is
-    refused before a byte is written into it, naming those commits, because
-    step 8's push would publish every one of them — and pushing or discarding
-    them is the person's. The paragraph already says why the worktree half of
-    the same rule exists; this is its history half, and a reader of one should
-    not meet the other as a surprise. Every dated entry above stays.
-
-    486 HERE AND 510 AT AN ASSEMBLY ROOT, on 2026-10-08 (opensoft/openRepoTools
-    #186, T009), for the reason the AGENTS.md entry of that day gives. The
-    twenty-four lines `assembly-0001` adds to the assembly's README are the
-    lockstep-invariant section the leg pins' `resync_runbook:` names
-    (`README.md#the-lockstep-invariant`) and the three-repository front door.
-    Today's single repository keeps 486.
-
-    486 -> 505 HERE, on 2026-10-18
-    (opensoft/openRepoTools #228, feature 006, T024), for what a workstation
-    with pipx's link reads. Twenty lines, each one a thing a person MEETS: the
-    version paragraph, 3 -> 7 (FR-043), which said "no version number" and
-    now says that a release is an annotated tag, that the version comes only
-    from the tag, and what `--version` prints stamped, unstamped and from a
-    checkout; the one sentence that a workstation uses one install route or
-    the other until workBenches#165 lets its `setup-estate-commands.sh`
-    accept pipx's link, with its blank (FR-047, Brett Heap's decision of this
-    day), 4; the paragraph that says what `--install` does beside that link,
-    with its blank, 7; the sixteen-of-seventeen pointer on the file count and
-    the one-link-skipped sentence in the symlink passage, 1 and 1; and the
-    count invariant's twenty-eight placed, one left to pipx and 28 receipt
-    rows, 3 (FR-044). No pipx install route is added (FR-045). Every dated
-    entry above stays.
-    THE ASSEMBLY'S 510 DOES NOT MOVE HERE, although the 2026-10-08 entry makes
-    it this count plus T006's twenty-four, which would be 529. Its file does
-    not exist yet, and the README part of `assembly-0001` no longer applies to
-    today's README, at three hunks: the one at `README.md:237`, which adds the
-    assembly's install sentence, fails against this entry's own rewrite of the
-    file-count sentence; the one at `README.md:260`, which moves `tests/run.sh`
-    under `code/`, fails against this entry's one-link-skipped sentence in the
-    symlink passage; and the one at `README.md:300`, which does the same for
-    `commands/swap.md`, fails against #237's (#247's) rewrite of the count
-    paragraph. None of the three can be counted at this head, so
-    529 would be arithmetic over a patch that does not apply. The re-cut that
-    makes the assembly's file again sets its cap, as the 2026-10-18 AGENTS.md
-    entry above says for its 347, and `tests/test_test_roots.py` holds 510
-    until then.
-    """
-    lines = doc("README.md").read_text().splitlines()
-    cap = 505 if ROOTS.assembly is None else 510
-    assert len(lines) <= cap, f"README.md is {len(lines)} lines; the cap is {cap}"
-
-
-def test_readme_says_what_a_release_is_and_offers_no_package_route():
-    """What T024 put in README is held here, because the line cap is the only
-    thing that bites otherwise (the review of PR 4 of #228, S2: a README
-    that offered the pipx route, dropped the one-route sentence, took back
-    "no version number" or counted 17 of 17 beside pipx's link, each stayed
-    green).
-
-    SC-009 and FR-045: README names no package route. No line holds `pipx
-    install` or `pip install` before `openrepotools` in any spelling of the
-    name, which is the check T024's own verify makes once, and makes only for
-    the lower-case `pipx install openrepotools`. FR-047: the install section
-    cites opensoft/workBenches#165. FR-043: the version paragraph holds the
-    three first lines `--version` prints, stamped, unstamped and from a
-    checkout, spelled as `contracts/cli-output.md` gives them. FR-044: the
-    count line beside pipx's link and the count invariant's receipt rows.
-
-    FR-045's later PR (the change's tasks.md 6.4) rewrites this test: it adds
-    the pipx route, so the first assertion goes with it, and the other three
-    follow the text it moves."""
-    text = doc("README.md").read_text(encoding="utf-8")
-
-    route = re.compile(r"(?i)\bpipx?\s+install\b.*\bopenrepotools\b")
-    offered = [line for line in text.splitlines() if route.search(line)]
-    assert not offered, (
-        "README.md offers a package route, which FR-045 and SC-009 forbid "
-        f"until the workBenches condition holds: {offered}")
-
-    install = re.search(r"(?ms)^## Install\n(.*?)(?=^## )", text)
-    assert install, "README.md has no `## Install` section"
-    assert "opensoft/workBenches#165" in install.group(1), (
-        "README.md's install section does not cite opensoft/workBenches#165, "
-        "which FR-047 requires beside the one-route sentence")
-
-    stamped = "openRepoTools <version> (<repository> @ <commit>)"
-    paragraphs = [" ".join(p.split()) for p in re.split(r"\n\s*\n", text)]
-    version = [p for p in paragraphs if stamped in p]
-    assert version, f"README.md has no paragraph holding `{stamped}`"
-    for first_line in (stamped, "openRepoTools 0.0.0 (an unstamped package)",
-                       "openRepoTools (<repo> @ <ref>)"):
-        assert first_line in version[0], (
-            f"README.md's version paragraph does not hold `{first_line}`")
-
-    for count in ("16 of 17 placed in <dir>, and 1 left to pipx",
-                  "28 receipt rows"):
-        assert count in text, (
-            f"README.md does not say `{count}` beside pipx's link (FR-044)")
-
-
-#: A host-absolute path baked into a committed file (the estate's Rule 1):
-#: it names one machine, one user, or one session, and silently breaks the
-#: moment the repository moves to a different machine or a different user's
-#: checkout - which is exactly what openRepoShape #61 found in one of its own
-#: tests, a scratchpad path from one session that no other machine could ever
-#: match.
-#:
-#: Each alternative requires a REAL-LOOKING segment rather than matching on
-#: the word alone, checked against what this repository's tracked text
-#: actually carries today:
-#:   - requiring the segment to contain no whitespace excludes a Windows
-#:     example that illustrates a SPACE in a username to make a quoting point;
-#:     this repository has none today and the exclusion costs nothing.
-#:   - .github/workflows/tests.yml would otherwise be flagged for the
-#:     GitHub-hosted Windows runner's own fixed account - a shared,
-#:     nobody's-machine-in-particular login. THE FILE IS SCANNED LIKE EVERY
-#:     OTHER: it is that ACCOUNT that is exempted, by the `(?!runneradmin\\)`
-#:     lookahead in the pattern below, so a real user's path in that same
-#:     workflow is still a finding.
-#:   - This definition would otherwise flag ITSELF: the Claude-scratchpad
-#:     tmp-directory prefix this guard exists to catch is therefore spelled
-#:     as two concatenated pieces, not written out contiguously.
-_CLAUDE_TMP_PREFIX = "/tmp/" + "claude-"
-HOST_ABSOLUTE_PATH = re.compile(
-    r"/home/[a-z][a-z0-9_-]*/"
-    "|" + re.escape(_CLAUDE_TMP_PREFIX) +
-    r"|/Users/[A-Za-z][A-Za-z0-9_-]*/"
-    r"|C:\\Users\\(?!runneradmin\\)[^\s\\]+\\"
-)
-
-#: THE BENCH ROOT, A RULE OF ITS OWN (opensoft/openRepoTools#193, item 22). A
-#: path under a bench's root names one machine as surely as a home directory
-#: does, and the rule above never matched it: 87 lines in two committed files
-#: carried one, checked by a person's eye alone. It is a second pattern, and
-#: not a fifth alternative above, because it has an allowance the first rule
-#: has no use for (`QUOTED_SEARCH_PATTERNS`, below).
-#:
-#: The pattern wants the root at the START of a path. Nothing that continues a
-#: path segment (a word character), a home directory (`~`), a variable (`$`,
-#: `}`) or a relative walk (`.`) may stand directly before it, so a relative
-#: `templates/<name>/` directory called `workspace`, or `~/workspace/…`, is not
-#: this bench's root and is not a finding. The root's name carries the trailing
-#: slash on purpose: `workspace.yaml` and `workspace-root/` are not it.
-#:
-#: THE ROOT IS SPELLED IN TWO PIECES for the reason `_CLAUDE_TMP_PREFIX` is:
-#: this file is scanned like every other, and a contiguous spelling here would
-#: be a finding in the very file that defines the rule.
-_BENCH_ROOT = "/work" + "space/"
-BENCH_ABSOLUTE_PATH = re.compile(r"(?<![\w.~$}])" + re.escape(_BENCH_ROOT))
-
-#: THE ONE ALLOWANCE: a path inside a quoted SEARCH PATTERN. A recorded
-#: `grep -e '<root>/…'` says what was searched for, and swapping a placeholder
-#: into it would make the record claim a different search. Three lines of
-#: `specs/004-migrate-to-triad/consumer-reads-2026-10-07.md` are exactly that.
-#:
-#: It is narrow on purpose. An allowed span is a SINGLE-QUOTED string (the shell
-#: expands nothing in one, so it is plainly a literal) that is
-#:   - the first quoted operand after a `grep` word and its short flags, as in
-#:     `grep -rn '^path: …'` and `grep -E '…'` (`git grep -n -e '…'` is this
-#:     form too: `-e` reads as one more flag), or
-#:   - the argument of a further `-e`, as in `grep -n -e 'a' -e 'b'`.
-#: Everything else stays a finding. The run of flags ends at the first word that
-#: is not a short flag, so a flag followed by a bare value (`grep -m 1 '…'`)
-#: licenses nothing; and a bundle that carries a lowercase `f` (`-f`, `-rf`) is
-#: not a flag of the run at all, because `-f` names a pattern FILE, which is a
-#: path and never a pattern (`-F`, fixed strings, is an ordinary flag). Likewise
-#: a second quoted operand is a FILE (`grep -n 'x' '<path>'`), a double-quoted
-#: string can hold a variable, and a path before the `grep` (`git -C <path>
-#: grep …`) is outside it.
-#:
-#: A scrubbed span is replaced by `grep ` WITH its space: a bare `grep` ends in a
-#: word character, and the root's lookbehind would then drop a path glued onto
-#: the closing quote. The key is the word `grep`, not a command position, so
-#: prose or an `echo` that says `grep '…'` is scrubbed the same way; this is a
-#: lexical rule for text a person reviews, not a shell parser. Within a line
-#: only: no whitespace in these patterns may be a newline.
-QUOTED_SEARCH_PATTERNS = re.compile(
-    r"\bgrep(?:[ \t]+-(?![A-Za-z]*f)[A-Za-z]+)*[ \t]+'[^'\n]*'"
-    r"(?:[ \t]+-e[ \t]+'[^'\n]*')*")
-
-
-def host_absolute_path_hits(text: str) -> list[str]:
-    """Every host-absolute path in `text`: the matched strings of
-    `HOST_ABSOLUTE_PATH`, then one `line N: <the line>` for each line that
-    names the bench root outside a quoted search pattern. A bare `[]` means the
-    text is clean."""
-    hits = HOST_ABSOLUTE_PATH.findall(text)
-    for number, line in enumerate(text.splitlines(), 1):
-        scrubbed = QUOTED_SEARCH_PATTERNS.sub("grep ", line)
-        if BENCH_ABSOLUTE_PATH.search(scrubbed):
-            hits.append(f"line {number}: {line.strip()[:120]}")
-    return hits
-
-
-def _dispatcher_arms(text: str) -> list[str]:
-    """Every subcommand the main dispatcher has an arm for, in file order.
-
-    The dispatcher is the LAST `case "$cmd" in` in the file — the two before it
-    are the pre-flight guards (the dirty-checkout capture and Amendment 11's
-    container refusal), which name a subset deliberately.
-    """
-    lines = text.splitlines()
-    starts = [i for i, l in enumerate(lines) if l.strip() == 'case "$cmd" in']
-    assert starts, "lanes-edit.sh has no `case \"$cmd\" in` at all"
-    out: list[str] = []
-    for line in lines[starts[-1] + 1:]:
-        # `startswith` AND NOT `line.strip() == "esac"`, and it is deliberate:
-        # the dispatcher's arms contain NESTED `case` statements whose `esac` is
-        # indented, so a whitespace-insensitive test ends the scan at the first
-        # of those. Measured: with `line.strip() == "esac"` this parser finds
-        # TWO arms instead of thirty and the test below fails on its own guard
-        # ("the parser has drifted"). The unindented `esac` is the dispatcher's
-        # own, which is exactly the property being relied on.
-        if line.startswith("esac"):
-            break
-        m = re.match(r"^  ([a-z][a-z0-9|-]*)\)", line)
-        if m:
-            out.extend(m.group(1).split("|"))
-    return out
-
-
-def test_the_unknown_subcommand_refusal_names_every_subcommand_there_is():
-    """`2` FROM THE `*)` ARM IS HOW A CALLER DETECTS AN OLD HELPER, and the
-    list it prints is the only place a person learns what this file answers to.
-
-    `fetch-age` was missing from it (F-X16): the arm existed, the read worked,
-    and the refusal for a typo listed twenty-nine of the thirty verbs — so a
-    person who mistyped `fetch-age` was told, by omission, that it does not
-    exist. The list is DERIVED here from the dispatcher's own arms rather than
-    restated, because a restated list is the thing that drifted.
-    """
-    text = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    arms = _dispatcher_arms(text)
-    assert len(arms) > 25, f"only {len(arms)} arms parsed — the parser has drifted"
-    m = re.search(r"unknown subcommand '\$cmd' \(([^)]*)\)", text)
-    assert m, "no unknown-subcommand refusal found in lanes-edit.sh"
-    listed = m.group(1).split("|")
-    assert sorted(set(listed)) == sorted(set(arms)), (
-        "the unknown-subcommand refusal and the dispatcher disagree:\n"
-        f"  in the arms but not the list: {sorted(set(arms) - set(listed))}\n"
-        f"  in the list but not the arms: {sorted(set(listed) - set(arms))}")
-    assert len(listed) == len(set(listed)), "the refusal lists a verb twice"
-
-
-def test_the_exit_code_table_carries_every_code_the_file_exits_with():
-    """*"EXIT CODES — every subcommand, one table, no two meanings on one
-    number"* is a claim the table makes about itself (`lanes-edit.sh:160`).
-
-    **64 was in no table at all** while twenty-one `die`s used it and the
-    contract gave it to every read Amendment 11 added (F-X16). A table that
-    says it is complete and is not is worse than no table, because it is the
-    thing a reader checks the code against.
-    """
-    text = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    start = text.index("# EXIT CODES — every subcommand, one table")
-    # The table ends where the next header does. `\n#\n` is NOT the boundary:
-    # a row long enough to need a blank comment line inside it would truncate
-    # the table and the test would pass by reading less of it.
-    end = text.index("# --no-sweep", start)
-    table = text[start:end]
-    used = set()
-    for m in re.finditer(r'\bdie "(?:[^"\\]|\\.)*" (\d+)', text, re.S):
-        used.add(m.group(1))
-    for m in re.finditer(r"^\s*(?:return|exit) (\d+)\b", text, re.M):
-        used.add(m.group(1))
-    documented = set(re.findall(r"^#\s+(\d+)\s{2}", table, re.M))
-    missing = sorted(int(c) for c in used - documented - {"0"})
-    assert not missing, (
-        f"these exit codes are used and are in no row of the table: {missing}\n"
-        f"the table documents {sorted(int(c) for c in documented)}")
-    assert "64" in documented, "64 is the code every Amendment 11 read uses"
-
-
-#: THE THREE CAUSES OF EXIT 3, as `lanes-edit.sh`'s exit-code table and the
-#: manual's copy of it give them, and what ties each cause to the `die` that
-#: reports it (opensoft/openRepoTools#68 item 5).
-#:
-#: A DIE IS TIED TO ITS CAUSE BY WHERE IT SITS AND NEVER BY WHAT IT SAYS. #68
-#: item 3 rewords `git_timeout_die`'s message and the act 2 `commit_publish`
-#: rewrites the push loop's, and a rule that found each die by a run of its own
-#: words would go blind at the first rewording that keeps the meaning (the
-#: first version of this rule did: it found the rebase conflict's die by the
-#: text `rebase conflict on origin/$LANES_BRANCH`). So:
-#:
-#:   * `function`: the cause owns every `die … 3` inside that function —
-#:     `git_timeout_die`, which exists to report one thing;
-#:   * `marker`: else the cause owns a `die … 3` that follows its marker
-#:     nearer than any other cause's marker, inside the same function — the
-#:     `dirty_elsewhere` guard that skips the pull and pushes straight out
-#:     (a peer's uncommitted file), and the `git_net … pull` call, after which
-#:     the rebase conflict's die sits (its `else` arm, reached when that call
-#:     fails). Neither is the function's name, so renaming `commit_push` leaves
-#:     the rule standing; and the marker is a CALL, not a word, because the
-#:     peer branch's own `note` says "skipping 'pull --rebase'" a few lines
-#:     above its die.
-#:
-#: What a die and each row that documents its cause must keep saying is
-#: `concept`: one word-group per cause, loose enough that rewording keeps
-#: passing ("timed out", "timeout" and "time-out" are one concept) and tight
-#: enough that a row which drops the cause fails. `scoped` is the wording #32
-#: put on the one cause whose die could be read as a claim about origin.
-#:
-#: A FOURTH CAUSE is a new row in this tuple and a new clause in BOTH rows — and
-#: a fourth `die … 3` with no row is exactly what the rule below refuses.
-_Exit3Cause = namedtuple("_Exit3Cause", "name function marker concept scoped")
-_EXIT_3_CAUSES = (
-    _Exit3Cause(
-        "a network timeout", "git_timeout_die", None,
-        re.compile(r"\btime[ds]?[ -]?out", re.I), None),
-    _Exit3Cause(
-        "six attempts blocked by a peer's uncommitted file", None,
-        re.compile(r"\bdirty_elsewhere\b"),
-        re.compile(r"\b(?:uncommitted|dirty)\b", re.I), None),
-    _Exit3Cause(
-        "a rebase conflict", None,
-        re.compile(r"\bgit_net\b[^\n]*\bpull\b"),
-        re.compile(r"\brebase\W+conflict", re.I),
-        re.compile(r"\bnot pushed by this attempt", re.I)),
-)
-
-#: A `die` whose message is one quoted literal and whose last word is `3`; a
-#: `\"` inside the message is read whole. A message that holds a command
-#: substitution with quotes of its own is NOT read by this, so `_exit_3_dies`
-#: also counts every line that ends `… 3` after a closing quote and compares:
-#: a `die` of that shape this cannot read is a finding. What stays out of its
-#: reach is a `die` whose exit code is not a literal `3` on the line that closes
-#: the message: the code held in a variable, or a `3` on a backslash-continued
-#: line of its own.
-_DIE_EXIT_3 = re.compile(r'\bdie "((?:[^"\\]|\\.)*)"[ \t]+3\b', re.S)
-_ENDS_IN_EXIT_3 = re.compile(
-    r'''["'][ \t]+3(?=\s*(?:$|;|\|\||&&|\)|\}|#))''', re.M)
-
-#: A SENTENCE THAT CLAIMS THE EDIT NEVER REACHED ORIGIN. Exit 3 is the code for
-#: "this attempt cannot confirm whether it also reached origin" (#32): a hung
-#: push often landed, and an aborted pull is no proof the commit stayed local
-#: in a checkout every lane shares. "not pushed BY THIS ATTEMPT" is the one
-#: true form of the claim, and is the one form this lets through.
-_NOTHING_REACHED_ORIGIN = re.compile(
-    r"\bnothing (?:was |has been )?pushed\b"
-    r"|\bnot (?:been )?pushed\b(?! by this attempt)"
-    r"|\bnever (?:been )?pushed\b"
-    r"|\b(?:never|not|nothing) reach(?:ed)? origin\b", re.I)
-
-
-def _function_around(code: str, at: int):
-    """`(name, offset of its body)` of the shell function whose body holds
-    offset `at` of `code`, or None where `at` is outside every function. A
-    function ends at the first line after its header that is a `}` alone in
-    column 0, which is how `lanes-edit.sh` closes every one of them (the `}'`
-    that closes a multi-line awk program inside one is not that line)."""
-    headers = list(re.finditer(r"^([A-Za-z_]\w*)\(\) *\{", code[:at], re.M))
-    if not headers:
-        return None
-    header = headers[-1]
-    if re.search(r"^\}[ \t]*(?:#.*)?$", code[header.end():at], re.M):
-        return None
-    return header.group(1), header.end()
-
-
-def _exit_3_cause_of(code: str, at: int):
-    """The cause in `_EXIT_3_CAUSES` that the `die` at offset `at` of `code`
-    reports, or None where nothing anchors it to one."""
-    around = _function_around(code, at)
-    if around is None:
-        return None
-    name, body = around
-    for cause in _EXIT_3_CAUSES:
-        if cause.function == name:
-            return cause
-    nearest, nearest_at = None, -1
-    for cause in _EXIT_3_CAUSES:
-        if cause.marker is None:
-            continue
-        hits = [m.start() for m in cause.marker.finditer(code, body, at)]
-        if hits and hits[-1] > nearest_at:
-            nearest, nearest_at = cause, hits[-1]
-    return nearest
-
-
-#: Every mention of `git_timeout_die` but its definition (`git_timeout_die() {`),
-#: each read as a call; and what may stand before a command on its line.
-_GIT_TIMEOUT_MENTION = re.compile(r"\bgit_timeout_die\b(?!\s*\()")
-_AT_COMMAND_START = re.compile(r"(?:^|&&|\|\||[;|({]|\b(?:then|do|else))\s*$")
-
-
-def _timeout_operations(code: str):
-    """`(operations, findings)`: the network operations every call of
-    `git_timeout_die` names (`push`, `pull`, ...), read off the words that
-    follow the call on its line: a quoted command "for the reader"
-    (`git_timeout_die "git push origin $B"`), a bare or quoted operation word
-    (`git_timeout_die push "git push origin $B"`), or both. A timeout row that
-    names a push and a pull is right until a call names a fetch.
-
-    EVERY MENTION OF THE NAME BUT ITS DEFINITION IS READ AS A CALL, and a call
-    whose shape this cannot read is a finding that says exactly that. It is
-    never "nothing calls it", which would be false of a call spelled in a shape
-    the reader did not expect (#68 item 3 may hand it the operation as a word
-    of its own)."""
-    operations, findings = set(), []
-    mentions = list(_GIT_TIMEOUT_MENTION.finditer(code))
-    if not mentions:
-        findings.append(
-            "lanes-edit.sh has no call of `git_timeout_die` (every mention of "
-            "it but its definition is read as one), so the timeout cause both "
-            "rows document can never fire")
-    for mention in mentions:
-        line = code.count("\n", 0, mention.start()) + 1
-        head = code.rfind("\n", 0, mention.start()) + 1
-        tail = code.find("\n", mention.end())
-        rest = code[mention.end():tail if tail != -1 else len(code)]
-        if not _AT_COMMAND_START.search(code[head:mention.start()]):
-            findings.append(
-                f"lanes-edit.sh:{line} mentions `git_timeout_die` somewhere "
-                "other than the start of a command, a shape this rule cannot "
-                "read as a call, so it cannot tell which network operation it "
-                "is called for. Make it the first word of a command; if it is "
-                "only a mention in a string, leave the name out of the string")
-            continue
-        words = []
-        for token in (_commands_on(rest) or [[]])[0]:
-            if token.startswith("#"):
-                break
-            words.append(token)
-        text = " ".join(words)
-        named = set(re.findall(r"\b(push|pull|fetch|clone)\w*", text))
-        if not named:
-            findings.append(
-                f"lanes-edit.sh:{line} calls `git_timeout_die` with {text!r}, "
-                "which names no network operation (push, pull, fetch or clone) "
-                "as a bare word or in a quoted command, so the rows cannot be "
-                "held to it")
-        operations |= named
-    return operations, findings
-
-
-def _exit_3_dies(src: str):
-    """`(dies, operations, findings)` for the text of `lanes-edit.sh`: every
-    `die "…" 3` as `(cause, line, message)`, the network operations
-    `git_timeout_die` is called for, and everything about the DIES themselves
-    that is wrong. The line numbers are the file's own (a whole-line comment is
-    blanked, not removed), and no comment is read as code."""
-    code = "\n".join("" if line.lstrip().startswith("#") else line
-                     for line in src.splitlines())
-
-    def line_of(offset: int) -> int:
-        return code.count("\n", 0, offset) + 1
-
-    dies, findings = [], []
-    read = list(_DIE_EXIT_3.finditer(code))
-    for m in read:
-        message = re.sub(r"\s+", " ", m.group(1))
-        cause = _exit_3_cause_of(code, m.start())
-        if cause is None:
-            around = _function_around(code, m.start())
-            findings.append(
-                f"lanes-edit.sh:{line_of(m.start())} has a `die … 3` in "
-                f"{around[0] if around else 'no function'} that none of the "
-                "documented causes explains, so the exit-code table and the "
-                "manual have no clause for it. Document it in BOTH rows, then "
-                f"add it to `_EXIT_3_CAUSES`: {message!r}")
-            continue
-        dies.append((cause, line_of(m.start()), message))
-    read_ends = {m.end() for m in read}
-    for m in _ENDS_IN_EXIT_3.finditer(code):
-        if m.end() not in read_ends:
-            findings.append(
-                f"lanes-edit.sh:{line_of(m.start())} ends in `… 3`, but this "
-                "rule cannot read it as a `die \"…\" 3` (a message holding a "
-                "command substitution with quotes of its own?), so it cannot "
-                "be held to the rows. Spell the message as one quoted literal")
-    for cause, line, message in dies:
-        said = _NOTHING_REACHED_ORIGIN.search(message)
-        if said:
-            findings.append(
-                f"lanes-edit.sh:{line}: the exit-3 die for {cause.name} claims "
-                f"that nothing reached origin ({said.group(0)!r}), where a "
-                "push may already have landed (#32)")
-        if not cause.concept.search(message):
-            findings.append(
-                f"lanes-edit.sh:{line}: the exit-3 die in the branch for "
-                f"{cause.name} does not name that cause, so the row that "
-                f"documents it describes a message nobody prints: {message!r}")
-        if cause.scoped and not cause.scoped.search(message):
-            findings.append(
-                f"lanes-edit.sh:{line}: the exit-3 die for {cause.name} lost "
-                "its attempt-scoped wording (\"not pushed by this attempt\"), "
-                f"the one form of that claim #32 found true: {message!r}")
-    for cause in _EXIT_3_CAUSES:
-        if not any(found is cause for found, _, _ in dies):
-            findings.append(
-                f"no `die … 3` reports {cause.name}, which both rows document: "
-                "either the cause is gone from the code and the rows are stale, "
-                "or its die moved where nothing anchors it (see "
-                "`_EXIT_3_CAUSES`)")
-    operations, more = _timeout_operations(code)
-    return dies, operations, findings + more
-
-
-def _flattened(text: str) -> str:
-    """`text` as one run of words, however the source wrapped it. A row that
-    wraps onto a comment-continuation line puts a literal `#` back-to-back
-    with the next word once newlines alone are collapsed, so the leading `#`
-    (`lanes-edit.sh`'s own comment marker; a no-op on the manual's markdown,
-    which never starts a line with one) goes from every line FIRST, and a
-    phrase that wraps still reads as one run of words."""
-    lines = (re.sub(r"^#\s*", "", line) for line in text.splitlines())
-    return re.sub(r"\s+", " ", " ".join(lines)).strip()
-
-
-def _exit_3_row_of_the_table(table: str) -> str:
-    """The exit-3 row of `lanes-edit.sh`'s table: from its `#   3  ` header to
-    the next row's, continuation lines and all; the empty string if none."""
-    heads = list(re.finditer(r"^#\s+(\d+)\s{2}", table, re.M))
-    for index, head in enumerate(heads):
-        if head.group(1) == "3":
-            stop = heads[index + 1].start() if index + 1 < len(heads) else len(table)
-            return table[head.start():stop]
-    return ""
-
-
-def _exit_3_row_of_the_manual(section: str) -> str:
-    """The manual's exit-3 row, one markdown line; the empty string if none."""
-    row = re.search(r"^\|\s*3\s*\|.*$", section, re.M)
-    return row.group(0) if row else ""
-
-
-def _exit_3_row_findings(name: str, whole: str, row: str, operations) -> list[str]:
-    """What is wrong with ONE document's exit-3 row: `whole` is all the text
-    of the document that is held to the old claim, `row` is the exit-3 row
-    alone, both flattened."""
-    findings = []
-    if "nothing was pushed" in whole or "nothing pushed" in whole:
-        findings.append(
-            f"{name} still claims that nothing reached origin on exit 3, which "
-            "an aborted pull does not prove (#32)")
-    if not row:
-        findings.append(f"{name} has no exit-3 row")
-        return findings
-    said = _NOTHING_REACHED_ORIGIN.search(row)
-    if said:
-        findings.append(
-            f"{name}'s exit-3 row claims that nothing reached origin "
-            f"({said.group(0)!r}), where a push may already have landed (#32)")
-    for cause in _EXIT_3_CAUSES:
-        if not cause.concept.search(row):
-            findings.append(
-                f"{name}'s exit-3 row no longer names {cause.name}, a cause "
-                "the code's `die … 3` still reports. Exit 3 is \"no two "
-                "meanings on one number\", so a code with three causes has to "
-                "name all three (#50 rounds 3 and 4, 5203261904 and "
-                "5203455553)")
-        if cause.scoped and not cause.scoped.search(row):
-            findings.append(
-                f"{name}'s exit-3 row lost the attempt-scoped wording for "
-                f"{cause.name} (\"not pushed by this attempt\")")
-    for operation in sorted(operations):
-        if not re.search(rf"\b{operation}", row, re.I):
-            findings.append(
-                f"{name}'s exit-3 row never names a {operation}, which "
-                "`git_timeout_die` is called for: a timeout on it ends in "
-                "exit 3")
-    return findings
-
-
-def _exit_3_findings(src: str, manual: str | None = None) -> list[str]:
-    """Every way the exit-3 `die`s of `src` (the text of `lanes-edit.sh`), its
-    exit-code table and — when given — the manual's copy of that table
-    disagree. Empty when they agree. The code's half comes first and alone
-    when there is no manual: a standalone code leg has none (#186, T009)."""
-    dies, operations, findings = _exit_3_dies(src)
-    start = src.index("# EXIT CODES — every subcommand, one table")
-    end = src.index("# --no-sweep", start)
-    table = src[start:end]
-    findings += _exit_3_row_findings(
-        "lanes-edit.sh's exit-code table", _flattened(table),
-        _flattened(_exit_3_row_of_the_table(table)), operations)
-    if manual is not None:
-        heading = manual.index("### Exit codes")
-        section = manual[heading:manual.index(
-            "3 to 6 are the codes this helper already used", heading)]
-        findings += _exit_3_row_findings(
-            "docs/README-lanes.md's copy of the table", _flattened(manual),
-            _flattened(_exit_3_row_of_the_manual(section)), operations)
-    return findings
-
-
-def test_the_exit_3_documentation_agrees_with_the_die_message_it_describes():
-    """Copilot's review of PR #50 (5202640056): the `die` for exit 3 picked up
-    attempt-scoped wording (#32) — *"not pushed by this attempt; a later
-    write from this checkout may already carry it"* — while the exit-code
-    table just above it in the same file, and the manual's own copy of that
-    table (`docs/README-lanes.md`), both still read *"nothing was pushed"* /
-    *"nothing pushed"*, a claim an aborted pull never proved. A table (or a
-    manual) that contradicts the code it describes is worse than no table at
-    all — the same claim `test_the_exit_code_table_carries_every_code_the_
-    file_exits_with` makes for a code missing from the table entirely.
-
-    Round 2 (5203033893) found this test's own gap: it read only the table
-    and the manual, so a regression in the `die` MESSAGE ITSELF, back to
-    "nothing was pushed", left both docs unchanged and passed anyway — a
-    test that enforces two descriptions agree with each other, never that
-    either agrees with the code. The die is extracted and checked first now,
-    so all three have to agree with the one thing that actually runs.
-
-    Round 3 (5203261904) named exit 3's other two causes (`git_timeout_die`,
-    and six push attempts exhausted against a peer's uncommitted file) that
-    this row used to leave out entirely; the row now names all three, which
-    means the phrase this test looks for can legitimately wrap onto its own
-    comment-continuation line — so the comparison text is whitespace-
-    normalized (one space, however the source wrapped it) rather than
-    matched as one literal run of characters.
-
-    Round 4 (5203455553) found this test's own gap in THAT check: it looked
-    for the bare word "timeout" only, which the round-3 wording ("timeout on
-    the push itself") already satisfied while omitting `git_timeout_die`'s
-    OTHER call site — a timed-out `git pull --rebase` (`commit_push`'s
-    `git_timeout_die "git pull --rebase …"`) — entirely. Checking for
-    "timeout" alone would keep passing even if a push is all either row ever
-    names again; "push" and "pull" are now checked for too, so the row has to
-    cover both keywords or the test catches it.
-
-    ROUND 5 (5203628254) AND #68 ITEM 5: the gap that was left. Of the three
-    `die "…" 3` in `lanes-edit.sh` — `git_timeout_die`'s own (:1894 at main
-    08e7550), the six-attempts one in `commit_push`'s dirty-checkout branch
-    (:2125) and the rebase conflict's (:2192) — this test read ONE, and the
-    two rows only for the WORDS timeout, push, pull and peer's somewhere in
-    the code's whole table text, not even in its exit-3 row. So either of the
-    other two dies could say anything, "nothing was pushed" included, where a
-    push may already have landed, and this test stayed green. It now reads
-    EVERY `die … 3` and holds each to both rows. What ties a die to its cause
-    (where it sits, so that a rewording that keeps the meaning cannot blind the
-    rule: #68 item 3 will reword, and so will the act 2 `commit_publish`) and
-    what each die and row must keep saying are written at `_EXIT_3_CAUSES`
-    above. A `die … 3` no cause explains is a finding: a fourth cause needs a
-    clause in BOTH rows before it ships.
-
-    The rule is `_exit_3_findings`; its own regression cases, one red per
-    mutation and one green per rewording that keeps the meaning, are the
-    `EXIT_3_*` tables below it, run on a fixture and not on this file's text.
-    """
-    src = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    # THE CODE'S TABLE FIRST, THEN THE MANUAL (#186, T009): in a standalone
-    # code leg the manual is the spec leg's, and the table's half of every
-    # claim above is asserted before that absence ends the test.
-    findings = _exit_3_findings(src)
-    assert not findings, (
-        "lanes-edit.sh's exit-3 `die` messages and its exit-code table do not "
-        "agree (opensoft/openRepoTools#68 item 5):\n  " + "\n  ".join(findings))
-    manual = doc("docs/README-lanes.md").read_text(encoding="utf-8")
-    findings = _exit_3_findings(src, manual)
-    assert not findings, (
-        "the exit-3 `die` messages, the code's table and the manual's copy of "
-        "it do not agree (opensoft/openRepoTools#68 item 5):\n  "
-        + "\n  ".join(findings))
-
-
-#: A FIXTURE FOR THE RULE ABOVE, shaped like the three places exit 3 is raised
-#: and the two rows that document it, and carrying the decoys that fooled
-#: simpler rules: a `die … 3` in a comment, and a `note` that says "skipping
-#: 'pull --rebase'" a few lines above the peer branch's die.
-EXIT_3_SOURCE = '''\
-# EXIT CODES — every subcommand, one table
-#   0  done
-#   3  the edit is never a permanent loss, but this attempt cannot confirm
-#      whether it also reached origin. THREE CAUSES:
-#      a rebase conflict (not pushed BY THIS ATTEMPT; look by content first);
-#      a network timeout on a push OR a pull (a hung one often landed);
-#      or six attempts exhausted because a peer's own uncommitted file blocks
-#      every rebase.
-#   4  the mutex could not be taken within 60s
-# --no-sweep is not an exit code
-# die "a decoy in a comment, which nothing runs" 3
-git_timeout_die() {   # <the command, for the reader>
-  release_lock
-  die "timed out after ${GIT_TIMEOUT}s on '$1' — your commit is local; nothing was lost." 3
-}
-commit_push() {
-  while [ "$attempt" -le 6 ]; do
-    others="$(dirty_elsewhere)"
-    if [ -n "$others" ]; then
-      note "skipping 'pull --rebase' and pushing straight out"
-      git_net push -q origin "$BRANCH" && return 0
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $BRANCH"
-      if [ "$attempt" -ge 6 ]; then
-        die "could not push origin/$BRANCH: behind the remote, and a peer's uncommitted file blocks the rebase. Nothing was lost — your commit is local." 3
-      fi
-    elif git_net pull --rebase -q origin "$BRANCH"; then
-      git_net push -q origin "$BRANCH" && return 0
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $BRANCH"
-    else
-      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git pull --rebase origin $BRANCH"
-      die "rebase conflict on origin/$BRANCH — not pushed by this attempt; a later write from this checkout may already carry it, so look before you retry." 3
-    fi
-  done
-  die "could not push origin/$BRANCH after 6 attempts" 6
-}
-'''
-
-EXIT_3_MANUAL = '''\
-### Exit codes
-
-| code | meaning |
-|---|---|
-| 0 | done |
-| 3 | the edit is never a permanent loss, but this attempt cannot confirm whether it also reached origin — a rebase conflict (not pushed by this attempt; look by content first), a network timeout on a push or a pull (a hung one often landed), or six attempts exhausted because a peer's uncommitted file blocks every rebase |
-| 4 | the mutex could not be taken within 60s |
-
-3 to 6 are the codes this helper already used; 7 and 8 were free.
-'''
-
-
-def _a_fourth_die(message: str) -> str:
-    """A FOURTH FUNCTION WITH AN EXIT-3 DIE, to append to the fixture's source."""
-    return "index_open() {\n  die \"" + message + "\" 3\n}\n"
-
-
-#: Each row is (why, where, old, new, what the findings must say): `old` is
-#: replaced by `new` in the fixture's `code` or `manual`, and the rule must
-#: refuse the result, in the words of the last column.
-EXIT_3_REFUSED = [
-    ("the timeout die says nothing was pushed", "code",
-     "your commit is local; nothing was lost.",
-     "your commit is local; nothing was pushed.",
-     "claims that nothing reached origin"),
-    ("the peer's-file die says nothing was pushed", "code",
-     "Nothing was lost — your commit is local.",
-     "Nothing was pushed — your commit is local.",
-     "claims that nothing reached origin"),
-    ("the conflict die drops its attempt-scoped wording", "code",
-     "not pushed by this attempt; a later write",
-     "not pushed to origin; a later write",
-     "attempt-scoped"),
-    ("the conflict die no longer says what failed", "code",
-     "rebase conflict on origin/$BRANCH — not pushed",
-     "the pull failed on origin/$BRANCH — not pushed",
-     "does not name that cause"),
-    ("the timeout die no longer says it timed out", "code",
-     "timed out after ${GIT_TIMEOUT}s on '$1' — your commit",
-     "failed on '$1' — your commit",
-     "does not name that cause"),
-    ("the peer's-file die no longer says what blocks the rebase", "code",
-     "and a peer's uncommitted file blocks the rebase",
-     "and the rebase is blocked",
-     "does not name that cause"),
-    ("a fourth die in a function no row documents", "code",
-     'die "could not push origin/$BRANCH after 6 attempts" 6\n}\n',
-     'die "could not push origin/$BRANCH after 6 attempts" 6\n}\n'
-     + _a_fourth_die("the index is gone"),
-     "none of the documented causes explains"),
-    ("a fourth die whose message holds a command substitution", "code",
-     'die "could not push origin/$BRANCH after 6 attempts" 6\n}\n',
-     'die "could not push origin/$BRANCH after 6 attempts" 6\n}\n'
-     + _a_fourth_die('$(describe "the index")'),
-     "cannot read"),
-    ("a fourth die in the push loop's success branch", "code",
-     '      git_net push -q origin "$BRANCH" && return 0\n'
-     '      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $BRANCH"\n'
-     '    else\n',
-     '      git_net push -q origin "$BRANCH" && return 0\n'
-     '      [ "$GIT_TIMED_OUT" = 1 ] && git_timeout_die "git push origin $BRANCH"\n'
-     '      die "the push raced six times" 3\n'
-     '    else\n',
-     "does not name that cause"),
-    ("the timeout die now exits 6, so no die reports a timeout", "code",
-     "nothing was lost.\" 3\n}",
-     "nothing was lost.\" 6\n}",
-     "no `die … 3` reports a network timeout"),
-    ("a call site names a network operation no row names", "code",
-     'git_timeout_die "git pull --rebase origin $BRANCH"',
-     'git_timeout_die "git fetch origin $BRANCH"',
-     "never names a fetch"),
-    ("a call site names no network operation at all", "code",
-     'git_timeout_die "git pull --rebase origin $BRANCH"',
-     'git_timeout_die "the network call"',
-     "names no network operation"),
-    ("a call hands git_timeout_die a bare operation word no row names", "code",
-     'git_timeout_die "git pull --rebase origin $BRANCH"',
-     'git_timeout_die fetch "the network call"',
-     "never names a fetch"),
-    ("a mention of git_timeout_die the reader cannot place as a call", "code",
-     "  release_lock\n",
-     "  release_lock\n  note \"git_timeout_die has released the lock\"\n",
-     "cannot read as a call"),
-    ("the table's row loses the timeout cause", "code",
-     "#      a network timeout on a push OR a pull (a hung one often landed);\n",
-     "#      a network failure on a push OR a pull (a hung one often landed);\n",
-     "no longer names a network timeout"),
-    ("the table's row loses the peer's-file cause", "code",
-     "#      or six attempts exhausted because a peer's own uncommitted file blocks\n"
-     "#      every rebase.\n",
-     "#      or one more thing.\n",
-     "no longer names six attempts blocked by a peer's uncommitted file"),
-    ("the table's row loses the pull", "code",
-     "a network timeout on a push OR a pull (a hung one often landed)",
-     "a network timeout on a push (a hung one often landed)",
-     "never names a pull"),
-    ("the table's row loses its attempt-scoped wording", "code",
-     "not pushed BY THIS ATTEMPT; look by content first",
-     "look by content first",
-     "lost the attempt-scoped wording"),
-    ("the table's row says the edit did not reach origin", "code",
-     "whether it also reached origin. THREE CAUSES:",
-     "whether it also reached origin; if it did not reach origin, retry. THREE CAUSES:",
-     "claims that nothing reached origin"),
-    ("the table says nothing was pushed", "code",
-     "#   0  done\n",
-     "#   0  done, and on a refusal nothing was pushed\n",
-     "still claims that nothing reached origin"),
-    ("the manual's row says nothing was pushed", "manual",
-     "cannot confirm whether it also reached origin",
-     "cannot confirm — nothing was pushed",
-     "claims that nothing reached origin"),
-    ("the manual's row is gone", "manual",
-     "| 3 | the edit",
-     "| 13 | the edit",
-     "has no exit-3 row"),
-]
-
-#: Each row is (why, where, old, new): a rewording that keeps the meaning, which
-#: the rule must let through.
-EXIT_3_ACCEPTED = [
-    ("the timeout die is reworded and still says timeout", "code",
-     "timed out after ${GIT_TIMEOUT}s on '$1' — your commit is local; nothing was lost.",
-     "git hit its ${GIT_TIMEOUT}s timeout on '$1'; your commit is local and nothing was lost."),
-    ("the peer's-file die says dirty and not uncommitted", "code",
-     "a peer's uncommitted file blocks the rebase. Nothing was lost — your commit is local.",
-     "another writer's dirty file blocks the rebase. Nothing was lost; your commit is still local."),
-    ("the conflict die keeps its wording and moves its clauses", "code",
-     "a later write from this checkout may already carry it, so look before you retry",
-     "so look before you retry: a later write from this checkout may already carry it"),
-    ("the function that holds the push loop is renamed", "code",
-     "commit_push() {", "commit_publish() {"),
-    ("a call hands git_timeout_die the operation as a bare word", "code",
-     'git_timeout_die "git pull --rebase origin $BRANCH"',
-     'git_timeout_die pull "the rebase on origin/$BRANCH"'),
-    ("two spaces stand before the exit code", "code",
-     "nothing was lost.\" 3\n}", "nothing was lost.\"  3\n}"),
-    ("a comment trails the exit code", "code",
-     "nothing was lost.\" 3\n}", "nothing was lost.\" 3   # the mutex is already released\n}"),
-    ("the table wraps the attempt-scoped phrase onto a continuation line", "code",
-     "not pushed BY THIS ATTEMPT;", "not pushed BY THIS\n#      ATTEMPT;"),
-    ("the manual spells time-out and names each operation", "manual",
-     "a network timeout on a push or a pull",
-     "a network time-out on a push or on a pull"),
-]
-
-
-def _exit_3_fixture(where: str, old: str, new: str) -> tuple[str, str]:
-    """`(code, manual)` of the fixture with `old` replaced by `new` in `where`."""
-    code, manual = EXIT_3_SOURCE, EXIT_3_MANUAL
-    target = code if where == "code" else manual
-    assert target.count(old) == 1, (
-        f"the fixture's {where} no longer holds exactly one {old!r}, so this "
-        "case would pass or fail without testing what it names")
-    target = target.replace(old, new)
-    return (target, manual) if where == "code" else (code, target)
-
-
-def test_the_exit_3_rule_is_green_on_the_fixture_it_is_mutated_from():
-    assert _exit_3_findings(EXIT_3_SOURCE, EXIT_3_MANUAL) == []
-
-
-@pytest.mark.parametrize("why,where,old,new,finding", EXIT_3_REFUSED,
-                         ids=[row[0] for row in EXIT_3_REFUSED])
-def test_the_exit_3_rule_is_red_on_a_die_or_a_row_that_disagrees(
-        why, where, old, new, finding):
-    """RED: each case plants one disagreement in the fixture — a die that
-    claims nothing reached origin, a die or a row that lost its cause, a
-    fourth die no row documents — and the rule must name it, in words that
-    say WHICH check refused. A case that passed for the wrong reason would
-    teach nothing: the last column is what the findings must hold."""
-    code, manual = _exit_3_fixture(where, old, new)
-    findings = _exit_3_findings(code, manual)
-    assert any(finding in each for each in findings), (
-        f"the exit-3 rule did not refuse ({why}) in the words {finding!r}; "
-        f"it said: {findings}")
-
-
-@pytest.mark.parametrize("why,where,old,new", EXIT_3_ACCEPTED,
-                         ids=[row[0] for row in EXIT_3_ACCEPTED])
-def test_the_exit_3_rule_is_green_on_a_rewording_that_keeps_the_meaning(
-        why, where, old, new):
-    """GREEN: #68 item 3 and the act 2 `commit_publish` will reword these
-    messages, so a rule anchored to the words of one would fail on the first
-    change that is only a change of words. The die is tied to its cause by
-    where it sits, and the rows by what they name."""
-    code, manual = _exit_3_fixture(where, old, new)
-    assert _exit_3_findings(code, manual) == [], (
-        f"the exit-3 rule refused a rewording that keeps the meaning ({why})")
-
-
-#: ADOPTION ACT 0, AND THE ONE SHA THAT IS IT. `opensoft/brett-wip#5` merged
-#: 2026-09-13T19:14:37Z, SQUASHED — so the PR's pre-merge head is not an
-#: ancestor of `origin/main` and names code that never landed, while the merge
-#: commit does and is (F-X18, A11 Addendum 4 ruling 13).
-ACT0_MERGED = "3719d97"
-ACT0_DRAFT_HEAD = "95e7a4c"
-#: `opensoft/brett-wip#5` @`<sha>` — the citation shape this repository uses.
-ACT0_CITATION = re.compile(
-    r"`?opensoft/brett-wip#5`?\s*@`([0-9a-f]{7,40})`")
-
-
-def test_adoption_act_zero_is_cited_by_the_sha_that_landed():
-    """A SHA IN A COMMENT IS A CLAIM ABOUT HISTORY, and this one was false in
-    two files: `lane-start:1027` and `lanes-edit.sh:4794` both cited act 0 —
-    the register veto this branch builds its second layer beside — as
-    `95e7a4c`, which is `#5`'s DRAFT head. Measured: `git merge-base
-    --is-ancestor 95e7a4c origin/main` is false and the same test on
-    `3719d97` is true.
-
-    The draft head may still be NAMED, and both files now name it — as the
-    thing that did not land. What is checked here is the citation form
-    `opensoft/brett-wip#5 @<sha>`, which asserts "this is act 0".
-    """
-    offenders = {}
-    cited = 0
-    for rel, path in tracked_files():
-        if not path.is_file():
-            continue
-        try:
-            text = path.read_bytes().decode("utf-8")
-        except UnicodeDecodeError:
-            continue
-        # THE CITATION WRAPS, AND A LINE-BY-LINE MATCH WOULD MISS THE ONE THAT
-        # DID. `lane-start` writes it as "(`opensoft/brett-wip#5`\n#     @`…`)",
-        # so the comment marker of the continuation line sits between the two
-        # halves. Joined here before matching — measured: without this the
-        # regex found only `lanes-edit.sh`'s one-line citation and the mutation
-        # of `lane-start`'s survived.
-        flat = re.sub(r"\n[ \t]*#?[ \t]*", " ", text)
-        for sha in ACT0_CITATION.findall(flat):
-            cited += 1
-            if not (sha.startswith(ACT0_MERGED) or ACT0_MERGED.startswith(sha)):
-                offenders.setdefault(rel, []).append(sha)
-    assert cited, (
-        "no file cites adoption act 0 at all — this test has stopped testing "
-        "anything, or the citation form has changed")
-    assert not offenders, (
-        f"act 0 is cited by a sha that is not the merge commit {ACT0_MERGED}: "
-        f"{offenders}. `{ACT0_DRAFT_HEAD}` is the draft head and is not an "
-        "ancestor of origin/main.")
-
-
-#: EVERY SURFACE THAT PRINTS SOMETHING ABOUT A LIVE FORK. Six of them: `who`,
-#: the SessionStart hook, `live-holder`, `lanes`, `lane` — which shows it where
-#: a person is CHOOSING what to bind, and which is where `restart`'s listing
-#: went under Amendment 18 Addendum 2 — and the `/restart` skill; and
-#: `lane-end`, which A11 Addendum 4 ruling 8 makes the DOOR and which must
-#: therefore hold to the same rule as the surfaces that print it.
-FORK_SURFACES = ("lanes-edit.sh", "lanes", "lane", "skills/restart/SKILL.md",
-                 "lane-end")
-#: A line that offers an act for a fork says `FORK` or `fork(s)` and an
-#: imperative beside it. Matched on the two spellings the surfaces use.
-FORK_ACT_LINE = re.compile(r"^.*(?:live FORK|live fork\(s\)).*$", re.M)
-
-
-#: The two halves of the `/lane-swap` skill that must spell the launch the same
-#: way: the `restart_cmd=` the skill EXECUTES into its printed line, and the
-#: prose three paragraphs below that explains it.
-#: THE SKILL THAT CARRIES THE ACT, READ OUT OF THE INSTALLER'S OWN
-#: `SKILL_NAME` rather than spelled here. Amendment 17(a) renamed the act from
-#: `lane-swap` to `handoff` and left an ALIAS FILE at the old path — one that
-#: restates no step, by the rule `tests/test_install_skill_and_hook.py` holds —
-#: so a constant spelled here went on reading a file with nothing in it to
-#: check, and every assertion below passed on an emptiness. The installer
-#: declares the canonical name once; this follows it, and the next rename moves
-#: both together.
-def _canonical_skill_path() -> str:
-    text = (REPO / "openRepoTools").read_text(encoding="utf-8")
-    match = re.search(r'^SKILL_NAME="([A-Za-z0-9._-]+)"$', text, re.MULTILINE)
-    assert match, "openRepoTools no longer declares `SKILL_NAME=\"…\"`"
-    return f"skills/{match.group(1)}/SKILL.md"
-
-
-SWAP_SKILL = _canonical_skill_path()
-
-
-def test_the_swap_skill_snippet_and_its_prose_spell_the_same_command():
-    """AMENDMENT 11 CLAUSE (a), EDIT 5 OF SIX: *"Every printed restart command
-    becomes the short form … Amendment 8(a) step 5's prescribed
-    `pclaude run <profile>` becomes that short form wherever it is printed."*
-
-    At `dae38be` this file took the snippet half of that edit and left the
-    prose half — `restart_cmd="pclaude ${CLAUDE_PROFILE_NAME:-<profile>}"` with
-    three paragraphs below it still saying `pclaude run <profile>`. That is not
-    a wording nit: `opensoft/workBenches#74`'s
-    `devcontainer.test/test-claude-profile-skill-install.sh` EXECUTES step 5's
-    branch rather than grepping it, and reported
-    `FAIL: RV-S2: normal-path restart_cmd='pclaude work', expected the
-    unqualified command` against the vendored bytes
-    (openRepoTools#26-5656319349). The executed snippet and the paragraph
-    explaining it produced different commands.
-
-    So: no `restart_cmd=` may spell the verb, and every `pclaude run` left in
-    the file must be on a line that says WHY the long form is being named — it
-    is quoted twice, as the sentence clause (a) edits and as the argv the short
-    form builds — rather than printed as the act.
-    """
-    text = (REPO / SWAP_SKILL).read_text(encoding="utf-8")
-    bad_cmd = [l.strip() for l in text.splitlines()
-               if "restart_cmd=" in l and "pclaude run" in l]
-    assert not bad_cmd, (
-        "clause (a) makes every PRINTED restart command the short form, and "
-        f"these assignments spell the verb:\n{bad_cmd}")
-    assigns = [l for l in text.splitlines() if l.strip().startswith("restart_cmd=")]
-    assert len(assigns) >= 2, (
-        f"{SWAP_SKILL} has {len(assigns)} `restart_cmd=` assignments; step 5 "
-        "has two branches (with --lane and without) and this test is stale")
-    unexplained = [l.strip()[:120] for l in text.splitlines()
-                   if "pclaude run" in l
-                   and "short form" not in l and "SAME argv" not in l]
-    assert not unexplained, (
-        "these lines print the LONG form without naming it as the one clause "
-        f"(a) supersedes, so the prose no longer agrees with the snippet:\n"
-        f"{unexplained}")
-    # AND `--lane` IS LEADING, on both halves. Measured on the live launcher
-    # (`claude-profile`): `--lane` is read only BEFORE the action or the
-    # profile — *"the first token that is not one of them ends this loop"* — so
-    # a `--lane` after the profile is handed to Claude and the lane is never
-    # taken.
-    after = [l.strip()[:120] for l in text.splitlines()
-             if re.search(r"pclaude (?:run )?[^`\s]*<?profile>? --lane", l)
-             and "never after" not in l and "handed to Claude" not in l]
-    assert not after, (
-        "`--lane` is a LEADING option of the launcher; after the profile it is "
-        f"passed to Claude and the lane is never taken:\n{after}")
-
-
-def test_every_fork_surface_prints_the_one_act():
-    """CLAUSE (k) RULE (e), and it names the act: *"both print the one act:
-    **retire it**, under Amendment 6(d) … **Neither kills a process** … and
-    `lane-end`'s `--retire` is the door."*
-
-    At `dae38be` the estate printed THREE other things and not that one
-    (F-X8): `restart:214` printed `lanes-edit.sh forks <lane>`, which is a
-    READ that retires nothing; `lanes:173` printed *"Name them"*; and `who`,
-    `live-holder`, the SessionStart hook and the `/restart` skill printed
-    `kill <pid>` — the one act the ruling refuses by name.
-
-    Derived rather than restated: every line in every surface that speaks of a
-    live fork must name `--retire`, and none may offer a `kill`. The IDLE
-    HOLDERS of a lane are a different population — earlier sessions of the lane
-    ITSELF, Amendment 6(d)'s orphans, which `lane-end --retire` refuses because
-    they are not forks — and their `kill` lines are deliberately untouched, so
-    this matches fork lines only.
-    """
-    offenders = {}
-    for rel in FORK_SURFACES:
-        text = (REPO / rel).read_text(encoding="utf-8")
-        for line in FORK_ACT_LINE.findall(text):
-            # `\bkill\b` AND NOT `"kill" in line`: the word `skill` contains it,
-            # and `skills/restart/SKILL.md` is one of the files being walked.
-            if re.search(r"\bkill\b", line) and "--retire" not in line:
-                offenders.setdefault(rel, []).append(line.strip()[:160])
-    assert not offenders, (
-        "these fork lines still offer a `kill` and not clause (k) rule (e)'s "
-        f"one act:\n{offenders}")
-    # …and the act is actually printed somewhere in each of the four.
-    missing = [rel for rel in FORK_SURFACES
-               if "--retire" not in (REPO / rel).read_text(encoding="utf-8")]
-    assert not missing, f"these surfaces name no `--retire` act at all: {missing}"
-
-
-def test_the_manual_offers_the_fork_act_and_not_a_kill():
-    """THE SAME RULE AS THE TEST ABOVE, READ BY PARAGRAPH BECAUSE PROSE WRAPS.
-
-    `test_every_fork_surface_prints_the_one_act` matches LINES, and a line is
-    the right unit in a bash file where each message is one string. It is the
-    wrong unit in a manual: `README-lanes.md`'s fork paragraph said *"none of
-    them kills anything - retiring is `kill <pid>`, typed by a person"*, and
-    the two halves of that contradiction sat on two different lines, so no
-    line-matching rule could see it and the document went on offering the one
-    act clause (k) rule (e) refuses BY NAME while the five surfaces beside it
-    had all been corrected (F-X8).
-
-    So the manual is read as PARAGRAPHS: any paragraph that speaks of a fork
-    and offers a `kill` must name `--retire`. The idle holders of a lane are a
-    different population - Amendment 6(d)'s orphans, which `lane-end --retire`
-    refuses because they are not forks - and their `kill` lines are untouched
-    here for the same reason the test above leaves them alone.
-    """
-    text = doc("docs/README-lanes.md").read_text(encoding="utf-8")
-    offenders = [" ".join(para.split())[:200]
-                 for para in re.split(r"\n\s*\n", text)
-                 if re.search(r"\bfork\b", para, re.I)
-                 and re.search(r"\bkill\b", para)
-                 and "--retire" not in para]
-    assert not offenders, (
-        "these paragraphs of the manual offer a `kill` for a fork and never "
-        f"clause (k) rule (e)'s one act:\n  " + "\n  ".join(offenders))
-    assert "lane-end <lane> --retire <pid|uuid>" in text, (
-        "the manual never spells the one fork act in full")
-
-
-def test_no_committed_file_names_a_host_absolute_path():
-    """openRepoShape #61: a suite stayed green on every machine but the one a
-    fixed path was written on, because the ONE test that read it SKIPPED when
-    it was absent. Nothing checked the path itself for being the kind of thing
-    that should never have been committed. This is that check.
-
-    Every file `git ls-files` tracks, decoded as UTF-8 - a file that fails to
-    decode is skipped rather than failed, because this test is about paths
-    written in text, not about what counts as text. The gitlink at
-    `upstream/openRepoShape` is listed as a path and is not a file, so it is
-    skipped too: what the standard's own tree carries is the standard's own
-    suite to police.
-
-    EVERY REPOSITORY THIS RUN CAN READ (#186, T009): the composed run scans the
-    assembly and the spec leg beside the code leg, which is every file the one
-    repository carried before the split. Their gitlinks are paths and not files,
-    like the one above.
-
-    THE BENCH ROOT IS A HOST PATH TOO (opensoft/openRepoTools#193, item 22):
-    `host_absolute_path_hits` reads it beside the home-directory forms, with
-    one allowance, a path inside a quoted `grep` search pattern. The tests
-    after this one hold both halves of that rule, red and green.
-    """
-    offenders = {}
-    for rel, path in tracked_files():
-        if not path.is_file():
-            continue
-        try:
-            text = path.read_bytes().decode("utf-8")
-        except UnicodeDecodeError:
-            continue
-        hits = host_absolute_path_hits(text)
-        if hits:
-            # FIVE PER FILE: a file with eighty-six findings should say so, not
-            # print them all into one assertion.
-            offenders[rel] = (hits if len(hits) <= 5
-                              else hits[:5] + [f"... and {len(hits) - 5} more"])
-    assert not offenders, (
-        f"committed file(s) name a host-absolute path: {offenders}")
-
-
-def _plant(template: str) -> str:
-    """`template` with `<root>` replaced by the bench root. The rule's own
-    constant fills it, so this file never spells the root contiguously and the
-    scan above has nothing of its own to find."""
-    return template.replace("<root>", _BENCH_ROOT)
-
-
-#: TEXT THE BENCH-ROOT RULE MUST REFUSE. Each row is (why, text).
-BENCH_PATH_REFUSED = [
-    ("a path as a command's operand",
-     "cat <root>projects/x/file"),
-    ("a path in a yaml value, the shape of the ideation sample",
-     "directory: <root>projects/openRepoTools"),
-    ("a path in prose and in a table cell",
-     "| `<root>projects/openRepoTools/handoffs` | the checkout's symlink |"),
-    ("a path as `git -C` argument, though the same line quotes a pattern",
-     "git -C <root>projects/x grep -n -e '<root>projects/y' HEAD -- ."),
-    ("a quoted path that is not a search pattern",
-     "ls '<root>projects/x'"),
-    ("a second quoted operand of grep, which is a file",
-     "grep -n 'x' '<root>projects/x/file'"),
-    ("a path after the pattern, which is the file searched",
-     "grep -n '<root>projects/x' <root>projects/y"),
-    ("a double-quoted pattern, which can hold a variable",
-     'grep -E "<root>projects/x" file'),
-    ("a flag that takes a value ends the run of flags",
-     "grep -m 1 '<root>projects/x' file"),
-    ("-f names a pattern FILE, which is a path and not a pattern",
-     "grep -f '<root>projects/pat.txt' log"),
-    ("-f under git grep names a pattern file too",
-     "git grep -f '<root>projects/pat.txt' HEAD"),
-    ("-f inside a flag bundle is still -f",
-     "grep -rf '<root>projects/pat.txt' ."),
-    ("-f ahead of an -e chain licenses nothing in it",
-     "grep -f '<root>projects/pat.txt' -e 'x' -e 'y' log"),
-    ("a path glued onto the closing quote of a pattern",
-     "grep -E 'x'<root>projects/y log"),
-    ("a quoted path piped INTO a grep is still an echoed path",
-     "echo '<root>projects/x' | grep -n 'y'"),
-    ("a grep on one line licenses nothing on the next",
-     "grep -n\n'<root>projects/x' file"),
-    ("a file:// URL names the same host path",
-     "file://<root>projects/x"),
-]
-
-#: TEXT IT MUST ACCEPT. The first five are the allowance, each in one of the
-#: shapes a recorded search takes; the rest are look-alikes that are not the
-#: bench's root at all.
-BENCH_PATH_ACCEPTED = [
-    ("grep -E with a quoted pattern",
-     "grep -E '<root>projects/x' file"),
-    ("grep -rn with an anchored pattern and a placeholder for the files",
-     "grep -rn '^path: <root>projects/openRepoTools/' $LS/openRepoTools-{1,2,3} | wc -l"),
-    ("git grep with several -e patterns and a placeholder for the checkout",
-     "git -C $WB grep -n -e '<root>projects/openRepoTools' "
-     "-e 'openRepoTools-worktrees' -e '\\.lane-worktrees' HEAD -- ."),
-    ("a later -e carries the path",
-     "grep -n -e 'a' -e '<root>projects/x' file"),
-    ("a pattern after a pipe",
-     "git show HEAD:x | grep -n '<root>projects/x'"),
-    ("a placeholder is not a path",
-     "git -C $ORT rev-parse HEAD"),
-    ("a path under the home directory, by tilde, $HOME and ${HOME}",
-     "~<root>x $HOME<root>x ${HOME}<root>x"),
-    ("a relative directory that happens to carry the root's name",
-     "templates<root>x ..<root>x .<root>x"),
-    ("the workspace record and a template directory are not the root",
-     "~/.agents/workspace.yaml and templates/workspace-root/ and workspace/"),
-]
-
-
-@pytest.mark.parametrize("why,template", BENCH_PATH_REFUSED,
-                         ids=[why for why, _ in BENCH_PATH_REFUSED])
-def test_the_bench_root_rule_is_red_on_a_planted_path(why, template):
-    """RED: a path at the bench's root is a finding wherever it stands, except
-    inside a quoted search pattern. Every row plants one in a place the
-    allowance must NOT reach, and `git -C <path> grep -e '<path>'` is the row
-    that matters most: the first path is as host-absolute as ever, and the
-    pattern beside it licenses nothing."""
-    hits = host_absolute_path_hits(_plant(template))
-    assert hits, f"the rule let this through ({why}): {_plant(template)!r}"
-
-
-@pytest.mark.parametrize("why,template", BENCH_PATH_ACCEPTED,
-                         ids=[why for why, _ in BENCH_PATH_ACCEPTED])
-def test_the_bench_root_rule_is_green_on_the_allowed_forms(why, template):
-    """GREEN: a path inside a quoted search pattern is the recorded command's
-    own text and stays; so does everything that merely resembles the root."""
-    text = _plant(template)
-    assert host_absolute_path_hits(text) == [], (
-        f"the rule refused this ({why}): {text!r}")
-
-
-def test_the_quoted_pattern_allowance_scrubs_the_pattern_and_nothing_beside_it():
-    """One line, two roots: the allowance takes the quoted pattern out of the
-    line and the other path stays a finding, reported by line number."""
-    line = _plant("git -C <root>projects/x grep -n -e '<root>projects/y' HEAD")
-    hits = host_absolute_path_hits("fine\n" + line + "\nalso fine\n")
-    assert len(hits) == 1 and hits[0].startswith("line 2: git -C "), hits
-
-
-def test_the_consumer_reads_search_lines_are_red_as_main_carried_them_and_green_fixed():
-    """The three recorded searches of `consumer-reads-2026-10-07.md` (lines 94,
-    132 and 142 on main), each as #189 landed it and as it reads once the root
-    BESIDE the pattern is a placeholder. The pattern itself is byte for byte
-    the same in both, which is the whole claim: a placeholder in it would have
-    changed what the command searched for."""
-    pairs = [
-        ("git -C <root>projects/workBenches grep -n -e '<root>projects/openRepoTools'"
-         " -e 'openRepoTools-worktrees' -e '\\.lane-worktrees' HEAD -- .",
-         "git -C $WB grep -n -e '<root>projects/openRepoTools'"
-         " -e 'openRepoTools-worktrees' -e '\\.lane-worktrees' HEAD -- ."),
-        ("git -C <root>projects/brett-wip grep -n -e '<root>projects/openRepoTools'"
-         " -e '~/projects/openRepoTools' ab88a10 -- .   # 341 lines",
-         "git -C $BW grep -n -e '<root>projects/openRepoTools'"
-         " -e '~/projects/openRepoTools' ab88a10 -- .   # 341 lines"),
-        ("grep -rn '^path: <root>projects/openRepoTools/'"
-         " <root>projects/.lane-state/openRepoTools-{1,2,3} | wc -l",
-         "grep -rn '^path: <root>projects/openRepoTools/'"
-         " $LS/openRepoTools-{1,2,3} | wc -l"),
-    ]
-    for before, after in pairs:
-        assert host_absolute_path_hits(_plant(before)), _plant(before)
-        assert host_absolute_path_hits(_plant(after)) == [], _plant(after)
-
-
-def test_the_bench_rule_leaves_the_home_directory_rule_as_it_was():
-    """The bench root is a second pattern beside the first, not an edit of it:
-    the home-directory forms are still found, and the Windows runner's own
-    account is still the one exemption."""
-    unix = "/home" + "/alice/"
-    mac = "/Users" + "/Bob/"
-    assert host_absolute_path_hits(unix + "x") == [unix]
-    assert host_absolute_path_hits(mac + "x") == [mac]
-    assert host_absolute_path_hits("C:" + "\\Users\\runneradmin\\x") == []
-
-
-def test_the_root_carries_the_line_ending_rule():
-    """`* text=auto eol=lf`, for openRepoShape's reason retold for this
-    repository: `openRepoTools --install` compares the bytes it is about to
-    place against the bytes already there with `cmp`, and its own tests compare
-    an installed copy to this checkout's file byte for byte. Git for Windows'
-    installer default is `core.autocrlf=true`; a checkout made under it turns
-    every `\\n` in the shipped bash files into `\\r\\n`, and the comparison is
-    then about line endings rather than about content. The rule normalises text
-    to LF in the object store on check-in and checks it out as LF on every
-    platform, whatever `core.autocrlf` says — so nobody has to be told a git
-    setting before cloning, and nobody who was never told is punished for it.
-
-    THE CODE ROOT'S, IN EVERY LAYOUT (#186, T009). The adoption mapping places
-    `.gitattributes` at the assembly, but git reads a submodule's attributes
-    from the submodule's own tree: the assembly's copy protects no byte of the
-    code leg. So this reads the file beside the bash files, and a code leg that
-    has none is red here until it carries its own.
-    """
-    text = (REPO / ".gitattributes").read_text(encoding="utf-8")
-    assert "* text=auto eol=lf" in text
-
-
-def test_every_shipped_bash_file_is_tracked_with_lf():
-    """The rule above, checked against the object store rather than the
-    intention. `git ls-files --eol` reports the index and working-tree endings;
-    a `crlf` in the index would mean the rule was added after the file was
-    committed under `autocrlf=true`, which is the state it exists to prevent.
-    """
-    proc = subprocess.run(["git", "ls-files", "--eol", "--", *ALL_BASH],
-                          cwd=str(REPO), capture_output=True, text=True,
-                          check=True)
-    for row in proc.stdout.splitlines():
-        assert "i/lf" in row, f"not LF in the index:\n    {row}"
-
-
-def package_modules() -> list:
-    """Every `.py` file under `src/openrepotools/`, the code root's own: the
-    modules the `openrepotools` wheel ships (opensoft/openRepoTools#228). A
-    subdirectory is searched too, so a module cannot hide one level down, and
-    an empty answer is a failure rather than a pass with nothing read."""
-    modules = sorted((REPO / "src" / "openrepotools").rglob("*.py"))
-    assert modules, "no module under src/openrepotools/: package missing"
-    return modules
-
-
-#: THE MODULES THE PACKAGE MAY IMPORT, AND WHY (FR-005, opensoft/openRepoTools
-#: #228), by top-level name. This is the allowlist, and it is explicit rather
-#: than "whatever `sys.stdlib_module_names` holds": it admits exactly what the
-#: entry module needs, which design.md Decision 3 spells out — `cli.main()` is
-#: `os.execvp("bash", ["bash", <payload>/openRepoTools, *sys.argv[1:]])`, with
-#: SIGPIPE and SIGXFSZ set back to `SIG_DFL` first (the lead's amendment of
-#: 2026-10-18), and, on `FileNotFoundError` or `NotADirectoryError`, a refusal
-#: on stderr and exit 2. `__init__.py` holds a docstring and `_release.py` the
-#: five stamp lines, so neither imports anything. Nothing else is here on
-#: purpose: `pathlib`, `subprocess`, `importlib` and the package's own name
-#: are all absent, because the entry module reads no stamp, runs no child and
-#: passes bash nothing but the person's arguments; `__future__` is absent
-#: because nothing in Decision 3's module needs an annotation postponed on
-#: Python 3.9. A module that needs another name takes an edit here, with its
-#: reason beside it.
-PACKAGE_IMPORT_ALLOWLIST = {
-    "os": ("os.execvp replaces the process with the first bash on PATH, so "
-           "signals, the EXIT trap and the exit status pass through; the "
-           "payload directory beside the module's own file is found from "
-           "its __file__ with os.path"),
-    "signal": ("Python starts with SIGPIPE and SIGXFSZ ignored, an exec keeps "
-               "an ignored disposition, and a non-interactive bash cannot "
-               "reset one ignored on entry, so signal.signal sets both back "
-               "to SIG_DFL just before the exec, as subprocess's "
-               "restore_signals does (design.md Decision 3, amended "
-               "2026-10-18; FR-003)"),
-    "sys": ("sys.argv[1:] is the person's arguments, passed on unchanged; "
-            "sys.stderr carries the no-bash refusal that precedes its "
-            "exit 2"),
-}
-
-
-def test_the_package_imports_only_the_standard_library():
-    """FR-005: the `openrepotools` wheel declares `dependencies = []`, so a
-    module under `src/openrepotools/` that imports a third-party name is a
-    console script that dies with `ModuleNotFoundError` on a clean pipx
-    install, before anything of ours can say why.
-
-    The rule is the allowlist above, held to the syntax tree: every `import`
-    and `from … import` at ANY depth of every module (`ast.walk`, so one inside
-    a function or a `try` counts), by the top-level name, with a relative
-    import refused as a name of its own. `__import__()` is refused too, since
-    it names a module the tree walk would never see. Where this Python has
-    `sys.stdlib_module_names` (3.10 and up), the allowlist itself must be
-    standard-library names, so nobody makes the rule pass by adding `yaml` to
-    it. On 3.9, which the package supports and has no such set, that one check
-    is not made and NOTHING SKIPS: the explicit allowlist alone decides.
-    """
-    stdlib = getattr(sys, "stdlib_module_names", None)
-    if stdlib is not None:
-        outside = sorted(set(PACKAGE_IMPORT_ALLOWLIST) - set(stdlib))
-        assert not outside, (
-            "PACKAGE_IMPORT_ALLOWLIST holds names that are not in the "
-            "standard library of this Python (sys.stdlib_module_names): "
-            + ", ".join(outside))
-    problems = []
-    for path in package_modules():
-        label = path.relative_to(REPO).as_posix()
-        tree = ast.parse(path.read_text(encoding="utf-8"), filename=label)
-        for node in ast.walk(tree):
-            names = []
-            if isinstance(node, ast.Import):
-                names = [alias.name for alias in node.names]
-            elif isinstance(node, ast.ImportFrom):
-                names = ["." * node.level + (node.module or "")]
-            elif (isinstance(node, ast.Call)
-                  and isinstance(node.func, ast.Name)
-                  and node.func.id == "__import__"):
-                problems.append(
-                    f"{label}:{node.lineno}: __import__() loads a module by "
-                    "a name this rule cannot read; write an import")
-            for name in names:
-                top = name.split(".")[0]
-                if top not in PACKAGE_IMPORT_ALLOWLIST:
-                    note = " (a relative import)" if top == "" else ""
-                    problems.append(
-                        f"{label}:{node.lineno}: imports {name!r}{note}, "
-                        "which is not on PACKAGE_IMPORT_ALLOWLIST (allowed: "
-                        + ", ".join(sorted(PACKAGE_IMPORT_ALLOWLIST)) + ")")
-    assert not problems, (
-        "the package's modules may import only the standard library "
-        "(FR-005, dependencies = []):\n    " + "\n    ".join(problems))
-
-
-def test_the_python_files_compile():
-    """The suite is the Python here, bar two shipped commands and the package's
-    modules named below, and a file that does not parse is a file that fails as
-    a collection ERROR rather than as a test — which reads as the suite being
-    broken instead of as one file being wrong.
-
-    `compile()` rather than `py_compile`: nothing is written anywhere, so this
-    runs in a read-only checkout and leaves no `__pycache__` behind.
-
-    opensoft/openRepoTools#160: `lanes-index` is a shipped command that is
-    Python, and it has no `.py` suffix for the glob below to find, so its
-    text is compiled the same way — a syntax error there is a command that
-    fails on every workstation's first sync. opensoft/openRepoTools#162 put
-    `lane-worktrees` beside it, for the same reason.
-
-    opensoft/openRepoTools#228: `src/openrepotools/*.py` is the `openrepotools`
-    package, which the wheel ships and whose console script runs on every
-    pipx install, so a syntax error in one of its modules is a command that
-    fails on every workstation the release reaches. `package_modules()` is the
-    set the standard-library rule above reads, so the two cover the same files.
-    """
-    for path in sorted((REPO / "tests").glob("*.py")):
-        compile(path.read_text(encoding="utf-8"), str(path), "exec")
-    for path in package_modules():
-        compile(path.read_text(encoding="utf-8"), str(path), "exec")
-    for name in ("lanes-index", "lane-worktrees"):
-        command = REPO / name
-        compile(command.read_text(encoding="utf-8"), str(command), "exec")
-
-
-# --- the macOS job RUNS this bash, it does not only parse it (R-A9-11) ------
-
-#: Which options of which utility take a SEPARATE argument. Everything after
-#: the first token that is neither an option nor an option's argument is an
-#: OPERAND, and an operand is where BSD's `getopt` stops looking for options.
-_OPTIONS_WITH_ARGUMENTS = {
-    "sed": {"-e", "-f", "-i", "-l"},
-    "grep": {"-e", "-f", "-m", "-A", "-B", "-C", "--include", "--exclude"},
-    "awk": {"-v", "-f"},
-}
-
-
-#: THE TOKENS THAT END ONE COMMAND ON A LINE AND BEGIN THE NEXT, as
-#: `_shell_tokens` hands them back: each is a token of its own, cut out of
-#: the line only where the shell reads it as syntax, and never out of a
-#: quoted run.
-_COMMAND_SEPARATORS = frozenset({"|", ";", "&", "(", ")", "$(", "`"})
-
-
-def _shell_tokens(text: str, opened: str = "") -> tuple[list[str], bool]:
-    """Split one line of shell into tokens, keeping a quoted run together and
-    handing every command separator back as a token of its own. Returns the
-    tokens, and whether the line ENDS inside a quoted run.
-
-    Deliberately small: it expands nothing and does not care what a token
-    MEANS. All it has to answer is "is this token exactly `--`, did an operand
-    come before it, and was that in the same command".
-
-    `opened` starts the line inside a quoted run of that kind, `'` or `"`: the
-    second reading `_commands_on` gives a line that may close a quote an
-    earlier line opened.
-
-    THE LINE IS TOKENIZED BEFORE IT IS CUT, AND NOT THE OTHER WAY ROUND
-    (opensoft/openRepoTools#54). The cut used to be a bare regular-expression
-    split of the raw text at every `|`, `;`, `&`, `(`, `)`, `$(` and backtick,
-    and a pattern is text. `grep -v 'not fetching; reading origin/' -- "$f"`
-    came apart at the `;` inside its own quotes, neither half held both the
-    operand and the `--` after it, and the check called a real BSD failure
-    clean — in a shipped command, the same line #53 had just fixed in a skill.
-    A quoted message that happened to hold `; grep x -- y` was the same cut
-    the other way: a finding in a string nothing runs.
-
-    So a separator is one only OUTSIDE a quoted run, and only where the shell
-    reads it as one: `|`, `;`, `&`, `(` and `)` outside every quote, and the
-    two that open a nested command, `$(` and a backtick, inside a
-    double-quoted run as well — `out="$(sed -n 'p' -- "$f")"` is a command
-    inside an assignment, and its quotes start afresh, so the `$(` and the
-    `)` that closes it are tracked to know where the outer double quote
-    resumes. A single-quoted run holds no syntax at all, and a backslash makes
-    the next character plain text either way.
-    """
-    tokens: list[str] = []
-    current: list[str] = []
-    started = False
-    # What encloses the character being read, innermost last: "'" or '"' for a
-    # quoted run, "$(", "(" or "`" for a command nested inside the line.
-    stack: list[str] = [opened] if opened else []
-
-    def end_token() -> None:
-        nonlocal current, started
-        if started:
-            tokens.append("".join(current))
-        current, started = [], False
-
-    index = 0
-    while index < len(text):
-        ch = text[index]
-        inside = stack[-1] if stack else ""
-        step = 1
-        if inside == "'":
-            current.append(ch)
-            if ch == "'":
-                stack.pop()
-        elif ch == "\\":
-            current.append(text[index:index + 2])
-            started, step = True, 2
-        elif inside == '"' and ch == '"':
-            current.append(ch)
-            stack.pop()
-        elif ch == "`" and inside == "`":
-            end_token()
-            tokens.append(ch)
-            stack.pop()
-        elif ch == "`" or text.startswith("$(", index):
-            opener = "`" if ch == "`" else "$("
-            end_token()
-            tokens.append(opener)
-            stack.append(opener)
-            step = len(opener)
-        elif inside == '"':
-            current.append(ch)
-        elif ch in "'\"":
-            stack.append(ch)
-            current.append(ch)
-            started = True
-        elif ch.isspace():
-            end_token()
-        elif ch == "(":
-            end_token()
-            tokens.append(ch)
-            stack.append(ch)
-        elif ch == ")":
-            end_token()
-            tokens.append(ch)
-            if inside in ("$(", "("):
-                stack.pop()
-        elif ch in "|;&":
-            end_token()
-            tokens.append(ch)
-        else:
-            started = True
-            current.append(ch)
-        index += step
-    end_token()
-    return tokens, bool(stack) and stack[-1] in ("'", '"')
-
-
-def _commands_on(line: str) -> list[list[str]]:
-    """The tokens of `line`, cut into one list per command at every separator
-    token — so a quoted pattern stays whole in the command that passes it.
-
-    A QUOTE CAN SPAN LINES, AND THIS READS ONE LINE AT A TIME. A line that
-    ends inside a quoted run is the first line of such a quote or its last,
-    and the line alone cannot say which. Read from outside every quote, a LAST
-    line's closing quote opens one instead, and the command after it goes into
-    a single token — `}' | LC_ALL=C sort | awk -v s="$US" '{ … }')"`, the
-    tail of a multi-line awk program in `lanes-edit.sh`, would lose its second
-    `awk` that way. So such a line is read again from inside a single-quoted
-    run and from inside a double-quoted one, and the commands of every reading
-    are checked; a line that closes every quote it opens is read once.
-    """
-    def cut(tokens: list[str]) -> list[list[str]]:
-        commands: list[list[str]] = [[]]
-        for token in tokens:
-            if token in _COMMAND_SEPARATORS:
-                commands.append([])
-            else:
-                commands[-1].append(token)
-        return commands
-
-    tokens, ends_quoted = _shell_tokens(line)
-    commands = cut(tokens)
-    if ends_quoted:
-        for quote in ("'", '"'):
-            commands += [command
-                         for command in cut(_shell_tokens(line, quote)[0])
-                         if command not in commands]
-    return commands
-
-
-def _end_of_options_after_an_operand(text: str) -> list[str]:
-    """Every `sed`/`grep`/`awk` call in `text` that passes `--` too late.
-
-    THE BUG THIS IS ABOUT. GNU's `getopt` PERMUTES: it finds options wherever
-    they appear, so `sed -n 'script' -- "$file"` reads `--` as end-of-options
-    and `$file` as the one file. BSD's stops at the first operand — the script
-    — so `--` is left as a FILENAME and macOS answers
-    `sed: --: No such file or directory`, exit 1. The same goes for
-    `grep 'pattern' -- "$f"` and `awk 'program' -- "$f"`.
-
-    `sed -n -e 'script' "$file"` has no operand before the file list at all,
-    which is why that is the shape this repository uses. The protection `--`
-    was there for — a filename that begins with `-` — is kept by every call
-    that still spells it before the operand, which is what the file list of
-    `rm -f -- "$x"` and `grep -v -x -F -- "$pattern"` are.
-    """
-    bad = []
-    for line in text.splitlines():
-        if line.lstrip().startswith("#"):
-            continue
-        for tokens in _commands_on(line):
-            for start, token in enumerate(tokens):
-                tool = token.rsplit("/", 1)[-1]
-                if tool not in _OPTIONS_WITH_ARGUMENTS:
-                    continue
-                takes_argument = _OPTIONS_WITH_ARGUMENTS[tool]
-                seen_operand = False
-                index = start + 1
-                while index < len(tokens):
-                    argument = tokens[index]
-                    if argument == "--":
-                        if seen_operand:
-                            bad.append(f"{tool}: {line.strip()}")
-                        break
-                    if not seen_operand and argument.startswith("-") and argument != "-":
-                        if argument in takes_argument:
-                            index += 1
-                    else:
-                        seen_operand = True
-                    index += 1
-                break
-    return bad
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_no_shipped_bash_ends_its_options_after_an_operand(name):
-    """THE macOS JOB IS A RUN GATE AND NOT ONLY A PARSE GATE (A9 Addendum 4,
-    R-A9-11, ratified 2026-09-13 after F4 of the #24 review).
-
-    Act 3's obligation 4 bought `/bin/bash -n` on every bash file this
-    repository ships, and obligation 6 made the same job RUN 196 KB of bash
-    that had only ever run on Linux. It went 507 passed / 447 failed, and the
-    first of the two causes named in that job's own log was seventeen calls of
-    this one shape. `bash -n` cannot see it: the grammar is fine, and the
-    utility is not bash.
-
-    So it is held here, where it costs nothing and runs in EVERY job —
-    `tests-windows` included, which skips every bash claim and can still read a
-    file.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    bad = _end_of_options_after_an_operand(text)
-    assert not bad, (
-        f"{name} passes `--` AFTER an operand, which BSD's `getopt` reads as a "
-        f"FILENAME (macOS: `sed: --: No such file or directory`). Put the "
-        f"script behind `-e` instead:\n  " + "\n  ".join(bad))
-
-
-#: LINES THE END-OF-OPTIONS RULE MUST REFUSE, each with a separator inside a
-#: quoted run (opensoft/openRepoTools#54). The cut over the raw text took
-#: every one of them apart at that separator and called it clean. Each row is
-#: (why, line).
-LATE_END_OF_OPTIONS_REFUSED = [
-    ("#54's own line, a semicolon inside the pattern",
-     "grep -v 'not fetching; reading origin/' -- \"$local_err_file\" >&2 || :"),
-    ("a pipe inside an alternation",
-     "grep -E 'PARKED|RESUMED' -- \"$log\""),
-    ("an ampersand inside a sed replacement",
-     "sed -n 's/^lane: /[&]/p' -- \"$file\""),
-    ("parentheses inside a double-quoted pattern",
-     'grep -n "^cut_to_line()" -- "$f"'),
-    ("a semicolon inside an awk program",
-     "awk '{ n++; print n }' -- \"$f\""),
-    ("a backtick inside a single-quoted pattern",
-     "grep -F 'run `lane`' -- \"$f\""),
-    ("a nested command inside double quotes, its pattern quoted afresh",
-     "out=\"$(grep 'a;b' -- \"$f\")\""),
-    ("the last line of a multi-line awk program, then a second call",
-     "}' | LC_ALL=C sort | awk '{ print; }' -- \"$f\")\""),
-]
-
-#: LINES IT MUST ACCEPT: a separator inside a quoted run that the raw cut
-#: turned into a call nothing makes. Each row is (why, line).
-LATE_END_OF_OPTIONS_ACCEPTED = [
-    ("a message that quotes the shape, after a semicolon",
-     "note \"the stderr filter is gone; grep 'pattern' -- file was its shape\""),
-    ("a single-quoted command line, after a double ampersand",
-     "printf '%s\\n' 'cd \"$dir\" && grep pattern -- file'"),
-    ("a single-quoted usage line, after a pipe",
-     "usage='lanes | grep \"x\" -- file'"),
-    ("parentheses inside a double-quoted message",
-     "echo \"(sed 's/x/y/' -- f)\""),
-    ("backticks inside a single-quoted message",
-     "printf '%s\\n' 'run `sed s/a/b/ -- f` by hand'"),
-    ("a correct call whose -e pattern holds a semicolon and a call",
-     "grep -v -e 'x; sed s/a/b/ -- y' -- \"$f\""),
-]
-
-
-@pytest.mark.parametrize("why,line", LATE_END_OF_OPTIONS_REFUSED,
-                         ids=[why for why, _ in LATE_END_OF_OPTIONS_REFUSED])
-def test_the_end_of_options_rule_sees_a_call_whose_quotes_hold_a_separator(
-        why, line):
-    """RED: a quoted pattern, program or nested command keeps its separators
-    to itself (opensoft/openRepoTools#54). `lanes` shipped the first row's
-    line while this rule called it clean — the `;` inside the pattern cut the
-    call in two before the tokenizer saw its `--` — so every row here is one
-    the raw-text cut let through, and the line is tokenized before it is cut.
-    """
-    assert _end_of_options_after_an_operand(line), (
-        f"the rule let this through ({why}): {line!r}")
-
-
-@pytest.mark.parametrize("why,line", LATE_END_OF_OPTIONS_ACCEPTED,
-                         ids=[why for why, _ in LATE_END_OF_OPTIONS_ACCEPTED])
-def test_the_end_of_options_rule_finds_no_call_inside_a_quoted_string(
-        why, line):
-    """GREEN: text inside quotes is a string, not a command, whatever
-    separators it holds. The raw-text cut began a new command at each of them,
-    so the words after one read as a call with its `--` too late — a finding
-    in a line nothing runs, which teaches a reader to stop trusting the rule.
-    """
-    assert _end_of_options_after_an_operand(line) == [], (
-        f"the rule refused this ({why}): {line!r}")
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_no_shipped_bash_leaves_a_variable_name_to_bash_3_2s_locale(name):
-    """`bash -n` PARSES THIS AND macOS DIES ON IT (A9 Addendum 4, R-A9-11).
-
-    Bash decides where a variable NAME ends with `isalnum()`, which is
-    LOCALE-DEPENDENT. Under the `en_US.UTF-8` the macOS runner sets, bash 3.2
-    on Darwin reads the bytes of `\u2026`, `\u2014` and `\u00b7` as name characters, so
-    `"\u2026$excerpt\u2026"` is a reference to a variable called `excerpt\u2026` \u2014 unset,
-    and under `set -u` the script DIES. It cost `lane-end` the whole refusal
-    branch its `--force` message lives in: exit 0 where the estate expects
-    exit 2, and `lane-end: line 573: excerpt\u2026: unbound variable` on stderr.
-
-    This estate writes every message with those three characters in it, so the
-    rule is held for all of them rather than for the one that was found.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    bad = []
-    for number, line in enumerate(text.splitlines(), 1):
-        if line.lstrip().startswith("#"):
-            continue
-        for hit in re.finditer(r"\$[A-Za-z_][A-Za-z0-9_]*", line):
-            rest = line[hit.end():hit.end() + 1]
-            if rest and ord(rest) > 127:
-                bad.append(f"{number}: {line.strip()}")
-                break
-    assert not bad, (
-        f"{name} ends an UNBRACED `$name` against a non-ASCII character. Bash "
-        f"3.2 on macOS reads that character as part of the name and the "
-        f"lookup fails under `set -u`. Write `${{name}}`:\n  "
-        + "\n  ".join(bad))
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_no_shipped_bash_quotes_the_replacement_half_of_a_substitution(name):
-    """BASH 3.2 KEEPS THOSE QUOTES AS CHARACTERS (A9 Addendum 4, R-A9-11).
-
-    In `${var/pattern/replacement}`, bash 4.3 and later read quotes as "this
-    half is a literal, not a pattern". Bash 3.2 removes them from the PATTERN
-    half and KEEPS THEM IN THE REPLACEMENT, so `${row/"$old"/"$new"}` wrote
-    `"<new>"` \u2014 with the quote marks \u2014 into the register on macOS, and nothing
-    went red for it: the write succeeded, the commit landed, the row was
-    quietly wrong. `lane-end --retire` produced `| "RETIRED 2026-09-13T\u2026" \u00b7 \u2026`
-    where every reader of that column expects `| RETIRED 2026-\u2026`.
-
-    Take the replacement out of the pattern machinery instead \u2014 `%%` for the
-    prefix and `#` for the tail, then concatenate.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    bad = [line.strip() for line in text.splitlines()
-           if not line.lstrip().startswith("#")
-           and re.search(r"\$\{[A-Za-z_][A-Za-z0-9_]*(?:\[[^]]*\])?/[^}]*/[^}]*\"",
-                         line)]
-    assert not bad, (
-        f"{name} quotes the replacement half of a `${{var/pat/rep}}`; bash 3.2 "
-        f"writes those quote marks out as text. Build the string from "
-        f"`${{var%%\"$pat\"*}}` and `${{var#*\"$pat\"}}` instead:\n  "
-        + "\n  ".join(bad))
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_no_shipped_bash_opens_a_case_inside_a_command_substitution(name):
-    """A `)` THAT CLOSES A `case` PATTERN CLOSES THE SUBSTITUTION TOO (A9
-    Addendum 4, R-A9-11).
-
-    Bash 3.2 - the bash the macOS job parses these files with - reads the `)`
-    that ends a case PATTERN as the one that ends the enclosing `$( )`. So
-    `$(case "$x" in a) printf yes ;; *) printf no ;; esac)` is a SYNTAX ERROR
-    there and nowhere else, and what the caller gets back is a fragment of the
-    script's own source. The job answered `command substitution: line 3284:
-    syntax error near unexpected token 'newline'` at `dcf1027`; two more of the
-    shape were written into this amendment's own suite afterwards, and at
-    `708395e` `tests-macos` compared ` printf 'resumed Y' ;; *) printf 'did
-    not' ;; esac)` against `did not` - twice, and green on every GNU runner.
-
-    A `bash -n` ON A GNU RUNNER PARSES IT, which is why this is a text rule
-    rather than a parse gate: every file in `ALL_BASH` already passes `bash -n`
-    under the Linux bash CI runs, and bash 3.2 is the only place the defect
-    exists. The fix is one line each time - hoist the `case` above the
-    assertion and read the variable it sets - so the rule is held for every
-    bash file this repository ships rather than for the two that were found.
-
-    Only the same-line form is matched. A `case` inside a multi-line `$(` ...
-    `)` is the same defect and wants the same hoist, but a line-level regex is
-    what the three rules beside this one are, and a paren-counting scanner that
-    misread one quoted `)` would refuse a file for nothing.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    bad = [f"{number}: {line.strip()}"
-           for number, line in enumerate(text.splitlines(), 1)
-           if not line.lstrip().startswith("#")
-           and re.search(r"\$\([^()]*\bcase\b", line)]
-    assert not bad, (
-        f"{name} opens a `case` inside a `$( )`; bash 3.2 ends the "
-        f"substitution at the first pattern's `)` and hands the caller a piece "
-        f"of the script's own source. Hoist the `case` onto its own line and "
-        f"read the variable it sets:\n  " + "\n  ".join(bad))
-
-
-@pytest.mark.parametrize("name", ALL_BASH)
-def test_no_shipped_bash_reaches_for_gnu_only_utilities_unaccompanied(name):
-    """THE SECOND CAUSE IN THAT JOB'S LOG, AND THE FOUR BESIDE IT.
-
-    `date -d`, `stat -c`, `xargs -r`, `sort -z`, `sha256sum` and BRE `\\|` are
-    GNU; macOS answers the first with `illegal option -- d`, does not ship
-    `sha256sum` on a stock install, and reads `\\|` as two literal characters —
-    which is the worst of the five, because it is not an error at all, it is a
-    pattern that quietly matches nothing.
-
-    None of them is forbidden. GNU is what every lane workstation runs, and
-    this is not a rule about writing to the lowest common denominator: it is a
-    rule that the BSD spelling must be within reach of the GNU one, beside the
-    thing it falls back from rather than in a comment somewhere else.
-    """
-    text = (REPO / name).read_text(encoding="utf-8")
-    lines = [line for line in text.splitlines()
-             if not line.lstrip().startswith("#")]
-    # BSD spells reading a stamp `date -u -j -f <format> <stamp>` and spells
-    # arithmetic `date -u -v-5H`; either answers a `date -d`, and a `-d` with
-    # neither within ten lines is a GNU-only call.
-    for index, line in enumerate(lines):
-        if not re.search(r"\bdate\b[^\n|]*\s-d\b", line):
-            continue
-        window = "\n".join(lines[max(0, index - 10):index + 7])
-        assert re.search(r"\bdate\b[^\n|]*\s-j\b", window) or "-v" in window, (
-            f"{name} reads a stamp with GNU `date -d` and carries no BSD "
-            f"spelling within ten lines of it (`date -u -j -f <format>` reads "
-            f"one, `date -u -v-5H` is the arithmetic):\n  {line.strip()}")
-    for line in lines:
-        if re.search(r"\bstat\b[^\n|]*\s-c\b", line):
-            assert re.search(r"\bstat\b[^\n|]*\s-f\b", line), (
-                f"{name} uses GNU `stat -c` with no `stat -f` beside it on the "
-                f"same line:\n  {line.strip()}")
-        assert not re.search(r"\bcmp\b[^\n|]*\s-n\b", line), (
-            f"{name} passes GNU `cmp -n <limit>`; BSD `cmp`'s trailing numbers "
-            f"are SKIPS, not a limit, so macOS answers `illegal option -- n` "
-            f"and exits 2 \u2014 which turns a PROOF into a refusal of a write that "
-            f"was correct. Build what the file must now be and compare that: "
-            f"`{{ cat -- old; printf ...; }} | cmp -s -- file -`. Not "
-            f"`head -c <n>` either: BSD `head` rejects a count of 0:"
-            f"\n  {line.strip()}")
-        assert not re.search(r"\bwc\b\s+-[lcwm]", line) or "tr -d ' '" in line, (
-            f"{name} reads a count out of `wc` and does not strip the spaces "
-            f"BSD `wc` pads it with. `wc -l < f` answers `\"       5\"` on macOS "
-            f"and `\"5\"` under GNU, so the moment that value meets anything "
-            f"unpadded \u2014 an arithmetic `$((n + 1))`, a literal, a count from "
-            f"anywhere else \u2014 a `[ x = y ]` between them is FALSE on one "
-            f"platform and true on the other. That is exactly how "
-            f"`append_text_line` came to refuse every append it had already "
-            f"made on the macOS job, and to say `append changed line count by "
-            f"1` while doing it. Spell it `| tr -d ' '`, as `park:564` and "
-            f"`status:746` always have:\n  {line.strip()}")
-        assert not re.search(r"\bxargs\b[^\n|]*\s-r\b", line), (
-            f"{name} passes GNU `xargs -r`, which BSD `xargs` does not "
-            f"take:\n  {line.strip()}")
-        assert not re.search(r"\bsort\b[^\n|]*\s-z\b", line), (
-            f"{name} passes GNU `sort -z`; sorting the lines a digest prints "
-            f"is as deterministic and needs no NUL:\n  {line.strip()}")
-        assert not (re.search(r"\b(sed|grep)\b", line) and "\\|" in line), (
-            f"{name} spells alternation `\\|`, which is a GNU extension to "
-            f"BRE: BSD `grep` and `sed` match it literally and report no "
-            f"error. Use a second `-e`, or `-E`:\n  {line.strip()}")
-    if "sha256sum" in "\n".join(lines):
-        assert "shasum" in "\n".join(lines), (
-            f"{name} names `sha256sum`, which a stock macOS does not ship, and "
-            f"never names `shasum -a 256`")
-
-
-
-def test_the_rule_6_register_scan_takes_its_alias_table_from_the_environment():
-    """`awk -v` CARRIES ONE LINE (A9 Addendum 4, R-A9-11, round 5).
-
-    POSIX says a `-v assignment` value is processed as if it were a STRING
-    LITERAL, and a string literal cannot span lines. macOS's awk \u2014 one-true-awk,
-    `awk version 20200816` on the runner \u2014 enforces exactly that and refuses one
-    outright: `awk: newline in string \u2026 at source line 1`, exit 2, nothing on
-    stdout. gawk and mawk accept it without a word, which is what made this the
-    last macOS group standing after four rounds and the only one no Linux run
-    of the suite could see.
-
-    `who_landing` handed `awk -v aliases=` the whole `repos.tsv` alias table,
-    one `<alias>\\037<owner/repo>` per line. So on that platform the REGISTER
-    half of `who --landing` produced nothing at all and every open LANDING in
-    the estate read as `none open` \u2014 fourteen red assertions on that job, and
-    off CI a workstation running macOS that cannot see the estate's merge holds
-    while reporting, in words, that there are none.
-
-    Pinned rather than held as a shape. The shape rule \u2014 "a shell FUNCTION's
-    output is a stream, so it does not go into a `-v`" \u2014 was written first and
-    is wrong about this file: `lc`, `short_ws` and `object_slug` are functions
-    too, and each transforms ONE value, so it reddened three call sites that
-    are correct. A hygiene test with three carve-outs teaches the wrong rule.
-    The general claim is held where it can be held honestly \u2014
-    `tests/test_lane_helpers.sh` runs `who --landing` under a proxy that
-    refuses a many-line `-v` exactly as that awk does \u2014 and this pins the one
-    line that proxy exists for, in a test that also runs on Windows.
-    """
-    text = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    assert 'na = split(ENVIRON["LANES_RULE6_ALIASES"], ar, "\\n")' in text, (
-        "RULE6_AWK must read the alias table out of the environment; "
-        "`ENVIRON` is POSIX awk and takes a value with newlines in it")
-    assert ('wd_rows="$(register_text | LANES_RULE6_ALIASES="$wd_aliases" '
-            'awk "$RULE6_AWK")"') in text, (
-        "the Rule 6 register scan must put the alias table in the environment "
-        "of that one awk, not in a `-v`")
-    assert "-v aliases=" not in text, (
-        "the alias table is many lines and `awk -v` carries one: macOS's awk "
-        "answers `newline in string ... at source line 1` and exits 2, and "
-        "`who --landing` then reports every merge hold in the estate as "
-        "`none open`")
-
-
-def test_the_suite_wrapper_takes_one_lock_and_names_it_where_agents_read_it():
-    """ONE SUITE AT A TIME WHERE LANES SHARE A WORKSTATION, and the lock has to
-    be the SAME lock in every lane or there is no lock at all
-    (opensoft/openRepoTools#51, measured 2026-09-14T20:4xZ on Eagle).
-
-    Four `python3 -m pytest tests -q` runs were live at once in four worktrees,
-    every one of them past a guard that had been copied into four briefs:
-
-        while pgrep -af 'python3 -m pytest' | grep -v pgrep >/dev/null; do sleep 20; done
-
-    It never waited. Under the harness `grep` is a shell FUNCTION, and its
-    status with stdout on `/dev/null` is 1 even where it matched — the same
-    pipeline captured into a variable returned 0 and six lines. The collision
-    is not a shared path (the suite redirects `$HOME` and `$TMPDIR`); it is
-    TIME: a suite that takes 18 minutes alone takes far longer four-wide and
-    trips every wrapper's timeout around it.
-
-    So the guard is written once, in `tests/run.sh`, and three things about it
-    are held here rather than trusted, because each has already been got wrong:
-
-      * THE LOCK PATH IS THE ESTATE'S, spelled the same in the wrapper and in
-        `AGENTS.md`. A lane that locks a different file locks nothing.
-      * THE PATTERN IS ANCHORED AND SPLIT, so it counts real runs and cannot
-        match the guard's own command line.
-      * `AGENTS.md` NAMES THE WRAPPER as the way to run the suite, because a
-        document that only shows `python3 -m pytest` is the document all four
-        of those runs were following.
-    """
-    wrapper = REPO / "tests" / "run.sh"
-    assert wrapper.is_file(), "tests/run.sh is the way this suite is run"
-    text = wrapper.read_text(encoding="utf-8")
-    lock = '${TMPDIR:-/tmp}/openrepotools-pytest.lock'
-    assert lock in text, f"the wrapper must take {lock}"
-
-    assert "'^python3 -m pyt'" in text, (
-        "the pgrep pattern must be anchored and split so it cannot match its "
-        "own command line")
-    # THE BROKEN FORM MAY BE QUOTED AND MUST NOT BE RUN. It is in the
-    # wrapper's own head as the defect being corrected, which is worth
-    # keeping: an assistant that has met the working guard still meets the
-    # old one in older briefs. So the rule is asked of the CODE lines only.
-    code = [ln for ln in text.splitlines()
-            if ln.strip() and not ln.lstrip().startswith("#")]
-    assert not any("| grep -v pgrep" in ln for ln in code), (
-        "that guard never waits where `grep` is a shell function whose status "
-        "is 1 with stdout on /dev/null — which is the harness every lane runs in")
-
-    assert "flock" in text and "mkdir " in text, (
-        "macOS ships no `flock`, so the wrapper needs the `mkdir` lock as its "
-        "fallback — that platform is the one the fallback exists for")
-    assert "python3 -m pytest tests -q" in text
-
-    # AND THEN WHERE AGENTS READ IT — AGENTS.md is the assembly root's in the
-    # triad (#186, T009), so the wrapper's own half is asserted above first.
-    agents = doc("AGENTS.md").read_text(encoding="utf-8")
-    assert lock in agents, (
-        f"AGENTS.md must name {lock}: every lane on one workstation locks the "
-        "same file or there is no lock")
-    assert "tests/run.sh" in agents, (
-        "AGENTS.md must name tests/run.sh as the way to run the suite")
-    # THE BY-HAND FORM LEAVES NOTHING EITHER (#170 E9): the one line a person
-    # with no checkout runs relocates bytecode and turns pytest's cache off, as
-    # the wrapper does, or it lands `__pycache__` and `.pytest_cache` beside
-    # the code the wrapper keeps clean.
-    by_hand = [ln for ln in agents.splitlines() if lock in ln and "python3 -m pytest" in ln]
-    assert by_hand and all("-p no:cacheprovider" in ln and "PYTHONPYCACHEPREFIX=" in ln
-                           for ln in by_hand), by_hand
diff --git a/tests/test_run_wrapper.py b/tests/test_run_wrapper.py
deleted file mode 100644
index 6c96226d..00000000
--- a/tests/test_run_wrapper.py
+++ /dev/null
@@ -1,482 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`tests/run.sh` leaves nothing beside the code (opensoft/openRepoTools#162).
-
-The wrapper's lock is `test_repo_hygiene.py`'s to pin; what is held here is
-what #162 added around it:
-
-  * bytecode goes to `${XDG_CACHE_HOME:-$HOME/.cache}/openRepoTools/pycache`
-    and pytest's cache is off, so no `__pycache__` or `.pytest_cache` lands in
-    a worktree;
-  * every temporary directory of a run is under ONE run root,
-    `${XDG_STATE_HOME:-$HOME/.local/state}/openRepoTools/tmp/<UTC>-<pid>/`,
-    and the run root is gone when the run ends - however it ends: a pass, a
-    failure, a TERM or an INT in the middle of the suite;
-  * the lock stays where every lane names it, computed BEFORE `TMPDIR` moves;
-  * the `mkdir` lock (macOS has no `flock`) is released the same way;
-  * the repository's virtual environment is used when it has pytest, with the
-    command line still reading `python3 -m pytest`.
-
-And what #72 asked of the `mkdir` lock itself: a run that cannot record its
-pid in the lock does not start, and a run's exit removes the lock only while
-that pid is still the one inside.
-
-THE SUITE ITSELF IS A STUB. A fake `python3` records how it was called and
-sleeps or exits on cue, and a fake `pgrep` reports no other run - the real one
-would see THIS suite's own `python3 -m pytest` and wait for ever.
-"""
-
-from __future__ import annotations
-
-import os
-import shlex
-import shutil
-import signal
-import subprocess
-import sys
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(shutil.which("bash") is None,
-                                               reason="the wrapper is bash")]
-
-WRAPPER = REPO / "tests" / "run.sh"
-
-FAKE_SUITE = """#!/bin/sh
-# Records its own argv, the two environment values the wrapper sets, its pid
-# and where it was found, then sleeps or exits on cue.
-{
-  printf 'argv0 %s\\n' "$0"
-  for a in "$@"; do printf 'arg %s\\n' "$a"; done
-  printf 'TMPDIR %s\\n' "$TMPDIR"
-  printf 'PYTHONPYCACHEPREFIX %s\\n' "$PYTHONPYCACHEPREFIX"
-  printf 'pid %s\\n' "$$"
-} > "$FAKE_SUITE_LOG"
-: > "$TMPDIR/the-suite-wrote-here"
-if [ -n "${FAKE_SUITE_READ:-}" ]; then
-  # A DEBUGGER'S PROMPT: it reads the terminal, as `--pdb` would.
-  printf 'prompt>\n'
-  read -r line
-  printf 'got: %s\n' "$line"
-  exit 0
-fi
-if [ -n "${FAKE_SUITE_IGNORE_TERM:-}" ]; then
-  # A LEADER THAT IGNORES TERM (#170 item 3), and children that inherit it.
-  trap '' TERM
-  : > "$FAKE_SUITE_LOG.started"
-  while :; do sleep 1; done
-fi
-if [ -n "${FAKE_SUITE_LEAVE:-}" ]; then
-  # A CHILD LEFT RUNNING when the suite returns (#170 G14), deaf to the hangup
-  # its session leader's exit sends, so only the wrapper can stop it.
-  ( trap '' HUP; exec sleep 300 ) &
-  printf '%s\n' "$!" > "$FAKE_SUITE_LOG.child"
-  exit 0
-fi
-if [ -n "${FAKE_SUITE_TAKEOVER:-}" ]; then
-  # THE LOCK IS TAKEN OVER WHILE THIS RUN HOLDS IT (#72 item 2): claimed as a
-  # waiter that read this holder as gone claims it, and made again with that
-  # waiter's pid inside.
-  mv "$FAKE_SUITE_TAKEOVER" "$FAKE_SUITE_TAKEOVER.claimed" &&
-    rm -rf "$FAKE_SUITE_TAKEOVER.claimed" &&
-    mkdir "$FAKE_SUITE_TAKEOVER" &&
-    printf '%s\\n' "$FAKE_SUITE_OTHER" > "$FAKE_SUITE_TAKEOVER/pid" || exit 99
-  exit 0
-fi
-if [ -n "${FAKE_SUITE_SLEEP:-}" ]; then
-  # A CHILD OF ITS OWN, as pytest waits on a shell suite or a `git`: the
-  # wrapper must stop it too, not only the process it started.
-  sleep "$FAKE_SUITE_SLEEP" &
-  printf '%s\n' "$!" > "$FAKE_SUITE_LOG.child"
-  : > "$FAKE_SUITE_LOG.started"
-  wait
-  exit 0
-fi
-exit "${FAKE_SUITE_RC:-0}"
-"""
-
-FAKE_PGREP = "#!/bin/sh\nexit 1\n"
-
-# THE REAL `mkdir`, and then - for the workstation's lock directory alone - a
-# DIRECTORY where the holder's pid file goes, so the wrapper's write of its pid
-# fails (#72 item 1) the same way on every platform and for every user, root
-# included, where a directory it cannot write would not stop root.
-FAKE_MKDIR = """#!/bin/sh
-REAL_MKDIR "$@" || exit
-case "$1" in
-  *.lock.d) REAL_MKDIR "$1/pid" || exit 99 ;;
-esac
-exit 0
-"""
-
-
-class Box:
-    def __init__(self, root: Path, flock: bool = True):
-        self.root = root
-        self.fakebin = root / "fakebin"
-        self.fakebin.mkdir()
-        self.lockdir = root / "locktmp"
-        self.lockdir.mkdir()
-        self.state = root / "state"
-        self.cache = root / "cache"
-        self.log = root / "suite.log"
-        for name, text in (("python3", FAKE_SUITE), ("pgrep", FAKE_PGREP)):
-            (self.fakebin / name).write_text(text)
-            (self.fakebin / name).chmod(0o755)
-        if flock:
-            path = f"{self.fakebin}{os.pathsep}{os.environ.get('PATH', '')}"
-        else:
-            # NO `flock` ON THIS PATH: the wrapper takes its `mkdir` lock, the
-            # one macOS uses. Every other tool it calls is linked in by name.
-            for tool in ("dirname", "awk", "mkdir", "cat", "mv", "rm", "sleep", "date",
-                         "chmod", "ps"):
-                found = shutil.which(tool)
-                assert found, tool
-                (self.fakebin / tool).symlink_to(found)
-            path = str(self.fakebin)
-        self.env = {k: v for k, v in os.environ.items()
-                    if not k.startswith(("XDG_", "PYTHON", "FAKE_"))}
-        self.env.update(PATH=path, TMPDIR=str(self.lockdir), XDG_STATE_HOME=str(self.state),
-                        XDG_CACHE_HOME=str(self.cache), HOME=str(root / "home"),
-                        FAKE_SUITE_LOG=str(self.log))
-
-    def popen(self, *args, **env) -> subprocess.Popen:
-        """The wrapper, its output to FILES: a pipe is held open by every
-        process that inherited it, and `communicate` waits for all of them."""
-        child = dict(self.env)
-        child.update(env)
-        self.out = open(self.root / "wrapper.out", "w")
-        self.err = open(self.root / "wrapper.err", "w")
-        return subprocess.Popen([shutil.which("bash") or "bash", str(WRAPPER), *args],
-                                env=child, stdout=self.out, stderr=self.err,
-                                stdin=subprocess.DEVNULL)
-
-    def finish(self, proc: subprocess.Popen, timeout: float = 60) -> str:
-        proc.wait(timeout=timeout)
-        self.out.close()
-        self.err.close()
-        return (self.root / "wrapper.err").read_text()
-
-    def recorded(self) -> dict:
-        out: dict = {"arg": []}
-        for line in self.log.read_text().splitlines():
-            key, _, value = line.partition(" ")
-            if key == "arg":
-                out["arg"].append(value)
-            else:
-                out[key] = value
-        return out
-
-    def runs(self) -> list:
-        base = self.state / "openRepoTools" / "tmp"
-        return sorted(base.iterdir()) if base.is_dir() else []
-
-    def wait_started(self, timeout: float = 30) -> None:
-        deadline = time.time() + timeout
-        marker = Path(str(self.log) + ".started")
-        while time.time() < deadline:
-            if marker.exists():
-                return
-            time.sleep(0.1)
-        raise AssertionError("the stub suite never started")
-
-
-def test_a_run_relocates_bytecode_caches_and_temp_and_leaves_none_of_it(tmp_path):
-    box = Box(tmp_path)
-    proc = box.popen("-k", "lane_worktrees", FAKE_SUITE_RC="5")
-    err = box.finish(proc)
-    assert proc.returncode == 5, err
-    rec = box.recorded()
-    run_root = Path(rec["TMPDIR"]).parent
-    assert run_root.parent == box.state / "openRepoTools" / "tmp"
-    assert run_root.name.endswith(f"-{proc.pid}"), run_root.name
-    assert rec["PYTHONPYCACHEPREFIX"] == str(box.cache / "openRepoTools" / "pycache")
-    assert rec["arg"][:5] == ["-m", "pytest", "tests", "-q", "-p"], rec["arg"]
-    assert "no:cacheprovider" in rec["arg"]
-    assert f"--basetemp={run_root}/basetemp" in rec["arg"]
-    assert rec["arg"][-2:] == ["-k", "lane_worktrees"]
-    assert not run_root.exists(), "the run root outlived the run"
-    assert box.runs() == []
-    # THE LOCK IS THE WORKSTATION'S, under the caller's TMPDIR and not the
-    # run's: the `flock` file where there is `flock`, and on macOS, which has
-    # none, the `mkdir` lock beside it - released by the exit.
-    if shutil.which("flock"):
-        assert (box.lockdir / "openrepotools-pytest.lock").exists(), (
-            "the lock is the workstation's, under the caller's TMPDIR, not the run's")
-    else:
-        assert not (box.lockdir / "openrepotools-pytest.lock.d").exists(), "the lock was kept"
-
-
-@pytest.mark.parametrize("sig,rc", [(signal.SIGTERM, 143), (signal.SIGINT, 130)])
-@pytest.mark.parametrize("flock", [True, False], ids=["flock", "mkdir-lock"])
-def test_a_killed_run_removes_its_run_root_and_stops_the_suite(tmp_path, sig, rc, flock):
-    """THE TRAP, PROVED: the wrapper is signalled while the suite is running.
-    It stops the suite, removes the run root (and, on the `mkdir` path, the
-    lock), and exits with the signal's code - not after the suite would have
-    finished, which is what a foreground child would have made it do."""
-    if flock and shutil.which("flock") is None:
-        pytest.skip("this host has no flock; the mkdir-lock case covers it")
-    box = Box(tmp_path, flock=flock)
-    proc = box.popen(FAKE_SUITE_SLEEP="120")
-    try:
-        box.wait_started()
-        rec = box.recorded()
-        run_root = Path(rec["TMPDIR"]).parent
-        assert (run_root / "tmp" / "the-suite-wrote-here").exists()
-        if not flock:
-            assert (box.lockdir / "openrepotools-pytest.lock.d").is_dir()
-        started = time.time()
-        proc.send_signal(sig)
-        box.finish(proc, timeout=30)
-    finally:
-        if proc.poll() is None:
-            proc.kill()
-            proc.wait()
-    assert proc.returncode == rc
-    assert time.time() - started < 20, "the trap waited for the suite"
-    assert not run_root.exists(), "the run root outlived a killed run"
-    child = Path(str(box.log) + ".child").read_text().strip()
-    for pid, what in ((int(rec["pid"]), "the suite"), (int(child), "the suite's own child")):
-        deadline = time.time() + 10
-        while time.time() < deadline and _running(pid):
-            time.sleep(0.1)
-        if _running(pid):
-            os.kill(pid, signal.SIGKILL)
-            raise AssertionError(f"{what} outlived its wrapper")
-    if not flock:
-        assert not (box.lockdir / "openrepotools-pytest.lock.d").exists(), "the lock was kept"
-        # NOR A COPY OF IT (#72 item 2): the lock is released by renaming it
-        # to a name only this run uses, and that copy goes too.
-        assert os.listdir(box.lockdir) == [], os.listdir(box.lockdir)
-
-
-def test_a_run_that_cannot_record_its_pid_in_the_mkdir_lock_does_not_start(tmp_path):
-    """#72 item 1: the holder's pid write was `|| :`, so a run that could not
-    write it entered the suite anyway - holding a lock every waiter reads as
-    stale, claims after three polls and runs beside. A pid that is not there
-    to be read is a refusal before the suite: the run releases the directory
-    it made and exits 1, naming the path."""
-    box = Box(tmp_path, flock=False)
-    fake = box.fakebin / "mkdir"
-    real = os.readlink(fake)
-    fake.unlink()
-    fake.write_text(FAKE_MKDIR.replace("REAL_MKDIR", shlex.quote(real)))
-    fake.chmod(0o755)
-    lock = box.lockdir / "openrepotools-pytest.lock.d"
-    proc = box.popen()
-    err = box.finish(proc)
-    assert not box.log.exists(), "the suite started with no pid in its lock"
-    assert proc.returncode == 1, err
-    assert f"cannot record this run's pid in {lock}/pid" in err, err
-    assert not lock.exists(), "a run that did not start kept the lock"
-    assert os.listdir(box.lockdir) == [], os.listdir(box.lockdir)
-    assert box.runs() == [], "a run that did not start made a run root"
-
-
-def test_a_holder_whose_mkdir_lock_was_taken_over_leaves_the_new_lock(tmp_path):
-    """#72 item 2: a waiter that reads a live holder as gone claims the lock
-    and makes it again with its own pid inside, and the old holder's EXIT
-    trap then removed the path - the NEW holder's lock. The trap removes the
-    lock only while it still carries this run's pid."""
-    box = Box(tmp_path, flock=False)
-    lock = box.lockdir / "openrepotools-pytest.lock.d"
-    other = str(os.getpid())                     # a live run that is not this one
-    proc = box.popen(FAKE_SUITE_TAKEOVER=str(lock), FAKE_SUITE_OTHER=other)
-    err = box.finish(proc)
-    assert proc.returncode == 0, err
-    assert lock.is_dir(), "the old holder's exit removed the new holder's lock"
-    assert (lock / "pid").read_text() == f"{other}\n"
-    assert os.listdir(box.lockdir) == [lock.name], os.listdir(box.lockdir)
-    assert box.runs() == [], "the run root outlived the run"
-
-
-@pytest.mark.skipif(not hasattr(os, "openpty") or sys.platform.startswith("win"),
-                    reason="needs a pseudo-terminal")
-def test_a_suite_that_reads_the_terminal_is_not_stopped(tmp_path):
-    """Adversarial review B7: with a terminal on stdin the suite runs in the
-    foreground, in the terminal's process group - a debugger's prompt reads
-    it. A background group would be stopped by SIGTTIN and the wrapper would
-    wait on it for ever, holding the workstation's lock."""
-    import pty
-    import select
-    box = Box(tmp_path)
-    env = dict(box.env, FAKE_SUITE_READ="1")
-    pid, master = pty.fork()
-    if pid == 0:                                 # the child: a session on the pty
-        try:
-            os.execve(shutil.which("bash") or "/bin/bash", ["bash", str(WRAPPER)], env)
-        finally:
-            os._exit(127)
-    seen, sent, status, finished = b"", False, None, False
-    deadline = time.time() + 30
-    try:
-        while time.time() < deadline:
-            ready, _w, _x = select.select([master], [], [], 0.2)
-            if ready:
-                try:
-                    chunk = os.read(master, 4096)
-                except OSError:
-                    chunk = b""
-                seen += chunk
-                if b"prompt>" in seen and not sent:
-                    os.write(master, b"hello\n")
-                    sent = True
-            done, status = os.waitpid(pid, os.WNOHANG)
-            if done:
-                finished = True
-                break
-        else:
-            raise AssertionError(f"the wrapper hung on a suite reading the terminal: {seen!r}")
-    finally:
-        if not finished:
-            try:
-                os.killpg(pid, signal.SIGKILL)
-                os.waitpid(pid, 0)
-            except OSError:
-                pass
-        os.close(master)
-    assert b"got: hello" in seen, seen
-    assert os.WIFEXITED(status) and os.WEXITSTATUS(status) == 0, (status, seen)
-    assert box.runs() == [], "the run root outlived the run"
-
-
-def test_a_leader_that_ignores_term_is_killed_at_the_deadline(tmp_path):
-    """#170 item 3: `stop_group` reaped the leader with an unbounded `wait`
-    BEFORE its ten-second grace loop, so a leader that traps or ignores TERM
-    held the wrapper - and the workstation's lock - for ever, and the KILL
-    was never reached."""
-    box = Box(tmp_path)
-    proc = box.popen(FAKE_SUITE_IGNORE_TERM="1")
-    leader = 0
-    try:
-        box.wait_started()
-        leader = int(box.recorded()["pid"])
-        started = time.time()
-        proc.send_signal(signal.SIGTERM)
-        box.finish(proc, timeout=40)
-    finally:
-        if proc.poll() is None:
-            proc.kill()
-            proc.wait()
-        if leader:
-            try:
-                os.killpg(leader, signal.SIGKILL)
-            except OSError:
-                pass
-    assert proc.returncode == 143
-    assert time.time() - started < 20, "the wrapper waited past its KILL deadline"
-    assert not _running(leader), "the leader outlived its wrapper"
-    assert box.runs() == [], "the run root outlived the run"
-
-
-@pytest.mark.parametrize("form", [["--basetemp", "ELSEWHERE"], ["--basetemp=ELSEWHERE"]])
-def test_a_callers_basetemp_is_refused(tmp_path, form):
-    """#170 G8: pytest takes the LAST `--basetemp`, and a caller's, forwarded
-    after the wrapper's, won - its temporary files landed outside the run root
-    the EXIT trap removes. It is refused before any lock is taken."""
-    box = Box(tmp_path)
-    elsewhere = str(tmp_path / "elsewhere")
-    proc = box.popen(*[a.replace("ELSEWHERE", elsewhere) for a in form])
-    err = box.finish(proc)
-    assert proc.returncode == 64, err
-    assert "--basetemp is the wrapper's own" in err
-    assert not box.log.exists(), "the suite ran"
-    assert not Path(elsewhere).exists()
-
-
-def _on_a_terminal(box, env: dict, timeout: float = 30) -> tuple:
-    """Run the wrapper with a pseudo-terminal on its stdin; (wait status,
-    seconds it took)."""
-    import pty
-    import select
-    started = time.time()
-    pid, master = pty.fork()
-    if pid == 0:
-        try:
-            os.execve(shutil.which("bash") or "/bin/bash", ["bash", str(WRAPPER)], env)
-        finally:
-            os._exit(127)
-    try:
-        deadline = time.time() + timeout
-        while time.time() < deadline:
-            ready, _w, _x = select.select([master], [], [], 0.05)
-            if ready:
-                try:
-                    os.read(master, 4096)
-                except OSError:
-                    pass
-            done, status = os.waitpid(pid, os.WNOHANG)
-            if done:
-                return status, time.time() - started
-        try:
-            os.kill(pid, signal.SIGKILL)
-            os.waitpid(pid, 0)
-        except OSError:
-            pass
-        raise AssertionError("the wrapper did not finish")
-    finally:
-        os.close(master)
-
-
-NEEDS_A_PTY = pytest.mark.skipif(not hasattr(os, "openpty") or sys.platform.startswith("win"),
-                                 reason="needs a pseudo-terminal")
-
-
-@NEEDS_A_PTY
-def test_what_a_suite_on_the_terminal_leaves_running_is_stopped(tmp_path):
-    """#170 G14: with a terminal on stdin the suite runs in the foreground, in
-    the wrapper's own process group, and no group id was kept - a child it
-    left running was not stopped before the run root went and the lock was
-    released. The group's members are read before the suite starts; what is
-    there afterwards that was not is stopped."""
-    box = Box(tmp_path)
-    child = 0
-    try:
-        status, _took = _on_a_terminal(box, dict(box.env, FAKE_SUITE_LEAVE="1"))
-        child = int(Path(str(box.log) + ".child").read_text().strip())
-        assert os.WIFEXITED(status) and os.WEXITSTATUS(status) == 0, status
-        assert not _running(child), "a process the suite left running outlived its wrapper"
-        assert box.runs() == [], "the run root outlived the run"
-    finally:
-        if child and _running(child):
-            os.kill(child, signal.SIGKILL)
-
-
-@NEEDS_A_PTY
-def test_a_terminal_run_that_leaves_nothing_waits_for_nothing(tmp_path):
-    """#179 Copilot round 2: the stray scan ran in a command substitution, so
-    its own subshell, `ps` and `awk` were members of the group that were not
-    there before - every scan found "strays", and every terminal run waited
-    out the whole ten-second deadline after a suite that left nothing."""
-    box = Box(tmp_path)
-    status, took = _on_a_terminal(box, dict(box.env))
-    assert os.WIFEXITED(status) and os.WEXITSTATUS(status) == 0, status
-    assert took < 8, f"the wrapper took {took:.1f} s after a suite that left nothing running"
-    assert box.runs() == [], "the run root outlived the run"
-
-
-def _running(pid: int) -> bool:
-    """Alive and not a zombie: an orphan's zombie answers `kill -0` until
-    whoever adopted it reaps it."""
-    proc = subprocess.run(["ps", "-o", "stat=", "-p", str(pid)], capture_output=True, text=True)
-    state = proc.stdout.strip()
-    return bool(state) and not state.startswith("Z")
-
-
-def test_the_repository_venv_is_used_when_it_has_pytest(tmp_path):
-    box = Box(tmp_path)
-    venv_bin = box.cache / "openRepoTools" / "venvs" / "openRepoTools" / "bin"
-    venv_bin.mkdir(parents=True)
-    stub = venv_bin / "python3"
-    stub.write_text("#!/bin/sh\ncase \"$1\" in -c) exit 0 ;; esac\nexec "
-                    f"{box.fakebin / 'python3'} \"$@\"\n")
-    stub.chmod(0o755)
-    proc = box.popen()
-    err = box.finish(proc)
-    assert proc.returncode == 0, err
-    assert "runs from the repository venv" in err
-    assert box.recorded()["arg"][:2] == ["-m", "pytest"]
-    assert box.runs() == []
diff --git a/tests/test_skill_shell_blocks.py b/tests/test_skill_shell_blocks.py
deleted file mode 100644
index 8ed3e1bf..00000000
--- a/tests/test_skill_shell_blocks.py
+++ /dev/null
@@ -1,274 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The shell blocks INSIDE the shipped skills, and one claim a skill must not make.
-
-opensoft/openRepoTools#78 and #79, both found by opensoft/workBenches'
-`devcontainer.test/` while it vendored `skills/handoff/SKILL.md` byte for byte.
-
-WHY A SKILL'S SHELL BLOCKS NEED THEIR OWN PARSE CHECK. `tests/test_repo_hygiene.py`
-runs `bash -n` on the twelve top-level command files, and it never reads a
-fenced block inside a `SKILL.md`. A block there is prose to every other test in
-the suite, but it is also what a person copies into a terminal, and the skill's
-own text says so: *"every command is copy-pasteable as written"*. #78 was one
-such block, `pclaude <profile>  # and only then`: bash reads `<` and `>` as
-redirections whatever stands beside them, so a person who pasted it got a parse
-error instead of a command. The command has since been renamed `lclaude`, and
-the bare placeholder was carried through the rename untouched, because nothing
-in this repository ever parsed it.
-
-THE CHECK IS `bash -n`, which parses and never runs: a block here may name
-`tmux send-keys`, `lane-end` or `git push`, and nothing in it is executed. It is
-asked of EVERY fenced `sh`/`bash` block in EVERY `skills/*/SKILL.md`, found by
-walking the directory, so a fourth skill is covered the day it is added.
-
-A FENCE WITH NO LANGUAGE IS A FAILURE, not a skip. "Skip what is clearly marked
-as not shell" means `text`, `json` and the like; a block that says nothing is
-not marked as anything, and treating it as prose would let the next unparsable
-example in by leaving its tag off. Today there is none, so this costs a writer
-one word.
-"""
-
-from __future__ import annotations
-
-import os
-import re
-import shutil
-import subprocess
-from pathlib import Path
-from typing import List, NamedTuple
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [pytest.mark.skipif(shutil.which("bash") is None,
-                                 reason="the check is `bash -n`"),
-              WINDOWS_SKIP]
-
-#: The fence tags whose blocks are parsed. Anything else that carries a tag
-#: (`text`, `json`, `diff`) is marked as not shell and is left alone.
-SHELL_TAGS = ("sh", "bash", "shell")
-
-#: An opening or closing fence: up to three spaces, three or more backticks, and
-#: the info string (no backtick in it, which is what tells a fence from a span
-#: of inline code that happens to start a line).
-FENCE = re.compile(r"^ {0,3}(`{3,})([^`]*)$")
-
-HANDOFF_SKILL = REPO / "skills/handoff/SKILL.md"
-
-
-class Block(NamedTuple):
-    tag: str      # the fence's first info word, "" where it has none
-    opens: int    # the 1-based line of the opening fence
-    body: str     # the lines between the fences, newline-terminated
-
-
-def fenced_blocks(text: str) -> List[Block]:
-    """Every fenced block in `text`, in order.
-
-    A fence closes with a bare fence of at least as many backticks, as in
-    CommonMark, and what stands between two fences is that block's whatever its
-    tag: a ```sh example quoted inside a ```text block is the text block's
-    content and is never read as a second block. A block still open at the end
-    of the file is returned with the tag `UNTERMINATED`, because it would
-    otherwise swallow the rest of the file in silence."""
-    blocks: List[Block] = []
-    lines = text.split("\n")
-    i = 0
-    while i < len(lines):
-        opening = FENCE.match(lines[i])
-        if not opening:
-            i += 1
-            continue
-        ticks, info = opening.group(1), opening.group(2).strip()
-        tag = info.split()[0] if info else ""
-        start = i
-        body: List[str] = []
-        i += 1
-        closed = False
-        while i < len(lines):
-            closing = FENCE.match(lines[i])
-            if closing and not closing.group(2).strip() \
-                    and len(closing.group(1)) >= len(ticks):
-                closed = True
-                break
-            body.append(lines[i])
-            i += 1
-        blocks.append(Block(tag if closed else "UNTERMINATED", start + 1,
-                            "".join(line + "\n" for line in body)))
-        i += 1
-    return blocks
-
-
-def parse_problems(rel: str, text: str) -> List[str]:
-    """What is wrong with the fenced blocks of `text`, one line each, every one
-    naming `rel` and the line IN THE FILE of the thing that is wrong.
-
-    `bash -n` reports `line N` of the block, so the block's own first line is
-    added back: the person who reads the failure goes straight to the file."""
-    env = {k: v for k, v in os.environ.items() if k not in ("BASH_ENV", "ENV")}
-    problems: List[str] = []
-    for block in fenced_blocks(text):
-        if block.tag == "UNTERMINATED":
-            problems.append(f"{rel}:{block.opens}: this fence is never closed")
-        elif block.tag == "":
-            problems.append(
-                f"{rel}:{block.opens}: this fence names no language, so nothing "
-                "says whether it is shell; tag it `sh` or `bash` to have it "
-                "parsed, or `text` to say it is not shell")
-        elif block.tag in SHELL_TAGS:
-            proc = subprocess.run(["bash", "-n"], input=block.body, env=env,
-                                  capture_output=True, text=True, check=False)
-            if proc.returncode == 0:
-                continue
-            body_lines = block.body.split("\n")
-            found = False
-            for report in proc.stderr.splitlines():
-                at = re.match(r"bash: line (\d+): ([^`].*)$", report)
-                if not at:
-                    continue   # bash's second line quotes the source in backticks
-                n = int(at.group(1))
-                quoted = body_lines[n - 1].strip() if 0 < n <= len(body_lines) else ""
-                problems.append(
-                    f"{rel}:{block.opens + n}: {at.group(2)} -- in `{quoted}` "
-                    f"(the ```{block.tag} block that opens at line {block.opens})")
-                found = True
-            if not found:
-                problems.append(
-                    f"{rel}:{block.opens}: this ```{block.tag} block does not "
-                    f"parse: {proc.stderr.strip()}")
-    return problems
-
-
-def shipped_skills() -> List[Path]:
-    return sorted((REPO / "skills").glob("*/SKILL.md"))
-
-
-def rel(path: Path) -> str:
-    return path.relative_to(REPO).as_posix()
-
-
-# --- #78 --------------------------------------------------------------------
-
-def test_every_shell_block_in_every_skill_parses():
-    """EVERY ```sh AND ```bash BLOCK IN EVERY `skills/*/SKILL.md` PARSES UNDER
-    `bash -n`, and every fence says what it is. The failure names the file, the
-    line and the text of what does not parse."""
-    skills = shipped_skills()
-    assert skills, "no skills/*/SKILL.md found — this test is looking in the wrong tree"
-    problems: List[str] = []
-    for path in skills:
-        problems += parse_problems(rel(path), path.read_text(encoding="utf-8"))
-    assert not problems, (
-        "a skill's example block is what a person pastes into a terminal, and "
-        "these do not parse (a bare `<placeholder>` is the usual cause: bash "
-        "reads `<` and `>` as redirections; spell it "
-        "`\"${CLAUDE_PROFILE_NAME:-<profile>}\"` or put it in a comment):\n  "
-        + "\n  ".join(problems))
-
-
-def test_the_checker_is_not_blind_to_the_blocks_it_checks():
-    """A checker whose fence reader went wrong would pass over a skill whose
-    every block it had failed to find. The two skills that carry the longest
-    sequences of commands are asserted to yield blocks, in both spellings of
-    the tag between them."""
-    seen = set()
-    for name in ("handoff", "restart"):
-        path = REPO / f"skills/{name}/SKILL.md"
-        blocks = [b for b in fenced_blocks(path.read_text(encoding="utf-8"))
-                  if b.tag in SHELL_TAGS]
-        assert len(blocks) >= 5, (
-            f"{rel(path)} yielded {len(blocks)} shell blocks; it carries well "
-            "over that, so the fence reader is skipping them")
-        seen |= {b.tag for b in blocks}
-    assert {"sh", "bash"} <= seen, f"only {sorted(seen)} found; both tags are in use"
-
-
-#: #78's block as filed, line for line, set between prose and a `text` fence
-#: that quotes the same bare placeholder, which is NOT shell and must not be
-#: parsed. The `sh` block that follows it spells the placeholder the way step 5
-#: does and must pass.
-ISSUE_78_DOCUMENT = """\
-Run the late record, then restart:
-
-```sh
-lane-handoff --late --at 2026-09-14T12:02:27Z "late; usage limit hit before the swap"
-pclaude <profile>      # and only then
-```
-
-What a person sees, which is not shell:
-
-```text
-pclaude <profile>
-```
-
-And spelled so that it parses:
-
-```bash
-lclaude "${CLAUDE_PROFILE_NAME:-<profile>}"      # and only then
-```
-"""
-
-
-def test_the_checker_reports_the_defect_issue_78_filed_where_it_is():
-    """THE CHECKER ITSELF, ON #78's OWN BLOCK. It must name the file and the
-    line IN THE FILE of the bare `pclaude <profile>` (line 5 of the document
-    above, not line 2 of the block), must say nothing about the `text` fence
-    that carries the same characters, and must pass the quoted spelling."""
-    problems = parse_problems("skills/x/SKILL.md", ISSUE_78_DOCUMENT)
-    assert len(problems) == 1, problems
-    assert problems[0].startswith("skills/x/SKILL.md:5: "), problems[0]
-    assert "pclaude <profile>      # and only then" in problems[0], problems[0]
-    assert "opens at line 3" in problems[0], problems[0]
-
-
-def test_a_fence_with_no_language_and_a_fence_never_closed_are_refused():
-    """The two ways an example block could leave the check by being written
-    carelessly rather than wrongly: an opening fence that says nothing, and one
-    that is never closed (which would otherwise read the rest of the file as
-    one block, or as none)."""
-    bare = parse_problems("skills/x/SKILL.md", "```\nlclaude <profile>\n```\n")
-    assert len(bare) == 1 and "names no language" in bare[0], bare
-    assert bare[0].startswith("skills/x/SKILL.md:1: "), bare[0]
-    open_ended = parse_problems("skills/x/SKILL.md", "text\n```sh\necho hi\n")
-    assert len(open_ended) == 1 and "never closed" in open_ended[0], open_ended
-    assert open_ended[0].startswith("skills/x/SKILL.md:2: "), open_ended[0]
-
-
-def test_a_fenced_example_inside_a_text_block_is_that_blocks_content():
-    """A ```sh fence quoted INSIDE a longer ```` ```text ```` fence is the text
-    block's own content: it is never read as a block of its own and never
-    parsed, and the longer fence is what closes the outer one."""
-    document = "````text\n```sh\npclaude <profile>\n```\n````\n"
-    assert parse_problems("skills/x/SKILL.md", document) == []
-
-
-# --- #79 --------------------------------------------------------------------
-
-def test_the_handoff_skill_does_not_call_rename_the_only_act_there_is():
-    """AMENDMENT 12'S NAME GUARD TYPES `/rename <lane>` ITSELF, so the
-    operator's own `/rename` is the fallback and not "the only act there is".
-
-    Step 5's comment said it was the only act, which was true until Amendment 12
-    (`lanes-edit.sh session-start`, the `SessionStart` hook, and
-    `lanes-edit.sh guard`, the `UserPromptSubmit` guard: `guard_type` sends the
-    keys to the session's own pane, and `docs/README-lanes.md` says so under
-    "The `SessionStart` block's own line"). What is still true, and is kept: no
-    API renames a running session from inside — a keystroke is not an API."""
-    text = HANDOFF_SKILL.read_text(encoding="utf-8")
-    stale = [n for n, line in enumerate(text.splitlines(), 1)
-             if "only act there is" in line]
-    assert not stale, (
-        f"{rel(HANDOFF_SKILL)}:{stale[0]} calls the operator's /rename the only "
-        "act there is, which Amendment 12's name guard made false: it types the "
-        "rename itself, and the operator's is the fallback (#79)")
-    comment = text.split("# WHICH ACT REMOVES THIS LINE", 1)
-    assert len(comment) == 2, "step 5's `WHICH ACT REMOVES THIS LINE` comment is gone"
-    paragraph = comment[1].split("echo 'then, in the session that comes up", 1)[0]
-    for name in ("SessionStart", "UserPromptSubmit", "Amendment 12"):
-        assert name in paragraph, (
-            f"step 5's comment no longer names {name}, which is who types the "
-            "rename ahead of the operator")
-    assert "FALLBACK" in paragraph, (
-        "step 5's comment must say the operator's /rename is the fallback")
-    assert "no API" in paragraph, (
-        "the true half of the claim stays: no API renames a running session")
diff --git a/tests/test_status_command.py b/tests/test_status_command.py
deleted file mode 100644
index 72db0a56..00000000
--- a/tests/test_status_command.py
+++ /dev/null
@@ -1,8492 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`status` — the read-only view of an estate: the LOCAL layer, and `--fetch`.
-
-Brett Heap's RULING of 2026-09-10 in this repository, verbatim: "lets go with
-a fourth file. start with the local status layer." So this file asserts what
-that layer is: the same estate resolution `park` and `resume` have (held
-byte-for-byte elsewhere), one row per repository the estate reads — holder or
-root, each member's working clone, every mounted leg — and, for each, what
-this machine already knows without a fetch: ahead/behind the tracking
-branch's origin AS OF THE LAST FETCH, dirty and stashed, feature branches
-never pushed or whose remote branch is gone, dirty feature worktrees, and a
-leg checked out away from its pin or pinned behind its origin. And the two
-things it never does without being asked: fetch, and change anything.
-
-His RULING of 2026-09-11, verbatim: "next layer: fork against upstream". A
-remote named `upstream` is read from local refs, `origin/<branch>` against
-`upstream/<branch>`, and `--fetch` fetches it too; with no such remote, and
-only under `--fetch`, an origin on github.com is asked about once with `gh
-api` — a FAKE `gh` on PATH here, answering the two calls the command makes,
-and a `url.<base>.insteadOf` rewrite so an origin that LOOKS like github.com
-still fetches from a bare repository on disk. Nothing here reaches the
-network. The third section holds that layer.
-
-His RULING of 2026-09-11, verbatim: "next layer: shape-pin drift". Every
-root and holder carries `contracts/shape-pin.yaml`, a COPY PIN: the
-openRepoShape commit its copied shape files came from and a sha256 per copy.
-The fourth section holds that layer: a copy edited in place is drift, a
-missing copy is named, a `shape:` mirror naming another commit is out of
-step, and the pin is read against the standard's `main` — from a clone of it
-under the projects directory (a bare repository on disk here, its origin
-spelled as github.com so the clone is found by slug and never fetched), or
-under `--fetch` from a fake `gh`'s compare answer.
-
-His RULING of 2026-09-11, verbatim: "next layer: parked record against disk".
-`park` records every open feature in the private workspace repository that
-`~/.agents/workspace.yaml` names, and `resume` rebuilds worktrees from it; the
-fifth section holds the ways record and disk drift apart, read the way
-`resume.sh` will judge them: a recorded feature with no worktree here, a
-worktree whose tip moved on from, fell behind, or diverged from the parked
-commit, a leg parked with `--no-push` — or one whose `pushed:` is missing or
-neither true nor false, which `resume` refuses just as flatly — a worktree
-the record does not know, and a family's record matched to each member by its
-`root:`.
-The config and the workspace checkout are plain files under the fake home;
-nothing is pulled.
-
-His RULING of 2026-09-11, verbatim: "next layer: --fetch". With the flag,
-`git fetch --prune origin` runs in every repository before it is read — the
-ONE write this command makes, to remote-tracking refs and nothing else — and
-the second section of this file holds exactly that: what moved is said, a
-deleted remote branch reads as gone, a fetch that fails is a finding and the
-read goes on, the leg is fetched too, and local branches, HEAD, index,
-working tree and stash are untouched.
-
-OFFLINE, LIKE THE REST OF THIS SUITE. Every remote is a BARE REPOSITORY IN A
-TEMPORARY DIRECTORY and every `$HOME` is a temporary directory. Nothing here
-needs `make` or the Speckit overlay, because `status` runs nothing; the one
-family test borrows the estate fixture `test_park_resume_commands.py` builds
-out of openRepoShape's own template bytes, and skips with it where the
-submodule is not checked out.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from conftest import NEEDS_UPSTREAM, REPO, WINDOWS_SKIP, git, rmtree
-from test_park_resume_commands import (  # noqa: F401  (fixtures by name)
-    ORG, MEMBERS, FAMILY, FAKE_SHA, commit_all, estate, family_manifest,
-    remotes, run, probe_project,
-)
-from test_park_resume_commands import (  # noqa: F401  (fixtures by name)
-    QUILL, QUILL_DISPLAY, clone_quill_estate, named_apart,
-    probe_family_two_names,
-)
-
-STATUS = REPO / "status"
-
-#: The command is bash, and it runs `git` in a checkout; Windows has no
-#: shebang execution for it. On Windows the way in is WSL2.
-pytestmark = [
-    WINDOWS_SKIP,
-    pytest.mark.skipif(shutil.which("bash") is None,
-                       reason="status is a bash script"),
-]
-
-#: THE ONE LINE EVERY RUN CARRIES. A status that stopped saying this is one
-#: somebody reads as current, and then does not fetch.
-CAVEAT = "as of the last fetch: status reads local refs only and fetches nothing."
-
-ROOT_WITH_LEG_YAML = """\
-schema_version: 1
-kind: project-manifest
-id: {id}
-name: "{name}"
-tracking_branch: main
-legs:
-  - role: assembly
-    repository: {org}/{name}
-    path: "."
-  - role: spec
-    repository: {org}/{name}-spec
-    path: spec
-"""
-
-
-#: A root `load_repo_shape` calls THREE-LEG, which is four conditions and not
-#: one: `kind: project-manifest`, `schema: project-repo-schema`, and BOTH a
-#: `spec` and a `code` leg declared. `ROOT_WITH_LEG_YAML` above is the other
-#: shape — no `schema:` line, no `code` leg — which is `single` however many
-#: legs it mounts, and `resume` maps only a `repo` leg onto it.
-THREE_LEG_YAML = """\
-schema_version: 1
-kind: project-manifest
-schema: project-repo-schema
-id: {id}
-name: "{name}"
-tracking_branch: main
-legs:
-  - role: assembly
-    repository: {org}/{name}
-    path: "."
-  - role: spec
-    repository: {org}/{name}-spec
-    path: spec
-  - role: code
-    repository: {org}/{name}-code
-    path: code
-"""
-
-
-@pytest.fixture
-def home(tmp_path) -> Path:
-    """A fake home with `projects/` in it — the common spelling."""
-    target = tmp_path / "home"
-    (target / "projects").mkdir(parents=True)
-    return target
-
-
-def seed_root_with_leg(base: Path, name: str,
-                       leg_branch: str | None = None) -> dict:
-    """Bare remotes for ONE standalone root that mounts ONE leg.
-
-    The leg has two commits so a checkout can be moved one back and be
-    genuinely away from its pin; the root pins the leg's tip. No Makefile and
-    no overlay: `status` runs nothing, so a root here is a `project.yaml`, a
-    `.gitmodules` and git.
-
-    `leg_branch` makes the leg's row declare `branch: <leg_branch>`, its OWN
-    branch (#235), and gives the leg's remote that branch at the pin.
-    """
-    leg_seed = base / "seed" / f"{name}-spec"
-    leg_seed.mkdir(parents=True)
-    (leg_seed / "spec.md").write_text("# the spec leg\n", encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=leg_seed)
-    commit_all(leg_seed, "the leg")
-    (leg_seed / "more.md").write_text("more spec\n", encoding="utf-8")
-    commit_all(leg_seed, "the leg moved on")
-    if leg_branch is not None:
-        git("branch", leg_branch, cwd=leg_seed)
-    leg_bare = base / "remotes" / f"{name}-spec.git"
-    leg_bare.parent.mkdir(parents=True, exist_ok=True)
-    git("clone", "-q", "--bare", str(leg_seed), str(leg_bare), cwd=base)
-
-    seed = base / "seed" / name
-    seed.mkdir(parents=True)
-    own_branch = "" if leg_branch is None else f"    branch: {leg_branch}\n"
-    (seed / "project.yaml").write_text(
-        ROOT_WITH_LEG_YAML.format(id=name.lower(), name=name, org=ORG)
-        + own_branch, encoding="utf-8")
-    (seed / "README.md").write_text(f"# {name}\n", encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "seed")
-    git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-        str(leg_bare), "spec", cwd=seed)
-    commit_all(seed, "the leg, pinned")
-    bare = base / "remotes" / f"{name}.git"
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return {"bare": bare, "leg_bare": leg_bare, "leg_seed": leg_seed,
-            "seed": seed}
-
-
-def seed_three_leg_root(base: Path, name: str) -> dict:
-    """Bare remotes for a root of the OTHER shape: two legs, both mounted as
-    submodules, and a `project.yaml` that satisfies every condition
-    `load_repo_shape` puts on `three-leg`. Built here rather than shared with
-    `seed_root_with_leg` because the two exist to differ."""
-    bares = {}
-    for role in ("spec", "code"):
-        seed = base / "seed" / f"{name}-{role}"
-        seed.mkdir(parents=True)
-        (seed / f"{role}.md").write_text(f"# the {role} leg\n", encoding="utf-8")
-        git("init", "-q", "-b", "main", ".", cwd=seed)
-        commit_all(seed, f"the {role} leg")
-        bares[role] = base / "remotes" / f"{name}-{role}.git"
-        bares[role].parent.mkdir(parents=True, exist_ok=True)
-        git("clone", "-q", "--bare", str(seed), str(bares[role]), cwd=base)
-
-    seed = base / "seed" / name
-    seed.mkdir(parents=True)
-    (seed / "project.yaml").write_text(
-        THREE_LEG_YAML.format(id=name.lower(), name=name, org=ORG),
-        encoding="utf-8")
-    (seed / "README.md").write_text(f"# {name}\n", encoding="utf-8")
-    # A three-leg root's `worktree_root` is `worktrees` INSIDE it, so the
-    # feature worktrees `park` and `resume` make show in the root's own `git
-    # status` unless it ignores them: `setup-openspeckit` writes the line, and
-    # `resume.sh` warns where it is missing ("'…/.gitignore' does not ignore
-    # /worktrees/; the recreated worktrees will show in `git status` at the
-    # root"). A fixture without it would report dirt no real root has.
-    (seed / ".gitignore").write_text("worktrees/\n", encoding="utf-8")
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    commit_all(seed, "seed")
-    for role in ("spec", "code"):
-        git("-c", "protocol.file.allow=always", "submodule", "add", "-q",
-            str(bares[role]), role, cwd=seed)
-    commit_all(seed, "the legs, pinned")
-    bare = base / "remotes" / f"{name}.git"
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return {"bare": bare, "spec_bare": bares["spec"], "code_bare": bares["code"]}
-
-
-@pytest.fixture
-def trio(home, tmp_path) -> Path:
-    """A THREE-LEG estate under the fake projects directory, both legs
-    mounted — the shape `resume` maps `spec` and `code` onto, and the one it
-    refuses a `repo` leg in."""
-    base = tmp_path / "trio-remotes"
-    base.mkdir()
-    return clone_root(home, seed_three_leg_root(base, "Trio"), "Trio")
-
-
-@pytest.fixture
-def status_remotes(tmp_path) -> dict:
-    """PER TEST, not per session: `push_from_elsewhere` moves a bare's `main`,
-    and a bare shared across tests would hand the next test a clone whose
-    pin is already behind — a true finding, in the wrong test."""
-    base = tmp_path / "status-remotes"
-    base.mkdir()
-    return {"base": base, "Atlas": seed_root_with_leg(base, "Atlas")}
-
-
-def clone_root(home: Path, remote: dict, name: str) -> Path:
-    """The root cloned under the fake projects directory, leg mounted."""
-    root = home / "projects" / name
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(remote["bare"]), str(root),
-        cwd=home / "projects")
-    return root
-
-
-@pytest.fixture
-def atlas(home, status_remotes) -> Path:
-    return clone_root(home, status_remotes["Atlas"], "Atlas")
-
-
-def push_from_elsewhere(base: Path, bare: Path, tag: str,
-                        stem: str = "elsewhere") -> None:
-    """One more commit on `main` in the bare, made from ANOTHER clone — so the
-    clone under test is behind and knows nothing about it until it fetches."""
-    other = base / f"{stem}-{tag}"
-    git("clone", "-q", str(bare), str(other), cwd=base)
-    (other / f"{tag}.md").write_text(f"{tag}\n", encoding="utf-8")
-    commit_all(other, f"{tag} from elsewhere")
-    git("push", "-q", "origin", "main", cwd=other)
-    rmtree(other)
-
-
-def snapshot(repo: Path) -> str:
-    """Everything a read-only command must leave alone, as one string."""
-    refs = git("for-each-ref", cwd=repo).stdout
-    head = git("rev-parse", "HEAD", cwd=repo).stdout
-    porcelain = git("status", "--porcelain", "--ignore-submodules=none",
-                    cwd=repo).stdout
-    stash = git("stash", "list", cwd=repo).stdout
-    return refs + head + porcelain + stash
-
-
-# --- a fresh clone --------------------------------------------------------
-
-def test_a_fresh_clone_is_in_sync_and_says_so_per_repository(atlas, home):
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"status: Atlas - the assembly root at {atlas}" in result.stdout
-    assert CAVEAT in result.stdout
-    assert f"root   main   {atlas}" in result.stdout
-    assert f"leg    main   {atlas / 'spec'}" in result.stdout
-    assert "in sync with origin/main; clean" in result.stdout
-    assert ("at its pin, which is origin/main's tip as of the last fetch; "
-            "clean") in result.stdout
-    assert ("status: Atlas - 0 finding(s) in 2 repositories; nothing was "
-            "changed.") in result.stdout
-    assert result.stderr == ""
-
-
-def test_help_prints_the_first_usage_line_and_the_exit_codes():
-    result = subprocess.run(["bash", str(STATUS), "--help"],
-                            capture_output=True, text=True, check=False)
-    assert result.returncode == 0, result.stderr
-    assert result.stdout.splitlines()[0].startswith("status [<Name>]")
-    assert "EXIT 0" in result.stdout and "EXIT 1" in result.stdout
-    assert "FETCHES NOTHING unless you say `--fetch`" in result.stdout
-    assert "  --fetch " in result.stdout
-
-
-# --- the root against its origin -------------------------------------------
-
-def test_an_unpushed_commit_on_the_root_is_a_finding_and_exit_one(atlas, home):
-    (atlas / "local.md").write_text("only here\n", encoding="utf-8")
-    commit_all(atlas, "a commit origin has not seen")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - ahead of origin/main by 1 commit(s): unpushed" in result.stdout
-    assert "1 finding(s) in 2 repositories" in result.stdout
-
-
-def test_behind_is_known_only_after_a_fetch_because_status_never_fetches(
-        atlas, home, status_remotes):
-    """THE CAVEAT, PROVED. A commit lands on origin from another workstation;
-    this clone has not fetched, so `status` — which fetches nothing — must
-    still say in sync, and say as of the last fetch. After a fetch the same
-    command reports behind."""
-    push_from_elsewhere(status_remotes["base"], status_remotes["Atlas"]["bare"],
-                        "behind")
-    before = run(STATUS, "Atlas", home=home)
-    assert before.returncode == 0, before.stdout + before.stderr
-    assert "- behind origin/main" not in before.stdout
-    assert CAVEAT in before.stdout
-
-    git("fetch", "-q", "origin", cwd=atlas)
-    after = run(STATUS, "Atlas", home=home)
-    assert after.returncode == 1, after.stdout + after.stderr
-    assert ("    - behind origin/main by 1 commit(s), as of the last fetch"
-            in after.stdout)
-
-
-def test_dirty_and_stashed_are_counted(atlas, home):
-    (atlas / "untracked.txt").write_text("x\n", encoding="utf-8")
-    (atlas / "README.md").write_text("changed\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1
-    assert "    - dirty: 2 path(s)" in result.stdout
-
-    git("stash", "-q", cwd=atlas)  # the README change; the untracked stays
-    result = run(STATUS, "Atlas", home=home)
-    assert "    - dirty: 1 path(s)" in result.stdout
-    assert "    - 1 stash(es)" in result.stdout
-
-
-def test_a_root_on_a_feature_branch_or_detached_is_a_finding(atlas, home):
-    git("checkout", "-q", "-b", "001-a-thing", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1
-    assert ("    - on branch 001-a-thing, not main (`resume` refuses a root on "
-            "a feature branch)") in result.stdout
-
-    git("checkout", "-q", "--detach", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1
-    assert "    - detached HEAD at " in result.stdout
-    assert "; expected to be on main" in result.stdout
-
-
-def test_feature_branches_never_pushed_unpushed_and_gone(atlas, home):
-    """Three states of a feature branch, without a fetch for the first two
-    and after a prune for the third. The root itself is put back on `main`
-    each time, so the ONLY finding is the branch's."""
-    git("checkout", "-q", "-b", "001-a-thing", cwd=atlas)
-    (atlas / "feature.md").write_text("wip\n", encoding="utf-8")
-    commit_all(atlas, "feature work")
-    git("checkout", "-q", "main", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - branch 001-a-thing: 1 commit(s) never pushed (no upstream "
-            "branch)") in result.stdout
-    assert "1 finding(s)" in result.stdout
-
-    git("push", "-q", "-u", "origin", "001-a-thing", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "001-a-thing" not in result.stdout, "pushed and level is not a finding"
-
-    git("checkout", "-q", "001-a-thing", cwd=atlas)
-    (atlas / "feature2.md").write_text("more wip\n", encoding="utf-8")
-    commit_all(atlas, "more feature work")
-    git("checkout", "-q", "main", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1
-    assert ("    - branch 001-a-thing: 1 commit(s) unpushed to "
-            "origin/001-a-thing") in result.stdout
-
-    git("push", "-q", "origin", "--delete", "001-a-thing", cwd=atlas)
-    git("fetch", "-q", "--prune", "origin", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1
-    assert ("    - branch 001-a-thing: its remote branch origin/001-a-thing is "
-            "gone (merged, or deleted)") in result.stdout
-
-
-def test_a_dirty_feature_worktree_is_a_finding(atlas, home):
-    """The Speckit extension's shape: a feature in a LINKED worktree. Its
-    branch is read like any other; what only the worktree can say is that it
-    holds uncommitted work, which is what `park` would have to carry."""
-    worktree = home / "projects" / "Atlas-wt" / "001-a-thing"
-    worktree.parent.mkdir(parents=True)
-    git("worktree", "add", "-q", "-b", "001-a-thing", str(worktree),
-        cwd=atlas)
-    (worktree / "wip.md").write_text("uncommitted\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - worktree " in result.stdout
-    assert "on 001-a-thing: dirty, 1 path(s)" in result.stdout
-    assert ("    - branch 001-a-thing: never pushed; no commit of its own yet "
-            "(no upstream branch)") in result.stdout, (
-        "the branch is read as well, and a branch with no commit of its own "
-        "is not `0 commit(s) never pushed`")
-
-
-def test_a_leftover_directory_under_the_root_is_not_read_as_a_worktree(
-        atlas, home):
-    """The extension puts feature worktrees UNDER the root, so a registered
-    path whose `.git` is gone is a plain directory inside the root's own
-    working tree. `git status` there finds no repository, walks UP, and hands
-    back the ROOT's dirty paths — which this layer would print on that
-    worktree's row, under a branch that has nothing to do with them. A
-    worktree is a directory with its own `.git`, the rule the record layer
-    and its sweep apply, and this reader applies it too."""
-    where = atlas / "worktrees" / "001-a-thing"
-    feature_worktree(atlas, "001-a-thing", where)
-    (where / ".git").unlink()       # the directory stays, inside the root
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "dirty" in result.stdout, "the root itself is dirty: the leftover"
-    assert "on 001-a-thing: dirty" not in result.stdout, (
-        "the root's own dirty paths, reported on the worktree's row")
-
-
-# --- the leg against its pin -------------------------------------------------
-
-def test_a_leg_checked_out_away_from_its_pin_is_reported_once(atlas, home):
-    """Moved but not pinned — and reported on the LEG's row only: the root's
-    porcelain would also show ` M spec`, which is the same fact twice."""
-    leg = atlas / "spec"
-    git("checkout", "-q", "HEAD~1", cwd=leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - checked out at " in result.stdout
-    assert ": moved but not pinned (scripts/bump-leg.py)" in result.stdout
-    assert "dirty" not in result.stdout, (
-        "the moved leg must not be counted again as a dirty root")
-    assert "1 finding(s) in 2 repositories" in result.stdout
-
-
-def test_a_leg_on_a_feature_branch_at_its_pin_is_a_finding(atlas, home):
-    """AGENTS.md rule 1: `resume` refuses a root whose LEG sits on a feature
-    branch, because that root's own `make bootstrap` would walk the leg back.
-    The superproject looks clean in that state — which is why the leg's row
-    has to say it, pin or no pin — while a leg detached at its pin (every
-    fresh clone) and a leg on its tracking branch are both not findings."""
-    leg = atlas / "spec"
-    git("checkout", "-q", "-b", "001-leg-work", cwd=leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - on branch 001-leg-work, not main (`resume` refuses a root "
-            "whose leg sits on a feature branch)") in result.stdout
-    assert ("    - branch 001-leg-work: never pushed; no commit of its own yet "
-            "(no upstream branch)") in result.stdout, (
-        "the branch itself is read too, as it is in a root")
-    assert "moved but not pinned" not in result.stdout, "it is AT the pin"
-    assert "dirty" not in result.stdout, "the superproject looks clean"
-    assert "2 finding(s) in 2 repositories" in result.stdout
-
-    git("checkout", "-q", "main", cwd=leg)
-    git("branch", "-q", "-D", "001-leg-work", cwd=leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-
-
-def test_a_leg_off_its_own_declared_branch_is_a_finding_that_names_it(
-        home, tmp_path):
-    """#235: the leg's row declares `branch: develop`, which `make bootstrap`
-    places it on instead of the root's `tracking_branch`, so a leg sitting on
-    `main` — the ROOT's branch, and at its pin — is the leg `resume` refuses.
-    The finding names `develop`, says it is the leg's own, and the row and the
-    reads under it are about `develop`, not `main`."""
-    base = tmp_path / "own-branch-remotes"
-    base.mkdir()
-    root = clone_root(home, seed_root_with_leg(base, "Atlas", "develop"),
-                      "Atlas")
-    leg = root / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"  leg    develop {leg}" in result.stdout, (
-        "the leg's row names the branch the leg is read against")
-    assert ("    - on branch main, not develop, the `branch:` this leg's own "
-            "row declares in project.yaml (`resume` refuses a root whose leg "
-            "sits on any other branch, because `make bootstrap` would move "
-            "it)") in result.stdout
-    assert "not main" not in result.stdout
-    assert "1 finding(s) in 2 repositories" in result.stdout
-
-
-def test_a_leg_on_its_own_declared_branch_is_not_a_finding(home, tmp_path):
-    """The other direction of #235: a leg on the `branch:` its row declares is
-    where `make bootstrap` leaves it, not "on branch develop, not main"."""
-    base = tmp_path / "own-branch-remotes"
-    base.mkdir()
-    root = clone_root(home, seed_root_with_leg(base, "Atlas", "develop"),
-                      "Atlas")
-    leg = root / "spec"
-    git("checkout", "-q", "-b", "develop", "origin/develop", cwd=leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "on branch" not in result.stdout, result.stdout
-    assert ("    at its pin, which is origin/develop's tip as of the last "
-            "fetch; clean") in result.stdout
-    assert "0 finding(s) in 2 repositories" in result.stdout
-
-
-def test_a_pin_behind_its_legs_origin_after_the_leg_fetched(atlas, home,
-                                                             status_remotes):
-    leg = atlas / "spec"
-    push_from_elsewhere(status_remotes["base"],
-                        status_remotes["Atlas"]["leg_bare"], "legbehind")
-    before = run(STATUS, "Atlas", home=home)
-    assert before.returncode == 0, before.stdout + before.stderr
-
-    git("fetch", "-q", "origin", cwd=leg)
-    after = run(STATUS, "Atlas", home=home)
-    assert after.returncode == 1, after.stdout + after.stderr
-    assert "    - pin " in after.stdout
-    assert (" is 1 commit(s) behind origin/main, as of the last fetch"
-            in after.stdout)
-    assert "moved but not pinned" not in after.stdout, (
-        "the checkout is still AT the pin; only the pin is stale")
-
-
-def test_a_pin_on_a_commit_the_leg_never_pushed(atlas, home):
-    """`bump-leg` ran, the leg did not push: the root now pins a commit
-    origin/main does not have. Two findings, one per repository."""
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    (leg / "local.md").write_text("leg work\n", encoding="utf-8")
-    commit_all(leg, "leg work not pushed")
-    git("add", "spec", cwd=atlas)
-    git("-c", "user.name=t", "-c", "user.email=t@t", "commit", "-qm",
-        "pin the leg's new commit", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - ahead of origin/main by 1 commit(s): unpushed" in result.stdout
-    assert " is not on origin/main: 1 commit(s) unpushed in the leg" \
-        in result.stdout
-    assert "2 finding(s) in 2 repositories" in result.stdout
-
-
-def test_a_leg_declared_and_not_mounted_is_a_finding(home, status_remotes):
-    root = home / "projects" / "Atlas"
-    git("clone", "-q", str(status_remotes["Atlas"]["bare"]), str(root),
-        cwd=home / "projects")  # no --recurse-submodules: spec/ is empty
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"leg    main   {root / 'spec'}" in result.stdout
-    assert ("    - declared in .gitmodules and not mounted (`make bootstrap` "
-            "places it)") in result.stdout
-
-
-def test_a_leg_whose_submodule_name_carries_a_space_is_one_leg_and_a_valueless_key_none(
-        atlas, home):
-    """`.gitmodules` read with `git config -z`: the leg under
-    `[submodule "sp ace"]` is still the one leg at `spec`, and a key with no
-    value beside it is not a phantom leg declared and never mounted."""
-    git("config", "--file", ".gitmodules", "--rename-section",
-        "submodule.spec", "submodule.sp ace", cwd=atlas)
-    with (atlas / ".gitmodules").open("a", encoding="utf-8") as handle:
-        handle.write('[submodule "empty"]\n\tpath\n')
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr  # .gitmodules is dirty
-    assert result.stdout.count("  leg    main   ") == 1, result.stdout
-    assert f"  leg    main   {atlas / 'spec'}" in result.stdout
-    assert "ace.path" not in result.stdout
-    assert "submodule.empty.path" not in result.stdout
-    assert "declared in .gitmodules and not mounted" not in result.stdout
-
-
-# --- a family ---------------------------------------------------------------
-
-@NEEDS_UPSTREAM
-def test_a_family_reads_the_holder_and_each_working_clone_and_names_a_missing_one(
-        estate, home):
-    """The holder, then each member's working clone beside it — the same rows
-    `park`'s report reads — and a member with NO working clone is a finding
-    rather than a silent skip: the estate as recorded is not all here."""
-    result = run(STATUS, FAMILY, home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"holder main   {estate['holder']}" in result.stdout
-    for name in MEMBERS:
-        assert f"root   main   {estate['siblings'][name]}" in result.stdout
-    assert "0 finding(s) in 3 repositories" in result.stdout
-
-    rmtree(estate["siblings"]["Bravo"])
-    result = run(STATUS, FAMILY, home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - not here: no working clone beside the holder (`resume "
-            f"{FAMILY}` places it)") in result.stdout
-    assert "1 finding(s) in 3 repositories" in result.stdout
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("folder", [QUILL, QUILL_DISPLAY],
-                         ids=["repository", "name"])
-def test_a_family_folder_is_read_by_its_repository_name_or_its_display_name(
-        named_apart, remotes, home, folder):
-    """#236: one `family.yaml` (`name: "QuillWorks"`, `repository:
-    testorg/Quill`), laid out in the folder openRepoShape v1.1.0 prescribes —
-    its repository's last part, opensoft/openRepoShape#629 — and in the one
-    `status` required before it, the display name. Both are one estate: the
-    holder, then each member's working clone beside it."""
-    quill = clone_quill_estate(named_apart, remotes, home, folder)
-    result = run(STATUS, folder, home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "no estate named" not in result.stderr
-    assert f"holder main   {quill['holder']}" in result.stdout
-    for name in MEMBERS:
-        assert f"root   main   {quill['siblings'][name]}" in result.stdout
-    assert "0 finding(s) in 3 repositories" in result.stdout
-
-
-@NEEDS_UPSTREAM
-def test_one_family_laid_out_twice_is_a_finding_that_names_the_folder_to_keep(
-        named_apart, remotes, home):
-    """#243, item 2. `Quill/Quill` and `QuillWorks/QuillWorks` are two
-    directories, so each is found by its own name and both are estates —
-    and they are ONE record, because `park.sh` files a family under its
-    `family.yaml` `id:` and each member's block under the member's id, so a
-    park from either replaces the member blocks the other parked. Nothing
-    de-duplicates them; `status` says so on the holder's row, read-only,
-    naming both folders and the one to keep: the folder named for the
-    repository, v1.1.0's layout. One layout is no finding at all."""
-    quill = clone_quill_estate(named_apart, remotes, home, QUILL)
-    result = run(STATUS, QUILL, home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "laid out" not in result.stdout
-    assert "0 finding(s) in 3 repositories" in result.stdout
-
-    works = clone_quill_estate(named_apart, remotes, home, QUILL_DISPLAY)
-    finding = (f"    - family `quill` is laid out 2 times under the projects "
-               f"directory, at {quill['folder']} and {works['folder']}: ONE "
-               "record holds it")
-    keep = (f"Keep {quill['folder']}, the folder named for its repository "
-            "(openRepoShape v1.1.0's layout")
-    for folder, holder in ((QUILL, quill["holder"]),
-                           (QUILL_DISPLAY, works["holder"])):
-        result = run(STATUS, folder, home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        holder_row = f"  holder main   {holder}\n"
-        assert holder_row + finding in result.stdout, result.stdout
-        assert keep in result.stdout
-        assert "1 finding(s) in 3 repositories" in result.stdout
-
-
-@pytest.mark.parametrize("shape", [
-    ("Elsewhere", "Other", f"{ORG}/Other", None),
-    (ORG, "Other", f"{ORG}/Quill/Other", None),
-    ("Quill", "Other", None, None),
-    ("Quill", "Other", None, f"{ORG}/Quill"),
-], ids=["neither-name-nor-repository",
-        "an-earlier-part-of-the-repository", "no-repository-and-another-name",
-        "only-a-members-repository-ends-in-the-folder"])
-def test_a_family_folder_that_is_neither_name_is_still_not_an_estate(home,
-                                                                    shape):
-    """The repository arm must not widen past the LAST part of `repository:`,
-    a missing key must not read as a name, and a MEMBER's own `repository:`
-    (indented) is never the holder's: those folders are directories called
-    that, exactly as they were before."""
-    folder, name, repository, member_repository = shape
-    probe_family_two_names(home / "projects", folder, name=name,
-                           repository=repository,
-                           member_repository=member_repository)
-    result = run(STATUS, folder, home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"no estate named '{folder}'" in result.stderr
-
-
-def test_a_family_folder_named_for_its_repository_wins_over_a_standalone_root(
-        home):
-    """The holder drives the members, so where a family whose `name:` differs
-    shares its folder with a `project.yaml`, `status` reads the family."""
-    projects = home / "projects"
-    holder = probe_family_two_names(projects, QUILL, name=QUILL_DISPLAY,
-                                    repository=f"{ORG}/{QUILL}")
-    probe_project(projects, QUILL, at=projects / QUILL)
-    result = run(STATUS, QUILL, home=home)
-    assert result.returncode != 2, result.stdout + result.stderr  # 1: findings
-    assert "no estate named" not in result.stderr, result.stderr
-    assert (f"status: {QUILL} - the family holder at {holder}"
-            in result.stdout), result.stdout + result.stderr
-    assert "the assembly root" not in result.stdout
-
-
-# --- every estate ------------------------------------------------------------
-
-@pytest.mark.parametrize("flag", ["--all", "-a"])
-def test_all_reads_every_estate_in_name_order_with_a_summary(home,
-                                                             status_remotes,
-                                                             flag):
-    clone_root(home, status_remotes["Atlas"], "Borealis")
-    atlas = clone_root(home, status_remotes["Atlas"], "Atlas")
-    result = run(STATUS, flag, home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "status --all: reading every estate under" in result.stdout
-    assert result.stdout.index("=== status Atlas ===") < \
-        result.stdout.index("=== status Borealis ===")
-    assert "  in sync    Atlas" in result.stdout
-    assert "  in sync    Borealis" in result.stdout
-    assert ("status: 2 estate(s) in sync, 0 with findings; nothing was "
-            "changed.") in result.stdout
-
-    (atlas / "dirty.txt").write_text("x\n", encoding="utf-8")
-    result = run(STATUS, flag, home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "  findings   Atlas (1)" in result.stdout
-    assert "  in sync    Borealis" in result.stdout
-    assert "status: 1 estate(s) in sync, 1 with findings" in result.stdout
-
-
-def test_bare_status_outside_every_estate_reads_them_all_without_asking(
-        home, status_remotes):
-    """Unlike `park`, whose bare form asks before a sweep that WRITES: a read
-    changes nothing, so the answer to "which estate did you mean" is all of
-    them, and `run` hands it a pipe for stdin — nothing may be asked."""
-    clone_root(home, status_remotes["Atlas"], "Atlas")
-    result = run(STATUS, home=home, cwd=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "status: no estate around" in result.stdout
-    assert "reading every estate under" in result.stdout
-    assert "[y/N]" not in result.stdout + result.stderr
-    assert "=== status Atlas ===" in result.stdout
-
-
-def test_bare_status_inside_an_estate_reads_only_that_one(home,
-                                                          status_remotes):
-    clone_root(home, status_remotes["Atlas"], "Borealis")
-    atlas = clone_root(home, status_remotes["Atlas"], "Atlas")
-    result = run(STATUS, home=home, cwd=atlas / "spec")
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"status: Atlas - the assembly root at {atlas}" in result.stdout
-    assert "Borealis" not in result.stdout
-    assert "reading every estate" not in result.stdout
-
-
-# --- refusals, and the one promise ------------------------------------------
-
-def test_refusals_read_nothing(home, status_remotes):
-    atlas = clone_root(home, status_remotes["Atlas"], "Atlas")
-    both = run(STATUS, "Atlas", "--all", home=home)
-    assert both.returncode == 2 and "both <Name> ('Atlas') and --all" in both.stderr
-    unknown = run(STATUS, "--dry-run", home=home)
-    assert unknown.returncode == 2 and "does not know --dry-run" in unknown.stderr
-    assert "-- --dry-run" not in unknown.stderr, "there is no extension to pass to"
-    nope = run(STATUS, "Nope", home=home)
-    assert nope.returncode == 2 and "no estate named 'Nope'" in nope.stderr
-    # A MISSING VALUE IS THIS COMMAND'S refusal, exit 2 — not bash's `${2:?}`
-    # message and exit 1, which is what `status` means by "findings".
-    valueless = run(STATUS, "--repo", home=home)
-    assert valueless.returncode == 2, valueless.stdout + valueless.stderr
-    assert "REFUSED: --repo needs a value" in valueless.stderr
-    # AN EMPTY VALUE IS THE SAME REFUSAL, and these two arms never went
-    # through `${2:?…}` at all: they have been arity-only since this file's
-    # first commit, so Copilot's review of #14 — which caught exactly this in
-    # `park` and `resume`, where `[ $# -ge 2 ]` had just replaced `${2:?…}` —
-    # never had `status` in front of it. RUN FROM INSIDE THE ESTATE, which is
-    # what makes it bite: before the fix the empty slug fell past the
-    # `--repo` branch of the resolver into the walk-up, and Atlas was read
-    # and reported as though `--repo` had never been typed. Nothing is
-    # printed at all now — the refusal is raised in the argument loop, before
-    # the estate is resolved and before the first `say` — so an empty stdout
-    # is the proof that the fallback was never reached.
-    empty = [(flag, run(STATUS, flag, "", home=home, cwd=atlas))
-             for flag in ("--repo", "--name", "--project")]
-    for flag, result in empty:
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"REFUSED: {flag} needs a value" in result.stderr
-        assert "${2:?" not in result.stderr
-        assert "parameter null or not set" not in result.stderr
-        assert "line " not in result.stderr, "bash's own message leaked"
-        assert result.stdout == "", (
-            "nothing may be resolved, said or read before an empty value is "
-            f"refused; stdout was {result.stdout!r}")
-    # AND A FLAG IS NOT A VALUE EITHER. `status --repo --fetch` set the slug
-    # to `--fetch` and left the flag unset, so the one thing the person asked
-    # for — a CURRENT answer — was the one thing that did not happen, and the
-    # refusal that followed was about a repository nobody named. The refusal
-    # is now the arm's own, and it names the spelling that does take a value
-    # beginning with `-`.
-    flagged = [(flag, run(STATUS, flag, "--fetch", home=home, cwd=atlas))
-               for flag in ("--repo", "--name", "--project")]
-    for flag, result in flagged:
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"REFUSED: {flag} needs a value:" in result.stderr
-        assert "`--fetch` begins with a `-`" in result.stderr
-        assert f"{flag}=--fetch" in result.stderr
-        assert result.stdout == "", (
-            "nothing may be read before a flag given a flag is refused; "
-            f"stdout was {result.stdout!r}")
-    for result in (both, unknown, nope, valueless,
-                   *(r for _, r in empty), *(r for _, r in flagged)):
-        assert str(atlas) not in result.stdout, "a refusal read nothing"
-
-
-def test_a_flag_takes_its_value_after_an_equals_sign_too(home, status_remotes):
-    """`--flag=value` IS `--flag value` here too, and `--flag=` is empty.
-
-    `status` has no verb to run, so what the `=` spelling has to prove is that
-    the value RESOLVES THE ESTATE: `--name=Atlas`, and `--repo=` the origin
-    of the clone, both read Atlas from a directory that is not inside it, so
-    the walk-up cannot be what answered. Before this they reached the
-    catch-all — "status does not know --name=Atlas" — which is why refusing a
-    `-`-led value needed this spelling in the same commit.
-    """
-    atlas = clone_root(home, status_remotes["Atlas"], "Atlas")
-    # The origin is re-spelled as the url a real root carries, because a clone
-    # whose origin is a bare repository ON DISK answers `<Name>` and the
-    # walk-up but never `--repo` — `test_park_resume_commands.py` re-spells it
-    # for the same reason.
-    git("remote", "set-url", "origin", f"https://github.com/{ORG}/Atlas.git",
-        cwd=atlas)
-    for spelling in ("--name=Atlas", "--project=Atlas", f"--repo={ORG}/Atlas"):
-        result = run(STATUS, spelling, home=home, cwd=home)
-        assert result.returncode == 0, (
-            f"{spelling}: {result.stdout}{result.stderr}")
-        assert f"status: Atlas - the assembly root at {atlas}" in result.stdout
-        assert "reading every estate" not in result.stdout, (
-            f"{spelling} fell past the arm into the bare form")
-
-    for spelling in ("--name=", "--project=", "--repo="):
-        result = run(STATUS, spelling, home=home, cwd=atlas)
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert f"REFUSED: {spelling[:-1]} needs a value:" in result.stderr
-        assert result.stdout == "", (
-            f"nothing may be read before `{spelling}` is refused; stdout was "
-            f"{result.stdout!r}")
-
-    # A VALUE THAT REALLY DOES BEGIN WITH `-` IS SAYABLE, which is the reason
-    # the spelling exists: read as a name, not as the flag it looks like.
-    weird = run(STATUS, "--name=--fetch", home=home, cwd=home)
-    assert weird.returncode == 2, weird.stdout + weird.stderr
-    assert "no estate named '--fetch'" in weird.stderr
-    assert "needs a value" not in weird.stderr
-
-
-def test_a_git_that_cannot_run_is_refused_not_reported(atlas, home, tmp_path):
-    """Every git call is `|| true`-guarded so a missing ref is a finding, not
-    a crash — so a git that refuses EVERY command would otherwise come back as
-    an estate with no commits, no branch and no legs, exit 1, and nothing to
-    say that nothing was read. A shim that rejects `--no-optional-locks`, the
-    way a git older than 2.15 does, has to be refused by name instead."""
-    shim = tmp_path / "shim"
-    shim.mkdir()
-    (shim / "git").write_text("#!/bin/sh\nexit 129\n", encoding="utf-8")
-    (shim / "git").chmod(0o755)
-    result = run(STATUS, "Atlas", home=home,
-                 env={"PATH": f"{shim}:{os.environ['PATH']}"})
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "does not know `--no-optional-locks`" in result.stderr
-    assert "no commits at all" not in result.stdout + result.stderr
-    assert "finding(s)" not in result.stdout, "nothing may be reported"
-
-
-def test_no_estate_anywhere_refuses(home):
-    result = run(STATUS, home=home)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "nothing to read" in result.stderr
-    everything = run(STATUS, "--all", home=home)
-    assert everything.returncode == 2
-    assert "--all found no estate under" in everything.stderr
-
-
-# --- --fetch: the second layer ------------------------------------------------
-#
-# Brett Heap's RULING of 2026-09-11, verbatim: "next layer: --fetch".
-
-FETCHED = ("fetched first (--fetch): origin — and upstream, where a fork has "
-           "one — is asked in every repository below, then it is read.")
-FETCH_CLAUSE = "only remote-tracking refs and fetched objects were changed (--fetch)."
-
-
-def local_state(repo: Path) -> str:
-    """Everything `--fetch` must leave alone: local branches, HEAD, the
-    porcelain and the stash list. NOT the remote-tracking refs — moving those
-    is the one thing a fetch is for."""
-    heads = git("for-each-ref", "refs/heads", cwd=repo).stdout
-    head = git("rev-parse", "HEAD", cwd=repo).stdout
-    porcelain = git("status", "--porcelain", "--ignore-submodules=none",
-                    cwd=repo).stdout
-    stash = git("stash", "list", cwd=repo).stdout
-    return heads + head + porcelain + stash
-
-
-def test_fetch_makes_behind_visible_and_says_what_moved(atlas, home,
-                                                        status_remotes):
-    """The caveat's other half: with `--fetch`, the commit that landed on
-    origin from another workstation is seen in one run, the report says which
-    ref moved and from where, and the footer says what was changed."""
-    push_from_elsewhere(status_remotes["base"], status_remotes["Atlas"]["bare"],
-                        "fetchme")
-    was = git("rev-parse", "origin/main", cwd=atlas).stdout.strip()[:7]
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert FETCHED in result.stdout
-    assert CAVEAT not in result.stdout
-    assert f"    fetched origin: origin/main moved {was} -> " in result.stdout
-    assert ("    - behind origin/main by 1 commit(s), as of the last fetch"
-            in result.stdout)
-    assert "    fetched origin: nothing new on origin/main" in result.stdout, (
-        "the leg was fetched too, and had nothing new")
-    assert FETCH_CLAUSE in result.stdout
-    assert "nothing was changed." not in result.stdout
-
-    plain = run(STATUS, "Atlas", home=home)
-    assert plain.returncode == 1, "the fetch persisted: a plain run knows too"
-    assert "- behind origin/main by 1 commit(s)" in plain.stdout
-
-
-def test_fetch_changes_remote_tracking_refs_and_nothing_else(atlas, home,
-                                                             status_remotes):
-    """THE ONE WRITE, bounded: origin/main moves; no local branch, HEAD,
-    index entry, working-tree path or stash does — in the root or the leg."""
-    leg = atlas / "spec"
-    push_from_elsewhere(status_remotes["base"], status_remotes["Atlas"]["bare"],
-                        "moveorigin")
-    (atlas / "dirty.txt").write_text("x\n", encoding="utf-8")
-    (atlas / "README.md").write_text("changed\n", encoding="utf-8")
-    git("stash", "-q", cwd=atlas)
-    git("branch", "001-a-thing", cwd=atlas)
-    before = local_state(atlas) + local_state(leg)
-    remote_was = git("rev-parse", "origin/main", cwd=atlas).stdout
-
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert local_state(atlas) + local_state(leg) == before
-    assert git("rev-parse", "origin/main", cwd=atlas).stdout != remote_was, (
-        "the remote-tracking ref is what a fetch moves")
-    assert not (atlas / ".git" / "index.lock").exists()
-    # The leg's `.git` is a GITFILE; its real git dir is under the root's
-    # `.git/modules/`, which is where a lock would be.
-    leg_gitdir = Path(git("rev-parse", "--absolute-git-dir", cwd=leg).stdout.strip())
-    assert leg_gitdir.is_dir()
-    assert not (leg_gitdir / "index.lock").exists()
-
-
-def test_fetch_prunes_so_a_branch_deleted_elsewhere_reads_as_gone(
-        atlas, home, status_remotes):
-    """A merged pull request deletes the remote branch UNDER a local feature.
-    Deleted from another clone, this clone's `origin/001-a-thing` is stale
-    and a plain read sees nothing wrong; `--fetch` prunes, and the branch
-    reads as gone — which is the finding that says the worktree can go."""
-    git("checkout", "-q", "-b", "001-a-thing", cwd=atlas)
-    (atlas / "feature.md").write_text("wip\n", encoding="utf-8")
-    commit_all(atlas, "feature work")
-    git("push", "-q", "-u", "origin", "001-a-thing", cwd=atlas)
-    git("checkout", "-q", "main", cwd=atlas)
-
-    other = status_remotes["base"] / "elsewhere-delete"
-    git("clone", "-q", str(status_remotes["Atlas"]["bare"]), str(other),
-        cwd=status_remotes["base"])
-    git("push", "-q", "origin", "--delete", "001-a-thing", cwd=other)
-    rmtree(other)
-
-    plain = run(STATUS, "Atlas", home=home)
-    assert plain.returncode == 0, plain.stdout + plain.stderr
-    assert "gone" not in plain.stdout, "a stale remote-tracking ref hides it"
-
-    fetched = run(STATUS, "--fetch", "Atlas", home=home)
-    assert fetched.returncode == 1, fetched.stdout + fetched.stderr
-    assert ("    - branch 001-a-thing: its remote branch origin/001-a-thing is "
-            "gone (merged, or deleted)") in fetched.stdout
-
-
-def test_a_failed_fetch_is_a_finding_and_the_read_goes_on(atlas, home):
-    """No network, a dead URL, a password prompt nobody is there for: the
-    row says the fetch failed and is read as of the last fetch that worked;
-    the leg, whose origin is fine, is still fetched and still read."""
-    git("remote", "set-url", "origin", str(home / "nowhere" / "Atlas.git"),
-        cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - fetch failed: " in result.stdout
-    assert "as of the last fetch that worked" in result.stdout
-    # EVERY FETCH IS MADE BEFORE ANY ROW IS PRINTED, and each row still
-    # carries its own fetch's line and its own fetch's finding: the failure
-    # belongs to the root, the "nothing new" to the leg.
-    root_block, _, leg_block = result.stdout.partition("  leg    main")
-    assert "    - fetch failed: " in root_block
-    assert "    fetched origin: nothing new on origin/main" in leg_block, (
-        "the leg's fetch still ran, and its line is on the leg's row")
-    assert ("at its pin, which is origin/main's tip as of the last fetch; "
-            "clean") in result.stdout
-    assert "1 finding(s) in 2 repositories" in result.stdout
-    assert FETCH_CLAUSE in result.stdout
-
-
-def test_fetch_reaches_the_leg(atlas, home, status_remotes):
-    push_from_elsewhere(status_remotes["base"],
-                        status_remotes["Atlas"]["leg_bare"], "legmove")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    fetched origin: origin/main moved " in result.stdout
-    assert " is 1 commit(s) behind origin/main, as of the last fetch" \
-        in result.stdout
-    assert "moved but not pinned" not in result.stdout
-
-
-def test_fetch_prune_never_touches_a_local_branch_or_tag_whatever_the_config_says(
-        atlas, home, status_remotes):
-    """THE REFSPEC IS PINNED, and this is why. A leg whose `remote.origin.fetch`
-    maps heads onto LOCAL branches (a `--mirror` clone, or a hand-edited
-    config) plus `--prune` would delete a local branch that origin no longer
-    has; `fetch.pruneTags` set anywhere would delete a local tag the same way.
-    The review of this layer did exactly that through the configured form.
-    With the refspec named on the command line, neither can happen — and
-    `origin/main` still moves, so the fetch itself still did its job."""
-    leg = atlas / "spec"
-    git("config", "remote.origin.fetch", "+refs/heads/*:refs/heads/*", cwd=leg)
-    git("config", "fetch.pruneTags", "true", cwd=leg)
-    git("branch", "doomed", cwd=leg)
-    git("tag", "keepme", cwd=leg)
-    git("config", "fetch.pruneTags", "true", cwd=atlas)
-    git("tag", "keepme-too", cwd=atlas)
-    push_from_elsewhere(status_remotes["base"],
-                        status_remotes["Atlas"]["leg_bare"], "legmoved")
-    leg_main_was = git("rev-parse", "refs/heads/main", cwd=leg).stdout
-
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    branches = git("for-each-ref", "--format=%(refname:short)", "refs/heads",
-                   cwd=leg).stdout.split()
-    assert "doomed" in branches, "--prune deleted a LOCAL branch"
-    assert "main" in branches
-    # THE OTHER ROUTE: git maps every fetched ref through the CONFIGURED
-    # refspecs too ("opportunistic remote-tracking updates"), so a pinned
-    # refspec alone still moved a detached leg's local `main` under a mirror
-    # config; `--refmap` is what stops it, and this is the line that proves it.
-    assert git("rev-parse", "refs/heads/main", cwd=leg).stdout == leg_main_was, (
-        "the pinned fetch moved the leg's LOCAL main through the configured "
-        "refspec")
-    assert git("tag", cwd=leg).stdout.split() == ["keepme"], "a local tag went"
-    assert git("tag", cwd=atlas).stdout.split() == ["keepme-too"]
-    assert "    fetched origin: origin/main moved " in result.stdout, (
-        "the pinned refspec must still move the remote-tracking ref")
-    assert " is 1 commit(s) behind origin/main" in result.stdout
-
-
-def test_fetch_says_when_the_tracking_branch_is_gone_from_origin(
-        atlas, home, status_remotes):
-    """A default-branch rename on origin: `--prune` removes `origin/main`,
-    which is the right thing to do and the wrong thing to describe as
-    "nothing new". The fetch line says GONE and from what, and the finding
-    below it says origin has no such branch — not "never fetched", which
-    the line above would contradict."""
-    bare = status_remotes["Atlas"]["bare"]
-    git("branch", "-m", "main", "main2", cwd=bare)
-    git("symbolic-ref", "HEAD", "refs/heads/main2", cwd=bare)
-
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    fetched origin: origin/main is GONE (was " in result.stdout
-    assert "): deleted or renamed on origin" in result.stdout
-    assert ("    - no origin/main after the fetch: origin has no branch main "
-            "(deleted or renamed there)") in result.stdout
-    assert "never fetched" not in result.stdout
-    assert "nothing new on origin/main" in result.stdout, "the leg, untouched"
-
-
-def test_fetch_on_a_leg_whose_gitdir_is_gone_says_so(atlas, home):
-    """A gitfile pointing at a `.git/modules/<leg>` that was deleted: the
-    leg is still "mounted" by the `.git` test, every git call in it fails,
-    and the diagnosis must be the broken repository — not "add a remote"."""
-    rmtree(atlas / ".git" / "modules" / "spec")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fetch: not a readable git repository (a gitfile whose gitdir "
-            "is gone?), so nothing could be fetched") in result.stdout
-    assert "no remote named origin, so nothing could be fetched" \
-        not in result.stdout
-    plain = run(STATUS, "Atlas", home=home)
-    assert plain.returncode == 1, "and without --fetch it still does not crash"
-
-
-def test_fetch_with_no_origin_is_a_finding(atlas, home):
-    leg = atlas / "spec"
-    git("remote", "remove", "origin", cwd=leg)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fetch: no remote named origin, so nothing could be fetched"
-            in result.stdout)
-
-
-def test_fetch_with_all_fetches_every_estate(home, status_remotes):
-    clone_root(home, status_remotes["Atlas"], "Borealis")
-    clone_root(home, status_remotes["Atlas"], "Atlas")
-    result = run(STATUS, "--all", "--fetch", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert result.stdout.count("    fetched origin: nothing new on origin/main") == 4, (
-        "two roots and two legs, each fetched")
-    assert result.stdout.count(FETCHED) == 2
-    assert f"status: 2 estate(s) in sync, 0 with findings; {FETCH_CLAUSE}" \
-        in result.stdout
-
-
-# --- the fork against its upstream --------------------------------------------
-#
-# Brett Heap's RULING of 2026-09-11, verbatim: "next layer: fork against
-# upstream".
-
-def parent_ahead(base: Path, remote: dict, tag: str) -> Path:
-    """The PARENT the fork's origin was forked from, one commit ahead of it:
-    a bare copy of origin's bare, then a push to it from elsewhere."""
-    parent = base / "remotes" / f"{tag}-parent.git"
-    git("clone", "-q", "--bare", str(remote["bare"]), str(parent), cwd=base)
-    push_from_elsewhere(base, parent, tag, stem="parent-elsewhere")
-    return parent
-
-
-def github_origin(repo: Path, bare: Path, slug: str) -> None:
-    """Make `origin` LOOK like github.com while every byte still comes from
-    the bare on disk: `url.<base>.insteadOf` rewrites it for the fetch, and
-    `status` reads the CONFIGURED url to decide whom to ask about."""
-    url = f"https://github.com/{slug}.git"
-    git("config", f"url.{bare}.insteadOf", url, cwd=repo)
-    git("remote", "set-url", "origin", url, cwd=repo)
-
-
-def fake_gh(tmp_path: Path, *, failing: bool = False,
-            not_found: str | None = None,
-            not_found_prefix: str | None = None) -> tuple[dict, Path]:
-    """A fake `gh` first on PATH that answers the two calls `status` makes —
-    `api repos/<slug>` (Atlas is a fork of opensoft/Atlas, its leg is not) and
-    the compare (3 behind, 1 ahead) — printing what the `--jq` filter would,
-    fields joined by 0x1F, and logging every call. `failing` answers as a
-    `gh` nobody logged in to (exit 4, true of every repository);
-    `not_found=<slug>` answers 404 (exit 1) for THAT repository's own call
-    only, and `not_found_prefix=<slug>` for every call under it (its compare
-    too)."""
-    shim = tmp_path / "gh-shim"
-    shim.mkdir(parents=True, exist_ok=True)
-    log = tmp_path / "gh-calls.log"
-    body = f'#!/bin/sh\nprintf \'%s\\n\' "$*" >> "{log}"\n'
-    if failing:
-        body += ("printf 'To get started with GitHub CLI, please run:  gh auth "
-                 "login\\n' >&2\nexit 4\n")
-    else:
-        body += 'case "$*" in\n'
-        if not_found:
-            body += (f"*\"repos/{not_found} \"*) printf 'gh: Not Found (HTTP 404)"
-                     "\\n' >&2; exit 1 ;;\n")
-        if not_found_prefix:
-            body += (f"*\"repos/{not_found_prefix}\"*) printf 'gh: Not Found (HTTP 404)"
-                     "\\n' >&2; exit 1 ;;\n")
-        body += (
-            "*\"repos/opensoft/openRepoShape/compare/\"*) printf '0\\0374\\n' ;;\n"
-            "*\"repos/opensoft/openRepoShape \"*) printf 'main\\n' ;;\n"
-            "*\"/compare/\"*) printf '3\\0371\\n' ;;\n"
-            "*\"repos/testorg/Atlas-spec \"*) printf 'false\\037\\037\\n' ;;\n"
-            "*\"repos/testorg/Atlas \"*) printf 'true\\037opensoft/Atlas\\037main\\n' ;;\n"
-            "*) printf 'fake gh: unexpected: %s\\n' \"$*\" >&2; exit 1 ;;\n"
-            "esac\n")
-    (shim / "gh").write_text(body, encoding="utf-8")
-    (shim / "gh").chmod(0o755)
-    return {"PATH": f"{shim}{os.pathsep}{os.environ['PATH']}"}, log
-
-
-def test_a_fork_behind_its_upstream_remote_reads_from_local_refs(
-        atlas, home, status_remotes):
-    """The convention every fork guide teaches: a remote named `upstream`.
-    Before it has ever been fetched there is nothing to compare, and the
-    finding says so and names `--fetch`; after one fetch of it the drift is
-    read from local refs, as of that fetch, with no network at all."""
-    parent = parent_ahead(status_remotes["base"], status_remotes["Atlas"],
-                          "forkbehind")
-    git("remote", "add", "upstream", str(parent), cwd=atlas)
-    unfetched = run(STATUS, "Atlas", home=home)
-    assert unfetched.returncode == 1, unfetched.stdout + unfetched.stderr
-    assert ("    - fork: no upstream/main here: the upstream remote was never "
-            "fetched (`--fetch` asks it)") in unfetched.stdout
-
-    git("fetch", "-q", "upstream", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fork: origin/main is 1 commit(s) behind upstream/main, as of "
-            "the last fetch") in result.stdout
-    assert "in sync with origin/main" not in result.stdout.split("leg    main")[0], (
-        "the root row has a finding, so no in-sync line")
-    assert "1 finding(s) in 2 repositories" in result.stdout
-
-
-def test_fetch_fetches_the_upstream_remote_under_the_pinned_refspec(
-        atlas, home, status_remotes):
-    """`--fetch` asks upstream as well as origin, says so on its own line,
-    and the pinned refspec bounds that write too: a mirror-style refspec in
-    `remote.upstream.fetch` cannot make `--prune` delete a local branch."""
-    parent = parent_ahead(status_remotes["base"], status_remotes["Atlas"],
-                          "forkfetch")
-    git("remote", "add", "upstream", str(parent), cwd=atlas)
-    git("config", "remote.upstream.fetch", "+refs/heads/*:refs/heads/*",
-        cwd=atlas)
-    git("branch", "doomed", cwd=atlas)
-    main_was = git("rev-parse", "refs/heads/main", cwd=atlas).stdout
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    fetched origin: nothing new on origin/main" in result.stdout
-    assert "    fetched upstream: upstream/main is here now, at " in result.stdout, (
-        "with a mirror-style refspec configured, git would map the fetched main "
-        "onto the CHECKED-OUT local main and refuse; --refmap is what makes "
-        "this line appear")
-    assert git("rev-parse", "refs/heads/main", cwd=atlas).stdout == main_was
-    assert ("    - fork: origin/main is 1 commit(s) behind upstream/main, as of "
-            "the last fetch") in result.stdout
-    branches = git("for-each-ref", "--format=%(refname:short)", "refs/heads",
-                   cwd=atlas).stdout.split()
-    assert "doomed" in branches, "--prune on the upstream fetch deleted a LOCAL branch"
-    assert git("rev-parse", "-q", "--verify", "refs/remotes/upstream/main",
-               cwd=atlas, check=False).returncode == 0
-
-
-def test_a_fork_pushed_ahead_of_its_upstream_is_a_finding(atlas, home,
-                                                          status_remotes):
-    """The other direction: commits on the fork's `main` that the parent
-    does not have — somebody pushed to the fork's main instead of opening a
-    pull request upstream."""
-    base = status_remotes["base"]
-    parent = base / "remotes" / "forkahead-parent.git"
-    git("clone", "-q", "--bare", str(status_remotes["Atlas"]["bare"]),
-        str(parent), cwd=base)
-    push_from_elsewhere(base, status_remotes["Atlas"]["bare"], "forkahead")
-    git("remote", "add", "upstream", str(parent), cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fork: origin/main has 1 commit(s) upstream/main does not"
-            in result.stdout)
-    assert "    - behind origin/main by 1 commit(s)" in result.stdout, (
-        "the local main is behind the fork's main too, and that is read as before")
-
-
-def test_a_github_origin_with_no_upstream_remote_is_asked_only_under_fetch(
-        atlas, home, status_remotes, tmp_path):
-    """No `upstream` remote, an origin on github.com: without `--fetch`
-    nothing is asked and nothing is said; with it, `gh api` is asked once
-    per repository, a fork is a finding naming the parent and the remote to
-    add, the compare gives the counts, and a repository GitHub says is NOT a
-    fork says nothing."""
-    github_origin(atlas, status_remotes["Atlas"]["bare"], "testorg/Atlas")
-    github_origin(atlas / "spec", status_remotes["Atlas"]["leg_bare"],
-                  "testorg/Atlas-spec")
-    env, log = fake_gh(tmp_path)
-
-    plain = run(STATUS, "Atlas", home=home, env=env)
-    assert plain.returncode == 0, plain.stdout + plain.stderr
-    assert not log.exists(), "without --fetch, gh must not be asked"
-    assert "fork" not in plain.stdout
-
-    fetched = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert fetched.returncode == 1, fetched.stdout + fetched.stderr
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 3, calls
-    assert calls[0].startswith("api repos/testorg/Atlas --hostname github.com ")
-    assert calls[1].startswith(
-        "api repos/opensoft/Atlas/compare/main...testorg:main?per_page=1 "
-        "--hostname github.com ")
-    assert calls[2].startswith("api repos/testorg/Atlas-spec --hostname github.com ")
-    assert ("    - fork of opensoft/Atlas (per GitHub), and no remote named "
-            "upstream here: `git remote add upstream "
-            "https://github.com/opensoft/Atlas.git` reads the drift locally"
-            ) in fetched.stdout
-    assert ("    - fork: origin/main is 3 commit(s) behind opensoft/Atlas's main "
-            "(per GitHub)") in fetched.stdout
-    assert ("    - fork: origin/main has 1 commit(s) opensoft/Atlas's main does "
-            "not (per GitHub)") in fetched.stdout
-    assert fetched.stdout.count("fork of") == 1, "the leg is not a fork"
-    assert "    fetched origin: nothing new on origin/main" in fetched.stdout, (
-        "the insteadOf rewrite still fetched from the bare on disk")
-    assert "3 finding(s) in 2 repositories" in fetched.stdout
-
-
-def test_a_failing_gh_is_said_once_and_a_local_origin_is_never_asked(
-        atlas, home, status_remotes, tmp_path):
-    github_origin(atlas, status_remotes["Atlas"]["bare"], "testorg/Atlas")
-    github_origin(atlas / "spec", status_remotes["Atlas"]["leg_bare"],
-                  "testorg/Atlas-spec")
-    env, log = fake_gh(tmp_path, failing=True)
-    result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert result.stdout.count("    fork check: `gh api repos/testorg/Atlas` "
-                               "failed (") == 1
-    assert "gh auth login); not asked again this run" in result.stdout
-    assert result.stdout.count("fork check:") == 1, "said once, not per row"
-    assert len(log.read_text(encoding="utf-8").splitlines()) == 1
-
-    plain_origin = clone_root(home, status_remotes["Atlas"], "Borealis")
-    env2, log2 = fake_gh(tmp_path / "second")
-    result = run(STATUS, "--fetch", "Borealis", home=home, env=env2)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert not log2.exists(), "an origin that is not on github.com is never asked"
-    assert str(plain_origin) in result.stdout
-
-
-def test_a_404_on_one_repository_does_not_silence_the_others(
-        atlas, home, status_remotes, tmp_path):
-    """Not logged in (gh exit 4) is true of every repository and settles the
-    run; a 404 is true of ONE — a repository this token cannot see — and the
-    leg beside it must still be asked, or a fork nobody asked about reads as
-    clean with the one trace under a different row."""
-    github_origin(atlas, status_remotes["Atlas"]["bare"], "testorg/Atlas")
-    github_origin(atlas / "spec", status_remotes["Atlas"]["leg_bare"],
-                  "testorg/Atlas-spec")
-    env, log = fake_gh(tmp_path, not_found="testorg/Atlas")
-    result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert ("    fork check: `gh api repos/testorg/Atlas` failed (gh: Not Found "
-            "(HTTP 404)); the other repositories are still asked") in result.stdout
-    assert "not asked again this run" not in result.stdout
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 2, calls
-    assert calls[1].startswith("api repos/testorg/Atlas-spec ")
-
-
-def test_only_an_origin_whose_host_is_github_dot_com_is_asked(
-        atlas, home, status_remotes, tmp_path):
-    """`github.company.com` is somebody's GitHub Enterprise and `notgithub.com`
-    somebody else's server; the question goes to github.com, so neither is
-    asked — a match on the substring would send a private repository's name,
-    with the person's token, to a server that never had it."""
-    bare = status_remotes["Atlas"]["bare"]
-    for i, url in enumerate((
-            "https://github.company.com/testorg/Atlas.git",
-            "https://notgithub.com/testorg/Atlas.git",
-            "https://github.com.evil.example/testorg/Atlas.git",
-            "https://gitlab.com/testorg/github.com-mirror.git")):
-        git("config", "--add", f"url.{bare}.insteadOf", url, cwd=atlas)
-        git("remote", "set-url", "origin", url, cwd=atlas)
-        env, log = fake_gh(tmp_path / f"host{i}")
-        result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-        assert result.returncode == 0, url + result.stdout + result.stderr
-        assert not log.exists(), f"{url} was asked about on github.com"
-    for url in ("git@github.com:testorg/Atlas.git",
-                "ssh://git@github.com:22/testorg/Atlas.git",
-                "https://token@GitHub.com/testorg/Atlas.git"):
-        git("config", "--add", f"url.{bare}.insteadOf", url, cwd=atlas)
-        git("remote", "set-url", "origin", url, cwd=atlas)
-        env, log = fake_gh(tmp_path / url.replace("/", "_").replace(":", "_"))
-        result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-        assert log.exists(), f"{url} IS github.com and must be asked"
-        assert "fork of opensoft/Atlas" in result.stdout, url
-
-
-def test_a_github_origin_with_an_upstream_remote_is_read_locally_not_asked(
-        atlas, home, status_remotes, tmp_path):
-    github_origin(atlas, status_remotes["Atlas"]["bare"], "testorg/Atlas")
-    parent = parent_ahead(status_remotes["base"], status_remotes["Atlas"],
-                          "localfirst")
-    git("remote", "add", "upstream", str(parent), cwd=atlas)
-    env, log = fake_gh(tmp_path)
-    result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fork: origin/main is 1 commit(s) behind upstream/main, as of "
-            "the last fetch") in result.stdout
-    assert not log.exists(), "with an upstream remote the answer is local"
-
-
-# --- the shape pin --------------------------------------------------------------
-#
-# Brett Heap's RULING of 2026-09-11, verbatim: "next layer: shape-pin drift".
-
-SHAPE_SOURCE = "opensoft/openRepoShape"
-
-SHAPE_PIN_YAML = """\
-schema_version: 1
-kind: pinned_contract_manifest
-
-# shape-pin.yaml — the openRepoShape revision this project was cut from.
-# A COPY PIN, NOT A SUBMODULE PIN. EDITING A COPIED FILE IS DRIFT.
-
-pin_role: shape
-source_repository: {source}
-materialization: copied
-
-commit: "{commit}"
-revision_kind: commit
-
-digest_algorithm: sha256
-digest_definition: sorted-ls-tree-r-v1
-digests:
-  tree_sha256: "{tree}"
-
-verify_pin: scripts/validate-pins.py
-
-files:
-{rows}
-"""
-
-SHAPE_MIRROR_YAML = """\
-shape:
-  repository: {source}
-  revision_kind: commit
-  commit: "{commit}"
-  digest_algorithm: sha256
-  digest_definition: sorted-ls-tree-r-v1
-  digests:
-    tree_sha256: "{tree}"
-"""
-
-
-def fake_standard(base: Path, commits: int = 3) -> dict:
-    """A bare repository standing in for opensoft/openRepoShape, `commits`
-    commits deep on `main`, plus one commit on a branch `main` never had.
-    Returns the bare and the shas, oldest first."""
-    seed = base / "seed" / "openRepoShape"
-    seed.mkdir(parents=True)
-    git("init", "-q", "-b", "main", ".", cwd=seed)
-    shas = []
-    for i in range(commits):
-        (seed / f"shape-{i}.md").write_text(f"shape {i}\n", encoding="utf-8")
-        commit_all(seed, f"shape commit {i}")
-        shas.append(git("rev-parse", "HEAD", cwd=seed).stdout.strip())
-    git("checkout", "-q", "-b", "orphan-branch", shas[0], cwd=seed)
-    (seed / "branch.md").write_text("never on main\n", encoding="utf-8")
-    commit_all(seed, "a branch commit")
-    branch_sha = git("rev-parse", "HEAD", cwd=seed).stdout.strip()
-    git("checkout", "-q", "main", cwd=seed)
-    bare = base / "remotes" / "openRepoShape.git"
-    git("clone", "-q", "--bare", str(seed), str(bare), cwd=base)
-    return {"bare": bare, "shas": shas, "branch_sha": branch_sha}
-
-
-def standard_clone(home: Path, bare: Path) -> Path:
-    """A clone of the fake standard under the projects directory whose origin
-    is SPELLED as github.com, so `clone_with_origin` finds it by slug — with
-    the remote-tracking refs the clone made from the bare, and never fetched
-    again (the url is only a name)."""
-    clone = home / "projects" / "openRepoShape"
-    git("clone", "-q", str(bare), str(clone), cwd=home / "projects")
-    git("remote", "set-url", "origin", f"https://github.com/{SHAPE_SOURCE}.git",
-        cwd=clone)
-    return clone
-
-
-def pin_shape(root: Path, commit: str, copies: dict, *, mirror: str | None = None,
-              push: bool = True) -> None:
-    """Write the copies, the pin with their real digests, and the mirror in
-    project.yaml; commit, and push so the clone stays in sync with origin."""
-    import hashlib
-    rows = []
-    for rel, body in copies.items():
-        target = root / rel
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text(body, encoding="utf-8")
-        digest = hashlib.sha256(target.read_bytes()).hexdigest()
-        rows.append(f"  - path: {rel}\n    sha256: \"{digest}\"")
-    tree = "0" * 64
-    (root / "contracts").mkdir(exist_ok=True)
-    (root / "contracts" / "shape-pin.yaml").write_text(
-        SHAPE_PIN_YAML.format(source=SHAPE_SOURCE, commit=commit, tree=tree,
-                              rows="\n".join(rows)), encoding="utf-8")
-    manifest = root / "project.yaml"
-    text = manifest.read_text(encoding="utf-8")
-    cut = text.find("\nshape:\n")
-    if cut >= 0:
-        text = text[:cut + 1]
-    manifest.write_text(text + SHAPE_MIRROR_YAML.format(
-        source=SHAPE_SOURCE, commit=mirror or commit, tree=tree),
-        encoding="utf-8")
-    commit_all(root, "pin the shape")
-    if push:
-        git("push", "-q", "origin", "main", cwd=root)
-
-
-COPIES = {"Makefile": ".PHONY: park\npark:\n\t@echo park\n",
-          "scripts/validate-pins.py": "#!/usr/bin/env python3\nprint('ok')\n"}
-
-
-def test_a_pinned_root_with_matching_copies_says_so_and_names_what_it_did_not_read(
-        atlas, home, status_remotes):
-    """The note line every pinned root gets: what is pinned, how many copies
-    match, and — with no clone of the standard here and no `--fetch` — that
-    currency was NOT read, so "no finding" is never mistaken for "current"."""
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][-1], COPIES)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert (f"    shape: pinned at {standard['shas'][-1][:7]} of {SHAPE_SOURCE}; "
-            f"2/2 copies match their digests; currency not read (no clone of "
-            f"{SHAPE_SOURCE} with its default branch fetched under the projects "
-            f"directory; --fetch asks GitHub)") in result.stdout
-    assert "in sync with origin/main; clean" in result.stdout
-
-
-def test_an_edited_or_missing_copy_is_drift(atlas, home, status_remotes):
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][-1], COPIES)
-    (atlas / "Makefile").write_text("# edited in place\n", encoding="utf-8")
-    (atlas / "scripts" / "validate-pins.py").unlink()
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - shape copy Makefile edited in place: its sha256 is not the one "
-            "contracts/shape-pin.yaml records (drift: carry the change upstream, "
-            "never re-digest)") in result.stdout
-    assert ("    - shape copy scripts/validate-pins.py is missing; "
-            "contracts/shape-pin.yaml names it (update-shape.py check --root "
-            f"{atlas})") in result.stdout
-    assert "0/2 copies match their digests" in result.stdout
-    assert "dirty: 2 path(s)" in result.stdout, "the edits are dirty paths too, read as before"
-
-
-def test_a_mirror_naming_another_commit_is_out_of_step(atlas, home,
-                                                        status_remotes):
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][-1], COPIES, mirror=standard["shas"][0])
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - shape: project.yaml mirrors {standard['shas'][0][:7]} but "
-            f"contracts/shape-pin.yaml pins {standard['shas'][-1][:7]}: out of "
-            "step (update-shape.py moves both together)") in result.stdout
-
-
-def test_the_pin_is_read_against_a_clone_of_the_standard_under_projects(
-        atlas, home, status_remotes):
-    """Local refs, no network: a clone of the standard under the projects
-    directory, found by its origin's slug, says the pin is behind — or not on
-    `main` at all."""
-    standard = fake_standard(status_remotes["base"])
-    clone = standard_clone(home, standard["bare"])
-    pin_shape(atlas, standard["shas"][0], COPIES)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - shape pin {standard['shas'][0][:7]} is 2 commit(s) behind "
-            f"{SHAPE_SOURCE} main (per the clone at {clone}, as of its last "
-            f"fetch): update-shape.py check --root {atlas}") in result.stdout
-    assert f"against {SHAPE_SOURCE} main per a clone under the projects directory" \
-        in result.stdout
-    assert "currency not read" not in result.stdout
-
-    git("checkout", "-q", "main", cwd=atlas)
-    pin_shape(atlas, standard["shas"][-1], COPIES)
-    current = run(STATUS, "Atlas", home=home)
-    assert current.returncode == 0, current.stdout + current.stderr
-    assert "shape pin" not in current.stdout, "at main's tip there is nothing to say"
-
-    pin_shape(atlas, standard["branch_sha"], COPIES)
-    orphan = run(STATUS, "Atlas", home=home)
-    assert orphan.returncode == 1, orphan.stdout + orphan.stderr
-    assert (f"    - shape pin {standard['branch_sha'][:7]} is not on {SHAPE_SOURCE} "
-            f"main (per the clone at {clone}): a branch commit, which the "
-            "standard's squash-merge orphans") in orphan.stdout
-
-
-def test_under_fetch_with_no_clone_github_is_asked_once_about_the_pin(
-        atlas, home, status_remotes, tmp_path):
-    """No clone of the standard here: under `--fetch` the fake `gh` answers
-    the compare (0 behind, 4 ahead of the pin), the finding names the exit,
-    and without `--fetch` nothing is asked."""
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][0], COPIES)
-    env, log = fake_gh(tmp_path)
-    plain = run(STATUS, "Atlas", home=home, env=env)
-    assert plain.returncode == 0, plain.stdout + plain.stderr
-    assert not log.exists(), "without --fetch, gh must not be asked"
-    assert "currency not read" in plain.stdout
-
-    fetched = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert fetched.returncode == 1, fetched.stdout + fetched.stderr
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert calls == [
-        f"api repos/{SHAPE_SOURCE} --hostname github.com "
-        "--jq .default_branch // \"main\"",
-        f"api repos/{SHAPE_SOURCE}/compare/{standard['shas'][0]}...main?per_page=1 "
-        "--hostname github.com "
-        "--jq [(.behind_by|tostring), (.ahead_by|tostring)] | join(\"\\u001f\")",
-    ], calls
-    assert (f"    - shape pin {standard['shas'][0][:7]} is 4 commit(s) behind "
-            f"{SHAPE_SOURCE} main (per GitHub): update-shape.py check --root "
-            f"{atlas}") in fetched.stdout
-    assert f"against {SHAPE_SOURCE} main per GitHub" in fetched.stdout
-
-
-def test_a_clone_of_the_standard_is_read_before_github_even_under_fetch(
-        atlas, home, status_remotes, tmp_path):
-    """The documents promise the clone first and GitHub only when no clone
-    answered — and the first draft did the reverse under `--fetch`, spending
-    a round-trip, and a strike against gh's budget, on a question the clone
-    beside it could answer for free."""
-    standard = fake_standard(status_remotes["base"])
-    standard_clone(home, standard["bare"])
-    pin_shape(atlas, standard["shas"][0], COPIES)
-    env, log = fake_gh(tmp_path)
-    result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert not log.exists(), "the clone answered; GitHub must not be asked"
-    assert "per a clone under the projects directory" in result.stdout
-    assert " is 2 commit(s) behind " in result.stdout
-
-
-def test_one_pin_on_two_roots_is_one_question_to_github(home, status_remotes,
-                                                         tmp_path):
-    """A family's holder and members are cut from the same commit. Asking
-    GitHub once per root would be N round-trips and N strikes against the
-    budget the fork check shares; the answer about a pin serves every root
-    that carries it, while each root still names its own `--root`."""
-    standard = fake_standard(status_remotes["base"])
-    atlas = clone_root(home, status_remotes["Atlas"], "Atlas")
-    borealis = clone_root(home, status_remotes["Atlas"], "Borealis")
-    pin_shape(atlas, standard["shas"][0], COPIES)
-    pin_shape(borealis, standard["shas"][0], COPIES, push=False)
-    env, log = fake_gh(tmp_path)
-    result = run(STATUS, "--all", "--fetch", home=home, env=env)
-    assert result.returncode == 1, result.stdout + result.stderr
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 2, calls
-    assert calls[0].startswith(f"api repos/{SHAPE_SOURCE} --hostname")
-    assert "/compare/" in calls[1]
-    for root in (atlas, borealis):
-        assert (f"is 4 commit(s) behind {SHAPE_SOURCE} main (per GitHub): "
-                f"update-shape.py check --root {root}") in result.stdout
-
-
-def test_a_404_on_the_shape_question_leaves_the_fork_check_asked(
-        atlas, home, status_remotes, tmp_path):
-    """The shape check's own failure is said on its row, and the leg's fork
-    check beside it is still asked — one failure is not a settled run."""
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][0], COPIES)
-    github_origin(atlas / "spec", status_remotes["Atlas"]["leg_bare"],
-                  "testorg/Atlas-spec")
-    env, log = fake_gh(tmp_path, not_found_prefix=SHAPE_SOURCE)
-    result = run(STATUS, "--fetch", "Atlas", home=home, env=env)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert (f"    shape check: `gh api repos/{SHAPE_SOURCE}` failed (gh: Not Found "
-            "(HTTP 404)); the other repositories are still asked") in result.stdout
-    assert ("currency NOT read: no clone of opensoft/openRepoShape with its "
-            "default branch fetched under the projects directory, and GitHub "
-            "did not answer (an earlier line says why)") in result.stdout
-    calls = log.read_text(encoding="utf-8").splitlines()
-    assert len(calls) == 2, calls
-    assert calls[1].startswith("api repos/testorg/Atlas-spec "), (
-        "the leg's fork check was still asked")
-
-
-def test_a_manifest_without_a_shape_mirror_is_out_of_step(atlas, home,
-                                                          status_remotes):
-    """`update-shape.py` refuses a manifest with no `shape:` block, so a pin
-    beside one is the same half-done state as two different commits."""
-    standard = fake_standard(status_remotes["base"])
-    pin_shape(atlas, standard["shas"][-1], COPIES)
-    manifest = atlas / "project.yaml"
-    text = manifest.read_text(encoding="utf-8")
-    manifest.write_text(text[:text.index("\nshape:\n") + 1], encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - shape: project.yaml carries no `shape:` commit beside "
-            "contracts/shape-pin.yaml (update-shape.py moves both together)"
-            ) in result.stdout
-
-
-@NEEDS_UPSTREAM
-def test_a_family_holder_reads_its_pin_and_the_mirror_in_family_yaml(estate,
-                                                                    home):
-    """The holder arm: the same pin, the mirror read out of `family.yaml`
-    rather than `project.yaml`. The holder here is the real family-root
-    template's clone, which carries no pin; one is written with a mirror
-    naming another commit, and the out-of-step finding names family.yaml."""
-    import hashlib
-    holder = estate["holder"]
-    (holder / "contracts").mkdir(exist_ok=True)
-    copy = holder / "scripts" / "validate-family.py"
-    copy.write_text("#!/usr/bin/env python3\nprint('ok')\n", encoding="utf-8")
-    digest = hashlib.sha256(copy.read_bytes()).hexdigest()
-    pinned, mirrored = "1" * 40, "2" * 40
-    (holder / "contracts" / "shape-pin.yaml").write_text(
-        SHAPE_PIN_YAML.format(source=SHAPE_SOURCE, commit=pinned, tree="0" * 64,
-                              rows=f"  - path: scripts/validate-family.py\n"
-                                   f"    sha256: \"{digest}\""),
-        encoding="utf-8")
-    family_yaml = holder / "family.yaml"
-    family_yaml.write_text(
-        family_yaml.read_text(encoding="utf-8") + SHAPE_MIRROR_YAML.format(
-            source=SHAPE_SOURCE, commit=mirrored, tree="0" * 64),
-        encoding="utf-8")
-    result = run(STATUS, FAMILY, home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    shape: pinned at {pinned[:7]} of {SHAPE_SOURCE}; 1/1 copies "
-            "match their digests") in result.stdout
-    assert (f"    - shape: family.yaml mirrors {mirrored[:7]} but "
-            f"contracts/shape-pin.yaml pins {pinned[:7]}: out of step "
-            "(update-shape.py moves both together)") in result.stdout
-    assert result.stdout.count("    shape:") == 1, (
-        "the members carry no pin and say nothing about one")
-
-
-def test_a_tracking_branch_no_remote_has_is_named_after_the_fetch(
-        atlas, home, status_remotes):
-    """Three lines the first draft could print wrongly: a fetch of a remote
-    with no such branch says so rather than "nothing new"; and with upstream
-    fetched and lacking it, the fork line says "after the fetch", not "never
-    fetched (--fetch asks it)"."""
-    parent = parent_ahead(status_remotes["base"], status_remotes["Atlas"],
-                          "nodevelop")
-    git("remote", "add", "upstream", str(parent), cwd=atlas)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "tracking_branch: main", "tracking_branch: develop"), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    fetched origin: there is no origin/develop" in result.stdout
-    assert "    fetched upstream: there is no upstream/develop" in result.stdout
-    assert ("    - fork: no upstream/develop after the fetch: upstream has no "
-            "branch develop") in result.stdout
-    assert "nothing new on origin/develop" not in result.stdout
-    assert "never fetched" not in result.stdout
-
-
-def test_a_failed_upstream_fetch_is_not_blamed_on_the_person(atlas, home):
-    git("remote", "add", "upstream", str(home / "nowhere" / "parent.git"),
-        cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - fetch upstream failed: " in result.stdout
-    assert ("    - fork: no upstream/main here, and the fetch of upstream above "
-            "did not bring one") in result.stdout
-    assert "--fetch` asks it" not in result.stdout
-
-
-def test_a_root_without_a_shape_pin_says_nothing_about_one(atlas, home):
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "    shape:" not in result.stdout
-    assert "shape pin" not in result.stdout
-    assert "shape copy" not in result.stdout
-
-
-# --- the parked record against disk ---------------------------------------------
-#
-# Brett Heap's RULING of 2026-09-11, verbatim: "next layer: parked record
-# against disk".
-
-def workspace_config(home: Path) -> Path:
-    """`~/.agents/workspace.yaml` naming a workspace checkout under the fake
-    home — a plain directory: `status` reads it and never pulls it."""
-    checkout = home / "wip"
-    (checkout / "workspaces" / ORG).mkdir(parents=True, exist_ok=True)
-    agents = home / ".agents"
-    agents.mkdir(exist_ok=True)
-    (agents / "workspace.yaml").write_text(
-        f"repository: tester/wip\npath: {checkout}\n", encoding="utf-8")
-    return checkout
-
-
-def record(checkout: Path, project_id: str, *, branch: str, role: str,
-           commit: str, pushed: str | None = "true", parked_on: str = "Eagle",
-           root: str | None = None, org: str = ORG, wip_depth: int = 1) -> Path:
-    """One standalone record as `park.sh` writes one: one project, one
-    feature, one leg. `commit=""` leaves the `parked_commit:` key out, as
-    `park.sh` leaves out any key whose value is empty; `pushed=None` leaves
-    the `pushed:` KEY out the same way — which is what
-    `workspace_write_manifest` does with an empty value, and what a hand-edit
-    or a bad merge of the record leaves behind."""
-    root = root or project_id.capitalize()
-    commit_line = f"            parked_commit: {commit}\n" if commit else ""
-    pushed_line = "" if pushed is None else f"            pushed: {pushed}\n"
-    text = f"""\
-schema_version: 1
-kind: workspace-manifest
-written_by: speckit park
-projects:
-  - id: {project_id}
-    repository: {org}/{root}
-    shape: three-leg
-    root: {root}
-    tracking_branch: main
-    worktree_root: worktrees
-    parked_at: 2026-09-10T20:00:00Z
-    parked_on: {parked_on}
-    parked_by_lane: xfactory-2
-    active_feature: {branch}
-    active_feature_source: state_file
-    features:
-      - branch: {branch}
-        feature_directory: worktrees/{branch}
-        legs:
-          - role: {role}
-            remote: origin
-{commit_line}            wip: true
-            wip_depth: {wip_depth}
-{pushed_line}"""
-    (checkout / "workspaces" / org).mkdir(parents=True, exist_ok=True)
-    path = checkout / "workspaces" / org / f"{project_id}.yaml"
-    path.write_text(text, encoding="utf-8")
-    return path
-
-
-def parked_worktree(root: Path, branch: str, mount: str | None = None) -> Path:
-    """THE ONE PATH `resume.sh` READS AS A FEATURE'S WORKTREE, and the one
-    `park.sh` collects features from: `collect_legs` computes
-    `<worktree_root>/<branch>` for a single root's `repo` leg and
-    `<worktree_root>/<branch>/<leg mount>` for a three-leg one, and
-    `get_config_value`'s default for `worktree_root` is `../<root
-    folder>-worktrees` BESIDE a single root and `worktrees` INSIDE a three-leg
-    one — these fixtures carry no `.specify/extensions/git/git-config.yml` to
-    say otherwise. A worktree anywhere else is one neither verb sees, which is
-    a finding of its own; every fixture below that means "the worktree `park`
-    made" therefore puts it here."""
-    if mount is None:
-        return root.parent / f"{root.name}-worktrees" / branch
-    return root / "worktrees" / branch / mount
-
-
-def feature_worktree(repo: Path, branch: str, where: Path, *, push: bool = True) -> str:
-    """A linked worktree on a new branch with one commit, pushed so the branch
-    itself is not a finding; returns the tip sha."""
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", branch, str(where), cwd=repo)
-    (where / "feature.md").write_text("wip\n", encoding="utf-8")
-    commit_all(where, "feature work")
-    if push:
-        git("push", "-q", "-u", "origin", branch, cwd=where)
-    return git("rev-parse", "HEAD", cwd=where).stdout.strip()
-
-
-RECORD_NOTE_NONE = "parked record: none for 'atlas' under"
-
-
-def origin_has_branch(repo: Path, branch: str, at: str = "main") -> None:
-    """The branch ON ORIGIN, with a remote-tracking ref for it here and no
-    worktree and no local branch: what a `park` on another workstation leaves
-    behind for this one, and what `resume.sh`'s RR2 looks for before it
-    recreates anything. Every record whose feature is meant to be RESUMABLE
-    here needs it — since the reading below, a leg whose repository has no
-    `origin/<branch>` is a leg `resume` may refuse instead."""
-    git("push", "-q", "origin", f"{at}:refs/heads/{branch}", cwd=repo)
-    git("fetch", "-q", "origin", cwd=repo)
-
-
-def drop_from_origin(repo: Path, branch: str) -> None:
-    """The branch deleted where origin keeps it — a feature that landed, or a
-    branch deleted by mistake — and pruned here, which is the state `resume`
-    refuses at RR2."""
-    git("push", "-q", "origin", "--delete", branch, cwd=repo)
-    git("fetch", "-q", "--prune", "origin", cwd=repo)
-
-
-
-def test_no_workspace_config_is_a_note_not_a_finding(atlas, home):
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert (f"  parked record: no {home}/.agents/workspace.yaml on this machine, "
-            "so parked features are not read (`resume --workspace "
-            "<owner>/<repo>` writes it)") in result.stdout
-
-
-def test_no_record_for_the_estate_is_a_note(atlas, home):
-    checkout = workspace_config(home)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert f"  {RECORD_NOTE_NONE} {checkout}" in result.stdout
-    assert "nothing of this estate has been parked" in result.stdout
-
-
-def test_a_recorded_feature_with_no_worktree_here_names_resume(atlas, home):
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"  parked record: {path}, as of its last pull" in result.stdout
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Eagle (lane xfactory-2); active 001-a-thing") in result.stdout
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Eagle — `resume Atlas` "
-            "brings it back") in result.stdout
-    assert "1 finding(s) in 2 repositories" in result.stdout
-
-
-def test_a_worktree_at_the_parked_commit_is_in_sync(atlas, home):
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "    parked record: 1 feature(s)" in result.stdout
-    assert "parked feature" not in result.stdout
-
-
-def test_a_recorded_features_deleted_worktree_names_the_prune_then_the_resume(
-        atlas, home):
-    """`worktree list --porcelain` keeps the block of a linked worktree whose
-    directory was deleted until somebody runs `git worktree prune`. Read as a
-    worktree, the recorded feature sat at the parked commit and was therefore
-    reported CLEAN — the one answer that hides the case this layer exists for.
-
-    And the registration that is left is not nothing: `resume.sh` matches a
-    leg on the registered PATH alone, so it reads that block as already done
-    and recreates nothing, or has its `git worktree add` refused for a path
-    git still holds. So the prune comes first and the `resume` second, and
-    the bare line — which names an exit that cannot run — never appears."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    rmtree(where)           # and NO `git worktree prune`
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "001-a-thing" in porcelain, "git pruned it for us; the test is moot"
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            f"branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} — clear it with `git -C {atlas} worktree "
-            "prune`, then `resume Atlas` brings it back") in result.stdout
-    assert "no worktree on that branch here; parked" not in result.stdout
-
-
-def test_a_worktree_that_moved_on_since_it_was_parked(atlas, home):
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (where / "more.md").write_text("more\n", encoding="utf-8")
-    commit_all(where, "more work")
-    git("push", "-q", "origin", "001-a-thing", cwd=where)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): moved on since it was "
-            f"parked, 1 commit(s) after {tip[:7]} — park again before leaving"
-            ) in result.stdout
-
-
-def test_a_worktree_behind_a_newer_record_is_what_resume_refuses(atlas, home):
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    (where / "more.md").write_text("more\n", encoding="utf-8")
-    commit_all(where, "parked elsewhere, later")
-    git("push", "-q", "origin", "001-a-thing", cwd=where)
-    newer = git("rev-parse", "HEAD", cwd=where).stdout.strip()
-    git("reset", "-q", "--hard", "HEAD~1", cwd=where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=newer,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): this worktree is BEHIND "
-            f"the parked commit {newer[:7]}, parked 2026-09-10T20:00:00Z on "
-            "Falcon — the record is newer, and `resume` refuses to reset it"
-            ) in result.stdout
-
-
-# --- the path `resume` computes, and no other ------------------------------
-#
-# The independent reviewer's note of 2026-09-12, verbatim: "`worktree_on_branch`
-# (in `status`) matches any path while RR4 matches only the computed one."
-
-def path_finding(root, branch: str, at, want, wtroot, repo=None) -> str:
-    """The one line the reading below prints, for a LINKED worktree.
-
-    IT NAMES THE OUTCOME AND NOT THE CHECK since the independent review of
-    this branch, 2026-09-12: "`resume.sh` only reaches that `worktree add`
-    when the leg also clears RR3, RR2, RR1 and RR5." Run against the real
-    `resume.sh` on four twin estates the same day, an off-path worktree at
-    the parked commit is refused at the `git worktree add` ("already used by
-    worktree at …"); moved on it is RR1's divergence, behind it is RR5, and
-    with the branch gone from origin it is RR2 — the same whole-feature
-    refusal and the same exit in all of them, and a quoted sentence the
-    other end does not print in four of the five. So the line says what
-    `resume` does, and keeps the quoted `worktree add` for the state that
-    prints it."""
-    repo = repo or root
-    return (f"    - parked feature {branch} (repo leg): its worktree is at "
-            f"{at}, which is not the {want} `resume` computes for it — "
-            "`resume` matches a leg's worktree on that path alone, so it does "
-            "not read this one as already recreated and refuses the WHOLE "
-            "feature, the other legs with it, at whichever of its own checks "
-            "this leg reaches first (with the branch still at the parked "
-            "commit that is the `git worktree add` it makes last of all, "
-            "which cannot take a branch another worktree holds); `park` does "
-            "not carry it either, because it parks the features under "
-            f"{wtroot} and no others — move it where both "
-            f"look: `mkdir -p {Path(want).parent} && git -C {repo} worktree "
-            f"move {at} {want}`, which is yours to run — `worktree move` "
-            "creates no parent directory of its own")
-
-
-def test_a_worktree_off_the_computed_path_is_a_finding_not_silence(atlas, home):
-    """VERIFIED AGAINST THE EXTENSION on 2026-09-12, on a scratch single-shape
-    estate with the real scripts: with the worktree on the branch at
-    `$HOME/elsewhere/001-a-thing` rather than `worktrees/001-a-thing`, and the
-    record's `pushed: true` and its parked commit origin's tip, `resume.sh`
-    answered "Error: could not add the repo leg worktree
-    'worktrees/001-a-thing' for '001-a-thing'; that feature was NOT recreated.
-    / fatal: '001-a-thing' is already used by worktree at
-    '…/elsewhere/001-a-thing'", "REFUSED: 001-a-thing — git worktree add
-    failed", exit 2 — while `status` answered "0 finding(s) in 1 repository",
-    exit 0. The feature read as CLEAN AND PRESENT, which is the one answer
-    that hides the state this layer exists for: RR4 matches a leg on the
-    registered PATH alone, and a worktree at any other path is not that leg's."""
-    checkout = workspace_config(home)
-    where = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert path_finding(atlas, "001-a-thing", where,
-                        parked_worktree(atlas, "001-a-thing"),
-                        home / "projects" / "Atlas-worktrees") in result.stdout
-
-
-def test_the_path_reading_ends_the_leg_because_park_is_blind_to_it_too(
-        atlas, home):
-    """Every arm below that one exits through "park again", and `park.sh`
-    collects a single checkout's features through `verify_git_worktree_candidate
-    "$REPO_ROOT" "$WORKTREE_ROOT" …`, which drops every worktree outside that
-    root: run on the same scratch estate the same day, `park --dry-run`
-    answered "[specify] No open features under 'worktrees'; nothing to park.",
-    and answered "PARKED: 001-a-thing" with the worktree at the computed path.
-    So the moved-on line, whose exit is exactly that park, must not follow
-    it — and what it would have said is said on the run after the move."""
-    checkout = workspace_config(home)
-    where = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (where / "more.md").write_text("more\n", encoding="utf-8")
-    commit_all(where, "more work")
-    git("push", "-q", "origin", "001-a-thing", cwd=where)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert path_finding(atlas, "001-a-thing", where,
-                        parked_worktree(atlas, "001-a-thing"),
-                        home / "projects" / "Atlas-worktrees") in result.stdout
-    assert "moved on since it was parked" not in result.stdout
-
-
-def test_the_worktree_root_in_git_config_moves_the_path_both_verbs_use(
-        atlas, home):
-    """`worktree_root:` in `.specify/extensions/git/git-config.yml` is where
-    the other end gets it — `get_config_value "worktree_root"
-    "$DEFAULT_WORKTREE_ROOT" "SPECKIT_GIT_WORKTREE_ROOT"` — taking the LAST
-    line for the key, stripping a `#` comment only where whitespace comes
-    first, and unquoting. So the DEFAULT path is the wrong one here, and the
-    configured one is right: both halves are run, and the `worktree move`
-    between them is the very command the finding names."""
-    checkout = workspace_config(home)
-    config = atlas / ".specify" / "extensions" / "git" / "git-config.yml"
-    config.parent.mkdir(parents=True, exist_ok=True)
-    config.write_text("checkout_mode: worktree\n"
-                      'worktree_root: "wt"   # beside the legs\n',
-                      encoding="utf-8")
-    where = parked_worktree(atlas, "001-a-thing")       # the DEFAULT path
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert path_finding(atlas, "001-a-thing", where,
-                        atlas / "wt" / "001-a-thing",
-                        atlas / "wt") in result.stdout
-    (atlas / "wt").mkdir()      # `worktree move` creates no parent
-    git("worktree", "move", str(where), str(atlas / "wt" / "001-a-thing"),
-        cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert "parked feature" not in result.stdout, result.stdout
-    assert "    parked record: 1 feature(s)" in result.stdout
-
-
-def test_the_environment_override_moves_that_path_too(atlas, home):
-    """`get_config_value` reads `$SPECKIT_GIT_WORKTREE_ROOT` BEFORE the config
-    file and before the default, so a person who runs `park` and `resume` with
-    it set has their worktrees somewhere else entirely. One estate, two runs:
-    without the variable the worktree is off the path, with it the same
-    worktree IS the path, and nothing on disk moved between them."""
-    checkout = workspace_config(home)
-    where = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert path_finding(atlas, "001-a-thing", where,
-                        parked_worktree(atlas, "001-a-thing"),
-                        home / "projects" / "Atlas-worktrees") in result.stdout
-    result = run(STATUS, "Atlas", home=home,
-                 env={"SPECKIT_GIT_WORKTREE_ROOT": str(home / "elsewhere")})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "parked feature" not in result.stdout
-
-
-def test_a_three_leg_legs_worktree_is_judged_under_its_own_mount(trio, home):
-    """`collect_legs` computes `$WORKTREE_ROOT/$branch/$SHAPE_SPEC_PATH` for a
-    `spec` leg, so the feature directory itself is not that leg's worktree —
-    and a three-leg root's `worktree_root` defaults to `worktrees` INSIDE it,
-    not to the `../<folder>-worktrees` a single root gets."""
-    checkout = workspace_config(home)
-    leg = trio / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    where = trio / "worktrees" / "001-s-thing"
-    tip = feature_worktree(leg, "001-s-thing", where)
-    record(checkout, "trio", branch="001-s-thing", role="spec", commit=tip,
-           root="Trio", parked_on="Falcon")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-s-thing (spec leg): its worktree is at "
-            f"{where}, which is not the {where / 'spec'} `resume` computes "
-            "for it — ") in result.stdout
-    assert f"worktree move {where} {where / 'spec'}`" in result.stdout
-
-
-def test_the_legs_own_checkout_on_that_branch_names_no_worktree_move(
-        atlas, home):
-    """`worktree_on_branch` answers with the MAIN worktree too, and `git
-    worktree move` refuses one: "'…' is a main working tree" (git 2.43,
-    2026-09-12). Naming it would be naming an exit that does not work, which
-    is the one thing the rule at the top of `check_parked_leg` forbids — and
-    `resume` refuses a root on a feature branch in any case, which the row
-    above says in the local layer's own words."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    git("worktree", "remove", str(parked_worktree(atlas, "001-a-thing")),
-        cwd=atlas)
-    git("checkout", "-q", "001-a-thing", cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its worktree is at "
-            f"{atlas}, which is not the "
-            f"{parked_worktree(atlas, '001-a-thing')} `resume` computes for "
-            "it — ") in result.stdout
-    assert (f"and no others — {atlas} is the repo leg's OWN checkout rather "
-            "than a worktree of it, and no `worktree move` moves a main "
-            "working tree, so there is nothing here to move: neither verb "
-            "sees this feature while that checkout is on that branch"
-            ) in result.stdout
-    assert "worktree move" in result.stdout
-    assert f"worktree move {atlas}" not in result.stdout
-
-
-def test_a_feature_resume_refuses_whole_says_nothing_about_the_path(
-        atlas, home):
-    """The rule the verdict already carries: no line of a feature
-    `collect_legs` throws out may claim a refusal reached later. RR4 is never
-    reached for one, so the leg's own path is not what stops it, and the
-    feature's line — the one that names the leg that costs it — is the whole
-    answer."""
-    checkout = workspace_config(home)
-    where = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=tip)
-    text = path.read_text(encoding="utf-8")
-    path.write_text(text + "          - role: nope\n"
-                    "            remote: origin\n"
-                    f"            parked_commit: {tip}\n"
-                    "            wip: true\n"
-                    "            wip_depth: 1\n"
-                    "            pushed: true\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (nope leg): the record names a "
-            "leg this root does not mount here; `resume` maps each leg's role "
-            "onto this checkout and refuses the WHOLE feature") in result.stdout
-    assert "which is not the" not in result.stdout
-    assert "1 finding(s)" in result.stdout
-
-
-def test_a_symlinked_spelling_of_the_root_is_the_path_git_spells(atlas, home):
-    """The independent review of this branch, 2026-09-12, its first blocker,
-    verbatim: "`$root` is the estate path as `estate_walk_up "$PWD"` /
-    `$PROJECTS_DIRS` spell it — LEXICAL, symlinks intact. `$tree` is
-    `worktree_on_branch`'s answer, which comes from `git worktree list
-    --porcelain` and is ALWAYS the physical path. `resume.sh` sets
-    `REPO_ROOT="$(git rev-parse --show-toplevel)"`, which is also always
-    physical."
-
-    RUN BOTH WAYS ON ONE ESTATE the same day, with the worktree AT the
-    computed path and nothing differing but the SPELLING of the projects
-    directory — a symlink to the very same directory. `resume.sh`, run from
-    the symlinked spelling, answered "[specify] 001-a-thing (repo): worktree
-    already registered at worktrees/001-a-thing; left as it is", "RESUMED:
-    001-a-thing", exit 0; this layer answered "a directory is at
-    …/proj-link/Atlas-worktrees/001-a-thing, which is the path `resume`
-    computes for this leg", refused the WHOLE feature and named an `mv` of
-    the feature's own worktree — because `[ -e ]` follows the link where an
-    exact-string match of the registered paths cannot. A healthy feature read
-    as somebody else's obstruction is the worst answer this arm has.
-
-    THE ROOT IS RESOLVED AS FAR AS GIT RESOLVES IT AND NO FURTHER, which is
-    the test below this one."""
-    checkout = workspace_config(home)
-    at = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", at)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "parked feature" not in result.stdout
-    link = home / "proj-link"
-    link.symlink_to(home / "projects", target_is_directory=True)
-    result = run(STATUS, "Atlas", home=home, env={"PROJECTS_DIR": str(link)})
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "parked feature" not in result.stdout
-    assert f"root   main   {link / 'Atlas'}" in result.stdout
-
-
-def test_a_symlinked_worktree_root_is_a_miss_at_both_ends(atlas, home):
-    """AND NO FURTHER THAN GIT, which is the other half of the blocker above:
-    `get_config_value` does not resolve `worktree_root:` and
-    `resolve_path_from_repo_root` is `os.path.abspath`, which resolves no
-    symlink either. So where the WORKTREE ROOT is a symlink `collect_legs`
-    computes the unresolved path, `git worktree list` reports the resolved
-    one, and RR4 misses at the other end exactly as it misses here.
-
-    Run against the extension on 2026-09-12 with `worktree_root: wtlink`
-    pointing at a directory elsewhere and the worktree added through the
-    link: `resume.sh` answered "Error: 'wtlink/001-a-thing' exists and is not
-    a registered worktree of the repo leg; that feature was NOT recreated …
-    Move it aside", "REFUSED: 001-a-thing — an unrelated path is in the way",
-    exit 2. The finding stands, and it is RR3's: resolving the root harder
-    than git does would have deleted a refusal the other end makes."""
-    checkout = workspace_config(home)
-    config = atlas / ".specify" / "extensions" / "git" / "git-config.yml"
-    config.parent.mkdir(parents=True, exist_ok=True)
-    config.write_text("checkout_mode: worktree\nworktree_root: wtlink\n",
-                      encoding="utf-8")
-    real = home / "real-wt"
-    real.mkdir()
-    (atlas / "wtlink").symlink_to(real, target_is_directory=True)
-    at = atlas / "wtlink" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", at)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): a directory is at "
-            f"{at}, which is the path `resume` computes for this leg and is "
-            "not this branch's worktree") in result.stdout
-    assert 'refused as "an unrelated path is in the way"' in result.stdout
-
-
-def test_a_registration_at_that_path_with_nothing_on_disk_wants_the_prune(
-        atlas, home):
-    """THE STATE THE COMMIT BELOW FOUND AND DID NOT TAKE: a PRUNABLE
-    registration AT the computed path for ANOTHER branch, with no directory
-    on disk. `load_git_worktrees` DROPS a prunable block, so RR4 never sees
-    it; `[ -e "$tree" ]` is false, so RR3 finds nothing; RR2, RR1 and RR5
-    pass — and the run dies at the very end, on the `git worktree add` that
-    is the last thing it does.
-
-    RUN AGAINST THE EXTENSION on 2026-09-12, on a scratch single-shape estate
-    with the real scripts: "Error: could not create the repo leg worktree
-    'worktrees/001-a-thing' from 'origin/001-a-thing'; that feature was NOT
-    recreated. / fatal: '…/worktrees/001-a-thing' is a missing but already
-    registered worktree; use 'add -f' to override, or 'prune' or 'remove' to
-    clear", "REFUSED: 001-a-thing — git worktree add failed", exit 2 — while
-    this layer said "`resume Atlas` brings it back". It is neither RR3 nor
-    RR4 and its REFUSED line is its own, and it belongs with the
-    stale-registration arms, which look for the RECORDED BRANCH and never at
-    the path: the exit is the same `worktree prune`, and after it `resume`
-    does bring the feature back."""
-    checkout = workspace_config(home)
-    want = parked_worktree(atlas, "001-a-thing")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(want), cwd=atlas)
-    rmtree(want)                # and NO `git worktree prune`
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "prunable" in porcelain, "git pruned it for us; the test is moot"
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, but a stale worktree registration for `002-other` "
-            f"is still recorded at the {want} `resume` computes for this leg, "
-            f"with nothing on disk there — clear it with `git -C {atlas} "
-            "worktree prune`, then `resume Atlas` brings it back"
-            ) in result.stdout
-
-
-def test_that_registration_is_in_the_way_of_a_move_as_well(atlas, home):
-    """AND IT OUTLIVES THE MOVE the arm above names, which is why the two are
-    one reading: with the feature's own worktree off the path AND a dead
-    registration on it, `git worktree move` refuses the destination in the
-    same words `git worktree add` refuses it — "a missing but already
-    registered worktree" (git 2.43, 2026-09-12) — so the prune comes FIRST
-    and the move second.
-
-    Run against the extension the same day on both spellings of it, the
-    registration naming another branch and the RECORDED one: each answered
-    "Error: could not add the repo leg worktree 'worktrees/001-a-thing' for
-    '001-a-thing'; that feature was NOT recreated. / fatal: '…' is a missing
-    but already registered worktree", "REFUSED: 001-a-thing — git worktree
-    add failed", exit 2 — the registration, not the branch already in use
-    elsewhere, being what the add hits first."""
-    checkout = workspace_config(home)
-    want = parked_worktree(atlas, "001-a-thing")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(want), cwd=atlas)
-    rmtree(want)                # and NO `git worktree prune`
-    where = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): its worktree is at "
-            f"{where}, which is not the {want} `resume` computes for it"
-            ) in result.stdout
-    # THE PRUNE IS IN THE COMMAND AND NOT BESIDE IT since Copilot's fifth
-    # round on #27 (2026-09-13, suppressed), verbatim: "In the `held == 2`
-    # recovery, the required destination prune appears only in the prose; the
-    # copy-pastable command is `${unlock}mkdir -p ... && git worktree move ...`
-    # and never runs `git worktree prune`. With a live off-path source and a
-    # stale destination registration, the advertised command therefore still
-    # fails at `worktree move`." Right, and it is this file's own rule: an exit
-    # a person can run is one they can paste, so every step the destination
-    # wants is in the sequence and the reason for each is behind it.
-    assert ("move it where both look: "
-            f"`git -C {atlas} worktree prune && mkdir -p {want.parent} && "
-            f"git -C {atlas} worktree move {where} {want}`, which is yours to "
-            "run — `worktree move` creates no parent directory of its own, and "
-            'it refuses a destination git still holds registered ("a missing '
-            'but already registered worktree") until the prune') in (
-        result.stdout), result.stdout
-
-
-def test_no_sibling_leg_of_an_off_path_feature_offers_resume(trio, home):
-    """THE RULE AT THE TOP OF `check_parked_leg`, applied to this reading: a
-    worktree off the computed path refuses the WHOLE feature at the other
-    end, so no line of that feature may name `resume <Name>`. A three-leg
-    record is where it shows — the `spec` leg's worktree at the feature
-    directory instead of under its own mount, and a `code` leg with no
-    worktree here at all — and the `code` leg's line said "`resume Trio`
-    brings it back" while the `spec` leg's said the feature was refused
-    whole.
-
-    Verified against the extension on 2026-09-12: with the spec leg's
-    worktree off the path, `resume.sh` refuses at the `git worktree add`
-    ("already used by worktree at …"), "REFUSED", exit 2, and recreates
-    nothing for any leg of that feature."""
-    checkout = workspace_config(home)
-    leg = trio / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    where = trio / "worktrees" / "001-s-thing"
-    tip = feature_worktree(leg, "001-s-thing", where)
-    path = record(checkout, "trio", branch="001-s-thing", role="spec",
-                  commit=tip, root="Trio", parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    path.write_text(text + leg_block("code", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "`resume Trio`" not in result.stdout, result.stdout
-
-
-# --- and what is AT that path, which is the other half of the question -----
-#
-# `resume.sh`'s RR4 second arm and RR3, the two readings the commit above
-# verified and recorded rather than took. Both refuse the WHOLE feature, both
-# are reached before RR2 reads origin, and this layer offered `resume <Name>`
-# for each.
-
-def in_the_way_finding(branch: str, role: str, what: str, at, why: str,
-                       exit_clause: str) -> str:
-    """The one line this reading prints, for the culprit leg."""
-    return (f"    - parked feature {branch} ({role} leg): {what} is at {at}, "
-            "which is the path `resume` computes for this leg and is not this "
-            "branch's worktree — `resume` reads that path and no other, "
-            "overwrites nothing it did not create, and refuses the WHOLE "
-            "feature, the other legs with it (\"… exists and is not a "
-            f"registered worktree of the {role} leg\", refused as \"{why}\"), "
-            f"so nothing here brings it back while that is there — {exit_clause}")
-
-
-def move_aside(at) -> str:
-    return (f"move it aside with `mv {at} <a path of your choosing>`, which "
-            "is yours to run — nothing here moves or deletes a path it did "
-            "not create")
-
-
-def worktree_move_aside(repo, at) -> str:
-    return (f"move it aside with `git -C {repo} worktree move {at} <a path of "
-            "your choosing>`, which is yours to run — a registered worktree "
-            "moved with `mv` leaves git holding the path it was at")
-
-
-def unlock_then_move(repo, at) -> str:
-    return ("git holds that worktree LOCKED and `worktree move` refuses a "
-            "locked one (\"cannot move a locked working tree\"), so the "
-            f"unlock comes first: `git -C {repo} worktree unlock {at}`, then "
-            f"`git -C {repo} worktree move {at} <a path of your choosing>`, "
-            "both yours to run — a registered worktree moved with `mv` "
-            "leaves git holding the path it was at")
-
-
-def move_aside_and_prune(repo, at) -> str:
-    return (f"move it aside with `mv {at} <a path of your choosing>` and "
-            "clear the stale registration git still holds for that path with "
-            f"`git -C {repo} worktree prune`, both yours to run — nothing "
-            "here moves or deletes a path it did not create, and `git "
-            "worktree add` refuses a path it is still registered at (\"a "
-            "missing but already registered worktree\")")
-
-
-def test_a_stray_path_at_the_computed_path_is_rr3_and_never_a_resume(
-        atlas, home):
-    """VERIFIED AGAINST THE EXTENSION on 2026-09-12, on a scratch single-shape
-    estate with the real scripts — a bare remote in a temp dir, a fake `$HOME`
-    — whose record carried `pushed: true` and a parked commit that was
-    origin's tip, with NO worktree for the feature here: a plain directory at
-    `worktrees/001-a-thing` answered "Error: 'worktrees/001-a-thing' exists
-    and is not a registered worktree of the repo leg; that feature was NOT
-    recreated. / Nothing here overwrites a directory it did not create. /
-    look:  git -C . worktree list / Move it aside, then re-run `make
-    resume`.", "REFUSED: 001-a-thing — an unrelated path is in the way", exit
-    2 — and a plain FILE there answered exactly the same. With nothing at that
-    path the same estate RESUMED the feature, exit 0. `status` at fd9ae96, this
-    branch's base, answered "`resume Atlas` brings it back" for both."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip())
-
-    where.mkdir(parents=True)
-    (where / "notes.md").write_text("somebody else's\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    rmtree(where)
-    where.write_text("somebody else's\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a file", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-
-def test_a_worktree_of_another_branch_at_that_path_is_rr4s_second_arm(
-        atlas, home):
-    """`leg_registered_at` matches the PATH and then tests the branch, and
-    `[ "$LEG_REGISTERED_BRANCH" = "$branch" ]` failing is RR4's second arm.
-    Run against the extension on the same estate the same day, a worktree of
-    `002-other` at `worktrees/001-a-thing` answered the same four stderr lines
-    as RR3 and "REFUSED: 001-a-thing — an unrelated worktree is in the way",
-    exit 2; a worktree with a DETACHED head there answered the same, because
-    a detached block has no `branch` line and `LEG_REGISTERED_BRANCH` is then
-    the empty string, which is no branch name either.
-
-    THE EXIT IS NOT THE STRAY PATH'S. `mv` on a registered worktree leaves
-    git holding the path it was at, and `git worktree move` is the command
-    that moves the directory and the registration together."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip())
-
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(where), cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a worktree on `002-other`",
-                              where, "an unrelated worktree is in the way",
-                              worktree_move_aside(atlas, where)) in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    git("worktree", "remove", str(where), cwd=atlas)
-    git("branch", "-q", "-D", "002-other", cwd=atlas)
-    git("worktree", "add", "-q", "--detach", str(where), "main", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo",
-                              "a worktree with a detached head", where,
-                              "an unrelated worktree is in the way",
-                              worktree_move_aside(atlas, where)) in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-
-def test_a_locked_registration_of_another_branch_names_the_unlock_not_a_move(
-        atlas, home):
-    """A block git calls `prunable` is one `load_git_worktrees` DROPS, so
-    `resume` never sees it — but it computes no `prunable` for a LOCKED one
-    (git 2.43), and `leg_registered_at` therefore matches it and RR4's second
-    arm refuses the feature. Verified against the extension on 2026-09-12:
-    with the worktree of `002-other` at `worktrees/001-a-thing` locked and its
-    `.git` deleted, it answered "REFUSED: 001-a-thing — an unrelated worktree
-    is in the way", exit 2.
-
-    AND THE EXIT IS NOT A `worktree move` THERE: the directory is no longer a
-    worktree, so what clears the registration is the unlock and the prune the
-    stale-registration arms already name — with the directory the prune
-    leaves behind moved aside, because `resume` refuses a path that exists
-    whatever git holds."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip())
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(where), cwd=atlas)
-    git("worktree", "lock", str(where), cwd=atlas)
-    (where / ".git").unlink()       # the directory stays; the worktree does not
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "prunable" not in porcelain, "git called a locked block prunable"
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding(
-        "001-a-thing", "repo", "a worktree on `002-other`", where,
-        "an unrelated worktree is in the way",
-        "the worktree it registers is not there and git holds the "
-        "registration LOCKED, which is why it calls it no `prunable` — clear "
-        f"it with `git -C {atlas} worktree unlock {where}`, then `git -C "
-        f"{atlas} worktree prune`, which is yours to run, and move aside "
-        "whatever the prune leaves behind there, which `resume` refuses for "
-        "existing whatever git holds") in result.stdout
-    assert "worktree move" not in result.stdout
-
-
-def test_a_locked_worktree_of_another_branch_puts_the_unlock_first(
-        atlas, home):
-    """RR4's second arm again, and the EXIT is the whole of what is new: git
-    holds a live worktree there LOCKED, `leg_registered_at` matches it because
-    a locked block carries no `prunable`, and the extension answered "REFUSED:
-    001-a-thing — an unrelated worktree is in the way", exit 2, on 2026-09-12.
-    `git worktree move` REFUSES a locked worktree — "fatal: cannot move a
-    locked working tree; use 'move -f -f' to override or unlock first", git
-    2.43 the same day — so the plain move this layer named at fd9ae96 is an
-    exit that does not run, and the unlock goes in front of it (run there
-    too: `unlock` then `move` exits 0)."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip())
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(where), cwd=atlas)
-    git("worktree", "lock", str(where), cwd=atlas)
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a worktree on `002-other`",
-                              where, "an unrelated worktree is in the way",
-                              unlock_then_move(atlas, where)) in result.stdout
-    assert worktree_move_aside(atlas, where) not in result.stdout
-
-
-def test_a_prunable_registration_at_that_path_names_the_prune_with_the_move(
-        atlas, home):
-    """A block git calls `prunable` is one `load_git_worktrees` DROPS, so
-    `leg_registered_at` misses it and what refuses the feature is the
-    DIRECTORY: RR3, "an unrelated path is in the way", exit 2 against the
-    extension on 2026-09-12 with a worktree of `002-other` at the computed
-    path whose `.git` had been deleted.
-
-    AND THE `mv` IS NOT THE WHOLE EXIT THERE. The registration outlives the
-    directory, and the `git worktree add` at the end of the run dies on it
-    instead — "'…' is a missing but already registered worktree; use 'add -f'
-    to override, or 'prune' or 'remove' to clear" — with the directory moved
-    aside or not (git 2.43, both spellings run the same day). So the prune is
-    named beside the move, and neither half is optional."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip())
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(where), cwd=atlas)
-    (where / ".git").unlink()       # prunable, with its directory still there
-    assert "prunable" in git("worktree", "list", "--porcelain",
-                             cwd=atlas).stdout
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside_and_prune(atlas, where)) in result.stdout
-    assert move_aside(where) not in result.stdout
-
-
-def test_a_worktree_registered_at_that_path_is_the_leg_however_many_others(
-        atlas, home):
-    """RR4's QUESTION IS THE PATH'S, AND THE BRANCH IS TESTED AFTER IT (the
-    independent review of fd9ae96, 2026-09-12, blocker 2). `leg_registered_at`
-    walks the registered paths for an exact match and only then reads the
-    branch on the block it found; `worktree_on_branch` walks the BRANCHES and
-    answers with the first live worktree holding it, which `git worktree list`
-    orders by path. Where one branch is checked out twice — `worktree add
-    --force`, the state this file's own comments already name — the two
-    answers are different worktrees, and the base read the wrong one: it
-    refused the WHOLE feature and named a `git worktree move` ONTO the very
-    worktree `resume` had just resumed the feature from. Verified against the
-    extension on 2026-09-12 with exactly this estate: "[specify] 001-a-thing
-    (repo): worktree already registered at worktrees/001-a-thing; left as it
-    is", "RESUMED: 001-a-thing", exit 0. So there is nothing to say here, and
-    the decoy's own path sorting before or after the computed one changes
-    nothing."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    decoy = home / "elsewhere" / "001-a-thing"
-    decoy.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "--force", str(decoy), "001-a-thing",
-        cwd=atlas)
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "0 finding(s)" in result.stdout
-    assert "which is not the" not in result.stdout
-    assert "which is the path `resume` computes for this leg" not in result.stdout
-
-
-def test_a_prunable_registration_on_the_recorded_branch_is_not_in_the_way(
-        atlas, home):
-    """The state the stale-registration arms already answer, and the one this
-    reading must not answer twice. `_git_worktree_finalize_record` stages a
-    block only `if [ "$prunable" = false ]`, so `leg_registered_at` never sees
-    this one and RR4 is not reached — and the prune, plus a move of the
-    directory it leaves behind, is what `resume` needs before it can recreate
-    anything, which is exactly what that line says. Two findings about one
-    path, one of them promising a `resume` and the other refusing it, is the
-    contradiction this guard exists to prevent.
-
-    AND IT IS THE LINE, NOT THE BLOCK, THAT DECIDES IT: the carve-out asks
-    `worktree_on_branch` which block it answered with, because that is the
-    one this layer prints. Put a LIVE worktree on the branch somewhere else
-    and it answers with that instead, nothing names the obstructed path at
-    all, and the reading is the only one left that does — with the prune in
-    the exit, because the dead registration is still on that path."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (where / ".git").unlink()       # prunable, with its directory still there
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            f"branch here, but a stale worktree registration for it is still "
-            f"recorded at {where}, whose path is still on disk and is no "
-            f"longer a worktree — clear it with `git -C {atlas} worktree "
-            "prune` and a move of what is there aside (`git worktree add` "
-            "refuses a path that \"already exists\"), then `resume Atlas` "
-            "brings it back") in result.stdout
-    assert "which is the path `resume` computes for this leg" not in result.stdout
-
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    elsewhere.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "--force", str(elsewhere), "001-a-thing",
-        cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside_and_prune(atlas, where)) in result.stdout
-    assert "a stale worktree registration" not in result.stdout
-
-
-def test_the_legs_own_checkout_at_that_path_names_nothing_to_move(atlas, home):
-    """`worktree list --porcelain` names the MAIN worktree too, so a root
-    whose computed worktree path is the root itself is a registration RR4
-    matches and refuses the feature for. Verified against the extension on
-    2026-09-12 on a scratch estate whose `git-config.yml` said `worktree_root:
-    ..` and whose recorded branch was named for the root folder: it answered
-    "Error: '.' exists and is not a registered worktree of the repo leg",
-    "REFUSED: Atlas — an unrelated worktree is in the way", exit 2.
-
-    `git worktree move` refuses a main working tree, so this spelling names no
-    command at all: an exit that cannot run is the one thing the rule at the
-    top of `check_parked_leg` forbids. `$SPECKIT_GIT_WORKTREE_ROOT` is the
-    override both verbs read first, which is how the fixture reaches the state
-    without a config file."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "Atlas")
-    record(checkout, "atlas", branch="Atlas", role="repo",
-           commit=git("rev-parse", "origin/Atlas", cwd=atlas).stdout.strip())
-    result = run(STATUS, "Atlas", home=home,
-                 env={"SPECKIT_GIT_WORKTREE_ROOT": str(home / "projects")})
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding(
-        "Atlas", "repo", "a worktree on `main`", atlas,
-        "an unrelated worktree is in the way",
-        f"{atlas} is the repo leg's OWN checkout rather than a worktree of "
-        "it, and no `worktree move` moves a main working tree, so there is "
-        "nothing here to move aside: while the worktree root this checkout "
-        "computes puts this feature on top of that checkout, neither verb can "
-        "do anything with it") in result.stdout
-    assert "worktree move" in result.stdout
-    assert f"worktree move {atlas}" not in result.stdout
-
-
-def test_the_reading_ends_the_leg_because_resume_never_gets_past_it(
-        atlas, home):
-    """RR3 and RR4 come before RR2 and RR1, so every arm below this one names
-    an exit `resume` never reaches. Two records prove it on one estate: a
-    branch origin has LOST, whose own line offers RR2's two exits, and a
-    record naming NO PARKED COMMIT, whose line offers a re-park — under a
-    stray directory neither is what happens, and the extension answered "an
-    unrelated path is in the way" for both on 2026-09-12."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    origin_has_branch(atlas, "001-a-thing")
-    tip = git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip()
-    where.mkdir(parents=True)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    drop_from_origin(atlas, "001-a-thing")
-    result = run(STATUS, "Atlas", "--fetch", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert "is no longer on origin in the repo leg" not in result.stdout
-
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit="")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert "names no parked commit" not in result.stdout
-
-
-def test_it_is_read_before_the_path_the_worktree_is_at_because_rr4_is_first(
-        atlas, home):
-    """The feature's own worktree somewhere else AND a stray directory at the
-    computed path: `resume` refuses at RR3 without ever reaching the `git
-    worktree add` the arm below predicts — "REFUSED: 001-a-thing — an
-    unrelated path is in the way", exit 2, against the extension on
-    2026-09-12. And the arm below would name a `git worktree move` INTO that
-    directory, which does not fail: `git worktree move` behaves like `mv` and
-    puts the worktree INSIDE an existing destination, leaving it at
-    `worktrees/001-a-thing/001-a-thing` — still where neither verb looks, and
-    now under the stray directory (git 2.43, the same day). An exit that
-    quietly misfiles the work is worse than one that refuses."""
-    checkout = workspace_config(home)
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    where = parked_worktree(atlas, "001-a-thing")
-    where.mkdir(parents=True)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-a-thing", "repo", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert "which is not the" not in result.stdout
-
-
-def test_rr6_is_read_first_so_a_no_push_record_says_what_it_always_said(
-        atlas, home):
-    """`resume.sh` tests `[ "$pushed" != true ]` at the top of the leg loop
-    and `break`s there, so no path is ever looked at for such a leg: the
-    refusal is RR6's, the exit is a park from the workstation that has the
-    WIP commit, and a stray directory here changes neither.
-
-    AND WITH A WORKTREE OFF THE PATH TOO the path-parity arm below goes quiet
-    as well, for the same stray directory and a reason of its own: the
-    `git worktree move` it names does not fail on an occupied destination, it
-    behaves like `mv` and puts the worktree INSIDE it (git 2.43, 2026-09-12).
-    An exit that quietly misfiles the work is worse than one line fewer, and
-    the line above already says what this record needs."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    where.mkdir(parents=True)
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with "
-            "--no-push on Falcon and no worktree on that branch here; only "
-            "that workstation has the WIP commit, so nothing here brings it "
-            "back — park it again from there") in result.stdout
-    assert "which is the path `resume` computes for this leg" not in result.stdout
-
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    feature_worktree(atlas, "001-a-thing", elsewhere, push=False)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with "
-            "--no-push on Falcon; only that workstation has the WIP commit, "
-            "and `resume` refuses it") in result.stdout
-    assert "which is the path `resume` computes for this leg" not in result.stdout
-    assert "which is not the" not in result.stdout
-
-
-def test_an_rr6_leg_still_says_where_its_own_worktree_sits(atlas, home):
-    """AFTER THE `pushed:` ARMS, AND NOT INSTEAD OF THEM — the claim the first
-    commit of this branch makes, met on `main` by a verdict that had not
-    existed when it was written. Since Copilot's third round on #23 a leg
-    whose `pushed:` is not `true` is RR6's refusal OF THE WHOLE FEATURE and
-    `read_record` hands that verdict down to every leg, so the test that
-    silences this arm for a feature `resume` refuses whole would have silenced
-    it here too.
-
-    IT MUST NOT. `resume.sh` tests `[ "$pushed" != true ]` at the TOP of the
-    leg loop, so RR6 IS "whichever of its own checks this leg reaches first",
-    and what this line says is true of THIS workstation whatever the record
-    says: a worktree on the recorded branch sitting where neither verb looks,
-    which `park` here does not collect either, and a `git worktree move` that
-    RUNS. The two lines answer different things and neither is the other's
-    second reading.
-
-    AND AN EARLIER LEG'S RR6 DOES SILENCE IT, which is the other half and is
-    the round's own rule: `resume` breaks at the first refusing leg in the
-    record's order, so a later leg is one the run never reaches and a line
-    about the check it would have reached first is a refusal this layer would
-    be inventing. RUN AGAINST THE EXTENSION on 2026-09-13, on a scratch
-    three-leg estate with the `code` leg recorded FIRST as `pushed: false` and
-    the `spec` leg's worktree at `$HOME/elsewhere/001-a-thing`: "Error:
-    001-a-thing (code leg) was parked with --no-push; that feature was NOT
-    recreated", "REFUSED: 001-a-thing — parked with --no-push", exit 2 — and
-    the same estate with that leg's `pushed: true`, which is the control,
-    "Error: could not add the spec leg worktree 'worktrees/001-a-thing/spec'
-    for '001-a-thing'", "REFUSED: 001-a-thing — git worktree add failed",
-    exit 2."""
-    checkout = workspace_config(home)
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    want = parked_worktree(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with "
-            "--no-push on Falcon; only that workstation has the WIP commit, "
-            "and `resume` refuses it") in result.stdout
-    assert (f"    - parked feature 001-a-thing (repo leg): its worktree is at "
-            f"{elsewhere}, which is not the {want} `resume` computes for it"
-            ) in result.stdout
-    assert f"git -C {atlas} worktree move {elsewhere} {want}" in result.stdout
-
-
-def test_a_later_leg_says_nothing_about_a_path_an_rr6_leg_beat_it_to(
-        trio, home):
-    """The other half of the test above, in the shape that needs two legs: the
-    `code` leg recorded FIRST and parked `--no-push`, the `spec` leg's worktree
-    off the path. `resume` breaks at RR6 on the first leg and never reads the
-    second, so the second says nothing about its path — the run above is the
-    proof, and so is its `pushed: true` control, which reaches the add."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    spec_tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    code_tip = git("rev-parse", "origin/001-a-thing", cwd=code).stdout.strip()
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    elsewhere.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", str(elsewhere), "001-a-thing", cwd=spec)
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit=code_tip, pushed="false", parked_on="Falcon",
-                  root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", spec_tip), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing (code leg): parked with --no-push on "
-        "Falcon and no worktree on that branch here; only that workstation "
-        "has the WIP commit, so nothing here brings it back — park it again "
-        "from there"], findings
-    assert "worktree move" not in result.stdout, (
-        "RR6 on the first leg breaks the loop before the second leg's path "
-        "is read at all")
-
-    # AND WITH THAT LEG'S `pushed: true` — the control — the run reaches the
-    # add, and this layer says so on the leg whose worktree is off the path.
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit=code_tip, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", spec_tip), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"its `spec` leg's worktree is at {elsewhere}") in result.stdout
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_no_line_of_a_feature_a_path_in_the_way_refuses_offers_resume(
-        trio, home):
-    """THE VERDICT IS THE FEATURE'S, because the refusal is. RR3 and RR4 are
-    per leg and `break` the leg loop, so one leg's obstructed path takes every
-    other leg of that feature with it — and a sibling leg with no worktree
-    here would otherwise print "`resume Trio` brings it back" beside the line
-    that says the feature is refused. `read_record`'s first pass asks the
-    question of each leg in the record's order and hands the answer down, as
-    it does for every verdict `collect_legs` makes; what is new is that this
-    one carries its own EXIT, because a park on another workstation moves
-    nothing out of this checkout's way.
-
-    The `spec` leg's worktree belongs under its own mount — `collect_legs`
-    computes `$WORKTREE_ROOT/$branch/$SHAPE_SPEC_PATH` — so the stray
-    directory goes there and not at the feature directory."""
-    checkout = workspace_config(home)
-    for leg in ("spec", "code"):
-        git("checkout", "-q", "main", cwd=trio / leg)
-        origin_has_branch(trio / leg, "001-s-thing")
-    where = parked_worktree(trio, "001-s-thing", "spec")
-    where.mkdir(parents=True)
-    tip = git("rev-parse", "origin/001-s-thing", cwd=trio / "spec").stdout.strip()
-    path = record(checkout, "trio", branch="001-s-thing", role="spec",
-                  commit=tip, root="Trio", parked_on="Falcon")
-    code_tip = git("rev-parse", "origin/001-s-thing",
-                   cwd=trio / "code").stdout.strip()
-    path.write_text(path.read_text(encoding="utf-8")
-                    + "          - role: code\n"
-                      "            remote: origin\n"
-                      f"            parked_commit: {code_tip}\n"
-                      "            wip: true\n"
-                      "            wip_depth: 1\n"
-                      "            pushed: true\n", encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert in_the_way_finding("001-s-thing", "spec", "a directory", where,
-                              "an unrelated path is in the way",
-                              move_aside(where)) in result.stdout
-    assert ("    - parked feature 001-s-thing (code leg): no worktree on that "
-            "branch here, parked 2026-09-10T20:00:00Z on Falcon; `resume` "
-            f"refuses the WHOLE feature, because a directory is at the {where} "
-            "it computes for its `spec` leg, so it does not bring this leg "
-            "back "
-            f"— {move_aside(where)}") in result.stdout
-    assert "`resume Trio` brings it back" not in result.stdout
-
-
-def test_a_feature_collect_legs_refuses_whole_says_nothing_about_that_path(
-        atlas, home):
-    """`collect_legs` is answered before any leg is read, so a feature it
-    throws out never reaches RR3 or RR4 and the path is not what stops it.
-    The verdict that wins is the one that is made first, and the line that
-    names the leg costing the feature is the whole answer."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    where.mkdir(parents=True)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + "          - role: nope\n"
-                      "            remote: origin\n"
-                      f"            parked_commit: {FAKE_SHA}\n"
-                      "            wip: true\n"
-                      "            wip_depth: 1\n"
-                      "            pushed: true\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (nope leg): the record names a "
-            "leg this root does not mount here; `resume` maps each leg's role "
-            "onto this checkout and refuses the WHOLE feature") in result.stdout
-    assert "which is the path `resume` computes for this leg" not in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-
-def test_a_leg_parked_with_no_push_is_a_finding(atlas, home):
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with --no-push "
-            "on Falcon; only that workstation has the WIP commit, and `resume` "
-            "refuses it") in result.stdout
-
-
-def test_an_unreadable_pushed_is_a_finding_where_the_worktree_is_in_sync(
-        atlas, home):
-    """The second independent review of #18, 2026-09-11, note (d): a `pushed:`
-    that is neither `true` nor `false` was read as `true` everywhere, because
-    only `= false` was ever tested. `park.sh` writes one of those two words
-    and nothing else, so this record is a hand-edit — and `resume.sh`'s RR6,
-    `[ "$pushed" != true ]`, refuses the leg for it exactly as it refuses a
-    `--no-push` one. So it is a finding of its own, as `--no-push` is, even
-    where the worktree here sits at the parked commit; and the line NAMES the
-    value rather than deciding what it must have meant."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed="maybe", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): its `pushed:` says "
-            "'maybe', which is neither true nor false, so whether its parked "
-            "commit ever left Falcon cannot be read; `resume` refuses a leg "
-            "whose `pushed:` is not true, so park it again from there to write "
-            "the record afresh") in result.stdout
-    assert "--no-push" not in result.stdout, (
-        "a --no-push claim the record does not make")
-
-    # `pushed: ""` is the empty value in quotes — `trim_unquote` takes the
-    # pair off, so it reads as the bare `pushed:` it is rather than as a
-    # value spelled with two quote characters.
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed='""', parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): its `pushed:` has no "
-            "value, which is neither true nor false, so whether its parked "
-            "commit ever left Falcon cannot be read; `resume` refuses a leg "
-            "whose `pushed:` is not true, so park it again from there to write "
-            "the record afresh") in result.stdout
-
-
-def test_a_record_with_no_pushed_key_at_all_is_a_finding_not_silence(
-        atlas, home):
-    """The independent review of #19, 2026-09-11, which recorded it there as
-    out of scope: the hole beside note (d) is larger than note (d), and this
-    is it. A leg whose record carries no `pushed:` KEY drew NOTHING — exit 0,
-    the parked-record note and no finding — because `record_rows` emitted a
-    leg's row AT its `pushed:` line and a leg without one had no row at all.
-
-    Meanwhile `workspace-common.sh`'s `workspace_load_project` — before
-    workBenches #60 (ec2b450) — seeded every leg's `MANIFEST_LEG_PUSHED` with
-    `false` at the `- role:` line and overwrote it only where a `pushed:`
-    followed (since #60 it seeds nothing and refuses a missing key for being
-    missing; the refusal and the exit are the same), so `resume.sh`'s RR6,
-    `[ "$pushed" != true ]`, REFUSED that leg in the `--no-push` words — run
-    against such a record on 2026-09-11 the extension answered "Error:
-    001-a-thing (repo leg) was parked with --no-push; that feature was NOT
-    recreated", exit 2. `status` was silent about a record `resume` will not
-    resume, which is the same family as note (d) and strictly worse: a wrong
-    line can be argued with, a missing one cannot.
-
-    That paragraph is workBenches BEFORE #60 (ec2b450). That pull request,
-    merged as 98b8bd1, stops the loader inventing `pushed: false` for an
-    absent key, and RR6 then refuses the leg in words of its own — "the
-    record has no `pushed:` for this leg", exit 2, run on 2026-09-11 against
-    its scripts. What the line below asserts is what is true under both: the
-    record does not say, `resume` refuses the leg for that, and the exit is a
-    park from the workstation that has it.
-
-    So it is a finding of its own, as `--no-push` and the unreadable value
-    are, even where the worktree here sits at the parked commit; and it names
-    what the record does not say rather than deciding what it must have
-    meant."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=tip, pushed=None, parked_on="Falcon")
-    assert "pushed" not in path.read_text(encoding="utf-8"), (
-        "the record still carries the key; the test is moot")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record has no "
-            "`pushed:` for that leg, so whether its parked commit ever left "
-            "Falcon cannot be read; `resume` refuses a leg whose record has no "
-            "`pushed:`, so park it again from there to write the record "
-            "afresh") in result.stdout
-    assert "--no-push" not in result.stdout, (
-        "a --no-push claim the record does not make")
-    assert "neither true nor false" not in result.stdout, (
-        "the reading for a value that IS there; this record has none")
-
-
-def test_an_absent_pushed_key_and_a_bare_one_are_not_the_same_finding(
-        atlas, home):
-    """Two states, not one, and the row carries them in separate fields: a
-    bare `pushed:` is PRESENT and unreadable — note (d) of the second
-    independent review of #18 — while no `pushed:` at all is the record
-    saying nothing about that leg. Both leave the value empty, so a reader
-    told only "has no value" would go looking for a line that is not there,
-    and one told only "has no `pushed:`" would miss the one that is. Each is
-    named for what it is."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed=None, parked_on="Falcon")
-    absent = run(STATUS, "Atlas", home=home)
-    assert absent.returncode == 1, absent.stdout + absent.stderr
-    assert "the record has no `pushed:` for that leg" in absent.stdout
-    assert "has no value" not in absent.stdout
-
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           pushed="", parked_on="Falcon")
-    bare = run(STATUS, "Atlas", home=home)
-    assert bare.returncode == 1, bare.stdout + bare.stderr
-    assert ("its `pushed:` has no value, which is neither true nor false"
-            in bare.stdout)
-    assert "the record has no `pushed:`" not in bare.stdout
-
-
-def test_the_absent_pushed_clause_says_the_refusal_not_the_loader(atlas, home):
-    """The independent review of workBenches #60, 2026-09-11. The clause this
-    layer carried for an absent `pushed:` — "`resume` reads a missing one as
-    not pushed and refuses it" — was the MECHANISM of one loader written into
-    this command's output: `workspace_load_project` seeded every leg's pushed
-    with `false`, so a missing key reached RR6 as `false`. #60 stops that
-    invention (the seed is the empty string, and a new
-    `MANIFEST_LEG_PUSHED_SEEN[]` keeps absent apart from bare, which is what
-    `record_rows`'s sixth field does here), and `resume` then reads a missing
-    key as NOTHING and refuses it for that, in words of its own.
-
-    A line that says HOW the other end reads the record goes stale the day
-    the other end changes; a line that says WHAT IT DOES does not. Both
-    loaders refuse the leg at the same test, `[ "$pushed" != true ]`, and
-    both leave the same exit — verified against both on 2026-09-11: main
-    answered "Error: 001-a-thing (repo leg) was parked with --no-push; that
-    feature was NOT recreated", #60's scripts "Error: 001-a-thing (repo leg):
-    the record has no `pushed:` for this leg; that feature was NOT
-    recreated", exit 2 each. So the clause names the refusal and the exit and
-    nothing else, and it must not say either loader's reading — not "as not
-    pushed", which is main's, and not `--no-push`, which is the claim the
-    record does not make."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed=None, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "`resume` refuses a leg whose record has no `pushed:`" in result.stdout
-    assert "reads a missing one as not pushed" not in result.stdout, (
-        "one loader's reading of the absent key, in a line about both")
-    assert "not pushed" not in result.stdout, (
-        "the record says nothing about the push; only the refusal is shared")
-    assert "--no-push" not in result.stdout, (
-        "a --no-push claim the record does not make")
-
-
-def test_a_registration_git_calls_prunable_is_stale_with_its_directory_there(
-        atlas, home):
-    """Delete only the worktree's `.git` file: the DIRECTORY stays, and git
-    calls the registration "prunable gitdir file points to non-existent
-    location". A `-d` test alone read that as a live worktree and, sitting at
-    the parked commit, said nothing at all — while `resume` still saw the
-    registration. Git's own verdict is the one to trust, and the exit is both
-    halves: the prune clears the registration and leaves the directory, which
-    `git worktree add` then refuses ("already exists")."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (where / ".git").unlink()       # the directory stays; the worktree does not
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "prunable" in porcelain, "git no longer says prunable; the test is moot"
-    assert where.is_dir(), "the directory is what makes this case"
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, but a stale worktree registration for it is still "
-            f"recorded at {where}, whose path is still on disk and is no "
-            f"longer a worktree — clear it with `git -C {atlas} worktree prune`"
-            " and a move of what is there aside (`git worktree add` refuses a "
-            'path that "already exists"), then `resume Atlas` brings it back'
-            ) in result.stdout
-
-
-def test_a_locked_registration_whose_git_file_is_gone_is_stale_too(atlas, home):
-    """Git computes no `prunable` for a LOCKED block, so a locked worktree
-    whose `.git` file is deleted says only `locked` while its directory sits
-    there: nothing in the porcelain calls it stale, and a directory test
-    alone called it live and the recorded feature clean. What a worktree has
-    is its own `.git`, and without it this is a leftover directory plus a
-    registration `resume` still trips on — cleared by unlock, then prune,
-    then moving the directory aside."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    git("worktree", "lock", str(where), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (where / ".git").unlink()       # locked, directory kept, worktree gone
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "\nlocked" in porcelain, "not locked; the test is moot"
-    assert "prunable" not in porcelain, "git judges a locked block now"
-    assert where.is_dir()
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} and LOCKED, which `worktree prune` skips, "
-            "whose path is still on disk and is no longer a worktree — "
-            f"clear it with `git -C {atlas} worktree unlock {where}`, then "
-            f"`git -C {atlas} worktree prune` and a move of what is there "
-            'aside (`git worktree add` refuses a path that "already exists"), '
-            "then `resume Atlas` brings it back") in result.stdout
-
-
-def test_a_locked_registration_that_is_not_a_worktree_is_not_unparked_work(
-        atlas, home):
-    """The sweep's twin of the same case: a directory with no `.git` in it is
-    not a worktree, so it was never parked work either — and `park` would
-    carry nothing if somebody ran it."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    gone = home / "Atlas-wt" / "002-unparked"
-    feature_worktree(atlas, "002-unparked", gone)
-    git("worktree", "lock", str(gone), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    (gone / ".git").unlink()        # locked, directory kept, worktree gone
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "002-unparked" not in result.stdout
-
-
-def test_the_locked_one_of_two_stale_registrations_is_the_one_named(atlas, home):
-    """`worktree add --force` is how one branch ends up with two
-    registrations. `prune` takes every UNLOCKED one with it, so the locked
-    one is what has to be named: naming the unlocked path would leave the
-    locked registration standing and `resume` still blocked, which is the
-    state the first draft's "first stale block wins" produced."""
-    checkout = workspace_config(home)
-    first = parked_worktree(atlas, "001-a-thing")
-    second = home / "Atlas-wt2" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", first)
-    git("worktree", "add", "--force", "-q", str(second), "001-a-thing", cwd=atlas)
-    git("worktree", "lock", str(second), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    rmtree(first)
-    rmtree(second)          # both gone, and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"recorded at {second} and LOCKED, which `worktree prune` skips — "
-            f"clear it with `git -C {atlas} worktree unlock {second}`, then "
-            f"`git -C {atlas} worktree prune`") in result.stdout
-    assert f"recorded at {first}" not in result.stdout, (
-        "the unlocked path, whose prune would leave the locked one standing")
-    assert f"worktree unlock {first}" not in result.stdout
-
-
-def test_a_locked_stale_registration_names_the_unlock_before_the_prune(
-        atlas, home):
-    """`git worktree prune` SKIPS a locked registration — against git 2.43,
-    `prune -v` prints nothing for one, `unlock` then `prune` removes it, and
-    `worktree remove --force` refuses it ("cannot remove a locked working
-    tree; use 'remove -f -f' to override or unlock first"). So the finding
-    that named the prune alone would have left `resume` blocked by the very
-    thing it said to clear."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    git("worktree", "lock", str(where), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    rmtree(where)           # locked, and NO `git worktree prune`
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "\nlocked" in porcelain, "the registration is not locked; the test is moot"
-    assert "prunable" not in porcelain, "git marks a locked one prunable now"
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} and LOCKED, which `worktree prune` skips — "
-            f"clear it with `git -C {atlas} worktree unlock {where}`, then "
-            f"`git -C {atlas} worktree prune`, then `resume Atlas` brings it "
-            "back") in result.stdout
-    assert f"recorded at {where} — clear it with" not in result.stdout, (
-        "the prune-only line, which cannot clear a locked registration")
-
-
-def test_a_no_push_record_with_no_worktree_here_never_names_resume(atlas, home):
-    """The two lines contradicted each other: `resume` refuses this record,
-    and then `resume Atlas` brings it back. Only the workstation that parked
-    it has the WIP commit — which is what `resume.sh` refuses the leg for — so
-    the two states are one line, and the exit is that workstation."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with --no-push "
-            "on Falcon and no worktree on that branch here; only that "
-            "workstation has the WIP commit, so nothing here brings it back — "
-            "park it again from there") in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    # The same record with a stale registration left behind: the prune is
-    # named, and `resume` still is not — there is nothing here to resume.
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    rmtree(where)           # and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with --no-push "
-            "on Falcon and no worktree on that branch here, but a stale "
-            f"worktree registration for it is still recorded at {where} — "
-            f"clear it with `git -C {atlas} worktree prune`; only that "
-            "workstation has the WIP commit, so nothing here brings it back — "
-            "park it again from there") in result.stdout
-    assert "brings it back" in result.stdout and "`resume Atlas`" not in result.stdout
-
-
-def test_an_unreadable_pushed_with_no_worktree_here_never_names_resume(
-        atlas, home):
-    """The same note, on the arm above: with no worktree here, `pushed:`
-    valueless fell past the `= false` test into "`resume Atlas` brings it
-    back" — the exit `resume.sh` refuses this record for. Whether the parked
-    commit ever left that workstation cannot be read either, so the line says
-    that instead of asserting it, and the exit is the one that works: park it
-    again from there, which writes the record afresh."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): its `pushed:` has no "
-            "value, which is neither true nor false, and no worktree on that "
-            "branch here; whether its parked commit ever left Falcon cannot be "
-            "read, and `resume` refuses a leg whose `pushed:` is not true, so "
-            "nothing here brings it back — park it again from there, which "
-            "writes the record afresh") in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    # And with a stale registration left behind: the prune is named first,
-    # exactly as it is for a `--no-push` record, and `resume` still is not.
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    rmtree(where)           # and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): its `pushed:` has no "
-            "value, which is neither true nor false, and no worktree on that "
-            "branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} — clear it with `git -C {atlas} worktree "
-            "prune`; whether its parked commit ever left Falcon cannot be "
-            "read, and `resume` refuses a leg whose `pushed:` is not true, so "
-            "nothing here brings it back — park it again from there, which "
-            "writes the record afresh") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_no_pushed_key_with_no_worktree_here_never_names_resume(atlas, home):
-    """The same pair of arms for the state the independent review of #19
-    named on 2026-09-11: with no `pushed:` key and no worktree here, the leg
-    had no row at all, so `status` said nothing — not even the `resume
-    <Name>` line the missing key would otherwise have fallen into. Now it is
-    read the way `resume.sh` judges it — RR6 is `[ "$pushed" != true ]`, and
-    an absent key is `false` to workBenches before #60 (ec2b450) and the
-    empty string under #60, neither of them `true`: nothing here brings it
-    back either way, and the exit is the workstation that parked it.
-
-    And where a stale registration is left behind, the prune is named FIRST,
-    exactly as it is for a `--no-push` record and for an unreadable value —
-    `resume` cannot recreate a worktree git still believes it has, and it is
-    not the exit here in any case."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed=None, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record has no "
-            "`pushed:` for that leg, and no worktree on that branch here; "
-            "whether its parked commit ever left Falcon cannot be read, and "
-            "`resume` refuses a leg whose record has no `pushed:`, so "
-            "nothing here brings it back — park it again from there, which "
-            "writes the record afresh") in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    # And with a stale registration left behind: the prune first, and
-    # `resume` still not named.
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    rmtree(where)           # and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record has no "
-            "`pushed:` for that leg, and no worktree on that branch here, but "
-            "a stale worktree registration for it is still recorded at "
-            f"{where} — clear it with `git -C {atlas} worktree prune`; whether "
-            "its parked commit ever left Falcon cannot be read, and `resume` "
-            "refuses a leg whose record has no `pushed:`, so nothing here "
-            "brings it back — park it again from there, which writes the "
-            "record afresh") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_record_that_names_no_parked_commit_never_names_resume(atlas, home):
-    """Note 7 of the independent review of #20, 2026-09-11, recorded there as
-    out of scope: with `pushed: true` and NO `parked_commit:` for the leg,
-    `check_parked_leg`'s `[ -n "$commit" ] || return 0` sat AFTER the
-    no-worktree arm, so the line was "no worktree on that branch here; parked
-    … — `resume Atlas` brings it back" — and the real `resume.sh` refuses that
-    record: RR6 passes on `pushed: true`, RR4 and RR3 find nothing already
-    there, RR2 finds the branch on origin, and RR1 compares origin's tip with
-    the parked commit, which an absent one never equals ("has moved since it
-    was parked", exit 2, verified against the extension the same day, with
-    the empty commit printing as a gap in its own report). Naming an exit
-    that cannot work is the one
-    thing this layer's rule forbids, so the state gets a line of its own, and
-    the exit is the park that writes the record afresh.
-
-    And where a stale registration is left behind, the prune is named FIRST,
-    exactly as it is for `--no-push` and for an unreadable `pushed:`."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit="",
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record names no "
-            "parked commit for that leg, and no worktree on that branch here; "
-            "`resume` matches origin's tip against the parked commit before it "
-            "recreates anything, an absent one never matches, and it refuses "
-            "the leg as having moved on since it was parked, so nothing here "
-            "brings it back — park it again from Falcon, which writes the "
-            "record afresh") in result.stdout
-    assert "`resume Atlas` brings it back" not in result.stdout
-
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    rmtree(where)           # and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record names no "
-            "parked commit for that leg, and no worktree on that branch here, "
-            "but a stale worktree registration for it is still recorded at "
-            f"{where} — clear it with `git -C {atlas} worktree prune`; "
-            "`resume` matches origin's tip against the parked commit before it "
-            "recreates anything, an absent one never matches, and it refuses "
-            "the leg as having moved on since it was parked, so nothing here "
-            "brings it back — park it again from Falcon, which writes the "
-            "record afresh") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_record_that_names_no_parked_commit_still_reads_the_worktree_here(
-        atlas, home):
-    """The same hole from its other side, and the half that was pure silence:
-    with a worktree on that branch here, the `return 0` skipped the three tip
-    arms — the only thing this layer says about a worktree that IS here — and
-    `status` exited 0 with nothing said about the record at all.
-
-    Those arms cannot run: there is nothing to compare the tip WITH, and the
-    empty string is not a commit — `cat-file -e "^{commit}"` fails on it, so
-    without this arm the layer would print "its parked commit  is not here",
-    a reason invented for a commit the record never named. So the line says what
-    cannot be compared and names no refusal — `resume.sh`'s RR4 calls a leg
-    whose worktree is already at the path it computes recreated and only
-    warns, "the parked WIP was NOT un-committed" — and the exit is the
-    moved-on arm's: park again, from the workstation the worktree is on.
-
-    Under `--fetch` it says the same thing, because no fetch can bring back a
-    commit the record does not name."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit="",
-           parked_on="Falcon")
-    for extra in ([], ["--fetch"]):
-        result = run(STATUS, *extra, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("    - parked feature 001-a-thing (repo leg): the record names "
-                "no parked commit for that leg, so there is nothing to read "
-                "this worktree's tip against; whether it moved on, fell behind "
-                "or diverged since it was parked cannot be told here — park "
-                "again before leaving, which writes that leg's parked commit"
-                ) in result.stdout
-        for guess in ("moved on since it was parked", "is BEHIND the parked",
-                      "diverged from the parked commit", "is not here"):
-            assert guess not in result.stdout, result.stdout
-
-
-def test_a_branch_this_clone_has_no_origin_ref_for_is_named_beside_resume(
-        atlas, home):
-    """The independent review of #21, 2026-09-11, recorded there as out of
-    scope: "if origin has lost the branch, `resume.sh` refuses first at RR2 —
-    'Error: `<branch>` is no longer on origin in the `<role>` leg' — with a
-    different remedy paragraph; `check_parked_leg` never reads
-    `origin/<branch>` for this leg, so it cannot tell."
-
-    IT STILL CANNOT TELL WITHOUT A FETCH, and that is the whole of what this
-    line says. RR2's test is a REF in the leg's repository — it fetches
-    `+refs/heads/<branch>:refs/remotes/origin/<branch>` first and then reads
-    it — so the question here is the local layer's own `has_ref`, AS OF THE
-    LAST FETCH, and a missing ref reads two ways: a branch origin has lost,
-    or a branch pushed on another workstation since this clone last fetched,
-    which is the ORDINARY state of a feature parked elsewhere and one
-    `resume` fetches and brings back. So the exit stays and the other reading
-    is named beside it, with the one flag that settles them.
-
-    With the branch really on origin the line is the one it always was, byte
-    for byte: that is the state the promise belongs to."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back"], findings
-
-    # And with no `origin/001-a-thing` here, the same line plus the reading
-    # it cannot rule out — RR2's own sentence, and the flag that settles it.
-    drop_from_origin(atlas, "001-a-thing")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back, unless origin has lost that branch: there is no "
-        "`origin/001-a-thing` here as of the last fetch, and `resume` "
-        "refuses a leg whose branch is not on origin, taking the WHOLE "
-        "feature with it (\"001-a-thing is no longer on origin in the repo "
-        "leg\") — `status --fetch` settles which"], findings
-
-
-def test_under_fetch_a_branch_origin_has_lost_names_rr2_and_not_resume(
-        atlas, home):
-    """After a fetch that WORKED in that repository there is nothing left to
-    settle: origin has not got the branch, and `resume` refuses the WHOLE
-    feature at RR2 before it compares any commit. Verified against the
-    extension on 2026-09-12 — a scratch single-shape estate, the branch
-    deleted in the bare and pruned in the clone — which answered "Error:
-    001-a-thing is no longer on origin in the repo leg; that feature was NOT
-    recreated", then the manifest's recorded commit, "If the feature landed,
-    delete its entry: … remove the `- branch: 001-a-thing` block", "If it was
-    deleted by mistake, push it again from the workstation that parked it",
-    "REFUSED: 001-a-thing — gone from origin", exit 2.
-
-    BOTH ITS EXITS ARE THE LINE'S, because they are not one and neither is
-    the re-park every other exception in this layer ends in: a feature that
-    landed is a record entry to delete, and a branch deleted by mistake is a
-    branch to push again."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    git("worktree", "remove", str(where), cwd=atlas)
-    git("branch", "-q", "-D", "001-a-thing", cwd=atlas)
-    git("push", "-q", "origin", "--delete", "001-a-thing", cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, parked 2026-09-10T20:00:00Z on Falcon, and no "
-            "`origin/001-a-thing` here after this run's fetch: origin has not "
-            "got that branch, so `resume` refuses the WHOLE feature for it, "
-            "\"001-a-thing is no longer on origin in the repo leg\", and "
-            "nothing here brings it back — the exits are to delete its "
-            "`- branch: 001-a-thing` block from the record where the feature "
-            "landed, or to push the branch again from Falcon where it went "
-            "by mistake") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-    assert "status --fetch` settles which" not in result.stdout, (
-        "the fetch settled it; there is nothing left for the flag to answer")
-
-
-def test_a_gone_branch_names_the_stale_registration_that_blocks_it_too(
-        atlas, home):
-    """The prune is still the person's to run — the registration is a state
-    of this disk, and `resume` is blocked by it whatever origin has — so it
-    is named first and the refusal after it, exactly as the `--no-push` and
-    absent-commit arms name it."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    rmtree(where)                        # and NO `git worktree prune`
-    git("push", "-q", "origin", "--delete", "001-a-thing", cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            f"branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} — clear it with `git -C {atlas} worktree "
-            "prune`; and no `origin/001-a-thing` here after this run's fetch, "
-            "so origin has not got that branch and `resume` refuses the WHOLE "
-            "feature for it, \"001-a-thing is no longer on origin in the repo "
-            "leg\" — nothing here brings it back: the exits are to delete its "
-            "`- branch: 001-a-thing` block from the record where the feature "
-            "landed, or to push the branch again from Falcon where it went by "
-            "mistake") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_under_fetch_a_gone_branch_outranks_the_absent_parked_commit(
-        atlas, home):
-    """RR2 IS BEFORE RR1, so a record that names no parked commit AND whose
-    branch origin has lost is refused for the branch, not for the commit.
-    Verified against the extension on 2026-09-12 on that same scratch estate:
-    with the parked commit left out and the branch deleted on origin, it
-    answered "Error: 001-a-thing is no longer on origin in the repo leg" —
-    "The manifest recorded it at , parked …" — and not "has moved since it
-    was parked", which is what it answers when origin still has the branch.
-
-    Without a fetch the two readings of the missing ref are not settled, so
-    the absent-commit arm keeps the line it had: that one is true whenever
-    origin does still have the branch, and this layer does not choose."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit="",
-           parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("no `origin/001-a-thing` here after this run's fetch: origin has "
-            "not got that branch, so `resume` refuses the WHOLE feature for "
-            "it") in result.stdout
-    assert "an absent one never matches" not in result.stdout, result.stdout
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): the record names no "
-            "parked commit for that leg, and no worktree on that branch here; "
-            "`resume` matches origin's tip against the parked commit before "
-            "it recreates anything, an absent one never matches") in \
-        result.stdout
-
-
-def test_the_gone_branch_reading_stops_where_resume_s_own_order_does(
-        atlas, home):
-    """`resume.sh` reads RR6, then RR4, RR3, RR2 — and `collect_legs` before
-    all of them — so this reading is the fourth thing to speak, not the
-    first, and three states of the same missing ref keep the lines they had.
-
-    A WORKTREE HERE is RR4's, not RR2's: with the worktree at the path it
-    computes, the extension answered "[specify] 001-a-thing (repo): worktree
-    already registered at …; left as it is" and exited 0 with the branch gone
-    from origin (verified 2026-09-12), so the tip arms go on saying what they
-    said and nothing here mentions origin. A FEATURE `collect_legs` REFUSES
-    WHOLE never reaches RR2 at all. And a leg RR6 refuses — `--no-push` — is
-    refused before origin is read."""
-    checkout = workspace_config(home)
-    # The reading itself, so this test bites: no worktree, branch gone.
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert "is no longer on origin in the repo leg" in result.stdout
-
-    # RR4: a worktree here, and the tip arms' line alone.
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    (where / "more.md").write_text("more\n", encoding="utf-8")
-    commit_all(where, "more work")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    git("push", "-q", "origin", "--delete", "001-a-thing", cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): moved on since it "
-            f"was parked, 1 commit(s) after {tip[:7]} — park again before "
-            "leaving") in result.stdout
-    assert "is no longer on origin" not in result.stdout, result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-    # `collect_legs`: a role this root does not mount, and no worktree.
-    git("worktree", "remove", "--force", str(where), cwd=atlas)
-    git("branch", "-q", "-D", "001-a-thing", cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="nope",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (nope leg): the record names a "
-            "leg this root does not mount here;") in result.stdout
-    assert "is no longer on origin" not in result.stdout, result.stdout
-
-    # RR6: `--no-push`, refused before origin is read.
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon", pushed="false")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with "
-            "--no-push on Falcon and no worktree on that branch here; only "
-            "that workstation has the WIP commit, so nothing here brings it "
-            "back — park it again from there") in result.stdout
-    assert "is no longer on origin" not in result.stdout, result.stdout
-
-
-def test_a_caveat_after_a_fetch_that_failed_here_does_not_name_the_flag(
-        atlas, home):
-    """The independent review of this branch, 2026-09-12, verbatim: "Under
-    --fetch where the fetch FAILED in that repository, the caveat tells the
-    person to run the flag they just ran."
-
-    `fetched_ok_at` is false for three different runs — one made without the
-    flag, one whose fetch in THIS repository failed, and one that never
-    fetched here at all — and only the first of them is answered by `status
-    --fetch`. The row above has already said the fetch failed and that what
-    follows is as of the last fetch that worked; the caveat says that the
-    reading under it is one of those things, rather than naming a command
-    that has just been run and settled nothing."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    git("remote", "set-url", "origin", str(home / "nowhere" / "Atlas.git"),
-        cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - fetch failed: " in result.stdout
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-            "Atlas` brings it back, unless origin has lost that branch: there "
-            "is no `origin/001-a-thing` here as of the last fetch, and "
-            "`resume` refuses a leg whose branch is not on origin, taking the "
-            "WHOLE feature with it (\"001-a-thing is no longer on origin in "
-            "the repo leg\") — the fetch this run made there failed, so "
-            "nothing has settled it") in result.stdout
-    assert "settles which" not in result.stdout, (
-        "the flag was run; it is not what is left to run")
-
-    # AND WITHOUT THE FLAG THE SAME RECORD KEEPS THE FLAG, because there the
-    # fetch that would settle it has not been made: the clause is about THIS
-    # RUN's fetch and not about the URL.
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "— `status --fetch` settles which" in result.stdout
-    assert "the fetch this run made there failed" not in result.stdout
-
-
-CAVEAT_HEAD = ("no worktree on that branch here; parked 2026-09-10T20:00:00Z "
-               "on Falcon — `resume {name}` brings it back, unless origin has "
-               "lost that branch: there is no `origin/001-a-thing` here as of "
-               "the last fetch, and `resume` refuses a leg whose branch is not "
-               "on origin, taking the WHOLE feature with it (\"001-a-thing is "
-               "no longer on origin in the {role} leg\") — ")
-
-
-def test_a_caveat_where_no_fetch_could_be_made_says_so_and_not_that_one_failed(
-        atlas, trio, home):
-    """Copilot's second round on #23, verbatim: "`fetch_tried_at` is true for
-    every repository entered by the pre-pass, including a readable repository
-    where `fetch_remote` returned early because no `origin` remote exists. In
-    that case this message says "the fetch this run made there failed" even
-    though no fetch was attempted, which makes the new diagnostic inaccurate."
-
-    THE STORE HELD FOUR STATES IN ONE FLAG. `fetch_remote` returns before it
-    runs anything for a repository git cannot read and for one with no
-    `origin` remote, and the pre-pass stores an entry for both — so "is there
-    an entry" said yes about a repository nothing was fetched in, and this
-    caveat contradicted the row two lines above it on the same report, which
-    had just said "no remote named origin, so nothing could be fetched".
-    `FETCH_STATE_AT` carries `fetch_remote`'s own word now, and the clause is
-    the one that is true of this run: a fetch that failed, a repository with
-    no remote to ask, one that could not be read, or — the flag's own case —
-    no fetch there at all."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    git("remote", "remove", "origin", cwd=atlas)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fetch: no remote named origin, so nothing could be fetched"
-            ) in result.stdout
-    assert ("    - parked feature 001-a-thing (repo leg): "
-            + CAVEAT_HEAD.format(name="Atlas", role="repo")
-            + "that repository has no `origin` remote for this run's fetch to "
-            "have asked, so nothing has settled it") in result.stdout
-    assert "the fetch this run made there failed" not in result.stdout, (
-        "a fetch that never ran was reported as one that failed")
-    assert "settles which" not in result.stdout, (
-        "the flag was run, and there is no remote for it to ask")
-
-    # A LEG, WHICH IS THE SHAPE THE COMMENT NAMES, in the checkout whose shape
-    # maps `spec`: the record layer asks the store about the path
-    # `project.yaml` gives the role, and the answer is that leg's own.
-    record(checkout, "trio", branch="001-a-thing", role="spec",
-           commit=FAKE_SHA, parked_on="Falcon", root="Trio")
-    git("remote", "remove", "origin", cwd=trio / "spec")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (spec leg): "
-            + CAVEAT_HEAD.format(name="Trio", role="spec")
-            + "that repository has no `origin` remote for this run's fetch to "
-            "have asked, so nothing has settled it") in result.stdout
-    assert "the fetch this run made there failed" not in result.stdout
-
-    # AND A REPOSITORY GIT CANNOT READ AT ALL is the other early return, and
-    # not the same sentence: nothing is wrong with its remotes, and the row
-    # above it says what is.
-    git("remote", "add", "origin", str(trio / "spec"), cwd=trio / "spec")
-    rmtree(trio / ".git" / "modules" / "spec")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - fetch: not a readable git repository (a gitfile whose "
-            "gitdir is gone?), so nothing could be fetched") in result.stdout
-    assert ("    - parked feature 001-a-thing (spec leg): "
-            + CAVEAT_HEAD.format(name="Trio", role="spec")
-            + "that repository could not be read this run, so no fetch was "
-            "made there and nothing has settled it") in result.stdout
-    assert "the fetch this run made there failed" not in result.stdout
-
-
-def test_a_caveat_in_a_repository_this_runs_fetch_never_listed_says_so(
-        atlas, home, status_remotes):
-    """Copilot's third round on #23, 2026-09-12, verbatim: "When `--fetch` is
-    active, `fetch_state_at` can still be `none` for a mapped role path that
-    `project.yaml` names but `estate_repos` did not enumerate (the code
-    explicitly allows that path not to be one of the fetch-store entries).
-    This fallback then tells the user to run `status --fetch`, even though
-    that flag has already run and repeated runs will not fetch a path absent
-    from `.gitmodules`; either fetch all mapped leg repositories or report
-    that this repository was not included in the fetch."
-
-    IT IS REAL, AND THE SECOND OF ITS TWO EXITS IS THE ONE TAKEN: `status
-    --fetch`'s one write is bounded to the repositories the estate declares —
-    the root and the legs of its `.gitmodules` — which is what AGENTS.md rule
-    4, the README and the help all say, so the reading says what this run DID
-    rather than widening what the flag does. The state is a `project.yaml`
-    that mounts a leg where `.gitmodules` declares none: `load_repo_shape`
-    maps the role onto that path and `collect_legs` hands it straight to
-    `resume`, while the pre-pass never sees it and no rerun of the flag ever
-    will.
-
-    WITHOUT THE FLAG THE FLAG IS STILL THE ANSWER, which is the control under
-    it: there the run has not asked at all, and what the flag settles is the
-    root and the legs it lists."""
-    checkout = workspace_config(home)
-    code_leg_onto_the_spec_checkout(atlas, path_line="    path: docs\n")
-    git("clone", "-q", str(status_remotes["Atlas"]["leg_bare"]),
-        str(atlas / "docs"), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="code",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (code leg): "
-            + CAVEAT_HEAD.format(name="Atlas", role="code")
-            + "this run's fetch did not reach that repository: it fetches the "
-            "root and the legs `.gitmodules` declares, and `project.yaml` maps "
-            "this role onto a path that is not one of them, so nothing has "
-            "settled it") in result.stdout
-    assert "settles which" not in result.stdout, (
-        "the flag was run, and no rerun of it reaches a path `.gitmodules` "
-        "does not declare")
-    assert "fetched origin" not in " ".join(
-        line for line in result.stdout.splitlines() if "docs" in line), (
-        "the fetch stays bounded to the repositories the estate declares")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (code leg): "
-            + CAVEAT_HEAD.format(name="Atlas", role="code")
-            + "`status --fetch` settles which") in result.stdout
-    assert "did not reach that repository" not in result.stdout
-
-
-def test_a_leg_the_record_gives_no_role_is_a_finding_not_silence(atlas, home):
-    """Note 8 of the independent review of #20, 2026-09-11, recorded there as
-    out of scope: an empty `- role:` value. `record_rows` dropped such a leg —
-    `[ -n "$role" ]` at both emit sites — so the record layer said nothing
-    about it, while `workspace_load_project` CREATES that leg (its indent-10
-    arm keys on `role` and assigns whatever the scalar is, empty or not) and
-    `resume.sh`'s `collect_legs` then hits its `*) return 1`, refusing the
-    WHOLE feature: "Error: 001-a-thing was parked from a single project and
-    this checkout is single; that feature was NOT recreated", exit 2, verified
-    against the extension the same day — a sentence about the SHAPE that says
-    nothing about the role, which is what this line explains in advance.
-
-    It is the ROOT's row, because no leg repository can be found for a leg
-    with no role, and it is NOT the "does not mount here" arm: those words are
-    true of `role: nope` and misleading here, where the record names no role
-    to mount and the refusal is of the whole feature. It is answered before
-    `leg_repo_for_role` is asked, too, because that function's last test for
-    an empty role is `[ -d "$root/" ]` — always true — and it would hand back
-    the root, reading the leg as if the record had named `repo`."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    path = record(checkout, "atlas", branch="001-a-thing", role="", commit=tip,
-                  parked_on="Falcon")
-    for extra in ([], ["--fetch"]):
-        result = run(STATUS, *extra, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("    - parked feature 001-a-thing: a leg of it in the record "
-                "has no role; `resume` maps each leg's role onto this checkout "
-                "and refuses the WHOLE feature — the other legs with it — "
-                "where one does not map, reporting it as a shape mismatch, so "
-                "nothing here brings it back — park that feature again from "
-                "the workstation that has it (the record says Falcon), which "
-                "writes the roles this checkout's own shape has") in result.stdout
-        assert "does not mount here" not in result.stdout
-        assert "( leg)" not in result.stdout
-
-    # The same record as a park that REFUSED the feature rewrites it —
-    # `workspace_write_manifest` keeps `role:` when its value is empty, the
-    # one leg key it does not drop — and it is the same empty role.
-    path.write_text(path.read_text(encoding="utf-8").replace(
-        "          - role: \n", '          - role: ""\n'), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing: a leg of it in the record has "
-            "no role;") in result.stdout
-
-    # AND A LEG WITH NO `- role:` LINE AT ALL is not a LEG in either reader:
-    # the loader's `[ "$key" = "role" ] || continue` starts none, and nothing
-    # opens one here — that much the two readers agree about, and it is still
-    # all that is held about the LINE: no leg-level finding names it. What
-    # they did NOT agree about was the FEATURE, which this record leaves with
-    # no legs at all and `collect_legs`'s closing `[ "${#LEG_ROLES[@]}" -gt
-    # 0 ]` refuses whole for that ("REFUSED: 001-a-thing — shape mismatch",
-    # exit 2, verified against the extension 2026-09-11) while this layer said
-    # nothing. That per-FEATURE reading is done now, so the finding here is
-    # the feature's — no leg named, because there is no leg to name.
-    path.write_text(path.read_text(encoding="utf-8").replace(
-        '          - role: ""\n', "          - nickname: x\n"), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing: the record lists no leg for it;"
-            ) in result.stdout
-    assert "a leg of it in the record has no role" not in result.stdout, (
-        "the LEG-level reading, for a line that is no leg to either reader")
-    assert "does not mount here" not in result.stdout
-
-
-def test_a_leg_with_no_role_does_not_take_the_legs_around_it_with_it(
-        atlas, home):
-    """The row goes out where the leg ENDS and `$open` — not the role's value
-    — is what says a leg is open, so an empty role costs the record neither a
-    leg before it nor one after it. Both of the others are read as they were,
-    and the roleless one is read too.
-
-    "As they were" is now "as they are": the `repo` leg with no worktree here
-    is still READ and still first, and what its line says has changed —
-    Copilot on #21, second round, 2026-09-11 — because `resume` refuses this
-    whole feature and the line used to offer `resume Atlas` for it two lines
-    under the one that says so. The `spec` leg's `--no-push` line is
-    untouched, which is the other half of the same rule: an arm that already
-    rules `resume` out needs no verdict to do it. Since the shape reading it
-    is preceded by one more of the leg's own: this root is `single`, so
-    `collect_legs` refuses a `spec` leg here too, and that is said before
-    what `--no-push` means for a leg with a worktree — four lines, in the
-    record's order, none of them naming `resume` as an exit."""
-    checkout = workspace_config(home)
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    spec_tip = feature_worktree(leg, "001-a-thing", home / "Atlas-wt" /
-                                "001-a-thing" / "spec")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    text = text.replace(
-        "            pushed: true\n",
-        "            pushed: true\n"
-        "          - role: \n"
-        "            remote: origin\n"
-        f"            parked_commit: {FAKE_SHA}\n"
-        "            wip: true\n"
-        "            wip_depth: 1\n"
-        "            pushed: true\n"
-        "          - role: spec\n"
-        "            remote: origin\n"
-        f"            parked_commit: {spec_tip}\n"
-        "            wip: true\n"
-        "            wip_depth: 1\n"
-        "            pushed: false\n")
-    path.write_text(text, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 4, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because a leg of it in the record has no role, so it "
-        "does not bring this leg back — park that feature again from the "
-        "workstation that has it (the record says Falcon)"), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing: a leg of it in the record has no role;"
-        ), findings[1]
-    assert findings[2].startswith(
-        "- parked feature 001-a-thing (spec leg): " + SHAPE_SPEC), findings[2]
-    assert findings[3].startswith(
-        "- parked feature 001-a-thing (spec leg): parked with --no-push on "
-        "Falcon"), findings[3]
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_role_this_shape_does_not_mount_names_the_whole_feature_refusal(
-        atlas, home):
-    """The independent review of #21, 2026-09-11, nobody having ruled on it:
-    a leg whose role this checkout's shape has not got drew "parked feature
-    001-a-thing (nope leg): the record names a leg this root does not mount
-    here" and stopped — no refusal, no exit, and it read as ONE leg of the
-    feature going unread. `resume.sh`'s `collect_legs` maps every leg's role
-    onto this checkout (`spec` and `code` only where `REPO_SHAPE` is
-    three-leg, `repo` only where it is single, `*) return 1` for anything
-    else) and takes the WHOLE FEATURE with the one that does not map: run
-    against a scratch single-shape estate on 2026-09-11, `role: nope`
-    answered "Error: 001-a-thing was parked from a single project and this
-    checkout is single; that feature was NOT recreated", "REFUSED:
-    001-a-thing — shape mismatch", exit 2 — the same refusal, in the same
-    words about the SHAPE, that the empty-role arm above explains in
-    advance.
-
-    ONE REFUSAL FOR BOTH KINDS OF ROLE, because this arm cannot tell them
-    apart: `leg_repo_for_role` returns nothing for a MISSPELLING (`nope`) and
-    nothing for ANOTHER SHAPE'S ROLE (`code` here, `spec` in the family
-    fixture's members), and `collect_legs` refuses both as a shape mismatch —
-    the first at its `*) return 1`, the second at its own `[ "$REPO_SHAPE" =
-    … ] || return 1`, both verified the same day. THE EXIT IS NOT ONE
-    WORDING, though it was when this test was written (Copilot's first round
-    on #23): a park from the workstation that has the feature writes the
-    roles ITS shape has, and for `code` — a role the OTHER shape maps — that
-    is the whole answer, the feature coming back in a checkout of that shape.
-    For `nope` no checkout of either shape maps it, so the line says that
-    first; the test for that split is its own, beside the `assembly` one.
-    Promising a re-park alone would send somebody round the second loop for
-    ever either way.
-
-    AND ONLY FOR A ROLE THIS ROOT HAS NO REPOSITORY FOR, which is what
-    proved the refusal before this checkout's SHAPE was read: `load_repo_shape`
-    calls a checkout three-leg only where `project.yaml` is a
-    `project-repo-schema` project manifest declaring both a `spec` and a
-    `code` LEG — the leg, not its `path:`, which defaults to the role's own
-    name — so a role this root can find no repository for is one
-    `collect_legs` cannot map either way. The block at the end of this test
-    is the one that changed with the shape reading, and its comment says
-    why."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    for role, exits in (
-            ("nope", "nor does any other checkout, of either shape, so the "
-                     "one exit is to park that feature again from the "
-                     "workstation that has it (the record says Falcon), which "
-                     "writes the roles its own shape has — `park` writes "
-                     "`spec` and `code` in a three-leg project and `repo` in "
-                     "a single one, and never this word — and the feature "
-                     "comes back in a checkout of that shape, which is this "
-                     "one only where the two agree"),
-            ("code", "park that feature again from the workstation that has "
-                     "it (the record says Falcon), which writes the roles its "
-                     "own shape has; where that shape is not this checkout's, "
-                     "the feature comes back in a checkout of that shape, not "
-                     "here")):
-        record(checkout, "atlas", branch="001-a-thing", role=role, commit=tip,
-               parked_on="Falcon")
-        for extra in ([], ["--fetch"]):
-            result = run(STATUS, *extra, "Atlas", home=home)
-            assert result.returncode == 1, result.stdout + result.stderr
-            assert (f"    - parked feature 001-a-thing ({role} leg): the record "
-                    "names a leg this root does not mount here; `resume` maps "
-                    "each leg's role onto this checkout and refuses the WHOLE "
-                    "feature — the other legs with it — where one does not map, "
-                    "reporting it as a shape mismatch, so nothing here brings it "
-                    "back — " + exits) in result.stdout
-
-    # With no `parked_on:` the exit still names the workstation, and says the
-    # record does not say which — the empty-role arm's words for the same gap.
-    record(checkout, "atlas", branch="001-a-thing", role="nope", commit=tip,
-           parked_on="")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("park that feature again from the workstation that has it (the "
-            "record does not say where)") in result.stdout
-
-    # AND A LEG THIS ROOT MOUNTS THAT IS NOT A CHECKOUT is read against the
-    # SHAPE, which is what this layer could not do when this block was
-    # written: Atlas is `single` — `kind: project-manifest`, no `schema:`
-    # line, an `assembly` leg and a `spec` leg and no `code` one — so
-    # `collect_legs` refuses a `spec` leg here whatever that directory holds,
-    # and "the record names a leg this root does not mount here" would send
-    # somebody to `make bootstrap` for a feature no bootstrap brings back.
-    # THE HALF THIS USED TO HOLD IS HELD WHERE IT IS TRUE: in a root whose
-    # shape DOES map the role, an unfetched leg claims no refusal and keeps
-    # that sentence — `test_a_three_leg_checkout_maps_spec_and_code_and_
-    # nothing_else` below, in the three-leg fixture.
-    spec = atlas / "spec"
-    rmtree(spec)
-    spec.mkdir()
-    record(checkout, "atlas", branch="001-a-thing", role="spec", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (spec leg): " + SHAPE_SPEC
-            ) in result.stdout
-    assert "does not mount here" not in result.stdout, result.stdout
-
-
-def test_a_leg_this_manifest_declares_with_no_path_is_mounted_at_its_role(
-        atlas, home):
-    """The independent review of this branch, 2026-09-12. `leg_repo_for_role`
-    learned a role's path from a `path:` key in `project.yaml` or a same-named
-    directory and answered NOTHING otherwise — while `git-common.sh`'s
-    `_shape_record_leg` DEFAULTS the path of the two legs it knows: `spec)
-    _SHAPE_LEG_SPEC_PATH="${path:-spec}"` and `code) … "${path:-code}"`. So a
-    root that declares `- role: spec` with no `path:`, and whose `spec/` is
-    not checked out, drew the whole-feature refusal above — a line `resume`
-    never prints there. `load_repo_shape` calls that manifest three-leg, and
-    `resume.sh` refuses the whole ESTATE before it reads a feature at all:
-    "Error: the spec leg 'spec' is not an initialised Git checkout at
-    '…/spec'. / Run 'git submodule update --init' (or 'make bootstrap') in the
-    project root first.", exit 1 — neither the refusal that line claims nor
-    either exit it offers.
-
-    The role maps now, as it does at the other end, and what is left is the
-    short line above: the leg is not mounted here, which is `make bootstrap`'s
-    to place. This layer says that and stops."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(
-        manifest.read_text(encoding="utf-8")
-        .replace("kind: project-manifest\n",
-                 "kind: project-manifest\nschema: project-repo-schema\n")
-        .replace("  - role: spec\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "    path: spec\n",
-                 "  - role: spec\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "  - role: code\n"
-                 f"    repository: {ORG}/Atlas-code\n"),
-        encoding="utf-8")
-    assert "path: spec" not in manifest.read_text(encoding="utf-8"), (
-        "the leg still has a path; the test is moot")
-    rmtree(atlas / "spec")      # declared, and not checked out here
-    record(checkout, "atlas", branch="001-a-thing", role="spec",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing (spec leg): the record names a leg this "
-        "root does not mount here"], findings
-    assert "refuses the WHOLE feature" not in result.stdout, (
-        "a refusal this layer cannot prove, and not the one `resume` makes")
-
-
-def test_an_unmountable_role_is_read_beside_the_legs_it_refuses_with(
-        atlas, home):
-    """The refusal is of the FEATURE, so the good leg beside it is read too
-    and both lines print — the leg's own state, and the whole-feature refusal
-    the record's other leg costs it. The order is the record's, and the good
-    leg's line says what the feature's verdict makes of it rather than
-    offering `resume` for a feature `resume` throws out."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    path.write_text(path.read_text(encoding="utf-8").replace(
-        "            pushed: true\n",
-        "            pushed: true\n"
-        "          - role: nope\n"
-        "            remote: origin\n"
-        f"            parked_commit: {FAKE_SHA}\n"
-        "            wip: true\n"
-        "            wip_depth: 1\n"
-        "            pushed: true\n"), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because its `nope` leg names a role this root does "
-        "not mount, so it does not bring this leg back — park that feature "
-        "again from the workstation that has it (the record says Falcon)"
-        ), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing (nope leg): the record names a leg this "
-        "root does not mount here; `resume` maps each leg's role onto this "
-        "checkout and refuses the WHOLE feature"), findings[1]
-    assert "`resume Atlas`" not in result.stdout
-
-
-#: The first clause of a `spec` leg's finding in a SINGLE root, which is
-#: every root this suite's Atlas fixture builds: `kind: project-manifest`, no
-#: `schema:` line, an `assembly` leg and a `spec` leg and no `code` one.
-SHAPE_SPEC = ("`resume` maps the role `spec` onto a three-leg checkout only, "
-              "and this one is single (its `project.yaml` declares no "
-              "`schema: project-repo-schema` and no `code` leg), so it "
-              "refuses the WHOLE feature")
-
-#: The rest of the `spec`-in-a-single-root finding, whose first clause two
-#: other tests read as `SHAPE_SPEC`: the refusal both shape findings share,
-#: the disagreement this suite's `record()` always writes (`shape:
-#: three-leg`), and the exit. THE DISAGREEMENT IS LAST since the independent
-#: verification of this branch, 2026-09-12: the `*)` exit opens "nor does any
-#: other checkout, of either shape", which answers "nothing here brings it
-#: back", and spliced between the two the disagreement left that "nor" denying
-#: "not one this layer can settle". The three pieces are the same; the order
-#: is the reading.
-MISMATCH = (" — the other legs with it — reporting it as a shape mismatch, "
-            "and nothing here brings it back")
-DISAGREE_S = ("; the record calls the project three-leg where this checkout "
-              "is single, which is the disagreement `resume` reports and not "
-              "one this layer can settle")
-EXIT_S = (" — park that feature again from the workstation that has it (the "
-          "record says Eagle), which writes the roles its own shape has; "
-          "where that shape is not this checkout's, the feature comes back "
-          "in a checkout of that shape, not here")
-
-#: The three pieces of the `assembly` finding, which two tests read: the
-#: refusal, the clause a record that disagrees about the shape adds, and the
-#: exit. Split because the second phase below is the same line without the
-#: middle, and a copy of 60 words would hide that.
-ASSEMBLY = (
-    "- parked feature 001-a-thing (assembly leg): `resume` maps the role "
-    "`assembly` onto no checkout of either shape — it knows `spec` and "
-    "`code` in a three-leg project and `repo` in a single one — and this one "
-    "is single (its `project.yaml` declares no `schema: project-repo-schema` "
-    "and no `code` leg), so it refuses the WHOLE feature — the other legs with it — reporting "
-    "it as a shape mismatch, and nothing here brings it back")
-DISAGREE = ("; the record calls the project three-leg where this checkout is "
-            "single, which is the disagreement `resume` reports and not one "
-            "this layer can settle")
-EXIT = (
-    " — park that feature again from the workstation that has it (the record "
-    "says Falcon), which writes the roles its own shape has; where that shape "
-    "is not this checkout's, the feature comes back in a checkout of that "
-    "shape, not here")
-
-#: AND THE EXIT FOR A ROLE OF NEITHER SHAPE IS NOT THAT ONE (Copilot's first
-#: round on #23): `EXIT` above ends by naming the checkout the feature comes
-#: back in, which is the right thing to say about `spec` in a single root and
-#: the wrong thing to leave a person with about `assembly`, where no checkout
-#: of either shape resumes the record as it stands. So the `*)` roles get
-#: their own, which says that first and then the one thing that changes it.
-EXIT_NEITHER = (
-    " — nor does any other checkout, of either shape, so the one exit is to "
-    "park that feature again from the workstation that has it (the record "
-    "says Falcon), which writes the roles its own shape has — `park` writes "
-    "`spec` and `code` in a three-leg project and `repo` in a single one, and "
-    "never this word — and the feature comes back in a checkout of that "
-    "shape, which is this one only where the two agree")
-
-#: AND THE LINES THE LOADER READS NEITHER A FEATURE NOR A LEG OUT OF, whose
-#: own section is at the bottom of this file and whose two `why` halves and
-#: shared exits are hoisted here beside the other findings' pieces, because
-#: the two tests that were written before that reading — the `root:` key
-#: between a feature and its legs, and the blank branch above it — read them
-#: too. THE TWO ARMS SAY DIFFERENT THINGS DELIBERATELY: a line that costs a
-#: LEG is not sent looking at the feature list, because the key that shut the
-#: list is the one the person has to go and find.
-WHY_FEATURES = (
-    "because `resume` reads a record by INDENT, and `workspace_load_project` "
-    "SHUTS the `features:` list at the next key at project indent, making no "
-    "feature of a `- branch:` below one")
-WHY_LEGS = (
-    "because `resume` reads a record by INDENT, and `workspace_load_project` "
-    "SHUTS a feature's `legs:` list at the next line shallower than its "
-    "`- role:` items, making no leg of one below it")
-#: AND THE OTHER ARM FOR A LOST LEG, which is a different line to go and
-#: find: a key at PROJECT indent shuts the feature list and every leg list
-#: inside it, so a `legs:` key below one opens nothing and an open leg list
-#: above one ends there. Naming the feature-indent arm for it would send a
-#: hand looking at an indent the record has nothing out of place at.
-WHY_OUTER = (
-    "because `resume` reads a record by INDENT, and `workspace_load_project` "
-    "SHUTS the `features:` list at the next key at project indent, and every "
-    "feature's `legs:` list inside it with it, making no leg of a `- role:` "
-    "below one")
-#: AND THE TWO ARMS FOR A LIST THAT WAS NEVER OPENED AT ALL (Copilot's first
-#: round on this PR, suppressed): `features:` is what OPENS the feature list
-#: and `legs:` a feature's leg list, so a `- branch:` above every `features:`
-#: key and a `- role:` above its feature's `legs:` key are unread for the
-#: OPPOSITE reason — nothing shut a list, nothing opened one. Read whole,
-#: both were told in the shutting arms above, which send a reader looking for
-#: a key the record has not got.
-WHY_NOLIST = (
-    "because `resume` reads a record by INDENT, and the `features:` key is "
-    "what OPENS the list `workspace_load_project` reads a `- branch:` out of "
-    "— this block has no such key ABOVE that line, so the loader is in no "
-    "feature list when it reaches it")
-WHY_NOLEGS = (
-    "because `resume` reads a record by INDENT, and the `legs:` key is what "
-    "OPENS the list `workspace_load_project` reads a `- role:` out of — this "
-    "feature has no such key ABOVE that line, so the loader is in no leg "
-    "list when it reaches it")
-
-
-def unread_exits(where: str = "the record says Falcon",
-                 name: str = "atlas.yaml") -> str:
-    """The exits every one of those findings ends in: the record's own key
-    ORDER first, which is the person's to put back and never `status`'s, and
-    the re-park second and only FROM THE WORKSTATION THAT HAS THE FEATURE.
-    That order is not a preference. `workspace_write_manifest` rewrites a
-    project's WHOLE BLOCK out of what its own `workspace_load_project` read
-    plus what it finds on disk, and `emit_recorded_feature` carries a feature
-    forward out of `MANIFEST_FEATURE_BRANCHES` — where a feature that loader
-    never made is not — so a park run anywhere else writes the block back
-    without these lines at all (read off both functions, 2026-09-12)."""
-    return (
-        " — the exits are to put the block back in the order `park` writes it "
-        "(every project-level key above `features:`, every feature-level key "
-        f"above `legs:`) in {name}, which is yours to do and not `status`'s, "
-        "or to park that feature again FROM THE WORKSTATION THAT HAS IT "
-        f"({where}), which rewrites the whole block in that order; a park from "
-        "any other workstation rewrites it out of what its own loader read and "
-        "takes these lines with it")
-
-
-def test_a_role_resume_maps_in_no_shape_costs_the_whole_feature(atlas, home):
-    """The reading the feature-level commit recorded and did not take: "a
-    role this root DOES mount that `collect_legs` refuses anyway —
-    `assembly`, or `spec` in a root whose `project.yaml` declares no `code`
-    leg, which `load_repo_shape` therefore calls `single` — for which
-    `leg_repo_for_role` hands back a repository, so the leg is read against
-    disk and nothing here mentions the refusal."
-
-    `assembly` is the role that proves it is not a misspelling: the three-leg
-    SHAPE has it — it is the assembly root itself, `path: "."` in this
-    fixture's own `project.yaml` — and `collect_legs` maps it in NEITHER
-    shape, because the root's worktree is the `repo` leg's. Run against the
-    extension on 2026-09-12, on a scratch estate shaped like this fixture (an
-    `assembly` leg at `.` and a `spec` leg at `spec/`, no `schema:` line and
-    no `code` leg): "Error: 001-a-thing was parked from a three-leg project
-    and this checkout is single; that feature was NOT recreated", "REFUSED:
-    001-a-thing — shape mismatch", exit 2.
-
-    THE SENTENCE `resume` PRINTS NAMES NO ROLE AND CAN CONTRADICT ITSELF —
-    "parked from a single project and this checkout is single" where the
-    record agrees — so this line names the role, the shape this checkout is
-    and WHY it is that shape, in `load_repo_shape`'s own terms. The record's
-    own `shape:` is held against it and NOT judged: which of the two is right
-    is not readable from either file."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="assembly",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [ASSEMBLY + EXIT_NEITHER + DISAGREE], findings
-    assert "`resume Atlas`" not in result.stdout
-
-    # AND WHERE THE RECORD AGREES WITH THIS CHECKOUT there is nothing to hold
-    # against it: the same refusal, without the clause.
-    path = checkout / "workspaces" / ORG / "atlas.yaml"
-    path.write_text(path.read_text(encoding="utf-8")
-                    .replace("shape: three-leg", "shape: single"),
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [ASSEMBLY + EXIT_NEITHER], findings
-
-    # AND A WORD THAT MERELY MATCHES A DIRECTORY reaches the same arm by the
-    # other route: `leg_repo_for_role`'s last case answers `docs` with
-    # `<root>/docs` once that directory exists, so the "does not mount here"
-    # arm above cannot see it either, and `collect_legs` maps it no better
-    # than `assembly` — its `*) return 1` is one case for both. (An empty
-    # directory is nothing to git, so the root is not dirty for it.)
-    (atlas / "docs").mkdir()
-    record(checkout, "atlas", branch="001-a-thing", role="docs",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (docs leg): `resume` maps the "
-            "role `docs` onto no checkout of either shape — it knows `spec` "
-            "and `code` in a three-leg project and `repo` in a single one — "
-            "and this one is single (its `project.yaml` declares no `schema: "
-            "project-repo-schema` and no `code` leg), so it refuses the WHOLE "
-            "feature") in result.stdout
-    assert "does not mount here" not in result.stdout, result.stdout
-
-
-def test_a_role_of_neither_shape_is_offered_no_checkout_of_the_other(
-        atlas, trio, home):
-    """Copilot's first round on #23, verbatim: "for roles such as `assembly`
-    or `docs`, `role_shape_long` correctly says that `resume` maps the role
-    onto no checkout of either shape, but this common suffix still says the
-    feature can come back in a checkout of the other shape … contradicts the
-    new help/README wording that a role of neither shape has no resumable
-    checkout."
-
-    THE RE-PARK IS NOT IMPOSSIBLE, which is the half of that note to
-    disagree with: the suffix's "that shape" is the WORKSTATION's, named two
-    clauses earlier, and `park.sh`'s `build_legs` is `LEG_ROLES=("spec"
-    "code")` in a three-leg root and `("repo")` in a single one — so the park
-    it names does write a role some checkout maps, and this suite's own
-    end-to-end run of `resume.sh` on a `code` leg brought the feature back,
-    exit 0. WHAT WAS MISSING IS THE OTHER HALF OF WHAT THE HELP AND THE
-    README ALREADY SAY: "where the role is really another shape's, only a
-    checkout of that shape, and where it is NEITHER shape's, no checkout at
-    all". The suffix said the first of those to both kinds, so a person
-    reading `assembly` was left with a checkout somewhere that resumes this
-    record, and there is none: run against the extension on 2026-09-12, both
-    `role: assembly` and `role: docs` in a real three-leg root — both legs
-    mounted, the four conditions met — answered "Error: 001-a-thing was
-    parked from a three-leg project and this checkout is three-leg; that
-    feature was NOT recreated", "REFUSED: 001-a-thing — shape mismatch",
-    exit 2, which is the refusal both words already draw in a single root.
-    Refused in BOTH shapes is a record no checkout brings back.
-
-    IT REACHES THE "DOES NOT MOUNT HERE" ARM TOO, because a role of neither
-    shape gets there whenever it matches no directory (`nope`) — while a
-    `spec` or a `code` that arm sees IS another shape's role and keeps the
-    suffix it had, byte for byte."""
-    checkout = workspace_config(home)
-    for role in ("assembly", "docs", "nope"):
-        if role == "docs":
-            (atlas / "docs").mkdir()
-        record(checkout, "atlas", branch="001-a-thing", role=role,
-               commit=FAKE_SHA, parked_on="Falcon")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        findings = [line.strip() for line in result.stdout.splitlines()
-                    if line.strip().startswith("- parked feature")]
-        assert len(findings) == 1, findings
-        # THE EXIT IS LAST WHERE THERE IS NO DISAGREEMENT TO REPORT, and the
-        # disagreement follows it where there is: `assembly` and `docs` reach
-        # the SHAPE arm, whose line holds the record's `shape:` against this
-        # checkout's, while `nope` matches no directory and reaches the mount
-        # arm, which has no such clause.
-        tail = EXIT_NEITHER[3:] + ("" if role == "nope" else DISAGREE)
-        assert findings[0].endswith(tail), findings[0]
-        assert "comes back in a checkout of that shape, not here" not in \
-            result.stdout, (
-                "a role no shape maps was still offered the other shape")
-        assert "`resume Atlas`" not in result.stdout
-
-    # ANOTHER SHAPE'S ROLE KEEPS THE EXIT IT HAD, which is the line this one
-    # is not: `spec` reaches the shape arm and `code` the mount arm, and both
-    # really do come back in a checkout of the shape that maps them.
-    for role in ("spec", "code"):
-        record(checkout, "atlas", branch="001-a-thing", role=role,
-               commit=FAKE_SHA, parked_on="Falcon")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("park that feature again from the workstation that has it "
-                "(the record says Falcon), which writes the roles its own "
-                "shape has; where that shape is not this checkout's, the "
-                "feature comes back in a checkout of that shape, not here"
-                ) in result.stdout
-        assert "nor does any other checkout" not in result.stdout
-
-    # AND THE SHAPE IT IS REFUSED IN CHANGES NOTHING: `assembly` is the
-    # three-leg shape's own root, and `resume` maps it there no better.
-    checkout = workspace_config(home)
-    record(checkout, "trio", branch="001-a-thing", role="assembly",
-           commit=FAKE_SHA, parked_on="Falcon", root="Trio")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 1, findings
-    assert findings[0].endswith(EXIT_NEITHER[3:]), findings[0]
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_a_spec_leg_this_single_root_mounts_is_still_the_shape_refusal(
-        atlas, home):
-    """The other half of the same state, and the one that reads as fine: this
-    root MOUNTS `spec`, `leg_repo_for_role` answers with its repository, the
-    worktree is there at the parked commit — and `collect_legs` refuses the
-    whole feature anyway, because `spec` maps onto a three-leg checkout only
-    and this one is single. Verified against the extension the same day, in
-    the same estate with the `spec` leg really mounted: "shape mismatch",
-    exit 2. Before this reading `status` printed nothing at all here and
-    exited 0.
-
-    WITH A WORKTREE HERE THE ARMS BELOW STILL RUN, because they are about
-    this workstation's own work and true whatever `collect_legs` does: the
-    second half moves that worktree on, and both lines print, the refusal
-    first."""
-    checkout = workspace_config(home)
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    where = home / "Atlas-wt" / "001-s-thing" / "spec"
-    tip = feature_worktree(leg, "001-s-thing", where)
-    record(checkout, "atlas", branch="001-s-thing", role="spec", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-s-thing (spec leg): `resume` maps the role "
-        "`spec` onto a three-leg checkout only, and this one is single (its "
-        "`project.yaml` declares no `schema: project-repo-schema` and no "
-        "`code` leg), so it refuses the WHOLE feature — the other legs with it — reporting it "
-        "as a shape mismatch, and nothing here brings it back "
-        "— park that feature again from the workstation that has it (the "
-        "record says Falcon), which writes the roles its own shape has; "
-        "where that shape is not this checkout's, the feature comes back in "
-        "a checkout of that shape, not here; the record "
-        "calls the project three-leg where this checkout is single, which is "
-        "the disagreement `resume` reports and not one this layer can settle"
-        ], findings
-
-    (where / "more.md").write_text("more\n", encoding="utf-8")
-    commit_all(where, "more work")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0].startswith(
-        "- parked feature 001-s-thing (spec leg): `resume` maps the role "
-        "`spec` onto a three-leg checkout only"), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-s-thing (spec leg): moved on since it was "
-        f"parked, 1 commit(s) after {tip[:7]} — park again before leaving"
-        ), findings[1]
-
-
-def test_a_repo_leg_in_a_three_leg_checkout_costs_the_whole_feature(
-        trio, home):
-    """The mirror image, and the one that needs a root of the other shape:
-    `repo` maps onto a SINGLE checkout only. Verified against the extension
-    on 2026-09-12 in a real three-leg scratch estate — `kind:
-    project-manifest`, `schema: project-repo-schema`, both legs mounted —
-    which answered "Error: 001-a-thing was parked from a three-leg project
-    and this checkout is three-leg; that feature was NOT recreated",
-    "REFUSED: 001-a-thing — shape mismatch", exit 2: the sentence that names
-    the same shape twice and says nothing about the role, which is what this
-    line exists to explain in advance.
-
-    NO DISAGREEMENT CLAUSE HERE, because there is none: the record calls the
-    project three-leg and so does this checkout. The record's `shape:` never
-    decides anything at either end — `collect_legs` maps roles onto the shape
-    of the CHECKOUT — and a line that read it as the reason would be wrong
-    about both."""
-    checkout = workspace_config(home)
-    record(checkout, "trio", branch="001-a-thing", role="repo",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing (repo leg): `resume` maps the role "
-        "`repo` onto a single checkout only, and this one is three-leg (its "
-        "`project.yaml` declares both a `spec` and a `code` leg), so it "
-        "refuses the WHOLE feature — the other legs with it — reporting it "
-        "as a shape mismatch, and nothing here brings it back — park that "
-        "feature again from the workstation that has it (the record says "
-        "Falcon), which writes the roles its own shape has; where that shape "
-        "is not this checkout's, the feature comes back in a checkout of "
-        "that shape, not here"], findings
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_a_three_leg_checkout_maps_spec_and_code_and_nothing_else(trio, home):
-    """What the shape reading must NOT do, held in the root where the roles
-    change places. `spec` maps here — the extension RESUMED that record on
-    2026-09-12 in this shape — so a `spec` leg at its parked commit is silent
-    exactly as a `repo` leg is in a single root; a `spec` leg this root
-    mounts that is NOT A CHECKOUT keeps the sentence it had and claims no
-    refusal, because `collect_legs` maps roles by name onto the paths
-    `load_repo_shape` computed and never looks at the directory; and
-    `assembly` is refused here too, which is the half that says the reading
-    is about the ROLE and not about the shape it came from."""
-    checkout = workspace_config(home)
-    leg = trio / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    tip = feature_worktree(leg, "001-s-thing",
-                           parked_worktree(trio, "001-s-thing", "spec"))
-    record(checkout, "trio", branch="001-s-thing", role="spec", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "parked feature" not in result.stdout
-
-    # A LEG THIS ROOT MOUNTS THAT IS NOT A CHECKOUT: `make bootstrap`'s, and
-    # no refusal claimed — the half the single-shape fixture can no longer
-    # hold, because there `spec` is refused for the shape whatever the
-    # directory is.
-    rmtree(leg)
-    leg.mkdir()
-    record(checkout, "trio", branch="001-s-thing", role="spec",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-s-thing (spec leg): the record names a "
-            "leg this root does not mount here") in result.stdout
-    assert "refuses the WHOLE feature" not in result.stdout, (
-        "a refusal this layer cannot prove for a leg the shape does map")
-
-    # And `assembly`, in the shape that has an assembly leg of its own.
-    record(checkout, "trio", branch="001-a-thing", role="assembly",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (assembly leg): `resume` maps "
-            "the role `assembly` onto no checkout of either shape — it knows "
-            "`spec` and `code` in a three-leg project and `repo` in a single "
-            "one — and this one is three-leg (its `project.yaml` declares "
-            "both a `spec` and a `code` leg), so it refuses the WHOLE "
-            "feature") in result.stdout
-
-
-def test_the_shape_verdict_reaches_the_legs_beside_it(atlas, home):
-    """The refusal is the FEATURE's, so a good `repo` leg beside a `spec` one
-    is read too and its line says what `collect_legs` will do rather than
-    offering a `resume` that throws the feature out — the rule Copilot's
-    second round on #21 set, reached now by a third route."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    path.write_text(path.read_text(encoding="utf-8").replace(
-        "            pushed: true\n",
-        "            pushed: true\n"
-        "          - role: spec\n"
-        "            remote: origin\n"
-        f"            parked_commit: {FAKE_SHA}\n"
-        "            wip: true\n"
-        "            wip_depth: 1\n"
-        "            pushed: true\n"), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because its `spec` leg names a role `resume` maps "
-        "only onto a three-leg checkout, and this one is single, so it does "
-        "not bring this leg back — park that feature again from the "
-        "workstation that has it (the record says Falcon)"), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing (spec leg): `resume` maps the role "
-        "`spec` onto a three-leg checkout only"), findings[1]
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_feature_the_record_lists_no_leg_for_is_a_finding_not_silence(
-        atlas, home):
-    """Note 1 of the independent review of #21, 2026-09-11, and the note-8
-    commit's own "recorded for later"; nobody has ruled on it. A feature the
-    record leaves with NO LEGS AT ALL — an empty `legs:`, `legs: []`, or leg
-    items with no `- role:` line — drew nothing whatever: no finding, exit 0,
-    the parked-record note counting the feature and saying no more. Every
-    reading this layer had was a LEG's, and there is no leg here to hang one
-    on.
-
-    `resume.sh` is not silent about it. `collect_legs` ends
-    `[ "${#LEG_ROLES[@]}" -gt 0 ]`, so it refuses the WHOLE feature in the
-    shape words: run on 2026-09-11 against a scratch single-shape estate —
-    bare remote in a temp dir, fake `$HOME`, the extension's own scripts —
-    each of the three spellings answered "Error: 001-a-thing was parked from
-    a single project and this checkout is single; that feature was NOT
-    recreated", "REFUSED: 001-a-thing — shape mismatch", exit 2. So the
-    finding is the FEATURE's, printed where the feature is, and the exit is
-    the one the roleless arm names: only a park that parks the feature
-    THROUGH writes legs for it — `workspace_write_manifest` writes `legs: []`
-    for a feature it has none for, and `emit_recorded_feature` carries a
-    REFUSED feature's legs forward out of the loaded manifest, which for this
-    one is none."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    head = path.read_text(encoding="utf-8").split("        legs:\n")[0]
-    for legs in ("        legs:\n",
-                 "        legs: []\n",
-                 "        legs:\n"
-                 "          - remote: origin\n"
-                 f"            parked_commit: {FAKE_SHA}\n"
-                 "            wip: true\n"
-                 "            wip_depth: 1\n"
-                 "            pushed: true\n"):
-        path.write_text(head + legs, encoding="utf-8")
-        for extra in ([], ["--fetch"]):
-            result = run(STATUS, *extra, "Atlas", home=home)
-            assert result.returncode == 1, result.stdout + result.stderr
-            assert ("    - parked feature 001-a-thing: the record lists no leg "
-                    "for it; `resume` collects a feature's legs before it "
-                    "recreates anything and refuses the WHOLE feature where it "
-                    "finds none, reporting it as a shape mismatch, so nothing "
-                    "here brings it back — park that feature again from the "
-                    "workstation that has it (the record says Falcon), which "
-                    "writes the record afresh with the legs it parks"
-                    ) in result.stdout, legs
-            assert "( leg)" not in result.stdout, legs
-            assert "`resume Atlas`" not in result.stdout, legs
-
-
-def test_a_feature_with_no_legs_is_still_a_feature_the_record_knows(
-        atlas, home):
-    """The unrecorded-worktree sweep reads the branch, not the legs: a
-    feature the record lists no leg for is still IN the record, so a worktree
-    on that branch was parked and must not be called unparked. `record_rows`
-    emits the `branch` row wherever the branch line is, legs or none, and
-    `$recorded` is built from those rows — so this holds without a line of
-    its own, and the test is what keeps it holding.
-
-    The feature COUNT on the record's own row counts it too, for the same
-    reason: it is a feature of this estate that was parked, and a count that
-    skipped it would disagree with the finding printed under it."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    head = path.read_text(encoding="utf-8").split("        legs:\n")[0]
-    path.write_text(head + "        legs:\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    parked record: 1 feature(s)" in result.stdout
-    assert ("    - parked feature 001-a-thing: the record lists no leg for it;"
-            ) in result.stdout
-    assert "never parked" not in result.stdout, (
-        "a worktree whose branch the record names is not unparked work")
-
-
-def test_a_feature_with_no_legs_is_read_in_the_record_s_own_order(
-        atlas, home):
-    """One feature with legs, one with none, one with legs: the feature-level
-    finding prints where its feature is, between the legs of the features
-    around it, because the judgement is made in a first pass and read back at
-    the `branch` row. A finding printed after everything else would read as a
-    fourth feature."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    text = text.replace(
-        "            pushed: true\n",
-        "            pushed: true\n"
-        "      - branch: 002-b-thing\n"
-        "        legs:\n"
-        "      - branch: 003-c-thing\n"
-        "        legs:\n"
-        "          - role: repo\n"
-        "            remote: origin\n"
-        f"            parked_commit: {FAKE_SHA}\n"
-        "            wip: true\n"
-        "            wip_depth: 1\n"
-        "            pushed: false\n")
-    path.write_text(text, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    parked record: 3 feature(s)" in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 3, findings
-    assert findings[0].startswith(
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here"), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 002-b-thing: the record lists no leg for it;"
-        ), findings[1]
-    assert findings[2].startswith(
-        "- parked feature 003-c-thing (repo leg): parked with --no-push on "
-        "Falcon"), findings[2]
-
-
-def leg_block(role: str, commit: str, *, pushed: str = "true") -> str:
-    """One more leg under the feature `record()` wrote, in its layout."""
-    return (f"          - role: {role}\n"
-            "            remote: origin\n"
-            f"            parked_commit: {commit}\n"
-            "            wip: true\n"
-            "            wip_depth: 1\n"
-            f"            pushed: {pushed}\n")
-
-
-def two_leg_record(checkout, *, second: str, first_commit: str,
-                   second_commit: str, order: str = "good-first"):
-    """A one-feature record with two legs: a good `repo` leg with no worktree
-    here, and `second` — the leg that costs the feature."""
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=first_commit, parked_on="Falcon")
-    good = leg_block("repo", first_commit)
-    spoiler = leg_block(second, second_commit)
-    text = path.read_text(encoding="utf-8")
-    assert text.count(good) == 1, text
-    path.write_text(text.replace(
-        good, good + spoiler if order == "good-first" else spoiler + good),
-        encoding="utf-8")
-    return path
-
-
-def test_no_line_of_a_feature_resume_refuses_whole_offers_resume(atlas, home):
-    """Copilot on #21, second round, 2026-09-11, verbatim: "This finding is
-    emitted per leg, but `read_record` still invokes `check_parked_leg` for
-    every sibling. Thus a feature with one roleless leg also prints the normal
-    `resume <Name> brings it back` advice for another leg, even though this
-    message says `resume` refuses the whole feature; the combined report
-    recommends a command that cannot recreate it."
-
-    True of both whole-feature refusals a leg can cause — a leg with no role,
-    and a role this root cannot answer — and in both orders, which is the
-    reason the verdict is made in a pass of its own: with the spoiling leg
-    LAST, no reader that judges a leg as it arrives can know. `resume` will
-    not recreate any of it, so no line of it may name `resume`; the sibling's
-    line says what `collect_legs` will do and why, and ends at the one exit
-    there is."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-b-other",
-                           parked_worktree(atlas, "001-b-other"))
-    for second, why in (
-            ("", "a leg of it in the record has no role"),
-            ("nope", "its `nope` leg names a role this root does not mount")):
-        for order in ("good-first", "spoiler-first"):
-            two_leg_record(checkout, second=second, first_commit=FAKE_SHA,
-                           second_commit=tip, order=order)
-            result = run(STATUS, "Atlas", home=home)
-            assert result.returncode == 1, result.stdout + result.stderr
-            assert ("    - parked feature 001-a-thing (repo leg): no worktree "
-                    "on that branch here, parked 2026-09-10T20:00:00Z on "
-                    f"Falcon; `resume` refuses the WHOLE feature, because {why}"
-                    ", so it does not bring this leg back — park that feature "
-                    "again from the workstation that has it (the record says "
-                    "Falcon)") in result.stdout, (second, order)
-            assert "`resume Atlas`" not in result.stdout, (second, order)
-
-
-def test_a_refused_feature_still_names_the_prune_that_blocks_it(atlas, home):
-    """A stale registration is still the person's to clear — `resume` cannot
-    recreate a worktree git believes it has, whatever else it refuses — so
-    the prune keeps its place at the front of the line, and only the `resume`
-    at the end of it goes."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    rmtree(where)               # and NO `git worktree prune`
-    two_leg_record(checkout, second="", first_commit=FAKE_SHA,
-                   second_commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here, but a stale worktree registration for it is still "
-            f"recorded at {where} — clear it with `git -C {atlas} worktree "
-            "prune`; and `resume` refuses the WHOLE feature in any case, "
-            "because a leg of it in the record has no role, so it does not "
-            "bring this leg back either — park that feature again from the "
-            "workstation that has it (the record says Falcon)") in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_the_verdict_reaches_only_the_feature_it_belongs_to(atlas, home):
-    """Per FEATURE, not per record: a second feature in the same block, with
-    every leg mappable, keeps the line it always had. The verdict is read
-    back at each feature's own `branch` row, and a record where one feature
-    is refused and another is not is the test of that."""
-    checkout = workspace_config(home)
-    path = two_leg_record(checkout, second="", first_commit=FAKE_SHA,
-                          second_commit=FAKE_SHA)
-    text = path.read_text(encoding="utf-8")
-    path.write_text(text + "      - branch: 002-b-thing\n        legs:\n"
-                    + leg_block("repo", FAKE_SHA), encoding="utf-8")
-    # THE SECOND FEATURE'S BRANCH IS ON ORIGIN, which is what "the line it
-    # always had" now needs: since the gone-from-origin reading, a leg whose
-    # repository has no `origin/<branch>` carries that reading beside the
-    # `resume`, and the line under test here is the one with nothing wrong
-    # with it at all.
-    origin_has_branch(atlas, "002-b-thing")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 3, findings
-    assert findings[0].startswith(
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature"), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing: a leg of it in the record has no role;"
-        ), findings[1]
-    assert findings[2] == (
-        "- parked feature 002-b-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back"), findings[2]
-
-
-def test_the_gone_branch_verdict_reaches_the_legs_beside_it(trio, home):
-    """The independent review of this branch, 2026-09-12, its BLOCKER,
-    verbatim: "The RR2 refusal ("origin has not got that branch, so `resume`
-    refuses the WHOLE feature") is PRINTED as a whole-feature refusal but is
-    NOT made the FEATURE's verdict, so a SIBLING leg in the same report still
-    says "`resume <Name>` brings it back"."
-
-    `resume.sh` walks a feature's legs in the record's order and RR2 is
-    `refused=true; break` — the loop stops and `[ "$refused" = false ] ||
-    continue` throws the whole feature out, the other legs with it — so a
-    report that names the refusal on one leg's line and `resume Trio` on the
-    next recommends a command that cannot recreate any of it, which is the
-    rule Copilot's second round on #21 set and this reading broke by a fourth
-    route. The verdict is made in `read_record`'s first pass now, beside the
-    two `collect_legs` asks, and the culprit leg still says it in RR2's own
-    words because a leg that meets that test says it for itself — the way two
-    unmappable roles each draw the long shape line.
-
-    THIS FIXTURE IS THE THREE-LEG ONE because a feature with two legs in two
-    DIFFERENT repositories is the state that shows it: the branch is on origin
-    in the `code` leg and gone from origin in the `spec` leg, so the sibling
-    is a leg with nothing whatever wrong with it and the base's report offered
-    `resume Trio` for it. BOTH EXITS TRAVEL WITH THE VERDICT, because the
-    re-park every other whole-feature refusal ends in is the wrong thing to
-    name for a branch origin has lost: the feature may have LANDED.
-
-    AND THE SECOND HALF IS THE ORDER THE TWO VERDICTS COME IN: `collect_legs`
-    runs to the end before any RR does, so the same record with a ROLELESS leg
-    beside the gone one is refused for the role, in the words and with the
-    exit that refusal has always had, and nothing in the report mentions
-    origin at all."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    drop_from_origin(spec, "001-a-thing")
-    path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                  commit=FAKE_SHA, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("code", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon, and no "
-        "`origin/001-a-thing` here after this run's fetch: origin has not got "
-        "that branch, so `resume` refuses the WHOLE feature for it, "
-        "\"001-a-thing is no longer on origin in the spec leg\", and nothing "
-        "here brings it back — the exits are to delete its `- branch: "
-        "001-a-thing` block from the record where the feature landed, or to "
-        "push the branch again from Falcon where it went by mistake"
-        ), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (code leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because there is no `origin/001-a-thing` in its "
-        "`spec` leg after this run's fetch, so it does not bring this leg "
-        "back — the exits are to delete its `- branch: 001-a-thing` block "
-        "from the record where the feature landed, or to push the branch "
-        "again from Falcon where it went by mistake"), findings[1]
-    assert "`resume Trio`" not in result.stdout
-    assert "park that feature again" not in result.stdout, (
-        "the re-park is the exit for the refusals `collect_legs` makes; a "
-        "feature that landed is a record entry to delete")
-
-    # AND `collect_legs` COMES FIRST, so a feature IT refuses is refused for
-    # that and the verdict the legs carry is the one with the re-park exit —
-    # RR2 never reads origin for that feature at all. The gone reading is kept
-    # in an array of its own for this, and read back only where the questions
-    # `collect_legs` asks found nothing, whatever the order of the legs.
-    path.write_text(path.read_text(encoding="utf-8")
-                    .replace(leg_block("code", FAKE_SHA),
-                             leg_block("", FAKE_SHA)), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because a leg of it in the record has no role, so it "
-        "does not bring this leg back — park that feature again from the "
-        "workstation that has it (the record says Falcon)"), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing: a leg of it in the record has no role;"
-        ), findings[1]
-    assert "is no longer on origin" not in result.stdout, (
-        "RR2 is never reached for a feature `collect_legs` throws out")
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_the_features_verdict_is_the_first_leg_resume_refuses_at(trio, home):
-    """Copilot's THIRD round on #23, 2026-09-12, verbatim: "`feature_gone` is
-    propagated to every leg without accounting for an earlier per-leg
-    refusal. For example, if the first leg has `pushed: false` (RR6) or no
-    `parked_commit:` (RR1) and a later leg has a missing origin branch,
-    `resume` stops at the first leg in record order, but this makes the whole
-    feature report RR2's gone-origin verdict and exits. Track the first
-    applicable refusal/order before promoting a later origin check to a
-    feature verdict, or suppress that promotion when an earlier leg already
-    blocks resume."
-
-    THE ORDER IS THE RECORD'S: `workspace_load_project` appends each leg in
-    file order, `collect_legs` walks `MANIFEST_LEG_ROLE` in that order, and
-    the per-leg loop under it breaks at the FIRST refusal — RR6, RR4, RR3,
-    RR2, RR1, RR5, each `refused=true; break`, with `[ "$refused" = false ] ||
-    continue` throwing the whole feature out after it. Run against the
-    extension on 2026-09-12 on a scratch three-leg estate — bare remotes in a
-    temp dir, a fake `$HOME`, the extension's own scripts — one feature, two
-    legs in two repositories, the record's order the variable:
-
-      `code` (`pushed: false`) then `spec` (branch deleted on origin)
-        "Error: 001-a-thing (code leg) was parked with --no-push; that feature
-        was NOT recreated", "REFUSED: 001-a-thing — parked with --no-push",
-        exit 2
-      `code` (no `parked_commit:`) then `spec` (branch deleted on origin)
-        "Error: 001-a-thing (code leg) has moved since it was parked; that
-        feature was NOT recreated", "REFUSED: 001-a-thing — divergence",
-        exit 2
-      `spec` (branch deleted on origin) then `code` (`pushed: false`)
-        "Error: 001-a-thing is no longer on origin in the spec leg; that
-        feature was NOT recreated", "REFUSED: 001-a-thing — gone from
-        origin", exit 2
-
-    ORIGIN IS NEVER READ IN THE FIRST TWO, so no line of them may say origin
-    has lost that branch and no line of them may name RR2's exits: deleting
-    the record entry is the wrong thing to do about a leg that was never
-    pushed. The verdict is the first REFUSING leg's, and every leg of the
-    feature carries it.
-
-    THE FOURTH BLOCK IS RR6 AGAINST RR4, because the order inside one leg is
-    as load-bearing as the order between legs: RR6 is the FIRST test of the
-    loop and carries no worktree condition, so a `--no-push` leg with its
-    worktree standing here still breaks the loop and still costs the feature,
-    while the gone-origin sibling two rows down is one `resume` never reaches.
-    Run against the extension on 2026-09-13, on a scratch three-leg estate
-    built the same way, the `code` leg's worktree registered at the parked
-    commit and the `spec` leg's branch deleted on origin:
-
-      `code` (`pushed: false`, worktree present) then `spec` (branch gone)
-        "Error: 001-a-thing (code leg) was parked with --no-push; that
-        feature was NOT recreated", "REFUSED: 001-a-thing — parked with
-        --no-push", exit 2, origin never mentioned
-      the same estate with that leg's `pushed: true` — the control
-        "Error: 001-a-thing is no longer on origin in the spec leg", "REFUSED:
-        001-a-thing — gone from origin", exit 2
-
-    So RR4 does not shield the leg from RR6, and it is RR6 that decides which
-    refusal the person gets.
-
-    THE FOURTH BLOCK'S WORKTREE IS AT THE PATH `resume` COMPUTES, which is
-    what "registered at the parked commit" meant in the run above and is what
-    this file's `parked_worktree` builds: RR4 matches ONE string, and a
-    worktree anywhere else is not the already-recreated leg this block needs
-    in order to be about RR6 at all. It was written at `Trio-wt/<branch>/
-    code`, a path neither verb reads, before this branch's own reading of RR4
-    existed to say so."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    drop_from_origin(spec, "001-a-thing")
-    afresh = ("park that feature again from Falcon, which writes the record "
-              "afresh")
-
-    # RR6 FIRST, RR2 SECOND. The `--no-push` leg keeps the line it always had
-    # — its own refusal, in its own words — and the leg origin has lost stops
-    # claiming a refusal `resume` never reaches.
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit=FAKE_SHA, pushed="false", parked_on="Falcon",
-                  root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (code leg): parked with --no-push on "
-        "Falcon and no worktree on that branch here; only that workstation "
-        "has the WIP commit, so nothing here brings it back — park it again "
-        "from there"), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because its `code` leg was parked with --no-push, so "
-        "it does not bring this leg back — " + afresh), findings[1]
-    assert "is no longer on origin" not in result.stdout, (
-        "RR6 breaks the loop before RR2 reads origin at all")
-    assert "delete its `- branch:" not in result.stdout, (
-        "a leg that was never pushed is no reason to delete the record entry")
-    assert "`resume Trio`" not in result.stdout
-
-    # RR1 FIRST, RR2 SECOND, and the same again: a leg the record names no
-    # commit for is refused at RR1 — after RR2 in one leg, before RR2 in the
-    # next one.
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit="", parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (code leg): the record names no parked "
-        "commit for that leg, and no worktree on that branch here; `resume` "
-        "matches origin's tip against the parked commit before it recreates "
-        "anything, an absent one never matches, and it refuses the leg as "
-        "having moved on since it was parked, so nothing here brings it back "
-        "— park it again from Falcon, which writes the record afresh"
-        ), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because the record names no parked commit for its "
-        "`code` leg, so it does not bring this leg back — " + afresh
-        ), findings[1]
-    assert "is no longer on origin" not in result.stdout
-    assert "`resume Trio`" not in result.stdout
-
-    # AND THE OTHER ORDER IS THE ONE THIS LAYER ALREADY READ RIGHT: with the
-    # gone leg FIRST, RR2 is the refusal `resume` makes and the report is the
-    # one it always was, the `--no-push` leg saying its own piece under it.
-    path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                  commit=FAKE_SHA, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("code", FAKE_SHA, pushed="false"),
-                    encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon, and no "
-        "`origin/001-a-thing` here after this run's fetch: origin has not got "
-        "that branch, so `resume` refuses the WHOLE feature for it, "
-        "\"001-a-thing is no longer on origin in the spec leg\", and nothing "
-        "here brings it back — the exits are to delete its `- branch: "
-        "001-a-thing` block from the record where the feature landed, or to "
-        "push the branch again from Falcon where it went by mistake"
-        ), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (code leg): parked with --no-push on "
-        "Falcon and no worktree on that branch here; only that workstation "
-        "has the WIP commit, so nothing here brings it back — park it again "
-        "from there"), findings[1]
-    assert "`resume Trio`" not in result.stdout
-
-    # AND RR6 IS BEFORE RR4, SO A WORKTREE HERE DOES NOT SAVE THE LEG, which
-    # is the one thing that could have made the first block above an accident
-    # of the fixture: RR2 and RR1 are read here only for a leg with NO
-    # worktree, because RR4 sits in front of them and `continue`s past a leg
-    # already recreated, and if the `pushed:` arm had been written with them
-    # it would have inherited that guard and let the gone-origin leg take the
-    # feature after all. `resume.sh` tests `[ "$pushed" != true ]` as the
-    # FIRST thing in the loop, with nothing about the worktree in it, so the
-    # `--no-push` leg still breaks the loop with its worktree standing — and
-    # the verdict the `spec` leg carries is still RR6's.
-    tip = feature_worktree(code, "001-a-thing",
-                           parked_worktree(trio, "001-a-thing", "code"))
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit=tip, pushed="false", parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "--fetch", "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (code leg): parked with --no-push on "
-        "Falcon; only that workstation has the WIP commit, and `resume` "
-        "refuses it"), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because its `code` leg was parked with --no-push, so "
-        "it does not bring this leg back — " + afresh), findings[1]
-    assert "is no longer on origin" not in result.stdout, (
-        "RR6 breaks the loop with the worktree standing, and RR2 is never "
-        "reached for the leg origin has lost")
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_every_command_it_hands_a_person_survives_a_space_in_the_path(
-        status_remotes, home):
-    """COPILOT'S FIRST ROUND ON #27 (2026-09-13), verbatim: "The remediation
-    command here interpolates `$repo` and `$want` directly into a shell
-    snippet. Valid paths containing spaces split the command, and shell
-    metacharacters make the copy-pasted `git worktree move` unsafe, so the
-    prescribed cleanup is not reliably runnable. Please emit shell-quoted
-    operands through a shared formatter (and cover such paths in tests)."
-
-    IT IS RIGHT, and by this layer's own rule: every one of these lines ends
-    in "which is yours to run", and the rule at the top of `check_parked_leg`
-    is that an arm may not name an exit that does not run. `~/My Projects` is
-    an ordinary spelling on a Mac, and a `git -C <that>/Atlas worktree move
-    <a> <b>` built by splicing it in is four operands where git wants two.
-
-    `sh_operand` is that formatter, and it quotes ONLY where a shell would
-    need it — a path of letters, digits and `/._@%+:,=-` is its own operand
-    everywhere — which is why no other pin in this file moves. This test is
-    the other half: a projects directory with a SPACE in it, where every
-    command the record layer prints must come back quoted and runnable.
-
-    The estate NAME is not tested for it because it cannot carry one:
-    `is_safe_folder_name` refuses anything outside `[A-Za-z0-9_.+@-]`, so
-    `resume <Name>` has no operand to quote."""
-    spaced = home / "my projects"
-    spaced.mkdir()
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(status_remotes["Atlas"]["bare"]),
-        str(spaced / "Atlas"), cwd=spaced)
-    atlas = spaced / "Atlas"
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    tip = git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip()
-    want = parked_worktree(atlas, "001-a-thing")
-    want.mkdir(parents=True)
-    (want / "stray.txt").write_text("not ours\n", encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home,
-                 env={"PROJECTS_DIR": str(spaced)})
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"move it aside with `mv '{want}' <a path of your choosing>`" in (
-        result.stdout), result.stdout
-    assert str(want) in result.stdout
-
-    # AND THE MOVE, WHICH TAKES TWO OF THEM: the worktree off the path, with
-    # nothing at the path this time, so the arm that names `worktree move` is
-    # the one that speaks.
-    rmtree(want)
-    elsewhere = home / "not the place" / "001-a-thing"
-    elsewhere.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", str(elsewhere), "001-a-thing", cwd=atlas)
-    result = run(STATUS, "Atlas", home=home,
-                 env={"PROJECTS_DIR": str(spaced)})
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"`mkdir -p '{want.parent}' && git -C '{atlas}' worktree move "
-            f"'{elsewhere}' '{want}'`") in result.stdout, result.stdout
-
-    # AND A SINGLE QUOTE IS THE ONE CHARACTER SINGLE QUOTES CANNOT HOLD, so
-    # the escape that ends them, adds a literal one and reopens them is what
-    # the formatter writes — `'it'\''s'` is `it's` to every POSIX shell.
-    quoted = home / "it's projects"
-    quoted.mkdir()
-    git("-c", "protocol.file.allow=always", "clone", "-q",
-        "--recurse-submodules", str(status_remotes["Atlas"]["bare"]),
-        str(quoted / "Atlas"), cwd=quoted)
-    q_atlas = quoted / "Atlas"
-    origin_has_branch(q_atlas, "001-a-thing")
-    q_tip = git("rev-parse", "origin/001-a-thing", cwd=q_atlas).stdout.strip()
-    q_want = parked_worktree(q_atlas, "001-a-thing")
-    q_want.mkdir(parents=True)
-    (q_want / "stray.txt").write_text("not ours\n", encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=q_tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home,
-                 env={"PROJECTS_DIR": str(quoted)})
-    assert result.returncode == 1, result.stdout + result.stderr
-    shell_safe = "'" + str(q_want).replace("'", "'\\''") + "'"
-    assert f"move it aside with `mv {shell_safe} <a path of your choosing>`" in (
-        result.stdout), result.stdout
-
-    # AND A PATH THAT NEEDS NOTHING IS LEFT ALONE, which is why every other
-    # pin in this file still passes: the same estate under a plain projects
-    # directory prints the same command unquoted.
-    plain = clone_root(home, status_remotes["Atlas"], "Atlas")
-    origin_has_branch(plain, "001-a-thing")
-    plain_tip = git("rev-parse", "origin/001-a-thing", cwd=plain).stdout.strip()
-    plain_want = parked_worktree(plain, "001-a-thing")
-    plain_want.mkdir(parents=True)
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=plain_tip, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"`mv {plain_want} <a path of your choosing>`" in result.stdout
-
-
-def test_what_the_prune_leaves_behind_is_a_path_and_not_a_directory(
-        atlas, home):
-    """COPILOT'S SECOND ROUND ON #27 (2026-09-13, suppressed), verbatim: "For a
-    stale registration on the recorded branch whose old worktree path is now a
-    regular file, the `-d` check is false, so status tells the user to prune
-    and then resume even though the file remains and `resume` still rejects the
-    existing destination. Detect and describe any leftover path here, not just
-    directories." Its twin on the LOCKED arm says the same of that one.
-
-    BOTH ARE REAL, and git says so in three words. Run on 2026-09-13: a
-    worktree registered, its directory replaced by a regular FILE, git calling
-    the block "prunable gitdir file points to non-existent location"; `git
-    worktree prune` cleared the registration and `git worktree add` at that
-    same path then answered "fatal: '…' already exists". The reason is the
-    path EXISTING and not what kind of path it is, so the clause asks `-e` and
-    says "whatever the prune leaves behind"."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    rmtree(where)
-    where.write_text("a file now\n", encoding="utf-8")   # not a directory
-    porcelain = git("worktree", "list", "--porcelain", cwd=atlas).stdout
-    assert "prunable" in porcelain, "git no longer says prunable; moot"
-    assert where.is_file(), "the FILE is what makes this case"
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("whose path is still on disk and is no longer a worktree") in (
-        result.stdout), result.stdout
-    assert ("worktree prune` and a move of what is there aside (`git worktree "
-            'add` refuses a path that "already exists")') in result.stdout
-
-    # AND THE LOCKED ARM'S OWN CLAUSE, which is the same test on the other
-    # side: git computes no `prunable` for a locked block, so that path is
-    # RR4's second arm and the exit is the unlock, the prune and the move.
-    where.unlink()
-    where.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "prune", cwd=atlas)
-    git("worktree", "add", "-q", "-b", "002-other", str(where), cwd=atlas)
-    git("worktree", "lock", str(where), cwd=atlas)
-    rmtree(where)
-    where.write_text("a file now\n", encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="repo",
-           commit=git("rev-parse", "origin/001-a-thing",
-                      cwd=atlas).stdout.strip())
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("and move aside whatever the prune leaves behind there, which "
-            "`resume` refuses for existing whatever git holds") in (
-        result.stdout), result.stdout
-
-
-def test_the_move_names_a_parent_that_is_never_the_empty_string(atlas, home):
-    """COPILOT'S SECOND ROUND ON #27 (2026-09-13), verbatim: "When the
-    configured worktree root is `/`, `want` can be `/branch`, so `${want%/*}`
-    expands to the empty string. The generated recovery command becomes `mkdir
-    -p '' && git worktree move ...`, which fails before the move even though
-    `resume` only needs the already-existing `/` parent. Use a parent-directory
-    fallback of `/` (or `dirname`) when constructing this command."
-
-    IT IS RIGHT AND IT WAS RUN: `mkdir -p ''` answers "cannot create directory
-    ''", so the exit dies on its first operand. `parent_dir` is that fallback,
-    and `/` is the one directory `${p%/*}` cannot name.
-
-    NOTHING IS CREATED BY THIS TEST: `status` reads and changes nothing, and
-    the only thing it does with `/001-a-thing` is ask whether it exists."""
-    checkout = workspace_config(home)
-    config = atlas / ".specify" / "extensions" / "git"
-    config.mkdir(parents=True, exist_ok=True)
-    (config / "git-config.yml").write_text(
-        "checkout_mode: worktree\nworktree_root: /\n", encoding="utf-8")
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    # `//001-a-thing` AND NOT `/001-a-thing`, because that is the string the
-    # other end computes: `resolve_path_from_repo_root` hands an absolute
-    # value back unchanged and `collect_legs` joins `$WORKTREE_ROOT/$branch`,
-    # so both ends spell the doubled slash and the comparison is exact.
-    assert "which is not the //001-a-thing `resume` computes for it" in (
-        result.stdout), result.stdout
-    assert (f"`mkdir -p / && git -C {atlas} worktree move {elsewhere} "
-            "//001-a-thing`") in result.stdout, result.stdout
-    assert "mkdir -p ''" not in result.stdout
-    assert "mkdir -p  &&" not in result.stdout
-
-
-def test_the_ref_in_the_diverged_command_is_a_shell_operand_too(atlas, home):
-    """COPILOT'S THIRD ROUND ON #27 (2026-09-13), verbatim: "The generated `git
-    log` command now quotes the repository path but still interpolates `branch`
-    unquoted. Git refnames can contain shell metacharacters such as `$`, so a
-    valid recorded branch can make this copy-pasted diagnostic expand or split
-    in the user's shell. Pass the ref through the same shell-operand formatter
-    and cover a metacharacter-bearing branch in the command-output test."
-
-    IT IS RIGHT: `git check-ref-format` takes `$` in a refname, and `git log
-    --oneline <sha>..feat/$HOME-thing` in a shell is `git log --oneline
-    <sha>..feat/` followed by whatever `$HOME-thing` expands to. The whole
-    revision range is one operand, so the whole range goes through
-    `sh_operand` — which leaves an ordinary branch name untouched, and is why
-    the pin beside this one did not move."""
-    checkout = workspace_config(home)
-    branch = "001-a-$thing"
-    where = parked_worktree(atlas, branch)
-    base = feature_worktree(atlas, branch, where)
-    (where / "theirs.md").write_text("theirs\n", encoding="utf-8")
-    commit_all(where, "parked elsewhere")
-    git("push", "-q", "origin", branch, cwd=where)
-    theirs = git("rev-parse", "HEAD", cwd=where).stdout.strip()
-    git("reset", "-q", "--hard", base, cwd=where)
-    (where / "mine.md").write_text("mine\n", encoding="utf-8")
-    commit_all(where, "mine")
-    record(checkout, "atlas", branch=branch, role="repo", commit=theirs)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"reconcile by hand: `git -C {atlas} log --oneline "
-            f"'{theirs[:7]}..{branch}'`") in result.stdout, result.stdout
-    assert f"--oneline {theirs[:7]}..{branch}`" not in result.stdout, (
-        "the ref is an operand, and an unquoted `$` is the shell's")
-
-
-def test_an_off_path_leg_whose_branch_origin_lost_carries_rr2s_exits(
-        atlas, home):
-    """COPILOT'S THIRD ROUND ON #27 (2026-09-13, suppressed), two comments and
-    one finding. On the RR2 predicate: "The `worktree_here` check above
-    delegates to `worktree_on_branch`, so it returns true for any live worktree
-    on this branch, not just the path RR4 computes. With `--fetch`, an off-path
-    worktree plus a successfully fetched missing `origin/<branch>` should reach
-    RR2 in `resume`, but this return suppresses the first-pass `gone` verdict
-    and can make sibling legs recommend the wrong re-park/move exit." And on
-    the arm it feeds: "this row instead recommends moving the worktree and
-    hides the delete/push exits for the actual refusal."
-
-    BOTH ARE REAL, and one run settles them. On a scratch estate on 2026-09-13
-    with the leg's worktree at `$HOME/elsewhere/001-a-thing` and its branch
-    deleted on origin, `resume.sh` answered "Error: 001-a-thing is no longer on
-    origin in the spec leg; that feature was NOT recreated", "REFUSED:
-    001-a-thing — gone from origin", exit 2 — RR4 missing ON THE PATH, RR3
-    finding nothing there, and RR2 refusing before any add — while this layer
-    named a `git worktree move`, which brings back no branch origin has lost.
-
-    SO `already_recreated` REPLACES `worktree_here` in RR2's predicate — RR4's
-    first arm asked the way RR4 asks it, a registration AT the computed path on
-    this branch — and the off-path line keeps its FACT and takes RR2's EXITS.
-    The fact is still worth a line: where the worktree sits is true of this
-    workstation, RR2's own words do not carry it, and `park` here will not
-    collect it either."""
-    checkout = workspace_config(home)
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    want = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    drop_from_origin(atlas, "001-a-thing")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its worktree is at "
-            f"{elsewhere}, which is not the {want} `resume` computes for it"
-            ) in result.stdout, result.stdout
-    assert ("there is no `origin/001-a-thing` in this leg after this run's "
-            "fetch either, so `resume` refuses at that before it reaches any "
-            "add — the exits are to delete its `- branch: 001-a-thing` block "
-            "from the record where the feature landed, or to push the branch "
-            "again from Falcon where it went by mistake") in result.stdout
-    assert "worktree move" not in result.stdout, (
-        "a move brings back no branch origin has lost")
-
-    # AND WITHOUT THE FLAG the reading is not made at all — a missing
-    # `origin/<branch>` has a second and commoner reading there — so the move
-    # is the exit again, which is the control for the arm above.
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"worktree move {elsewhere} {want}" in result.stdout, result.stdout
-
-
-def test_a_dangling_symlink_at_that_path_is_the_adds_refusal_not_rr3s(
-        atlas, home):
-    """COPILOT'S FOURTH ROUND ON #27 (2026-09-13, suppressed), verbatim: "`[ -e
-    "$want" ]` follows symlinks, so a dangling symlink at the computed
-    destination is treated as absent. `git worktree add` still rejects that
-    existing path, so a parked feature with no branch worktree falls through to
-    the `resume` success guidance even though `resume` fails at its final add."
-
-    IT IS REAL AND GIT SAYS SO: run on 2026-09-13, with a dangling symlink at a
-    path, `[ -e ]` is false, `[ -L ]` is true, and `git worktree add` answers
-    "fatal: '…' already exists".
-
-    AND IT IS THE ADD's REFUSAL, NOT RR3's. `resume.sh`'s RR3 is the same
-    `[ -e "$tree" ]`, so it looks straight through the link too and the run
-    goes on to RR2, RR1, RR5 and dies on the last thing it does — which is
-    exactly the shape of the prunable registration this layer already reads in
-    the stale arms' words. So this is read there too, in words of its own: what
-    settles it is not a prune, because nothing is registered at that path, but
-    the `mv` every other leftover there wants. `path_in_the_way` still asks
-    `[ -e ]` and nothing more, because a reading harder than the other end's
-    would invent an RR3 refusal `resume` does not make."""
-    checkout = workspace_config(home)
-    want = parked_worktree(atlas, "001-a-thing")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    want.symlink_to(home / "nowhere-at-all")
-    assert not want.exists() and want.is_symlink(), "the dangling link is the case"
-    origin_has_branch(atlas, "001-a-thing")
-    tip = git("rev-parse", "origin/001-a-thing", cwd=atlas).stdout.strip()
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): no worktree on that "
-            f"branch here, but a dangling symlink is at the {want} `resume` "
-            "computes for this leg, which `[ -e ]` looks straight through and "
-            '`git worktree add` refuses all the same ("already exists") — '
-            f"clear it with a move of it aside (`mv {want} <a path of your "
-            "choosing>`), then `resume Atlas` brings it back") in (
-        result.stdout), result.stdout
-    assert "is in the way" not in result.stdout, (
-        "RR3 looks through the link at the other end too")
-    assert "worktree prune" not in result.stdout, (
-        "nothing is registered at that path to prune")
-
-
-def test_an_off_path_worktree_with_a_dangling_link_at_the_path_is_not_silence(
-        atlas, home):
-    """COPILOT'S FIFTH ROUND ON #27 (2026-09-13), verbatim: "`dest_exists`
-    treats a dangling symlink as occupied, but `resume`'s RR3 uses `[ -e ]` and
-    therefore proceeds to its final `git worktree add`, which still rejects
-    that symlink. With an off-path live worktree and a dangling symlink at this
-    computed destination, this condition is false, so no add verdict is carried
-    to sibling legs and the report can claim the feature is clean even though
-    `resume` fails."
-
-    IT IS RIGHT, AND THE ROUND BEFORE IT MADE THAT SILENCE. `[ -e ]` is the
-    test RR3 makes at the other end, so a path only a link occupies is one the
-    run walks PAST — and then the add refuses it. The feature is refused, the
-    finding is the off-path one, and clearing the link is a STEP IN ITS EXIT
-    rather than a reason to say nothing: the `mv` goes in front of the `mkdir
-    -p`, where the prune goes for a stale registration, and the clause behind
-    the command says which of them git refuses for what."""
-    checkout = workspace_config(home)
-    want = parked_worktree(atlas, "001-a-thing")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    want.symlink_to(home / "nowhere-at-all")
-    assert not want.exists() and want.is_symlink()
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its worktree is at "
-            f"{elsewhere}, which is not the {want} `resume` computes for it"
-            ) in result.stdout, result.stdout
-    # THE `mv` NAMES NO DESTINATION OF ITS OWN since Copilot's sixth round on
-    # #27 (2026-09-13, suppressed): a hard-coded `<want>.aside` would overwrite
-    # that path where it already exists, which is the one thing every `mv` this
-    # file prints has refused to do since the commit that first named one.
-    assert (f"move it where both look: `mv {want} <a path of your choosing> "
-            f"&& mkdir -p {want.parent} && git -C {atlas} worktree move "
-            f"{elsewhere} {want}`") in result.stdout, result.stdout
-    assert ("`git worktree add` refuses the dangling symlink at that path "
-            '("already exists") whatever `[ -e ]` says of it') in result.stdout
-
-
-def test_a_symlinked_parent_of_the_computed_path_gets_no_move_either(
-        trio, home):
-    """COPILOT'S SIXTH ROUND ON #27 (2026-09-13, suppressed), verbatim: "The
-    symlink safeguard only checks `RECORD_WORKTREE_ROOT`, not all components of
-    the computed destination. If an existing `$WORKTREE_ROOT/$branch` (or a
-    parent from a declared mount) is a symlink while the final `$want` is
-    absent, this branch advertises `mkdir -p ... && git worktree move ...`;
-    both commands follow the link and Git records the physical target, while
-    `resume` later compares the lexical `$want` and still refuses at RR3."
-
-    RIGHT, and it is the same fault one level down: the question is asked of
-    the destination's PARENT now, which `has_symlink_component` walks prefix by
-    prefix — so the root, the feature directory and every mount above the last
-    component are all in it. The FINAL component is deliberately out: a link
-    there is the leftover the `mv` clears, not a spelling to correct."""
-    checkout = workspace_config(home)
-    spec = trio / "spec"
-    git("checkout", "-q", "main", cwd=spec)
-    origin_has_branch(spec, "001-a-thing")
-    tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    want = parked_worktree(trio, "001-a-thing", "spec")
-    # THE FEATURE DIRECTORY IS THE LINK, and the mount under it is not there at
-    # all — the shape a root-only question cannot see, and the reason this is a
-    # three-leg estate: a single root's computed path IS the feature directory,
-    # so a link there is the FINAL component, which RR3 sees and an `mv` fixes.
-    real = home / "real-feature"
-    real.mkdir()
-    want.parent.parent.mkdir(parents=True, exist_ok=True)
-    want.parent.symlink_to(real)
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    elsewhere.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", str(elsewhere), "001-a-thing", cwd=spec)
-    record(checkout, "trio", branch="001-a-thing", role="spec", commit=tip,
-           parked_on="Falcon", root="Trio")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "no `worktree move` fixes this one, because the path it would " in (
-        result.stdout), result.stdout
-    # AND THE COMPONENT IT NAMES IS THE FEATURE DIRECTORY, not the worktree
-    # root, which is the half Copilot's eighth round on #27 asked for: the root
-    # here is a real directory and the link is under it, so the remedy is that
-    # component being a directory rather than a setting to respell.
-    assert (f"{want.parent} is a symlink under the worktree root") in (
-        result.stdout), result.stdout
-    assert f"worktree move {elsewhere}" not in result.stdout, result.stdout
-
-
-def test_every_root_mount_spelling_gets_the_same_no_command_reading(
-        atlas, home):
-    """COPILOT'S SIXTH ROUND ON #27 (2026-09-13, suppressed), verbatim:
-    "`dot_mount` only recognizes a destination whose raw string ends in `/.`.
-    The manifest parser preserves other non-empty root spellings such as `path:
-    "./"`, so `collect_legs` can produce `<worktree_root>/<branch>/./`; this
-    helper misses it and `off_path_exit` advertises a move."
-
-    RIGHT: `_shape_record_leg` keeps any non-empty `path:` verbatim, so `.`,
-    `./` and `.//` all reach `collect_legs` and all name the feature directory
-    itself — and every operand built on them was already run and refused (the
-    tip of this branch, and the round that stopped advertising one). Trailing
-    slashes come off before the `.` is looked for."""
-    checkout = workspace_config(home)
-    where = home / "Atlas-wt" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="code", commit=tip,
-           parked_on="Falcon")
-    pristine = (atlas / "project.yaml").read_text(encoding="utf-8")
-    for spelling in ('    path: "./"\n', '    path: ".//"\n'):
-        (atlas / "project.yaml").write_text(pristine, encoding="utf-8")
-        code_leg_onto_the_spec_checkout(atlas, path_line=spelling)
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert "`mkdir -p " not in result.stdout, result.stdout
-        assert f"worktree move {where}" not in result.stdout, result.stdout
-        assert ("there is no command that puts it where `resume` looks: this "
-                'leg is declared `path: "."` in `project.yaml`') in (
-            result.stdout), result.stdout
-
-
-def test_no_sibling_offers_resume_for_a_destination_that_blocks_the_add(
-        trio, home):
-    """COPILOT'S SEVENTH AND EIGHTH ROUNDS ON #27 (2026-09-13, suppressed), the
-    seventh verbatim: "This add-verdict prepass only runs when
-    `worktree_on_branch` finds a live off-path worktree. It misses other
-    failures that happen before or at `git worktree add` when no worktree
-    exists, such as a dangling symlink at the computed destination (RR3's
-    `[ -e ]` check passes) or a regular file at the feature-directory parent
-    (`resume`'s `mkdir -p` fails). In a multi-leg record, the culprit line can
-    then say to clear the path and resume while sibling legs still advertise
-    `resume`, even though the run refuses the whole feature."
-
-    IT IS REAL AND IT IS THIS BRANCH'S OWN RULE BROKEN: no line of a feature
-    `resume` refuses whole may name `resume <Name>`. Three states reach the
-    add with no worktree anywhere — a registration git still holds at that path
-    with nothing on disk, a dangling symlink there, and a feature directory
-    that is not a directory — and `check_parked_leg` reads all three on the
-    CULPRIT leg already. What was missing is the FEATURE's verdict, so every
-    sibling went on offering the command that cannot run.
-
-    THE CULPRIT KEEPS ITS OWN LINE, which already names the blocker AND the
-    command that clears it and ends in the `resume` that follows the clearing —
-    the sentence this branch's third commit chose deliberately. The sibling
-    carries the verdict and the same exit, and says nothing about `resume`."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    spec_tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    code_tip = git("rev-parse", "origin/001-a-thing", cwd=code).stdout.strip()
-    want = parked_worktree(trio, "001-a-thing", "spec")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    want.symlink_to(home / "nowhere-at-all")
-    assert not want.exists() and want.is_symlink()
-    path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                  commit=spec_tip, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("code", code_tip), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0].startswith(
-        "- parked feature 001-a-thing (spec leg): no worktree on that branch "
-        f"here, but a dangling symlink is at the {want} `resume` computes for "
-        "this leg"), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (code leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        f"WHOLE feature, because a dangling symlink is at the {want} it "
-        "computes for its `spec` leg, which `[ -e ]` looks straight through "
-        "and `git worktree add` refuses all the same, so it does not bring "
-        f"this leg back — clear it with `mv {want} <a path of your "
-        "choosing>`, which is yours to run"), findings[1]
-    assert "`resume Trio` brings it back" in findings[0], (
-        "the culprit's own line ends in the run AFTER the clearing")
-    assert "`resume Trio`" not in findings[1], (
-        "no sibling offers a command that cannot run")
-
-    # AND THE FEATURE DIRECTORY IS THE SAME VERDICT, read the same way — and
-    # here BOTH legs are culprits, because in a three-leg root one feature
-    # directory is the parent of both mounts. Each says its own reading and
-    # each carries the verdict; neither offers `resume`.
-    want.unlink()
-    rmtree(want.parent)
-    want.parent.write_text("a file where the feature directory goes\n",
-                           encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    for line in findings:
-        assert (f"the {want.parent} `resume` makes the feature's worktrees "
-                "under is not a directory, and `resume` runs `mkdir -p` on it "
-                "before it adds any leg") in line, line
-    # The FIRST leg is the one the verdict belongs to and keeps its own line,
-    # which ends in the run AFTER the clearing; the second carries the verdict
-    # as well and offers no `resume`.
-    assert findings[0].endswith("`), then `resume Trio` brings it back"), (
-        findings[0])
-    assert ("`resume` refuses the WHOLE feature in any case, because the "
-            f"{want.parent} it makes that leg's worktrees under is not a "
-            "directory") in findings[1], findings[1]
-    assert "`resume Trio`" not in findings[1], findings[1]
-
-    # AND A STALE REGISTRATION AT THAT PATH, the third of the three.
-    want.parent.unlink()
-    want.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(want), cwd=spec)
-    rmtree(want)
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert ("`resume` refuses the WHOLE feature, because git still holds a "
-            f"worktree registration at the {want} it computes for its `spec` "
-            "leg, with nothing on disk there") in findings[1], findings[1]
-    assert "worktree prune" in findings[1], findings[1]
-    assert "`resume Trio`" not in findings[1]
-
-    # AND WHERE TWO OF THEM HOLD AT ONCE the exit is BOTH, in order (Copilot's
-    # ninth round on #27, 2026-09-13, verbatim: "`ADD_BLOCKED_EXIT` then
-    # contains only `worktree prune`, but prune does not remove the dangling
-    # link or parent file; in a multi-leg record, siblings carry that
-    # incomplete exit and `resume` still fails"). Right: the prune clears a
-    # REGISTRATION and touches nothing on disk, so where a dangling link holds
-    # the same path both steps belong in the one exit a person pastes.
-    want.symlink_to(home / "nowhere-at-all")
-    assert not want.exists() and want.is_symlink()
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert (f"clear it with `git -C {trio / 'spec'} worktree prune`, then "
-            f"`mv {want} <a path of your choosing>`, which is yours to run"
-            ) in findings[1], findings[1]
-    assert "`resume Trio`" not in findings[1], findings[1]
-
-
-def test_a_feature_directory_that_is_not_a_directory_is_read_too(trio, home):
-    """COPILOT'S SIXTH ROUND ON #27 (2026-09-13, suppressed), verbatim:
-    "`dest_exists` only checks the final component. For a three-leg
-    destination, `want` is `<worktree_root>/<branch>/<mount>`, but `resume`
-    first runs `mkdir -p <worktree_root>/<branch>`; if that feature directory
-    is a regular file or dangling symlink, the final path appears absent and
-    status can recommend `resume` (or emit a `mkdir -p ... && git worktree move
-    ...`) even though the mkdir fails before the worktree is added."
-
-    RUN on 2026-09-13: `mkdir -p <file>/spec` answers "mkdir: cannot create
-    directory '…': Not a directory". So the run stops EARLIER than the add and
-    in `resume.sh`'s own words rather than git's, and this layer said "`resume
-    Trio` brings it back". It is read with the other paths in the way of a step
-    no RR looks at, and cleared by the same `mv`.
-
-    THE SHAPE IS THE THREE-LEG ONE, because a single root's `repo` leg has no
-    mount under the feature directory: its computed path IS that directory, and
-    a file there is already the dangling/existing reading above."""
-    checkout = workspace_config(home)
-    spec = trio / "spec"
-    git("checkout", "-q", "main", cwd=spec)
-    origin_has_branch(spec, "001-a-thing")
-    tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    want = parked_worktree(trio, "001-a-thing", "spec")
-    feature_dir = want.parent
-    feature_dir.parent.mkdir(parents=True, exist_ok=True)
-    feature_dir.write_text("a file where the feature directory goes\n",
-                           encoding="utf-8")
-    assert feature_dir.is_file() and not want.exists()
-    record(checkout, "trio", branch="001-a-thing", role="spec", commit=tip,
-           parked_on="Falcon", root="Trio")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (spec leg): no worktree on that "
-            f"branch here, but the {feature_dir} `resume` makes the feature's "
-            "worktrees under is not a directory, and `resume` runs `mkdir -p` "
-            'on it before it adds any leg ("cannot create directory …: Not a '
-            f"directory\") — clear it with a move of it aside (`mv "
-            f"{feature_dir} <a path of your choosing>`), then `resume Trio` "
-            "brings it back") in result.stdout, result.stdout
-
-
-def test_a_leftover_at_the_destination_is_named_beside_a_prune_elsewhere(
-        atlas, home):
-    """COPILOT'S FIFTH ROUND ON #27 (2026-09-13, suppressed), verbatim:
-    "Restricting this probe to `[ -z "$ghost" ]` misses a destination
-    obstruction whenever the recorded branch has a stale registration at some
-    other path … so the destination is never examined and the report offers
-    `resume` even though its final `git worktree add` is blocked by the
-    destination registration."
-
-    THE PRUNE ITSELF IS NOT THE GAP: `git worktree prune` walks every
-    registration in the repository, not one, so the exit those arms name
-    already clears a stale block at the destination too. WHAT THE PRUNE DOES
-    NOT DO IS MOVE ANYTHING ON DISK — and a leftover at the DESTINATION is what
-    `git worktree add` refuses after it, which is the half worth a clause. It
-    is named where the two paths differ, which is the only shape in which the
-    arms above have not named it already."""
-    checkout = workspace_config(home)
-    want = parked_worktree(atlas, "001-a-thing")
-    want.parent.mkdir(parents=True, exist_ok=True)
-    # a stale registration for the RECORDED branch somewhere else…
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    (elsewhere / ".git").unlink()          # prunable, the directory left
-    # …and a DANGLING SYMLINK at the path `resume` computes, which is the one
-    # shape RR3 walks past — a real directory there is RR3's own refusal and
-    # the in-the-way arm says it, above all of this.
-    want.symlink_to(home / "nowhere-at-all")
-    assert not want.exists() and want.is_symlink()
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f", and a move aside of what is at the {want} `resume` computes "
-            "for this leg, which the prune does not touch and `git worktree "
-            "add` refuses for existing") in result.stdout, result.stdout
-
-
-def test_a_locked_off_path_worktree_names_the_unlock_before_the_move(
-        atlas, home):
-    """COPILOT'S FOURTH ROUND ON #27 (2026-09-13, suppressed), verbatim: "When
-    the off-path worktree itself is locked, `worktree_on_branch` still returns
-    it as live, but this branch only checks `held` for the destination and
-    prints `git worktree move <tree> <want>`. Git refuses moving a locked
-    source, so the recovery command cannot run; please carry the source
-    registration's lock state through the lookup and prepend `git worktree
-    unlock <tree>` before the move."
-
-    RUN on 2026-09-13: `git worktree move` with a locked source answered
-    "fatal: cannot move a locked working tree; use 'move -f -f' to override or
-    unlock first", and after `git worktree unlock` the same move exited 0. The
-    unlock goes in front, which is the pair the in-the-way arm has named for a
-    locked DESTINATION since this branch's second commit; this is its twin on
-    the source, and `$held` was only ever the destination's."""
-    checkout = workspace_config(home)
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    want = parked_worktree(atlas, "001-a-thing")
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    git("worktree", "lock", str(elsewhere), cwd=atlas)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"move it where both look: `git -C {atlas} worktree unlock "
-            f"{elsewhere} && mkdir -p {want.parent} && git -C {atlas} "
-            f"worktree move {elsewhere} {want}`, which is yours to run — "
-            "`worktree move` creates no parent directory of its own, and it "
-            "refuses a LOCKED source until the unlock in front of it") in (
-        result.stdout), result.stdout
-
-    # AND WITH THE LOCK OFF the command is the pair it always was, which is
-    # the control: one `git worktree unlock` apart.
-    git("worktree", "unlock", str(elsewhere), cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"move it where both look: `mkdir -p {want.parent} && git -C "
-            f"{atlas} worktree move {elsewhere} {want}`") in result.stdout
-    assert "worktree unlock" not in result.stdout
-
-
-def test_no_move_is_named_where_the_worktree_root_is_itself_a_symlink(
-        atlas, home):
-    """COPILOT'S THIRD ROUND ON #27 (2026-09-13, suppressed), verbatim:
-    "`off_path_exit` still advertises this move when `worktree_root` is a
-    symlink. `record_worktree_root` deliberately preserves that lexical
-    spelling, while Git reports the physical worktree path; moving an off-path
-    worktree to this `want` therefore leaves `registered_at` unable to match
-    it, so the next `resume` still refuses at RR3."
-
-    IT IS REAL AND IT WAS RUN END TO END on 2026-09-13: the move exited 0, git
-    then held the worktree at the PHYSICAL `…/real-wt/001-a-thing/spec`, and
-    `resume.sh` answered "Error: '…/wtlink/001-a-thing/spec' exists and is not
-    a registered worktree of the spec leg", "REFUSED: 001-a-thing — an
-    unrelated path is in the way", exit 2. The move ran and fixed nothing,
-    which is the one thing the rule at the top of `check_parked_leg` forbids.
-
-    THE EXIT THAT DOES WORK IS THE SPELLING, and that was run too: the same
-    estate with `worktree_root` set to the path git spells RESUMED the feature,
-    exit 0. So the line names that, and the resolving is still not done here —
-    a `worktree_root` resolved harder than the other end resolves it would
-    compute a path `resume` does not, which is the finding this branch already
-    carries from the other side."""
-    checkout = workspace_config(home)
-    real = home / "real-wt"
-    real.mkdir()
-    (home / "wtlink").symlink_to(real)
-    where = atlas / ".specify" / "extensions" / "git"
-    where.mkdir(parents=True, exist_ok=True)
-    (where / "git-config.yml").write_text(
-        f"checkout_mode: worktree\nworktree_root: {home / 'wtlink'}\n",
-        encoding="utf-8")
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", elsewhere)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip,
-           parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    # AND THE LINE NAMES THE COMPONENT since Copilot's eighth round on #27
-    # (2026-09-13, suppressed): the question was widened to every parent one
-    # round earlier and the ANSWER went on naming the root it no longer meant,
-    # which for a link at `<worktree_root>/<branch>` or a mount's parent is the
-    # wrong setting to point a person at.
-    assert (f"no `worktree move` fixes this one, because the path it would "
-            f"land in is reached through a symlink: both verbs compute "
-            f"{home / 'wtlink' / '001-a-thing'} and git registers whatever is "
-            f"made there under the path that link resolves to, so `resume` "
-            f"matches nothing however the worktree is moved — "
-            f"{home / 'wtlink'} is a symlink, and it is the worktree root this "
-            f"checkout computes (or a directory above it) — spell "
-            f"`worktree_root` (or `$SPECKIT_GIT_WORKTREE_ROOT`) as the "
-            f"directory git spells, which is {real}, and the `git worktree "
-            "move` this line would otherwise name becomes one that works") in (
-        result.stdout), result.stdout
-
-    # AND A LINK WHOSE TARGET IS NOT THERE YET is the same refusal, which
-    # `physical_path` cannot see (Copilot's fourth round on #27): `cd` into it
-    # fails, so the fallback returns the lexical path and the two compare
-    # equal — while `[ -L ]` on the component answers whether or not the
-    # target exists, and `mkdir -p` through such a link answers "cannot create
-    # directory '…': File exists", so the exit would die on its first operand.
-    rmtree(real)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "no `worktree move` fixes this one" in result.stdout, result.stdout
-    assert f"{home / 'wtlink'} is a symlink, and it is the worktree root" in (
-        result.stdout), result.stdout
-    real.mkdir()
-    assert f"worktree move {elsewhere}" not in result.stdout
-
-    # AND WITH THE ROOT SPELLED THE WAY GIT SPELLS IT the move is named again,
-    # which is the control: the same estate, the same worktree, one line of
-    # config apart.
-    (where / "git-config.yml").write_text(
-        f"checkout_mode: worktree\nworktree_root: {real}\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"worktree move {elsewhere} {real / '001-a-thing'}") in (
-        result.stdout), result.stdout
-
-
-def test_only_the_leg_the_run_stops_at_speaks_for_the_path(trio, home):
-    """COPILOT'S FIRST ROUND ON #27 (2026-09-13, suppressed), verbatim: "When
-    an earlier leg has already set the feature verdict to `inway` (or `add`),
-    `refused_exit` is nonempty for every sibling, so this guard still lets
-    later legs re-enter `path_in_the_way` (and the analogous off-path guard
-    below). If a later leg also has an obstruction, its own refusal/exit is
-    reported even though `resume` stops at the earlier leg and the first-pass
-    verdict is meant to be carried to all siblings. Track the refusing leg and
-    only run these path checks for that leg; otherwise render the stored
-    verdict for siblings."
-
-    IT IS REAL, and the run says so. On a scratch three-leg estate on
-    2026-09-13 — bare remotes in a temp dir, a fake `$HOME`, workBenches' own
-    scripts — with a stray DIRECTORY at the `spec` leg's computed path and a
-    worktree of another branch at the `code` leg's, `resume.sh` answered
-    ONCE: "Error: 'worktrees/001-a-thing/spec' exists and is not a registered
-    worktree of the spec leg; that feature was NOT recreated", "REFUSED:
-    001-a-thing — an unrelated path is in the way", exit 2. It breaks at the
-    FIRST leg in the record's order and never reads the second leg's path, so
-    a second line quoting "an unrelated worktree is in the way" is a REFUSED
-    reason that run does not print — the drift this file's own rules forbid,
-    and the one the round before this closed from the other side.
-
-    So the verdict carries its leg's ORDINAL now, and the two arms that read
-    a path run for that leg alone. The sibling says what every sibling of a
-    refused feature says: the verdict, and the exit that travels with it."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    spec_tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    code_tip = git("rev-parse", "origin/001-a-thing", cwd=code).stdout.strip()
-    spec_want = parked_worktree(trio, "001-a-thing", "spec")
-    code_want = parked_worktree(trio, "001-a-thing", "code")
-    spec_want.mkdir(parents=True)
-    (spec_want / "stray.txt").write_text("not ours\n", encoding="utf-8")
-    code_want.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", "-b", "002-other", str(code_want), cwd=code)
-    path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                  commit=spec_tip, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("code", code_tip), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0].startswith(
-        f"- parked feature 001-a-thing (spec leg): a directory is at "
-        f"{spec_want}, which is the path `resume` computes for this leg"
-        ), findings[0]
-    assert findings[1] == (
-        "- parked feature 001-a-thing (code leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        f"WHOLE feature, because a directory is at the {spec_want} it "
-        "computes for its `spec` leg, so it does not bring this leg back — "
-        f"move it aside with `mv {spec_want} <a path of your choosing>`, "
-        "which is yours to run — nothing here moves or deletes a path it did "
-        "not create"), findings[1]
-    assert "an unrelated worktree is in the way" not in result.stdout, (
-        "`resume` stops at the spec leg and never reads the code leg's path")
-    assert str(code_want) not in result.stdout, (
-        "the later leg's obstruction is one the run never reaches")
-    assert "`resume Trio`" not in result.stdout
-
-    # AND WITH THE RECORD'S ORDER REVERSED the other leg is the one that
-    # speaks, which is what makes this the record's order and not a priority
-    # between readings.
-    path = record(checkout, "trio", branch="001-a-thing", role="code",
-                  commit=code_tip, parked_on="Falcon", root="Trio")
-    path.write_text(path.read_text(encoding="utf-8")
-                    + leg_block("spec", spec_tip), encoding="utf-8")
-    result = run(STATUS, "Trio", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0].startswith(
-        f"- parked feature 001-a-thing (code leg): a worktree on `002-other` "
-        f"is at {code_want}, which is the path `resume` computes for this leg"
-        ), findings[0]
-    assert "an unrelated path is in the way" not in result.stdout, (
-        "with the code leg first, the spec leg's directory is never read")
-
-
-def test_the_path_takes_its_place_in_that_order_and_the_add_does_not(
-        trio, home):
-    """THE SAME ORDER, WITH THE TWO READINGS THIS BRANCH ADDS IN IT. The test
-    above settled that the feature's verdict is the FIRST leg `resume`
-    refuses in the RECORD's order; this branch teaches that pass two more
-    refusals — RR4's second arm and RR3, which are the PATH, and the `git
-    worktree add` that is the LAST thing the run does — and where each of
-    them goes is not a matter of taste. `resume.sh`'s leg loop is RR6 -> RR4
-    -> RR3 -> RR2 -> RR1 -> RR5, every one of them `refused=true; break`, and
-    the loop that creates the worktrees runs only after every leg has passed
-    all six.
-
-    COPILOT'S FIFTH ROUND ON #23 (2026-09-13, suppressed), verbatim: "A
-    stale-registration leg before a later gone-origin leg is not represented
-    in this verdict pass … `resume` stops at RR3 first." FIVE ESTATES WERE
-    BUILT TO SETTLE IT, on 2026-09-13, against workBenches' own `resume.sh`,
-    `park.sh`, `git-common.sh` and `workspace-common.sh` — a three-leg estate
-    with bare remotes in a temp dir and a fake `$HOME`, the `spec` leg
-    recorded FIRST and the `code` leg second with `code`'s branch deleted on
-    its origin:
-
-      (a) a stray DIRECTORY at the `spec` leg's computed path
-          "Error: 'worktrees/001-a-thing/spec' exists and is not a registered
-          worktree of the spec leg", "REFUSED: 001-a-thing — an unrelated
-          path is in the way", exit 2 — RR3 on the EARLIER leg, and origin
-          never read for the later one. THE ROUND IS RIGHT ABOUT THIS SHAPE.
-      (b) a PRUNABLE registration at that path with nothing on disk
-          "Error: 001-a-thing is no longer on origin in the code leg",
-          "REFUSED: 001-a-thing — gone from origin", exit 2 — in BOTH
-          spellings, the registration for ANOTHER branch and the one for the
-          RECORDED branch: `load_git_worktrees` drops a prunable block so RR4
-          never sees it, `[ -e "$tree" ]` finds nothing so RR3 passes, and
-          the LATER leg's RR2 is the refusal the person gets. THE ROUND'S
-          PREMISE IS WRONG FOR A STALE REGISTRATION.
-      (c) the `spec` leg's WORKTREE on the branch, off the computed path
-          "Error: 001-a-thing is no longer on origin in the code leg",
-          "REFUSED: 001-a-thing — gone from origin", exit 2 — the add is the
-          last thing the run does and every RR of every leg comes first, so
-          the later leg's RR2 takes it. THE ROUND'S PREMISE IS WRONG HERE
-          TOO, and this reading never claimed otherwise.
-
-    And the control that tells (a) from (b): a LOCKED registration for
-    another branch at that path with nothing on disk — which git computes no
-    `prunable` for, so `leg_registered_at` DOES match it — answered "REFUSED:
-    001-a-thing — an unrelated worktree is in the way", exit 2, RR4's second
-    arm on the earlier leg in front of the later leg's RR2.
-
-    So the round is REAL for a path in the way and WRONG for a stale
-    registration, which is the distinction `path_in_the_way` already makes;
-    what this pins is that the VERDICT PASS makes it too, in one array, so
-    that no reading overtakes another by being read back in a different
-    order."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    spec_tip = git("rev-parse", "origin/001-a-thing", cwd=spec).stdout.strip()
-    code_tip = git("rev-parse", "origin/001-a-thing", cwd=code).stdout.strip()
-    drop_from_origin(code, "001-a-thing")
-
-    def two_legs():
-        path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                      commit=spec_tip, parked_on="Falcon", root="Trio")
-        path.write_text(path.read_text(encoding="utf-8")
-                        + leg_block("code", code_tip), encoding="utf-8")
-
-    def findings(*args):
-        result = run(STATUS, *args, home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        return result, [line.strip() for line in result.stdout.splitlines()
-                        if line.strip().startswith("- parked feature")]
-
-    want = parked_worktree(trio, "001-a-thing", "spec")
-
-    # (a) RR3 ON THE EARLIER LEG BEATS RR2 ON THE LATER ONE.
-    want.mkdir(parents=True)
-    (want / "stray.txt").write_text("not ours\n", encoding="utf-8")
-    two_legs()
-    result, lines = findings("--fetch", "Trio")
-    assert len(lines) == 2, lines
-    assert lines[0].startswith(
-        f"- parked feature 001-a-thing (spec leg): a directory is at {want}, "
-        "which is the path `resume` computes for this leg"), lines[0]
-    assert lines[1] == (
-        "- parked feature 001-a-thing (code leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        f"WHOLE feature, because a directory is at the {want} it computes for "
-        "its `spec` leg, so it does not bring this leg back — move it aside "
-        f"with `mv {want} <a path of your choosing>`, which is yours to run — "
-        "nothing here moves or deletes a path it did not create"), lines[1]
-    assert "is no longer on origin" not in result.stdout, (
-        "RR3 breaks the loop on the earlier leg and origin is never read")
-    assert "delete its `- branch:" not in result.stdout, (
-        "RR2's exits are the wrong thing to name for a path in the way")
-    rmtree(want)
-
-    # (b) A STALE REGISTRATION IS NOT RR3's, AND THE LATER LEG'S RR2 TAKES IT
-    # — in both spellings, the one for another branch and the one for the
-    # recorded branch, because `load_git_worktrees` drops a prunable block
-    # whichever branch it names.
-    for other in ("002-other", "001-a-thing"):
-        want.parent.mkdir(parents=True, exist_ok=True)
-        if other == "001-a-thing":
-            git("worktree", "add", "-q", str(want), "001-a-thing", cwd=spec)
-        else:
-            git("worktree", "add", "-q", "-b", other, str(want), cwd=spec)
-        rmtree(want)            # and NO `git worktree prune`
-        porcelain = git("worktree", "list", "--porcelain", cwd=spec).stdout
-        assert "prunable" in porcelain, "git pruned it for us; the test is moot"
-        two_legs()
-        result, lines = findings("--fetch", "Trio")
-        assert len(lines) == 2, lines
-        assert "worktree prune`" in lines[0], lines[0]
-        assert ("`resume` refuses the WHOLE feature in any case, because there "
-                "is no `origin/001-a-thing` in its `code` leg after this run's "
-                "fetch") in lines[0], lines[0]
-        assert lines[1].endswith(
-            "the exits are to delete its `- branch: 001-a-thing` block from "
-            "the record where the feature landed, or to push the branch again "
-            "from Falcon where it went by mistake"), lines[1]
-        assert "is in the way" not in result.stdout, (
-            "RR4 never sees a prunable block and RR3 finds nothing on disk")
-        git("worktree", "prune", cwd=spec)
-
-    # (c) THE ADD RUNS LAST, so the later leg's RR2 beats it — while WITHOUT
-    # the flag, which is the only run that reads RR2 here, the off-path
-    # worktree is the verdict and the move is the exit.
-    elsewhere = home / "elsewhere" / "001-a-thing"
-    elsewhere.parent.mkdir(parents=True, exist_ok=True)
-    git("worktree", "add", "-q", str(elsewhere), "001-a-thing", cwd=spec)
-    two_legs()
-    result, lines = findings("--fetch", "Trio")
-    assert len(lines) == 1, lines
-    assert lines[0].startswith(
-        "- parked feature 001-a-thing (code leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon, and no "
-        "`origin/001-a-thing` here after this run's fetch"), lines[0]
-    assert "worktree move" not in result.stdout, (
-        "every RR of every leg is asked before the first worktree is added")
-    result, lines = findings("Trio")
-    assert len(lines) == 2, lines
-    assert lines[0].startswith(
-        "- parked feature 001-a-thing (spec leg): its worktree is at "
-        f"{elsewhere}, which is not the {want} `resume` computes for it"
-        ), lines[0]
-    assert (f"`resume` refuses the WHOLE feature, because its `spec` leg's "
-            f"worktree is at {elsewhere}") in lines[1], lines[1]
-    assert "`resume Trio`" not in result.stdout
-
-
-def test_no_leg_beside_one_rr6_refuses_says_resume_brings_it_back(trio, home):
-    """THE HOLE THE VERDICT CLOSES ON ITS WAY PAST, and the rule is the one at
-    the top of `check_parked_leg`: NO LINE OF A FEATURE `resume` REFUSES WHOLE
-    MAY NAME `resume <Name>` (Copilot on #21, second round). RR6 is
-    `[ "$pushed" != true ]` and it is the FIRST test in the per-leg loop —
-    before RR4, so a worktree here does not save it — and it ends
-    `refused=true; break`, which throws the feature out with every other leg
-    of it. A good leg beside a `--no-push` one therefore went on saying
-    "`resume Trio` brings it back" about a feature `resume` will not recreate,
-    which is the pair the rule forbids.
-
-    ALL FOUR SPELLINGS RR6 REFUSES, and in both orders, because the record's
-    order decides which refusal is REPORTED and not whether the feature is
-    refused: the loop breaks at the first one wherever it sits, and the legs
-    before it were only ever collected."""
-    checkout = workspace_config(home)
-    spec, code = trio / "spec", trio / "code"
-    for leg in (spec, code):
-        git("checkout", "-q", "main", cwd=leg)
-        origin_has_branch(leg, "001-a-thing")
-    for pushed, why in (
-            ("false", "its `code` leg was parked with --no-push"),
-            (None, "the record has no `pushed:` for its `code` leg"),
-            ("", "its `code` leg's `pushed:` has no value, which is neither "
-                 "true nor false"),
-            ("maybe", "its `code` leg's `pushed:` says 'maybe', which is "
-                      "neither true nor false")):
-        for order in ("spoiler-first", "good-first"):
-            path = record(checkout, "trio", branch="001-a-thing", role="code",
-                          commit=FAKE_SHA, pushed=pushed, parked_on="Falcon",
-                          root="Trio")
-            spoiler = path.read_text(encoding="utf-8")
-            good = leg_block("spec", FAKE_SHA)
-            head, _, culprit = spoiler.partition("          - role: code\n")
-            path.write_text(
-                spoiler + good if order == "spoiler-first"
-                else head + good + "          - role: code\n" + culprit,
-                encoding="utf-8")
-            result = run(STATUS, "Trio", home=home)
-            assert result.returncode == 1, result.stdout + result.stderr
-            assert ("    - parked feature 001-a-thing (spec leg): no worktree "
-                    "on that branch here, parked 2026-09-10T20:00:00Z on "
-                    f"Falcon; `resume` refuses the WHOLE feature, because {why}"
-                    ", so it does not bring this leg back — park that feature "
-                    "again from Falcon, which writes the record afresh"
-                    ) in result.stdout, (pushed, order, result.stdout)
-            assert "`resume Trio`" not in result.stdout, (pushed, order)
-
-
-def test_a_root_key_between_a_branch_and_its_legs_still_reads_that_feature(
-        atlas, home):
-    """THIS RECORD WAS THE CRASH FIRST AND THE MISREADING SECOND, and the two
-    reviews are worth keeping together.
-
-    The independent review of this branch, 2026-09-12: the second pass read
-    `${feature_why[seen_branches - 1]:-}` unguarded, where the first pass's
-    lookup is guarded by `[ "$legs" -gt 0 ]` — and `$seen_branches` COULD be 0
-    at a `leg` row, because `record_rows` emitted a `branch` row only where
-    `$matched` was 1 AT the `- branch:` line, while a record selected by
-    `root=` — one filed under the folder name, and every family member — has
-    `$matched` set by its `root:` line. Put that key between a feature's
-    `- branch:` line and its legs and the block yielded a leg row with no
-    branch row before it: subscript -1, "bad array subscript" on bash 3.2 and,
-    on bash 4.2 and later with a non-empty array, the LAST feature's verdict
-    printed about a feature it is no verdict of. Against 5cb123b the first
-    record below died mid-report — exit 1 with no footer, and under `--all` it
-    took the sweep with it.
-
-    Copilot's second round on #22 then named the row that was missing rather
-    than the subscript it made: a block is not known to be the selected one
-    until the key that selects it is read, and every row above that key was
-    being thrown away for a block that DID match. So this record is read whole
-    now — the `project` row with it, which is why the line below names the
-    workstation and the date instead of `? on ?`, and why the feature is
-    COUNTED. `record_rows` can no longer hand out a leg row with no branch row
-    before it, `$named` being set by the same line that appends the branch
-    row; the guard in `read_record` stays as the belt to that brace, and this
-    test is what proves the record it was written for now reads.
-
-    AND THE LEG PINNED HERE MOVED ON 2026-09-12, with the reading at the
-    bottom of this file: `    root:` is a key at PROJECT indent, and it shuts
-    the feature's `legs:` list with the feature list it is inside. Run against
-    the extension that day this record loads as ONE FEATURE AND ZERO LEGS — so
-    `collect_legs` collects nothing, refuses the whole feature as a shape
-    mismatch, and the `resume Atlas` this test used to pin was the command
-    that refuses it. The feature half of the test is untouched, which is the
-    half it was written for: the block still matches on `root:`, the rows
-    above that key are still held rather than dropped, the feature is still
-    counted, and the report still reaches its footer. What changed is the
-    sentence under it, and the second phase now REOPENS the list with a
-    second `features:` key so that the verdict half — each feature keeping its
-    own — is still asked of two features the loader really makes."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "id: atlas\n", "id: atlas-core\n"), encoding="utf-8")
-    commit_all(atlas, "an id that is not the folder's name")
-    git("push", "-q", "origin", "main", cwd=atlas)
-    path = record(checkout, "Atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, root="Atlas")
-    text = path.read_text(encoding="utf-8")
-    assert text.count("    root: Atlas\n") == 1, text
-    assert text.count("        legs:\n") == 1, text
-    mangled = (text.replace("    root: Atlas\n", "")
-                   .replace("        legs:\n", "    root: Atlas\n"
-                            "        legs:\n"))
-    path.write_text(mangled, encoding="utf-8")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    no_leg = (
-        "- parked feature 001-a-thing: the record lists its `repo` leg where "
-        f"`resume` reads no leg, {WHY_OUTER}; `resume` collects NO leg for this "
-        "feature and refuses it WHOLE, reporting it as a shape mismatch, so "
-        "nothing here brings it back"
-        + unread_exits(where="the record says Eagle", name="Atlas.yaml"))
-    assert "    " + no_leg in result.stdout, result.stdout
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Eagle (lane xfactory-2); active 001-a-thing") in result.stdout, (
-        "the block matched on `root:` and the rows above it were held, not "
-        "dropped")
-    assert result.stdout.splitlines()[-1] == (
-        "status: Atlas - 1 finding(s) in 2 repositories; nothing was changed."
-        ), "the footer, which a report that died mid-run never reaches"
-    assert "(repo leg)" not in result.stdout, (
-        "a leg read against disk for a feature `collect_legs` collects none "
-        "for")
-    assert "`resume Atlas`" not in result.stdout, (
-        "the command that refuses this feature, offered for it")
-
-    # AND WITH A FEATURE AFTER IT, the verdict that is not this leg's: on bash
-    # 5 `${feature_why[-1]}` was the OTHER feature's refusal, on the line of a
-    # leg the record files under this one. Each feature keeps its own now.
-    # The second `features:` key is what makes the second feature a feature at
-    # all — the `root:` above it shut the list — and the loader reads a
-    # reopened list as it reads the first (2 features, 2 legs, against the
-    # extension 2026-09-12), so this phase asks what it always asked.
-    path.write_text(mangled + "    features:\n"
-                    "      - branch: 002-another\n"
-                    "        legs:\n" + leg_block("nope", FAKE_SHA),
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    assert findings[0] == no_leg, findings[0]
-    assert findings[1].startswith(
-        "- parked feature 002-another (nope leg): the record names a leg this "
-        "root does not mount here; `resume` maps each leg's role onto this "
-        "checkout and refuses the WHOLE feature"), findings[1]
-    assert "    parked record: 2 feature(s)" in result.stdout
-
-
-def test_every_leg_of_a_record_is_read_once_and_in_order(atlas, home):
-    """THE STRUCTURAL HALF of the same review note, held on its own. The leg
-    row used to go out at the leg's `pushed:` line; it now goes out where the
-    LEG ENDS — the next `- role:`, the next feature's `- branch:`, the next
-    project block's `- id:`, or the end of the file — so a leg without that
-    key is read like any other. What must not change is everything else: one
-    row per leg, in the order the record lists them, and no row for a block
-    that is not this root's.
-
-    Three features in one block exercise three of the four enders at once: the second
-    feature's first leg is closed by its own second `- role:`, its second leg
-    by the third feature's `- branch:`, and the third feature's leg by the
-    NEXT PROJECT's `- id:` — and the leg that carries no `pushed:` sits in
-    the middle, where a dropped row would have been invisible in a count of
-    two. The fourth ender, the end of the file, closes the last leg of every
-    record `record()` writes, whose last line is a leg's last key — every
-    other record-layer test holds that one."""
-    checkout = workspace_config(home)
-    (checkout / "workspaces" / ORG).mkdir(parents=True, exist_ok=True)
-    (checkout / "workspaces" / ORG / "atlas.yaml").write_text("""\
-schema_version: 1
-kind: workspace-manifest
-written_by: speckit park
-projects:
-  - id: atlas
-    repository: testorg/Atlas
-    shape: three-leg
-    root: Atlas
-    tracking_branch: main
-    worktree_root: worktrees
-    parked_at: 2026-09-10T20:00:00Z
-    parked_on: Falcon
-    parked_by_lane: xfactory-2
-    features:
-      - branch: 001-a-thing
-        legs:
-          - role: repo
-            remote: origin
-            parked_commit: {sha}
-            wip: true
-            wip_depth: 1
-            pushed: false
-      - branch: 002-b-thing
-        legs:
-          - role: repo
-            remote: origin
-            parked_commit: {sha}
-            wip: true
-            wip_depth: 1
-          - role: spec
-            remote: origin
-            parked_commit: {sha}
-            wip: true
-            wip_depth: 1
-            pushed: true
-      - branch: 003-c-thing
-        legs:
-          - role: repo
-            remote: origin
-            parked_commit: {sha}
-            wip: true
-            wip_depth: 1
-            pushed: true
-  - id: other
-    repository: testorg/Other
-    shape: single
-    root: Other
-    features:
-      - branch: 004-d-thing
-        legs:
-          - role: repo
-            remote: origin
-            parked_commit: {sha}
-            wip: true
-            wip_depth: 1
-            pushed: true
-""".format(sha=FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    parked record: 3 feature(s)" in result.stdout
-    legs = [line.split("parked feature ", 1)[1].split(":", 1)[0]
-            for line in result.stdout.splitlines() if "parked feature " in line]
-    assert legs == ["001-a-thing (repo leg)", "002-b-thing (repo leg)",
-                    "002-b-thing (spec leg)", "003-c-thing (repo leg)"], legs
-    assert "the record has no `pushed:` for that leg" in result.stdout
-    assert "004-d-thing" not in result.stdout, (
-        "a block that is not this root's was read")
-
-
-def test_a_comment_after_pushed_is_read_as_the_loader_reads_it(atlas, home):
-    """The extension's `workspace_load_project` strips a `#` comment from
-    EVERY line before it reads the value, so `resume.sh` sees `pushed: true #
-    note` as `true` and RECREATES the leg. Read whole here it was "neither
-    true nor false", and the finding named a refusal `resume` would not make
-    — the independent review of this follow-up, 2026-09-11. `pushed:` is the
-    field this layer JUDGES rather than matches or prints, so it is read the
-    way the judge reads it: with no worktree here, `true # note` names
-    `resume <Name>` and says nothing about the value."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="true # hand-written note", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "`resume Atlas` brings it back" in result.stdout
-    assert "neither true nor false" not in result.stdout, (
-        "a value `resume.sh` reads as `true`, called unreadable")
-
-    # And `false # note` is the `--no-push` record it says it is — which
-    # against a2c8521 read as `true`, the only other thing `= false` misses.
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="false # hand-written note", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("parked with --no-push on Falcon and no worktree on that branch "
-            "here") in result.stdout
-    assert "neither true nor false" not in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_comment_after_any_records_value_is_read_as_the_loader_reads_it(
-        atlas, home):
-    """Copilot on #21: `role:` was read with `trim_unquote` alone, so
-    `- role: # note` was NOT empty here — it was `# note` — while the
-    extension's loader takes `#` and everything after it off every line before
-    it reads a value, and so treats that leg as roleless and refuses the whole
-    feature. Here the leg went to `leg_repo_for_role` and drew "the record
-    names a leg this root does not mount here" instead. #19 closed this gap
-    for `pushed:` alone; `record_scalar` now closes it for every value this
-    parser reads — `role:`, `parked_commit:` and the rest — because a reader
-    that judges a value must read it the way the judge will."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    assert text.count("          - role: repo\n") == 1
-    assert text.count(f"            parked_commit: {FAKE_SHA}\n") == 1
-    path.write_text(text
-                    .replace("          - role: repo\n",
-                             "          - role: repo # the leg that holds the code\n")
-                    .replace(f"            parked_commit: {FAKE_SHA}\n",
-                             f"            parked_commit: {FAKE_SHA} # hand-written\n"),
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    # The role read as `repo` (not "does not mount here") and the commit as
-    # the sha alone: the missing-commit line names it by its first seven.
-    assert "does not mount here" not in result.stdout
-    assert f"its parked commit {FAKE_SHA[:7]} is not here" in result.stdout
-
-    # A role that is EMPTY under a comment is roleless to the loader, and so
-    # the whole-feature finding, never the mounting arm's.
-    for spelling in ("          - role: # note\n", '          - role: "" # note\n'):
-        text = path.read_text(encoding="utf-8")
-        text = text.replace("          - role: repo # the leg that holds the code\n",
-                            spelling)
-        text = text.replace("          - role: # note\n", spelling)
-        text = text.replace('          - role: "" # note\n', spelling)
-        path.write_text(text, encoding="utf-8")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("    - parked feature 001-a-thing: a leg of it in the record "
-                "has no role;") in result.stdout, spelling
-        assert "does not mount here" not in result.stdout, spelling
-
-
-def test_a_comment_after_a_project_yaml_leg_value_is_read_as_the_loader_reads_it(
-        atlas, home):
-    """Copilot on #22: `leg_repo_for_role` read `project.yaml`'s `role:` and
-    `path:` with `trim_unquote` alone, while `load_repo_shape` takes `#` and
-    everything after it off every line before it reads a key. So `- role:
-    spec # the spec leg`, declared with no `path:` and not checked out here,
-    never matched the role this reader wanted, and the leg fell to the arm
-    that calls it a role this root cannot mount and `resume` refuses whole —
-    where `resume` maps `spec` fine and refuses the whole ESTATE for the
-    missing checkout instead. The values lose their comments the way the
-    loader loses them, and the short line comes back."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(
-        manifest.read_text(encoding="utf-8")
-        .replace("kind: project-manifest\n",
-                 "kind: project-manifest\nschema: project-repo-schema\n")
-        .replace("  - role: spec\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "    path: spec\n",
-                 "  - role: spec # the spec leg\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "  - role: code # the code leg\n"
-                 f"    repository: {ORG}/Atlas-code\n"),
-        encoding="utf-8")
-    assert "role: spec # the spec leg" in manifest.read_text(encoding="utf-8")
-    rmtree(atlas / "spec")
-    record(checkout, "atlas", branch="001-a-thing", role="spec",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 1, findings
-    assert findings[0].startswith(
-        "- parked feature 001-a-thing (spec leg): the record names a leg this "
-        "root does not mount here"), findings
-    assert "refuses the WHOLE feature" not in result.stdout, (
-        "a comment after the role read as a role this root cannot mount")
-
-
-def code_leg_onto_the_spec_checkout(atlas: Path, *, path_line: str,
-                                    above_path: str = "") -> None:
-    """The Atlas manifest made genuinely three-leg — `kind:`, `schema:`, a
-    `spec` leg and a `code` one — with the CODE leg declared onto the
-    directory this fixture already mounts, and `$above_path` put between that
-    leg's `- role:` line and its `$path_line`.
-
-    THE PATH HAS TO DIFFER FROM THE ROLE'S OWN NAME for a reading of it to be
-    provable at all: where the path IS `code`, `_shape_record_leg`'s default
-    and a `path:` this reader lost are the same answer, and there is nothing
-    to tell apart. `spec/` is the one checkout under this root, so the `code`
-    leg is declared onto it and the assertion is that the leg is read THERE.
-    """
-    manifest = atlas / "project.yaml"
-    manifest.write_text(
-        manifest.read_text(encoding="utf-8")
-        .replace("kind: project-manifest\n",
-                 "kind: project-manifest\nschema: project-repo-schema\n")
-        .replace("  - role: spec\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "    path: spec\n",
-                 "  - role: spec\n"
-                 f"    repository: {ORG}/Atlas-spec\n"
-                 "    path: spec\n"
-                 "  - role: code\n"
-                 f"    repository: {ORG}/Atlas-code\n"
-                 + above_path + path_line),
-        encoding="utf-8")
-
-
-#: What a `code` leg mounted at `spec/` reads as when this root is read the
-#: way `load_repo_shape` reads it: the leg is found, and the only thing out of
-#: step is that nothing here is on that branch.
-CODE_LEG_AT_SPEC = ("    - parked feature 001-a-thing (code leg): no worktree "
-                    "on that branch here; parked 2026-09-10T20:00:00Z on "
-                    "Falcon — `resume Atlas` brings it back")
-
-
-def test_a_comment_after_a_project_yaml_leg_path_is_cut_where_the_loader_cuts_it(
-        atlas, home):
-    """Copilot's THIRD round on #22: the `path:` half of the `#` cut #22 gave
-    `leg_repo_for_role` had no test of its own. The round before it proves the
-    `role:` half — `- role: spec # the spec leg`, declared with no `path:` —
-    and the round after it proves a FULL-LINE comment; neither reads a `path:`
-    whose own value carries a `#`, so the one line that does could have been
-    dropped and the suite stayed green.
-
-    `load_repo_shape` takes `#` and everything after it off every line before
-    it splits key from value, so `path: spec # the checkout it is mounted at`
-    is `spec` there and the leg is `CODE_LEG=<root>/spec`. Read whole here it
-    was `<root>/spec # the checkout it is mounted at`, a path with no `.git`
-    in it, and the leg drew "the record names a leg this root does not mount
-    here" for a leg `resume` mounts and resumes — and it did NOT fall back to
-    `_shape_record_leg`'s default either, because the `path:` arm answers
-    before the default does."""
-    checkout = workspace_config(home)
-    code_leg_onto_the_spec_checkout(
-        atlas, path_line="    path: spec # the checkout it is mounted at\n")
-    assert "path: spec # the checkout it is mounted at" in \
-        (atlas / "project.yaml").read_text(encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="code",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert CODE_LEG_AT_SPEC in result.stdout
-    assert "does not mount here" not in result.stdout, (
-        "the comment read as part of the path, so the leg was looked for at a "
-        "directory no manifest names")
-
-
-def test_a_full_line_comment_inside_a_project_yaml_leg_does_not_end_the_leg(
-        atlas, home):
-    """Copilot's second round on #22: `leg_repo_for_role` lost the `#` after a
-    value in the round before, and kept reading a full-line comment at COLUMN
-    0 as the indent-zero key that closes the leg — `[![:space:]]*) role=""`.
-    `load_repo_shape` takes `#` and everything after it off every line before
-    it reads one, so that line is nothing to the loader and the `path:` below
-    it still belongs to the leg above. Read as a leg-ender here, the `path:`
-    was dropped and the role fell to `_shape_record_leg`'s default — the
-    role's own name — so a `code` leg this manifest maps onto a directory of
-    another name was reported as a leg this root does not mount, where
-    `resume` maps it and brings the feature back. The same treatment #20 gave
-    the record's own parser (a2c8521's `record_rows`), for the same reason."""
-    checkout = workspace_config(home)
-    code_leg_onto_the_spec_checkout(
-        atlas, above_path="# a note a hand left here, at column 0\n",
-        path_line="    path: spec\n")
-    record(checkout, "atlas", branch="001-a-thing", role="code",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert CODE_LEG_AT_SPEC in result.stdout
-    assert "does not mount here" not in result.stdout, (
-        "a comment line read as the end of the leg, and the `path:` under it "
-        "dropped")
-
-
-#: The Atlas manifest made genuinely three-leg with its `legs:` list indented
-#: FOUR spaces and its keys SIX — which YAML allows anywhere and
-#: `load_repo_shape` reads by keying on the item's own indent, not on a
-#: column. The `code` leg is declared onto `spec/`, the one checkout under this
-#: root, because a path that differs from the role's own name is the only kind
-#: whose reading can be proved.
-DEEP_LEGS_YAML = """\
-schema_version: 1
-kind: project-manifest
-schema: project-repo-schema
-id: atlas
-name: "Atlas"
-tracking_branch: main
-legs:
-    - role: assembly
-      repository: {org}/Atlas
-      path: "."
-    - role: spec
-      repository: {org}/Atlas-spec
-      path: spec
-    - role: code
-      repository: {org}/Atlas-code
-{above}      path: spec
-"""
-
-
-def test_a_legs_list_indented_deeper_is_read_the_way_the_loader_reads_it(
-        atlas, home):
-    """The independent review of this branch, 2026-09-12, verbatim: "list
-    items at 4-space indent (`    - role: spec` / `      path: docs`) → both
-    shape readers say three-leg; leg_repo_for_role answers NOTHING for spec
-    and code → first pass sets feature_why "names a role this root does not
-    mount" → false whole-feature refusal."
-
-    TWO READERS OF ONE FILE IS WHAT MADE THAT POSSIBLE. `read_root_shape`
-    walks `project.yaml` the way `load_repo_shape` walks it — `#` and
-    everything after it off every line, an empty line skipped, a `- ` item at
-    ANY indent opening a leg and keys two past its own belonging to it — while
-    `leg_repo_for_role` scanned the same file again by COLUMN, `'  - role:'*`
-    and `'    path:'*`, and answered nothing for a manifest indented any other
-    way. The shape reader therefore called this root three-leg, `collect_legs`
-    maps `code` onto a three-leg checkout, and the leg was still reported as a
-    role this root does not mount and the whole feature refused for it — a
-    refusal `resume` does not make. The walk records each leg's role and
-    `path:` as it passes now, and this function reads those back: ONE parser
-    of `project.yaml` in this file.
-
-    Verified against the extension on 2026-09-12 by sourcing `git-common.sh`
-    and running `load_repo_shape` on this manifest: `REPO_SHAPE=three-leg`,
-    `SHAPE_SPEC_PATH=spec`, `SHAPE_CODE_PATH=spec`, `CODE_LEG=<root>/spec`,
-    with and without the column-0 comment below — and on the review's own
-    spelling of it (a two-space list whose `spec` leg carries `path: docs`
-    under such a comment and whose `code` leg carries `path: src`):
-    `SHAPE_SPEC_PATH=docs`, `SHAPE_CODE_PATH=src`."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(DEEP_LEGS_YAML.format(org=ORG, above=""),
-                        encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="code",
-           commit=FAKE_SHA, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert CODE_LEG_AT_SPEC in result.stdout
-    assert "does not mount here" not in result.stdout, (
-        "the leg was looked for at a path no manifest names, because the "
-        "`path:` line was indented past the column this reader wanted")
-    assert "refuses the WHOLE feature" not in result.stdout, (
-        "a whole-feature refusal `resume` does not make: it maps `code` onto "
-        "this checkout and brings the feature back")
-
-    # AND A COLUMN-0 COMMENT INSIDE THE ITEM CLOSES NOTHING AT THAT INDENT
-    # EITHER, which is the other half of one parser: the walk takes `#` and
-    # everything after it off the line and SKIPS what is left when it is
-    # empty, wherever the item's keys sit.
-    manifest.write_text(DEEP_LEGS_YAML.format(
-        org=ORG, above="# a note a hand left here, at column 0\n"),
-        encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert CODE_LEG_AT_SPEC in result.stdout
-    assert "does not mount here" not in result.stdout
-
-
-def test_a_leg_declared_at_the_root_is_read_at_the_root(atlas, home):
-    """Copilot's first round on #23, verbatim: "this special-cases `path: "."`
-    as if the path were omitted, but the extension's `_shape_record_leg`
-    preserves any non-empty path and builds `SPEC_LEG`/`CODE_LEG` as
-    `$root/$SHAPE_*_PATH`; therefore a declared `spec` or `code` leg with
-    `path: "."` is mapped to the root repository. Status will instead inspect
-    `$root/spec` or `$root/code` (or report it missing), so its
-    worktree/origin findings disagree with `resume`."
-
-    IT DOES, AND EVERY SPELLING OF IT DOES. Run against the extension on
-    2026-09-12 on a manifest whose `code` leg carries `path: "."`, `path: .`
-    and `path: '.'` in turn: `load_repo_shape` answered `REPO_SHAPE=three-leg`,
-    `SHAPE_CODE_PATH=.` and `CODE_LEG=<root>/.` for all three — `.` is not
-    empty, so `"${path:-code}"` keeps it — and an EMPTY `path:` was the one
-    spelling that fell to the default `code`. `collect_legs` hands `$CODE_LEG`
-    straight to `LEG_REPOS`, so the leg `resume` reads is the ROOT. This
-    reader skipped the declared `.`, found no `code/` and answered the default
-    `<root>/code`, so the same estate drew "the record names a leg this root
-    does not mount here" — a whole-feature refusal `resume` does not make.
-
-    AND THE MOUNT IS `.` AT THE OTHER END TOO, which is what the proof turns
-    on since this layer reads the path `collect_legs` computes: `LEG_TREES`
-    for a `code` leg is `$WORKTREE_ROOT/$branch/$SHAPE_CODE_PATH`, and with
-    the leg declared `path: "."` that is `worktrees/<branch>/.` — a string
-    `leg_registered_at` never matches, because git spells no registered path
-    with a trailing `/.`. Run end to end against the extension on 2026-09-12
-    on a three-leg estate whose `code` leg carried `path: "."` and whose
-    `spec` leg was a real submodule: with NOTHING at that path `resume.sh`
-    RESUMED the feature — "code  worktrees/001-a-thing/.", exit 0; with the
-    feature's own worktree on the recorded branch AT `worktrees/001-a-thing`
-    it REFUSED, "Error: 'worktrees/001-a-thing/.' exists and is not a
-    registered worktree of the code leg", "REFUSED: 001-a-thing — an
-    unrelated path is in the way", exit 2; and with that worktree elsewhere
-    it refused at the `git worktree add`, "'001-a-thing' is already used by
-    worktree at …". So the ROOT's own registrations answer all three, and a
-    leg read at `<root>/code` — a directory that does not exist — answers
-    none of them.
-
-    THE PROOF IS THE ROOT'S OWN WORKTREE LIST, not the absence of that line:
-    the worktree this test makes is a worktree of the ROOT repository, and it
-    is found, named and judged against `worktrees/001-a-thing/.` — the mount
-    the manifest declares — while a reader looking at `<root>/code` would
-    have neither the worktree nor the path."""
-    checkout = workspace_config(home)
-    where = home / "Atlas-wt" / "001-a-thing"
-    tip = feature_worktree(atlas, "001-a-thing", where)
-    record(checkout, "atlas", branch="001-a-thing", role="code", commit=tip,
-           parked_on="Falcon")
-    pristine = (atlas / "project.yaml").read_text(encoding="utf-8")
-    computed = atlas / "worktrees" / "001-a-thing"
-    for spelling in ('    path: "."\n', "    path: .\n", "    path: '.'\n"):
-        (atlas / "project.yaml").write_text(pristine, encoding="utf-8")
-        code_leg_onto_the_spec_checkout(atlas, path_line=spelling)
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert "does not mount here" not in result.stdout
-        assert (f"    - parked feature 001-a-thing (code leg): its worktree "
-                f"is at {where}, which is not the {computed}/. `resume` "
-                "computes for it") in result.stdout
-        # AND IT NAMES NO COMMAND (Copilot's second round on #27), because
-        # every operand this path could be put into was RUN and did not work:
-        # `mv '<…>/001-a-thing/.' <dest>` is refused by coreutils outright,
-        # and `mkdir -p <…>/001-a-thing && git worktree move <tree>
-        # '<…>/001-a-thing/.'` exits 0 and leaves the worktree nested at
-        # `<…>/001-a-thing/001-a-thing`, which is where neither verb looks
-        # (git 2.43, GNU coreutils 9.4, both run 2026-09-12). The line says
-        # so, and names the `collect_legs` that answers it.
-        assert "`mkdir -p " not in result.stdout, result.stdout
-        assert f"worktree move {where}" not in result.stdout, result.stdout
-        assert ("there is no command that puts it where `resume` looks: this "
-                'leg is declared `path: "."` in `project.yaml`') in (
-            result.stdout), result.stdout
-        assert ("a `collect_legs` that computes `<worktree_root>/<branch>` "
-                "for a leg declared at the root, which is the standard's and "
-                "not this command's") in result.stdout
-
-    # AND WITH NO WORKTREE AT ALL the same leg is the ordinary parked feature
-    # `resume` brings back — which is the other half of the same reading,
-    # because a leg read at `<root>/code` is a whole-feature refusal in this
-    # state too, and the extension resumed it (exit 0, the same day).
-    git("worktree", "remove", "--force", str(where), cwd=atlas)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "does not mount here" not in result.stdout
-    assert ("    - parked feature 001-a-thing (code leg): no worktree on that "
-            "branch here") in result.stdout
-    assert "`resume Atlas` brings it back" in result.stdout
-
-
-def test_a_feature_the_record_gives_no_branch_name_is_a_finding_not_silence(
-        atlas, home):
-    """Copilot on #22: `record_rows` dropped a `- branch:` whose value is
-    empty, and its legs with it, so the feature vanished from this layer —
-    while `workspace_load_project` makes a feature of every `- branch:` line
-    and `resume.sh` refuses the one named nothing: with legs, at RR2 with the
-    name blank ("Error:  is no longer on origin in the repo leg", exit 2);
-    with none, as a shape mismatch. Both run against the extension on
-    2026-09-12. One line on the root's row, RR2's two exits, and no per-leg
-    line for a feature whose legs have no branch to be found by."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    assert text.count("      - branch: 001-a-thing\n") == 1
-    for spelling in ("      - branch:\n", "      - branch: # a note\n"):
-        path.write_text(text.replace("      - branch: 001-a-thing\n", spelling),
-                        encoding="utf-8")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("    - parked feature with no branch name: a `- branch:` in the "
-                "record has no value; `resume` reads it as a feature named "
-                "nothing and refuses it as a branch origin has not got (\"is no "
-                "longer on origin\", the name blank), so nothing here brings it "
-                "back — if that feature landed, remove its `- branch:` block "
-                "from atlas.yaml; if it was parked, park it again from the "
-                "workstation that has it (the record says Falcon), which writes "
-                "the branch it parks") in result.stdout, spelling
-        assert "(repo leg)" not in result.stdout, spelling
-        assert "`resume Atlas`" not in result.stdout, spelling
-        assert "parked record: 1 feature(s)" in result.stdout, spelling
-
-    # And with no legs under it, the refusal `resume` makes is the shape one.
-    legless = text.replace("      - branch: 001-a-thing\n", "      - branch:\n")
-    legless = legless[:legless.index("        legs:\n") + len("        legs:\n")]
-    path.write_text(legless, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature with no branch name: a `- branch:` in the "
-            "record has no value and lists no leg; `resume` reads it as a "
-            "feature named nothing and refuses it whole as a shape mismatch "
-            "before it reads a leg, so nothing here brings it back — if that "
-            "feature landed, remove its `- branch:` block from atlas.yaml; if "
-            "it was parked, park it again from the workstation that has it "
-            "(the record says Falcon), which writes the branch it parks"
-            ) in result.stdout
-    assert "lists no leg for it" not in result.stdout, (
-        "the named-feature no-legs line, for a feature with no name")
-
-
-def test_the_help_carries_the_no_push_exception_its_findings_do(home):
-    """`status --help` is the other place this rule is stated, and a help
-    text that sends somebody to `resume` for a record `resume` refuses is the
-    same contradiction the two findings had. Read with the wrapping
-    normalised, so the paragraph can be re-wrapped and not the sentence.
-
-    It carries BOTH records `resume` refuses since the second independent
-    review of #18, 2026-09-11, note (d): `--no-push`, and a `pushed:` that is
-    neither true nor false, which `resume.sh`'s `[ "$pushed" != true ]`
-    refuses in exactly the same breath. The independent review of #19 that
-    day added the third, and it is the same clause rather than a sentence of
-    its own: a `pushed:` that is MISSING is refused by that same test — the
-    extension's loader, before workBenches #60, seeded an absent one with `false`, and since #60 refuses it for being absent — and settled by the
-    same re-park, so splitting it out would be two sentences saying one
-    thing.
-
-    Note 7 of the independent review of #20, the same day, adds the fourth,
-    and it is NOT that same clause: a record that names no `parked_commit:`
-    for the leg is refused by a different test — RR1, origin's tip against a
-    parked commit that is absent and so never matches — and "which `resume`
-    refuses the same way" would be a claim about the extension that is not
-    true. Its own half-sentence, and the same re-park at the end of both.
-
-    Note 8 of that review adds the fifth, and it is a half-sentence of its
-    own for the same reason: a leg the record gives NO ROLE is refused by
-    `collect_legs`, which takes the WHOLE FEATURE with it, so neither "the
-    same way" nor "as moved-on" describes it. The list beside the paragraph
-    names it too, as a finding on the root's row.
-
-    The independent review of #21, the same day, widens that fifth rather
-    than adding a sixth: a role THIS CHECKOUT'S SHAPE DOES NOT MOUNT is
-    refused by the same `collect_legs`, for the same whole feature, in the
-    same "shape mismatch" words. What it adds is the second exit, because
-    the two are not one — a misspelt role is a record to write afresh, and a
-    role that is really another shape's is a record that is right about a
-    checkout this is not.
-
-    Note 1 of that review is the sixth, and the first that is not a leg's at
-    all: a FEATURE the record lists no leg for, refused whole by the same
-    `collect_legs` at its closing `[ "${#LEG_ROLES[@]}" -gt 0 ]`. It goes in
-    the same exception because the same re-park settles it, and in the list
-    as a feature rather than a leg, because that is where the finding
-    prints.
-
-    The follow-up's own note WIDENS the fifth again rather than adding to the
-    list: a role this checkout's shape has no place for is not only one it
-    does not mount — `assembly`, and any role only the OTHER shape maps, are
-    roles this root can hand a repository for and `collect_legs` refuses
-    anyway — and the exits are three, not two, because a role of NEITHER
-    shape is a record no checkout of any shape resumes.
-
-    The seventh is that review's note on a BRANCH GONE FROM ORIGIN, and it is
-    the first exception whose exits are NOT the re-park: `resume` refuses
-    such a record at RR2, and what answers it is the record's own entry where
-    the feature landed or a push of the branch from the workstation that
-    parked it. It carries the flag with it, because the two readings of a
-    missing `origin/<branch>` are only settled by `--fetch` — without one the
-    line still names `resume`, which is what brings back the branch this
-    clone has merely not fetched yet.
-
-    AND THE SEVENTH SAYS "THE WHOLE FEATURE" SINCE THE INDEPENDENT REVIEW OF
-    THIS BRANCH, 2026-09-12: RR2 is `refused=true; break`, which throws the
-    feature out with every other leg of it, and the findings said so while
-    this paragraph did not. It is the same widening the fifth got, and the
-    line is pinned here because a help text that describes a narrower refusal
-    than the code makes is the drift these tests exist to catch.
-
-    AND IT SETTLES ON A FETCH THAT WORKED THERE, NOT ON THE FLAG, which is
-    Copilot's FOURTH round on #23 (2026-09-13), verbatim: "This help text
-    says that `--fetch` settles a missing `origin/<branch>` unconditionally,
-    but the implementation distinguishes failed, no-remote, unreadable, and
-    unlisted repositories and leaves those readings unresolved. Qualify this
-    with a successful fetch that actually reached the repository, otherwise
-    the help contradicts the row-level guidance." IT IS RIGHT, and it is this
-    branch's own rule turned on its help: the gone verdict is made under
-    `fetched_ok_at` and nowhere else, and the four states the two rounds
-    before it named — a fetch that FAILED there, no `origin` remote, a
-    repository git cannot read, and a path this run's fetch never listed —
-    are every one of them a run made WITH the flag that settles nothing. So
-    the clause names the fetch that settles it rather than the flag that asks
-    for it, and "without one" covers those four exactly as it already covered
-    a run made without the flag. THE SAME ROUND'S OTHER TWO ARE NOT THIS:
-    AGENTS.md rule 4's "only `status --fetch` settles that" and the README's
-    "which only `--fetch` settles" are claims of EXCLUSIVITY — that nothing
-    else settles it — which is true of every one of those four states and
-    stays as it is.
-
-    AND THE THIRD OF THEM IS EVERY SYMLINKED PARENT, not the worktree root
-    alone, since Copilot's EIGHTH round on #27 (2026-09-13, suppressed): the
-    round before it widened the question `off_path_exit` asks and left all
-    three texts naming the root it no longer meant, which for a link at the
-    feature directory or a mount's parent points a person at the wrong
-    setting. The line names the component now, and so do these.
-
-    AND IT NAMES THE THREE STATES THAT GET NO MOVE, since Copilot's FOURTH
-    round on #27 (2026-09-13, suppressed), verbatim: "This help text overstates
-    the recovery for an off-path worktree: it says the exit is always `git
-    worktree move`, but `off_path_exit` intentionally emits no move for a
-    declared `path: "."` and for a symlink-spelled worktree root because that
-    move does not produce a path `resume` can register." IT IS RIGHT, and it is
-    drift this branch made in the two rounds that suppressed those commands:
-    the code stopped promising a move and these three texts went on promising
-    one. The leg's own checkout was already named; the other two are named
-    beside it now, here, in AGENTS.md rule 4 and in the README, because the
-    three say the same things or one of them is wrong.
-
-    AND THE LIST NAMES ALL THREE SOURCES OF THAT PATH SINCE COPILOT'S FIRST
-    ROUND ON #27 (2026-09-13, suppressed), verbatim: "This contract documents
-    only the environment override and `git-config.yml`, but the implementation
-    also falls back to the shape default (`worktrees` for a three-leg root or
-    `../<root>-worktrees` for a single root). For an estate without either
-    override, readers cannot derive the path that `resume` and the recovery
-    guidance use; include that third source in this statement and its mirrored
-    help/README wording." IT IS RIGHT, AND THE DEFAULT IS THE COMMON CASE:
-    these fixtures carry no `git-config.yml` at all, so every path in every
-    finding this file pins comes from the shape, and a reader told only about
-    the two overrides is told about the two spellings an estate usually does
-    not have. It is the same fault as the should-fix that put
-    `$SPECKIT_GIT_WORKTREE_ROOT` here — a list that reads as exhaustive and is
-    not — so AGENTS.md rule 4, the README and this clause all take the third
-    source.
-
-    The eighth is the independent reviewer's note of 2026-09-12 on the PATH,
-    and it goes in the LIST and not in the exception: nothing is being
-    brought back for a worktree that is already here, and the exit is neither
-    a `resume` nor a re-park but a `git worktree move` to the path both verbs
-    compute. The list says which path that is, because a reader who is not
-    told it is computed HERE — from this checkout's `git-config.yml`, or the
-    environment, or the shape's own default — reaches for the record's own
-    `worktree_root:`, which is the one thing neither verb reads.
-
-    The ninth is that reviewer's second and third notes of 2026-09-12, and
-    they are ONE clause rather than two: `resume.sh` words RR3 and RR4's
-    second arm identically — "'…' exists and is not a registered worktree of
-    the <role> leg … Move it aside" — and the only thing that differs is
-    WHAT GIT HOLDS at the obstructed path, which is the only thing the exit
-    turns on. The `unlock` and the `prune` ride in that same clause because
-    neither command clears the path without them: `git worktree move` refuses
-    a locked worktree ("cannot move a locked working tree") and `git worktree
-    add` refuses a path a dead registration still names ("a missing but
-    already registered worktree"), both run against git 2.43 the same day.
-    It goes in the EXCEPTION and not in the list beside it, unlike the
-    eighth: this IS a record `resume <Name>` brings back, once the path is
-    clear, and the sentence it falsifies is the promise itself.
-
-    THE TENTH IS THE RECORD'S OWN KEY ORDER, 2026-09-12, and it is the
-    second whose exits are not the re-park — and the first whose FIRST exit
-    is a hand on the record. `workspace_load_project` shuts the `features:`
-    list at the next key at project indent and a feature's `legs:` list at
-    the next key at feature indent, so a `- branch:` or a `- role:` a bad merge
-    left below one is a line `resume` reads no feature and no leg out of.
-    The order of the two exits is why the sentence is pinned and not merely
-    counted: the key goes back BY HAND, which is the one hand-edit of the
-    record these texts ask for, and the re-park settles it only FROM THE
-    WORKSTATION THAT HAS THE FEATURE, because `workspace_write_manifest`
-    rewrites a project's whole block out of what its own loader read and a
-    park anywhere else takes those lines with it. A help text that named the
-    re-park first would send a person to the park that deletes the work."""
-    result = run(STATUS, "--help", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    helptext = " ".join(result.stdout.split())
-    assert ("a recorded feature with no worktree here (`resume <Name>` brings "
-            "it back — unless the record says `--no-push`, or its `pushed:` "
-            "is missing or neither true nor false, which `resume` refuses the "
-            "same way, or it names no parked commit for that leg, which "
-            "`resume` refuses as moved-on, or it gives a leg no role at "
-            "all, or a role this checkout's shape has no place for — one it "
-            "does not mount, or one `resume` maps only onto the other shape, "
-            "or onto neither, as it maps `assembly` — or lists "
-            "no leg for it at all, which "
-            "`resume` refuses the whole feature for: then only the "
-            "workstation that parked it can park it again — and where the "
-            "role is really another shape's, only a checkout of that shape, "
-            "and where it is neither shape's, no checkout at all; "
-            "and unless origin has lost the branch, which `resume` refuses "
-            "as gone from origin, the WHOLE feature with it — after a fetch "
-            "that WORKED in that repository, which is the only way "
-            "it is settled, a missing `origin/<branch>` is origin's "
-            "answer and the exits are the record's own entry where the "
-            "feature landed or a push of the branch from the workstation "
-            "that parked it, and without one it is named beside the `resume` "
-            "that still brings back a branch this clone has merely not "
-            "fetched; and where the record's KEY ORDER leaves a `- branch:` "
-            "or a `- role:` where the loader reads neither — it shuts the "
-            "`features:` list at the next key at project indent and a "
-            "feature's `legs:` list at the next key at feature indent — the "
-            "exits are putting that key back, which is yours and not this "
-            "command's, and a re-park only from the workstation that has the "
-            "feature, since a park anywhere else rewrites the block without "
-            "those lines; and where `git worktree list` still "
-            "holds a registration that is no longer a worktree, that is "
-            "cleared with `worktree prune`, after a `worktree unlock` if it "
-            "is locked and with any leftover directory moved aside, before "
-            "`resume` can recreate anything; and where ANYTHING ELSE is at "
-            "the path both verbs compute for that leg — a directory, a file, "
-            "a worktree of another branch — `resume` refuses the WHOLE "
-            "feature rather than overwrite a path it did not create, and "
-            "moving that aside first is yours: a `git worktree move` where "
-            "git holds it as a worktree and a plain `mv` where it does not, "
-            "with the `worktree unlock` a LOCKED registration wants in front "
-            "of either and the `worktree prune` a dead one wants beside the "
-            "`mv`)") in helptext
-    # And the LIST of findings beside it names the new one, as the README's
-    # does: the two texts say the same things or one of them is wrong.
-    assert ("a worktree whose tip is not the parked commit or a record that "
-            "names no parked commit to compare it with, a recorded branch "
-            "this repository has no `origin/<branch>` for, a leg parked with "
-            "`--no-push` or whose `pushed:` is missing or neither true nor "
-            "false, a leg the record gives no role or a role this shape has "
-            "no place for, a feature the record lists no leg for, a worktree "
-            "on a recorded branch that is not at the path BOTH VERBS compute "
-            "for that leg — <worktree_root>/<branch>, with the leg's own "
-            "mount under it in a three-leg root, out of "
-            "$SPECKIT_GIT_WORKTREE_ROOT, else this checkout's git-config.yml, "
-            "else the shape's own default, and not out of the record — which "
-            "is the only "
-            "worktree `resume` reads as that feature's and the only one "
-            "`park` carries, so the exit is a `git worktree move` of yours "
-            "— except where no move works and the line says so: the leg's own "
-            "checkout, a leg declared `path: \".\"`, and a symlink anywhere "
-            "in that path's own parents, each of which names the component — "
-            "anything at that same path that is not that leg's "
-            "worktree, which `resume` refuses the whole feature for before "
-            "it reads origin, and a "
-            "worktree the record does not know (never parked)") in helptext
-
-
-def test_a_missing_parked_commit_is_read_against_what_the_record_claims(
-        atlas, home):
-    """`pushed: true` RULES OUT `--no-push`, so what is left is a fetch this
-    repository never made or a commit origin no longer has; `pushed: false` is
-    the other case, already a finding of its own, and here only says where the
-    commit is. The first draft offered both reasons under either record."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here — the record says it was pushed, so "
-            "this repository has never fetched it, or origin no longer has it"
-            ) in result.stdout
-    assert "--no-push" not in result.stdout
-
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here, which is what --no-push means — "
-            "Falcon is the only place it is") in result.stdout
-    assert "never fetched" not in result.stdout
-
-
-def test_a_missing_parked_commit_under_an_unreadable_pushed_rules_nothing_out(
-        atlas, home):
-    """The line the second independent review of #18 named on 2026-09-11, note
-    (d): with `pushed:` valueless the arm below fired and said "the record
-    says it was pushed" — a claim the record does not make, and the one
-    reading that rules out the commit never having left that workstation. A
-    `pushed:` that rules nothing out rules nothing out in the line: every
-    reason still standing is named, and the VALUE is named too, because a
-    reader who is told the record cannot be read can go and look at it."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here, and its `pushed:` has no value, "
-            "which is neither true nor false — so no reason is ruled out: it "
-            "may never have left Falcon, or this repository has never fetched "
-            "it, or origin no longer has it") in result.stdout
-    assert "the record says it was pushed" not in result.stdout
-    assert "--no-push" not in result.stdout, (
-        "the other reading, and just as much a guess")
-
-    # A value that is not empty is named as itself, for the same reason.
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="yes", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here, and its `pushed:` says 'yes', which "
-            "is neither true nor false — so no reason is ruled out: it may "
-            "never have left Falcon, or this repository has never fetched it, "
-            "or origin no longer has it") in result.stdout
-    assert "the record says it was pushed" not in result.stdout
-
-
-def test_a_full_line_comment_inside_a_leg_does_not_end_the_leg(atlas, home):
-    """`workspace_load_project` takes `#` and everything after it off every
-    line before it reads one, so a `# note` a hand left at column 0 between
-    two of a leg's keys is nothing to the loader, and `resume.sh` reads the
-    `pushed: true` below it. Read as a leg-ender here — its first character
-    sits shallower than a leg's keys — it closed the leg before its `pushed:`,
-    and the leg went out as if the record had none: a false "has no `pushed:`"
-    finding, and `resume <Name>`, the exit that works, withheld (the review of
-    this follow-up, 2026-09-11)."""
-    checkout = workspace_config(home)
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, pushed="true", parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    assert text.count("            pushed: true\n") == 1
-    path.write_text(text.replace(
-        "            pushed: true\n",
-        "# a note a hand left here, at column 0\n            pushed: true\n"),
-        encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "`resume Atlas` brings it back" in result.stdout
-    assert "has no `pushed:`" not in result.stdout, (
-        "a comment line read as the end of the leg")
-
-
-def test_a_missing_parked_commit_with_no_pushed_key_rules_nothing_out(
-        atlas, home):
-    """The same arm for the state the independent review of #19 named on
-    2026-09-11. A record that says NOTHING about `pushed:` rules out no more
-    than one whose value cannot be read, so the line names every reason still
-    standing — and until the leg had a row at all, it named none of them,
-    because there was no line."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed=None, parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here, and the record has no `pushed:` for "
-            "that leg — so no reason is ruled out: it may never have left "
-            "Falcon, or this repository has never fetched it, or origin no "
-            "longer has it") in result.stdout
-    assert "the record says it was pushed" not in result.stdout
-    assert "--no-push" not in result.stdout, (
-        "the other reading, and just as much a guess")
-
-
-def test_a_parked_commit_still_missing_after_this_runs_fetch_says_so(atlas, home):
-    """After a fetch that WORKED in this repository, "never fetched" is ruled
-    out, and saying it would contradict the `fetched origin:` line printed a
-    moment earlier — `no_origin_branch_finding`'s rule, and this layer's too
-    now that every repository is fetched before any row is read."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here after this run's fetch — the record "
-            "says it was pushed, so origin has not got it either"
-            ) in result.stdout
-    assert "never fetched it" not in result.stdout
-
-
-def test_an_unreadable_pushed_after_this_runs_fetch_drops_the_fetch_reason(
-        atlas, home):
-    """The fetched twin of the unreadable missing-commit arm, and
-    `no_origin_branch_finding`'s rule: after a fetch that WORKED in this
-    repository, "never fetched it" is ruled out, and saying it would
-    contradict the `fetched origin:` line printed a moment earlier. What an
-    unreadable `pushed:` leaves standing is the other two, and the line names
-    those and no more."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed="maybe", parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here after this run's fetch, and its "
-            "`pushed:` says 'maybe', which is neither true nor false — so "
-            "neither reason is ruled out: it may never have left Falcon, and "
-            "origin may not have it either") in result.stdout
-    assert "never fetched it" not in result.stdout
-    assert "the record says it was pushed" not in result.stdout
-
-
-def test_no_pushed_key_after_this_runs_fetch_drops_the_fetch_reason(
-        atlas, home):
-    """The fetched twin of the arm above, and `no_origin_branch_finding`'s
-    rule again: after a fetch that WORKED in this repository, "never fetched
-    it" is ruled out and saying it would contradict the `fetched origin:`
-    line printed a moment earlier. An absent `pushed:` leaves the other two
-    standing, and the line names those and no more."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           pushed=None, parked_on="Falcon")
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here after this run's fetch, and the record "
-            "has no `pushed:` for that leg — so neither reason is ruled out: it "
-            "may never have left Falcon, and origin may not have it either"
-            ) in result.stdout
-    assert "never fetched it" not in result.stdout
-    assert "the record says it was pushed" not in result.stdout
-
-
-def test_under_fetch_the_legs_own_fetch_comes_before_the_record_is_read(
-        atlas, home, status_remotes):
-    """`--fetch` says it asks origin in EVERY repository FIRST, and then
-    reads. The record layer is read on the ROOT's row while the legs are rows
-    of their own, so a parked commit that had only ever been pushed to the
-    SPEC LEG's origin was read as "not here" by the very run that fetched it
-    a moment later — a finding that vanished on a second run. With every
-    fetch made before any row is read, what is left is the true one: this
-    worktree is behind a record that is newer."""
-    checkout = workspace_config(home)
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    feature_worktree(leg, "001-s-thing", home / "Atlas-wt" / "001-s-thing" / "spec")
-    # The parked commit: made and pushed to the LEG's origin from another
-    # workstation, so nothing here knows it until this run's fetch.
-    other = status_remotes["base"] / "elsewhere-spec"
-    git("clone", "-q", str(status_remotes["Atlas"]["leg_bare"]), str(other),
-        cwd=status_remotes["base"])
-    git("checkout", "-q", "001-s-thing", cwd=other)
-    (other / "more.md").write_text("parked over there\n", encoding="utf-8")
-    commit_all(other, "parked from the other workstation")
-    parked = git("rev-parse", "HEAD", cwd=other).stdout.strip()
-    git("push", "-q", "origin", "001-s-thing", cwd=other)
-    rmtree(other)
-    record(checkout, "atlas", branch="001-s-thing", role="spec", commit=parked)
-
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "is not here" not in result.stdout, "read before its own fetch"
-    assert (f"    - parked feature 001-s-thing (spec leg): this worktree is "
-            f"BEHIND the parked commit {parked[:7]}") in result.stdout
-
-
-def test_two_spellings_of_one_leg_are_one_repository_in_the_fetch_store(
-        atlas, home):
-    """`estate_repos` builds a leg's path out of `.gitmodules` and the record
-    layer asks about the path `project.yaml` gives that role: `./spec` and
-    `spec` are one leg and two strings. Keyed on the spelling, the store
-    missed and the finding told the person this repository had never fetched
-    a leg the same run had fetched two rows below."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "    path: spec\n", "    path: ./spec\n"), encoding="utf-8")
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    feature_worktree(leg, "001-s-thing", home / "Atlas-wt" / "001-s-thing" / "spec")
-    record(checkout, "atlas", branch="001-s-thing", role="spec", commit=FAKE_SHA)
-    result = run(STATUS, "--fetch", "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-s-thing (spec leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here after this run's fetch"
-            ) in result.stdout
-    assert "never fetched it" not in result.stdout
-
-
-def test_a_worktree_the_record_does_not_know_was_never_parked(atlas, home):
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    feature_worktree(atlas, "002-unparked", home / "Atlas-wt" / "002-unparked")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - worktree on 002-unparked (root): not in the parked record — "
-            "never parked; `park` carries the features under this root's "
-            "worktree root, anything else is yours to keep or remove"
-            ) in result.stdout
-    assert "worktree on 001-a-thing" not in result.stdout
-
-
-def test_a_deleted_worktrees_stale_entry_is_not_an_unparked_worktree(atlas, home):
-    """The other half of the porcelain's stale block: telling somebody that a
-    directory which is not there was never parked is a finding about nothing,
-    and `park` would carry nothing when they ran it."""
-    checkout = workspace_config(home)
-    tip = feature_worktree(atlas, "001-a-thing",
-                           parked_worktree(atlas, "001-a-thing"))
-    gone = home / "Atlas-wt" / "002-unparked"
-    feature_worktree(atlas, "002-unparked", gone)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=tip)
-    rmtree(gone)            # and NO `git worktree prune`
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "002-unparked" not in result.stdout
-
-
-def test_a_spec_leg_is_read_in_the_legs_own_repository(atlas, home):
-    """The role is mapped to a path through `project.yaml`'s legs, so the
-    worktree is looked for in `spec/`, not in the root.
-
-    THE SECOND HALF IS WHAT PROVES IT NOW: this root is `single`, so the
-    shape reading refuses a `spec` leg here before any of it — that line is
-    the same whether or not a worktree was found — and only the arms AFTER it
-    say where the layer looked. "its parked commit … is not here" is one of
-    those: it is printed for a leg whose worktree WAS found, and it is
-    printed here, in the leg's own repository."""
-    checkout = workspace_config(home)
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    tip = feature_worktree(leg, "001-s-thing", home / "Atlas-wt" / "001-s-thing" / "spec")
-    record(checkout, "atlas", branch="001-s-thing", role="spec", commit=tip)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == ["- parked feature 001-s-thing (spec leg): "
-                        + SHAPE_SPEC + MISMATCH + EXIT_S + DISAGREE_S], findings
-
-    record(checkout, "atlas", branch="001-s-thing", role="spec", commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-s-thing (spec leg): its parked commit "
-            f"{FAKE_SHA[:7]} is not here — the record says it was pushed, so "
-            "this repository has never fetched it, or origin no longer has it"
-            ) in result.stdout
-
-
-def test_two_orgs_recording_the_same_id_is_a_note(atlas, home):
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a", role="repo", commit=FAKE_SHA)
-    record(checkout, "atlas", branch="001-a", role="repo", commit=FAKE_SHA,
-           org="otherorg")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert ("  parked record: 2 records for 'atlas' in different orgs, and none "
-            "is the org this root's origin names; not read") in result.stdout
-
-
-def test_the_state_a_resume_leaves_is_not_behind(atlas, home):
-    """`park` commits the WIP under `wip: park …` and records its depth;
-    `resume` recreates the worktree at the parked commit and soft-resets
-    exactly those commits away. That tip — `<parked>~<wip_depth>`, with the
-    work back in the tree — is the state every resumed machine is in, and
-    `resume.sh`'s `wip_gap_is_ours` is why it does not refuse it. So neither
-    does this: the first draft called it BEHIND, forever, on every run."""
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    feature_worktree(atlas, "001-a-thing", where)
-    (where / "half-done.md").write_text("half done\n", encoding="utf-8")
-    git("add", "-A", cwd=where)
-    git("-c", "user.name=t", "-c", "user.email=t@t", "commit", "-qm",
-        "wip: park 2026-09-10T20:00:00Z — lane xfactory-2", cwd=where)
-    git("push", "-q", "origin", "001-a-thing", cwd=where)
-    parked = git("rev-parse", "HEAD", cwd=where).stdout.strip()
-    git("reset", "-q", "--soft", "HEAD~1", cwd=where)   # what resume.sh does
-    git("reset", "-q", cwd=where)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=parked,
-           wip_depth=1)
-    result = run(STATUS, "Atlas", home=home)
-    assert "BEHIND" not in result.stdout, result.stdout
-    assert "parked feature" not in result.stdout, result.stdout
-    assert result.returncode == 1, "the un-committed WIP is a dirty worktree, and read as one"
-    assert "on 001-a-thing: dirty, 1 path(s)" in result.stdout
-
-    # The same gap with a commit that is NOT the parked WIP is genuinely behind.
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=parked,
-           wip_depth=0)
-    result = run(STATUS, "Atlas", home=home)
-    assert "this worktree is BEHIND the parked commit" in result.stdout
-
-
-def test_an_absent_optional_key_does_not_shift_the_fields(atlas, home):
-    """`park.sh` writes no key for an empty value. A leg with no
-    `parked_commit:` and `pushed: false` must still report the --no-push
-    finding, not a parked commit called `false`."""
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit="",
-           pushed="false", parked_on="Falcon")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature 001-a-thing (repo leg): parked with --no-push "
-            "on Falcon") in result.stdout
-    assert "parked commit false" not in result.stdout
-
-
-def test_a_diverged_worktree_names_the_log_to_read(atlas, home):
-    checkout = workspace_config(home)
-    where = parked_worktree(atlas, "001-a-thing")
-    base = feature_worktree(atlas, "001-a-thing", where)
-    (where / "theirs.md").write_text("theirs\n", encoding="utf-8")
-    commit_all(where, "parked elsewhere")
-    git("push", "-q", "origin", "001-a-thing", cwd=where)
-    theirs = git("rev-parse", "HEAD", cwd=where).stdout.strip()
-    git("reset", "-q", "--hard", base, cwd=where)
-    (where / "mine.md").write_text("mine\n", encoding="utf-8")
-    commit_all(where, "mine")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=theirs)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert (f"    - parked feature 001-a-thing (repo leg): diverged from the "
-            f"parked commit {theirs[:7]}, parked 2026-09-10T20:00:00Z on Eagle "
-            f"— reconcile by hand: `git -C {atlas} log --oneline {theirs[:7]}"
-            "..001-a-thing`") in result.stdout
-
-
-def test_a_root_the_record_does_not_mention_still_has_its_worktrees_swept(
-        atlas, home):
-    checkout = workspace_config(home)
-    feature_worktree(atlas, "001-a-thing",
-                     parked_worktree(atlas, "001-a-thing"))
-    record(checkout, "atlas", branch="001-x", role="repo", commit=FAKE_SHA)
-    # the file is atlas.yaml, but its one block is somebody else's — by id
-    # AND by root, since a block whose `root:` is this folder is this root's
-    path = checkout / "workspaces" / ORG / "atlas.yaml"
-    path.write_text(path.read_text(encoding="utf-8").replace(
-        "  - id: atlas\n", "  - id: somethingelse\n").replace(
-        "    root: Atlas\n", "    root: Somethingelse\n"), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    parked record: no block for this root in atlas.yaml" in result.stdout
-    assert ("    - worktree on 001-a-thing (root): not in the parked record"
-            in result.stdout)
-
-
-def test_an_unparked_worktree_in_a_leg_is_named_with_the_leg(atlas, home):
-    checkout = workspace_config(home)
-    leg = atlas / "spec"
-    git("checkout", "-q", "main", cwd=leg)
-    feature_worktree(leg, "001-s-thing", home / "Atlas-wt" / "001-s-thing" / "spec")
-    record(checkout, "atlas", branch="001-other", role="repo", commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    - worktree on 001-s-thing (spec): not in the parked record" in result.stdout
-
-
-def test_two_orgs_are_settled_by_the_origins_owner(atlas, home, status_remotes):
-    github_origin(atlas, status_remotes["Atlas"]["bare"], "testorg/Atlas")
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a", role="repo", commit=FAKE_SHA)
-    record(checkout, "atlas", branch="001-a", role="repo", commit=FAKE_SHA,
-           org="otherorg", parked_on="Nowhere")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"  parked record: {checkout}/workspaces/{ORG}/atlas.yaml" in result.stdout
-    assert "on Eagle" in result.stdout and "Nowhere" not in result.stdout
-
-
-def test_an_override_pointing_at_the_same_checkout_is_one_checkout(atlas, home):
-    """An `orgs:` override whose `path:` is the default's clone is one clone,
-    not two orgs recording the same id — `resume` dedupes by physical path
-    (F4 of the review on openRepoShape #83), and so does this."""
-    checkout = workspace_config(home)
-    (home / ".agents" / "workspace.yaml").write_text(
-        f"repository: tester/wip\npath: {checkout}\norgs:\n  {ORG}:\n"
-        f"    repository: tester/wip\n    path: {checkout}/\n", encoding="utf-8")
-    record(checkout, "atlas", branch="001-a", role="repo", commit=FAKE_SHA)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "2 records for 'atlas'" not in result.stdout
-    assert f"  parked record: {checkout}/workspaces/{ORG}/atlas.yaml" in result.stdout
-
-
-def test_two_checkouts_of_one_workspace_repository_are_one_record(atlas, home):
-    """Two CLONES of one workspace repository — the default `path:` and an
-    `orgs:` override that is a second checkout of it — hold the same
-    `<org>/<id>.yaml`. `resume` counts that as ONE record, by org and
-    basename (F4 of the review on openRepoShape #83), because `--org` could
-    not have told the two apart. Counted as two it read as "two orgs record
-    this id", and a local-path origin names no owner to settle it with, so a
-    record that was never ambiguous was skipped unread."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA)
-    other = home / "wip-2"
-    shutil.copytree(checkout, other)
-    (home / ".agents" / "workspace.yaml").write_text(
-        f"repository: tester/wip\npath: {checkout}\norgs:\n  {ORG}:\n"
-        f"    repository: tester/wip\n    path: {other}\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "2 records for 'atlas'" not in result.stdout
-    assert f"  parked record: {checkout}/workspaces/{ORG}/atlas.yaml" in result.stdout
-    assert "no worktree on that branch here" in result.stdout
-
-
-def test_two_checkouts_that_spell_the_record_differently_are_one_record(
-        atlas, home):
-    """The basename is MATCHED case-insensitively — `park` files under the id
-    and `resume <Name>` looks up the folder — so the key that decides whether
-    two rows are two records folds it the same way, as it already folds the
-    org. `atlas.yaml` in one checkout and `Atlas.yaml` in another are one
-    record of one org; keyed on the raw basename they were two, and a record
-    of one org was reported as two orgs' and skipped."""
-    checkout = workspace_config(home)
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA)
-    other = home / "wip-2"
-    shutil.copytree(checkout, other)
-    (other / "workspaces" / ORG / "atlas.yaml").rename(
-        other / "workspaces" / ORG / "Atlas.yaml")
-    (home / ".agents" / "workspace.yaml").write_text(
-        f"repository: tester/wip\npath: {checkout}\norgs:\n  {ORG}:\n"
-        f"    repository: tester/wip\n    path: {other}\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "2 records for 'atlas'" not in result.stdout
-    assert f"  parked record: {checkout}/workspaces/{ORG}/atlas.yaml" in result.stdout
-    assert "no worktree on that branch here" in result.stdout
-
-
-def test_a_checkout_not_on_this_machine_is_said(atlas, home):
-    (home / ".agents").mkdir(exist_ok=True)
-    (home / ".agents" / "workspace.yaml").write_text(
-        f"repository: tester/wip\npath: {home}/not-cloned-yet\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert (f"  parked record: the workspace checkout {home}/.agents/workspace.yaml "
-            f"names is not on this machine ({home}/not-cloned-yet), so parked "
-            "features are not read (`resume` clones it)") in result.stdout
-
-
-def test_a_record_filed_under_the_folder_name_is_found_too(atlas, home):
-    """`park` files under the id; `resume <Name>` looks up the folder. Where an
-    `id:` is not the folder's own name, both are tried."""
-    checkout = workspace_config(home)
-    manifest = atlas / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "id: atlas\n", "id: atlas-core\n"), encoding="utf-8")
-    record(checkout, "Atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA,
-           root="Atlas")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"  parked record: {checkout}/workspaces/{ORG}/Atlas.yaml" in result.stdout
-    assert "no worktree on that branch here" in result.stdout
-
-
-def folder_matched_record(atlas: Path, checkout: Path) -> Path:
-    """A record whose block is reached by its `root:` and not by its `id:` —
-    the selector a FAMILY member is matched by, and the one a record filed
-    under the folder name carries. The project's `id:` is made its own so the
-    `id=` selector finds nothing and `root=Atlas` is what selects the block."""
-    manifest = atlas / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "id: atlas\n", "id: atlas-core\n"), encoding="utf-8")
-    return record(checkout, "Atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon", root="Atlas")
-
-
-def test_a_root_key_below_the_features_still_selects_the_whole_block(
-        atlas, home):
-    """Copilot's second round on #22: `record_rows` decides whether a row goes
-    out AT the line it reads it from, and a block selected by `root=` is not
-    known to be the selected one until its `root:` line — which
-    `workspace_write_manifest` writes above `features:` and a hand-edit or a
-    bad merge can move below it. Every row above that line was then dropped:
-    the `project` row, each feature's `branch` row and every leg that ended
-    before it, which for the layout `park` writes is the WHOLE BLOCK — so this
-    layer said "no block for this root" about a record it had just found and
-    matched, while `workspace_load_project` matches at the `- id:` line and
-    reads the keys of a block by their indent, in any order."""
-    checkout = workspace_config(home)
-    path = folder_matched_record(atlas, checkout)
-    text = path.read_text(encoding="utf-8")
-    assert text.count("    root: Atlas\n") == 1
-    path.write_text(text.replace("    root: Atlas\n", "") + "    root: Atlas\n",
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "parked record: no block for this root" not in result.stdout, (
-        "the block was matched at its `root:` and read from there on")
-    assert ("    - parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-            "Atlas` brings it back") in result.stdout
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    assert "lists no leg for it" not in result.stdout, (
-        "the branch row kept and its leg dropped is a feature with no legs")
-
-
-def test_a_project_key_below_the_features_is_read_as_the_loader_reads_it(
-        atlas, home):
-    """Copilot's first round on #23, verbatim: "the project row is serialized
-    when `features:` is encountered, but `workspace_load_project` accepts the
-    other project-level keys at the same indent in any order. If a
-    hand-edited or merged manifest places `shape:` after the feature list,
-    this assignment updates the local variable after the `project` row has
-    already been buffered, so `RECORD_SHAPE` remains empty and the new
-    shape-disagreement diagnostic is silently omitted even though `resume`
-    reads the field."
-
-    AND IT HOLDS FOR ALL FIVE OF THEM. The loader's indent-4 arm is one
-    `case` over `shape`, `root`, `parked_at`, `parked_on`, `parked_by_lane`,
-    `active_feature` and the rest, reached by INDENT and not by position: run
-    against the extension on 2026-09-12 on this record, `workspace_load_project`
-    returned `MANIFEST_SHAPE=three-leg`, `MANIFEST_PARKED_AT=2026-09-10T20:00:00Z`,
-    `MANIFEST_PARKED_ON=Falcon`, the lane and the active feature, with the
-    feature and its leg intact. Read here at the `features:` line, every one
-    of them was empty: the root's note line said "parked ? on ?", the finding
-    lost the clause that holds the record's `shape:` against this checkout,
-    and its exit said "the record does not say where" about a record that
-    says Falcon. The row is built at the flush now, from what the whole block
-    left behind."""
-    checkout = workspace_config(home)
-    keys = ("    shape: three-leg\n",
-            "    parked_at: 2026-09-10T20:00:00Z\n",
-            "    parked_on: Falcon\n",
-            "    parked_by_lane: xfactory-2\n",
-            "    active_feature: 001-a-thing\n")
-    path = record(checkout, "atlas", branch="001-a-thing", role="assembly",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    for key in keys:
-        assert text.count(key) == 1, key
-        text = text.replace(key, "")
-    path.write_text(text + "".join(keys), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [ASSEMBLY + EXIT_NEITHER + DISAGREE], findings
-
-
-def test_a_blank_branch_above_the_root_key_is_still_the_feature_resume_refuses(
-        atlas, home):
-    """Copilot's second round on #22, its own scenario: with the `root:` key
-    between an empty `- branch:` and that feature's legs, the branch row was
-    suppressed — `matched` was still false at the branch — and the leg row was
-    not, so it reached `read_record` with no branch row before it, took no
-    feature's verdict, and was offered `resume Atlas` under a blank name. The
-    loader makes a feature of every `- branch:` line whatever sits above or
-    below it, and `resume` refuses the one named nothing at RR2 ("Error:  is
-    no longer on origin in the repo leg", exit 2) — so the feature's own line
-    is what this record gets, and no leg line under it.
-
-    AND THE SENTENCE MOVED 2026-09-12, with the reading at the bottom of this
-    file: the `    root:` key this record puts between the branch and its
-    `legs:` shuts the leg list too, so the loader loads this feature with ZERO
-    legs and `collect_legs` refuses it as a shape mismatch BEFORE RR2 is
-    reached. TWO DEFECTS AND ONE LINE, then: "a `- branch:` with no value" is
-    still the first thing said, the refusal named is the one `resume` actually
-    makes, and the leg the record does list is named rather than passed over —
-    "lists no leg", which is what the no-leg arm beside this one says, is true
-    of the loader and false of this record. The exits do not move: a blank
-    name is not settled by the key order, so it is the delete-or-re-park pair
-    the arm above gives, and only the workstation that has the feature can
-    write the branch and the legs back."""
-    checkout = workspace_config(home)
-    path = folder_matched_record(atlas, checkout)
-    text = path.read_text(encoding="utf-8")
-    assert text.count("        legs:\n") == 1
-    path.write_text(text.replace("    root: Atlas\n", "")
-                    .replace("      - branch: 001-a-thing\n", "      - branch:\n")
-                    .replace("        legs:\n", "    root: Atlas\n        legs:\n"),
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature with no branch name: a `- branch:` in the "
-            "record has no value, and the `repo` leg listed under it sits "
-            f"where `resume` reads no leg, {WHY_OUTER}; `resume` reads the "
-            "feature as one named nothing, collects no leg for it, and "
-            "refuses it whole as a shape mismatch before it reads one, so "
-            "nothing here brings it back — if that feature landed, remove its "
-            "`- branch:` block from Atlas.yaml; if it was parked, park it "
-            "again from the workstation that has it (the record says Falcon), "
-            "which writes the branch and the legs it parks") in result.stdout
-    assert "(repo leg)" not in result.stdout
-    assert "lists no leg" not in result.stdout, (
-        "said about a record that lists one")
-    assert "`resume Atlas`" not in result.stdout, (
-        "a feature named nothing was offered the command that refuses it")
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-
-
-# --- the key ORDER, and the lines the loader reads NEITHER out of ------------
-#
-# `workspace_load_project` reads a record by INDENT and shuts a list at the
-# first key shallower than its items: `in_features=false` is the first line of
-# its indent-4 arm, `in_legs=false` the first line of its indent-8 arm, its
-# `- branch:` arm sits behind `[ "$in_features" = true ] || continue` and its
-# `- role:` arm behind `[ "$in_legs" = true ] || continue`. So a project-level
-# key between two features, or between a feature and its `legs:`, or a
-# feature-level key inside a leg list, does not merely reorder the record — it
-# ENDS the list, and what is below it is lines `resume` makes no feature and no
-# leg out of. Run against the extension on 2026-09-12, nine hand-built records,
-# the `MANIFEST_*` arrays printed:
-#
-#   the ordinary record `park` writes, two features     -> 2 features, 2 legs
-#   a project key BETWEEN two features                  -> 1 feature,  1 leg
-#   a project key between a `- branch:` and its `legs:` -> 1 feature,  0 legs
-#   a `- branch:` above every `features:` key           -> 0 features, 0 legs
-#   a feature-level key between `legs:` and its items   -> 1 feature,  0 legs
-#   a feature-level key BETWEEN two legs                -> 1 feature,  1 leg
-#   a project key between two legs                      -> 1 feature,  1 leg
-#   a SECOND `features:` key after a project key        -> 2 features, 2 legs
-#   a `- branch:` below a project key, no legs          -> 1 feature,  1 leg
-#
-# THIS LAYER HAD NO SUCH STATE: it matched the indent of a line and nothing
-# above it, so it counted features `resume` never makes and legs it never
-# collects, and offered `resume <Name>` for both. That is work `status` claims
-# and `resume` will not bring back — the direction that most needs a line,
-# because a person reading it believes the feature is safe. The `why` halves
-# and the exits these findings share are hoisted to the top of this file,
-# beside the other findings' pieces; the two tests above that were written
-# before this reading read them too.
-
-#: The second feature these records grow, and the project-level key moved down
-#: to shut the list in front of it. `record()` writes exactly one of that key.
-SECOND_FEATURE = ("      - branch: 002-second\n"
-                  "        feature_directory: worktrees/002-second\n"
-                  "        legs:\n")
-LANE = "    parked_by_lane: xfactory-2\n"
-FEATURES = "    features:\n"
-LEGS_KEY = "        legs:\n"
-
-
-def test_a_project_key_between_two_features_leaves_the_second_unread(
-        atlas, home):
-    """A project-level key that a hand-edit or a bad merge left between two
-    features ENDS the feature list: the loader reads the first feature and its
-    leg and makes nothing at all of the second (1 feature, 1 leg, against the
-    extension, 2026-09-12). This layer counted two and offered `resume Atlas`
-    for both — for a feature `resume` never selects, never collects a leg for
-    and never mentions. The second is a finding of its own now, said ONCE: the
-    legs written under an unread `- branch:` are the same defect twice, and
-    the branch's line is the one with a name on it."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    origin_has_branch(atlas, "002-second")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    assert text.count(LANE) == 1, text
-    second = SECOND_FEATURE + leg_block("repo", FAKE_SHA)
-    path.write_text(text.replace(LANE, "") + LANE + second, encoding="utf-8")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    unread = (
-        "- parked feature 002-second: the record lists this branch where "
-        f"`resume` reads no feature, {WHY_FEATURES}; it is in none of the "
-        "features a bare `resume` walks and none `--feature` can name, so "
-        "nothing here brings it back" + unread_exits())
-    assert findings == [
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back",
-        unread,
-        ], findings
-    assert result.stdout.count("`resume Atlas`") == 1, (
-        "a feature the loader never makes was offered the command that never "
-        "sees it")
-
-    # AND WITH NO LEGS UNDER IT, which is the same reading and used to be a
-    # different sentence: "the record lists no leg for it" is the refusal
-    # `collect_legs` makes, about a feature it reaches. This one it does not
-    # reach — the feature is not refused, it does not exist — so the line is
-    # the branch's, whether the record lists legs for it or none.
-    path.write_text(text.replace(LANE, "") + LANE
-                    + "      - branch: 002-second\n", encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert "    " + unread in result.stdout, result.stdout
-    assert "lists no leg for it" not in result.stdout
-    assert result.stdout.count("`resume Atlas`") == 1
-
-
-def test_a_branch_above_every_features_key_is_a_feature_resume_never_makes(
-        atlas, home):
-    """The `features:` key OPENS the list, so a `- branch:` above every one of
-    them is under no list at all: 0 features, 0 legs (against the extension,
-    2026-09-12). Both spellings are here because the second is the one that
-    also moves the note line: with no `features:` key in the block the project
-    row was suppressed entirely — that key was its whole gate — and the
-    finding would have had no date and no workstation to name in its exits.
-    The row goes out for a block that owes a finding now, which is the one
-    thing added to that gate.
-
-    AND THE BRANCH IS IN NO RECORDED SET, which the third phase holds: a
-    worktree on it really is one `park` has never recorded, because `park`
-    reads this record through the same loader and would park it as new.
-
-    AND THE WHY IS THE OPENING KEY AND NOT A SHUTTING ONE since Copilot's
-    first round on this PR (2026-09-14, suppressed): nothing here shut the
-    feature list, because no `features:` key above these lines ever opened
-    one, and the shutting arm every other unread `- branch:` gets sent a
-    reader looking for a key at project indent that this record has not got.
-    The exits do not move — the order `park` writes is exactly what puts the
-    `features:` key back above the branch."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    assert text.count("    features:\n") == 1, text
-    unread = (
-        "- parked feature 001-a-thing: the record lists this branch where "
-        f"`resume` reads no feature, {WHY_NOLIST}; it is in none of the "
-        "features a bare `resume` walks and none `--feature` can name, so "
-        "nothing here brings it back" + unread_exits())
-    note = ("    parked record: 0 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing")
-
-    # (1) the key pushed to the bottom of its own block.
-    path.write_text(text.replace("    features:\n", "") + "    features:\n",
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert note in result.stdout, result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [unread], findings
-    assert "`resume Atlas`" not in result.stdout
-
-    # (2) the key gone altogether, which is the gate.
-    path.write_text(text.replace("    features:\n", ""), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert note in result.stdout, (
-        "the project row a block with no `features:` key still owes")
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [unread], findings
-    assert "`resume Atlas`" not in result.stdout
-
-    # (3) and a worktree on that branch is one the record does not know.
-    feature_worktree(atlas, "001-a-thing", home / "Atlas-wt" / "001-a-thing")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - worktree on 001-a-thing (root): not in the parked record — "
-            "never parked") in result.stdout, result.stdout
-
-
-def test_a_feature_level_key_between_legs_and_its_items_leaves_no_leg(
-        atlas, home):
-    """`legs:` opens a feature's leg list and the next key at FEATURE indent
-    shuts it, so a `feature_directory:` a merge put below `legs:` rather than
-    above it costs that feature every leg it has: 1 feature, 0 legs (against
-    the extension, 2026-09-12). `collect_legs` collects none and refuses the
-    WHOLE feature as a shape mismatch before it reads one — so this layer read
-    the leg against disk and offered `resume Atlas` for a feature `resume`
-    throws out. The line is the FEATURE's, not the leg's, and it names the leg
-    the record lists rather than saying it lists none."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    directory = "        feature_directory: worktrees/001-a-thing\n"
-    legs = "        legs:\n"
-    assert text.count(directory + legs) == 1, text
-    path.write_text(text.replace(directory + legs, legs + directory),
-                    encoding="utf-8")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing: the record lists its `repo` leg where "
-        f"`resume` reads no leg, {WHY_LEGS}; `resume` collects NO leg for this "
-        "feature and refuses it WHOLE, reporting it as a shape mismatch, so "
-        "nothing here brings it back" + unread_exits(),
-        ], findings
-    assert "(repo leg)" not in result.stdout, (
-        "a leg read against disk for a feature `collect_legs` collects none "
-        "for")
-    assert "`resume Atlas`" not in result.stdout
-    assert "lists no leg for it" not in result.stdout, (
-        "said about a record that lists one")
-
-
-def test_a_key_between_two_legs_costs_that_leg_and_not_the_feature(trio, home):
-    """THE SAME KEY IN THE SAME PLACE, ONE LEG LATER, IS A DIFFERENT ANSWER:
-    the feature and the legs above the key are read, the legs below it are
-    not, and `resume` brings the feature back with what it read. So no line of
-    this record may say "refuses the WHOLE feature" — which is what this layer
-    said, because it read the second leg, mapped its role and let it spoil a
-    feature `collect_legs` never sees it in — and the leg that DOES come back
-    keeps `resume Trio`. A three-leg estate, where both roles map: the point
-    is the key, not the shape.
-
-    Both enders are held, because they are two arms of the loader and one
-    reading: a key at FEATURE indent (`in_legs=false` at the top of the
-    indent-8 arm) and a key at PROJECT indent, which shuts the leg list with
-    the feature list it is inside."""
-    checkout = workspace_config(home)
-    origin_has_branch(trio / "spec", "001-a-thing")
-    path = record(checkout, "trio", branch="001-a-thing", role="spec",
-                  commit=FAKE_SHA, parked_on="Falcon", root="Trio")
-    code = leg_block("code", FAKE_SHA)
-    text = path.read_text(encoding="utf-8") + code
-    directory = "        feature_directory: worktrees/001-a-thing\n"
-    assert text.count(directory) == 1 and text.count(code) == 1, text
-
-    def lost(why):
-        return (
-            "- parked feature 001-a-thing: the record lists a `code` leg for "
-            f"it where `resume` reads no leg, {why}; `resume` brings the "
-            "feature back with the legs it does read and leaves that one's "
-            "work where it was parked" + unread_exits(name="trio.yaml"))
-    kept = ("- parked feature 001-a-thing (spec leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-            "Trio` brings it back")
-
-    for moved, why in ((directory, WHY_LEGS), (LANE, WHY_OUTER)):
-        path.write_text(text.replace(moved, "").replace(code, moved + code),
-                        encoding="utf-8")
-        result = run(STATUS, "Trio", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z "
-                "on Falcon") in result.stdout, moved
-        findings = [line.strip() for line in result.stdout.splitlines()
-                    if line.strip().startswith("- parked feature")]
-        assert findings == [lost(why), kept], (moved, findings)
-        assert "refuses the WHOLE feature" not in result.stdout, moved
-        assert result.stdout.count("`resume Trio`") == 1, moved
-
-
-def test_a_second_features_key_reopens_the_list_and_its_legs_keep_the_feature(
-        atlas, home):
-    """THE LIST REOPENS, AND THE LOADER'S `feature_index` DOES NOT GO BACK.
-
-    The first phase is the control and must not move: a project key between
-    two features, a second `features:` key below it, and both features and
-    both legs are read again (2 features, 2 legs, against the extension,
-    2026-09-12). This reading closes a LIST, not a record.
-
-    The second is what `$branch` is for. `feature_index` at the loader is the
-    last feature it MADE, and a `- branch:` it reads no feature out of does
-    not move it — so the legs of a `features:` key reopened below such a line
-    are collected onto the feature ABOVE it, and the verdict they cost is that
-    feature's. Read with `$branch` overwritten at every `- branch:` line
-    whatever became of it, the refusal went out against the phantom, which is
-    a feature the same report says `resume` never makes."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    origin_has_branch(atlas, "002-second")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    second = SECOND_FEATURE + leg_block("repo", FAKE_SHA)
-    path.write_text(text.replace(LANE, "") + LANE + "    features:\n" + second,
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 2 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 2, findings
-    for branch in ("001-a-thing", "002-second"):
-        assert (f"- parked feature {branch} (repo leg): no worktree on that "
-                "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-                "Atlas` brings it back") in findings, (branch, findings)
-    assert "reads no feature" not in result.stdout, "the list reopened"
-
-    # AND THE LEGS OF A REOPENED LIST BELONG TO THE FEATURE ABOVE THE UNREAD
-    # BRANCH. `nope` is a role this root does not mount, so `collect_legs`
-    # refuses whichever feature owns it — and the name on that refusal is the
-    # whole question.
-    path.write_text(text.replace(LANE, "") + LANE
-                    + "      - branch: 002-second\n"
-                    + "    features:\n        legs:\n"
-                    + leg_block("nope", FAKE_SHA), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 3, findings
-    assert findings[0] == (
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here, parked 2026-09-10T20:00:00Z on Falcon; `resume` refuses the "
-        "WHOLE feature, because its `nope` leg names a role this root does "
-        "not mount, so it does not bring this leg back — park that feature "
-        "again from the workstation that has it (the record says Falcon)"
-        ), findings[0]
-    assert findings[1] == (
-        "- parked feature 002-second: the record lists this branch where "
-        f"`resume` reads no feature, {WHY_FEATURES}; it is in none of the "
-        "features a bare `resume` walks and none `--feature` can name, so "
-        "nothing here brings it back" + unread_exits()), findings[1]
-    assert findings[2].startswith(
-        "- parked feature 001-a-thing (nope leg): the record names a leg this "
-        "root does not mount here"), findings[2]
-    assert "002-second (nope leg)" not in result.stdout, (
-        "the leg went out under the `- branch:` line above it rather than "
-        "under the feature the loader collects it onto")
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_reopened_list_below_an_unread_branch_still_says_the_leg_it_drops(
-        atlas, home):
-    """COPILOT'S FIRST ROUND ON THIS PR (2026-09-14, suppressed), verbatim:
-    "`dropped` remains set after an unread `- branch:` even when a later
-    `features:` key reopens the list. In that shape the loader keeps the last
-    real feature as the current feature, so a subsequent `- role:` under a
-    closed `legs:` list belongs to that real feature; this condition
-    suppresses its `noleg` row, causing `read_record` to miss the unread leg
-    (or incorrectly report that the feature lists no leg). Reset `dropped`
-    when `features:` reopens the feature list, and add a regression for this
-    reopen-then-noleg case."
-
-    IT IS RIGHT, AND THE SECOND HALF IS THIS COMMIT'S OWN SENTENCE TURNED ON
-    ITSELF. `$dropped` says "the last `- branch:` line was one the loader did
-    not read, so the legs written under it are its defect and not a second
-    one" — and a `features:` key ENDS that, because the legs of a reopened
-    list are collected onto the feature ABOVE the unread line (record (k) of
-    the probe, and the test above this one). Run against the extension
-    2026-09-14: this record loads as ONE feature and ONE leg, the `spec` line
-    below the reopened key read as no leg at all — and left as it was, this
-    layer said nothing whatever about it. The second phase is the half that
-    made a FALSE line: with the feature above keeping no read leg of its own,
-    "the record lists no leg for it" went out about a record that lists one,
-    which is the sentence the arm beside this one exists to stop making.
-
-    The WHY is `outer` in both, and that is the same reading: the key that
-    shut the leg list is at PROJECT indent — `parked_by_lane:` here, and the
-    `features:` key that reopened the feature list is at that indent too —
-    so no feature-level key is what a hand should go looking for."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    ghost = "      - branch: 002-ghost\n"
-    tail = ghost + FEATURES + leg_block("spec", FAKE_SHA)
-    unread_branch = (
-        "- parked feature 002-ghost: the record lists this branch where "
-        f"`resume` reads no feature, {WHY_FEATURES}; it is in none of the "
-        "features a bare `resume` walks and none `--feature` can name, so "
-        "nothing here brings it back" + unread_exits())
-
-    # (1) the feature above KEEPS the leg it does list, so the line is the
-    # leg's and `resume Atlas` still stands for the feature.
-    path.write_text(text.replace(LANE, "") + LANE + tail, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    parked record: 1 feature(s), parked 2026-09-10T20:00:00Z on "
-            "Falcon (lane xfactory-2); active 001-a-thing") in result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing: the record lists a `spec` leg for it "
-        f"where `resume` reads no leg, {WHY_OUTER}; `resume` brings the "
-        "feature back with the legs it does read and leaves that one's work "
-        "where it was parked" + unread_exits(),
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back",
-        unread_branch,
-        ], findings
-
-    # (2) and with no read leg under it, the line the arm beside this one
-    # would have said instead: "lists no leg", about a record that lists one.
-    head = text.split(LEGS_KEY)[0]
-    assert head.count(LANE) == 1 and head.endswith(
-        "        feature_directory: worktrees/001-a-thing\n"), head
-    path.write_text(head.replace(LANE, "") + LANE + tail, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing: the record lists its `spec` leg where "
-        f"`resume` reads no leg, {WHY_OUTER}; `resume` collects NO leg for "
-        "this feature and refuses it WHOLE, reporting it as a shape mismatch, "
-        "so nothing here brings it back" + unread_exits(),
-        unread_branch,
-        ], findings
-    assert "lists no leg for it" not in result.stdout, (
-        "said about a record that lists one")
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_role_above_its_features_legs_key_names_the_key_that_never_opened(
-        atlas, home):
-    """COPILOT'S FIRST ROUND ON THIS PR (2026-09-14, suppressed), the second
-    half of its note on `record_unread_why`: "the analogous `legs` text is
-    also wrong when a role precedes the first `legs:` key". IT IS RIGHT. The
-    `legs:` key is what OPENS a feature's leg list, so a `- role:` above it is
-    unread because nothing opened one — not because a key at feature indent
-    shut one — and the shutting arm sends a hand looking for a line the
-    record has not got. Run against the extension 2026-09-14: with the
-    `- role:` above the `legs:` key the loader reads ONE leg (the one below
-    it), and with no `legs:` key at all it reads NONE.
-
-    The exits do not move: the order `park` writes is where the `legs:` key
-    goes back, and the re-park is still only from the workstation that has
-    the feature.
-
-    AND THE THIRD PHASE IS THE LINE THIS ARM MAY NOT TAKE ON ITS WAY IN,
-    which is the loader's own reading and not a symmetry: its indent-6 arm
-    makes a feature only where the item's key is `branch`, so an indent-6
-    line that is anything else reads as no feature and leaves the one above
-    it current — and THAT feature has its `legs:` key above the line. The
-    list was opened and a key at that indent shut it, which is the arm every
-    such line had before this round; answering `nolegs` there would send a
-    hand looking for a `legs:` key the feature has got. Run against the
-    extension 2026-09-14 on both spellings of the line, `- stray: x` and
-    `stray: x`: 1 feature, 1 leg (`repo`), `MANIFEST_LEG_FEATURE` `0` — the
-    line makes no feature, and the `- role:` below it is no leg."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    spec = leg_block("spec", FAKE_SHA)
-    assert text.count(LEGS_KEY) == 1, text
-
-    # (1) the `- role:` above the key that would have opened the list.
-    path.write_text(text.replace(LEGS_KEY, spec + LEGS_KEY), encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing: the record lists a `spec` leg for it "
-        f"where `resume` reads no leg, {WHY_NOLEGS}; `resume` brings the "
-        "feature back with the legs it does read and leaves that one's work "
-        "where it was parked" + unread_exits(),
-        "- parked feature 001-a-thing (repo leg): no worktree on that branch "
-        "here; parked 2026-09-10T20:00:00Z on Falcon — `resume Atlas` brings "
-        "it back",
-        ], findings
-
-    # (2) and with no `legs:` key in the feature at all, where the feature is
-    # the one `collect_legs` refuses whole.
-    path.write_text(text.split(LEGS_KEY)[0] + spec, encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings == [
-        "- parked feature 001-a-thing: the record lists its `spec` leg where "
-        f"`resume` reads no leg, {WHY_NOLEGS}; `resume` collects NO leg for "
-        "this feature and refuses it WHOLE, reporting it as a shape mismatch, "
-        "so nothing here brings it back" + unread_exits(),
-        ], findings
-    assert "`resume Atlas`" not in result.stdout
-    assert "lists no leg for it" not in result.stdout
-
-    # (3) and the line the arm above may not take: an indent-6 key that is
-    # not a `- branch:` shuts the list the `legs:` key above it opened, and
-    # the feature it is still inside HAS that key.
-    for stray in ("      - stray: x\n", "      stray: x\n"):
-        path.write_text(text + stray + spec, encoding="utf-8")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        findings = [line.strip() for line in result.stdout.splitlines()
-                    if line.strip().startswith("- parked feature")]
-        assert findings == [
-            "- parked feature 001-a-thing: the record lists a `spec` leg for "
-            f"it where `resume` reads no leg, {WHY_LEGS}; `resume` brings the "
-            "feature back with the legs it does read and leaves that one's "
-            "work where it was parked" + unread_exits(),
-            "- parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-            "Atlas` brings it back",
-            ], (stray, findings)
-
-
-def test_an_unread_leg_with_no_role_is_named_by_the_role_it_has_not_got(
-        atlas, home):
-    """COPILOT'S SECOND ROUND ON THIS PR (2026-09-14, suppressed), verbatim:
-    "When an unread `- role:` has an empty value (for example `- role: # note`
-    under a closed `legs:` list), `feature_drop_role` is empty and this
-    renders `the record lists its `` leg`. That makes the new recovery
-    diagnostic unclear for a roleless record; use an explicit label such as
-    'a leg with no role' (and cover this malformed spelling in the regression
-    tests)."
-
-    IT IS RIGHT, AND THE SPELLING IS ONE THIS LAYER ALREADY KNOWS. `- role: #
-    note` is a leg with no role to BOTH readers, because `record_scalar` takes
-    a `#` comment off every value for the same reason `workspace_load_project`
-    takes it off every line — the reading #21's round put above `record_scalar`
-    itself. Run against the extension 2026-09-14 on every record below: with a
-    `repo` leg beside it the loader reads `features=1 legs=1 roles=[repo]`,
-    and with the roleless line as the feature's only leg, `features=1
-    legs=0` — `MANIFEST_LEG_ROLE` empty in both. So the line is unread in each
-    of them, and the finding about it was naming the leg with a pair of empty
-    backticks: a name where the reader is looking for one, on the line whose
-    whole worth is sending a hand to a line.
-
-    THE TWO PHASES ARE THE TWO ARMS THAT NAME A DROPPED LEG ON A FEATURE THE
-    RECORD NAMES — the one where the feature keeps a leg `resume` reads and
-    the one where it keeps none; the third, a feature whose `- branch:` has no
-    value either, is the test below this one. Both spellings are held in each,
-    the `#` comment and the bare key, because it is `record_scalar` that makes
-    them the same thing and not this arm.
-
-    RECORDED AND NOT TAKEN, and it is the exits' reading rather than this
-    line's: with the key put back this leg becomes one `collect_legs` READS,
-    and a leg with no role is a refusal of the WHOLE feature — which this
-    layer already says, in `check_parked_leg`'s own roleless arm, on the run
-    after the key moves. Bolting that onto this sentence would say it twice
-    and in the wrong place; the arm that owns it says it where it is true."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    directory = "        feature_directory: worktrees/001-a-thing\n"
-    assert text.count(directory) == 1, text
-
-    for roleless in ("# note", ""):
-        # (1) beside a leg the loader DOES read: the feature comes back and
-        # the line is about the leg that does not come with it.
-        path.write_text(text.replace(directory, "") + directory
-                        + leg_block(roleless, FAKE_SHA), encoding="utf-8")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        findings = [line.strip() for line in result.stdout.splitlines()
-                    if line.strip().startswith("- parked feature")]
-        assert findings == [
-            "- parked feature 001-a-thing: the record lists a leg with no "
-            f"role for it where `resume` reads no leg, {WHY_LEGS}; `resume` "
-            "brings the feature back with the legs it does read and leaves "
-            "that one's work where it was parked" + unread_exits(),
-            "- parked feature 001-a-thing (repo leg): no worktree on that "
-            "branch here; parked 2026-09-10T20:00:00Z on Falcon — `resume "
-            "Atlas` brings it back",
-            ], (roleless, findings)
-        assert "``" not in result.stdout, (roleless, "an empty name")
-
-        # (2) as the feature's only leg, with no `legs:` key above it to
-        # have opened a list: `collect_legs` collects none and refuses the
-        # feature whole (the loader, same day: `features=1 legs=0`).
-        path.write_text(text.split(LEGS_KEY)[0] + leg_block(roleless, FAKE_SHA),
-                        encoding="utf-8")
-        result = run(STATUS, "Atlas", home=home)
-        assert result.returncode == 1, result.stdout + result.stderr
-        findings = [line.strip() for line in result.stdout.splitlines()
-                    if line.strip().startswith("- parked feature")]
-        assert findings == [
-            "- parked feature 001-a-thing: the record lists its leg with no "
-            f"role where `resume` reads no leg, {WHY_NOLEGS}; `resume` "
-            "collects NO leg for this feature and refuses it WHOLE, reporting "
-            "it as a shape mismatch, so nothing here brings it back"
-            + unread_exits(),
-            ], (roleless, findings)
-        assert "``" not in result.stdout, (roleless, "an empty name")
-        assert "`resume Atlas`" not in result.stdout, roleless
-
-
-def test_a_blank_branch_over_an_unread_leg_with_no_role_says_both_and_neither(
-        atlas, home):
-    """THE THIRD ARM OF COPILOT'S SECOND ROUND (2026-09-14, suppressed): the
-    line for a feature whose `- branch:` has no value AND whose only listed
-    leg sits where `resume` reads none named that leg with the same empty
-    backticks. Two defects were already said in one line here; the leg is now
-    named by the role it has not got, and nothing else about this record
-    moves — not the refusal `resume` makes, and not the exits, which are the
-    delete-or-re-park pair a blank name needs rather than the key order."""
-    checkout = workspace_config(home)
-    path = folder_matched_record(atlas, checkout)
-    text = path.read_text(encoding="utf-8")
-    assert text.count("        legs:\n") == 1
-    path.write_text(text.replace("    root: Atlas\n", "")
-                    .replace("      - branch: 001-a-thing\n", "      - branch:\n")
-                    .replace("          - role: repo\n", "          - role: # note\n")
-                    .replace("        legs:\n", "    root: Atlas\n        legs:\n"),
-                    encoding="utf-8")
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature with no branch name: a `- branch:` in the "
-            "record has no value, and the leg with no role listed under it "
-            f"sits where `resume` reads no leg, {WHY_OUTER}; `resume` reads "
-            "the feature as one named nothing, collects no leg for it, and "
-            "refuses it whole as a shape mismatch before it reads one, so "
-            "nothing here brings it back — if that feature landed, remove its "
-            "`- branch:` block from Atlas.yaml; if it was parked, park it "
-            "again from the workstation that has it (the record says Falcon), "
-            "which writes the branch and the legs it parks") in result.stdout
-    assert "``" not in result.stdout, "an empty name"
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_a_blank_branch_that_keeps_a_leg_still_names_the_one_it_drops(
-        atlas, home):
-    """COPILOT'S THIRD ROUND ON THIS PR (2026-09-14), verbatim: "When a blank
-    `- branch:` has both a readable leg and a `noleg`, this condition skips
-    the new combined diagnostic because it only enters the unread-leg branch
-    when `feature_legs` is zero. Control then falls through to the older
-    blank-branch message; `unnamed=1` suppresses all readable leg rows and the
-    later `noleg` arm is a no-op, so the unread leg/key-order defect is never
-    reported. Please handle this mixed case too (and add a regression) while
-    retaining the blank-branch refusal."
-
-    IT IS RIGHT, AND IT IS THE ONE HOLE THIS WHOLE BRANCH EXISTS TO SHUT: a
-    line the record lists, that `resume` reads nothing of, said NOWHERE. The
-    blank name suppresses every per-leg line by design — there is no branch to
-    find a worktree for — and the `noleg` arm only counts, so the feature's own
-    line is the only place the unread one can be named, and the combined arm
-    was reached only where the feature keeps none. Against the extension
-    2026-09-14, the record below loads as ONE feature named nothing with ONE
-    leg (`MANIFEST_LEG_ROLE` `[repo]`, `MANIFEST_LEG_FEATURE` `0`), the `spec`
-    line below the `feature_directory:` key read as no leg at all — and this
-    layer said only "a `- branch:` in the record has no value", with nothing
-    whatever about the line it drops.
-
-    THE REFUSAL DOES NOT MOVE, and that is the half Copilot asked to keep:
-    the feature DOES keep a leg `collect_legs` collects, so the run reaches
-    RR2 and refuses it there with the name blank — not the shape mismatch the
-    legless arm names. Nor do the exits: a key put back leaves a feature named
-    nothing, which no re-ordering settles, so they are the blank name's
-    delete-or-re-park pair, and the re-park carries the dropped leg's lines
-    because the park that writes the branch writes the legs with it."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="repo",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    directory = "        feature_directory: worktrees/001-a-thing\n"
-    assert text.count(directory) == 1, text
-    blank = text.replace("      - branch: 001-a-thing\n", "      - branch:\n")
-    path.write_text(blank.replace(directory, "") + directory
-                    + leg_block("spec", FAKE_SHA), encoding="utf-8")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert ("    - parked feature with no branch name: a `- branch:` in the "
-            "record has no value, and a `spec` leg listed under it sits where "
-            f"`resume` reads no leg, {WHY_LEGS}; `resume` reads the feature "
-            "as one named nothing and refuses it as a branch origin has not "
-            "got (\"is no longer on origin\", the name blank), so nothing here "
-            "brings it back — if that feature landed, remove its `- branch:` "
-            "block from atlas.yaml; if it was parked, park it again from the "
-            "workstation that has it (the record says Falcon), which writes "
-            "the branch and the legs it parks") in result.stdout, result.stdout
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert len(findings) == 1, findings
-    assert "(repo leg)" not in result.stdout, (
-        "a per-leg line for a feature whose legs have no branch to be found by")
-    assert "(spec leg)" not in result.stdout
-    assert "`resume Atlas`" not in result.stdout
-    assert "lists no leg" not in result.stdout, (
-        "said about a record that lists two")
-    assert "parked record: 1 feature(s)" in result.stdout
-
-
-def test_the_unread_leg_line_never_promises_a_feature_this_run_refuses(
-        atlas, home):
-    """COPILOT'S FIRST ROUND ON THIS PR (2026-09-14, suppressed), verbatim:
-    "This wording assumes that the readable legs will resume successfully,
-    but `feature_why`, `feature_rr`, or `feature_add` may already contain a
-    whole-feature refusal from one of those legs. In that case
-    `check_parked_leg` reports the feature as refused and does not offer
-    `resume`, while this line says that `resume` brings it back, producing
-    contradictory guidance."
-
-    IT IS RIGHT, and the pair is the one the rule at the top of
-    `check_parked_leg` forbids — made here by this layer against itself. The
-    record below lists a `nope` leg, which this root does not mount, and a
-    second leg the key above it leaves unread: `collect_legs` refuses the
-    WHOLE feature over the first before any RR is asked, every leg line says
-    so and offers no `resume`, and the unread-leg line may not promise the
-    feature back beside them. What it still says is the key ORDER, because
-    that leg's lines are one park from gone whatever refuses the feature."""
-    checkout = workspace_config(home)
-    origin_has_branch(atlas, "001-a-thing")
-    path = record(checkout, "atlas", branch="001-a-thing", role="nope",
-                  commit=FAKE_SHA, parked_on="Falcon")
-    text = path.read_text(encoding="utf-8")
-    directory = "        feature_directory: worktrees/001-a-thing\n"
-    assert text.count(directory) == 1, text
-    path.write_text(text.replace(directory, "") + directory
-                    + leg_block("repo", FAKE_SHA), encoding="utf-8")
-
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    findings = [line.strip() for line in result.stdout.splitlines()
-                if line.strip().startswith("- parked feature")]
-    assert findings[0] == (
-        "- parked feature 001-a-thing: the record lists a `repo` leg for it "
-        f"where `resume` reads no leg, {WHY_LEGS}; `resume` refuses this "
-        "feature WHOLE in any case, for the reason the legs it does read give "
-        "on their own lines below, so nothing here brings it back"
-        + unread_exits()), findings[0]
-    assert findings[1].startswith(
-        "- parked feature 001-a-thing (nope leg): the record names a leg this "
-        "root does not mount here"), findings[1]
-    assert len(findings) == 2, findings
-    assert "brings the feature back with the legs it does read" not in (
-        result.stdout), "promised beside a refusal of the whole feature"
-    assert "`resume Atlas`" not in result.stdout
-
-
-def test_the_record_layer_under_all_is_located_per_estate(home, status_remotes):
-    """`locate_record` runs once per estate and starts clean: Atlas finds its
-    record, Borealis (whose `id:` is made its own) finds none, and neither
-    leaks into the other."""
-    checkout = workspace_config(home)
-    clone_root(home, status_remotes["Atlas"], "Atlas")
-    borealis = clone_root(home, status_remotes["Atlas"], "Borealis")
-    manifest = borealis / "project.yaml"
-    manifest.write_text(manifest.read_text(encoding="utf-8").replace(
-        "id: atlas\n", "id: borealis\n"), encoding="utf-8")
-    record(checkout, "atlas", branch="001-a-thing", role="repo", commit=FAKE_SHA)
-    result = run(STATUS, "--all", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert result.stdout.count("`resume Atlas` brings it back") == 1
-    assert "`resume Borealis`" not in result.stdout
-    assert "  parked record: none for 'borealis' under" in result.stdout
-
-
-@NEEDS_UPSTREAM
-def test_a_family_record_is_matched_to_each_member_by_its_root(estate, home):
-    """One block per MEMBER, matched by `root: <family folder>/<member>`; the
-    holder has none. The fixture's members mount no spec leg, so the recorded
-    spec leg is named as one this root does not mount — which is the match
-    working, per member, and the holder row staying silent."""
-    checkout = workspace_config(home)
-    (checkout / "workspaces" / ORG / f"{FAMILY.lower()}.yaml").write_text(
-        family_manifest(), encoding="utf-8")
-    result = run(STATUS, FAMILY, home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert f"  parked record: {checkout}/workspaces/{ORG}/{FAMILY.lower()}.yaml" \
-        in result.stdout
-    for name in MEMBERS:
-        assert (f"    - parked feature 001-{name.lower()}-thing (spec leg): the "
-                "record names a leg this root does not mount here") in result.stdout
-    assert result.stdout.count("    parked record: 1 feature(s)") == 2
-    holder_block = result.stdout.split("  root   main")[0]
-    assert "    parked record:" not in holder_block, "the holder has no block"
-
-
-# --- the one promise ----------------------------------------------------------
-
-def test_status_changes_nothing_and_takes_no_lock(atlas, home, status_remotes):
-    """THE ONE PROMISE, against a repository in every state this file knows:
-    ahead, dirty, stashed, a feature branch, a moved leg and a stale pin. Every
-    ref, HEAD, the porcelain and the stash list are identical before and
-    after, no `index.lock` is left behind, and the origin's `main` was not
-    fetched — the clone still does not know it is behind."""
-    leg = atlas / "spec"
-    (atlas / "local.md").write_text("only here\n", encoding="utf-8")
-    commit_all(atlas, "ahead")
-    (atlas / "README.md").write_text("changed\n", encoding="utf-8")
-    git("stash", "-q", cwd=atlas)
-    (atlas / "dirty.txt").write_text("x\n", encoding="utf-8")
-    git("branch", "001-a-thing", cwd=atlas)
-    git("checkout", "-q", "HEAD~1", cwd=leg)
-    push_from_elsewhere(status_remotes["base"], status_remotes["Atlas"]["bare"],
-                        "unfetched")
-
-    before = snapshot(atlas) + snapshot(leg)
-    result = run(STATUS, "Atlas", home=home)
-    assert result.returncode == 1, result.stdout + result.stderr
-    assert snapshot(atlas) + snapshot(leg) == before
-    assert not (atlas / ".git" / "index.lock").exists()
-    assert "- behind origin/main" not in result.stdout, "status fetched"
-    assert "nothing was changed." in result.stdout
diff --git a/tests/test_supervised_restart_regressions.py b/tests/test_supervised_restart_regressions.py
deleted file mode 100644
index d24c3216..00000000
--- a/tests/test_supervised_restart_regressions.py
+++ /dev/null
@@ -1,1883 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""Restart fault cases through the real helper and lane-start entrypoints."""
-from __future__ import annotations
-
-import hashlib
-import json
-import shutil
-import signal
-import time
-import os
-import subprocess
-from pathlib import Path
-
-import pytest
-
-from test_lane_start_claude_current import Sandbox, LANE, _write, pytestmark
-from conftest import REPO
-
-
-@pytest.fixture
-def restart_box(tmp_path: Path) -> Sandbox:
-    box = Sandbox(tmp_path)
-    box.env["LANES_LANE_STATE_ROOT"] = str(tmp_path / "state")
-    box.env["LANES_NO_FETCH"] = "1"
-    box.env["TMUX_PANE"] = "%1"
-    tmux = box.fakebin / "tmux"
-    tmux.write_text(tmux.read_text().replace("#!/usr/bin/env bash\n", '''#!/usr/bin/env bash
-if [ "${1-}" = respawn-pane ]; then
-  printf 'respawn-pane %s\\n' "$*" >> "$FAKE_TMUX_LOG"
-  exit 0
-fi
-''', 1))
-    return box
-
-
-def helper(box, *args):
-    return subprocess.run([str(box.bin / "lanes-edit.sh"), *args],
-                          cwd=box.lane_dir, env=box.env, text=True,
-                          capture_output=True, timeout=30, check=False)
-
-
-def intent_path(box):
-    return Path(box.env["LANES_LANE_STATE_ROOT"]) / LANE / "restart-intent.yaml"
-
-
-def write_intent(box, text):
-    path = intent_path(box)
-    _write(path, text, 0o600)
-    return path
-
-
-@pytest.mark.parametrize("state", ["", "unknown", "STARTING"])
-def test_restart_unknown_state_is_diagnostic_not_launch_authority(restart_box, state):
-    box = restart_box
-    write_intent(box, f"schema: 1\nstate: {state}\n")
-    result = helper(box, "restart-intent", LANE)
-    assert result.returncode == 0, result.stderr
-    assert "state\tUNKNOWN-STATE" in result.stdout
-    box.resolver()
-    result = box.start()
-    assert result.returncode == 2, result.stderr
-    assert box.claude_runs() == ""
-
-
-@pytest.mark.parametrize("schema", ["", "2"])
-def test_restart_writer_preserves_records_with_missing_or_unknown_schema(restart_box, schema):
-    box = restart_box
-    contents = f"schema: {schema}\nstate: pending\noperation: prior\n"
-    path = write_intent(box, contents)
-    result = helper(box, "set-restart-intent", LANE, "pending", "--expect", "none|ready|failed")
-    assert result.returncode == 2, result.stderr
-    assert path.read_text() == contents
-
-
-def test_restart_nonregular_intent_refuses_read_and_replacement(restart_box):
-    box = restart_box
-    path = intent_path(box)
-    path.mkdir(parents=True)
-    for args in [("restart-intent", LANE),
-                 ("set-restart-intent", LANE, "pending", "--expect", "none")]:
-        result = helper(box, *args)
-        assert result.returncode == 1, (result.stdout, result.stderr)
-    assert path.is_dir()
-
-
-def test_restart_failed_record_needs_launch_facts_before_retry(restart_box):
-    box = restart_box
-    write_intent(box, "schema: 1\nstate: failed\noperation: prior\nmode: fresh-from-handoff\n")
-    result = helper(box, "restart-intent", LANE)
-    assert result.returncode == 0, result.stderr
-    assert "state\tINCOMPLETE" in result.stdout
-    assert "intended_state\tfailed" in result.stdout
-    missing = next(line.split("\t", 1)[1].split() for line in result.stdout.splitlines() if line.startswith("missing\t"))
-    assert {"dir", "pane", "handoff", "digest", "agent", "window", "new_transcript"} <= set(missing)
-
-
-@pytest.mark.parametrize("write_rc", [7, 1])
-def test_restart_failed_prepared_transcript_write_never_executes(restart_box, write_rc):
-    box = restart_box
-    prepare_restart(box)
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f'''#!/usr/bin/env bash
-case "$*" in
- *"lane-start prepared the launch"*) exit {write_rc} ;;
-esac
-exec "$(dirname -- "$0")/lanes-edit-real.sh" "$@"
-''')
-    result = box.start("--fresh", "--operation", "op-test")
-    assert result.returncode == (2 if write_rc == 7 else 1), (result.stdout, result.stderr)
-    assert "refused before exec" in result.stderr or "refused before exec" in result.stdout
-    assert box.claude_runs() == ""
-
-
-def test_restart_unreadable_intent_is_neither_absent_nor_replaceable(restart_box):
-    if os.geteuid() == 0:
-        pytest.skip("permission regression requires an unprivileged runner")
-    box = restart_box
-    contents = "schema: 1\nstate: pending\noperation: held\n"
-    path = write_intent(box, contents)
-    path.chmod(0)
-    try:
-        for args in [("restart-intent", LANE),
-                     ("set-restart-intent", LANE, "pending", "--expect", "none|ready|failed")]:
-            result = helper(box, *args)
-            assert result.returncode == 1, (result.stdout, result.stderr)
-    finally:
-        path.chmod(0o600)
-    assert path.read_text() == contents
-
-
-@pytest.mark.parametrize("presence", [0, 1, 8])
-def test_restart_managed_service_requires_confirmed_absence(restart_box, presence):
-    box = restart_box
-    calls = box.root / "managed-read.log"
-    _write(box.bin / "lane-managed", f'''#!/usr/bin/env bash
-printf '%s\\n' "$*" >> '{calls}'
-exit {presence}
-''')
-    result = helper(box, "legacy-restart-check", LANE)
-    assert result.returncode == (0 if presence == 8 else 2 if presence == 0 else 1)
-    assert calls.read_text().strip() == f"legacy-check --lane {LANE}"
-
-
-def test_restart_managed_storage_without_reader_refuses(restart_box):
-    box = restart_box
-    state = box.wip / ".git" / "openrepotools-managed" / "eagle" / LANE.lower()
-    state.mkdir(parents=True)
-    _write(state / "owner.json", '{"mode":"managed"}\n', 0o600)
-    result = helper(box, "legacy-restart-check", LANE)
-    assert result.returncode == 2, result.stderr
-    assert "managed ownership storage" in result.stderr
-    assert (state / "owner.json").read_text() == '{"mode":"managed"}\n'
-
-
-def prepare_restart(box):
-    box.resolver()
-    initial = box.start("--no-launch")
-    assert initial.returncode == 0, initial.stderr
-    row = next(line for line in (box.wip / "lanes" / "LANES.md").read_text().splitlines()
-               if line.startswith(f"| `{LANE}`"))
-    source = box.wip / row.split("|")[6].strip()
-    _write(source, "# restart handoff\n\nPreserved task.\n---\nHistory.\n", 0o600)
-    box.git("-C", str(box.wip), "add", "--", str(source))
-    box.git("-C", str(box.wip), "commit", "-qm", "seed handoff")
-    box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    result = helper(box, "set-restart-intent", LANE, "pending", "--expect", "none",
-                    "--operation", "op-test", "--generation", "7", "--agent", "claude",
-                    "--profile", "test-profile", "--dir", str(box.lane_dir),
-                    "--pane", "testsess:@1.%1", "--handoff", str(source))
-    assert result.returncode == 0, result.stderr
-    return source
-
-
-def test_restart_opening_prompt_cannot_switch_to_a_different_register_file(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    other = box.wip / "handoffs" / "other.md"
-    _write(other, "# Another task\n\nWrong preserved work.\n", 0o600)
-    registry = box.wip / "lanes" / "LANES.md"
-    registry.write_text(registry.read_text().replace(str(source.relative_to(box.wip)),
-                                                     str(other.relative_to(box.wip))))
-    box.git("-C", str(box.wip), "add", "--", "lanes/LANES.md", "handoffs/other.md")
-    box.git("-C", str(box.wip), "commit", "-qm", "move row handoff")
-    box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    result = box.start("--fresh", "--operation", "op-test")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "different handoffs" in result.stderr
-    assert box.claude_runs() == ""
-
-
-def test_restart_owned_resume_stamp_preserves_retry_digest(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    result = box.start("--fresh", "--operation", "op-test", TMUX_PANE="%1")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert "Preserved task." in box.claude_runs()
-    assert "RESUMED by" in source.read_text()
-    result = helper(box, "restart-intent", LANE)
-    digest = next(line.split("\t", 1)[1] for line in result.stdout.splitlines()
-                  if line.startswith("digest\t"))
-    assert digest == hashlib.sha256(source.read_bytes()).hexdigest()
-    result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "starting",
-                    "--expect-operation", "op-test", "--expect-generation", "7")
-    assert result.returncode == 0, result.stderr
-    # Retrying in the same operation must accept only that owned stamp.
-    result = helper(box, "set-restart-intent", LANE, "starting", "--expect", "failed",
-                    "--expect-operation", "op-test", "--expect-generation", "7",
-                    "--bump-attempt", "--new-transcript", "none")
-    assert result.returncode == 0, result.stderr
-    second = box.start("--fresh", "--operation", "op-test", TMUX_PANE="%1")
-    assert second.returncode == 0, (second.stdout, second.stderr)
-    assert source.read_text().count("RESUMED by") == 2
-
-
-def test_restart_missing_supervisor_token_cannot_consume_pending_intent(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "supervisor operation token" in result.stderr
-    assert box.claude_runs() == ""
-
-
-def test_restart_supervisor_token_cannot_select_a_newer_operation(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    result = box.start(LANE_RESTART_OPERATION="superseded")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "not lane" in result.stderr
-    assert box.claude_runs() == ""
-
-
-def test_restart_managed_lane_refuses_before_handoff_stamp(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = source.read_bytes()
-    _write(box.bin / "lane-managed", "#!/usr/bin/env bash\nexit 0\n")
-    result = box.start("--fresh", "--operation", "op-test")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "managed" in result.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == ""
-
-
-@pytest.mark.parametrize("field,value", [("generation", "bad"), ("attempt", "-1"), ("state", "BOGUS")])
-def test_restart_writer_never_normalizes_malformed_existing_identity(restart_box, field, value):
-    box = restart_box
-    prepare_restart(box)
-    path = intent_path(box)
-    lines = path.read_text().splitlines()
-    path.write_text("\n".join(f"{field}: {value}" if line.startswith(f"{field}:") else line for line in lines) + "\n")
-    before = path.read_bytes()
-    result = helper(box, "set-restart-intent", LANE, "starting", "--expect-operation", "op-test")
-    assert result.returncode == 2, result.stderr
-    assert path.read_bytes() == before
-
-
-def test_restart_stale_attempt_cannot_write_or_launch(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = source.read_bytes()
-    result = helper(box, "set-restart-intent", LANE, "starting", "--expect-attempt", "1")
-    assert result.returncode == 7, result.stderr
-    result = box.start("--operation", "op-test", LANE_RESTART_ATTEMPT="1")
-    assert result.returncode == 2, result.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == ""
-
-
-def test_restart_profile_mismatch_refuses_before_preservation(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = source.read_bytes()
-    result = box.start("--operation", "op-test", CLAUDE_PROFILE_NAME="different")
-    assert result.returncode == 2, result.stderr
-    assert "profile disagrees" in result.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == ""
-
-
-def test_restart_preparing_reservation_is_not_launchable(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    result = helper(box, "set-restart-intent", LANE, "preparing", "--expect", "pending")
-    assert result.returncode == 0, result.stderr
-    before = source.read_bytes()
-    result = box.start("--operation", "op-test")
-    assert result.returncode == 2, result.stderr
-    assert "still preparing" in result.stderr
-    assert source.read_bytes() == before
-
-
-def test_restart_interrupted_stamp_publication_accepts_only_owned_bytes(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    original = source.read_bytes()
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", '''#!/usr/bin/env bash
-case "$*" in *"lane-start prepared the launch"*) exit 1 ;; esac
-exec "$(dirname -- "$0")/lanes-edit-real.sh" "$@"
-''')
-    result = box.start("--operation", "op-test")
-    assert result.returncode == 1, result.stderr
-    assert source.read_bytes() != original
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["digest"] == hashlib.sha256(original).hexdigest()
-    assert record["prepared_digest"] == hashlib.sha256(source.read_bytes()).hexdigest()
-    real.replace(box.bin / "lanes-edit.sh")
-    assert helper(box, "set-restart-intent", LANE, "failed", "--expect", "starting").returncode == 0
-    assert helper(box, "set-restart-intent", LANE, "starting", "--expect", "failed", "--bump-attempt", "--new-transcript", "none").returncode == 0
-    result = box.start("--operation", "op-test")
-    assert result.returncode == 0, result.stderr
-    # The transaction does not whitelist edits made by anyone else.
-    assert helper(box, "set-restart-intent", LANE, "failed", "--expect", "starting").returncode == 0
-    source.write_text(source.read_text() + "Unrelated changed instructions.\n")
-    result = box.start("--operation", "op-test")
-    assert result.returncode == 2
-
-
-def supervisor(box, *args):
-    from conftest import REPO
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    return subprocess.run([str(box.bin / "lane-handoff"), *args], cwd=box.lane_dir,
-                          env=box.env, text=True, capture_output=True, timeout=30)
-
-
-def test_restart_failed_child_retries_in_same_supervisor_operation(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    child = _write(box.fakebin / "pclaude", "#!/usr/bin/env bash\nexit 127\n")
-    box.env.update(PCLAUDE=str(child), LANE_SUPERVISOR_NO_PROMPT="1")
-    for attempt in (1, 2):
-        result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-        assert result.returncode == 3, (result.stdout, result.stderr)
-        record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-        assert record["state"] == "failed"
-        assert record["attempt"] == str(attempt)
-        assert record["operation"] == "op-test"
-        assert record["new_transcript"] == "none"
-
-
-def test_restart_signal_with_live_child_does_not_offer_retry(restart_box):
-    from conftest import REPO
-    box = restart_box
-    prepare_restart(box)
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    pidfile = box.root / "child.pid"
-    child = _write(box.fakebin / "pclaude", f'''#!/usr/bin/env bash
-printf '%s\n' "$$" > '{pidfile}'
-exec sleep 30
-''')
-    box.env.update(PCLAUDE=str(child), LANE_SUPERVISOR_NO_PROMPT="1")
-    with (box.root / "supervisor.out").open("w") as output:
-        proc = subprocess.Popen([str(box.bin / "lane-handoff"), "--supervise", "--lane", LANE,
-                                 "--operation", "op-test"], cwd=box.lane_dir, env=box.env,
-                                stdout=output, stderr=output, start_new_session=True)
-        try:
-            deadline = time.monotonic() + 15
-            while not pidfile.exists() and proc.poll() is None and time.monotonic() < deadline:
-                time.sleep(.05)
-            assert pidfile.exists(), (box.root / "supervisor.out").read_text()
-            proc.send_signal(signal.SIGTERM)
-            assert proc.wait(timeout=10) == 143
-            record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-            assert record["state"] == "starting"
-            assert "INDETERMINATE" in record["reason"]
-            retry = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-            assert retry.returncode == 2
-        finally:
-            # Only this sandbox's process group is stopped.
-            try:
-                os.killpg(proc.pid, signal.SIGTERM)
-            except ProcessLookupError:
-                pass
-            if proc.poll() is None:
-                proc.wait(timeout=10)
-
-
-def test_restart_reserved_transcript_cannot_be_consumed_twice(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    first = box.start("--operation", "op-test")
-    assert first.returncode == 0, first.stderr
-    before = source.read_bytes()
-    launched = box.claude_runs()
-    second = box.start("--operation", "op-test")
-    assert second.returncode == 2, second.stderr
-    assert "lost ownership" in second.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == launched
-
-
-def test_restart_atomic_stamp_failure_preserves_original_for_retry(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = source.read_bytes()
-    real_mv = shutil.which("mv")
-    _write(box.fakebin / "mv", f'''#!/usr/bin/env bash
-case "$*" in *.resume.*) exit 1 ;; esac
-exec '{real_mv}' "$@"
-''')
-    first = box.start("--operation", "op-test")
-    assert first.returncode == 2, first.stderr
-    assert "published atomically" in first.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == ""
-    (box.fakebin / "mv").unlink()
-    assert helper(box, "set-restart-intent", LANE, "failed", "--expect", "starting").returncode == 0
-    assert helper(box, "set-restart-intent", LANE, "starting", "--expect", "failed", "--bump-attempt", "--new-transcript", "none").returncode == 0
-    retry = box.start("--operation", "op-test")
-    assert retry.returncode == 0, retry.stderr
-
-
-def test_restart_historical_ready_intent_does_not_control_ordinary_resume(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    before = intent_path(box).read_bytes()
-    result = box.start()
-    assert result.returncode == 0, result.stderr
-    assert intent_path(box).read_bytes() == before
-    assert box.claude_runs()
-
-
-def test_restart_second_ctx_leaves_inflight_preservation_unchanged(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = {p: p.read_bytes() for p in (source, box.wip / "lanes" / "LANES.md", intent_path(box))}
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "No handoff, row, log or window was changed" in result.stderr
-    assert all(p.read_bytes() == contents for p, contents in before.items())
-
-
-def test_restart_preparation_error_releases_only_its_reservation(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    real_mktemp = shutil.which("mktemp")
-    _write(box.fakebin / "mktemp", f'''#!/usr/bin/env bash
-case "$*" in *lane-handoff-writers*) exit 1 ;; esac
-exec '{real_mktemp}' "$@"
-''')
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == "failed"
-    assert "preservation stopped" in record["reason"]
-    assert record["generation"] == "8"
-    assert record["mode"] == "preservation-only"
-    retry = supervisor(box, "--supervise", "--lane", LANE, "--operation", record["operation"])
-    assert retry.returncode == 2, (retry.stdout, retry.stderr)
-    assert "only 'fresh-from-handoff'" in retry.stderr
-    assert box.claude_runs() == ""
-    assert "respawn-pane" not in box.tmux_log.read_text()
-    (box.fakebin / "mktemp").unlink()
-    prior = helper(box, "last-session", LANE)
-    assert prior.returncode == 0, prior.stderr
-    transcript = prior.stdout.strip()
-    dirname = "".join(ch if ch.isascii() and ch.isalnum() else "-" for ch in str(box.lane_dir))
-    _write(box.home / ".claude" / "projects" / dirname / (transcript + ".jsonl"),
-           '{"type":"user","message":{"role":"user","content":"preserved work"}}\n', 0o600)
-    unchanged = intent_path(box).read_bytes()
-    status = supervisor(box, "--restart-status", "--lane", LANE)
-    assert "PREPARATION FAILED" in status.stdout
-    assert "RETRY:" not in status.stdout
-    resumed = box.start()
-    assert resumed.returncode == 0, (resumed.stdout, resumed.stderr)
-    assert "--resume " + transcript in box.claude_runs()
-    assert "--session-id" not in box.claude_runs()
-    assert intent_path(box).read_bytes() == unchanged
-
-
-def failed_preparation(box):
-    prepare_restart(box)
-    result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "pending",
-                    "--mode", "preservation-only", "--attempt", "0", "--new-transcript", "none")
-    assert result.returncode == 0, result.stderr
-    records = {p for root in (box.wip / "lanes", box.wip / "handoffs")
-               for p in root.rglob("*") if p.is_file()}
-    records.add(intent_path(box))
-    return {p: p.read_bytes() for p in records}
-
-
-@pytest.mark.parametrize("holder_rc", [0, 1, 2])
-def test_preparation_recovery_requires_confirmed_holder_absence(restart_box, holder_rc):
-    box = restart_box
-    before = failed_preparation(box)
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-[ "$1" != lane-holders ] || exit {holder_rc}
-exec '{real}' "$@"
-""")
-    box.tmux_log.write_text("")
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "confirmed absence" in result.stderr
-    assert all(p.read_bytes() == data for p, data in before.items())
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.claude_runs() == ""
-
-
-@pytest.mark.parametrize("kind", ["attempt", "transcript", "launch", "preparing", "operation-token", "environment-operation", "environment-attempt", "fresh", "environment-fresh"])
-def test_preparation_recovery_rejects_launch_ownership_or_tokens(restart_box, kind):
-    box = restart_box
-    failed_preparation(box)
-    changes = {"attempt": ("--attempt", "1"),
-               "transcript": ("--new-transcript", "11111111-2222-4333-8444-555555555555"),
-               "launch": ("--mode", "fresh-from-handoff")}
-    if kind in changes or kind == "preparing":
-        result = helper(box, "set-restart-intent", LANE, "preparing" if kind == "preparing" else "failed",
-                        *changes.get(kind, ()))
-        assert result.returncode == 0, result.stderr
-    before = intent_path(box).read_bytes()
-    args, env = (), {}
-    if kind == "operation-token": args = ("--operation", "op-test")
-    if kind == "environment-operation": env["LANE_RESTART_OPERATION"] = "op-test"
-    if kind == "environment-attempt": env["LANE_RESTART_ATTEMPT"] = "0"
-    if kind == "fresh": args = ("--fresh",)
-    if kind == "environment-fresh": env["LANE_START_FRESH"] = "1"
-    box.tmux_log.write_text("")
-    result = box.start(*args, **env)
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert intent_path(box).read_bytes() == before
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.claude_runs() == ""
-
-
-@pytest.mark.parametrize("stage", [2, 3])
-def test_preparation_recovery_rechecks_operation_before_launch(restart_box, stage):
-    box = restart_box
-    failed_preparation(box)
-    count = box.root / "intent-reads"
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = restart-intent ]; then
-  n=$(cat '{count}' 2>/dev/null || printf 0)
-  n=$((n + 1)); printf '%s\n' "$n" > '{count}'
-  if [ "$n" = {stage} ]; then
-    '{real}' set-restart-intent "$2" failed --operation newer-preparation --generation 8 --mode preservation-only --attempt 0 --new-transcript none >/dev/null || exit 1
-  fi
-fi
-exec '{real}' "$@"
-""")
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "changed during ordinary recovery" in result.stderr
-    assert box.claude_runs() == ""
-    final = helper(box, "restart-intent", LANE)
-    assert "operation\tnewer-preparation" in final.stdout
-    assert "generation\t8" in final.stdout
-    assert "state\tfailed" in final.stdout
-
-
-@pytest.mark.parametrize("stage,holder_rc", [(2, 0), (3, 1)])
-def test_preparation_recovery_rechecks_holders_before_launch(restart_box, stage, holder_rc):
-    box = restart_box
-    failed_preparation(box)
-    before = intent_path(box).read_bytes()
-    count = box.root / "holder-reads"
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = lane-holders ]; then
-  n=$(cat '{count}' 2>/dev/null || printf 0)
-  n=$((n + 1)); printf '%s\n' "$n" > '{count}'
-  if [ "$n" = {stage} ]; then exit {holder_rc}; fi
-  exit 8
-fi
-exec '{real}' "$@"
-""")
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "confirmed absence" in result.stderr
-    assert box.claude_runs() == ""
-    assert intent_path(box).read_bytes() == before
-
-
-@pytest.mark.parametrize("damage", ["attempt", "transcript"])
-def test_preparation_recovery_rejects_malformed_identity(restart_box, damage):
-    box = restart_box
-    failed_preparation(box)
-    path = intent_path(box)
-    text = path.read_text()
-    text = text.replace("attempt: 0\n", "attempt: -1\n") if damage == "attempt" else text.replace("new_transcript: none\n", "")
-    path.write_text(text)
-    before = {p: p.read_bytes() for root in (box.wip / "lanes", box.wip / "handoffs", path.parent)
-              for p in root.rglob("*") if p.is_file()}
-    box.tmux_log.write_text("")
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "INCOMPLETE" in result.stderr
-    assert all(p.read_bytes() == data for p, data in before.items())
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert box.claude_runs() == ""
-
-
-def live_record(box, pid, transcript, suffix):
-    proc = Path(f"/proc/{pid}/stat")
-    start = proc.read_text().split()[21] if proc.exists() else ""
-    path = box.home / ".claude" / "sessions" / f"{suffix}.json"
-    _write(path, json.dumps(dict(pid=pid, sessionId=transcript, cwd=str(box.lane_dir),
-                                procStart=start, tmux="testsess:@1.%1", name=LANE,
-                                nameSource="user", status="busy"), separators=(",", ":")) + "\n", 0o600)
-    return path
-
-
-def test_restart_all_holders_retains_duplicate_processes_for_one_uuid(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    sid = "10101010-1111-4111-8111-111111111111"
-    row = next(line for line in (box.wip / "lanes" / "LANES.md").read_text().splitlines()
-               if line.startswith(f"| `{LANE}`"))
-    anchor = row.split("|")[2].strip()
-    result = helper(box, "append-session-id", LANE, anchor, f"`{sid}`")
-    assert result.returncode == 0, result.stderr
-    procs = [subprocess.Popen(["sleep", "20"]) for _ in range(2)]
-    try:
-        for n, proc in enumerate(procs):
-            live_record(box, proc.pid, sid, str(n))
-        result = helper(box, "lane-holders", LANE)
-        assert result.returncode == 0, result.stderr
-        assert len(result.stdout.splitlines()) == 2
-        assert len(helper(box, "live-holder", LANE).stdout.splitlines()) == 1
-    finally:
-        for proc in procs:
-            proc.terminate()
-            proc.wait(timeout=5)
-
-
-@pytest.mark.parametrize("child_state", ["live", "zombie"])
-def test_restart_observer_confirms_late_uuid_prepared_by_real_child(restart_box, child_state):
-    box = restart_box
-    prepare_restart(box)
-    if child_state == "zombie":
-        ps = shutil.which("ps")
-        _write(box.fakebin / "ps", f"""#!/usr/bin/env bash
-case "$*" in *"-o stat="*) printf 'Z\n'; exit 0 ;; esac
-exec '{ps}' "$@"
-""")
-    box.env["FAKE_CHILD_STATE"] = child_state
-    # A fake profile launcher forwards both supervisor tokens in the existing
-    # pane. The child itself executes real lane-start, including the stamp.
-    launcher = _write(box.fakebin / "pclaude", '''#!/usr/bin/env bash
-export CLAUDE_PROFILE_NAME=test-profile
-exec "$OPENREPOTOOLS_BIN_DIR/lane-start" repoZ 1
-''')
-    _write(box.resolved, r'''#!/usr/bin/env python3
-import json, os, pathlib, sys, time
-args=sys.argv[1:]
-sid=args[args.index('--session-id')+1]
-pid=os.getpid()
-stat=pathlib.Path(f'/proc/{pid}/stat')
-start=stat.read_text().split()[21] if stat.exists() else ''
-record=dict(pid=pid, sessionId=sid, procStart=start, cwd=os.getcwd(),
-            tmux='testsess:@1.%1', name='repoZ-1', nameSource='user', status='busy')
-record_path=pathlib.Path(os.environ['HOME'])/'.claude'/'sessions'/'ready.json'
-record_path.write_text(json.dumps(record, separators=(',', ':'))+'\n')
-# /clear can leave a historical UUID witness for this same process.
-registry=pathlib.Path(os.environ['HOME'])/'projects'/'wip'/'lanes'/'LANES.md'
-import re
-uuids=re.findall(r'[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}', registry.read_text())
-if uuids:
-    historical=dict(record, sessionId=uuids[0])
-    (record_path.parent/'historical.json').write_text(json.dumps(historical, separators=(',', ':'))+'\n')
-
-pathlib.Path(os.environ['FAKE_CLAUDE_LOG']).write_text(' '.join(args))
-intent=pathlib.Path(os.environ['LANES_LANE_STATE_ROOT'])/'repoZ-1'/'restart-intent.yaml'
-if os.environ.get('FAKE_CHILD_STATE') == 'zombie':
-    time.sleep(1)
-    record_path.unlink()
-    historical_path=record_path.parent/'historical.json'
-    if historical_path.exists(): historical_path.unlink()
-    sys.exit(127)
-for _ in range(150):
-    if 'state: ready\n' in intent.read_text(): break
-    time.sleep(.1)
-else: sys.exit(4)
-record_path.unlink()
-''')
-    box.env.update(PCLAUDE=str(launcher), LANE_SUPERVISOR_NO_PROMPT="1",
-                   LANE_SUPERVISOR_READY_SECONDS="15", FAKE_CC_PATH=str(box.resolved), TMUX_PANE="%1")
-    result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    assert result.returncode == (0 if child_state == "live" else 3), (result.stdout, result.stderr)
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == ("ready" if child_state == "live" else "failed")
-    assert record["attempt"] == "1"
-    assert record["new_transcript"] != "none"
-    assert "Preserved task." in box.claude_runs()
-
-
-def test_restart_signal_before_claim_preserves_pending_intent(restart_box):
-    from conftest import REPO
-    box = restart_box
-    prepare_restart(box)
-    before = intent_path(box).read_bytes()
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    marker = box.root / "preflight.marker"
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f'''#!/usr/bin/env bash
-if [ "$1" = legacy-restart-check ]; then
-  touch '{marker}'
-  sleep 1
-fi
-exec "$(dirname -- "$0")/lanes-edit-real.sh" "$@"
-''')
-    with (box.root / "preflight.out").open("w") as output:
-        proc = subprocess.Popen([str(box.bin / "lane-handoff"), "--supervise", "--lane", LANE,
-                                 "--operation", "op-test"], cwd=box.lane_dir, env=box.env,
-                                stdout=output, stderr=output, start_new_session=True)
-        try:
-            deadline = time.monotonic() + 10
-            while not marker.exists() and proc.poll() is None and time.monotonic() < deadline:
-                time.sleep(.02)
-            assert marker.exists()
-            proc.send_signal(signal.SIGTERM)
-            assert proc.wait(timeout=5) == 143
-            assert intent_path(box).read_bytes() == before
-        finally:
-            try: os.killpg(proc.pid, signal.SIGTERM)
-            except ProcessLookupError: pass
-            if proc.poll() is None: proc.wait(timeout=5)
-
-
-def test_restart_missing_checksum_is_not_launch_authority(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "pending", "--digest", "none").returncode == 0
-    before = source.read_bytes()
-    result = box.start("--operation", "op-test")
-    assert result.returncode == 2, result.stderr
-    assert "no complete handoff checksum" in result.stderr
-    result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    assert result.returncode == 2, result.stderr
-    assert source.read_bytes() == before
-    assert box.claude_runs() == ""
-
-
-def test_restart_stale_supervisor_cannot_fail_or_retry_newer_operation(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    child = _write(box.fakebin / "pclaude", '''#!/usr/bin/env bash
-"$OPENREPOTOOLS_BIN_DIR/lanes-edit.sh" set-restart-intent repoZ-1 pending \
-  --expect starting --expect-operation op-test --operation newer --generation 8 \
-  --reason 'new owner' >/dev/null || exit 9
-exit 127
-''')
-    box.env.update(PCLAUDE=str(child), LANE_SUPERVISOR_NO_PROMPT="1")
-    result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == "pending"
-    assert record["generation"] == "8"
-    assert record["operation"] == "newer"
-    assert record["reason"] == "new owner"
-    assert "no retry is authorized" in result.stdout
-    assert "RESTART FAILED" not in result.stdout
-
-
-@pytest.mark.parametrize("field", ["agent", "window", "new_transcript", "created"])
-def test_restart_truncated_intent_is_never_repaired_by_transition(restart_box, field):
-    box = restart_box
-    prepare_restart(box)
-    path = intent_path(box)
-    path.write_text("\n".join(line for line in path.read_text().splitlines() if not line.startswith(field + ":")) + "\n")
-    before = path.read_bytes()
-    result = helper(box, "restart-intent", LANE)
-    assert "state\tINCOMPLETE" in result.stdout
-    assert field in result.stdout
-    result = helper(box, "set-restart-intent", LANE, "starting", "--expect", "pending")
-    assert result.returncode == 2, result.stderr
-    assert path.read_bytes() == before
-
-
-def test_restart_publication_fences_changed_bytes_and_current_attempt(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = source.read_bytes()
-    digest = hashlib.sha256(before).hexdigest()
-    prepared = box.root / "prepared.md"
-    _write(prepared, "# owned stamp\n\nPreserved task.\n", 0o600)
-    args = ("publish-handoff", LANE, str(source), str(prepared), "--expect-digest", digest,
-            "--operation", "op-test", "--generation", "7", "--attempt", "0",
-            "--state", "pending", "--transcript", "none")
-    # Changed source and stale intent must independently refuse publication.
-    source.write_text(source.read_text() + "Other writer's instructions.\n")
-    changed = source.read_bytes()
-    result = helper(box, *args)
-    assert result.returncode == 7, result.stderr
-    assert source.read_bytes() == changed
-    source.write_bytes(before)
-    assert helper(box, "set-restart-intent", LANE, "starting", "--attempt", "1").returncode == 0
-    result = helper(box, *args)
-    assert result.returncode == 7, result.stderr
-    assert source.read_bytes() == before
-
-
-def test_plain_handoff_refuses_active_restart_before_preservation(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    before = {p: p.read_bytes() for p in (source, box.wip / "lanes" / "LANES.md", intent_path(box))}
-    result = supervisor(box, "--lane", LANE, "--dir", str(box.lane_dir), "handoff")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "preservation refused before" in result.stderr
-    assert all(p.read_bytes() == contents for p, contents in before.items())
-
-
-@pytest.mark.parametrize("field,value", [("operation", "bad operation"), ("dir", "relative"),
-                                         ("digest", "bad-sha"), ("lane", "other-1"),
-                                         ("generation", "1:2"), ("attempt", "1:2")])
-def test_restart_writer_preserves_invalid_existing_values(restart_box, field, value):
-    box = restart_box
-    prepare_restart(box)
-    path = intent_path(box)
-    text = path.read_text()
-    contents = "\n".join(f"{field}: {value}" if line.startswith(f"{field}:") else line
-                         for line in text.splitlines()) + "\n"
-    path.write_text(contents)
-    result = helper(box, "set-restart-intent", LANE, "starting", "--expect", "pending")
-    assert result.returncode == 2, result.stderr
-    assert path.read_text() == contents
-    assert "state\tINCOMPLETE" in helper(box, "restart-intent", LANE).stdout
-
-
-def test_handoff_publishers_serialize_checksum_and_replacement(restart_box):
-    box = restart_box
-    source = prepare_restart(box)
-    digest = hashlib.sha256(source.read_bytes()).hexdigest()
-    ready, release = box.root / "publisher.locked", box.root / "publisher.release"
-    first, second = box.root / "first.md", box.root / "second.md"
-    first.write_text("First publisher.\n")
-    second.write_text("Second publisher.\n")
-    cp = shutil.which("cp")
-    _write(box.fakebin / "cp", f"""#!/usr/bin/env bash
-case "$*" in
-  *.resume.*)
-    : > '{ready}'
-    while [ ! -e '{release}' ]; do sleep .05; done ;;
-esac
-exec '{cp}' "$@"
-""")
-    def command(prepared):
-        return [str(box.bin / "lanes-edit.sh"), "publish-handoff", LANE, str(source),
-                str(prepared), "--expect-digest", digest, "--operation", "op-test",
-                "--generation", "7", "--attempt", "0", "--state", "pending",
-                "--transcript", "none"]
-    a = subprocess.Popen(command(first), cwd=box.lane_dir, env=box.env,
-                         text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    b = None
-    try:
-        deadline = time.monotonic() + 15
-        while not ready.exists() and a.poll() is None and time.monotonic() < deadline:
-            time.sleep(.05)
-        assert ready.exists(), a.communicate(timeout=5)
-        b = subprocess.Popen(command(second), cwd=box.lane_dir, env=box.env,
-                             text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-        release.touch()
-        out_a = a.communicate(timeout=20)
-        out_b = b.communicate(timeout=20)
-        assert a.returncode == 0, out_a
-        assert b.returncode == 7, out_b
-        assert source.read_text() == "First publisher.\n"
-    finally:
-        release.touch()
-        for process in (a, b):
-            if process is not None and process.poll() is None:
-                process.terminate()
-                process.communicate(timeout=10)
-
-
-def test_new_lane_checkout_without_projects_root_can_launch(restart_box):
-    box = restart_box
-    box.env.pop("LANES_LANE_STATE_ROOT")
-    box.env["PROJECTS_ROOT"] = str(box.root / "missing-projects")
-    box.resolver()
-    result = box.start("--dir", str(box.lane_dir))
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert box.claude_runs()
-
-
-def test_new_lane_checkout_hint_still_refuses_unreadable_intent(restart_box):
-    box = restart_box
-    box.env.pop("LANES_LANE_STATE_ROOT")
-    box.env["PROJECTS_ROOT"] = str(box.root / "missing-projects")
-    (box.lane_dir.parent / ".lane-state" / LANE / "restart-intent.yaml").mkdir(parents=True)
-    box.resolver()
-    result = box.start("--dir", str(box.lane_dir))
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert not box.claude_runs()
-
-
-def test_interactive_retry_rechecks_holder_absence_before_launch(restart_box):
-    import pty
-    import fcntl
-    import termios
-    import errno
-    from conftest import REPO
-    box = restart_box
-    prepare_restart(box)
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = lane-holders ] && command grep -q '^attempt: 2$' '{intent_path(box)}'; then
-  printf 'another holder\n'
-  exit 0
-fi
-exec "$(dirname -- "$0")/lanes-edit-real.sh" "$@"
-""")
-    launches = box.root / "launches"
-    child = _write(box.fakebin / "pclaude", f"""#!/usr/bin/env bash
-printf 'launch\n' >> '{launches}'
-exit 127
-""")
-    box.env.update(PCLAUDE=str(child))
-    box.env.pop("LANE_SUPERVISOR_NO_PROMPT", None)
-    master, slave = pty.openpty()
-    fcntl.fcntl(master, fcntl.F_SETFL, fcntl.fcntl(master, fcntl.F_GETFL) | os.O_NONBLOCK)
-    output_path = box.root / "interactive.out"
-
-    def drain_terminal():
-        # Consume terminal echo as a pane does. Darwin waits for queued tty
-        # output during session-leader exit, even when stdout is a file.
-        while True:
-            try:
-                if not os.read(master, 4096):
-                    return
-            except BlockingIOError:
-                return
-            except OSError as error:
-                if error.errno == errno.EIO:  # the slave has closed on Linux
-                    return
-                raise
-
-    def wait_with_terminal(timeout):
-        deadline = time.monotonic() + timeout
-        while True:
-            drain_terminal()
-            status = proc.poll()
-            if status is not None:
-                return status
-            if time.monotonic() >= deadline:
-                raise subprocess.TimeoutExpired(proc.args, timeout)
-            time.sleep(.01)
-
-    def own_terminal():
-        # Match a pane: the supervisor owns a controlling tty in its session.
-        # An openpty fd alone is only a tty, which differs on macOS.
-        fcntl.ioctl(0, termios.TIOCSCTTY, 0)
-    with output_path.open("w") as output:
-        proc = subprocess.Popen([str(box.bin / "lane-handoff"), "--supervise", "--lane", LANE,
-                                 "--operation", "op-test"], cwd=box.lane_dir, env=box.env,
-                                stdin=slave, stdout=output, stderr=output, start_new_session=True,
-                                preexec_fn=own_terminal)
-        os.close(slave)
-        try:
-            deadline = time.monotonic() + 15
-            while "retry this restart?" not in output_path.read_text() and proc.poll() is None and time.monotonic() < deadline:
-                drain_terminal()
-                time.sleep(.05)
-            assert "retry this restart?" in output_path.read_text(), output_path.read_text()
-            os.write(master, b"r\n")
-            # The terminal stays open for an indeterminate result until its
-            # message is acknowledged, matching the real supervisor pane.
-            deadline = time.monotonic() + 15
-            while "Press Enter to close it" not in output_path.read_text() and proc.poll() is None and time.monotonic() < deadline:
-                drain_terminal()
-                time.sleep(.05)
-            assert "INDETERMINATE" in output_path.read_text(), output_path.read_text()
-            assert "Press Enter to close it" in output_path.read_text(), output_path.read_text()
-            os.write(master, b"\n")
-            try:
-                status = wait_with_terminal(15)
-            except subprocess.TimeoutExpired as error:
-                raise AssertionError("supervisor did not exit after Enter:\n" + output_path.read_text()) from error
-            assert status == 4, output_path.read_text()
-            assert launches.read_text().splitlines() == ["launch"]
-            record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-            assert record["state"] == "starting" and record["attempt"] == "2"
-            assert "before attempt launch" in record["reason"]
-        finally:
-            # Disconnect even on assertion/timeout: an unread master must
-            # not prevent Darwin from completing the owned process's exit.
-            os.close(master)
-            if proc.poll() is None:
-                proc.terminate()
-                try:
-                    proc.wait(timeout=10)
-                except subprocess.TimeoutExpired:
-                    proc.kill()
-                    proc.wait(timeout=10)
-
-
-def test_checkout_hint_cannot_hide_existing_fallback_intent(restart_box):
-    box = restart_box
-    box.env.pop("LANES_LANE_STATE_ROOT")
-    fallback = box.root / "established-projects"
-    fallback.mkdir()
-    box.env["PROJECTS_ROOT"] = str(fallback)
-    source = box.wip / "handoffs" / "README.md"
-    result = helper(box, "set-restart-intent", LANE, "pending", "--expect", "none",
-                    "--operation", "established", "--agent", "claude", "--handoff", str(source))
-    assert result.returncode == 0, result.stderr
-    path = fallback / ".lane-state" / LANE / "restart-intent.yaml"
-    before = path.read_bytes()
-    box.resolver()
-    result = box.start("--dir", str(box.lane_dir))
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "supervisor operation token" in result.stderr
-    assert not box.claude_runs()
-    assert path.read_bytes() == before
-
-
-@pytest.mark.parametrize("holder_rc", [0, 1])
-def test_signal_after_launcher_exit_keeps_live_or_unknown_holder_indeterminate(restart_box, holder_rc):
-    from conftest import REPO
-    box = restart_box
-    prepare_restart(box)
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    exited, probed, release = (box.root / name for name in ("child.exited", "holder.probed", "holder.release"))
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = lane-holders ] && [ -e '{exited}' ]; then
-  : > '{probed}'
-  while [ ! -e '{release}' ]; do sleep .05; done
-  exit {holder_rc}
-fi
-exec "$(dirname -- "$0")/lanes-edit-real.sh" "$@"
-""")
-    child = _write(box.fakebin / "pclaude", f"""#!/usr/bin/env bash
-: > '{exited}'
-exit 127
-""")
-    box.env.update(PCLAUDE=str(child), LANE_SUPERVISOR_NO_PROMPT="1")
-    output_path = box.root / "ended-child-signal.out"
-    with output_path.open("w") as output:
-        proc = subprocess.Popen([str(box.bin / "lane-handoff"), "--supervise", "--lane", LANE,
-                                 "--operation", "op-test"], cwd=box.lane_dir, env=box.env,
-                                stdout=output, stderr=output, start_new_session=True)
-        try:
-            deadline = time.monotonic() + 15
-            while not probed.exists() and proc.poll() is None and time.monotonic() < deadline:
-                time.sleep(.05)
-            assert probed.exists(), output_path.read_text()
-            proc.send_signal(signal.SIGTERM)
-            release.touch()
-            assert proc.wait(timeout=15) == 143, output_path.read_text()
-            record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-            assert record["state"] == "starting"
-            assert "INDETERMINATE" in record["reason"]
-        finally:
-            release.touch()
-            try: os.killpg(proc.pid, signal.SIGTERM)
-            except ProcessLookupError: pass
-            if proc.poll() is None: proc.wait(timeout=10)
-
-
-def test_respawn_restores_configured_roots_in_new_pane(restart_box):
-    box = restart_box
-    protocol = box.root / "protocol with spaces"
-    (box.home / ".agents").rename(protocol)
-    box.env["AGENT_PROTOCOL_ROOT"] = str(protocol)
-    box.env["LANES_LANE_STATE_ROOT"] = str(box.root / "state with spaces")
-    box.env.update(LANES_HOST="fixture-host", LANES_OS="linux", LANES_CONTAINER="fixture-container")
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    real_tmux = box.fakebin / "tmux-real"
-    (box.fakebin / "tmux").rename(real_tmux)
-    pane_result = box.root / "pane-result"
-    _write(box.fakebin / "tmux", f"""#!/usr/bin/env bash
-if [ "$1" = respawn-pane ]; then
-  for arg in "$@"; do line="$arg"; done
-  env -u LANES_LANE_STATE_ROOT -u AGENT_PROTOCOL_ROOT -u LANES_HOST -u LANES_OS -u LANES_CONTAINER sh -c "$line"
-  printf '%s\n' "$?" > '{pane_result}'
-  exit 0
-fi
-exec '{real_tmux}' "$@"
-""")
-    child = _write(box.fakebin / "pclaude", """#!/usr/bin/env bash
-[ "$LANES_HOST" = fixture-host ] && [ "$LANES_OS" = linux ] && [ "$LANES_CONTAINER" = fixture-container ] || exit 66
-exit 127
-""")
-    box.env.update(PCLAUDE=str(child), CLAUDE_PROFILE_NAME="test-profile",
-                   LANE_SUPERVISOR_NO_PROMPT="1", TMUX_PANE="%1")
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert pane_result.read_text().strip() == "3", (result.stdout, result.stderr)
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == "failed" and record["attempt"] == "1"
-    assert "127" in record["reason"]
-
-
-@pytest.mark.parametrize("pane", ["", "%2"])
-def test_supervisor_refuses_unknown_or_different_pane(restart_box, pane):
-    box = restart_box
-    prepare_restart(box)
-    before = intent_path(box).read_bytes()
-    box.env["TMUX_PANE"] = pane
-    result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "pane" in result.stderr
-    assert intent_path(box).read_bytes() == before
-    assert not box.claude_runs()
-
-
-@pytest.mark.parametrize("kind", ["file", "ancestor-file", "broken-link"])
-def test_existing_invalid_state_root_is_not_absent_intent(restart_box, kind):
-    box = restart_box
-    root = Path(box.env["LANES_LANE_STATE_ROOT"])
-    if kind == "file":
-        root.write_text("not a directory\n")
-    elif kind == "ancestor-file":
-        root.write_text("not a directory\n")
-        box.env["LANES_LANE_STATE_ROOT"] = str(root / "child")
-    else:
-        root.symlink_to(box.root / "missing-target")
-    assert helper(box, "restart-intent", LANE).returncode == 1
-    box.resolver()
-    result = box.start()
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert not box.claude_runs()
-
-
-@pytest.mark.parametrize("extra", ["future_key: preserve-me\n", "garbage\n", "profile:test\n", "\n",
-                                   "schema: 1\n", "prepared_digest: none\n",
-                                   "pane: testsess:@1.%1\tignored\n"])
-def test_restart_strict_schema_preserves_unrecognized_or_malformed_records(restart_box, extra):
-    box = restart_box
-    prepare_restart(box)
-    path = intent_path(box)
-    path.write_text(path.read_text() + extra)
-    before = path.read_bytes()
-    read = helper(box, "restart-intent", LANE)
-    assert "state\tINCOMPLETE" in read.stdout, (read.stdout, read.stderr)
-    write = helper(box, "set-restart-intent", LANE, "starting", "--expect", "pending")
-    assert write.returncode == 2, write.stderr
-    assert path.read_bytes() == before
-    assert box.start("--operation", "op-test").returncode == 2
-    assert not box.claude_runs()
-
-
-@pytest.mark.parametrize("field", ["dir", "handoff", "pane", "window"])
-@pytest.mark.parametrize("control", ["\n", "\r", "\t"])
-def test_restart_writer_rejects_record_delimiters_without_changing_identity(restart_box, field, control):
-    box = restart_box
-    prepare_restart(box)
-    before = intent_path(box).read_bytes()
-    value = (str(box.lane_dir) if field in {"dir", "handoff"} else "testsess:@1.%1") + control + "tail"
-    result = helper(box, "set-restart-intent", LANE, "pending", f"--{field}", value)
-    assert result.returncode == 64, (result.stdout, result.stderr)
-    assert intent_path(box).read_bytes() == before
-
-
-def test_restart_writer_rejects_record_delimiters_all_ascii_controls(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    before = intent_path(box).read_bytes()
-    for code in [*range(1, 32), 127]:
-        result = helper(box, "set-restart-intent", LANE, "pending", "--pane",
-                        "testsess:@1.%1" + chr(code) + "tail")
-        assert result.returncode == 64, (code, result.stdout, result.stderr)
-        assert intent_path(box).read_bytes() == before
-
-
-def test_restart_writer_does_not_follow_predictable_temporary_symlink(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    sentinel = box.root / "sentinel"
-    sentinel.write_text("unrelated bytes\n")
-    result = subprocess.run(["bash", "-c", 'ln -s "$1" "$2.tmp.$$"; exec "$3" set-restart-intent "$4" starting --expect pending',
-                             "_", str(sentinel), str(intent_path(box)), str(box.bin / "lanes-edit.sh"), LANE],
-                            env=box.env, cwd=box.lane_dir, capture_output=True, text=True, timeout=30)
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert sentinel.read_text() == "unrelated bytes\n"
-    assert list(intent_path(box).parent.glob("restart-intent.yaml.tmp.*"))[0].is_symlink()
-    assert intent_path(box).stat().st_mode & 0o777 == 0o600
-
-
-@pytest.mark.parametrize("alias", ["file", "parent"])
-def test_restart_accepts_equivalent_handoff_file_identity(restart_box, alias):
-    box = restart_box
-    source = prepare_restart(box)
-    physical = source
-    if alias == "file":
-        physical = source.with_name("backing.md")
-        source.rename(physical)
-        source.symlink_to(physical.name)
-        box.git("-C", str(box.wip), "add", "--", str(source), str(physical))
-        box.git("-C", str(box.wip), "commit", "-qm", "use leaf handoff alias")
-        box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    else:
-        link = source.parent.with_name("handoff-alias")
-        link.symlink_to(source.parent, target_is_directory=True)
-        source = link / source.name
-        registry = box.wip / "lanes" / "LANES.md"
-        registry.write_text(registry.read_text().replace(str(physical.relative_to(box.wip)), str(source.relative_to(box.wip))))
-        box.git("-C", str(box.wip), "add", "--", "lanes/LANES.md", str(link))
-        box.git("-C", str(box.wip), "commit", "-qm", "use handoff directory alias")
-        box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    result = helper(box, "set-restart-intent", LANE, "pending", "--handoff", str(source.resolve()))
-    assert result.returncode == 0, result.stderr
-    first = box.start("--operation", "op-test")
-    assert first.returncode == 0, (first.stdout, first.stderr)
-    assert "Preserved task." in box.claude_runs()
-    assert "RESUMED by" in physical.read_text()
-    if alias == "file":
-        assert source.is_symlink()
-    assert helper(box, "set-restart-intent", LANE, "failed", "--expect", "starting").returncode == 0
-    assert helper(box, "set-restart-intent", LANE, "starting", "--expect", "failed", "--bump-attempt", "--new-transcript", "none").returncode == 0
-    retry = box.start("--operation", "op-test")
-    assert retry.returncode == 0, (retry.stdout, retry.stderr)
-
-
-@pytest.mark.parametrize("state", ["preparing", "pending", "starting", "failed", "ready"])
-def test_restart_reconcile_rename_preserves_unfinished_operation_inputs(restart_box, state):
-    box = restart_box
-    source = prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, state, "--expect", "pending").returncode == 0
-    if state == "ready":
-        inventory = helper(box, "set-lane-tree", LANE, str(box.lane_dir))
-        assert inventory.returncode == 0, inventory.stderr
-        trees = {p.name: p.read_bytes() for p in intent_path(box).parent.glob("trees/*.yaml")}
-        assert trees
-    tracked = [p for p in box.wip.rglob("*") if p.is_file() and ".git" not in p.parts]
-    before = {p: p.read_bytes() for p in tracked}
-    record = intent_path(box).read_bytes()
-    box.env["LANES_SESSION"] = "10101010-1111-4111-8111-111111111111"
-    result = helper(box, "rename-lane", LANE, "repoZ-2", "--no-github")
-    if state == "ready":
-        assert result.returncode == 0, (result.stdout, result.stderr)
-        assert "repoZ-2" in (box.wip / "lanes" / "LANES.md").read_text()
-    else:
-        assert result.returncode == 2, (result.stdout, result.stderr)
-        assert "supervised recovery" in result.stderr
-        assert {p: p.read_bytes() for p in tracked} == before
-        assert set(tracked) == {p for p in box.wip.rglob("*") if p.is_file() and ".git" not in p.parts}
-    assert intent_path(box).read_bytes() == record
-    if state == "ready":
-        # Completed history remains at the old name; diagnostics follow the row.
-        new_root = intent_path(box).parent.with_name("repoZ-2")
-        assert (new_root / "lane-state.yaml").is_file()
-        assert {p.name: p.read_bytes() for p in new_root.glob("trees/*.yaml")} == trees
-        assert not (intent_path(box).parent / "trees").exists()
-        assert not (intent_path(box).parent / "lane-state.yaml").exists()
-        assert helper(box, "restart-intent", "repoZ-2").returncode == 8
-        resumed = box.start("--no-launch")
-        assert resumed.returncode == 0, (resumed.stdout, resumed.stderr)
-        assert intent_path(box).read_bytes() == record
-
-
-@pytest.mark.parametrize("kind", ["relative", "missing", "none", "agent", "tab", "newline"])
-def test_restart_refuses_unsupported_checkout_or_agent_before_preservation(restart_box, kind):
-    box = restart_box
-    source = prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    before = source.read_bytes()
-    registry = (box.wip / "lanes" / "LANES.md").read_bytes()
-    box.tmux_log.write_text("")
-    args = ["--restart", "--lane", LANE]
-    if kind in {"relative", "missing"}:
-        args += ["--dir", "relative" if kind == "relative" else str(box.root / "absent")]
-    elif kind == "agent":
-        args += ["--agent", "codex"]
-    elif kind in {"tab", "newline"}:
-        unsafe = box.root / ("checkout" + ("\t" if kind == "tab" else "\n") + "tail")
-        unsafe.mkdir()
-        args += ["--dir", str(unsafe)]
-    else:
-        real = box.bin / "lanes-edit-real.sh"
-        (box.bin / "lanes-edit.sh").rename(real)
-        _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-[ "$1" != lane-dir ] || exit 8
-exec '{real}' "$@"
-""")
-        box.env.pop("WORKBENCHES_CLAUDE_LANE_DIR", None)
-        box.env.pop("CLAUDE_CODE_SESSION_ID", None)
-    result = supervisor(box, *args, "clear")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert source.read_bytes() == before
-    assert (box.wip / "lanes" / "LANES.md").read_bytes() == registry
-    assert "rename-window" not in box.tmux_log.read_text()
-    assert "respawn-pane" not in box.tmux_log.read_text()
-    if kind in {"tab", "newline"}:
-        assert "control characters" in result.stderr
-
-
-@pytest.mark.parametrize("fact", ["dir", "digest", "pane", "agent"])
-def test_restart_verifies_complete_pending_record_before_respawn(restart_box, fact):
-    box = restart_box
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    value = {"dir": "none", "digest": "none", "pane": "wrong-pane", "agent": "codex"}[fact]
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = set-restart-intent ] && [ "$3" = pending ]; then
-  '{real}' "$@" || exit $?
-  sed 's|^{fact}: .*|{fact}: {value}|' '{intent_path(box)}' > '{intent_path(box)}.fixture'
-  mv '{intent_path(box)}.fixture' '{intent_path(box)}'
-  exit 0
-fi
-exec '{real}' "$@"
-""")
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "before replacing the pane" in result.stderr
-    assert "respawn-pane" not in box.tmux_log.read_text()
-    assert not box.claude_runs()
-
-
-@pytest.mark.parametrize("finish", ["exit", "signal"])
-def test_completed_observer_cleanup_never_signals_saved_pid(restart_box, finish):
-    box = restart_box
-    prepare_restart(box)
-    shutil.copy2(REPO / "lane-handoff", box.bin / "lane-handoff")
-    signals = box.root / "positive-kill.log"
-    bash_env = _write(box.root / "bash-env", f"""kill() {{
-  case "$1" in -0) : ;; *) printf '%s\\n' "$*" >> '{signals}' ;; esac
-  builtin kill "$@"
-}}
-""", 0o600)
-    release = box.root / "release-child"
-    launcher = _write(box.fakebin / "pclaude", '''#!/usr/bin/env bash
-export CLAUDE_PROFILE_NAME=test-profile
-exec "$OPENREPOTOOLS_BIN_DIR/lane-start" repoZ 1
-''')
-    _write(box.resolved, r'''#!/usr/bin/env python3
-import json, os, pathlib, time
-sid=os.sys.argv[os.sys.argv.index('--session-id')+1]
-pid=os.getpid()
-stat=pathlib.Path(f'/proc/{pid}/stat')
-start=stat.read_text().split()[21] if stat.exists() else ''
-record=pathlib.Path(os.environ['HOME'])/'.claude'/'sessions'/'owned.json'
-record.write_text(json.dumps(dict(pid=pid,sessionId=sid,procStart=start,cwd=os.getcwd(),
-    tmux='testsess:@1.%1',name='repoZ-1',nameSource='user',status='busy'),separators=(',',':'))+'\n')
-release=pathlib.Path(os.environ['OBSERVER_TEST_RELEASE'])
-for _ in range(300):
-    if release.exists(): break
-    time.sleep(.1)
-record.unlink()
-''')
-    box.env.update(PCLAUDE=str(launcher), LANE_SUPERVISOR_NO_PROMPT="1",
-                   LANE_SUPERVISOR_READY_SECONDS="15", BASH_ENV=str(bash_env),
-                   OBSERVER_TEST_RELEASE=str(release), FAKE_CC_PATH=str(box.resolved))
-    unrelated = subprocess.Popen(["sleep", "60"])
-    proc = subprocess.Popen([str(box.bin / "lane-handoff"), "--supervise", "--lane", LANE,
-                             "--operation", "op-test"], env=box.env, cwd=box.lane_dir,
-                            stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
-    try:
-        deadline = time.monotonic() + 20
-        while time.monotonic() < deadline:
-            if "state: ready\n" in intent_path(box).read_text(): break
-            assert proc.poll() is None
-            time.sleep(.1)
-        else:
-            pytest.fail("observer never confirmed readiness")
-        # Let the observer return while the long-lived child remains alive.
-        time.sleep(.3)
-        if finish == "signal":
-            proc.send_signal(signal.SIGTERM)
-            proc.wait(timeout=10)
-            assert (box.home / ".claude" / "sessions" / "owned.json").exists()
-        release.touch()
-        out, err = proc.communicate(timeout=10)
-        assert proc.returncode == (143 if finish == "signal" else 0), (out, err)
-        assert not signals.exists(), signals.read_text() if signals.exists() else ""
-        assert unrelated.poll() is None
-        assert not list(Path(box.env["TMPDIR"]).glob("lane-observer.*"))
-    finally:
-        release.touch()
-        if proc.poll() is None:
-            proc.terminate()
-            proc.communicate(timeout=10)
-        unrelated.terminate()
-        unrelated.wait(timeout=5)
-
-
-def test_signal_between_observer_fork_and_pid_publication_reaps_owned_job(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    path = box.bin / "lane-handoff"
-    shutil.copy2(REPO / "lane-handoff", path)
-    source = path.read_text()
-    assert '\t\tsr_watch=$!' in source
-    path.write_text(source.replace('\t\tsr_watch=$!', '\t\tkill -TERM "$$"\n\t\tsr_watch=$!', 1))
-    result = subprocess.run([str(path), "--supervise", "--lane", LANE, "--operation", "op-test"],
-                            env=box.env, cwd=box.lane_dir, capture_output=True, text=True, timeout=15)
-    assert result.returncode == 143, (result.stdout, result.stderr)
-    assert not box.claude_runs()
-    assert not list(Path(box.env["TMPDIR"]).glob("lane-observer.*"))
-    assert "state: ready\n" not in intent_path(box).read_text()
-
-
-def test_new_restart_explicitly_clears_previous_operations_profile(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    # This pane has no current account profile; a historical account is not
-    # permission to select it silently for this operation.
-    box.env.pop("CLAUDE_PROFILE_NAME", None)
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == "pending"
-    assert record["profile"] == "none"
-    assert record["operation"] != "op-test"
-    assert "respawn-pane" in box.tmux_log.read_text()
-
-
-@pytest.mark.parametrize("claim", ["success", "lost"])
-def test_signal_during_claim_publication_reconciles_only_owned_attempt(restart_box, claim):
-    box = restart_box
-    prepare_restart(box)
-    before = intent_path(box).read_bytes()
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    action = f"'{real}' \"$@\"; result=$?" if claim == "success" else "result=7"
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-case "$*" in
-  *"supervisor claimed the operation"*)
-    {action}
-    kill -TERM "$PPID"
-    exit "$result" ;;
-esac
-exec '{real}' "$@"
-""")
-    result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    assert result.returncode == 143, (result.stdout, result.stderr)
-    assert not box.claude_runs()
-    if claim == "lost":
-        assert intent_path(box).read_bytes() == before
-        assert "before the restart claim" in result.stdout
-    else:
-        record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-        assert record["state"] == "failed" and record["attempt"] == "1"
-        assert record["generation"] == "7" and record["operation"] == "op-test"
-        assert "no child was launched" in record["reason"]
-        assert "retry:" in result.stdout
-
-
-def test_handoff_target_is_resolved_after_waiting_for_writer_mutex(restart_box):
-    box = restart_box
-    original = prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    other = _write(box.wip / "handoffs" / "other.md", "other preserved work\n", 0o600)
-    alias = box.wip / "handoffs" / "alias.md"
-    alias.symlink_to(original.name)
-    prepared = _write(box.root / "prepared.md", "replacement bytes\n", 0o600)
-    digest = hashlib.sha256(original.read_bytes()).hexdigest()
-    before = (original.read_bytes(), other.read_bytes())
-    lock = box.wip / "lanes" / ".lanes-edit.lock"
-    lock.mkdir()
-    (lock / "pid").write_text(str(os.getpid()) + "\n")
-    marker = box.root / "waiting-for-writer"
-    real_mkdir = shutil.which("mkdir")
-    _write(box.fakebin / "mkdir", f"""#!/usr/bin/env bash
-case "$*" in *.lanes-edit.lock*) touch '{marker}' ;; esac
-exec '{real_mkdir}' "$@"
-""")
-    proc = subprocess.Popen([str(box.bin / "lanes-edit.sh"), "publish-handoff", LANE,
-                             str(alias), str(prepared), "--expect-digest", digest],
-                            env=box.env, cwd=box.lane_dir, stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE, text=True)
-    try:
-        deadline = time.monotonic() + 10
-        while not marker.exists() and time.monotonic() < deadline:
-            assert proc.poll() is None
-            time.sleep(.02)
-        assert marker.exists()
-        alias.unlink()
-        alias.symlink_to(other.name)
-        (lock / "pid").unlink()
-        lock.rmdir()
-        out, err = proc.communicate(timeout=15)
-        assert proc.returncode == 7, (out, err)
-        assert "changed before publication" in err
-        assert (original.read_bytes(), other.read_bytes()) == before
-        assert alias.is_symlink() and alias.resolve() == other
-    finally:
-        if lock.exists():
-            (lock / "pid").unlink(missing_ok=True)
-            lock.rmdir()
-        if proc.poll() is None:
-            proc.terminate()
-            proc.communicate(timeout=5)
-
-
-@pytest.mark.parametrize("kind", ["non-executable", "directory", "broken-link"])
-def test_existing_unusable_managed_reader_is_not_confirmed_absence(restart_box, kind):
-    box = restart_box
-    reader = box.bin / "lane-managed"
-    if kind == "non-executable": _write(reader, "#!/bin/sh\nexit 8\n", 0o600)
-    elif kind == "directory": reader.mkdir()
-    else: reader.symlink_to(box.root / "missing-reader")
-    result = helper(box, "legacy-restart-check", LANE)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "reader is unusable" in result.stderr
-    assert not intent_path(box).exists()
-
-
-@pytest.mark.parametrize("target", ["bound", "different"])
-def test_operation_publication_requires_its_bound_handoff(restart_box, target):
-    box = restart_box
-    bound = prepare_restart(box)
-    other = _write(box.wip / "handoffs" / "different.md", bound.read_text(), 0o600)
-    prepared = _write(box.root / "prepared.md", "preserved replacement\n", 0o600)
-    before = (bound.read_bytes(), other.read_bytes())
-    chosen = bound if target == "bound" else other
-    digest = hashlib.sha256(chosen.read_bytes()).hexdigest()
-    result = helper(box, "publish-handoff", LANE, str(chosen), str(prepared),
-                    "--expect-digest", digest, "--operation", "op-test", "--generation", "7",
-                    "--attempt", "0", "--state", "pending", "--transcript", "none")
-    assert result.returncode == (0 if target == "bound" else 2), (result.stdout, result.stderr)
-    if target == "different":
-        assert "operation-bound handoff" in result.stderr
-        assert (bound.read_bytes(), other.read_bytes()) == before
-    else:
-        assert bound.read_bytes() == prepared.read_bytes()
-        assert other.read_bytes() == before[1]
-
-
-@pytest.mark.parametrize("marker", ["published", "malformed", "local-only"])
-@pytest.mark.parametrize("entry", ["check", "supervise", "start", "restart", "intent", "publish"])
-def test_restart_reconcile_managed_projection_refuses_every_writer(restart_box, marker, entry):
-    box = restart_box
-    source = prepare_restart(box)
-    # A managed service claiming absence cannot overrule the register projection.
-    _write(box.bin / "lane-managed", "#!/usr/bin/env bash\nexit 8\n")
-    registry = box.wip / "lanes" / "LANES.md"
-    lines = registry.read_text().splitlines()
-    row = next(i for i, line in enumerate(lines) if line.startswith(f"| `{LANE}`"))
-    cells = lines[row].split("|")
-    generation = "0" if marker == "malformed" else "4"
-    cells[7] = (f" LIVE · 2026-10-05T00:00:00Z · managed-owner mode=managed "
-                f"daemon=ledger-test generation={generation} bound-lane={LANE} ")
-    lines[row] = "|".join(cells)
-    registry.write_text("\n".join(lines) + "\n")
-    if marker != "local-only":
-        box.git("-C", str(box.wip), "add", "--", "lanes/LANES.md")
-        box.git("-C", str(box.wip), "commit", "-qm", "publish managed projection")
-        box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    prepared = _write(box.root / "prepared.md", "# Changed handoff\n", 0o600)
-    roots = [box.wip, Path(box.env["LANES_LANE_STATE_ROOT"]), box.home / ".claude"]
-
-    def snapshot():
-        files = {str(path): path.read_bytes() for root in roots for path in root.rglob("*")
-                 if path.is_file() and ".git" not in path.parts}
-        return (files, box.git("-C", str(box.wip), "rev-parse", "HEAD"),
-                box.git("--git-dir", str(box.origin), "rev-parse", "main"),
-                box.git("-C", str(box.wip), "status", "--porcelain"),
-                box.tmux_log.read_bytes(), box.claude_log.read_bytes())
-
-    before = snapshot()
-    if entry == "check":
-        result = helper(box, "legacy-restart-check", LANE)
-    elif entry == "supervise":
-        result = supervisor(box, "--supervise", "--lane", LANE, "--operation", "op-test")
-    elif entry == "start":
-        result = box.start("--operation", "op-test")
-    elif entry == "restart":
-        result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    elif entry == "intent":
-        result = helper(box, "set-restart-intent", LANE, "starting", "--expect", "pending")
-    else:
-        result = helper(box, "publish-handoff", LANE, str(source), str(prepared),
-                        "--expect-digest", hashlib.sha256(source.read_bytes()).hexdigest(),
-                        "--operation", "op-test", "--generation", "7", "--attempt", "0",
-                        "--state", "pending", "--transcript", "none")
-    assert result.returncode != 0, (result.stdout, result.stderr)
-    assert "managed" in result.stderr.lower() or "UNKNOWN" in result.stderr
-    assert snapshot() == before
-
-
-def test_restart_reconcile_state_stores_and_counters_are_independent(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    diagnostic = intent_path(box).with_name("lane-state.yaml")
-    before_diagnostic = diagnostic.read_bytes()
-    for state, previous in [("starting", "pending"), ("failed", "starting")]:
-        result = helper(box, "set-restart-intent", LANE, state, "--expect", previous,
-                        "--expect-operation", "op-test", "--expect-generation", "7")
-        assert result.returncode == 0, result.stderr
-        assert diagnostic.read_bytes() == before_diagnostic
-    before_restart = intent_path(box).read_bytes()
-    result = helper(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING",
-                    "--operation", "diagnostic-only")
-    assert result.returncode == 0, result.stderr
-    assert intent_path(box).read_bytes() == before_restart
-    restart = helper(box, "restart-intent", LANE)
-    assert "operation\top-test" in restart.stdout
-    assert "generation\t7" in restart.stdout
-    lifecycle = helper(box, "lane-state", LANE)
-    assert "operation\tdiagnostic-only" in lifecycle.stdout
-    assert "generation\t7" not in lifecycle.stdout
-
-
-@pytest.mark.parametrize("unknown", ["diagnostic", "restart"])
-def test_restart_reconcile_unknown_schema_is_confined_to_its_store(restart_box, unknown):
-    box = restart_box
-    prepare_restart(box)
-    diagnostic = intent_path(box).with_name("lane-state.yaml")
-    affected = diagnostic if unknown == "diagnostic" else intent_path(box)
-    affected.write_text(affected.read_text().replace("schema: 1", "schema: 99", 1))
-    preserved = affected.read_bytes()
-    if unknown == "diagnostic":
-        result = helper(box, "set-restart-intent", LANE, "starting", "--expect", "pending")
-        assert result.returncode == 0, result.stderr
-        assert "state\tstarting" in helper(box, "restart-intent", LANE).stdout
-        assert helper(box, "set-lane-state", LANE, "SWAPPING").returncode == 1
-    else:
-        result = helper(box, "set-lane-state", LANE, "SWAPPING", "--expect", "RUNNING")
-        assert result.returncode == 0, result.stderr
-        assert "state\tSWAPPING" in helper(box, "lane-state", LANE).stdout
-        assert helper(box, "set-restart-intent", LANE, "starting").returncode == 2
-    assert affected.read_bytes() == preserved
-
-
-def test_restart_reconcile_case_only_rename_preserves_completed_history(restart_box):
-    box = restart_box
-    prepare_restart(box)
-    assert helper(box, "set-restart-intent", LANE, "ready", "--expect", "pending").returncode == 0
-    roots = [box.wip, intent_path(box).parent]
-    before = {str(p): p.read_bytes() for root in roots for p in root.rglob("*")
-              if p.is_file() and ".git" not in p.parts}
-    commit = box.git("-C", str(box.wip), "rev-parse", "HEAD")
-    box.env["LANES_SESSION"] = "10101010-1111-4111-8111-111111111111"
-    result = helper(box, "rename-lane", LANE, LANE.lower(), "--no-github")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "SPELLING" in result.stderr
-    assert {str(p): p.read_bytes() for root in roots for p in root.rglob("*")
-            if p.is_file() and ".git" not in p.parts} == before
-    assert box.git("-C", str(box.wip), "rev-parse", "HEAD") == commit
-    assert "state\tready" in helper(box, "restart-intent", LANE).stdout
-
-
-def restart_root_without_recorded_checkout(box):
-    source = prepare_restart(box)
-    box.restart_root_seed = intent_path(box).read_bytes()
-    intent_path(box).unlink()
-    old_dir = box.lane_dir
-    log = box.wip / "lanes" / "log" / f"{LANE}.md"
-    log.write_text(log.read_text().replace(f"; dir {old_dir}", ""))
-    box.git("-C", str(box.wip), "add", "--", str(log))
-    box.git("-C", str(box.wip), "commit", "-qm", "legacy record without checkout")
-    box.git("-C", str(box.wip), "push", "-q", "origin", "main")
-    box.env.pop("LANES_LANE_STATE_ROOT")
-    box.env["PROJECTS_ROOT"] = str(old_dir.parent)
-    nested = old_dir.parent / "nested" / "repoZ"
-    nested.mkdir(parents=True)
-    box.git("init", "-q", "-b", "main", str(nested))
-    box.git("-C", str(nested), "remote", "add", "origin", "https://github.com/opensoft/repoZ.git")
-    box.lane_dir = nested
-    assert helper(box, "lane-dir", LANE).returncode == 8
-    fallback = old_dir.parent / ".lane-state" / LANE / "restart-intent.yaml"
-    alternate = nested.parent / ".lane-state" / LANE / "restart-intent.yaml"
-    return source, fallback, alternate
-
-
-def record_nested_restart_checkout(box):
-    prior = box.env
-    session = helper(box, "last-session", LANE).stdout.strip()
-    box.env = dict(prior, LANES_LANE=LANE, LANES_SESSION=session)
-    try:
-        result = helper(box, "log", "PAUSED", f"lane:{LANE}", "→", f"swap; dir {box.lane_dir}", "fixture")
-    finally:
-        box.env = prior
-    assert result.returncode == 0, (result.stdout, result.stderr)
-
-
-def test_restart_root_retains_reservation_after_nested_checkout_preservation(restart_box):
-    box = restart_box
-    source, fallback, alternate = restart_root_without_recorded_checkout(box)
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    assert "respawn-pane" in box.tmux_log.read_text()
-    assert not alternate.exists()
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["state"] == "pending" and record["file"] == str(fallback)
-    assert record["dir"] == str(box.lane_dir) and record["handoff"] == str(source)
-    status = supervisor(box, "--restart-status", "--lane", LANE)
-    assert status.returncode == 0 and "intent      pending" in status.stdout
-    before = fallback.read_bytes()
-    result = box.start("--dir", str(box.lane_dir))
-    assert result.returncode == 2 and "supervisor operation token" in result.stderr
-    assert fallback.read_bytes() == before and not box.claude_runs()
-
-
-def test_restart_root_cleanup_after_paused_fails_original_reservation(restart_box):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    real = box.bin / "lanes-edit-real.sh"
-    (box.bin / "lanes-edit.sh").rename(real)
-    _write(box.bin / "lanes-edit.sh", f"""#!/usr/bin/env bash
-if [ "$1" = set-restart-intent ] && [ "$3" = pending ]; then exit 1; fi
-exec '{real}' "$@"
-""")
-    result = supervisor(box, "--restart", "--lane", LANE, "--dir", str(box.lane_dir), "clear")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "PAUSED" in box.lane_log() and "respawn-pane" not in box.tmux_log.read_text()
-    assert not alternate.exists()
-    record = dict(line.split("\t", 1) for line in helper(box, "restart-intent", LANE).stdout.splitlines())
-    assert record["file"] == str(fallback) and record["state"] == "failed"
-    assert record["mode"] == "preservation-only" and record["attempt"] == "0"
-
-
-@pytest.mark.parametrize("entry", ["read", "write", "start", "rename"])
-def test_restart_root_conflicts_refuse_without_changing_either_intent(restart_box, entry):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    assert helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "held").returncode == 0
-    record_nested_restart_checkout(box)
-    alternate.parent.mkdir(parents=True, exist_ok=True)
-    alternate.write_bytes(fallback.read_bytes())  # identical bytes are separate authority
-    before = {p: p.read_bytes() for p in [fallback, alternate, box.wip / "lanes" / "LANES.md"]}
-    box.resolver()
-    if entry == "read":
-        result = helper(box, "restart-intent", LANE)
-    elif entry == "write":
-        result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "preparing")
-    elif entry == "rename":
-        result = helper(box, "rename-lane", LANE, "repoZ-2")
-    else:
-        result = box.start("--dir", str(box.lane_dir))
-    assert result.returncode != 0, (result.stdout, result.stderr)
-    assert all(p.read_bytes() == contents for p, contents in before.items())
-    assert not box.claude_runs() and "respawn-pane" not in box.tmux_log.read_text()
-
-
-@pytest.mark.parametrize("alias", ["lane-root", "state-root"])
-def test_restart_root_directory_aliases_preserve_one_authority_across_replacement(restart_box, alias):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    assert helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "held").returncode == 0
-    record_nested_restart_checkout(box)
-    target = alternate.parent if alias == "lane-root" else alternate.parent.parent
-    # Move any independent diagnostic snapshot aside in this fixture before
-    # making the alias. Restart selection must not mutate diagnostic files.
-    if target.exists():
-        target.rename(box.root / "pre-alias-diagnostics")
-    target.parent.mkdir(parents=True, exist_ok=True)
-    target.symlink_to(fallback.parent if alias == "lane-root" else fallback.parent.parent, target_is_directory=True)
-    result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "preparing", "--expect-operation", "held")
-    assert result.returncode == 0, (result.stdout, result.stderr)
-    record = helper(box, "restart-intent", LANE)
-    assert record.returncode == 0 and "operation\theld" in record.stdout
-    assert "state\tfailed" in record.stdout
-    assert alternate.resolve() == fallback.resolve()
-    assert alternate.read_bytes() == fallback.read_bytes()
-
-
-@pytest.mark.parametrize("alias", ["symlink", "hardlink"])
-def test_restart_root_distinct_file_aliases_refuse_before_atomic_replacement(restart_box, alias):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    assert helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "held").returncode == 0
-    record_nested_restart_checkout(box)
-    alternate.parent.mkdir(parents=True, exist_ok=True)
-    if alias == "symlink":
-        alternate.symlink_to(fallback)
-    else:
-        os.link(fallback, alternate)
-    before = fallback.read_bytes()
-    assert helper(box, "restart-intent", LANE).returncode == 1
-    result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "preparing")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert alternate.read_bytes() == fallback.read_bytes() == before
-
-
-@pytest.mark.parametrize("kind", ["malformed", "directory", "broken-link", "unusable-parent"])
-def test_restart_root_does_not_hide_unusable_fallback_after_checkout_is_recorded(restart_box, kind):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    fallback.parent.mkdir(parents=True, exist_ok=True)
-    if kind == "malformed":
-        fallback.write_text("schema: 1\nstate: pending\n")
-    elif kind == "directory":
-        fallback.mkdir()
-    elif kind == "broken-link":
-        fallback.symlink_to(box.root / "missing-intent")
-    else:
-        fallback.parent.rmdir()
-        fallback.parent.write_text("not a directory\n")
-    record_nested_restart_checkout(box)
-    read = helper(box, "restart-intent", LANE)
-    assert read.returncode != 8, (read.stdout, read.stderr)
-    if kind == "malformed":
-        assert read.returncode == 0 and "INCOMPLETE" in read.stdout
-    else:
-        assert read.returncode == 1, (read.stdout, read.stderr)
-    result = helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "other")
-    assert result.returncode != 0, (result.stdout, result.stderr)
-    assert not alternate.exists()
-
-
-def test_restart_root_waiting_writer_discovers_new_authority_under_mutex(restart_box):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    record_nested_restart_checkout(box)
-    lock = box.wip / "lanes" / ".lanes-edit.lock"
-    lock.mkdir()
-    (lock / "pid").write_text(str(os.getpid()))
-    waited = box.root / "writer.waited"
-    sleep = shutil.which("sleep")
-    _write(box.fakebin / "sleep", f"""#!/usr/bin/env bash
-: > '{waited}'
-exec '{sleep}' "$@"
-""")
-    process = subprocess.Popen([str(box.bin / "lanes-edit.sh"), "set-restart-intent", LANE,
-                                "preparing", "--expect", "none", "--operation", "waiting"],
-                               cwd=box.lane_dir, env=box.env, text=True,
-                               stdout=subprocess.PIPE, stderr=subprocess.PIPE)
-    try:
-        deadline = time.monotonic() + 15
-        while not waited.exists() and process.poll() is None and time.monotonic() < deadline:
-            time.sleep(.05)
-        assert waited.exists()
-        # Another writer establishes a valid fallback before this waiter owns
-        # the mutex. It must discover that authority instead of creating nested.
-        fallback.parent.mkdir(parents=True, exist_ok=True)
-        fallback.write_bytes(box.restart_root_seed)
-        before = fallback.read_bytes()
-        lock.joinpath("pid").unlink()
-        lock.rmdir()
-        out = process.communicate(timeout=15)
-        assert process.returncode == 7, out
-        assert fallback.read_bytes() == before and not alternate.exists()
-    finally:
-        if lock.exists():
-            lock.joinpath("pid").unlink(missing_ok=True)
-            lock.rmdir()
-        if process.poll() is None:
-            process.terminate()
-            process.communicate(timeout=10)
-
-
-@pytest.mark.parametrize("kind", ["file", "broken-link"])
-def test_restart_root_unusable_configured_parent_cannot_disappear_from_selection(restart_box, kind):
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    record_nested_restart_checkout(box)
-    bad = box.root / "unusable-projects"
-    if kind == "file":
-        bad.write_text("not a directory\n")
-    else:
-        bad.symlink_to(box.root / "missing-projects")
-    box.env["PROJECTS_ROOT"] = str(bad)
-    assert helper(box, "restart-intent", LANE).returncode == 1
-    result = helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "other")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert not alternate.exists() and not fallback.exists()
-
-
-@pytest.mark.parametrize("candidate", ["recorded", "projects"])
-def test_restart_root_unsearchable_parent_ancestry_is_unknown_not_absent(restart_box, candidate):
-    if os.geteuid() == 0:
-        pytest.skip("permission regression requires an unprivileged runner")
-    box = restart_box
-    _, fallback, alternate = restart_root_without_recorded_checkout(box)
-    assert helper(box, "set-restart-intent", LANE, "preparing", "--expect", "none", "--operation", "held").returncode == 0
-    record_nested_restart_checkout(box)
-    before = fallback.read_bytes()
-    if candidate == "recorded":
-        blocked = box.lane_dir.parent
-        box.lane_dir = Path(box.env["PROJECTS_ROOT"]) / "repoZ"  # accessible caller cwd
-    else:
-        blocked = box.root / "blocked"
-        root = blocked / "projects"
-        root.mkdir(parents=True)
-        box.env["PROJECTS_ROOT"] = str(root)
-    blocked.chmod(0)
-    try:
-        assert helper(box, "restart-intent", LANE).returncode == 1
-        result = helper(box, "set-restart-intent", LANE, "failed", "--expect", "preparing")
-        assert result.returncode == 1, (result.stdout, result.stderr)
-    finally:
-        blocked.chmod(0o755)
-    assert fallback.read_bytes() == before and not alternate.exists()
diff --git a/tests/test_test_roots.py b/tests/test_test_roots.py
deleted file mode 100644
index f9c0dca9..00000000
--- a/tests/test_test_roots.py
+++ /dev/null
@@ -1,1151 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""THE FOUR ROOTS AND THE TWO MODES, held (opensoft/openRepoTools#186, T009 of
-`specs/004-migrate-to-triad/tasks.md`).
-
-`tests/conftest.py` resolves a CODE root (the commands, `tests/`, the pin), an
-ASSEMBLY root (`README.md`, `AGENTS.md`, `CLAUDE.md`, the leg pins), a SPEC root
-(`docs/`, `openspec/`, `specs/`) and the DEPENDENCY nested in the code root
-(`upstream/openRepoShape`) — from `OPENREPOTOOLS_CODE_ROOT`,
-`OPENREPOTOOLS_ASSEMBLY_ROOT` and `OPENREPOTOOLS_SPEC_ROOT` where they are set,
-from the layout where they are not. `OPENREPOTOOLS_COMPOSED=1` makes the run a
-claim about the whole arrangement: every root present, each leg at the commit
-the assembly pins, and nothing skipped for want of one.
-
-TWO KINDS OF TEST HERE. The resolver is asked directly about fixture layouts
-built under `tmp_path` — today's single tree, a triad, a standalone code leg —
-which is fast and runs everywhere. And because a resolver nobody calls proves
-nothing about the suite, the SUITE ITSELF is run against those fixtures, in a
-nested `pytest` with the variables set: the hygiene module must read the
-README from the fixture's assembly root and the lane manual from its spec
-root, the pin module must read the fixture code root's own gitlink, the
-no-submodule skip must still be today's skip, and a composed run missing a
-context must refuse rather than start. Those nested runs are what was red at
-`origin/main`, where every one of those variables was ignored.
-
-NOTHING HERE TOUCHES A REAL REPOSITORY'S STATE. Every fixture is a copy or a
-fresh `git init` under `tmp_path`; the real code root and its dependency are
-only READ (a `git ls-files`, a local `git clone`). Every fixture's legs are
-pinned with the tree digest recomputed from the fixture's own tree, never
-written in to agree.
-"""
-
-from __future__ import annotations
-
-import hashlib
-import os
-import re
-import shutil
-import subprocess
-import sys
-import xml.etree.ElementTree as ET
-from pathlib import Path
-
-import pytest
-
-import conftest
-from conftest import NEEDS_UPSTREAM, REPO, WINDOWS_SKIP
-
-TESTS = Path(__file__).resolve().parent
-DEPENDENCY = REPO / "upstream" / "openRepoShape"
-WRAPPER = REPO / "tests" / "run.sh"
-
-#: What a code leg does NOT carry after the split, by the adoption mapping's
-#: placement table: the root files went to the assembly and the four trees to
-#: the spec leg. A fixture code leg is the code root less these. EXCEPT
-#: `.gitattributes`, which the table also sends to the assembly and which the
-#: code leg must carry too — git never applies the assembly's inside a
-#: submodule (conftest's `GUIDANCE_DOCUMENTS` note) — so a fixture leg keeps
-#: it, as the leg is meant to be (Copilot on #190). `LICENSE` and `.gitignore`
-#: likewise: T006's `code-0001` gives the code leg its own copy of each, so a
-#: fixture leg keeps them too (#193 item 7).
-ASSEMBLY_FILES = ("README.md", "AGENTS.md", "CLAUDE.md")
-SPEC_TREES = ("docs", "openspec", "specs", "ideation")
-
-INSTALL_LINE = (
-    "curl -fsSL https://raw.githubusercontent.com/opensoft/openRepoTools/main/"
-    "openRepoTools | bash -s -- --install")
-FORK_ACT = "lane-end <lane> --retire <pid|uuid>"
-
-#: The rehearsed assembly's `contracts/code-pin.yaml` grammar
-#: (`adopt/three-repo-shape` at 2726d3a), field for field.
-LEG_PIN = """\
-schema_version: 1
-kind: pinned_contract_manifest
-
-leg_role: {role}
-source_repository: example/fixture-{role}
-submodule_path: {role}
-
-commit: "{commit}"
-revision_kind: commit
-
-digest_algorithm: sha256
-digest_definition: sorted-ls-tree-r-v1
-digests:
-  tree_sha256: "{digest}"
-
-verify_pin: scripts/validate-pins.py
-resync_runbook: "README.md#the-lockstep-invariant"
-"""
-
-PROJECT_YAML = """\
-schema_version: 1
-kind: project-manifest
-id: fixture
-name: "fixture"
-legs:
-  - role: assembly
-    repository: example/fixture
-    path: "."
-  - role: spec
-    repository: example/fixture-spec
-    path: spec
-  - role: code
-    repository: example/fixture-code
-    path: code
-"""
-
-#: Git in a fixture: an identity of its own. The one clone of the dependency
-#: is a local-path clone, which needs no `protocol.file.allow` (#193 item 7).
-GIT_ENV = {"GIT_AUTHOR_NAME": "openRepoTools CI",
-           "GIT_AUTHOR_EMAIL": "ci@openrepotools.invalid",
-           "GIT_COMMITTER_NAME": "openRepoTools CI",
-           "GIT_COMMITTER_EMAIL": "ci@openrepotools.invalid"}
-
-
-def run_git(cwd: Path, *args: str) -> str:
-    env = dict(os.environ)
-    env.update(GIT_ENV)
-    proc = subprocess.run(["git", *args], cwd=str(cwd), capture_output=True,
-                          text=True, env=env, check=False)
-    assert proc.returncode == 0, (f"git {' '.join(args)} in {cwd}:\n"
-                                  f"{proc.stderr}{proc.stdout}")
-    return proc.stdout.strip()
-
-
-def tree_sha256(repository: Path, commit: str) -> str:
-    """`sorted-ls-tree-r-v1`, exactly as the pin grammar defines it."""
-    out = subprocess.run(["git", "ls-tree", "-r", "-z", commit],
-                         cwd=str(repository), capture_output=True,
-                         check=True).stdout
-    records = sorted(record for record in out.split(b"\0") if record)
-    return hashlib.sha256(b"".join(r + b"\n" for r in records)).hexdigest()
-
-
-def pinned_commit() -> str:
-    for line in (REPO / "contracts" / "openreposhape-pin.yaml").read_text(
-            encoding="utf-8").splitlines():
-        if line.startswith("commit:"):
-            return line.split(":", 1)[1].strip().strip('"')
-    raise AssertionError("the dependency pin records no commit")
-
-
-def dependency_present() -> bool:
-    return (DEPENDENCY / "scripts" / "repo_shape.py").is_file()
-
-
-# --- fixture layouts ----------------------------------------------------------
-
-def code_leg(dest: Path, *, single: bool = False, repository: bool = False,
-             gitlink: str = "", dependency: str = "") -> Path:
-    """A copy of the code root's tracked files at `dest`.
-
-    `single` keeps the assembly's files and the spec trees (today's layout);
-    otherwise they are left out, as the split leaves them. `repository` makes
-    it a repository of its own with one commit, recording `gitlink` (default:
-    the pinned commit) at `upstream/openRepoShape`. `dependency` is "" for no
-    directory there, "empty" for the empty one a clone without
-    `--recurse-submodules` leaves, or "clone" for a checkout of the real
-    dependency at the pinned commit.
-    """
-    listed = run_git(REPO, "ls-files", "-z").split("\0")
-    for rel in filter(None, listed):
-        top = rel.split("/", 1)[0]
-        if not single and (rel in ASSEMBLY_FILES or top in SPEC_TREES):
-            continue
-        source = REPO / rel
-        if not source.is_file():
-            continue          # the dependency's gitlink, which is not a file
-        target = dest / rel
-        target.parent.mkdir(parents=True, exist_ok=True)
-        shutil.copy2(source, target)
-    if single:
-        # TODAY'S TREE EVEN WHERE THIS RUN IS A CODE LEG (the composed job):
-        # the documents and the spec trees a single repository carries.
-        for rel, text in (("README.md", f"# fixture\n\n    {INSTALL_LINE}\n"),
-                          ("AGENTS.md", "# fixture\n"),
-                          ("docs/README-lanes.md", f"# Lanes\n\n{FORK_ACT}\n"),
-                          ("openspec/README.md", "# fixture spec\n")):
-            target = dest / rel
-            if not target.exists():
-                target.parent.mkdir(parents=True, exist_ok=True)
-                target.write_text(text, encoding="utf-8")
-    if repository:
-        run_git(dest, "init", "-q")
-        run_git(dest, "add", "-A")
-        run_git(dest, "update-index", "--add", "--cacheinfo",
-                f"160000,{gitlink or pinned_commit()},upstream/openRepoShape")
-        run_git(dest, "commit", "-q", "-m", "the code leg, copied for a fixture")
-    if dependency == "empty":
-        (dest / "upstream" / "openRepoShape").mkdir(parents=True, exist_ok=True)
-    elif dependency == "clone":
-        target = dest / "upstream" / "openRepoShape"
-        if target.exists():
-            target.rmdir()
-        run_git(dest, "clone", "-q", "--no-checkout", str(DEPENDENCY), str(target))
-        run_git(target, "checkout", "-q", "--detach", pinned_commit())
-    return dest
-
-
-def spec_leg(dest: Path, *, manual: str = f"# Lanes\n\n{FORK_ACT}\n",
-             repository: bool = False) -> Path:
-    (dest / "docs").mkdir(parents=True)
-    (dest / "docs" / "README-lanes.md").write_text(manual, encoding="utf-8")
-    (dest / "openspec").mkdir()
-    (dest / "openspec" / "README.md").write_text("# fixture spec\n",
-                                                 encoding="utf-8")
-    if repository:
-        run_git(dest, "init", "-q")
-        run_git(dest, "add", "-A")
-        run_git(dest, "commit", "-q", "-m", "the spec leg, for a fixture")
-    return dest
-
-
-def assembly(dest: Path, *, readme: str = f"# fixture\n\n    {INSTALL_LINE}\n",
-             code: Path | None = None, spec: Path | None = None,
-             repository: bool = False) -> Path:
-    """An assembly root at `dest`: the manifest, the two leg pins and a
-    README. With `repository`, a repository of its own whose HEAD records
-    `code` and `spec` as gitlinks at each one's own HEAD, the pins recording
-    the same commits and each leg's recomputed tree digest."""
-    (dest / "contracts").mkdir(parents=True, exist_ok=True)
-    (dest / "project.yaml").write_text(PROJECT_YAML, encoding="utf-8")
-    (dest / "README.md").write_text(readme, encoding="utf-8")
-    heads = {}
-    for role, leg in (("code", code), ("spec", spec)):
-        head = run_git(leg, "rev-parse", "HEAD") if (leg and repository) else "0" * 40
-        digest = tree_sha256(leg, head) if (leg and repository) else "0" * 64
-        heads[role] = head
-        (dest / "contracts" / f"{role}-pin.yaml").write_text(
-            LEG_PIN.format(role=role, commit=head, digest=digest),
-            encoding="utf-8")
-    if repository:
-        run_git(dest, "init", "-q")
-        run_git(dest, "add", "--", "project.yaml", "README.md", "contracts")
-        for role in ("code", "spec"):
-            run_git(dest, "update-index", "--add", "--cacheinfo",
-                    f"160000,{heads[role]},{role}")
-        run_git(dest, "commit", "-q", "-m", "the assembly, for a fixture")
-    return dest
-
-
-# --- the suite, run nested against a fixture ----------------------------------
-
-class Nested:
-    def __init__(self, proc: subprocess.CompletedProcess, outcomes: dict):
-        self.returncode = proc.returncode
-        self.output = proc.stdout + proc.stderr
-        self.outcomes = outcomes
-
-    def outcome(self, name: str) -> tuple:
-        assert name in self.outcomes, (
-            f"{name} did not run; the nested run said:\n{self.output[-3000:]}")
-        return self.outcomes[name]
-
-
-_nested_runs = [0]
-
-
-def nested(tmp_path: Path, env: dict, select: str, *modules: str) -> Nested:
-    """`python -m pytest` on this suite's own `modules`, `-k select`, with
-    `env` as the ONLY `OPENREPOTOOLS_*` variables: a run that read anything
-    from the outer run's roots would prove nothing about these."""
-    _nested_runs[0] += 1
-    n = _nested_runs[0]
-    junit = tmp_path / f"nested-{n}.xml"
-    child = {k: v for k, v in os.environ.items()
-             if not k.startswith("OPENREPOTOOLS_") and k != "PYTEST_ADDOPTS"}
-    child.update(GIT_ENV)
-    child.update(env)
-    child["PYTHONDONTWRITEBYTECODE"] = "1"
-    command = [sys.executable, "-m", "pytest", "-q", "-p", "no:cacheprovider",
-               "-rA", f"--junitxml={junit}",
-               f"--basetemp={tmp_path / f'nested-{n}-tmp'}", "-k", select,
-               *(str(TESTS / module) for module in modules)]
-    proc = subprocess.run(command, cwd=str(tmp_path), env=child,
-                          capture_output=True, text=True, timeout=900,
-                          check=False)
-    outcomes = {}
-    if junit.is_file():
-        for case in ET.parse(str(junit)).getroot().iter("testcase"):
-            outcome, message = "passed", ""
-            for kind in ("failure", "error", "skipped"):
-                found = case.find(kind)
-                if found is not None:
-                    outcome = kind
-                    message = (found.get("message") or "") + (found.text or "")
-                    break
-            outcomes[case.get("name")] = (outcome, message)
-    return Nested(proc, outcomes)
-
-
-README_TEST = "test_the_readme_prints_the_install_line_the_pointer_prints"
-MANUAL_TEST = "test_the_manual_offers_the_fork_act_and_not_a_kill"
-LOCKSTEP_TEST = "test_the_gitlink_and_the_pin_name_the_same_commit"
-DIGEST_TEST = "test_the_tree_digest_is_the_pinned_commits_own_number"
-HEAD_TEST = "test_the_checked_out_submodule_is_at_the_recorded_commit"
-
-
-def test_the_hygiene_suite_reads_the_readme_from_the_assembly_root(tmp_path):
-    """`OPENREPOTOOLS_ASSEMBLY_ROOT` decides which README the install-line
-    test reads: one that lacks the line FAILS it, one that carries it passes.
-    Red at `origin/main`, which read this checkout's own README either way."""
-    lacking = assembly(tmp_path / "lacking", readme="# no install line here\n")
-    carrying = assembly(tmp_path / "carrying")
-    red = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(lacking)},
-                 README_TEST, "test_repo_hygiene.py")
-    outcome, message = red.outcome(README_TEST)
-    assert outcome == "failure" and "does not carry the install line" in message, (
-        f"the README test {outcome} against an assembly README with no install "
-        f"line; it did not read the assembly root:\n{message}\n{red.output[-2000:]}")
-    green = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(carrying)},
-                   README_TEST, "test_repo_hygiene.py")
-    assert green.outcome(README_TEST)[0] == "passed", green.output[-3000:]
-
-
-def test_the_hygiene_suite_reads_the_lane_manual_from_the_spec_root(tmp_path):
-    """`OPENREPOTOOLS_SPEC_ROOT` decides which `docs/README-lanes.md` is read:
-    a manual that never spells the fork act FAILS the manual test."""
-    lacking = spec_leg(tmp_path / "lacking", manual="# Lanes\n\nnothing here\n")
-    carrying = spec_leg(tmp_path / "carrying")
-    red = nested(tmp_path, {"OPENREPOTOOLS_SPEC_ROOT": str(lacking)},
-                 MANUAL_TEST, "test_repo_hygiene.py")
-    outcome, message = red.outcome(MANUAL_TEST)
-    assert outcome == "failure" and "never spells the one fork act" in message, (
-        f"the manual test {outcome} against a spec root whose manual lacks the "
-        f"act; it did not read the spec root:\n{message}\n{red.output[-2000:]}")
-    green = nested(tmp_path, {"OPENREPOTOOLS_SPEC_ROOT": str(carrying)},
-                   MANUAL_TEST, "test_repo_hygiene.py")
-    assert green.outcome(MANUAL_TEST)[0] == "passed", green.output[-3000:]
-
-
-AGENTS_CAP_TEST = "test_agents_md_is_short_enough_to_be_read"
-README_CAP_TEST = "test_readme_is_short_enough_to_be_read"
-
-
-PIN_RULES_TEST = "test_agents_md_names_the_pin_rules"
-
-
-@pytest.mark.parametrize("prefixed, outcome", [
-    pytest.param(True, "passed", id="the-assemblys-code-prefixed-rules"),
-    pytest.param(False, "failure", id="todays-spelling-at-an-assembly-root"),
-])
-def test_the_pin_rules_are_read_with_the_assemblys_code_prefix(tmp_path, prefixed, outcome):
-    """At an assembly root the pin rules name the submodule through the code
-    mount, `code/upstream/openRepoShape` and `git -C code submodule update
-    …`, as T006's `assembly-0001` writes them; today's spelling there names a
-    path the assembly does not have, and FAILS (#193 item 14). Red at
-    `fb77bed`, which held the assembly's AGENTS.md to today's spelling."""
-    where, init = (("code/", "git -C code submodule update")
-                   if prefixed else ("", "git submodule update"))
-    root = assembly(tmp_path / "asm")
-    (root / "AGENTS.md").write_text(
-        f"1. **Never edit anything under `{where}upstream/openRepoShape` in place.**\n"
-        "2. **Never pin a commit that is not on that repository's `main`.**\n"
-        "3. **The digest is RECOMPUTED, never adjusted.**\n"
-        f"    {init} --init upstream/openRepoShape\n", encoding="utf-8")
-    run = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(root)},
-                 PIN_RULES_TEST, "test_repo_hygiene.py")
-    assert run.outcome(PIN_RULES_TEST)[0] == outcome, run.output[-2000:]
-
-
-def test_the_length_caps_are_the_assembly_roots_where_one_is_named(tmp_path):
-    """At an assembly root the two caps are 347 and 510. The dated entries in
-    `tests/test_repo_hygiene.py` made them from this repository's then caps,
-    323 and 486, and the twenty-four lines each that T006's root guidance adds
-    there, and they stand there while this repository's own are 330 and 505 at
-    this head: `assembly-0001` no longer applies to today's AGENTS.md or
-    README, so the re-cut that makes the assembly's files again sets them. And
-    they are asked of the ASSEMBLY's files: one line over FAILS, the cap itself
-    passes. Red at `origin/main`, which counted this checkout's own README and
-    AGENTS.md whatever was named."""
-    def lines(n: int) -> str:
-        return "".join(f"line {i}\n" for i in range(n))
-    at_cap = assembly(tmp_path / "at", readme=lines(510))
-    (at_cap / "AGENTS.md").write_text(lines(347), encoding="utf-8")
-    over = assembly(tmp_path / "over", readme=lines(511))
-    (over / "AGENTS.md").write_text(lines(348), encoding="utf-8")
-    select = f"{AGENTS_CAP_TEST} or {README_CAP_TEST}"
-    green = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(at_cap)},
-                   select, "test_repo_hygiene.py")
-    for name in (AGENTS_CAP_TEST, README_CAP_TEST):
-        assert green.outcome(name)[0] == "passed", green.output[-3000:]
-    red = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(over)},
-                 select, "test_repo_hygiene.py")
-    for name, said in ((AGENTS_CAP_TEST, "AGENTS.md is 348 lines; the cap is 347"),
-                       (README_CAP_TEST, "README.md is 511 lines; the cap is 510")):
-        outcome, message = red.outcome(name)
-        assert outcome == "failure" and said in message, (
-            f"{name} {outcome} on an assembly file one line over its cap:\n"
-            f"{message}\n{red.output[-2000:]}")
-
-
-def test_the_lane_suite_fails_a_missing_manual_by_name():
-    """`tests/test_lane_helpers.sh` reads the lane manual where the run's roots
-    put it, and a manual that is not there FAILS naming the path, before the
-    `cat … || :` that would otherwise hand the assertions an empty string
-    (T006's record of 2026-10-08, §10). Held on the text, as this module's
-    neighbours hold the shell suite's other properties: the suite itself is
-    forty minutes of bash, and its own run proves the readable branch."""
-    lines = (REPO / "tests" / "test_lane_helpers.sh").read_text(
-        encoding="utf-8").splitlines()
-    reads = [i for i, line in enumerate(lines)
-             if "README-lanes.md" not in line and 'cat "$LANE_MANUAL"' in line]
-    assert len(reads) == 2, f"expected the two manual reads, found {len(reads)}"
-    assert not any('cat "$SRC_DIR/docs/README-lanes.md"' in l for l in lines), (
-        "a manual read still bypasses the run's roots")
-    for i in reads:
-        guard = "\n".join(lines[max(0, i - 3):i])
-        assert '[ -r "$LANE_MANUAL" ]' in guard and "bad " in guard and \
-            "no readable file at $LANE_MANUAL" in guard, (
-            f"line {i + 1} reads the manual with no failure for a missing one "
-            f"in the three lines above it:\n{guard}")
-
-
-# --- the lane suite's manual sections, read and run ---------------------------
-
-SUITE = REPO / "tests" / "test_lane_helpers.sh"
-MANUAL_GUARD = re.compile(r'^if \[ -n "\$LANE_MANUAL" \]$')
-MANUAL_USE = re.compile(r'\$\{?(?:ln_doc|ss_doc)\b')
-HEREDOC = re.compile(r"""<<(-?)\s*\\?(['"]?)([A-Za-z_][A-Za-z0-9_]*)\2""")
-
-
-def shell_commands(line: str) -> list:
-    """`line` cut at each `;` outside quotes, stopping at a `#` comment: a
-    reading of the suite's one-line `if …; then …` / `else …; fi` forms that
-    is enough to follow their nesting, and no more than that."""
-    out, cur, quote, i = [], [], None, 0
-    while i < len(line):
-        ch = line[i]
-        if quote:
-            cur.append(ch)
-            if ch == "\\" and quote == '"' and i + 1 < len(line):
-                cur.append(line[i + 1])
-                i += 2
-                continue
-            if ch == quote:
-                quote = None
-        elif ch in "\"'":
-            quote = ch
-            cur.append(ch)
-        elif ch == "\\" and i + 1 < len(line):
-            cur.append(line[i:i + 2])
-            i += 2
-            continue
-        elif ch == "#" and (not cur or "".join(cur)[-1:].isspace()):
-            break
-        elif ch == ";":
-            out.append("".join(cur).strip())
-            cur = []
-        else:
-            cur.append(ch)
-        i += 1
-    out.append("".join(cur).strip())
-    return [c for c in out if c]
-
-
-def heredoc_in(line: str):
-    """The first here-document `line` opens outside quotes, as (dash, word):
-    its body is not shell this reading follows (the suite writes fakes and
-    Python through them)."""
-    quote, i = None, 0
-    while i < len(line):
-        ch = line[i]
-        if quote:
-            if ch == "\\" and quote == '"':
-                i += 2
-                continue
-            if ch == quote:
-                quote = None
-        elif ch in "\"'":
-            quote = ch
-        elif ch == "\\":
-            i += 2
-            continue
-        elif ch == "#" and (i == 0 or line[i - 1].isspace()):
-            return None
-        elif line.startswith("<<", i) and not line.startswith("<<<", i):
-            found = HEREDOC.match(line, i)
-            return (found.group(1) == "-", found.group(3)) if found else None
-        i += 1
-    return None
-
-
-def manual_reads(lines: list):
-    """Follow the suite's `if`/`elif`/`else`/`fi` nesting, here-documents
-    skipped. Returns each use of the manual's text (`$ss_doc`, `$ln_doc`, in
-    either spelling) with whether the THEN branch of an
-    `if [ -n "$LANE_MANUAL" ]` holds it; each such section's first and last
-    line; and the frames still open at the end, which must be none for the
-    reading to be trusted."""
-    stack, uses, blocks, heredoc = [], [], [], None
-    for n, raw in enumerate(lines):
-        if heredoc is not None:
-            if (raw.lstrip("\t") if heredoc[0] else raw) == heredoc[1]:
-                heredoc = None
-            continue
-        if raw.lstrip().startswith("#"):
-            continue
-        opened = heredoc_in(raw)
-        for cmd in shell_commands(raw):
-            word, _, rest = cmd.partition(" ")
-            rest = rest.strip()
-            if word in ("then", "do") and rest:
-                cmd = rest
-                word, _, rest = cmd.partition(" ")
-                rest = rest.strip()
-            if word == "if":
-                stack.append([bool(MANUAL_GUARD.match(cmd)), False, n])
-                continue
-            if word in ("elif", "else"):
-                if stack:
-                    stack[-1][1] = True
-                if word == "elif" or not rest:
-                    continue
-                cmd = rest
-            if word == "fi":
-                if stack:
-                    frame = stack.pop()
-                    if frame[0]:
-                        blocks.append((frame[2], n))
-                continue
-            if MANUAL_USE.search(cmd):
-                uses.append((n, any(f[0] and not f[1] for f in stack)))
-        if opened:
-            heredoc = opened
-    return uses, blocks, stack
-
-
-def test_the_lane_suite_reads_the_manual_only_inside_its_guard():
-    """Every use of the manual's text in `tests/test_lane_helpers.sh` sits in
-    the THEN branch of an `if [ -n "$LANE_MANUAL" ]` guard. `ss_doc` and
-    `ln_doc` are bound only there, and the suite runs under `set -u`, so one
-    use outside a guard does not skip in a code leg with no spec root: it
-    ABORTS the whole suite with `ln_doc: unbound variable` (lane
-    openRepoTools-3's review of #190; fixed in `b50f197`).
-
-    The nesting is FOLLOWED, not guessed from the nearest line spelled `fi`:
-    the first reading missed a `${ln_doc}` and an indented closing `fi` (the
-    review of `b50f197`, point 6; #193 item 7). The reading planted with both
-    is held by the test below."""
-    uses, blocks, still_open = manual_reads(
-        SUITE.read_text(encoding="utf-8").splitlines())
-    assert not still_open, (
-        f"the suite's if/fi nesting could not be followed past line "
-        f"{still_open[0][2] + 1}, so where the manual is read cannot be vouched for")
-    assert len(uses) >= 16 and len(blocks) >= 3, (
-        f"expected the manual's sixteen uses in three guarded sections, found "
-        f"{len(uses)} in {len(blocks)}")
-    unguarded = [n + 1 for n, guarded in uses if not guarded]
-    assert not unguarded, (
-        f"the manual's text is used outside its guard at line(s) {unguarded}, "
-        f"which aborts a run with no spec root under `set -u`")
-
-
-@pytest.mark.parametrize("text, unguarded", [
-    pytest.param(
-        'if [ -n "$LANE_MANUAL" ]; then\n'
-        'ln_doc="$(cat "$LANE_MANUAL" 2>/dev/null || :)"\n'
-        'has "a" "$ln_doc" "x"\n'
-        'fi\n'
-        'has "b" "${ln_doc}" "y"\n', [5], id="braced-use-after-the-guard"),
-    pytest.param(
-        'if [ -n "$LANE_MANUAL" ]; then\n'
-        '  ln_doc="$(cat "$LANE_MANUAL" 2>/dev/null || :)"\n'
-        '  fi\n'
-        'has "c" "$ln_doc" "z"\n', [4], id="indented-closing-fi"),
-    pytest.param(
-        'if [ -n "$LANE_MANUAL" ]; then\n'
-        'ss_doc="$(cat "$LANE_MANUAL")"\n'
-        'else\n'
-        '  has "d" "$ss_doc" "w"\n'
-        'fi\n', [4], id="use-in-the-guards-else"),
-    pytest.param(
-        'if [ -n "$LANE_MANUAL" ]; then\n'
-        'if [ -r "$LANE_MANUAL" ]; then ok "r"\n'
-        'else bad "r" "no readable file"; fi\n'
-        'cat <<EOF\n'
-        'fi\n'
-        'EOF\n'
-        'has "e" "${ln_doc}" "v"\n'
-        'fi\n', [], id="nested-if-and-a-heredoc-inside-the-guard"),
-])
-def test_the_guard_reading_follows_the_nesting_not_a_spelling(text, unguarded):
-    """The planted cases the first reading got wrong (a braced use after the
-    guard, an indented closing `fi`) and two it must keep right."""
-    uses, _blocks, still_open = manual_reads(text.splitlines())
-    assert not still_open
-    assert [n + 1 for n, guarded in uses if not guarded] == unguarded
-
-
-def suite_helpers() -> str:
-    """The suite's own one-line assertion helpers, verbatim, and a stand-in
-    for the `excerpt` its `has` calls."""
-    wanted = re.compile(r"^(ok|bad|skip|has|hasnt)\(\) *\{")
-    found = [line for line in SUITE.read_text(encoding="utf-8").splitlines()
-             if wanted.match(line)]
-    assert len(found) == 5, f"expected the suite's five helpers, found {found}"
-    return "\n".join(found + ["excerpt() { printf '%.200s' \"$1\"; }"])
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None, reason="the suite is bash")
-def test_the_lane_suites_manual_sections_fail_skip_or_pass_by_name(tmp_path):
-    """THE MISSING-MANUAL BRANCH, RUN (#193 item 3; until now only its text
-    was checked). The suite's three `$LANE_MANUAL` sections, cut out of it by
-    the reading above and run under its own `set -uo pipefail` and its own
-    helpers:
-
-      * a manual that is NOT THERE is a FAIL naming the path, in each section
-        that reads it — never an empty string the quotes then misread;
-      * NO manual (no spec root) is three named skips, and the run reaches
-        its end — never `unbound variable`;
-      * the run's own manual, where it has one, passes every quote."""
-    lines = SUITE.read_text(encoding="utf-8").splitlines()
-    _uses, blocks, _open = manual_reads(lines)
-    body = "\n".join("\n".join(lines[a:b + 1]) for a, b in blocks)
-    script = tmp_path / "manual-sections.sh"
-    script.write_text(
-        "set -uo pipefail\npass=0; fail=0; skipped=0\n" + suite_helpers()
-        + '\nLANE_MANUAL="$MANUAL_UNDER_TEST"\n' + body
-        + '\nprintf "END %s passed, %s failed, %s skipped\\n" '
-          '"$pass" "$fail" "$skipped"\n', encoding="utf-8")
-
-    def run(manual: str) -> str:
-        env = dict(os.environ, MANUAL_UNDER_TEST=manual)
-        proc = subprocess.run([shutil.which("bash") or "bash", str(script)],
-                              env=env, capture_output=True, text=True,
-                              timeout=60, check=False)
-        out = proc.stdout + proc.stderr
-        assert proc.returncode == 0 and "\nEND " in "\n" + out, (
-            f"the manual sections did not run to their end with "
-            f"LANE_MANUAL={manual!r}:\n{out}")
-        assert "unbound variable" not in out, out
-        return out
-
-    missing = tmp_path / "no-spec-leg" / "docs" / "README-lanes.md"
-    out = run(str(missing))
-    named = out.count(f"no readable file at {missing}")
-    assert named == 2 and "\nFAIL " in out, (
-        f"a missing manual must FAIL naming {missing} in both sections that "
-        f"check it; it was named {named} time(s):\n{out}")
-    out = run("")
-    assert "END 0 passed, 0 failed, 3 skipped" in out, out
-    assert out.count("no spec root in this run") == 3, out
-    manual = conftest.ROOTS.root_of("spec")
-    if manual is not None:
-        out = run(str(manual / "docs" / "README-lanes.md"))
-        assert " 0 failed, 0 skipped" in out, out
-
-
-
-def test_a_redirected_run_names_its_roots_where_quiet_output_keeps_them(tmp_path):
-    """A run whose roots a variable named says them at its foot, under the
-    `-q` every CI job and `tests/run.sh` use. The report header that said them
-    is dropped by `-q`, so a run pointed at another tree was silent about it
-    (lane openRepoTools-3's review of #190, #193 item 6). A run on today's
-    layout with no variable prints nothing new."""
-    root = assembly(tmp_path / "asm")
-    named = nested(tmp_path, {"OPENREPOTOOLS_ASSEMBLY_ROOT": str(root)},
-                   README_TEST, "test_repo_hygiene.py")
-    assert named.outcome(README_TEST)[0] == "passed", named.output[-2000:]
-    assert "openRepoTools test roots" in named.output, named.output[-2000:]
-    assert f"assembly: {root.resolve()} (OPENREPOTOOLS_ASSEMBLY_ROOT)" in named.output, (
-        named.output[-2000:])
-    plain = nested(tmp_path, {}, README_TEST, "test_repo_hygiene.py")
-    if conftest.ROOTS.layout == "single" and not conftest.ROOTS.how:
-        assert "openRepoTools test roots" not in plain.output, (
-            "today's layout, with no variable, printed the roots section:\n"
-            + plain.output[-2000:])
-
-
-def test_a_standalone_code_leg_skips_what_only_the_assembly_carries(tmp_path):
-    """A code leg cloned on its own has no README: standalone, the README test
-    SKIPS naming the assembly root, which is the courtesy the missing submodule
-    gets; composed, the session is REFUSED naming it (exit 4), never a skip."""
-    leg = code_leg(tmp_path / "code")
-    standalone = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg)},
-                        README_TEST, "test_repo_hygiene.py")
-    outcome, message = standalone.outcome(README_TEST)
-    assert outcome == "skipped" and "assembly root" in message, (
-        f"a standalone code leg's README test {outcome}, not a skip naming the "
-        f"assembly root:\n{message}\n{standalone.output[-2000:]}")
-    composed = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg),
-                                 "OPENREPOTOOLS_COMPOSED": "1"},
-                      README_TEST, "test_repo_hygiene.py")
-    assert composed.returncode == 4, (
-        f"a composed run with no assembly root exited {composed.returncode}, "
-        f"not pytest's refusal (4):\n{composed.output[-3000:]}")
-    assert "the ASSEMBLY root is absent" in composed.output, composed.output[-3000:]
-    assert "the SPEC root is absent" in composed.output, composed.output[-3000:]
-    assert not composed.outcomes, "a refused session ran tests anyway"
-
-
-#: The command's half of three mixed hygiene tests, and the line each asserts.
-COMMAND_HALVES = (
-    ("test_the_documents_say_what_bare_park_does_now", "park",
-     "PARKED EVERY ESTATE unasked"),
-    ("test_the_documents_say_what_status_is_and_is_not", "status",
-     "--no-optional-locks"),
-    ("test_the_documents_say_what_a_bare_lanes_lists", "openRepoTools",
-     "lanes [--all] [--fetch]"),
-)
-
-
-def test_a_standalone_code_leg_still_checks_each_commands_own_half(tmp_path):
-    """Where a test reads a command and the documents about it, the command's
-    half is asserted FIRST, so a standalone code leg — which skips the
-    documents — still checks the command (the #190 review). A leg whose three
-    commands lost their lines FAILS those three tests rather than skipping
-    them with the documents."""
-    leg = code_leg(tmp_path / "code")
-    for _, name, line in COMMAND_HALVES:
-        path = leg / name
-        text = path.read_text(encoding="utf-8")
-        assert line in text, f"{name} no longer carries {line!r}; this test is stale"
-        path.write_text(text.replace(line, "(removed for the fixture)"),
-                        encoding="utf-8")
-    run = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg)},
-                 " or ".join(test for test, _, _ in COMMAND_HALVES),
-                 "test_repo_hygiene.py")
-    for test, name, _ in COMMAND_HALVES:
-        outcome, message = run.outcome(test)
-        assert outcome == "failure", (
-            f"{test} {outcome} on a leg whose {name} lost its line: the "
-            f"command's half was not asserted before the documents' skip:\n"
-            f"{message}\n{run.output[-2000:]}")
-
-
-def test_the_pin_checks_read_the_code_roots_own_git_identity(tmp_path):
-    """The lockstep check reads `git ls-tree HEAD` IN the code root it is given:
-    a code leg whose gitlink disagrees with its pin FAILS it. Red at
-    `origin/main`, which read this checkout's gitlink whatever was named."""
-    leg = code_leg(tmp_path / "code", repository=True, gitlink="1" * 40)
-    run = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg)},
-                 LOCKSTEP_TEST, "test_upstream_pin.py")
-    outcome, message = run.outcome(LOCKSTEP_TEST)
-    assert outcome == "failure" and "1" * 40 in message, (
-        f"the lockstep check {outcome} on a code root whose gitlink is "
-        f"{'1' * 40}; it did not read that root:\n{message}\n{run.output[-2000:]}")
-
-
-def test_the_no_submodule_skip_is_todays_skip_and_composed_refuses_it(tmp_path):
-    """A code root whose dependency was never initialized — the empty directory
-    a clone without `--recurse-submodules` leaves — SKIPS the three checks of
-    the dependency's bytes with today's reason, standalone, while the checks of
-    the pin itself still run and pass; composed, the session is refused
-    naming the dependency. The worktree's own submodule is never touched."""
-    leg = code_leg(tmp_path / "code", repository=True, dependency="empty")
-    select = f"{LOCKSTEP_TEST} or {DIGEST_TEST} or {HEAD_TEST}"
-    standalone = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg)},
-                        select, "test_upstream_pin.py")
-    assert standalone.returncode == 0, standalone.output[-3000:]
-    assert standalone.outcome(LOCKSTEP_TEST)[0] == "passed", standalone.output[-3000:]
-    for name in (DIGEST_TEST, HEAD_TEST):
-        outcome, message = standalone.outcome(name)
-        assert outcome == "skipped" and (
-            "the pinned openRepoShape is not checked out; run `git submodule "
-            "update --init upstream/openRepoShape`") in message, (
-            f"{name} {outcome} without the dependency, not today's skip:\n{message}")
-    composed = nested(tmp_path, {"OPENREPOTOOLS_CODE_ROOT": str(leg),
-                                 "OPENREPOTOOLS_COMPOSED": "1"},
-                      select, "test_upstream_pin.py")
-    assert composed.returncode == 4, composed.output[-3000:]
-    assert "the DEPENDENCY" in composed.output and "is not initialized" in \
-        composed.output, composed.output[-3000:]
-
-
-@NEEDS_UPSTREAM
-def test_a_composed_triad_runs_every_check_and_skips_none(tmp_path):
-    """THE POSITIVE CONTROL: a fixture triad — an assembly whose HEAD pins a
-    code leg and a spec leg at their own HEADs, the dependency checked out at
-    its pin — runs the README, manual and pin checks composed, found by
-    discovery alone (only the code root is named), and every one PASSES.
-    Then one moved gitlink: the spec leg no longer at its pin is refused."""
-    code = code_leg(tmp_path / "asm" / "code", repository=True,
-                    dependency="clone")
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    root = assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    env = {"OPENREPOTOOLS_CODE_ROOT": str(code), "OPENREPOTOOLS_COMPOSED": "1"}
-    run = nested(tmp_path, env, f"{README_TEST} or {MANUAL_TEST} or upstream_pin",
-                 "test_repo_hygiene.py", "test_upstream_pin.py")
-    assert run.returncode == 0, run.output[-4000:]
-    assert run.outcomes, run.output[-3000:]
-    not_passed = {name: o for name, o in run.outcomes.items() if o[0] != "passed"}
-    assert not not_passed, f"a composed run did not pass everything: {not_passed}"
-    for name in (README_TEST, MANUAL_TEST, LOCKSTEP_TEST, DIGEST_TEST, HEAD_TEST):
-        run.outcome(name)
-    (spec / "openspec" / "README.md").write_text("# moved\n", encoding="utf-8")
-    run_git(spec, "commit", "-q", "-a", "-m", "the spec leg moves off its pin")
-    moved = nested(tmp_path, env, README_TEST, "test_repo_hygiene.py")
-    assert moved.returncode == 4, moved.output[-3000:]
-    assert f"the spec root {spec.resolve()}" in moved.output and \
-        "composed acceptance is for the pinned spec leg" in moved.output, (
-        moved.output[-3000:])
-    assert root.is_dir()
-
-
-@WINDOWS_SKIP
-@pytest.mark.skipif(shutil.which("bash") is None, reason="the wrapper is bash")
-def test_the_wrapper_passes_a_relative_root_through_as_an_absolute_one(tmp_path):
-    """`tests/run.sh` `cd`s to its own repository before it runs pytest, so a
-    RELATIVE root would be read against the code root, not against where the
-    caller stood. It is made absolute first; an absolute one and the mode pass
-    as they are. The suite is a stub that records its environment, and `pgrep`
-    a stub that sees no other run — the real one would see this suite."""
-    fakebin = tmp_path / "fakebin"
-    fakebin.mkdir()
-    log = tmp_path / "suite.env"
-    (fakebin / "python3").write_text(
-        "#!/bin/sh\nenv | grep '^OPENREPOTOOLS_' > \"$FAKE_SUITE_LOG\"\nexit 0\n")
-    (fakebin / "pgrep").write_text("#!/bin/sh\nexit 1\n")
-    for name in ("python3", "pgrep"):
-        (fakebin / name).chmod(0o755)
-    caller = tmp_path / "caller"
-    caller.mkdir()
-    env = {k: v for k, v in os.environ.items()
-           if not k.startswith(("XDG_", "PYTHON", "OPENREPOTOOLS_"))
-           and k not in ("PWD", "OLDPWD")}
-    env.update(PATH=f"{fakebin}{os.pathsep}{os.environ.get('PATH', '')}",
-               TMPDIR=str(tmp_path), XDG_STATE_HOME=str(tmp_path / "state"),
-               XDG_CACHE_HOME=str(tmp_path / "cache"), HOME=str(tmp_path / "home"),
-               FAKE_SUITE_LOG=str(log),
-               OPENREPOTOOLS_ASSEMBLY_ROOT="asm",
-               OPENREPOTOOLS_SPEC_ROOT="asm/spec",
-               OPENREPOTOOLS_CODE_ROOT=str(tmp_path / "elsewhere"),
-               OPENREPOTOOLS_COMPOSED="1")
-    proc = subprocess.run([shutil.which("bash") or "bash", str(WRAPPER), "-k", "x"],
-                          cwd=str(caller), env=env, capture_output=True, text=True,
-                          stdin=subprocess.DEVNULL, timeout=120, check=False)
-    assert proc.returncode == 0, proc.stderr
-    seen = dict(line.split("=", 1) for line in log.read_text().splitlines())
-    assert seen["OPENREPOTOOLS_ASSEMBLY_ROOT"] == f"{caller.resolve()}/asm", seen
-    assert seen["OPENREPOTOOLS_SPEC_ROOT"] == f"{caller.resolve()}/asm/spec", seen
-    assert seen["OPENREPOTOOLS_CODE_ROOT"] == str(tmp_path / "elsewhere"), seen
-    assert seen["OPENREPOTOOLS_COMPOSED"] == "1", seen
-    # A QUOTED `~` is the home directory, as conftest's `expanduser` reads it,
-    # never a directory named `~` under the caller (#193 item 7).
-    env.update(OPENREPOTOOLS_SPEC_ROOT="~/spec", OPENREPOTOOLS_ASSEMBLY_ROOT="~")
-    proc = subprocess.run([shutil.which("bash") or "bash", str(WRAPPER), "-k", "x"],
-                          cwd=str(caller), env=env, capture_output=True, text=True,
-                          stdin=subprocess.DEVNULL, timeout=120, check=False)
-    assert proc.returncode == 0, proc.stderr
-    seen = dict(line.split("=", 1) for line in log.read_text().splitlines())
-    assert seen["OPENREPOTOOLS_SPEC_ROOT"] == f"{tmp_path / 'home'}/spec", seen
-    assert seen["OPENREPOTOOLS_ASSEMBLY_ROOT"] == str(tmp_path / "home"), seen
-
-
-# --- the resolver, asked directly -------------------------------------------
-
-def test_todays_single_tree_is_every_root_at_once(tmp_path):
-    """Today's layout: the code root carries the spec trees beside the
-    commands, so it answers for the assembly and the spec leg too, and a
-    document test reads exactly the file it always read."""
-    code = code_leg(tmp_path / "repo", single=True)
-    roots = conftest.resolve_roots({}, code)
-    assert roots.refusal() is None, roots.refusal()
-    assert (roots.layout, roots.assembly, roots.spec) == ("single", None, None)
-    assert roots.root_of("assembly") == roots.root_of("spec") == roots.code
-    assert roots.path_for("README.md") == roots.code / "README.md"
-    assert roots.path_for("docs/README-lanes.md") == roots.code / "docs/README-lanes.md"
-    assert [role for role, _ in roots.tracked_roots()] == ["code"]
-
-
-def test_a_mounted_code_leg_finds_its_assembly_and_spec_leg(tmp_path):
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    root = assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    roots = conftest.resolve_roots({}, code)
-    assert roots.layout == "leg"
-    assert roots.assembly == root.resolve() and roots.spec == spec.resolve()
-    assert roots.path_for("README.md") == root.resolve() / "README.md"
-    assert roots.path_for("AGENTS.md").parent == root.resolve()
-    assert roots.path_for("docs/README-lanes.md") == spec.resolve() / "docs/README-lanes.md"
-    assert roots.path_for(".gitattributes") == code.resolve() / ".gitattributes", (
-        "the line-ending rule is the code root's: git does not read a "
-        "superproject's attributes into a submodule")
-    assert roots.path_for("tests/run.sh") == code.resolve() / "tests/run.sh"
-    for own in ("LICENSE", ".gitignore"):
-        assert roots.path_for(own) == code.resolve() / own, (
-            f"{own} is the code root's: the code leg carries its own (T006's "
-            f"code-0001), and it is the copy that governs the leg's files")
-    assert [role for role, _ in roots.tracked_roots()] == ["code", "assembly", "spec"]
-
-
-def test_a_directory_that_does_not_mount_the_code_root_is_not_its_assembly(tmp_path):
-    """An assembly above a code root that it does not record as its code
-    gitlink is somebody else's: discovery answers no rather than borrow it."""
-    root = assembly(tmp_path / "asm")              # no repository, no gitlink
-    code = code_leg(root / "code")
-    assert conftest.resolve_roots({}, code).assembly is None
-
-
-def paired_triad(tmp_path: Path, *, spec_worktree: bool = True):
-    """An assembly with both legs mounted, and a feature's paired worktrees
-    `worktrees/001-feature/{code,spec}` made from those legs, as T006's root
-    guidance and the code leg's AGENTS.md lay them out."""
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    root = assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    feature = root / "worktrees" / "001-feature"
-    run_git(code, "worktree", "add", "-q", "-b", "001-feature",
-            str(feature / "code"))
-    if spec_worktree:
-        run_git(spec, "worktree", "add", "-q", "-b", "001-feature",
-                str(feature / "spec"))
-    return root, feature
-
-
-def test_a_paired_feature_worktree_finds_its_assembly_and_its_own_spec(tmp_path):
-    """The paired layout: a feature's code worktree at
-    `<assembly>/worktrees/<feature>/code` reads the assembly's README and its
-    own spec worktree's manual. Discovery returned None there, so every
-    document test would skip in a feature worktree after Gate C (lane
-    openRepoTools-3's review of #190, #193 item 5)."""
-    root, feature = paired_triad(tmp_path)
-    roots = conftest.resolve_roots({}, feature / "code")
-    assert roots.refusal() is None, roots.refusal()
-    assert roots.assembly == root.resolve(), roots.describe()
-    assert roots.spec == (feature / "spec").resolve(), roots.describe()
-    assert roots.path_for("README.md") == root.resolve() / "README.md"
-    assert roots.path_for("docs/README-lanes.md") == (
-        feature / "spec" / "docs" / "README-lanes.md").resolve()
-    assert "paired feature worktree" in roots.how["assembly"], roots.how
-    # Without a spec worktree of its own, the feature reads the mounted one.
-    root2, feature2 = paired_triad(tmp_path / "two", spec_worktree=False)
-    roots2 = conftest.resolve_roots({}, feature2 / "code")
-    assert roots2.spec == (root2 / "spec").resolve(), roots2.describe()
-
-
-def test_only_the_two_designed_places_are_an_assemblys_code(tmp_path):
-    """Discovery stays bounded to the mount and the paired worktree: a
-    repository that is not the code leg's, at the paired path, is not found,
-    and neither is the code leg's own worktree anywhere but `worktrees/`."""
-    root, feature = paired_triad(tmp_path)
-    # A repository of its own with a history of its own: built from the same
-    # files, but never holding the commit the assembly pins (a fixture leg
-    # committed in the same second with the same tree would BE that commit).
-    stranger = code_leg(root / "worktrees" / "002-stranger" / "code")
-    (stranger / "STRANGER").write_text("not the code leg\n", encoding="utf-8")
-    run_git(stranger, "init", "-q")
-    run_git(stranger, "add", "-A")
-    run_git(stranger, "commit", "-q", "-m", "a history of its own")
-    assert conftest.resolve_roots({}, stranger).assembly is None, (
-        "a checkout that does not hold the pinned commit was taken for the leg")
-    elsewhere = root / "elsewhere" / "001-feature" / "code"
-    run_git(root / "code", "worktree", "add", "-q", "-b", "elsewhere",
-            str(elsewhere))
-    assert conftest.resolve_roots({}, elsewhere).assembly is None, (
-        "a worktree outside worktrees/ was taken for a paired one")
-    # Found is not accepted: a feature's commits are not the pinned leg, and
-    # a composed run there is refused for that, naming it.
-    run_git(feature / "code", "commit", "-q", "--allow-empty", "-m", "feature work")
-    composed = conftest.resolve_roots({"OPENREPOTOOLS_COMPOSED": "1"},
-                                      feature / "code").refusal()
-    assert composed and "composed acceptance is for the pinned code leg" in composed, (
-        composed)
-
-
-def test_a_stale_manifest_under_a_feature_does_not_hide_its_assembly(tmp_path):
-    """An ancestor carrying the assembly's two markers but failing the rest
-    (not a repository's top level, no gitlink) is skipped, not the end of the
-    search: discovery stopped there and found nothing (Copilot round 2 on
-    #195)."""
-    root, feature = paired_triad(tmp_path)
-    (feature / "contracts").mkdir()
-    (feature / "contracts" / "code-pin.yaml").write_text(
-        LEG_PIN.format(role="code", commit="0" * 40, digest="0" * 64), encoding="utf-8")
-    (feature / "project.yaml").write_text(PROJECT_YAML, encoding="utf-8")
-    roots = conftest.resolve_roots({}, feature / "code")
-    assert roots.assembly == root.resolve(), roots.describe()
-
-
-def test_a_stray_spec_tree_beside_a_paired_code_worktree_is_not_its_spec(tmp_path):
-    """The feature's own spec worktree must be a repository holding the spec
-    commit the assembly pins, as the paired code worktree must. A plain `docs/`
-    there is not it, and the mounted spec leg is read instead (Copilot round 2
-    on #195)."""
-    root, feature = paired_triad(tmp_path, spec_worktree=False)
-    stray = spec_leg(feature / "spec")              # files only, no repository
-    assert (stray / "docs" / "README-lanes.md").is_file()
-    roots = conftest.resolve_roots({}, feature / "code")
-    assert roots.spec == (root / "spec").resolve(), roots.describe()
-    assert roots.how["spec"] == "the assembly's spec leg", roots.how
-
-
-def test_the_variables_name_the_roots(tmp_path):
-    code = code_leg(tmp_path / "code")
-    root = assembly(tmp_path / "elsewhere" / "asm")
-    spec = spec_leg(tmp_path / "spec")
-    roots = conftest.resolve_roots({"OPENREPOTOOLS_CODE_ROOT": str(code),
-                                    "OPENREPOTOOLS_ASSEMBLY_ROOT": str(root),
-                                    "OPENREPOTOOLS_SPEC_ROOT": str(spec)},
-                                   tmp_path / "unused")
-    assert roots.refusal() is None, roots.refusal()
-    assert (roots.code, roots.assembly, roots.spec) == (
-        code.resolve(), root.resolve(), spec.resolve())
-    assert roots.how == {"code": "OPENREPOTOOLS_CODE_ROOT",
-                         "assembly": "OPENREPOTOOLS_ASSEMBLY_ROOT",
-                         "spec": "OPENREPOTOOLS_SPEC_ROOT"}
-    assert roots.dependency == code.resolve() / "upstream" / "openRepoShape"
-
-
-@pytest.mark.parametrize("variable, value, said", [
-    ("OPENREPOTOOLS_COMPOSED", "yes", "is neither 1"),
-    ("OPENREPOTOOLS_CODE_ROOT", "missing", "is not a code root"),
-    ("OPENREPOTOOLS_ASSEMBLY_ROOT", "missing", "is not an assembly root"),
-    ("OPENREPOTOOLS_SPEC_ROOT", "missing", "is not a spec root"),
-])
-def test_a_variable_that_names_the_wrong_thing_is_refused_in_either_mode(
-        tmp_path, variable, value, said):
-    """A root named by hand that is not that root is a typo, not a layout:
-    refused before any test, standalone as well as composed."""
-    code = code_leg(tmp_path / "repo", single=True)
-    target = value if variable == "OPENREPOTOOLS_COMPOSED" else str(tmp_path / value)
-    refusal = conftest.resolve_roots({variable: target}, code).refusal()
-    assert refusal and said in refusal and variable in refusal, refusal
-
-
-@pytest.mark.parametrize("variable, role", [
-    ("OPENREPOTOOLS_SPEC_ROOT", "SPEC"),
-    ("OPENREPOTOOLS_ASSEMBLY_ROOT", "ASSEMBLY"),
-])
-def test_composed_names_the_value_a_rejected_root_was_named_by(
-        tmp_path, variable, role):
-    """A root that was NAMED and refused is absent because of that value,
-    and the composed refusal says so: never that its variable "is unset", or
-    that there is "no" such variable, when the run set it (#193 item 15, lane
-    openRepoTools-2's reading of the composed-run logs). The refusal itself was
-    right before; only its words were wrong."""
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    wrong = tmp_path / "not-a-root"
-    wrong.mkdir()
-    refusal = conftest.resolve_roots(
-        {"OPENREPOTOOLS_COMPOSED": "1", variable: str(wrong)}, code).refusal()
-    assert refusal, "a named root that is not one must be refused"
-    absent = [part for part in refusal.split("; ")
-              if part.startswith(f"the {role} root is absent")]
-    assert absent, refusal
-    assert f"{variable} names {wrong}" in absent[0], absent[0]
-    for misnomer in (f"{variable} is unset", f"no {variable}"):
-        assert misnomer not in refusal, (
-            f"the refusal says {misnomer!r} although the run named "
-            f"{variable}={wrong}:\n{refusal}")
-
-
-def test_composed_names_every_absent_context(tmp_path):
-    leg = code_leg(tmp_path / "code", repository=True, dependency="empty")
-    refusal = conftest.resolve_roots({"OPENREPOTOOLS_COMPOSED": "1"}, leg).refusal()
-    assert refusal is not None
-    for context in ("the ASSEMBLY root is absent", "the SPEC root is absent",
-                    "the DEPENDENCY", "is not initialized"):
-        assert context in refusal, refusal
-    assert conftest.resolve_roots({}, leg).refusal() is None, (
-        "standalone, the same leg is a layout and not a refusal")
-
-
-def test_composed_refuses_a_code_leg_off_its_pin_or_with_changes(tmp_path):
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    (code / "upstream" / "openRepoShape").mkdir(parents=True, exist_ok=True)
-    for probe in ("scripts/repo_shape.py", "templates/workspace-root/README.md"):
-        target = code / "upstream" / "openRepoShape" / probe
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text("# a probe\n", encoding="utf-8")
-    composed = {"OPENREPOTOOLS_COMPOSED": "1"}
-    assert conftest.resolve_roots(composed, code).refusal() is None, (
-        conftest.resolve_roots(composed, code).refusal())
-    (code / "park").write_text("#!/usr/bin/env bash\n# edited\n", encoding="utf-8")
-    refusal = conftest.resolve_roots(composed, code).refusal()
-    assert refusal and "has changes to tracked files" in refusal, refusal
-    run_git(code, "commit", "-q", "-a", "-m", "the code leg moves off its pin")
-    refusal = conftest.resolve_roots(composed, code).refusal()
-    assert refusal and "composed acceptance is for the pinned code leg" in refusal, refusal
-
-
-def test_composed_refuses_a_leg_whose_status_cannot_be_read(tmp_path):
-    """A `git status` that fails is not a clean one (Copilot on #190): a code
-    leg at its pin whose index is unreadable is refused, naming it, rather
-    than accepted because no changes were printed."""
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    for probe in ("scripts/repo_shape.py", "templates/workspace-root/README.md"):
-        target = code / "upstream" / "openRepoShape" / probe
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text("# a probe\n", encoding="utf-8")
-    composed = {"OPENREPOTOOLS_COMPOSED": "1"}
-    assert conftest.resolve_roots(composed, code).refusal() is None
-    (code / ".git" / "index").write_bytes(b"not an index")
-    refusal = conftest.resolve_roots(composed, code).refusal()
-    assert refusal and "answered no `git status`" in refusal, refusal
-
-
-def test_composed_refuses_a_pin_that_names_another_commit_than_the_gitlink(tmp_path):
-    """The leg pin's `commit:` and the gitlink are one invariant. A pin moved
-    off the gitlink, with the gitlink and the leg's HEAD still agreeing, was
-    accepted (`refusal()` was None) while `scripts/validate-pins.py` exits 1 on
-    the same tree (Copilot round 2 on #190, #193 item 4). Refused now, naming
-    the pin, the gitlink and the mount."""
-    code = code_leg(tmp_path / "asm" / "code", repository=True)
-    spec = spec_leg(tmp_path / "asm" / "spec", repository=True)
-    root = assembly(tmp_path / "asm", code=code, spec=spec, repository=True)
-    for probe in ("scripts/repo_shape.py", "templates/workspace-root/README.md"):
-        target = code / "upstream" / "openRepoShape" / probe
-        target.parent.mkdir(parents=True, exist_ok=True)
-        target.write_text("# a probe\n", encoding="utf-8")
-    composed = {"OPENREPOTOOLS_COMPOSED": "1"}
-    assert conftest.resolve_roots(composed, code).refusal() is None, (
-        conftest.resolve_roots(composed, code).refusal())
-    pin = root / "contracts" / "code-pin.yaml"
-    head = run_git(code, "rev-parse", "HEAD")
-    pin.write_text(pin.read_text(encoding="utf-8").replace(head, "1" * 40),
-                   encoding="utf-8")
-    refusal = conftest.resolve_roots(composed, code).refusal()
-    assert refusal and "contracts/code-pin.yaml pins " + "1" * 40 in refusal, refusal
-    assert f"records {head}" in refusal and "one invariant" in refusal, refusal
-
-
-@pytest.mark.parametrize("variable, markers", [
-    ("OPENREPOTOOLS_CODE_ROOT", ("openRepoTools", "contracts/openreposhape-pin.yaml")),
-    ("OPENREPOTOOLS_ASSEMBLY_ROOT", ("contracts/code-pin.yaml", "project.yaml")),
-])
-def test_a_directory_spelled_like_a_marker_is_not_one(tmp_path, variable, markers):
-    """A root's markers are files. A tree whose `openRepoTools` or
-    `project.yaml` is a DIRECTORY is not that root, and naming it is refused
-    like any other wrong tree; with `exists()` it passed (#193 item 4)."""
-    code = code_leg(tmp_path / "repo", single=True)
-    fake = tmp_path / "fake"
-    for marker in markers:
-        (fake / marker).mkdir(parents=True)
-    refusal = conftest.resolve_roots({variable: str(fake)}, code).refusal()
-    assert refusal and variable in refusal and "is not a" in refusal, (
-        f"{variable} naming a tree of marker-named directories was accepted: "
-        f"{refusal}")
-
-
-def test_this_runs_roots_are_the_ones_it_is_running_with():
-    """This session's own roots: coherent, and — composed — complete. The
-    composed half is the same check `pytest_configure` refused on, held as a
-    test so a green composed run lists it."""
-    roots = conftest.ROOTS
-    assert roots.refusal() is None, roots.refusal()
-    assert REPO == roots.code == conftest.CODE_ROOT
-    for marker in ("openRepoTools", "contracts/openreposhape-pin.yaml"):
-        assert (roots.code / marker).exists(), marker
-    if roots.composed:
-        assert roots.assembly is not None and roots.spec is not None
-        assert roots.dependency_initialized()
diff --git a/tests/test_tests_workflow.py b/tests/test_tests_workflow.py
deleted file mode 100644
index 030880c7..00000000
--- a/tests/test_tests_workflow.py
+++ /dev/null
@@ -1,1226 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`.github/workflows/tests.yml`: its triggers, its four jobs and the `package` job (#228).
-
-OFFLINE, LIKE THE REST OF THIS SUITE. What these tests hold is
-contracts/workflows.md's "Held by `tests/test_tests_workflow.py`" list, with
-the `package` job's steps 1 to 11 as that contract writes them. The workflow
-is read with the PINNED STANDARD'S OWN `repo_shape.load_yaml` (research R9),
-the fail-closed reader of the YAML subset this family writes, so a construct
-outside that subset fails here first, and no YAML library joins the suite.
-Without the submodule those tests SKIP, naming it, as the command tests do.
-Two tests read the file as text instead, and need no submodule: the header
-comment, because a comment is not data, and the digest rule, because a
-digest is wrong wherever in the file it stands.
-
-THREE OF THE `package` JOB'S STEPS ARE RUN, NOT ONLY READ. Each runs under
-bash at the repository's root, as the runner runs it, with `$RUNNER_TEMP`,
-`$HOME` and every `$GITHUB_*` file under the test's own directory, and with
-pip pointed at no index, so nothing can be fetched:
-
-- step 4, under a fake `pip` that records each call and installs nothing:
-  the file it installs `tomli` from, by hash, must be the build lock's whole
-  `tomli` entry, every hash of it;
-- step 6, the wheel check, over four wheels made here with `zipfile` from
-  HEAD's own blobs and modes, laid out as hatchling 1.27.0 lays one out, and
-  put where step 5 leaves its two builds, `$RUNNER_TEMP/a/` and
-  `$RUNNER_TEMP/b/`;
-- step 11's report step, over JUnit reports written here.
-
-WHAT THESE TESTS NEED OF THE `package` JOB, beyond the contract's own
-words, written down here so that the task adding the job (T016) knows:
-
-- each numbered step of the contract is its own YAML step, or several, in
-  the contract's order, and step 11's report is a later YAML step than its
-  pytest command;
-- a step is found by what it does, its `run:`, `env:` and `with:`, never by
-  its `name:`: step 4 names the build lock, 5 runs `pip wheel`, 6 opens a
-  `python3 - … <<'PY'` heredoc, 7 names the pipx lock, 8 runs
-  `pipx install`, 9 runs `openRepoTools --version`, 10 sets
-  `OPENREPOTOOLS_REPO=offline.invalid/sentinel`, and 11 runs the contract's
-  pytest command;
-- step 6's YAML step holds that one heredoc, and its script, up to the
-  heredoc's closing `PY`, checks the wheel in `$RUNNER_TEMP/a/` against
-  `HEAD`, printing each problem, and exits 0 or 1;
-- a step that is run reads what an earlier step left only through
-  `$GITHUB_ENV`, `$GITHUB_PATH`, `$RUNNER_TEMP` or the job's `env:`, and the
-  only expressions it holds are `${{ runner.temp }}`,
-  `${{ github.workspace }}`, `${{ github.sha }}` and `${{ env.NAME }}`.
-"""
-
-from __future__ import annotations
-
-import ast
-import base64
-import hashlib
-import importlib.util
-import json
-import os
-import re
-import shlex
-import shutil
-import subprocess
-import sys
-import zipfile
-from datetime import datetime, timezone
-from pathlib import Path
-
-import pytest
-
-from conftest import NEEDS_UPSTREAM, REPO, UPSTREAM, WINDOWS_SKIP
-
-WORKFLOW = REPO / ".github" / "workflows" / "tests.yml"
-BUILD_LOCK = REPO / ".github" / "release-build-requirements.txt"
-PINNED_READER = UPSTREAM / "scripts" / "repo_shape.py"
-
-#: THE RELEASE GATE'S FOUR JOB IDS (FR-046), in the file's order. The gate
-#: reads them by name, so a fifth job, a renamed one or a `name:` on one is
-#: a gate that finds nothing.
-JOB_IDS = ("guard-launch-mode", "tests", "tests-no-submodule", "package")
-
-#: The two commits every job pins (contracts/workflows.md).
-CHECKOUT = "actions/checkout@11d5960a326750d5838078e36cf38b85af677262"
-SETUP_PYTHON = "actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065"
-
-#: THE TRIGGERS. Only `push.branches` moves, from `[main]`.
-PULL_REQUEST = {"types": ["opened", "synchronize", "reopened", "labeled"]}
-PUSH = {"branches": ["main", "release/v*"]}
-SCHEDULE = [{"cron": "17 4 * * *"}]
-
-#: THE THREE EXISTING JOBS AS TODAY'S FILE HOLDS THEM, written out here and
-#: never read from history: CI checks out one commit at `fetch-depth: 1`.
-#: Each is its runner, its checkout's options, its Python and its `run:`
-#: commands in order. The pull request's diff review answers for the rest
-#: of "byte for byte".
-EXISTING_JOBS = {
-    "guard-launch-mode": {
-        "checkout": {"submodules": True, "fetch-depth": 1},
-        "python": "3.x",
-        "runs": [
-            "python3 -m pip install --disable-pip-version-check "
-            "--only-binary=:all: pytest==8.3.4",
-            "bash tests/run.sh -k 'guard_launch_mode or repo_hygiene'",
-        ],
-    },
-    "tests": {
-        "checkout": {"submodules": True, "fetch-depth": 1},
-        "python": "3.x",
-        "runs": [
-            "python3 -m pip install --disable-pip-version-check pytest==8.3.4",
-            "{\n"
-            '  echo "GIT_AUTHOR_NAME=openRepoTools CI"\n'
-            '  echo "GIT_AUTHOR_EMAIL=ci@openrepotools.invalid"\n'
-            '  echo "GIT_COMMITTER_NAME=openRepoTools CI"\n'
-            '  echo "GIT_COMMITTER_EMAIL=ci@openrepotools.invalid"\n'
-            '} >> "$GITHUB_ENV"\n',
-            "python3 -m pytest tests -q",
-        ],
-    },
-    "tests-no-submodule": {
-        "checkout": {"submodules": False, "fetch-depth": 1},
-        "python": "3.x",
-        "runs": [
-            "python3 -m pip install --disable-pip-version-check pytest==8.3.4",
-            "set -euo pipefail\n"
-            "if [ -f upstream/openRepoShape/scripts/repo_shape.py ]; then\n"
-            '  echo "the submodule IS checked out; this job proves nothing" >&2\n'
-            "  exit 1\n"
-            "fi\n",
-            "python3 -m pytest tests -q -rs",
-        ],
-    },
-}
-
-#: The identity the fixture commits carry, as the `tests` job sets it.
-GIT_IDENTITY = {
-    "GIT_AUTHOR_NAME": "openRepoTools CI",
-    "GIT_AUTHOR_EMAIL": "ci@openrepotools.invalid",
-    "GIT_COMMITTER_NAME": "openRepoTools CI",
-    "GIT_COMMITTER_EMAIL": "ci@openrepotools.invalid",
-}
-
-#: contracts/cli-output.md's unstamped `--version`, which step 9 compares.
-UNSTAMPED_VERSION = (
-    "openRepoTools 0.0.0 (an unstamped package)",
-    "  version   0.0.0, unstamped: a package built from a checkout, not a release",
-    "  tag       none",
-    "  commit    none",
-    "  digest    none",
-)
-
-#: THE SKIP LINE AND THE COUNT LINE OF STEP 10, as the parts a bash script
-#: carries whole however it quotes the rest: the line holds an apostrophe
-#: and four backticks, and a script may escape either.
-SKIP_LINE_PARTS = ("left to pipx at ", "(a link into pipx",
-                   "openrepotools environment); update it with ",
-                   "pipx upgrade openrepotools", ", then run ")
-COUNT_LINE_PARTS = ("16 of 17 placed in ", ", and 1 left to pipx")
-
-#: STEP 11's COMMAND, as contracts/workflows.md writes it.
-PYTEST_COMMAND = ("python3 -m pytest tests/test_package.py "
-                  "tests/test_package_stamp.py tests/test_install_pipx.py "
-                  '-q -rs --junitxml="$RUNNER_TEMP/package-tests.xml"')
-
-#: `$RUNNER_TEMP` in any spelling a step may give it.
-RT = r"(?:\$\{?RUNNER_TEMP\}?|\$\{\{\s*runner\.temp\s*\}\})"
-
-#: A heredoc's opening line, `python3 - … <<'PY'`: python3, a lone `-` for
-#: its script, and nothing after the delimiter.
-HEREDOC_OPENER = re.compile(
-    r"^[ \t]*python3[ \t](?:[^\n]*[ \t])?-[ \t](?:[^\n]*[ \t])?<<'PY'[ \t]*$",
-    re.M)
-
-#: HOW EACH STEP OF THE `package` JOB IS FOUND, in the contract's order: the
-#: first YAML step after the one before whose `run:`, `env:` or `with:`
-#: matches. Steps 1 and 2 are the job's first two YAML steps, and step 3
-#: is what lies between them and step 4.
-ANCHORS = (
-    (4, "the test tools", re.compile(r"release-build-requirements\.txt")),
-    (5, "build twice, then compare", re.compile(r"\bpip[ \t]+wheel\b")),
-    (6, "the wheel check", HEREDOC_OPENER),
-    (7, "pipx from its hash lock",
-     re.compile(r"release-pipx-requirements\.txt")),
-    (8, "install the wheel with pipx", re.compile(r"\bpipx[ \t]+install\b")),
-    (9, "the unstamped --version",
-     re.compile(r"openRepoTools[\"']?[ \t]+--version\b")),
-    (10, "an offline --install beside pipx's link",
-     re.compile(r"\bOPENREPOTOOLS_REPO=[\"']?offline\.invalid/sentinel")),
-    (11, "the package's tests, none skipped",
-     re.compile(r"-m[ \t]+pytest[ \t]+tests/test_package\.py\b")),
-)
-REPORT = re.compile(r"package-tests\.xml")
-ORDER = (4, 5, 6, 7, 8, 9, 10, 11, "report")
-
-#: Where the package's files sit in the wheel, and the stamp in the commit.
-PACKAGE = "openrepotools/"
-PAYLOAD = PACKAGE + "payload/"
-STAMP = "src/openrepotools/_release.py"
-FORCE_INCLUDE = "[tool.hatch.build.targets.wheel.force-include]"
-
-#: THE MODE HATCHLING 1.27.0 GIVES WHAT IT WRITES ITSELF, the `.dist-info/`
-#: files: `set_zip_info_mode`'s default, 0644, with no file-type bits. A
-#: file it copies in, a module or a payload file, keeps its type bits, with
-#: its permissions normalised to 0644, or 0755 where the owner may execute
-#: it (clarifications N4).
-WRITTEN_MODE = 0o644
-
-#: The `WHEEL` file hatchling 1.27.0 writes for a pure-Python wheel.
-WHEEL_FILE = (b"Wheel-Version: 1.0\nGenerator: hatchling 1.27.0\n"
-              b"Root-Is-Purelib: true\nTag: py3-none-any\n")
-
-#: THE WHEEL CHECK'S FOUR WHEELS (contracts/workflows.md, step 6). Each case
-#: is the exit the check must give and the name its output must add to the
-#: output the wheel as built gives: the file that is wrong.
-BYTE_TARGET = "skills/handoff/SKILL.md"
-MODE_TARGET = "lanes-index"
-WHEEL_CASES = {
-    "as-built": (0, None),
-    "no-license": (1, "LICENSE"),
-    "payload-byte": (1, BYTE_TARGET),
-    "payload-mode": (1, MODE_TARGET),
-}
-
-#: Every expression a run step may hold, and what the runner gives it.
-EXPRESSION = re.compile(r"\$\{\{\s*([A-Za-z_][\w.-]*)\s*\}\}")
-
-#: An index that never answers, for any pip the fake does not catch.
-OFFLINE_INDEX = "https://offline.invalid/simple"
-
-NEEDS_BASH = pytest.mark.skipif(shutil.which("bash") is None,
-                                reason="the package job's steps are bash")
-
-
-# --- reading the workflow -----------------------------------------------------
-
-def pinned_reader():
-    """The pinned openRepoShape's `scripts/repo_shape.py`, loaded from its
-    own file under a name of this module's, so no other module's
-    `repo_shape` can stand in for it."""
-    spec = importlib.util.spec_from_file_location(
-        "_tests_workflow_repo_shape", str(PINNED_READER))
-    module = importlib.util.module_from_spec(spec)
-    sys.modules[spec.name] = module
-    spec.loader.exec_module(module)
-    return module
-
-
-@pytest.fixture(scope="module")
-def workflow() -> dict:
-    """`tests.yml`, read by the pinned `load_yaml`. A refusal fails the test
-    that asked, naming it: a construct outside the standard's subset is
-    the workflow's to fix (research R9), not this suite's to read around."""
-    reader = pinned_reader()
-    try:
-        loaded = reader.load_yaml(WORKFLOW)
-    except reader.Refusal as refusal:
-        pytest.fail(f"the pinned load_yaml refuses {WORKFLOW.name}: "
-                    f"{refusal}. tests.yml must stay inside openRepoShape's "
-                    f"YAML subset (research R9)", pytrace=False)
-    assert isinstance(loaded, dict), f"{WORKFLOW.name} is not a mapping"
-    return loaded
-
-
-def jobs_of(workflow: dict) -> dict:
-    jobs = workflow.get("jobs")
-    assert isinstance(jobs, dict), f"{WORKFLOW.name} has no `jobs:` mapping"
-    return jobs
-
-
-def package_job(workflow: dict) -> dict:
-    job = jobs_of(workflow).get("package")
-    if not isinstance(job, dict):
-        pytest.fail("tests.yml has no `package` job: contracts/workflows.md "
-                    "adds it, with steps 1 to 11 (T016)", pytrace=False)
-    steps = job.get("steps")
-    if not isinstance(steps, list) or not all(isinstance(s, dict)
-                                              for s in steps):
-        pytest.fail("the package job has no list of steps", pytrace=False)
-    return job
-
-
-def as_text(value) -> str:
-    """A YAML value as the runner hands it to a step."""
-    if value is None:
-        return ""
-    if isinstance(value, bool):
-        return "true" if value else "false"
-    return str(value)
-
-
-def mapping_text(mapping) -> list:
-    return ([f"{key}={as_text(value)}" for key, value in mapping.items()]
-            if isinstance(mapping, dict) else [])
-
-
-def step_text(step: dict) -> str:
-    """What a step does, for finding it: its `env:` and `with:` as
-    `NAME=value` lines, then its `run:`. Never its `name:`, which says
-    what a step is for and not what it does."""
-    return "\n".join(mapping_text(step.get("env"))
-                     + mapping_text(step.get("with"))
-                     + [as_text(step.get("run"))])
-
-
-def commands(script: str) -> list:
-    """A script's command lines as the shell reads them: each continuation
-    joined to the line it continues, comment lines dropped."""
-    joined = re.sub(r"[ \t]*\\\n[ \t]*", " ", script)
-    return [line.strip() for line in joined.splitlines()
-            if line.strip() and not line.strip().startswith("#")]
-
-
-def locate(job: dict) -> dict:
-    """Each numbered step's first YAML step, and the report step's, by
-    `ANCHORS`. Each is looked for only after the one before it, so the
-    steps are in the contract's order, or the test that asked fails naming
-    the first one that is not."""
-    texts = [step_text(step) for step in job["steps"]]
-    found: dict = {}
-    start = 2
-    for number, title, anchor in ANCHORS:
-        hit = next((i for i in range(start, len(texts))
-                    if anchor.search(texts[i])), None)
-        if hit is None:
-            after = (f"after step {number - 1} (YAML step {start - 1})"
-                     if found else "after its checkout and setup-python")
-            pytest.fail(f"the package job has no step {number}, {title}, "
-                        f"{after}: no `run:`, `env:` or `with:` there "
-                        f"matches {anchor.pattern!r} (contracts/workflows.md)",
-                        pytrace=False)
-        found[number], start = hit, hit + 1
-    report = next((i for i in range(start, len(texts))
-                   if REPORT.search(texts[i])), None)
-    if report is None:
-        pytest.fail("the package job has no step after its pytest command "
-                    "that reads `$RUNNER_TEMP/package-tests.xml` (step 11)",
-                    pytrace=False)
-    found["report"] = report
-    return found
-
-
-def region(job: dict, found: dict, number, scope: str = "step") -> str:
-    """The text a check reads: the job's `env:`, and then the YAML steps
-    of step `number` (`step`), every step up to the end of it (`upto`), or
-    the whole job (`job`)."""
-    texts = [step_text(step) for step in job["steps"]]
-    end = (found[ORDER[ORDER.index(number) + 1]] if number != "report"
-           else len(texts))
-    chosen = {"step": texts[found[number]:end], "upto": texts[:end],
-              "job": texts}[scope]
-    return "\n".join(mapping_text(job.get("env")) + chosen)
-
-
-# --- running a step ---------------------------------------------------------------
-
-def git_bytes(*args: str) -> bytes:
-    proc = subprocess.run(["git", *args], cwd=str(REPO), capture_output=True,
-                          check=False)
-    if proc.returncode != 0:
-        raise AssertionError(f"git {' '.join(args)} in {REPO} failed: "
-                             f"{proc.stderr.decode('utf-8', 'replace')}")
-    return proc.stdout
-
-
-class Runner:
-    """The runner's part in a step, offline, under `root`.
-
-    Bash runs the step's script at the repository's root, as `bash -e`, or
-    as `bash --noprofile --norc -eo pipefail` under `shell: bash`, which is
-    what GitHub runs. `$RUNNER_TEMP`, `$HOME` and the four `$GITHUB_*`
-    files are directories and files under `root`, so a step under test
-    never writes into the job that runs this suite; what a step appends to
-    `$GITHUB_ENV` and `$GITHUB_PATH` reaches the steps after it, as on the
-    runner. The job's `env:` and the step's own apply, and the expressions
-    `EXPRESSION` names are filled in. pip is pointed at no index, so a pip
-    nothing fakes can fetch nothing.
-    """
-
-    SCRUBBED = ("GITHUB_", "RUNNER_", "PIP_", "PIPX_", "OPENREPOTOOLS_",
-                "SOURCE_DATE_EPOCH", "BASH_ENV", "PYTHONSTARTUP")
-
-    def __init__(self, workflow: dict, job: dict, root: Path) -> None:
-        self.root = root
-        self.temp = root / "runner-temp"
-        self.home = root / "home"
-        self.scripts = root / "scripts"
-        for directory in (self.temp, self.home, self.scripts):
-            directory.mkdir(parents=True)
-        self.files = {name: root / f"{name.lower()}.txt"
-                      for name in ("GITHUB_ENV", "GITHUB_PATH",
-                                   "GITHUB_OUTPUT", "GITHUB_STEP_SUMMARY")}
-        env = {key: value for key, value in os.environ.items()
-               if not key.startswith(self.SCRUBBED)}
-        env.update({
-            "RUNNER_TEMP": str(self.temp), "HOME": str(self.home),
-            "GITHUB_WORKSPACE": str(REPO), "GITHUB_SHA": Head.sha_of(),
-            "CI": "true", "PIP_NO_INDEX": "1", "PIP_INDEX_URL": OFFLINE_INDEX,
-            "PIP_CONFIG_FILE": os.devnull,
-            "PIP_DISABLE_PIP_VERSION_CHECK": "1",
-            "PYTHONDONTWRITEBYTECODE": "1"})
-        for name, path in self.files.items():
-            path.write_text("", encoding="utf-8")
-            env[name] = str(path)
-        self.env = env
-        self.shell = ((job.get("defaults") or {}).get("run") or {}).get(
-            "shell") or ((workflow.get("defaults") or {}).get("run")
-                         or {}).get("shell")
-        for key, value in (job.get("env") or {}).items():
-            self.env[key] = self.evaluate(value)
-        self.count = 0
-
-    def evaluate(self, value) -> str:
-        def one(match):
-            name = match.group(1)
-            if name == "runner.temp":
-                return str(self.temp)
-            if name == "github.workspace":
-                return str(REPO)
-            if name == "github.sha":
-                return self.env["GITHUB_SHA"]
-            if name.startswith("env."):
-                return self.env.get(name[len("env."):], "")
-            pytest.fail(f"a step holds the expression `${{{{ {name} }}}}`, "
-                        f"which this test cannot give a value offline",
-                        pytrace=False)
-        return EXPRESSION.sub(one, as_text(value))
-
-    def run(self, step: dict, script: str | None = None):
-        """Run `step`'s `run:`, or `script` in its place, and return the
-        finished process, its output as text."""
-        self.count += 1
-        env = dict(self.env)
-        for key, value in (step.get("env") or {}).items():
-            env[key] = self.evaluate(value)
-        text = self.evaluate(step.get("run") if script is None else script)
-        path = self.scripts / f"step-{self.count}.sh"
-        path.write_text(text, encoding="utf-8")
-        shell = step.get("shell") or self.shell
-        if not shell:
-            argv = ["bash", "-e", str(path)]
-        elif shell == "bash":
-            argv = ["bash", "--noprofile", "--norc", "-eo", "pipefail",
-                    str(path)]
-        else:
-            pytest.fail(f"a step asks for `shell: {shell}`, and this test "
-                        f"runs bash steps alone", pytrace=False)
-        cwd = REPO / as_text(step.get("working-directory") or ".")
-        proc = subprocess.run(argv, cwd=str(cwd), env=env,
-                              capture_output=True, text=True, timeout=300,
-                              check=False)
-        self.absorb()
-        return proc
-
-    def absorb(self) -> None:
-        """`$GITHUB_ENV`'s `NAME=value` and `NAME<<DELIMITER` entries, and
-        `$GITHUB_PATH`'s directories, into the environment of the steps
-        after; then both files are empty again, as each step finds them."""
-        lines = self.files["GITHUB_ENV"].read_text(encoding="utf-8").split("\n")
-        at = 0
-        while at < len(lines):
-            line = lines[at]
-            at += 1
-            if "<<" in line and ("=" not in line
-                                 or line.index("<<") < line.index("=")):
-                name, delimiter = line.split("<<", 1)
-                value = []
-                while at < len(lines) and lines[at] != delimiter:
-                    value.append(lines[at])
-                    at += 1
-                at += 1
-                self.env[name] = "\n".join(value)
-            elif "=" in line:
-                name, value = line.split("=", 1)
-                self.env[name] = value
-        for line in self.files["GITHUB_PATH"].read_text(
-                encoding="utf-8").splitlines():
-            if line.strip():
-                self.env["PATH"] = line.strip() + os.pathsep + self.env["PATH"]
-        for name in ("GITHUB_ENV", "GITHUB_PATH"):
-            self.files[name].write_text("", encoding="utf-8")
-
-    def lines(self, proc) -> list:
-        """The process's output, stdout then stderr, one entry per line,
-        with this runner's own directory written as `<root>`, so that two
-        runners' outputs can be compared line for line."""
-        text = proc.stdout + "\n" + proc.stderr
-        for spelling in {str(self.root.resolve()), str(self.root)}:
-            text = text.replace(spelling, "<root>")
-        return [line.strip() for line in text.splitlines() if line.strip()]
-
-
-def shown(proc) -> str:
-    return (f"exit {proc.returncode}\n--- stdout ---\n{proc.stdout}"
-            f"\n--- stderr ---\n{proc.stderr}")
-
-
-# --- the lock ------------------------------------------------------------------
-
-def lock_entries(text: str) -> dict:
-    """`name==version ; marker` -> its sha256 digests, from a hash lock's
-    text: continuation lines joined, comment lines dropped."""
-    kept = "\n".join(line for line in text.splitlines()
-                     if not line.lstrip().startswith("#"))
-    entries = {}
-    for entry in re.sub(r"\\\n", " ", kept).splitlines():
-        if entry.strip():
-            requirement = entry.split("--hash=")[0].strip()
-            entries[requirement] = re.findall(r"--hash=sha256:(\S+)", entry)
-    return entries
-
-
-def build_lock_tomli() -> tuple:
-    """The build lock's one `tomli` entry: its requirement line, as the
-    lock writes it, and its digests."""
-    entries = lock_entries(BUILD_LOCK.read_text(encoding="utf-8"))
-    tomli = [name for name in entries if name.startswith("tomli==")]
-    assert len(tomli) == 1, (f"{BUILD_LOCK.name} holds {len(tomli)} tomli "
-                             f"entries, not one: {tomli}")
-    assert entries[tomli[0]], f"{BUILD_LOCK.name}'s {tomli[0]} has no hash"
-    return tomli[0], entries[tomli[0]]
-
-
-#: A FAKE `pip`, and a `python3` that is one for `-m pip` alone. Each call
-#: is one JSON line in `$FAKE_PIP_LOG`: its arguments, and the text of each
-#: requirement file it names, read when it ran. Nothing is installed. Any
-#: other `python3` call is the real interpreter's.
-FAKE_PIP = r'''#!@PYTHON@
-"""A fake pip for tests/test_tests_workflow.py: it records, and installs nothing."""
-import json
-import os
-import sys
-
-REAL = @REAL@
-
-
-def record(args):
-    files = {}
-    at = 0
-    while at < len(args):
-        arg, name = args[at], None
-        if arg in ("-r", "--requirement") and at + 1 < len(args):
-            name = args[at + 1]
-            at += 1
-        elif arg.startswith("--requirement="):
-            name = arg.split("=", 1)[1]
-        elif arg.startswith("-r") and len(arg) > 2:
-            name = arg[2:]
-        if name is not None:
-            path = os.path.abspath(name)
-            try:
-                with open(path, encoding="utf-8") as handle:
-                    files[path] = handle.read()
-            except OSError:
-                files[path] = None
-        at += 1
-    with open(os.environ["FAKE_PIP_LOG"], "a", encoding="utf-8") as log:
-        log.write(json.dumps({"args": args, "files": files}) + "\n")
-
-
-args = sys.argv[1:]
-if os.path.basename(sys.argv[0]).startswith("pip"):
-    record(args)
-    sys.exit(0)
-at = 0
-while at < len(args) and args[at].startswith("-") and args[at] not in ("-", "-m", "-c"):
-    at += 1
-if args[at:at + 2] == ["-m", "pip"]:
-    record(args[at + 2:])
-    sys.exit(0)
-os.execv(REAL, [REAL] + args)
-'''
-
-
-def fake_pip(directory: Path) -> Path:
-    directory.mkdir(parents=True)
-    text = (FAKE_PIP.replace("@PYTHON@", sys.executable)
-            .replace("@REAL@", repr(sys.executable)))
-    for name in ("python3", "python", "pip", "pip3"):
-        path = directory / name
-        path.write_text(text, encoding="utf-8")
-        path.chmod(0o755)
-    return directory
-
-
-def pip_command(args: list) -> str:
-    return next((arg for arg in args if not arg.startswith("-")), "")
-
-
-def only_binary_all(args: list) -> bool:
-    return ("--only-binary=:all:" in args
-            or any(a == "--only-binary" and b == ":all:"
-                   for a, b in zip(args, args[1:])))
-
-
-# --- HEAD's own files, and the wheels made of them ------------------------------
-
-class Head:
-    """HEAD's files, read from git and never from the working tree: the
-    blobs and modes a wheel built at that commit is checked against."""
-
-    @staticmethod
-    def sha_of() -> str:
-        return git_bytes("rev-parse", "HEAD").decode("ascii").strip()
-
-    def __init__(self) -> None:
-        self.sha = self.sha_of()
-        self.epoch = int(git_bytes("log", "-1", "--format=%ct", "HEAD")
-                         .decode("ascii").strip())
-        self.modes = {}
-        for entry in git_bytes("ls-tree", "-r", "-z", "--full-tree",
-                               "HEAD").split(b"\0"):
-            if entry:
-                meta, path = entry.split(b"\t", 1)
-                mode, kind, _ = meta.decode("ascii").split(" ")
-                if kind == "blob":
-                    self.modes[path.decode("utf-8")] = mode
-        self._blobs: dict = {}
-        pyproject = self.blob("pyproject.toml").decode("utf-8")
-        self.payload = force_include_paths(pyproject)
-        self.modules = tuple(sorted(
-            path for path in self.modes
-            if re.fullmatch(r"src/openrepotools/[^/]+\.py", path)))
-        self.version = stamp_version(self.blob(STAMP).decode("utf-8"))
-        self.project = toml_table(pyproject, "project")
-        self.scripts = toml_table(pyproject, "project.scripts")
-        self.dist_info = f"openrepotools-{self.version}.dist-info/"
-        self.wheel_name = f"openrepotools-{self.version}-py3-none-any.whl"
-
-    def blob(self, path: str) -> bytes:
-        if path not in self.modes:
-            raise AssertionError(f"HEAD has no file {path}")
-        if path not in self._blobs:
-            self._blobs[path] = git_bytes("cat-file", "blob", f"HEAD:{path}")
-        return self._blobs[path]
-
-    def zip_mode(self, path: str) -> int:
-        """The mode hatchling 1.27.0 gives a file it copies in: a regular
-        file at 0755 where git records `100755`, and at 0644 otherwise."""
-        mode = self.modes[path]
-        if mode not in ("100755", "100644"):
-            raise AssertionError(f"{path} is {mode} at HEAD, neither 100755 "
-                                 "nor 100644")
-        return 0o100755 if mode == "100755" else 0o100644
-
-    def metadata(self, license_file: bool = True) -> bytes:
-        lines = ["Metadata-Version: 2.4", f"Name: {self.project['name']}",
-                 f"Version: {self.version}",
-                 f"License-Expression: {self.project['license']}"]
-        if license_file:
-            lines.append("License-File: LICENSE")
-        lines.append(f"Requires-Python: {self.project['requires-python']}")
-        return ("\n".join(lines) + "\n").encode("utf-8")
-
-    def entry_points(self) -> bytes:
-        return ("[console_scripts]\n" + "".join(
-            f"{name} = {ref}\n" for name, ref in self.scripts.items())
-        ).encode("utf-8")
-
-
-def force_include_paths(pyproject: str) -> tuple:
-    """`<P>` of each `"<P>" = "openrepotools/payload/<P>"` in the
-    force-include table, in order: read by line, so that it reads the same
-    on a Python with no `tomllib`, and held to `tomllib` where there is one."""
-    lines = pyproject.split("\n")
-    headers = [i for i, line in enumerate(lines)
-               if line.strip() == FORCE_INCLUDE]
-    assert len(headers) == 1, f"HEAD's pyproject.toml has {len(headers)} " \
-                              f"{FORCE_INCLUDE} tables, not one"
-    entry = re.compile(r'"([^"\\]+)" = "([^"\\]+)"')
-    paths = []
-    for line in lines[headers[0] + 1:]:
-        line = line.strip()
-        if line.startswith("["):
-            break
-        if not line or line.startswith("#"):
-            continue
-        match = entry.fullmatch(line)
-        assert match and match.group(2) == PAYLOAD + match.group(1), (
-            f"HEAD's force-include table holds a line this test does not "
-            f"read: {line}")
-        paths.append(match.group(1))
-    try:
-        import tomllib
-    except ImportError:
-        return tuple(paths)
-    table = (tomllib.loads(pyproject)["tool"]["hatch"]["build"]["targets"]
-             ["wheel"]["force-include"])
-    assert list(table) == paths, "the force-include table reads one way by " \
-                                 "line and another by tomllib"
-    return tuple(paths)
-
-
-def toml_table(pyproject: str, name: str) -> dict:
-    """The `key = "value"` lines of one table, read by line."""
-    values, inside = {}, False
-    for line in pyproject.splitlines():
-        stripped = line.strip()
-        if stripped.startswith("["):
-            inside = stripped == f"[{name}]"
-            continue
-        match = re.fullmatch(r'"?([A-Za-z0-9_.-]+)"? = "([^"]*)"', stripped)
-        if inside and match:
-            values[match.group(1)] = match.group(2)
-    return values
-
-
-def stamp_version(text: str) -> str:
-    versions = re.findall(r'(?m)^VERSION = "([^"]*)"$', text)
-    assert len(versions) == 1, f"HEAD's {STAMP} holds {len(versions)} " \
-                               "VERSION lines, not one"
-    return versions[0]
-
-
-@pytest.fixture(scope="module")
-def head() -> Head:
-    return Head()
-
-
-def built_members(head: Head) -> dict:
-    """The wheel `pip wheel` builds at HEAD, as hatchling 1.27.0 lays it
-    out: each member's name -> (bytes, zip mode), RECORD aside."""
-    members = {}
-    for path in head.modules:
-        members[PACKAGE + path.rsplit("/", 1)[1]] = (head.blob(path),
-                                                     head.zip_mode(path))
-    for rel in head.payload:
-        members[PAYLOAD + rel] = (head.blob(rel), head.zip_mode(rel))
-    info = head.dist_info
-    members[info + "WHEEL"] = (WHEEL_FILE, WRITTEN_MODE)
-    members[info + "entry_points.txt"] = (head.entry_points(), WRITTEN_MODE)
-    members[info + "METADATA"] = (head.metadata(), WRITTEN_MODE)
-    members[info + "licenses/LICENSE"] = (head.blob("LICENSE"), WRITTEN_MODE)
-    return members
-
-
-def case_members(head: Head, case: str) -> dict:
-    """The wheel as built, with what `case` changes."""
-    members = built_members(head)
-    info = head.dist_info
-    if case == "no-license":
-        del members[info + "licenses/LICENSE"]
-        members[info + "METADATA"] = (head.metadata(license_file=False),
-                                      WRITTEN_MODE)
-    elif case == "payload-byte":
-        assert PAYLOAD + BYTE_TARGET in members, (
-            f"{BYTE_TARGET} is no longer a payload file: pick another")
-        data, mode = members[PAYLOAD + BYTE_TARGET]
-        changed = bytearray(data)
-        changed[len(changed) // 2] ^= 0x01
-        members[PAYLOAD + BYTE_TARGET] = (bytes(changed), mode)
-    elif case == "payload-mode":
-        assert members.get(PAYLOAD + MODE_TARGET, (b"", 0))[1] == 0o100755, (
-            f"{MODE_TARGET} is no longer an executable payload file: pick "
-            "another")
-        members[PAYLOAD + MODE_TARGET] = (members[PAYLOAD + MODE_TARGET][0],
-                                          0o100644)
-    else:
-        assert case == "as-built", case
-    return members
-
-
-def write_wheel(path: Path, head: Head, members: dict) -> None:
-    """`members`, and the RECORD of them, as one zip at the commit's time."""
-    when = datetime.fromtimestamp(max(head.epoch, 315532800), timezone.utc)
-    record = []
-    for name, (data, _) in members.items():
-        digest = base64.urlsafe_b64encode(hashlib.sha256(data).digest())
-        record.append(f"{name},sha256={digest.rstrip(b'=').decode()},"
-                      f"{len(data)}")
-    record.append(f"{head.dist_info}RECORD,,")
-    entries = dict(members)
-    entries[head.dist_info + "RECORD"] = (
-        ("\n".join(record) + "\n").encode("utf-8"), WRITTEN_MODE)
-    with zipfile.ZipFile(path, "w") as wheel:
-        for name, (data, mode) in entries.items():
-            info = zipfile.ZipInfo(name, when.timetuple()[:6])
-            info.external_attr = mode << 16
-            info.compress_type = zipfile.ZIP_DEFLATED
-            wheel.writestr(info, data)
-
-
-def wheel_check_script(step: dict) -> tuple:
-    """Step 6's script up to and including its heredoc's closing `PY`, and
-    the heredoc's Python."""
-    script = as_text(step.get("run"))
-    lines = script.split("\n")
-    openers = [i for i, line in enumerate(lines)
-               if HEREDOC_OPENER.fullmatch(line)]
-    assert len(openers) == 1, (f"step 6's YAML step opens {len(openers)} "
-                               f"`python3 - <<'PY'` heredocs, not one")
-    start = openers[0]
-    assert "PY" in lines[start + 1:], "step 6's heredoc has no closing `PY`"
-    end = lines.index("PY", start + 1)
-    return ("\n".join(lines[:end + 1]) + "\n",
-            "\n".join(lines[start + 1:end]) + "\n")
-
-
-def run_wheel_check(workflow: dict, head: Head, root: Path, members: dict):
-    """Step 6, over the wheel `members` make, placed where step 5 leaves its
-    two builds: the finished process and its runner."""
-    job = package_job(workflow)
-    step = job["steps"][locate(job)[6]]
-    script, _ = wheel_check_script(step)
-    runner = Runner(workflow, job, root)
-    first = runner.temp / "a" / head.wheel_name
-    first.parent.mkdir()
-    write_wheel(first, head, members)
-    (runner.temp / "b").mkdir()
-    shutil.copyfile(first, runner.temp / "b" / head.wheel_name)
-    return runner.run(step, script=script), runner
-
-
-# --- the triggers and the jobs ---------------------------------------------------
-
-@NEEDS_UPSTREAM
-def test_tests_yml_push_runs_on_main_and_every_release_branch(workflow):
-    """FR-025: a push to `main` or to any `release/v*` branch runs the
-    workflow, and nothing else about `push` is filtered."""
-    assert workflow.get("on", {}).get("push") == PUSH, (
-        f"`on.push` is {workflow.get('on', {}).get('push')!r}, not {PUSH!r}")
-
-
-@NEEDS_UPSTREAM
-def test_tests_yml_its_other_triggers_are_unchanged(workflow):
-    """`pull_request` with `labeled` beside GitHub's three defaults, the
-    nightly cron at 04:17 UTC and `workflow_dispatch`, and no trigger
-    besides those and `push`."""
-    on = workflow.get("on")
-    assert isinstance(on, dict), "tests.yml has no `on:` mapping"
-    assert sorted(on) == sorted(["pull_request", "push", "schedule",
-                                 "workflow_dispatch"]), sorted(on)
-    assert on["pull_request"] == PULL_REQUEST, on["pull_request"]
-    assert on["schedule"] == SCHEDULE, on["schedule"]
-    assert on["workflow_dispatch"] is None, on["workflow_dispatch"]
-
-
-@NEEDS_UPSTREAM
-def test_tests_yml_has_exactly_the_four_gate_jobs(workflow):
-    """The release gate's four ids (FR-046) and no fifth. None has a
-    `name:`, so each check run is named by its id, and none has an `if:`,
-    so every trigger runs all four."""
-    jobs = jobs_of(workflow)
-    assert sorted(jobs) == sorted(JOB_IDS), (
-        f"the jobs are {list(jobs)}, not {list(JOB_IDS)}")
-    for job_id in JOB_IDS:
-        assert "name" not in jobs[job_id], f"`{job_id}` has a `name:`"
-        assert "if" not in jobs[job_id], f"`{job_id}` has an `if:`"
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("job_id", sorted(EXISTING_JOBS))
-def test_tests_yml_existing_job_keeps_todays_runner_checkout_python_and_runs(
-        workflow, job_id):
-    """The three jobs the contract leaves byte for byte keep today's
-    runner, checkout options, Python and `run:` commands."""
-    job = jobs_of(workflow).get(job_id)
-    assert isinstance(job, dict), f"tests.yml has no `{job_id}` job"
-    want = EXISTING_JOBS[job_id]
-    steps = job.get("steps") or []
-    assert job.get("runs-on") == "ubuntu-24.04", job.get("runs-on")
-    assert len(steps) >= 2, f"`{job_id}` has {len(steps)} steps"
-    assert steps[0].get("uses") == CHECKOUT, steps[0]
-    assert steps[0].get("with") == want["checkout"], steps[0].get("with")
-    assert steps[1].get("uses") == SETUP_PYTHON, steps[1]
-    assert steps[1].get("with") == {"python-version": want["python"]}, \
-        steps[1].get("with")
-    runs = [step["run"] for step in steps if "run" in step]
-    assert runs == want["runs"], f"`{job_id}`'s `run:` commands moved: {runs}"
-
-
-def test_tests_yml_header_comment_names_both_push_branches_and_four_jobs():
-    """FR-025: the comment above `on:` says that `push` covers `main` and
-    every `release/v*` branch, and names the four jobs every trigger runs.
-    It no longer says "(main only)" or "those same three jobs". Read as
-    text, since a comment is not data, and with each job id in backticks,
-    as the file writes every one."""
-    lines = WORKFLOW.read_text(encoding="utf-8").splitlines()
-    assert "on:" in lines, "tests.yml has no `on:` line"
-    at = lines.index("on:")
-    block = []
-    while at > 0 and lines[at - 1].startswith("#"):
-        at -= 1
-        block.insert(0, lines[at])
-    text = " ".join(line.lstrip("#").strip() for line in block)
-    assert block, "tests.yml has no comment directly above `on:`"
-    assert re.search(r"\bmain\b", text), f"the header names no `main`: {text}"
-    assert "release/v*" in text, f"the header names no `release/v*`: {text}"
-    missing = [job_id for job_id in JOB_IDS if f"`{job_id}`" not in text]
-    assert not missing, f"the header names no {missing}: {text}"
-    for stale in ("(main only)", "same three"):
-        assert stale not in text, f"the header still says {stale!r}: {text}"
-
-
-def test_tests_yml_holds_no_digest_of_its_own():
-    """tests.yml holds no digest of tomli's. The build lock's entry is copied
-    at run time, and the pipx lock carries the same entry (research R12): no
-    `--hash=sha256:` and no 64-digit hex string anywhere in the file."""
-    text = WORKFLOW.read_text(encoding="utf-8")
-    assert not re.search(r"--hash[= ]sha256:", text), "tests.yml holds a --hash"
-    digests = re.findall(r"(?<![0-9A-Fa-f])[0-9A-Fa-f]{64}(?![0-9A-Fa-f])",
-                         text)
-    assert not digests, f"tests.yml holds a digest of its own: {digests}"
-
-
-# --- the package job, read ------------------------------------------------------
-
-@NEEDS_UPSTREAM
-def test_tests_yml_package_runs_on_ubuntu_python_3_9_with_the_submodule(
-        workflow):
-    """Steps 1 and 2: the pinned checkout, with `submodules: true` and
-    `fetch-depth: 1`, then the pinned setup-python at `'3.9'`, the oldest
-    Python the package supports, on ubuntu."""
-    job = package_job(workflow)
-    steps = job["steps"]
-    assert job.get("runs-on") == "ubuntu-24.04", job.get("runs-on")
-    assert len(steps) >= 2, f"the package job has {len(steps)} steps"
-    assert steps[0].get("uses") == CHECKOUT, steps[0]
-    assert steps[0].get("with") == {"submodules": True, "fetch-depth": 1}, \
-        steps[0].get("with")
-    assert steps[1].get("uses") == SETUP_PYTHON, steps[1]
-    assert steps[1].get("with") == {"python-version": "3.9"}, (
-        f"{steps[1].get('with')!r}: the version is the string '3.9', "
-        "quoted, as a bare 3.9 is a number")
-
-
-@NEEDS_UPSTREAM
-def test_tests_yml_package_carries_steps_4_to_11_in_order(workflow):
-    """Steps 4 to 11, each its own YAML step or steps, in the contract's
-    order, with step 11's report read in a step after its pytest command."""
-    found = locate(package_job(workflow))
-    indices = [found[key] for key in ORDER]
-    assert indices == sorted(set(indices)), found
-
-
-def source_date_epoch_reaches_pip(text: str) -> bool:
-    """`SOURCE_DATE_EPOCH` is exported, or set on each `pip wheel` command:
-    an assignment alone never reaches the build."""
-    if re.search(r"\bexport[ \t]+SOURCE_DATE_EPOCH\b", text):
-        return True
-    builds = [cmd for cmd in commands(text) if re.search(r"\bpip\s+wheel\b",
-                                                         cmd)]
-    return bool(builds) and all(cmd.startswith("SOURCE_DATE_EPOCH=")
-                                for cmd in builds)
-
-
-def runs_the_pytest_command(text: str) -> bool:
-    """A command that is `PYTEST_COMMAND`, word for word as the shell splits
-    it, after any `NAME=value` set on it."""
-    want = shlex.split(PYTEST_COMMAND)
-    for command in commands(text):
-        try:
-            words = shlex.split(command)
-        except ValueError:
-            continue
-        while words and (words[0] == "env" or re.fullmatch(
-                r"[A-Za-z_][A-Za-z0-9_]*=.*", words[0])):
-            words.pop(0)
-        if words == want:
-            return True
-    return False
-
-
-def has(pattern: str):
-    compiled = re.compile(pattern)
-    return lambda text: compiled.search(text) is not None
-
-
-def has_all(*parts: str):
-    return lambda text: all(part in text for part in parts)
-
-
-#: WHAT EACH STEP MUST SAY, from the contract's own words: per step, what
-#: is checked, where (`step`: its own YAML steps; `upto`: every step up to
-#: its end; `job`: the whole job; each with the job's `env:`), and how.
-STEP_CHECKS = {
-    4: (
-        ("names tomli", "step", has(r"\btomli\b")),
-        ("installs by hash, --require-hashes", "step", has(r"--require-hashes")),
-        ("wheels only, --only-binary=:all:", "step",
-         has(r"--only-binary[= ]:all:")),
-        ("from a file under $RUNNER_TEMP", "step", has(RT)),
-        ("then installs pytest==8.3.4", "step", has(r"pytest==8\.3\.4")),
-    ),
-    5: (
-        ('SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"', "step",
-         has(re.escape('SOURCE_DATE_EPOCH="$(git log -1 --format=%ct HEAD)"'))),
-        ("which reaches both builds, exported or set on each", "step",
-         source_date_epoch_reaches_pip),
-        ("pip wheel --no-deps", "step", has(r"--no-deps")),
-        ('into "$RUNNER_TEMP/a"', "step", has(RT + r"[\"']?/a\b")),
-        ('and into "$RUNNER_TEMP/b"', "step", has(RT + r"[\"']?/b\b")),
-        ("the two compared with cmp", "step", has(r"\bcmp\b")),
-    ),
-    7: (
-        ("pipx by hash, --require-hashes", "step", has(r"--require-hashes")),
-        ("wheels only, --only-binary=:all:", "step",
-         has(r"--only-binary[= ]:all:")),
-        ("PIPX_HOME under $RUNNER_TEMP", "job",
-         has(r"\bPIPX_HOME=[\"']?" + RT)),
-        ("PIPX_BIN_DIR under $RUNNER_TEMP", "job",
-         has(r"\bPIPX_BIN_DIR=[\"']?" + RT)),
-    ),
-    8: (
-        ("the link openRepoTools in PIPX_BIN_DIR", "step",
-         has_all("PIPX_BIN_DIR", "openRepoTools")),
-    ),
-    9: tuple((f"the line `{line.strip()}`", "step", has_all(line.strip()))
-             for line in UNSTAMPED_VERSION),
-    10: (
-        ('OPENREPOTOOLS_BIN_DIR="$PIPX_BIN_DIR"', "step",
-         has(r"\bOPENREPOTOOLS_BIN_DIR=[\"']?(?:\$\{?PIPX_BIN_DIR\}?"
-             r"|\$\{\{\s*env\.PIPX_BIN_DIR\s*\}\})")),
-        ("runs --install", "step", has(r"--install\b")),
-        ("with HOME a fresh directory", "step",
-         has(r"(?<![A-Za-z0-9_])HOME=")),
-        ("a PATH first holding a gh and a curl that exit 1", "step",
-         lambda text: all(re.search(p, text) for p in (
-             r"\bgh\b", r"\bcurl\b", r"exit 1(?![0-9])", r"\bPATH="))),
-        ("the skip line, exactly", "step", has_all(*SKIP_LINE_PARTS)),
-        ("the count line, exactly", "step", has_all(*COUNT_LINE_PARTS)),
-        ("28 receipt rows", "step", has(r"\b28\b")),
-    ),
-    11: (
-        (f"runs `{PYTEST_COMMAND}`", "step", runs_the_pytest_command),
-        ("with OPENREPOTOOLS_TEST_WHEEL the built wheel", "upto",
-         has(r"\bOPENREPOTOOLS_TEST_WHEEL\b")),
-    ),
-}
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("number", sorted(STEP_CHECKS),
-                         ids=[f"step-{n}" for n in sorted(STEP_CHECKS)])
-def test_tests_yml_package_step_says_what_the_contract_says(workflow, number):
-    """What contracts/workflows.md writes for each of steps 4 to 11, read
-    from the step itself. Steps 4, 6 and 11's report are also run, below."""
-    job = package_job(workflow)
-    found = locate(job)
-    missing = [what for what, scope, check in STEP_CHECKS[number]
-               if not check(region(job, found, number, scope))]
-    assert not missing, (f"step {number} of the package job does not say: "
-                         f"{missing}\n--- the step ---\n"
-                         f"{region(job, found, number)}")
-
-
-@NEEDS_UPSTREAM
-@WINDOWS_SKIP
-@NEEDS_BASH
-def test_tests_yml_package_sets_the_git_identity_by_environment(
-        workflow, tmp_path):
-    """Step 3: the identity the `tests` job gives the fixture commits, by
-    the environment, here the job's `env:` or what the steps before step 4
-    append to `$GITHUB_ENV`, which are run to see it. Never by
-    `git config --global` anywhere in the job."""
-    job = package_job(workflow)
-    found = locate(job)
-    runner = Runner(workflow, job, tmp_path)
-    for step in job["steps"][2:found[4]]:
-        if "run" in step:
-            proc = runner.run(step)
-            assert proc.returncode == 0, shown(proc)
-    got = {name: runner.env.get(name) for name in GIT_IDENTITY}
-    assert got == GIT_IDENTITY, f"before step 4 the identity is {got}"
-    texts = [step_text(step) for step in job["steps"]]
-    assert not [t for t in texts if re.search(r"\bgit\s+config\b[^\n]*--global",
-                                              t)], "the job runs git config --global"
-
-
-# --- the package job, run ----------------------------------------------------------
-
-@NEEDS_UPSTREAM
-@WINDOWS_SKIP
-@NEEDS_BASH
-def test_tests_yml_package_tomli_is_the_build_locks_own_entry_with_every_hash(
-        workflow, tmp_path):
-    """Step 4, run under a fake pip: its first install is by hash, wheels
-    only, from a file under `$RUNNER_TEMP` holding the build lock's whole
-    `tomli` entry, its requirement line and every one of its digests, and
-    nothing else; pytest==8.3.4 is installed after it. With no digest in
-    tests.yml itself, the entry can only have come from the lock."""
-    job = package_job(workflow)
-    found = locate(job)
-    requirement, digests = build_lock_tomli()
-    runner = Runner(workflow, job, tmp_path / "run")
-    log = tmp_path / "pip-calls.jsonl"
-    runner.env["PATH"] = (str(fake_pip(tmp_path / "fakes")) + os.pathsep
-                          + runner.env["PATH"])
-    runner.env["FAKE_PIP_LOG"] = str(log)
-    procs = [runner.run(step) for step in job["steps"][found[4]:found[5]]]
-    said = "\n".join(shown(proc) for proc in procs)
-    calls = ([json.loads(line) for line in log.read_text(
-        encoding="utf-8").splitlines()] if log.is_file() else [])
-    installs = [call for call in calls if pip_command(call["args"]) == "install"]
-    assert installs, f"step 4 ran no pip install:\n{said}"
-    first = installs[0]
-    assert "--require-hashes" in first["args"], (
-        f"step 4's first pip install is not by hash: {first['args']}\n{said}")
-    assert only_binary_all(first["args"]), (
-        f"step 4's first pip install is not wheels only: {first['args']}")
-    assert len(first["files"]) == 1, (
-        f"step 4's first install names {len(first['files'])} requirement "
-        f"files, not one: {first['args']}")
-    [(path, text)] = first["files"].items()
-    assert text is not None, f"step 4 named {path}, which it never wrote"
-    assert Path(path).resolve().is_relative_to(runner.temp.resolve()), (
-        f"{path} is not under $RUNNER_TEMP")
-    entries = lock_entries(text)
-    assert list(entries) == [requirement], (
-        f"step 4 installs {list(entries)}, not the lock's {requirement!r}:\n"
-        f"{text}")
-    assert sorted(entries[requirement]) == sorted(digests), (
-        f"step 4's tomli carries {len(entries[requirement])} digests, and the "
-        f"lock's entry {len(digests)}: every hash, and only those")
-    later = [call for call in installs[1:]
-             if "pytest==8.3.4" in call["args"]
-             or any("pytest==8.3.4" in (body or "")
-                    for body in call["files"].values())]
-    assert later, f"step 4 installs no pytest==8.3.4 after tomli:\n{said}"
-
-
-@NEEDS_UPSTREAM
-def test_tests_yml_package_wheel_check_parses_as_python_3_9(workflow):
-    """Step 6's heredoc runs on the job's Python, 3.9: it must parse there."""
-    job = package_job(workflow)
-    _, body = wheel_check_script(job["steps"][locate(job)[6]])
-    ast.parse(body, filename="step 6's heredoc", feature_version=(3, 9))
-
-
-@NEEDS_UPSTREAM
-@WINDOWS_SKIP
-@NEEDS_BASH
-def test_tests_yml_package_wheel_check_passes_the_wheel_as_built(
-        workflow, head, tmp_path):
-    """Step 6 over the wheel `pip wheel` builds at HEAD, made here from
-    HEAD's blobs and modes: it passes, exit 0."""
-    proc, _ = run_wheel_check(workflow, head, tmp_path, built_members(head))
-    assert proc.returncode == 0, shown(proc)
-
-
-@NEEDS_UPSTREAM
-@WINDOWS_SKIP
-@NEEDS_BASH
-@pytest.mark.parametrize("case", [c for c in WHEEL_CASES if c != "as-built"])
-def test_tests_yml_package_wheel_check_refuses_a_wheel_that_is_not_the_commits(
-        workflow, head, tmp_path, case):
-    """Step 6 over the wheel as built with one thing wrong: no
-    `licenses/LICENSE`, a payload file with one byte changed, or a payload
-    file that lost its execute bit. It exits 1, and what it prints beyond
-    what the wheel as built gives names the file that is wrong."""
-    built, built_runner = run_wheel_check(workflow, head, tmp_path / "built",
-                                          built_members(head))
-    assert built.returncode == 0, ("the wheel as built does not pass, so "
-                                   "this case proves nothing:\n" + shown(built))
-    proc, runner = run_wheel_check(workflow, head, tmp_path / "case",
-                                   case_members(head, case))
-    code, name = WHEEL_CASES[case]
-    assert proc.returncode == code, shown(proc)
-    before = set(built_runner.lines(built))
-    new = [line for line in runner.lines(proc) if line not in before]
-    assert any(name in line for line in new), (
-        f"the check refused, and named no {name}:\n" + shown(proc))
-
-
-def junit_report(tests: int, skipped: int = 0, failures: int = 0,
-                 errors: int = 0) -> str:
-    """A report as pytest 8.3.4's `--junitxml` writes one."""
-    cases = []
-    for number in range(tests):
-        inner = ""
-        if number < skipped:
-            inner = '<skipped type="pytest.skip" message="a reason">a reason</skipped>'
-        elif number < skipped + failures:
-            inner = '<failure message="assert False">assert False</failure>'
-        elif number < skipped + failures + errors:
-            inner = '<error message="failed on setup">failed on setup</error>'
-        cases.append(f'<testcase classname="tests.test_package" '
-                     f'name="test_{number}" time="0.001">{inner}</testcase>')
-    return ('<?xml version="1.0" encoding="utf-8"?>'
-            '<testsuites name="pytest tests"><testsuite name="pytest" '
-            f'errors="{errors}" failures="{failures}" skipped="{skipped}" '
-            f'tests="{tests}" time="0.010" '
-            'timestamp="2026-10-18T00:00:00.000000+00:00" hostname="runner">'
-            + "".join(cases) + "</testsuite></testsuites>\n")
-
-
-@NEEDS_UPSTREAM
-@WINDOWS_SKIP
-@NEEDS_BASH
-@pytest.mark.parametrize("report, passes", [
-    ({"tests": 3}, True),
-    ({"tests": 0}, False),
-    ({"tests": 3, "skipped": 1}, False),
-    ({"tests": 3, "failures": 1}, False),
-    ({"tests": 3, "errors": 1}, False),
-], ids=["three-ran", "none-ran", "one-skipped", "one-failed", "one-error"])
-def test_tests_yml_package_report_step_fails_on_any_skip_or_none_run(
-        workflow, tmp_path, report, passes):
-    """Step 11's report step, over a JUnit report at
-    `$RUNNER_TEMP/package-tests.xml`: it passes only with at least one test
-    and no skip, failure or error (design.md Decision 9's enforcer)."""
-    job = package_job(workflow)
-    step = job["steps"][locate(job)["report"]]
-    runner = Runner(workflow, job, tmp_path)
-    (runner.temp / "package-tests.xml").write_text(junit_report(**report),
-                                                   encoding="utf-8")
-    proc = runner.run(step)
-    assert (proc.returncode == 0) is passes, shown(proc)
-
-
-def test_tests_yml_synthetic_wheels_are_wheel_md_s_members(head):
-    """The wheels above are the one contracts/wheel.md lists: HEAD's
-    modules, the 24 payload files and the five `.dist-info` names, each
-    case differing from the wheel as built in its one member alone."""
-    built = built_members(head)
-    info = head.dist_info
-    assert len(head.payload) == 24, head.payload
-    assert {PACKAGE + "__init__.py", PACKAGE + "_release.py"} <= set(built)
-    assert sorted(name[len(info):] for name in built if name.startswith(info)) \
-        == sorted(["METADATA", "WHEEL", "entry_points.txt",
-                   "licenses/LICENSE"]), "RECORD is added when written"
-    changed = {"no-license": {info + "licenses/LICENSE", info + "METADATA"},
-               "payload-byte": {PAYLOAD + BYTE_TARGET},
-               "payload-mode": {PAYLOAD + MODE_TARGET}}
-    for case, names in changed.items():
-        members = case_members(head, case)
-        differ = {name for name in set(built) | set(members)
-                  if built.get(name) != members.get(name)}
-        assert differ == names, (case, differ)
diff --git a/tests/test_triad_lane_tooling.py b/tests/test_triad_lane_tooling.py
deleted file mode 100644
index ee7a6110..00000000
--- a/tests/test_triad_lane_tooling.py
+++ /dev/null
@@ -1,1215 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""T018 (opensoft/openRepoTools#186): the lane tooling sees a TRIAD's trees.
-
-A lane's checkout is an ASSEMBLY when its own `project.yaml` declares a leg
-other than itself - the standard's rule, read by `lanes-edit.sh project-legs`
-with `lane-start`'s rung-5 grammar. Its legs (`spec/`, `code/`) are submodules
-and its feature trees are worktrees of the LEGS' repositories, under
-`<assembly>/worktrees/<feature>/{spec,code}` - so before this every lane tool
-was blind to them (docs/triad-lane-tooling-analysis.md §4.4).
-
-TWO THINGS ARE HELD HERE, and the second is the condition of the first:
-
-  * on an assembly built from openRepoShape's OWN template bytes at the
-    pinned commit (`upstream/openRepoShape/templates/assembly-root/`), with
-    every leg a real git repository behind a bare local origin and a fake `gh`
-    that exits 1, the sweep, `lane-end`'s gate (and, in later commits, the
-    handoff poll, the daily report and `add`) see the legs, their worktrees and
-    the paired feature trees;
-  * on a SINGLE REPOSITORY - no `project.yaml`, a submodule that is no leg, and
-    a `project.yaml` naming no leg but itself - every output of every touched
-    command is byte for byte what the tools at `c45a452` printed. The "before"
-    is STORED (`tests/fixtures/t018/single-repository.golden`), generated ONCE
-    from `c45a452`'s own tools by this module's `--capture` and committed: CI
-    checks out at depth 1, where `c45a452` is not there to run. It is
-    normalised for what no two runs share - the bench's path, UTC stamps,
-    hashes, ages and byte sizes - and for nothing else.
-
-NOTHING REAL IS TOUCHED: every repository, origin, register, `$HOME` and
-state directory is under `tmp_path`, and the network is never reached.
-"""
-
-from __future__ import annotations
-
-import difflib
-import os
-import re
-import shutil
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-from conftest import NEEDS_UPSTREAM, REPO, UPSTREAM, WINDOWS_SKIP  # noqa: E402
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("git") is None or shutil.which("bash") is None,
-    reason="the lane tools are bash and Python over git")]
-
-GOLDEN = Path(__file__).resolve().parent / "fixtures" / "t018" / "single-repository.golden"
-#: The assembly is built from the pinned openRepoShape's own template bytes,
-#: so every assembly case wears conftest's `NEEDS_UPSTREAM`: standalone it
-#: skips where the submodule is not checked out, and composed it FAILS.
-TEMPLATE = UPSTREAM / "templates" / "assembly-root"
-
-UUID = "18018018-1111-4180-8180-180180180001"
-#: Every command the bench installs beside each other, as `--install` does.
-TOOLS = ("lanes-edit.sh", "lane-worktrees", "lane-end", "lane-handoff", "lane-start",
-         "repos.tsv")
-GATE = ("--branches", "--include-scratch", "--include-caches")
-US = "\x1f"
-
-FAKE_GH = "#!/bin/sh\nprintf 'fake gh: no GitHub here (%s)\\n' \"$*\" >&2\nexit 1\n"
-FAKE_TMUX = "#!/bin/sh\nexit 1\n"
-FAKE_STATUS = ("#!/bin/sh\nprintf 'status --all: reading every estate:\\n\\n"
-               "=== status repoS ===\\n    - a fixed finding\\n'\nexit 1\n")
-
-
-class Bench:
-    """One workstation under `root`: a workspace repository with a register,
-    `$HOME`, the projects directory, bare origins, fakes, and the tools under
-    test copied side by side into `root/bin`."""
-
-    def __init__(self, root: Path, tools: Path):
-        self.root = root
-        self.home = root / "home"
-        self.projects = self.home / "projects"
-        self.remotes = root / "remotes"
-        self.fake = root / "fakebin"
-        self.bin = root / "bin"
-        self.wip = self.projects / "wip"
-        for d in (self.home, self.projects, self.remotes, self.fake, self.bin, root / "tmp",
-                  root / "sandboxes", self.home / ".agents", self.home / ".claude" / "sessions"):
-            d.mkdir(parents=True, exist_ok=True)
-        for name in TOOLS:
-            shutil.copy2(tools / name, self.bin / name)
-            (self.bin / name).chmod(0o755)
-        for name, text in (("gh", FAKE_GH), ("tmux", FAKE_TMUX), ("status", FAKE_STATUS)):
-            (self.fake / name).write_text(text)
-            (self.fake / name).chmod(0o755)
-        (self.home / ".gitconfig").write_text(
-            "[user]\n\tname = t018\n\temail = t018@example.invalid\n"
-            "[init]\n\tdefaultBranch = main\n[protocol \"file\"]\n\tallow = always\n"
-            "[advice]\n\tdetachedHead = false\n")
-        env = {k: v for k, v in os.environ.items()
-               if not k.startswith(("LANES_", "LANE_", "CLAUDE_", "WORKBENCHES_", "TMUX", "XDG_",
-                                    "PROJECTS_", "GH_", "GIT_", "FAKE_", "OPENREPOTOOLS_",
-                                    "PYTEST_"))
-               and k not in ("AGENT_PROTOCOL_ROOT",)}
-        system_path = os.pathsep.join(p for p in env.get("PATH", "/usr/bin:/bin").split(os.pathsep)
-                                      if p and not any(os.path.exists(os.path.join(p, n))
-                                                       for n in TOOLS + ("lanes-index",)))
-        env.update(
-            HOME=str(self.home), TMPDIR=str(root / "tmp"),
-            PATH=os.pathsep.join([str(self.fake), str(self.bin), system_path]),
-            AGENT_PROTOCOL_ROOT=str(self.home / ".agents"),
-            XDG_STATE_HOME=str(self.home / ".local" / "state"),
-            XDG_CONFIG_HOME=str(self.home / ".config"), XDG_CACHE_HOME=str(self.home / ".cache"),
-            PROJECTS_ROOT=str(self.projects), LANES_WORKSTATION="Eagle", LANES_HOST="eagle",
-            LANES_OS="linux", LANES_CONTAINER="none", LANES_IN_CONTAINER="0",
-            LANES_NO_GITHUB="1", LANES_INDEX="off", LANE_WORKTREES_REPORT="off",
-            LANE_WORKTREES_SANDBOX_ROOTS=str(root / "sandboxes"),
-            LANE_WORKTREES_STATUS=str(self.fake / "status"),
-            CLAUDE_CONFIG_DIR=str(self.home / ".claude"), LANES_SESSION=UUID,
-            GIT_CONFIG_NOSYSTEM="1", OPENREPOTOOLS_BIN_DIR=str(self.bin), LC_ALL="C")
-        self.env = env
-        self._seed_workspace()
-
-    # ------------------------------------------------------------ plumbing
-    def run(self, *argv, cwd=None, env=None, timeout=300) -> subprocess.CompletedProcess:
-        child = dict(self.env)
-        child.update(env or {})
-        return subprocess.run([str(a) for a in argv], cwd=str(cwd or self.root), env=child,
-                              capture_output=True, text=True, timeout=timeout,
-                              stdin=subprocess.DEVNULL)
-
-    def tool(self, name, *args, cwd=None, env=None) -> subprocess.CompletedProcess:
-        return self.run(self.bin / name, *args, cwd=cwd, env=env)
-
-    def git(self, *args, cwd=None) -> str:
-        proc = self.run("git", *args, cwd=cwd)
-        assert proc.returncode == 0, f"git {' '.join(map(str, args))}: {proc.stderr}"
-        return proc.stdout.strip()
-
-    def commit(self, cwd: Path, message: str, files: dict | None = None,
-               lane: str | None = None) -> str:
-        for rel, text in (files or {}).items():
-            path = Path(cwd) / rel
-            path.parent.mkdir(parents=True, exist_ok=True)
-            path.write_text(text)
-        self.git("add", "-A", cwd=cwd)
-        self.git("commit", "-q", "--allow-empty", "-m",
-                 f"{message}\n\nLane: {lane}\n" if lane else message, cwd=cwd)
-        return self.git("rev-parse", "HEAD", cwd=cwd)
-
-    def origin(self, name: str) -> Path:
-        bare = self.remotes / f"{name}.git"
-        self.git("init", "-q", "--bare", "-b", "main", bare)
-        return bare
-
-    def seeded(self, name: str, files: dict) -> Path:
-        """A bare origin holding one commit of `files`."""
-        bare = self.origin(name)
-        work = self.root / "seed" / name
-        self.git("clone", "-q", bare, work)
-        self.commit(work, f"{name}: seed", files)
-        self.git("push", "-q", "origin", "main", cwd=work)
-        return bare
-
-    # ------------------------------------------------------------ register
-    def _seed_workspace(self) -> None:
-        bare = self.origin("wip")
-        self.git("clone", "-q", bare, self.wip)
-        (self.wip / "lanes" / "log").mkdir(parents=True)
-        (self.wip / "handoffs").mkdir()
-        (self.wip / "lanes" / "LANES.md").write_text(
-            "# LANES.md\n\n| lane | session id | workstation / env / user | started (UTC) "
-            "| objects owned | handoff path | state |\n|---|---|---|---|---|---|---|\n")
-        self.git("add", "-A", cwd=self.wip)
-        self.git("commit", "-q", "-m", "seed", cwd=self.wip)
-        self.git("push", "-q", "origin", "main", cwd=self.wip)
-        (self.home / ".agents" / "workspace.yaml").write_text(
-            f"repository: {bare}\npath: {self.wip}\n")
-
-    def lanes(self, home: str, checkout: Path, *names: str) -> None:
-        """A register row, a handoff and a STARTED line naming `checkout` for
-        each lane, pushed in one commit; and a RUNNING #97 snapshot."""
-        reg = self.wip / "lanes" / "LANES.md"
-        text = reg.read_text()
-        for lane in names:
-            text += (f"| `{lane}` | harness `{UUID}` | Eagle / test / brett | 2026-10-08T00:00Z "
-                     f"| none | handoffs/{lane}.md | LIVE · 2026-10-08T00:00:00Z · working |\n")
-            (self.wip / "handoffs" / f"{lane}.md").write_text(f"# handoff {lane}\n\nwork.\n")
-            (self.wip / "lanes" / "log" / f"{lane}.md").write_text(
-                f"STARTED — lane {lane}, session {UUID}@Eagle, 2026-10-08T00:00:00Z, lane:{lane} "
-                f"→ home {home}; dir {checkout}; host eagle; container none; os linux\n")
-        reg.write_text(text)
-        self.git("add", "-A", cwd=self.wip)
-        self.git("commit", "-q", "-m", "lanes", cwd=self.wip)
-        self.git("push", "-q", "origin", "main", cwd=self.wip)
-        for lane in names:
-            proc = self.tool("lanes-edit.sh", "set-lane-state", lane, "RUNNING", "--expect", "none",
-                             "--operation", "op-seed", "--owner", UUID)
-            assert proc.returncode == 0, proc.stderr
-
-    def row(self, lane: str) -> str:
-        return next(line for line in (self.wip / "lanes" / "LANES.md").read_text().splitlines()
-                    if line.startswith(f"| `{lane}`"))
-
-    def last_log(self, lane: str) -> str:
-        return (self.wip / "lanes" / "log" / f"{lane}.md").read_text().splitlines()[-1]
-
-    def sweep(self, lane: str, *args) -> subprocess.CompletedProcess:
-        return self.tool("lane-worktrees", "sweep", lane, *args)
-
-
-# ================================================================ normalising
-
-_RULES = (
-    (re.compile(r"\bc\d{3,}-[A-Za-z0-9._-]*"), "<TREE-ID>"),
-    (re.compile(r"op-\d{8}T\d{6}Z-\d+-\d+"), "<OPERATION>"),
-    (re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{2}:\d{2}"), "<ISO>"),
-    (re.compile(r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(:\d{2})?Z"), "<UTC>"),
-    (re.compile(r"\d{8}T\d{6}Z"), "<STAMP>"),
-    (re.compile(r"\d{4}-\d{2}-\d{2}"), "<DATE>"),
-    (re.compile(r"\b[0-9a-f]{7,40}\b"), "<HEX>"),
-    (re.compile(r"\b\d+ d\b"), "<N> d"),
-    (re.compile(r"active \d+ min ago"), "active <N> min ago"),
-    (re.compile(r"\b\d+(\.\d+)? (B|KB|MB|GB)\b"), "<SIZE>"),
-    (re.compile(r"\(\d+ bytes\)"), "(<N> bytes)"),
-)
-
-
-_PROC_NOTE = re.compile(r"^  note: \d+ process\(es\) of this account could not be read in /proc ")
-
-
-def normalise(text: str, bench: Bench) -> str:
-    """What no two runs share, and nothing else: the bench's own path and its
-    `$HOME` (both spellings), tree ids (a checksum of that path), operation ids, stamps,
-    hashes, ages and byte sizes - and a porcelain row's byte count."""
-    # `$HOME` FIRST, and as a word of its own: `tests/test_repo_hygiene.py`
-    # rightly refuses a committed `/home/<user>/` path, and the bench's home
-    # sits under its root.
-    for place, word in ((bench.home, "<HOME>"), (bench.root, "<ROOT>")):
-        for spelling in sorted({str(place), os.path.realpath(place)}, key=len, reverse=True):
-            text = text.replace(spelling, word)
-    for rx, sub in _RULES:
-        text = rx.sub(sub, text)
-    out = []
-    for line in text.split("\n"):
-        # A HOST FACT, NOT THE TOOL'S: how many of this account's processes
-        # `/proc` would not show the sweep is whatever else runs beside it.
-        if _PROC_NOTE.match(line):
-            continue
-        cols = line.split("\t")
-        if cols[0] in ("scratch", "cache", "sandbox") and len(cols) > 5:
-            cols[5] = "<N>"
-        out.append("\t".join(cols))
-    return "\n".join(out)
-
-
-def shown(proc: subprocess.CompletedProcess, bench: Bench) -> str:
-    return normalise(f"exit {proc.returncode}\n--- stdout\n{proc.stdout}--- stderr\n{proc.stderr}",
-                     bench)
-
-
-# =================================================== the single repository
-
-def single_repository(bench: Bench) -> list:
-    """THE SCENARIO WHOSE OUTPUTS MAY NOT MOVE: one repository with a
-    submodule (as openRepoTools has `upstream/openRepoShape`) and a second with
-    a `project.yaml` naming no leg but itself, every kind of row the touched
-    commands print, and each command's output in the order it ran."""
-    b = bench
-    out = []
-    dep = b.seeded("dep", {"d.txt": "a dependency\n"})
-    b.origin("repoS")
-    s = b.projects / "repoS"
-    b.git("clone", "-q", b.remotes / "repoS.git", s)
-    b.commit(s, "seed", {"README.md": "S\n", ".gitignore": ".env\n__pycache__/\n"})
-    b.git("submodule", "add", "-q", dep, "vendor/dep", cwd=s)
-    b.commit(s, "a submodule that is no leg")
-    b.git("push", "-q", "origin", "main", cwd=s)
-    b.lanes("opensoft/repoS", s, "repoS-1", "repoS-2")
-
-    # add: the dry run, then the act; work in the tree it made.
-    out.append(("add --dry-run", shown(b.tool("lane-worktrees", "add", "repoS-1", "inv",
-                                              "--dry-run"), b)))
-    out.append(("add", shown(b.tool("lane-worktrees", "add", "repoS-1", "inv"), b)))
-    inv = b.projects / ".lane-worktrees" / "repoS-1" / "inv"
-    b.commit(inv, "inv work", {"i.txt": "i\n"}, lane="repoS-1")
-    (inv / "i.txt").write_text("changed\n")
-    (inv / ".env").write_text("SECRET=1\n")
-    (inv / "__pycache__").mkdir()
-    (inv / "__pycache__" / "x.pyc").write_bytes(b"\0" * 64)
-    # a tree under .claude/worktrees carrying the lane's trailer, unrecorded
-    tr = s / ".claude" / "worktrees" / "tr"
-    b.git("worktree", "add", "-q", "-b", "tr", tr, "origin/main", cwd=s)
-    b.commit(tr, "trailer work", {"t.txt": "t\n"}, lane="repoS-1")
-    # a FOREIGN registration elsewhere, another lane's
-    b.git("worktree", "add", "-q", "-b", "elsewhere", b.projects / "elsewhere", "origin/main", cwd=s)
-    b.commit(b.projects / "elsewhere", "theirs", {"e.txt": "e\n"}, lane="repoS-9")
-    # scratch, and a branch of the lane's own with no tree
-    (b.projects / ".lane-worktrees" / "repoS-1" / "notes-scratch").mkdir()
-    (b.projects / ".lane-worktrees" / "repoS-1" / "notes-scratch" / "n.md").write_text("n\n")
-    tmp = b.root / "tmp-branch"
-    b.git("worktree", "add", "-q", "-b", "old-work", tmp, "origin/main", cwd=s)
-    b.commit(tmp, "old work", {"o.txt": "o\n"}, lane="repoS-1")
-    b.git("worktree", "remove", tmp, cwd=s)
-
-    out.append(("sweep porcelain", shown(b.sweep("repoS-1", *GATE, "--dry-run", "--porcelain"), b)))
-    out.append(("sweep table", shown(b.sweep("repoS-1", *GATE, "--dry-run"), b)))
-    out.append(("lane-reconcile", shown(b.tool("lanes-edit.sh", "lane-reconcile", "repoS-1"), b)))
-    out.append(("lane-end refused", shown(b.tool("lane-end", "repoS-1"), b)))
-    out.append(("lane-end refused: row and log", normalise(
-        b.row("repoS-1") + "\n" + b.last_log("repoS-1"), b)))
-
-    # a repository whose project.yaml names no leg but itself
-    p = b.projects / "repoP"
-    b.origin("repoP")
-    b.git("clone", "-q", b.remotes / "repoP.git", p)
-    b.commit(p, "seed", {"project.yaml": (
-        "schema_version: 1\nkind: project-manifest\nid: repoP\nlegs:\n"
-        "  - role: assembly\n    repository: opensoft/repoP\n    path: \".\"\n")})
-    b.git("push", "-q", "origin", "main", cwd=p)
-    b.lanes("opensoft/repoP", p, "repoP-1")
-    pt = b.projects / ".lane-worktrees" / "repoP-1" / "w"
-    out.append(("add (manifest, no leg)", shown(b.tool("lane-worktrees", "add", "repoP-1", "w"), b)))
-    b.commit(pt, "p work", {"p.txt": "p\n"}, lane="repoP-1")
-    out.append(("sweep porcelain (manifest, no leg)",
-                shown(b.sweep("repoP-1", *GATE, "--dry-run", "--porcelain"), b)))
-
-    out.append(("lane-handoff", shown(b.tool("lane-handoff", "--lane", "repoS-1", "--transcript",
-                                             "none", "--agent", "claude", "t018 handoff",
-                                             cwd=s), b)))
-    handoff = (b.wip / "handoffs" / "repoS-1.md").read_text()
-    out.append(("lane-handoff: top block", normalise(handoff.split("\n---\n", 1)[0], b)))
-    # ONE SIDECAR PER TREE, LISTED IN THE ORDER OF THEIR FILE NAMES - a
-    # checksum of each tree's path, so of the bench's own path: sorted here.
-    trees = b.tool("lanes-edit.sh", "lane-trees", "repoS-1")
-    trees.stdout = "".join(sorted(trees.stdout.splitlines(keepends=True),
-                                  key=lambda line: normalise(line, b)))
-    out.append(("lane-handoff: inventory", shown(trees, b)))
-    out.append(("sweep porcelain after the handoff",
-                shown(b.sweep("repoS-1", *GATE, "--dry-run", "--porcelain"), b)))
-    out.append(("lane-end passes", shown(b.tool("lane-end", "repoS-2"), b)))
-    out.append(("lane-end passes: row and log", normalise(
-        b.row("repoS-2") + "\n" + b.last_log("repoS-2"), b)))
-    out.append(("report", shown(b.tool("lane-worktrees", "sweep", "--all", "--dry-run", "--report",
-                                       "--estate", b.projects), b)))
-    return out
-
-
-def render_golden(sections: list) -> str:
-    return "".join(f"=== {key} ===\n{text}\n" for key, text in sections)
-
-
-def parse_golden(text: str) -> list:
-    out = []
-    for chunk in re.split(r"(?m)^=== (.+) ===\n", text)[1:]:
-        out.append(chunk)
-    return [(out[i], out[i + 1][:-1] if out[i + 1].endswith("\n") else out[i + 1])
-            for i in range(0, len(out), 2)]
-
-
-@pytest.mark.skipif(not sys.platform.startswith("linux"),
-                    reason="the golden was captured on Linux, where liveness is read in /proc; "
-                           "macOS reads it with lsof, a host fact this proof is not about")
-def test_t018_single_repository_outputs_are_c45a452s_byte_for_byte(tmp_path):
-    """THE INVARIANT. Every output of every touched command on a single
-    repository - a submodule that is no leg, and a `project.yaml` naming no leg
-    but itself, included - equals what `c45a452`'s tools printed, stored in the
-    golden file this module's `--capture` wrote from them."""
-    assert GOLDEN.is_file(), f"{GOLDEN} is missing; it is generated from c45a452's tools"
-    want = parse_golden(GOLDEN.read_text(encoding="utf-8"))
-    got = single_repository(Bench(tmp_path / "bench", REPO))
-    assert [k for k, _ in got] == [k for k, _ in want]
-    for (key, have), (_k, gold) in zip(got, want):
-        if have != gold:
-            diff = "\n".join(difflib.unified_diff(gold.splitlines(), have.splitlines(),
-                                                  f"c45a452: {key}", f"now: {key}", lineterm=""))
-            raise AssertionError(f"the single-repository output of '{key}' moved:\n{diff}")
-
-
-# ================================================================ the assembly
-
-def build_assembly(b: Bench, name: str = "triad") -> dict:
-    """An assembly made of openRepoShape's own template bytes at the pinned
-    commit: every file of `templates/assembly-root/` copied, `project.yaml`'s
-    placeholders filled, the legs mounted as submodules from bare local
-    origins, and a dependency nested in the code leg (`upstream/dep`), as
-    openRepoTools' code leg will carry `upstream/openRepoShape`."""
-    dep = b.seeded(f"{name}-dep", {"dep.txt": "a nested dependency\n"})
-    spec = b.seeded(f"{name}-spec", {"spec.md": "the spec leg\n"})
-    code_bare = b.origin(f"{name}-code")
-    seed = b.root / "seed" / f"{name}-code"
-    b.git("clone", "-q", code_bare, seed)
-    b.commit(seed, "code: seed", {"tool.sh": "#!/bin/sh\n"})
-    b.git("submodule", "add", "-q", dep, "upstream/dep", cwd=seed)
-    b.commit(seed, "code: the nested dependency")
-    b.git("push", "-q", "origin", "main", cwd=seed)
-    b.origin(name)
-    a = b.projects / name
-    b.git("clone", "-q", b.remotes / f"{name}.git", a)
-    for src in TEMPLATE.rglob("*"):
-        rel = src.relative_to(TEMPLATE)
-        if src.is_dir():
-            (a / rel).mkdir(parents=True, exist_ok=True)
-        else:
-            (a / rel).parent.mkdir(parents=True, exist_ok=True)
-            shutil.copy2(src, a / rel)
-    manifest = (TEMPLATE / "project.yaml").read_text(encoding="utf-8")
-    fill = {"ASSEMBLY_REPOSITORY": f"opensoft/{name}", "SPEC_REPOSITORY": f"opensoft/{name}-spec",
-            "CODE_REPOSITORY": f"opensoft/{name}-code", "SPEC_PATH": "spec", "CODE_PATH": "code"}
-    lines = []
-    for line in manifest.splitlines():
-        if re.fullmatch(r"\{\{[A-Z_]+_NAMING\}\}", line.strip()):
-            continue
-        lines.append(re.sub(r"\{\{([A-Z_]+)\}\}", lambda m: fill.get(m.group(1), m.group(0)), line))
-    (a / "project.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
-    b.commit(a, "the assembly, from the template")
-    b.git("submodule", "add", "-q", spec, "spec", cwd=a)
-    b.git("submodule", "add", "-q", code_bare, "code", cwd=a)
-    b.commit(a, "the legs")
-    b.git("push", "-q", "origin", "main", cwd=a)
-    b.git("submodule", "update", "-q", "--init", "--recursive", cwd=a)
-    return {"assembly": a, "code": a / "code", "spec": a / "spec",
-            "dep": a / "code" / "upstream" / "dep"}
-
-
-def porcelain_rows(out: str, kind: str) -> dict:
-    rows = {}
-    for line in out.splitlines():
-        cols = line.split("\t")
-        if cols[0] == kind and len(cols) > 6:
-            rows[cols[3]] = {"disposition": cols[1], "retire": cols[2], "branch": cols[4],
-                             "head": cols[5], "why": cols[6]}
-    return rows
-
-
-@pytest.fixture
-def triad(tmp_path):
-    b = Bench(tmp_path / "bench", REPO)
-    t = build_assembly(b)
-    b.lanes("opensoft/triad", t["assembly"], "triad-1", "triad-2")
-    return b, t
-
-
-def _lane_start_reader() -> list:
-    text = (REPO / "lane-start").read_text(encoding="utf-8")
-    start = text.index("    ls_cand=\"$(awk -v want=\"$ls_home\" '\n")
-    lines = text[start:].splitlines()[1:8]
-    return [ln.strip() for ln in lines]
-
-
-def _shared_reader() -> list:
-    text = (REPO / "lanes-edit.sh").read_text(encoding="utf-8")
-    start = text.index("project_leg_paths_file() {")
-    lines = text[start:].splitlines()[3:10]
-    return [ln.strip() for ln in lines]
-
-
-def test_t018_the_legs_reader_is_lane_starts_rung_5_line_for_line():
-    """NEVER A SECOND GRAMMAR: the seven lines that decide what a leg is are
-    the ones `lane-start` resolves a lane's directory with."""
-    theirs, ours = _lane_start_reader(), _shared_reader()
-    assert len(theirs) == 7 and theirs[0].startswith("/^[A-Za-z_]"), theirs
-    assert theirs == ours
-
-
-@NEEDS_UPSTREAM
-def test_t018_project_legs_reads_the_templates_manifest(tmp_path):
-    b = Bench(tmp_path / "bench", REPO)
-    t = build_assembly(b)
-    a = t["assembly"]
-    proc = b.tool("lanes-edit.sh", "project-legs", a, env={"AGENT_PROTOCOL_ROOT": str(tmp_path / "none")})
-    assert proc.returncode == 0, proc.stderr
-    assert proc.stdout.splitlines() == [f"opensoft/triad-spec\tspec\t{a}/spec",
-                                        f"opensoft/triad-code\tcode\t{a}/code"]
-    for where, rc in ((b.projects, 8), (b.projects / "wip", 8)):
-        proc = b.tool("lanes-edit.sh", "project-legs", where)
-        assert proc.returncode == rc, proc.stdout + proc.stderr
-    assert b.tool("lanes-edit.sh", "project-legs", "relative").returncode == 64
-    os.chmod(a / "project.yaml", 0)
-    try:
-        if os.geteuid() != 0:
-            proc = b.tool("lanes-edit.sh", "project-legs", a)
-            assert proc.returncode == 1 and "could not be read" in proc.stderr
-    finally:
-        os.chmod(a / "project.yaml", 0o644)
-
-
-@NEEDS_UPSTREAM
-def test_t018_the_sweep_reads_every_leg_and_its_nested_dependency(triad):
-    b, t = triad
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    legs = porcelain_rows(proc.stdout, "leg")
-    assert list(legs) == [str(t["spec"]), str(t["code"]), str(t["dep"])]
-    assert all(r["disposition"] == "clean" and r["retire"] == "-" for r in legs.values()), legs
-    assert "the code leg of" in legs[str(t["code"])]["why"]
-    assert "nested in the code leg (code/upstream/dep)" in legs[str(t["dep"])]["why"]
-    table = b.sweep("triad-1", "--dry-run")
-    assert "LEGS (the assembly's own checkouts" in table.stdout
-    assert "3 leg checkout(s), 0 counted" in table.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_paired_code_tree_with_unpushed_lane_work_holds_lane_end(triad):
-    """THE GAP §4.4 MEASURED: a paired `worktrees/<feature>/code` tree, made
-    as Speckit makes one (a worktree of the code leg's repository), holding the
-    lane's unpushed commit, passed `lane-end`. Now the sweep claims it by its
-    HEAD's own `Lane:` trailer and the gate refuses, naming it."""
-    b, t = triad
-    tree = t["assembly"] / "worktrees" / "005-x" / "code"
-    b.git("worktree", "add", "-q", "-b", "005-x", tree, "origin/main", cwd=t["code"])
-    b.commit(tree, "the feature's code", {"f.txt": "f\n"}, lane="triad-1")
-    # the paired spec tree carries another lane's work: never this lane's
-    spec_tree = t["assembly"] / "worktrees" / "005-x" / "spec"
-    b.git("worktree", "add", "-q", "-b", "005-x", spec_tree, "origin/main", cwd=t["spec"])
-    b.commit(spec_tree, "the feature's spec", {"s.md": "s\n"}, lane="triad-2")
-    proc = b.sweep("triad-1", *GATE, "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    trees = porcelain_rows(proc.stdout, "tree")
-    assert trees[str(tree)]["retire"] == "retire", trees
-    assert "Lane: trailer" in trees[str(tree)]["why"]
-    assert trees[str(spec_tree)]["disposition"] == "foreign", trees
-    assert "paired feature worktrees" in trees[str(spec_tree)]["why"]
-    assert "the spec leg of" in trees[str(spec_tree)]["why"]
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 2, end.stderr
-    assert "lane triad-1 is NOT ended" in end.stderr and str(tree) in end.stderr
-    assert "1 tree(s)" in end.stderr
-    # and the other lane's own sweep claims the spec tree, not the code one
-    other = porcelain_rows(b.sweep("triad-2", "--dry-run", "--porcelain").stdout, "tree")
-    assert other[str(spec_tree)]["retire"] == "retire"
-    assert other[str(tree)]["disposition"] == "foreign"
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_tree_made_elsewhere_is_registered_in_its_leg(triad):
-    b, t = triad
-    away = b.projects / "away-code"
-    b.git("worktree", "add", "-q", "-b", "away", away, "origin/main", cwd=t["code"])
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    row = porcelain_rows(proc.stdout, "tree")[str(away)]
-    assert row["disposition"] == "foreign" and row["retire"] == "-", row
-    assert "registered in the code leg of" in row["why"]
-    # and a tree recorded with the leg as its checkout is the lane's
-    rec = b.tool("lanes-edit.sh", "set-lane-tree", "triad-1", away, "--checkout", t["code"])
-    assert rec.returncode == 0, rec.stderr
-    row = porcelain_rows(b.sweep("triad-1", "--dry-run", "--porcelain").stdout, "tree")[str(away)]
-    assert row["retire"] == "retire" and row["disposition"] == "remove", row
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_holding_the_lanes_unpushed_commit_is_counted(triad):
-    """A lane working in the code leg itself: its HEAD's own trailer is this
-    lane's and origin lacks it, so the leg is COUNTED - the gate refuses, and
-    offers no `--yes`, which never acts on a leg."""
-    b, t = triad
-    b.git("checkout", "-q", "-b", "in-place", cwd=t["code"])
-    b.commit(t["code"], "worked in the leg", {"w.txt": "w\n"}, lane="triad-1")
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(t["code"])]
-    assert leg["disposition"] == "unpushed" and leg["retire"] == "retire", leg
-    assert leg["branch"] == "in-place"
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 2
-    assert "1 leg checkout(s)" in end.stderr and str(t["code"]) in end.stderr
-    assert "no sweep acts on one" in end.stderr
-    assert "--yes" not in end.stderr
-    # another lane's sweep lists that leg and does not count it
-    other = b.sweep("triad-2", "--dry-run", "--porcelain")
-    assert other.returncode == 0, other.stdout
-    assert porcelain_rows(other.stdout, "leg")[str(t["code"])]["retire"] == "-"
-    assert b.tool("lane-end", "triad-2").returncode == 0
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_dirty_leg_that_is_no_lanes_is_listed_never_counted(triad):
-    b, t = triad
-    (t["code"] / "scratch.txt").write_text("someone's edit\n")
-    (t["dep"] / "d2.txt").write_text("an edit in the dependency\n")
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    legs = porcelain_rows(proc.stdout, "leg")
-    assert legs[str(t["code"])]["disposition"] == "dirty"
-    assert legs[str(t["dep"])]["disposition"] == "dirty"
-    assert all(r["retire"] == "-" for r in legs.values())
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 0, end.stderr
-    assert "close-out gate: nothing of lane triad-1's is left on disk" in end.stderr
-    assert "listed and NOT counted" in end.stderr and str(t["dep"]) in end.stderr
-
-
-@NEEDS_UPSTREAM
-def test_t018_the_legs_branches_are_read_under_branches(triad):
-    b, t = triad
-    tmp = b.root / "leg-branch"
-    b.git("worktree", "add", "-q", "-b", "leg-old", tmp, "origin/main", cwd=t["code"])
-    b.commit(tmp, "leg work", {"l.txt": "l\n"}, lane="triad-1")
-    b.git("worktree", "remove", tmp, cwd=t["code"])
-    proc = b.sweep("triad-1", "--branches", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    rows = [ln.split("\t") for ln in proc.stdout.splitlines() if ln.startswith("branch\t")]
-    assert [r[3] for r in rows] == ["leg-old"], rows
-    assert rows[0][2] == "retire" and rows[0][4].startswith("in the code leg of"), rows
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_manifest_or_leg_that_cannot_be_read_refuses(triad):
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 file")
-    os.chmod(t["assembly"] / "project.yaml", 0)
-    try:
-        proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    finally:
-        os.chmod(t["assembly"] / "project.yaml", 0o644)
-    assert proc.returncode == 2, proc.stdout
-    assert "the legs of the assembly" in proc.stdout and "could not be read" in proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_git_cannot_read_is_counted_and_holds_lane_end(triad):
-    """A LEG WITH A `.git` OF ITS OWN THAT GIT CANNOT READ is a read that
-    failed, never an absent or a clean leg (Amendment 7(d)): its row is
-    `unreadable` and counted, the dry run exits 3, and `lane-end` refuses,
-    naming it."""
-    b, t = triad
-    (t["spec"] / ".git").write_text("gitdir: /nonexistent/t018-spec\n")
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(t["spec"])]
-    assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", leg
-    assert "git could not be read through it" in leg["why"], leg
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 2, end.stderr
-    assert "lane triad-1 is NOT ended" in end.stderr and str(t["spec"]) in end.stderr
-
-
-#: The words every reader gives a leg directory this account cannot search (#255).
-UNSEARCHABLE = ("git could not be read through it (its directory cannot be searched, so whether "
-                "it has a .git of its own could not be tested, and git could not read it: ")
-
-
-@NEEDS_UPSTREAM
-def test_255_a_leg_directory_that_cannot_be_searched_is_unreadable_and_holds_lane_end(triad):
-    """#255, OPENREPOSHAPE-2'S SHOULD ON #246: A LEG DIRECTORY THIS ACCOUNT
-    CANNOT SEARCH hid whether a `.git` stood in it, and `probe_leg` read it as
-    a leg that is not checked out - `absent`, counted for nobody - so the dry
-    run exited 0, the daily report left it out and `lane-end` ENDED the lane
-    over the lane's unpushed commit inside it. It is a read that failed
-    (Amendment 7(d)): `unreadable` and counted, with no permission at all and
-    with read but no search, the report names it, and `lane-end` refuses,
-    naming it. Searchable again, it is the leg holding the lane's commit; a
-    leg directory that is not there at all is still `absent`."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root searches a directory whatever its mode")
-    a, spec = t["assembly"], t["spec"]
-    b.git("checkout", "-q", "-b", "in-place", cwd=spec)
-    b.commit(spec, "worked in the leg", {"w.md": "w\n"}, lane="triad-1")
-    for mode in (0, 0o600):
-        os.chmod(spec, mode)
-        try:
-            proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-            report = b.tool("lane-worktrees", "sweep", "--all", "--dry-run", "--report",
-                            "--estate", b.projects)
-            end = b.tool("lane-end", "triad-1")
-        finally:
-            os.chmod(spec, 0o755)
-        assert proc.returncode == 3, (oct(mode), proc.stdout + proc.stderr)
-        leg = porcelain_rows(proc.stdout, "leg")[str(spec)]
-        assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", (oct(mode), leg)
-        assert f"the spec leg of {a}/project.yaml (opensoft/triad-spec): {UNSEARCHABLE}" \
-            in leg["why"], (oct(mode), leg)
-        assert report.returncode == 0, (oct(mode), report.stderr)
-        legs = _section(report.stdout, "Assembly legs with uncommitted or unpublished work")
-        assert f"- {spec} · the spec leg of {a} · (unreadable) ·" in legs, (oct(mode), legs)
-        assert "its directory cannot be searched" in legs, (oct(mode), legs)
-        assert end.returncode == 2, (oct(mode), end.stdout + end.stderr)
-        assert "lane triad-1 is NOT ended" in end.stderr and str(spec) in end.stderr, end.stderr
-        assert "1 leg checkout(s)" in end.stderr, end.stderr
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(spec)]
-    assert leg["disposition"] == "unpushed" and leg["retire"] == "retire", leg
-    away = b.root / "spec-moved-away"
-    spec.rename(away)
-    try:
-        proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    finally:
-        away.rename(spec)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(spec)]
-    assert leg["disposition"] == "absent" and leg["retire"] == "-", leg
-
-
-def _work_in_the_nested_dependency(b: Bench, t: dict) -> None:
-    """A commit of triad-1's, on a branch no origin holds, in the dependency
-    nested in the code leg (`code/upstream/dep`)."""
-    dep = t["dep"]
-    b.git("checkout", "-q", "-b", "in-dep", cwd=dep)
-    b.commit(dep, "worked in the nested dependency", {"n.md": "n\n"}, lane="triad-1")
-
-
-@NEEDS_UPSTREAM
-def test_255_a_nested_dependency_directory_that_cannot_be_searched_is_unreadable_and_holds_lane_end(
-        triad):
-    """#255, LANE 3'S REVIEW (finding 1): `git submodule status --recursive`
-    lists a nested dependency whose directory this account cannot search as
-    `-` - not initialized - and exits 0, and `assembly_checkouts` skipped every
-    `-` line before it probed anything. The dependency got no row, the code
-    leg read `clean`, the dry run exited 0 and `lane-end` ENDED the lane over
-    the lane's unpushed commit in it - what `probe_leg` stopped for a declared
-    leg. A `-` line is now probed, and the dependency is `unreadable` and
-    counted, with no permission at all and with read but no search; the sweep
-    exits 3 and `lane-end` refuses, naming it. Searchable again, it is the
-    dependency holding the lane's commit."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root searches a directory whatever its mode")
-    dep = t["dep"]
-    _work_in_the_nested_dependency(b, t)
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(dep)]
-    assert leg["disposition"] == "unpushed" and leg["retire"] == "retire", leg
-    for mode in (0, 0o600):
-        os.chmod(dep, mode)
-        try:
-            proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-            end = b.tool("lane-end", "triad-1")
-        finally:
-            os.chmod(dep, 0o755)
-        assert proc.returncode == 3, (oct(mode), proc.stdout + proc.stderr)
-        legs = porcelain_rows(proc.stdout, "leg")
-        assert list(legs) == [str(t["spec"]), str(t["code"]), str(dep)], (oct(mode), legs)
-        leg = legs[str(dep)]
-        assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", (oct(mode), leg)
-        assert f"a dependency nested in the code leg (code/upstream/dep): {UNSEARCHABLE}" \
-            in leg["why"], (oct(mode), leg)
-        assert end.returncode == 2, (oct(mode), end.stdout + end.stderr)
-        assert "lane triad-1 is NOT ended" in end.stderr and str(dep) in end.stderr, end.stderr
-        assert "1 leg checkout(s)" in end.stderr, end.stderr
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    leg = porcelain_rows(proc.stdout, "leg")[str(dep)]
-    assert leg["disposition"] == "unpushed" and leg["retire"] == "retire", leg
-
-
-@NEEDS_UPSTREAM
-def test_255_a_nested_dependency_beneath_a_directory_that_cannot_be_searched_holds_lane_end(
-        triad):
-    """The same, with the dependency's PARENT (`code/upstream`) unsearchable
-    and the dependency itself left as it is. Git lists it as `-` and exits 0
-    here too, and `Leg.exists` - `os.path.isdir` - is False for a path it cannot
-    reach exactly as for one that is not there, so `probe_leg` alone would read
-    it `absent`. It holds whichever way git answers: the dependency is an
-    `unreadable` row (the sweep exits 3), or - where `git submodule status`
-    itself fails - the sweep refuses to list the dependencies nested in the
-    leg (exit 2); either way `lane-end` refuses and the lane is NOT ended."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root searches a directory whatever its mode")
-    dep = t["dep"]
-    parent = dep.parent
-    assert parent == t["code"] / "upstream"
-    _work_in_the_nested_dependency(b, t)
-    for mode in (0, 0o600):
-        os.chmod(parent, mode)
-        try:
-            proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-            end = b.tool("lane-end", "triad-1")
-        finally:
-            os.chmod(parent, 0o755)
-        assert proc.returncode in (2, 3), (oct(mode), proc.stdout + proc.stderr)
-        if proc.returncode == 3:
-            leg = porcelain_rows(proc.stdout, "leg")[str(dep)]
-            assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", (oct(mode), leg)
-            assert "a dependency nested in the code leg (code/upstream/dep): git could not be " \
-                "read through it (" in leg["why"], (oct(mode), leg)
-        else:
-            assert "could not be listed (git submodule status failed)" in proc.stdout, proc.stdout
-        assert end.returncode == 2, (oct(mode), end.stdout + end.stderr)
-        assert "lane triad-1 is NOT ended" in end.stderr, end.stderr
-        assert "nothing of lane triad-1's is left on disk" not in end.stderr, end.stderr
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert porcelain_rows(proc.stdout, "leg")[str(dep)]["disposition"] == "unpushed", proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_255_a_nested_dependency_never_initialized_adds_no_row(triad):
-    """A dependency the code leg declares and nobody initialized is a `-`
-    line git prints for it exactly as for an unreadable one, and it is still
-    nothing to read: with its directory empty and searchable - or not there at
-    all - the sweep has no row for it and exits 0, and `lane-end` passes. Only
-    a read that FAILED is a row (#255); an uninitialized dependency is not one."""
-    b, t = triad
-    code, dep = t["code"], t["dep"]
-    b.git("submodule", "deinit", "-q", "-f", "upstream/dep", cwd=code)
-    sub = b.run("git", "-C", code, "submodule", "status", "--recursive")
-    assert sub.returncode == 0 and sub.stdout.startswith("-"), sub.stdout + sub.stderr
-    assert dep.is_dir() and not any(dep.iterdir())
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    legs = porcelain_rows(proc.stdout, "leg")
-    assert list(legs) == [str(t["spec"]), str(code)], legs
-    assert str(dep) not in proc.stdout, proc.stdout
-    dep.rmdir()
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert list(porcelain_rows(proc.stdout, "leg")) == [str(t["spec"]), str(code)], proc.stdout
-    assert str(dep) not in proc.stdout, proc.stdout
-    dep.mkdir()
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 0, end.stdout + end.stderr
-    assert "close-out gate: nothing of lane triad-1's is left on disk" in end.stderr, end.stderr
-
-
-@NEEDS_UPSTREAM
-def test_255_a_nested_dependency_git_lists_as_not_initialized_that_holds_a_checkout_is_read(triad):
-    """#255, LANE 3'S RULING ON THE REVIEW'S FINDING 1: a dependency git lists
-    as `-` whose directory holds a checkout `probe_leg` can read - a clone made
-    by hand into the directory of a deinitialized dependency, which git does
-    not count as initialized - holds the lane's work all the same. It was
-    skipped with every `-` line, so the sweep exited 0 and `lane-end` ENDED
-    the lane over the lane's unpushed commit there. It is read like an
-    initialized dependency now: the sweep has a row for it and exits 3, and
-    `lane-end` refuses. An empty directory still adds none (the test above)."""
-    b, t = triad
-    code, dep = t["code"], t["dep"]
-    b.git("submodule", "deinit", "-q", "-f", "upstream/dep", cwd=code)
-    b.git("clone", "-q", b.remotes / "triad-dep.git", dep)
-    sub = b.run("git", "-C", code, "submodule", "status", "--recursive")
-    assert sub.returncode == 0 and sub.stdout.startswith("-"), sub.stdout + sub.stderr
-    b.git("checkout", "-q", "-b", "in-dep", cwd=dep)
-    b.commit(dep, "worked in a hand-cloned dependency", {"n.md": "n\n"}, lane="triad-1")
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    legs = porcelain_rows(proc.stdout, "leg")
-    assert list(legs) == [str(t["spec"]), str(code), str(dep)], legs
-    assert legs[str(dep)]["disposition"] == "unpushed" and legs[str(dep)]["retire"] == "retire", legs
-    assert legs[str(dep)]["branch"] == "in-dep", legs
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 2, end.stdout + end.stderr
-    assert "lane triad-1 is NOT ended" in end.stderr and str(dep) in end.stderr, end.stderr
-    assert "1 leg checkout(s)" in end.stderr, end.stderr
-
-
-@NEEDS_UPSTREAM
-def test_255_a_nested_dependency_whose_path_ends_in_a_parenthesis_is_read_by_that_path(triad):
-    """git prints a describe suffix, ` (v1)`, only on a ` ` or `+` line
-    (`print_status`), never on a `-` line, so nothing is trimmed from the
-    path of a `-` line. A dependency never initialized at `upstream/dep (1)`
-    ends in what the trim would cut: read as `upstream/dep`, it became a second
-    row for the initialized dependency beside it and left `dep (1)` unread -
-    here at mode 000, where it must be the `unreadable` row."""
-    if os.geteuid() == 0:
-        pytest.skip("root searches a directory whatever its mode")
-    b, t = triad
-    code, dep = t["code"], t["dep"]
-    odd = code / "upstream" / "dep (1)"
-    b.git("submodule", "add", "-q", b.remotes / "triad-dep.git", "upstream/dep (1)", cwd=code)
-    b.git("submodule", "deinit", "-q", "-f", "upstream/dep (1)", cwd=code)
-    sub = b.run("git", "-C", code, "submodule", "status", "--recursive")
-    assert any(ln.startswith("-") and ln.endswith(" upstream/dep (1)")
-               for ln in sub.stdout.splitlines()), sub.stdout
-    assert odd.is_dir() and not any(odd.iterdir())
-
-    def leg_paths(proc):
-        return [ln.split("\t")[3] for ln in proc.stdout.splitlines() if ln.startswith("leg\t")]
-
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert leg_paths(proc) == [str(t["spec"]), str(code), str(dep)], proc.stdout
-    os.chmod(odd, 0)
-    try:
-        proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    finally:
-        os.chmod(odd, 0o755)
-    assert proc.returncode == 3, proc.stdout + proc.stderr
-    assert leg_paths(proc) == [str(t["spec"]), str(code), str(dep), str(odd)], proc.stdout
-    leg = porcelain_rows(proc.stdout, "leg")[str(odd)]
-    assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", leg
-    assert "a dependency nested in the code leg (code/upstream/dep (1))" in leg["why"], leg
-
-
-@NEEDS_UPSTREAM
-def test_t018_dependencies_a_leg_nests_that_cannot_be_listed_refuse_the_sweep(triad):
-    """THE SWEEP'S OWN REFUSAL, UNSHADOWED: `git submodule status --recursive`
-    failing in a checked-out leg - here a nested dependency whose `.git` names
-    no repository - leaves the assembly's checkouts unknown, so the sweep
-    refuses, exit 2. `lane-reconcile` does not read nested dependencies, so its
-    verdict is no `indeterminate` that refuses first: this is `_assembly`'s."""
-    b, t = triad
-    a = t["assembly"]
-    (t["dep"] / ".git").write_text("gitdir: /nonexistent/t018-dep\n")
-    rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    verdict = next((ln.split(US)[1] for ln in rec.stdout.splitlines()
-                    if ln.split(US)[0] == "VERDICT"), "")
-    assert verdict and verdict != "indeterminate", rec.stdout
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    assert proc.returncode == 2, proc.stdout + proc.stderr
-    assert f"the legs of the assembly {a} could not be read" in proc.stdout, proc.stdout
-    assert "the dependencies nested in the code leg" in proc.stdout
-    assert "could not be listed (git submodule status failed)" in proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_that_is_not_checked_out_is_absent_and_claims_no_tree_of_the_assembly(triad):
-    """A DEINITIALIZED LEG is an empty directory of the assembly's, where git
-    answers the ASSEMBLY. The sweep lists it `absent`, counted for nobody; the
-    assembly's own trees and registrations stay the assembly's rather than
-    becoming that leg's (`probe_leg`'s toplevel guard); and `add` from the
-    assembly records the assembly, never the empty leg (`add`'s guard)."""
-    b, t = triad
-    a = t["assembly"]
-    b.git("submodule", "deinit", "-q", "spec", cwd=a)
-    assert not any((a / "spec").iterdir())
-    made = b.tool("lane-worktrees", "add", "triad-1", "root-work")
-    assert made.returncode == 0, made.stderr
-    tree = made.stdout.strip()
-    assert "is an ASSEMBLY, and this tree is of the assembly itself" in made.stderr
-    assert "the spec leg of" not in made.stderr, made.stderr
-    assert _inventory(b, "triad-1")[tree] == str(a)
-    away = b.projects / "away-root"
-    b.git("worktree", "add", "-q", "-b", "away-root", away, "origin/main", cwd=a)
-    proc = b.sweep("triad-1", "--dry-run", "--porcelain")
-    legs = porcelain_rows(proc.stdout, "leg")
-    assert legs[str(t["spec"])]["disposition"] == "absent", legs
-    assert legs[str(t["spec"])]["retire"] == "-", legs
-    assert "not checked out here" in legs[str(t["spec"])]["why"], legs
-    assert legs[str(t["code"])]["disposition"] == "clean", legs
-    trees = porcelain_rows(proc.stdout, "tree")
-    assert trees[tree]["retire"] == "retire", trees
-    for path in (tree, str(away)):
-        assert "spec leg" not in trees[path]["why"], trees[path]
-    assert trees[str(away)]["disposition"] == "foreign", trees
-
-
-def _lane_worktrees_module():
-    """`lane-worktrees` as a module, its bytecode written nowhere (as
-    tests/test_lane_worktrees.py loads it)."""
-    import importlib.util
-    from importlib.machinery import SourceFileLoader
-    loader = SourceFileLoader("lane_worktrees_t018", str(REPO / "lane-worktrees"))
-    spec = importlib.util.spec_from_loader("lane_worktrees_t018", loader)
-    module = importlib.util.module_from_spec(spec)
-    was = sys.dont_write_bytecode
-    sys.dont_write_bytecode = True
-    try:
-        loader.exec_module(module)
-    finally:
-        sys.dont_write_bytecode = was
-    return module
-
-
-def test_t018_the_sweeps_paired_root_refuses_what_it_cannot_list_or_search(tmp_path):
-    """THE SWEEP'S OWN PAIRED-ROOT REFUSAL (`Sweep._paired`), which no run
-    shows: `lane-reconcile` reads the same directories first and says
-    `indeterminate`, and the sweep refuses on that verdict before it looks.
-    Called directly: the root, a feature directory, or a leg's directory under
-    it that cannot be listed or searched each refuse, naming it; readable,
-    the tree in it is found."""
-    if os.geteuid() == 0:
-        pytest.skip("root lists and searches a mode-000 directory")
-    import types
-    lw = _lane_worktrees_module()
-    root = tmp_path / "worktrees"
-    feature = root / "001-a"
-    tree = feature / "code"
-    tree.mkdir(parents=True)
-    (tree / ".git").write_text("gitdir: /nonexistent\n")
-    legs = [types.SimpleNamespace(decl="spec", nested_in=""),
-            types.SimpleNamespace(decl="code", nested_in="")]
-
-    def paired():
-        sweep = types.SimpleNamespace(paired_root=str(root), legs=legs, refusal="")
-        seen: dict = {}
-        lw.Sweep._paired(sweep, seen)
-        return sweep.refusal, seen
-
-    refusal, seen = paired()
-    assert refusal == "" and list(seen) == [lw.real(str(tree))], (refusal, seen)
-    for target, mode, words in ((root, 0, "worktree root"), (root, 0o600, "worktree root"),
-                                (feature, 0, "feature directory"),
-                                (feature, 0o600, "feature directory"),
-                                (tree, 0o600, "paired tree directory")):
-        os.chmod(target, mode)
-        try:
-            refusal, seen = paired()
-        finally:
-            os.chmod(target, 0o755)
-        assert f"{words} {target} could not be" in refusal, (target, oct(mode), refusal)
-        assert not seen, (target, oct(mode), seen)
-
-
-@NEEDS_UPSTREAM
-def test_t018_project_legs_reads_quoted_scalars_as_openreposhape_v1_writes_them(triad):
-    """openRepoShape v1.0.0 (opensoft/openRepoShape#395) writes the assembly
-    template's scalars QUOTED: `path: "{{SPEC_PATH}}"` under `legs:`, and `id:`,
-    `elected_on:`, `visibility:` and `tracking_branch:` alike. The one reader
-    every lane tool asks reads `path: "code"` and `path: 'code'` - and a quoted
-    `repository:` - exactly as `path: code`, so the sweep's leg rows are the
-    same three."""
-    b, t = triad
-    a = t["assembly"]
-    want = [f"opensoft/triad-spec\tspec\t{a}/spec", f"opensoft/triad-code\tcode\t{a}/code"]
-    proc = b.tool("lanes-edit.sh", "project-legs", a)
-    assert proc.returncode == 0 and proc.stdout.splitlines() == want, proc.stdout + proc.stderr
-    plain = (a / "project.yaml").read_text(encoding="utf-8")
-    for q in ('"', "'"):
-        lines, inlegs, quoted = [], False, 0
-        for line in plain.splitlines():
-            if re.match(r"^[A-Za-z_][A-Za-z0-9_]*:", line):
-                inlegs = line.startswith("legs:")
-            top = re.match(r"^(id|elected_on|visibility|tracking_branch):\s*(\S.*?)\s*$", line)
-            leg = re.match(r"^(\s+(?:repository|path):\s*)(\S.*?)\s*$", line) if inlegs else None
-            m = top or leg
-            if m:
-                head = f"{m.group(1)}: " if top else m.group(1)
-                line = f"{head}{q}{m.group(2).strip(chr(34) + chr(39))}{q}"
-                quoted += 1
-            lines.append(line)
-        assert quoted >= 10, quoted
-        (a / "project.yaml").write_text("\n".join(lines) + "\n", encoding="utf-8")
-        assert f"path: {q}spec{q}" in (a / "project.yaml").read_text()
-        proc = b.tool("lanes-edit.sh", "project-legs", a)
-        assert proc.returncode == 0, proc.stderr
-        assert proc.stdout.splitlines() == want, (q, proc.stdout)
-        legs = porcelain_rows(b.sweep("triad-1", "--dry-run", "--porcelain").stdout, "leg")
-        assert list(legs) == [str(t["spec"]), str(t["code"]), str(t["dep"])], (q, legs)
-
-
-# ========================================================= (c) the daily report
-
-def _section(text: str, title: str) -> str:
-    start = text.index(f"## {title}")
-    end = text.find("\n## ", start + 3)
-    return text[start:end if end != -1 else len(text)]
-
-
-@NEEDS_UPSTREAM
-def test_t018_the_report_counts_each_leg_as_a_checkout_of_its_own(triad):
-    b, t = triad
-    a = t["assembly"]
-    tmp = b.root / "leg-branch"
-    b.git("worktree", "add", "-q", "-b", "leg-unpushed", tmp, "origin/main", cwd=t["code"])
-    b.commit(tmp, "leg work", {"l.txt": "l\n"}, lane="triad-1")
-    b.git("worktree", "remove", tmp, cwd=t["code"])
-    (t["spec"] / "edit.md").write_text("an edit in the spec leg\n")
-    proc = b.tool("lane-worktrees", "sweep", "--all", "--dry-run", "--report", "--estate",
-                  b.projects)
-    assert proc.returncode == 0, proc.stderr
-    branches = _section(proc.stdout, "Unmerged branches with a missing, diverged or unpushed upstream")
-    assert f"- {t['code']} leg-unpushed ·" in branches, branches
-    assert f"the code leg of {a}" in branches
-    legs = _section(proc.stdout, "Assembly legs with uncommitted or unpublished work")
-    assert f"- {t['spec']} · the spec leg of {a} ·" in legs, legs
-    assert "1 dirty or untracked path(s)" in legs
-    assert str(t["code"]) + " ·" not in legs
-    assert "| Assembly legs with uncommitted or unpublished work | 1 |" in proc.stdout
-
-
-def test_t018_a_report_with_no_assembly_has_no_legs_section(tmp_path):
-    b = Bench(tmp_path / "bench", REPO)
-    b.seeded("plain", {"p.txt": "p\n"})
-    b.git("clone", "-q", b.remotes / "plain.git", b.projects / "plain")
-    proc = b.tool("lane-worktrees", "sweep", "--all", "--dry-run", "--report", "--estate",
-                  b.projects)
-    assert proc.returncode == 0, proc.stderr
-    assert "Assembly legs" not in proc.stdout
-
-
-def test_t018_the_report_lists_a_leg_that_is_also_a_canonical_clone_once(tmp_path):
-    """FINDING 1 OF THE READ-ONLY TRIAD MEASUREMENT (2026-10-17): a leg whose
-    `.git` is a DIRECTORY - a clone, not a submodule's gitfile - is also one of
-    the estate's canonical checkouts, and the report read it once as each, so
-    its branch rows printed twice (8 rows on that workstation) and its `main`
-    row would have. Each leg's rows now appear once, still naming the leg, in
-    the branch, `main` and rescue sections. The manifest is written here, so
-    no template is needed."""
-    b = Bench(tmp_path / "bench", REPO)
-    a = b.projects / "cl"
-    b.origin("cl")
-    b.git("clone", "-q", b.remotes / "cl.git", a)
-    b.commit(a, "the assembly, its legs clones", {
-        ".gitignore": "spec/\ncode/\n",
-        "project.yaml": ("schema_version: 1\nkind: project-manifest\nid: \"cl\"\nlegs:\n"
-                         "  - role: assembly\n    repository: opensoft/cl\n    path: \".\"\n"
-                         "  - role: spec\n    repository: opensoft/cl-spec\n    path: \"spec\"\n"
-                         "  - role: code\n    repository: opensoft/cl-code\n    path: \"code\"\n")})
-    b.git("push", "-q", "origin", "main", cwd=a)
-    spec, code = a / "spec", a / "code"
-    b.git("clone", "-q", b.seeded("cl-spec", {"s.md": "s\n"}), spec)
-    b.git("clone", "-q", b.seeded("cl-code", {"c.txt": "c\n"}), code)
-    assert (spec / ".git").is_dir() and (code / ".git").is_dir()
-    # the code leg: a branch with no upstream, and a rescue branch past the aging line
-    b.git("checkout", "-q", "-b", "leg-unpushed", cwd=code)
-    b.commit(code, "leg work", {"l.txt": "l\n"}, lane="cl-1")
-    b.git("checkout", "-q", "-b", "rescue/cl-1/old", "main", cwd=code)
-    old = {"GIT_AUTHOR_DATE": "2020-01-01T00:00:00+00:00",
-           "GIT_COMMITTER_DATE": "2020-01-01T00:00:00+00:00"}
-    made = b.run("git", "commit", "-q", "--allow-empty", "-m", "old rescue", cwd=code, env=old)
-    assert made.returncode == 0, made.stderr
-    b.git("checkout", "-q", "main", cwd=code)
-    # the spec leg: local main ahead of origin
-    b.commit(spec, "spec work on main", {"m.md": "m\n"}, lane="cl-1")
-
-    proc = b.tool("lane-worktrees", "sweep", "--all", "--dry-run", "--report", "--estate",
-                  b.projects)
-    assert proc.returncode == 0, proc.stderr
-    foreign = _section(proc.stdout, "FOREIGN repositories")
-    assert str(spec) not in foreign and str(code) not in foreign, foreign   # both canonical
-    branches = _section(proc.stdout, "Unmerged branches with a missing, diverged or unpushed upstream")
-    rows = [ln for ln in branches.splitlines() if ln.startswith(f"- {code} leg-unpushed ·")]
-    assert len(rows) == 1, branches
-    assert rows[0].endswith(f"the code leg of {a}"), rows
-    root_main = _section(proc.stdout, "Root main divergence")
-    rows = [ln for ln in root_main.splitlines() if ln.startswith(f"- {spec} · local main ahead")]
-    assert len(rows) == 1, root_main
-    assert rows[0].endswith(f"the spec leg of {a}"), rows
-    aging = _section(proc.stdout, "Awaiting disposition")
-    rows = [ln for ln in aging.splitlines() if ln.startswith(f"- {code} rescue/cl-1/old ·")]
-    assert len(rows) == 1, aging
-    assert rows[0].endswith(f"the code leg of {a}"), rows
-    legs = _section(proc.stdout, "Assembly legs with uncommitted or unpublished work")
-    assert legs.count(f"- {spec} · the spec leg of {a} ·") == 1, legs
-
-
-# ================================================================ (d) add
-
-def _inventory(b: Bench, lane: str) -> dict:
-    """{path: checkout} of the lane's #97 inventory."""
-    proc = b.tool("lanes-edit.sh", "lane-trees", lane)
-    assert proc.returncode in (0, 8), proc.stderr
-    rows = {}
-    for line in proc.stdout.splitlines():
-        cols = line.split(US)
-        if len(cols) > 9:
-            rows[cols[1]] = cols[9]
-    return rows
-
-
-@NEEDS_UPSTREAM
-def test_t018_add_records_the_leg_it_made_a_tree_from(triad):
-    b, t = triad
-    a = t["assembly"]
-    dry = b.tool("lane-worktrees", "add", "triad-1", "c1", "--checkout", t["code"], "--dry-run")
-    assert dry.returncode == 0, dry.stderr
-    assert f"--checkout {t['code']} - the code leg of {a}/project.yaml (opensoft/triad-code)" \
-        in dry.stderr
-    made = b.tool("lane-worktrees", "add", "triad-1", "c1", "--checkout", t["code"])
-    assert made.returncode == 0, made.stderr
-    tree = Path(made.stdout.strip())
-    assert f"in {t['code']} - the code leg of {a}/project.yaml" in made.stderr
-    assert _inventory(b, "triad-1")[str(tree)] == str(t["code"])
-    # FROM A WORKTREE OF THE LEG'S REPOSITORY, the leg is what is recorded
-    paired = a / "worktrees" / "010-v" / "code"
-    b.git("worktree", "add", "-q", "-b", "010-v", paired, "origin/main", cwd=t["code"])
-    made = b.tool("lane-worktrees", "add", "triad-1", "c2", "--checkout", paired)
-    assert made.returncode == 0, made.stderr
-    assert f"with {t['code']} as its checkout" in made.stderr
-    assert _inventory(b, "triad-1")[made.stdout.strip()] == str(t["code"])
-    # the sweep then reads it through its leg
-    row = porcelain_rows(b.sweep("triad-1", "--dry-run", "--porcelain").stdout,
-                         "tree")[made.stdout.strip()]
-    assert row["retire"] == "retire", row
-
-
-@NEEDS_UPSTREAM
-def test_t018_add_from_the_assembly_itself_says_its_legs_are_empty(triad):
-    b, t = triad
-    a = t["assembly"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "root-work")
-    assert made.returncode == 0, made.stderr
-    assert "is an ASSEMBLY, and this tree is of the assembly itself" in made.stderr
-    # every leg is named, never only the last one the manifest declares
-    assert f"--checkout {a}/spec or --checkout {a}/code" in made.stderr, made.stderr
-    assert _inventory(b, "triad-1")[made.stdout.strip()] == str(a)
-
-
-
-@NEEDS_UPSTREAM
-def test_t018_add_refuses_where_the_manifest_cannot_be_read(triad):
-    """Never "no legs" (Amendment 7(d)): which checkout the tree would be
-    recorded under is unknown, so nothing is made, in the words the sweep
-    and the reconciliation use for the same fact."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 file")
-    os.chmod(t["assembly"] / "project.yaml", 0)
-    try:
-        proc = b.tool("lane-worktrees", "add", "triad-1", "c9", "--checkout", t["code"])
-    finally:
-        os.chmod(t["assembly"] / "project.yaml", 0o644)
-    assert proc.returncode == 2, proc.stderr
-    assert (f"REFUSED, nothing was made: the legs of the assembly {t['assembly']} could not "
-            "be read") in proc.stderr
-    assert not (t["assembly"].parent / ".lane-worktrees" / "triad-1" / "c9").exists()
-    assert not any(p.endswith("/c9") for p in _inventory(b, "triad-1"))
-
-# ===================================================================== capture
-
-def capture(tools: Path, golden: Path) -> None:
-    """Write the golden file from the tools in `tools` - run ONCE, against
-    `c45a452`'s (`git archive c45a452 | tar -x -C <dir>`), and committed."""
-    with tempfile.TemporaryDirectory(prefix="t018-capture.") as tmp:
-        text = render_golden(single_repository(Bench(Path(tmp) / "bench", tools)))
-    golden.parent.mkdir(parents=True, exist_ok=True)
-    golden.write_text(text, encoding="utf-8")
-
-
-if __name__ == "__main__":
-    if len(sys.argv) in (3, 4) and sys.argv[1] == "--capture":
-        capture(Path(sys.argv[2]).resolve(), Path(sys.argv[3]) if len(sys.argv) == 4 else GOLDEN)
-        sys.exit(0)
-    sys.stderr.write("usage: test_triad_lane_tooling.py --capture <tools dir> [<golden>]\n")
-    sys.exit(64)
diff --git a/tests/test_triad_lane_tooling_handoff.py b/tests/test_triad_lane_tooling_handoff.py
deleted file mode 100644
index 28578298..00000000
--- a/tests/test_triad_lane_tooling_handoff.py
+++ /dev/null
@@ -1,1293 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""T018 (b) (opensoft/openRepoTools#186): `lane-handoff` and `lane-reconcile`
-see a TRIAD's trees.
-
-A lane's checkout is an ASSEMBLY when its own `project.yaml` declares a leg
-other than itself - read by `lanes-edit.sh project-legs`, the one reader every
-lane tool asks. Its legs are submodules, and a feature's trees are worktrees of
-the LEGS' repositories, so before this (docs/triad-lane-tooling-analysis.md
-§4.4 and §4.7):
-
-  1. `lane-handoff`'s writer poll never looked in the paired feature trees
-     `<assembly>/worktrees/<feature>/{spec,code}`, so a lane with unpushed work
-     there was absent from its WRITERS block;
-  2. a handoff re-recorded a tree made by `lane-worktrees add --checkout
-     <assembly>/code` with the ASSEMBLY as its checkout, so the leg `add` had
-     recorded was lost from the inventory at the first handoff;
-  3. `lane-reconcile` recomputed from the checkout's own worktree registrations
-     and never read the legs', nor the paired root.
-
-Each is held here on an assembly built from openRepoShape's own template bytes
-at the pinned commit, with every leg a real git repository behind a bare local
-origin and a fake `gh` that exits 1 (the bench of `tests/test_triad_lane_tooling.py`,
-imported, so the two modules build one assembly one way). AND THE CONDITION OF
-ALL THREE: on a single repository - no `project.yaml`, or one naming no leg but
-itself - the handoff's output, its top block, the inventory it writes and the
-reconciliation are byte for byte what `c45a452`'s tools printed, even where the
-repository is laid out to look like a triad (a submodule with a worktree under
-`worktrees/<feature>/code`, and a tree recorded with the submodule as its
-checkout). That "before" is STORED (`tests/fixtures/t018-handoff/`), generated
-ONCE from `c45a452`'s own tools by this module's `--capture`, because CI checks
-out at depth 1; `tests/test_triad_lane_tooling.py`'s own golden covers the
-ordinary single repository and keeps passing unregenerated.
-
-NOTHING REAL IS TOUCHED: every repository, origin, register, `$HOME` and state
-directory is under `tmp_path`, and the network is never reached.
-"""
-
-from __future__ import annotations
-
-import difflib
-import os
-import shlex
-import shutil
-import subprocess
-import sys
-import tempfile
-from pathlib import Path
-
-import pytest
-
-sys.path.insert(0, str(Path(__file__).resolve().parent))
-from conftest import NEEDS_UPSTREAM, REPO, WINDOWS_SKIP  # noqa: E402
-from test_triad_lane_tooling import (  # noqa: E402
-    US, Bench, build_assembly, normalise, parse_golden, porcelain_rows, render_golden, shown)
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("git") is None or shutil.which("bash") is None,
-    reason="the lane tools are bash and Python over git")]
-
-GOLDEN = (Path(__file__).resolve().parent / "fixtures" / "t018-handoff"
-          / "single-repository-decoys.golden")
-
-
-# ================================================================== helpers
-
-def inventory(b: Bench, lane: str) -> dict:
-    """{path: checkout} of the lane's #97 inventory, `lane-trees`' tenth field."""
-    proc = b.tool("lanes-edit.sh", "lane-trees", lane)
-    assert proc.returncode in (0, 8), proc.stderr
-    rows = {}
-    for line in proc.stdout.splitlines():
-        cols = line.split(US)
-        if len(cols) > 9:
-            rows[cols[1]] = cols[9]
-    return rows
-
-
-def reconcile_rows(out: str) -> dict:
-    """{physical path: (class, why)} of `lane-reconcile`'s TREE rows. Keyed by
-    the PHYSICAL path, because git's registrations are spelled physically and
-    a recorded tree as it was polled (macOS keeps `$TMPDIR` under `/var`, a
-    symlink); look a path up with `real()`."""
-    rows = {}
-    for line in out.splitlines():
-        cols = line.split(US)
-        if cols[0] == "TREE" and len(cols) > 4:
-            rows[real(cols[3])] = (cols[2], cols[4])
-    return rows
-
-
-def real(path) -> str:
-    return os.path.realpath(str(path))
-
-
-def field(out: str, key: str) -> list:
-    return next((ln.split(US)[1:] for ln in out.splitlines() if ln.split(US)[0] == key), [])
-
-
-def handoff(b: Bench, lane: str, cwd: Path, why: str = "t018 handoff",
-            *flags: str, env: dict | None = None) -> subprocess.CompletedProcess:
-    return b.tool("lane-handoff", "--lane", lane, "--transcript", "none", "--agent", "claude",
-                  *flags, why, cwd=cwd, env=env)
-
-
-def writers_file(b: Bench, lane: str, rows: dict) -> Path:
-    """A `--writers-file`: `<worktree> TAB <brief>`, one a line."""
-    path = b.root / f"writers-{lane}.tsv"
-    path.write_text("".join(f"{tree}\t{brief}\n" for tree, brief in rows.items()))
-    return path
-
-
-def top_block(b: Bench, lane: str) -> str:
-    return (b.wip / "handoffs" / f"{lane}.md").read_text().split("\n---\n", 1)[0]
-
-
-def git_says(b: Bench, leg: Path) -> str:
-    """WHAT EVERY READER QUOTES for a leg git cannot read - the sweep's
-    `probe_leg`, `lane-reconcile` and `lane-handoff` alike: git's own answer to
-    `rev-parse --show-toplevel` in the leg, its first non-empty error line, or
-    `git answers <toplevel> there` where git names another checkout. Asked of
-    the git under test, never spelled here, because git words the same
-    condition differently by version: for a `.git` file naming a directory that
-    does not exist, 2.43 says `fatal: not a git repository: <that path>` and
-    2.55 (CI's ubuntu runner, PR #246) says `fatal: not a git repository:
-    (null)`. The tools read the CONDITION (git's toplevel there is not the leg,
-    and a `.git` stands in it); only this quoted clause is git's."""
-    proc = b.run("git", "-C", leg, "rev-parse", "--show-toplevel")
-    if proc.returncode == 0:
-        return f"git answers {proc.stdout.strip()} there"
-    return next((ln.strip() for ln in proc.stderr.splitlines() if ln.strip()), "no answer")
-
-
-def leg_tree(b: Bench, leg: Path, path: Path, branch: str) -> Path:
-    """A worktree of `leg`'s repository at `path`, on a new branch from origin/main."""
-    b.git("worktree", "add", "-q", "-b", branch, path, "origin/main", cwd=leg)
-    return path
-
-
-@pytest.fixture
-def triad(tmp_path):
-    b = Bench(tmp_path / "bench", REPO)
-    t = build_assembly(b)
-    b.lanes("opensoft/triad", t["assembly"], "triad-1", "triad-2")
-    return b, t
-
-
-# ============================================================= (1) and (2)
-
-@NEEDS_UPSTREAM
-def test_t018_the_handoff_polls_the_paired_trees_and_records_each_tree_under_its_leg(triad):
-    """(1) THE PAIRED TREES ARE POLLED: a paired code tree holding the lane's
-    unpushed commit and a paired spec tree holding a writer's first edit are in
-    the WRITERS block, and what under the paired root is not a checkout of its
-    own is not. (2) EACH TREE IS RECORDED UNDER ITS LEG: the code tree `add`
-    made with `--checkout <assembly>/code` keeps the leg as its checkout through
-    the handoff, the paired trees are recorded under theirs, and a tree of the
-    assembly itself is still recorded under the assembly. The reconciliation
-    then reads every one of them as inventoried, never as unmanaged."""
-    b, t = triad
-    a, code, spec = t["assembly"], t["code"], t["spec"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "c1", "--checkout", code)
-    assert made.returncode == 0, made.stderr
-    lane_code = Path(made.stdout.strip())
-    assert inventory(b, "triad-1")[str(lane_code)] == str(code)
-    b.commit(lane_code, "the slice's code", {"c1.txt": "c1\n"}, lane="triad-1")
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    paired_code = leg_tree(b, code, a / "worktrees" / "007-y" / "code", "007-y")
-    b.commit(paired_code, "the feature's code", {"f.txt": "f\n"}, lane="triad-1")
-    paired_spec = leg_tree(b, spec, a / "worktrees" / "007-y" / "spec", "007-y")
-    (paired_spec / "draft.md").write_text("a writer's first edit\n")
-    # under the paired root and NOT a checkout of its own: the assembly's tree
-    (a / "worktrees" / "007-y" / "notes").mkdir()
-    (a / "worktrees" / "007-y" / "notes" / "n.md").write_text("n\n")
-    # the spec writer has committed nothing, so no trailer finds it: the
-    # writers file names it, and that makes it this lane's (M1 (a))
-    wf = writers_file(b, "triad-1", {paired_spec: "the 007-y spec writer"})
-
-    proc = handoff(b, "triad-1", a, "t018 handoff", "--writers-file", str(wf))
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    for tree, branch in ((lane_code, "c1"), (lane_root, "root"), (paired_code, "007-y"),
-                         (paired_spec, "007-y")):
-        assert f"WRITER {tree} — branch {branch}" in proc.stdout, proc.stdout
-    for not_one in (a / "worktrees" / "007-y" / "notes", a / "worktrees" / "007-y"):
-        assert f"WRITER {not_one} —" not in proc.stdout, proc.stdout
-    assert f"writers polled: 4 under {a}" in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert "NOT POLLED" not in proc.stdout + proc.stderr
-
-    block = top_block(b, "triad-1")
-    assert f"(4 found under `{a}`)" in block, block
-    assert (f"- `{paired_code}` — branch `007-y`, last commit" in block
-            and "0 dirty, 1 unpushed" in block.split(f"`{paired_code}`", 1)[1].split("\n", 1)[0]), block
-    assert "1 dirty, 0 unpushed" in block.split(f"`{paired_spec}`", 1)[1].split("\n", 1)[0], block
-    assert "brief: the 007-y spec writer" in block, block
-    assert "PAIRED ROOT" not in block and "PAIRED ROOT" not in proc.stdout, block
-
-    inv = inventory(b, "triad-1")
-    assert inv == {str(lane_code): str(code), str(lane_root): str(a),
-                   str(paired_code): str(code), str(paired_spec): str(spec)}, inv
-
-    rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    assert rec.returncode == 0, rec.stderr
-    rows = reconcile_rows(rec.stdout)
-    assert rows[real(paired_code)][0] == "unpushed", rows
-    assert rows[real(paired_spec)][0] == "dirty", rows
-    assert not [p for p, (cls, _w) in rows.items() if cls in ("unmanaged", "stale-registration")], rows
-    assert field(rec.stdout, "TREES")[0] == "4 inventoried", rec.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_that_is_not_checked_out_claims_no_tree_of_the_assembly(triad):
-    """A LEG THAT IS NOT CHECKED OUT is an empty directory of the assembly's,
-    where git answers the ASSEMBLY - so read naively, its repository would be
-    the assembly's and every tree of the assembly would be recorded under it.
-    Deinitialized, the spec leg names no tree; the code leg still names its own."""
-    b, t = triad
-    a, code = t["assembly"], t["code"]
-    b.git("submodule", "deinit", "-q", "spec", cwd=a)
-    assert not any((a / "spec").iterdir())
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    paired_code = leg_tree(b, code, a / "worktrees" / "008-z" / "code", "008-z")
-    b.commit(paired_code, "the feature's code", {"z.txt": "z\n"}, lane="triad-1")
-    proc = handoff(b, "triad-1", a)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"writers polled: 2 under {a}" in proc.stderr, proc.stderr
-    # not checked out is no unreadable leg: it has no `.git` of its own
-    assert f"the leg {a / 'spec'} is unreadable" not in proc.stderr, proc.stderr
-    assert "UNREADABLE LEG" not in top_block(b, "triad-1")
-    assert inventory(b, "triad-1") == {str(lane_root): str(a), str(paired_code): str(code)}
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_manifest_the_handoff_cannot_read_is_said_and_the_handoff_goes_on(triad):
-    """A `project.yaml` that is there and cannot be read is never "no legs"
-    (Amendment 7(d)), and a swap is never left unwritten (`R-A11-11`): the
-    handoff exits 0, the paired root is NOT polled and the top block says so,
-    a tree of the assembly's own repository is recorded as always, a tree of a
-    leg keeps the checkout `add` recorded rather than one nobody could
-    establish, and the lane stays SWAPPING."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 file")
-    a, code = t["assembly"], t["code"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "c1", "--checkout", code)
-    assert made.returncode == 0, made.stderr
-    lane_code = Path(made.stdout.strip())
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    paired_code = leg_tree(b, code, a / "worktrees" / "009-w" / "code", "009-w")
-    b.commit(paired_code, "the feature's code", {"w.txt": "w\n"}, lane="triad-1")
-    os.chmod(a / "project.yaml", 0)
-    try:
-        proc = handoff(b, "triad-1", a, "unreadable manifest")
-    finally:
-        os.chmod(a / "project.yaml", 0o644)
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert (f"the legs of the assembly {a} could not be read (its project.yaml is there, "
-            "and ") in proc.stderr, proc.stderr
-    assert "paired feature trees" in proc.stderr and "were NOT polled" in proc.stderr
-    assert f"WRITER {paired_code} —" not in proc.stdout, proc.stdout
-    assert f"WRITER {lane_code} —" in proc.stdout and f"WRITER {lane_root} —" in proc.stdout
-    assert f"the worktree inventory entry for {lane_code} was NOT written" in proc.stderr
-    assert "lifecycle: SWAPPING" in proc.stdout, proc.stdout
-    assert "the assembly's legs could not be read" in proc.stderr
-    block = top_block(b, "triad-1")
-    assert "- NOT POLLED: " in block and f"`{a}/worktrees`" in block, block
-    assert inventory(b, "triad-1") == {str(lane_code): str(code), str(lane_root): str(a)}
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_handoff_takes_no_other_lanes_paired_tree(triad):
-    """M1 OF THE PRE-PR REVIEW, OPTION (a): THE PAIRED ROOT IS POLLED BY THE
-    SWEEP'S RULE. Two lanes share one assembly, and its paired root holds lane
-    2's trees: one whose HEAD's own trailer is lane 2's, unpushed, and one with
-    nothing committed that only lane 2's writers file names. Lane 1's handoff
-    neither polls, counts nor records either - each is one `PAIRED ROOT, not
-    this lane's` line outside WRITERS - so lane 1's `lane-end` passes; and lane
-    2's handoff polls and records both, each under its leg."""
-    b, t = triad
-    a, code, spec = t["assembly"], t["code"], t["spec"]
-    theirs = leg_tree(b, code, a / "worktrees" / "020-b" / "code", "020-b")
-    b.commit(theirs, "lane 2's feature code", {"b.txt": "b\n"}, lane="triad-2")
-    fresh = leg_tree(b, spec, a / "worktrees" / "021-c" / "spec", "021-c")
-    (fresh / "draft.md").write_text("lane 2's writer's first edit\n")
-    wf2 = writers_file(b, "triad-2", {fresh: "lane 2's 021-c spec writer"})
-
-    one = handoff(b, "triad-1", a)
-    assert one.returncode == 0, one.stdout + one.stderr
-    for tree in (theirs, fresh):
-        assert f"WRITER {tree} —" not in one.stdout, one.stdout
-        assert f"PAIRED ROOT, not this lane's: {tree} — branch" in one.stdout, one.stdout
-    assert f"writers polled: 0 under {a}" in one.stderr, one.stderr
-    assert "paired root: 2 tree(s)" in one.stderr, one.stderr
-    assert "lifecycle: SWAPPED" in one.stdout, one.stdout
-    assert "NOT POLLED" not in one.stdout + one.stderr
-    block = top_block(b, "triad-1")
-    writers, _sep, rest = block.partition("**PAIRED ROOT at ")
-    assert "(0 found under" in writers and "- none running at the handoff." in writers, block
-    assert str(theirs) not in writers and str(fresh) not in writers, block
-    assert f"2 tree(s) under `{a}/worktrees` that are NOT this lane's" in rest, block
-    assert (f"- PAIRED ROOT, not this lane's: `{theirs}` — branch `020-b`, last commit "
-            in rest), block
-    assert "HEAD's own `Lane:` trailer `triad-2`" in rest, block
-    assert f"- PAIRED ROOT, not this lane's: `{fresh}` — branch `021-c`" in rest, block
-    assert "HEAD's own `Lane:` trailer none" in rest, block
-    assert inventory(b, "triad-1") == {}
-    end = b.tool("lane-end", "triad-1")
-    assert end.returncode == 0, end.stdout + end.stderr
-
-    two = handoff(b, "triad-2", a, "t018 handoff", "--writers-file", str(wf2))
-    assert two.returncode == 0, two.stdout + two.stderr
-    for tree in (theirs, fresh):
-        assert f"WRITER {tree} —" in two.stdout, two.stdout
-    assert f"writers polled: 2 under {a}" in two.stderr, two.stderr
-    assert "PAIRED ROOT" not in two.stdout and "PAIRED ROOT" not in top_block(b, "triad-2")
-    assert inventory(b, "triad-2") == {str(theirs): str(code), str(fresh): str(spec)}
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_paired_directory_the_handoff_cannot_list_is_said_and_the_lane_stays_swapping(triad):
-    """S1 OF THE PRE-PR REVIEW: a paired root, a feature directory, or a leg's
-    directory under one that could not be listed or searched hid what stood in
-    it from the poll IN SILENCE, while `lane-reconcile` said `indeterminate`
-    and the sweep refused. Now each is a `- NOT POLLED` line in WRITERS and a
-    note on stderr, the handoff still exits 0 (`R-A11-11`), and the lane stays
-    SWAPPING; the reconciliation is `indeterminate` for every one of them."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root lists and searches a mode-000 directory")
-    a, code = t["assembly"], t["code"]
-    mine = leg_tree(b, code, a / "worktrees" / "030-m" / "code", "030-m")
-    b.commit(mine, "the lane's feature code", {"m.txt": "m\n"}, lane="triad-1")
-    clone = a / "worktrees" / "031-n" / "spec"
-    b.git("clone", "-q", b.remotes / "triad-spec.git", clone)
-    cases = (
-        (a / "worktrees", f"the assembly's paired root {a}/worktrees could not be listed", False),
-        (a / "worktrees" / "030-m",
-         f"the assembly's feature directory {a}/worktrees/030-m could not be listed", False),
-        (clone, f"the assembly's paired tree directory {clone} could not be searched", True),
-    )
-    for target, words, mine_seen in cases:
-        os.chmod(target, 0)
-        try:
-            proc = handoff(b, "triad-1", a, "unlistable")
-            rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-        finally:
-            os.chmod(target, 0o755)
-        assert proc.returncode == 0, proc.stdout + proc.stderr
-        assert (f"WRITER {mine} —" in proc.stdout) is mine_seen, (target, proc.stdout)
-        assert words in proc.stderr, (target, proc.stderr)
-        assert "may not have been polled" in proc.stderr, (target, proc.stderr)
-        assert "lifecycle: SWAPPING" in proc.stdout, (target, proc.stdout)
-        assert f"- NOT POLLED: {words}" in top_block(b, "triad-1"), target
-        verdict = field(rec.stdout, "VERDICT")
-        assert verdict and verdict[0] == "indeterminate", (target, rec.stdout)
-        assert words in verdict[1], (target, verdict)
-    proc = handoff(b, "triad-1", a, "readable again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"WRITER {mine} — branch 030-m" in proc.stdout, proc.stdout
-    assert f"PAIRED ROOT, not this lane's: {clone} —" in proc.stdout, proc.stdout
-    assert "NOT POLLED" not in proc.stdout + proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_tree_of_a_nested_dependency_keeps_the_checkout_add_recorded(triad):
-    """N5 OF THE PRE-PR REVIEW: a tree `add` made from a dependency nested in a
-    leg (`--checkout <assembly>/code/upstream/dep`) is no declared leg's, and
-    the next handoff re-recorded it under the assembly - the loss (b) fixed for
-    the legs. A recorded checkout of the tree's own repository is now kept."""
-    b, t = triad
-    dep = t["dep"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "d1", "--checkout", dep)
-    assert made.returncode == 0, made.stderr
-    tree = made.stdout.strip()
-    assert inventory(b, "triad-1")[tree] == str(dep)
-    proc = handoff(b, "triad-1", t["assembly"])
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"WRITER {tree} —" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1")[tree] == str(dep)
-
-
-# ===================================================================== (3)
-
-@NEEDS_UPSTREAM
-def test_t018_reconcile_reports_what_the_legs_hold_and_no_sidecar_names(triad):
-    """(3) THE LEGS' REGISTRATIONS AND THE PAIRED ROOT ARE READ: a spec tree
-    made away from every root, a paired code tree, a clone where a paired
-    worktree belongs and a registration whose directory is gone are each
-    reported - unmanaged or stale - naming the leg, while a tree the inventory
-    records is not, and neither leg's own checkout is."""
-    b, t = triad
-    a, code, spec = t["assembly"], t["code"], t["spec"]
-    away = leg_tree(b, spec, b.projects / "away-spec", "away")
-    paired = leg_tree(b, code, a / "worktrees" / "010-v" / "code", "010-v")
-    clone = a / "worktrees" / "010-v" / "spec"
-    b.git("clone", "-q", b.remotes / "triad-spec.git", clone)
-    gone = leg_tree(b, code, b.projects / "gone-code", "gone")
-    shutil.rmtree(gone)
-    made = b.tool("lane-worktrees", "add", "triad-1", "c1", "--checkout", code)
-    assert made.returncode == 0, made.stderr
-    recorded = made.stdout.strip()
-
-    proc = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    assert proc.returncode == 0, proc.stderr
-    rows = reconcile_rows(proc.stdout)
-    assert rows[real(away)][0] == "unmanaged", rows
-    assert f"git registers it in {spec}, the spec leg of {a}/project.yaml (opensoft/triad-spec)" \
-        in rows[real(away)][1], rows
-    assert rows[real(paired)][0] == "unmanaged", rows
-    assert f"the code leg of {a}/project.yaml" in rows[real(paired)][1], rows
-    assert rows[real(clone)][0] == "unmanaged", rows
-    assert f"paired feature trees ({a}/worktrees)" in rows[real(clone)][1], rows
-    assert rows[real(gone)][0] == "stale-registration", rows
-    assert f"git -C {code} worktree prune" in rows[real(gone)][1], rows
-    assert rows[real(recorded)][0] == "ok", rows
-    for not_a_tree in (a, code, spec, a / ".git" / "modules" / "code", a / ".git" / "modules" / "spec",
-                       a / "worktrees" / "010-v"):
-        assert real(not_a_tree) not in rows, rows
-    assert field(proc.stdout, "TREES") == ["1 inventoried", "0 dirty or unpushed",
-                                           "0 require recovery", "4 unmanaged or stale"], proc.stdout
-    assert field(proc.stdout, "VERDICT")[0] == "ungraceful-stop", proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_reconcile_pronounces_no_clearance_over_legs_nobody_read(triad):
-    """A manifest, or the paired root, that could not be read leaves paths
-    nobody inspected: the verdict is `indeterminate`, never a clearance."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 file")
-    a, code = t["assembly"], t["code"]
-    paired = leg_tree(b, code, a / "worktrees" / "011-u" / "code", "011-u")
-    os.chmod(a / "project.yaml", 0)
-    try:
-        proc = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    finally:
-        os.chmod(a / "project.yaml", 0o644)
-    assert proc.returncode == 0, proc.stderr
-    verdict = field(proc.stdout, "VERDICT")
-    assert verdict[0] == "indeterminate", proc.stdout
-    assert (f"the legs of the assembly {a} could not be read (its project.yaml is there and "
-            "unreadable)") in verdict[1], verdict
-    assert real(paired) not in reconcile_rows(proc.stdout)
-    # the paired root that cannot be listed: a clone stands in it, which only
-    # the listing could find (a registered tree is found through its leg)
-    b.git("worktree", "remove", paired, cwd=code)
-    b.git("clone", "-q", b.remotes / "triad-code.git", a / "worktrees" / "012-t" / "code")
-    os.chmod(a / "worktrees", 0)
-    try:
-        proc = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    finally:
-        os.chmod(a / "worktrees", 0o755)
-    assert proc.returncode == 0, proc.stderr
-    verdict = field(proc.stdout, "VERDICT")
-    assert verdict[0] == "indeterminate", proc.stdout
-    assert f"the assembly's paired root {a}/worktrees could not be listed" in verdict[1], verdict
-
-
-@NEEDS_UPSTREAM
-def test_t018_reconcile_reports_a_leg_git_cannot_read_as_the_sweep_counts_it(triad):
-    """A LEG WITH A `.git` OF ITS OWN THAT GIT CANNOT READ was passed over by
-    the reconciliation IN SILENCE, as a leg that is not checked out is, while
-    the sweep's `leg` row for it is `unreadable` and counted. Now it is the
-    sweep's rule and the sweep's word: one TREE row, `unreadable`, that requires
-    recovery - for a `.git` naming no repository, and for one where git answers
-    the assembly. Its verdict is no `indeterminate`, so the sweep still lists
-    and counts that leg (exit 3) rather than refusing on the verdict. Readable
-    again, or not checked out at all, the leg names nothing."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    gitfile = (spec / ".git").read_text()
-
-    def reconciled_rows() -> tuple:
-        rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-        assert rec.returncode == 0, rec.stderr
-        return rec, reconcile_rows(rec.stdout)
-
-    def check(answer: str) -> None:
-        rec, rows = reconciled_rows()
-        assert list(rows) == [real(spec)], rows
-        cls, why = rows[real(spec)]
-        assert cls == "unreadable", rows
-        assert why.startswith(f"the spec leg of {a}/project.yaml (opensoft/triad-spec): git could "
-                              "not be read through it (it has a .git of its own and git could not "
-                              "read it: "), why
-        assert answer in why and f"(git -C {spec} status)" in why, (answer, why)
-        # N2 of the review of bf2a220: a leg is the assembly's, not a writer's tree
-        assert why.endswith("before relaunching a writer onto a tree of its repository"), why
-        assert field(rec.stdout, "TREES") == ["0 inventoried", "0 dirty or unpushed",
-                                              "1 require recovery", "0 unmanaged or stale"], rec.stdout
-        assert field(rec.stdout, "VERDICT")[0] == "ungraceful-stop", rec.stdout
-        sweep = b.sweep("triad-1", "--dry-run", "--porcelain")
-        assert sweep.returncode == 3, sweep.stdout + sweep.stderr
-        leg = porcelain_rows(sweep.stdout, "leg")[str(spec)]
-        assert leg["disposition"] == "unreadable" and leg["retire"] == "retire", leg
-        assert "git could not be read through it" in leg["why"] and answer in leg["why"], leg
-
-    (spec / ".git").write_text("gitdir: /nonexistent/t018-spec\n")
-    check(git_says(b, spec))
-    (spec / ".git").unlink()
-    (spec / ".git").mkdir()
-    check(f"git answers {real(a)} there")
-    shutil.rmtree(spec / ".git")
-    (spec / ".git").write_text(gitfile)
-    for state in ("readable again", "deinitialized"):
-        if state == "deinitialized":
-            b.git("submodule", "deinit", "-q", "spec", cwd=a)
-            assert not any(spec.iterdir())
-        rec, rows = reconciled_rows()
-        assert real(spec) not in rows, (state, rows)
-        assert field(rec.stdout, "TREES")[2] == "0 require recovery", (state, rec.stdout)
-
-
-@NEEDS_UPSTREAM
-def test_t018_the_handoff_reports_a_leg_git_cannot_read_as_the_sweep_counts_it(triad):
-    """THE SAME SILENT SKIP IN `lane-handoff`: a leg with a `.git` of its own
-    that git cannot read was passed over as a leg that is not checked out is,
-    so the handoff said nothing of it, and a tree `add` made from that leg was
-    re-recorded under the ASSEMBLY - the loss (2) fixed. Now it is the sweep's
-    rule and word: one `- UNREADABLE LEG` line in WRITERS, a note on stderr and
-    a count, for a `.git` naming no repository and for one where git answers
-    the assembly. The lifecycle is not held for the leg itself (the
-    reconciliation's verdict is not `indeterminate` for it either): with no
-    tree of that leg the lane is SWAPPED. A tree of that leg keeps the checkout
-    `add` recorded - named, NOT recorded, and the lane stays SWAPPING for it -
-    while a tree of the assembly is recorded as always. Readable again, the
-    leg names nothing and its tree is recorded under it."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    gitfile = (spec / ".git").read_text()
-    words = (f"the spec leg of {a}/project.yaml (opensoft/triad-spec): git could not be read "
-             "through it (it has a .git of its own and git could not read it: ")
-
-    def check(answer: str, trees: tuple, unplaced: tuple, state: str) -> None:
-        proc = handoff(b, "triad-1", a, "unreadable leg")
-        assert proc.returncode == 0, proc.stdout + proc.stderr
-        assert f"the leg {spec} is unreadable: {words}" in proc.stderr, proc.stderr
-        assert answer in proc.stderr.split(f"the leg {spec} is unreadable: ", 1)[1], proc.stderr
-        assert f"legs: 1 of the assembly's legs under {a} unreadable" in proc.stderr, proc.stderr
-        assert f"writers polled: {len(trees)} under {a}" in proc.stderr, proc.stderr
-        for tree in trees:
-            assert f"WRITER {tree} —" in proc.stdout, proc.stdout
-            missed = f"the worktree inventory entry for {tree} was NOT written: "
-            if tree in unplaced:
-                assert (missed + "the assembly has 1 unreadable leg(s), each named by an "
-                        "UNREADABLE LEG line in the top block") in proc.stderr, proc.stderr
-            else:
-                assert missed not in proc.stderr, proc.stderr
-        assert f"lifecycle: {state}" in proc.stdout, proc.stdout
-        assert "NOT POLLED" not in proc.stdout + proc.stderr
-        writers = top_block(b, "triad-1").split("**WRITERS at ", 1)[1]
-        line = next((ln for ln in writers.splitlines() if ln.startswith("- UNREADABLE LEG: ")), "")
-        assert line.startswith(f"- UNREADABLE LEG: `{spec}` is unreadable, {words}"), writers
-        assert answer in line and f"(`git -C {spec} status`)" in line, line
-        assert writers.count("- UNREADABLE LEG: ") == 1, writers
-        # N2 of the review of bf2a220: a leg is the assembly's, not a writer's tree
-        assert line.endswith("before relaunching a writer onto a tree of its repository."), line
-        assert proc.stderr.split(f"the leg {spec} is unreadable: ", 1)[1].split("\n", 1)[0] \
-            .endswith("before relaunching a writer onto a tree of its repository."), proc.stderr
-        # N1: the leg's line says what was withheld, and a withheld tree's own line
-        # says it is NOT recorded, where a recorded tree's line does not
-        if unplaced:
-            assert (f"the {len(unplaced)} tree(s) this handoff could not place are named "
-                    "above, each marked (NOT recorded)") in line, line
-        else:
-            assert ("every tree this handoff polled could still be placed, so none is "
-                    "withheld for it") in line, line
-        for tree in trees:
-            assert (f"- `{tree}` (NOT recorded) — branch `" in writers) is (tree in unplaced), \
-                (tree, writers)
-            assert (f"- `{tree}` — branch `" in writers) is (tree not in unplaced), (tree, writers)
-
-    (spec / ".git").write_text("gitdir: /nonexistent/t018-spec\n")
-    check(git_says(b, spec), (lane_root,), (), "SWAPPED")
-    assert inventory(b, "triad-1") == {str(lane_root): str(a)}
-    rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    assert reconcile_rows(rec.stdout)[real(spec)][0] == "unreadable", rec.stdout
-    assert field(rec.stdout, "TREES")[2] == "1 require recovery", rec.stdout
-    assert field(rec.stdout, "VERDICT")[0] == "resumable", rec.stdout
-    (spec / ".git").unlink()
-    (spec / ".git").mkdir()
-    check(f"git answers {real(a)} there", (lane_root,), (), "SWAPPED")
-    shutil.rmtree(spec / ".git")
-    (spec / ".git").write_text(gitfile)
-
-    made = b.tool("lane-worktrees", "add", "triad-1", "s1", "--checkout", spec)
-    assert made.returncode == 0, made.stderr
-    lane_spec = Path(made.stdout.strip())
-    want = {str(lane_spec): str(spec), str(lane_root): str(a)}
-    assert inventory(b, "triad-1") == want
-    (spec / ".git").write_text("gitdir: /nonexistent/t018-spec\n")
-    check(git_says(b, spec), (lane_spec, lane_root), (lane_spec,), "SWAPPING")
-    assert inventory(b, "triad-1") == want
-
-    (spec / ".git").write_text(gitfile)
-    proc = handoff(b, "triad-1", a, "readable again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"the leg {spec} is unreadable" not in proc.stderr, proc.stderr
-    assert "of the assembly's legs under" not in proc.stderr, proc.stderr
-    assert "UNREADABLE LEG" not in top_block(b, "triad-1")
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == want
-
-
-@NEEDS_UPSTREAM
-def test_t018_an_unreadable_leg_withholds_no_tree_of_another_repository(triad):
-    """S1 OF THE REVIEW OF bf2a220: while a leg was unreadable, the handoff
-    withheld EVERY tree that was not of the assembly's own repository - a
-    worktree of an unrelated repository in the lane's own root included, as
-    lane openRepoTools-3's root holds today - so the lane stayed SWAPPING on
-    every handoff and those trees' records went stale for as long as the leg
-    stayed broken. Now only a tree that could be of the leg's repository is
-    withheld: one whose common git directory lies inside the assembly, or one
-    the inventory records under the unreadable leg. A worktree of a third
-    repository, recorded before or new, is recorded under the lane's `dir` as
-    when every leg reads, and with nothing else withheld the lane is SWAPPED."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    third = b.projects / "third"
-    b.git("clone", "-q", b.seeded("third", {"t.txt": "a third repository\n"}), third)
-    root = b.projects / ".lane-worktrees" / "triad-1"
-    before = leg_tree(b, third, root / "nw-before", "nw-before")
-    proc = handoff(b, "triad-1", a, "every leg reads")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert inventory(b, "triad-1") == {str(before): str(a)}
-
-    (spec / ".git").write_text("gitdir: /nonexistent/t018-spec\n")
-    after = leg_tree(b, third, root / "nw-after", "nw-after")
-    proc = handoff(b, "triad-1", a, "unreadable leg")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"the leg {spec} is unreadable: " in proc.stderr, proc.stderr
-    assert f"writers polled: 2 under {a}" in proc.stderr, proc.stderr
-    for tree in (before, after):
-        assert f"WRITER {tree} — branch {tree.name}" in proc.stdout, proc.stdout
-        assert f"the worktree inventory entry for {tree} was NOT written" not in proc.stderr, \
-            proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    writers = top_block(b, "triad-1").split("**WRITERS at ", 1)[1]
-    assert "(NOT recorded)" not in writers, writers
-    assert ("every tree this handoff polled could still be placed, so none is withheld "
-            "for it") in writers, writers
-    assert inventory(b, "triad-1") == {str(before): str(a), str(after): str(a)}
-
-    # A RECORD NAMING THE UNREADABLE LEG still withholds its tree, whatever
-    # repository the tree's own common directory says it is of.
-    named = leg_tree(b, third, root / "nw-named", "nw-named")
-    rec = b.tool("lanes-edit.sh", "set-lane-tree", "triad-1", named, "--checkout", spec)
-    assert rec.returncode == 0, rec.stderr
-    proc = handoff(b, "triad-1", a, "unreadable leg, and a record naming it")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert (f"the worktree inventory entry for {named} was NOT written: the assembly has 1 "
-            "unreadable leg(s)") in proc.stderr, proc.stderr
-    for tree in (before, after):
-        assert f"the worktree inventory entry for {tree} was NOT written" not in proc.stderr, \
-            proc.stderr
-    assert "lifecycle: SWAPPING" in proc.stdout, proc.stdout
-    writers = top_block(b, "triad-1").split("**WRITERS at ", 1)[1]
-    assert f"- `{named}` (NOT recorded) — branch `nw-named`" in writers, writers
-    for tree in (before, after):
-        assert f"- `{tree}` — branch `{tree.name}`" in writers, writers
-    assert ("the 1 tree(s) this handoff could not place are named above, each marked "
-            "(NOT recorded)") in writers, writers
-    assert inventory(b, "triad-1") == {str(before): str(a), str(after): str(a),
-                                       str(named): str(spec)}
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_tree_git_cannot_read_in_an_assembly_is_named_and_holds_the_lane_swapping(triad):
-    """S2 OF THE REVIEW OF bf2a220: the poll passed over IN SILENCE any tree
-    with a `.git` git cannot read. With the spec leg's module directory
-    deleted after `add --checkout spec`, every tree of that leg - the one
-    `add` made, and a paired spec tree the inventory names - vanished from
-    WRITERS and from its count, and the lane went SWAPPED. Now each is listed
-    and counted, `UNREADABLE` and `(NOT recorded)`, its record is kept, and
-    the lane stays SWAPPING. Scoped to assemblies: a single repository's tree
-    that git cannot read is passed over, as it always was."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "s1", "--checkout", spec)
-    assert made.returncode == 0, made.stderr
-    lane_spec = Path(made.stdout.strip())
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    paired_spec = leg_tree(b, spec, a / "worktrees" / "040-p" / "spec", "040-p")
-    b.commit(paired_spec, "the feature's spec", {"p.md": "p\n"}, lane="triad-1")
-    proc = handoff(b, "triad-1", a, "every leg reads")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    want = {str(lane_spec): str(spec), str(lane_root): str(a), str(paired_spec): str(spec)}
-    assert inventory(b, "triad-1") == want
-
-    shutil.rmtree(a / ".git" / "modules" / "spec")
-    proc = handoff(b, "triad-1", a, "the spec leg's module directory is gone")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"the leg {spec} is unreadable: " in proc.stderr, proc.stderr
-    assert f"writers polled: 3 under {a}" in proc.stderr, proc.stderr
-    assert f"WRITER {lane_root} — branch root" in proc.stdout, proc.stdout
-    block = top_block(b, "triad-1")
-    assert f"(3 found under `{a}`)" in block, block
-    writers = block.split("**WRITERS at ", 1)[1]
-    for tree in (lane_spec, paired_spec):
-        assert (f"WRITER {tree} — UNREADABLE: it has a .git of its own and git could not "
-                "read it: ") in proc.stdout, proc.stdout
-        assert (f"the worktree inventory entry for {tree} was NOT written: it has a .git of "
-                "its own and git could not read it") in proc.stderr, proc.stderr
-        assert (f"- `{tree}` (NOT recorded) — UNREADABLE: it has a .git of its own and git "
-                "could not read it (") in writers, writers
-        assert f"(`git -C {tree} status`)" in writers, writers
-    assert f"- `{lane_root}` — branch `root`" in writers, writers
-    assert ("the 2 tree(s) this handoff could not place are named above, each marked "
-            "(NOT recorded)") in writers, writers
-    assert "lifecycle: SWAPPING" in proc.stdout, proc.stdout
-    held = proc.stderr.split("the worktree inventory was not recorded for ", 1)[1].split("\n", 1)[0]
-    assert str(lane_spec) in held and str(paired_spec) in held and str(lane_root) not in held, held
-    assert inventory(b, "triad-1") == want
-
-    # A SINGLE REPOSITORY PASSES OVER SUCH A TREE, AS IT ALWAYS DID.
-    b.origin("plain")
-    s = b.projects / "plain"
-    b.git("clone", "-q", b.remotes / "plain.git", s)
-    b.commit(s, "seed", {"README.md": "plain\n"})
-    b.git("push", "-q", "origin", "main", cwd=s)
-    b.lanes("opensoft/plain", s, "plain-1")
-    made = b.tool("lane-worktrees", "add", "plain-1", "w")
-    assert made.returncode == 0, made.stderr
-    w = Path(made.stdout.strip())
-    admin = (w / ".git").read_text().split("gitdir:", 1)[1].strip()
-    shutil.rmtree(admin)
-    proc = handoff(b, "plain-1", s, "a tree git cannot read")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"writers polled: 0 under {s}" in proc.stderr, proc.stderr
-    assert "UNREADABLE" not in proc.stdout + proc.stderr
-    assert "NOT recorded" not in proc.stdout + proc.stderr + top_block(b, "plain-1")
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-
-
-@NEEDS_UPSTREAM
-def test_t018_a_leg_tree_add_made_is_withheld_where_the_legs_git_is_an_empty_directory(triad):
-    """N4 OF THE REVIEW OF bf2a220: the empty-`.git`-directory case was run
-    only with no tree of that leg, and its path differs from the gitfile
-    case's: git answers the ASSEMBLY in the leg, so the common directory of
-    the checkout the tree's record names is the assembly's own `.git`, not
-    nothing. A tree `add --checkout spec` made is still withheld - named,
-    marked `(NOT recorded)`, its record kept under the leg and never moved to
-    the assembly - and the lane stays SWAPPING; readable again, the tree is
-    recorded under its leg and the lane is SWAPPED."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "s1", "--checkout", spec)
-    assert made.returncode == 0, made.stderr
-    lane_spec = Path(made.stdout.strip())
-    want = {str(lane_spec): str(spec)}
-    assert inventory(b, "triad-1") == want
-    gitfile = (spec / ".git").read_text()
-    (spec / ".git").unlink()
-    (spec / ".git").mkdir()
-    # the path this case takes: in the leg, git answers the assembly
-    assert real(b.git("rev-parse", "--show-toplevel", cwd=spec)) == real(a)
-    assert real(spec / b.git("rev-parse", "--git-common-dir", cwd=spec)) == real(a / ".git")
-    proc = handoff(b, "triad-1", a, "the spec leg's .git is an empty directory")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"the leg {spec} is unreadable: " in proc.stderr, proc.stderr
-    assert f"git answers {real(a)} there" in proc.stderr, proc.stderr
-    assert f"WRITER {lane_spec} — branch s1" in proc.stdout, proc.stdout
-    assert (f"the worktree inventory entry for {lane_spec} was NOT written: the assembly has 1 "
-            "unreadable leg(s)") in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPING" in proc.stdout, proc.stdout
-    writers = top_block(b, "triad-1").split("**WRITERS at ", 1)[1]
-    assert f"- `{lane_spec}` (NOT recorded) — branch `s1`" in writers, writers
-    assert ("the 1 tree(s) this handoff could not place are named above, each marked "
-            "(NOT recorded)") in writers, writers
-    assert inventory(b, "triad-1") == want
-
-    shutil.rmtree(spec / ".git")
-    (spec / ".git").write_text(gitfile)
-    proc = handoff(b, "triad-1", a, "readable again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "UNREADABLE LEG" not in top_block(b, "triad-1")
-    assert "(NOT recorded)" not in top_block(b, "triad-1")
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == want
-
-
-# ====================================================================== #255
-
-@NEEDS_UPSTREAM
-def test_255_a_leg_directory_that_cannot_be_searched_is_unreadable_in_the_handoff_and_reconcile(triad):
-    """#255, OPENREPOSHAPE-2'S SHOULD ON #246: A LEG DIRECTORY THIS ACCOUNT
-    CANNOT SEARCH failed the handoff's and the reconciliation's `.git` test
-    as a leg that is not checked out does, so both passed over it IN SILENCE:
-    no UNREADABLE LEG line, no TREE row, and the tree `add --checkout spec`
-    made was re-recorded under the ASSEMBLY, over the leg `add` had recorded.
-    Now it takes the path of a leg git cannot read, in the sweep's words, with
-    no permission at all and with read but no search: named and counted, its
-    tree withheld `(NOT recorded)` and its record kept, the lane SWAPPING, and
-    one `unreadable` TREE row that requires recovery. Searchable again, it
-    names nothing and its tree is recorded under it."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root searches a directory whatever its mode")
-    a, spec = t["assembly"], t["spec"]
-    made = b.tool("lane-worktrees", "add", "triad-1", "s1", "--checkout", spec)
-    assert made.returncode == 0, made.stderr
-    lane_spec = Path(made.stdout.strip())
-    made = b.tool("lane-worktrees", "add", "triad-1", "root")
-    assert made.returncode == 0, made.stderr
-    lane_root = Path(made.stdout.strip())
-    want = {str(lane_spec): str(spec), str(lane_root): str(a)}
-    assert inventory(b, "triad-1") == want
-    words = (f"the spec leg of {a}/project.yaml (opensoft/triad-spec): git could not be read "
-             "through it (its directory cannot be searched, so whether it has a .git of its own "
-             "could not be tested, and git could not read it: ")
-    for mode in (0, 0o600):
-        os.chmod(spec, mode)
-        try:
-            proc = handoff(b, "triad-1", a, "a leg directory that cannot be searched")
-            rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-        finally:
-            os.chmod(spec, 0o755)
-        assert proc.returncode == 0, (oct(mode), proc.stdout + proc.stderr)
-        assert f"the leg {spec} is unreadable: {words}" in proc.stderr, (oct(mode), proc.stderr)
-        assert f"legs: 1 of the assembly's legs under {a} unreadable" in proc.stderr, proc.stderr
-        assert f"writers polled: 2 under {a}" in proc.stderr, proc.stderr
-        assert f"WRITER {lane_spec} — branch s1" in proc.stdout, proc.stdout
-        assert (f"the worktree inventory entry for {lane_spec} was NOT written: the assembly has "
-                "1 unreadable leg(s)") in proc.stderr, proc.stderr
-        assert f"the worktree inventory entry for {lane_root} was NOT written" not in proc.stderr
-        assert "lifecycle: SWAPPING" in proc.stdout, (oct(mode), proc.stdout)
-        writers = top_block(b, "triad-1").split("**WRITERS at ", 1)[1]
-        assert f"- UNREADABLE LEG: `{spec}` is unreadable, {words}" in writers, (oct(mode), writers)
-        assert writers.count("- UNREADABLE LEG: ") == 1, writers
-        assert f"- `{lane_spec}` (NOT recorded) — branch `s1`" in writers, writers
-        assert f"- `{lane_root}` — branch `root`" in writers, writers
-        assert inventory(b, "triad-1") == want
-        assert rec.returncode == 0, rec.stderr
-        rows = reconcile_rows(rec.stdout)
-        assert rows[real(spec)][0] == "unreadable", (oct(mode), rows)
-        assert rows[real(spec)][1].startswith(words), (oct(mode), rows[real(spec)])
-        assert field(rec.stdout, "TREES")[2] == "1 require recovery", (oct(mode), rec.stdout)
-        assert field(rec.stdout, "VERDICT")[0] != "indeterminate", rec.stdout
-
-    proc = handoff(b, "triad-1", a, "searchable again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"the leg {spec} is unreadable" not in proc.stderr, proc.stderr
-    assert "UNREADABLE LEG" not in top_block(b, "triad-1")
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == want
-    rec = b.tool("lanes-edit.sh", "lane-reconcile", "triad-1")
-    assert real(spec) not in reconcile_rows(rec.stdout), rec.stdout
-    assert field(rec.stdout, "TREES")[2] == "0 require recovery", rec.stdout
-
-
-def lone_sidecar(b: Bench, lane: str) -> Path:
-    """The lane's one inventory record, as `set-lane-tree` filed it."""
-    files = sorted((b.projects / ".lane-state" / lane / "trees").glob("*.yaml"))
-    assert len(files) == 1, files
-    return files[0]
-
-
-def trees_row(b: Bench, lane: str, path: Path, env: dict | None = None) -> list:
-    """The `lane-trees` row whose path is `path`, as the handoff's `LANES_EDIT` gives it."""
-    helper = (env or {}).get("LANES_EDIT", str(b.bin / "lanes-edit.sh"))
-    proc = b.run(helper, "lane-trees", lane, env=env)
-    assert proc.returncode == 0, proc.stderr
-    rows = [ln.split(US) for ln in proc.stdout.splitlines() if ln.split(US)[1:2] == [str(path)]]
-    assert len(rows) == 1, proc.stdout
-    return rows[0]
-
-
-def a_paired_tree_a_broken_record_names(b: Bench, t: dict) -> tuple:
-    """A paired spec tree with a writer's first edit and nothing committed - so
-    no trailer finds it - recorded in triad-1's inventory with its leg as its
-    checkout: (the tree, its record, the record's bytes)."""
-    a, spec = t["assembly"], t["spec"]
-    fresh = leg_tree(b, spec, a / "worktrees" / "050-r" / "spec", "050-r")
-    (fresh / "draft.md").write_text("a writer's first edit\n")
-    rec = b.tool("lanes-edit.sh", "set-lane-tree", "triad-1", fresh, "--checkout", spec)
-    assert rec.returncode == 0, rec.stderr
-    sidecar = lone_sidecar(b, "triad-1")
-    text = sidecar.read_text()
-    assert text.startswith("schema: 1\n") and f"\npath: {fresh}\n" in text, text
-    return fresh, sidecar, text
-
-
-def assert_the_record_is_named_and_not_polled(b: Bench, t: dict, proc, fresh: Path,
-                                              sidecar: Path, before: bytes, schema: str,
-                                              path: str | None = None) -> None:
-    """THE HANDOFF NAMES A RECORD IT COULD NOT READ (#255): its id, schema and
-    path in the NOT POLLED note, on stderr and in the top block; the tree that
-    record names is not taken as this lane's writer; nothing is filed over the
-    record; and the lane stays SWAPPING. `path` is the path the record keeps
-    (the tree, unless told otherwise); `""` is a record that keeps none, which
-    the note then names by its id and schema alone."""
-    a = t["assembly"]
-    kept = str(fresh) if path is None else path
-    note = (f"this lane's worktree inventory holds record(s) that could not be read "
-            f"({sidecar.stem} (schema {schema}{', path ' + kept if kept else ''})), so a paired "
-            "tree only they name could not be told from another lane's")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert note in proc.stderr, proc.stderr
-    assert f"- NOT POLLED: {note}" in top_block(b, "triad-1"), top_block(b, "triad-1")
-    assert "lifecycle: SWAPPING" in proc.stdout, proc.stdout
-    assert f"WRITER {fresh} —" not in proc.stdout, proc.stdout
-    assert f"PAIRED ROOT, not this lane's: {fresh} — branch 050-r" in proc.stdout, proc.stdout
-    assert f"writers polled: 0 under {a}" in proc.stderr, proc.stderr
-    assert sidecar.read_bytes() == before, sidecar.read_text()
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("schema", ["2", "10"])
-def test_255_an_unknown_schema_record_is_named_in_the_handoffs_not_polled_note(triad, schema):
-    """#255: THE INVENTORY'S UNREADABLE RECORDS WERE ONLY THE ONES WITH NO
-    PATH. A record of another schema keeps its path and nothing else
-    (`lane-trees`' `${ltl_s:-<none>}` row), so the handoff read it as a record
-    with an empty checkout: its paired tree became this lane's writer, and the
-    poll's record for it was refused by `set-lane-tree`, which writes over no
-    record of another schema - reported as a refused write, with nothing said
-    of the record. Now a row whose schema - the thirteenth field - is not `1`
-    is named in the NOT POLLED note and never read as a record, as the sweep
-    reads it (`_discover`). Whole again, the record makes the tree this
-    lane's writer, and the lane is SWAPPED. THE SCHEMA IS MATCHED WHOLE: `10`
-    begins with a `1` but is not schema 1, so a rule that matched the schema by
-    its first character would read this record as a whole schema-1 one."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    fresh, sidecar, text = a_paired_tree_a_broken_record_names(b, t)
-    sidecar.write_text(f"schema: {schema}\n" + text[len("schema: 1\n"):])
-    before = sidecar.read_bytes()
-    row = trees_row(b, "triad-1", fresh)
-    assert row[0] == sidecar.stem and row[12] == schema and row[9] == "", row
-    proc = handoff(b, "triad-1", a, "a record of another schema")
-    assert_the_record_is_named_and_not_polled(b, t, proc, fresh, sidecar, before, schema)
-
-    sidecar.write_text(text)
-    proc = handoff(b, "triad-1", a, "a whole record again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"WRITER {fresh} — branch 050-r" in proc.stdout, proc.stdout
-    assert "NOT POLLED" not in proc.stdout + proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == {str(fresh): str(spec)}
-
-
-@NEEDS_UPSTREAM
-def test_255_a_malformed_record_is_named_in_the_handoffs_not_polled_note(triad):
-    """#255, AND #252'S `<malformed>` ROW: a schema-1 record that is not a
-    whole one keeps its id, its path and the schema `<malformed>`
-    (`lanes-edit.sh` at 36520b9, `lane_trees_list`). Here the record is cut to
-    its first four lines, and `LANES_EDIT` is a `lanes-edit.sh` that passes
-    every call through but answers `lane-trees` with #252's row for it, so
-    this holds before #252 lands and after. The handoff names it in the NOT
-    POLLED note, takes its tree for no writer of this lane's, files nothing
-    over it, and leaves the lane SWAPPING."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    fresh, sidecar, text = a_paired_tree_a_broken_record_names(b, t)
-    sidecar.write_text("".join(text.splitlines(keepends=True)[:4]))
-    before = sidecar.read_bytes()
-    fake = b.root / "fake-lanes-edit.sh"
-    fake.write_text(
-        "#!/bin/sh\n"
-        f"real={shlex.quote(str(b.bin / 'lanes-edit.sh'))}\n"
-        "if [ \"${1-}\" = lane-trees ]; then\n"
-        "  out=\"$(\"$real\" \"$@\")\"; rc=$?\n"
-        "  [ \"$rc\" = 0 ] || { [ -z \"$out\" ] || printf '%s\\n' \"$out\"; exit \"$rc\"; }\n"
-        f"  printf '%s\\n' \"$out\" | P={shlex.quote(str(fresh))} awk -F'\\037' '$2 != ENVIRON[\"P\"]'\n"
-        f"  printf '%s\\037%s\\037\\037\\037\\037\\037\\037\\037\\037\\037\\037\\037<malformed>\\n' "
-        f"{shlex.quote(sidecar.stem)} {shlex.quote(str(fresh))}\n"
-        "  exit 0\n"
-        "fi\n"
-        "exec \"$real\" \"$@\"\n")
-    fake.chmod(0o755)
-    env = {"LANES_EDIT": str(fake)}
-    row = trees_row(b, "triad-1", fresh, env)
-    assert row[0] == sidecar.stem and len(row) == 13 and row[12] == "<malformed>", row
-    assert not any(row[2:12]), row
-    proc = b.tool("lane-handoff", "--lane", "triad-1", "--transcript", "none", "--agent", "claude",
-                  "a malformed record", cwd=a, env=env)
-    assert_the_record_is_named_and_not_polled(b, t, proc, fresh, sidecar, before, "<malformed>")
-
-    sidecar.write_text(text)
-    proc = handoff(b, "triad-1", a, "a whole record again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"WRITER {fresh} — branch 050-r" in proc.stdout, proc.stdout
-    assert "NOT POLLED" not in proc.stdout + proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == {str(fresh): str(spec)}
-
-
-@NEEDS_UPSTREAM
-def test_255_a_record_with_a_tree_id_and_no_path_is_named_in_the_handoffs_not_polled_note(triad):
-    """#255, `pi_bad`'S EMPTY-PATH ARM: a record that files a tree id and no
-    path - #219's path-less tree - is a row with an empty path. A row with no
-    path names no tree, so it is no record of whose a tree is, whatever its
-    schema: before #252 the real `lanes-edit.sh` prints it as a WHOLE schema-1
-    row (every field but the path), which only the empty-path rule names; with
-    #252 it is `<malformed>`, which the schema rule names as well. Either way
-    the handoff names it by its id and its schema - there is no path to name -
-    takes the tree beside it for no writer of this lane's, files nothing over
-    the record, and leaves the lane SWAPPING. Whole again, the record makes the
-    tree this lane's writer."""
-    b, t = triad
-    a, spec = t["assembly"], t["spec"]
-    fresh, sidecar, text = a_paired_tree_a_broken_record_names(b, t)
-    no_path = "".join(ln for ln in text.splitlines(keepends=True) if not ln.startswith("path: "))
-    assert no_path != text and "\npath:" not in no_path, no_path
-    sidecar.write_text(no_path)
-    before = sidecar.read_bytes()
-    lt = b.tool("lanes-edit.sh", "lane-trees", "triad-1")
-    assert lt.returncode == 0, lt.stderr
-    rows = [ln.split(US) for ln in lt.stdout.splitlines() if ln.split(US)[0] == sidecar.stem]
-    assert len(rows) == 1, lt.stdout
-    row = rows[0]
-    assert row[1] == "" and row[12] in ("1", "<malformed>"), row
-    proc = handoff(b, "triad-1", a, "a record with no path")
-    assert_the_record_is_named_and_not_polled(b, t, proc, fresh, sidecar, before, row[12], path="")
-
-    sidecar.write_text(text)
-    proc = handoff(b, "triad-1", a, "a whole record again")
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert f"WRITER {fresh} — branch 050-r" in proc.stdout, proc.stdout
-    assert "NOT POLLED" not in proc.stdout + proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert inventory(b, "triad-1") == {str(fresh): str(spec)}
-
-
-@NEEDS_UPSTREAM
-def test_255_an_unreadable_record_is_named_in_the_handoffs_not_polled_note(triad):
-    """#255: a record file this account cannot read is a row of its own, named
-    by its file (`lane-trees`' `<unreadable>`, and no path). The handoff names
-    it in the NOT POLLED note - by its id and its schema, there being no path -
-    takes the tree beside it for no writer of this lane's, files nothing over
-    it and leaves the lane SWAPPING."""
-    b, t = triad
-    if os.geteuid() == 0:
-        pytest.skip("root reads a mode-000 file")
-    a = t["assembly"]
-    fresh, sidecar, text = a_paired_tree_a_broken_record_names(b, t)
-    before = sidecar.read_bytes()
-    sidecar.chmod(0)
-    try:
-        lt = b.tool("lanes-edit.sh", "lane-trees", "triad-1")
-        proc = handoff(b, "triad-1", a, "an unreadable record")
-    finally:
-        sidecar.chmod(0o644)
-    assert lt.returncode == 0, lt.stderr
-    rows = [ln.split(US) for ln in lt.stdout.splitlines() if ln.split(US)[0] == sidecar.stem]
-    assert len(rows) == 1 and rows[0][1] == "" and rows[0][12] == "<unreadable>", lt.stdout
-    assert_the_record_is_named_and_not_polled(b, t, proc, fresh, sidecar, before, "<unreadable>",
-                                              path="")
-
-
-# ===================================================================== #280
-
-#: A `lanes-edit.sh` that is the bench's own for every verb but `lane-state`, and
-#: answers that one in PIECES - the `state` line, 1.5 MiB of padding, then the
-#: rest of the snapshot - so that its reader has gone before it has finished,
-#: WHATEVER THE TIMING AND WHATEVER THE AWK. A pipe holds 64 KiB, so a producer
-#: with 1.5 MiB to write is still writing when a reader that stops at the first
-#: line closes; its next write gets SIGPIPE and the wrapper dies of it, as the
-#: real one can when a reader is quick enough to leave between its writes (its
-#: builtin `printf` writes a multi-line snapshot a line at a time). A pause
-#: instead of the padding was a race of its own: an awk that stalled for longer
-#: than the pause read it all. mawk reads ahead until its buffer is full - the
-#: review of fc061fe measured the end of input at 255 KiB or less and an early
-#: stop at 320 KiB or more - so the padding stays far above that. Its key, `pad`,
-#: is no field `lane-state` prints, so nothing in `lane-handoff` takes it for
-#: one. `real` is the bench's copy, `calls` the file each `lane-state` call is
-#: logged to, `pad` one padding line (a real TAB) and `pad_lines` how many.
-SLOW_LANE_STATE = """#!/bin/sh
-real='{real}'
-if [ "$1" = lane-state ]; then
-    printf '%s\\n' "$*" >> '{calls}'
-    out="$("$real" "$@")"
-    rc=$?
-    if [ "$rc" != 0 ]; then
-        [ -z "$out" ] || printf '%s\\n' "$out"
-        exit "$rc"
-    fi
-    first="$(printf '%s\\n' "$out" | sed -n 1p)"
-    rest="$(printf '%s\\n' "$out" | sed 1d)"
-    printf '%s\\n' "$first"
-    yes '{pad}' | head -n {pad_lines}
-    printf '%s\\n' "$rest"
-    exit 0
-fi
-exec "$real" "$@"
-"""
-#: One line of padding, and how many: 32768 lines of 48 bytes are 1.5 MiB.
-PAD_LINE = "pad\tno lifecycle field is spelled like this one"
-PAD_LINES = 32768
-
-#: `lane-handoff`'s lifecycle read as it was written before #280: the producer
-#: piped into an `awk` that exits at its first match, under `pipefail`.
-OLD_LIFECYCLE_READ = r'''set -uo pipefail
-rc=0
-now="$(LANES_NO_FETCH=1 "$1" lane-state "$2" 2>/dev/null | awk -F"\t" '$1 == "state" { print $2; exit }')" || rc=$?
-printf '%s %s\n' "$now" "$rc"
-'''
-
-
-def slow_lane_state(b: Bench) -> tuple:
-    """THE PRODUCER THAT OUTLIVES ITS READER: the wrapper (a `$LANES_EDIT`), and
-    the file it logs each `lane-state` call to."""
-    wrapper = b.root / "slow-lane-state" / "lanes-edit.sh"
-    wrapper.parent.mkdir()
-    calls = wrapper.parent / "calls"
-    wrapper.write_text(SLOW_LANE_STATE.format(real=b.bin / "lanes-edit.sh", calls=calls,
-                                              pad=PAD_LINE, pad_lines=PAD_LINES))
-    wrapper.chmod(0o755)
-    return wrapper, calls
-
-
-def lane_state(b: Bench, lane: str) -> dict:
-    proc = b.tool("lanes-edit.sh", "lane-state", lane)
-    assert proc.returncode == 0, proc.stderr
-    return dict(ln.split("\t", 1) for ln in proc.stdout.splitlines() if "\t" in ln)
-
-
-@NEEDS_UPSTREAM
-def test_280_a_lifecycle_read_whose_producer_writes_after_the_filter_exits_is_still_a_read(triad):
-    """#280: `lane-handoff` read the lane's lifecycle as `lane-state | awk '$1 ==
-    "state" { print $2; exit }'` under `set -o pipefail`, and that `awk` exits at
-    the first line. A producer that writes once more after that dies of SIGPIPE -
-    the real one's builtin `printf` hands a multi-line snapshot to the pipe in
-    pieces, and a reader quick enough sees the first before the last is written -
-    so the substitution's status was 141, the handoff said "the lane lifecycle
-    could not be read" and recorded no RUNNING -> SWAPPING -> SWAPPED transition
-    (CI run 39322387035, which passed one prefix down and in every run before
-    it). The race is held here EVERY time, by a `lane-state` that prints its
-    `state` line, 1.5 MiB of padding and then the rest: a pipe holds 64 KiB, so
-    that producer is still writing when a reader that stops at the first line
-    has closed, whatever the timing and whatever the awk. THE PREMISE FIRST: the
-    old shape of the read, run on that producer, gives `RUNNING 141`. Then the
-    handoff reads the snapshot whole and takes the status from `lane-state`
-    alone, so it records the transition as it does when the producer is quick."""
-    b, t = triad
-    a = t["assembly"]
-    wrapper, calls = slow_lane_state(b)
-    old = b.run("bash", "-c", OLD_LIFECYCLE_READ, "_", wrapper, "triad-1")
-    assert (old.returncode, old.stdout) == (0, "RUNNING 141\n"), (old.stdout, old.stderr)
-    calls.write_text("")        # the premise logged a call of its own
-
-    proc = handoff(b, "triad-1", a, "t280 handoff", env={"LANES_EDIT": str(wrapper)})
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "lane-state triad-1" in calls.read_text().splitlines(), \
-        "the handoff never read the lifecycle through the wrapper"
-    assert "the lane lifecycle could not be read" not in proc.stderr, proc.stderr
-    assert "exited 141" not in proc.stderr, proc.stderr
-    assert "lifecycle: RUNNING -> SWAPPING (generation " in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPING -> SWAPPED (generation " in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPED" in proc.stdout, proc.stdout
-    assert lane_state(b, "triad-1")["state"] == "SWAPPED"
-
-
-@NEEDS_UPSTREAM
-def test_280_a_swapping_lane_read_the_same_way_still_names_the_operation_it_supersedes(triad):
-    """#280, a lane left SWAPPING: the FIRST read - the state - goes through the
-    same producer and must still see SWAPPING, so the handoff takes the lane
-    over, and its note names the operation that never finished. THAT IS WHAT
-    THIS PINS: the note's content, and the first read on a SWAPPING lane. It
-    cannot pin the SECOND read's own fix, the operation read once more for that
-    note: its status was never read, so reverting that site alone still passes."""
-    b, t = triad
-    a = t["assembly"]
-    wrapper, calls = slow_lane_state(b)
-    took = b.tool("lanes-edit.sh", "set-lane-state", "triad-1", "SWAPPING", "--expect", "RUNNING",
-                  "--operation", "op-stuck-280")
-    assert took.returncode == 0, took.stderr
-    assert lane_state(b, "triad-1")["operation"] == "op-stuck-280"
-
-    proc = handoff(b, "triad-1", a, "t280 handoff", env={"LANES_EDIT": str(wrapper)})
-    assert proc.returncode == 0, proc.stdout + proc.stderr
-    assert "lane-state triad-1" in calls.read_text().splitlines(), \
-        "the handoff never read the lifecycle through the wrapper"
-    assert "the lane lifecycle could not be read" not in proc.stderr, proc.stderr
-    assert ("lane triad-1 is still recorded SWAPPING from operation op-stuck-280, which never "
-            "finished") in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPING -> SWAPPING (generation " in proc.stderr, proc.stderr
-    assert "lifecycle: SWAPPING -> SWAPPED (generation " in proc.stderr, proc.stderr
-    after = lane_state(b, "triad-1")
-    assert after["state"] == "SWAPPED" and after["operation"] != "op-stuck-280", after
-
-
-# ===================================================== the single repository
-
-def single_repository_decoys(bench: Bench) -> list:
-    """THE SCENARIO WHOSE OUTPUTS MAY NOT MOVE, laid out to look like a triad:
-    a repository with a submodule that is NO leg, a worktree of that submodule
-    under `worktrees/<feature>/code` and one of the repository itself under
-    `worktrees/<feature>/spec`, and a tree under the lane's own root recorded
-    with the SUBMODULE as its checkout - first with no `project.yaml`, then with
-    one naming no leg but the checkout itself. The handoff's output, its top
-    block and inventory, and the reconciliation before and after it."""
-    b = bench
-    out = []
-    dep = b.seeded("dep", {"d.txt": "a dependency\n"})
-
-    def scenario(name: str, manifest: str | None) -> None:
-        lane = f"{name}-1"
-        b.origin(name)
-        s = b.projects / name
-        b.git("clone", "-q", b.remotes / f"{name}.git", s)
-        files = {"README.md": f"{name}\n", ".gitignore": "worktrees/\n"}
-        if manifest is not None:
-            files["project.yaml"] = manifest
-        b.commit(s, "seed", files)
-        b.git("submodule", "add", "-q", dep, "vendor/dep", cwd=s)
-        b.commit(s, "a submodule that is no leg")
-        b.git("push", "-q", "origin", "main", cwd=s)
-        b.lanes(f"opensoft/{name}", s, lane)
-        vendor = s / "vendor" / "dep"
-        decoy_code = leg_tree(b, vendor, s / "worktrees" / "001-d" / "code", "001-d")
-        b.commit(decoy_code, "decoy code", {"x.txt": "x\n"}, lane=lane)
-        decoy_spec = leg_tree(b, s, s / "worktrees" / "001-d" / "spec", "001-d")
-        (decoy_spec / "y.md").write_text("y\n")
-        mine = leg_tree(b, vendor, b.projects / ".lane-worktrees" / lane / "dep", "dep")
-        b.commit(mine, "lane work in the dependency", {"m.txt": "m\n"}, lane=lane)
-        rec = b.tool("lanes-edit.sh", "set-lane-tree", lane, mine, "--checkout", vendor)
-        assert rec.returncode == 0, rec.stderr
-        out.append((f"{name}: lane-reconcile before", reconciled(b, lane)))
-        out.append((f"{name}: lane-handoff", shown(handoff(b, lane, s), b)))
-        out.append((f"{name}: lane-handoff: top block", normalise(top_block(b, lane), b)))
-        trees = b.tool("lanes-edit.sh", "lane-trees", lane)
-        trees.stdout = "".join(sorted(trees.stdout.splitlines(keepends=True),
-                                      key=lambda line: normalise(line, b)))
-        out.append((f"{name}: lane-handoff: inventory", shown(trees, b)))
-        out.append((f"{name}: lane-reconcile after", reconciled(b, lane)))
-
-    scenario("repoD", None)
-    scenario("repoQ", ("schema_version: 1\nkind: project-manifest\nid: repoQ\nlegs:\n"
-                       "  - role: assembly\n    repository: opensoft/repoQ\n    path: \".\"\n"))
-    return out
-
-
-def reconciled(b: Bench, lane: str) -> str:
-    """`lane-reconcile`, its TREE rows in a stable order: the inventoried ones
-    come in the order of their sidecars' file names, a checksum of the bench's
-    own path, so every row is sorted by its normalised text, in place."""
-    proc = b.tool("lanes-edit.sh", "lane-reconcile", lane)
-    lines = proc.stdout.splitlines(keepends=True)
-    idx = [i for i, ln in enumerate(lines) if ln.startswith("TREE" + US)]
-    for i, ln in zip(idx, sorted((lines[i] for i in idx), key=lambda ln: normalise(ln, b))):
-        lines[i] = ln
-    proc.stdout = "".join(lines)
-    return shown(proc, b)
-
-
-@pytest.mark.skipif(not sys.platform.startswith("linux"),
-                    reason="the golden was captured on Linux, as tests/test_triad_lane_tooling.py's")
-def test_t018_single_repository_handoff_and_reconcile_are_c45a452s_byte_for_byte(tmp_path):
-    """THE INVARIANT, ON A REPOSITORY LAID OUT TO LOOK LIKE A TRIAD: with no
-    `project.yaml` naming a leg, a `worktrees/<feature>/code` holding a
-    submodule's worktree is not polled or reported as a paired tree, and a tree
-    of a submodule is recorded under the lane's checkout, exactly as
-    `c45a452`'s tools did - every byte of every output equal to the stored
-    golden this module's `--capture` wrote from them."""
-    assert GOLDEN.is_file(), f"{GOLDEN} is missing; it is generated from c45a452's tools"
-    want = parse_golden(GOLDEN.read_text(encoding="utf-8"))
-    got = single_repository_decoys(Bench(tmp_path / "bench", REPO))
-    assert [k for k, _ in got] == [k for k, _ in want]
-    for (key, have), (_k, gold) in zip(got, want):
-        if have != gold:
-            diff = "\n".join(difflib.unified_diff(gold.splitlines(), have.splitlines(),
-                                                  f"c45a452: {key}", f"now: {key}", lineterm=""))
-            raise AssertionError(f"the single-repository output of '{key}' moved:\n{diff}")
-
-
-# ===================================================================== capture
-
-def capture(tools: Path, golden: Path) -> None:
-    """Write the golden file from the tools in `tools` - run ONCE, against
-    `c45a452`'s (`git archive c45a452 | tar -x -C <dir>`), and committed."""
-    with tempfile.TemporaryDirectory(prefix="t018-handoff-capture.") as tmp:
-        text = render_golden(single_repository_decoys(Bench(Path(tmp) / "bench", tools)))
-    golden.parent.mkdir(parents=True, exist_ok=True)
-    golden.write_text(text, encoding="utf-8")
-
-
-if __name__ == "__main__":
-    if len(sys.argv) in (3, 4) and sys.argv[1] == "--capture":
-        capture(Path(sys.argv[2]).resolve(), Path(sys.argv[3]) if len(sys.argv) == 4 else GOLDEN)
-        sys.exit(0)
-    sys.stderr.write("usage: test_triad_lane_tooling_handoff.py --capture <tools dir> [<golden>]\n")
-    sys.exit(64)
diff --git a/tests/test_upstream_pin.py b/tests/test_upstream_pin.py
deleted file mode 100644
index 8a3c9b8c..00000000
--- a/tests/test_upstream_pin.py
+++ /dev/null
@@ -1,222 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`contracts/openreposhape-pin.yaml` and the gitlink beside it are ONE fact.
-
-A pin file and a submodule are two records of the same commit, written in two
-places, and nothing but a test keeps them from drifting: a `git submodule
-update --remote` moves the gitlink and no line of YAML, and a hand-edited
-`commit:` moves the YAML and no byte of the tree. Either way the next reader is
-told the tests were verified against a commit they were not.
-
-THE CHECKS OF THE PIN ITSELF NEED NO SUBMODULE, on purpose. The gitlink is read
-out of `git ls-tree HEAD` in three lines of subprocess and nothing in those
-checks imports anything from `upstream/openRepoShape` — so a clone made without
-`--recurse-submodules` still gets the lockstep check. Only the three that read
-the checkout's real bytes — the digest, its HEAD and the eight files — carry
-`NEEDS_UPSTREAM`.
-
-THE CODE ROOT'S GIT IDENTITY, AND THE DEPENDENCY NESTED IN IT
-(opensoft/openRepoTools#186, T009). In the triad the pin file, `.gitmodules`
-and the gitlink all move with the CODE leg, which is its own repository
-mounted under the assembly — so every read here is of `CODE_ROOT`, `git
-ls-tree HEAD` runs IN it (never in an assembly, whose HEAD records the code
-leg and not the standard), and `DEPENDENCY_ROOT` is the checkout nested
-there. On today's layout `CODE_ROOT` is this repository and nothing moved; a
-composed run that lacks the dependency fails rather than skips (conftest).
-"""
-
-from __future__ import annotations
-
-import re
-import subprocess
-import sys
-from pathlib import Path
-
-import pytest
-
-from conftest import CODE_ROOT, DEPENDENCY_ROOT, NEEDS_UPSTREAM
-
-PIN = CODE_ROOT / "contracts" / "openreposhape-pin.yaml"
-SUBMODULE_PATH = "upstream/openRepoShape"
-SOURCE_REPOSITORY = "opensoft/openRepoShape"
-SOURCE_URL = "https://github.com/opensoft/openRepoShape.git"
-
-#: 40 means 40, and lowercase means lowercase. An abbreviated oid, a branch
-#: name or a tag cannot pass — `openRepoShape`'s own `COMMIT_RE`, spelled here
-#: rather than imported, because a pin check that had to import the thing it is
-#: checking could not run in a clone that never materialized it.
-COMMIT_RE = re.compile(r"^[0-9a-f]{40}$")
-SHA256_RE = re.compile(r"^[0-9a-f]{64}$")
-
-
-def pin_scalars() -> dict:
-    """Every `key: value` in the pin file, at any indent, comments stripped.
-
-    A ~15-line reader rather than a YAML dependency: this repository ships
-    bash and standard-library `python3` commands and installs no package, and
-    the file it reads is a flat map with one nested key written by hand. The
-    nesting is flattened onto the leaf name (`tree_sha256`), which is
-    unambiguous here because no leaf name repeats — asserted below, so a
-    second `tree_sha256` under some other block would fail rather than shadow
-    this one.
-    """
-    values: dict = {}
-    for raw in PIN.read_text(encoding="utf-8").splitlines():
-        line = raw.split("#", 1)[0].rstrip()
-        if not line.strip() or ":" not in line:
-            continue
-        key, _, value = line.partition(":")
-        key = key.strip()
-        value = value.strip().strip('"').strip("'")
-        if not value:
-            continue
-        assert key not in values, f"{key} appears twice in {PIN.name}"
-        values[key] = value
-    return values
-
-
-def test_the_pin_records_a_full_lowercase_commit():
-    """A tag can be moved and a commit cannot, and a pin the next person
-    cannot fetch is a pin nobody can reproduce."""
-    commit = pin_scalars()["commit"]
-    assert COMMIT_RE.match(commit), (
-        f"commit: {commit!r} is not 40 lowercase hex")
-
-
-def test_the_code_root_is_a_repository_of_its_own():
-    """THE GITLINK IS READ FROM THE CODE REPOSITORY'S OWN HEAD, so the code
-    root must BE that repository's top level: a directory inside some other
-    checkout would answer `git ls-tree HEAD` with that checkout's tree. In the
-    triad the code leg is a submodule and its own top level; today it is this
-    repository's."""
-    proc = subprocess.run(["git", "rev-parse", "--show-toplevel"],
-                          cwd=str(CODE_ROOT), capture_output=True, text=True,
-                          check=False)
-    assert proc.returncode == 0, (
-        f"the code root {CODE_ROOT} is not inside a git repository, so it has "
-        f"no gitlink to agree with {PIN.name}:\n{proc.stderr}")
-    assert Path(proc.stdout.strip()).resolve() == CODE_ROOT.resolve(), (
-        f"the code root {CODE_ROOT} is not the top level of its repository "
-        f"({proc.stdout.strip()}); the gitlink read below would be that "
-        f"repository's, not the code leg's")
-
-
-def test_the_gitlink_and_the_pin_name_the_same_commit():
-    """THE LOCKSTEP CHECK, and the reason this file exists.
-
-    `git ls-tree HEAD -- upstream/openRepoShape` prints the commit git has
-    RECORDED for that path, which is what a `git clone --recurse-submodules`
-    will check out — not what happens to be checked out here right now. So this
-    bites on a moved gitlink whether or not the submodule is materialized, and
-    it bites on a hand-edited `commit:` the same way.
-    """
-    proc = subprocess.run(["git", "ls-tree", "HEAD", "--", SUBMODULE_PATH],
-                          cwd=str(CODE_ROOT), capture_output=True, text=True,
-                          check=True)
-    row = proc.stdout.strip()
-    assert row, (f"git records no gitlink at {SUBMODULE_PATH}; the pin file "
-                 f"and the submodule are one commit, and this is half of it")
-    mode, kind, rest = row.split(" ", 2)
-    recorded = rest.split("\t", 1)[0]
-    assert mode == "160000" and kind == "commit", (
-        f"{SUBMODULE_PATH} is recorded as `{mode} {kind}`, not as a gitlink")
-    assert recorded == pin_scalars()["commit"], (
-        f"the gitlink is {recorded} and {PIN.name} says "
-        f"{pin_scalars()['commit']}; they move in one commit")
-
-
-def test_gitmodules_names_the_same_path_and_repository():
-    """The third record of the same fact, and the one a `git submodule update`
-    reads. A pin whose `submodule_path:` named a path `.gitmodules` does not
-    would be a pin nothing materializes."""
-    text = (CODE_ROOT / ".gitmodules").read_text(encoding="utf-8")
-    assert f'[submodule "{SUBMODULE_PATH}"]' in text
-    assert f"path = {SUBMODULE_PATH}" in text
-    assert f"url = {SOURCE_URL}" in text
-    values = pin_scalars()
-    assert values["submodule_path"] == SUBMODULE_PATH
-    assert values["source_repository"] == SOURCE_REPOSITORY
-
-
-def test_the_pin_says_mounted_and_names_its_verifier():
-    """MOUNTED is a claim about this repository's whole arrangement: the tests
-    run on the standard's real bytes at a commit, not on copies here. A pin
-    that said `copied` would be describing a tree that does not exist."""
-    values = pin_scalars()
-    assert values["pin_role"] == "upstream-standard"
-    assert values["materialization"] == "mounted"
-    assert values["revision_kind"] == "commit"
-    assert values["digest_algorithm"] == "sha256"
-    assert values["verify_pin"] == "tests/test_upstream_pin.py"
-    assert SHA256_RE.match(values["tree_sha256"]), (
-        f"tree_sha256: {values['tree_sha256']!r} is not 64 lowercase hex")
-
-
-@NEEDS_UPSTREAM
-def test_the_tree_digest_is_the_pinned_commits_own_number():
-    """Recomputed with the PINNED CHECKOUT'S OWN `scripts/repo_shape.py`.
-
-    Two things fall out of importing the standard's code rather than copying
-    it. This repository carries no copy of `tree_digest` to fall behind the
-    definition it implements — the digest is checked against the pinned
-    commit's own idea of what `sorted-ls-tree-r-v1` means, which is the only
-    reading that can be right about a number that commit's tools produced. And
-    a bump of the pin that changed the definition would fail HERE, naming the
-    disagreement, instead of producing a number nothing could reproduce.
-    """
-    sys.path.insert(0, str(DEPENDENCY_ROOT / "scripts"))
-    try:
-        from repo_shape import TREE_DIGEST_DEFINITION, tree_digest
-    finally:
-        sys.path.pop(0)
-    values = pin_scalars()
-    assert values["digest_definition"] == TREE_DIGEST_DEFINITION, (
-        f"the pin says `digest_definition: {values['digest_definition']}` and "
-        f"the pinned openRepoShape's own repo_shape.py says "
-        f"{TREE_DIGEST_DEFINITION!r}")
-    computed = tree_digest(DEPENDENCY_ROOT, "HEAD")
-    assert computed == values["tree_sha256"], (
-        f"the pinned checkout's tree digests to {computed} and {PIN.name} "
-        f"records {values['tree_sha256']}. RECOMPUTE the row from the commit "
-        f"you meant to pin; never edit it to agree with this checkout")
-
-
-@NEEDS_UPSTREAM
-def test_the_checked_out_submodule_is_at_the_recorded_commit():
-    """The fourth record: what is on disk right now. `git ls-tree` above says
-    what a fresh clone gets; this says what THIS working tree has, which is
-    what the rest of the suite actually reads its template bytes out of."""
-    head = subprocess.run(["git", "rev-parse", "HEAD"], cwd=str(DEPENDENCY_ROOT),
-                          capture_output=True, text=True, check=True)
-    assert head.stdout.strip() == pin_scalars()["commit"], (
-        "the checked-out submodule is not at the pinned commit; "
-        "run `git submodule update --init upstream/openRepoShape`")
-
-
-@NEEDS_UPSTREAM
-@pytest.mark.parametrize("rel", [
-    "scripts/repo_shape.py",
-    "templates/assembly-root/Makefile",
-    "templates/assembly-root/.gitignore",
-    "templates/assembly-root/scripts/bootstrap.py",
-    "templates/family-root/Makefile",
-    "templates/family-root/.gitignore",
-    "templates/family-root/scripts/bootstrap.py",
-    "templates/family-root/scripts/siblings.py",
-])
-def test_the_pinned_commit_carries_what_this_suite_reads(rel):
-    """The eight files `test_park_resume_commands.py` copies.
-
-    EIGHT, not the seven openRepoShape #92 counted: the two root Makefiles, the
-    two `.gitignore`s, the two `bootstrap.py`s, `siblings.py` and
-    `scripts/repo_shape.py`. The issue's prose miscounted its own list; this
-    parametrization is the list, so it cannot.
-
-    They are what makes the submodule worth having, and a pin bumped past
-    a rename would otherwise fail deep inside a fixture with a `FileNotFound`
-    naming a path nobody was looking for.
-
-    `park`, the pre-carve witness, leaves this list in THIS commit: the one
-    that bumps the pin past openRepoShape#94, which deleted it from the tree.
-    """
-    assert (DEPENDENCY_ROOT / rel).is_file(), (
-        f"the pinned openRepoShape has no {rel}")
diff --git a/tests/test_wip_init_command.py b/tests/test_wip_init_command.py
deleted file mode 100644
index 933e4c40..00000000
--- a/tests/test_wip_init_command.py
+++ /dev/null
@@ -1,2132 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""`openRepoTools wip init` — the one act that creates the workspace.
-
-lane-collision-protocol Amendment 9(c), under Brett Heap's ruling 4. NO
-NETWORK AND NO GITHUB, exactly as the rest of this suite: every run here meets
-a fake `gh` first on `$PATH`, backed by BARE REPOSITORIES IN A TEMPORARY
-DIRECTORY, so `gh repo create`, `gh repo clone` and the seed's push are all
-real git against real refs and none of them is a stub. A test that needed a
-real `gh` would be the wrong test.
-
-WHAT EACH SCENARIO IS FOR, since a reader meeting eleven steps at once cannot
-tell which ones matter:
-
-* rights present — the whole path, end to end: derive, create, clone, seed,
-  substitute, push, write the pointer file, link. The push IS the ruleset
-  probe, so a test that stops before it has not tested the thing the amendment
-  added it for.
-* rights ABSENT — ruling 2. It prints the administrator's block with every
-  value already substituted and stops at exit 2, having created nothing. The
-  block is three acts, not two: Addendum 1(2) on brettheap/new-workstation#17.
-* a workstation that already has one — step 1's whole idempotence, which is a
-  file test and not a network call.
-* a pointer file naming a repository its path is NOT a checkout of — the
-  refusal Amendment 9(a) calls new behaviour in so many words: "nothing
-  validates it today ... so a `path:` pointing at some other repository is
-  currently accepted and after this is not."
-* teams 0, 1 and 2 — ratified decision 2, derive or omit, never a placeholder.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import subprocess
-import textwrap
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-COMMAND = REPO / "openRepoTools"
-TEMPLATE = REPO / "upstream" / "openRepoShape" / "templates" / "workspace-root"
-
-#: The nine template files, which are clause (d)'s list and `openRepoTools`'
-#: own `WIP_TEMPLATE_FILES`. Named here rather than globbed, for the reason the
-#: command names them rather than listing a directory at runtime: the set is a
-#: published contract, not whatever upstream happens to hold.
-TEMPLATE_FILES = ("README.md", "AGENTS.md", "CLAUDE.md", ".gitattributes",
-                  ".gitignore", "handoffs/README.md", "lanes/LANES.md",
-                  "lanes/log/README.md", "workspaces/.gitkeep")
-
-NEEDS_TEMPLATE = pytest.mark.skipif(
-    not (TEMPLATE / "README.md").is_file(),
-    reason="the pinned openRepoShape is not checked out; "
-           "run `git submodule update --init upstream/openRepoShape`")
-
-pytestmark = [WINDOWS_SKIP, NEEDS_TEMPLATE]
-
-
-def fake_gh(tmp_path: Path, *, login: str = "brettheap",
-            teams: tuple[str, ...] = ("platform",),
-            may_create: bool = True,
-            exists: bool = False,
-            refuse_clone: bool = False,
-            refuse_push: bool = False) -> dict:
-    """A `gh` that answers the five calls `wip init` makes, and refuses the rest.
-
-    `repo create` makes a BARE repository under `<tmp>/github/<org>/<name>.git`
-    and `repo clone` clones it, so the seed commit and its push are real git
-    against a real ref — which is the only way the ruleset-probe branch can be
-    exercised at all. `may_create=False` is the account without the right, and
-    `exists=True` is the administrator having already run the block.
-
-    `refuse_push=True` IS THE ORGANISATION'S PR-ONLY RULESET, and it is a real
-    `pre-receive` hook in the bare repository rather than a stubbed exit code:
-    clause (c) step 8 makes the seed's push the probe for that gate, so a test
-    that faked the rejection would be testing the fake. The hook refuses while
-    a marker file sits beside it; deleting that marker is the administrator
-    excluding the repository, and the re-run afterwards is the path step 8
-    promises has "only to push".
-    """
-    server = tmp_path / "github"
-    server.mkdir(parents=True, exist_ok=True)
-    teams_json = "\n".join(
-        '{"slug":"%s","organization":{"login":"opensoft"}}' % t for t in teams)
-    ruleset_call = 'install_ruleset "$(slug_path "$target")"' if refuse_push else ":"
-    # A `gh repo clone` that fails the way a fresh machine's does — no
-    # credential — and says so on STDERR, which is the whole of F9.
-    clone_refusal = (
-        '''printf '%s\\n' "fatal: could not read Username for 'https://github.com': terminal prompts disabled" >&2; exit 1;'''
-        if refuse_clone else ":")
-    fake = tmp_path / "fake-path"
-    fake.mkdir(exist_ok=True)
-    (fake / "gh").write_text(textwrap.dedent(f"""\
-        #!/usr/bin/env bash
-        set -u
-        server={server!s}
-        slug_path() {{ printf '%s\\n' "$server/$1.git"; }}
-        # THE ORGANISATION'S PR-ONLY RULESET, as a real pre-receive hook: it
-        # refuses every push while `ruleset-on` sits in the bare repository,
-        # which is the state a NEW repository is in until an administrator
-        # excludes it (clause (c) step 8, Addendum 1(2)).
-        install_ruleset() {{
-            d="$1"
-            : > "$d/ruleset-on"
-            {{
-                printf '%s\\n' '#!/bin/sh'
-                printf '%s\\n' '[ -e "$(dirname "$0")/../ruleset-on" ] || exit 0'
-                printf '%s\\n' 'echo "remote: refused by the PR-only ruleset" >&2'
-                printf '%s\\n' 'exit 1'
-            }} > "$d/hooks/pre-receive"
-            chmod 755 "$d/hooks/pre-receive"
-        }}
-        case "$1 ${{2-}}" in
-        "api user")
-            printf '%s\\n' "{login}"; exit 0 ;;
-        "api --paginate")
-            # /user/teams, read with -q; the fake answers the filter's input.
-            printf '%s\\n' {"'" + (teams_json or "") + "'"} \\
-                | sed -n 's/.*"slug":"\\([^"]*\\)".*/\\1/p'
-            exit 0 ;;
-        esac
-        case "$*" in
-        "repo view "*)
-            target="$3"
-            [ -d "$(slug_path "$target")" ] && exit 0
-            exit 1 ;;
-        "repo create "*)
-            {"" if may_create else "printf 'GraphQL: Resource not accessible by personal access token\\n' >&2; exit 1;"}
-            target="$3"
-            mkdir -p -- "$(dirname -- "$(slug_path "$target")")"
-            git init -q --bare -b main "$(slug_path "$target")"
-            {ruleset_call}
-            exit 0 ;;
-        "repo clone "*)
-            target="$3"; dest="$4"
-            {clone_refusal}
-            git clone -q "$(slug_path "$target")" "$dest" || exit 1
-            git -C "$dest" config user.email wip@example.invalid
-            git -C "$dest" config user.name "wip init tests"
-            exit 0 ;;
-        "api --method PUT"*) exit 0 ;;
-        *"/contents/"*)
-            path="${{*}}"
-            path="${{path##*/contents/}}"; path="${{path%%\\?*}}"
-            src="{REPO!s}/upstream/openRepoShape/$path"
-            [ -f "$src" ] && exec cat -- "$src"
-            src="{REPO!s}/$path"
-            [ -f "$src" ] && exec cat -- "$src"
-            exit 1 ;;
-        esac
-        printf 'fake gh: unexpected call: %s\\n' "$*" >&2
-        exit 1
-        """), encoding="utf-8")
-    (fake / "gh").chmod(0o755)
-    (fake / "curl").write_text(
-        "#!/bin/sh\nprintf 'no test here may reach the network\\n' >&2\nexit 1\n",
-        encoding="utf-8")
-    (fake / "curl").chmod(0o755)
-    if exists:
-        d = server / "opensoft" / f"{login}-wip.git"
-        d.parent.mkdir(parents=True, exist_ok=True)
-        subprocess.run(["git", "init", "-q", "--bare", "-b", "main", str(d)],
-                       check=True)
-    return {"PATH": f"{fake}{os.pathsep}{os.environ['PATH']}"}
-
-
-def wip_env(home: Path, extra: dict) -> dict:
-    environ = dict(os.environ)
-    for name in ("OPENREPOTOOLS_REF", "OPENREPOTOOLS_REPO",
-                 "OPENREPOTOOLS_BIN_DIR", "CLAUDE_PROFILES_HOME",
-                 "CLAUDE_USER_DIR", "AGENT_PROTOCOL_ROOT", "PROJECTS_DIR",
-                 "OPENREPOTOOLS_WIP_ORG"):
-        environ.pop(name, None)
-    environ["HOME"] = str(home)
-    environ["AGENT_PROTOCOL_ROOT"] = str(home / ".agents")
-    environ["PROJECTS_DIR"] = str(home / "projects")
-    environ["OPENREPOTOOLS_BIN_DIR"] = str(home / "bin")
-    environ["GIT_AUTHOR_NAME"] = environ["GIT_COMMITTER_NAME"] = "wip tests"
-    environ["GIT_AUTHOR_EMAIL"] = environ["GIT_COMMITTER_EMAIL"] = \
-        "wip@example.invalid"
-    environ.update(extra)
-    return environ
-
-
-def run_wip(home: Path, *args: str, extra: dict | None = None,
-            stdin: str = "") -> subprocess.CompletedProcess:
-    (home / "projects").mkdir(parents=True, exist_ok=True)
-    return subprocess.run(["bash", str(COMMAND), "wip", "init", *args],
-                          capture_output=True, text=True, check=False,
-                          input=stdin, cwd=str(REPO),
-                          env=wip_env(home, extra or {}))
-
-
-# --- the whole path, where the person may create the repository -------------
-
-@pytest.mark.parametrize("has_lclaude", [False, True])
-def test_wip_init_creates_clones_seeds_pushes_and_points_at_it(tmp_path, has_lclaude):
-    """Steps 2 to 10 in one run, and every one of them checked.
-
-    The seed is checked for its SUBSTITUTED bytes rather than its presence: a
-    template written with `{{LOGIN}}` still in it is the failure clause (c)
-    step 7 refuses by name, and a file that is merely there proves nothing
-    about that.
-    """
-    home = tmp_path / "home"
-    environment = fake_gh(tmp_path)
-    environment["PATH"] = f"{tmp_path / 'fake-path'}{os.pathsep}/usr/bin{os.pathsep}/bin"
-    if has_lclaude:
-        launcher = tmp_path / "fake-path" / "lclaude"
-        launcher.write_text("#!/bin/sh\nexit 0\n", encoding="utf-8")
-        launcher.chmod(0o755)
-    result = run_wip(home, extra=environment)
-    assert result.returncode == 0, result.stdout + result.stderr
-
-    checkout = home / "projects" / "brettheap-wip"
-    for rel in TEMPLATE_FILES:
-        assert (checkout / rel).is_file(), f"{rel}\n{result.stdout}"
-    readme = (checkout / "README.md").read_text(encoding="utf-8")
-    assert "{{" not in readme, "a placeholder was written into the repository"
-    assert "brettheap" in readme
-    assert "opensoft" in readme
-
-    # The pointer file, which is the whole of what a later run reads.
-    config = home / ".agents" / "workspace.yaml"
-    assert config.is_file(), result.stdout
-    text = config.read_text(encoding="utf-8")
-    assert "repository: opensoft/brettheap-wip" in text
-    assert "path: ~/projects/brettheap-wip" in text, (
-        "the path is written with a `~` where it is under $HOME, so the file "
-        "travels with the thing it points at")
-
-    # THE PUSH IS THE RULESET PROBE, so the seed has to be on the remote.
-    remote = subprocess.run(
-        ["git", "-C", str(checkout), "ls-remote", "origin", "main"],
-        capture_output=True, text=True, check=True)
-    assert remote.stdout.strip(), "the seed never landed on main"
-    assert "pushed the seed" in result.stdout
-
-    expected_command = ("lclaude --lane <repo>-<n> <profile>" if has_lclaude
-                        else "pclaude --lane <repo>-<n> <profile>")
-    assert expected_command in result.stdout
-
-
-def test_wip_init_is_idempotent_and_a_second_run_writes_nothing(tmp_path):
-    """Step 1: a file test, not a network call, and the whole of the
-    idempotence. `setup.sh` runs this on every host on every run, so a second
-    run that did anything at all would do it on every machine, every time."""
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    assert run_wip(home, extra=env).returncode == 0
-    config = home / ".agents" / "workspace.yaml"
-    before = config.read_bytes()
-    mtime = config.stat().st_mtime
-
-    second = run_wip(home, extra=env)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert "nothing to do" in second.stdout
-    assert config.read_bytes() == before
-    assert config.stat().st_mtime == mtime
-
-
-def test_dry_run_rehearses_and_writes_nothing(tmp_path):
-    home = tmp_path / "home"
-    result = run_wip(home, "--dry-run", extra=fake_gh(tmp_path))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "--dry-run, so nothing below was done" in result.stdout
-    assert not (home / ".agents" / "workspace.yaml").exists()
-    assert not (home / "projects" / "brettheap-wip").exists()
-
-
-# --- ruling 2: where the person may NOT create it ---------------------------
-
-def test_without_the_right_it_prints_the_administrators_three_acts(tmp_path):
-    """RULING 2, verbatim "print the command" — and THREE acts, not two.
-
-    Every value is already substituted, so what is printed runs as it stands:
-    a block with a `<org>` left in it is a placeholder a person must fill,
-    which is a question wearing a different hat (R-A9-3).
-
-    Exit 2 and NOT 1: 1 in this toolset means "findings were printed".
-    """
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, may_create=False))
-    assert result.returncode == 2, result.stdout + result.stderr
-    out = result.stdout + result.stderr
-    assert "gh repo create opensoft/brettheap-wip --private --team platform" in out
-    assert "/orgs/opensoft/teams/platform/repos/opensoft/brettheap-wip" in out
-    assert "gh api /orgs/opensoft/rulesets" in out, (
-        "the third administrator act — without the ruleset exclusion, Rule 9's "
-        "one commit per write cannot land and the register is unwritable")
-    assert "{{" not in out and "<org>" not in out and "<login>" not in out
-    assert not (home / ".agents" / "workspace.yaml").exists()
-    assert not (home / "projects" / "brettheap-wip").exists()
-
-
-def test_with_no_terminal_it_does_not_wait_on_a_person(tmp_path):
-    """An unattended launch — `setup.sh` under CI, a container build — must not
-    block on a person. Where stdin is not a terminal it does not ask at all."""
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, may_create=False))
-    assert result.returncode == 2
-    assert "no terminal to wait on" in result.stderr
-
-
-def test_it_adopts_a_repository_an_administrator_already_created(tmp_path):
-    """The other half of ruling 2: once the repository exists, a re-run picks
-    up from there. That is what makes the printed block a step in a sequence
-    rather than a dead end."""
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, may_create=False, exists=True))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "already there; this run adopts it" in result.stdout
-    assert (home / ".agents" / "workspace.yaml").is_file()
-
-
-# --- ratified decision 2: derive the team, or drop it ----------------------
-
-def test_one_matching_team_is_used(tmp_path):
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, teams=("platform",)))
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "team                platform (the one team you are in there)" \
-        in result.stdout
-
-
-@pytest.mark.parametrize("teams,why", [
-    ((), "you are in no team"),
-    (("platform", "infra"), "you are in 2 teams"),
-])
-def test_no_single_team_drops_the_flag_entirely_and_says_why(tmp_path, teams, why):
-    """NOT a placeholder, and not a question: the flag is omitted from what is
-    run AND from what is printed, with one line saying why. (Ratified
-    decision 2.)"""
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, teams=teams, may_create=False))
-    out = result.stdout + result.stderr
-    assert why in out, out
-    assert "--team" not in out.split("openRepoTools wip init")[0] or \
-        "--team platform" not in out
-    assert "gh repo create opensoft/brettheap-wip --private \\" in out
-    assert "teams/" not in out, (
-        "a team grant for a team that was not derived is a command that fails")
-
-
-# --- the refusals -----------------------------------------------------------
-
-def test_a_login_that_cannot_form_a_compliant_name_is_refused(tmp_path):
-    """openRepoShape's naming contract, named with its source. A name repaired
-    by guesswork is a repository nobody can find again."""
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, login="bad_login"))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "cannot form a compliant" in result.stderr
-    assert "^[a-z0-9]+(-[a-z0-9]+)*-wip$" in result.stderr
-
-
-def test_a_pointer_file_whose_path_is_another_repository_is_refused(tmp_path):
-    """THE CHECKOUT TEST IS NEW BEHAVIOUR and Amendment 9(a) says so: nothing
-    validated it before, so a `path:` pointing at some other repository was
-    accepted and after this is not. It is a refusal rather than an overwrite,
-    because which private repository holds a person's unfinished work is
-    theirs to name."""
-    home = tmp_path / "home"
-    other = home / "projects" / "somebody-elses"
-    other.mkdir(parents=True)
-    subprocess.run(["git", "init", "-q", "-b", "main", str(other)], check=True)
-    subprocess.run(["git", "-C", str(other), "remote", "add", "origin",
-                    "https://github.com/opensoft/not-your-wip.git"], check=True)
-    (home / ".agents").mkdir(parents=True)
-    (home / ".agents" / "workspace.yaml").write_text(
-        f"repository: opensoft/brettheap-wip\npath: {other}\n", encoding="utf-8")
-
-    result = run_wip(home, extra=fake_gh(tmp_path))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "is not the root of a checkout of it" in result.stderr
-    assert "never overwrites that file" in result.stderr
-
-
-def test_an_existing_checkout_of_another_repository_is_refused(tmp_path):
-    """A clone already sitting where the workspace would go, of something
-    else. It is neither written into nor moved aside: moving somebody's
-    checkout is not an installer's to do."""
-    home = tmp_path / "home"
-    squatter = home / "projects" / "brettheap-wip"
-    squatter.mkdir(parents=True)
-    subprocess.run(["git", "init", "-q", "-b", "main", str(squatter)], check=True)
-    subprocess.run(["git", "-C", str(squatter), "remote", "add", "origin",
-                    "https://github.com/opensoft/something-else.git"], check=True)
-    marker = squatter / "KEEP.md"
-    marker.write_text("somebody's work\n", encoding="utf-8")
-
-    result = run_wip(home, extra=fake_gh(tmp_path, exists=True))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "already a checkout, and not of opensoft/brettheap-wip" in result.stderr
-    assert marker.read_text(encoding="utf-8") == "somebody's work\n"
-    assert not (home / ".agents" / "workspace.yaml").exists()
-
-
-# --- step 8: the push IS the ruleset probe, and the re-run has only to push --
-
-def remote_main(tmp_path: Path, slug: str = "opensoft/brettheap-wip") -> str:
-    """What `<slug>`'s bare `main` actually points at, or "" for no such ref.
-
-    Read from the BARE repository rather than from the clone, because the whole
-    question step 8 asks is whether anything landed on the REMOTE.
-    """
-    bare = tmp_path / "github" / f"{slug}.git"
-    done = subprocess.run(["git", "-C", str(bare), "rev-parse", "main"],
-                          capture_output=True, text=True, check=False)
-    return done.stdout.strip() if done.returncode == 0 else ""
-
-
-def test_a_push_the_ruleset_refuses_is_exit_2_and_leaves_the_seed_in_place(tmp_path):
-    """CLAUSE (c) STEP 8, and the reason the amendment added it.
-
-    A newly created repository is inside the organisation's PR-only ruleset
-    until an administrator excludes it, and until it is, Rule 9's one commit
-    per write cannot land — so the register would be unwritable. An earlier
-    draft of the clause said `wip init` "names that in its output and cannot do
-    it itself", and the amendment rejected that in so many words: it "let a
-    person finish successfully and meet the failure at their first register
-    write, which is the worst place there is to meet it."
-
-    So: exit 2, the refusal names the PR-only ruleset and step 5's third act,
-    and the clone and the seed commit are LEFT EXACTLY WHERE THEY ARE — which
-    is what the next test spends.
-
-    THE POINTER FILE IS NOT WRITTEN. It is step 9, after this, and writing it
-    here would make step 1's file test return on every later run, which is the
-    one state no re-run can dig out of.
-    """
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, refuse_push=True))
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "THAT IS THE RULESET" in result.stderr
-    assert "PR-only ruleset" in result.stderr
-    assert "gh api /orgs/opensoft/rulesets" in result.stderr
-    assert "openRepoTools wip init" in result.stderr
-
-    assert remote_main(tmp_path) == "", "the seed reached main through the gate"
-    checkout = home / "projects" / "brettheap-wip"
-    assert (checkout / "lanes" / "LANES.md").is_file(), (
-        "the clone and the seed were not left in place for the re-run")
-    head = subprocess.run(["git", "-C", str(checkout), "rev-parse", "HEAD"],
-                          capture_output=True, text=True, check=True)
-    assert head.stdout.strip(), "the seed was not committed"
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written over a push that never landed, so step "
-        "1 would return on every later run and no re-run could fix it")
-
-
-def test_the_rerun_after_the_administrator_acts_has_only_to_push(tmp_path):
-    """THE OTHER HALF OF STEP 8, and the half that is easy to lose.
-
-    The first run committed the seed and was refused by the gate, so the
-    worktree is CLEAN and the commit is unpushed. A push gated on
-    `git status --porcelain` — on the WORKTREE — therefore finds nothing to do,
-    prints "already carries the seed", writes the pointer file and exits 0 over
-    an empty `main`; and step 1's file test then returns on every later run, so
-    the command can never repair it. The gate is the REMOTE for that reason.
-
-    Deleting the marker is the administrator adding the repository to the
-    ruleset's exempt list. Nothing else changes, and the amendment's promise is
-    that the re-run "has only to push".
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path, refuse_push=True)
-    first = run_wip(home, extra=env)
-    assert first.returncode == 2, first.stdout + first.stderr
-    checkout = home / "projects" / "brettheap-wip"
-    seed = subprocess.run(["git", "-C", str(checkout), "rev-parse", "HEAD"],
-                          capture_output=True, text=True, check=True).stdout.strip()
-
-    # The administrator excludes it from the PR-only ruleset.
-    (tmp_path / "github" / "opensoft" / "brettheap-wip.git" / "ruleset-on").unlink()
-
-    second = run_wip(home, extra=env)
-    assert second.returncode == 0, second.stdout + second.stderr
-    # A ROOT commit, so step 6a's history gate (#64) has to know the seed by
-    # comparing it with the EMPTY tree — `diff-tree` names no path at all for a
-    # root commit unless it is asked to.
-    assert ("one seed an earlier run committed is not on "
-            "opensoft/brettheap-wip main yet") in second.stdout, second.stdout
-    assert "pushed the seed" in second.stdout
-    assert remote_main(tmp_path) == seed, (
-        "the re-run did not push the commit the first run left behind")
-    assert (home / ".agents" / "workspace.yaml").is_file(), (
-        "step 9 did not run after the push finally landed")
-
-    # AND IT IS STILL IDEMPOTENT: a third run is step 1's file test.
-    third = run_wip(home, extra=env)
-    assert third.returncode == 0, third.stdout + third.stderr
-    assert "nothing to do" in third.stdout
-
-
-def test_a_seed_already_on_main_is_not_pushed_again(tmp_path):
-    """The other side of the remote gate: where `origin/main` already points at
-    this commit there is nothing to push, and saying so is not the same as
-    saying there was nothing to commit. A command that pushed anyway would be
-    making a network call to learn what it had just read."""
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    first = run_wip(home, extra=env)
-    assert first.returncode == 0, first.stdout + first.stderr
-    seed = remote_main(tmp_path)
-    assert seed, "the first run did not push"
-
-    # A second workstation's view: the pointer file is gone, everything else is
-    # exactly as the first run left it.
-    (home / ".agents" / "workspace.yaml").unlink()
-    second = run_wip(home, extra=env)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert "already carries this commit" in second.stdout
-    assert remote_main(tmp_path) == seed
-
-
-# --- the seed is the template and nothing else (#40, finding 1) -------------
-
-def head_of(checkout: Path) -> str:
-    """What `HEAD` points at, or "" in a repository with no commit."""
-    done = subprocess.run(["git", "-C", str(checkout), "rev-parse", "HEAD"],
-                          capture_output=True, text=True, check=False)
-    return done.stdout.strip() if done.returncode == 0 else ""
-
-
-def staged_in(checkout: Path) -> str:
-    done = subprocess.run(
-        ["git", "-C", str(checkout), "diff", "--cached", "--name-only"],
-        capture_output=True, text=True, check=False)
-    return done.stdout
-
-
-def staged_mode_in(checkout: Path, rel: str) -> str:
-    """The MODE of `rel`'s stage-0 entry, or "" where the index has none.
-
-    `git ls-files -s` is where a staged mode is legible at all: `cat-file -p`
-    prints a blob's bytes and never its mode, which is the whole of #63.
-    """
-    done = subprocess.run(["git", "-C", str(checkout), "ls-files", "-s", "--", rel],
-                          capture_output=True, text=True, check=True)
-    return done.stdout.split()[0] if done.stdout.strip() else ""
-
-
-def adopted_checkout(tmp_path: Path, home: Path, env: dict) -> Path:
-    """A workspace repository this workstation ADOPTS: created, seeded and
-    pushed by an earlier run, carrying a file of the person's own on `main`,
-    and with the pointer file gone so step 1 does not simply return.
-
-    That is the state the finding is about — `wip init` is idempotent and
-    `setup.sh` runs it on every host on every run, so the run that meets a
-    checkout somebody has been working in is the normal one, not the exotic
-    one.
-    """
-    first = run_wip(home, extra=env)
-    assert first.returncode == 0, first.stdout + first.stderr
-    checkout = home / "projects" / "brettheap-wip"
-    log = checkout / "lanes" / "log" / "openRepoTools-3.md"
-    log.write_text("the lane log this workspace already carried\n",
-                   encoding="utf-8")
-    for args in (["add", "--", "lanes/log/openRepoTools-3.md"],
-                 ["commit", "-q", "-m", "a lane's object log"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    (home / ".agents" / "workspace.yaml").unlink()
-    return checkout
-
-
-def adopted_checkout_without(tmp_path: Path, home: Path, env: dict,
-                             rel: str = "handoffs/README.md"):
-    """An adopted checkout HEAD no longer carries `rel` in, and the template's
-    own bytes at that path — `(checkout, template_bytes, head)`.
-
-    EVERY TEST THAT REACHES STEP 7'S OWED-CANDIDATE BRANCH NEEDS THE SAME
-    THREE THINGS, and building them once per test is how two of them come to
-    differ in a way nobody meant. Step 7's outer test asks `HEAD:$rel` before
-    anything else, so a template path HEAD still carries never reaches that
-    branch at all: removing it from HEAD — committed and pushed, the way a
-    person's own `git rm` leaves a workspace — is the only way in. The bytes
-    are read BEFORE the removal because they are what this command's own seed
-    wrote there, which is exactly what "an earlier run's own leftover" looks
-    like, and `head` is what every refusal below is then checked against. The
-    step 6a test takes it too, for the one of the three it does need: a
-    template file that is genuinely missing, so "nothing was written" is a
-    question the checkout can answer.
-    """
-    checkout = adopted_checkout(tmp_path, home, env)
-    template_bytes = (checkout / rel).read_text(encoding="utf-8")
-    for args in (["rm", "-q", "--", rel],
-                 ["commit", "-q", "-m", f"somebody removed {rel}"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    return checkout, template_bytes, head_of(checkout)
-
-
-@pytest.mark.parametrize("state", ["untracked", "modified", "deleted"])
-def test_an_adopted_checkout_with_unrelated_changes_is_refused(tmp_path, state):
-    """`git add -A -- .` PUBLISHED WHATEVER THE WORKTREE HAPPENED TO CARRY
-    (#40, finding 1, P1).
-
-    Step 8 staged every modified, deleted and untracked file in an adopted
-    checkout and `push origin HEAD:main` put them on `main` as part of the
-    seed. The repository on the other end of that push is the one a person
-    keeps their UNFINISHED work in, which is the last place a file should
-    arrive by accident.
-
-    The question is asked BEFORE step 7 writes a byte into that checkout, for
-    the reason `plan_install_targets` is asked before the fetch: at this point
-    a refusal costs nothing at all, and the person's own files are still
-    exactly where they left them when they read it.
-
-    All three shapes `status --porcelain` reports, because `-A` swept up all
-    three.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    head = head_of(checkout)
-    log = checkout / "lanes" / "log" / "openRepoTools-3.md"
-    if state == "untracked":
-        (checkout / "notes.md").write_text("unfinished\n", encoding="utf-8")
-        named = "notes.md"
-    elif state == "modified":
-        log.write_text("edited, and not committed\n", encoding="utf-8")
-        named = "lanes/log/openRepoTools-3.md"
-    else:
-        log.unlink()
-        named = "lanes/log/openRepoTools-3.md"
-
-    result = run_wip(home, extra=env)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "carries changes this command did not write" in result.stderr
-    assert named in result.stderr, result.stderr
-    assert "NOTHING was written" in result.stderr and \
-        "nothing was staged" in result.stderr, result.stderr
-    assert staged_in(checkout) == "", (
-        f"the refusal staged {staged_in(checkout)!r}")
-    assert head_of(checkout) == head, "a commit was made over the refusal"
-    assert remote_main(tmp_path) == head, "something was pushed to main"
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-def test_the_seed_stages_the_paths_it_wrote_and_not_a_template_file_beside(
-        tmp_path):
-    """THE OTHER HALF OF THE SAME FINDING, and the half step 6a cannot reach.
-
-    A template file a person has EDITED is not `unrelated` — the template names
-    it, and a half-finished earlier run leaves exactly those paths behind, so
-    excluding them is what makes the re-run step 7 promises actually work. That
-    is precisely why step 8 stages the paths step 7 wrote BY NAME: the one path
-    the refusal is deliberately blind to is the one an `-A` would have carried
-    into the seed commit.
-
-    So: a checkout missing one template file and carrying an edit to another
-    finishes the run, commits the file it wrote, and leaves the edit in the
-    worktree, uncommitted and unpushed.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    # A template file the workspace no longer has — the state a re-seed fixes.
-    subprocess.run(["git", "-C", str(checkout), "rm", "-q", "--",
-                    "handoffs/README.md"], check=True)
-    subprocess.run(["git", "-C", str(checkout), "commit", "-q", "-m",
-                    "somebody removed the handoffs README"], check=True)
-    subprocess.run(["git", "-C", str(checkout), "push", "-q", "origin",
-                    "HEAD:main"], check=True)
-    # …and one the person is in the middle of editing.
-    lanes = checkout / "lanes" / "LANES.md"
-    edited = lanes.read_text(encoding="utf-8") + "\n| a row being written |\n"
-    lanes.write_text(edited, encoding="utf-8")
-
-    result = run_wip(home, extra=env)
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "seeded 1 of" in result.stdout, result.stdout
-
-    committed = subprocess.run(
-        ["git", "-C", str(checkout), "show", "--name-only", "--pretty=format:",
-         "HEAD"], capture_output=True, text=True, check=True)
-    assert committed.stdout.split() == ["handoffs/README.md"], (
-        f"the seed commit carried more than the template paths it wrote:\n"
-        f"{committed.stdout}")
-    assert lanes.read_text(encoding="utf-8") == edited, (
-        "the person's edit was overwritten")
-    dirty = subprocess.run(["git", "-C", str(checkout), "status", "--porcelain"],
-                           capture_output=True, text=True, check=True)
-    assert dirty.stdout.strip() == "M lanes/LANES.md", (
-        f"the edit was staged or committed:\n{dirty.stdout}")
-
-
-def test_a_staged_edit_to_a_template_file_stays_out_of_the_seed(tmp_path):
-    """AND THE HALF THAT WAS STILL OPEN: THE INDEX (#44 round 1,
-    `openRepoTools:1525`).
-
-    Step 8 staged the paths it wrote BY NAME and then committed with no
-    pathspec, and `git commit` with no pathspec commits THE INDEX. So the one
-    path step 6a is deliberately blind to — a template file the person had
-    edited — rode out to `main` anyway, as long as they had `git add`ed it and
-    the run had any seeding to do at all. The staging was by name and the
-    commit was not, which is the same publication one line further down.
-
-    The commit takes the same pathspec, so the person's staged edit is exactly
-    where they left it when the run finishes: staged, uncommitted, unpushed.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    # A template file the workspace no longer has, so the seed has work to do.
-    for args in (["rm", "-q", "--", "handoffs/README.md"],
-                 ["commit", "-q", "-m", "somebody removed the handoffs README"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    # …and one the person has edited AND STAGED.
-    lanes = checkout / "lanes" / "LANES.md"
-    edited = lanes.read_text(encoding="utf-8") + "\n| a row being written |\n"
-    lanes.write_text(edited, encoding="utf-8")
-    subprocess.run(["git", "-C", str(checkout), "add", "--", "lanes/LANES.md"],
-                   check=True)
-
-    result = run_wip(home, extra=env)
-    assert result.returncode == 0, result.stdout + result.stderr
-
-    committed = subprocess.run(
-        ["git", "-C", str(checkout), "show", "--name-only", "--pretty=format:",
-         "HEAD"], capture_output=True, text=True, check=True)
-    assert committed.stdout.split() == ["handoffs/README.md"], (
-        f"the seed commit published a path the person staged:\n"
-        f"{committed.stdout}")
-    assert staged_in(checkout).split() == ["lanes/LANES.md"], (
-        f"the seed commit consumed the person's index: {staged_in(checkout)!r}")
-    assert lanes.read_text(encoding="utf-8") == edited, (
-        "the person's edit was overwritten")
-
-
-def test_the_rerun_after_a_commit_that_failed_carries_the_seed_it_left_behind(
-        tmp_path):
-    """THE OTHER HALF OF THE SAME PATHSPEC, and the one it could have cost.
-
-    A first run that copied the nine template files and could not commit them
-    — no `user.email`, which is what the refusal above is written about —
-    leaves them in the worktree and in the index, and HEAD carrying none of
-    them. The re-run seeds NOTHING, because step 7 leaves a file that is
-    already there exactly as it is, so a commit restricted to the paths THIS
-    run wrote would commit nothing, push nothing, and go on to write the
-    pointer file over an empty `main`: the one state step 8's remote gate
-    exists to prevent, reached from the other side.
-
-    So the pathspec is the paths the seed OWES this checkout — what this run
-    wrote, and every template path the worktree carries and HEAD does not.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path, exists=True)
-    checkout = home / "projects" / "brettheap-wip"
-    checkout.parent.mkdir(parents=True)
-    bare = tmp_path / "github" / "opensoft" / "brettheap-wip.git"
-    subprocess.run(["git", "clone", "-q", str(bare), str(checkout)], check=True)
-    hook = checkout / ".git" / "hooks" / "pre-commit"
-    hook.write_text("#!/bin/sh\necho 'no user.email here' >&2\nexit 1\n",
-                    encoding="utf-8")
-    hook.chmod(0o755)
-
-    first = run_wip(home, extra=env)
-    assert first.returncode == 2, first.stdout + first.stderr
-    assert "could not commit the seed" in first.stderr
-    assert sorted(staged_in(checkout).split()) == sorted(TEMPLATE_FILES), (
-        f"the first run left something other than the seed staged: "
-        f"{staged_in(checkout)!r}")
-    assert head_of(checkout) == "", "the first run committed after all"
-
-    hook.unlink()
-    second = run_wip(home, extra=env)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert "committed the seed" in second.stdout, second.stdout
-
-    committed = subprocess.run(
-        ["git", "-C", str(checkout), "show", "--name-only", "--pretty=format:",
-         "HEAD"], capture_output=True, text=True, check=True)
-    assert sorted(committed.stdout.split()) == sorted(TEMPLATE_FILES), (
-        f"the re-run did not carry the seed the first run left staged:\n"
-        f"{committed.stdout}")
-    assert remote_main(tmp_path) == head_of(checkout), "the seed never landed"
-    assert (home / ".agents" / "workspace.yaml").is_file(), (
-        "step 9 did not run after the seed finally landed")
-
-
-def test_an_untracked_file_at_a_template_path_is_refused_not_absorbed(tmp_path):
-    """THE HALF THE `cat-file -e HEAD:` QUESTION COULD NOT TELL APART (#44
-    round 2, `openRepoTools:1621`).
-
-    An earlier run's own leftover and a person's own untracked file at a
-    template path are BOTH absent from HEAD — the one question step 7 asked
-    could not tell them apart, so a person's own `handoffs/README.md`, never
-    committed and never named to this command, answered it exactly as this
-    command's own half-finished leftover would have, and went into the seed.
-
-    The bytes tell them apart where the question alone could not: this
-    command's own leftover is what THIS RUN would itself write there, so the
-    fetched, substituted template is compared against what is on disk before
-    either is trusted as this command's own — and a mismatch is a refusal in
-    the same voice as step 6a's, not a silent seed of somebody else's file.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    for args in (["rm", "-q", "--", "handoffs/README.md"],
-                 ["commit", "-q", "-m", "somebody removed the handoffs README"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    before_head = head_of(checkout)
-    foreign = checkout / "handoffs" / "README.md"
-    foreign.parent.mkdir(parents=True, exist_ok=True)
-    foreign_text = "this is somebody's own file, not the template\n"
-    foreign.write_text(foreign_text, encoding="utf-8")
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "handoffs/README.md exists" in result.stderr, result.stderr
-    assert ("run's own template bytes was written into that checkout, "
-            "and nothing was staged.") in result.stderr
-    assert foreign.read_text(encoding="utf-8") == foreign_text, (
-        "the foreign file was overwritten")
-    assert staged_in(checkout) == "", "the foreign file was staged"
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-def test_a_staged_edit_at_a_missing_path_is_refused_even_when_the_worktree_reads_back_as_the_template(
-        tmp_path):
-    """THE HALF THE WORKTREE COMPARISON ALONE COULD NOT TELL APART (#44
-    round 3, `openRepoTools:1647`).
-
-    HEAD lacking a template path says nothing about the INDEX: a person can
-    `git add` their own edit at that path — before this command ever runs —
-    and step 8's `add` stages straight from the worktree, by name, so it would
-    stage over that edit the moment the WORKTREE's own bytes happen to read
-    back as the template, exactly as an earlier run's real leftover does. The
-    index is asked the same question the worktree already answers, so a
-    staged edit does not vanish just because the file on disk no longer shows
-    it.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, before_head = adopted_checkout_without(
-        tmp_path, home, env)
-
-    foreign = checkout / "handoffs" / "README.md"
-    foreign.parent.mkdir(parents=True, exist_ok=True)
-    foreign_text = "this is somebody's own staged edit, not the template\n"
-    foreign.write_text(foreign_text, encoding="utf-8")
-    subprocess.run(["git", "-C", str(checkout), "add", "--",
-                    "handoffs/README.md"], check=True)
-    # …and now the WORKTREE copy reads back as the template, even though what
-    # is STAGED at this path is still the person's own edit above.
-    foreign.write_text(template_bytes, encoding="utf-8")
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "handoffs/README.md exists" in result.stderr, result.stderr
-    assert ("run's own template bytes was written into that checkout, "
-            "and nothing was staged.") in result.stderr
-    assert foreign.read_text(encoding="utf-8") == template_bytes, (
-        "the worktree file was overwritten")
-    assert staged_in(checkout).split() == ["handoffs/README.md"], (
-        f"the staged edit was unstaged: {staged_in(checkout)!r}")
-    staged_blob = subprocess.run(
-        ["git", "-C", str(checkout), "show", ":handoffs/README.md"],
-        capture_output=True, text=True, check=True).stdout
-    assert staged_blob == foreign_text, (
-        "the seed overwrote the person's staged edit with the template")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-@pytest.mark.parametrize("dangling", [True, False],
-                         ids=["dangling", "live-matching-target"])
-def test_a_symlink_at_a_missing_template_path_is_refused_not_followed(
-        tmp_path, dangling):
-    """NEITHER `cmp` NOR `cp` MAY BE TRUSTED THROUGH ONE (#44 round 3,
-    `openRepoTools:1613` and `:1647`).
-
-    `[ -e ]` alone answers false for a DANGLING symlink exactly as it does for
-    nothing there at all, so without also asking `-L` this path would reach
-    the MISSING branch and meet `cp` at a link — writing this run's bytes
-    wherever the link points, inside the checkout or far outside it. And a
-    LIVE symlink whose target happens to hold the template's own bytes would
-    pass the worktree comparison the owed-candidate branch makes, and a
-    `git add` of it would stage the LINK ITSELF, never the bytes at its far
-    end. Both shapes are refused the same way, before either branch acts on
-    the link or on whatever it points at.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, before_head = adopted_checkout_without(
-        tmp_path, home, env)
-
-    link = checkout / "handoffs" / "README.md"
-    link.parent.mkdir(parents=True, exist_ok=True)
-    # OUTSIDE the checkout: a file inside it would itself be an untracked
-    # path step 6a's own refusal catches first, and that is a different
-    # test (`test_an_adopted_checkout_with_unrelated_changes_is_refused`).
-    if dangling:
-        target = tmp_path / "nowhere-at-all"
-    else:
-        target = tmp_path / "elsewhere-with-template-bytes.md"
-        target.write_text(template_bytes, encoding="utf-8")
-    link.symlink_to(target)
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{link} is a symlink" in result.stderr, result.stderr
-    assert ("template bytes was written into that checkout, "
-            "and nothing was staged.") in result.stderr, result.stderr
-    assert link.is_symlink(), "the symlink was replaced"
-    if not dangling:
-        assert target.read_text(encoding="utf-8") == template_bytes, (
-            "the symlink's target was modified")
-    assert staged_in(checkout) == "", "the symlink was staged"
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-def test_a_non_regular_file_at_a_missing_template_path_is_refused_not_opened(
-        tmp_path):
-    """`cmp` MAY BLOCK ON WHAT IT OPENS, NOT ONLY MISREAD IT (#44 round 3,
-    a second finding at `openRepoTools:1699`).
-
-    A FIFO at a template path HEAD does not carry answers `[ -e ]` true and
-    `[ -L ]` false exactly as a regular file would, so without asking what
-    KIND of node it is, `cmp` would open it directly to compare it against
-    the template — and `cmp` on a FIFO with no writer on the other end
-    blocks forever rather than refusing. `path_kind`, the same question
-    `--install`'s own planners already ask of a target, is asked here too,
-    before anything opens it. A bounded subprocess timeout stands in for
-    "forever": this test fails loudly rather than hanging the suite if the
-    refusal ever stops firing before the `cmp`.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    for args in (["rm", "-q", "--", "handoffs/README.md"],
-                 ["commit", "-q", "-m", "somebody removed the handoffs README"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    before_head = head_of(checkout)
-
-    fifo = checkout / "handoffs" / "README.md"
-    fifo.parent.mkdir(parents=True, exist_ok=True)
-    os.mkfifo(fifo)
-
-    (home / "projects").mkdir(parents=True, exist_ok=True)
-    result = subprocess.run(
-        ["bash", str(COMMAND), "wip", "init"],
-        capture_output=True, text=True, check=False,
-        cwd=str(REPO), env=wip_env(home, env), timeout=30)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{fifo} is not a regular file" in result.stderr, result.stderr
-    assert ("template bytes was written into that checkout, "
-            "and nothing was staged.") in result.stderr, result.stderr
-    assert not fifo.is_file(), "the FIFO was replaced with a regular file"
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-def test_a_staged_addition_with_no_worktree_file_is_refused_not_overwritten(
-        tmp_path):
-    """THE INDEX CAN OWE SOMETHING THE WORKTREE NO LONGER HAS AT ALL (#44
-    round 3, `openRepoTools:1613`).
-
-    A person's own `git add` of a template path, followed by removing the
-    worktree file, leaves the INDEX carrying something the worktree does not
-    — a shape `[ -e "$checkout/$rel" ]` alone reads as plain MISSING, which
-    would `cp` the template straight in and let step 8's own `add` stage over
-    whatever they had. This command has never staged a path and then removed
-    its own file out from under it, so an index entry with nothing on disk
-    behind it is never this command's own leftover, whatever it holds.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    for args in (["rm", "-q", "--", "handoffs/README.md"],
-                 ["commit", "-q", "-m", "somebody removed the handoffs README"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    before_head = head_of(checkout)
-
-    staged = checkout / "handoffs" / "README.md"
-    staged.parent.mkdir(parents=True, exist_ok=True)
-    staged_text = "somebody's own staged addition, then the file was removed\n"
-    staged.write_text(staged_text, encoding="utf-8")
-    subprocess.run(["git", "-C", str(checkout), "add", "--",
-                    "handoffs/README.md"], check=True)
-    staged.unlink()
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{staged} does not exist, HEAD does not carry" in result.stderr, (
-        result.stderr)
-    assert not staged.exists(), "a file was written where there was none"
-    staged_blob = subprocess.run(
-        ["git", "-C", str(checkout), "show", ":handoffs/README.md"],
-        capture_output=True, text=True, check=True).stdout
-    assert staged_blob == staged_text, (
-        "the seed overwrote the person's staged addition")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-def test_a_staged_deletion_of_a_head_tracked_path_is_left_alone(tmp_path):
-    """A TEMPLATE PATH HEAD ALREADY CARRIES IS THE PERSON'S EVEN MID-DELETE
-    (#44 round 3, `openRepoTools:1615`).
-
-    `git rm` of a path HEAD still carries leaves the worktree file gone and
-    the index entry gone too, so it answers `[ -e ]`, `[ -L ]` and the
-    stage-0 index question all false — exactly what a plain MISSING path
-    answers — unless `HEAD` itself is also asked. Without that, the MISSING
-    branch would fetch the template and `cp` it straight back, undoing a
-    deletion this command has never modified a committed file to make.
-    `HEAD:$rel` answers true here, so the path is left exactly where the
-    person put it: staged, and this run commits nothing over it.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    before_head = head_of(checkout)
-
-    lanes = checkout / "lanes" / "LANES.md"
-    subprocess.run(["git", "-C", str(checkout), "rm", "-q", "--",
-                    "lanes/LANES.md"], check=True)
-    assert not lanes.exists()
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert "the workspace already carries every template file" in result.stdout, (
-        result.stdout)
-    assert not lanes.exists(), "the deleted file was restored"
-    assert staged_in(checkout).split() == ["lanes/LANES.md"], (
-        f"the staged deletion was not exactly what remained staged: "
-        f"{staged_in(checkout)!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made over the person's own staged deletion")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed over the person's own staged deletion")
-
-
-def test_a_template_path_with_an_unresolved_merge_conflict_is_refused(tmp_path):
-    """FOUR TESTS, AND A CONFLICT ANSWERS ALL OF THEM FALSE (#44 round 3,
-    `openRepoTools:1699`).
-
-    A path at stages 1-3 with no stage 0 — an unresolved merge conflict,
-    added differently on two sides with no common ancestor version — can
-    have no worktree file of its own and no `HEAD` entry either, so
-    `[ -e ]`, `[ -L ]`, the stage-0 index question and `HEAD:$rel` are all
-    false: exactly what a plain MISSING path answers, and step 6a's own
-    exclusion of template paths means no earlier gate has seen it either.
-    `git ls-files -u` is asked directly instead, and a conflict there is
-    refused rather than settled by whichever branch the worktree's own
-    (absent) state happens to satisfy.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    for args in (["rm", "-q", "--", "handoffs/README.md"],
-                 ["commit", "-q", "-m", "somebody removed the handoffs README"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    before_head = head_of(checkout)
-
-    def hash_object(text: str) -> str:
-        return subprocess.run(
-            ["git", "-C", str(checkout), "hash-object", "-w", "--stdin"],
-            input=text, capture_output=True, text=True, check=True
-        ).stdout.strip()
-
-    # A stage-1-3 conflict built directly through plumbing: an add/add with
-    # no common ancestor has no stage 1 either, and no `git merge` is needed
-    # to reach exactly the index shape this finding is about.
-    ours = hash_object("ours: not the template\n")
-    theirs = hash_object("theirs: not the template either\n")
-    index_info = (f"100644 {ours} 2\thandoffs/README.md\n"
-                  f"100644 {theirs} 3\thandoffs/README.md\n")
-    subprocess.run(["git", "-C", str(checkout), "update-index", "--index-info"],
-                   input=index_info, text=True, check=True)
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert (f"{checkout} has an unresolved merge conflict at "
-            "handoffs/README.md") in result.stderr, result.stderr
-    assert not (checkout / "handoffs" / "README.md").exists(), (
-        "a file was written where the conflict left none")
-    unmerged = subprocess.run(
-        ["git", "-C", str(checkout), "ls-files", "-u", "--",
-         "handoffs/README.md"],
-        capture_output=True, text=True, check=True).stdout
-    assert unmerged.count("\n") == 2, (
-        f"the conflict's own stages were touched: {unmerged!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-
-
-# --- the four hardening gaps of #49, #62, #63 and #69 -----------------------
-
-def test_a_git_status_this_command_cannot_run_is_refused_not_read_as_clean(
-        tmp_path):
-    """AN EMPTY CHANGE LIST FROM A FAILED `git status` IS NOT "NOTHING
-    UNRELATED" (#49).
-
-    Step 6a asked the question as
-    `git … status … 2>/dev/null | sed … || :`. The redirect threw away git's
-    own diagnostic and the `|| :` turned any non-zero exit of the pipeline —
-    under this file's `set -o pipefail`, `git status`'s own — into a plain
-    empty string, which is exactly what a clean checkout produces. So a
-    checkout this command could not even PUT the question to passed the one
-    gate that exists to refuse before a byte is written, and step 7 wrote
-    template bytes into it.
-
-    A corrupt `.git/index` is the cheapest real shape of that: `rev-parse`
-    still answers, so step 6's own checks pass and the run reaches step 6a,
-    and `git status` exits 128 with `fatal: index file corrupt`. The refusal
-    carries git's own words under it, the way the clone and the commit
-    already do.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    # A template file the workspace no longer has, so this run HAS a byte to
-    # write the moment the gate lets it through — the thing the assertion
-    # below can then look for. (Its template bytes are not this test's
-    # question: what it asks is whether anything was written at all.)
-    checkout, _, before_head = adopted_checkout_without(tmp_path, home, env)
-    (checkout / ".git" / "index").write_bytes(b"not an index at all, garbage\n")
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "REFUSED:" in result.stderr, result.stderr
-    assert f"could not ask git what {checkout} carries" in result.stderr, (
-        result.stderr)
-    assert "What it said:" in result.stderr, result.stderr
-    assert "    | " in result.stderr, (
-        f"the refusal kept none of git's own stderr:\n{result.stderr}")
-    # GIT'S OWN SENTENCE, not one particular wording of it: which one a corrupt
-    # index draws (`bad signature`, `index file smaller than expected`, `index
-    # file corrupt`) depends on how it is corrupt and on the version. What the
-    # refusal owes a person is the `fatal:` line naming the index, and that is
-    # what is asserted.
-    assert "fatal:" in result.stderr, (
-        f"the refusal dropped the only sentence that says why:\n"
-        f"{result.stderr}")
-    assert "index" in result.stderr, (
-        f"git's sentence reached the person but says nothing about the index "
-        f"it could not read:\n{result.stderr}")
-    assert not (checkout / "handoffs" / "README.md").exists(), (
-        "a template byte was written past the gate that could not be asked")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-@pytest.mark.parametrize("ancestor", ["symlink", "regular-file"])
-def test_an_ancestor_of_a_template_path_that_is_not_a_directory_is_refused(
-        tmp_path, ancestor):
-    """THE LEAF WAS ASKED ABOUT AND ITS PARENTS WERE NOT (#62).
-
-    `path_kind` asks what is at `$rel` itself; nothing asked what is at
-    `handoffs`, and an adopted checkout can carry a TRACKED symlink there —
-    a person whose `handoffs` is a link into another tree of their own,
-    committed, which step 6a reads as a clean worktree because it IS what
-    HEAD says. Every test step 7 then makes answers as though nothing were at
-    `handoffs/README.md` at all: `[ -e ]` and `[ -L ]` are false where the
-    link's target holds no such file, and git has no notion of a path inside
-    a tracked symlink, so `:$rel`, `HEAD:$rel` and `ls-files -u` are false
-    too. The MISSING branch was reached, its `mkdir -p` created nothing
-    (the link resolves to a directory that is already there) and its `cp`
-    wrote this run's template bytes THROUGH the link, outside the checkout —
-    and only the `git add` two steps later noticed, with
-    `fatal: … is beyond a symbolic link`, after the bytes had landed.
-
-    A regular file committed at that same component is the same walk's other
-    answer: there the `mkdir -p` FAILS, and a failing `mkdir` under this
-    file's `set -e` exits 1 — the code this toolset spends on "findings were
-    printed" — from a run that meant to refuse with 2 and never said why.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    outside = tmp_path / "another-tree-of-their-own"
-    outside.mkdir()
-    # IN HEAD, which is what makes step 6a see a clean worktree and hand this
-    # to step 7 — the state the finding is about.
-    subprocess.run(["git", "-C", str(checkout), "rm", "-q", "-r", "--",
-                    "handoffs"], check=True)
-    if ancestor == "symlink":
-        (checkout / "handoffs").symlink_to(outside)
-    else:
-        (checkout / "handoffs").write_text(
-            "a file where the template wants a directory\n", encoding="utf-8")
-    for args in (["add", "--", "handoffs"],
-                 ["commit", "-q", "-m", "handoffs is not a directory here"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    before_head = head_of(checkout)
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    if ancestor == "symlink":
-        assert f"{checkout / 'handoffs'} is a symlink to {outside}" in \
-            result.stderr, result.stderr
-        assert list(outside.iterdir()) == [], (
-            f"the seed wrote through the link: {list(outside.iterdir())}")
-    else:
-        assert f"{checkout / 'handoffs'} is not a directory" in result.stderr, (
-            result.stderr)
-        assert (checkout / "handoffs").read_text(encoding="utf-8") == \
-            "a file where the template wants a directory\n", (
-            "the person's own file at that component was written over")
-    assert "handoffs/README.md sits under it" in result.stderr, result.stderr
-    assert staged_in(checkout) == "", (
-        f"the refusal staged {staged_in(checkout)!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-def test_a_staged_entry_whose_blob_is_gone_is_refused_not_read_as_no_entry(
-        tmp_path):
-    """`cat-file -e ":$rel"` ANSWERS FALSE IN TWO STATES (Copilot round 3 on
-    PR #101, against the staged-mode guard's own diff).
-
-    It resolves the name through the index and then looks the OBJECT up, so it
-    fails both where there is no stage-0 entry and where there is one whose
-    blob the object store has lost. Gating on it spent the second as though it
-    were the first: the mode guard was skipped, the index comparison took its
-    "no entry" arm, and a worktree that reads back as the template was
-    accepted — after which step 8's `git add` replaced what the person had
-    staged with this run's copy and said nothing. Measured before the fix: the
-    staged sha changes.
-
-    `ls-files -s` reads the index and never the object store, so presence is
-    its answer, and an entry whose blob cannot be read is refused on its own
-    terms.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, before_head = adopted_checkout_without(
-        tmp_path, home, env)
-
-    foreign = checkout / "handoffs" / "README.md"
-    foreign.parent.mkdir(parents=True, exist_ok=True)
-    foreign.write_text("this is somebody's own staged edit\n", encoding="utf-8")
-    subprocess.run(["git", "-C", str(checkout), "add", "--",
-                    "handoffs/README.md"], check=True)
-    staged_sha = subprocess.run(
-        ["git", "-C", str(checkout), "rev-parse", ":handoffs/README.md"],
-        capture_output=True, text=True, check=True).stdout.strip()
-    # …the worktree now reads back as the template, which is what made the old
-    # "no entry" arm accept it…
-    foreign.write_text(template_bytes, encoding="utf-8")
-    # …and the object behind the index entry is gone, which is what made the
-    # entry look absent.
-    (checkout / ".git" / "objects" / staged_sha[:2] / staged_sha[2:]).unlink()
-    gone = subprocess.run(
-        ["git", "-C", str(checkout), "cat-file", "-e", ":handoffs/README.md"],
-        capture_output=True, text=True, check=False)
-    assert gone.returncode != 0, "the blob was supposed to be unreadable now"
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "cannot read what is staged there" in result.stderr, result.stderr
-    still = subprocess.run(
-        ["git", "-C", str(checkout), "ls-files", "-s", "--",
-         "handoffs/README.md"], capture_output=True, text=True, check=True)
-    assert staged_sha in still.stdout, (
-        f"the person's staged entry was replaced: {still.stdout!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-@pytest.mark.parametrize("state", ["checked-out", "deinitialized"])
-def test_a_submodule_at_a_template_paths_ancestor_is_refused(tmp_path, state):
-    """A DIRECTORY THAT IS ANOTHER REPOSITORY'S IS NOT THIS ONE'S TO WRITE IN
-    (Copilot round 2 on PR #101, against the ancestor walk's own diff).
-
-    A tracked SUBMODULE at `handoffs` is a gitlink in this repository and a
-    whole repository on disk, so the walk's symlink and not-a-directory
-    questions both pass it: `-d` is true and `-L` is false. Step 6a sees a
-    clean worktree, because a clean submodule reports nothing, and every
-    presence test in step 7 answers false, because a gitlink carries no
-    `handoffs/README.md` for `:$rel` or `HEAD:$rel` to find. The MISSING
-    branch then wrote this run's template bytes INSIDE that nested repository
-    and the `git add` two steps later answered `fatal: Pathspec … is in
-    submodule …` — with the bytes already there.
-
-    Both shapes, because the index is what makes it a submodule and only one
-    of them is on disk: a checked-out submodule has its own `.git`, and a
-    `deinit`ed one is an empty directory with nothing in it at all — and
-    `git add` fails identically for both.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-
-    # A repository of somebody's own, mounted where the template wants a
-    # directory. `protocol.file.allow` because git refuses a local-path
-    # submodule without it since 2.38 (CVE-2022-39253).
-    nested = tmp_path / "a-nested-repository"
-    nested.mkdir()
-    for args in (["init", "-q", "-b", "main", str(nested)],
-                 ["-C", str(nested), "config", "user.email", "wip@example.invalid"],
-                 ["-C", str(nested), "config", "user.name", "wip init tests"]):
-        subprocess.run(["git", *args], check=True)
-    (nested / "file.txt").write_text("somebody's own nested work\n", encoding="utf-8")
-    for args in (["add", "-A"], ["commit", "-q", "-m", "a nested repository"]):
-        subprocess.run(["git", "-C", str(nested), *args], check=True)
-
-    subprocess.run(["git", "-C", str(checkout), "rm", "-q", "-r", "--",
-                    "handoffs"], check=True)
-    subprocess.run(["git", "-C", str(checkout), "-c",
-                    "protocol.file.allow=always", "submodule", "add", "-q",
-                    str(nested), "handoffs"], check=True)
-    for args in (["commit", "-q", "-m", "handoffs is a submodule here"],
-                 ["push", "-q", "origin", "HEAD:main"]):
-        subprocess.run(["git", "-C", str(checkout), *args], check=True)
-    if state == "deinitialized":
-        subprocess.run(["git", "-C", str(checkout), "-c",
-                        "protocol.file.allow=always", "submodule", "deinit",
-                        "-f", "--", "handoffs"], check=True)
-        assert not (checkout / "handoffs" / ".git").exists()
-    before_head = head_of(checkout)
-    clean = subprocess.run(["git", "-C", str(checkout), "status", "--porcelain"],
-                           capture_output=True, text=True, check=True)
-    assert clean.stdout == "", (
-        f"a clean submodule is supposed to be invisible to status: "
-        f"{clean.stdout!r}")
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{checkout / 'handoffs'} is another git repository" in \
-        result.stderr, result.stderr
-    assert "handoffs/README.md sits under it" in result.stderr, result.stderr
-    assert not (checkout / "handoffs" / "README.md").exists(), (
-        "the seed wrote into somebody else's repository")
-    assert staged_in(checkout) == "", (
-        f"the refusal staged {staged_in(checkout)!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-def test_a_template_path_staged_at_another_mode_is_refused_not_restaged(
-        tmp_path):
-    """`cat-file -p` PRINTS A BLOB'S BYTES AND NEVER ITS MODE (#63).
-
-    The owed-candidate branch trusted the index the moment its blob matched
-    the template — so a path a person had staged with `git add --chmod=+x`,
-    byte-identical to the template and executable, read as "the index carries
-    the template". Step 8's `git add` then restaged that path from the
-    WORKTREE, at the worktree's own mode, and committed it: their `100755`
-    replaced by `100644` without a word.
-
-    Every file in `templates/workspace-root/` is a plain `100644` and this
-    command has never chmod'ed anything it wrote, so a stage-0 entry at any
-    other mode is somebody's own — which in this branch is a refusal, the
-    same answer the bytes themselves already get, and not a thing to stage
-    over.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, before_head = adopted_checkout_without(
-        tmp_path, home, env)
-
-    owed = checkout / "handoffs" / "README.md"
-    owed.parent.mkdir(parents=True, exist_ok=True)
-    owed.write_text(template_bytes, encoding="utf-8")
-    subprocess.run(["git", "-C", str(checkout), "add", "--chmod=+x", "--",
-                    "handoffs/README.md"], check=True)
-    # `--chmod` moves the INDEX and leaves the worktree file alone, which is
-    # the whole shape: the bytes match on both sides and only the mode does
-    # not.
-    assert staged_mode_in(checkout, "handoffs/README.md") == "100755"
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert (f"{checkout} has handoffs/README.md staged with mode 100755"
-            in result.stderr), result.stderr
-    assert staged_mode_in(checkout, "handoffs/README.md") == "100755", (
-        "the person's staged mode was replaced by the worktree's")
-    assert owed.read_text(encoding="utf-8") == template_bytes, (
-        "the worktree file was written over")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-@pytest.mark.parametrize("how", ["untracked", "staged-then-chmod"])
-def test_an_executable_template_path_is_refused_not_seeded_at_100755(
-        tmp_path, how):
-    """THE INDEX IS ONLY HALF THE MODE (Copilot round 1 on PR #101, against
-    the #63 fix's own diff).
-
-    Step 8 stages from the WORKTREE, so an owed candidate whose file carries
-    the execute bit is recorded in the seed commit as `100755` and pushed —
-    and it reaches that point two ways the stage-0 mode question never sees:
-    an UNTRACKED template path whose bytes match the template and whose file
-    somebody chmod'ed, and a path staged `100644` whose worktree file got the
-    bit afterwards. This command copies the template's own bytes from a 0644
-    file and has never chmod'ed anything it wrote, so an executable file at a
-    template path is not its leftover whatever its bytes say.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, before_head = adopted_checkout_without(
-        tmp_path, home, env)
-
-    owed = checkout / "handoffs" / "README.md"
-    owed.parent.mkdir(parents=True, exist_ok=True)
-    owed.write_text(template_bytes, encoding="utf-8")
-    if how == "staged-then-chmod":
-        # Staged at the mode this command itself writes, so the stage-0 check
-        # is satisfied and only the worktree's own bit is left to catch it.
-        subprocess.run(["git", "-C", str(checkout), "add", "--",
-                        "handoffs/README.md"], check=True)
-        assert staged_mode_in(checkout, "handoffs/README.md") == "100644"
-    owed.chmod(0o755)
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert f"{owed} is executable" in result.stderr, result.stderr
-    assert oct(owed.stat().st_mode & 0o777) == "0o755", (
-        "the refusal changed the person's own mode")
-    assert owed.read_text(encoding="utf-8") == template_bytes, (
-        "the worktree file was written over")
-    if how == "staged-then-chmod":
-        assert staged_mode_in(checkout, "handoffs/README.md") == "100644", (
-            "what was staged was changed by a run that refused")
-    else:
-        assert staged_in(checkout) == "", (
-            f"the refusal staged {staged_in(checkout)!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made despite the refusal")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed despite the refusal")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-def test_a_skip_worktree_template_path_is_named_and_never_seeded(tmp_path):
-    """A PATH HEAD CARRIES AND THE DISK DOES NOT IS NOT THE SAME AS A PATH
-    THAT IS SIMPLY THERE (#69).
-
-    `skip-worktree` — which is also what `git sparse-checkout` sets — tells
-    git not to compare the worktree at that path at all: HEAD carries it, the
-    stage-0 entry carries it, `git status` is clean, and the file is
-    physically absent. That answered step 7's outer question exactly as a
-    person's own deliberate `git rm` does, so the run `continue`d past it,
-    counted it as neither seeded nor owed, printed "the workspace already
-    carries every template file" and wrote the pointer file — while a
-    template path this command seeds, and the lane tooling reads, was not on
-    disk at all.
-
-    The principle above still stands, so the answer is not to seed over it:
-    a template path HEAD already carries is the person's, and this command
-    has never modified a committed file. What it stops being is INVISIBLE.
-    It is named in the summary, in one line, and nothing is written, staged
-    or committed for it.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    before_head = head_of(checkout)
-
-    lanes = checkout / "lanes" / "LANES.md"
-    subprocess.run(["git", "-C", str(checkout), "update-index",
-                    "--skip-worktree", "--", "lanes/LANES.md"], check=True)
-    lanes.unlink()
-    clean = subprocess.run(["git", "-C", str(checkout), "status", "--porcelain"],
-                           capture_output=True, text=True, check=True)
-    assert clean.stdout == "", (
-        f"skip-worktree is supposed to make this invisible to status: "
-        f"{clean.stdout!r}")
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 0, result.stdout + result.stderr
-    assert ("lanes/LANES.md: HEAD carries it, the index marks it "
-            "skip-worktree, and it is not on disk") in result.stdout, (
-        result.stdout)
-    assert not lanes.exists(), (
-        "the seed wrote into a path the index keeps off the disk")
-    assert staged_in(checkout) == "", (
-        f"something was staged for it: {staged_in(checkout)!r}")
-    assert head_of(checkout) == before_head, (
-        "a commit was made for a path HEAD already carries")
-    assert remote_main(tmp_path) == before_head, (
-        "something was pushed for a path HEAD already carries")
-    # AND THE RUN STILL FINISHES: this is a line to read, not a refusal.
-    assert (home / ".agents" / "workspace.yaml").exists(), (
-        "the run stopped over a path it only had to name")
-
-
-# --- step 6a's history half: nothing but the seed goes out ahead of main (#64)
-
-def git_in(where: Path, *args: str, stdin: str | None = None) -> str:
-    """`git -C <where> …`, checked, its stdout stripped."""
-    return subprocess.run(["git", "-C", str(where), *args], input=stdin,
-                          capture_output=True, text=True,
-                          check=True).stdout.strip()
-
-
-def commit_of_their_own(checkout: Path, subject: str,
-                        rel: str = "lanes/log/openRepoTools-3.md") -> str:
-    """A commit a person made in the workspace checkout and never pushed —
-    the thing #64 is about — and its sha. It touches a path the template does
-    not name, so nothing about it could be read as the seed."""
-    path = checkout / rel
-    path.parent.mkdir(parents=True, exist_ok=True)
-    path.write_text(f"{subject}\n", encoding="utf-8")
-    git_in(checkout, "add", "--", rel)
-    git_in(checkout, "commit", "-q", "-m", subject)
-    return head_of(checkout)
-
-
-def ruleset_on(tmp_path: Path, slug: str = "opensoft/brettheap-wip") -> Path:
-    """The organisation's PR-only ruleset, switched on for a repository that
-    ALREADY EXISTS — `fake_gh`'s own `install_ruleset`, line for line, for the
-    repository `refuse_push=True` cannot reach because an earlier run created
-    it. Returns the marker: unlinking it is the administrator's exclusion."""
-    bare = tmp_path / "github" / f"{slug}.git"
-    hook = bare / "hooks" / "pre-receive"
-    hook.write_text("#!/bin/sh\n"
-                    '[ -e "$(dirname "$0")/../ruleset-on" ] || exit 0\n'
-                    'echo "remote: refused by the PR-only ruleset" >&2\n'
-                    "exit 1\n", encoding="utf-8")
-    hook.chmod(0o755)
-    marker = bare / "ruleset-on"
-    marker.touch()
-    return marker
-
-
-def assert_refused_before_a_byte(result, checkout: Path, home: Path,
-                                 tmp_path: Path, head: str, main: str) -> None:
-    """What every history refusal owes: exit 2, step 6a's "nothing written,
-    nothing staged" in its own words and TRUE — the template path the run was
-    about to seed still absent, the index empty, HEAD where the person left it
-    — nothing pushed, and no pointer file."""
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "NOTHING was written" in result.stderr and \
-        "nothing was staged" in result.stderr, result.stderr
-    assert not (checkout / "handoffs" / "README.md").exists(), (
-        "a template byte was written past the gate that refused")
-    assert staged_in(checkout) == "", (
-        f"the refusal staged {staged_in(checkout)!r}")
-    assert head_of(checkout) == head, "a commit was made over the refusal"
-    assert remote_main(tmp_path) == main, "something was pushed to main"
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that refused")
-
-
-def test_an_adopted_checkout_ahead_of_main_by_a_persons_commit_is_refused(
-        tmp_path):
-    """STEP 6a ASKED ABOUT THE WORKTREE AND THE INDEX, AND NEVER ABOUT
-    HISTORY (#64, Brett Heap's RULING of 2026-10-02, "go with option 1 on
-    #64").
-
-    Step 8 pushes `HEAD:main` wherever HEAD is not what origin's `main`
-    already carries, and HEAD carries every commit beneath it. So a CLEAN
-    adopted checkout holding a commit of the person's own that never left this
-    workstation passed step 6a, had the template seeded on top of it, and had
-    both pushed to the `main` of the repository that holds their unfinished
-    work — by a command that came to place a template. Measured before the
-    fix: exit 0, and the person's commit on the remote's `main`.
-
-    The refusal names the commit — sha and subject, the way `git log
-    --oneline` prints it — and it comes before step 7 writes a byte: the one
-    template file this checkout is missing is still missing afterwards.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, _, main = adopted_checkout_without(tmp_path, home, env)
-    ahead = commit_of_their_own(checkout, "Record a diary entry nobody pushed")
-    assert git_in(checkout, "status", "--porcelain") == "", (
-        "the checkout is supposed to be clean by the worktree-and-index gate")
-
-    result = run_wip(home, extra=env)
-
-    assert_refused_before_a_byte(result, checkout, home, tmp_path, ahead, main)
-    assert "not every one of them is this command's own seed" in result.stderr, (
-        result.stderr)
-    assert f"{ahead[:7]} Record a diary entry nobody pushed" in result.stderr, (
-        result.stderr)
-    assert f"opensoft/brettheap-wip's main ({main[:7]})" in result.stderr
-    assert "workspace repository unreviewed" in result.stderr
-    assert "Push those commits yourself, or discard them" in result.stderr
-
-
-def test_a_seed_a_refused_push_left_on_an_adopted_main_is_pushed_by_the_rerun(
-        tmp_path):
-    """THE EXEMPTION, AND THE PROMISE IT KEEPS: "a re-run after that has only
-    to push" (step 8's own refusal).
-
-    A run whose push the PR-only ruleset refused leaves a clean worktree and
-    exactly one commit ahead of `main`: its seed. That commit is recognised —
-    its subject, its `Written by` line, and a tree that differs from its
-    parent's at a template path and nowhere else — so step 6a lets it through
-    and the re-run, once an administrator has acted, pushes it. This is the
-    ADOPTED shape, whose seed has a parent; the root-commit seed of a fresh
-    repository is `test_the_rerun_after_the_administrator_acts_has_only_to_push`.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, _, main = adopted_checkout_without(tmp_path, home, env)
-    marker = ruleset_on(tmp_path)
-
-    first = run_wip(home, extra=env)
-    assert first.returncode == 2, first.stdout + first.stderr
-    assert "THAT IS THE RULESET" in first.stderr, first.stderr
-    seed = head_of(checkout)
-    assert seed != main and git_in(checkout, "rev-parse", f"{seed}^") == main, (
-        "the first run did not leave exactly one seed commit on top of main")
-    assert remote_main(tmp_path) == main
-
-    marker.unlink()
-    second = run_wip(home, extra=env)
-
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert ("one seed an earlier run committed is not on "
-            "opensoft/brettheap-wip main yet") in second.stdout, second.stdout
-    assert "pushed the seed" in second.stdout
-    assert remote_main(tmp_path) == seed, (
-        "the re-run did not push the seed the first run left behind")
-    assert (home / ".agents" / "workspace.yaml").is_file()
-
-
-def test_a_remote_that_cannot_be_asked_skips_the_history_check_for_the_probe(
-        tmp_path):
-    """STEP 8'S OWN "COULD NOT ASK" ARM, KEPT AT STEP 6a, as the ruling keeps
-    it.
-
-    A remote that does not answer `ls-remote` has no `main` to name commits
-    against, so the history check is SKIPPED — said in one line — and the
-    run goes on to the push, which is the probe: here it meets the same wall
-    and step 8 refuses, as it always did. It is not refused at step 6a, and it
-    is not read as an EMPTY `main` either, which would put every local commit
-    ahead and refuse a seed re-run. A person's own commit is ahead here so the
-    two readings come apart: the run reaching step 8's refusal, and not step
-    6a's, is the skip.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout = adopted_checkout(tmp_path, home, env)
-    main = head_of(checkout)
-    commit_of_their_own(checkout, "Record a diary entry nobody pushed")
-    # Still `…/opensoft/brettheap-wip`, so step 6 adopts it as before, and
-    # nothing at all at that path to answer.
-    nowhere = tmp_path / "unreachable" / "opensoft" / "brettheap-wip.git"
-    git_in(checkout, "remote", "set-url", "origin", str(nowhere))
-
-    result = run_wip(home, extra=env)
-
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert ("could not ask origin where opensoft/brettheap-wip's main is"
-            in result.stdout), result.stdout
-    assert "this command's own seed" not in result.stderr, (
-        f"an unanswered question was refused as history:\n{result.stderr}")
-    assert "THAT IS THE RULESET" in result.stderr, (
-        f"the run did not reach step 8's push:\n{result.stderr}")
-    assert remote_main(tmp_path) == main
-    assert not (home / ".agents" / "workspace.yaml").exists()
-
-
-@pytest.mark.parametrize("disguise", ["non-template-path", "no-trailer",
-                                      "merge", "empty"])
-def test_a_commit_wearing_the_seeds_message_is_not_taken_for_the_seed(
-        tmp_path, disguise):
-    """A MESSAGE IS SOMETHING ANYBODY CAN TYPE, so the seed is known by all of
-    what makes it step 8's own commit, and each of these lacks one part:
-
-    * `non-template-path` — the seed's own message, byte for byte, on a commit
-      that touches a path the template does not name. This is the one the
-      ruling names: the TREE test is what gives the exemption its teeth.
-    * `no-trailer` — the seed's subject and the template's own bytes at a
-      template path, without the `Written by` line.
-    * `merge` — the seed's message on a merge whose tree adds a path the
-      template does not name. `diff-tree` names NO path for a merge unless asked
-      for a combined diff, so without the parent count a merge would pass the
-      tree test by naming nothing.
-    * `empty` — the seed's message on a commit that changes nothing. Step 8
-      commits only where `diff --cached` has something, so it never makes one.
-
-    Every one of them would have been pushed to `main` before the fix.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, template_bytes, main = adopted_checkout_without(tmp_path, home, env)
-    # THE SEED'S OWN MESSAGE, read from the seed the first run made — the
-    # root commit — rather than retyped here, so it is step 8's to the byte.
-    root = git_in(checkout, "rev-list", "--max-parents=0", "HEAD")
-    seed_message = git_in(checkout, "log", "-1", "--format=%B", root) + "\n"
-    assert seed_message.startswith("Seed this workspace repository from ")
-    assert "Written by `openRepoTools wip init`" in seed_message
-
-    notes = checkout / "notes.md"
-    if disguise == "non-template-path":
-        notes.write_text("somebody's own notes\n", encoding="utf-8")
-        git_in(checkout, "add", "--", "notes.md")
-        git_in(checkout, "commit", "-q", "-F", "-", stdin=seed_message)
-    elif disguise == "no-trailer":
-        readme = checkout / "handoffs" / "README.md"
-        readme.parent.mkdir(parents=True, exist_ok=True)
-        readme.write_text(template_bytes, encoding="utf-8")
-        git_in(checkout, "add", "--", "handoffs/README.md")
-        git_in(checkout, "commit", "-q", "-m", seed_message.splitlines()[0])
-    elif disguise == "merge":
-        notes.write_text("somebody's own notes\n", encoding="utf-8")
-        git_in(checkout, "add", "--", "notes.md")
-        tree = git_in(checkout, "write-tree")
-        # Both parents are already on `main`, so the merge is the ONE commit
-        # ahead of it and nothing else in the range could be what refuses.
-        merge = git_in(checkout, "commit-tree", tree, "-p", "HEAD",
-                       "-p", "HEAD~1", "-F", "-", stdin=seed_message)
-        git_in(checkout, "update-ref", "HEAD", merge)
-        assert git_in(checkout, "diff-tree", "--no-commit-id", "--name-only",
-                      "-r", merge) == "", (
-            "diff-tree was supposed to name no path for a merge")
-    else:
-        git_in(checkout, "commit", "-q", "--allow-empty", "-F", "-",
-               stdin=seed_message)
-    ahead = head_of(checkout)
-    assert git_in(checkout, "rev-list", f"{main}..HEAD") == ahead
-    assert git_in(checkout, "status", "--porcelain") == ""
-
-    result = run_wip(home, extra=env)
-
-    if disguise == "no-trailer":
-        # It put `handoffs/README.md` back into HEAD, so the "nothing written"
-        # check below has a different path to look at.
-        assert result.returncode == 2, result.stdout + result.stderr
-        assert "NOTHING was written" in result.stderr and \
-            "nothing was staged" in result.stderr, result.stderr
-        assert head_of(checkout) == ahead and remote_main(tmp_path) == main
-        assert staged_in(checkout) == ""
-        assert not (home / ".agents" / "workspace.yaml").exists()
-    else:
-        assert_refused_before_a_byte(result, checkout, home, tmp_path,
-                                     ahead, main)
-    assert "not every one of them is this command's own seed" in result.stderr, (
-        result.stderr)
-    assert f"{ahead[:7]} Seed this workspace repository from" in result.stderr, (
-        result.stderr)
-
-
-def git_at_least(major: int, minor: int) -> bool:
-    words = subprocess.run(["git", "--version"], capture_output=True,
-                           text=True, check=False).stdout.split()
-    try:
-        have = tuple(int(n) for n in words[2].split(".")[:2])
-    except (IndexError, ValueError):
-        return False
-    return have >= (major, minor)
-
-
-@pytest.mark.skipif(shutil.which("ssh-keygen") is None or not git_at_least(2, 34),
-                    reason="ssh commit signing needs ssh-keygen and git 2.34")
-def test_a_signed_seed_is_still_known_where_log_shows_signatures(tmp_path):
-    """`log.showSignature` IS A PERSON'S OWN CONFIG, AND IT WRITES ON STDOUT.
-
-    With it set, `git log --format=%s` prints the signature check's report
-    ahead of the subject, so a seed this command committed on a machine that
-    signs every commit read back as a commit whose first line is that report
-    — and step 6a would refuse the very seed its exemption is for. The
-    recognizer passes `--no-show-signature` on every `log` it runs. SSH
-    signing stands in for gpg because it needs no keyring: the report lands
-    on stdout either way.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, _, main = adopted_checkout_without(tmp_path, home, env)
-    key = tmp_path / "signing-key"
-    subprocess.run(["ssh-keygen", "-q", "-t", "ed25519", "-N", "", "-f",
-                    str(key)], check=True, capture_output=True)
-    for name, value in (("gpg.format", "ssh"),
-                        ("user.signingkey", f"{key}.pub"),
-                        ("commit.gpgSign", "true"),
-                        ("log.showSignature", "true")):
-        git_in(checkout, "config", name, value)
-    marker = ruleset_on(tmp_path)
-
-    first = run_wip(home, extra=env)
-    assert first.returncode == 2, first.stdout + first.stderr
-    assert "THAT IS THE RULESET" in first.stderr, first.stderr
-    seed = head_of(checkout)
-    assert "BEGIN SSH SIGNATURE" in git_in(checkout, "cat-file", "commit", seed), (
-        "the seed was supposed to be signed")
-
-    marker.unlink()
-    second = run_wip(home, extra=env)
-
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert ("one seed an earlier run committed is not on "
-            "opensoft/brettheap-wip main yet") in second.stdout, second.stdout
-    assert remote_main(tmp_path) == seed
-
-
-def test_an_empty_main_with_a_persons_local_commit_is_refused(tmp_path):
-    """WITH NO `main` ON THE REMOTE, EVERY LOCAL COMMIT IS AHEAD OF IT.
-
-    A repository an administrator created and nobody seeded, cloned here, and
-    a commit of the person's own made in it first: step 8's push would make
-    that commit the first thing on the workspace repository's `main`. The
-    range is all of HEAD, the refusal says the remote has no `main` yet, and
-    not one of the nine template files is written.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path, exists=True)
-    checkout = home / "projects" / "brettheap-wip"
-    checkout.parent.mkdir(parents=True)
-    bare = tmp_path / "github" / "opensoft" / "brettheap-wip.git"
-    subprocess.run(["git", "clone", "-q", str(bare), str(checkout)], check=True,
-                   capture_output=True)
-    git_in(checkout, "config", "user.email", "wip@example.invalid")
-    git_in(checkout, "config", "user.name", "wip init tests")
-    ahead = commit_of_their_own(checkout, "Start my own notes first",
-                                rel="notes.md")
-
-    result = run_wip(home, extra=env)
-
-    assert_refused_before_a_byte(result, checkout, home, tmp_path, ahead, "")
-    assert f"{ahead[:7]} Start my own notes first" in result.stderr, (
-        result.stderr)
-    assert "opensoft/brettheap-wip's main (it has none yet)" in result.stderr, (
-        result.stderr)
-    for rel in TEMPLATE_FILES:
-        assert not (checkout / rel).exists(), f"{rel} was written"
-
-
-def test_a_main_this_checkout_never_fetched_is_refused_not_read_as_nothing_ahead(
-        tmp_path):
-    """A RANGE THAT CANNOT BE LISTED IS NEVER AN EMPTY ONE (#49's lesson,
-    asked of history).
-
-    Another workstation pushed to `main` since this checkout last fetched, so
-    the commit `ls-remote` names is one this checkout does not have and
-    `rev-list <it>..HEAD` fails. An empty list read from that failure is
-    exactly what "nothing ahead" looks like; it is a refusal instead, with
-    git's own words and the fetch that settles it, before a byte is written.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, _, main = adopted_checkout_without(tmp_path, home, env)
-    elsewhere = tmp_path / "another-workstation"
-    bare = tmp_path / "github" / "opensoft" / "brettheap-wip.git"
-    subprocess.run(["git", "clone", "-q", str(bare), str(elsewhere)], check=True)
-    git_in(elsewhere, "config", "user.email", "wip@example.invalid")
-    git_in(elsewhere, "config", "user.name", "wip init tests")
-    commit_of_their_own(elsewhere, "A register write from another workstation")
-    git_in(elsewhere, "push", "-q", "origin", "HEAD:main")
-    moved = remote_main(tmp_path)
-    assert moved != main
-
-    result = run_wip(home, extra=env)
-
-    assert_refused_before_a_byte(result, checkout, home, tmp_path, main, moved)
-    assert "could not list the commits" in result.stderr, result.stderr
-    assert f"opensoft/brettheap-wip's main ({moved[:7]})" in result.stderr
-    assert "What it said:" in result.stderr and "    | " in result.stderr, (
-        result.stderr)
-    assert f"git -C {checkout} fetch origin" in result.stderr, result.stderr
-
-
-def test_a_branch_whose_name_ends_in_main_is_not_read_as_main(tmp_path):
-    """`ls-remote origin main` MATCHES EVERY REF WHOSE NAME ENDS IN `main`.
-
-    Step 8 read the FIRST line, and `refs/heads/backup/main` sorts before
-    `refs/heads/main` — so a person who had pushed their commit to a backup
-    branch, and not to `main`, had that branch's tip read as `main`: step 6a's
-    range came out empty, and step 8 said `main` "already carries this
-    commit" and never pushed, writing the pointer file over a `main` that did
-    not. The one read both steps share is `refs/heads/main` by name.
-    """
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    checkout, _, main = adopted_checkout_without(tmp_path, home, env)
-    ahead = commit_of_their_own(checkout, "Record a diary entry kept on a backup")
-    git_in(checkout, "push", "-q", "origin", "HEAD:refs/heads/backup/main")
-    listed = git_in(checkout, "ls-remote", "origin", "main").splitlines()
-    assert listed[0].endswith("refs/heads/backup/main"), listed
-
-    result = run_wip(home, extra=env)
-
-    assert_refused_before_a_byte(result, checkout, home, tmp_path, ahead, main)
-    assert f"{ahead[:7]} Record a diary entry kept on a backup" in result.stderr
-    assert f"opensoft/brettheap-wip's main ({main[:7]})" in result.stderr
-
-
-# --- one answer to one question, across the seam between two toolsets -------
-
-#: (name, the two yaml lines as a template, whether both sides must ACCEPT).
-#: `{origin}` is the bare repository, `{wip}` its clone's root.
-WORKSPACE_FIXTURES = (
-    ("the root of a checkout of the repository it names",
-     "repository: {origin}\npath: {wip}\n", True),
-    ("a subdirectory of that checkout rather than its root",
-     "repository: {origin}\npath: {wip}/lanes\n", False),
-    ("a checkout of some other repository",
-     "repository: {origin}\npath: {foreign}\n", False),
-    ("a path that is no checkout at all",
-     "repository: {origin}\npath: {nowhere}\n", False),
-    ("no `repository:` line",
-     "path: {wip}\n", False),
-    ("no `path:` line",
-     "repository: {origin}\n", False),
-)
-
-
-@pytest.mark.parametrize("what,yaml,accepted",
-                         WORKSPACE_FIXTURES,
-                         ids=[f[0] for f in WORKSPACE_FIXTURES])
-def test_wip_init_and_the_lane_helpers_read_one_pointer_file_the_same_way(
-        tmp_path, what, yaml, accepted):
-    """TWO IMPLEMENTATIONS OF ONE QUESTION, AND THE FILE SAYS THEY MUST AGREE.
-
-    `openRepoTools` carries `wip_config_file`, `wip_yaml_field`,
-    `wip_norm_repo` and `wip_is_checkout_of`; the four lane helpers carry
-    `lanes_ws_yaml`, `lanes_ws_field`, `lanes_ws_norm` and
-    `lanes_workspace_root`. They are separate code because the two toolsets are
-    separate files on a PATH — `wip init` cannot source a helper it may be
-    running before `--install` has placed, and a helper cannot source the
-    installer — and `openRepoTools`' own comment says what that costs: they
-    "have to agree on what 'already has a workspace' means, or a host can pass
-    one and fail the other."
-
-    That host is the failure this pins. `wip init` accepting means step 1
-    returns "nothing to do" and writes nothing ever again; the helpers refusing
-    means the register cannot be found. A person in that state has a command
-    that says they are set up and four commands that say they are not, and no
-    re-run of anything repairs it — which is precisely the shape of defect
-    Amendment 9(a) exists to remove, arriving through a different door.
-
-    Six fixtures, one `workspace.yaml` at a time, both sides asked.
-    """
-    home = tmp_path / "home"
-    agents = home / ".agents"
-    agents.mkdir(parents=True)
-    origin = tmp_path / "origin.git"
-    wip = home / "projects" / "brettheap-wip"
-    foreign = tmp_path / "foreign"
-    nowhere = tmp_path / "nowhere"
-    subprocess.run(["git", "init", "-q", "--bare", "-b", "main", str(origin)],
-                   check=True)
-    wip.parent.mkdir(parents=True, exist_ok=True)
-    subprocess.run(["git", "clone", "-q", str(origin), str(wip)], check=True)
-    (wip / "lanes").mkdir()
-    subprocess.run(["git", "init", "-q", "-b", "main", str(foreign)], check=True)
-    subprocess.run(["git", "-C", str(foreign), "remote", "add", "origin",
-                    "https://github.com/opensoft/somebody-else-wip.git"],
-                   check=True)
-
-    (agents / "workspace.yaml").write_text(
-        yaml.format(origin=origin, wip=wip, foreign=foreign, nowhere=nowhere),
-        encoding="utf-8")
-
-    env = wip_env(home, fake_gh(tmp_path))
-    tools = run_wip(home)
-    helper = subprocess.run(
-        ["bash", str(REPO / "lanes-edit.sh"), "who", "--lane", "repoA-1"],
-        capture_output=True, text=True, check=False, cwd=str(tmp_path), env=env)
-    unfound = "the workspace repository could not be found"
-
-    if accepted:
-        assert tools.returncode == 0, tools.stdout + tools.stderr
-        assert "nothing to do" in tools.stdout, (
-            f"`wip init` did not accept {what}")
-        assert unfound not in helper.stderr, (
-            f"`wip init` accepted {what} and `lanes-edit.sh` could not find it:\n"
-            f"{helper.stderr}")
-    else:
-        assert tools.returncode == 2, (
-            f"`wip init` did not refuse {what}:\n{tools.stdout}{tools.stderr}")
-        assert helper.returncode == 1, (
-            f"`lanes-edit.sh` did not refuse {what} with exit 1:\n{helper.stderr}")
-        assert unfound in helper.stderr, (
-            f"`lanes-edit.sh` refused {what} for some other reason:\n{helper.stderr}")
-        assert "no reason recorded" not in helper.stderr, (
-            "the refusal reached the person without the diagnosis it computed")
-
-
-# --- git's own words, on the three failures a fresh machine meets (F9) ------
-
-def test_a_clone_that_fails_prints_what_it_said_and_not_only_a_summary(tmp_path):
-    """THE COMMAND WHOSE JOB IS TO SET UP A NEW MACHINE MUST NOT SWALLOW THE
-    ONE SENTENCE THAT SAYS WHAT IS WRONG WITH IT (F9 of the #24 review, ruled
-    R-A9-15).
-
-    The clone, the stage and the commit all ran `>/dev/null 2>&1` and died with
-    a summary of this command's own devising: a machine with no credential got
-    `could not clone <target> into <path>. Nothing else was changed.` and
-    nothing else, when git had already said exactly what to do about it. Its
-    stderr is kept now and the last of it is printed UNDER the refusal — the
-    shape `fetch_from_repo`'s refusal already has.
-    """
-    home = tmp_path / "home"
-    result = run_wip(home, extra=fake_gh(tmp_path, refuse_clone=True))
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "could not clone" in result.stderr
-    assert "What it said:" in result.stderr, result.stderr
-    assert "terminal prompts disabled" in result.stderr, (
-        f"the refusal dropped the only sentence that says why:\n{result.stderr}")
-
-
-def test_a_commit_that_fails_prints_what_git_said(tmp_path):
-    """THE SAME RULE ON THE SEED COMMIT, which is the one a machine with no
-    `user.email` configured actually meets. A `pre-commit` hook standing in for
-    it, because the refusal under test is "whatever git said", not one
-    particular sentence git says."""
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path, exists=True)
-    checkout = home / "projects" / "brettheap-wip"
-    checkout.parent.mkdir(parents=True)
-    bare = tmp_path / "github" / "opensoft" / "brettheap-wip.git"
-    subprocess.run(["git", "clone", "-q", str(bare), str(checkout)], check=True)
-    hook = checkout / ".git" / "hooks" / "pre-commit"
-    hook.write_text("#!/bin/sh\necho 'the commit hook said no' >&2\nexit 1\n",
-                    encoding="utf-8")
-    hook.chmod(0o755)
-
-    result = run_wip(home, extra=env)
-    assert result.returncode == 2, result.stdout + result.stderr
-    assert "could not commit the seed" in result.stderr
-    assert "the commit hook said no" in result.stderr, (
-        f"the refusal dropped what git said:\n{result.stderr}")
-    assert not (home / ".agents" / "workspace.yaml").exists(), (
-        "the pointer file was written by a run that never committed")
-
-
-# --- the workspace ignores bytecode and caches (opensoft/openRepoTools#162) --
-
-#: What `openRepoTools`' `WIP_HYGIENE_LINES` adds to the seeded `.gitignore`.
-HYGIENE_LINES = ("__pycache__/", "*.pyc", "*.pyo", ".pytest_cache/", ".mypy_cache/",
-                 ".ruff_cache/", "node_modules/", ".venv/", "venv/", "site-packages/")
-
-
-def test_the_seeded_gitignore_ignores_bytecode_caches_and_venvs(tmp_path):
-    """Cause 19 of the cleanup analysis: generated bytecode was committed into
-    handoff attachments. The seed's `.gitignore` is the template's AND the
-    ten hygiene lines, so `git add` of an attachment folder never picks a
-    `__pycache__` up; the re-run compares the same bytes and has nothing to
-    do."""
-    home = tmp_path / "home"
-    env = fake_gh(tmp_path)
-    first = run_wip(home, extra=env)
-    assert first.returncode == 0, first.stdout + first.stderr
-    checkout = home / "projects" / "brettheap-wip"
-    lines = (checkout / ".gitignore").read_text(encoding="utf-8").splitlines()
-    template = (TEMPLATE / ".gitignore").read_text(encoding="utf-8").splitlines()
-    assert lines[:len(template)] == template, "the template's own lines come first, unchanged"
-    for line in HYGIENE_LINES:
-        assert lines.count(line) == 1, (line, lines)
-    probe = checkout / "handoffs" / "attachments" / "x" / "__pycache__" / "m.cpython-312.pyc"
-    probe.parent.mkdir(parents=True)
-    probe.write_bytes(b"\0")
-    ignored = subprocess.run(["git", "-C", str(checkout), "check-ignore", "-q", str(probe)],
-                             check=False)
-    assert ignored.returncode == 0, "the workspace would commit bytecode"
-    probe.unlink()
-    second = run_wip(home, extra=env)
-    assert second.returncode == 0, second.stdout + second.stderr
-    assert "nothing to do" in second.stdout
-
-
-@pytest.mark.parametrize("have,expect", [
-    ("*.swp\n", HYGIENE_LINES),
-    ("__pycache__/\n*.pyc\nvenv/\n", tuple(x for x in HYGIENE_LINES
-                                            if x not in ("__pycache__/", "*.pyc", "venv/"))),
-    ("".join(f"{x}\n" for x in HYGIENE_LINES), ()),
-])
-def test_a_hygiene_line_the_template_already_carries_is_not_repeated(tmp_path, have, expect):
-    """`wip_hygiene_lines`, by itself: the block less every line the file
-    already carries, and NOTHING - not even the comment - when it carries them
-    all, so a template that adopts the lines upstream seeds them once."""
-    gitignore = tmp_path / "gitignore"
-    gitignore.write_text(have, encoding="utf-8")
-    source = COMMAND.read_text(encoding="utf-8")
-    start = source.index("\nWIP_HYGIENE_LINES=(")
-    end = source.index("\n}\n", source.index("\nwip_hygiene_lines()", start)) + 3
-    proc = subprocess.run(["bash", "-c", source[start:end] + '\nwip_hygiene_lines "$1"\n',
-                           "bash", str(gitignore)], capture_output=True, text=True, check=False)
-    assert proc.returncode == 0, proc.stderr
-    added = [ln for ln in proc.stdout.splitlines() if ln and not ln.startswith("#")]
-    assert tuple(added) == expect
-    if not expect:
-        assert proc.stdout == ""
diff --git a/tests/test_wrapper_hardening_138.py b/tests/test_wrapper_hardening_138.py
deleted file mode 100644
index d7ae9ff2..00000000
--- a/tests/test_wrapper_hardening_138.py
+++ /dev/null
@@ -1,417 +0,0 @@
-# SPDX-License-Identifier: Apache-2.0
-"""The three wrapper fail-opens of opensoft/openRepoTools#138 (items 6, 13, 15).
-
-Each is a read the wrapper could not make, taken for an answer:
-
-  * item 13, `lane` (`go_live`): the window-name collision check asked only the
-    PUBLISHED register, so a lane whose row is committed here and not yet pushed
-    could have its window renamed out from under it;
-  * item 15, `lanes` (the empty listing's hidden-row probe): `grep -q .` under
-    `pipefail` ends its producer with SIGPIPE on a large listing, and the
-    pipeline's 141 read as "no hidden row";
-  * item 6, `lane-end --retire-dormant`: no capture file for the listing's
-    stderr left the "session records could not be read" sentence unread, and
-    the sweep went on.
-
-Older gaps beside those lines are closed with them: `lanes` claimed none was
-recorded when the hidden-row read itself FAILED, and `lane-end --retire-dormant`
-left its stderr capture file behind when the note could not be relayed, resumed
-after a signal that had removed it, and took an unreadable capture for an empty
-one.
-
-The register helper, tmux and mktemp are fakes on a controlled PATH, as in
-`test_guard_launch_mode.py`; nothing here touches a real register or a real
-tmux server.
-"""
-
-from __future__ import annotations
-
-import os
-import shutil
-import signal
-import stat
-import subprocess
-import time
-from pathlib import Path
-
-import pytest
-
-from conftest import REPO, WINDOWS_SKIP
-
-pytestmark = [WINDOWS_SKIP, pytest.mark.skipif(
-    shutil.which("bash") is None, reason="the wrappers are bash commands")]
-
-UUID = "aaaa0001-1111-4000-8000-aaaa00019999"
-TAB = "\t"
-
-
-def _script(path: Path, body: str) -> Path:
-    path.write_text("#!/usr/bin/env bash\n" + body)
-    path.chmod(path.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
-    return path
-
-
-class Box:
-    """A private HOME, a fake-first PATH and a clean environment."""
-
-    def __init__(self, tmp_path: Path) -> None:
-        self.root = tmp_path
-        self.home = tmp_path / "home"
-        self.home.mkdir()
-        self.bin = tmp_path / "bin"
-        self.bin.mkdir()
-        self.tmpdir = tmp_path / "tmp"
-        self.tmpdir.mkdir()
-        self.log = tmp_path / "calls.log"
-        self.log.write_text("")
-        self.env = {name: value for name, value in os.environ.items()
-                    if not name.startswith(("LANES_", "LANE_", "CLAUDE_", "TMUX", "FAKE_"))}
-        self.env.update(HOME=str(self.home), TMPDIR=str(self.tmpdir),
-                        AGENT_PROTOCOL_ROOT=str(self.home / ".agents"),
-                        FAKE_LOG=str(self.log),
-                        PATH=str(self.bin) + os.pathsep + self.env.get("PATH", ""))
-
-    def edit(self, body: str) -> Path:
-        """The fake `lanes-edit.sh`, named to the wrapper by `$LANES_EDIT`."""
-        path = _script(self.root / "lanes-edit-fake.sh", body)
-        self.env["LANES_EDIT"] = str(path)
-        return path
-
-    def calls(self) -> str:
-        return self.log.read_text()
-
-    def run(self, command: str, *args: str, **env: str) -> subprocess.CompletedProcess:
-        child_env = dict(self.env)
-        child_env.update(env)
-        return subprocess.run(["bash", str(REPO / command), *args], env=child_env,
-                              stdin=subprocess.DEVNULL, text=True, capture_output=True,
-                              timeout=60, check=False)
-
-
-@pytest.fixture
-def box(tmp_path: Path) -> Box:
-    return Box(tmp_path)
-
-
-# --- item 13: `lane`, go_live's window-name collision check -------------------
-
-#: A tmux with one window, `@31` of `picksess`, whose current name is the file
-#: `$FAKE_NAME_FILE`, and which logs every call. Every act succeeds.
-FAKE_TMUX = r'''
-printf '%s\n' "$*" >> "$FAKE_LOG"
-case "${1-}" in
-  display-message)
-    shift; t=""; f=""
-    while [ $# -gt 0 ]; do
-      case "$1" in -p) shift ;; -t) t="${2-}"; shift 2 ;; *) f="$1"; shift ;; esac
-    done
-    case "$f" in
-      '#{session_name}') [ "${t##*:}" = "@31" ] && printf 'picksess\n' || exit 1 ;;
-      '#{window_name}') cat "$FAKE_NAME_FILE" ;;
-      *) printf '\n' ;;
-    esac ;;
-  list-windows) printf '@31\t%s\n' "$(cat "$FAKE_NAME_FILE")" ;;
-  rename-window) for last; do :; done; printf '%s\n' "$last" > "$FAKE_NAME_FILE" ;;
-esac
-exit 0
-'''
-
-#: The register helper `lane <name>` reads a LIVE lane through. `thislane-1` is
-#: live in `@31`, and both of its register copies end in the live transcript.
-#: `otherlane-9` is the lane-shaped name the window carries now: its PUBLISHED
-#: row answers `$FAKE_PUB_RC` and its LOCAL row `$FAKE_LOCAL_RC` (0 prints a
-#: row, 8 says there is none, anything else is a read that failed).
-FAKE_LANE_EDIT = r'''
-sub="${1-}"; shift || :
-tab="$(printf '\t')"
-row_for() { printf '| %s | %s |\n' "$1" "$FAKE_UUID"; }
-other() {   # <rc> — what a register read about otherlane-9 answers
-  case "$1" in 0) row_for otherlane-9 ;; esac
-  return "$1"
-}
-case "$sub" in
-  workstation) printf 'Eagle\tseam\n' ;;
-  canon-lane) printf '%s\n' "$1" ;;
-  lanes)
-    printf '%s\n' "thislane-1${tab}LIVE${tab}Eagle${tab}team${tab}picksess:@31.%31${tab}${FAKE_UUID}${tab}/work${tab}none${tab}5m${tab}tmux attach${tab}owner/repo${tab}0${tab}here${tab}none${tab}2026-10-01${tab}none${tab}none" ;;
-  lane-groups) while IFS= read -r row; do [ -n "$row" ] && printf 'live\t%s\n' "$row"; done; exit 0 ;;
-  register-row)
-    printf 'register-row %s\n' "$1" >> "$FAKE_LOG"
-    case "$1" in thislane-1) row_for thislane-1 ;; otherlane-9) other "${FAKE_PUB_RC:-8}" ;; *) exit 8 ;; esac ;;
-  register-row-local)
-    printf 'register-row-local %s\n' "$1" >> "$FAKE_LOG"
-    case "$1" in thislane-1) row_for thislane-1 ;; otherlane-9) other "${FAKE_LOCAL_RC:-8}" ;; *) exit 8 ;; esac ;;
-  window-session) printf '%s\037%s\037%s\037%s\037%s\n' "$FAKE_UUID" "$1.%31" thislane-1 4242 team ;;
-  *) printf 'fake lanes-edit: unexpected subcommand %s\n' "$sub" >&2; exit 99 ;;
-esac
-'''
-
-
-def live_box(box: Box, window_name: str = "otherlane-9", pub: int = 8, local: int = 8):
-    name_file = box.root / "window-name"
-    name_file.write_text(window_name + "\n")
-    _script(box.bin / "tmux", FAKE_TMUX)
-    box.edit(FAKE_LANE_EDIT)
-    box.env.update(FAKE_NAME_FILE=str(name_file), FAKE_UUID=UUID,
-                   FAKE_PUB_RC=str(pub), FAKE_LOCAL_RC=str(local))
-    return name_file
-
-
-def test_live_attach_renames_a_window_no_register_row_names(box):
-    name_file = live_box(box)
-    result = box.run("lane", "thislane-1")
-    assert result.returncode == 0, result.stderr
-    assert "rename-window -t picksess:@31 thislane-1" in box.calls()
-    assert "attach -t picksess:@31" in box.calls()
-    assert name_file.read_text().strip() == "thislane-1"
-    # Both copies of the register were asked about the old name.
-    assert "register-row otherlane-9" in box.calls()
-    assert "register-row-local otherlane-9" in box.calls()
-
-
-def test_live_attach_refuses_a_window_named_for_a_row_not_yet_pushed(box):
-    name_file = live_box(box, pub=8, local=0)
-    result = box.run("lane", "thislane-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "otherlane-9, which has its own lane row" in result.stderr
-    assert "nothing was renamed or attached" in result.stderr
-    assert "rename-window" not in box.calls()
-    assert "attach" not in box.calls()
-    assert name_file.read_text().strip() == "otherlane-9"
-
-
-@pytest.mark.parametrize("local", [1, 2])
-def test_live_attach_fails_closed_when_the_local_row_cannot_be_read(box, local):
-    name_file = live_box(box, pub=8, local=local)
-    result = box.run("lane", "thislane-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "could not be read" in result.stderr and f"(exit {local})" in result.stderr
-    assert "rename-window" not in box.calls()
-    assert "attach" not in box.calls()
-    assert name_file.read_text().strip() == "otherlane-9"
-
-
-def test_live_attach_still_refuses_a_window_named_for_a_published_row(box):
-    live_box(box, pub=0, local=8)
-    result = box.run("lane", "thislane-1")
-    assert result.returncode == 2, (result.stdout, result.stderr)
-    assert "otherlane-9, which has its own lane row" in result.stderr
-    assert "rename-window" not in box.calls()
-
-
-# --- item 15: `lanes`, the empty listing's hidden-row probe ------------------
-
-#: `lanes` is empty (exit 8, no rows) and `lanes --closed` is `$FAKE_ROWS` rows
-#: of CLOSED lanes, written one printf at a time so that a reader which stops
-#: at the first line leaves the producer writing into a closed pipe, then exits
-#: `$FAKE_CLOSED_RC` where that is set (a read that FAILED, rows or no rows).
-FAKE_LANES_EDIT = r'''
-sub="${1-}"; shift || :
-case "$sub" in
-  workstation) printf 'Eagle\tseam\n' ;;
-  lanes)
-    case " $* " in
-      *" --closed "*)
-        i=0
-        while [ "$i" -lt "${FAKE_ROWS:-0}" ]; do
-          printf 'repoH-%s\tENDED\tEagle\tteam\tnone\t%s\t/work\tnone\t1d\tnone\towner/repoH\t0\there\tclosed\t2026-09-01\tnone\tnone\n' "$i" "$FAKE_UUID"
-          i=$((i + 1))
-        done
-        [ -z "${FAKE_CLOSED_RC:-}" ] || exit "$FAKE_CLOSED_RC"
-        [ "${FAKE_ROWS:-0}" -gt 0 ] || exit 8 ;;
-      *) exit 8 ;;
-    esac ;;
-  next-free) cat > /dev/null; printf '1\n' ;;
-  *) printf 'fake lanes-edit: unexpected subcommand %s\n' "$sub" >&2; exit 99 ;;
-esac
-'''
-
-
-def listing(box: Box, rows: int, closed_rc: int | None = None):
-    box.edit(FAKE_LANES_EDIT)
-    extra = {} if closed_rc is None else {"FAKE_CLOSED_RC": str(closed_rc)}
-    return box.run("lanes", "--prefix", "repoH", FAKE_ROWS=str(rows), FAKE_UUID=UUID, **extra)
-
-
-@pytest.mark.parametrize("rows", [1, 40000])
-def test_empty_listing_says_closed_rows_are_hidden_however_many_there_are(box, rows):
-    # 40000 rows of ~150 bytes is far past a pipe's buffer: the producer is
-    # still writing when a `grep -q` would have gone, and it would take SIGPIPE.
-    result = listing(box, rows)
-    assert result.returncode == 8, (result.stdout, result.stderr)
-    assert "is not the same as none being recorded" in result.stdout
-    assert "see them:" in result.stdout
-    assert "no lane of repoH is recorded" not in result.stdout
-
-
-def test_empty_listing_of_an_empty_repository_still_says_none_is_recorded(box):
-    result = listing(box, 0)
-    assert result.returncode == 8, (result.stdout, result.stderr)
-    assert "no lane of repoH is recorded." in result.stdout
-    assert "is not the same as none being recorded" not in result.stdout
-
-
-@pytest.mark.parametrize("rows", [0, 3])
-@pytest.mark.parametrize("closed_rc", [1, 2])
-def test_empty_listing_claims_nothing_when_the_hidden_row_read_fails(box, rows, closed_rc):
-    # A read that FAILED, with or without rows, is not "none is recorded".
-    result = listing(box, rows, closed_rc=closed_rc)
-    assert result.returncode == 8, (result.stdout, result.stderr)
-    assert "no lane of repoH is recorded" not in result.stdout
-    assert "could not be read" in result.stdout
-    assert f"exited {closed_rc}" in result.stdout
-
-
-def test_empty_listing_treats_rows_printed_before_an_exit_8_as_hidden(box):
-    # The real helper never does this; a listing that says "none is recorded"
-    # over rows it was just handed would be saying something it can see is false.
-    result = listing(box, 3, closed_rc=8)
-    assert result.returncode == 8, (result.stdout, result.stderr)
-    assert "is not the same as none being recorded" in result.stdout
-    assert "no lane of repoH is recorded" not in result.stdout
-
-
-# --- item 6: `lane-end --retire-dormant`, the stderr capture -----------------
-
-#: The sweep's read: one DORMANT row (class, the fourteenth column), and the
-#: sentence `lanes_rows` says on stderr when it could not read this
-#: workstation's session records, when `$FAKE_UNREAD` is 1. Where `$FAKE_READY`
-#: names a file the read touches it once its notes are written and then takes
-#: two seconds, so a test can signal the sweep mid-read. `retire-rows` is the
-#: sweep's one write and only logs that it was called.
-FAKE_SWEEP_EDIT = r'''
-sub="${1-}"; shift || :
-case "$sub" in
-  lanes)
-    [ "${FAKE_UNREAD:-0}" != 1 ] || printf "this workstation's session records could not be read\n" >&2
-    [ -z "${FAKE_NOTE:-}" ] || printf '%s\n' "$FAKE_NOTE" >&2
-    [ -z "${FAKE_READY:-}" ] || { : > "$FAKE_READY"; sleep 2; }
-    printf 'repoD-1\tNO LOG\tEagle\tnone\tnone\tnone\tnone\tnone\t9d\tnone\tnone\t0\there\tdormant\t2026-09-02\told cell\tnone\n' ;;
-  retire-rows) printf 'retire-rows %s\n' "$*" >> "$FAKE_LOG" ;;
-  *) printf 'fake lanes-edit: unexpected subcommand %s\n' "$sub" >&2; exit 99 ;;
-esac
-'''
-
-
-def sweep_box(box: Box, mktemp_works: bool = True, unread: bool = False):
-    register = box.root / "LANES.md"
-    register.write_text("# register\n")
-    box.edit(FAKE_SWEEP_EDIT)
-    box.env.update(LANES_FILE=str(register), LANES_REPO=str(box.root),
-                   LANES_LANE="repoW-1", FAKE_UNREAD="1" if unread else "0")
-    if not mktemp_works:
-        # The case under test is `mktemp` itself failing — a `$TMPDIR` that is
-        # full or read-only — while the shell's own temp files still work.
-        _script(box.bin / "mktemp", "exit 1\n")
-
-
-@pytest.mark.parametrize("extra", [(), ("--yes",)])
-def test_sweep_refuses_when_the_stderr_capture_cannot_be_made(box, extra):
-    sweep_box(box, mktemp_works=False)
-    result = box.run("lane-end", "--retire-dormant", "repoD", *extra)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "no temporary file could be made" in result.stderr
-    assert "Nothing was written" in result.stderr
-    assert "DRY RUN" not in result.stdout
-    assert "retire-rows" not in box.calls()
-
-
-@pytest.mark.parametrize("extra", [(), ("--yes",)])
-def test_sweep_refuses_on_unread_session_records(box, extra):
-    sweep_box(box, unread=True)
-    result = box.run("lane-end", "--retire-dormant", "repoD", *extra)
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "session records could not be read" in result.stderr
-    assert "retire-rows" not in box.calls()
-
-
-def test_sweep_dry_run_and_act_still_work_with_a_capture_file(box):
-    sweep_box(box)
-    dry = box.run("lane-end", "--retire-dormant", "repoD")
-    assert dry.returncode == 0, (dry.stdout, dry.stderr)
-    assert "DRY RUN" in dry.stdout and "repoD-1" in dry.stdout
-    assert "retire-rows" not in box.calls()
-    act = box.run("lane-end", "--retire-dormant", "repoD", "--yes")
-    assert act.returncode == 0, (act.stdout, act.stderr)
-    assert "retire-rows repoD-1 --writer repoW-1" in box.calls()
-
-
-@pytest.mark.skipif(not os.path.exists("/dev/full"), reason="needs /dev/full to fail a write")
-def test_sweep_leaves_no_capture_file_when_its_note_cannot_be_relayed(box):
-    # The read's stderr is relayed to the person's own; where that write fails
-    # the script exits under `set -e` before it reaches its `rm`.
-    sweep_box(box)
-    box.env["FAKE_NOTE"] = "a note to relay"
-    with open("/dev/full", "w") as full:
-        result = subprocess.run(["bash", str(REPO / "lane-end"), "--retire-dormant", "repoD"],
-                                env=box.env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
-                                stderr=full, text=True, timeout=60, check=False)
-    assert result.returncode != 0, result.stdout
-    assert "DRY RUN" not in result.stdout
-    assert list(box.tmpdir.glob("lane-end-sweep.*")) == []
-
-
-def signalled_sweep(box: Box, sig: signal.Signals) -> subprocess.Popen:
-    """`lane-end --retire-dormant repoD --yes`, sent `sig` ALONE (not its process
-    group) once `$FAKE_READY` appears, which the fake read or the slow `mktemp`
-    shim touches, and reaped. The caller has set `FAKE_READY`."""
-    if sig == signal.SIGINT and signal.getsignal(signal.SIGINT) is signal.SIG_IGN:
-        pytest.skip("SIGINT is ignored at entry, so no script can trap it")
-    ready = Path(box.env["FAKE_READY"])
-    proc = subprocess.Popen(["bash", str(REPO / "lane-end"), "--retire-dormant", "repoD", "--yes"],
-                            env=box.env, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE,
-                            stderr=subprocess.PIPE, text=True)
-    try:
-        deadline = time.monotonic() + 30
-        while not ready.exists() and time.monotonic() < deadline:
-            time.sleep(0.02)
-        assert ready.exists(), "the sweep never reached the read"
-        proc.send_signal(sig)
-        proc.communicate(timeout=60)
-    finally:
-        if proc.poll() is None:
-            proc.kill()
-            proc.wait()
-    return proc
-
-
-@pytest.mark.parametrize("sig", [signal.SIGTERM, signal.SIGINT])
-def test_sweep_does_not_resume_after_a_signal_during_the_read(box, sig):
-    # A signal that reaches the lane-end shell ALONE (not its process group)
-    # while the read runs. `cleanup` used to be the whole trap, so the script
-    # resumed after it: with the capture file gone the unread-records refusal
-    # read an empty note, and `--yes` went on to write.
-    sweep_box(box, unread=True)
-    box.env["FAKE_READY"] = str(box.root / "ready")
-    proc = signalled_sweep(box, sig)
-    assert proc.returncode == 128 + sig, proc.returncode
-    assert "retire-rows" not in box.calls()
-    assert list(box.tmpdir.glob("lane-end-sweep.*")) == []
-
-
-@pytest.mark.parametrize("sig", [signal.SIGTERM, signal.SIGINT])
-def test_sweep_leaves_no_capture_file_when_a_signal_lands_as_it_is_made(box, sig):
-    # The window between `mktemp` creating the file and `cleanup` knowing its
-    # name: a `mktemp` that takes a moment after it has made the file.
-    sweep_box(box)
-    box.env["FAKE_READY"] = str(box.root / "ready")
-    _script(box.bin / "mktemp",
-            f'f="$({shutil.which("mktemp")} "$@")" || exit $?\n'
-            ': > "$FAKE_READY"\nsleep 2\nprintf \'%s\\n\' "$f"\n')
-    proc = signalled_sweep(box, sig)
-    assert proc.returncode == 128 + sig, proc.returncode
-    assert "retire-rows" not in box.calls()
-    assert list(box.tmpdir.glob("lane-end-sweep.*")) == []
-
-
-def test_sweep_refuses_when_the_capture_cannot_be_read_back(box):
-    # `cat` fails on the capture file, which `|| printf ''` used to turn into
-    # an empty note, and an empty note is the one that never refuses.
-    sweep_box(box, unread=True)
-    _script(box.bin / "cat", f'case "$*" in *lane-end-sweep.*) exit 1 ;; esac\nexec {shutil.which("cat")} "$@"\n')
-    result = box.run("lane-end", "--retire-dormant", "repoD", "--yes")
-    assert result.returncode == 1, (result.stdout, result.stderr)
-    assert "could not be read back" in result.stderr
-    assert "Nothing was written" in result.stderr
-    assert "retire-rows" not in box.calls()
-    assert list(box.tmpdir.glob("lane-end-sweep.*")) == []
diff --git a/upstream/openRepoShape b/upstream/openRepoShape
deleted file mode 160000
index 190133d5..00000000
--- a/upstream/openRepoShape
+++ /dev/null
@@ -1 +0,0 @@
-Subproject commit 190133d5e704e380c430f87ca9c4e31746de0012